v2.1.4

Addressed Issues

• When uploading records to analytics, the API Product value will be for a matched operation. This replaces the existing functionality where a random product associated with the credential was used, even if that product did not have a matching operation.

Changelog

• fc3dc6e For analytics records, upload a singular product that was used for an authorized operation. This replaces the existing functionality that picked a random matching product from the credential (#412)

v2.1.3

Addressed Issues

• Match the default tag/release version used by the apigee-remote-service-cli when generating sample yamls for kuberentes integration.

Changelog

• N/A - this is a version bump with no code changes between v2.1.2 and v2.1.3.

v2.1.2

Addressed Issues

• Fixes issue where quota buckets were deleted while in use, causing a brief period between refreshes where quota was prematurely reset.

Changelog

• b6ade2f Bump golib version to v2.1.2 (#408)
• 647d526 Add condition to validate bucket is not in-use before deleting

This change only affects the Envoy Adapter runtime (binary / docker image), there is no need to re-provision Apigee.

v2.1.1

Addressed Issues

• panic can occur during quota sync

Changelog

• 009c8e2 v2.1.1

This change only affects the Envoy Adapter runtime (binary / docker image), there is no need to re-provision Apigee.

v2.1.0

Breaking Change

• Quota IDs have changed and values within the current window will be lost.

Addressed Issues

• Quotas may be applied per operation instead of at Product level
• Quota is shared across apps of the same name

Changelog

v2.0.7

New Features

• JWTs can now add a claim named "customattributes" that will pass the value on to the target in a header called "x-apigee-customattributes" (if "append_metadata_headers" is configured to be true).

Addressed Issues

• Addresses an issue where an invalid api key could create spurious log entries and analytics records

Changelog

• 4604974 Added new header to capture customattributes (#402)
• c70fcad fix handling of errors for analytics (#401)

v2.0.6

Addresses a Denial of Service (DoS) vulnerability in a dependency library. See the following notice for more details:

https://www.cve.org/CVERecord?id=CVE-2022-28948

Note: This change affects the Envoy Adapter runtime (binary / docker image) and CLI. Apigee proxies are unaffected, thus there is no need to re-provision Apigee.

Changelog

• 9e71f26 update goboring, peg goreleaser
• 6a3b2b9 update actions/checkout
• ecbe12a update deps (#397)
• 5a67a30 update gopkg.in/yaml.v3 lib for vulnerability (#396)

v2.0.5

Security release to address a Denial of Service (DoS) risk in the promethus library. See the following notice for more details:

https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPROMETHEUSCLIENTGOLANGPROMETHEUSPROMHTTP-2401819

Note: This change only affects the Envoy Adapter runtime (binary / docker image), there is no change to the CLI or Apigee proxies, thus there is no need to re-provision Apigee.

Changelog

• 4762d8f fix goreleaser
• 9fd7907 Upgrade prometheus/client_golang (#393)

v2.0.4

• Added nil-check for the PEM block private key loading to avoid panic.
• Details of the internal error that may occur during authorization will be logged at the debug level. Specifically, the token fetching error for API key will be logged at the error level.

Note: There is no change in CLI's provision command and no need to re-provision to Apigee.

Changelog

• ba9ed5a update deps (#361)
• ffc1eb1 add nil-check for decoded private key pem bytes (#360)

v2.0.3

Envoy Adapter v2.0.3 is a patch release that fixes an analytics logging issue with direct responses under certain circumstances. See #322.

Note: CLI is unchanged. There is no need to re-provision to Apigee.

Changelog

1e7bb20 ensure ca-certificates.crt is read only (#326) (#327)
a9bbd5c fix AX sending issue (#322)