API gateways and management

Added Basic authentication to the New Edge UI, which lets you sign in without configuring an identity provider.

The New Edge UI supports Basic authentication without additional configuration. You can also configure Apigee SSO, or an external identity provider such as SAML or OIDC. This feature is generally available in 4.54.00.

Added automated pre-flight validation checks to apigee-setup and apigee-service, which surface environment configuration problems before a component is…

Added automated pre-flight validation checks to apigee-setup and apigee-service, which surface environment configuration problems before a component is installed.

Fixed multiple security vulnerabilities in Apigee Edge for Private Cloud 4.54.00.

These fixes ship as part of the component upgrades in this release; see Changes in Edge for Private Cloud 4.54.00.

Upgraded Nginx on the Edge Router to 1.30.0.

If you are upgrading from Nginx 1.20.x, see Nginx 1.30 changes in Apigee Edge 4.54.00 for the full list of changes.

Bug ID · Component · Description

Bug ID Component Description 560310696 SSO Fixed an issue where the Portal SSO endpoint inadvertently accepted deprecated TLS 1.1 connections. The endpoint now strictly enforces TLS 1.2+.

Replaced the Classic UI (edge-ui) with the New Edge UI (edge-management-ui).

Replaced the Classic UI ( edge-ui ) with the New Edge UI ( edge-management-ui ).

4.54.00 runs Java in mixed mode: Java 17 for Cassandra and ZooKeeper, Java 21 for the Management Server, Message Processor, Router, and Qpid Broker-J.

Both Oracle JDK and OpenJDK are supported at those versions.

Bug ID · Description

Bug ID Description 466116259 Updated the startup script for the managed instance group (MIG) that routes external traffic to Apigee. net.ipv4.ip_forward is now written to /etc/sysctl.d/, so an instance no longer stops forwarding traffic when a reboot or an OS update resets it.

This release replaces Java 8 with Java 17 and Java 21, removes the Classic UI and the apigee-sso component, and updates the bundled Cassandra, Postgres,…

This release replaces Java 8 with Java 17 and Java 21, removes the Classic UI and the apigee-sso component, and updates the bundled Cassandra, Postgres, OpenLDAP, ZooKeeper, Qpid Broker-J, Nginx, and Consul versions. These changes are not backward-compatible.

On October 15, 2026, we released a new version of the Apigee integrated portal.

Changed the TLS defaults on Message Processors to the Java 21 cryptographic baseline.

Message Processors run on Java 21, which enables TLS 1.3 by default ( JEP 332 ) and prefers it for outbound backend connections, falling back to TLS 1.2.

In deployments with Apigee SSO enabled, an integrated OIDC identity broker in apigee-openldap replaces the standalone apigee-sso component and Apache Tomcat…

In deployments with Apigee SSO enabled, an integrated OIDC identity broker in apigee-openldap replaces the standalone apigee-sso component and Apache Tomcat 9.0.x.

Released Apigee Edge for Private Cloud 4.54.00.

Designated Apigee Edge for Private Cloud 4.54.00.00 a long-term support (LTS) release: 18 months of full support ending April 2028, then 18 months of maintenance ending October 2029.

On October 15, 2026, we began releasing Single Sign-On (SSO) updates for Apigee Edge for Public Cloud.

Changed the default garbage collector on Message Processors to the Garbage-First garbage collector.

Message Processors set useG1GC=true and useStringDeduplication=true by default in 4.54.00. In 4.53.01 neither was set by default. To configure garbage collection, see Configure the garbage collector for Message Processors.

Fixed in this release

Bug ID Description 565072374 Fixed an issue where VerifyJWT policies using a JWKS uriRef could return steps.jwt.NoMatchingPublicKey on the first request after the 5-minute JWKS cache TTL expired when the identity provider rotated keys.

Bug ID · Description

Bug ID Description N/A Security fixes for apigee-fluent-bit. This addresses the following vulnerabilities: CVE-2026-35189

v1.16.11

On October 14, 2026 we released an updated version of the Apigee hybrid software, v1.16.11.

Public Preview: Microsoft Agent 365 integration with Azure API Management

The integration between Microsoft Agent 365 and Azure API Management is now available in public preview, helping organizations connect centralized governance with runtime enforcement for MCP servers and tools.

Fixed in this release

Bug ID Description 565072374 Fixed an issue where VerifyJWT policies using a JWKS uriRef could return steps.jwt.NoMatchingPublicKey on the first request after the 5-minute JWKS cache TTL expired when the identity provider rotated keys.