RATATOSKRATATOSK
Sign in

Meshery

v1.0.76Provisioning & Runtime
Nov 12, 2026

ACTION 25CHECK 4PLAN 1OTHER 119

A substantial feature and maintenance release focused on `mesheryctl` and UI correctness, stricter CLI validation, and operator-visible behavior and compatibility improvements. It also includes a disclosed security fix affecting unauthenticated model export and UI permissions, so workflows involving these paths may need review.

Action needed (25)

  • breakingTelemetry handler connection ID validation

    The server now validates the connection ID path parameter in telemetry handlers.

  • breakingDeleteUserCredential invalid UUID errors

    The server now uses ErrInvalidUUID for invalid UUID errors from DeleteUserCredential.

  • breakingMulti-selector relationship validation

    The server now validates multi-selector relationships and prevents ghost relationship bleed.

  • breakingGetUserCredentialByID credential ID validation

    The server now validates the credential ID path parameter in GetUserCredentialByID.

  • breakingFilter deletion HTTP status handling

    Filter deletion now returns HTTP 400 for malformed identifiers and HTTP 404 for filters that do not exist.

  • breakingUnknown connection ID update handling

    Updating an unknown connection ID now returns HTTP 404 instead of creating a connection.

  • breakingregistry purge argument validation

    mesheryctl now enforces exact argument validation in registry purge.

  • breakingdesign apply input validation

    mesheryctl now validates input for design apply.

  • breakingsystem login positional argument validation

    mesheryctl now rejects unexpected positional arguments in system login.

  • breakingDesign ID prefix validation

    mesheryctl now rejects ambiguous design ID prefixes.

  • breakingsystem provider list argument validation

    mesheryctl now enforces exact argument validation in system provider list.

  • breakingsystem context list argument validation

    mesheryctl now enforces exact argument validation in system context list.

  • breakingsystem token view argument validation

    mesheryctl now enforces argument validation in system token view.

  • breakingsystem token view maximum argument validation

    mesheryctl now enforces maximum argument validation in system token view.

  • breakingfilter list argument validation

    mesheryctl now enforces argument validation in filter list.

  • breakingenvironment create argument validation

    mesheryctl now enforces exact argument validation in environment create.

  • breakingworkspace create argument validation

    mesheryctl now enforces exact argument validation in workspace create.

  • breakingenvironment view argument validation

    mesheryctl now enforces exact argument validation in environment view.

  • breakingenvironment list argument validation

    mesheryctl now enforces exact argument validation in environment list.

  • breakingorganization list argument validation

    mesheryctl now enforces exact argument validation in organization list.

  • breakingworkspace list argument validation

    mesheryctl now enforces exact argument validation in workspace list.

  • breakingdesign list argument validation

    mesheryctl now enforces exact argument validation in design list.

  • breakingcomponent list argument validation

    mesheryctl now enforces exact argument validation in component list.

  • breakingsystem logout positional argument validation

    mesheryctl now rejects unexpected positional arguments in system logout.

  • breakingperf apply duration validation

    mesheryctl now sends perf apply durations in whole seconds and rejects other duration values.

Check if affected (4)

  • securityUnauthenticated model export path traversal

    Applies if the request is unauthenticated.

    The server fixes unauthenticated path traversal in model export through version fields.

  • securityUI wire-level data protection

    Applies if view permission is denied.

    The UI now prevents wire-level data leakage in Environments, Settings, Performance, and Extensions when view permission is denied.

  • breakingDesign and connection list pagination validation

    Applies if you use --page or --pagesize.

    mesheryctl now validates --page and --pagesize in design and connection listing commands.

  • breakingThe workspace --count flag, removed

    Applies if you use --count.

    The workspace --count flag has been removed from mesheryctl because it always failed.

Plan ahead (1)

  • deprecatedModel export --page flag deprecation

    Applies if you use --page.

    The no-op --page flag on model export is deprecated in mesheryctl.

All 119 other recorded changesfixes 86 · value changes 15 · additions 13 · constraints 5

fixes (86)

  • - [Server] Exclude soft-deleted connections and mappings in GetEnvironmentConnections @harmanD-MAX (#23263)
  • - [Server] Retain API group paths in manifest errors and record partial registration @Supersaiyan101 (#23249)
  • - [Server] Guard nil dereferences, detached goroutines, and unmarshal errors in events streamer @Amansingh0807 (#23233)
  • - [Server] Propagate manifest extraction errors and add positive CRD test @Supersaiyan101 (#23232)
  • - [Server] Fix missing metrics query parameter in GetMesheryPattern @Swarup-Banik (#23227)
  • - fix: correct meshmodel policies pagination @Nixantsingh943 (#23231)
  • - [Server] Fix runtime panic in getResolvedManifest (MeshModel) @Supersaiyan101 (#23228)
  • - [Server] Fix HTTP error handling in DefaultLocalProvider.PublishMetrics @Swarup-Banik (#23218)
  • - [Server] Initialize valid MachineCtx for Kubernetes connection registration @Atharva-Mendhulkar (#23210)
  • - fix(server): preserve correct annotation classification for alias components @VimalN2005 (#23177)
  • - [Server] Do not route non-Kubernetes status updates through the Kubernetes machine @sahillpaul (#23201)
  • - [Server] Fix connection definition updates @0xmaster7 (#23192)
  • - [Server] Rollback in-memory state machine on database update failure @Atharva-Mendhulkar (#23155)
  • - [Server] Return HTTP 404 when deleting non-existent model or connection definition @Amansingh0807 (#22821)
  • - [Server] Handle registry lookup errors during connection registration @Nixantsingh943 (#23072)
  • - fix(handlers): preserve context for background FSM transitions @Atharva-Mendhulkar (#23146)
  • - [Server] Report Kubernetes context conversion failures instead of silently skipping connections @Nixantsingh943 (#23171)
  • - [Server] Cancel stalled Kubernetes discovery requests @0xmaster7 (#23166)
  • - [Server] Propagate database and marshal errors from GetMesheryK8sContexts @RameshwariS (#22967)
  • - fix(server): report asynchronous context deletion errors @Nixantsingh943 (#23145)
  • - [Server] Resolve Kubernetes unreachable condition after connection deletion @Nixantsingh943 (#23101)
  • - [Server] Preserve composite string formatting and non-greedy reference matching in pattern filler @nishant-devv (#23090)
  • - [Server] Prevent index out-of-bounds panic in ExtensionProxy router @Supersaiyan101 (#23088)
  • - [Server] Dynamically size planner channels and eliminate mutex deadlock on fan-in @nishant-devv (#23085)
  • - [Server] Prevent send on closed channel panic in ProviderTracker @Supersaiyan101 (#23086)
  • - [Helm] Fix ingressClassName rendering in meshery chart @madhavzanwar (#23064)
  • - [Server] Reset registration status on component generation failure and allow retries @nishant-devv (#23081)
  • - [Server] Cascade mapping deletions on workspace and member removal and deduplicate designs @nishant-devv (#23077)
  • - [Server] Deduplicate environment connection mappings and cascade delete on removal @nishant-devv (#23048)
  • - [Server] Parse Content-Disposition when naming a design imported from a URL @BarbieRajput (#23045)
  • - [Server] Stop repeated workspace assignments from surviving removal @BarbieRajput (#23043)
  • - [Server] Match every label in MeshSync resource filters @BarbieRajput (#23041)
  • - [Server] Deduplicate workspace environment, view, and team mappings @nishant-devv (#23034)
  • - [Server] Keep a connection's created_at and owner when updating it @maindevhoon (#23027)
  • - [Server] Prevent unchecked type assertions and detached goroutine nil panics in GraphQL resolvers @Amansingh0807 (#23011)
  • - [Server] Keep a performance profile's created_at when editing it @BarbieRajput (#23002)
  • - [Server] Apply Additional Options saved from the UI to load tests @BarbieRajput (#22996)
  • - [Server] Keep a filter's file, visibility and created_at when updating it @BarbieRajput (#22995)
  • - [Server] Prevent caching uninitialized state machine on Start failure @nishant-devv (#22975)
  • - [Server] Sum registration failure counts across models @Asheesh7298 (#22977)
  • - [Server] Save performance results when anonymous sharing is off @BarbieRajput (#22952)
  • - [Server] Retain ORDER BY clause in GetMeshSyncResources handler @Supersaiyan101 (#22829)
  • - [server] Prevent nil pointer dereference on pattern clone and ErrRequestBody @Supersaiyan101 (#22768)
  • - [Server] Prevent unchecked type assertion and detached goroutine nil panics in middlewares @Amansingh0807 (#22964)
  • - fix(server): guard against nil patternData in pattern update handler (#22898) @VimalN2005 (#22946)
  • - [Server] Fix file descriptor leaks in component SVG generation and OCI export (#22814) @muskan-creates352 (#22815)
  • - [Server] Prevent unbounded goroutine leak in MeshSyncRegistrationQueue.Send @Amansingh0807 (#22901)
  • - [Server] Close the gzip reader in TarXZ @Ankitavasudev (#22893)
  • - [Server] Prevent nil pointer dereferences on missing context values in state machines @Amansingh0807 (#22885)
  • - [Docker Extension] Fix nil-pointer panic in proxy ServeHTTP @BarbieRajput (#22691)
  • - [Server] Keep stored design fields when re-saving through POST /api/pattern @Karman580 (#22843)
  • - [Server] Use a valid OCI repository name when exporting models @kkm121 (#22862)
  • - [Server] Close temp certificate file descriptor and guard type assertion in LoadTestHandler @Amansingh0807 (#22818)
  • - [Server] Close file descriptor on all return paths in k8s_components_registration @Amansingh0807 (#22765)
  • - [Server] Close each adapter client per host in Provision @harshitsaxena214 (#22839)
  • - [mesheryctl] Respect --skip-browser in system dashboard --port-forward @Eternity0207 (#23240)
  • - [mesheryctl] Align flag struct json tags with Cobra flag names @ayushbuilds-code (#23236)
  • - [mesheryctl] Show only the requested services in system logs on Docker @Eternity0207 (#23136)
  • - [mesheryctl] Fix remaining HTTP response body leaks @ItsAbir005 (#23028)
  • - [mesheryctl] Prevent hang on empty token view prompt and respect --yes flag @nishant-devv (#23036)
  • - Fix/issue 22923 filter import url v2 @itsCodeTide (#23017)
  • - [mesheryctl] Send the deploy payload from design delete -f @Asheesh7298 (#23021)
  • - [mesheryctl] Respect --follow for system logs on Docker @mayank609 (#22979)
  • - fix(mesheryctl): use IsValidUrl to detect URLs in filter import @aditya-desale (#22969)
  • - [mesheryctl] Preserve silent flag across system restart @Swatantra-66 (#22776)
  • [mesheryctl] Propagate errors and handle non-200 responses in registry update and publish @aarushdubey (#22926)
  • [mesheryctl] Restore the adapter event stream and fail fast without it @Eternity0207 (#22927)
  • [mesheryctl] Fix unclosed file descriptors in helpers (#22902) @muskan-creates352 (#22908)
  • [mesheryctl] Save and fetch designs correctly in design apply and delete @Eternity0207 (#22887)
  • fix(mesheryctl): surface error detail in ErrUndeployDesign @ThakurUjjwal1706 (#22866)
  • [mesheryctl] Prevent slice out-of-bounds panic and unchecked type assertions in model import @Swatantra-66 (#22867)
  • [mesheryctl] Fix design and filter list showing wrong names by using strings.TrimSuffix @NerfedAce (#22668)
  • fix(mesheryctl): support relative file paths in design undeploy @ThakurUjjwal1706 (#22838)
  • fix(mesheryctl): support positional file argument and validate input in design delete @ThakurUjjwal1706 (#22773)
  • [mesheryctl] Validate the provider before system provider switch asks for confirmation @Eternity0207 (#22789)
  • [mesheryctl] Prevent nil pointer dereference panic and unhandled HTTP status in perf apply @Swatantra-66 (#22801)
  • [UI] Read camelCase catalogData.publishedVersion in getDesignVersion @ayushbuilds-code (#23241)
  • [UI] Fix Kubernetes dashboard columns that always render empty @MuhammadFaizan-prog (#23234)
  • [UI] Use supported durations in performance preferences @0xmaster7 (#23107)
  • [UI] Fix comparator contract, state mutation, and semver sorting in versionSort utility @madhavzanwar (#23055)
  • [mesheryctl] Fix remaining HTTP response body leaks @ItsAbir005 (#23028)
  • [UI] Roll back Catalog Content preference on save failure @spacenets7 (#23029)
  • [UI] Fix dashboard edit options overflow on small screens @ItsAbir005 (#22984)
  • [UI] Fix notification center infinite scroll loading past the last page @ayushgade06 (#22793)
  • Fix/issue 22923 filter import url v2 @itsCodeTide (#23017)
  • [Server] Prevent nil pointer dereference on in-cluster context discovery @nishant-devv (#22823)

value changes (15)

  • feat(server): adopt the error and event condition contract from meshery/schemas @leecalcote (#22950)
  • [mesheryctl] Print perf result latencies in milliseconds @BarbieRajput (#22939)
  • [mesheryctl] Send saved headers, cookies and content type in perf apply @BarbieRajput (#22938)
  • [mesheryctl] Return an error instead of exiting on stdin read failures in prompts @harshitsaxena214 (#22850)
  • [UI] Honor hideError in widget error indicators @dropps07 (#23109)
  • [UI] Reset to the first page when searching or filtering resources @mayank609 (#22992)
  • [UI] Reset to the first page when searching environments, workspaces and profiles @mayank609 (#22982)
  • [UI] Send the canonical filter import bodies @Asheesh7298 (#22983)
  • [UI] Forward pageSize in useLazyGetConnectionsQuery @krishbuilds01 (#22971)
  • fix: harden event replay, stale idempotency bindings, and revision ordering @leecalcote (#22965)
  • [UI] Honor hideError in ObjectFieldTemplate error indicator @dropps07 (#22957)
  • [UI] Report adapter and preference save failures instead of failing silently @mayank609 (#22941)
  • [Server] Trigger Kubernetes cluster teardown on connection deletion @Atharva-Mendhulkar (#23219)
  • [Server] Index the events table for Notification Center queries @ayushgade06 (#23174)
  • [Catalog] Migrate Kafka design to Apache Kafka 4.4.0 @spacenets7 (#22872)

additions (13)

  • - [Models] Seed cert-manager and dapr relationships on newest model version @BarbieRajput (#23204)
  • - [mesheryctl] Add subcommand examples and action overview to registry help text @madhavzanwar (#23053)
  • [mesheryctl] Find designs by name in design export @Eternity0207 (#22890)
  • [mesheryctl] Add perf delete command @harshitsaxena214 (#22840)
  • [UI] Add accessible noscript fallback when JavaScript is disabled @Prakhar1Ojha (#23165)
  • [UI] Add quick-access Delete action to Designs @Prakhar1Ojha (#23151)
  • [UI] Notify when the Designs publish schema fails to load @mayank609 (#22990)
  • [Server][UI] Store and show filter configuration @Asheesh7298 (#23040)
  • [UI] Show an error when deleting a performance profile fails @mayank609 (#22986)
  • [UI] Notify when the SMP mesh list fails to load in the performance form @mayank609 (#22988)
  • feat(server): insert events, replay idempotent creates and correlate repeated failures on MeshKit v1.0.29 @leecalcote (#22958)
  • [UI] Show error notifications when filter actions fail @mayank609 (#22930)
  • [UI] Show a single error toast when MeshSync resources fail to load @harshiltewari2004 (#22807)

constraints (5)

  • - [Server] Scope adapter events to the user and operation that requested them @Eternity0207 (#23098)
  • [mesheryctl] Apply perf apply --options and --cert-path to existing profiles @Eternity0207 (#22861)
  • [mesheryctl] Accept any case of --output-format in the output formatter factories @Eternity0207 (#22855)
  • [UI] Parse lowercase k quantity unit in memory and disk parsers @madhavzanwar (#23247)
  • [UI] List every environment in the environment pickers @Asheesh7298 (#23024)
Add Meshery to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →