chore: bump ngx_http_ffi_client to v0.1.2

[shreemaan-abhishek]

Why

v0.1.1 was a licensing and packaging release: over v0.1.0 it adds a LICENSE, a README section and a config tweak, and the C sources are byte-identical. So the runtime still carries the three defects found while moving the AI plugins onto this client (apache/apisix#13778, api7/api7-ee-3-gateway#2075):

• Request bodies containing CR or LF are rejected as "invalid request" ngx_http_ffi_client#38 — request bodies containing CR or LF are rejected as invalid request. Any caller posting pretty-printed JSON gets a 500 when the body is forwarded verbatim.
• Connection errors are logged at error level, ignoring lua_socket_log_errors off ngx_http_ffi_client#39 — connection errors are logged at error level even under lua_socket_log_errors off, which APISIX sets. Refused and reset upstreams are routine for an AI gateway, so this is steady error-log noise.
• TLS verification fails: the trust store ignores lua_ssl_trusted_certificate and the bundled OpenSSL ships no CAs ngx_http_ffi_client#42 — the trust store ignores lua_ssl_trusted_certificate and relies on OpenSSL's default verify paths, which are empty in an apisix-runtime build. Every verified TLS connection fails unless the call site passes a CA explicitly, so the client cannot reach any HTTPS LLM provider as shipped.

All three are fixed in v0.1.2.

Verification

A runtime built from these three fixes was exercised on an API7 EE gateway proxying to real Azure OpenAI, comparing ngx_http_ffi_client against lua-resty-http on the same routes:

scenario	ngx_http_ffi_client	lua-resty-http
buffered chat (gpt-4o)	200	200
streaming SSE	15 chunks, [DONE]	15 chunks, [DONE]
multiline JSON body	200	200
failover 5xx to healthy instance	200	200
keepalive, 5 sequential	5/5	5/5
responses API (gpt-5-codex)	200	200
anthropic messages (claude-sonnet-4-5)	200	200
36 KB request body	200	200

Three protocol adapters (openai-chat, openai-responses, anthropic-messages), TLS with SNI, streaming, retry and connection reuse. Before the fixes the same gateway returned 500 TLS certificate verify failed on every one of these.

The build itself also covers api7/ngx_http_ffi_client#43's compat shim: this script exports NGX_HTTP_LUA_MODULE_DIR pointing at the pristine bundled ngx_lua-*, which is the configured-checkout case src/compat/ngx_http_lua_autoconf.h exists for. It compiles clean.

Next

A runtime release on top of this, so apache/apisix#13778 and api7/api7-ee-3-gateway#2075 can pin a runtime that actually carries the fixes. 1.3.13 and 1.3.14 both pin v0.1.1.

Summary by CodeRabbit

• Bug Fixes
  • Updated the runtime’s default client component version to improve compatibility and reliability.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 5b396cb5-3407-47cb-a067-b149d55b74ea

📥 Commits

Reviewing files that changed from the base of the PR and between bd4d74f and d67a9af.

📒 Files selected for processing (1)

• build-apisix-runtime.sh

---

📝 Walkthrough

Walkthrough

The runtime build script now uses ngx_http_ffi_client version v0.1.2 as its default dependency version.

Changes

Runtime dependency update

Layer / File(s)	Summary
Update ngx_http_ffi_client version build-apisix-runtime.sh	The default ngx_http_ffi_client_ver value changes from v0.1.1 to v0.1.2.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• api7/apisix-build-tools#481: Updates the same dependency version variable.
• api7/apisix-build-tools#484: Updates the same dependency version variable.

Suggested reviewers: alinsran, jarvis9443

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the version bump made in the pull request.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
E2e Test Quality Review	✅ Passed	The PR changes only the intended version pin; upstream v0.1.2 exists and includes focused CR/LF and TLS tests, while the description reports real Azure OpenAI E2E coverage.
Security Check	✅ Passed	HEAD changes only the default client tag in build-apisix-runtime.sh; no credential handling, persistence, authorization, ownership, resource-sharing, or secret-resolution code changed.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/ffi-client-v0.1.2

---

_{Comment @coderabbitai help to get the list of available commands.}