RATATOSKRATATOSK
ログイン

NATS

v2.15.1Networking & Messaging
2026年10月9日

CHECK 5OTHER 60

正確性と性能に焦点を置いた保守リリースです。旧式のゲートウェイ動作の削除に加え、既存の設定に影響する可能性がある制限と検証の適用強化が含まれます。

影響確認 (5)

  • securityauth_users のバイパス問題を修正

    auth_users を設定している場合に適用されます。

    auth callout における auth_users のバイパス問題を修正しました。

  • breakingmax_ha_assets の上限適用を一貫化

    max_ha_assets を設定している場合に適用されます。

    ストリームとコンシューマーの配置、スケール、移動において、metalayer leader が max_ha_assets の上限を一貫して適用するようになりました。

  • breaking旧式の $GR. 返信プレフィックスのサポート削除

    旧式の $GR. 返信プレフィックスを使用している場合に適用されます。

    v2.1.2より前のサーバーで使われていた旧式の $GR. 返信プレフィックスについて、送受信のサポートが削除されました。

  • breakingプロキシ URL 未指定時の Remote proxy options を拒否

    Remote proxy options を設定し、プロキシ URL を指定していない場合に適用されます。

    プロキシ URL が指定されていない場合、Remote proxy options は拒否されるようになりました。

  • breakingクライアント ingress での $GR. 返信プレフィックス予約

    クライアント ingress を使用している場合に適用されます。

    クライアント ingress では $GR. 返信プレフィックスが予約され、クライアントがそのプレフィックスを使ったゲートウェイ返信サブジェクトにパブリッシュできなくなりました。

その他の記録済み変更 60 件すべてfixes 43 · value changes 15 · additions 1 · constraints 1

fixes (43)

  • - Connz requests selecting a connection by cid now correctly apply account, user and MQTT client ID filters (#8613)
  • - Pipelined client operations are no longer processed after a connection is rejected for exceeding the account's max_connections limit (#8614)
  • - Queue subscription deny permissions are now checked against the mapped delivery subject (#8616)
  • - Outstanding reply permissions are now preserved when inherited account permissions are refreshed without changing the response policy (#8620, contributed by @0xasritha)
  • - Subscription deny filters are now rebuilt atomically when inherited account permissions are refreshed, preventing a window in which denied messages could be delivered (#8622, contributed by @0xasritha)
  • - Unquoted configuration values beginning with a number and a size or exponent suffix, such as 0K1abc, are now correctly parsed as strings (#8263, contributed by @koriyoshi2041)
  • - Account JWT updates now reject invalid subject mappings instead of reporting success, and failed replacements no longer remove existing mappings (#8627, contributed by @vulragrag-star)
  • - Cached subscription results are now cleared when an already connected client sends another CONNECT, preventing stale results from being reused after an account change (#8641, reported by @Tan-JunWei)
  • - Fixed several data races affecting service imports and exports during configuration reloads and account updates (#8675)
  • - Per-account routes no longer double count inbound account message and byte statistics (#8677)
  • - TLS certificate pin validation now checks the correct pins after a configuration reload (#8679)
  • - Auth callout rejections are now reported as authentication errors instead of account connection limit errors (#8688, contributed by @aniketatgithub)
  • - Scoped ProxyRequired settings are now respected in JWTs and auth callouts (#8694)
  • - Subscription interest notifications are no longer missed when a subscription is added or removed concurrently (#8703)
  • - Fast batch ping no longer starts a new batch incorrectly (#8714)
  • - Fixed a PDH counter buffer overflow on Windows
  • - Stale per-message TTL entries are now removed when their messages have already been deleted, avoiding repeated expiry scans and excess CPU and memory usage (#8595, contributed by @digitalstraw)
  • - The maximum deliveries exceeded advisory is now sent correctly when a consumer's max_deliver is lowered below a message's existing delivery count (#8605, contributed by @zeke-lin)
  • - The consumer created time is now preserved after recovery (#8621)
  • - Filestore compaction now respects the configured sync settings when replacing a message block (#8629)
  • - Fixed a race during filestore compaction that could cause consumers to skip messages or lose redelivery tracking (#8623, contributed by @as-clearview)
  • - Concurrent updates to R1 consumers no longer lose API responses (#8628)
  • - Stream and consumer create and delete requests received during metalayer catchup now receive responses once catchup completes (#8643)
  • - R1 consumer create requests no longer lose their responses when the consumer is deleted immediately afterwards (#8643)
  • - Fixed a data race when handling consumer leader stepdown requests (#8647)
  • - Clustered snapshots now use the correct generated names for ephemeral consumers, allowing backup validation and restore to succeed (#8651, contributed by @kris70lesgo)
  • - Fixed a memory leak affecting pull requests and direct gets after a configuration reload when the system account is explicitly configured in the accounts block (#8650, contributed by @1995parham)
  • - Fixed membership change, learner scale-up and metalayer commit recovery issues (#8672)
  • - Fixed migration and R1 scale-up issues that could delete a running store or lose writes (#8673)
  • - Recreated streams with renamed Raft groups now start their monitors correctly (#8673)
  • - Consumers are no longer moved to new stream peers before those peers hold the stream data (#8678)
  • - Failed clustered stream restores now clean up correctly without deleting a subsequently recreated stream or losing a stream rm response (#8702)
  • - Fixed a panic when shutting down a clustered JetStream server immediately after startup (#8707, contributed by @clwluvw)
  • - Idempotent stream create requests with sources no longer time out after leader changes (#8703)
  • - Interest cleanup no longer compacts a stream past its last sequence during recovery (#8710, contributed by @pat-s)
  • - Raft nodes will no longer leak their WAL if stopped before route connections are available (#8711, contributed by @clwluvw)
  • - Recovered ephemeral consumers with inactive_threshold set are now cleaned up properly after a server restart (#8732)
  • - Publish permissions are now checked against the transformed subject sent over the leafnode connection, avoiding the need to also allow the original stream import subject (#8530, contributed by @fbarth-ifr)
  • - Fixed incorrect pending byte accounting after a partial compressed write that could stall a leafnode connection and prevent it from reconnecting (#8636)
  • - Closed leafnode connections are now correctly removed from the account's leafnode list, reducing retained memory and garbage collection pressure (#8637)
  • - Remote proxies no longer incorrectly warn that nats:// URLs are unsupported or lose the hub's initial INFO message (#8701)
  • - Config load no longer breaks QoS1/QoS2 delivery when max_ack_pending is unset (#8671)
  • - MQTT packet lengths are validated earlier against max_payload, and non-QoS 2 PUBREC packets are handled correctly (#8692)

value changes (15)

  • - Stalled source and mirror flow control is now reported in stream info and warning logs, making missing $JS.FC.> imports or exports easier to diagnose (#8633)
  • - Stream and consumer placement now prefers peers that have caught up with the metalayer, reducing delays in API responses (#8643)
  • - Improved the performance of deleting entries from and encoding AVL sequence sets (#8646)
  • - Fast batch publish now reports backward sequence gaps as well as forward gaps (#8699)
  • - Stream pending message calculations avoid unnecessary filestore cache access and handle deleted sequence ranges more efficiently (#8680, #8681)
  • - Stream restore format detection now stops after the first S2 chunk (#8693)
  • - Stream restore waits for the preferred node to become leader, avoiding an incorrect create response during clustered restore (#8690)
  • - Memory backed streams avoid copying message headers and bodies twice when storing messages (#8652, contributed by @randomizedcoder)
  • - Leafz now reports whether a leafnode connection uses WebSockets (#8683)
  • - QoS2 PUBLISH and PUBREL processing is now pipelined for increased throughput (#8416, contributed by @levb)
  • - Reduced allocations and buffer copying when processing QoS1 and QoS2 messages and issuing JetStream store and delete requests (#8624, #8625, contributed by @levb)
  • - Partial packets are no longer copied in full on every read, reducing allocations and buffer copying (#8692)
  • - TLS state is now available to auth callouts when leafnodes connect over WebSockets (#8686, contributed by @jurry-duty)
  • - Leafnode clients are now shed alongside regular clients during lame duck shutdown, avoiding a thundering herd (#8695)
  • - Leafnode isolation is now checked before the subscription permission checks, reducing CPU usage on hubs with large numbers of isolated leafnodes (#8727)

additions (1)

  • - Leafnode interest and request/reply across account imports (#8730, contributed by @edjeffreys)

constraints (1)

  • - Remote proxies now support TLS with https:// proxy URLs and an optional proxy tls block (#8701)
NATSをスタックに追加

対応が必要なリリースが出たときに、週次メールでお知らせします。 今回のセキュリティパッチと破壊的変更も、その一例です。

スタックに追加 →
公式リリースノート ↗NATSのリリース一覧 →