2.5.3 (Jul 14th, 2026)
Nacos 2.5.3 is mainly a bugfix, security, and experience-improvement release for the 2.x series.
This release focuses on:
- Compatible security dependency upgrades for the v2.x JDK 8 baseline.
- Client stability and logging improvements.
- Config namespace isolation fixes.
- Server-side request validation improvements.
It also keeps incompatible major dependency lines out of v2.x, such as Spring Boot 3, Spring Framework 6, and other JDK 17+ only upgrades.
Detailed changes in this release:
Feature
No major feature changes.
Enhancement/Refactor
[#12323] Improve Logback packagingData behavior by making it configurable through nacos.logback.packagingData with default false, and upgrade the external Logback adapter to 1.1.5.
BugFix
[#13940] Fix continuous class unloading during Nacos Client Log4j2 configuration reload by using safe Log4j2 initialization.
[#14423] Fix missing exceptions when form parameters exceed the configured Tomcat request size limit.
[#15437] Fix client shutdown thread leaks and executor creation race conditions in ConfigRpcTransportClient and related client components.
[#15497] Fix Config namespace isolation for ID-based export, batch delete, and clone operations, and enforce source namespace read permission for clone requests.
Dependencies
[#13998][#14859] Upgrade embedded Tomcat to 9.0.118 to address known Tomcat CVEs.
[#15025][#15451] Upgrade compatible v2.x dependencies, including Jackson to 2.18.9, gRPC Java to 1.75.0, and Spring Security to 5.8.16, while preserving the JDK 8 baseline.
Java Version Requirements
| Module | Java Required |
|---|---|
| Nacos-Server / Nacos-Console | Java 8 |
| Nacos-Client | Java 8 |
New Contributors
Full Changelog: 2.5.2...2.5.3
