Lisbon release notes

Update

To update an existing API Builder application, execute the following command from within the application directory:

npm update

To update the API Builder CLI, execute the following command:

axway pm update

Features

• #5125: Add “Home” link functionality to Axway logo and API Builder text in the header
• #5180: Support the user in managing OAuth2 credentials for devops
• #5264: Provide clearer and more explicit HTTP authentication.

Fixes

• #5337: Limit graph scaling in flow editor
• #5404: RegEx DoS attack on markdown rendering engine
• #5412: OAuth 2.0 toast is not showing
• #5419: Deprecate web routes
• #5441: Create model with name containing invalid character will kill the server

Release notes

• #5125: Previously, the the Axway logo and the API Builder text in the header were not interactable. Now, they act as hyperlinks and take you to the Summary page.
• #5180: Previously, the credential cards did not provide user access to refresh and obtain tokens. Now, you can refresh and obtain tokens from the credential cards.
• #5264: Previously, requests to non-existing resources on apiPrefix did not have authentication. Now, all requests to apiPrefix must pass authentication. Added config.accessControl settings to clarify authentication and ensure that HTTP authentication is applied to all paths bound on apiPrefix and that any path not on apiPrefix, be required to be explicitly public. This change deprecates the use of matchURL in authentication plugins and deprecates the configuration settings for APIKeyAuthPlugin and APIKeyAuthType. See deprecation [D010].
• #5337: Previously, it was possible to lose the flow in the flow editor while zooming in or out. Now, there is a limit to how far you can zoom.
• #5404: Previously, API Builder used appc-marked for its markdown engine. Now, it is using marked.
• #5412: Previously, the toast notification was shown very fast and was not visible to the user. Now, the notification is clearly visible.
• #5419: Previously, API Builder registered all built-in rendering engines on startup by default. Now, API Builder Web feature (routes in web/routes folder) has been deprecated so those rendering engines are not registered by default but only if the web/routes folder exists. See deprecation [D011].
• #5441: Previously, creating a model having a name with a single quote would succeed to create the model, but would cause the application to fail to restart. Now, single quotes are escaped.

Deprecations

These are the deprecations introduced in this release. Click here for a list of all deprecations.

• [D010] perURLAuthentication: authentication has changed to make all paths secure, and public paths must be explicitly declared.
• [D011] API Builder Web: API Builder Web is deprecated and will be removed in a future major version. If you are currently using Web Routes, consider switching to another modern web application architecture for your front end that consumes API Builder APIs.

Updated modules

• @axway/api-builder-runtime@4.6.12
• @axway/api-builder-admin@1.5.14
• @axway/api-builder@4.5.1

Updated plugins

• @axway/api-builder-plugin-fn-swagger@2.1.1

Previous releases