- Added support for wildcard subdomains, multiple rate‑limit limits, HTTPS logging, auto‑generated keys, CORS enabled by default, and new OAuth2, Mashape Analytics, and IP whitelist/blacklist plugins.
- Extended Admin API with endpoints for plugin‑schema retrieval and node status; authentication plugins now return proper 401/405 responses and PATCH requests no longer overwrite partial plugin configs.
- Breaking change: SSL plugin no longer accepts a consumer ID; internal DAO fully refactored and schema self‑check added; numerous bug fixes and migration safety improvements.