Changelog | anynines Documentation

75.0.0

July 27, 2026 · 9 min read

Added

a9s Backup Services: a9s Backup Manager: Add api.max_backup_list_limit and api.max_restore_list_limit BOSH properties to configure the maximum number of items returned by the a9s Backup Manager API. Both values default to 50, with the minimum accepted value being 1 and the maximum being 1000. The Ops file backup-service-max-backup-list-limit.yml is provided for ease of configuration.
a9s MariaDB: Make the wsrep_max_ws_size MariaDB Galera parameter configurable through custom parameters. For more information, see a9s MariaDB - Custom Parameters.
a9s Search: a9s Search SPI: Allow the Platform Operator to define which plugins can be enabled by the Application Developer. This change directly impacts the plugins custom parameter.
docs: Application Developer: a9s MariaDB: Add information about the new custom parameter wsrep_max_ws_size. For more information, see a9s MariaDB - Custom Parameters.
docs: Platform Operator: a9s Backup Services: a9s Backup Manager: Document the new api.max_backup_list_limit and api.max_restore_list_limit properties, their usage, and the performance impact of increasing these limits. For more information, see a9s Backup Manager - Properties.
docs: Platform Operator: a9s MariaDB: Add information about the new custom parameter wsrep_max_ws_size. For more information, see a9s MariaDB - SPI Configuration.
docs: Platform Operator: a9s Messaging: Add information about TLS hostname verification for shovel and federation links. For more information, see a9s Messaging - Configuration and Features.

Changed

breaking change a9s Messaging: Update Erlang/OTP to 27.3.4.14, fixing CVE-2026-42790. Following RFC 9525, TLS hostname verification no longer falls back to the certificate's Common Name (CN): shovel and federation amqps:// links to brokers whose certificate does not carry the connection hostname in a SAN dNSName entry (e.g. CN-only certificates) now fail hostname verification. Wildcard SAN entries continue to be matched, as a9s Messaging enables RFC 6125/9525-compliant wildcard matching for these links. The fix also closes a name-constraints bypass, so certificates issued by a DNS-name-constrained intermediate CA for out-of-scope hostnames are now rejected as well. For more information, see UPGRADE.md.
all services: a9s Public API: Adapt the endpoint /v1/instances/:instance_id to contain allowed_update_time in its response when retrieving the Service Instance overview. For more information, see API V1 Endpoints - Instance Endpoints - Get Instance Overview.
all services: a9s Service Dashboard: Change the endpoint used to get Service Instance information from a9s Public API v0 to a9s Public API v1.
a9s Backup Monit: Reduce the number of outbound requests made to the backup storage when computing the content length of a backup. This prevents high request volumes from overwhelming firewalls.
a9s CF Service Guard: Update a9s CF Service Guard to prevent matching the details of a new Service Instance to a "deleted" Service Instance when searching across Service Brokers to mark it for synchronization.
a9s MariaDB: Update the dashboard_client.id for the a9s Public API Auth Provider and the smoke-test errand name to a supported Data Service version in the Data Service manifest.
a9s Messaging: Update the dashboard_client.id for the a9s Public API Auth Provider and the smoke-test errand name to a supported Data Service version in the Data Service manifest.
a9s MongoDB: Update the dashboard_client.id for the a9s Public API Auth Provider to a supported Data Service version in the add-mongodb-sspl.yml Ops file.
a9s PostgreSQL: Update the dashboard_client.id for the a9s Public API Auth Provider and the smoke-test errand name to a supported Data Service version in the Data Service manifest.
a9s Search: a9s Search SPI: Fix an issue where the custom parameters reset to their default in certain conditions.
a9s Search: Allow the Application Developer to configure any supported plugin that has been allowed by the Platform Operator. This change directly impacts the plugins custom parameter.
a9s Template Uploader Errand: a9s MariaDB: Extend the a9s MariaDB templates to allow adding the custom parameter wsrep_max_ws_size.
docs: Application Developer: a9s Search: Update the documentation for the plugins custom parameter to reflect the new behavior. For more information, see a9s Search - Enable Custom Plugins.
docs: Platform Operator: a9s LogMe2: Update the "Plugins" section to improve clarity on the enabled plugins. For more information, see a9s LogMe2 - Resource Considerations.
docs: Platform Operator: a9s Search: Update the documentation for the plugins custom parameter to reflect the new behavior. For more information, see a9s Search - Enable Custom Plugins.
BOSH stemcell: all services: Update Jammy stemcell to version 1.1298 for internal tests of all supported services.

Updated Dependencies

all services:
- bpm to v1.4.34.
- routing to v0.387.0.
- a9s Backup Agent: Update internal dependencies.
- a9s Bee: Update internal dependencies.
- a9s Public API:
  - Update internal dependencies.
  - Node.JS to v24.18.0.
  - a9s-beehive to v1.2.13.
  - krakend to v2.13.8.
  - krakend-custom-plugins to v2.13.8.
  - nginx to v1.31.3.
- a9s Service Dashboard:
  - Node.JS to v22.23.1.
  - Update internal dependencies.
- a9s Smoke Tests: Update internal dependencies.
- logstash to v8.19.19.
- nginx:
  - nginx to v1.31.3.
a9s-pg: Update internal dependencies.
a9s Backup Services:
- a9s Backup Manager: Update internal dependencies.
- a9s Backup Monit: Update internal dependencies.
a9s CF Service Guard: Bump Ruby gem dependencies.
a9s KeyValue: a9s KeyValue 8: valkey to v8.1.9.
a9s LogMe2:
- Update internal dependencies.
- fluentd to 1.19.3.
- OpenSearch to v2.19.6.
a9s MariaDB:
- a9s MariaDB 10.6: Update internal dependencies.
- a9s MariaDB 10.11: Update internal dependencies.
a9s Messaging:
- a9s Messaging 4:
  - erlang to v27.3.4.14.
  - RabbitMQ to 4.3.3.
  - Update internal dependencies.
a9s MongoDB:
- a9s MongoDB 8:
  - mongosh to v2.9.2.
- a9s MongoDB 7:
  - mongosh to v2.9.2.
a9s PostgreSQL:
- a9s PostgreSQL 15: Update internal dependencies.
- a9s PostgreSQL 17: Update internal dependencies.
a9s Prometheus:
- prometheus2: Update internal dependencies.
- prometheus-legacy: Update internal dependencies.
- promgraf2: Update internal dependencies.
- a9s Dashboard API:
  - Update internal dependencies.
  - Node.JS to v22.23.1.
a9s Search:
- OpenSearch to v2.19.6.

Deprecated

a9s MariaDB: Deprecation: Deprecate the following a9s Data Service version:
- a9s MariaDB 10.6: MariaDB 10.6 is end-of-life by their vendor since July 2026
Please ensure that you organize the migration of your existing Service Instances to a more up-to-date version of the same a9s Data Service:
- for a9s MariaDB 10.6: a9s MariaDB 10.11 is available as GA version.
This deprecation follows the announcement in v73.0.0. The deprecation phase is planned to last until v78.0.0 (expected end of October 2026), in which the unsupport phase of the deprecated version will start. The creation of new a9s Data Service Instances for this particular version will then be disabled by default in the a9s Data Service Bundle when the unsupport occurs in v81.0.0 (expected end of January 2027) and we will not provide regular support for this version. The corresponding documentation will also be removed. Therefore, we strongly recommend that you start your migrations to a supported GA version as soon as possible and complete them until the end of the deprecation phase. For more information see a9s Platform Operator - Sunrise Sunset.

Fixed

a9s Search: Fix an installation issue in the analysis-phonetic plugin.

Security

all services:
- a9s Bee:
  - Fix CVE-2026-33811.
  - Fix CVE-2026-33814.
  - Fix CVE-2026-39820.
  - Fix CVE-2026-39822.
  - Fix CVE-2026-39829.
  - Fix CVE-2026-39830.
  - Fix CVE-2026-39831.
  - Fix CVE-2026-39832.
  - Fix CVE-2026-39833.
  - Fix CVE-2026-39834.
  - Fix CVE-2026-39836.
  - Fix CVE-2026-42499.
  - Fix CVE-2026-42501.
  - Fix CVE-2026-42508.
  - Fix CVE-2026-46595.
  - Fix CVE-2026-46597.
- a9s Public API:
  - Fix CVE-2026-33811.
  - Fix CVE-2026-33814.
  - Fix CVE-2026-39820.
  - Fix CVE-2026-39822.
  - Fix CVE-2026-39836.
  - Fix CVE-2026-42499.
  - Fix CVE-2026-42501.
- a9s Service Dashboard:
  - Fix CVE-2026-9277.
  - Fix CVE-2026-12143.
  - Fix CVE-2026-48619.
  - Fix CVE-2026-48779.
  - Fix CVE-2026-48930.
  - Fix CVE-2026-48933.
- a9s Smoke Tests:
  - Fix CVE-2026-33811.
  - Fix CVE-2026-33814.
  - Fix CVE-2026-39820.
  - Fix CVE-2026-39822.
  - Fix CVE-2026-39829.
  - Fix CVE-2026-39830.
  - Fix CVE-2026-39831.
  - Fix CVE-2026-39832.
  - Fix CVE-2026-39833.
  - Fix CVE-2026-39834.
  - Fix CVE-2026-39836.
  - Fix CVE-2026-42499.
  - Fix CVE-2026-42501.
  - Fix CVE-2026-42508.
  - Fix CVE-2026-46595.
  - Fix CVE-2026-46597.
  - Improve measures to prevent credential leakage in the Smoke Tests logs.
- a9s SSO Proxy: Fix a reflected cross-site scripting (XSS) vulnerability in the SSO proxy authentication failure page.
- nginx:
  - Fix CVE-2026-42533.
  - Fix CVE-2026-60005.
a9s-pg:
- Fix CVE-2026-11822.
- Fix CVE-2026-11824.
- Fix CVE-2026-33811.
- Fix CVE-2026-33814.
- Fix CVE-2026-39820.
- Fix CVE-2026-39822.
- Fix CVE-2026-39829.
- Fix CVE-2026-39830.
- Fix CVE-2026-39831.
- Fix CVE-2026-39832.
- Fix CVE-2026-39833.
- Fix CVE-2026-39834.
- Fix CVE-2026-39836.
- Fix CVE-2026-42499.
- Fix CVE-2026-42501.
- Fix CVE-2026-42508.
- Fix CVE-2026-46595.
- Fix CVE-2026-46597.
a9s LogMe2:
- Fix CVE-2026-34477.
- Fix CVE-2026-34478.
- Fix CVE-2026-34480.
- Fix CVE-2026-44024.
- Fix CVE-2026-44025.
- Fix CVE-2026-44160.
- Fix CVE-2026-44161.
a9s MariaDB:
- a9s MariaDB 10.6: Fix CVE-2026-39822.
- a9s MariaDB 10.11: Fix CVE-2026-39822.
a9s Messaging:
- a9s Messaging 4:
  - Fix CVE-2026-33811.
  - Fix CVE-2026-33814.
  - Fix CVE-2026-39820.
  - Fix CVE-2026-39822.
  - Fix CVE-2026-39836.
  - Fix CVE-2026-42499.
  - Fix CVE-2026-42501.
  - Fix CVE-2026-42790.
  - Fix CVE-2026-49759.
a9s PostgreSQL:
- a9s PostgreSQL 15:
  - Fix CVE-2026-11822.
  - Fix CVE-2026-11824.
  - Fix CVE-2026-33811.
  - Fix CVE-2026-33814.
  - Fix CVE-2026-39820.
  - Fix CVE-2026-39822.
  - Fix CVE-2026-39829.
  - Fix CVE-2026-39830.
  - Fix CVE-2026-39831.
  - Fix CVE-2026-39832.
  - Fix CVE-2026-39833.
  - Fix CVE-2026-39834.
  - Fix CVE-2026-39836.
  - Fix CVE-2026-42499.
  - Fix CVE-2026-42501.
  - Fix CVE-2026-42508.
  - Fix CVE-2026-46595.
  - Fix CVE-2026-46597.
- a9s PostgreSQL 17:
  - Fix CVE-2026-11822.
  - Fix CVE-2026-11824.
  - Fix CVE-2026-33811.
  - Fix CVE-2026-33814.
  - Fix CVE-2026-39820.
  - Fix CVE-2026-39822.
  - Fix CVE-2026-39829.
  - Fix CVE-2026-39830.
  - Fix CVE-2026-39831.
  - Fix CVE-2026-39832.
  - Fix CVE-2026-39833.
  - Fix CVE-2026-39834.
  - Fix CVE-2026-39836.
  - Fix CVE-2026-42499.
  - Fix CVE-2026-42501.
  - Fix CVE-2026-42508.
  - Fix CVE-2026-46595.
  - Fix CVE-2026-46597.
a9s Prometheus:
- prometheus2: Fix CVE-2026-39822.
- prometheus-legacy: Fix CVE-2026-39822.
- promgraf2: Fix CVE-2026-39822.
- a9s Dashboard API:
  - Fix CVE-2026-48619.
  - Fix CVE-2026-48930.
  - Fix CVE-2026-48933.
a9s Search:
- Fix CVE-2026-34477.
- Fix CVE-2026-34478.
- Fix CVE-2026-34480.

74.0.0

June 24, 2026 · 5 min read

Added

docs: Application Developer: all services: Add admonitions to highlight the limitations of backups and restores of stopped Service Instances. For more information, see a9s Service Dashboard.
docs: Application Developer: all services: Add an admonition to highlight the limitation of manual updates for stopped Service Instances. For more information, see a9s Service Dashboard - Update Service Instance.
docs: Application Developer: all services: Add known limitations about backups and restores to the documentation of the Stop/Start feature. For more information, see Stop/Start Feature - Known Limitations.
docs: Application Developer: all services: Add known limitations about manual updates to the documentation of the Stop/Start feature. For more information, see Stop/Start Feature - Known Limitations.
docs: Application Developer: a9s Public API: Add admonitions to highlight the limitations of backups, restores and updates for stopped Service Instances in the API V1 Endpoints documentation. For more information, see API V1 Endpoints.
docs: Platform Operator: Add a section to highlight the behavior of updates for stopped Service Instances in the documentation of known limitations for Maintenance Updates. For more information, see Maintenance Updates - Known Limitations
docs: Platform Operator: a9s Service Broker: Add known limitations about manual updates to the documentation of the Stop/Start feature. For more information, see Stop/Start Feature - Known Limitations.

Changed

breaking change all services: a9s Logstash 8: Add internal queues to syslog and graphite output plugins. It now drops messages when the configured output service cannot empty the queue fast enough. This will ensure that Logstash will not block any output when a service has reached its limit.
all services: a9s Public API: Make the platform property optional in the ops/enable-stop-start-feature.yml Ops file.
all services: a9s Service Broker: Extend the ServiceUsage API of the a9s Service Broker, so that when the strategy=transform is used, the usage events that are returned have entity.event_type set to service_broker. Other strategies keep entity.event_type as service_instance.
a9s Backup Manager: Improve backup queue handling to reduce the risk of stuck backups.
a9s MariaDB: The Galera Healthcheck post-start script now blocks the task's lifecycle until the node's Consul DNS entry is resolvable.
a9s PostgreSQL: a9s PostgreSQL SPI: Sanitize logs, and streamline them into one file, to prevent sensitive connection details from appearing in log output, as a security hardening measure.
docs: Application Developer: all services: Highlight the expected behavior of the metrics and alerts for stopped Service Instances in the documentation of the Stop/Start feature. For more information, see Stop/Start Feature - Expected Behavior.
docs: Application Developer: a9s MariaDB: Update documentation to fix minor issues and improve readability. For more information, see: a9s MariaDB - Forking and Migration.
docs: Application Developer: a9s PostgreSQL: Add an admonition to highlight the expected behavior of metrics for stopped Service Instances. For more information, see a9s PostgreSQL - Metrics.
docs: Platform Operator: all services: Add an admonition to highlight the limitations of metrics and alerts for stopped Service Instances. For more information, see Data Services - Metrics.
docs: Platform Operator: a9s Service Broker: Update the documentation to extend the paragraph to enable or disable the Stop/Start feature. For more information, see Stop/Start Feature - Enable or Disable.
BOSH stemcell: all services: Update Jammy stemcell to version 1.1250 for internal tests of all supported services.

Updated Dependencies

all services:
- bpm to v1.4.33.
- routing to v0.385.0.
- a9s Public API:
  - krakend-custom-plugins to v2.13.7.
  - krakend to v2.13.7.
  - nginx to v1.31.2.
- nginx:
  - nginx to v1.31.2.
a9s KeyValue: a9s KeyValue 8: valkey to v8.1.8.
a9s MariaDB:
- a9s MariaDB 10.6:
  - mariadb to v10.6.27.
  - golang to 1.26.
- a9s MariaDB 10.11:
  - mariadb to v10.11.18.
a9s Messaging:
- a9s Messaging 4:
  - RabbitMQ to 4.3.2.
a9s MongoDB:
- a9s MongoDB 5:
  - mongodb to v5.0.34.
- a9s MongoDB 7:
  - mongodb to v7.0.37.
- a9s MongoDB 8:
  - mongodb to v8.0.26.
a9s Prometheus:
- prometheus2:
  - stackdriver_exporter to v0.19.0.
  - alertmanager to v0.33.0.
  - statsd_exporter to v0.30.0.
- prometheus-legacy:
  - stackdriver_exporter to v0.19.0.
  - alertmanager to v0.33.0.
  - statsd_exporter to v0.30.0.
- promgraf2:
  - stackdriver_exporter to v0.19.0.
  - alertmanager to v0.33.0.
  - statsd_exporter to v0.30.0.

Removed

breaking change docs: Application Developer: a9s PostgreSQL: Remove the documentation on the use of CREATEDB as a configuration parameter for a9s PostgreSQL due to the limitations in the use of custom databases. Since the a9s Data Services' automation is not aware of the custom databases, the desired level of support cannot be expected for custom databases. For more information, see a9s PostgreSQL - Custom Parameters - Role Privileges.
breaking change docs: Platform Operator: a9s PostgreSQL: Remove the documentation on the use of CREATEDB as a configuration parameter for a9s PostgreSQL due to the limitations in the use of custom databases. Since the a9s Data Services' automation is not aware of the custom databases, the desired level of support cannot be expected for custom databases. For more information, see a9s PostgreSQL - SPI Configuration - Role Privileges.
a9s Billing: Remove unneeded job and its related dependencies.

Fixed

a9s Backup Services: a9s Backup Manager: Block restore requests when a backup is in progress on the Service Instance, and respond with 409 ConcurrencyError. This prevents restores from failing inside the Backup Agent's info call, which previously left the restore in a bad state.

Security

a9s MariaDB:
- a9s MariaDB 10.6:
  - Fix CVE-2026-49261.
  - Fix CVE-2026-48163.
  - Fix CVE-2026-48165.
- a9s MariaDB 10.11:
  - Fix CVE-2026-49261.
  - Fix CVE-2026-48163.
  - Fix CVE-2026-48165.
a9s MongoDB:
- a9s MongoDB 8:
  - Fix CVE-2026-9740.
  - Fix CVE-2026-9741.
  - Fix CVE-2026-9746.
  - Fix CVE-2026-9749.
  - Fix CVE-2026-9750.
  - Fix CVE-2026-9751.
  - Fix CVE-2026-9752.
  - Fix CVE-2026-9753.
  - Fix CVE-2026-9754.
  - Fix CVE-2026-11933.
  - Fix CVE-2026-9743.
- a8s MongoDB 7:
  - Fix CVE-2026-9740.
  - Fix CVE-2026-9741.
  - Fix CVE-2026-9746.
  - Fix CVE-2026-9748.
  - Fix CVE-2026-9749.
  - Fix CVE-2026-9750.
  - Fix CVE-2026-9751.
  - Fix CVE-2026-9752.
  - Fix CVE-2026-9753.
  - Fix CVE-2026-9754.
  - Fix CVE-2026-11933.

73.0.0

May 27, 2026 · 8 min read

Added

a9s-pg: a9s PostgreSQL: a9s PostgreSQL 15: Support BOSH CPI migration by addressing cluster nodes via a9s Consul DNS names instead of static IPs, and by falling back to the BOSH deployment index when node IDs are reassigned during the migration. The feature is opt-in via the a9s-pg/ops/use-consul-dns-names.yml Ops file.
a9s PostgreSQL: Support BOSH CPI migration by addressing cluster nodes via a9s Consul DNS names instead of static IPs, and by falling back to the BOSH deployment index when node IDs are reassigned during the migration. The feature is opt-in via the postgresql-service/ops/use-consul-dns-names.yml Ops file.
docs: Application Developer: Update the Disaster Recovery documentation to specify how to fork from specific backups. For more information, see Disaster Recovery - Retrieve the Backup ID of a specific Backup.
docs: Application Developer: Update the Forking documentation to add additional information regarding forking from a specific backup. For more information, see Forking a Service Instance - Retrieving the Wanted Backup's ID.
docs: Application Developer: a9s Messaging: Add references to the concerns relevant to the upgrade to RabbitMQ 4.3. For more information, see a9s Messaging Concerns.
docs: Platform Operator: a9s Billing: Add the missing prerequisite step in the deployment of a9s Billing to add required databases to a9s-pg. For more information, see a9s Data Services Setup - Deploy a9s Billing.
docs: Platform Operator: a9s Parachute: Update the documentation to add a disclaimer about the intended usage of a9s Parachute. For more information, see a9s Parachute.
docs: Platform Operator: a9s Parachute: Update the documentation to add limitations associated with the use of a9s Parachute for a9s MariaDB. For more information, see a9s Parachute.

Changed

breaking change a9s Backup Services: a9s Backup Manager: Fix duplicate Service Instance entries in the a9s Backup Manager database by adding a uniqueness validation and database constraint for instance_id per broker_id. Duplicate entries could cause backup creation failures and incorrect backup details in the dashboard. For more information, see UPGRADE - Merge Duplicate Service Instances.
a9s Template Uploader Errand: all services: Improve internal upload logic for hardcoded release versions.
a9s Template Uploader Errand: all services: Increased BOSH release version due to internal changes.
a9s Template Uploader Errand: a9s Messaging: Add legacy templates messaging42-* which contain the latest version of RabbitMQ 4.2. Once RabbitMQ 4.4 is supported, these legacy templates will be removed and new templates messaging43-* will be created. These templates provide a last resort rollback to the previous minor version of RabbitMQ, in case there are problems with the latest version of a9s Messaging. For more information, see a9s Messaging - Rollback to Legacy Version.
docs: Application Developer: a9s Messaging: Update documentation to include rabbitmqadmin v2 references. For more information, see: Forking and Migration.
docs: Platform Operator: a9s Messaging: Add warning about rollback limitation for RabbitMQ 4.3 instances. For more information, see: Rollback Limitation for RabbitMQ 4.3 and Later.
BOSH stemcell: all services: Update Jammy stemcell to version 1.1202 for the internal tests of all supported services.

Updated Dependencies

all services:
- bpm to v1.4.31.
- routing to v0.381.0.
- a9s Public API:
  - nginx to v1.31.0.
  - krakend-custom-plugins to v2.13.5.
  - krakend to v2.13.5.
  - Update internal dependencies.
- logstash to v8.19.15.
- nginx:
  - nginx to v1.31.0.
a9s-pg:
- postgresql15 to v15.18.
consul-dns: Dnsmasq: Update internal dependencies.
a9s KeyValue: a9s KeyValue 8: valkey to v8.1.7.
a9s LogMe: Update internal dependencies.
a9s MariaDB:
- a9s MariaDB 10.6:
  - mariadb to v10.6.26.
- a9s MariaDB 10.11:
  - mariadb to v10.11.17.
- Update internal dependencies.
a9s Messaging:
- a9s Messaging 4:
  - RabbitMQ to 4.3.1.
a9s MongoDB:
- a9s MongoDB 5:
  - mongodb to v5.0.33.
- a9s MongoDB 7:
  - mongodb to v7.0.34.
  - mongosh to v2.8.3.
- a9s MongoDB 8:
  - mongosh to v2.8.3.
  - mongodb to v8.0.23.
a9s MySQL: Update internal dependencies.
a9s PostgreSQL:
- a9s PostgreSQL 15:
  - postgresql15 to v15.18.
- a9s PostgreSQL 17:
  - postgresql17 to v17.10.
  - Update internal dependencies.
a9s Prometheus:
- prometheus2:
  - cadvisor to v0.57.0.
  - alertmanager to v0.32.1.
  - bosh_exporter to v3.8.0.
- prometheus-legacy:
  - cadvisor to v0.57.0.
  - alertmanager to v0.32.1.
  - bosh_exporter to v3.8.0.
- promgraf2:
  - cadvisor to v0.57.0.
  - alertmanager to v0.32.1.
  - bosh_exporter to v3.8.0.
- a9s Node Guard:
  - nginx to v1.31.0.
  - Update internal dependencies.
- a9s SSO Proxy:
  - nginx to v1.31.0.
  - Update internal dependencies.
a9s Redis:
- a9s Redis 7: redis to v7.2.14.

Unsupported

a9s PostgreSQL: End of Support: Terminate support for the following deprecated a9s Data Service version:
- a9s PostgreSQL v13: PostgreSQL 13 is end-of-life by their vendor since November 2025
The creation of new a9s Data Service Instances for this deprecated version is now disabled by default in the a9s Data Service Bundle and we no longer provide regular support for this version. The corresponding documentation has been removed.

Although we will not intentionally break running Service Instances of this unsupported version, it cannot be guaranteed that they still work as expected after an update to this release.

Removed

docs: Platform Operator: a9s PostgreSQL: Remove a9s PostgreSQL 13 from the "a9s Data Service Release Lifecycle Table" page. For more information, see a9s Platform Operator Sunrise Sunset - a9s Data Service Release Lifecycle Table.
docs: Platform Operator: a9s Search: Remove the deprecated "Backup and Restores" section from the a9s Search Platform Operator documentation, as that configuration is no longer necessary due to the refactoring of the a9s Backup Agent.

Security

all services:
- a9s Public API:
  - Fix CVE-2026-42945.
  - Fix CVE-2026-42946.
- nginx:
  - Fix CVE-2026-42945.
  - Fix CVE-2026-42946.
a9s-pg:
- Fix CVE-2026-6475.
- Fix CVE-2026-6477.
- Fix CVE-2026-6479.
- Fix CVE-2026-6637.
consul-dns:
- Dnsmasq:
  - Fix CVE-2026-4890.
  - Fix CVE-2026-4891.
  - Fix CVE-2026-4892.
  - Fix CVE-2026-4893.
  - Fix CVE-2026-2291.
  - Fix CVE-2026-5172.
a9s KeyValue: a9s KeyValue 8:
- Fix CVE-2026-23479.
- Fix CVE-2026-23631.
- Fix CVE-2026-25243.
a9s LogMe: a9s Service Broker:
- Fix CVE-2026-34827.
- Fix CVE-2026-34829.
a9s MariaDB:
- a9s MariaDB 10.6:
  - Fix CVE-2026-44168.
- a9s MariaDB 10.11:
  - Fix CVE-2026-44168.
a9s MongoDB:
- a9s MongoDB 5:
  - Fix CVE-2026-8053
- a9s MongoDB 7:
  - Fix CVE-2026-6914.
  - Fix CVE-2026-8053.
  - Fix CVE-2026-8199.
  - Fix CVE-2026-8201.
  - Fix CVE-2026-8843.
- a9s MongoDB 8:
  - Fix CVE-2026-6914.
  - Fix CVE-2026-8053.
  - Fix CVE-2026-8199.
  - Fix CVE-2026-8201.
  - Fix CVE-2026-8843.
a9s MySQL: a9s Service Broker:
- Fix CVE-2026-34827.
- Fix CVE-2026-34829.
a9s PostgreSQL:
- a9s PostgreSQL 17:
  - Fix CVE-2025-70873.
  - Fix CVE-2026-6475.
  - Fix CVE-2026-6476.
  - Fix CVE-2026-6477.
  - Fix CVE-2026-6479.
  - Fix CVE-2026-6637.
- a9s PostgreSQL 15:
  - Fix CVE-2026-6475.
  - Fix CVE-2026-6477.
  - Fix CVE-2026-6479.
  - Fix CVE-2026-6637.
a9s Prometheus:
- a9s Node Guard:
  - Fix CVE-2026-42945.
  - Fix CVE-2026-42946.
- a9s SSO Proxy:
  - Fix CVE-2026-42945.
  - Fix CVE-2026-42946.
a9s Redis: a9s Redis 7:
- Fix CVE-2026-23479.
- Fix CVE-2026-23631.
- Fix CVE-2026-25243.

Upcoming

a9s MariaDB: Deprecation: Prepare for the upcoming deprecation, planned for the release v75.0.0 (expected end of July 2026), of the following a9s Data Service version:
- a9s MariaDB 10.6: MariaDB 10.6 will become end-of-life by their vendor by 6th of July 2026.
Please ensure that you organize the migration of your existing Service Instances to a more up-to-date version of the same a9s Data Service:
- for a9s MariaDB 10.6: a9s MariaDB 10.11 is available as GA version.
The deprecation phase is planned to last until v78.0.0 (expected end of October). With this release, the unsupport phase of the deprecated version will start. The creation of new a9s Data Service Instances for this particular version will be disabled by default in the a9s Data Service Bundle when the unsupport occurs in v81.0.0 (expected end of January 2027) and we will not provide regular support for this version. The corresponding documentation will also be removed. Therefore, we strongly recommend that you start your migrations to a supported GA version as soon as possible and complete them until the end of the deprecation phase. For more information see a9s Platform Operator Sunrise Sunset.
a9s Redis®: End of Support: Terminate support, starting from anynines deployment v76.0.0 (expected end of August 2026).

The whole Data Service will be discontinued and no new versions will be released for it. Please ensure that you organize the migration of your existing Service Instances to the supported a9s KeyValue Data Service:
- for a9s Redis®: a9s KeyValue 8 is available as GA version.
Existing a9s Redis® Service Instances can be migrated to a9s KeyValue by forking them using the Disaster Recovery feature, or by applying manual migration steps. For more information about the available migration options, please see the Forking and Migration documentation page.

The creation of new a9s Data Service Instances for this deprecated Data Service will be disabled by default in the a9s Data Service Bundle, and we will not provide regular support for this Data Service. The corresponding documentation will also be removed.

Although we will not intentionally break running Service Instances of this unsupported Data Service, it cannot be guaranteed that they still work as expected after an update to v76.0.0.

73.0.0

May 27, 2026 · 8 min read

Added

a9s-pg: a9s PostgreSQL: a9s PostgreSQL 15: Support BOSH CPI migration by addressing cluster nodes via a9s Consul DNS names instead of static IPs, and by falling back to the BOSH deployment index when node IDs are reassigned during the migration. The feature is opt-in via the a9s-pg/ops/use-consul-dns-names.yml Ops file.
a9s PostgreSQL: Support BOSH CPI migration by addressing cluster nodes via a9s Consul DNS names instead of static IPs, and by falling back to the BOSH deployment index when node IDs are reassigned during the migration. The feature is opt-in via the postgresql-service/ops/use-consul-dns-names.yml Ops file.
docs: Application Developer: Update the Disaster Recovery documentation to specify how to fork from specific backups. For more information, see Disaster Recovery - Retrieve the Backup ID of a specific Backup.
docs: Application Developer: Update the Forking documentation to add additional information regarding forking from a specific backup. For more information, see Forking a Service Instance - Retrieving the Wanted Backup's ID.
docs: Application Developer: a9s Messaging: Add references to the concerns relevant to the upgrade to RabbitMQ 4.3. For more information, see a9s Messaging Concerns.
docs: Platform Operator: a9s Billing: Add the missing prerequisite step in the deployment of a9s Billing to add required databases to a9s-pg. For more information, see a9s Data Services Setup - Deploy a9s Billing.
docs: Platform Operator: a9s Parachute: Update the documentation to add a disclaimer about the intended usage of a9s Parachute. For more information, see a9s Parachute.
docs: Platform Operator: a9s Parachute: Update the documentation to add limitations associated with the use of a9s Parachute for a9s MariaDB. For more information, see a9s Parachute.

Changed

breaking change a9s Backup Services: a9s Backup Manager: Fix duplicate Service Instance entries in the a9s Backup Manager database by adding a uniqueness validation and database constraint for instance_id per broker_id. Duplicate entries could cause backup creation failures and incorrect backup details in the dashboard. For more information, see UPGRADE - Merge Duplicate Service Instances.
a9s Template Uploader Errand: all services: Improve internal upload logic for hardcoded release versions.
a9s Template Uploader Errand: all services: Increased BOSH release version due to internal changes.
a9s Template Uploader Errand: a9s Messaging: Add legacy templates messaging42-* which contain the latest version of RabbitMQ 4.2. Once RabbitMQ 4.4 is supported, these legacy templates will be removed and new templates messaging43-* will be created. These templates provide a last resort rollback to the previous minor version of RabbitMQ, in case there are problems with the latest version of a9s Messaging. For more information, see a9s Messaging - Rollback to Legacy Version.
docs: Application Developer: a9s Messaging: Update documentation to include rabbitmqadmin v2 references. For more information, see: Forking and Migration.
docs: Platform Operator: a9s Messaging: Add warning about rollback limitation for RabbitMQ 4.3 instances. For more information, see: Rollback Limitation for RabbitMQ 4.3 and Later.
BOSH stemcell: all services: Update Jammy stemcell to version 1.1202 for the internal tests of all supported services.

Updated Dependencies

all services:
- bpm to v1.4.31.
- routing to v0.381.0.
- a9s Public API:
  - nginx to v1.31.0.
  - krakend-custom-plugins to v2.13.5.
  - krakend to v2.13.5.
  - Update internal dependencies.
- logstash to v8.19.15.
- nginx:
  - nginx to v1.31.0.
a9s-pg:
- postgresql15 to v15.18.
consul-dns: Dnsmasq: Update internal dependencies.
a9s KeyValue: a9s KeyValue 8: valkey to v8.1.7.
a9s LogMe: Update internal dependencies.
a9s MariaDB:
- a9s MariaDB 10.6:
  - mariadb to v10.6.26.
- a9s MariaDB 10.11:
  - mariadb to v10.11.17.
- Update internal dependencies.
a9s Messaging:
- a9s Messaging 4:
  - RabbitMQ to 4.3.1.
a9s MongoDB:
- a9s MongoDB 5:
  - mongodb to v5.0.33.
- a9s MongoDB 7:
  - mongodb to v7.0.34.
  - mongosh to v2.8.3.
- a9s MongoDB 8:
  - mongosh to v2.8.3.
  - mongodb to v8.0.23.
a9s MySQL: Update internal dependencies.
a9s PostgreSQL:
- a9s PostgreSQL 15:
  - postgresql15 to v15.18.
- a9s PostgreSQL 17:
  - postgresql17 to v17.10.
  - Update internal dependencies.
a9s Prometheus:
- prometheus2:
  - cadvisor to v0.57.0.
  - alertmanager to v0.32.1.
  - bosh_exporter to v3.8.0.
- prometheus-legacy:
  - cadvisor to v0.57.0.
  - alertmanager to v0.32.1.
  - bosh_exporter to v3.8.0.
- promgraf2:
  - cadvisor to v0.57.0.
  - alertmanager to v0.32.1.
  - bosh_exporter to v3.8.0.
- a9s Node Guard:
  - nginx to v1.31.0.
  - Update internal dependencies.
- a9s SSO Proxy:
  - nginx to v1.31.0.
  - Update internal dependencies.
a9s Redis:
- a9s Redis 7: redis to v7.2.14.

Unsupported

a9s PostgreSQL: End of Support: Terminate support for the following deprecated a9s Data Service version:
- a9s PostgreSQL v13: PostgreSQL 13 is end-of-life by their vendor since November 2025
The creation of new a9s Data Service Instances for this deprecated version is now disabled by default in the a9s Data Service Bundle and we no longer provide regular support for this version. The corresponding documentation has been removed.

Although we will not intentionally break running Service Instances of this unsupported version, it cannot be guaranteed that they still work as expected after an update to this release.

Removed

docs: Platform Operator: a9s PostgreSQL: Remove a9s PostgreSQL 13 from the "a9s Data Service Release Lifecycle Table" page. For more information, see a9s Platform Operator Sunrise Sunset - a9s Data Service Release Lifecycle Table.
docs: Platform Operator: a9s Search: Remove the deprecated "Backup and Restores" section from the a9s Search Platform Operator documentation, as that configuration is no longer necessary due to the refactoring of the a9s Backup Agent.

Security

all services:
- a9s Public API:
  - Fix CVE-2026-42945.
  - Fix CVE-2026-42946.
- nginx:
  - Fix CVE-2026-42945.
  - Fix CVE-2026-42946.
a9s-pg:
- Fix CVE-2026-6475.
- Fix CVE-2026-6477.
- Fix CVE-2026-6479.
- Fix CVE-2026-6637.
consul-dns:
- Dnsmasq:
  - Fix CVE-2026-4890.
  - Fix CVE-2026-4891.
  - Fix CVE-2026-4892.
  - Fix CVE-2026-4893.
  - Fix CVE-2026-2291.
  - Fix CVE-2026-5172.
a9s KeyValue: a9s KeyValue 8:
- Fix CVE-2026-23479.
- Fix CVE-2026-23631.
- Fix CVE-2026-25243.
a9s LogMe: a9s Service Broker:
- Fix CVE-2026-34827.
- Fix CVE-2026-34829.
a9s MariaDB:
- a9s MariaDB 10.6:
  - Fix CVE-2026-44168.
- a9s MariaDB 10.11:
  - Fix CVE-2026-44168.
a9s MongoDB:
- a9s MongoDB 5:
  - Fix CVE-2026-8053
- a9s MongoDB 7:
  - Fix CVE-2026-6914.
  - Fix CVE-2026-8053.
  - Fix CVE-2026-8199.
  - Fix CVE-2026-8201.
  - Fix CVE-2026-8843.
- a9s MongoDB 8:
  - Fix CVE-2026-6914.
  - Fix CVE-2026-8053.
  - Fix CVE-2026-8199.
  - Fix CVE-2026-8201.
  - Fix CVE-2026-8843.
a9s MySQL: a9s Service Broker:
- Fix CVE-2026-34827.
- Fix CVE-2026-34829.
a9s PostgreSQL:
- a9s PostgreSQL 17:
  - Fix CVE-2025-70873.
  - Fix CVE-2026-6475.
  - Fix CVE-2026-6476.
  - Fix CVE-2026-6477.
  - Fix CVE-2026-6479.
  - Fix CVE-2026-6637.
- a9s PostgreSQL 15:
  - Fix CVE-2026-6475.
  - Fix CVE-2026-6477.
  - Fix CVE-2026-6479.
  - Fix CVE-2026-6637.
a9s Prometheus:
- a9s Node Guard:
  - Fix CVE-2026-42945.
  - Fix CVE-2026-42946.
- a9s SSO Proxy:
  - Fix CVE-2026-42945.
  - Fix CVE-2026-42946.
a9s Redis: a9s Redis 7:
- Fix CVE-2026-23479.
- Fix CVE-2026-23631.
- Fix CVE-2026-25243.

Upcoming

a9s MariaDB: Deprecation: Prepare for the upcoming deprecation, planned for the release v75.0.0 (expected end of July 2026), of the following a9s Data Service version:
- a9s MariaDB 10.6: MariaDB 10.6 will become end-of-life by their vendor by 6th of July 2026.
Please ensure that you organize the migration of your existing Service Instances to a more up-to-date version of the same a9s Data Service:
- for a9s MariaDB 10.6: a9s MariaDB 10.11 is available as GA version.
The deprecation phase is planned to last until v78.0.0 (expected end of October). With this release, the unsupport phase of the deprecated version will start. The creation of new a9s Data Service Instances for this particular version will be disabled by default in the a9s Data Service Bundle when the unsupport occurs in v81.0.0 (expected end of January 2027) and we will not provide regular support for this version. The corresponding documentation will also be removed. Therefore, we strongly recommend that you start your migrations to a supported GA version as soon as possible and complete them until the end of the deprecation phase. For more information see a9s Platform Operator Sunrise Sunset.
a9s Redis®: End of Support: Terminate support, starting from anynines deployment v76.0.0 (expected end of August 2026).

The whole Data Service will be discontinued and no new versions will be released for it. Please ensure that you organize the migration of your existing Service Instances to the supported a9s KeyValue Data Service:
- for a9s Redis®: a9s KeyValue 8 is available as GA version.
Existing a9s Redis® Service Instances can be migrated to a9s KeyValue by forking them using the Disaster Recovery feature, or by applying manual migration steps. For more information about the available migration options, please see the Forking and Migration documentation page.

The creation of new a9s Data Service Instances for this deprecated Data Service will be disabled by default in the a9s Data Service Bundle, and we will not provide regular support for this Data Service. The corresponding documentation will also be removed.

Although we will not intentionally break running Service Instances of this unsupported Data Service, it cannot be guaranteed that they still work as expected after an update to v76.0.0.

72.0.0

April 28, 2026 · 13 min read

Changed

all services: Update the enable-service-instances-aws-instance-profiles.yml Ops file to extend the list of vm_extensions instead of overwriting it.
all services: a9s Backup Agent: Improve backup connection handling with automatic retries for temporary backup storage errors.
a9s-pg: Update the enable-service-instances-aws-instance-profiles.yml Ops file to extend the list of vm_extensions instead of overwriting it.
a9s Backup Services: Update the enable-backup-services-aws-instance-profiles Ops file to extend the list of vm_extensions for the a9s Backup Manager and a9s Backup Monit instead of overwriting it.
a9s Backup Services: a9s Backup Manager: Improve backup connection handling with automatic retries for temporary backup storage errors.
a9s MongoDB: a9s MongoDB SPI: Consolidate logging into one file.
a9s Service Broker: Instance deletion Rake task now handles potential state inconsistency when communicating with a9s Deployer.
docs: all services: Extend admonitions within the a9s Backup Manager documentation, to explicitly state the limitations of automatic/periodic backups when a Service Instance has been stopped. For more information, see a9s Backup Manager - Properties.
docs: all services: Extend the documentation of the Stop/Start feature, to better explain the current limitations, expected behavior, and extend the cross-referencing within the pages. For more information, see Stop/Start.
docs: Application Developer: a9s Public API: Restructure the API V1 Endpoints page into a new section, divided into subpages by topic. For more information, see API V1 Endpoints.
docs: Platform Operator: a9s Backup Services: Update the examples to use AWS IAM Instance Profiles via Ops file to extend the list of vm_extensions instead of overwriting it. For more information, see Using AWS Instance Profiles.
BOSH stemcell: all services: Update Jammy stemcell to version 1.1183 for internal tests of all supported services.

Updated Dependencies

all services:
- a9s Bee:
  - Update dependencies to resolve GO CVEs.
- a9s Public API:
  - a9s-beehive to v1.2.6.
  - krakend-custom-plugins to v2.13.4.
  - krakend to v2.13.4.
  - nginx to v1.30.0.
  - Update internal dependencies.
- bpm to v1.4.29.
- logstash to v8.19.14.
- nginx:
  - nginx to v1.30.0.
- routing to v0.379.0.
- a9s Backup Agent: Update internal dependencies.
- a9s BOSH Deployer: Update internal dependencies.
- a9s Service Broker: Update internal dependencies.
- a9s Smoke Tests:
  - Update internal dependencies.
- a9s SPIs: Update internal dependencies.
a9s-pg: Update internal dependencies.
a9s Backup Services:
- a9s Backup Manager: Update internal dependencies.
- a9s Backup Monit: Update internal dependencies.
a9s Billing: Update internal dependencies.
a9s CF Service Guard: Update internal dependencies.
a9s MariaDB:
- a9s MariaDB 10.6:
  - Update internal dependencies.
- a9s MariaDB 10.11:
  - Update internal dependencies.
a9s Messaging:
- a9s Messaging 3.8:
  - Update internal dependencies.
- a9s Messaging 3.10:
  - Update internal dependencies.
- a9s Messaging 3.12:
  - Update internal dependencies.
- a9s Messaging 3.13:
  - Update internal dependencies.
- a9s Messaging 4:
  - erlang to v27.3.4.11.
  - rabbitmq to v4.2.6
  - Update internal dependencies.
a9s MongoDB:
- a9s MongoDB 8:
  - mongosh to v2.8.2.
- a9s MongoDB 7:
  - mongosh to v2.8.2.
a9s MySQL:
- a9s MariaDB 10.4:
  - Update internal dependencies.
a9s PostgreSQL:
- a9s PostgreSQL 17:
  - postgresql-info-webservice to v3.8.4
  - Update internal dependencies.
- a9s PostgreSQL 15:
  - postgresql-info-webservice to v3.8.4
  - Update internal dependencies.
- a9s PostgreSQL 13:
  - postgresql-info-webservice to v3.8.4
  - cmake3 to v3.31.12
  - Update internal dependencies.
a9s Prometheus:
- prometheus2:
  - alertmanager to v0.32.0
  - memcached_exporter to v0.16.0
  - influxdb_exporter to v0.12.1
  - Update internal dependencies.
- prometheus-legacy:
  - alertmanager to v0.32.0
  - memcached_exporter to v0.16.0
  - influxdb_exporter to v0.12.1
  - Update internal dependencies.
- promgraf2:
  - alertmanager to v0.32.0
  - memcached_exporter to v0.16.0
  - influxdb_exporter to v0.12.1
  - Update internal dependencies.

Deprecated

breaking change all services: Deprecation: Deprecate the a9s Environment Info service.

The whole a9s Environment Info service will be discontinued and no new versions will be released for it. Please ensure that any internal usage of this component is appropriately removed.

This direct deprecation phase will be followed by immediate removal, planned for the release v73.0.0 (expected end of May 2026). Therefore, we strongly recommend that any and all adjustments are made, if necessary, soon as possible and to complete them before upgrading to v73.0.0.

To inquire about extended support for a deprecated component, please get in contact with our sales department at sales@anynines.com.

Fixed

a9s MongoDB: a9s MongoDB SPI: Introduce a timeout for the Mongo client. This was done to prevent the client from infinitely calling any unreachable MongoDB Service Instance, which would exhaust the SPI VM resources.
docs: Platform Operator: Fix incorrect statements regarding the blocking of Maintenance Updates. Previously, the admonition provided misleading information about the types of updates the feature is concerned with. For more information, see Block Maintenance Updates

Security

all services:
- a9s Backup Agent:
  - Fix CVE-2026-34827.
  - Fix CVE-2026-34829.
all services:
- a9s BOSH Deployer:
  - Fix CVE-2026-34827.
  - Fix CVE-2026-34829.
all services:
- a9s Logstash: Fix CVE-2026-33466.
all services:
- a9s Public API:
  - Fix CVE-2026-34827.
  - Fix CVE-2026-34829.
  - Fix CVE-2026-35611.
all services:
- a9s Service Broker:
  - Fix CVE-2026-34827.
  - Fix CVE-2026-34829.
  - Fix CVE-2026-35611.
all services:
- a9s Service Dashboard:
  - Fix CVE-2026-33937.
  - Fix CVE-2026-33941.
  - Fix CVE-2026-33940.
  - Fix CVE-2026-33939.
  - Fix CVE-2026-33938.
  - Fix CVE-2026-33891.
  - Fix CVE-2026-33895.
  - Fix CVE-2026-33894.
  - Fix CVE-2026-33896.
  - Fix CVE-2026-4800.
all services:
- a9s Smoke Tests:
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
all services:
- a9s Bee:
  - Fix CVE-2026-27140.
  - Fix CVE-2026-27143.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
- a9s SPIs:
  - Fix CVE-2026-34827.
  - Fix CVE-2026-34829.
  - Fix CVE-2026-35611.
a9s-pg:
- Fix CVE-2025-70873.
- Fix CVE-2026-27143.
- Fix CVE-2026-27140.
- Fix CVE-2026-32280.
- Fix CVE-2026-32281.
- Fix CVE-2026-32283.
- Fix CVE-2026-27144.
a9s Backup Services:
- a9s Backup Manager:
  - Fix CVE-2026-34827.
  - Fix CVE-2026-34829.
- a9s Backup Monit:
  - Fix CVE-2026-34827.
  - Fix CVE-2026-34829.
a9s Billing: Fix CVE-2026-22860.
a9s CF Service Guard:
- Fix CVE-2026-34827.
- Fix CVE-2026-34829.
a9s MariaDB:
- a9s MariaDB 10.4:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
- a9s MariaDB 10.6:
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
- a9s MariaDB 10.11:
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
a9s Messaging:
- a9s Messaging 3.8:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
- a9s Messaging 3.10:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
- a9s Messaging 3.12:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
- a9s Messaging 3.13:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
- a9s Messaging 4:
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
a9s MongoDB:
- a9s MongoDB SPI: Fix CVEs:
  - CVE-2026-34829.
  - CVE-2026-34827.
a9s MySQL:
- a9s MariaDB 10.4:
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
a9s PostgreSQL:
- a9s PostgreSQL 17:
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
- a9s PostgreSQL 15:
  - Fix CVE-2025-70873.
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
- a9s PostgreSQL 13:
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
- a9s PostgreSQL 11:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
- a9s PostgreSQL 10:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
a9s Prometheus:
- prometheus2:
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
- prometheus-legacy:
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
- promgraf2:
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.

Upcoming

a9s Messaging: Version Upgrade with Breaking Changes planned for v73.0.0 (End of May 2026):

Within a9s Messaging 4, RabbitMQ 4.2 will be replaced with RabbitMQ 4.3. There are now Breaking Changes between Minor Versions of RabbitMQ 4, which usually only affect the client side, but require attention. Nevertheless, these RabbitMQ Minor Versions will be released as Minor Versions of a9s Messaging 4.

Due to recent changes in the RabbitMQ release policy, Minor Versions of RabbitMQ 4 now have a maintenance overlap period of 3 months. Previous versions of RabbitMQ 4 did not have any maintenance overlap period.

RabbitMQ 4.2 will be supported by the vendor until the 31st of July.

As a consequence of the Data Service vendor's decision to make the maintenance overlap periods for the open source version of RabbitMQ 4 unusually short, we have decided with the release of a9s Messaging 4 to treat each minor version of RabbitMQ 4 as a minor version of a9s Messaging 4 as well, although some breaking changes between these minor versions may occur.

Therefore we do not follow our usual process for releasing, deprecating and unsupporting these versions as Major Versions: RabbitMQ 4.2 will not be deprecated and unsupported with our default processes, due to the aforementioned situation.

The version upgrade from RabbitMQ 4.2 to 4.3 will be handled as fully automatic in-place upgrade of the a9s Messaging 4 Service Instances, as is currently the case for all minor version upgrades of our Data Services. Thus, RabbitMQ 4.2 will be unsupported, as soon as RabbitMQ 4.3 is available with a9s Data Services.

a9s Data Service will only support one minor version of RabbitMQ 4 (offered as a9s Messaging 4) at any given time.

Please take the necessary steps now to ensure compatibility with the new RabbitMQ Minor Version to be shipped with v73.0.0, which will be released at the end of May 2026.

The following Breaking Changes must be considered and the Recommended Actions must be taken before upgrading to v73.0.0. We recommend to take care of these changes immediately to ensure a smooth transition.
- Classic Queues v1 Storage (CQv1) is Removed
  
  Starting with RabbitMQ 4, all classic queues will be automatically converted to version 2 (CQv2), even if they are defined as version 1 (CQv1). If there are existing version 1 (CQv1) queues, they will be converted at RabbitMQ service start.
  
  RabbitMQ 4.3 removes the original classic queue storage implementation these days known as CQv1. This will lead to all attempts to fail that try to create classic queues with the following parameters:
  - x-queue-mode set to any value
  - x-queue-version set to 1
  All applications or automations that should be adapted to not set those parameters for the declaration of queues.
- Consumer Timeout
  
  Starting with RabbitMQ 4.3, quorum queues will support configurable consumer timeouts. For more information, please see the RabbitMQ 4.3 documentation of the vendor.
  
  In addition to this change, consumer timeouts are removed for classic queues. Therefore, all applications should be evaluated if they depend on the consumer timeouts for classic queues and use quorum queues instead.
- Quorum Queues support unlimited returns
  
  Up to RabbitMQ 4.2, every requeued message incremented its delivery-count by 1, regardless of the reason. Poison message handling would dead-letter the message once this count exceeded the queue's delivery-limit. Starting with RabbitMQ 4.3, quorum queues track two distinct counters: acquired-count and delivery-count.
  
  The delivery limit will based on delivery-count rather than the new header acquired-count. This can lead to unlimited explicit message returns (by nack or AMQP 1.0 modify with delivery_failed=false) without counting towards the delivery limit.
  
  The header x-acquired-count will track the number of times a messages was aquired by a consumer. And x-delivery-count will track the actual number of failed deliveries.
  
  All applications should be evaluated if quorum queues are used with poison message handling and, if required, adapt the application accordingly.
- Khepri is Now The Only Metadata Store
  
  Starting with RabbitMQ 4.3, the Mnesia Storage Engine will be removed in favor of the new Khepri Storage Engine. The Khepri Storage Engine was introduced with RabbitMQ 4.0 and is the new default since RabbitMQ 4.2 for all newly created Service Instances.
  
  All a9s Messaging Service Instance that were updated from a9s Messaging 4.1 (or prior) to 4.2, are still using the Mnesia Storage Engine. If a9s Messaging Service Instances with Mnesia are upgraded to RabbitMQ 4.3, they will automatically migrate their data to the new Khepri Storage Engine on the first start. Even though this process should work without issues, we recommend to use the Strategy to safely evaluate RabbitMQ 4.X minor updates to safely update a9s Messaging Service Instances to RabbitMQ 4.3. Because if those Service Instances would break during the Storage Engine migration process, there could be issues to do a rollback.
  
  With the following command it can be identified if the Khepri Storage Engine is already being used:
```
curl -k -s -u <user>:<pass> 'https://<node-hostname_or_alias>:15672/api/feature-flags' | grep khepri_db
```
  If there is a object with the name khepri_db, then the Khepri Storage Engine is used on the Service Instance.

71.0.1

April 3, 2026 · One min read

Fixed

all services: a9s SPIs: Fix the issue that caused custom parameter configuration set at Service Plan level to be used for all plans, as it overwrote the referenced object in memory as well.

71.0.0

March 30, 2026 · 10 min read

Added

breaking change a9s MongoDB: Introduce a9s MongoDB 8.0 SSPL (Add-on) as an a9s Generally Available (GA). For more information, see a9s Platform Operator - Sunrise Sunset.
all services: a9s Service Broker: Introduce the Beta release of the Stop/Start feature. For more information, see Common Features - Stop/Start Feature.
all services: a9s Public API: Add the Stop/Start feature related endpoints to the a9s Public API V1. For more information, see API V1 Endpoints - Stop/Start.
a9s MongoDB: Add support to configure TLS 1.3 cipher suites via the tls13_cipher_suites custom parameter. This maps to the MongoDB opensslCipherSuiteConfig startup parameter.
a9s MongoDB: a9s MongoDB SPI: Implement the new custom parameter tls13_cipher_suites to support the MongoDB opensslCipherSuiteConfig startup parameter.
a9s PostgreSQL: Create external bootstrap lock to prevent reinitialization of databases already created.
docs: Application Developer: all services: Add initial documentation for the Stop/Start feature. For more information, see Common Features - Stop/Start Feature.
docs: Application Developer: a9s MongoDB: Add an admonition regarding the migration path for the Disaster Recovery feature. For more information, see Forking and Migration.
docs: Application Developer: a9s PostgreSQL: Add references to the external bootstrap lock introduced to the a9s PostgreSQL Continuous Archiving Service Instances. For more information, see Continuous Archiving and Point-in-Time Recovery (PITR) - Data Protection.
docs: Platform Operator: a9s PostgreSQL: Add new section to the PostgreSQL Cluster Recovery documentation explaining the recovery of the external bootstrap lock. For more information, see Cluster Recovery - Recreate bootstrap_initialized.lock File.
docs: Platform Operator: a9s Service Broker: Add initial documentation for the Stop/Start feature. For more information, see Stop/Start Feature.
INTERNAL RELEASE a9s Backup Manager: Add script to find unknown files in the backup storage.

Changed

all services: a9s Beehive: Improve the a9s Bee discovery in a9s Beehive by replacing API calls to a9s Service Broker with a9s Consul.
all services: a9s Deployer: Extend the definition of outdated Service Instances to include stopped Service Instances.
all services: a9s Deployment Updater Errand: Extend the functionality of the update strategy, using the outdated instance type, to skip all stopped Service Instances. The output of the errand has also been extended to reflect this additional Service Instance state. For more information, see a9s Deployment Updater - Update.
all services: a9s Public API: Add Secure attribute to session cookie, which is set after the Oauth Handshake between CF UAA and a9s Public API.
all services: a9s Public API: Extend internal plugin to better handle and sanitize the response from the endpoints that are in communication with the a9s Service Broker.
all services: a9s Service Broker: Improve performance by extending the a9s Service Broker from single threaded to multithreaded. It now able to run up to five threads.
all services: a9s Service Broker: Improve error handling to be more explicit about the error that occurred. This change also extends to concurrency errors.
all services: a9s Service Dashboard: Remove reference to manifest.json to avoid unnecessary API calls to the a9s Public API.
a9s KeyValue: Rename the occurrence of keyvalue to valkey in the enable-service-instances-aws-instance-profiles.yml Ops file.
a9s MongoDB: Enforce SSL communication in internal create-admin and update-admin scripts for a9s MongoDB 8.0 BOSH release.
a9s Prometheus: Add internal configuration to Grafana.
docs: Application Developer: Update the links in the Disaster Recovery documentation to use the latest version of the a9s Cloud Foundry CLI Plugin. For more information, see Disaster Recovery.
docs: Application Developer: a9s PostgreSQL: Move the "PostgreSQL Extensions" section from the "Metrics" page into the "Custom Parameters" page. For more information, see a9s PostgreSQL - Custom Parameters - PostgreSQL Extensions.
docs: Application Developer: a9s PostgreSQL: Refactor the contents of the "Custom Parameters" page to improve readability. For more information, see a9s PostgreSQL - Custom Parameters.
docs: Application Developer: a9s Public API: Extend the API V1 Endpoints documentation with the Stop/Start feature related enpdoints. For more information, see API V1 Endpoints - Stop/Start.
docs: Platform Operator: Rename the occurrence of keyvalue to valkey in the "Extending the a9s Data Services' Templates" section. For more information, see Using AWS Instance Profiles.
BOSH stemcell: all services: Update Jammy stemcell to version 1.1107, for internal tests of all supported services.

Updated Dependencies

all services:
- a9s Backup Agent: Bump Ruby gem dependencies.
- a9s Bee:
  - Update dependencies to resolve CVEs.
- a9s BOSH Deployer: Bump Ruby gem dependencies.
- a9s Dashboard API: Update internal dependencies.
- a9s Public API:
  - a9s-beehive to v1.2.5
  - krakend-custom-plugins to v2.13.3.
  - krakend to v2.13.3.
  - nginx to v1.29.7.
- a9s Service Dashboard:
  - Node.JS to v22.22.2.
  - Update internal dependencies.
- a9s Smoke Tests: Update internal dependencies.
- a9s SPIs: Bump Ruby gem dependencies.
- a9s SSO Proxy: Bump Ruby gem dependencies.
- bpm to v1.4.27.
- logstash to v8.19.12.
- nginx:
  - nginx to v1.29.7.
- routing to v0.370.0.
a9s-pg:
- a9s PostgreSQL: a9s PostgreSQL 15: Update internal dependencies.
- Update internal dependencies.
a9s Backup Services:
- a9s Backup Agent: Bump Ruby gem dependencies.
- a9s Backup Manager: Bump Ruby gem dependencies.
- a9s Backup Monit: Bump Ruby gem dependencies.
a9s Billing: Update internal dependencies.
a9s CF Service Guard: Bump Ruby gem dependencies.
a9s KeyValue: a9s Service Broker: Bump Ruby gem dependencies.
a9s LogMe2:
- a9s Service Broker: Bump Ruby gem dependencies.
- opensearch to v2.19.5.
- opensearch-dashboards to v2.19.5.
- opensearch-plugin-repository-azure to v2.19.5.
- opensearch-plugin-repository-s3 to v2.19.5.
a9s MariaDB:
- a9s MariaDB 10.6:
  - Update internal dependencies.
- a9s MariaDB 10.11:
  - Update internal dependencies.
- a9s Service Broker: Bump Ruby gem dependencies.
a9s Messaging:
- a9s Messaging 4:
  - erlang to v27.3.4.9.
  - rabbitmq to v4.2.5.
  - Update internal dependencies.
- a9s Service Broker: Bump Ruby gem dependencies.
a9s MongoDB:
- a9s MongoDB 7:
  - mongodb to v7.0.31
  - mongosh to v2.8.1.
  - Update internal dependencies.
- a9s MongoDB 8:
  - mongodb to v8.0.20
  - mongosh to v2.8.1.
  - Update internal dependencies.
- a9s Service Broker: Bump Ruby gem dependencies.
a9s PostgreSQL:
- a9s PostgreSQL 13:
  - pgvector to v0.8.2.
- a9s PostgreSQL 15:
  - pgvector to v0.8.2.
  - Update internal dependencies.
- a9s PostgreSQL 17:
  - pgvector to v0.8.2.
  - Update internal dependencies.
- a9s Service Broker: Bump Ruby gem dependencies.
a9s Prometheus:
- a9s Service Broker: Bump Ruby gem dependencies.
- prometheus2:
  - collectd_exporter to v0.7.1.
  - statsd_exporter to v0.29.0.
  - postgres_exporter to v0.19.1.
  - mysqld_exporter to v0.19.0.
  - Update internal dependencies.
- prometheus-legacy:
  - statsd_exporter to v0.29.0.
  - postgres_exporter to v0.19.1.
  - Update internal dependencies.
- promgraf2:
  - collectd_exporter to v0.7.1.
  - statsd_exporter to v0.29.0.
  - postgres_exporter to v0.19.1.
  - mysqld_exporter to v0.19.0.
  - Update internal dependencies.
a9s Redis:
- a9s Redis 7: redis to v7.2.13.
- a9s Service Broker: Bump Ruby gem dependencies.
a9s Search:
- a9s Service Broker: Bump Ruby gem dependencies.
- opensearch to v2.19.5.
- opensearch-dashboards to v2.19.5.
- opensearch-plugin-repository-azure to v2.19.5.
- opensearch-plugin-repository-s3 to v2.19.5.

Fixed

all services: a9s Backup Agent: Fix port configuration in the backup store used for OpenSearch backups. The ports given for backup storages are now used during the creation of OpenSearch backups.
all services: a9s BOSH Deployer: Fix update process of the deployment status. This fixes a failure that caused the a9s Deployer to keep the Service Instance's state as deploying, which prevented further operations from taking place.
all services: a9s Smoke Tests: Fix a9s Smoke Tests issue by choosing the correct App URL based on the "Apps Domain" in the a9s Data Service manifest when multiple Cloud Foundry App domains are configured.
all services: a9s SPIs: Fix parameter parsing to accept Service Plan names with special characters like ..
a9s Backup Services: a9s Backup Manager: Improve cronparser to work more reliabily when triggering automated backups.
a9s MongoDB: a9s MongoDB SPI: Fix the handling of Intermediate Wildcard CAs to ensure the complete CA chain is used to validate the a9s MongoDB Service Instance certificates.
a9s Service Dashboard: Extend error notification when provided by the backend components.
docs: Application Developer: a9s Public API: Fix example API call to update the Service Instance settings via cURL. For more information, see API V1 Endpoints - Update Instance Settings.
docs: Platform Operator: a9s MongoDB: Simplify the manual cluster restore instructions, and fix minor issues in the provided commands. For more information, see Manual Logical Backup Recovery.
INTERNAL RELEASE a9s KeyValue: Fix issue with reconnection to the cluster after the failover on the unit tests.

Security

all services:
- a9s Backup Agent: Fix CVE-2026-22860.
- a9s Bee:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
- a9s BOSH Deployer: Fix CVE-2026-22860.
- a9s Dashboard API:
  - Fix CVE-2026-27601.
  - Fix CVE-2026-26996.
  - Fix CVE-2026-27903.
  - Fix CVE-2026-27904.
  - Fix CVE-2026-32141.
  - Fix CVE-2026-33228.
- a9s Public API:
  - Fix CVE-2026-27601.
  - Fix CVE-2026-26996.
  - Fix CVE-2026-27903.
  - Fix CVE-2026-27904.
  - Fix CVE-2026-32141.
  - Fix CVE-2026-33228.
- a9s Service Dashboard:
  - Fix CVE-2026-27601.
  - Fix CVE-2026-27606.
  - Fix CVE-2026-26996.
  - Fix CVE-2026-27903.
  - Fix CVE-2026-27904.
  - Fix CVE-2026-29063.
  - Fix CVE-2026-29074.
  - Fix CVE-2026-32141.
  - Fix CVE-2026-33228.
- a9s Smoke Tests:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-22860.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
- a9s SPIs: Fix CVE-2026-22860.
- a9s SSO Proxy: Fix CVE-2026-22860.
a9s-pg:
- Fix CVE-2025-4674.
- Fix CVE-2025-58187.
- Fix CVE-2025-58188.
- Fix CVE-2025-61723.
- Fix CVE-2026-25679.
- Fix CVE-2026-27137.
- Fix CVE-2026-27142.
a9s Backup Services:
- a9s Backup Agent: Fix CVE-2026-22860.
- a9s Backup Manager: Fix CVE-2026-22860.
- a9s Backup Monit: Fix CVE-2026-22860.
a9s Billing: Fix CVE-2026-22860.
a9s CF Service Guard: Fix CVE-2026-22860.
a9s KeyValue: a9s Service Broker: Fix CVE-2026-22860.
a9s LogMe2: a9s Service Broker: Fix CVE-2026-22860.
a9s MariaDB:
- a9s MariaDB 10.6:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
- a9s MariaDB 10.11:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
- a9s Service Broker: Fix CVE-2026-22860.
a9s Messaging:
- a9s Messaging 4:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
- a9s Service Broker: Fix CVE-2026-22860.
a9s MongoDB:
- a9s MongoDB 7: Fix CVEs:
  - CVE-2026-4147
  - CVE-2026-4148
- a9s MongoDB 8: Fix CVEs:
  - CVE-2026-4147
  - CVE-2026-4148
- a9s Service Broker: Fix CVE-2026-22860.
a9s PostgreSQL:
- a9s PostgreSQL 13: Fix CVE-2026-3172.
- a9s PostgreSQL 15:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-3172.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
- a9s PostgreSQL 17:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-3172.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
- a9s Service Broker: Fix CVE-2026-22860.
a9s Prometheus:
- a9s Service Broker: Fix CVE-2026-22860.
- prometheus2:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
- prometheus-legacy:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
- promgraf2:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
a9s Redis: a9s Service Broker: Fix CVE-2026-22860.
a9s Search: a9s Service Broker: Fix CVE-2026-22860.

70.0.0

February 24, 2026 · 8 min read

Added

breaking change a9s MongoDB: Introduce a9s MongoDB 8.0 SSPL (Add-on) as an a9s Release Candidate.
all services: a9s Service Broker: Add two new fields, state and locked to the script instance-information.
all services: a9s Template Uploader Errand: Add templates for a9s MongoDB 8.0 SSPL (Add-on).
docs: Application Developer: Add an admonition to notify Application Developers about the deprecation & unsupport of a9s PostgreSQL 13 Data Service. For more information, see a9s PostgreSQL.
docs: Application Developer: Add an admonition to notify Application Developers about the deprecation & unsupport of the a9s Redis® Data Service. For more information, see a9s Redis®.
docs: Platform Operator: Add an admonition to notify Platform Operators about the deprecation & unsupport of the a9s Redis® Data Service. For more information, see a9s Redis®.
docs: Platform Operator: a9s Service Broker: Update the instance-information script documentation to include the new fields, state and locked. For more information, see a9s Service Broker - Retrieve Service Instance Information.

Changed

breaking change all services: a9s Service Broker: Adapt the script instance-information.erb in the a9s Service Broker BOSH release to provide the context of a Service Instance instead of the metadata.
breaking change a9s MongoDB: Update addons/mongodbsspl/ops/add-mongodb-sspl.yml with the following new properties to introduce a9s MongoDB 8.0 SSPL (Add-on) as an a9s Release Candidate:
- mongodb_service.services.a9s-mongodb80.name
- mongodb_service.services.a9s-mongodb80.guid
- mongodb_service.services.a9s-mongodb80.description
- mongodb_service.services.a9s-mongodb80.label
- mongodb_service.services.a9s-mongodb80.version
- mongodb_service.services.a9s-mongodb80.bindable
- mongodb_service.services.a9s-mongodb80.requires
- mongodb_service.services.a9s-mongodb80.tags
- mongodb_service.services.a9s-mongodb80.documentation_url
- mongodb_service.services.a9s-mongodb80.metadata
- mongodb_service.services.a9s-mongodb80.dashboard_client.id
- mongodb_service.services.a9s-mongodb80.plans-to-test
- mongodb_service.services.a9s-mongodb80.planupdates-to-test
all services: a9s Backup Agent: Change the logging level of the a9s Backup Agent's task from error to info for better visibility.
all services: a9s Public API: Extend functionality of the operations endpoints of the Stop/Start Experimental Feature to allow to forward pagination related query parameters. For more information, see Experimental Features - Stop/Start Feature.
all services: a9s Public API: Update CF API v2 calls to v3.
all services: a9s Service Broker: Improve behavior and reliability of the Stop/Start Experimental Feature. For more information, see Experimental Features - Stop/Start Feature.
all services: a9s Service Broker: Update CF API v2 calls to v3.
all services: a9s Smoke Tests: Update CF API v2 calls to v3.
all services: a9s SSO Proxy: Update CF API v2 calls to v3.
a9s MariaDB: a9s Logstash: Transform ON/OFF metrics to 1/0 and include them in the metrics.
a9s Messaging: Move legacy templates from folder messaging41 to messaging4.
a9s MongoDB: a9s Logstash: Stream all available additional metrics that are compatible with the Graphite standard.
a9s MongoDB: a9s MongoDB SPI: Enhance the validation for the ssl_ciphers custom parameter to ensure no malicious strings can be injected into the configuration.
a9s PostgreSQL: a9s PostgreSQL SPI: Enhance the validation for the ssl_ciphers custom parameter to ensure no malicious strings can be injected into the configuration.
docs: Application Developer: a9s MongoDB: Adapt the MongoDB metrics documentation page to reflect the information that all available metrics are streamed. For more information, see Service Instance Metrics.
docs: Application Developer: a9s MongoDB: Update the migration documentation to reflect the current State and include a clear migration path for all supported a9s MongoDB Data Service versions. For more information, see Forking and Migration.
docs: Platform Operator: Add a9s MongoDB 8.0 RC to the "a9s Data Service Release Lifecycle" table. For more information, see a9s Platform Operator - Sunrise Sunset.
docs: Platform Operator: Update the Vendor DS version for MariaDB 10.6 in the "a9s Data Service Release Lifecycle" table. For more information, see a9s Platform Operator - Sunrise Sunset.
docs: Platform Operator: Add the available templates for MongoDB 8.0 RC to the documentation. For more information, see Available Templates.
docs: Platform Operator: Add the required ports for a9s MongoDB 8.0 RC to the documentation. For more information, see Required Ports.
BOSH stemcell: all services: Update Jammy stemcell to version 1.1065 for internal tests of all supported services.

Updated Dependencies

all services:
- a9s Service Dashboard:
  - Update internal dependencies.
- a9s Public API:
  - krakend-custom-plugins to v2.13.1.
  - krakend to v2.13.1.
  - nginx to v1.29.5.
- a9s Smoke Tests: Update internal dependencies.
- bpm to v1.4.26.
- nginx:
  - nginx to v1.29.5.
- routing to v0.366.0.
a9s-pg: a9s PostgreSQL: a9s PostgreSQL 15: Update internal dependencies.
consul-dns: Dnsmasq: Update internal dependencies.
a9s Billing: Update internal dependencies.
a9s KeyValue: a9s Valkey 8: Update internal dependencies.
a9s LogMe2:
- Fluentd:
  - Bump openssl from 3.3.0 to 4.0.0.
  - Bump uri from 1.0.3 to 1.0.4.
  - Update internal dependencies.
- a9s Search: Update internal dependencies.
a9s MariaDB:
- a9s MariaDB 10.6:
  - MariaDB to v10.6.25.
  - Update internal dependencies.
- a9s MariaDB 10.11:
  - MariaDB to v10.11.16.
  - Update internal dependencies.
a9s Messaging:
- a9s Messaging 4:
  - erlang to v27.3.4.8.
  - rabbitmq to v4.2.4.
  - Update internal dependencies.
a9s MongoDB:
- a9s MongoDB 5: Update internal dependencies.
- a9s MongoDB 7:
  - mongodb to v7.0.30.
  - mongosh to v2.7.0.
  - Update internal dependencies.
a9s PostgreSQL:
- a9s PostgreSQL 13:
  - cmake3 to v3.31.11.
  - Update internal dependencies.
- a9s PostgreSQL 15:
  - PostgreSQL to 15.16.
  - Update internal dependencies.
- a9s PostgreSQL 17:
  - PostgreSQL to 17.8.
  - Update internal dependencies.
a9s Prometheus:
- prometheus2:
  - alertmanager to v0.31.1.
  - memcached_exporter to v0.15.5.
  - postgres_exporter to v0.19.0.
  - Update internal dependencies.
- prometheus-legacy:
  - alertmanager to v0.31.1.
  - postgres_exporter to v0.19.0.
  - Update internal dependencies.
- promgraf2:
  - alertmanager to v0.31.1.
  - postgres_exporter to v0.19.0.
  - Update internal dependencies.
a9s Redis: a9s Redis 7: Update internal dependencies.
a9s Search: Update internal dependencies.

Deprecated

a9s Redis®: Deprecation: Deprecate the following Data Service:
- a9s Redis®
The whole Data Service will be discontinued and no new versions will be released for it. Please ensure that you organize the migration of your existing Service Instances to the supported a9s KeyValue Data Service:
- for a9s Redis®: a9s KeyValue 8 is available as GA version.
Existing a9s Redis® Service Instances can be migrated to a9s KeyValue by forking them using the Disaster Recovery feature, or by applying manual migration steps. For more information about the available migration options, please see the Forking and Migration documentation page.

This deprecation follows the announcement in v67.0.0. The deprecation phase is planned to last until v73.0.0 (expected end of May). With that release, the unsupport phase of the deprecated Data Service will start. The creation of new a9s Data Service Instances for this Data Service will be disabled by default in the a9s Data Service Bundle when the unsupport occurs in v76.0.0 (expected end of August) and we will not provide regular support for this Data Service. The corresponding documentation will also be removed. Therefore, we strongly recommend that you start your migrations to a supported Data Service as soon as possible and complete them until the end of the deprecation phase. For more information see a9s Platform Operator Sunrise Sunset.

Fixed

all services: a9s SPIs: Remove the possibility to set undocumented custom parameters during Service Instance creation, that could be used for a command injection attack.
all services: a9s SPIs: Merge SPI's custom parameter config with the Service Plan's custom parameter config, so that the Service Plan's settings can override, but not entirely replace, the SPI's settings.
docs: all services: Fix small typos across both documentation paths.
docs: Application Developer: a9s PostgreSQL: Fix the note admonition in the max_connections custom parameter section by properly closing it. For more information, see a9s PosgreSQL - Custom Parameters - max_connections.

Security

all services:
- a9s Service Dashboard: Fix CVE-2026-1615.
- a9s Smoke Tests:
  - Fix CVE-2025-69419.
  - Fix CVE-2025-69420.
  - Fix CVE-2025-69421.
a9s Billing: Fix CVE-2025-68696.
a9s MongoDB: Fix CVEs:
- CVE-2026-1847
- CVE-2026-1848
- CVE-2026-1849
- CVE-2026-1850
- CVE-2026-25609
- CVE-2026-25610
- CVE-2026-25611
- CVE-2026-25612
- CVE-2026-25613
- CVE-2025-69419
- CVE-2025-69420
- CVE-2025-69421
a9s MongoDB: Hardened custom parameter handling to close code and config injection vulnerabilities.
a9s PostgreSQL: Fix CVEs:
- CVE-2026-2004
- CVE-2026-2005
- CVE-2026-2006
a9s PostgreSQL: Hardened custom parameter handling to close config injection vulnerabilities.

Upcoming

a9s PostgreSQL: End of Support: Terminate support, starting from anynines deployment v73.0.0 (expected end of May 2026), for the following deprecated a9s Data Service version:
- a9s PostgreSQL 13: PostgreSQL 13 is end-of-life by their vendor since November 2025.
The creation of new a9s Data Service Instances for this deprecated version will be disabled by default in the a9s Data Service Bundle, and we will not provide regular support for this version. The corresponding documentation will also be removed.

Although we will not intentionally break running Service Instances of this unsupported version, it cannot be guaranteed that they still work as expected after an update to v73.0.0.

69.0.0

January 27, 2026 · 5 min read

Added

all services: Introduce the "a9s Data Services Experimental Features". This will allow Platform Operators to test out new and upcoming functionality alongside the default anynines-deployment release. For more information, see Experimental Features.
docs: Application Developer: a9s Search: Add an explanation about why the backup size of an a9s Search Service Instance always shows 0 B. For more information, see a9s Search - Backups and Restores Considerations.

Changed

a9s Messaging: Add legacy templates messaging41-* which contain the latest version of RabbitMQ 4.1. Once RabbitMQ 4.3 is supported, these legacy templates will be removed and new templates messaging42-* will be created. These templates provide a last resort rollback to the previous minor version of RabbitMQ, in case there are problems with the latest version of a9s Messaging. For more information, see a9s Messaging - Rollback to Legacy Version.
a9s MongoDB: a9s Backup Agent: Extend the logging of the backup process for Single Service Instances to make information more accessible for debugging purposes.
a9s PostgreSQL: Extend the stop process to execute CHECKPOINT before stopping replication, in order to facilitate the conditions for a graceful shutdown during an update. For more information, see CHECKPOINT.
docs: Application Developer: a9s MariaDB: Update the a9s MariaDB metric table to only include the custom metrics, with an admonition pointing towards the official MariaDB documentation for a detailed description of the available metrics. The full list of available metrics has been added to the "Metrics" summary under said table. For more information, see Service Instance Metrics
docs: Application Developer: a9s Messaging: Add rabbitmq_event_exchange to the available plugins list. For more information, see a9s Messaging - Custom Parameters.
docs: Application Developer: a9s Messaging: Update links on the Metrics page, explain metric formats and remove references to Ghost Queues. For more information, see a9s Messaging - Metrics.
docs: Application Developer: a9s Search: Extend documentation regarding the available plugins, and how any of the bundled plugins of the vendored OpenSearch can be enabled at the discretion of the Platform Operator. For more information, see a9s Search - Custom Parameters.
docs: Platform Operator: a9s LogMe2: Add a "Bundled Plugins" section to the "Resource Considerations" page, describing the imposed restrictions on the Data Service's available plugins. For more information, see a9s LogMe2 - Resource Considerations.
docs: Platform Operator: a9s Search: Extend documentation regarding the bundled plugins of the vendored OpenSearch, specify the ones enabled by default, how all are actually available to be enabled by the Platform Operator, and clarify the limitations and caveats surrounding their use. For more information, see a9s Search - SPI Configuration.
docs: Platform Operator: a9s Search: Refactor the backup size admonition to be reusable across the Application Developer documentation. For more information, see a9s Search - Backups and Restores Considerations.
BOSH stemcell: all services: Update Jammy stemcell to version 1.1028 for internal tests of all supported services.

Updated Dependencies

all services:
- a9s Backup Agent: Bump Ruby gem dependencies.
- a9s BOSH Deployer: Bump Ruby gem dependencies.
- a9s Deployment Updater Errand: Bump Ruby gem dependencies.
- a9s Logstash: a9s Logstash 8: Bump Ruby gem dependencies.
- a9s Public API:
  - krakend-custom-plugins to v2.12.1.
  - krakend to v2.12.1.
  - Update internal dependencies.
- a9s Service Broker: Bump Ruby gem dependencies.
- a9s Service Dashboard:
  - Node.JS to v22.22.0.
  - Update internal dependencies.
- a9s Smoke Tests: Bump Ruby gem dependencies.
- a9s SPIs:
  - Bump Ruby gem dependencies.
- a9s SSO Proxy: Bump Ruby gem dependencies.
- a9s Template Uploader Errand: Bump Ruby gem dependencies.
- bpm to v1.4.24.
- logstash to v8.19.10.
- routing to v0.362.0.
a9s-pg: a9s Logstash: a9s Logstash 8: Bump Ruby gem dependencies.
a9s Backup Services:
- a9s Backup Agent: Bump Ruby gem dependencies.
- a9s Backup Monit: Bump Ruby gem dependencies.
- a9s Logstash: a9s Logstash 8: Bump Ruby gem dependencies.
a9s CF Service Guard: Bump Ruby gem dependencies.
a9s Messaging:
- a9s Messaging 4:
  - erlang to v27.3.4.6.
  - rabbitmq to v4.2.3.
a9s MongoDB:
- a9s MongoDB 5:
  - mongodb to v7.0.28.
- a9s MongoDB 7:
  - mongodb to v5.0.32.
  - mongosh to v2.6.0.
a9s Prometheus:
- prometheus2:
  - alertmanager to v0.30.1.
  - cadvisor to v0.56.2.
- prometheus-legacy:
  - alertmanager to v0.30.1.
  - cadvisor to v0.56.2.
  - memcached_exporter to v0.15.5.
- promgraf2:
  - alertmanager to v0.30.1.
  - cadvisor to v0.56.2.
  - memcached_exporter to v0.15.5.

Fixed

a9s Backup Services: a9s Backup Manager: Fix the task-handler process to avoid deadlocking single Service Instances. This prevents it from immediately rescheduling a backup that is already running, ensuring continuous processing without repeatedly picking the same Service Instance.
a9s MariaDB: a9s Backup Agent: Fix the LOCK TABLES error when restoring an a9s MariaDB backup, by adding --skip-add-locks to the backup's creation command. The function of LOCK TABLES is already covered by the internal restore-prepare step already ensures that no connections are made to MariaDB, which protects the tables as they are being restored.
a9s MongoDB: Set 'no' as default value for the i_agree_with_the_underlying_license_agreement property. Although the license agreement must be accepted in order to deploy the Data Service deployment, a default value is necessary to properly output the error for not accepting the license.
docs: Platform Operator: a9s LogMe2: Fix minor typos. For more information, see a9s LogMe2 - SPI Configuration.

Security

all services:
- a9s Backup Agent: Fix CVE-2025-68696.
- a9s BOSH Deployer: Fix CVE-2025-68696.
- a9s Deployment Updater Errand: Fix CVE-2025-68696.
- a9s Logstash: a9s Logstash 8: Fix CVE-2025-68696.
- a9s Public API: Fix CVEs:
  - CVE-2025-15284
  - CVE-2025-68696
- a9s Service Broker: Fix CVE-2025-68696.
- a9s Service Dashboard: Fix CVEs:
  - CVE-2025-15284
  - CVE-2025-55130
  - CVE-2025-55131
  - CVE-2025-59465
- a9s Smoke Tests: Fix CVE-2025-68696.
- a9s SPIs: Fix CVE-2025-68696.
- a9s SSO Proxy: Fix CVE-2025-68696.
- a9s Template Uploader Errand: Fix CVE-2025-68696.
a9s-pg: a9s Logstash: a9s Logstash 8: Fix CVE-2025-68696.
a9s Backup Services:
- a9s Backup Agent: Fix CVE-2025-68696.
- a9s Backup Monit: Fix CVE-2025-68696.
- a9s Logstash: a9s Logstash 8: Fix CVE-2025-68696.
a9s CF Service Guard: Fix CVE-2025-68696.
a9s MongoDB: Fix CVE-2025-14847.

68.0.0

December 22, 2025 · 8 min read

Added

all services: a9s Service Broker: Add HTTPS port to the Service Brokers of all Data Services.
all services: a9s Service Broker: Add an Ops file that removes the billing configuration in the a9s Service Broker running in offline environments. For more information, see remove-billing-configuration-from-broker.yml.
a9s Backup Manager: Add an internal health‑check endpoint to a9s Backup Manager.
a9s MariaDB: Make the net_read_timeout and net_write_timeout parameters configurable through custom parameters. For more information, see a9s MariaDB.
a9s Prometheus: Introduce a GUID filter to enable the viewing of metrics for one or all Service Instances.
docs: Application Developer: a9s KeyValue: Add information about the upper size limit for values in the Data Service. For more information, see: Object Size Limit.
docs: Application Developer: a9s MariaDB: Add information about the new custom parameters net_read_timeout and net_write_timeout. For more information, see a9s MariaDB.
docs: Application Developer: a9s MariaDB: Add information about the upper size limit for object types in the Data Service. For more information, see: Object Size Limit.
docs: Application Developer: a9s Messaging: Add documentation about verifying the compatibility of new minor updates for a9s Messaging Service Instances and client applications. For more information, see Safely Evaluating RabbitMQ 4.x Minor Updates.
docs: Application Developer: a9s Messaging: Add information about the upper size limit for objects in the Data Service. For more information, see: Object Size Limit.
docs: Application Developer: a9s MongoDB: Add information about the upper size limit for documents in the Data Service. For more information, see: Object Size Limit.
docs: Application Developer: a9s MongoDB: Add a documentation page to describe the configuration and replication behaviour of cluster Service Instances. For more information, see Cluster Replication.
docs: Application Developer: a9s PostgreSQL: Add information about the upper size limit for object types in the Data Service. For more information, see: Object Size Limit.
docs: Application Developer: a9s Search: Add information about the upper size limit for objects in the Data Service. For more information, see: Object Size Limit.
docs: Platform Operator: a9s MariaDB: Add information about the new custom parameters net_read_timeout and net_write_timeout. For more information, see a9s MariaDB.
docs: Platform Operator: a9s PostgreSQL: Add an instruction page on how to enable AppDynamics support. For more information, see a9s PostgreSQL Enable AppDynamics Support

Changed

breaking change all services: a9s Service Broker: Rename the forbid-automatic-update-of-service-instance.yml Ops file to enable-ad-to-manage-maintenance-updates.yml to better align with the underlying functionality.
breaking change all services: a9s Service Broker: Update the billing configuration in the a9s Service Broker to be able to configure multiple billing endpoints. For more information, see UPGRADE - Upgrading to v68.0.0.
breaking change a9s Messaging: Rename templates messaging40* to messaging4*. These templates will always contain the latest supported version of RabbitMQ 4.X.
breaking change a9s Messaging: Rename the reference to the Service Offering from a9s-messaging40 to a9s-messaging4 in the Service Instance manifests.
breaking change a9s Messaging: Rename BOSH release rabbitmq40 to rabbitmq4 and reset its version number (latest version:1.0.2). The latest version of a9s Messaging will always be available with rabbitmq4.
all services: a9s Service Broker: Adapt the response of the endpoint GET /v2/service_usage_events to only include events that are relevant for a9s Billing; transitional events such as CREATING or UPDATING are omitted. This reduces the response size and as a result the size of the usage_data file in offline environments.
all services: Extend the bin/rotate_ca_certificate.rb script to include a parameter for the CA name. For more information, see rotate_ca_certificate.rb.
all services: a9s Service Broker: Extend the response of the endpoint GET /v2/service_instances/:instance_id/service_bindings/:binding_id to also include the credentials.
all services: a9s Template Uploader Errand: Extend the a9s MariaDB templates to allow adding the custom parameters net_read_timeout and net_write_timeout.
a9s Backup Services: a9s Backup Monit: Update graphite metrics to include skipped_metrics, ensuring that failed metric fetches are properly tracked and logged. For more information, see Metrics - General Metrics.
a9s PostgreSQL: Add retry logic for the cloning phase of the node startup to prevent malfunctioning standby nodes.
a9s Prometheus: Add missing metrics dashboards to Grafana for a9s KeyValue, a9s Parachute and a9s Search.
a9s Prometheus: Migrate dashboards from Angular panels to new replacement panels.
docs: all services: Rename a9s Messaging 4.X to a9s Messaging 4 to reflect the transition to minor versioning.
docs: Application Developer: all services: Update the documentation to use the primary/secondary role names and add information about the naming conventions the Data Service vendors use for node roles.
docs: Application Developer: a9s Messaging: Improve the migration documentation. For more information, see Forking and Migration
docs: Application Developer: a9s Messaging: Rename occurrences of a9s-messaging40 to a9s-messaging4.
docs: Application Developer: a9s Messaging: Update the information and examples regarding the provided protocols. For more information, see a9s Messaging - Service Instance Access.
docs: Application Developer: a9s Messaging: Correct wrong plugin names (rabbitmq_webmqtt to rabbitmq_web_mqtt and rabbitmq_webstomp to rabbitmq_web_stomp). For more information, see a9s Messaging - Service Instance Access.
docs: Application Developer: a9s PostgreSQL: Add information about the Sync Property Update feature in relation to max_connections and max_wal_senders. For more information, see:
- Custom Parameters - max_connections.
- Custom Parameters - max_wal_senders.
docs: Platform Operator: Update the TLS documentation to include the root CA a9s_public_components_ca. For more information, see Root CAs.
docs: Platform Operator: all services: Add information about the number of nodes in single and cluster service plans. For more information, see Available Templates.
docs: Platform Operator: all services: Update the documentation to use the primary/secondary role names and add information about the naming conventions the Data Service vendors use for node roles.
docs: Platform Operator: a9s Messaging: Rename occurrences of a9s-messaging40 to a9s-messaging4.
docs: Platform Operator: a9s MongoDB: Reformat the service bindings information for AppDynamics support into an admonition. For more information, see a9s MongoDB Enable AppDynamics Support
docs: Platform Operator: a9s PostgreSQL: Add information about the Sync Property Update feature in relation to max_connections and max_wal_senders. For more information, see:
- Custom Parameters - max_connections.
- Custom Parameters - max_wal_senders.
docs: Platform Operator: a9s Service Broker: Add the HTTPS port for the a9s Service Broker to the documentation. For more information, see Required Ports.
docs: Platform Operator: a9s Service Broker: Describe the new secure communication channel that is provided by the a9s Service Broker. For more information, see Secure HTTPS Endpoint.
BOSH stemcell: all services: Update Jammy stemcell to version 1.999 for internal tests of all supported services.

Updated Dependencies

all services:
- a9s Public API:
  - a9s-beehive to v1.2.3.
  - nginx to v1.29.4.
- a9s Logstash: a9s Logstash 8: logstash8 to v8.19.8.
- a9s Service Dashboard: Update internal dependencies.
- a9s Smoke Tests: CF CLI to v8.17.0.
- a9s Template Uploader to v665.
- bpm to v1.4.23.
- nginx:
  - nginx to v1.29.4.
- routing to v0.355.0.
a9s-pg: Update internal dependencies.
a9s Billing: CF CLI to v8.17.0.
a9s KeyValue: a9s KeyValue 8: valkey to v8.1.5.
a9s Messaging:
- a9s Messaging 4:
  - rabbitmq to v4.1.7.
  - Update internal dependencies.
- a9s Messaging SPI: Update internal dependencies.
a9s MongoDB: a9s MongoDB 7:
- mongodb to v7.0.27.
- mongosh to v2.5.10.
a9s PostgreSQL:
- a9s PostgreSQL 13: Update internal dependencies.
- a9s PostgreSQL 15: Update internal dependencies.
- a9s PostgreSQL 17: Update internal dependencies.
a9s Prometheus:
- prometheus2:
  - alertmanager to v0.30.0
  - blackbox_exporter to v0.28.0.
  - cadvisor to v0.55.0
  - elasticsearch_exporter to v1.10.0
- prometheus-legacy:
  - alertmanager to v0.30.0.
  - blackbox_exporter to v0.28.0.
  - cadvisor to v0.55.0.
  - elasticsearch_exporter to v1.10.0.
- promgraf2:
  - alertmanager to v0.30.0.
  - blackbox_exporter to v0.28.0.
  - cadvisor to v0.55.0.
  - elasticsearch_exporter to v1.10.0.

Fixed

a9s Backup Services: a9s Backup Manager: Fix the listing logic for failed restores. By making it more robust under certain edge cases, the logic will no longer affect the funtionality a9s Service Dashboard.
a9s Backup Services: a9s Backup Manager: Ensure correct transaction handling when syncing deleted Service Instances from the a9s Service Broker.
a9s Backup Services: a9s Backup Manager: Improve the logic through which Service Instances are selected to have their backups deleted, so that all relevant backup files are included in the deletion loop.
a9s CF Service Guard: Harden API validation to ensure that the asg_guid is not missing, and that it is properly synced between the CF Service Guard and Cloud Foundry after an update.
a9s MongoDB: a9s Backup Agent: Fix an issue with performing disaster recovery on Single Service Instances when the restored data contains indexes.
a9s PostgreSQL:
- a9s PostgreSQL 15: Add a Sync Property Update to manage and synchronize updates to the max_connections and max_wal_senders parameters. This enables safe adjustment of their values, both increases and decreases, resolving the previous issues where increasing these parameters caused downtime and decreasing them resulted in update failures.
- a9s PostgreSQL 17: Add a Sync Property Update feature to manage and synchronize updates to the max_connections and max_wal_senders parameters. This enables safe adjustment of their values, both increases and decreases, resolving the previous issues where increasing these parameters caused downtime and decreasing them resulted in update failures.
docs: Platform Operator: a9s MariaDB: Fix the outdated external link to MariaDB's documentation in the binlog_expire_days custom parameter section. For more information, see a9s MariaDB.

Security

all services:
- a9s Public API: a9s Beehive: Fix CVE: CVE-2025-65637
- a9s Service Dashboard: Fix CVEs:
  - CVE-2025-12816
  - CVE-2025-66031
- a9s Smoke Tests: Fix CVE: CVE-2025-22869
a9s-pg: Fix CVE: CVE-2025-22869
a9s Billing: Fix CVE: CVE-2025-22869
a9s PostgreSQL: Fix CVE: CVE-2025-22869

Added​

Changed​

Updated Dependencies​

Deprecated​

Fixed​

Security​

Added​

Changed​

Updated Dependencies​

Removed​

Fixed​

Security​

Added​

Changed​

Updated Dependencies​

Unsupported​

Removed​

Security​

Upcoming​

Added​

Changed​

Updated Dependencies​

Unsupported​

Removed​

Security​

Upcoming​

Changed​

Updated Dependencies​

Deprecated​

Fixed​

Security​

Upcoming​

Fixed​

Added​

Changed​

Updated Dependencies​

Fixed​

Security​

Added​

Changed​

Updated Dependencies​

Deprecated​

Fixed​

Security​

Upcoming​

Added​

Changed​

Updated Dependencies​

Fixed​

Security​

Added​

Changed​

Updated Dependencies​

Fixed​

Security​

Added

Changed

Updated Dependencies

Deprecated

Fixed

Security

Added

Changed

Updated Dependencies

Removed

Fixed

Security

Added

Changed

Updated Dependencies

Unsupported

Removed

Security

Upcoming

Added

Changed

Updated Dependencies

Unsupported

Removed

Security

Upcoming

Changed

Updated Dependencies

Deprecated

Fixed

Security

Upcoming

Fixed

Added

Changed

Updated Dependencies

Fixed

Security

Added

Changed

Updated Dependencies

Deprecated

Fixed

Security

Upcoming

Added

Changed

Updated Dependencies

Fixed

Security

Added

Changed

Updated Dependencies

Fixed

Security