What's Changed
- [releng master] gromit: sync templates by @probelabs[bot] in #8585
- TT-17795: bump golang.org/x/text and google.golang.org/grpc for CVE fixes by @edsonmichaque in #8582
- TT-17795: update version of Tyk/opentelemetry with fixed CVEs by @vladzabolotnyi in #8614
- TT-17641: [releng master] Add next-generation plugin compiler by @buger in #8379
- TT-17509: Update s1-cns-scans.yml workflow to use policy_id and production tag by @probelabs[bot] in #8546
- TT-17641: [releng master] gromit: sync templates by @probelabs[bot] in #8603
- [TT-17921] Improve header handling for GraphQL-based APIs by @pvormste in #8602
- TT-17795: Update path for avro's replace directive by @vladzabolotnyi in #8626
- [TT-431] Authorization token should not be recorded in detailed logs by @MaciekMis in #8500
- chore: update swagger info.version to 5.15 by @probelabs[bot] in #8646
- Fix docs generation issues from PR 2802 by @probelabs[bot] in #8649
- [TT-1860] Preserve rewritten URL path when stripping listen path by @andrei-tyk in #8515
- [TT-18136] Tolerate stale MCP selectors on catalogue reads by @andrei-tyk in #8653
- TT-17927: escape config literal that breaks generated docs by @olamilekan000 in #8660
- [TT-14684] The listen path recorded in analytics changes when an API response comes from cache by @shults in #8543
- [TT-17926] Bump pump dependency by @ilijabojanovic in #8666
- docs: escape MDX-breaking spans in doc comments synced to tyk-docs by @sharadregoti in #8669
- feat: add GetOASConfigData helper function by @dawidgoracl in #8665
- [TT-16132] Granular access control conditions on query parameters, headers and body by @mativm02 in #8652
- [DX-2218] docs: add /ready endpoint to swagger.yml by @probelabs[bot] in #7906
- [releng master] gromit: sync templates by @probelabs[bot] in #8690
- [TT-17765] Prevent Dashboard recovery reload deadlock by @andrei-tyk in #8661
- [TT-14404] regression-gateway-always-generates-detailed-records-for-graphql-udg-requests by @dawidgoracl in #8671
- [TT-14684] The listen path recorded in analytics changes when an API response comes from cache by @shults in #8672
- TT-18373: fix point force-merge at github-actions@production by @olamilekan000 in #8709
- TT-16030: grant id-token for the jira-linter ECR pull by @kofoworola in #8711
- [TT-6555] [Zerocopter] Local File Read via Webhook endpoint by @shults in #8610
- docs: surface MCP Gateway and AI Studio in the README by @sharadregoti in #8714
- [TT-18283] upgrade kin-openapi by @pvormste in #8719
- [TT-17873] proxy_default_timeout overrides enforced timeout middleware but should only be applied when enforced timeout is unset by @shults in #8640
- docs: fix README install routing and stale links by @sharadregoti in #8733
- docs: replace archived repo links in README installation list by @sharadregoti in #8734
- [TT-14951] Enum type arguments in UDG queries are not included in the REST API request by @shults in #8663
- [TT-18285] Bump dependencies by @buraksezer in #8736
- [TT-18106] Security: GraphQL RBAC Authorization Error Information Disclosure cannot be overridden by @shults in #8722
- [TT-6555] [Zerocopter] Local File Read via Webhook endpoint - add feature flag by @shults in #8725
- [TT-18285] Bump otlptrace exporters to v1.46.0 to fix CVE-2026-81870 by @buraksezer in #8745
- [TT-16298] unable-to-perform-get-update-delete-operations-in-api-which-is-created-with-unallowed-characters-in-id by @dawidgoracl in #8707
- [TT-18106] Fix granular access error format for GraphQL engine v3 by @dawidgoracl in #8749
- [TT-6554] [Zerocopter] local file read via endpoint body transform template path by @dawidgoracl in #8624
- TT-18236 Gateway register information by @tbuchaillot in #8712
- [TT-18486] Access conditions on named JSON body fields by @mativm02 in #8735
- [TT-18006] Consolidate MCP GA Gateway support by @andrei-tyk in #8755
- [TT-17727] Dynamic discovery and round-robin load balancing of gRPC upstream pods by @MFCaballero in #8716
- [TT-18609] Bump golang.org/x/net to v0.60.0 for CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-97032 by @sredxny in #8775
- Merging to release-5.16.0: [TT-1860] Strip listen path can modify rewritten URL [Enable Feature Flag] (#8795) by @probelabs[bot] in #8800
- Merging to release-5.16.0: [TT-16007] get-oas-config-data-deep-copy (#8811) by @probelabs[bot] in #8821
- Merging to release-5.16.0: CVE-528: Bump github.com/andybalholm/brotli to v1.2.7 (#8828) by @probelabs[bot] in #8829
Full Changelog: v5.15.1...v5.16.0