JavaGolangJavaScriptSwiftAndroidRustMiddleware
4 hours ago
seaweedfs
seaweedfs

4.52

What's Changed

New Contributors

Full Changelog: https://github.com/seaweedfs/seaweedfs/compare/4.51...4.52

6 hours ago
MeiliSearch
meilisearch

v1.55.1 🔭

Meilisearch v1.55.1 introduces important security fixes. Upgrading from v1.55.0 and earlier is recommended for all users.

See the release notes for Meilisearch v1.56.1 for details.

Full Changelog: https://github.com/meilisearch/meilisearch/compare/v1.55.0...v1.55.1

6 hours ago
MeiliSearch
meilisearch

v1.56.1 🐫

Meilisearch v1.56.1 introduces important security fixes. Updating from v1.56.0 is recommended for all users.

🦋 Fixes

  • Fix issue with ranking scores greater than 1 by @dureuill in https://github.com/meilisearch/meilisearch/pull/6703

  • Make sure that all nested fields are inserted in field id map by @dureuill in https://github.com/meilisearch/meilisearch/pull/6700

    • Fixes a panic when modifying the list of searchable attributes after an existing document has been updated to insert new nested fields.

    • Existing databases encountering this issue can be fixed by adding a new document containing the new nested fields.

    • Fixes #6636 and fixes #6657

🔒 Security

🔩 Miscellaneous

New Contributors

Full Changelog: https://github.com/meilisearch/meilisearch/compare/v1.56.0...v1.56.1

1 days ago
redis
redis

8.12 RC2

This is the second Release Candidate of Redis 8.12 in Redis Open Source.

Release Candidates are feature-complete pre-releases. Pre-releases are not suitable for production use.

New Features

  • #16082 Update the Search module to include all RedisSearch-related content that was intended for RC1
3 days ago
thingsboard
thingsboard

ThingsBoard 4.4.0.2 Release

What's Changed

Security

  • Security patches by @ViacheslavKlimov and @smatvienko-tb

Full Changelog: https://github.com/thingsboard/thingsboard/compare/v4.4.0.1...v4.4.0.2

3 days ago
influxdb
influxdata

v1.13.2

Please see https://docs.influxdata.com/influxdb/v1/about_the_project/release-notes/#v1132 for official release notes.

Bug fixes

Maintenance

OSS BINARY FILES SHA256
influxdb-1.13.2_linux_amd64.tar.gz 4b1254ebcef8361baab2e0e4313e7e2821d56bea34bc0d5a63c0c2312cdd41c1
influxdb-1.13.2_linux_arm64.tar.gz 5f334b94cb02c20a063698f25155171013f61f9c6c7deb07e83b825247413f69
influxdb-1.13.2_darwin_amd64.tar.gz f54909cb3f3960f49023309b30bf91a5bdd4ce7f037dbeff7a3363d71da19e5d
influxdb-1.13.2-windows_amd64.zip 5e61905d8a50d1775ae329183a1c2b4f798abd6328b812a7bf27870ae2fe87bb
OSS UBUNTU AND DEBIAN PACKAGE FILES SHA256
influxdb_1.13.2-1_amd64.deb c072144aa2aed112c0ae46a099b9e3677ac5d0c8b17abba8699d3bad5b3d603e
influxdb_1.13.2-1_arm64.deb d25674a563084400f34761945e810b2aa4f3ed8dd586a264705257dc0e950b31
OSS REDHAT & CENTOS PACKAGE FILES SHA256
influxdb-1.13.2.aarch64.rpm c69b796e2c8f6ef6b1df7e5de99a5abe797b2903875b229b7c534e129e1a946d
influxdb-1.13.2.x86_64.rpm 8241f6c01459648467caca61353487400fc5ec9e472b4f677955245fb2639445
3 days ago
node
nodejs

2026-10-29, Version 27.0.0-alpha.0.0.0 (Alpha), @RafaelGSS

Notable Changes

V8 15.6

The V8 engine is updated to version 15.6.75.13, up from 14.6 in Node.js 26. Highlights:

  • New language features enabled by default: Math.sumPrecise(), Intl.Locale.prototype.variants, Iterator.prototype.join(), Iterator.prototype.includes(), Iterator.zip() and Iterator.zipKeyed().
  • Experimental features behind flags: import defer (--js-defer-import-eval), Immutable ArrayBuffer (--js-immutable-arraybuffer) and RegExp buffer boundaries (--js-regexp-buffer-boundaries).
  • Memory: when --max-old-space-size is not set, the default heap size limit is now half of the physical memory clamped between 256 MB and 4 GB, and memory held by Buffer and ArrayBuffer instances now counts toward the heap limit. Applications that relied on the previous defaults should set --max-old-space-size explicitly.
  • Serialization: v8.serialize(), structuredClone() and postMessage() use a new format that older Node.js releases cannot read. v8.cachedDataVersionTag() and the compile cache also change on every Node.js patch of V8, not only on V8 version changes.
  • Observable behavior changes: Math methods now use LLVM's libm and may differ in the last bit; Math.random() sequences change for a given --random-seed; error.stack is no longer looked up through the prototype chain; await incurs fewer microtasks; Array.prototype.sort() uses PowerSort for large arrays and remains stable.
  • Heap snapshots include internal objects, numeric values and full script sources. Taking one takes about twice as long and the file is about twice as large.
  • WebAssembly: asm.js is no longer compiled to WebAssembly, and the --experimental-wasm-<name> flags are renamed --wasm-<name>.

A full changelog of the V8 changes between 14.6 and 15.6 will be shared soon.

Contributed by Joyee Cheung in #65161, #66537 and #66601.

Other notable changes

  • [21cfb2a4ad] - (SEMVER-MAJOR) build: remove the bundled FIPS provider build (Filip Skokan) #64777
  • [34e3b90621] - (SEMVER-MAJOR) build: require OpenSSL 3 or later (Filip Skokan) #64777
  • [c362db6e24] - (SEMVER-MAJOR) build: downgrade Intel macOS support to experimental (Antoine du Hamel) #65427
  • [fb8d52d75a] - (SEMVER-MAJOR) crypto: move DEP0093 to End-of-Life (Filip Skokan) #64777
  • [8be36fb494] - (SEMVER-MAJOR) crypto: remove legacy OpenSSL code paths (Filip Skokan) #64777
  • [718f044f07] - (SEMVER-MAJOR) crypto: validate digest output encodings (Filip Skokan) #66247
  • [6b8001d219] - (SEMVER-MAJOR) crypto: validate update input encodings (Filip Skokan) #66247
  • [127f79a911] - (SEMVER-MAJOR) crypto: validate inputEncoding in Cipher/Decipher update (Maruthan G) #66247
  • [b116861e88] - (SEMVER-MAJOR) crypto: move DEP0198 to End-of-Life (Filip Skokan) #64000
  • [4d09c04253] - (SEMVER-MAJOR) crypto: move DEP0203 and DEP0204 to End-of-Life (Filip Skokan) #63188
  • [9d50432837] - (SEMVER-MAJOR) crypto: reject resizable backing stores in Web Crypto buffer parameters (Filip Skokan) #63925
  • [63907e1018] - (SEMVER-MAJOR) crypto: throw on uninitialized DH computeSecret (Filip Skokan) #63922
  • [463e56fb00] - (SEMVER-MAJOR) crypto: runtime-deprecate calling Hmac.digest() more than once (Madelyn) #63624
  • [a2cd8aa883] - (SEMVER-MAJOR) crypto,https,tls: end OpenSSL engine support (Filip Skokan) #64777
  • [3983092f63] - (SEMVER-MAJOR) deps: update archs files for openssl-4.1.0 (Node.js GitHub Bot) #66971
  • [79239a48f1] - (SEMVER-MAJOR) deps: upgrade openssl sources to openssl-4.1.0 (Node.js GitHub Bot) #66971
  • [85bfe9a938] - (SEMVER-MAJOR) deps: remove ncrypto legacy OpenSSL backend (Filip Skokan) #64777
  • [826df076a3] - (SEMVER-MAJOR) deps: update V8 to 15.6.75.13 (Joyee Cheung) #66601
  • [4eb3908d1f] - (SEMVER-MAJOR) deps: upgrade npm to 12.1.0 (npm team) #66212
  • [cba0833111] - (SEMVER-MAJOR) dgram: skip the custom lookup for literal IP addresses (Ruben Bridgewater) #64131
  • [54a5095764] - (SEMVER-MAJOR) dns: do not consult hosts file in reverse lookups (Archkon) #64268
  • [efc0a14461] - (SEMVER-MAJOR) dns: stop using deprecated functions in SetServers (Antoine du Hamel) #64356
  • [7f16850ef6] - (SEMVER-MAJOR) doc: remove OpenSSL 1.x references (Filip Skokan) #64777
  • [9c67491706] - (SEMVER-MAJOR) doc: update Node.js 27 official binary toolchains (Richard Lau) #66377
  • [6071f8bc32] - (SEMVER-MAJOR) domain: runtime-deprecate the module (Matteo Collina) #65074
  • [2c4356cedf] - (SEMVER-MAJOR) domain: port to AsyncLocalStorage (Matteo Collina) #61095
  • [a8f2bf007e] - (SEMVER-MAJOR) fs: implement glob natively (Aviv Keller) #65392
  • [1f53d7ee3f] - (SEMVER-MAJOR) fs: return Buffer from mkdtemp when prefix is a Buffer (Hamid Reza Ghavami) #64397
  • [e5778f78c5] - (SEMVER-MAJOR) http: reject responses exceeding header limit (Matteo Collina) #65010
  • [25c0c8e18a] - (SEMVER-MAJOR) http: runtime deprecate instantiating without new (Yagiz Nizipli) #64853
  • [9f75269840] - (SEMVER-MAJOR) http: increase keepAliveTimeout default to 65 seconds (Tim Perry) #62782
  • [21436f0405] - (SEMVER-MAJOR) http: make req.headers have a null prototype (Matteo Collina) #62900
  • [b2248fd370] - (SEMVER-MAJOR) http: reject addTrailers after finish (Ryuhei Shima) #62832
  • [1576cb83b4] - (SEMVER-MAJOR) http2: increase default window sizes (Matteo Collina) #64623
  • [12ce81920a] - (SEMVER-MAJOR) lib: deprecate _http_* (Sebastian Beltran) #58535
  • [19c46abbef] - (SEMVER-MAJOR) lib: insert argv[0] at argv[1] in setDeserializeMainFunction (Daijiro Wachi) #62928
  • [b1387e6aed] - (SEMVER-MAJOR) lib: use Object.freeze to avoid defensive cloning in SourceMap (Daijiro Wachi) #62830
  • [9390c810d1] - (SEMVER-MAJOR) lib: reject SharedArrayBuffer in Blob constructor per spec (Ali Hassan) #63046
  • [057e591f7c] - (SEMVER-MAJOR) lib,src: remove --no-experimental-websocket CLI flag (Antoine du Hamel) #65284
  • [9746ebce07] - (SEMVER-MAJOR) net: race family autoselection attempts (Matteo Collina) #66229
  • [e03e2f6486] - (SEMVER-MAJOR) net: throw on multiple listen calls (Matteo Collina) #64871
  • [a6e7e6a95e] - (SEMVER-MAJOR) net: runtime-deprecate Server.prototype._listen2 (Guilherme Araújo) #64794
  • [6d8baeabb0] - (SEMVER-MAJOR) net: add experimental net/promises API (Ethan Arrowood) #63965
  • [4f844f4380] - (SEMVER-MAJOR) repl: use inspector over vm (Aviv Keller) #64034
  • [fc28d9402f] - (SEMVER-MAJOR) src: officially deprecate node::ObjectWrap (Anna Henningsen) #63756
  • [2d0c926907] - (SEMVER-MAJOR) src: merge CreateEnvironment() overloads (Anna Henningsen) #63596
  • [f378cfcfbf] - (SEMVER-MAJOR) src,lib: add --allow-env permission (James M Snell) #66132
  • [9f7ae86d8b] - (SEMVER-MAJOR) stream: destroy source when map iterator closes early (Y1D7NG) #64264
  • [6698675526] - test_runner: use AsyncLocalStorage instead of async_hooks (Matteo Collina) #66795
  • [7a11a9b2db] - (SEMVER-MAJOR) tls: move _tls_* to end-of-life (Sebastian Beltran) #60658
  • [967d4af565] - (SEMVER-MAJOR) zlib: convert classes to modern syntax and eol DEP0184 (Yagiz Nizipli) #64849

Semver-Major Commits

  • [984aa0c25e] - (SEMVER-MAJOR) async_hooks: remove legacy AsyncLocalStorage implementation (Matteo Collina) #63641
  • [d1960949bb] - (SEMVER-MAJOR) benchmark: protect against accidental fork bomb (James M Snell) #66132
  • [21cfb2a4ad] - (SEMVER-MAJOR) build: remove the bundled FIPS provider build (Filip Skokan) #64777
  • [34e3b90621] - (SEMVER-MAJOR) build: require OpenSSL 3 or later (Filip Skokan) #64777
  • [6f178cd39f] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Joyee Cheung) #66601
  • [60c7958b8e] - (SEMVER-MAJOR) build: update flags for V8 CI (Richard Lau) #66537
  • [05c9b89d42] - (SEMVER-MAJOR) build: disable V8_USE_METAGEN_INSTANCE_TYPES (Joyee Cheung) #66537
  • [18077b5d3a] - (SEMVER-MAJOR) build: do not match v8_libplatform_headers when scraping sources (Joyee Cheung) #66537
  • [520388f362] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Joyee Cheung) #66537
  • [30074a3cc8] - (SEMVER-MAJOR) build: fix cppgc_base perfetto source scraper (Chengzhong Wu) #65161
  • [b356886269] - (SEMVER-MAJOR) build: use ICU_UTIL_DATA_STATIC across V8 (Joyee Cheung) #65161
  • [08a7331bb1] - (SEMVER-MAJOR) build: disable v8_postmortem_support (Joyee Cheung) #65161
  • [c148a7f3ba] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Joyee Cheung) #65161
  • [87a4efb61f] - (SEMVER-MAJOR) Revert "build: update Makefile to support fat binary" (Antoine du Hamel) #65427
  • [c362db6e24] - (SEMVER-MAJOR) build: downgrade Intel macOS support to experimental (Antoine du Hamel) #65427
  • [ea86967557] - (SEMVER-MAJOR) build,win: do not quote cmd arguments (StefanStojanovic) #65161
  • [fb8d52d75a] - (SEMVER-MAJOR) crypto: move DEP0093 to End-of-Life (Filip Skokan) #64777
  • [8be36fb494] - (SEMVER-MAJOR) crypto: remove legacy OpenSSL code paths (Filip Skokan) #64777
  • [718f044f07] - (SEMVER-MAJOR) crypto: validate digest output encodings (Filip Skokan) #66247
  • [6b8001d219] - (SEMVER-MAJOR) crypto: validate update input encodings (Filip Skokan) #66247
  • [127f79a911] - (SEMVER-MAJOR) crypto: validate inputEncoding in Cipher/Decipher update (Maruthan G) #66247
  • [b116861e88] - (SEMVER-MAJOR) crypto: move DEP0198 to End-of-Life (Filip Skokan) #64000
  • [4d09c04253] - (SEMVER-MAJOR) crypto: move DEP0203 and DEP0204 to End-of-Life (Filip Skokan) #63188
  • [9d50432837] - (SEMVER-MAJOR) crypto: reject resizable backing stores in Web Crypto buffer parameters (Filip Skokan) #63925
  • [63907e1018] - (SEMVER-MAJOR) crypto: throw on uninitialized DH computeSecret (Filip Skokan) #63922
  • [463e56fb00] - (SEMVER-MAJOR) crypto: runtime-deprecate calling Hmac.digest() more than once (Madelyn) #63624
  • [a2cd8aa883] - (SEMVER-MAJOR) crypto,https,tls: end OpenSSL engine support (Filip Skokan) #64777
  • [b61e682fc0] - (SEMVER-MAJOR) Revert "crypto,https,tls: runtime-deprecate OpenSSL engine-based APIs (DEP0183)" (Filip Skokan) #64777
  • [da516920fc] - (SEMVER-MAJOR) crypto,https,tls: runtime-deprecate OpenSSL engine-based APIs (DEP0183) (Filip Skokan) #63966
  • [3983092f63] - (SEMVER-MAJOR) deps: update archs files for openssl-4.1.0 (Node.js GitHub Bot) #66971
  • [79239a48f1] - (SEMVER-MAJOR) deps: upgrade openssl sources to openssl-4.1.0 (Node.js GitHub Bot) #66971
  • [85bfe9a938] - (SEMVER-MAJOR) deps: remove ncrypto legacy OpenSSL backend (Filip Skokan) #64777
  • [1c90519c1a] - (SEMVER-MAJOR) deps: V8: cherry-pick 8d14d49c4040 (Antoine du Hamel) #66601
  • [2d87c56f37] - (SEMVER-MAJOR) deps: V8: cherry-pick 19173cde61d8 (Joyee Cheung) #66601
  • [2589e42f48] - (SEMVER-MAJOR) deps: V8: cherry-pick 95626c699ff2 (Joyee Cheung) #66601
  • [0e2f479a0c] - (SEMVER-MAJOR) deps: V8: cherry-pick 99ebeac9c548 (Joyee Cheung) #66601
  • [c1e280b773] - (SEMVER-MAJOR) deps: V8: cherry-pick b2fc93f37507 (Joyee Cheung) #66601
  • [66f9d2e907] - (SEMVER-MAJOR) deps: V8: cherry-pick e10d795bfe95 (Joyee Cheung) #66601
  • [fc2b3fb0d0] - (SEMVER-MAJOR) deps: V8: cherry-pick 5dfeb2e42380 (Joyee Cheung) #66601
  • [5fb4242977] - (SEMVER-MAJOR) deps: V8: cherry-pick 415b7d302d2e (Joyee Cheung) #66601
  • [cb9469250e] - (SEMVER-MAJOR) deps: patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #66601
  • [415fe6e55e] - (SEMVER-MAJOR) deps: update Rust crates for V8 15.6.75.13 (Joyee Cheung) #66601
  • [826df076a3] - (SEMVER-MAJOR) deps: update V8 to 15.6.75.13 (Joyee Cheung) #66601
  • [18b117b30f] - (SEMVER-MAJOR) deps: patch V8 to fix Windows build (StefanStojanovic) #66537
  • [87c1b1cfb4] - (SEMVER-MAJOR) deps: support madvise(3C) across ALL illumos revisions (Dan McDonald) #66537
  • [5fb74d16f9] - (SEMVER-MAJOR) deps: patch V8 for illumos (Dan McDonald) #66537
  • [ea41e655f3] - (SEMVER-MAJOR) deps: define V8_PRESERVE_MOST as no-op on Windows (Stefan Stojanovic) #66537
  • [a633547d9c] - (SEMVER-MAJOR) deps: patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #66537
  • [bae4e709b8] - (SEMVER-MAJOR) deps: V8: cherry-pick 1246d3bfab1a (Joyee Cheung) #66537
  • [a9cc80dd34] - (SEMVER-MAJOR) deps: V8: cherry-pick 00508c374a45 (Joyee Cheung) #66537
  • [801d1c7a39] - (SEMVER-MAJOR) deps: V8: backport 9fb4444bfc46 (Steven R. Loomis) #66537
  • [938487505f] - (SEMVER-MAJOR) deps: V8: cherry-pick 786c1c2d88d4 (Eliau Elkouby) #66537
  • [e7db80914f] - (SEMVER-MAJOR) deps: V8: cherry-pick 820f3d72a638 (Joyee Cheung) #66537
  • [2551a56021] - (SEMVER-MAJOR) deps: V8: cherry-pick 315d9c945ac3 (ishabi) #66537
  • [bfd74f89dd] - (SEMVER-MAJOR) deps: V8: cherry-pick 37baecdd9479 (ishabi) #66537
  • [fd1aba0dfa] - (SEMVER-MAJOR) deps: V8: cherry-pick 99ebeac9c548 (Joyee Cheung) #66537
  • [f0273edb9e] - (SEMVER-MAJOR) deps: V8: cherry-pick b2fc93f37507 (Joyee Cheung) #66537
  • [d5a8930d0f] - (SEMVER-MAJOR) deps: update Rust crates for V8 15.5.35.20 (Joyee Cheung) #66537
  • [6b28cb0909] - (SEMVER-MAJOR) deps: update V8 to 15.5.35.20 (Joyee Cheung) #66537
  • [93bb027b68] - (SEMVER-MAJOR) deps: V8: cherry-pick c795f5948568 (Aviv Keller) #65161
  • [28553729d0] - (SEMVER-MAJOR) deps: remove broken NamedPropertyDefinerCallbackV2 converter (Joyee Cheung) #65161
  • [84087531dc] - (SEMVER-MAJOR) deps: V8: backport 9fb4444bfc46 (Steven R. Loomis) #65161
  • [346ac563dc] - (SEMVER-MAJOR) deps: V8: cherry-pick 786c1c2d88d4 (Eliau Elkouby) #65161
  • [39d3b1d1a0] - (SEMVER-MAJOR) deps: V8: cherry-pick 5404e0f85a83 (Shelley Vohr) #65161
  • [5d221d9cd6] - (SEMVER-MAJOR) deps: V8: cherry-pick 820f3d72a638 (Joyee Cheung) #65161
  • [6faa33426f] - (SEMVER-MAJOR) deps: V8: cherry-pick 315d9c945ac3 (ishabi) #65161
  • [daf03c0361] - (SEMVER-MAJOR) deps: V8: cherry-pick 37baecdd9479 (ishabi) #65161
  • [9e274db98a] - (SEMVER-MAJOR) deps: V8: backport a0607c5006b8 (Antoine du Hamel) #65161
  • [bfc94df374] - (SEMVER-MAJOR) deps: V8: cherry-pick f4221e09e812 (Gundepalli Sravani) #65161
  • [f2967441e5] - (SEMVER-MAJOR) deps: V8: backport f3d4d458fe59 (Olivier Flückiger) #65161
  • [33e5031503] - (SEMVER-MAJOR) deps: V8: cherry-pick 99ebeac9c548 (Joyee Cheung) #65161
  • [c419eaca14] - (SEMVER-MAJOR) deps: V8: cherry-pick 811fe8b04203 (Milad Fa) #65161
  • [677424cd86] - (SEMVER-MAJOR) deps: V8: cherry-pick ba4ef8d72cde (Joyee Cheung) #65161
  • [268bd647fc] - (SEMVER-MAJOR) deps: V8: cherry-pick 68cf9ecd884b (Joyee Cheung) #65161
  • [430abdf455] - (SEMVER-MAJOR) deps: fixup macros.h for GCC support (Michaël Zasso) #65161
  • [109aaa78bd] - (SEMVER-MAJOR) deps: fix V8 race condition for AIX (Abdirahim Musse) #65161
  • [38b9b32a3b] - (SEMVER-MAJOR) deps: patch V8 to fix Windows build (StefanStojanovic) #65161
  • [a4c868738f] - (SEMVER-MAJOR) deps: support madvise(3C) across ALL illumos revisions (Dan McDonald) #65161
  • [904ceda2cb] - (SEMVER-MAJOR) deps: patch V8 for illumos (Dan McDonald) #65161
  • [ee7590d4b9] - (SEMVER-MAJOR) deps: V8: cherry-pick b2fc93f37507 (Joyee Cheung) #65161
  • [1407687630] - (SEMVER-MAJOR) deps: define V8_PRESERVE_MOST as no-op on Windows (Stefan Stojanovic) #65161
  • [0b7a5c99d3] - (SEMVER-MAJOR) deps: patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #65161
  • [888c6fd847] - (SEMVER-MAJOR) deps: update Rust crates for V8 15.2.124.38 (Joyee Cheung) #65161
  • [07fa7280c1] - (SEMVER-MAJOR) deps: update V8 to 15.2.124.38 (Joyee Cheung) #65161
  • [4eb3908d1f] - (SEMVER-MAJOR) deps: upgrade npm to 12.1.0 (npm team) #66212
  • [cba0833111] - (SEMVER-MAJOR) dgram: skip the custom lookup for literal IP addresses (Ruben Bridgewater) #64131
  • [54a5095764] - (SEMVER-MAJOR) dns: do not consult hosts file in reverse lookups (Archkon) #64268
  • [efc0a14461] - (SEMVER-MAJOR) dns: stop using deprecated functions in SetServers (Antoine du Hamel) #64356
  • [7f16850ef6] - (SEMVER-MAJOR) doc: remove OpenSSL 1.x references (Filip Skokan) #64777
  • [9c67491706] - (SEMVER-MAJOR) doc: update Node.js 27 official binary toolchains (Richard Lau) #66377
  • [6071f8bc32] - (SEMVER-MAJOR) domain: runtime-deprecate the module (Matteo Collina) #65074
  • [2c4356cedf] - (SEMVER-MAJOR) domain: port to AsyncLocalStorage (Matteo Collina) #61095
  • [a8f2bf007e] - (SEMVER-MAJOR) fs: implement glob natively (Aviv Keller) #65392
  • [1f53d7ee3f] - (SEMVER-MAJOR) fs: return Buffer from mkdtemp when prefix is a Buffer (Hamid Reza Ghavami) #64397
  • [e5778f78c5] - (SEMVER-MAJOR) http: reject responses exceeding header limit (Matteo Collina) #65010
  • [25c0c8e18a] - (SEMVER-MAJOR) http: runtime deprecate instantiating without new (Yagiz Nizipli) #64853
  • [9f75269840] - (SEMVER-MAJOR) http: increase keepAliveTimeout default to 65 seconds (Tim Perry) #62782
  • [21436f0405] - (SEMVER-MAJOR) http: make req.headers have a null prototype (Matteo Collina) #62900
  • [b2248fd370] - (SEMVER-MAJOR) http: reject addTrailers after finish (Ryuhei Shima) #62832
  • [1576cb83b4] - (SEMVER-MAJOR) http2: increase default window sizes (Matteo Collina) #64623
  • [12ce81920a] - (SEMVER-MAJOR) lib: deprecate _http_* (Sebastian Beltran) #58535
  • [19c46abbef] - (SEMVER-MAJOR) lib: insert argv[0] at argv[1] in setDeserializeMainFunction (Daijiro Wachi) #62928
  • [b1387e6aed] - (SEMVER-MAJOR) lib: use Object.freeze to avoid defensive cloning in SourceMap (Daijiro Wachi) #62830
  • [9390c810d1] - (SEMVER-MAJOR) lib: reject SharedArrayBuffer in Blob constructor per spec (Ali Hassan) #63046
  • [057e591f7c] - (SEMVER-MAJOR) lib,src: remove --no-experimental-websocket CLI flag (Antoine du Hamel) #65284
  • [9746ebce07] - (SEMVER-MAJOR) net: race family autoselection attempts (Matteo Collina) #66229
  • [e03e2f6486] - (SEMVER-MAJOR) net: throw on multiple listen calls (Matteo Collina) #64871
  • [a6e7e6a95e] - (SEMVER-MAJOR) net: runtime-deprecate Server.prototype._listen2 (Guilherme Araújo) #64794
  • [6d8baeabb0] - (SEMVER-MAJOR) net: add experimental net/promises API (Ethan Arrowood) #63965
  • [4f844f4380] - (SEMVER-MAJOR) repl: use inspector over vm (Aviv Keller) #64034
  • [d9264eb6f2] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 153 (Joyee Cheung) #66601
  • [26cc118a75] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 152 (Joyee Cheung) #66537
  • [6cf05e7ddc] - (SEMVER-MAJOR) src: fix external reference registration for new CFunction lifetime (Joyee Cheung) #65161
  • [da93e7e4de] - (SEMVER-MAJOR) src: migrate from v8::PropertyCallbackInfo<void> (Michaël Zasso) #65161
  • [45287a975f] - (SEMVER-MAJOR) src: migrate from deprecated xxxV2 APIs (Michaël Zasso) #65161
  • [aa1d7b53ac] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 151 (Joyee Cheung) #65161
  • [fc28d9402f] - (SEMVER-MAJOR) src: officially deprecate node::ObjectWrap (Anna Henningsen) #63756
  • [2d0c926907] - (SEMVER-MAJOR) src: merge CreateEnvironment() overloads (Anna Henningsen) #63596
  • [f92c252fe9] - (SEMVER-MAJOR) src, test: migrate to cppgc-owned v8::MicrotaskQueue (Joyee Cheung) #66537
  • [f378cfcfbf] - (SEMVER-MAJOR) src,lib: add --allow-env permission (James M Snell) #66132
  • [7e7ff40303] - (SEMVER-MAJOR) src,test: migrate GetPrototypeV2() to GetPrototype() (Joyee Cheung) #66537
  • [9f7ae86d8b] - (SEMVER-MAJOR) stream: destroy source when map iterator closes early (Y1D7NG) #64264
  • [a730f3bf1f] - (SEMVER-MAJOR) test: update for new V8 serialization format (Joyee Cheung) #65161
  • [9b4d1576df] - (SEMVER-MAJOR) test: avoid worker in shared value conveyor test (Michaël Zasso) #65161
  • [536cedd8bc] - (SEMVER-MAJOR) test: update test-heapdump-vm-script.js for new version of V8 (Joyee Cheung) #65161
  • [27be1e05a4] - (SEMVER-MAJOR) test: update wpt Wasm jsapi expectations (Michaël Zasso) #65161
  • [822e8ef3ce] - (SEMVER-MAJOR) test: fix fs write encoding coverage (Filip Skokan) #66247
  • [acbc3ff133] - (SEMVER-MAJOR) test,benchmark: drop OpenSSL 1.x-only coverage (Filip Skokan) #64777
  • [ee9ae88636] - (SEMVER-MAJOR) test,tools: drop OpenSSL 1.x-era FIPS leftovers (Filip Skokan) #64777
  • [7a11a9b2db] - (SEMVER-MAJOR) tls: move _tls_* to end-of-life (Sebastian Beltran) #60658
  • [1eead123e2] - (SEMVER-MAJOR) tools: increase constexpr step limit for MSVC STL (Joyee Cheung) #65161
  • [6d854b7338] - (SEMVER-MAJOR) tools: update V8 gypfiles for 15.1 (Michaël Zasso) #65161
  • [84de78ad23] - (SEMVER-MAJOR) tools: update V8 gypfiles for 15.0 (Michaël Zasso) #65161
  • [60c6de2540] - (SEMVER-MAJOR) tools: update V8 gypfiles for 14.9 (Michaël Zasso) #65161
  • [8394db37d8] - (SEMVER-MAJOR) tools: update V8 gypfiles for 14.8 (Michaël Zasso) #65161
  • [967d4af565] - (SEMVER-MAJOR) zlib: convert classes to modern syntax and eol DEP0184 (Yagiz Nizipli) #64849

Semver-Minor Commits

  • [bcf58508d8] - (SEMVER-MINOR) doc: promote alpine to tier 2. List alpine 3.21 as minimum (Stewart X Addison) #63737
  • [1a885caa6e] - (SEMVER-MINOR) fs: add mkstemp() (Marco) #66484
  • [6dea43a0f8] - (SEMVER-MINOR) lib: speed up AbortSignal (Robert Nagy) #66789
  • [2052d0dcdf] - (SEMVER-MINOR) module: add --experimental-strip-private-modules (Marco Ippolito) #63869
  • [9a9f7e87b8] - (SEMVER-MINOR) process: return unregister fn from finalization (Matteo Collina) #66482
  • [f513ec7e7c] - (SEMVER-MINOR) test_runner: add mockReturnValue and promise helpers (Guilherme Araújo) #66631
  • [49ad95045a] - (SEMVER-MINOR) vfs: unflag (Matteo Collina) #66318
  • [df2ea49e00] - (SEMVER-MINOR) zlib: add crc32c (Philipp Dunkel) #66828

Semver-Patch Commits

  • [a4231cfc6b] - benchmark: honor n in perf_hooks usertiming (Rafael Gonzaga) #66746
  • [77609be7c0] - benchmark: use process.execPath when pinning CPUs in run.js (Rafael Gonzaga) #66724
  • [2d908f48d9] - benchmark: fix hideStackFrames error benchmarks (Rafael Gonzaga) #66723
  • [b41fabb13c] - build: respect OpenSSL's configured API level (Filip Skokan) #66953
  • [5741b0ed04] - build: error on incompatible quic configure flags (Antoine du Hamel) #66893
  • [262e9ac11f] - build: warn on incompatible dtls configure flags (Antoine du Hamel) #66892
  • [d1ed17b708] - build: remove default values for libname (Antoine du Hamel) #66790
  • [796a83a7ce] - build: do not pass vendored headers when building against shared libs (Antoine du Hamel) #66844
  • [ef632266e5] - build: include v8_debug_helper sources in the tarball (Chengzhong Wu) #66763
  • [754325cd2f] - build: warn on incompatible quic configure flags (Antoine du Hamel) #66754
  • [cd192cd442] - build: load gtest_main using pkg-config (Antoine du Hamel) #66675
  • [06c0e46c81] - build: align rustc version warning with minimum requirement (Yuya Inoue) #66794
  • [e463b487c6] - build: fail Windows CI on missing GYP sources (Yuya Inoue) #66787
  • [df214abc5f] - build: fix gtest integration (Antoine du Hamel) #66735
  • [87db28b6ba] - build: remove nonexistent header from abseil.gyp (Jiawen Geng) #66583
  • [7514ef8caf] - build: remove deleted V8 headers from metadata inputs (inoway46) #66531
  • [313b83438f] - build: bump RUSTC_VERSION to 1.88 in github workflows (Joyee Cheung) #65742
  • [b12bad4b11] - build,deps,tools: prepare to update to OpenSSL 4.1 (Filip Skokan) #66758
  • [ca277a6294] - build,test: setup perfetto tests on windows build (Chengzhong Wu) #66731
  • [4c294b3b27] - build,win: fix Perfetto (StefanStojanovic) #66876
  • [28b50fb016] - build,win: fail fast in vcbuild without cargo (Ved Chaudhari) #66858
  • [86066045ea] - cli: add No-Op --experimental-repl-await (Aviv Keller) #64986
  • [7e58295439] - crypto: wire up SHA-3 with BoringSSL (Filip Skokan) #66922
  • [91c4436158] - crypto: fix builds with older OpenSSL 3.0 (Filip Skokan) #66931
  • [14ed05f86b] - crypto: fix BoringSSL RSA-PSS macro redefinitions (Filip Skokan) #66900
  • [39e03b4673] - crypto: use OPENSSL_SIZE_T instead of hard coding int (Antoine du Hamel) #66889
  • [fccdbc8b99] - crypto: do not leak scrypt param check errors (Lazizbek Ergashev) #66671
  • [b5b07a0772] - crypto: use OPENSSL_SIZE_T instead of hard coding int (Antoine du Hamel) #66752
  • [38aa1f3881] - crypto: avoid reusing randomInt() cache bytes (Jiawen Geng) #66597
  • [f0f8115e10] - crypto: fix X509 curve name crash for non-NIST curves (Lazizbek Ergashev) #66694
  • [75191c45af] - deps: patch npm engines to accept alpha versions (Rafael Gonzaga) #67063
  • [640ce854c5] - deps: update zlib to 1.3.2.1-motley-9f9f52c (Node.js GitHub Bot) #66989
  • [578d081148] - deps: update brotli to 1.2.1 (Node.js GitHub Bot) #66990
  • [0f2a5394a5] - deps: update undici to 8.12.3 (Node.js GitHub Bot) #66993
  • [352e81424f] - deps: patch V8 to 15.6.75.25 (Node.js GitHub Bot) #66820
  • [3bc923a3e4] - deps: update googletest to cd8e73f067129f8489e35c7b51c7a68552b289d2 (Node.js GitHub Bot) #66814
  • [7c2eaad296] - deps: V8: cherry-pick 785a2ea88a90 (Antoine du Hamel) #66876
  • [00d716d323] - deps: update sqlite to 3.54.1 (Node.js GitHub Bot) #66816
  • [ce3f25de37] - deps: update simdjson to 5.0.5 (Node.js GitHub Bot) #66817
  • [c883ccf3b2] - deps: patch V8 to undefined (Node.js GitHub Bot) #66656
  • [8b52f14ae5] - Revert "deps: enable V8 API interrupt JS check" (Antoine du Hamel) #65907
  • [875d905390] - Revert "deps: V8: backport b36cf9f6ccd2" (Antoine du Hamel) #65907
  • [ccd648eb0c] - deps: V8: backport b36cf9f6ccd2 (Olivier Flückiger) #65397
  • [49e2608492] - deps: enable V8 API interrupt JS check (deepak1556) #65397
  • [d8ac30125b] - deps: cherry-pick e807d4e379 from SQLite (Junsu Han) #63525
  • [8ee5b26f86] - deps: V8: backport bef0d9c1bc90 (Joyee Cheung) #62132
  • [88ec31414c] - Revert "deps,lib,tools: remove jitless and lite modes" (Joyee Cheung) #66516
  • [7e39b8781a] - deps,lib,tools: remove jitless and lite modes (Paolo Insogna) #66459
  • [45ae12c3aa] - diagnostics_channel: fix dangling binding pointer (Trevor Burnham) #65860
  • [2f65b902d8] - dns: reserve vector capacity in ParseTxtReply (agape1225) #64978
  • [3e6cca0e6a] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) #64820
  • [c558c8e81a] - dns: add tests for ENODATA states (David Evans) #64624
  • [116302d950] - dns: address compile-time warnings (Antoine du Hamel) #64355
  • [7abbd56cfd] - doc: document the alpha release process (Rafael Gonzaga) #66796
  • [ba3c34a93a] - doc: fix grammar and phrasing in typescript.md (Ravi Arnan Irianto) #66977
  • [2e4f8cfa20] - doc: add rafael and antoine as last security release stewards (Rafael Gonzaga) #66909
  • [84f8e2f3a9] - doc: document --allow-fs-vfs in the permission model page (Rafael Gonzaga) #66793
  • [952dcb2dc2] - doc: update config schema for test-forbid-only (Filip Skokan) #66945
  • [6d4646731e] - doc: mark test runner watch mode as stable (Guilherme Araújo) #66708
  • [67d0e5faca] - doc: update node-config-schema.json (Marco Ippolito) #66827
  • [8df2dd89d0] - doc: update V8 ABI release policy (Rafael Gonzaga) #64196
  • [5926201795] - doc: add doc on when to backport V8 patches to main (Chengzhong Wu) #66710
  • [9df97a7c2b] - doc: reserve NMV 154 for Electron 46 (David Babenko-Sanders) #66712
  • [ba4d9bf94b] - doc: add hoondongkang as triager (Donghoon Kang) #66427
  • [c0c8ce80a8] - doc: warn against awaiting replies in module hooks (Paul Bouchon) #65590
  • [4381c4730e] - doc: correct QuicStream direction and id types (Kisnner Obando) #66687
  • [04fb145b6a] - doc: clarify hex code usage in styleText docs (Chris Swithinbank) #66539
  • [886c7b41f3] - doc: list openssl-store channel and drop field in permissions (Rafael Gonzaga) #66558
  • [d4484555ea] - doc: add documentation for the new release schedule (Antoine du Hamel) #66568
  • [6f723ec6e7] - doc: fix crypto changes list sorting (Chengzhong Wu) #66073
  • [dab3a73673] - doc: fix YAML errors due to bad conflict resolutions (Antoine du Hamel) #65921
  • [bb5cffc091] - doc: clarify DEP0207 scope (Antoine du Hamel) #65618
  • [e65df3b3e5] - doc: reserve NMV 150 for Electron 45 (John Kleinschmidt) #65405
  • [0ce7b02d50] - doc: remove synopsis (Aviv Keller) #65246
  • [d097de8855] - doc: reserve NMV 149 for Electron 44 (Calvin) #63859
  • [a641226c91] - doc: fix lint-md (Rafael Gonzaga) #63127
  • [fc192ee030] - doc: reserve NMV 148 for Electron 43 (Ryan Fitzgerald) #63016
  • [936b20c074] - doc,crypto: mark raw key formats as stable (Filip Skokan) #66829
  • [98dbf6070e] - events: report original once() listener on removal (Ved Chaudhari) #66621
  • [1eb734d568] - ffi: drain task queues after event loop callbacks (Trivikram Kamat) #66918
  • [e0619bb7e3] - ffi: fix handle leak in fast buffer arguments (Trivikram Kamat) #66867
  • [4c14b9f58a] - ffi: add getFunction cache-miss benchmark (Donghoon Kang) #66456
  • [8fbb315a4d] - ffi: add binary parameter to internal binding type (Donghoon Kang) #66502
  • [bb3f9176ca] - fs: reduce glob section allocations (Roberto Bianchi) #66716
  • [9c06dab7d0] - http: pass maxHeaderPairs to parser.initialize() (Matteo Collina) #66250
  • [34c28d5a69] - Revert "http: do not emit socket errors after complete response" (Matteo Collina) #64511
  • [17163ead33] - http: do not emit socket errors after complete response (Archkon) #64278
  • [41b1e6845a] - http2: detect streams abandoned by nghttp2 (Matteo Collina) #66641
  • [1f26576a3f] - http2: submit RST_STREAM before emitting 'aborted' (Lazizbek Ergashev) #66314
  • [191a3b2db4] - http2: emit close for aborted HEAD compat responses (Robert Nagy) #66310
  • [351da9c1b1] - http2: reduce scheduled callbacks per request (Matteo Collina) #64265
  • [d3b20a7cd5] - http2: finish empty trailers natively for compat streams (Matteo Collina) #64265
  • [ec8b9f49bf] - http2: skip trailers round trip for compat responses (Matteo Collina) #64265
  • [a28496591e] - Revert "inspector: defer JS execution from V8 interrupts" (Antoine du Hamel) #65907
  • [30f4990224] - inspector: defer JS execution from V8 interrupts (deepak1556) #65397
  • [6353f4026c] - lib: optimize TextEncoder.encode for short strings (Mert Can Altin) #66831
  • [d15ccb7e97] - meta: label top-level GN build files (Yuya Inoue) #66808
  • [3ab2db8cb5] - meta: ignore AGENTS.override.md (Matteo Collina) #66629
  • [8ae0ad0683] - module: add "worker" condition for Web Worker threads (Guy Bedford) #66635
  • [c526694ae9] - module: fix require(esm) on the module.register() hooks thread (Matteo Collina) #66770
  • [269cab6320] - net: fail closed when BlockList peer address is unavailable (Matteo Collina) #66640
  • [c4429c85ec] - Revert "path: fix win32 normalize false-positive on reserved names" (Anna Henningsen) #64216
  • [b0a4f162df] - path: fix win32 normalize false-positive on reserved names (Daijiro Wachi) #64159
  • [a7e06d975d] - permission: reject wildcard references when dropping env (Rafael Gonzaga) #66773
  • [53f037ecc3] - quic: remove obsolete setOutbound() (Efe Karasakal) #66646
  • [1a54c4fe8c] - quic: truncate CONNECTION_CLOSE frame reason field (Efe Karasakal) #66644
  • [107133ceb8] - quic: allow null body when opening streams (Efe Karasakal) #66690
  • [6678d6f71d] - quic: reuse header support assertion (Efe Karasakal) #66777
  • [f88a1d25e9] - quic: validate stream error codes (Efe Karasakal) #66650
  • [8c1a7d3172] - quic: replace removed SetPrototypeV2 calls (Yuya Inoue) #66603
  • [9f2fb935fd] - sea: mount vfsArchive at layer 0 and in workers (Philipp Dunkel) #66709
  • [3f0c2e4c8b] - Revert "sea: mount vfsArchive at layer 0 and in workers" (Antoine du Hamel) #66706
  • [ac9d85c418] - sea: mount vfsArchive at layer 0 and in workers (Philipp Dunkel) #66614
  • [eb663fe6f4] - sqlite: avoid sqlite3_clear_bindings() before every run (Michał Fox) #66983
  • [d630b5d88b] - sqlite: retry busy or locked backup steps (Lazizbek Ergashev) #66769
  • [e20da720c8] - sqlite: validate backup() source is a Database (Guilherme Araújo) #66797
  • [cfb2de3db8] - sqlite: skip return() on exhausted virtual table iterators (Trivikram Kamat) #66519
  • [1bffd1d0a3] - sqlite: propagate errors from Database option getters (Guilherme Araújo) #66748
  • [68df1db7b0] - sqlite: use shared-shape objects for result rows (Guilherme Araújo) #66385
  • [6511fb8e34] - Revert "src: seed V8 from the OS CSPRNG instead of OpenSSL's DRBG" (Filip Skokan) #66903
  • [03cca65be3] - src: fix build with --shared-brotli (Lazizbek Ergashev) #66895
  • [1c12ff1667] - src: avoid truncating Blob sizes to 32 bits (Christian Aurich Zanettini Martins) #66207
  • [5a566ac6b9] - src: cut small costs in node::MakeCallback (Nigro Simone) #66395
  • [a0ce8f152b] - src: keep ALS store in AsyncResource::MakeCallback (Nigro Simone) #66326
  • [f9f3fa96b2] - src: allow building the snapshot on top of a V8 startup blob (Shelley Vohr) #65374
  • [21f0f2786f] - src: remove --harmony-import-attributes (Olivier Flückiger) #65396
  • [0401a2d083] - src: fix external reference registration for new CFunction lifetime (Joyee Cheung) #63679
  • [18f938d254] - src: bump NODE_MAJOR_VERSION to 27 (Rafael Gonzaga) #63128
  • [967f0a7061] - src,permission: do not grant cwd read access without entrypoint (Rafael Gonzaga) #66645
  • [60e6c84f4e] - stream: keep async context of parked writes (Matteo Collina) #66907
  • [4e75b714df] - stream: trim TransformStream construction costs (Matteo Collina) #66643
  • [153ec89621] - stream: make stream/iter from() cancellation waits cheaper (James M Snell) #66648
  • [818f34833a] - stream: share the once option for stream/iter abort listeners (James M Snell) #66648
  • [17e7b68996] - stream: do not miss 'drain' in fromWritable() (James M Snell) #66648
  • [a7c156fd37] - stream: construct the options passed to stream/iter transforms (James M Snell) #66648
  • [13d0167013] - stream: construct stream/iter wait and merge records (James M Snell) #66648
  • [e6c9c8eecd] - stream: construct stream/iter byte view snapshots and batch entries (James M Snell) #66648
  • [724190cfdc] - stream: avoid per-write allocations in stream/iter writers (James M Snell) #66648
  • [778306c001] - stream: create stream/iter iterator results with a constructor (James M Snell) #66648
  • [5bcade91de] - stream: make endSync() optional in pipeToSync() (James M Snell) #66648
  • [82563d8c39] - stream: keep long-lived stream/iter objects in fast mode (James M Snell) #66648
  • [64a762b7d3] - stream: fix flaky stream destroy, reachable from HTTP/2 teardown (Tim Perry) #65079
  • [ddba9a535f] - test: check html and json doc files are generated (Richard Lau) #66613
  • [62b471723d] - test: adapt test-blocklist to libuv 1.53+ (Antoine du Hamel) #67002
  • [9b5d938fad] - test: remove obsolete BoringSSL skips (Filip Skokan) #66922
  • [236f6e7217] - test: fix TLS coalescing test for OpenSSL 4.1 (Filip Skokan) #66962
  • [b91d04955a] - Revert "test: mark worker init failure flaky on SmartOS" (Filip Skokan) #66903
  • [08b09a2f62] - test: handle stringbytes allocation failures (Filip Skokan) #66887
  • [2f91bc366d] - test: deflake test-http-agent-keepalive (Filip Skokan) #66887
  • [727e0cac72] - test: send SNI in CA certificate test (Tamir Duberstein) #66835
  • [fd20448111] - test: keep objects alive in finalization fixtures (Matteo Collina) #66869
  • [ce9d6504a4] - test: check build options when skipping config schema test (Yuya Inoue) #66899
  • [221b47d556] - test: run test-config-json-schema in default builds (Marco Ippolito) #66827
  • [56da329c76] - test: update WPT for WebCryptoAPI to e15690d276 (Node.js GitHub Bot) #66813
  • [4737802218] - test: skip openssl config test under BoringSSL (David Babenko-Sanders) #66780
  • [c61ba86ed0] - test: account for OpenSSL 4.x changes (Filip Skokan) #66775
  • [9347db1df9] - test: deflake test-filehandle-close (Filip Skokan) #66750
  • [bc5af1c67c] - test: wait for shared-isolate Worker exit (Filip Skokan) #66722
  • [0c2949dd9d] - test: move large SQLite string cases to pummel (Filip Skokan) #66722
  • [c172bcd8a8] - test: allow periodic flush to finish under load (Filip Skokan) #66722
  • [592a0bd89c] - test: wait for inspector restart before exit (Filip Skokan) #66722
  • [6fc90e4427] - test: retry unready process timeout reports (Filip Skokan) #66722
  • [8d4262525d] - test: reserve both families for local port test (Filip Skokan) #66722
  • [2745698537] - test: cover source-specific membership on closed sockets (Rich Trott) #66624
  • [782a3ac8ae] - test: update WPT for WebCryptoAPI to b638c093cd (Node.js GitHub Bot) #66689
  • [4599b6a0f2] - test: skip test failing when run under root (Livia Medeiros) #66666
  • [c570b67593] - test: unmark loader inspector wait test as flaky (Filip Skokan) #66319
  • [c12d483b1f] - test: unmark exit timeout tests as flaky (Filip Skokan) #66319
  • [1a15692fb6] - test: unmark test-cpu-prof-dir-worker as flaky (Filip Skokan) #66319
  • [cbf3566b12] - test: remove stale SEA Linux debug flaky entries (Filip Skokan) #66319
  • [e0a3c37c30] - test: remove stale flaky status entries (Filip Skokan) #66319
  • [a4aa3c02cc] - test: fix flaky HTTP/2 reset callback check (Trivikram Kamat) #64730
  • [2cc4c81e10] - Revert "test: reduce flakiness of different-registry-per-thread" (Antoine du Hamel) #63244
  • [130398ab05] - test: reduce flakiness of different-registry-per-thread (Antoine du Hamel) #63209
  • [45b6626457] - test_runner: add option to forbid exclusive tests (joao-oliveira-softtor) #66578
  • [6698675526] - test_runner: use AsyncLocalStorage instead of async_hooks (Matteo Collina) #66795
  • [a0b4170764] - tls: configure TLS 1.3 ciphers with BoringSSL (Filip Skokan) #66922
  • [c7974d9982] - tls: coalesce buffered records into one read (Robert Nagy) #66698
  • [135b70e670] - tls: add tlsSocket.socket, to access the raw stream beneath TLS (Tim Perry) #66598
  • [a2ce2c6def] - tls,tools: update BoringSSL pin and TLS errors (Filip Skokan) #66922
  • [79c1fc4fbb] - tools: bump remark-preset-lint-node (dependabot[bot]) #67023
  • [8587d711a1] - tools: update nixpkgs-unstable to 901c54c08bdc20e00c2b3c73716b97497b1 (Node.js GitHub Bot) #66994
  • [ec8e19d893] - Revert "tools: bump the doc group in /tools/doc with 2 updates" (Antoine du Hamel) #67015
  • [763524d434] - tools: grant CI workflows Actions read permission (Filip Skokan) #66919
  • [7eff3cc4cd] - tools: limit checkout for lint-addon-docs (Yuya Inoue) #66505
  • [6209c29dcf] - tools: disable error-on-warn on x64 macOS (Antoine du Hamel) #66925
  • [a232998e0d] - tools: add --error-on-warn configure flag in test-shared.yml (Antoine du Hamel) #66751
  • [678c5551b2] - tools: reenable openssl 1.1.x and 3.0.x on test-shared.yml (Antoine du Hamel) #66711
  • [d7b6fee8cc] - tools: update nixpkgs-unstable to f20cd90e28fe0403873f473b29e42662cd8 (Node.js GitHub Bot) #66819
  • [8175dc3c05] - tools: add lint rule for unread benchmark n (Murat Kirazkaya) #66807
  • [1bc3cdae37] - tools: bump the doc group in /tools/doc with 4 updates (dependabot[bot]) #66798
  • [947b9a3aba] - tools: skip dependency update if PR has non-bot commits (Marco Ippolito) #66503
  • [e2d5522773] - tools: tolerate non-UTF-8 test output (Filip Skokan) #66783
  • [a5af6440be] - tools: update OpenSSL on the selected branch (Filip Skokan) #66704
  • [e39f2e8cff] - tools: add read-only access in nix-changes.yml (Antoine du Hamel) #66691
  • [d8d598b6d0] - tools: update nixpkgs-unstable to 8edc0c72e3a38faf5434e40d1f19431125f (Node.js GitHub Bot) #66497
  • [2192f7f916] - tools: bump the doc group in /tools/doc with 2 updates (dependabot[bot]) #66632
  • [28194a3037] - tools: bump the doc group in /tools/doc with 4 updates (dependabot[bot]) #66468
  • [5d9228d5c3] - tools: pin sccache on all platforms to fix benchmark CI job (Tim Perry) #66284
  • [d4120cbcc6] - tools: update nixpkgs-unstable to 79b35bf0bda5cd110f856aa5b5b2c5ba446 (Node.js GitHub Bot) #66146
  • [fe10572a1c] - tools: update nixpkgs-unstable to aff8a0b28396750446e5537a96461bc4fac (Node.js GitHub Bot) #66010
  • [278a9b21b3] - tools: update nixpkgs-unstable to e5ead30d0824debba629dcf0720abeddee5 (Node.js GitHub Bot) #65836
  • [8e8ada7f6b] - tools: remove nghttp2 pin in sharedLibDeps.nix (Antoine du Hamel) #65687
  • [f80223c414] - tools: update nixpkgs-unstable to 0e7911a191ea0fb9d6e8e771d24736d3618 (Node.js GitHub Bot) #65657
  • [9d7f18516c] - tools: update nixpkgs-unstable to 391b592eb44808b3bd0cb80bb71b63a5a11 (Node.js GitHub Bot) #65496
  • [04a0c270be] - tools: update nixpkgs-unstable to 6b5e5b7a6631f065bf6908986990b37d845 (Node.js GitHub Bot) #65224
  • [1b0b7ae7c9] - tools: bump nixpkgs pins (Node.js GitHub Bot) #64747
  • [c76aff4e0a] - tools: update nixpkgs-unstable to 20535e48e12c86043b577b8518234ff5dbb (Node.js GitHub Bot) #64589
  • [56387dda0f] - tools: update nixpkgs pins (Node.js GitHub Bot) #64463
  • [71812d1b43] - tools: pin to nixpkgs-26.05-darwin on Intel Macs (Antoine du Hamel) #64210
  • [72b8d91212] - tools: update nixpkgs-unstable to d33369954a67ae3322177dc9a3d56409291 (Node.js GitHub Bot) #64298
  • [0c59d78639] - tools: update nixpkgs-unstable to 89570f24e97e614aa34aa9ab1c927b6578a (Node.js GitHub Bot) #64183
  • [1434a079e1] - tools: update nixpkgs-unstable to 3e41b24abd260e8f71dbe2f5737d24122f9 (Node.js GitHub Bot) #64041
  • [e3a1c12f81] - tools: update nixpkgs-unstable to 49a4bd0573c376468dd7996ddb6f9fa31d8 (Node.js GitHub Bot) #63902
  • [7378f014ae] - tools: update nixpkgs-unstable to cbb5cf358f50aa6acc9efd6113b7bcfbc35 (Node.js GitHub Bot) #63778
  • [330f44f29c] - tools: update nixpkgs-unstable to e9a7635a57597d9754eccebdfc7045e6c86 (Node.js GitHub Bot) #63671
  • [73c592be2f] - tools: update nixpkgs-unstable to 3d8f0f3f72a6cd4d93d0ad13203f2ea1cb7 (Node.js GitHub Bot) #63528
  • [2ebf53330d] - tools: update nixpkgs-unstable to d233902339c02a9c334e7e593de68855ad2 (Node.js GitHub Bot) #63376
  • [a37c61d1c2] - tools: update nixpkgs-unstable to b3da656039dc7a6240f27b2ef8cc6a3ef3b (Node.js GitHub Bot) #63218
  • [f59539b514] - url: skip plain prefixes in percent-escape checks (Roberto Bianchi) #66696
  • [dd7235cb6a] - url: reduce search params sort buffering (Roberto Bianchi) #66665
  • [531d28fc36] - util: fix inspecting URL subclass prototypes (Donghoon Kang) #66822
  • [c7ae7ab5b9] - vfs: fix readlink, realpath and mkdtemp encoding (Christian Aurich Zanettini Martins) #66352
  • [fcb1aa83f6] - vfs: fix promises.watch() with an already-aborted signal (Trivikram Kamat) #66254
  • [44d5d57ad2] - vfs: keep open memory handles in sync with file (Trivikram Kamat) #66356
  • [06550c777f] - vfs: enforce readonly state on open handles (Harjoth Khara) #64403
  • [62ca1bae5a] - vfs: allow mounting in permission audit mode (Rafael Gonzaga) #66745
  • [1d5f8e6cba] - wasi: accept wasm i32 pointers with high bit set (Guy Bedford) #66636
4 days ago
milvus
milvus-io

milvus-3.0.5

Release note is coming soon...

4 days ago
redis
redis

8.12 RC1

This is the first Release Candidate of Redis 8.12 in Redis Open Source.

Release Candidates are feature-complete pre-releases. Pre-releases are not suitable for production use.

Headlines:

Redis 8.12 introduces new features and performance improvements.

Operating systems we test Redis 8.12 on

  • Ubuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat), 26.04 (Resolute Raccoon)
  • Rocky Linux 8.10, 9.7, 10.1
  • AlmaLinux 8.10, 9.7, 10.1
  • Debian 12.13 (Bookworm), Debian 13.4 (Trixie)
  • Alpine 3.23
  • macOS 14.8.4 (Sonoma), 15.7.4 (Sequoia), 26.3 (Tahoe) - for both Intel and ARM

Security fixes

  • RediSearch/RediSearch#10073 Indexed value hashing is now collision-resistant, preventing HashDoS-style index degradation from adversarial input. (MOD-14459)
  • RediSearch/RediSearch#11202 Incomplete UTF-8 characters no longer reads out of bounds in indexed TEXT fields. (MOD-18088)

New Features

  • #15331 Compressed bitmaps — Integrated redis-roaring into Redis core for lower memory usage and faster bitmap operations. Special thanks to Antonio, the original creator of redis-roaring, for contributing this capability! https://redisroaring.com/redis-merge/#/1;
  • #15986 New command: BITRANGEINTARRAY equivalent to redis-roaring’s R.RANGEINTARRAY, to return set bit offsets within a specified range
  • #15938 Set expiration to individual set member; New commands: SEXPIRE,SPEXPIRE,SEXPIREAT,SPEXPIREAT to set expiration and STTL, SPTTL, SEXPIRETIME,SPEXPIRETIME to retrieve remaining TTLs or expiration timestamps
  • #15649 Bless keys: avoid eviction of specified keys; New command: BLESS
  • #15829 CLUSTER MIGRATION STATUS now reports progress for both the snapshot and incremental migration phases
  • #15556 TLS named groups can now be configured using tls-groups
  • RedisBloom/RedisBloom#1063 Count-min-sketch extensions: Added optional CELL_SIZE support to CMS.INITBYDIM and CMS.INITBYPROB for lower memory usage, negative increments in CMS.INCRBY to decrement counts, and cell size reporting in CMS.INFO
  • RedisJSON/RedisJSON#1640 Auto-create JSON deep path
  • RediSearch/RediSearch#10151 EXPLAINSCORE is now supported for FT.HYBRID. (MOD-10044)
  • RediSearch/RediSearch#11330 SQ8 new compression is now available for HNSW vector fields. (MOD-6132)
  • RediSearch/RediSearch#10247 RETURN_STRICT timeout handling is now enabled for local FT.HYBRID execution. (MOD-16492)
  • RediSearch/RediSearch#11278 FT.ALTER avoids unnecessary document reindexing during schema additions. (MOD-18171)
  • RediSearch/RediSearch#11384 Score/payload-only hash updates avoid reindexing. (MOD-18182)
  • RediSearch/RediSearch#11230 Hash documents are no longer re-indexed when no vector indexed field is touched. (MOD-17688)

Bug fixes

  • #15569 Changes made by XDELEX DELREF for already-deleted stream entries could fail to propagate to replicas or the AOF
  • #15508 Operations using random radix-tree traversal could behave incorrectly when starting from certain leaf nodes
  • #15604 Memory usage could be calculated incorrectly for hashes using shared templates
  • #15489 RDB files could fail to load after XSETID reduced a stream’s entries_added counter
  • #15626 SET could calculate an incorrect expiration time when given an excessively large relative TTL
  • #15628 Active defragmentation could incorrectly handle the shared-template registry used by compact hashes
  • #15530 After failover, a replica could remain connected to another replica instead of the new primary
  • #15733 Invalid cluster slot ranges could be accepted after being merged into a valid range
  • #15756 RESTORE could calculate an incorrect expiration time when given an excessively large relative TTL
  • #15699 Memory growth could be accounted for incorrectly when SETBIT or BITFIELD expanded a string
  • #15815 XTRIM could leave a stream in a state that prevented an RDB file containing it from loading
  • #15795 Clients could fail to receive a protocol error when a malformed command arrived across multiple network reads
  • #15875 ARLASTITEMS could omit elements appearing after a gap in an array
  • #15916 Data could be lost when a legacy AOF file was upgraded before loading completed
  • #15917 Hiredis clients on Linux could mishandle errors when establishing TCP connections
  • #15869 Redis could crash when a module thread paused I/O threads
  • #15468 - Pub/Sub subscriptions could remain active after the subscribing user’s channel permissions were revoked or the user was deleted, if the client had re-authenticated as another user.
  • #15623 Module actions scheduled by hash-field expiration notifications could be delayed after fields expired in the background
  • #15680 Data could be lost after a replica migrated to a different shard
  • #15587 LMOVEM could emit keyspace notifications inconsistent with those produced by LMOVE
  • #15695 Command side effects could be propagated to replicas or the AOF despite settings that should have excluded them
  • RediSearch/RediSearch#10872 Shard no longer crashes with SIGSEGV when RESTORE of a legacy ft_index0 payload is issued outside an RDB load. (MOD-15685)
  • RediSearch/RediSearch#10728 GC timer arming off the main thread on ARM no longer causes random shard crashes after extended uptime. (MOD-17309)
  • RediSearch/RediSearch#10767 Server no longer crashes on writes when an index FILTER references no schema fields. (MOD-15592)
  • RediSearch/RediSearch#11303, RediSearch/RediSearch#11304, RediSearch/RediSearch#11308, RediSearch/RediSearch#11309, RediSearch/RediSearch#11310, RediSearch/RediSearch#11311 FT.ALTER SCHEMA ADD running concurrently with queries under WORKERS>0 no longer crashes query execution across VECTOR, TAG, NUMERIC, GEO, ISMISSING, and GEOSHAPE nodes. (MOD-18356, MOD-18361, MOD-18366, MOD-18367, MOD-18368)
  • RediSearch/RediSearch#11474 FT.AGGREGATE with the numeric SORTBY optimizer no longer crashes or returns wrong results. (MOD-6967)
  • RediSearch/RediSearch#10209 Coordinator no longer crashes under RESP2 when FT.PROFILE HYBRID hits a return-strict timeout. (MOD-16396)
  • RediSearch/RediSearch#10145 TEXT PHONETIC matches now behave correctly when non-TEXT fields precede TEXT fields in the schema. (MOD-16304)
  • RediSearch/RediSearch#11262 FT.AGGREGATE cursor with FILTER now reports the correct result count. (MOD-18172)
  • RediSearch/RediSearch#11282 FT.EXPLAIN now renders a multi-word tag value as a single tag rather than an INTERSECT. (MOD-8666)
  • RediSearch/RediSearch#10768 NOT queries no longer leak excluded documents or drop results after a concurrent index change. (MOD-17394)
  • RediSearch/RediSearch#10637 Numeric index cardinality and bounds are now correct under float compression. (MOD-16877)
  • RediSearch/RediSearch#10704 Empty wildcard patterns no longer cause out-of-bounds writes or spurious empty-value matches. (MOD-17451)
  • RediSearch/RediSearch#10752 Wildcard ? on WITHSUFFIXTRIE TEXT fields now matches per codepoint rather than per byte. (MOD-17476)
  • RediSearch/RediSearch#10112 Suffix-trie wildcard queries on TEXT fields are now case-insensitive. (MOD-16259)
  • RediSearch/RediSearch#11450 Matching literal * no longer hangs on the indexed string.
  • RediSearch/RediSearch#11267 Duplicate vector results are no longer returned during tiered indexing. (MOD-17795)
  • RediSearch/RediSearch#10731 FT.SEARCH on cluster now returns an error for invalid LIMIT arguments, matching standalone behavior. (MOD-12465)
  • RediSearch/RediSearch#10251 FT.SEARCH under WORKERS>0 no longer returns a nil field-array for documents re-indexed mid-query. (MOD-16507)
  • RediSearch/RediSearch#10921 Sort keys with embedded NUL bytes are no longer truncated in replies.
  • RediSearch/RediSearch#9963 Trie RangeIter now preserves the excluded-empty lower bound. (MOD-15897)
  • RediSearch/RediSearch#10085 RETURN_STRICT safe-loader no longer deadlocks the GIL on client timeout. (MOD-16267)
  • RediSearch/RediSearch#11449 Index reference leak after queued search cancellation no longer occurs. (MOD-18682)
  • RediSearch/RediSearch#11369 Memory leaks after coordinator SEARCH cancellation no longer occur. (MOD-18548)
  • RediSearch/RediSearch#10110 FT.HYBRID cursor setup now has a bounded channel timeout. (MOD-16145)
  • RediSearch/RediSearch#10211, RediSearch/RediSearch#10745 RETURN_STRICT cursors are now depleted on timeout; strict-timed-out hybrid cursor cycles drop their cursors at cycle end. (MOD-16091, MOD-16991)
  • RediSearch/RediSearch#10947 Coordinator cursor memory is now capped via INDEX_CURSOR_LIMIT. (MOD-17479)
  • RediSearch/RediSearch#10766, RediSearch/RediSearch#10763 Cursor reads no longer time out against a deadline belonging to an earlier read, and now correctly reports a timeout that expires while iterators are revalidated. (MOD-17489, MOD-17488)
  • RediSearch/RediSearch#10993 RDB and replication payloads no longer leak a stray heap byte. (MOD-17800)
  • RediSearch/RediSearch#10074 FT.HYBRID now returns a stable RRF result order across cluster shards. (MOD-12438)
  • RediSearch/RediSearch#11027 Cluster TLS connections now use Redis node metadata, aligning with topology changes. (MOD-15869)
  • RediSearch/RediSearch#10380, RediSearch/RediSearch#10430 Cluster topology is now refreshed on topology-change events rather than by polling. (MOD-15868, MOD-15870)
  • RediSearch/RediSearch#10835 Coordinator fanout now preserves binary argument lengths.
  • RediSearch/RediSearch#11095 Replica stalls during FT.DROPINDEX DD are reduced.
  • RediSearch/RediSearch#10255 Blocked search clients no longer trigger eager query dumps. (MOD-16518)
  • RediSearch/RediSearch#10083 Internal query arguments missing during rolling upgrade are now tolerated. (MOD-16047)
  • RediSearch/RediSearch#10816 Forced GC now waits for a concurrent child process instead of skipping its cycle.
  • RediSearch/RediSearch#10958 Async disk read pool no longer spins when saturated; it blocks instead.
  • RediSearch/RediSearch#10646, RediSearch/RediSearch#10392 VectorSimilarity dependency refreshed to address unaligned metadata access on ARM/SVE paths. (MOD-15303, MOD-16696)
  • RediSearch/RediSearch#10352 FT.PROFILE ON_TIMEOUT FAIL now reports a pre-execution timeout as a warning rather than an error. (MOD-16660)
  • RediSearch/RediSearch#10870 Crash reports now include in-flight coordinator aggregate, hybrid, and cursor-read queries. (MOD-16992)
  • RediSearch/RediSearch#11089 Debug aggregate request synchronization no longer crashes. (MOD-17616)
  • RediSearch/RediSearch#10063 COLLECT LIMIT now honors the configurable search-max-aggregate-results
  • RedisJSON/RedisJSON#1636 Fixed array-index normalization overflow for extreme negative indexes, including i64::MIN, affecting commands such as JSON.ARRTRIM
  • RedisJSON/RedisJSON#1648 Corrected JSON.MGET key-spec metadata to identify all key arguments and exclude the trailing JSONPath argument.
  • RedisJSON/RedisJSON#1670 Fixed downstream compilation when using redis_json_module_create! with the as-library feature and the new RDB depth configuration
  • RedisBloom/RedisBloom#1035 TDIGEST.QUANTILE, TDIGEST.CDF, and TDIGEST.TRIMMED_MEAN could return NaN for a sketch containing exactly one observation
  • RedisBloom/RedisBloom#1053 RDB loading and RESTORE did not consistently reject invalid numeric values, allocation sizes, serialized counts, or inconsistent metadata in Bloom filters, Count-Min Sketches, Top-K sketches, and t-digests; Bloom filter growth also lacked overflow checks
  • RedisBloom/RedisBloom#1053 Top-K sketches containing nonempty items with zero counts or empty-string items with nonzero counts could be restored incorrectly
  • RedisBloom/RedisBloom#1067 Bloom filters with excessive hash-function counts could be accepted during loading and restoration, including through BF.LOADCHUNK
  • RedisBloom/RedisBloom#1062 CMS.MERGE key metadata did not correctly identify the destination and all source keys, affecting cluster slot validation
  • RedisBloom/RedisBloom#1071 CF.COMPACT command metadata was missing its argument count and key specification

Performance and resource utilization improvements

  • #15618 Batch updates to hashes using shared templates now run more efficiently
  • #15018 Supported x86 systems now use the processor-based monotonic clock by default, with runtime calibration to reduce timing overhead
  • #15782 RDB and AOF loading now provides sequential-read hints to the operating system to improve loading efficiency
  • RediSearch/RediSearch#10169 Searches on indexes using field-level expiration (HEXPIRE) are faster. (MOD-16350)
  • RediSearch/RediSearch#10981, RediSearch/RediSearch#11065 Coordinator field lookup and row-reply serialization overhead is reduced. (MOD-17924)
  • RediSearch/RediSearch#11055, RediSearch/RediSearch#11056, RediSearch/RediSearch#11057 Cluster reply conversion, result destruction, and GROUPBY cleanup have reduced overhead. (MOD-17908, MOD-17909, MOD-17910)
  • RediSearch/RediSearch#11507, RediSearch/RediSearch#11506 Query replies now format integral numeric values without snprintf and declare reply collection lengths up front. (MOD-18800, MOD-18799)
  • RediSearch/RediSearch#11509 Hash field loading for RETURN and LOAD no longer requires per-field allocations. (MOD-18811)
  • RediSearch/RediSearch#10246 Concurrent writes are now allowed during vector range queries. (MOD-16437)
  • RediSearch/RediSearch#10515 Coordinator requests are now allocated on the main thread, removing CoordRequestCtx. (MOD-16990)
  • RediSearch/RediSearch#11018 Query usage is now separated from administrative index operations. (MOD-17536)
  • RediSearch/RediSearch#10066 Shard response barrier removed in favor of async iterator depletion callback for FT.AGGREGATE WITHCOUNT. (MOD-16210)
  • RedisJSON/RedisJSON#1645 More accurate memory usage reporting for shared strings: Memory usage now accounts for each reference’s proportional share of a shared string’s allocation, including its header and padding, instead of charging the full allocation to every reference
  • J1660 Reduced object memory consumption: JSON parsing now uses compact object allocation to reduce the actual memory needed to store JSON objects
  • RedisJSON/RedisJSON#1661 Improved JSONPath parsing and evaluation by reducing parser backtracking, temporary allocations, and repeated traversal. Optimizations include caching root-path operands across filter candidates, stopping existence checks at the first match, and reducing overhead in regex matching and string comparisons
  • RedisJSON/RedisJSON#1631 Improved typed-array element access through direct indexing, avoiding repeated iteration and quadratic work during full indexed scans
  • RedisBloom/RedisBloom#1049 Improved t-digest compression performance for inputs containing many duplicate values. Sorting is now bounded to O(n log n), avoiding quadratic behavior on pathological inputs

Configuration parameters

  • Redis-roaring:bitmap-default-roaring - to enable the new roaring bitmaps type, disabled by default
  • RedisJSON/RedisJSON#1657 Configurable RDB depth validation: Added json-legacy-rdb-depth-limit, disabled by default, to enforce a maximum nesting depth of 128 when loading JSON from RDB or through RESTORE
  • RedisJSON/RedisJSON#1640 Addedjson-auto-create-deep-paths and is disabled by default and can only be configured at load time. Use the same value on every node of a shard and when replaying AOF files, because differing values can cause data divergence

Metrics

  • #15374 INFO keysizes histograms now include streams, providing visibility into stream key sizes
  • #15682 Streams observability – Added INFO STREAMS with per-database histograms of consumer groups per stream, pending entries per group, and consumers per group. Enable with stream-stats yes (disabled by default)
  • RediSearch/RediSearch#10097 FT.INFO now exposes the default EF_RUNTIME. (MOD-16147)
  • RediSearch/RediSearch#10107 Disk GC bytes_collected and cycle stats are now reported in FT.INFO. (MOD-14621)
  • RediSearch/RediSearch#10464 FT.INFO on coordinator now aggregates per-field disk metrics via the reducer. (MOD-14859)
  • RediSearch/RediSearch#10204 Redis INFO now breaks down query timeout metrics by pipeline stage. (MOD-13192)
  • RediSearch/RediSearch#11521 Index metrics are no longer collected for unrelated INFO sections. (MOD-18033)
  • RediSearch/RediSearch#10536 FT.PROFILE loader-field timing resolution is improved. (MOD-17132)

Behavior changes

  • RediSearch/RediSearch#10109 FT.CREATE rejects RERANK on HNSW vector fields in RAM mode. (MOD-16015)
  • RediSearch/RediSearch#10200 Disk indexes reject DIALECT 4 and WITHOUTCOUNT. (MOD-15997)
  • RediSearch/RediSearch#10082 COLLECT requires an @ prefix for field names. (MOD-16233)
  • RediSearch/RediSearch#11106 JSON HIGHLIGHT/SUMMARIZE fields with multi-value JSONPath are now rejected. (MOD-16530)
  • RediSearch/RediSearch#10208 Non-cacheable commands are now marked with dont_cache. (MOD-16175)
  • RediSearch/RediSearch#10699 Numeric command arguments are now strictly parsed. (MOD-17409)
  • RediSearch/RediSearch#11335 Search module now requires Redis 8.9.241 or newer to load. (MOD-15868)
  • RedisBloom/RedisBloom#1063 Rejected CMS.INCRBY item updates now leave counters and the total count unchanged instead of saturating counters on overflow. Multi-item commands can still partially succeed.
  • RedisBloom/RedisBloom#1063 CMS.MERGE now requires matching cell sizes across the destination and all sources.

Modules API

  • #15517 Modules can now retrieve a cluster node’s TLS port using the new REDISMODULE_NODE_PORT_TLS flag in RM_GetClusterNodeInfo()
  • RedisJSON/RedisJSON#1623 Added getWithPath in shared API V9 to evaluate a precompiled JSONPath, allowing callers to compile a path once and reuse it across documents.
  • RedisJSON/RedisJSON#1666 Added pathParseNoErrorMsg in shared API V10 to compile JSONPaths without a Redis context or an allocated error message. Returns a compiled handle on success or NULL on failure.
  • RedisJSON/RedisJSON#1653 Made pre-command hooks optional and allowed hook errors to abort JSON commands before execution. Hooks now return RedisResult<()>; shared C API calls continue to ignore hook errors.
  • RedisJSON/RedisJSON#1640 Extended the Rust Manager interface with clone_value and create_object to support construction of missing paths. Custom implementations must implement these methods and satisfy the new Borrow<Self::V> requirement for owned values.
4 days ago
nacos
alibaba

3.3.0(Oct 29th, 2026)

Nacos 3.3.0

Nacos 3.3.0 is a feature iteration release for the Nacos 3.x series. It brings protocol-neutral Agent management and discovery, shared AI resource search, and unified MCP lifecycle management to the stable release.

This release focuses on:

  • AI Registry capabilities across Agent, AgentSpec, Skill, Prompt, and MCP resources.
  • DNS service discovery and distributed locks.
  • Dynamic plugin management and authentication enabled by default.
  • Spring Boot 4 and Jackson 3 compatibility, with improved client and server reliability.

The main feature updates include:

  • Agent registration, version management, runtime endpoints, RAD discovery, transport negotiation, and Watch/Push through Java SDKs and Console workflows.
  • Shared AI resource search with hybrid keyword and vector retrieval, artifact access, and optional relevance filtering.
  • MCP draft, review, publish, online/offline, and visibility management, with migration support for historical resources.
  • Optional DNS discovery with A, AAAA, and SRV records over UDP and TCP.
  • Distributed reentrant and non-reentrant locks with watchdog renewal and Raft consistency.

The stable release also improves Skill metadata consistency across version transitions, extends visibility plugin capabilities, and strengthens Config SDK usability, Console compatibility, and recovery after Naming reconnects and cluster restarts.

These notes are cumulative and include the changes delivered in 3.3.0-BETA and 3.3.0-RC.

Detailed changes in this release:

Feature

  • #50 Add optional DNS service discovery over UDP and TCP, with A, AAAA, and SRV records, metrics, and configurable external DNS forwarding.
  • #14466 Add a neutral JSON adapter with Jackson 2 and Jackson 3 runtime support.
  • #14804 Add protocol-neutral Agent lifecycle management, Console workflows, RAD discovery, runtime endpoints, transport negotiation, Watch/Push, and Java SDKs.
  • #15279 Add distributed reentrant and non-reentrant locks with watchdog renewal, FIFO waiting, gRPC notifications, Raft consistency, and a Java Lock SDK.
  • #15471 Support SkillSpector as an AI publish pipeline.
  • #15475 Add unified dynamic plugin configuration, lifecycle management, runtime updates, deterministic discovery, and Console configuration workflows.
  • #15476#15604 Add plugin-owned visibility grant and revoke APIs and Console management for Skill and AgentSpec resources.
  • #15541 Add Agentic Resource Discovery with search, exploration, artifact retrieval, visibility filtering, persistent indexes, and hybrid keyword and vector retrieval.
  • #15640 Add Linux RISC-V64 compatibility for RocksDB JNI loading and startup.
  • #15761 Add shared MCP lifecycle management with drafts, review, publish, online/offline operations, visibility, Java SDKs, and historical reconciliation while preserving existing Config/Naming serving data.

Enhancement/Refactor

  • #8354 Replace the mandatory Prometheus client dependency with a pluggable client metrics SPI and a no-op default.
  • #12064 Support configuring the gRPC port offset through individual client properties.
  • #12734 Add request/result-based Config SDK methods, encrypted Config CAS publishing, and conditional queries with local cache reuse.
  • #13690 Log the resolved client logging configuration and include namespace IDs in subscription logs.
  • #14804 Improve Agent Console workflows, expose SDK discovery capabilities and A2A conversion helpers, and trace discovery request origins.
  • #14817 Disable selected deprecated Pipeline and MCP import APIs by default and provide a shared temporary compatibility switch.
  • #14932 Reduce read-path contention and improve index consistency in the legacy MCP cache.
  • #14980 Support deregistering persistent Naming instances from Console v3.
  • #15315#15561 Improve Skill upload precheck, conflict handling, and server-side ZIP validation.
  • #15322 Remove obsolete Config migration compatibility code and retain only the current Config storage model.
  • #15345 Return cached Skill frontmatter in list and metadata-detail responses.
  • #15346 Manage the reserved latest label for AI resources on the server.
  • #15357 Enable Client API authentication by default and validate standard integration scenarios with authentication enabled.
  • #15432#15440#15441 Remove reviewed unused Java code while preserving required compatibility contracts.
  • #15448 Improve English translations in Console UI Next.
  • #15486 Include the Skill owner in upload permission-denied messages.
  • #15606 Return a stable per-item result for every Skill batch upload candidate.
  • #15661 Restrict distributed embedded database query results to supported scalar types and registered row mappers.
  • #15678 Decouple the visibility plugin SPI from server runtime modules.
  • #15686#15692 Align authorization method resolution with Spring MVC routing and expand controller-level authorization regression coverage.
  • #15687 Authenticate native JRaft gRPC requests with server identity and a rolling-upgrade enforcement transition.
  • #15695 Improve Config detail, edit, and history page layouts with larger content areas and full-screen reading.
  • #15720 Automatically publish the first uploaded Skill version.
  • #15746 Add operator-controlled outbound access policies for MCP tool imports.
  • #15837 Add opt-in initialization for multiple Spring AOT contexts and improve GraalVM runtime metadata.
  • #15838 Clarify that rolling back the first inserted Config history record deletes the configuration.
  • #15854 Remove untagged legacy Raft request parsing and preserve explicit errors for malformed log entries.
  • #15868 Support disabling local Config snapshots through the configSnapshotEnabled startup property.
  • #15896 Migrate Copilot streaming to typed AgentScope events while preserving the existing SSE response contract.
  • #15900 Correlate Java SDK HTTP requests with server request context through Nacos-Request-Id.
  • #15903 Add a runnable Parallel Search MCP example for registration, endpoint discovery, web search, and page fetching.
  • #15921 Add optional Jev relevance filtering for ARD Search, with stable result ordering and fallback to basic search.
  • #15929 Add Russian localization and a language selector to Console UI Next.
  • #15956 Allow visibility plugins to declare additional AI resource scopes and extend Agent validation through an optional SPI, while preserving default PUBLIC/PRIVATE behavior.

BugFix

  • #11122 Accept healthCheckEnabled as a health-check switch entry while retaining the legacy check alias.
  • #11780 Preserve Config and service list filters and pagination when returning from detail pages.
  • #11890 Avoid removing metadata for instances that still exist after restart.
  • #12557 Retry Config dump write-lock acquisition to prevent stale MD5 cache data.
  • #14008 Fix native-image metadata required to establish gRPC client connections.
  • #14804 Keep AI search available with partial results while indexes are being backfilled.
  • #14804 Preserve Agent SDK Watches across transient failures and deliver initial and updated state through a consistent Listener path.
  • #14981#15468 Fix concurrent Config publish duplicate-key handling through the datasource dialect SPI, including PostgreSQL unique_violation.
  • #15410 Fix trailing separators when joining collections containing null elements.
  • #15415 Prevent malformed config-plugin property names from discarding valid plugin configuration.
  • #15420 Fix Skill ZIP uploads with invalid or unavailable version candidates.
  • #15425 Prevent out-of-range batch indexes from causing IndexOutOfBoundsException.
  • #15446 Fix page count calculation for empty and exactly divisible result sets.
  • #15447 Prevent NamingUtils.getServiceName from failing on a trailing service separator.
  • #15466 Correct @Since annotations for Skill upload APIs.
  • #15470 Prevent Naming connection cleanup from waiting for unrelated distributed-lock Raft writes.
  • #15475 Fix standalone Console auth plugin initialization and forward the caller identity to downstream Server requests.
  • #15476 Enforce Prompt visibility on list, detail, version, download, and Client read APIs.
  • #15477 Wait for persistent service metadata before starting health checks.
  • #15490 Fix Chinese text corruption in Skill Scanner pipeline reports on Windows.
  • #15494 Restore complete MCP tool advanced-template support in Console UI Next.
  • #15510 Reject explicitly supplied invalid Bearer tokens instead of falling back to anonymous access.
  • #15534 Generate deterministic, ASCII-safe physical Config keys for AI resources.
  • #15543 Restore case-sensitive collation for newly initialized MySQL Config schemas.
  • #15557 Fix startup failures when plugin state snapshots are restored before unified plugin discovery.
  • #15560 Preserve MCP tool passthrough authentication when editing and publishing runtime templates.
  • #15603 Fix visibility query conversion when explicitly authorized resources are present.
  • #15618 Try lower-priority explicit Skill upload versions before generating a version.
  • #15620 Allow AI resource versions to be resubmitted after completed or stale review results.
  • #15625 Fix gray Config cache null access and cross-thread visibility in Config disk services and client connections.
  • #15634 Fix API authorization metadata, custom resource parser precedence, AgentSpec authorization, and Prometheus security path matching.
  • #15642 Make AI resource deletion cleanup-first and retryable across all stored versions.
  • #15658 Keep AI resource reads, updates, and deletion bound to the persisted storage provider.
  • #15660 Fix standalone Console startup when the Config clone source-permission checker is unavailable.
  • #15663 Preserve case-sensitive AI resource identities in MySQL search and task tables.
  • #15675 Preserve nullable MCP tool output schemas during editing, display, and OpenAPI import.
  • #15682 Prevent login responses from disclosing whether a username exists.
  • #15689 Preserve string serialization of Config storage IDs with Jackson 3 to avoid numeric precision loss.
  • #15701 Fix Config history next-record queries on Derby and preserve gray-version filtering.
  • #15703 Migrate the legacy skills.sh importer state key without overriding canonical configuration.
  • #15705 Clean removed Skill and AgentSpec draft files while retaining retry metadata after storage failures.
  • #15710 Declare the required SQL LIKE escape clause for Derby, Oracle, and other affected dialects.
  • #15712#15827 Reject unsafe instance addresses, HTTP targets, headers, and MySQL connection options in active health checks.
  • #15714 Handle encoded context paths consistently in the legacy controller-method resolver.
  • #15718 Escape all LIKE predicates when searching embedded roles with username filters.
  • #15724 Forward the namespace when querying Config listeners by IP across cluster members.
  • #15744 Align bootstrap and distribution configuration defaults.
  • #15763 Reject invalid IPv6 mixed addresses with too many explicit address blocks.
  • #15788 Allow the Java client to run with Jackson 3 after excluding Jackson 2 core/databind, including authentication paths.
  • #15803 Reject unsafe AgentSpec and Skill ZIP layouts and enforce entry-count and decompression limits.
  • #15804 Reject unsafe filesystem paths before Config, archive, and local rule-storage operations.
  • #15821 Increase the embedded Derby connection timeout to prevent initialization failures on slow storage.
  • #15836 Fix plugin availability RPC serialization so remote cluster members are reported correctly.
  • #15844 Use the correct default gRPC protocol negotiator type.
  • #15847 Restore public defaults for newly created Agent and MCP resources and preserve existing visibility scopes.
  • #15850#15851 Select the default JDBC driver from the datasource dialect and clarify non-MySQL configuration examples.
  • #15853 Return schema metadata in current, historical, and previous-version Config details.
  • #15857 Prevent stale Distro snapshots from overwriting redo registrations and losing service instances after cluster restarts.
  • #15864 Resolve HEAD requests through their GET mapping in the legacy controller-method cache.
  • #15866 Remove server-list event subscriptions on client shutdown and prevent callbacks from accessing a closed server-list provider.
  • #15872 Display subscriber addresses, client versions, and application names correctly in Console UI Next.
  • #15876 Ignore registration responses from obsolete connections so ephemeral instances are re-registered after reconnect storms.
  • #15883 Fix unexpected HTTP 403 responses from identity-only APIs when Console is deployed independently.
  • #15899 Fix Console UI Next loading failures on Chromium 90 by transpiling unsupported JavaScript syntax.
  • #15930 Prevent uncaught errors from permanently cancelling Naming redo tasks and blocking registration or subscription recovery.
  • #15945#15947 Parse multiline YAML Skill descriptions correctly and prevent spurious frontmatter fields.
  • #15946 Preserve empty and whitespace-only Skill resource files when reading versions and downloading packages.
  • #15949 Keep Skill descriptions consistent with the displayed version across draft edits and lifecycle transitions, and retain the correct description when the last online version goes offline.
  • #15953 Keep Publish and Cancel actions visible on Config creation and edit pages, and eliminate nested scrolling on Config and history detail pages in Console UI Next.

Dependencies

  • #14944 Upgrade Spring Boot from 3.5.14 to 4.0.6.
  • #15470 Upgrade SOFA JRaft to 1.4.1 while preserving callback cache behavior and JRaft authentication.
  • #15584 Upgrade Maven Compiler Plugin from 3.5.1 to 3.15.0 for JDK 25 build compatibility.
  • #15645#15834#15944 Update legacy and next Console dependencies, refresh packaged assets, and upgrade the bundled DOMPurify sanitizer to 3.4.17.
  • #15707 Upgrade Log4j API from 2.25.4 to 2.25.5.
  • #15767 Upgrade gRPC to 1.81.0 to address CVE-2026-33871.
  • #15796 Upgrade Apache Derby from 10.14.2.0 to 10.16.1.1, align split artifacts, and retain the Java 17 baseline.
  • #15878 Upgrade AgentScope Java from 1.0.7 to 2.0.3 in Copilot.

Breaking Change Notice

Nacos 3.3.0 changes authentication defaults, disables selected deprecated APIs, and introduces migration requirements. Applications using the new Agent SDK from BETA or RC also need to review the finalized subscription contract.

Affected users:

  • Applications relying on Client APIs without credentials or on deprecated Pipeline and MCP import endpoints.
  • Deployments with legacy Config data, historical AI storage keys, untagged Raft logs, or A2A/MCP resources requiring migration.
  • Applications relying on built-in Prometheus client metrics or implicit AI resource visibility defaults.
  • BETA/RC adopters using RAD subscriptions or remotely accessing the optional DNS server.

Recommended upgrade path:

  • Prepare Client API credentials. An absent nacos.core.auth.enabled now means true. Existing explicit false settings remain effective. If necessary, keep authentication explicitly disabled during credential provisioning, then enable it consistently across the cluster after verifying client access. Admin and Console authentication defaults are unchanged.
  • Migrate deprecated AI API calls. Selected legacy Pipeline and Console MCP import endpoints return HTTP 410 with API_DEPRECATED by default. Use the Pipeline /list and /detail endpoints and unified /v3/console/ai/import/validate and /execute endpoints. nacos.core.api.compatibility.enabled=true temporarily reopens the selected endpoints; nacos.ai.resource.import.legacy-mcp-api-enabled is no longer recognized.
  • Complete legacy Config migrations. Upgrade pre-3.0 deployments through an earlier Nacos 3.x version. Migrate default-namespace data from the empty tenant to public, and legacy beta/tag data to config_info_gray. For the nacos_config AI storage provider, explicitly migrate affected historical non-ASCII or overlength Config coordinates to the deterministic ASCII-safe mapping.
  • Check persisted Raft logs. Nacos 3.3 no longer replays untagged entries, including entries originally written by Nacos 2.0.x and retained through intermediate upgrades. Recover and migrate those logs or snapshots with a compatible version before upgrading; changing the running version alone does not convert persisted logs.
  • Plan historical A2A and MCP migration. The default nacos.ai.a2a.compatibility.mode=CANONICAL does not scan historical A2A data. Follow the A2A upgrade runbook for AUTO migration and early-3.3 preflight. After permanent canonical cutover, legacy-only servers must not rejoin. Preserve MCP reconciliation state and its existing Config/Naming serving data during the one-way lifecycle transition.
  • Keep cluster server identities consistent. Native JRaft authentication becomes enforced after all members advertise support, and enforcement persists across restarts. Rolling downgrades to members without JRaft credential support are not guaranteed to remain available.
  • Update BETA/RC Agent SDK consumers. The new RAD subscribeAgent methods now return void. Receive both initial state and subsequent updates through the Listener, prepare Listener state before subscribing, and recompile dependent applications. Legacy A2A signatures and HTTP/gRPC wire contracts remain unchanged.
  • Configure client metrics explicitly. nacos-client no longer includes a mandatory Prometheus client dependency. Install an implementation of NacosClientMetricsProvider when metrics are required; without one, recording is a no-op even when enableClientMetrics is enabled.
  • Review MCP import and visibility settings. Private or local MCP import targets require nacos.console.ai.mcp.import.allowed-private-addresses, and redirects are not followed. The built-in visibility plugin defaults newly created Agent and MCP resources to PUBLIC; explicitly choose a private scope where required. Existing stored scopes and Prompt/Skill defaults are unchanged.
  • Review DNS listener configuration. DNS remains optional and disabled by default. When enabled, nacos.naming.dns.bind-address defaults to 127.0.0.1; configure the intended listening address for remote clients. External forwarding requires separate explicit configuration.
  • Refresh affected Skill metadata. Historical Skill descriptors without parsed frontmatter retain their existing metadata; this release does not automatically read their packages or backfill missing metadata. Update the content or re-upload affected Skills to regenerate frontmatter and correct previously stored multiline descriptions.
  • Back up and rehearse the upgrade. Back up the database and persisted server data, then verify authentication, data migration, discovery, and client behavior in staging. Embedded Derby is upgraded to 10.16.1.1, so include persisted-data reads, subsequent writes, and restart recovery in upgrade validation.

Deployments without the affected historical data do not require those data migrations. The authentication defaults and any applicable API or SDK changes still need review.

Java Version Requirements

Module Java Required
Nacos-Server / Nacos-Console Java 17
Nacos-Client Java 8
Nacos-Maintainer-Client Java 8

New Contributors

Full Changelog: https://github.com/alibaba/nacos/compare/3.3.0-RC...3.3.0