v5.5.0-alpha1

Refactor streaming functionality to become a standard middleware

Add RSA-PSS Support

v5.5.0-rc1

Add support for RSAPSS signed JWTs

Tyk Gateway 5.3.2 and Tyk Dashboard 5.3.2

Tyk Gateway 5.3.2

Fixed

• Enhanced error handling in webhook event template rendering to ensure proper logging and skipping of the event when errors occur, preventing invalid data from being sent.
• tyk.api.apikey and tyk.api.oauthid attributes were exposing API keys when OTEL was enabled. Now, the value of this attribute is the hashed key instead.
• Addressed a potential issue when working with Tyk OAS APIs where request context variables are automatically made available to relevant Tyk and custom middleware. We have introduced a control in the Tyk OAS API definition to disable this access if required.
• Addressed an issue where an API with a custom domain might not be invoked if another API with the same listen path but no custom domain was also deployed on the Gateway. Now APIs with custom domain names are loaded first, so requests will be checked against these first before falling back to APIs without custom domains.
• Fixed an issue with nested field mapping in UDG when used with GraphQL (GQL) operations for a field’s data source. Previously, querying only the mentioned field resulted in an error, but querying alongside another ’normal’ field from the same level worked without issue.
• Addressed an issue in service discovery where an IP:port returned by Consul wasn't parsed correctly on the Gateway side, leading to errors when proxying requests to the service. The issue primarily occurred with IP:port responses, while valid domain names were unaffected.

Tyk Dashboard 5.3.2

Fixed

• Resolved oppressive language in Tyk's Dashboard UI, ensuring inclusive and clear wording.
• In this version we have submitted a modification to our default OPA rules as we identified a scenario in which admins different from the initial bootstrapped one were allowed to modify the passwords of other admins hence enabling “rogue admin” behaviour. Tyk Dashboard clients using OPA rules are advised to apply the new change to their existing OPA ruleset to benefit from this piece of work. For any help/clarification please get in touch with your assigned Tyk representative.
• There was an issue with GQL schema editor for Data Graphs, where users were not able to use the "Import Schema" button. The issue is now fixed and it is possible to import files containing GQL schemas into the Dashboard.
• Addressed a potential issue when working with Tyk OAS APIs where request context variables are automatically made available to relevant Tyk and custom middleware. We have introduced a control in the Tyk OAS API definition to disable this access if required.
• Fixed issue in api/usage endpoint where Dashboard+Postgres returned unfiltered results with one valid tag and required duplicating the same parameter as a workaround for multiple tags, now correctly filtering results as expected.
• Fixed an issue where API Templates were not correctly assigned to Tyk Organisations allowing the potential for accidental sharing of secret data between Organisations through use of the incorrect template.

v5.4.0-alpha5

Add portal support

Tyk Gateway 4.0.16 and Tyk Dashboard 4.0.16

Tyk Gateway 4.0.16

Fixed

• Fixed a bug where gateway logs were not honouring enable_key_logging setting
• Fixed a bug where enforced timeout values wouldn't be correct on a per-request basis. As we enforced timeouts only on the transport level, and created the transport only once within max_conn_time, the timeout in effect was not deterministic.
• Fixed a minor issue with Go Plugin virtual endpoints where a runtime log error was produced from a request, even if the response was successful. Thanks to @uddmorningsun for spotting this and proposing a fix.
• Fixed a bug where, when using MongoDB, Tyk could incorrectly grant access to an API using a key after that API had been deleted from a policy.
• Fixed a bug where Tyk could return the wrong error code when a websocket upstream responds with error
• Fixed a bug where keys linked to multiple policies become unusable if one of the policies is removed.
• Remove the extra chunked transfer encoding that was added to rawResponse analytics
• Updated the default Hybrid Pump RPC pool size from 20 to 5 connections in order to reduce default CPU and memory footprint
• Fixed a bug where the Gateway did not correctly close idle upstream connections (sockets) when configured to generate a new connection after a configurable period of time (using the max_conn_time configuration option).
• Fixed a bug where the URL Rewrite middleware did not correctly handle escaped characters in the URL.
• Fixed a potential performance issue related to high rates of Gateway reloads (when the Gateway is updated due to a change in APIs and/or policies)
• Fixed a memory leak that occurred when setting the strict routes option to change the routing to avoid nearest-neighbour requests on overlapping routes (TYK_GW_HTTPSERVEROPTIONS_ENABLESTRICTROUTES)
• Fixed one Critical and six High CVEs reported in the Plugin Compiler.
• Fixed automated token trimming in Redis, ensuring efficient management of OAuth tokens by implementing a new hourly job within the Gateway and providing a manual trigger endpoint.
• Fixed a bug that was introduced in the fix applied to the URL Rewrite middleware.

Tyk Dashboard 4.0.16

Fixed

• Fixed a bug where, if you created a Key which provided access to an inactive or draft API, you would be unable to subsequently modify that Key (via the Dashboard or directly via the Tyk Gateway API)
• Fixed a bug where Dashboard would take too long loading Policies to the Gateway
• Fixed a bug where the Dashboard could timeout while loading policies at startup. Added connection_timeout configuration option (defaults to 30 seconds)
• Adjusted the description for the Policy states, so that it reflects the actual behaviour of the policy, when attached to a key.
• Optimised the loading and re-loading of APIs and Policies for complex scenarios
• Fixed a bug where searching for a User in the Tyk Dashboard didn't match partial user names.
• Moved all HTML inline scripts to their own script files, to accommodate the Content security policies that have been enabled, to increase security.

Tyk Gateway 5.0.12 and Tyk Dashboard 5.0.12

Tyk Gateway 5.0.12

Fixed

• Fixed a bug where Tyk failed to properly reject custom plugin bundles with signature verification failures, allowing APIs to load without necessary plugins, potentially exposing upstream services. With the fix, if the plugin bundle fails to load (for example, due to failed signature verification) the API will not be loaded and an error will be logged in the Gateway.
• Fixed a panic scenario that occurred when a custom JavaScript plugin that requests access to the session metadata (require_session:true) is assigned to the same endpoint as the Ignore Authentication middleware. While the custom plugin expects access to a valid session, the configuration flag doesn't guarantee its presence, only that it's passed if available. As such, the custom plugin should be coded to verify that the session metadata is present before attempting to use it.
• Fixed a bug where the Gateway could crash when using custom Python plugins that access the Redis storage. The Tyk Python API methods store_data and get_data could fail due to connection issues with the Redis. With this fix, the Redis connection will be created if required, avoiding the crash.
• Fixed a bug where in some instances users were noticing gateway panics when using the "Persist GQL" middleware without arguments defined. This issue has been fixed and the gateway will not throw panics in these cases anymore.
• Fixed a bug where in some cases detailed_tracing was set to false and the client was sending a malformed request to a GraphQL API, the traces were missing GraphQL attributes (operation name, type and document). This has been corrected and debugging GraphQL with OTel will be easier for users.
• Fixed a bug where GQL Open Telemetry semantic conventions attribute names were missing graphql prefix and therefore were not in line with the community standard. This has been fixed and all attributes have the correct prefix.
• Fixed two bugs in the handling of usage quotas by the URL rewrite middleware when it was configured to rewrite to itself (e.g. to tyk://self). Quota limits were not observed and the quota related response headers always contained 0.
• Fixed a bug where in distributed deployments where the MDCB data plane gateway counter was inaccurately incremented when a Gateway was stopped and restarted.
• Addressed a bug where clearing the API cache from the Tyk Dashboard failed to invalidate the cache in distributed data plane (MDCB) gateways.
• Fixed a bug introduced in 5.3.0 which prevented custom Go plugins compiled in RHEL8 environments from loading into Tyk Gateway. An automation issue had caused the build environments for the Gateway and Plugin Compiler to use different base images. This fix restores the plugin functionality on RHEL8 environments, by fixing the plugin compiler base image to match the gateway build environment: Go 1.21 and Debian Bullseye.
• Removed several unused packages from the plugin compiler image. The packages include: docker, buildkit, ruc, sqlite, curl, wget, and other build tooling. The removal was done in order to address invalid CVE reporting, none of the removed dependencies are used to provide plugin compiler functionality.

Tyk Dashboard 5.0.12

Fixed

• Improved the behaviour of the Dashboard when searching for users to avoid transmitting sensitive information (user email addresses) in the request query parameters. Deprecated the GET method for the /api/users/search endpoint in favour of a POST method with the same logic but with parameters supplied in the request body.
• As Tyk Dashboard and Tyk Classic Portal do not accept cross origin requests we have removed the Access-Control-Allow-Credentials header from Dashboard API responses to prevent any potential misuse of the header by attackers. This allows simplification of the web application’s security configuration.
• Implemented a randomised delay to obscure login response times, mitigating brute force attacks that rely on response time analysis.
• Fixed a bug where a user was still able to log into an Organisation on the Tyk Dashboard after that Organisation had been deleted. Now, when an Organisation is deleted, it will not be offered as an option when logging in.
• Fixed an issue where access keys could accidentally also be printed to the Dashboard’s stdout when a call was made to /api/keys to retrieve the keys. This has now been suppressed.
• The Endpoint Designer did not correctly display a GraphQL policy’s allow or block list if a wildcard character () was used in the list’s definition. This has been fixed and now, if the wildcard () is present in the allow/block list definition, the UI correctly displays the list of allowed/blocked fields.
• Fixed an issue that was preventing the OPA editor from being visible using the keyboard shortcut when using Microsoft Windows.
• Fixed an issue where common keyboard shortcuts (Cmd + X, A, C, V) were not working correctly when configuring the URL field for a UDG data source.
• Fixed an issue in the Tyk OAS API Designer where there was no input validation of the OAuth Introspection URL. The Gateway reported an HTTP 400 error when attempting to save an API with an illegal value, however the API Designer did not guide the user to the source of the error. Now there is automatic validation of the text entered in the Introspection URL field.
• Fixed an issue with the text editor in the Tyk OAS API Designer where the cursor was misaligned with where characters would be entered. We have replaced the text editor module throughout the Tyk Dashboard to use a more modern, supported library.
• The ‘Top 5 Errors by Graph’ bar chart in the Activity by Graph dashboard experienced display issues with long graph names and sometimes showed empty bars. This has been resolved, and the chart now displays accurately.
• Fixed a bug where some Tyk Dashboard analytics screens stopped working when the analytics aggregates collection grew too large.
• In Tyk 5.0.7/5.2.2 we fixed an issue in the policy-API link deletion code. This introduced an unintended side-effect for users of DocumentDB such that they were unable to delete APIs from the persistent storage. We identified that this was due to the use of the $expr operator in the solution - and discovered that this is supported by MongoDB but not by DocumentDB. We have now reimplemented the fix and removed the limitation introduced for DocumentDB users.
• Fixed an issue when using MongoDB and Tyk Security Policies where Tyk could incorrectly grant access to an API after that API had been deleted from the associated policy. This introduced an unintended side-effect for users of DocumentDB such that they were unable to delete APIs from the persistent storage. We identified that this was due to the use of the $expr operator in the solution - and discovered that this is supported by MongoDB but not by DocumentDB. We have now reimplemented the fix and removed the limitation introduced for DocumentDB users.
• Addressed a bug where clearing the API cache from the Tyk Dashboard failed to invalidate the cache in distributed data plane gateways.

Tyk Gateway 5.3.1 and Tyk Dashboard 5.3.1

Tyk Gateway 5.3.1

Fixed

• Fixed a bug where Tyk failed to properly reject custom plugin bundles with signature verification failures, allowing APIs to load without necessary plugins, potentially exposing upstream services. With the fix, if the plugin bundle fails to load (for example, due to failed signature verification) the API will not be loaded and an error will be logged in the Gateway.
• Fixed a panic scenario that occurred when a custom JavaScript plugin that requests access to the session metadata (require_session:true) is assigned to the same endpoint as the Ignore Authentication middleware. While the custom plugin expects access to a valid session, the configuration flag doesn't guarantee its presence, only that it's passed if available. As such, the custom plugin should be coded to verify that the session metadata is present before attempting to use it.
• Fixed a bug where the Gateway could crash when using custom Python plugins that access the Redis storage. The Tyk Python API methods store_data and get_data could fail due to connection issues with the Redis. With this fix, the Redis connection will be created if required, avoiding the crash.
• Fixed a bug where in some instances users were noticing gateway panics when using the "Persist GQL" middleware without arguments defined. This issue has been fixed and the gateway will not throw panics in these cases anymore.
• Fixed a bug where in some cases detailed_tracing was set to false and the client was sending a malformed request to a GraphQL API, the traces were missing GraphQL attributes (operation name, type and document). This has been corrected and debugging GraphQL with OTel will be easier for users.
• Fixed a bug where GQL Open Telemetry semantic conventions attribute names were missing graphql prefix and therefore were not in line with the community standard. This has been fixed and all attributes have the correct prefix.
• Fixed two bugs in the handling of usage quotas by the URL rewrite middleware when it was configured to rewrite to itself (e.g. to tyk://self). Quota limits were not observed and the quota related response headers always contained 0.
• Fixed a bug where in distributed deployments where the MDCB data plane gateway counter was inaccurately incremented when a Gateway was stopped and restarted.
• Addressed a bug where clearing the API cache from the Tyk Dashboard failed to invalidate the cache in distributed data plane (MDCB) gateways.
• Fixed a bug introduced in 5.3.0 which prevented custom Go plugins compiled in RHEL8 environments from loading into Tyk Gateway. An automation issue had caused the build environments for the Gateway and Plugin Compiler to use different base images. This fix restores the plugin functionality on RHEL8 environments, by fixing the plugin compiler base image to match the gateway build environment: Go 1.21 and Debian Bullseye.
• Removed several unused packages from the plugin compiler image. The packages include: docker, buildkit, ruc, sqlite, curl, wget, and other build tooling. The removal was done in order to address invalid CVE reporting, none of the removed dependencies are used to provide plugin compiler functionality.

Tyk Dashboard 5.3.1

Fixed

• Improved the behaviour of the Dashboard when searching for users to avoid transmitting sensitive information (user email addresses) in the request query parameters. Deprecated the GET method for the /api/users/search endpoint in favour of a POST method with the same logic but with parameters supplied in the request body.
• As Tyk Dashboard and Tyk Classic Portal do not accept cross origin requests we have removed the Access-Control-Allow-Credentials header from Dashboard API responses to prevent any potential misuse of the header by attackers. This allows simplification of the web application’s security configuration.
• Implemented a randomised delay to obscure login response times, mitigating brute force attacks that rely on response time analysis.
• Fixed a bug where a user was still able to log into an Organisation on the Tyk Dashboard after that Organisation had been deleted. Now, when an Organisation is deleted, it will not be offered as an option when logging in.
• Fixed an issue where access keys could accidentally also be printed to the Dashboard’s stdout when a call was made to /api/keys to retrieve the keys. This has now been suppressed.
• The Endpoint Designer did not correctly display a GraphQL policy’s allow or block list if a wildcard character () was used in the list’s definition. This has been fixed and now, if the wildcard () is present in the allow/block list definition, the UI correctly displays the list of allowed/blocked fields.
• Fixed an issue that was preventing the OPA editor from being visible using the keyboard shortcut when using Microsoft Windows.
• Fixed an issue where common keyboard shortcuts (Cmd + X, A, C, V) were not working correctly when configuring the URL field for a UDG data source.
• Fixed an issue in the Tyk OAS API Designer where there was no input validation of the OAuth Introspection URL. The Gateway reported an HTTP 400 error when attempting to save an API with an illegal value, however the API Designer did not guide the user to the source of the error. Now there is automatic validation of the text entered in the Introspection URL field.
• Fixed an issue with the text editor in the Tyk OAS API Designer where the cursor was misaligned with where characters would be entered. We have replaced the text editor module throughout the Tyk Dashboard to use a more modern, supported library.
• The ‘Top 5 Errors by Graph’ bar chart in the Activity by Graph dashboard experienced display issues with long graph names and sometimes showed empty bars. This has been resolved, and the chart now displays accurately.
• Fixed a bug where some Tyk Dashboard analytics screens stopped working when the analytics aggregates collection grew too large.
• In Tyk 5.07/5.22 (delete as appropriate - include link to change log) we fixed an issue in the policy-API link deletion code. This introduced an unintended side-effect for users of DocumentDB such that they were unable to delete APIs from the persistent storage. We identified that this was due to the use of the $expr operator in the solution - and discovered that this is supported by MongoDB but not by DocumentDB. We have now reimplemented the fix and removed the limitation introduced for DocumentDB users.
• In Tyk 5.2.2 we fixed an issue when using MongoDB and Tyk Security Policies where Tyk could incorrectly grant access to an API after that API had been deleted from the associated policy. This introduced an unintended side-effect for users of DocumentDB such that they were unable to delete APIs from the persistent storage. We identified that this was due to the use of the $expr operator in the solution - and discovered that this is supported by MongoDB but not by DocumentDB. We have now reimplemented the fix and removed the limitation introduced for DocumentDB users.
• Addressed a bug where clearing the API cache from the Tyk Dashboard failed to invalidate the cache in distributed data plane gateways.

Tyk Gateway 5.0.11 and Tyk Dashboard 5.0.11

Tyk Gateway 5.0.11

Caveat

• This version contains an unintended side-effect for users of DocumentDB introduced in v5.0.7 such that APIs are blocked from deletion APIs within the persistent storage. This has been fixed in v5.0.12 and v5.3.1

Fixed

• Addressed a memory leak issue in Tyk Gateway linked to a logger mutex change introduced in v5.2.4. Reverting these changes has improved connection management and enhanced system performance.
• Fixed an issue where reloading a bundle containing JS plugins could cause the Gateway to panic.
• An issue was identified where the encoding from the GQL upstream cache was causing readability problems in the response body. Specifically, the upstream GQL cache was utilizing brotli compression and not respecting the Accept-Encoding header. Consequently, larger response bodies became increasingly unreadable for the GQL engine due to compression, leading to usability issues for users accessing affected content. The issue has now been fixed by adding the brotli encoder to the GQL engine.
• We have optimised the allocation behaviour of our sliding window log rate limiter implementation (Redis Rate Limiter). Previously the complete request log would be retrieved from Redis. With this enhancement only the count of the requests in the window is retrieved, optimising the interaction with Redis and decreasing the Gateway memory usage.
• Fixed a performance issue when certain claims are present in the JWT. Tyk uses specific claims (clientId, cid and client_id) to identify certain external IDPs and, if the provided claim matches one of these "reserved" values then Tyk will attempt to contact that IDP. We have introduced a new flag that can be configured in the API Definition to skip this mapping: idp_client_id_mapping_disabled (Tyk Classic API Definition) / idpClientIdMappingDisabled (Tyk OAS API Definition).
• We fixed a bug in the Tyk OAS Validate Request middleware where we were not correctly validating date-time format schema, which could lead to invalid date-time values reaching the upstream services.
• In this release, we fixed automated token trimming in Redis, ensuring efficient management of OAuth tokens by implementing a new hourly job within the Gateway and providing a manual trigger endpoint.
• Update Tyk OAS API definition json schema to validate the domain name in upstream certificates and public key pinning

Tyk Dashboard 5.0.11

Fixed

• Removed strict validation over description field in mock response when using Tyk OAS, for the response status codes and headers
• Moved all HTML inline scripts to their own script files, to accommodate the Content security policies that have been enabled, to increase security.
• Fixed an issue where applying security policies to large numbers of APIs took a long time. We’ve implemented bulk processing in the validation step at the api/portal/policies/POLICY_ID endpoint, resulting in an 80% reduction in the time taken to apply a policy to 2000 APIs.
• Improved the documentation to explain the usage of PUT /admin/organisations/{ORG_ID}

Tyk Gateway 5.3.0 and Tyk Dashboard 5.3.0

Tyk Gateway 5.3.0

https://tyk.io/docs/product-stack/tyk-gateway/release-notes/version-5.3/

Tyk Dashboard 5.3.0

https://tyk.io/docs/product-stack/tyk-dashboard/release-notes/version-5.3/

Tyk Gateway v5.2.6 and Tyk Dashboard v5.2.6

Tyk Gateway v5.2.6

Caveat

• This version contains an unintended side-effect for users of DocumentDB introduced in v5.2.2 such that APIs are blocked from deletion APIs within the persistent storage. This has been fixed in v5.0.12 and v5.3.1

Fixed

• Fixed a memory leak happening on high concurrency; improved connection management and enhanced system performance.

Tyk Dashboard v5.2.6

No changes