Fixed in this release

Bug ID · Description

565753858 · Fixed an issue where the apigee-mcp-server controller dropped pod-level volumes configured on the mcpServer component (such as fwi-token volumes when Federated Workload Identity is enabled), causing ReplicaSet creation to fail.

565072374 · Fixed an issue where VerifyJWT policies using a JWKS uriRef could return steps.jwt.NoMatchingPublicKey on the first request after the 5-minute JWKS cache TTL expired when the identity provider rotated keys. The cache now refreshes synchronously upon expiration.

564969400 · Fixed an issue where variables initialized from an empty <Value/> element in AssignMessage (AssignVariable) were not treated as empty strings when referenced in message template functions such as replaceAll.

563557547 · Fixed an issue where EventFlow (Server-Sent Events) could coalesce multiple events into a single policy invocation under burst traffic on the http-adaptor datapath, producing malformed SSE responses.

560372165 · Fixed a synchronizer readiness-gate deadlock that could leave a Message Processor on an older contract revision and return 404 ApplicationNotFound for newly deployed standard proxies.

560130499 · Fixed a security issue by hardening the JavaCallout policy sandbox.

558888960 · Fixed an issue in distributed tracing where the target URL was omitted from outbound target request span attributes after a request-flow policy step executed.

556750755 · Fixed an issue where EventFlow (Server-Sent Events) dropped or truncated events following a large (>16 KB) event under load on the http-adaptor datapath.

556680325 · Fixed a server-side request forgery (SSRF) vulnerability in URL host validation for the SemanticCacheLookup policy.

554114419