v7.3.0

7.3.0 is a significant security and extensibility release. It adds OpenAPI 3.2 support, new protection plugins (MCP, SQL injection, HTTP method validation, and JSON-RPC), live YAML configuration reloading, and a wave of new tutorials covering OAuth2, JWT, API Keys, Prometheus, and OpenTelemetry.

New Features

• AI gateway: add per-user token limits, usage tracking, and an OpenAI API interceptor with concurrent rate limiting #2965
• Add mcpProtection plugin for securing MCP (Model Context Protocol) endpoints with JSON-RPC request validation and schema enforcement #2977
• Add jsonRpcProtection plugin for JSON-RPC request validation with method allow-listing and parameter schema checks #2963
• Add SQL injection detection and blocking via a new sqlInjectionProtection interceptor #3031
• Add HTTP method validation with configurable allow/block policies via a new methodValidator interceptor #3032
• Support live YAML configuration reloading: the gateway now detects file changes and hot-deploys the updated config without a restart #2959
• Support OpenAPI 3.2 specifications for request/response validation #3007
• Add new tutorials for OAuth2 #3020, API Keys #3019, JWT authentication #3021, Prometheus monitoring #3023, OpenTelemetry tracing #3022, and configuration includes #3025

Improvements

• OpenAPI validation now rejects non-integer values supplied for integer-typed properties #3006
• Improve JWT error handling and logging with proper SLF4J placeholder syntax #2970
• Fix CRLF line endings in Windows startup scripts #3008

Fixes

• Handle ConfigurationException gracefully during XML/schema validator initialization instead of propagating a startup failure #3005
• HTTP/2: ignore unknown frame types instead of killing the connection #3044
• Set XML entity size limits in JAVA_OPTS to restore compatibility with Java 25 #3027

Dependencies

• Reduce dependency vulnerabilities in pom.xml #3003
• Upgrade Jackson to 2.21.4 #3012

Full changelog: v7.2.4...v7.3.0