chore: upgrade api7 and gateway to v3.9.18

[jarvis9443]

Chart release for API7 EE 3.9.18.

3.9.18 is a patch on the 3.9 line and 3.10 is the latest line, so this targets release/3.9 rather than main.

Version bumps

chart	version	appVersion
api7	3.9.4 → 3.9.5	3.9.17 → 3.9.18
gateway	3.9.8 → 3.9.9	3.9.17 → 3.9.18

Chart patches are each line's own counter, per the numbering rule in AGENTS.md. Image tags move to v3.9.18 (dashboard, dp_manager, file_server, developer_portal) and 3.9.18 (gateway). ingress-controller and developer-portal-fe are left at their existing versions so CR_SKIP_EXISTING skips them.

Structural change

Adds developer_portal_configuration.security.ssrf_protection to charts/api7/values.yaml, mirroring what the 3.10.5 chart exposed for the same Control Plane change (#341). 3.9.18 installs the SSRF guard in the developer portal process, so security.ssrf_protection has to be reachable from the chart or the setting has no effect there.

The default stays enable: false, so a default render is unchanged. Verified that it renders in both states, and that the existing dashboard_configuration.security block (trusted_proxies, ip_restriction) is untouched — the two security: keys sit under different parents.

Not ported

The other Control Plane chart changes in the v3.9.17..v3.9.18 range — extraInitContainers, the file server nodePort example, and the connection max-lifetime comment — came from reconciling the upstream copy against this chart and are already present here. The gateway's conf/config-default.yaml did not change in this range, so the gateway chart needs no structural update.

Validation

helm lint passes on both charts, and the rendered gateway config.yaml was extracted from the ConfigMap and run through apisix init on api7/api7-ee-3-gateway:3.9.18, which validates it against the real config schema. README.md regenerated with make helm-docs.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 45039b9c-603e-4fc2-8f85-9f77da6a4f00

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[jarvis9443]

The Helm chart job is red because three of the v3.9.18 images are not on Docker Hub yet, not because of anything in this diff.

ct install deploys the chart into kind, so it pulls the tags the chart pins:

Failed to pull image "api7/api7-ee-3-integrated:v3.9.18":
  docker.io/api7/api7-ee-3-integrated:v3.9.18: not found
Failed to pull image "api7/api7-ee-developer-portal:v3.9.18": ... not found

Current publication state on Docker Hub:

image	v3.9.18
api7-ee-3-gateway	published (3.9.18)
api7-ee-dp-manager	published
api7-ee-3-integrated	missing
api7-ee-developer-portal	missing
api7-ee-file-server	missing

helm lint and the chart-rendering steps all pass; the rendered gateway config.yaml was also validated through apisix init on the real api7/api7-ee-3-gateway:3.9.18 image.

So this job cannot go green until the remaining three images are pushed. Once they are, a rerun should be enough — no change to the chart is needed.

[jarvis9443]

All five v3.9.18 images are on Docker Hub now (integrated, dp-manager, developer-portal, file-server and gateway), so the blocker above is cleared. Reran the failed job — no change to the chart.