Skip to content

Conversation

renovate[bot]
Copy link

@renovate renovate bot commented Jun 2, 2025

This PR contains the following updates:

Package Change Age Confidence
github.com/nats-io/nats.go v1.15.0 -> v1.46.1 age confidence

Release Notes

nats-io/nats.go (github.com/nats-io/nats.go)

v1.46.1

Compare Source

Changelog

FIXED
  • JetStream:
    • Add omitempty to AllowMsgTTL and AllowMsgCounter (#​1947)
Complete Changes

v1.46.0

Compare Source

Changelog

Overview

This release enables features introduced in [email protected].

Some features, while enabled in the client by adding relevant configuration, have APIs exposed in synadia-io/orbit.go, namely:

ADDED
  • JetStream:
    • Stream counters configuration option (#​1932, #​1939)
    • New fields in ClusterInfo (#​1935)
    • AllowAtomicPublish stream configuration option (#​1940)
    • PersistMode stream config option for configurable stream persistence settings (#​1943)
    • AllowMsgSchedules stream configuration option to enable message scheduling (#​1942)
    • Context and timeout options to Messages.Next() plus Fetch context support (#​1938)
    • Support custom name prefix for ordered consumers (#​1928)
    • Prioritized priority policy (#​1937)
  • KeyValue:
    • Added KeyValue bucket metadada support (#​1944)
IMPROVED
  • JetStream:
    • Add max consumers limit error (code=10026). Thanks @​Arlet2 for the contribution (#​1922)
    • Return more specific cons info error on ordered consumer recreation (#​1931)
Complete Changes

v1.45.0

Compare Source

Changelog

ADDED
  • Core NATS:
    • Handling for maximum account active connections exceeded (#​1921)
  • JetStream:
    • WithExpectLastSequenceForSubject publish option (#​1920)
FIXED
  • Core NATS:
    • Track delivered count and auto-unsubscribe for channel subscriptions (#​1913)
    • Clear status listeners map on SubscriptionClosed event to prevent race condition (#​1914)
    • Call ReconnectErrHandler for initial connection failures with RetryOnFailedConnect (#​1915)
  • JetStream:
    • CreateOrUpdateStream preserves domain prefix during updates (#​1917)
    • Handle empty response when creating a consumer (#​1912)
IMPROVED
  • KeyValue:
    • Add test checking KV TTL watcher updates (#​1916)
Complete Changes

v1.44.0

Compare Source

Changelog

Overview

This PR adds a PushConsumer implementation to jetstream, allowing easier migration to new API while maintaining usage of push consumers. For now it only supports the callback-based Consume(), more consuming options will be added in future releases.

ADDED
  • Core NATS:
    • UserCredentialBytes() Conn option (#​1877)
  • JetStream:
    • PushConsumer implementation in jetstream package
    • Expose ClientTrace in JetStreamOptions (#​1886)
  • Service API:
    • Expose WithEndpointPendingLimits option (#​1899)
  • Legacy KeyValue:
    • Error() method to KeyLister and KeyWatcher interfaces (#​1889)
FIXED
  • Core NATS:
    • Fix timeoutWriter not recovering after first error (#​1896)
  • JetStream:
    • Consumer.Next() hangs after connection is closed (#​1883)
    • Fixed stream info request for strict mode (#​1887)
    • Ordered consumer not closing on connection close (#​1885)
    • Return a more appropriate error when Subject Transform is not supported (#​1416)
    • Fix subject transform comparison. Thanks @​erikmansson for the contribution (#​1907)
  • Legacy JetStream:
    • Use timeout from JetStreamContext if no deadline is set on ctx (#​1909)
  • KeyValue:
    • Keys() and ListKeys() returning duplicates (#​1884)
    • Fix subject prefix for the Create/Update operation in KV store. Thanks @​SalvaChiLlo for the contribution (#​1903)
CHANGED
  • Change DefaultSubPendingMsgsLimit (#​998)
Complete Changes

v1.43.0

Compare Source

Changelog

ADDED
  • Core NATS:
    • Add nc.LocalAddr, similar to nc.ConnectedAddr (#​1877)
FIXED
  • Service API:
    • Fix stopping service not unsubscribing from all endpoints. Thanks @​arunsworld for the contribution (#​1872)
    • Remove fmt.Println from Service.Stop() (#​1880)
  • Legacy KeyValue:
    • Fix possible race setting timer in kv.WatchFiltered (#​1879)
Complete Changes

v1.42.0

Compare Source

Changelog
Overview

This release adds per-key TTL functionality to key-value stores. It adds:

  1. LimitMarkerTTL config option to enable automatic tombstone deletion.
  2. KeyTTL option to kv.Create()
  3. PurgeTTL() option to kv.Purge()
ADDED
  • KeyValue:
    • Added KeyValue per key TTL support and limit markers (#​1864)
Complete Changes

v1.41.2

Compare Source

Changelog

ADDED
  • Core NATS:
    • Add nc.RemoveStatusListener() method (#​1856)
FIXED
  • Legacy JetStream:
    • Fix Fetch and FetchBatch memory leak (#​1856)
  • Legacy KeyValue:
    • Use context in when purging stream in kv.PurgeDeletes() (#​1858)
  • Bump golang.org/x/crypto to fix vulnerability (#​1857)
Complete Changes

v1.41.1

Compare Source

Changelog

FIXED
  • ObjectStore:
    • Use default timeout for ObjectStore.Get when no deadline is set on ctx (#​1850)
IMPROVED
  • Remove golang.org/x/text dependency (#​1849)
Complete Changes

v1.41.0

Compare Source

Changelog

Overview

This release adds consumer priority groups to JetStream, exposing overflow and pinning policies. For more information on consumer priority groups, see ADR-42.

Added
  • JetStream:
    • Consumer priority groups with pinned and overflow policies (#​1826)
    • WithDefaultTimeout option for JetStream API requests (#​1843)
Fixed
  • KeyValue:
    • Ensure timer is stopped when watcher is stopped (#​1838)
  • ObjectStore:
    • Ensure object watcher stop closes the updates channel (#​1844)
  • Core NATS:
    • Data race when reading current status in sub.StatusChanged and nc.StatusChanged (#​1841)
    • Reset channel after closing in ForceReconnect to avoid panic on subsequent ForceReconnect calls (#​1842, #​1846)
Changed
Improved
  • Legacy JetStream:
    • Cancel Fetch and FetchBatch on reconnect (#​1840)
  • JetStream:
    • Invalid default in documentation for OrderedConsumerConfig.InactiveThreshold (#​1845)
  • KeyValue:
    • Stop the watcher before performing the purge operations for PurgeDeletes (#​1839)
Complete Changes

v1.40.1

Compare Source

Changelog

Overview

This release fixes an issue in legacy JetStream Subscribe which did not respect user-set context when creating a consumer.

FIXED
  • Legacy JetStream:
    • Set context from option when creating consumer in js.Subscribe (#​1835)
Complete Changes

v1.40.0

Compare Source

Changelog

Overview

This release focuses on adding support for new features from NATS Server v2.11.0. This includes:

  • Per message TTLs
  • Consumer pause and resume

Batch direct get will be released in orbit. Support for consumer priority groups will be added in the next minor release.

Added
  • JetStream:
    • Pause and resume JetStream consumer. Thanks @​yordis for the contribution (#​1571)
    • Per message TTL option for JetStream publish (#​1825)
    • Timeout option for async publish (#​1819)
  • Service API
    • Support for disabling queue groups at service, group, and endpoint levels (#​1797)
  • Core NATS:
    • ReconnectErrCB for handling failed reconnect attempts in a callback. Thanks @​sschleemilch for the contribution (#​1804)
Fixed
  • JetStream
    • Invalid subscription on ordered consumer in leaderless cluster (#​1808)
    • Ordered consumer not restarting on no responders (#​1827)
    • Avoid ack id collision in PublishAsync (#​1812)
    • Possible panic in Consumer.Fetch (#​1828)
    • Use resp.Error to show NATS error in deleteMsg. Thanks @​imariman for the contribution (#​1822)
  • KeyValue
    • Deadlock when fetching keys from KV while messages are deleted/purged (#​1824)
Changed
  • Bump go version to 1.23 and update dependencies (#​1821)
Complete Changes

v1.39.1

Compare Source

Changelog

Fixed
  • KeyValue:
Improved
  • Remove stale experimental comment in Service API (#​1805)
Complete Changes

v1.39.0

Compare Source

Changelog

Overview

This release bumps the minimal go version in go.mod to 1.22.

Added
  • JetStream:
    • Added PullMaxMessagesWithBytesLimit option for Consume and Messages (#​1789)
    • Added Metadata to OrderedConsumerConfig. Thanks @​mwain for the contribution (#​1737)
    • Added JetStream.Options() and JetStream.Conn() methods to JetStream interface (#​1792)
  • KeyValue:
    • Added ListKeysFiltered for listing keys with multiple filters. Thanks @​somratdutta for the contribution (#​1711)
Fixed
  • JetStream:
    • Fixed invalid heartbeat timer for Consumer.Messages() (#​1786)
  • ObjectStore:
    • Fixed invalid error being returned from DeleteObjectStore (#​1762)
  • WebSockets:
    • Fixed protocol parsing errors with websocket compression and PONGs. Thanks @​rsafonseca for the contribution (#​1790)
  • Core NATS:
    • Protect against possible nil pointer panic (#​1771)
Changed
Improved
  • Fixed typo in JetStream docs. Thanks @​davydog187 for the contribution (#​1758)
  • Improved documentation of JetStream Consume and Messages options (#​1770)
  • Removed obsolete build tags (#​1787)
Complete Changes

v1.38.0

Compare Source

Changelog

Added
  • Core NATS:
    • Added UserInfoHandler for dynamically setting user/password (#​1713)
    • Added PermissionErrOnSubscribe option, causing SubscribeSync to return nats.ErrPermissionViolation on NextMsg() if there was a permission error (#​1728)
    • Added Msgs() method on Subscription, returning an iterator (iter.Seq2[*nats.Msg, error]) for the subscription. This method is only available for go version >=1.23 (#​1728)
  • KeyValue:
  • Added WatchFiltered method to watch for updates with multiple filters (#​1739)
Fixed
  • Core NATS:
  • JetStream:
    • Fixed PublishAsync not closing done and stall channels after failed retries (#​1719)
    • Set valid fetch sequence in ordered consumer's Fetch() and Next() after timeout (#​1705)
    • Do not overwrite ordered consumer deliver policy if start time is set (#​1742)
    • Fixed race condition in MessageBatch (#​1743)
  • Legacy JetStream:
    • Fixed race condition in MessageBatch (#​1743)
Changed
  • Legacy Jetstream:
Improved
Complete Changes

v1.37.0

Compare Source

Changelog

Added
  • JetStream:
    • CleanupPublisher method for removing internal JetStream subscription (#​1690)
    • ConsumeContext.Closed() method for waiting for consume to be closed/drained (#​1691)
Fixed
  • JetStream:
    • Fix deadlock when accessing subscriptions map on a consumer (#​1671)
    • Fix panic in OrderedConsumer (#​1686)
    • Fix setting deliver policy in Fetch() for OrderedConsumer (#​1693)
  • Legacy JetStream:
    • Change Fetch and FetchBatch client timeout to a higher value (#​1689)
Improved
  • Trim trailing slash if set on server address which can cause errors during lookup (#​1654)
  • Fixed README.md formatting. Thanks @​patrick-othmer for the contribution (#​1692)
Deprecated
  • Deprecate encoded connections (#​1674)
Complete Changes

v1.36.0

Compare Source

Changelog

Fixed
  • JetStream:
    • Set OptStartSeq correctly in OrderedConsumerConfig and simplify ordered consumer creation (#​1644, #​1645)
    • Fix invalid handling of mismatched sequence when using Messages() for ordered consumer (#​1646)
Changed
  • JetStream:
    • Remove ConsumerInfo() calls in Consume() and Messages() after reconnect (#​1643)
Improved
Complete Changes

v1.35.0

Compare Source

Changelog

Added
  • Service API:
    • Added API to read reply subject from micro.Request. Thanks @​mcosta74 for the contribution (#​1589)
  • Core NATS:
    • Added ForceReconnect method on connection for manually triggering reconnect (#​1624)
Fixed
  • KeyValue:
    • Fixed invalid DiscardPolicy being set when creating a new KeyValue store using the jetstream package. Previously created KV instances will be auto-repaired when calling CreateKeyValue (#​1616, #​1617)
  • JetStream:
    • Fixed validation for streams, consumers and KV buckets to avoid protocol errors (#​1613)
  • Core NATS:
    • Fixed ConnectedCB not being invoked when using RetryOnFailedConnect: true and the initial nats.Connect fails (#​1619)
Improved
  • Core NATS:
    • Remove unnecessary allocations from readMIMEHeader (#​1609)
  • KeyValue:
  • Legacy JetStream:
Complete Changes

v1.34.1

Compare Source

Changelog

Fixed
  • JetStream:
    • Fixed async publish error handling on disconnect (#​1592)
    • Fixed race condition in Fetch and FetchBatch when using heartbeats (#​1601)
Complete Changes

v1.34.0

Compare Source

Changelog

Added
  • Core NATS:
    • StatusChanged method for subscription event notifications (#​1570)
    • ClientTLSConfig option for setting TLS config with callbacks in Connect (#​1413)
Fixed
  • Object Store:
    • Add missing Compression struct tag (#​1559)
  • Legacy JetStream:
    • Fetch and FetchBatch will no longer publish a pull request if the subscription is closed or draining (#​1582)
  • Service API:
Improved
Complete Changes

v1.33.1

Compare Source

Changelog

Overview

This release fixes v1.33.0 release which was re-released with different tag, causing checksum mismatch when running go get github.com/nats-io/[email protected].

Complete Changes

v1.33.0

Compare Source

Changelog

Overview

This release introduces significant documentation improvements across jetstream package components (JetStream, Object Store, and KeyValue).

Added
  • JetStream:
    • TermWithReason method on JetStream message (#​1539)
    • Timestamp fields on stream and consumer infos (#​1540)
    • FetchHeartbeat option for Fetch and FetchBytes (#​1548)
  • Object Store:
    • Compression option for object store. Thanks to @​johbar for the contribution (#​1544)
    • UpdateObjectStore and CreateOrUpdateObjectStore methods (#​1550)
  • KeyValue:
    • UpdateKeyValue and CreateOrUpdateKeyValue methods (#​1549)
Fixed
  • JetStream:
    • Fixed Drain() infinite loop and add test for concurrent Next() calls. Thanks to @​mdawar for the contribution (#​1525)
    • Fixed race condition when resetting ordered consumer (#​1526)
  • Object Store:
    • Fixed hardcoded read deadline when reading an object (#​1531)
Improved
Complete Changes

v1.32.0

Compare Source

Changelog

Added
  • JetStream:
    • ObjectStore is now available as part of jetstream package (#​1450)
    • Drain method for ConsumeContext and MessagesContext. Unlike Stop(), in addition to unsubscribing and canceling the existing pull requests it will ensure that all messages already stored in client buffer will be available for processing (#​1515)
    • Return account reservations on AccountInfo. NOTE: This is only available since nats-server@​v2.10.8 (#​1511)
    • Paging Subjects on Stream.Info() response when WithSubjectFilter() option is used (#​1517)
  • KeyValue:
    • Compression option on KeyValueConfig (#​1451)
    • ListKeys method for efficiently iterating over all keys in KV bucket (#​1490)
    • ResumeFromRevision option for KV watcher. Thanks to @​shadow3x3x3 for the contribution (#​1489)
Fixed
  • Legacy JetStream:
    • Fixed and issue where ordered consumer was recreated with different name format than the original (#​1449)
  • JetStream:
    • Fixed an issue where WithRetryAttempts() and WithRetryWait() options were ignored in PublishAsync() (#​1464)
    • Fixed invalid PullExpiry validation in Consumer.Messages() options (#​1468)
    • Fixed race condition on Stop() method for ConsumeContext and MessagesContext . Thanks to
      @​evanofslack for the contribution (#​1454)
    • Fixed issues with Next() method for ordered consumers (#​1471, #​1472)
    • Fixed ignoring a private inbox prefix in JetStream.Publish(). Thanks to @​oderwat for the contribution (#​1474)
    • Fixed invalid PAF id for PublishAsync() (#​1476)
    • Fixed race condition when getting pull subscriptions in ordered consumer (#​1497)
    • Fixed several issues in checkPending logic (#​1516)
  • KeyValue:
    • Removed KV_ prefix when listing KeyValue store names (#​1487)
  • Service API:
    • Fixed race condition when adding endpoints concurrently. Thanks to @​actatum for the contribution (#​1484)
Improved
  • Bumped nkeys and compress dependencies to latest versions (#​1458, #​1514)
  • Fixed broken link in jetstream/README.md. Thanks to @​sebbbastien for the contribution (#​1448)
  • Improvements for code quality across the library. Thanks to @​sashamelentyev for the contribution (#​1498, #​1500)
  • Legacy JetStream:
    • Library now attempts to delete ordered consumer before creating new one to avoid piling up consumers on reset (#​1449)
  • Service API:
    • Added compatibility tests for Service API (#​1443)
Complete Changes

v1.31.0

Compare Source

Changelog

Added
  • Core NATS:
    • TLSHandshakeFirst option to perform TLS handshake before receiving the INFO protocol message. Note: This option is not yet available in nats-server (#​1433)
  • JetStream:
    • CreateOrUpdateStream helper function to create a stream if it does not exist or update an existing stream. Thanks to @​samanebi for the contribution (#​1395)
Fixed
  • Test (dev) dependencies are no longer added to go.mod when using nats.go. Thanks to @​masumomo for the contribution (#​1441)
  • JetStream:
    • Panic on Consumer.Info() when empty response and errors are returned (#​1426)
    • Invalid handling of heartbeats in Consume and Messages (#​1428)
    • Properly recreating ordered consumers on server restart (#​1425)
  • Legacy JetStream:
    • Panic on ConsumerInfo() when empty response and errors are returned (#​1426)
Improved
Complete Changes

v1.30.2

Compare Source

Changelog

Fixed
  • JetStream:
    • Fixed backwards compatibility issue when creating streams with sources on nats-server 2.9.x (#​1420)
Complete Changes

v1.30.1

Compare Source

Changelog

Fixed
  • JetStream:
    • Fixed validation on nats.PullHeartbeat() causing pull heartbeat not being validated against deadline from nats.Context() (#​1414)
Complete Changes

v1.30.0

Compare Source

Changelog

Overview

This release focuses on adding features introduced in nats-server@​v2.10.0. Among other things, this includes setting multiple filter subjects for a consumer, configuring stream subject transform, as well as setting stream and consumer metadata.

Added
  • JetStream:
    • SubjectTransform support on streams (#​1200)
    • SubjectTransforms on mirrors and sources (#​1359, #​1404)
    • Multiple subject filters on consumers (#​1214)
    • Setting Compression type on StreamConfig (#​1405)
    • Setting FirstSeq on StreamConfig (#​1405)
    • Setting ConsumerLimits on StreamConfig (#​1405)
    • CreateConsumer and UpdateConsumer methods (#​1379)
    • Support for stream and consumer metadata (#​1384)
  • ObjectStore:
    • Support for object store and object metadata (#​1385)
  • Service API (micro):
    • Customizing queue groups per service, group and endpoint (#​1401)
  • Legacy JetStream:
    • SubjectTransform support on streams (#​1200)
    • SubjectTransforms on mirrors and sources (#​1359)
    • Multiple subject filters on consumers (#​1214)
    • Setting Compression type on StreamConfig (#​1405)
    • Setting FirstSeq on StreamConfig (#​1405)
    • Setting ConsumerLimits on StreamConfig (#​1405)
    • Setting heartbeats in Fetch and FetchBatch in legacy API (#​1402)
Complete Changes

v1.29.0

Compare Source

Changelog

Overview

With this release, Object Store is out of experimental preview. Additionally, jetstream package now supports KeyValue stores. Object store will be added to jetstream in future release.

Added
  • JetStream:
    • KeyValue is now available as part of jetstream (#​1362)
  • KeyValue:
    • UpdatesOnly option for KV watchers (#​1378)
  • ObjectStore:
    • UpdatesOnly option for object store watchers (#​1377)
  • Core NATS:
    • Invoke ErrorHandler() on preparing connection string when reconnecting (#​1397)
Improved
Changed
  • ObjectStore:
    • Remove experimental notice from object store (#​1399)
  • Core NATS:
    • Use default value for FlusherTimeout instead of 0 (#​1398)
Fixed
  • JetStream:
    • Fixed deadlock when acknowledging a message which was previously acknowledged. Thanks @​Zamony for the contribution (#​1364)
  • Service API (micro):
    • Fixed possible panic in custom error handlers (#​1371)
  • Legacy JetStream:
    • Fixed ordered consumer not being recreated after context timeout (#​1360)
Complete Changes

v1.28.0

Compare Source

Changelog

Overview

This release focuses on a set of changes and improvements in new JetStream API. With this release, JetStream API is out of preview.
Additionally, with this release support for go version < 1.18.0 is dropped, due to usage of any type in codebase.

Added
  • JetStream:
    • HeadersOnly field on OrderedConsumerConfig (#​1327)
    • WithStreamListSubject() option to filter results of ListStreams() and StreamNames() by stream name (#​1312)
Improved
  • Added dev and main branches of nats-server to tests in CI (#​1336)
  • Core NATS:
  • JetStream:
    • Fix typos and doc comments in new JetStream API. Thanks @​mdawar for the contribution (#​1339)
    • Fixed and slightly enhanced the basic example in jetstream package. Thanks to @​pwntr for the contribution (#​1340)
    • Improvements in in jetstream/README.md (#​1347, #​1350)
Changed
  • Replace interface{} with any across the codebase (#​1332)
  • JetStream:
    • [BREAKING CHANGE] Move NakWithDelay to separate method, instead of it being an option on Nak() (#​1337)
    • [BREAKING CHANGE] Simplified API for listing streams and stream names (#​1312)
    • Add default timeout when context.Background() or context.TODO() is used (#​1348)
Fixed
  • JetStream:
    • Create consumer when calling OrderedConsumer() (#​1317)
    • Unset start time for ordered consumer on reset (#​1341)
    • Fixed Next() blocking indefinitely after calling Stop(). Thanks @​mdawar for the contribution (#​1344)
    • Invalid missing heartbeat errors in Consume() (#​1345)
    • Fixed PublishAsync() blocking published due to PublishAsyncMaxPending not being reset on reconnect (#​1346)
  • Legacy JetStream:
    • Fixed PublishAsync() blocking published due to PublishAsyncMaxPending not being reset on reconnect (#​1346)
Complete Changes

v1.27.1

Compare Source

Changelog

Improved
  • JetStream Simplified API:
    • Fixed unit from kB to B for FetchBytes() in jetstream/README.md. Thanks @​fabiant7t for the contribution! (#​1329)
    • Add param names in API interfaces to better document the code (#​1316)
Fixed
  • JetStream Simplified API:
    • Use custom inbox prefix set on nats.Conn for pull requests. Thanks @​oderwat for the contribution! (#​1322)
  • Object Store:
  • JetStream:
    • Fixed creating a consumer with Durable not set on server versions prior to 2.9.0 (#​1325)
Complete Changes

v1.27.0

Compare Source

Changelog

Overview

This release focuses on improvements to new JetStream API and Service API (micro) preview functionalities.

Added
  • JetStream Simplified API:
    • StreamNameBySubject() method for stream discovery based on provided subject (#​1292)
Improved
  • JetStream Simplified API:
    • Simplified lock handling for Consume() and Messages() (#​1303)
Changed
  • JetStream Simplified API:
    • [BREAKING CHANGE] Renamed AddConsumer to CreateOrUpdateConsumer. This change is introduced in anticipation for separation of create and update operations in nats-server (#​1300)
    • [BREAKING CHANGE] Change default AckPolicy to AckPolicyExplicit (#​1278)
    • [BREAKING CHANGE] Fixed typo in PullThresholdBytes type name (#​1300)
    • [BREAKING CHANGE] Removed push consumer only fields from ConsumerConfig (#​1300)
    • [BREAKING CHANGE] Removed context.Context from PublishAsync and PublishMsgAsync (#​1300)
  • Service API (micro):
    • [BREAKING CHANGE] More verbose endpoint INFO schema (#​1277)
      • Endpoint metadata was moved from STATS response to INFO response
      • INFO now returns endpoints object, containing subject, name and metatada. This replaces subject field.
Fixed
  • JetStream Simplified API:
  • Object Store:
    • Fixed leaking goroutines after calling Put() and PutBytes() (#​1282)
  • Flaky tests picking the used port for cluster connections (#​1284, #​1298)
  • Division by zero fixes in bechmark tests. Thanks @​Zamony fot the contribution! (#​1293)
Complete Changes

v1.26.0

Compare Source

Changelog

Overview

This release adds beta functionality of JetStream simplified API. The goal of this API is to simplify and streamline stream and consumer management, as well as leverage pull consumers for continuous message retrieval. We encourage you to give it a try and post your feedback!

You can find more details on the new API here

Added
  • JetStream Simplified API:
  • JetStream:
    • ConsumerName() subscribe option to set Name in ConsumerConfig when creating a consumer (#​1263)
    • SkipConsumerLookup() subscribe option to bypass verifying if the consumer exists before consumer creation (#​1265)
Improved
Changed
  • JetStream:
    • Generate consumer name in Subscribe() when name is not provided to leverage 2.9.0 consumer create server API (#​1261, #​1263)
  • Service API (micro):
    • Removed api_urland SCHEMA endpoint (#​1270)
    • Avoid producing nil metadata (#​1242)
  • Changed compression library for websockets (#​1259)
  • Reload client TLS certificates and Root CAs on reconnect (#​1264)
Fixed
  • Object Store
    • Fixed Put purging partial object before acks for all sent chunks were received. This caused leftover chunks to be processed after purge (#​1260)
    • Fixed issue in Read where nil was returned instead of context error (#​1260)
  • JetStream:
    • Fixed flaky TestJetStreamConcurrentQueueDurablePushConsumers test (#​1267)
  • Fixed leaking goroutines in tests (#​1268)
Complete Changes

v1.25.0

Compare Source

Changelog

Added
  • Service API (micro):
    • Support

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Copy link
Author

renovate bot commented Jun 2, 2025

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.15 -> 1.23.0

Copy link

socket-security bot commented Jun 2, 2025

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedgolang.org/​x/​net@​v0.0.0-20220513224357-95641704303c ⏵ v0.25.075 +198 +29100100100
Updatedgithub.com/​nats-io/​nats.go@​v1.15.0 ⏵ v1.46.175 -14100100100100

View full report

Copy link

socket-security bot commented Jun 2, 2025

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Block Medium
github.com/nats-io/[email protected] Uses eval.

Location: Package overview

From: ?golang/github.com/nats-io/[email protected]golang/github.com/nats-io/[email protected]

ℹ Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/nats-io/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
golang.org/x/[email protected] has Network access.

Location: Package overview

From: ?golang/golang.org/x/[email protected]golang/github.com/prometheus/[email protected]golang/github.com/Shopify/[email protected]golang/golang.org/x/[email protected]

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
golang.org/x/[email protected] has Shell access.

Location: Package overview

From: ?golang/golang.org/x/[email protected]golang/github.com/prometheus/[email protected]golang/github.com/Shopify/[email protected]golang/golang.org/x/[email protected]

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
golang.org/x/[email protected] Uses eval.

Location: Package overview

From: ?golang/golang.org/x/[email protected]golang/github.com/prometheus/[email protected]golang/github.com/Shopify/[email protected]golang/golang.org/x/[email protected]

ℹ Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
github.com/klauspost/[email protected] has Environment variable access.

Location: Package overview

From: ?golang/github.com/Shopify/[email protected]golang/github.com/segmentio/[email protected]golang/github.com/nats-io/[email protected]golang/github.com/klauspost/[email protected]

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/klauspost/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
golang.org/x/[email protected] has Filesystem access.

Location: Package overview

From: ?golang/golang.org/x/[email protected]golang/github.com/prometheus/[email protected]golang/github.com/Shopify/[email protected]golang/golang.org/x/[email protected]

ℹ Read more on: This package | This alert | What is filesystem access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
golang.org/x/[email protected] has Environment variable access.

Location: Package overview

From: ?golang/golang.org/x/[email protected]golang/github.com/prometheus/[email protected]golang/github.com/Shopify/[email protected]golang/golang.org/x/[email protected]

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@renovate renovate bot force-pushed the renovate/github.com-nats-io-nats.go-1.x branch from 712cdc1 to 6271863 Compare June 3, 2025 11:49
@renovate renovate bot changed the title fix(deps): update module github.com/nats-io/nats.go to v1.42.0 fix(deps): update module github.com/nats-io/nats.go to v1.43.0 Jun 3, 2025
@renovate renovate bot force-pushed the renovate/github.com-nats-io-nats.go-1.x branch from 6271863 to c1d998b Compare July 29, 2025 20:56
@renovate renovate bot changed the title fix(deps): update module github.com/nats-io/nats.go to v1.43.0 fix(deps): update module github.com/nats-io/nats.go to v1.44.0 Jul 29, 2025
@renovate renovate bot force-pushed the renovate/github.com-nats-io-nats.go-1.x branch from c1d998b to d4dac35 Compare August 10, 2025 14:39
@renovate renovate bot force-pushed the renovate/github.com-nats-io-nats.go-1.x branch from d4dac35 to 0fbce40 Compare August 20, 2025 14:55
@renovate renovate bot changed the title fix(deps): update module github.com/nats-io/nats.go to v1.44.0 fix(deps): update module github.com/nats-io/nats.go to v1.45.0 Aug 20, 2025
@renovate renovate bot force-pushed the renovate/github.com-nats-io-nats.go-1.x branch from 0fbce40 to f05dca2 Compare September 22, 2025 18:58
@renovate renovate bot changed the title fix(deps): update module github.com/nats-io/nats.go to v1.45.0 fix(deps): update module github.com/nats-io/nats.go to v1.46.0 Sep 22, 2025
@renovate renovate bot force-pushed the renovate/github.com-nats-io-nats.go-1.x branch from f05dca2 to 2463916 Compare September 30, 2025 19:10
@renovate renovate bot changed the title fix(deps): update module github.com/nats-io/nats.go to v1.46.0 fix(deps): update module github.com/nats-io/nats.go to v1.46.1 Sep 30, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants