v0.8.1

Nisshi 0.8.1 is a patch release. Its container image stops trusting the emSign roots behind the compromised eMudhra intermediates, and it fixes idempotent producers, LogAppendTime topics and fetches of large records. Some changes need attention before you upgrade, especially on the memory, S3 and Google Cloud Storage engines.

Highlights

• Security: the container image no longer trusts emSign ECC Root CA - G3, emSign Root CA - C1 and emSign ECC Root CA - C3. The compromised eMudhra intermediates (CVE-2026-111943) chain to G3, and NSS 3.131.1 removed all three roots.
• An idempotent producer can bump its own epoch after an error, as in Kafka (KIP-360), instead of being fenced or failing with UNKNOWN_SERVER_ERROR.
• Memory, S3 and Google Cloud Storage remember each producer's last 5 batches per partition, so a retry is answered with its offset, and a batch that reuses a sequence number is refused instead of being acknowledged and lost.
• Topics set to message.timestamp.type=LogAppendTime get the broker's timestamps, in records, Produce responses, timestamp lookups (except on SlateDB) and lake tables.
• On PostgreSQL, SQLite and Turso, a consumer no longer stalls on a record larger than its fetch limit.
• An ApiVersions request above v4 gets only the ApiVersions range back, as from Kafka, so franz-go v1.22.2 retries at v4.
• The broker warns at startup when an *_ALLOW_INVALID_CERTIFICATES variable turns off certificate checks, and the README has a new "Outbound TLS" section.

Upgrade notes

Read the upgrade notes in CHANGELOG.md before upgrading. In short:

• LogAppendTime topics switch from producer time to broker time at the upgrade, and message.timestamp.type must be exactly CreateTime or LogAppendTime.
• Memory, S3 and Google Cloud Storage: a batch that reuses an idempotent sequence number now gets OUT_OF_ORDER_SEQUENCE_NUMBER, which librdkafka treats as fatal. With batch_max_delay set, a queue that holds an idempotent batch is no longer merged.
• Container image: an outbound TLS connection to a server whose chain ends at one of the three emSign roots fails.
• Rollback: don't roll back a PostgreSQL, SQLite or Turso broker with LogAppendTime topics, and restart producers that bumped their epoch after rolling back.
• The library crates change Batch::set_timestamps and what Storage::fetch must return.

Install

• Cargo: cargo install nisshi --locked
• Container image: ghcr.io/nisshi-io/solace-nisshi:0.8.1, also published as ghcr.io/nisshi-io/nisshi:0.8.1
• Binaries for Linux (x86_64 and aarch64, static) and macOS (Apple silicon) are attached below.

v0.8.0

Nisshi 0.8.0 brings retention, message-size, ListOffsets and consumer-group behaviour closer to Apache Kafka, and deprecates the SlateDB engine. It has upgrade notes that need action before you upgrade, especially for retention on PostgreSQL and SQLite.

Highlights

• Retention on PostgreSQL and SQLite applies Kafka's default delete policy to a topic without a cleanup.policy, and retention.ms=-1 keeps every record, as in Kafka.
• Produce enforces each topic's max.message.bytes (Kafka's default 1048588 bytes) and rejects a batch whose CRC doesn't match with CORRUPT_MESSAGE, on every engine.
• ListOffsets answers the real log start and end on PostgreSQL, SQLite and the memory, S3 and GCS engines, so lag tools and --reset-offsets --to-latest work after retention, DeleteRecords and multi-record batches.
• ListGroups and DescribeGroups report Kafka's classic group states, and kafka-consumer-groups --list --state works.
• Topic configuration keys move to nisshi.*; the tansu.* keys keep working as deprecated aliases.
• PostgreSQL Fetch and the retention and compaction sweeps no longer scan the whole record table, so a fetch's cost no longer grows with the backlog.
• cargo install nisshi now builds a broker that starts: the crate's default features include the dynostore, libsql and postgres engines.
• The slatedb:// engine is deprecated; it accepts only security fixes and may be removed in a future release.
• Security: a request that fails to decode no longer writes its bytes to the log, the proxy and CLI tools bound response fields to their frame, and zstd, rustls-webpki, tokio and ctutils are updated for RustSec advisories.

Upgrade notes

Read the upgrade notes in CHANGELOG.md before upgrading. In short:

• PostgreSQL and SQLite: a topic without a cleanup.policy loses its records older than retention.ms (7 days if unset) at the first maintenance run, and the deletion can't be undone. To keep every record, set retention.ms=-1 on such topics before you upgrade.
• Produce enforces max.message.bytes: a producer sending batches over 1 MiB to a topic that doesn't set it gets RecordTooLargeException. Raise the limit per topic.
• Transactional producers are refused with TRANSACTIONAL_ID_AUTHORIZATION_FAILED. Idempotent producers are unaffected.
• --authentication stops the broker at startup on memory://, s3://, gs://, null:// and turso://, which can't store SCRAM users.
• ACL requests fail with SECURITY_DISABLED, as on Kafka without an authorizer.
• Topic configuration keys start with nisshi.; upgrade every broker and proxy before you move a topic to them.
• The default log level is warn (was error).
• Memory, S3 and Google Cloud Storage: ListOffsets latest jumps to the real end of the log.
• Docker Compose services listen on 127.0.0.1 only, and the broker waits for db.
• The nisshi CLI changes its output and exit codes, and the library crates change in ways that break existing code.

Install

• Cargo: cargo install nisshi --locked
• Container image: ghcr.io/nisshi-io/solace-nisshi:0.8.0, also published as ghcr.io/nisshi-io/nisshi:0.8.0
• Binaries for Linux (x86_64 and aarch64, static) and macOS (Apple silicon) are attached below.

v0.8.0-pre.1

Pre-release of 0.8.0, for trying changes before it ships: behaviour and storage formats can still change, so use the latest release for anything you keep. See Which release to use.

Full Changelog: v0.7.0...v0.8.0-pre.1

v0.7.0

Nisshi 0.7.0 is the first stable release since the project was renamed from Tansu. Nisshi is a stateless, Apache Kafka-compatible broker with PostgreSQL, SQLite, S3, Google Cloud Storage, SlateDB and in-memory storage.

Highlights

• Google Cloud Storage (gs://) storage engine, and produce request batching on S3 and GCS.
• DeleteRecords on every storage engine, retention.bytes on PostgreSQL and SQLite, and cleanup policies on SlateDB.
• Consumer group rebalances follow Kafka's classic coordinator, so a group settles in about the same time as on Kafka instead of several times longer.
• Kafka compatibility fixes: Fetch offset bounds, ListOffsets by timestamp, InitProducerId, IncrementalAlterConfigs, DeleteGroups and transactions now answer as Apache Kafka 3.9.1 does.
• The broker creates the PostgreSQL and SQLite schema at startup and records its version, so a new deployment needs no setup step.
• PostgreSQL aborts timed-out transactions, so an abandoned transaction no longer stalls read_committed consumers.
• Security fixes: SCRAM with a wrong password no longer authenticates, --cert/--key now actually serve TLS, produce batch decoding is bounded, and secrets and record data are kept out of logs.
• Fixed data loss: DeleteTopics on PostgreSQL and SQLite deleted every topic in the cluster, and on S3 and in-memory storage some group ids and topic names collided with others.
• Requests are bounded by deadlines and timeouts, so a slow storage read, a stalled client or a dead broker connection no longer holds up other work.

Upgrade notes

Read the upgrade notes in CHANGELOG.md before upgrading. In short:

• Renamed: binary nisshi, image ghcr.io/nisshi-io/nisshi, metrics nisshi_*. The default cluster id is now nisshi_cluster: set CLUSTER_ID=tansu_cluster to keep existing data. The SlateDB database path and the Iceberg and Delta defaults also moved from tansu to nisshi.
• PostgreSQL, SQLite and Turso need a manual header table change before the first start, and PostgreSQL servers not on UTC a txn_detail change. The broker creates missing tables itself and needs a role that can create tables.
• --cert/--key now serve TLS only.
• S3 and in-memory: some consumer group keys move without migration.
• SlateDB: lagging consumers can reset to auto.offset.reset; check committed offsets first.
• The listener binds [::] and advertises 127.0.0.1 by default.
• Invalid storage URL options and intervals now stop the broker at startup.
• Upgrade nisshi proxy before its brokers. The proxy no longer forwards SASL.
• Narrower advertised API versions and stricter produce validation.
• Every empty consumer group waits 3s on its first join, as on Kafka.

Install

• Cargo: cargo install nisshi --locked --features dynostore,postgres,libsql,slatedb (a plain cargo install nisshi has no storage engine yet, see #940).
• Container image: ghcr.io/nisshi-io/nisshi:0.7.0
• Binaries for Linux (x86_64 and aarch64, static) and macOS (Apple silicon) are attached below.

v0.7.0-pre.3

Full Changelog: v0.7.0-pre.2...v0.7.0-pre.3

v0.7.0-pre.2

Full Changelog: v0.7.0-pre.1...v0.7.0-pre.2

v0.7.0-pre.1

What's Changed

• Bump delta_kernel from 0.19.2 to 0.20.0 by @dependabot[bot] in #621
• Bump actions/download-artifact from 7 to 8 by @dependabot[bot] in #614
• Bump actions/upload-artifact from 6 to 7 by @dependabot[bot] in #615
• Bump crate-ci/typos from 1.43.1 to 1.44.0 by @dependabot[bot] in #616
• Bump docker/login-action from 3 to 4 by @dependabot[bot] in #617
• Bump docker/setup-buildx-action from 3 to 4 by @dependabot[bot] in #618
• Bump docker/build-push-action from 6 to 7 by @dependabot[bot] in #628
• Bump docker/metadata-action from 5 to 6 by @dependabot[bot] in #629
• Bump jsonschema from 0.41.0 to 0.45.0 by @dependabot[bot] in #633
• Bump rand from 0.9.2 to 0.10.0 by @dependabot[bot] in #606
• disable/remove third party license from CI by @shortishly in #644
• 640 gcloud support by @shortishly in #642
• 648 lite split compaction around group by by @shortishly in #650
• virtual keyed topics: filter fetch by key when topic name contains '/' by @shortishly in #652
• 639 return dyn buf when encoding rather than bytes by @shortishly in #646
• include the produce request batcher with dynostore/s3 by @shortishly in #658
• fix(auth): support SASL re-authentication on existing connections (KIP-368) by @erikcw in #665
• fix(storage): parse GroupDetail JSON instead of wrapping it as Value::String by @erikcw in #662
• inflate: reset compression attribute to none by @shortishly in #667
• lite: virtual topic table by @shortishly in #655
• 659 client request pool metrics by @shortishly in #670
• propagate max_wait into storage by @shortishly in #674
• Move consumer protocol types to sans-io crate by @shortishly in #428
• join/sync: delay and retry request for members without an assignment by @shortishly in #680
• fix(storage): stop read_committed from reading past the last stable offset by @OrHayat in #689
• refactor(storage): split the timeout sweep into maintain_transactions by @OrHayat in #692
• fix(auth): require a validated identity to treat SASL as authenticated by @HarrisonCentner in #696
• feat(storage): add Storage::aborted_transactions trait and stubs by @OrHayat in #698
• build(deps): bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #701
• build(deps): bump actions/setup-go from 5 to 7 by @dependabot[bot] in #700
• build(deps): bump crate-ci/typos from 1.44.0 to 1.48.0 by @dependabot[bot] in #699
• build(deps): bump softprops/action-gh-release from 2 to 3 by @dependabot[bot] in #654
• build(deps): bump fake from 4.4.0 to 5.1.0 by @dependabot[bot] in #634
• build(deps): bump extractions/setup-just from 3 to 4 by @dependabot[bot] in #645

New Contributors

• @erikcw made their first contribution in #665
• @OrHayat made their first contribution in #689
• @HarrisonCentner made their first contribution in #696

Full Changelog: v0.6.0...v0.7.0-pre.1

v0.6.0

What's Changed

• Topic command error handling #346 by @shaneikennedy in #545
• fix(lake): use watermark for offset in lake sink path by @rawkode in #546
• Command error handling by @shaneikennedy in #547
• 500 slatedb storage engine by @jiaoew1991 in #515
• compact policy for lite and pg by @shortishly in #503
• Add ICEBERG_ vars to example env by @shaneikennedy in #549
• Rename pg dir to sql for shared sql statements by @shaneikennedy in #550
• Bump actions/checkout from 5 to 6 by @dependabot[bot] in #507
• Bump actions/download-artifact from 5 to 6 by @dependabot[bot] in #474
• Bump jsonschema from 0.26.2 to 0.33.0 by @dependabot[bot] in #451
• Bump chrono from 0.4.41 to 0.4.42 by @dependabot[bot] in #418
• Bump getrandom from 0.3.3 to 0.3.4 by @dependabot[bot] in #450
• Bump crate-ci/typos from 1.34.0 to 1.40.0 by @dependabot[bot] in #508
• Bump opentelemetry-otlp from 0.30.0 to 0.31.0 by @dependabot[bot] in #453
• Bump governor from 0.10.1 to 0.10.4 by @dependabot[bot] in #554
• Bump tracing-core from 0.1.34 to 0.1.36 by @dependabot[bot] in #555
• Bump serde_json from 1.0.145 to 1.0.149 by @dependabot[bot] in #556
• Bump thiserror from 2.0.17 to 2.0.18 by @dependabot[bot] in #557
• chore: upgrade arrow from 55 to 57 by @jiaoew1991 in #552
• add transaction_id to record by @shortishly in #559
• Bump softprops/action-gh-release from 1 to 2 by @dependabot[bot] in #561
• Bump crate-ci/typos from 1.42.0 to 1.42.1 by @dependabot[bot] in #562
• Bump convert_case from 0.8.0 to 0.9.0 by @dependabot[bot] in #563
• Bump ordered-float from 4.6.0 to 5.1.0 by @dependabot[bot] in #564
• Bump tracing-opentelemetry from 0.29.0 to 0.32.1 by @dependabot[bot] in #567
• Bump rhai from 1.23.6 to 1.24.0 by @dependabot[bot] in #571
• Bump convert_case from 0.9.0 to 0.10.0 by @dependabot[bot] in #570
• Bump apache-avro from 0.17.0 to 0.21.0 by @dependabot[bot] in #566
• Bump criterion from 0.5.1 to 0.8.1 by @dependabot[bot] in #565
• Bump delta_kernel from 0.19.0 to 0.19.1 by @dependabot[bot] in #572
• Bump proc-macro2 from 1.0.105 to 1.0.106 by @dependabot[bot] in #574
• Bump object_store from 0.13.0 to 0.13.1 by @dependabot[bot] in #575
• Bump quote from 1.0.43 to 1.0.44 by @dependabot[bot] in #576
• Bump jsonschema from 0.33.0 to 0.40.0 by @dependabot[bot] in #573
• Bump uuid from 1.19.0 to 1.20.0 by @dependabot[bot] in #580
• Bump time from 0.3.45 to 0.3.46 by @dependabot[bot] in #579
• Bump crate-ci/typos from 1.42.1 to 1.42.2 by @dependabot[bot] in #578
• Bump crate-ci/typos from 1.42.2 to 1.42.3 by @dependabot[bot] in #581
• Bump clap from 4.5.54 to 4.5.55 by @dependabot[bot] in #582
• Bump clap from 4.5.55 to 4.5.56 by @dependabot[bot] in #583
• Bump jsonschema from 0.40.0 to 0.40.2 by @dependabot[bot] in #584
• Bump crate-ci/typos from 1.42.3 to 1.43.0 by @dependabot[bot] in #586
• Bump delta_kernel from 0.19.1 to 0.19.2 by @dependabot[bot] in #587
• Bump hyper-util from 0.1.19 to 0.1.20 by @dependabot[bot] in #588
• Bump getrandom from 0.3.4 to 0.4.0 by @dependabot[bot] in #589
• Bump convert_case from 0.10.0 to 0.11.0 by @dependabot[bot] in #590
• Bump regex from 1.12.2 to 1.12.3 by @dependabot[bot] in #591
• Bump clap from 4.5.56 to 4.5.57 by @dependabot[bot] in #592
• Bump bytes from 1.11.0 to 1.11.1 by @dependabot[bot] in #594
• Bump getrandom from 0.4.0 to 0.4.1 by @dependabot[bot] in #593
• Bump crate-ci/typos from 1.43.0 to 1.43.1 by @dependabot[bot] in #595
• Bump flate2 from 1.1.8 to 1.1.9 by @dependabot[bot] in #596
• Bump criterion from 0.8.1 to 0.8.2 by @dependabot[bot] in #597
• Bump time from 0.3.46 to 0.3.47 by @dependabot[bot] in #599
• Bump deltalake from 0.30.1 to 0.30.2 by @dependabot[bot] in #600
• Bump jsonschema from 0.40.2 to 0.41.0 by @dependabot[bot] in #598
• rustls setup/configuration for pg by @shortishly in #296
• interactive/progress bar on startup by @shortishly in #604
• fix: always using a fresh wrapper state in coordinator by @shortishly in #626
• sasl scram auth wip by @shortishly in #47

New Contributors

• @rawkode made their first contribution in #546
• @jiaoew1991 made their first contribution in #515

Full Changelog: v0.5.11...v0.6.0

v0.6.0-pre.11

What's Changed

• Bump crate-ci/typos from 1.42.3 to 1.43.0 by @dependabot[bot] in #586
• Bump delta_kernel from 0.19.1 to 0.19.2 by @dependabot[bot] in #587
• Bump hyper-util from 0.1.19 to 0.1.20 by @dependabot[bot] in #588
• Bump getrandom from 0.3.4 to 0.4.0 by @dependabot[bot] in #589
• Bump convert_case from 0.10.0 to 0.11.0 by @dependabot[bot] in #590
• Bump regex from 1.12.2 to 1.12.3 by @dependabot[bot] in #591
• Bump clap from 4.5.56 to 4.5.57 by @dependabot[bot] in #592
• Bump bytes from 1.11.0 to 1.11.1 by @dependabot[bot] in #594
• Bump getrandom from 0.4.0 to 0.4.1 by @dependabot[bot] in #593
• Bump crate-ci/typos from 1.43.0 to 1.43.1 by @dependabot[bot] in #595
• Bump flate2 from 1.1.8 to 1.1.9 by @dependabot[bot] in #596
• Bump criterion from 0.8.1 to 0.8.2 by @dependabot[bot] in #597
• Bump time from 0.3.46 to 0.3.47 by @dependabot[bot] in #599
• Bump deltalake from 0.30.1 to 0.30.2 by @dependabot[bot] in #600
• Bump jsonschema from 0.40.2 to 0.41.0 by @dependabot[bot] in #598
• rustls setup/configuration for pg by @shortishly in #296
• interactive/progress bar on startup by @shortishly in #604
• fix: always using a fresh wrapper state in coordinator by @shortishly in #626

Full Changelog: v0.6.0-pre.10...v0.6.0-pre.11

v0.6.0-pre.10

What's Changed

• Bump softprops/action-gh-release from 1 to 2 by @dependabot[bot] in #561
• Bump crate-ci/typos from 1.42.0 to 1.42.1 by @dependabot[bot] in #562
• Bump convert_case from 0.8.0 to 0.9.0 by @dependabot[bot] in #563
• Bump ordered-float from 4.6.0 to 5.1.0 by @dependabot[bot] in #564
• Bump tracing-opentelemetry from 0.29.0 to 0.32.1 by @dependabot[bot] in #567
• Bump rhai from 1.23.6 to 1.24.0 by @dependabot[bot] in #571
• Bump convert_case from 0.9.0 to 0.10.0 by @dependabot[bot] in #570
• Bump apache-avro from 0.17.0 to 0.21.0 by @dependabot[bot] in #566
• Bump criterion from 0.5.1 to 0.8.1 by @dependabot[bot] in #565
• Bump delta_kernel from 0.19.0 to 0.19.1 by @dependabot[bot] in #572
• Bump proc-macro2 from 1.0.105 to 1.0.106 by @dependabot[bot] in #574
• Bump object_store from 0.13.0 to 0.13.1 by @dependabot[bot] in #575
• Bump quote from 1.0.43 to 1.0.44 by @dependabot[bot] in #576
• Bump jsonschema from 0.33.0 to 0.40.0 by @dependabot[bot] in #573
• Bump uuid from 1.19.0 to 1.20.0 by @dependabot[bot] in #580
• Bump time from 0.3.45 to 0.3.46 by @dependabot[bot] in #579
• Bump crate-ci/typos from 1.42.1 to 1.42.2 by @dependabot[bot] in #578
• Bump crate-ci/typos from 1.42.2 to 1.42.3 by @dependabot[bot] in #581
• Bump clap from 4.5.54 to 4.5.55 by @dependabot[bot] in #582
• Bump clap from 4.5.55 to 4.5.56 by @dependabot[bot] in #583
• Bump jsonschema from 0.40.0 to 0.40.2 by @dependabot[bot] in #584

Full Changelog: v0.6.0-pre.9...v0.6.0-pre.10