Release v7.6.0 · membrane/api-gateway

New Features

wsdl2openapi: map XSD facets (length/min/max constraints), default/fixed values, and nillable through to generated OpenAPI schemas #3158
OpenAPI: validate $ref siblings recursively in OpenAPI 3.1 schemas #3191

Improve logging of client disconnects and body-read failures for clearer diagnostics #3192
sslProxy: renamed the sslInterceptors child element to interceptors — update existing configs using this attribute #3208

HTTP client: fix retry body replay and proxy CONNECT handling #3212
sslProxy: register the proxy's SSLContext so passthrough actually forwards traffic — broken since sslProxy was introduced #3205
RuleResolver: report internal proxy flow failures instead of swallowing them #3203
Abort the response flow the same way as the request flow, so a failed interceptor no longer lets an unfiltered backend response reach the client #3198 #3202
OpenAPI: honour nullable when allOf/oneOf/anyOf is present #3189
annot: map boxed and integral @MCAttribute types correctly in the generated JSON/XML schema #3232
Validator: fix duplicate init, incomplete error reporting, and lost validation exceptions #3242
WSDLValidator: report rejections as a SOAP 1.1 or SOAP 1.2 fault matching the request's SOAP version #3241
Fix matchesPath to prevent base-path conflicts #3177
Check Content-Length/Transfer-Encoding before the request method when deciding whether a body is expected #3183
Honor the declared charset when parsing XML bodies (XmlDomBody, XMLUtil.getInputSource) #3234 #3142
Retry a request when establishing the connection timed out #3170
CLI: fix start -t to perform a dry run as documented #3228
Tutorials: fix Windows docker launcher scripts masking a failed container's exit status #3207
Fail on truncated bodies instead of silently NUL-padding them #3195

xmlProtection: add a configurable attribute-name-length limit, multipart body scanning, and hardened charset/DOCTYPE handling #3194
xmlProtection: add a maxDepth limit for nested elements #3143
jsonProtection: scan JSON documents inside multipart attachments #3180
Fix path exposure in production mode for WebServerInterceptor error responses #3176
CLI: harden option parsing/validation/help across all subcommands; restrict generate-jwk private key file permissions to the owner and prevent symlink overwrite #3228