v2.60.0

2.60.0 (2026-10-28)

Features

• auth: add DELETE /api-keys to delete one's own API key by key or fingerprint (377c158), closes #3068 #3069
• logger: upgrade kuzzle-logger to 1.5.0 (bdf25a0)
• require Node.js 22.12, drop Node.js 20 support (98e74fc)
• types: export StartOptions, InstallationConfig, ImportConfig, SupportConfig (2b53683), closes #2968

Bug Fixes

• admin: set the shutdown guard, answer loadFixtures with an acknowledgement (6688e5f), closes #3067 #3070
• auth: a strategy failing with null info rejects with missing_user (2a96a8a)
• bin: start scripts let Kuzzle's shutdown finish on failure (#3022) (df39402)
• ci: docker-test.sh functional installs into a volume, not the checkout (c12eb62), closes #2790 #2797 #2968
• cluster: a node deletes its ID card when it shuts down (573995c)
• cluster: a node that cannot join fails its startup (3145e75)
• cluster: do not throw on cluster messages received before the handshake (37bfd12), closes #3031
• cluster: leave the cluster when the handshake lock is lost (#2894) (a890d16)
• cluster: leave the cluster with exit code 1 on a failure (44347b5)
• cluster: mark the shutdown on a lost handshake lock as not awaited (#2894) (0bf43c5)
• cluster: wait for a same-IP ID card to expire before failing (6078a46)
• config: honour security.authToken.gracePeriod and user-set security.jwt keys (d6644ec), closes #3065
• core: a lock taken with no retry is refused at once, and only for itself (#2894) (bf08076)
• core: a node that exits frees the locks it took with withLock (#2894) (deee923), closes #2933
• core: wait for the startup imports run by another node (#3003) (cfa6682)
• funnel: log a rejection of request:afterExecution for plugin requests (be90601)
• funnel: never re-run a failed triggerEvents plugin request (98b4ac0)
• handle or mark every floating promise Sonar reports (S9383) (b3fd043)
• http: answer empty-body requests without waiting for uWS data (#2972) (0517dc9)
• http: remove the routes to four removed API actions (8089dfc)
• kuzzle: a failed start shuts the node down with exit code 1 (#3020) (323e551)
• kuzzle: bound a failure's shutdown to 30 seconds (64d46bd)
• kuzzle: run the shutdown once, and report a lost ID card once (#3017) (5708fd2)
• kuzzle: stop the startup once a shutdown has begun (5856d84), closes #3045
• logger: make Logger.child() return a Logger (d77330a)
• mutex: default the options of Mutex.wait() (3308c16)
• mutex: let unlock() resolve on a lock freed by releaseAllBeforeExit (7c231be), closes #3030
• ratchet: count any off the AST instead of grepping lines (de0d94a), closes #2968
• request: getDate custom formats and getTimestamp integer strings (d9d808e), closes #3056 #3057
• response: overwrite Last-Modified and Location headers (6b3449d)
• router: mark the callback-form http pipe as not awaited (6bc17ac)
• router: trigger http: lowercased for every route (4439bcc)
• storage: apply mappings of a collection:create that loses the creation race (8690363), closes #3043
• storage: cache an index a peer created before this node joined (1d41466), closes #3029
• storage: check number_of_shards only when it is configured (#3009) (f0f1236)
• storage: drop _kuzzle_keep only after the collection is created (#3013) (2edaed5)
• storage: give bodyless Elasticsearch errors a usable message (a5be52a), closes #3032
• storage: make the internal index bootstrap resumable (6b0dac2), closes #3028
• storage: make waitForCollectionShards wait for active primaries (5249c0c), closes #3074
• storage: reload the index cache right after the cluster join (ac89fa7), closes #3036 #3044
• storage: stop recreating _kuzzle_keep when createCollection drops it (#3013) (2f62822)
• storage: wait for the shards of a collection another node created (cdee29c), closes #3033
• test: legacy harness unsubscribe rejects on an unknown room (1087f28), closes #2968
• vault: find the project's secrets file from an npm install of dist/ (87c29b5), closes #3066

Reverts

• index: drop the spelled-out | undefined on IndexController.list (eca434e)