apisix/plugins/ext-plugin-post-resp.lua (4 lines):
	- line 40: -- TODO: handle proxy_set_header
	- line 46: -- TODO: keepalive
	- line 64: -- TODO: set timeout
	- line 121: -- TODO: response body is empty (304 or HEAD)


apisix/plugins/ext-plugin/init.lua (4 lines):
	- line 325: -- TODO: send RPC_ERROR to runner
	- line 624: -- TODO: support empty body
	- line 821: -- TODO: support empty body
	- line 928: -- TODO: add retry


apisix/plugins/openid-connect.lua (2 lines):
	- line 423: -- TODO: In the called method, the openidc module will try to extract
	- line 460: -- TODO: Same as above for public key validation.


apisix/plugins/zipkin.lua (2 lines):
	- line 153: -- TODO: add an option like 'single_b3_header' so we can adapt to the upstream
	- line 194: -- TODO: support ipv6


apisix/plugins/mcp/session.lua (2 lines):
	- line 26: local SESSION_THRESHOLD_PING        = 30000  --TODO allow customize
	- line 27: local SESSION_THRESHOLD_TIMEOUT     = 60000  --TODO allow customize


apisix/plugins/zipkin/reporter.lua (2 lines):
	- line 77: -- TODO: ip/port from ngx.var.server_name/ngx.var.server_port?
	- line 105: -- TODO: debug?


apisix/plugins/mcp-bridge.lua (2 lines):
	- line 82: -- TODO: recover by Last-Event-ID
	- line 201: if core.string.has_prefix(tostring(body_json.id), "ping") then --TODO check client pong


t/chaos/utils/utils.go (1 line):
	- line 34: // TODO: refactor the code. We should move the endpoint from the expect to the http call.


apisix/plugins/tencent-cloud-cls/cls-sdk.lua (1 line):
	- line 246: -- TODO: support lz4/zstd compress


apisix/stream/router/ip_port.lua (1 line):
	- line 82: -- TODO: check the subordinate relationship in the Admin API


apisix/plugins/skywalking.lua (1 line):
	- line 129: -- TODO: maybe need to fetch them from plugin-metadata


t/config-center-yaml/plugin.t (1 line):
	- line 59: ## TODO: extra_apisix_yaml is specific to this document and is not standard behavior for


apisix/cli/ops.lua (1 line):
	- line 856: -- TODO: more logs for APISIX cli could be added using this feature


t/wasm/response-rewrite/main.go (1 line):
	- line 104: // TODO support changing body


apisix/plugins/file-logger.lua (1 line):
	- line 98: -- TODO: switch to a cache which supports inactive time,


apisix/core/etcd.lua (1 line):
	- line 259: -- TODO: cover this branch in CI


apisix/plugins/jwe-decrypt.lua (1 line):
	- line 246: -- TODO: random bytes


apisix/plugin.lua (1 line):
	- line 75: -- TODO: get attr from synchronized data


apisix/core/event.lua (1 line):
	- line 37: -- TODO: we can register more than one handler


apisix/ssl/router/radixtree_sni.lua (1 line):
	- line 261: -- TODO: support passing `trusted_certs` (3rd arg, keep it nil for now)


t/wasm/log/main.go (1 line):
	- line 79: // TODO: support access/modify http request headers


apisix/init.lua (1 line):
	- line 161: -- TODO: we can support stream plugin later - currently there is not `destroy` method


apisix/schema_def.lua (1 line):
	- line 510: -- TODO: add more nginx variable support


apisix/stream/xrpc/sdk.lua (1 line):
	- line 63: -- TODO: support mTLS


apisix/ssl.lua (1 line):
	- line 202: -- TODO: check if key & cert match


apisix/cli/file.lua (1 line):
	- line 148: -- TODO: support more reserved environment variables


t/plugin/ai5.t (1 line):
	- line 135: -- TODO: The route cache should be enabled, but since no new routes are registered,


apisix/plugins/error-log-logger.lua (1 line):
	- line 306: -- TODO Here save error log as a whole string to clickhouse 'data' column.


apisix/control/v1.lua (1 line):
	- line 347: -- TODO: find a way to trigger GC in the stream subsystem


apisix/discovery/eureka/init.lua (1 line):
	- line 51: -- TODO Add health check to get healthy nodes.


apisix/plugins/wolf-rbac.lua (1 line):
	- line 189: -- TODO: read apisix info.


apisix/discovery/nacos/init.lua (1 line):
	- line 171: -- TODO Add health check to get healthy nodes.


t/lib/keycloak.lua (1 line):
	- line 91: -- TODO: Consider validating this against the plugin configuration.