v2.12.0

nats-io/nats-serverv2.12.0Sep 22, 2025by github-actions[bot]

AI Summary

This is a major release of NATS server v2.12.0 featuring significant JetStream enhancements including atomic batch publishes, counter streams with aggregate consistency, delayed message scheduling, and offline asset support. The release also introduces TLS security improvements with insecure ciphers now disabled by default, and adds new configuration options for routing, gateways, and leafnodes.

Key Highlights

  • JetStream atomic batch publishes with stage-and-commit style consistency
  • Counter streams with full aggregate consistency over sources and mirrors
  • TLS security: insecure ciphers disabled by default, new X25519MLKEM768 support
  • Delayed message scheduling using Nats-Schedule-TTL header
  • JetStream API now in strict mode by default, erroring on unknown fields

Breaking Changes

  • Insecure cipher suites now disabled by default (new allow_insecure_cipher_suites option added)
  • JetStream API surface is now in strict mode by default - errors if unknown fields provided in request body
  • WebSocket and MQTT clients no longer use TCP keepalives
  • max_buffered_msgs default increased 10x from 10,000 to 100,000 messages
  • Replicated streams now default to async flush (unless sync: always is configured)

New Features

  • Exponential backoff on route/gateway reconnection attempts
  • X25519MLKEM768 TLS curve preference option
  • No responders errors include original subject in Nats-Subject header
  • Exact match filtering for monitoring endpoints
  • Prioritised mode for consumer priority groups with low-latency switching
  • Trusted proxies support for NATS protocol-aware proxies
  • Mirror promotion to normal streams for disaster recovery
  • Delayed message scheduling with Nats-Schedule-TTL header
  • Offline assets support for version compatibility
  • Partition(n) and random(n) for subject transforms
  • Async writes option for streams
  • Server metadata block for per-server key-pairs
  • Leader_since field in stream and consumer info
  • Leafnode interest isolation with isolate_leafnode_interest option
  • Disabled option for leafnode remotes with runtime reload support

Full Release Notes

## Changelog

Refer to the [2.12 Upgrade Guide](https://docs.nats.io/release-notes/whats_new/whats_new_212) for backwards compatibility notes with 2.11.x.

### Go Version

- 1.25.1 (#7273)

### Added

General

- Exponential backoff on route/gateway reconnection attempts (#7042, #7048)
- Added `allow_insecure_cipher_suites` configuration option to `tls` block, as insecure ciphers are now disabled by default (#7144)
- Added `X25519MLKEM768` option to the TLS curve preferences (#7280)
- No responders errors from the server now include the original subject in the `Nats-Subject` header (#5250)
- Added `exact_match` field to the filtering of various monitoring endpoints for server name, host or cluster matching (#7260)

JetStream

- Atomic batch publishes (#6966, #7057, #7060, #7085, #7090, #7091, #7119, #7152, #7175, #7274, #7294, #7313, #7314, #7311, #7316, #7321, #7322, #7327, #7330)
  - Stage-and-commit style batches for JetStream message publishes with normal consistency checks
  - ADR: https://github.com/nats-io/nats-architecture-and-design/blob/main/adr/ADR-50.md
- Counter streams (#6973, #6988, #7081, #7118)
  - Counters are incremented or decremented by publishing to the stream with `Nats-Incr` headers, with full aggregate consistency over sources and mirrors
  - ADR: https://github.com/nats-io/nats-architecture-and-design/blob/main/adr/ADR-49.md
- Prioritised mode for consumer priority groups (#7113)
  - Allows for low-latency switching between clients based on the priority set
  - ADR: https://github.com/nats-io/nats-architecture-and-design/blob/main/adr/ADR-42.md
- Support for trusted proxies (#7153)
  - Allows enforcing that connections arrive via a NATS protocol-aware proxy
  - ADR: https://github.com/nats-io/nats-architecture-and-design/blob/main/adr/ADR-55.md
- Added the ability to promote mirrors to normal streams by removing the mirror configuration (#7171)
  - This allows a mirror to take over operation if the original stream is lost, for example in a disaster recovery scenario
  - This operation cannot be undone and also requires configuring the stream subjects to continue operation
- Added delayed message scheduling (#7170, #7245, #7319)
  - Implements single schedule messages using the `Nats-Schedule-TTL` message header
  - ADR: https://github.com/nats-io/nats-architecture-and-design/blob/main/adr/ADR-51.md
- Added support for offline assets (#7158)
  - Streams and consumers from a higher API version or using unsupported features (i.e. after a downgrade) will be marked as offline to prevent corruption
  - ADR: https://github.com/nats-io/nats-architecture-and-design/blob/main/adr/ADR-44.md 
- Added `partition(n)` for deterministic hash-based partitioning and `random(n)` for non-deterministic random partitioning to subject transforms (#6950)
- Added the ability to specify the required API level in JetStream API requests with the `Nats-Required-Api-Level` request header (#7157)
- Added the ability for streams to opt into async writes (#7315, #7323)
- Add `server_metadata` block to server config, allowing arbitrary key-pairs to be set on a per-server basis, similar to stream/consumer metadata (#6935)
- Support for empty votes, which improves how the Raft election logic handles nodes that have lost their stable storage and attempt to rejoin the cluster regardless (#7038)
- Added `"leader_since"` to the stream and consumer info responses (#7189)

Leafnodes

- Added the ability to isolate leafnode subject interest propagation with the hub-side `isolate_leafnode_interest` configuration option, suppressing east-west traffic and reducing subscription overheads when there are many leafnodes (#7238, #7243, #7277)
- Added `disabled` option for leafnode remotes, with support for reloading from the config at runtime (#7054)

### Changed

General

- WebSocket and MQTT clients no longer use TCP keepalives (#7329)

JetStream

- The JetStream API level has been increased to `2` (#6969)
- The API surface is now in strict mode by default, erroring if unknown fields are provided in the request body (#7049)
- Replicated streams will now default to async flush as long as `sync: always` is not configured (#7018, #7163)
- The default value for `max_buffered_msgs` has been increased by 10x to 100,000 messages (#6633)

### Improved

General

- When logging closed connections, the remote is now logged if known, making it easier to identify where route/gateway/leafnode connections have dropped (#7077)
- Client-specific log lines now include the account and user if known (#7079)

JetStream

- Raft nodes will no longer respond success to catchup messages and will ignore responses if not leader, fixing some potential stream desync scenarios (#6944)
- Replicated streams can now be created even if some of the replica nodes are offline (#7075)
- The storage type is now logged when logging resource limits exceeded (#7076)
- JetStream API requests are always handled from the worker pool, improving the semantics of the API request queue and logging when requests take too long (#7125)
- Filestore in-memory caches now use weak pointers and can respond to garbage collector (GC) pressure, which should help to avoid a number of possible out-of-memory scenarios (#7180)
- Filestore buffer reuse has been fixed (#7295)
- Raft will no longer send any append entries in a known non-leader state (#7297)
- Improved recovery of filestore blocks with unexpected sequence ordering (#7303, #7304, #7305)
- Filestore fixes to improve write correctness, particularly when combined with async mode (#7318, #7331)

Leafnodes

- Leafnode connections without auth no longer unexpectedly connect to the global account (#7116)

### Fixed

JetStream

- Improved validation for stream/consumer configs (#7134)
- An error will now be correctly surfaced when the `Nats-Expected-Last-Subject-Sequence-Subject` header is supplied but the accompanying `Nats-Expected-Last-Subject-Sequence` header is not (#7196)

OCSP

- URL encoding of OCSP requests should now be RFC4648-compliant (#7184)

### Complete Changes
 
https://github.com/nats-io/nats-server/compare/v2.11.0...v2.12.0