LoginSign Up
← Back to all sparks
N

NATS

DEVOPS
Velocity5.0

High-performance messaging system for distributed applications

nats.io ↗

NATS 2.15.2 closes auth-callout and leafnode ACL gaps on both supported lines.

messagingjetstreamsecurity-fixesbackportsopen-source
◆Current state
NATS shipped 2.15.2 and 2.14.9 together on Oct 26, the first patches since 2.15.1 went final. Both carry the same fixes: auth callout now respects allowed connection types, leafnode ACLs no longer implicitly allow $MQTT.> permissions, OCSP responses are bound to the certificate serial, and restored v1 snapshots are bounds-checked. Both also move to Go builds that distrust eMudhra intermediates.
◆Where it's heading
After 2.15's desired-state metalayer, the release stream has turned to hardening: two rounds of metalayer data-safety fixes in 2.15.1, now a batch of authorization and certificate-validation fixes. Every 2.15 patch is mirrored to 2.14, so the project is carrying two lines in parallel while 2.15 adoption grows.
◆Prediction
Expect paired 2.15.3 / 2.14.10 candidates within a few weeks, continuing the mirrored cadence. The entries don't show when 2.14 support ends.

◆Recent moves

  1. 2d ago

    NATS 2.15.2: auth callout, leafnode ACL and OCSP fixes

    The first patch after 2.15.1's metalayer work shifts to access control: auth callout setups now enforce allowed connection types, leafnode ACLs stop implicitly granting MQTT permissions, and OCSP checks bind to the certificate serial. Operators running auth callout or MQTT over leafnodes have a concrete reason to upgrade.

    View source ↗
  2. 2d ago

    NATS 2.14.9 backports 2.15.2's auth and OCSP fixes

    The 2.14 line receives the identical fix set as 2.15.2 on the same day, on a Go 1.26 toolchain. It continues the pattern of every 2.15 patch being mirrored for users not yet on the metalayer release.

    View source ↗
  3. 20d ago

    NATS 2.15.1 ships metalayer data-safety fixes as stable

    The final 2.15.1 rolls up both release candidates: metalayer-led max_ha_assets enforcement, fixes for scale-up and migration paths that could lose writes, and stalled flow control surfaced in stream info. It is the release that makes 2.15's reconciliation engine the safer upgrade target.

    View source ↗
  4. 20d ago

    NATS 2.14.8 backports JetStream fixes to the 2.14 line

    2.14.8 carries 2.15.1's JetStream diagnostics, placement and data-race fixes to clusters still on 2.14, and drops the legacy $GR. gateway reply prefix. It is maintenance for the older branch rather than new direction.

    View source ↗
  5. 23d ago

    2.15.1 RC2: metalayer data-loss fixes, TLS for leafnode proxies

    The second 2.15.1 candidate is a hardening pass on the new metalayer: it fixes migration and R1 scale-up paths that could delete a running store or lose writes, and stops consumers moving to peers that don't yet hold the stream data. Leafnode remote proxies gain https:// TLS support, and memory-backed streams stop double-copying messages.

    View source ↗
  6. 23d ago

    2.14.8 RC2: backports 2.15.1 race and JetStream fixes

    A 2.14 backport candidate carrying RC2's data-race, auth-callout and JetStream efficiency fixes to users not yet on 2.15. It is maintenance for the older branch rather than new direction.

    View source ↗