Release v2.12.14

Changelog

Go Version

• 1.25.12 (#8435)

Dependencies

• github.com/klauspost/compress v1.19.0 (#8385)
• golang.org/x/crypto v0.54.0 (#8385)
• golang.org/x/sys v0.47.0 (#8385)
• github.com/antithesishq/antithesis-sdk-go v0.7.2-default-no-op (#8385)

Improved

JetStream

• The Raft transport layer has been decoupled, improves testing but does not change server behaviour (#8181)
• The disk concurrency semaphore has been increased to 4096 slots, up from the previous CPU-scaled count (#8336)
• The disk concurrency semaphore can now be configured with the max_concurrent_io option in the jetstream config block (#8336)
• Filestore underlying block cache buffers are now recycled to the pool when the weak reference is collected by the GC, which should smooth out memory usage with some usage patterns (#8395)
• Inserts, iterations and deletes in AVL sequence sets are now faster in many cases, which speeds up the tracking of interior deletes (#8406)
• Stream snapshots now attempt to determine the correct encode buffer size up front, avoiding many unnecessary allocations on streams with large numbers of interior deletes (#8405)
• Reduced memory usage of the structure that is used to track subjects within a stream (#8412)

Fixed

General

• allow_non_tls will no longer log an incorrect message at startup claiming that TLS is required (#8420)
• Combining no_auth_user with auth callouts will no longer skip authentication checks when no CONNECT message is sent
• JWT validation no longer crashes the server with whitespace-only permissions
• Several paths that enforce the permissions of queue subscriptions no longer treat the whole permission as a subject literal
• Several JetStream and MQTT endpoints now correctly guard against null values in JSON
• Fixed an authentication bypass with TLS verify_and_map authenticating users with blank passwords

Monitoring

• The healthz endpoint will now skip and no longer report on expired JWT accounts (#8379, thanks to @ByapakSigdel)
• The varz endpoint will now correctly report JetStream limits after they were changed via a config reload (#8394)

JetStream

• Malformed cluster replicated acks or delivered updates are now correctly rejected by the decoder (#8284, thanks to @uwezkhan)
• Malformed cluster replicated skip or reset updates are now correctly rejected by the decoder (#8345, thanks to @uwezkhan)
• Empty cluster replicated entries are now correctly ignored (#8347, thanks to @uwezkhan)
• Decoded AVL sequence set node counts are now validated correctly on 32-bit systems (#8355, thanks to @uwezkhan)
• Oversized cluster replicated messages are now validated correctly on 32-bit systems (#8357, thanks to @uwezkhan)
• Raft elections now correctly ignore votes from removed peers (#8353)
• Filestore encryption key files are now synced to disk more aggressively (#8366)
• Raft now handles the append entry iterator returning no more entries correctly (#8372)
• Fixed a bug in the filestore which could prevent some filestore block cache references from being weakened correctly, which could result in unexpected memory usage and GC pressure (#8380)
• Attempting to update the consumer storage type now correctly returns an error (#8382)
• Stream publish checks will now correctly reject messages that exceed the maximum store size before proposal (#8389)
• Creating a clustered consumer immediately after creating a clustered stream should no longer respond with a stream not found error (#8410)
• Replicated streams that were recreated while a node was down are no longer treated as an update by a returning node processing a snapshot, avoiding stale Raft groups from continuing to run and unexpected behaviour with consumers (#8413)
• Stream snapshot endpoints now more strictly check the reply subject for validity

MQTT

• Packet identifiers for QoS1 and QoS2 are now issued by a monotonic counter, avoiding accidental ID reuse (#8358, thanks to @nberlee)
• Pending QoS1 and QoS2 deliveries should no longer leak when the subscription is downgraded to QoS0 (#8359, thanks to @nberlee)
• QoS2 messages released on a resumed sessions should no longer lose their QoS or packet ID (#8414)

Complete Changes

v2.12.12...v2.12.14