### Summary

#### Fixed
- fix(session): clear_request cookie to check remember_meta correctly before using it

#### Added
- feat(opm): add more dependencies in requires
- feat(opm): add right version number requirements
- docs(readme): add remark on dependencies on installation section

… upstream keepalive patch (#10212)

KAG-474

This commit implements an upper limit on the number of batches that
may be waiting on a queue for processing.  Once the limit has been
reached, the oldest batch is dropped from the queue and an error
message is logged.  The maximum number of batches that can be waiting
on a queue is configured through the max_queued_batches parameter of
the queue, which defaults to 100 and can be globally overriden with
the max_queued_batches parameter in kong.conf

A more complete rewrite of the queuing system is in the works but will
not make it into 3.2.

KAG-303

This reverts commit 218cc0a.

* fix(conf_loader): deprecate and alias otel properties

* chore(conf_loader): update error string

(cherry picked from commit ef25a10)

(cherry picked from commit 3828b1f)

…al configuration parameter (#10271)

We don't want to support this parameter going forward as we're going
to re-implement the queue system.  This change hard-codes the queue limit
to a value that would be considered "large enough".

We added an undocumented environment variable serves to help users who require
a different limit on the maximum size of queues.  A proper solution is
under development and this undocumented environment variable will only
exist until the reimplementation has been released

Co-authored-by: Datong Sun <datong.sun@konghq.com>
(cherry picked from commit 989b23e)

- fix(*): hkdf is not approved by FIPS, use PBKDF2 instead on FIPS-mode

#10316)

(cherry picked from commit ee74ed9)

Co-authored-by: Harry <harrybagdi@gmail.com>

### Summary

Fixes Redis (non-cluster/sentinel) authentication.

For 3.2, we added `aws_imds_protocol_version` config for `aws_lambda` plugin, and `aws_imds_protocol_version` config for `zipkin` plugin, but we did not add corresponding `removed_fields` entries. Which causes Hybrid mode sync to older versions of Kong to fail.

Fix KAG-725

Co-authored-by: Chrono <chronolaw@gmail.com>
(cherry picked from commit 2a23672)

Co-authored-by: Datong Sun <datong.sun@konghq.com>

Backported from #10272 

* (feat/container-scanning): Integrate container and cve scanning post … (#10272)

* (feat/container-scanning): Integrate container and cve scanning post publishing

* build/ENGEN-844 review (#10273)

* chore(gha): cleanup trailing whitespace

* chore(gha): simplify release scan image as ENV

* chore(gha): simplify release scan logic

* fix(gha): release scan IMAGE context

* chore(gha): fix scan manifest output redirection

---------

Co-authored-by: Isa Farnik <isa@konghq.com>

* fix(cd): remove container scan dependency

---------

Co-authored-by: Isa Farnik <isa@konghq.com>

Co-authored-by: Samuele Illuminati <samuele@konghq.com>

Co-authored-by: Datong Sun <datong.sun@konghq.com>

…ions (#10343) (#10361)

Performing this comparison actually turns a "true" string into a false.
We already check for a string when consuming this environment variable
so there is no need to perform it here.

Signed-off-by: Tyler Ball <tyler.ball@konghq.com>
(cherry picked from commit 999f5be)

Co-authored-by: Chrono <chrono_cpp@me.com>
Co-authored-by: Michael Martin <3277009+flrgh@users.noreply.github.com>
(cherry picked from commit 6fa55b3)

Co-authored-by: Xumin <100666470+StarlightIbuki@users.noreply.github.com>
Co-authored-by: Enrique García Cota <kikito@gmail.com>

…10369)

* fix(gha): set package arch for upload

* Update .github/workflows/release.yml

Co-authored-by: Tyler Ball <2481463+tyler-ball@users.noreply.github.com>

---------

Co-authored-by: Tyler Ball <2481463+tyler-ball@users.noreply.github.com>
(cherry picked from commit 35c4b7a)

…ron list (#4647) (#10376) (#10377)

Fix KAG-744

Co-authored-by: Chrono <chrono_cpp@me.com>
Co-authored-by: Aapo Talvensaari <aapo.talvensaari@gmail.com>
Co-authored-by: Enrique García Cota <kikito@gmail.com>
(cherry picked from commit 2f82ced)

* fix(balancer) use local target cache

* fix(targets): remove dup code

(cherry picked from commit 4f29d72)

Co-authored-by: Vinicius Mignot <vinicius.mignot@gmail.com>

(cherry picked from commit 50e8ba2)

regression from #10322

* chore(tests): mv admin-api tests++
* feat(*): [KAG-617] port kbt smoke tests that previously lived in as 01-package/run.sh
* fix(tests): add VERBOSE flag to admin api tests
* fix(tests): set VERBOSE from runner.debug
* fix(tests): allow repeat runs
* fix(tests): allow multiple response codes
* fix(tests): skip file tests on alpine (status quo)

(cherry picked from commit 13c7c6f)

(cherry picked from commit a5f3634)

)

Fix KAG-816

This PR adds a simple smoke test to check if the HTTP/2 listening port can respond with valid response data.

KAG-854

(cherry picked from commit 40c572d)

Co-authored-by: Qirui(Keery) Nie <windmgc@gmail.com>

* fix(dockerfiles): clean up dangling sockets on startup (#10468)

FTI-4525

(cherry picked from commit a6fe370)

* docs(CHANGELOG): describe fix

* Update CHANGELOG.md

Co-authored-by: Chrono <chrono_cpp@me.com>

---------

Co-authored-by: Chrono <chrono_cpp@me.com>

We expect the upstream passive unhealthy healthcheck on HTTP status code should only mark the targets as "down" (not reachable or proxiable) using the returned HTTP status code from the target, and it should not be affected by the final HTTP status code set by Kong plugin, which is returned to the client.

So we change the passive health check implementation to use nginx var `upstream_code`, this will not be changed by any plugin.

FTI-4841
Fix #10281

(cherry picked from commit dbe8d94)