chore: upgrade api7 and gateway to v3.9.21

[AlinsRan]

Chart release for API7 EE v3.9.21 on the 3.9 maintenance line.

Version bumps

chart	version	appVersion
charts/api7	3.9.9 -> 3.9.10	3.9.20 -> 3.9.21
charts/gateway	3.9.13 -> 3.9.14	3.9.20 -> 3.9.21

Image tags:

• charts/api7/values.yaml: dashboard.image.tag, dp_manager.image.tag, developer_portal.image.tag, file_server.image.tag -> v3.9.21
• charts/gateway/values.yaml: apisix.image.tag -> 3.9.21

openapi-to-mcp sidecar 1.0.5 -> 1.0.6

charts/gateway/values.yaml openapiToMcp.image.tag is bumped to 1.0.6 for two reasons:

• it matches the version the control plane pins for this release: OPENAPI_TO_MCP_VERSION=1.0.6 in EE v3.9.21's VERSION.
• it clears two HIGH libssl3t64 CVEs — CVE-2026-14456 and CVE-2026-45447 — that are present in both 1.0.4 and 1.0.5 and are fixed by 1.0.6's rebuilt base image. A version pin bump alone would not have cleared them; the base image had to be rebuilt.

1.0.6 also supports the per-route cache_enabled / cache_ttl options sent by gateway #2261.

Removed dashboard_configuration.console.addr

The control plane dropped this key from its own chart values in control-plane #3011: on this line the dashboard binary serves the console SPA itself, so there is no Node process on 127.0.0.1:3000 and the key is dead config. The rest of the console: block (hybrid_mode, sentry) is unchanged.

Gateway shared dict plugin-saml-auth-replay: no chart change needed

Gateway v3.9.21 adds plugin-saml-auth-replay: 10m to nginx_config.http.lua_shared_dict in conf/config-default.yaml (saml-auth assertion replay). The chart carries its own explicit apisix.http.luaSharedDict map, so the question was whether that map replaces the image default or is merged onto it.

Verified against the release image rather than assumed — the chart's rendered ConfigMap config.yaml (which does not contain plugin-saml-auth-replay) was run through apisix init:

$ docker run --rm --entrypoint sh -v $PWD/config.yaml:/usr/local/apisix/conf/config.yaml \
    api7/api7-ee-3-gateway:3.9.21 -c 'apisix init && grep -n saml-auth-replay /usr/local/apisix/conf/nginx.conf'
142:    lua_shared_dict plugin-saml-auth-replay 10m;

APISIX deep-merges the chart's partial map onto config-default.yaml: the new dict is present in the generated nginx.conf without any chart change, while chart-set entries still win (prometheus-metrics renders at the chart's 128m). The chart's luaSharedDict list is therefore an override list, not a replacement, which is also why it can omit plugin-ai-rate-limiting today and still work.

Validation

• helm lint charts/api7 and helm lint charts/gateway — both pass.
• helm template for both charts; the api7 dashboard ConfigMap renders console: {hybrid_mode, sentry} with no addr.
• openapiToMcp.enabled=true renders the sidecar at api7/openapi-to-mcp:1.0.6; unset renders no sidecar.
• Rendered gateway config accepted by apisix init in the 3.9.21 image (exit 0).
• READMEs regenerated with make helm-docs; only charts/api7 and charts/gateway change.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 4b0aab61-6580-4e18-9624-abe519b1e6ca

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}