v5.2.14

Security

• mTLS revocation checks are enforced again when the client's issuer is missing from the TLS chain (#2827, backport of #2457). When the client's issuer certificate was not in the TLS chain, verifyCertificate() accepted the client without a revocation check, even with failureMode: fail-closed. That is the normal case on Node.js 24.21.0+ and 26.8.x, and on resumed TLS sessions with any Node version. On those versions a revoked client certificate could connect. Harper now looks up the issuer in its trusted CA set. If it still cannot find the issuer, it applies failureMode: rejects the client under fail-closed, allows it under fail-open, and logs a warning once per certificate.
  • Upgrade note (fail-closed only): if a client certificate is signed by an intermediate CA and Harper trusts only the root, add the intermediate to tls.certificateAuthority. Otherwise resumed sessions from that client are rejected.

Reliability

• Boot recovery no longer runs out of heap on a large transaction log (#2824). After an unclean shutdown, replay combined every native commit stored under one log key into a single transaction. A replication receiver's log can hold a very large number of such commits, so the node crash-looped. Replay now commits each native commit separately.
• A subscription no longer pins workers at 100% CPU when a record key starts with / (v5.2 port of #2689). The walk that notifies subscribers on parent keys never finished for such keys, and it looped on every worker that held a subscription on the table.
• Component startup no longer hangs on zombie process groups (#2794, backport of #2085). Process-group liveness checks now treat an all-zombie group as terminated. Waiting for a group to terminate is capped at 30 seconds, and a warning is logged if the wait runs long.

Replication

• Replicated deletes no longer echo across the mesh (#2815, backport of #2761). When a delete arrived again with the same version and origin, it was applied and logged again each time. Every peer then forwarded that new log entry. A delete that lands on its own tombstone is now skipped.
• A re-delivered write relayed from an origin that has no log on this node is recognized as a duplicate (#2821). The duplicate check read only the origin's log, but the write had been stored in the relaying peer's log. Each re-delivery was therefore applied and logged again. The write, the duplicate check and the retention floor now all read the same log.

Deploy

• Secret custody starts before the application installs that run at startup (#2814, backport of #2783). Sealed (enc:v1:) SSH deploy keys and stored registry credentials now work during those installs. Previously the installs skipped them with no secret custody is registered on this node.

Also in this release

• Test and CI stability on this line: Node 26.9.0 inspector-exception handling in the unit suite, chokidar watch-window timing on the Node 26 unit leg (#2795, backport of #2664), and subscription-walk regression tests.

Full Changelog: v5.2.13...v5.2.14