Skip to main content
API7.ai Logo

Review Changes Before Upgrade

Upgrading an existing APISIX deployment to this version can change plugin defaults, metric labels, and authentication checks. Review these changes before shifting production traffic. Follow the linked plugin and reference pages for field definitions, examples, and procedures.

For a gradual traffic shift onto new nodes, see Canary Deployment.

Observability and Debug Output​

  • The Apisix-Plugins response header lists plugin-name#phase entries in execution order instead of a de-duplicated plugin-name list. Update tools that parse that header. See Debug Mode.
  • apisix_llm_latency adds a type label. Select type="total" to keep the previous total-latency meaning. Streaming requests record both total and ttft. See Prometheus and Monitor APISIX with Prometheus.
  • Batch-processor loggers default max_pending_entries to 8192 and discard entries above that limit. Size the backlog against log body size and worker memory. See Batch Processor.

Request and Response Body Limits​

Several plugins that buffer request or response bodies now default to a 64 MiB cap. Oversized requests can be rejected. Oversized responses can be truncated or passed through without caching, depending on the plugin. Set max_req_body_size or max_resp_body_size on routes that must accept larger payloads. The field tables are on the affected Plugin Hub pages, including request-validation, response-rewrite, and proxy-cache.

JSON and multipart bodies read for post_arg.* route matching use the same 64 MiB default. A larger body no longer matches the predicate. See Router Options.

AI Plugins​

Authentication and Identity​

  • openid-connect fails closed when the trusted issuer cannot be determined, treats claim_validator.audience.match_with_client_id as requiring an audience claim, and enforces required_scopes on authorization-code sessions. Configure claim_validator.issuer.valid_issuers when discovery can be unavailable.
  • The Admin API rejects a write that would assign the same lookup key to two consumers or credentials for key-auth, basic-auth, jwt-auth, hmac-auth, or LDAP authentication. The check is best-effort and cannot resolve Secret or environment references. See Consumers.
  • ldap-auth now performs certificate verification when tls_verify is true. Self-signed or hostname-mismatched LDAP certificates fail until you install a matching trusted certificate or disable verification deliberately.
  • ldap-auth looks up consumers with the RFC 4514-escaped bind DN. Consumers whose usernames contain characters such as commas or plus signs must use that escaped user_dn form.

Logging, Forwarding, and Custom Plugins​

  • sls-logger defaults ssl_verify to true and sends SNI. Custom or self-signed logging endpoints need a trusted certificate, or you must set ssl_verify: false after assessing the risk.
  • Lua no longer exposes ctx.var.var_x_forwarded_proto, ctx.var.var_x_forwarded_host, or ctx.var.var_x_forwarded_port. Use core.request.set_header to change upstream forwarding headers. See Configuration Files.