Tyk Gateway 5.6 Release Notes

Open Source (Mozilla Public License)

This page contains all release notes for version 5.6.X displayed in a reverse chronological order

Support Lifetime

Our minor releases are supported until our next minor comes out.

---

5.6.0 Release Notes

Release Date 10 October 2024

Release Highlights

We are thrilled to announce new updates and improvements in Tyk 5.6.0, bringing more control, flexibility, and performance. For a comprehensive list of changes, please refer to the detailed changelog below.

Per endpoint Rate Limiting for clients

Building on the per-endpoint upstream rate limits introduced in Tyk 5.5.0 we have now added per-endpoint client rate limits. This new feature allows for more granular control over client consumption of API resources by associating the rate limit with the access key, enabling you to manage and optimize API usage more effectively.

Gateway logs in JSON format

You can now output Tyk Gateway system logs in JSON format. This allows for easier integration with logging systems and more structured log data.

Go upgrade to 1.22

We’ve upgraded the Tyk Gateway to Golang 1.22, bringing improved performance, better security, and enhanced stability to the core system.

Breaking Changes

There are no breaking changes in this release.

Dependencies

Compatibility Matrix For Tyk Components

Gateway Version	Recommended Releases	Backwards Compatibility
5.6.0	MDCB v2.7.1	MDCB v2.4.2
	Operator v1.0.0	Operator v0.17
	Sync v2.0	Sync v1.4.3
	Helm Chart v2.1	Helm all versions
	EDP v1.11	EDP all versions
	Pump v1.11	Pump all versions
	TIB (if using standalone) v1.5.1	TIB all versions

3rd Party Dependencies & Tools

Third Party Dependency	Tested Versions	Compatible Versions	Comments
Go	1.22	1.22	Go plugins must be built using Go 1.22
Redis	6.2.x, 7.x	6.2.x, 7.x	Used by Tyk Gateway
OpenAPI Specification	v3.0.x	v3.0.x	Supported by Tyk OAS

Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.

Deprecations

There are no deprecations in this release.

Upgrade instructions

If you are upgrading to 5.6.0, please follow the detailed upgrade instructions.

Downloads

• Docker image to pull

  • docker pull tykio/tyk-gateway:v5.6.0
    

• Helm charts

  • tyk-charts v2.1.0

• Source code tarball for OSS projects

Changelog

Added

• Per endpoint client rate limiting

  Building on the per-endpoint upstream rate limits introduced in Tyk 5.5.0 we have added per-endpoint client rate limits. This new feature provided users with more precise control over API resource consumption by linking rate limits to access keys, allowing for better management and optimization of API usage.

• New option to generate Gateway system logs in JSON format

  The Tyk Gateway now supports logging in JSON format. To enable this feature, set the environment variable TYK_GW_LOGFORMAT to json. If a different value is provided, the logs will default to the standard format. This enhancement allows for improved log processing and integration with various monitoring tools.

Changed

• Upgrade to Go 1.22 for Tyk Dashboard

  The Tyk Gateway and Tyk Dashboard have been upgraded from Golang 1.21 to Golang 1.22, bringing enhanced performance, strengthened security, and access to the latest features available in the new Golang release.

Fixed

• Data plane gateways sometimes didn't synchronise policies and APIs on start-up

  We have enhanced the initial synchronization of Data Plane gateways with the Control Plane to ensure more reliable loading of policies and APIs on start-up. A synchronous initialization process has been implemented to avoid sync failures and reduce the risk of service disruptions caused by failed loads. This update ensures smoother and more consistent syncing of policies and APIs in distributed deployments.

• Quota wasn't respected under extreme load

  We have fixed an issue where the quota limit was not being consistently respected during request spikes, especially in deployments with multiple gateways. The problem occurred when multiple gateways cached the current and remaining quota counters at the end of quota periods. To address this, a distributed lock mechanism has been implemented, ensuring coordinated quota resets and preventing discrepancies across gateways.

• Rate limits were incorrectly combined when multiple policies were applied to a key

  We have fixed an issue where API-level rate limits set in multiple policies were not correctly applied to the same key. With this update, when multiple policies configure rate limits for a key, the key will now receive the highest rate limit from the combined policies, ensuring proper enforcement of limits.

• Restored key creation performance to Gateway 4.0.12/4.3.3 levels

  We have addressed a performance regression where key creation for policies with a large number of APIs (100+) became significantly slower in Tyk 4.0.13/5.0.1. The operation, which previously took around 1.5 seconds, has been taking over 20 seconds since versions 4.0.13/5.0.1. This issue has been resolved by optimizing Redis operations during key creation, restoring the process to the previous duration, even with a large number of APIs in the policy.

Security Fixes

• High priority CVEs fixed

  Fixed the following high priority CVEs identified in the Tyk Gateway, providing increased protection against security vulnerabilities:

  • CVE-2024-6104

---

Further Information

Upgrading Tyk

Please refer to the upgrading Tyk page for further guidance on the upgrade strategy.

API Documentation

• Tyk Gateway API
• Postman Collection

FAQ

Please visit our Developer Support page for further information relating to reporting bugs, upgrading Tyk, technical support and how to contribute.