Fixed in this release

Bug ID · Description

535928300 · Fixed a security issue in JWT refresh token revocation handling.

535683286 · Fixed a security issue in HTTP target interim-response (103 Early Hints) handling to prevent response desynchronization.

534852923 · Fixed a security issue in the JavaCallout policy.

534420582 · The JSONThreatProtection policy now supports an optional <RejectDuplicateKeys> child element that rejects JSON payloads containing duplicate keys within the same object.

531773665 · Fixed an issue where the VerifyAPIKey policy could fail with a NullPointerException when reading developer attributes.

469642464 · Improved input validation in AI protection policies to prevent server-side request forgery (SSRF).

449228485 · Apigee hybrid now supports configuring custom Kubernetes PodDisruptionBudget (minAvailable or maxUnavailable) values for Apigee hybrid components in your overrides.yaml file.