v2.14.8

## Changelog

Refer to the [2.14 Upgrade Guide](https://docs.nats.io/release-notes/whats_new/whats_new_214) for backwards compatibility notes with 2.12.x. Please note that the 2.13.x version was skipped.

### Go Version

- 1.26.9 (#8740)

### Dependencies

- github.com/klauspost/compress v1.20.1 (#8737)
- github.com/nats-io/nats.go v1.53.1 (#8737) 

### Changed

Gateways

- Support for sending and handling the legacy `$GR.` reply prefix, used by servers prior to v2.1.2, has been removed (#8615)

### Improved

JetStream

- Stalled source and mirror flow control is now reported in stream info and warning logs, making missing `$JS.FC.>` imports or exports easier to diagnose (#8633)
- Stream and consumer placement now prefers peers that have caught up with the metalayer, reducing delays in API responses (#8643)
- Improved the performance of deleting entries from and encoding AVL sequence sets (#8646)
- Fast batch publish now reports backward sequence gaps as well as forward gaps (#8699)
- Stream pending message calculations avoid unnecessary filestore cache access and handle deleted sequence ranges more efficiently (#8680, #8681)
- Stream restore waits for the preferred node to become leader, avoiding an incorrect create response during clustered restore (#8690)
- Memory backed streams avoid copying message headers and bodies twice when storing messages (#8652, contributed by @randomizedcoder)

Monitoring

- Leafz now reports whether a leafnode connection uses WebSockets (#8683)

MQTT

- Partial packets are no longer copied in full on every read, reducing allocations and buffer copying (#8692)

### Fixed

General

- Concurrent account JWT updates no longer invalidate stream imports and interrupt message delivery (#8610)
- Configuration reloads no longer incorrectly disconnect operator mode clients that send an `nkey` (#8609)
- `Connz` requests selecting a connection by `cid` now correctly apply account, user and MQTT client ID filters (#8613)
- Pipelined client operations are no longer processed after a connection is rejected for exceeding the account's `max_connections` limit (#8614)
- Queue subscription deny permissions are now checked against the mapped delivery subject (#8616)
- Outstanding reply permissions are now preserved when inherited account permissions are refreshed without changing the response policy (#8620, contributed by @0xasritha)
- Subscription deny filters are now rebuilt atomically when inherited account permissions are refreshed, preventing a window in which denied messages could be delivered (#8622, contributed by @0xasritha)
- Unquoted configuration values beginning with a number and a size or exponent suffix, such as `0K1abc`, are now correctly parsed as strings (#8263, contributed by @koriyoshi2041)
- Account JWT updates now reject invalid subject mappings instead of reporting success, and failed replacements no longer remove existing mappings (#8627, contributed by @vulragrag-star)
- Cached subscription results are now cleared when an already connected client sends another `CONNECT`, preventing stale results from being reused after an account change (#8641, reported by @Tan-JunWei)
- Fixed several data races affecting service imports and exports during configuration reloads and account updates (#8675)
- Per-account routes no longer double count inbound account message and byte statistics (#8677)
- TLS certificate pin validation now checks the correct pins after a configuration reload (#8679)
- Fast batch ping no longer starts a new batch incorrectly (#8714)
- Auth callout rejections are now reported as authentication errors instead of account connection limit errors (#8688, contributed by @aniketatgithub)
- Scoped `ProxyRequired` settings are now respected in JWTs and auth callouts (#8694)
- Subscription interest notifications are no longer missed when a subscription is added or removed concurrently (#8703)
- Fixed issues with auth callout `auth_users` bypass 
- Fixed a PDH counter buffer overflow on Windows

JetStream

- Stream scale-down requests are now rejected when the target replica count has no configured account tier (#8608)
- Stale per-message TTL entries are now removed when their messages have already been deleted, avoiding repeated expiry scans and excess CPU and memory usage (#8595, contributed by @digitalstraw)
- The maximum deliveries exceeded advisory is now sent correctly when a consumer's `max_deliver` is lowered below a message's existing delivery count (#8605, contributed by @zeke-lin)
- The consumer created time is now preserved after recovery (#8621)
- Filestore compaction now respects the configured sync settings when replacing a message block (#8629)
- Fixed a race during filestore compaction that could cause consumers to skip messages or lose redelivery tracking (#8623, contributed by @as-clearview)
- Concurrent updates to R1 consumers no longer lose API responses (#8628)
- Stream and consumer create and delete requests received during metalayer catchup now receive responses once catchup completes (#8643)
- R1 consumer create requests no longer lose their responses when the consumer is deleted immediately afterwards (#8643)
- Fixed a data race when handling consumer leader stepdown requests (#8647)
- Fixed a memory leak affecting pull requests and direct gets after a configuration reload when the system account is explicitly configured in the `accounts` block (#8650, contributed by @1995parham)
- Fixed a panic when shutting down a clustered JetStream server immediately after startup (#8707, contributed by @clwluvw)
- Idempotent stream create requests with sources no longer time out after leader changes (#8703)
- Recovered ephemeral consumers with `inactive_threshold` set are now cleaned up properly after a server restart (#8732)

Leafnodes

- Publish permissions are now checked against the transformed subject sent over the leafnode connection, avoiding the need to also allow the original stream import subject (#8530, contributed by @fbarth-ifr)
- Fixed incorrect pending byte accounting after a partial compressed write that could stall a leafnode connection and prevent it from reconnecting (#8636)
- Closed leafnode connections are now correctly removed from the account's leafnode list, reducing retained memory and garbage collection pressure (#8637)
- TLS state is now available to auth callouts when leafnodes connect over WebSockets (#8686, contributed by @jurry-duty)
- Leafnode clients are now shed alongside regular clients during lame duck shutdown, avoiding a thundering herd (#8695)
- Remote proxies now support TLS with `https://` proxy URLs and an optional proxy `tls` block (#8701)
- Remote proxies no longer incorrectly warn that `nats://` URLs are unsupported or lose the hub's initial `INFO` message (#8701)
- Remote proxy options are now rejected when no proxy URL is specified (#8701)
- Leafnode interest and request/reply across account imports (#8730, contributed by @edjeffreys)

Gateways

- The legacy `$GR.` reply prefix is now reserved on client ingress, preventing clients from publishing to gateway reply subjects using that prefix (#8615)

MQTT

- Config load no longer breaks QoS1/QoS2 delivery when `max_ack_pending` is unset (#8671)
- MQTT packet lengths are validated earlier against `max_payload` (#8692)

### Complete Changes

https://github.com/nats-io/nats-server/compare/v2.14.7...v2.14.8