Docs

Chaitin WAF Changelog

Released changes to the Chaitin WAF plugin (`chaitin-waf`), newest release first.

11 released changes name chaitin-waf, newest release first — 5 in Apache APISIX, 6 in API7 Gateway. Each row links to the change itself.

Apache APISIX

API7 Gateway

ReleaseDateTypeChange
3.10.7 (opens in API7 Gateway docs)2026-09-08FixFixed issue: Setting any option in a route- or service-level config block reset every option it did not set, discarding the values configured in the plugin metadata. A route that set only read_timeout silently reverte… (opens in API7 Gateway docs)
3.10.7 (opens in API7 Gateway docs)2026-09-08FeatureThe response can now be reported to the SafeLine detection service alongside the request, so data leaked in a response body, an exploit's output, or an unexpected status code becomes visible to SafeLine. Three options… (opens in API7 Gateway docs)
3.9.20 (opens in API7 Gateway docs)2026-09-03FixFixed issue: Setting any option in a route- or service-level config block reset every option it did not set, discarding the values configured in the plugin metadata. A route that set only read_timeout silently reverte… (opens in API7 Gateway docs)
3.9.20 (opens in API7 Gateway docs)2026-09-03FeatureThe response can now be reported to the SafeLine detection service alongside the request, so data leaked in a response body, an exploit's output, or an unexpected status code becomes visible to SafeLine. Three options… (opens in API7 Gateway docs)
3.9.13 (opens in API7 Gateway docs)2026-05-22FixChaitin WAF and Wolf RBAC: Fixed issue: The plugins used raw client-supplied IP headers when sending client IP information to their backend services. They now use the trusted real client IP resolved by the gateway. (opens in API7 Gateway docs)
3.8.9 (opens in API7 Gateway docs)2025-08-11FeatureBackported Chaitin WAF plugin from APISIX to API7 Enterprise. (opens in API7 Gateway docs)