# Meshery v1.0.76

> Provisioning & Runtime · 2026-11-12

A substantial feature and maintenance release focused on `mesheryctl` and UI correctness, stricter CLI validation, and operator-visible behavior and compatibility improvements. It also includes a disclosed security fix affecting unauthenticated model export and UI permissions, so workflows involving these paths may need review.

## Action needed
- **[breaking]** Telemetry handler connection ID validation
  - The server now validates the connection ID path parameter in telemetry handlers.
- **[breaking]** `DeleteUserCredential` invalid UUID errors
  - The server now uses `ErrInvalidUUID` for invalid UUID errors from `DeleteUserCredential`.
- **[breaking]** Multi-selector relationship validation
  - The server now validates multi-selector relationships and prevents ghost relationship bleed.
- **[breaking]** `GetUserCredentialByID` credential ID validation
  - The server now validates the credential ID path parameter in `GetUserCredentialByID`.
- **[breaking]** Filter deletion HTTP status handling
  - Filter deletion now returns HTTP 400 for malformed identifiers and HTTP 404 for filters that do not exist.
- **[breaking]** Unknown connection ID update handling
  - Updating an unknown connection ID now returns HTTP 404 instead of creating a connection.
- **[breaking]** `registry purge` argument validation
  - `mesheryctl` now enforces exact argument validation in `registry purge`.
- **[breaking]** `design apply` input validation
  - `mesheryctl` now validates input for `design apply`.
- **[breaking]** `system login` positional argument validation
  - `mesheryctl` now rejects unexpected positional arguments in `system login`.
- **[breaking]** Design ID prefix validation
  - `mesheryctl` now rejects ambiguous design ID prefixes.
- **[breaking]** `system provider list` argument validation
  - `mesheryctl` now enforces exact argument validation in `system provider list`.
- **[breaking]** `system context list` argument validation
  - `mesheryctl` now enforces exact argument validation in `system context list`.
- **[breaking]** `system token view` argument validation
  - `mesheryctl` now enforces argument validation in `system token view`.
- **[breaking]** `system token view` maximum argument validation
  - `mesheryctl` now enforces maximum argument validation in `system token view`.
- **[breaking]** `filter list` argument validation
  - `mesheryctl` now enforces argument validation in `filter list`.
- **[breaking]** `environment create` argument validation
  - `mesheryctl` now enforces exact argument validation in `environment create`.
- **[breaking]** `workspace create` argument validation
  - `mesheryctl` now enforces exact argument validation in `workspace create`.
- **[breaking]** `environment view` argument validation
  - `mesheryctl` now enforces exact argument validation in `environment view`.
- **[breaking]** `environment list` argument validation
  - `mesheryctl` now enforces exact argument validation in `environment list`.
- **[breaking]** `organization list` argument validation
  - `mesheryctl` now enforces exact argument validation in `organization list`.
- **[breaking]** `workspace list` argument validation
  - `mesheryctl` now enforces exact argument validation in `workspace list`.
- **[breaking]** `design list` argument validation
  - `mesheryctl` now enforces exact argument validation in `design list`.
- **[breaking]** `component list` argument validation
  - `mesheryctl` now enforces exact argument validation in `component list`.
- **[breaking]** `system logout` positional argument validation
  - `mesheryctl` now rejects unexpected positional arguments in `system logout`.
- **[breaking]** `perf apply` duration validation
  - `mesheryctl` now sends `perf apply` durations in whole seconds and rejects other duration values.

## Check if affected
- **[security]** Unauthenticated model export path traversal
  - Applies if the request is unauthenticated.
  - The server fixes unauthenticated path traversal in model export through version fields.
- **[security]** UI wire-level data protection
  - Applies if view permission is denied.
  - The UI now prevents wire-level data leakage in Environments, Settings, Performance, and Extensions when view permission is denied.
- **[breaking]** Design and connection list pagination validation
  - Applies if you use `--page` or `--pagesize`.
  - `mesheryctl` now validates `--page` and `--pagesize` in design and connection listing commands.
- **[breaking]** The workspace `--count` flag, removed
  - Applies if you use `--count`.
  - The workspace `--count` flag has been removed from `mesheryctl` because it always failed.

## Plan ahead
- **[deprecated]** Model export `--page` flag deprecation
  - Applies if you use `--page`.
  - The no-op `--page` flag on model export is deprecated in `mesheryctl`.

## Other recorded changes
- 119 (defect_corrected 86, value_changed 15, added 13, constraint_changed 5)

[Full analysis](https://ratatosk.io/en/releases/meshery/v1.0.76)

[Original release notes](https://github.com/meshery/meshery/releases/tag/v1.0.76)