Announcement

v1.16.9

On August 11, 2026 we released an updated version of the Apigee hybrid software, v1.16.9.

• For information on upgrading, see Upgrading Apigee hybrid to version v1.16.9.
• For information on new installations, see The big picture.

Fixed

Fixed in this release

Security

Various security and CVE fixes are included in this release.

Announcement

v1.15.7

On July 31, 2026 we released an updated version of the Apigee hybrid software, v1.15.7.

• For information on upgrading, see Upgrading Apigee hybrid to version v1.15.7.
• For information on new installations, see The big picture.

Feature

Runtime rollout strategy configuration

In this release, you can configure the rollout strategy used when updating runtime (message processor) ReplicaSets by setting the runtime.release.strategy property (with options rolling, scale-down-first, or none) or per-environment with envs[].components.runtime.release.strategy in your overrides configuration file. The property defaults to rolling.

Security

Various security and CVE fixes are included in this release.

Announcement

v1.16.8

On July 24, 2026 we released an updated version of the Apigee hybrid software, v1.16.8.

• For information on upgrading, see Upgrading Apigee hybrid to version 1.16.
• For information on new installations, see The big picture.

Fixed

Fixed in this release

Feature

Runtime rollout strategy configuration

In this release, you can configure the rollout strategy used when updating runtime (message processor) ReplicaSets by setting the runtime.release.strategy property (with options rolling, scale-down-first, or none) or per-environment with envs[].components.runtime.release.strategy in your overrides configuration file. The property defaults to rolling.

Security

Various security and CVE fixes are included in this release.

Announcement

v1.14.7

On July 23, 2026 we released an updated version of the Apigee hybrid software, v1.14.7.

• For information on upgrading, see Upgrading Apigee hybrid to version 1.14.
• For information on new installations, see The big picture.

Feature

Runtime rollout strategy configuration

In this release, you can configure the rollout strategy used when updating runtime (message processor) ReplicaSets by setting the runtime.release.strategy property (with options rolling, scale-down-first, or none) or per-environment with envs[].components.runtime.release.strategy in your overrides configuration file. The property defaults to rolling.

Security

Various security and CVE fixes are included in this release.

Announcement

v1.15.6

On July 15, 2026 we released an updated version of the Apigee hybrid software, v1.15.6.

• For information on upgrading, see Upgrading Apigee hybrid to version v1.15.6.
• For information on new installations, see The big picture.

Security

Various security and CVE fixes are included in this release.

Announcement

v1.16.7

On July 10, 2026 we released an updated version of the Apigee hybrid software, v1.16.7.

• For information on upgrading, see Upgrading Apigee hybrid to version v1.16.7.
• For information on new installations, see The big picture.

Security

Various security and CVE fixes are included in this release.

Announcement

v1.15.5

On July 3, 2026 we released an updated version of the Apigee hybrid software, v1.15.5.

• For information on upgrading, see Upgrading Apigee hybrid to version v1.15.5.
• For information on new installations, see The big picture.

Security

Various security and CVE fixes are included in this release.

Announcement

v1.16.6

On June 19, 2026 we released an updated version of the Apigee hybrid software, v1.16.6.

• For information on upgrading, see Upgrading Apigee hybrid to version v1.16.6.
• For information on new installations, see The big picture.

Feature

HAProxy PROXY-protocol support on Apigee ingress gateway

In this release, you can opt into HAProxy PROXY-protocol parsing by setting the ingressGateways[].proxyProtocol.mode property (with options strict, permissive, or disable) in your overrides configuration file. The property defaults to disable.

Security

Various security and CVE fixes are included in this release.

Announcement

v1.14.6

On June 16, 2026 we released an updated version of the Apigee hybrid software, v1.14.6.

• For information on upgrading, see Upgrading Apigee hybrid to version v1.14.6.
• For information on new installations, see The big picture.

Security

Various security and CVE fixes are included in this release.

Announcement

v1.16.5

On June 8, 2026 we released an updated version of the Apigee hybrid software, v1.16.5.

• For information on upgrading, see Upgrading Apigee hybrid to version v1.16.5.
• For information on new installations, see The big picture.

Security

Various security and CVE fixes are included in this release.

Announcement

v1.15.4

On May 30, 2026 we released an updated version of the Apigee hybrid software, v1.15.4.

• For information on upgrading, see Upgrading Apigee hybrid to version v1.15.4.
• For information on new installations, see The big picture.

Security

Various security and CVE fixes are included in this release.

Announcement

v1.14.5

On May 22, 2026 we released an updated version of the Apigee hybrid software, v1.14.5.

• For information on upgrading, see Upgrading Apigee hybrid to version v1.14.5.
• For information on new installations, see The big picture.

Security

Various security and CVE fixes are included in this release.

Announcement

On May 22, 2026 we released an updated version of the Apigee UI.

The Management > Instances page now displays Apigee hybrid instances. The display includes the instance name, location, and runtime version.

See Managing instances.

Announcement

Apigee Emulator is now released independently

Starting May 22, 2026, the Apigee Emulator is versioned and released independently from Apigee hybrid. Emulator updates, including security patches, are no longer tied to hybrid release cycles.

The emulator image continues to be available at gcr.io/apigee-release/hybrid/apigee-emulator. The first independent release is v2.0.0.

For emulator release notes going forward, see Apigee release notes.

Announcement

v1.16.4

On May 21, 2026 we released an updated version of the Apigee hybrid software, v1.16.4.

• For information on upgrading, see Upgrading Apigee hybrid to version v1.16.4.
• For information on new installations, see The big picture.

Fixed

Fixed in this release

Announcement

v1.16.3

On May 19, 2026 we released an updated version of the Apigee hybrid software, v1.16.3.

• For information on upgrading, see Upgrading Apigee hybrid to version v1.16.3.
• For information on new installations, see The big picture.

Fixed

Fixed in this release

Feature

Custom environment variables for Guardrail pods (guardrails.envVars)

Starting in version v1.16.3, you can inject custom environment variables into Apigee hybrid Guardrail pods using the new guardrails.envVars property in overrides.yaml. This is most commonly used to set NO_PROXY (or no_proxy) so that Guardrail pods bypass a configured forward HTTP proxy when calling internal in-cluster endpoints such as the Kubernetes API server, which previously failed in restricted-network environments with a global httpProxy configured. The property is supported on Guardrail pods for the following components: apigee-datastore, apigee-env, apigee-ingress-manager, apigee-operator, apigee-org, apigee-redis, apigee-telemetry, and apigee-virtualhost.

Example:

guardrails:
  envVars:
    NO_PROXY: 'kubernetes.default.svc,172.20.0.1'

Announcement

v1.16.2

On May 13, 2026 we released an updated version of the Apigee hybrid software, v1.16.2.

• For information on upgrading, see Upgrading Apigee hybrid to version v1.16.2.
• For information on new installations, see The big picture.

Feature

Basic Auth credential support for forward proxies

Starting in version v1.16.2, Apigee hybrid runtime components can accept credentials for an upstream forward proxy that enforces HTTP Basic Auth. You can now configure a Basic Auth username and password for the forward proxy in your overrides.yaml. This resolves known issue tracked in b/499322601. See Configure Apigee hybrid to use a forward proxy.

Feature

Sidecar authentication for Workload Identity Federation on AKS and EKS

Starting in version v1.16.2, you can now use a sidecar along with Workload Identity Federation on AKS and EKS to mount security tokens from your preferred identity provider (IDP) for service account authentication. This method is an alternative to using Kubernetes Projected Service Account Tokens, and is useful when you need to integrate with a custom Identity Provider. See Use sidecar authentication for Workload Identity Federation on AKS and EKS.

Fixed

Fixed in this release

Security

Various security and CVE fixes are included in this release.

Announcement

v1.15.3

On May 4, 2026 we released an updated version of the Apigee hybrid software, v1.15.3.

• For information on upgrading, see Upgrading Apigee hybrid to version v1.15.3.
• For information on new installations, see The big picture.

Security

Announcement

v1.14.4

On April 27, 2026 we released an updated version of the Apigee hybrid software, v1.14.4.

• For information on upgrading, see Upgrading Apigee hybrid to version v1.14.4.
• For information on new installations, see The big picture.

Feature

Sidecar authentication for Workload Identity Federation on non-GKE platforms

Starting in version v1.14.4, you can now use a sidecar along with Workload Identity Federation on non-GKE platforms to mount security tokens from your preferred identity provider (IDP) for service account authentication. See Use sidecar authentication for Workload Identity Federation on non-GKE platforms.

Security

Announcement

v1.16.1

On April 20, 2026 we released an updated version of the Apigee hybrid software, v1.16.1.

• For information on upgrading, see Upgrading Apigee hybrid to version v1.16.1.
• For information on new installations, see The big picture.

Fixed

Fixed in this release

Security

Announcement

hybrid 1.16.0-hotfix.2

On March 12, 2026 we released Apigee hybrid 1.16.0-hotfix.2.

Apply this hotfix with the following steps:

Apply this hotfix with the following steps:

1. In your hybrid Helm charts directory, download the Apigee hybrid 1.16.0-hotfix.2 Helm charts into your hybrid Helm charts directory with the following commands:

   export CHART_REPO=oci://us-docker.pkg.dev/apigee-release/apigee-hybrid-helm-charts
   export CHART_VERSION=1.16.0-hotfix.2
   helm pull $CHART_REPO/apigee-operator --version $CHART_VERSION --untar
   helm pull $CHART_REPO/apigee-datastore --version $CHART_VERSION --untar
   helm pull $CHART_REPO/apigee-env --version $CHART_VERSION --untar
   helm pull $CHART_REPO/apigee-ingress-manager --version $CHART_VERSION --untar
   helm pull $CHART_REPO/apigee-org --version $CHART_VERSION --untar
   helm pull $CHART_REPO/apigee-redis --version $CHART_VERSION --untar
   helm pull $CHART_REPO/apigee-telemetry --version $CHART_VERSION --untar
   helm pull $CHART_REPO/apigee-virtualhost --version $CHART_VERSION --untar
   

2. Install the hotfix release for Apigee operators, beginning with a dry run:

   helm upgrade operator apigee-operator/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     -f overrides.yaml \
     --dry-run=server
   

3. After the dry run is successful, install the hotfix release for Apigee operators:

   helm upgrade operator apigee-operator/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     -f overrides.yaml
   

4. Install the hotfix release for your organization, beginning with a dry run:

   helm upgrade $ORG_NAME apigee-org/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     -f overrides.yaml \
     --dry-run=server
   

5. After the dry run is successful, install the hotfix release for your organization:

   helm upgrade $ORG_NAME apigee-org/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     -f overrides.yaml
   

6. Verify the organization chart by checking the state:

   kubectl -n APIGEE_NAMESPACE get apigeeorg
   

7. Install the hotfix release for your environments. Repeat the following steps for each environment, beginning with a dry run:

   helm upgrade ENV_RELEASE_NAME apigee-env/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     --set env=$ENV_NAME \
     -f overrides.yaml \
     --dry-run=server
   

8. After the dry run is successful, install the hotfix release for your environment:

   helm upgrade ENV_RELEASE_NAME apigee-env/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     --set env=$ENV_NAME \
     -f overrides.yaml
   

9. Verify the environment chart by checking the state:

   kubectl -n APIGEE_NAMESPACE get apigeeenv
   

Fixed

Fixed in this release

Announcement

hybrid v1.15.2

On March 11, 2026 we released an updated version of the Apigee hybrid software, v1.15.2.

• For information on upgrading, see Upgrading Apigee hybrid to version v1.15.2.
• For information on new installations, see The big picture.

Fixed

Fixed in this release

Security

Announcement

hybrid 1.16.0-hotfix.1

On February 6, 2026 we released Apigee hybrid 1.16.0-hotfix.1.

Apply this hotfix with the following steps:

1. In your overrides file, update the image.url and image.tag properties of ao and mart to version 1.16.0-hotfix.1:

   ao:
     image:
       url: "gcr.io/apigee-release/hybrid/apigee-operators"
       tag: "1.16.0-hotfix.1"
   
   mart:
     image:
       url: "gcr.io/apigee-release/hybrid/apigee-mart-server"
       tag: "1.16.0-hotfix.1"
   

2. Install the hotfix release for Apigee operators, beginning with a dry run:

   helm upgrade operator apigee-operator/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     -f overrides.yaml \
     --dry-run=server
   

3. If the dry run is successful, install the hotfix release for Apigee operators:

   helm upgrade operator apigee-operator/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     -f overrides.yaml
   

4. Install the hotfix release for your organization, beginning with a dry run:

   helm upgrade $ORG_NAME apigee-org/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     -f overrides.yaml \
     --dry-run=server
   

5. If the dry run is successful, install the hotfix release for your organization:

   helm upgrade $ORG_NAME apigee-org/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     -f overrides.yaml
   

6. Verify the organization chart by checking the state:

   kubectl -n APIGEE_NAMESPACE get apigeeorg
   

7. Install the hotfix release for your environment, beginning with a dry run:

   helm upgrade ENV_RELEASE_NAME apigee-env/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     --set env=$ENV_NAME \
     -f overrides.yaml \
     --dry-run=server
   

8. If the dry run is successful, install the hotfix release for your environment:

   helm upgrade ENV_RELEASE_NAME apigee-env/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     --set env=$ENV_NAME \
     -f overrides.yaml
   

9. Verify the environment chart by checking the state:

   kubectl -n APIGEE_NAMESPACE get apigeeenv
   

Fixed

Fixed in this release

Announcement

hybrid v1.16.0

On December 19, 2025 we released an updated version of the Apigee hybrid software, 1.16.0.

• For information on upgrading, see Upgrading Apigee hybrid to version v1.16.
• For information on new installations, see The big picture.

Feature

Seccomp Profiles

Apigee Hybrid now offers the capability to apply Seccomp Profiles to your runtime components, significantly enhancing the security posture of your deployment.

This feature allows Apigee administrators and security teams to restrict the system calls (syscalls) a containerized process can make to the host's kernel. By limiting a container to only the necessary syscalls, you can:

• Enhance Security: Mitigate the risk of container breakouts and privilege escalation.
• Enforce Least Privilege: Ensure components only have access to the exact system calls required for their operation.
• Meet Compliance: Provide a critical control for meeting stringent security compliance requirements.

Seccomp profiles are not enabled by default. To enable the feature, see Configure Seccomp profiles for pod security.

Feature

apigee-guardrails service account

In v1.16.0, Apigee Hybrid introduces an apigee-guardrails Google IAM service account. This is used by the apigee-operator chart during initial installation to check that all needed APIs are enabled in your project.

See:

• Diagnosing issues with guardrails
• About service accounts: apigee-guardrails
• create-service-account
• Upgrading to Apigee hybrid to version 1.16
• Installation Part 2: Step 4: Create service accounts
• Installation Part 2: Step 5: Set up service account authentication

Change

UDCA component removed

In Apigee hybrid v1.16, the Unified Data Collection Agent (UDCA) component has been removed. The responsibilities of sending analytics, trace, and deployment status data to the Apigee control plane are now handled using a Google Cloud Pub/Sub based data pipeline. Using the Pub/Sub based data pipeline has been the default data collection mechanism since Apigee hybrid v1.14.0.

Change

Support for cert-manager release 1.18 and 1.19

Apigee hybrid v1.16 supports cert-manager release 1.18 and 1.19.

Fixed

Fixed in this release

Fixed

Fixed since last minor release

Security

Fixed in this release

Security

Fixed since last minor release

Announcement

hybrid v1.15.1

On October 10, 2025 we released an updated version of the Apigee hybrid software, 1.15.1.

• For information on upgrading, see Upgrading Apigee hybrid to version 1.15.
• For information on new installations, see The big picture.

Feature

Recurring, top-up, and setup fees for Apigee hybrid monetization

Apigee hybrid now supports recurring, top-up, and setup fees for monetization. For information see Enabling monetization for Apigee hybrid.

Feature

Apigee policies for LLM/GenAI workloads

Apigee hybrid now supports the following Apigee policies with support for LLM/GenAI workloads.

• SemanticCacheLookup policy
• SemanticCachePopulate policy
• SanitizeUserPrompt
• SanitizeModelResponse

The Apigee semantic caching policies enable intelligent response reuse based on semantic similarity. Using these policies in your Apigee API proxies can minimize redundant backend API calls, reduce latency, and lower operational costs. With this release, the semantic caching policies support URL templating, enabling the use of variables for AI model endpoint values.

The Model Armor policies protect your AI applications by sanitizing user prompts to and responses from large language models (LLMs). Using these policies in your Apigee API proxies can mitigate the risks associated with LLM usage by leveraging Model Armor to detect prompt injection, prevent jailbreak attacks, apply responsible AI filters, filter malicious URLs, and protect sensitive data.

For more information on using these policies in your Apigee API proxies, see:

• Get started with semantic caching policies
• Get started with Apigee Model Armor policies

Fixed

Security

Change

Documentation change

The following documents have been changed or introduced to align the Apigee hybrid installation guides with the supported methods for service account authentication:

• Service account authentication methods in Apigee hybrid - A new overview topic for service account authentication.
• Storing service account keys in Kubernetes secrets - A new topic.
• Step 4: Create service accounts - Rewritten to accommodate all supported methods of service account authentication.
• Step 5: Set up service account authentication - A new topic on configuring authentication after creating service accounts.
• Step 7: Create the overrides and Step 11: Install Apigee hybrid Using Helm - Topics revised to provide templates, examples, and procedures for each supported type of service account authentication.
• Step 11(Optional): Configure Workload Identity - Topic removed. The procedures are included in Step 11: Install Apigee hybrid Using Helm: WIF for GKE

Announcement

hybrid v1.14.3

On October 7, 2025 we released an enhancement to Apigee hybrid version 1.14.3, recurring, top-up, and setup fees for Apigee hybrid monetization.

• For complete information on the contents of the v1.14.3 release, see Apigee hybrid v1.14.3 release notes.

Feature

Recurring, top-up, and setup fees for Apigee hybrid monetization

Apigee hybrid now supports recurring, top-up, and setup fees for monetization. For information see Enabling monetization for Apigee hybrid.

Fixed

Announcement

hybrid v1.14.3

On September 29, 2025 we released an updated version of the Apigee hybrid software, 1.14.3.

• For information on upgrading, see Upgrading Apigee hybrid to version 1.14.
• For information on new installations, see The big picture.

Fixed

Security

Announcement

Apigee Operator for Kubernetes for Apigee Hybrid (Preview)

On September 24, 2025 we released the Apigee Operator for Kubernetes for Apigee Hybrid 1.15.0 and newer.

The Apigee Operator for Kubernetes allows you to perform API management tasks, such as defining API products and operations, using Kubernetes tools. This preview release allows you to integrate this capability with your Apigee hybrid (v1.15.0 or newer) installation.

For more information, see:

• Apigee Operator for Kubernetes overview
• Install the Apigee Operator for Kubernetes for Apigee hybrid

Announcement

hybrid v1.13.4

On July 9, 2025 we released an updated version of the Apigee hybrid software, 1.13.4.

• For information on upgrading, see Upgrading Apigee hybrid to version 1.13.
• For information on new installations, see The big picture.

Fixed

Security

Announcement

hybrid v1.15.0

On June 4, 2025 we released an updated version of the Apigee hybrid software, 1.15.0.

• For information on upgrading, see Upgrading Apigee hybrid to version 1.15.
• For information on new installations, see The big picture.

Feature

Large message payload support in Apigee hybrid

Apigee now supports message payloads up to 30MB. You configure support for large message payloads in Apigee hybrid for individual environments or for your whole installation. See Configure large message payload support in Apigee hybrid.

Fixed

Security

Fixed in this release

Security

Fixed since last minor release

Announcement

On May 29, 2025 we announced the shutdown schedule for the Apigee Classic UI.

Deprecated

The Apigee Classic UI will be shutdown as of August 29, 2025.

This is the final phase of moving Apigee to the Google Cloud console. Apigee in the Google Cloud console gives you the ability to manage all of your Apigee functionality in one place.

To prepare for the shutdown of the Apigee Classic UI, familiarize yourself with the new Apigee UI in Google Cloud console by reviewing UI overview.

See Apigee Classic UI shutdown for details on shutdown dates and exception request.

Announcement

hybrid 1.14.2-hotfix.1

On May 16, 2025 we released an updated version of the Apigee hybrid software, 1.14.2-hotfix.1.

Apply this hotfix with the following steps:

1. Download the apigee-org and apigee-env charts with the 1.14.2-hotfix.1 version tag:

   export CHART_REPO=oci://us-docker.pkg.dev/apigee-release/apigee-hybrid-helm-charts
   export CHART_VERSION=1.14.2-hotfix.1
   helm pull $CHART_REPO/apigee-env --version $CHART_VERSION --untar
   helm pull $CHART_REPO/apigee-org --version $CHART_VERSION --untar
   

2. Optional: Perform this step if you need to allow use of the allOf combinator along with setting additionalProperties: true in your OAS spec. See fixed bug 393615439.

   Add the following stanza to your overrides.yaml:

   runtime:
     cwcAppend:
       conf_message-processor-communication_oas.disable.resolve.combinator: true
   

3. Install the hotfix release:

   1. Update the apigee-env chart with the helm upgrade command and your current overrides file for each environment in your Apigee org:

      Dry run:

      helm upgrade ENV_RELEASE_NAME apigee-env/ \
      --namespace APIGEE_NAMESPACE \
      --set env=ENV_NAME \
      --atomic \
      -f OVERRIDES_FILE \
      --dry-run=server
      

      • ENV_RELEASE_NAME is a name used to keep track of installation and upgrades of the apigee-env chart. This name must be unique from the other Helm release names in your installation. Usually this is the same as ENV_NAME. However, if your environment has the same name as your environment group, you must use different release names for the environment and environment group, for example dev-env-release and dev-envgroup-release. For more information on releases in Helm, see Three big concepts in the Helm documentation.
      • APIGEE_NAMESPACE is your installation's namespace. The default is apigee.
      • ENV_NAME is the name of the environment you are upgrading.
      • OVERRIDES_FILE is your edited overrides file.

      Install the changes:

      helm upgrade ENV_RELEASE_NAME apigee-env/ \
      --namespace APIGEE_NAMESPACE \
      --set env=ENV_NAME \
      --atomic \
      -f OVERRIDES_FILE

   2. Update the apigee-org chart:

      Dry run:

      helm upgrade ORG_NAME apigee-org/ \
      --namespace APIGEE_NAMESPACE \
      -f OVERRIDES_FILE \
      --dry-run=server

      Install the changes:

      helm upgrade ORG_NAME apigee-org/ \
      --namespace APIGEE_NAMESPACE \
      -f OVERRIDES_FILE

4. Verify the installation:

   Ensure runtime and udca pods are up and running by checking their state:

   kubectl -n APIGEE_NAMESPACE get pods -l app=apigee-runtime

   kubectl -n APIGEE_NAMESPACE get pods -l app=apigee-udca

• For information on upgrading, see Upgrading Apigee hybrid to version 1.14.
• For information on new installations, see The big picture.

Fixed

conf_message-processor-communication_oas.disable.resolve.combinator = true

Security