OAS Validator Changelog
Released changes to the OAS Validator plugin (`oas-validator`), newest release first.
12 released changes name oas-validator, newest release first — 1 in Apache APISIX, 11 in API7 Gateway. Each row links to the change itself.
| Release | Date | Type | Change |
|---|
| 3.10.4 (opens in API7 Gateway docs) | 2026-07-27 | Feature | Added max_req_body_size and max_resp_body_size to bound how much of a request or response body a plugin reads into memory, defaulting to 67108864 bytes (64 MiB). A request body larger than the limit is rejected, and a… (opens in API7 Gateway docs) |
| 3.9.17 (opens in API7 Gateway docs) | 2026-07-28 | Feature | Added max_req_body_size and max_resp_body_size to bound how much of a request or response body a plugin reads into memory, defaulting to 67108864 bytes (64 MiB). A request body larger than the limit is rejected, and a… (opens in API7 Gateway docs) |
| 3.9.12 (opens in API7 Gateway docs) | 2026-05-08 | Feature | Added spec_url field that loads the OpenAPI specification from a remote HTTP(S) URL instead of embedding the full JSON inline in the plugin configuration. This is useful when the spec exceeds the 2 MB inline size limi… (opens in API7 Gateway docs) |
| 3.9.12 (opens in API7 Gateway docs) | 2026-05-08 | Fix | Fixed issue: Header parameter validation was case-sensitive, causing requests to be rejected when the header name casing did not exactly match the OpenAPI specification (for example, sending X-Request-Id when the spec… (opens in API7 Gateway docs) |
| 3.9.11 (opens in API7 Gateway docs) | 2026-04-30 | Feature | Replaced the Go FFI-based OpenAPI validator with a pure-Lua implementation (lua-resty-openapi-validator). Internal benchmarks on a real-world large-scale OpenAPI specification (Stripe, ~414 endpoints) show the new val… (opens in API7 Gateway docs) |
| 3.9.8 (opens in API7 Gateway docs) | 2026-04-07 | Feature | Added a configurable rejection_status_code option (400–599, default 400). This allows distinguishing semantic validation errors (e.g., 422 Unprocessable Entity) from malformed request syntax (400 Bad Request). (opens in API7 Gateway docs) |
| 3.9.8 (opens in API7 Gateway docs) | 2026-04-07 | Feature | Added support for OpenAPI 3.1 specification validation, including features such as exclusiveMinimum/exclusiveMaximum as numbers, if/then/else conditional schemas, nullable types via ["string", "null"], const, patternP… (opens in API7 Gateway docs) |
| 3.9.6 (opens in API7 Gateway docs) | 2026-03-09 | Feature | Added a new parameter reject_if_not_match. When set to false, it allows requests to pass to upstream services even if they fail OAS validation. (opens in API7 Gateway docs) |
| 3.8.9 (opens in API7 Gateway docs) | 2025-08-11 | Fix | Fixed issue: Adjusted error level for detailed response errors from error to warn when verbose_errors is enabled. (opens in API7 Gateway docs) |
| 3.8.2 (opens in API7 Gateway docs) | 2025-05-19 | Fix | Fixed issue: OAS Validator plugin incorrectly rejecting numbers between 1.11-1.19 with multipleOf: 0.01 rule. (opens in API7 Gateway docs) |
| 3.7.5 (opens in API7 Gateway docs) | 2025-05-19 | Fix | Fixed issue: OAS Validator plugin incorrectly rejecting numbers between 1.11-1.19 with multipleOf: 0.01 rule. (opens in API7 Gateway docs) |
