This page documents production updates to all Apigee software in 2022 and later. We recommend that users periodically check this list for any new announcements, or subscribe to this page using a feed reader to get notifications of updates.
What is a feed reader?
Really simple syndication (RSS) feed readers aggregate content from websites that you specify.
Feed reader notifications can be email-, browser-, desktop-, or mobile-based. Some readers are free, or have free versions, and some require a subscription.
A few examples:
More information on RSS:
See also:
You can see the latest product updates for all of Google Cloud on the Google Cloud page, browse and filter all release notes in the Google Cloud console, or programmatically access release notes in BigQuery.
To get the latest product updates delivered to you, add the URL of this page to your feed reader, or add the feed URL directly.
September 21, 2026
Apigee XOn September 21st, 2026, we began maintenance updates of Apigee instances configured for maintenance windows.
If you set a preferred window for maintenance for your instance, and your instance version is below 1-18-0-apigee-4, your instance will be updated to 1-18-0-apigee-4 within the next seven to 21 days. A notification containing the expected date of upgrade will be sent within the next two business days.
For more information on participating in scheduled maintenance windows, see Maintenance overview and Manage Apigee instance maintenance windows.
On September 21st, 2026, we released an updated version of Apigee (1-18-0-apigee-5).
| Bug ID | Description |
|---|---|
| 560130499 | Security fix for Apigee. Fixed a security issue in the Java Callout policy. |
| 547681234 | Security fix for Apigee. Patched CVE-2026-69247 by upgrading a third-party library used by the Apigee model-security engine. |
| 556568593 | Security fix for Apigee. Patched CVE-2026-84304 by upgrading gRPC. |
| N/A | Security fix for Apigee infrastructure. |
| Bug ID | Description |
|---|---|
| 559009293 | Fixed elevated OAuth and VerifyAPIKey latency and Cassandra read load for AppGroup apps by caching the AppGroup entity in the Message Processor runtime, matching Developer-app behavior. |
| 558888960 | Fixed distributed tracing so that the target URL is included as a span attribute in all scenarios. |
| 556750755 | Fixed EventFlow (Server-Sent Events) dropping or truncating events that follow a large (greater than 16 KB) event under load on the http-adaptor data path. |
| 553931019 | The MCP tools/list method now aggregates tools across all approved API products. |
| 531783017 | Implemented the <Enforce>true</Enforce> element of SSLInfo for a Syslog endpoint, so that the syslog target's TLS server identity is verified. |
| 554114419 | Policies can now change request pseudo-headers (for example, :path and :authority) when HTTP/2 is in use. |
| 548763108 | Blocked outbound HTTP from the Message Processor to Kubernetes-internal targets. |
| 513032450 | Restored a 15-second TCP keep-alive on the Apigee Connect control-plane connection so that a silently dropped connection recovers in seconds rather than approximately two hours. |
| N/A | Updates to infrastructure and libraries. |
September 17, 2026
Apigee hybridv1.16.10
On September 17, 2026 we released an updated version of the Apigee hybrid software, v1.16.10.
- For information on upgrading, see Upgrading Apigee hybrid to version v1.16.10.
- For information on new installations, see The big picture.
Fixed in this release
| Bug ID | Description |
|---|---|
| 556750755 | Fixed an issue where EventFlow (Server-Sent Events) dropped or truncated events following a large (>16 KB) event under load on the http-adaptor datapath. |
| 547712217 | Fixed an issue where EventFlow (Server-Sent Events) responses larger than 16 KB could be truncated or corrupted across socket reads. |
| 519729209 | Fixed a SAML XML Signature Wrapping (XSW) vulnerability in the ValidateSAMLAssertion policy. |
| 514384893 | Hardened the Script policy to block server-side request forgery (SSRF) to link-local addresses. |
| 505645076 | Fixed a security issue in the OAuthV2 policy to prevent unauthorized token injection via HTTP form parameters. |
| 505543289 | Fixed thread-safety issues in the Netty client connection pool and channel lifecycle. |
| 503817773 | Improved security in the OAuthV2 policy implicit grant redirect_uri validation. |
| 502268966 | Apigee hybrid now supports optional decoding of percent-encoded path separators (%2F and %5C) before flow selection via the request.path.decode.encoded.separators proxy property. |
| 480770263 | Fixed an issue in the SpikeArrest policy to handle edge cases that previously caused NullPointerException and 500 errors. |
| 472526232 | Improved SAML assertion validation in the ValidateSAMLAssertion policy against entity and comment injection. |
| 470375542 | Fixed a memory leak in WSFrameDecoder that could result in a spike in 503 responses with no_healthy_upstream errors. |
| 449228485 | Apigee hybrid now supports configuring custom Kubernetes PodDisruptionBudget (minAvailable or maxUnavailable) values for Apigee hybrid components in your overrides.yaml file. |
| 402250928 | Apigee hybrid now supports routing outbound calls from AI policies, such as the Model Armor and semantic caching policies, through an HTTP forward proxy. |
Kubernetes 1.36 support
Apigee hybrid v1.16.10 adds support for Kubernetes 1.36 on Google Kubernetes Engine (GKE), Google Distributed Cloud Virtual for VMware (vSphere), Google Distributed Cloud Virtual for bare metal, Amazon EKS, Azure AKS, and Rancher Kubernetes Engine (RKE2).
For more information, see Supported platforms.
Forward proxy support for AI policies
Apigee hybrid v1.16.10 adds forward proxy support for AI policies, such as the Model Armor and semantic caching policies. Outbound calls from these policies can now be routed through an HTTP forward proxy.
For more information, see Configure a forward proxy, Get started with the Model Armor policies, and Get started with semantic caching policies.
| Bug ID | Description |
|---|---|
| N/A | Security fixes for apigee-asm-ingress. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-asm-istiod. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-connect-agent. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-fluent-bit. This addresses the following vulnerabilities:
|
| N/A | Security fixes for apigee-hybrid-cassandra-client. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-mart-server. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-mint-task-scheduler. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-open-telemetry-collector. This addresses the following vulnerability: |
| N/A | Security fixes for apigee-operators. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-prom-prometheus. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-prometheus-adapter. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-redis. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-runtime. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-synchronizer. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-watcher. This addresses the following vulnerabilities: |
September 14, 2026
Apigee hybridhybrid v1.17.0
On September 14, 2026 we released an updated version of the Apigee hybrid software, 1.17.0.
- For information on upgrading, see Upgrading Apigee hybrid to version v1.17.
- For information on new installations, see The big picture.
Model Context Protocol (MCP) support
Apigee hybrid now supports Model Context Protocol (MCP), an open protocol that lets agentic AI applications use your APIs as tools through managed MCP endpoints. Apigee hybrid routes, authorizes, and secures these MCP tool calls the same way it manages your other APIs, so you don't need to run or maintain your own MCP servers.
MCP support is an optional feature that is not enabled by default. You must explicitly enable it in your Apigee hybrid configuration.
For more information, see Model Context Protocol (MCP) overview, Enable MCP for Apigee hybrid, and the MCP quickstart.
Root CA certificate rotation
Apigee hybrid v1.17.0 lets you rotate the root certificate authority (CA) certificate that anchors trust for TLS communication between your runtime components. You can now replace the root CA before it expires, without downtime.
For more information, see Rotate the root CA.
TLS 1.3 support
Apigee hybrid v1.17.0 adds support for TLS 1.3, a newer version of the Transport Layer Security (TLS) protocol that offers faster connection handshakes and stronger security than earlier TLS versions.
For information about configuring TLS on the ingress gateway, see Configuring TLS and mTLS on the Apigee ingress gateway.
Forward proxy support for AI policies
Apigee hybrid v1.17.0 adds forward proxy support for AI policies, such as the Model Armor and semantic caching policies. Outbound calls from these policies can now be routed through an HTTP forward proxy.
For more information, see Configure a forward proxy, Get started with the Model Armor policies, and Get started with semantic caching policies.
Semantic cache Private Service Connect (PSC) endpoint support
Apigee hybrid v1.17.0 adds Private Service Connect (PSC) endpoint support for semantic caching. The semantic caching policies can now reach their backing services over a Private Service Connect endpoint, which keeps that traffic on your private network.
For more information, see Configure semantic caching over Private Service Connect.
Semantic cache distance measure support
Apigee hybrid v1.17.0 adds support for non-default Vertex AI Vector Search distance measures in the SemanticCacheLookup policy. A new optional <DistanceMeasureType> element accepts DOT_PRODUCT_DISTANCE (the default, and the existing behavior), COSINE_DISTANCE, SQUARED_L2_DISTANCE, and L1_DISTANCE. The policy compares <Threshold> in the direction the declared measure implies, so declaring a non-default measure requires re-tuning the threshold in the same edit.
For more information, see SemanticCacheLookup policy.
Reduced service account permissions
Apigee hybrid v1.17.0 reduces the Google Cloud IAM permissions that Apigee service accounts require. Service accounts that use Cloud Storage now require only the storage.objects.get and storage.objects.create permissions rather than the broader Storage Admin (roles/storage.admin) role. The Cassandra components also no longer run with the privileged: true security context.
For more information about service accounts, see Create service accounts.
Various security and CVE fixes are included in this release.
September 10, 2026
Apigee XAddendum to Apigee release notes dated August 27, 2026 (1-18-0-apigee-4).
| Bug ID | Description |
|---|---|
| 502540992 | Fixed an issue where the SemanticCacheLookup policy was incompatible with Vertex AI Vector Search Private Service Connect (PSC) endpoints. |
September 09, 2026
Apigee XSemanticCacheLookup policy supports non-default Vector Search distance measures
Available in Apigee 1-18-0-apigee-4 and later. A new optional
<DistanceMeasureType> element accepts DOT_PRODUCT_DISTANCE (the
default, and the existing behavior), COSINE_DISTANCE,
SQUARED_L2_DISTANCE and L1_DISTANCE. The policy now compares
<Threshold> in the direction the declared measure implies, so declaring a
non-default measure requires re-tuning the threshold in the same edit. The 0-to-1 restriction on
<Threshold> is also removed.
September 02, 2026
Apigee Edge for Private CloudApigee Edge for Private Cloud release notes are now published on Google Cloud documentation.
Release notes and patch announcements for Apigee Edge for Private Cloud are published on the Apigee Edge for Private Cloud release notes page from September 2026 onward. You can subscribe to that page with a feed reader to be notified when a new release or patch is published.
Release notes published before September 2026 remain available in the Apigee Edge release notes archive.
Apigee Edge for Public Cloud release notes are now published on Google Cloud documentation.
Release notes for Apigee Edge for Public Cloud, including its Edge UI, SSO, Message Processor, and integrated portal components, are published on the Apigee Edge for Public Cloud release notes page from September 2026 onward. You can subscribe to that page with a feed reader to be notified when a new release is published.
Release notes published before September 2026 remain available in the Apigee Edge release notes archive.
September 01, 2026
Apigee UIOn September 1, 2026, we released an updated version of the Apigee UI.
| Bug ID | Description |
|---|---|
| 547582067 |
Revisions can now be imported for API proxies and shared flows in a space Importing a revision in the Apigee UI now works for an API proxy or shared flow that is associated with a space. Previously, the Apigee UI did not include the space when it uploaded the revision bundle, so the import request was rejected and the new revision was not created. This affected both API proxies and shared flows. The earlier workaround of removing the API proxy or shared flow from its space, importing the revision, and then adding it back to the space is no longer needed. |
August 27, 2026
Apigee XOn August 27th, 2026, we released an updated version of Apigee (1-18-0-apigee-4).
| Bug ID | Description |
|---|---|
| 507878328 | Upgraded the Apigee runtime to run on JDK 17, while maintaining backward compatibility with JDK 11. |
| 530965355 | Added an opt-in Message Processor connection-failure back-off (CWC property HTTPClient.backoff.enabled, defaults to false) that prevents the Message Processor from consuming excessive CPU when a target is completely unavailable. |
| 532793298 | Fixed an API product bug where combining a payloadOperationGroup with a REST or llmOperationGroup rejected REST/LLM traffic with a 401. |
| 534420582 | The JSONThreatProtection policy adds a new optional child element <RejectDuplicateKeys> that rejects request bodies containing duplicate JSON keys within the same object. Defaults to false to preserve existing behavior. |
| N/A | Updates to infrastructure and libraries. |
This list is incomplete; see entries for September 9, 2026 and September 10, 2026.
| Bug ID | Description |
|---|---|
| 544570126 | Security fix for Apigee. Fixed a security issue in the PythonScript policy. |
| N/A | Security fix for Apigee infrastructure. |
August 26, 2026
Apigee hybridv1.14.8
On August 26, 2026 we released an updated version of the Apigee hybrid software, v1.14.8.
- For information on upgrading, see Upgrading Apigee hybrid to version v1.14.8.
- For information on new installations, see The big picture.
| Bug ID | Description |
|---|---|
| N/A | Security fixes for apigee-asm-ingress. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-asm-istiod. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-connect-agent. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-fluent-bit. This addresses the following vulnerabilities:
|
| N/A | Security fixes for apigee-hybrid-cassandra. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-hybrid-cassandra-client. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-mart-server. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-mint-task-scheduler. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-operators. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-prom-prometheus. This addresses the following vulnerability: |
| N/A | Security fixes for apigee-prometheus-adapter. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-redis. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-runtime. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-synchronizer. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-watcher. This addresses the following vulnerabilities: |
August 22, 2026
Apigee UI| Bug ID | Description |
|---|---|
| 543626585 |
ServiceCallout policy can now be added in the Apigee UI Adding a ServiceCallout policy in the Apigee UI no longer leaves the Create or Add button disabled. Previously, selecting Service Callout in the Create policy or Add policy panel could display only the Name and Display name fields and omit the required HTTP target field. With the required field missing, the form never became valid, so the Create or Add button stayed disabled no matter what you entered. This affected both API proxies and shared flows. The earlier workaround of creating a placeholder policy and replacing its XML in the code editor is no longer needed. For more information, see ServiceCallout policy and Attach and configure policies in the UI. |
| Bug ID | Description |
|---|---|
| 540008387 |
Developer custom attributes now save reliably in the Apigee UI Saving changes to a developer in the Apigee UI in Cloud console no longer intermittently fails to persist that developer's custom attributes. Previously, the UI reported the save as successful, but the previous attribute values reappeared when the page was reloaded. Developer updates made with the Apigee API were not affected. |
August 13, 2026
Apigee XOn August 13th, 2026, we began maintenance updates of Apigee instances configured for maintenance windows.
If you set a preferred window for maintenance for your instance, and your instance version is below 1-18-0-apigee-2, your instance will be updated to 1-18-0-apigee-2 within the next seven to 21 days. A notification containing the expected date of upgrade will be sent within the next two business days.
For more information on participating in scheduled maintenance windows, see Maintenance overview and Manage Apigee instance maintenance windows.
On August 13th, 2026, we released an updated version of Apigee (1-18-0-apigee-3).
| Bug ID | Description |
|---|---|
| 532147587 | To fix forward proxy support. |
| 537657987 | Fixed a bug where watcher failed to reconcile all routes if an environment was not found in the control plane. |
| 543022076 | Google Cloud BOM upgrade (protobuf 4.x, gRPC 1.81, Guava 33.5). One user-visible change: a malformed inbound gRPC request frame is now reported to the client as grpc-status INTERNAL(13) and recorded in analytics as x-apigee.grpc.status=13, where it was previously an Apigee ServiceUnavailable fault seen as UNAVAILABLE(14) with no x-apigee.grpc.status recorded. Otherwise no user facing impact, but any prod issue related to gcp, protobuf or gRPC may relate to this. |
| 542242046 | Fixed LLMTokenQuota metering the request against an arbitrary quota bucket when the API Product declared multiple models and the request carried no model. |
| 531731614 | Apigee analytics fields ai_llm_response_token_count, ai_llm_prompt_token_count, ai_llm_model_name, and ai_llm_model_provider are available in the Custom Report when LLMTokenQuota and PromptTokenLimit policies are used in Apigee proxies. |
| 492044413 | LLMTokenQuota resolves the model from the API Product LLM Operation when LLMModelSource is omitted and the request body has no model field. |
| 67169710 | Adds an opt-in <DynamicClientIdSupported> boolean XML element to the OAuthV2 policy. When true, AbstractOAuthStepExecution.extractClientDetails() preserves any non-empty ClientID/ClientSecret already present on the OAuthClientContext. |
| 531731614 | Apigee auto identifies the providers and publishes them to analytics. |
| 537396574 | Added feature to rotate the apigee-ca certificate. |
| 540861752 | Aligned the ApigeeDeployment conversion hub with its v1alpha3 storage version. Internal change; no effect on existing ApigeeDeployment resources. |
| 540861752 | Aligned the ApigeeDeployment custom resource's conversion hub with its v1alpha3 storage version. This internal change does not affect existing ApigeeDeployment resources. |
| N/A | Updates to infrastructure and libraries. |
| Bug ID | Description |
|---|---|
| 535928300 | Security fix for Apigee. Fixed a security issue in JWT refresh token revocation handling. |
| 539515020 | Security fix for Apigee. Fixed a security issue in the MessageValidation policy. |
| 535928530 | Security fix for Apigee. Fixed a security issue in the OAuthV2 policy. |
| 535683286 | Security fix for Apigee. Fixed a security issue in HTTP target interim-response handling. |
| N/A | Security fix for Apigee infrastructure. |
August 12, 2026
Apigee API hubConfigure and deploy MCP servers with gcloud CLI
You can use the gcloud apihub locations configure-and-deploy-server command to configure and deploy API hub Model Context Protocol (MCP) servers to an attached Apigee runtime.
Define MCP tools inline or by referencing a YAML or JSON specification file to expose your API hub operations for agent integrations.
For more information, see gcloud CLI for API hub.
August 11, 2026
Apigee hybridv1.16.9
On August 11, 2026 we released an updated version of the Apigee hybrid software, v1.16.9.
- For information on upgrading, see Upgrading Apigee hybrid to version v1.16.9.
- For information on new installations, see The big picture.
Fixed in this release
| Bug ID | Description |
|---|---|
| 514973778 | Fixed an issue where the SanitizeUserPrompt and SanitizeModelResponse policies failed to tolerate unknown fields while parsing responses from the Model Armor Service. |
| 543171828 | Fixed an issue where the apigee-logger DaemonSet failed to schedule on cluster nodes without custom node labels due to a default logger.nodeSelector in the Helm chart. |
Various security and CVE fixes are included in this release.
July 31, 2026
Apigee hybridv1.15.7
On July 31, 2026 we released an updated version of the Apigee hybrid software, v1.15.7.
- For information on upgrading, see Upgrading Apigee hybrid to version v1.15.7.
- For information on new installations, see The big picture.
Runtime rollout strategy configuration
In this release, you can configure the rollout strategy used when updating runtime (message processor) ReplicaSets by setting the runtime.release.strategy property (with options rolling, scale-down-first, or none) or per-environment with envs[].components.runtime.release.strategy in your overrides configuration file. The property defaults to rolling.
Various security and CVE fixes are included in this release.
July 27, 2026
Apigee XOn July 27th, 2026, we released an updated version of Apigee (1-18-0-apigee-2).
SanitizeUserPrompt and SanitizeModelResponse policies now support function calling
The SanitizeUserPrompt and SanitizeModelResponse policies now handle LLM function calling (tool use) flows. Two new optional XML elements extract function calling content for Model Armor sanitization:
<FunctionResponseSource>in SanitizeUserPrompt: extracts function/tool response data from user turns. Used as a fallback when<UserPromptSource>returns empty on function calling turns.<FunctionCallSource>in SanitizeModelResponse: extracts function call arguments from model responses. Used as a fallback when<LLMResponseSource>returns empty.
Default templates target the Gemini format and require no additional configuration. For OpenAI and Anthropic formats, configure custom JSONPath templates. For more information, see FunctionResponseSource and FunctionCallSource.
| Bug ID | Description |
|---|---|
| 534852923 | Security fix for Apigee. Fixed a security issue in the Java Callout policy. |
| N/A | Security fix for Apigee infrastructure. |
| Bug ID | Description |
|---|---|