GraphQL Rate Limiting Advanced

Release date 2026/10/12

Bugfix

• Fixed an issue where pass_all_downstream_headers forwarded stale Content-Length, Content-Encoding, and Transfer-Encoding headers, breaking schema introspection.

• Fixed an issue where a longer fixed window was incorrectly marked as exhausted if a shorter window denied a request.

Release date 2026/07/02

Bugfix

• Fixed an issue where the GraphQL Rate Limiting Advanced plugin’s API threw 500 errors when handling HTTP PUT requests.

Release date 2026/10/14

Bugfix

• Fixed an issue where pass_all_downstream_headers forwarded stale Content-Length, Content-Encoding, and Transfer-Encoding headers, breaking schema introspection.

• Fixed an issue where a longer fixed window was incorrectly marked as exhausted if a shorter window denied a request.

Release date 2026/04/28

Bugfix

• Fixed an issue where the graphql-rate-limiting-advanced plugin’s API throws 500 when handling HTTP PUT request.

Release date 2026/04/07

Bugfix

• Fixed an issue where the plugin could fail to connect to the upstream server to introspect the upstream schema.

Release date 2026/04/08

Bugfix

• Fixed an issue where the graphql-rate-limiting-advanced plugin’s API throws 500 when handling HTTP PUT request.

Release date 2026/04/15

Bugfix

• Fixed an issue where the graphql-rate-limiting-advanced plugin’s API throws 500 when handling HTTP PUT request.

Release date 2026/04/15

Bugfix

• Fixed an issue where the graphql-rate-limiting-advanced plugin’s API throws 500 when handling HTTP PUT request.

Release date 2025/07/03

Feature

• Added support for passing all downstream headers to GraphQL upstream servers in introspection requests.

Bugfix

• Fixed an issue where the rate limiting plugins can’t handle decimal numbers when using Redis strategy.

Release date 2026/04/09

Bugfix

• Fixed an issue where the graphql-rate-limiting-advanced plugin’s API throws 500 when handling HTTP PUT request.

Release date 2024/12/12

Bugfix

• Fixed an issue where the plugin may fail to authenticate to Redis correctly with vault-referenced redis configuration.

Release date 2024/09/11

Deprecation

• Deprecated timeout config field in redis config in favor of connect_/send_/read_timeout (timeout field will be removed in 4.0).

• Switched to sentinel_nodes and cluster_nodes for redis configuration.

Feature

• Added Redis cluster_max_redirections configuration option.

Release date 2023/11/08

Breaking Change

• Fix a bug in the schema validation which prevents from using redis in cluster mode

Release date 2026/04/09

Bugfix

• Fixed an issue where the graphql-rate-limiting-advanced plugin’s API throws 500 when handling HTTP PUT request.

Release date 2024/12/17

Bugfix

• Fixed an issue where the plugin may fail to authenticate to Redis correctly with vault-referenced redis configuration.

Release date 2023/09/28

Breaking Change

• Fix a bug in the schema validation which prevents from using redis in cluster mode

Release date 2023/08/09

Feature

• The host field of this plugin now accepts Kong upstream targets.

Release date 2023/02/28

Feature

• In hybrid and DB-less modes, these plugins now support sync_rate = -1 with any strategy, including the default cluster strategy.

Release date 2022/10/12

Bugfix

• The plugin now returns a 500 error when using the cluster strategy in hybrid or DB-less modes instead of crashing.

Release date 2022/05/27

Bugfix

• Fixed deserialize_parse_tree logic when building GraphQL AST with non-nullable or list types.

Release date 2022/03/02

Feature

• Added Redis ACL support (Redis v6.0.0+ and Redis Sentinel v6.2.0+).

• Added the redis.username and redis.sentinel_username configuration parameters.

• Beta feature: The redis.username, redis.password, redis.sentinel_username, and redis.sentinel_passwordconfiguration fields are now marked as referenceable, which means they can be securely stored assecretsin a vault. References must follow a specific format.