This page documents production updates to all Apigee software in 2022 and later.
We recommend that users periodically check this list for
any new announcements, or [subscribe](https://docs.cloud.google.com/apigee/docs/release-notes.md.txt#sub) to this page using a
feed reader to get notifications of updates.
<button class="devsite-dialog-button button-white button-unindented" data-modal-dialog-id="feed-reader-modal-dialog">What is a feed reader?</button>

### What is a feed reader?

Really simple syndication (RSS) feed readers aggregate content from
websites that you specify.

Feed reader notifications can be email-, browser-, desktop-, or
mobile-based. Some readers are free, or have free versions, and some
require a subscription.

A few examples:

- [Feedly](https://feedly.com)
- [Feedreader](https://feedreader.com)
- [Feeder](https://feeder.co/)

More information on RSS:

- [RSS](https://en.wikipedia.org/wiki/RSS)
- [Comparison of feed aggregators](https://en.wikipedia.org/wiki/Comparison_of_feed_aggregators)
<button class="devsite-dialog-close">Close</button>

<br />

See also:

- [Apigee Edge for Public Cloud release notes](https://docs.cloud.google.com/apigee/docs/edge-public-cloud/release-notes.md.txt)
- [Apigee Edge for Private Cloud release notes](https://docs.cloud.google.com/apigee/docs/edge-private-cloud/release-notes.md.txt)
- [Apigee Edge release notes published before September 2026](https://docs.apigee.com/release/notes/apigee-release-notes)
- [Apigee 2021 and prior release notes](https://docs.cloud.google.com/apigee/docs/release/notes/apigee-release-notes.md.txt)
- [Known issues](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt)


Subscribe:

You can see the latest product updates for all of Google Cloud on the
[Google Cloud](https://docs.cloud.google.com/release-notes.md.txt) page, browse and filter all release notes in the
[Google Cloud console](https://console.cloud.google.com/release-notes),
or programmatically access release notes in
[BigQuery](https://console.cloud.google.com/bigquery?p=bigquery-public-data&d=google_cloud_release_notes&t=release_notes&page=table).

To get the latest product updates delivered to you, add the URL of this page to your
[feed
reader](https://wikipedia.org/wiki/Comparison_of_feed_aggregators), or add the
[feed URL](https://docs.cloud.google.com/feeds/apigee-release-notes.xml) directly.

## November 11, 2026

**Apigee Edge for Public Cloud** Announcement On November 11, 2026, we began releasing Edge UI updates for Apigee Edge for
Public Cloud.
Fixed

| Bug ID | Component | Description |
|---|---|---|
| **392653797, 399185014** | Edge UI | Fixed an issue where navigating to the App Details or New App pages in organizations with a large number of API products experienced slowness or UI freezing during the initial page load. The Edge UI now fetches API products on demand when you open the **Add Product** dialog, improving initial page load performance. |
| **576859695** | Edge UI | Fixed an issue in the Analytics Error Code Analysis dashboard where `504 Gateway Timeout` responses caused by target timeouts were excluded from the **Proxy errors** charts. Target timeout `504` responses are now counted under **Proxy errors**. |
| **188163219** | Edge UI | Fixed a UI formatting issue in the Analytics Custom Reports list view so that dimensions display without overlapping. |

## November 09, 2026

**Apigee Edge for Private Cloud** Announcement Released Apigee Edge for Private Cloud 4.54.00.01.

For the list of updated RPM packages and the patch update procedure, see
[Install 4.54.00.x patch updates](https://docs.apigee.com/private-cloud/v4.54.00/update-apigee-edge-45400-patch#4540001).
Security Fixed multiple security vulnerabilities in Apigee Edge for Private Cloud,
including security hardening across Edge runtime, management, New Edge UI,
OpenLDAP, Apigee mTLS, and Nginx components.
Fixed Resolved the following issues in Apigee Edge for Private Cloud 4.54.00.01:

- Fixed an issue in the New Edge UI where creating an OpenAPI Specification in the `OASValidation` policy modal stored the specification resource under `yaml://` or `json://` instead of `oas://`.
- Fixed an issue where running `setup.sh -p uapim` failed during `edge-uapim-connector` setup.
- Apigee Edge for Private Cloud 4.54.00 and its patch releases support Red Hat Enterprise Linux, Oracle Linux, and Rocky Linux 8.10, 9.6, 9.7, and 9.8. See [Supported software and supported versions](https://docs.apigee.com/release/supported-software#apigeeedgeforprivatecloudsupportedversions).

## November 05, 2026

**Apigee Edge for Public Cloud** Announcement **Scheduled maintenance of Management/Control Plane for the Apigee Edge for Public Cloud on November 6, 2026.**

Scheduled maintenance of Management/Control Plane for the Apigee Edge for Public Cloud production will take place on Friday, November 6, 2026, from 9:00 PM PT to
10:00 PM PT (Saturday, November 7, 2026, from 5:00 AM UTC to 6:00 AM UTC). This
maintenance follows the monthly maintenance window schedule documented in the
[Apigee Edge release notes archive](https://docs.apigee.com/release/notes/apigee-release-notes).

During the scheduled maintenance window, the following services will be
temporarily unavailable, and attempts to access them will return a `4xx` status
code:

- Management Services UI
- Management Services APIs
- Monetization Management APIs
- New proxy deployments
- DevPortal Service
- Microgateway Services
- Edge Query (Analytics Stats APIs)

Runtime API calls to deployed API proxies are unaffected. While access to
analytics queries may be temporarily unavailable during the maintenance window, all
analytics and metrics data from this period will be available once maintenance
ends.
**Apigee hybrid** v1.14.10 Announcement

### v1.14.10

On November 5, 2026 we released an updated version of the Apigee hybrid
software, v1.14.10.

- For information about upgrading, see [Upgrading Apigee hybrid to v1.14.10](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/upgrade.md.txt).
- For information about new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release. The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch by using the Helm chart automatically updates the images. You don't typically need to make manual image changes. For information about container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Fixed

#### Fixed in this release

| Bug ID | Description |
|---|---|
| **578314600** | **Fixed an issue where `apigee-connect-agent` ignored `HTTPS_PROXY` and failed to establish a tether in clusters that require an HTTP forward proxy for egress; the agent now uses HTTP/2 keepalive pings on the control-plane connection while honoring `HTTPS_PROXY` (including proxy credentials).** |
| **576707253** | **Removed the compromised emSign roots and the cross-signing Comodo AAA Services root from the system and Java (`cacerts`) trust stores across containers.** |
| **573622417** | **Fixed an issue where `apigee-ingressgateway` forwarded the `x-envoy-decorator-operation` header to upstream runtime and target backends.** |
| **571378258** | **The `apigee-redis` container now uses the Valkey engine (version 8.1.10). The RESP2 wire protocol and `redis-server` and `redis-cli` binary names are unchanged.** |
| **554114419** | **Fixed an issue where an `AssignMessage`, `HTTPModifier`, or `RaiseFault` policy that creates a new request (`createNew="true"`) in an HTTP/2 flow could not set the `:path` and `:authority` pseudo-headers and failed with an invalid-header error.** |
| **524115876** | **Fixed an intermittent HTTP `400` error in the `OASValidation` policy's strict parameter validation that rejected valid requests under load.** |
| **449228485** | **Fixed an issue where `podDisruptionBudget` overrides configured in the Helm charts were dropped by the Kubernetes API server.** |
| **432315283** | **Fixed an issue where changes to a multi-certificate truststore's trust anchors required a Message Processor restart when `features.truststore.multi_cert_bundle.enabled` was toggled at runtime; the outbound `SSLContext` now rebuilds automatically.** |

Security

| Bug ID | Description |
|---|---|
| **N/A** | **Security fixes for `apigee-asm-ingress`.** This addresses the following vulnerabilities: - [CVE-2026-116585](https://nvd.nist.gov/vuln/detail/CVE-2026-116585) - [CVE-2026-116586](https://nvd.nist.gov/vuln/detail/CVE-2026-116586) - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-asm-istiod`.** This addresses the following vulnerabilities: - [CVE-2026-116585](https://nvd.nist.gov/vuln/detail/CVE-2026-116585) - [CVE-2026-116586](https://nvd.nist.gov/vuln/detail/CVE-2026-116586) - [CVE-2026-40179](https://nvd.nist.gov/vuln/detail/CVE-2026-40179) - [CVE-2026-42151](https://nvd.nist.gov/vuln/detail/CVE-2026-42151) - [CVE-2026-42154](https://nvd.nist.gov/vuln/detail/CVE-2026-42154) - [CVE-2026-44903](https://nvd.nist.gov/vuln/detail/CVE-2026-44903) - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) - [GHSA-gcjh-h69q-9w9g](https://osv.dev/vulnerability/GHSA-gcjh-h69q-9w9g) |
| **N/A** | **Security fixes for `apigee-connect-agent`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-envoy`.** This addresses the following vulnerabilities: - [CVE-2026-5450](https://nvd.nist.gov/vuln/detail/CVE-2026-5450) - [CVE-2026-5928](https://nvd.nist.gov/vuln/detail/CVE-2026-5928) |
| **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2026-111497](https://nvd.nist.gov/vuln/detail/CVE-2026-111497) - [CVE-2026-35189](https://nvd.nist.gov/vuln/detail/CVE-2026-35189) - [CVE-2026-35191](https://nvd.nist.gov/vuln/detail/CVE-2026-35191) - [CVE-2026-42772](https://nvd.nist.gov/vuln/detail/CVE-2026-42772) - [CVE-2026-5450](https://nvd.nist.gov/vuln/detail/CVE-2026-5450) - [CVE-2026-54872](https://nvd.nist.gov/vuln/detail/CVE-2026-54872) - [CVE-2026-54873](https://nvd.nist.gov/vuln/detail/CVE-2026-54873) - [CVE-2026-54875](https://nvd.nist.gov/vuln/detail/CVE-2026-54875) - [CVE-2026-58050](https://nvd.nist.gov/vuln/detail/CVE-2026-58050) - [CVE-2026-58051](https://nvd.nist.gov/vuln/detail/CVE-2026-58051) - [CVE-2026-5928](https://nvd.nist.gov/vuln/detail/CVE-2026-5928) - [CVE-2026-66032](https://nvd.nist.gov/vuln/detail/CVE-2026-66032) - [CVE-2026-66033](https://nvd.nist.gov/vuln/detail/CVE-2026-66033) - [CVE-2026-66034](https://nvd.nist.gov/vuln/detail/CVE-2026-66034) - [CVE-2026-66035](https://nvd.nist.gov/vuln/detail/CVE-2026-66035) - [CVE-2026-72897](https://nvd.nist.gov/vuln/detail/CVE-2026-72897) - [CVE-2026-75804](https://nvd.nist.gov/vuln/detail/CVE-2026-75804) - [CVE-2026-75805](https://nvd.nist.gov/vuln/detail/CVE-2026-75805) - [CVE-2026-75806](https://nvd.nist.gov/vuln/detail/CVE-2026-75806) - [CVE-2026-77696](https://nvd.nist.gov/vuln/detail/CVE-2026-77696) - [CVE-2026-8286](https://nvd.nist.gov/vuln/detail/CVE-2026-8286) - [CVE-2026-84782](https://nvd.nist.gov/vuln/detail/CVE-2026-84782) - [CVE-2026-84784](https://nvd.nist.gov/vuln/detail/CVE-2026-84784) - [CVE-2026-8924](https://nvd.nist.gov/vuln/detail/CVE-2026-8924) - [CVE-2026-8927](https://nvd.nist.gov/vuln/detail/CVE-2026-8927) - [CVE-2026-92392](https://nvd.nist.gov/vuln/detail/CVE-2026-92392) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2026-18401](https://nvd.nist.gov/vuln/detail/CVE-2026-18401) - [CVE-2026-54512](https://nvd.nist.gov/vuln/detail/CVE-2026-54512) - [CVE-2026-54513](https://nvd.nist.gov/vuln/detail/CVE-2026-54513) - [CVE-2026-54514](https://nvd.nist.gov/vuln/detail/CVE-2026-54514) - [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-59888](https://nvd.nist.gov/vuln/detail/CVE-2026-59888) - [CVE-2026-59889](https://nvd.nist.gov/vuln/detail/CVE-2026-59889) - [CVE-2026-68494](https://nvd.nist.gov/vuln/detail/CVE-2026-68494) - [CVE-2026-77310](https://nvd.nist.gov/vuln/detail/CVE-2026-77310) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerabilities: - [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) - [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) - [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) - [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777) |
| **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** This addresses the following vulnerabilities: - [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) - [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) - [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) - [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777) |
| **N/A** | **Security fixes for `apigee-open-telemetry-collector`.** This addresses the following vulnerabilities: - [CVE-2026-116585](https://nvd.nist.gov/vuln/detail/CVE-2026-116585) - [CVE-2026-116586](https://nvd.nist.gov/vuln/detail/CVE-2026-116586) - [CVE-2026-116587](https://nvd.nist.gov/vuln/detail/CVE-2026-116587) |
| **N/A** | **Security fixes for `apigee-operators`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-redis`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-runtime`.** This addresses the following vulnerabilities: - [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) - [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) - [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) - [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777) |
| **N/A** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) - [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) - [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) - [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777) |
| **N/A** | **Security fixes for `apigee-udca`.** This addresses the following vulnerabilities: - [CVE-2026-116585](https://nvd.nist.gov/vuln/detail/CVE-2026-116585) - [CVE-2026-116586](https://nvd.nist.gov/vuln/detail/CVE-2026-116586) - [CVE-2026-116587](https://nvd.nist.gov/vuln/detail/CVE-2026-116587) - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |

## November 04, 2026

**Apigee Edge for Public Cloud** Announcement Released Edge Microgateway 3.3.12.

Edge Microgateway 3.3.12 includes the following component versions:

| Component | Version |
|---|---|
| [microgateway](https://github.com/apigee-internal/microgateway/releases) | 3.3.12 |
| [plugins](https://github.com/apigee/microgateway-plugins/releases) | 3.3.9 |
| [edgeauth](https://github.com/apigee/microgateway-edgeauth/releases) | 3.2.2 |

To upgrade, install version 3.3.12 of the `edgemicro` npm package or pull the
`gcr.io/apigee-microgateway/edgemicro:3.3.12` Docker image. For the npm upgrade
steps, see
[Upgrading Edge Microgateway](https://docs.apigee.com/api-platform/microgateway/3.3.x/operation-and-configuration-reference-edge-microgateway#upgradingedgemicrogateway).
For earlier Edge Microgateway releases, see
[Edge Microgateway release notes](https://docs.apigee.com/release/notes/edge-microgateway-release-notes-0).
Breaking Removed support for Node.js 20 from Edge Microgateway. Use Node.js 22, 24, or
26 instead.

Edge Microgateway 3.3.12 supports only Node.js 22, 24, and 26. Support for
Node.js 26 is new in this release. Before you upgrade an npm installation of
Edge Microgateway to 3.3.12, upgrade the Node.js runtime on each host to
version 22, 24, or 26. The 3.3.12 Docker image is built on Node.js 24, so
Docker deployments need no action for this change. For supported versions, see
[Supported software and supported versions](https://docs.apigee.com/release/supported-software#apigeeedgemicrogateway).
Breaking Removed the `npm` and `npx` command-line tools from the Edge Microgateway Docker
image. Install custom plugin dependencies before you add the plugins to the
container.

Starting with version 3.3.12, the Edge Microgateway Docker image doesn't include
`npm` or `npx`, and commands that run either tool inside the container fail. The
change doesn't affect how Edge Microgateway runs. If your custom plugins have
npm dependencies, run `npm install` in each plugin directory before you add the
plugins to the container, so that each plugin's `node_modules` directory is
included. For the steps, see
[Adding a custom plugin](https://docs.apigee.com/api-platform/microgateway/3.3.x/docker#adding_a_custom_plugin).
This change doesn't affect npm installations of Edge Microgateway.
Security Fixed multiple security vulnerabilities in Edge Microgateway. Upgrade to Edge
Microgateway 3.3.12.

Edge Microgateway 3.3.12 fixes the following vulnerabilities:

- [CVE-2026-12590](https://nvd.nist.gov/vuln/detail/CVE-2026-12590)
- [CVE-2026-14257](https://nvd.nist.gov/vuln/detail/CVE-2026-14257)
- [CVE-2026-45819](https://nvd.nist.gov/vuln/detail/CVE-2026-45819)
- [CVE-2026-54272](https://nvd.nist.gov/vuln/detail/CVE-2026-54272)
- [CVE-2026-59870](https://nvd.nist.gov/vuln/detail/CVE-2026-59870)
- [CVE-2026-69152](https://nvd.nist.gov/vuln/detail/CVE-2026-69152)
- [CVE-2026-69192](https://nvd.nist.gov/vuln/detail/CVE-2026-69192)
- [CVE-2026-69198](https://nvd.nist.gov/vuln/detail/CVE-2026-69198)
- [CVE-2026-73088](https://nvd.nist.gov/vuln/detail/CVE-2026-73088)
- [CVE-2026-73089](https://nvd.nist.gov/vuln/detail/CVE-2026-73089)
- [CVE-2026-82417](https://nvd.nist.gov/vuln/detail/CVE-2026-82417)
- [CVE-2026-82562](https://nvd.nist.gov/vuln/detail/CVE-2026-82562)
- [CVE-2026-84375](https://nvd.nist.gov/vuln/detail/CVE-2026-84375)
- [CVE-2026-87018](https://nvd.nist.gov/vuln/detail/CVE-2026-87018)
- [CVE-2026-101910](https://nvd.nist.gov/vuln/detail/CVE-2026-101910)
- [CVE-2026-101911](https://nvd.nist.gov/vuln/detail/CVE-2026-101911)
- [CVE-2026-101912](https://nvd.nist.gov/vuln/detail/CVE-2026-101912)
- [CVE-2026-101913](https://nvd.nist.gov/vuln/detail/CVE-2026-101913)
- [CVE-2026-102276](https://nvd.nist.gov/vuln/detail/CVE-2026-102276)
- [CVE-2026-102277](https://nvd.nist.gov/vuln/detail/CVE-2026-102277)
- [CVE-2026-102278](https://nvd.nist.gov/vuln/detail/CVE-2026-102278)
- [CVE-2026-109383](https://nvd.nist.gov/vuln/detail/CVE-2026-109383)
- [CVE-2026-109869](https://nvd.nist.gov/vuln/detail/CVE-2026-109869)
- [CVE-2026-109924](https://nvd.nist.gov/vuln/detail/CVE-2026-109924)
- [CVE-2026-109932](https://nvd.nist.gov/vuln/detail/CVE-2026-109932)
- [CVE-2026-110816](https://nvd.nist.gov/vuln/detail/CVE-2026-110816)
- [CVE-2026-111181](https://nvd.nist.gov/vuln/detail/CVE-2026-111181)
- [CVE-2026-111497](https://nvd.nist.gov/vuln/detail/CVE-2026-111497)
- [CVE-2026-111997](https://nvd.nist.gov/vuln/detail/CVE-2026-111997)
- [CVE-2026-115897](https://nvd.nist.gov/vuln/detail/CVE-2026-115897)

The Edge Microgateway 3.3.12 Docker image is built on
`node:24.22.1-trixie-slim`, which includes the Node.js fix for CVE-2026-111497.
For npm installations of Edge Microgateway, upgrading the `edgemicro` package
doesn't fix CVE-2026-111497. You must also upgrade the Node.js runtime on each
host to one of the following versions, or to a later version in the same
release line:

| Node.js release line | Fixed version |
|---|---|
| 22.x | 22.23.4 |
| 24.x | 24.22.1 |
| 26.x | 26.12.1 |

**Apigee Operator for kubernetes** Announcement On November 4, 2026, we released an updated version of Apigee.
Feature **The Apigee Operator for Kubernetes version 1.1.2 is now available.**
Security

| Bug ID | Description |
|---|---|
| **521387476, 521388685, 521389473, 521389648, 521390401, 521390431, 521418315, 521467563, 521470029, 521523106, 521532318, 522502328, 522502515, 522502723, 522508097, 522515015, 522515987, 523406508, 524990439, 525000385, 525013469, 545525835, 545535262, 545546643, 545547894, 545594793, 545595426, 545604082, 545605504, 545613200, 545619209, 546865118, 549708263, 572097689, 572100132** | **Security fixes for Netty in the Apigee Operator for Kubernetes.** Upgraded Netty to 4.1.137.Final. This addresses the following vulnerabilities: - [CVE-2026-33870](https://nvd.nist.gov/vuln/detail/CVE-2026-33870) - [CVE-2026-33871](https://nvd.nist.gov/vuln/detail/CVE-2026-33871) - [CVE-2026-41417](https://nvd.nist.gov/vuln/detail/CVE-2026-41417) - [CVE-2026-42578](https://nvd.nist.gov/vuln/detail/CVE-2026-42578) - [CVE-2026-42579](https://nvd.nist.gov/vuln/detail/CVE-2026-42579) - [CVE-2026-42580](https://nvd.nist.gov/vuln/detail/CVE-2026-42580) - [CVE-2026-42581](https://nvd.nist.gov/vuln/detail/CVE-2026-42581) - [CVE-2026-42583](https://nvd.nist.gov/vuln/detail/CVE-2026-42583) - [CVE-2026-42584](https://nvd.nist.gov/vuln/detail/CVE-2026-42584) - [CVE-2026-42585](https://nvd.nist.gov/vuln/detail/CVE-2026-42585) - [CVE-2026-42587](https://nvd.nist.gov/vuln/detail/CVE-2026-42587) - [CVE-2026-44249](https://nvd.nist.gov/vuln/detail/CVE-2026-44249) - [CVE-2026-45416](https://nvd.nist.gov/vuln/detail/CVE-2026-45416) - [CVE-2026-45673](https://nvd.nist.gov/vuln/detail/CVE-2026-45673) - [CVE-2026-45674](https://nvd.nist.gov/vuln/detail/CVE-2026-45674) - [CVE-2026-47244](https://nvd.nist.gov/vuln/detail/CVE-2026-47244) - [CVE-2026-47691](https://nvd.nist.gov/vuln/detail/CVE-2026-47691) - [CVE-2026-48043](https://nvd.nist.gov/vuln/detail/CVE-2026-48043) - [CVE-2026-50010](https://nvd.nist.gov/vuln/detail/CVE-2026-50010) - [CVE-2026-50020](https://nvd.nist.gov/vuln/detail/CVE-2026-50020) - [CVE-2026-50560](https://nvd.nist.gov/vuln/detail/CVE-2026-50560) - [CVE-2026-55831](https://nvd.nist.gov/vuln/detail/CVE-2026-55831) - [CVE-2026-55833](https://nvd.nist.gov/vuln/detail/CVE-2026-55833) - [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745) - [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746) - [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819) - [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898) - [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899) - [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900) - [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901) - [CVE-2026-59903](https://nvd.nist.gov/vuln/detail/CVE-2026-59903) - [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921) - [CVE-2026-73508](https://nvd.nist.gov/vuln/detail/CVE-2026-73508) - [CVE-2026-75595](https://nvd.nist.gov/vuln/detail/CVE-2026-75595) - [CVE-2026-75596](https://nvd.nist.gov/vuln/detail/CVE-2026-75596) <br /> |
| **527492626, 527495614, 527497578, 527498733, 545553137, 572096453, 572096754, 572096884, 572097054, 572097090, 572097183, 572098198, 572098299, 572099894, 572100881, 578504005** | **Security fixes for Jackson in the Apigee Operator for Kubernetes.** Upgraded Jackson to 2.21.7. This addresses the following vulnerabilities: - [CVE-2026-18401](https://nvd.nist.gov/vuln/detail/CVE-2026-18401) - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-54512](https://nvd.nist.gov/vuln/detail/CVE-2026-54512) - [CVE-2026-54513](https://nvd.nist.gov/vuln/detail/CVE-2026-54513) - [CVE-2026-54514](https://nvd.nist.gov/vuln/detail/CVE-2026-54514) - [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) - [CVE-2026-59888](https://nvd.nist.gov/vuln/detail/CVE-2026-59888) - [CVE-2026-59889](https://nvd.nist.gov/vuln/detail/CVE-2026-59889) - [CVE-2026-68494](https://nvd.nist.gov/vuln/detail/CVE-2026-68494) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-77310](https://nvd.nist.gov/vuln/detail/CVE-2026-77310) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) - [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) - [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) - [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) - [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777) <br /> |
| **521477919, 545546100, 545555197, 545603496, 545608493** | **Security fixes for Jetty in the Apigee Operator for Kubernetes.** Upgraded Jetty to 12.0.36. This addresses the following vulnerabilities: - [CVE-2025-11143](https://nvd.nist.gov/vuln/detail/CVE-2025-11143) - [CVE-2026-1605](https://nvd.nist.gov/vuln/detail/CVE-2026-1605) - [CVE-2026-2332](https://nvd.nist.gov/vuln/detail/CVE-2026-2332) - [CVE-2026-6790](https://nvd.nist.gov/vuln/detail/CVE-2026-6790) - [CVE-2026-8384](https://nvd.nist.gov/vuln/detail/CVE-2026-8384) - [CVE-2026-10050](https://nvd.nist.gov/vuln/detail/CVE-2026-10050) - [CVE-2026-10051](https://nvd.nist.gov/vuln/detail/CVE-2026-10051) <br /> |
| **522503039** | **Security fixes for Vert.x in the Apigee Operator for Kubernetes.** Upgraded Vert.x to 4.5.35. This addresses the following vulnerabilities: - [CVE-2026-1002](https://nvd.nist.gov/vuln/detail/CVE-2026-1002) - [CVE-2026-6860](https://nvd.nist.gov/vuln/detail/CVE-2026-6860) <br /> |
| **579151884** | **Security fixes for Guava in the Apigee Operator for Kubernetes.** Upgraded Guava to 33.7.2-jre. This addresses the following vulnerabilities: - [CVE-2026-102554](https://nvd.nist.gov/vuln/detail/CVE-2026-102554) <br /> |

## November 03, 2026

**Apigee X** Announcement On November 3, 2026, we released an updated version of Apigee (1-18-0-apigee-8).

> [!NOTE]
> **Note:** Rollouts of this release began today and can take four or more business days to complete across all Google Cloud zones. Your instances might not have the features and fixes available until the rollout is complete.

Security

| Bug ID | Description |
|---|---|
| **N/A** | **Security fix for Apigee infrastructure.** |

Fixed

| Bug ID | Description |
|---|---|
| **574037227** | Added config override token `oauth_default_access_token_expiry_time_in_millis` (per-org via the deployment contract) that overrides the default OAuthV2 access token lifetime (ms) applied when a policy omits `<ExpiresIn>`. When unset, behavior is unchanged (installation default, typically 30 days). |
| **573326336** | Proxies that declare `<ProxyOperationMode>MCP` are now recognized as [MCP proxies](https://docs.cloud.google.com/apigee/docs/api-platform/apigee-mcp/apigee-mcp-overview.md.txt) regardless of their basepath. |
| **576697209** | LLMTokenQuota no longer counts tokens for responses that SemanticCacheLookup serves from the cache, and records no ai_llm_response_token_count for them. |
| **578314600** | The Apigee Connect agent now uses HTTP/2 keepalive pings on the control-plane connection, detecting a silently dropped connection in \~80s (vs \~2h) while honoring HTTPS_PROXY (including proxy credentials), so proxy-only clusters re-establish connectivity. |
| **N/A** | Updates to infrastructure and libraries. |

**Apigee hybrid** v1.15.10 Announcement

### v1.15.10

On November 3, 2026 we released an updated version of the Apigee hybrid
software, v1.15.10.

- For information about upgrading, see [Upgrading Apigee hybrid to v1.15.10](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/upgrade.md.txt).
- For information about new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release. The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch by using the Helm chart automatically updates the images. You don't typically need to make manual image changes. For information about container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Fixed

#### Fixed in this release

| Bug ID | Description |
|---|---|
| **578314600** | **Fixed an issue where `apigee-connect-agent` ignored `HTTPS_PROXY` and failed to establish a tether in clusters that require an HTTP forward proxy for egress; the agent now uses HTTP/2 keepalive pings on the control-plane connection while honoring `HTTPS_PROXY` (including proxy credentials).** |
| **576707253** | **Removed the compromised emSign roots and the cross-signing Comodo AAA Services root from the system and Java (`cacerts`) trust stores across containers.** |

Security

| Bug ID | Description |
|---|---|
| **N/A** | **Security fixes for `apigee-asm-ingress`.** This addresses the following vulnerabilities: - [CVE-2026-116585](https://nvd.nist.gov/vuln/detail/CVE-2026-116585) - [CVE-2026-116586](https://nvd.nist.gov/vuln/detail/CVE-2026-116586) - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) |
| **N/A** | **Security fixes for `apigee-asm-istiod`.** This addresses the following vulnerabilities: - [CVE-2026-116585](https://nvd.nist.gov/vuln/detail/CVE-2026-116585) - [CVE-2026-116586](https://nvd.nist.gov/vuln/detail/CVE-2026-116586) - [CVE-2026-40179](https://nvd.nist.gov/vuln/detail/CVE-2026-40179) - [CVE-2026-42151](https://nvd.nist.gov/vuln/detail/CVE-2026-42151) - [CVE-2026-42154](https://nvd.nist.gov/vuln/detail/CVE-2026-42154) - [CVE-2026-44903](https://nvd.nist.gov/vuln/detail/CVE-2026-44903) - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) |
| **N/A** | **Security fixes for `apigee-envoy`.** This addresses the following vulnerabilities: - [CVE-2026-5450](https://nvd.nist.gov/vuln/detail/CVE-2026-5450) - [CVE-2026-5928](https://nvd.nist.gov/vuln/detail/CVE-2026-5928) |
| **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2026-111497](https://nvd.nist.gov/vuln/detail/CVE-2026-111497) - [CVE-2026-8286](https://nvd.nist.gov/vuln/detail/CVE-2026-8286) - [CVE-2026-8924](https://nvd.nist.gov/vuln/detail/CVE-2026-8924) - [CVE-2026-8927](https://nvd.nist.gov/vuln/detail/CVE-2026-8927) - [CVE-2026-92392](https://nvd.nist.gov/vuln/detail/CVE-2026-92392) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-operators`.** This addresses the following vulnerability: - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) |
| **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-udca`.** This addresses the following vulnerabilities: - [CVE-2026-116585](https://nvd.nist.gov/vuln/detail/CVE-2026-116585) - [CVE-2026-116586](https://nvd.nist.gov/vuln/detail/CVE-2026-116586) - [CVE-2026-116587](https://nvd.nist.gov/vuln/detail/CVE-2026-116587) |
| **N/A** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerability: - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) |

## November 02, 2026

**Apigee X** Announcement On November 2, 2026, we released an updated version of Apigee.

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Feature **EKM health monitoring**

You can now monitor EKM health and configure alerts for EKM-related issues using Cloud Logging. For more information, see [EKM health monitoring](https://docs.cloud.google.com/apigee/docs/api-platform/security/ekm-monitoring.md.txt).

## October 30, 2026

**Apigee hybrid** v1.16.13 Announcement

### v1.16.13

On October 30, 2026 we released an updated version of the Apigee hybrid software, v1.16.13.

- For information about upgrading, see [Upgrading Apigee hybrid to v1.16.13](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/upgrade.md.txt).
- For information about new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/big-picture.md.txt).

> [!NOTE]
> **Note:** Do not use Apigee hybrid v1.16.12 due to a potential regression in `apigee-connect-agent` (see known issue [578314600](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt#578314600)). Use v1.16.13 instead.

> [!NOTE]
> **Note:** This is a patch release. The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch by using the Helm chart automatically updates the images. You don't typically need to make manual image changes. For information about container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Fixed

#### Fixed in this release

| Bug ID | Description |
|---|---|
| **578314600** | **Fixed an issue where `apigee-connect-agent` ignored `HTTPS_PROXY` and failed to establish a tether in clusters that require an HTTP forward proxy for egress; the agent now uses HTTP/2 keepalive pings on the control-plane connection while honoring `HTTPS_PROXY` (including proxy credentials).** |
| **576707253** | **Removed the compromised emSign roots and the cross-signing Comodo AAA Services root from the system and Java (`cacerts`) trust stores across containers.** |
| **573622417** | **Fixed an issue where `apigee-ingressgateway` forwarded the `x-envoy-decorator-operation` header to upstream runtime and target backends.** |
| **492041991** | **Fixed an issue where `VerifyAPIKey` and `VerifyAccessToken` set the `apiproduct.operation.llmTokenQuota.*` flow variables from unmatched LLM operations; they are now set only from the LLM operations that matched the request.** |

Security

| Bug ID | Description |
|---|---|
| **N/A** | **Security fixes for `apigee-asm-ingress`.** This addresses the following vulnerabilities: - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) |
| **N/A** | **Security fixes for `apigee-asm-istiod`.** This addresses the following vulnerabilities: - [CVE-2026-40179](https://nvd.nist.gov/vuln/detail/CVE-2026-40179) - [CVE-2026-42151](https://nvd.nist.gov/vuln/detail/CVE-2026-42151) - [CVE-2026-42154](https://nvd.nist.gov/vuln/detail/CVE-2026-42154) - [CVE-2026-44903](https://nvd.nist.gov/vuln/detail/CVE-2026-44903) - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) |
| **N/A** | **Security fixes for `apigee-envoy`.** This addresses the following vulnerabilities: - [CVE-2026-5450](https://nvd.nist.gov/vuln/detail/CVE-2026-5450) - [CVE-2026-5928](https://nvd.nist.gov/vuln/detail/CVE-2026-5928) |
| **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2026-8286](https://nvd.nist.gov/vuln/detail/CVE-2026-8286) - [CVE-2026-8924](https://nvd.nist.gov/vuln/detail/CVE-2026-8924) - [CVE-2026-8927](https://nvd.nist.gov/vuln/detail/CVE-2026-8927) - [CVE-2026-92392](https://nvd.nist.gov/vuln/detail/CVE-2026-92392) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2026-18401](https://nvd.nist.gov/vuln/detail/CVE-2026-18401) - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-39822](https://nvd.nist.gov/vuln/detail/CVE-2026-39822) - [CVE-2026-42505](https://nvd.nist.gov/vuln/detail/CVE-2026-42505) - [CVE-2026-54512](https://nvd.nist.gov/vuln/detail/CVE-2026-54512) - [CVE-2026-54513](https://nvd.nist.gov/vuln/detail/CVE-2026-54513) - [CVE-2026-54514](https://nvd.nist.gov/vuln/detail/CVE-2026-54514) - [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-59888](https://nvd.nist.gov/vuln/detail/CVE-2026-59888) - [CVE-2026-59889](https://nvd.nist.gov/vuln/detail/CVE-2026-59889) - [CVE-2026-68494](https://nvd.nist.gov/vuln/detail/CVE-2026-68494) - [CVE-2026-77310](https://nvd.nist.gov/vuln/detail/CVE-2026-77310) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-operators`.** This addresses the following vulnerability: - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) |
| **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerability: - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) |

## October 29, 2026

**Apigee hybrid** v1.17.3 Announcement

### v1.17.3

On October 29, 2026 we released an updated version of the Apigee hybrid software, v1.17.3.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.17.3](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/big-picture.md.txt).

> [!NOTE]
> **Note:** Do not use Apigee hybrid v1.17.2 due to a potential regression in `apigee-connect-agent` (see known issue [578314600](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt#578314600)). Use v1.17.3 instead.

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Fixed

#### Fixed in this release

| Bug ID | Description |
|---|---|
| **578314600** | **Fixed an issue where `apigee-connect-agent` ignored `HTTPS_PROXY` and failed to establish a tether in clusters that require an HTTP forward proxy for egress; the agent now uses HTTP/2 keepalive pings on the control-plane connection while honoring `HTTPS_PROXY` (including proxy credentials).** |
| **576707253** | **Removed the compromised emSign roots and the cross-signing Comodo AAA Services root from the system and Java (`cacerts`) trust stores across containers.** |
| **573622417** | **Fixed an issue where `apigee-ingressgateway` forwarded the `x-envoy-decorator-operation` header to upstream runtime and target backends.** |
| **572025634** | **Fixed an issue where responses with a compressed `text/event-stream` body to a proxy with an `EventFlow` returned a corrupted body; compressed `text/event-stream` responses now skip `EventFlow` processing and pass through intact.** |
| **571378258** | **The `apigee-redis` container now uses the Valkey engine (version 8.1.10). The RESP2 wire protocol and `redis-server` and `redis-cli` binary names are unchanged.** |
| **568860869** | **Fixed an issue in the `RegularExpressionProtection` policy where patterns starting and ending with `.*` whose middle section contained regular expression syntax were matched as literal text instead of regular expressions.** |
| **560272924** | **Apigee hybrid now supports continuous-scan bidirectional gRPC streaming for the `SanitizeModelResponse` policy over Server-Sent Events (SSE) streams, preserving native LLM provider SSE JSON envelopes and event framing.** |
| **555332621** | **Fixed an issue where Model Armor policies did not honor `HTTPClient.managementplane.skip.proxy`: when set, Model Armor callouts now bypass the forward proxy like other `googleapis` traffic, while streaming (`ContinuousScan`) Model Armor traffic uses the forward proxy.** |
| **554114419** | **Fixed an issue where an `AssignMessage`, `HTTPModifier`, or `RaiseFault` policy that creates a new request (`createNew="true"`) in an HTTP/2 flow could not set the `:path` and `:authority` pseudo-headers and failed with an invalid-header error.** |
| **549779897** | **Apigee analytics now reports the Model Armor template, verdict, and matched filters for each request on both the prompt and model-response directions.** |
| **546141116** | **The `SemanticCacheLookup` policy now reports the cache key and cache name to analytics in the `ai_semantic_cache_key` and `ai_semantic_cache_name` fields.** |
| **535395491** | **Extension Processor (`ext_proc`) denials now return the status and body that the policy or FaultRule produced, instead of always returning HTTP `500`.** |
| **524115876** | **Fixed an intermittent HTTP `400` error in the `OASValidation` policy's strict parameter validation that rejected valid requests under load.** |
| **502231886** | **Fixed an issue where the `SanitizeUserPrompt` and `SanitizeModelResponse` policies failed to extract content using default source templates when the `<Source>` element was omitted and `<IgnoreUnresolvedVariables>` was set to `false`.** |
| **492041991** | **Fixed an issue where `VerifyAPIKey` and `VerifyAccessToken` set the `apiproduct.operation.llmTokenQuota.*` flow variables from unmatched LLM operations; they are now set only from the LLM operations that matched the request.** |
| **449228485** | **Fixed an issue where `podDisruptionBudget` overrides configured in the Helm charts were dropped by the Kubernetes API server.** |

Security

| Bug ID | Description |
|---|---|
| **N/A** | **Security fixes for `apigee-asm-ingress`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-asm-istiod`.** This addresses the following vulnerabilities: - [CVE-2026-40179](https://nvd.nist.gov/vuln/detail/CVE-2026-40179) - [CVE-2026-42151](https://nvd.nist.gov/vuln/detail/CVE-2026-42151) - [CVE-2026-42154](https://nvd.nist.gov/vuln/detail/CVE-2026-42154) - [CVE-2026-44903](https://nvd.nist.gov/vuln/detail/CVE-2026-44903) - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) - [GHSA-gcjh-h69q-9w9g](https://osv.dev/vulnerability/GHSA-gcjh-h69q-9w9g) |
| **N/A** | **Security fixes for `apigee-connect-agent`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-envoy`.** This addresses the following vulnerabilities: - [CVE-2026-5450](https://nvd.nist.gov/vuln/detail/CVE-2026-5450) - [CVE-2026-5928](https://nvd.nist.gov/vuln/detail/CVE-2026-5928) |
| **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2026-35189](https://nvd.nist.gov/vuln/detail/CVE-2026-35189) - [CVE-2026-35191](https://nvd.nist.gov/vuln/detail/CVE-2026-35191) - [CVE-2026-42772](https://nvd.nist.gov/vuln/detail/CVE-2026-42772) - [CVE-2026-5450](https://nvd.nist.gov/vuln/detail/CVE-2026-5450) - [CVE-2026-54872](https://nvd.nist.gov/vuln/detail/CVE-2026-54872) - [CVE-2026-54873](https://nvd.nist.gov/vuln/detail/CVE-2026-54873) - [CVE-2026-54875](https://nvd.nist.gov/vuln/detail/CVE-2026-54875) - [CVE-2026-58050](https://nvd.nist.gov/vuln/detail/CVE-2026-58050) - [CVE-2026-58051](https://nvd.nist.gov/vuln/detail/CVE-2026-58051) - [CVE-2026-5928](https://nvd.nist.gov/vuln/detail/CVE-2026-5928) - [CVE-2026-66032](https://nvd.nist.gov/vuln/detail/CVE-2026-66032) - [CVE-2026-66033](https://nvd.nist.gov/vuln/detail/CVE-2026-66033) - [CVE-2026-66034](https://nvd.nist.gov/vuln/detail/CVE-2026-66034) - [CVE-2026-66035](https://nvd.nist.gov/vuln/detail/CVE-2026-66035) - [CVE-2026-72897](https://nvd.nist.gov/vuln/detail/CVE-2026-72897) - [CVE-2026-75804](https://nvd.nist.gov/vuln/detail/CVE-2026-75804) - [CVE-2026-75805](https://nvd.nist.gov/vuln/detail/CVE-2026-75805) - [CVE-2026-75806](https://nvd.nist.gov/vuln/detail/CVE-2026-75806) - [CVE-2026-77696](https://nvd.nist.gov/vuln/detail/CVE-2026-77696) - [CVE-2026-8286](https://nvd.nist.gov/vuln/detail/CVE-2026-8286) - [CVE-2026-84782](https://nvd.nist.gov/vuln/detail/CVE-2026-84782) - [CVE-2026-84784](https://nvd.nist.gov/vuln/detail/CVE-2026-84784) - [CVE-2026-8924](https://nvd.nist.gov/vuln/detail/CVE-2026-8924) - [CVE-2026-8927](https://nvd.nist.gov/vuln/detail/CVE-2026-8927) - [CVE-2026-92392](https://nvd.nist.gov/vuln/detail/CVE-2026-92392) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) - [GHSA-gcjh-h69q-9w9g](https://osv.dev/vulnerability/GHSA-gcjh-h69q-9w9g) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) |
| **N/A** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerabilities: - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) - [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) - [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) - [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) - [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777) |
| **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** This addresses the following vulnerabilities: - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) - [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) - [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) - [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) - [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777) |
| **N/A** | **Security fixes for `apigee-operators`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-redis`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-runtime`.** This addresses the following vulnerabilities: - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) - [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) - [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) - [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) - [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777) |
| **N/A** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) - [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) - [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) - [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) - [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777) |
| **N/A** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |

## October 27, 2026

**Apigee X** Feature The **Apigee API Health \& Availability** dashboard is now generally available in [Cloud Monitoring](https://console.cloud.google.com/monitoring/dashboards) to help you monitor the health, performance, and availability of your Apigee API proxies in real time:

- **Golden signal scorecards** : track aggregate **Traffic** (requests per second), **Error Rate (5xx)** , and **Latency (p95)** scorecards.
- **Status code and error trends** : visualize the **Request Rate by Status
  Code** chart over time and identify problematic APIs using the dedicated **5xx Error Rate by Proxy** and **4xx Error Rate by Proxy** charts.
- **Granular filtering** : filter telemetry by `project_id`, `location`, and `proxy_name` to troubleshoot specific regions or proxies.

For more information, see [API Monitoring](https://docs.cloud.google.com/apigee/docs/api-monitoring.md.txt).

## October 26, 2026

**Apigee X** Feature **Model Context Protocol (MCP) tool arguments are sent to the location their OpenAPI
parameter declares**

This change applies to Apigee X in all supported regions.

An MCP tool argument whose OpenAPI parameter declares `in: header` is now sent to
your backend as a request header, and one that declares `in: cookie` is sent in the
`Cookie` header. Previously both were appended to the query string.
`in: query` and `in: path` parameters are unchanged, and every parameter
still appears in the tool's `inputSchema`, so MCP clients supply arguments exactly as
before. If a backend reads one of these values from the query string, declare the parameter
`in: query` or read it from its declared location.

On a tool call that supplies at least one cookie argument, the `Cookie` header is
replaced with only the declared cookie parameters, omitting any others. Any cookie your backend
relies on must be declared as an `in: cookie` parameter.

An MCP proxy that was already deployed continues to use the previous query-string behavior
until its configuration is next regenerated. To adopt the new routing on an existing MCP proxy,
deploy a new revision of it.

For the full mapping, see
[Tool
argument placement on the backend request](https://docs.cloud.google.com/apigee/docs/api-platform/apigee-mcp/apigee-mcp-overview#tool-argument-placement).
Security **On October 24, 2026, we published a security bulletin for Apigee.**

Two vulnerabilities in PHP core
([CVE-2026-109618](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-109618)
and
[CVE-2026-109619](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-109619),
"PHP2Shell") allow an unauthenticated attacker to execute code remotely on a
server running a vulnerable PHP version. The impact is limited to Drupal-based
Apigee developer portals, which customers deploy and operate. Apigee, Apigee
Hybrid, and the Apigee integrated portal don't use PHP and aren't affected.

**Security bulletin published: [GCP-2026-072](https://docs.cloud.google.com/apigee/docs/security-bulletins/security-bulletins.md.txt#gcp-2026-072)**

## October 22, 2026

**Apigee X** Announcement On October 22, 2026, we released an updated version of Apigee (1-18-0-apigee-7).

> [!NOTE]
> **Note:** Rollouts of this release began today and can take four or more business days to complete across all Google Cloud zones. Your instances might not have the features and fixes available until the rollout is complete.

Security

| Bug ID | Description |
|---|---|
| **573663408** | **Security fix for Apigee.** Upgraded the ingress gateway to patch security vulnerabilities. |
| **N/A** | **Security fix for Apigee infrastructure.** |

Fixed

| Bug ID | Description |
|---|---|
| **568535165** | Skip main_task_wait_time and nio_task_wait_time metrics for the first 12 Prometheus scrapes during Message Processor startup warmup. |
| **573602919** | Fix generated OpenAPI specs' servers\[\] to carry the Apigee envgroup hostname instead of the backend target host. |
| **562964081** | The sgpUserIntentMatchingMode verdict-log field is now always present, including on dry-run policy records, and shows the mode used for the evaluation, including when sgpUserIntentMatching isn't set (CONSTRAINTS_AND_INTENT, or INTENT_ONLY when no policies match the tool call). |
| **524115876** | Fix an intermittent HTTP 400 error in the OASValidation policy's strict parameter validation that rejected valid requests. |
| **572025634** | Responses with a compressed text/event-stream body to a proxy with an EventFlow now skip EventFlow processing and pass through intact instead of returning a corrupted body. |
| **549078690** | If no SGP policy is attributed for a denial, a customer sees the generic fallback message. This fix short-circuits to show the rationale instead when no matched policy has a configured denial message. |
| **492041991** | VerifyAPIKey and VerifyAccessToken now set the apiproduct.operation.llmTokenQuota.\* flow variables only from the LLM operation(s) that matched the request; they are no longer set from unmatched LLM operations or for requests that match no LLM operation. |
| **567244615** | Semantic Governance now evaluates LLM requests it previously skipped, such as OpenAI requests whose message content is an array of parts, which can produce new denials and judge-model usage. It considers every system message rather than only the last, and a non-streaming OpenAI or an Ollama tool call whose arguments are not valid JSON is now an evaluation error. |
| **567244615** | Semantic Governance no longer evaluates a request or response with a field it cannot read when a tool call is involved. It records verdict ERROR naming the field, with status MODEL_ERROR. The inline SemanticGovernance policy instead raises GovernedLLMResponseParseError or GovernedLLMProviderDetectionFailed (HTTP 500), in DRY_RUN too unless continueOnError is true. It also reads every text part of a Gemini system instruction and Gemini tool parameters given as parametersJsonSchema, and no longer loses the rest of a Claude or Gemini request when one field has an unexpected shape. |
| **560272924** | Added continuous-scan bidirectional gRPC streaming support for the SanitizeModelResponse policy over Server-Sent Events (SSE) streams, preserving native LLM provider SSE JSON envelopes and event framing. |
| **555332621** | Model Armor policies now honor HTTPClient.managementplane.skip.proxy: with it set, Model Armor callouts bypass the forward proxy like other googleapis traffic. Streaming (ContinuousScan) Model Armor traffic uses the forward proxy. |
| **158204922** | VerifyJWT now rejects a JWT whose header contains "b64":false, with fault steps.jwt.InvalidToken, as RFC 7797 section 7 requires. Previously, such a token could be accepted if KnownHeaders listed b64, IgnoreCriticalHeaders was true, or the header had no crit. |
| **158204922** | GenerateJWS supports RFC 7797 unencoded payloads. GenerateJWS now raises MissingPayload, InvalidPayload or FailedToResolveVariable for payload errors, where it previously raised GenerationFailed. KnownHeaders and CriticalHeaders in the JWS and JWT policies accept names separated by whitespace, such as one per line. A b64 header supplied through AdditionalHeaders is now rejected, with steps.jws.InvalidNameForAdditionalHeader for GenerateJWS and steps.jwt.InvalidNameForAdditionalHeader for GenerateJWT. A proxy that set b64 through an AdditionalHeaders variable produced an RFC 7797 JWS before this change, and must move to UnencodedPayload, with DetachContent for the detached form. |
| **158204922** | VerifyJWS verifies RFC 7797 unencoded-payload JWS (b64:false), attached or detached. b64 in crit no longer needs a KnownHeaders entry. VerifyJWS rejects b64:false unless crit lists b64, with the new fault steps.jws.UnencodedPayloadNotCritical; IgnoreCriticalHeaders does not change that. DecodeJWS reports the raw payload of such a JWS. |
| **559228730** | ext_proc: ImmediateResponse now carries any Content-Type (raw body bytes + preserved Content-Type); replies too large to buffer use StreamedImmediateResponse. |
| **544751120** | Semantic Governance Policies marked as dry run are now evaluated and logged without blocking the request. Each dry-run policy adds a second judge evaluation per tool-calling response, whose tokens are billed. Dry-run verdicts are written to the semantic-governance-policy log as separate records flagged sgpDryRunPolicyEvaluation=true; queries that count verdicts should add sgpDryRunPolicyEvaluation != true to exclude them. |
| **554114419** | Fixed: an AssignMessage/HTTPModifier/RaiseFault policy that creates a new request (createNew="true") in an HTTP/2 flow can now set the :path and :authority pseudo-headers instead of failing with an invalid-header error. |
| **567812025** | FILESYSTEM persistence mode makes the synchronizer skip Cassandra entirely (no connections, reads, writes, or datastore health probes). |
| **559009293** | Fixed elevated OAuth latency and Cassandra read load for AppGroup apps, including access token verification and token and authorization-code generation, by caching AppGroup lookups in the message processor runtime, matching Developer behavior. |
| **568860869** | Fixed `RegularExpressionProtection` patterns of the form `"...."` whose middle section contains regular expression syntax (for example, `".?Exception in thread."` or `"(?i).\<script.>.*"`) being matched as literal text instead of as regular expressions. Such patterns now raise `steps.regexprotection.ThreatDetected` for all matching input. |
| **564945600** | Enhance VerifyAPIKey policy to better handle leading spaces. |
| **502231886** | Fixed the default source templates for SanitizeUserPrompt and SanitizeModelResponse so a policy that omits the source element extracts content correctly when IgnoreUnresolvedVariables is false. |
| **562964081** | Semantic Governance now honors the `sgpUserIntentMatching` `AuthzExtension` metadata key (`ENABLED` or `DISABLED`) to toggle user-intent matching in policy evaluation; `DISABLED` evaluates against constraints only. |
| **565004219** | Fixed Semantic Governance Policy skipping evaluation for Anthropic requests that send `system` as a content-block array (the form ADK and LiteLlm emit). Affected agents are now evaluated, which may produce new denials and new judge-model usage on the consumer project. |
| **527517087** | SGP policy logs written to your project now identify their originating region. resource.type changes from "global" to "generic_node" and the region appears in resource.labels.location. Anything selecting these entries by resource.type="global" must be updated -- including log-based metrics, sinks, exclusion filters and alerts, which stop matching silently rather than erroring. |
| **575439485** | JavaCallout policies that run remotely (per-contract offload) can now pass every value type allowed by the GCP-2025-023 setVariable restriction between policies (collections, maps, arrays, primitive wrappers including Character, Date, BigDecimal, UUID, java.time, atomics, JDK enums, Optional), with their types preserved, instead of failing with steps.remotepolicy.NonSerializableVariable. |
| **575439485** | Remotely executed (per-contract offload) JavaCallout policies with continueOnError="true" now continue the flow when the callout faults, instead of returning HTTP 500. |
| **567244901** | In enforce mode, Semantic Governance now blocks a tool call when the governance check cannot be completed, instead of letting it through. |
| **573622417** | Fixed an issue where istio-ingressgateway forwarded the x-envoy-decorator-operation header to upstream runtime and target backends. |
| **571679067** | removes old version of ApigeeTelemetry CRD. |
| **571378258** | The Apigee Redis container is now built from the Valkey engine (BSD-3-Clause, Linux Foundation) at version 8.1.10. Wire protocol is unchanged (RESP2) and the redis-server/redis-cli binary names are preserved. |
| **N/A** | Updates to infrastructure and libraries. |

## October 21, 2026

**Apigee X** Announcement **Apigee Emulator**

### Apigee Emulator v2.0.2

On October 21, 2026, we released Apigee Emulator version 2.0.2.

This release upgrades the Apigee Emulator runtime to Java 21 (Eclipse Temurin
JRE 21) to align local proxy development and policy execution with the
production Apigee runtime, while keeping the embedded Apache Cassandra
datastore pinned to Java 8. It also addresses 46 security vulnerabilities across
Netty, Jackson, Apache Log4j, BouncyCastle, Apache CXF, Eclipse Jetty, and the
embedded Cassandra Go standard library health-check binary.

The emulator image is available at
[Artifact Registry](https://console.cloud.google.com/artifacts/docker/apigee-release/us/gcr.io/hybrid%2Fapigee-emulator).

To upgrade, update the emulator version in your Cloud Code for VS Code settings
to `2.0.2`. See
[Manage the Apigee Emulator](https://docs.cloud.google.com/apigee/docs/api-platform/local-development/vscode/manage-apigee-emulator.md.txt#choose_the_emulator_version)
for details.
Feature **Apigee Emulator**

#### Changed in this release

- Upgraded the Apigee Emulator runtime JVM to Eclipse Temurin JRE 21 (`21.0.12.1.0+1-0`, from JRE 11 `11.0.31+11`), adding JVM 21 compatibility flags (`-Djava.security.manager=allow` and `--add-opens` module flags) for `JavaCallout`, JavaScript (Rhino), and Python (Jython) policies while keeping the embedded Apache Cassandra `4.0.19` datastore pinned to Eclipse Temurin JRE 8.
- Upgraded Netty to `4.1.137.Final` (from `4.1.135.Final`) and updated `netty-tcnative-boringssl-static` and `netty-tcnative-classes` to `2.0.81.Final` (from `2.0.77.Final`).
- Upgraded Jackson (`jackson-core`, `jackson-databind`, and `jackson-dataformat-yaml`) to `2.21.7` (from `2.18.6` and `2.19.2`) and `jackson-annotations` to `2.21`.
- Upgraded shaded Apache Log4j (`log4j-api` and `log4j-core`) in `ConfigUtil.jar` to `2.25.5` (from `2.17.1` and `2.25.4`).
- Upgraded BouncyCastle (`bcprov-jdk18on`, `bcpkix-jdk18on`, and `bcutil-jdk18on`) to `1.85` (from `1.84`).
- Upgraded Apache CXF (`cxf-*`) to `3.6.12` (from `3.5.11`).
- Upgraded gRPC to `1.82.3` (from `1.62.2`), Protobuf (`protobuf-java` and `protobuf-java-util`) to `4.33.6` (from `3.25.5`), and Guava to `33.5.0-jre` (from `33.4.8-jre`).
- Removed unused `org.eclipse.jetty:jetty-*` (`9.4.58.v20250814`) and `commons-collections:commons-collections` (`3.2.2`) JARs from the emulator distribution.
- Refreshed the Cassandra base image to pick up Go standard library `1.27.0` (from `1.25.11`) in the embedded `/opt/apigee/ready` health-check binary.
Security **Apigee Emulator**

#### Security

This release addresses 46 security vulnerabilities across Netty, the embedded
Go standard library, Jackson, Apache Log4j, Eclipse Jetty, BouncyCastle, and
Apache CXF:

| CVE / Advisory | Component |
|---|---|
| [CVE-2026-75595](https://nvd.nist.gov/vuln/detail/CVE-2026-75595) | Netty (`netty-handler`) |
| [CVE-2026-75596](https://nvd.nist.gov/vuln/detail/CVE-2026-75596) | Netty (`netty-handler`) |
| [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901) | Netty (`netty-codec`) |
| [CVE-2026-55831](https://nvd.nist.gov/vuln/detail/CVE-2026-55831) | Netty (`netty-codec-http`) |
| [CVE-2026-55833](https://nvd.nist.gov/vuln/detail/CVE-2026-55833) | Netty (`netty-codec-http`) |
| [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745) | Netty (`netty-codec-http`) |
| [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746) | Netty (`netty-codec-http`) |
| [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898) | Netty (`netty-codec-http`) |
| [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899) | Netty (`netty-codec-http`) |
| [CVE-2026-59903](https://nvd.nist.gov/vuln/detail/CVE-2026-59903) | Netty (`netty-codec-http`) |
| [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921) | Netty (`netty-codec-http`) |
| [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819) | Netty (`netty-codec-http2`) |
| [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900) | Netty (`netty-codec-http2`) |
| [CVE-2026-73508](https://nvd.nist.gov/vuln/detail/CVE-2026-73508) | Netty (`netty-codec-dns`) |
| [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) | Go standard library |
| [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) | Go standard library |
| [CVE-2026-39822](https://nvd.nist.gov/vuln/detail/CVE-2026-39822) | Go standard library |
| [CVE-2026-42505](https://nvd.nist.gov/vuln/detail/CVE-2026-42505) | Go standard library |
| [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) | Go standard library |
| [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) | Go standard library |
| [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) | Go standard library |
| [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) | Go standard library |
| [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) | Go standard library |
| [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) | Go standard library |
| [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) | Go standard library |
| [CVE-2026-68494](https://nvd.nist.gov/vuln/detail/CVE-2026-68494) | Jackson (`jackson-core`) |
| [CVE-2026-18401](https://nvd.nist.gov/vuln/detail/CVE-2026-18401) | Jackson (`jackson-core`) |
| [CVE-2026-54512](https://nvd.nist.gov/vuln/detail/CVE-2026-54512) | Jackson (`jackson-databind`) |
| [CVE-2026-54513](https://nvd.nist.gov/vuln/detail/CVE-2026-54513) | Jackson (`jackson-databind`) |
| [CVE-2026-54514](https://nvd.nist.gov/vuln/detail/CVE-2026-54514) | Jackson (`jackson-databind`) |
| [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) | Jackson (`jackson-databind`) |
| [CVE-2026-59888](https://nvd.nist.gov/vuln/detail/CVE-2026-59888) | Jackson (`jackson-databind`) |
| [CVE-2026-59889](https://nvd.nist.gov/vuln/detail/CVE-2026-59889) | Jackson (`jackson-databind`) |
| [CVE-2026-77310](https://nvd.nist.gov/vuln/detail/CVE-2026-77310) | Jackson (`jackson-databind`) |
| [GHSA-mhm7-754m-9p8w](https://github.com/advisories/GHSA-mhm7-754m-9p8w) | Jackson (`jackson-databind`) |
| [CVE-2025-68161](https://nvd.nist.gov/vuln/detail/CVE-2025-68161) | Apache Log4j (`log4j-core`) |
| [CVE-2026-34477](https://nvd.nist.gov/vuln/detail/CVE-2026-34477) | Apache Log4j (`log4j-core`) |
| [CVE-2026-34480](https://nvd.nist.gov/vuln/detail/CVE-2026-34480) | Apache Log4j (`log4j-core`) |
| [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) | Apache Log4j (`log4j-api`) |
| [CVE-2026-10050](https://nvd.nist.gov/vuln/detail/CVE-2026-10050) | Eclipse Jetty (`jetty-security`) |
| [CVE-2026-2332](https://nvd.nist.gov/vuln/detail/CVE-2026-2332) | Eclipse Jetty (`jetty-http`) |
| [CVE-2024-6763](https://nvd.nist.gov/vuln/detail/CVE-2024-6763) | Eclipse Jetty (`jetty-http`) |
| [CVE-2026-6790](https://nvd.nist.gov/vuln/detail/CVE-2026-6790) | Eclipse Jetty (`jetty-server`) |
| [CVE-2026-8763](https://nvd.nist.gov/vuln/detail/CVE-2026-8763) | BouncyCastle (`bcprov-jdk18on`) |
| [CVE-2026-13506](https://nvd.nist.gov/vuln/detail/CVE-2026-13506) | BouncyCastle (`bcprov-jdk18on`) |
| [CVE-2026-50645](https://nvd.nist.gov/vuln/detail/CVE-2026-50645) | Apache CXF (`cxf-core`) |

**Apigee hybrid** v1.15.9 Announcement

### v1.15.9

On October 21, 2026 we released an updated version of the Apigee hybrid software, v1.15.9.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.15.9](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Fixed

#### Fixed in this release

| Bug ID | Description |
|---|---|
| **573622417** | **Fixed an issue where `apigee-ingressgateway` forwarded the `x-envoy-decorator-operation` header to upstream runtime and target backends.** |
| **571378258** | **The `apigee-redis` container now uses the Valkey engine (version 8.1.10). The RESP2 wire protocol and `redis-server` and `redis-cli` binary names are unchanged.** |
| **568860869** | **Fixed an issue in the `RegularExpressionProtection` policy where patterns starting and ending with `.*` whose middle section contained regular expression syntax were matched as literal text instead of regular expressions.** |
| **565072374** | **Fixed an issue where `VerifyJWT` policies using a JWKS `uriRef` could return `steps.jwt.NoMatchingPublicKey` on the first request after the 5-minute JWKS cache TTL expired when the identity provider rotated keys. The cache now refreshes synchronously upon expiration.** |
| **535395491** | **Extension Processor (`ext_proc`) denials now return the status and body that the policy or FaultRule produced, instead of always returning HTTP `500`.** |
| **524115876** | **Fixed an intermittent HTTP `400` error in the `OASValidation` policy's strict parameter validation that rejected valid requests under load.** |
| **519729209** | **Fixed a SAML XML Signature Wrapping vulnerability in the `ValidateSAMLAssertion` policy.** |
| **502231886** | **Fixed an issue where the `SanitizeUserPrompt` and `SanitizeModelResponse` policies failed to extract content using default source templates when the `<Source>` element was omitted and `<IgnoreUnresolvedVariables>` was set to `false`.** |
| **449228485** | **Fixed an issue where `podDisruptionBudget` overrides set through Helm had no effect because the `apigee-operator` chart CRDs didn't include the `podDisruptionBudget` field. These overrides now take effect.** |
| **432315283** | **Fixed an issue where changes to a multi-certificate truststore's trust anchors required a Message Processor restart when `features.truststore.multi_cert_bundle.enabled` was toggled at runtime; the outbound `SSLContext` now rebuilds automatically.** |
| **428750492** | **Removed the `required` validation constraint on the `strategy` and `stages` fields in the `ApigeeDeployment` CRD.** |

Security

| Bug ID | Description |
|---|---|
| **N/A** | **Security fixes for `apigee-asm-ingress`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-asm-istiod`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-connect-agent`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2026-35189](https://nvd.nist.gov/vuln/detail/CVE-2026-35189) - [CVE-2026-35191](https://nvd.nist.gov/vuln/detail/CVE-2026-35191) - [CVE-2026-42772](https://nvd.nist.gov/vuln/detail/CVE-2026-42772) - [CVE-2026-5450](https://nvd.nist.gov/vuln/detail/CVE-2026-5450) - [CVE-2026-54872](https://nvd.nist.gov/vuln/detail/CVE-2026-54872) - [CVE-2026-54873](https://nvd.nist.gov/vuln/detail/CVE-2026-54873) - [CVE-2026-54875](https://nvd.nist.gov/vuln/detail/CVE-2026-54875) - [CVE-2026-58050](https://nvd.nist.gov/vuln/detail/CVE-2026-58050) - [CVE-2026-58051](https://nvd.nist.gov/vuln/detail/CVE-2026-58051) - [CVE-2026-5928](https://nvd.nist.gov/vuln/detail/CVE-2026-5928) - [CVE-2026-66032](https://nvd.nist.gov/vuln/detail/CVE-2026-66032) - [CVE-2026-66033](https://nvd.nist.gov/vuln/detail/CVE-2026-66033) - [CVE-2026-66034](https://nvd.nist.gov/vuln/detail/CVE-2026-66034) - [CVE-2026-66035](https://nvd.nist.gov/vuln/detail/CVE-2026-66035) - [CVE-2026-72897](https://nvd.nist.gov/vuln/detail/CVE-2026-72897) - [CVE-2026-75804](https://nvd.nist.gov/vuln/detail/CVE-2026-75804) - [CVE-2026-75805](https://nvd.nist.gov/vuln/detail/CVE-2026-75805) - [CVE-2026-75806](https://nvd.nist.gov/vuln/detail/CVE-2026-75806) - [CVE-2026-77696](https://nvd.nist.gov/vuln/detail/CVE-2026-77696) - [CVE-2026-84782](https://nvd.nist.gov/vuln/detail/CVE-2026-84782) - [CVE-2026-84784](https://nvd.nist.gov/vuln/detail/CVE-2026-84784) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) |
| **N/A** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerabilities: - [CVE-2024-6763](https://nvd.nist.gov/vuln/detail/CVE-2024-6763) - [CVE-2025-46392](https://nvd.nist.gov/vuln/detail/CVE-2025-46392) - [CVE-2026-10050](https://nvd.nist.gov/vuln/detail/CVE-2026-10050) - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-2332](https://nvd.nist.gov/vuln/detail/CVE-2026-2332) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-50645](https://nvd.nist.gov/vuln/detail/CVE-2026-50645) - [CVE-2026-6790](https://nvd.nist.gov/vuln/detail/CVE-2026-6790) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) - [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) - [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) - [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) - [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777) |
| **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** This addresses the following vulnerabilities: - [CVE-2024-6763](https://nvd.nist.gov/vuln/detail/CVE-2024-6763) - [CVE-2025-46392](https://nvd.nist.gov/vuln/detail/CVE-2025-46392) - [CVE-2026-10050](https://nvd.nist.gov/vuln/detail/CVE-2026-10050) - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-2332](https://nvd.nist.gov/vuln/detail/CVE-2026-2332) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-50645](https://nvd.nist.gov/vuln/detail/CVE-2026-50645) - [CVE-2026-6790](https://nvd.nist.gov/vuln/detail/CVE-2026-6790) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) - [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) - [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) - [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) - [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777) |
| **N/A** | **Security fixes for `apigee-operators`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) |
| **N/A** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-redis`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-runtime`.** This addresses the following vulnerabilities: - [CVE-2025-46392](https://nvd.nist.gov/vuln/detail/CVE-2025-46392) - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-50645](https://nvd.nist.gov/vuln/detail/CVE-2026-50645) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) - [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) - [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) - [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) - [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777) |
| **N/A** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-50645](https://nvd.nist.gov/vuln/detail/CVE-2026-50645) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) - [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) - [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) - [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) - [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777) |
| **N/A** | **Security fixes for `apigee-udca`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |
| **N/A** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) |

## October 20, 2026

**Apigee X** Announcement On October 20th, 2026, we began maintenance updates of Apigee instances [configured for maintenance windows](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/maintenance-windows.md.txt).

If you set a preferred window for maintenance for your instance, and your instance version is
below **1-18-0-apigee-6** , your instance will be updated to **1-18-0-apigee-6** within the
next seven to 21 days. A notification containing the expected date of upgrade will be sent within the next two business days.

> [!NOTE]
> Note: Instances that meet either of the following two criteria will **not** be updated:
>
> - Your instance has a DNS misconfiguration, as described in [Known Issue 445936920](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt).
> - Your instance uses an Apigee Java Library that has been removed, as described in [Apigee release notes dated October 16, 2025](https://docs.cloud.google.com/apigee/docs/release/release-notes.md.txt#October_16_2025).

For more information on participating in scheduled maintenance windows, see [Maintenance overview](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/maintenance.md.txt) and [Manage Apigee instance maintenance windows](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/maintenance-windows.md.txt).

## October 15, 2026

**Apigee Edge for Private Cloud** Announcement Released Apigee Edge for Private Cloud 4.54.00.

Designated Apigee Edge for Private Cloud 4.54.00.00 a long-term support (LTS)
release: 18 months of full support ending April 2028, then 18 months of
maintenance ending October 2029. After October 2029, 4.54.00.00 receives no
software updates, security mitigations, or technical support.

Installing a later 4.54 minor release or patch does not change those dates. To
extend the support lifecycle, upgrade to the next LTS release.

For the support lifecycle phases, release cadences, and version numbering, see
[Apigee Edge for Private Cloud release and lifecycle policy](https://docs.apigee.com/release/private-cloud-release-lifecycle-policy).
Announcement This release replaces Java 8 with Java 17 and Java 21, removes the Classic UI
and the `apigee-sso` component, and updates the bundled Cassandra, Postgres,
OpenLDAP, ZooKeeper, Qpid Broker-J, Nginx, and Consul versions. These changes
are not backward-compatible.

For the 4.54.00 versions and the 4.53.01 versions they replace, see
[Supported software and supported versions](https://docs.apigee.com/release/supported-software).

Before upgrading, read
[Changes in Edge for Private Cloud 4.54.00](https://docs.apigee.com/private-cloud/v4.54.00/changes-privatecloud-45400),
then
[Update Apigee Edge 4.53.00 or 4.53.01 to 4.54.00](https://docs.apigee.com/private-cloud/v4.54.00/update-apigee-edge-4530x-45400)
or
[New installation overview](https://docs.apigee.com/private-cloud/v4.54.00/installation-overview).
For known issues, see
[Known issues with Edge for Private Cloud](https://docs.apigee.com/release/known-issues#private-cloud-known-issues).
Announcement Replaced the Classic UI (`edge-ui`) with the
[New Edge UI](https://docs.apigee.com/private-cloud/v4.54.00/new-edge-ui)
(`edge-management-ui`).

The New Edge UI is the only management UI in 4.54.00 and is installed by
default. Deployments running the Classic UI must transition to it before
upgrading. Custom Classic UI properties do not carry over automatically. The
default port also changes from `9000` to `3001`, configurable with
`conf_uebe_port`, so firewall rules and load balancer target ports that point
at `9000` fail until they are updated.

For the migration steps and the supported feature list, see
[Migrate to the New Edge UI](https://docs.apigee.com/private-cloud/v4.54.00/migrate-ui)
and
[What features are supported?](https://docs.apigee.com/private-cloud/v4.54.00/new-edge-ui#features).
Breaking In deployments with Apigee SSO enabled, an integrated OIDC identity broker in
`apigee-openldap` replaces the standalone `apigee-sso` component and Apache
Tomcat 9.0.x. Before upgrading, take a complete and validated LDAP backup;
existing `apigee-sso` configurations do not migrate automatically. Deployments
not using Apigee SSO require no action.

For migration prerequisites, validation checks, and rollback constraints, see
[Option 2: Upgrade UI (with Apigee SSO)](https://docs.apigee.com/private-cloud/v4.54.00/update-apigee-edge-4530x-45400#upgrade-ui-with-apigee-sso).
Breaking 4.54.00 runs Java in mixed mode: Java 17 for Cassandra and ZooKeeper, Java 21
for the Management Server, Message Processor, Router, and Qpid Broker-J. Both
Oracle JDK and OpenJDK are supported at those versions.

Oracle JDK 8 and OpenJDK 8 are no longer supported.

API proxies with custom JavaCallout policies or custom resource JARs can break
on Java 21. For details, see
[Changes in Edge for Private Cloud 4.54.00](https://docs.apigee.com/private-cloud/v4.54.00/changes-privatecloud-45400).
Change Upgraded Nginx on the Edge Router to 1.30.0.

If you are upgrading from Nginx 1.20.x, see
[Nginx 1.30 changes in Apigee Edge 4.54.00](https://docs.apigee.com/private-cloud/v4.54.00/nginx-45400)
for the full list of changes.
Change Changed the TLS defaults on Message Processors to the Java 21 cryptographic
baseline.

Message Processors run on Java 21, which enables TLS 1.3 by default
([JEP 332](https://openjdk.org/jeps/332)) and prefers it for outbound backend
connections, falling back to TLS 1.2. No configuration change is required if
your target servers and load balancers negotiate TLS 1.3, or negotiate TLS 1.2
with forward-secret (ECDHE) cipher suites.

Java 21 also disables the non-forward-secret static RSA key-exchange suites
(`TLS_RSA_*`). If you have overridden
`conf_http_HTTPTransport.ssl.cipher.suites.whitelist` or
`conf_message-processor-communication_local.http.ssl.ciphers` with static RSA
suites only, backend calls fail with `no cipher suites in common` and the
Router cannot complete a TLS handshake with the Message Processor. Replace the
`TLS_RSA_*` entries with modern cipher suites and restart the Message
Processor.

For the remediation path, see
[Legacy backend requirements and remediation](https://docs.apigee.com/private-cloud/v4.54.00/changes-privatecloud-45400#legacy-tls-remediation).
Feature Added Basic authentication to the New Edge UI, which lets you sign in without
configuring an identity provider.

The [New Edge UI](https://docs.apigee.com/private-cloud/v4.54.00/new-edge-ui)
supports Basic authentication without additional configuration. You can also
configure Apigee SSO, or an external identity provider such as SAML or OIDC.
This feature is generally available in 4.54.00.
Feature Added automated pre-flight validation checks to `apigee-setup` and
`apigee-service`, which surface environment configuration problems before a
component is installed.

This feature is generally available in 4.54.00.
Security Fixed multiple security vulnerabilities in Apigee Edge for Private Cloud
4.54.00.

These fixes ship as part of the component upgrades in this release; see
[Changes in Edge for Private Cloud 4.54.00](https://docs.apigee.com/private-cloud/v4.54.00/changes-privatecloud-45400).
Change Changed the default garbage collector on Message Processors to the
Garbage-First garbage collector.

Message Processors set `useG1GC=true` and `useStringDeduplication=true` by
default in 4.54.00. In 4.53.01 neither was set by default. To configure garbage
collection, see
[Configure the garbage collector for Message Processors](https://docs.apigee.com/private-cloud/v4.54.00/configuring-gc-message-processors-4.54).
**Apigee Edge for Public Cloud** Announcement On October 15, 2026, we began releasing Single Sign-On (SSO) updates for Apigee
Edge for Public Cloud.
Fixed

| Bug ID | Component | Description |
|---|---|---|
| **560310696** | SSO | Fixed an issue where the Portal SSO endpoint inadvertently accepted deprecated TLS 1.1 connections. The endpoint now strictly enforces TLS 1.2+. |

**Apigee Integrated Portal** Announcement On October 15, 2026, we released a new version of the Apigee integrated portal.
Fixed

| Bug ID | Description |
|---|---|
| **560310696** | Fixed an issue where the Portal SSO endpoint inadvertently accepted deprecated TLS 1.1 connections. The endpoint now strictly enforces TLS 1.2+. |

**Apigee X** Fixed

| Bug ID | Description |
|---|---|
| **466116259** | Updated the startup script for the managed instance group (MIG) that routes external traffic to Apigee. `net.ipv4.ip_forward` is now written to `/etc/sysctl.d/`, so an instance no longer stops forwarding traffic when a reboot or an OS update resets it. The script does not change unrelated `iptables` NAT rules. Instances pick up the change the next time they are restarted or recreated. |

## October 14, 2026

**Apigee hybrid** v1.16.11 Announcement

### v1.16.11

On October 14, 2026 we released an updated version of the Apigee hybrid software, v1.16.11.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.16.11](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Fixed

#### Fixed in this release

| Bug ID | Description |
|---|---|
| **565072374** | **Fixed an issue where `VerifyJWT` policies using a JWKS `uriRef` could return `steps.jwt.NoMatchingPublicKey` on the first request after the 5-minute JWKS cache TTL expired when the identity provider rotated keys. The cache now refreshes synchronously upon expiration.** |
| **556680325** | **Fixed a server-side request forgery (SSRF) vulnerability in URL host validation for the `SemanticCacheLookup` policy.** |
| **535395491** | **Extension Processor (`ext_proc`) denials now return the status and body that the policy or FaultRule produced, instead of always returning HTTP `500`.** |
| **513032450** | **Fixed an issue where `apigee-connect-agent` control-plane connections could hang for up to 2 hours when silently dropped by a network intermediary by restoring a 15-second TCP keep-alive.** |
| **502540992** | **Fixed an issue where the `SemanticCacheLookup` policy was incompatible with Vertex AI Vector Search Private Service Connect (PSC) endpoints by adding gRPC transport support via `<PrivateServiceConnect><GrpcEndpoint>`.** |
| **492042425** | **Fixed an issue in the `LLMTokenQuota` policy where operation-level token quota values configured on an API product were not applied at runtime, causing product-level quota values to be enforced instead.** |
| **449228485** | **Fixed an issue where `podDisruptionBudget` overrides set through Helm had no effect because the `apigee-operator` chart CRDs didn't include the `podDisruptionBudget` field. These overrides now take effect.** |

Security

| Bug ID | Description |
|---|---|
| **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2026-35189](https://nvd.nist.gov/vuln/detail/CVE-2026-35189) - [CVE-2026-35191](https://nvd.nist.gov/vuln/detail/CVE-2026-35191) - [CVE-2026-42772](https://nvd.nist.gov/vuln/detail/CVE-2026-42772) - [CVE-2026-5450](https://nvd.nist.gov/vuln/detail/CVE-2026-5450) - [CVE-2026-54872](https://nvd.nist.gov/vuln/detail/CVE-2026-54872) - [CVE-2026-54873](https://nvd.nist.gov/vuln/detail/CVE-2026-54873) - [CVE-2026-54875](https://nvd.nist.gov/vuln/detail/CVE-2026-54875) - [CVE-2026-58050](https://nvd.nist.gov/vuln/detail/CVE-2026-58050) - [CVE-2026-58051](https://nvd.nist.gov/vuln/detail/CVE-2026-58051) - [CVE-2026-5928](https://nvd.nist.gov/vuln/detail/CVE-2026-5928) - [CVE-2026-66032](https://nvd.nist.gov/vuln/detail/CVE-2026-66032) - [CVE-2026-66033](https://nvd.nist.gov/vuln/detail/CVE-2026-66033) - [CVE-2026-66034](https://nvd.nist.gov/vuln/detail/CVE-2026-66034) - [CVE-2026-66035](https://nvd.nist.gov/vuln/detail/CVE-2026-66035) - [CVE-2026-72897](https://nvd.nist.gov/vuln/detail/CVE-2026-72897) - [CVE-2026-75804](https://nvd.nist.gov/vuln/detail/CVE-2026-75804) - [CVE-2026-75805](https://nvd.nist.gov/vuln/detail/CVE-2026-75805) - [CVE-2026-75806](https://nvd.nist.gov/vuln/detail/CVE-2026-75806) - [CVE-2026-77696](https://nvd.nist.gov/vuln/detail/CVE-2026-77696) - [CVE-2026-84782](https://nvd.nist.gov/vuln/detail/CVE-2026-84782) - [CVE-2026-84784](https://nvd.nist.gov/vuln/detail/CVE-2026-84784) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** This addresses the following vulnerability: - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) |
| **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) |
| **N/A** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerabilities: - [CVE-2024-6763](https://nvd.nist.gov/vuln/detail/CVE-2024-6763) - [CVE-2025-46392](https://nvd.nist.gov/vuln/detail/CVE-2025-46392) - [CVE-2026-10050](https://nvd.nist.gov/vuln/detail/CVE-2026-10050) - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-2332](https://nvd.nist.gov/vuln/detail/CVE-2026-2332) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-6790](https://nvd.nist.gov/vuln/detail/CVE-2026-6790) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) |
| **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** This addresses the following vulnerabilities: - [CVE-2024-6763](https://nvd.nist.gov/vuln/detail/CVE-2024-6763) - [CVE-2025-46392](https://nvd.nist.gov/vuln/detail/CVE-2025-46392) - [CVE-2026-10050](https://nvd.nist.gov/vuln/detail/CVE-2026-10050) - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-2332](https://nvd.nist.gov/vuln/detail/CVE-2026-2332) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-6790](https://nvd.nist.gov/vuln/detail/CVE-2026-6790) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) |
| **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) |
| **N/A** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerability: - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) |
| **N/A** | **Security fixes for `apigee-runtime`.** This addresses the following vulnerabilities: - [CVE-2025-46392](https://nvd.nist.gov/vuln/detail/CVE-2025-46392) - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) |
| **N/A** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) |

## October 07, 2026

**Apigee hybrid** v1.14.9 Announcement

### v1.14.9

On October 7, 2026 we released an updated version of the Apigee hybrid software, v1.14.9.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.14.9](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Fixed

#### Fixed in this release

| Bug ID | Description |
|---|---|
| **565072374** | **Fixed an issue where `VerifyJWT` policies using a JWKS `uriRef` could return `steps.jwt.NoMatchingPublicKey` on the first request after the 5-minute JWKS cache TTL expired when the identity provider rotated keys. The cache now refreshes synchronously upon expiration.** |
| **564969400** | **Fixed an issue where variables initialized from an empty `<Value/>` element in `AssignMessage` (`AssignVariable`) were not treated as empty strings when referenced in message template functions such as `replaceAll`.** |
| **558888960** | **Fixed an issue in distributed tracing where the target URL was omitted from outbound target request span attributes after a request-flow policy step executed.** |
| **554114419** | **Apigee hybrid now allows policies to modify HTTP/2 request pseudo-headers (`:path` and `:authority`) when communicating over HTTP/2.** |
| **548763108** | **Hardened Message Processor outbound HTTP validation to block requests to internal Kubernetes cluster hostnames (`*.svc.cluster.local`).** |
| **513032450** | **Fixed an issue where `apigee-connect-agent` control-plane connections could hang for up to 2 hours when silently dropped by a network intermediary by restoring a 15-second TCP keep-alive.** |

Security

| Bug ID | Description |
|---|---|
| **N/A** | **Security fixes for `apigee-asm-ingress`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) |
| **N/A** | **Security fixes for `apigee-asm-istiod`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) |
| **N/A** | **Security fixes for `apigee-connect-agent`.** This addresses the following vulnerabilities: - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) |
| **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2026-14456](https://nvd.nist.gov/vuln/detail/CVE-2026-14456) - [CVE-2026-14457](https://nvd.nist.gov/vuln/detail/CVE-2026-14457) - [CVE-2026-18798](https://nvd.nist.gov/vuln/detail/CVE-2026-18798) - [CVE-2026-54874](https://nvd.nist.gov/vuln/detail/CVE-2026-54874) - [CVE-2026-63072](https://nvd.nist.gov/vuln/detail/CVE-2026-63072) - [CVE-2026-63073](https://nvd.nist.gov/vuln/detail/CVE-2026-63073) - [CVE-2026-63074](https://nvd.nist.gov/vuln/detail/CVE-2026-63074) - [CVE-2026-63075](https://nvd.nist.gov/vuln/detail/CVE-2026-63075) - [CVE-2026-63076](https://nvd.nist.gov/vuln/detail/CVE-2026-63076) - [CVE-2026-75803](https://nvd.nist.gov/vuln/detail/CVE-2026-75803) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** This addresses the following vulnerabilities: - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) |
| **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) |
| **N/A** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerabilities: - [CVE-2025-46392](https://nvd.nist.gov/vuln/detail/CVE-2025-46392) - [CVE-2026-13506](https://nvd.nist.gov/vuln/detail/CVE-2026-13506) - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) - [CVE-2026-8763](https://nvd.nist.gov/vuln/detail/CVE-2026-8763) |
| **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** This addresses the following vulnerabilities: - [CVE-2025-46392](https://nvd.nist.gov/vuln/detail/CVE-2025-46392) - [CVE-2026-13506](https://nvd.nist.gov/vuln/detail/CVE-2026-13506) - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) - [CVE-2026-8763](https://nvd.nist.gov/vuln/detail/CVE-2026-8763) |
| **N/A** | **Security fixes for `apigee-open-telemetry-collector`.** This addresses the following vulnerabilities: - [CVE-2026-43871](https://nvd.nist.gov/vuln/detail/CVE-2026-43871) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-81871](https://nvd.nist.gov/vuln/detail/CVE-2026-81871) - [CVE-2026-81872](https://nvd.nist.gov/vuln/detail/CVE-2026-81872) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) |
| **N/A** | **Security fixes for `apigee-operators`.** This addresses the following vulnerabilities: - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) |
| **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) |
| **N/A** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerabilities: - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) |
| **N/A** | **Security fixes for `apigee-runtime`.** This addresses the following vulnerabilities: - [CVE-2025-46392](https://nvd.nist.gov/vuln/detail/CVE-2025-46392) - [CVE-2026-13506](https://nvd.nist.gov/vuln/detail/CVE-2026-13506) - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) - [CVE-2026-8763](https://nvd.nist.gov/vuln/detail/CVE-2026-8763) |
| **N/A** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2026-13506](https://nvd.nist.gov/vuln/detail/CVE-2026-13506) - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) - [CVE-2026-8763](https://nvd.nist.gov/vuln/detail/CVE-2026-8763) |
| **N/A** | **Security fixes for `apigee-udca`.** This addresses the following vulnerabilities: - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) |
| **N/A** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerabilities: - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) |

## October 05, 2026

**Apigee Edge for Public Cloud** Security **Security fixes for the integrated portal and API specs in the Apigee Edge
management UIs.**

The Apigee Edge UIs for managing integrated portals and API specs were updated
to patch vulnerabilities in underlying libraries and serving components.
Functionality is unchanged, but some pages might show minor styling differences.

## October 02, 2026

**Apigee X** Announcement On October 2, 2026, we released an updated version of Apigee (1-18-0-apigee-6).

> [!NOTE]
> **Note:** Rollouts of this release began today and can take four or more business days to complete across all Google Cloud zones. Your instances might not have the features and fixes available until the rollout is complete.

Security

| Bug ID | Description |
|---|---|
| **564386425** | **Security fix for Apigee.** Upgraded the Apigee ingress gateway (ASM) to patch security vulnerabilities. |
| **561666530** | **Security fix for Apigee.** Upgraded the Prometheus library to patch the following vulnerabilities: <br /> - [CVE-2026-42151](https://nvd.nist.gov/vuln/detail/CVE-2026-42151) - [CVE-2026-42154](https://nvd.nist.gov/vuln/detail/CVE-2026-42154) - [CVE-2026-44903](https://nvd.nist.gov/vuln/detail/CVE-2026-44903) - [CVE-2026-40179](https://nvd.nist.gov/vuln/detail/CVE-2026-40179) <br /> |
| **N/A** | **Security fix for Apigee infrastructure.** |

Fixed

| Bug ID | Description |
|---|---|
| **432315283** | Fixed a multi-certificate truststore so that its trust anchors take effect without a Message Processor restart when `features.truststore.multi_cert_bundle.enabled` is toggled at runtime; the outbound SSL context is now rebuilt automatically on any trust-anchor change. |
| **565072374** | VerifyJWT policies that use a JWKS `uriRef` no longer return `steps.jwt.NoMatchingPublicKey` on the first request after the JWKS cache TTL expires when the identity provider has rotated to a new key ID. The cache now re-fetches synchronously when its entry expires. |
| **535395491** | Extension Processor (ext_proc) denials now return the status and body that the policy or FaultRule produced, instead of always returning HTTP 500. |
| **558421499** | Apigee runtime runs on JRE 21. |
| **517953321** | The `lookupcache.<n>.isEncrypted` and `responsecache.<n>.isEncrypted` flow variables now report the per-entry on-disk encryption state of the L2 cache, rather than approximating whether the cache-encryption key is loaded. L1 cache hits report `false`. Review any policy conditions that rely on these flow variables. |
| **563557547** | Fixed EventFlow (Server-Sent Events) coalescing multiple events into a single policy invocation under burst load on the http-adaptor data path, which produced malformed SSE output to the client. |
| **562740573** | Apigee Analytics now populates the `processing_mode` dimension, distinguishing proxy traffic from extension-processor traffic. This dimension is not populated in billing-only analytics mode. |
| **357042873** | Stopped redirecting `apigee-cassandra-schema-readiness` init container logs to `/dev/null`, improving troubleshooting. Workloads undergo a rolling restart upon upgrade. |
| **564969400** | Fixed an issue where variables initialized from an empty `<Value/>` element in `AssignMessage` (`AssignVariable`) were not treated as empty strings when referenced in message template functions such as `replaceAll`. |
| **N/A** | Updates to infrastructure and libraries. |

## September 30, 2026

**Apigee API hub** Feature **Service type system attribute (GA)**

API hub now includes **Service type** , a system attribute that classifies an API as `Code`, `Model`, `Agent`, or `Skill`. Service type describes what a service is. **API style** describes how you call it. Use Service type to find and govern your APIs, agents, models, and skills.

Set Service type when you register or edit an API. To show only your agents, filter the API list by Service type, or select the new **Agent** chip. In the API, use the `service_type` field.

This feature is [Generally Available (GA)](https://cloud.google.com/products#product-launch-stages). For more information, see [Supported system attributes](https://docs.cloud.google.com/apigee/docs/apihub/manage-attributes.md.txt#supported-system-attributes).
Feature **AI performance and Tool performance dashboards in API insights**

API insights in API hub now includes two dashboards for AI and agent traffic:

- **AI performance** reports token usage and model latency for the large language models called through your gateways, with filters for model and provider.
- **Tool performance** reports traffic, throughput, payload sizes, and latency for your Model Context Protocol (MCP) tools, with filters for MCP server, deployment, and tool name.

For more information, see [API insights dashboards](https://docs.cloud.google.com/apigee/docs/apihub/api-insights-dashboard.md.txt).
**Apigee hybrid** v1.17.1 Announcement

### v1.17.1

On September 30, 2026 we released an updated version of the Apigee hybrid software, v1.17.1.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.17.1](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Feature **External Cassandra datastore support**

Apigee hybrid v1.17.1 adds support for connecting an Apigee hybrid runtime to a Cassandra datastore that runs in a separate Kubernetes cluster (**external datastore** mode). In external datastore mode, the runtime cluster runs with `cassandra.replicaCount: 0` (no local Cassandra pods) and connects to the remote Cassandra ring using the [`cassandra.properties.externalHost`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/config-prop-ref.md.txt#cassandra) property (a comma-separated list of remote Cassandra IP addresses) and the optional [`cassandra.properties.externalEndpointsSync`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/config-prop-ref.md.txt#cassandra) property for dynamic endpoint synchronization.

For more information, see [Use an external Cassandra datastore](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/cassandra-external.md.txt) and [Configuration property reference](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/config-prop-ref.md.txt#cassandra).
Change **The Apigee operator's Kubernetes manager role now includes the core `endpoints` permission.**

In v1.17.1, the Apigee operator's manager role is granted the core (`""` API group) [`endpoints`](https://kubernetes.io/docs/concepts/services-networking/service/#endpoints) resource, with the verbs `get`, `list`, `watch`, `create`, `update`, `patch`, and `delete`. This role is the namespaced `apigee-manager-role` Kubernetes `Role` created by default in the `apigee` namespace. The operator needs this permission for the external (cross-cluster) Cassandra datastore feature: when a datastore uses an external host, the operator directly manages the `Endpoints` object of the selectorless Kubernetes `Service` that fronts it.

This permission is granted to **all** v1.17.1 installations, whether or not you use an external datastore. It is added to the operator's manager role and is not gated on any configuration property, so security teams that audit operator permissions should expect it after upgrading. Because the grant is on a namespaced `Role`, the new access is limited to the Apigee namespace and does not extend cluster-wide.

Most installations require no action. The `apigee-operator` Helm chart defines this role, so running `helm upgrade` on the `apigee-operator` chart grants the permission automatically.

If you self-manage the Apigee operator's Kubernetes RBAC, meaning you prevent Helm from creating or updating the operator's `Role` objects, add the `endpoints` resource to the existing core (`""`) API group rule of the `apigee-manager-role` `Role` in the Apigee namespace, or append the following rule:

```yaml
- apiGroups: [""]
  resources: ["endpoints"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
```

If you self-manage the operator's RBAC, add this permission before you upgrade to v1.17.1. If you have already upgraded without this permission, apply the update to your role configuration to ensure proper operator functionality. Without this permission, the operator cannot manage the `Endpoints` object of an external datastore, so the external datastore feature does not work. If you do not use an external datastore, the operator works without this permission.

> [!NOTE]
> **Note:** The [`ao.args.disableManagedClusterRoles`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/config-prop-ref.md.txt#ao-args-disablemanagedclusterroles) property does not apply to this change. That property governs only `ClusterRole` and `ClusterRoleBinding` objects, whereas this permission is added to a namespaced `Role`.

Fixed

#### Fixed in this release

| Bug ID | Description |
|---|---|
| **565753858** | **Fixed an issue where the `apigee-mcp-server` controller dropped pod-level volumes configured on the `mcpServer` component (such as `fwi-token` volumes when Federated Workload Identity is enabled), causing `ReplicaSet` creation to fail.** |
| **565072374** | **Fixed an issue where `VerifyJWT` policies using a JWKS `uriRef` could return `steps.jwt.NoMatchingPublicKey` on the first request after the 5-minute JWKS cache TTL expired when the identity provider rotated keys. The cache now refreshes synchronously upon expiration.** |
| **564969400** | **Fixed an issue where variables initialized from an empty `<Value/>` element in `AssignMessage` (`AssignVariable`) were not treated as empty strings when referenced in message template functions such as `replaceAll`.** |
| **563557547** | **Fixed an issue where EventFlow (Server-Sent Events) could coalesce multiple events into a single policy invocation under burst traffic on the `http-adaptor` datapath, producing malformed SSE responses.** |
| **560372165** | **Fixed a synchronizer readiness-gate deadlock that could leave a Message Processor on an older contract revision and return `404 ApplicationNotFound` for newly deployed standard proxies.** |
| **560130499** | **Fixed a security issue by hardening the `JavaCallout` policy sandbox.** |
| **558888960** | **Fixed an issue in distributed tracing where the target URL was omitted from outbound target request span attributes after a request-flow policy step executed.** |
| **556750755** | **Fixed an issue where EventFlow (Server-Sent Events) dropped or truncated events following a large (\>16 KB) event under load on the `http-adaptor` datapath.** |
| **556680325** | **Fixed a server-side request forgery (SSRF) vulnerability in URL host validation for the `SemanticCacheLookup` policy.** |
| **554114419** | **Apigee hybrid now allows policies to modify HTTP/2 request pseudo-headers (`:path` and `:authority`) when communicating over HTTP/2.** |
| **548763108** | **Hardened Message Processor outbound HTTP validation to block requests to internal Kubernetes cluster hostnames (`*.svc.cluster.local`).** |
| **547712217** | **Fixed an issue where EventFlow (Server-Sent Events) responses larger than 16 KB could be truncated or corrupted across socket reads.** |
| **531783017** | **Fixed a security issue in the `MessageLogging` policy where syslog-over-TLS did not verify the server TLS certificate hostname when `<Enforce>true</Enforce>` was configured in `<SSLInfo>`.** |
| **513032450** | **Fixed an issue where `apigee-connect-agent` control-plane connections could hang for up to 2 hours when silently dropped by a network intermediary by restoring a 15-second TCP keep-alive.** |
| **432315283** | **Fixed an issue where only the first certificate in a multi-certificate PEM bundle uploaded to a single truststore alias was registered when the `features.truststore.multi_cert_bundle.enabled` environment property is set to `true`.** |
| **357042873** | **Fixed an issue where `apigee-cassandra-schema-readiness` init container logs were redirected to `/dev/null`, improving troubleshooting visibility.** |

Security

| Bug ID | Description |
|---|---|
| **N/A** | **Security fixes for `apigee-connect-agent`.** This addresses the following vulnerability: - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2022-42003](https://nvd.nist.gov/vuln/detail/CVE-2022-42003) - [CVE-2022-42004](https://nvd.nist.gov/vuln/detail/CVE-2022-42004) - [CVE-2024-45336](https://nvd.nist.gov/vuln/detail/CVE-2024-45336) - [CVE-2024-45341](https://nvd.nist.gov/vuln/detail/CVE-2024-45341) - [CVE-2024-47554](https://nvd.nist.gov/vuln/detail/CVE-2024-47554) - [CVE-2025-0913](https://nvd.nist.gov/vuln/detail/CVE-2025-0913) - [CVE-2025-22866](https://nvd.nist.gov/vuln/detail/CVE-2025-22866) - [CVE-2025-22870](https://nvd.nist.gov/vuln/detail/CVE-2025-22870) - [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) - [CVE-2025-22873](https://nvd.nist.gov/vuln/detail/CVE-2025-22873) - [CVE-2025-4673](https://nvd.nist.gov/vuln/detail/CVE-2025-4673) - [CVE-2025-4674](https://nvd.nist.gov/vuln/detail/CVE-2025-4674) - [CVE-2025-47906](https://nvd.nist.gov/vuln/detail/CVE-2025-47906) - [CVE-2025-47907](https://nvd.nist.gov/vuln/detail/CVE-2025-47907) - [CVE-2025-47912](https://nvd.nist.gov/vuln/detail/CVE-2025-47912) - [CVE-2025-48924](https://nvd.nist.gov/vuln/detail/CVE-2025-48924) - [CVE-2025-52999](https://nvd.nist.gov/vuln/detail/CVE-2025-52999) - [CVE-2025-58183](https://nvd.nist.gov/vuln/detail/CVE-2025-58183) - [CVE-2025-58185](https://nvd.nist.gov/vuln/detail/CVE-2025-58185) - [CVE-2025-58186](https://nvd.nist.gov/vuln/detail/CVE-2025-58186) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58189](https://nvd.nist.gov/vuln/detail/CVE-2025-58189) - [CVE-2025-61723](https://nvd.nist.gov/vuln/detail/CVE-2025-61723) - [CVE-2025-61724](https://nvd.nist.gov/vuln/detail/CVE-2025-61724) - [CVE-2025-61725](https://nvd.nist.gov/vuln/detail/CVE-2025-61725) - [CVE-2025-61726](https://nvd.nist.gov/vuln/detail/CVE-2025-61726) - [CVE-2025-61727](https://nvd.nist.gov/vuln/detail/CVE-2025-61727) - [CVE-2025-61728](https://nvd.nist.gov/vuln/detail/CVE-2025-61728) - [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729) - [CVE-2025-61730](https://nvd.nist.gov/vuln/detail/CVE-2025-61730) - [CVE-2025-61731](https://nvd.nist.gov/vuln/detail/CVE-2025-61731) - [CVE-2025-61732](https://nvd.nist.gov/vuln/detail/CVE-2025-61732) - [CVE-2025-68121](https://nvd.nist.gov/vuln/detail/CVE-2025-68121) - [CVE-2025-68161](https://nvd.nist.gov/vuln/detail/CVE-2025-68161) - [CVE-2026-25679](https://nvd.nist.gov/vuln/detail/CVE-2026-25679) - [CVE-2026-27139](https://nvd.nist.gov/vuln/detail/CVE-2026-27139) - [CVE-2026-27140](https://nvd.nist.gov/vuln/detail/CVE-2026-27140) - [CVE-2026-27142](https://nvd.nist.gov/vuln/detail/CVE-2026-27142) - [CVE-2026-27143](https://nvd.nist.gov/vuln/detail/CVE-2026-27143) - [CVE-2026-27144](https://nvd.nist.gov/vuln/detail/CVE-2026-27144) - [CVE-2026-27145](https://nvd.nist.gov/vuln/detail/CVE-2026-27145) - [CVE-2026-32280](https://nvd.nist.gov/vuln/detail/CVE-2026-32280) - [CVE-2026-32281](https://nvd.nist.gov/vuln/detail/CVE-2026-32281) - [CVE-2026-32282](https://nvd.nist.gov/vuln/detail/CVE-2026-32282) - [CVE-2026-32283](https://nvd.nist.gov/vuln/detail/CVE-2026-32283) - [CVE-2026-32288](https://nvd.nist.gov/vuln/detail/CVE-2026-32288) - [CVE-2026-32289](https://nvd.nist.gov/vuln/detail/CVE-2026-32289) - [CVE-2026-33811](https://nvd.nist.gov/vuln/detail/CVE-2026-33811) - [CVE-2026-33814](https://nvd.nist.gov/vuln/detail/CVE-2026-33814) - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-34477](https://nvd.nist.gov/vuln/detail/CVE-2026-34477) - [CVE-2026-34480](https://nvd.nist.gov/vuln/detail/CVE-2026-34480) - [CVE-2026-39817](https://nvd.nist.gov/vuln/detail/CVE-2026-39817) - [CVE-2026-39819](https://nvd.nist.gov/vuln/detail/CVE-2026-39819) - [CVE-2026-39820](https://nvd.nist.gov/vuln/detail/CVE-2026-39820) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-39822](https://nvd.nist.gov/vuln/detail/CVE-2026-39822) - [CVE-2026-39823](https://nvd.nist.gov/vuln/detail/CVE-2026-39823) - [CVE-2026-39825](https://nvd.nist.gov/vuln/detail/CVE-2026-39825) - [CVE-2026-39826](https://nvd.nist.gov/vuln/detail/CVE-2026-39826) - [CVE-2026-39836](https://nvd.nist.gov/vuln/detail/CVE-2026-39836) - [CVE-2026-42499](https://nvd.nist.gov/vuln/detail/CVE-2026-42499) - [CVE-2026-42501](https://nvd.nist.gov/vuln/detail/CVE-2026-42501) - [CVE-2026-42504](https://nvd.nist.gov/vuln/detail/CVE-2026-42504) - [CVE-2026-42505](https://nvd.nist.gov/vuln/detail/CVE-2026-42505) - [CVE-2026-42507](https://nvd.nist.gov/vuln/detail/CVE-2026-42507) - [CVE-2026-50193](https://nvd.nist.gov/vuln/detail/CVE-2026-50193) - [CVE-2026-54512](https://nvd.nist.gov/vuln/detail/CVE-2026-54512) - [CVE-2026-54513](https://nvd.nist.gov/vuln/detail/CVE-2026-54513) - [CVE-2026-54514](https://nvd.nist.gov/vuln/detail/CVE-2026-54514) - [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [GHSA-r7wm-3cxj-wff9](https://osv.dev/vulnerability/GHSA-r7wm-3cxj-wff9) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** This addresses the following vulnerabilities: - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) |
| **N/A** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerabilities: - [CVE-2026-13506](https://nvd.nist.gov/vuln/detail/CVE-2026-13506) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-50645](https://nvd.nist.gov/vuln/detail/CVE-2026-50645) - [CVE-2026-8763](https://nvd.nist.gov/vuln/detail/CVE-2026-8763) |
| **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** This addresses the following vulnerabilities: - [CVE-2026-13506](https://nvd.nist.gov/vuln/detail/CVE-2026-13506) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-50645](https://nvd.nist.gov/vuln/detail/CVE-2026-50645) - [CVE-2026-8763](https://nvd.nist.gov/vuln/detail/CVE-2026-8763) |
| **N/A** | **Security fixes for `apigee-operators`.** This addresses the following vulnerability: - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) |
| **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) |
| **N/A** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerability: - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) |
| **N/A** | **Security fixes for `apigee-runtime`.** This addresses the following vulnerabilities: - [CVE-2026-13506](https://nvd.nist.gov/vuln/detail/CVE-2026-13506) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-50645](https://nvd.nist.gov/vuln/detail/CVE-2026-50645) - [CVE-2026-8763](https://nvd.nist.gov/vuln/detail/CVE-2026-8763) |
| **N/A** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2026-13506](https://nvd.nist.gov/vuln/detail/CVE-2026-13506) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-50645](https://nvd.nist.gov/vuln/detail/CVE-2026-50645) - [CVE-2026-8763](https://nvd.nist.gov/vuln/detail/CVE-2026-8763) |
| **N/A** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerability: - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) |

## September 24, 2026

**Apigee hybrid** v1.15.8 Announcement

### v1.15.8

On September 24, 2026 we released an updated version of the Apigee hybrid software, v1.15.8.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.15.8](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Fixed

#### Fixed in this release

| Bug ID | Description |
|---|---|
| **535928300** | **Fixed a security issue in JWT refresh token revocation handling.** |
| **535683286** | **Fixed a security issue in HTTP target interim-response (`103 Early Hints`) handling to prevent response desynchronization.** |
| **534852923** | **Fixed a security issue in the `JavaCallout` policy.** |
| **534420582** | **The `JSONThreatProtection` policy now supports an optional `<RejectDuplicateKeys>` child element that rejects JSON payloads containing duplicate keys within the same object.** |
| **531773665** | **Fixed an issue where the `VerifyAPIKey` policy could fail with a `NullPointerException` when reading developer attributes.** |
| **469642464** | **Improved input validation in AI protection policies to prevent server-side request forgery (SSRF).** |
| **449228485** | **Apigee hybrid now supports configuring custom Kubernetes `PodDisruptionBudget` (`minAvailable` or `maxUnavailable`) values for Apigee hybrid components in your `overrides.yaml` file. These overrides take effect from Apigee hybrid v1.15.9, which adds the `podDisruptionBudget` field to the CRDs in the `apigee-operator` chart.** |

Security

| Bug ID | Description |
|---|---|
| **N/A** | **Security fixes for `apigee-asm-ingress`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) |
| **N/A** | **Security fixes for `apigee-asm-istiod`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) |
| **N/A** | **Security fixes for `apigee-connect-agent`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) |
| **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2025-13151](https://nvd.nist.gov/vuln/detail/CVE-2025-13151) - [CVE-2025-14524](https://nvd.nist.gov/vuln/detail/CVE-2025-14524) - [CVE-2025-14819](https://nvd.nist.gov/vuln/detail/CVE-2025-14819) - [CVE-2026-14456](https://nvd.nist.gov/vuln/detail/CVE-2026-14456) - [CVE-2026-14457](https://nvd.nist.gov/vuln/detail/CVE-2026-14457) - [CVE-2026-14662](https://nvd.nist.gov/vuln/detail/CVE-2026-14662) - [CVE-2026-14663](https://nvd.nist.gov/vuln/detail/CVE-2026-14663) - [CVE-2026-14664](https://nvd.nist.gov/vuln/detail/CVE-2026-14664) - [CVE-2026-14666](https://nvd.nist.gov/vuln/detail/CVE-2026-14666) - [CVE-2026-14668](https://nvd.nist.gov/vuln/detail/CVE-2026-14668) - [CVE-2026-14669](https://nvd.nist.gov/vuln/detail/CVE-2026-14669) - [CVE-2026-14670](https://nvd.nist.gov/vuln/detail/CVE-2026-14670) - [CVE-2026-14671](https://nvd.nist.gov/vuln/detail/CVE-2026-14671) - [CVE-2026-14672](https://nvd.nist.gov/vuln/detail/CVE-2026-14672) - [CVE-2026-14673](https://nvd.nist.gov/vuln/detail/CVE-2026-14673) - [CVE-2026-14677](https://nvd.nist.gov/vuln/detail/CVE-2026-14677) - [CVE-2026-14678](https://nvd.nist.gov/vuln/detail/CVE-2026-14678) - [CVE-2026-14679](https://nvd.nist.gov/vuln/detail/CVE-2026-14679) - [CVE-2026-14680](https://nvd.nist.gov/vuln/detail/CVE-2026-14680) - [CVE-2026-14681](https://nvd.nist.gov/vuln/detail/CVE-2026-14681) - [CVE-2026-15741](https://nvd.nist.gov/vuln/detail/CVE-2026-15741) - [CVE-2026-15742](https://nvd.nist.gov/vuln/detail/CVE-2026-15742) - [CVE-2026-16239](https://nvd.nist.gov/vuln/detail/CVE-2026-16239) - [CVE-2026-16241](https://nvd.nist.gov/vuln/detail/CVE-2026-16241) - [CVE-2026-18024](https://nvd.nist.gov/vuln/detail/CVE-2026-18024) - [CVE-2026-18408](https://nvd.nist.gov/vuln/detail/CVE-2026-18408) - [CVE-2026-18798](https://nvd.nist.gov/vuln/detail/CVE-2026-18798) - [CVE-2026-19385](https://nvd.nist.gov/vuln/detail/CVE-2026-19385) - [CVE-2026-1965](https://nvd.nist.gov/vuln/detail/CVE-2026-1965) - [CVE-2026-34743](https://nvd.nist.gov/vuln/detail/CVE-2026-34743) - [CVE-2026-3783](https://nvd.nist.gov/vuln/detail/CVE-2026-3783) - [CVE-2026-3784](https://nvd.nist.gov/vuln/detail/CVE-2026-3784) - [CVE-2026-3805](https://nvd.nist.gov/vuln/detail/CVE-2026-3805) - [CVE-2026-4873](https://nvd.nist.gov/vuln/detail/CVE-2026-4873) - [CVE-2026-54874](https://nvd.nist.gov/vuln/detail/CVE-2026-54874) - [CVE-2026-5545](https://nvd.nist.gov/vuln/detail/CVE-2026-5545) - [CVE-2026-5773](https://nvd.nist.gov/vuln/detail/CVE-2026-5773) - [CVE-2026-6253](https://nvd.nist.gov/vuln/detail/CVE-2026-6253) - [CVE-2026-6276](https://nvd.nist.gov/vuln/detail/CVE-2026-6276) - [CVE-2026-63072](https://nvd.nist.gov/vuln/detail/CVE-2026-63072) - [CVE-2026-63073](https://nvd.nist.gov/vuln/detail/CVE-2026-63073) - [CVE-2026-63074](https://nvd.nist.gov/vuln/detail/CVE-2026-63074) - [CVE-2026-63075](https://nvd.nist.gov/vuln/detail/CVE-2026-63075) - [CVE-2026-63076](https://nvd.nist.gov/vuln/detail/CVE-2026-63076) - [CVE-2026-6429](https://nvd.nist.gov/vuln/detail/CVE-2026-6429) - [CVE-2026-6464](https://nvd.nist.gov/vuln/detail/CVE-2026-6464) - [CVE-2026-6469](https://nvd.nist.gov/vuln/detail/CVE-2026-6469) - [CVE-2026-6470](https://nvd.nist.gov/vuln/detail/CVE-2026-6470) - [CVE-2026-6471](https://nvd.nist.gov/vuln/detail/CVE-2026-6471) - [CVE-2026-6473](https://nvd.nist.gov/vuln/detail/CVE-2026-6473) - [CVE-2026-7168](https://nvd.nist.gov/vuln/detail/CVE-2026-7168) - [CVE-2026-75803](https://nvd.nist.gov/vuln/detail/CVE-2026-75803) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-54512](https://nvd.nist.gov/vuln/detail/CVE-2026-54512) - [CVE-2026-54513](https://nvd.nist.gov/vuln/detail/CVE-2026-54513) - [CVE-2026-54514](https://nvd.nist.gov/vuln/detail/CVE-2026-54514) - [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [CVE-2026-59888](https://nvd.nist.gov/vuln/detail/CVE-2026-59888) - [GHSA-72hv-8253-57qq](https://osv.dev/vulnerability/GHSA-72hv-8253-57qq) - [GHSA-r7wm-3cxj-wff9](https://osv.dev/vulnerability/GHSA-r7wm-3cxj-wff9) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) |
| **N/A** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerabilities: - [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) - [CVE-2026-55831](https://nvd.nist.gov/vuln/detail/CVE-2026-55831) - [CVE-2026-55833](https://nvd.nist.gov/vuln/detail/CVE-2026-55833) - [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745) - [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746) - [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819) - [CVE-2026-59889](https://nvd.nist.gov/vuln/detail/CVE-2026-59889) - [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898) - [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899) - [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900) - [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901) - [CVE-2026-59903](https://nvd.nist.gov/vuln/detail/CVE-2026-59903) - [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921) - [CVE-2026-73508](https://nvd.nist.gov/vuln/detail/CVE-2026-73508) - [GHSA-mhm7-754m-9p8w](https://osv.dev/vulnerability/GHSA-mhm7-754m-9p8w) |
| **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** This addresses the following vulnerabilities: - [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) - [CVE-2026-55831](https://nvd.nist.gov/vuln/detail/CVE-2026-55831) - [CVE-2026-55833](https://nvd.nist.gov/vuln/detail/CVE-2026-55833) - [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745) - [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746) - [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819) - [CVE-2026-59889](https://nvd.nist.gov/vuln/detail/CVE-2026-59889) - [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898) - [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899) - [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900) - [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901) - [CVE-2026-59903](https://nvd.nist.gov/vuln/detail/CVE-2026-59903) - [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921) - [CVE-2026-73508](https://nvd.nist.gov/vuln/detail/CVE-2026-73508) - [GHSA-mhm7-754m-9p8w](https://osv.dev/vulnerability/GHSA-mhm7-754m-9p8w) |
| **N/A** | **Security fixes for `apigee-open-telemetry-collector`.** This addresses the following vulnerabilities: - [CVE-2026-43871](https://nvd.nist.gov/vuln/detail/CVE-2026-43871) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-81871](https://nvd.nist.gov/vuln/detail/CVE-2026-81871) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) |
| **N/A** | **Security fixes for `apigee-operators`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) - [GHSA-w67g-5rqw-f597](https://osv.dev/vulnerability/GHSA-w67g-5rqw-f597) |
| **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) |
| **N/A** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) |
| **N/A** | **Security fixes for `apigee-redis`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) |
| **N/A** | **Security fixes for `apigee-runtime`.** This addresses the following vulnerabilities: - [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) - [CVE-2026-55831](https://nvd.nist.gov/vuln/detail/CVE-2026-55831) - [CVE-2026-55833](https://nvd.nist.gov/vuln/detail/CVE-2026-55833) - [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745) - [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746) - [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819) - [CVE-2026-59889](https://nvd.nist.gov/vuln/detail/CVE-2026-59889) - [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898) - [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899) - [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900) - [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901) - [CVE-2026-59903](https://nvd.nist.gov/vuln/detail/CVE-2026-59903) - [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921) - [CVE-2026-73508](https://nvd.nist.gov/vuln/detail/CVE-2026-73508) - [CVE-2026-75595](https://nvd.nist.gov/vuln/detail/CVE-2026-75595) - [CVE-2026-75596](https://nvd.nist.gov/vuln/detail/CVE-2026-75596) - [GHSA-mhm7-754m-9p8w](https://osv.dev/vulnerability/GHSA-mhm7-754m-9p8w) |
| **N/A** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) - [CVE-2026-55831](https://nvd.nist.gov/vuln/detail/CVE-2026-55831) - [CVE-2026-55833](https://nvd.nist.gov/vuln/detail/CVE-2026-55833) - [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745) - [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746) - [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819) - [CVE-2026-59889](https://nvd.nist.gov/vuln/detail/CVE-2026-59889) - [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898) - [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899) - [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900) - [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901) - [CVE-2026-59903](https://nvd.nist.gov/vuln/detail/CVE-2026-59903) - [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921) - [CVE-2026-73508](https://nvd.nist.gov/vuln/detail/CVE-2026-73508) - [GHSA-mhm7-754m-9p8w](https://osv.dev/vulnerability/GHSA-mhm7-754m-9p8w) |
| **N/A** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) |

v1.16.0 Change **Correction: API base path limit for Apigee hybrid organizations**

The [December 16, 2024](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#December_16_2024) release note for enhanced per-environment proxy limits stated that the maximum number of API base paths per Apigee organization is 3000. That number is incorrect. The maximum number of API base paths per organization is 6,000 for both Apigee and Apigee hybrid.

For optimal performance, Apigee recommends using no more than 3,000 API proxy basepaths per environment or environment group. This is a recommendation, not an enforced limit.

For more information, see [Limits](https://docs.cloud.google.com/apigee/docs/api-platform/reference/limits.md.txt#environment-and-organization) and [Enhanced per-environment proxy limits](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/enhanced-proxy-limits.md.txt).

## September 23, 2026

**Apigee API hub** Feature **Preview launch of AWS API Gateway and Azure API Management plugins**

API hub now includes two new built-in plugins for ingesting API metadata from third-party gateways: **AWS API Gateway** and **Azure API Management** . Both plugins are in [Public Preview](https://cloud.google.com/products#product-launch-stages), extending API hub's multi-cloud governance to give you a single pane of glass across your Google Cloud, AWS, and Azure APIs.

**What's new**

- **Automated discovery and onboarding**: Connect your AWS account or Azure API Management (APIM) service and API hub automatically discovers your existing deployed APIs and related metadata.
- **Scheduled pull sync**: A full metadata sync runs every 6 hours by default, with reconciliation (upserts and orphan deletes) to keep your catalog in sync with the source gateway.
- **Optional near-real-time push sync** : Deploy a customer-managed AWS Lambda function (for AWS API Gateway) or Azure Function (for Azure API Management) to relay control-plane change events to API hub in near real time. For sample deployment code, see the [apigee-samples](https://github.com/GoogleCloudPlatform/apigee-samples/tree/main/apihub-plugins) repository.

For more information, see [About plugins](https://docs.cloud.google.com/apigee/docs/apihub/plugins.md.txt), [Manage third-party plugins](https://docs.cloud.google.com/apigee/docs/apihub/manage-third-party-plugins.md.txt), and [Create a plugin instance](https://docs.cloud.google.com/apigee/docs/apihub/create-plugin-instances.md.txt).
Feature **Spec-to-deployment linkage and gateway revision tracking in API hub (GA)**

API hub now provides a first-class, bidirectional link between API specifications, operations, and the deployments that serve them, together with native tracking of the underlying gateway revision.

**What's new**

- **Direct visibility between specs and deployments**: See exactly which API specification and operations are served by a specific deployment, and navigate from a spec to the deployments that serve it.
- **Native gateway revision tracking** : Deployments now capture and display their underlying gateway revision (for example, an Apigee proxy revision) via the new `source_revision` field on the Deployment resource.
- **More accurate operation resolution**: When multiple revisions expose overlapping operations (same method and path), API hub associates each operation with its specific specification instead of dropping duplicates.
- **Multiple spec revisions per API**: API hub can store multiple revisions of the same spec for an API deployed across different environments.

## September 21, 2026

**Apigee X** Announcement On September 21st, 2026, we began maintenance updates of Apigee instances [configured for maintenance windows](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/maintenance-windows.md.txt).

If you set a preferred window for maintenance for your instance, and your instance version is
below **1-18-0-apigee-4** , your instance will be updated to **1-18-0-apigee-4** within the
next seven to 21 days. A notification containing the expected date of upgrade will be sent within the next two business days.

> [!NOTE]
> Note: Instances that meet either of the following two criteria will **not** be updated:
>
> - Your instance has a DNS misconfiguration, as described in [Known Issue 445936920](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt).
> - Your instance uses an Apigee Java Library that has been removed, as described in [Apigee release notes dated October 16, 2025](https://docs.cloud.google.com/apigee/docs/release/release-notes.md.txt#October_16_2025).

For more information on participating in scheduled maintenance windows, see [Maintenance overview](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/maintenance.md.txt) and [Manage Apigee instance maintenance windows](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/maintenance-windows.md.txt).
Announcement On September 21st, 2026, we released an updated version of Apigee (1-18-0-apigee-5).

> [!NOTE]
> **Note:** Rollouts of this release began today and can take four or more business days to be completed across all Google Cloud zones. Your instances might not have the features and fixes available until the rollout is complete.

Security

| Bug ID | Description |
|---|---|
| **560130499** | **Security fix for Apigee.** Fixed a security issue in the Java Callout policy. |
| **547681234** | **Security fix for Apigee.** Patched [CVE-2026-69247](https://nvd.nist.gov/vuln/detail/CVE-2026-69247) by upgrading a third-party library used by the Apigee model-security engine. |
| **556568593** | **Security fix for Apigee.** Patched [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) by upgrading gRPC. |
| **N/A** | **Security fix for Apigee infrastructure.** |

Fixed

| Bug ID | Description |
|---|---|
| **559009293** | Fixed elevated OAuth and VerifyAPIKey latency and Cassandra read load for AppGroup apps by caching the AppGroup entity in the Message Processor runtime, matching Developer-app behavior. |
| **558888960** | Fixed distributed tracing so that the target URL is included as a span attribute in all scenarios. |
| **556750755** | Fixed EventFlow (Server-Sent Events) dropping or truncating events that follow a large (greater than 16 KB) event under load on the http-adaptor data path. |
| **553931019** | The MCP tools/list method now aggregates tools across all approved API products. |
| **531783017** | Implemented the `<Enforce>true</Enforce>` element of SSLInfo for a Syslog endpoint, so that the syslog target's TLS server identity is verified. |
| **554114419** | Policies can now change request pseudo-headers (for example, :path and :authority) when HTTP/2 is in use. |
| **548763108** | Blocked outbound HTTP from the Message Processor to Kubernetes-internal targets. |
| **513032450** | Restored a 15-second TCP keep-alive on the Apigee Connect control-plane connection so that a silently dropped connection recovers in seconds rather than approximately two hours. |
| **N/A** | Updates to infrastructure and libraries. |

## September 17, 2026

**Apigee hybrid** v1.16.10 Announcement

### v1.16.10

On September 17, 2026 we released an updated version of the Apigee hybrid software, v1.16.10.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.16.10](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Fixed

#### Fixed in this release

| Bug ID | Description |
|---|---|
| **556750755** | **Fixed an issue where EventFlow (Server-Sent Events) dropped or truncated events following a large (\>16 KB) event under load on the `http-adaptor` datapath.** |
| **547712217** | **Fixed an issue where EventFlow (Server-Sent Events) responses larger than 16 KB could be truncated or corrupted across socket reads.** |
| **519729209** | **Fixed a SAML XML Signature Wrapping (XSW) vulnerability in the `ValidateSAMLAssertion` policy.** |
| **514384893** | **Hardened the `Script` policy to block server-side request forgery (SSRF) to link-local addresses.** |
| **505645076** | **Fixed a security issue in the `OAuthV2` policy to prevent unauthorized token injection via HTTP form parameters.** |
| **505543289** | **Fixed thread-safety issues in the Netty client connection pool and channel lifecycle.** |
| **503817773** | **Improved security in the `OAuthV2` policy implicit grant `redirect_uri` validation.** |
| **502268966** | **Apigee hybrid now supports optional decoding of percent-encoded path separators (`%2F` and `%5C`) before flow selection via the `request.path.decode.encoded.separators` proxy property.** |
| **480770263** | **Fixed an issue in the `SpikeArrest` policy to handle edge cases that previously caused `NullPointerException` and `500` errors.** |
| **472526232** | **Improved SAML assertion validation in the `ValidateSAMLAssertion` policy against entity and comment injection.** |
| **470375542** | **Fixed a memory leak in `WSFrameDecoder` that could result in a spike in `503` responses with `no_healthy_upstream` errors.** |
| **449228485** | **Apigee hybrid now supports configuring custom Kubernetes `PodDisruptionBudget` (`minAvailable` or `maxUnavailable`) values for Apigee hybrid components in your `overrides.yaml` file. These overrides take effect from Apigee hybrid v1.16.11, which adds the `podDisruptionBudget` field to the CRDs in the `apigee-operator` chart.** |
| **402250928** | **Apigee hybrid now supports routing outbound calls from AI policies, such as the Model Armor and semantic caching policies, through an HTTP forward proxy.** |

Feature **Kubernetes 1.36 support**

Apigee hybrid v1.16.10 adds support for Kubernetes 1.36 on Google Kubernetes Engine (GKE), Google Distributed Cloud Virtual for VMware (vSphere), Google Distributed Cloud Virtual for bare metal, Amazon EKS, Azure AKS, and Rancher Kubernetes Engine (RKE2).

For more information, see [Supported platforms](https://docs.cloud.google.com/apigee/docs/hybrid/supported-platforms.md.txt).
Feature **Forward proxy support for AI policies**

Apigee hybrid v1.16.10 adds forward proxy support for AI policies, such as the Model Armor and semantic caching policies. Outbound calls from these policies can now be routed through an HTTP forward proxy.

For more information, see [Configure a forward proxy](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/forward-proxy.md.txt), [Get started with the Model Armor policies](https://docs.cloud.google.com/apigee/docs/api-platform/tutorials/using-model-armor-policies.md.txt), and [Get started with semantic caching policies](https://docs.cloud.google.com/apigee/docs/api-platform/tutorials/using-semantic-caching-policies.md.txt).
Security

| Bug ID | Description |
|---|---|
| **N/A** | **Security fixes for `apigee-asm-ingress`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) |
| **N/A** | **Security fixes for `apigee-asm-istiod`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) |
| **N/A** | **Security fixes for `apigee-connect-agent`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) |
| **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2025-13151](https://nvd.nist.gov/vuln/detail/CVE-2025-13151) - [CVE-2025-14524](https://nvd.nist.gov/vuln/detail/CVE-2025-14524) - [CVE-2025-14819](https://nvd.nist.gov/vuln/detail/CVE-2025-14819) - [CVE-2026-14456](https://nvd.nist.gov/vuln/detail/CVE-2026-14456) - [CVE-2026-14457](https://nvd.nist.gov/vuln/detail/CVE-2026-14457) - [CVE-2026-14662](https://nvd.nist.gov/vuln/detail/CVE-2026-14662) - [CVE-2026-14663](https://nvd.nist.gov/vuln/detail/CVE-2026-14663) - [CVE-2026-14664](https://nvd.nist.gov/vuln/detail/CVE-2026-14664) - [CVE-2026-14666](https://nvd.nist.gov/vuln/detail/CVE-2026-14666) - [CVE-2026-14668](https://nvd.nist.gov/vuln/detail/CVE-2026-14668) - [CVE-2026-14669](https://nvd.nist.gov/vuln/detail/CVE-2026-14669) - [CVE-2026-14670](https://nvd.nist.gov/vuln/detail/CVE-2026-14670) - [CVE-2026-14671](https://nvd.nist.gov/vuln/detail/CVE-2026-14671) - [CVE-2026-14672](https://nvd.nist.gov/vuln/detail/CVE-2026-14672) - [CVE-2026-14673](https://nvd.nist.gov/vuln/detail/CVE-2026-14673) - [CVE-2026-14677](https://nvd.nist.gov/vuln/detail/CVE-2026-14677) - [CVE-2026-14678](https://nvd.nist.gov/vuln/detail/CVE-2026-14678) - [CVE-2026-14679](https://nvd.nist.gov/vuln/detail/CVE-2026-14679) - [CVE-2026-14680](https://nvd.nist.gov/vuln/detail/CVE-2026-14680) - [CVE-2026-14681](https://nvd.nist.gov/vuln/detail/CVE-2026-14681) - [CVE-2026-15741](https://nvd.nist.gov/vuln/detail/CVE-2026-15741) - [CVE-2026-15742](https://nvd.nist.gov/vuln/detail/CVE-2026-15742) - [CVE-2026-16239](https://nvd.nist.gov/vuln/detail/CVE-2026-16239) - [CVE-2026-16241](https://nvd.nist.gov/vuln/detail/CVE-2026-16241) - [CVE-2026-18024](https://nvd.nist.gov/vuln/detail/CVE-2026-18024) - [CVE-2026-18408](https://nvd.nist.gov/vuln/detail/CVE-2026-18408) - [CVE-2026-18798](https://nvd.nist.gov/vuln/detail/CVE-2026-18798) - [CVE-2026-19385](https://nvd.nist.gov/vuln/detail/CVE-2026-19385) - [CVE-2026-1965](https://nvd.nist.gov/vuln/detail/CVE-2026-1965) - [CVE-2026-34743](https://nvd.nist.gov/vuln/detail/CVE-2026-34743) - [CVE-2026-3783](https://nvd.nist.gov/vuln/detail/CVE-2026-3783) - [CVE-2026-3784](https://nvd.nist.gov/vuln/detail/CVE-2026-3784) - [CVE-2026-3805](https://nvd.nist.gov/vuln/detail/CVE-2026-3805) - [CVE-2026-4873](https://nvd.nist.gov/vuln/detail/CVE-2026-4873) - [CVE-2026-54874](https://nvd.nist.gov/vuln/detail/CVE-2026-54874) - [CVE-2026-5545](https://nvd.nist.gov/vuln/detail/CVE-2026-5545) - [CVE-2026-5773](https://nvd.nist.gov/vuln/detail/CVE-2026-5773) - [CVE-2026-6253](https://nvd.nist.gov/vuln/detail/CVE-2026-6253) - [CVE-2026-6276](https://nvd.nist.gov/vuln/detail/CVE-2026-6276) - [CVE-2026-63072](https://nvd.nist.gov/vuln/detail/CVE-2026-63072) - [CVE-2026-63073](https://nvd.nist.gov/vuln/detail/CVE-2026-63073) - [CVE-2026-63074](https://nvd.nist.gov/vuln/detail/CVE-2026-63074) - [CVE-2026-63075](https://nvd.nist.gov/vuln/detail/CVE-2026-63075) - [CVE-2026-63076](https://nvd.nist.gov/vuln/detail/CVE-2026-63076) - [CVE-2026-6429](https://nvd.nist.gov/vuln/detail/CVE-2026-6429) - [CVE-2026-6464](https://nvd.nist.gov/vuln/detail/CVE-2026-6464) - [CVE-2026-6469](https://nvd.nist.gov/vuln/detail/CVE-2026-6469) - [CVE-2026-6470](https://nvd.nist.gov/vuln/detail/CVE-2026-6470) - [CVE-2026-6471](https://nvd.nist.gov/vuln/detail/CVE-2026-6471) - [CVE-2026-6473](https://nvd.nist.gov/vuln/detail/CVE-2026-6473) - [CVE-2026-7168](https://nvd.nist.gov/vuln/detail/CVE-2026-7168) - [CVE-2026-75803](https://nvd.nist.gov/vuln/detail/CVE-2026-75803) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) |
| **N/A** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerabilities: - [CVE-2026-55831](https://nvd.nist.gov/vuln/detail/CVE-2026-55831) - [CVE-2026-55833](https://nvd.nist.gov/vuln/detail/CVE-2026-55833) - [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745) - [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746) - [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819) - [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898) - [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899) - [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900) - [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901) - [CVE-2026-59903](https://nvd.nist.gov/vuln/detail/CVE-2026-59903) - [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921) - [CVE-2026-73508](https://nvd.nist.gov/vuln/detail/CVE-2026-73508) - [CVE-2026-75595](https://nvd.nist.gov/vuln/detail/CVE-2026-75595) - [CVE-2026-75596](https://nvd.nist.gov/vuln/detail/CVE-2026-75596) |
| **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** This addresses the following vulnerabilities: - [CVE-2026-55831](https://nvd.nist.gov/vuln/detail/CVE-2026-55831) - [CVE-2026-55833](https://nvd.nist.gov/vuln/detail/CVE-2026-55833) - [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745) - [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746) - [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819) - [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898) - [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899) - [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900) - [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901) - [CVE-2026-59903](https://nvd.nist.gov/vuln/detail/CVE-2026-59903) - [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921) - [CVE-2026-73508](https://nvd.nist.gov/vuln/detail/CVE-2026-73508) - [CVE-2026-75595](https://nvd.nist.gov/vuln/detail/CVE-2026-75595) - [CVE-2026-75596](https://nvd.nist.gov/vuln/detail/CVE-2026-75596) |
| **N/A** | **Security fixes for `apigee-open-telemetry-collector`.** This addresses the following vulnerability: - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) |
| **N/A** | **Security fixes for `apigee-operators`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) - [GHSA-w67g-5rqw-f597](https://osv.dev/vulnerability/GHSA-w67g-5rqw-f597) |
| **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) |
| **N/A** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) |
| **N/A** | **Security fixes for `apigee-redis`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) |
| **N/A** | **Security fixes for `apigee-runtime`.** This addresses the following vulnerabilities: - [CVE-2026-55831](https://nvd.nist.gov/vuln/detail/CVE-2026-55831) - [CVE-2026-55833](https://nvd.nist.gov/vuln/detail/CVE-2026-55833) - [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745) - [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746) - [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819) - [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898) - [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899) - [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900) - [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901) - [CVE-2026-59903](https://nvd.nist.gov/vuln/detail/CVE-2026-59903) - [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921) - [CVE-2026-73508](https://nvd.nist.gov/vuln/detail/CVE-2026-73508) - [CVE-2026-75595](https://nvd.nist.gov/vuln/detail/CVE-2026-75595) - [CVE-2026-75596](https://nvd.nist.gov/vuln/detail/CVE-2026-75596) |
| **N/A** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2026-55831](https://nvd.nist.gov/vuln/detail/CVE-2026-55831) - [CVE-2026-55833](https://nvd.nist.gov/vuln/detail/CVE-2026-55833) - [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745) - [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746) - [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819) - [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898) - [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899) - [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900) - [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901) - [CVE-2026-59903](https://nvd.nist.gov/vuln/detail/CVE-2026-59903) - [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921) - [CVE-2026-73508](https://nvd.nist.gov/vuln/detail/CVE-2026-73508) - [CVE-2026-75595](https://nvd.nist.gov/vuln/detail/CVE-2026-75595) - [CVE-2026-75596](https://nvd.nist.gov/vuln/detail/CVE-2026-75596) |
| **N/A** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) |

## September 14, 2026

**Apigee hybrid** v1.17.0 Announcement

### hybrid v1.17.0

On September 14, 2026 we released an updated version of the Apigee hybrid software, 1.17.0.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.17](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a minor release: The container images used in minor releases are integrated with the Apigee hybrid Helm charts. Upgrading to a minor via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Feature **Model Context Protocol (MCP) support**

Apigee hybrid now supports [Model Context Protocol (MCP)](https://modelcontextprotocol.io), an open protocol that lets agentic AI applications use your APIs as tools through managed MCP endpoints. Apigee hybrid routes, authorizes, and secures these MCP tool calls the same way it manages your other APIs, so you don't need to run or maintain your own MCP servers.

MCP support is an optional feature that is not enabled by default. You must explicitly enable it in your Apigee hybrid configuration.

For more information, see [Model Context Protocol (MCP) overview](https://docs.cloud.google.com/apigee/docs/api-platform/apigee-mcp/apigee-mcp-overview.md.txt), [Enable MCP for Apigee hybrid](https://docs.cloud.google.com/apigee/docs/api-platform/apigee-mcp/enable-mcp.md.txt), and the [MCP quickstart](https://docs.cloud.google.com/apigee/docs/api-platform/apigee-mcp/apigee-mcp-quickstart.md.txt).
Feature **Root CA certificate rotation**

Apigee hybrid v1.17.0 lets you rotate the root certificate authority (CA) certificate that anchors trust for TLS communication between your runtime components. You can now replace the root CA before it expires, without downtime.

For more information, see [Rotate the root CA](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/rotate-root-ca.md.txt).
Feature **TLS 1.3 support**

Apigee hybrid v1.17.0 adds support for TLS 1.3, a newer version of the Transport Layer Security (TLS) protocol that offers faster connection handshakes and stronger security than earlier TLS versions.

For information about configuring TLS on the ingress gateway, see [Configuring TLS and mTLS on the Apigee ingress gateway](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/ingress-tls.md.txt).
Feature **Forward proxy support for AI policies**

Apigee hybrid v1.17.0 adds forward proxy support for AI policies, such as the Model Armor and semantic caching policies. Outbound calls from these policies can now be routed through an HTTP forward proxy.

For more information, see [Configure a forward proxy](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/forward-proxy.md.txt), [Get started with the Model Armor policies](https://docs.cloud.google.com/apigee/docs/api-platform/tutorials/using-model-armor-policies.md.txt), and [Get started with semantic caching policies](https://docs.cloud.google.com/apigee/docs/api-platform/tutorials/using-semantic-caching-policies.md.txt).
Feature **Semantic cache Private Service Connect (PSC) endpoint support**

Apigee hybrid v1.17.0 adds Private Service Connect (PSC) endpoint support for semantic caching. The semantic caching policies can now reach their backing services over a Private Service Connect endpoint, which keeps that traffic on your private network.

For more information, see [Configure semantic caching over Private Service Connect](https://docs.cloud.google.com/apigee/docs/api-platform/tutorials/using-semantic-caching-policies-psc.md.txt).
Feature **Semantic cache distance measure support**

Apigee hybrid v1.17.0 adds support for non-default Vertex AI Vector Search distance measures in the SemanticCacheLookup policy. A new optional `<DistanceMeasureType>` element accepts `DOT_PRODUCT_DISTANCE` (the default, and the existing behavior), `COSINE_DISTANCE`, `SQUARED_L2_DISTANCE`, and `L1_DISTANCE`. The policy compares `<Threshold>` in the direction the declared measure implies, so declaring a non-default measure requires re-tuning the threshold in the same edit.

For more information, see [SemanticCacheLookup policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/semantic-cache-lookup-policy.md.txt).
Feature **Reduced service account permissions**

Apigee hybrid v1.17.0 reduces the Google Cloud IAM permissions that Apigee service accounts require. Service accounts that use Cloud Storage now require only the `storage.objects.get` and `storage.objects.create` permissions rather than the broader Storage Admin (`roles/storage.admin`) role. The Cassandra components also no longer run with the `privileged: true` security context.

For more information about service accounts, see [Create service accounts](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/create-service-account.md.txt).
Security Various security and CVE fixes are included in this release.

## September 10, 2026

**Apigee X** Fixed Addendum to Apigee release notes dated [August 27, 2026](https://docs.cloud.google.com/apigee/docs/release-notes.md.txt#August_27_2026) (1-18-0-apigee-4).

| Bug ID | Description |
|---|---|
| **502540992** | Fixed an issue where the SemanticCacheLookup policy was incompatible with Vertex AI Vector Search Private Service Connect (PSC) endpoints. |

## September 09, 2026

**Apigee X** Feature **SemanticCacheLookup policy supports non-default Vector Search distance measures**

Available in Apigee `1-18-0-apigee-4` and later. A new optional
`<DistanceMeasureType>` element accepts `DOT_PRODUCT_DISTANCE` (the
default, and the existing behavior), `COSINE_DISTANCE`,
`SQUARED_L2_DISTANCE` and `L1_DISTANCE`. The policy now compares
`<Threshold>` in the direction the declared measure implies, so declaring a
non-default measure requires re-tuning the threshold in the same edit. The 0-to-1 restriction on
`<Threshold>` is also removed.

## September 02, 2026

**Apigee Edge for Private Cloud** Announcement Apigee Edge for Private Cloud release notes are now published on Google Cloud
documentation.

Release notes and patch announcements for Apigee Edge for Private Cloud are
published on the
[Apigee Edge for Private Cloud release notes](https://docs.cloud.google.com/apigee/docs/edge-private-cloud/release-notes.md.txt)
page from September 2026 onward. You can
[subscribe](https://docs.cloud.google.com/apigee/docs/edge-private-cloud/release-notes.md.txt#sub) to that page with
a feed reader to be notified when a new release or patch is published.

Release notes published before September 2026 remain available in the
[Apigee Edge release notes archive](https://docs.apigee.com/release/notes/apigee-release-notes).
**Apigee Edge for Public Cloud** Announcement Apigee Edge for Public Cloud release notes are now published on Google Cloud
documentation.

Release notes for Apigee Edge for Public Cloud, including its Edge UI, SSO,
Message Processor, and integrated portal components, are published on the
[Apigee Edge for Public Cloud release notes](https://docs.cloud.google.com/apigee/docs/edge-public-cloud/release-notes.md.txt)
page from September 2026 onward. You can
[subscribe](https://docs.cloud.google.com/apigee/docs/edge-public-cloud/release-notes.md.txt#sub) to that page with
a feed reader to be notified when a new release is published.

Release notes published before September 2026 remain available in the
[Apigee Edge release notes archive](https://docs.apigee.com/release/notes/apigee-release-notes).

## September 01, 2026

**Apigee UI** Announcement On September 1, 2026, we released an updated version of the Apigee UI.
Fixed

| Bug ID | Description |
|---|---|
| 547582067 | **Revisions can now be imported for API proxies and shared flows in a space** Importing a revision in the Apigee UI now works for an API proxy or shared flow that is associated with a [space](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/spaces/apigee-spaces-overview.md.txt). Previously, the Apigee UI did not include the space when it uploaded the revision bundle, so the import request was rejected and the new revision was not created. This affected both API proxies and shared flows. The earlier workaround of removing the API proxy or shared flow from its space, importing the revision, and then adding it back to the space is no longer needed. |

## August 27, 2026

**Apigee X** Announcement On August 27th, 2026, we released an updated version of Apigee (1-18-0-apigee-4).

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Fixed

| Bug ID | Description |
|---|---|
| **507878328** | Upgraded the Apigee runtime to run on JDK 17, while maintaining backward compatibility with JDK 11. |
| **530965355** | Added an opt-in Message Processor connection-failure back-off (CWC property HTTPClient.backoff.enabled, defaults to false) that prevents the Message Processor from consuming excessive CPU when a target is completely unavailable. |
| **532793298** | Fixed an API product bug where combining a payloadOperationGroup with a REST or llmOperationGroup rejected REST/LLM traffic with a 401. |
| **534420582** | The JSONThreatProtection policy adds a new optional child element \<RejectDuplicateKeys\> that rejects request bodies containing duplicate JSON keys within the same object. Defaults to false to preserve existing behavior. |
| **N/A** | Updates to infrastructure and libraries. |

This list is incomplete; see entries for
[September 9, 2026](https://docs.cloud.google.com/apigee/docs/release-notes.md.txt#September_09_2026) and [September 10, 2026](https://docs.cloud.google.com/apigee/docs/release-notes.md.txt#September_10_2026).
Security

| Bug ID | Description |
|---|---|
| **544570126** | **Security fix for Apigee.** Fixed a security issue in the PythonScript policy. |
| **N/A** | **Security fix for Apigee infrastructure.** |

## August 26, 2026

**Apigee hybrid** v1.14.8 Announcement

### v1.14.8

On August 26, 2026 we released an updated version of the Apigee hybrid software, v1.14.8.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.14.8](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Security

| Bug ID | Description |
|---|---|
| **N/A** | **Security fixes for `apigee-asm-ingress`.** This addresses the following vulnerabilities: - [CVE-2026-39822](https://nvd.nist.gov/vuln/detail/CVE-2026-39822) - [CVE-2026-42505](https://nvd.nist.gov/vuln/detail/CVE-2026-42505) |
| **N/A** | **Security fixes for `apigee-asm-istiod`.** This addresses the following vulnerabilities: - [CVE-2026-39822](https://nvd.nist.gov/vuln/detail/CVE-2026-39822) - [CVE-2026-42505](https://nvd.nist.gov/vuln/detail/CVE-2026-42505) |
| **N/A** | **Security fixes for `apigee-connect-agent`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) |
| **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2025-13151](https://nvd.nist.gov/vuln/detail/CVE-2025-13151) - [CVE-2025-14524](https://nvd.nist.gov/vuln/detail/CVE-2025-14524) - [CVE-2025-14819](https://nvd.nist.gov/vuln/detail/CVE-2025-14819) - [CVE-2026-14662](https://nvd.nist.gov/vuln/detail/CVE-2026-14662) - [CVE-2026-14663](https://nvd.nist.gov/vuln/detail/CVE-2026-14663) - [CVE-2026-14664](https://nvd.nist.gov/vuln/detail/CVE-2026-14664) - [CVE-2026-14666](https://nvd.nist.gov/vuln/detail/CVE-2026-14666) - [CVE-2026-14668](https://nvd.nist.gov/vuln/detail/CVE-2026-14668) - [CVE-2026-14669](https://nvd.nist.gov/vuln/detail/CVE-2026-14669) - [CVE-2026-14670](https://nvd.nist.gov/vuln/detail/CVE-2026-14670) - [CVE-2026-14671](https://nvd.nist.gov/vuln/detail/CVE-2026-14671) - [CVE-2026-14672](https://nvd.nist.gov/vuln/detail/CVE-2026-14672) - [CVE-2026-14673](https://nvd.nist.gov/vuln/detail/CVE-2026-14673) - [CVE-2026-14677](https://nvd.nist.gov/vuln/detail/CVE-2026-14677) - [CVE-2026-14678](https://nvd.nist.gov/vuln/detail/CVE-2026-14678) - [CVE-2026-14679](https://nvd.nist.gov/vuln/detail/CVE-2026-14679) - [CVE-2026-14680](https://nvd.nist.gov/vuln/detail/CVE-2026-14680) - [CVE-2026-14681](https://nvd.nist.gov/vuln/detail/CVE-2026-14681) - [CVE-2026-15741](https://nvd.nist.gov/vuln/detail/CVE-2026-15741) - [CVE-2026-15742](https://nvd.nist.gov/vuln/detail/CVE-2026-15742) - [CVE-2026-16239](https://nvd.nist.gov/vuln/detail/CVE-2026-16239) - [CVE-2026-16241](https://nvd.nist.gov/vuln/detail/CVE-2026-16241) - [CVE-2026-18024](https://nvd.nist.gov/vuln/detail/CVE-2026-18024) - [CVE-2026-18408](https://nvd.nist.gov/vuln/detail/CVE-2026-18408) - [CVE-2026-19385](https://nvd.nist.gov/vuln/detail/CVE-2026-19385) - [CVE-2026-1965](https://nvd.nist.gov/vuln/detail/CVE-2026-1965) - [CVE-2026-34743](https://nvd.nist.gov/vuln/detail/CVE-2026-34743) - [CVE-2026-3783](https://nvd.nist.gov/vuln/detail/CVE-2026-3783) - [CVE-2026-3784](https://nvd.nist.gov/vuln/detail/CVE-2026-3784) - [CVE-2026-3805](https://nvd.nist.gov/vuln/detail/CVE-2026-3805) - [CVE-2026-4873](https://nvd.nist.gov/vuln/detail/CVE-2026-4873) - [CVE-2026-5545](https://nvd.nist.gov/vuln/detail/CVE-2026-5545) - [CVE-2026-5773](https://nvd.nist.gov/vuln/detail/CVE-2026-5773) - [CVE-2026-6253](https://nvd.nist.gov/vuln/detail/CVE-2026-6253) - [CVE-2026-6276](https://nvd.nist.gov/vuln/detail/CVE-2026-6276) - [CVE-2026-6429](https://nvd.nist.gov/vuln/detail/CVE-2026-6429) - [CVE-2026-6464](https://nvd.nist.gov/vuln/detail/CVE-2026-6464) - [CVE-2026-6469](https://nvd.nist.gov/vuln/detail/CVE-2026-6469) - [CVE-2026-6470](https://nvd.nist.gov/vuln/detail/CVE-2026-6470) - [CVE-2026-6471](https://nvd.nist.gov/vuln/detail/CVE-2026-6471) - [CVE-2026-6473](https://nvd.nist.gov/vuln/detail/CVE-2026-6473) - [CVE-2026-7168](https://nvd.nist.gov/vuln/detail/CVE-2026-7168) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) |
| **N/A** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerabilities: - [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) - [CVE-2026-55831](https://nvd.nist.gov/vuln/detail/CVE-2026-55831) - [CVE-2026-55833](https://nvd.nist.gov/vuln/detail/CVE-2026-55833) - [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745) - [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746) - [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819) - [CVE-2026-59889](https://nvd.nist.gov/vuln/detail/CVE-2026-59889) - [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898) - [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899) - [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900) - [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901) - [CVE-2026-59903](https://nvd.nist.gov/vuln/detail/CVE-2026-59903) - [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921) - [CVE-2026-73508](https://nvd.nist.gov/vuln/detail/CVE-2026-73508) - [GHSA-mhm7-754m-9p8w](https://osv.dev/vulnerability/GHSA-mhm7-754m-9p8w) |
| **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** This addresses the following vulnerabilities: - [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) - [CVE-2026-55831](https://nvd.nist.gov/vuln/detail/CVE-2026-55831) - [CVE-2026-55833](https://nvd.nist.gov/vuln/detail/CVE-2026-55833) - [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745) - [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746) - [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819) - [CVE-2026-59889](https://nvd.nist.gov/vuln/detail/CVE-2026-59889) - [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898) - [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899) - [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900) - [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901) - [CVE-2026-59903](https://nvd.nist.gov/vuln/detail/CVE-2026-59903) - [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921) - [CVE-2026-73508](https://nvd.nist.gov/vuln/detail/CVE-2026-73508) - [GHSA-mhm7-754m-9p8w](https://osv.dev/vulnerability/GHSA-mhm7-754m-9p8w) |
| **N/A** | **Security fixes for `apigee-operators`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) |
| **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerability: - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) |
| **N/A** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) |
| **N/A** | **Security fixes for `apigee-redis`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) |
| **N/A** | **Security fixes for `apigee-runtime`.** This addresses the following vulnerabilities: - [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) - [CVE-2026-55831](https://nvd.nist.gov/vuln/detail/CVE-2026-55831) - [CVE-2026-55833](https://nvd.nist.gov/vuln/detail/CVE-2026-55833) - [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745) - [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746) - [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819) - [CVE-2026-59889](https://nvd.nist.gov/vuln/detail/CVE-2026-59889) - [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898) - [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899) - [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900) - [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901) - [CVE-2026-59903](https://nvd.nist.gov/vuln/detail/CVE-2026-59903) - [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921) - [CVE-2026-73508](https://nvd.nist.gov/vuln/detail/CVE-2026-73508) - [GHSA-mhm7-754m-9p8w](https://osv.dev/vulnerability/GHSA-mhm7-754m-9p8w) |
| **N/A** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) - [CVE-2026-55831](https://nvd.nist.gov/vuln/detail/CVE-2026-55831) - [CVE-2026-55833](https://nvd.nist.gov/vuln/detail/CVE-2026-55833) - [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745) - [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746) - [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819) - [CVE-2026-59889](https://nvd.nist.gov/vuln/detail/CVE-2026-59889) - [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898) - [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899) - [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900) - [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901) - [CVE-2026-59903](https://nvd.nist.gov/vuln/detail/CVE-2026-59903) - [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921) - [CVE-2026-73508](https://nvd.nist.gov/vuln/detail/CVE-2026-73508) - [GHSA-mhm7-754m-9p8w](https://osv.dev/vulnerability/GHSA-mhm7-754m-9p8w) |
| **N/A** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) |

## August 22, 2026

**Apigee UI** Fixed

| Bug ID | Description |
|---|---|
| 543626585 | **ServiceCallout policy can now be added in the Apigee UI** Adding a ServiceCallout policy in the Apigee UI no longer leaves the **Create** or **Add** button disabled. Previously, selecting **Service Callout** in the **Create policy** or **Add policy** panel could display only the **Name** and **Display name** fields and omit the required HTTP target field. With the required field missing, the form never became valid, so the **Create** or **Add** button stayed disabled no matter what you entered. This affected both API proxies and shared flows. The earlier workaround of creating a placeholder policy and replacing its XML in the code editor is no longer needed. For more information, see [ServiceCallout policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/service-callout-policy.md.txt) and [Attach and configure policies in the UI](https://docs.cloud.google.com/apigee/docs/api-platform/develop/attaching-and-configuring-policies-management-ui.md.txt). |

Fixed

| Bug ID | Description |
|---|---|
| 540008387 | **Developer custom attributes now save reliably in the Apigee UI** Saving changes to a developer in the [Apigee UI in Cloud console](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/ui-overview.md.txt) no longer intermittently fails to persist that developer's custom attributes. Previously, the UI reported the save as successful, but the previous attribute values reappeared when the page was reloaded. Developer updates made with the Apigee API were not affected. |

## August 13, 2026

**Apigee X** Announcement On August 13th, 2026, we began maintenance updates of Apigee instances [configured for maintenance windows](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/maintenance-windows.md.txt).

If you set a preferred window for maintenance for your instance, and your instance version is
below **1-18-0-apigee-2** , your instance will be updated to **1-18-0-apigee-2** within the
next seven to 21 days. A notification containing the expected date of upgrade will be sent within the next two business days.

> [!NOTE]
> Note: Instances that meet either of the following two criteria will **not** be updated:
>
> - Your instance has a DNS misconfiguration, as described in [Known Issue 445936920](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt).
> - Your instance uses an Apigee Java Library that has been removed, as described in [Apigee release notes dated October 16, 2025](https://docs.cloud.google.com/apigee/docs/release/release-notes.md.txt#October_16_2025).

For more information on participating in scheduled maintenance windows, see [Maintenance overview](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/maintenance.md.txt) and [Manage Apigee instance maintenance windows](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/maintenance-windows.md.txt).
Announcement On August 13th, 2026, we released an updated version of Apigee (1-18-0-apigee-3).

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Fixed

| Bug ID | Description |
|---|---|
| **532147587** | To fix forward proxy support. |
| **537657987** | Fixed a bug where watcher failed to reconcile all routes if an environment was not found in the control plane. |
| **543022076** | Google Cloud BOM upgrade (protobuf 4.x, gRPC 1.81, Guava 33.5). One user-visible change: a malformed inbound gRPC request frame is now reported to the client as grpc-status INTERNAL(13) and recorded in analytics as x-apigee.grpc.status=13, where it was previously an Apigee ServiceUnavailable fault seen as UNAVAILABLE(14) with no x-apigee.grpc.status recorded. Otherwise no user facing impact, but any prod issue related to gcp, protobuf or gRPC may relate to this. |
| **542242046** | Fixed LLMTokenQuota metering the request against an arbitrary quota bucket when the API Product declared multiple models and the request carried no model. |
| **531731614** | Apigee analytics fields ai_llm_response_token_count, ai_llm_prompt_token_count, ai_llm_model_name, and ai_llm_model_provider are available in the Custom Report when LLMTokenQuota and PromptTokenLimit policies are used in Apigee proxies. |
| **492044413** | LLMTokenQuota resolves the model from the API Product LLM Operation when LLMModelSource is omitted and the request body has no model field. |
| **67169710** | Adds an opt-in \<DynamicClientIdSupported\> boolean XML element to the OAuthV2 policy. When true, AbstractOAuthStepExecution.extractClientDetails() preserves any non-empty ClientID/ClientSecret already present on the OAuthClientContext. |
| **531731614** | Apigee auto identifies the providers and publishes them to analytics. |
| **537396574** | Added feature to rotate the apigee-ca certificate. |
| **540861752** | Aligned the ApigeeDeployment conversion hub with its v1alpha3 storage version. Internal change; no effect on existing ApigeeDeployment resources. |
| **540861752** | Aligned the ApigeeDeployment custom resource's conversion hub with its v1alpha3 storage version. This internal change does not affect existing ApigeeDeployment resources. |
| **N/A** | Updates to infrastructure and libraries. |

Security

| Bug ID | Description |
|---|---|
| **535928300** | **Security fix for Apigee.** Fixed a security issue in JWT refresh token revocation handling. |
| **539515020** | **Security fix for Apigee.** Fixed a security issue in the MessageValidation policy. |
| **535928530** | **Security fix for Apigee.** Fixed a security issue in the OAuthV2 policy. |
| **535683286** | **Security fix for Apigee.** Fixed a security issue in HTTP target interim-response handling. |
| **N/A** | **Security fix for Apigee infrastructure.** |

## August 12, 2026

**Apigee API hub** Feature **Configure and deploy MCP servers with gcloud CLI**

You can use the `gcloud apihub locations configure-and-deploy-server` command to configure and deploy API hub Model Context Protocol (MCP) servers to an attached Apigee runtime.
Define MCP tools inline or by referencing a YAML or JSON specification file to expose your API hub operations for agent integrations.

For more information, see [gcloud CLI for API hub](https://docs.cloud.google.com/apigee/docs/apihub/gcloud-cli-apihub.md.txt).

## August 11, 2026

**Apigee hybrid** v1.16.9 Announcement

### v1.16.9

On August 11, 2026 we released an updated version of the Apigee hybrid software, v1.16.9.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.16.9](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Fixed

#### Fixed in this release

| Bug ID | Description |
|---|---|
| **514973778** | **Fixed an issue where the `SanitizeUserPrompt` and `SanitizeModelResponse` policies failed to tolerate unknown fields while parsing responses from the Model Armor Service.** |
| **543171828** | **Fixed an issue where the `apigee-logger` DaemonSet failed to schedule on cluster nodes without custom node labels due to a default `logger.nodeSelector` in the Helm chart.** |

Security Various security and CVE fixes are included in this release.

## July 31, 2026

**Apigee hybrid** v1.15.7 Announcement

### v1.15.7

On July 31, 2026 we released an updated version of the Apigee hybrid software, v1.15.7.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.15.7](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Feature **Runtime rollout strategy configuration**

In this release, you can configure the rollout strategy used when updating runtime (message processor) ReplicaSets by setting the [`runtime.release.strategy`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/config-prop-ref.md.txt#runtime-release-strategy) property (with options `rolling`, `scale-down-first`, or `none`) or per-environment with `envs[].components.runtime.release.strategy` in your overrides configuration file. The property defaults to `rolling`.
Security Various security and CVE fixes are included in this release.

## July 27, 2026

**Apigee X** Announcement On July 27th, 2026, we released an updated version of Apigee (1-18-0-apigee-2).

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Feature **SanitizeUserPrompt and SanitizeModelResponse policies now support function calling**

The SanitizeUserPrompt and SanitizeModelResponse policies now handle LLM function calling
(tool use) flows. Two new optional XML elements extract function calling content for
Model Armor sanitization:

- `<FunctionResponseSource>` in SanitizeUserPrompt: extracts function/tool response data from user turns. Used as a fallback when `<UserPromptSource>` returns empty on function calling turns.
- `<FunctionCallSource>` in SanitizeModelResponse: extracts function call arguments from model responses. Used as a fallback when `<LLMResponseSource>` returns empty.

Default templates target the Gemini format and require no additional configuration.
For OpenAI and Anthropic formats, configure custom JSONPath templates.
For more information, see
[FunctionResponseSource](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/sanitize-user-prompt-policy.md.txt#functionresponsesource) and
[FunctionCallSource](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/sanitize-llm-response-policy.md.txt#functioncallsource).
Security

| Bug ID | Description |
|---|---|
| **534852923** | **Security fix for Apigee.** Fixed a security issue in the Java Callout policy. |
| **N/A** | **Security fix for Apigee infrastructure.** |

Fixed

| Bug ID | Description |
|---|---|
| **N/A** | Updates to infrastructure and libraries. |

## July 24, 2026

**Apigee API hub** Feature **General availability (GA) launch of Model Context Protocol (MCP) in API hub**

The API hub MCP server is [Generally Available (GA)](https://cloud.google.com/products#product-launch-stages). This release enables seamless integration between your AI agents and API hub, allowing your applications to discover, query, and manage your API ecosystem using natural language.

**What's new in GA**

- **Expanded read and write capabilities**: AI agents can create, update, and delete APIs, versions, specs, and deployments. They can also configure and deploy MCP discovery proxies in Apigee.
- **Global endpoint routing** : Connect to the API hub MCP server using the global endpoint (`apihub.googleapis.com/mcp`), in addition to the supported regional endpoints. For a list of supported regions, see the [API hub MCP reference](https://docs.cloud.google.com/apigee/docs/reference/apis/apihub/mcp.md.txt#server-endpoints).
- **Granular OAuth scopes** : Use service-specific OAuth scopes (`apihub.readonly` and `apihub.readwrite`) for more secure access.
- **Model Armor integration**: Protect MCP tool invocations from prompt-injection and other attacks by integrating with Model Armor.

For configuration details and a complete list of available tools, see [API hub MCP reference](https://docs.cloud.google.com/apigee/docs/reference/apis/apihub/mcp.md.txt).
Feature **Configure and deploy MCP servers with API hub RPC**

API hub now includes a new RPC, `ConfigureAndDeployServer`, which enables the configuration and deployment of Model Context Protocol (MCP) servers directly to an Apigee runtime.

For more information, see [Manage MCP proxies](https://docs.cloud.google.com/apigee/docs/apihub/manage-mcp-proxies.md.txt) and the [API hub reference](https://docs.cloud.google.com/apigee/docs/reference/apis/apihub.md.txt).
**Apigee hybrid** v1.16.8 Announcement

### v1.16.8

On July 24, 2026 we released an updated version of the Apigee hybrid software, v1.16.8.

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.16](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Fixed

#### Fixed in this release

| Bug ID | Description |
|---|---|
| **493354568** | **Fixed an issue where component-specific nodeSelector configurations are ignored in Helm charts.** |

Feature **Runtime rollout strategy configuration**

In this release, you can configure the rollout strategy used when updating runtime (message processor) ReplicaSets by setting the [`runtime.release.strategy`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/config-prop-ref.md.txt#runtime-release-strategy) property (with options `rolling`, `scale-down-first`, or `none`) or per-environment with `envs[].components.runtime.release.strategy` in your overrides configuration file. The property defaults to `rolling`.
Security Various security and CVE fixes are included in this release.

## July 23, 2026

**Apigee hybrid** v1.14.7 Announcement

### v1.14.7

On July 23, 2026 we released an updated version of the Apigee hybrid software, v1.14.7.

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.14](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Feature **Runtime rollout strategy configuration**

In this release, you can configure the rollout strategy used when updating runtime (message processor) ReplicaSets by setting the [`runtime.release.strategy`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/config-prop-ref.md.txt#runtime-release-strategy) property (with options `rolling`, `scale-down-first`, or `none`) or per-environment with `envs[].components.runtime.release.strategy` in your overrides configuration file. The property defaults to `rolling`.
Security Various security and CVE fixes are included in this release.

## July 16, 2026

**Apigee UI** Announcement On July 16, 2026, we released an updated version of the Apigee UI.
Fixed **Updated PDU and basepath limits display in the Apigee UI**

Removed the ambiguous org-wide PDU limit visualization from the Apigee proxy usage card. Added display of **Deployments per instance** and **Per-org basepaths** limits to the **Instance details** page in the Apigee UI.
**Apigee X** Announcement On July 16th, 2026, we began maintenance updates of Apigee instances [configured for maintenance windows](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/maintenance-windows.md.txt).

If you set a preferred window for maintenance for your instance, and your instance version is
below **1-17-0-apigee-10** , your instance will be updated to **1-17-0-apigee-10** within the
next seven to 21 days. A notification containing the expected date of upgrade will be sent within the next two business days.

> [!NOTE]
> Note: Instances that meet either of the following two criteria will **not** be updated:
>
> - Your instance has a DNS misconfiguration, as described in [Known Issue 445936920](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt).
> - Your instance uses an Apigee Java Library that has been removed, as described in [Apigee release notes dated October 16, 2025](https://docs.cloud.google.com/apigee/docs/release/release-notes.md.txt#October_16_2025).

For more information on participating in scheduled maintenance windows, see [Maintenance overview](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/maintenance.md.txt) and [Manage Apigee instance maintenance windows](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/maintenance-windows.md.txt).

## July 15, 2026

**Apigee UI** Fixed **Apigee UI**

Fixed an issue where editing a legacy API Product with a selected API Proxy
could cause the Apigee UI to become unresponsive.
**Apigee X** Announcement On July 15th, 2026, we released an updated version of Apigee (1-18-0-apigee-1).

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Fixed

| Bug ID | Description |
|---|---|
| **527586459** | Fixed a cache policy throttling bug (CacheThrottlerV2 key poisoning) to enhance reliability. |
| **525697701** | Fixed an issue where API proxy deployments could get stuck during basepath migrations in Apigee X. |
| **N/A** | Updates to infrastructure and libraries. |

Security

| Bug ID | Description |
|---|---|
| **527415966, 524656652** | **Security fix for Apigee.** Upgraded the Apigee ingress gateway (ASM) to patch security vulnerabilities. |
| **527956223** | **Security fix for Apigee.** Enhanced security in the Java Callout policy to prevent sandbox escape. |
| **519729209** | **Security fix for Apigee.** Fixed a SAML XML Signature Wrapping (XSW) vulnerability in the ValidateSAMLAssertion policy. |
| **530886487** | **Security fix for Apigee.** Upgraded the apigee-connect-agent to patch [CVE-2026-25680](https://nvd.nist.gov/vuln/detail/CVE-2026-25680). |
| **N/A** | **Security fix for Apigee infrastructure.** |

**Apigee hybrid** v1.15.6 Announcement

### v1.15.6

On July 15, 2026 we released an updated version of the Apigee hybrid software, v1.15.6.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.15.6](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Security Various security and CVE fixes are included in this release.

## July 10, 2026

**Apigee Advanced API Security** Deprecated **Deprecation and shutdown of GenAI Incident Summary (generative AI Insights)**

The standalone **GenAI Incident Summary** (generative AI Insights) feature in
Apigee Advanced API Security Abuse Detection, currently in Preview, is
deprecated and shut down as of July 9, 2026. This feature used Google Cloud
generative AI large language models (LLMs) to provide automated summaries and
mitigation guidance for security incidents identified by the Abuse Detection
clustering tool.

For more information, see [GenAI Incident Summary deprecation](https://docs.cloud.google.com/apigee/docs/deprecations/genai-incident-summary.md.txt).
**Apigee hybrid** v1.16.7 Announcement

### v1.16.7

On July 10, 2026 we released an updated version of the Apigee hybrid software, v1.16.7.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.16.7](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Security Various security and CVE fixes are included in this release.

## July 08, 2026

**Apigee X** Security An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to 2026-06-12 on Google Cloud Platform allowed an authenticated attacker to exfiltrate cross-tenant data.

This vulnerability was patched on 12 June 2026 on the Apigee Servers, and no customer action is needed. Apigee hybrid was not affected.

For more information, see [CVE-2026-12879](http://cve.org/CVERecord?id=CVE-2026-12879).

## July 06, 2026

**Apigee UI** Announcement On July 6, 2026, we released an updated version of the Apigee UI.
Feature **ParsePayload policy and payload operations matching in the Apigee UI**

The Apigee UI now supports the new payload operations matching feature:

- The new **ParsePayload** policy is now available in the proxy editor for API proxy authoring. You can use it to extract logical operations from structured payloads at runtime.
- The API Product page now displays payload-based operations, allowing you to configure and manage access control and quotas based on request payload content.

For more information, see [Manage MCP tool access with API
products](https://docs.cloud.google.com/apigee/docs/api-platform/apigee-mcp/manage-mcp-tool-access).
**Apigee X** Feature **Support for payload operations matching in API Products**

Apigee now supports payload operations matching (`payloadOperationGroup`) in API
Products, powered by the new **ParsePayload** policy.

Payload operations matching allows you to define API Product operations that
match fields within request payloads, such as JSON-RPC requests used by the
Model Context Protocol (MCP). Apigee can then route, monetize, authorize, and
apply distinct quota limits to traffic based on the derived payload operation.

This feature is available to all Apigee X customers in all supported regions
with no additional charge. For more information, see [Manage MCP tool access
with API products](https://docs.cloud.google.com/apigee/docs/api-platform/apigee-mcp/manage-mcp-tool-access)
and the [ParsePayload policy
reference](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/parse-payload-policy).

## July 03, 2026

**Apigee hybrid** v1.15.5 Announcement

### v1.15.5

On July 3, 2026 we released an updated version of the Apigee hybrid software, v1.15.5.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.15.5](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Security Various security and CVE fixes are included in this release.

## June 24, 2026

**Apigee X** Announcement **Apigee Emulator**

### Apigee Emulator v2.0.1

On June 24, 2026, we released Apigee Emulator version 2.0.1.

This is a security-only hotfix release on top of v2.0.0 that addresses
10 security vulnerabilities in the Netty networking library and the embedded
Cassandra Go standard library health-check binary. There are no functional,
API, or configuration changes -- v2.0.1 is a drop-in replacement for v2.0.0.

The emulator image is available at
[Google Artifact Registry](https://console.cloud.google.com/artifacts/docker/apigee-release/us/gcr.io/hybrid%2Fapigee-emulator).

To upgrade, update the emulator version in your VS Code Cloud Code settings
to `2.0.1`. See
[Manage the Apigee Emulator](https://docs.cloud.google.com/apigee/docs/api-platform/local-development/vscode/manage-apigee-emulator.md.txt#choose_the_emulator_version)
for details.
Feature **Apigee Emulator**

#### Changed in this release

- Upgraded Netty to `4.1.135.Final` (from `4.1.133.Final`) and pinned all transitive `netty-*` artifacts via `netty-bom`.
- Refreshed the Cassandra base image to pick up Go standard library `1.25.11` (from `1.25.10`) in the embedded health-check binary.
- Updated `netty-tcnative-boringssl-static` classifier variants from `2.0.53.Final` to `2.0.77.Final`.
Security **Apigee Emulator**

#### Security

This release addresses 10 security vulnerabilities in the Netty networking
library and the embedded Go standard library. All Netty fixes come from
upgrading to `4.1.135.Final`; all Go standard library fixes come from a
Cassandra base image rebuild against Go `1.25.11`.

| CVE | Component |
|---|---|
| [CVE-2026-50010](https://nvd.nist.gov/vuln/detail/CVE-2026-50010) | Netty (`netty-handler`) |
| [CVE-2026-50020](https://nvd.nist.gov/vuln/detail/CVE-2026-50020) | Netty (`netty-codec-http`) |
| [CVE-2026-50560](https://nvd.nist.gov/vuln/detail/CVE-2026-50560) | Netty (`netty-codec-http2`) |
| [CVE-2026-48043](https://nvd.nist.gov/vuln/detail/CVE-2026-48043) | Netty (`netty-codec-http2`) |
| [CVE-2026-44249](https://nvd.nist.gov/vuln/detail/CVE-2026-44249) | Netty (`netty-handler`) |
| [CVE-2026-45416](https://nvd.nist.gov/vuln/detail/CVE-2026-45416) | Netty (`netty-handler`) |
| [CVE-2026-47244](https://nvd.nist.gov/vuln/detail/CVE-2026-47244) | Netty (`netty-codec-http2`) |
| [CVE-2026-27145](https://nvd.nist.gov/vuln/detail/CVE-2026-27145) | Go standard library |
| [CVE-2026-42504](https://nvd.nist.gov/vuln/detail/CVE-2026-42504) | Go standard library |
| [CVE-2026-42507](https://nvd.nist.gov/vuln/detail/CVE-2026-42507) | Go standard library |

## June 22, 2026

**Apigee X** Announcement On June 22nd, 2026, we released an updated version of Apigee (1-17-0-apigee-10).

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Security

| Bug ID | Description |
|---|---|
| **519996459** | **Security fix for Apigee.** Upgraded the Apigee ingress gateway to patch the following vulnerabilities: <br /> - [CVE-2026-27143](https://nvd.nist.gov/vuln/detail/CVE-2026-27143) - [CVE-2019-14993](https://nvd.nist.gov/vuln/detail/CVE-2019-14993) - [CVE-2021-39155](https://nvd.nist.gov/vuln/detail/CVE-2021-39155) - [CVE-2021-39156](https://nvd.nist.gov/vuln/detail/CVE-2021-39156) - [CVE-2022-23635](https://nvd.nist.gov/vuln/detail/CVE-2022-23635) - [CVE-2026-27140](https://nvd.nist.gov/vuln/detail/CVE-2026-27140) - [CVE-2026-27144](https://nvd.nist.gov/vuln/detail/CVE-2026-27144) - [CVE-2026-29181](https://nvd.nist.gov/vuln/detail/CVE-2026-29181) - [CVE-2026-32280](https://nvd.nist.gov/vuln/detail/CVE-2026-32280) - [CVE-2026-32281](https://nvd.nist.gov/vuln/detail/CVE-2026-32281) - [CVE-2026-32283](https://nvd.nist.gov/vuln/detail/CVE-2026-32283) - [CVE-2026-33811](https://nvd.nist.gov/vuln/detail/CVE-2026-33811) - [CVE-2026-33814](https://nvd.nist.gov/vuln/detail/CVE-2026-33814) - [CVE-2026-34986](https://nvd.nist.gov/vuln/detail/CVE-2026-34986) - [CVE-2026-35469](https://nvd.nist.gov/vuln/detail/CVE-2026-35469) - [CVE-2026-39820](https://nvd.nist.gov/vuln/detail/CVE-2026-39820) - [CVE-2026-39836](https://nvd.nist.gov/vuln/detail/CVE-2026-39836) - [CVE-2026-39883](https://nvd.nist.gov/vuln/detail/CVE-2026-39883) - [CVE-2026-4046](https://nvd.nist.gov/vuln/detail/CVE-2026-4046) - [CVE-2026-42499](https://nvd.nist.gov/vuln/detail/CVE-2026-42499) - [CVE-2026-42501](https://nvd.nist.gov/vuln/detail/CVE-2026-42501) - [CVE-2026-42504](https://nvd.nist.gov/vuln/detail/CVE-2026-42504) - [CVE-2022-31045](https://nvd.nist.gov/vuln/detail/CVE-2022-31045) - [CVE-2026-27145](https://nvd.nist.gov/vuln/detail/CVE-2026-27145) - [CVE-2026-32282](https://nvd.nist.gov/vuln/detail/CVE-2026-32282) - [CVE-2026-32288](https://nvd.nist.gov/vuln/detail/CVE-2026-32288) - [CVE-2026-32289](https://nvd.nist.gov/vuln/detail/CVE-2026-32289) - [CVE-2026-39350](https://nvd.nist.gov/vuln/detail/CVE-2026-39350) - [CVE-2026-39817](https://nvd.nist.gov/vuln/detail/CVE-2026-39817) - [CVE-2026-39819](https://nvd.nist.gov/vuln/detail/CVE-2026-39819) - [CVE-2026-39823](https://nvd.nist.gov/vuln/detail/CVE-2026-39823) - [CVE-2026-39825](https://nvd.nist.gov/vuln/detail/CVE-2026-39825) - [CVE-2026-39826](https://nvd.nist.gov/vuln/detail/CVE-2026-39826) - [CVE-2026-41413](https://nvd.nist.gov/vuln/detail/CVE-2026-41413) - [CVE-2026-42507](https://nvd.nist.gov/vuln/detail/CVE-2026-42507) - [CVE-2026-4437](https://nvd.nist.gov/vuln/detail/CVE-2026-4437) - [CVE-2026-4438](https://nvd.nist.gov/vuln/detail/CVE-2026-4438) <br /> |
| **N/A** | **Security fix for Apigee infrastructure.** |

Fixed

| Bug ID | Description |
|---|---|
| **515788622** | Upgraded the default outbound TLS protocol from TLSv1.2 to TLSv1.3 on JVMs that support it. Per-proxy `<SSLInfo><Protocols>` settings continue to take precedence, and the new `HTTPClient.outbound.tls.protocol` override lets operators force a specific protocol. |
| **184266748** | Fixed an issue where ApigeeDatastore TLS certificate creation could fail in namespaces with longer names when the certificate common name exceeded the 64-byte limit. |
| **286069772** | Added a per-gateway `proxyProtocol.mode` property (strict, permissive, disable) on Apigee ingress gateway components to opt in to HAProxy PROXY-protocol parsing. The property defaults to disable. |
| **N/A** | Updates to infrastructure and libraries. |

## June 19, 2026

**Apigee hybrid** v1.16.6 Announcement

### v1.16.6

On June 19, 2026 we released an updated version of the Apigee hybrid software, v1.16.6.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.16.6](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Feature **HAProxy PROXY-protocol support on Apigee ingress gateway**

In this release, you can opt into HAProxy PROXY-protocol parsing by setting the [`ingressGateways[].proxyProtocol.mode`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/config-prop-ref.md.txt#ingressgateways-proxyprotocol-mode) property (with options `strict`, `permissive`, or `disable`) in your overrides configuration file. The property defaults to `disable`.
Security Various security and CVE fixes are included in this release.

## June 18, 2026

**Apigee X** Announcement On June 18th, 2026, we began maintenance updates of Apigee instances [configured for maintenance windows](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/maintenance-windows.md.txt).

If you set a preferred window for maintenance for your instance, and your instance version is
below **1-17-0-apigee-9** , your instance will be updated to **1-17-0-apigee-9** within the
next seven to 21 days. A notification containing the expected date of upgrade will be sent within the next two business days.

> [!NOTE]
> Note: Instances that meet either of the following two criteria will **not** be updated:
>
> - Your instance has a DNS misconfiguration, as described in [Known Issue 445936920](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt).
> - Your instance uses an Apigee Java Library that has been removed, as described in [Apigee release notes dated October 16, 2025](https://docs.cloud.google.com/apigee/docs/release/release-notes.md.txt#October_16_2025).

For more information on participating in scheduled maintenance windows, see [Maintenance overview](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/maintenance.md.txt) and [Manage Apigee instance maintenance windows](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/maintenance-windows.md.txt).

## June 16, 2026

**Apigee hybrid** v1.14.6 Announcement

### v1.14.6

On June 16, 2026 we released an updated version of the Apigee hybrid software, v1.14.6.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.14.6](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Security Various security and CVE fixes are included in this release.

## June 08, 2026

**Apigee X** Announcement On June 8th, 2026, we released an updated version of Apigee (1-17-0-apigee-9).

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Security

| Bug ID | Description |
|---|---|
| **514384893** | **Security fix for Apigee.** Hardened the Script policy to block server-side request forgery (SSRF) to link-local addresses. |
| **N/A** | **Security fix for Apigee infrastructure.** |

Fixed

| Bug ID | Description |
|---|---|
| **512850756** | Added observability metrics for the OpenTelemetry trace export pipeline, reporting spans exported, export latency, batch size, and dropped spans. |
| **515039499** | Fixed an issue where OpenTelemetry trace export over HTTP could fail to authenticate when sent through a forward proxy that requires basic authentication. |

**Apigee hybrid** v1.16.5 Announcement

### v1.16.5

On June 8, 2026 we released an updated version of the Apigee hybrid software, v1.16.5.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.16.5](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Security Various security and CVE fixes are included in this release.

## June 02, 2026

**Apigee X** Announcement On June 2nd, 2026, we released an updated version of Apigee Cassandra.

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Security

| Bug ID | Description |
|---|---|
| **Apigee Cassandra security update** | **Security fix for Apigee Cassandra infrastructure.** This addresses the following vulnerabilities: - [CVE-2026-39820](https://nvd.nist.gov/vuln/detail/CVE-2026-39820) - [CVE-2026-42499](https://nvd.nist.gov/vuln/detail/CVE-2026-42499) - [CVE-2026-39836](https://nvd.nist.gov/vuln/detail/CVE-2026-39836) - [CVE-2026-33814](https://nvd.nist.gov/vuln/detail/CVE-2026-33814) - [CVE-2026-42501](https://nvd.nist.gov/vuln/detail/CVE-2026-42501) - [CVE-2026-33811](https://nvd.nist.gov/vuln/detail/CVE-2026-33811) - [CVE-2026-39825](https://nvd.nist.gov/vuln/detail/CVE-2026-39825) - [CVE-2026-39817](https://nvd.nist.gov/vuln/detail/CVE-2026-39817) - [CVE-2026-39823](https://nvd.nist.gov/vuln/detail/CVE-2026-39823) - [CVE-2026-39819](https://nvd.nist.gov/vuln/detail/CVE-2026-39819) - [CVE-2026-39826](https://nvd.nist.gov/vuln/detail/CVE-2026-39826) <br /> |

## May 30, 2026

**Apigee hybrid** v1.15.4 Announcement

### v1.15.4

On May 30, 2026 we released an updated version of the Apigee hybrid software, v1.15.4.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.15.4](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Security Various security and CVE fixes are included in this release.

## May 29, 2026

**Apigee X** Announcement On May 29, 2026, we released an updated version of the Apigee UI.
Feature **Apigee EventFlow now supports the DataCapture policy**

You can now use the DataCapture policy within an EventFlow to extract and
persist data from server-sent events (SSE) streams, such as token counts and
other fields from streaming LLM responses.
For more information, see
[Use the DataCapture policy to capture token counts](https://docs.cloud.google.com/apigee/docs/api-platform/develop/server-sent-events.md.txt#datacapture-token-counts).
Feature **Manage Spaces in the Apigee UI**

You can now create, view, update, and delete spaces, and manage their Identity and Access Management (IAM) policies directly in the Apigee UI.
Previously, these actions could only be performed using the Apigee API.
For more information, see
[Apigee Spaces overview](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/spaces/apigee-spaces-overview.md.txt).

## May 22, 2026

**Apigee X** Announcement **Apigee Emulator**

### Apigee Emulator v2.0.0

On May 22, 2026, we released Apigee Emulator version 2.0.0.

Starting with this release, the Apigee Emulator is versioned and released
independently from Apigee hybrid. This enables faster delivery of security
patches and updates without waiting for hybrid release cycles. The emulator
image continues to be available at
[Google Artifact Registry](https://console.cloud.google.com/artifacts/docker/apigee-release/us/gcr.io/hybrid%2Fapigee-emulator).

To use the new version, update the emulator version in your VS Code Cloud Code
settings to `2.0.0`. See
[Manage the Apigee Emulator](https://docs.cloud.google.com/apigee/docs/api-platform/local-development/vscode/manage-apigee-emulator.md.txt#choose_the_emulator_version)
for details.
Feature **Apigee Emulator**

#### Changed in this release

- The Apigee Emulator now follows independent semantic versioning (MAJOR.MINOR.PATCH), decoupled from Apigee hybrid versioning.
- Updated base Cassandra image to version 4.0.19.
- Updated Java runtime to Eclipse Temurin JRE 11.0.31.
Security **Apigee Emulator**

#### Security

This release addresses 78 security vulnerabilities across Cassandra base image,
Go standard library, Java dependencies, and Python packages. Key fixes include:

| CVE | Component |
|---|---|
| [CVE-2022-42003](https://nvd.nist.gov/vuln/detail/CVE-2022-42003) | Jackson Databind |
| [CVE-2022-42004](https://nvd.nist.gov/vuln/detail/CVE-2022-42004) | Jackson Databind |
| [CVE-2022-38749](https://nvd.nist.gov/vuln/detail/CVE-2022-38749) | SnakeYAML |
| [CVE-2022-38750](https://nvd.nist.gov/vuln/detail/CVE-2022-38750) | SnakeYAML |
| [CVE-2023-2976](https://nvd.nist.gov/vuln/detail/CVE-2023-2976) | Google Guava |
| [CVE-2020-8908](https://nvd.nist.gov/vuln/detail/CVE-2020-8908) | Google Guava |
| [CVE-2024-12798](https://nvd.nist.gov/vuln/detail/CVE-2024-12798) | Logback |
| [CVE-2025-22866](https://nvd.nist.gov/vuln/detail/CVE-2025-22866) | Go stdlib |
| [CVE-2025-22870](https://nvd.nist.gov/vuln/detail/CVE-2025-22870) | Go stdlib |
| [CVE-2022-40897](https://nvd.nist.gov/vuln/detail/CVE-2022-40897) | Python setuptools |

And 68 additional CVEs fixed through updated upstream dependencies.
**Apigee hybrid** v1.14.5 Announcement

### v1.14.5

On May 22, 2026 we released an updated version of the Apigee hybrid software, v1.14.5.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.14.5](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Security Various security and CVE fixes are included in this release.
v1.16.0 Announcement On May 22, 2026 we released an updated version of the Apigee UI.

The **Management \> Instances** page now displays Apigee hybrid instances. The display includes the instance name, location, and runtime version.

See [Managing instances](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/instances.md.txt).
Announcement

### Apigee Emulator is now released independently

Starting May 22, 2026, the Apigee Emulator is versioned and released
independently from Apigee hybrid. Emulator updates, including security patches,
are no longer tied to hybrid release cycles.

The emulator image continues to be available at
`gcr.io/apigee-release/hybrid/apigee-emulator`. The first independent release
is **v2.0.0**.

For emulator release notes going forward, see
[Apigee release notes](https://docs.cloud.google.com/apigee/docs/release/release-notes.md.txt).

## May 21, 2026

**Apigee X** Announcement On May 21st, 2026, we released an updated version of Apigee (1-17-0-apigee-8).

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Fixed

| Bug ID | Description |
|---|---|
| **514973778** | Fixed Model Armor response parsing to gracefully handle unknown fields, so future Model Armor field additions no longer cause policy failures. |

**Apigee hybrid** v1.16.4 Announcement

### v1.16.4

On May 21, 2026 we released an updated version of the Apigee hybrid software, v1.16.4.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.16.4](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Fixed

#### Fixed in this release

| Bug ID | Description |
|---|---|
| **515424331** | **Fixed an issue with missing container images in the `gcr.io/apigee-release/hybrid/` repository.** |

## May 20, 2026

**Apigee X** Security **On May 20, 2026, we published a security bulletin for Apigee.**

A vulnerability was found in Apigee
([CVE-2026-2264](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2264))
where the `IntegrationRegion`
parameter in the `SetIntegrationRequest` policy lacks validation,
allowing for Server-Side Request Forgery (SSRF) and service account token
exfiltration. The issue arises when an attacker can control a flow variable used
for `IntegrationRegion`, leading to requests being sent to an
attacker-controlled host with the service account token.

**Security bulletin published: [GCP-2026-034](https://docs.cloud.google.com/apigee/docs/security-bulletins/security-bulletins.md.txt#gcp-2026-034)**

## May 19, 2026

**Apigee hybrid** v1.16.3 Announcement

### v1.16.3

On May 19, 2026 we released an updated version of the Apigee hybrid software, v1.16.3.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.16.3](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Fixed

#### Fixed in this release

| Bug ID | Description |
|---|---|
| **512866352** | **Fixed an issue where the `apigee-redis` pod entered a `CrashLoopBackOff` state when deployed with Vault-based secret injection due to a GLIBC version mismatch in the bundled `/bin/sh` and `/bin/cat` binaries.** |

Feature **Custom environment variables for Guardrail pods (`guardrails.envVars`)**

Starting in version v1.16.3, you can inject custom environment variables into Apigee hybrid Guardrail pods using the new `guardrails.envVars` property in `overrides.yaml`. This is most commonly used to set `NO_PROXY` (or `no_proxy`) so that Guardrail pods bypass a configured forward HTTP proxy when calling internal in-cluster endpoints such as the Kubernetes API server, which previously failed in restricted-network environments with a global `httpProxy` configured. The property is supported on Guardrail pods for the following components: `apigee-datastore`, `apigee-env`, `apigee-ingress-manager`, `apigee-operator`, `apigee-org`, `apigee-redis`, `apigee-telemetry`, and `apigee-virtualhost`.

Example:

```yaml
guardrails:
  envVars:
    NO_PROXY: 'kubernetes.default.svc,172.20.0.1'
```

## May 13, 2026

**Apigee hybrid** v1.16.2 Announcement

### v1.16.2

On May 13, 2026 we released an updated version of the Apigee hybrid software, v1.16.2.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.16.2](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Feature **Basic Auth credential support for forward proxies**

Starting in version v1.16.2, Apigee hybrid runtime components can accept credentials for an upstream forward proxy that enforces HTTP Basic Auth. You can now configure a Basic Auth username and password for the forward proxy in your overrides.yaml. This resolves known issue tracked in b/499322601. See [Configure Apigee hybrid to use a forward proxy](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/forward-proxy.md.txt).
Feature **Sidecar authentication for Workload Identity Federation on AKS and EKS**

Starting in version v1.16.2, you can now use a sidecar along with Workload Identity Federation on AKS and EKS to mount security tokens from your preferred identity provider (IDP) for service account authentication. This method is an alternative to using Kubernetes Projected Service Account Tokens, and is useful when you need to integrate with a custom Identity Provider. See [Use sidecar authentication for Workload Identity Federation on AKS and EKS](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/use-sidecar-for-wif.md.txt).
Fixed

#### Fixed in this release

| Bug ID | Description |
|---|---|
| **485738013** | **Fixed an issue where API products with `LLMTokenQuota` operations were not enforcing model-based access restrictions, allowing requests to models not listed in the product to bypass the operations check.** |
| **479288727** | **Fixed an issue where the Apigee UI and API reported a 10+ minute delay in deployment status after performing a proxy deployment.** |
| **499223890** | **Fixed an issue where the runtime could not handle HTTP proxy passwords containing special characters in Apigee hybrid 1.16.0-hotfix-1 configurations.** |
| **500861814** | **Fixed an issue that caused excessive Message Processor (MP) upscaling and failure to downscale.** |
| **510438578** | **Fixed an ingestion-blocking issue with `apigee-stackdriver-prometheus-sidecar` in Apigee hybrid 1.16.1.** |

Security Various security and CVE fixes are included in this release.

## May 12, 2026

**Apigee API hub** Feature **MCP tools support for Agentic AI workflows (Preview)**

API hub now exposes read-only APIs as Model Context Protocol (MCP) tools. Agentic AI applications can now use the standard MCP `tools/list` and `tools/call` methods to list and inspect API hub resources, including APIs, specs, versions, and deployments.

This feature is in [Public Preview](https://cloud.google.com/products#product-launch-stages). For more information, see [API hub MCP reference](https://docs.cloud.google.com/apigee/docs/reference/apis/apihub/mcp.md.txt).
**Apigee X** Announcement On May 12th, 2026, we released an updated version of Apigee (1-17-0-apigee-7).

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Security

| Bug ID | Description |
|---|---|
| **511325186, 505460952, 502250074, 491231600, 497357701, 509560467, 496969438, 495897297, 495033618, 511332617, 505183435, 500735547, 500890221** | **Security fix for Apigee infrastructure.** This addresses the following vulnerabilities: - [CVE-2026-42587](https://nvd.nist.gov/vuln/detail/CVE-2026-42587) - [CVE-2026-5588](https://nvd.nist.gov/vuln/detail/CVE-2026-5588) - [CVE-2026-34480](https://nvd.nist.gov/vuln/detail/CVE-2026-34480) - [GHSA-72hv-8253-57qq](https://github.com/advisories/GHSA-72hv-8253-57qq) - [CVE-2026-33870](https://nvd.nist.gov/vuln/detail/CVE-2026-33870) - [CVE-2026-33871](https://nvd.nist.gov/vuln/detail/CVE-2026-33871) - [CVE-2026-35611](https://nvd.nist.gov/vuln/detail/CVE-2026-35611) - [CVE-2026-33170](https://nvd.nist.gov/vuln/detail/CVE-2026-33170) - [CVE-2026-33169](https://nvd.nist.gov/vuln/detail/CVE-2026-33169) - [CVE-2026-33176](https://nvd.nist.gov/vuln/detail/CVE-2026-33176) - [CVE-2026-33210](https://nvd.nist.gov/vuln/detail/CVE-2026-33210) - [CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186) - [CVE-2026-42499](https://nvd.nist.gov/vuln/detail/CVE-2026-42499) - [CVE-2026-35469](https://nvd.nist.gov/vuln/detail/CVE-2026-35469) - [CVE-2026-32281](https://nvd.nist.gov/vuln/detail/CVE-2026-32281) - [CVE-2026-27144](https://nvd.nist.gov/vuln/detail/CVE-2026-27144) <br /> |

Fixed

| Bug ID | Description |
|---|---|
| **480260846** | Improved XML processing security to prevent external entity injection. |
| **510061670, 505723451, 503723862, 503817773** | Improved security in OAuthV2 policy. |
| **505645076** | Fixed a security issue in OAuthV2 policy to prevent unauthorized token injection. |
| **503047744, 410026138, 496021751** | Improved security isolation for PythonScript policy execution. |
| **469694040** | Fixed an issue where custom security policies could intermittently fail to apply, and improved security policy resolution to ensure correct policy selection. |
| **502971220** | Fixed a concurrency issue to improve stability under high load. |
| **509692565** | Fixed content-length header handling in external processing to prevent incorrect values. |
| **282207038** | Improved performance while listing apps on scale. |
| **501102321** | Fixed recurring fee calculation in monetization to correctly apply rate plan overrides. |
| **449729840, 502604752** | Fixed streaming response handling to prevent race conditions in bidirectional flows. |
| **507167063** | Fixed preservation of client request IDs during proxy chaining. |
| **507580304** | Improved IPv4 address normalization for consistent access control evaluation. |
| **502692267** | MCP to handle /.well-known/oauth-protected-resource/mcp resource paths. |
| **430170696** | Changed the error response from 500 to 401 for expired consumer keys. |
| **480770263** | Fixed SpikeArrest policy to handle edge cases that previously caused 500 errors. |
| **500861814** | Gracefully handle connection failures involving the forward proxy, resolving an issue where port exhaustion could trigger aggressive retry storms, excessive CPU usage, and unnecessary scaling. |
| **500313309** | Fixed SSE streaming detection logic. |
| **494304819** | Hardened message processor management ports by blocking external access to internal management endpoints. |
| **469642464** | Improved input validation in AI protection policies to prevent Server-Side Request Forgery. |
| **472526232** | Improved SAML assertion validation. |
| **494590020** | Added enforcement for product association in OAuthV2 flow. Apps without valid products are now denied. |
| **479288727** | Improved performance and reduced redundant work in ingress status watcher. |
| **N/A** | Updates to infrastructure and libraries. |

## May 07, 2026

**Apigee API hub** Feature **Unified MCP Proxy Configuration in API hub (Preview)**

API hub allows you to create and deploy Model Context Protocol (MCP) discovery proxies. Select specific API operations from your registered catalog, bundle them into an MCP server, and automatically deploy them as discovery proxies in your Apigee project. This feature eliminates the need to manually author MCP specifications in Apigee.

This feature is in [Public Preview](https://cloud.google.com/products#product-launch-stages). For more information, see [Manage MCP proxies](https://docs.cloud.google.com/apigee/docs/apihub/manage-mcp-proxies.md.txt).

## May 04, 2026

**Apigee hybrid** v1.15.3 Announcement

### v1.15.3

On May 4, 2026 we released an updated version of the Apigee hybrid software, v1.15.3.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.15.3](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Security

| Bug ID | Description |
|---|---|
| **N/A** | **Security fixes for `apigee-asm-ingress`.** This addresses the following vulnerabilities: - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) - [CVE-2026-34040](https://nvd.nist.gov/vuln/detail/CVE-2026-34040) - [CVE-2026-33997](https://nvd.nist.gov/vuln/detail/CVE-2026-33997) - [CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186) - [CVE-2026-25679](https://nvd.nist.gov/vuln/detail/CVE-2026-25679) - [CVE-2026-24051](https://nvd.nist.gov/vuln/detail/CVE-2026-24051) - [CVE-2026-0915](https://nvd.nist.gov/vuln/detail/CVE-2026-0915) - [CVE-2026-0861](https://nvd.nist.gov/vuln/detail/CVE-2026-0861) - [CVE-2025-68119](https://nvd.nist.gov/vuln/detail/CVE-2025-68119) - [CVE-2025-61732](https://nvd.nist.gov/vuln/detail/CVE-2025-61732) - [CVE-2025-61731](https://nvd.nist.gov/vuln/detail/CVE-2025-61731) - [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729) - [CVE-2025-61726](https://nvd.nist.gov/vuln/detail/CVE-2025-61726) - [CVE-2025-4674](https://nvd.nist.gov/vuln/detail/CVE-2025-4674) - [CVE-2025-15558](https://nvd.nist.gov/vuln/detail/CVE-2025-15558) - [CVE-2025-15281](https://nvd.nist.gov/vuln/detail/CVE-2025-15281) |
| **N/A** | **Security fixes for `apigee-asm-istiod`.** This addresses the following vulnerabilities: - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) - [CVE-2026-35469](https://nvd.nist.gov/vuln/detail/CVE-2026-35469) - [CVE-2026-34040](https://nvd.nist.gov/vuln/detail/CVE-2026-34040) - [CVE-2026-33997](https://nvd.nist.gov/vuln/detail/CVE-2026-33997) - [CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186) - [CVE-2026-25679](https://nvd.nist.gov/vuln/detail/CVE-2026-25679) - [CVE-2026-24051](https://nvd.nist.gov/vuln/detail/CVE-2026-24051) - [CVE-2025-68119](https://nvd.nist.gov/vuln/detail/CVE-2025-68119) - [CVE-2025-61732](https://nvd.nist.gov/vuln/detail/CVE-2025-61732) - [CVE-2025-61731](https://nvd.nist.gov/vuln/detail/CVE-2025-61731) - [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729) - [CVE-2025-61726](https://nvd.nist.gov/vuln/detail/CVE-2025-61726) - [CVE-2025-4674](https://nvd.nist.gov/vuln/detail/CVE-2025-4674) - [CVE-2025-15558](https://nvd.nist.gov/vuln/detail/CVE-2025-15558) |
| **N/A** | **Security fixes for `apigee-connect-agent`.** This addresses the following vulnerabilities: - [CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186) - [CVE-2026-32283](https://nvd.nist.gov/vuln/detail/CVE-2026-32283) - [CVE-2026-32281](https://nvd.nist.gov/vuln/detail/CVE-2026-32281) - [CVE-2026-32280](https://nvd.nist.gov/vuln/detail/CVE-2026-32280) - [CVE-2026-27144](https://nvd.nist.gov/vuln/detail/CVE-2026-27144) - [CVE-2026-27143](https://nvd.nist.gov/vuln/detail/CVE-2026-27143) - [CVE-2026-27140](https://nvd.nist.gov/vuln/detail/CVE-2026-27140) - [CVE-2026-25679](https://nvd.nist.gov/vuln/detail/CVE-2026-25679) |
| **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2026-31789](https://nvd.nist.gov/vuln/detail/CVE-2026-31789) - [CVE-2026-28387](https://nvd.nist.gov/vuln/detail/CVE-2026-28387) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2026-34481](https://nvd.nist.gov/vuln/detail/CVE-2026-34481) - [CVE-2026-32283](https://nvd.nist.gov/vuln/detail/CVE-2026-32283) - [CVE-2026-32281](https://nvd.nist.gov/vuln/detail/CVE-2026-32281) - [CVE-2026-32280](https://nvd.nist.gov/vuln/detail/CVE-2026-32280) - [CVE-2026-27144](https://nvd.nist.gov/vuln/detail/CVE-2026-27144) - [CVE-2026-27143](https://nvd.nist.gov/vuln/detail/CVE-2026-27143) - [CVE-2026-27140](https://nvd.nist.gov/vuln/detail/CVE-2026-27140) - [CVE-2026-25679](https://nvd.nist.gov/vuln/detail/CVE-2026-25679) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** This addresses the following vulnerabilities: - [CVE-2026-39883](https://nvd.nist.gov/vuln/detail/CVE-2026-39883) - [CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186) - [CVE-2026-32283](https://nvd.nist.gov/vuln/detail/CVE-2026-32283) - [CVE-2026-32281](https://nvd.nist.gov/vuln/detail/CVE-2026-32281) - [CVE-2026-32280](https://nvd.nist.gov/vuln/detail/CVE-2026-32280) - [CVE-2026-27144](https://nvd.nist.gov/vuln/detail/CVE-2026-27144) - [CVE-2026-27143](https://nvd.nist.gov/vuln/detail/CVE-2026-27143) - [CVE-2026-27140](https://nvd.nist.gov/vuln/detail/CVE-2026-27140) - [CVE-2026-25679](https://nvd.nist.gov/vuln/detail/CVE-2026-25679) |
| **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2026-24051](https://nvd.nist.gov/vuln/detail/CVE-2026-24051) - [CVE-2026-25679](https://nvd.nist.gov/vuln/detail/CVE-2026-25679) |
| **N/A** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerabilities: - [CVE-2026-34481](https://nvd.nist.gov/vuln/detail/CVE-2026-34481) - [CVE-2026-34480](https://nvd.nist.gov/vuln/detail/CVE-2026-34480) - [CVE-2026-34478](https://nvd.nist.gov/vuln/detail/CVE-2026-34478) - [CVE-2026-21932](https://nvd.nist.gov/vuln/detail/CVE-2026-21932) - [CVE-2025-48913](https://nvd.nist.gov/vuln/detail/CVE-2025-48913) |
| **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** This addresses the following vulnerabilities: - [CVE-2026-34481](https://nvd.nist.gov/vuln/detail/CVE-2026-34481) - [CVE-2026-34480](https://nvd.nist.gov/vuln/detail/CVE-2026-34480) - [CVE-2026-34478](https://nvd.nist.gov/vuln/detail/CVE-2026-34478) - [CVE-2026-21932](https://nvd.nist.gov/vuln/detail/CVE-2026-21932) |
| **N/A** | **Security fixes for `apigee-open-telemetry-collector`.** This addresses the following vulnerabilities: - [CVE-2025-68119](https://nvd.nist.gov/vuln/detail/CVE-2025-68119) - [CVE-2025-61731](https://nvd.nist.gov/vuln/detail/CVE-2025-61731) - [CVE-2025-61726](https://nvd.nist.gov/vuln/detail/CVE-2025-61726) |
| **N/A** | **Security fixes for `apigee-operators`.** This addresses the following vulnerabilities: - [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729) - [CVE-2025-61726](https://nvd.nist.gov/vuln/detail/CVE-2025-61726) - [CVE-2025-61723](https://nvd.nist.gov/vuln/detail/CVE-2025-61723) - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) - [CVE-2026-32283](https://nvd.nist.gov/vuln/detail/CVE-2026-32283) - [CVE-2026-32281](https://nvd.nist.gov/vuln/detail/CVE-2026-32281) - [CVE-2026-32280](https://nvd.nist.gov/vuln/detail/CVE-2026-32280) - [CVE-2026-27144](https://nvd.nist.gov/vuln/detail/CVE-2026-27144) - [CVE-2026-27143](https://nvd.nist.gov/vuln/detail/CVE-2026-27143) - [CVE-2026-27140](https://nvd.nist.gov/vuln/detail/CVE-2026-27140) - [CVE-2026-25679](https://nvd.nist.gov/vuln/detail/CVE-2026-25679) |
| **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186) - [CVE-2026-32283](https://nvd.nist.gov/vuln/detail/CVE-2026-32283) - [CVE-2026-32281](https://nvd.nist.gov/vuln/detail/CVE-2026-32281) - [CVE-2026-32280](https://nvd.nist.gov/vuln/detail/CVE-2026-32280) - [CVE-2026-27144](https://nvd.nist.gov/vuln/detail/CVE-2026-27144) - [CVE-2026-27143](https://nvd.nist.gov/vuln/detail/CVE-2026-27143) - [CVE-2026-27140](https://nvd.nist.gov/vuln/detail/CVE-2026-27140) - [CVE-2026-25679](https://nvd.nist.gov/vuln/detail/CVE-2026-25679) - [CVE-2025-61732](https://nvd.nist.gov/vuln/detail/CVE-2025-61732) |
| **N/A** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerabilities: - [CVE-2026-39883](https://nvd.nist.gov/vuln/detail/CVE-2026-39883) - [CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186) - [CVE-2026-32283](https://nvd.nist.gov/vuln/detail/CVE-2026-32283) - [CVE-2026-32281](https://nvd.nist.gov/vuln/detail/CVE-2026-32281) - [CVE-2026-32280](https://nvd.nist.gov/vuln/detail/CVE-2026-32280) - [CVE-2026-27144](https://nvd.nist.gov/vuln/detail/CVE-2026-27144) - [CVE-2026-27143](https://nvd.nist.gov/vuln/detail/CVE-2026-27143) - [CVE-2026-27140](https://nvd.nist.gov/vuln/detail/CVE-2026-27140) - [CVE-2026-25679](https://nvd.nist.gov/vuln/detail/CVE-2026-25679) - [CVE-2025-61732](https://nvd.nist.gov/vuln/detail/CVE-2025-61732) |
| **N/A** | **Security fixes for `apigee-redis`.** This addresses the following vulnerabilities: - [CVE-2026-32283](https://nvd.nist.gov/vuln/detail/CVE-2026-32283) - [CVE-2026-32281](https://nvd.nist.gov/vuln/detail/CVE-2026-32281) - [CVE-2026-32280](https://nvd.nist.gov/vuln/detail/CVE-2026-32280) - [CVE-2026-27144](https://nvd.nist.gov/vuln/detail/CVE-2026-27144) - [CVE-2026-27143](https://nvd.nist.gov/vuln/detail/CVE-2026-27143) - [CVE-2026-27140](https://nvd.nist.gov/vuln/detail/CVE-2026-27140) - [CVE-2026-25679](https://nvd.nist.gov/vuln/detail/CVE-2026-25679) - [CVE-2025-68119](https://nvd.nist.gov/vuln/detail/CVE-2025-68119) - [CVE-2025-61732](https://nvd.nist.gov/vuln/detail/CVE-2025-61732) - [CVE-2025-61731](https://nvd.nist.gov/vuln/detail/CVE-2025-61731) - [CVE-2025-61726](https://nvd.nist.gov/vuln/detail/CVE-2025-61726) - [CVE-2025-47907](https://nvd.nist.gov/vuln/detail/CVE-2025-47907) - [CVE-2025-4674](https://nvd.nist.gov/vuln/detail/CVE-2025-4674) |
| **N/A** | **Security fixes for `apigee-runtime`.** This addresses the following vulnerabilities: - [CVE-2026-34481](https://nvd.nist.gov/vuln/detail/CVE-2026-34481) - [CVE-2026-34480](https://nvd.nist.gov/vuln/detail/CVE-2026-34480) - [CVE-2026-34478](https://nvd.nist.gov/vuln/detail/CVE-2026-34478) - [CVE-2026-21932](https://nvd.nist.gov/vuln/detail/CVE-2026-21932) - [CVE-2025-48913](https://nvd.nist.gov/vuln/detail/CVE-2025-48913) |
| **N/A** | **Security fixes for `apigee-stackdriver-logging-agent`.** This addresses the following vulnerabilities: - [CVE-2026-41316](https://nvd.nist.gov/vuln/detail/CVE-2026-41316) - [CVE-2026-35611](https://nvd.nist.gov/vuln/detail/CVE-2026-35611) - [CVE-2026-33210](https://nvd.nist.gov/vuln/detail/CVE-2026-33210) - [CVE-2026-33176](https://nvd.nist.gov/vuln/detail/CVE-2026-33176) |
| **N/A** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2026-34481](https://nvd.nist.gov/vuln/detail/CVE-2026-34481) - [CVE-2026-34480](https://nvd.nist.gov/vuln/detail/CVE-2026-34480) - [CVE-2026-34478](https://nvd.nist.gov/vuln/detail/CVE-2026-34478) - [CVE-2026-21932](https://nvd.nist.gov/vuln/detail/CVE-2026-21932) - [CVE-2025-48913](https://nvd.nist.gov/vuln/detail/CVE-2025-48913) |
| **N/A** | **Security fixes for `apigee-udca`.** This addresses the following vulnerabilities: - [CVE-2026-39883](https://nvd.nist.gov/vuln/detail/CVE-2026-39883) - [CVE-2026-34986](https://nvd.nist.gov/vuln/detail/CVE-2026-34986) - [CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186) - [CVE-2026-32283](https://nvd.nist.gov/vuln/detail/CVE-2026-32283) - [CVE-2026-32281](https://nvd.nist.gov/vuln/detail/CVE-2026-32281) - [CVE-2026-32280](https://nvd.nist.gov/vuln/detail/CVE-2026-32280) - [CVE-2026-29181](https://nvd.nist.gov/vuln/detail/CVE-2026-29181) - [CVE-2026-27144](https://nvd.nist.gov/vuln/detail/CVE-2026-27144) - [CVE-2026-27143](https://nvd.nist.gov/vuln/detail/CVE-2026-27143) - [CVE-2026-27140](https://nvd.nist.gov/vuln/detail/CVE-2026-27140) - [CVE-2026-25679](https://nvd.nist.gov/vuln/detail/CVE-2026-25679) |
| **N/A** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerabilities: - [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729) - [CVE-2025-61723](https://nvd.nist.gov/vuln/detail/CVE-2025-61723) - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) - [CVE-2026-35469](https://nvd.nist.gov/vuln/detail/CVE-2026-35469) - [CVE-2026-25679](https://nvd.nist.gov/vuln/detail/CVE-2026-25679) |

## April 29, 2026

**Apigee X** Announcement On April 29th, 2026, we began maintenance updates of Apigee instances [configured for maintenance windows](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/maintenance-windows.md.txt).

If you set a preferred window for maintenance for your instance, and your instance version is
below **1-17-0-apigee-4** , your instance will be updated to **1-17-0-apigee-4** within the
next seven to 21 days. A notification containing the expected date of upgrade will be sent within the next two business days.

> [!NOTE]
> Note: Instances that meet either of the following two criteria will **not** be updated:
>
> - Your instance has a DNS misconfiguration, as described in [Known Issue 445936920](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt).
> - Your instance uses an Apigee Java Library that has been removed, as described in [Apigee release notes dated October 16, 2025](https://docs.cloud.google.com/apigee/docs/release/release-notes.md.txt#October_16_2025).

For more information on participating in scheduled maintenance windows, see [Maintenance overview](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/maintenance.md.txt) and [Manage Apigee instance maintenance windows](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/maintenance-windows.md.txt).

## April 27, 2026

**Apigee hybrid** v1.14.4 Announcement

### v1.14.4

On April 27, 2026 we released an updated version of the Apigee hybrid software, v1.14.4.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.14.4](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Feature **Sidecar authentication for Workload Identity Federation on non-GKE platforms**

Starting in version v1.14.4, you can now use a sidecar along with Workload Identity Federation on non-GKE platforms to mount security tokens from your preferred identity provider (IDP) for service account authentication. See [Use sidecar authentication for Workload Identity Federation on non-GKE platforms](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/use-sidecar-for-wif.md.txt).
Security

| Bug ID | Description |
|---|---|
| **471527485, 471173296, 471172082, 471171833** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2025-55163](https://nvd.nist.gov/vuln/detail/CVE-2025-55163) - [CVE-2025-58056](https://nvd.nist.gov/vuln/detail/CVE-2025-58056) - [CVE-2025-58057](https://nvd.nist.gov/vuln/detail/CVE-2025-58057) - [CVE-2025-67735](https://nvd.nist.gov/vuln/detail/CVE-2025-67735) |
| **471290390, 471199955, 471197958, 470990914** | **Security fixes for `apigee-runtime`.** This addresses the following vulnerabilities: - [CVE-2025-55163](https://nvd.nist.gov/vuln/detail/CVE-2025-55163) - [CVE-2025-58056](https://nvd.nist.gov/vuln/detail/CVE-2025-58056) - [CVE-2025-58057](https://nvd.nist.gov/vuln/detail/CVE-2025-58057) - [CVE-2025-67735](https://nvd.nist.gov/vuln/detail/CVE-2025-67735) |
| **470992132, 470991089, 470989623, 470989232, 470988977** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerabilities: - [CVE-2025-48924](https://nvd.nist.gov/vuln/detail/CVE-2025-48924) - [CVE-2025-55163](https://nvd.nist.gov/vuln/detail/CVE-2025-55163) - [CVE-2025-58056](https://nvd.nist.gov/vuln/detail/CVE-2025-58056) - [CVE-2025-58057](https://nvd.nist.gov/vuln/detail/CVE-2025-58057) - [CVE-2025-67735](https://nvd.nist.gov/vuln/detail/CVE-2025-67735) |
| **470953507, 470953254, 470952893** | **Security fixes for `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2022-40897](https://nvd.nist.gov/vuln/detail/CVE-2022-40897) - [CVE-2023-2976](https://nvd.nist.gov/vuln/detail/CVE-2023-2976) - [CVE-2025-47273](https://nvd.nist.gov/vuln/detail/CVE-2025-47273) |
| **451224723, 451224123** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2010-4756](https://nvd.nist.gov/vuln/detail/CVE-2010-4756) - [CVE-2011-3389](https://nvd.nist.gov/vuln/detail/CVE-2011-3389) - [CVE-2013-4392](https://nvd.nist.gov/vuln/detail/CVE-2013-4392) - [CVE-2015-3276](https://nvd.nist.gov/vuln/detail/CVE-2015-3276) - [CVE-2017-14159](https://nvd.nist.gov/vuln/detail/CVE-2017-14159) - [CVE-2017-17740](https://nvd.nist.gov/vuln/detail/CVE-2017-17740) - [CVE-2018-20796](https://nvd.nist.gov/vuln/detail/CVE-2018-20796) - [CVE-2018-5709](https://nvd.nist.gov/vuln/detail/CVE-2018-5709) - [CVE-2018-6829](https://nvd.nist.gov/vuln/detail/CVE-2018-6829) - [CVE-2019-1010022](https://nvd.nist.gov/vuln/detail/CVE-2019-1010022) - [CVE-2019-1010023](https://nvd.nist.gov/vuln/detail/CVE-2019-1010023) - [CVE-2019-1010024](https://nvd.nist.gov/vuln/detail/CVE-2019-1010024) - [CVE-2019-1010025](https://nvd.nist.gov/vuln/detail/CVE-2019-1010025) - [CVE-2019-9192](https://nvd.nist.gov/vuln/detail/CVE-2019-9192) - [CVE-2020-15719](https://nvd.nist.gov/vuln/detail/CVE-2020-15719) - [CVE-2022-27943](https://nvd.nist.gov/vuln/detail/CVE-2022-27943) - [CVE-2023-2953](https://nvd.nist.gov/vuln/detail/CVE-2023-2953) - [CVE-2023-31437](https://nvd.nist.gov/vuln/detail/CVE-2023-31437) - [CVE-2023-31438](https://nvd.nist.gov/vuln/detail/CVE-2023-31438) - [CVE-2023-31439](https://nvd.nist.gov/vuln/detail/CVE-2023-31439) - [CVE-2023-45853](https://nvd.nist.gov/vuln/detail/CVE-2023-45853) - [CVE-2024-2236](https://nvd.nist.gov/vuln/detail/CVE-2024-2236) - [CVE-2024-2379](https://nvd.nist.gov/vuln/detail/CVE-2024-2379) - [CVE-2024-26458](https://nvd.nist.gov/vuln/detail/CVE-2024-26458) - [CVE-2024-26461](https://nvd.nist.gov/vuln/detail/CVE-2024-26461) - [CVE-2025-0725](https://nvd.nist.gov/vuln/detail/CVE-2025-0725) - [CVE-2025-10148](https://nvd.nist.gov/vuln/detail/CVE-2025-10148) - [CVE-2025-27587](https://nvd.nist.gov/vuln/detail/CVE-2025-27587) - [CVE-2025-62813](https://nvd.nist.gov/vuln/detail/CVE-2025-62813) - [CVE-2025-9086](https://nvd.nist.gov/vuln/detail/CVE-2025-9086) - [CVE-2025-9230](https://nvd.nist.gov/vuln/detail/CVE-2025-9230) - [CVE-2025-9232](https://nvd.nist.gov/vuln/detail/CVE-2025-9232) |
| **N/A** | **Security fixes for `apigee-asm-ingress`.** This addresses the following vulnerabilities: - [CVE-2026-4437](https://nvd.nist.gov/vuln/detail/CVE-2026-4437) - [CVE-2026-4046](https://nvd.nist.gov/vuln/detail/CVE-2026-4046) - [CVE-2026-34040](https://nvd.nist.gov/vuln/detail/CVE-2026-34040) - [CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186) - [CVE-2026-24051](https://nvd.nist.gov/vuln/detail/CVE-2026-24051) - [CVE-2025-15558](https://nvd.nist.gov/vuln/detail/CVE-2025-15558) |
| **N/A** | **Security fixes for `apigee-asm-istiod`.** This addresses the following vulnerabilities: - [CVE-2026-34040](https://nvd.nist.gov/vuln/detail/CVE-2026-34040) - [CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186) - [CVE-2026-24051](https://nvd.nist.gov/vuln/detail/CVE-2026-24051) - [CVE-2025-15558](https://nvd.nist.gov/vuln/detail/CVE-2025-15558) |
| **N/A** | **Security fixes for `apigee-connect-agent`.** This addresses the following vulnerabilities: - [CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186) - [CVE-2025-68121](https://nvd.nist.gov/vuln/detail/CVE-2025-68121) - [CVE-2025-68119](https://nvd.nist.gov/vuln/detail/CVE-2025-68119) - [CVE-2025-61732](https://nvd.nist.gov/vuln/detail/CVE-2025-61732) - [CVE-2025-61731](https://nvd.nist.gov/vuln/detail/CVE-2025-61731) - [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729) - [CVE-2025-61726](https://nvd.nist.gov/vuln/detail/CVE-2025-61726) - [CVE-2025-4674](https://nvd.nist.gov/vuln/detail/CVE-2025-4674) |
| **N/A** | **Security fixes for `apigee-envoy`.** This addresses the following vulnerabilities: - [CVE-2026-4437](https://nvd.nist.gov/vuln/detail/CVE-2026-4437) - [CVE-2026-4046](https://nvd.nist.gov/vuln/detail/CVE-2026-4046) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** This addresses the following vulnerabilities: - [CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186) - [CVE-2026-24051](https://nvd.nist.gov/vuln/detail/CVE-2026-24051) - [CVE-2025-47907](https://nvd.nist.gov/vuln/detail/CVE-2025-47907) - [CVE-2025-4674](https://nvd.nist.gov/vuln/detail/CVE-2025-4674) |
| **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2026-24051](https://nvd.nist.gov/vuln/detail/CVE-2026-24051) - [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729) - [CVE-2025-61723](https://nvd.nist.gov/vuln/detail/CVE-2025-61723) - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) - [CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186) |
| **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** This addresses the following vulnerabilities: - [CVE-2026-33871](https://nvd.nist.gov/vuln/detail/CVE-2026-33871) - [CVE-2026-33870](https://nvd.nist.gov/vuln/detail/CVE-2026-33870) |
| **N/A** | **Security fixes for `apigee-open-telemetry-collector`.** This addresses the following vulnerabilities: - [CVE-2026-34040](https://nvd.nist.gov/vuln/detail/CVE-2026-34040) - [CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186) - [CVE-2026-32287](https://nvd.nist.gov/vuln/detail/CVE-2026-32287) - [CVE-2026-24051](https://nvd.nist.gov/vuln/detail/CVE-2026-24051) |
| **N/A** | **Security fixes for `apigee-operators`.** This addresses the following vulnerability: - [CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186) |
| **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2026-34040](https://nvd.nist.gov/vuln/detail/CVE-2026-34040) - [CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186) - [CVE-2026-24051](https://nvd.nist.gov/vuln/detail/CVE-2026-24051) |
| **N/A** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerabilities: - [CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186) - [CVE-2026-24051](https://nvd.nist.gov/vuln/detail/CVE-2026-24051) |
| **N/A** | **Security fixes for `apigee-redis`.** This addresses the following vulnerabilities: - [CVE-2025-32023](https://nvd.nist.gov/vuln/detail/CVE-2025-32023) - [CVE-2025-68119](https://nvd.nist.gov/vuln/detail/CVE-2025-68119) - [CVE-2025-61732](https://nvd.nist.gov/vuln/detail/CVE-2025-61732) - [CVE-2025-61731](https://nvd.nist.gov/vuln/detail/CVE-2025-61731) - [CVE-2025-61726](https://nvd.nist.gov/vuln/detail/CVE-2025-61726) - [CVE-2025-47907](https://nvd.nist.gov/vuln/detail/CVE-2025-47907) - [CVE-2025-4674](https://nvd.nist.gov/vuln/detail/CVE-2025-4674) |
| **N/A** | **Security fixes for `apigee-stackdriver-logging-agent`.** This addresses the following vulnerabilities: - [CVE-2026-33176](https://nvd.nist.gov/vuln/detail/CVE-2026-33176) - [CVE-2025-61594](https://nvd.nist.gov/vuln/detail/CVE-2025-61594) - [CVE-2025-24294](https://nvd.nist.gov/vuln/detail/CVE-2025-24294) - [CVE-2023-33953](https://nvd.nist.gov/vuln/detail/CVE-2023-33953) - [CVE-2022-32511](https://nvd.nist.gov/vuln/detail/CVE-2022-32511) - [CVE-2022-29181](https://nvd.nist.gov/vuln/detail/CVE-2022-29181) - [CVE-2022-24839](https://nvd.nist.gov/vuln/detail/CVE-2022-24839) - [CVE-2022-24836](https://nvd.nist.gov/vuln/detail/CVE-2022-24836) - [CVE-2022-0759](https://nvd.nist.gov/vuln/detail/CVE-2022-0759) - [CVE-2021-41817](https://nvd.nist.gov/vuln/detail/CVE-2021-41817) - [CVE-2021-31799](https://nvd.nist.gov/vuln/detail/CVE-2021-31799) - [CVE-2021-30560](https://nvd.nist.gov/vuln/detail/CVE-2021-30560) - [CVE-2021-28965](https://nvd.nist.gov/vuln/detail/CVE-2021-28965) - [CVE-2021-23214](https://nvd.nist.gov/vuln/detail/CVE-2021-23214) - [CVE-2020-25695](https://nvd.nist.gov/vuln/detail/CVE-2020-25695) - [CVE-2020-25694](https://nvd.nist.gov/vuln/detail/CVE-2020-25694) - [CVE-2020-25613](https://nvd.nist.gov/vuln/detail/CVE-2020-25613) - [CVE-2019-3881](https://nvd.nist.gov/vuln/detail/CVE-2019-3881) - [CVE-2018-25032](https://nvd.nist.gov/vuln/detail/CVE-2018-25032) - [CVE-2018-1115](https://nvd.nist.gov/vuln/detail/CVE-2018-1115) - [CVE-2018-10915](https://nvd.nist.gov/vuln/detail/CVE-2018-10915) - [CVE-2018-1058](https://nvd.nist.gov/vuln/detail/CVE-2018-1058) - [CVE-2018-1053](https://nvd.nist.gov/vuln/detail/CVE-2018-1053) - [CVE-2017-7546](https://nvd.nist.gov/vuln/detail/CVE-2017-7546) - [CVE-2017-7484](https://nvd.nist.gov/vuln/detail/CVE-2017-7484) - [CVE-2017-15098](https://nvd.nist.gov/vuln/detail/CVE-2017-15098) - [CVE-2017-14798](https://nvd.nist.gov/vuln/detail/CVE-2017-14798) - [CVE-2016-7954](https://nvd.nist.gov/vuln/detail/CVE-2016-7954) - [CVE-2016-7048](https://nvd.nist.gov/vuln/detail/CVE-2016-7048) - [CVE-2016-5424](https://nvd.nist.gov/vuln/detail/CVE-2016-5424) - [CVE-2016-5423](https://nvd.nist.gov/vuln/detail/CVE-2016-5423) - [CVE-2016-0766](https://nvd.nist.gov/vuln/detail/CVE-2016-0766) - [CVE-2015-3167](https://nvd.nist.gov/vuln/detail/CVE-2015-3167) - [CVE-2015-3166](https://nvd.nist.gov/vuln/detail/CVE-2015-3166) - [CVE-2015-0244](https://nvd.nist.gov/vuln/detail/CVE-2015-0244) - [CVE-2015-0243](https://nvd.nist.gov/vuln/detail/CVE-2015-0243) - [CVE-2015-0241](https://nvd.nist.gov/vuln/detail/CVE-2015-0241) |
| **N/A** | **Security fixes for `apigee-udca`.** This addresses the following vulnerabilities: - [CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186) - [CVE-2026-24051](https://nvd.nist.gov/vuln/detail/CVE-2026-24051) - [CVE-2025-68119](https://nvd.nist.gov/vuln/detail/CVE-2025-68119) - [CVE-2025-61731](https://nvd.nist.gov/vuln/detail/CVE-2025-61731) - [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729) - [CVE-2025-61726](https://nvd.nist.gov/vuln/detail/CVE-2025-61726) - [CVE-2025-61723](https://nvd.nist.gov/vuln/detail/CVE-2025-61723) - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) |
| **N/A** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerability: - [CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186) |

## April 20, 2026

**Apigee hybrid** v1.16.1 Announcement

### v1.16.1

On April 20, 2026 we released an updated version of the Apigee hybrid software, v1.16.1.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.16.1](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Fixed

#### Fixed in this release

| Bug ID | Description |
|---|---|
| **469900037** | **Apigee hybrid now supports `LLMTokenQuota` and `PromptTokenLimit` policies.** |
| **502577947** | **Enhanced the `ParsePayload` policy to support a broader set of Model Context Protocol (MCP) methods and implemented governance bypass for essential system-level methods.** |
| **503029410** | **Removed PII from `ParsePayload` policy outputs to improve security and privacy.** |

Security

| Bug ID | Description |
|---|---|
| **485998102, 482978613** | **Security fixes for `apigee-runtime`, `apigee-mart-server`, and `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2026-21945](https://nvd.nist.gov/vuln/detail/CVE-2026-21945) - [CVE-2026-21932](https://nvd.nist.gov/vuln/detail/CVE-2026-21932) - [CVE-2025-55163](https://nvd.nist.gov/vuln/detail/CVE-2025-55163) - [CVE-2023-2976](https://nvd.nist.gov/vuln/detail/CVE-2023-2976) - [CVE-2022-48174](https://nvd.nist.gov/vuln/detail/CVE-2022-48174) - [CVE-2022-1471](https://nvd.nist.gov/vuln/detail/CVE-2022-1471) |
| **471527485, 471173296, 471172082, 471171833** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2025-67735](https://nvd.nist.gov/vuln/detail/CVE-2025-67735) - [CVE-2025-58057](https://nvd.nist.gov/vuln/detail/CVE-2025-58057) - [CVE-2025-58056](https://nvd.nist.gov/vuln/detail/CVE-2025-58056) - [CVE-2025-55163](https://nvd.nist.gov/vuln/detail/CVE-2025-55163) |
| **454672970** | **Security fix for `apigee-runtime`.** This adds strict input validation to the `IntegrationRegion` parameter in the `SetIntegrationRequest` policy to prevent potential server-side request forgery (SSRF). |
| **493067053, 493061344, 492959383, 492957334, 492359443, 492358696, 492067139, 490280970, 489908390, 489907729, 489489437, 488070159, 485580973** | **Security fixes for `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2025-66566](https://nvd.nist.gov/vuln/detail/CVE-2025-66566) - [CVE-2025-4802](https://nvd.nist.gov/vuln/detail/CVE-2025-4802) - [CVE-2025-12183](https://nvd.nist.gov/vuln/detail/CVE-2025-12183) - [CVE-2023-6246](https://nvd.nist.gov/vuln/detail/CVE-2023-6246) - [CVE-2023-5156](https://nvd.nist.gov/vuln/detail/CVE-2023-5156) - [CVE-2023-4911](https://nvd.nist.gov/vuln/detail/CVE-2023-4911) - [CVE-2023-0687](https://nvd.nist.gov/vuln/detail/CVE-2023-0687) - [CVE-2022-3715](https://nvd.nist.gov/vuln/detail/CVE-2022-3715) |
| **494902472, 493902764, 493747531, 493747186, 493066364, 492956556, 492812098, 492810982, 492737291, 492733739, 492067214, 491191150, 490628133, 490627481, 490279890, 490278396, 489905507, 489904404, 477290192** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2026-24051](https://nvd.nist.gov/vuln/detail/CVE-2026-24051) - [CVE-2025-68119](https://nvd.nist.gov/vuln/detail/CVE-2025-68119) - [CVE-2025-61731](https://nvd.nist.gov/vuln/detail/CVE-2025-61731) - [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729) - [CVE-2025-61728](https://nvd.nist.gov/vuln/detail/CVE-2025-61728) - [CVE-2025-61726](https://nvd.nist.gov/vuln/detail/CVE-2025-61726) - [CVE-2025-61724](https://nvd.nist.gov/vuln/detail/CVE-2025-61724) - [CVE-2025-61723](https://nvd.nist.gov/vuln/detail/CVE-2025-61723) - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58186](https://nvd.nist.gov/vuln/detail/CVE-2025-58186) - [CVE-2025-58185](https://nvd.nist.gov/vuln/detail/CVE-2025-58185) |
| **494874583, 493352686, 493350530, 493065065, 492958506, 492958221, 492810419, 492734198, 492360831, 491606491, 491602959, 490628958, 490628720, 490625335, 489487288, 477290192** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerabilities: - [CVE-2025-61731](https://nvd.nist.gov/vuln/detail/CVE-2025-61731) - [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729) - [CVE-2025-61725](https://nvd.nist.gov/vuln/detail/CVE-2025-61725) - [CVE-2025-61724](https://nvd.nist.gov/vuln/detail/CVE-2025-61724) - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) - [CVE-2025-47912](https://nvd.nist.gov/vuln/detail/CVE-2025-47912) |
| **493904046, 493748763, 493353749, 492959837, 492959353, 492958532, 492734063, 492358967, 491163162, 489907974, 489494841, 477290192** | **Security fixes for `apigee-operators`.** This addresses the following vulnerabilities: - [CVE-2026-27139](https://nvd.nist.gov/vuln/detail/CVE-2026-27139) - [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729) - [CVE-2025-61728](https://nvd.nist.gov/vuln/detail/CVE-2025-61728) - [CVE-2025-61726](https://nvd.nist.gov/vuln/detail/CVE-2025-61726) - [CVE-2025-58181](https://nvd.nist.gov/vuln/detail/CVE-2025-58181) |
| **493940049, 493935866, 492812693, 492811208, 490847438, 490285784, 443494822, 430609333, 428036268, 428035602** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2026-22795](https://nvd.nist.gov/vuln/detail/CVE-2026-22795) - [CVE-2025-69419](https://nvd.nist.gov/vuln/detail/CVE-2025-69419) - [CVE-2025-69418](https://nvd.nist.gov/vuln/detail/CVE-2025-69418) - [CVE-2018-5709](https://nvd.nist.gov/vuln/detail/CVE-2018-5709) |
| **494873893, 492957899, 492811896, 492735230, 492734621, 492362013, 492358145, 492044636, 491192904, 491163716, 490628292, 490283689, 489908590, 489487798, 485998102, 482978613** | **Security fixes for `apigee-open-telemetry-collector`.** This addresses the following vulnerabilities: - [CVE-2025-68156](https://nvd.nist.gov/vuln/detail/CVE-2025-68156) - [CVE-2025-47913](https://nvd.nist.gov/vuln/detail/CVE-2025-47913) |
| **495206280, 492736206, 492358267, 491606961, 491603879, 490845184, 490842872, 490626346, 490625529, 490278258, 489155677** | **Security fixes for `apigee-udca`.** This addresses the following vulnerability: - [CVE-2026-25679](https://nvd.nist.gov/vuln/detail/CVE-2026-25679) |
| **492959491, 492959470, 492959266, 492812323, 492736535, 492736355, 492736200, 492734720, 492549333, 492528258, 492528186, 492361814, 492360845, 492359742, 492359020, 492039084, 490625473, 489488025, 489120498** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerability: - [CVE-2026-25679](https://nvd.nist.gov/vuln/detail/CVE-2026-25679) |
| **492959323, 492958717, 492813153, 492736850, 492736096, 492735265, 492360419, 492359937, 492359237, 492041473, 491604321, 491602140, 490847572, 490627493, 490282905, 489151338, 489127231** | **Security fixes for `apigee-redis`.** This addresses the following vulnerability: - [CVE-2025-61726](https://nvd.nist.gov/vuln/detail/CVE-2025-61726) |
| **492736867, 492735320, 492550947, 492549407, 492360316, 492359543, 492358244, 491608063, 491603446, 491169265, 490282128, 490278007, 490276323, 489127588, 489124394** | **Security fixes for `apigee-asm-ingress`.** This addresses the following vulnerability: - [CVE-2025-15558](https://nvd.nist.gov/vuln/detail/CVE-2025-15558) |
| **492956844, 492956300, 492812417, 492811007, 492810814, 492528300, 492361776, 492360457, 492360310, 492360053, 492358006, 492037890, 491606683, 489492294, 489152529** | **Security fixes for `apigee-asm-istiod`.** This addresses the following vulnerabilities: - [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729) |

## April 09, 2026

**Apigee X** Change **Relaxed limitation on header name for Client IP resolution**

The client IP can now be resolved from any header, not just the `X-Forwarded-For` header. The most common headers are `X-Forwarded-For` or `True-Client-Ip`.

For more information, see [Client IP resolution](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/client-ip-resolution.md.txt).

## April 06, 2026

**Apigee API hub** Feature **Agent Registry integration support for MCP metadata (Preview)**

API hub now includes a managed integration with Agent Registry to automatically synchronize Model Context Protocol (MCP) servers and tools metadata. This feature enables AI agents to discover and interact with the APIs registered in your hub without manual configuration.

This feature is in [Public Preview](https://cloud.google.com/products#product-launch-stages). For more information, see [Manage Agent Registry integration](https://docs.cloud.google.com/apigee/docs/apihub/manage-agent-registry-integration.md.txt).
**Apigee X** Fixed **Correction to [April 2, 2026 release note: Deployment disruption for Apigee Drupal Portal via Google Cloud Marketplace](https://docs.cloud.google.com/apigee/docs/release-notes.md.txt#April_02_2026)**

For the deployment disruption announced on April 2, the announcement noted that deployment and management functionality using Google Cloud Deployment Manager would definitely be unavailable during the transition. This statement is incorrect. The functionality *might* be unavailable.

See the [Known issue](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt#495305258) for more information.
Change On April 6th, 2026, we released an updated version of Apigee.

This change introduces the new `apigee.coreServiceAgent` IAM role for
Apigee. **Effective immediately, use `apigee.coreServiceAgent` instead of the
`apigee.serviceAgent` role.**

For information on the new role, see
[`apigee.coreServiceAgent`](https://docs.cloud.google.com/iam/docs/roles-permissions/apigee.md.txt#apigee.coreServiceAgent).

## April 02, 2026

**Apigee X** Breaking **Deployment disruption for Apigee Drupal Portal via Google Cloud Marketplace**

Google Cloud Deployment Manager was deprecated as of March 31, 2026. We are currently transitioning the Apigee Drupal Portal Marketplace solution to use Infrastructure Manager. During this transition period, some deployment and management functionalities are unavailable.

**Impact:**

- **New Deployments:** Starting April 1, 2026, attempting to deploy a new Apigee Drupal Portal instance using the "Deploy" button on the Google Cloud Marketplace will fail.
- **Existing Deployments:** Your underlying resources (such as VMs and Cloud SQL databases) are unaffected and will continue to run normally. However, you can no longer use Deployment Manager-based features to manage the deployment via the Marketplace UI or the `gcloud deployment-manager` tool.

**Workaround \& Resolution:**
Any configuration changes or management tasks must be performed directly on the individual Google Cloud resources (Compute Engine, Cloud SQL, etc.) rather than through the Marketplace UI.

We are actively working to release the updated Infrastructure Manager-based solution.

## March 31, 2026

**Apigee X** Announcement On March 31st, 2026, we released an updated version of Apigee.

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Feature **General Availability (GA) launch of Model Context Protocol (MCP) in Apigee**

With this release, Model Context Protocol (MCP) in Apigee is [generally available](https://docs.cloud.google.com/products#product-launch-stages), enabling you to expose your Apigee APIs as MCP tools to agentic applications.

Any MCP client that supports remote MCP endpoints over HTTP/S can access these tools. Because the endpoints are managed, you don't need to install or manage local MCP servers, remote MCP servers, or additional infrastructure to enable agentic applications to access your services.

MCP in Apigee is available for Subscription, Pay-as-you-go, and Evaluation organizations, including organizations with Data Residency and VPC Service Controls enabled.

For more information on using MCP in Apigee, see [MCP in Apigee overview](https://docs.cloud.google.com/apigee/docs/api-platform/apigee-mcp/apigee-mcp-overview.md.txt).
Feature **Enhanced OAS server URL path handling for MCP in Apigee**

With this feature enhancement, your OpenAPI specification (OAS) configurations behave exactly
as defined in the OAS standard, automatically combining the `server.url` base path value with individual operation paths.

For example, a server URL of`https://example.com/api/v1` paired with a path of `/users` will now correctly route to `https://example.com/api/v1/users` without additional manual intervention.

If you previously prepended base paths to your OAS paths entries, remove the path segment from your `servers.url` field to prevent
duplication. For example, change `https://example.com/api/v1` to `https://example.com`.

For more information, see [Create an OpenAPI 3.0 specification](https://docs.cloud.google.com/apigee/docs/api-platform/apigee-mcp/apigee-mcp-quickstart.md.txt#create-an-openapi-3.0.x-specification-describing-your-api-operations).
Change **Updated MCP server target endpoint for MCP Discovery Proxies**

With the GA launch of Model Context Protocol (MCP) in Apigee, the structure of the MCP server target endpoint for MCP Discover Proxies has changed to `ORG_NAME.mcp.apigee.internal`.

Private preview customers using the previous format (`mcp.apigee.internal`) are encouraged to update their proxies to reflect the new structure. Existing endpoints using the old format will continue to work, but new endpoints will use the new structure.
Issue **Known Issue 496552286: Deployment fails for MCP Discovery Proxies in regions with capacity limitations.**

For more information, see [Apigee known issues](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt).

## March 26, 2026

**Apigee X** Announcement On March 26th, 2026, we released an updated version of Apigee (1-17-0-apigee-6).

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Security

| Bug ID | Description |
|---|---|
| **495897297, 495909767** | **Security fix for Apigee infrastructure.** This addresses the following vulnerabilities: - [CVE-2026-33210](https://nvd.nist.gov/vuln/detail/CVE-2026-33210) - [CVE-2026-25679](https://nvd.nist.gov/vuln/detail/CVE-2026-25679) - [CVE-2026-27139](https://nvd.nist.gov/vuln/detail/CVE-2026-27139) - [CVE-2026-27142](https://nvd.nist.gov/vuln/detail/CVE-2026-27142) - [2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186) <br /> |

Fixed

| Bug ID | Description |
|---|---|
| **N/A** | **Updates to infrastructure and libraries.** |

## March 19, 2026

**Apigee X** Announcement On March 19th, 2026, we began maintenance updates of Apigee instances [configured for maintenance windows](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/maintenance-windows.md.txt).

If you set a preferred window for maintenance for your instance, and your instance version is
below **1-16-0-apigee-6** , your instance will be updated to **1-16-0-apigee-6** within the
next seven to 21 days. A notification containing the expected date of upgrade will be sent within the next two business days.

> [!NOTE]
> Note: Instances that meet either of the following two criteria will **not** be updated:
>
> - Your instance has a DNS misconfiguration, as described in [Known Issue 445936920](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt).
> - Your instance uses an Apigee Java Library that has been removed, as described in [Apigee release notes dated October 16, 2025](https://docs.cloud.google.com/apigee/docs/release/release-notes.md.txt#October_16_2025).

For more information on participating in scheduled maintenance windows, see [Maintenance overview](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/maintenance.md.txt) and [Manage Apigee instance maintenance windows](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/maintenance-windows.md.txt).

## March 17, 2026

**Apigee Advanced API Security** Announcement On March 17, 2026 we released an updated version of Advanced API Security
abuse detection
Feature **VPC-SC support in abuse detection**

This release includes full support in Advanced API Security abuse detection
for VPC-SC customers. This includes support for VPC-SC with the Advanced Anomaly
Detection ML model used for abuse detection, as well as detection exclusion
lists.

For usage information, see
[Abuse detection](https://docs.cloud.google.com/apigee/docs/api-security/abuse-detection.md.txt) in the
documentation.
**Apigee X** Announcement On March 17th, 2026, we released an updated version of Apigee (1-17-0-apigee-5).

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Fixed

| Bug ID | Description |
|---|---|
| **N/A** | **Updates to infrastructure and libraries.** |

## March 13, 2026

**Apigee UI** Announcement On March 13, 2026, we released an updated version of the Apigee UI.
Feature **Manage environment-scoped Key Value Maps in the Apigee UI**

You can now view, add, edit, and delete environment-scoped Key Value Map (KVM) entries in the Apigee UI.
For more information, see
[Using key value maps](https://docs.cloud.google.com/apigee/docs/api-platform/cache/key-value-maps.md.txt).

## March 12, 2026

**Apigee hybrid** v1.16.0 Announcement

### hybrid 1.16.0-hotfix.2

On March 12, 2026 we released Apigee hybrid 1.16.0-hotfix.2.

> [!IMPORTANT]
> **Important:** If your installation is already on Apigee hybrid v1.16.0, use the following procedure to apply this hotfix. For new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/big-picture.md.txt) and then apply the hotfix to the new installation with the following instructions.

#### Apply this hotfix with the following steps:

> [!NOTE]
> **Note:** This release reflects a change to both the component images and the Helm chart templates.

Apply this hotfix with the following steps:

1. In your hybrid Helm charts directory, download the Apigee hybrid 1.16.0-hotfix.2 Helm charts into your hybrid Helm charts directory with the following commands:

       export CHART_REPO=oci://us-docker.pkg.dev/apigee-release/apigee-hybrid-helm-charts
       export CHART_VERSION=1.16.0-hotfix.2
       helm pull $CHART_REPO/apigee-operator --version $CHART_VERSION --untar
       helm pull $CHART_REPO/apigee-datastore --version $CHART_VERSION --untar
       helm pull $CHART_REPO/apigee-env --version $CHART_VERSION --untar
       helm pull $CHART_REPO/apigee-ingress-manager --version $CHART_VERSION --untar
       helm pull $CHART_REPO/apigee-org --version $CHART_VERSION --untar
       helm pull $CHART_REPO/apigee-redis --version $CHART_VERSION --untar
       helm pull $CHART_REPO/apigee-telemetry --version $CHART_VERSION --untar
       helm pull $CHART_REPO/apigee-virtualhost --version $CHART_VERSION --untar

2. Install the hotfix release for Apigee operators, beginning with a dry run:

   ```
   helm upgrade operator apigee-operator/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     -f overrides.yaml \
     --dry-run=server
   ```
3. After the dry run is successful, install the hotfix release for Apigee operators:

   ```
   helm upgrade operator apigee-operator/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     -f overrides.yaml
   ```
4. Install the hotfix release for your organization, beginning with a dry run:

   ```
   helm upgrade $ORG_NAME apigee-org/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     -f overrides.yaml \
     --dry-run=server
   ```
5. After the dry run is successful, install the hotfix release for your organization:

   ```
   helm upgrade $ORG_NAME apigee-org/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     -f overrides.yaml
   ```
6. Verify the organization chart by checking the state:

   ```
   kubectl -n APIGEE_NAMESPACE get apigeeorg
   ```
7. Install the hotfix release for your environments. Repeat the following steps for each environment, beginning with a dry run:

   ```
   helm upgrade ENV_RELEASE_NAME apigee-env/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     --set env=$ENV_NAME \
     -f overrides.yaml \
     --dry-run=server
   ```
8. After the dry run is successful, install the hotfix release for your environment:

   ```
   helm upgrade ENV_RELEASE_NAME apigee-env/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     --set env=$ENV_NAME \
     -f overrides.yaml
   ```
9. Verify the environment chart by checking the state:

   ```
   kubectl -n APIGEE_NAMESPACE get apigeeenv
   ```
Fixed

#### Fixed in this release

| Bug ID | Description |
|---|---|
| **490308770** | **Fixed malformed `http_proxy` and `https_proxy` strings in Helm templates that occurred when using authenticated outbound proxy configurations.** |
| **488417252** | **Fixed an issue where the Apigee Operator guardrails pod failed to run on EKS with Workload Identity Federation (WIF) by ensuring it runs as the federated principal rather than the default service account.** |
| **485526221** | **Removed the deprecated `apigee-stackdriver-logging-agent` image from the `apigee-pull-push.sh` tool, resolving image pull failures during automated deployments.** |
| **484405364** | **Helm chart images with the `1.16.0-hotfix.2` tag are available for download.** |
| **482209901** | **Added the `watch` permission to the `apigee-manager` role to allow the controller to monitor Deployment resources and resolve watch failures in the namespace.** |
| **482077193** | **Fixed an issue where proxy chaining failed with HTTP 404 `route_not_found` errors in multi-organization, single-namespace configurations.** |
| **481793880** | **Fixed a bug in the `apigeeorg` admission webhook controller that prevented upgrading organizations when monetization was enabled.** |
| **479872706** | **Resolved an issue that prevented loading API products, apps, and developers after migrating data to Apigee hybrid 1.16.0 in configurations using Workload Identity Federation (WIF) with an HTTP Forward Proxy.** |
| **479040521** | **Resolved a regression where the `apigee-operator-guardrails-sa` ServiceAccount was not correctly created on AKS and EKS platforms with Federated Workload Identity enabled.** |

## March 11, 2026

**Apigee hybrid** v1.15.2 Announcement

### hybrid v1.15.2

On March 11, 2026 we released an updated version of the Apigee hybrid software, v1.15.2.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.15.2](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Fixed

#### Fixed in this release

| Bug ID | Description |
|---|---|
| **469694040** | **Fixed an issue where custom Java security policies were intermittently not applied during runtime pod restarts or environment contract updates, which could lead to "Permission denied" errors in Java callouts.** |

Security

| Bug ID | Description |
|---|---|
| **471502899, 471173561** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2025-48924](https://nvd.nist.gov/vuln/detail/CVE-2025-48924) - [CVE-2025-67735](https://nvd.nist.gov/vuln/detail/CVE-2025-67735) |
| **471502752, 471191392** | **Security fixes for `apigee-runtime`.** This addresses the following vulnerabilities: - [CVE-2025-48924](https://nvd.nist.gov/vuln/detail/CVE-2025-48924) - [CVE-2025-67735](https://nvd.nist.gov/vuln/detail/CVE-2025-67735) |
| **471502495, 471501875, 471126425** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerabilities: - [CVE-2025-48924](https://nvd.nist.gov/vuln/detail/CVE-2025-48924) - [CVE-2025-67735](https://nvd.nist.gov/vuln/detail/CVE-2025-67735) |
| **471016560, 471015664, 471015120** | **Security fixes for `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2022-40897](https://nvd.nist.gov/vuln/detail/CVE-2022-40897) - [CVE-2025-47273](https://nvd.nist.gov/vuln/detail/CVE-2025-47273) - [CVE-2025-48924](https://nvd.nist.gov/vuln/detail/CVE-2025-48924) |
| **451224723, 451224123** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2010-4756](https://nvd.nist.gov/vuln/detail/CVE-2010-4756) - [CVE-2011-3389](https://nvd.nist.gov/vuln/detail/CVE-2011-3389) - [CVE-2013-4392](https://nvd.nist.gov/vuln/detail/CVE-2013-4392) - [CVE-2015-3276](https://nvd.nist.gov/vuln/detail/CVE-2015-3276) - [CVE-2017-14159](https://nvd.nist.gov/vuln/detail/CVE-2017-14159) - [CVE-2017-17740](https://nvd.nist.gov/vuln/detail/CVE-2017-17740) - [CVE-2018-20796](https://nvd.nist.gov/vuln/detail/CVE-2018-20796) - [CVE-2018-5709](https://nvd.nist.gov/vuln/detail/CVE-2018-5709) - [CVE-2018-6829](https://nvd.nist.gov/vuln/detail/CVE-2018-6829) - [CVE-2019-1010022](https://nvd.nist.gov/vuln/detail/CVE-2019-1010022) - [CVE-2019-1010023](https://nvd.nist.gov/vuln/detail/CVE-2019-1010023) - [CVE-2019-1010024](https://nvd.nist.gov/vuln/detail/CVE-2019-1010024) - [CVE-2019-1010025](https://nvd.nist.gov/vuln/detail/CVE-2019-1010025) - [CVE-2019-9192](https://nvd.nist.gov/vuln/detail/CVE-2019-9192) - [CVE-2020-15719](https://nvd.nist.gov/vuln/detail/CVE-2020-15719) - [CVE-2022-27943](https://nvd.nist.gov/vuln/detail/CVE-2022-27943) - [CVE-2023-2953](https://nvd.nist.gov/vuln/detail/CVE-2023-2953) - [CVE-2023-31437](https://nvd.nist.gov/vuln/detail/CVE-2023-31437) - [CVE-2023-31438](https://nvd.nist.gov/vuln/detail/CVE-2023-31438) - [CVE-2023-31439](https://nvd.nist.gov/vuln/detail/CVE-2023-31439) - [CVE-2023-45853](https://nvd.nist.gov/vuln/detail/CVE-2023-45853) - [CVE-2024-2236](https://nvd.nist.gov/vuln/detail/CVE-2024-2236) - [CVE-2024-2379](https://nvd.nist.gov/vuln/detail/CVE-2024-2379) - [CVE-2024-26458](https://nvd.nist.gov/vuln/detail/CVE-2024-26458) - [CVE-2024-26461](https://nvd.nist.gov/vuln/detail/CVE-2024-26461) - [CVE-2025-0725](https://nvd.nist.gov/vuln/detail/CVE-2025-0725) - [CVE-2025-10148](https://nvd.nist.gov/vuln/detail/CVE-2025-10148) - [CVE-2025-27587](https://nvd.nist.gov/vuln/detail/CVE-2025-27587) - [CVE-2025-62813](https://nvd.nist.gov/vuln/detail/CVE-2025-62813) - [CVE-2025-9086](https://nvd.nist.gov/vuln/detail/CVE-2025-9086) - [CVE-2025-9230](https://nvd.nist.gov/vuln/detail/CVE-2025-9230) - [CVE-2025-9232](https://nvd.nist.gov/vuln/detail/CVE-2025-9232) |
| **N/A** | **Security fixes for `apigee-asm-ingress`.** This addresses the following vulnerability: - [CVE-2026-24051](https://nvd.nist.gov/vuln/detail/CVE-2026-24051) |
| **N/A** | **Security fixes for `apigee-asm-istiod`.** This addresses the following vulnerability: - [CVE-2026-24051](https://nvd.nist.gov/vuln/detail/CVE-2026-24051) |
| **N/A** | **Security fixes for `apigee-connect-agent`.** This addresses the following vulnerabilities: - [CVE-2025-68121](https://nvd.nist.gov/vuln/detail/CVE-2025-68121) - [CVE-2025-68119](https://nvd.nist.gov/vuln/detail/CVE-2025-68119) - [CVE-2025-61732](https://nvd.nist.gov/vuln/detail/CVE-2025-61732) - [CVE-2025-61731](https://nvd.nist.gov/vuln/detail/CVE-2025-61731) - [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729) - [CVE-2025-61726](https://nvd.nist.gov/vuln/detail/CVE-2025-61726) - [CVE-2025-4674](https://nvd.nist.gov/vuln/detail/CVE-2025-4674) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** This addresses the following vulnerabilities: - [CVE-2026-24051](https://nvd.nist.gov/vuln/detail/CVE-2026-24051) - [CVE-2025-68121](https://nvd.nist.gov/vuln/detail/CVE-2025-68121) - [CVE-2025-68119](https://nvd.nist.gov/vuln/detail/CVE-2025-68119) - [CVE-2025-61732](https://nvd.nist.gov/vuln/detail/CVE-2025-61732) - [CVE-2025-61731](https://nvd.nist.gov/vuln/detail/CVE-2025-61731) - [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729) - [CVE-2025-61726](https://nvd.nist.gov/vuln/detail/CVE-2025-61726) - [CVE-2025-61725](https://nvd.nist.gov/vuln/detail/CVE-2025-61725) - [CVE-2025-61723](https://nvd.nist.gov/vuln/detail/CVE-2025-61723) - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) - [CVE-2025-47907](https://nvd.nist.gov/vuln/detail/CVE-2025-47907) - [CVE-2025-4674](https://nvd.nist.gov/vuln/detail/CVE-2025-4674) |
| **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729) - [CVE-2025-61725](https://nvd.nist.gov/vuln/detail/CVE-2025-61725) - [CVE-2025-61723](https://nvd.nist.gov/vuln/detail/CVE-2025-61723) - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) - [CVE-2026-24051](https://nvd.nist.gov/vuln/detail/CVE-2026-24051) |
| **N/A** | **Security fixes for `apigee-open-telemetry-collector`.** This addresses the following vulnerabilities: - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) - [CVE-2026-24051](https://nvd.nist.gov/vuln/detail/CVE-2026-24051) - [CVE-2025-68156](https://nvd.nist.gov/vuln/detail/CVE-2025-68156) - [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729) - [CVE-2025-4674](https://nvd.nist.gov/vuln/detail/CVE-2025-4674) - [CVE-2025-29786](https://nvd.nist.gov/vuln/detail/CVE-2025-29786) |
| **N/A** | **Security fixes for `apigee-open-telemetry-collector:`.** This addresses the following vulnerability: - [CVE-2025-29786](https://nvd.nist.gov/vuln/detail/CVE-2025-29786) |
| **N/A** | **Security fixes for `apigee-operators`.** This addresses the following vulnerability: - [CVE-2025-61725](https://nvd.nist.gov/vuln/detail/CVE-2025-61725) |
| **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) - [CVE-2026-24051](https://nvd.nist.gov/vuln/detail/CVE-2026-24051) - [CVE-2025-68119](https://nvd.nist.gov/vuln/detail/CVE-2025-68119) - [CVE-2025-61731](https://nvd.nist.gov/vuln/detail/CVE-2025-61731) - [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729) - [CVE-2025-61726](https://nvd.nist.gov/vuln/detail/CVE-2025-61726) - [CVE-2025-47913](https://nvd.nist.gov/vuln/detail/CVE-2025-47913) - [CVE-2025-4674](https://nvd.nist.gov/vuln/detail/CVE-2025-4674) |
| **N/A** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerabilities: - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) - [CVE-2026-24051](https://nvd.nist.gov/vuln/detail/CVE-2026-24051) - [CVE-2025-68119](https://nvd.nist.gov/vuln/detail/CVE-2025-68119) - [CVE-2025-61731](https://nvd.nist.gov/vuln/detail/CVE-2025-61731) - [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729) - [CVE-2025-61726](https://nvd.nist.gov/vuln/detail/CVE-2025-61726) - [CVE-2025-4674](https://nvd.nist.gov/vuln/detail/CVE-2025-4674) |
| **N/A** | **Security fixes for `apigee-redis`.** This addresses the following vulnerabilities: - [CVE-2025-68121](https://nvd.nist.gov/vuln/detail/CVE-2025-68121) - [CVE-2025-68119](https://nvd.nist.gov/vuln/detail/CVE-2025-68119) - [CVE-2025-61732](https://nvd.nist.gov/vuln/detail/CVE-2025-61732) - [CVE-2025-61731](https://nvd.nist.gov/vuln/detail/CVE-2025-61731) - [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729) - [CVE-2025-61726](https://nvd.nist.gov/vuln/detail/CVE-2025-61726) - [CVE-2025-61725](https://nvd.nist.gov/vuln/detail/CVE-2025-61725) - [CVE-2025-61723](https://nvd.nist.gov/vuln/detail/CVE-2025-61723) - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) - [CVE-2025-47907](https://nvd.nist.gov/vuln/detail/CVE-2025-47907) - [CVE-2025-4674](https://nvd.nist.gov/vuln/detail/CVE-2025-4674) |
| **N/A** | **Security fixes for `apigee-stackdriver-logging-agent`.** This addresses the following vulnerabilities: - [CVE-2025-61594](https://nvd.nist.gov/vuln/detail/CVE-2025-61594) - [CVE-2025-24294](https://nvd.nist.gov/vuln/detail/CVE-2025-24294) |
| **N/A** | **Security fixes for `apigee-udca`.** This addresses the following vulnerabilities: - [CVE-2026-24051](https://nvd.nist.gov/vuln/detail/CVE-2026-24051) - [CVE-2025-68121](https://nvd.nist.gov/vuln/detail/CVE-2025-68121) - [CVE-2025-68119](https://nvd.nist.gov/vuln/detail/CVE-2025-68119) - [CVE-2025-61732](https://nvd.nist.gov/vuln/detail/CVE-2025-61732) - [CVE-2025-61731](https://nvd.nist.gov/vuln/detail/CVE-2025-61731) - [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729) - [CVE-2025-61726](https://nvd.nist.gov/vuln/detail/CVE-2025-61726) - [CVE-2025-61725](https://nvd.nist.gov/vuln/detail/CVE-2025-61725) - [CVE-2025-61723](https://nvd.nist.gov/vuln/detail/CVE-2025-61723) - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) - [CVE-2025-47907](https://nvd.nist.gov/vuln/detail/CVE-2025-47907) |

## March 10, 2026

**Apigee API hub** Feature **Security monitoring condition support in Advanced API Security for multi-gateway projects**

Advanced API Security's multi-gateway Risk Assessment feature (available through
API hub) now includes support for security monitoring conditions and alerts.

Security monitoring conditions allow you to map resources (gateways) to security profiles.
Cloud Monitoring can then use this mapping to create dedicated dashboards to track security scores over time and alert based on metric levels.

For information on monitoring conditions features and usage see [Manage monitoring conditions for multiple Apigee organizations and gateways](https://docs.cloud.google.com/apigee/docs/apihub/manage-monitoring-conditions-multi-gateway.md.txt).

> [!NOTE]
> **Note:** Rollouts of this release to production instances might take up to 5 business days to complete across all Google Cloud zones. Your instances might not have the feature available until the rollout is complete.

Feature **Support for Apigee Edge Private Cloud (OPDK) in Advanced API Security for multi-gateway projects**

API hub Advanced API Security for multi-gateway now includes support for the OPDK
gateway type for risk assessment security profiles.

For information on risk assessment custom security profiles and gateway specification, see [Create a security profile](https://docs.cloud.google.com/apigee/docs/apihub/manage-security-profiles-multi-gateway.md.txt#create-a-security-profile).

> [!NOTE]
> **Note:** Rollouts of this release to production instances might take up to 5 business days to complete across all Google Cloud zones. Your instances might not have the feature available until the rollout is complete.

**Apigee Advanced API Security** Announcement On March 10, 2026 we released an updated version of Advanced API Security Abuse Detection
Feature **General availability of monitoring conditions in risk assessment v2**

Starting with this release, the risk assessment v2 monitoring conditions feature is generally available.

For information on monitoring conditions features and usage see [monitoring conditions and alerts](https://docs.cloud.google.com/apigee/docs/api-security/security-scores.md.txt#monitoring-conditions). For usage information and a list of all features in Risk Assessment v2, see the [Risk Assessment v2 customer documentation](https://docs.cloud.google.com/apigee/docs/api-security/security-scores.md.txt#risk-assessment-v2).
**Apigee X** Announcement On March 10th, 2026, we released an updated version of Apigee (1-17-0-apigee-4).

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Fixed

| Bug ID | Description |
|---|---|
| **N/A** | **Updates to infrastructure and libraries.** |

Security

| Bug ID | Description |
|---|---|
| **483769763, 481735779** | **Security fix for Apigee infrastructure.** This addresses the following vulnerabilities: - [CVE-2025-61726](https://nvd.nist.gov/vuln/detail/CVE-2025-61726) - [CVE-2025-61728](https://nvd.nist.gov/vuln/detail/CVE-2025-61728) - [CVE-2025-61730](https://nvd.nist.gov/vuln/detail/CVE-2025-61730) - [CVE-2025-61731](https://nvd.nist.gov/vuln/detail/CVE-2025-61731) - [CVE-2025-61732](https://nvd.nist.gov/vuln/detail/CVE-2025-61732) - [CVE-2026-24051](https://nvd.nist.gov/vuln/detail/CVE-2026-24051) - [CVE-2026-25765](https://nvd.nist.gov/vuln/detail/CVE-2026-25765) <br /> |

## March 05, 2026

**Apigee Integrated Portal** Announcement On March 5, 2026 we released a new version of the Apigee integrated portal.
Feature You can now publish APIs using AsyncAPI documents to render documentation for asynchronous APIs in your portal. For more information, see [Publishing your APIs](https://docs.cloud.google.com/apigee/docs/api-platform/publish/portal/publish-apis.md.txt#what-published).

## March 04, 2026

**Apigee API hub** Feature **gcloud CLI support for API hub**

The `gcloud CLI` now supports Apigee API hub, allowing you to manage your organization's API catalog, versions, and lifecycle metadata directly from the command line.

For more information see [gcloud CLI for API hub](https://docs.cloud.google.com/apigee/docs/apihub/gcloud-cli-apihub.md.txt).

## February 24, 2026

**Apigee X** Announcement On February 24th, 2026, we released an updated version of Apigee (1-17-0-apigee-3).

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Fixed

| Bug ID | Description |
|---|---|
| **470375542** | Fixed a memory leak which could result in a spike in 503 responses with `no_healthy_upstream` messages. |
| **480997525** | Applied a fix for proxy calls failing with `The URI contains illegal characters` error after Netty upgrade. |
| **485595627** | Fixed an issue resulting in TLS handshake errors. |

Security

| Bug ID | Description |
|---|---|
| **481735779, 457138941, 471232237** | **Security fix for Apigee infrastructure.** This addresses the following vulnerabilities: - [CVE-2025-61730](https://nvd.nist.gov/vuln/detail/CVE-2025-61730) - [CVE-2025-68156](https://nvd.nist.gov/vuln/detail/CVE-2025-68156) - [CVE-2025-54388](https://nvd.nist.gov/vuln/detail/CVE-2025-54388) - [CVE-2025-61727](https://nvd.nist.gov/vuln/detail/CVE-2025-61727) - [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729) <br /> |

## February 23, 2026

**Apigee API hub** Feature **Preview release of specification boost**

API hub now supports the preview release of specification boost, an AI-powered
add-on that lets you automatically enhance the readability and discoverability
of your API specifications in API hub. It analyzes your existing specification
files and generates boosted versions enriched with richer details, including
additional examples, clearer descriptions, better error documentation, and more.

For more information see [Specification boost add-on](https://docs.cloud.google.com/apigee/docs/apihub/spec-boost.md.txt).

> [!NOTE]
> **Note:** Rollouts of this release to production instances might take up to 5 business days to complete across all Google Cloud zones. Your instances might not have the feature available until the rollout is complete.

## February 13, 2026

**Apigee UI** Announcement On February 13, 2026, we released an updated version of the Apigee UI.
Change Updated the route for Operations Anomalies from `apigee/analytics/operations-anomalies` to `apigee/aapi-ops/operations-anomalies`.
**Apigee X** Announcement On February 13, 2026, we published a security bulletin for Apigee.
Security A vulnerability was identified in the Apigee platform ([CVE-2025-13292](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13292)) that could have allowed a malicious actor with administrative or developer-level permissions in their own Apigee environment to elevate privileges and access cross-tenant data.

**Security bulletin published: [GCP-2026-010](https://docs.cloud.google.com/apigee/docs/security-bulletins/security-bulletins.md.txt#gcp-2026-010)**

## February 10, 2026

**Apigee X** Announcement

> [!NOTE]
> **Note:** This release was rolled back to address an issue. See the entry for [February 24th, 2026](https://docs.cloud.google.com/apigee/docs/release-notes.md.txt#February_24_2026) for the updated version number and payload.

On February 10, 2026, we released an updated version of Apigee (1-17-0-apigee-2).

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Security

> [!NOTE]
> **Note:** This note is incorrect - these security fixes, including the removal of support for the `TLS_RSA` cipher suites, were rolled back. See the entry for [February 24th, 2026](https://docs.cloud.google.com/apigee/docs/release-notes.md.txt#February_24_2026) for the updated version number and payload.

| Bug ID | Description |
|---|---|
| **481735779, 457138941, 471232237** | **Security fix for Apigee infrastructure.** This addresses the following vulnerabilities: - [CVE-2025-61730](https://nvd.nist.gov/vuln/detail/CVE-2025-61730) - [CVE-2025-68156](https://nvd.nist.gov/vuln/detail/CVE-2025-68156) - [CVE-2025-54388](https://nvd.nist.gov/vuln/detail/CVE-2025-54388) - [CVE-2025-61727](https://nvd.nist.gov/vuln/detail/CVE-2025-61727) - [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729) <br /> |
| **470375542** | Fixed a memory leak which could result in a spike in 503 responses with `no_healthy_upstream` messages. |
| **480997525** | Applied a fix for proxy calls failing with `The URI contains illegal characters` error after Netty upgrade. |
| **485543125** | Apigee no longer supports the following `TLS_RSA` cipher suites: - `TLS_RSA_WITH_AES_256_GCM_SHA384` - `TLS_RSA_WITH_AES_128_GCM_SHA256` - `TLS_RSA_WITH_AES_256_CBC_SHA256` - `TLS_RSA_WITH_AES_128_CBC_SHA256` - `TLS_RSA_WITH_AES_256_CBC_SHA` - `TLS_RSA_WITH_AES_128_CBC_SHA` |

## February 06, 2026

**Apigee X** Announcement On February 6th, 2026, we released an updated version of Apigee.

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Security

| Bug ID | Description |
|---|---|
| **477294854, 477297075, 477297324, 470988850, 471662549** | **Security fix for Apigee infrastructure.** This addresses the following vulnerabilities: - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) - [CVE-2025-61723](https://nvd.nist.gov/vuln/detail/CVE-2025-61723) - [CVE-2025-61725](https://nvd.nist.gov/vuln/detail/CVE-2025-61725) - [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729) - [CVE-2025-61727](https://nvd.nist.gov/vuln/detail/CVE-2025-61727) <br /> |

**Apigee hybrid** 1.16.0-hotfix.1 Announcement

### hybrid 1.16.0-hotfix.1

On February 6, 2026 we released Apigee hybrid 1.16.0-hotfix.1.

> [!IMPORTANT]
> **Important:** If your installation is already on Apigee hybrid v1.16.0, use the following procedure to apply this hotfix. For new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/big-picture.md.txt) and then apply the hotfix to the new installation with the following instructions.

#### Apply this hotfix with the following steps:

> [!NOTE]
> **Note:** This hotfix installs the `apigee-mart-server` container images. All other container images are unchanged from Hybrid v1.16.0.

1. In your overrides file, update the `image.url` and `image.tag` properties of `ao` and `mart` to version `1.16.0-hotfix.1`:

   ```
   ao:
     image:
       url: "gcr.io/apigee-release/hybrid/apigee-operators"
       tag: "1.16.0-hotfix.1"
   mart:
     image:
       url: "gcr.io/apigee-release/hybrid/apigee-mart-server"
       tag: "1.16.0-hotfix.1"
   ```
2. Install the hotfix release for Apigee operators, beginning with a dry run:

   ```
   helm upgrade operator apigee-operator/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     -f overrides.yaml \
     --dry-run=server
   ```
3. If the dry run is successful, install the hotfix release for Apigee operators:

   ```
   helm upgrade operator apigee-operator/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     -f overrides.yaml
   ```
4. Install the hotfix release for your organization, beginning with a dry run:

   ```
   helm upgrade $ORG_NAME apigee-org/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     -f overrides.yaml \
     --dry-run=server
   ```
5. If the dry run is successful, install the hotfix release for your organization:

   ```
   helm upgrade $ORG_NAME apigee-org/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     -f overrides.yaml
   ```
6. Verify the organization chart by checking the state:

   ```
   kubectl -n APIGEE_NAMESPACE get apigeeorg
   ```
7. Install the hotfix release for your environment, beginning with a dry run:

   ```
   helm upgrade ENV_RELEASE_NAME apigee-env/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     --set env=$ENV_NAME \
     -f overrides.yaml \
     --dry-run=server
   ```
8. If the dry run is successful, install the hotfix release for your environment:

   ```
   helm upgrade ENV_RELEASE_NAME apigee-env/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     --set env=$ENV_NAME \
     -f overrides.yaml
   ```
9. Verify the environment chart by checking the state:

   ```
   kubectl -n APIGEE_NAMESPACE get apigeeenv
   ```
Fixed

#### Fixed in this release

| Bug ID | Description |
|---|---|
| **479872706** | **An issue that prevented loading API products, apps, and developers after migrating data to Apigee hybrid 1.16.0 in certain configurations has been resolved.** |
| **481793880** | **An issue that prevented upgrading an existing organization when monetization was enabled has been fixed.** |

## February 03, 2026

**Apigee Advanced API Security** Announcement On February 3, 2026 we released an updated version of Advanced API Security
security actions
Feature **Support for configuring two condition types within a single security action**
Announcing the availability of support for two condition types
in a single security action. For example, you can include both IP addresses and
ASN numbers in the same security action.

This feature is available in Apigee and Apigee hybrid 1.16.0 and later.

**Note:** This feature is available when configuring the security action
via the API, not the UI, at this time.

For usage information, see [Configure multiple condition types](https://docs.cloud.google.com/apigee/docs/api-security/security-actions-api.md.txt#configure-multiple-condition-types) in the documentation.

## February 02, 2026

**Apigee X** Issue **Known Issue:** [480997525 - Proxy calls fail with `The URI contains illegal characters` error after Netty upgrade](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt#480997525)

## January 27, 2026

**Apigee UI** Announcement On January 27, 2026, we released an updated version of the Apigee UI.
Fixed **Show all rows in the Debug properties panel**

Fixed an issue where only the first 50 rows were displayed in the Debug
properties panel, including the variables tab. The Debug properties table now
displays up to 200 rows per page by default. Pagination controls are displayed
if the total number of rows exceeds 200.

## January 21, 2026

**Apigee X** Announcement On January 21st, 2026, we released an updated version of Apigee (1-17-0-apigee-1).

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Security

| Bug ID | Description |
|---|---|
| **471001896, 469829527, 470953822, 462478248, 474415498** | **Security fix for Apigee infrastructure.** This addresses the following vulnerabilities: - [CVE-2025-68161](https://nvd.nist.gov/vuln/detail/CVE-2025-68161) - [CVE-2025-67735](https://nvd.nist.gov/vuln/detail/CVE-2025-67735) - [CVE-2025-47914](https://nvd.nist.gov/vuln/detail/CVE-2025-47914) - [CVE-2025-58181](https://nvd.nist.gov/vuln/detail/CVE-2025-58181) - [CVE-2025-58767](https://nvd.nist.gov/vuln/detail/CVE-2025-58767) - [CVE-2025-4802](https://nvd.nist.gov/vuln/detail/CVE-2025-4802) - [CVE-2025-8058](https://nvd.nist.gov/vuln/detail/CVE-2025-8058) - [CVE-2025-61727](https://nvd.nist.gov/vuln/detail/CVE-2025-61727) - [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729) - [CVE-2025-22868](https://nvd.nist.gov/vuln/detail/CVE-2025-22868) - [CVE-2025-22869](https://nvd.nist.gov/vuln/detail/CVE-2025-22869) - [CVE-2025-22870](https://nvd.nist.gov/vuln/detail/CVE-2025-22870) - [CVE-2025-22872](https://nvd.nist.gov/vuln/detail/CVE-2025-22872) <br /> |

Fixed

| Bug ID | Description |
|---|---|
| **433999957** | **Implemented full TLS validation when fetching JWKS from remote URIs** |
| **467762922** | **Quota enforcement logic for Server-Sent Events (SSE) updated** Quotas for SSE are now calculated strictly for events containing explicit token counts. The quota enforcement logic skips SSE that lack token usage metadata. |
| **N/A** | **Updates to security, infrastructure, and libraries.** |

## January 20, 2026

**Apigee UI** Deprecated **Debug v1 turndown**

As of January 20, 2026, Debug v1 has been turned down and is no longer
available. Please use
[Debug v2](https://docs.cloud.google.com/apigee/docs/api-platform/debug/trace.md.txt)
(now referred to as Debug) for debugging API proxies.

## January 12, 2026

**Apigee API hub** Feature **Ingest API Gateway metadata into API hub**

API hub now supports automatic metadata ingestion from [Google Cloud API Gateway](https://docs.cloud.google.com/api-gateway/docs/about-api-gateway.md.txt). You can now [attach](https://docs.cloud.google.com/apigee/docs/apihub/auto-register-apigee-proxies#attach-a-runtime-project) your API Gateway projects to API hub to enable auto-ingestion for all your APIs. For more information see [Centralize API management using API hub](https://docs.cloud.google.com/api-gateway/docs/api-hub-overview.md.txt).

> [!NOTE]
> **Note:** Rollouts of this release to production instances might take up to 5 business days to complete across all Google Cloud zones. Your instances might not have the feature available until the rollout is complete.

**Apigee Advanced API Security** Announcement On January 12, 2026 we released an updated version of Advanced API Security Abuse Detection
Feature **Introduction of Terraform support for managing Advanced API Security abuse detection exclusion lists**

You can now use Terraform to manage Advanced API Security abuse detection
exclusion lists. The feedback feature allows you to specify CIDR ranges and IP
addresses to exclude from future incident reports, and is used to exclude
traffic known to be safe, such as requests related to automated testing.

**Note:** Exclusion lists are not available for VPC-SC customers at this time.

For usage information, see
[Exclude traffic from abuse detection](https://docs.cloud.google.com/apigee/docs/api-security/abuse-detection.md.txt#exclude-traffic-from-abuse-detection)
and [Use Terraform in Apigee](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/terraform-overview.md.txt)
in the Apigee documentation and the
[Terraform abuse detection feedback (exclusion lists) instructions](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/apigee_security_feedback).
**Apigee UI** Announcement On January 12, 2026, we released an updated version of the Apigee UI.
Feature **Manage environment-level resources in the Apigee UI**

You can now manage environment-level resources using the Apigee UI.
Previously, environment-level resources could only be managed using the API.
For more information, see
[Managing resources](https://docs.cloud.google.com/apigee/docs/api-platform/develop/resource-files.md.txt#ui-env).

## January 07, 2026

**Apigee Operator for kubernetes** Announcement On January 7, 2026, we released an updated version of Apigee.
Feature **The Apigee Operator for Kubernetes version 1.1.1 is now available.**
Security

| Bug ID | Description |
|---|---|
| **471150886, 471150271, 471150102, 426783172** | **Security fixes for the Apigee Operator for Kubernetes.** This addresses the following vulnerabilities: - [CVE-2025-55163](https://nvd.nist.gov/vuln/detail/CVE-2025-55163) - [CVE-2025-67735](https://nvd.nist.gov/vuln/detail/CVE-2025-67735) - [CVE-2025-58057](https://nvd.nist.gov/vuln/detail/CVE-2025-58057) - [CVE-2025-58056](https://nvd.nist.gov/vuln/detail/CVE-2024-58056) <br /> |

## December 29, 2025

**Apigee X** Announcement On December 29th, 2025, we released an updated version of Apigee.

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Feature **The Apigee Extension Processor provisioning API is available**

Apigee Extension Processor customers can now use the Extension Processor provisioning API to create traffic extensions.
For more information, see [Get started with the Apigee Extension Processor](https://docs.cloud.google.com/apigee/docs/api-platform/service-extensions/extension-processor-quickstart.md.txt#create-traffic-ext)

## December 23, 2025

**Apigee X** Announcement On December 23, 2025, we released an updated version of Apigee.

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Feature **New Apigee policies for LLM Token Management are now Generally Available (GA)**

Two new Apigee policies for managing Large Language Model (LLM) workloads are now Generally Available (GA). These policies provide fine-grained control and rate-limiting for AI application traffic as follows:

- **LLMTokenQuota policy**
  - This policy monitors and enforces limits on **LLM response token usage** to control overall LLM expenditure and resource allocation.
  - It can be configured with `<CountOnly>` (placed in the response flow to track tokens consumed) or `<EnforceOnly>` (placed in the request flow to block calls if the quota is exceeded).
  - If the quota is reached, Apigee returns an `HTTP 429` (Too Many Requests) status code.
  - For more information, see [LLMTokenQuota Policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/llm-token-quota-policy.md.txt).
- **PromptTokenLimit policy**
  - This policy provides a token-based rate-limiting mechanism analogous to the SpikeArrest policy, specifically for the tokens consumed by the user's prompt message.
  - It calculates the prompt's token count using the widely adopted `o200k_base` encoding technique.
  - If the configured token rate limit is exceeded, the incoming request is blocked, returning an `HTTP 429` (Too Many Requests) status code.
  - For more information, see [PromptTokenLimit policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/prompt-token-limit-policy.md.txt).

**Related documents:**

- [Get started with Apigee AI token policies](https://docs.cloud.google.com/apigee/docs/api-platform/tutorials/using-ai-token-policies.md.txt)
- [Rate-limiting](https://docs.cloud.google.com/apigee/docs/api-platform/develop/rate-limiting.md.txt)
- [Comparing rate-limiting policies](https://docs.cloud.google.com/apigee/docs/api-platform/develop/comparing-quota-and-spike-arrest-policies.md.txt)
- [Managing API products](https://docs.cloud.google.com/apigee/docs/api-platform/publish/create-api-products.md.txt)
- [LLMTokenQuota policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/llm-token-quota-policy.md.txt)
- [PromptTokenLimit policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/prompt-token-limit-policy.md.txt)

## December 19, 2025

**Apigee Monetization** Announcement On December 19, 2025, we released an updated version of Apigee Monetization.

> [!NOTE]
> **Note:** Rollouts of this release to production instances have begun. Rollout may take four or more business days to complete across all Google Cloud zones. Your instances may not have the feature available until the rollout is complete.

Feature Monetization now supports AppGroups. Use AppGroups to manage API product
subscriptions for all app developers in the AppGroup at the same time.

For more information, see
[Use AppGroups to manage API product subscriptions](https://cloud.google.com/apigee/docs/api-platform/monetization/overview#use-appgroups-to-manage-api-product-subscriptions).
**Apigee hybrid** v1.16.0 Announcement

### hybrid v1.16.0

On December 19, 2025 we released an updated version of the Apigee hybrid software, 1.16.0.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.16](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a minor release: The container images used in minor releases are integrated with the Apigee hybrid Helm charts. Upgrading to a minor via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Feature **Seccomp Profiles**

Apigee Hybrid now offers the capability to apply Seccomp Profiles to your runtime components, significantly enhancing the security posture of your deployment.

This feature allows Apigee administrators and security teams to restrict the system calls (syscalls) a containerized process can make to the host's kernel. By limiting a container to only the necessary syscalls, you can:

- Enhance Security: Mitigate the risk of container breakouts and privilege escalation.
- Enforce Least Privilege: Ensure components only have access to the exact system calls required for their operation.
- Meet Compliance: Provide a critical control for meeting stringent security compliance requirements.

Seccomp profiles are not enabled by default. To enable the feature, see [Configure Seccomp profiles for pod security](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/configure-seccomp-profiles.md.txt).
Feature **`apigee-guardrails` service account**

In v1.16.0, Apigee Hybrid introduces an `apigee-guardrails` Google IAM service account. This is used by the `apigee-operator` chart during initial installation to check that all needed APIs are enabled in your project.

> [!NOTE]
> **Note:** The `apigee-guardrails` service account is required for both upgraded and new installations. See [Upgrading to Apigee hybrid to version 1.16: Set up the `apigee-guardrails` service account](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/upgrade.md.txt#set-up-the-apigee-guardrails-service-account) for upgrade instructions.

See:

- [Diagnosing issues with guardrails](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/guardrails.md.txt)
- [About service accounts: `apigee-guardrails`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/sa-about.md.txt#apigee-guardrails)
- [`create-service-account`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/create-service-account.md.txt)
- [Upgrading to Apigee hybrid to version 1.16](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/upgrade.md.txt#changes-from-previous-version)
- [Installation Part 2: Step 4: Create service accounts](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/install-service-accounts.md.txt)
- [Installation Part 2: Step 5: Set up service account authentication](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/install-sa-authentication.md.txt)
Change **UDCA component removed**

In Apigee hybrid v1.16, the Unified Data Collection Agent (UDCA) component has been removed. The responsibilities of sending analytics, trace, and deployment status data to the Apigee control plane are now handled using a [Google Cloud Pub/Sub](https://docs.cloud.google.com/pubsub/docs.md.txt) based data pipeline. Using the Pub/Sub based data pipeline has been the default data collection mechanism since [Apigee hybrid v1.14.0](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1140).
Change **Support for cert-manager release 1.18 and 1.19**

Apigee hybrid v1.16 supports cert-manager release 1.18 and 1.19.

> [!NOTE]
> **Note:** cert-manager release 1.18 introduces a change to the default certificate `Spec.PrivateKey.RotationPolicy` value that can impact traffic on upgraded Apigee hybrid installations. This does not affect new installations of Apigee Hybrid. See [Known issue 465834046](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt#465834046).

Fixed

#### Fixed in this release

| Bug ID | Description |
|---|---|
| **448647917** | **Fixed a issue where non-SSL connections through a forward proxy could be improperly shared.** (also fixed in [Apigee 1-16-0-apigee-4](https://docs.cloud.google.com/apigee/docs/release/release-notes.md.txt#October_31_2025)) |
| **442501403** | **Fixed an issue that caused incorrect target latency metrics in Apigee Analytics when a TargetEndpoint is configured with a \<LoadBalancer\>.** (also fixed in [Apigee 1-16-0-apigee-3](https://docs.cloud.google.com/apigee/docs/release/release-notes.md.txt#October_16_2025)) |
| **438192028** | **Updated the geolocation database to mitigate stale IP-to-location mappings.** (also fixed in [Apigee 1-16-0-apigee-3](https://docs.cloud.google.com/apigee/docs/release/release-notes.md.txt#October_16_2025)) |
| **437999897** | **Reduced the log level for failed geo IP lookups to address excessive log messages for private IP addresses.** (also fixed in [Apigee 1-16-0-apigee-3](https://docs.cloud.google.com/apigee/docs/release/release-notes.md.txt#October_16_2025)) |
| **436323210** | **Fixed ingress cert keys to allow both `tls.key`/`key` and `tls.crt`/`cert`.** |
| **N/A** | **Updates to security, infrastructure, and libraries.** (also fixed in [Apigee 1-16-0-apigee-4](https://docs.cloud.google.com/apigee/docs/release/release-notes.md.txt#October_31_2025)) |

Fixed

#### Fixed since last minor release

| Bug ID | Description |
|---|---|
| **451841788** | **Apigee hybrid required the `mintTaskScheduler.serviceAccountPath` property even when Monetization was not enabled.** (Fixed in [v1.15.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1151) \& [v1.14.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1143)) |
| **451375397** | **The `apigee-pull-push.sh` script could return a No such image error message.** (Fixed in [v1.15.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1151) \& [v1.14.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1143)) |
| **445912919** | **Unused files and folders have been removed from the Apigee hybrid Helm charts to prevent potential security exposure and streamline the product installation and upgrade process.** (Fixed in [v1.15.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1151)) |
| **442501403** | **Fixed an issue that caused incorrect target latency metrics in Apigee Analytics when a `TargetEndpoint` is configured with a `<LoadBalancer>`.** (Fixed in [v1.15.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1151)) |
| **437999897** | **Reduced the log level for failed geo IP lookups to address excessive log messages for private IP addresses.** (Fixed in [v1.15.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1151)) |
| **431930277** , **395272878** | **When the configuration property [`envs.managementCallsSkipProxy`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/config-prop-ref.md.txt#envs-managementcallsskipproxy) is set to `true` via helm for environment-level forward proxy, trace and analytics (which use `googleapis.com`) will skip forward proxy.** (Fixed in [v1.15.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1151)) |
| **423597917** | **Post of an [`AppGroupAppKey`](https://docs.cloud.google.com/apigee/docs/reference/apis/apigee/rest/v1/organizations.appgroups.apps.keys/updateAppGroupAppKey.md.txt) scopes should result in insert operation instead of update.** (Fixed in [v1.15.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1151) \& [v1.14.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1143)) |
| **420675540** | **Fixed Cassandra based replication for runtime contracts in synchronizer.** (Fixed in [v1.15.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1151), [v1.14.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1143) \& [v1.13.4](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1134)) |
| **419578402** | **Mint-Mart forward proxy compatible.** (Fixed in [v1.15.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1151) \& [v1.14.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1143)) |
| **416634326** | **Presence of istio.io Custom Resource Definitions (CRDs) in an Apigee hybrid cluster could cause failure in apigee-ingressgateway-manager pods.** (Fixed in [v1.15.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1151), [v1.14.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1143) \& [v1.13.4](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1134)) |
| **414499328** | **`ApigeeTelemetry` could become stuck in `creating` state** (Fixed in [v1.14.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1143) \& [v1.13.4](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1134)) |
| **412740465** | **Fixed issue where zipkin headers were not generated by Apigee Ingress Gateway.** (Fixed in [v1.15.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1151) \& [v1.14.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1143)) |
| **409048431** | **Fixes a vulnerability which could allow a SAML signature verification to be bypassed.** (Fixed in [v1.15.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1151) \& [v1.14.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1143)) |
| **401746333** | **Fixed a `java.lang.ClassCircularityError` that could occur in Java Callouts due to an issue with the class loading mechanism.** (Fixed in [v1.15.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1151) \& [v1.14.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1143)) |
| **395272878** | **Separate Forward proxy support for `googleapis.com` and `non-googleapis.com` runtime traffic.** (Fixed in [v1.14.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1143)) |
| **393615439** | **OASValidation behavior for `allOf` with `additionalProperties: true`.** (Fixed in [1.14.2-hotfix.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_1142-hotfix1)) |
| **382565315** | **A memory leak within the Security Policy has been addressed, improving system stability.** (Fixed in [v1.13.4](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1134)) |
| **378686709** | **The use of wildcards (\*) in Apigee proxy basepaths would conflict with other explicit basepaths, resulting in a 404 error.** To apply this fix, follow the procedure in [Known issue 378686709](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt#378686709). (Fixed in [v1.15.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1151) \& [v1.14.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1143)) |
| **375360455** | **Updated apigee-runtime drain timeout to 300s to fix connection termination issue during pod termination.** (Fixed in [v1.13.4](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1134)) |
| **367815792** | **Two new Flow Variables: `app_group_app` and `app_group_name` have been added to VerifyApiKey and Access Token policy.** (Fixed in [v1.15.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1151) \& [v1.14.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1143)) |

Security

#### Fixed in this release

| Bug ID | Description |
|---|---|
| **452621774, 452381632, 441266643, 448498138** | **Security fix for Apigee infrastructure.** (also fixed in [Apigee 1-16-0-apigee-4](https://docs.cloud.google.com/apigee/docs/release/release-notes.md.txt#October_31_2025)) This addresses the following vulnerabilities: - [CVE-2025-53864](https://nvd.nist.gov/vuln/detail/CVE-2025-53864) Updated Nimbus JWT library from 9.37.2 to 9.37.4, which introduced changes in behavior including changes to error string verbiage. - [CVE-2025-8916](https://nvd.nist.gov/vuln/detail/CVE-2025-8916) - [CVE-2025-5115](https://nvd.nist.gov/vuln/detail/CVE-2025-5115) - [CVE-2024-40094](https://nvd.nist.gov/vuln/detail/CVE-2024-40094) <br /> |
| **440419558, 433759657** | **Security fix for Apigee infrastructure.** (also fixed in [Apigee 1-16-0-apigee-3](https://docs.cloud.google.com/apigee/docs/release/release-notes.md.txt#October_16_2025)) This addresses the following vulnerabilities: - [CVE-2025-22868](https://nvd.nist.gov/vuln/detail/CVE-2025-22868) - [CVE-2025-48924](https://nvd.nist.gov/vuln/detail/CVE-2025-48924) > [!NOTE] > **Note** : This fix updates a Java library that is included in Apigee. Reliance on Java libraries that are included with Apigee is not supported. Those libraries are for Apigee product functionality only, and there's no guarantee that a library will be available from release to release. For more information, see [Restrictions](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/java-callout-policy.md.txt#Restrictions). <br /> |
| **443902061** | **Security fix for Apigee infrastructure** (also fixed in [Apigee 1-16-0-apigee-3](https://docs.cloud.google.com/apigee/docs/release/release-notes.md.txt#October_16_2025)) This addresses the following vulnerability: - [CVE-2025-13292](https://nvd.nist.gov/vuln/detail/CVE-2025-13292) Fixed an issue with improper access control that resulted in cross-tenant analytics modification and access to log data. <br /> |
| **N/A** | **Security fixes for `apigee-asm-ingress`.** This addresses the following vulnerabilities: - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) |
| **N/A** | **Security fixes for `apigee-asm-istiod`.** This addresses the following vulnerabilities: - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) |
| **N/A** | **Security fixes for `apigee-connect-agent`.** This addresses the following vulnerabilities: - [CVE-2025-61725](https://nvd.nist.gov/vuln/detail/CVE-2025-61725) - [CVE-2025-61723](https://nvd.nist.gov/vuln/detail/CVE-2025-61723) - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) - [CVE-2025-47907](https://nvd.nist.gov/vuln/detail/CVE-2025-47907) |
| **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerability: - [CVE-2025-9230](https://nvd.nist.gov/vuln/detail/CVE-2025-9230) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2025-61725](https://nvd.nist.gov/vuln/detail/CVE-2025-61725) - [CVE-2025-61723](https://nvd.nist.gov/vuln/detail/CVE-2025-61723) - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) - [CVE-2025-47913](https://nvd.nist.gov/vuln/detail/CVE-2025-47913) - [CVE-2025-47907](https://nvd.nist.gov/vuln/detail/CVE-2025-47907) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** This addresses the following vulnerabilities: - [CVE-2025-61725](https://nvd.nist.gov/vuln/detail/CVE-2025-61725) - [CVE-2025-61723](https://nvd.nist.gov/vuln/detail/CVE-2025-61723) - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) - [CVE-2025-47907](https://nvd.nist.gov/vuln/detail/CVE-2025-47907) |
| **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2025-61725](https://nvd.nist.gov/vuln/detail/CVE-2025-61725) - [CVE-2025-61723](https://nvd.nist.gov/vuln/detail/CVE-2025-61723) - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) |
| **N/A** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerabilities: - [CVE-2025-53066](https://nvd.nist.gov/vuln/detail/CVE-2025-53066) - [CVE-2025-50106](https://nvd.nist.gov/vuln/detail/CVE-2025-50106) - [CVE-2025-50059](https://nvd.nist.gov/vuln/detail/CVE-2025-50059) - [CVE-2025-48913](https://nvd.nist.gov/vuln/detail/CVE-2025-48913) - [CVE-2025-30749](https://nvd.nist.gov/vuln/detail/CVE-2025-30749) - [CVE-2024-13009](https://nvd.nist.gov/vuln/detail/CVE-2024-13009) |
| **N/A** | **Security fixes for `apigee-open-telemetry-collector`.** This addresses the following vulnerabilities: - [CVE-2025-61723](https://nvd.nist.gov/vuln/detail/CVE-2025-61723) - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) - [CVE-2025-29786](https://nvd.nist.gov/vuln/detail/CVE-2025-29786) |
| **N/A** | **Security fixes for `apigee-operators`.** This addresses the following vulnerabilities: - [CVE-2025-61723](https://nvd.nist.gov/vuln/detail/CVE-2025-61723) - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) - [CVE-2025-61725](https://nvd.nist.gov/vuln/detail/CVE-2025-61725) |
| **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2025-61723](https://nvd.nist.gov/vuln/detail/CVE-2025-61723) - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) - [CVE-2022-48174](https://nvd.nist.gov/vuln/detail/CVE-2022-48174) |
| **N/A** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerabilities: - [CVE-2025-61723](https://nvd.nist.gov/vuln/detail/CVE-2025-61723) - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) |
| **N/A** | **Security fixes for `apigee-redis`.** This addresses the following vulnerabilities: - [CVE-2025-61725](https://nvd.nist.gov/vuln/detail/CVE-2025-61725) - [CVE-2025-61723](https://nvd.nist.gov/vuln/detail/CVE-2025-61723) - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) - [CVE-2025-47907](https://nvd.nist.gov/vuln/detail/CVE-2025-47907) |
| **N/A** | **Security fixes for `apigee-runtime`.** This addresses the following vulnerabilities: - [CVE-2025-50106](https://nvd.nist.gov/vuln/detail/CVE-2025-50106) - [CVE-2025-50059](https://nvd.nist.gov/vuln/detail/CVE-2025-50059) - [CVE-2025-48913](https://nvd.nist.gov/vuln/detail/CVE-2025-48913) - [CVE-2025-30749](https://nvd.nist.gov/vuln/detail/CVE-2025-30749) |
| **N/A** | **Security fixes for `apigee-stackdriver-logging-agent`.** This addresses the following vulnerability: - [CVE-2025-24294](https://nvd.nist.gov/vuln/detail/CVE-2025-24294) |
| **N/A** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2025-50106](https://nvd.nist.gov/vuln/detail/CVE-2025-50106) - [CVE-2025-50059](https://nvd.nist.gov/vuln/detail/CVE-2025-50059) - [CVE-2025-48913](https://nvd.nist.gov/vuln/detail/CVE-2025-48913) - [CVE-2025-30749](https://nvd.nist.gov/vuln/detail/CVE-2025-30749) |
| **N/A** | **Security fixes for `apigee-udca`.** This addresses the following vulnerabilities: - [CVE-2025-61725](https://nvd.nist.gov/vuln/detail/CVE-2025-61725) - [CVE-2025-61723](https://nvd.nist.gov/vuln/detail/CVE-2025-61723) - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) - [CVE-2025-47913](https://nvd.nist.gov/vuln/detail/CVE-2025-47913) |
| **N/A** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerabilities: - [CVE-2025-61723](https://nvd.nist.gov/vuln/detail/CVE-2025-61723) - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) |

Security

#### Fixed since last minor release

| Bug ID | Description |
|---|---|
| **448498138** | **Security fixes for `apigee-runtime`.** (Fixed in [v1.15.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1151)) This addresses the following vulnerability: - [CVE-2024-40094](https://nvd.nist.gov/vuln/detail/CVE-2024-40094) |
| **447367372** | **Security fixes for `apigee-runtime`.** (Fixed in [v1.15.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1151)) This addresses the following vulnerability: - [CVE-2025-58057](https://nvd.nist.gov/vuln/detail/CVE-2025-58057) |
| **433952146** | **Security fix.** (Fixed in [v1.14.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1143)) This addresses the following vulnerability: - [CVE-2024-6763](https://nvd.nist.gov/vuln/detail/CVE-2024-6763) |
| **433951774** | **Security fix.** (Fixed in [v1.14.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1143)) This addresses the following vulnerability: - [CVE-2024-7254](https://nvd.nist.gov/vuln/detail/CVE-2024-7254) |
| **433950558** | **Security fix.** (Fixed in [v1.14.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1143)) This addresses the following vulnerability: - [CVE-2024-47554](https://nvd.nist.gov/vuln/detail/CVE-2024-47554) |
| **433950370** | **Security fix.** (Fixed in [v1.14.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1143)) This addresses the following vulnerability: - [CVE-2025-25193](https://nvd.nist.gov/vuln/detail/CVE-2025-25193) |
| **418557195** | **Security fixes for `apigee-fluent-bit`.** (Fixed in [v1.15.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1151)) This addresses the following vulnerabilities: - [CVE-2025-24528](https://nvd.nist.gov/vuln/detail/CVE-2025-24528) - [CVE-2025-4207](https://nvd.nist.gov/vuln/detail/CVE-2025-4207) - [CVE-2025-1390](https://nvd.nist.gov/vuln/detail/CVE-2025-1390) - [CVE-2024-26462](https://nvd.nist.gov/vuln/detail/CVE-2024-26462) - [CVE-2024-13176](https://nvd.nist.gov/vuln/detail/CVE-2024-13176) |
| **396944778** | **Security fixes for `apigee-synchronizer`.** (Fixed in [v1.13.4](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1134)) This addresses the following vulnerabilities: - [CVE-2025-25193](https://nvd.nist.gov/vuln/detail/CVE-2025-25193) - [CVE-2025-24970](https://nvd.nist.gov/vuln/detail/CVE-2025-24970) - [CVE-2025-23184](https://nvd.nist.gov/vuln/detail/CVE-2025-23184) - [CVE-2024-47554](https://nvd.nist.gov/vuln/detail/CVE-2024-47554) |
| **392934392** | **Security fixes for `apigee-logger`.** |
| **N/A** | **Incorporated an updated base image for `stackdriver-logging-agent`, improving the overall security of the service.** (Fixed in [1.14.2-hotfix.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_1142-hotfix1)) This addresses the following vulnerabilities (among others and not limited to): - [CVE-2022-32221](https://nvd.nist.gov/vuln/detail/CVE-2022-32221) - [GHSA-jvgm-pfqv-887x](https://osv.dev/vulnerability/GHSA-jvgm-pfqv-887x) |
| **N/A** | **Security fixes for `apigee-asm-ingress`.** (Fixed in [v1.14.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1143)) This addresses the following vulnerability: - [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) |
| **N/A** | **Security fixes for `apigee-asm-istiod`.** (Fixed in [v1.14.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1143)) This addresses the following vulnerability: - [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) |
| **N/A** | **Security fixes for `apigee-envoy`.** (Fixed in [v1.14.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1143)) This addresses the following vulnerability: - [CVE-2025-0395](https://nvd.nist.gov/vuln/detail/CVE-2025-0395) |
| **N/A** | **Security fixes for `apigee-fluent-bit`.** (Fixed in [v1.14.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1143) \& [v1.15.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1151)) This addresses the following vulnerabilities: - [CVE-2025-32990](https://nvd.nist.gov/vuln/detail/CVE-2025-32990) - [CVE-2025-32988](https://nvd.nist.gov/vuln/detail/CVE-2025-32988) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** (Fixed in [v1.14.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1143)) This addresses the following vulnerability: - [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** (Fixed in [v1.14.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1143)) This addresses the following vulnerabilities: - [CVE-2025-23015](https://nvd.nist.gov/vuln/detail/CVE-2025-23015) - [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) - [CVE-2025-24970](https://nvd.nist.gov/vuln/detail/CVE-2025-24970) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** (Fixed in [v1.15.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1151)) This addresses the following vulnerability: - [CVE-2025-23015](https://nvd.nist.gov/vuln/detail/CVE-2025-23015) |
| **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** (Fixed in [v1.14.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1143)) This addresses the following vulnerability: - [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) |
| **N/A** | **Security fixes for `apigee-mart-server`.** (Fixed in [v1.13.4](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1134)) This addresses the following vulnerability: - [CVE-2024-20952](https://nvd.nist.gov/vuln/detail/CVE-2024-20952) |
| **N/A** | **Security fixes for `apigee-mart-server`.** (Fixed in [v1.14.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1143)) This addresses the following vulnerabilities: - [CVE-2025-48924](https://nvd.nist.gov/vuln/detail/CVE-2025-48924) - [CVE-2025-48795](https://nvd.nist.gov/vuln/detail/CVE-2025-48795) - [CVE-2025-48734](https://nvd.nist.gov/vuln/detail/CVE-2025-48734) - [CVE-2025-24970](https://nvd.nist.gov/vuln/detail/CVE-2025-24970) - [CVE-2024-47554](https://nvd.nist.gov/vuln/detail/CVE-2024-47554) - [CVE-2024-47535](https://nvd.nist.gov/vuln/detail/CVE-2024-47535) - [CVE-2024-13009](https://nvd.nist.gov/vuln/detail/CVE-2024-13009) - [CVE-2024-8184](https://nvd.nist.gov/vuln/detail/CVE-2024-8184) - [CVE-2024-7254](https://nvd.nist.gov/vuln/detail/CVE-2024-7254) - [CVE-2024-6763](https://nvd.nist.gov/vuln/detail/CVE-2024-6763) |

## December 17, 2025

**Apigee API hub** Feature **Advanced API Security for multi-gateway projects**

Apigee Advanced API Security can now centrally manage and govern the security posture of your APIs across multiple Apigee projects, environments, and gateways. This enhancement leverages API hub to provide a single, unified view of your API security, helping you to identify risks and enforce standards consistently across your entire organization.

This enhancement introduces the following key capabilities:

- **Unified risk assessment:** view and manage security scores for all your APIs in a centralized dashboard, regardless of which project, environment, or gateway they are deployed in.
- **Customizable security profiles:** create and manage custom security profiles and apply them consistently across your multi-gateway landscape.

Supported gateways:

- Apigee X
- Apigee hybrid
- Apigee Edge Public Cloud

To enable this feature, navigate to the **Add-on management page** in API hub and enable the **Apigee Advanced API Security** add-on.

Advanced API Security currently has limited support for VPC Service Controls (VPC-SC). To avoid potential feature limitations, we recommend enabling this add-on for API hub instances associated with Apigee organizations that don't have VPC-SC enabled.

For more information, see [Advanced API Security for multiple Apigee organizations and gateways](https://docs.cloud.google.com/apigee/docs/apihub/advanced-api-security-multi-gateway.md.txt).

> [!NOTE]
> **Note:** Rollouts of this feature will begin today, and may take five or more business days to be completed across all Google Cloud zones. You may not be able to view or use this feature until the rollout is complete.

**Apigee Advanced API Security** Announcement On December 17, 2025 we released an updated version of Advanced API Security
Risk Assessment

**Note:** Rollouts of this release to production instances will begin within two
business days and may take four or more business days to complete across all
Google Cloud zones. Your instances may not have the feature available until the
rollout is complete.
Feature **General availability of Risk Assessment v2 and support for assessments using additional policies**

Announcing the
[general availability](https://cloud.google.com/products#product-launch-stages)
of Risk Assessment v2 and support for assessments using the VerifyIAM policy and
these three AI policies: SanitizeUserPrompt, SanitizeModelResponse, and
SemanticCacheLookup.

**Note:** The Risk Assessment v2 monitoring conditions feature remains in preview.

For usage information, see [Risk Assessment overview and UI](https://docs.cloud.google.com/apigee/docs/api-security/security-scores.md.txt) in the documentation.
Feature **New risk assessment type field when creating or updating a risk assessment version 2 custom security profile**

The API for creating and updating a version 2 risk assessment custom security
profile now includes a `risk_assessment_type` field to specify
whether the custom security profile applies to an Apigee/Apigee hybrid instance
or to API hub multi-gateway.

This field is optional and defaults to `APIGEE`; this is not a
breaking change for existing risk assessment users.

See [REST Resource: organizations.securityProfilesV2](https://docs.cloud.google.com/apigee/docs/reference/apis/apigee/rest/v1/organizations.securityProfilesV2.md.txt) for information on the new functionality.
**Apigee Integrated Portal** Announcement On December 17, 2025 we released a new version of the Apigee integrated portal.
Fixed **Incorrect Cross-Origin-Opener-Policy header in developer portal**

A fix has been implemented to address an issue where the
`Cross-Origin-Opener-Policy` response header in the developer portal was
malformed with an extra colon. This change ensures the security header is
correctly formatted.
**Apigee UI** Announcement On December 17, 2025, we announced that Debug v1 will be shutdown on
January 15, 2026. Use
[Debug v2](https://docs.cloud.google.com/apigee/docs/api-platform/debug/trace.md.txt)
instead of Debug v1.

## December 15, 2025

**Apigee API hub** Feature **New API card view**

A new card view is now available for APIs in API hub. This view provides a more visual and comprehensive way to browse, edit, and manage your APIs, complementing the existing list view.

The card view highlights key information for each API, such as the owner, last modified date, target users, gateway, API style, and business unit, to enhance discoverability and provide a richer at-a-glance overview of your API landscape.

You can switch between the list and card views from the **API hub \> APIs** page.

## December 11, 2025

**Apigee API hub** Feature **Model Context Protocol (MCP) support in API hub**

API hub now supports the Model Context Protocol (MCP) as a first-class API style. This enables you to ingest, register, and manage MCP APIs and their associated tools.

**Key capabilities include:**

- **MCP API registration:** Register MCP APIs manually or via API hub APIs to create a single registry for your agentic services.
- **MCP tools:** Attach MCP specification files to your APIs. API hub parses these files to automatically extract and display the MCP tools in the UI.

For more information, see [API resources overview](https://docs.cloud.google.com/apigee/docs/apihub/apis-intro.md.txt), [Register MCP APIs](https://docs.cloud.google.com/apigee/docs/apihub/register-mcp-apis.md.txt), and [Manage MCP tools](https://docs.cloud.google.com/apigee/docs/apihub/manage-mcp-tools.md.txt).

> [!NOTE]
> **Note:** Rollouts of this feature will begin today, and may take five or more business days to be completed across all Google Cloud zones. You may not be able to view or use this feature until the rollout is complete.

## December 10, 2025

**Apigee X** Announcement On December 10th, 2025, we released an updated version of Apigee (1-16-0-apigee-6).

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Fixed

| Bug ID | Description |
|---|---|
| **458417250** | **Multiple authorization headers** Fixed issue where adding multiple authorization headers would cause Apigee to return a `500` error. |
| **N/A** | **Updates to security, infrastructure, and libraries.** |

## December 09, 2025

**Apigee API hub** Feature **New add-on management page in API hub**

A new **Add-on Management** page is now available in API hub. This page serves as a centralized location to enable, configure, and manage all your add-on services.

For more information, see [Manage add-ons](https://docs.cloud.google.com/apigee/docs/apihub/manage-add-ons.md.txt).
Change **Actions tab changes**

The **Actions** tab previously located in the **API hub \> Settings** page is now removed, accounting for the following UI changes:

- You can now find and configure add-on services like Specification Linter and Semantic Search under the new unified [Add-on Management](https://docs.cloud.google.com/apigee/docs/apihub/manage-add-ons.md.txt) page, alongside other API hub add-ons.
- The deprovisioning function is now moved to a dedicated top-level tab called **Deprovision**.

## December 04, 2025

**Apigee X** Feature **Mask KVM values**

You can now turn on key value map (KVM) masking to mask values with asterisks (\*\*\*\*\*).
For more information, see [About KVM masking](https://docs.cloud.google.com/apigee/docs/api-platform/cache/key-value-maps.md.txt#aboutmasking).

## November 18, 2025

**Apigee API hub** Feature **New API deployments view**

API deployment information is now available as a separate tab in the **API details** page. You can view your API deployment details, create new deployments, and manage existing deployments using the API deployments tab.

For more information, see [Manage deployments](https://docs.cloud.google.com/apigee/docs/apihub/manage-api-deployments.md.txt).
Fixed The issue relating to [API hub provisioning failures in data residency enabled Apigee organizations](https://docs.cloud.google.com/apigee/docs/release-notes.md.txt#November_03_2025) is now resolved. You can now provision API hub within an Apigee organization that has data residency enabled.

For information about provisioning API hub, see [Provision API hub in the Cloud console](https://docs.cloud.google.com/apigee/docs/apihub/provision.md.txt).
Change **New tutorial: Ingest Microsoft Azure API data into API hub**

A new tutorial is available for ingesting Microsoft Azure API data into API hub.

This tutorial shows you how to ingest API metadata from Azure API Management (APIM) into Apigee API hub. It uses a pre-built Application Integration template and a set of custom scripts on GitHub to perform a manual, on-demand ingestion of your API data.

For more information, see [Ingest Microsoft Azure API data into API hub](https://docs.cloud.google.com/apigee/docs/apihub/tutorials/ingest-azure-api-hub).

## November 17, 2025

**Apigee Analytics** Announcement On November 17, 2025 we released an updated version of Apigee Analytics.
Feature **Support for aggregate data in Error Code Analysis, Cache Performance, and Target Performance charts**

Announcing support for viewing aggregate data in the Error Code Analysis, Cache
Performance, and Target Performance Analytics dashboards.

For information on the Analytics dashboards, see
[Use the Analytics dashboards](https://docs.cloud.google.com/apigee/docs/api-platform/analytics/using-analytics-dashboards.md.txt).
**Apigee UI** Announcement On November 17, 2025, we released an updated version of the Apigee UI.
Fixed

| Bug ID | Description |
|---|---|
| 446973091 | **Proxy editor endpoint view is now disabled if there are over 200 flows configured in proxy endpoints.** When opening the proxy editor endpoint view with a proxy that has over 200 flows, the proxy graph is no longer rendered, and instead you are presented with a message informing you that there are too many flows to render. This action addresses a performance issue that made the proxy editor unusable when there were over 200 flows configured. |

**Apigee X** Announcement On November 17, 2025, we released an updated version of Apigee (1-16-0-apigee-5).

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Feature **Secure and validate documents using WS-Security with X.509 certificates**   

You can now secure and validate SOAP documents using WS-Security with X.509 certificates using crypto object methods. See [Secure SOAP documents using WS-Security with X.509 certificates](https://docs.cloud.google.com/apigee/docs/api-platform/reference/javascript-object-model.md.txt#cryptoobjectreference-cryptowsSecRsaSign) and [Validate SOAP documents using WS-Security with X.509 certificates](https://docs.cloud.google.com/apigee/docs/api-platform/reference/javascript-object-model.md.txt#cryptoobjectreference-cryptowsSecRsaValidate).
Change **New field available in the Apigee Organization API**

With this release, a new field is added to the [Apigee Organization API](https://docs.cloud.google.com/apigee/docs/reference/apis/apigee/rest/v1/organizations.md.txt#Organization). The new `caCertificates` (plural) field returns the value of the original CA certificate field and can hold additional values. The original `caCertificate` (singular) field is deprecated.
Security

| Bug ID | Description |
|---|---|
| **454672970** | **Added strict input validation to the `SetIntegrationRequest` policy** |

Fixed

| Bug ID | Description |
|---|---|
| **N/A** | **Updates to security, infrastructure, and libraries.** |

## November 12, 2025

**Apigee UI** Fixed

| Bug ID | Description |
|---|---|
| 455584175 | **Fixed a performance issue with Debug session UI** Fixed an issue where performance of the Debug session was severely degraded when loading a Debug session with a moderate number of transactions. |

Announcement On November 12, 2025, we released an updated version of the Apigee UI.

## November 10, 2025

**Apigee Analytics** Announcement On November 10, 2025 we released an updated version of Apigee.
Feature **Support for new Apigee Analytics regions**

This release introduces Apigee Analytics support for these new regions:
Hong Kong (`asia-east2`) and São Paulo (`southamerica-east1`).

**NOTE:** Apigee Advanced API Security does not support these new regions at this
time.

For a list of all of the supported Analytics regions, see
[Available Apigee API Analytics regions](https://cloud.google.com/apigee/docs/locations#available-apigee-api-analytics-regions).

## November 04, 2025

**Apigee API hub** Feature **Filter APIs by user-defined attributes**

You can now filter APIs using your custom, user-defined attributes from the **APIs** page in the Google Cloud console.

For more information, see [Filter resources based on attributes](https://docs.cloud.google.com/apigee/docs/apihub/manage-attributes.md.txt#filter-resources).

## November 03, 2025

**Apigee API hub** Issue **API hub provisioning fails in data residency enabled Apigee organizations**

Currently, API hub can't be provisioned within an Apigee organization that has data residency enabled. Attempts to provision API hub in a data residency-enabled Apigee organization will result in a timeout error.

**Workaround:** There is no workaround available at this time. If your existing Apigee organization has data residency enabled, you will not be able to provision API hub until this limitation is resolved in a future release.

## November 02, 2025

**Apigee UI** Deprecated
The Apigee Classic UI shutdown is complete. The shutdown was finalized on
November 2, 2025, completing the migration of Apigee to the Google Cloud console.
All Apigee functionality is now available in the Apigee UI in the
Google Cloud console.


See the [Apigee Classic UI shutdown](https://docs.cloud.google.com/apigee/docs/deprecations/apigee-classic-ui.md.txt) page for more details.
Announcement On November 2, 2025, we released an updated version of the Apigee UI.

## October 31, 2025

**Apigee X** Announcement On October 31, 2025, we released an updated version of Apigee (1-16-0-apigee-4).

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Security

| Bug ID | Description |
|---|---|
| **452621774, 452381632, 441266643, 448498138** | **Security fix for Apigee infrastructure.** This addresses the following vulnerabilities: - [CVE-2025-53864](https://nvd.nist.gov/vuln/detail/CVE-2025-53864) Updated Nimbus JWT library from 9.37.2 to 9.37.4, which introduced changes in behavior including changes to error string verbiage. - [CVE-2025-8916](https://nvd.nist.gov/vuln/detail/CVE-2025-8916) - [CVE-2025-5115](https://nvd.nist.gov/vuln/detail/CVE-2025-5115) - [CVE-2024-40094](https://nvd.nist.gov/vuln/detail/CVE-2024-53864) <br /> |

Fixed

| Bug ID | Description |
|---|---|
| **448647917** | **Fixed a issue where non-SSL connections through a forward proxy could be improperly shared.** |
| **N/A** | **Updates to security, infrastructure, and libraries.** |

## October 30, 2025

**Apigee UI** Fixed

| Bug ID | Description |
|---|---|
| 443120120 | **Fixed an issue where an incorrect target URL or cURL command was displayed in the proxy debug properties window.** New generated debug sessions now contain information in a flow info event that describes the values used by the proxy to call the target endpoint. The debug UI displays these values and uses them to generate the target URL and curl command displayed in the debug properties window when the target request event is selected. If some of the header fields are masked in the debug session, a warning appears next to the **Copy cURL** button. If the headers are truncated due to system limitations, **Copy cURL** is disabled. Older debug sessions that do not have the new target endpoint information no longer attempt to display the target URL or generate a cURL command as they were unreliable. A dialog is displayed warning you of this when attempting to open older debug sessions. |

Announcement On October 30, 2025, we released an updated version of the Apigee UI.

## October 29, 2025

**Apigee X** Announcement On October 29, 2025, we released an updated version of Apigee.
Feature **Support for API-product scoped quotas**

You can now set quotas at the API product level to limit the number of requests
all API proxies in the API product can process within a specified time frame.
See
[Configuring the quota policy to use API product quota settings](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/quota-policy.md.txt#configuring-the-quota-policy-to-use-api-product-quota-settings)
for information and instructions.

NOTE: API product-scoped quotas are not supported in Apigee hybrid
at this time.
Feature **Enhanced Validation for API products**

Heightened validation logic for creating and updating API products is now available. Apigee now explicitly verifies proxy and environment resources against your organization when creating and updating API products.

Please ensure that all referenced resources exist and are correctly associated with your organization to avoid validation errors.

## October 28, 2025

**Apigee API hub** Feature **Detailed API resource insights**

A new **Insights** tab is now available on the API details page, providing API-centric analytics to help you understand usage patterns and performance for each of your APIs.

You can now analyze key metrics such as total traffic, average TPS, request/response latencies, and more, directly from the API details page.

For more information, see [View API resource insights](https://cloud.google.com/apigee/docs/apihub/view-api-resource-insights).
Feature **API insights in API hub**

API insights is now available in API hub, providing a unified view of your API traffic and performance across all connected gateways. With API insights, you can gain a holistic understanding of your API ecosystem's health and quickly identify areas for optimization.

Currently, API insights supports data sources from Apigee, Apigee hybrid, Apigee Edge Public Cloud, and Apigee Edge Private Cloud (OPDK).

> [!NOTE]
> **Note:** Data residency (DRZ) and VPC-SC are not supported with API insights at this time.

For more information, see [API insights overview](https://cloud.google.com/apigee/docs/apihub/api-insights-overview).

## October 27, 2025

**Apigee X** Announcement On October 27, 2025, we released an updated version of Apigee.
Feature **Introduction of the `target.evaluated.url` flow variable**

This release includes a new flow variable, `target.evaluated.url`,
which should be used instead of the `target.url` flow variable in
cases when the URL is dynamically constructed based on user input.

For more information, see the
[target flow variables](https://docs.cloud.google.com/apigee/docs/api-platform/reference/variables-reference.md.txt#target)
documentation.

## October 16, 2025

**Apigee API hub** Change **Create and manage API operations in the UI**

You can now create and manage API operations for your API versions from the **API details** page in the Google Cloud console.

For more information, see [Manage operations](https://cloud.google.com/apigee/docs/apihub/manage-operations).
**Apigee X** Security

| Bug ID | Description |
|---|---|
| **440419558, 433759657** | **Security fix for Apigee infrastructure.** This addresses the following vulnerabilities: - [CVE-2025-22868](https://nvd.nist.gov/vuln/detail/CVE-2025-22868) - [CVE-2025-48924](https://nvd.nist.gov/vuln/detail/CVE-2025-48924) > [!NOTE] > **Note** : This fix updates a Java library that is included in Apigee. Reliance on Java libraries that are included with Apigee is not supported. Those libraries are for Apigee product functionality only, and there's no guarantee that a library will be available from release to release. For more information, see [Restrictions](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/java-callout-policy.md.txt#Restrictions). <br /> |
| **443902061** | **Security fix for Apigee infrastructure** This addresses the following vulnerability: - CVE-2025-13292Fixed an issue with improper access control that resulted in cross-tenant analytics modification and access to log data. <br /> |

Fixed

| Bug ID | Description |
|---|---|
| **442501403** | **Fixed an issue that caused incorrect target latency metrics in Apigee Analytics when a TargetEndpoint is configured with a \<LoadBalancer\>.** |
| **437999897** | **Reduced the log level for failed geo IP lookups to address excessive log messages for private IP addresses.** |
| **436323210** | **Fixed ingress cert keys to allow both `tls.key`/`key` and `tls.crt`/`cert`.** |
| **438192028** | **Updated the geolocation database to mitigate stale IP-to-location mappings.** |
| **N/A** | **Updates to security infrastructure and libraries.** |

Announcement On October 16, 2025, we released an updated version of Apigee (1-16-0-apigee-3).

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

## October 14, 2025

**Apigee API hub** Change **New MCP API style system attribute**

The system-defined API style attribute now includes a new value: **MCP**. This lets you classify and govern APIs based on the latest Model Context Protocol (MCP) standards.

For more information, see [System attributes](https://cloud.google.com/apigee/docs/apihub/manage-attributes#system-attributes).
**Apigee X** Deprecated **Removal of deprecated Gemini Code Assist `@Apigee` tool.**

The Gemini Code Assist `@Apigee` tool is shut down as of October 14, 2025.

See [Gemini Code Assist @Apigee tool deprecation](https://docs.cloud.google.com/apigee/docs/deprecations/apigee-tool.md.txt) for information.

## October 12, 2025

**Apigee hybrid** v1.15.1 Announcement

### hybrid v1.15.1

On October 10, 2025 we released an updated version of the Apigee hybrid software, 1.15.1.

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.15](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Feature **Recurring, top-up, and setup fees for Apigee hybrid monetization**

Apigee hybrid now supports recurring, top-up, and setup fees for monetization. For information see [Enabling monetization for Apigee hybrid](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/monetization-for-hybrid.md.txt).
Feature **Apigee policies for LLM/GenAI workloads**

Apigee hybrid now supports the following Apigee policies with support for LLM/GenAI workloads.

- [SemanticCacheLookup policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/semantic-cache-lookup-policy.md.txt)
- [SemanticCachePopulate policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/semantic-cache-populate-policy.md.txt)
- [SanitizeUserPrompt](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/sanitize-user-prompt-policy.md.txt)
- [SanitizeModelResponse](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/sanitize-user-prompt-policy.md.txt)

The Apigee semantic caching policies enable intelligent response reuse based on semantic similarity. Using these policies in your Apigee API proxies can minimize redundant backend API calls, reduce latency, and lower operational costs. With this release, the semantic caching policies support URL templating, enabling the use of variables for AI model endpoint values.

The Model Armor policies protect your AI applications by sanitizing user prompts to and responses from large language models (LLMs). Using these policies in your Apigee API proxies can mitigate the risks associated with LLM usage by leveraging Model Armor to detect prompt injection, prevent jailbreak attacks, apply responsible AI filters, filter malicious URLs, and protect sensitive data.

> [!NOTE]
> **Note:** In Apigee hybrid, this feature has the following limitations:
>
> - Support for these policies is limited to installations on Google Cloud Platform.
> - Apigee hybrid does not support forward proxy with these policies.

For more information on using these policies in your Apigee API proxies, see:

- [Get started with semantic caching policies](https://docs.cloud.google.com/apigee/docs/api-platform/tutorials/using-semantic-caching-policies.md.txt)
- [Get started with Apigee Model Armor policies](https://docs.cloud.google.com/apigee/docs/api-platform/tutorials/using-model-armor-policies.md.txt)
Fixed

| Bug ID | Description |
|---|---|
| **451841788** | **Apigee hybrid required the `mintTaskScheduler.serviceAccountPath` property even when Monetization was not enabled.** |
| **451375397** | **The `apigee-pull-push.sh` script could return a "No such image error" message.** |
| **445912919** | **Unused files and folders have been removed from the Apigee hybrid Helm charts to prevent potential security exposure and streamline the product installation and upgrade process.** |
| **442501403** | **Fixed an issue that caused incorrect target latency metrics in Apigee Analytics when a `TargetEndpoint` is configured with a `<LoadBalancer>`.** |
| **437999897** | **Reduced the log level for failed geo IP lookups to address excessive log messages for private IP addresses.** |
| **431930277** , **395272878** | **When the configuration property [`envs.managementCallsSkipProxy`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/config-prop-ref.md.txt#envs-managementcallsskipproxy) is set to `true` via helm for environment-level forward proxy, trace and analytics (which use `googleapis.com`) will skip forward proxy.** |
| **423597917** | **Post of an [`AppGroupAppKey`](https://docs.cloud.google.com/apigee/docs/reference/apis/apigee/rest/v1/organizations.appgroups.apps.keys/updateAppGroupAppKey.md.txt) scopes should result in insert operation instead of update.** |
| **420675540** | **Fixed Cassandra based replication for runtime contracts in synchronizer.** |
| **419578402** | **Mint-Mart forward proxy compatible.** |
| **416634326** | **Presence of istio.io Custom Resource Definitions (CRDs) in an Apigee hybrid cluster could cause failure in apigee-ingressgateway-manager pods.** |
| **412740465** | **Fixed issue where zipkin headers were not generated by Apigee Ingress Gateway.** |
| **409048431** | **Fixes a vulnerability which could allow a SAML signature verification to be bypassed.** |
| **378686709** | **The use of wildcards (\*) in Apigee proxy basepaths would conflict with other explicit basepaths, resulting in a 404 error.** To apply this fix, follow the procedure in [Known issue 378686709](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt#378686709). |
| **367815792** | **Two new Flow Variables: `app_group_app` and `app_group_name` have been added to VerifyApiKey and Access Token policy.** |

Security

| Bug ID | Description |
|---|---|
| **448498138** | **Security fixes for `apigee-runtime`.** This addresses the following vulnerability: - [CVE-2024-40094](https://nvd.nist.gov/vuln/detail/CVE-2024-40094) |
| **447367372** | **Security fixes for `apigee-runtime`.** This addresses the following vulnerability: - [CVE-2025-58057](https://nvd.nist.gov/vuln/detail/CVE-2025-58057) |
| **418557195** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2025-24528](https://nvd.nist.gov/vuln/detail/CVE-2025-24528) - [CVE-2025-4207](https://nvd.nist.gov/vuln/detail/CVE-2025-4207) - [CVE-2025-1390](https://nvd.nist.gov/vuln/detail/CVE-2025-1390) - [CVE-2024-26462](https://nvd.nist.gov/vuln/detail/CVE-2024-26462) - [CVE-2024-13176](https://nvd.nist.gov/vuln/detail/CVE-2024-13176) |
| **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2025-32990](https://nvd.nist.gov/vuln/detail/CVE-2025-32990) - [CVE-2025-32988](https://nvd.nist.gov/vuln/detail/CVE-2025-32988) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** This addresses the following vulnerability: - [CVE-2025-23015](https://nvd.nist.gov/vuln/detail/CVE-2025-23015) |
| **N/A** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerabilities: - [CVE-2025-58057](https://nvd.nist.gov/vuln/detail/CVE-2025-58057) - [CVE-2025-58056](https://nvd.nist.gov/vuln/detail/CVE-2025-58056) - [CVE-2025-55163](https://nvd.nist.gov/vuln/detail/CVE-2025-55163) - [CVE-2025-48924](https://nvd.nist.gov/vuln/detail/CVE-2025-48924) - [CVE-2025-48795](https://nvd.nist.gov/vuln/detail/CVE-2025-48795) - [CVE-2025-48734](https://nvd.nist.gov/vuln/detail/CVE-2025-48734) - [CVE-2025-24970](https://nvd.nist.gov/vuln/detail/CVE-2025-24970) - [CVE-2024-47554](https://nvd.nist.gov/vuln/detail/CVE-2024-47554) - [CVE-2024-47535](https://nvd.nist.gov/vuln/detail/CVE-2024-47535) - [CVE-2024-13009](https://nvd.nist.gov/vuln/detail/CVE-2024-13009) - [CVE-2024-8184](https://nvd.nist.gov/vuln/detail/CVE-2024-8184) - [CVE-2024-7254](https://nvd.nist.gov/vuln/detail/CVE-2024-7254) - [CVE-2024-6763](https://nvd.nist.gov/vuln/detail/CVE-2024-6763) |
| **N/A** | **Security fixes for `apigee-stackdriver-logging-agent`.** This addresses the following vulnerabilities: - [CVE-2025-58767](https://nvd.nist.gov/vuln/detail/CVE-2025-58767) - [CVE-2025-24294](https://nvd.nist.gov/vuln/detail/CVE-2025-24294) - [CVE-2023-33953](https://nvd.nist.gov/vuln/detail/CVE-2023-33953) - [CVE-2022-32511](https://nvd.nist.gov/vuln/detail/CVE-2022-32511) - [CVE-2022-29181](https://nvd.nist.gov/vuln/detail/CVE-2022-29181) - [CVE-2022-24839](https://nvd.nist.gov/vuln/detail/CVE-2022-24839) - [CVE-2022-24836](https://nvd.nist.gov/vuln/detail/CVE-2022-24836) - [CVE-2022-0759](https://nvd.nist.gov/vuln/detail/CVE-2022-0759) - [CVE-2021-41817](https://nvd.nist.gov/vuln/detail/CVE-2021-41817) - [CVE-2021-31799](https://nvd.nist.gov/vuln/detail/CVE-2021-31799) - [CVE-2021-30560](https://nvd.nist.gov/vuln/detail/CVE-2021-30560) - [CVE-2021-28965](https://nvd.nist.gov/vuln/detail/CVE-2021-28965) - [CVE-2021-23214](https://nvd.nist.gov/vuln/detail/CVE-2021-23214) - [CVE-2020-25695](https://nvd.nist.gov/vuln/detail/CVE-2020-25695) - [CVE-2020-25694](https://nvd.nist.gov/vuln/detail/CVE-2020-25694) - [CVE-2020-25613](https://nvd.nist.gov/vuln/detail/CVE-2020-25613) - [CVE-2019-3881](https://nvd.nist.gov/vuln/detail/CVE-2019-3881) - [CVE-2018-25032](https://nvd.nist.gov/vuln/detail/CVE-2018-25032) - [CVE-2018-1115](https://nvd.nist.gov/vuln/detail/CVE-2018-1115) - [CVE-2018-10915](https://nvd.nist.gov/vuln/detail/CVE-2018-10915) - [CVE-2018-1058](https://nvd.nist.gov/vuln/detail/CVE-2018-1058) - [CVE-2018-1053](https://nvd.nist.gov/vuln/detail/CVE-2018-1053) - [CVE-2017-7546](https://nvd.nist.gov/vuln/detail/CVE-2017-7546) - [CVE-2017-7484](https://nvd.nist.gov/vuln/detail/CVE-2017-7484) - [CVE-2017-15098](https://nvd.nist.gov/vuln/detail/CVE-2017-15098) - [CVE-2017-14798](https://nvd.nist.gov/vuln/detail/CVE-2017-14798) - [CVE-2016-7954](https://nvd.nist.gov/vuln/detail/CVE-2016-7954) - [CVE-2016-7048](https://nvd.nist.gov/vuln/detail/CVE-2016-7048) - [CVE-2016-5424](https://nvd.nist.gov/vuln/detail/CVE-2016-5424) - [CVE-2016-5423](https://nvd.nist.gov/vuln/detail/CVE-2016-5423) - [CVE-2016-0766](https://nvd.nist.gov/vuln/detail/CVE-2016-0766) - [CVE-2015-3167](https://nvd.nist.gov/vuln/detail/CVE-2015-3167) - [CVE-2015-3166](https://nvd.nist.gov/vuln/detail/CVE-2015-3166) - [CVE-2015-0244](https://nvd.nist.gov/vuln/detail/CVE-2015-0244) - [CVE-2015-0243](https://nvd.nist.gov/vuln/detail/CVE-2015-0243) - [CVE-2015-0241](https://nvd.nist.gov/vuln/detail/CVE-2015-0241) |

Change **Documentation change**

The following documents have been changed or introduced to align the Apigee hybrid installation guides with the supported methods for service account authentication:

- [Service account authentication methods in Apigee hybrid](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/sa-authentication-methods.md.txt) - A new overview topic for service account authentication.
- [Storing service account keys in Kubernetes secrets](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/storing-sa-keys-in-k8s-secrets.md.txt) - A new topic.
- [Step 4: Create service accounts](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/install-service-accounts.md.txt) - Rewritten to accommodate all supported methods of service account authentication.
- [Step 5: Set up service account authentication](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/install-sa-authentication.md.txt) - A new topic on configuring authentication after creating service accounts.
- [Step 7: Create the overrides](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/install-create-overrides.md.txt) and [Step 11: Install Apigee hybrid Using Helm](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/install-helm-charts.md.txt) - Topics revised to provide templates, examples, and procedures for each supported type of service account authentication.
- **Step 11(Optional): Configure Workload Identity** - Topic removed. The procedures are included in [Step 11: Install Apigee hybrid Using Helm: WIF for GKE](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/install-helm-charts.md.txt#wif-for-gke)

## October 09, 2025

**Apigee X** Deprecated **Deprecation of the Gemini Code Assist `@Apigee` tool.**

The Gemini Code Assist `@Apigee` tool is deprecated and will be shut down as of October 14, 2025.

See [Gemini Code Assist @Apigee tool deprecation](https://docs.cloud.google.com/apigee/docs/deprecations/apigee-tool.md.txt) for information.

## October 07, 2025

**Apigee UI** Announcement On October 7, 2025, we released an updated version of the Apigee UI.
Feature **Output from print statements is now displayed in the Debug session viewer**   

A new option has been added to the transaction navigation table header in the Debug session viewer that opens the **Transaction output** window. The **Transaction output** window displays `print()` output from either *all transactions* in the debug session, or a *specific transaction* from the session. See [Creating a debug session](https://docs.cloud.google.com/apigee/docs/api-platform/debug/trace.md.txt#create) for details.
**Apigee X** Breaking **Previously unreported customer DNS misconfigurations now result in DNS errors**

Apigee removed the automatic DNS fallback functionality that was in 1-16-0-apigee-2. This removal surfaces customer DNS misconfigurations that previously did not show as DNS errors.

See [Known Issue 445936920](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt#445936920).
**Apigee hybrid** v1.14.3 Announcement

### hybrid v1.14.3

On October 7, 2025 we released an enhancement to Apigee hybrid version 1.14.3, recurring, top-up, and setup fees for Apigee hybrid monetization.

> [!NOTE]
> **Note:** This is an enhancement to an existing release.

- For complete information on the contents of the v1.14.3 release, see [Apigee hybrid v1.14.3 release notes](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1143).
Feature **Recurring, top-up, and setup fees for Apigee hybrid monetization**

Apigee hybrid now supports recurring, top-up, and setup fees for monetization. For information see [Enabling monetization for Apigee hybrid](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/monetization-for-hybrid.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **419578402** | **Mint-Mart forward proxy compatible.** |

## October 02, 2025

**Apigee Advanced API Security** Announcement On October 2, 2025 we released an updated version of Advanced API Security Abuse Detection

**Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the feature available until the rollout is complete.
Feature **Introduction of exclusion lists for Abuse Detection and incidents**

You can now specify CIDR ranges and IP addresses to exclude from future incident reports. Use this feature to exclude traffic known to be safe, such as requests related to automated testing.

The new functionality includes the ability to create and manage multiple "exclusion lists" which define traffic to exclude and the reasons it is excluded.

**Note:** Exclusion lists are not available for VPC-SC customers at this time.

For usage information, see [Exclude traffic from abuse detection](https://docs.cloud.google.com/apigee/docs/api-security/abuse-detection.md.txt#exclude-traffic-from-abuse-detection) in the documentation.

## September 29, 2025

**Apigee hybrid** v1.14.3 Announcement

### hybrid v1.14.3

On September 29, 2025 we released an updated version of the Apigee hybrid software, 1.14.3.

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.14](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Fixed

| Bug ID | Description |
|---|---|
| **451841788** | **Apigee hybrid required the `mintTaskScheduler.serviceAccountPath` property even when Monetization was not enabled.** |
| **451375397** | **The `apigee-pull-push.sh` script could return a "No such image" error message.** |
| **423597917** | **Post of an [`AppGroupAppKey`](https://docs.cloud.google.com/apigee/docs/reference/apis/apigee/rest/v1/organizations.appgroups.apps.keys/updateAppGroupAppKey.md.txt) scopes should result in insert operation instead of update.** |
| **420675540** | **Fixed Cassandra based replication for runtime contracts in synchronizer.** |
| **416634326** | **Presence of istio.io Custom Resource Definitions (CRDs) in an Apigee hybrid cluster could cause failure in apigee-ingressgateway-manager pods.** |
| **414499328** | **`ApigeeTelemetry` could become stuck in `creating` state** |
| **412740465** | **Fixed issue where zipkin headers were not generated by Apigee Ingress Gateway.** |
| **409048431** | **Fixes a vulnerability which could allow a SAML signature verification to be bypassed.** |
| **395272878** | **Separate Forward proxy support for `googleapis.com` and `non-googleapis.com` runtime traffic.** |
| **378686709** | **The use of wildcards (\*) in Apigee proxy basepaths would conflict with other explicit basepaths, resulting in a 404 error.** To apply this fix, follow the procedure in [Known issue 378686709](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt#378686709). |
| **367815792** | **Two new Flow Variables: `app_group_app` and `app_group_name` have been added to VerifyApiKey and Access Token policy.** |

Security

| Bug ID | Description |
|---|---|
| **433952146** | **Security fix.** This addresses the following vulnerability: - [CVE-2024-6763](https://nvd.nist.gov/vuln/detail/CVE-2024-6763) |
| **433951774** | **Security fix.** This addresses the following vulnerability: - [CVE-2024-7254](https://nvd.nist.gov/vuln/detail/CVE-2024-7254) |
| **433950558** | **Security fix.** This addresses the following vulnerability: - [CVE-2024-47554](https://nvd.nist.gov/vuln/detail/CVE-2024-47554) |
| **433950370** | **Security fix.** This addresses the following vulnerability: - [CVE-2025-25193](https://nvd.nist.gov/vuln/detail/CVE-2025-25193) |
| **N/A** | **Security fixes for `apigee-asm-ingress`.** This addresses the following vulnerability: - [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) |
| **N/A** | **Security fixes for `apigee-asm-istiod`.** This addresses the following vulnerability: - [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) |
| **N/A** | **Security fixes for `apigee-envoy`.** This addresses the following vulnerability: - [CVE-2025-0395](https://nvd.nist.gov/vuln/detail/CVE-2025-0395) |
| **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2025-32990](https://nvd.nist.gov/vuln/detail/CVE-2025-32990) - [CVE-2025-32988](https://nvd.nist.gov/vuln/detail/CVE-2025-32988) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2025-23015](https://nvd.nist.gov/vuln/detail/CVE-2025-23015) - [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) - [CVE-2025-24970](https://nvd.nist.gov/vuln/detail/CVE-2025-24970) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** This addresses the following vulnerability: - [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) |
| **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerability: - [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) |
| **N/A** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerabilities: - [CVE-2025-48924](https://nvd.nist.gov/vuln/detail/2025-48924) - [CVE-2025-48795](https://nvd.nist.gov/vuln/detail/2025-48795) - [CVE-2025-48734](https://nvd.nist.gov/vuln/detail/2025-48734) - [CVE-2025-24970](https://nvd.nist.gov/vuln/detail/2025-24970) - [CVE-2024-47554](https://nvd.nist.gov/vuln/detail/2024-47554) - [CVE-2024-47535](https://nvd.nist.gov/vuln/detail/2024-47535) - [CVE-2024-13009](https://nvd.nist.gov/vuln/detail/2024-13009) - [CVE-2024-8184](https://nvd.nist.gov/vuln/detail/2024-8184) - [CVE-2024-7254](https://nvd.nist.gov/vuln/detail/2024-7254) - [CVE-2024-6763](https://nvd.nist.gov/vuln/detail/2024-6763) |
| **N/A** | **Security fixes for `apigee-operators`.** This addresses the following vulnerability: - [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) |
| **N/A** | **Security fixes for `apigee-stackdriver-logging-agent`.** This addresses the following vulnerabilities: - [CVE-2025-43857](https://nvd.nist.gov/vuln/detail/CVE-2025-43857) - [CVE-2024-41946](https://nvd.nist.gov/vuln/detail/CVE-2024-41946) - [CVE-2024-41123](https://nvd.nist.gov/vuln/detail/CVE-2024-41123) - [CVE-2024-25062](https://nvd.nist.gov/vuln/detail/CVE-2024-25062) - [CVE-2023-42915](https://nvd.nist.gov/vuln/detail/CVE-2023-42915) - [CVE-2023-33953](https://nvd.nist.gov/vuln/detail/CVE-2023-33953) - [CVE-2022-34169](https://nvd.nist.gov/vuln/detail/CVE-2022-34169) - [CVE-2022-32511](https://nvd.nist.gov/vuln/detail/CVE-2022-32511) - [CVE-2022-32207](https://nvd.nist.gov/vuln/detail/CVE-2022-32207) - [CVE-2022-29181](https://nvd.nist.gov/vuln/detail/CVE-2022-29181) - [CVE-2022-28739](https://nvd.nist.gov/vuln/detail/CVE-2022-28739) - [CVE-2022-27782](https://nvd.nist.gov/vuln/detail/CVE-2022-27782) - [CVE-2022-24839](https://nvd.nist.gov/vuln/detail/CVE-2022-24839) - [CVE-2022-24836](https://nvd.nist.gov/vuln/detail/CVE-2022-24836) - [CVE-2022-23308](https://nvd.nist.gov/vuln/detail/CVE-2022-23308) - [CVE-2022-0759](https://nvd.nist.gov/vuln/detail/CVE-2022-0759) - [CVE-2021-41819](https://nvd.nist.gov/vuln/detail/CVE-2021-41819) - [CVE-2021-41817](https://nvd.nist.gov/vuln/detail/CVE-2021-41817) - [CVE-2021-4044](https://nvd.nist.gov/vuln/detail/CVE-2021-4044) - [CVE-2021-3518](https://nvd.nist.gov/vuln/detail/CVE-2021-3518) - [CVE-2021-3517](https://nvd.nist.gov/vuln/detail/CVE-2021-3517) - [CVE-2021-32740](https://nvd.nist.gov/vuln/detail/CVE-2021-32740) - [CVE-2021-32066](https://nvd.nist.gov/vuln/detail/CVE-2021-32066) - [CVE-2021-31799](https://nvd.nist.gov/vuln/detail/CVE-2021-31799) - [CVE-2021-30560](https://nvd.nist.gov/vuln/detail/CVE-2021-30560) - [CVE-2021-28966](https://nvd.nist.gov/vuln/detail/CVE-2021-28966) - [CVE-2021-28965](https://nvd.nist.gov/vuln/detail/CVE-2021-28965) - [CVE-2021-23214](https://nvd.nist.gov/vuln/detail/CVE-2021-23214) - [CVE-2021-22926](https://nvd.nist.gov/vuln/detail/CVE-2021-22926) - [CVE-2020-7595](https://nvd.nist.gov/vuln/detail/CVE-2020-7595) - [CVE-2020-25695](https://nvd.nist.gov/vuln/detail/CVE-2020-25695) - [CVE-2020-25694](https://nvd.nist.gov/vuln/detail/CVE-2020-25694) - [CVE-2020-25613](https://nvd.nist.gov/vuln/detail/CVE-2020-25613) - [CVE-2019-9193](https://nvd.nist.gov/vuln/detail/CVE-2019-9193) - [CVE-2019-3881](https://nvd.nist.gov/vuln/detail/CVE-2019-3881) - [CVE-2019-20388](https://nvd.nist.gov/vuln/detail/CVE-2019-20388) - [CVE-2019-10211](https://nvd.nist.gov/vuln/detail/CVE-2019-10211) - [CVE-2019-10210](https://nvd.nist.gov/vuln/detail/CVE-2019-10210) - [CVE-2019-10128](https://nvd.nist.gov/vuln/detail/CVE-2019-10128) - [CVE-2019-10127](https://nvd.nist.gov/vuln/detail/CVE-2019-10127) - [CVE-2018-25032](https://nvd.nist.gov/vuln/detail/CVE-2018-25032) - [CVE-2018-1115](https://nvd.nist.gov/vuln/detail/CVE-2018-1115) - [CVE-2018-10915](https://nvd.nist.gov/vuln/detail/CVE-2018-10915) - [CVE-2018-1058](https://nvd.nist.gov/vuln/detail/CVE-2018-1058) - [CVE-2018-1053](https://nvd.nist.gov/vuln/detail/CVE-2018-1053) - [CVE-2017-7546](https://nvd.nist.gov/vuln/detail/CVE-2017-7546) - [CVE-2017-7486](https://nvd.nist.gov/vuln/detail/CVE-2017-7486) - [CVE-2017-7484](https://nvd.nist.gov/vuln/detail/CVE-2017-7484) - [CVE-2017-17405](https://nvd.nist.gov/vuln/detail/CVE-2017-17405) - [CVE-2017-15098](https://nvd.nist.gov/vuln/detail/CVE-2017-15098) - [CVE-2017-14798](https://nvd.nist.gov/vuln/detail/CVE-2017-14798) - [CVE-2016-7954](https://nvd.nist.gov/vuln/detail/CVE-2016-7954) - [CVE-2016-7048](https://nvd.nist.gov/vuln/detail/CVE-2016-7048) - [CVE-2016-5424](https://nvd.nist.gov/vuln/detail/CVE-2016-5424) - [CVE-2016-5423](https://nvd.nist.gov/vuln/detail/CVE-2016-5423) - [CVE-2016-0766](https://nvd.nist.gov/vuln/detail/CVE-2016-0766) - [CVE-2015-3167](https://nvd.nist.gov/vuln/detail/CVE-2015-3167) - [CVE-2015-3166](https://nvd.nist.gov/vuln/detail/CVE-2015-3166) - [CVE-2015-0244](https://nvd.nist.gov/vuln/detail/CVE-2015-0244) - [CVE-2015-0243](https://nvd.nist.gov/vuln/detail/CVE-2015-0243) - [CVE-2015-0242](https://nvd.nist.gov/vuln/detail/CVE-2015-0242) - [CVE-2015-0241](https://nvd.nist.gov/vuln/detail/CVE-2015-0241) |
| **N/A** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerability: - [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) |

## September 24, 2025

**Apigee Operator for kubernetes** Feature **ApigeeBackendService for the Apigee Operator for Kubernetes (GA)**

The ApigeeBackendService resource for the Apigee Operator for Kubernetes is [Generally Available (GA)](https://cloud.google.com/products#product-launch-stages).

This new resource enables the integration of the Apigee Operator for Kubernetes with the [Google Kubernetes Engine (GKE) Inference Gateway](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/about-gke-inference-gateway.md.txt). The GKE Inference Gateway is an extension to the GKE Gateway that provides optimized routing and load balancing for serving generative Artificial Intelligence (AI) workloads. It simplifies the deployment, management, and observability of AI inference workloads.

With this new integration, GKE Inference Gateway users can now leverage Apigee's full suite of features to manage, govern and monetize their AI workload through APIs.

To learn more, see [Create an ApigeeBackendService](https://docs.cloud.google.com/apigee/docs/api-platform/apigee-kubernetes/apigee-apim-operator-apigeebackendservice.md.txt).
Announcement On September 24, 2025, we released an updated version of Apigee.
**Apigee hybrid** v1.15.0 Announcement

### Apigee Operator for Kubernetes for Apigee Hybrid (Preview)

On September 24, 2025 we released the Apigee Operator for Kubernetes for Apigee Hybrid 1.15.0 and newer.

The Apigee Operator for Kubernetes allows you to perform API management tasks, such as defining API products and operations, using Kubernetes tools. This preview release allows you to integrate this capability with your Apigee hybrid (v1.15.0 or newer) installation.

For more information, see:

- [Apigee Operator for Kubernetes overview](https://docs.cloud.google.com/apigee/docs/api-platform/apigee-kubernetes/apigee-apim-operator-overview.md.txt)
- [Install the Apigee Operator for Kubernetes for Apigee hybrid](https://docs.cloud.google.com/apigee/docs/api-platform/apigee-kubernetes/apigee-apim-operator-install-hybrid.md.txt)

## September 19, 2025

**Apigee Advanced API Security** Announcement On September 19, 2025 we released an updated version of Advanced API Security

**Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the feature available until the rollout is complete.
Feature **New security actions status icons and "expired" note in the security actions UI**

This release adds security status icons to the Apigee UI to make it easier to see, at a glance, whether a security action is enabled, disabled, or paused, and an "expired" note when an action is expired.

The status icons display next to the action's status in the security actions list and in the security action details page.

For information on security actions and security action statuses, see the [Security Actions customer documentation](https://docs.cloud.google.com/apigee/docs/api-security/security-actions.md.txt).
**Apigee UI** Announcement On September 19, 2025, we released an updated version of the Apigee UI.
Fixed

| Bug ID | Description |
|---|---|
| 444579842 | **Fixed browser hang issue when uploading large bundles**. Fixed an issue where the browser would hang when creating a new proxy or proxy revision from a large uploaded zip bundle. |

## September 18, 2025

**Apigee Advanced API Security** Announcement On September 18, 2025 we released an updated version of Advanced API Security

**Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the feature available until the rollout is complete.
Feature **Improvements to the Abuse Detection incident model**

This release includes improvements to the incident model, including lower noise and higher accuracy for abuse detection incidents.

**Note: This feature is not currently available to customers with VPC-SC enabled.**

For information on abuse detection incidents, see the [Abuse Detection customer documentation](https://docs.cloud.google.com/apigee/docs/api-security/abuse-detection.md.txt#incidents).

## September 14, 2025

**Apigee UI** Announcement On September 14, 2025, we released an updated version of the Apigee UI.
Feature **Added icon to proxy and sharedflow editor to mark unused policies**

If a policy has yet to be [attached to any flow](https://docs.cloud.google.com/apigee/docs/api-platform/develop/attaching-and-configuring-policies-management-ui.md.txt#attaching-a-policy-to-a-flow) in the configuration, an icon now displays next to that policy in the Proxy Editor side navigation to signify that the policy is currently unused in the proxy or sharedflow.

## September 12, 2025

**Apigee X** Security

| Bug ID | Description |
|---|---|
| **N/A** | **Security fix for `apigee-runtime`.** |

Announcement On September 12, 2025, we released an updated version of Apigee (1-16-0-apigee-2).

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

## September 11, 2025

**Apigee API hub** Change **API hub navigation update**

The **API hub** section is now moved to the top level of the Apigee left navigation menu. This change improves discoverability and access to the API hub features.
Libraries Updated Go client library. For more information, see [apihub: v0.2.0](https://github.com/googleapis/google-cloud-go/releases/tag/apihub/v0.2.0).
**Apigee X** Change **API hub navigation update**

The **API hub** section is now moved to the top level of the Apigee left navigation menu. This change improves discoverability and access to the API hub features.

## September 09, 2025

**Apigee X** Announcement On September 9, 2025, we released an updated version of Apigee (1-16-0-apigee-1).

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Change

| Bug ID | Description |
|---|---|
| **N/A** | **Updates to security infrastructure and libraries.** |

## September 08, 2025

**Apigee API hub** Feature **Enable and disable semantic search**

You can now enable and disable semantic search from the **API hub \> Settings\> Actions** page in the Google Cloud console.

For more information, see [Enable and disable semantic search](https://docs.cloud.google.com/apigee/docs/apihub/search-apis.md.txt#enable-semantic-search).
Deprecated **Deprecation of Vertex AI Extensions in API hub**

The Vertex AI Extensions feature is no longer supported in API hub as of **September 8, 2025**.
Change **Automatic discovery of OpenAPI Spec from Apigee proxy resources**

API hub now automatically discovers and ingests valid OpenAPI specifications when they are included in an Apigee API proxy resource. This applies to all new and existing Apigee and Apigee hybrid runtime projects that are attached in API hub.

For more information, see [Auto-discovery of OpenAPI specs from Apigee proxies](https://docs.cloud.google.com/apigee/docs/apihub/auto-register-apigee-proxies#auto-oas-discovery).
**Apigee Integrated Portal** Announcement On September 8, 2025 we released a new version of the Apigee integrated portal.
Feature Workforce Identity Federation users can now manage Integrated Portals using the Apigee Cloud console. This previous limitation has been removed from [Accessing features only available in the Classic Apigee UI](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/workforce-identity-federation-apigee.md.txt#accessing-features-only-available-in-the-classic-apigee-ui).

## September 04, 2025

**Apigee X** Announcement On September 4, 2025, we released an updated version of Apigee.
Feature **Apigee policies for LLM/GenAI workloads are Generally Available (GA)**

Four new Apigee policies supporting LLM/GenAI workloads are now [GA](https://cloud.google.com/products#product-launch-stages):

- [SemanticCacheLookup policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/semantic-cache-lookup-policy.md.txt)
- [SemanticCachePopulate policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/semantic-cache-populate-policy.md.txt)
- [SanitizeUserPrompt](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/sanitize-user-prompt-policy.md.txt)
- [SanitizeModelResponse](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/sanitize-user-prompt-policy.md.txt)

The Apigee semantic caching policies enable intelligent response reuse based on semantic similarity. Using these policies in your Apigee API proxies can minimize redundant backend API calls, reduce latency, and lower operational costs. With this release, the semantic caching policies support URL templating, enabling the use of variables for AI model endpoint values.

The Model Armor policies protect your AI applications by sanitizing user prompts to and responses from large language models (LLMs). Using these policies in your Apigee API proxies can mitigate the risks associated with LLM usage by leveraging Model Armor to detect prompt injection, prevent jailbreak attacks, apply responsible AI filters, filter malicious URLs, and protect sensitive data.

For more information on using these policies in your Apigee API proxies, see:

- [Get started with semantic caching policies](https://docs.cloud.google.com/apigee/docs/api-platform/tutorials/using-semantic-caching-policies.md.txt)
- [Get started with Apigee Model Armor policies](https://docs.cloud.google.com/apigee/docs/api-platform/tutorials/using-model-armor-policies.md.txt)

## September 03, 2025

**Apigee X** Feature **Apigee Server-Sent Events (SSE) and EventFlows are supported for use with the Apigee Extension Processor.**

The Apigee SSE feature enables continuous response streaming from server-sent event (SSE) endpoints to clients in real time. To learn more about this feature, see [Streaming server-sent events](https://docs.cloud.google.com/apigee/docs/api-platform/develop/server-sent-events.md.txt).

The Apigee Extension Processor is a [traffic extension](https://docs.cloud.google.com/service-extensions/docs/overview.md.txt#integration-lb) that lets you use Cloud Load Balancing to send callouts from the data processing path of the application load balancer to the Apigee Extension Processor. To learn more, see the [Apigee Extension Processor overview](https://docs.cloud.google.com/apigee/docs/api-platform/service-extensions/extension-processor-overview.md.txt).
Announcement On September 3, 2025, we released an updated version of Apigee.

## September 01, 2025

**Apigee API hub** Change **New API versions view**

API version information is now available as a separate tab in the **API details** page. You can view your API version details, copy API ID, create new API versions and more using the API versions tab.

For more information, see [Manage versions](https://docs.cloud.google.com/apigee/docs/apihub/manage-versions.md.txt).

## August 27, 2025

**Apigee X** Security

| Bug ID | Description |
|---|---|
| **427752569** | **Security fix for Apigee infrastructure.** This addresses the following vulnerabilities: - [CVE-2025-22872](https://nvd.nist.gov/vuln/detail/CVE-2025-22872) - [CVE-2025-22870](https://nvd.nist.gov/vuln/detail/CVE-2025-22870) - [CVE-2025-22868](https://nvd.nist.gov/vuln/detail/CVE-2025-22868) - [CVE-2025-22869](https://nvd.nist.gov/vuln/detail/CVE-2025-22869) |

Announcement On August 27, 2025, we released an updated version of Apigee (1-15-0-apigee-9).

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Fixed

| Bug ID | Description |
|---|---|
| **420901514** | **Enhanced WebSocket authentication.** |
| **429245088** | **Implemented option to override endpoints in the PublishMessage policy.** |
| **405039175** | **Resolved issue causing duplicate x-b3-\* headers when Distributed Trace is enabled.** |
| **378686709** | **Resolved issue causing unexpected `404` errors when using wildcards in proxy basepaths.** |
| **429245268** | **Implemented option to override endpoints in the MessageLogging policy.** |
| **N/A** | **Updates to security infrastructure and libraries.** |

## August 26, 2025

**Apigee UI** Announcement On August 26, 2025, we released an updated version of the Apigee UI.
Feature **Added Display name column to Apps table**

Added a column to the [Apps table](https://docs.cloud.google.com/apigee/docs/api-platform/publish/creating-apps-surface-your-api.md.txt#register) to show the App display name separate from the App name. The **App name** column will no longer show the display name if one is set. Instead the display name will appear in the new **Display name** column. You can also now filter by the **App name** and **Display name** independently.
Feature **Debug view settings are now retained when switching between transactions**

When switching between transactions in the debug view the following view settings are now retained:

- The state of the expand all toggle
- The zoom level of the graph
- The positioning of the viewport in the graph (best effort). This may be modified due to discrepancies in between the transactions
- The search filter. The active match will go into an indeterminate when switching transactions.

## August 25, 2025

**Apigee Advanced API Security** Announcement On August 25, 2025 we released an updated version of Advanced API Security

**Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the feature available until the rollout is complete.
Feature **Additional details and explanations for incidents and traffic identified as anomalous in Abuse Detection Advanced Anomaly Detection**

Starting with this release, additional details are available for anomalies detected in incidents and detected traffic, including details on why traffic was flagged as anomalous, the days and times it triggered, time series charts showing anomalous traffic spikes, and direct links to the Google Cloud Logging for events.

See the [Abuse detection "Details view"](https://docs.cloud.google.com/apigee/docs/api-security/abuse-detection.md.txt#details-view) for more information.
**Apigee Integrated Portal** Announcement On August 25, 2025 we released a new version of the Apigee integrated portal.

This release includes general improvements to performance and availability.

## August 22, 2025

**Apigee API hub** Feature **Deprovision API hub in the UI**

You can now deprovision an API hub instance from the **API hub \> Settings \> Actions** page in the Google Cloud console.

For more information, see [Deprovision Apigee API hub](https://docs.cloud.google.com/apigee/docs/apihub/deprovision.md.txt).
Feature **Create and delete custom plugins in the UI**

You can now create and delete custom plugins from the **API hub \> Settings \> Plugins** page in the Google Cloud console.

For more information, see [Create custom plugins](https://docs.cloud.google.com/apigee/docs/apihub/create-custom-plugins) and [Manage custom plugins](https://docs.cloud.google.com/apigee/docs/apihub/manage-custom-plugins.md.txt).

## August 20, 2025

**Apigee UI** Announcement On August 20, 2025, we released an updated version of the Apigee UI.
Feature **Added Name column to API Products table**

Added a column to the [API Products table](https://docs.cloud.google.com/apigee/docs/api-platform/publish/create-api-products.md.txt#productdetails) to display the product name. You can now filter and sort by the product name. The link to the API product detail page is now in the **Name** column instead of the **Display Name** column.

## August 12, 2025

**Apigee API hub** Feature **API observations in API hub ([Preview](https://cloud.google.com/products#product-launch-stages))**

API observations in API hub helps you tackle the challenges of undocumented and unmanaged APIs in your API infrastructure. It leverages Apigee [shadow API discovery](https://docs.cloud.google.com/apigee/docs/api-observation/shadow-api-discovery.md.txt) and uses automated discovery processes to bring all your APIs, **across Google Cloud projects**, into a unified, managed view.

For more information, see [API observations in API hub](https://docs.cloud.google.com/apigee/docs/apihub/api-observation-overview.md.txt).

> [!NOTE]
> **Note:** Rollouts of this feature will begin today, and may take five or more business days to be completed across all Google Cloud zones. You may not be able to view or use API observations until the rollout is complete.

**Apigee UI** Announcement On August 12, 2025, we released an updated version of the Apigee UI.
Feature **Added path column to Debug transaction table**

A new column has been added to the [transactions table](https://docs.cloud.google.com/apigee/docs/api-platform/debug/trace.md.txt#create) in the Debug view that specifies the path that was used by the transaction to call the proxy.
Fixed

| Bug ID | Description |
|---|---|
| **421974963** | **Adjusted tooltip positions in Debug sequence view** The tooltips for response items in the Debug sequence view now appear at the bottom of the element, so as not to block the elements above. |
| **421975987** | **You can no longer pan away from the graph in the Debug canvas** The Debug canvas is now restricted and will no longer allow you to pan away from the graph. The scroll wheel on the mouse can now also be used to zoom in and out of the graph. |
| **421975987** | **Debug canvas no longer automatically centers when event elements are clicked** When clicking an element in the Debug canvas the canvas will no longer automatically center on the selected item. |

## August 11, 2025

**Apigee Advanced API Security** Announcement On August 11, 2025 we released an updated version of Advanced API Security Abuse Detection

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the feature available until the rollout is complete.

Feature **Improved performance when viewing IP address-specific details for abuse detection incidents**

With this release, the IP address detail information for abuse incidents displays more quickly for IP addresses with high traffic volumes, potentially reducing load times from minutes to seconds.

For usage information, see the [Abuse Detection incident detail documentation](https://docs.cloud.google.com/apigee/docs/api-security/abuse-detection.md.txt#incident-details).

## August 06, 2025

**Apigee Advanced API Security** Announcement On August 6, 2025 we released an updated version of Advanced API Security

**Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the feature available until the rollout is complete.
Feature **Availability of Shadow API Discovery for APIs in any Google Cloud project**

Using Shadow API Discovery, you can find undocumented/shadow APIs in your existing cloud infrastructure. Shadow APIs pose a security risk to your system, since they might be unsecured, unmonitored, and unmaintained.

With this release, you can configure and run API observation jobs in any Google Cloud project, without needing to provision Apigee in that project. You can also centrally view the results of API observation jobs and compare discovered API endpoints and operations to APIs cataloged in API hub to identify shadow APIs.

See the [Shadow API Discovery overview](https://docs.cloud.google.com/apigee/docs/api-observation/shadow-api-discovery.md.txt) for information on Shadow API Discovery and how to add it to projects.

> [!NOTE]
> **Note:** Data residency is not currently supported for Shadow API Discovery. See [data residency compatibility](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/drz-concepts.md.txt#data-residency-compatibility).

## August 04, 2025

**Apigee Advanced API Security** Announcement On August 4, 2025 we announced new functionality in Advanced API Security Abuse Detection.
Feature **Terraform support for configuring Advanced API Security**

We have expanded our Terraform support for Advanced API Security, enabling you to automate the management of your security posture. You can now use Terraform to manage add-on enablement for [Subscription](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/apigee_addons_config) and [PAYG](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/apigee_environment_addons_config) environments, create [Risk Assessment security profiles](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/apigee_security_profile_v2) and [monitoring conditions](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/apigee_security_monitoring_condition), [configure IP address resolution](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/apigee_environment#client_ip_resolution_config-1), and [create security actions](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/apigee_security_action).

For information, see [Configure Advanced API Security using Terraform](https://docs.cloud.google.com/apigee/docs/api-security/enable-security.md.txt#configure-advanced-api-security-using-terraform).
**Apigee X** Announcement On August 4, 2025, we released an updated version of Apigee (1-15-0-apigee-8).

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Feature **Server-sent events and EventFlows are [Generally Available (GA)](https://cloud.google.com/products#product-launch-stages)**

Apigee supports continuous response streaming from server-sent event (SSE) endpoints to clients in real time. The Apigee SSE feature is useful for handling large language model (LLM) APIs that operate most effectively by streaming their responses back to the client. SSE streaming reduces latency, and clients can receive response data as soon as it is generated by an LLM. This feature supports the use of AI agents that operate in real time environments, such as customer service bots or workflow orchestrators. For more information, see [Streaming server-sent events](https://docs.cloud.google.com/apigee/docs/api-platform/develop/server-sent-events.md.txt).

Streaming from SSE endpoints is available in Apigee and in Apigee hybrid v1.15.0 and newer.
Fixed

| Bug ID | Description |
|---|---|
| **435620966** | **Fixed a regression that occurred when upgrading from ASM 1.22 to 1.23 that resulted in 503 errors.** |
| **422195061** | **Enhanced cache lookup performance.** |
| **269573358** | **Resolved issue with OASValidation policy schema references for parameters without body validation** The OASValidation policy correctly resolves and validates schemas passed by reference (`$ref`) for header, path, and query parameters, even when the \<ValidateMessageBody\> flag is set to `false`. |
| **421141062** | **Increased OAS validation limit to 20MB in JSON payloads to prevent validation failures.** |
| **417200603** | **Improved API connection stability to prevent premature timeouts for long-running requests.** |
| **423597917** | **`POST` operations for AppGroupApp keys updated** `POST` operations for AppGroup app keys now insert scopes and attributes instead of appending these values. This behavior is consistent with `POST` operations for companies in Apigee Edge for Public Cloud. |
| **390234048** | **Resolved issue resulting in missing fields in API responses for Monetization rate plans** The `createdAt` and `lastModifiedAt` fields are now present in responses from the `organizations.apiproducts.rateplans` API. |
| **422757662** | **Reverted problematic commit regarding X-b3 trace headers send when using distributed tracing.** |
| **409048431** | **Fixed a SAML signature verification bypass vulnerability.** |
| **N/A** | **Updates to security infrastructure and libraries.** |

## July 31, 2025

**Apigee API hub** Feature **New data source support for plugins**

API hub now supports importing API metadata through new dedicated plugins for the following data sources:

1. [Apigee Edge Public Cloud](https://docs.apigee.com/api-platform/get-started/apigee-edge-uapim)
2. [Apigee Edge Private Cloud (OPDK)](https://docs.apigee.com/private-cloud/v4.53.00/privatecloud-uapim-overview)

For more information, see [Plugins overview](https://docs.cloud.google.com/apigee/docs/apihub/plugins.md.txt).
Feature **Create custom plugins \[API only\]**

You can now use the `Create Plugin` API to create custom plugins in API hub. Custom plugins are created manually to connect API hub to a specific API data source.

For more information, see [Create custom plugins](https://docs.cloud.google.com/apigee/docs/apihub/create-custom-plugins).
Feature **Push-based plugin ingestion**

API hub now supports push-based plugin ingestion. This method allows for more real-time synchronization of API metadata. All new **Apigee, Apigee hybrid, Apigee Edge Public Cloud, and Apigee Edge Private Cloud (OPDK)** plugins are created with push-based ingestion by default.

For more information, see [Plugin data ingestion methods](https://docs.cloud.google.com/apigee/docs/apihub/plugins.md.txt#plugin-data-ingestion-methods).

> [!NOTE]
> **Note:** Rollouts of this feature will begin today, and may take five or more business days to be completed across all Google Cloud zones. You may not be able to create push-based plugins until the rollout is complete.

Issue **Default Apigee plugin instance not auto-created during runtime attachment**

**Issue:** When provisioning API hub as part of Apigee provisioning, the default `Apigee X and hybrid` plugin instance is not automatically created. This prevents API proxies from being auto-registered.

**Workaround:** You can manually attach an Apigee runtime instance and import the Apigee assets. See [Attach a runtime project](https://docs.cloud.google.com/apigee/docs/apihub/auto-register-apigee-proxies#attach-a-runtime-project).
Change **New tutorial: Enrich API data in API hub**

A new tutorial is available for enriching API data in Apigee API hub.

It shows you how to use API hub's custom curation features to automatically fetch OpenAPI specifications from a Cloud Storage bucket and associate them with their corresponding Apigee API proxies. The custom curation logic is defined using an integration in Application Integration.

For more information, see [Enrich API data with custom curation in API hub](https://docs.cloud.google.com/apigee/docs/apihub/tutorials/enrich-api-data.md.txt).
Change **Provisioning changes and Apigee API proxy registration**

API hub changed how it registers API proxies from Apigee and how it creates default plugin instances during provisioning.

API hub now automatically creates a default `Apigee X and hybrid` plugin instance and auto-registers API proxies only when you provision it as part of Apigee provisioning.

If you provision API hub directly from the API hub UI, API hub does not automatically create a default plugin instance, nor does it auto-register proxies.

For more information, see [Project attachments and plugins](https://docs.cloud.google.com/apigee/docs/apihub/auto-register-apigee-proxies#project-associations-and-plugins).
Change **Delete plugin instance changes**

API hub no longer retains any ingested metadata from a plugin after its deletion. Deleting a plugin instance also permanently deletes all the associated API data from API hub.

For more information, see [Delete a plugin instance](https://docs.cloud.google.com/apigee/docs/apihub/manage-plugin-instances.md.txt#delete-plugin-instance).
Deprecated **Deprecation of pull-based ingestion for Apigee plugins**

[Pull-based ingestion](https://docs.cloud.google.com/apigee/docs/apihub/plugins.md.txt#plugin-data-ingestion-methods) is no longer supported for `Apigee and Apigee hybrid` plugins as of **July 31, 2025** . For existing projects that have pull-based Apigee X and hybrid plugins configured, these plugins will continue to function and will be automatically migrated to the push-based type starting **August 2025**.
Deprecated **Deprecation of Apigee proxy deployment attributes**

As of **July 31st, 2025** , the `Apigee X and Hybrid Environment` and `Apigee X and Hybrid Organization` attributes will no longer be added to new Apigee proxy deployments. This change specifically applies when you import deployments into API hub by attaching a runtime project.

If your existing projects use these attributes in filtered search queries, we recommend updating them. To ensure your searches continue to work, use the `Source project` and `Source environment` fields as alternatives.

## July 30, 2025

**Apigee UI** Announcement On July 30, 2025 we began redirecting the following Apigee Classic UI navigation items to Apigee UI in the Google Cloud console:

- Develop \> API Proxies
- Develop \> Shared Flows
- Develop \> Offline Debug

See [Apigee UI in Cloud console navigation](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/ui-overview.md.txt#console-compare) for a mapping of each Classic Apigee UI feature page to its location in the Apigee UI in Cloud console.

See [Apigee Classic UI shutdown](https://docs.cloud.google.com/apigee/docs/deprecations/apigee-classic-ui.md.txt) for details on shutdown dates.

If you require more time to transition to the Google Cloud console, submit the [exception request form](https://docs.google.com/forms/d/e/1FAIpQLSedFe2Pj2f9B8YxD7cgWOyf8-IjRA8IhRZpZ2jXMZ9DU1uz1g/viewform) by Aug 15, 2025.
**Apigee X** Announcement On July 30, 2025 we began redirecting the following Apigee Classic UI navigation items to Apigee UI in the Google Cloud console:

- Develop \> API Proxies
- Develop \> Shared Flows
- Develop \> Offline Debug

See [Apigee UI in Cloud console navigation](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/ui-overview.md.txt#console-compare) for a mapping of each Classic Apigee UI feature page to its location in the Apigee UI in Cloud console.

See [Apigee Classic UI shutdown](https://docs.cloud.google.com/apigee/docs/deprecations/apigee-classic-ui.md.txt) for details on shutdown dates.

If you require more time to transition to the Google Cloud console, submit the [exception request form](https://docs.google.com/forms/d/e/1FAIpQLSedFe2Pj2f9B8YxD7cgWOyf8-IjRA8IhRZpZ2jXMZ9DU1uz1g/viewform) by Aug 15, 2025.

## July 29, 2025

**Apigee UI** Announcement On July 29, 2025 we removed the **Switch to Classic** option from the following Apigee UI in the Google Cloud console pages:

- API Proxy
- Shared Flow
- Offline Debug detail

This is part of the Apigee Classic UI shutdown plan.

See [Apigee UI in Cloud console navigation](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/ui-overview.md.txt#console-compare) for a mapping of each Classic Apigee UI feature page to its location in the Apigee UI in Cloud console.

See [Apigee Classic UI shutdown](https://docs.cloud.google.com/apigee/docs/deprecations/apigee-classic-ui.md.txt) for details on shutdown dates.

If you require more time to transition to the Google Cloud console, submit the [exception request form](https://docs.google.com/forms/d/e/1FAIpQLSedFe2Pj2f9B8YxD7cgWOyf8-IjRA8IhRZpZ2jXMZ9DU1uz1g/viewform) by Aug 15, 2025.

## July 28, 2025

**Apigee X** Feature **Server-sent events and EventFlows are [Generally Available (GA)](https://cloud.google.com/products#product-launch-stages)**

Apigee supports continuous response streaming from server-sent event (SSE) endpoints to clients in real time. The Apigee SSE feature is useful for handling large language model (LLM) APIs that operate most effectively by streaming their responses back to the client. SSE streaming reduces latency, and clients can receive response data as soon as it is generated by an LLM. This feature supports the use of AI agents that operate in real time environments, such as customer service bots or workflow orchestrators. For more information, see [Streaming server-sent events](https://docs.cloud.google.com/apigee/docs/api-platform/develop/server-sent-events.md.txt).

Streaming from SSE endpoints is available in Apigee and in Apigee hybrid v1.15.0 and newer.
Announcement On July 28, 2025, we released an updated version of Apigee (1-15-0-apigee-7).

> [!NOTE]
> **Note:** This release has been rolled back to address am issue. See entry for [August 4, 2025](https://docs.cloud.google.com/apigee/docs/release-notes.md.txt#August_04_2025) for the updated version number and payload.

Fixed

| Bug ID | Description |
|---|---|
| **422195061** | **Enhanced cache lookup performance.** |
| **269573358** | **Resolved issue with OASValidation policy schema references for parameters without body validation** The OASValidation policy correctly resolves and validates schemas passed by reference (`$ref`) for header, path, and query parameters, even when the \<ValidateMessageBody\> flag is set to `false`. |
| **421141062** | **Increased OAS validation limit to 20MB in JSON payloads to prevent validation failures.** |
| **417200603** | **Improved API connection stability to prevent premature timeouts for long-running requests.** |
| **423597917** | **`POST` operations for AppGroupApp keys updated** `POST` operations for AppGroup app keys now insert scopes and attributes instead of appending these values. This behavior is consistent with `POST` operations for companies in Apigee Edge for Public Cloud. |
| **390234048** | **Resolved issue resulting in missing fields in API responses for Monetization rate plans** The `createdAt` and `lastModifiedAt` fields are now present in responses from the `organizations.apiproducts.rateplans` API. |
| **422757662** | **Reverted problematic commit regarding X-b3 trace headers send when using distributed tracing.** |
| **409048431** | **Fixed a SAML signature verification bypass vulnerability.** |
| **N/A** | **Updates to security infrastructure and libraries.** |

## July 24, 2025

**Apigee Integrated Portal** Announcement On July 24, 2025 we began redirecting the following Apigee Classic UI navigation items to Apigee UI in the Google Cloud console:

- Publish \> Portals

See [Apigee UI in Cloud console navigation](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/ui-overview.md.txt#console-compare) for a mapping of each Classic Apigee UI feature page to its location in the Apigee UI in Cloud console.

See [Apigee Classic UI shutdown](https://docs.cloud.google.com/apigee/docs/deprecations/apigee-classic-ui.md.txt) for details on shutdown dates.

If you require more time to transition to the Google Cloud console, submit the [exception request form](https://docs.google.com/forms/d/e/1FAIpQLSedFe2Pj2f9B8YxD7cgWOyf8-IjRA8IhRZpZ2jXMZ9DU1uz1g/viewform) by Aug 15, 2025.
**Apigee UI** Announcement On July 24, 2025 we began redirecting the following Apigee Classic UI navigation items to Apigee UI in the Google Cloud console:

- Publish \> Portals

See [Apigee UI in Cloud console navigation](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/ui-overview.md.txt#console-compare) for a mapping of each Classic Apigee UI feature page to its location in the Apigee UI in Cloud console.

See [Apigee Classic UI shutdown](https://docs.cloud.google.com/apigee/docs/deprecations/apigee-classic-ui.md.txt) for details on shutdown dates.

If you require more time to transition to the Google Cloud console, submit the [exception request form](https://docs.google.com/forms/d/e/1FAIpQLSedFe2Pj2f9B8YxD7cgWOyf8-IjRA8IhRZpZ2jXMZ9DU1uz1g/viewform) by Aug 15, 2025.
**Apigee X** Announcement On July 24, 2025 we began redirecting the following Apigee Classic UI navigation items to Apigee UI in the Google Cloud console:

- Publish \> Portals

See [Apigee UI in Cloud console navigation](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/ui-overview.md.txt#console-compare) for a mapping of each Classic Apigee UI feature page to its location in the Apigee UI in Cloud console.

See [Apigee Classic UI shutdown](https://docs.cloud.google.com/apigee/docs/deprecations/apigee-classic-ui.md.txt) for details on shutdown dates.

If you require more time to transition to the Google Cloud console, submit the [exception request form](https://docs.google.com/forms/d/e/1FAIpQLSedFe2Pj2f9B8YxD7cgWOyf8-IjRA8IhRZpZ2jXMZ9DU1uz1g/viewform) by Aug 15, 2025.

## July 22, 2025

**Apigee API hub** Change **API hub deprovisioning changes**

Deprovisioning an API hub instance now also deletes any associated Apigee organizations from your Google Cloud project, provided those Apigee organizations have no Apigee instances.

If you deprovision an API hub instance, you can reprovision it later, but you'll need to wait 7 days before you can do so.

For more information, see [Deprovision Apigee API hub](https://docs.cloud.google.com/apigee/docs/apihub/deprovision.md.txt).
Change **VPC Service Controls (VPC-SC) is GA**

VPC Service Controls in API hub is now [GA](https://cloud.google.com/products#product-launch-stages).

For more information, see [VPC Service Controls for API hub](https://docs.cloud.google.com/apigee/docs/apihub/vpc-service-control.md.txt).
Change **API hub provisioning now enables Apigee API**

When you provision API hub, it now enables the Apigee API (`apigee.googleapis.com`) in your Google Cloud project. If Apigee isn't already provisioned, an Apigee organization is also automatically created in your project as part of the provisioning process.

API hub remains a free service. Enabling the Apigee API has no additional pricing or billing implications for your project.

For more information, see [Provision API hub in the Cloud console](https://docs.cloud.google.com/apigee/docs/apihub/provision.md.txt).

## July 18, 2025

**Apigee API hub** Feature **Apigee and hybrid plugin instance management**

You can now create and delete plugin instances for Apigee and Apigee Hybrid while associating the respective Apigee runtime projects to API hub.

For more information, see [Auto-register Apigee proxies](https://docs.cloud.google.com/apigee/docs/apihub/auto-register-apigee-proxies).
Breaking **Apigee and Apigee hybrid plugin creation now requires source project ID**

When creating new instances of the **Apigee X and hybrid** plugin, you must now provide a source project ID. This source project ID is the Google Cloud project from which the plugin will import data.

This is a breaking change and will affect any existing API calls that create these plugins without explicitly providing this ID.

**Action Required:** Update your API calls to include the appropriate source project ID when creating new Apigee X and hybrid plugins. Failing to do so will result in creation errors.
Change **Edit plugin instances changes**

You can now change or modify the name and curation logic of your plugin instance.

For more information, see [Edit a plugin instance](https://docs.cloud.google.com/apigee/docs/apihub/manage-plugin-instances.md.txt#edit-plugin-instance).
Change **Resource URI format for Apigee deployments**

To ensure optimal functionality and consistency while creating or updating **Apigee** deployments, we now recommend that the **Resource URI** conforms to the following format:
`organizations/([^/]+)/environments/([^/]+)/apis/([^/]+)$`

For more information, see [Introduction to deployments](https://docs.cloud.google.com/apigee/docs/apihub/deployments-intro.md.txt).

## July 14, 2025

**Apigee Advanced API Security** Announcement On July 14, 2025 we released an updated version of Advanced API Security

**Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the feature available until the rollout is complete.
Feature **Support for editing and deleting security actions**

With this release you can edit and delete existing security actions using either the UI or the Apigee Management APIs.

For usage information, see the [security actions documentation](https://docs.cloud.google.com/apigee/docs/api-security/security-actions.md.txt).

## July 09, 2025

**Apigee hybrid** v1.13.4 Announcement

### hybrid v1.13.4

On July 9, 2025 we released an updated version of the Apigee hybrid software, 1.13.4.

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.13](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/big-picture.md.txt).

> [!NOTE]
> **Note:** if you are upgrading to Apigee hybrid version 1.13.4 from version 1.13.2 or earlier, see [APPENDIX: Validate policies after upgrade to 1.13.3 or later](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/upgrade.md.txt#recommended-actions-upgrade-1133) for steps to address stricter class instantiation checks introduced in [version 1.13.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1133).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Fixed

| Bug ID | Description |
|---|---|
| **420675540** | **Fixed Cassandra based replication for runtime contracts in synchronizer.** |
| **401746333** | **Fixed a `java.lang.ClassCircularityError` that could occur in Java Callouts due to an issue with the class loading mechanism.** |
| **382565315** | **A memory leak within the Security Policy has been addressed, improving system stability.** |
| **375360455** | **Updated apigee-runtime drain timeout to 300s to fix connection termination issue during pod termination.** |

Security

| Bug ID | Description |
|---|---|
| **396944778** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2025-25193](https://nvd.nist.gov/vuln/detail/CVE-2025-25193) - [CVE-2025-24970](https://nvd.nist.gov/vuln/detail/CVE-2025-24970) - [CVE-2025-23184](https://nvd.nist.gov/vuln/detail/CVE-2025-23184) - [CVE-2024-47554](https://nvd.nist.gov/vuln/detail/CVE-2024-47554) |
| **392934392** | **Security fixes for `apigee-logger`.** |
| **N/A** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerability: - [CVE-2024-20952](https://nvd.nist.gov/vuln/detail/CVE-2024-20952) |
| **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** This addresses the following vulnerability: - [CVE-2024-20952](https://nvd.nist.gov/vuln/detail/CVE-2024-20952) |
| **N/A** | **Security fixes for `apigee-redis`.** This addresses the following vulnerabilities: - [CVE-2022-24834](https://nvd.nist.gov/vuln/detail/CVE-2022-24834) - [CVE-2022-24735](https://nvd.nist.gov/vuln/detail/CVE-2022-24735) |
| **N/A** | **Security fixes for `apigee-runtime`.** This addresses the following vulnerability: - [CVE-2024-20952](https://nvd.nist.gov/vuln/detail/CVE-2024-20952) |
| **N/A** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerability: - [CVE-2024-20952](https://nvd.nist.gov/vuln/detail/CVE-2024-20952) |
| **N/A** | **Security fixes for `vault`.** This addresses the following vulnerability: - [CVE-2025-0377](https://nvd.nist.gov/vuln/detail/CVE-2025-0377) |

## July 01, 2025

**Apigee Advanced API Security** Announcement On July 1, 2025 we released a new version of Advanced API Security Abuse Detection.

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the feature available until the rollout is complete.

Feature **Support for AppGroups in Abuse Detection attributes**

Abuse Detection incidents and detected traffic now show information on AppGroups and AppGroup apps when the AppGroup is part of the request or traffic.

**Note:** This functionality is not available in Apigee hybrid at this time.

For usage information, see the [Abuse Detection documentation](https://docs.cloud.google.com/apigee/docs/api-security/abuse-detection.md.txt#incident-details).

## June 25, 2025

**Apigee UI** Announcement On June 25, 2025 we began redirecting the following Apigee Classic UI navigation items to Apigee UI in the Google Cloud console:

- Publish \> API products
- Publish \> Developers
- Publish \> Apps
- Admin \> Instances
- Admin \> Data collectors
- Admin \> Environments
- Admin \> Endpoint attachments

See [Apigee UI in Cloud console navigation](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/ui-overview.md.txt#console-compare) for a mapping of each Classic Apigee UI feature page to its location in the Apigee UI in Cloud console.

See [Apigee Classic UI shutdown](https://docs.cloud.google.com/apigee/docs/deprecations/apigee-classic-ui.md.txt) for details on shutdown dates.

If you require more time to transition to the Google Cloud console, submit the [exception request form](https://docs.google.com/forms/d/e/1FAIpQLSedFe2Pj2f9B8YxD7cgWOyf8-IjRA8IhRZpZ2jXMZ9DU1uz1g/viewform) by Aug 15, 2025.
**Apigee X** Announcement On June 25, 2025 we began redirecting the following Apigee Classic UI navigation items to Apigee UI in the Google Cloud console:

- Publish \> API products
- Publish \> Developers
- Publish \> Apps
- Admin \> Instances
- Admin \> Data collectors
- Admin \> Environments
- Admin \> Endpoint attachments

See [Apigee UI in Cloud console navigation](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/ui-overview.md.txt#console-compare) for a mapping of each Classic Apigee UI feature page to its location in the Apigee UI in Cloud console.

See [Apigee Classic UI shutdown](https://docs.cloud.google.com/apigee/docs/deprecations/apigee-classic-ui.md.txt) for details on shutdown dates.

If you require more time to transition to the Google Cloud console, submit the [exception request form](https://docs.google.com/forms/d/e/1FAIpQLSedFe2Pj2f9B8YxD7cgWOyf8-IjRA8IhRZpZ2jXMZ9DU1uz1g/viewform) by Aug 15, 2025.

## June 23, 2025

**Apigee Analytics** Announcement On June 23, 2025 we released an updated version of Apigee.
Announcement On June 23, 2025 we released an updated version of Apigee.
Feature **Addition of AppGroup-specific Analytics dimensions for Custom Reports**

This release introduces two new AppGroups Analytics dimensions: `AppGroup Name` and `AppGroup App Name`.

Use these dimensions with [custom reports and report jobs](https://docs.cloud.google.com/apigee/docs/api-platform/analytics/create-custom-reports.md.txt) to group metrics by a specific AppGroup or a specific app within an AppGroup.

For additional information see [Analytics dimensions](https://docs.cloud.google.com/apigee/docs/api-platform/analytics/analytics-reference.md.txt#dimensions) and [Creating and managing custom reports](https://docs.cloud.google.com/apigee/docs/api-platform/analytics/create-custom-reports.md.txt).
Feature **Addition of AppGroup-specific Analytics dimensions for Custom Reports**

This release introduces two new AppGroups Analytics dimensions: `AppGroup Name` and `AppGroup App Name`.

Use these dimensions with [custom reports and report jobs](https://docs.cloud.google.com/apigee/docs/api-platform/analytics/create-custom-reports.md.txt) to group metrics by a specific AppGroup or a specific app within an AppGroup.

For additional information see [Analytics dimensions](https://docs.cloud.google.com/apigee/docs/api-platform/analytics/analytics-reference.md.txt#dimensions) and [Creating and managing custom reports](https://docs.cloud.google.com/apigee/docs/api-platform/analytics/create-custom-reports.md.txt).
**Apigee Integrated Portal** Announcement On June 23, 2025 we released a new version of the Apigee integrated portal.

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the feature available until the rollout is complete.

Feature This release adds the **Export** feature to the Apigee UI in the Cloud console. You can now export publishing data for developers, apps, or API products as a comma-separated values (CSV) file or JSON file.

**Documentation:** [Exporting publishing data](https://docs.cloud.google.com/apigee/docs/api-platform/publish/adding-developers-your-api-product.md.txt#export)

## June 17, 2025

**Apigee UI** Announcement On June 17, 2025 we began redirecting the following Apigee Classic UI navigation items to Apigee UI in the Google Cloud console:

- Publish \> Monetization
- Analyze \> API monitoring
- Analyze \> API metrics
- Analyze \> Developers \> Developer Engagement
- Analyze \> Developers \> Traffic Composition
- Analyze \> End Users \> Devices
- Analyze \> End Users \> Geomap
- Analyze \> Custom reports

See [Apigee UI in Cloud console navigation](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/ui-overview.md.txt#console-compare) for a mapping of each Classic Apigee UI feature page to its location in the Apigee UI in Cloud console.

See [Apigee Classic UI shutdown](https://docs.cloud.google.com/apigee/docs/deprecations/apigee-classic-ui.md.txt) for details on shutdown dates.

If you require more time to transition to the Google Cloud console, submit the [exception request form](https://docs.google.com/forms/d/e/1FAIpQLSedFe2Pj2f9B8YxD7cgWOyf8-IjRA8IhRZpZ2jXMZ9DU1uz1g/viewform) by Aug 15, 2025.
**Apigee X** Announcement On June 17, 2025 we began redirecting the following Apigee Classic UI navigation items to Apigee UI in the Google Cloud console:

- Publish \> Monetization
- Analyze \> API monitoring
- Analyze \> API metrics
- Analyze \> Developers \> Developer Engagement
- Analyze \> Developers \> Traffic Composition
- Analyze \> End Users \> Devices
- Analyze \> End Users \> Geomap
- Analyze \> Custom reports

See [Apigee UI in Cloud console navigation](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/ui-overview.md.txt#console-compare) for a mapping of each Classic Apigee UI feature page to its location in the Apigee UI in Cloud console.

See [Apigee Classic UI shutdown](https://docs.cloud.google.com/apigee/docs/deprecations/apigee-classic-ui.md.txt) for details on shutdown dates.

If you require more time to transition to the Google Cloud console, submit the [exception request form](https://docs.google.com/forms/d/e/1FAIpQLSedFe2Pj2f9B8YxD7cgWOyf8-IjRA8IhRZpZ2jXMZ9DU1uz1g/viewform) by Aug 15, 2025.

## June 16, 2025

**Apigee Advanced API Security** Announcement On June 16, 2025 we released a new version of Advanced API Security Abuse Detection.
Feature **API address drill down details are now available in the preview release of Advanced API Security Abuse Detection incidents in the detected traffic tab.**

This new functionality shows details related to specific API addresses when viewing detected abuse in detected traffic.

For usage information, see the [Abuse Detection customer documentation](https://docs.cloud.google.com/apigee/docs/api-security/abuse-detection.md.txt#incident-details) for incident details.
**Apigee Analytics** Announcement On June 16, 2025 we released an updated version of Apigee Analytics and the Apigee UI.
Announcement On June 16, 2025 we released an updated version of Apigee Analytics and the Apigee UI.
Feature Starting with this release, the API proxy performance dashboard includes aggregate metrics such as the average TPS (transactions per second) with each chart.

For information and usage instructions for the API proxy performance dashboard, see the [API proxy performance dashboard customer documentation](https://docs.cloud.google.com/apigee/docs/api-platform/analytics/api-proxy-performance-dashboard.md.txt).
Feature Starting with this release, the API proxy performance dashboard includes aggregate metrics such as the average TPS (transactions per second) with each chart.

For information and usage instructions for the API proxy performance dashboard, see the [API proxy performance dashboard customer documentation](https://docs.cloud.google.com/apigee/docs/api-platform/analytics/api-proxy-performance-dashboard.md.txt).

## June 04, 2025

**Apigee Advanced API Security** Announcement On June 4, 2025 we released an update to the Anomaly Detection model in Advanced API Security Abuse Detection.

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the feature available until the rollout is complete.

Feature **New model for Abuse Detection's Advanced Anomaly Detection rule**

With this release, we introduced a new and improved machine learning model for anomaly detection in Advanced API Security. This new model includes the following improvements:

- **Trained on customer-specific traffic patterns.** The new model is trained exclusively on your organization's historical API traffic data. It continues to learn from your API traffic patterns over time to increase accuracy.
- **Engineered by Google for anomaly detection.** The new model is a custom Vertex AI-based machine learning model, engineered and also used internally by Google specifically to detect anomalies in traffic patterns.

Usage requirements:

- In order to use this new model, you must explicitly opt in to allow the model to use your traffic and other data to train for anomaly detection. Note that your data is never shared with other customers for training purposes.
- The new model is not available for VPC-SC customers at this time.

The new anomaly detection model replaces the old model, with no customer-facing changes to the API or UI. Upon opting in for model training, you can expect to start seeing detected anomalies within 6 hours. If you have already opted in to allow the older version of our anomaly detection model to use your traffic data for training, you will not need to opt in again.

For more information on this model and on Abuse Detection, see [Abuse Detection customer documentation](https://docs.cloud.google.com/apigee/docs/api-security/abuse-detection.md.txt), including [Detection rules](https://docs.cloud.google.com/apigee/docs/api-security/detection-rules.md.txt).
**Apigee hybrid** v1.15.0 Announcement

### hybrid v1.15.0

On June 4, 2025 we released an updated version of the Apigee hybrid software, 1.15.0.

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.15](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a minor release: The container images used in minor releases are integrated with the Apigee hybrid Helm charts. Upgrading to a minor via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Feature **Large message payload support in Apigee hybrid**

Apigee now supports message payloads up to 30MB. You configure support for large message payloads in Apigee hybrid for individual environments or for your whole installation. See [Configure large message payload support in Apigee hybrid](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/configure-large-payload-support.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **414499328** | **`ApigeeTelemetry` could become stuck in `creating` state** (Fixed in [v1.15.0](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1150)) |
| **412324617** | **Fixed issue where Runtime container could spin at 100% cpu limit.** (Fixed in [v1.14.2](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1142)) |
| **399447688** | **API proxy deployment could become stuck in `PROGRESSING` state.** (Fixed in [v1.14.2](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1142)) |
| **396886110** | **Fixed a bug where the HPA max replicas could be lower than min.** (Fixed in [v1.14.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1141)) |
| **413708061** , **396571537** | **Rotating Cassandra credentials in Kubernetes secrets fixed for Multi-region deployments.** (Fixed in [v1.14.2](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1142)) |
| **392547038** | **Add Helm chart template checks for non-existent environments and virtualhosts.** (Fixed in [v1.14.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1141)) |
| **391861216** | **Restore for Google Cloud Platform and HYBRID Cloud Providers no longer affects system keyspaces. This fixes [Known Issue 391861216](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt#391861216).** (Fixed in [v1.14.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1141)) |
| **390258745** , **388608440** | **Any left over Cassandra snapshots are automatically removed. This fixes [known issue 388608440](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt#388608440).** (Fixed in [v1.14.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1141)) |
| **384937220** | **Fixed `ApigeeRoute` name collision on internal chaining gateway for Enhanced Proxy Limits.** (Fixed in [v1.14.2](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1142)) |
| **383441226** | **Added the following `metrics` configuration properties:** - [metrics.adapter.resources.limits.cpu](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/config-prop-ref.md.txt#metrics-adapter-resources-limits-cpu) - [metrics.adapter.resources.limits.memory](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/config-prop-ref.md.txt#metrics-adapter-resources-limits-memory) - [metrics.adapter.resources.requests.cpu](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/config-prop-ref.md.txt#metrics-adapter-resources-requests-cpu) - [metrics.adapter.resources.requests.memory](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/config-prop-ref.md.txt#metrics-adapter-resources-requests-memory) - [metrics.prometheus.resources.limits.cpu](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/config-prop-ref.md.txt#metrics-prometheus-resources-limits-cpu) - [metrics.prometheus.resources.limits.memory](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/config-prop-ref.md.txt#metrics-prometheus-resources-limits-memory) - [metrics.prometheus.resources.requests.cpu](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/config-prop-ref.md.txt#metrics-prometheus-resources-requests-cpu) - [metrics.prometheus.resources.requests.memory](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/config-prop-ref.md.txt#metrics-prometheus-resources-requests-memory) (Fixed in [v1.14.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1141)) |
| **368155212** | **Auto Cassandra secret rotation could fail when [Enhanced per-environment proxy limits](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/enhanced-proxy-limits.md.txt) are enabled.** (Fixed in [v1.14.2](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1142)) |
| **367681534** | **Tagging [`apigee-stackdriver-prometheus-sidecar`](http://gcr.io/apigee-release/hybrid/apigee-stackdriver-prometheus-sidecar:0.10.0) to prevent removal from customer repos after 2 years due to infrequent updates.** (Fixed in [1.14.0-hotfix.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_1140-hotfix1)) |

Security **Fixed in this release**

| Bug ID | Description |
|---|---|
| **N/A** | **Security fixes for `apigee-asm-ingress`.** This addresses the following vulnerability: - [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) |
| **N/A** | **Security fixes for `apigee-asm-istiod`.** This addresses the following vulnerability: - [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) |
| **N/A** | **Security fixes for `apigee-connect-agent`.** This addresses the following vulnerability: - [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) |
| **N/A** | **Security fixes for `apigee-envoy`.** This addresses the following vulnerabilities: - [CVE-2025-4802](https://nvd.nist.gov/vuln/detail/CVE-2025-4802) - [CVE-2025-0395](https://nvd.nist.gov/vuln/detail/CVE-2025-0395) |
| **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerability: - [CVE-2025-4802](https://nvd.nist.gov/vuln/detail/CVE-2025-4802) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2025-23015](https://nvd.nist.gov/vuln/detail/CVE-2025-23015) - [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** This addresses the following vulnerability: - [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) |
| **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerability: - [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) |
| **N/A** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerability: - [CVE-2022-3715](https://nvd.nist.gov/vuln/detail/CVE-2022-3715) |
| **N/A** | **Security fixes for `apigee-operators`.** This addresses the following vulnerability: - [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) |
| **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) - [CVE-2025-22869](https://nvd.nist.gov/vuln/detail/CVE-2025-22869) |
| **N/A** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerability: - [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) |
| **N/A** | **Security fixes for `apigee-redis`.** This addresses the following vulnerabilities: - [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) - [CVE-2024-24791](https://nvd.nist.gov/vuln/detail/CVE-2024-24791) |
| **N/A** | **Security fixes for `apigee-runtime`.** This addresses the following vulnerabilities: - [CVE-2025-0725](https://nvd.nist.gov/vuln/detail/CVE-2025-0725) - [CVE-2022-3715](https://nvd.nist.gov/vuln/detail/CVE-2022-3715) |
| **N/A** | **Security fixes for `apigee-stackdriver-logging-agent`.** This addresses the following vulnerabilities: - [CVE-2025-43857](https://nvd.nist.gov/vuln/detail/CVE-2025-43857) - [CVE-2025-32415](https://nvd.nist.gov/vuln/detail/CVE-2025-32415) - [CVE-2025-32414](https://nvd.nist.gov/vuln/detail/CVE-2025-32414) - [CVE-2025-27788](https://nvd.nist.gov/vuln/detail/CVE-2025-27788) - [CVE-2025-27113](https://nvd.nist.gov/vuln/detail/CVE-2025-27113) - [CVE-2024-49761](https://nvd.nist.gov/vuln/detail/CVE-2024-49761) - [CVE-2024-41946](https://nvd.nist.gov/vuln/detail/CVE-2024-41946) - [CVE-2024-41123](https://nvd.nist.gov/vuln/detail/CVE-2024-41123) - [CVE-2024-25062](https://nvd.nist.gov/vuln/detail/CVE-2024-25062) - [CVE-2023-42915](https://nvd.nist.gov/vuln/detail/CVE-2023-42915) - [CVE-2023-33953](https://nvd.nist.gov/vuln/detail/CVE-2023-33953) - [CVE-2022-34169](https://nvd.nist.gov/vuln/detail/CVE-2022-34169) - [CVE-2022-32511](https://nvd.nist.gov/vuln/detail/CVE-2022-32511) - [CVE-2022-32207](https://nvd.nist.gov/vuln/detail/CVE-2022-32207) - [CVE-2022-29181](https://nvd.nist.gov/vuln/detail/CVE-2022-29181) - [CVE-2022-28739](https://nvd.nist.gov/vuln/detail/CVE-2022-28739) - [CVE-2022-27782](https://nvd.nist.gov/vuln/detail/CVE-2022-27782) - [CVE-2022-24839](https://nvd.nist.gov/vuln/detail/CVE-2022-24839) - [CVE-2022-24836](https://nvd.nist.gov/vuln/detail/CVE-2022-24836) - [CVE-2022-23308](https://nvd.nist.gov/vuln/detail/CVE-2022-23308) - [CVE-2022-0759](https://nvd.nist.gov/vuln/detail/CVE-2022-0759) - [CVE-2021-41819](https://nvd.nist.gov/vuln/detail/CVE-2021-41819) - [CVE-2021-41817](https://nvd.nist.gov/vuln/detail/CVE-2021-41817) - [CVE-2021-4044](https://nvd.nist.gov/vuln/detail/CVE-2021-4044) - [CVE-2021-3518](https://nvd.nist.gov/vuln/detail/CVE-2021-3518) - [CVE-2021-3517](https://nvd.nist.gov/vuln/detail/CVE-2021-3517) - [CVE-2021-32740](https://nvd.nist.gov/vuln/detail/CVE-2021-32740) - [CVE-2021-32066](https://nvd.nist.gov/vuln/detail/CVE-2021-32066) - [CVE-2021-31799](https://nvd.nist.gov/vuln/detail/CVE-2021-31799) - [CVE-2021-30560](https://nvd.nist.gov/vuln/detail/CVE-2021-30560) - [CVE-2021-28966](https://nvd.nist.gov/vuln/detail/CVE-2021-28966) - [CVE-2021-28965](https://nvd.nist.gov/vuln/detail/CVE-2021-28965) - [CVE-2021-23214](https://nvd.nist.gov/vuln/detail/CVE-2021-23214) - [CVE-2021-22926](https://nvd.nist.gov/vuln/detail/CVE-2021-22926) - [CVE-2020-7595](https://nvd.nist.gov/vuln/detail/CVE-2020-7595) - [CVE-2020-25695](https://nvd.nist.gov/vuln/detail/CVE-2020-25695) - [CVE-2020-25694](https://nvd.nist.gov/vuln/detail/CVE-2020-25694) - [CVE-2020-25613](https://nvd.nist.gov/vuln/detail/CVE-2020-25613) - [CVE-2019-9193](https://nvd.nist.gov/vuln/detail/CVE-2019-9193) - [CVE-2019-3881](https://nvd.nist.gov/vuln/detail/CVE-2019-3881) - [CVE-2019-20388](https://nvd.nist.gov/vuln/detail/CVE-2019-20388) - [CVE-2019-10211](https://nvd.nist.gov/vuln/detail/CVE-2019-10211) - [CVE-2019-10210](https://nvd.nist.gov/vuln/detail/CVE-2019-10210) - [CVE-2019-10128](https://nvd.nist.gov/vuln/detail/CVE-2019-10128) - [CVE-2019-10127](https://nvd.nist.gov/vuln/detail/CVE-2019-10127) - [CVE-2018-25032](https://nvd.nist.gov/vuln/detail/CVE-2018-25032) - [CVE-2018-1115](https://nvd.nist.gov/vuln/detail/CVE-2018-1115) - [CVE-2018-10915](https://nvd.nist.gov/vuln/detail/CVE-2018-10915) - [CVE-2018-1058](https://nvd.nist.gov/vuln/detail/CVE-2018-1058) - [CVE-2018-1053](https://nvd.nist.gov/vuln/detail/CVE-2018-1053) - [CVE-2017-7546](https://nvd.nist.gov/vuln/detail/CVE-2017-7546) - [CVE-2017-7486](https://nvd.nist.gov/vuln/detail/CVE-2017-7486) - [CVE-2017-7484](https://nvd.nist.gov/vuln/detail/CVE-2017-7484) - [CVE-2017-17405](https://nvd.nist.gov/vuln/detail/CVE-2017-17405) - [CVE-2017-15098](https://nvd.nist.gov/vuln/detail/CVE-2017-15098) - [CVE-2017-14798](https://nvd.nist.gov/vuln/detail/CVE-2017-14798) - [CVE-2016-7954](https://nvd.nist.gov/vuln/detail/CVE-2016-7954) - [CVE-2016-7048](https://nvd.nist.gov/vuln/detail/CVE-2016-7048) - [CVE-2016-5424](https://nvd.nist.gov/vuln/detail/CVE-2016-5424) - [CVE-2016-5423](https://nvd.nist.gov/vuln/detail/CVE-2016-5423) - [CVE-2016-0766](https://nvd.nist.gov/vuln/detail/CVE-2016-0766) - [CVE-2015-3167](https://nvd.nist.gov/vuln/detail/CVE-2015-3167) - [CVE-2015-3166](https://nvd.nist.gov/vuln/detail/CVE-2015-3166) - [CVE-2015-0244](https://nvd.nist.gov/vuln/detail/CVE-2015-0244) - [CVE-2015-0243](https://nvd.nist.gov/vuln/detail/CVE-2015-0243) - [CVE-2015-0242](https://nvd.nist.gov/vuln/detail/CVE-2015-0242) - [CVE-2015-0241](https://nvd.nist.gov/vuln/detail/CVE-2015-0241) |
| **N/A** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2025-0725](https://nvd.nist.gov/vuln/detail/CVE-2025-0725) - [CVE-2022-3715](https://nvd.nist.gov/vuln/detail/CVE-2022-3715) |
| **N/A** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerability: - [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) |
| **N/A** | **Security fixes for `cert-manager-cainjector`.** This addresses the following vulnerabilities: - [CVE-2023-45287](https://nvd.nist.gov/vuln/detail/CVE-2023-45287) - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538) - [CVE-2023-24537](https://nvd.nist.gov/vuln/detail/CVE-2023-24537) - [CVE-2023-24536](https://nvd.nist.gov/vuln/detail/CVE-2023-24536) - [CVE-2023-24534](https://nvd.nist.gov/vuln/detail/CVE-2023-24534) - [CVE-2022-41725](https://nvd.nist.gov/vuln/detail/CVE-2022-41725) - [CVE-2022-41724](https://nvd.nist.gov/vuln/detail/CVE-2022-41724) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) - [CVE-2022-41715](https://nvd.nist.gov/vuln/detail/CVE-2022-41715) - [CVE-2022-32189](https://nvd.nist.gov/vuln/detail/CVE-2022-32189) - [CVE-2022-30635](https://nvd.nist.gov/vuln/detail/CVE-2022-30635) - [CVE-2022-30633](https://nvd.nist.gov/vuln/detail/CVE-2022-30633) - [CVE-2022-30632](https://nvd.nist.gov/vuln/detail/CVE-2022-30632) - [CVE-2022-30631](https://nvd.nist.gov/vuln/detail/CVE-2022-30631) - [CVE-2022-30630](https://nvd.nist.gov/vuln/detail/CVE-2022-30630) - [CVE-2022-30580](https://nvd.nist.gov/vuln/detail/CVE-2022-30580) - [CVE-2022-2880](https://nvd.nist.gov/vuln/detail/CVE-2022-2880) - [CVE-2022-2879](https://nvd.nist.gov/vuln/detail/CVE-2022-2879) - [CVE-2022-28327](https://nvd.nist.gov/vuln/detail/CVE-2022-28327) - [CVE-2022-28131](https://nvd.nist.gov/vuln/detail/CVE-2022-28131) - [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664) - [CVE-2022-24921](https://nvd.nist.gov/vuln/detail/CVE-2022-24921) - [CVE-2022-24675](https://nvd.nist.gov/vuln/detail/CVE-2022-24675) - [CVE-2022-23806](https://nvd.nist.gov/vuln/detail/CVE-2022-23806) - [CVE-2022-23773](https://nvd.nist.gov/vuln/detail/CVE-2022-23773) - [CVE-2022-23772](https://nvd.nist.gov/vuln/detail/CVE-2022-23772) - [CVE-2021-44716](https://nvd.nist.gov/vuln/detail/CVE-2021-44716) - [CVE-2021-41772](https://nvd.nist.gov/vuln/detail/CVE-2021-41772) - [CVE-2021-41771](https://nvd.nist.gov/vuln/detail/CVE-2021-41771) - [CVE-2021-39293](https://nvd.nist.gov/vuln/detail/CVE-2021-39293) - [CVE-2021-38297](https://nvd.nist.gov/vuln/detail/CVE-2021-38297) - [CVE-2021-33198](https://nvd.nist.gov/vuln/detail/CVE-2021-33198) - [CVE-2021-33196](https://nvd.nist.gov/vuln/detail/CVE-2021-33196) - [CVE-2021-33195](https://nvd.nist.gov/vuln/detail/CVE-2021-33195) - [CVE-2021-33194](https://nvd.nist.gov/vuln/detail/CVE-2021-33194) - [CVE-2021-29923](https://nvd.nist.gov/vuln/detail/CVE-2021-29923) - [CVE-2021-27918](https://nvd.nist.gov/vuln/detail/CVE-2021-27918) - [CVE-2020-28367](https://nvd.nist.gov/vuln/detail/CVE-2020-28367) - [CVE-2020-28366](https://nvd.nist.gov/vuln/detail/CVE-2020-28366) - [CVE-2020-28362](https://nvd.nist.gov/vuln/detail/CVE-2020-28362) - [CVE-2020-16845](https://nvd.nist.gov/vuln/detail/CVE-2020-16845) |
| **N/A** | **Security fixes for `cert-manager-controller`.** This addresses the following vulnerabilities: - [CVE-2023-45287](https://nvd.nist.gov/vuln/detail/CVE-2023-45287) - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538) - [CVE-2023-24537](https://nvd.nist.gov/vuln/detail/CVE-2023-24537) - [CVE-2023-24536](https://nvd.nist.gov/vuln/detail/CVE-2023-24536) - [CVE-2023-24534](https://nvd.nist.gov/vuln/detail/CVE-2023-24534) - [CVE-2022-41725](https://nvd.nist.gov/vuln/detail/CVE-2022-41725) - [CVE-2022-41724](https://nvd.nist.gov/vuln/detail/CVE-2022-41724) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) - [CVE-2022-41715](https://nvd.nist.gov/vuln/detail/CVE-2022-41715) - [CVE-2022-32189](https://nvd.nist.gov/vuln/detail/CVE-2022-32189) - [CVE-2022-30635](https://nvd.nist.gov/vuln/detail/CVE-2022-30635) - [CVE-2022-30633](https://nvd.nist.gov/vuln/detail/CVE-2022-30633) - [CVE-2022-30632](https://nvd.nist.gov/vuln/detail/CVE-2022-30632) - [CVE-2022-30631](https://nvd.nist.gov/vuln/detail/CVE-2022-30631) - [CVE-2022-30630](https://nvd.nist.gov/vuln/detail/CVE-2022-30630) - [CVE-2022-30580](https://nvd.nist.gov/vuln/detail/CVE-2022-30580) - [CVE-2022-2880](https://nvd.nist.gov/vuln/detail/CVE-2022-2880) - [CVE-2022-2879](https://nvd.nist.gov/vuln/detail/CVE-2022-2879) - [CVE-2022-28327](https://nvd.nist.gov/vuln/detail/CVE-2022-28327) - [CVE-2022-28131](https://nvd.nist.gov/vuln/detail/CVE-2022-28131) - [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664) - [CVE-2022-24921](https://nvd.nist.gov/vuln/detail/CVE-2022-24921) - [CVE-2022-24675](https://nvd.nist.gov/vuln/detail/CVE-2022-24675) - [CVE-2022-23806](https://nvd.nist.gov/vuln/detail/CVE-2022-23806) - [CVE-2022-23773](https://nvd.nist.gov/vuln/detail/CVE-2022-23773) - [CVE-2022-23772](https://nvd.nist.gov/vuln/detail/CVE-2022-23772) - [CVE-2021-44716](https://nvd.nist.gov/vuln/detail/CVE-2021-44716) - [CVE-2021-41772](https://nvd.nist.gov/vuln/detail/CVE-2021-41772) - [CVE-2021-41771](https://nvd.nist.gov/vuln/detail/CVE-2021-41771) - [CVE-2021-39293](https://nvd.nist.gov/vuln/detail/CVE-2021-39293) - [CVE-2021-38297](https://nvd.nist.gov/vuln/detail/CVE-2021-38297) - [CVE-2021-33198](https://nvd.nist.gov/vuln/detail/CVE-2021-33198) - [CVE-2021-33196](https://nvd.nist.gov/vuln/detail/CVE-2021-33196) - [CVE-2021-33195](https://nvd.nist.gov/vuln/detail/CVE-2021-33195) - [CVE-2021-33194](https://nvd.nist.gov/vuln/detail/CVE-2021-33194) - [CVE-2021-29923](https://nvd.nist.gov/vuln/detail/CVE-2021-29923) - [CVE-2021-27918](https://nvd.nist.gov/vuln/detail/CVE-2021-27918) - [CVE-2020-28367](https://nvd.nist.gov/vuln/detail/CVE-2020-28367) - [CVE-2020-28366](https://nvd.nist.gov/vuln/detail/CVE-2020-28366) - [CVE-2020-28362](https://nvd.nist.gov/vuln/detail/CVE-2020-28362) - [CVE-2020-16845](https://nvd.nist.gov/vuln/detail/CVE-2020-16845) |
| **N/A** | **Security fixes for `cert-manager-webhook`.** This addresses the following vulnerabilities: - [CVE-2023-45287](https://nvd.nist.gov/vuln/detail/CVE-2023-45287) - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538) - [CVE-2023-24537](https://nvd.nist.gov/vuln/detail/CVE-2023-24537) - [CVE-2023-24536](https://nvd.nist.gov/vuln/detail/CVE-2023-24536) - [CVE-2023-24534](https://nvd.nist.gov/vuln/detail/CVE-2023-24534) - [CVE-2022-41725](https://nvd.nist.gov/vuln/detail/CVE-2022-41725) - [CVE-2022-41724](https://nvd.nist.gov/vuln/detail/CVE-2022-41724) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) - [CVE-2022-41715](https://nvd.nist.gov/vuln/detail/CVE-2022-41715) - [CVE-2022-32189](https://nvd.nist.gov/vuln/detail/CVE-2022-32189) - [CVE-2022-30635](https://nvd.nist.gov/vuln/detail/CVE-2022-30635) - [CVE-2022-30633](https://nvd.nist.gov/vuln/detail/CVE-2022-30633) - [CVE-2022-30632](https://nvd.nist.gov/vuln/detail/CVE-2022-30632) - [CVE-2022-30631](https://nvd.nist.gov/vuln/detail/CVE-2022-30631) - [CVE-2022-30630](https://nvd.nist.gov/vuln/detail/CVE-2022-30630) - [CVE-2022-30580](https://nvd.nist.gov/vuln/detail/CVE-2022-30580) - [CVE-2022-2880](https://nvd.nist.gov/vuln/detail/CVE-2022-2880) - [CVE-2022-2879](https://nvd.nist.gov/vuln/detail/CVE-2022-2879) - [CVE-2022-28327](https://nvd.nist.gov/vuln/detail/CVE-2022-28327) - [CVE-2022-28131](https://nvd.nist.gov/vuln/detail/CVE-2022-28131) - [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664) - [CVE-2022-24921](https://nvd.nist.gov/vuln/detail/CVE-2022-24921) - [CVE-2022-24675](https://nvd.nist.gov/vuln/detail/CVE-2022-24675) - [CVE-2022-23806](https://nvd.nist.gov/vuln/detail/CVE-2022-23806) - [CVE-2022-23773](https://nvd.nist.gov/vuln/detail/CVE-2022-23773) - [CVE-2022-23772](https://nvd.nist.gov/vuln/detail/CVE-2022-23772) - [CVE-2021-44716](https://nvd.nist.gov/vuln/detail/CVE-2021-44716) - [CVE-2021-41772](https://nvd.nist.gov/vuln/detail/CVE-2021-41772) - [CVE-2021-41771](https://nvd.nist.gov/vuln/detail/CVE-2021-41771) - [CVE-2021-39293](https://nvd.nist.gov/vuln/detail/CVE-2021-39293) - [CVE-2021-38297](https://nvd.nist.gov/vuln/detail/CVE-2021-38297) - [CVE-2021-33198](https://nvd.nist.gov/vuln/detail/CVE-2021-33198) - [CVE-2021-33196](https://nvd.nist.gov/vuln/detail/CVE-2021-33196) - [CVE-2021-33195](https://nvd.nist.gov/vuln/detail/CVE-2021-33195) - [CVE-2021-33194](https://nvd.nist.gov/vuln/detail/CVE-2021-33194) - [CVE-2021-29923](https://nvd.nist.gov/vuln/detail/CVE-2021-29923) - [CVE-2021-27918](https://nvd.nist.gov/vuln/detail/CVE-2021-27918) - [CVE-2020-28367](https://nvd.nist.gov/vuln/detail/CVE-2020-28367) - [CVE-2020-28366](https://nvd.nist.gov/vuln/detail/CVE-2020-28366) - [CVE-2020-28362](https://nvd.nist.gov/vuln/detail/CVE-2020-28362) - [CVE-2020-16845](https://nvd.nist.gov/vuln/detail/CVE-2020-16845) |
| **N/A** | **Security fixes for `vault`.** This addresses the following vulnerability: - [CVE-2025-0377](https://nvd.nist.gov/vuln/detail/CVE-2025-0377) |

Security **Fixed since last minor release**

| Bug ID | Description |
|---|---|
| **391923260** | **Security fixes for `apigee-watcher`.** (Fixed in [v1.14.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1141)) This addresses the following vulnerabilities: - [CVE-2024-24789](https://nvd.nist.gov/vuln/detail/CVE-2024-24789) - [CVE-2024-45337](https://nvd.nist.gov/vuln/detail/CVE-2024-45337) - [CVE-2024-45338](https://nvd.nist.gov/vuln/detail/CVE-2024-45338) - [CVE-2024-24790](https://nvd.nist.gov/vuln/detail/CVE-2024-24790) - [CVE-2022-23635](https://nvd.nist.gov/vuln/detail/CVE-2022-23635) - [CVE-2022-31045](https://nvd.nist.gov/vuln/detail/CVE-2022-31045) - [CVE-2021-39156](https://nvd.nist.gov/vuln/detail/CVE-2021-39156) - [CVE-2021-39155](https://nvd.nist.gov/vuln/detail/CVE-2021-39155) - [CVE-2019-14993](https://nvd.nist.gov/vuln/detail/CVE-2019-14993) |
| **391923260** | **Security fixes for `apigee-udca`.** (Fixed in [v1.14.2](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1142)) This addresses the following vulnerabilities: - [CVE-2025-27788](https://nvd.nist.gov/vuln/detail/CVE-2025-27788) - [CVE-2025-22869](https://nvd.nist.gov/vuln/detail/CVE-2025-22869) - [CVE-2025-22868](https://nvd.nist.gov/vuln/detail/CVE-2025-22868) - [CVE-2024-45337](https://nvd.nist.gov/vuln/detail/CVE-2024-45337) - [CVE-2024-34158](https://nvd.nist.gov/vuln/detail/CVE-CVE-2024-34158) - [CVE-2024-34156](https://nvd.nist.gov/vuln/detail/CVE-CVE-2024-34156) - [CVE-2023-6481](https://nvd.nist.gov/vuln/detail/CVE-2023-6481) |
| **385394193** , **383850393** , **383778273** | **Security fixes for `apigee-cassandra-backup-utility`, `apigee-cassandra-client`, and `apigee-hybrid-cassandra`.** (Fixed in [v1.14.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1141)) This addresses the following vulnerabilities: - [CVE-2024-0727](https://nvd.nist.gov/vuln/detail/CVE-2024-0727) - [CVE-2023-5678](https://nvd.nist.gov/vuln/detail/CVE-2023-5678) - [CVE-2022-3715](https://nvd.nist.gov/vuln/detail/CVE-2022-3715) |
| **385394193** , **383850393** , **383778273** | **Security fixes for `apigee-cassandra-backup-utility`, `apigee-cassandra-client`, and `apigee-hybrid-cassandra`.** (Fixed in [v1.13.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1133)) This addresses the following vulnerabilities: - [CVE-2022-3715](https://nvd.nist.gov/vuln/detail/CVE-2022-3715) - [CVE-2024-0727](https://nvd.nist.gov/vuln/detail/CVE-2024-0727) - [CVE-2023-5678](https://nvd.nist.gov/vuln/detail/CVE-2023-5678) |
| **383113773, 382967738** | **Fixed a vulnerability in PythonScript policy.** (Fixed in [v1.14.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1141)) |
| **365178914** | **Security fixes for `apigee-cassandra-backup-utility` and `apigee-hybrid-cassandra`.** (Fixed in [v1.14.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1141)) This addresses the following vulnerability: - [CVE-2023-37920](https://nvd.nist.gov/vuln/detail/CVE-2023-37920) |
| **N/A** | **Security fixes for `apigee-watcher`.** (Fixed in [v1.14.2](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1142)) This addresses the following vulnerabilities: - [CVE-2025-22869](https://nvd.nist.gov/vuln/detail/CVE-2025-22869) - [CVE-2025-22868](https://nvd.nist.gov/vuln/detail/CVE-2025-22868) |
| **N/A** | **Security fixes for `apigee-udca`.** (Fixed in [v1.13.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1133)) This addresses the following vulnerability: - [CVE-2024-24790](https://nvd.nist.gov/vuln/detail/CVE-2024-24790) |
| **N/A** | **Security fixes for `apigee-stackdriver-logging-agent`.** (Fixed in [v1.14.2](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1142)) This addresses the following vulnerabilities: - [CVE-2025-24928](https://nvd.nist.gov/vuln/detail/CVE-2025-24928) - [CVE-2025-24855](https://nvd.nist.gov/vuln/detail/CVE-2025-24855) - [CVE-2025-0306](https://nvd.nist.gov/vuln/detail/CVE-2025-0306) - [CVE-2024-56171](https://nvd.nist.gov/vuln/detail/CVE-2024-56171) - [CVE-2024-55549](https://nvd.nist.gov/vuln/detail/CVE-2024-55549) |
| **N/A** | **Security fixes for `apigee-redis`.** (Fixed in [v1.14.2](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1142)) This addresses the following vulnerabilities: - [CVE-2025-22869](https://nvd.nist.gov/vuln/detail/CVE-2025-22869) - [CVE-2024-56171](https://nvd.nist.gov/vuln/detail/CVE-2024-56171) - [CVE-2024-24791](https://nvd.nist.gov/vuln/detail/CVE-2024-24791) |
| **N/A** | **Security fixes for `apigee-prometheus-adapter`.** (Fixed in [v1.14.2](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1142)) This addresses the following vulnerability: - [CVE-2025-22868](https://nvd.nist.gov/vuln/detail/CVE-2025-22868) |
| **N/A** | **Security fixes for `apigee-prometheus-adapter`.** (Fixed in [v1.14.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1141)) This addresses the following vulnerabilities: - [CVE-2024-45338](https://nvd.nist.gov/vuln/detail/CVE-2024-45338) - [CVE-2024-45337](https://nvd.nist.gov/vuln/detail/CVE-2024-45337) |
| **N/A** | **Security fixes for `apigee-operators`.** (Fixed in [v1.14.2](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1142)) This addresses the following vulnerabilities: - [CVE-2025-22869](https://nvd.nist.gov/vuln/detail/CVE-2025-22869) - [CVE-2025-22868](https://nvd.nist.gov/vuln/detail/CVE-2025-22868) |
| **N/A** | **Security fixes for `apigee-open-telemetry-collector`.** (Fixed in [v1.14.2](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1142)) This addresses the following vulnerabilities: - [CVE-2025-29786](https://nvd.nist.gov/vuln/detail/CVE-2025-29786) - [CVE-2025-22869](https://nvd.nist.gov/vuln/detail/CVE-2025-22869) - [CVE-2025-22868](https://nvd.nist.gov/vuln/detail/CVE-2025-22868) |
| **N/A** | **Security fixes for `apigee-open-telemetry-collector`.** (Fixed in [v1.14.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1141)) This addresses the following vulnerability: - [CVE-2024-45338](https://nvd.nist.gov/vuln/detail/CVE-2024-45338) |
| **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** (Fixed in [v1.14.2](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1142)) This addresses the following vulnerability: - [CVE-2025-21587](https://nvd.nist.gov/vuln/detail/CVE-2025-21587) |
| **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** (Fixed in [v1.14.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1141)) This addresses the following vulnerabilities: - [CVE-2025-24970](https://nvd.nist.gov/vuln/detail/CVE-2025-24970) - [CVE-2024-47535](https://nvd.nist.gov/vuln/detail/CVE-2024-47535) |
| **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** (Fixed in [v1.13.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1133)) This addresses the following vulnerability: - [CVE-2024-47535](https://nvd.nist.gov/vuln/detail/CVE-2024-47535) |
| **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** (Fixed in [v1.13.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1133)) This addresses the following vulnerabilities: - [CVE-2024-24790](https://nvd.nist.gov/vuln/detail/CVE-2024-24790) - [CVE-2019-9192](https://nvd.nist.gov/vuln/detail/CVE-2019-9192) - [CVE-2019-1010023](https://nvd.nist.gov/vuln/detail/CVE-2019-1010023) - [CVE-2019-1010022](https://nvd.nist.gov/vuln/detail/CVE-2019-1010022) - [CVE-2018-20796](https://nvd.nist.gov/vuln/detail/CVE-2018-20796) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** (Fixed in [v1.14.2](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1142)) This addresses the following vulnerability: - [CVE-2025-23015](https://nvd.nist.gov/vuln/detail/CVE-2025-23015) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** (Fixed in [v1.14.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1141)) This addresses the following vulnerability: - [CVE-2023-37920](https://nvd.nist.gov/vuln/detail/CVE-2023-37920) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** (Fixed in [v1.13.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1133)) This addresses the following vulnerability: - [CVE-2024-9287](https://nvd.nist.gov/vuln/detail/CVE-2024-9287) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** (Fixed in [v1.14.2](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1142)) This addresses the following vulnerability: - [CVE-2025-22868](https://nvd.nist.gov/vuln/detail/CVE-2025-22868) |
| **N/A** | **Security fixes for `apigee-fluent-bit`.** (Fixed in [v1.14.2](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1142)) This addresses the following vulnerabilities: - [CVE-2025-1094](https://nvd.nist.gov/vuln/detail/CVE-2025-1094) - [CVE-2025-0395](https://nvd.nist.gov/vuln/detail/CVE-2025-0395) |
| **N/A** | **Security fixes for `apigee-fluent-bit`.** (Fixed in [v1.13.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1133)) This addresses the following vulnerability: - [CVE-2024-10979](https://nvd.nist.gov/vuln/detail/CVE-2024-10979) |
| **N/A** | **Security fixes for `apigee-asm-istiod`.** (Fixed in [v1.14.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1141)) This addresses the following vulnerability: - [CVE-2024-45338](https://nvd.nist.gov/vuln/detail/CVE-2024-45338) |

## June 03, 2025

**Apigee API hub** Feature **Apigee API hub is enabled for new Apigee organizations in supported regions.**

With this release, we are enabling [Apigee API hub](https://docs.cloud.google.com/apigee/docs/apihub/what-is-api-hub.md.txt) for new Apigee organizations [in regions where API hub is supported](https://docs.cloud.google.com/apigee/docs/locations.md.txt#available-apigee-api-analytics-regions). All new Apigee organizations, including hybrid organizations, that select an API hub-supported region *for their Apigee Analytics region* during provisioning will have access to API hub features at no additional cost.

API hub allows you to view, organize, and manage all of the APIs in your Apigee organization in one central location. To learn more, see [What is Apigee API hub?](https://docs.cloud.google.com/apigee/docs/apihub/what-is-api-hub.md.txt)

No action on your part is required to provision API hub for your organization, with the following exceptions:

- If your Apigee organization has Data Residency or VPC Service Controls enabled, you must configure your API hub instance manually to support these services. See [VPC Service Controls for API hub](https://docs.cloud.google.com/apigee/docs/apihub/vpc-service-control.md.txt) and [API hub and data residency](https://docs.cloud.google.com/apigee/docs/apihub/locations.md.txt#drz-api-hub) for more information.
- If your Apigee organization uses Customer-Managed Encryption Keys (CMEK), you must deprovision the Apigee API hub instance provided by default and recreate it to support CMEK. See [Deprovision Apigee API hub](https://docs.cloud.google.com/apigee/docs/apihub/deprovision.md.txt) and [Provision API hub in the Cloud console](https://docs.cloud.google.com/apigee/docs/apihub/provision.md.txt) for step-by-step instructions.

Contact [Google Cloud Support](https://docs.cloud.google.com/apigee/docs/support/getting-started-with-support.md.txt) for questions or assistance.
Announcement On June 3, 2025, we released an updated version of Apigee.
**Apigee X** Feature **Apigee API hub is enabled for new Apigee organizations in supported regions.**

With this release, we are enabling [Apigee API hub](https://docs.cloud.google.com/apigee/docs/apihub/what-is-api-hub.md.txt) for new Apigee organizations [in regions where API hub is supported](https://docs.cloud.google.com/apigee/docs/locations.md.txt#available-apigee-api-analytics-regions). All new Apigee organizations, including hybrid organizations, that select an API hub-supported region *for their Apigee Analytics region* during provisioning will have access to API hub features at no additional cost.

API hub allows you to view, organize, and manage all of the APIs in your Apigee organization in one central location. To learn more, see [What is Apigee API hub?](https://docs.cloud.google.com/apigee/docs/apihub/what-is-api-hub.md.txt)

No action on your part is required to provision API hub for your organization, with the following exceptions:

- If your Apigee organization has Data Residency or VPC Service Controls enabled, you must configure your API hub instance manually to support these services. See [VPC Service Controls for API hub](https://docs.cloud.google.com/apigee/docs/apihub/vpc-service-control.md.txt) and [API hub and data residency](https://docs.cloud.google.com/apigee/docs/apihub/locations.md.txt#drz-api-hub) for more information.
- If your Apigee organization uses Customer-Managed Encryption Keys (CMEK), you must deprovision the Apigee API hub instance provided by default and recreate it to support CMEK. See [Deprovision Apigee API hub](https://docs.cloud.google.com/apigee/docs/apihub/deprovision.md.txt) and [Provision API hub in the Cloud console](https://docs.cloud.google.com/apigee/docs/apihub/provision.md.txt) for step-by-step instructions.

Contact [Google Cloud Support](https://docs.cloud.google.com/apigee/docs/support/getting-started-with-support.md.txt) for questions or assistance.
Announcement On June 3, 2025, we released an updated version of Apigee.

## June 02, 2025

**Apigee Integrated Portal** Announcement On June 2, 2025 we released a new version of the Apigee integrated portal.
Fixed

| Bug ID | Description |
|---|---|
| 404509044 | When [configuring an SMTP server,](https://docs.cloud.google.com/apigee/docs/api-platform/publish/portal/configure-email.md.txt#cloud-console-ui-preview) and the portal is first provisioned, email notifications are sent to portal users from a generic sender address. This release updates that generic address to `noreply-apigee-portals@google.com`. |

This approach is suitable for evaluation, but you should configure your own SMTP server before launching your portal to users. When you configure the SMTP server, you can also configure the sender address, for example, `no-reply@mycompany.com`.
**Apigee X** Announcement On June 2, 2025, we released an updated version of Apigee (1-15-0-apigee-5).

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Feature **New flow variables available for VerifyAPIKey policy**

Two new flow variables have been added to the [VerifyAPIKey](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/verify-api-key-policy.md.txt) policy.

- `app_group_app`
- `app_group_name`

To learn more, see [Using flow variables](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/introduction-flow-variables.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **410670597** | **Fixed the proxy response count metric (`proxy/response_count`) for EventFlow-enabled streaming proxies.** |
| **375360455** | **Resolved issues with connection termination when using HTTP streaming** Added automatic retries for connection reset due to upstream services. |
| **N/A** | **Updates to security infrastructure and libraries.** |
| **N/A** | **`x-b3` trace headers will be sent only when distributed tracing is enabled.** In previous releases Apigee was sending `x-b3` trace headers even when distributed tracing was disabled. This was an unexpected behavior which is fixed in this release. |

## May 30, 2025

**Apigee X** Announcement On May 30, 2025 we released an updated version of Apigee.
Feature **Announcing the general availability of Gemini Code Assist API development features in Apigee**

With this functionality, you can accelerate your API development lifecycle within VS Code using Gemini Code Assist in Apigee. This feature allows you to use natural language prompts to design, create, iterate, and manage OpenAPI specifications with the following capabilities:

- **AI-Powered API Design**: Generate high-quality OpenAPI specifications from natural language prompts to the Apigee tool in Gemini Code Assist Chat, leveraging the Gemini model and the enterprise context of your API hub.
- **Effortless Iteration**: Refine existing or newly generated specifications using the intuitive Gemini chat interface.
- **Integrated Testing**: Quickly validate your APIs by deploying them to a local or Google Cloud-hosted mock server.
- **Streamlined Workflow**: Publish your completed API specifications directly to Apigee API hub and kick-start proxy development by creating Apigee proxy bundles from your API specifications.
- **Duplicate Endpoint Detection**: Proactively identify and prevent the creation of duplicate API endpoints already registered in your API hub.

For more information and usage instructions, see [Designing and editing APIs](https://docs.cloud.google.com/apigee/docs/api-platform/local-development/vscode/develop-design-edit-apis.md.txt), [Tutorial: Use Gemini Code Assist to design, develop, and test APIs in Apigee](https://docs.cloud.google.com/apigee/docs/api-platform/local-development/vscode/tutorial-gemini.md.txt), and [Setting up Apigee API Management in Cloud Code for VS Code](https://docs.cloud.google.com/apigee/docs/api-platform/local-development/setup.md.txt).

## May 29, 2025

**Apigee Integrated Portal** Announcement On May 29, 2025 we announced the shutdown schedule for the Apigee Classic UI.
Announcement On May 29, 2025 we released a new version of the Apigee integrated portal.

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Feature **GA: Apigee Integrated Developer Portal Admin UI in the Google Cloud console.**

This release adds the Apigee Integrated Developer Portal Admin UI from the Classic Apigee UI into the Google Cloud console.

Leveraging Google Cloud console components provides API providers and Portal Admins with a centralized platform to efficiently configure, publish, and manage your API consumer portals, eliminating the need to switch between different UIs.

No new APIs have been introduced in this release.

See [Publishing overview](https://docs.cloud.google.com/apigee/docs/api-platform/publish/publishing-overview.md.txt) to get started.
Deprecated The Apigee Classic UI will be shutdown as of August 29, 2025.

This is the final phase of moving Apigee to the Google Cloud console. Apigee in the Google Cloud console gives you the ability to manage all of your Apigee functionality in one place.

To prepare for the shutdown of the Apigee Classic UI, familiarize yourself with the new Apigee UI in Google Cloud console by reviewing [UI overview](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/ui-overview.md.txt).

See [Apigee Classic UI shutdown](https://docs.cloud.google.com/apigee/docs/deprecations/apigee-classic-ui.md.txt) for details on shutdown dates and exception request.
**Apigee UI** Announcement On May 29, 2025 we announced the shutdown schedule for the Apigee Classic UI.
Deprecated The Apigee Classic UI will be shutdown as of August 29, 2025.

This is the final phase of moving Apigee to the Google Cloud console. Apigee in the Google Cloud console gives you the ability to manage all of your Apigee functionality in one place.

To prepare for the shutdown of the Apigee Classic UI, familiarize yourself with the new Apigee UI in Google Cloud console by reviewing [UI overview](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/ui-overview.md.txt).

See [Apigee Classic UI shutdown](https://docs.cloud.google.com/apigee/docs/deprecations/apigee-classic-ui.md.txt) for details on shutdown dates and exception request.
**Apigee X** Announcement On May 29, 2025 we announced the shutdown schedule for the Apigee Classic UI.
Feature **Public Preview: Apigee Extension Processor support for request and response body processing**

When creating a load balancer service extension, you can customize the behavior of the extension processor proxy to support request body processing, response body processing, or a combination of the two.

For more information, see [Get started with the Apigee Extension Processor](https://docs.cloud.google.com/apigee/docs/api-platform/service-extensions/extension-processor-quickstart.md.txt#create-lb-ext).
Announcement On May 29, 2025, we released an updated version of Apigee.
Deprecated The Apigee Classic UI will be shutdown as of August 29, 2025.

This is the final phase of moving Apigee to the Google Cloud console. Apigee in the Google Cloud console gives you the ability to manage all of your Apigee functionality in one place.

To prepare for the shutdown of the Apigee Classic UI, familiarize yourself with the new Apigee UI in Google Cloud console by reviewing [UI overview](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/ui-overview.md.txt).

See [Apigee Classic UI shutdown](https://docs.cloud.google.com/apigee/docs/deprecations/apigee-classic-ui.md.txt) for details on shutdown dates and exception request.
**Apigee hybrid** v1.14.2 Announcement On May 29, 2025 we announced the shutdown schedule for the Apigee Classic UI.
Deprecated The Apigee Classic UI will be shutdown as of August 29, 2025.

This is the final phase of moving Apigee to the Google Cloud console. Apigee in the Google Cloud console gives you the ability to manage all of your Apigee functionality in one place.

To prepare for the shutdown of the Apigee Classic UI, familiarize yourself with the new Apigee UI in Google Cloud console by reviewing [UI overview](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/ui-overview.md.txt).

See [Apigee Classic UI shutdown](https://docs.cloud.google.com/apigee/docs/deprecations/apigee-classic-ui.md.txt) for details on shutdown dates and exception request.

## May 27, 2025

**Apigee Advanced API Security** Announcement On May 27, 2025 we released an updated version of Apigee Advanced API Security.
Feature With this release, Advanced API Security expands its runtime region support to include `africa-south1` (Johannesburg).

For a list of supported regions, see [Apigee locations](https://docs.cloud.google.com/apigee/docs/locations.md.txt).

## May 22, 2025

**Apigee X** Announcement On May 22, 2025, we released an updated version of Apigee.
Feature **Public preview of server-sent events**

Apigee now supports continuous response streaming from server-sent event (SSE) endpoints to clients in real time. The Apigee SSE feature is useful for handling large language model (LLM) APIs that operate most effectively by streaming their responses back to the client. SSE streaming reduces latency, and clients can receive response data as soon as it is generated by an LLM. This feature supports the use of AI agents that operate in real time environments, such as customer service bots or workflow orchestrators. For more information, see [Streaming server-sent events](https://docs.cloud.google.com/apigee/docs/api-platform/develop/server-sent-events.md.txt).
Feature **Public Preview of Apigee policies for LLM/GenAI workloads**

Four new Apigee policies supporting LLM/GenAI workloads are now available in [Public Preview](https://cloud.google.com/products#product-launch-stages):

- [SemanticCacheLookup policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/semantic-cache-lookup-policy.md.txt)
- [SemanticCachePopulate policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/semantic-cache-populate-policy.md.txt)
- [SanitizeUserPrompt](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/sanitize-user-prompt-policy.md.txt)
- [SanitizeModelResponse](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/sanitize-user-prompt-policy.md.txt)

The Apigee semantic caching policies enable intelligent response reuse based on semantic similarity. Using these policies in your Apigee API proxies can minimize redundant backend API calls, reduce latency, and lower operational costs.

The Model Armor policies protect your AI applications by sanitizing user prompts to and responses from large language models (LLMs). Using these policies in your Apigee API proxies can mitigate the risks associated with LLM usage by leveraging Model Armor to detect prompt injection, prevent jailbreak attacks, apply responsible AI filters, filter malicious URLs, and protect sensitive data.

For more information on using these policies in your Apigee API proxies, see:

- [Get started with semantic caching policies](https://docs.cloud.google.com/apigee/docs/api-platform/tutorials/using-semantic-caching-policies.md.txt)
- [Get started with Apigee Model Armor policies](https://docs.cloud.google.com/apigee/docs/api-platform/tutorials/using-model-armor-policies.md.txt)

## May 21, 2025

**Apigee API hub** Announcement Apigee API hub is now available in the following regions:

- europe-west10 (Berlin)
- us-east5 (Columbus)
- us-south1 (Dallas)
- me-central2 (Dammam)
- asia-south2 (Delhi)
- me-central1 (Doha)
- europe-north1 (Finland)
- europe-west3 (Frankfurt)
- asia-east2 (Hong Kong)
- asia-southeast2 (Jakarta)
- africa-south1 (Johannesburg)
- us-west4 (Las Vegas)
- us-west2 (Los Angeles)
- europe-southwest1 (Madrid)
- australia-southeast2 (Melbourne)
- europe-west8 (Milan)
- northamerica-northeast1 (Montréal)
- europe-west4 (Netherlands)
- asia-northeast2 (Osaka)
- us-west3 (Salt Lake City)
- southamerica-west1 (Santiago)
- asia-northeast3 (Seoul)
- us-east1 (South Carolina)
- asia-east1 (Taiwan)
- me-west1 (Tel Aviv)
- asia-northeast1 (Tokyo)
- northamerica-northeast2 (Toronto)
- europe-west12 (Turin)
- europe-central2 (Warsaw)
- europe-west6 (Zürich)

For more information, see [API hub locations](https://docs.cloud.google.com/apigee/docs/apihub/locations.md.txt).

## May 20, 2025

**Apigee Advanced API Security** Announcement On May 20, 2025 we released a new version of Advanced API Security Abuse Detection.

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the feature available until the rollout is complete.

Feature **Advanced API Security Abuse Detection incident reports now include the ability to view raw data**

With this new functionality, you can view raw data underlying an incident report, including client IP address, API proxy, developer app, and other attributes.

For usage information, see the [Abuse Detection customer documentation](https://docs.cloud.google.com/apigee/docs/api-security/abuse-detection.md.txt#incident-details).

## May 16, 2025

**Apigee API hub** Feature **API overview and metrics**

The **Get Started with API hub** page now includes new charts and scorecards to provide a quick overview of your API landscape.

For more information see [Get started with API hub](https://docs.cloud.google.com/apigee/docs/apihub/getting-started-apihub.md.txt#view-your-api-landscape-overview).
Change **Attach and manage Tags**

You can now add custom tags to your APIs and API deployments, making it easier to organize, categorize, and discover your API resources in API hub. Tags can also be used to conditionally allow or deny policies to a specific resource.

For more information see [Attach and manage tags](https://docs.cloud.google.com/apigee/docs/apihub/attach-manage-tags.md.txt).
Change **Updated UI for API hub**

The API hub user interface is now updated to Google Material Design 2. This update provides a more consistent and modern look and feel, enhancing the overall user experience and aligning the UI with other Google Cloud products.
**Apigee hybrid** 1.14.2-hotfix.1 Announcement

### hybrid 1.14.2-hotfix.1

On May 16, 2025 we released an updated version of the Apigee hybrid software, 1.14.2-hotfix.1.

> [!IMPORTANT]
> **Important:** If your installation is already on Apigee hybrid v1.14.2, use the following procedure to apply this hotfix. If your installation is on 1.14.1 or older, follow the instructions in [Upgrading Apigee hybrid to version 1.14](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/upgrade.md.txt).

#### Apply this hotfix with the following steps:

1. Download the `apigee-org` and `apigee-env` charts with the `1.14.2-hotfix.1` version tag:

       export CHART_REPO=oci://us-docker.pkg.dev/apigee-release/apigee-hybrid-helm-charts
       export CHART_VERSION=1.14.2-hotfix.1
       helm pull $CHART_REPO/apigee-env --version $CHART_VERSION --untar
       helm pull $CHART_REPO/apigee-org --version $CHART_VERSION --untar

2. **Optional** : Perform this step if you need to allow use of the `allOf` combinator along with setting `additionalProperties: true` in your OAS spec. See [fixed bug 393615439](https://docs.cloud.google.com/apigee/docs/release-notes.md.txt#393615439).

   Add the following stanza to your `overrides.yaml`:

       runtime:
         cwcAppend:
           conf_message-processor-communication_oas.disable.resolve.combinator: true

3. Install the hotfix release:

   1. Update the `apigee-env` chart with the `helm upgrade` command and your current overrides file for each environment in your Apigee org:

      #### **Dry run:**

      ```
      helm upgrade ENV_RELEASE_NAME apigee-env/ \
      --namespace APIGEE_NAMESPACE \
      --set env=ENV_NAME \
      --atomic \
      -f OVERRIDES_FILE \
      --dry-run=server
      ```
      - <var translate="no">ENV_RELEASE_NAME</var> is a name used to keep track of installation and upgrades of the `apigee-env chart`. This name must be unique from the other Helm release names in your installation. Usually this is the same as <var translate="no">ENV_NAME</var>. However, if your environment has the same name as your environment group, you must use different release names for the environment and environment group, for example `dev-env-release` and `dev-envgroup-release`. For more information on releases in Helm, see [Three big concepts](https://helm.sh/docs/intro/using_helm/#three-big-concepts) in the Helm documentation.
      - <var translate="no">APIGEE_NAMESPACE</var> is your installation's namespace. The default is `apigee`.
      - <var translate="no">ENV_NAME</var> is the name of the environment you are upgrading.
      - <var translate="no">OVERRIDES_FILE</var> is your edited overrides file.

      #### **Install the changes:**

      ```
      helm upgrade ENV_RELEASE_NAME apigee-env/ \
      --namespace APIGEE_NAMESPACE \
      --set env=ENV_NAME \
      --atomic \
      -f OVERRIDES_FILE
      ```
   2. Update the `apigee-org` chart:

      #### **Dry run:**

      ```
      helm upgrade ORG_NAME apigee-org/ \
      --namespace APIGEE_NAMESPACE \
      -f OVERRIDES_FILE \
      --dry-run=server
      ```

      #### **Install the changes:**

      ```
      helm upgrade ORG_NAME apigee-org/ \
      --namespace APIGEE_NAMESPACE \
      -f OVERRIDES_FILE
      ```
4. Verify the installation:

   Ensure runtime and udca pods are up and running by checking their state:

   <br />

   ```
   kubectl -n APIGEE_NAMESPACE get pods -l app=apigee-runtime
   ```

   ```
   kubectl -n APIGEE_NAMESPACE get pods -l app=apigee-udca
   ```

   <br />

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.14](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a hotfix release: For critical security and other immediate fixes, Apigee provides specific container image tags that you must manually update in your existing deployments. The Helm chart binary usually remains unchanged for hotfixes. Hotfixes are temporary and their changes will be included in the next standard release. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Fixed

| Bug ID | Description |
|---|---|
| **393615439** | **OASValidation behavior for `allOf` with `additionalProperties: true`.** #### **Issue** The OASValidation policy in Apigee Hybrid versions 1.12 and later may incorrectly reject requests when validating against an OpenAPI Specification (OAS) that uses combinator keywords (`allOf`, `oneOf`, `anyOf`) and allows additional properties (`additionalProperties: true`) within the combined schema. This occurs because the default behavior resolves combinators into an aggregated schema before validation, but an underlying issue in the parser library can cause the `additionalProperties` definition to be handled incorrectly during this resolution. This behavior differs from Apigee Edge and older Apigee Hybrid versions. #### **Resolution** A configuration flag has been introduced to control this behavior. By setting this flag, you can disable the pre-validation combinator resolution step, reverting to the behavior consistent with Apigee Edge and older Hybrid versions. #### **Validation errors in Apigee hybrid** If you encounter the validation errors described above, particularly for specs that worked correctly in Apigee Edge or Hybrid versions prior to 1.12, you can revert to the previous validation behavior by setting the following flag for the apigee-runtime container: ``` conf_message-processor-communication_oas.disable.resolve.combinator = true ``` > [!NOTE] > **Note:** Reverting to the older behavior (by setting the flag to true) reintroduces the older limitation: When using `allOf`, the `additionalProperties` keyword must be explicitly set to true if you intend to make the inheritance work correctly. The older behavior does not correctly handle schema validation with `allOf` when `additionalProperties` is set to false or is undefined. Customers migrating from Edge/OPDK or older hybrid versions should already be working around this limitation. |

Security

| Bug ID | Description |
|---|---|
| **N/A** | **Incorporated an updated base image for `stackdriver-logging-agent`, improving the overall security of the service.** This addresses the following vulnerabilities (among others and not limited to): - [CVE-2022-32221](https://nvd.nist.gov/vuln/detail/CVE-2022-32221) - [GHSA-jvgm-pfqv-887x](https://osv.dev/vulnerability/GHSA-jvgm-pfqv-887x) |

## May 14, 2025

**Apigee X** Announcement On May 14, 2025, we released an updated version of Apigee (1-15-0-apigee-4).

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Feature **Large message payload support in Apigee**

Apigee now supports message payloads up to 30MB. For more information, see:

- [Message payload size](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/best-practices-api-proxy-design-and-development.md.txt#size).
- `Properties` in the [ProxyEndpoint configuration elements](https://docs.cloud.google.com/apigee/docs/api-platform/reference/api-proxy-configuration-reference.md.txt#proxyendpoint-proxyendpointconfigurationelements) reference.
- `Properties` in the [TargetEndpoint configuration elements](https://docs.cloud.google.com/apigee/docs/api-platform/reference/api-proxy-configuration-reference.md.txt#targetendpoint-targetendpointconfigurationelements) reference.
Feature **Improvements to the AppGroups functionality**

Scopes and attributes can now be added to the AppGroup App Key via a POST operation on the key using the appGroupAppKey. See the [updateAppGroupAppKey API](https://docs.cloud.google.com/apigee/docs/reference/apis/apigee/rest/v1/organizations.appgroups.apps.keys/updateAppGroupAppKey.md.txt) for details.
Feature **Improvements to the PublishMessage policy**

The [PublishMessage policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/publish-message-policy.md.txt) now supports two new elements:

- The **\<UseMessageAsSource\>** element uses request or response message content as the source of data to be written to [Pub/Sub](https://docs.cloud.google.com/pubsub). For more information, see [\<UseMessageAsSource\>](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/publish-message-policy.md.txt#umas).

- The **\<Attributes\>** element lets you specify string attributes (key/value pairs) to include with the request or response message that is written to Pub/Sub. For more information, see [\<Attributes\>](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/publish-message-policy.md.txt#attributes).

Fixed

| Bug ID | Description |
|---|---|
| **391140293** | **Resolved scaling issue resulting in `503` errors** Added `drainDuration` and updated the values for `terminationDrainDuration` and `terminationGracePeriodSeconds`. |
| **391862684** | **Resolved issue with requests stuck at Message Processor causing timeouts.** |
| **N/A** | **Updates to security infrastructure and libraries.** |

## May 06, 2025

**Apigee UI** Announcement On May 6, 2025, we released a new Apigee REST resource for debug sessions.
Feature Apigee now offers a Management API that allows users to list all recent debug sessions for a given proxy, regardless of revision or environment and current deployment status. This API is available for use, and is now used to populate all recent debug sessions in the Apigee Debug UI.

For more information on this method, see: [organizations.apis.debugsessions.list](https://docs.cloud.google.com/apigee/docs/reference/apis/apigee/rest/v1/organizations.apis.debugsessions/list.md.txt)
**Apigee X** Announcement On May 6, 2025, we released a new Apigee REST resource for debug sessions.
Feature Apigee now offers a Management API that allows users to list all recent debug sessions for a given proxy, regardless of revision or environment and current deployment status. This API is available for use, and is now used to populate all recent debug sessions in the Apigee Debug UI.

For more information on this method, see: [organizations.apis.debugsessions.list](https://docs.cloud.google.com/apigee/docs/reference/apis/apigee/rest/v1/organizations.apis.debugsessions/list.md.txt)

## May 05, 2025

**Apigee UI** Announcement On May 5, 2025, we released an updated version of the Apigee UI.
Fixed

| Bug ID | Description |
|---|---|
| **402183688** | **Resolved navigation issue when creating a new flow in the Apigee Proxy Editor** In some instances, adding a flow to an Apigee endpoint using the Apigee Proxy Editor resulted in redirection to a `404` page. |

## May 02, 2025

**Apigee X** Feature **Large message payload support in Apigee**

Apigee now supports message payloads up to 30MB. For more information, see:

- [Message payload size](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/best-practices-api-proxy-design-and-development.md.txt#size).
- `Properties` in the [ProxyEndpoint configuration elements](https://docs.cloud.google.com/apigee/docs/api-platform/reference/api-proxy-configuration-reference.md.txt#proxyendpoint-proxyendpointconfigurationelements) reference.
- `Properties` in the [TargetEndpoint configuration elements](https://docs.cloud.google.com/apigee/docs/api-platform/reference/api-proxy-configuration-reference.md.txt#targetendpoint-targetendpointconfigurationelements) reference.
Announcement On May 2, 2025, we released an updated version of Apigee (1-15-0-apigee-3).

> [!NOTE]
> **Note:** This release has been rolled back to address an issue.
>
> See entry for [May 14, 2025](https://docs.cloud.google.com/apigee/docs/release-notes.md.txt#May_14_2025) for the updated version number and payload.

Feature **Improvements to the PublishMessage policy**

The [PublishMessage policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/publish-message-policy.md.txt) now supports two new elements:

- The **\<UseMessageAsSource\>** element uses request or response message content as the source of data to be written to [Pub/Sub](https://docs.cloud.google.com/pubsub). For more information, see [\<UseMessageAsSource\>](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/publish-message-policy.md.txt#umas).

- The **\<Attributes\>** element lets you specify string attributes (key/value pairs) to include with the request or response message that is written to Pub/Sub. For more information, see [\<Attributes\>](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/publish-message-policy.md.txt#attributes).

Fixed

| Bug ID | Description |
|---|---|
| **391140293** | **Resolved scaling issue resulting in `503` errors** Added `drainDuration` and updated the values for `terminationDrainDuration` and `terminationGracePeriodSeconds`. |
| **391862684** | **Resolved issue with requests stuck at Message Processor causing timeouts.** |
| **N/A** | **Updates to security infrastructure and libraries.** |

**Apigee hybrid** v1.14.2 Announcement

### hybrid v1.14.2

On May 2, 2025 we released an updated version of the Apigee hybrid software, 1.14.2.

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.14](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/big-picture.md.txt).

> [!NOTE]
> **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Feature **Large message payload support in Apigee hybrid**

Apigee now supports message payloads up to 30MB. For information see:

- [Message payload size](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/best-practices-api-proxy-design-and-development.md.txt#size)
- [`runtime.resources.limits.memory`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/config-prop-ref.md.txt#runtime-resources-limits-memory) in the Configuration property reference.
- [`runtime.resources.requests.memory`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/config-prop-ref.md.txt#runtime-resources-requests-memory) in the Configuration property reference.
Change Starting with v1.14.2, third-party container images will be labeled with a version tag that matches the Apigee hybrid image tag. This affects the image tags returned by the [`apigee-pull-push`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/apigee-pull-push.md.txt) command line tool. For more information, see:

- [Use a private image repository with Apigee hybrid](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/container-images.md.txt#supported-platforms)
- [`apigee-pull-push`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/apigee-pull-push.md.txt#list-the-images-in-your-repository)
- [`hub`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/config-prop-ref.md.txt#hub)

> [!NOTE]
> **Note:** You can see the original component container image tags as a label with the `docker history` and `docker inspect` commands.

Fixed

| Bug ID | Description |
|---|---|
| **412324617** | **Fixed issue where Runtime container could spin at 100% cpu limit.** |
| **401746333** | **Fixed a `java.lang.ClassCircularityError` that could occur in Java Callouts due to an issue with the class loading mechanism.** |
| **399447688** | **API proxy deployment could become stuck in `PROGRESSING` state.** |
| **397693324** | **ESS and non-ESS Multi-region Cassandra credential rotation could fail in every region except the first.** |
| **396571537** | **Rotating Cassandra credentials in Kubernetes secrets fixed for Multi-region deployments.** |
| **384937220** | **Fixed `ApigeeRoute` name collision on internal chaining gateway for Enhanced Proxy Limits.** |
| **368155212** | **Auto Cassandra secret rotation could fail when [Enhanced per-environment proxy limits](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/enhanced-proxy-limits.md.txt) are enabled.** |

Security

| Bug ID | Description |
|---|---|
| **391923260** | **Security fixes for `apigee-udca`.** This addresses the following vulnerabilities: - [CVE-2025-27788](https://nvd.nist.gov/vuln/detail/CVE-2025-27788) - [CVE-2025-22869](https://nvd.nist.gov/vuln/detail/CVE-2025-22869) - [CVE-2025-22868](https://nvd.nist.gov/vuln/detail/CVE-2025-22868) - [CVE-2024-45337](https://nvd.nist.gov/vuln/detail/CVE-2024-45337) - [CVE-2024-34158](https://nvd.nist.gov/vuln/detail/CVE-2024-34158) - [CVE-2024-34156](https://nvd.nist.gov/vuln/detail/CVE-2024-34156) - [CVE-2023-6481](https://nvd.nist.gov/vuln/detail/CVE-2023-6481) |
| **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2025-1094](https://nvd.nist.gov/vuln/detail/CVE-2025-1094) - [CVE-2025-0395](https://nvd.nist.gov/vuln/detail/CVE-2025-0395) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** This addresses the following vulnerability: - [CVE-2025-23015](https://nvd.nist.gov/vuln/detail/CVE-2025-23015) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** This addresses the following vulnerability: - [CVE-2025-22868](https://nvd.nist.gov/vuln/detail/CVE-2025-22868) |
| **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** This addresses the following vulnerability: - [CVE-2025-21587](https://nvd.nist.gov/vuln/detail/CVE-2025-21587) |
| **N/A** | **Security fixes for `apigee-open-telemetry-collector`.** This addresses the following vulnerabilities: - [CVE-2025-29786](https://nvd.nist.gov/vuln/detail/CVE-2025-29786) - [CVE-2025-22869](https://nvd.nist.gov/vuln/detail/CVE-2025-22869) - [CVE-2025-22868](https://nvd.nist.gov/vuln/detail/CVE-2025-22868) |
| **N/A** | **Security fixes for `apigee-operators`.** This addresses the following vulnerabilities: - [CVE-2025-22869](https://nvd.nist.gov/vuln/detail/CVE-2025-22869) - [CVE-2025-22868](https://nvd.nist.gov/vuln/detail/CVE-2025-22868) |
| **N/A** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerability: - [CVE-2025-22868](https://nvd.nist.gov/vuln/detail/CVE-2025-22868) |
| **N/A** | **Security fixes for `apigee-redis`.** This addresses the following vulnerabilities: - [CVE-2025-22869](https://nvd.nist.gov/vuln/detail/CVE-2025-22869) - [CVE-2024-56171](https://nvd.nist.gov/vuln/detail/CVE-2024-56171) - [CVE-2024-24791](https://nvd.nist.gov/vuln/detail/CVE-2024-24791) |
| **N/A** | **Security fixes for `apigee-stackdriver-logging-agent`.** This addresses the following vulnerabilities: - [CVE-2025-24928](https://nvd.nist.gov/vuln/detail/CVE-2025-24928) - [CVE-2025-24855](https://nvd.nist.gov/vuln/detail/CVE-2025-24855) - [CVE-2025-0306](https://nvd.nist.gov/vuln/detail/CVE-2025-0306) - [CVE-2024-56171](https://nvd.nist.gov/vuln/detail/CVE-2024-56171) - [CVE-2024-55549](https://nvd.nist.gov/vuln/detail/CVE-2024-55549) |
| **N/A** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerabilities: - [CVE-2025-22869](https://nvd.nist.gov/vuln/detail/CVE-2025-22869) - [CVE-2025-22868](https://nvd.nist.gov/vuln/detail/CVE-2025-22868) |

## April 29, 2025

**Apigee API hub** Announcement On April 29, 2025, we released an updated version of Apigee.
Feature **Apigee API hub is enabled for existing Apigee organizations in supported regions.**

With this release, we are enabling [Apigee API hub](https://docs.cloud.google.com/apigee/docs/apihub/what-is-api-hub.md.txt) for existing Apigee organizations [in regions where API hub is supported](https://docs.cloud.google.com/apigee/docs/apihub/locations.md.txt#supported-locations). All existing Apigee organizations, including hybrid organizations, that selected an API hub-supported region *for their Apigee Analytics region* will have access to API hub features at no additional cost.

API hub allows you to view, organize, and manage all of the APIs in your Apigee organization in one central location. To learn more, see [What is Apigee API hub?](https://docs.cloud.google.com/apigee/docs/apihub/what-is-api-hub.md.txt)

The process of enabling API hub for these organizations will continue over the next several weeks until all eligible organizations are updated. No action on your part is required to provision API hub for your organization, with the following exceptions:

- If your Apigee organization has Data Residency or VPC Service Controls enabled, you must configure your API hub instance manually to support these services. See [VPC Service Controls for API hub](https://docs.cloud.google.com/apigee/docs/apihub/vpc-service-control.md.txt) and [API hub and data residency](https://docs.cloud.google.com/apigee/docs/apihub/locations.md.txt#drz-api-hub) for more information.
- If your Apigee organization uses Customer-Managed Encryption Keys (CMEK), you must deprovision the Apigee API hub instance provided by default and recreate it to support CMEK. See [Deprovision Apigee API hub](https://docs.cloud.google.com/apigee/docs/apihub/deprovision.md.txt) and [Provision API hub in the Cloud console](https://docs.cloud.google.com/apigee/docs/apihub/provision.md.txt) for step-by-step instructions.

Contact [Google Cloud Support](https://docs.cloud.google.com/apigee/docs/support/getting-started-with-support.md.txt) for questions or assistance.
**Apigee X** Announcement On April 29, 2025, we released an updated version of Apigee.
Feature **Apigee API hub is enabled for existing Apigee organizations in supported regions.**

With this release, we are enabling [Apigee API hub](https://docs.cloud.google.com/apigee/docs/apihub/what-is-api-hub.md.txt) for existing Apigee organizations [in regions where API hub is supported](https://docs.cloud.google.com/apigee/docs/apihub/locations.md.txt#supported-locations). All existing Apigee organizations, including hybrid organizations, that selected an API hub-supported region *for their Apigee Analytics region* will have access to API hub features at no additional cost.

API hub allows you to view, organize, and manage all of the APIs in your Apigee organization in one central location. To learn more, see [What is Apigee API hub?](https://docs.cloud.google.com/apigee/docs/apihub/what-is-api-hub.md.txt)

The process of enabling API hub for these organizations will continue over the next several weeks until all eligible organizations are updated. No action on your part is required to provision API hub for your organization, with the following exceptions:

- If your Apigee organization has Data Residency or VPC Service Controls enabled, you must configure your API hub instance manually to support these services. See [VPC Service Controls for API hub](https://docs.cloud.google.com/apigee/docs/apihub/vpc-service-control.md.txt) and [API hub and data residency](https://docs.cloud.google.com/apigee/docs/apihub/locations.md.txt#drz-api-hub) for more information.
- If your Apigee organization uses Customer-Managed Encryption Keys (CMEK), you must deprovision the Apigee API hub instance provided by default and recreate it to support CMEK. See [Deprovision Apigee API hub](https://docs.cloud.google.com/apigee/docs/apihub/deprovision.md.txt) and [Provision API hub in the Cloud console](https://docs.cloud.google.com/apigee/docs/apihub/provision.md.txt) for step-by-step instructions.

Contact [Google Cloud Support](https://docs.cloud.google.com/apigee/docs/support/getting-started-with-support.md.txt) for questions or assistance.

## April 22, 2025

**Apigee Integrated Portal** Announcement On April 22, 2025 we released a new version of the Apigee integrated portal.

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Feature **Public Preview: Apigee Integrated Developer Portal Admin UI in the Google Cloud console.**

This release adds the Apigee Integrated Developer Portal Admin UI from the Classic Apigee UI into the Google Cloud console.

Leveraging Google Cloud console components provides API providers and Portal Admins with a centralized platform to efficiently configure, publish, and manage your API consumer portals, eliminating the need to switch between different UIs.

No new APIs have been introduced in this release.

See [Publishing overview](https://docs.cloud.google.com/apigee/docs/api-platform/publish/publishing-overview.md.txt) to get started.

## April 15, 2025

**Apigee Analytics** Announcement On April 15, 2025 we released an updated version of Apigee Analytics and the Apigee UI.
Announcement On April 15, 2025 we released an updated version of Apigee Analytics and the Apigee UI.
Change Starting with this release, the Analytics dashboards available in the Apigee Classic UI redirect to the comparable dashboards in Apigee UI in Cloud console. These dashboards are available exclusively in the Apigee UI in Cloud console going forward.

For information and usage instructions for the Analytics dashboards, see [Apigee API Analytics overview](https://docs.cloud.google.com/apigee/docs/api-platform/analytics/analytics-services-overview.md.txt).
Change Starting with this release, the Analytics dashboards available in the Apigee Classic UI redirect to the comparable dashboards in Apigee UI in Cloud console. These dashboards are available exclusively in the Apigee UI in Cloud console going forward.

For information and usage instructions for the Analytics dashboards, see [Apigee API Analytics overview](https://docs.cloud.google.com/apigee/docs/api-platform/analytics/analytics-services-overview.md.txt).
**Apigee UI** Announcement On April 15, 2025 we released an updated version of Apigee Analytics and the Apigee UI.
Change Starting with this release, the Analytics dashboards available in the Apigee Classic UI redirect to the comparable dashboards in Apigee UI in Cloud console. These dashboards are available exclusively in the Apigee UI in Cloud console going forward.

For information and usage instructions for the Analytics dashboards, see [Apigee API Analytics overview](https://docs.cloud.google.com/apigee/docs/api-platform/analytics/analytics-services-overview.md.txt).

## April 14, 2025

**Apigee X** Announcement On April 14, 2025 we released an updated version of Apigee.
Feature **Announcing data collectors data residency (DRZ) compliance for Apigee and Apigee hybrid.**

Data collectors can be used with data residency for Subscription and Pay-as-you-go organizations and hybrid versions 1.14.0 and later.

See [Data residency compatibility](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/drz-concepts.md.txt#data-residency-compatibility) for information.
**Apigee hybrid** v1.14.0 Announcement On April 14, 2025 we released an updated version of Apigee.
Feature **Announcing data collectors data residency (DRZ) compliance for Apigee and Apigee hybrid.**

Data collectors can be used with data residency for Subscription and Pay-as-you-go organizations and hybrid versions 1.14.0 and later.

See [Data residency compatibility](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/drz-concepts.md.txt#data-residency-compatibility) for information.
1.11.2-hotfix.3 Announcement

### hybrid 1.11.2-hotfix.3

On April 14, 2025 we released an updated version of the Apigee hybrid software, 1.11.2-hotfix.3.

#### Apply this hotfix with the following steps:

1. In your overrides file, update the `image.url` and `image.tag` properties of `ao` and `runtime`:

       runtime:
         image:
           url: "gcr.io/apigee-release/hybrid/apigee-runtime"
           tag: "1.11.2-hotfix.3"

2. Install the hotfix release:

   - For Helm-managed releases, update the `apigee-env` chart with the `helm upgrade` command and your current overrides files:

     For each environment in your Apigee org:

         helm upgrade ENV_RELEASE_NAME apigee-env/ \
           --namespace APIGEE_NAMESPACE \
           --set env=ENV_NAME \
           --atomic \
           -f OVERRIDES_FILE

     - <var translate="no">ENV_RELEASE_NAME</var> is a name used to keep track of installation and upgrades of the `apigee-env chart`. This name must be unique from the other Helm release names in your installation. Usually this is the same as <var translate="no">ENV_NAME</var>. However, if your environment has the same name as your environment group, you must use different release names for the environment and environment group, for example `dev-env-release` and `dev-envgroup-release`. For more information on releases in Helm, see [Three big concepts](https://helm.sh/docs/intro/using_helm/#three-big-concepts) in the Helm documentation.
     - <var translate="no">APIGEE_NAMESPACE</var> is your installation's namespace. The default is `apigee`.
     - <var translate="no">ENV_NAME</var> is the name of the environment you are upgrading.
     - <var translate="no">OVERRIDES_FILE</var> is your edited overrides file.
   - For `apigeectl`-managed releases:

     1. Install the hotfix release with `apigeectl init` using your updated overrides file:

            ${APIGEECTL_HOME}/apigeectl init -f OVERRIDES_FILE --dry-run=client

        Followed by:

            ${APIGEECTL_HOME}/apigeectl init -f OVERRIDES_FILE

     2. Apply the hotfix release with `apigeectl apply`:

            ${APIGEECTL_HOME}/apigeectl apply -f OVERRIDES_FILE --all-envs --dry-run=client

        Followed by:

            ${APIGEECTL_HOME}/apigeectl apply -f OVERRIDES_FILE --all-envs

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.11](https://docs.cloud.google.com/apigee/docs/hybrid/v1.11/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.11/big-picture.md.txt).
- For recommended actions after upgrading, see [Validate policies after upgrade to 1.12-hotfix.3](https://docs.cloud.google.com/apigee/docs/hybrid/v1.11/upgrade.md.txt#recommended-actions-upgrade-1112h3).

> [!NOTE]
> **Note:** This is a hotfix release: For critical security and other immediate fixes, Apigee provides specific container image tags that you must manually update in your existing deployments. The Helm chart binary usually remains unchanged for hotfixes. Hotfixes are temporary and their changes will be included in the next standard release. For information on container image support in Apigee hybrid releases, see the [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images).

Security **Stricter class instantiation checks included in this release.**

JavaCallout policy now includes additional security during Java class instantiation. The enhanced security measure prevents the deployment of policies that directly or indirectly attempt actions that require permissions that are not allowed.

In most cases, existing policies will continue to function as expected without any issues. However, there is a possibility that policies relying on third-party libraries, or those with custom code that indirectly triggers operations requiring elevated permissions, could be affected.

To test your installation, follow the procedure in [Validate policies after upgrade to 1.11.2-hotfix.3](https://docs.cloud.google.com/apigee/docs/hybrid/v1.11/upgrade.md.txt#recommended-actions-upgrade-1112h3) to validate policy behavior.

| Bug ID | Description |
|---|---|
| **382967738** | **Fixed a vulnerability in PythonScript policy.** |

## April 10, 2025

**Apigee X** Announcement On April 10, 2025, we released an updated version of Apigee.
Feature The Apigee Extension Processor is now [generally available (GA)](https://cloud.google.com/products#product-launch-stages).

The Apigee Extension Processor lets Apigee customers add API management capabilities to Google Cloud and third-party products and services exposed using Cloud Load Balancing. Select from a range of Apigee policies that enable you to:

- Secure access to your workloads.
- Apply quota enforcement to network traffic.
- Manage Google access token and Google ID token injection to authenticate requests.
- Support native protocols like gRPC, SSE, and HTTP/3.

For more information, see the [Apigee Extension Processor overview](https://docs.cloud.google.com/apigee/docs/api-platform/service-extensions/extension-processor-overview.md.txt).

## April 02, 2025

**Apigee API hub** Feature **Data residency zone compliance**

API hub is now compliant with data residency Zone C3 requirements.

> [!NOTE]
> **Note:** While API hub is data residency compliant as a standalone service, the automated provisioning of API hub for an Apigee organization that has data residency enabled is **not** currently supported.

For more information, see [API hub and data residency](https://docs.cloud.google.com/apigee/docs/apihub/locations.md.txt).
Feature **VPC Service Controls (VPC-SC) integration** ([Preview](https://cloud.google.com/products#product-launch-stages))

API hub now integrates with VPC Service Controls, providing enhanced network security for your API hub instance provisioned in Google Cloud. Establish service perimeters to control ingress and egress traffic. For more information, see [VPC Service Controls for API hub](https://docs.cloud.google.com/apigee/docs/apihub/vpc-service-control.md.txt).
Feature **Terraform support for provisioning**

You can now provision API hub instances programmatically using Terraform for Google Cloud within Cloud Shell, enabling infrastructure-as-code practices. For more information, see [Provision API hub using Terraform](https://docs.cloud.google.com/apigee/docs/apihub/provision-terraform.md.txt).
Feature **Plugin Framework**

API hub now uses a plugin framework to connect and ingest API metadata from various Google Cloud services and external sources where your APIs are managed or defined. This provides a flexible and extensible way to integrate with your existing API landscape. For more information, see [Plugins overview](https://docs.cloud.google.com/apigee/docs/apihub/plugins.md.txt).
Feature **Enhancements to the Operations entity \[API only\]**

You can now add, edit, or delete operations for an API version even if it lacks a specification file or has an unparsable one. For more information, see [Manage operations](https://docs.cloud.google.com/apigee/docs/apihub/manage-operations.md.txt).
Feature **API Metadata Curations**

API hub introduces a curation process to transform and enrich API metadata ingested by plugins. This ensures consistency across different sources, enabling effective governance, discovery, and management of your APIs. For more information, see [Curations overview](https://docs.cloud.google.com/apigee/docs/apihub/curations.md.txt).
Feature **API Supply chain graph view**

Visualize and understand the dependencies within your API ecosystem with the new interactive API supply chain graph view. This directed graph allows you to explore the relationships between your APIs and API operations. For more information, see [API Supply chain views](https://docs.cloud.google.com/apigee/docs/apihub/api-supply-chain.md.txt#api-supply-chain-views).
Feature **Deprovision an API hub instance \[API only\]**

You can now delete an API hub instance from your Google Cloud project using the [ApiHubInstance](https://docs.cloud.google.com/apigee/docs/reference/apis/apihub/rest/v1/projects.locations.apiHubInstances.md.txt) API. For more information, see [Deprovision Apigee API hub](https://docs.cloud.google.com/apigee/docs/apihub/deprovision.md.txt).
Change **Attach API documents**

You can now enhance your API documentation by attaching additional relevant files, such as requirements, design documents, and functionality details, directly to your APIs in API hub.

## March 31, 2025

**Apigee X** Announcement On March 31, 2025, we released an updated version of Apigee (1-15-0-apigee-2).

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Feature **New flow variable suffixes available for accessing base64-encoded message content.**

There are two new read-only flow variable suffixes available for accessing message content in base64-encoded form:

- `content.as.base64`
- `content.as.url.safe.base64`

These variable suffixes can be used with the `request`, `response`, and `message` objects, as well as with any `Message` object created implicitly during API proxy execution when using the AssignMessage or ServiceCallout policies.

For more information, see [Flow variables reference](https://docs.cloud.google.com/apigee/docs/api-platform/reference/variables-reference.md.txt).
Fixed

| Bug ID | Description |
|---|---|

\| **N/A** \| **Updates to security infrastructure and libraries.**

## March 27, 2025

**Apigee X** Announcement On March 27, 2025, we released an updated version of Apigee.
Feature **Availability of client IP resolution functionality with Apigee hybrid.**

Client IP resolution functonality is now available with Apigee hybrid versions 1.14.0 and later.

See [Client IP resolution](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/client-ip-resolution.md.txt) for information.
Fixed

| Bug ID | Description |
|---|---|
| **N/A** | **Updates to security infrastructure and libraries.** |

Change On March 26, 2025, we released an updated version of Apigee (1-14-0-apigee-5). This Apigee version applies *only* to organizations using the [**JavaCallout** policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/java-callout-policy.md.txt) in production environments.

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

**Apigee hybrid** v1.14.0 Announcement On March 27, 2025, we released an updated version of Apigee.
Feature **Availability of client IP resolution functionality with Apigee hybrid.**

Client IP resolution functonality is now available with Apigee hybrid versions 1.14.0 and later.

See [Client IP resolution](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/client-ip-resolution.md.txt) for information.

## March 25, 2025

**Apigee Advanced API Security** Announcement On March 25, 2025 we released an updated version of Advanced API Security.
Announcement **Risk Assessment v2 is now the default Risk Assessment version**

Starting with this release, Risk Assessment v2 is the default Risk Assessment version in the UI. You will see the see v2 functionality and interfaces unless you choose to switch back to v1 by clicking **Switch to v1** in the upper right of the UI.

**Note:** Rollouts of this functionality to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the feature available until the rollout is complete.
Change **New Advanced API Security support when using data residency (DRZ) with Apigee hybrid**

Advanced API Security is now available for Apigee hybrid orgs using DRZ, for hybrid versions 1.14.0 and later. See [Using data residency with Apigee hybrid](https://docs.cloud.google.com/apigee/docs/hybrid/latest/using-data-residency-with-apigee-hybrid).

See [Introduction to data residency](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/drz-concepts.md.txt#data-residency-and-apigee-hybrid) for information on DRZ and Advanced API Security support across organization types.
Feature **New features added to public preview of Risk Assessment v2**

This release introduces new features to the Risk Assessment v2 preview:

- **Security monitoring conditions.** Security monitoring conditions allow you to map resources (proxies or environments) to security profiles. Cloud Monitoring can then use this mapping to alert or create dedicated dashboards so that you can track security scores over time.
- **Alerts on security monitoring conditions.** Once you've created a monitoring condition, you can set up alerts using Alerting in Cloud Monitoring so that you're notified when the security scores change.

For information on monitoring conditions features and usage see [monitoring conditions and alerts](https://docs.cloud.google.com/apigee/docs/api-security/security-scores.md.txt#monitoring-conditions). For usage information and a list of all features in Risk Assessment v2, see the [Risk Assessment v2 customer documentation](https://docs.cloud.google.com/apigee/docs/api-security/security-scores.md.txt#risk-assessment-v2).

**Note:** Rollouts of this functionality to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the feature available until the rollout is complete.
**Apigee hybrid** v1.14.0 Announcement On March 25, 2025 we released an updated version of Advanced API Security.
Change **New Advanced API Security support when using data residency (DRZ) with Apigee hybrid**

Advanced API Security is now available for Apigee hybrid orgs using DRZ, for hybrid versions 1.14.0 and later. See [Using data residency with Apigee hybrid](https://docs.cloud.google.com/apigee/docs/hybrid/latest/using-data-residency-with-apigee-hybrid).

See [Introduction to data residency](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/drz-concepts.md.txt#data-residency-and-apigee-hybrid) for information on DRZ and Advanced API Security support across organization types.

## March 24, 2025

**Apigee X** Feature **Apigee Spaces is now [generally available (GA)](https://cloud.google.com/products#product-launch-stages) for use in Apigee organizations.**

Apigee Spaces enables identity-based isolation and grouping of API resources within an Apigee organization. With Apigee Spaces, you can have granular IAM control over access to your API proxies, shared flows, and API products.

Spaces also provide the option of resource isolation at a team level, providing a clear separation of resources associated with different teams operating within the same Apigee organization. IAM policies can be applied at the Space level, eliminating the need to manage permissions individually for every API proxy, shared flow, and API product.

Spaces are a brand new resource type with resource-level permissions. This means that Space permissions are not subject to the 64k limitation for project-level IAM conditions. Each space has its own 64k limit.

To learn more, see [Apigee Spaces overview](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/spaces/apigee-spaces-overview.md.txt).
Announcement On March 24, 2025, we released an updated version of Apigee.

## March 17, 2025

**Apigee X** Announcement On March 17, 2025, Apigee announced the GA support for DNS peering for Apigee organizations that have VPC peering disabled.
Feature For Apigee organizations set up without VPC peering, you can now configure Apigee to resolve your private domains by peering your DNS zones with Apigee. See [Connecting with private DNS peering zones](https://docs.cloud.google.com/apigee/docs/api-platform/architecture/southbound-networking-patterns-endpoints.md.txt#connecting-with-private-dns-peering-zones).

## March 14, 2025

**Apigee UI** Fixed

| Bug ID | Description |
|---|---|
| **401574741** | **Fixed issue with loading API resource and path configurations when opening the Product detail pages of legacy API products.** API resources and paths are now properly populated and applied when viewing the **Product detail** pages for legacy API products in the Apigee UI. |

Announcement On March 14, 2025, we released an updated version of the Apigee UI.

## March 12, 2025

**Apigee UI** Announcement On March 12, 2025, we released an updated version of the Apigee UI.
Change With this release, the **Filter** display name for the `proxy` field in the **Custom reports** page of the Apigee UI in Cloud console is changed to **Proxy Endpoint**.

This change should help users differentiate between **Proxy** and **Proxy Endpoint** values when configuring filters for custom reports using Apigee API Analytics.

For more information, see \[Creating and managing custom reports\](/apigee/docs/api-platform/analytics/create-custom-reports#setting-filters).
**Apigee X** Security

| Bug ID | Description |
|---|---|
| **396944778** | **Security fix for Apigee infrastructure.** This addresses the following vulnerabilities: - [CVE-2025-23184](https://nvd.nist.gov/vuln/detail/CVE-2025-23184) - [CVE-2024-47554](https://nvd.nist.gov/vuln/detail/CVE-2024-47554) - [CVE-2025-24970](https://nvd.nist.gov/vuln/detail/CVE-2025-24970) - [CVE-2025-25193](https://nvd.nist.gov/vuln/detail/CVE-2025-25193) |

Announcement On March 12, 2025, we released an updated version of Apigee (1-15-0-apigee-1).

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Issue **The [Nimbus JOSE + JWT](https://connect2id.com/products/nimbus-jose-jwt) library may cause a java.lang.ClassCircularityError when using a JavaCallout policy.**

For more information, see [Apigee known issues](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt).

<br />

> [!NOTE]
> **Note:** If you have a Apigee hybrid-enabled organization with a JavaCallout policy that uses the Nimbus JOSE + JWT library, **do not upgrade to hybrid versions 1.12.4, 1.13.3, or 1.14.1**.

Fixed

| Bug ID | Description |
|---|---|
| **N/A** | **Updates to security infrastructure and libraries.** |

**Apigee hybrid** v1.13.3 \& v1.12.4 \& v1.14.1 Issue

### v1.13.3 , v1.14.1, v1.12.4

**The [Nimbus JOSE + JWT](https://connect2id.com/products/nimbus-jose-jwt) library may cause a java.lang.ClassCircularityError when using a JavaCallout policy.**

For more information, see [Apigee known issues](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt).

<br />

> [!NOTE]
> **Note:** If you have a Apigee hybrid-enabled organization with a JavaCallout policy that uses the Nimbus JOSE + JWT library, **do not upgrade to hybrid versions 1.12.4, 1.13.3, or 1.14.1**.

## March 11, 2025

**Apigee Integrated Portal** Announcement On March 11, 2025 we released a new version of the Apigee integrated portal.
Fixed

| Bug ID | Description |
|---|---|
| 380076166 | For an app in a portal, the status for each key will now show approved, revoked, partially approved or inactive based on the approval status of all the API products on that key (or if the key has been revoked). Additionally, the status of an API Product for an app will show approved, partially approved, or pending approval based on the approval status for all keys associated to that API product. If a key is revoked, it will not effect the approval status of the API product. |

## March 07, 2025

**Apigee Advanced API Security** Announcement On March 7, 2025 we released an updated version of Apigee Advanced API Security.
Feature **Availability of data obfuscation support with Advanced API Security**

With this release, data obfuscation can be used with Advanced API Security.

For usage information, see [Obfuscate user data for Apigee API Analytics](https://docs.cloud.google.com/apigee/docs/api-platform/analytics/obfuscate-user-data-for-analytics.md.txt) and [Data obfuscation with Advanced API Security](https://docs.cloud.google.com/apigee/docs/api-security.md.txt#data-obfuscation-with-advanced-api-security).

## March 05, 2025

**Apigee UI** Announcement On March 5, 2025, we released an updated version of the Apigee UI.
Fixed

| Bug ID | Description |
|---|---|
| **368686537** | **Resolved issue causing delay when loading API product pages in the Apigee UI in Cloud console.** Members of Apigee organizations with large number of API proxies experienced long load times when accessing the **API product create** or **API product edit** pages in the Apigee UI in Cloud console. |

## March 01, 2025

**Apigee hybrid** v1.14.1 Announcement

### hybrid v1.14.1

On March 1, 2025 we released an updated version of the Apigee hybrid software, 1.14.1.

This release enhances the security posture within the [JavaCallout](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/java-callout-policy.md.txt) and [PythonScript](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/python-script-policy.md.txt) policies. This release does not include any new features or general bug fixes.

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.14](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/big-picture.md.txt).
- For recommended actions after upgrading, see [Validate policies after upgrade to 1.14.1](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/upgrade.md.txt#recommended-actions-upgrade-1141).
Fixed

| Bug ID | Description |
|---|---|
| **396886110** | **Fixed a bug where the HPA max replicas could be lower than min.** |
| **392547038** | **Add Helm chart template checks for non-existent environments and virtualhosts.** |
| **391861216** | **Restore for Google Cloud Platform and HYBRID Cloud Providers no longer affects system keyspaces. This fixes [Known Issue 391861216](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt#391861216).** |
| **390019667** | **Fixed bug where the daemonsets had an invalid pod disruption budget which prevented downscaling.** |
| **383441226** | **Added the following `metrics` configuration properties:** - [metrics.adapter.resources.limits.cpu](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/config-prop-ref.md.txt#metrics-adapter-resources-limits-cpu) - [metrics.adapter.resources.limits.memory](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/config-prop-ref.md.txt#metrics-adapter-resources-limits-memory) - [metrics.adapter.resources.requests.cpu](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/config-prop-ref.md.txt#metrics-adapter-resources-requests-cpu) - [metrics.adapter.resources.requests.memory](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/config-prop-ref.md.txt#metrics-adapter-resources-requests-memory) - [metrics.prometheus.resources.limits.cpu](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/config-prop-ref.md.txt#metrics-prometheus-resources-limits-cpu) - [metrics.prometheus.resources.limits.memory](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/config-prop-ref.md.txt#metrics-prometheus-resources-limits-memory) - [metrics.prometheus.resources.requests.cpu](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/config-prop-ref.md.txt#metrics-prometheus-resources-requests-cpu) - [metrics.prometheus.resources.requests.memory](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/config-prop-ref.md.txt#metrics-prometheus-resources-requests-memory) |
| **382565315** | **LogTimer usage in SecurityPolicy could cause a memory leak.** |

Security **Stricter class instantiation checks included in this release.**

JavaCallout policy now includes additional security during Java class instantiation. The enhanced security measure prevents the deployment of policies that directly or indirectly attempt actions that require permissions that are not allowed.

In most cases, existing policies will continue to function as expected without any issues. However, there is a possibility that policies relying on third-party libraries, or those with custom code that indirectly triggers operations requiring elevated permissions, could be affected.

To test your installation, follow the procedure in [Validate policies after upgrade to 1.14.1](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/upgrade.md.txt#recommended-actions-upgrade-1141) to validate policy behavior.

| Bug ID | Description |
|---|---|
| **385394193** , **383850393** , **383778273** | **Security fixes for `apigee-cassandra-backup-utility`, `apigee-cassandra-client`, and `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2024-0727](https://nvd.nist.gov/vuln/detail/CVE-2024-0727) - [CVE-2023-5678](https://nvd.nist.gov/vuln/detail/CVE-2023-5678) - [CVE-2022-3715](https://nvd.nist.gov/vuln/detail/CVE-2022-3715) |
| **383113773, 382967738** | **Fixed a vulnerability in PythonScript policy.** |
| **365178914** | **Security fixes for `apigee-cassandra-backup-utility` and `apigee-hybrid-cassandra`.** This addresses the following vulnerability: - [CVE-2023-37920](https://nvd.nist.gov/vuln/detail/CVE-2023-37920) |
| **N/A** | **Security fixes for `apigee-asm-istiod`.** This addresses the following vulnerability: - [CVE-2024-45338](https://nvd.nist.gov/vuln/detail/CVE-2024-45338) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** This addresses the following vulnerability: - [CVE-2023-37920](https://nvd.nist.gov/vuln/detail/CVE-2023-37920) |
| **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** This addresses the following vulnerabilities: - [CVE-2025-24970](https://nvd.nist.gov/vuln/detail/CVE-2025-24970) - [CVE-2024-47535](https://nvd.nist.gov/vuln/detail/CVE-2024-47535) |
| **N/A** | **Security fixes for `apigee-open-telemetry-collector`.** This addresses the following vulnerability: - [CVE-2024-45338](https://nvd.nist.gov/vuln/detail/CVE-2024-45338) |
| **392174215** | **Security fixes for `apigee-operator`.** This addresses the following vulnerabilities: - [CVE-2024-45337](https://nvd.nist.gov/vuln/detail/CVE-2024-45337) - [CVE-2024-45338](https://nvd.nist.gov/vuln/detail/CVE-2024-45338) |
| **N/A** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerabilities: - [CVE-2024-45338](https://nvd.nist.gov/vuln/detail/CVE-2024-45338) - [CVE-2024-45337](https://nvd.nist.gov/vuln/detail/CVE-2024-45337) |
| **391786033** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerability: - [CVE-2024-45338](https://nvd.nist.gov/vuln/detail/CVE-2024-45338) |
| **388271708** | **Security fix for Apigee infrastructure** This addresses the following vulnerability: - CVE-2025-13426Fixed an issue with the JavaCallout policy that could result in remote code execution. <br /> |

Announcement **Manage process ID limits**

The procedure to manage the process ID limits in your clusters has been added to the documentation.

A Process ID limit is a Kubernetes resource constraint on nodes and pods to prevent excessive process creation, which can impact node stability. Setting process ID limits in Kubernetes can improve system stability, security, and resource management. This is also consistent with Kubernetes best practices. Apigee Hybrid supports the Kubernetes feature to set process ID limits.

See: [Manage process ID limits](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/manage-process-id-limit.md.txt).
v1.13.3 Announcement

### hybrid v1.13.3

On March 1, 2025 we released an updated version of the Apigee hybrid software, 1.13.3.

This release enhances the security posture within the [JavaCallout](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/java-callout-policy.md.txt) and [PythonScript](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/python-script-policy.md.txt) policies. This release does not include any new features or general bug fixes.

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.13](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/big-picture.md.txt).
- For recommended actions after upgrading, see [Validate policies after upgrade to 1.13.3](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/upgrade.md.txt#recommended-actions-upgrade-1133).
Fixed

| Bug ID | Description |
|---|---|
| **396886110** | **Fixed a bug where the HPA max replicas could be lower than min.** |
| **391861216** | **Restore for Google Cloud Platform and HYBRID Cloud Providers no longer affects system keyspaces. This fixes [Known Issue 391861216](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt#391861216).** |
| **390258745** , **388608440** | **Any left over Cassandra snapshots are automatically removed. This fixes [known issue 388608440](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt#388608440).** |
| **390019667** | **Fixed bug where the daemonsets had an invalid pod disruption budget which prevented downscaling.** |
| **383441226** | **Added the following `metrics` configuration properties:** - [metrics.adapter.resources.limits.cpu](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/config-prop-ref.md.txt#metrics-adapter-resources-limits-cpu) - [metrics.adapter.resources.limits.memory](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/config-prop-ref.md.txt#metrics-adapter-resources-limits-memory) - [metrics.adapter.resources.requests.cpu](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/config-prop-ref.md.txt#metrics-adapter-resources-requests-cpu) - [metrics.adapter.resources.requests.memory](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/config-prop-ref.md.txt#metrics-adapter-resources-requests-memory) - [metrics.prometheus.resources.limits.cpu](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/config-prop-ref.md.txt#metrics-prometheus-resources-limits-cpu) - [metrics.prometheus.resources.limits.memory](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/config-prop-ref.md.txt#metrics-prometheus-resources-limits-memory) - [metrics.prometheus.resources.requests.cpu](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/config-prop-ref.md.txt#metrics-prometheus-resources-requests-cpu) - [metrics.prometheus.resources.requests.memory](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/config-prop-ref.md.txt#metrics-prometheus-resources-requests-memory) |
| **382565315** | **LogTimer usage in SecurityPolicy could cause a memory leak.** |

Security **Stricter class instantiation checks included in this release.**

JavaCallout policy now includes additional security during Java class instantiation. The enhanced security measure prevents the deployment of policies that directly or indirectly attempt actions that require permissions that are not allowed.

In most cases, existing policies will continue to function as expected without any issues. However, there is a possibility that policies relying on third-party libraries, or those with custom code that indirectly triggers operations requiring elevated permissions, could be affected.

To test your installation, follow the procedure in [Validate policies after upgrade to 1.13.3](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/upgrade.md.txt#recommended-actions-upgrade-1133) to validate policy behavior.

| Bug ID | Description |
|---|---|
| Bug ID | Description |
| **385394193** , **383850393** , **383778273** | **Security fixes for `apigee-cassandra-backup-utility`, `apigee-cassandra-client`, and `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2024-0727](https://nvd.nist.gov/vuln/detail/CVE-2024-0727) - [CVE-2023-5678](https://nvd.nist.gov/vuln/detail/CVE-2023-5678) - [CVE-2022-3715](https://nvd.nist.gov/vuln/detail/CVE-2022-3715) |
| **382967738** | **Fixed a vulnerability in PythonScript policy.** |
| **N/A** | **Security fixes for `apigee-envoy`.** This addresses the following vulnerability: - [CVE-2019-1010024](https://nvd.nist.gov/vuln/detail/CVE-2019-1010024) |
| **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerability: - [CVE-2024-10979](https://nvd.nist.gov/vuln/detail/CVE-2024-10979) |
| **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** This addresses the following vulnerabilities: - [CVE-2025-24970](https://nvd.nist.gov/vuln/detail/CVE-2025-24970) - [CVE-2024-47535](https://nvd.nist.gov/vuln/detail/CVE-2024-47535) |
| **N/A** | **Security fixes for `apigee-open-telemetry-collector`.** This addresses the following vulnerability: - [CVE-2024-45338](https://nvd.nist.gov/vuln/detail/CVE-2024-45338) |
| **392174215** | **Security fixes for `apigee-operator`.** This addresses the following vulnerabilities: - [CVE-2024-45337](https://nvd.nist.gov/vuln/detail/CVE-2024-45337) - [CVE-2024-45338](https://nvd.nist.gov/vuln/detail/CVE-2024-45338) |
| **N/A** | **Security fixes for `apigee-redis`.** This addresses the following vulnerabilities: - [CVE-2022-24834](https://nvd.nist.gov/vuln/detail/CVE-2022-24834) - [CVE-2022-24735](https://nvd.nist.gov/vuln/detail/CVE-2022-24735) |
| **391786033** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerability: - [CVE-2024-45338](https://nvd.nist.gov/vuln/detail/CVE-2024-45338) |
| **N/A** | **Security fixes for `livenessprobe`.** This addresses the following vulnerability: - [CVE-2023-45288](https://nvd.nist.gov/vuln/detail/CVE-2023-45288) |
| **388271708** | **Security fix for Apigee infrastructure** This addresses the following vulnerability: - CVE-2025-13426Fixed an issue with the JavaCallout policy that could result in remote code execution. <br /> |

Announcement **Manage process ID limits**

The procedure to manage the process ID limits in your clusters has been added to the documentation.

A Process ID limit is a Kubernetes resource constraint on nodes and pods to prevent excessive process creation, which can impact node stability. Setting process ID limits in Kubernetes can improve system stability, security, and resource management. This is also consistent with Kubernetes best practices. Apigee Hybrid supports the Kubernetes feature to set process ID limits.

See: [Manage process ID limits](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/manage-process-id-limit.md.txt).
v1.12.4 Announcement

### hybrid v1.12.4

On March 1, 2025 we released an updated version of the Apigee hybrid software, 1.12.4.

This release enhances the security posture within the [JavaCallout](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/java-callout-policy.md.txt) and [PythonScript](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/python-script-policy.md.txt) policies. This release does not include any new features or general bug fixes.

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.12](https://docs.cloud.google.com/apigee/docs/hybrid/v1.12/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.12/big-picture.md.txt).
- For recommended actions after upgrading, see [Validate policies after upgrade to 1.12.4](https://docs.cloud.google.com/apigee/docs/hybrid/v1.12/upgrade.md.txt#recommended-actions-upgrade-1124).
Fixed

| Bug ID | Description |
|---|---|
| **390258745** , **388608440** | **Any left over Cassandra snapshots are automatically removed. This fixes [known issue 388608440](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt#388608440).** |

Security **Stricter class instantiation checks included in this release.**

JavaCallout policy now includes additional security during Java class instantiation. The enhanced security measure prevents the deployment of policies that directly or indirectly attempt actions that require permissions that are not allowed.

In most cases, existing policies will continue to function as expected without any issues. However, there is a possibility that policies relying on third-party libraries, or those with custom code that indirectly triggers operations requiring elevated permissions, could be affected.

To test your installation, follow the procedure in [Validate policies after upgrade to 1.12.4](https://docs.cloud.google.com/apigee/docs/hybrid/v1.12/upgrade.md.txt#recommended-actions-upgrade-1124) to validate policy behavior.

| Bug ID | Description |
|---|---|
| **391923260** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerabilities: - [CVE-2024-24789](https://nvd.nist.gov/vuln/detail/CVE-2024-24789) - [CVE-2024-45337](https://nvd.nist.gov/vuln/detail/CVE-2024-45337) - [CVE-2024-45338](https://nvd.nist.gov/vuln/detail/CVE-2024-45338) - [CVE-2024-24790](https://nvd.nist.gov/vuln/detail/CVE-2024-24790) - [CVE-2022-23635](https://nvd.nist.gov/vuln/detail/CVE-2022-23635) - [CVE-2022-31045](https://nvd.nist.gov/vuln/detail/CVE-2022-31045) - [CVE-2021-39156](https://nvd.nist.gov/vuln/detail/CVE-2021-39156) - [CVE-2021-39155](https://nvd.nist.gov/vuln/detail/CVE-2021-39155) - [CVE-2019-14993](https://nvd.nist.gov/vuln/detail/CVE-2019-14993) |
| **385394193** , **383850393** , **383778273** | **Security fixes for `apigee-cassandra-backup-utility`, `apigee-cassandra-client`, and `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2024-0727](https://nvd.nist.gov/vuln/detail/CVE-2024-0727) - [CVE-2023-5678](https://nvd.nist.gov/vuln/detail/CVE-2023-5678) - [CVE-2022-3715](https://nvd.nist.gov/vuln/detail/CVE-2022-3715) |
| **382967738** | **Fixed a vulnerability in PythonScript policy.** |
| **365178914** | **Security fixes for `apigee-cassandra-backup-utility` and `apigee-hybrid-cassandra`.** This addresses the following vulnerability: - [CVE-2023-37920](https://nvd.nist.gov/vuln/detail/CVE-2023-37920) |
| **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerability: - [CVE-2024-10979](https://nvd.nist.gov/vuln/detail/CVE-2024-10979) |
| **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2024-24790](https://nvd.nist.gov/vuln/detail/CVE-2024-24790) - [CVE-2019-9192](https://nvd.nist.gov/vuln/detail/CVE-2019-9192) - [CVE-2019-1010023](https://nvd.nist.gov/vuln/detail/CVE-2019-1010023) - [CVE-2019-1010022](https://nvd.nist.gov/vuln/detail/CVE-2019-1010022) - [CVE-2018-20796](https://nvd.nist.gov/vuln/detail/CVE-2018-20796) |
| **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerability: - [CVE-2024-10979](https://nvd.nist.gov/vuln/detail/CVE-2024-10979) |
| **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2024-24790](https://nvd.nist.gov/vuln/detail/CVE-2024-24790) - [CVE-2019-9192](https://nvd.nist.gov/vuln/detail/CVE-2019-9192) - [CVE-2019-1010023](https://nvd.nist.gov/vuln/detail/CVE-2019-1010023) - [CVE-2019-1010022](https://nvd.nist.gov/vuln/detail/CVE-2019-1010022) - [CVE-2018-20796](https://nvd.nist.gov/vuln/detail/CVE-2018-20796) |
| **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** This addresses the following vulnerability: - [CVE-2024-47535](https://nvd.nist.gov/vuln/detail/CVE-2024-47535) |
| **N/A** | **Security fixes for `apigee-open-telemetry-collector`.** This addresses the following vulnerability: - [CVE-2024-36129](https://nvd.nist.gov/vuln/detail/CVE-2024-36129) |
| **N/A** | **Security fixes for `apigee-udca`.** This addresses the following vulnerability: - [CVE-2024-24790](https://nvd.nist.gov/vuln/detail/CVE-2024-24790) |
| **388271708** | **Security fix for Apigee infrastructure** This addresses the following vulnerability: - CVE-2025-13426Fixed an issue with the JavaCallout policy that could result in remote code execution. <br /> |

## February 28, 2025

**Apigee X** Announcement On February 28, 2025, we released an updated version of Apigee (1-14-0-apigee-8).

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Security

| Bug ID | Description |
|---|---|
| **382883585** | **Fixed a vulnerability in the JavaCallout policy.** |
| **N/A** | **Updates to security infrastructure and libraries.** |

## February 27, 2025

**Apigee UI** Announcement On February 27, 2025, we released an updated version of the Apigee Proxy Debug tool.

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Feature **Overview**

This release introduces a redesigned debugging experience for API proxies in the Apigee UI, which is available in Google Cloud console.

This new feature, [Debug Sequence View (v2)](https://docs.cloud.google.com/apigee/docs/api-platform/debug/trace.md.txt), addresses user feedback and aims to streamline the process of identifying and resolving issues in your API proxies.

We believe that Debug Sequence View will significantly improve the API proxy debugging experience. We encourage you to try it out and provide your valuable feedback as we continue to refine and enhance this feature!

**Key highlights**

- **Intuitive horizontal layout** :  
  The new Debug Sequence View (v2) features a horizontal sequence diagram, mirroring the familiar layout of the classic Apigee Console UI, making it easier to understand the flow of your API proxy transactions at a glance.
- **Enhanced clarity** :  
  The horizontal visualization, coupled with improved grouping of events, provides a clearer picture of policy execution, highlighting errors and their context within the transaction flow.
- **Streamlined workflow** :  
  Debug Sequence View (v2) is designed to reduce the need for disruptive pop-ups and sifting through events, offering a smoother and more focused debugging experience. Reimagined icons help quickly understand a transaction at a glance.
- **Feature parity** :  
  Debug Sequence View (v2) is designed for users already familiar with debugging in Apigee Classic UI to quickly be proficient.
- **Search** :  
  You can now search for a specific string in the sequence diagram and details pane.
- **Improved API status display** :  
  The API status display in the transaction list has been improved for increased readability.
- **Consolidated FlowInfo events** :  
  FlowInfo events are now grouped together in the sequence diagram.
- **Target URL displayed** :  
  Displayed target URL on "Request Sent" node when relevant

## February 19, 2025

**Apigee X** Announcement On February 19, 2025, we released an updated version of Apigee (1-14-0-apigee-7).

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Security

| Bug ID | Description |
|---|---|
| **391714121** | **Security fix for Apigee infrastructure.** This addresses the following vulnerability: - [CVE-2024-45338](https://nvd.nist.gov/vuln/detail/CVE-2024-45338) |

Fixed

| Bug ID | Description |
|---|---|
| **N/A** | **Updates to security infrastructure and libraries.** |

## February 11, 2025

**Apigee API hub** Feature **IAM conditions for fine-grained access**

API hub now integrates with IAM Conditions, enabling you to define and enforce granular, conditional attribute-based access control for your API hub resources. For more information, see [Add IAM conditions](https://docs.cloud.google.com/apigee/docs/apihub/add-iam-conditions.md.txt).
Change **Enhanced onboarding experience**

After provisioning your API hub instance in your Google Cloud project, you'll now see an updated **Overview** page. You can also automatically attach your Apigee runtime projects right from this page. For more information, see [Provision API hub in the Cloud console](https://docs.cloud.google.com/apigee/docs/apihub/provision.md.txt).
Change **Auth support for Vertex AI extensions**

API hub now supports the following authentication configurations for creating Vertex AI extensions:

- `API Key`: Authenticate using API keys stored in Secret Manager.
- `HTTP Basic`: Authenticate using credentials stored in Secret Manager.

For more information, see [Create a Vertex AI extension](https://docs.cloud.google.com/apigee/docs/apihub/vertex-extensions#createextension).
Change **Resource ID length limits increased**

The maximum allowed length for API hub resource IDs has been increased. The new limits are as follows:

- **APIs:** API unique IDs can now be up to 500 characters long.
- **Versions:** Version unique IDs can now be up to 700 characters long.
- **Specs:** Specification unique IDs can now be up to 1000 characters long.
**Apigee UI** Change On February 11, 2025, we released an updated version of the Apigee UI.
Fixed

| Bug ID | Description |
|---|---|
| **356780408** | **Fixed issue preventing users from saving a proxy revision** Resolved issue in the proxy editor where navigating away from a proxy file containing an error would not properly clear the error state, requiring users to reload the page to save the edited proxy. |

## February 06, 2025

**Apigee X** Announcement On February 6, 2025, we released an updated version of Apigee (1-14-0-apigee-6).

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Fixed

| Bug ID | Description |
|---|---|
| **381553288** | **Fixed class initialization issue in JavaCallout policy.** |
| **390559772** | **Fixed issue with ResponseCache policy not appearing in debug sessions when added using Apigee APIM Operator for Kubernetes.** |
| **N/A** | **Updates to security infrastructure and libraries.** |

## February 04, 2025

**Apigee Integrated Portal** Announcement On February 4, 2025 we released a new version of the Apigee integrated portal.
Feature This release includes general improvements to performance and availability.

## February 03, 2025

**Apigee UI** Announcement On February 3, we released an updated version of the Apigee UI.
Feature **GA of Apigee analytics dashboards in Google Cloud console**

You can now access these dashboards in the Apigee UI in Google Cloud console:

- **Analytics \> Developer analysis \>** [Developer engagement](https://docs.cloud.google.com/apigee/docs/api-platform/analytics/partner-engagement-dashboard.md.txt)
- **Analytics \> Developer analysis \>** [Traffic composition](https://docs.cloud.google.com/apigee/docs/api-platform/analytics/traffic-composition-dashboard.md.txt)
- **Analytics \> End user analysis \>** [Devices](https://docs.cloud.google.com/apigee/docs/api-platform/analytics/devices-dashboard.md.txt)
- **Analytics \> End user analysis \>** [Geomap](https://docs.cloud.google.com/apigee/docs/api-platform/analytics/geomap-dashboard.md.txt)
**Apigee X** Feature **Public Preview of the Apigee APIM Operator for Kubernetes**

The Apigee APIM Operator for Kubernetes (Preview) allows you to perform API management tasks using Kubernetes tools. It is designed to support cloud-native developers by providing a command-line interface that integrates with familiar Kubernetes tools like `kubectl`. The operator works by using various APIM resources to keep your Google Kubernetes Engine (GKE) cluster synchronized with the Apigee runtime.

For more information, see [Apigee APIM Operator for Kubernetes overview](https://docs.cloud.google.com/apigee/docs/api-platform/apigee-kubernetes/apigee-apim-operator-overview.md.txt).

## January 24, 2025

**Apigee X** Announcement On January 24, 2025, we released an updated version of Apigee (1-14-0-apigee-4).

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Fixed

| Bug ID | Description |
|---|---|
| **372248577** | **Fixed issue causing `system.pod.name` flow variable to return `null`.** |
| **N/A** | **Updates to security infrastructure and libraries.** |

## January 15, 2025

**Apigee API hub** Feature **Resource filtering with user-Defined attributes**

You can now filter API hub resources based on user-defined attributes using a REST API call. For more information, see [Filter resources based on user attributes](https://docs.cloud.google.com/apigee/docs/apihub/manage-attributes.md.txt#filter-resources-based-on-user-attributes).
Change **Validation for user-defined attributes**

API hub now supports JSON schema validation for user-defined attributes. This enhancement ensures data integrity and consistency for JSON data type inputs, improving the quality and reliability of API specifications.

## January 13, 2025

**Apigee Advanced API Security** Announcement On January 13, 2025 we released an updated version of Apigee's Shadow API Discovery.
Feature **Shadow API Discovery latency improvements**

This release improves Shadow API Discovery and removes the latency impact on load balancers previously documented as part of Shadow API Discovery enablement.

For more information on Shadow API Discovery, see the [Shadow API Discovery customer documentation](https://docs.cloud.google.com/apigee/docs/api-observation/shadow-api-discovery.md.txt).

## January 09, 2025

**Apigee X** Fixed

| Bug ID | Description |
|---|---|
| **365406457** | **Implemented fix to optimize CPU usage and close sockets when needed.** |
| **382967738, 383113773** | **Fixed security vulnerability in PythonScript policy.** |
| **382883585** | **Fixed security vulnerability in JavaCallout policy.** |
| **N/A** | **Updates to security infrastructure and libraries.** |

Announcement On January 9, 2025, we released an updated version of Apigee (1-14-0-apigee-3).

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

**Apigee hybrid** 1.14.0-hotfix.1 Announcement

### hybrid 1.14.0-hotfix.1

On January 9, 2025 we released an updated version of the Apigee hybrid software, 1.14.0-hotfix.1.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.14](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/big-picture.md.txt).

> [!NOTE]
> **Note:** This release only affects the `apigee-telemetry` chart.

#### **Instructions**:

To install 1.14.0-hotfix.1:

1. In your `overrides.yaml` file update the value of `metrics.sdSidecar.image.tag` to `0.10.0`. Add the following stanza:

       metrics:
         sdSidecar:
           image:
             url: "gcr.io/apigee-release/hybrid/apigee-stackdriver-prometheus-sidecar"
             tag: "0.10.0"

2. Apply the changes to the `apigee-telemetry` chart:

   1. Dry run:

          helm upgrade telemetry apigee-telemetry/ \
            --install \
            --namespace APIGEE_NAMESPACE \
            --atomic \
            -f overrides.yaml \
            --dry-run=server

   2. Install the chart:

          helm upgrade telemetry apigee-telemetry/ \
            --install \
            --namespace APIGEE_NAMESPACE \
            --atomic \
            -f overrides.yaml

   3. Verify the change by checking its state:

          kubectl -n APIGEE_NAMESPACE get apigeetelemetry apigee-telemetry

Fixed

| Bug ID | Description |
|---|---|
| **367681534** | **Tagging [`apigee-stackdriver-prometheus-sidecar`](http://gcr.io/apigee-release/hybrid/apigee-stackdriver-prometheus-sidecar:0.10.0) to prevent removal from customer repos after 2 years due to infrequent updates.** |

## January 07, 2025

**Apigee Advanced API Security** Announcement On January 7, 2024 we released a new version of Advanced API Security Abuse Detection.

> [!NOTE]
> **Note:** Rollouts of this release to production instances have begun and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the feature available until the rollout is complete.

Feature **API key drill down details are now available in the preview release of Advanced API Security Abuse Detection incidents.**

This new functionality allows viewing details of detected abuse by the API key used to access the API.

For usage information, see the [Abuse Detection customer documentation for incident details](https://docs.cloud.google.com/apigee/docs/api-security/abuse-detection.md.txt#incident-details).

## January 06, 2025

**Apigee Advanced API Security** Announcement On January 6, 2025 we released an updated version of Advanced API Security.
Feature **UI support for environment-level client IP address resolution**

This release introduces the ability to view the client IP address resolution setting for an environment in the Apigee Console.

For more information and usage instructions, see the [Client IP resolution customer documentation](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/client-ip-resolution.md.txt).

## December 20, 2024

**Apigee Advanced API Security** Announcement On December 20, 2024 we released an updated version of Apigee.

**Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the feature available until the rollout is complete.
Feature **Support for environment-level client IP address resolution**

This release introduces the ability to specify, per environment, how to capture the client IP address on API requests from the X-Forwarded-For header. When configured for the environment, the specified client IP address is used to apply security actions, populate the `ax_resolved_client_ip` Analytics variable and the new `client.resolved.ip` flow variable. The new configuration option can be used to specify the request IP address used in Advanced API Security.

This functionality is not available in Apigee hybrid at this time.

For more information and usage instructions, see the [Client IP resolution customer documentation](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/client-ip-resolution.md.txt), [Analytics dimensions](https://docs.cloud.google.com/apigee/docs/api-platform/analytics/analytics-reference.md.txt#dimensions), and [client flow variable](https://docs.cloud.google.com/apigee/docs/api-platform/reference/variables-reference.md.txt#client).
**Apigee X** Announcement On December 20, 2024 we released an updated version of Apigee.

**Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the feature available until the rollout is complete.
Feature **Support for environment-level client IP address resolution**

This release introduces the ability to specify, per environment, how to capture the client IP address on API requests from the X-Forwarded-For header. When configured for the environment, the specified client IP address is used to apply security actions, populate the `ax_resolved_client_ip` Analytics variable and the new `client.resolved.ip` flow variable. The new configuration option can be used to specify the request IP address used in Advanced API Security.

This functionality is not available in Apigee hybrid at this time.

For more information and usage instructions, see the [Client IP resolution customer documentation](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/client-ip-resolution.md.txt), [Analytics dimensions](https://docs.cloud.google.com/apigee/docs/api-platform/analytics/analytics-reference.md.txt#dimensions), and [client flow variable](https://docs.cloud.google.com/apigee/docs/api-platform/reference/variables-reference.md.txt#client).

## December 19, 2024

**Apigee X** Fixed

| Bug ID | Description |
|---|---|
| **N/A** | **Updates to security infrastructure and libraries.** |

Announcement On December 19, 2024, we released an updated version of Apigee (1-14-0-apigee-3) for trial organizations only.

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

## December 17, 2024

**Apigee X** Announcement On December 17, 2024, we released a new version of Apigee.
Change With this release, the maximum number of apps per AppGroup is increased from 500 to 30,000.

For more information, see the Apigee [Limits page](https://docs.cloud.google.com/apigee/docs/api-platform/reference/limits.md.txt).

## December 16, 2024

**Apigee hybrid** v1.14.0 Announcement

### hybrid v1.14.0

On December 16, 2024 we released an updated version of the Apigee hybrid software, v1.14.0.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.14](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/big-picture.md.txt).
Feature **New analytics and debug data pipeline for hybrid orgs**

Starting with version 1.14, Apigee hybrid orgs can use a new data pipeline to collect analytics and debug data and allow various runtime components to write data directly to our control plane. Control plane access is required to enable the new data pipeline.

See:

- [Enable Control Plane access](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/install-enable-control-plane-access.md.txt)
- [Configure hybrid to use the new data pipeline (v1.14.0 only)](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/data-collection-with-data-residency.md.txt)
Feature **Cassandra credential rotation**

Starting in version v1.14, you can rotate Cassandra credentials in Kubernetes secrets. In addition, you can now roll back credential rotation before the cleanup job is initiated in both Vault and Kubernetes secrets. See:

- [Rotating Cassandra credentials in Kubernetes secrets](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/rotating-cassandra-credentials-non-ess.md.txt)
- [Rotating Cassandra credentials in Vault: Rolling back a rotation](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/rotating-cassandra-credentials-in-vault.md.txt#rollback-rotation)
- [Rotating Cassandra credentials in Kubernetes secrets: Rolling back a rotation](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/rotating-cassandra-credentials-non-ess.md.txt#rollback-rotation)
Feature **Enable and disable metrics-based scaling with `customAutoscaling.enabled`**

Starting in version v1.14, you can enable and disable metrics-based auto-scaling with the `customAutoscaling.enabled` configuration property. See:

- [Scale and autoscale runtime services: Metrics-based scaling](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/scale-and-autoscale.md.txt#metrics-scaling)
- [`customAutoscaling.enabled`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/config-prop-ref.md.txt#customautoscaling-enabled)
Feature **Guardrails checks to ensure backups before upgrade**

Starting in version 1.14 new guardrails checks have been added to ensure a backup is enabled and has been made before proceeding with an upgrade. See:

- [Upgrading Apigee hybrid to version v1.14](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/upgrade.md.txt#prepare)
- [Diagnosing issues with guardrails](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/guardrails.md.txt)
Feature **Forward Proxy allowlist access**

Starting in version v1.14, forward proxies pass through access to allowlisted URLs. Therefore you only need to configure allowlists to googleapis.com URLs on the server on which the forward proxy is configured. See:

- [Google Cloud URLs to allow for Hybrid](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/allow-gcp-urls.md.txt)
- [Using Data Residency with Apigee hybrid: URL allowlisting](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/using-data-residency-with-apigee-hybrid.md.txt#url-allowlisting)
- [Configure forward proxying for API proxies](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/forward-proxy.md.txt)
Feature **Enhanced Per-environment Proxy Limits in Apigee Hybrid**

Starting in version v1.14, new Apigee hybrid organizations can be provisioned with the ability to deploy more than 50 proxies per environment enabled. This feature is already available for [Apigee X](https://docs.cloud.google.com/apigee/docs/api-platform/reference/limits.md.txt#api-proxies).

Starting with Apigee hybrid version 1.14, the limits for Apigee hybrid organizations have increased:

- The maximum number of deployed API proxies and shared flows per organization is 6000.
- The maximum number of proxy deployment units per Apigee instance is 6000.
- The maximum number of API base paths per Apigee organization is 3000.

The API base path limit in this note is incorrect; see entry for [September 24, 2026](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#September_24_2026).

When more than 50 proxies are deployed in an environment, Apigee will automatically partition the environment into several distinct replica sets, each containing a subset of proxies deployed in the environment. These replica subsets are equivalent in behavior and infrastructure resource usage to a single environment in the way it loads and runs a set of proxies and other environment resources. This will be transparent to the user, and you can continue to use the environment as you would a single environment.

> [!NOTE]
> **Note:** Enhanced per-environment proxy limits are only available for new hybrid organizations with the entitlement for the feature included in [Subscription 2024](https://docs.cloud.google.com/apigee/docs/api-platform/reference/subscription-entitlements.md.txt#subscription-2024-entitlements). Enhanced per-environment proxy limits are not available in upgraded organizations.

See:

- [Enhanced per-environment proxy limits](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/enhanced-proxy-limits.md.txt)
- [Subscription 2024](https://docs.cloud.google.com/apigee/docs/api-platform/reference/subscription-entitlements.md.txt#subscription-2024-entitlements)
Fixed

| Bug ID | Description |
|---|---|
| **382323427** | **Added a guardrails check that requires backup to be enabled for Apigee Hybrid upgrades. Backups are required prior to upgrading to support restoring to the previous version, if necessary.** |
| **380346557** | **Added a guardrails check that requires the backup within the last 24 hours to be present if the CSI backup is enabled. This will minimize potential data loss if a restore to the previous version is needed.** |
| **377573589** | **Fix a bug where manually created rollbacks would interfere with existing rotations instead of cancelling them.** |
| **362305438** | **Users can now add additional env variables to the runtime component.** See [`runtime.envVars`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/config-prop-ref.md.txt#runtime-envvars) |
| **319152386** | **Fix `AccessTokenGenerationFailure` in runtime when using a forward proxy.** |
| **335357961** | **Fixed an issue where Apigee hybrid could claim uploads of backups with the Cloud provider when no bucket had been configured** |
| **290183372** | **The need to allowlist oauth2 and iamcredentials.googleapis.com directly from MP in fwd proxy setup is removed.** |
| **237656263** | **Resolved issue with ServiceCallout policy not working in async mode as expected.** |
| **373722434** | **Fixed support for backups to Google Cloud Storage buckets with retention policies.** (Fixed in [v1.13.2](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1132)) |
| **368646378** | **Fixed an issue affecting control Plane connectivity testing in Guardrails.** (Fixed in [v1.12.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1123)) |
| **364282883** | **Remove check for dc-expansion flag and add timeout to multi-region seed host connection test.** (Fixed in [v1.13.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1131)) |
| **362979563** | **Fix for Ingress Health Check failure `/healthz/ingress - route_not_found`.** (Fixed in [1.13.0-hotfix.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_1130-hotfix1)) |
| **362690729** | **Fix for aggressive scaling of runtime pods \& cpu spike.** (Fixed in [1.13.0-hotfix.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_1130-hotfix1)) |
| **362305438** | **You can now add additional env variables to the runtime component.** (Fixed in [v1.13.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1131)) |
| **361044374** | **Fixes assign message not correctly highlighting the set payload action in the debug trace.** (Fixed in [v1.13.2](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1132)) |
| **355122464** | **This release contains a few error-handling fixes for CSI backup and restore.** (Fixed in [v1.13.2](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1132)) |
| **353527851** | **WebSocket connection drops when using `VerifyJwt` or `OAuthV2 VerifyJWTAccessToken` operations.** (Fixed in [v1.13.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1131)) |
| **351440306** | **An issue was fixed where trace could not be viewed in the UI for orgs with DRZ enabled.** (Fixed in [v1.13.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1131)) |
| **347798999** | **You can now configure forward proxy for opentelemetry pods in Apigee hybrid.** (Fixed in [v1.12.2](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1122)) |
| **338638343** | **An ID is now added at the end of `apigee-env` and `virtualhost` guardrails pods to make the pod names unique.** (Fixed in [v1.13.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1131)) |
| **237656263** | **Fix added to make use of asynchronous ServiceCallout execution when the [ServiceCallout policy \<Response\> element](https://cloud.google.com/apigee/docs/api-platform/reference/policies/service-callout-policy#response) is not present** (Fixed in [v1.13.2](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1132)) |
| **181569113** | **Fixed an issue in new debug session creation.** (Fixed in [v1.12.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1123)) |

Security

| Bug ID | Description |
|---|---|
| **N/A** | **Security fixes for `apigee-redis`.** This addresses the following vulnerabilities: - [CVE-2022-24834](https://nvd.nist.gov/vuln/detail/CVE-2022-24834) - [CVE-2022-24735](https://nvd.nist.gov/vuln/detail/CVE-2022-24735) |
| **N/A** | **Security fixes for `livenessprobe`.** This addresses the following vulnerability: - [CVE-2023-45288](https://nvd.nist.gov/vuln/detail/CVE-2023-45288) |
| **376104926** | **Security fixes for `apigee-kube-rbac-proxy`.** (Fixed in [v1.12.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1123)) This addresses the following vulnerabilities: - [CVE-2024-41110](https://nvd.nist.gov/vuln/detail/CVE-2024-41110) - [CVE-2024-28180](https://nvd.nist.gov/vuln/detail/CVE-2024-28180) - [CVE-2024-24790](https://nvd.nist.gov/vuln/detail/CVE-2024-24790) - [CVE-2024-24789](https://nvd.nist.gov/vuln/detail/CVE-2024-24789) - [CVE-2023-4039](https://nvd.nist.gov/vuln/detail/CVE-2023-4039) - [CVE-2022-27943](https://nvd.nist.gov/vuln/detail/CVE-2022-27943) - [CVE-2019-1010025](https://nvd.nist.gov/vuln/detail/CVE-2019-1010025) - [CVE-2019-1010024](https://nvd.nist.gov/vuln/detail/CVE-2019-1010024) - [CVE-2019-1010023](https://nvd.nist.gov/vuln/detail/CVE-2019-1010023) - [CVE-2019-1010022](https://nvd.nist.gov/vuln/detail/CVE-2019-1010022) - [CVE-2019-9192](https://nvd.nist.gov/vuln/detail/CVE-2019-9192) - [CVE-2018-20796](https://nvd.nist.gov/vuln/detail/CVE-2018-20796) - [CVE-2012-2663](https://nvd.nist.gov/vuln/detail/CVE-2012-2663) - [CVE-2010-4756](https://nvd.nist.gov/vuln/detail/CVE-2010-4756) |
| **N/A** | **Security fixes for `apigee-redis`.** (Fixed in [v1.13.2](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1132)) This addresses the following vulnerabilities: - [CVE-2022-24834](https://nvd.nist.gov/vuln/detail/CVE-2022-24834) - [CVE-2022-24735](https://nvd.nist.gov/vuln/detail/CVE-2022-24735) |
| **N/A** | **Security fixes for `apigee-open-telemetry-collector`.** (Fixed in [v1.13.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1131)) This addresses the following vulnerability: - [CVE-2024-36129](https://nvd.nist.gov/vuln/detail/CVE-2024-36129) |
| **N/A** | **Security fixes for `apigee-open-telemetry-collector`.** (Fixed in [v1.12.3](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1123)) This addresses the following vulnerability: - [CVE-2024-36129](https://nvd.nist.gov/vuln/detail/CVE-2024-36129) |
| **N/A** | **Security fixes for `apigee-cassandra-backup-utility` and `apigee-hybrid-cassandra`.** (Fixed in [v1.12.2](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1122)) This addresses the following vulnerability: - [CVE-2023-37920](https://nvd.nist.gov/vuln/detail/CVE-2023-37920) |

## December 10, 2024

**Apigee Integrated Portal** Announcement On December 10, 2024, we released a new version of the Apigee integrated portal.
Fixed

| Bug ID | Description |
|---|---|
| 381086551 | Fixed an issue that caused the page list view to fail for some portals with large numbers of pages. |

**Apigee X** Announcement On December 10, 2024, we released an updated version of Apigee (1-14-0-apigee-2).

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Fixed

| Bug ID | Description |
|---|---|
| **357880539** | **Resolved issue with missing span in the Apigee UI for distributed trace.** |
| **237656263** | **Resolved issue with ServiceCallout policy not working in async mode as expected.** |
| **N/A** | **Updates to security infrastructure and libraries.** |

## November 22, 2024

**Apigee UI** Fixed

| Bug ID | Description |
|---|---|
| **357165778** | **Refactored app credential management experience** Resolved issue causing the **Apps** page in the Apigee UI in Cloud console to crash when working with apps that have a large amount of products assigned to app credentials. |

Change This release includes an improved **Apps** page for Apigee API Management in the Google Cloud console, making it easier to manage API products that are assigned to app
credentials.

With this release:

- Products can be added to an app from a single multi-select list box.
- Products can be approved, revoked, and removed from a credential by selecting products in the credential product table and using one of the available action buttons.
- Clicking the **Add Credential** button adds an empty credential to the list.
- Credential approval and expiry configuration fields are located in the credential card.
- A warning appears to users if they attempt to leave the **Apps** page when un-saved changes are present.
Announcement On November 22, 2024, we released an updated version of the Apigee UI.

## November 15, 2024

**Apigee UI** Fixed

| Bug ID | Description |
|---|---|
| **376257906** | **Fixed issue with custom report editing** Resolved issue where customer reports without properties that were created using the API could not be rendered with the **Edit** option. |

Announcement On November 15, 2024, we released an updated version of the Apigee UI.

## November 14, 2024

**Apigee Advanced API Security** Announcement On November 14, 2024 we released a new version of Advanced API Security
Feature **IP address drill down details are now available in the preview release of Advanced API Security Abuse Detection Incidents.**

This new functionality allows viewing details of detected abuse by source IP.

For usage information, see the [Abuse Detection customer documentation](https://docs.cloud.google.com/apigee/docs/api-security/abuse-detection.md.txt#incident-details).

## November 12, 2024

**Apigee hybrid** v1.13.2 Announcement

### hybrid v1.13.2

On November 12, 2024 we released an updated version of the Apigee hybrid software, 1.13.2.

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.13.2](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/big-picture.md.txt).
Fixed

| **Bug ID** | **Description** |
|---|---|
| **373722434** | **Fixed support for backups to GCS buckets with retention policies.** |
| **361044374** | **Fixes assign message not correctly highlighting the set payload action in the debug trace.** |
| **355122464** | **This release contains a few error-handling fixes for CSI backup and restore.** |
| **237656263** | **Fix added to make use of asynchronous ServiceCallout execution when the [ServiceCallout policy \<Response\> element](https://cloud.google.com/apigee/docs/api-platform/reference/policies/service-callout-policy#response) is not present** . **Procedure:** 1. In the `apigee-env/values.yaml` file set `conf_system_servicecallout.expects.response` to `false` under `runtime:cwcAppend:`. For example: ``` # Apigee Runtime. runtime: cwcAppend: conf_system_servicecallout.expects.response: false ``` 2. Upgrade the `apigee-env` chart for each environment to apply the change. For example: ``` helm upgrade ENV_RELEASE_NAME apigee-env/ \ --install \ --namespace APIGEE_NAMESPACE \ --set env=ENV_NAME \ -f OVERRIDES_FILE ``` |

Security

| Bug ID | Description |
|---|---|
| **N/A** | **Security fixes for `apigee-redis`.** This addresses the following vulnerabilities: - [CVE-2022-24834](https://nvd.nist.gov/vuln/detail/CVE-2022-24834) - [CVE-2022-24735](https://nvd.nist.gov/vuln/detail/CVE-2022-24735) |

## November 01, 2024

**Apigee hybrid** v1.12.3 Announcement

### hybrid v1.12.3

On November 1, 2024 we released an updated version of the Apigee hybrid software, 1.12.3.

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.12.3](https://docs.cloud.google.com/apigee/docs/hybrid/v1.12/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.12/big-picture.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **368646378** | **Fixed an issue affecting control Plane connectivity testing in Guardrails.** |
| **361044374** | **Fixes assign message not correctly highlighting the set payload action in the debug trace.** |
| **335357961** | **Fixed an issue where Apigee hybrid could claim uploads of backups with the Cloud provider when no bucket had been configured** |
| **181569113** | **Fixed an issue in new debug session creation.** |

Security

| Bug ID | Description |
|---|---|
| **376104926** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2024-41110](https://nvd.nist.gov/vuln/detail/CVE-2024-41110) - [CVE-2024-28180](https://nvd.nist.gov/vuln/detail/CVE-2024-28180) - [CVE-2024-24790](https://nvd.nist.gov/vuln/detail/CVE-2024-24790) - [CVE-2024-24789](https://nvd.nist.gov/vuln/detail/CVE-2024-24789) - [CVE-2023-4039](https://nvd.nist.gov/vuln/detail/CVE-2023-4039) - [CVE-2022-27943](https://nvd.nist.gov/vuln/detail/CVE-2022-27943) - [CVE-2019-1010025](https://nvd.nist.gov/vuln/detail/CVE-2019-1010025) - [CVE-2019-1010024](https://nvd.nist.gov/vuln/detail/CVE-2019-1010024) - [CVE-2019-1010023](https://nvd.nist.gov/vuln/detail/CVE-2019-1010023) - [CVE-2019-1010022](https://nvd.nist.gov/vuln/detail/CVE-2019-1010022) - [CVE-2019-9192](https://nvd.nist.gov/vuln/detail/CVE-2019-9192) - [CVE-2018-20796](https://nvd.nist.gov/vuln/detail/CVE-2018-20796) - [CVE-2012-2663](https://nvd.nist.gov/vuln/detail/CVE-2012-2663) - [CVE-2010-4756](https://nvd.nist.gov/vuln/detail/CVE-2010-4756) |
| **N/A** | **Security fixes for `apigee-open-telemetry-collector`.** This addresses the following vulnerability: - [CVE-2024-36129](https://nvd.nist.gov/vuln/detail/CVE-2024-36129) |

## October 23, 2024

**Apigee X** Announcement On October 23, 2024, we released an updated version of Apigee (1-14-0-apigee-1).

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Fixed

| Bug ID | Description |
|---|---|
| **N/A** | Updates to security infrastructure and libraries. |

## October 22, 2024

**Apigee X** Change With this release, the following limits for Apigee organizations have changed:

- The maximum number of deployed API proxies and shared flows per (non-hybrid) organizations is 6000.
- The maximum number of proxy deployment units per Apigee instance is 6000.
- The maximum number of API base paths per Apigee organization is 6000.

For more information, see the Apigee [Limits](https://docs.cloud.google.com/apigee/docs/api-platform/reference/limits.md.txt) page.
Announcement On October 22, 2024, we released a new version of Apigee.

## October 18, 2024

**Apigee API hub** Feature In addition to `us-central1` and `europe-west1`, Apigee API hub now supports the following new hosting regions:

| Region Description | Region name |
|---|---|
| Northern Virginia | `us-east4` |
| Oregon | `us-west1` |
| London | `europe-west2` |
| Singapore | `asia-southeast1` |
| Mumbai | `asia-south` |
| Sao Paulo | `southamerica-east1` |
| Sydney | `australia-southeast1` |

See [Provision API hub](https://docs.cloud.google.com/apigee/docs/apihub/provision.md.txt).
Announcement On October 18, 2024, Apigee announced the an update to Apigee API hub.

## October 11, 2024

**Apigee UI** Announcement On October 11, 2024, we released an updated version of the Apigee UI.
Change

| Bug ID | Description |
|---|---|
| **357165778** | **VerifyIAM policy selection removed for hybrid organizations.** The VerifyIAM policy is not supported for hybrid-enabled Apigee organizations. It has been removed as an option in the Proxy Editor. |
| **372224845** | **Offline debug page not loading** Fixed issue where the offline debug page would not load if a debug session was loaded elsewhere in the UI previously. |

## October 10, 2024

**Apigee X** Announcement On October 10, 2024, we released an updated version of Apigee.
Feature Apigee no longer limits the number of Cloud projects that can connect to an Apigee instance. Previously, the limit was 50 projects. For each project, you can now create up to 100 Private Service Connect Network Endpoint Groups. The previous limit was 20. For any Apigee instances created before October 10, 2024, you must perform an update to the consumer accept list for an Apigee instance if you want to take advantage of these new limits. See [Updating the consumer accept list for an Apigee instance](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/northbound-networking-psc.md.txt#updating-the-consumer-accept-list-for-an-apigee-instance). See also [Limits](https://docs.cloud.google.com/apigee/docs/api-platform/reference/limits.md.txt#private-service-connect-psc).

## October 08, 2024

**Apigee Advanced API Security** Announcement On October 8, 2024 we released an updated version of Advanced API Security.

**Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the feature available until the rollout is complete.
Feature **New features added to the Risk Assessment v2 preview**

This release introduces new features to the Risk Assessment v2 [preview](https://cloud.google.com/products/#product-launch-stages):

- **Support for custom security profiles.** You can create your own security profiles, with unique combinations of risk assessment checks and weights, to use for proxy risk assessment.
- **New assessment checks.** We've added additional checks you can use when assessing proxy risk.
- **Assess proxies across multiple profiles.** You can now switch between security profiles to see differences in scoring across profiles.

For usage information and a list of all features in Risk Assessment v2, see the [Risk Assessment v2 customer documentation](https://docs.cloud.google.com/apigee/docs/api-security/security-scores.md.txt#risk-assessment-v2).
**Apigee X** Announcement On October 8, 2024, we released an updated version of Apigee (1-13-0-apigee-6).

This release addresses the security concerns in [GCP-2024-052 from Google Anthos Service Mesh](https://docs.cloud.google.com/service-mesh/docs/security-bulletins.md.txt#gcp-2024-052).

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Fixed

| Bug ID | Description |
|---|---|
| **361714906** | **Fixed synchronization issue with Cloud KMS keys** Implemented recovery mechanism for the Apigee dataplane in the event of an extended disruption in the CloudKMS key service. |
| **361044374** | **Resolved issue with incorrect payloads shown in debug trace** When using debug trace with the AssignMessage policy, the UI now displays the correct request and response payloads. |
| **N/A** | **Updates to security infrastructure and libraries.** |

## October 04, 2024

**Apigee Advanced API Security** Announcement **On October 4, 2024 we released an updated version of Advanced API Security.**
Change **Fixed:** Delay in score generation for Risk Assessment v2 with VPC-SC-enabled organizations only

In Risk Assessment v2, which is in [preview](https://cloud.google.com/products/#product-launch-stages), this issue has been resolved:

With VPC-SC-enabled organizations only, when generating scores for new organizations or scoring changes to included proxies, shared flows, and target server configurations, score generation could have take as much as three hours.

See the [Risk Assessment v2 customer documentation](https://docs.cloud.google.com/apigee/docs/api-security/security-scores.md.txt#risk-assessment-v2) for information on the functionality.
Change Risk Assessment v2 is now available in the `me-central2` region. See [Available Apigee API Analytics Regions](https://docs.cloud.google.com/apigee/docs/locations.md.txt#available-apigee-api-analytics-regions) for region information.
**Apigee hybrid** v1.13.1 Announcement

### hybrid v1.13.1

On October 4, 2024 we released an updated version of the Apigee hybrid software, 1.13.1.

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.13.1](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/big-picture.md.txt).
Feature **Cassandra credential rotation in Vault**

Starting in version v1.3.1, You can set up automatic Cassandra credential rotation when your credentials are stored in Hashicorp Vault. See [Rotating Cassandra credentials in Hashicorp Vault](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/rotating-cassandra-credentials-in-vault.md.txt).
Feature **New analytics and debug data pipeline for data residency-enabled orgs**

Starting in v1.13.1 hybrid organizations created with data residency enabled must use the new data pipeline to collect analytics and debug data and allow various runtime components to write data directly to our control plane. Changes to overrides file and control plane access are required to enable the new data pipeline.

For details, see:

- [Enabling the new data pipeline](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/using-data-residency-with-apigee-hybrid.md.txt#newpipeline).
- [Configure hybrid to use the new data pipeline](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/data-collection-with-data-residency.md.txt)

> [!NOTE]
> **Note:** The new data pipeline is only supported for data residency enabled organizations in versions 1.13.x. It is supported for non-data residency enabled organizations starting in [Apigee hybrid version 1.14.0](https://docs.cloud.google.com/apigee/docs/release-notes.md.txt#hybrid_v1140).

Fixed

| Bug ID | Description |
|---|---|
| **364282883** | **Remove check for dc-expansion flag and add timeout to multi-region seed host connection test.** |
| **362305438** | **You can now add additional env variables to the runtime component.** |
| **353527851** | **WebSocket connection drops when using `VerifyJwt` or `OAuthV2 VerifyJWTAccessToken` operations.** |
| **351440306** | **An issue was fixed where trace could not be viewed in the UI for orgs with DRZ enabled.** |
| **338638343** | **An ID is now added at the end of `apigee-env` and `virtualhost` guardrails pods to make the pod names unique.** |

Security

| Bug ID | Description |
|---|---|
| **N/A** | **Security fixes for `apigee-open-telemetry-collector`.** This addresses the following vulnerability: - [CVE-2024-36129](https://nvd.nist.gov/vuln/detail/CVE-2024-36129) |

## October 03, 2024

**Apigee UI** Announcement On October 3, 2024, we released an updated version of the Apigee UI.
Fixed

| Bug ID | Description |
|---|---|
| **369647749** | **Proxy deployment units counts include shared flows** Fixed issue where proxy deployment unit counts in the UI did not take into account shared flow deployments. |
| **369385955** | **Fixed the display of the Apigee apps list** Resolved an issue causing Apigee apps to display incorrectly in the Apps list when the search bar is used for filtering. |
| **361497390** | **Updated the description and calculation of Apigee deployment quotas** The deployment quota displayed on the Apigee overview page now correctly describes and calculates the value of all proxy deployment units, including both API proxy and shared flow deployments across all environments./p\> |

## October 02, 2024

**Apigee X** Feature With this release, all remaining Apigee API Management organizations with Subscription 2021 contracts have been upgraded to introduce standard and extensible API proxy features.

To learn more about:

- Standard and Extensible API Proxy types, see [API Proxy types](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/understanding-apis-and-api-proxies.md.txt#proxy-types).
- Viewing proxy deployment count, see [View proxy deployment usage](https://docs.cloud.google.com/apigee/docs/api-platform/deploy/ui-deploy-overview.md.txt#view-proxy-deployment-usage).
Change Subscription Apigee organizations (without hybrid entitlements) upgraded in this release will see changes to the user experience in the [Classic Apigee UI](https://apigee.google.com/edge). To support management of the upgraded functionality now available to these organizations, a number of feature administration pages are now only available in the [Apigee UI in Cloud console](https://docs.cloud.google.com/console/apigee).

For more information, see [Apigee UI in Cloud console navigation](https://cloud.google.com/apigee/docs/api-platform/fundamentals/ui-overview#console-compare).
Announcement On October 2, 2024, we released an updated version of Apigee.

## September 26, 2024

**Apigee API hub** Announcement On September 26, 2024, Apigee announced the GA launch of Apigee API hub.
Feature A new "Get started with API hub" page was added to the user interface. This new page includes valuable getting started information, including a new FAQ, to help you get the most out of API hub.
Feature We added a new Supply chain page where you can create, view and manage your dependencies across API operations. The same dependencies can also be created from the API operations page. See [Manage dependencies](https://docs.cloud.google.com/apigee/docs/apihub/manage-dependencies.md.txt).
Feature We added support for GMEK and CMEK in the provisioning steps. While provisioning, you can also choose to host your Vertex search data in a different location or disable Vertex search altogether. See [Provision API hub](https://docs.cloud.google.com/apigee/docs/apihub/provision.md.txt).
Feature The Semantic Search (formerly Smart Search) user interface has been improved, and search results are shown across all API hub entities, such as APIs, deployments, specifications, and versions. See [Search and filter APIs](https://docs.cloud.google.com/apigee/docs/apihub/search-apis.md.txt).
Feature The List APIs for specifications, dependencies, and external APIs have been enhanced to return a complete response, including user-defined attributes.
Feature We added support for [Cloud audit logging](https://docs.cloud.google.com/apigee/docs/apihub/audit-logging-apihub.md.txt).
Feature While you can use API hub by making direct REST over HTTP requests, we now provide client libraries for several popular languages. See [API hub client libraries](https://docs.cloud.google.com/apigee/docs/apihub/libraries.md.txt).
Feature Significant user interface improvements were made, such as standardization of cards on the API details page, unlinking of deployments, various performance fixes, and more.
**Apigee X** Announcement On September 26, 2024 we released an updated version of Apigee.

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Feature If you have CMEK org policy constraints on your Google Cloud project, Apigee will enforce compliance with those constraints and guide you in choosing valid configuration, and prevent you from using Apigee features that are not CMEK-compliant.

The following documents are new and explain how to use CMEK with Apigee:

- [Using organization policy constraints in Apigee](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/using-org-policies.md.txt)
- [Best practices for Apigee CMEK](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/cmek-best-practices.md.txt)

The following documents have been updated with the relevant CMEK information:

- [Introduction to CMEK](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/cmek-concepts.md.txt)
- [Compare evaluation and paid organizations in Apigee](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/compare-paid-eval.md.txt)
- [Provisioning an eval org](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/eval-orgs.md.txt)
- [Provision a paid org without VPC peering](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/install-cli-non-peered-paygo.md.txt)
- [About the Apigee encryption keys](https://docs.cloud.google.com/apigee/docs/api-platform/security/encryption-keys.md.txt)
- [Compatible services](https://docs.cloud.google.com/kms/docs/compatible-services.md.txt)
- [Use Cloud KMS keys in Google Cloud](https://docs.cloud.google.com/kms/docs/use-keys-google-cloud.md.txt#supported-services)
Issue A [known issue](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt#354716994) was added: Apigee does not support [Cloud External Key Manager](https://docs.cloud.google.com/kms/docs/ekm.md.txt).
Issue A [known issue](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt#cmek) was added: Apigee does not support key re-encryption, which means even after rotation, the old key version will still be used and you cannot change the CMEK key after org creation.

## September 20, 2024

**Apigee X** Announcement On September 20, 2024, we released an updated version of Apigee (1-13-0-apigee-5).

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Change

| Bug ID | Description |
|---|---|
| **366039324** | **Fixed PEM parsing error in JWT/JWS policies** Resolved a PEM parsing error in JWT/JWS policy execution caused by a problematic PEM format. |
| **353527851** | **Resolved dropped WebSocket connection** Fixed issue causing a dropped WebSocket connection when using the OAuthV2 policy and the `VerifyJWTAccessToken` operation or VerifyJWT. |
| **361166073** | **Fixed issue with JWKS rejection in GenerateJWT policy** Fixed an issue where valid JWKS used to sign encrypted JWTs with the GenerateJWT Policy are incorrectly rejected with `steps.jwt.NoMatchingPublicKey`. |
| **352593965** | **Resolved SSL enforcement bug in proxies using the `<SSLInfo>` block** This release fixes an SSL enforcement bug in proxies where an `<SSLInfo>` block specifies both `<IgnoreValidationErrors>` and `<Enforce>` as `true`. The bug results in no enforcement for one specific type of SSL violation - a mismatch between the certificate subject name and the real host name of the target (No Subject Alternative Name, or NSAN). With this fix, `<Enforce>` uniformly overrides `<IgnoreValidationErrors>` in all cases, including NSAN. |
| **N/A** | Updates to security infrastructure and libraries. |

## September 18, 2024

**Apigee UI** Announcement On September 18, 2024, we released an updated version of the Apigee UI.
Fixed

| Bug ID | Description |
|---|---|
| **349284447** | **All API products associated with a key now displayed in the UI** All API products associated with a key can now be viewed in the **App detail** page of the UI using pagination. Previously, a maximum of 50 API products could be displayed. |

**Apigee X** Announcement On September 18, 2024 we released an updated version of Apigee

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the feature available until the rollout is complete.

Feature **Release of Cloud IAM-based authorization and authentication and the VerifyIAM policy.**

This release introduces Cloud IAM-based authorization and authentication for Apigee API access. With this IAM-based solution, access to invoke an API requires the API consumer to have a specific Google Cloud IAM role or permissions.

For information, see [IAM-based API authentication overview](https://docs.cloud.google.com/apigee/docs/api-platform/security/iam/iam-overview.md.txt) and [VerifyIAM policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/verify-iam-policy.md.txt).

## September 13, 2024

**Apigee hybrid** v1.12.2 Announcement

### hybrid v1.12.2

On September 13, 2024 we released an updated version of the Apigee hybrid software, 1.12.2.

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.12.2](https://docs.cloud.google.com/apigee/docs/hybrid/v1.12/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.12/big-picture.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **362305438** | **You can now add additional env variables to the runtime component.** |
| **347798999** | **You can now configure forward proxy for opentelemetry pods in Apigee hybrid.** |

Security

| Bug ID | Description |
|---|---|
| **N/A** | **Security fixes for `apigee-cassandra-backup-utility` and `apigee-hybrid-cassandra`.** This addresses the following vulnerability: - [CVE-2023-37920](https://nvd.nist.gov/vuln/detail/CVE-2023-37920) |

## September 12, 2024

**Apigee X** Announcement On September 12, 2024, we released an updated version of Apigee.
Feature With this release, Apigee supports [Workforce Identity Federation](https://docs.cloud.google.com/iam/docs/workforce-identity-federation.md.txt).

Workforce Identity Federation lets you use an external identity provider (IdP) to authenticate and authorize a workforce --- a group of users, such as employees, partners, and contractors --- using [Identity and Access Management (IAM)](https://docs.cloud.google.com/iam/docs.md.txt) to access Apigee services.

See [Access Apigee using Workforce Identity Federation](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/workforce-identity-federation-apigee.md.txt) for more information.
Fixed

| Bug ID | Description |
|---|---|
| 338285095 | Fixed a problem where apps associated with an AppGroup did not appear in the Apps list in the Apigee UI in Cloud Console. As a result, users could not access the app's App Detail page in the console. Using search in the console with a partial app name or API key search for the app was not available. With this fix, users can now view apps associated with an AppGroup in the Apps list, and view details for each app or delete the app. Users will still not be able to create or edit AppGroup apps. Apigee hybrid organizations were not impacted by this problem, as they use the Classic UI to view the app details. |

Issue **PEM parsing error in JWT/JWS policies due to non-standard format**

For Apigee and Apigee hybrid versions 1.13 and higher, any deviations in the required PEM format of keys used in [Apigee JWS or JWT policies](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/jwt-policies-overview.md.txt) may result in a parsing error.

For more information, see [Apigee known issues](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt).

<br />

## September 11, 2024

**Apigee Advanced API Security** Issue **Delay in score generation for Risk Assessment v2 with VPC-SC-enabled organizations only**

This issue impacts Risk Assessment v2 only, which is in [preview](https://cloud.google.com/products/#product-launch-stages).

*With VPC-SC-enabled organizations only,* when generating scores for new organizations or scoring changes to included proxies, shared flows, and target server configurations, score generation could take as much as three hours.

See the [Risk Assessment v2 customer documentation](https://docs.cloud.google.com/apigee/docs/api-security/security-scores.md.txt#risk-assessment-v2) for information on the functionality.

## September 10, 2024

**Apigee Advanced API Security** Announcement On September 10, 2024 we released an updated version of Advanced API Security.

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the feature available until the rollout is complete.

Feature **Proxy-specific security actions**

You can now create security actions that apply only to one or more specified proxies.

This new functionality is not available with Apigee hybrid at this time.

See [Security actions](https://docs.cloud.google.com/apigee/docs/api-security/security-actions.md.txt) to learn more about proxy-specific security actions.

## September 05, 2024

**Apigee UI** Announcement On September 5, 2024, we released an updated version of the Apigee UI.
Feature An informational message was added to the **action** creation flow for [Apigee Security actions](https://docs.cloud.google.com/apigee/docs/api-security/security-actions.md.txt#create-a-security-action), informing users that actions can't be edited or deleted.
Fixed

| Bug ID | Description |
|---|---|
| **349284447** | **Correct sorting for revisions in Duplicate Proxy** The Duplicate Proxy experience now correctly sorts the list of existing revisions. |
| **359475166** | **Fixed issue with Analytics Error Analysis** Resolved issue with the Error Composition page that interchanged the proxy error and target error legend. |

**Apigee hybrid** 1.13.0-hotfix.1 Announcement

### hybrid 1.13.0-hotfix.1

On September 5, 2024 we released an updated version of the Apigee hybrid software, 1.13.0-hotfix.1.

Apply this hotfix following the steps in [Upgrading Apigee hybrid to version 1.13](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/upgrade.md.txt):

1. [Prepare for the Helm charts upgrade](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/upgrade.md.txt#prepare-for-the-helm-charts-upgrade)
2. [Install the Apigee hybrid Helm charts](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/upgrade.md.txt#install-the-apigee-hybrid-helm-charts)

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.13](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/big-picture.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **362690729** | **Fix for aggressive scaling of runtime pods \& cpu spike.** |
| **362979563** | **Fix for Ingress Health Check failure `/healthz/ingress - route_not_found`.** |

## August 30, 2024

**Apigee X** Change On August 30, 2024, we released an updated version of Apigee (1-13-0-apigee-4).

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Change

| Bug ID | Description |
|---|---|
| **N/A** | Updates to security infrastructure and libraries. |

## August 27, 2024

**Apigee X** Announcement **Clarification:** On July 26 we announced monetization support with data residency. Please note that monetization support with data residency is for non-hybrid organizations only at this time.

For more information, see [Introduction to data residency](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/drz-concepts.md.txt).

## August 26, 2024

**Apigee X** Announcement On, August 26, 2024, Apigee announced the GA launch of its non-VPC provisioning option.
Feature With the non-VPC peering provisioning approach, you are not required to provide networks and IP ranges during the Apigee provisioning process. Instead, you use Private Service Connect (PSC) for routing northbound traffic to Apigee and southbound traffic to target services running in your Google Cloud projects.
Non-VPC peering is supported for command-line (CLI) steps only. You can perform non-VPC provisioning for [subscription](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/install-cli-non-peered.md.txt), [Pay-as-you-go](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/install-cli-non-peered-paygo.md.txt), and [evaluation](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/install-cli-non-peered-eval.md.txt) installations of Apigee.

> [!NOTE]
> **Note:** The use of VPC Service Controls and Private DNS Peering is not supported. For a complete list of features and networking approaches that are and are not supported for non-VPC peering, see [How to choose a networking option](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/networking-options.md.txt#how-to-choose-a-networking-option).

To learn more, see [Apigee networking options](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/networking-options.md.txt).

## August 23, 2024

**Apigee API hub** Announcement On August 23, 2024, we updated the Preview release of Apigee API hub.
Feature All API proxy endpoints auto-registered from Apigee will be prefixed with `https://` by default. Endpoints for existing API proxies that were added to API hub will be updated.
Feature You can now choose in the Cloud console to restrict the upload of an API specification file that contains errors. By default, specs containing errors are uploaded. See [Add a spec to an existing version](https://docs.cloud.google.com/apigee/docs/apihub/manage-specifications.md.txt#addtoexistingversion).
Feature User interface and performance improvements were made.
Feature A validation check has been added to reject an API specification style guide upload if the style guide's `extends` property contains a URL. See [Upload a new style guide](https://docs.cloud.google.com/apigee/docs/apihub/validate-spec.md.txt#upload-a-new-style-guide).
Feature When an Apigee API proxy is auto-registered, its deployment type is now labeled either Apigee X or Apigee hybrid. Existing Apigee proxy deployments registered with API hub will also be labeled with the appropriate type. See [Auto-register Apigee proxies](https://docs.cloud.google.com/apigee/docs/apihub/auto-register-apigee-proxies).
Feature You can now edit an uploaded API specification's metadata through the Cloud console. See [Edit specification metadata](https://docs.cloud.google.com/apigee/docs/apihub/manage-specifications.md.txt#editspecification).
Fixed Provisioning improvements were made to address potential failures.
**Apigee hybrid** v1.13.0 Announcement

### hybrid v1.13.0

On August 23, 2024 we released an updated version of the Apigee hybrid software, v1.13.0.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.13.0](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/big-picture.md.txt).
Feature **Improved backup and restore**

Starting in version v1.13.0, Apigee hybrid introduces a new backup and restore system. The new system removes the need for pod exec permission and use of a Kubernetes ClusterRole, and requires fewer Kubernetes Service Accounts when using Workload Identity. The new system replaces use of the apigee-cassandra-backup-utility image by using the apigee-hybrid-cassandra-client image. The apigee-cassandra-backup-utility image will no longer be provided starting with this release.

To use the new functionality if you are overriding the image used, update your `overrides.yaml` file.

Replace:

- `repo.sample.com/gcr-docker/apigee-release/hybrid/apigee-cassandra-backup-utility`

with

- `repo.sample.com/gcr-docker/apigee-release/hybrid/apigee-hybrid-cassandra-client`

under `cassandra.backup.image.url` and `cassandra.restore.image.url`.

See [Scheduling backups in a remote server](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/cassandra-backup-overview.md.txt) for more information.
Feature **Leader election enabled for `apigee-watcher` component**

Starting in version v1.13.0, leader election is enabled for the `apigee-watcher` component. For proper functioning of the leader election, make sure that the `apigee-watcher` component uses only one replica set.
Feature **Apigee Operator now runs in the Apigee Kubernetes namespace**

Starting in version v1.13, `apigee-operator` runs in the same name space as the other Apigee hybrid components instead of the `apigee-system` namespace. You can use `apigee` or your own custom Apigee namespace. See [Upgrading Apigee hybrid to version v1.13.0](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/upgrade.md.txt) and [Step 3: Create the apigee namespace](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/install-create-namespace.md.txt).
Feature **Storing additional secrets in an external secret store**

Starting in version v1.13, You can now store AX Hash Salt, Redis password, and Encryption keys in an external secret store like Hashicorp Vault. See [Storing Secrets in Vault](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/storing-secrets-in-vault.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **352070616** | **Update Go language version.** |
| **351868444** | **Tolerations are now working for Redis's Envoy pod.** (Fixed in 1.12.1-hotfix.1) |
| **347997965** | **Upgrading to Apigee Hybrid 1.11.2 and 1.10.5 can cause missing metrics.** (Fixed in 1.11.2-hotfix.1) |
| **347798999** | **Fixed issue preventing configuration of forward proxy for `opentelemetry` pods.** (Fixed in Apigee hybrid v 1.12.1) |
| **346589998** | **Check Cassandra DNS hostname resolution during Hybrid region expansion.** |
| **345501069** | **Fixed issue with Hybrid Guardrails resource configuration preventing the Guardails pod from starting.** (Fixed in Apigee hybrid v 1.12.1) |
| **341797795** | **Autofill the Hybrid Guardrails checkpoint value if a checkpoint is not provided.** (Fixed in Apigee hybrid v 1.12.1) |
| **340889560** | **Added `csi` to the `apigee-logger` SCC.** (Fixed in Apigee hybrid v 1.12.0-hotfix.1) |
| **340248314** | **Added support for `targetCPUUtilizationPercentage` to [`apigeeIngressGateway`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/config-prop-ref.md.txt#apigeeingressgateway-targetcpuutilizationpercentage) and [`ingressGateways`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/config-prop-ref.md.txt#ingressgateways-targetcpuutilizationpercentage).** The default value is 75. (Fixed in Apigee hybrid v 1.12.1) |
| **339849002** | **Hashicorp Vault integration issues fixed for Google Service Account for Cassandra Backup/Restore.** (Fixed in Apigee hybrid v 1.12.0-hotfix.1) |
| **324779388** | **Improved error handling for backup and restore.** (Fixed in Apigee hybrid v 1.12.1) |
| **311489774** | **Removed inclusion of Java in Cassandra client image..** (Fixed in Apigee hybrid v 1.12.1) |
| **310338146** | **Fixed invalid download directory output from the [`create-service-account`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.12/create-service-account.md.txt) tool.** (Fixed in Apigee hybrid v 1.12.1) |
| **300135626** | **Removed inclusion of Java in Cassandra Backup Utility image.** (Fixed in Apigee hybrid v 1.12.1) |
| **297539870** | **`HTTPTargetConnection` property `io.timeout.millis` is now honored correctly when using websockets.** (Fixed in 1.11.2-hotfix.2) |
| **239523766** | **Remove "Unable to evaluate jsonVariable, returning null" logging string from *ExtractVariables* Policy** (Fixed in Apigee hybrid v 1.12.1) |
| **181569113** | **Fixed an issue in new debug session creation.** (Fixed in Apigee hybrid v 1.11.2) |

Security

| Bug ID | Description |
|---|---|
| **N/A** | **Security fixes for `apigee-asm-istiod`.** This addresses the following vulnerability: - [CVE-2024-26147](https://nvd.nist.gov/vuln/detail/CVE-2024-26147) |
| **N/A** | **Security fixes for `apigee-cassandra-backup-utility`.** This addresses the following vulnerability: - [CVE-2023-37920](https://nvd.nist.gov/vuln/detail/CVE-2023-37920) |
| **N/A** | **Security fixes for `apigee-connect-agent`.** This addresses the following vulnerabilities: - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) |
| **N/A** | **Security fixes for `apigee-envoy`.** This addresses the following vulnerability: - [CVE-2023-4911](https://nvd.nist.gov/vuln/detail/CVE-2023-4911) |
| **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerability: - [CVE-2023-50387](https://nvd.nist.gov/vuln/detail/CVE-2023-50387) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2023-37920](https://nvd.nist.gov/vuln/detail/CVE-2023-37920) - [CVE-2023-21930](https://nvd.nist.gov/vuln/detail/CVE-2023-21930) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** This addresses the following vulnerability: - [CVE-2024-24790](https://nvd.nist.gov/vuln/detail/CVE-2024-24790) |
| **N/A** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerabilities: - [CVE-2024-22201](https://nvd.nist.gov/vuln/detail/CVE-2024-22201) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-36478](https://nvd.nist.gov/vuln/detail/CVE-2023-36478) |
| **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** This addresses the following vulnerabilities: - [CVE-2024-22201](https://nvd.nist.gov/vuln/detail/CVE-2024-22201) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-36478](https://nvd.nist.gov/vuln/detail/CVE-2023-36478) |
| **N/A** | **Security fixes for `apigee-operators`.** This addresses the following vulnerabilities: - [CVE-2022-30123](https://nvd.nist.gov/vuln/detail/CVE-2022-30123) - [CVE-2020-8165](https://nvd.nist.gov/vuln/detail/CVE-2020-8165) - [CVE-2020-14001](https://nvd.nist.gov/vuln/detail/CVE-2020-14001) - [CVE-2019-5477](https://nvd.nist.gov/vuln/detail/CVE-2019-5477) - [CVE-2019-11068](https://nvd.nist.gov/vuln/detail/CVE-2019-11068) |
| **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerability: - [CVE-2024-24790](https://nvd.nist.gov/vuln/detail/CVE-2024-24790) |
| **N/A** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerability: - [CVE-2024-24790](https://nvd.nist.gov/vuln/detail/CVE-2024-24790) |
| **N/A** | **Security fixes for `apigee-redis`.** This addresses the following vulnerabilities: - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) |
| **N/A** | **Security fixes for `apigee-udca`.** This addresses the following vulnerability: - [CVE-2024-24790](https://nvd.nist.gov/vuln/detail/CVE-2024-24790) |
| **N/A** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerability: - [CVE-2024-24790](https://nvd.nist.gov/vuln/detail/CVE-2024-24790) |
| **N/A** | **Security fixes for `cassandra-backup-utility`.** This addresses the following vulnerability: - [CVE-2024-24790](https://nvd.nist.gov/vuln/detail/CVE-2024-24790) |

## August 22, 2024

**Apigee Integrated Portal** Announcement On August 22, 2024 we released a new version of the Apigee integrated portal.
Fixed

| Bug ID | Description |
|---|---|
| 350546059 | Fixed an issue when displaying OpenAPI Specs in the portal that caused the **Example** button to show even when no example was present. |

## August 19, 2024

**Apigee X** Issue **Timeouts when deploying API proxies and shared flows**

The following endpoints may experience timeouts when used with a high volume of queries per second (QPS):

- [organizations.environments.apis.revisions.
  deployments.deploy](https://cloud.google.com/apigee/docs/reference/apis/apigee/rest/v1/organizations.environments.apis.revisions.deployments/deploy)
- [organizations.environments.apis.revisions.
  deployments.undeploy](https://cloud.google.com/apigee/docs/reference/apis/apigee/rest/v1/organizations.environments.apis.revisions.deployments/undeploy)
- [organizations.environments.sharedflows.revisions.
  deployments.deploy](https://cloud.google.com/apigee/docs/reference/apis/apigee/rest/v1/organizations.environments.sharedflows.revisions.deployments/deploy)
- [organizations.environments.sharedflows.revisions.
  deployments.undeploy](https://cloud.google.com/apigee/docs/reference/apis/apigee/rest/v1/organizations.environments.sharedflows.revisions.deployments/undeploy)

To reduce the likelihood of timeouts, we recommend a target of three QPS when using these endpoints.

<br />

To track the status of this issue, see [Apigee Known Issues](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt).

## August 16, 2024

**Apigee X** Announcement On August 16, 2024, we released an updated version of Apigee (1-13-0-apigee-3).

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Fixed

| Bug ID | Description |
|---|---|
| **324418891** | Added improvements to the MessageLogging policy to avoid potential downtime and deployment failures. |
| **351068926** | Updated the error format, fault status, and status code returned (from `500` to `404`) in cases where an invalid authorization code causes an error. |

## August 15, 2024

**Apigee UI** Fixed

| Bug ID | Description |
|---|---|
| **356453519** | **Fixed issue with the display of shared flow detail pages.** In some cases, detail pages for shared flows with names containing a space (" ") would not display and resulted in UI errors. |
| **355674677** | **Fixed infinite redirect loop after Subscription org provisioning.** Clicking the **Continue** button in the final step of the Subscription organization provisioning flow resulted in an infinite redirect loop. |

Announcement On August 15, 2024, we released an updated version of the Apigee UI.
**Apigee X** Announcement On August 15, 2024 documentation was added describing how to provision Apigee in the Google Cloud console.

See [Get started in the Google Cloud console](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/wizard-select-project.md.txt) for more information.
Feature Apigee provisioning for Subscription orgs is now performed in the [Google Cloud console](https://console.cloud.google.com/apigee/welcome).

## August 13, 2024

**Apigee Advanced API Security** Announcement On August 13, 2024 we released an updated version of Advanced API Security.

**Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the feature available until the rollout is complete.

**Note:** This functionality is not available in the `me-central2` region at this time. See [Available Apigee API Analytics Regions](https://docs.cloud.google.com/apigee/docs/locations.md.txt#available-apigee-api-analytics-regions) for region information. We will announce with a release note when that region is supported.
Feature **Public preview of Risk Assessment v2**

This release introduces Risk Assessment v2 in [preview](https://cloud.google.com/products/#product-launch-stages). Risk Assessment v2 includes these improvements:

- Improved reliability: Faster score calculations with recent proxy data.
- Simplified score display: The new score is a percentage, where 100% means full alignment with the security profile.

For usage information and a list of all improvements and changes in v2, see [Risk Assessment v2](https://docs.cloud.google.com/apigee/docs/api-security/security-scores.md.txt#risk-assessment-v2).

## August 12, 2024

**Apigee X** Feature We changed the maximum number of **Apps per developer** from 10 to 100. See the [Limits](https://docs.cloud.google.com/apigee/docs/api-platform/reference/limits.md.txt#keys,-developers,-apps) page for more detail.

Note that using more than 10 apps per developer will result in latency when accessing flow variables referencing `developer.apps`.
Announcement On August 12, 2024, we released a new version of Apigee.
Feature With this release, Apigee expanded its support for data residency to additional regions in Japan:

- `asia-northeast1` (Tokyo)
- `asia-northeast2` (Osaka)

Data residency for Apigee meets compliance and regulatory requirements by allowing you to specify the geographic locations (regions) where Apigee data is stored.

For more information, see [Introduction to data residency](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/drz-concepts.md.txt).

## August 08, 2024

**Apigee X** Announcement On August 8, 2024, we announced an increase in the recommended number of API basepaths per Apigee environment or environment group.

The recommended limit of API proxy basepaths per Apigee environment or environment group increased from 1,000 to 3,000.
For more information, see the [Environment and organization section of the Limits page](https://docs.cloud.google.com/apigee/docs/api-platform/reference/limits.md.txt#environment-and-organization).
Fixed

| Bug ID | Description |
|---|---|
| **329304975** , **301845257** | **Limit on number of basepaths per environment** Fixed issue with the number of total basepaths per environment causing potential failures when deploying API proxy revisions. |

## August 07, 2024

**Apigee X** Announcement On August 7, 2024, we published new documentation explaining how to integrate Apigee with a Security Information and Event Management (SIEM) solution. See [Integrate Apigee with your SIEM solution](https://docs.cloud.google.com/apigee/docs/api-platform/security/siem-integration.md.txt) for more information.

## August 05, 2024

**Apigee Advanced API Security** Announcement On August 5, 2024 we released an updated version of Advanced API Security.
Feature Shadow API Discovery, which is in [preview](https://cloud.google.com/products/#product-launch-stages), now supports the use of tags to label and organize observation results.

For usage information, see [Use tags](https://docs.cloud.google.com/apigee/docs/api-observation/shadow-api-discovery.md.txt#use-tags).

## August 02, 2024

**Apigee Advanced API Security** Announcement The preview release of generative AI summaries and recommendations for Advanced API Security Abuse Detection incidents is now re-enabled after resolution of the known issue noted on [July 19](https://docs.cloud.google.com/apigee/docs/api-security/release-notes.md.txt#July_19_2024).

For usage instructions, see the [Incident details](https://docs.cloud.google.com/apigee/docs/api-security/abuse-detection.md.txt#incident-details) documentation.
**Apigee Integration** Announcement **Redirecting from Apigee Integration to Application Integration**

We are converging Apigee Integration and Application Integration. This change involves the following updates:

- You will now be redirected to [Application Integration](https://console.cloud.google.com/integrations) from the Apigee portal.
- Apigee Integration will not support [configuring connector tasks](https://docs.cloud.google.com/application-integration/docs/configure-connectors-task.md.txt) in the Apigee portal. You will have to open [Application Integration](https://console.cloud.google.com/integrations) in the Google cloud console to configure connector tasks in your integration.

For more information, see [Use Application Integration](https://docs.cloud.google.com/apigee/docs/api-platform/integration/using-application-integration.md.txt).

## August 01, 2024

**Apigee X** Announcement On August 1, 2024, we released an updated version of Apigee (1-13-0-apigee-1).

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Feature New [flow variables](https://docs.cloud.google.com/apigee/docs/api-platform/reference/variables-reference.md.txt) are now available:

- `request.headers.names.string `
- `request.queryparams.names.string `
- `request.formparams.names.string `
- `message.headers.names.string `
- `message.queryparams.names.string `
- `message.formparams.names.string `
- `response.headers.names.string `

These context variables can be used to return header, query parameter, and form parameter names in `string` format that can be used in API proxy logic. Each variable returns a comma-separated list of names.

For more information, see the [Flow variables reference](https://docs.cloud.google.com/apigee/docs/api-platform/reference/variables-reference.md.txt).
Security

| Bug ID | Description |
|---|---|
| **308583363, 332464869** | Security fix for `apigee-mart`. This addresses the following vulnerabilities: - [CVE-2023-36478](https://nvd.nist.gov/vuln/detail/CVE-2023-36478) - [CVE-2023-36479](https://nvd.nist.gov/vuln/detail/CVE-2023-36479) - [CVE-2023-34462](https://nvd.nist.gov/vuln/detail/CVE-2023-34462) - [CVE-2023-40167](https://nvd.nist.gov/vuln/detail/CVE-2023-40167) - [CVE-2023-26048](https://nvd.nist.gov/vuln/detail/CVE-2023-26048) - [CVE-2023-26049](https://nvd.nist.gov/vuln/detail/CVE-2023-26049) - [CVE-2023-51775](https://nvd.nist.gov/vuln/detail/CVE-2023-51775) - [CVE-2024-28752](https://nvd.nist.gov/vuln/detail/CVE-2024-28752) - [CVE-2024-25710](https://nvd.nist.gov/vuln/detail/CVE-2024-25710) - [CVE-2024-26308](https://nvd.nist.gov/vuln/detail/CVE-2024-26308) |
| **332465218** | Security fix for `apigee-runtime`. This addresses the following vulnerabilities: - [CVE-2023-52428](https://nvd.nist.gov/vuln/detail/CVE-2023-52428) - [CVE-2023-44483](https://nvd.nist.gov/vuln/detail/CVE-2023-44483) |
| **341994213, 333971421** | Security fixes for `Cassandra emulator`. These address the following vulnerabilities: - [CVE-2017-5929](https://nvd.nist.gov/vuln/detail/CVE-2017-5929) - [CVE-2017-18640](https://nvd.nist.gov/vuln/detail/CVE-2017-18640) - [CVE-2023-36478](https://nvd.nist.gov/vuln/detail/CVE-2023-36478) - [CVE-2019-16869](https://nvd.nist.gov/vuln/detail/CVE-2019-16869) - [CVE-2024-22201](https://nvd.nist.gov/vuln/detail/CVE-2024-22201) - [CVE-2015-0886](https://nvd.nist.gov/vuln/detail/CVE-2015-0886) - [CVE-2024-28752](https://nvd.nist.gov/vuln/detail/CVE-2024-28752) - [CVE-2024-29025](https://nvd.nist.gov/vuln/detail/CVE-2024-29025) - [CVE-2021-42550](https://nvd.nist.gov/vuln/detail/CVE-2021-42550) - [CVE-2023-52428](https://nvd.nist.gov/vuln/detail/CVE-2023-52428) - [CVE-2018-10237](https://nvd.nist.gov/vuln/detail/CVE-2018-10237) - [CVE-2023-40167](https://nvd.nist.gov/vuln/detail/CVE-2023-41067) - [CVE-2021-29425](https://nvd.nist.gov/vuln/detail/CVE-2021-29425) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-26048](https://nvd.nist.gov/vuln/detail/CVE-2023-26048) - [CVE-2023-44483](https://nvd.nist.gov/vuln/detail/CVE-2023-44483) - [CVE-2023-26049](https://nvd.nist.gov/vuln/detail/CVE-2023-26049) |
| **329762216** | Security fix for `apigee-installer`. This addresses the following vulnerability: [CVE-2024-24786](https://nvd.nist.gov/vuln/detail/CVE-2024-24786) |
| **342630443, 342714341, 343202829** | Security fixes to address the following vulnerabilities: - [CVE-2024-29857](https://nvd.nist.gov/vuln/detail/CVE-2024-29857) - [CVE-2024-30172](https://nvd.nist.gov/vuln/detail/CVE-2024-30172) - [CVE-2024-30171](https://nvd.nist.gov/vuln/detail/CVE-2024-30171) - [CVE-2024-34447](https://nvd.nist.gov/vuln/detail/CVE-2024-34447) - [CVE-2023-5072](https://nvd.nist.gov/vuln/detail/CVE-2023-5072) - [CVE-2022-4568](https://nvd.nist.gov/vuln/detail/CVE-2022-4568) - [CVE-2023-6378](https://nvd.nist.gov/vuln/detail/CVE-2023-6378) - [CVE-2021-42550](https://nvd.nist.gov/vuln/detail/CVE-2021-42550) |

Fixed

| Bug ID | Description |
|---|---|
| **293150694** | **`<HTTPMonitor>` now supports the `<UseTargetServerSSLInfo>` element and can trust TLS certs from non-public CAs**. |
| **329874359** | **Decreased the default value of `<CacheLookupTimeoutInSeconds>` from 30 seconds to 12 seconds.** |
| **334442202** | **Added specific and informative error messaging for App query failures resulting from discrepancies between developers and apps.** |
| **333919279** | **Improved reliability for Developer, App and API products APIs.** |
| **339169651** | **Fixed potential `HTTP` request smuggling vulnerability when using the `OPTIONS` method.** |
| **297539870** | **`<HTTPTargetConnection>` property `io.timeout.millis` is honored when used with WebSockets.** |
| **N/A** | **Updated infrastructure and libraries.** |

## July 31, 2024

**Apigee hybrid** 1.11.2-hotfix.2 Announcement

### hybrid 1.11.2-hotfix.2

On July 31, 2024 we released an updated version of the Apigee hybrid software, 1.11.2-hotfix.2.

**Note:** This release reflects a change to the component images and not the Helm chart templates. If your hybrid installation is currently on Apigee hybrid v1.11.2, Apply this hotfix with the following steps:

1. In your overrides file, update the `image.url` and `image.tag` properties of `ao` and `runtime`:

       ao:
         image:
           url: "gcr.io/apigee-release/hybrid/apigee-operators"
           tag: "1.11.2-hotfix.2"
       runtime:
         image:
           url: "gcr.io/apigee-release/hybrid/apigee-runtime"
           tag: "1.11.2-hotfix.2"

2. Install the hotfix release:

   - For Helm-managed releases, update the `apigee-operator` with the `helm upgrade` command and your current overrides files:

         helm upgrade operator apigee-operator/ \
           --namespace apigee-system \
           --atomic \
           -f overrides.yaml 

     For each environment in your Apigee org:

         helm upgrade ENV_RELEASE_NAME apigee-env/ \
           --namespace APIGEE_NAMESPACE \
           --set env=ENV_NAME \
           --atomic \
           -f overrides.yaml 

     - <var translate="no">ENV_RELEASE_NAME</var> is a name used to keep track of installation and upgrades of the `apigee-env chart`. This name must be unique from the other Helm release names in your installation. Usually this is the same as <var translate="no">ENV_NAME</var>. However, if your environment has the same name as your environment group, you must use different release names for the environment and environment group, for example `dev-env-release` and `dev-envgroup-release`. For more information on releases in Helm, see [Three big concepts](https://helm.sh/docs/intro/using_helm/#three-big-concepts) in the Helm documentation.
     - <var translate="no">APIGEE_NAMESPACE</var> is your installation's namespace. The default is `apigee`.
     - <var translate="no">ENV_NAME</var> is the name of the environment you are upgrading.
   - For `apigeectl`-managed releases:

     1. install the hotfix release with `apigeectl init` using your updated overrides file:

            ${APIGEECTL_HOME}/apigeectl init -f OVERRIDES_FILE --dry-run=client 

        Followed by:

            ${APIGEECTL_HOME}/apigeectl init -f OVERRIDES_FILE 

     2. Apply the hotfix release with `apigeectl apply`:

            ${APIGEECTL_HOME}/apigeectl apply -f OVERRIDES_FILE --all-envs --dry-run=client 

        Followed by:

            ${APIGEECTL_HOME}/apigeectl apply -f OVERRIDES_FILE --all-envs

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.11](https://docs.cloud.google.com/apigee/docs/hybrid/v1.11/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.11/big-picture.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **351868444** | **Tolerations are now working for Redis's Envoy pod.** |
| **297539870** | **`HTTPTargetConnection` property `io.timeout.millis` is now honored correctly when using websockets.** |

## July 30, 2024

**Apigee X** Feature With this release, Apigee expanded its support for data residency to an additional region in Europe: `europe-west6` (Zurich).

Data residency for Apigee meets compliance and regulatory requirements by allowing you to specify the geographic locations (regions) where Apigee data is stored.

For more information, see [Introduction to data residency](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/drz-concepts.md.txt).

For a list of supported geographic locations, see [Apigee locations](https://docs.cloud.google.com/apigee/docs/locations.md.txt).
Announcement On July 30, 2024, we released an updated version of Apigee.
**Apigee hybrid** 1.12.1-hotfix.1 Announcement

### hybrid 1.12.1-hotfix.1

On July 30, 2024 we released an updated version of the Apigee hybrid software, 1.12.1-hotfix.1.

**Note:** This release reflects a change to the component images and not the Helm chart templates. If your hybrid installation is currently on Apigee hybrid v1.12.1, Apply this hotfix with the following steps:

1. In your overrides file, update the `ao.image.url` and `ao.image.tag` properties:

       ao:
         image:
           url: "gcr.io/apigee-release/hybrid/apigee-operators"
           tag: "1.12.1-hotfix.1"

2. Install the hotfix release. Update the `apigee-operator` component with the `helm upgrade` command and your current overrides files:

          helm upgrade operator apigee-operator/ \
            --namespace apigee-system \
            --atomic \
            -f overrides.yaml 

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.12](https://docs.cloud.google.com/apigee/docs/hybrid/v1.12/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.12/big-picture.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **351868444** | **Tolerations are now working for Redis's Envoy pod.** |

## July 26, 2024

**Apigee Advanced API Security** Feature Advanced API Security now supports data residency. Data residency meets compliance and regulatory requirements by allowing you to specify the geographic locations (regions) where Advanced API Security data is stored. For more information, see [Introduction to data residency](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/drz-concepts.md.txt).
Announcement On July 26, 2024, we released an updated version of Advanced API Security.
**Apigee Monetization** Announcement On July 26, 2024, we released an updated version of Apigee Monetization.
Feature Monetization functionality, including rate plan creation and managing rate plans for API Products, is now available in the Apigee UI in Cloud Console.

For information, see [Manage Rate Plans](https://docs.cloud.google.com/apigee/docs/api-platform/monetization/manage-rate-plans.md.txt) and [Create API Products](https://docs.cloud.google.com/apigee/docs/api-platform/publish/create-api-products.md.txt).
Feature Monetization now supports data residency. Data residency meets compliance and regulatory requirements by allowing you to specify the geographic locations (regions) where Monetization data is stored. For more information, see [Introduction to data residency](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/drz-concepts.md.txt).

## July 25, 2024

**Apigee X** Announcement On July 25, 2024, we released an updated version of Apigee.
Feature This release includes an update to Advanced API Operations Anomaly Detection functionality: the Anomaly Detection functionality is now available in the Apigee UI in Cloud Console and is renamed to "Operations Anomalies."

For information, see the [Operations Anomalies overview](https://docs.cloud.google.com/apigee/docs/api-platform/analytics/operations-anomalies-overview.md.txt) for information on the functionality in Apigee UI in Cloud Console.
Feature Operations Anomalies supports data residency. Data residency meets compliance and regulatory requirements by allowing you to specify the geographic locations (regions) where Operations Anomalies data is stored. For more information, see [Introduction to data residency](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/drz-concepts.md.txt).

## July 19, 2024

**Apigee Advanced API Security** Announcement The preview release of generative AI summaries and recommendations for Advanced API Security Abuse Detection incidents has been temporarily disabled due to a known issue. We will announce in a release note when the functionality is re-enabled.

## July 16, 2024

**Apigee Integrated Portal** Announcement On July 16, 2024 we released a new version of the Apigee integrated portal.
Feature This release includes general improvements to performance and availability.

## July 11, 2024

**Apigee X** Announcement On July 11, 2024, we released an updated version of Apigee (1-12-0-apigee-8).

This release addresses the security concerns in [GCP-2024-032 from Google Anthos Service Mesh](https://docs.cloud.google.com/service-mesh/docs/security-bulletins.md.txt#gcp-2024-032).

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Security

| Bug ID | Description |
|---|---|
| **330175485** | **Security fix for apigee-ingress.** This addresses the following vulnerabilities: - [CVE-2024-23326](https://nvd.nist.gov/vuln/detail/CVE-2024-23326) - [CVE-2024-32974](https://nvd.nist.gov/vuln/detail/CVE-2024-32974) - [CVE-2024-32975](https://nvd.nist.gov/vuln/detail/CVE-2024-32975) - [CVE-2024-32976](https://nvd.nist.gov/vuln/detail/CVE-2024-32976) - [CVE-2024-34362](https://nvd.nist.gov/vuln/detail/CVE-2024-34362) - [CVE-2024-34363](https://nvd.nist.gov/vuln/detail/CVE-2024-34363) - [CVE-2024-34364](https://nvd.nist.gov/vuln/detail/CVE-2024-34364) |

Fixed

| Bug ID | Description |
|---|---|
| **N/A** | **Updated libraries and infrastructure.** |

## July 09, 2024

**Apigee X** Issue **Updated: Limit on number of basepaths per environment**

Apigee is raising the temporary limit of 1000 basepaths per environment to avoid potential failures when deploying API proxy revisions.

While this limit is in place, you can deploy up to 1000 API proxy revisions (each containing a single basepath) per environment. If your API proxies or revisions contain more than one basepath, the total number of basepaths per environment must not exceed 1000.

To track the status of this issue, see [Apigee Known Issues](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt).

## July 02, 2024

**Apigee X** Announcement On July 2, 2024, we published a security bulletin for Apigee.
Security A remote code execution vulnerability, [CVE-2024-6387](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6387), was recently discovered in OpenSSH. The vulnerability exploits a race condition that could be used to obtain access to a remote shell, enabling attackers to gain root access to GKE or VM nodes.

**Security bulletin published: [GCP-2024-040](https://docs.cloud.google.com/apigee/docs/security-bulletins/security-bulletins.md.txt#gcp-2024-040)**

## June 28, 2024

**Apigee hybrid** v1.12.1 Announcement

### hybrid v1.12.1

On June 28, 2024 we released an updated version of the Apigee hybrid software, 1.12.1.

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.12.1](https://docs.cloud.google.com/apigee/docs/hybrid/v1.12/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.12/big-picture.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **347798999** | **Fixed an issue preventing configuration of forward proxies for OpenTelemetry collector pods.** |
| **345501069** | **Fixed issue with Hybrid Guardrails resource configuration preventing the Guardails pod from starting.** |
| **341797795** | **Autofill the Hybrid Guardrails checkpoint value if a checkpoint is not provided.** |
| **340248314** | **Added support for `targetCPUUtilizationPercentage` to [`apigeeIngressGateway`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.12/config-prop-ref.md.txt#apigeeingressgateway-targetcpuutilizationpercentage) and [`ingressGateways`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.12/config-prop-ref.md.txt#ingressgateways-targetcpuutilizationpercentage).** The default value is 75. |
| **324779388** | **Improved error handling for backup and restore.** |
| **311489774** | **Removed inclusion of Java in Cassandra client image..** |
| **310338146** | **Fixed invalid download directory output from the [`create-service-account`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.12/create-service-account.md.txt) tool.** |
| **300135626** | **Removed inclusion of Java in Cassandra Backup Utility image.** |
| **239523766** | **Remove "Unable to evaluate jsonVariable, returning null" logging string from *ExtractVariables* Policy** |

Security

| Bug ID | Description |
|---|---|
| **345791712** | **Security fix for `fluent-bit`.** This addresses the following vulnerability: - [CVE-2024-4323](https://nvd.nist.gov/vuln/detail/CVE-2024-4323) |
| **335910066** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerability: - [CVE-2023-47108](https://nvd.nist.gov/vuln/detail/CVE-2023-47108) |
| **335909737** | **Security fixes for `apigee-asm-ingress`.** This addresses the following vulnerabilities: - [CVE-2024-24557](https://nvd.nist.gov/vuln/detail/CVE-2024-24557) - [CVE-2024-21664](https://nvd.nist.gov/vuln/detail/CVE-2024-21664) - [CVE-2023-6779](https://nvd.nist.gov/vuln/detail/CVE-2023-6779) - [CVE-2023-6246](https://nvd.nist.gov/vuln/detail/CVE-2023-6246) |
| **335909397** | **Security fixes for `apigee-open-telemetry-collector`.** This addresses the following vulnerability: - [CVE-2023-47108](https://nvd.nist.gov/vuln/detail/CVE-2023-47108) |
| **335908990** | **Security fixes for `apigee-asm-istiod`.** This addresses the following vulnerabilities: - [CVE-2024-24557](https://nvd.nist.gov/vuln/detail/CVE-2024-24557) - [CVE-2024-21664](https://nvd.nist.gov/vuln/detail/CVE-2024-21664) |
| **335908985** | **Security fix for `apigee-prometheus-adapter`.** This addresses the following vulnerabilities: - [CVE-2023-47108](https://nvd.nist.gov/vuln/detail/CVE-2023-47108) - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) - [CVE-2023-45142](https://nvd.nist.gov/vuln/detail/CVE-2023-45142) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) . |
| **335908657** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2024-24557](https://nvd.nist.gov/vuln/detail/CVE-2024-24557) - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) |
| **335908139** | **Security fix for `fluent-bit`.** This addresses the following vulnerability: - [CVE-2024-0985](https://nvd.nist.gov/vuln/detail/CVE-2024-0985) |
| **332821083** | **Security fix for `apigee-operators`.** This addresses the following vulnerability: - [CVE-2024-24786](https://nvd.nist.gov/vuln/detail/CVE-2024-24786) |
| **317528509** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2023-34462](https://nvd.nist.gov/vuln/detail/CVE-2023-34462) - [CVE-2023-32732](https://nvd.nist.gov/vuln/detail/CVE-2023-32732) - [CVE-2023-32731](https://nvd.nist.gov/vuln/detail/CVE-2023-32731) - [CVE-2023-1428](https://nvd.nist.gov/vuln/detail/CVE-2023-1428) |
| **308835165** | **Security fix for `apigee-synchronizer`.** This addresses the following vulnerability: - [CVE-2023-34462](https://nvd.nist.gov/vuln/detail/CVE-2023-34462) |
| **N/A** | **Security fixes for `apigee-asm-ingress`.** This addresses the following vulnerabilities: - [CVE-2023-6779](https://nvd.nist.gov/vuln/detail/CVE-2023-6779) - [CVE-2023-6246](https://nvd.nist.gov/vuln/detail/CVE-2023-6246) |
| **N/A** | **Security fixes for `apigee-asm-istiod`.** This addresses the following vulnerabilities: - [CVE-2024-21664](https://nvd.nist.gov/vuln/detail/CVE-2024-21664) |
| **N/A** | **Security fixes for `apigee-cassandra-backup-utility`.** This addresses the following vulnerabilities: - [CVE-2023-50782](https://nvd.nist.gov/vuln/detail/CVE-2023-50782) |
| **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2022-4899](https://nvd.nist.gov/vuln/detail/CVE-2022-4899) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2023-50782](https://nvd.nist.gov/vuln/detail/CVE-2023-50782) |
| **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2023-47108](https://nvd.nist.gov/vuln/detail/CVE-2023-47108) |
| **N/A** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerabilities: - [CVE-2023-47108](https://nvd.nist.gov/vuln/detail/CVE-2023-47108) - [CVE-2023-45142](https://nvd.nist.gov/vuln/detail/CVE-2023-45142) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) |
| **N/A** | **Security fixes for `apigee-stackdriver-prometheus-sidecar`.** This addresses the following vulnerabilities: - [CVE-2023-45287](https://nvd.nist.gov/vuln/detail/CVE-2023-45287) - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) - [CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538) - [CVE-2023-24537](https://nvd.nist.gov/vuln/detail/CVE-2023-24537) - [CVE-2023-24536](https://nvd.nist.gov/vuln/detail/CVE-2023-24536) - [CVE-2023-24534](https://nvd.nist.gov/vuln/detail/CVE-2023-24534) - [CVE-2022-41725](https://nvd.nist.gov/vuln/detail/CVE-2022-41725) - [CVE-2022-41724](https://nvd.nist.gov/vuln/detail/CVE-2022-41724) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) - [CVE-2022-41722](https://nvd.nist.gov/vuln/detail/CVE-2022-41722) - [CVE-2022-41720](https://nvd.nist.gov/vuln/detail/CVE-2022-41720) - [CVE-2022-41716](https://nvd.nist.gov/vuln/detail/CVE-2022-41716) - [CVE-2022-41715](https://nvd.nist.gov/vuln/detail/CVE-2022-41715) - [CVE-2022-32189](https://nvd.nist.gov/vuln/detail/CVE-2022-32189) - [CVE-2022-30635](https://nvd.nist.gov/vuln/detail/CVE-2022-30635) - [CVE-2022-30633](https://nvd.nist.gov/vuln/detail/CVE-2022-30633) - [CVE-2022-30632](https://nvd.nist.gov/vuln/detail/CVE-2022-30632) - [CVE-2022-30631](https://nvd.nist.gov/vuln/detail/CVE-2022-30631) - [CVE-2022-30630](https://nvd.nist.gov/vuln/detail/CVE-2022-30630) - [CVE-2022-30580](https://nvd.nist.gov/vuln/detail/CVE-2022-30580) - [CVE-2022-29804](https://nvd.nist.gov/vuln/detail/CVE-2022-29804) - [CVE-2022-2880](https://nvd.nist.gov/vuln/detail/CVE-2022-2880) - [CVE-2022-2879](https://nvd.nist.gov/vuln/detail/CVE-2022-2879) - [CVE-2022-28327](https://nvd.nist.gov/vuln/detail/CVE-2022-28327) - [CVE-2022-28131](https://nvd.nist.gov/vuln/detail/CVE-2022-28131) - [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664) - [CVE-2022-27536](https://nvd.nist.gov/vuln/detail/CVE-2022-27536) - [CVE-2022-27191](https://nvd.nist.gov/vuln/detail/CVE-2022-27191) - [CVE-2022-24921](https://nvd.nist.gov/vuln/detail/CVE-2022-24921) - [CVE-2022-24675](https://nvd.nist.gov/vuln/detail/CVE-2022-24675) - [CVE-2022-23806](https://nvd.nist.gov/vuln/detail/CVE-2022-23806) - [CVE-2022-23773](https://nvd.nist.gov/vuln/detail/CVE-2022-23773) - [CVE-2022-23772](https://nvd.nist.gov/vuln/detail/CVE-2022-23772) - [CVE-2022-21698](https://nvd.nist.gov/vuln/detail/CVE-2022-21698) - [CVE-2021-44716](https://nvd.nist.gov/vuln/detail/CVE-2021-44716) - [CVE-2021-43565](https://nvd.nist.gov/vuln/detail/CVE-2021-43565) - [CVE-2021-41772](https://nvd.nist.gov/vuln/detail/CVE-2021-41772) - [CVE-2021-41771](https://nvd.nist.gov/vuln/detail/CVE-2021-41771) - [CVE-2021-39293](https://nvd.nist.gov/vuln/detail/CVE-2021-39293) - [CVE-2021-38297](https://nvd.nist.gov/vuln/detail/CVE-2021-38297) - [CVE-2021-37219](https://nvd.nist.gov/vuln/detail/CVE-2021-37219) - [CVE-2021-33198](https://nvd.nist.gov/vuln/detail/CVE-2021-33198) - [CVE-2021-33196](https://nvd.nist.gov/vuln/detail/CVE-2021-33196) - [CVE-2021-33195](https://nvd.nist.gov/vuln/detail/CVE-2021-33195) - [CVE-2021-33194](https://nvd.nist.gov/vuln/detail/CVE-2021-33194) - [CVE-2021-3121](https://nvd.nist.gov/vuln/detail/CVE-2021-3121) - [CVE-2021-3115](https://nvd.nist.gov/vuln/detail/CVE-2021-3115) - [CVE-2021-27918](https://nvd.nist.gov/vuln/detail/CVE-2021-27918) - [CVE-2020-7919](https://nvd.nist.gov/vuln/detail/CVE-2020-7919) - [CVE-2020-29652](https://nvd.nist.gov/vuln/detail/CVE-2020-29652) - [CVE-2020-28852](https://nvd.nist.gov/vuln/detail/CVE-2020-28852) - [CVE-2020-28367](https://nvd.nist.gov/vuln/detail/CVE-2020-28367) - [CVE-2020-28366](https://nvd.nist.gov/vuln/detail/CVE-2020-28366) - [CVE-2020-26160](https://nvd.nist.gov/vuln/detail/CVE-2020-26160) - [CVE-2020-16845](https://nvd.nist.gov/vuln/detail/CVE-2020-16845) - [CVE-2020-14040](https://nvd.nist.gov/vuln/detail/CVE-2020-14040) - [CVE-2019-9634](https://nvd.nist.gov/vuln/detail/CVE-2019-9634) - [CVE-2019-17596](https://nvd.nist.gov/vuln/detail/CVE-2019-17596) - [CVE-2019-14809](https://nvd.nist.gov/vuln/detail/CVE-2019-14809) - [CVE-2019-11888](https://nvd.nist.gov/vuln/detail/CVE-2019-11888) |

1.10.5-hotfix.1 Announcement

### hybrid 1.10.5-hotfix.1

On June 28, 2024 we released an updated version of the Apigee hybrid software, 1.10.5-hotfix.1.

**Note:** This release reflects a change to the Helm chart templates and not a change to the images. If your hybrid installation is currently on Apigee hybrid v1.10.5, Apply this hotfix with the following steps:

1. In your overrides file, update the `ao.image` `url` and `tag`:

       ao:
         image:
           url: "gcr.io/apigee-release/hybrid/apigee-operators"
           tag: "1.10.5-hotfix.1"

2. Install the hotfix release with `apigeectl init` using your updated overrides files:

       ${APIGEECTL_HOME}/apigeectl init -f OVERRIDES_FILE --dry-run=client 

   Followed by:

       ${APIGEECTL_HOME}/apigeectl init -f OVERRIDES_FILE 

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.10.5-hotfix.1](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/big-picture.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **347997965** | **Upgrading to Apigee Hybrid 1.11.2 and 1.10.5 can cause missing metrics.** |

1.11.2-hotfix.1 Announcement

### hybrid 1.11.2-hotfix.1

On June 28, 2024 we released an updated version of the Apigee hybrid software, 1.11.2-hotfix.1.

**Note:** This release reflects a change to the Helm chart templates and not a change to the images. If your hybrid installation is currently on Apigee hybrid v1.11.2, Apply this hotfix with the following steps:

1. In your overrides file, update the `ao.image` `url` and `tag`:

       ao:
         image:
           url: "gcr.io/apigee-release/hybrid/apigee-operators"
           tag: "1.11.2-hotfix.1"

2. Install the hotfix release:

   - For Helm-managed releases, update the `apigee-operator` with the `helm upgrade` command and your current overrides files:

         helm upgrade operator apigee-operator/ \
           --namespace apigee-system \
           --atomic \
           -f overrides.yaml 

   - For `apigeectl`-managed releases, install the hotfix release with `apigeectl init` using your updated overrides files:

         ${APIGEECTL_HOME}/apigeectl init -f OVERRIDES_FILE --dry-run=client 

     Followed by:

         ${APIGEECTL_HOME}/apigeectl init -f OVERRIDES_FILE 

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.11.2-hotfix.1](https://docs.cloud.google.com/apigee/docs/hybrid/v1.11/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.11/big-picture.md.txt).

## June 27, 2024

**Apigee Advanced API Security** Announcement On June 27, 2024 we released a new version of Advanced API Security

Rollouts of this feature are ongoing and will take multiple days to complete across all Google Cloud zones. You might not be able to use the functionality until the rollout is complete.
Feature **Preview release of generative AI incident report summaries**

This release introduces the [preview](https://cloud.google.com/products/#product-launch-stages) release of generative AI summaries and recommendations for Advanced API Security Abuse Detection incidents. The new generative AI features are available for all Advanced API Security-enabled projects and do not require the Gemini Code Assist add-on.

For usage information, see the [Abuse Detection customer documentation](https://docs.cloud.google.com/apigee/docs/api-security/abuse-detection.md.txt#incident-details).
**Apigee X** Announcement On June 27, 2024, we released an updated version of Apigee.
Feature Apigee is now available in new regions:

- Europe - Berlin (`europe-west10`)
- Africa - Johannesburg (`africa-south1`)

See [Apigee locations](https://docs.cloud.google.com/apigee/docs/locations.md.txt) for more information about available regions.

## June 26, 2024

**Apigee X** Fixed

| Bug ID | Description |
|---|---|
| N/A | **Upgraded infrastructure and libraries.** |

Announcement On June 26, 2024, we released an updated version of Apigee (1-12-0-apigee-7).

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Fixed These issues were fixed in 1-12-0-apigee-4-hotfix and are included in this release:

| Bug ID | Description |
|---|---|
| **337876238, 330314128, 333762214** | **Resolved issues resulting in an increase in `404/503` responses.** Upgraded storage for the Apigee router to the latest version to resolve `404` responses. Adjusted traffic weight and delays in the older replica set to handle traffic divergence during the release process to address any `5xx` responses. |
| **335832119** | **Fixed 404 errors caused during Apigee instance update/rollback.** |
| **255772956** | **Turned off asynchronous services callout when the `<Response>` element is not present due to inconsistent scaling of runtime pods.** |
| **338717278** | **Reverted problematic commit to address thread pool exhaustion.** |

## June 20, 2024

**Apigee X** Announcement On June 20, 2024, we released an updated version of Apigee.
Change This release includes a change in the user experience of selecting a physical location for control plane hosting when provisioning a Subscription or Pay-as-you-go Apigee organization with data regionalization enabled.

The new provisioning experience provides the opportunity to select a control plane hosting jurisdiction that refers to a location within a geopolitical boundary that may span more than one region. For more information, see [Select an Apigee API control plane hosting jurisdiction](https://docs.cloud.google.com/apigee/docs/locations.md.txt#select-an-apigee-api-control-plane-hosting-jurisdiction).

## June 17, 2024

**Apigee Advanced API Security** Announcement On June 17, 2024 we released an updated version of Advanced API Security.
Feature Shadow API Discovery, which is in [preview](https://cloud.google.com/products/#product-launch-stages), no longer requires separate creation of P4SA permissions in order to enable the functionality.

For usage information, see the [Shadow API Discovery documentation](https://docs.cloud.google.com/apigee/docs/api-observation/shadow-api-discovery.md.txt).
**Apigee X** Announcement On June 17, 2024, we released an updated version of Apigee.
Feature **Update Pay-as-you-go environment types using the Apigee UI in the Google Cloud console**

Apigee Pay-as-you-go customers can modify the type of an existing environment using the Apigee UI in the Cloud console. This feature allows you to add or remove feature capabilities for your environments from the UI.

For more information, see [Update your environment type](https://docs.cloud.google.com/apigee/docs/api-platform/reference/update-environment-types.md.txt#update-your-environment-type).
To learn more about environment types, see [Apigee Pay-as-you-go environment types](https://docs.cloud.google.com/apigee/docs/api-platform/reference/update-environment-types.md.txt#update-your-environment-type).
**Apigee hybrid** v1.10.5 Announcement

### hybrid v1.10.5

On June 17, 2024 we released an updated version of the Apigee hybrid software, 1.10.5.

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.10.5](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/big-picture.md.txt).
Security

| Bug ID | Description |
|---|---|
| **329540114** | **Security fix for `apigee-installer`.** This addresses the following vulnerability: - [CVE-2024-24786](https://nvd.nist.gov/vuln/detail/CVE-2024-24786) |
| **317528509** | **Security fix for `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2023-34462](https://nvd.nist.gov/vuln/detail/CVE-2023-34462) - [CVE-2023-32732](https://nvd.nist.gov/vuln/detail/CVE-2023-32732) - [CVE-2023-32731](https://nvd.nist.gov/vuln/detail/CVE-2023-32731) - [CVE-2023-1428](https://nvd.nist.gov/vuln/detail/CVE-2023-1428) |
| **N/A** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerability: - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) |
| **N/A** | **Security fixes for `apigee-asm-ingress` and `apigee-asm-istiod`.** This addresses the following vulnerability: - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) |
| **N/A** | **Security fixes for `apigee-cassandra-backup-utility`.** This addresses the following vulnerabilities: - [CVE-2023-6378](https://nvd.nist.gov/vuln/detail/CVE-2023-6378) - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-43642](https://nvd.nist.gov/vuln/detail/CVE-2023-43642) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-34455](https://nvd.nist.gov/vuln/detail/CVE-2023-34455) - [CVE-2023-34454](https://nvd.nist.gov/vuln/detail/CVE-2023-34454) - [CVE-2023-34453](https://nvd.nist.gov/vuln/detail/CVE-2023-34453) - [CVE-2023-30601](https://nvd.nist.gov/vuln/detail/CVE-2023-30601) - [CVE-2023-2976](https://nvd.nist.gov/vuln/detail/CVE-2023-2976) - [CVE-2022-42004](https://nvd.nist.gov/vuln/detail/CVE-2022-42004) - [CVE-2022-42003](https://nvd.nist.gov/vuln/detail/CVE-2022-42003) - [CVE-2022-25857](https://nvd.nist.gov/vuln/detail/CVE-2022-25857) - [CVE-2022-1471](https://nvd.nist.gov/vuln/detail/CVE-2022-1471) - [CVE-2021-44521](https://nvd.nist.gov/vuln/detail/CVE-2021-44521) - [CVE-2021-20190](https://nvd.nist.gov/vuln/detail/CVE-2021-20190) - [CVE-2020-36518](https://nvd.nist.gov/vuln/detail/CVE-2020-36518) - [CVE-2020-36189](https://nvd.nist.gov/vuln/detail/CVE-2020-36189) - [CVE-2020-36188](https://nvd.nist.gov/vuln/detail/CVE-2020-36188) - [CVE-2020-36187](https://nvd.nist.gov/vuln/detail/CVE-2020-36187) - [CVE-2020-36186](https://nvd.nist.gov/vuln/detail/CVE-2020-36186) - [CVE-2020-36185](https://nvd.nist.gov/vuln/detail/CVE-2020-36185) - [CVE-2020-36184](https://nvd.nist.gov/vuln/detail/CVE-2020-36184) - [CVE-2020-36183](https://nvd.nist.gov/vuln/detail/CVE-2020-36183) - [CVE-2020-36182](https://nvd.nist.gov/vuln/detail/CVE-2020-36182) - [CVE-2020-36181](https://nvd.nist.gov/vuln/detail/CVE-2020-36181) - [CVE-2020-36180](https://nvd.nist.gov/vuln/detail/CVE-2020-36180) - [CVE-2020-36179](https://nvd.nist.gov/vuln/detail/CVE-2020-36179) - [CVE-2020-35728](https://nvd.nist.gov/vuln/detail/CVE-2020-35728) - [CVE-2020-35491](https://nvd.nist.gov/vuln/detail/CVE-2020-35491) - [CVE-2020-35490](https://nvd.nist.gov/vuln/detail/CVE-2020-35490) - [CVE-2020-25649](https://nvd.nist.gov/vuln/detail/CVE-2020-25649) - [CVE-2020-24750](https://nvd.nist.gov/vuln/detail/CVE-2020-24750) - [CVE-2020-24616](https://nvd.nist.gov/vuln/detail/CVE-2020-24616) - [CVE-2020-17516](https://nvd.nist.gov/vuln/detail/CVE-2020-17516) - [CVE-2020-14195](https://nvd.nist.gov/vuln/detail/CVE-2020-14195) - [CVE-2020-14062](https://nvd.nist.gov/vuln/detail/CVE-2020-14062) - [CVE-2020-14061](https://nvd.nist.gov/vuln/detail/CVE-2020-14061) - [CVE-2020-14060](https://nvd.nist.gov/vuln/detail/CVE-2020-14060) - [CVE-2019-16869](https://nvd.nist.gov/vuln/detail/CVE-2019-16869) - [CVE-2017-18640](https://nvd.nist.gov/vuln/detail/CVE-2017-18640) |
| **N/A** | **Security fixes for `apigee-connect-agent`.** This addresses the following vulnerability: - [CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283) |
| **N/A** | **Security fixes for `apigee-diagnostics-collector`.** This addresses the following vulnerabilities: - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-36478](https://nvd.nist.gov/vuln/detail/CVE-2023-36478) - [CVE-2023-32731](https://nvd.nist.gov/vuln/detail/CVE-2023-32731) - [CVE-2023-21930](https://nvd.nist.gov/vuln/detail/CVE-2023-21930) - [CVE-2023-1428](https://nvd.nist.gov/vuln/detail/CVE-2023-1428) |
| **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2023-5869](https://nvd.nist.gov/vuln/detail/CVE-2023-5869) - [CVE-2023-39417](https://nvd.nist.gov/vuln/detail/CVE-2023-39417) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2023-49083](https://nvd.nist.gov/vuln/detail/CVE-2023-49083) - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) - [CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-36632](https://nvd.nist.gov/vuln/detail/CVE-2023-36632) - [CVE-2023-30601](https://nvd.nist.gov/vuln/detail/CVE-2023-30601) - [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329) - [CVE-2022-48565](https://nvd.nist.gov/vuln/detail/CVE-2022-48565) - [CVE-2022-48560](https://nvd.nist.gov/vuln/detail/CVE-2022-48560) - [CVE-2022-45061](https://nvd.nist.gov/vuln/detail/CVE-2022-45061) - [CVE-2022-41881](https://nvd.nist.gov/vuln/detail/CVE-2022-41881) - [CVE-2022-34169](https://nvd.nist.gov/vuln/detail/CVE-2022-34169) - [CVE-2022-26488](https://nvd.nist.gov/vuln/detail/CVE-2022-26488) - [CVE-2022-21476](https://nvd.nist.gov/vuln/detail/CVE-2022-21476) - [CVE-2022-0391](https://nvd.nist.gov/vuln/detail/CVE-2022-0391) - [CVE-2021-44521](https://nvd.nist.gov/vuln/detail/CVE-2021-44521) - [CVE-2021-37137](https://nvd.nist.gov/vuln/detail/CVE-2021-37137) - [CVE-2021-37136](https://nvd.nist.gov/vuln/detail/CVE-2021-37136) - [CVE-2021-28667](https://nvd.nist.gov/vuln/detail/CVE-2021-28667) - [CVE-2021-20190](https://nvd.nist.gov/vuln/detail/CVE-2021-20190) - [CVE-2020-36518](https://nvd.nist.gov/vuln/detail/CVE-2020-36518) - [CVE-2020-36189](https://nvd.nist.gov/vuln/detail/CVE-2020-36189) - [CVE-2020-36188](https://nvd.nist.gov/vuln/detail/CVE-2020-36188) - [CVE-2020-36187](https://nvd.nist.gov/vuln/detail/CVE-2020-36187) - [CVE-2020-36186](https://nvd.nist.gov/vuln/detail/CVE-2020-36186) - [CVE-2020-36185](https://nvd.nist.gov/vuln/detail/CVE-2020-36185) - [CVE-2020-36184](https://nvd.nist.gov/vuln/detail/CVE-2020-36184) - [CVE-2020-36183](https://nvd.nist.gov/vuln/detail/CVE-2020-36183) - [CVE-2020-36182](https://nvd.nist.gov/vuln/detail/CVE-2020-36182) - [CVE-2020-36181](https://nvd.nist.gov/vuln/detail/CVE-2020-36181) - [CVE-2020-36180](https://nvd.nist.gov/vuln/detail/CVE-2020-36180) - [CVE-2020-36179](https://nvd.nist.gov/vuln/detail/CVE-2020-36179) - [CVE-2020-35728](https://nvd.nist.gov/vuln/detail/CVE-2020-35728) - [CVE-2020-35491](https://nvd.nist.gov/vuln/detail/CVE-2020-35491) - [CVE-2020-35490](https://nvd.nist.gov/vuln/detail/CVE-2020-35490) - [CVE-2020-25649](https://nvd.nist.gov/vuln/detail/CVE-2020-25649) - [CVE-2020-24750](https://nvd.nist.gov/vuln/detail/CVE-2020-24750) - [CVE-2020-24616](https://nvd.nist.gov/vuln/detail/CVE-2020-24616) - [CVE-2020-17516](https://nvd.nist.gov/vuln/detail/CVE-2020-17516) - [CVE-2020-14195](https://nvd.nist.gov/vuln/detail/CVE-2020-14195) - [CVE-2020-14062](https://nvd.nist.gov/vuln/detail/CVE-2020-14062) - [CVE-2020-14061](https://nvd.nist.gov/vuln/detail/CVE-2020-14061) - [CVE-2020-14060](https://nvd.nist.gov/vuln/detail/CVE-2020-14060) - [CVE-2020-10650](https://nvd.nist.gov/vuln/detail/CVE-2020-10650) - [CVE-2019-9674](https://nvd.nist.gov/vuln/detail/CVE-2019-9674) - [CVE-2019-20445](https://nvd.nist.gov/vuln/detail/CVE-2019-20445) - [CVE-2019-20444](https://nvd.nist.gov/vuln/detail/CVE-2019-20444) - [CVE-2019-0205](https://nvd.nist.gov/vuln/detail/CVE-2019-0205) - [CVE-2018-1320](https://nvd.nist.gov/vuln/detail/CVE-2018-1320) - [CVE-2017-5929](https://nvd.nist.gov/vuln/detail/CVE-2017-5929) - [CVE-2017-17522](https://nvd.nist.gov/vuln/detail/CVE-2017-17522) - [CVE-2016-5397](https://nvd.nist.gov/vuln/detail/CVE-2016-5397) - [CVE-2015-5652](https://nvd.nist.gov/vuln/detail/CVE-2015-5652) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** This addresses the following vulnerabilities: - [CVE-2023-6378](https://nvd.nist.gov/vuln/detail/CVE-2023-6378) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-43642](https://nvd.nist.gov/vuln/detail/CVE-2023-43642) - [CVE-2023-36632](https://nvd.nist.gov/vuln/detail/CVE-2023-36632) - [CVE-2023-34455](https://nvd.nist.gov/vuln/detail/CVE-2023-34455) - [CVE-2023-34454](https://nvd.nist.gov/vuln/detail/CVE-2023-34454) - [CVE-2023-34453](https://nvd.nist.gov/vuln/detail/CVE-2023-34453) - [CVE-2023-30601](https://nvd.nist.gov/vuln/detail/CVE-2023-30601) - [CVE-2023-2976](https://nvd.nist.gov/vuln/detail/CVE-2023-2976) - [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329) - [CVE-2022-48565](https://nvd.nist.gov/vuln/detail/CVE-2022-48565) - [CVE-2022-48560](https://nvd.nist.gov/vuln/detail/CVE-2022-48560) - [CVE-2022-45061](https://nvd.nist.gov/vuln/detail/CVE-2022-45061) - [CVE-2022-42004](https://nvd.nist.gov/vuln/detail/CVE-2022-42004) - [CVE-2022-42003](https://nvd.nist.gov/vuln/detail/CVE-2022-42003) - [CVE-2022-41881](https://nvd.nist.gov/vuln/detail/CVE-2022-41881) - [CVE-2022-34169](https://nvd.nist.gov/vuln/detail/CVE-2022-34169) - [CVE-2022-26488](https://nvd.nist.gov/vuln/detail/CVE-2022-26488) - [CVE-2022-25857](https://nvd.nist.gov/vuln/detail/CVE-2022-25857) - [CVE-2022-21476](https://nvd.nist.gov/vuln/detail/CVE-2022-21476) - [CVE-2022-1471](https://nvd.nist.gov/vuln/detail/CVE-2022-1471) - [CVE-2022-0391](https://nvd.nist.gov/vuln/detail/CVE-2022-0391) - [CVE-2021-44521](https://nvd.nist.gov/vuln/detail/CVE-2021-44521) - [CVE-2021-37137](https://nvd.nist.gov/vuln/detail/CVE-2021-37137) - [CVE-2021-37136](https://nvd.nist.gov/vuln/detail/CVE-2021-37136) - [CVE-2021-28667](https://nvd.nist.gov/vuln/detail/CVE-2021-28667) - [CVE-2021-20190](https://nvd.nist.gov/vuln/detail/CVE-2021-20190) - [CVE-2020-36518](https://nvd.nist.gov/vuln/detail/CVE-2020-36518) - [CVE-2020-36189](https://nvd.nist.gov/vuln/detail/CVE-2020-36189) - [CVE-2020-36188](https://nvd.nist.gov/vuln/detail/CVE-2020-36188) - [CVE-2020-36187](https://nvd.nist.gov/vuln/detail/CVE-2020-36187) - [CVE-2020-36186](https://nvd.nist.gov/vuln/detail/CVE-2020-36186) - [CVE-2020-36185](https://nvd.nist.gov/vuln/detail/CVE-2020-36185) - [CVE-2020-36184](https://nvd.nist.gov/vuln/detail/CVE-2020-36184) - [CVE-2020-36183](https://nvd.nist.gov/vuln/detail/CVE-2020-36183) - [CVE-2020-36182](https://nvd.nist.gov/vuln/detail/CVE-2020-36182) - [CVE-2020-36181](https://nvd.nist.gov/vuln/detail/CVE-2020-36181) - [CVE-2020-36180](https://nvd.nist.gov/vuln/detail/CVE-2020-36180) - [CVE-2020-36179](https://nvd.nist.gov/vuln/detail/CVE-2020-36179) - [CVE-2020-35728](https://nvd.nist.gov/vuln/detail/CVE-2020-35728) - [CVE-2020-35491](https://nvd.nist.gov/vuln/detail/CVE-2020-35491) - [CVE-2020-35490](https://nvd.nist.gov/vuln/detail/CVE-2020-35490) - [CVE-2020-25649](https://nvd.nist.gov/vuln/detail/CVE-2020-25649) - [CVE-2020-24750](https://nvd.nist.gov/vuln/detail/CVE-2020-24750) - [CVE-2020-24616](https://nvd.nist.gov/vuln/detail/CVE-2020-24616) - [CVE-2020-17516](https://nvd.nist.gov/vuln/detail/CVE-2020-17516) - [CVE-2020-14195](https://nvd.nist.gov/vuln/detail/CVE-2020-14195) - [CVE-2020-14062](https://nvd.nist.gov/vuln/detail/CVE-2020-14062) - [CVE-2020-14061](https://nvd.nist.gov/vuln/detail/CVE-2020-14061) - [CVE-2020-14060](https://nvd.nist.gov/vuln/detail/CVE-2020-14060) - [CVE-2020-10650](https://nvd.nist.gov/vuln/detail/CVE-2020-10650) - [CVE-2019-9674](https://nvd.nist.gov/vuln/detail/CVE-2019-9674) - [CVE-2019-20445](https://nvd.nist.gov/vuln/detail/CVE-2019-20445) - [CVE-2019-20444](https://nvd.nist.gov/vuln/detail/CVE-2019-20444) - [CVE-2019-16869](https://nvd.nist.gov/vuln/detail/CVE-2019-16869) - [CVE-2019-0205](https://nvd.nist.gov/vuln/detail/CVE-2019-0205) - [CVE-2018-1320](https://nvd.nist.gov/vuln/detail/CVE-2018-1320) - [CVE-2017-5929](https://nvd.nist.gov/vuln/detail/CVE-2017-5929) - [CVE-2017-18640](https://nvd.nist.gov/vuln/detail/CVE-2017-18640) - [CVE-2017-17522](https://nvd.nist.gov/vuln/detail/CVE-2017-17522) - [CVE-2016-5397](https://nvd.nist.gov/vuln/detail/CVE-2016-5397) - [CVE-2015-5652](https://nvd.nist.gov/vuln/detail/CVE-2015-5652) |
| **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2023-47108](https://nvd.nist.gov/vuln/detail/CVE-2023-47108) - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) - [CVE-2023-45142](https://nvd.nist.gov/vuln/detail/CVE-2023-45142) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) |
| **N/A** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerabilities: - [CVE-2023-32731](https://nvd.nist.gov/vuln/detail/CVE-2023-32731) - [CVE-2023-1428](https://nvd.nist.gov/vuln/detail/CVE-2023-1428) |
| **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** This addresses the following vulnerabilities: - [CVE-2023-32731](https://nvd.nist.gov/vuln/detail/CVE-2023-32731) - [CVE-2023-1428](https://nvd.nist.gov/vuln/detail/CVE-2023-1428) |
| **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) - [CVE-2023-45142](https://nvd.nist.gov/vuln/detail/CVE-2023-45142) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) |
| **N/A** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerabilities: - [CVE-2023-47108](https://nvd.nist.gov/vuln/detail/CVE-2023-47108) - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) - [CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283) - [CVE-2023-45142](https://nvd.nist.gov/vuln/detail/CVE-2023-45142) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) |
| **N/A** | **Security fixes for `apigee-runtime`.** This addresses the following vulnerabilities: - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-32731](https://nvd.nist.gov/vuln/detail/CVE-2023-32731) - [CVE-2023-1428](https://nvd.nist.gov/vuln/detail/CVE-2023-1428) |
| **N/A** | **Security fixes for `apigee-udca`.** This addresses the following vulnerabilities: - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) - [CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) |

## June 12, 2024

**Apigee X** Announcement On June 12, 2024, we released an updated version of Apigee
Feature **Feature: [Preview](https://cloud.google.com/products/#product-launch-stages) release of Google Cloud-based mock servers for API Management features in Gemini Code Assist.**

This release introduces the ability to easily deploy a Google Cloud-based remote mock server for Gemini Code Assist API management, which allows interaction with the designed API by anyone with access to the mock server, helping with testing and validating the APIs.

For more information and usage instructions, see [Use Gemini Code Assist](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/gemini-code-assist).

## June 11, 2024

**Apigee API hub** Feature **Vertex AI extensions**

You can create [Vertex AI](https://docs.cloud.google.com/vertex-ai/generative-ai/docs/extensions/overview.md.txt) extensions for the APIs registered in API hub. These extensions can be integrated with Large Language Models (LLMs) to process real-time data. For more information, see [Create a Vertex AI extension](https://docs.cloud.google.com/apigee/docs/apihub/vertex-extensions#createextension).
Feature **Eventarc triggers**

API hub is integrated with Google Cloud's [Eventarc](https://docs.cloud.google.com/eventarc/docs.md.txt). You can now create Eventarc triggers to listen for specific events in API hub, and then trigger custom workflows based on the event. For more information, see [Create an Eventarc trigger](https://docs.cloud.google.com/apigee/docs/apihub/quickstart-create-event-triggers.md.txt).
Feature **Multi-level delete**

By default, you can delete an API only if all underlying versions are deleted. Starting with this release, you can use the *force* option to delete an API and its child resources in a single step. For more information, see [Delete an API resource](https://docs.cloud.google.com/apigee/docs/apihub/manage-apis.md.txt#deleteapi).

## June 10, 2024

**Apigee hybrid** v1.11.2 Announcement

### hybrid v1.11.2

On June 10, 2024 we released an updated version of the Apigee hybrid software, 1.11.2.

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.11.2](https://docs.cloud.google.com/apigee/docs/hybrid/v1.11/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.11/big-picture.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **340248314** | **Added support for `targetCPUUtilizationPercentage` to [`apigeeIngressGateway`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.11/config-prop-ref.md.txt#apigeeingressgateway-targetcpuutilizationpercentage) and [`ingressGateways`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.11/config-prop-ref.md.txt#ingressgateways-targetcpuutilizationpercentage) for hybrid installations managed with Helm.** The default value is 75. **Note:** `targetCPUUtilizationPercentage` is not supported for `apigeectl`. |
| **324779388** | **Improved error handling for backup and restore.** |
| **311489774** | **Removed inclusion of Java and Python installations in Cassandra client image.** |
| **300135626** | **Removed inclusion of Java and Python installations in Cassandra Backup Utility image.** |
| **181569113** | **Fixed an issue in new debug session creation.** |

Security

| Bug ID | Description |
|---|---|
| **345520525** | **Security fixes for `apigee-asm-ingress.` and `apigee-asm-istiod`.** This addresses the following vulnerabilities: - [CVE-2024-24557](https://nvd.nist.gov/vuln/detail/CVE-2024-24557) - [CVE-2024-21664](https://nvd.nist.gov/vuln/detail/CVE-2024-21664) - [CVE-2023-6779](https://nvd.nist.gov/vuln/detail/CVE-2023-6779) - [CVE-2023-6246](https://nvd.nist.gov/vuln/detail/CVE-2023-6246) - [CVE-2018-20796](https://nvd.nist.gov/vuln/detail/CVE-2018-20796) |
| **335908139** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerability: - [CVE-2024-0985](https://nvd.nist.gov/vuln/detail/CVE-2024-0985) |
| **333121802** | **Security fixes for `apigee-cassandra-backup-utility.` and `apigee-hybrid-cassandra`.** This addresses the following vulnerability: - [CVE-2023-50782](https://nvd.nist.gov/vuln/detail/CVE-2023-50782) |
| **317528509** | **Security fix for `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2023-34462](https://nvd.nist.gov/vuln/detail/CVE-2023-34462) - [CVE-2023-32732](https://nvd.nist.gov/vuln/detail/CVE-2023-32732) - [CVE-2023-32731](https://nvd.nist.gov/vuln/detail/CVE-2023-32731) - [CVE-2023-1428](https://nvd.nist.gov/vuln/detail/CVE-2023-1428) |
| **317447390** | **Security fix for `apigee-operators`.** This addresses the following vulnerability: - [CVE-2023-48795](https://nvd.nist.gov/vuln/detail/CVE-2023-48795) |
| **329762216** | **Security fix for `apigee-installer`.** This addresses the following vulnerability: - [CVE-2024-24786](https://nvd.nist.gov/vuln/detail/CVE-2024-24786) |
| **308835165** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerability: - [CVE-2023-34462](https://nvd.nist.gov/vuln/detail/CVE-2023-34462) |
| **308926079** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2023-45142](https://nvd.nist.gov/vuln/detail/CVE-2023-45142) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) |
| **300091388** | **Security fixes for Apigee Connect Agent.** This addresses the following vulnerability: - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) |
| **N/A** | **Security fixes for `apigee-cassandra-backup-utility`.** This addresses the following vulnerability: - [CVE-2023-6378](https://nvd.nist.gov/vuln/detail/CVE-2023-6378) - [CVE-2023-49083](https://nvd.nist.gov/vuln/detail/CVE-2023-49083) - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) - [CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-43642](https://nvd.nist.gov/vuln/detail/CVE-2023-43642) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-36632](https://nvd.nist.gov/vuln/detail/CVE-2023-36632) - [CVE-2023-34455](https://nvd.nist.gov/vuln/detail/CVE-2023-34455) - [CVE-2023-34454](https://nvd.nist.gov/vuln/detail/CVE-2023-34454) - [CVE-2023-34453](https://nvd.nist.gov/vuln/detail/CVE-2023-34453) - [CVE-2023-30601](https://nvd.nist.gov/vuln/detail/CVE-2023-30601) - [CVE-2023-2976](https://nvd.nist.gov/vuln/detail/CVE-2023-2976) - [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329) - [CVE-2023-2253](https://nvd.nist.gov/vuln/detail/CVE-2023-2253) - [CVE-2022-48565](https://nvd.nist.gov/vuln/detail/CVE-2022-48565) - [CVE-2022-48560](https://nvd.nist.gov/vuln/detail/CVE-2022-48560) - [CVE-2022-45061](https://nvd.nist.gov/vuln/detail/CVE-2022-45061) - [CVE-2022-42004](https://nvd.nist.gov/vuln/detail/CVE-2022-42004) - [CVE-2022-42003](https://nvd.nist.gov/vuln/detail/CVE-2022-42003) - [CVE-2022-41881](https://nvd.nist.gov/vuln/detail/CVE-2022-41881) - [CVE-2022-34169](https://nvd.nist.gov/vuln/detail/CVE-2022-34169) - [CVE-2022-26488](https://nvd.nist.gov/vuln/detail/CVE-2022-26488) - [CVE-2022-25857](https://nvd.nist.gov/vuln/detail/CVE-2022-25857) - [CVE-2022-21476](https://nvd.nist.gov/vuln/detail/CVE-2022-21476) - [CVE-2022-1471](https://nvd.nist.gov/vuln/detail/CVE-2022-1471) - [CVE-2022-0391](https://nvd.nist.gov/vuln/detail/CVE-2022-0391) - [CVE-2021-44521](https://nvd.nist.gov/vuln/detail/CVE-2021-44521) - [CVE-2021-37137](https://nvd.nist.gov/vuln/detail/CVE-2021-37137) - [CVE-2021-37136](https://nvd.nist.gov/vuln/detail/CVE-2021-37136) - [CVE-2021-28667](https://nvd.nist.gov/vuln/detail/CVE-2021-28667) - [CVE-2021-20190](https://nvd.nist.gov/vuln/detail/CVE-2021-20190) - [CVE-2020-36518](https://nvd.nist.gov/vuln/detail/CVE-2020-36518) - [CVE-2020-36189](https://nvd.nist.gov/vuln/detail/CVE-2020-36189) - [CVE-2020-36188](https://nvd.nist.gov/vuln/detail/CVE-2020-36188) - [CVE-2020-36187](https://nvd.nist.gov/vuln/detail/CVE-2020-36187) - [CVE-2020-36186](https://nvd.nist.gov/vuln/detail/CVE-2020-36186) - [CVE-2020-36185](https://nvd.nist.gov/vuln/detail/CVE-2020-36185) - [CVE-2020-36184](https://nvd.nist.gov/vuln/detail/CVE-2020-36184) - [CVE-2020-36183](https://nvd.nist.gov/vuln/detail/CVE-2020-36183) - [CVE-2020-36182](https://nvd.nist.gov/vuln/detail/CVE-2020-36182) - [CVE-2020-36181](https://nvd.nist.gov/vuln/detail/CVE-2020-36181) - [CVE-2020-36180](https://nvd.nist.gov/vuln/detail/CVE-2020-36180) - [CVE-2020-36179](https://nvd.nist.gov/vuln/detail/CVE-2020-36179) - [CVE-2020-35728](https://nvd.nist.gov/vuln/detail/CVE-2020-35728) - [CVE-2020-35491](https://nvd.nist.gov/vuln/detail/CVE-2020-35491) - [CVE-2020-35490](https://nvd.nist.gov/vuln/detail/CVE-2020-35490) - [CVE-2020-25649](https://nvd.nist.gov/vuln/detail/CVE-2020-25649) - [CVE-2020-24750](https://nvd.nist.gov/vuln/detail/CVE-2020-24750) - [CVE-2020-24616](https://nvd.nist.gov/vuln/detail/CVE-2020-24616) - [CVE-2020-17516](https://nvd.nist.gov/vuln/detail/CVE-2020-17516) - [CVE-2020-14195](https://nvd.nist.gov/vuln/detail/CVE-2020-14195) - [CVE-2020-14062](https://nvd.nist.gov/vuln/detail/CVE-2020-14062) - [CVE-2020-14061](https://nvd.nist.gov/vuln/detail/CVE-2020-14061) - [CVE-2020-14060](https://nvd.nist.gov/vuln/detail/CVE-2020-14060) - [CVE-2020-10650](https://nvd.nist.gov/vuln/detail/CVE-2020-10650) - [CVE-2019-9674](https://nvd.nist.gov/vuln/detail/CVE-2019-9674) - [CVE-2019-20445](https://nvd.nist.gov/vuln/detail/CVE-2019-20445) - [CVE-2019-20444](https://nvd.nist.gov/vuln/detail/CVE-2019-20444) - [CVE-2019-16869](https://nvd.nist.gov/vuln/detail/CVE-2019-16869) - [CVE-2019-0205](https://nvd.nist.gov/vuln/detail/CVE-2019-0205) - [CVE-2018-1320](https://nvd.nist.gov/vuln/detail/CVE-2018-1320) - [CVE-2017-5929](https://nvd.nist.gov/vuln/detail/CVE-2017-5929) - [CVE-2017-18640](https://nvd.nist.gov/vuln/detail/CVE-2017-18640) - [CVE-2017-17522](https://nvd.nist.gov/vuln/detail/CVE-2017-17522) - [CVE-2016-5397](https://nvd.nist.gov/vuln/detail/CVE-2016-5397) - [CVE-2015-5652](https://nvd.nist.gov/vuln/detail/CVE-2015-5652) |
| **N/A** | **Security fixes for `apigee-diagnostics-collector`.** This addresses the following vulnerabilities: - [CVE-2023-36478](https://nvd.nist.gov/vuln/detail/CVE-2023-36478) - [CVE-2023-32731](https://nvd.nist.gov/vuln/detail/CVE-2023-32731) - [CVE-2023-1428](https://nvd.nist.gov/vuln/detail/CVE-2023-1428) |
| **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2023-5869](https://nvd.nist.gov/vuln/detail/CVE-2023-5869) - [CVE-2023-39417](https://nvd.nist.gov/vuln/detail/CVE-2023-39417) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** This addresses the following vulnerabilities: - [CVE-2023-6378](https://nvd.nist.gov/vuln/detail/CVE-2023-6378) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-43642](https://nvd.nist.gov/vuln/detail/CVE-2023-43642) - [CVE-2023-36632](https://nvd.nist.gov/vuln/detail/CVE-2023-36632) - [CVE-2023-34455](https://nvd.nist.gov/vuln/detail/CVE-2023-34455) - [CVE-2023-34454](https://nvd.nist.gov/vuln/detail/CVE-2023-34454) - [CVE-2023-34453](https://nvd.nist.gov/vuln/detail/CVE-2023-34453) - [CVE-2023-30601](https://nvd.nist.gov/vuln/detail/CVE-2023-30601) - [CVE-2023-2976](https://nvd.nist.gov/vuln/detail/CVE-2023-2976) - [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329) - [CVE-2022-48565](https://nvd.nist.gov/vuln/detail/CVE-2022-48565) - [CVE-2022-48560](https://nvd.nist.gov/vuln/detail/CVE-2022-48560) - [CVE-2022-45061](https://nvd.nist.gov/vuln/detail/CVE-2022-45061) - [CVE-2022-42004](https://nvd.nist.gov/vuln/detail/CVE-2022-42004) - [CVE-2022-42003](https://nvd.nist.gov/vuln/detail/CVE-2022-42003) - [CVE-2022-41881](https://nvd.nist.gov/vuln/detail/CVE-2022-41881) - [CVE-2022-34169](https://nvd.nist.gov/vuln/detail/CVE-2022-34169) - [CVE-2022-26488](https://nvd.nist.gov/vuln/detail/CVE-2022-26488) - [CVE-2022-25857](https://nvd.nist.gov/vuln/detail/CVE-2022-25857) - [CVE-2022-21476](https://nvd.nist.gov/vuln/detail/CVE-2022-21476) - [CVE-2022-1471](https://nvd.nist.gov/vuln/detail/CVE-2022-1471) - [CVE-2022-0391](https://nvd.nist.gov/vuln/detail/CVE-2022-0391) - [CVE-2021-44521](https://nvd.nist.gov/vuln/detail/CVE-2021-44521) - [CVE-2021-37137](https://nvd.nist.gov/vuln/detail/CVE-2021-37137) - [CVE-2021-37136](https://nvd.nist.gov/vuln/detail/CVE-2021-37136) - [CVE-2021-28667](https://nvd.nist.gov/vuln/detail/CVE-2021-28667) - [CVE-2021-20190](https://nvd.nist.gov/vuln/detail/CVE-2021-20190) - [CVE-2020-36518](https://nvd.nist.gov/vuln/detail/CVE-2020-36518) - [CVE-2020-36189](https://nvd.nist.gov/vuln/detail/CVE-2020-36189) - [CVE-2020-36188](https://nvd.nist.gov/vuln/detail/CVE-2020-36188) - [CVE-2020-36187](https://nvd.nist.gov/vuln/detail/CVE-2020-36187) - [CVE-2020-36186](https://nvd.nist.gov/vuln/detail/CVE-2020-36186) - [CVE-2020-36185](https://nvd.nist.gov/vuln/detail/CVE-2020-36185) - [CVE-2020-36184](https://nvd.nist.gov/vuln/detail/CVE-2020-36184) - [CVE-2020-36183](https://nvd.nist.gov/vuln/detail/CVE-2020-36183) - [CVE-2020-36182](https://nvd.nist.gov/vuln/detail/CVE-2020-36182) - [CVE-2020-36181](https://nvd.nist.gov/vuln/detail/CVE-2020-36181) - [CVE-2020-36180](https://nvd.nist.gov/vuln/detail/CVE-2020-36180) - [CVE-2020-36179](https://nvd.nist.gov/vuln/detail/CVE-2020-36179) - [CVE-2020-35728](https://nvd.nist.gov/vuln/detail/CVE-2020-35728) - [CVE-2020-35491](https://nvd.nist.gov/vuln/detail/CVE-2020-35491) - [CVE-2020-35490](https://nvd.nist.gov/vuln/detail/CVE-2020-35490) - [CVE-2020-25649](https://nvd.nist.gov/vuln/detail/CVE-2020-25649) - [CVE-2020-24750](https://nvd.nist.gov/vuln/detail/CVE-2020-24750) - [CVE-2020-24616](https://nvd.nist.gov/vuln/detail/CVE-2020-24616) - [CVE-2020-17516](https://nvd.nist.gov/vuln/detail/CVE-2020-17516) - [CVE-2020-14195](https://nvd.nist.gov/vuln/detail/CVE-2020-14195) - [CVE-2020-14062](https://nvd.nist.gov/vuln/detail/CVE-2020-14062) - [CVE-2020-14061](https://nvd.nist.gov/vuln/detail/CVE-2020-14061) - [CVE-2020-14060](https://nvd.nist.gov/vuln/detail/CVE-2020-14060) - [CVE-2020-10650](https://nvd.nist.gov/vuln/detail/CVE-2020-10650) - [CVE-2019-9674](https://nvd.nist.gov/vuln/detail/CVE-2019-9674) - [CVE-2019-20445](https://nvd.nist.gov/vuln/detail/CVE-2019-20445) - [CVE-2019-20444](https://nvd.nist.gov/vuln/detail/CVE-2019-20444) - [CVE-2019-16869](https://nvd.nist.gov/vuln/detail/CVE-2019-16869) - [CVE-2019-0205](https://nvd.nist.gov/vuln/detail/CVE-2019-0205) - [CVE-2018-1320](https://nvd.nist.gov/vuln/detail/CVE-2018-1320) - [CVE-2017-5929](https://nvd.nist.gov/vuln/detail/CVE-2017-5929) - [CVE-2017-18640](https://nvd.nist.gov/vuln/detail/CVE-2017-18640) - [CVE-2017-17522](https://nvd.nist.gov/vuln/detail/CVE-2017-17522) - [CVE-2016-5397](https://nvd.nist.gov/vuln/detail/CVE-2016-5397) - [CVE-2015-5652](https://nvd.nist.gov/vuln/detail/CVE-2015-5652) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2023-49083](https://nvd.nist.gov/vuln/detail/CVE-2023-49083) - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) - [CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-36632](https://nvd.nist.gov/vuln/detail/CVE-2023-36632) - [CVE-2023-30601](https://nvd.nist.gov/vuln/detail/CVE-2023-30601) - [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329) - [CVE-2022-48565](https://nvd.nist.gov/vuln/detail/CVE-2022-48565) - [CVE-2022-48560](https://nvd.nist.gov/vuln/detail/CVE-2022-48560) - [CVE-2022-45061](https://nvd.nist.gov/vuln/detail/CVE-2022-45061) - [CVE-2022-41881](https://nvd.nist.gov/vuln/detail/CVE-2022-41881) - [CVE-2022-34169](https://nvd.nist.gov/vuln/detail/CVE-2022-34169) - [CVE-2022-26488](https://nvd.nist.gov/vuln/detail/CVE-2022-26488) - [CVE-2022-21476](https://nvd.nist.gov/vuln/detail/CVE-2022-21476) - [CVE-2022-0391](https://nvd.nist.gov/vuln/detail/CVE-2022-0391) - [CVE-2021-44521](https://nvd.nist.gov/vuln/detail/CVE-2021-44521) - [CVE-2021-37137](https://nvd.nist.gov/vuln/detail/CVE-2021-37137) - [CVE-2021-37136](https://nvd.nist.gov/vuln/detail/CVE-2021-37136) - [CVE-2021-28667](https://nvd.nist.gov/vuln/detail/CVE-2021-28667) - [CVE-2021-20190](https://nvd.nist.gov/vuln/detail/CVE-2021-20190) - [CVE-2020-36518](https://nvd.nist.gov/vuln/detail/CVE-2020-36518) - [CVE-2020-36189](https://nvd.nist.gov/vuln/detail/CVE-2020-36189) - [CVE-2020-36188](https://nvd.nist.gov/vuln/detail/CVE-2020-36188) - [CVE-2020-36187](https://nvd.nist.gov/vuln/detail/CVE-2020-36187) - [CVE-2020-36186](https://nvd.nist.gov/vuln/detail/CVE-2020-36186) - [CVE-2020-36185](https://nvd.nist.gov/vuln/detail/CVE-2020-36185) - [CVE-2020-36184](https://nvd.nist.gov/vuln/detail/CVE-2020-36184) - [CVE-2020-36183](https://nvd.nist.gov/vuln/detail/CVE-2020-36183) - [CVE-2020-36182](https://nvd.nist.gov/vuln/detail/CVE-2020-36182) - [CVE-2020-36181](https://nvd.nist.gov/vuln/detail/CVE-2020-36181) - [CVE-2020-36180](https://nvd.nist.gov/vuln/detail/CVE-2020-36180) - [CVE-2020-36179](https://nvd.nist.gov/vuln/detail/CVE-2020-36179) - [CVE-2020-35728](https://nvd.nist.gov/vuln/detail/CVE-2020-35728) - [CVE-2020-35491](https://nvd.nist.gov/vuln/detail/CVE-2020-35491) - [CVE-2020-35490](https://nvd.nist.gov/vuln/detail/CVE-2020-35490) - [CVE-2020-25649](https://nvd.nist.gov/vuln/detail/CVE-2020-25649) - [CVE-2020-24750](https://nvd.nist.gov/vuln/detail/CVE-2020-24750) - [CVE-2020-24616](https://nvd.nist.gov/vuln/detail/CVE-2020-24616) - [CVE-2020-17516](https://nvd.nist.gov/vuln/detail/CVE-2020-17516) - [CVE-2020-14195](https://nvd.nist.gov/vuln/detail/CVE-2020-14195) - [CVE-2020-14062](https://nvd.nist.gov/vuln/detail/CVE-2020-14062) - [CVE-2020-14061](https://nvd.nist.gov/vuln/detail/CVE-2020-14061) - [CVE-2020-14060](https://nvd.nist.gov/vuln/detail/CVE-2020-14060) - [CVE-2020-10650](https://nvd.nist.gov/vuln/detail/CVE-2020-10650) - [CVE-2019-20445](https://nvd.nist.gov/vuln/detail/CVE-2019-20445) - [CVE-2019-20444](https://nvd.nist.gov/vuln/detail/CVE-2019-20444) - [CVE-2019-9674](https://nvd.nist.gov/vuln/detail/CVE-2019-9674) - [CVE-2019-0205](https://nvd.nist.gov/vuln/detail/CVE-2019-0205) - [CVE-2018-1320](https://nvd.nist.gov/vuln/detail/CVE-2018-1320) - [CVE-2017-17522](https://nvd.nist.gov/vuln/detail/CVE-2017-17522) - [CVE-2017-5929](https://nvd.nist.gov/vuln/detail/CVE-2017-5929) - [CVE-2016-5397](https://nvd.nist.gov/vuln/detail/CVE-2016-5397) - [CVE-2015-5652](https://nvd.nist.gov/vuln/detail/CVE-2015-5652) |
| **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) - [CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283) - [CVE-2023-45142](https://nvd.nist.gov/vuln/detail/CVE-2023-45142) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) |
| **N/A** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerabilities: - [CVE-2023-32731](https://nvd.nist.gov/vuln/detail/CVE-2023-32731) - [CVE-2023-1428](https://nvd.nist.gov/vuln/detail/CVE-2023-1428) |
| **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** This addresses the following vulnerabilities: - [CVE-2023-32731](https://nvd.nist.gov/vuln/detail/CVE-2023-32731) - [CVE-2023-1428](https://nvd.nist.gov/vuln/detail/CVE-2023-1428) |
| **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) - [CVE-2023-45142](https://nvd.nist.gov/vuln/detail/CVE-2023-45142) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) |
| **N/A** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerabilities: - [CVE-2023-47108](https://nvd.nist.gov/vuln/detail/CVE-2023-47108) - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) - [CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283) - [CVE-2023-45142](https://nvd.nist.gov/vuln/detail/CVE-2023-45142) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) |
| **N/A** | **Security fixes for `apigee-redis`.** This addresses the following vulnerabilities: - [CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283) - [CVE-2022-24834](https://nvd.nist.gov/vuln/detail/CVE-2022-24834) - [CVE-2022-24735](https://nvd.nist.gov/vuln/detail/CVE-2022-24735) |
| **N/A** | **Security fixes for `apigee-runtime`.** This addresses the following vulnerabilities: - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-32731](https://nvd.nist.gov/vuln/detail/CVE-2023-32731) - [CVE-2023-1428](https://nvd.nist.gov/vuln/detail/CVE-2023-1428) |
| **N/A** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-32731](https://nvd.nist.gov/vuln/detail/CVE-2023-32731) - [CVE-2023-1428](https://nvd.nist.gov/vuln/detail/CVE-2023-1428) |
| **N/A** | **Security fixes for `apigee-udca`.** This addresses the following vulnerabilities: - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) - [CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) |
| **N/A** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerabilities: - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) |

## May 31, 2024

**Apigee Integrated Portal** Announcement On May 31, 2024 we released an updated version of Apigee integrated portal.
Feature This release includes the [general availability (GA)](https://cloud.google.com/products/#product-launch-stages) of integrated portal APIs which allow you to manage your integrated portal APIs and reference documentation using API calls. The available functionality has not changed since the [public preview release](https://docs.cloud.google.com/apigee/docs/api-platform/publish/portal/release-notes.md.txt#November_10_2023).

The catalog items list view now uses pagination when making requests to the portals service, examples have been added to **Publishing your APIs**, and new reference documentation is available:

- [Publishing your APIs](https://docs.cloud.google.com/apigee/docs/api-platform/publish/portal/publish-apis.md.txt)
- [API categories reference documentation](https://docs.cloud.google.com/apigee/docs/reference/apis/apigee/rest/v1/organizations.sites.apicategories.md.txt)
- [API documents reference documentation](https://docs.cloud.google.com/apigee/docs/reference/apis/apigee/rest/v1/organizations.sites.apidocs.md.txt)

## May 29, 2024

**Apigee Advanced API Security** Announcement On May 29, 2024 we released a new version of Advanced API Security

NOTE: Rollouts of this feature are ongoing and will take multiple days to complete across all Google Cloud zones. You might not be able to use the functionality until the rollout is complete.
Feature **Preview release of Shadow API Discovery**

This release introduces Shadow API Discovery in [preview](https://cloud.google.com/products/#product-launch-stages). Shadow API Discovery finds shadow APIs (also known as undocumented or unmanaged APIs) in your existing cloud infrastructure. Shadow APIs pose a security risk to your system, since they might be unsecured, unmonitored, and unmaintained.

For a feature overview and usage information, see [Shadow API Discovery](https://docs.cloud.google.com/apigee/docs/api-observation/shadow-api-discovery.md.txt).
**Apigee X** Announcement On May 29, 2024 we released an updated version of Apigee
Feature **[Preview](https://cloud.google.com/products/#product-launch-stages) release of API Management features in Gemini Code Assist: generative AI API spec creation with enterprise context and Apigee policy code explanation. This release also includes the preview release of enhanced API hub interaction in Cloud Code.**

This release introduces features for Gemini Code Assist API management:

- Use Gemini Code Assist to facilitate API design including OpenAPI spec generation with enterprise context from natural language prompts and built in visual API designer to further refine the specification.
- Code explain for Apigee policies: When adding or editing a proxy policy, highlight part of the policy XML code, such as an element or attribute, to see Gemini Assist-generated information and guidance about the selection.

For more information and usage instructions, see [Use Gemini Code Assist](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/gemini-code-assist).

This release also includes updates to API hub interaction from Cloud Code: An update to the Cloud Code extension enables you to interact with any API in your API hub using a mock server in Cloud Code, make changes to the API, and publish it back to API hub. For information and usage instructions, see [Edit APIs](https://docs.cloud.google.com/apigee/docs/api-platform/local-development/vscode/develop-design-edit-apis.md.txt#edit-apis).

## May 28, 2024

**Apigee hybrid** 1.12.0-hotfix.1 Announcement ANNOUNCEMENT

### hybrid 1.12.0-hotfix.1

On May 28, 2024 we released an updated version of the Apigee hybrid software, 1.12.0-hotfix.1.

**Note:** This release reflects a change to the Helm chart templates and not a change to the images. If your hybrid installation is currently on Apigee hybrid v1.12.0, you can install this hotfix release by downloading the charts with the version tag `1.12.0-hotfix.1` and updating the `apigee-operator` and `apigee-datastore` charts with the `helm upgrade` command and your current overrides files.

For example:

    export CHART_REPO=oci://us-docker.pkg.dev/apigee-release/apigee-hybrid-helm-charts
    export CHART_VERSION=1.12.0-hotfix.1
    helm pull $CHART_REPO/apigee-operator --version $CHART_VERSION --untar
    helm pull $CHART_REPO/apigee-datastore --version $CHART_VERSION --untar

    helm upgrade operator apigee-operator/ \
      --namespace apigee-system \
      --atomic \
      -f overrides.yaml 
    helm upgrade datastore apigee-datastore/ \
      --namespace apigee \
      --atomic \
      -f overrides.yaml

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.12.0-hotfix.1](https://docs.cloud.google.com/apigee/docs/hybrid/v1.12/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.12/big-picture.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **340889560** | **Added `csi` to the `apigee-logger` SCC.** |
| **339849002** | **Hashicorp Vault integration issues fixed for Google Service Account for Cassandra Backup/Restore.** |

## May 17, 2024

**Apigee X** Announcement On May 17, 2024, we released an updated version of Apigee (1-12-0-apigee-4-hotfix, 1-12-0-apigee-5).

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Fixed

| Bug ID | Description |
|---|---|
| **337876238, 330314128, 333762214** | **Resolved issues resulting in an increase in `404/503` responses.** Upgraded storage for the Apigee router to the latest version to resolve `404` responses. Adjusted traffic weight and delays in the older replica set to handle traffic divergence during the release process to address any `5xx` responses. |
| **335832119** | **Fixed 404 errors caused during Apigee instance update/rollback.** |
| **255772956** | **Turned off asynchronous services callout when the `<Response>` element is not present due to inconsistent scaling of runtime pods.** |
| **338717278** | **Reverted problematic commit to address thread pool exhaustion.** |

Change Navigation menus in the [Classic Apigee UI](https://apigee.google.com/edge) have been restored to support the transition from the Classic console to [Apigee in the Google Cloud console](https://docs.cloud.google.com/console/apigee).

Each menu item in the Classic console now directs you to the corresponding feature location in the Cloud console where you can carry out your task. Please see [Apigee UI in Cloud console navigation](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/ui-overview.md.txt#console-compare) for more details.
Change **Correction** : Apigee hybrid entitlements are available in Apigee Subscription 2024 plans. For more information, see [Apigee Subscription 2024 entitlements](https://docs.cloud.google.com/apigee/docs/api-platform/reference/subscription-entitlements.md.txt#subscription-2024-entitlements).

## May 16, 2024

**Apigee Integrated Portal** Announcement On May 16, 2024 we released a new version of the Apigee integrated portal.
Feature This release includes general improvements to performance and availability.

## May 14, 2024

**Apigee Advanced API Security** Announcement On May 14, 2024 we released an updated version of Advanced API Security.

NOTE: Rollouts of this feature are ongoing and will take multiple days to complete across all Google Cloud zones. You may not be able to use the functionality until the rollout is complete.
Feature **Addition of autonomous system numbers (ASN), HTTP methods, and region codes as supported security action rule condition types.**

This new functionality is not available with Apigee hybrid at this time.

See [Create a security action](https://docs.cloud.google.com/apigee/docs/api-security/security-actions.md.txt#create-a-security-action) to learn more.

## May 09, 2024

**Apigee Advanced API Security** Announcement On May 9, 2024 we released an updated version of Advanced API Security.
Feature **Addition of CIDR range support when specifying IPv4 addresses for security action rules.**

Apigee Advanced API Security now includes support for CIDR range specification when creating security action rules that restrict access based on IP addresses.

This new functionality is not available with Apigee hybrid at this time.

See [Create a security action](https://docs.cloud.google.com/apigee/docs/api-security/security-actions.md.txt#create-a-security-action) to learn more.
**Apigee X** Issue **Limit on number of basepaths per environment**

Apigee is enforcing a temporary limit of 500 basepaths per environment to avoid potential failures when deploying API proxy revisions.

While this limit is in place, you can deploy up to 500 API proxy revisions (each containing a single basepath) per environment. If your API proxies or revisions contain more than one basepath, the total number of basepaths per environment must not exceed 500.

To track the status of this issue, see [Apigee Known Issues](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt).

## May 08, 2024

**Apigee X** Announcement On May 8, 2024, we released an updated version of Apigee X.
Feature This release contains the [General Availability (GA)](https://cloud.google.com/products/#product-launch-stages) release of AppGroups for Apigee and Apigee hybrid (version 1.10.0 and later).

AppGroups represent a relationship between one or more apps that are managed by the same set of people. For information, see [Using AppGroups to organize app ownership](https://docs.cloud.google.com/apigee/docs/api-platform/publish/organizing-client-app-ownership.md.txt#using-appgroups-to-organize-app-ownership).
Client support for AppGroups is available with the latest Drupal Teams module.

## May 07, 2024

**Apigee X** Feature **Environment-level flag for SSL enforcement**

Apigee customers can specify strict SSL southbound enforcement across an Apigee environment, using the `SSLInfo.Enforce` flag.

If `SSLInfo.Enforce` is set to `true` or `false`, the value specified overrides any granular enforcement options specified in `<SSLInfo>` blocks in TargetEndpoint or TargetServer configurations.

If `SSLInfo.Enforce` is unset, SSL enforcement is determined by any values specified using the `<Enforce>` element within individual `<SSLInfo>` blocks.
For more information, see [TLS/SSL TargetEndpoint configuration](https://cloud.google.com/apigee/docs/api-platform/reference/api-proxy-configuration-reference#tlsssltargetendpointconfiguration).
Feature **Two-way HTTPS health monitor support**

Apigee health monitors using `<HTTPMonitor>` can now use all SSL parameters available in the `<SSLInfo>` block of their TargetServer configurations when performing health checks.

To enable access, set `<UseTargetServerSSLInfo>` to `true` in the `<Request>` block of the HTTPMonitor configuration.

For more information, see [Health monitor using HTTP monitor](https://docs.cloud.google.com/apigee/docs/api-platform/deploy/load-balancing-across-backend-servers.md.txt#healthmonitoring-httpmonitor).
Feature **Target server SSL enforcement**

With this release, Apigee customers can specify strict SSL
southbound enforcement in TargetServer configurations using the object's `enforce` key. If set to `true`, SSL enforcement is applied to service callouts.

The option to specify this behavior is analogous to usage of the `<Enforce>` tag in the `<SSLInfo>` block of the TargetEndpoint configuration.

For more information, see [Configure strict SSL enforcement](https://docs.cloud.google.com/apigee/docs/api-platform/deploy/load-balancing-across-backend-servers.md.txt#configure-strict-ssl-enforcement).
Announcement On May 7, 2024, we released an updated version of Apigee.

## May 06, 2024

**Apigee API hub** Announcement Apigee API hub is available in [preview](https://cloud.google.com/products#product-launch-stages).

With Apigee API hub, you can consolidate and organize critical information about your APIs in one place. Use API hub to accelerate the consistency, use, reuse, and governance of your API portfolio.

Use API hub to:

- Create and manage a complete catalog of your APIs and API resources.
- Add rich attributes to your APIs for tracking, organizing, and filtering.
- Link to one or more Apigee projects to automatically fetch and store Apigee API proxy information.
- Find APIs with powerful free-form semantic search capabilities.
- Track compliance for your API specification files using Linting functionality.

To learn more about the features and functionality available, see [What is Apigee API hub?](https://docs.cloud.google.com/apigee/docs/apihub/what-is-api-hub.md.txt)

**NOTE**: Rollouts of this feature will begin on May 6, 2024, and may take four or more business days to be completed across all Google Cloud zones. You may not be able to provision API hub until the rollout is complete.

## May 01, 2024

**Apigee Integrated Portal** Announcement On May 1, 2024 we released an updated version of Apigee integrated portal.
Security This release contains multiple security fixes.

## April 26, 2024

**Apigee X** Feature **Logging Apigee access logs**

Apigee Subscription and Pay-as-you-go customers can now enable Cloud Logging ingress access logs for each Apigee instance in their organization. Once enabled, this feature allows you to view the logs generated by ingress gateways in your Apigee infrastructure, such as an external Application Load Balancer or an Anthos gateway, to assist in troubleshooting Apigee API calls.

For more information, see [Logging Apigee access logs](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/cloud-logging-ingress-access.md.txt).
Announcement On April 26, 2024, we released an updated version of Apigee.

## April 19, 2024

**Apigee X** Announcement On April 19, 2024, we released an updated version of Apigee.
Feature With this release, Apigee API Management organizations with Subscription 2021 contracts have been upgraded to introduce standard and extensible API proxy features and expanded limits on deployments.

With this upgrade:

- Standard and extensible API proxy calls are counted equally when calculating overall API call entitlement for Subscription 2021 contracts.
- The maximum number of shared flow deployments is 75 per environment.
- There are no limits on the total number of API proxy deployments per environment for Apigee organizations, only limits at the organization level. Limitations on API proxy deployments per environment for hybrid organizations still apply.
- The maximum limit of total deployment units (API proxies or shared flows) per organization is 4250.

**Note**: The fleetwide upgrade is complete for the majority of Subscription 2021 contract organizations. Organization administrators for the remaining 5% of organizations have been contacted by Apigee representatives regarding timelines for the release.

To learn more about:

- Standard and Extensible API Proxy types, see [API Proxy types](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/understanding-apis-and-api-proxies.md.txt#proxy-types).
- Expanded limits for API proxy and shared flow deployments, see [Limits](https://docs.cloud.google.com/apigee/docs/api-platform/reference/limits.md.txt#api-proxies).
- Account level deployment limits, see [Subscription 2021 entitlements](https://docs.cloud.google.com/apigee/docs/api-platform/reference/subscription-entitlements.md.txt#apigee-entitlements).
- Viewing proxy deployment count, see [View proxy deployment usage](https://docs.cloud.google.com/apigee/docs/api-platform/deploy/ui-deploy-overview.md.txt#view-proxy-deployment-usage).
Change Subscription Apigee organizations (without hybrid entitlements) upgraded in this release will see changes to the user experience in the [Classic Apigee UI](https://apigee.google.com/edge). To support management of the upgraded functionality now available to these organizations, a number of feature administration pages are now only available in the [Apigee UI in Cloud console](https://docs.cloud.google.com/console/apigee).

For more information, see [Apigee UI in Cloud console navigation](https://cloud.google.com/apigee/docs/api-platform/fundamentals/ui-overview#console-compare).

## April 17, 2024

**Apigee hybrid** v1.12.0 Announcement

### hybrid v1.12.0

On April 17, 2024 we released an updated version of the Apigee hybrid software, v1.12.0.

For information on upgrading, see [Upgrading Apigee hybrid to version v1.12.0](https://docs.cloud.google.com/apigee/docs/hybrid/v1.12/upgrade.md.txt).
For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.12/big-picture.md.txt).
Feature Apigee hybrid now supports Workload Identity Federation for component authentication on AKS and EKS installations. See [Enabling Workload Identity Federation on AKS and EKS](https://docs.cloud.google.com/apigee/docs/hybrid/v1.12/enable-workload-identity-federation.md.txt).
Feature You can now add your own `contractEncryptionKey` for new Apigee hybrid installations. For details, see [Data encryption](https://docs.cloud.google.com/apigee/docs/hybrid/v1.12/key-encryption.md.txt).
Feature Hybrid v1.12 now supports storing service account keys in Hashicorp Vault. See [Storing service account keys in Hashicorp Vault](https://docs.cloud.google.com/apigee/docs/hybrid/v1.12/storing-sa-keys-in-vault.md.txt).
Feature A new suite of metrics for monitoring Apigee proxies and target endpoints is now available for Hybrid 1.12.
Feature The JAR file dependencies required to create a [Java callout](https://docs.cloud.google.com/apigee/docs/api-platform/develop/how-create-java-callout.md.txt#whatisajavacallout) are now hosted securely in Artifact [Registry](https://docs.cloud.google.com/artifact-registry).

For more information on downloading the JAR dependencies from Artifact Regsitry, see [Compile your code with Maven](https://docs.cloud.google.com/apigee/docs/api-platform/develop/how-create-java-callout.md.txt#hellojavacallout-compileyourcodewithmaven).
Feature Hybrid 1.12 validates required conditions are satisfied before allowing Runtime services to be created. See [Diagnosing issues with guardrails](https://docs.cloud.google.com/apigee/docs/hybrid/v1.12/guardrails.md.txt).
Deprecated The `apigeectl` command-line tool is deprecated. as of April 17, 2024. The `apigeectl` tool is not supported for Apigee hybrid v1.12. Support for `apigeectl` for hybrid v1.10 and v1.11 will end on April 17, 2025. For more information, see [apigeectl deprecation](https://docs.cloud.google.com/apigee/docs/deprecations/apigeectl.md.txt).
Deprecated The `Proxyv2` and `targetv2` metrics suite is deprecated. The Apigee hybrid v1.12 release supports the [new proxy and target metrics](https://docs.cloud.google.com/apigee/docs/api-monitoring/alerts-notifications.md.txt#new-metrics) by default. Support for `Proxyv2` and `targetv2` metrics in hybrid v 1.10 and v1.11 will end on April 17, 2025. For more information, see [ProxyV2 and TargetV2 deprecation](https://docs.cloud.google.com/apigee/docs/deprecations/proxyv2-targetv2-metrics.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **284034011** | **Modified Apigee Watcher and Apigee Ingress to leverage a sidecar instead of pod/exec for collecting ingress routing status.** |
| **298202120** | **The Datastore component now uses Cassandra 4.** |
| **311705715** | **Use a non-default service account for the `remove-dc` component. (Fixed in Apigee hybrid 1.10.3-hotfix.4, 1.10.4, and 1.11.1)** |
| **306341401** | **Fixed regression where virtualhost cipherSuites overrides weren't being used. (Fixed in Apigee hybrid 1.10.4 and 1.11.1)** |
| **302186503** | **Added the missing HTTP proxy template settings to the Apigee Hybrid Helm `datastore` component. (Fixed in Apigee hybrid 1.10.4)** |
| **300542690** | **Added dedicated service accounts for Apigee Connect, Redis, and UDCA to prevent Kubernetes from automatically injecting credentials for a specified Service Account or the default Service Account. (Fixed in Apigee hybrid 1.10.4)** |
| **277353680** | **Fixed issue causing target server HealthMonitors to continue beyond revision or deletion of the proxy.** Target health checks are now terminated as soon as the proxy is removed from the runtime (undeployed or deleted). Note: There may be a delay between removal of the proxy and termination of the target server health checks. (Fixed in Apigee hybrid 1.10.4) |

Security **These security bugs were fixed in Apigee hybrid v1.12.0**

| Bug ID | Description |
|---|---|
| **N/A** | **Security fixes for `apigee-cassandra-backup-utility`** This addresses the following vulnerabilities: - [CVE-2015-5652](https://nvd.nist.gov/vuln/detail/CVE-2015-5652) - [CVE-2016-5397](https://nvd.nist.gov/vuln/detail/CVE-2016-5397) - [CVE-2017-17522](https://nvd.nist.gov/vuln/detail/CVE-2017-17522) - [CVE-2018-1320](https://nvd.nist.gov/vuln/detail/CVE-2018-1320) - [CVE-2019-0205](https://nvd.nist.gov/vuln/detail/CVE-2019-0205) - [CVE-2019-9674](https://nvd.nist.gov/vuln/detail/CVE-2019-9674) - [CVE-2019-20444](https://nvd.nist.gov/vuln/detail/CVE-2019-20444) - [CVE-2019-20445](https://nvd.nist.gov/vuln/detail/CVE-2019-20445) - [CVE-2020-10650](https://nvd.nist.gov/vuln/detail/CVE-2020-10650) - [CVE-2020-17516](https://nvd.nist.gov/vuln/detail/CVE-2020-17516) - [CVE-2021-20190](https://nvd.nist.gov/vuln/detail/CVE-2021-20190) - [CVE-2021-28667](https://nvd.nist.gov/vuln/detail/CVE-2021-28667) - [CVE-2021-37136](https://nvd.nist.gov/vuln/detail/CVE-2021-37136) - [CVE-2021-37137](https://nvd.nist.gov/vuln/detail/CVE-2021-37137) - [CVE-2021-44521](https://nvd.nist.gov/vuln/detail/CVE-2021-44521) - [CVE-2022-0391](https://nvd.nist.gov/vuln/detail/CVE-2022-0391) - [CVE-2022-26488](https://nvd.nist.gov/vuln/detail/CVE-2022-26488) - [CVE-2022-41881](https://nvd.nist.gov/vuln/detail/CVE-2022-41881) - [CVE-2022-45061](https://nvd.nist.gov/vuln/detail/CVE-2022-45061) - [CVE-2022-48560](https://nvd.nist.gov/vuln/detail/CVE-2022-48560) - [CVE-2022-48565](https://nvd.nist.gov/vuln/detail/CVE-2022-48565) - [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329) - [CVE-2023-30601](https://nvd.nist.gov/vuln/detail/CVE-2023-30601) - [CVE-2023-34453](https://nvd.nist.gov/vuln/detail/CVE-2023-34453) - [CVE-2023-34454](https://nvd.nist.gov/vuln/detail/CVE-2023-34454) - [CVE-2023-34455](https://nvd.nist.gov/vuln/detail/CVE-2023-34455) - [CVE-2023-36632](https://nvd.nist.gov/vuln/detail/CVE-2023-36632) - [CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283) - [CVE-2023-49083](https://nvd.nist.gov/vuln/detail/CVE-2023-49083) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`** This addresses the following vulnerabilities: - [CVE-2015-5652](https://nvd.nist.gov/vuln/detail/CVE-2015-5652) - [CVE-2016-5397](https://nvd.nist.gov/vuln/detail/CVE-2016-5397) - [CVE-2017-17522](https://nvd.nist.gov/vuln/detail/CVE-2017-17522) - [CVE-2017-18640](https://nvd.nist.gov/vuln/detail/CVE-2017-18640) - [CVE-2017-5929](https://nvd.nist.gov/vuln/detail/CVE-2017-5929) - [CVE-2018-1320](https://nvd.nist.gov/vuln/detail/CVE-2018-1320) - [CVE-2019-0205](https://nvd.nist.gov/vuln/detail/CVE-2019-0205) - [CVE-2019-16869](https://nvd.nist.gov/vuln/detail/CVE-2019-16869) - [CVE-2019-20444](https://nvd.nist.gov/vuln/detail/CVE-2019-20444) - [CVE-2019-20445](https://nvd.nist.gov/vuln/detail/CVE-2019-20445) - [CVE-2019-9674](https://nvd.nist.gov/vuln/detail/CVE-2019-9674) - [CVE-2020-10650](https://nvd.nist.gov/vuln/detail/CVE-2020-10650) - [CVE-2020-14060](https://nvd.nist.gov/vuln/detail/CVE-2020-14060) - [CVE-2020-14061](https://nvd.nist.gov/vuln/detail/CVE-2020-14061) - [CVE-2020-14062](https://nvd.nist.gov/vuln/detail/CVE-2020-14062) - [CVE-2020-14195](https://nvd.nist.gov/vuln/detail/CVE-2020-14195) - [CVE-2020-17516](https://nvd.nist.gov/vuln/detail/CVE-2020-17516) - [CVE-2020-24616](https://nvd.nist.gov/vuln/detail/CVE-2020-24616) - [CVE-2020-24750](https://nvd.nist.gov/vuln/detail/CVE-2020-24750) - [CVE-2020-25649](https://nvd.nist.gov/vuln/detail/CVE-2020-25649) - [CVE-2020-35490](https://nvd.nist.gov/vuln/detail/CVE-2020-35490) - [CVE-2020-35491](https://nvd.nist.gov/vuln/detail/CVE-2020-35491) - [CVE-2020-35728](https://nvd.nist.gov/vuln/detail/CVE-2020-35728) - [CVE-2020-36179](https://nvd.nist.gov/vuln/detail/CVE-2020-36179) - [CVE-2020-36180](https://nvd.nist.gov/vuln/detail/CVE-2020-36180) - [CVE-2020-36181](https://nvd.nist.gov/vuln/detail/CVE-2020-36181) - [CVE-2020-36182](https://nvd.nist.gov/vuln/detail/CVE-2020-36182) - [CVE-2020-36183](https://nvd.nist.gov/vuln/detail/CVE-2020-36183) - [CVE-2020-36184](https://nvd.nist.gov/vuln/detail/CVE-2020-36184) - [CVE-2020-36185](https://nvd.nist.gov/vuln/detail/CVE-2020-36185) - [CVE-2020-36186](https://nvd.nist.gov/vuln/detail/CVE-2020-36186) - [CVE-2020-36187](https://nvd.nist.gov/vuln/detail/CVE-2020-36187) - [CVE-2020-36188](https://nvd.nist.gov/vuln/detail/CVE-2020-36188) - [CVE-2020-36189](https://nvd.nist.gov/vuln/detail/CVE-2020-36189) - [CVE-2020-36518](https://nvd.nist.gov/vuln/detail/CVE-2020-36518) - [CVE-2021-20190](https://nvd.nist.gov/vuln/detail/CVE-2021-20190) - [CVE-2021-28667](https://nvd.nist.gov/vuln/detail/CVE-2021-28667) - [CVE-2021-37136](https://nvd.nist.gov/vuln/detail/CVE-2021-37136) - [CVE-2021-37137](https://nvd.nist.gov/vuln/detail/CVE-2021-37137) - [CVE-2021-44521](https://nvd.nist.gov/vuln/detail/CVE-2021-44521) - [CVE-2022-0391](https://nvd.nist.gov/vuln/detail/CVE-2022-0391) - [CVE-2022-26488](https://nvd.nist.gov/vuln/detail/CVE-2022-26488) - [CVE-2022-41881](https://nvd.nist.gov/vuln/detail/CVE-2022-41881) - [CVE-2022-45061](https://nvd.nist.gov/vuln/detail/CVE-2022-45061) - [CVE-2022-48560](https://nvd.nist.gov/vuln/detail/CVE-2022-48560) - [CVE-2022-48565](https://nvd.nist.gov/vuln/detail/CVE-2022-48565) - [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329) - [CVE-2023-30601](https://nvd.nist.gov/vuln/detail/CVE-2023-30601) - [CVE-2023-34453](https://nvd.nist.gov/vuln/detail/CVE-2023-34453) - [CVE-2023-34454](https://nvd.nist.gov/vuln/detail/CVE-2023-34454) - [CVE-2023-34455](https://nvd.nist.gov/vuln/detail/CVE-2023-34455) - [CVE-2023-36632](https://nvd.nist.gov/vuln/detail/CVE-2023-36632) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra`** This addresses the following vulnerabilities: - [CVE-2015-5652](https://nvd.nist.gov/vuln/detail/CVE-2015-5652) - [CVE-2016-5397](https://nvd.nist.gov/vuln/detail/CVE-2016-5397) - [CVE-2017-5929](https://nvd.nist.gov/vuln/detail/CVE-2017-5929) - [CVE-2017-17522](https://nvd.nist.gov/vuln/detail/CVE-2017-17522) - [CVE-2017-18640](https://nvd.nist.gov/vuln/detail/CVE-2017-18640) - [CVE-2018-1320](https://nvd.nist.gov/vuln/detail/CVE-2018-1320) - [CVE-2019-0205](https://nvd.nist.gov/vuln/detail/CVE-2019-0205) - [CVE-2019-9674](https://nvd.nist.gov/vuln/detail/CVE-2019-9674) - [CVE-2019-16869](https://nvd.nist.gov/vuln/detail/CVE-2019-16869) - [CVE-2019-20444](https://nvd.nist.gov/vuln/detail/CVE-2019-20444) - [CVE-2019-20445](https://nvd.nist.gov/vuln/detail/CVE-2019-20445) - [CVE-2020-10650](https://nvd.nist.gov/vuln/detail/CVE-2020-10650) - [CVE-2020-14060](https://nvd.nist.gov/vuln/detail/CVE-2020-14060) - [CVE-2020-14061](https://nvd.nist.gov/vuln/detail/CVE-2020-14061) - [CVE-2020-14062](https://nvd.nist.gov/vuln/detail/CVE-2020-14062) - [CVE-2020-14195](https://nvd.nist.gov/vuln/detail/CVE-2020-14195) - [CVE-2020-17516](https://nvd.nist.gov/vuln/detail/CVE-2020-17516) - [CVE-2020-24616](https://nvd.nist.gov/vuln/detail/CVE-2020-24616) - [CVE-2020-24750](https://nvd.nist.gov/vuln/detail/CVE-2020-24750) - [CVE-2020-25649](https://nvd.nist.gov/vuln/detail/CVE-2020-25649) - [CVE-2020-35490](https://nvd.nist.gov/vuln/detail/CVE-2020-35490) - [CVE-2020-35491](https://nvd.nist.gov/vuln/detail/CVE-2020-35491) - [CVE-2020-35728](https://nvd.nist.gov/vuln/detail/CVE-2020-35728) - [CVE-2020-36179](https://nvd.nist.gov/vuln/detail/CVE-2020-36179) - [CVE-2020-36180](https://nvd.nist.gov/vuln/detail/CVE-2020-36180) - [CVE-2020-36181](https://nvd.nist.gov/vuln/detail/CVE-2020-36181) - [CVE-2020-36182](https://nvd.nist.gov/vuln/detail/CVE-2020-36182) - [CVE-2020-36183](https://nvd.nist.gov/vuln/detail/CVE-2020-36183) - [CVE-2020-36184](https://nvd.nist.gov/vuln/detail/CVE-2020-36184) - [CVE-2020-36185](https://nvd.nist.gov/vuln/detail/CVE-2020-36185) - [CVE-2020-36186](https://nvd.nist.gov/vuln/detail/CVE-2020-36186) - [CVE-2020-36187](https://nvd.nist.gov/vuln/detail/CVE-2020-36187) - [CVE-2020-36188](https://nvd.nist.gov/vuln/detail/CVE-2020-36188) - [CVE-2020-36189](https://nvd.nist.gov/vuln/detail/CVE-2020-36189) - [CVE-2020-36518](https://nvd.nist.gov/vuln/detail/CVE-2020-36518) - [CVE-2021-20190](https://nvd.nist.gov/vuln/detail/CVE-2021-20190) - [CVE-2021-28667](https://nvd.nist.gov/vuln/detail/CVE-2021-28667) - [CVE-2021-37136](https://nvd.nist.gov/vuln/detail/CVE-2021-37136) - [CVE-2021-37137](https://nvd.nist.gov/vuln/detail/CVE-2021-37137) - [CVE-2021-44521](https://nvd.nist.gov/vuln/detail/CVE-2021-44521) - [CVE-2022-0391](https://nvd.nist.gov/vuln/detail/CVE-2022-0391) - [CVE-2022-26488](https://nvd.nist.gov/vuln/detail/CVE-2022-26488) - [CVE-2022-41881](https://nvd.nist.gov/vuln/detail/CVE-2022-41881) - [CVE-2022-45061](https://nvd.nist.gov/vuln/detail/CVE-2022-45061) - [CVE-2022-48560](https://nvd.nist.gov/vuln/detail/CVE-2022-48560) - [CVE-2022-48565](https://nvd.nist.gov/vuln/detail/CVE-2022-48565) - [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329) - [CVE-2023-30601](https://nvd.nist.gov/vuln/detail/CVE-2023-30601) - [CVE-2023-34453](https://nvd.nist.gov/vuln/detail/CVE-2023-34453) - [CVE-2023-34454](https://nvd.nist.gov/vuln/detail/CVE-2023-34454) - [CVE-2023-34455](https://nvd.nist.gov/vuln/detail/CVE-2023-34455) - [CVE-2023-36632](https://nvd.nist.gov/vuln/detail/CVE-2023-36632) - [CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283) - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) - [CVE-2023-49083](https://nvd.nist.gov/vuln/detail/CVE-2023-49083) |
| **N/A** | **Security fixes for `apigee-kube-rbac-proxy`** This addresses the following vulnerabilities: - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-45142](https://nvd.nist.gov/vuln/detail/CVE-2023-45142) - [CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283) - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) |
| **N/A** | **Security fixes for `apigee-prometheus-adapter`** This addresses the following vulnerability: - [CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283) |
| **N/A** | **Security fixes for `apigee-udca`** This addresses the following vulnerabilities: - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283) - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) |
| **N/A** | **Security fixes for `apigee-watcher`** This addresses the following vulnerability: - [CVE-2023-45287](https://nvd.nist.gov/vuln/detail/CVE-2023-45287) |
| **N/A** | **Security fixes for `apigee-connect-agent`** This addresses the following vulnerability: - [CVE-2023-45283](https://nvd.nist.gov/vuln/detail/CVE-2023-45283) |
| **N/A** | **Security fixes for `apigee-fluent-bit`** This addresses the following vulnerabilities: - [CVE-2015-3276](https://nvd.nist.gov/vuln/detail/CVE-2015-3276) - [CVE-2019-1010022](https://nvd.nist.gov/vuln/detail/CVE-2019-1010022) - [CVE-2023-39417](https://nvd.nist.gov/vuln/detail/CVE-2023-39417) - [CVE-2023-5869](https://nvd.nist.gov/vuln/detail/CVE-2023-5869) |

Security **These security bugs were fixed in Apigee hybrid v1.11.1.**

| Bug ID | Description |
|---|---|
| **315034009** | **Security fixes: `apigee-asm-ingress` and `apigee-asm-istiod` (`ingressgateway` and `ingressgateway-controller`) are upgraded to Service Mesh version 1.17.8-asm.4.** This addresses the following vulnerabilities: - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-4806](https://nvd.nist.gov/vuln/detail/CVE-2023-4806) (`apigee-asm-ingress` only) - [CVE-2023-4911](https://nvd.nist.gov/vuln/detail/CVE-2023-4911) (`apigee-asm-ingress` only) - [CVE-2023-4813](https://nvd.nist.gov/vuln/detail/CVE-2023-4813) (`apigee-asm-ingress` only) - [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) |
| **303460289** | **Security fixes to `apigee-prometheus-adapter`.** This addresses the following vulnerabilities: - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) - [CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406) - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) |
| **303459588** | **Security fixes to `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2023-45142](https://nvd.nist.gov/vuln/detail/CVE-2023-45142) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-40577](https://nvd.nist.gov/vuln/detail/CVE-2023-40577) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) - [CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406) - [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) - [CVE-2023-2253](https://nvd.nist.gov/vuln/detail/CVE-2023-2253) |
| **303292806** | **Restrict connections from the Cassandra backup utility to Cassandra server pods in the `apigee` namespace.** |
| **N/A** | **Security fixes to `apigee-cassandra-backup-utility`.** This addresses the following vulnerabilities: - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) |
| **N/A** | **Security fixes to `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2023-36054](https://nvd.nist.gov/vuln/detail/CVE-2023-36054) - [CVE-2023-4911](https://nvd.nist.gov/vuln/detail/CVE-2023-4911) - [CVE-2023-3817](https://nvd.nist.gov/vuln/detail/CVE-2023-3817) - [CVE-2023-3446](https://nvd.nist.gov/vuln/detail/CVE-2023-3446) |
| **N/A** | **Security fixes to `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) - [CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406) - [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) |
| **N/A** | **Security fixes to `apigee-hybrid-cassandra-client`.** This addresses the following vulnerabilities: - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39326](https://nvd.nist.gov/vuln/detail/CVE-2023-39326) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) - [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) |
| **N/A** | **Security fixes to `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) - [CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406) - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) |
| **N/A** | **Security fixes to `apigee-installer`, `apigee-operators`, and `apigee-watcher`.** This addresses the following vulnerabilities: - [CVE-2023-48795](https://nvd.nist.gov/vuln/detail/CVE-2023-48795) (`apigee-operators` only) - [CVE-2023-45287](https://nvd.nist.gov/vuln/detail/CVE-2023-45287) (`apigee-operators` and `apigee-watcher`) - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39326](https://nvd.nist.gov/vuln/detail/CVE-2023-39326) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) (`apigee-operators` and `apigee-watcher`) |

Security **These security bugs were fixed in Apigee hybrid v1.10.4.**

| Bug ID | Description |
|---|---|
| **315034009** | **Security fixes: `apigee-asm-ingress` and `apigee-asm-istiod` (`ingressgateway` and `ingressgateway-controller`) are upgraded to Service Mesh version 1.17.8-asm.4.** This addresses the following vulnerabilities: - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) - [CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406) - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2023-28842](https://nvd.nist.gov/vuln/detail/CVE-2023-28842) - [CVE-2023-28841](https://nvd.nist.gov/vuln/detail/CVE-2023-28841) - [CVE-2023-28840](https://nvd.nist.gov/vuln/detail/CVE-2023-28840) - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2023-4911](https://nvd.nist.gov/vuln/detail/CVE-2023-4911) (`apigee-asm-ingress` only) - [CVE-2023-4813](https://nvd.nist.gov/vuln/detail/CVE-2023-4813) (`apigee-asm-ingress` only) - [CVE-2023-4806](https://nvd.nist.gov/vuln/detail/CVE-2023-4806) (`apigee-asm-ingress` only) - [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) - [CVE-2023-2253](https://nvd.nist.gov/vuln/detail/CVE-2023-2253) |
| **311167948** | **A security issue was addressed.** |
| **303460289** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerabilities: - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) - [CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406) - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) |
| **303459588** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2023-45142](https://nvd.nist.gov/vuln/detail/CVE-2023-45142) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-40577](https://nvd.nist.gov/vuln/detail/CVE-2023-40577) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) - [CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406) - [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) - [CVE-2023-2253](https://nvd.nist.gov/vuln/detail/CVE-2023-2253) |
| **300319489** | **Security fixes for `fluentd`.** This addresses the following vulnerabilities: - [CVE-2023-36617](https://nvd.nist.gov/vuln/detail/CVE-2023-36617) - [CVE-2023-32732](https://nvd.nist.gov/vuln/detail/CVE-2023-32732) - [CVE-2023-32731](https://nvd.nist.gov/vuln/detail/CVE-2023-32731) - [CVE-2023-28755](https://nvd.nist.gov/vuln/detail/CVE-2023-28755) - [CVE-2023-1428](https://nvd.nist.gov/vuln/detail/CVE-2023-1428) - [CVE-2022-39379](https://nvd.nist.gov/vuln/detail/CVE-2022-39379) - [CVE-2022-31163](https://nvd.nist.gov/vuln/detail/CVE-2022-31163) - [CVE-2022-3171](https://nvd.nist.gov/vuln/detail/CVE-2022-3171) - [CVE-2021-43809](https://nvd.nist.gov/vuln/detail/CVE-2021-43809) - [CVE-2021-41186](https://nvd.nist.gov/vuln/detail/CVE-2021-41186) - [CVE-2021-33621](https://nvd.nist.gov/vuln/detail/CVE-2021-33621) - [CVE-2020-36327](https://nvd.nist.gov/vuln/detail/CVE-2020-36327) - [CVE-2020-10663](https://nvd.nist.gov/vuln/detail/CVE-2020-10663) |
| **294892189** | **Security fixes for `apigee-diagnostics-collector`.** This addresses the Guava vulnerability: - [CVE-2023-2976](https://nvd.nist.gov/vuln/detail/CVE-2023-2976) |
| **N/A** | **Security fixes for `apigee-cassandra-backup-utility` and `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) - [CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406) (`apigee-prom-prometheus` only) - [CVE-2023-2253](https://nvd.nist.gov/vuln/detail/CVE-2023-2253) (`apigee-prom-prometheus` only) |
| **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2023-36054](https://nvd.nist.gov/vuln/detail/CVE-2023-36054) - [CVE-2023-3446](https://nvd.nist.gov/vuln/detail/CVE-2023-3446) - [CVE-2023-4911](https://nvd.nist.gov/vuln/detail/CVE-2023-4911) - [CVE-2023-3817](https://nvd.nist.gov/vuln/detail/CVE-2023-3817) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra` and `apigee-hybrid-cassandra-client`.** This addresses the following vulnerabilities: - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) (`apigee-hybrid-cassandra-client` only) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39326](https://nvd.nist.gov/vuln/detail/CVE-2023-39326) (`apigee-hybrid-cassandra-client` only) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) - [CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406) (`apigee-hybrid-cassandra` only) - [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) |
| **N/A** | **Security fixes for `apigee-installer`, `apigee-operators`, and `apigee-watcher`.** This addresses the following vulnerabilities: - [CVE-2023-45287](https://nvd.nist.gov/vuln/detail/CVE-2023-45287) ( `apigee-operators` and `apigee-watcher` only) - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39326](https://nvd.nist.gov/vuln/detail/CVE-2023-39326) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) ( `apigee-operators` and `apigee-watcher` only) |
| **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) - [CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406) - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) |

Security **These security bugs were fixed in Apigee hybrid v1.10.4-hotfix.1.**

| Bug ID | Description |
|---|---|
| **324460830** | **Security fix for apigee-ingress.** This addresses the following vulnerabilities: - [CVE-2024-23327](https://nvd.nist.gov/vuln/detail/CVE-2024-23327) - [CVE-2024-23325](https://nvd.nist.gov/vuln/detail/CVE-2024-23325) - [CVE-2024-23324](https://nvd.nist.gov/vuln/detail/CVE-2024-23324) - [CVE-2024-23323](https://nvd.nist.gov/vuln/detail/CVE-2024-23323) - [CVE-2024-23322](https://nvd.nist.gov/vuln/detail/CVE-2024-23322) |

Security **These security bugs were fixed in Apigee hybrid v1.11.1-hotfix.1.**

| Bug ID | Description |
|---|---|
| **324460830** | **Security fix for apigee-ingress.** This addresses the following vulnerabilities: - [CVE-2024-23327](https://nvd.nist.gov/vuln/detail/CVE-2024-23327) - [CVE-2024-23325](https://nvd.nist.gov/vuln/detail/CVE-2024-23325) - [CVE-2024-23324](https://nvd.nist.gov/vuln/detail/CVE-2024-23324) - [CVE-2024-23323](https://nvd.nist.gov/vuln/detail/CVE-2024-23323) - [CVE-2024-23322](https://nvd.nist.gov/vuln/detail/CVE-2024-23322) |

## April 15, 2024

**Apigee X** Fixed

| Bug ID | Description |
|---|---|
| **332981542** | **Optimized VerifyAPI policy execution time for high count of API products.** |

Announcement On April 15, 2024, we released an updated version of Apigee (1-12-0-apigee-4).

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

## April 03, 2024

**Apigee X** Feature With this release, Apigee expanded its support for data residency to additional regions in Asia-Pacific and the Middle East. Data residency for Apigee meets compliance and regulatory requirements by allowing you to specify the geographic locations (regions) where Apigee data is stored.

For more information, see [Introduction to data residency](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/drz-concepts.md.txt).

For a list of supported geographic locations, see [Apigee locations](https://docs.cloud.google.com/apigee/docs/locations.md.txt).
Announcement On April 3, 2024, we released an updated version of Apigee.

## April 02, 2024

**Apigee X** Announcement On April 2, 2024, we announced an increase in the rate limits for the [Spike Arrest](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/spike-arrest-policy.md.txt) policy.

The limit on the rate you can specify increased from 1,000 requests per second, 60,000 requests per minute to 4,000 requests per second, 240,000 requests per minute.

See the [Spike Arrest section of the Limits page](https://docs.cloud.google.com/apigee/docs/api-platform/reference/limits.md.txt#spikearrest) for information on Spike Arrest limits.

## April 01, 2024

**Apigee X** Announcement On April 1, 2024, we released an updated version of Apigee.
Feature With this release, Apigee expanded its support for data residency to additional regions in Canada. Data residency for Apigee meets compliance and regulatory requirements by allowing you to specify the geographic locations (regions) where Apigee data is stored.

For more information, see [Introduction to data residency](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/drz-concepts.md.txt).

For a list of supported geographic locations, see [Apigee locations](https://docs.cloud.google.com/apigee/docs/locations.md.txt).

## March 29, 2024

**Apigee X** Announcement On March 29, 2024, we released an updated version of Apigee (1-12-0-apigee-2).

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Feature With this release, Apigee expanded its support for data residency to additional regions in the European Union. Data residency for Apigee meets compliance and regulatory requirements by allowing you to specify the geographic locations (regions) where Apigee data is stored.

For more information, see [Introduction to data residency](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/drz-concepts.md.txt).

For a list of supported geographic locations, see [Apigee locations](https://docs.cloud.google.com/apigee/docs/locations.md.txt).
Feature **New Apigee API Monitoring Metrics**

An new suite of metrics for monitoring Apigee proxies and target endpoints is now available. With improved scalability and accuracy, the new suite can support large workloads and withstand underlying infrastructure changes.

Apigee's [API Monitoring](https://docs.cloud.google.com/apigee/docs/api-monitoring.md.txt) tables and dashboards have been updated to include the following new metrics, which can be used to [configure alerts](https://docs.cloud.google.com/apigee/docs/api-monitoring/alerts-notifications.md.txt#metrics-and-filters) and [create custom dashboards](https://docs.cloud.google.com/monitoring/charts/dashboards.md.txt#create-custom-dashboard):

    proxy/request_count
    proxy/response_count
    proxy/latencies
    target/request_count
    target/response_count
    target/latencies

Fixed

| Bug ID | Description |
|---|---|
| **322843888** | **Fixed issue with incorrect proxy routing when using base paths in proxy chaining.** |
| **293933387** | **KVM `list` operation now permits entries with `null` or empty values.** |
| **239523766** | **Removed `Unable to evaluate jsonVariable, returning null` error string from ExtractVariable Policy logging.** |
| **285592278** | **Fixed issue with deduction of recurring fees from prepaid balances.** |
| **237656263** | **Resolved issue with async mode in the ServiceCallout policy when the `<Response>` element is removed.** This note is incorrect; this fix is not included in this release. |
| **321744310** | **Added support for caching JSON results retrieved from the ExtractVariables policy.** |
| **295341973** | **Resolved issue causing delay in updating southbound SSL certificates in truststore and keystore references.** |

## March 28, 2024

**Apigee Integrated Portal** Announcement On March 28, 2024 we released an updated version of Apigee integrated portal.
Fixed

| Bug ID | Description |
|---|---|
| **324872865** | **Fixed scrolling issue with API documentation display when navigating to the overview page.** |

## March 26, 2024

**Apigee X** Feature **New Apigee API Monitoring Metrics**

An new suite of metrics for monitoring Apigee proxies and target endpoints is now available. With improved scalability and accuracy, the new suite can support large workloads and withstand underlying infrastructure changes.

Apigee's [API Monitoring](https://docs.cloud.google.com/apigee/docs/api-monitoring.md.txt) tables and dashboards have been updated to include the following new metrics, which can be used to [configure alerts](https://docs.cloud.google.com/apigee/docs/api-monitoring/alerts-notifications.md.txt#metrics-and-filters) and [create custom dashboards](https://docs.cloud.google.com/monitoring/charts/dashboards.md.txt#create-custom-dashboard):

    proxy/request_count
    proxy/response_count
    proxy/latencies
    target/request_count
    target/response_count
    target/latencies

Announcement On March 26, 2024, we released an updated version of Apigee (1-12-0-apigee-1).

> [!NOTE]
> **Note:** This release was rolled back to address an issue. See entry for [March 29, 2024](https://docs.cloud.google.com/apigee/docs/release-notes.md.txt#March_29_2024) for the updated version number and payload.

Fixed

| Bug ID | Description |
|---|---|
| **322843888** | **Fixed issue with incorrect proxy routing when using base paths in proxy chaining.** |
| **293933387** | **KVM `list` operation now permits entries with `null` or empty values.** |
| **239523766** | **Removed `Unable to evaluate jsonVariable, returning null` error string from ExtractVariable Policy logging.** |
| **285592278** | **Fixed issue with deduction of recurring fees from prepaid balances.** |
| **237656263** | **Resolved issue with async mode in the ServiceCallout policy when the `<Response>` element is removed.** This note is incorrect; this fix is not included in this release. |
| **321744310** | **Added support for caching JSON results retrieved from the ExtractVariables policy.** |
| **295341973** | **Resolved issue causing delay in updating southbound SSL certificates in truststore and keystore references.** |

## March 14, 2024

**Apigee UI** Announcement On March 14, 2024 we released an updated version of the Apigee UI.
Fixed

| Bug ID | Description |
|---|---|
| **320739232** | **An issue was fixed where an incorrect error message was displayed after an API proxy or shared flow was undeployed.** |

## March 13, 2024

**Apigee X** Announcement As of March 13, 2024, the conversion of Apigee API Management organizations with Pay-as-you-go pricing provisioned **before** October 1, 2023, to [Pay-as-you-go organizations that use updated attributes](https://docs.cloud.google.com/apigee/docs/api-platform/reference/pay-as-you-go-updated-overview.md.txt) for pricing is complete, with the exception of one organization that requires customer action.

The [Apigee API Analytics add-on](https://docs.cloud.google.com/apigee/docs/api-platform/reference/manage-analytics-add-on.md.txt) is enabled in converted organizations.The Analytics add-on can be [disabled](https://docs.cloud.google.com/apigee/docs/api-platform/reference/manage-analytics-add-on.md.txt#disable-the-apigee-api-analytics-add-on) if it is not required. In addition, you can [update your Pay-as-you-go environment types using the API](https://docs.cloud.google.com/apigee/docs/api-platform/reference/update-environment-types.md.txt#update-your-environment-type-using-the-api).

For more information on the updated pricing and enhanced features now available for these organizations, see [Pay-as-you-go (updated attributes) overview](https://docs.cloud.google.com/apigee/docs/api-platform/reference/pay-as-you-go-updated-overview.md.txt).

Updated pricing attributes will be reflected in March invoices. For billing questions related to this change, contact [Google Cloud Billing support](https://docs.cloud.google.com/support/billing).

## March 04, 2024

**Apigee Advanced API Security** Announcement On March 4, 2024 we released an updated version of Advanced API Security.
Feature **New conditions for security actions**

You can now create [security actions](https://docs.cloud.google.com/apigee/docs/api-security/security-actions.md.txt) based on the following condition types (in addition to the condition types for Detection rules and IP addresses that were already available):

- API keys
- API products
- Access tokens
- Developers
- Developer apps
- User agents

**These new conditions are not available with Apigee hybrid at this time.**

See [Create a security action](https://docs.cloud.google.com/apigee/docs/api-security/security-actions.md.txt#create-a-security-action) to learn more.

## February 12, 2024

**Apigee X** Announcement On February 12, 2024, we released an updated version of Apigee (1-11-0-apigee-17).

This release addresses the security concerns in [GCP-2024-007 from Google Anthos Service Mesh](https://docs.cloud.google.com/support/bulletins.md.txt#gcp-2024-007).

> [!NOTE]
> **Note:** Rollouts of this release to production instances began on February 12 and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Security

| Bug ID | Description |
|---|---|
| **322389251** | **Security fix for apigee-ingress.** This addresses the following vulnerabilities: - [CVE-2024-23327](https://nvd.nist.gov/vuln/detail/CVE-2024-23327) - [CVE-2024-23325](https://nvd.nist.gov/vuln/detail/CVE-2024-23325) - [CVE-2024-23324](https://nvd.nist.gov/vuln/detail/CVE-2024-23324) - [CVE-2024-23323](https://nvd.nist.gov/vuln/detail/CVE-2024-23323) - [CVE-2024-23322](https://nvd.nist.gov/vuln/detail/CVE-2024-23322) |

Fixed

| Bug ID | Description |
|---|---|
| **230082910** | **Fixed issue causing `null` values for `system.timestamp` and `system.time.millisecond` proxy variables.** |

This note is incorrect; this fix is not included in this release.

\| **285592278** \| **Fixed issue with deduction of recurring fees from prepaid balances.**

This note is incorrect; see entry for [March 26, 2024](https://docs.cloud.google.com/apigee/docs/release/release-notes.md.txt#March_26_2024).

## February 09, 2024

**Apigee hybrid** 1.10.4-hotfix.1 Announcement

### hybrid 1.10.4-hotfix.1

On February 9, 2024 we released an updated version of the Apigee hybrid software, v1.10.4-hotfix.1.

This release addresses the security concerns in [GCP-2024-007 from Google Anthos Service Mesh](https://docs.cloud.google.com/support/bulletins.md.txt#gcp-2024-007).

- To install the hotfix, follow the instructions in [Upgrading Apigee hybrid to version 1.10](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/upgrade.md.txt#install-hotfix-1).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/big-picture.md.txt).

> [!NOTE]
> **Note:** This hotfix installs the `apigee-ingress` container image. All other container images are unchanged from Hybrid v1.10.4.

Security

| Bug ID | Description |
|---|---|
| **324460830** | **Security fix for apigee-ingress.** This addresses the following vulnerabilities: - [CVE-2024-23327](https://nvd.nist.gov/vuln/detail/CVE-2024-23327) - [CVE-2024-23325](https://nvd.nist.gov/vuln/detail/CVE-2024-23325) - [CVE-2024-23324](https://nvd.nist.gov/vuln/detail/CVE-2024-23324) - [CVE-2024-23323](https://nvd.nist.gov/vuln/detail/CVE-2024-23323) - [CVE-2024-23322](https://nvd.nist.gov/vuln/detail/CVE-2024-23322) |

1.11.1-hotfix.1 Announcement

### hybrid 1.11.1-hotfix.1

On February 9, 2024 we released an updated version of the Apigee hybrid software, v1.11.1-hotfix.1.

This release addresses the security concerns in [GCP-2024-007 from Google Anthos Service Mesh](https://docs.cloud.google.com/support/bulletins.md.txt#gcp-2024-007).

- To install the hotfix, follow the instructions in [Upgrading Apigee hybrid to version 1.11](https://docs.cloud.google.com/apigee/docs/hybrid/v1.11/upgrade.md.txt#install-hotfix-1).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.11/big-picture.md.txt).

> [!NOTE]
> **Note:** This hotfix installs the `apigee-ingress` container image. All other container images are unchanged from Hybrid v1.11.1.

## February 08, 2024

**Apigee X** Announcement On February 8, 2024 we released an updated version of the Apigee APIs.
Feature **API support for update operations on KeyValueMap entries**

Starting with this release, the Apigee APIs support update operations for KeyValueMap entries. See the API reference page for [REST Resource: organizations.environments.keyvaluemaps.entries](https://docs.cloud.google.com/apigee/docs/reference/apis/apigee/rest/v1/organizations.environments.keyvaluemaps.entries.md.txt) for information.

## February 07, 2024

**Apigee Integrated Portal** Announcement On February 07, 2024 we released an updated version of Apigee integrated portal.
Fixed

| Bug ID | Description |
|---|---|
| **323278335** | **A security issue was fixed.** |
| **192987085** | **Fixed an issue where switching API spec pages in the public developer portal resulted in an error. Note, this issue was erroneously mentioned in the 12/7/23 release notes.** |

## February 02, 2024

**Apigee X** Announcement On February 2, 2024, we released an updated version of Apigee.

> [!NOTE]
> **Note:** Rollouts of this release to production instances began on February 2 and may take up to four business days before it is available across all regions.

Feature We modified or added these limits:

- Changed the maximum API proxy endpoints per API proxy from 5 to 10
- Specified the maximum API base paths per organization as 21,250

See the [Limits page](https://docs.cloud.google.com/apigee/docs/api-platform/reference/limits.md.txt) for details.

## February 01, 2024

**Apigee X** Announcement On February 1, 2024, we released an updated version of Apigee.

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin on February 1 and will be complete for all organizations by the end of February.

With this release, Apigee API Management organizations with Pay-as-you-go pricing provisioned **before** October 1, 2023, will be converted to [Pay-as-you-go organizations that use updated attributes](https://docs.cloud.google.com/apigee/docs/api-platform/reference/pay-as-you-go-updated-overview.md.txt) for pricing.

Prior to the conversion, these organizations were billed for API runtimes based on [Apigee gateway node usage](https://docs.cloud.google.com/apigee/docs/api-platform/reference/pay-as-you-go#how-does-apigee-pay-as-you-go-pricing-work) and the total number of API requests processed by [Apigee analytics](https://docs.cloud.google.com/apigee/docs/api-platform/reference/pay-as-you-go#how-does-apigee-pay-as-you-go-pricing-work).

Once converted, these organizations will be billed for the following:

- Volume of API calls processed by a given proxy type
- Usage of deployment environments (per hour per region)
- Usage of additional deployment units (API proxies or shared flows)
- Any additional add-on capabilities (Advanced API security, Monetization, Analytics)

The conversion process is expected to last about 5 minutes and traffic will continue to be processed normally during this time. If proxy revision deployments are interrupted during this time frame, revisions can be deployed after conversion completes.

The [Apigee API Analytics add-on](https://docs.cloud.google.com/apigee/docs/api-platform/reference/manage-analytics-add-on.md.txt) will be enabled by default in converted organizations.The Analytics add-on can be [disabled](https://docs.cloud.google.com/apigee/docs/api-platform/reference/manage-analytics-add-on.md.txt#disable-the-apigee-api-analytics-add-on) after the pricing change if it is not required.

For more information on the updated pricing and enhanced features now available for these organizations, see [Pay-as-you-go (updated attributes) overview](https://docs.cloud.google.com/apigee/docs/api-platform/reference/pay-as-you-go-updated-overview.md.txt).

Updated pricing attributes will be reflected in March invoices. For billing questions related to this change, contact [Google Cloud Billing support](https://docs.cloud.google.com/support/billing).

## January 23, 2024

**Apigee UI** Announcement On January 23, 2024 we released an updated version of the Apigee UI.
Fixed

| Bug ID | Description |
|---|---|
| **317739341** | In some cases the navigation menu for Monetization was hidden when Monetization was enabled in the Apigee organization. This has been fixed. |

## January 22, 2024

**Apigee Integrated Portal** Fixed

| Bug ID | Description |
|---|---|
| **311491188** | API requests to add a category to a catalog item now validate that the category ID exists. |

Announcement On January 22, 2024 we released an updated version of Apigee integrated portal.
**Apigee X** Fixed

| Bug ID | Description |
|---|---|
| **316093865** | **Fixed issue where empty `LoadBalancer` configuration in the Target Endpoint results in a failed proxy deployment with `NullPointerException`.** |
| **312966965** | **Resolved proxy chaining issue resulting in incorrect post-target service callout hostnames.** |
| **318909276** | **Fixed issue withLookupCache policy failures under certain circumstances.** |
| **262071551** | **Resolved issue with the use of combinators such as `allOf` in the OASValidation Policy.** |
| **311049371** | **Resolved issue causing SSL error in proxy chaining and path chaining flows.** |
| **308196929** | **Use of `target.header.host` flow variable with gRPC targets is now fixed.** |

Announcement On January 22, 2023, we released an updated version of Apigee (1-11-0-apigee-14).

**Note**: Rollouts of this release to production instances will begin within two business days and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

## January 16, 2024

**Apigee Advanced API Security** Announcement On January 16, 2024 we released an updated version of Advanced API Security.
Feature **Training machine learning models for abuse detection on your data**

You now have the option to allow Apigee to [train your organization's machine learning models for abuse detection on your data](https://docs.cloud.google.com/apigee/docs/api-security/abuse-detection.md.txt#help-improve-your-machine-learning-models-for-abuse-detection). Training the models on your data helps improve their accuracy for detecting security incidents.

## December 21, 2023

**Apigee hybrid** v1.11.1 Announcement

### hybrid v1.11.1

On December 21, 2023 we released an updated version of the Apigee hybrid software, 1.11.1.

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.11.1](https://docs.cloud.google.com/apigee/docs/hybrid/v1.11/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.11/big-picture.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **311705715** | **Use a non-default service account for the `remove-dc` component.** |
| **306341401** | **Fixed regression where virtualhost cipherSuites overrides weren't being used.** |

Security

| Bug ID | Description |
|---|---|
| **315034009** | **Security fixes: `apigee-asm-ingress` and `apigee-asm-istiod` (`ingressgateway` and `ingressgateway-controller`) are upgraded to Service Mesh version 1.17.8-asm.4.** This addresses the following vulnerabilities: - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-4806](https://nvd.nist.gov/vuln/detail/CVE-2023-4806) (`apigee-asm-ingress` only) - [CVE-2023-4911](https://nvd.nist.gov/vuln/detail/CVE-2023-4911) (`apigee-asm-ingress` only) - [CVE-2023-4813](https://nvd.nist.gov/vuln/detail/CVE-2023-4813) (`apigee-asm-ingress` only) - [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) |
| **303460289** | **Security fixes to `apigee-prometheus-adapter`.** This addresses the following vulnerabilities: - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) - [CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406) - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) |
| **303459588** | **Security fixes to `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2023-45142](https://nvd.nist.gov/vuln/detail/CVE-2023-45142) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-40577](https://nvd.nist.gov/vuln/detail/CVE-2023-40577) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) - [CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406) - [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) - [CVE-2023-2253](https://nvd.nist.gov/vuln/detail/CVE-2023-2253) |
| **303292806** | **Restrict connections from the Cassandra backup utility to Cassandra server pods in the `apigee` namespace.** |
| **N/A** | **Security fixes to `apigee-cassandra-backup-utility`.** This addresses the following vulnerabilities: - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) |
| **N/A** | **Security fixes to `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2023-36054](https://nvd.nist.gov/vuln/detail/CVE-2023-36054) - [CVE-2023-4911](https://nvd.nist.gov/vuln/detail/CVE-2023-4911) - [CVE-2023-3817](https://nvd.nist.gov/vuln/detail/CVE-2023-3817) - [CVE-2023-3446](https://nvd.nist.gov/vuln/detail/CVE-2023-3446) |
| **N/A** | **Security fixes to `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) - [CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406) - [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) |
| **N/A** | **Security fixes to `apigee-hybrid-cassandra-client`.** This addresses the following vulnerabilities: - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39326](https://nvd.nist.gov/vuln/detail/CVE-2023-39326) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) - [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) |
| **N/A** | **Security fixes to `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) - [CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406) - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) |
| **N/A** | **Security fixes to `apigee-installer`, `apigee-operators`, and `apigee-watcher`.** This addresses the following vulnerabilities: - [CVE-2023-48795](https://nvd.nist.gov/vuln/detail/CVE-2023-48795) (`apigee-operators` only) - [CVE-2023-45287](https://nvd.nist.gov/vuln/detail/CVE-2023-45287) (`apigee-operators` and `apigee-watcher`) - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39326](https://nvd.nist.gov/vuln/detail/CVE-2023-39326) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) (`apigee-operators` and `apigee-watcher`) |

## December 18, 2023

**Apigee hybrid** v1.10.4 Announcement

### hybrid v1.10.4

On December 18, 2023 we released an updated version of the Apigee hybrid software, 1.10.4.

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.10.4](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/big-picture.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **311705715** | **Use a non-default service account for the `remove-dc` component.** |
| **306341401** | **Fixed regression where virtualhost cipherSuites overrides weren't being used.** |
| **302186503** | **Add the missing HTTP proxy template settings to the Apigee Hybrid Helm `datastore` component.** |
| **300542690** | **Added dedicated service accounts for Apigee Connect, Redis, and UDCA to prevent Kubernetes from automatically injecting credentials for a specified Service Account or the default Service Account.** |
| **277353680** | **Fixed issue causing target server HealthMonitors to continue beyond revision or deletion of the proxy.** Target health checks are now terminated as soon as the proxy is removed from the runtime (undeployed or deleted). Note: There may be a delay between removal of the proxy and termination of the target server health checks. |

Security

| Bug ID | Description |
|---|---|
| **315034009** | **Security fixes: `apigee-asm-ingress` and `apigee-asm-istiod` (`ingressgateway` and `ingressgateway-controller`) are upgraded to Service Mesh version 1.17.8-asm.4.** This addresses the following vulnerabilities: - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) - [CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406) - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2023-28842](https://nvd.nist.gov/vuln/detail/CVE-2023-28842) - [CVE-2023-28841](https://nvd.nist.gov/vuln/detail/CVE-2023-28841) - [CVE-2023-28840](https://nvd.nist.gov/vuln/detail/CVE-2023-28840) - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2023-4911](https://nvd.nist.gov/vuln/detail/CVE-2023-4911) (`apigee-asm-ingress` only) - [CVE-2023-4813](https://nvd.nist.gov/vuln/detail/CVE-2023-4813) (`apigee-asm-ingress` only) - [CVE-2023-4806](https://nvd.nist.gov/vuln/detail/CVE-2023-4806) (`apigee-asm-ingress` only) - [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) - [CVE-2023-2253](https://nvd.nist.gov/vuln/detail/CVE-2023-2253) |
| **311167948** | **A security issue was addressed.** |
| **303460289** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerabilities: - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) - [CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406) - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) |
| **303459588** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2023-45142](https://nvd.nist.gov/vuln/detail/CVE-2023-45142) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-40577](https://nvd.nist.gov/vuln/detail/CVE-2023-40577) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) - [CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406) - [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) - [CVE-2023-2253](https://nvd.nist.gov/vuln/detail/CVE-2023-2253) |
| **300319489** | **Security fixes for `fluentd`.** This addresses the following vulnerabilities: - [CVE-2023-36617](https://nvd.nist.gov/vuln/detail/CVE-2023-36617) - [CVE-2023-32732](https://nvd.nist.gov/vuln/detail/CVE-2023-32732) - [CVE-2023-32731](https://nvd.nist.gov/vuln/detail/CVE-2023-32731) - [CVE-2023-28755](https://nvd.nist.gov/vuln/detail/CVE-2023-28755) - [CVE-2023-1428](https://nvd.nist.gov/vuln/detail/CVE-2023-1428) - [CVE-2022-39379](https://nvd.nist.gov/vuln/detail/CVE-2022-39379) - [CVE-2022-31163](https://nvd.nist.gov/vuln/detail/CVE-2022-31163) - [CVE-2022-3171](https://nvd.nist.gov/vuln/detail/CVE-2022-3171) - [CVE-2021-43809](https://nvd.nist.gov/vuln/detail/CVE-2021-43809) - [CVE-2021-41186](https://nvd.nist.gov/vuln/detail/CVE-2021-41186) - [CVE-2021-33621](https://nvd.nist.gov/vuln/detail/CVE-2021-33621) - [CVE-2020-36327](https://nvd.nist.gov/vuln/detail/CVE-2020-36327) - [CVE-2020-10663](https://nvd.nist.gov/vuln/detail/CVE-2020-10663) |
| **294892189** | **Security fixes for `apigee-diagnostics-collector`.** This addresses the Guava vulnerability: - [CVE-2023-2976](https://nvd.nist.gov/vuln/detail/CVE-2023-2976) |
| **N/A** | **Security fixes for `apigee-cassandra-backup-utility` and `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) - [CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406) (`apigee-prom-prometheus` only) - [CVE-2023-2253](https://nvd.nist.gov/vuln/detail/CVE-2023-2253) (`apigee-prom-prometheus` only) |
| **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2023-36054](https://nvd.nist.gov/vuln/detail/CVE-2023-36054) - [CVE-2023-3446](https://nvd.nist.gov/vuln/detail/CVE-2023-3446) - [CVE-2023-4911](https://nvd.nist.gov/vuln/detail/CVE-2023-4911) - [CVE-2023-3817](https://nvd.nist.gov/vuln/detail/CVE-2023-3817) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra` and `apigee-hybrid-cassandra-client`.** This addresses the following vulnerabilities: - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) (`apigee-hybrid-cassandra-client` only) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39326](https://nvd.nist.gov/vuln/detail/CVE-2023-39326) (`apigee-hybrid-cassandra-client` only) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) - [CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406) (`apigee-hybrid-cassandra` only) - [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) |
| **N/A** | **Security fixes for `apigee-installer`, `apigee-operators`, and `apigee-watcher`.** This addresses the following vulnerabilities: - [CVE-2023-45287](https://nvd.nist.gov/vuln/detail/CVE-2023-45287) ( `apigee-operators` and `apigee-watcher` only) - [CVE-2023-45285](https://nvd.nist.gov/vuln/detail/CVE-2023-45285) - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39326](https://nvd.nist.gov/vuln/detail/CVE-2023-39326) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) ( `apigee-operators` and `apigee-watcher` only) |
| **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) - [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) - [CVE-2023-39323](https://nvd.nist.gov/vuln/detail/CVE-2023-39323) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) - [CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406) - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) |

## December 15, 2023

**Apigee X** Announcement On December 15, 2023, we released an updated version of Apigee.
Feature **Update Pay-as-you-go environment types with Apigee APIs.**

Use Apigee APIs to upgrade or downgrade the type of an *existing* environment to add or remove feature capabilities and manage your Apigee Pay-as-you-go billing and resource usage. For more information, see [Update Pay-as-you-go environment types](https://docs.cloud.google.com/apigee/docs/api-platform/reference/update-environment-types.md.txt).
Feature **Apigee Advanced API Security add-on for Pay-as-you-go organizations is [generally available (GA)](https://cloud.google.com/products/#product-launch-stages).**

With this release, Apigee Advanced API Security is available as a paid add-on capability for Pay-as-you-go organizations. The add-on can be enabled in any Apigee Intermediate or Comprehensive environment from the Apigee UI in Cloud Console or using the Apigee APIs. For more information, see [Manage the Advanced API Security add-on](https://docs.cloud.google.com/apigee/docs/api-platform/reference/manage-security-add-on.md.txt).

## December 13, 2023

**Apigee Advanced API Security** Announcement On December 13, 2023 we released an updated version of Advanced API Security.
Feature **Performance improvements to Risk Assessment security scores**

Risk Assessment [security scores](https://docs.cloud.google.com/apigee/docs/api-security/security-scores.md.txt#security-scores) now load faster in the Apigee UI, due to improved server side caching of scores.
Feature **Public preview of archiving security incidents**

With this release, you can now [archive security incidents](https://docs.cloud.google.com/apigee/docs/api-security/abuse-detection.md.txt#archive-incidents) that you no longer want to see displayed in the [incidents list](https://docs.cloud.google.com/apigee/docs/api-security/abuse-detection.md.txt#environment-details). For example, you might want to archive incidents that you have already dealt with and no longer need to track. Archiving incidents can help you focus on those incidents that still require your attention. Archiving does not delete the incident: you can always unarchive it whenever you want.
**Apigee X** Announcement On December 13, 2023, we released an updated version of Apigee.

**Note**: Rollouts of this release to production instances will begin within two business days and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.
Feature Apigee now supports data residency. Data residency for Apigee meets compliance and regulatory requirements by allowing you to specify the geographic locations (regions) where Apigee data is stored. See [Introduction to data residency](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/drz-concepts.md.txt).
Feature Apigee now supports Forward Proxying. Forward Proxying provides the ability to forward traffic received in a particular environment to a specified URI. See [Forward proxying](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/environments-overview.md.txt#forward-proxying).
Feature You can now restrict the creation of Apigee location based resources (Organization, Instances and EndpointAttachments) to specific locations using an Organization Policy Service constraint. This feature is [generally available](https://cloud.google.com/products/#product-launch-stages). To learn more, see [Restricting Resource Locations](https://docs.cloud.google.com/resource-manager/docs/organization-policy/defining-locations).
Feature Apigee now supports CMEK for the control plane. If you have specific compliance or regulatory requirements related to the keys that protect your data, you can use customer-managed encryption keys (CMEK). See [Introduction to CMEK](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/cmek-concepts.md.txt).

## December 07, 2023

**Apigee Integrated Portal** Announcement On December 7, 2023 we released an updated version of Apigee integrated portal.
Fixed

| Bug ID | Description |
|---|---|
| 313803133 | Fixed an issue where switching API spec pages in the public developer portal resulted in an error. |
| 310865440 | Fixed an issue where updating the documentation of a CatalogItem could timeout. |

**Apigee X** Announcement On December 7, 2023, we released an updated version of Apigee X.

> [!NOTE]
> **Note:** Rollouts of this release to production instances has begun and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features available until the rollout is complete.

Feature **[General Availability (GA)](https://cloud.google.com/products/#product-launch-stages) of Apigee gRPC passthrough**

Apigee's gRPC proxy passthrough functionality provides the ability to create proxies which receive gRPC client requests and pass them through to a gRPC target server.

For information, see [Creating gRPC API proxies](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/build-simple-api-proxy.md.txt#creating-grpc-api-proxies).

## December 06, 2023

**Apigee Advanced API Security** Announcement On December 6, 2023 we released an updated version of Advanced API Security.
Feature **New button to create a security action is now in several places in the Abuse detection and Risk assessment pages**

The new button links directly to the Security actions page from the Abuse detection or Risk assessment pages, so you can easily create a [security action](https://docs.cloud.google.com/apigee/docs/api-security/security-actions.md.txt) for the environment you are currently viewing. The button is in the following locations:

- The Source assessment view in the Risk assessment page
- The Detected Traffic, Incident, and Incident details views in the Abuse detection page

## December 05, 2023

**Apigee Advanced API Security** Announcement On December 5, 2023 we released an updated version of Advanced API Security.
Change **Changes to proxy security scores**

The following changes have been made to the way proxy security scores are calculated:

- Previously, adding a policy to a proxy or shared flow, but not attaching the policy to any flow (preflow, postflow or conditional flow), could affect the proxy's score.

  With this release, you must attach a policy in a flow in order for the policy to affect the proxy's score. A policy that is not attached in a flow is treated as if no policy were present for scoring.
- Previously, proxies with no policies were not considered in scoring.

  With this release, proxies with no policies *are* considered in scoring.

See [How policies affect proxy security scores](https://docs.cloud.google.com/apigee/docs/api-security/security-scores.md.txt#how-policies-affect-proxy-security-scores) to learn more.

## December 01, 2023

**Apigee X** Announcement On December 1, 2023, we released an updated version of Apigee (1-11-0-apigee-8).

**Note**: Rollouts of this release to production instances will begin within two business days and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.
Change **Dynamic endpoint target metrics aggregated into a single metric.**

With this release, all request, response, and latency [target metrics](https://docs.cloud.google.com/monitoring/api/resources.md.txt#tag_apigee.googleapis.com/TargetV2) for dynamically-configured endpoints are aggregated and presented as a single metric per proxy, using the `endpoint` label `Dynamic Target`. This feature does not change monitoring behavior for statically configured endpoints.
Fixed

| Bug ID | Description |
|---|---|
| **294882858** | **Fixed issue with ServiceCallout policy overriding `target_ip` value in proxy.** |
| **279037851** | **Improved performance when running debug sessions with masked payload.** |
| **312026988** | **Resolved possible usage counting issue for monetization prepaid developers using proxies with multiple proxy endpoints configured.** |

**Apigee hybrid** 1.10.3-hotfix.4 Announcement

### hybrid 1.10.3-hotfix.4

On December 1, 2023 we released an updated version of the Apigee hybrid software, v1.10.3-hotfix.4.

- To install the hotfix, follow the instructions in [Upgrading Apigee hybrid to version 1.10](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/upgrade.md.txt#install-hotfix-4).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/big-picture.md.txt).

> [!NOTE]
> **Note:** This hotfix installs the `apigee-hybrid-cassandra` and `apigee-operator` container images. All other container images are unchanged from [Hybrid v1.10.3-hotfix.3](https://docs.cloud.google.com/apigee/docs/release-notes.md.txt#hybrid_v1103-hotfix3).

Fixed

| Bug ID | Description |
|---|---|
| **311705715** | **Mount a dedicated service account to the `remove-dc` component.** |

Security

| Bug ID | Description |
|---|---|
| **311167948** | **A security issue was addressed.** |

## November 17, 2023

**Apigee hybrid** v1.11.0 Announcement

### hybrid v1.11.0

On November 17, 2023 we released an updated version of the Apigee hybrid software, v1.11.0.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.11.0](https://docs.cloud.google.com/apigee/docs/hybrid/v1.11/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.11/big-picture.md.txt).
Feature **Helm charts management for Apigee hybrid**

Starting in version v1.11.0, you have the choice of installing and managing your clusters with either Helm or `apigeectl`. You cannot manage a cluster with both. Apigee recommends using Helm for new hybrid installations. See [Apigee hybrid Helm charts reference](https://docs.cloud.google.com/apigee/docs/hybrid/v1.11/helm-reference.md.txt).
Feature **Apigee Advance API Security Actions for Apigee hybrid**

Advanced API Security's new [Security Actions](https://docs.cloud.google.com/apigee/docs/api-security/security-actions.md.txt) feature is now available in Apigee hybrid.
Feature With this release, the `HeaderName` element is available as a child element of `Authentication`. This element appears in the [ServiceCallout](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/service-callout-policy.md.txt#authentication) and [ExternalCallout](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/external-callout-policy.md.txt) policies, and in the [TargetEndpoint proxy configuration](https://docs.cloud.google.com/apigee/docs/api-platform/reference/api-proxy-configuration-reference.md.txt#authentication-element-usage).

By default, when an `Authentication` configuration is present, Apigee generates and injects a bearer token into the `Authorization` header, in the message sent to the target system. The new `HeaderName` element allows you to specify the name of a different header to hold that bearer token.
Feature **Vault integration for Cassandra credentials (preview)**

Starting in version v1.11.0, you can store Cassandra credentials in Hashicorp Vault.   
**Note:** Using Vault requires Helm management of your Apigee installation.   
See [Storing Cassandra credentials in Hashicorp Vault](https://docs.cloud.google.com/apigee/docs/hybrid/v1.11/storing-cassandra-secrets-in-vault.md.txt).

Vault integration is in preview as of the Apigee hybrid 1.11.0 release.
Fixed

| Bug ID | Description |
|---|---|
| **295929616** | **Installation of Hybrid 1.10.x would fail on OpenShift due to out of memory issues.** (Fixed in Apigee hybrid v1.10.3) |
| **294069799** | **Updated the security context settings for the Apigee Hybrid Backup and Restore pod.** |
| **292571089** | **An error with support for CSI backup and restore for Cassandra was fixed.** (Fixed in Apigee hybrid v1.10.3) |
| **292118812** | **Fixed UDCA regression in Hybrid 1.10.1 where UDCA would ignore forward proxy configuration.** (Fixed in Apigee hybrid v1.10.2) |
| **289254725** | **Implemented a fix to prevent failure of proxy deployments that include the OASValidation policy.** (Fixed in Apigee hybrid v1.10.1) |
| **287321226** | **Security context has been corrected for `apigee-prom-prometheus` to avoid privilege escalation.** (Fixed in Apigee hybrid v1.10.3) |
| **277353680** | **Fixed issue causing target server `HealthMonitors` to continue beyond revision or deletion of the proxy.** Target health checks are now terminated as soon as the proxy is removed from the runtime (undeployed or deleted). Note: There may be a delay between removal of the proxy and termination of the target server health checks. (Fixed in Apigee X) |
| **240180122** | **Disable privilege escalation on the cassandra container by moving the ulimit settings to the newly introduced initContainer "apigee-cassandra-ulimit-init".** If you are using security controls with gatekeeper, ensure that apigee-cassandra-ulimit-init initContainer can runAs user, group as 0 and allow capabilities IPC_LOCK and SYS_RESOURCES. (Fixed in Apigee hybrid v1.11.0) |
| **205666368** | **Fixed issue with default validation of TLS target endpoint certificates.** To enable strict SSL on southbound connections to a proxy target endpoint, add the tag `<Enforce>true</Enforce>` in the target `<SSLInfo>` block. See [About setting TLS options in a target endpoint or target server](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/options-configuring-tls.md.txt#about-setting-tls-options-in-a-target-endpoint-target-server). See also [Known Issue #205666368](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt#205666368). (Fixed in Apigee hybrid v1.10.3-hotfix.1) |
| **158132963** | **Added improvements to capture relevant target flow variables in trace and analytics in case of target timeouts.** (Fixed in Apigee hybrid v1.10.2) |

Security

| Bug ID | Description |
|---|---|
| **303292806** | **Set backup utility to only connect to Cassandra server pods in the `apigee` namespace.** (Fixed in Apigee hybrid v1.10.3-hotfix.3) |
| **300542690** | **Added dedicated service accounts for Apigee Connect, Redis, and UDCA to prevent Kubernetes from automatically injecting credentials for a specified ServiceAccount or the default ServiceAccount.** (Fixed in Apigee hybrid v1.10.3-hotfix.3) |
| **297938600, 297938559, 297938486, 294892344** | **Security fixes for `apigee-diagnostics-collector`.** (Fixed in Apigee hybrid v1.10.3) This addresses the following vulnerabilities: - [CVE-2023-1436](https://nvd.nist.gov/vuln/detail/CVE-2023-1436) - [CVE-2022-45693](https://nvd.nist.gov/vuln/detail/CVE-2022-45693) - [CVE-2022-45685](https://nvd.nist.gov/vuln/detail/CVE-2022-45685) - [CVE-2022-40150](https://nvd.nist.gov/vuln/detail/CVE-2022-40150) |
| **297938498, 297938487** | **Security fixes for `apigee-fluent-bit`.** (Fixed in Apigee hybrid v1.10.3) This addresses the following vulnerabilities: - [CVE-2023-2650](https://nvd.nist.gov/vuln/detail/CVE-2023-2650) - [CVE-2023-0464](https://nvd.nist.gov/vuln/detail/CVE-2023-0464) |
| **297938441** | **Security fixes for `apigee-runtime`.** (Fixed in Apigee hybrid v1.10.3) This addresses the following vulnerabilities: - [CVE-2023-1370](https://nvd.nist.gov/vuln/detail/CVE-2023-1370) - [CVE-2021-31684](https://nvd.nist.gov/vuln/detail/CVE-2021-31684) |
| **297286274** | **Security fixes for `apigee-installer`.** (Fixed in Apigee hybrid v1.10.3) This addresses the following vulnerabilities: - [CVE-2023-39533](https://nvd.nist.gov/vuln/detail/CVE-2023-39533) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) - [CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406) - [CVE-2023-2253](https://nvd.nist.gov/vuln/detail/CVE-2023-2253) |
| **296719459, 296719400, 296719348, 296719307, 296719306, 296719188, 296719187, 296719186, 296719115, 296719018, 296718937, 296718918, 296718917, 296718916, 296716670, 296716669, 296716472, 296716471, 296715155** | **Security fixes for `apigee-hybrid-cassandra`.** (Fixed in Apigee hybrid v1.10.3) This addresses the following vulnerabilities: - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538) - [CVE-2023-24537](https://nvd.nist.gov/vuln/detail/CVE-2023-24537) - [CVE-2023-24536](https://nvd.nist.gov/vuln/detail/CVE-2023-24536) - [CVE-2023-24534](https://nvd.nist.gov/vuln/detail/CVE-2023-24534) - [CVE-2022-41725](https://nvd.nist.gov/vuln/detail/CVE-2022-41725) - [CVE-2022-41724](https://nvd.nist.gov/vuln/detail/CVE-2022-41724) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) - [CVE-2022-41715](https://nvd.nist.gov/vuln/detail/CVE-2022-41715) - [CVE-2022-32190](https://nvd.nist.gov/vuln/detail/CVE-2022-32190) - [CVE-2022-2880](https://nvd.nist.gov/vuln/detail/CVE-2022-2880) - [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664) - [CVE-2022-2879](https://nvd.nist.gov/vuln/detail/CVE-2022-2879) |
| **296717666, 296717283, 296716668, 296716667, 296716650, 296716635, 296716634, 296716633, 296716470, 296716234, 296715734, 296715733, 296715154, 296715153** | **Security fixes for `apigee-hybrid-cassandra-client`.** (Fixed in Apigee hybrid v1.10.3) This addresses the following vulnerabilities: - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538) - [CVE-2023-24537](https://nvd.nist.gov/vuln/detail/CVE-2023-24537) - [CVE-2023-24536](https://nvd.nist.gov/vuln/detail/CVE-2023-24536) - [CVE-2023-24534](https://nvd.nist.gov/vuln/detail/CVE-2023-24534) - [CVE-2022-41725](https://nvd.nist.gov/vuln/detail/CVE-2022-41725) - [CVE-2022-41724](https://nvd.nist.gov/vuln/detail/CVE-2022-41724) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) |
| **296717665, 296717664, 296717663, 296717662, 296717185, 296716666, 296716649, 296716632, 296716468, 296716467, 296716232, 296715152, 296715151, 296714218** | **Security fixes for `apigee-cassandra-backup-utility`.** (Fixed in Apigee hybrid v1.10.3) This addresses the following vulnerabilities: - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538) - [CVE-2023-24537](https://nvd.nist.gov/vuln/detail/CVE-2023-24537) - [CVE-2023-24536](https://nvd.nist.gov/vuln/detail/CVE-2023-24536) - [CVE-2023-24534](https://nvd.nist.gov/vuln/detail/CVE-2023-24534) - [CVE-2022-41725](https://nvd.nist.gov/vuln/detail/CVE-2022-41725) - [CVE-2022-41724](https://nvd.nist.gov/vuln/detail/CVE-2022-41724) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) |
| **295936113** | **Security fixes for `apigee-mart-server`.** (Fixed in Apigee hybrid v1.10.3) This addresses the following vulnerability: - [CVE-2023-3635](https://nvd.nist.gov/vuln/detail/CVE-2023-3635) |
| **294906706** | **Security fixes for `apigee-prom-prometheus`.** (Fixed in Apigee hybrid v1.10.3) This addresses the following vulnerabilities: - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2023-28842](https://nvd.nist.gov/vuln/detail/CVE-2023-28842) - [CVE-2023-28841](https://nvd.nist.gov/vuln/detail/CVE-2023-28841) - [CVE-2023-28840](https://nvd.nist.gov/vuln/detail/CVE-2023-28840) - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538) - [CVE-2023-24537](https://nvd.nist.gov/vuln/detail/CVE-2023-24537) - [CVE-2023-24536](https://nvd.nist.gov/vuln/detail/CVE-2023-24536) - [CVE-2023-24534](https://nvd.nist.gov/vuln/detail/CVE-2023-24534) - [CVE-2023-24532](https://nvd.nist.gov/vuln/detail/CVE-2023-24532) - [CVE-2022-46146](https://nvd.nist.gov/vuln/detail/CVE-2022-46146) - [CVE-2022-41725](https://nvd.nist.gov/vuln/detail/CVE-2022-41725) - [CVE-2022-41724](https://nvd.nist.gov/vuln/detail/CVE-2022-41724) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) - [CVE-2022-41721](https://nvd.nist.gov/vuln/detail/CVE-2022-41721) - [CVE-2022-41717](https://nvd.nist.gov/vuln/detail/CVE-2022-41717) - [CVE-2022-32149](https://nvd.nist.gov/vuln/detail/CVE-2022-32149) |
| **293925856** | **Security fixes for `apigee-prometheus-adapter`.** (Fixed in Apigee hybrid v1.10.3) This addresses the following vulnerabilities: - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538) - [CVE-2023-24537](https://nvd.nist.gov/vuln/detail/CVE-2023-24537) - [CVE-2023-24536](https://nvd.nist.gov/vuln/detail/CVE-2023-24536) - [CVE-2023-24534](https://nvd.nist.gov/vuln/detail/CVE-2023-24534) - [CVE-2023-24532](https://nvd.nist.gov/vuln/detail/CVE-2023-24532) - [CVE-2022-41725](https://nvd.nist.gov/vuln/detail/CVE-2022-41725) - [CVE-2022-41724](https://nvd.nist.gov/vuln/detail/CVE-2022-41724) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) - [CVE-2022-41717](https://nvd.nist.gov/vuln/detail/CVE-2022-41717) - [CVE-2022-41715](https://nvd.nist.gov/vuln/detail/CVE-2022-41715) - [CVE-2022-32190](https://nvd.nist.gov/vuln/detail/CVE-2022-32190) - [CVE-2022-32149](https://nvd.nist.gov/vuln/detail/CVE-2022-32149) - [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664) - [CVE-2022-27191](https://nvd.nist.gov/vuln/detail/CVE-2022-27191) - [CVE-2022-2880](https://nvd.nist.gov/vuln/detail/CVE-2022-2880) - [CVE-2022-2879](https://nvd.nist.gov/vuln/detail/CVE-2022-2879) |
| **293348130** | **Security fixes for `apigee-udca`.** (Fixed in Apigee hybrid v1.10.2) This addresses the following vulnerabilities: - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538) - [CVE-2022-32149](https://nvd.nist.gov/vuln/detail/CVE-2022-32149) - [CVE-2023-24536](https://nvd.nist.gov/vuln/detail/CVE-2023-24536) - [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664) - [CVE-2022-41721](https://nvd.nist.gov/vuln/detail/CVE-2022-41721) - [CVE-2023-24534](https://nvd.nist.gov/vuln/detail/CVE-2023-24534) - [CVE-2023-24537](https://nvd.nist.gov/vuln/detail/CVE-2023-24537) - [CVE-2022-41724](https://nvd.nist.gov/vuln/detail/CVE-2022-41724) - [CVE-2022-41725](https://nvd.nist.gov/vuln/detail/CVE-2022-41725) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) |
| **291994501** | **Security fixes for `apigee-operator` and `apigee-watcher`.** (Fixed in Apigee hybrid v1.10.2) This addresses the following vulnerabilities: - [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538) - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2023-24534](https://nvd.nist.gov/vuln/detail/CVE-2023-24534) - [CVE-2022-41725](https://nvd.nist.gov/vuln/detail/CVE-2022-41725) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) - [CVE-2023-24536](https://nvd.nist.gov/vuln/detail/CVE-2023-24536) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2022-41724](https://nvd.nist.gov/vuln/detail/CVE-2022-41724) - [CVE-2023-24537](https://nvd.nist.gov/vuln/detail/CVE-2023-24537) - [CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406) - [CVE-2023-24532](https://nvd.nist.gov/vuln/detail/CVE-2023-24532) |
| **291994501** | **Security fixes for `apigee-installer`.** (Fixed in Apigee hybrid v1.10.2) This addresses the following vulnerabilities: - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-24537](https://nvd.nist.gov/vuln/detail/CVE-2023-24537) - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) - [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664) - [CVE-2023-24536](https://nvd.nist.gov/vuln/detail/CVE-2023-24536) - [CVE-2023-24534](https://nvd.nist.gov/vuln/detail/CVE-2023-24534) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2022-2879](https://nvd.nist.gov/vuln/detail/CVE-2022-2879) - [CVE-2022-41724](https://nvd.nist.gov/vuln/detail/CVE-2022-41724) - [CVE-2022-32149](https://nvd.nist.gov/vuln/detail/CVE-2022-32149) - [CVE-2022-41725](https://nvd.nist.gov/vuln/detail/CVE-2022-41725) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2022-2880](https://nvd.nist.gov/vuln/detail/CVE-2022-2880) - [CVE-2022-41715](https://nvd.nist.gov/vuln/detail/CVE-2022-41715) - [CVE-2022-41721](https://nvd.nist.gov/vuln/detail/CVE-2022-41721) - [CVE-2023-24532](https://nvd.nist.gov/vuln/detail/CVE-2023-24532) - [CVE-2022-41717](https://nvd.nist.gov/vuln/detail/CVE-2022-41717) |
| **290829031** | **Security fixes for `apigee-hybrid-cassandra`, `apigee-cassandra-client`, and `cassandra-backup-utility`.** (Fixed in Apigee hybrid v1.10.2) This addresses the following vulnerabilities: - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538) - [CVE-2023-24537](https://nvd.nist.gov/vuln/detail/CVE-2023-24537) - [CVE-2023-24536](https://nvd.nist.gov/vuln/detail/CVE-2023-24536) - [CVE-2023-24534](https://nvd.nist.gov/vuln/detail/CVE-2023-24534) - [CVE-2023-24532](https://nvd.nist.gov/vuln/detail/CVE-2023-24532) - [CVE-2022-41725](https://nvd.nist.gov/vuln/detail/CVE-2022-41725) - [CVE-2022-41724](https://nvd.nist.gov/vuln/detail/CVE-2022-41724) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) - [CVE-2022-41717](https://nvd.nist.gov/vuln/detail/CVE-2022-41717) - [CVE-2022-41715](https://nvd.nist.gov/vuln/detail/CVE-2022-41715) - [CVE-2022-32190](https://nvd.nist.gov/vuln/detail/CVE-2022-32190) - [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664) - [CVE-2022-2880](https://nvd.nist.gov/vuln/detail/CVE-2022-2880) - [CVE-2022-2879](https://nvd.nist.gov/vuln/detail/CVE-2022-2879) - [CVE-2020-29511](https://nvd.nist.gov/vuln/detail/CVE-2020-29511) - [CVE-2020-29509](https://nvd.nist.gov/vuln/detail/CVE-2020-29509) |
| **290829028** | **Security fixes for Apigee Connect and `apigee-connect-agent` and `apigee-redis`.** (Fixed in Apigee hybrid v1.10.2) This addresses the following vulnerabilities: - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538) - [CVE-2023-24537](https://nvd.nist.gov/vuln/detail/CVE-2023-24537) - [CVE-2023-24536](https://nvd.nist.gov/vuln/detail/CVE-2023-24536) - [CVE-2023-24534](https://nvd.nist.gov/vuln/detail/CVE-2023-24534) - [CVE-2023-24532](https://nvd.nist.gov/vuln/detail/CVE-2023-24532) - [CVE-2022-41725](https://nvd.nist.gov/vuln/detail/CVE-2022-41725) - [CVE-2022-41724](https://nvd.nist.gov/vuln/detail/CVE-2022-41724) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) - [CVE-2022-41717](https://nvd.nist.gov/vuln/detail/CVE-2022-41717) - [CVE-2022-32149](https://nvd.nist.gov/vuln/detail/CVE-2022-32149) - [CVE-2022-29526](https://nvd.nist.gov/vuln/detail/CVE-2022-29526) - [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664) - [CVE-2022-21698](https://nvd.nist.gov/vuln/detail/CVE-2022-21698) |
| **290068742** | **Security fixes for `apigee-udca`.** (Fixed in Apigee hybrid v1.10.1) This addresses the following vulnerability: - [CVE-2022-1471](https://nvd.nist.gov/vuln/detail/CVE-2022-1471) |
| **290067464** , **297938583** | **Security fixes for `apigee-stackdriver-logging-agent`.** (Fixed in Apigee hybrid v1.10.1) This addresses the following vulnerabilities: - [CVE-2022-32511](https://nvd.nist.gov/vuln/detail/CVE-2022-32511) - [CVE-2023-32731](https://nvd.nist.gov/vuln/detail/CVE-2023-32731) |
| **290065830** | **Security fixes for `apigee-udca`.** (Fixed in Apigee hybrid v1.10.1) This addresses the following vulnerability: - [CVE-2022-42889](https://nvd.nist.gov/vuln/detail/CVE-2022-42889) |
| **281561243** | **Security fixes for `apigee-diagnostics-collector`, `apigee-mart-server`, `apigee-mint-task-scheduler`, `apigee-runtime`, and `apigee-synchronizer`.** (Fixed in Apigee hybrid v1.10.1) This addresses the following vulnerability: - [CVE-2022-1471](https://nvd.nist.gov/vuln/detail/CVE-2022-1471) |
| **N/A** | **Security fixes for `apigee-prometheus-adapter`.** (Fixed in Apigee hybrid hybrid v1.11) This addresses the following vulnerabilities: - [CVE-2023-39533](https://nvd.nist.gov/vuln/detail/CVE-2023-39533) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) |
| **N/A** | **Security fixes for `apigee-prom-prometheus/master`.** (Fixed in Apigee hybrid v1.11) This addresses the following vulnerabilities: - [CVE-2023-40577](https://nvd.nist.gov/vuln/detail/CVE-2023-40577) - [CVE-2023-39533](https://nvd.nist.gov/vuln/detail/CVE-2023-39533) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) - [CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406) - [CVE-2023-2253](https://nvd.nist.gov/vuln/detail/CVE-2023-2253) |
| **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** (Fixed in Apigee hybrid hybrid v1.11) This addresses the following vulnerabilities: - [CVE-2023-39533](https://nvd.nist.gov/vuln/detail/CVE-2023-39533) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) - [CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406) - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) |
| **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** (Fixed in Apigee hybrid hybrid v1.11) This addresses the following vulnerabilities: - [CVE-2023-39533](https://nvd.nist.gov/vuln/detail/CVE-2023-39533) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) - [CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406) |
| **N/A** | **Security fixes for `apigee-fluent-bit`.** (Fixed in Apigee hybrid hybrid v1.11) This addresses the following vulnerabilities: - [CVE-2023-3817](https://nvd.nist.gov/vuln/detail/CVE-2023-3817) - [CVE-2023-36054](https://nvd.nist.gov/vuln/detail/CVE-2023-36054) - [CVE-2023-3446](https://nvd.nist.gov/vuln/detail/CVE-2023-3446) |
| **N/A** | **Security fixes for `apigee-diagnostics-collector`, `apigee-mart-server`, `apigee-mint-task-scheduler`, `apigee-runtime`, and `apigee-synchronizer`.** (Fixed in Apigee hybrid hybrid v1.11) This addresses the following vulnerabilities: - [CVE-2023-4586](https://nvd.nist.gov/vuln/detail/CVE-2023-4586) - [CVE-2023-34462](https://nvd.nist.gov/vuln/detail/CVE-2023-34462) |
| **N/A** | **Security fixes for `apigee-cassandra-backup-utility`, `apigee-hybrid-cassandra-client`, and `apigee-connect-agent`.** (Fixed in Apigee hybrid v1.11) This addresses the following vulnerabilities: - [CVE-2023-39533](https://nvd.nist.gov/vuln/detail/CVE-2023-39533) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) |
| **N/A** | **Security fixes for `apigee-asm-ingress` and `apigee-asm-istiod`.** (Fixed in Apigee hybrid v1.11) This addresses the following vulnerabilities: - [CVE-2023-39533](https://nvd.nist.gov/vuln/detail/CVE-2023-39533) - [CVE-2023-39319](https://nvd.nist.gov/vuln/detail/CVE-2023-39319) - [CVE-2023-39318](https://nvd.nist.gov/vuln/detail/CVE-2023-39318) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) - [CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406) - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2023-28842](https://nvd.nist.gov/vuln/detail/CVE-2023-28842) - [CVE-2023-28841](https://nvd.nist.gov/vuln/detail/CVE-2023-28841) - [CVE-2023-28840](https://nvd.nist.gov/vuln/detail/CVE-2023-28840) - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2023-2253](https://nvd.nist.gov/vuln/detail/CVE-2023-2253) |

## November 10, 2023

**Apigee Integrated Portal** Announcement On November 10, 2023 we released an updated version of Apigee integrated portal.
Feature This release includes the public preview of integrated portal APIs which allow you to manage your integrated portal APIs and reference documentation using API calls.

The catalog items list view now uses pagination when making requests to the portals service, examples have been added to **Publishing your APIs**, and new reference documentation is available:

- [Publishing your APIs](https://docs.cloud.google.com/apigee/docs/api-platform/publish/portal/publish-apis.md.txt)
- [API categories reference documentation](https://docs.cloud.google.com/apigee/docs/reference/apis/apigee/rest/v1/organizations.sites.apicategories.md.txt)
- [API documents reference documentation](https://docs.cloud.google.com/apigee/docs/reference/apis/apigee/rest/v1/organizations.sites.apidocs.md.txt)
**Apigee X** Feature Apigee is now available in a new region: Middle East - Dammam (`me-central2`).

See [Apigee locations](https://docs.cloud.google.com/apigee/docs/locations.md.txt) for more information about available regions.
Announcement On November 10, 2023 we released an updated version of Apigee.
Deprecated As of November 10, 2023, Configurable API Proxies (preview) is no longer available. For more information, see [Configurable API Proxies (preview) deprecation](https://docs.cloud.google.com/apigee/docs/deprecations/configurable-proxies.md.txt).

## November 08, 2023

**Apigee Integrated Portal** Announcement On November 8, 2023 we released an updated version of Apigee integrated portal.
Fixed

| Bug ID | Description |
|---|---|
| 305287906 | Fixed links to an API product from the **API details** , **User account details** , or **Team details** page in the Apigee UI. |
| 307600672 | Fixed issue where the name of the documentation was not populated in the **Documentation** column on the Apigee UI, **API catalog** page. |
| 307599975 | Improved pagination through large API catalogs on the Apigee UI, **API catalog** page. |

## November 03, 2023

**Apigee X** Security On November 3, 2023, we updated the following security bulletin:

| Bug ID | Description |
|---|---|
| 304599411 | **Security bulletin updated** [GCP-2023-32](https://docs.cloud.google.com/apigee/docs/security-bulletins/security-bulletins.md.txt#gcp-2023-032) A Denial-of-Service (DoS) vulnerability was recently discovered in multiple implementations of the HTTP/2 protocol (CVE-2023-44487), including the Apigee Ingress (Anthos Service Mesh) server used by Apigee X. The vulnerability could lead to a DoS of Apigee API management functionality. |

Announcement The shutdown of the Configurable API Proxy (Preview) feature is approaching. On or after November 10, 2023, the preview feature will no longer be available. For more information, see [Configurable API proxies (preview) deprecation](https://docs.cloud.google.com/apigee/docs/deprecations/configurable-proxies.md.txt).

## November 01, 2023

**Apigee Advanced API Security** Announcement On December 6, 2024 we release an updated version of Advanced API Security.
Feature **Public preview of Advanced API Security custom profiles in the Apigee UI**

With this release, you can now create and edit [custom security profiles](https://docs.cloud.google.com/apigee/docs/api-security/security-scores.md.txt#create-and-edit-security-profiles) in the Apigee UI. Custom profiles let you specify the security categories that your security scores are based on.

The Security scores page in the Apigee UI has been renamed to the [Risk assessment](https://docs.cloud.google.com/apigee/docs/api-security/security-scores.md.txt) page, and the page now has tabs for security scores and security profiles.

## October 26, 2023

**Apigee Integrated Portal** Announcement On October 26, 2023 we released an updated version of Apigee integrated portal.
Fixed

| Bug ID | Description |
|---|---|
| 5400261 | Improve confirmation dialog text when user clicks the button to revoke an app key from the portal UI. This dialog is displayed when you: 1. Select **Apps** from the user account drop-down in the portal. 2. Click an app. 3. Click the **Revoke** button in the **API Keys** row. |

**Apigee UI** Change On October 26, 2023 we released an updated version of the Apigee UI.
Fixed

| Bug ID | Description |
|---|---|
| 287028804, 291942702 | Fixed issue where customers with a mismatched with Google Cloud project and Apigee organization ID would be presented with the Apigee welcome screen instead of the management UI in the Apigee UI in Google Cloud console. |

Breaking The above fix requires a change in permissions for users managing Apigee through the Google Cloud console with a custom role.

Custom roles must now include the `apigee.projectorganizations.get` role for users who manage Apigee organizations via the Apigee UI in Cloud console. Without this role, users see a provisioning prompt in the console rather than the standard UI actions.

See [UI-based Apigee management permissions](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/permissions.md.txt#ui-based-apigee-management-permissions) for instructions.

## October 24, 2023

**Apigee UI** Announcement On October 24, 2023 we released an updated version of the Apigee UI.
Fixed

| Bug ID | Description |
|---|---|
| 301458133 | Fixed an issue in which saving a previously deployed proxy or shared flow revision resulted in the error "revision *revision_name* is immutable." You are now prompted to create a new revision in this case. |

**Apigee X** Feature With this release, the `HeaderName` element is available as a child element of `Authentication`. This element appears in the [ServiceCallout](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/service-callout-policy.md.txt#authentication) and [ExternalCallout](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/external-callout-policy.md.txt) policies, and in the [TargetEndpoint proxy configuration](https://docs.cloud.google.com/apigee/docs/api-platform/reference/api-proxy-configuration-reference.md.txt#authentication-element-usage).

By default, when an `Authentication` configuration is present, Apigee generates and injects a bearer token into the `Authorization` header, in the message sent to the target system. The new `HeaderName` element allows the configuration to specify the name of a different header to hold that bearer token.
Fixed

| Bug ID | Description |
|---|---|
| **294293907** | **Fixed issue with Google authentication for gRPC-based target servers.** |
| **292454825** | **Fixed issue causing Null Pointer Exception when creating or updating an API product.** |
| **291784631** | **Implemented fix to permit the use of hyphens (-) in flow variables used to define target URLs in `<HTTPTargetConnection>`.** |
| **267229604** | **Fixed issue where updates to a TLS truststore reference were not reflected for in-use southbound target server connections.** |
| **277353680** | **Fixed issue causing target server `HealthMonitors` to continue beyond revision or deletion of the proxy.** Target health checks are now terminated as soon as the proxy is removed from the runtime (undeployed or deleted). **Note**: There may be a delay between removal of the proxy and termination of the target server health checks. |
| **N/A** | **Upgraded infrastructure and libraries.** |

Announcement On October 24, 2023, we released an updated version of Apigee (1-11-0-apigee-7).

**Note**: Rollouts of this release to production instances will begin within two business days and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

## October 19, 2023

**Apigee Integration** Announcement The maximum memory available for script evaluation in the [Data Transformer Script task](https://docs.cloud.google.com/apigee/docs/api-platform/integration/configure-data-transformer-script-task) is 300 MB. For the list of all the applicable limits, see [Quotas and Limits](https://docs.cloud.google.com/apigee/docs/api-platform/integration/system-limits).
**Apigee X** Announcement On October 19, 2023, we released an updated version of Apigee
Feature **Looker Studio Integration**

This release includes the public preview of [Looker Studio Integration](https://docs.cloud.google.com/apigee/docs/api-platform/analytics/looker), which connects Apigee data to Google's [Looker Studio](https://docs.cloud.google.com/looker-studio). Looker Studio is a powerful and flexible tool that you can use to display Apigee data in fully customizable dashboards and reports.

## October 17, 2023

**Apigee hybrid** 1.10.3-hotfix.3 Announcement

### hybrid v1.10.3-hotfix.3

On October 17, 2023 we released an updated version of the Apigee hybrid software, v1.10.3-hotfix.3.

- To install the hotfix, follow the instructions in [Upgrading Apigee hybrid to version 1.10](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/upgrade.md.txt#install-hotfix-3).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/big-picture.md.txt).

> [!NOTE]
> **Note:** This hotfix installs the `cassandra-backup-utility`, `apigee-ingress-gateway`, and `apigee-operator` container images. All other container images are unchanged from Hybrid v1.10.3.

Fixed

| Bug ID | Description |
|---|---|
| **303292806** | **Set backup utility to only connect to Cassandra server pods in the `apigee` namespace.** |
| **300542690** | **Added dedicated service accounts for Apigee Connect, Redis, and UDCA to prevent Kubernetes from automatically injecting credentials for a specified ServiceAccount or the default ServiceAccount.** |

## October 13, 2023

**Apigee X** Announcement On October 13, 2023, we released an updated version of Apigee (1-11-0-apigee-6).
Security

| Bug ID | Description |
|---|---|
| 304681330 | **Security fix for apigee-ingress.** This addresses the following vulnerability: [CVE-2023-44487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44487) |
| 305127632 | **Security bulletin published.** [GCP-2023-032](https://docs.cloud.google.com/apigee/docs/security-bulletins/security-bulletins.md.txt#gcp-2023-032) |

Issue **Description**

A Denial-of-Service (DoS) vulnerability was recently discovered in multiple implementations of the HTTP/2 protocol ([CVE-2023-44487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44487)), including the Apigee Ingress (Anthos Service Mesh) server used by Apigee X. The vulnerability could lead to a DoS of Apigee API management functionality.

**Affected Products**

Deployments of Apigee X that are accessible through a Google Cloud Network Load Balancer (Layer 4), or a custom layer 4 load balancer, are affected. A hotfix is being applied to all Apigee X instances. Your Apigee X instances will be automatically updated within the next few days.

**Unaffected products**

Apigee X instances which are accessed only via Google Cloud Application Load Balancers (Layer 7) are not affected. This includes deployments that have HTTP/2 enabled for gRPC proxies.

**What Should I Do?**

All Apigee X instances will be automatically updated within the next few days. Customers do not need to take any actions.

**What Vulnerabilities Are Addressed By These Patches?**

The vulnerability, [CVE-2023-44487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44487), allows an attacker to execute a denial-of-service attack on Apigee ingresses.
**Apigee hybrid** 1.10.3-hotfix.2 \& 1.9.4-hotfix.1 Announcement

### hybrid v1.10.3-hotfix.2

On October 13, 2023 we released an updated version of the Apigee hybrid software, v1.10.3-hotfix.2.

- To install the hotfix, follow the instructions in [Upgrading Apigee hybrid to version 1.10](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/upgrade.md.txt#install-hotfix-2).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/big-picture.md.txt).

> [!NOTE]
> **Note:** This hotfix installs the `apigee-ingress` container image. All other container images are unchanged from Hybrid v1.10.3.

Security

| Bug ID | Description |
|---|---|
| 304681330 | **Security fix for apigee-ingress.** This addresses the following vulnerability: [CVE-2023-44487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44487) |
| 305127632 | **Security bulletin published.** [GCP-2023-032](https://docs.cloud.google.com/apigee/docs/security-bulletins/security-bulletins.md.txt#gcp-2023-032) |

Announcement

### hybrid v1.9.4-hotfix.1

On October 13, 2023 we released an updated version of the Apigee hybrid software, v1.9.4-hotfix.1.

- To install the hotfix, follow the instructions in [Upgrading Apigee hybrid to version 1.9](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/upgrade.md.txt#install-hotfix).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/big-picture.md.txt).

> [!NOTE]
> **Note:** This hotfix installs the `apigee-ingress` container image. All other container images are unchanged from Hybrid v1.9.4.

Security

| Bug ID | Description |
|---|---|
| 304681330 | **Security fix for apigee-ingress.** This addresses the following vulnerability: [CVE-2023-44487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44487) |
| 305127632 | **Security bulletin published.** [GCP-2023-032](https://docs.cloud.google.com/apigee/docs/security-bulletins/security-bulletins.md.txt#gcp-2023-032) |

Issue **Description**

A Denial-of-Service (DoS) vulnerability was recently discovered in multiple implementations of the HTTP/2 protocol ([CVE-2023-44487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44487)), including the Apigee Ingress (Anthos Service Mesh) server used by Apigee hybrid. The vulnerability could lead to a DoS of Apigee API management functionality.

**Affected Products**

Apigee hybrid instances that allow HTTP/2 requests to reach the Apigee Ingress are affected. Customers should verify if the load balancers fronting their Apigee hybrid ingresses allow for HTTP/2 requests to reach the Apigee Ingress service.

**What Should I Do?**

Apigee hybrid customers will need to upgrade to one of the following patch versions:

- [v1.10.3-hotfix.2](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v1103-hotfix2) which will be released by Friday, October 13, 2023
- [v1.9.4-hotfix.1](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#hybrid_v194-hotfix1) which will be released by Friday, October 13, 2023

**What Vulnerabilities Are Addressed By These Patches?**

The vulnerability, [CVE-2023-44487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44487), allows an attacker to execute a denial-of-service attack on Apigee ingresses.

## October 10, 2023

**Apigee Integration** Feature The following new [data transformer functions](https://docs.cloud.google.com/apigee/docs/api-platform/integration/data-mapping-functions-reference) are available:

- [Manifest XML](https://docs.cloud.google.com/apigee/docs/api-platform/integration/data-mapping-functions-reference#manifest-xml) - Converts the specified input JSON object into an XML string.

- [Parse XML](https://docs.cloud.google.com/apigee/docs/api-platform/integration/data-mapping-functions-reference#parse-xml) - Parses the specified input XML string into a JSON object.

Feature **IAM Conditions for fine-grained access**

[IAM Conditions](https://docs.cloud.google.com/iam/docs/conditions-overview.md.txt) lets you define and enforce conditional, attribute-based access control for Google Cloud resources, including Application Integration resources. For more information, see [Add IAM conditions](https://docs.cloud.google.com/apigee/docs/api-platform/integration/add-iam-conditions).
Feature You can now view the detailed summary of an integration from the Integration designer. For more information, see [View integration details](https://docs.cloud.google.com/application-integration/docs/view-integration-details.md.txt).

## October 06, 2023

**Apigee Advanced API Security** Announcement On October 6, 2023, we released an updated version of Advanced API Security.
Feature **Public Preview of Advanced API Security Actions**

Advanced API Security's new [Security Actions](https://cloud.google.com/apigee/docs/api-security/security-actions) feature lets you create security actions that define how Apigee handles detected traffic. You can create the following security actions:

- *Deny* actions, which deny requests that meet specified conditions, for example, originating at an IP address that has been identified as a source of abuse.

- *Flag* actions, which let requests pass through, but add headers to requests to identify them as suspicious.

- *Allow* actions, which are used to override deny actions in specific cases when the request is trusted.

> [!NOTE]
> **Note:** At the present time, Security Actions is only available for Apigee, but not for Apigee hybrid.

## October 05, 2023

**Apigee Integrated Portal** Announcement On October 5, 2023 we released an updated version of Apigee integrated portal. This release includes general improvements to performance and availability.

## September 29, 2023

**Apigee X** Feature **Standard and extensible API proxies are [generally available (GA)](https://cloud.google.com/products/#product-launch-stages).**

Standard and extensible API proxies are generally available for use with Apigee organizations.

For more information about standard and extensible API proxies, see [API proxy types](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/understanding-apis-and-api-proxies.md.txt#proxy-types).
Feature **One click provisioning for Apigee Pay-as-you-go organizations is [generally available (GA)](https://cloud.google.com/products/#product-launch-stages).**

Simplify your onboarding experience with one click provisioning for new Pay-as-you-go organizations, using smart default configurations. To learn more, see [Provision Apigee with one click](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/one-click.md.txt).
Announcement **On September 29, 2023, we released an updated version of Apigee.**

> [!NOTE]
> **Note:** Rollouts of this release may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Feature **Apigee API Analytics add-on for Pay-as-you-go organizations is [generally available (GA)](https://cloud.google.com/products/#product-launch-stages).**

With this release, Apigee API Analytics is available as a paid add-on capability for Pay-as-you-go organizations. The add-on can be enabled in any Apigee Intermediate or Comprehensive environment. For more information, see [Manage the Apigee API Analytics add-on](https://docs.cloud.google.com/apigee/docs/api-platform/reference/manage-analytics-add-on.md.txt).
Feature **New attributes for Pay-as-you-go pricing are [generally available (GA)](https://cloud.google.com/products/#product-launch-stages).**

Apigee updated its Pay-as-you-go pricing model, making it possible for customers to onboard at a significantly reduced initial cost and right-size their ongoing expenses to usage.

To learn more about the updated Pay-as-you-go pricing experience, see [Pay-as-you-go (updated attributes) pricing overview](https://docs.cloud.google.com/apigee/docs/api-platform/reference/pay-as-you-go-updated-overview.md.txt).
Feature **New environment types are [generally available (GA)](https://cloud.google.com/products/#product-launch-stages).**

With this release, Apigee introduces three distinct environments that have access to varying degrees of Apigee capabilities and costs: Base, Intermediate, and Comprehensive.

For more information, see [Apigee Pay-as-you-go environment types](https://docs.cloud.google.com/apigee/docs/api-platform/reference/pay-as-you-go-environment-types.md.txt).
Feature **HTTPModifier and ReadPropertySet policies and templating support for message elements are [generally available (GA)](https://cloud.google.com/products/#product-launch-stages).**

The HTTPModifier policy can change an existing request or response message and provides a subset of the functionality already available in the AssignMessage policy. See [HTTPModifier policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/http-modifier-policy.md.txt).

The ReadPropertySet policy reads property sets and populates flow variables with the results. See [ReadPropertySet policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/read-property-set-policy.md.txt).

HTTPModifier and ReadPropertySet are [standard policies](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/reference-overview-policy.md.txt#policy-types). Proxies built exclusively with standard policies are called standard proxies and can be deployed to any environment type. See [Pay-as-you-go (updated attributes) pricing overview](https://docs.cloud.google.com/apigee/docs/api-platform/reference/pay-as-you-go-updated-overview.md.txt).

With this release, template support for message elements is also generally available. See [URL templating](https://docs.cloud.google.com/apigee/docs/api-platform/reference/message-template-intro.md.txt#URL-templating).
Feature **Updated pricing attributes in Subscription plans are available.**

To get started with subscription plans that include new pricing attributes (consistent with Pay-as-you-go pricing), contact your [Google Cloud sales specialist](https://docs.cloud.google.com/contact?direct=true&pre_product=apigee).

For more information, see [Apigee Subscription 2024 entitlements](https://docs.cloud.google.com/apigee/docs/api-platform/reference/subscription-entitlements.md.txt#subscription-2024-entitlements). Apigee hybrid is not available in the new subscription plan at this time.

This note is incorrect; see entry for [May 17, 2024](https://docs.cloud.google.com/apigee/docs/release/release-notes.md.txt#May_17_2024).

## September 27, 2023

**Apigee Advanced API Security** Announcement On September 27, 2023, we released an updated version of Advanced API Security.
Feature **Public preview of Advanced API Security Alerting**

Advanced API Security's new [alerting feature](https://docs.cloud.google.com/apigee/docs/api-security/security-alerts.md.txt) lets you create alerts for events related to API security using Google Cloud Monitoring, such as changes to your security scores or incidents involving detected API abuse. You can configure alerts to send you notifications by email or other channels when these events occur, so you can take action to counteract them.

## September 25, 2023

**Apigee Advanced API Security** Announcement On September 25, 2023 we release an updated version of Advanced API Security.

> [!NOTE]
> **Note:** Rollouts of this release to production instances may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Change If a flow hook contains any [FlowCallout](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/flow-callout-policy.md.txt) policies, Advanced API Security scores now processes all policies from the shared flows that the flow callouts are pointing to for scoring. Further callout chaining is not supported.
Fixed

| Bug ID | Description |
|---|---|
| 300849647 | Fixed a bug in Security scores for proxies that don't contain any policies in the categories authorization, mediation, threat or CORS . |

**Apigee UI** Announcement On September 25, 2023, we released an updated version of the Apigee UI.
Feature This release includes a new **Overview** page for Apigee API Management in the Google Cloud console.

From the **Overview** page, you can:

- [Get started as a new Apigee user](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/ui-overview.md.txt#new-user)
- [Test your Apigee runtime](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/ui-overview.md.txt#test-runtime)
- [View key resource usage metrics](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/ui-overview.md.txt#view-usage)
- [Explore Apigee API management features](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/ui-overview.md.txt#explore-nav)

For more information, see [UI overview](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/ui-overview.md.txt).

## September 22, 2023

**Apigee Integration** Feature **Vertex AI - Predict task**

Starting with this release, Apigee Integration provides the [Vertex AI - Predict task](https://docs.cloud.google.com/apigee/docs/api-platform/integration/gcp-tasks/configure-vertex-ai-predict-task) that lets you perform online predictions on your ML models.

## September 20, 2023

**Apigee Integration** Announcement [Application Integration](https://docs.cloud.google.com/application-integration/docs/overview.md.txt) is now available for your Google Cloud project. You can now use both Apigee Integration and Application Integration within the same Google Cloud project. For more information, see [Using Application Integration](https://docs.cloud.google.com/apigee/docs/api-platform/integration/using-application-integration.md.txt).

## September 19, 2023

**Apigee UI** Announcement On September 19, 2023, we released an updated version of the Apigee UI.
Feature **GA release of the Apigee UI in Cloud console**

This is the GA release of the [Apigee UI in Cloud](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/ui-overview.md.txt) console, a new version of the Apigee UI that is integrated with the Google Cloud console. The new UI makes it easier to use Apigee, while also performing related tasks in the Cloud console.
**Apigee X** Security

| Bug ID | Description |
|---|---|
| **296506425, 295936113, 295925991, 295688738, 296110120, 281112632** | **Security fix for `apigee-runtime`.** This addresses the following vulnerabilities: - [CVE-2023-2976](https://nvd.nist.gov/vuln/detail/CVE-2023-2976) - [CVE-2023-3635](https://nvd.nist.gov/vuln/detail/CVE-2023-3635) - [CVE-2020-8908](https://nvd.nist.gov/vuln/detail/CVE-2020-8908) - [CVE-2022-34169](https://nvd.nist.gov/vuln/detail/CVE-2022-34169) - [CVE-2023-28867](https://nvd.nist.gov/vuln/detail/CVE-2023-28867) - [CVE-2022-37734](https://nvd.nist.gov/vuln/detail/CVE-2022-37734) |
| **287218068** | **Fixed security vulnerability to prevent header injection using flow variables.** |

Fixed

| Bug ID | Description |
|---|---|
| **296296456** | **Implemented fix to ensure that `continueOnError` is honored in the SpikeArest policy.** |
| **229615887** | **The flow variable `target.scheme` is now set consistently with the target server URL.** |
| **78106145** | **Fixed issue in the RegularExpressionProtection policy to ensure that multiple JSONPaths elements in a JSON payload are checked.** |
| **294090782** | **Implemented fix to allow the Apigee runtime to connect to a target server using a wildcard CNAME that references a wildcard A record.** |
| **285592278** | **Fixed issue with deduction of recurring fees from prepaid balances.** This note is incorrect; see entry for [March 26, 2024](https://cloud.google.com/apigee/docs/release/release-notes#March_26_2024). |
| **N/A** | **Upgraded infrastructure and libraries.** |

Announcement On September 19, 2023, we released an updated version of Apigee X (1-11-0-apigee-5).

> [!NOTE]
> **Note:** This release replaces Apigee X (1-11-0-apigee-3). Rollouts of this release to production instances will begin within two business days and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

## September 18, 2023

**Apigee UI** Feature This release includes improvements to the **Create Environment** experience in the Apigee UI in the Cloud console.

With this release, users can create a new environment, attach the environment to an Apigee instance, and assign the environment to an environment group within the same creation flow.

In addition, users can edit or remove environment group assignments from the environment detail page in the Apigee UI, simplifying management of their Apigee implementation.

For more information, see [Working with environments](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/environments-working-with.md.txt).
Announcement On September 18, 2023, we released an updated version of the Apigee UI.

## September 14, 2023

**Apigee hybrid** 1.10.3-hotfix.1 Announcement

### hybrid 1.10.3-hotfix.1

On September 14, 2023 we released an updated version of the Apigee hybrid software, 1.10.3-hotfix.1.

- To install the hotfix, follow the instructions in [Install 1.10.3-hotfix.1](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/upgrade.md.txt#install-hotfix).
- For new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/big-picture.md.txt) and then apply the hotfix to the new installation with the instructions in [Install 1.10.3-hotfix.1](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/upgrade.md.txt#install-hotfix).

> [!NOTE]
> **Note:** This hotfix installs the `apigee-runtime` container image. All other container images are unchanged from Hybrid v1.10.3.

Fixed

| Bug ID | Description |
|---|---|
| **205666368** | **Fixed issue with default validation of TLS target endpoint certificates.** To enable strict SSL on southbound connections to a proxy target endpoint, add the tag `<Enforce>true</Enforce>` in the target `<SSLInfo>` block. See [About setting TLS options in a target endpoint or target server](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/options-configuring-tls.md.txt#about-setting-tls-options-in-a-target-endpoint-target-server). See also [Known Issue #205666368](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt#205666368). |

## September 07, 2023

**Apigee Integrated Portal** Announcement On September 7, 2023 we released an updated version of Apigee integrated portal. This release includes general improvements to performance and availability.

## August 31, 2023

**Apigee hybrid** v1.10.3 Announcement

### hybrid v1.10.3

On August 31, 2023 we released an updated version of the Apigee hybrid software, v1.10.3.

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.10](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/big-picture.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **295929616** | **Installation of Hybrid 1.10.x would fail on OpenShift due to out of memory issues.** |
| **292571089** | **An error with support for CSI backup and restore for Cassandra was fixed.** |
| **287321226** | **Security context has been corrected for `apigee-prom-prometheus` to avoid privilege escalation.** |

Security

| Bug ID | Description |
|---|---|
| **296717665, 296717664, 296717663, 296717662, 296717185, 296716666, 296716649, 296716632, 296716468, 296716467, 296716232, 296715152, 296715151, 296714218** | **Security fixes for `apigee-cassandra-backup-utility`.** This addresses the following vulnerabilities: - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538) - [CVE-2023-24537](https://nvd.nist.gov/vuln/detail/CVE-2023-24537) - [CVE-2023-24536](https://nvd.nist.gov/vuln/detail/CVE-2023-24536) - [CVE-2023-24534](https://nvd.nist.gov/vuln/detail/CVE-2023-24534) - [CVE-2022-41725](https://nvd.nist.gov/vuln/detail/CVE-2022-41725) - [CVE-2022-41724](https://nvd.nist.gov/vuln/detail/CVE-2022-41724) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) |
| **297938600, 297938559, 297938486, 294892344** | **Security fixes for `apigee-diagnostics-collector`.** This addresses the following vulnerabilities: - [CVE-2023-1436](https://nvd.nist.gov/vuln/detail/CVE-2023-1436) - [CVE-2022-45693](https://nvd.nist.gov/vuln/detail/CVE-2022-45693) - [CVE-2022-45685](https://nvd.nist.gov/vuln/detail/CVE-2022-45685) - [CVE-2022-40150](https://nvd.nist.gov/vuln/detail/CVE-2022-40150) |
| **297938498, 297938487** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2023-2650](https://nvd.nist.gov/vuln/detail/CVE-2023-2650) - [CVE-2023-0464](https://nvd.nist.gov/vuln/detail/CVE-2023-0464) |
| **296719459, 296719400, 296719348, 296719307, 296719306, 296719188, 296719187, 296719186, 296719115, 296719018, 296718937, 296718918, 296718917, 296718916, 296716670, 296716669, 296716472, 296716471, 296715155** | **Security fixes for `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538) - [CVE-2023-24537](https://nvd.nist.gov/vuln/detail/CVE-2023-24537) - [CVE-2023-24536](https://nvd.nist.gov/vuln/detail/CVE-2023-24536) - [CVE-2023-24534](https://nvd.nist.gov/vuln/detail/CVE-2023-24534) - [CVE-2022-41725](https://nvd.nist.gov/vuln/detail/CVE-2022-41725) - [CVE-2022-41724](https://nvd.nist.gov/vuln/detail/CVE-2022-41724) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) - [CVE-2022-41715](https://nvd.nist.gov/vuln/detail/CVE-2022-41715) - [CVE-2022-32190](https://nvd.nist.gov/vuln/detail/CVE-2022-32190) - [CVE-2022-2880](https://nvd.nist.gov/vuln/detail/CVE-2022-2880) - [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664) - [CVE-2022-2879](https://nvd.nist.gov/vuln/detail/CVE-2022-2879) |
| **296717666, 296717283, 296716668, 296716667, 296716650, 296716635, 296716634, 296716633, 296716470, 296716234, 296715734, 296715733, 296715154, 296715153** | **Security fixes for `apigee-hybrid-cassandra-client`.** This addresses the following vulnerabilities: - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538) - [CVE-2023-24537](https://nvd.nist.gov/vuln/detail/CVE-2023-24537) - [CVE-2023-24536](https://nvd.nist.gov/vuln/detail/CVE-2023-24536) - [CVE-2023-24534](https://nvd.nist.gov/vuln/detail/CVE-2023-24534) - [CVE-2022-41725](https://nvd.nist.gov/vuln/detail/CVE-2022-41725) - [CVE-2022-41724](https://nvd.nist.gov/vuln/detail/CVE-2022-41724) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) |
| **297286274** | **Security fixes for `apigee-installer`.** This addresses the following vulnerabilities: - [CVE-2023-39533](https://nvd.nist.gov/vuln/detail/CVE-2023-39533) - [CVE-2023-29409](https://nvd.nist.gov/vuln/detail/CVE-2023-29409) - [CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406) - [CVE-2023-2253](https://nvd.nist.gov/vuln/detail/CVE-2023-2253) |
| **295936113** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerability: - [CVE-2023-3635](https://nvd.nist.gov/vuln/detail/CVE-2023-3635) |
| **297938441** | **Security fixes for `apigee-runtime`.** This addresses the following vulnerabilities: - [CVE-2023-1370](https://nvd.nist.gov/vuln/detail/CVE-2023-1370) - [CVE-2021-31684](https://nvd.nist.gov/vuln/detail/CVE-2021-31684) |
| **294906706** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2023-28842](https://nvd.nist.gov/vuln/detail/CVE-2023-28842) - [CVE-2023-28841](https://nvd.nist.gov/vuln/detail/CVE-2023-28841) - [CVE-2023-28840](https://nvd.nist.gov/vuln/detail/CVE-2023-28840) - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538) - [CVE-2023-24537](https://nvd.nist.gov/vuln/detail/CVE-2023-24537) - [CVE-2023-24536](https://nvd.nist.gov/vuln/detail/CVE-2023-24536) - [CVE-2023-24534](https://nvd.nist.gov/vuln/detail/CVE-2023-24534) - [CVE-2023-24532](https://nvd.nist.gov/vuln/detail/CVE-2023-24532) - [CVE-2022-46146](https://nvd.nist.gov/vuln/detail/CVE-2022-46146) - [CVE-2022-41725](https://nvd.nist.gov/vuln/detail/CVE-2022-41725) - [CVE-2022-41724](https://nvd.nist.gov/vuln/detail/CVE-2022-41724) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) - [CVE-2022-41721](https://nvd.nist.gov/vuln/detail/CVE-2022-41721) - [CVE-2022-41717](https://nvd.nist.gov/vuln/detail/CVE-2022-41717) - [CVE-2022-32149](https://nvd.nist.gov/vuln/detail/CVE-2022-32149) |
| **293925856** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerabilities: - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538) - [CVE-2023-24537](https://nvd.nist.gov/vuln/detail/CVE-2023-24537) - [CVE-2023-24536](https://nvd.nist.gov/vuln/detail/CVE-2023-24536) - [CVE-2023-24534](https://nvd.nist.gov/vuln/detail/CVE-2023-24534) - [CVE-2023-24532](https://nvd.nist.gov/vuln/detail/CVE-2023-24532) - [CVE-2022-41725](https://nvd.nist.gov/vuln/detail/CVE-2022-41725) - [CVE-2022-41724](https://nvd.nist.gov/vuln/detail/CVE-2022-41724) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) - [CVE-2022-41717](https://nvd.nist.gov/vuln/detail/CVE-2022-41717) - [CVE-2022-41715](https://nvd.nist.gov/vuln/detail/CVE-2022-41715) - [CVE-2022-32190](https://nvd.nist.gov/vuln/detail/CVE-2022-32190) - [CVE-2022-32149](https://nvd.nist.gov/vuln/detail/CVE-2022-32149) - [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664) - [CVE-2022-27191](https://nvd.nist.gov/vuln/detail/CVE-2022-27191) - [CVE-2022-2880](https://nvd.nist.gov/vuln/detail/CVE-2022-2880) - [CVE-2022-2879](https://nvd.nist.gov/vuln/detail/CVE-2022-2879) |

## August 25, 2023

**Apigee Advanced API Security** Announcement On August 25, 2023, we released an updated version of Apigee Advanced API Security.
Feature This release includes [custom profiles](https://docs.cloud.google.com/apigee/docs/api-security/security-scores.md.txt#custom-security-profile) for Advanced API Security scores. Custom profiles let you specify the security categories you want your security scores to be based on. In this release, you must create a security profile in the [security scores API](https://docs.cloud.google.com/apigee/docs/api-security/security-scores-api.md.txt#use-a-custom-security-profile). However, you can view scores for the profile in the [security scores UI](https://docs.cloud.google.com/apigee/docs/api-security/security-scores.md.txt).

## August 15, 2023

**Apigee X** Security

| Bug ID | Description |
|---|---|
| **281112632, 294892189** | **Security fix for `apigee-runtime`.** This addresses the following vulnerability: - [CVE-2023-28867](https://nvd.nist.gov/vuln/detail/CVE-2023-28867) - [CVE-2022-37734](https://nvd.nist.gov/vuln/detail/CVE-2022-37734) - [CVE-2023-2976](https://nvd.nist.gov/vuln/detail/CVE-2023-2976) |
| **294891556** | **Security fix for `apigee-emulator`, `apigee-mock-server`, and `apigee-runtime`.** This addresses the following vulnerability: - [CVE-2021-31684](https://nvd.nist.gov/vuln/detail/CVE-2021-31684) |
| **287207717** | **Fixed sandbox bypass vulnerability.** |
| **286993631** | **Fixed message template injection vulnerability.** |

Fixed

| Bug ID | Description |
|---|---|
| **155498623** | **`XPaths` in `maskconfigs` now mask values with special characters.** |
| **291746838** | **Implemented fix to prevent service callouts from overwriting timeouts on clients used by other policies or target endpoints.** |
| **274663992** | **Fixed issue in AccessControl policy to avoid race condition.** |
| **294441215** | **Implemented fix to resolve quota count in the Quota policy.** |
| **287659763** | **Fixed issue causing incorrect target endpoint URLs to display in debug sessions.** |
| **283285631** | **Fixed issue where base environment debug sessions were not recorded for Pay-as-you-go (updated attributes) organizations.** |
| **196216798** | **Fixed issue with access to monetization flow variables in the post client flow.** |
| **N/A** | **Upgraded infrastructure and libraries.** |

Announcement On August 15, 2023, we released an updated version of Apigee X (1-11-0-apigee-1).

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

## August 14, 2023

**Apigee X** Announcement On August 14, 2023, we released an updated version of Apigee X.

> [!NOTE]
> **Note:** The changes in this release only apply to the [Apigee UI in Cloud console](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/ui-overview.md.txt), but not to the classic Apigee UI.

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Feature This release includes a major redesign of the Advanced API [Security scores](https://docs.cloud.google.com/apigee/docs/api-security/security-scores.md.txt) page in the Apigee UI in Cloud console. The Security scores page now:

- Highlights the top recommendations for improving security scores.
- Links directly to the Apigee UI [Proxy Editor](https://docs.cloud.google.com/apigee/docs/api-platform/develop/ui-edit-proxy.md.txt) and [Target Server](https://docs.cloud.google.com/apigee/docs/api-platform/deploy/load-balancing-across-backend-servers.md.txt) tabs , where you can implement recommended changes to your API proxies and target servers.

## August 09, 2023

**Apigee X** Announcement The Apigee documentation site navigation has been updated to be more consistent with other Google Cloud product documentation sites. The changes include:

- Added a new [**Overview**](https://docs.cloud.google.com/apigee/docs.md.txt) tab that provides links to Apigee documentation, training and tutorials, use cases, and videos.
- Moved the **Getting started** tab content to the [**Guides**](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/what-apigee.md.txt) tab.

> [!NOTE]
> **Note:** While the location of some content in the site's table of contents has changed, page URLs are unchanged. Internal links and any bookmarks you may have created remain unchanged.

## August 07, 2023

**Apigee X** Fixed

| Bug ID | Description |
|---|---|
| N/A | **Upgraded infrastructure and libraries.** |

Announcement On August 7, 2023, we released an updated version of Apigee X (1-10-0-apigee-7).

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

## August 03, 2023

**Apigee Advanced API Security** Announcement On August 3, 2023, we released an updated version of Apigee Advanced API Security.

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Change Previously, [Advanced API Security scores](https://cloud.google.com/apigee/docs/api-security/security-scores) didn't evaluate proxies calling shared flows via flow hooks and the [FlowCallout](https://cloud.google.com/apigee/docs/api-platform/reference/policies/flow-callout-policy) policy in the proxy. With this release, security scores take into account proxies calling shared flows this way. As a result, your security scores may change because they now factor in the shared flows in the environment.
**Apigee X** Announcement On August 3, 2023, we released an updated version of Apigee X.

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Change Previously, [Advanced API Security scores](https://docs.cloud.google.com/apigee/docs/api-security/security-scores.md.txt) didn't evaluate proxies calling shared flows via flow hooks and the [FlowCallout](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/flow-callout-policy.md.txt) policy in the proxy. With this release, security scores take into account proxies calling shared flows this way. As a result, your security scores may change because they now factor in the shared flows in the environment.

## July 31, 2023

**Apigee hybrid** v1.10.2 Announcement

### hybrid v1.10.2

On July 31, 2023 we released an updated version of the Apigee hybrid software, v1.10.2.

- To install the hotfix, follow the instructions in [Upgrading Apigee hybrid to version 1.10](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/big-picture.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **292118812** | **Fixed UDCA regression in Hybrid 1.10.1 where UDCA would ignore forward proxy configuration.** |
| **205666368** | **Fixed issue with default validation of TLS target endpoint certificates.** To enable strict SSL on southbound connections to a proxy target endpoint, add the tag `<Enforce>true</Enforce>` in the target `<SSLInfo>` block. See [About setting TLS options in a target endpoint or target server](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/options-configuring-tls.md.txt#about-setting-tls-options-in-a-target-endpoint-target-server). See also [Known Issue #205666368](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt#205666368). |
| **158132963** | **Added improvements to capture relevant target flow variables in trace and analytics in case of target timeouts.** |

Security

| Bug ID | Description |
|---|---|
| **293348130** | **Security fixes for `apigee-udca`.** This addresses the following vulnerabilities: - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538) - [CVE-2022-32149](https://nvd.nist.gov/vuln/detail/CVE-2022-32149) - [CVE-2023-24536](https://nvd.nist.gov/vuln/detail/CVE-2023-24536) - [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664) - [CVE-2022-41721](https://nvd.nist.gov/vuln/detail/CVE-2022-41721) - [CVE-2023-24534](https://nvd.nist.gov/vuln/detail/CVE-2023-24534) - [CVE-2023-24537](https://nvd.nist.gov/vuln/detail/CVE-2023-24537) - [CVE-2022-41724](https://nvd.nist.gov/vuln/detail/CVE-2022-41724) - [CVE-2022-41725](https://nvd.nist.gov/vuln/detail/CVE-2022-41725) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) |
| **291994501** | **Security fixes for `apigee-operator` and `apigee-watcher`.** This addresses the following vulnerabilities: - [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538) - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2023-24534](https://nvd.nist.gov/vuln/detail/CVE-2023-24534) - [CVE-2022-41725](https://nvd.nist.gov/vuln/detail/CVE-2022-41725) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) - [CVE-2023-24536](https://nvd.nist.gov/vuln/detail/CVE-2023-24536) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2022-41724](https://nvd.nist.gov/vuln/detail/CVE-2022-41724) - [CVE-2023-24537](https://nvd.nist.gov/vuln/detail/CVE-2023-24537) - [CVE-2023-29406](https://nvd.nist.gov/vuln/detail/CVE-2023-29406) - [CVE-2023-24532](https://nvd.nist.gov/vuln/detail/CVE-2023-24532) |
| **291994501** | **Security fixes for `apigee-installer`.** This addresses the following vulnerabilities: - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-24537](https://nvd.nist.gov/vuln/detail/CVE-2023-24537) - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) - [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664) - [CVE-2023-24536](https://nvd.nist.gov/vuln/detail/CVE-2023-24536) - [CVE-2023-24534](https://nvd.nist.gov/vuln/detail/CVE-2023-24534) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2022-2879](https://nvd.nist.gov/vuln/detail/CVE-2022-2879) - [CVE-2022-41724](https://nvd.nist.gov/vuln/detail/CVE-2022-41724) - [CVE-2022-32149](https://nvd.nist.gov/vuln/detail/CVE-2022-32149) - [CVE-2022-41725](https://nvd.nist.gov/vuln/detail/CVE-2022-41725) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2022-2880](https://nvd.nist.gov/vuln/detail/CVE-2022-2880) - [CVE-2022-41715](https://nvd.nist.gov/vuln/detail/CVE-2022-41715) - [CVE-2022-41721](https://nvd.nist.gov/vuln/detail/CVE-2022-41721) - [CVE-2023-24532](https://nvd.nist.gov/vuln/detail/CVE-2023-24532) - [CVE-2022-41717](https://nvd.nist.gov/vuln/detail/CVE-2022-41717) |
| **290829031** | **Security fixes for `apigee-hybrid-cassandra`, `apigee-cassandra-client`, and `cassandra-backup-utility`.** This addresses the following vulnerabilities: - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538) - [CVE-2023-24537](https://nvd.nist.gov/vuln/detail/CVE-2023-24537) - [CVE-2023-24536](https://nvd.nist.gov/vuln/detail/CVE-2023-24536) - [CVE-2023-24534](https://nvd.nist.gov/vuln/detail/CVE-2023-24534) - [CVE-2023-24532](https://nvd.nist.gov/vuln/detail/CVE-2023-24532) - [CVE-2022-41725](https://nvd.nist.gov/vuln/detail/CVE-2022-41725) - [CVE-2022-41724](https://nvd.nist.gov/vuln/detail/CVE-2022-41724) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) - [CVE-2022-41717](https://nvd.nist.gov/vuln/detail/CVE-2022-41717) - [CVE-2022-41715](https://nvd.nist.gov/vuln/detail/CVE-2022-41715) - [CVE-2022-32190](https://nvd.nist.gov/vuln/detail/CVE-2022-32190) - [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664) - [CVE-2022-2880](https://nvd.nist.gov/vuln/detail/CVE-2022-2880) - [CVE-2022-2879](https://nvd.nist.gov/vuln/detail/CVE-2022-2879) - [CVE-2020-29511](https://nvd.nist.gov/vuln/detail/CVE-2020-29511) - [CVE-2020-29509](https://nvd.nist.gov/vuln/detail/CVE-2020-29509) |
| **290829028** | **Security fixes for Apigee Connect and `apigee-connect-agent` and `apigee-redis`.** This addresses the following vulnerabilities: - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538) - [CVE-2023-24537](https://nvd.nist.gov/vuln/detail/CVE-2023-24537) - [CVE-2023-24536](https://nvd.nist.gov/vuln/detail/CVE-2023-24536) - [CVE-2023-24534](https://nvd.nist.gov/vuln/detail/CVE-2023-24534) - [CVE-2023-24532](https://nvd.nist.gov/vuln/detail/CVE-2023-24532) - [CVE-2022-41725](https://nvd.nist.gov/vuln/detail/CVE-2022-41725) - [CVE-2022-41724](https://nvd.nist.gov/vuln/detail/CVE-2022-41724) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) - [CVE-2022-41717](https://nvd.nist.gov/vuln/detail/CVE-2022-41717) - [CVE-2022-32149](https://nvd.nist.gov/vuln/detail/CVE-2022-32149) - [CVE-2022-29526](https://nvd.nist.gov/vuln/detail/CVE-2022-29526) - [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664) - [CVE-2022-21698](https://nvd.nist.gov/vuln/detail/CVE-2022-21698) |

## July 24, 2023

**Apigee X** Announcement On July 24, 2023, we released an updated version of Apigee X.

> [!NOTE]
> **Note:** Rollouts of this release to production instances has begun and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features available until the rollout is complete.

Feature **Public preview of Apigee gRPC passthrough**

Apigee's new gRPC proxy passthrough functionality provides the ability to create proxies which receive gRPC client requests and pass them through to a gRPC target server.

For information, see [Creating gRPC API proxies](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/build-simple-api-proxy.md.txt#creating-grpc-api-proxies).

## July 21, 2023

**Apigee X** Announcement On July 21, 2023, we released an updated version of Apigee X.
Change The Advanced API Security Abuse detection [Incident details](https://docs.cloud.google.com/apigee/docs/api-security/abuse-detection.md.txt#incident-details) page now displays unique IP addresses, even if more than one incident corresponds to the same IP address. Previously, the Incident details page could display the same IP address more than once for different incidents.

Also, the **Attributes** tab of the Incident details page no longer displays the following attributes:

- **Top App Key**
- **Detected Rules**
- **Top URL**
**Apigee hybrid** v1.9.4 Announcement

### hybrid v1.9.4

On July 21, 2023 we released an updated version of the Apigee hybrid software, v1.9.4.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.9](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/big-picture.md.txt).

<br />

Fixed

| Bug ID | Description |
|---|---|
| **289254725** | **Implemented a fix to prevent failure of proxy deployments that include the OASValidation policy.** |
| **279712107** | **Added the ability to annotate apigee-ingressgateway-manager pods through overrides.yaml file.** See [`istiod.annotations`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/config-prop-ref.md.txt#istiod-annotations) for details. |
| **272212164** | **Cassandra CSI backup could clash with Azure default configuration.** The CSI backup script has been fixed to prevent a resource naming issue that could cause backups to fail. |
| **158132963** | **Added improvements to capture relevant target flow variables in trace and analytics in case of target timeouts.** |

Security

| Bug ID | Description |
|---|---|
| **290709899** | **Security fixes for `apigee-diagnostics-collector`, `apigee-mart-server`, `apigee-mint-task-scheduler`, `apigee-runtime`, and `apigee-synchronizer`.** This addresses the following vulnerability: - [CVE-2022-1471](https://nvd.nist.gov/vuln/detail/CVE-2022-1471) |
| **290829028** | **Security fixes for Apigee Connect and `apigee-connect-agent` and `apigee-redis`.** This addresses the following vulnerabilities: - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538) - [CVE-2023-24537](https://nvd.nist.gov/vuln/detail/CVE-2023-24537) - [CVE-2023-24536](https://nvd.nist.gov/vuln/detail/CVE-2023-24536) - [CVE-2023-24534](https://nvd.nist.gov/vuln/detail/CVE-2023-24534) - [CVE-2023-24532](https://nvd.nist.gov/vuln/detail/CVE-2023-24532) - [CVE-2022-41725](https://nvd.nist.gov/vuln/detail/CVE-2022-41725) - [CVE-2022-41724](https://nvd.nist.gov/vuln/detail/CVE-2022-41724) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) - [CVE-2022-41717](https://nvd.nist.gov/vuln/detail/CVE-2022-41717) - [CVE-2022-32149](https://nvd.nist.gov/vuln/detail/CVE-2022-32149) - [CVE-2022-29526](https://nvd.nist.gov/vuln/detail/CVE-2022-29526) - [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664) - [CVE-2022-21698](https://nvd.nist.gov/vuln/detail/CVE-2022-21698) |

## July 20, 2023

**Apigee X** Announcement On July 20, 2023, we released an updated version of Apigee X (1-10-0-apigee-6).

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Fixed

| Bug ID | Description |
|---|---|
| **290943249** | **Fixed latency issue between Istio and runtime container.** |
| **205666368** | **Fixed issue with default validation of TLS target endpoint certificates.** To enable strict SSL on southbound connections to a proxy target endpoint, add the tag `<Enforce>true</Enforce>` in the target `<SSLInfo>` block. For more information about using `<Enforce>true</Enforce>` in `<SSLInfo>`, see [About setting TLS options in a target endpoint or target server](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/options-configuring-tls.md.txt#about-setting-tls-options-in-a-target-endpoint-target-server). |

Security

| Bug ID | Description |
|---|---|
| **290709899** | **Security fix for `apigee-runtime`.** This addresses the following vulnerability: - [CVE-2022-1471](https://nvd.nist.gov/vuln/detail/CVE-2022-1471) |
| **N/A** | **Security fixes for `apigee-redis` and `apigee-connect-agent`.** These address the following vulnerabilities: - [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405) - [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540) - [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404) - [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538) - [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402) - [CVE-2022-41724](https://nvd.nist.gov/vuln/detail/CVE-2022-41724) - [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) - [CVE-2023-24536](https://nvd.nist.gov/vuln/detail/CVE-2023-24536) - [CVE-2022-41725](https://nvd.nist.gov/vuln/detail/CVE-2022-41725) - [CVE-2023-24534](https://nvd.nist.gov/vuln/detail/CVE-2023-24534) - [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403) - [CVE-2023-24537](https://nvd.nist.gov/vuln/detail/CVE-2023-24537) - [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400) - [CVE-2023-24532](https://nvd.nist.gov/vuln/detail/CVE-2023-24532) - [CVE-2022-41717](https://nvd.nist.gov/vuln/detail/CVE-2022-41717) |
| **N/A** | **Security fixes for `apigee-connect-agent`.** These address the following vulnerabilities: - [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664) - [CVE-2022-21698](https://nvd.nist.gov/vuln/detail/CVE-2022-21698) - [CVE-2022-32149](https://nvd.nist.gov/vuln/detail/CVE-2022-32149) - [CVE-2022-29526](https://nvd.nist.gov/vuln/detail/CVE-2022-29526) |

## July 13, 2023

**Apigee hybrid** v1.10.1 Announcement

### hybrid v1.10.1

On July 13, 2023 we released an updated version of the Apigee hybrid software, v1.10.1.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.10.1](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/big-picture.md.txt).

<br />

Fixed

| Bug ID | Description |
|---|---|
| **289254725** | **Implemented a fix to prevent failure of proxy deployments that include the OASValidation policy.** |

Security

| Bug ID | Description |
|---|---|
| **281561243** | **Security fixes for `apigee-diagnostics-collector`, `apigee-mart-server`, `apigee-mint-task-scheduler`, `apigee-runtime`, and `apigee-synchronizer`.** This addresses the following vulnerability: - [CVE-2022-1471](https://nvd.nist.gov/vuln/detail/CVE-2022-1471) |
| **290067464** | **Security fixes for `apigee-stackdriver-logging-agent`.** This addresses the following vulnerability: - [CVE-2022-32511](https://nvd.nist.gov/vuln/detail/CVE-2022-32511) |
| **290068742** | **Security fixes for `apigee-udca`.** This addresses the following vulnerability: - [CVE-2022-1471](https://nvd.nist.gov/vuln/detail/CVE-2022-1471) |
| **290065830** | **Security fixes for `apigee-udca`.** This addresses the following vulnerability: - [CVE-2022-42889](https://nvd.nist.gov/vuln/detail/CVE-2022-42889) |

## July 12, 2023

**Apigee X** Announcement On July 12, 2023, we released an updated version of Apigee X.
Feature Preview release of non-VPC peering option for Apigee provisioning
Apigee now supports a provisioning option that does not require VPC peering. With this approach, you are not required to provide networks and IP ranges during the Apigee provisioning process. Instead, you use Private Service Connect (PSC) for routing northbound traffic to Apigee and southbound traffic to target services running in your Google Cloud projects.

Non-VPC peering is supported for command-line (CLI) provisioning steps only. You can perform non-VPC provisioning for [subscription](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/install-cli-non-peered.md.txt), [Pay-as-you-go](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/install-cli-non-peered-paygo.md.txt), and [evaluation](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/install-cli-non-peered-eval.md.txt) installations of Apigee.

To learn more, see [Apigee networking options](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/networking-options.md.txt).

## July 10, 2023

**Apigee X** Announcement On July 10, 2023, we released an updated version of Apigee X (1-10-0-apigee-5).

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Security

| Bug ID | Description |
|---|---|
| 273693152 | **Fixed SAMLAssertion policy parsing to limit the number of entities that will be parsed to 10000.** Any attempt to parse more than 10000 entities will generate an error. |
| 273695718 | **Fixed DataCapture policy to avoid evaluation of external entities during XML parsing for variable collection.** |
| 273929507 | **Fixed issue with potential Java security bypass in LookupCache policy.** Certain objects which implement `PostDeserializer` interface are now cached. |
| 273950705 | **Fixed issue in PythonScript policy to prevent execution of arbitrary Java code.** With this fix, the runtime does not allow execution of python code added to a `.js` resource file. |

Fixed

| Bug ID | Description |
|---|---|
| 289254725 | **Implemented fix to prevent failure of proxy deployments that include the OASValidation policy.** |
| N/A | **Upgraded infrastructure and libraries.** |

## July 07, 2023

**Apigee Adapter for Envoy** v2.1.1 Announcement

### v2.1.1

On June 7, 2023, we released version 2.1.1 of Apigee Adapter for Envoy.
Fixed An issue was fixed where quotas were being improperly duplicated between operations instead of being shared at the Product level.

## July 06, 2023

**Apigee X** Announcement On July 6, 2023, we released an updated version of Apigee X.
Feature **Preview release of Pay-as-you-go pricing with updated attributes**

Apigee is updating its Pay-as-you-go pricing model, making it possible to start using Apigee at a significantly reduced initial cost and right-size ongoing expenses to match precise usage.

To learn how to get started with the updated Pay-as-you-go pricing experience, see [Pay-as-you-go (updated attributes) pricing overview](https://docs.cloud.google.com/apigee/docs/api-platform/reference/pay-as-you-go-updated-overview.md.txt).
Feature **Preview release of new environment types**

Apigee announces the Preview release of three distinct environment types: Base, Intermediate, and Comprehensive. Each environment type offers varying degrees of capabilities and costs; you can tailor pricing to suit your needs.

For more information, see [Apigee Pay-as-you-go environment types](https://docs.cloud.google.com/apigee/docs/api-platform/reference/pay-as-you-go-environment-types.md.txt).
Feature **Preview release of new HTTPModifier and ReadPropertySet policies and templating support for message \<URL\> elements**

Apigee announces the Preview release of the HTTPModifier and ReadPropertySet policies.

The HTTPModifier policy can change an existing request or response message and provides a subset of the functionality already available in the AssignMessage policy. See [HTTPModifier policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/http-modifier-policy.md.txt).

The ReadPropertySet policy reads property sets and populates flow variables with the results. See [ReadPropertySet policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/read-property-set-policy.md.txt).

HTTPModifier and ReadPropertySet are [standard policies](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/reference-overview-policy.md.txt#policy-types). Proxies built exclusively with standard policies are called standard proxies and can be deployed to any environment type. See [Pay-as-you-go (updated attributes) pricing overview](https://docs.cloud.google.com/apigee/docs/api-platform/reference/pay-as-you-go-updated-overview.md.txt).

This release also includes template support for message \<URL\> elements. See [URL templating](https://docs.cloud.google.com/apigee/docs/api-platform/reference/message-template-intro.md.txt#URL-templating).
Feature **Preview release of standard and extensible API proxies**

Apigee announces the Preview release of standard and extensible API proxies, available for use with preview organizations using Pay-as-you-go (updated attributes) pricing.

For more information about standard and extensible API proxies, see [API proxy types](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/understanding-apis-and-api-proxies.md.txt#proxy-types).

## June 30, 2023

**Apigee hybrid** v1.10.0 Announcement

### hybrid v1.10

On June 30, 2023 we released an updated version of the Apigee hybrid software, v1.10.0.

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.10](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/big-picture.md.txt).
Feature **Support for AppGroups (preview)**

Starting in version 1.10, Apigee hybrid supports AppGroups, which represent a relationship between one or more apps that are managed by the same set of people. For information, see [Using AppGroups to organize app ownership](https://docs.cloud.google.com/apigee/docs/api-platform/publish/organizing-client-app-ownership.md.txt#using-appgroups-to-organize-app-ownership).

AppGroups is in preview as of the Apigee hybrid 1.10 release. See the [AppGroups preview launch announcement](https://docs.cloud.google.com/apigee/docs/release/release-notes.md.txt#June_27_2023) for details.
Feature **Support for environment-level scaling**

Starting in version 1.9.3, Apigee hybrid added the following environment configuration properties that enable you to specify environment-specific scaling in the `overrides.yaml` file:

- [`envs[].runtime.replicaCountMax`](https://docs.cloud.google.com/apigee/docs/hybrid/latest/config-prop-ref#envs-runtime-max)
- [`envs[].runtime.replicaCountMin`](https://docs.cloud.google.com/apigee/docs/hybrid/latest/config-prop-ref#envs-runtime-min)
- [`envs[].synchronizer.replicaCountMax`](https://docs.cloud.google.com/apigee/docs/hybrid/latest/config-prop-ref#envs-sync-max)
- [`envs[].synchronizer.replicaCountMin`](https://docs.cloud.google.com/apigee/docs/hybrid/latest/config-prop-ref#envs-sync-min)
- [`envs[].udca.replicaCountMax`](https://docs.cloud.google.com/apigee/docs/hybrid/latest/config-prop-ref#envs-ucda-max)
- [`envs[].udca.replicaCountMin`](https://docs.cloud.google.com/apigee/docs/hybrid/latest/config-prop-ref#envs-ucda-min)

**Documentation:** [Environment-based scaling](https://docs.cloud.google.com/apigee/docs/hybrid/latest/scale-and-autoscale#environment-based-scaling)
Feature **Automated Issue Surfacing (AIS)**

Starting with Apigee hybrid 1.10, Apigee hybrid offers a new tool that examines the hybrid runtime and surfaces issues by running a `kubectl` command. If the tool detects errors in the cluster, it returns a detailed error message. The error message contains a link to the troubleshooting guide for that specific error. See [Automated issue surfacing](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/automated-issue-surfacing.md.txt) and [Configuration property reference, `watcher`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/config-prop-ref.md.txt#watcher).
Feature **Pre-install Cluster Check Kubernetes job**

Starting in version 1.10, Apigee hybrid offers a new tool that examines the hybrid cluster before you install the hybrid runtime. See [Step 8: Check cluster readiness](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/install-check-cluster.md.txt) .
Fixed

| Bug ID | Description |
|---|---|
| **181569522** | **You can now create a new environment with the same name as a deleted environment without needing to perform manual clean-up tasks first.** (Fixed in Apigee hybrid v1.8.5 and v1.7.6) |
| **209509030** | **Apigee Ingressgateway cannot access K8s secret from another namespace.** |
| **218567150** | **The ingress gateway is now configured to consistently preserve UUID in the x-request-id header.** **Note:** This setting does have some impact on tracing in the ingress gateway. For more information, see *pack_trace_reason* in ["UUID (proto)"](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/request_id/uuid/v3/uuid.proto#extensions-request-id-uuid-v3-uuidrequestidconfig) in the envoy documentation. (Fixed in Apigee hybrid v1.7.6 and v1.8.3) |
| **223320630** | **mTLS-related client variables are now set by the Apigee runtime.** (Fixed in Apigee hybrid v1.8.6) |
| **245619397** | **In Apigee hybrid, fluentbit support now includes the `NO_PROXY` environment variable.** (Fixed in Apigee hybrid v1.8.5, v1.8.6, and v1.9.1) |
| **259264961** | **Added support for ASM v1.15.** Please see [Known issue 266452840](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt#266452840) (Fixed in Apigee hybrid v1.7.6) |
| **260342163** | **Fixed a narrow scenario where threads in runtime pods ended up consuming 100% CPU.** (Fixed in Apigee hybrid v1.9.1) |
| **260372012** | **Requests failed with 500 response and keyvaluemap.service.ErrorDuringDecryption error after upgrade to Hybrid 1.8.** **Note:** Fixed in Apigee hybrid 1.8.4 and newer. (Fixed in Apigee hybrid v1.8.5) |
| **262699558** | **The watcher component no longer fails when using Kubernetes Secret to store hybrid service account secret.** (Fixed in Apigee hybrid v1.7.6) |
| **263840644** | **Fixed a conflict with an existing ASM on the cluster.** (Fixed in Apigee hybrid v1.8.6) |
| **265374889** | **Fixed an issue where in some circumstances the Java Callout would to fail due with the following error:** *Failed to execute JavaCallout. Could not initialize class org.jose4j.jwa.AlgorithmFactoryFactory2*. (Fixed in Apigee hybrid v1.9.1) |
| **266411394** | **Add support for Azure Front Door request headers to `/healthz` health check.** (Fixed in Apigee hybrid v1.8.5 and v1.9.1) |
| **266594584** | **Websocket was failing in asm 1.15.** This was due to incompatible capitalization in variable names between the Anthos Service Mesh `overlay.yaml` file and the and the Envoy filter `apigee-envoyfilter.yaml` file. (Fixed in Apigee hybrid v1.8.5 and v1.9.1) |
| **266814873** | **In certain circumstances, retrieving encrypted KVM entries could fail with an error.** This fix ensures that MART will be able to successfully function for environment-scoped KVM entries, even if the encryption key is used in the Org Env configuration or when the keys contain non-UTF8 characters. There is no change to KVM data. (Fixed in Apigee hybrid v1.8.6 and v1.9.1) |
| **266989915 266919136** | **In some circumstances, Apigee could return incorrect developer credentials for an app, unless the specific app was selected when requesting the credentials.** (Fixed in Apigee hybrid v1.9.1) |
| **267666187** | **When using a custom Kubernetes service for the Apigee ingress gateway, you can disable the creation of a default load balancer.** See [Managing Apigee ingress gateway](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/managing-ingress.md.txt#disable-loadbalancer). (Fixed in Apigee hybrid v1.8.6 and v1.9.1) |
| **267691299 265295406** | **The Apigee controller uses a dedicated `apigee-manager` Kubernetes service account, instead of using the default SA.** (Fixed in Apigee hybrid v1.8.6 and v1.9.1) |
| **268445095** | **The `validateOrg` flag can be set to false to bypass upgrade validation errors when configuration includes HTTP Forward proxy.** You can use this to avoid upgrade errors caused by HTTP proxy settings. (Fixed in Apigee hybrid v1.7.6) |
| **268696297** | **Providing a Kubernetes secret for Cassandra and Redis components is now supported.** See [`cassandra.auth.secret`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/config-prop-ref.md.txt#cassandra-auth-secret) and [`redis.auth.secret`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/config-prop-ref.md.txt#redis-auth-secret) in the [Configuration properties reference](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/config-prop-ref.md.txt). (Fixed in Apigee hybrid v1.9.1) |
| **269451743** | **In certain circumstances, upgrading from Apigee hybrid v1.8.3 to v1.9.0 could fail with an error message when creating the virtual hosts.** (Fixed in Apigee hybrid v1.9.1) |
| **269738951** | **The example network policies are now included in the `apigeectl/examples/network-policies` directory.** see [Configuring Kubernetes network policies](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/kubernetes-network-policies.md.txt). (Fixed in Apigee hybrid v1.9.1) |
| **270371160** | **In Apigee hybrid v1.8.7, we removed certain insecure TLS ciphers.** Apigee hybrid supports the TLS cipher suites supported by the [Boring FIPS build of Envoy](https://www.envoyproxy.io/docs/envoy/v1.21.5/api-v3/extensions/transport_sockets/tls/v3/common.proto.html). You can now specify specific cipher suites with the [`virtualhosts.cipherSuites` configuration property](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/config-prop-ref.md.txt#virtualhosts) in your overrides. (Fixed in Apigee hybrid v1.8.7) **Note**: Apigee hybrid only supports the RSA ciphers listed. ECDSA ciphers are not supported. |
| **270371160** | **In Apigee hybrid v1.9.0, we removed certain insecure TLS ciphers.** Apigee hybrid supports the TLS cipher suites supported by the [Boring FIPS build of Envoy](https://www.envoyproxy.io/docs/envoy/v1.21.5/api-v3/extensions/transport_sockets/tls/v3/common.proto.html). You can now specify specific cipher suites with the [`virtualhosts.cipherSuites` configuration property](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/config-prop-ref.md.txt#virtualhosts) in your overrides. (Fixed in Apigee hybrid v1.9.2) **Note**: Apigee hybrid only supports the RSA ciphers listed. ECDSA ciphers are not supported. |
| **271266079** | **Removed port 80 from the default Kubernetes service of Apigee Ingress Gateway.** (Fixed in Apigee hybrid v1.8.6 and v1.9.1) |
| **272212164** | **Cassandra CSI backup could clash with Azure default configuration.** The CSI backup script has been fixed to prevent a resource naming issue that could cause backups to fail. (Fixed in Apigee hybrid v1.9.4 and v1.10.0) |
| **273561434** | **Some projects were unable to run debug sessions.** (Fixed in Apigee hybrid v1.8.8 and v1.9.3) |
| **274292101** | **In certain circumstances, environment-scoped KVMs in hybrid could cause rollback issues for MART.** (Fixed in Apigee hybrid v1.8.6) |
| **274999014** | **Restrict watcher RBAC to a single K8s namespace** |
| **278646149** | **In certain circumstances, the `logger.livenessProbe.timeoutSeconds` configuration property was not working as expected.** See [`logger.livenessProbe.timeoutSeconds`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/config-prop-ref.md.txt#logger-livenessprobe-timeoutseconds) in the Configuration property reference. (Fixed in Apigee hybrid v1.8.7 and v1.9.2) |
| **279053612** | **`x-forwarded-client-cert` (XFCC) HTTP headers handled with the `istiod.forwardClientCertDetails` configuration property.** (Fixed in Apigee hybrid v1.8.7 and v1.9.2) See the Configuration properties reference for details: - v1.8: [istiod.forwardClientCertDetails](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/config-prop-ref.md.txt#istiod-forwardclientcertdetails) - v1.9: [istiod.forwardClientCertDetails](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/config-prop-ref.md.txt#istiod-forwardclientcertdetails) |
| **279193831** | **Envoy has been updated to v1.25.6..** (Fixed in Apigee hybrid v1.8.8) |
| **279712107** | **Added the ability to annotate `apigee-ingressgateway-manager` pods through `overrides.yaml file`.** (Fixed in Apigee hybrid v1.8.8) |
| **280544499** | **Request headers were not seen in debug sessions.** (Fixed in Apigee hybrid v1.8.8) |
| **284488296** | **Removed an unneeded Workload Identity on the Cassandra Schema Validation cron job.** (Fixed in Apigee hybrid v1.8.8 and v1.9.3) |

Breaking

| Bug ID | Description |
|---|---|
| **270371160** | **In Apigee hybrid v1.9.0, we removed certain insecure TLS ciphers.** Apigee hybrid supports the TLS cipher suites supported by the Boring FIPS build of Envoy. **Note:** Apigee hybrid only supports the RSA ciphers listed. ECDSA ciphers are not supported. |
| **271266079** | **Removed port 80 from the default Kubernetes service of Apigee Ingress Gateway.** Port 80 is not supported by Apigee ingress gateway. If you are migrating from ASM to Apigee ingress gateway, and followed the instructions in the [community post](https://www.googlecloudcommunity.com/gc/Cloud-Product-Articles/Apigee-hybrid-ingress-Three-different-options-to-expose-your/ta-p/79149) to enable Port 80, it will not work with Apigee Ingress gateway. (Fixed in Apigee hybrid v1.8.6 and v1.9.1) |

Security

| Bug ID | Description |
|---|---|
| **262576079** | **Security fix for for `apigee-envoy`.** (Fixed in Apigee hybrid v1.10) This addresses the following vulnerability: - [CVE-2022-23806](https://nvd.nist.gov/vuln/detail/CVE-2022-23806) |
| **273797045** | **Security fix for for `apigee-diagnostics-collector apigee-synchronizer apigee-udca`.** (Fixed in Apigee hybrid v1.8.8) This addresses the following vulnerability: - [CVE-2021-22573](https://nvd.nist.gov/vuln/detail/CVE-2021-22573) |
| **273800345** , **281572616** | **Security fixes for `apigee-diagnostics-collector`, `apigee-mart-server`, `apigee-mint-task-scheduler`, `apigee-runtime`, `apigee-synchronizer`, and `apigee-udca`.** (Fixed in Apigee hybrid v1.8.8 and v1.9.3 This addresses the following vulnerabilities: - [CVE-2022-3510](https://nvd.nist.gov/vuln/detail/CVE-2022-3510) - [CVE-2022-3509](https://nvd.nist.gov/vuln/detail/CVE-2022-3509) - [CVE-2022-3171](https://nvd.nist.gov/vuln/detail/CVE-2022-3171) |
| **273800717** | **Security fixes for `apigee-emulator`, `apigee-diagnostics-collector`, `apigee-mart-server`, `apigee-mint-task-scheduler`, `apigee-mock-server`, `apigee-runtime`, and `apigee-synchronizer`.** (Fixed in Apigee hybrid v1.8.7 and v1.9.2) This addresses the following vulnerabilities: - [CVE-2022-46364](https://nvd.nist.gov/vuln/detail/CVE-2022-46364) - [CVE-2022-46363](https://nvd.nist.gov/vuln/detail/CVE-2022-46363) |
| **273800965** | **Security fix for `apigee-diagnostics-collector`, `apigee-mart-server`, `apigee-mint-task-scheduler`, `apigee-runtime`, and `apigee-synchronizer`.** (Fixed in Apigee hybrid v1.8.7, v1.9.2, and v1.9.3) This addresses the following vulnerability: - [CVE-2019-10172](https://nvd.nist.gov/vuln/detail/CVE-2019-10172) |
| **273801301** | **Security fixes for `apigee-mart-server` and `apigee-runtime`.** (Fixed in Apigee hybrid v1.8.8 and v1.9.3) This addresses the following vulnerability: - [CVE-2020-13936](https://nvd.nist.gov/vuln/detail/CVE-2020-13936) |
| **274112103** | **Security fixes to the Apigee Controller and Apigee Watcher.** (Fixed in Apigee hybrid v1.8.6 and v1.9.1) This addresses the following vulnerabilities: - [CVE-2022-1996](https://nvd.nist.gov/vuln/detail/CVE-2022-1996) - [CVE-2022-27191](https://nvd.nist.gov/vuln/detail/CVE-2022-27191) - [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664) - [CVE-2022-32149](https://nvd.nist.gov/vuln/detail/CVE-2022-32149) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) |
| **275002360** | **Security fixes for `fluent-bit`.** (Fixed in Apigee hybrid v1.8.6 and v1.9.1) This addresses the following vulnerabilities: - [CVE-2021-46848](https://nvd.nist.gov/vuln/detail/CVE-2021-46848) - [CVE-2022-1304](https://nvd.nist.gov/vuln/detail/CVE-2022-1304) - [CVE-2022-2097](https://nvd.nist.gov/vuln/detail/CVE-2022-2097) - [CVE-2022-42898](https://nvd.nist.gov/vuln/detail/CVE-2022-42898) |
| **277367440** | **Security fixes for Apigee Controller, Watcher, and `apigeectl`.** (Fixed in Apigee hybrid v1.8.7 and v1.9.2) This addresses the following vulnerabilities: - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) - [CVE-2022-41717](https://nvd.nist.gov/vuln/detail/CVE-2022-41717) - [CVE-2022-28948](https://nvd.nist.gov/vuln/detail/CVE-2022-28948) |
| **278313047** | **Security fixes for `apigee-stackdriver-logging-agent`.** (Fixed in Apigee hybrid v1.9.2) This addresses the following vulnerabilities: - [CVE-2022-32511](https://nvd.nist.gov/vuln/detail/CVE-2022-32511) - [CVE-2022-29181](https://nvd.nist.gov/vuln/detail/CVE-2022-29181) - [CVE-2022-24836](https://nvd.nist.gov/vuln/detail/CVE-2022-24836) - [CVE-2022-0759](https://nvd.nist.gov/vuln/detail/CVE-2022-0759) - [CVE-2021-41817](https://nvd.nist.gov/vuln/detail/CVE-2021-41817) - [CVE-2021-41098](https://nvd.nist.gov/vuln/detail/CVE-2021-41098) - [CVE-2021-32740](https://nvd.nist.gov/vuln/detail/CVE-2021-32740) - [CVE-2021-28965](https://nvd.nist.gov/vuln/detail/CVE-2021-28965) - [CVE-2020-8130](https://nvd.nist.gov/vuln/detail/CVE-2020-8130) - [CVE-2020-25613](https://nvd.nist.gov/vuln/detail/CVE-2020-25613) - [CVE-2019-3881](https://nvd.nist.gov/vuln/detail/CVE-2019-3881) |
| **279194142** | **Fixes build issues to achieve FIPS compliance.** (Fixed in Apigee hybrid v1.8.7 and v1.9.2) |
| **281561243** | **Security fix for `apigee-diagnostics-collector`, `apigee-mint-task-scheduler`, `apigee-runtime`, and `apigee-synchronizer`.** (Fixed in Apigee hybrid v1.8.8 and v1.9.3) This addresses the following vulnerability: - [CVE-2022-1471](https://nvd.nist.gov/vuln/detail/CVE-2022-1471) |
| **283826216** | **Security fixes for `apigee-ingressgateway`.** (Fixed in Apigee hybrid v1.9.3) This addresses the following vulnerabilities: - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) - [CVE-2022-41721](https://nvd.nist.gov/vuln/detail/CVE-2022-41721) |
| **283826785** | **Security fixes for `istiod`.** (Fixed in Apigee hybrid v1.9.3) This addresses the following vulnerabilities: - [CVE-2023-25165](https://nvd.nist.gov/vuln/detail/CVE-2023-25165) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) - [CVE-2022-41721](https://nvd.nist.gov/vuln/detail/CVE-2022-41721) - [CVE-2022-23526](https://nvd.nist.gov/vuln/detail/CVE-2022-23526) - [CVE-2022-23525](https://nvd.nist.gov/vuln/detail/CVE-2022-23525) - [CVE-2022-23524](https://nvd.nist.gov/vuln/detail/CVE-2022-23524) |

## June 27, 2023

**Apigee X** Announcement On June 27, 2023 we released an updated version of Apigee X.

> [!NOTE]
> **Note:** Rollouts of this release to production instances has begun and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Feature **Public preview of AppGroups**

Introduces the concept of AppGroups, which represent a relationship between one or more apps that are managed by the same set of people. For information, see [Using AppGroups to organize app ownership](https://docs.cloud.google.com/apigee/docs/api-platform/publish/organizing-client-app-ownership.md.txt#using-appgroups-to-organize-app-ownership).

> [!NOTE]
> **Note:** For Apigee hybrid, AppGroups and the organizations.apps API "filter" option to filter apps based on developer or AppGroup are available in hybrid 1.10.0 and later. This generic filtering option can also be used to filter apps based on developerEmail, apiProduct, consumerKey, status, appId and appName. PageSize and PageToken can be used to paginate the dataset.   
>
> Client support for AppGroups is available with the latest Drupal Teams module.   
>
Note that the purpose of this release is to support upgrades from Apigee Edge customers who used company-apps without monetization; however, it is available to any Apigee X/hybrid customer during the public preview stage.

## June 23, 2023

**Apigee Integrated Portal** Announcement On April 20, 2023 we released an updated version of Apigee integrated portal. The fix below was not reported in a release note at the time. This update corrects the record.
Fixed

| Bug ID | Description |
|---|---|
| **275578252** | **Addressed an issue where an account could be created even though the built-in identity provider (IdP) had been disabled.** For any portal with a disabled IdP, you can review the user accounts on the **Portals \> Portal name \> Accounts \> Users** page. Select an account and then change the **Status** to **Inactive** to prevent login. **Documentation:** [Deactivating user accounts](https://docs.cloud.google.com/apigee/docs/api-platform/publish/portal/api-portal-users.md.txt#deactivating_user_accounts) |

## June 20, 2023

**Apigee X** Announcement On June 20, 2023, we released an updated version of Apigee X (1-10-0-apigee-4).

> [!NOTE]
> **Note:** Rollouts of this release to production instances will begin within two business days and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Security

| Bug ID | Description |
|---|---|
| **273801301** | **Security fix for `apigee-diagnostics-collector`, `apigee-mart-server`, `apigee-runtime`, and `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2022-40150](https://nvd.nist.gov/vuln/detail/CVE-2022-40150) - [CVE-2022-40149](https://nvd.nist.gov/vuln/detail/CVE-2022-40149) <br /> |
| **281561243** | **Security fix for `apigee-diagnostics-collector`, `apigee-mart-server`, `apigee-runtime`, and `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2017-18640](https://nvd.nist.gov/vuln/detail/CVE-2017-18640) - [CVE-2022-25857](https://nvd.nist.gov/vuln/detail/CVE-2022-25857) - [CVE-2022-38751](https://nvd.nist.gov/vuln/detail/CVE-2022-38751) - [CVE-2022-38750](https://nvd.nist.gov/vuln/detail/CVE-2022-38750) - [CVE-2022-38749](https://nvd.nist.gov/vuln/detail/CVE-2022-38749) - [CVE-2022-41854](https://nvd.nist.gov/vuln/detail/CVE-2022-41854) - [CVE-2022-38752](https://nvd.nist.gov/vuln/detail/CVE-2022-38752) |

Fixed

| Bug ID | Description |
|---|---|
| 284114575 | **Implemented fix to prevent the execution of untrusted code in Apigee policies.** |
| 279092925 | **Modified Cloud Logging policy to improve runtime performance.** |
| 186885918 | **Disabled access to external entities in XML parsing.** |
| 270764083 | **Default expiration for refresh tokens set to 30 days if not explicitly set in the OAuth policy.** |
| N/A | **Upgraded infrastructure and libraries.** |

## June 14, 2023

**Apigee hybrid** v1.8.8 Announcement

### hybrid v1.8.8

On June 14, 2023 we released an updated version of the Apigee hybrid software, v1.8.8.

- For information on upgrading, see [Upgrading Apigee hybrid to version v1.8](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/big-picture.md.txt).

<br />

Fixed

| Bug ID | Description |
|---|---|
| **273561434** | **Some projects were unable to run debug sessions..** |
| **279193831** | **Envoy has been updated to v1.25.6..** |
| **279712107** | **Added the ability to annotate `apigee-ingressgateway-manager` pods through `overrides.yaml file`.** |
| **280544499** | **Request headers were not seen in debug sessions.** |
| **284488296** | **Removed an unneeded Workload Identity on the Cassandra Schema Validation cron job.** |

Security

| Bug ID | Description |
|---|---|
| **281561243** | **Security fix for `apigee-diagnostics-collector`, `apigee-mint-task-scheduler`, `apigee-runtime`, and `apigee-synchronizer`.** This addresses the following vulnerability: - [CVE-2022-1471](https://nvd.nist.gov/vuln/detail/CVE-2022-1471) |
| **273797045** | **Security fix for for `apigee-diagnostics-collector apigee-synchronizer apigee-udca`.** This addresses the following vulnerability: - [CVE-2021-22573](https://nvd.nist.gov/vuln/detail/CVE-2021-22573) |
| **273800345** , **281572616** | **Security fixes for `apigee-diagnostics-collector`, `apigee-mart-server`, `apigee-mint-task-scheduler`, `apigee-runtime`, `apigee-synchronizer`, and `apigee-udca`.** This addresses the following vulnerabilities: - [CVE-2022-3510](https://nvd.nist.gov/vuln/detail/CVE-2022-3510) - [CVE-2022-3509](https://nvd.nist.gov/vuln/detail/CVE-2022-3509) - [CVE-2022-3171](https://nvd.nist.gov/vuln/detail/CVE-2022-3171) |
| **273801301** | **Security fixes for `apigee-mart-server` and `apigee-runtime`** . This addresses the following vulnerability: - [CVE-2020-13936](https://nvd.nist.gov/vuln/detail/CVE-2020-13936) |

## June 13, 2023

**Apigee Integration** Feature The following preview features are now [generally available (GA)](https://cloud.google.com/products/#product-launch-stages):

- [Suspend task](https://docs.cloud.google.com/apigee/docs/api-platform/integration/run-suspend-task)
- [JavaScript task](https://docs.cloud.google.com/apigee/docs/api-platform/integration/run-javascript-task)
- [Cloud Scheduler trigger](https://docs.cloud.google.com/apigee/docs/api-platform/integration/configuring-cloud-scheduler-trigger)
- [VPC service controls for Apigee Integration](https://docs.cloud.google.com/apigee/docs/api-platform/integration/vpcsc-integration)

## June 09, 2023

**Apigee Analytics** Announcement On June 9, 2023 we released an updated version of Apigee X.
Fixed

| Bug ID | Description |
|---|---|
| 286452898 | **Previously, the Apigee Analytics `topk` query parameter, which returns the top k results for a query, always returned the results in descending order, even when the `order` parameter was `ASC`. This has been fixed: results are now sorted according to the `order` parameter before returning the top k entries.** |

## June 05, 2023

**Apigee Adapter for Envoy** v2.1.0 Announcement

### v2.1.0

On June 5, 2023, we released version 2.1.0 of Apigee Adapter for Envoy.
Fixed The `application_id` claim was added to the `/verifyApiKey` response.
**Apigee hybrid** v1.9.3 Announcement ANNOUNCEMENT

### hybrid v1.9.3

On June 5, 2023 we released an updated version of the Apigee hybrid software, v1.9.3.

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.9](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/big-picture.md.txt).

<br />

Fixed

| Bug ID | Description |
|---|---|
| **284488296** | **Removed an unneeded Workload Identity on the Cassandra Schema Validation cron job.** |
| **273561434** | **Some projects were unable to run debug sessions.** |

Security

| Bug ID | Description |
|---|---|
| **273800965** | **Security fix for `apigee-diagnostics-collector`, `apigee-mart-server`, `apigee-mint-task-scheduler`, `apigee-runtime`, and `apigee-synchronizer`.** This addresses the following vulnerability: - [CVE-2019-10172](https://nvd.nist.gov/vuln/detail/CVE-2019-10172) |
| **273800345** , **281572616** | **Security fixes for `apigee-diagnostics-collector`, `apigee-mart-server`, `apigee-mint-task-scheduler`, `apigee-runtime`, `apigee-synchronizer`, and `apigee-udca`.** This addresses the following vulnerabilities: - [CVE-2022-3510](https://nvd.nist.gov/vuln/detail/CVE-2022-3510) - [CVE-2022-3509](https://nvd.nist.gov/vuln/detail/CVE-2022-3509) - [CVE-2022-3171](https://nvd.nist.gov/vuln/detail/CVE-2022-3171) |
| **273801301** | **Security fixes for `apigee-mart-server` and `apigee-runtime`.** This addresses the following vulnerability: - [CVE-2020-13936](https://nvd.nist.gov/vuln/detail/CVE-2020-13936) |
| **283826216** | **Security fixes for `apigee-ingressgateway`.** This addresses the following vulnerabilities: - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) - [CVE-2022-41721](https://nvd.nist.gov/vuln/detail/CVE-2022-41721) |
| **283826785** | **Security fixes for `istiod`.** This addresses the following vulnerabilities: - [CVE-2023-25165](https://nvd.nist.gov/vuln/detail/CVE-2023-25165) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) - [CVE-2022-41721](https://nvd.nist.gov/vuln/detail/CVE-2022-41721) - [CVE-2022-23526](https://nvd.nist.gov/vuln/detail/CVE-2022-23526) - [CVE-2022-23525](https://nvd.nist.gov/vuln/detail/CVE-2022-23525) - [CVE-2022-23524](https://nvd.nist.gov/vuln/detail/CVE-2022-23524) |
| **281561243** | **Security fix for `apigee-diagnostics-collector`, `apigee-mint-task-scheduler`, `apigee-runtime`, and `apigee-synchronizer`.** This addresses the following vulnerability: - [CVE-2022-1471](https://nvd.nist.gov/vuln/detail/CVE-2022-1471) |

## May 30, 2023

**Apigee UI** Announcement On May, 30, 2023, we released an updated version of the Apigee UI.
Feature The following labels in the Advanced API Security abuse detection view have been changed:

- **Detection type** has been changed to **Detection rules**.
- **Suspected bot traffic** has been changed to **Detected traffic**.
- **Percent bot traffic** has been changed to **% of detected traffic**.
- **Bot count** has been changed to **Detected IP address count**.
- **Top API key** has been changed to: **Top app key**.
- **Bot reason** has been changed to **Detected rules**.
- **Total calls made** has been changed to **Detected traffic**.
- **First detection time** has been changed to **First event detected**.
- **Last detection time** has been changed to **Last event detected**.

## May 23, 2023

**Apigee Integration** Feature **New tasks for Google Cloud services**

The following new integration tasks are available in [preview](https://cloud.google.com/products#product-launch-stages):

- [AI Platform - Prediction](https://docs.cloud.google.com/apigee/docs/api-platform/integration/gcp-tasks/run-ml-prediction-task)
- [Cloud KMS - encrypt](https://docs.cloud.google.com/apigee/docs/api-platform/integration/gcp-tasks/run-cloudkms-encrypt-task)
- [Cloud KMS - decrypt](https://docs.cloud.google.com/apigee/docs/api-platform/integration/gcp-tasks/run-cloudkms-decrypt-task)
- [Dataflow - Create Job](https://docs.cloud.google.com/apigee/docs/api-platform/integration/gcp-tasks/run-dataflow-createjob-task)
- [Drive - List](https://docs.cloud.google.com/apigee/docs/api-platform/integration/gcp-tasks/run-drive-list-task)
- [Doc AI - Batch Process](https://docs.cloud.google.com/apigee/docs/api-platform/integration/gcp-tasks/run-documentai-batchprocess-task)
- [Doc AI - Process](https://docs.cloud.google.com/apigee/docs/api-platform/integration/gcp-tasks/run-documentai-process-task)
- [Doc AI - Operation](https://docs.cloud.google.com/apigee/docs/api-platform/integration/gcp-tasks/run-documentai-operation-task)
- [Firestore - Batch Get](https://docs.cloud.google.com/apigee/docs/api-platform/integration/gcp-tasks/run-firestore-batchget-task)
- [Firestore - Batch Write](https://docs.cloud.google.com/apigee/docs/api-platform/integration/gcp-tasks/run-firestore-batchwrite-task)
- [Firestore - Document Get](https://docs.cloud.google.com/apigee/docs/api-platform/integration/gcp-tasks/run-firestore-documentget-task)
- [Language - Annotate Text](https://docs.cloud.google.com/apigee/docs/api-platform/integration/gcp-tasks/run-language-annotatetext-task)
- [Language - Classify Text](https://docs.cloud.google.com/apigee/docs/api-platform/integration/gcp-tasks/run-language-classifytext-task)
- [Sheets - Append](https://docs.cloud.google.com/apigee/docs/api-platform/integration/gcp-tasks/run-sheets-append-task)
- [Sheets - Batch Get](https://docs.cloud.google.com/apigee/docs/api-platform/integration/gcp-tasks/run-sheets-batchget-task)
- [Sheets - Get](https://docs.cloud.google.com/apigee/docs/api-platform/integration/gcp-tasks/run-sheets-get-task)
- [Translate - Document](https://docs.cloud.google.com/apigee/docs/api-platform/integration/gcp-tasks/run-translate-document-task)
- [Translate - Text](https://docs.cloud.google.com/apigee/docs/api-platform/integration/gcp-tasks/run-translate-text-task)
- [Workflows - Execute](https://docs.cloud.google.com/apigee/docs/api-platform/integration/gcp-tasks/run-workflowexecutions-execute-task)

## May 22, 2023

**Apigee Integrated Portal** Announcement On May 22, 2023 we released an updated version of Apigee integrated portal.
Fixed

| Bug ID | Description |
|---|---|
| **274916981** | **Fixed issue where an API specification set via URL could fail.** |
| **277265034** | **App names can start with numeric characters as described in [Naming guidelines](https://docs.cloud.google.com/apigee/docs/api-platform/reference/naming-guidelines.md.txt).** |

**Apigee Integration** Feature **Return task**

The Return task lets you customize the error messages corresponding to the HTTP response codes that are returned during an integration execution failure.

For more information, see [Return task](https://docs.cloud.google.com/apigee/docs/api-platform/integration/run-return-task).
Feature **Error catcher trigger**

The Error Catcher trigger lets you invoke an [error catcher](https://docs.cloud.google.com/apigee/docs/api-platform/integration/error-catcher) that is defined or customized to handle the failure of an identified trigger, task, or edge condition in your integration.

For more information, see [Error catcher trigger](https://docs.cloud.google.com/apigee/docs/api-platform/integration/configure-error-catcher-trigger).

## May 17, 2023

**Apigee X** Announcement On May 17, 2023, we released an updated version of Apigee X (1-10-0-apigee-1).

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Breaking **Fixed issue with incomplete removal of form parameters when using the `<Remove>` element in the Assign Message policy to delete headers and form parameters simultaneously.**

This fix may result in a breaking change for any customer employing an antipattern that attempts to access a form parameter *after* using the `<Remove>` element to delete *the same form parameter* and headers simultaneously in the policy flow.

For more information on the recommended steps for setting and removing form parameters and headers using the Assign Message policy, see the updated documentation for the [Assign Message policy examples](https://cloud.google.com/apigee/docs/api-platform/reference/policies/assign-message-policy#samples).
Fixed

| Bug ID | Description |
|---|---|
| N/A | **Upgraded infrastructure and libraries.** |
| 280695936 | **Fixed issue with incomplete removal of form parameters when using the `<Remove>` element in the Assign Message policy to delete headers and form parameters simultaneously.** |
| 271217050 | **Fixed issue resulting in missing execution records in debug sessions for the JavaCallout policy.** |
| 271894110, 273568673, 273571029 | **Fix enables support for TLS 1.3 for southbound targets.** |
| 271539836 | **Fixed intermittent Cloud Logging failures.** |
| 277090269 | **Fixed encryption of internal proxy chaining headers to avoid proxy invocation misuse.** |
| 273561434 | **Fixed issue with incomplete debug session information for proxies deployed in the same environment.** |
| 158132963 | **Improved capture of relevant target flow variables in trace and analytics in the event of target timeouts.** |
| 271093461 | **Fixed issue with heap exhaustion when using OASValidation policy.** |
| 269514256 | **Fixed issue causing `GoogleTokenGeneration` failure.** |
| 261924658 | **Optimization to reduce latency in Quota policy.** |
| 252864240 | **Fixed issue to support bot detection with Analytics obfuscation enabled.** |
| 222024484 | **CORS policy now returns `Access-Control-Allow-Credentials` header in preflight response when `<AllowCredentials>` is set to true.** |
| 261205290 | **Optimization to reduce resource usage on Cassandra connections.** |
| 266814873 | **Fixed issue with retrieval of environment-scoped KVM entries containing encryption keys with non-UTF-8 characters.** |
| 260342163 | **Fixed issue causing 100% CPU usage by runtime pod threads under specific circumstances.** |
| 273800523, 273800717 | **Security fixes for Apigee.** The fixes address the following vulnerabilities: - [CVE-2022-41881](https://nvd.nist.gov/vuln/detail/CVE-2022-41881) - [CVE-2022-24823](https://nvd.nist.gov/vuln/detail/CVE-2022-24823) - [CVE-2021-43797](https://nvd.nist.gov/vuln/detail/CVE-2021-43797) - [CVE-2022-46363](https://nvd.nist.gov/vuln/detail/CVE-2022-46363) - [CVE-2022-46364](https://nvd.nist.gov/vuln/detail/CVE-2022-46364) - [CVE-2023-0286](https://nvd.nist.gov/vuln/detail/CVE-2023-0286) - [CVE-2022-4450](https://nvd.nist.gov/vuln/detail/CVE-2022-4450) - [CVE-2021-3999](https://nvd.nist.gov/vuln/detail/CVE-2021-3999) - [CVE-2023-0215](https://nvd.nist.gov/vuln/detail/CVE-2023-0215) - [CVE-2022-2097](https://nvd.nist.gov/vuln/detail/CVE-2022-2097) - [CVE-2022-4304](https://nvd.nist.gov/vuln/detail/CVE-2022-4304) |

## May 11, 2023

**Apigee UI** Feature This release includes new **Permissions Pre-check functionality** and UI messaging, which is available when provisioning Apigee with Pay-as-you-go pricing in the Google Cloud console. With the release of this feature, users are alerted when any permissions required to complete the provisioning operations are missing. The missing permissions and the steps to resolve are now identified in the UI messaging.
Announcement On May 11, 2023 we released an updated version of the Apigee UI.

## May 09, 2023

**Apigee Integration** Feature **Cloud logs support for Connectors tasks**

You can now view the execution logs of a failed [Connectors task](https://docs.cloud.google.com/apigee/docs/api-platform/integration/connectors-task) in Apigee Integration.

For more information, see [Execution Logs](https://docs.cloud.google.com/apigee/docs/api-platform/integration/viewing-logs#use-logs-to-troubleshoot-and-trace-connector-failures).
Fixed The issue relating to the validation of incorrect variable assignments in an integration has been resolved.

## May 08, 2023

**Apigee hybrid** v1.8.7 Announcement

### hybrid v1.8.7

On May 8, 2023 we released an updated version of the Apigee hybrid software, v1.8.7.

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.8](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/big-picture.md.txt).

<br />

Fixed

| Bug ID | Description |
|---|---|
| **279053612** | **`x-forwarded-client-cert` (XFCC) HTTP headers handled with the `istiod.forwardClientCertDetails` configuration property.** See [istiod.forwardClientCertDetails](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/config-prop-ref.md.txt#istiod-forwardclientcertdetails) in the Configuration properties reference for details. |
| **278646149** | **In certain circumstances, the `logger.livenessProbe.timeoutSeconds` configuration property was not working as expected.** See [`logger.livenessProbe.timeoutSeconds`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/config-prop-ref.md.txt#logger-livenessprobe-timeoutseconds) in the Configuration property reference. |
| **270371160** | **In Apigee hybrid v1.8.7, we removed certain insecure TLS ciphers.** Apigee hybrid supports the TLS cipher suites supported by the [Boring FIPS build of Envoy](https://www.envoyproxy.io/docs/envoy/v1.21.5/api-v3/extensions/transport_sockets/tls/v3/common.proto.html). You can now specify specific cipher suites with the [`virtualhosts.cipherSuites` configuration property](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/config-prop-ref.md.txt#virtualhosts) in your overrides. **Note**: Apigee hybrid only supports the RSA ciphers listed. ECDSA ciphers are not supported. |

Security

| Bug ID | Description |
|---|---|
| **279194142** | **Fixes build issues to achieve FIPS compliance.** |
| **277367440** | **Security fixes for Apigee Controller, Watcher, and `apigeectl`.** This addresses the following vulnerabilities: - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) - [CVE-2022-41717](https://nvd.nist.gov/vuln/detail/CVE-2022-41717) - [CVE-2022-28948](https://nvd.nist.gov/vuln/detail/CVE-2022-28948) |
| **273800965** | **Security fixes for `apigee-diagnostics-collector`, `apigee-mart-server`, `apigee-runtime`, and `synchronizer`.** This addresses the following vulnerabilities: - [CVE-2019-10172](https://nvd.nist.gov/vuln/detail/CVE-2019-10172) |
| **273800717** | **Security fixes for `apigee-emulator`, `apigee-diagnostics-collector`, `apigee-mart-serve`, `apigee-mint-task-scheduler`, `apigee-mock-server`, `apigee-runtime`, and `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2022-46364](https://nvd.nist.gov/vuln/detail/CVE-2022-46364) - [CVE-2022-46363](https://nvd.nist.gov/vuln/detail/CVE-2022-46363) |

## May 02, 2023

**Apigee hybrid** v1.9.2 Announcement

### hybrid v1.9.2

On May 2, 2023 we released an updated version of the Apigee hybrid software, v1.9.2.

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.9](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/big-picture.md.txt).

<br />

Fixed

| Bug ID | Description |
|---|---|
| **279053612** | **`x-forwarded-client-cert` (XFCC) HTTP headers handled with the `istiod.forwardClientCertDetails` configuration property.** See [istiod.forwardClientCertDetails](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/config-prop-ref.md.txt#istiod-forwardclientcertdetails) in the Configuration properties reference for details. |
| **278646149** | **In certain circumstances, the `logger.livenessProbe.timeoutSeconds` configuration property was not working as expected.** See [`logger.livenessProbe.timeoutSeconds`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/config-prop-ref.md.txt#logger-livenessprobe-timeoutseconds) in the Configuration property reference. |
| **270371160** | **In Apigee hybrid v1.9.0, we removed certain insecure TLS ciphers.** Apigee hybrid supports the TLS cipher suites supported by the [Boring FIPS build of Envoy](https://www.envoyproxy.io/docs/envoy/v1.21.5/api-v3/extensions/transport_sockets/tls/v3/common.proto.html). You can now specify specific cipher suites with the [`virtualhosts.cipherSuites` configuration property](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/config-prop-ref.md.txt#virtualhosts) in your overrides. **Note**: Apigee hybrid only supports the RSA ciphers listed. ECDSA ciphers are not supported. |

Security

| Bug ID | Description |
|---|---|
| **279194142** | **Fixes build issues to achieve FIPS compliance.** |
| **278313047** | **Security fixes for `apigee-stackdriver-logging-agent`.** This addresses the following vulnerabilities: - [CVE-2022-32511](https://nvd.nist.gov/vuln/detail/CVE-2022-32511) - [CVE-2022-29181](https://nvd.nist.gov/vuln/detail/CVE-2022-29181) - [CVE-2022-24836](https://nvd.nist.gov/vuln/detail/CVE-2022-24836) - [CVE-2022-0759](https://nvd.nist.gov/vuln/detail/CVE-2022-0759) - [CVE-2021-41817](https://nvd.nist.gov/vuln/detail/CVE-2021-41817) - [CVE-2021-41098](https://nvd.nist.gov/vuln/detail/CVE-2021-41098) - [CVE-2021-32740](https://nvd.nist.gov/vuln/detail/CVE-2021-32740) - [CVE-2021-28965](https://nvd.nist.gov/vuln/detail/CVE-2021-28965) - [CVE-2020-8130](https://nvd.nist.gov/vuln/detail/CVE-2020-8130) - [CVE-2020-25613](https://nvd.nist.gov/vuln/detail/CVE-2020-25613) - [CVE-2019-3881](https://nvd.nist.gov/vuln/detail/CVE-2019-3881) |
| **277367440** | **Security fixes for Apigee Controller, Watcher, and `apigeectl`.** This addresses the following vulnerabilities: - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) - [CVE-2022-41717](https://nvd.nist.gov/vuln/detail/CVE-2022-41717) - [CVE-2022-28948](https://nvd.nist.gov/vuln/detail/CVE-2022-28948) |
| **273800965** | **Security fixes for `apigee-diagnostics-collector`, `apigee-mart-server`, `apigee-runtime`, and `synchronizer`.** This addresses the following vulnerabilities: - [CVE-2019-10172](https://nvd.nist.gov/vuln/detail/CVE-2019-10172) |
| **273800717** | **Security fixes for `apigee-emulator`, `apigee-diagnostics-collector`, `apigee-mart-server`, `apigee-mint-task-scheduler`, `apigee-mock-server`, `apigee-runtime`, and `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2022-46364](https://nvd.nist.gov/vuln/detail/CVE-2022-46364) - [CVE-2022-46363](https://nvd.nist.gov/vuln/detail/CVE-2022-46363) |

## May 01, 2023

**Apigee Integration** Announcement On May 1, 2023 we released an updated version of the Apigee Integration.
Feature Apigee Integrations is now available in the following locations:

- Melbourne (`australia-southeast2`)
- Finland (`europe-north1`)
- Paris (`europe-west9`)
- Madrid (`europe-southwest1`)
- Doha (`me-central1`)
- Tel Aviv (`me-west1`)

For more information about the supported locations, see [Apigee Integration supported regions](https://docs.cloud.google.com/apigee/docs/api-platform/integration/system-limits#supported-regions).

## April 26, 2023

**Apigee X** Announcement Effective May 31, 2023, the default value for the OAuthv2 policy `RefreshTokenExpiresIn` element has new behavior. Starting May 31, `RefreshTokenExpiresIn` defaults to **2592000000 ms (30 days)** for all policies where this element is not set.

For information on this element, see [RefreshTokenExpiresIn](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/oauthv2-policy.md.txt#refreshtokenexpiresinelement).

## April 20, 2023

**Apigee Advanced API Security** Announcement On April 20, 2023 we released an updated version of Apigee Advanced API Security.
Feature This release contains a new Advanced API Security [**Detected Traffic**](https://docs.cloud.google.com/apigee/docs/api-security/abuse-detection.md.txt#detected-traffic) view, which displays information about API traffic originating from detected bots. This information was previously displayed in the **Abuse metrics** section of the **Security scores** view.
**Apigee Integration** Issue Apigee Integration fails to validate incorrect variable assignments in an integration. For example, you can currently assign a JSON value to an unassigned variable of String data type. This behaviour might cause data mapping and integration failures.

Until this issue is resolved, we recommend that you do the following:

- Assign values to an integration variable as per the variable data type.
- Verify and update existing integration variable values as per its respective variable data type.
**Apigee X** Announcement On April 20, 2023 we released an updated version of Apigee.
Feature This release contains a new Advanced API Security [Detected Traffic](https://docs.cloud.google.com/apigee/docs/api-security/abuse-detection.md.txt#detected-traffic) view, which displays information about API traffic originating from detected bots. This information was previously displayed in the **Abuse metrics** section of the **Security scores** view.

## April 17, 2023

**Apigee X** Fixed

| Bug ID | Description |
|---|---|
| N/A | **Upgraded infrastructure and libraries.** |

Announcement On April 17, 2023, we released an updated version of Apigee X (1-9-0-apigee-25).

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

## April 13, 2023

**Apigee X** Announcement On April 13, 2023, we released an updated version of Apigee.
Feature **New features now supported in Apigee in VS Code for local development**

The following features are now supported with Apigee in VS Code for local development as part of the [Insiders build](https://docs.cloud.google.com/code/docs/vscode/insiders.md.txt#get) (as of v1.22.1-insiders.3):

- **Create multi-repository workspaces** - Choose individual storage locations for artifacts, such as API proxies that are stored as individual SCMs, but develop them together using a single workspace. You no longer have to create a single repository that contains all of your API proxies. See [Understanding the structure of an Apigee multi-repository workspace](https://docs.cloud.google.com/apigee/docs/api-platform/local-development/vscode/manage-apigee-workspace.md.txt#understanding_the_structure_of_an_apigee_multi-repository_workspace).
- **Use keystore** - Introduces a new environment-level setting for creating the required keystores in the Apigee Emulator by using locally available keys. See [Configuring the keystrokes (keystores.json)](https://docs.cloud.google.com/apigee/docs/api-platform/local-development/vscode/deploy-environment.md.txt#key-stores).
- **Test API proxies that require service accounts (for example, calling a cloud logging process as part of an API proxy flow)** - Set up your Apigee Emulators with a service account key to enable service accounts, add policies and targets that rely on service accounts, and deploy the API proxies to the Apigee Emulator to test them. See [Customizing the Apigee Emulator to support service account-based authentication](https://docs.cloud.google.com/apigee/docs/api-platform/local-development/vscode/manage-apigee-emulator.md.txt#customizing_the_apigee_emulator_to_support_service_account-based_authentication).

## April 03, 2023

**Apigee Integration** Announcement On April 3, 2023 we released an updated version of the Apigee Integration.
Feature **Secret Manager - Access task ([Preview](https://cloud.google.com/products#product-launch-stages))**

The Secret Manager - Access task lets you access secret versions that are stored in [Cloud Secret Manager](https://docs.cloud.google.com/secret-manager/docs/overview.md.txt) from your integration.

For more information, see [Secret Manager - Access task](https://docs.cloud.google.com/apigee/docs/api-platform/integration/gcp-tasks/run-secretmanager-access-task).

> [!NOTE]
> **Note:** Rollouts of this feature will begin on April 3, 2023, and may take four or more business days to be completed across all Google Cloud zones. You may not be able to provision Apigee Integration until the rollout is complete.

**Apigee hybrid** v1.8.6 Announcement

### hybrid v1.8.6

On April 3, 2023 we released an updated version of the Apigee hybrid software, v1.8.6.

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.8](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/big-picture.md.txt).

<br />

Fixed

| Bug ID | Description |
|---|---|
| **274292101** | **In certain circumstances, environment-scoped KVMs in hybrid could cause rollback issues for MART.** |
| **271266079** | **Removed port 80 from the default Kubernetes service of Apigee Ingress Gateway.** |
| **267691299** | **The Apigee controller uses a dedicated `apigee-manager` Kubernetes service account, instead of using the default SA.** |
| **267666187** | **When using a custom Kubernetes service for the Apigee ingress gateway, you can disable the creation of a default load balancer.** See [Managing Apigee ingress gateway](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/managing-ingress.md.txt#disable-loadbalancer). |
| **266814873** | **In certain circumstances, retrieving encrypted KVM entries could fail with an error.** This fix ensures that MART will be able to successfully function for environment-scoped KVM entries, even if the encryption key is used in the Org Env configuration or when the keys contain non-UTF8 characters. There is no change to KVM data. |
| **263840644** | **Fixed a conflict with an existing ASM on the cluster.** |
| **245619397** | **In Apigee hybrid, fluentbit support now includes the `NO_PROXY` environment variable.** |
| **223320630** | **mTLS-related client variables are now set by the Apigee runtime.** |

Security

| Bug ID | Description |
|---|---|
| **275002360** | **Security fixes for `fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2021-46848](https://nvd.nist.gov/vuln/detail/CVE-2021-46848) - [CVE-2022-1304](https://nvd.nist.gov/vuln/detail/CVE-2022-1304) - [CVE-2022-2097](https://nvd.nist.gov/vuln/detail/CVE-2022-2097) - [CVE-2022-42898](https://nvd.nist.gov/vuln/detail/CVE-2022-42898) |
| **274112103** | **Security fixes to the Apigee Controller and Apigee Watcher.** This addresses the following vulnerabilities: - [CVE-2022-1996](https://nvd.nist.gov/vuln/detail/CVE-2022-1996) - [CVE-2022-27191](https://nvd.nist.gov/vuln/detail/CVE-2022-27191) - [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664) - [CVE-2022-32149](https://nvd.nist.gov/vuln/detail/CVE-2022-32149) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) |

Breaking

| Bug ID | Description |
|---|---|
| **271266079** | **Removed port 80 from the default Kubernetes service of Apigee Ingress Gateway.** Port 80 is not supported by Apigee ingress gateway. If you are migrating from ASM to Apigee ingress gateway, and followed the instructions in the [community post](https://www.googlecloudcommunity.com/gc/Cloud-Product-Articles/Apigee-hybrid-ingress-Three-different-options-to-expose-your/ta-p/79149) to enable Port 80, it will not work with Apigee Ingress gateway. |

## March 27, 2023

**Apigee hybrid** v1.9.1 Announcement

### hybrid v1.9.1

On March 27, 2023 we released an updated version of the Apigee hybrid software, v1.9.1.

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.9](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/big-picture.md.txt).

<br />

Fixed

| Bug ID | Description |
|---|---|
| **269738951** | **The example network policies are now included in the `apigeectl/examples/network-policies` directory.** see [Configuring Kubernetes network policies](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/kubernetes-network-policies.md.txt). |
| **271266079** | **Removed port 80 from the default Kubernetes service of Apigee Ingress Gateway.** |
| **269451743** | **In certain circumstances, upgrading from Apigee hybrid v1.8.3 to v1.9.0 could fail with an error message when creating the virtual hosts.** |
| **268696297** | **Providing a Kubernetes secret for Cassandra and Redis components is now supported.** See [`cassandra.auth.secret`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/config-prop-ref.md.txt#cassandra-auth-secret) and [`redis.auth.secret`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/config-prop-ref.md.txt#redis-auth-secret) in the [Configuration properties reference](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/config-prop-ref.md.txt). |
| **267691299** | **The Apigee controller uses a dedicated `apigee-manager` Kubernetes service account, instead of using the default SA.** |
| **267666187** | **When using a custom Kubernetes service for the Apigee ingress gateway, you can disable the creation of a default load balancer.** See [Managing Apigee ingress gateway](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/managing-ingress.md.txt#disable-loadbalancer). |
| **266989915 266919136** | **In some circumstances, Apigee could return incorrect developer credentials for an app, unless the specific app was selected when requesting the credentials.** |
| **266814873** | **In certain circumstances, retrieving encrypted KVM entries could fail with an error.** This fix ensures that MART will be able to successfully function for environment-scoped KVM entries, even if the encryption key is used in the Org Env configuration or when the keys contain non-UTF8 characters. There is no change to KVM data. |
| **266594584** | **Websocket was failing in asm 1.15.** This was due to incompatible capitalization in variable names between the Anthos Service Mesh `overlay.yaml` file and the and the Envoy filter `apigee-envoyfilter.yaml` file. |
| **266411394** | **Added support for Azure Front Door request headers to `/healthz` health check.** |
| **265374889** | **Fixed an issue where in some circumstances the Java Callout would to fail due with the following error:** *Failed to execute JavaCallout. Could not initialize class org.jose4j.jwa.AlgorithmFactoryFactory2*. |
| **260342163** | **Fixed a narrow scenario where threads in runtime pods ended up consuming 100% CPU.** |
| **245619397** | **In Apigee hybrid, fluentbit support now includes the `NO_PROXY` environment variable.** |

Security

| Bug ID | Description |
|---|---|
| **275002360** | **Security fixes for `fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2021-46848](https://nvd.nist.gov/vuln/detail/CVE-2021-46848) - [CVE-2022-1304](https://nvd.nist.gov/vuln/detail/CVE-2022-1304) - [CVE-2022-2097](https://nvd.nist.gov/vuln/detail/CVE-2022-2097) - [CVE-2022-42898](https://nvd.nist.gov/vuln/detail/CVE-2022-42898) |
| **274112103** | \*\*Security fixes to the Apigee Controller and Apigee Watcher. This addresses the following vulnerabilities: - [CVE-2022-1996](https://nvd.nist.gov/vuln/detail/CVE-2022-1996) - [CVE-2022-27191](https://nvd.nist.gov/vuln/detail/CVE-2022-27191) - [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664) - [CVE-2022-32149](https://nvd.nist.gov/vuln/detail/CVE-2022-32149) - [CVE-2022-41723](https://nvd.nist.gov/vuln/detail/CVE-2022-41723) |

Breaking

| Bug ID | Description |
|---|---|
| **271266079** | **Removed port 80 from the default Kubernetes service of Apigee Ingress Gateway.** Port 80 is not supported by Apigee ingress gateway. If you are migrating from ASM to Apigee ingress gateway, and followed the instructions in the [community post](https://www.googlecloudcommunity.com/gc/Cloud-Product-Articles/Apigee-hybrid-ingress-Three-different-options-to-expose-your/ta-p/79149) to enable Port 80, it will not work with Apigee Ingress gateway. |

## March 23, 2023

**Apigee Advanced API Security** Announcement On March 23, 2023, we released an updated version of Apigee Advanced API Security.
Issue The two new detection rules, Advanced Anomaly Detection and Advanced API Scraper, are not available for organizations with [VPC Service Controls](https://docs.cloud.google.com/vpc-service-controls). We are actively working to resolve this issue.
Feature **Public preview release of Advanced API Security abuse detection**

Advanced API Security's new [abuse detection](https://docs.cloud.google.com/apigee/docs/api-security/abuse-detection.md.txt) feature lets you view security incidents involving your APIs. Abuse detection uses Google's machine learning algorithms to detect API traffic patterns that are a sign of malicious activity targeting your APIs.

Abuse detection includes two new types of detection rules powered by machine learning models:

- Advanced Anomaly Detection: Detects unusual patterns of API traffic.
- Advanced API scraper: Detects attempts to extract information from APIs for malicious purposes.
**Apigee Integrated Portal** Announcement On March 23, 2023 we released an updated version of Apigee integrated portal.
Feature Users are now able to enable the content security policy feature for their portal for Apigee and Apigee hybrid. Previously, this feature was available in Apigee Edge only.

See: [Configure a content security policy](https://docs.cloud.google.com/apigee/docs/api-platform/publish/portal/csp.md.txt)
Fixed

| Bug ID | Description |
|---|---|
| 272794133 | When setting a user account to **Inactive**, a notice is now displayed indicating that this setting affects the login behavior only for built-in identity provider accounts. |
| 267502391 | Improved error messages for invalid input to various endpoints. |
| 265051231 | Default assets (images) added to a newly created portal used to show up as size `0px x 0px`. Now they show their proper size. |
| 253037871 | Users are now able to enable the content security policy feature for their portal for Apigee and Apigee hybrid. Previously, this feature was available in Apigee Edge only. |

**Apigee X** Announcement On March 23, 2023, we released an updated version of Apigee.
Feature **Public preview release of Advanced API Security abuse detection**

Advanced API Security's new [abuse detection](https://docs.cloud.google.com/apigee/docs/api-security/abuse-detection.md.txt) feature lets you view security incidents involving your APIs. Abuse detection uses Google's machine learning algorithms to detect API traffic patterns that are a sign of malicious activity targeting your APIs.

Abuse detection includes two new types of detection rules powered by machine learning models:

- Advanced Anomaly Detection: Detects unusual patterns of API traffic.
- Advanced API scraper: Detects attempts to extract information from APIs for malicious purposes.
Issue The two new detection rules, Advanced Anomaly Detection and Advanced API Scraper, are not available for organizations with [VPC Service Controls](https://docs.cloud.google.com/vpc-service-controls). We are actively working to resolve this issue.

## March 22, 2023

**Apigee X** Feature **Customize SSL certs for access routing when provisioning Apigee Pay-as-you-go organizations.**

Users can now select existing self-managed SSL certs when customizing access routing during Apigee Pay-as-you-go provisioning. For more information, see [Step 4: Customize access routing](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/console-configure-access.md.txt#perform-the-step).

<br />

Announcement On March 22, we released an updated version of Apigee X.
Feature **Receive Cloud console notifications when Pay-as-you-go provisioning completes.**

While provisioning is in progress, users can navigate away from the Apigee provisioning page and monitor notifications in the Cloud console for updates when provisioning completes.

<br />

## March 17, 2023

**Apigee X** Fixed With this release we removed certain insecure TLS ciphers for northbound traffic. You can find the full list of supported ciphers in the [FIPS build of Envoy](https://www.envoyproxy.io/docs/envoy/v1.21.5/api-v3/extensions/transport_sockets/tls/v3/common.proto.html).

**Note**: Apigee only supports the RSA ciphers listed. ECDSA ciphers are not supported.
Announcement On March 17, we released an updated version of Apigee X (1-9-0-apigee-23).

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Fixed

| Bug ID | Description |
|---|---|
| N/A | **Upgraded infrastructure and libraries.** |

## March 09, 2023

**Apigee Adapter for Envoy** v2.0.7 Announcement

### v2.0.7

On March 9, 2023, we released version 2.0.7 of Apigee Adapter for Envoy.

**Note:** If you are **upgrading** an existing Apigee Adapter for Envoy, you **must** add the `--force-proxy-install` flag to the provision command. This flag forces the Apigee proxy to be replaced with the latest proxy. See [Apigee hybrid example](https://docs.cloud.google.com/apigee/docs/api-platform/envoy-adapter/latest/example-hybrid).
Fixed
- An issue was fixed where an invalid api key could create spurious log entries and analytics records.
- A deprecated version check was removed in a proxy that caused issues in newer versions of Apigee.
Feature JWTs can now add a claim named `customattributes` that will pass the value on to the target in a header called `x-apigee-customattributes` (if `append_metadata_headers` is configured to be true).

## March 02, 2023

**Apigee UI** Announcement On March 2, 2023, we released an updated provisioning experience for Apigee users creating Pay-as-you-go organizations from the [Apigee UI](https://apigee.google.com/edge). All Apigee users creating new organizations with Pay-as-you-go billing can access the simplified onboarding experience, whether they are provisioning from the Apigee UI or the [Google Cloud console](https://docs.cloud.google.com/console/apigee/setup).

## March 01, 2023

**Apigee UI** Announcement On March 1, 2023, we released an updated version of the Apigee UI.
Feature **Public preview release of the Apigee UI in the Google Cloud console**

This release includes a [new version of the Apigee UI](https://docs.cloud.google.com/apigee/docs/api-platform/fundamentals/ui-overview.md.txt) that is integrated with the Google Cloud console. The new UI makes it easier to perform Apigee tasks that are managed in the Cloud console. We welcome your feedback on the new UI: click **Send Feedback** at the top of the UI.

For now, you can continue to use the classic Apigee UI if you wish: just click **Back to Classic Apigee** in the new UI.

The following tabs in the classic Apigee UI have not yet been implemented in the Apigee UI in the Cloud console, but they will be available there soon:

- **Develop \> Integrations**
- **API Security**
- **Monetization**
- **Analyze \> API Metrics \> Cache Performance**,
- **Analyze \> API Metrics \> Target Performance**
- **Analyze \> Developers**
- **Analyze \> End Users**
- **Publish \> Portals**

If you need to use these features, you can do so by switching to the classic Apigee UI.

This release will be rolled out over the next week, so you might not be able to view the new Apgee UI until the rollout is complete.

## February 24, 2023

**Apigee hybrid** v1.8.5 Announcement

### hybrid v1.8.5

On February 24, 2023 we released an updated version of the Apigee hybrid software, v1.8.5.

For information on upgrading, see [Upgrading Apigee hybrid to version 1.8](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/upgrade.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **266594584** | **Websocket was failing in asm 1.15.** This was due to incompatible capitalization in variable names between the Anthos Service Mesh `overlay.yaml` file and the and the Envoy filter `apigee-envoyfilter.yaml` file. |
| **266411394** | **Add support for Azure Front Door request headers to `/healthz` health check.** |
| **260372012** | **Requests failed with 500 response and keyvaluemap.service.ErrorDuringDecryption error after upgrade to Hybrid 1.8.** **Note:** Fixed in Apigee hybrid 1.8.4 and newer. |
| **245619397** | **In Apigee hybrid, fluentbit support now includes the `NO_PROXY` environment variable.** |
| **181569522** | **You can now create a new environment with the same name as a deleted environment without needing to perform manual clean-up tasks first.** |

## February 14, 2023

**Apigee hybrid** v1.7.6 Announcement

### hybrid v1.7.6

On February 14, 2023 we released an updated version of the Apigee hybrid software, v1.7.6.

For information on upgrading, see [Upgrading Apigee hybrid to version 1.7](https://docs.cloud.google.com/apigee/docs/hybrid/v1.7/upgrade.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **268445095** | **The `validateOrg` flag can be set to false to bypass upgrade validation errors when configuration includes HTTP Forward proxy.** You can use this to avoid upgrade errors caused by HTTP proxy settings. |
| **262699558** | **The watcher component no longer fails when using Kubernetes Secret to store hybrid service account secret.** |
| **181569522** | **You can now create a new environment with the same name as a deleted environment without needing to perform manual clean-up tasks first.** |
| **218567150** | **The ingress gateway is now configured to consistently preserve UUID in the x-request-id header.** **Note:** This setting does have some impact on tracing in the ingress gateway. For more information, see *pack_trace_reason* in ["UUID (proto)"](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/request_id/uuid/v3/uuid.proto#extensions-request-id-uuid-v3-uuidrequestidconfig) in the envoy documentation. (Also fixed in Apigee hybrid v1.8.3) |
| **259264961** | **Added support for ASM v1.15.** Please see [Known issue 266452840](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt#266452840) |

## February 09, 2023

**Apigee Integration** Announcement On February 9, 2023 we released an updated version of the Apigee Integration.
Change **Data Mapping Editor improvements**

**Transform expression changes:**

- You can now add, modify, or remove a function or a function parameter in-between an existing transform expression without losing the subsequent transform functions in the expression.
- When applying a pre-defined transform function to a variable in the **Data Mapping Editor**, the function selection menu now displays the list of functions as per the return type of the preceding function or the data type of the preceding parameter.

**Data Mapping Editor UI changes:**

- *Input* rows are updated to display indent guides to improve readability and structure recognition.
- Mapping validation errors are now highlighted for each function in an *Input* row.

For more information, see [Data Mapping editor](https://docs.cloud.google.com/apigee/docs/api-platform/integration/data-mapping-overview#data-mapping-editor).

## February 08, 2023

**Apigee X** Announcement On February 8, we released an updated version of Apigee X (1-9-0-apigee-21).

> [!NOTE]
> **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Feature The VerifyAPIKey policy and the `VerifyAccessToken` action of the OAuth2 policy now support `CacheExpiryInSeconds`. Setting this variable enforces TTL on the cache and enables customization of the time period for cached token expiry.
Fixed

| Bug ID | Description |
|---|---|
| 181569522 | Fixed the environment recreate scenario without manual cleanup. |
| 217173784 | **The `HMAC.policy-name.error` variable is populated for HMAC failing policies.** |
| 257268790 | **Fixed bug where invalid proxy configuration halted Message Processor boot up.** |
| 250638658 | **Fixed the SetIntegrationRequest policy that fails if the JSON payload contains `{foo}`.** |
| 265204739 | **Set `externalTrafficPolicy:local` as default for Apigee X instances to mitigate `502` errors.** |
| N/A | **Upgraded infrastructure and libraries.** |

## February 06, 2023

**Apigee Integration** Announcement On February 6, 2023 we released an updated version of the Apigee Integration.
Feature **JavaScript task ([Preview](https://cloud.google.com/products#product-launch-stages))**

The JavaScript task lets you write custom JavaScript code snippets for your integration.

Using the JavaScript Editor, you can code complex data mapping logic for your integration, perform variable assignments, and add or modify integration variables.

For more information, see [JavaScript task](https://docs.cloud.google.com/apigee/docs/api-platform/integration/run-javascript-task).
Feature **Delete integration**

You can now delete an entire integration without the need to individually delete all the respective integration versions.

When you delete an integration, you permanently delete all the versions of that integration, including all the integration variables, configured triggers, tasks, and data mappings.

For more information, see [Delete integrations](https://docs.cloud.google.com/apigee/docs/api-platform/integration/delete-integration).

> [!NOTE]
> **Note:** Rollouts of this release will begin on February 6, 2023, and may take four or more business days to be completed across all Google Cloud zones. You may not be able to provision Apigee Integration until the rollout is complete.

## February 01, 2023

**Apigee hybrid** v1.9.0 Announcement

### hybrid v1.9.0

On February 1, 2023 we released an updated version of the Apigee hybrid software, v1.9.0.

- For information on upgrading, see [Upgrading Apigee hybrid to version 1.9](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/upgrade.md.txt).
- For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/big-picture.md.txt).

<br />

Feature **Target separate ingress gateways to virtual hosts**

Starting in version 1.9, Apigee hybrid you can control how separate Apigee Ingress gateways map to specific virtual hosts. See [Targeting an Apigee ingress to a virtual host](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/managing-ingress.md.txt#targetvh).
Feature **Custom ingress access logs**

Starting in version 1.9, Apigee hybrid offers custom log formats for the Apigee Ingress gateway. See [Customize Ingress access logs](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/managing-ingress.md.txt#customize-logs).
Feature **Kubernetes network policies**

Starting in version 1.9, Apigee hybrid offers new Kubernetes network policies to secure Cassandra and Redis pods within an Apigee Hybrid cluster. See [Configuring Kubernetes network policies](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/kubernetes-network-policies.md.txt).
Feature **CSI Backup and Restore**

Starting with Apigee hybrid 1.9, you can back up and restore your [hybrid data](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/cassandra-backup-overview.md.txt#what-is-backed-up) using [CSI](https://kubernetes.io/docs/concepts/storage/volume-snapshots/) (Container Storage Interface) snapshots. CSI backup generates disk snapshots and stores them as encrypted data in cloud storage. See [Cassandra CSI backup and restore](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/cassandra-csi-backup-restore.md.txt).
Deprecated **Support for customer-installed Anthos Service Mesh deprecated**

Starting in version 1.9, Apigee hybrid only supports the Apigee Ingress gateway for ingress, and no longer supports customer-installed Anthos Service Mesh. See:

- [Managing Apigee ingress gateway](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/managing-ingress.md.txt)
- [Migrating to Apigee Ingress gateway](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/migrating-to-apigee-ingress.md.txt)

<br />

Fixed

| Bug ID | Description |
|---|---|
| **266356206** | **A jackson-databind library error was causing OAS Validation errors when loading applications.** The jackson-databind libraries have been updated to correctly parse null vs NullMode values. (Fixed in Apigee hybrid v1.9.0) |
| **262616276** | **Apigee hybrid v1.9 adds support for Kubernetes in AKS v1.24+.** Also fixed in Apigee hybrid v1.8.4 and newer (Fixed in Apigee hybrid v1.9.0 and v1.8.4) |
| **260372012** | **Requests failed with 500 response and keyvaluemap.service.ErrorDuringDecryption error after upgrade to Hybrid 1.8.** Also fixed in Apigee hybrid v1.8.4 and newer (Fixed in Apigee hybrid v1.9.0 and v1.8.4) |
| **260324159** | **Solved up to 30 minute delay proxy deployment due to socket closed error in synchronizer.** (Fixed in Apigee hybrid v1.9.0) |
| **259738092** | **Intermittent 404's were seen at the Apigee Ingress Gateway due to an inconsistent configuration delivery mechanism.** (Fixed in Apigee hybrid v1.8.3) |
| **258699204** | **The default memory requests and limits for metrics pods that were inadvertently changed in 1.8.x. have been fixed.** Also fixed in Apigee hybrid v1.8.4 and newer (Fixed in Apigee hybrid v1.9.0 and v1.8.4) |
| **255677576** | **In fresh installations with Apigee Ingress (instead of user-installed Anthos Service Mesh), the Apigee UI would sometimes show red (not working) status.** This is because in certain circumstances Watcher did not send the correct deployment status due to using the wrong selector for the Apigee Ingress Gateway. (Fixed in Apigee hybrid v1.8.3) |
| **251435916** | **Fixed an issue where in certain circumstances, MP pods would scale without traffic.** (Fixed in Apigee hybrid v1.7.5) |
| **249144084** | **Reuse existing target IPs if DNS resolution fail on DNS cache refresh.** (Fixed in Apigee hybrid v1.8.1) |
| **245664917** | **During the upgrade to Apigee hybrid 1.8.x, after running apigeectl init and confirming that check-ready succeeded, the Cassandra schema validation job was in an error state.** Also fixed in Apigee hybrid v1.8.4 and newer (Fixed in Apigee hybrid v1.9.0 and v1.8.4) |
| **243880171** | **Upgrade from Apigee hybrid v1.7 to v1.8 could fail when `http_proxy` was configured to DENY internal network traffic.** (Fixed in Apigee hybrid v1.8.1) |
| **243717191** | **Container restart no longer conflicts with the existing certificates.** |
| **243599452** | **Fixed indentation issue with ingress gateway annotations.** (Fixed in Apigee hybrid v1.8.2) |
| **243167389** | **Apigee now validates the length of `ingressGateways[].name` in `overrides.yaml`.** TThe value of `ingressGateways:name` must meet the following requirements: - Have a maximum length of 17 characters - Contain only lowercase alphanumeric characters, '-' or '.' - Start with an alphanumeric character - End with an alphanumeric character See [`ingressGateways[].name`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/config-prop-ref.md.txt#ingressgateways-name) in the Configuration property reference. (Fixed in Apigee hybrid v1.8.1) |
| **243158304** | **'ApigeeRouteConfig' no longer looks for a cert in the `istio-system` namespace.** (Fixed in Apigee hybrid v1.9.0) |
| **241959053** | **Fixed `apigeectl` parsing error for `serviceaccountRef`.** (Fixed in Apigee hybrid v1.8.2) |
| **232529030** | **Replaced the Logging fluentbit container environment variable `http_proxy` with `HTTP__PROXY` to maintain compatibility with fluentbit 1.8.** (Fixed in Apigee hybrid v1.8.1) |
| **227212728** | **Cassandra scripts now avoid writing data to the Pod Filesystem.** (Fixed in Apigee hybrid v1.8.1) |
| **218567150** | **The ingress gateway is now configured to consistently preserve UUID in the `x-request-id` header.** This applies to both Apigee Ingress gateway and to the Istio ingress gateway when are using customer-installed Anthos Service Mesh. **Note:** This setting does have some impact on tracing in the ingress gateway. For more information, see `pack_trace_reason` in the ["UUID (proto)" page in the envoy documentation](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/request_id/uuid/v3/uuid.proto). (Fixed in Apigee hybrid v1.8.3) |

Breaking

| Bug ID | Description |
|---|---|
| **270371160** | **In Apigee hybrid v1.9.0, we removed certain insecure TLS ciphers.** Apigee hybrid supports the TLS cipher suites supported by the [Boring FIPS build of Envoy](https://www.envoyproxy.io/docs/envoy/v1.21.5/api-v3/extensions/transport_sockets/tls/v3/common.proto.html). **Note**: Apigee hybrid only supports the RSA ciphers listed. ECDSA ciphers are not supported. |

Security

| Bug ID | Description |
|---|---|
| **N/A** | **Upgraded to ASM 1.12.9 to address Istio and Go language vulnerabilities in an earlier version ([CVE-2022-39278](https://nvd.nist.gov/vuln/detail/CVE-2022-39278)).** For more information, see the [Service Mesh security bulletin](https://docs.cloud.google.com/service-mesh/docs/security-bulletins.md.txt#gcp-2022-020). (Fixed in Apigee hybrid v1.8.2) |
| **N/A** | **Upgraded to ASM 1.12.9 to address Istio and Go language vulnerabilities in an earlier version ([CVE-2022-39278](https://nvd.nist.gov/vuln/detail/CVE-2022-39278)).** For more information, see the [Service Mesh security bulletin](https://docs.cloud.google.com/service-mesh/docs/security-bulletins.md.txt#gcp-2022-020). (Fixed in Apigee hybrid v1.7.5) |
| **N/A** | **Miscellaneous Security updates and fixes.** (Fixed in Apigee hybrid v1.7.4) |
| **262576073** | **Security fix for apigee-watcher.** Also fixed in Apigee hybrid v1.8.4 and newer (Fixed in Apigee hybrid v1.9.0 and v1.8.4) This addresses the following vulnerabilities: - [CVE-2022-41716](https://nvd.nist.gov/vuln/detail/CVE-2022-41716) - [CVE-2022-41715](https://nvd.nist.gov/vuln/detail/CVE-2022-41715) - [CVE-2022-2880](https://nvd.nist.gov/vuln/detail/CVE-2022-2880) - [CVE-2022-2879](https://nvd.nist.gov/vuln/detail/CVE-2022-2879) |
| **262574571** | **Security fix for apigee-operators.** Also fixed in Apigee hybrid v1.8.4 and newer (Fixed in Apigee hybrid v1.9.0 and v1.8.4) This addresses the following vulnerabilities: - [CVE-2022-41716](https://nvd.nist.gov/vuln/detail/CVE-2022-41716) |
| **259290668** | **Update Kubectl in the backup utility.** (Fixed in Apigee hybrid v1.8.3) This addresses the following vulnerabilities: - [CVE-2022-1705](https://nvd.nist.gov/vuln/detail/CVE-2022-1705) - [CVE-2022-1962](https://nvd.nist.gov/vuln/detail/CVE-2022-1962) - [CVE-2022-23772](https://nvd.nist.gov/vuln/detail/CVE-2022-23772) - [CVE-2022-23773](https://nvd.nist.gov/vuln/detail/CVE-2022-23773) - [CVE-2022-23806](https://nvd.nist.gov/vuln/detail/CVE-2022-23806) - [CVE-2022-24675](https://nvd.nist.gov/vuln/detail/CVE-2022-24675) - [CVE-2022-24921](https://nvd.nist.gov/vuln/detail/CVE-2022-24921) - [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664) - [CVE-2022-28131](https://nvd.nist.gov/vuln/detail/CVE-2022-28131) - [CVE-2022-28327](https://nvd.nist.gov/vuln/detail/CVE-2022-28327) - [CVE-2022-2879](https://nvd.nist.gov/vuln/detail/CVE-2022-2879) - [CVE-2022-2880](https://nvd.nist.gov/vuln/detail/CVE-2022-2880) - [CVE-2022-30580](https://nvd.nist.gov/vuln/detail/CVE-2022-30580) - [CVE-2022-30629](https://nvd.nist.gov/vuln/detail/CVE-2022-30629) - [CVE-2022-30630](https://nvd.nist.gov/vuln/detail/CVE-2022-30630) - [CVE-2022-30631](https://nvd.nist.gov/vuln/detail/CVE-2022-30631) - [CVE-2022-30632](https://nvd.nist.gov/vuln/detail/CVE-2022-30632) - [CVE-2022-30633](https://nvd.nist.gov/vuln/detail/CVE-2022-30633) - [CVE-2022-30635](https://nvd.nist.gov/vuln/detail/CVE-2022-30635) - [CVE-2022-32148](https://nvd.nist.gov/vuln/detail/CVE-2022-32148) - [CVE-2022-32189](https://nvd.nist.gov/vuln/detail/CVE-2022-32189) - [CVE-2022-41715](https://nvd.nist.gov/vuln/detail/CVE-2022-41715) |
| **256019598** | **Security fix for Cassandra.** Also fixed in Apigee hybrid v1.8.4 and newer (Fixed in Apigee hybrid v1.9.0 and v1.8.4) This addresses the following vulnerabilities: - [CVE-2022-37434](https://nvd.nist.gov/vuln/detail/CVE-2022-37434) - [CVE-2022-32511](https://nvd.nist.gov/vuln/detail/CVE-2022-32511) - [CVE-2022-23806](https://nvd.nist.gov/vuln/detail/CVE-2022-23806) - [CVE-2022-23806](https://nvd.nist.gov/vuln/detail/CVE-2022-23806) - [CVE-2022-23806](https://nvd.nist.gov/vuln/detail/CVE-2022-23806) - [CVE-2022-2068](https://nvd.nist.gov/vuln/detail/CVE-2022-2068) - [CVE-2022-2068](https://nvd.nist.gov/vuln/detail/CVE-2022-2068) - [CVE-2022-1292](https://nvd.nist.gov/vuln/detail/CVE-2022-1292) - [CVE-2021-44521](https://nvd.nist.gov/vuln/detail/CVE-2021-44521) - [CVE-2021-38297](https://nvd.nist.gov/vuln/detail/CVE-2021-38297) - [CVE-2021-27568](https://nvd.nist.gov/vuln/detail/CVE-2021-27568) - [CVE-2020-2801](https://nvd.nist.gov/vuln/detail/CVE-2020-2801) - [CVE-2019-20445](https://nvd.nist.gov/vuln/detail/CVE-2019-20445) - [CVE-2019-20444](https://nvd.nist.gov/vuln/detail/CVE-2019-20444) |
| **254862745** , **249630685** | **Security fix for `apigee-diagnostics-runner` and `apigee-envoy`.** (Fixed in Apigee hybrid v1.8.3) This addresses the following vulnerabilities: - [CVE-2021-3999](https://nvd.nist.gov/vuln/detail/CVE-2021-3999) - [CVE-2022-2068](https://nvd.nist.gov/vuln/detail/CVE-2022-2068) |
| **254774193** , **254773110** | **Fix for vulnerability in `apigee-diagnostics-collector`, `apigee-mart-server`, and `apigee-mint-task-scheduler`.** (Fixed in Apigee hybrid v1.8.3) This addresses the following vulnerability: - [CVE-2022-2048](https://nvd.nist.gov/vuln/detail/CVE-2022-2048) |
| **254774167** | **Fix for `apigee-mart-server`, `apigee-mint-task-scheduler`, `apigee-runtime`, and `apigee-synchronizer`.** (Fixed in Apigee hybrid v1.8.3) This addresses the following vulnerabilities: - [CVE-2022-42004](https://nvd.nist.gov/vuln/detail/CVE-2022-42004) - [CVE-2022-42003](https://nvd.nist.gov/vuln/detail/CVE-2022-42003) |
| **254773838** , **254773636** , **254772551** , **254771693** | **Fix for vulnerability in `apigee-diagnostics-collector`, `apigee-mart-server`, `apigee-mint-task-scheduler`, `apigee-runtime`, and `apigee-synchronizer`.** (Fixed in Apigee hybrid v1.8.3) This addresses the following vulnerabilities: - [CVE-2022-25857](https://nvd.nist.gov/vuln/detail/CVE-2022-25857) - [CVE-2022-0239](https://nvd.nist.gov/vuln/detail/CVE-2022-0239) - [CVE-2021-37136](https://nvd.nist.gov/vuln/detail/CVE-2021-37136) - [CVE-2021-30468](https://nvd.nist.gov/vuln/detail/CVE-2021-30468) - [CVE-2017-18640](https://nvd.nist.gov/vuln/detail/CVE-2017-18640) |
| **254770883** , **249633275** , **249629782** | **Security fixes for `apigee-diagnostics-collector`, `apigee-mart-server`, `apigee-runtime`, and `apigee-synchronizer`.** (Fixed in Apigee hybrid v1.8.3) This addresses the following vulnerabilities: - [CVE-2022-42889](https://nvd.nist.gov/vuln/detail/CVE-2022-42889) - [CVE-2022-42004](https://nvd.nist.gov/vuln/detail/CVE-2022-42004) - [CVE-2022-42003](https://nvd.nist.gov/vuln/detail/CVE-2022-42003) - [CVE-2022-40150](https://nvd.nist.gov/vuln/detail/CVE-2022-40150) - [CVE-2022-40149](https://nvd.nist.gov/vuln/detail/CVE-2022-40149) - [CVE-2022-38752](https://nvd.nist.gov/vuln/detail/CVE-2022-38752) - [CVE-2022-38751](https://nvd.nist.gov/vuln/detail/CVE-2022-38751) - [CVE-2022-38750](https://nvd.nist.gov/vuln/detail/CVE-2022-38750) - [CVE-2022-38749](https://nvd.nist.gov/vuln/detail/CVE-2022-38749) - [CVE-2022-25857](https://nvd.nist.gov/vuln/detail/CVE-2022-25857) - [CVE-2022-3171](https://nvd.nist.gov/vuln/detail/CVE-2022-3171) - [CVE-2022-2097](https://nvd.nist.gov/vuln/detail/CVE-2022-2097) - [CVE-2022-2068](https://nvd.nist.gov/vuln/detail/CVE-2022-2068) - [CVE-2022-2048](https://nvd.nist.gov/vuln/detail/CVE-2022-2048) - [CVE-2022-2047](https://nvd.nist.gov/vuln/detail/CVE-2022-2047) - [CVE-2022-1292](https://nvd.nist.gov/vuln/detail/CVE-2022-1292) - [CVE-2021-31684](https://nvd.nist.gov/vuln/detail/CVE-2021-31684) - [CVE-2021-29425](https://nvd.nist.gov/vuln/detail/CVE-2021-29425) - [CVE-2021-27568](https://nvd.nist.gov/vuln/detail/CVE-2021-27568) - [CVE-2020-13936](https://nvd.nist.gov/vuln/detail/CVE-2020-13936) - [CVE-2020-8908](https://nvd.nist.gov/vuln/detail/CVE-2020-8908) - [CVE-2019-18276](https://nvd.nist.gov/vuln/detail/CVE-2019-18276) - [CVE-2018-10237](https://nvd.nist.gov/vuln/detail/CVE-2018-10237) - [CVE-2017-18640](https://nvd.nist.gov/vuln/detail/CVE-2017-18640) |
| **253693906** | **Upgraded Prometheus to 2.39.1 to address vulnerabilities in an earlier version.** (Fixed in Apigee hybrid v1.8.2) This addresses the following vulnerabilities: - [CVE-2022-24675](https://nvd.nist.gov/vuln/detail/CVE-2022-24675) - [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664) - [CVE-2022-28131](https://nvd.nist.gov/vuln/detail/CVE-2022-28131) - [CVE-2022-28327](https://nvd.nist.gov/vuln/detail/CVE-2022-28327) - [CVE-2022-30580](https://nvd.nist.gov/vuln/detail/CVE-2022-30580) - [CVE-2022-30630](https://nvd.nist.gov/vuln/detail/CVE-2022-30630) - [CVE-2022-30631](https://nvd.nist.gov/vuln/detail/CVE-2022-30631) - [CVE-2022-30632](https://nvd.nist.gov/vuln/detail/CVE-2022-30632) - [CVE-2022-30633](https://nvd.nist.gov/vuln/detail/CVE-2022-30633) - [CVE-2022-30635](https://nvd.nist.gov/vuln/detail/CVE-2022-30635) - [CVE-2022-32189](https://nvd.nist.gov/vuln/detail/CVE-2022-32189) |
| **253498057** | **Upgraded Fluent Bit to 1.9.9 to address vulnerabilities in an earlier version.** (Fixed in Apigee hybrid v1.8.2) This addresses the following vulnerabilities: - [CVE-2022-1292](https://nvd.nist.gov/vuln/detail/CVE-2022-1292) - [CVE-2022-2068](https://nvd.nist.gov/vuln/detail/CVE-2022-2068) - [CVE-2021-3999](https://nvd.nist.gov/vuln/detail/CVE-2021-3999) - [CVE-2022-23218](https://nvd.nist.gov/vuln/detail/CVE-2022-23218) - [CVE-2022-23219](https://nvd.nist.gov/vuln/detail/CVE-2022-23219) - [CVE-2022-25013](https://nvd.nist.gov/vuln/detail/CVE-2022-25013) - [CVE-2021-33574](https://nvd.nist.gov/vuln/detail/CVE-2021-33574) - [CVE-2018-12886](https://nvd.nist.gov/vuln/detail/CVE-2018-12886) - [CVE-2022-0778](https://nvd.nist.gov/vuln/detail/CVE-2022-0778) |
| **249635718** , **249629771** | **Security fixes for Apigee Connect and `apigee-redis`.** (Fixed in Apigee hybrid v1.8.3) This addresses the following vulnerabilities: - [CVE-2022-32189](https://nvd.nist.gov/vuln/detail/CVE-2022-32189) - [CVE-2022-30635](https://nvd.nist.gov/vuln/detail/CVE-2022-30635) - [CVE-2022-30633](https://nvd.nist.gov/vuln/detail/CVE-2022-30633) - [CVE-2022-30632](https://nvd.nist.gov/vuln/detail/CVE-2022-30632) - [CVE-2022-30631](https://nvd.nist.gov/vuln/detail/CVE-2022-30631) - [CVE-2022-30630](https://nvd.nist.gov/vuln/detail/CVE-2022-30630) - [CVE-2022-30580](https://nvd.nist.gov/vuln/detail/CVE-2022-30580) - [CVE-2022-28327](https://nvd.nist.gov/vuln/detail/CVE-2022-28327) - [CVE-2022-28131](https://nvd.nist.gov/vuln/detail/CVE-2022-28131) - [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664) - [CVE-2022-24921](https://nvd.nist.gov/vuln/detail/CVE-2022-24921) - [CVE-2022-24675](https://nvd.nist.gov/vuln/detail/CVE-2022-24675) - [CVE-2022-23773](https://nvd.nist.gov/vuln/detail/CVE-2022-23773) - [CVE-2022-23772](https://nvd.nist.gov/vuln/detail/CVE-2022-23772) |
| **249633289** | **Fix for `apigee-prometheus-adapter`.** (Fixed in Apigee hybrid v1.8.3) This addresses the following vulnerabilities: - [CVE-2022-21698](https://nvd.nist.gov/vuln/detail/CVE-2022-21698) - [CVE-2022-1996](https://nvd.nist.gov/vuln/detail/CVE-2022-1996) |
| **248288668** | **Fixes to address apigee-installer vulnerabilities.** (Fixed in Apigee hybrid v1.8.2) |
| **247864229** | **upgraded kube-rbac-proxy to v0.13.0 to address vulnerabilities in an earlier version.** (Fixed in Apigee hybrid v1.8.2) |
| **240833499** | **Security fix for gopkg.in/yaml.v3.** (Fixed in Apigee hybrid v1.7.4) |
| **230369447** | **Security fix for commons-codec** (Fixed in Apigee hybrid v1.7.4) |
| **230368838** | **Security fix for [CVE-2018-10237](https://nvd.nist.gov/vuln/detail/CVE-2018-10237), auto-value:guava.** (Fixed in Apigee hybrid v1.7.4) |
| **230366823** | **Security fix for jackson-databind.** (Fixed in Apigee hybrid v1.7.4) |
| **230366589** | **Security fix for [CVE-2021-22696-cxf](https://nvd.nist.gov/vuln/detail/CVE-2021-22696) in cxf.** (Fixed in Apigee hybrid v1.7.4) |
| **230366276** | **Security fix for [CVE-2021-22569](https://nvd.nist.gov/vuln/detail/CVE-2021-22569).** (Fixed in Apigee hybrid v1.7.4) |
| **229804717** | **Security fix for apigee-envoy.** (Fixed in Apigee hybrid v1.7.4) |
| **222772470** , **220169963** , **210116413** | **Security fix for [CVE-2021-38297](https://nvd.nist.gov/vuln/detail/CVE-2021-38297): Updated Go language version.** (Fixed in Apigee hybrid v1.8.1) |
| **222772341** , **222772333** , **222772261** , **222771839** | **Security fix for [CVE-2022-23806](https://nvd.nist.gov/vuln/detail/CVE-2022-23806): Updated Go language version.** (Fixed in Apigee hybrid v1.8.2) |
| **202174499** | **Fixed Vulnerability for protobuf-java and protobuf-java-util packages.** (Fixed in Apigee hybrid v1.8.2) |

## January 26, 2023

**Apigee hybrid** v1.8.4 Announcement

### hybrid v1.8.4

On January 26, 2023 we released an updated version of the Apigee hybrid software, v1.8.4.
For information on upgrading, see [Upgrading Apigee hybrid to version 1.8](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/upgrade.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **262699558** | **The watcher component failed when using Kubernetes Secret to store hybrid service account secret.** |
| **262616276** | **[Added support for Kubernetes v1.24 and v1.25](https://docs.cloud.google.com/apigee/docs/hybrid/supported-platforms.md.txt)** |
| **260372012** | **Requests failed with 500 response and keyvaluemap.service.ErrorDuringDecryption error after upgrade to Hybrid 1.8.** |
| **258699204** | **The default memory requests and limits for metrics pods that were inadvertently changed in 1.8.x. have been fixed.** |
| **245664917** | **During the upgrade to Apigee hybrid 1.8.x, after running apigeectl init and confirming that check-ready succeeded, the Cassandra schema validation job was in an error state.** |

Security

| Bug ID | Description |
|---|---|
| **262576073** | **Security fix for apigee-watcher.** This addresses the following vulnerabilities: ∙ [CVE-2022-41716](https://nvd.nist.gov/vuln/detail/CVE-2022-41716) ∙ [CVE-2022-41715](https://nvd.nist.gov/vuln/detail/CVE-2022-41715) ∙ [CVE-2022-2880](https://nvd.nist.gov/vuln/detail/CVE-2022-2880) ∙ [CVE-2022-2879](https://nvd.nist.gov/vuln/detail/CVE-2022-2879) |
| **262574571** | **Security fix for apigee-operators.** This addresses the following vulnerabilities: ∙ [CVE-2022-41716](https://nvd.nist.gov/vuln/detail/CVE-2022-41716) |

## January 17, 2023

**Apigee Integrated Portal** Announcement On January 17, 2023 we released an updated version of Apigee integrated portal.
Fixed

| Bug ID | Description |
|---|---|
| 262260756 | We have updated the new account notification to administrators to read: "A new account was created by {{firstname}} {{lastname}} ({{email}}), for site {{siteurl}}. If you have enabled manual approval for new user accounts, this user will not be able to log in until you approve their account creation request by setting their status to 'active'." This is to highlight that they need to manually activate new accounts ONLY if they have enabled manual approval for new accounts. |
| 261788412 | Updated the version of GraphiQL used in the portal. |

## January 11, 2023

**Apigee UI** Announcement On January 11, 2023, we released an updated version of the Apigee UI.
Feature **GA release of the new Proxy Editor**

The new Proxy Editor simplifies the process of adding policies to an API proxy, configuring those policies, and then deploying the proxy.

## January 10, 2023

**Apigee Integration** Announcement On January 10, 2023 we released an updated version of the Apigee Integrations software.
Feature **Cloud Scheduler trigger ([Preview](https://cloud.google.com/products#product-launch-stages))**

The Cloud Scheduler trigger lets you schedule your integration executions for defined time periods or regular intervals across multiple regions. Cloud Scheduler triggers leverage the [Cloud Scheduler](https://docs.cloud.google.com/scheduler/docs/overview.md.txt) services to provide a fully managed enterprise-grade cron job scheduler within Apigee Integration.

For more information, see [Cloud Scheduler trigger](https://docs.cloud.google.com/apigee/docs/api-platform/integration/configuring-cloud-scheduler-trigger).

## January 09, 2023

**Apigee UI** Announcement On January 9, 2023, we released an updated version of the Apigee UI.
Feature **Specify an IP range with prefix /28 when creating a new instance**

Previously, you could only specify an IP range with prefix /22 when creating an instance. This change makes it possible to specify /28 ranges as well as /22 ranges when creating an Apigee instance in the instance manager or the provisioning wizard.
Fixed

| Bug ID | Description |
|---|---|
| **255609921** | **Advanced API Security table rows now use links or span tags** |

## December 26, 2022

**Apigee Integration** Announcement On December 26, 2022 we released an updated version of the Apigee Integrations software.
Feature **Test without publishing an integration**

You can now test your integration without the need to publish or create a new integration version. Testing an integration lets you experiment with the integration input variable values, and helps in identifying any faults in the integration connection flow before you finalize and publish the integration.

For more information, see [Test and publish integrations](https://docs.cloud.google.com/apigee/docs/api-platform/integration/test-publish-integrations).

## December 14, 2022

**Apigee Integrated Portal** Announcement On December 14, 2022 we released an updated version of Apigee integrated portal.
Fixed

| Bug ID | Description |
|---|---|
| 260725456 | The `x-xss-protection` header on portal runtime loading changed from value of "1;" to be "1; mode=block". |
| 254053443 | Fixed a bug to ensure that a **Not found** page is displayed whenever an invalid document path is navigated to in a portal. |

## December 08, 2022

**Apigee X** Announcement On December 8, we released an updated version of Apigee X.

> [!NOTE]
> **Note:** Rollouts of this release will begin today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Feature **GA release of Simplified Onboarding for Apigee X (Pay-as-you-go) in the Google Cloud console.**

With this release, new Apigee customers using Pay-as-you-go pricing can quickly configure Apigee using a simplified onboarding flow accessible from the Google Cloud console.

- The new onboarding UI provides stepped navigation consistent with other products available in the console.
- Apigee X (Pay-as-you-go) provisioning is simplified but remains flexible. Default settings are provided, with the option to customize as needed.
- Improved contextual help streamlines decision-making during onboarding.

See [Before you begin](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/overview.md.txt) and [Get started in the Cloud Console](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/console-select-project.md.txt) for more details on provisioning Apigee X with Pay-as-you-go pricing from the Google Cloud console.

## December 05, 2022

**Apigee hybrid** v1.8.3 Announcement

### hybrid v1.8.3

On December 5, 2022 we released an updated version of the Apigee hybrid software, v1.8.3.

For information on upgrading, see [Upgrading Apigee hybrid to version 1.8](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/upgrade.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **259738092** | **Intermittent 404's were seen at the Apigee Ingress Gateway due to an inconsistent configuration delivery mechanism.** |
| **255677576** | **In fresh installations with Apigee Ingress (instead of user-installed Anthos Service Mesh), the Apigee UI would sometimes show red (not working) status.** This is because in certain circumstances Watcher did not send the correct deployment status due to using the wrong selector for the Apigee Ingress Gateway. |
| **218567150** | **The ingress gateway is now configured to consistently preserve UUID in the `x-request-id` header.** This applies to both Apigee Ingress gateway and to the Istio ingress gateway when are using customer-installed Anthos Service Mesh. **Note:** This setting does have some impact on tracing in the ingress gateway. For more information, see `pack_trace_reason` in the ["UUID (proto)" page in the envoy documentation](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/request_id/uuid/v3/uuid.proto). |

Security

| Bug ID | Description |
|---|---|
| **259290668** | **Update Kubectl in the backup utility.** This addresses the following vulnerabilities: ∙ [CVE-2022-42004](https://nvd.nist.gov/vuln/detail/CVE-2022-42004) ∙ [CVE-2022-42003](https://nvd.nist.gov/vuln/detail/CVE-2022-42003) ∙ [CVE-2022-32189](https://nvd.nist.gov/vuln/detail/CVE-2022-32189) ∙ [CVE-2022-30635](https://nvd.nist.gov/vuln/detail/CVE-2022-30635) ∙ [CVE-2022-30633](https://nvd.nist.gov/vuln/detail/CVE-2022-30633) ∙ [CVE-2022-30632](https://nvd.nist.gov/vuln/detail/CVE-2022-30632) ∙ [CVE-2022-30631](https://nvd.nist.gov/vuln/detail/CVE-2022-30631) ∙ [CVE-2022-30630](https://nvd.nist.gov/vuln/detail/CVE-2022-30630) ∙ [CVE-2022-30580](https://nvd.nist.gov/vuln/detail/CVE-2022-30580) ∙ [CVE-2022-28327](https://nvd.nist.gov/vuln/detail/CVE-2022-28327) ∙ [CVE-2022-28131](https://nvd.nist.gov/vuln/detail/CVE-2022-28131) ∙ [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664) ∙ [CVE-2022-25857](https://nvd.nist.gov/vuln/detail/CVE-2022-25857) ∙ [CVE-2022-24921](https://nvd.nist.gov/vuln/detail/CVE-2022-24921) ∙ [CVE-2022-24675](https://nvd.nist.gov/vuln/detail/CVE-2022-24675) ∙ [CVE-2022-23773](https://nvd.nist.gov/vuln/detail/CVE-2022-23773) ∙ [CVE-2022-23772](https://nvd.nist.gov/vuln/detail/CVE-2022-23772) ∙ [CVE-2022-23635](https://nvd.nist.gov/vuln/detail/CVE-2022-23635) ∙ [CVE-2022-0391](https://nvd.nist.gov/vuln/detail/CVE-2022-0391) ∙ [CVE-2021-39156](https://nvd.nist.gov/vuln/detail/CVE-2021-39156) ∙ [CVE-2021-39155](https://nvd.nist.gov/vuln/detail/CVE-2021-39155) ∙ [CVE-2021-37137](https://nvd.nist.gov/vuln/detail/CVE-2021-37137) ∙ [CVE-2021-37136](https://nvd.nist.gov/vuln/detail/CVE-2021-37136) ∙ [CVE-2021-29482](https://nvd.nist.gov/vuln/detail/CVE-2021-29482) ∙ [CVE-2021-20190](https://nvd.nist.gov/vuln/detail/CVE-2021-20190) ∙ [CVE-2021-3121](https://nvd.nist.gov/vuln/detail/CVE-2021-3121) ∙ [CVE-2020-36518](https://nvd.nist.gov/vuln/detail/CVE-2020-36518) ∙ [CVE-2020-36189](https://nvd.nist.gov/vuln/detail/CVE-2020-36189) ∙ [CVE-2020-36188](https://nvd.nist.gov/vuln/detail/CVE-2020-36188) ∙ [CVE-2020-36187](https://nvd.nist.gov/vuln/detail/CVE-2020-36187) ∙ [CVE-2020-36186](https://nvd.nist.gov/vuln/detail/CVE-2020-36186) ∙ [CVE-2020-36185](https://nvd.nist.gov/vuln/detail/CVE-2020-36185) ∙ [CVE-2020-36184](https://nvd.nist.gov/vuln/detail/CVE-2020-36184) ∙ [CVE-2020-36183](https://nvd.nist.gov/vuln/detail/CVE-2020-36183) ∙ [CVE-2020-36182](https://nvd.nist.gov/vuln/detail/CVE-2020-36182) ∙ [CVE-2020-36181](https://nvd.nist.gov/vuln/detail/CVE-2020-36181) ∙ [CVE-2020-36180](https://nvd.nist.gov/vuln/detail/CVE-2020-36180) ∙ [CVE-2020-36179](https://nvd.nist.gov/vuln/detail/CVE-2020-36179) ∙ [CVE-2020-35728](https://nvd.nist.gov/vuln/detail/CVE-2020-35728) ∙ [CVE-2020-35491](https://nvd.nist.gov/vuln/detail/CVE-2020-35491) ∙ [CVE-2020-35490](https://nvd.nist.gov/vuln/detail/CVE-2020-35490) ∙ [CVE-2020-29652](https://nvd.nist.gov/vuln/detail/CVE-2020-29652) ∙ [CVE-2020-25649](https://nvd.nist.gov/vuln/detail/CVE-2020-25649) ∙ [CVE-2020-24750](https://nvd.nist.gov/vuln/detail/CVE-2020-24750) ∙ [CVE-2020-24616](https://nvd.nist.gov/vuln/detail/CVE-2020-24616) ∙ [CVE-2020-17516](https://nvd.nist.gov/vuln/detail/CVE-2020-17516) ∙ [CVE-2020-16845](https://nvd.nist.gov/vuln/detail/CVE-2020-16845) ∙ [CVE-2020-14195](https://nvd.nist.gov/vuln/detail/CVE-2020-14195) ∙ [CVE-2020-14062](https://nvd.nist.gov/vuln/detail/CVE-2020-14062) ∙ [CVE-2020-14061](https://nvd.nist.gov/vuln/detail/CVE-2020-14061) ∙ [CVE-2020-14060](https://nvd.nist.gov/vuln/detail/CVE-2020-14060) ∙ [CVE-2019-16869](https://nvd.nist.gov/vuln/detail/CVE-2019-16869) ∙ [CVE-2019-9674](https://nvd.nist.gov/vuln/detail/CVE-2019-9674) ∙ [CVE-2019-0205](https://nvd.nist.gov/vuln/detail/CVE-2019-0205) ∙ [CVE-2018-1320](https://nvd.nist.gov/vuln/detail/CVE-2018-1320) ∙ [CVE-2017-18640](https://nvd.nist.gov/vuln/detail/CVE-2017-18640) ∙ [CVE-2016-5397](https://nvd.nist.gov/vuln/detail/CVE-2016-5397) |
| **254862745** , **249630685** | **Security fix for `apigee-diagnostics-runner` and `apigee-envoy`.** This addresses the following vulnerabilities: ∙ [CVE-2021-3999](https://nvd.nist.gov/vuln/detail/CVE-2021-3999) ∙ [CVE-2022-2068](https://nvd.nist.gov/vuln/detail/CVE-2022-2068) |
| **254774167** | **Fix for `apigee-mart-server`, `apigee-mint-task-scheduler`, `apigee-runtime`, and `apigee-synchronizer`.** This addresses the following vulnerabilities: ∙ [CVE-2022-42004](https://nvd.nist.gov/vuln/detail/CVE-2022-42004) ∙ [CVE-2022-42003](https://nvd.nist.gov/vuln/detail/CVE-2022-42003) |
| **254773838** , **254773636** , **254772551** , **254771693** | **Fix for vulnerability in `apigee-diagnostics-collector`, `apigee-mart-server`, `apigee-mint-task-scheduler`, `apigee-runtime`, and `apigee-synchronizer`.** This addresses the following vulnerabilities: ∙ [CVE-2022-25857](https://nvd.nist.gov/vuln/detail/CVE-2022-25857) ∙ [CVE-2022-0239](https://nvd.nist.gov/vuln/detail/CVE-2022-0239) ∙ [CVE-2021-37136](https://nvd.nist.gov/vuln/detail/CVE-2021-37136) ∙ [CVE-2021-30468](https://nvd.nist.gov/vuln/detail/CVE-2021-30468) ∙ [CVE-2017-18640](https://nvd.nist.gov/vuln/detail/CVE-2017-18640) |
| **254774193** , **254773110** | **Fix for vulnerability in `apigee-diagnostics-collector`, `apigee-mart-server`, and `apigee-mint-task-scheduler`.** This addresses the following vulnerability: ∙ [CVE-2022-2048](https://nvd.nist.gov/vuln/detail/CVE-2022-2048) |
| **254770883** , **249633275** , **249629782** | **Security fixes for `apigee-diagnostics-collector`, `apigee-mart-server`, `apigee-runtime`, and `apigee-synchronizer`.** This addresses the following vulnerabilities: ∙ [CVE-2022-42889](https://nvd.nist.gov/vuln/detail/CVE-2022-42889) ∙ [CVE-2022-42004](https://nvd.nist.gov/vuln/detail/CVE-2022-42004) ∙ [CVE-2022-42003](https://nvd.nist.gov/vuln/detail/CVE-2022-42003) ∙ [CVE-2022-40150](https://nvd.nist.gov/vuln/detail/CVE-2022-40150) ∙ [CVE-2022-40149](https://nvd.nist.gov/vuln/detail/CVE-2022-40149) ∙ [CVE-2022-38752](https://nvd.nist.gov/vuln/detail/CVE-2022-38752) ∙ [CVE-2022-38751](https://nvd.nist.gov/vuln/detail/CVE-2022-38751) ∙ [CVE-2022-38750](https://nvd.nist.gov/vuln/detail/CVE-2022-38750) ∙ [CVE-2022-38749](https://nvd.nist.gov/vuln/detail/CVE-2022-38749) ∙ [CVE-2022-25857](https://nvd.nist.gov/vuln/detail/CVE-2022-25857) ∙ [CVE-2022-3171](https://nvd.nist.gov/vuln/detail/CVE-2022-3171) ∙ [CVE-2022-2097](https://nvd.nist.gov/vuln/detail/CVE-2022-2097) ∙ [CVE-2022-2068](https://nvd.nist.gov/vuln/detail/CVE-2022-2068) ∙ [CVE-2022-2048](https://nvd.nist.gov/vuln/detail/CVE-2022-2048) ∙ [CVE-2022-2047](https://nvd.nist.gov/vuln/detail/CVE-2022-2047) ∙ [CVE-2022-1292](https://nvd.nist.gov/vuln/detail/CVE-2022-1292) ∙ [CVE-2021-31684](https://nvd.nist.gov/vuln/detail/CVE-2021-31684) ∙ [CVE-2021-29425](https://nvd.nist.gov/vuln/detail/CVE-2021-29425) ∙ [CVE-2021-27568](https://nvd.nist.gov/vuln/detail/CVE-2021-27568) ∙ [CVE-2020-13936](https://nvd.nist.gov/vuln/detail/CVE-2020-13936) ∙ [CVE-2020-8908](https://nvd.nist.gov/vuln/detail/CVE-2020-8908) ∙ [CVE-2019-18276](https://nvd.nist.gov/vuln/detail/CVE-2019-18276) ∙ [CVE-2018-10237](https://nvd.nist.gov/vuln/detail/CVE-2018-10237) ∙ [CVE-2017-18640](https://nvd.nist.gov/vuln/detail/CVE-2017-18640) |
| **249635718** , **249629771** | **Security fixes for Apigee Connect and `apigee-redis`.** This addresses the following vulnerabilities: ∙ [CVE-2022-32189](https://nvd.nist.gov/vuln/detail/CVE-2022-32189) ∙ [CVE-2022-30635](https://nvd.nist.gov/vuln/detail/CVE-2022-30635) ∙ [CVE-2022-30633](https://nvd.nist.gov/vuln/detail/CVE-2022-30633) ∙ [CVE-2022-30632](https://nvd.nist.gov/vuln/detail/CVE-2022-30632) ∙ [CVE-2022-30631](https://nvd.nist.gov/vuln/detail/CVE-2022-30631) ∙ [CVE-2022-30630](https://nvd.nist.gov/vuln/detail/CVE-2022-30630) ∙ [CVE-2022-30580](https://nvd.nist.gov/vuln/detail/CVE-2022-30580) ∙ [CVE-2022-28327](https://nvd.nist.gov/vuln/detail/CVE-2022-28327) ∙ [CVE-2022-28131](https://nvd.nist.gov/vuln/detail/CVE-2022-28131) ∙ [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664) ∙ [CVE-2022-24921](https://nvd.nist.gov/vuln/detail/CVE-2022-24921) ∙ [CVE-2022-24675](https://nvd.nist.gov/vuln/detail/CVE-2022-24675) ∙ [CVE-2022-23773](https://nvd.nist.gov/vuln/detail/CVE-2022-23773) ∙ [CVE-2022-23772](https://nvd.nist.gov/vuln/detail/CVE-2022-23772) |
| **249633289** | **Fix for `apigee-prometheus-adapter`.** This addresses the following vulnerabilities: ∙ [CVE-2022-21698](https://nvd.nist.gov/vuln/detail/CVE-2022-21698) ∙ [CVE-2022-1996](https://nvd.nist.gov/vuln/detail/CVE-2022-1996) |

## November 29, 2022

**Apigee Integration** Announcement On November 29, 2022 we released an updated version of the Apigee Integrations software.
Change **Integration variable color code**

The color codes of all the integration variable data types is removed and now changed to a single uniform color. Integration variables will no longer be color coded (green, blue, orange) based on their data type.

See [Format of an integration variable](https://docs.cloud.google.com/application-integration/docs/variables-overview#format-of-an-integration-variable).

<br />

**Data Mapping editor**

- The background color of the *Input* and *Output* row is changed to a single uniform color.
- *Input* rows are updated to add line breaks and indentations according to the use of mapping functions to improve readability and structure recognition.
- A confirmation dialog is displayed before proceeding to delete an entire *Input* row.

See \[Data Mapping editor\](/application-integration/docs/data-mapping-overview#data-mapping-editor).

## November 23, 2022

**Apigee Integration** Announcement On November 23, 2022 we released an updated version of the Apigee Integrations software.
Breaking

| Bug ID | Description |
|---|---|
| 250638658 | Updated the behaviour of the [SetIntegrationRequest policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/set-integration-request-policy.md.txt) to identify payload parameter strings enclosed within `$#` and `#$` as [flow variables](https://docs.cloud.google.com/apigee/docs/api-platform/reference/variables-reference.md.txt). [SetIntegrationRequest policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/set-integration-request-policy.md.txt) payload parameter strings enclosed within `{` and `}` are no longer identified as [flow variables](https://docs.cloud.google.com/apigee/docs/api-platform/reference/variables-reference.md.txt). |

## November 18, 2022

**Apigee X** Announcement On November 18, 2022, we released an updated version of Apigee X (1-9-0-apigee-16).

> [!NOTE]
> **Note:** Rollouts of this release began on 11/18/22 and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Fixed

| Bug ID | Description |
|---|---|
| 257268790 | There is an edge case scenario where an invalid resource or bundle configuration resulting in unhandled exception will result in failure that leads to restart of runtime pods or bootup of new runtime pods. |

Issue **Known issue:** [260324159 - API proxies and shared flows deployed by customers could take around 20 to 30 minutes to deploy in the runtime plane.](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt#260324159)

## November 14, 2022

**Apigee Monetization** Announcement On November 14, 2022 we released an updated version of the Apigee Monetization software.
Feature **Added support for a new recurring fees**

Apigee X now supports optional recurring fees charged to API developers. For more information on fees, see [Understanding billing](https://docs.cloud.google.com/apigee/docs/api-platform/monetization/overview.md.txt#understanding-billing).

## November 10, 2022

**Apigee Integrated Portal** Announcement On November 10, 2022 we released an updated version of Apigee integrated portal.
Fixed

| Bug ID | Description |
|---|---|
| 246636016 | Updated the handling of linked or uploaded empty specification files for API catalog items, and added a meaningful error message. |
| 226406073 | In the portal list view, changed column **Last Published** to **Created**. Sorting is by oldest portal at top. |
| 182687440 | Updated the file filter for icon upload so you can choose and upload `.ico` files. |
| 153886771 | Fixed an issue with identity provider configuration where SAML certificate data would not correctly render after initial upload. |

**Apigee Monetization** Announcement On November 10, 2022 we released an updated version of the Apigee Monetization software.
Feature **Added support for a new setup fee**

Apigee X now supports an optional setup fee charged to new API developers. For more information on fees, see [Understanding billing](https://docs.cloud.google.com/apigee/docs/api-platform/monetization/overview.md.txt#understanding-billing).

## November 04, 2022

**Apigee Integration** Announcement On November 4, 2022 we released an updated version of the Apigee Integration software.
Deprecated **US multi-region (us) for Apigee Integration is deprecated. Use *us-east1* , *us-west1* , or *us-central1* locations instead**

As of **November 10, 2022** , you can no longer create an integration in the US multi-region (us) location. Any existing integration running in US multi-region (us) will be stopped on or after **January 10, 2023**.

It's recommended that you perform the following actions before **January 10, 2023**:

- Clone your existing integrations to *us-east1* , *us-west1* , *us-central1* , or any of the [supported regions](https://docs.cloud.google.com/apigee/docs/api-platform/integration/system-limits#supported-regions). For information about how to clone an integration, see [Clone integrations](https://docs.cloud.google.com/apigee/docs/api-platform/integration/clone-integration).

- Migrate your existing integration proxies to *us-east1* , *us-west1* , *us-central1* , or any of the [supported regions](https://docs.cloud.google.com/apigee/docs/api-platform/integration/system-limits#supported-regions). You can do this by manually updating the `IntegrationRegion` child element in the [SetIntegrationRequest](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/set-integration-request-policy.md.txt) policy.

**Apigee X** Announcement On November 4, 2022 we released an updated version of Apigee X.
Feature Apigee support for using Private Service Connect (PSC) for client-to-Apigee (northbound) traffic is now GA. In addition, we now support using PSC for northbound routing in multi-region configurations. For details, see [Expanding Apigee to multiple regions](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/multi-region.md.txt). See also [Northbound networking with Private Service Connect](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/northbound-networking-psc.md.txt) and [Migrate northbound routing to Private Service Connect](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/migrate-from-mig-to-psc.md.txt).

## November 02, 2022

**Apigee hybrid** v1.7.5 Announcement

### hybrid v1.7.5

On November 2, 2022 we released an updated version of the Apigee hybrid software, v1.7.5.

For information on upgrading, see [Upgrading Apigee hybrid to version 1.7](https://docs.cloud.google.com/apigee/docs/hybrid/v1.7/upgrade.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **251435916** | **Fixed an issue where in certain circumstances, MP pods would scale without traffic.** |
| **241959053** | **Fixed `apigeectl` parsing error for `serviceaccountRef`.** |

Security

| Bug ID | Description |
|---|---|
| **253693906** | **Upgraded Prometheus to 2.39.1 to address vulnerabilities in an earlier version.** This change addresses the following vulnerabilities: ∙ [CVE-2022-24675](https://nvd.nist.gov/vuln/detail/CVE-2022-24675) ∙ [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664) ∙ [CVE-2022-28131](https://nvd.nist.gov/vuln/detail/CVE-2022-28131) ∙ [CVE-2022-28327](https://nvd.nist.gov/vuln/detail/CVE-2022-28327) ∙ [CVE-2022-30580](https://nvd.nist.gov/vuln/detail/CVE-2022-30580) ∙ [CVE-2022-30630](https://nvd.nist.gov/vuln/detail/CVE-2022-30630) ∙ [CVE-2022-30631](https://nvd.nist.gov/vuln/detail/CVE-2022-30631) ∙ [CVE-2022-30632](https://nvd.nist.gov/vuln/detail/CVE-2022-30632) ∙ [CVE-2022-30633](https://nvd.nist.gov/vuln/detail/CVE-2022-30633) ∙ [CVE-2022-30635](https://nvd.nist.gov/vuln/detail/CVE-2022-30635) ∙ [CVE-2022-32189](https://nvd.nist.gov/vuln/detail/CVE-2022-32189) |
| **253498057** | **Upgraded Fluent Bit to 1.9.9 to address vulnerabilities in an earlier version.** This change addresses the following vulnerabilities: ∙ [CVE-2022-1292](https://nvd.nist.gov/vuln/detail/CVE-2022-1292) ∙ [CVE-2022-2068](https://nvd.nist.gov/vuln/detail/CVE-2022-2068) ∙ [CVE-2021-3999](https://nvd.nist.gov/vuln/detail/CVE-2021-3999) ∙ [CVE-2022-23218](https://nvd.nist.gov/vuln/detail/CVE-2022-23218) ∙ [CVE-2022-23219](https://nvd.nist.gov/vuln/detail/CVE-2022-23219) ∙ [CVE-2022-25013](https://nvd.nist.gov/vuln/detail/CVE-2022-25013) ∙ [CVE-2021-33574](https://nvd.nist.gov/vuln/detail/CVE-2021-33574) ∙ [CVE-2018-12886](https://nvd.nist.gov/vuln/detail/CVE-2018-12886) ∙ [CVE-2022-0778](https://nvd.nist.gov/vuln/detail/CVE-2022-0778) |
| **248288668** | **Fixes to address apigee-installer vulnerabilities.** |
| **247864229** | **upgraded kube-rbac-proxy to v0.13.0 to address vulnerabilities in an earlier version.** |
| **N/A** | **Upgraded to ASM 1.12.9 to address Istio and Go language vulnerabilities in an earlier version ([CVE-2022-39278](https://nvd.nist.gov/vuln/detail/CVE-2022-39278)).** For more information, see the [Service Mesh security bulletin](https://docs.cloud.google.com/service-mesh/docs/security-bulletins.md.txt#gcp-2022-020). |

## October 27, 2022

**Apigee X** Announcement On October 27, 2022 we released an updated version of Apigee X.
Feature This release contains the General Acceptance (GA) release of [Advanced API Security](https://docs.cloud.google.com/apigee/docs/api-security.md.txt), which:

- Detects unwanted requests sent to your APIs, including attacks by bots or other malicious agents.
- Evaluates the security of your API configurations and provides recommendations for improvements.

Advanced API Security is a paid add-on to Apigee. You can try
out Advanced API Security for free in any trial org---follow the procedure described
in [Enable Advanced API Security](https://docs.cloud.google.com/apigee/docs/api-security/enable-security.md.txt#enable).
Contact [Apigee](https://docs.cloud.google.com/contact?direct=true&pre_product=apigee)
to learn more.
**Apigee hybrid** v1.8.2 Announcement

### hybrid v1.8.2

On October 27, 2022 we released an updated version of the Apigee hybrid software, v1.8.2.

For information on upgrading, see [Upgrading Apigee hybrid to version 1.8](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/upgrade.md.txt).
Security

| Bug ID | Description |
|---|---|
| **253693906** | **Upgraded Prometheus to 2.39.1 to address vulnerabilities in an earlier version.** This change addresses the following vulnerabilities: ∙ [CVE-2022-24675](https://nvd.nist.gov/vuln/detail/CVE-2022-24675) ∙ [CVE-2022-27664](https://nvd.nist.gov/vuln/detail/CVE-2022-27664) ∙ [CVE-2022-28131](https://nvd.nist.gov/vuln/detail/CVE-2022-28131) ∙ [CVE-2022-28327](https://nvd.nist.gov/vuln/detail/CVE-2022-28327) ∙ [CVE-2022-30580](https://nvd.nist.gov/vuln/detail/CVE-2022-30580) ∙ [CVE-2022-30630](https://nvd.nist.gov/vuln/detail/CVE-2022-30630) ∙ [CVE-2022-30631](https://nvd.nist.gov/vuln/detail/CVE-2022-30631) ∙ [CVE-2022-30632](https://nvd.nist.gov/vuln/detail/CVE-2022-30632) ∙ [CVE-2022-30633](https://nvd.nist.gov/vuln/detail/CVE-2022-30633) ∙ [CVE-2022-30635](https://nvd.nist.gov/vuln/detail/CVE-2022-30635) ∙ [CVE-2022-32189](https://nvd.nist.gov/vuln/detail/CVE-2022-32189) |
| **253498057** | **Upgraded Fluent Bit to 1.9.9 to address vulnerabilities in an earlier version.** This change addresses the following vulnerabilities: ∙ [CVE-2022-1292](https://nvd.nist.gov/vuln/detail/CVE-2022-1292) ∙ [CVE-2022-2068](https://nvd.nist.gov/vuln/detail/CVE-2022-2068) ∙ [CVE-2021-3999](https://nvd.nist.gov/vuln/detail/CVE-2021-3999) ∙ [CVE-2022-23218](https://nvd.nist.gov/vuln/detail/CVE-2022-23218) ∙ [CVE-2022-23219](https://nvd.nist.gov/vuln/detail/CVE-2022-23219) ∙ [CVE-2022-25013](https://nvd.nist.gov/vuln/detail/CVE-2022-25013) ∙ [CVE-2021-33574](https://nvd.nist.gov/vuln/detail/CVE-2021-33574) ∙ [CVE-2018-12886](https://nvd.nist.gov/vuln/detail/CVE-2018-12886) ∙ [CVE-2022-0778](https://nvd.nist.gov/vuln/detail/CVE-2022-0778) |
| **248288668** | **Fixes to address apigee-installer vulnerabilities.** |
| **247864229** | **upgraded kube-rbac-proxy to v0.13.0 to address vulnerabilities in an earlier version.** |
| **N/A** | **Upgraded to ASM 1.12.9 to address Istio and Go language vulnerabilities in an earlier version ([CVE-2022-39278](https://nvd.nist.gov/vuln/detail/CVE-2022-39278)).** For more information, see the [Service Mesh security bulletin](https://docs.cloud.google.com/service-mesh/docs/security-bulletins.md.txt#gcp-2022-020). |

## October 24, 2022

**Apigee X** Announcement On October 24, 2022, we released an updated version of Apigee X (1-9-0-apigee-5).

> [!NOTE]
> **Note:** Rollouts of this release will begin today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Feature Some runtime error messages have been improved with a reason code. To display only the error codes with a reason code, scroll down to **Search** and type `reason`. The error catalog filters the view.

See: [Runtime error catalog](https://docs.cloud.google.com/apigee/docs/api-platform/errorcatalog/mp-runtime-errorcatalog.md.txt)
Fixed

| Bug ID | Description |
|---|---|
| 252818300 | **Fixed issue with failing web socket connections.** |
| 249580739 | This feature introduces a new filter-based mechanism to display API products. |
| 249521773 | **Endpoint attachment ID naming convention change.** The ID must start with a lowercase letter followed by up to 31 lowercase letters, numbers, or hyphens, and cannot end with a hyphen. The minimum length is 2. See [Create an endpoint attachment](https://docs.cloud.google.com/apigee/docs/api-platform/architecture/southbound-networking-patterns-endpoints.md.txt#create-an-endpoint-attachment). |
| 249069616 | Fixed issue where error in DebugSession could interrupt runtime flow. |
| 248631925 | The Developer List API has been enhanced to support pagination in a Google-wide consistent pattern. |
| 247540503 | Race condition with encryption key lookup causing KVM lookup failures. |
| 246774745 | **`io.timeout.millis` not honored, causing `504 Gateway timeout` for dynamic targets.** |
| 246193561 | Disabling/Destroying of customer cloud KMS key impacted the runtime after 5 minutes and data that was encrypted with the key could not be accessed by Apigee data plane. |
| 241786534 | MART is able to send logs to UDCA successfully now. |
| 240618523 | Dynamically setting `target.url` now supports websocket protocols (`ws` and `wss`) |
| 218567150 | **`X-request-id` headers modified at 14th character.** |
| 206879901 | Fixed issue where Response headers were not visible from debug screen. |
| 173566787 | Message Processors behavior is changed. Message Processors will now reuse existing target IP addresses once if DNS resolution fails during DNS cache refresh |
| 159599332 | The flow variable `servicecallout.requesturi` reflects appropriately if the URI is constructed using multiple variables. |
| N/A | **Upgraded infrastructure and libraries** |

Security

| Bug ID | Description |
|---|---|
| 204965286 | Security fix for [CVE-2022-25647](https://nvd.nist.gov/vuln/detail/CVE-2022-25647) |
| 193613381 | Security fix for [CVE-2021-21290](https://nvd.nist.gov/vuln/detail/CVE-2021-21290) in netty-transport |

Issue **Known issue:** [257268790 - Unhandled exception results in failure that leads to restart or bootup of new runtime pods.](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt#257268790)

## October 19, 2022

**Apigee Integrated Portal** Announcement On October 19, 2022 we released an updated version of Apigee integrated portal.
Fixed

| Bug ID | Description |
|---|---|
| 239424786 | When reusing your portal custom domain with other sites, the cookies for the domain can get larger. This fix allows you to send cookies up to 16K in size, up from the previous 8K limit. |
| 237181283 | Pressing the enter button in the input field of **Portals \> Accounts \> Authentication \> Account creation \& sign in** no longer opens a file explorer window. |
| 233933177 | The email notification field for new account creation can be only a single email address, and not multiple email addresses separated by a delimiter (ie , space or tab). This fix adds validation on the client side to enforce this limitation. |

## October 18, 2022

**Apigee Adapter for Envoy** v2.0.6 Announcement

### v2.0.6

On October 18, 2022, we released version 2.0.6 of Apigee Adapter for Envoy.
Change Security release to address a Denial of Service (DoS) vulnerability in a dependency library. See [CVE-2022-28948](https://www.cve.org/CVERecord?id=CVE-2022-28948).

## October 06, 2022

**Apigee X** Announcement On October 6, 2022, Apigee announced the GA launch of Cloud Monitoring for Apigee gateway node usage for Pay-as-you-go customers.

The availability of Apigee gateway node usage metrics in Cloud Monitoring enables Pay-as-you-go customers to view node usage, create dashboards, and configure alerting policies using Cloud Monitoring interfaces. For more information, see [View usage and estimate your bill](https://docs.cloud.google.com/apigee/docs/api-platform/reference/pay-as-you-go-view-usage).

## October 04, 2022

**Apigee Integration** Announcement On October 4, 2022 we released an updated version of the Apigee Integration software.
Change **Apigee Integration trials**

Starting with this release, Apigee Integration trials (eval org) is available in [Application Integration](https://docs.cloud.google.com/application-integration/docs/release-notes.md.txt#September_28_2022). Users in a newly provisioned Apigee eval org will be redirected to Application Integration when they open Integrations in Apigee. You can continue using the Apigee proxies (created in the eval org) with the integrations created in Application Integration.

> [!NOTE]
> **Note:** There is no change in the process of enabling integrations in an Apigee paid org. For information about Apigee paid org, see [Enable integrations in a paid org](https://docs.cloud.google.com/apigee/docs/api-platform/integration/getting-started-apigee-integration#enable-integrations-in-a-paid-org).

## October 01, 2022

**Apigee hybrid** preview Announcement

### hybrid new installation experience public preview

On September 30, 2022 we released the public preview of the new Apigee hybrid installation experience.

#### Overview

The new Apigee hybrid installation experience provides a Kubernetes way of installing Apigee components using [`kubectl`](https://kubernetes.io/docs/reference/kubectl/kubectl/). The enhanced validations and visibility of the components being installed provides better debuggability and improves the overall install process.

An install script, `apigee-hybrid-setup.sh`, provides an easy tool for basic installation. You can use that to create your hybrid installation and then modify it to fit your needs with `kubectl`, or you can create your hybrid installation from scratch using `kubectl`. All Apigee hybrid configuration properties are stored in yaml files, one for each major component. This allows much more granular control of your hybrid installation on your Kubernetes environment.

#### Links

- [Preview release documentation](https://docs.cloud.google.com/apigee/docs/hybrid/preview/new-install-user-guide.md.txt)
- [GitHub repository](https://github.com/apigee/apigee-hybrid-install/releases/tag/preview-1)

#### Preview release

The new Apigee hybrid installation experience and its documentation are part of a *preview release*. Apigee does not warranty the software or the procedures in this preview. The software and documentation are subject to change without notice.

## September 29, 2022

**Apigee hybrid** v1.8.1 Announcement

### hybrid v1.8.1

On September 29, 2022 we released an updated version of the Apigee hybrid software, v1.8.1.

For information on upgrading, see [Upgrading Apigee hybrid to version 1.8](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/upgrade.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **249144084** | **Reuse existing target IPs if DNS resolution fail on DNS cache refresh.** |
| **243880171** | **Upgrade from Apigee hybrid v1.7 to v1.8 could fail when `http_proxy` was configured to DENY internal network traffic.** |
| **243717191** | **Container restart no longer conflicts with the existing certificates.** |
| **243599452** | **Fixed indentation issue with ingress gateway annotations.** |
| **243167389** | **Apigee now validates the length of `ingressGateways[].name` in `overrides.yaml`.** TThe value of `ingressGateways:name` must meet the following requirements: - Have a maximum length of 17 characters - Contain only lowercase alphanumeric characters, '-' or '.' - Start with an alphanumeric character - End with an alphanumeric character See [`ingressGateways[].name`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/config-prop-ref.md.txt#ingressgateways-name) in the Configuration property reference. |
| **241959053** | **Fixed `apigeectl` parsing error for `serviceaccountRef`.** |
| **232529030** | **Replaced the Logging fluentbit container environment variable `http_proxy` with `HTTP__PROXY` to maintain compatibility with fluentbit 1.8.** |
| **227212728** | **Cassandra scripts now avoid writing data to the Pod Filesystem.** |

Security

| Bug ID | Description |
|---|---|
| **222772470** , **220169963** , **210116413** | **Security fix for [CVE-2021-38297](https://nvd.nist.gov/vuln/detail/CVE-2021-38297): Updated Go language version.** |
| **222772341** , **222772333** , **222772261** , **222771839** | **Security fix for [CVE-2022-23806](https://nvd.nist.gov/vuln/detail/CVE-2022-23806): Updated Go language version.** |
| **202174499** | **Fixed Vulnerability for protobuf-java and protobuf-java-util packages.** |

## September 26, 2022

**Apigee X** Announcement Availability of scripts to recreate Apigee instances created before January 25, 2022.
Feature If you have an Apigee instance that was created before January 25, 2022, Apigee recommends that you replace it with a new instance. If you do not recreate the older instance, you may experience scaling issues and the number of environments you can add to an instance will continue to be limited to 10.

For more information and detailed instructions, see [Recreating an Apigee instance with zero downtime](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/instance-recreate.md.txt)

## September 14, 2022

**Apigee X** Announcement On September 14, 2022 we released an updated version of the Apigee X software.
Feature When using local development with Apigee in VS Code, the following pre-release features are available as part of the Insiders build (v1.21.0 and higher):

- [Using a different version of the Apigee Emulator](https://docs.cloud.google.com/apigee/docs/api-platform/local-development/vscode/manage-apigee-emulator.md.txt#using_a_different_version_of_the_apigee_emulator)

- [Customizing the Apigee runtime Docker container](https://docs.cloud.google.com/apigee/docs/api-platform/local-development/vscode/manage-apigee-emulator.md.txt#customizing_the_apigee_runtime_docker_container)

## September 12, 2022

**Apigee Integrated Portal** Announcement On September 12, 2022 we released an updated version of Apigee integrated portal.
Fixed

| Bug ID | Description |
|---|---|
| 237412458 | Fixed an issue where some SMTP settings were not migrated to an upgraded portal. |
| 235634994 | Implemented a minor security fix to block content spoofing in the API search page. |
| 233407912 | When creating a new App key for products that have been set to manual approval, but have already been approved, the new key will "auto" approve and not have to go through the approval process again. |

## September 09, 2022

**Apigee X** Announcement On September 09, 2022, we released an updated version of Apigee X.
Feature With this release, Apigee support for Private Service Connect (PSC) is GA. PSC allows you to privately connect Apigee to target services running across VPC networks in addition to the peered network. For more information, see [Southbound networking patterns](https://docs.cloud.google.com/apigee/docs/api-platform/architecture/southbound-networking-patterns-endpoints.md.txt).

## September 02, 2022

**Apigee hybrid** v1.7.4 Announcement

### hybrid v1.7.4

On September 2, 2022 we released an updated version of the Apigee hybrid software, v1.7.4.

For information on upgrading, see [Upgrading Apigee hybrid to version 1.7](https://docs.cloud.google.com/apigee/docs/hybrid/v1.7/upgrade.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **232529030** | **Replaced the Logging fluentbit container environment variable `http_proxy` with `HTTP_PROXY` to maintain compatibility with fluentbit 1.8.** |

Security

| Bug ID | Description |
|---|---|
| **240833499** | **Security fix for gopkg.in/yaml.v3.** |
| **230369447** | **Security fix for commons-codec** |
| **230368838** | **Security fix for [CVE-2018-10237](https://nvd.nist.gov/vuln/detail/CVE-2018-10237), auto-value:guava.** |
| **230366823** | **Security fix for jackson-databind.** |
| **230366589** | **Security fix for [CVE-2021-22696-cxf](https://nvd.nist.gov/vuln/detail/CVE-2021-22696) in cxf.** |
| **230366276** | **Security fix for [CVE-2021-22569](https://nvd.nist.gov/vuln/detail/CVE-2021-22569).** |
| **229804717** | **Security fix for apigee-envoy.** |
| **N/A** | **Miscellaneous Security updates and fixes.** |

## September 01, 2022

**Apigee Integration** Announcement On September 01, 2022 we released an updated version of the Apigee Integration software.
Feature **Region support for integration endpoint**

- **Region support when creating an integration using a proxy.** You can now specify the region of the integration in a proxy and use that region to generate a regionalised integration endpoint. For more information, see [Getting started with Apigee Integration and Apigee proxy Integration targets.](https://docs.cloud.google.com/apigee/docs/api-platform/integration/getting-started-apigee-target-endpoint.md.txt)

- **Region support in [SetIntegrationRequest policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/set-integration-request-policy.md.txt).** Using the [\<IntegrationRegion\>](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/set-integration-request-policy.md.txt#integrationregion) element, you can now specify the region of your integration in the [SetIntegrationRequest policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/set-integration-request-policy.md.txt).


  **Note:** [\<IntegrationRegion\>](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/set-integration-request-policy.md.txt#integrationregion) is a mandatory element in the [SetIntegrationRequest policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/set-integration-request-policy.md.txt) and applies to any new proxies that are created from this release onwards. If there is no [\<IntegrationRegion\>](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/set-integration-request-policy.md.txt#integrationregion) provided in the policy, Apigee will throw an error and continue execution using the Apigee runtime region.


  For more information, see [SetIntegrationRequest policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/set-integration-request-policy.md.txt).

  <br />

## August 30, 2022

**Apigee X** Feature With this release, the Apigee **Pay-as-you-go** pricing model includes a maximum Apigee gateway node count of 1,000 across all environments in a region.
Announcement On August 30, 2022, Apigee announced the GA launch of **Pay-as-you-go pricing**, a consumption-based model for
Google's Apigee Platform.

When you use **Pay-as-you-go pricing** for Apigee, you are charged for the following:

- The number of Apigee gateway nodes in the Apigee organization
- The number of API requests processed by Apigee Analytics services
- The amount of network usage

For more information, see the [Pay-as-you-go overview](https://docs.cloud.google.com/apigee/docs/api-platform/reference/pay-as-you-go) and the [Pay-as-you-go
Example pricing](https://cloud.google.com/apigee/docs/api-platform/reference/pay-as-you-go-examples).

## August 23, 2022

**Apigee UI** Announcement On August 23, 2022, we released an updated version of the Apigee UI.

**Note:** Rollouts of this release will begin today and may take several weeks to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.
Change With this release, the Apigee UI will display the new version of the Proxy Editor by default.
Feature In this release, you can view both the visual editor and the text editor at the same time in the Develop view, without having to manually switch between the two. You can also resize the display area of either editor to view it more easily. See [Change the target endpoint](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/change-endpoint.md.txt#new-proxy-editor) for a description of the changes to the editor layout.

## August 22, 2022

**Apigee X** Issue Value of `io.timeout.millis` is not honored when used with multiple dynamic targets.

If a proxy sets two or more `io.timeout.millis` values in two or more flows using the same target host, only one ` io.timeout.millis` value is honored.

<br />

Announcement On August 22, 2022, we released an updated version of Apigee X (1-8-0-apigee-33).

> [!NOTE]
> **Note:** Rollouts of this release will begin today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Fixed

| Bug ID | Description |
|---|---|
| N/A | **Upgraded infrastructure and libraries** |

**Apigee hybrid** v1.8.0 Announcement

### hybrid v1.8.0

On August 22, 2022 we released an updated version of the Apigee hybrid software, v1.8.0.

For information on upgrading, see [Upgrading Apigee hybrid to version 1.8](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/upgrade.md.txt).
Feature **`tools/apigee-pull-push.sh` includes a `--list` option to list all images**

Starting in version 1.8, The `tools/apigee-pull-push.sh` utility has a `--list` or `-l` option that will list all images in the gcr repo. See [`apigee-pull-push.sh`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/apigee-pull-push.md.txt) for details.
Feature **KVM pagination**

The Key Value Map (KVM) CRUD APIs with pagination support are now available in Hybrid (introduced in Apigee X on March 10, 2022). See [REST Resource: `organizations.keyvaluemaps`](https://docs.cloud.google.com/apigee/docs/reference/apis/apigee/rest/v1/organizations.keyvaluemaps.md.txt) and [REST Resource: `v1.organizations.environments.keyvaluemaps`](https://docs.cloud.google.com/apigee/docs/reference/apis/apigee/rest.md.txt#rest-resource:-v1.organizations.environments.keyvaluemaps).
Feature **`apigeectl` now supports the `--v` option to set the log verbosity level**

Starting in version 1.8, `apigeectl` includes a `--v` option to set log verbosity levels in the format `--v=int`, for example `apigeectl apply --v=5`. This option replaces the `--verbose` option *(now deprecated)* . This is the same as the `kubectl` `--v` option. See [`apigeectl`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/cli-reference.md.txt) for details.
Feature **Apigee Ingress gateway**

Starting in version 1.8, Apigee hybrid offers a new feature to manage the ingress gateway for your hybrid installation, Apigee ingress gateway. Anthos Service Mesh is no longer a prerequisite for hybrid installation. With Apigee ingress gateway, Apigee will stop supplying routing configuration to Anthos Service Mesh. See [Managing Apigee ingress](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/managing-ingress.md.txt).
Feature **Support for newer versions of Anthos, Anthos Service Mesh, and Kubernetes**

Starting in version 1.8, Apigee hybrid supports Anthos version 1.12, Anthos Service Mesh version 1.13, and Kubernetes version 1.23 on specific platforms. See [Apigee hybrid supported platforms and versions](https://docs.cloud.google.com/apigee/docs/hybrid/supported-platforms.md.txt) for details.
Feature **ORG-level UDCA**

Apigee hybrid now supports setting UDCA at the org level instead of at the environment level. See [`orgScopedUDCA` in the Configuration property reference](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/config-prop-ref.md.txt#orgscopedudca).
Fixed

| Bug ID | Description |
|---|---|
| **239854141** | **`apigee-pull-push.sh` now uses gcr source repositories.** (Fixed in Apigee hybrid v1.8.0) |
| **238370197** | **Fixed an issue where the `timeTaken` variable's value could sometimes be calculated incorrectly.** (Fixed in Apigee hybrid v1.7.3) |
| **236399482** | **Added support for ASM v1.13.** (Fixed in Apigee hybrid v1.7.2) |
| **236129944** | **Fixed the controller crashloopbackoff due to null pointer issue.** (Fixed in Apigee hybrid v1.6.9) |
| **236129944** | **Fixed the controller crashloopbackoff resulting from null pointer.** (Fixed in Apigee hybrid v1.7.2) |
| **234620567** | **Fix logger issue in Anthos BareMetal with CentOS.** (Fixed in Apigee hybrid v1.6.9) |
| **234355351** | **Fixed issue with message processor pods restarting frequently.** Added backoff polling task for Cloud KMS key listener. The listener is paused only when the flush policy is met. (Fixed in Apigee X, June 21, 2022) |
| **233349518** | **Fixed "Invalid Resource" error generated for `job/apigee-resources-install`.** (Fixed in Apigee hybrid v1.7.1) |
| **233094108** | **Fixed Stacktrace truncation in runtime containers to support proxy diagnosis.** (Fixed in Apigee hybrid v1.7.2) |
| **232977937** | **Fixed an issue where deployment would become stuck on "Applying routing changes on" for multiple ingress gateways.** (Fixed in Apigee hybrid v1.7.1) |
| **231313050** | **Fixed issue causing Apigee logger pod to remain in crashloopbackoff state.** (Fixed in Apigee hybrid v1.7.2) |
| **229824389** | **Fixed an issue in hybrid 1.7.0 where the output `apigeectl init` could be generated in the wrong order.** (Fixed in Apigee hybrid v1.7.1) |
| **229804717** | **Fixed upgrade envoy to use distroless v1.22.0.** (Fixed in Apigee hybrid v1.7.1) |
| **229639530** | **Fixed an error harmonizing the container process ID to use Apigee ID for Hybrid on OpenShift.** (Fixed in Apigee hybrid v1.7.1) |
| **228855520** | Upgraded support for ASM version 1.13. (Fixed in Apigee X, May 9, 2022) |
| **227600373** | **Fixed an installation issue with Cassandra.** (Fixed in Apigee hybrid v1.6.7) |
| **227538469** | **Fixed an issue where configuration actions would write logs to the pod file system.** (Fixed in Apigee hybrid v1.7.1) |
| **226964206** | **MART, runtime and synchronizer would write to the pod file system.** (Fixed in Apigee hybrid v1.7.1) |
| **226464960** | **Apigee hybrid fresh installations on OpenShift 4.6 and 4.8 would fail.** (Fixed in Apigee hybrid v1.6.7) |
| **225939342** | **Fixed an error where deployment status would show as "Applying routing changes on {env}".** (Fixed in Apigee hybrid v1.7.1) |
| **225198475** | **Fixed an issue where resource reference changes could not be detected.** (Fixed in Apigee hybrid v1.7.1) |
| **225169066** | **Cassandra database backup and restore was not working when http_proxy is enabled under certain circumstances.** (Fixed in Apigee hybrid v1.5.10) |
| **225081332** | **Fixed allow privileged pods issue.** (Fixed in Apigee hybrid v1.7.1) |
| **224620542** | **On some Kubernetes platforms, logging would fail without adding an empty directory for the logs.** (Fixed in Apigee hybrid v1.6.7) |
| **223081301** | **Fixed organization-level UDCA incorrect http-proxy secret name.** (Fixed in Apigee hybrid v1.6.7) |
| **222649295** | **Organization-level UDCA would hang.** (Fixed in Apigee hybrid v1.6.7) |
| **221885751** | **Hybrid logging functionality has been reworked.** This should resolve issues with excessive log volume generation, frequent logger restarts, and ensure correct logger functionality with both docker and containerd runtimes. (Fixed in Apigee hybrid v1.5.8) |
| **221292104** | Fix to address failure to capture requests in Debug sessions involving PostClientFlow ServiceCallouts. (Fixed in Apigee X, May 9, 2022) |
| **221266789** | **Hybrid logging functionality has been reworked.** This should resolve issues with excessive log volume generation, frequent logger restarts, and ensure correct logger functionality with both docker and containerd runtimes. (Fixed in Apigee hybrid v1.6.7) |
| **219622478** | **Fixed the CPS property token so that when set to `true`, it will allow the instance to shutdown and reboot when cassandra connection failures occur.** (Fixed in Apigee hybrid v1.7.3) |
| **216018530** | **Fixed an issue where the `apigee-logger-apigee-telemetry` DaemonSet could still be left running after turning off logger.** (Fixed in Apigee hybrid v1.7.1) |
| **213261445** | **Fixed reliance on keystore generated by cert manager for metrics endpoint and removed the need for a custom `generate_cert` script.** (Fixed in Apigee hybrid v1.6.7) |
| **211716827** | **Fixed an issue where a non-default gateway could cause routing errors in certain circumstances.** (Fixed in Apigee hybrid v1.7.1) |
| **205616792** | **Fixed core dump on running user schema setup.** (Fixed in Apigee hybrid v1.7.1) |
| **202950533** | **Remove the server header from all responses. This will be consistent with CG SaaS and OPDK.** (Fixed in Apigee hybrid v1.8.0) |
| **202403896** | **Upgrade to Apigee hybrid v1.6 from v1.5 could fail due to annotation size.** (Fixed in Apigee hybrid v1.5.8) |

Deprecated The `apigeectl` `--verbose` option has been deprecated. It is replaced with the `--v` option which lets you specify the log verbosity level in the format `--v=int`, for example `apigeectl apply --v=5`. See [`apigeectl`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/cli-reference.md.txt) for details.
Security

| Bug ID | Description |
|---|---|
| **230369447** | **Security fix for commons-codec (Fixed in Apigee hybrid v1.8)** |
| **230368838** | **Security fix for [CVE-2018-10237](https://nvd.nist.gov/vuln/detail/CVE-2018-10237), auto-value:guava (Fixed in Apigee hybrid v1.8)** |
| **230366823** | **Security fix for jackson-databind (Fixed in Apigee hybrid v1.8)** |
| **230366589** | **Security fix for [CVE-2021-22696-cxf](https://nvd.nist.gov/vuln/detail/CVE-2021-22696) in cxf (Fixed in Apigee hybrid v1.8)** |
| **229804717** | **Security fix for [CVE-2021-3711](https://nvd.nist.gov/vuln/detail/CVE-2021-3711) (Fixed in Apigee hybrid v1.8, v1.7, v1.6)** |
| **229804942** | **Security fix for [CVE-2022-0778](https://nvd.nist.gov/vuln/detail/CVE-2022-0778) (Fixed in Apigee hybrid v1.8)** |
| **N/A** | **Miscellaneous Security updates and fixes.** |

## August 11, 2022

**Apigee X** Announcement On August 11, 2022 we released an updated version of Apigee X.
Feature This release contains the new [Abuse page](https://cloud.google.com/apigee/docs/api-security/security-scores#abuse-page) in Advanced API Security, which displays information about bots that have been detected by analysis of your API traffic. The Abuse page displays the IP addresses of detected bots, as well as their locations, the bot rules that led to their detection, and other details.

## August 10, 2022

**Apigee Integration** Announcement On August 10, 2022 we released an updated version of the Apigee Integration software.
Feature **Support for VPC Service Controls (Preview)**

VPC Service Controls lets you define a security perimeter around the Apigee Integration Google Cloud service. For more information, see [Set up VPC Service Controls for Apigee Integration](https://docs.cloud.google.com/apigee/docs/api-platform/integration/vpcsc-integration).

## July 29, 2022

**Apigee hybrid** v1.7.3 Announcement

### hybrid v1.7.3

On July 29, 2022 we released an updated version of the Apigee hybrid software, v1.7.3.

For information on upgrading, see [Upgrading Apigee hybrid to version 1.7](https://docs.cloud.google.com/apigee/docs/hybrid/v1.7/upgrade.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **219622478** | **Fixed the CPS property token so that when set to `true`, it will allow the instance to shutdown and reboot when cassandra connection failures occur.** |
| **238370197** | **Fixed an issue where the `timeTaken` variable's value could sometimes be calculated incorrectly.** |

Security

| Bug ID | Description |
|---|---|
| **N/A** | **Security fix for CVE-2022-22963.** |

## July 25, 2022

**Apigee X** Fixed

| Bug ID | Description |
|---|---|
| N/A | **Upgraded infrastructure and libraries** |

Announcement On July 25, 2022, we released an updated version of Apigee X (1-8-0-apigee-23).

> [!NOTE]
> **Note:** Rollouts of this release will begin today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

## July 21, 2022

**Apigee X** Announcement On July 21, 2022 we released an updated version of Apigee X.
Feature The Advanced API Security's [target assessment](https://cloud.google.com/apigee/docs/api-security/security-scores#target-assessment), which evaluates the security of target servers in your API, is now available. See [Security scores in the Apigee UI](https://cloud.google.com/apigee/docs/api-security/security-scores) to learn more.

## July 19, 2022

**Apigee UI** Announcement On July 19, 2022 we released an updated version of the Apigee UI.
Change The Needs Attention Table in Advanced API Security Scores now use links instead of buttons. This fixes font and alignment issues inside the table
rows.
Fixed

| Bug ID | Description |
|---|---|
| 238248377 | The Needs Attention Table in Advanced API Security Scores was not showing target components. This has been fixed. |

## July 09, 2022

**Apigee Integration** Announcement On July 09, 2022 we released an updated version of the Apigee Integration software.
Feature **Data Mapping task enhancements**

The **Data Mapping** task in Apigee Integrations now provides the following enhancements:

- **Nested function support**. You can pass one or more transformation functions as input parameters to another function.
- **New transformation functions**. You can use the following new transform functions for array-type variables:

  - [FILTER](https://docs.cloud.google.com/apigee/docs/api-platform/integration/data-mapping-functions-reference#filter-function) - Filters the array elements that satisfy a given condition.
  - [FOR_EACH](https://docs.cloud.google.com/apigee/docs/api-platform/integration/data-mapping-functions-reference#for_each-function) - Applies one or more transformation functions for each element in an array.
- **Subfield mapping support for JSON variables**. You can view and search all the subfields of a JSON variable in the data mapping editor variable list.

For more information, see the [Data Mapping task](https://docs.cloud.google.com/apigee/docs/api-platform/integration/data-mapping-task).

## July 08, 2022

**Apigee hybrid** v1.6.9 Announcement

### hybrid v1.6.9

On July 8, 2022 we released an updated version of the Apigee hybrid software, v1.6.9.

For information on upgrading, see [Upgrading Apigee hybrid to version 1.6](https://docs.cloud.google.com/apigee/docs/hybrid/v1.6/upgrade.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **236129944** | **Fixed the controller crashloopbackoff due to null pointer issue.** |
| **234620567** | **Fix logger issue in Anthos BareMetal with CentOS.** |
| **231313050** | **Fixed issue causing Apigee logger pod to remain in crashloopbackoff state.** |
| **233094108** | **Fixed Stacktrace truncation in runtime containers to support proxy diagnosis.** |

## July 01, 2022

**Apigee UI** Announcement On July 1, 2022, we released an updated version of the Apigee UI.

> [!NOTE]
> **Note:** Rollouts of this release will begin today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Feature This release contains a [new version of the Debug tab](https://docs.cloud.google.com/apigee/docs/api-platform/debug/trace.md.txt) in the Apigee Proxy Editor. Following previous releases of new versions of the Overview and Develop tabs, this completes the initial release of the new Proxy Editor.

To view the new Debug tab, see [Using Debug](https://docs.cloud.google.com/apigee/docs/api-platform/debug/trace.md.txt).

## June 30, 2022

**Apigee X** Announcement On June 30, 2022 we released an updated version of Apigee X.
Feature This release contains the Public Preview of [Advanced API Security](https://docs.cloud.google.com/apigee/docs/api-security.md.txt), which protects your APIs from unwanted requests, including attacks by malicious clients such as bots, and evaluates the security level of your API configurations.

Advanced API Security lets you:

- Create [*security reports*](https://docs.cloud.google.com/apigee/docs/api-security/security-report-jobs.md.txt) to detect bots and other threats to your APIs.
- View [*security scores*](https://docs.cloud.google.com/apigee/docs/api-security/security-scores.md.txt), which rate the security of your APIs and provide recommendations for improving security.

## June 24, 2022

**Apigee hybrid** v1.7.2 Fixed

| Bug ID | Description |
|---|---|
| **233094108** | **Fixed Stacktrace truncation in runtime containers to support proxy diagnosis.** |
| **236129944** | **Fixed the controller crashloopbackoff resulting from null pointer.** |
| **231313050** | **Fixed issue causing Apigee logger pod to remain in crashloopbackoff state.** |
| **236399482** | **Added support for ASM v1.13.** |

Announcement

### hybrid v1.7.2

On June 24, 2022 we released an updated version of the Apigee hybrid software, v1.7.2.

For information on upgrading, see [Upgrading Apigee hybrid to version 1.7](https://docs.cloud.google.com/apigee/docs/hybrid/v1.7/upgrade.md.txt).

## June 23, 2022

**Apigee Integration** Announcement On June 23, 2022 we released an updated version of the Apigee Integrations software.
Feature **Updates to SetIntegrationRequest policy**

The [SetIntegrationRequest policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/set-integration-request-policy.md.txt) has the following updates:

- Support for **ref** attribute in the [\<Parameter\>](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/set-integration-request-policy.md.txt#parameter), [\<ParameterArray\>](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/set-integration-request-policy.md.txt#parameterarray), and [\<Value\>](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/set-integration-request-policy.md.txt#value) elements. By using this attribute, you can assign flow variable values to the parameters.

- Empty **\<Parameter\>** and **\<ParameterArray\>** elements are supported. However, if these elements are empty, Apigee treats the element value as null.

- Empty **\<Value\>** element is not supported. If the element is empty, Apigee reports an error.

Feature **Apigee Integration trials**

Starting with this release, Apigee Integrations is available in an Apigee Eval org which lets you try out the integrations feature without getting billed for the usage. For information, see [Enable integrations in an eval org](https://docs.cloud.google.com/apigee/docs/api-platform/integration/getting-started-apigee-integration#enable-integrations-in-an-eval-org).

## June 21, 2022

**Apigee Integrated Portal** Announcement On June 21, we released an updated version of Apigee integrated portal.
Feature Added the ability to sort by **Name** and **Created** fields in the [**Apps**](https://docs.apigee.com/api-platform/publish/portal/portal-interact#register-apps) and [**Teams**](https://docs.apigee.com/api-platform/publish/portal/portal-interact#teams) tables. Click the column heading to sort.
**Apigee UI** Announcement On June 21, 2022 we released an updated version of the Apigee UI,
Feature A search bar has been added to the new Proxy Editor Develop view. This lets you search for items
within a proxy or sharedflow bundle.
Feature The [Data Collectors UI](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/data-collectors.md.txt) is now generally available.
**Apigee X** Fixed

| Bug ID | Description |
|---|---|
| 234355351 | **Fixed issue with message processor pods restarting frequently.** Added backoff polling task for Cloud KMS key listener. The listener is paused only when the flush policy is met. |
| N/A | **Upgraded infrastructure and libraries.** |

Announcement On June 21, 2022, we released an updated version of Apigee X (1-8-0-apigee-18).

> [!NOTE]
> **Note:** Rollouts of this release will begin today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

## June 14, 2022

**Apigee Integrated Portal** Announcement On June 14, we released an updated version of Apigee integrated portal.
Feature Use a GraphQL schema to publish your APIs to an integrated portal.

For details, see:

- [What is GraphQL schema](https://docs.cloud.google.com/apigee/docs/api-platform/publish/api-design-overview.md.txt#what-graphql)
- [GraphQL Explorer](https://docs.cloud.google.com/apigee/docs/api-platform/publish/portal/publish-apis.md.txt#graphql)

## June 02, 2022

**Apigee X** Announcement On June 2, 2022, we released an updated version of Apigee X.
Feature Apigee X APIs for managing key value entries in a key value map scoped to an organization, environment, or API proxy are now available. For more information, see the [Apigee API reference documentation](https://docs.cloud.google.com/apigee/docs/reference/apis/apigee/rest.md.txt#rest-resource:-v1.organizations.apis.keyvaluemaps.entries).
**Apigee hybrid** v1.7.1 Announcement

### hybrid v1.7.1

On June 2, 2022 we released an updated version of the Apigee hybrid software, v1.7.1.

For information on upgrading, see [Upgrading Apigee hybrid to version 1.7](https://docs.cloud.google.com/apigee/docs/hybrid/v1.7/upgrade.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **233349518** | **Fixed "Invalid Resource" error generated for `job/apigee-resources-install`.** |
| **232977937** | **Fixed an issue where deployment would become stuck on "Applying routing changes on" for multiple ingress gateways.** |
| **216018530** | **Fixed an issue where the `apigee-logger-apigee-telemetry` DaemonSet could still be left running after turning off logger.** |
| **226964206** | **MART, runtime and synchronizer would write to the pod file system.** |
| **211716827** | **Fixed an issue where a non-default gateway could cause routing errors in certain circumstances.** |
| **225198475** | **Fixed an issue where resource reference changes could not be detected.** |
| **225939342** | **Fixed an error where deployment status would show as "Applying routing changes on {env}".** |
| **229824389** | **Fixed an issue in hybrid 1.7.0 where the output `apigeectl init` could be generated in the wrong order.** |
| **229639530** | **Fixed an error harmonizing the container process ID to use Apigee ID for Hybrid on OpenShift** |
| **229804717** | **Fixed upgrade envoy to use distroless v1.22.0.** |
| **227538469** | **Fixed an issue where configuration actions would write logs to the pod file system.** |
| **205616792** | **Fixed core dump on running user schema setup.** |
| **225081332** | **Fixed allow privileged pods issue.** |

## May 31, 2022

**Apigee UI** Announcement On May 31, 2022 we released an updated version of the Apigee UI.
Change API Monitoring Timeline charts were not displayed correctly in the Timeline view.

Previously, you needed to navigate to another API
Monitoring view (such as Investigate) and then return to the Timeline view to
see charts. This has been fixed: now you can go directly to the Timeline view to see charts.
**Apigee hybrid** v1.6.8 Announcement

### hybrid v1.6.8

On May 31, 2022 we released an updated version of the Apigee hybrid software, v1.6.8.

For information on upgrading, see [Upgrading Apigee hybrid to version 1.6](https://docs.cloud.google.com/apigee/docs/hybrid/v1.6/upgrade.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **233349518** | **Fixed "Invalid Resource" error generated for `job/apigee-resources-install`.** |
| **225939342** | **Fixed an error where deployment status would show as "Applying routing changes on {env}".** |
| **225198475** | **Fixed an issue where resource reference changes could not be detected.** |
| **232977937** | **Fixed an issue where deployment would become stuck on "Applying routing changes on" for multiple ingress gateways.** |
| **229804717** | **Fixed upgrade envoy to use distroless v1.22.0.** |

## May 25, 2022

**Apigee UI** Feature You can now create and manage [Private Service Connect](https://docs.cloud.google.com/vpc/docs/private-service-connect.md.txt) (PSC) endpoint attachments in the Apigee UI. For details, see [Creating an endpoint attachment](https://docs.cloud.google.com/apigee/docs/api-platform/architecture/southbound-networking-patterns-endpoints.md.txt#create-an-endpoint-attachment).

## May 23, 2022

**Apigee X** Announcement On May 23, 2022, we released an updated version of Apigee X (1-8-0-apigee-9).

> [!NOTE]
> **Note:** Rollouts of this release will begin today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Fixed

| Bug ID | Description |
|---|---|
| N/A | **Upgraded infrastructure and libraries** |

## May 18, 2022

**Apigee Monetization** Announcement On May 18, 2022 we released an updated version of the Apigee Monetization software.
Feature **Export support for additional monetization-related values**

Apigee X now supports export of additional fee-based values for organizations using monetization. For more information, see [Generating monetization reports](https://docs.cloud.google.com/apigee/docs/api-platform/monetization/generate-reports.md.txt).
**Apigee UI** Change On May 18, 2022, we released an updated version of the Apigee UI.

## May 11, 2022

**Apigee Integrated Portal** Fixed

| **Bug ID** | **Description** |
|---|---|
| 228603948 | Fixed an issue that prevented users from editing custom fields for account creation and signup. |
| 228339667 | Documentation now reflects support for the [STARTTLS SMTP authorization type](https://docs.apigee.com/api-platform/publish/portal/configure-email). |
| 227511014 | Fixed an issue that prevented V1 Portals from being upgraded to V2. |
| 224991572 | Improvements to the **Get Started** documentation bundled with a new portal. Create a new portal and then click **Get Started** to see the new content. |
| 220980189 | Fixed issue with publishing API Products on a Portal when the organization has over 1,000 API Products. |
| 218320618 | Page descriptions are now limited to 1,000 characters. Page content is now limited to 1 MB. |
| 210651558 | Fixed issue where adding a new API Product subscription to an App would remove all scopes on the Apps credentials. |

Announcement On May 11, 2022 we released an updated version of the Apigee Integrated Portal software.
**Apigee hybrid** v1.6.7 Announcement

### hybrid v1.6.7

On May 11, 2022 we released an updated version of the Apigee hybrid v1.6.7 software.

For information on upgrading, see [Upgrading Apigee hybrid to version 1.6](https://docs.cloud.google.com/apigee/docs/hybrid/v1.6/upgrade.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **227600373** | **Fixed an installation issue with Cassandra.** |
| **227538469** | **Configuration actions would write logs to the pod file system.** |
| **226964206** | **MART, runtime and synchronizer would write to the pod file system.** |
| **226464960** | **Apigee hybrid fresh installations on OpenShift 4.6 and 4.8 would fail.** |
| **225081332** | **Allow privileged pods issue.** |
| **224620542** | **On some Kubernetes platforms, logging would fail without adding an empty directory for the logs.** |
| **223081301** | **Fixed organization-level UDCA incorrect http-proxy secret name.** |
| **222649295** | **Organization-level UDCA would hang.** |
| **221266789** | **Hybrid logging functionality has been reworked.** This should resolve issues with excessive log volume generation, frequent logger restarts, and ensure correct logger functionality with both docker and containerd runtimes. |
| **213261445** | **Fixed reliance on keystore generated by cert manager for metrics endpoint and removed the need for a custom `generate_cert` script.** |
| **205616792** | **Fixed core dump on running user schema setup.** |

## May 10, 2022

**Apigee hybrid** v1.7.0 \& v1.5.10 \& v1.6.7 Issue

### hybrid v1.6.7/1.5.10/1.7.0

**Known Issue:** [231758700 - Apigee Hybrid Dockerhub customers unable to pull images with Docker Content Trust enabled](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt#231758700)

## May 09, 2022

**Apigee X** Feature The `GoogleIDToken.Audience` tag now includes the `useTargetUrl` attribute to simplify audience configuration of Google ID tokens for Apigee policies.
Announcement On May 9, 2022 we released an updated version of the Apigee X software (1-8-0-apigee-5).

> [!NOTE]
> **Note:** Rollouts of this release will begin today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Fixed

| Bug ID | Description |
|---|---|
| **221292104** | Fix to address failure to capture requests in Debug sessions involving PostClientFlow ServiceCallouts. |
| **228855520** | Upgraded ASM to the latest version. |

Security

| Bug ID | Description |
|---|---|
| **217497793** | A security issue was addressed. |

## May 04, 2022

**Apigee Integrated Portal** Announcement On May 4, 2022 we released an updated version of the Apigee Integrated Portal software.
Feature Emails from `portal-sso` will either be the email address of the sender that the user sets up in the custom `smtp` settings, or it will be `no-reply@google.com`, instead of the human-readable name `orgname-portalname`. **[This screenshot](https://docs.cloud.google.com/static/apigee/docs/api-platform/images/portals-email-example.png)** illustrates emails sent from `portal-sso` in `e2e`. It shows one email with custom `smtp` settings (`tsnow-custom-smtp`) and one email with the default settings (`no-reply`).
Feature Error messages for rejected logins for an inactive user are now more informative to the user.
Fixed

| **Bug ID** | **Description** |
|---|---|
| 220993729 | Portal SSO showed the Apigee domain when hovering over footer links in third-party web pages. |
| 220188030 | Reset password was not working for LDAP configurations. |
| 214146121 | An authentication issue with Apigee SSO has been fixed. |
| 204952689 | Fixed miscellaneous logback error. |
| 194469693 | Enabled SAML config error so that it is visible. |
| 194053231 | Added server-side validation for the `password` field. If the password is non-compliant, the response is `422:Unprocessable Entity`. |
| 190609332 | Improved error output for failures while enabling SSO for Apigee |
| 157131343 | Added support for the parenthesis `()` and plus `+` characters for built-in IDP custom fields. Other special characters will continue to be blocked due to security reasons. |

Security

| **ID** | **Description** |
|---|---|
| 200604177 | Upgraded jQuery and Bootstrap |

**Apigee UI** Announcement On May 4, 2022 we released an updated version of the Apigee UI.

> [!NOTE]
> **Note:** Rollouts of this release will begin today and may take four or more business days to be completed across all Google Cloud zones. You may not see the new features and changes in the Apigee UI until the rollout is complete.

Feature We have released a new version of the Develop tab in the Proxy Editor. See [Introducing the new Proxy Editor](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/new-proxy-editor-intro).

## April 22, 2022

**Apigee X** Fixed

| Bug ID | Description |
|---|---|
| N/A | **Upgraded infrastructure and libraries** |

Announcement On April 22, 2022 we released an updated version of the Apigee X software (1-7-0-apigee-34).

> [!NOTE]
> **Note:** Rollouts of this release will begin today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

**Apigee hybrid** v1.5.10 Announcement

### hybrid v1.5.10

On April 22, 2022 we released an updated version of the Apigee hybrid v1.5.10 software.

For information on upgrading, see [Upgrading Apigee hybrid to version 1.5](https://docs.cloud.google.com/apigee/docs/hybrid/v1.5/upgrade.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **225169066** | **Cassandra database backup and restore was not working when http_proxy is enabled under certain circumstances.** |
| **221885751** | **Hybrid logging functionality has been reworked.** This should resolve issues with excessive log volume generation, frequent logger restarts, and ensure correct logger functionality with both docker and containerd runtimes. |
| **202403896** | **Upgrade to Apigee hybrid v1.6 from v1.5 could fail due to annotation size.** |
| **221885751** | **Multiple issues with the Hybrid logging functionality have been addressed.** |

## April 18, 2022

**Apigee UI** Announcement On April 18, 2022, we released an updated version of the Apigee UI.
Feature

> [!NOTE]
> **Note:** Rollouts of this release will begin today and may take four or more business days to be completed across all Google Cloud zones. You may not see the new features and changes in the Apigee UI until the rollout is complete.

The UI for managing Apigee instances has been updated and improved:

- You can now specify a list of accepted Cloud projects that can privately connect to the instance's service attachment.
- The New Instance dialog is replaced by a dedicated Create new instance configuration page with fields for specifying or creating a disk encryption key and for editing the list of accepted projects.
- The Edit instance dialog is replaced by a dedicated page that lets you add or remove environments and edit the list of accepted projects that can privately connect to the instance's service attachment.
- The UI now lets you select the disk encryption key from a list and provides a convenient flow if you want to create a new key.
- The UI for deleting an instance has changed. There is now a **DELETE** button on the Instance details page.

For more information, see [Managing instances](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/instances.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **229008583** | **When opening the Apigee UI in multiple tabs with different orgs, some cache entries were not being synched.** This has been fixed. |
| **204429957** | **Make `ClientSpecificResourceService` and `ClientResourceNamePipe` return plain values.** Previously, methods on those classes returned observables. Now they return values. |

**Apigee hybrid** v1.7.0 Announcement

### Apigee hybrid v1.7.0

On April 18, 2022 we released Apigee hybrid v1.7.0.

For information on upgrading, see [Upgrading Apigee hybrid to version 1.7](https://docs.cloud.google.com/apigee/docs/hybrid/v1.7/upgrade.md.txt).
Feature **OAuth JWT access tokens**

Apigee hybrid v1.7.0 now supports JWT operations that allow the OAuthV2 policy to generate, verify, and refresh access tokens that conform to the [JWT token standard](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-access-token-jwt). See [Using JWT OAuth tokens](https://docs.cloud.google.com/apigee/docs/api-platform/security/oauth/using-jwt-oauth.md.txt). (Implemented in Apigee hybrid v1.7.0)
Feature **Cloud Logging**

Apigee hybrid v1.7.0 now supports the `<CloudLogging>` element in the [MessageLogging policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/message-logging-policy.md.txt) that lets you log messages to [Cloud Logging](https://docs.cloud.google.com/logging). (Implemented in Apigee hybrid v1.7.0)
Feature **Custom metrics scaling**

Apigee hybrid v1.7.0 now supports custom metrics scaling using the `metrics:appStackdriverExporter` and `metrics:proxyStackdriverExporter` configuration properties. See [metrics in the Configuration properties reference](https://docs.cloud.google.com/apigee/docs/hybrid/v1.7/config-prop-ref.md.txt#metrics). (Implemented in Apigee hybrid v1.7.0)
Feature **PublishMessage policy**

Apigee hybrid v1.7.0 now supports the PublishMessage policy that lets you publish your API proxy flow information to a Google Cloud [Pub/Sub](https://docs.cloud.google.com/pubsub/docs/overview.md.txt) topic.

- Policy document: [PublishMessage policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/publish-message-policy.md.txt)

  (Implemented in Apigee hybrid v1.7.0)
Feature **mTLS communication between Cassandra clients and Cassandra nodes**

Apigee hybrid now supports mTLS communication between Cassandra clients (MART, Sync, and MP) and Cassandra nodes. For related ports used, see [feedbackSecure ports usage](https://docs.cloud.google.com/apigee/docs/hybrid/v1.7/ports.md.txt). (Implemented in Apigee hybrid v1.7.0)
Feature **[GraphQL policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/graphql-policy.md.txt) now supports JSON-encoded payloads.** (Implemented in Apigee X, March 15, 2022)
Fixed

| Bug ID | Description |
|---|---|
| **224577096** | **Support Added for Anthos Service Mesh 1.12** (Fixed in Apigee hybrid v1.6.6) |
| **219523719** | **Fix to address CPU and memory consumption when `debug-session` is enabled with `response-status` as the filtering criteria.** (Fixed in Apigee X, March 15, 2022) |
| **217386412** | **Change the property set logging level to *fine* when property is not found.** (Fixed in Apigee hybrid v1.6.5) |
| **215773113** | **Setting the securityPolicy appeared to have no effect for specific configurations.** (Fixed in Apigee hybrid v1.6.5) |
| **214960081** | **HTTPS endpoints could be called as HTTP resulting in an "EOF unexpected" error.** (Fixed in Apigee hybrid v1.6.4) |
| **211787541** | **Errors displayed in synchronizer logs for stale contracts.** (Fixed in Apigee hybrid v1.6.5) |
| **210590135** | **Invalid protocol in proxy.url flow variable in Apigee X.** The `proxy.url` flow variable could show as `http` even when the request is `https`. (Fixed in Apigee hybrid v1.6.4) |
| **210314786** | **The backup utility did not work with workload identity.** (Fixed in Apigee hybrid v1.6.4) |
| **209622008** | **Dynamic updates to rate in spike arrest are now reflected immediately.** (Fixed in Apigee X, March 15, 2022) |
| **209484701** | **Invalid client IP sent to analytics.** (Fixed in Apigee hybrid v1.6.5) |
| **209097822** | **Fixed and issue where SpikeArrest was not reflecting updated rate** (Fixed in Apigee hybrid v1.6.3) |
| **208474799** | **Apigee hybrid now supports ASM version 1.12.** See [Supported platforms](https://docs.cloud.google.com/apigee/docs/hybrid/supported-platforms.md.txt) for ASM version support for each supported version of Apigee Hybrid. (Fixed in Apigee hybrid v1.7.0) |
| **208322185** | **Apigee hybrid Cassandra backup and restore can now use either a user-provided custom secret or a generated secret** (Fixed in Apigee hybrid v1.6.3) |
| **207762842** | **Hybrid logging functionality has been reworked.** This should resolve issues with excessive log volume generation, frequent logger restarts, and ensure correct logger functionality with both docker and containerd runtimes.(Fixed in Apigee hybrid v1.7.0) |
| **207618262** | **Fixed an issue where SpikeArrest opened too many connections to redis-envoy.** (Fixed in Apigee hybrid v1.6.3) |
| **207400645** | **Allow direct reads from API server to API client when enabled.** (Fixed in Apigee hybrid v1.6.3) |
| **205820658** | **Fixed an issue where Apigee X/hybrid Debug could show the authorization header.** (Fixed in Apigee hybrid v1.6.3) |
| **205810988** | **Resolve suspension dialog displayed "user not authorized" message for regions other than US** This has been fixed. Location information is now added into the suspension URL from Apigee. (Fixed in Apigee X, December 02,2021) |
| **205732137** | **Handle Quota correctly when the Operation group is set with empty string params** (Fixed in Apigee hybrid v1.6.3) |
| **205148816** | **Product Level Quota Info now available in Proxy.** (Fixed in Apigee hybrid v1.6.3) |
| **204943895** | **Quota Policy in Shared Flow now working properly.** (Fixed in Apigee hybrid v1.6.3) |
| **204943880** | **Fixed issue where SpikeArrest in Shared Flow did not have context of API Proxy.** (Fixed in Apigee hybrid v1.6.3) |
| **204905727** | **`GenerateResponse` was hanging on response flow when `enabled=true`.** (Fixed in Apigee hybrid v1.6.5) |
| **204368970** | **TLS variables are now set by Apigee Runtime.** (Fixed in Apigee hybrid v1.6.3) |
| **204146857** | **Fixed an issue where new environments were not created in Apigee hybrid deployment.** (Fixed in Apigee hybrid v1.6.3) |
| **203785814** | **A transient error could occur when calling conversion webhook for Apigee Telemetry.** The error would occur when Apigee CRD is installed too early in the sequence. The installer job now checks for the correct sequence. (Fixed in Apigee hybrid v1.6.4) |
| **203468593** | **Corrected the `storageclass` property name.** (Fixed in Apigee hybrid v1.5.5) |
| **203462573** | **The StorageClass set in overrides was not honored.** (Fixed in Apigee hybrid v1.6.1) |
| **202560276** | **AKS - containerd broke `apigee-logger`.** (Fixed in Apigee hybrid v1.6.1) |
| **202309278** | **Monetization: Eliminated a race condition that could make a prepaid developer's balance appear incorrect.** (Fixed in Apigee hybrid v1.6.2) |
| **202299966** | **Added new remote-address-related headers and modified the headers to be RFC compliant.** (Fixed in Apigee hybrid v1.6.3) |
| **200918549** | **There was an issue when using forward proxy with the ApigeeConnect agent.** (Fixed in Apigee hybrid v1.6.1) |
| **200700375** | **Fixed API products sorting issue in UI.** Previously, sorting was disabled on the API products page. Sorting is now enabled. (Fixed in Apigee X, September 23, 2021) |
| **200648523** | **Trace Variable, is_request_blocked, was showing incorrect information.** (Fixed in Apigee hybrid v1.6.2) |
| **199952038** | **The *`apigeectl`* command uses the new `--restore` flag to restore Cassandra to a previously saved snapshot. For more information, see [Restoring in a single region](https://docs.cloud.google.com/apigee/docs/hybrid/v1.6/restore-cassandra-single-region.md.txt).** (Fixed in Apigee hybrid v1.6.6) |
| **199807323** | **Updating Developer would reset the Developer billing type attribute** (Fixed in Apigee hybrid v1.6.2) |
| **199541025** | **Transaction ID is now required to be unique when used with prepaid developer balance credit API.** (Fixed in Apigee hybrid v1.6.2) |
| **198549304, 197730687, 196937143, 188370635, 187890034** | **Error state for conflicting dates is now correct.** (Fixed in Apigee hybrid v1.6.2) |
| **198036824** | **The `securityContext` was empty when it should have been populated.** (Fixed in Apigee hybrid v1.6.1) |
| **197945951** | **Stale DNS record in MP memory could cause an outage for a proxy.** (Fixed in Apigee hybrid v1.6.4) |
| **197910247** | **SetDialogflowResponse Policy - JSONPath expressions were not working.** (Fixed in Apigee hybrid v1.6.1) |
| **197711066** | **Cluster upgrade failed due to PDB (PodDisruptionBudget) policy not being met.** (Fixed in Apigee hybrid v1.6.1) |
| **196095557** | **Fixed proxy high response times.** (Fixed in Apigee hybrid v1.5.4) |
| **196024622** | **Hybrid images contained keys.** (Fixed in Apigee hybrid v1.6.1) |
| **196024483** | **Hybrid images did not set USER instruction when building the container.** (Fixed in Apigee hybrid v1.6.1) |
| **193799009** | **Fixed wrong status code shown on trace with ServiceCallout in PostClientflow.** (Fixed in Apigee hybrid v1.5.4) |
| **193520269** | **Fixed Apigee UI not showing the trace UI.** (Fixed in Apigee hybrid v1.5.4) |
| **193041253** | **Cassandra upgraded to v3.11.9** The Cassandra database in Apigee hybrid v1.7.0 has been upgraded to version 3.11.9. (Fixed in Apigee hybrid v1.7.0) |
| **192987085** | **Fixed the ApiProductNotFound exception, which occurred when you deleted an API product but the deletion of associated rate plans was pending.** (Fixed in Apigee X Monetization, November 3, 2021) |
| **191853747** | **Apigee Workload Identities not working for specific configurations.** (Fixed in Apigee hybrid v1.6.5) |
| **190679584** | **There was an Incorrect error message on deploying AssertCondition policy with invalid condition.** (Fixed in Apigee hybrid v1.6.1) |
| **189341334** | **Fixed an issue to eliminate the potential for connection leaks for the watcher component.** (Fixed in Apigee hybrid v1.6.3) |
| **188407113** | **Invalid value in the ConsumptionPricingType during rate plan creation displayed the 500 status code. Now the status code for an invalid value is 4xx.** (Fixed in Apigee X Monetization, November 3, 2021) |
| **181259284** | **Fixed unresolved flow variables `system.region.name` and `system.pod.name`.** (Fixed in Apigee hybrid v1.5.4) |
| **180672249** | **FlowCallout succeeded, although SharedFlow had errors in deployment.** (Fixed in Apigee hybrid v1.6.1) |
| **173738907** | **Fixed support resource request/limit in `override.yaml` in `apigee-metrics`.** (Fixed in Apigee hybrid v1.5.4) |
| **173566787** | **Reuse existing target IPs if DNS resolution fail on DNS cache refresh.** (Fixed in Apigee hybrid v1.6.5) |
| **111777025** | **LookupCache: `cachehit` was shown false in trace when the actual value was true.** (Fixed in Apigee hybrid v1.6.5)**N/A** |
| **N/A** | **If there is more than one SpikeArrest policy in a bundle, 502 errors will occur.** (Fixed in Apigee X, December 12, 2021) |
| **N/A** | **If ServiceCallout is "fire and forget" (no tag), a race condition can occur if there is another policy that occurs after it.** (Fixed in Apigee X, December 12, 2021) |
| **N/A** | **Fix bug delete dialog does not open** Previously, on click of delete dialog, the dialog was not appearing, this fixes it (Fixed in Apigee X, October 05, 2021) |
| **N/A** | **Dynamic updates to rate in SpikeArrest may not reflect immediately.** (Fixed in Apigee X, December 12, 2021) |

Security

| Bug ID | Description |
|---|---|
| **217743790** | \*\* Cassandra backup would run as privileged.\*\* |
| **204994504** | **Container Vulnerability fixed: [CVE-2018-12934](https://nvd.nist.gov/vuln/detail/CVE-2018-12934).** (Fixed in Apigee hybrid v1.6.5) |
| **N/A** | **Multiple security fixes including [CVE-2019-5021](https://nvd.nist.gov/vuln/detail/CVE-2019-5021).** (Fixed in Apigee hybrid v1.6.5) |
| **N/A** | **Miscellaneous Security updates and fixes.** (Fixed in Apigee X, December 12, 2021) |
| **205820658** | **A security issue was addressed.** (Fixed in Apigee hybrid v1.6.2-hotfix.1) |

Deprecated **"Apigee Deployer" role deprecated and replaced by "Apigee Environment Admin"**
The environment role "Apigee Deployer" has been deprecated, and replaced by "Apigee Environment Admin". (Implemented in Apigee X, December 2, 2022)

## April 05, 2022

**Apigee Integrated Portal** Announcement On April 5, 2022 we released an updated version of the Apigee Integrated Portal software.
Fixed

| Bug ID | Description |
|---|---|
| **220377670** | **Fixed an issue that prevented users from uploading svg and ico files.** |
| **217600695** | **Menus will scroll when they don't fit on the page.** |
| **174476355** | **When adding a custom registration field in the `accounts-authentication` UI for creating/editing a portal, the allowed characters for a custom field has been limited to letters, numbers, and spaces.** |

## March 31, 2022

**Apigee X** Announcement On March 31, 2022, we released an updated version of Apigee X.
Feature You can now use [Private Service Connect](https://docs.cloud.google.com/vpc/docs/private-service-connect.md.txt) (PSC) to connect to Apigee. This architectural pattern eliminates the need to create managed instance groups to forward requests from the global load balancer to Apigee. For details, see [Using Private Service Connect](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/psc-overview).

## March 29, 2022

**Apigee X** Announcement On March 29, 2022, we released an updated version of Apigee X (1-7-0-apigee-28).

> [!NOTE]
> **Note:** Rollouts of this release will begin today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete.

Fixed

| Bug ID | Description |
|---|---|
| N/A | **Upgraded infrastructure and libraries** |

## March 28, 2022

**Apigee X** Announcement On March 28, 2022 we released an updated version of Apigee X.
Feature You can now use [Private Service Connect](https://docs.cloud.google.com/vpc/docs/private-service-connect.md.txt) (PSC) to connect Apigee with backend target services running in VPC networks other than the one that is peered with your Apigee organization. For details, see [Southbound networking patterns](https://docs.cloud.google.com/apigee/docs/api-platform/architecture/southbound-networking-patterns-endpoints.md.txt).

## March 24, 2022

**Apigee Analytics** Announcement On March 24, 2022, we released a new version of the Apigee Analytics software.

We welcome your feedback about the [anomaly events](https://docs.cloud.google.com/apigee/docs/aapi-ops/anomaly-detect-ui) feature in Advanced API Operations. If you have received an anomaly alert, you can send feedback about the alert in the [API Monitoring Investigate dashboard](https://docs.cloud.google.com/apigee/docs/aapi-ops/investigate-anomalies) by clicking the **Anomaly Feedback** button at the top of the **Anomaly Event Details** pane.
**Apigee hybrid** v1.5.9 Announcement

### hybrid v1.5.9

On March 24, 2022 we released an updated version of the Apigee hybrid v1.5.9 software.

For information on upgrading, see [Upgrading Apigee hybrid to version 1.5](https://docs.cloud.google.com/apigee/docs/hybrid/v1.5/upgrade.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **224577096** | **Support Added for Anthos Service Mesh 1.12** |
| **204368970** | **Fixed the bug in TLS variables population** |

v1.6.6 Announcement

### hybrid v1.6.6

On March 24, 2022 we released an updated version of the Apigee hybrid v1.6.6 software.

For information on upgrading, see [Upgrading Apigee hybrid to version 1.6](https://docs.cloud.google.com/apigee/docs/hybrid/v1.6/upgrade.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **224577096** | **Support Added for Anthos Service Mesh 1.12** |
| **204368970** | **Fixed a bug in TLS variables population** |
| **199952038** | **The *`apigeectl`* command uses the new `--restore` flag to restore Cassandra to a previously saved snapshot. For more information, see [Restoring in a single region](https://docs.cloud.google.com/apigee/docs/hybrid/v1.6/restore-cassandra-single-region.md.txt).** |

## March 22, 2022

**Apigee X** Announcement On March 22, 2022, we released an updated version of the Apigee X software.
Feature **Support for conditions in IAM policies**

You can add resource conditions in your IAM policies. A resource condition lets you have granular control over your Apigee resources. For more information, see [Adding resource conditions in IAM policies](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/add-iam-conditions.md.txt).

## March 15, 2022

**Apigee X** Announcement On March15, we released **version 1.7x** of Apigee X (1-7-0-apigee-22).

> [!NOTE]
> **Note:** Rollouts of this release will begin today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the following features and fixes available until the rollout is complete.

Feature **[GraphQL policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/graphql-policy.md.txt) now supports JSON-encoded payloads.**
Issue **Note:** When using the [GraphQL](https://docs.cloud.google.com/apigee/docs/api-platform/develop/graphql.md.txt) policy, you can only provide one graphQL schema for verification in an environment.
Feature **[KVM pagination](https://docs.cloud.google.com/apigee/docs/reference/apis/apigee/rest/v1/organizations.keyvaluemaps.md.txt) support now available (via the API only).**
Fixed

| Bug ID | Description |
|---|---|
| **209622008** | Dynamic updates to rate in spike arrest are now reflected immediately. |
| **219523719** | Fix to address CPU and memory consumption when `debug-session` is enabled with `response-status` as the filtering criteria. |

## March 03, 2022

**Apigee Adapter for Envoy** v2.0.5 Announcement

### Envoy adapter v2.0.5

On March 3, 2022 we released a new version of Apigee Adapter for Envoy v2.0.5.
Security Security release to address a Denial of Service (DoS) risk in the prometheus library. See [CVE-2022-21698](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21698).
**Apigee X** Feature **Southbound mTLS** can be enabled for use with [configurable API proxies](https://docs.cloud.google.com/apigee/docs/api-platform/develop/configurable-api-proxies).

By adding south bound mTLS functionality to configurable proxies, Apigee customers can seamlessly maintain their current usage of mTLS when transitioning to the use of configurable proxies, or increase security for communications between existing configurable proxies and their backends.

For more information, see [Enable south bound mTLS for configurable proxies](https://docs.cloud.google.com/apigee/docs/api-platform/develop/mtls-configurable-proxies).
Announcement On March 3, 2022, we released new features for the Public Preview of configurable API proxies.
To learn more, see [Introduction to configurable API proxies](https://docs.cloud.google.com/apigee/docs/api-platform/develop/configurable-api-proxies).
Feature [Configurable API proxies](https://docs.cloud.google.com/apigee/docs/api-platform/develop/configurable-api-proxies) now support the use of **template variables.**

Apigee property sets can be used to specify template variables for configurable API proxies in [archive deployments](https://docs.cloud.google.com/apigee/docs/api-platform/deploy/manage-archive-deployments.md.txt). This feature enables customers to use string templates in their proxy configuration YAML files.

For more information, see [Template variables for configurable proxies](https://docs.cloud.google.com/apigee/docs/api-platform/develop/template-variables-configurable-proxies).
Feature **Google authentication** for securing targets is now supported when using [configurable API proxies](https://docs.cloud.google.com/apigee/docs/api-platform/develop/configurable-api-proxies).

With this feature, configurable API proxy developers can secure their Google backend services using Google OAuth and automatically grant access to authorized API consumers. This offers the advantage of seamless integration with other Google services, without requiring API producers to manage private keys.

For more information, see [Securing targets for configurable proxies](https://docs.cloud.google.com/apigee/docs/api-platform/security/google-auth/configurable-proxy-service-account).
Feature **HTTP request transforms** are now available for use with [configurable API proxies](https://docs.cloud.google.com/apigee/docs/api-platform/develop/configurable-api-proxies).

With HTTP request transforms, configurable API proxy developers can quickly rewrite HTTP request paths, header, and query parameters using HTTP Request Transforms. Rewriting is enabled using a simple configuration that can reference incoming path template segments, header values, or query parameter values.

For more information, see [HTTP request transforms for configurable proxies](https://docs.cloud.google.com/apigee/docs/api-platform/develop/transform-headers-configurable-proxies).

## March 01, 2022

**Apigee hybrid** v1.5.8 Announcement

### hybrid v1.5.8

On March 1, 2022 we released an updated version of the Apigee hybrid v1.5.8 software.

For information on upgrading, see [Upgrading Apigee hybrid to version 1.5](https://docs.cloud.google.com/apigee/docs/hybrid/v1.5/upgrade.md.txt).
Security

| Bug ID | Description |
|---|---|
| **N/A** | **Multiple security fixes including [CVE-2019-5021](https://nvd.nist.gov/vuln/detail/CVE-2019-5021).** |

Fixed

| Bug ID | Description |
|---|---|
| **219523719** | **Fix to address the CPU and memory consumption when debug-session is enabled with response-status as the filtering criteria.** |
| **217386412** | **Change the property set logging level to *fine* when property is not found.** |
| **215773113** | **Setting the securityPolicy appeared to have no effect for specific configurations.** |
| **209484701** | **Invalid client IP sent to analytics.** |
| **189233354** | **Distributed tracing with Jaeger would error out.** |

## February 28, 2022

**Apigee hybrid** v1.6.5 Announcement

### hybrid v1.6.5

On February 28, 2022 we released an updated version of the Apigee hybrid v1.6.5 software.

For information on upgrading, see [Upgrading Apigee hybrid to version 1.6](https://docs.cloud.google.com/apigee/docs/hybrid/v1.6/upgrade.md.txt).
Security

| Bug ID | Description |
|---|---|
| **217743790** | \*\* Cassandra backup would run as privileged.\*\* |
| **204994504** | **Container Vulnerability fixed: [CVE-2018-12934](https://nvd.nist.gov/vuln/detail/CVE-2018-12934).** |
| **N/A** | **Multiple security fixes including [CVE-2019-5021](https://nvd.nist.gov/vuln/detail/CVE-2019-5021).** |

Fixed

| Bug ID | Description |
|---|---|
| **217386412** | **Change the property set logging level to *fine* when property is not found.** |
| **215773113** | **Setting the securityPolicy appeared to have no effect for specific configurations.** |
| **211787541** | **Errors displayed in synchronizer logs for stale contracts.** |
| **209484701** | **Invalid client IP sent to analytics.** |
| **204905727** | **`GenerateResponse` was hanging on response flow when `enabled=true`.** |
| **191853747** | **Apigee Workload Identities not working for specific configurations.** |
| **173566787** | **Reuse existing target IPs if DNS resolution fail on DNS cache refresh.** |
| **111777025** | **LookupCache: `cachehit` was shown false in trace when the actual value was true.** |

## February 24, 2022

**Apigee Integrated Portal** Announcement On February 24, 2022 we released an updated version of the Apigee Integrated Portal software.
Fixed

| Bug ID | Description |
|---|---|
| **216299743** | **Inconsistent button icon for delete in Pages** . Updated the page delete button from (circle with x) to (trash can). |
| **210539825** | **CSS compiler should gracefully handle errors with unexpected form** . Fixed a rare issue where some custom CSS payloads would result in an `Internal Server Error`. |
| **205579028** | **`500s` caused by `could not get auth token for GCP`** . Periodically, under high load, GCP Authentication would fail on the backend and return a `500 internal exception`. |
| **194226935** | **Update site pages to link to Quickstart documentation** . The Quick Start tutorial is no longer embedded in the portal. See [Build your first portal](https://docs.cloud.google.com/apigee/docs/api-platform/publish/portal/get-started/overview.md.txt) in the Apigee documentation. |

## February 22, 2022

**Apigee UI** Announcement On February 22, 2022 we released an updated version of the Apigee UI software.
Feature The following accessibility improvements have been made in the Apigee UI:

- In the **Develop \> API Proxies** view, the screen reader now reads "Create new proxy" for the **Create New** button
- In the **Traffic** column of the **API Proxies** view, the screen reader now reads the traffic tooltip text, and the tooltip has been removed.
- In the **Last Modified** column, the screen reader now reads a message like "5 months ago on Sep 17, 2021 6:21 PM," and the tooltip has been removed.
- Hovering the mouse in the **Action** column now displays a menu showing the **Delete** item, to make it accessible.
Fixed

| Bug ID | Description |
|---|---|
| **170748813** | **The help text in the project selector menu at the top of the UI was out of date.** The information has now been updated. |
| **220188457** | **Proxy/sharedflow undeployment was failing in the [new Proxy Editor](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/new-proxy-editor-intro).** This has been fixed. |

## February 21, 2022

**Apigee Integration** Announcement On February 21, 2022 we released an updated version of the Apigee Integration software.
Fixed

| Bug ID | Description |
|---|---|
| **N/A** | **Cloud Pub/Sub trigger having same topic in multiple region fails**. You can now create a Cloud Pub/Sub trigger for the same topic in multiple regions. Because of this fix, your already existing Cloud Pub/Sub trigger may now execute multiple times. Contact Apigee support if you notice this problem. However, if you haven't used the Cloud Pub/Sub trigger in your integrations, you can ignore this fix. |

## February 15, 2022

**Apigee UI** Announcement On February 15, 2022 we released an updated version of the Apigee UI software.
Feature **The UI now shows a warning when an API Product is in legacy format, stating that some of the displayed fields might be legacy fields.**
Fixed

| Bug ID | Description |
|---|---|
| **201759530** | **Operations that did not have methods defined were not appearing in the operations table in the API Products UI** |
| **199814779** | **The test button in Admin \> Environments \> Keystores was not working correctly.** The button has been temporarily removed from the UI. |

Feature **New Overview Tab in Proxy Editor**

We have released a new version of the Overview tab in the Proxy Editor. See [Introducing the new Proxy Editor](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/new-proxy-editor-intro).

**Note:** The new features in this release will be rolled out over the next week, so you might not be able to view them until the rollout is complete.
**Apigee X** Announcement On February 15, 2022 we released an updated version of the Apigee X software.
Feature **Backend target routing with Private Service Connect**

You can now use [Private Service Connect](https://docs.cloud.google.com/vpc/docs/private-service-connect.md.txt) (PSC) to connect Apigee with backend target services running in VPC networks other than the one that is peered with your Apigee organization. For details, see [Southbound networking patterns](https://docs.cloud.google.com/apigee/docs/api-platform/architecture/southbound-networking-patterns-endpoints.md.txt).

## February 08, 2022

**Apigee Integrated Portal** Announcement On February 8, 2022 we released an updated version of the Apigee Integrated Portal software.
Fixed

| Bug ID | Description |
|---|---|
| **212421254** | **Consumers can access teams in a portal for which they have no IDP account.** Before, a consumer could access a team as long as they were added to the team and had an IDP account in the same organization as the team. Now they can only access the team if they are added as a member and have an IDP account in the same portal as the team. |
| **209436418** | **Display asset file sizes in megabytes.** Asset file size was being incorrectly displayed in mebibytes and is now shown in megabytes. |
| **207130598** | **Improve asset upload error messages.** Improved an error message when an unsupported image type was uploaded. |
| **205963075** | **New portal name rules are not enforced on backend.** The same portal name rules that were already enforced on the front end are now also enforced on the backend. |
| **205881764** | **Cannot delete mobile logo/favicon in Apigee X/Hybrid.** Fixed a bug where Apigee X and Hybrid customers could not delete mobile logos or favicons. |
| **205629978** | **Broken HTML after portals v2 migration.** The live portal of the upgraded portal will not be displayed correctly after migrating a portal from v1 to v2. |
| **205581372** | **Users endpoint should not crash when passed an invalid Enum value.** Passing an invalid sortBy value to the `providers/{scope}/users` endpoint is now handled gracefully. |
| **196875216** | **Team does not exist exceptions should not be reported as `500s`.** When API producers attempted to retrieve a team which does not exist, they got an uniformative `500`. Now they get an easy-to-read `404`. |

**Apigee UI** Announcement On February 8, 2022 we released an updated version of the Apigee UI software.
Fixed

| Bug ID | Description |
|---|---|
| **212782769** | **An issue prevented editing a new target server that used a keystore reference, and selecting a key alias when using a keystore.** |

**Apigee X** Announcement On February 8, 2022 we released an updated version of the Apigee X software.
Fixed

| Bug ID | Description |
|---|---|
| N/A | **Upgraded infrastructure and libraries** |

## February 02, 2022

**Apigee UI** Announcement On February 2, 2022 we released an updated version of the Apigee UI software.
Fixed

| Bug ID | Description |
|---|---|
| **205810610** | **Products couldn't be removed from an app if the product's name contained a trailing space** |

Feature **The Apigee provisioning wizard can now auto-allocate /22 and /28 IP address ranges, instead of the larger /21 range**

This feature makes it easier to [allocate IP address ranges](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/configure-service-networking.md.txt) when you are provisioning Apigee. The feature is an enhancement to the [IP range feature](https://docs.cloud.google.com/apigee/docs/release/notes/apigee-release-notes.md.txt#january-24,-2022---apigee-x) released on Jan. 24, 2022.

## January 31, 2022

**Apigee hybrid** v1.6.4 Announcement

### hybrid v1.6.4

On January 31, 2022 we released an updated version of the Apigee hybrid v1.6.4 software

For information on upgrading, see [Upgrading Apigee hybrid to version 1.6](https://docs.cloud.google.com/apigee/docs/hybrid/v1.6/upgrade.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **214960081** | **HTTPS endpoints could be called as HTTP resulting in an "EOF unexpected" error.** |
| **210590135** | **Invalid protocol in proxy.url flow variable in Apigee X.** The `proxy.url` flow variable could show as `http` even when the request is `https`. |
| **203785814** | **A transient error could occur when calling conversion webhook for Apigee Telemetry.** The error would occur when Apigee CRD is installed too early in the sequence. The installer job now checks for the correct sequence. |
| **197945951** | **Stale DNS record in MP memory could cause an outage for a proxy.** |
| **210314786** | **The backup utility did not work with workload identity.** |

## January 28, 2022

**Apigee X** Announcement On January 28, 2022 we released an updated version of the Apigee X software.
Feature **UI updates for service networking and instance creation**

UI updates were made to support changes to network IP CIDR range requirements for service networking and instance creation. These changes simplify Apigee provisioning.
**Apigee hybrid** v1.5.7 Announcement

### hybrid v1.5.7

On January 28, 2022 we released an updated version of the Apigee hybrid v1.5.7 software

For information on upgrading, see [Upgrading Apigee hybrid to version 1.5](https://docs.cloud.google.com/apigee/docs/hybrid/v1.5/upgrade.md.txt).
Fixed

| Bug ID | Description |
|---|---|
| **214960081** | **HTTPS endpoints could be called as HTTP resulting in an `EOF unexpected` error.** |
| **204368970** | **TLS variables were not being set by Apigee Runtime.** |
| **189341334** | **Fixed potential connection leaks for watcher component.** |

## January 24, 2022

**Apigee X** Announcement On January 24, 2022 we released an updated version of the Apigee X software.
Feature **Reduce the IP range required to peer your VPC network**

The required IP range needed to peer your VPC network to the Apigee network is now limited to a non-overlapping CIDR range of /22. This change simplifies Apigee provisioning. Note that the provisioning step for [service network configuration](https://docs.cloud.google.com/apigee/docs/api-platform/get-started/install-cli.md.txt#service-networking) has been updated to reflect this change. For more information, see [Understanding peering ranges](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/peering-ranges.md.txt).

## January 19, 2022

**Apigee Integration** Announcement On January 19, 2022 we released an updated version of the Apigee Integration software.
Feature **Filter clause in the Connectors task**

You can add a filter to restrict the amount of data processed by an entity operation. For more information, see [Add a filter for an operation](https://docs.cloud.google.com/apigee/docs/api-platform/integration/connectors-task#filter).
Feature **Upload and download integrations**

The Upload/download menu button in the integration designer lets you upload and download integrations in a JSON file format. For more information, see [Upload and download integrations](https://docs.cloud.google.com/apigee/docs/api-platform/integration/upload-download).

## January 17, 2022

**Apigee UI** Announcement On January 17, 2022 we released an updated version of the Apigee UI software.
Fixed

| Bug ID | Description |
|---|---|
| **211983110** | **Product link in app detail page was broken.** |

## December 03, 2021

**Apigee Adapter for Envoy** v2.0.4 Announcement

### v2.0.4

On December 3, 2021 we released an updated version of the Apigee Adapter for Envoy v2.0.4 software.

> [!NOTE]
> **Note:** If you are upgrading an existing Apigee Adapter for Envoy, you must add the `--force-proxy-install` flag to the provision command. This flag forces the Apigee proxy to be replaced with the latest proxy. See [Apigee hybrid example](https://docs.cloud.google.com/apigee/docs/api-platform/envoy-adapter/latest/example-hybrid).

<br />

▶ Click to see the list of supported platforms.

<br />

We publish binaries for MacOS, Linux, and Windows, and in this version, we support the following platforms:

- Apigee hybrid version 1.4.x, 1.5.x, 1.6.x
- Apigee X
- Apigee Edge for Public Cloud
- Apigee Edge for Private Cloud
- Istio versions 1.10, 1.11, 1.12
- Envoy versions 1.17, 1.18, 1.19, 1.20

  <br />

<br />

Feature **The list of supported Envoy and Istio versions for the CLI samples command has been updated.** These versions are now supported for samples:

- Envoy versions 1.18 to 1.20
- Istio versions 1.10 to 1.12
Fixed

| Bug ID | Description |
|---|---|
| **360** | A nil-check was added for the PEM block private key loading to avoid panic. |
| **104** | Remote service authorization errors are now logged at the Debug level. An exception to this categorization is made for token fetching errors for API keys. In that case, errors are logged at the Error level so that they are visible even if Debug log level for apigee-remote-service-envoy is disabled. See also [Setting remote service log levels](https://docs.cloud.google.com/apigee/docs/api-platform/envoy-adapter/v2.0.x/troubleshooting.md.txt#settingremoteserviceloglevels). |

## November 03, 2021

**Apigee Monetization** Announcement On November 3, 2021 we released an updated version of the Apigee Monetization software.
Feature **Volume banded consumption pricing**

[Rate plan](https://docs.cloud.google.com/apigee/docs-preview/api-platform/monetization/manage-rate-plans#create) supports the new **Banded** type of consumption based fees. You can configure variable fees for each monetized transaction based on a band. A band refers to an API consumption range, and you can configure a different fee for each band.
Feature **Revenue sharing with developers**

The revenue sharing feature enables developers to receive a percentage of the total revenue generated. As an API provider, you can configure **Revenue share** in your [rate plan](https://docs.cloud.google.com/apigee/docs-preview/api-platform/monetization/manage-rate-plans#create) to share a specific percentage of the revenue with your developer partners.
Deprecated **The `rateplans` API doesn't support the `paymentFundingModel` field.**
Feature **Criteria for successful transaction**

You can specify if a transaction must be monetized or not by configuring the [transactionSuccess](https://docs.cloud.google.com/apigee/docs-preview/api-platform/reference/policies/data-capture-policy#mint-var) monetization variable in your DataCapture policy.
Feature **DataCapture policy captures monetization variables**

You can configure the DataCapture policy to capture a transaction's monetization information such as revenue, currency, price multiplier, and status. For more information, see [Monetization variables](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/data-capture-policy.md.txt#datacollector).
Feature **Prepaid billing**

Apigee now supports the prepaid billing of developers, as well as postpaid billing. In prepaid billing, app developers pay in advance even before using your API products. The upfront payment made by the developers is available in the developer's wallet, which can have different currencies. You can track a developer's balance in real time and block API calls if a developer has insufficient funds.
Feature **Dynamic consumption pricing**

To calculate the cost of a transaction, you can specify a multiplier ([perUnitPriceMultiplier](https://docs.cloud.google.com/apigee/docs-preview/api-platform/reference/policies/data-capture-policy#mint-var)) value on top of the pre-configured base price in your DataCapture policy.
Fixed

| Bug ID | Description |
|---|---|
| **199807323** | **A prepaid developer is set as a postpaid developer after updates to the prepaid developer.** |
| **198549304, 197730687, 196937143, 188370635, 187890034** | **Apigee displays improved error messages during rate plan creation.** |
| **192987085** | **Fixed the ApiProductNotFound exception, which occurred when you deleted an API product but the deletion of associated rate plans was pending.** |
| **188407113** | **Invalid value in the `ConsumptionPricingType` during rate plan creation displayed the `500` status code. Now the status code for an invalid value is `4xx`.** |

## September 21, 2021

**Apigee Adapter for Envoy** v2.0.3 Fixed

| Bug ID | Description |
|---|---|
| **N/A** | **An analytics logging issue with direct responses was fixed.** The issue only occurred under certain circumstances. For example: a) For requests not requiring authn/z check, no authContext was generated and dynamic metadata was nil causing the access log entry to be ignored. b) The denied response used RPC code instead of HTTP code, causing records to be shown in the Apigee UI as success. |

Announcement

### v2.0.3

On September 21, 2021 we released an updated version of the Apigee Adapter for Envoy v2.0.3 software.

> [!NOTE]
> **Note:** If you are upgrading an existing Apigee Adapter for Envoy, you must add the `--force-proxy-install` flag to the provision command. This flag forces the Apigee proxy to be replaced with the latest proxy. See [Apigee hybrid example](https://docs.cloud.google.com/apigee/docs/api-platform/envoy-adapter/latest/example-hybrid).

<br />

▶ Click to see the list of supported platforms.

<br />

We publish binaries for MacOS, Linux, and Windows, and in this version, we support the following platforms:

- Apigee hybrid version 1.4.x, 1.5.x, 1.6.x
- Apigee X
- Apigee Edge for Public Cloud
- Apigee Edge for Private Cloud
- Istio versions 1.10, 1.11, 1.12
- Envoy versions 1.17, 1.18, 1.19

  <br />

<br />

## March 24, 2021

**Apigee Analytics** Announcement On March 24, 2021 we released an updated version of the Apigee Analytics software.
Feature **Advanced API Operations**

This is the GA release of Apigee's [Advanced API Operations](https://docs.cloud.google.com/apigee/docs/aapi-ops) (AAPI Ops), which provides tools to help you ensure that your APIs stay up and running as intended. AAPI Ops automatically detects unusual patterns in API traffic---called anomalies---such as spikes in latency or error rate.

AAPI Ops enables you to:

- [Detect anomalies and view them in the Anomaly Events dashboard](https://docs.cloud.google.com/apigee/docs/aapi-ops/anomaly-detect-ui)
- [Investigate anomalies](https://docs.cloud.google.com/apigee/docs/aapi-ops/anomaly-detect-ui#viewing-anomalies-in-the-api-monitoring-dashboard)
- [Create anomaly alerts](https://docs.cloud.google.com/apigee/docs/aapi-ops/create-alerts)

## February 05, 2021

**Apigee Analytics** Announcement On February 5, 2021 we released an updated version of the Apigee Analytics software.
Feature **Recent view**

The new API Monitoring Recent view displays treemaps of API traffic by proxy. A treemap displays traffic data for each proxy as a rectangle, whose size is proportional to the amount of traffic in the proxy. The colors of the rectangle indicate the relative sizes of the following variables:

- Number of incidents triggered by [alerts](https://docs.cloud.google.com/apigee/docs/api-monitoring/alerts-notifications.md.txt).
- Error rate
- Maximum latency 50th percentile (median)

See [Using the Recent view](https://docs.cloud.google.com/apigee/docs/api-monitoring/recent.md.txt).
Feature **Additional channels for sending alert notifications**

Apigee API Monitoring now supports the following channels for sending alert notifications:

- Email
- PagerDuty
- Slack
- Webhooks

See [Creating a notification for an alert](https://docs.cloud.google.com/apigee/docs/api-monitoring/alerts-notifications.md.txt#creating_a_notfication_for_an_alert).