Nacos 3.3.0-BETA is a feature iteration release for the Nacos 3.x series.

This release focuses on:

• Protocol-neutral Agent registration, management, and discovery.
• Agentic Resource Discovery for AI Registry resources.
• Dynamic plugin configuration and management.
• Distributed lock capabilities.
• Spring Boot 4 and Jackson 3 compatibility.

The main feature updates include:

• Agent lifecycle management, endpoint discovery, SDKs, Console support, and legacy A2A compatibility.
• Hybrid keyword and vector discovery for Skill, Prompt, and MCP resources.
• Runtime plugin configuration and AI resource visibility authorization.
• Phase 1 distributed reentrant and non-reentrant locks.

It also includes Skill workflow improvements, security hardening, compatibility fixes, performance optimizations, and dependency updates.

Detailed changes in this release:

• [#14466] Add a neutral JSON adapter with Jackson 2 and Jackson 3 runtime support.
• [#14804] Add protocol-neutral Agent registration, persistence, endpoint discovery, Java SDKs, Admin and Console APIs, Console management, and legacy A2A compatibility routing.
• [#15279] Add distributed reentrant and non-reentrant locks with watchdog renewal, FIFO waiting, gRPC notifications, Raft consistency, and a Java Lock SDK.
• [#15471] Support SkillSpector as an AI publish pipeline.
• [#15475] Add unified dynamic plugin configuration, lifecycle management, runtime updates, deterministic discovery, and Console configuration workflows.
• [#15476][#15604] Add plugin-owned visibility grant and revoke APIs and Console management for Skill and AgentSpec resources.
• [#15541] Add Agentic Resource Discovery with search, exploration, artifact retrieval, visibility filtering, persistent indexes, and hybrid keyword and vector retrieval.
• [#15640] Support Nacos server deployments on Linux RISC-V with RocksDB.

• [#12064] Support configuring the gRPC port offset through individual client properties.
• [#14932] Refactor the in-memory MCP cache to reduce read-path contention and improve index consistency.
• [#15315][#15561] Improve Skill upload precheck, conflict handling, and server-side ZIP validation.
• [#15322] Remove obsolete Config migration compatibility code and retain only the current Config storage model.
• [#15346] Manage the reserved latest label for AI resources on the server.
• [#15432][#15440][#15441] Remove reviewed unused Java code and preserve compatibility-facing contracts where required.
• [#15448] Improve English translations in Console UI Next.
• [#15486] Include the Skill owner in upload permission-denied messages.
• [#15606] Return a stable per-item result for every Skill batch upload candidate.

• [#12557] Add retry behavior when acquiring the Config dump write lock to prevent stale MD5 cache data.
• [#14981][#15468] Fix concurrent Config publish duplicate-key handling through the datasource dialect SPI, including PostgreSQL unique_violation.
• [#15410] Fix trailing separators when joining collections containing null elements.
• [#15415] Prevent malformed config-plugin property names from discarding valid plugin configuration.
• [#15420] Fix Skill ZIP uploads with invalid or unavailable version candidates.
• [#15425] Prevent out-of-range batch indexes from causing IndexOutOfBoundsException.
• [#15446] Fix page count calculation for empty and exactly divisible result sets.
• [#15447] Prevent NamingUtils.getServiceName from failing on a trailing service separator.
• [#15466] Correct @Since annotations for Skill upload APIs.
• [#15490] Fix Chinese text corruption in Skill Scanner pipeline reports on Windows.
• [#15494] Restore complete MCP tool advanced-template support in Console UI Next.
• [#15510] Reject explicitly supplied invalid Bearer tokens instead of silently falling back to anonymous access.
• [#15534] Generate deterministic, ASCII-safe physical Config keys for AI resources.
• [#15543] Restore case-sensitive collation for newly initialized MySQL schemas.
• [#15557] Fix server startup failures when plugin state snapshots are restored before unified plugin discovery.
• [#15603] Fix visibility query conversion when explicitly authorized resources are present.
• [#15618] Fix Skill upload version resolution to try lower-priority explicit versions before generating a version.
• [#15620] Allow AI resource versions to be resubmitted after completed or stale review results.
• [#15634] Fix HTTP and gRPC authorization metadata, custom resource parser precedence, AgentSpec authorization, and Prometheus security path matching.

• [#14944] Upgrade Spring Boot from 3.5.14 to 4.0.6.
• [#15584] Upgrade Maven Compiler Plugin from 3.5.1 to 3.15.0 for JDK 25 build compatibility.
• [#15645] Upgrade compatible Console UI Next dependencies and regenerate packaged frontend assets.

Nacos 3.3 removes legacy Config migration compatibility paths and changes how unsafe AI resource Config keys are mapped.

Affected users:

• Users upgrading from a version earlier than Nacos 3.0 whose Config data uses the legacy empty tenant for the default namespace.
• Users with legacy beta or tag gray-release data in config_info_beta or config_info_tag.
• Users of the nacos_config AI storage provider with historical non-ASCII or overlength resource identifiers.

Recommended upgrade path:

• Upgrade pre-3.0 deployments to an earlier Nacos 3.x version first.
• Migrate default-namespace data from the empty tenant to public.
• Migrate legacy beta and tag data to config_info_gray.
• Explicitly migrate affected AI resource Config coordinates to the new deterministic ASCII-safe mapping.
• Back up the database and verify the migration in a staging environment before upgrading to Nacos 3.3.0-BETA.

Users already running Nacos 3.x who do not have affected AI Config coordinates are not impacted by these migration removals.

Nacos 2.5.3 is mainly a bugfix, security, and experience-improvement release for the 2.x series.

This release focuses on:

• Compatible security dependency upgrades for the v2.x JDK 8 baseline.
• Client stability and logging improvements.
• Config namespace isolation fixes.
• Server-side request validation improvements.

It also keeps incompatible major dependency lines out of v2.x, such as Spring Boot 3, Spring Framework 6, and other JDK 17+ only upgrades.

Detailed changes in this release:

No major feature changes.

[#12323] Improve Logback packagingData behavior by making it configurable through nacos.logback.packagingData with default false, and upgrade the external Logback adapter to 1.1.5.

[#13940] Fix continuous class unloading during Nacos Client Log4j2 configuration reload by using safe Log4j2 initialization.

[#14423] Fix missing exceptions when form parameters exceed the configured Tomcat request size limit.

[#15437] Fix client shutdown thread leaks and executor creation race conditions in ConfigRpcTransportClient and related client components.

[#15497] Fix Config namespace isolation for ID-based export, batch delete, and clone operations, and enforce source namespace read permission for clone requests.

[#13998][#14859] Upgrade embedded Tomcat to 9.0.118 to address known Tomcat CVEs.

[#15025][#15451] Upgrade compatible v2.x dependencies, including Jackson to 2.18.9, gRPC Java to 1.75.0, and Spring Security to 5.8.16, while preserving the JDK 8 baseline.

• @zmz789 made their first contribution in https://github.com/alibaba/nacos/pull/15288

Full Changelog: https://github.com/alibaba/nacos/compare/2.5.2...2.5.3

Nacos 3.2.3 is mainly a bugfix and experience-improvement release for the 3.2 series.

This release focuses on:

• Improving AI Registry, Skill, MCP, and next console workflows.
• Fixing Config namespace isolation, Naming validation, and client stability issues.
• Improving observability and release dependency hygiene.

It also fixes bugs across Config, Naming, AI Registry, A2A, MCP, Client, Core, and Console.

Detailed changes in this release:

• #15143 #15463 Support nested Skill package uploads and preserve nested SKILL.md files as resources.

• #12737 #12867 Add per-Raft-group leader status and term metrics.
• #15321 Refresh client disk cache asynchronously after subscriber notifications.
• #15322 Align Logback adapter packagingData configuration.
• #15354 Adjust next console sidebar menu elements.
• #15435 Improve AI resource version diff display in next console.

• #12585 Fix pagination parameter binding so ? placeholders work correctly.
• #14036 Support HTTPS/TLS prefixes in HTTP login processing.
• #14693 Fix MCP service selector pagination in the console.
• #15032 Fix TCP health-check SocketChannel leaks and exact member IP matching.
• #15229 Normalize null A2A agent names in list queries.
• #15265 Allow Skill list fuzzy queries when skillName starts or ends with a hyphen.
• #15275 Copy pg-upgrade-null-tenant-id.sql to distribution/conf to prevent PostgreSQL Docker upgrade startup failures.
• #15296 Update service detail status after instance online/offline toggles.
• #15305 Reject blank instance IPs in Naming registration.
• #15350 Fix empty Config history compare content in next console.
• #15355 Restore editable Config clone target Data ID and group fields.
• #15359 Fix AI Registry version deletion corrupting version aggregates and breaking A2A/MCP queries.
• #15428 Preserve query parameters in MCP endpoint URLs after publish.
• #15430 Preserve transportProtocol in auto-built MCP endpoint specs.
• #15498 Scope ID-based Config export, batch delete, and clone operations by namespace.

• #15442 Roll up console-ui-next dependency fixes and rebuild next console static assets.

Full Changelog: https://github.com/alibaba/nacos/compare/3.2.2...3.2.3

Nacos 3.2.2 is mainly a bugfix and experience-improvement release for the 3.2 series.

This release focuses on:

• Console experience improvements for Config, Naming, MCP, Skill, AI resources, and namespace workflows.
• Stability and compatibility fixes across Config, Naming, plugins, startup scripts, and AI resource handling.
• AI Registry import, discovery, publishing, subscription, and security improvements.

For AI Registry and Console users, this release adds or improves:

• Importing AI resources from operator-configured external registries.
• Skill well-known discovery, Skill subscription, and latest protocol adapter support.
• Config diff confirmation, Prompt Markdown download, and Skill upload lifecycle improvements.

It also fixes bugs across Config, Naming, Console, MCP, Skill, plugins, and client-side watch handling.

Detailed changes in this release:

[#14695] Support label-based matching for Config gray rules. [#14848] Add Prompt version download as Markdown. [#14907] Support specifying a target version when uploading Skills. [#14985] Add persistent instance deregistration support in Console v3. [#15022] Support optional Skill auto-publish after review. [#15031] Extend nacos.functionMode with microservice and ai modes. [#15142] Support drag-and-drop ZIP upload and batch Skill upload. [#15183] Support importing AI resources from operator-configured external registries, including MCP resources, Skill well-known resources, importer APIs, SPI models, built-in presets, and source-based import UI. [#15234] Support commit messages when uploading AI skills. [#15247] Support the latest Skill well-known protocol in the registry adapter. [#15263] Add Skill subscription support and refactor AgentSpec subscription to HTTP polling with 304 handling.

[#14833][#15221] Route AI resource version trace logging through trace events and the default plugin. [#14911] Split LDAP authentication into an optional plugin and package the LDAP plugin JAR. [#14983] Enforce non-frontmatter Markdown body content during Skill validation. [#15059] Add the reviewed version status after pipeline approval for Skill versions. [#15066] Harden AgentSpec ZIP parsing with Zip Slip, Zip Bomb, and entry-count defenses. [#15138] Add Config publish diff confirmation in the new Console. [#15145] Restrict forcePublish to valid Skill states and add pipeline stale flags for re-edit. [#15164] Make Skill ZIP entry and size limits configurable. [#15165] Parallelize AgentSpec storage writes to align with Skill behavior. [#15258] Enable reviewed status by default for the AI publish pipeline.

[#11122] Accept healthCheckEnabled as a Naming switch-entry alias. [#14774] Shade Caffeine into the OIDC plugin JAR to avoid NoClassDefFoundError. [#14882] Fix Console theme color loss by adding RGB fallbacks. [#14952] Fix the incorrect MCP protocol value when the restToMcp switch is off. [#14992] Add v3 Naming APIs to DistroFilter to fix client API instance registration and deregistration in clusters. [#14997] Preserve SKILL.md indentation and validate Skill versions during upload and download. [#15000] Add the missing group_id LIKE placeholder in BaseConfigInfoMapper. [#15004] Replace deprecated AccessControlException usage with SecurityException. [#15037] Fix access denied errors on Console history detail, rollback, and compare pages. [#15067] Fix the missing write lock in MemoryMcpCacheIndex#removeIndex. [#15073] Preserve multi-byte UTF-8 characters across DiskUtils chunk boundaries. [#15136] Fix the password modification dialog display. [#15141] Fix namespace description editing when namespaceId is missing. [#15150] Prevent PostgreSQL tenant nulls from causing config sync row explosions. [#15152] Fix Config page display mismatches after namespace switching. [#15160] Fix ConfigChangeAspect misclassifying Console config changes as RPC when srcType is missing. [#15162] Default unlisted AI resources to base64 to avoid UTF-8 corruption. [#15167] Fix Console controller mapping with request context paths. [#15171] Re-exec startup scripts under bash when invoked through sh. [#15192] Reject submit requests for non-draft AI resource versions to protect formal version status. [#15201] Fix Skill description inconsistencies between list and detail after uploading a new version. [#15207] Fix MCP Console editor regressions for object-type tool input fields. [#15228] Guard fuzzy-watch futures against lost and spurious wakeups. [#15240] Fix Skill install card overflow with long Skill names in Console next. [#15252] Preserve namespace context on Console AI resource pages.

[#15039] Upgrade the PostgreSQL JDBC driver from 42.7.2 to 42.7.11. [#15060] Upgrade Micrometer to 1.15.10 to fix the Prometheus endpoint. [#15087] Upgrade vulnerable dependencies reported for the Nacos server image and enable default AI importers. [#15148] Add a console-ui-next npm min-release-age policy for supply-chain security.

• @Wyhhhh24 made their first contribution in https://github.com/alibaba/nacos/pull/14971
• @zy84338719 made their first contribution in https://github.com/alibaba/nacos/pull/15060
• @grllll made their first contribution in https://github.com/alibaba/nacos/pull/15057
• @ViperThanks made their first contribution in https://github.com/alibaba/nacos/pull/15110
• @jay666mnj made their first contribution in https://github.com/alibaba/nacos/pull/15178
• @wansho made their first contribution in https://github.com/alibaba/nacos/pull/15167
• @Hccake made their first contribution in https://github.com/alibaba/nacos/pull/15161
• @elnafateh made their first contribution in https://github.com/alibaba/nacos/pull/15118
• @Jholly2008 made their first contribution in https://github.com/alibaba/nacos/pull/15204
• @wushiyuanmaimob made their first contribution in https://github.com/alibaba/nacos/pull/15226

Full Changelog: https://github.com/alibaba/nacos/compare/3.2.1...3.2.2

Nacos 3.2.1 is a patch release focused on critical bug fixes and feature enhancements for issues discovered in 3.2.0. This release delivers significant improvements to AI Registry functionality, database compatibility, security, and console user experience.

Key highlights include:

• AI Registry Maturity: Complete Prompt lifecycle management with UI, A2A AgentCard v1 protocol support, skill bizTag filtering, and resource spec storage for MCP servers
• Security Enhancements: Fixed LDAP authentication bypass vulnerability, added OIDC/OAuth2 SSO login support for both consoles
• Database Compatibility: Comprehensive PostgreSQL, Oracle, MySQL, and Derby fixes including deterministic pagination and schema timestamp issues
• Dependency Upgrades: Spring Boot 3.5.13, MCP SDK 0.17.0, and log4j-core 2.25.4
• Concurrency & Reliability: Eliminated race conditions in AI publish pipeline, naming module, client failover, and config export operations
• Console UX: Fixed configuration editing errors, namespace ID validation, batch import, token expiry handling, and UI bugs in both legacy and next consoles

• [#14621] A2A Registry 1.0 adapter with unified and normalized supported interfaces in agent card handling
• [#14796] Add MCP server resource specification support
• [#14807] Add Prompt lifecycle management UI for both legacy and next consoles
• [#14809] Enhance AI resource list APIs with filters and ordering support
• [#14847] Support AI resource subtype parsing in authentication plugin
• [#14895] Support filtering skills by bizTag in list API and console UI
• [#14794] Support force-publish skills for admin user

• [#14743] Close CallableStatement in DerbySnapshotOperation to prevent JDBC resource leak
• [#14750] Fix check-then-act race condition in FailoverReactor.isFailoverSwitch
• [#14751] Fix check-then-act race conditions on ConcurrentHashMap in naming module
• [#14784] Validate input parameters in ops controller forms for better security
• [#14806] Improve cluster metrics aggregation completeness signal in v3 API
• [#14818] Improve cluster metrics aggregation completeness signal in v3 API
• [#14822] Extract duplicated logic from SkillOperationServiceImpl and AgentSpecOperationServiceImpl into AiResourceManager and VersionUtils
• [#14834] Upgrade UI dependencies for both legacy and next consoles
• [#14873] Add config option to enable or disable visibility plugin
• [#14883] Add default scope resolution for new resource creation in visibility plugin
• [#14884] Standardize pipeline API and fix legacy console UI bugs
• [#14893] Add copilot feature toggle and redesign plugin management layout
• [#14927] Fix TOCTOU race condition and thread leak in ClientWorker.ensureSyncExecutor()
• [#14928] Fix TOCTOU race condition in removeSubscriberIndexes causing data loss

• [#14046] Fix ConfigInfoMapperByMySql.findConfigInfoLike4PageFetchRows result accuracy on MySQL
• [#14741] Add ORDER BY to findConfigInfoLike4PageFetchRows for deterministic pagination
• [#14742] Add ORDER BY to findConfigInfo4PageFetchRows for deterministic pagination
• [#14746] Add ORDER BY to remaining MySQL pagination queries for deterministic results
• [#14747] Add ORDER BY to Oracle pagination queries for deterministic results
• [#14748] Add ORDER BY to Derby pagination queries for deterministic results
• [#14764] Fix namespace ID validation issue in new UI when adding custom namespace
• [#14765] Fix configuration file editing error in 3.2 console
• [#14768] Fix /v3/console/ai/mcp/importToolsFromMcp failure due to json-schema-validator dependency conflict
• [#14771] Fix batch import failure in legacy console UI
• [#14775] Add missing OIDC-related configurations to application.properties template
• [#14778] Fix clusterName forced to DEFAULT in v3 HTTP API
• [#14783] Remove downloadSkillZip from AiClientProxy interface and route skill download directly to HTTP client
• [#14786] Eliminate race condition in AI publish pipeline by pre-generating executionId
• [#14810] Fix PostgreSQL schema default timestamp issues causing startup failures
• [#14812] Set default timestamps to current time in Oracle and PostgreSQL schemas
• [#14828] Fix cross-type version contamination when querying ai_resource_version by name
• [#14832] Fix PostgreSQL compatibility issues for AI resource persistence and capacity modules
• [#14836] Fix cross-type version contamination in ai_resource_version queries
• [#14837] Enforce type isolation for ai_resource_version queries
• [#14843] Fix ActionTypes.WRITE to ActionTypes.READ for getting instance detail in InstanceControllerV3
• [#14849] Fix instance detail permission check in InstanceControllerV3
• [#14852] Fix prompt bizTags handling in both legacy and next UIs
• [#14853] Fix login page loop and header when auth is disabled in next console
• [#14856] Redirect to login page on token invalid/expired responses
• [#14862] Fix LDAP authentication bypass via hardcoded credentials in proxy user synchronization
• [#14875] Fix misleading error messages in maintainer-client ParamUtil
• [#14886] Fix legacy console UI bugs and improve robustness
• [#14892] Fix misleading value reporting in maintainer-client when timeout/retry properties are invalid
• [#14908] Fix skill content loss in SkillRemoteHandler#createDraft when passing skillCard as targetVersion
• [#14910] Add null check for optional ids parameter in exportConfigV2
• [#14915] Add null check for metaDataItem in config import
• [#14917] Reject login with LDAP-prefixed usernames to prevent auth bypass
• [#14947] Fix exception when adding Prompt page in console

• [#14782] Upgrade MCP SDK to 0.17.0 to resolve json-schema-validator conflict
• [#14834] Upgrade UI dependencies (both legacy and next consoles)
• [#14910] Bump org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4
• [#14955] Upgrade Spring Boot from 3.4.10 to 3.5.13

Action Required: This release includes critical fixes for PostgreSQL, Oracle, MySQL, and Derby schemas, particularly around default timestamp values and ORDER BY clauses for deterministic pagination.

Before upgrading:

1. Backup your existing database
2. Apply the updated schema script: conf/schema.sql (for your database type)
3. Restart Nacos server after schema migration

Affected databases:

• PostgreSQL: Default timestamp fixes, AI resource persistence compatibility
• Oracle: Default timestamp fixes
• MySQL: Pagination query accuracy improvements
• Derby: ORDER BY clause additions, JDBC resource leak fixes

Failure to apply schema changes may result in:

• Database startup failures (PostgreSQL)
• Inconsistent pagination results
• JDBC resource leaks
• AI resource version contamination

This release adds OIDC/OAuth2 SSO login support for both legacy and next consoles. To enable:

# OIDC Configuration
nacos.auth.oidc.enabled=true
nacos.auth.oidc.issuer-uri=<your-oidc-issuer-uri>
nacos.auth.oidc.client-id=<your-client-id>
nacos.auth.oidc.client-secret=<your-client-secret>
nacos.auth.oidc.redirect-uri=${domain}/v3/console/login

• AgentCard v1 Protocol: Full support for A2A AgentCard v1 protocol with extended capabilities
• Unified Interfaces: Normalized and validated supported interfaces in agent card handling
• Version Meta API: New API to query agent spec metadata without loading full content

• @CHEN666333-SVG made their first contribution in https://github.com/alibaba/nacos/pull/14818
• @Sunwenzhi58 made their first contribution in https://github.com/alibaba/nacos/pull/14866
• @LiyunZhang10 made their first contribution in https://github.com/alibaba/nacos/pull/14928
• @FatOnionLee made their first contribution in https://github.com/alibaba/nacos/pull/14946

Full Changelog: https://github.com/alibaba/nacos/compare/3.2.0...3.2.1

Nacos 3.2.1-2026.04.03 is a snapshot release focused on critical bug fixes and feature enhancements for issues discovered in 3.2.0, particularly around AI module stability, database compatibility, and console UI improvements.

Key highlights include:

• AI Registry Enhancements: Complete Prompt lifecycle management UI, AI resource trace logging, and enhanced list APIs with filters
• Database Compatibility: PostgreSQL and Oracle schema fixes, deterministic pagination with ORDER BY clauses
• Dependency Resolution: Upgraded MCP SDK to 0.17.0 to resolve json-schema-validator conflicts
• Concurrency Fixes: Eliminated race conditions in AI publish pipeline, naming module, and client failover
• Console UI: Fixed configuration editing errors, namespace ID validation, and batch import issues

• [#14807] Add Prompt lifecycle management UI for both legacy and next consoles
• [#14809] Enhance AI resource list APIs with filters and ordering support
• [#14794] Support force-publish skills for admin user

• [#14743] Close CallableStatement in DerbySnapshotOperation to prevent JDBC resource leak
• [#14750] Fix check-then-act race condition in FailoverReactor.isFailoverSwitch
• [#14751] Fix check-then-act race conditions on ConcurrentHashMap in naming module
• [#14784] Validate input parameters in ops controller forms for better security
• [#14806] Improve cluster metrics aggregation completeness signal in v3 API
• [#14818] Improve cluster metrics aggregation completeness signal in v3 API
• [#14822] Extract duplicated logic from SkillOperationServiceImpl and AgentSpecOperationServiceImpl into AiResourceManager and VersionUtils
• [#14834] Upgrade UI dependencies for both legacy and next consoles

• [#14046] Fix ConfigInfoMapperByMySql.findConfigInfoLike4PageFetchRows result accuracy on MySQL
• [#14741] Add ORDER BY to findConfigInfoLike4PageFetchRows for deterministic pagination
• [#14742] Add ORDER BY to findConfigInfoLike4PageFetchRows for deterministic pagination
• [#14746] Add ORDER BY to remaining MySQL pagination queries for deterministic results
• [#14747] Add ORDER BY to Oracle pagination queries for deterministic results
• [#14748] Add ORDER BY to Derby pagination queries for deterministic results
• [#14764] Fix namespace ID validation issue in new UI when adding custom namespace
• [#14765] Fix configuration file editing error in 3.2 console
• [#14768] Fix /v3/console/ai/mcp/importToolsFromMcp failure due to json-schema-validator dependency conflict
• [#14771] Fix batch import failure in legacy console UI
• [#14775] Add missing OIDC-related configurations to application.properties template
• [#14783] Remove downloadSkillZip from AiClientProxy interface and route skill download directly to HTTP client
• [#14786] Eliminate race condition in AI publish pipeline by pre-generating executionId
• [#14810] Fix PostgreSQL schema default timestamp issues causing startup failures
• [#14812] Set default timestamps to current time in Oracle and PostgreSQL schemas
• [#14828] Fix cross-type version contamination when querying ai_resource_version by name
• [#14832] Fix PostgreSQL compatibility issues for AI resource persistence and capacity modules
• [#14836] Fix cross-type version contamination in ai_resource_version queries
• [#14837] Enforce type isolation for ai_resource_version queries
• [#14843] Fix ActionTypes.WRITE to ActionTypes.READ for getting instance detail in InstanceControllerV3
• [#14849] Fix instance detail permission check in InstanceControllerV3
• [#14852] Fix prompt bizTags handling in both legacy and next UIs

• [#14782] Upgrade MCP SDK to 0.17.0 to resolve json-schema-validator conflict
• [#14834] Upgrade UI dependencies (both legacy and next consoles)

Action Required: This release includes critical fixes for PostgreSQL and Oracle schemas, particularly around default timestamp values and ORDER BY clauses for deterministic pagination.

Before upgrading:

1. Backup your existing database
2. Apply the updated schema script: conf/schema.sql (for your database type)
3. Restart Nacos server after schema migration

Affected databases:

• PostgreSQL: Default timestamp fixes
• Oracle: Default timestamp fixes
• MySQL: Pagination query accuracy improvements
• Derby: ORDER BY clause additions

• @CHEN666333-SVG made their first contribution in https://github.com/alibaba/nacos/pull/14818

Full Changelog: https://github.com/alibaba/nacos/compare/3.2.0...3.2.1-2026.04.03

Nacos 3.2.1-2026.03.30 is a snapshot release focused on critical bug fixes for issues discovered in 3.2.0, particularly around AI module dependency conflicts, console UI bugs, and race conditions in the skill publish pipeline.

Key highlights include:

• Dependency Resolution: Upgraded MCP SDK to 0.17.0 to resolve json-schema-validator conflicts affecting AI module functionality
• AI Module Stability: Fixed race condition in skill publish pipeline and streamlined skill download routing
• Console UI Fixes: Addressed configuration file editing errors and namespace ID validation issues in the new UI
• Input Validation: Enhanced parameter validation in ops controller forms for better security

• [#14794] Support force-publish skills for admin user

• [#14784] Validate input parameters in ops controller forms for better security

• [#14765] Fix configuration file editing error in 3.2 console
• [#14768] Fix /v3/console/ai/mcp/importToolsFromMcp failure due to json-schema-validator dependency conflict
• [#14771] Fix batch import failure in legacy console UI
• [#14775] Add missing OIDC-related configurations to application.properties template
• [#14783] Remove downloadSkillZip from AiClientProxy interface and route skill download directly to HTTP client
• [#14786] Eliminate race condition in AI publish pipeline by pre-generating executionId
• [#14794] Fix namespace ID validation issue in new UI when adding custom namespace

• [#14782] Upgrade MCP SDK to 0.17.0 to resolve json-schema-validator conflict

Full Changelog: https://github.com/alibaba/nacos/compare/3.2.0...3.2.1-2026.03.30

Nacos 3.2.0 is a major release focused on plugin architecture enhancement, AI Registry expansion, API modernization, and code quality improvements. Key highlights include:

• AI Registry Completes the "AI Triad": Skill Registry and Prompt Registry join existing MCP/Agent Registry, with Nacos Copilot integration for AI-assisted management
• Plugin Architecture Modernization: Comprehensive SPI-based plugin management with console UI, cluster-wide synchronization, and PostgreSQL enhancements
• API Cleanup: Legacy UDP PUSH support removed, /v1 and /v2 HTTP APIs extracted to submodules for future removal
• Security & Code Quality: OIDC/OAuth2 authentication plugin, multiple FindBugs fixes, dead code removal, and JDK 17+ compatibility enhancements
• Console Modernization: Dual UI support for new/legacy console switching with improved user experience

• [#13699] Support outputSchema for MCP tools
• [#14041] Merge nacos-plugin PostgreSQL & Base Implementation into main repository
• [#14056] Refactor datasource plugins structure and enhance PostgreSQL capabilities
• [#14077] Implement SPI-based plugin discovery and management API
• [#14078] Implement cluster-wide state synchronization for plugins
• [#14079] Add plugin management console UI and API
• [#14084] Support MCP Tool _meta and annotations fields
• [#14085] Enhance MCP tool metadata with annotations support
• [#14101] Implement cluster-wide state synchronization
• [#14109] Introduce Prompt Registry as core component of Nacos AI Registry
• [#14110] Introduce Skills Registry to complement Nacos AI Registry vision
• [#14117] Add plugin management console UI and API
• [#14120] Add version parameter support to Maintainer SDK Get Agent Card method
• [#14527] Add OIDC/OAuth2 Authentication Plugin (Server)
• [#14534] Add find-skill-from-nacos capability for intelligent skill discovery
• [#14623] Add skill-scanner integration for AI Skill security scanning
• [#14641] Update Nacos console UI with modern design
• [#14653] Support dual UI switching between new and legacy console with contextPath adaptation
• [#14672] Skill support for data level access and visibility Phase 2
• [#14677] Skill support for data level access and visibility Phase 3

• [#14048] Refactor datasource plugins structure and enhance PostgreSQL capabilities
• [#14050] Extract /v1 and /v2 HTTP APIs to submodules for future removal
• [#14052] Remove UDP PUSH support for naming module
• [#14057] Refactor CreateTool and support output scheme
• [#14074] Remove legacy UDP PUSH support from naming module
• [#14122] Add JVM --add-opens options for JDK 17+ compatibility in startup scripts
• [#14125] Activate dev profile by default for plugin dependencies
• [#14441] Refactor version comparison and JSON field handling with constants
• [#14461] Remove obsolete p3c-pmd plugin and cleanup annotations
• [#14463] Unify component scanning with custom package exclusion
• [#14468] Unify component scanning with custom package exclusion
• [#14546] Remove unused common.cache package (dead code from Guava removal attempt)
• [#14585] Refactor admin API input from JSON body to form params
• [#14640] Refactor database plugins and update CI report paths

• [#13770] Fix missing context path in importToolsFromMcp and other AI-related APIs
• [#14009] Fix UUID passing issue in configuration fuzzy listening causing initialization events to be filtered
• [#14016] Fix Console automatic server member synchronization in distributed deployment
• [#14020] Fix missing '?' placeholder in database query
• [#14024] Fix MCP cache index inconsistency when recreating MCP server with same name
• [#14028] Fix remote server selection to use healthy nodes during import/export operations
• [#14063] Fix control plugin bug
• [#14104] Fix AI API context path errors in console
• [#14114] Fix incorrect grayRule detection in ConfigMigrateService
• [#14121] Fix console-ui pagination reset to 0 instead of 1 on API error
• [#14210] Fix MainLayout to handle language changes and fetch notices on update
• [#14307] Add JVM --add-opens options for JDK 17+ compatibility in startup scripts
• [#14401] Fix incorrect created field returned by ConfigRowMapperInjector
• [#14402] Fix MySQL LIKE query escaping to prevent underscore and hyphen confusion
• [#14442] Fix Derby and MySQL LIKE query with proper escape handling
• [#14450] Fix console remote server context-path for maintainer-client
• [#14454] Throw proper exception when form parameters exceed size limit
• [#14471] Replace Long.valueOf() with Long.parseLong() to avoid unnecessary boxing
• [#14479] Fix typo, incorrect Javadoc and improve resource management in health check processors
• [#14484] Add 'type' and 'md5' fields to findConfigInfoLike4PageFetchRows for plugin development
• [#14486] Remove unnecessary equals() override in enum classes
• [#14491] Fix DumpChangeGrayConfigWorker NPE
• [#14509] Fix non-short-circuit operator in for-loop condition
• [#14510] Fix clone() not calling super.clone() in ConfigForm
• [#14515] Fix unnecessary equals() override in enum classes
• [#14527] Add OIDC/OAuth2 Authentication Plugin (Server)
• [#14533] Fix DM_DEFAULT_ENCODING: add explicit charset to avoid platform-dependent encoding
• [#14538] Fix DMI_RANDOM_USED_ONLY_ONCE: replace new Random() with ThreadLocalRandom
• [#14545] Remove unused common.cache package
• [#14547] Fix HE_EQUALS_USE_HASHCODE: add missing hashCode() to Config model classes
• [#14548] Fix NP_PARAMETER_MUST_BE_NONNULL_BUT_MARKED_AS_NULLABLE: add null check in GrpcConnection callback
• [#14567] Fix console-ui TypeError in MainLayout and improve copilot module loading
• [#14616] Fix naming module pagination parameter validation
• [#14622] Exclude json-schema-validator 3.0.0 from agentscope-core to resolve NoClassDefFoundError
• [#14625] Fix NoClassDefFoundError by excluding conflicting json-schema-validator dependency
• [#14635] Fix health status update method to correctly handle persistent instances
• [#14712] Fix Skill ZIP upload losing SKILL.md content

• [#11180] Upgrade jraft-core version to 1.4.0
• [#14006] Upgrade Spring Boot to 3.4.10 to address CVE-2025-55752
• [#14055] Bump org.apache.logging.log4j:log4j-core from 2.24.3 to 2.25.3
• [#14625] Exclude json-schema-validator 3.0.0 from agentscope-core
• [#14714] Upgrade gRPC version to 1.78.0

Action Required: This release introduces significant database schema changes with multiple new tables added for plugin management, AI Registry (Skill/Prompt), and enhanced audit capabilities.

Before upgrading, you must apply the new schema:

1. Backup your existing database
2. Apply the schema upgrade script: conf/schema.sql (for MySQL) or corresponding script for your database type
3. Restart Nacos server after schema migration

Failure to apply the schema changes may result in plugin management, AI Registry, and other new features not functioning correctly.

Action Required: The plugins directory includes the api-legacy-adapter plugin by default to maintain compatibility with extracted /v1 and /v2 HTTP APIs. This plugin will be removed in future versions.

If you have confirmed that your deployment no longer uses the legacy /v1 or /v2 APIs, you can safely remove the api-legacy-adapter plugin from the plugins directory immediately to reduce footprint.

The naming module has removed legacy UDP PUSH support, moving to a cleaner HTTP API architecture. Clients relying on UDP-based service discovery updates must migrate to HTTP-based mechanisms.

• Centralized Management: Create, update, and version skills via UI or API with changelogs
• Skill Composition: Chain multiple MCP tools into business-meaningful capabilities (e.g., "user_onboarding" = verify_email + create_profile + send_welcome_email)
• MCP Integration: Skills explicitly declare dependencies on registered MCP tools with integrity validation
• Folder-based Organization: Skills displayed in multi-level folder structure for better organization
• Agent-Friendly APIs: REST/gRPC APIs for agent frameworks (LangChain, CrewAI, etc.) to discover and subscribe to skills
• Upload Support: Upload skill packages (zip format, max 10MB) with authentication
• Security Scanning: Integrated skill-scanner for AI Skill security validation
• Data Level Access: Fine-grained visibility and access control (Phase 2 & 3)

• First-Class Configuration: Store prompts with metadata (agentId, modelId, version, tags) as versioned config artifacts
• Multi-Version Management: Support parallel multi-version management with template and commit message tracking
• Tag-Based Subscription: Subscribe to prompts by tags for dynamic updates
• Interactive Debugging: Test and compare prompt outputs across versions directly in console
• AI Client Proxy: Unified HTTP/gRPC client interface for prompt operations

• AI-Powered Assistant: Integrated AI assistant to help optimize and create Prompts and Skills
• Intelligent Discovery: Automatically find relevant existing skills from the registry
• Console Integration: Accessible directly from Nacos console for seamless workflow

• @INotWant made their first contribution in https://github.com/alibaba/nacos/pull/14009
• @QingYuanQ made their first contribution in https://github.com/alibaba/nacos/pull/14020
• @echooymxq made their first contribution in https://github.com/alibaba/nacos/pull/14100
• @shichaoyuan made their first contribution in https://github.com/alibaba/nacos/pull/14099
• @chlch made their first contribution in https://github.com/alibaba/nacos/pull/14104
• @lvren1485 made their first contribution in https://github.com/alibaba/nacos/pull/14210
• @slightsharp made their first contribution in https://github.com/alibaba/nacos/pull/14263
• @Cholesterol12138 made their first contribution in https://github.com/alibaba/nacos/pull/14357
• @codezkk made their first contribution in https://github.com/alibaba/nacos/pull/14401
• @1lck made their first contribution in https://github.com/alibaba/nacos/pull/14449
• @Zjianru made their first contribution in https://github.com/alibaba/nacos/pull/14461
• @qiacheng7 made their first contribution in https://github.com/alibaba/nacos/pull/14465
• @aMetric made their first contribution in https://github.com/alibaba/nacos/pull/14477
• @DocJlm made their first contribution in https://github.com/alibaba/nacos/pull/14480
• @java-acc made their first contribution in https://github.com/alibaba/nacos/pull/14485
• @FrioSea made their first contribution in https://github.com/alibaba/nacos/pull/14476
• @saynoword made their first contribution in https://github.com/alibaba/nacos/pull/14534
• @pierluigilenoci made their first contribution in https://github.com/alibaba/nacos/pull/14706
• @daguimu made their first contribution in https://github.com/alibaba/nacos/pull/14730

Full Changelog: https://github.com/alibaba/nacos/compare/3.1.1...3.2.0

Nacos 3.1.2 is a patch release focused on stability improvements, security fixes, and AI module enhancements. Key highlights include:

• Security: Upgraded Spring Boot to 3.4.10 to address CVE-2025-55752, plus log4j and gRPC dependency updates
• AI/MCP: Fixed MCP cache inconsistency issues and added version parameter support for Agent Card queries
• Console: Improved distributed deployment experience with automatic server member sync and fixed multiple context path issues
• Client: Eliminated class unloading memory leak during config reload and fixed UUID passing issue in fuzzy listening
• Config: Enhanced config metadata publishing with audit logging and notifications

• [#13996] Add event publishing for agent and MCP endpoint operations
• [#13999] Add audit logging and notifications for config metadata publishing
• [#14120] Add version parameter support to Maintainer SDK Get Agent Card method

• [#14000] Eliminate class unloading memory leak during configuration reload using Configuration.initialize()
• [#14062] Prevent potential data modification risk in client ServiceInfoHolder
• [#14099] Add validation for serviceName and groupName in SubscribeServiceRequestHandler
• [#14449] Remove ineffective ThreadLocal in MD5Utils
• [#14454] Throw proper exception when form parameters exceed size limit

• [#13770] Fix missing context path in importToolsFromMcp and other AI-related APIs
• [#14009] Fix UUID passing issue in configuration fuzzy listening causing initialization events to be filtered
• [#14016] Fix Console automatic server member synchronization in distributed deployment
• [#14020] Fix missing '?' placeholder in database query
• [#14024] Fix MCP cache index inconsistency when recreating MCP server with same name
• [#14028] Fix remote server selection to use healthy nodes during import/export operations
• [#14063] Fix control plugin bug
• [#14104] Fix AI API context path errors in console
• [#14114] Fix incorrect grayRule detection in ConfigMigrateService
• [#14121] Fix console-ui pagination reset to 0 instead of 1 on API error
• [#14210] Fix MainLayout to handle language changes and fetch notices on update
• [#14401] Fix incorrect created field returned by ConfigRowMapperInjector
• [#14402] Fix MySQL LIKE query escaping to prevent underscore and hyphen confusion
• [#14442] Fix Derby and MySQL LIKE query with proper escape handling
• [#14450] Fix console remote server context-path for maintainer-client
• [#14635] Fix health status update method to correctly handle persistent instances

• [#14006] Upgrade Spring Boot to 3.4.10 to address CVE-2025-55752
• [#14055] Bump org.apache.logging.log4j:log4j-core from 2.24.3 to 2.25.3
• [#14714] Upgrade gRPC version to 1.78.0

Thanks to all contributors: @KomachiSion, @chunhai1127, @INotWant, @chlch, and the Nacos community.

Full Changelog: https://github.com/alibaba/nacos/compare/3.1.1...3.1.2

This version focuses on plugin architecture enhancement, API modernization, AI Registry expansion, and code quality improvements.

Nacos 3.2.0 introduces Skill Registry and Prompt Registry, completing the AI control plane vision alongside existing MCP Registry and Agent Registry:

• Skill Registry: Centralized management for reusable, business-aligned capabilities composed of MCP tools with versioning, tags, and folder-based organization
• Prompt Registry: First-class prompt management with multi-version support, tag-based subscription, template management, and A/B testing capabilities
• Nacos Copilot: AI-powered assistant integrated into Nacos console, helping users optimize/create Prompts and Skills, and intelligently find existing skills from the registry

Comprehensive plugin management system with SPI-based plugin discovery, management console UI, and cluster-wide state synchronization. PostgreSQL datasource plugin receives significant enhancements with merged implementations from nacos-plugin repository.

The naming module removes legacy UDP PUSH support, moving to a cleaner HTTP API architecture with /v1 and /v2 APIs extracted to submodules for future removal.

MCP (Model Context Protocol) support is expanded with tool _meta, annotations fields, and output scheme support.

Multiple FindBugs/SpotBugs fixes, dead code removal, and JDK 17+ compatibility enhancements.

Action Required: In this version, the plugins directory includes the api-legacy-adapter plugin by default to maintain compatibility with extracted /v1 and /v2 HTTP APIs. This plugin will be removed in future versions.

If you have confirmed that your deployment no longer uses the legacy /v1 or /v2 APIs, you can safely remove the api-legacy-adapter plugin from the plugins directory immediately to reduce footprint.

[#14050] Extract /v1 and /v2 HTTP APIs to submodules for future removal. [#14052] Remove UDP PUSH support for naming module. [#14077] Implement SPI-based plugin discovery and management API. [#14078] Implement cluster-wide state synchronization. [#14079] Add plugin management console UI and API. [#14084] Support MCP Tool _meta and annotations fields. [#14109] Introduce Prompt Registry as a core component of Nacos AI Registry. [#14110] Introduce Skills Registry to complement Nacos AI Registry vision. [#14122] Add JVM --add-opens options for JDK 17+ compatibility in startup scripts. [#14245] Integrate Nacos Copilot for AI-assisted Prompt and Skill management. [#14440] Add Prompt Registry with multi-version management support. [#14453] Support tag-based subscription and management for Prompts. [#14484] Add 'type' and 'md5' fields to findConfigInfoLike4PageFetchRows for plugin development. [#14505] Refactor Prompt Registry to support parallel multi-version management. [#14525] Add AI client proxy interface supporting HTTP and gRPC transport. [#14534] Add find-skill-from-nacos capability for intelligent skill discovery.

[#13699] Support outputSchema for MCP tools. [#14048] Refactor datasource plugins structure and enhance PostgreSQL capabilities. [#14056] Support output scheme and refactor the CreateTool. [#14057] Refactor CreateTool and support output scheme. [#14441] Refactor version comparison and JSON field handling with constants. [#14461] Remove obsolete p3c-pmd plugin and cleanup annotations. [#14463] Unify component scanning with custom package exclusion. [#14468] Unify component scanning with custom package exclusion. [#14479] Fix typo, incorrect Javadoc and improve resource management in health check processors. [#14486] Remove unnecessary equals() override in enum classes. [#14489] Align PostgreSQL trusted function enum and enrich tag queries. [#14537] Normalize escaped YAML parsing and stabilize skill export/import roundtrips. [#14545] Remove unused common.cache package (dead code from Guava removal attempt). [#14565] Extract common RemoteServerConnector for AI services.

[#14084] Support meta and annotation in mcp tools. [#14117] Add plugin management console UI and API. [#14471] Replace Long.valueOf() with Long.parseLong() to avoid unnecessary boxing. [#14484] Add 'type' and 'md5' fields to findConfigInfoLike4PageFetchRows for plugin development. [#14491] Fix DumpChangeGrayConfigWorker NPE. [#14509] Fix non-short-circuit operator in for-loop condition. [#14510] Fix clone() not calling super.clone() in ConfigForm. [#14527] Add OIDC/OAuth2 Authentication Plugin (Server). [#14533] Fix DM_DEFAULT_ENCODING: add explicit charset to avoid platform-dependent encoding. [#14538] Fix DMI_RANDOM_USED_ONLY_ONCE: replace new Random() with ThreadLocalRandom. [#14547] Fix HE_EQUALS_USE_HASHCODE: add missing hashCode() to Config model classes. [#14548] Fix NP_PARAMETER_MUST_BE_NONNULL_BUT_MARKED_AS_NULLABLE: add null check in GrpcConnection callback. [#14567] Fix console-ui TypeError in MainLayout and improve copilot module loading.

[#11180] Upgrade jraft-core version to 1.4.0.

• Centralized Management: Create, update, and version skills via UI or API with changelogs
• Skill Composition: Chain multiple MCP tools into business-meaningful capabilities (e.g., "user_onboarding" = verify_email + create_profile + send_welcome_email)
• MCP Integration: Skills explicitly declare dependencies on registered MCP tools with integrity validation
• Folder-based Organization: Skills displayed in multi-level folder structure for better organization
• Agent-Friendly APIs: REST/gRPC APIs for agent frameworks (LangChain, CrewAI, etc.) to discover and subscribe to skills
• Upload Support: Upload skill packages (zip format, max 10MB) with authentication

• First-Class Configuration: Store prompts with metadata (agentId, modelId, version, tags) as versioned config artifacts
• Multi-Version Management: Support parallel multi-version management with template and commit message tracking
• Tag-Based Subscription: Subscribe to prompts by tags for dynamic updates
• Interactive Debugging: Test and compare prompt outputs across versions directly in console
• AI Client Proxy: Unified HTTP/gRPC client interface for prompt operations

• AI-Powered Assistant: Integrated AI assistant to help optimize and create Prompts and Skills
• Intelligent Discovery: Automatically find relevant existing skills from the registry
• Console Integration: Accessible directly from Nacos console for seamless workflow

• @INotWant made their first contribution in https://github.com/alibaba/nacos/pull/14009
• @QingYuanQ made their first contribution in https://github.com/alibaba/nacos/pull/14020
• @echooymxq made their first contribution in https://github.com/alibaba/nacos/pull/14100
• @shichaoyuan made their first contribution in https://github.com/alibaba/nacos/pull/14099
• @chlch made their first contribution in https://github.com/alibaba/nacos/pull/14104
• @lvren1485 made their first contribution in https://github.com/alibaba/nacos/pull/14210
• @slightsharp made their first contribution in https://github.com/alibaba/nacos/pull/14263
• @Cholesterol12138 made their first contribution in https://github.com/alibaba/nacos/pull/14357
• @codezkk made their first contribution in https://github.com/alibaba/nacos/pull/14401
• @1lck made their first contribution in https://github.com/alibaba/nacos/pull/14449
• @Zjianru made their first contribution in https://github.com/alibaba/nacos/pull/14461
• @qiacheng7 made their first contribution in https://github.com/alibaba/nacos/pull/14465
• @aMetric made their first contribution in https://github.com/alibaba/nacos/pull/14477
• @DocJlm made their first contribution in https://github.com/alibaba/nacos/pull/14480
• @java-acc made their first contribution in https://github.com/alibaba/nacos/pull/14485
• @FrioSea made their first contribution in https://github.com/alibaba/nacos/pull/14476
• @saynoword made their first contribution in https://github.com/alibaba/nacos/pull/14534

Full Changelog: https://github.com/alibaba/nacos/compare/3.1.1...3.2.0-BETA