Apache APISIX 2.13.0 LTS Release: New Features, Observability, Multi‑language Support, and Bug Fixes

Apache APISIX community released LTS version 2.13.0, improving stability and adding new observability, service discovery plugins, and a more complete multi‑language development ecosystem.

Feature Updates

API Exposure Change

Previously plugins could register APIs that were directly callable (e.g., jwt-auth ), which posed security risks because the API was not a routable entity. Starting with 2.13.0 the default behavior no longer exposes APIs; users must use the public-api plugin to bind an API to a route, gaining better visibility and full permission control.

Registered APIs have higher visibility and require explicit configuration to be effective.

APIs now share the same permission model as routes, allowing richer security options.

Observability Enhancements

Added a new opentelemetry tracing plugin that sends OpenTelemetry data to a configured collector. Example configuration:

plugin_attr:
  opentelemetry:
    resource:
      service.name: APISIX
      tenant.id: business_id
    collector:
      address: "127.0.0.1:4317"
    batch_span_processor:
      drop_on_queue_full: false
      max_queue_size: 6
      batch_timeout: 2
      inactive_timeout: 1
      max_export_batch_size: 2

Enable tracing on a specific route:

curl http://127.0.0.1:9080/apisix/admin/routes/1  -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '{
    "methods": ["GET"],
    "uris": ["/uid/*"],
    "plugins": {
        "opentelemetry": {
            "sampler": {"name": "always_on"}
        }
    },
    "upstream": {
        "type": "roundrobin",
        "nodes": {"127.0.0.1:8089": 1}
    }
}'

Requests matching the route will report tracing data to the collector.

Two new log plugins were added: clickhouse-logger for sending logs to ClickHouse and loggly for sending logs to Loggly via syslog or HTTP. Example configurations are provided in the release notes.

Improved Multi‑language Development

Full support for Wasm (Proxy Wasm SDK) across request/response phases, making 2.13.0 the first LTS version with Wasm. Ongoing work on RPC‑based multi‑language plugins includes Python Runner 0.2.0 and upcoming Go Runner 0.3.0.

Bug Fixes

Fix tracing authentication failures for SkyWalking and OpenTelemetry.

Correct log‑rotate hour‑boundary behavior.

Deepcopy now copies metatables.

Proper handling of duplicate JSON keys in request‑validate.

Prevent duplicate metric calculation in prometheus plugin.

Fix method override when conf.headers is missing in proxy-rewrite.

Resolve first‑rule failure in traffic-split.

Handle etcd resync_delay timeout correctly.

Resolve proto definition conflicts.

Fix limit-count reset behavior.

Correct counting of plugin-metadata and global-rule in Admin API.

Preserve labels when merging routes and services.

Additional Details

grpc-transcode now supports .pb files with imported proto definitions.

Kubernetes configuration can now provide upstream nodes.

New csrf plugin for cross‑site request forgery protection.

New mocking plugin for generating test data.