From 956ff04281cd98ea16b1af66498def07ea5509fb Mon Sep 17 00:00:00 2001
From: Nic <qianyong@api7.ai>
Date: Thu, 22 Oct 2026 04:22:54 +0000
Subject: [PATCH 1/9] ci: make CI work on the Ubuntu 26.04 runner image

---
 .github/workflows/build.yml          |  6 +++++-
 .github/workflows/cli.yml            |  6 +++++-
 .github/workflows/link-check.yml     |  2 +-
 .github/workflows/source-install.yml |  6 +++++-
 ci/common.sh                         |  2 +-
 ci/free_disk_space.sh                |  8 +++++--
 utils/install-dependencies.sh        | 32 +++++++++++++++++++---------
 utils/linux-install-luarocks.sh      |  6 ++++++
 8 files changed, 51 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7d891f8779ea..f6c64a35744c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -50,13 +50,17 @@ jobs:
         with:
           go-version: "1.17"
 
+      - name: Get runner image
+        id: runner_image
+        run: echo "os=${ImageOS}" >> "$GITHUB_OUTPUT"
+
       - name: Cache deps
         uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         env:
           cache-name: cache-deps
         with:
           path: deps
-          key: ${{ runner.os }}-${{ env.cache-name }}-${{ matrix.os_name }}-${{ hashFiles('apisix-master-0.rockspec') }}
+          key: ${{ runner.os }}-${{ steps.runner_image.outputs.os }}-${{ env.cache-name }}-${{ matrix.os_name }}-${{ hashFiles('apisix-master-0.rockspec') }}
 
       - name: Extract test type
         shell: bash
diff --git a/.github/workflows/cli.yml b/.github/workflows/cli.yml
index 5a2e5bd141b1..a5d544fa9b6f 100644
--- a/.github/workflows/cli.yml
+++ b/.github/workflows/cli.yml
@@ -41,13 +41,17 @@ jobs:
         with:
           submodules: recursive
 
+      - name: Get runner image
+        id: runner_image
+        run: echo "os=${ImageOS}" >> "$GITHUB_OUTPUT"
+
       - name: Cache deps
         uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         env:
           cache-name: cache-deps
         with:
           path: deps
-          key: ${{ runner.os }}-${{ env.cache-name }}-${{ matrix.job_name }}-${{ hashFiles('apisix-master-0.rockspec') }}
+          key: ${{ runner.os }}-${{ steps.runner_image.outputs.os }}-${{ env.cache-name }}-${{ matrix.job_name }}-${{ hashFiles('apisix-master-0.rockspec') }}
 
       - name: Linux launch common services
         run: |
diff --git a/.github/workflows/link-check.yml b/.github/workflows/link-check.yml
index a0f128e7762e..43c8b780ff0f 100644
--- a/.github/workflows/link-check.yml
+++ b/.github/workflows/link-check.yml
@@ -41,7 +41,7 @@ jobs:
       - name: Setup python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: '3.9'
+          python-version: '3.12'
 
       - name: Link check (critical, all files)
         run: |
diff --git a/.github/workflows/source-install.yml b/.github/workflows/source-install.yml
index 023aa5886a0c..b246eacc919c 100644
--- a/.github/workflows/source-install.yml
+++ b/.github/workflows/source-install.yml
@@ -52,13 +52,17 @@ jobs:
         with:
           submodules: recursive
 
+      - name: Get runner image
+        id: runner_image
+        run: echo "os=${ImageOS}" >> "$GITHUB_OUTPUT"
+
       - name: Cache deps
         uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         env:
           cache-name: cache-deps
         with:
           path: deps
-          key: ${{ runner.os }}-${{ env.cache-name }}-${{ matrix.os_platform }}-${{ hashFiles('apisix-master-0.rockspec') }}
+          key: ${{ runner.os }}-${{ steps.runner_image.outputs.os }}-${{ env.cache-name }}-${{ matrix.os_platform }}-${{ hashFiles('apisix-master-0.rockspec') }}
 
       - name: Install and start apisix on ${{ matrix.os_platform }}
         env:
diff --git a/ci/common.sh b/ci/common.sh
index 4dfbde8beeb2..2dd78befec97 100644
--- a/ci/common.sh
+++ b/ci/common.sh
@@ -199,7 +199,7 @@ GRPC_SERVER_EXAMPLE_VER=20210819
 
 linux_get_dependencies () {
     apt update
-    apt install -y cpanminus build-essential libncurses5-dev libreadline-dev libssl-dev perl libpcre3 libpcre3-dev libpcre2-dev xz-utils redis-tools
+    apt install -y cpanminus build-essential libncurses5-dev libreadline-dev libssl-dev perl libpcre2-dev xz-utils redis-tools
     apt remove -y curl
     apt-get install -y libyaml-dev
     wget https://github.com/mikefarah/yq/releases/download/3.4.1/yq_linux_amd64 -O /usr/bin/yq && sudo chmod +x /usr/bin/yq
diff --git a/ci/free_disk_space.sh b/ci/free_disk_space.sh
index 462258eafc12..fd47b0af92d0 100644
--- a/ci/free_disk_space.sh
+++ b/ci/free_disk_space.sh
@@ -32,8 +32,12 @@ echo "Removing large directories and runtimes..."
 sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/.ghcup /usr/share/swift
 
 echo "Removing large packages and performing clean-up..."
-sudo apt-get remove -y '^aspnetcore-.*' '^dotnet-.*' '^llvm-.*' 'php.*' '^mongodb-.*' '^mysql-.*' \
-azure-cli google-chrome-stable firefox powershell mono-devel libgl1-mesa-dri google-cloud-sdk google-cloud-cli --fix-missing
+# apt-get refuses the whole removal if any named package is unknown, and the
+# preinstalled set differs between runner images, so only name installed ones
+dpkg-query -W -f='${db:Status-Abbrev} ${Package}\n' \
+    | awk '$1 == "ii" { print $2 }' \
+    | grep -E '^(aspnetcore-|dotnet-|llvm-|php|mongodb-|mysql-)|^(azure-cli|google-chrome-stable|firefox|powershell|mono-devel|libgl1-mesa-dri|google-cloud-sdk|google-cloud-cli)$' \
+    | xargs -r sudo apt-get remove -y --fix-missing
 sudo apt-get autoremove -y
 sudo apt-get clean
 
diff --git a/utils/install-dependencies.sh b/utils/install-dependencies.sh
index cc901e4f6e14..619df6fcea4f 100755
--- a/utils/install-dependencies.sh
+++ b/utils/install-dependencies.sh
@@ -63,25 +63,37 @@ function install_dependencies_with_yum() {
 function install_dependencies_with_apt() {
     # add OpenResty source
     sudo apt-get update
-    sudo apt-get -y install software-properties-common wget lsb-release gnupg patch
-    wget -qO - https://openresty.org/package/pubkey.gpg | sudo apt-key add -
+    sudo apt-get -y install wget lsb-release gnupg patch
+    sudo mkdir -p /etc/apt/keyrings
+    wget -qO - https://openresty.org/package/pubkey.gpg | sudo gpg --dearmor --yes -o /etc/apt/keyrings/openresty.gpg
     arch=$(uname -m | tr '[:upper:]' '[:lower:]')
     arch_path=""
     if [[ $arch == "arm64" ]] || [[ $arch == "aarch64" ]]; then
         arch_path="arm64/"
     fi
-    if [[ "${1}" == "ubuntu" ]]; then
-        sudo add-apt-repository -y "deb http://openresty.org/package/${arch_path}ubuntu $(lsb_release -sc) main"
-    elif [[ "${1}" == "debian" ]]; then
-        # add-apt-repository on Debian 12 writes an empty list file for a plain
-        # deb line, so the repository never makes it into apt
-        echo "deb http://openresty.org/package/${arch_path}debian $(lsb_release -sc) openresty" \
-            | sudo tee /etc/apt/sources.list.d/openresty.list
+    codename=$(lsb_release -sc)
+    repo_url="http://openresty.org/package/${arch_path}${1}"
+    # OpenResty publishes packages for a new distribution release some time
+    # after it comes out (e.g. Ubuntu 26.04). Only openresty-zlib-dev and
+    # openresty-pcre-dev are needed from it, and they are self-contained under
+    # /usr/local/openresty, so fall back to the previous release's repository.
+    if ! wget -q --spider "${repo_url}/dists/${codename}/Release"; then
+        if [[ "${1}" == "ubuntu" ]]; then
+            codename=noble
+        else
+            codename=bookworm
+        fi
+    fi
+    component=main
+    if [[ "${1}" == "debian" ]]; then
+        component=openresty
     fi
+    echo "deb [signed-by=/etc/apt/keyrings/openresty.gpg] ${repo_url} ${codename} ${component}" \
+        | sudo tee /etc/apt/sources.list.d/openresty.list
     sudo apt-get update
 
     # install some compilation tools
-    sudo apt-get install -y curl make gcc g++ cpanminus libpcre3 libpcre3-dev libpcre2-dev libyaml-dev unzip openresty-zlib-dev openresty-pcre-dev libxml2-dev libxslt-dev zlib1g-dev
+    sudo apt-get install -y curl make gcc g++ cpanminus libpcre2-dev libyaml-dev unzip openresty-zlib-dev openresty-pcre-dev libxml2-dev libxslt-dev zlib1g-dev
 }
 
 # Identify the different distributions and call the corresponding function
diff --git a/utils/linux-install-luarocks.sh b/utils/linux-install-luarocks.sh
index 4ddc42ddb312..092bcaff745f 100755
--- a/utils/linux-install-luarocks.sh
+++ b/utils/linux-install-luarocks.sh
@@ -72,3 +72,9 @@ luarocks config variables.OPENSSL_DIR ${OPENSSL_PREFIX}
 luarocks config variables.OPENSSL_LIBDIR ${OPENSSL_PREFIX}/lib
 luarocks config variables.OPENSSL_INCDIR ${OPENSSL_PREFIX}/include
 luarocks config variables.YAML_DIR /usr
+
+# lrexlib-pcre needs PCRE1, which newer distributions (Ubuntu 26.04, Debian 13)
+# no longer ship; use the copy bundled with APISIX runtime instead.
+if [ -f ${OPENRESTY_PREFIX}/pcre/include/pcre.h ]; then
+    luarocks config variables.PCRE_DIR ${OPENRESTY_PREFIX}/pcre
+fi

From 7d6414fd2e584a4e4598f6925ada639edbc5a255 Mon Sep 17 00:00:00 2001
From: Nic <qianyong@api7.ai>
Date: Thu, 22 Oct 2026 04:24:33 +0000
Subject: [PATCH 2/9] ci: only fall back to the noble OpenResty repository on
 Ubuntu

---
 utils/install-dependencies.sh | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/utils/install-dependencies.sh b/utils/install-dependencies.sh
index 619df6fcea4f..e754810d54ca 100755
--- a/utils/install-dependencies.sh
+++ b/utils/install-dependencies.sh
@@ -73,16 +73,12 @@ function install_dependencies_with_apt() {
     fi
     codename=$(lsb_release -sc)
     repo_url="http://openresty.org/package/${arch_path}${1}"
-    # OpenResty publishes packages for a new distribution release some time
-    # after it comes out (e.g. Ubuntu 26.04). Only openresty-zlib-dev and
-    # openresty-pcre-dev are needed from it, and they are self-contained under
-    # /usr/local/openresty, so fall back to the previous release's repository.
-    if ! wget -q --spider "${repo_url}/dists/${codename}/Release"; then
-        if [[ "${1}" == "ubuntu" ]]; then
-            codename=noble
-        else
-            codename=bookworm
-        fi
+    # OpenResty publishes packages for a new Ubuntu release some time after it
+    # comes out (e.g. 26.04). Only openresty-zlib-dev and openresty-pcre-dev are
+    # needed from it, and they are self-contained under /usr/local/openresty,
+    # so fall back to the latest LTS repository it has.
+    if [[ "${1}" == "ubuntu" ]] && ! wget -q --spider "${repo_url}/dists/${codename}/Release"; then
+        codename=noble
     fi
     component=main
     if [[ "${1}" == "debian" ]]; then

From d98bda02e6b2980bc4ec3fe1d22dc7500d537a5a Mon Sep 17 00:00:00 2001
From: Nic <qianyong@api7.ai>
Date: Thu, 22 Oct 2026 06:27:37 +0000
Subject: [PATCH 3/9] ci: handle sudo-rs and Docker 29 on the Ubuntu 26.04
 image

---
 .github/workflows/build.yml | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f6c64a35744c..25da7adfc141 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -92,6 +92,17 @@ jobs:
         run: |
           sudo ./ci/${{ matrix.os_name }}_runner.sh do_install
 
+      - name: Allow the Docker API version used by OpenWhisk
+        if: steps.test_env.outputs.type == 'plugin'
+        run: |
+          # Docker 29 (Ubuntu 26.04 image) rejects API versions below 1.44 by default,
+          # and openwhisk/standalone drives the host daemon with an older client
+          sudo mkdir -p /etc/systemd/system/docker.service.d
+          printf '[Service]\nEnvironment=DOCKER_MIN_API_VERSION=1.24\n' \
+            | sudo tee /etc/systemd/system/docker.service.d/min-api-version.conf
+          sudo systemctl daemon-reload
+          sudo systemctl restart docker
+
       - name: Linux launch common services
         run: |
           make ci-env-up project_compose_ci=ci/pod/docker-compose.common.yml
@@ -187,7 +198,8 @@ jobs:
       - name: Linux Script
         env:
           TEST_FILE_SUB_DIR: ${{ matrix.test_dir }}
-        run: sudo -E ./ci/${{ matrix.os_name }}_runner.sh script
+        # sudo-rs (Ubuntu 26.04) ignores -E, so pass what the script needs explicitly
+        run: sudo -E TEST_FILE_SUB_DIR="$TEST_FILE_SUB_DIR" ./ci/${{ matrix.os_name }}_runner.sh script
 
       - if: ${{ steps.cache-images.outputs.cache-hit != 'true' }}
         name: Save docker images

From eabc15095e9bdea1bd8449899afaf81b48c585d0 Mon Sep 17 00:00:00 2001
From: Nic <qianyong@api7.ai>
Date: Thu, 22 Oct 2026 07:42:44 +0000
Subject: [PATCH 4/9] ci: only restart docker when its minimum API version is
 too new for OpenWhisk

---
 .github/workflows/build.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 25da7adfc141..5364992f004c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -97,11 +97,17 @@ jobs:
         run: |
           # Docker 29 (Ubuntu 26.04 image) rejects API versions below 1.44 by default,
           # and openwhisk/standalone drives the host daemon with an older client
+          min_api=$(docker version --format '{{.Server.MinAPIVersion}}')
+          echo "docker minimum API version: $min_api"
+          if [ "$min_api" = "1.24" ]; then
+              exit 0
+          fi
           sudo mkdir -p /etc/systemd/system/docker.service.d
           printf '[Service]\nEnvironment=DOCKER_MIN_API_VERSION=1.24\n' \
             | sudo tee /etc/systemd/system/docker.service.d/min-api-version.conf
           sudo systemctl daemon-reload
           sudo systemctl restart docker
+          docker version --format '{{.Server.MinAPIVersion}}'
 
       - name: Linux launch common services
         run: |

From 7226de99146c85aa0172e28c0875f980cd417537 Mon Sep 17 00:00:00 2001
From: Nic <qianyong@api7.ai>
Date: Thu, 22 Oct 2026 10:17:23 +0000
Subject: [PATCH 5/9] docs: list Ubuntu 26.04 as supported by
 install-dependencies.sh

---
 docs/en/latest/install-dependencies.md | 2 +-
 docs/zh/latest/install-dependencies.md | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/en/latest/install-dependencies.md b/docs/en/latest/install-dependencies.md
index c8ed977de146..347c23929faa 100644
--- a/docs/en/latest/install-dependencies.md
+++ b/docs/en/latest/install-dependencies.md
@@ -37,7 +37,7 @@ title: Install Dependencies
 
 Run the following command to install Apache APISIX's dependencies on a supported operating system.
 
-Supported OS versions: Debian 11/12, Ubuntu 20.04/22.04/24.04, etc.
+Supported OS versions: Debian 11/12, Ubuntu 20.04/22.04/24.04/26.04, etc.
 
 Note that in the case of Arch Linux, we use `openresty` from the AUR, thus requiring a AUR helper. For now `yay` and `pacaur` are supported.
 
diff --git a/docs/zh/latest/install-dependencies.md b/docs/zh/latest/install-dependencies.md
index c2b713163963..4b8871f53def 100644
--- a/docs/zh/latest/install-dependencies.md
+++ b/docs/zh/latest/install-dependencies.md
@@ -37,7 +37,7 @@ title: 安装依赖
 
 在支持的操作系统上运行以下指令即可安装 Apache APISIX dependencies。
 
-支持的操作系统版本：Debian 11/12, Ubuntu 20.04/22.04/24.04 等。
+支持的操作系统版本：Debian 11/12, Ubuntu 20.04/22.04/24.04/26.04 等。
 
 注意，对于 Arch Linux 来说，我们使用 AUR 源中的 `openresty`，所以需要 AUR Helper 才能正常安装。目前支持 `yay` 和 `pacaur`。
 

From 87199832068a3d4014f6c34dcad16f64b93f87f8 Mon Sep 17 00:00:00 2001
From: Nic <qianyong@api7.ai>
Date: Fri, 23 Oct 2026 01:16:04 +0000
Subject: [PATCH 6/9] chore: bump lua-resty-saml to 0.2.7 to build against
 libxml2 2.12+

---
 apisix-master-0.rockspec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apisix-master-0.rockspec b/apisix-master-0.rockspec
index 5a0137bc05f6..1e4b1e027640 100644
--- a/apisix-master-0.rockspec
+++ b/apisix-master-0.rockspec
@@ -53,7 +53,7 @@ dependencies = {
     "lua-resty-radixtree = 2.9.2-0",
     "lua-protobuf = 0.5.3-1",
     "lua-resty-openidc = 1.9.0-1",
-    "lua-resty-saml = 0.2.6",
+    "lua-resty-saml = 0.2.7",
     "luafilesystem = 1.8.0-1",
     "nginx-lua-prometheus-api7 = 1.0.0-1",
     "jsonschema = 0.9.13-0",

From ef55086691dcc250335aa8add3f649f5da95491e Mon Sep 17 00:00:00 2001
From: Nic <qianyong@api7.ai>
Date: Fri, 23 Oct 2026 03:09:11 +0000
Subject: [PATCH 7/9] ci: address review on the Ubuntu 26.04 changes

---
 .github/workflows/build.yml     | 2 +-
 utils/install-dependencies.sh   | 3 ++-
 utils/linux-install-luarocks.sh | 4 ++--
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5364992f004c..f7211f65c037 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -205,7 +205,7 @@ jobs:
         env:
           TEST_FILE_SUB_DIR: ${{ matrix.test_dir }}
         # sudo-rs (Ubuntu 26.04) ignores -E, so pass what the script needs explicitly
-        run: sudo -E TEST_FILE_SUB_DIR="$TEST_FILE_SUB_DIR" ./ci/${{ matrix.os_name }}_runner.sh script
+        run: sudo -E env TEST_FILE_SUB_DIR="$TEST_FILE_SUB_DIR" ./ci/${{ matrix.os_name }}_runner.sh script
 
       - if: ${{ steps.cache-images.outputs.cache-hit != 'true' }}
         name: Save docker images
diff --git a/utils/install-dependencies.sh b/utils/install-dependencies.sh
index e754810d54ca..f72aa0d0e6e6 100755
--- a/utils/install-dependencies.sh
+++ b/utils/install-dependencies.sh
@@ -66,13 +66,14 @@ function install_dependencies_with_apt() {
     sudo apt-get -y install wget lsb-release gnupg patch
     sudo mkdir -p /etc/apt/keyrings
     wget -qO - https://openresty.org/package/pubkey.gpg | sudo gpg --dearmor --yes -o /etc/apt/keyrings/openresty.gpg
+    sudo chmod 0644 /etc/apt/keyrings/openresty.gpg
     arch=$(uname -m | tr '[:upper:]' '[:lower:]')
     arch_path=""
     if [[ $arch == "arm64" ]] || [[ $arch == "aarch64" ]]; then
         arch_path="arm64/"
     fi
     codename=$(lsb_release -sc)
-    repo_url="http://openresty.org/package/${arch_path}${1}"
+    repo_url="https://openresty.org/package/${arch_path}${1}"
     # OpenResty publishes packages for a new Ubuntu release some time after it
     # comes out (e.g. 26.04). Only openresty-zlib-dev and openresty-pcre-dev are
     # needed from it, and they are self-contained under /usr/local/openresty,
diff --git a/utils/linux-install-luarocks.sh b/utils/linux-install-luarocks.sh
index 092bcaff745f..61ee4e79117b 100755
--- a/utils/linux-install-luarocks.sh
+++ b/utils/linux-install-luarocks.sh
@@ -75,6 +75,6 @@ luarocks config variables.YAML_DIR /usr
 
 # lrexlib-pcre needs PCRE1, which newer distributions (Ubuntu 26.04, Debian 13)
 # no longer ship; use the copy bundled with APISIX runtime instead.
-if [ -f ${OPENRESTY_PREFIX}/pcre/include/pcre.h ]; then
-    luarocks config variables.PCRE_DIR ${OPENRESTY_PREFIX}/pcre
+if [ -f "${OPENRESTY_PREFIX}/pcre/include/pcre.h" ]; then
+    luarocks config variables.PCRE_DIR "${OPENRESTY_PREFIX}/pcre"
 fi

From 83fedfc48baace6bbbc482932745b29e7736f72e Mon Sep 17 00:00:00 2001
From: Nic <qianyong@api7.ai>
Date: Fri, 23 Oct 2026 03:35:45 +0000
Subject: [PATCH 8/9] ci: pin OpenWhisk's docker API version instead of
 lowering the daemon's floor

---
 .github/workflows/build.yml    | 17 -----------------
 ci/backup-docker-images.sh     |  2 +-
 ci/init-plugin-test-service.sh |  4 +++-
 3 files changed, 4 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f7211f65c037..6f739056c2d6 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -92,23 +92,6 @@ jobs:
         run: |
           sudo ./ci/${{ matrix.os_name }}_runner.sh do_install
 
-      - name: Allow the Docker API version used by OpenWhisk
-        if: steps.test_env.outputs.type == 'plugin'
-        run: |
-          # Docker 29 (Ubuntu 26.04 image) rejects API versions below 1.44 by default,
-          # and openwhisk/standalone drives the host daemon with an older client
-          min_api=$(docker version --format '{{.Server.MinAPIVersion}}')
-          echo "docker minimum API version: $min_api"
-          if [ "$min_api" = "1.24" ]; then
-              exit 0
-          fi
-          sudo mkdir -p /etc/systemd/system/docker.service.d
-          printf '[Service]\nEnvironment=DOCKER_MIN_API_VERSION=1.24\n' \
-            | sudo tee /etc/systemd/system/docker.service.d/min-api-version.conf
-          sudo systemctl daemon-reload
-          sudo systemctl restart docker
-          docker version --format '{{.Server.MinAPIVersion}}'
-
       - name: Linux launch common services
         run: |
           make ci-env-up project_compose_ci=ci/pod/docker-compose.common.yml
diff --git a/ci/backup-docker-images.sh b/ci/backup-docker-images.sh
index bc87987a1f6a..eb186dae4b5f 100644
--- a/ci/backup-docker-images.sh
+++ b/ci/backup-docker-images.sh
@@ -23,7 +23,7 @@ mkdir docker-images-backup
 sum=$(cat ci/pod/docker-compose.$test_type.yml | grep image | wc -l)
 special_tag=$(cat ci/pod/docker-compose.$test_type.yml | grep image: | awk '{print $2}' | awk 'ORS=NR%"'$sum'"?" ":"\n"{print}')
 echo special: $special_tag
-openwhisk_tag="openwhisk/action-nodejs-v14:nightly openwhisk/standalone:nightly"
+openwhisk_tag="openwhisk/action-nodejs-v14:nightly openwhisk/standalone:7ef091c"
 echo
 echo special_tag: $special_tag
 echo openwhisk_tag: $openwhisk_tag
diff --git a/ci/init-plugin-test-service.sh b/ci/init-plugin-test-service.sh
index 71c63dcc67f2..e80a75d37645 100755
--- a/ci/init-plugin-test-service.sh
+++ b/ci/init-plugin-test-service.sh
@@ -54,7 +54,9 @@ after() {
         --entity-name admin
     # prepare openwhisk env
     docker pull openwhisk/action-nodejs-v14:1.20.0
-    docker run --rm -d --name openwhisk -p 3233:3233 -p 3232:3232 -v /var/run/docker.sock:/var/run/docker.sock openwhisk/standalone:1.0.0
+    # the image bundles docker 18.06 (API 1.38), which Docker 29 refuses; pin
+    # the API version it claims so every docker call it spawns is accepted
+    docker run --rm -d --name openwhisk -e DOCKER_API_VERSION=1.40 -p 3233:3233 -p 3232:3232 -v /var/run/docker.sock:/var/run/docker.sock openwhisk/standalone:7ef091c
     docker exec -i openwhisk waitready
     docker exec -i openwhisk bash -c "wsk package create pkg"
     docker exec -i openwhisk bash -c "wsk action update /guest/pkg/testpkg <(echo 'function main(args){return {\"hello\": \"world\"}}') --kind nodejs:14"

From f09f329e71d6aac6cace6ba3d37698702f714c2e Mon Sep 17 00:00:00 2001
From: Nic <qianyong@api7.ai>
Date: Fri, 23 Oct 2026 04:34:48 +0000
Subject: [PATCH 9/9] ci: create the OpenWhisk test actions on nodejs:20

---
 ci/backup-docker-images.sh     |  2 +-
 ci/init-plugin-test-service.sh | 16 +++++++++-------
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/ci/backup-docker-images.sh b/ci/backup-docker-images.sh
index eb186dae4b5f..4679d9b8e4a2 100644
--- a/ci/backup-docker-images.sh
+++ b/ci/backup-docker-images.sh
@@ -23,7 +23,7 @@ mkdir docker-images-backup
 sum=$(cat ci/pod/docker-compose.$test_type.yml | grep image | wc -l)
 special_tag=$(cat ci/pod/docker-compose.$test_type.yml | grep image: | awk '{print $2}' | awk 'ORS=NR%"'$sum'"?" ":"\n"{print}')
 echo special: $special_tag
-openwhisk_tag="openwhisk/action-nodejs-v14:nightly openwhisk/standalone:7ef091c"
+openwhisk_tag="openwhisk/action-nodejs-v20:nightly openwhisk/standalone:7ef091c"
 echo
 echo special_tag: $special_tag
 echo openwhisk_tag: $openwhisk_tag
diff --git a/ci/init-plugin-test-service.sh b/ci/init-plugin-test-service.sh
index e80a75d37645..ffe7f6d534c8 100755
--- a/ci/init-plugin-test-service.sh
+++ b/ci/init-plugin-test-service.sh
@@ -53,18 +53,20 @@ after() {
         --entity-type users \
         --entity-name admin
     # prepare openwhisk env
-    docker pull openwhisk/action-nodejs-v14:1.20.0
+    # nodejs:20 is the default runtime of this standalone build and is prewarmed;
+    # nodejs:14 is no longer offered
+    docker pull openwhisk/action-nodejs-v20:nightly
     # the image bundles docker 18.06 (API 1.38), which Docker 29 refuses; pin
     # the API version it claims so every docker call it spawns is accepted
     docker run --rm -d --name openwhisk -e DOCKER_API_VERSION=1.40 -p 3233:3233 -p 3232:3232 -v /var/run/docker.sock:/var/run/docker.sock openwhisk/standalone:7ef091c
     docker exec -i openwhisk waitready
     docker exec -i openwhisk bash -c "wsk package create pkg"
-    docker exec -i openwhisk bash -c "wsk action update /guest/pkg/testpkg <(echo 'function main(args){return {\"hello\": \"world\"}}') --kind nodejs:14"
-    docker exec -i openwhisk bash -c "wsk action update test <(echo 'function main(args){return {\"hello\": \"test\"}}') --kind nodejs:14"
-    docker exec -i openwhisk bash -c "wsk action update test-params <(echo 'function main(args){return {\"hello\": args.name || \"test\"}}') --kind nodejs:14"
-    docker exec -i openwhisk bash -c "wsk action update test-statuscode <(echo 'function main(args){return {\"statusCode\": 407}}') --kind nodejs:14"
-    docker exec -i openwhisk bash -c "wsk action update test-headers <(echo 'function main(args){return {\"headers\": {\"test\":\"header\"}}}') --kind nodejs:14"
-    docker exec -i openwhisk bash -c "wsk action update test-body <(echo 'function main(args){return {\"body\": {\"test\":\"body\"}}}') --kind nodejs:14"
+    docker exec -i openwhisk bash -c "wsk action update /guest/pkg/testpkg <(echo 'function main(args){return {\"hello\": \"world\"}}') --kind nodejs:20"
+    docker exec -i openwhisk bash -c "wsk action update test <(echo 'function main(args){return {\"hello\": \"test\"}}') --kind nodejs:20"
+    docker exec -i openwhisk bash -c "wsk action update test-params <(echo 'function main(args){return {\"hello\": args.name || \"test\"}}') --kind nodejs:20"
+    docker exec -i openwhisk bash -c "wsk action update test-statuscode <(echo 'function main(args){return {\"statusCode\": 407}}') --kind nodejs:20"
+    docker exec -i openwhisk bash -c "wsk action update test-headers <(echo 'function main(args){return {\"headers\": {\"test\":\"header\"}}}') --kind nodejs:20"
+    docker exec -i openwhisk bash -c "wsk action update test-body <(echo 'function main(args){return {\"body\": {\"test\":\"body\"}}}') --kind nodejs:20"
 
 
     docker exec -i rmqnamesrv rm /home/rocketmq/rocketmq-4.6.0/conf/tools.yml