What's Changed

• [TT-13727] Add RFC3339 compliant option for consistent GW application logs by @shults in #8157
• [TT-17137] Support remote MCPs as upstream — routing fix + auto-mirror PRM + OAuth proxy by @andrei-tyk in #8181
• [TT-16865]: Gateway reads node id and nonce on 409 by @kofoworola in #8137
• [TT-17190] Upgrade apache/thrift to 0.23.0 by @MFCaballero in #8194
• TT-17162: update github-actions workflow by @probelabs[bot] in #8213
• [TT-17172] OAuth2 security scheme: foundation container by @lghiur in #8198
• [TT-4023] Track 404 logs not showing in listening port when changing control api port by @MaciekMis in #7976
• TT-17147: fix: remove unconditional break in memorycache cleanup timer by @probelabs[bot] in #8180
• [TT-12339] [BE] Implement sub-second timeout for the Enforced Timeout middleware by @MaciekMis in #8151
• [TT-17154] Docs update by @MFCaballero in #8214
• [TT-17154] Bump opentelemetry to post-v0.0.25 doc-comment fixes by @mativm02 in #8240
• [TT-17173] OAuth2 scope check (API-level / global) by @lghiur in #8199
• [TT-16823] Filter MCP discovery with OAS middleware rules by @andrei-tyk in #8246
• [TT-17173] apidef classic schema: declare security_requirement_scopes by @lghiur in #8253
• [TT-17049] Replace unbounded regex caches with a bounded LRU cache to prevent memory leaks by @MFCaballero in #8239
• [TT-17174] OAuth2 scope check (per-operation / per-MCP-primitive) by @lghiur in #8203
• [TT-17339 master] Implement Floating tags in github actions by @konrad-sol in #8270
• [TT-17312] Gateway: client-IdP registry for JWT key & scope resolution by @mativm02 in #8268
• [TT-17065] Fix MinTokenLength: reject silent-accept on create + correct off-by-one operator by @sedkis in #8154
• [TT-17175] OAuth2 Protected Resource Metadata — new structure inside oauth2 (gateway) by @lghiur in #8209
• TT-17333 gromit sync templates by @probelabs[bot] in #8293
• [TT-16017] Fix issue with strip auth data GQL APIs by @LLe27 in #7831
• [TT-17176] Mirror upstream PRM from the new oauth2.protectedResourceMetadata block by @lghiur in #8297
• [TT-17356] Join the MCP agent's trace from params._meta and propagate upstream by @lghiur in #8276
• [TT-7519] add "original_path" and "listen_path" to observability by @sedkis in #7791
• [TT-17312] Resolve JWT scope claim name from client-IdP registry by @mativm02 in #8296
• [TT-12339] Rename OAS enforceTimeout field timeout to duration by @jay-deshmukh in #8278
• [TT-16259] [Security] Unable to delete Session that uses a quota and is under heavy load [Plan A] by @shults in #8254
• [TT-16068] Enhance Graceful Shutdown Sequence to introduce a waiting period for Gateway Deregistration by @MaciekMis in #8241
• [TT-15935] Feature Request - Standardize Log Message Key Across All Tyk Components by @shults in #8236
• [TT-17442] Upstream WebSocket connection reuse ignores per-request auth headers by @MaciekMis in #8303
• [TT-17295] feat: support embedded PEM certificate content in Gateway by @mativm02 in #8256
• TT-17297: support file based kv references by @vladzabolotnyi in #8267
• Revert TT-16259 by @shults in #8307
• TT-15813: add api-level timeout configuration by @vladzabolotnyi in #8282
• TT-17495 Fix span Original Path by @tbuchaillot in #8311
• [TT-12339] Missing schema updates for enforce timeout by @MaciekMis in #8319
• [TT-17486] fix: stop liveness probe blocking on node re-registration by @mativm02 in #8314
• TT-5486: Fix session cache access rights race by @andrei-tyk in #8320
• TT-17527: add timeout to test CI job by @olamilekan000 in #8331
• TT-17508: Add restriction to absolute paths when base_path is provided by @vladzabolotnyi in #8322
• [TT-17515] Rename Tyk Classic hard_timeouts duration wire field by @mativm02 in #8335
• [TT-17446] Tyk Gateway 5.13.1/5.14.0 CVEs by @MFCaballero in #8315
• [TT-17569] Bump storage to v1.3.4 (CVE fixes) by @lghiur in #8336
• TT-17607: Fix dep-guard running on tag push by @probelabs[bot] in #8355
• Merging to release-5.14.0: [TT-17578] Bump graphql-go-tools to fix Federation subscription-then-query null regression (#8345) by @probelabs[bot] in #8362
• Merging to release-5.14.0: TT-17622: cherry-pick goreleaser timeout bump (#8377) by @probelabs[bot] in #8378
• Merging to release-5.14.0: [TT-17585] MinTokenLength: apply the default floor of 3 to the create-time guard (#8346) by @probelabs[bot] in #8376
• fix: bump aws-sdk-go-v2/service/s3 to v1.97.3 (release-5.14.0) by @probelabs[bot] in #8385
• [releng release-5.14.0] Fix VEX attachment for ee by @probelabs[bot] in #8397
• [releng release-5.14.0] gromit: sync templates by @probelabs[bot] in #8406
• TT-17684 [5.14.0] Fix vulnerable stream dependencies by @buger in #8415
• TT-17688: test: add local httpbin.org mock to smoke tests (backport #8409) by @probelabs[bot] in #8418
• [TT-17689] Update httpbin image to mccutchen/go-httpbin in tests by @probelabs[bot] in #8428
• TT-17689: Fix httpbin port mismatch (renamed branch) by @probelabs[bot] in #8440
• DX-2386: Revert httpbin test-infra migration to pre-migration baseline (5.14.0) by @probelabs[bot] in #8450
• Update aws-sdk-go-v2 dependencies in go.mod and go.sum by @ilijabojanovic in #8457
• [TT-17417] docs: update swagger version to 5.14.0 by @bsten-tyk in #8460

Full Changelog: v5.13.1...v5.14.0

What's Changed

• [TT-11185] release docs 5.3.0 update by @titpetric in #6079
• [TT-11405] Updating JSON tags and field names for TLS max and min versions by @mativm02 in #6078
• TT-10962 by @kofoworola in #6072
• [TT-11388]: updated opentelemtry library and added tests for new span keys by @kofoworola in #6087
• [TT-11377] Adding “node_is_segmented” flag under “node” to complement “tags” by @mativm02 in #6093
• [TT-11413] Fix apidef GlobalRateLimit migrations by @titpetric in #6086
• TT-11288 Revert logger mutex by @sredxny in #6103
• [TT-11197] Upgrade google/grpc by @titpetric in #6100
• [TT-11440/TT-11461] Add functionName to replace name in OAS virtual endpoint and endpoint post plugin by @jeffy-mathew in #6098
• [TT-11439/TT-11452] fix custom plugins contract by @jeffy-mathew in #6097
• [TT-11295] Update graphql-go-tools dependency by @buraksezer in #6112
• [TT-11389]: moved graphql span attributes by @kofoworola in #6088
• TT-11443 Shim to keep compatibility in goplugins importing tyk redis by @sredxny in #6096
• [TT-11452] remove unused migrate func by @jeffy-mathew in #6117
• TT-11485, fix for global rate limit disabled flag not working by @andrei-tyk in #6120
• [SYSE-332] Fail tests reliably by @ermirizio in #6130
• [TT-11197] Bump github.com/go-jose/go-jose/v3 from 3.0.1 to 3.0.3 by @dependabot[bot] in #6124
• [TT-11549/TT-11597] Auto generated from templates by gromit by @jeffy-mathew in #6138
• [TT-10856/TT-11593]fix quota limits not working with url rewrite to self by @jeffy-mathew in #6133
• [TT-11627] Migrate failling to golangci-lint/forbidigo, fix issues by @titpetric in #6152
• [TT-11197]update hashicorp vault by @jeffy-mathew in #6150
• [TT-10909]: fix issue with missing upstream headers in graphql proxy only by @kofoworola in #6166
• [TT-6011] Fix non-functional coprocess apis, add tests by @titpetric in #4055
• [TT-11684] OAS-to-UDG converter - import paths & cleanup by @buraksezer in #6181
• [TT-11735] Exclude testdata from sonarcloud by @titpetric in #6182
• [TT-10104] JS middleware + ignore auth test and fix for panic by @titpetric in #6180
• Update README.md by @letzya in #6035
• [TT-11746] Add linter for regression test names by @titpetric in #6191
• [TT-11585] Process DeleteAPICache event by @jeffy-mathew in #6190
• [TT-10856/TT-11778] fix quota limit remaining header value when key is created from policy and API is looped by @jeffy-mathew in #6199
• [SYSE-336 master] Followup from March template application by @alephnull in #6207
• TT-7560, fixed issue with bundles loading with bad sign/checksum by @andrei-tyk in #6165
• [SYSE-353 master] Fix tyk-ci fetch mechanism by @ermirizio in #6213
• [TT-7560] skip loading API when custom middleware bundle fetch fails by @jeffy-mathew in #6211
• TT-11748 dont attempt to remove ApiCacheDeletion key from redis by @sredxny in #6215
• [TT-9972] release resources only after specs are completely switched during hot reload by @jeffy-mathew in #5535
• [TT-11925] Reset plugin compiler build env to match gateway build env by @titpetric in #6234
• [TT-11655] Graphql APIs are unable to handle OPTIONS requests by @rhianeKobar in #6221
• [SYSE-358 master] April template application by @ermirizio in #6248
• [TT-11991]: added request_headers_rewrite by @kofoworola in #6257
• [TT-11966/TT-12064] implement OAS webhooks events by @jeffy-mathew in #6258
• [TT-10291]: support gql-go-tools verison 2 by @kofoworola in #6240
• [TT-12064]Update Cast function signature by @jeffy-mathew in #6261
• [TT-10291]: upgrade gql-tools for v2 by @kofoworola in #6264
• [TT-11966/TT-12064] refactor oas events, update contract by @jeffy-mathew in #6263
• [TT-11966/TT-12064] update typo in cooldown period by @jeffy-mathew in #6266
• [TT-11966/TT-12064] handle edge case with empty event handlers by @jeffy-mathew in #6267
• [TT-12114]update goerr113 with err113 by @jeffy-mathew in #6268
• [SYSE-363 master] May template application by @alephnull in #6270
• update graphql-go-tools (TT-9884) by @pvormste in #6274
• [TT-5790] Update EnsureTransport and related tests by @titpetric in #6243
• [TT-11990] Change default behaviour of request_headers by @buraksezer in #6277
• [TT-11954/TT-12155] add x-tyk-api-gateway.servers.contextVariables.enabled by @jeffy-mathew in #6281
• [TT-7325] Enable fixed window rate limiter by @titpetric in #6253
• [TT-11954/TT-12115]fix location of contextVariables by @jeffy-mathew in #6285
• [TT-11739] Clean up rate limiting area, decouple GlobalConfig in APISpec by @titpetric in #6262
• [TT-11914/TT-12101]Add OAS trafficLogs by @jeffy-mathew in #6287
• [Test] Updates for opentelemetry test, use golang_cross in GH build cache key by @titpetric in #6282
• [TT-11806] Respect domain and listen path by @titpetric in #6289
• [DX-1345] Update config description for inclusive naming project by @dcs3spp in #6286
• [TT-12153]: Fix/complexity checker and granular access checker v3-preview by @kofoworola in #6293
• [TT-12193] Fix poor error handling in webhook event templates by @titpetric in #6303
• add features section to graphql proxy config by @pvormste in #6298
• [TT-12193] Add log for event handler webhook by @titpetric in #6310
• [TT-12193] Update error handling on webhook events when the event template has errors by @titpetric in #6312
• [TT-11997] Backend logic for request_headers_rewrite by @buraksezer in #6306
• [TT-12095] Fixing unhashed API keys exposed in OTEL spans by @mativm02 in #6296
• [TT-11470] Add human identifiable information in NodeData by @padiazg in #6229
• add logic for use_immutable_headers (TT-12190) by @pvormste in #6315
• [TT-11997] Header case insensitivity by @buraksezer in #6316
• [TT-3738] Implement rate limit smoothing by @titpetric in #6295
• [TT-11739] Re-add gateway.RateLimitExceeded (Dashboard coupling) by @titpetric in #6318
• [TT-11739] Fix RateLimitExceeded var name to include Event prefix by @titpetric in #6319
• feat/TT-9462/tag-cached-response by @joshblakeley in #6308
• [TT-12186] Fixes TestOAS_ExtractTo_ResetAPIDefinition with a valid event config by @titpetric in #6321
• [TT-12312] update openapi spec version by @jeffy-mathew in #6323
• [TT-12313, TT-12222] Update graphql-go-tools by @buraksezer in #6326
• [TT-12323] fix panic when webhook handler is disabled by @jeffy-mathew in #6334
• [TT-12311] exp/modcheck: Update go.mod dependencies by @buger in #6337
• [TT-12365] Add new events to validate in x-tyk-api-gateway by @titpetric in #6347
• [TT-9864] Optimize the cre...

What's Changed

• [TT-11185] release docs 5.3.0 update by @titpetric in #6079
• [TT-11405] Updating JSON tags and field names for TLS max and min versions by @mativm02 in #6078
• TT-10962 by @kofoworola in #6072
• [TT-11388]: updated opentelemtry library and added tests for new span keys by @kofoworola in #6087
• [TT-11377] Adding “node_is_segmented” flag under “node” to complement “tags” by @mativm02 in #6093
• [TT-11413] Fix apidef GlobalRateLimit migrations by @titpetric in #6086
• TT-11288 Revert logger mutex by @sredxny in #6103
• [TT-11197] Upgrade google/grpc by @titpetric in #6100
• [TT-11440/TT-11461] Add functionName to replace name in OAS virtual endpoint and endpoint post plugin by @jeffy-mathew in #6098
• [TT-11439/TT-11452] fix custom plugins contract by @jeffy-mathew in #6097
• [TT-11295] Update graphql-go-tools dependency by @buraksezer in #6112
• [TT-11389]: moved graphql span attributes by @kofoworola in #6088
• TT-11443 Shim to keep compatibility in goplugins importing tyk redis by @sredxny in #6096
• [TT-11452] remove unused migrate func by @jeffy-mathew in #6117
• TT-11485, fix for global rate limit disabled flag not working by @andrei-tyk in #6120
• [SYSE-332] Fail tests reliably by @ermirizio in #6130
• [TT-11197] Bump github.com/go-jose/go-jose/v3 from 3.0.1 to 3.0.3 by @dependabot[bot] in #6124
• [TT-11549/TT-11597] Auto generated from templates by gromit by @jeffy-mathew in #6138
• [TT-10856/TT-11593]fix quota limits not working with url rewrite to self by @jeffy-mathew in #6133
• [TT-11627] Migrate failling to golangci-lint/forbidigo, fix issues by @titpetric in #6152
• [TT-11197]update hashicorp vault by @jeffy-mathew in #6150
• [TT-10909]: fix issue with missing upstream headers in graphql proxy only by @kofoworola in #6166
• [TT-6011] Fix non-functional coprocess apis, add tests by @titpetric in #4055
• [TT-11684] OAS-to-UDG converter - import paths & cleanup by @buraksezer in #6181
• [TT-11735] Exclude testdata from sonarcloud by @titpetric in #6182
• [TT-10104] JS middleware + ignore auth test and fix for panic by @titpetric in #6180
• Update README.md by @letzya in #6035
• [TT-11746] Add linter for regression test names by @titpetric in #6191
• [TT-11585] Process DeleteAPICache event by @jeffy-mathew in #6190
• [TT-10856/TT-11778] fix quota limit remaining header value when key is created from policy and API is looped by @jeffy-mathew in #6199
• [SYSE-336 master] Followup from March template application by @alephnull in #6207
• TT-7560, fixed issue with bundles loading with bad sign/checksum by @andrei-tyk in #6165
• [SYSE-353 master] Fix tyk-ci fetch mechanism by @ermirizio in #6213
• [TT-7560] skip loading API when custom middleware bundle fetch fails by @jeffy-mathew in #6211
• TT-11748 dont attempt to remove ApiCacheDeletion key from redis by @sredxny in #6215
• [TT-9972] release resources only after specs are completely switched during hot reload by @jeffy-mathew in #5535
• [TT-11925] Reset plugin compiler build env to match gateway build env by @titpetric in #6234
• [TT-11655] Graphql APIs are unable to handle OPTIONS requests by @rhianeKobar in #6221
• [SYSE-358 master] April template application by @ermirizio in #6248
• [TT-11991]: added request_headers_rewrite by @kofoworola in #6257
• [TT-11966/TT-12064] implement OAS webhooks events by @jeffy-mathew in #6258
• [TT-10291]: support gql-go-tools verison 2 by @kofoworola in #6240
• [TT-12064]Update Cast function signature by @jeffy-mathew in #6261
• [TT-10291]: upgrade gql-tools for v2 by @kofoworola in #6264
• [TT-11966/TT-12064] refactor oas events, update contract by @jeffy-mathew in #6263
• [TT-11966/TT-12064] update typo in cooldown period by @jeffy-mathew in #6266
• [TT-11966/TT-12064] handle edge case with empty event handlers by @jeffy-mathew in #6267
• [TT-12114]update goerr113 with err113 by @jeffy-mathew in #6268
• [SYSE-363 master] May template application by @alephnull in #6270
• update graphql-go-tools (TT-9884) by @pvormste in #6274
• [TT-5790] Update EnsureTransport and related tests by @titpetric in #6243
• [TT-11990] Change default behaviour of request_headers by @buraksezer in #6277
• [TT-11954/TT-12155] add x-tyk-api-gateway.servers.contextVariables.enabled by @jeffy-mathew in #6281
• [TT-7325] Enable fixed window rate limiter by @titpetric in #6253
• [TT-11954/TT-12115]fix location of contextVariables by @jeffy-mathew in #6285
• [TT-11739] Clean up rate limiting area, decouple GlobalConfig in APISpec by @titpetric in #6262
• [TT-11914/TT-12101]Add OAS trafficLogs by @jeffy-mathew in #6287
• [Test] Updates for opentelemetry test, use golang_cross in GH build cache key by @titpetric in #6282
• [TT-11806] Respect domain and listen path by @titpetric in #6289
• [DX-1345] Update config description for inclusive naming project by @dcs3spp in #6286
• [TT-12153]: Fix/complexity checker and granular access checker v3-preview by @kofoworola in #6293
• [TT-12193] Fix poor error handling in webhook event templates by @titpetric in #6303
• add features section to graphql proxy config by @pvormste in #6298
• [TT-12193] Add log for event handler webhook by @titpetric in #6310
• [TT-12193] Update error handling on webhook events when the event template has errors by @titpetric in #6312
• [TT-11997] Backend logic for request_headers_rewrite by @buraksezer in #6306
• [TT-12095] Fixing unhashed API keys exposed in OTEL spans by @mativm02 in #6296
• [TT-11470] Add human identifiable information in NodeData by @padiazg in #6229
• add logic for use_immutable_headers (TT-12190) by @pvormste in #6315
• [TT-11997] Header case insensitivity by @buraksezer in #6316
• [TT-3738] Implement rate limit smoothing by @titpetric in #6295
• [TT-11739] Re-add gateway.RateLimitExceeded (Dashboard coupling) by @titpetric in #6318
• [TT-11739] Fix RateLimitExceeded var name to include Event prefix by @titpetric in #6319
• feat/TT-9462/tag-cached-response by @joshblakeley in #6308
• [TT-12186] Fixes TestOAS_ExtractTo_ResetAPIDefinition with a valid event config by @titpetric in #6321
• [TT-12312] update openapi spec version by @jeffy-mathew in #6323
• [TT-12313, TT-12222] Update graphql-go-tools by @buraksezer in #6326
• [TT-12323] fix panic when webhook handler is disabled by @jeffy-mathew in #6334
• [TT-12311] exp/modcheck: Update go.mod dependencies by @buger in #6337
• [TT-12365] Add new events to validate in x-tyk-api-gateway by @titpetric in #6347
• [TT-9864] Optimize the cre...

Tyk Gateway 5.11.0

https://tyk.io/docs/developer-support/release-notes/gateway#5-11-release-notes

Tyk Dashboard 5.11.0

https://tyk.io/docs/developer-support/release-notes/dashboard#5-11-release-notes