nacos

Nacos 2.5.5 Release Notes

Nacos 2.5.5 is mainly a bugfix and experience-improvement release for the 2.x series.

This release focuses on:

• Hardening server disk paths and active HTTP health checks.
• Preventing service instance loss during full cluster restarts.
• Fixing gRPC frame corruption while preserving Java 8 compatibility.
• Improving HTTP request handling and cluster member consistency.

Detailed changes in this release:

Enhancement/Refactor

• #15809 Harden server disk path validation for Config storage, local TPS rules, and ZIP extraction to prevent access outside intended directories.
• #15828 Harden active HTTP health checks by validating request targets and custom headers and restricting checks to the registered instance target.

BugFix

• #15857 Fix permanent service instance loss during full cluster restarts by excluding connection-based clients from Distro snapshots that can overwrite new registrations.
• #15865 Fix controller method lookup for HTTP HEAD requests by resolving them to the corresponding GET mappings.
• #15951 Fix inconsistent cluster member hashing by aligning hashCode() with the address-based comparison used by equals().

Dependencies

• #15936 Upgrade gRPC to 1.78.0 to fix frame corruption causing false message-size and mid-frame end-of-stream errors, while retaining Guava 33.3.1-android for Java 8 compatibility.

Upgrade Notes

This release strengthens validation for disk paths and active HTTP health checks. Before upgrading, review the following configurations:

• Config identity fields must not be exactly . or ... Local TPS rule names must be valid file names without path separators or directory traversal components.
• HTTP health-check targets must use relative URI references, such as /health with optional query parameters, without a scheme, authority, or fragment. Custom headers must be valid and must not include Content-Length or Transfer-Encoding.

Existing HTTP health checks that fail the new validation are skipped without sending requests or changing instance health status. Update affected configurations to restore health checking.

Deployments using valid identifiers and health-check configurations require no changes for these validation updates.

Java Version Requirements

Nacos 2.5.5 retains the Java 8 baseline used by the 2.x series.

Full Changelog: https://github.com/alibaba/nacos/compare/2.5.4...2.5.5

Nacos 3.3.0-RC is a release candidate for the Nacos 3.3 feature iteration. It builds on 3.3.0-BETA with expanded AI Registry capabilities, DNS service discovery, and further security and compatibility improvements.

This release focuses on:

• Protocol-neutral Agent management and RAD discovery, including transport negotiation and Watch/Push.
• Shared AI resource search and unified MCP lifecycle management.
• DNS-based service discovery and Config SDK improvements.
• Authentication enabled by default, migration safeguards, and runtime stability.

The main feature updates include:

• Agent registration, endpoint publication, discovery, Java SDKs, and Console management, with a migration path for historical A2A data.
• Search and discovery across Agent, AgentSpec, Skill, Prompt, and MCP resources, including shared indexes and artifact retrieval.
• MCP draft, review, publish, online/offline, and visibility management while retaining existing serving contracts.
• Optional DNS A-record queries over UDP and TCP.

The release also retains BETA's dynamic plugin management, distributed locks, Jackson 2/3 support, and Spring Boot 4 compatibility. It includes further fixes across Config, Naming, Console, clients, AI storage, and authorization.

These notes are cumulative for 3.3.0 and include the changes documented in 3.3.0-BETA.

Detailed changes in this release:

Feature

• #50 Add optional DNS service discovery with A-record queries over UDP and TCP.
• #14466 Add a neutral JSON adapter with Jackson 2 and Jackson 3 runtime support.
• #14804 Add protocol-neutral Agent lifecycle management, Console workflows, RAD discovery, runtime endpoints, transport negotiation, Watch/Push, and Java SDKs.
• #15279 Add distributed reentrant and non-reentrant locks with watchdog renewal, FIFO waiting, gRPC notifications, Raft consistency, and a Java Lock SDK.
• #15471 Support SkillSpector as an AI publish pipeline.
• #15475 Add unified dynamic plugin configuration, lifecycle management, runtime updates, deterministic discovery, and Console configuration workflows.
• #15476#15604 Add plugin-owned visibility grant and revoke APIs and Console management for Skill and AgentSpec resources.
• #15541 Add Agentic Resource Discovery with search, exploration, artifact retrieval, visibility filtering, persistent indexes, and hybrid keyword and vector retrieval.
• #15640 Support Nacos server deployments on Linux RISC-V with RocksDB.
• #15761 Add shared MCP lifecycle management with drafts, review, publish, online/offline operations, visibility, Java SDKs, and historical reconciliation while preserving existing Config/Naming serving data.

Enhancement/Refactor

• #8354 Replace the mandatory Prometheus client dependency with a pluggable client metrics SPI and a no-op default.
• #12064 Support configuring the gRPC port offset through individual client properties.
• #12734 Add request/result-based Config SDK methods, encrypted Config CAS publishing, and conditional queries with local cache reuse.
• #13690 Log the resolved client logging configuration and include namespace IDs in subscription logs.
• [#14804](https://github.com/alibaba/nacos

Nacos 3.2.4 is mainly a bugfix, security-hardening, and experience-improvement release for the 3.2 series.

This release focuses on:

• Strengthening JRaft, HTTP/gRPC authorization, embedded database, login, active health check, and MCP import security.
• Fixing standalone Console, Prompt visibility, Config history, listener state, and MCP tool authentication issues.
• Improving Config detail, edit, and history page usability.

For cluster and API operators, this release also:

• Adds server-identity authentication to native JRaft gRPC traffic with rolling-upgrade-aware enforcement.
• Disables selected deprecated v3 AI APIs by default and provides a temporary compatibility switch.
• Adds an allowlist policy for MCP tool imports from private or local targets.

Detailed changes in this release:

Feature

• #15687 Add server-identity authentication to native JRaft gRPC traffic with rolling-upgrade-aware enforcement.

Enhancement/Refactor

• #14817 Add a shared, disabled-by-default compatibility gate for deprecated Pipeline and MCP import APIs.
• #15661 Harden distributed embedded database result resolution to supported scalar types and registered row mappers.
• #15688 Refactor controller context-path URI parsing for consistent route matching.
• #15695 Improve Config detail, edit, and history layouts with compact metadata and a full-screen content view.
• #15712 Harden active health checks by validating target addresses and disabling unsafe MySQL JDBC options.
• #15749 Add configurable outbound access control for MCP tool imports, allowing public targets and allowlisted private or local targets.

BugFix

• #15475 Fix caller identity forwarding from a standalone Console so the Server enforces caller-specific RBAC.
• #15476 Fix Prompt visibility enforcement for list, detail, version, download, and Client read paths.
• #15560 Fix MCP tool passthrough authentication being lost after publishing from the Console.
• #15634 #15563 Fix authorization metadata and resource parsing across Admin, HTTP/gRPC, Prometheus, and AgentSpec APIs.
• #15660 Fix standalone Console startup failure caused by a missing Config clone permission checker bean.
• #15682 Prevent username enumeration by normalizing login failure responses.
• #15701 Fix Config history next-record queries on Derby and apply gray-name filtering correctly.
• #15724 Preserve the namespace filter when aggregating listener-by-IP state across cluster members.

Breaking Change Notice

Nacos 3.2.4 changes the default behavior of deprecated AI APIs and private MCP tool imports, and introduces an irreversible JRaft authentication enforcement transition.

Affected users:

• Users calling the deprecated Pipeline list/detail or legacy MCP import APIs. These APIs now return HTTP 410 Gone by default.
• Console operators importing MCP tools from private or local addresses. These targets now require an administrator-managed allowlist.
• Clusters attempting a mixed-version rolling downgrade after all members have enabled JRaft authentication enforcement.

Recommended upgrade path:

• Migrate to the canonical Pipeline and /v3/console/ai/import/* APIs. If additiona

Nacos 2.5.4 is mainly a bugfix, security for the 2.x series.

Detailed changes in this release:

BugFix

[#15661] Harden distributed database query result resolution. [#15712] Fix active health check target address validation.

Java Version Requirements

Full Changelog: https://github.com/alibaba/nacos/compare/2.5.3...2.5.4