A maintenance release with a Go toolchain update, dependency manifest updates, JetStream performance and configuration changes, and numerous correctness fixes. Authentication fixes address security flaws and require upgrading.
Action needed (1)
breakingThe disk concurrency semaphore, increased to 4096 slots
The disk concurrency semaphore is now set to 4096 slots, up from the previous CPU-scaled count. This performance change ships in v2.12.14.
Check if affected (2)
securityAuthentication checks with
no_auth_userand auth calloutsApplies if you configure
no_auth_userand use auth callouts.Authentication checks are no longer skipped when
no_auth_useris combined with auth callouts and noCONNECTmessage is sent. This security fix ships in v2.12.14.securityTLS
verify_and_mapauthentication with blank passwordsApplies if you use TLS and configure
verify_and_map.An authentication bypass involving TLS
verify_and_mapand users with blank passwords is fixed. This security fix ships in v2.12.14.