v5.2.15

TLS

• A failed certificate rebuild no longer drops hostnames to the self-signed default (#2982, backport of #2384). During a certificate renewal, if the hdb_certificate write arrived after the 1.5 s rebuild debounce, updateTLS paired the old certificate with the new private key and failed with ERR_OSSL_X509_KEY_VALUES_MISMATCH. The rebuild had already cleared the shared SNI map, so that record's hostnames fell back to the self-signed certificate, and nothing retried. updateTLS now builds the complete replacement state first and applies it only after the whole pass succeeds. A record whose rebuild fails keeps serving its last good certificate, and each worker retries with backoff (1.5 s, doubling up to 5 min).
  • Behavior change: an invalid replacement certificate now means "keep serving the previous certificate". Deleting the certificate record is still how you revoke it immediately. On mTLS listeners, a retained context is rebuilt against the current CA set whenever that set changes, so removed client-CA trust is not kept.

Analytics

• Analytics aggregation no longer drops raw reports between cycles (#2987, backport of #2692). Each aggregation cycle resumed from a marker set to the cycle's own end time, so raw analytics reported after the end of the aggregated window were skipped permanently. These were reports written while the cycle ran, and the rest of any backlog. get_analytics under-counted by that amount. Aggregation now resumes from the last raw record it actually read. A node that falls behind catches up over consecutive cycles without waiting a full period between them.

Unix domain sockets

• Per-worker UDS mirror sockets survive a rolling HTTP worker restart on Linux (#2966, backport of #2964). With tls.unixDomainSockets enabled, restart_service http_workers starts each replacement worker before stopping the old one. When the old worker closed, libuv deleted the socket path, which the replacement had just bound, so after the restart every <worker>-<port>.sock mirror was missing. Each mirror now binds to a temporary name and is renamed over the published path, so closing the old worker no longer removes the new worker's socket.
  • Upgrade note: apply this with a full process restart. A worker-only restart during an in-place upgrade still runs old-code workers that delete the path when they close.

Also in this release

• Regression tests for analytics aggregation ordering and readability.

Full Changelog: v5.2.14...v5.2.15