v7.6.0

New Features

• wsdl2openapi: map XSD facets (length/min/max constraints), default/fixed values, and nillable through to generated OpenAPI schemas #3158
• OpenAPI: validate $ref siblings recursively in OpenAPI 3.1 schemas #3191

Improvements

• Improve logging of client disconnects and body-read failures for clearer diagnostics #3192
• sslProxy: renamed the sslInterceptors child element to interceptors — update existing configs using this attribute #3208

Fixes

• HTTP client: fix retry body replay and proxy CONNECT handling #3212
• sslProxy: register the proxy's SSLContext so passthrough actually forwards traffic — broken since sslProxy was introduced #3205
• RuleResolver: report internal proxy flow failures instead of swallowing them #3203
• Abort the response flow the same way as the request flow, so a failed interceptor no longer lets an unfiltered backend response reach the client #3198 #3202
• OpenAPI: honour nullable when allOf/oneOf/anyOf is present #3189
• annot: map boxed and integral @MCAttribute types correctly in the generated JSON/XML schema #3232
• Validator: fix duplicate init, incomplete error reporting, and lost validation exceptions #3242
• WSDLValidator: report rejections as a SOAP 1.1 or SOAP 1.2 fault matching the request's SOAP version #3241
• Fix matchesPath to prevent base-path conflicts #3177
• Check Content-Length/Transfer-Encoding before the request method when deciding whether a body is expected #3183
• Honor the declared charset when parsing XML bodies (XmlDomBody, XMLUtil.getInputSource) #3234 #3142
• Retry a request when establishing the connection timed out #3170
• CLI: fix start -t to perform a dry run as documented #3228
• Tutorials: fix Windows docker launcher scripts masking a failed container's exit status #3207
• Fail on truncated bodies instead of silently NUL-padding them #3195

Security

• xmlProtection: add a configurable attribute-name-length limit, multipart body scanning, and hardened charset/DOCTYPE handling #3194
• xmlProtection: add a maxDepth limit for nested elements #3143
• jsonProtection: scan JSON documents inside multipart attachments #3180
• Fix path exposure in production mode for WebServerInterceptor error responses #3176
• CLI: harden option parsing/validation/help across all subcommands; restrict generate-jwk private key file permissions to the owner and prevent symlink overwrite #3228

Dependencies

• Bump log4j-api and (dev) async-http-client #3160 #3178

v7.5.0

New Features

• Add wsdl2openapi, an interceptor that exposes a WSDL-based SOAP service as an OpenAPI/REST API, transforming JSON requests/responses to/from SOAP #3100
• Add WS-Security support for SOAP: XML-DSig signing/verification, UsernameToken, and wsu:Timestamp, including tutorials #3116
• Add a tutorial for lokiExchangeStore #3115

Improvements

• Lift the 3 MiB SnakeYAML size limit on OpenAPI documents, which previously caused large specs to fail with "the incoming YAML document exceeds the limit" #3122
• Parse each OpenAPI document only once instead of re-reading/re-parsing it up to three times, reducing parse cost and network calls for remote specs #3125
• WSDLValidator now validates SOAP 1.1/1.2 fault structures and detail elements against the WSDL schema #3135
• OAuth2 session storage now uses ConcurrentHashMap #3132

Fixes

• Surface SAX parse errors from XSLTInterceptor as problem details instead of an unhandled exception #3134
• Rebuild the HttpClient when setHttpClientConfig() is called after init() #3131
• Schema validation now resolves $ref before reading allOf/anyOf/oneOf/not, fixing composition keywords being silently skipped on referenced schemas (reported by @schiller-hank) #3120

Full changelog: 7.4.0...7.5.0
v7.4.0...v7.5.0

v7.4.0

New Features

• openapi: add an opt-in maskValues attribute that masks submitted values in validation error messages (response, log, or both) so PII isn't leaked in echoed values #3101
• Add LokiExchangeStore to push completed and failed exchanges to Grafana Loki for visualization via LogQL #3106
• openapi: support a basePath override for OpenAPI server URLs, with new rewriting tutorials covering automatic, explicit, and reverse-proxy setups #3093 #3094

Fixes

• Fix a body-length overflow that corrupted responses for bodies >= 2 GB by widening getLength()/getContent() to 64-bit across Body, ChunkedBody, and HTTP/2 bodies #3102
• Fix --dry-run failing for YAML configurations #3105
• Allow /api-docs and related paths to match even when a custom path is configured on the API proxy #3091

Security

• Patch OS packages in the runtime image to fix a tar CVE (Snyk finding on the Ubuntu base image) #3092

Full changelog: 7.3.1...7.4.0
v7.3.1...v7.4.0

v6.6.0

New Features

• Add an opt-in maskValues attribute on <openapi> to redact submitted values from validation error messages (e.g. "5 is smaller than the minimum of 18"), configurable independently for the response and the log (none | response | log | both, default none) #3103

Improvements

• Validate application/x-www-form-urlencoded request/response bodies against the OpenAPI schema, instead of rejecting them with a "not implemented yet" error (downport of #2985) #3099

Full changelog: 6.5.4...6.6.0 — v6.5.4...v6.6.0

v6.5.4

6.5.4 is a bugfix release that fixes XML issues

Fixes

• XML security fixes

Full changelog: v6.5.3...v6.5.4

v7.3.1

7.3.1

7.3.1 is a maintenance release that fixes SOAP/WSDL schema validation for WSDLs whose payloads span multiple embedded schemas.

Improvements

• SOAP/WSDL schema validation no longer logs spurious per-schema errors for a message that is valid against another schema embedded in the same WSDL; a genuine failure is now logged once with all collected errors #TBD
• Add an XSLT parameter tutorial showing how string-valued Exchange properties are passed to a stylesheet as xsl:param values #3076

Fixes

• WSDL validation now resolves namespace-only <xsd:import> references between schemas embedded in the same WSDL, fixing a startup failure (Cannot read schema … src-resolve: Cannot resolve the name ..) #TBD
• SOAP message validation now strips only the SOAP envelope's <Body>, preserving domain elements named Body in other namespaces that were previously dropped and caused false cvc-complex-type validation errors #TBD

Full changelog: v7.3.0...v7.3.1

v7.3.0

7.3.0 is a significant security and extensibility release. It adds OpenAPI 3.2 support, new protection plugins (MCP, SQL injection, HTTP method validation, and JSON-RPC), live YAML configuration reloading, and a wave of new tutorials covering OAuth2, JWT, API Keys, Prometheus, and OpenTelemetry.

New Features

• AI gateway: add per-user token limits, usage tracking, and an OpenAI API interceptor with concurrent rate limiting #2965
• Add mcpProtection plugin for securing MCP (Model Context Protocol) endpoints with JSON-RPC request validation and schema enforcement #2977
• Add jsonRpcProtection plugin for JSON-RPC request validation with method allow-listing and parameter schema checks #2963
• Add SQL injection detection and blocking via a new sqlInjectionProtection interceptor #3031
• Add HTTP method validation with configurable allow/block policies via a new methodValidator interceptor #3032
• Support live YAML configuration reloading: the gateway now detects file changes and hot-deploys the updated config without a restart #2959
• Support OpenAPI 3.2 specifications for request/response validation #3007
• Add new tutorials for OAuth2 #3020, API Keys #3019, JWT authentication #3021, Prometheus monitoring #3023, OpenTelemetry tracing #3022, and configuration includes #3025

Improvements

• OpenAPI validation now rejects non-integer values supplied for integer-typed properties #3006
• Improve JWT error handling and logging with proper SLF4J placeholder syntax #2970
• Fix CRLF line endings in Windows startup scripts #3008

Fixes

• Handle ConfigurationException gracefully during XML/schema validator initialization instead of propagating a startup failure #3005
• HTTP/2: ignore unknown frame types instead of killing the connection #3044
• Set XML entity size limits in JAVA_OPTS to restore compatibility with Java 25 #3027

Dependencies

• Reduce dependency vulnerabilities in pom.xml #3003
• Upgrade Jackson to 2.21.4 #3012

Full changelog: v7.2.4...v7.3.0

v7.2.5

Security

• Update Jackson to 2.21.4 to address CVE-2026-54512 and CVE-2026-54513

v6.5.3

Improvements

• OpenTelemetryInterceptor now populates the logging MDC, so trace and span IDs are available to log statements #2981
• Log OpenAPI request and response validation failures #2984

Fixes

• Handle a null query string correctly in getPathAndQuery #2927

Security

• Update Jackson to 2.21.4 to address CVE-2026-54512 and CVE-2026-54513

Full changelog: v6.5.2...v6.5.3

v7.2.4

New Features

• Add correlationId support for tracing requests across services #2987
• soapBodyTemplate: allow an explicit Content-Type override #2996

Improvements

• OpenAPI validation now covers multipart #2980, XML #2976 and form-url-encoded #2985 request bodies
• Log OpenAPI request/response validation failures #2982
• for: support use in the response flow #2995
• jwtSigner: store the signed JWT in the body or in a property #2986
• Optimize the javadoc descriptions of interceptors #2990

Fixes

• ResolverMap.combine: fix combining paths like ?foo=http:// #2997

Full changelog: v7.2.3...v7.2.4