New Features

apisJson: APIs.json 0.24 catalog including serviceProxy/soapProxy, tags and tag rules, ETag and HEAD #3556
OpenAPI 3.1/3.2 validation: unevaluatedProperties and prefixItems #3473 #3574
WSDL validation of SOAP headers: headers: none|bound|declared and requireBoundHeaders #3582
Kafka and JMS: kafkaProducer, kafkaConsumer and jmsProducer (with jmsConnection) via the Membrane Kafka/JMS Extensions #3519 #3533 #3601

Improvements

OpenAPI: concrete paths match before templated ones, 405 carries an Allow header, parameter names may contain any character but braces, templates are compiled once at startup #3517
OpenAPI: undeclared path template parameters log a warning instead of a 500; /api-docs gives clearer 404s and ignores the query in document ids #3523 #3510 #3591
Global xmlConfig namespaces apply to all language: xpath plugins and wsSecurity #3542
Groovy: built-in functions callable without fn. (xpath('//id')) #3559
XPath/JSONPath read XML/JSON sent as form data; clearer choose errors; less log noise from the API test #3450
Production mode shows client-facing rejection details (apiKey, cors, idempotency, jsonProtection, rateLimiter with Retry-After, rewriter) and real 5xx reason phrases #3493
Logging: request URIs moved to debug and out of error details; XML parse errors go to SLF4J instead of stderr #3547 #3596 #3516
Configuration: real YAML syntax errors instead of a --- hint; better editor validation via membrane.schema.json #3576 #3600 #3605 #3608 #3610
Runtime: shutdown/hot deploy poll every 1s instead of 5s; Docker image runs under tini #3593 #3505
Docs: examples migrated to tutorials (routing, WebSockets, HTTP proxy, plugin chains, basic auth, OpenAPI), cross-platform curl, SpEL reference #3435 #3563 #3525 #3509 #3553

Routing: bracketed IPv6 Host headers, forward proxies bound to an IP, ConcurrentModificationException on runtime proxy changes #3566 #3464 #3463
Routing: regular expression paths anchored with $ match again; they no longer ignore a trailing slash #3622
OpenAPI: nested server paths pick the longest match; validation uses the routing path (//, ;jsessionid) #3545
OpenAPI validation: boolean schemas (false now rejects), enum/const for all types, media types without schema, JSON Pointer escaping, unanchored patternProperties in query parameters #3500 #3592 #3571 #3594 #3501
WSDL validation: header part before body part, spurious cvc-elt.1.a errors with several schemas #3582
Plugins: accessLog logs defaultValue instead of null; unreadable bodies in setHeader/setProperty/rateLimiter give 400; rewriter with templated base path; idempotency race; shadowing of already-read bodies; webServer index files #3583 #3462 #3512 #3514 #3579 #3474
HTTP: close-delimited responses no longer kept alive; HTTP/1 and HTTP/2 client pooling and shutdown races; timer-thread and file-handle leaks #3423 #3424 #3541 #3550 #3503 #3508
YAML: a child given via $ref satisfies a required child #3598

XXE hardening: message bodies parsed with the hardened XML parser in more places; DOCTYPE can no longer bypass xmlContentFilter #3520
BouncyCastle 1.86 #3470

See 7.8.0.md for details and breaking changes
See MIGRATION-GUIDE.md for migration hints