diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7d891f8779ea..6f739056c2d6 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -50,13 +50,17 @@ jobs:
         with:
           go-version: "1.17"
 
+      - name: Get runner image
+        id: runner_image
+        run: echo "os=${ImageOS}" >> "$GITHUB_OUTPUT"
+
       - name: Cache deps
         uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         env:
           cache-name: cache-deps
         with:
           path: deps
-          key: ${{ runner.os }}-${{ env.cache-name }}-${{ matrix.os_name }}-${{ hashFiles('apisix-master-0.rockspec') }}
+          key: ${{ runner.os }}-${{ steps.runner_image.outputs.os }}-${{ env.cache-name }}-${{ matrix.os_name }}-${{ hashFiles('apisix-master-0.rockspec') }}
 
       - name: Extract test type
         shell: bash
@@ -183,7 +187,8 @@ jobs:
       - name: Linux Script
         env:
           TEST_FILE_SUB_DIR: ${{ matrix.test_dir }}
-        run: sudo -E ./ci/${{ matrix.os_name }}_runner.sh script
+        # sudo-rs (Ubuntu 26.04) ignores -E, so pass what the script needs explicitly
+        run: sudo -E env TEST_FILE_SUB_DIR="$TEST_FILE_SUB_DIR" ./ci/${{ matrix.os_name }}_runner.sh script
 
       - if: ${{ steps.cache-images.outputs.cache-hit != 'true' }}
         name: Save docker images
diff --git a/.github/workflows/cli.yml b/.github/workflows/cli.yml
index 5a2e5bd141b1..a5d544fa9b6f 100644
--- a/.github/workflows/cli.yml
+++ b/.github/workflows/cli.yml
@@ -41,13 +41,17 @@ jobs:
         with:
           submodules: recursive
 
+      - name: Get runner image
+        id: runner_image
+        run: echo "os=${ImageOS}" >> "$GITHUB_OUTPUT"
+
       - name: Cache deps
         uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         env:
           cache-name: cache-deps
         with:
           path: deps
-          key: ${{ runner.os }}-${{ env.cache-name }}-${{ matrix.job_name }}-${{ hashFiles('apisix-master-0.rockspec') }}
+          key: ${{ runner.os }}-${{ steps.runner_image.outputs.os }}-${{ env.cache-name }}-${{ matrix.job_name }}-${{ hashFiles('apisix-master-0.rockspec') }}
 
       - name: Linux launch common services
         run: |
diff --git a/.github/workflows/link-check.yml b/.github/workflows/link-check.yml
index a0f128e7762e..43c8b780ff0f 100644
--- a/.github/workflows/link-check.yml
+++ b/.github/workflows/link-check.yml
@@ -41,7 +41,7 @@ jobs:
       - name: Setup python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: '3.9'
+          python-version: '3.12'
 
       - name: Link check (critical, all files)
         run: |
diff --git a/.github/workflows/source-install.yml b/.github/workflows/source-install.yml
index 023aa5886a0c..b246eacc919c 100644
--- a/.github/workflows/source-install.yml
+++ b/.github/workflows/source-install.yml
@@ -52,13 +52,17 @@ jobs:
         with:
           submodules: recursive
 
+      - name: Get runner image
+        id: runner_image
+        run: echo "os=${ImageOS}" >> "$GITHUB_OUTPUT"
+
       - name: Cache deps
         uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         env:
           cache-name: cache-deps
         with:
           path: deps
-          key: ${{ runner.os }}-${{ env.cache-name }}-${{ matrix.os_platform }}-${{ hashFiles('apisix-master-0.rockspec') }}
+          key: ${{ runner.os }}-${{ steps.runner_image.outputs.os }}-${{ env.cache-name }}-${{ matrix.os_platform }}-${{ hashFiles('apisix-master-0.rockspec') }}
 
       - name: Install and start apisix on ${{ matrix.os_platform }}
         env:
diff --git a/apisix-master-0.rockspec b/apisix-master-0.rockspec
index 5a0137bc05f6..1e4b1e027640 100644
--- a/apisix-master-0.rockspec
+++ b/apisix-master-0.rockspec
@@ -53,7 +53,7 @@ dependencies = {
     "lua-resty-radixtree = 2.9.2-0",
     "lua-protobuf = 0.5.3-1",
     "lua-resty-openidc = 1.9.0-1",
-    "lua-resty-saml = 0.2.6",
+    "lua-resty-saml = 0.2.7",
     "luafilesystem = 1.8.0-1",
     "nginx-lua-prometheus-api7 = 1.0.0-1",
     "jsonschema = 0.9.13-0",
diff --git a/ci/backup-docker-images.sh b/ci/backup-docker-images.sh
index bc87987a1f6a..4679d9b8e4a2 100644
--- a/ci/backup-docker-images.sh
+++ b/ci/backup-docker-images.sh
@@ -23,7 +23,7 @@ mkdir docker-images-backup
 sum=$(cat ci/pod/docker-compose.$test_type.yml | grep image | wc -l)
 special_tag=$(cat ci/pod/docker-compose.$test_type.yml | grep image: | awk '{print $2}' | awk 'ORS=NR%"'$sum'"?" ":"\n"{print}')
 echo special: $special_tag
-openwhisk_tag="openwhisk/action-nodejs-v14:nightly openwhisk/standalone:nightly"
+openwhisk_tag="openwhisk/action-nodejs-v20:nightly openwhisk/standalone:7ef091c"
 echo
 echo special_tag: $special_tag
 echo openwhisk_tag: $openwhisk_tag
diff --git a/ci/common.sh b/ci/common.sh
index 4dfbde8beeb2..2dd78befec97 100644
--- a/ci/common.sh
+++ b/ci/common.sh
@@ -199,7 +199,7 @@ GRPC_SERVER_EXAMPLE_VER=20210819
 
 linux_get_dependencies () {
     apt update
-    apt install -y cpanminus build-essential libncurses5-dev libreadline-dev libssl-dev perl libpcre3 libpcre3-dev libpcre2-dev xz-utils redis-tools
+    apt install -y cpanminus build-essential libncurses5-dev libreadline-dev libssl-dev perl libpcre2-dev xz-utils redis-tools
     apt remove -y curl
     apt-get install -y libyaml-dev
     wget https://github.com/mikefarah/yq/releases/download/3.4.1/yq_linux_amd64 -O /usr/bin/yq && sudo chmod +x /usr/bin/yq
diff --git a/ci/free_disk_space.sh b/ci/free_disk_space.sh
index 462258eafc12..fd47b0af92d0 100644
--- a/ci/free_disk_space.sh
+++ b/ci/free_disk_space.sh
@@ -32,8 +32,12 @@ echo "Removing large directories and runtimes..."
 sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/.ghcup /usr/share/swift
 
 echo "Removing large packages and performing clean-up..."
-sudo apt-get remove -y '^aspnetcore-.*' '^dotnet-.*' '^llvm-.*' 'php.*' '^mongodb-.*' '^mysql-.*' \
-azure-cli google-chrome-stable firefox powershell mono-devel libgl1-mesa-dri google-cloud-sdk google-cloud-cli --fix-missing
+# apt-get refuses the whole removal if any named package is unknown, and the
+# preinstalled set differs between runner images, so only name installed ones
+dpkg-query -W -f='${db:Status-Abbrev} ${Package}\n' \
+    | awk '$1 == "ii" { print $2 }' \
+    | grep -E '^(aspnetcore-|dotnet-|llvm-|php|mongodb-|mysql-)|^(azure-cli|google-chrome-stable|firefox|powershell|mono-devel|libgl1-mesa-dri|google-cloud-sdk|google-cloud-cli)$' \
+    | xargs -r sudo apt-get remove -y --fix-missing
 sudo apt-get autoremove -y
 sudo apt-get clean
 
diff --git a/ci/init-plugin-test-service.sh b/ci/init-plugin-test-service.sh
index 71c63dcc67f2..ffe7f6d534c8 100755
--- a/ci/init-plugin-test-service.sh
+++ b/ci/init-plugin-test-service.sh
@@ -53,16 +53,20 @@ after() {
         --entity-type users \
         --entity-name admin
     # prepare openwhisk env
-    docker pull openwhisk/action-nodejs-v14:1.20.0
-    docker run --rm -d --name openwhisk -p 3233:3233 -p 3232:3232 -v /var/run/docker.sock:/var/run/docker.sock openwhisk/standalone:1.0.0
+    # nodejs:20 is the default runtime of this standalone build and is prewarmed;
+    # nodejs:14 is no longer offered
+    docker pull openwhisk/action-nodejs-v20:nightly
+    # the image bundles docker 18.06 (API 1.38), which Docker 29 refuses; pin
+    # the API version it claims so every docker call it spawns is accepted
+    docker run --rm -d --name openwhisk -e DOCKER_API_VERSION=1.40 -p 3233:3233 -p 3232:3232 -v /var/run/docker.sock:/var/run/docker.sock openwhisk/standalone:7ef091c
     docker exec -i openwhisk waitready
     docker exec -i openwhisk bash -c "wsk package create pkg"
-    docker exec -i openwhisk bash -c "wsk action update /guest/pkg/testpkg <(echo 'function main(args){return {\"hello\": \"world\"}}') --kind nodejs:14"
-    docker exec -i openwhisk bash -c "wsk action update test <(echo 'function main(args){return {\"hello\": \"test\"}}') --kind nodejs:14"
-    docker exec -i openwhisk bash -c "wsk action update test-params <(echo 'function main(args){return {\"hello\": args.name || \"test\"}}') --kind nodejs:14"
-    docker exec -i openwhisk bash -c "wsk action update test-statuscode <(echo 'function main(args){return {\"statusCode\": 407}}') --kind nodejs:14"
-    docker exec -i openwhisk bash -c "wsk action update test-headers <(echo 'function main(args){return {\"headers\": {\"test\":\"header\"}}}') --kind nodejs:14"
-    docker exec -i openwhisk bash -c "wsk action update test-body <(echo 'function main(args){return {\"body\": {\"test\":\"body\"}}}') --kind nodejs:14"
+    docker exec -i openwhisk bash -c "wsk action update /guest/pkg/testpkg <(echo 'function main(args){return {\"hello\": \"world\"}}') --kind nodejs:20"
+    docker exec -i openwhisk bash -c "wsk action update test <(echo 'function main(args){return {\"hello\": \"test\"}}') --kind nodejs:20"
+    docker exec -i openwhisk bash -c "wsk action update test-params <(echo 'function main(args){return {\"hello\": args.name || \"test\"}}') --kind nodejs:20"
+    docker exec -i openwhisk bash -c "wsk action update test-statuscode <(echo 'function main(args){return {\"statusCode\": 407}}') --kind nodejs:20"
+    docker exec -i openwhisk bash -c "wsk action update test-headers <(echo 'function main(args){return {\"headers\": {\"test\":\"header\"}}}') --kind nodejs:20"
+    docker exec -i openwhisk bash -c "wsk action update test-body <(echo 'function main(args){return {\"body\": {\"test\":\"body\"}}}') --kind nodejs:20"
 
 
     docker exec -i rmqnamesrv rm /home/rocketmq/rocketmq-4.6.0/conf/tools.yml
diff --git a/docs/en/latest/install-dependencies.md b/docs/en/latest/install-dependencies.md
index c8ed977de146..347c23929faa 100644
--- a/docs/en/latest/install-dependencies.md
+++ b/docs/en/latest/install-dependencies.md
@@ -37,7 +37,7 @@ title: Install Dependencies
 
 Run the following command to install Apache APISIX's dependencies on a supported operating system.
 
-Supported OS versions: Debian 11/12, Ubuntu 20.04/22.04/24.04, etc.
+Supported OS versions: Debian 11/12, Ubuntu 20.04/22.04/24.04/26.04, etc.
 
 Note that in the case of Arch Linux, we use `openresty` from the AUR, thus requiring a AUR helper. For now `yay` and `pacaur` are supported.
 
diff --git a/docs/zh/latest/install-dependencies.md b/docs/zh/latest/install-dependencies.md
index c2b713163963..4b8871f53def 100644
--- a/docs/zh/latest/install-dependencies.md
+++ b/docs/zh/latest/install-dependencies.md
@@ -37,7 +37,7 @@ title: 安装依赖
 
 在支持的操作系统上运行以下指令即可安装 Apache APISIX dependencies。
 
-支持的操作系统版本：Debian 11/12, Ubuntu 20.04/22.04/24.04 等。
+支持的操作系统版本：Debian 11/12, Ubuntu 20.04/22.04/24.04/26.04 等。
 
 注意，对于 Arch Linux 来说，我们使用 AUR 源中的 `openresty`，所以需要 AUR Helper 才能正常安装。目前支持 `yay` 和 `pacaur`。
 
diff --git a/utils/install-dependencies.sh b/utils/install-dependencies.sh
index cc901e4f6e14..f72aa0d0e6e6 100755
--- a/utils/install-dependencies.sh
+++ b/utils/install-dependencies.sh
@@ -63,25 +63,34 @@ function install_dependencies_with_yum() {
 function install_dependencies_with_apt() {
     # add OpenResty source
     sudo apt-get update
-    sudo apt-get -y install software-properties-common wget lsb-release gnupg patch
-    wget -qO - https://openresty.org/package/pubkey.gpg | sudo apt-key add -
+    sudo apt-get -y install wget lsb-release gnupg patch
+    sudo mkdir -p /etc/apt/keyrings
+    wget -qO - https://openresty.org/package/pubkey.gpg | sudo gpg --dearmor --yes -o /etc/apt/keyrings/openresty.gpg
+    sudo chmod 0644 /etc/apt/keyrings/openresty.gpg
     arch=$(uname -m | tr '[:upper:]' '[:lower:]')
     arch_path=""
     if [[ $arch == "arm64" ]] || [[ $arch == "aarch64" ]]; then
         arch_path="arm64/"
     fi
-    if [[ "${1}" == "ubuntu" ]]; then
-        sudo add-apt-repository -y "deb http://openresty.org/package/${arch_path}ubuntu $(lsb_release -sc) main"
-    elif [[ "${1}" == "debian" ]]; then
-        # add-apt-repository on Debian 12 writes an empty list file for a plain
-        # deb line, so the repository never makes it into apt
-        echo "deb http://openresty.org/package/${arch_path}debian $(lsb_release -sc) openresty" \
-            | sudo tee /etc/apt/sources.list.d/openresty.list
+    codename=$(lsb_release -sc)
+    repo_url="https://openresty.org/package/${arch_path}${1}"
+    # OpenResty publishes packages for a new Ubuntu release some time after it
+    # comes out (e.g. 26.04). Only openresty-zlib-dev and openresty-pcre-dev are
+    # needed from it, and they are self-contained under /usr/local/openresty,
+    # so fall back to the latest LTS repository it has.
+    if [[ "${1}" == "ubuntu" ]] && ! wget -q --spider "${repo_url}/dists/${codename}/Release"; then
+        codename=noble
     fi
+    component=main
+    if [[ "${1}" == "debian" ]]; then
+        component=openresty
+    fi
+    echo "deb [signed-by=/etc/apt/keyrings/openresty.gpg] ${repo_url} ${codename} ${component}" \
+        | sudo tee /etc/apt/sources.list.d/openresty.list
     sudo apt-get update
 
     # install some compilation tools
-    sudo apt-get install -y curl make gcc g++ cpanminus libpcre3 libpcre3-dev libpcre2-dev libyaml-dev unzip openresty-zlib-dev openresty-pcre-dev libxml2-dev libxslt-dev zlib1g-dev
+    sudo apt-get install -y curl make gcc g++ cpanminus libpcre2-dev libyaml-dev unzip openresty-zlib-dev openresty-pcre-dev libxml2-dev libxslt-dev zlib1g-dev
 }
 
 # Identify the different distributions and call the corresponding function
diff --git a/utils/linux-install-luarocks.sh b/utils/linux-install-luarocks.sh
index 4ddc42ddb312..61ee4e79117b 100755
--- a/utils/linux-install-luarocks.sh
+++ b/utils/linux-install-luarocks.sh
@@ -72,3 +72,9 @@ luarocks config variables.OPENSSL_DIR ${OPENSSL_PREFIX}
 luarocks config variables.OPENSSL_LIBDIR ${OPENSSL_PREFIX}/lib
 luarocks config variables.OPENSSL_INCDIR ${OPENSSL_PREFIX}/include
 luarocks config variables.YAML_DIR /usr
+
+# lrexlib-pcre needs PCRE1, which newer distributions (Ubuntu 26.04, Debian 13)
+# no longer ship; use the copy bundled with APISIX runtime instead.
+if [ -f "${OPENRESTY_PREFIX}/pcre/include/pcre.h" ]; then
+    luarocks config variables.PCRE_DIR "${OPENRESTY_PREFIX}/pcre"
+fi