Fixed in this release

Bug ID · Description

565072374 · Fixed an issue where VerifyJWT policies using a JWKS uriRef could return steps.jwt.NoMatchingPublicKey on the first request after the 5-minute JWKS cache TTL expired when the identity provider rotated keys. The cache now refreshes synchronously upon expiration.

556680325 · Fixed a server-side request forgery (SSRF) vulnerability in URL host validation for the SemanticCacheLookup policy.

535395491 · Extension Processor (ext_proc) denials now return the status and body that the policy or FaultRule produced, instead of always returning HTTP 500.

513032450 · Fixed an issue where apigee-connect-agent control-plane connections could hang for up to 2 hours when silently dropped by a network intermediary by restoring a 15-second TCP keep-alive.

502540992 · Fixed an issue where the SemanticCacheLookup policy was incompatible with Vertex AI Vector Search Private Service Connect (PSC) endpoints by adding gRPC transport support via <PrivateServiceConnect><GrpcEndpoint>.

492042425 · Fixed an issue in the LLMTokenQuota policy where operation-level token quota values configured on an API product were not applied at runtime, causing product-level quota values to be enforced instead.