Istio graduated

Istio addresses the challenges developers and operators face with a distributed or microservices architecture. Whether you're building from scratch or migrating existing applications to cloud native, Istio can help. Read more at: https://istio.io/latest/about/solutions/

Istio 1.29.0-rc.0

Artifacts

Open Policy Agent (OPA) graduated

v1.13.0

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

  • A new immediate upload trigger mode in the Decision Logger
  • A new array.flatten built-in function
  • Numerous performance improvements

Immediate Upload Trigger Mode in Decision Logger (#8110)

An immediate trigger mode has been added to the Decision Logger; enabled by setting the decision_logs.reporting.trigger configuration option to immediate.
When enabled, log events are pushed to the log service as soon as the configured upload chunk size criteria is met; or, at latest, when the configured upload delay is reached.

Authored by @sspaink

Runtime, SDK, Tooling

  • cmd/fmt: Do not overwrite file on fmt without changes (#8222) authored by @Loic-R
  • cmd/test: Enable sorting JSON test results by duration (#7444) authored by @sspaink
  • profiler: nil *Profiler should not report Enabled() (#8256) authored by @anderseknert
  • rego: Add Data function to simplify adding data from map (#5961) authored by @majiayu000 reported by @anderseknert
  • runtime: Correct naming & docs for version checking (#8191) authored by @charlieegan3

Compiler, Topdown and Rego

  • ast: Body.String() doesn't panic on empty body (#8244) authored by @srenatus
  • ast: Improve type error message when referencing functions (#6840) authored by @sspaink
  • ast: Type Checker recognizes when a variable has multiple assignments but is an undefined function (#7463) authored by @sspaink reported by @anderseknert
  • ast/parser: Avoid duplicate loc copies (#8142) authored by @srenatus
  • topdown: Add array.flatten built-in function (#8226) authored by @anderseknert
  • topdown: Fix issue where numbers.range_step built-in could erroneously return undefined value (#8194) authored by @thevilledev
  • topdown: Remove hard-coded missing key error in strings.render_template built-in (#7931) authored by @colinjlacy reported by @anderseknert
  • topdown: Re-introduce cancellation-awareness for regex.replace built-in (#8179) authored by @srenatus
    from having been reverted in v1.12.1
  • topdown: Support arrays as input for json.match_schema (#6615) authored by @sspaink reported by @mscudlik

Performance

Docs, Website, Ecosystem

Miscellaneous

  • Decoupled the Rego job check from the Go job checks in the Github PR workflow (#8203) authored by @SeanLedford
  • build: Format pr_check.rego with opa fmt (#8201) authored by @thevilledev
  • build: Migrate PR check to OPA policy (#8183) authored by @SeanLedford
  • build: Run go get against main to spot redacted (#8146) authored by @charlieegan3
  • deps: Switch to maintained go.yaml.in/yaml/v3 yaml library (#8182) authored by @mrueg
  • test/cases: Increase yaml test coverage for some regex and string builtins (#8152) authored by @srenatus
  • Dependency updates; notably:
    • build: bump golang from 1.25.5 to 1.25.6 (#8224) authored by @srenatus
    • build(deps): bump go.opentelemetry.io deps from 1.38.0/0.63.0 to 1.39.0/0.64.0
    • build(deps): bump klauspost/compress from v1.18.1 to v1.18.2 (#8184) authored by @srenatus
      because of redaction warning
    • build(deps): bump github.com/go-ini/ini from v1.67.0 to gopkg.in/ini.v1 v1.67.1 (#8208) authored by @gabrpt
Release notes from oxia-client-java

v0.7.3

What's Changed

  • feat: upgrade otel dependencies by @mattisonchao in #250
  • Allow to override version id and modification count by @merlimat in #252
  • build(deps-dev): bump org.assertj:assertj-core from 3.24.1 to 3.27.7 in the maven group across 1 directory by @dependabot[bot] in #251

Full Changelog: v0.7.2...v0.7.3

kube-vip sandbox

v1.0.4

What's Changed

New Contributors

Full Changelog: v1.0.3...v1.0.4

Linkerd graduated

Linkerd is the lightest, fastest, and most importantly, simplest service mesh on the market. It provides security, reliability, and observability features to any Kubernetes application without requiring code changes.

edge-26.1.4

What's Changed

Full Changelog: edge-26.1.3...edge-26.1.4

Kube-OVN sandbox

v1.15.2

v1.15.2 (2026-01-29)

  • a4ecdaac8 release v1.15.2
  • 0622723d3 fix: skip NetworkUnavailable condition in non-primary CNI mode (#6195)
  • 25acdabb4 fix(vpcnatgw): nat gateway uses faulty default network (#6212)
  • b64138b90 controller: fix vpc egress gateway forward policy not working for targets within the internal subnet's cidr (#6222)
  • c608e4841 controller: fix vpc egress gateway not working for targets within the internal subnet's cidr (#6218)
  • 90eea0ed3 Update start-ic-db.sh to have gen_conn_addr function defined (#6216)
  • c0e9ec780 fix: caching NAD CRD should before all kubeovn crds and pod (#6198)
  • e3296ba1f prepare for next release

Contributors

  • Mengxin Liu
  • SKALA NETWORKS
  • andrewlee1089
  • dnugmanov
  • zbb88888
  • 张祖建
SlimFaaS sandbox

SlimFaas MCP 0.60.9

SlimFaasMcp build native AOT for 4 platforms :

  • linux-x64
  • windows-x64
  • macOS (x64)
  • macOS (arm64)
Shipwright sandbox

Shipwright Build release v0.18.2

Release changes since v0.18.1

None. This is a rebuild of all components to address vulnerabilities from the Go standard libraries.

To see a list of addressed vulnerabilities, please refer to #2093

Features

Fixes

API Changes

Docs

Misc

Inspektor Gadget sandbox

Release v0.48.1

Welcome to the v0.48.1 bugfix release of Inspektor Gadget.

Bug Fixes

  • [BACKPORT] cmd: Remove possibility to customize CFLAGS from build.yaml. by @eiffel-fl in #5245
SchemaHero sandbox

v0.23.0

show help if a subcommand isn't found (#1285)

Signed-off-by: Andrew Lavery <laverya@umich.edu>

Cozystack sandbox

Provides users with managed services and ready-to-use dev environments.

v0.41.4

Release v0.41.4 (#1926)

This PR prepares the release `v0.41.4`.

Cozystack sandbox

Provides users with managed services and ready-to-use dev environments.

v0.40.5

Release v0.40.5 (#1925)

This PR prepares the release `v0.40.5`.

Meshery sandbox

As a self-service engineering platform, Meshery enables collaborative design and operation of cloud and cloud native infrastructure.

Meshery v0.8.202

What's New

🔤 General

🖥 Meshery UI

🧰 Maintenance

👨🏽‍💻 Contributors

Thank you to our contributors for making this release possible:
@hortison, @marblom007, @suttonskate and dependabot[bot]

Longhorn incubating

* Highly available persistent storage for Kubernetes In the past, ITOps and DevOps have found it hard to add replicated storage to Kubernetes clusters. As a result many non-cloud-hosted Kubernetes clusters don’t support persistent storage....

Longhorn v1.11.0

Longhorn v1.11.0 Release Notes

The Longhorn team is excited to announce the release of Longhorn v1.11.0. This release marks a major milestone, with the V2 Data Engine officially entering the Technical Preview stage following significant stability improvements.

Additionally, this version optimizes the stability of the whole system and introduces critical improvements in resource observability, scheduling, and utilization.

For terminology and background on Longhorn releases, see Releases.

Deprecation

V2 Backing Image Deprecation

The Backing Image feature for the V2 Data Engine is now deprecated in v1.11.0 and is scheduled for removal in v1.12.0.

Users using V2 volumes for virtual machines are encouraged to adopt the Containerized Data Importer (CDI) for volume population instead.

GitHub Issue #12237

Primary Highlights

V2 Data Engine

Now in Technical Preview Stage

We are pleased to announce that the V2 Data Engine has officially graduated to the Technical Preview stage. This indicates increased stability and feature maturity as we move toward General Availability.

Limitation: While the engine is in Technical Preview, live upgrade is not supported yet. V2 volumes must be detached (offline) before engine upgrade.

Support for ublk Frontend

Users can now configure ublk (Userspace Block Device) as the frontend for V2 Data Engine volumes. This provides a high-performance alternative to the NVMe-oF frontend for environments running Kernel v6.0+.

GitHub Issue #11039

V1 Data Engine

Faster Replica Rebuilding from Multiple Sources

The V1 Data Engine now supports parallel rebuilding. When a replica needs to be rebuilt, the engine can now stream data from multiple healthy replicas simultaneously rather than a single source. This significantly reduces the time required to restore redundancy for volumes containing tons of scattered data chunks.

GitHub Issue #11331

General

Balance-Aware Algorithm Disk Selection For Replica Scheduling

Longhorn improves the disk selection for the replica scheduling by introducing an intelligent balance-aware scheduling algorithm, reducing uneven storage usage across nodes and disks.

GitHub Issue #10512

Node Disk Health Monitoring

Longhorn now actively monitors the physical health of the underlying disks used for storage by using S.M.A.R.T. data. This allows administrators to identify issues and raise alerts when abnormal SMART metrics are detected, helping prevent failed volumes.

GitHub Issue #12016

Share Manager Networking

Users can now configure an extra network interface for the Share Manager to support complex network segmentation requirements.

GitHub Issue #10269

ReadWriteOncePod (RWOP) Support

Full support for the Kubernetes ReadWriteOncePod access mode has been added.

GitHub Issue #9727

StorageClass allowedTopologies Support

Administrators can now use the allowedTopologies field in Longhorn StorageClasses to restrict volume provisioning to specific zones, regions, or nodes within the cluster.

GitHub Issue #12261

Installation

Important

Ensure that your cluster is running Kubernetes v1.25 or later before installing Longhorn v1.11.0.

You can install Longhorn using a variety of tools, including Rancher, Kubectl, and Helm. For more information about installation methods and requirements, see Quick Installation in the Longhorn documentation.

Upgrade

Important

Ensure that your cluster is running Kubernetes v1.25 or later before upgrading from Longhorn v1.10.x to v1.11.0.

Longhorn only allows upgrades from supported versions. For more information about upgrade paths and procedures, see Upgrade in the Longhorn documentation.

Post-Release Known Issues

For information about issues identified after this release, see Release-Known-Issues.

Resolved Issues in this release

Highlight

Feature

Improvement

Bug

Misc

New Contributors

Contributors

Thank you to the following contributors who made this release possible.

Note: Starting from v1.11.0, as long as a GitHub issue is resolved in the current release, the corresponding authors will be listed in this contributor list as well. If there is still a missing, please contact Longhorn team for the update.

Meshery sandbox

As a self-service engineering platform, Meshery enables collaborative design and operation of cloud and cloud native infrastructure.

Meshery v0.8.201

What's New

🔤 General

⌨️ Meshery CLI

  • [mesheryctl]: Improved error output readability for mesheryctl connection delete command @DharunMR (#17152)
  • feat(mesheryctl): add connection list by kind and/or status support @lekaf974 (#17147)
  • [mesheryctl] refactor: consolidate --output-format handling in perf command @shri771 (#17105)
  • mesheryctl: E2E tests for connection sub command @DharunMR (#17144)
  • [Docs] Update outdated Go version requirements in documentation @thc1006 (#17136)
  • [mesehryctl] refactor: consolidate --output-format handling in all commands @lekaf974 (#17086)
  • Fixed E2E test failures (provider name, assertions, error messages) @PragalvaXFREZ (#17052)
  • fix(mesheryctl): typo in command @DharunMR (#17074)
  • environment subcommand schema driven @Aryakoste (#16988)
  • refactor: update mesheryctl to use connection schema and improve error handling @lekaf974 (#16919)
  • [mesheryctl] fix: e2e test meshery server not reachable @lekaf974 (#17008)
  • [mesheryctl] Migrate to MeshKit errors and common test helpers in filter cmd @shri771 (#16921)

🖥 Meshery UI

🧰 Maintenance

📖 Documentation

👨🏽‍💻 Contributors

Thank you to our contributors for making this release possible:
@0xF4ker, @AbhijeetDev102, @Anusha-pannati, @Aryakoste, @Canbow, @CodexRaunak, @Copilot, @DharunMR, @FriedIce-623, @Joiejoie1, @PragalvaXFREZ, @Pragyanshu08, @Ryshab, @Sbragul26, @Shubham-Kumar1, @Syed-Khizerr, @YASHMAHAKAL, @aabidsofi19, @alexquincy, @dependabot[bot], @devlopharsh, @dhruvagrawal2028, @fitzergerald, @hardworker635, @hortison, @ianrwhitney, @ishumi007, @jeetburman, @krishnavbajoria02, @l5io, @leecalcote, @lekaf974, @marblom007, @matrixkavi, @miacycle, @saurabhiiitm062, @shri771, @simihablo, @thc1006, @va4unsingh, @yats0x7, @yi-nuo426, copilot-swe-agent[bot] and dependabot[bot]

Keycloak incubating

Keycloak is an Open-Source Identity and Access Management Solution for Modern Applications and Services. The project is primarily designed to make it easy for developers to secure their applications with minimal effort....

nightly

Add revert button to client credentials form

Signed-off-by: Tero Saarni <tero.saarni@est.tech>

KubeArmor sandbox

Secure workloads at runtime.

v1.6.7

What's Changed

New Contributors

Full Changelog: v1.6.6...v1.6.7

OpenFGA incubating

OpenFGA enables developers to implement highly performant and flexible authorization for their applications. It incorporates Relationship-Based Access Control (ReBAC) and Attribute-Based Access Control (ABAC) concepts with a domain-specific language that simplifies crafting authorization and permission solutions, scalable to any use case and scale

v1.11.3

What's Changed

Added

  • Add configuration option to limit max type system cache size. 2744
  • Add OTEL_* env var support to existing otel env vars. #2825
  • Add configurable server-side validation for ReadChanges page size. The default max page size remains 100 to maintain backward compatibility, and can be configured via --readChanges-max-page-size CLI flag or OPENFGA_READ_CHANGES_MAX_PAGE_SIZE environment variable. #2887

Changed

  • Datastore throttling separated from dispatch throttling in BatchCheck, ListUsers metadata. Also, throttling_type label added to throttledRequestCounter metric to differentiate between dispatch/datastore throttling. #2839

Removed

  • Removed custom grpc_prometheus fork, replace with go-grpc-middleware's provider. Removes the custom grpc_code label on this metric. #2855

Fixed

  • ListUsers will now properly get datastore throttled if enabled. #2846
  • Cache controller now uses the logger provided to the server instead of always using a no-op logger. #2847
  • Typesystem invalidate model with empty intersection and union. #2865
  • Ordered iterator to iterate tuples correctly. #2898

New Contributors

Full Changelog: v1.11.2...v1.11.3

LoxiLB sandbox

vlatest

Merge pull request #874 from TrekkieCoder/main

gh-868 Generate packages runnable with systemd

Knative graduated

Knative is system that helps teams develop, build, manage, and maintain processes in Kubernetes. Its purpose is to simplify, automate, and monitor deployments of Kubernetes so teams spend less time on maintenance and more time on app development and projects....

v1.20.2

🚨 Breaking or Notable Changes

Metrics and Tracing

In v1.19 we've dropped support for OpenCensus (which has been deprecated for a while) in favour of OpenTelemetry. This is a breaking change and details are documented here in the design document. and the website (https://knative.dev/docs/serving/observability/metrics/collecting-metrics/)

Secure Pod Defaults (#16042, @nader-ziada)

We've introduce secure-pod-defaults in an earlier release but this release includes a new setting AllowRootBounded that offers a better security posture for your workloads but balances the compatibility with images that require/expect you to run as root.

For v1.20 release the secure-pod-defaults default will remain disabled but in a future release (most likely v1.21) we will switch this default to AllowRootBounded.

If you're unsure whether your workloads will support this new setting you should explicitly set this option to disabled prior to upgrading to v1.21.

What's Changed

Full Changelog: knative-v1.20.1...knative-v1.20.2

Knative graduated

Knative is system that helps teams develop, build, manage, and maintain processes in Kubernetes. Its purpose is to simplify, automate, and monitor deployments of Kubernetes so teams spend less time on maintenance and more time on app development and projects....

v1.19.9

v1.19.9

🚨 Breaking or Notable Changes

We've dropped support for OpenCensus (which has been deprecated for a while) in favour of OpenTelemetry. This is a breaking change and details are documented here in the design document. and the website (https://knative.dev/docs/serving/observability/metrics/collecting-metrics/)

What's Changed

Full Changelog: knative-v1.19.8...knative-v1.19.9

Knative graduated

Knative is system that helps teams develop, build, manage, and maintain processes in Kubernetes. Its purpose is to simplify, automate, and monitor deployments of Kubernetes so teams spend less time on maintenance and more time on app development and projects....

v0.46.9

v1.19.9

Falco graduated

Falco is a cloud-native runtime security project that makes it easy to consume kernel events. Falco enriches these events with additional information from the Kubernetes platform and ecosystem as well as the rest of the cloud native stack....

0.43.0

LIBS
DRIVER

Packages Download
rpm-x86_64 rpm
deb-x86_64 deb
tgz-x86_64 tgz
tgz-static-x86_64 tgz-static
rpm-aarch64 rpm
deb-aarch64 deb
tgz-aarch64 tgz
Images
docker pull docker.io/falcosecurity/falco:0.43.0
docker pull public.ecr.aws/falcosecurity/falco:0.43.0
docker pull docker.io/falcosecurity/falco-driver-loader:0.43.0
docker pull docker.io/falcosecurity/falco-driver-loader:0.43.0-buster
docker pull docker.io/falcosecurity/falco:0.43.0-debian

v0.43.0

Released on 2026-01-28

Breaking Changes ⚠️

  • fix(userspace)!: show source config path only in debug builds [#3787] - @leogr

Minor Changes

  • chore: [NOTICE] The GPG key used to sign DEB/RPM packages has been rotated, and all existing packages have been re-signed. New key fingerprint: 478B2FBBC75F4237B731DA4365106822B35B1B1F [#3753] - @leogr
  • chore(userspace): deprecate --gvisor-generate-config CLI option [#3784] - @ekoops
  • docs: add deprecation notice for legacy eBPF in pkg install dialog [#3786] - @ekoops
  • chore(scripts/falcoctl): increase follow interval to 1 week [#3757] - @leogr
  • docs: add deprecation notice for legacy eBPF, gVisor and gRPC usage [#3763] - @ekoops
  • chore(userspace): deprecate legacy eBPF probe, gVisor engine and gRPC [#3763] - @ekoops
  • chore(engine): emit warning when the deprecated evt.latency field family is used in a rule condition or output [#3744] - @irozzo-1A

Bug Fixes

  • fix: prevent null pointer crash on popen() failure in output_program [#3722] - @vietcgi
  • fix: correct falcoctl.yaml path in debian conffiles [#3745] - @leogr

Non user-facing changes

  • revert: chore(.github): temporary action for GPG key rotation [#3766] - @leogr
  • chore(cmake): bump falcoctl dependency version to 0.12.2 [#3790] - @ekoops
  • chore(cmake): bump falcoctl dependency version to 0.12.1 [#3777] - @ekoops
  • chore(cmake): bump container plugin version to 0.6.1 [#3780] - @ekoops
  • fix(userspace/engine): missing closing quote in deprecated field warning [#3779] - @leogr
  • chore(.github): Put back gpg key rotation workflow [#3772] - @irozzo-1A
  • chore(cmake): bump libs/drivers to 0.23.1/9.1.0+driver [#3769] - @ekoops
  • chore(cmake): bump container plugin version to 0.6.0 [#3768] - @irozzo-1A
  • docs(proposals): add proposal for legacy probe, gVisor engine and gRPC output deprecation [#3755] - @ekoops
  • chore(cmake): bump libs/drivers to 0.23.0/9.1.0+driver [#3760] - @ekoops
  • update(cmake): update libs and driver to latest master [#3754] - @github-actions[bot]
  • fix(metrics): Add null check for state.outputs in metrics collection [#3740] - @adduali1310
  • chore(cmake): bump libs to 0.23.0-rc2 [#3759] - @ekoops
  • chore(cmake): bump libs/drivers to 0.23.0-rc1/9.1.0-rc1+driver [#3758] - @ekoops
  • fix(ci): revert changes to mitigate rate-limitar change [#3752] - @irozzo-1A
  • update(cmake): update libs and driver to latest master [#3723] - @github-actions[bot]
  • Reduce image size [#3746] - @jfcoz
  • docs(RELEASE.md): specify target branch association upon release creation [#3717] - @ekoops
  • docs(RELEASE.md): fix rn2md cmd generating changelogs [#3709] - @ekoops
  • docs(RELEASE.md): fix PRs filtering expr for checking release notes [#3708] - @ekoops
  • docs(RELEASE.md): fix PRs filtering expression text [#3707] - @ekoops

Statistics

MERGED PRS NUMBER
Not user-facing 21
Release note 11
Total 32

Release Manager @ekoops

SlimFaaS sandbox

SlimFaas MCP 0.60.8

SlimFaasMcp build native AOT for 4 platforms :

  • linux-x64
  • windows-x64
  • macOS (x64)
  • macOS (arm64)
Armada sandbox

v0.20.28

Armada v0.20.28

For more info, head over to the docs page at https://armadaproject.io

Armada CLI

armadactl controls the Armada batch job queueing system and is used for interacting with the system.

The CLI can be downloaded for a specific OS & Architecture from the Assets section below.

NOTE: The OSX binary is packaged as an universal binary and should work on both Intel and Apple Silicon based Macs.

Docker images

Armada Bundle

  • docker pull gresearch/armada:0.20.28
  • docker pull gresearch/armada:latest

Armada Lookout Bundle

  • docker pull gresearch/armada-lookout-bundle:0.20.28
  • docker pull gresearch/armada-lookout-bundle:latest

Armada Full Bundle

  • docker pull gresearch/armada-full-bundle:0.20.28
  • docker pull gresearch/armada-full-bundle:latest

Armada Server

  • docker pull gresearch/armada-server:0.20.28
  • docker pull gresearch/armada-server:latest

Armada Executor

  • docker pull gresearch/armada-executor:0.20.28
  • docker pull gresearch/armada-executor:latest

Armada Lookout

  • docker pull gresearch/armada-lookout:0.20.28
  • docker pull gresearch/armada-lookout:latest

Armada Lookout Ingester

  • docker pull gresearch/armada-lookout-ingester:0.20.28
  • docker pull gresearch/armada-lookout-ingester:latest

Armada Event Ingester

  • docker pull gresearch/armada-event-ingester:0.20.28
  • docker pull gresearch/armada-event-ingester:latest

Armada Scheduler

  • docker pull gresearch/armada-scheduler:0.20.28
  • docker pull gresearch/armada-scheduler:latest

Armada Scheduler Ingester

  • docker pull gresearch/armada-scheduler-ingester:0.20.28
  • docker pull gresearch/armada-scheduler-ingester:latest

Armada Binoculars

  • docker pull gresearch/armada-binoculars:0.20.28
  • docker pull gresearch/armada-binoculars:latest

armadactl

  • docker pull gresearch/armadactl:0.20.28
  • docker pull gresearch/armadactl:latest

Changelog

Features

Other work

Full Changelog: v0.20.27...v0.20.28

SlimFaaS sandbox

v0.60.8

v0.60.8

EMQX

EMQX Enterprise 5.10.3

Enhancements

Deployment

  • #16491 Start releasing packages for macOS 15 (Sequoia)

Observability

  • #16135 Added two new metrics and corresponding rates for the GET /monitor_current HTTP API: rules_matched and actions_executed. They track the number of rules that matched and act
    ion execution rate (i.e., success + failure), respectively.

  • #16324 Added support for end-to-end tracing of messages published via HTTP API.

Security

  • #16625 Added configuration options idp_signs_envelopes and idp_signs_assertions to SAML SSO backend to control signature verification behavior.
    Previously, SAML signature verification was not working correctly because the IdP certificate fingerprint was not being extracted from metadata and passed to esaml for verification.

    Both options default to false for backwards compatibility with existing configurations. Users who want to enable signature verification should explicitly set these to true when their IdP is configured to sign SAML responses.

  • #16456 Added support for TLS 1.3 session ticket resumption.

    EMQX now supports TLS 1.3 session resumption using stateless session tickets, allowing clients to resume TLS sessions without server-side session state storage.

    Node-level configuration: node.tls_stateless_tickets_seed is the secret key seed for generating TLS 1.3 stateless session tickets. Listener-level configuration: listeners.ssl.<name>.ssl_options.session_tickets enables TLS 1.3 session resumption using stateless session tickets.
    Possible values are disabled (default), stateless, and stateless_with_cert (includes certificate information).

    Session tickets are only generated when node.tls_stateless_tickets_seed is configured (non-empty) and session_tickets is enabled in listener SSL options.
    If session_tickets is enabled but node.tls_stateless_tickets_seed is empty, session tickets will not be generated and an error log will be emitted when starting the listener.

Gateway

  • #16220 Added the jt808.frame.parse_unknown_message option, enabling the JT808 gateway to transparently forward unknown messages.

  • #16596 Added support for JT/T 808 protocol 2019.

  • #16627 Add GBK character encoding support for JT/T 808 gateway.

    The JT/T 808 protocol specifies GBK encoding for STRING type fields. A new frame.string_encoding configuration option is added:

    • utf8 (default): Pass through strings as-is (backward-compatible)
    • gbk: Convert GBK-encoded strings from devices to UTF-8 for MQTT, and UTF-8 from MQTT to GBK for devices

    This affects string fields including license plates, driver names, text messages, area names, and client parameters.
    MQTT payloads always use UTF-8 encoding regardless of this setting.

Data Integration

  • #16511 Added support for the IoTDB Table Model in the data integration.

Bug Fixes [39/760]

Core MQTT Functionalities

  • #16349 Fixed a crash in MQTT v5 connections caused by a type mismatch when processing the request-response-information property.

  • #16514 Fixed a bug that caused WebSocket connections to crash when receiving broker messages larger than the client's advertised Maximum-Packet-Size.

Rule Engine

  • #16489 Fixed an issue where the following rule functions always returned undefined:
    msgid/0, qos/0, topic/0, topic/1, flags/0, flag/1,
    clientid/0, username/0, peerhost/0, payload/0, payload/1.

    Note: This is a backward compatibility fix for EMQX v4. These functions are not documented in EMQX v5 and later. The encouraged usage is to directly reference fields from the rule evaluation context. For example, SELECT clientid ... instead of SELECT clientid().

Data Integration

  • #16263 Previously, the Kafka consumer connector performed health checks by verifying partition leader connectivity for all partitions.
    In a clustered deployment, each EMQX node is assigned only a subset of partitions, causing leader connections for unassigned partitions to remain idle.
    Since Kafka closes idle connections after a timeout (10 minutes by default), this behavior could trigger false connectivity alarms.

    The health check now verifies leader connectivity only for the partitions assigned to the current EMQX node, preventing unnecessary idle connections and false alarms.

  • #16336 Fixed a race condition which may cause timeout when testing connectivity or stopping a connector from the dashboard.

  • #16383 Previously, when using IoTDB Connector with its REST API driver, credentials would not be checked during health checks. Now, we send a no-op query during IoTDB connector health c
    heck. This enables early detection of misconfigured client credentials.

  • #16415 Upgraded Apache Pulsar client to 2.1.2.

    When Pulsar producer action's batch_size is configured to 1, the producer will now encode single messages instead of single-element batches.
    This enables consumers to share load using Key Share strategy.

  • #16507 Previously, when an MQTT Source's Connector recovered after losing its connection, topics would not be re-subscribed and the Source would stop working until the Connector itself w
    as restarted. Now, the Source will re-subscribe upon reconnect.

  • #16585 Fixed an issue with GreptimeDB TLS connection failures.

  • #16618 The Kafka request timeout is now automatically set to at least twice the metadata request timeout (with a minimum of 30 seconds),
    reducing unnecessary reconnections and retries when metadata requests take longer than expected.
    This is especially beneficial when metadata request timeout is configured to a small value.

  • #16622 Fixed an issue where, if an Action used async query mode and its Connector was disconnect after more than one health check, its Fallback Actions could be triggered twice.

Clustering

  • #16269 Fixed an issue in the Cluster Link route replication protocol recovery sequence where re-bootstrapping was incorrectly skipped even though the remote side needed it.

  • #16317 Fixed an issue in Cluster Link garbage-collection logic that could accidentally remove live routes from the internal routing table in the process of cleaning up stale route replic
    ation state. This problem occurred only when multiple independent Cluster Links were set up, and some of these links went down for relatively long periods of time.

  • #16452 Upgraded gen_rpc to 3.5.1.

    Prior to the gen_rpc upgrade, EMQX may experience a long tail of crash logs due to connection timeout if a peer node is unreachable.
    The new version of gen_rpc no longer has the long tail and converts crash logs to more readable error logs,
    and the frequent log "failed_to_connect_server" is also throttled to avoid log spamming.

  • #16543 Improved robustness of cluster autoclean procedure.

    Previously, if autoclean feature was disabled during initial start of the node, it would never activate after configuration change.
    This fix resolves this issue.

Access Control

  • #16304 Fixed an issue where Multi-Factor Authentication (MFA) could not be enabled after upgrading EMQX from versions earlier than 5.3.0 due to incompatible login-user database records.

  • #16541 Fixed an issue where OIDC issuer URLs were automatically normalized with a trailing slash when saved to the configuration file, causing issuer mismatch errors when the OIDC provid
    er's discovery document returned the issuer without a trailing slash.

Observability

  • #16418 Reduced the volume of logs generated when a resource exception occurs (resource_exception). These logs are now throttled, and some potentially large terms are redacted from the
    m.

  • #16535 Fixed formatter crash when logging gen_rpc errors.

    Prior to this fix, EMQX would crash with "FORMATTER CRASH" errors when gen_rpc logged certain error messages (e.g., transmission timeout errors). The formatter now handles these error messages correctly without crashing.

Gateway

  • #16609 Fixed JT/T 808 gateway parameter setting (0x8103) and query response (0x0104) message handling for CAN bus ID parameters (0x0110~0x01FF), which should use BYTE[8] data type with b
    ase64 encoding in JSON instead of string type.

  • #16606 Fixed CoAP Gateway working in connection mode over DTLS.

Breaking Changes

Deployment

  • #16491 Stop releasing packages for macOS 13 (Ventura)