Important

If you're upgrading from Tyk Gateway/Dashboard 3.0.5 or 3.0.6, or from Tyk MDCB 1.7.9, due to packaging bug introduced in those versions, after doing upgrade, you need to run systemctl daemon-reload (this command also mentioned in logs during upgrade as well).

Deprecation notice

enable_health_checks option is deprecated, and going to be disabled by default starting from 4.0.0.
This option enable special API level health check endpoint, with was no longer used, and duplicate information provided by Tyk Pump.
Note that it is not related to Gateway health check endpoint. This option can cause significant performance issues, so ensure that you have it turned off in your installation, if not used.

Tyk Gateway 3.0.7

• Fixed small amount of panics happening on high concurrency when using API level limits
  https://github.com/TykTechnologies/tyk/pull/3644
• Fixed signature validation for custom tokens https://github.com/TykTechnologies/tyk/pull/3634
• Fixed propagation of update/delete events in MDCB environments https://github.com/TykTechnologies/tyk/pull/3638
• Fix quota reset in MDCB environment if "per api quota" is set https://github.com/TykTechnologies/tyk/pull/3619
• Fixed Go plugins with dependencies
• Fixed deadlock causing performance degradation happening when gRPC middleware in MDCB environment with high concurrency https://github.com/TykTechnologies/tyk/pull/3592
• Fix gRPC streaming https://github.com/TykTechnologies/tyk/pull/3602 https://github.com/TykTechnologies/tyk/pull/3603
• Fixed gRPC -> h2c and h2c -> gRPC communication https://github.com/TykTechnologies/tyk/pull/3496
• Added default template for XML content https://github.com/TykTechnologies/tyk/pull/3510
• Fixed detection of content type, when content type header contains charset directive https://github.com/TykTechnologies/tyk/pull/3501
• Request headers added by middlewares now should be visible in detailed logs https://github.com/TykTechnologies/tyk/pull/3585
• Fixed issue when gateway register multiple times with dashboard with different IDs https://github.com/TykTechnologies/tyk/pull/3563

Tyk Dashboard 3.0.7

• Fixed issue with large number of APIs. Approximately when bigger then 2000, but actually depends on their total bytes size.
• Fixed package upgrades issue introduce in 3.0.6
• In Portal, add a way to re-use certificates when subscribing to another API
• Fixed Dashboard policy behaviour when environment was created using Tyk Sync
• Fixed when users belonging to user-group, and have user permissions, can't edit users
• Disallow changing email in portal user profile
• Fixed double organisation IDs when searching certificates
• Security vulnerability in SAML identity management
• Fixed security issue when users with "read" user permissions, were able to access another user API token though Tyk Dashboardd API
• Portal session now stored in mongo instead of cookies, which means that on user logout cookies can't be re-used
• Fixed uptime tests page UI

Tyk MDCB 1.7.10

• Fix memory leaks which can happen on high amount of APIs and Policies

Tyk Gateway 3.2.1

• Fixed issue with loading Python and Go plugins
• Fixed issue with mounting apps and middleware folders for Docker images

Tyk Gateway 3.0.6

• Fixed issue with loading Python and Go plugins
• Fixed issue with mounting apps and middleware folders for Docker images

Tyk Gateway v2.9.5

• Added default error template for XML content type https://github.com/TykTechnologies/tyk/pull/3510
• Fix error content type detection when "charset" included into content type header https://github.com/TykTechnologies/tyk/pull/3501
• Fixed issues with certificates and custom keys when migrating to a new hashing algorithm. Added a way to specify hash_key_function_fallback fallback. For example if you are migrating from murmur64 to sha256, hash_key_function_fallback should be ["murmur64"]. https://github.com/TykTechnologies/tyk/pull/3505
• Fixed uptime checks in multi-gateway configuration https://github.com/TykTechnologies/tyk/pull/3431 https://github.com/TykTechnologies/tyk/pull/3504

Tyk Gateway 3.0.4

• Fix hello endpoint when control api moved to a separate port https://github.com/TykTechnologies/tyk/pull/3434
• Fix gRPC H2C load balancing https://github.com/TykTechnologies/tyk/pull/3427
• Do not proxying to down hosts when round robin and uptime tests enabled https://github.com/TykTechnologies/tyk/pull/3431
• Fix Mutual TLS for domains containing regex https://github.com/TykTechnologies/tyk/pull/3442

Tyk Dashboard 3.0.4

• Fix dashboard analytics page in Firefox
• Disable Update/Delete buttons on Keys interface if disabled in config
• Fix javascript error on developer screen
• Add user id to the User API create response
• Fixed Analytics endpoint lastHit format to use RFC-3339

Tyk Gateway

• Fix JSVM authentification plugins when using bundles https://github.com/TykTechnologies/tyk/pull/3402
• Fix error handler templates for XML responses https://github.com/TykTechnologies/tyk/pull/3392

Tyk Gateway

• Fixed JWKs backward compatibility issue introduced in previous release. Now both old-format JWKs and RFC valid JWKs are supported. https://github.com/TykTechnologies/tyk/pull/3430
• Fixed Gateway cold start in MDCB environment, in cases when Redis connection happen after initial API load. https://github.com/TykTechnologies/tyk/pull/3428
• Fixed GRPC proxying with H2C protocol https://github.com/TykTechnologies/tyk/pull/3142 https://github.com/TykTechnologies/tyk/pull/3372. Documentation went though the full revamp https://tyk.io/docs/key-concepts/grpc-proxy/
• Fixed slow key/policy pages in cases when you have multi-tenant environment with a lot of certificates. https://github.com/TykTechnologies/tyk/pull/3410
• Fixed custom error messages for XML content type https://github.com/TykTechnologies/tyk/pull/3392
• Fixed JSVM authentication middleware when using bundles https://github.com/TykTechnologies/tyk/pull/3402
• Fixed Virtual Endpoint latency in analytics (previously was shown as 0) https://github.com/TykTechnologies/tyk/pull/3386

Tyk Dashboard

• Fixed portal domains with long TLDs like ( dev.docs.services)
• Fixed memory link happening for trial licenses, in close networks
• Fixed OrgID validation for when updating APIs, now it should not allow wrong IDs. Should resolve one of the common Tyk Sync issues.
• Fixed initial screen in Firefox
• Fixed pagination on certificate listing page
• Fixed Blank page and console errors when searching basic auth key by keyID or key hash

Tyk Gateway

• Fixed JWKs backward compatibility issue introduced in previous release. Now both old-format JWKs and RFC valid JWKs are supported. https://github.com/TykTechnologies/tyk/pull/3430
• Fixed Gateway cold start in MDCB environment, in cases when Redis connection happen after initial API load. https://github.com/TykTechnologies/tyk/pull/3428
• Fixed GRPC proxying with H2C protocol https://github.com/TykTechnologies/tyk/pull/3142 https://github.com/TykTechnologies/tyk/pull/3372. Documentation went though the full revamp https://tyk.io/docs/key-concepts/grpc-proxy/
• Fixed slow key/policy pages in cases when you have multi-tenant environment with a lot of certificates. https://github.com/TykTechnologies/tyk/pull/3410
• Fixed custom error messages for XML content type https://github.com/TykTechnologies/tyk/pull/3392
• Fixed JSVM authentication middleware when using bundles https://github.com/TykTechnologies/tyk/pull/3402
• Fixed Virtual Endpoint latency in analytics (previously was shown as 0) https://github.com/TykTechnologies/tyk/pull/3386

Tyk Dashboard

• Fixed portal domains with long TLDs like ( dev.docs.services)
• Fixed memory link happening for trial licenses, in close networks
• Fixed OrgID validation for when updating APIs, now it should not allow wrong IDs. Should resolve one of the common Tyk Sync issues.
• Fixed initial screen in Firefox
• Fixed pagination on certificate listing page
• Display User group name instead of its ID in Identity management screens.

Upgrade instructions

Important If you used JWTs with non-standard JWKs Tyk (PEM) format, you should update your API to use the default JWKs URL given by your IDP. UPDATE: Fixed in 3.1.2

Tyk Gateway 3.1.1

• Fixed GraphQL query depth when per API limits used https://github.com/TykTechnologies/tyk/pull/3290
• It now possible to disable Circuit Breaker ‘half-open’ state using disable_half_open_state gateway option. Read more here https://tyk.io/docs/planning-for-production/ensure-high-availability/circuit-breakers/ https://github.com/TykTechnologies/tyk/issues/2673
• By default Tyk normalize your HTTP headers case. Now you can disable this behavior using ignore_canonical_mime_header_key config option. https://tyk.io/docs/tyk-configuration-reference/tyk-gateway-configuration-options/#ignore_canonical_mime_header_key https://github.com/TykTechnologies/tyk/pull/3249
• Fixed do not track middleware. When applied to an endpoint, it is no longer recorded (this includes logs, api activity analytics, endpoint popularity analytics) https://github.com/TykTechnologies/tyk/pull/3381
• Fixed leaking traffic between the Tyk components and Redis cluster nodes when Redis 6 is used.
• Fixed Gateway crash when disable_management_poller is used https://github.com/TykTechnologies/tyk/pull/3350
• JWT middleware follows the spec and now expects JWK certificate x509 in standard der encoded format instead of PEM https://github.com/TykTechnologies/tyk/pull/3212
• Fixed uptime checks when multiple segmented gateway groups connected to the same Redis. Each cluster now should have uptime_tests.poller_group set https://tyk.io/docs/planning-for-production/ensure-high-availability/uptime-tests/#initial-configuration https://github.com/TykTechnologies/tyk/pull/3321 https://github.com/TykTechnologies/tyk/pull/3357 https://github.com/TykTechnologies/tyk-docs/pull/1457
• Fixed panic when having a high number of requests due to concurrent map writes https://github.com/TykTechnologies/tyk/pull/3274
• Added a new config option drl_enable_sentinel_rate_limiter to enable Redis Sentinel algorithm as a fallback for Distributed rate-limiting algorithm https://github.com/TykTechnologies/tyk/pull/3298
• Worker gateway in the multi-datacenter environment now should properly start if MDCB component is down. https://github.com/TykTechnologies/tyk/pull/3285
• This refactors EnsureTransport function for properly ensuring transport is present on the host when load balancer is enabled.
• Fixed load balancing when custom "protocol" is set https://github.com/TykTechnologies/tyk/pull/3329
• Fix panic for API health check endpoint (not related to Gateway Healthcheck) https://github.com/TykTechnologies/tyk/pull/3223
• Fix loading open tracing using ENV variables https://github.com/TykTechnologies/tyk/pull/3147
• Worker gateways in a multi-datacenter environment now can have configurable key events polling time via slave_options.key_space_sync_interval (e.g. how fast it reacts to key changes in management layer). https://github.com/TykTechnologies/tyk/pull/3059
• Fix detailed recording of response payloads for errors https://github.com/TykTechnologies/tyk/pull/3208
• Fix using JSVM with nested metadata (like keys generated via developer portal) https://github.com/TykTechnologies/tyk/pull/3231

Tyk Dashboard 3.1.1

• Fix bug when UDG API not get saved when the user navigates away from schema editor
• Fixed API URL in GraphQL Documentation in the portal
• API search now returns results when only part of the word match
• Fix API listing when you have more than 100 APIs
• The approve button for key approval was having a theme blank which made it look like the button is missing, this fix makes changes theme to success to display the button
• Fixed broken navigation to user edit page from the top menu bar of the Dashboard.
• Fixed issue with Keys and Policy pages, when dashboard hostname is not available from the machine where Dashboard is running.
• Fixed blank page/console errors on Uptime Targets page
• Prevented Dashboard panics when Key was created using invalid Policy ids.
• Fixed missing developer information on Key request details page
• Fix APIs and Policies synchronization when using Tyk Sync. Should be used together with Tyk Sync 1.2
• Fix developer portal analytics when hashed keys are used
• Fixed built-in Dashboard SSO when dashboard has multiple instances behind a load balancer
• Email used during SSO flow now case insensitive
• Fixed propagation of basic auth keys on worker gateways in a multi-datacenter environment.
• Fixed developer token revocation in a multi-datacenter environment.

Upgrade instructions

Important If you used JWTs with non-standard JWKs Tyk (PEM) format, you should update your API to use the default JWKs URL given by your IDP. UPDATE: Fixed in 3.0.3

Tyk Gateway 3.0.2

• It now possible to disable Circuit Breaker ‘half-open’ state using disable_half_open_state gateway option. Read more here https://tyk.io/docs/planning-for-production/ensure-high-availability/circuit-breakers/ https://github.com/TykTechnologies/tyk/issues/2673
• By default Tyk normalize your HTTP headers case. Now you can disable this behavior using ignore_canonical_mime_header_key config option. https://tyk.io/docs/tyk-configuration-reference/tyk-gateway-configuration-options/#ignore_canonical_mime_header_key https://github.com/TykTechnologies/tyk/pull/3249
• Fixed do not track middleware. When applied to an endpoint, it is no longer recorded (this includes logs, api activity analytics, endpoint popularity analytics) https://github.com/TykTechnologies/tyk/pull/3381
• Fixed leaking traffic between the Tyk components and Redis cluster nodes when Redis 6 is used.
• Fixed Gateway crash when disable_management_poller is used https://github.com/TykTechnologies/tyk/pull/3350
• JWT middleware follows the spec and now expects JWK certificate x509 in standard der encoded format instead of PEM https://github.com/TykTechnologies/tyk/pull/3212
• Fixed uptime checks when multiple segmented gateway groups connected to the same Redis. Each cluster now should have uptime_tests.poller_group set https://tyk.io/docs/planning-for-production/ensure-high-availability/uptime-tests/#initial-configuration https://github.com/TykTechnologies/tyk/pull/3321 https://github.com/TykTechnologies/tyk/pull/3357 https://github.com/TykTechnologies/tyk-docs/pull/1457
• Fixed panic when having a high number of requests due to concurrent map writes https://github.com/TykTechnologies/tyk/pull/3274
• Added a new config option drl_enable_sentinel_rate_limiter to enable Redis Sentinel algorithm as a fallback for Distributed rate-limiting algorithm https://github.com/TykTechnologies/tyk/pull/3298
• Worker gateway in the multi-datacenter environment now should properly start if MDCB component is down. https://github.com/TykTechnologies/tyk/pull/3285
• This refactors EnsureTransport function for properly ensuring transport is present on the host when load balancer is enabled.
• Fixed load balancing when custom "protocol" is set https://github.com/TykTechnologies/tyk/pull/3329
• Fix panic for API health check endpoint (not related to Gateway Healthcheck) https://github.com/TykTechnologies/tyk/pull/3223
• Fix loading open tracing using ENV variables https://github.com/TykTechnologies/tyk/pull/3147
• Worker gateways in a multi-datacenter environment now can have configurable key events polling time via slave_options.key_space_sync_interval (e.g. how fast it reacts to key changes in management layer). https://github.com/TykTechnologies/tyk/pull/3059
• Fix detailed recording of response payloads for errors https://github.com/TykTechnologies/tyk/pull/3208
• Fix using JSVM with nested metadata (like keys generated via developer portal) https://github.com/TykTechnologies/tyk/pull/3231

Tyk Dashboard 3.0.2

• API search now returns results when only part of the word match
• Fix API listing when you have more than 100 APIs
• The approve button for key approval was having a theme blank which made it look like the button is missing, this fix makes changes theme to success to display the button
• Fixed broken navigation to user edit page from the top menu bar of the Dashboard.
• Fixed issue with Keys and Policy pages, when dashboard hostname is not available from the machine where Dashboard is running.
• Fixed blank page/console errors on Uptime Targets page
• Prevented Dashboard panics when Key was created using invalid Policy ids.
• Fixed missing developer information on Key request details page
• Fix APIs and Policies synchronization when using Tyk Sync. Should be used together with Tyk Sync 1.2
• Fix developer portal analytics when hashed keys are used
• Fixed built-in Dashboard SSO when dashboard has multiple instances behind a load balancer
• Email used during SSO flow now case insensitive
• Fixed propagation of basic auth keys on worker gateways in a multi-datacenter environment.
• Fixed developer token revocation in a multi-datacenter environment.

SAML support, GraphQL and Universal Data Graph updates, new secure way to request keys via the developer portal, and much more!

See full release notes

Tyk Gateway 2.9.4.7

• Fixed panic happening when using uptime tests poller groups in combination with load balancing #3321 #3357

Tyk Gateway v2.9.4.6

• Added alternative Circuit breaker algorithm, which completely disables requests to upstream during cool-down period.
  Can be enabled by setting disable_half_open_state to true on plugin configuration level. https://github.com/TykTechnologies/tyk/pull/3325
• Fixed uptime check behavior when multiple gateway groups connected to the same Redis but segregated using tags. Added a new gateway configuration option to disable uptime checks on the specific gateway using disable_management_poller boolean option, and uptime_tests.poller_group to have district checkers in each gateway cluster. https://github.com/TykTechnologies/tyk/pull/3321

Tyk Dashboard 1.9.4.4

• Added support for setting new circuit breaker and uptime checker fields added in Tyk Gateway 2.9.4.6

Tyk MDCB v1.7.6

• Added support for the new circuit breaker and uptime checker fields added in Tyk Gateway 2.9.4.6

Tyk Gateway v2.9.4.5

• Fixed additional concurrent session map access bug (#3307, fix #3309).

Tyk Gateway v2.9.4.4

• Fixed concurrent map writes panic in session object https://github.com/TykTechnologies/tyk/pull/3274
• Fixed reload implementation https://github.com/TykTechnologies/tyk/pull/3269
• Don't encode and reset RawQuery after JSVM if no change on query params https://github.com/TykTechnologies/tyk/pull/3283
• Added a way to use sentinel rate limiter during Redis fallback with DRL https://github.com/TykTechnologies/tyk/pull/3298
• Implemented rw mutex for session and avoid multiple write access to the session https://github.com/TykTechnologies/tyk/pull/3274

Tyk Gateway v3.0.1

• Fix custom keys in MDCB env https://github.com/TykTechnologies/tyk/pull/3129
• HTTP signing now include query params https://github.com/TykTechnologies/tyk/pull/3185
• API token update in hashed mode should not generate rudimentary Redis record https://github.com/TykTechnologies/tyk/pull/3229
• Fixed HTTP signing with empty request path https://github.com/TykTechnologies/tyk/pull/3243
• Fixed proxy to internal GraphQL APIs https://github.com/TykTechnologies/tyk/pull/3262
• Fixed loading transform templates from files https://github.com/TykTechnologies/tyk/pull/2661
• Fixed merging of GraphQL policies with restricted fields https://github.com/TykTechnologies/tyk/issues/3166
• Fixed caching of JWT error state, when used JWT with invalid scope https://github.com/TykTechnologies/tyk/pull/3219
• Don’t ask certificate if there are multiple APIs on the same domain https://github.com/TykTechnologies/tyk/pull/3264
• Fix blocking gateway if MDCB its down https://github.com/TykTechnologies/tyk/pull/3285

Tyk Dashboard v3.0.1

• Fix DocumentDB API listing
• Fix default permissions during SSO login
• Deprecated organization key events (now enabled all the time)
• Fix registration of new developers though SSO when using built-in Dashboard SSO
• Do not hide developers when the policy of their subscription was removed, and API ownership enabled
• Fixed built-in Dashboard SSO when multiple dashboard instances used

Upgrade notice

If you started using GraphQL APIs, introduced in v3.0.0, after upgrading the dashboard you need to run tyk-analytics migration cli command. This command will migrate GraphQL apis from 3.0.0 to 3.0.1 format. If you not using GraphQL APIs it is not needed.

Tyk Gateway 2.9.4.3

• Request signing now works with query params
• Fixed request signing if upstream do not have trailing slash https://github.com/TykTechnologies/tyk/issues/3242
• Fixed custom keys in MDCB environment https://github.com/TykTechnologies/tyk/issues/3103
• Fixed issue when update of hashed token caused generated rudimentary record in Redis https://github.com/TykTechnologies/tyk/issues/3109

Tyk Dashboard 1.9.4.3

• Fixed dashboard bootstrapping when using TLS

Our major release!

See full release notes here: https://tyk.io/docs/release-notes/version-3.0/

• Now Open Tracing configuration options can be set via ENV variables https://github.com/TykTechnologies/tyk/pull/3112
• Fixed Key quota Monitor https://github.com/TykTechnologies/tyk/issues/3078

The last patch released introduced improved package signing changes, however, we found that some old RPM base systems, do not support signing using sub-keys. So we have released packages for all products, to fix that issue.

Additional changes:

Tyk Gateway 2.9.4.1

• Fixed JWT middleware with Auth0 JWKs format https://github.com/TykTechnologies/tyk/issues/3030
• Fixed OAuth token revocation inside slaved data-centers in multi-datacenter scenario https://github.com/TykTechnologies/tyk/issues/3025
• Fixed OAuth token revocation when using bind_to_slugs https://github.com/TykTechnologies/tyk/pull/3015
• Fixed issue with the unlimited rate limit when using Redis rate limiter https://github.com/TykTechnologies/tyk-analytics/issues/1719

Tyk Dashboard 1.9.4.1

• Fixed OAuth token revocation even propagation in multi-datacenter scenario
• Fixed bug preventing using SSO lookup together with temporary SSO users.
• Fixed UI bug which adds double OrgID to the certificate IDs when using certificate modal

Tyk MDCB 1.7.4

• Fixed OAuth token revocation even propagation in multi-datacenter scenario