This page documents production updates to Apigee hybrid in 2022 and later. We recommend that users periodically check this list for any new announcements, or subscribe to this page using a feed reader to get notifications of updates.
What is a feed reader?
Really simple syndication (RSS) feed readers aggregate content from websites that you specify.
Feed reader notifications can be email-, browser-, desktop-, or mobile-based. Some readers are free, or have free versions, and some require a subscription.
A few examples:
More information on RSS:
See also:
You can see the latest product updates for all of Google Cloud on the Google Cloud page, browse and filter all release notes in the Google Cloud console, or programmatically access release notes in BigQuery.
To get the latest product updates delivered to you, add the URL of this page to your feed reader, or add the feed URL directly.
September 17, 2026
v1.16.10
On September 17, 2026 we released an updated version of the Apigee hybrid software, v1.16.10.
- For information on upgrading, see Upgrading Apigee hybrid to version v1.16.10.
- For information on new installations, see The big picture.
Fixed in this release
| Bug ID | Description |
|---|---|
| 556750755 | Fixed an issue where EventFlow (Server-Sent Events) dropped or truncated events following a large (>16 KB) event under load on the http-adaptor datapath. |
| 547712217 | Fixed an issue where EventFlow (Server-Sent Events) responses larger than 16 KB could be truncated or corrupted across socket reads. |
| 519729209 | Fixed a SAML XML Signature Wrapping (XSW) vulnerability in the ValidateSAMLAssertion policy. |
| 514384893 | Hardened the Script policy to block server-side request forgery (SSRF) to link-local addresses. |
| 505645076 | Fixed a security issue in the OAuthV2 policy to prevent unauthorized token injection via HTTP form parameters. |
| 505543289 | Fixed thread-safety issues in the Netty client connection pool and channel lifecycle. |
| 503817773 | Improved security in the OAuthV2 policy implicit grant redirect_uri validation. |
| 502268966 | Apigee hybrid now supports optional decoding of percent-encoded path separators (%2F and %5C) before flow selection via the request.path.decode.encoded.separators proxy property. |
| 480770263 | Fixed an issue in the SpikeArrest policy to handle edge cases that previously caused NullPointerException and 500 errors. |
| 472526232 | Improved SAML assertion validation in the ValidateSAMLAssertion policy against entity and comment injection. |
| 470375542 | Fixed a memory leak in WSFrameDecoder that could result in a spike in 503 responses with no_healthy_upstream errors. |
| 449228485 | Apigee hybrid now supports configuring custom Kubernetes PodDisruptionBudget (minAvailable or maxUnavailable) values for Apigee hybrid components in your overrides.yaml file. |
| 402250928 | Apigee hybrid now supports routing outbound calls from AI policies, such as the Model Armor and semantic caching policies, through an HTTP forward proxy. |
Kubernetes 1.36 support
Apigee hybrid v1.16.10 adds support for Kubernetes 1.36 on Google Kubernetes Engine (GKE), Google Distributed Cloud Virtual for VMware (vSphere), Google Distributed Cloud Virtual for bare metal, Amazon EKS, Azure AKS, and Rancher Kubernetes Engine (RKE2).
For more information, see Supported platforms.
Forward proxy support for AI policies
Apigee hybrid v1.16.10 adds forward proxy support for AI policies, such as the Model Armor and semantic caching policies. Outbound calls from these policies can now be routed through an HTTP forward proxy.
For more information, see Configure a forward proxy, Get started with the Model Armor policies, and Get started with semantic caching policies.
| Bug ID | Description |
|---|---|
| N/A | Security fixes for apigee-asm-ingress. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-asm-istiod. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-connect-agent. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-fluent-bit. This addresses the following vulnerabilities:
|
| N/A | Security fixes for apigee-hybrid-cassandra-client. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-mart-server. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-mint-task-scheduler. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-open-telemetry-collector. This addresses the following vulnerability: |
| N/A | Security fixes for apigee-operators. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-prom-prometheus. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-prometheus-adapter. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-redis. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-runtime. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-synchronizer. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-watcher. This addresses the following vulnerabilities: |
September 14, 2026
hybrid v1.17.0
On September 14, 2026 we released an updated version of the Apigee hybrid software, 1.17.0.
- For information on upgrading, see Upgrading Apigee hybrid to version v1.17.
- For information on new installations, see The big picture.
Model Context Protocol (MCP) support
Apigee hybrid now supports Model Context Protocol (MCP), an open protocol that lets agentic AI applications use your APIs as tools through managed MCP endpoints. Apigee hybrid routes, authorizes, and secures these MCP tool calls the same way it manages your other APIs, so you don't need to run or maintain your own MCP servers.
MCP support is an optional feature that is not enabled by default. You must explicitly enable it in your Apigee hybrid configuration.
For more information, see Model Context Protocol (MCP) overview, Enable MCP for Apigee hybrid, and the MCP quickstart.
Root CA certificate rotation
Apigee hybrid v1.17.0 lets you rotate the root certificate authority (CA) certificate that anchors trust for TLS communication between your runtime components. You can now replace the root CA before it expires, without downtime.
For more information, see Rotate the root CA.
TLS 1.3 support
Apigee hybrid v1.17.0 adds support for TLS 1.3, a newer version of the Transport Layer Security (TLS) protocol that offers faster connection handshakes and stronger security than earlier TLS versions.
For information about configuring TLS on the ingress gateway, see Configuring TLS and mTLS on the Apigee ingress gateway.
Forward proxy support for AI policies
Apigee hybrid v1.17.0 adds forward proxy support for AI policies, such as the Model Armor and semantic caching policies. Outbound calls from these policies can now be routed through an HTTP forward proxy.
For more information, see Configure a forward proxy, Get started with the Model Armor policies, and Get started with semantic caching policies.
Semantic cache Private Service Connect (PSC) endpoint support
Apigee hybrid v1.17.0 adds Private Service Connect (PSC) endpoint support for semantic caching. The semantic caching policies can now reach their backing services over a Private Service Connect endpoint, which keeps that traffic on your private network.
For more information, see Configure semantic caching over Private Service Connect.
Semantic cache distance measure support
Apigee hybrid v1.17.0 adds support for non-default Vertex AI Vector Search distance measures in the SemanticCacheLookup policy. A new optional <DistanceMeasureType> element accepts DOT_PRODUCT_DISTANCE (the default, and the existing behavior), COSINE_DISTANCE, SQUARED_L2_DISTANCE, and L1_DISTANCE. The policy compares <Threshold> in the direction the declared measure implies, so declaring a non-default measure requires re-tuning the threshold in the same edit.
For more information, see SemanticCacheLookup policy.
Reduced service account permissions
Apigee hybrid v1.17.0 reduces the Google Cloud IAM permissions that Apigee service accounts require. Service accounts that use Cloud Storage now require only the storage.objects.get and storage.objects.create permissions rather than the broader Storage Admin (roles/storage.admin) role. The Cassandra components also no longer run with the privileged: true security context.
For more information about service accounts, see Create service accounts.
Various security and CVE fixes are included in this release.
August 26, 2026
v1.14.8
On August 26, 2026 we released an updated version of the Apigee hybrid software, v1.14.8.
- For information on upgrading, see Upgrading Apigee hybrid to version v1.14.8.
- For information on new installations, see The big picture.
| Bug ID | Description |
|---|---|
| N/A | Security fixes for apigee-asm-ingress. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-asm-istiod. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-connect-agent. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-fluent-bit. This addresses the following vulnerabilities:
|
| N/A | Security fixes for apigee-hybrid-cassandra. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-hybrid-cassandra-client. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-mart-server. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-mint-task-scheduler. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-operators. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-prom-prometheus. This addresses the following vulnerability: |
| N/A | Security fixes for apigee-prometheus-adapter. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-redis. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-runtime. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-synchronizer. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-watcher. This addresses the following vulnerabilities: |
August 11, 2026
v1.16.9
On August 11, 2026 we released an updated version of the Apigee hybrid software, v1.16.9.
- For information on upgrading, see Upgrading Apigee hybrid to version v1.16.9.
- For information on new installations, see The big picture.
Fixed in this release
| Bug ID | Description |
|---|---|
| 514973778 | Fixed an issue where the SanitizeUserPrompt and SanitizeModelResponse policies failed to tolerate unknown fields while parsing responses from the Model Armor Service. |
| 543171828 | Fixed an issue where the apigee-logger DaemonSet failed to schedule on cluster nodes without custom node labels due to a default logger.nodeSelector in the Helm chart. |
Various security and CVE fixes are included in this release.
July 31, 2026
v1.15.7
On July 31, 2026 we released an updated version of the Apigee hybrid software, v1.15.7.
- For information on upgrading, see Upgrading Apigee hybrid to version v1.15.7.
- For information on new installations, see The big picture.
Runtime rollout strategy configuration
In this release, you can configure the rollout strategy used when updating runtime (message processor) ReplicaSets by setting the runtime.release.strategy property (with options rolling, scale-down-first, or none) or per-environment with envs[].components.runtime.release.strategy in your overrides configuration file. The property defaults to rolling.
Various security and CVE fixes are included in this release.
July 24, 2026
v1.16.8
On July 24, 2026 we released an updated version of the Apigee hybrid software, v1.16.8.
- For information on upgrading, see Upgrading Apigee hybrid to version 1.16.
- For information on new installations, see The big picture.
Fixed in this release
| Bug ID | Description |
|---|---|
| 493354568 | Fixed an issue where component-specific nodeSelector configurations are ignored in Helm charts. |
Runtime rollout strategy configuration
In this release, you can configure the rollout strategy used when updating runtime (message processor) ReplicaSets by setting the runtime.release.strategy property (with options rolling, scale-down-first, or none) or per-environment with envs[].components.runtime.release.strategy in your overrides configuration file. The property defaults to rolling.
Various security and CVE fixes are included in this release.
July 23, 2026
v1.14.7
On July 23, 2026 we released an updated version of the Apigee hybrid software, v1.14.7.
- For information on upgrading, see Upgrading Apigee hybrid to version 1.14.
- For information on new installations, see The big picture.
Runtime rollout strategy configuration
In this release, you can configure the rollout strategy used when updating runtime (message processor) ReplicaSets by setting the runtime.release.strategy property (with options rolling, scale-down-first, or none) or per-environment with envs[].components.runtime.release.strategy in your overrides configuration file. The property defaults to rolling.
Various security and CVE fixes are included in this release.
July 15, 2026
v1.15.6
On July 15, 2026 we released an updated version of the Apigee hybrid software, v1.15.6.
- For information on upgrading, see Upgrading Apigee hybrid to version v1.15.6.
- For information on new installations, see The big picture.
Various security and CVE fixes are included in this release.
July 10, 2026
v1.16.7
On July 10, 2026 we released an updated version of the Apigee hybrid software, v1.16.7.
- For information on upgrading, see Upgrading Apigee hybrid to version v1.16.7.
- For information on new installations, see The big picture.
Various security and CVE fixes are included in this release.
July 03, 2026
v1.15.5
On July 3, 2026 we released an updated version of the Apigee hybrid software, v1.15.5.
- For information on upgrading, see Upgrading Apigee hybrid to version v1.15.5.
- For information on new installations, see The big picture.
Various security and CVE fixes are included in this release.
June 19, 2026
v1.16.6
On June 19, 2026 we released an updated version of the Apigee hybrid software, v1.16.6.
- For information on upgrading, see Upgrading Apigee hybrid to version v1.16.6.
- For information on new installations, see The big picture.
HAProxy PROXY-protocol support on Apigee ingress gateway
In this release, you can opt into HAProxy PROXY-protocol parsing by setting the ingressGateways[].proxyProtocol.mode property (with options strict, permissive, or disable) in your overrides configuration file. The property defaults to disable.
Various security and CVE fixes are included in this release.
June 16, 2026
v1.14.6
On June 16, 2026 we released an updated version of the Apigee hybrid software, v1.14.6.
- For information on upgrading, see Upgrading Apigee hybrid to version v1.14.6.
- For information on new installations, see The big picture.
Various security and CVE fixes are included in this release.
June 08, 2026
v1.16.5
On June 8, 2026 we released an updated version of the Apigee hybrid software, v1.16.5.
- For information on upgrading, see Upgrading Apigee hybrid to version v1.16.5.
- For information on new installations, see The big picture.
Various security and CVE fixes are included in this release.
May 30, 2026
v1.15.4
On May 30, 2026 we released an updated version of the Apigee hybrid software, v1.15.4.
- For information on upgrading, see Upgrading Apigee hybrid to version v1.15.4.
- For information on new installations, see The big picture.
Various security and CVE fixes are included in this release.
May 22, 2026
On May 22, 2026 we released an updated version of the Apigee UI.
The Management > Instances page now displays Apigee hybrid instances. The display includes the instance name, location, and runtime version.
See Managing instances.
v1.14.5
On May 22, 2026 we released an updated version of the Apigee hybrid software, v1.14.5.
- For information on upgrading, see Upgrading Apigee hybrid to version v1.14.5.
- For information on new installations, see The big picture.
Various security and CVE fixes are included in this release.
Apigee Emulator is now released independently
Starting May 22, 2026, the Apigee Emulator is versioned and released independently from Apigee hybrid. Emulator updates, including security patches, are no longer tied to hybrid release cycles.
The emulator image continues to be available at
gcr.io/apigee-release/hybrid/apigee-emulator. The first independent release
is v2.0.0.
For emulator release notes going forward, see Apigee release notes.
May 21, 2026
v1.16.4
On May 21, 2026 we released an updated version of the Apigee hybrid software, v1.16.4.
- For information on upgrading, see Upgrading Apigee hybrid to version v1.16.4.
- For information on new installations, see The big picture.
Fixed in this release
| Bug ID | Description |
|---|---|
| 515424331 | Fixed an issue with missing container images in the gcr.io/apigee-release/hybrid/ repository. |
May 19, 2026
v1.16.3
On May 19, 2026 we released an updated version of the Apigee hybrid software, v1.16.3.
- For information on upgrading, see Upgrading Apigee hybrid to version v1.16.3.
- For information on new installations, see The big picture.
Fixed in this release
| Bug ID | Description |
|---|---|
| 512866352 | Fixed an issue where the apigee-redis pod entered a CrashLoopBackOff state when deployed with Vault-based secret injection due to a GLIBC version mismatch in the bundled /bin/sh and /bin/cat binaries. |
Custom environment variables for Guardrail pods (guardrails.envVars)
Starting in version v1.16.3, you can inject custom environment variables into Apigee hybrid Guardrail pods using the new guardrails.envVars property in overrides.yaml. This is most commonly used to set NO_PROXY (or no_proxy) so that Guardrail pods bypass a configured forward HTTP proxy when calling internal in-cluster endpoints such as the Kubernetes API server, which previously failed in restricted-network environments with a global httpProxy configured. The property is supported on Guardrail pods for the following components: apigee-datastore, apigee-env, apigee-ingress-manager, apigee-operator, apigee-org, apigee-redis, apigee-telemetry, and apigee-virtualhost.
Example:
guardrails:
envVars:
NO_PROXY: 'kubernetes.default.svc,172.20.0.1'
May 13, 2026
v1.16.2
On May 13, 2026 we released an updated version of the Apigee hybrid software, v1.16.2.
- For information on upgrading, see Upgrading Apigee hybrid to version v1.16.2.
- For information on new installations, see The big picture.
Basic Auth credential support for forward proxies
Starting in version v1.16.2, Apigee hybrid runtime components can accept credentials for an upstream forward proxy that enforces HTTP Basic Auth. You can now configure a Basic Auth username and password for the forward proxy in your overrides.yaml. This resolves known issue tracked in b/499322601. See Configure Apigee hybrid to use a forward proxy.
Sidecar authentication for Workload Identity Federation on AKS and EKS
Starting in version v1.16.2, you can now use a sidecar along with Workload Identity Federation on AKS and EKS to mount security tokens from your preferred identity provider (IDP) for service account authentication. This method is an alternative to using Kubernetes Projected Service Account Tokens, and is useful when you need to integrate with a custom Identity Provider. See Use sidecar authentication for Workload Identity Federation on AKS and EKS.
Fixed in this release
| Bug ID | Description |
|---|---|
| 485738013 | Fixed an issue where API products with LLMTokenQuota operations were not enforcing model-based access restrictions, allowing requests to models not listed in the product to bypass the operations check. |
| 479288727 | Fixed an issue where the Apigee UI and API reported a 10+ minute delay in deployment status after performing a proxy deployment. |
| 499223890 | Fixed an issue where the runtime could not handle HTTP proxy passwords containing special characters in Apigee hybrid 1.16.0-hotfix-1 configurations. |
| 500861814 | Fixed an issue that caused excessive Message Processor (MP) upscaling and failure to downscale. |
| 510438578 | Fixed an ingestion-blocking issue with apigee-stackdriver-prometheus-sidecar in Apigee hybrid 1.16.1. |
Various security and CVE fixes are included in this release.
May 04, 2026
v1.15.3
On May 4, 2026 we released an updated version of the Apigee hybrid software, v1.15.3.
- For information on upgrading, see Upgrading Apigee hybrid to version v1.15.3.
- For information on new installations, see The big picture.
| Bug ID | Description |
|---|---|
| N/A | Security fixes for apigee-asm-ingress. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-asm-istiod. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-connect-agent. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-fluent-bit. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-hybrid-cassandra. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-hybrid-cassandra-client. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-kube-rbac-proxy. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-mart-server. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-mint-task-scheduler. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-open-telemetry-collector. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-operators. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-prom-prometheus. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-prometheus-adapter. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-redis. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-runtime. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-stackdriver-logging-agent. This addresses the following vulnerabilities: |