Meshery
v1.0.77Provisioning & RuntimeNov 12, 2026
A maintenance release focused on correctness, validation, and UI and CLI robustness. It includes an SSRF fix for remote URL imports and behavior changes that affect operators using `mesheryctl`.
Check if affected (2)
securitySSRF protection for remote URL imports
Applies if you use remote URL imports.
The
Servernow guards remote URL imports against SSRF. The fix ships in theServercomponent.breakingExact argument validation for the system provider view
Applies if you run
mesheryctl.mesheryctlnow enforces exact argument validation for the system provider view. The validation change ships inmesheryctl.
All 31 other recorded changesfixes 14 · value changes 14 · additions 2 · constraints 1
fixes (14)
- - [Server] Guard nil dereferences for user, SystemID, provider, and connection in telemetry handlers @Amansingh0807 (#23338)
- - [Server] Guard nil MesheryInstanceID and typed-nil INSTANCE_ID in K8s context paths @piyxsh31 (#23305)
- - [Server] Prevent nil pointer dereference on unauthenticated /user/logout @Supersaiyan101 (#23311)
- - [Server] Evict state machine from tracker on DeleteContext error @Atharva-Mendhulkar (#23256)
- - [Server] Probe NOTFOUND Kubernetes connections so their unreachable condition can resolve @dropps07 (#23235)
- - [mesheryctl] Fix nil dereference and slice bounds panic in
environment view@abhinavkdeval08-design (#23365) - - [mesheryctl] Guard nil timestamp and UUID fields across design and filter commands @Swarup-Banik (#23325)
- - [mesheryctl] Fix connection view empty-slice panic when TotalCount > 0 @Swarup-Banik (#23328)
- - [mesheryctl] Fix Kubernetes log stream descriptor leak in system logs @muskan-creates352 (#22471)
- - [mesheryctl] Fix file descriptor leak in model init @muskan-creates352 (#22438)
- - [UI] Fix search paging and Count sort in the database summary table @mayank609 (#23282)
- - [Server] Dedup inventory parent additions across relationship copies @yi-nuo426 (#23366)
- - fix(mesheryctl): sanitize spaces and path separators in relationship view --save filename
- - fix(mesheryctl): escape model path and validate input in relationship view
value changes (14)
- - [mesheryctl] Use MeshKit errors for token assignment and rollback @piyxsh31 (#23340)
- - [mesheryctl] Respect -c/--context across system token create, set, and view @piyxsh31 (#23317)
- - [mesheryctl] Replace path separators in file names saved by component view @RajJasani (#23300)
- - [mesheryctl] Honor the --context flag in system dashboard, login and logout @mayank609 (#23280)
- - [mesheryctl] Return actionable error for unsupported meshery publish target @Rohith-Saran (#23270)
- - [UI] Handle empty component.schema in LazyComponentForm @abhinavkdeval08-design (#23357)
- - [UI] Offer every credential in the connection wizard and MeshSync stepper @ChackoPAbraham19 (#23334)
- - [UI] Paginate the Credentials table on the server @ChackoPAbraham19 (#23243)
- - [UI] Guard missing cluster context in Dashboard View and enforce RBAC query skip checks @piyxsh31 (#23319)
- - [UI] Keep failed notification page requests retryable @ayushgade06 (#22805)
- - [UI] Enforce RBAC skip guards on connections, preferences, and registry @piyxsh31 (#23295)
- - [UI] Disable LegacyRJSFModal submit while pending and add submitDisabled @piyxsh31 (#23299)
- - [UI] Reset to the first page when searching performance results @mayank609 (#23284)
- - [UI] Skip unauthorized queries in Dashboard charts when view permissions are denied @piyxsh31 (#23272)
additions (2)
- - [Helm] Add env.MESHSYNC_DEFAULT_DEPLOYMENT_MODE with embedded default @ayushbuilds-code (#23291)
- - [mesheryctl] Added Port Fallback To Unused Port @tanav29 (#22308)
constraints (1)
- - [mesheryctl] Parse positional mesh name argument in adapter deploy and remove (#23275) @muskan-creates352 (#23276)
Add Meshery to your stack
A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.