Fixed in this release

Bug ID · Description

573622417 · Fixed an issue where apigee-ingressgateway forwarded the x-envoy-decorator-operation header to upstream runtime and target backends.

571378258 · The apigee-redis container now uses the Valkey engine (version 8.1.10). The RESP2 wire protocol and redis-server and redis-cli binary names are unchanged.

568860869 · Fixed an issue in the RegularExpressionProtection policy where patterns starting and ending with .* whose middle section contained regular expression syntax were matched as literal text instead of regular expressions.

565072374 · Fixed an issue where VerifyJWT policies using a JWKS uriRef could return steps.jwt.NoMatchingPublicKey on the first request after the 5-minute JWKS cache TTL expired when the identity provider rotated keys. The cache now refreshes synchronously upon expiration.

535395491 · Extension Processor (ext_proc) denials now return the status and body that the policy or FaultRule produced, instead of always returning HTTP 500.

524115876 · Fixed an intermittent HTTP 400 error in the OASValidation policy's strict parameter validation that rejected valid requests under load.

519729209 · Fixed a SAML XML Signature Wrapping vulnerability in the ValidateSAMLAssertion policy.

502231886 · Fixed an issue where the SanitizeUserPrompt and SanitizeModelResponse policies failed to extract content using default source templates when the <Source> element was omitted and <IgnoreUnresolvedVariables> was set to false.

432315283 · Fixed an issue where changes to a multi-certificate truststore's trust anchors required a Message Processor restart when features.truststore.multi_cert_bundle.enabled was toggled at runtime; the outbound SSLContext now rebuilds automatically.