NATS Server: vanhemmat versiot ja versiohistoria

## Changelog

Refer to the [2.15 Upgrade Guide](https://docs.nats.io/release-notes/upgrade-to-2.15) for backwards compatibility notes with 2.14.x.

### Go Version

• 1.27.3, which contains mitigations for CVE-2026-111943 by distrusting eMudhra intermediate certificates (#8798)

### Dependencies

• github.com/klauspost/compress v1.20.3 (#8798)
• golang.org/x/crypto v0.58.0 (#8798)
• golang.org/x/sys v0.49.0 (#8798)

### Fixed

General

• Allowed connection types are now correctly respected in auth callout setups
• Fixed a potential queue sub weight amplification in the sublist
• OCSP responses are now correctly bound to the certificate serial number

JetStream

• Restored v1 stream snapshots now correctly guard against excessive subject lengths, subject counts or block counts

Leafnodes

• ACLs on leafnode connections no longer override allow/deny lists to implicitly allow `$MQTT.>` permissions

MQTT

• OCSP verification for MQTT connections now correctly obeys the `ocsp_peer` option in the `mqtt` block

### Complete Changes

https://github.com/nats-io/nats-server/compare/v2.15.1...v2.15.2

## Changelog

Refer to the [2.15 Upgrade Guide](https://docs.nats.io/release-notes/upgrade-to-2.15) for backwards compatibility notes with 2.14.x.

### Go Version

• 1.27.2 (#8740)

### Dependencies

• github.com/klauspost/compress v1.20.1 (#8737)
• github.com/nats-io/nats.go v1.53.1 (#8737)

### Changed

JetStream

• The `max_ha_assets` limit is now enforced consistently by the metalayer leader during stream and consumer placement, scaling and moves (#8639)

Gateways

• Support for sending and handling the legacy `$GR.` reply prefix, used by servers prior to v2.1.2, has been removed (#8615)

### Improved

JetStream

• Stalled source and mirror flow control is now reported in stream info and warning logs, making missing `$JS.FC.>` imports or exports easier to diagnose (#8633)
• Stream and consumer placement now prefers peers that have caught up with the metalayer, reducing delays in API responses (#8643)
• Improved the performance of deleting entries from and encoding AVL sequence sets (#8646)
• Fast batch publish now reports backward sequence gaps as well as forward gaps (#8699)
• Stream pending message calculations avoid unnecessary filestore cache access and handle deleted sequence ranges more efficiently (#8680, #8681)
• Stream restore format detection now stops after the first S2 chunk (#8693)
• Stream restore waits for the preferred node to become leader, avoiding an incorrect create response during clustered restore (#8690)
• Memory backed streams avoid copying message headers and bodies twice when storing messages (#8652, contributed by @randomizedcoder)

Monitoring

• Leafz now reports whether a leafnode connection uses WebSockets (#8683)

MQTT

• QoS2 `PUBLISH` and `PUBREL` processing is now pipelined for increased throughput (#8416, contributed by @levb)
• Reduced allocations and buffer copying when processing QoS1 and QoS2 messages and issuing JetStream store and delete requests (#8624, #8625, contributed by @levb)
• Partial packets are no longer copied in full on every read, reducing allocations and buffer copying (#8692)

### Fixed

General

• `Connz` requests selecting a connection by `cid` now correctly apply account, user and MQTT client ID filters (#8613)
• Pipelined client operations are no longer processed after a connection is rejected for exceeding the account's `max_connections` limit (#8614)
• Queue subscription deny permissions are now checked against the mapped delivery subject (#8616)
• Outstanding reply permissions are now preserved when inherited account permissions are refreshed without changing the response policy (#8620, contributed by @0xasritha)
• Subscription deny filters are now rebuilt atomically when inherited account permissions are refreshed, preventing a window in which denied messages could be delivered (#8622, contributed by @0xasritha)
• Unquoted configuration values beginning with a number and a size or exponent suffix, such as `0K1abc`, are now correctly parsed as strings (#8263, contributed by @koriyoshi2041)
• Account JWT updates now reject invalid subject mappings instead of reporting success, and failed replacements no longer remove existing mappings (#8627, contributed by @vulragrag-star)
• Cached subscription results are now cleared when an already connected client sends another `CONNECT`, preventing stale results from being reused after an account change (#8641, reported by @Tan-JunWei)
• Fixed several data races affecting service imports and exports during configuration reloads and account updates (#8675)
• Per-account routes no longer double count inbound account message and byte statistics (#8677)
• TLS certificate pin validation now checks the correct pins after a configuration reload (#8679)
• Auth callout rejections are now reported as authentication errors instead of account connection limit errors (#8688, contributed by @aniketatgithub)
• Scoped `ProxyRequired` settings are now respected in JWTs and auth callouts (#8694)
• Subscription interest notifications are no l

## Changelog

Refer to the [2.15 Upgrade Guide](https://docs.nats.io/release-notes/upgrade-to-2.15) for backwards compatibility notes with 2.14.x. This release also contains all changes up to and including [v2.14.7](https://github.com/nats-io/nats-server/releases/tag/v2.14.7).

### Go Version

• 1.27.1 (#8551)

### Added

JetStream

• Desired state metalayer (#8432, #8437, #8439, #8443, #8452, #8460, #8476, #8576, #8598, #8602, #8603)
• A new desired state reconciliation engine for streams and consumers considerably improves the safety and reliability of asset moves and scales
• Updating the placement or replication factor midway through an existing scale/move operation, cancelling an in-flight scale/move, or peer-removing is now much safer
• ADR：https://github.com/nats-io/nats-architecture-and-design/blob/main/adr/ADR-62.md
• Cancel stream move endpoint (#8476)
• An in-flight scale/move operation on a stream can be cancelled and the asset returned to its original placement using the new `$JS.API.STREAM.CANCEL_MOVE` endpoint
• ADR：https://github.com/nats-io/nats-architecture-and-design/blob/main/adr/ADR-62.md
• Evacuate endpoints (#8443)
• The new `$JS.API.SERVER.EVACUATE` endpoint can safely evacuate streams, and any consumers on those streams, from a node
• The new `$JS.API.STREAM.PEER.EVACUATE.*` endpoint can safely evacuate a peer, and any consumers on that peer, from a stream
• These operations combined allow for maintenance operations with full transfer of data and state without having to peer-remove first
• ADR：https://github.com/nats-io/nats-architecture-and-design/blob/main/adr/ADR-62.md
• Metalayer rescue for disaster recovery (#8408)
• The new `$JS.API.META.RESCUE` endpoint can temporarily lower the quorum-needed for the metalayer, in order to facilitate the recovery of a system where nodes have been permanently lost and the metalayer cannot reach quorum
• ADR：https://github.com/nats-io/nats-architecture-and-design/blob/main/adr/ADR-61.md
• Stream backup and restore v2 (#7882, #8584, #8591, #8604)
• A new backup format for stream snapshots which reads out per-message rather than per-block
• The new backup format also now correctly includes non-replicated consumers on follower nodes
• ADR：https://github.com/nats-io/nats-architecture-and-design/blob/main/adr/ADR-63.md
• Detect source stream recreation (#8384)
• The server now detects a source stream being recreated, restarting the sourcing back from the beginning, ensuring new messages are sourced
• Stream source indexing (#8282, #8516, #8283)
• Restarts and leader changes previously required expensive backward scans through the stream to find the last sourced indices. These are now persisted in an index for instant lookup.
• Domain-prefixed JS API in system account (#8429)
• When a system account is bridged between the hub and a leaf node, the domain-prefixed JS API can now be used to operate on the leaf node while directly connected to the hub

### Changed

JetStream

• Streams now have a default limit of 1000 consumers, unless `max_consumers` is specified in the stream config or account limits (#8337, #8566)
• Applications planning to use a large number of consumers on a stream should configure `max_consumers` in the stream config or account limits to an appropriately high number
• The server-wide default of 1000 can be overridden by setting `default_max_consumers` in the JetStream limits, or can be disabled by setting to `-1`
• This limit does not affect existing consumers and will not result in consumer deletions, only the creation of new consumers is prevented
• Sync changes for replicated streams (#8447)
• When the `sync_interval` is set to `always`, replicated streams now sync their WAL entries but no longer sync upper stream layer writes
• The synced log allows the stream to recover safely, but removing unnecessary syncs from the upper stream layer dramatically improves performance
• Non-replicated R1 streams are not affected by this change and will continue 

## Changelog

Refer to the [2.14 Upgrade Guide](https://docs.nats.io/release-notes/whats_new/whats_new_214) for backwards compatibility notes with 2.12.x. Please note that the 2.13.x version was skipped.

### Go Version

• 1.26.8 (#8551)

### Dependencies

• github.com/antithesishq/antithesis-sdk-go v0.8.0-default-no-op (#8562)
• github.com/klauspost/compress v1.20.0 (#8562)
• golang.org/x/crypto v0.57.0 (#8597)
• golang.org/x/sys v0.48.0 (#8597)
• golang.org/x/time v0.16.0 (#8597)

### Added

JetStream

• Compatibility for the new desired state metalayer, introduced in v2.15, to support safe upgrades and downgrades (#8554)

### Improved

General

• The `fastrand` and `math/rand` packages have been replaced with `math/rand/v2` (#8538, #8557)
• Reduced lock contention that could arise from tracking event IDs or closed connections (#8533)

JetStream

• When syncing deletes from a snapshot, block removals are now aggregated, reducing pending calculations (#8545)
• Message size checks are now performed before more expensive header checks (#8561)
• Pending calculations are now considerably faster when the max messages per subject limit is 1 (#8567)

### Fixed

General

• The `{{left}}` and `{{right}}` mapping functions now work correctly in account mappings and source/mirror transforms (#8568)

JetStream

• A potential underflow when calculating deletes in skip messages has been fixed (#8546)
• Fixed an issue where catchup signals to the metalayer are blocked, which could stall stream or cluster management operations until the node is restarted (#8555)
• Consumer removal is now handled correctly after a recreate during metalayer recovery at startup (#8556)
• Fixed a potential panic that could happen when filestore block caches were released during message removal (#8548)
• The last dedupe message ID is now restored correctly if the last message was outside of the window after restart (#8564)
• An unreachable send snapshot condition has been removed from the stream monitor (#8565)
• Pull request expiry is now counted as activity when `inactive_threshold` is set (#8575)
• Purges and roll-ups on multi-filter subject consumers will no longer advance past unrelated subjects (#8572)
• Filestore compression header checking is now extended to check for compatible compression values and for the presence of correct or incorrect first record checksums, avoiding collisions at the beginning of a message block (#8581)
• JetStream usage from peer-removed nodes is now removed from the remaining cluster node accounting correctly (#8570)
• Fixed a data race between deduplication tracking and stream config updates (#8598)
• Fixed a potential nil consumer info when responding to consumer reset requests (#8598)
• Stream catchups will no longer run for removed or re-synced peers (#8598)
• Fixed a race condition that could leave ghost consumer assignments when deleting consumers (#8598)
• Pausing a consumer with pending changes no longer cancels out the in-flight assignment (#8598)
• Stepping down a consumer leader with pending changes no longer fails (#8598)
• Switching a stream to interest retention policy with no consumers now correctly cleans up messages with no interest (#8598)
• Fixed an issue where removed consumers were incorrectly matched without checking the group name (#8598)
• A number of stream and consumer endpoints will no longer report the wrong state based on in-flight proposals (#8598)

### Complete Changes

https://github.com/nats-io/nats-server/compare/v2.14.6...v2.14.7

## Changelog

Refer to the [2.14 Upgrade Guide](https://docs.nats.io/release-notes/whats_new/whats_new_214) for backwards compatibility notes with 2.12.x. Please note that the 2.13.x version was skipped.

### Go Version

• 1.26.7

### Improved

General

• Removal from service import response maps is now constant-time (#8463)
• The client code no longer resets the deadline more times than necessary when flushing client buffers (#8513)
• The client write buffers are now freed correctly when the working buffer exceeds a rational size (#8515)

JetStream

• Stream reads are now isolated with a separate lock, which improves the performance of direct gets (#8486)
• Improved the performance of looking up matching sequence numbers for multi-subject gets (#8486)
• Reduced the number of heap escapes in subject tree matching (#8526)

### Fixed

General

• WebSocket client buffers are recycled more aggressively when reallocating into larger buffers (#8518)
• Fixed missing routes after a reconnect when gossiped URLs were rejected (#8527)

JetStream

• The filestore block sync no longer incorrectly skips blocks that were compacted during the same pass (#8456)
• The filestore block sync now performs a single directory sync upon completion rather than once per compacted block (#8461)
• The filestore I/O semaphore now covers block sync operations (#8462)
• Stream config updates with replicas greater than 1 are now rejected on non-clustered systems (#8464)
• Fixed some issues that could prevent stream snapshots from taking place on a clean shutdown (#8465)
• The filestore inline compaction no longer ignores `sync_interval：always` (#8475)
• The stream created time is now preserved after recovery on a standalone server (#8471, contributed by @Green7)
• Fixed a data race that could apply when accessing the batch ID (#8369)
• Fixed a data race when reading the consumer direct or sourcing status (#8478, contributed by @nberlee)
• Prevent the consumer direct or sourcing status from being changed with a consumer update (#8478, contributed by @nberlee)
• Fixed an issue where the server could fail to distinguish consumer tiers when enforcing limits (#8484)
• Fixed a flow control problem where replicated consumers could get stuck after a leader change (#8488)
• Fixed various consumer create issues that could destroy the state of an existing consumer with the same name (#8491)
• Internal message delete proposals are no longer counted in the JS API statistics (#8502)
• Dynamic filestore reservations no longer incorrectly shrink based on used storage after restarts (#8503)
• Fixed a signalling issue that could stall Raft catchups (#8501)
• The pending append entry cache in-memory is now bounded by size as well as entry count (#8501)
• Fixed an issue where a stale snapshot from a previous Raft group could be replayed if the group name was unchanged (#8501)
• Consumer delivery counts will no longer underflow below zero (#8512, contributed by @no-hup)
• `AckFlowControl` consumers from a work queue stream will no longer incorrectly ack messages outside of the consumer filter (#8431, #8528)

### Complete Changes

https://github.com/nats-io/nats-server/compare/v2.14.5...v2.14.6

Changelog
Refer to the 2.10 Upgrade Guide for backwards compatibility notes with 2.9.x.
Go Version
• 1.23.5 (#6379)
Dependencies
• golang.org/x/sys v0.29.0 (#6323)
• golang.org/x/time v0.9.0 (#6324)
• golang.org/x/crypto v0.32.0 (#6367)
Improved
JetStream
• Raft groups will no longer snapshot too often in some situations, improving performance (#6277)
• Optimistically perform stream and consumer snapshots on a normal shutdown (#6279)
• The stream snapshot interval has been removed, now relying on the compaction minimum, which improves performance (#6289)
• Raft groups will no longer report current while they are paused with pending commits (#6317)
• Unnecessary client info fields have been removed from stream and consumer assignment proposals, API advisories and stream snapshot/restore advisories (#6326, #6338)
• Reduced lock contention between the JetStream lock and Raft group locks (#6335)
• Advisories will only be encoded and sent when there is interest, reducing CPU usage (#6341)
• Consumers with inactivity thresholds will now start less clean-up goroutines, which can reduce load on the goroutine scheduler (#6344)
• Consumer cleanup goroutines will now stop faster when the server shuts down (#6351)
Fixed
JetStream
• Subject state consistency with some message removal patterns (#6226)
• A performance issue has been fixed when updating the per-subject state (#6235)
• Fixed consistency issues with detecting partial writes in the filestore (#6283)
• A race condition between removing peers and updating replica counts has been fixed (#6316)
• Pre-acks for a sequence are now removed when the message is removed, correcting a potential memory leak (#6325)
• Metalayer snapshot errors are now surfaced correctly (#6361)
• Healthchecks no longer re-evaluate stream and consumer assignments, avoiding some streams and consumers being unexpectedly recreated shortly after a deletion (#6362)
• Clients should no longer timeout on a retried ack with the AckAll policy after a server restart (#6392)
• Replicated consumers should no longer get stuck after leader changes due to incorrect accounting (#6387)
• Consumers will now correctly handle the case where messages queued for delivery have been removed, fixing a delivery slowdown (#6387, #6399)
• The API in-flight metric has been fixed so that it does not drift after the queue has been dropped (#6373)
• Handles for temporary files are now closed correctly if compression errors occur (#6390) — Thanks to @deem0n for the contribution!
• JetStream will now shut down correctly when detecting that the store directory underlying filesystem has become read-only (#6292) — Thanks to @souravagrawal for the contribution!
Leafnodes
• Fixed an interest propagation issue that could occur when the hub has a user with subscribe permissions on a literal subject (#6291)
• Fixed a bug where all queue interest across leafnodes could be dropped over gateways in a supercluster deployment after a leafnode connection drops (#6377)
Tests
• A number of unit tests have been improved (#6150, #6278, #6297, #6300, #6343, #6329, #6330, #6331, #6331, #6334, #6364)
Complete Changes
v2.10.24...v2.10.25

Changelog
Refer to the 2.10 Upgrade Guide for backwards compatibility notes with 2.9.x.
Go Version
- 1.23.5 (#6379)
Dependencies
- golang.org/x/sys v0.29.0 (#6323)
- golang.org/x/time v0.9.0 (#6324)
- golang.org/x/crypto v0.32.0 (#6367)
Improved
JetStream
- Raft groups will no longer snapshot too often in some situations, improving performance (#6277)
- Optimistically perform stream and consumer snapshots on a normal shutdown (#6279)
- The stream snapshot interval has been removed, now relying on the compaction minimum, which improves performance (#6289)
- Raft groups will no longer report current while they are paused with pending commits (#6317)
- Unnecessary client info fields have been removed from stream and consumer assignment proposals, API advisories and stream snapshot/restore advisories (#6326, #6338)
- Reduced lock contention between the JetStream lock and Raft group locks (#6335)
- Advisories will only be encoded and sent when there is interest, reducing CPU usage (#6341)
- Consumers with inactivity thresholds will now start less clean-up goroutines, which can reduce load on the goroutine scheduler (#6344)
- Consumer cleanup goroutines will now stop faster when the server shuts down (#6351)
Fixed
JetStream
- Subject state consistency with some message removal patterns (#6226)
- A performance issue has been fixed when updating the per-subject state (#6235)
- Fixed consistency issues with detecting partial writes in the filestore (#6283)
- A race condition between removing peers and updating replica counts has been fixed (#6316)
- Pre-acks for a sequence are now removed when the message is removed, correcting a potential memory leak (#6325)
- Metalayer snapshot errors are now surfaced correctly (#6361)
- Healthchecks no longer re-evaluate stream and consumer assignments, avoiding some streams and consumers being unexpectedly recreated shortly after a deletion (#6362)
- Clients should no longer timeout on a retried ack with the AckAll policy after a server restart (#6392)
- Replicated consumers should no longer get stuck after leader changes due to incorrect accounting (#6387)
- Consumers will now correctly handle the case where messages queued for delivery have been removed, fixing a delivery slowdown (#6387, #6399)
- The API in-flight metric has been fixed so that it does not drift after the queue has been dropped (#6373)
- Handles for temporary files are now closed correctly if compression errors occur (#6390) — Thanks to @deem0n for the contribution!
- JetStream will now shut down correctly when detecting that the store directory underlying filesystem has become read-only (#6292) — Thanks to @souravagrawal for the contribution!
Leafnodes
- Fixed an interest propagation issue that could occur when the hub has a user with subscribe permissions on a literal subject (#6291)
- Fixed a bug where all queue interest across leafnodes could be dropped over gateways in a supercluster deployment after a leafnode connection drops (#6377)
Tests
- A number of unit tests have been improved (#6150, #6278, #6297, #6300, #6343, #6329, #6330, #6331, #6331, #6334, #6364)
Complete Changes
v2.10.24...v2.10.25