NATS

Summary pending.

• Fixed authentication bypass vulnerability with TLS verify_and_map for users with blank passwords
• Fixed multiple JetStream issues including race conditions in filestore operations, Raft proposal handling, and cluster replication
• Improved JetStream performance with faster sequence lookups, AVL operations, and reduced memory usage
• Fixed MQTT packet identifier reuse and QoS message handling issues

• Per-connection log lines demoted to debug level to reduce noise in normal operation
• Multiple JetStream fixes including stream catchup, consumer handling, and data consistency issues
• MQTT security improvements including validation of subscribe deny rules and rejection of malformed packets
• Various stability fixes for panic conditions, race conditions, and memory leaks across authentication, routing, and clustering

• Fixed a race condition when handling subscription interest over routes
• Fixed potential protocol-level corruption from rewriting $JS.ACK subjects and buffer misuse in compressed WebSocket clients
• Fixed multiple JetStream issues including Raft peer tracking, filestore lock handling, and consumer lock release
• Client ID is now available through the embedded ClientAuthentication API

Summary pending.

• Fixed multiple JetStream data consistency issues including consumer redelivery state drift, cache corruption during encryption mode conversion, and metalayer state preservation
• Improved performance by calculating pending messages only on consumer leaders and cancelling expensive sublist intersection operations early
• Fixed TLS and compression handling for leafnode and PROXY protocol connections
• Resolved various race conditions and lock contention issues affecting cluster operations

Summary pending.

• JetStream disk concurrency semaphore increased to 4096 slots and is now configurable via max_concurrent_io option
• Multiple security fixes including authentication bypass with TLS verify_and_map, JWT validation crash, and permission enforcement issues
• Performance improvements to AVL sequence sets, stream snapshots, and memory usage optimization for filestore block cache buffers
• Bug fixes for JetStream cluster replication, MQTT packet ID handling, and various edge cases in stream and consumer operations

• Per-connection log lines demoted to debug level to reduce noise in normal operation
• Multiple stability fixes including race conditions, panics, and data corruption issues in JetStream, authentication, routing, and MQTT handling
• JSONP callback support removed from monitoring endpoints
• Writer options now applied consistently with s2_fast compression mode

• Fixed a regression in JetStream that could cause 'Message Not Found' errors when using max messages per subject limits
• Updated Go version to 1.25.11

• Fixed a race condition when handling subscription interest over routes
• Fixed potential protocol-level corruption from rewriting $JS.ACK subjects and buffer misuse in compressed WebSocket clients
• Fixed multiple JetStream issues including Raft peer tracking, quorum calculation, and stream/consumer scaling behavior
• Client ID is now available through the embedded ClientAuthentication API

Summary pending.