---
schema_version: "1"
id: 9ac0c8302df5f6ef5022554e82e7e2ff03155ae05d414808d8b18cd68d70309f
title: Omni Gateway Policy Development Kit (PDK) Release Notes
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/release-notes/pdk/pdk-release-notes.md
canonical_url: https://docs.mulesoft.com/release-notes/pdk/pdk-release-notes
source_site: docs.mulesoft.com
content_type: documentation
content_hash: bf58cefb9193e8c4569b76e4c4d438fd72e73c6d144db35e405ba8d9751f8f65
description: MuleSoft Documentation Site
latest: true
---
---
product: Release Notes
version: master
---

# Omni Gateway Policy Development Kit (PDK) Release Notes

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

## 1.10.0

**August 20, 2026**

### What’s New

- The Cache library now supports the Least Recently Used (LRU) eviction strategy and a time-to-live
  (TTL) for cache entries. Previously, the cache supported only first-in, first-out (FIFO) eviction.

  See
  [Configure a Cache Eviction Strategy](https://docs.mulesoft.com/pdk/latest/policies-pdk-configure-features-caching#configure-a-cache-eviction-strategy)
  and
  [Configure a Cache TTL](https://docs.mulesoft.com/pdk/latest/policies-pdk-configure-features-caching#configure-a-cache-ttl).

- For policies generated with PDK 1.10.0, you can now run a single integration test by passing the
  `TEST` parameter to the `make test` command.

  See
  [Run an Integration Test](https://docs.mulesoft.com/pdk/latest/policies-pdk-integration-tests#run-integration-test).

- For policies generated with PDK 1.10.0, policy projects now register an Omni Gateway automatically
  when no `registration.yaml` file is provided for the debugging playground or integration tests.

  See
  [Debugging Custom Policies with the PDK Debugging Playground](https://docs.mulesoft.com/pdk/latest/policies-pdk-debug-local)
  and [Writing Integration Tests](https://docs.mulesoft.com/pdk/latest/policies-pdk-integration-tests).

- For policies generated with PDK 1.10.0, the debugging playground `docker-compose` configuration is
  now parameterized with the same environment variables as `pdk-test`.

- For new policies generated with PDK 1.10.0, PDK now skips republishing a policy definition that is
  unchanged from the published version and reuses the existing definition when using `make publish`
  or `make release`.

  See
  [Skip Republishing an Unchanged Definition](https://docs.mulesoft.com/pdk/latest/policies-pdk-publish-policies#skip-republishing-an-unchanged-definition).

- The Token Introspection library now provides a standalone RFC 9728 protected resource metadata
  (PRM) builder.

  See
  [Using OAuth 2.0 Token Introspection Library Functions](https://docs.mulesoft.com/pdk/latest/policies-pdk-configure-features-token-introspection).

- PDK unit testing now supports policy chaining and setting the log level on test constructors.

- The WebSocket library now supports HTTP calls and timer ticks within WebSocket flows, and you can
  now share references to structs from the `configure` context with WebSocket filters.

  See [Support WebSocket APIs](https://docs.mulesoft.com/pdk/latest/policies-pdk-configure-features-websocket).

  > [!NOTE] The WebSocket library is currently in open beta.

- PDK script evaluation setup is now optimized.

### Fixed Issues

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>HTTP calls triggered after awaiting timer ticks are now correctly routed to the request context instead of the root context handler.</p></div></div></td><td><div><div><p>W-23652660</p></div></div></td></tr><tr><td><div><div><p>JSON string escape validation now matches the RFC 8259 specification.</p></div></div></td><td><div><div><p>W-23510751</p></div></div></td></tr><tr><td><div><div><p>The Contracts library now includes improved internal error handling and a retry mechanism for the contracts collector.</p></div></div></td><td><div><div><p>W-23460693</p></div></div></td></tr><tr><td><div><div><p>The WebSocket <code>FilterBuilder</code> now provides the <code>build()</code> method for response-only filters and supports <code>on_done</code> chaining for response-only filters.</p></div></div></td><td><div><div><p>W-23048381</p></div></div></td></tr></tbody></table>

## 1.9.2

**July 21, 2026**

### What’s New

- Third-party testing and development dependencies are now updated to address security
  vulnerabilities and unmaintained-crate advisories. These dependencies affect only the PDK testing
  framework and aren’t included in the compiled WASM of policies.

## 1.9.1

**July 15, 2026**

### What’s New

- PDK updated third-party dependencies to address reported security vulnerabilities.

- The XML Validator and JWT libraries are now gated behind Cargo features so you can remove them
  from the compiled WASM of policies that don’t require the libraries. Both features are still
  enabled by default.

  To disable them, see
  [Configure PDK Features in Cargo.toml](https://docs.mulesoft.com/pdk/latest/policies-pdk-create-project#configure-pdk-features).

- PDK now provides the `jwt-fips` feature to select the FIPS-compliant JWT backend, which delegates
  cryptography to the proxy-wasm host instead of bundling native RustCrypto.

  To enable `jwt-fips`, see
  [FIPS-Compliant JWT](https://docs.mulesoft.com/pdk/latest/policies-pdk-configure-features-jwt#fips-compliant-jwt).

## 1.9.0

**June 18, 2026**

### What’s New

- PDK now supports FIPS 140-3 compliance to enable use of FIPS-compliant cryptographic modules.

  Add the `--fips` flag to PDK CLI `create` command to create a FIPS-compliant policy project. For
  more information, see
  [Create a New Policy Project](https://docs.mulesoft.com/pdk/latest/policies-pdk-create-project#create-a-new-policy-project).

- PDK project folders now include an AGENTS.md file to provide guidance for AI coding agents such as
  Claude Code, GitHub Copilot, or other AI assistants.

  See [AGENTS.md](https://docs.mulesoft.com/pdk/latest/policies-pdk-create-project-split#agents-md).

- PDK now provides the WebSocket library to write policies for WebSocket APIs.

  See [Support WebSocket APIs](https://docs.mulesoft.com/pdk/latest/policies-pdk-configure-features-websocket).

  > [!NOTE] The WebSocket library is currently in open beta.

- PDK unit now provides support for testing WebSocket policies.

  See [Test WebSocket Policies](https://docs.mulesoft.com/pdk/latest/policies-pdk-unit#test-websocket-policies).

- PDK unit testing now supports testing for any policy created with `proxy-wasm`. Use PDK Unit to
  test non-PDK policies before migrating them to PDK.

  See
  [Enable pdk-unit for Non-PDK Policies](https://docs.mulesoft.com/pdk/latest/policies-pdk-unit#enable-pdk-unit-for-non-pdk-policies).

- \* PDK unit testing now better matches Envoy’s proxy-wasm host behavior, with added validations
  and bug fixes.

- The PDK unit testing default chunk size increased from 3 bytes to 30KB to align with Envoy’s
  behavior and reduce event overhead when testing policies with regular-sized payloads.

### Fixed Issues

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>The JWT library no longer panics due to an unguarded unwrap.</p></div></div></td><td><div><div><p>W-22691626</p></div></div></td></tr><tr><td><div><div><p>Duplicated names in <code>config.rs</code> no longer occur in valid GCL.</p></div></div></td><td><div><div><p>W-22710786</p></div></div></td></tr></tbody></table>

## 1.8.0

**April 21, 2026**

### What’s New

- PDK now provides the `PDK-Unit` testing framework to quickly test policies without deploying to an
  Omni Gateway.

  See [Writing Unit Tests](https://docs.mulesoft.com/pdk/latest/policies-pdk-unit).

- PDK now automatically applies outbound policies to the service in the PDK debugging playground.

- The `Clock` and `Timer` now expose the `now` method that returns the current SystemTime to provide
  more control than `SystemTime::now` for unit testing.

  See
  [Configuring Delayed, Periodic, and Synchronous Functions](https://docs.mulesoft.com/pdk/latest/policies-pdk-configure-features-timer).

- PDK now provides the Spike Control library for implementing spike arrest and smoothing rate
  limiting patterns. For more information, see:

  - [Using Spike Control Library Functions](https://docs.mulesoft.com/pdk/latest/policies-pdk-configure-features-spike-control)

  - [Spike Policy Example](https://github.com/mulesoft/pdk-custom-policy-examples/blob/1.8.0/spike/README.md)

- PDK now provides the XML Validator library to validate and process XML payloads with configurable
  rules. For more information, see:

  - [Using XML Validator Library Functions](https://docs.mulesoft.com/pdk/latest/policies-pdk-configure-features-xml-validator)

  - [XML Validation Policy Example](https://github.com/mulesoft/pdk-custom-policy-examples/blob/1.8.0/xml-validation/README.md)

- PDK now provides the JSON Validator library to validate and process JSON payloads with
  configurable validation rules. For more information, see:

  - [Using JSON Validator Library Functions](https://docs.mulesoft.com/pdk/latest/policies-pdk-configure-features-json-validator)

  - [JSON Validation Policy Example](https://github.com/mulesoft/pdk-custom-policy-examples/blob/1.8.0/json-validation/README.md)

- Custom Policies can now read and write to headers and bodies at the same time by using the
  `enable_stop_iteration` feature.

  See
  [Reading and Writing Request Headers and Bodies with Stop Iteration](https://docs.mulesoft.com/pdk/latest/policies-pdk-configure-features-headers-stop).

- The PDK Token Introspection Library now supports Microsoft Entra ID and the RFC 9728
  specification. The token validator now provides these methods for configuration:

  - `with_client_id`: Sets the client ID credential to talk with the introspection service.

  - `with_client_secret`: Sets the client secret credential to talk with the introspection service.

  - `with_protected_resource_metadata` Enables RFC 9728 protected resource discovery with the given
    authorization server URL.

  - `with_protected_resource_metadata_with_properties`: Enables RFC 9728 protected resource
    discovery with the given authorization server URL and additional metadata properties (such as
    `scopes_supported` or `bearer_methods_supported`).

    See
    [Using OAuth 2.0 Token Introspection Library Functions](https://docs.mulesoft.com/pdk/latest/policies-pdk-configure-features-token-introspection).

### Fixed Issues

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>PDK policies now properly handle distributed rate limiting quotas.</p></div></div></td><td><div><div><p>W-22108203</p></div></div></td></tr><tr><td><div><div><p>PDK message logging policies now properly resolve <code>dw::Core::--</code> expressions. <code>--</code> functions are supported only in Flex Gateway versions 1.2.0 or later.</p></div></div></td><td><div><div><p>W-21643871</p></div></div></td></tr></tbody></table>

## 1.7.0

**February 12, 2026**

### What’s New

- The name of the Anypoint CLI PDK plugin was changed from `anypoint-cli-pdk-plugin` to
  `anypoint-pdk-plugin`. To develop 1.7.0 policies, ensure you install the new plugin.

  See
  [Install the 1.7.0 Anypoint CLI PDK plugin](https://docs.mulesoft.com/pdk/latest/policies-pdk-upgrade-pdk#upgrade-anypoint-cli-pdk-plugin-earlier-1.7.0).

- The Anypoint CLI PDK Plugin now supports split model policies to enable you to update policy
  definitions and implementations independently.

  See [Create a Split Model Policy Project](https://docs.mulesoft.com/pdk/latest/policies-pdk-create-project-split).

- The JWT library now provides the functionality to create JWT tokens.

  See [Create a JWT Token](https://docs.mulesoft.com/pdk/latest/policies-pdk-configure-features-jwt#create-jwt-token).

- You can now send an early response during the HTTP response event to terminate the execution flow
  early.

  See
  [Stop Response Execution](https://docs.mulesoft.com/pdk/latest/policies-pdk-configure-features-stop#stop-response-execution).

- The IP-filter library now provides functionality to create allowlists or blocklists of IP
  addresses and CIDR ranges.

  See [Filter IP Addresses](https://docs.mulesoft.com/pdk/latest/policies-pdk-configure-features-ip-filter).

- The OAuth 2.0 library now provides functionality to validate incoming OAuth 2.0 with OAuth 2.0
  servers.

  See
  [Using OAuth 2.0 Token Introspection Library Functions](https://docs.mulesoft.com/pdk/latest/policies-pdk-configure-features-token-introspection).

### Fixed Issues

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>There is no longer inconsistent store creation behavior across Object Store v2 and in-memory or Redis backends for the Rate Limiting library.</p></div></div></td><td><div><div><p>W-20223396</p></div></div></td></tr><tr><td><div><div><p>There is no longer a type mismatch error when extracting JWT objects from Bearer tokens.</p></div></div></td><td><div><div><p>W-20435785</p></div></div></td></tr></tbody></table>

## 1.6.0

**November 18, 2025**

### What’s New

- PDK rust libraries are now hosted on [crates.io](https://crates.io/crates/pdk). You can now
  download the crates without a connection to Anypoint Platform. Creating, publishing, and releasing
  policies still requires Anypoint Platform connection.

  To upgrade your policies created before PDK v1.6.0, see
  [Upgrade Policies with Versions Earlier Than v1.6.0](https://docs.mulesoft.com/pdk/latest/policies-pdk-upgrade-pdk#upgrade-versions-earlier-1.6.0).

- The minimum Rust version is now v1.88.0 to meet dependency requirements.

  To update your policy’s Rust version, see
  [Upgrade a Policy’s Rust Version](https://docs.mulesoft.com/pdk/latest/policies-pdk-upgrade-pdk#anypoint-rust-version).

- PDK now uses `proxy_wasm` v0.2.4 to fix a memory leak in the crate.

### Fixed Issues

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>For Windows, the Makefile commands no longer fail due to the unrecognized command “export”. You must create a new policy to fix this issue.</p></div></div></td><td><div><div><p>W-19991510</p></div></div></td></tr><tr><td><div><div><p>Data storage Time To Live (TTL) values are now correctly converted from milliseconds to seconds when creating stores, and the maximum TTL upper bound of 30 days is now enforced.</p></div></div></td><td><div><div><p>W-20148366</p></div></div></td></tr></tbody></table>

## 1.5.0

**October 22, 2025**

### What’s New

- PDK now provides data storage functionality to store and retrieve data across workers and
  replicas. Data storage supports both in-memory and shared storage. For shared storage, stored data
  can persist across API Gateway restarts.

  See [Configuring Data Storage](https://docs.mulesoft.com/pdk/latest/policies-pdk-configure-features-data-storage).

- PDK now provides rate limiting functionality to control request rates. PDK rate limiting supports
  both single Flex Replicas and multi-replica clustered deployments.

  See [Rate Limiting Requests](https://docs.mulesoft.com/pdk/latest/policies-pdk-configure-features-rate-limiting).

## 1.4.1

**June 30, 2025**

### What’s New

- PDK policies are now built with Rust Version 1.87.0 and require the `wasm32-wasip1` target.

  To update your Device’s rust version and download the `wasm32-wasip1` target, see
  [Rust Requirements for Using PDK](https://docs.mulesoft.com/pdk/latest/policies-pdk-prerequisites#rust-requirements).

  To update your existing policy’s rust version and WASI target, see
  [Upgrade a Policy’s Rust Version](https://docs.mulesoft.com/pdk/latest/policies-pdk-upgrade-pdk#anypoint-rust-version)
  and
  [Upgrade a Policy’s WASI Crate](https://docs.mulesoft.com/pdk/latest/policies-pdk-upgrade-pdk#anypoint-wasi-crate).

- PDK can now develop Mule Gateway custom policies.

  See [Creating Mule Gateway PDK Policies](https://docs.mulesoft.com/pdk/latest/policies-pdk-mule-policies).

- PDK now provides the Policy Violation framework to report policy violations to Anypoint
  Monitoring.

  See [Reporting Policy Violations](https://docs.mulesoft.com/pdk/latest/policies-pdk-configure-features-violations).

- PDK now supports streaming payload bodies to read payload bodies larger than 1MB.

  See [Streaming Bodies](https://docs.mulesoft.com/pdk/latest/policies-pdk-configure-features-headers#streaming-bodies).

- PDK now provides these new example policies:

  - [Stream Payload Policy Example](https://github.com/mulesoft/pdk-custom-policy-examples/blob/1.4.0/stream-payload/README.md):
    Use the Stream Payload Policy as an example of how to
    [read payload bodies larger than 1MB](https://docs.mulesoft.com/pdk/latest/policies-pdk-configure-features-headers#streaming-bodies).

  - [DataWeave Policy Example](https://github.com/mulesoft/pdk-custom-policy-examples/blob/1.4.0/dataweave/README.md):
    Use the DataWeave Policy as an example of how to handle
    [custom DataWeave expressions](https://docs.mulesoft.com/pdk/latest/policies-pdk-configure-features-dataweave) in
    your custom policy.

    To learn more about example policies, see
    [Custom Policy Examples](https://docs.mulesoft.com/pdk/latest/policies-pdk-policy-templates).

- The `payload` DataWeave Schema parameter now supports the `xml` `mimeType`.

  See
  [DataWeave Expressions Schema Definition](https://docs.mulesoft.com/pdk/latest/policies-pdk-create-schema-definition#dataweave-expressions).

### Fixed Issues

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>HTTP calls from timers are now isolated from regular HTTP operations to avoid interference between them.</p></div></div></td><td><div><div><p>W-18121316</p></div></div></td></tr></tbody></table>

### Compatibility

Policies created with PDK might be compatible with Omni Gateway versions that aren’t compatible with
PDK’s integration testing framework. The Omni Gateway version used for testing doesn’t affect the
functionality of the policy when deployed to a different Omni Gateway version. See the following
table to ensure your Omni Gateway’s compatibility:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Component</th><th>Minimum Omni Gateway Version</th><th>Maximum Omni Gateway Version</th></tr></thead><tbody><tr><td><p>Policies</p></td><td><p>1.6.1</p></td><td><p>Latest</p></td></tr><tr><td><p>Testing Framework</p></td><td><p>1.6.1</p></td><td><p>Latest</p></td></tr></tbody></table>

## 1.3.0

**March 18, 2025**

### What’s New

- PDK now provides a Contract Validation library to help with creating custom client ID enforcement
  policies.

  See
  [Using Contracts Validation Library Functions](https://docs.mulesoft.com/pdk/latest/policies-pdk-configure-features-contracts).

- PDK is now built with Rust Version 1.83.0

- Integration testing performance is improved for `pdk-test` with desktop configurations.

- PDK can now develop outbound policies.

  See
  [Define Outbound Policies](https://docs.mulesoft.com/pdk/latest/policies-pdk-create-schema-definition#define-outbound-policies).

### Fixed Issues

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p><code>GrpcClient</code> now handles optional empty values instead of failing. Previously <code>GrpcClient</code> raised a <code>GrpcClientError::EmptyContent</code> error for some conditions with an empty optional field.</p></div></div></td><td><div><div><p>W-16486150</p></div></div></td></tr></tbody></table>

### Compatibility

Policies created with PDK might be compatible with Omni Gateway versions that aren’t compatible with
PDK’s integration testing framework. The Omni Gateway version used for testing doesn’t affect the
functionality of the policy when deployed to a different Omni Gateway version. See the following
table to ensure your Omni Gateway’s compatibility:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Component</th><th>Minimum Omni Gateway Version</th><th>Maximum Omni Gateway Version</th></tr></thead><tbody><tr><td><p>Policies</p></td><td><p>1.6.1</p></td><td><p>Latest</p></td></tr><tr><td><p>Testing Framework</p></td><td><p>1.6.1</p></td><td><p>Latest</p></td></tr></tbody></table>

## 1.2.0

**August 28, 2024**

### What’s New

- PDK now provides a CORS library to help create policies that process cross-origin requests.

  See [Using CORS Library Functions](https://docs.mulesoft.com/pdk/latest/policies-pdk-configure-features-cors).

- The PDK integration testing framework is improved for easier test configuration.

  See [Writing Integration Tests](https://docs.mulesoft.com/pdk/latest/policies-pdk-integration-tests).

- Incorrect conditional parameter schema configurations are now rejected when the policy is compiled
  instead of when the policy is deployed.

- Conditional parameters can now depend on `boolean` and `integer` parameters.

  See
  [Define Conditional Parameters](https://docs.mulesoft.com/pdk/latest/policies-pdk-create-schema-definition#define-conditional-parameters).

### Compatibility

Policies created with PDK might be compatible with Omni Gateway versions that aren’t compatible with
PDK’s integration testing framework. The Omni Gateway version used for testing doesn’t affect the
functionality of the policy when deployed to a different Omni Gateway version. See the following
table to ensure your Omni Gateway’s compatibility:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Component</th><th>Minimum Omni Gateway Version</th><th>Maximum Omni Gateway Version</th></tr></thead><tbody><tr><td><p>Policies</p></td><td><p>1.6.1</p></td><td><p>Latest</p></td></tr><tr><td><p>Testing Framework</p></td><td><p>1.6.1</p></td><td><p>Latest</p></td></tr></tbody></table>

## See Also

- [PDK Troubleshooting](https://docs.mulesoft.com/pdk/latest/policies-pdk-troubleshooting)

- [Known Issues](https://help.salesforce.com/s/issues)