This page documents production updates to all Apigee software in 2022 and later. We recommend that users periodically check this list for any new announcements, or subscribe to this page using a feed reader to get notifications of updates.
What is a feed reader?
Really simple syndication (RSS) feed readers aggregate content from websites that you specify.
Feed reader notifications can be email-, browser-, desktop-, or mobile-based. Some readers are free, or have free versions, and some require a subscription.
A few examples:
More information on RSS:
See also:
You can see the latest product updates for all of Google Cloud on the Google Cloud page, browse and filter all release notes in the Google Cloud console, or programmatically access release notes in BigQuery.
To get the latest product updates delivered to you, add the URL of this page to your feed reader, or add the feed URL directly.
September 21, 2026
Apigee XOn September 21st, 2026, we began maintenance updates of Apigee instances configured for maintenance windows.
If you set a preferred window for maintenance for your instance, and your instance version is below 1-18-0-apigee-4, your instance will be updated to 1-18-0-apigee-4 within the next seven to 21 days. A notification containing the expected date of upgrade will be sent within the next two business days.
For more information on participating in scheduled maintenance windows, see Maintenance overview and Manage Apigee instance maintenance windows.
On September 21st, 2026, we released an updated version of Apigee (1-18-0-apigee-5).
| Bug ID | Description |
|---|---|
| 560130499 | Security fix for Apigee. Fixed a security issue in the Java Callout policy. |
| 547681234 | Security fix for Apigee. Patched CVE-2026-69247 by upgrading a third-party library used by the Apigee model-security engine. |
| 556568593 | Security fix for Apigee. Patched CVE-2026-84304 by upgrading gRPC. |
| N/A | Security fix for Apigee infrastructure. |
| Bug ID | Description |
|---|---|
| 559009293 | Fixed elevated OAuth and VerifyAPIKey latency and Cassandra read load for AppGroup apps by caching the AppGroup entity in the Message Processor runtime, matching Developer-app behavior. |
| 558888960 | Fixed distributed tracing so that the target URL is included as a span attribute in all scenarios. |
| 556750755 | Fixed EventFlow (Server-Sent Events) dropping or truncating events that follow a large (greater than 16 KB) event under load on the http-adaptor data path. |
| 553931019 | The MCP tools/list method now aggregates tools across all approved API products. |
| 531783017 | Implemented the <Enforce>true</Enforce> element of SSLInfo for a Syslog endpoint, so that the syslog target's TLS server identity is verified. |
| 554114419 | Policies can now change request pseudo-headers (for example, :path and :authority) when HTTP/2 is in use. |
| 548763108 | Blocked outbound HTTP from the Message Processor to Kubernetes-internal targets. |
| 513032450 | Restored a 15-second TCP keep-alive on the Apigee Connect control-plane connection so that a silently dropped connection recovers in seconds rather than approximately two hours. |
| N/A | Updates to infrastructure and libraries. |
September 17, 2026
Apigee hybridv1.16.10
On September 17, 2026 we released an updated version of the Apigee hybrid software, v1.16.10.
- For information on upgrading, see Upgrading Apigee hybrid to version v1.16.10.
- For information on new installations, see The big picture.
Fixed in this release
| Bug ID | Description |
|---|---|
| 556750755 | Fixed an issue where EventFlow (Server-Sent Events) dropped or truncated events following a large (>16 KB) event under load on the http-adaptor datapath. |
| 547712217 | Fixed an issue where EventFlow (Server-Sent Events) responses larger than 16 KB could be truncated or corrupted across socket reads. |
| 519729209 | Fixed a SAML XML Signature Wrapping (XSW) vulnerability in the ValidateSAMLAssertion policy. |
| 514384893 | Hardened the Script policy to block server-side request forgery (SSRF) to link-local addresses. |
| 505645076 | Fixed a security issue in the OAuthV2 policy to prevent unauthorized token injection via HTTP form parameters. |
| 505543289 | Fixed thread-safety issues in the Netty client connection pool and channel lifecycle. |
| 503817773 | Improved security in the OAuthV2 policy implicit grant redirect_uri validation. |
| 502268966 | Apigee hybrid now supports optional decoding of percent-encoded path separators (%2F and %5C) before flow selection via the request.path.decode.encoded.separators proxy property. |
| 480770263 | Fixed an issue in the SpikeArrest policy to handle edge cases that previously caused NullPointerException and 500 errors. |
| 472526232 | Improved SAML assertion validation in the ValidateSAMLAssertion policy against entity and comment injection. |
| 470375542 | Fixed a memory leak in WSFrameDecoder that could result in a spike in 503 responses with no_healthy_upstream errors. |
| 449228485 | Apigee hybrid now supports configuring custom Kubernetes PodDisruptionBudget (minAvailable or maxUnavailable) values for Apigee hybrid components in your overrides.yaml file. |
| 402250928 | Apigee hybrid now supports routing outbound calls from AI policies, such as the Model Armor and semantic caching policies, through an HTTP forward proxy. |
Kubernetes 1.36 support
Apigee hybrid v1.16.10 adds support for Kubernetes 1.36 on Google Kubernetes Engine (GKE), Google Distributed Cloud Virtual for VMware (vSphere), Google Distributed Cloud Virtual for bare metal, Amazon EKS, Azure AKS, and Rancher Kubernetes Engine (RKE2).
For more information, see Supported platforms.
Forward proxy support for AI policies
Apigee hybrid v1.16.10 adds forward proxy support for AI policies, such as the Model Armor and semantic caching policies. Outbound calls from these policies can now be routed through an HTTP forward proxy.
For more information, see Configure a forward proxy, Get started with the Model Armor policies, and Get started with semantic caching policies.