Merge branch 'master' into chore/apply-label-on-failed-cherry-pick

.github/labeler.yml

@@ -90,6 +90,18 @@ plugins/acme:
 - changed-files:
   - any-glob-to-any-file: kong/plugins/acme/**/*
 
+plugins/ai-proxy:
+- changed-files:
+  - any-glob-to-any-file: ['kong/plugins/ai-proxy/**/*', 'kong/llm/**/*']
+
+plugins/ai-prompt-decorator:
+- changed-files:
+  - any-glob-to-any-file: kong/plugins/ai-prompt-decorator/**/*
+
+plugins/ai-prompt-template:
+- changed-files:
+  - any-glob-to-any-file: kong/plugins/ai-prompt-template/**/*
+
 plugins/aws-lambda:
 - changed-files:
   - any-glob-to-any-file: kong/plugins/aws-lambda/**/*

.github/workflows/backport.yml

@@ -14,7 +14,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Create backport pull requests
-        uses: korthout/backport-action@930286d359d53effaf69607223933cbbb02460eb #v2.2.0
+        uses: korthout/backport-action@6e72f987c115430f6abc2fa92a74cdbf3e14b956 # v2.4.1
         with:
           github_token: ${{ secrets.PAT }}
           pull_title: '[backport -> ${target_branch}] ${pull_title}'
@@ -23,6 +23,10 @@ jobs:
           label_pattern: ^backport (release\/[^ ]+)$ # filters for labels starting with "backport " and extracts the branch name
           pull_description: |-
             Automated backport to `${target_branch}`, triggered by a label in #${pull_number}.
+
+            ## Original description
+
+            #{pull_description}
           copy_assignees: true
           copy_milestone: true
           copy_requested_reviewers: true

.github/workflows/build_and_test.yml

@@ -57,6 +57,13 @@ jobs:
         options: --health-cmd pg_isready --health-interval 5s --health-timeout 5s --health-retries 8
 
     steps:
+    - name: Bump max open files
+      run: |
+          sudo echo 'kong soft nofile 65536' | sudo tee -a /etc/security/limits.d/kong-ci.conf
+          sudo echo 'kong hard nofile 65536' | sudo tee -a /etc/security/limits.d/kong-ci.conf
+          sudo echo "$(whoami) soft nofile 65536" | sudo tee -a /etc/security/limits.d/kong-ci.conf
+          sudo echo "$(whoami) hard nofile 65536" | sudo tee -a /etc/security/limits.d/kong-ci.conf
+
     - name: Checkout Kong source code
       uses: actions/checkout@v4
 
@@ -160,6 +167,13 @@ jobs:
           - 9411:9411
 
     steps:
+    - name: Bump max open files
+      run: |
+          sudo echo 'kong soft nofile 65536' | sudo tee -a /etc/security/limits.d/kong-ci.conf
+          sudo echo 'kong hard nofile 65536' | sudo tee -a /etc/security/limits.d/kong-ci.conf
+          sudo echo "$(whoami) soft nofile 65536" | sudo tee -a /etc/security/limits.d/kong-ci.conf
+          sudo echo "$(whoami) hard nofile 65536" | sudo tee -a /etc/security/limits.d/kong-ci.conf
+
     - name: Checkout Kong source code
       uses: actions/checkout@v4
 
@@ -292,6 +306,13 @@ jobs:
           - 15003:9001
 
     steps:
+    - name: Bump max open files
+      run: |
+          sudo echo 'kong soft nofile 65536' | sudo tee -a /etc/security/limits.d/kong-ci.conf
+          sudo echo 'kong hard nofile 65536' | sudo tee -a /etc/security/limits.d/kong-ci.conf
+          sudo echo "$(whoami) soft nofile 65536" | sudo tee -a /etc/security/limits.d/kong-ci.conf
+          sudo echo "$(whoami) hard nofile 65536" | sudo tee -a /etc/security/limits.d/kong-ci.conf
+
     - name: Checkout Kong source code
       uses: actions/checkout@v4
 
@@ -358,6 +379,13 @@ jobs:
     needs: build
 
     steps:
+    - name: Bump max open files
+      run: |
+          sudo echo 'kong soft nofile 65536' | sudo tee -a /etc/security/limits.d/kong-ci.conf
+          sudo echo 'kong hard nofile 65536' | sudo tee -a /etc/security/limits.d/kong-ci.conf
+          sudo echo "$(whoami) soft nofile 65536" | sudo tee -a /etc/security/limits.d/kong-ci.conf
+          sudo echo "$(whoami) hard nofile 65536" | sudo tee -a /etc/security/limits.d/kong-ci.conf
+
     - name: Checkout Kong source code
       uses: actions/checkout@v4
 

.github/workflows/cherry-picks.yml

@@ -35,6 +35,10 @@ jobs:
           trigger_label: 'cherry-pick kong-ee' # trigger based on this label
           pull_description: |-
             Automated cherry-pick to `${target_branch}`, triggered by a label in https://github.com/${owner}/${repo}/pull/${pull_number} :robot:.
+
+            ## Original description
+
+            #{pull_description}
           upstream_repo: 'kong/kong-ee'
           branch_map: |-
             {

.github/workflows/release.yml

@@ -37,9 +37,9 @@ env:
   PRERELEASE_DOCKER_REPOSITORY: kong/kong
   FULL_RELEASE: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.actor == 'dependabot[bot]'}}
 
-  # only for pr
+  # only for PR
   GHA_CACHE: ${{ github.event_name == 'pull_request' }}
-
+  # PRs opened from fork and from dependabot don't have access to repo secrets
   HAS_ACCESS_TO_GITHUB_TOKEN: ${{ github.event_name != 'pull_request' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') }}
 
 jobs:
@@ -581,7 +581,7 @@ jobs:
     name: Release Images - ${{ matrix.label }} - ${{ needs.metadata.outputs.release-desc }}
     needs: [metadata, build-images]
     runs-on: ubuntu-22.04
-    if: github.repository_owner == 'Kong' && fromJSON(needs.metadata.outputs.matrix)['release-images'] != ''
+    if: fromJSON(needs.metadata.outputs.matrix)['release-images'] != ''
 
     strategy:
       # limit to 3 jobs at a time
@@ -592,6 +592,7 @@ jobs:
 
     steps:
     - name: Login to Docker Hub
+      if: ${{ env.HAS_ACCESS_TO_GITHUB_TOKEN == 'true' }}
       uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v2.1.0
       with:
         username: ${{ secrets.GHA_DOCKERHUB_PUSH_USER }}
@@ -626,6 +627,7 @@ jobs:
       uses: regclient/actions/regctl-installer@b6614f5f56245066b533343a85f4109bdc38c8cc
 
     - name: Push Images
+      if: ${{ env.HAS_ACCESS_TO_GITHUB_TOKEN == 'true' }}
       env:
         TAGS: "${{ steps.meta.outputs.tags }}"
       run: |

.requirements

@@ -1,6 +1,6 @@
 KONG_PACKAGE_NAME=kong
 
-OPENRESTY=1.21.4.3
+OPENRESTY=1.25.3.1
 LUAROCKS=3.9.2
 OPENSSL=3.2.0
 PCRE=8.45
@@ -10,10 +10,12 @@ LUA_KONG_NGINX_MODULE=4fbc3ddc7dcbc706ed286b95344f3cb6da17e637 # 0.8.0
 LUA_RESTY_LMDB=19a6da0616db43baf8197dace59e64244430b3c4 # 1.4.1
 LUA_RESTY_EVENTS=8448a92cec36ac04ea522e78f6496ba03c9b1fd8 # 0.2.0
 LUA_RESTY_WEBSOCKET=60eafc3d7153bceb16e6327074e0afc3d94b1316 # 0.4.0
-ATC_ROUTER=ac71b24ea5556b38b0f9903850ed666c36ad7843 # 1.4.1
+ATC_ROUTER=1abb9286947b70b4e302d8df953961c1280a0289 # 1.6.0
 
 KONG_MANAGER=nightly
 NGX_WASM_MODULE=a7087a37f0d423707366a694630f1e09f4c21728
 WASMER=3.1.1
 WASMTIME=14.0.3
 V8=10.5.18
+
+NGX_BROTLI=25f86f0bac1101b6512135eac5f93c49c63609e3 # v1.0.0rc

CONTRIBUTING.md

@@ -956,6 +956,17 @@ then
 end
 ```
 
+When invoking `ngx.log()` with some variable as input, prefer vararg-style
+calls rather than using the string concatenation operator (`..`):
+
+```lua
+-- bad
+ngx.log(ngx.DEBUG, "if `my_var` is nil, this code throws an exception: " .. my_var)
+
+-- good
+ngx.log(ngx.DEBUG, "if `my_var` is nil, this code is fine: ", my_var)
+```
+
 [Back to code style TOC](#table-of-contents---code-style)
 
 [Back to TOC](#table-of-contents)

bin/busted

@@ -41,6 +41,9 @@ if not os.getenv("KONG_BUSTED_RESPAWNED") then
     end
   end
 
+  -- create shared dict
+  resty_flags = resty_flags .. require("spec.fixtures.shared_dict")
+
   if resty_flags then
     table.insert(cmd, cmd_prefix_count+1, resty_flags)
   end

build/README.md

@@ -195,9 +195,6 @@ time to control how the ngx_wasm_module repository is sourced:
     tells bazel to build from a branch rather than using the tag found in our
     `.requirements` file
 
-**NOTE:** these environment variables currently do not integrate very well with
-bazel's cache mechanism, so you may need to clear cache after changing their value.
-
 ## Cross compiling
 
 Cross compiling is currently only tested on Ubuntu 22.04 x86_64 with following targeting platforms:

build/kong_bindings.bzl

@@ -64,6 +64,9 @@ def _load_vars(ctx):
     ngx_wasm_module_remote = ctx.os.environ.get("NGX_WASM_MODULE_REMOTE", "https://github.com/Kong/ngx_wasm_module.git")
     content += '"NGX_WASM_MODULE_REMOTE": "%s",' % ngx_wasm_module_remote
 
+    ngx_wasm_module_branch = ctx.os.environ.get("NGX_WASM_MODULE_BRANCH", "")
+    content += '"NGX_WASM_MODULE_BRANCH": "%s",' % ngx_wasm_module_branch
+
     ctx.file("BUILD.bazel", "")
     ctx.file("variables.bzl", "KONG_VAR = {\n" + content + "\n}")
 
@@ -107,6 +110,7 @@ load_bindings = repository_rule(
         "INSTALL_DESTDIR",
         "RPM_SIGNING_KEY_FILE",
         "NFPM_RPM_PASSPHRASE",
+        "NGX_WASM_MODULE_BRANCH",
         "NGX_WASM_MODULE_REMOTE",
     ],
 )

build/openresty/BUILD.openresty.bazel

@@ -168,6 +168,7 @@ CONFIGURE_OPTIONS = [
     "--add-module=$$EXT_BUILD_ROOT$$/external/lua-kong-nginx-module/stream",
     "--add-module=$$EXT_BUILD_ROOT$$/external/lua-resty-lmdb",
     "--add-module=$$EXT_BUILD_ROOT$$/external/lua-resty-events",
+    "--add-module=$$EXT_BUILD_ROOT$$/external/ngx_brotli",
 ] + select({
     "@kong//:aarch64-linux-anylibc-cross": [
         "--crossbuild=Linux:aarch64",
@@ -261,6 +262,7 @@ configure_make(
         "@lua-resty-lmdb//:all_srcs",
         "@lua-resty-events//:all_srcs",
         "@openresty_binding//:all_srcs",
+        "@ngx_brotli//:all_srcs",
     ] + select({
         "@kong//:wasmx_flag": [
             "@ngx_wasm_module//:all_srcs",