Meshery
v1.0.76Provisioning & RuntimeACTION 25CHECK 4PLAN 1OTHER 119
A substantial feature and maintenance release focused on `mesheryctl` and UI correctness, stricter CLI validation, and operator-visible behavior and compatibility improvements. It also includes a disclosed security fix affecting unauthenticated model export and UI permissions, so workflows involving these paths may need review.
Action needed (25)
breakingTelemetry handler connection ID validation
The server now validates the connection ID path parameter in telemetry handlers.
breaking
DeleteUserCredentialinvalid UUID errorsThe server now uses
ErrInvalidUUIDfor invalid UUID errors fromDeleteUserCredential.breakingMulti-selector relationship validation
The server now validates multi-selector relationships and prevents ghost relationship bleed.
breaking
GetUserCredentialByIDcredential ID validationThe server now validates the credential ID path parameter in
GetUserCredentialByID.breakingFilter deletion HTTP status handling
Filter deletion now returns HTTP 400 for malformed identifiers and HTTP 404 for filters that do not exist.
breakingUnknown connection ID update handling
Updating an unknown connection ID now returns HTTP 404 instead of creating a connection.
breaking
registry purgeargument validationmesheryctlnow enforces exact argument validation inregistry purge.breaking
design applyinput validationmesheryctlnow validates input fordesign apply.breaking
system loginpositional argument validationmesheryctlnow rejects unexpected positional arguments insystem login.breakingDesign ID prefix validation
mesheryctlnow rejects ambiguous design ID prefixes.breaking
system provider listargument validationmesheryctlnow enforces exact argument validation insystem provider list.breaking
system context listargument validationmesheryctlnow enforces exact argument validation insystem context list.breaking
system token viewargument validationmesheryctlnow enforces argument validation insystem token view.breaking
system token viewmaximum argument validationmesheryctlnow enforces maximum argument validation insystem token view.breaking
filter listargument validationmesheryctlnow enforces argument validation infilter list.breaking
environment createargument validationmesheryctlnow enforces exact argument validation inenvironment create.breaking
workspace createargument validationmesheryctlnow enforces exact argument validation inworkspace create.breaking
environment viewargument validationmesheryctlnow enforces exact argument validation inenvironment view.breaking
environment listargument validationmesheryctlnow enforces exact argument validation inenvironment list.breaking
organization listargument validationmesheryctlnow enforces exact argument validation inorganization list.breaking
workspace listargument validationmesheryctlnow enforces exact argument validation inworkspace list.breaking
design listargument validationmesheryctlnow enforces exact argument validation indesign list.breaking
component listargument validationmesheryctlnow enforces exact argument validation incomponent list.breaking
system logoutpositional argument validationmesheryctlnow rejects unexpected positional arguments insystem logout.breaking
perf applyduration validationmesheryctlnow sendsperf applydurations in whole seconds and rejects other duration values.
Check if affected (4)
securityUnauthenticated model export path traversal
Applies if the request is unauthenticated.
The server fixes unauthenticated path traversal in model export through version fields.
securityUI wire-level data protection
Applies if view permission is denied.
The UI now prevents wire-level data leakage in Environments, Settings, Performance, and Extensions when view permission is denied.
breakingDesign and connection list pagination validation
Applies if you use
--pageor--pagesize.mesheryctlnow validates--pageand--pagesizein design and connection listing commands.breakingThe workspace
--countflag, removedApplies if you use
--count.The workspace
--countflag has been removed frommesheryctlbecause it always failed.
Plan ahead (1)
deprecatedModel export
--pageflag deprecationApplies if you use
--page.The no-op
--pageflag on model export is deprecated inmesheryctl.
All 119 other recorded changesfixes 86 · value changes 15 · additions 13 · constraints 5
fixes (86)
- - [Server] Exclude soft-deleted connections and mappings in GetEnvironmentConnections @harmanD-MAX (#23263)
- - [Server] Retain API group paths in manifest errors and record partial registration @Supersaiyan101 (#23249)
- - [Server] Guard nil dereferences, detached goroutines, and unmarshal errors in events streamer @Amansingh0807 (#23233)
- - [Server] Propagate manifest extraction errors and add positive CRD test @Supersaiyan101 (#23232)
- - [Server] Fix missing metrics query parameter in GetMesheryPattern @Swarup-Banik (#23227)
- - fix: correct meshmodel policies pagination @Nixantsingh943 (#23231)
- - [Server] Fix runtime panic in getResolvedManifest (MeshModel) @Supersaiyan101 (#23228)
- - [Server] Fix HTTP error handling in DefaultLocalProvider.PublishMetrics @Swarup-Banik (#23218)
- - [Server] Initialize valid MachineCtx for Kubernetes connection registration @Atharva-Mendhulkar (#23210)
- - fix(server): preserve correct annotation classification for alias components @VimalN2005 (#23177)
- - [Server] Do not route non-Kubernetes status updates through the Kubernetes machine @sahillpaul (#23201)
- - [Server] Fix connection definition updates @0xmaster7 (#23192)
- - [Server] Rollback in-memory state machine on database update failure @Atharva-Mendhulkar (#23155)
- - [Server] Return HTTP 404 when deleting non-existent model or connection definition @Amansingh0807 (#22821)
- - [Server] Handle registry lookup errors during connection registration @Nixantsingh943 (#23072)
- - fix(handlers): preserve context for background FSM transitions @Atharva-Mendhulkar (#23146)
- - [Server] Report Kubernetes context conversion failures instead of silently skipping connections @Nixantsingh943 (#23171)
- - [Server] Cancel stalled Kubernetes discovery requests @0xmaster7 (#23166)
- - [Server] Propagate database and marshal errors from GetMesheryK8sContexts @RameshwariS (#22967)
- - fix(server): report asynchronous context deletion errors @Nixantsingh943 (#23145)
- - [Server] Resolve Kubernetes unreachable condition after connection deletion @Nixantsingh943 (#23101)
- - [Server] Preserve composite string formatting and non-greedy reference matching in pattern filler @nishant-devv (#23090)
- - [Server] Prevent index out-of-bounds panic in ExtensionProxy router @Supersaiyan101 (#23088)
- - [Server] Dynamically size planner channels and eliminate mutex deadlock on fan-in @nishant-devv (#23085)
- - [Server] Prevent send on closed channel panic in ProviderTracker @Supersaiyan101 (#23086)
- - [Helm] Fix ingressClassName rendering in meshery chart @madhavzanwar (#23064)
- - [Server] Reset registration status on component generation failure and allow retries @nishant-devv (#23081)
- - [Server] Cascade mapping deletions on workspace and member removal and deduplicate designs @nishant-devv (#23077)
- - [Server] Deduplicate environment connection mappings and cascade delete on removal @nishant-devv (#23048)
- - [Server] Parse Content-Disposition when naming a design imported from a URL @BarbieRajput (#23045)
- - [Server] Stop repeated workspace assignments from surviving removal @BarbieRajput (#23043)
- - [Server] Match every label in MeshSync resource filters @BarbieRajput (#23041)
- - [Server] Deduplicate workspace environment, view, and team mappings @nishant-devv (#23034)
- - [Server] Keep a connection's created_at and owner when updating it @maindevhoon (#23027)
- - [Server] Prevent unchecked type assertions and detached goroutine nil panics in GraphQL resolvers @Amansingh0807 (#23011)
- - [Server] Keep a performance profile's created_at when editing it @BarbieRajput (#23002)
- - [Server] Apply Additional Options saved from the UI to load tests @BarbieRajput (#22996)
- - [Server] Keep a filter's file, visibility and created_at when updating it @BarbieRajput (#22995)
- - [Server] Prevent caching uninitialized state machine on Start failure @nishant-devv (#22975)
- - [Server] Sum registration failure counts across models @Asheesh7298 (#22977)
- - [Server] Save performance results when anonymous sharing is off @BarbieRajput (#22952)
- - [Server] Retain ORDER BY clause in GetMeshSyncResources handler @Supersaiyan101 (#22829)
- - [server] Prevent nil pointer dereference on pattern clone and ErrRequestBody @Supersaiyan101 (#22768)
- - [Server] Prevent unchecked type assertion and detached goroutine nil panics in middlewares @Amansingh0807 (#22964)
- - fix(server): guard against nil patternData in pattern update handler (#22898) @VimalN2005 (#22946)
- - [Server] Fix file descriptor leaks in component SVG generation and OCI export (#22814) @muskan-creates352 (#22815)
- - [Server] Prevent unbounded goroutine leak in MeshSyncRegistrationQueue.Send @Amansingh0807 (#22901)
- - [Server] Close the gzip reader in TarXZ @Ankitavasudev (#22893)
- - [Server] Prevent nil pointer dereferences on missing context values in state machines @Amansingh0807 (#22885)
- - [Docker Extension] Fix nil-pointer panic in proxy ServeHTTP @BarbieRajput (#22691)
- - [Server] Keep stored design fields when re-saving through POST /api/pattern @Karman580 (#22843)
- - [Server] Use a valid OCI repository name when exporting models @kkm121 (#22862)
- - [Server] Close temp certificate file descriptor and guard type assertion in LoadTestHandler @Amansingh0807 (#22818)
- - [Server] Close file descriptor on all return paths in k8s_components_registration @Amansingh0807 (#22765)
- - [Server] Close each adapter client per host in Provision @harshitsaxena214 (#22839)
- - [mesheryctl] Respect --skip-browser in system dashboard --port-forward @Eternity0207 (#23240)
- - [mesheryctl] Align flag struct json tags with Cobra flag names @ayushbuilds-code (#23236)
- - [mesheryctl] Show only the requested services in system logs on Docker @Eternity0207 (#23136)
- - [mesheryctl] Fix remaining HTTP response body leaks @ItsAbir005 (#23028)
- - [mesheryctl] Prevent hang on empty token view prompt and respect --yes flag @nishant-devv (#23036)
- - Fix/issue 22923 filter import url v2 @itsCodeTide (#23017)
- - [mesheryctl] Send the deploy payload from design delete -f @Asheesh7298 (#23021)
- - [mesheryctl] Respect --follow for system logs on Docker @mayank609 (#22979)
- - fix(mesheryctl): use IsValidUrl to detect URLs in filter import @aditya-desale (#22969)
- - [mesheryctl] Preserve silent flag across system restart @Swatantra-66 (#22776)
- [mesheryctl] Propagate errors and handle non-200 responses in registry update and publish @aarushdubey (#22926)
- [mesheryctl] Restore the adapter event stream and fail fast without it @Eternity0207 (#22927)
- [mesheryctl] Fix unclosed file descriptors in helpers (#22902) @muskan-creates352 (#22908)
- [mesheryctl] Save and fetch designs correctly in design apply and delete @Eternity0207 (#22887)
- fix(mesheryctl): surface error detail in ErrUndeployDesign @ThakurUjjwal1706 (#22866)
- [mesheryctl] Prevent slice out-of-bounds panic and unchecked type assertions in model import @Swatantra-66 (#22867)
- [mesheryctl] Fix design and filter list showing wrong names by using strings.TrimSuffix @NerfedAce (#22668)
- fix(mesheryctl): support relative file paths in design undeploy @ThakurUjjwal1706 (#22838)
- fix(mesheryctl): support positional file argument and validate input in design delete @ThakurUjjwal1706 (#22773)
- [mesheryctl] Validate the provider before system provider switch asks for confirmation @Eternity0207 (#22789)
- [mesheryctl] Prevent nil pointer dereference panic and unhandled HTTP status in perf apply @Swatantra-66 (#22801)
- [UI] Read camelCase catalogData.publishedVersion in getDesignVersion @ayushbuilds-code (#23241)
- [UI] Fix Kubernetes dashboard columns that always render empty @MuhammadFaizan-prog (#23234)
- [UI] Use supported durations in performance preferences @0xmaster7 (#23107)
- [UI] Fix comparator contract, state mutation, and semver sorting in versionSort utility @madhavzanwar (#23055)
- [mesheryctl] Fix remaining HTTP response body leaks @ItsAbir005 (#23028)
- [UI] Roll back Catalog Content preference on save failure @spacenets7 (#23029)
- [UI] Fix dashboard edit options overflow on small screens @ItsAbir005 (#22984)
- [UI] Fix notification center infinite scroll loading past the last page @ayushgade06 (#22793)
- Fix/issue 22923 filter import url v2 @itsCodeTide (#23017)
- [Server] Prevent nil pointer dereference on in-cluster context discovery @nishant-devv (#22823)
value changes (15)
- feat(server): adopt the error and event condition contract from meshery/schemas @leecalcote (#22950)
- [mesheryctl] Print perf result latencies in milliseconds @BarbieRajput (#22939)
- [mesheryctl] Send saved headers, cookies and content type in perf apply @BarbieRajput (#22938)
- [mesheryctl] Return an error instead of exiting on stdin read failures in prompts @harshitsaxena214 (#22850)
- [UI] Honor hideError in widget error indicators @dropps07 (#23109)
- [UI] Reset to the first page when searching or filtering resources @mayank609 (#22992)
- [UI] Reset to the first page when searching environments, workspaces and profiles @mayank609 (#22982)
- [UI] Send the canonical filter import bodies @Asheesh7298 (#22983)
- [UI] Forward pageSize in useLazyGetConnectionsQuery @krishbuilds01 (#22971)
- fix: harden event replay, stale idempotency bindings, and revision ordering @leecalcote (#22965)
- [UI] Honor hideError in ObjectFieldTemplate error indicator @dropps07 (#22957)
- [UI] Report adapter and preference save failures instead of failing silently @mayank609 (#22941)
- [Server] Trigger Kubernetes cluster teardown on connection deletion @Atharva-Mendhulkar (#23219)
- [Server] Index the events table for Notification Center queries @ayushgade06 (#23174)
- [Catalog] Migrate Kafka design to Apache Kafka 4.4.0 @spacenets7 (#22872)
additions (13)
- - [Models] Seed cert-manager and dapr relationships on newest model version @BarbieRajput (#23204)
- - [mesheryctl] Add subcommand examples and action overview to registry help text @madhavzanwar (#23053)
- [mesheryctl] Find designs by name in design export @Eternity0207 (#22890)
- [mesheryctl] Add perf delete command @harshitsaxena214 (#22840)
- [UI] Add accessible noscript fallback when JavaScript is disabled @Prakhar1Ojha (#23165)
- [UI] Add quick-access Delete action to Designs @Prakhar1Ojha (#23151)
- [UI] Notify when the Designs publish schema fails to load @mayank609 (#22990)
- [Server][UI] Store and show filter configuration @Asheesh7298 (#23040)
- [UI] Show an error when deleting a performance profile fails @mayank609 (#22986)
- [UI] Notify when the SMP mesh list fails to load in the performance form @mayank609 (#22988)
- feat(server): insert events, replay idempotent creates and correlate repeated failures on MeshKit v1.0.29 @leecalcote (#22958)
- [UI] Show error notifications when filter actions fail @mayank609 (#22930)
- [UI] Show a single error toast when MeshSync resources fail to load @harshiltewari2004 (#22807)
constraints (5)
- - [Server] Scope adapter events to the user and operation that requested them @Eternity0207 (#23098)
- [mesheryctl] Apply perf apply --options and --cert-path to existing profiles @Eternity0207 (#22861)
- [mesheryctl] Accept any case of --output-format in the output formatter factories @Eternity0207 (#22855)
- [UI] Parse lowercase k quantity unit in memory and disk parsers @madhavzanwar (#23247)
- [UI] List every environment in the environment pickers @Asheesh7298 (#23024)
A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.