53 posts tagged with "a9s"

View All Tags

73.0.0

May 27, 2026 · 8 min read

Added

a9s-pg: a9s PostgreSQL: a9s PostgreSQL 15: Support BOSH CPI migration by addressing cluster nodes via a9s Consul DNS names instead of static IPs, and by falling back to the BOSH deployment index when node IDs are reassigned during the migration. The feature is opt-in via the a9s-pg/ops/use-consul-dns-names.yml Ops file.
a9s PostgreSQL: Support BOSH CPI migration by addressing cluster nodes via a9s Consul DNS names instead of static IPs, and by falling back to the BOSH deployment index when node IDs are reassigned during the migration. The feature is opt-in via the postgresql-service/ops/use-consul-dns-names.yml Ops file.
docs: Application Developer: Update the Disaster Recovery documentation to specify how to fork from specific backups. For more information, see Disaster Recovery - Retrieve the Backup ID of a specific Backup.
docs: Application Developer: Update the Forking documentation to add additional information regarding forking from a specific backup. For more information, see Forking a Service Instance - Retrieving the Wanted Backup's ID.
docs: Application Developer: a9s Messaging: Add references to the concerns relevant to the upgrade to RabbitMQ 4.3. For more information, see a9s Messaging Concerns.
docs: Platform Operator: a9s Billing: Add the missing prerequisite step in the deployment of a9s Billing to add required databases to a9s-pg. For more information, see a9s Data Services Setup - Deploy a9s Billing.
docs: Platform Operator: a9s Parachute: Update the documentation to add a disclaimer about the intended usage of a9s Parachute. For more information, see a9s Parachute.
docs: Platform Operator: a9s Parachute: Update the documentation to add limitations associated with the use of a9s Parachute for a9s MariaDB. For more information, see a9s Parachute.

Changed

breaking change a9s Backup Services: a9s Backup Manager: Fix duplicate Service Instance entries in the a9s Backup Manager database by adding a uniqueness validation and database constraint for instance_id per broker_id. Duplicate entries could cause backup creation failures and incorrect backup details in the dashboard. For more information, see UPGRADE - Merge Duplicate Service Instances.
a9s Template Uploader Errand: all services: Improve internal upload logic for hardcoded release versions.
a9s Template Uploader Errand: all services: Increased BOSH release version due to internal changes.
a9s Template Uploader Errand: a9s Messaging: Add legacy templates messaging42-* which contain the latest version of RabbitMQ 4.2. Once RabbitMQ 4.4 is supported, these legacy templates will be removed and new templates messaging43-* will be created. These templates provide a last resort rollback to the previous minor version of RabbitMQ, in case there are problems with the latest version of a9s Messaging. For more information, see a9s Messaging - Rollback to Legacy Version.
docs: Application Developer: a9s Messaging: Update documentation to include rabbitmqadmin v2 references. For more information, see: Forking and Migration.
docs: Platform Operator: a9s Messaging: Add warning about rollback limitation for RabbitMQ 4.3 instances. For more information, see: Rollback Limitation for RabbitMQ 4.3 and Later.
BOSH stemcell: all services: Update Jammy stemcell to version 1.1202 for the internal tests of all supported services.

Updated Dependencies

all services:
- bpm to v1.4.31.
- routing to v0.381.0.
- a9s Public API:
  - nginx to v1.31.0.
  - krakend-custom-plugins to v2.13.5.
  - krakend to v2.13.5.
  - Update internal dependencies.
- logstash to v8.19.15.
- nginx:
  - nginx to v1.31.0.
a9s-pg:
- postgresql15 to v15.18.
consul-dns: Dnsmasq: Update internal dependencies.
a9s KeyValue: a9s KeyValue 8: valkey to v8.1.7.
a9s LogMe: Update internal dependencies.
a9s MariaDB:
- a9s MariaDB 10.6:
  - mariadb to v10.6.26.
- a9s MariaDB 10.11:
  - mariadb to v10.11.17.
- Update internal dependencies.
a9s Messaging:
- a9s Messaging 4:
  - RabbitMQ to 4.3.1.
a9s MongoDB:
- a9s MongoDB 5:
  - mongodb to v5.0.33.
- a9s MongoDB 7:
  - mongodb to v7.0.34.
  - mongosh to v2.8.3.
- a9s MongoDB 8:
  - mongosh to v2.8.3.
  - mongodb to v8.0.23.
a9s MySQL: Update internal dependencies.
a9s PostgreSQL:
- a9s PostgreSQL 15:
  - postgresql15 to v15.18.
- a9s PostgreSQL 17:
  - postgresql17 to v17.10.
  - Update internal dependencies.
a9s Prometheus:
- prometheus2:
  - cadvisor to v0.57.0.
  - alertmanager to v0.32.1.
  - bosh_exporter to v3.8.0.
- prometheus-legacy:
  - cadvisor to v0.57.0.
  - alertmanager to v0.32.1.
  - bosh_exporter to v3.8.0.
- promgraf2:
  - cadvisor to v0.57.0.
  - alertmanager to v0.32.1.
  - bosh_exporter to v3.8.0.
- a9s Node Guard:
  - nginx to v1.31.0.
  - Update internal dependencies.
- a9s SSO Proxy:
  - nginx to v1.31.0.
  - Update internal dependencies.
a9s Redis:
- a9s Redis 7: redis to v7.2.14.

Unsupported

a9s PostgreSQL: End of Support: Terminate support for the following deprecated a9s Data Service version:
- a9s PostgreSQL v13: PostgreSQL 13 is end-of-life by their vendor since November 2025
The creation of new a9s Data Service Instances for this deprecated version is now disabled by default in the a9s Data Service Bundle and we no longer provide regular support for this version. The corresponding documentation has been removed.

Although we will not intentionally break running Service Instances of this unsupported version, it cannot be guaranteed that they still work as expected after an update to this release.

Removed

docs: Platform Operator: a9s PostgreSQL: Remove a9s PostgreSQL 13 from the "a9s Data Service Release Lifecycle Table" page. For more information, see a9s Platform Operator Sunrise Sunset - a9s Data Service Release Lifecycle Table.
docs: Platform Operator: a9s Search: Remove the deprecated "Backup and Restores" section from the a9s Search Platform Operator documentation, as that configuration is no longer necessary due to the refactoring of the a9s Backup Agent.

Security

all services:
- a9s Public API:
  - Fix CVE-2026-42945.
  - Fix CVE-2026-42946.
- nginx:
  - Fix CVE-2026-42945.
  - Fix CVE-2026-42946.
a9s-pg:
- Fix CVE-2026-6475.
- Fix CVE-2026-6477.
- Fix CVE-2026-6479.
- Fix CVE-2026-6637.
consul-dns:
- Dnsmasq:
  - Fix CVE-2026-4890.
  - Fix CVE-2026-4891.
  - Fix CVE-2026-4892.
  - Fix CVE-2026-4893.
  - Fix CVE-2026-2291.
  - Fix CVE-2026-5172.
a9s KeyValue: a9s KeyValue 8:
- Fix CVE-2026-23479.
- Fix CVE-2026-23631.
- Fix CVE-2026-25243.
a9s LogMe: a9s Service Broker:
- Fix CVE-2026-34827.
- Fix CVE-2026-34829.
a9s MariaDB:
- a9s MariaDB 10.6:
  - Fix CVE-2026-44168.
- a9s MariaDB 10.11:
  - Fix CVE-2026-44168.
a9s MongoDB:
- a9s MongoDB 5:
  - Fix CVE-2026-8053
- a9s MongoDB 7:
  - Fix CVE-2026-6914.
  - Fix CVE-2026-8053.
  - Fix CVE-2026-8199.
  - Fix CVE-2026-8201.
  - Fix CVE-2026-8843.
- a9s MongoDB 8:
  - Fix CVE-2026-6914.
  - Fix CVE-2026-8053.
  - Fix CVE-2026-8199.
  - Fix CVE-2026-8201.
  - Fix CVE-2026-8843.
a9s MySQL: a9s Service Broker:
- Fix CVE-2026-34827.
- Fix CVE-2026-34829.
a9s PostgreSQL:
- a9s PostgreSQL 17:
  - Fix CVE-2025-70873.
  - Fix CVE-2026-6475.
  - Fix CVE-2026-6476.
  - Fix CVE-2026-6477.
  - Fix CVE-2026-6479.
  - Fix CVE-2026-6637.
- a9s PostgreSQL 15:
  - Fix CVE-2026-6475.
  - Fix CVE-2026-6477.
  - Fix CVE-2026-6479.
  - Fix CVE-2026-6637.
a9s Prometheus:
- a9s Node Guard:
  - Fix CVE-2026-42945.
  - Fix CVE-2026-42946.
- a9s SSO Proxy:
  - Fix CVE-2026-42945.
  - Fix CVE-2026-42946.
a9s Redis: a9s Redis 7:
- Fix CVE-2026-23479.
- Fix CVE-2026-23631.
- Fix CVE-2026-25243.

Upcoming

a9s MariaDB: Deprecation: Prepare for the upcoming deprecation, planned for the release v75.0.0 (expected end of July 2026), of the following a9s Data Service version:
- a9s MariaDB 10.6: MariaDB 10.6 will become end-of-life by their vendor by 6th of July 2026.
Please ensure that you organize the migration of your existing Service Instances to a more up-to-date version of the same a9s Data Service:
- for a9s MariaDB 10.6: a9s MariaDB 10.11 is available as GA version.
The deprecation phase is planned to last until v78.0.0 (expected end of October). With this release, the unsupport phase of the deprecated version will start. The creation of new a9s Data Service Instances for this particular version will be disabled by default in the a9s Data Service Bundle when the unsupport occurs in v81.0.0 (expected end of January 2027) and we will not provide regular support for this version. The corresponding documentation will also be removed. Therefore, we strongly recommend that you start your migrations to a supported GA version as soon as possible and complete them until the end of the deprecation phase. For more information see a9s Platform Operator Sunrise Sunset.
a9s Redis®: End of Support: Terminate support, starting from anynines deployment v76.0.0 (expected end of August 2026).

The whole Data Service will be discontinued and no new versions will be released for it. Please ensure that you organize the migration of your existing Service Instances to the supported a9s KeyValue Data Service:
- for a9s Redis®: a9s KeyValue 8 is available as GA version.
Existing a9s Redis® Service Instances can be migrated to a9s KeyValue by forking them using the Disaster Recovery feature, or by applying manual migration steps. For more information about the available migration options, please see the Forking and Migration documentation page.

The creation of new a9s Data Service Instances for this deprecated Data Service will be disabled by default in the a9s Data Service Bundle, and we will not provide regular support for this Data Service. The corresponding documentation will also be removed.

Although we will not intentionally break running Service Instances of this unsupported Data Service, it cannot be guaranteed that they still work as expected after an update to v76.0.0.

72.0.0

April 28, 2026 · 13 min read

Changed

all services: Update the enable-service-instances-aws-instance-profiles.yml Ops file to extend the list of vm_extensions instead of overwriting it.
all services: a9s Backup Agent: Improve backup connection handling with automatic retries for temporary backup storage errors.
a9s-pg: Update the enable-service-instances-aws-instance-profiles.yml Ops file to extend the list of vm_extensions instead of overwriting it.
a9s Backup Services: Update the enable-backup-services-aws-instance-profiles Ops file to extend the list of vm_extensions for the a9s Backup Manager and a9s Backup Monit instead of overwriting it.
a9s Backup Services: a9s Backup Manager: Improve backup connection handling with automatic retries for temporary backup storage errors.
a9s MongoDB: a9s MongoDB SPI: Consolidate logging into one file.
a9s Service Broker: Instance deletion Rake task now handles potential state inconsistency when communicating with a9s Deployer.
docs: all services: Extend admonitions within the a9s Backup Manager documentation, to explicitly state the limitations of automatic/periodic backups when a Service Instance has been stopped. For more information, see a9s Backup Manager - Properties.
docs: all services: Extend the documentation of the Stop/Start feature, to better explain the current limitations, expected behavior, and extend the cross-referencing within the pages. For more information, see Stop/Start.
docs: Application Developer: a9s Public API: Restructure the API V1 Endpoints page into a new section, divided into subpages by topic. For more information, see API V1 Endpoints.
docs: Platform Operator: a9s Backup Services: Update the examples to use AWS IAM Instance Profiles via Ops file to extend the list of vm_extensions instead of overwriting it. For more information, see Using AWS Instance Profiles.
BOSH stemcell: all services: Update Jammy stemcell to version 1.1183 for internal tests of all supported services.

Updated Dependencies

all services:
- a9s Bee:
  - Update dependencies to resolve GO CVEs.
- a9s Public API:
  - a9s-beehive to v1.2.6.
  - krakend-custom-plugins to v2.13.4.
  - krakend to v2.13.4.
  - nginx to v1.30.0.
  - Update internal dependencies.
- bpm to v1.4.29.
- logstash to v8.19.14.
- nginx:
  - nginx to v1.30.0.
- routing to v0.379.0.
- a9s Backup Agent: Update internal dependencies.
- a9s BOSH Deployer: Update internal dependencies.
- a9s Service Broker: Update internal dependencies.
- a9s Smoke Tests:
  - Update internal dependencies.
- a9s SPIs: Update internal dependencies.
a9s-pg: Update internal dependencies.
a9s Backup Services:
- a9s Backup Manager: Update internal dependencies.
- a9s Backup Monit: Update internal dependencies.
a9s Billing: Update internal dependencies.
a9s CF Service Guard: Update internal dependencies.
a9s MariaDB:
- a9s MariaDB 10.6:
  - Update internal dependencies.
- a9s MariaDB 10.11:
  - Update internal dependencies.
a9s Messaging:
- a9s Messaging 3.8:
  - Update internal dependencies.
- a9s Messaging 3.10:
  - Update internal dependencies.
- a9s Messaging 3.12:
  - Update internal dependencies.
- a9s Messaging 3.13:
  - Update internal dependencies.
- a9s Messaging 4:
  - erlang to v27.3.4.11.
  - rabbitmq to v4.2.6
  - Update internal dependencies.
a9s MongoDB:
- a9s MongoDB 8:
  - mongosh to v2.8.2.
- a9s MongoDB 7:
  - mongosh to v2.8.2.
a9s MySQL:
- a9s MariaDB 10.4:
  - Update internal dependencies.
a9s PostgreSQL:
- a9s PostgreSQL 17:
  - postgresql-info-webservice to v3.8.4
  - Update internal dependencies.
- a9s PostgreSQL 15:
  - postgresql-info-webservice to v3.8.4
  - Update internal dependencies.
- a9s PostgreSQL 13:
  - postgresql-info-webservice to v3.8.4
  - cmake3 to v3.31.12
  - Update internal dependencies.
a9s Prometheus:
- prometheus2:
  - alertmanager to v0.32.0
  - memcached_exporter to v0.16.0
  - influxdb_exporter to v0.12.1
  - Update internal dependencies.
- prometheus-legacy:
  - alertmanager to v0.32.0
  - memcached_exporter to v0.16.0
  - influxdb_exporter to v0.12.1
  - Update internal dependencies.
- promgraf2:
  - alertmanager to v0.32.0
  - memcached_exporter to v0.16.0
  - influxdb_exporter to v0.12.1
  - Update internal dependencies.

Deprecated

breaking change all services: Deprecation: Deprecate the a9s Environment Info service.

The whole a9s Environment Info service will be discontinued and no new versions will be released for it. Please ensure that any internal usage of this component is appropriately removed.

This direct deprecation phase will be followed by immediate removal, planned for the release v73.0.0 (expected end of May 2026). Therefore, we strongly recommend that any and all adjustments are made, if necessary, soon as possible and to complete them before upgrading to v73.0.0.

To inquire about extended support for a deprecated component, please get in contact with our sales department at sales@anynines.com.

Fixed

a9s MongoDB: a9s MongoDB SPI: Introduce a timeout for the Mongo client. This was done to prevent the client from infinitely calling any unreachable MongoDB Service Instance, which would exhaust the SPI VM resources.
docs: Platform Operator: Fix incorrect statements regarding the blocking of Maintenance Updates. Previously, the admonition provided misleading information about the types of updates the feature is concerned with. For more information, see Block Maintenance Updates

Security

all services:
- a9s Backup Agent:
  - Fix CVE-2026-34827.
  - Fix CVE-2026-34829.
all services:
- a9s BOSH Deployer:
  - Fix CVE-2026-34827.
  - Fix CVE-2026-34829.
all services:
- a9s Logstash: Fix CVE-2026-33466.
all services:
- a9s Public API:
  - Fix CVE-2026-34827.
  - Fix CVE-2026-34829.
  - Fix CVE-2026-35611.
all services:
- a9s Service Broker:
  - Fix CVE-2026-34827.
  - Fix CVE-2026-34829.
  - Fix CVE-2026-35611.
all services:
- a9s Service Dashboard:
  - Fix CVE-2026-33937.
  - Fix CVE-2026-33941.
  - Fix CVE-2026-33940.
  - Fix CVE-2026-33939.
  - Fix CVE-2026-33938.
  - Fix CVE-2026-33891.
  - Fix CVE-2026-33895.
  - Fix CVE-2026-33894.
  - Fix CVE-2026-33896.
  - Fix CVE-2026-4800.
all services:
- a9s Smoke Tests:
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
all services:
- a9s Bee:
  - Fix CVE-2026-27140.
  - Fix CVE-2026-27143.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
- a9s SPIs:
  - Fix CVE-2026-34827.
  - Fix CVE-2026-34829.
  - Fix CVE-2026-35611.
a9s-pg:
- Fix CVE-2025-70873.
- Fix CVE-2026-27143.
- Fix CVE-2026-27140.
- Fix CVE-2026-32280.
- Fix CVE-2026-32281.
- Fix CVE-2026-32283.
- Fix CVE-2026-27144.
a9s Backup Services:
- a9s Backup Manager:
  - Fix CVE-2026-34827.
  - Fix CVE-2026-34829.
- a9s Backup Monit:
  - Fix CVE-2026-34827.
  - Fix CVE-2026-34829.
a9s Billing: Fix CVE-2026-22860.
a9s CF Service Guard:
- Fix CVE-2026-34827.
- Fix CVE-2026-34829.
a9s MariaDB:
- a9s MariaDB 10.4:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
- a9s MariaDB 10.6:
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
- a9s MariaDB 10.11:
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
a9s Messaging:
- a9s Messaging 3.8:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
- a9s Messaging 3.10:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
- a9s Messaging 3.12:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
- a9s Messaging 3.13:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
- a9s Messaging 4:
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
a9s MongoDB:
- a9s MongoDB SPI: Fix CVEs:
  - CVE-2026-34829.
  - CVE-2026-34827.
a9s MySQL:
- a9s MariaDB 10.4:
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
a9s PostgreSQL:
- a9s PostgreSQL 17:
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
- a9s PostgreSQL 15:
  - Fix CVE-2025-70873.
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
- a9s PostgreSQL 13:
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
- a9s PostgreSQL 11:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
- a9s PostgreSQL 10:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
a9s Prometheus:
- prometheus2:
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
- prometheus-legacy:
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.
- promgraf2:
  - Fix CVE-2026-27143.
  - Fix CVE-2026-27140.
  - Fix CVE-2026-32280.
  - Fix CVE-2026-32281.
  - Fix CVE-2026-32283.
  - Fix CVE-2026-27144.

Upcoming

a9s Messaging: Version Upgrade with Breaking Changes planned for v73.0.0 (End of May 2026):

Within a9s Messaging 4, RabbitMQ 4.2 will be replaced with RabbitMQ 4.3. There are now Breaking Changes between Minor Versions of RabbitMQ 4, which usually only affect the client side, but require attention. Nevertheless, these RabbitMQ Minor Versions will be released as Minor Versions of a9s Messaging 4.

Due to recent changes in the RabbitMQ release policy, Minor Versions of RabbitMQ 4 now have a maintenance overlap period of 3 months. Previous versions of RabbitMQ 4 did not have any maintenance overlap period.

RabbitMQ 4.2 will be supported by the vendor until the 31st of July.

As a consequence of the Data Service vendor's decision to make the maintenance overlap periods for the open source version of RabbitMQ 4 unusually short, we have decided with the release of a9s Messaging 4 to treat each minor version of RabbitMQ 4 as a minor version of a9s Messaging 4 as well, although some breaking changes between these minor versions may occur.

Therefore we do not follow our usual process for releasing, deprecating and unsupporting these versions as Major Versions: RabbitMQ 4.2 will not be deprecated and unsupported with our default processes, due to the aforementioned situation.

The version upgrade from RabbitMQ 4.2 to 4.3 will be handled as fully automatic in-place upgrade of the a9s Messaging 4 Service Instances, as is currently the case for all minor version upgrades of our Data Services. Thus, RabbitMQ 4.2 will be unsupported, as soon as RabbitMQ 4.3 is available with a9s Data Services.

a9s Data Service will only support one minor version of RabbitMQ 4 (offered as a9s Messaging 4) at any given time.

Please take the necessary steps now to ensure compatibility with the new RabbitMQ Minor Version to be shipped with v73.0.0, which will be released at the end of May 2026.

The following Breaking Changes must be considered and the Recommended Actions must be taken before upgrading to v73.0.0. We recommend to take care of these changes immediately to ensure a smooth transition.
- Classic Queues v1 Storage (CQv1) is Removed
  
  Starting with RabbitMQ 4, all classic queues will be automatically converted to version 2 (CQv2), even if they are defined as version 1 (CQv1). If there are existing version 1 (CQv1) queues, they will be converted at RabbitMQ service start.
  
  RabbitMQ 4.3 removes the original classic queue storage implementation these days known as CQv1. This will lead to all attempts to fail that try to create classic queues with the following parameters:
  - x-queue-mode set to any value
  - x-queue-version set to 1
  All applications or automations that should be adapted to not set those parameters for the declaration of queues.
- Consumer Timeout
  
  Starting with RabbitMQ 4.3, quorum queues will support configurable consumer timeouts. For more information, please see the RabbitMQ 4.3 documentation of the vendor.
  
  In addition to this change, consumer timeouts are removed for classic queues. Therefore, all applications should be evaluated if they depend on the consumer timeouts for classic queues and use quorum queues instead.
- Quorum Queues support unlimited returns
  
  Up to RabbitMQ 4.2, every requeued message incremented its delivery-count by 1, regardless of the reason. Poison message handling would dead-letter the message once this count exceeded the queue's delivery-limit. Starting with RabbitMQ 4.3, quorum queues track two distinct counters: acquired-count and delivery-count.
  
  The delivery limit will based on delivery-count rather than the new header acquired-count. This can lead to unlimited explicit message returns (by nack or AMQP 1.0 modify with delivery_failed=false) without counting towards the delivery limit.
  
  The header x-acquired-count will track the number of times a messages was aquired by a consumer. And x-delivery-count will track the actual number of failed deliveries.
  
  All applications should be evaluated if quorum queues are used with poison message handling and, if required, adapt the application accordingly.
- Khepri is Now The Only Metadata Store
  
  Starting with RabbitMQ 4.3, the Mnesia Storage Engine will be removed in favor of the new Khepri Storage Engine. The Khepri Storage Engine was introduced with RabbitMQ 4.0 and is the new default since RabbitMQ 4.2 for all newly created Service Instances.
  
  All a9s Messaging Service Instance that were updated from a9s Messaging 4.1 (or prior) to 4.2, are still using the Mnesia Storage Engine. If a9s Messaging Service Instances with Mnesia are upgraded to RabbitMQ 4.3, they will automatically migrate their data to the new Khepri Storage Engine on the first start. Even though this process should work without issues, we recommend to use the Strategy to safely evaluate RabbitMQ 4.X minor updates to safely update a9s Messaging Service Instances to RabbitMQ 4.3. Because if those Service Instances would break during the Storage Engine migration process, there could be issues to do a rollback.
  
  With the following command it can be identified if the Khepri Storage Engine is already being used:
```
curl -k -s -u <user>:<pass> 'https://<node-hostname_or_alias>:15672/api/feature-flags' | grep khepri_db
```
  If there is a object with the name khepri_db, then the Khepri Storage Engine is used on the Service Instance.

71.0.1

April 3, 2026 · One min read

Fixed

all services: a9s SPIs: Fix the issue that caused custom parameter configuration set at Service Plan level to be used for all plans, as it overwrote the referenced object in memory as well.

71.0.0

March 30, 2026 · 10 min read

Added

breaking change a9s MongoDB: Introduce a9s MongoDB 8.0 SSPL (Add-on) as an a9s Generally Available (GA). For more information, see a9s Platform Operator - Sunrise Sunset.
all services: a9s Service Broker: Introduce the Beta release of the Stop/Start feature. For more information, see Common Features - Stop/Start Feature.
all services: a9s Public API: Add the Stop/Start feature related endpoints to the a9s Public API V1. For more information, see API V1 Endpoints - Stop/Start.
a9s MongoDB: Add support to configure TLS 1.3 cipher suites via the tls13_cipher_suites custom parameter. This maps to the MongoDB opensslCipherSuiteConfig startup parameter.
a9s MongoDB: a9s MongoDB SPI: Implement the new custom parameter tls13_cipher_suites to support the MongoDB opensslCipherSuiteConfig startup parameter.
a9s PostgreSQL: Create external bootstrap lock to prevent reinitialization of databases already created.
docs: Application Developer: all services: Add initial documentation for the Stop/Start feature. For more information, see Common Features - Stop/Start Feature.
docs: Application Developer: a9s MongoDB: Add an admonition regarding the migration path for the Disaster Recovery feature. For more information, see Forking and Migration.
docs: Application Developer: a9s PostgreSQL: Add references to the external bootstrap lock introduced to the a9s PostgreSQL Continuous Archiving Service Instances. For more information, see Continuous Archiving and Point-in-Time Recovery (PITR) - Data Protection.
docs: Platform Operator: a9s PostgreSQL: Add new section to the PostgreSQL Cluster Recovery documentation explaining the recovery of the external bootstrap lock. For more information, see Cluster Recovery - Recreate bootstrap_initialized.lock File.
docs: Platform Operator: a9s Service Broker: Add initial documentation for the Stop/Start feature. For more information, see Stop/Start Feature.
INTERNAL RELEASE a9s Backup Manager: Add script to find unknown files in the backup storage.

Changed

all services: a9s Beehive: Improve the a9s Bee discovery in a9s Beehive by replacing API calls to a9s Service Broker with a9s Consul.
all services: a9s Deployer: Extend the definition of outdated Service Instances to include stopped Service Instances.
all services: a9s Deployment Updater Errand: Extend the functionality of the update strategy, using the outdated instance type, to skip all stopped Service Instances. The output of the errand has also been extended to reflect this additional Service Instance state. For more information, see a9s Deployment Updater - Update.
all services: a9s Public API: Add Secure attribute to session cookie, which is set after the Oauth Handshake between CF UAA and a9s Public API.
all services: a9s Public API: Extend internal plugin to better handle and sanitize the response from the endpoints that are in communication with the a9s Service Broker.
all services: a9s Service Broker: Improve performance by extending the a9s Service Broker from single threaded to multithreaded. It now able to run up to five threads.
all services: a9s Service Broker: Improve error handling to be more explicit about the error that occurred. This change also extends to concurrency errors.
all services: a9s Service Dashboard: Remove reference to manifest.json to avoid unnecessary API calls to the a9s Public API.
a9s KeyValue: Rename the occurrence of keyvalue to valkey in the enable-service-instances-aws-instance-profiles.yml Ops file.
a9s MongoDB: Enforce SSL communication in internal create-admin and update-admin scripts for a9s MongoDB 8.0 BOSH release.
a9s Prometheus: Add internal configuration to Grafana.
docs: Application Developer: Update the links in the Disaster Recovery documentation to use the latest version of the a9s Cloud Foundry CLI Plugin. For more information, see Disaster Recovery.
docs: Application Developer: a9s PostgreSQL: Move the "PostgreSQL Extensions" section from the "Metrics" page into the "Custom Parameters" page. For more information, see a9s PostgreSQL - Custom Parameters - PostgreSQL Extensions.
docs: Application Developer: a9s PostgreSQL: Refactor the contents of the "Custom Parameters" page to improve readability. For more information, see a9s PostgreSQL - Custom Parameters.
docs: Application Developer: a9s Public API: Extend the API V1 Endpoints documentation with the Stop/Start feature related enpdoints. For more information, see API V1 Endpoints - Stop/Start.
docs: Platform Operator: Rename the occurrence of keyvalue to valkey in the "Extending the a9s Data Services' Templates" section. For more information, see Using AWS Instance Profiles.
BOSH stemcell: all services: Update Jammy stemcell to version 1.1107, for internal tests of all supported services.

Updated Dependencies

all services:
- a9s Backup Agent: Bump Ruby gem dependencies.
- a9s Bee:
  - Update dependencies to resolve CVEs.
- a9s BOSH Deployer: Bump Ruby gem dependencies.
- a9s Dashboard API: Update internal dependencies.
- a9s Public API:
  - a9s-beehive to v1.2.5
  - krakend-custom-plugins to v2.13.3.
  - krakend to v2.13.3.
  - nginx to v1.29.7.
- a9s Service Dashboard:
  - Node.JS to v22.22.2.
  - Update internal dependencies.
- a9s Smoke Tests: Update internal dependencies.
- a9s SPIs: Bump Ruby gem dependencies.
- a9s SSO Proxy: Bump Ruby gem dependencies.
- bpm to v1.4.27.
- logstash to v8.19.12.
- nginx:
  - nginx to v1.29.7.
- routing to v0.370.0.
a9s-pg:
- a9s PostgreSQL: a9s PostgreSQL 15: Update internal dependencies.
- Update internal dependencies.
a9s Backup Services:
- a9s Backup Agent: Bump Ruby gem dependencies.
- a9s Backup Manager: Bump Ruby gem dependencies.
- a9s Backup Monit: Bump Ruby gem dependencies.
a9s Billing: Update internal dependencies.
a9s CF Service Guard: Bump Ruby gem dependencies.
a9s KeyValue: a9s Service Broker: Bump Ruby gem dependencies.
a9s LogMe2:
- a9s Service Broker: Bump Ruby gem dependencies.
- opensearch to v2.19.5.
- opensearch-dashboards to v2.19.5.
- opensearch-plugin-repository-azure to v2.19.5.
- opensearch-plugin-repository-s3 to v2.19.5.
a9s MariaDB:
- a9s MariaDB 10.6:
  - Update internal dependencies.
- a9s MariaDB 10.11:
  - Update internal dependencies.
- a9s Service Broker: Bump Ruby gem dependencies.
a9s Messaging:
- a9s Messaging 4:
  - erlang to v27.3.4.9.
  - rabbitmq to v4.2.5.
  - Update internal dependencies.
- a9s Service Broker: Bump Ruby gem dependencies.
a9s MongoDB:
- a9s MongoDB 7:
  - mongodb to v7.0.31
  - mongosh to v2.8.1.
  - Update internal dependencies.
- a9s MongoDB 8:
  - mongodb to v8.0.20
  - mongosh to v2.8.1.
  - Update internal dependencies.
- a9s Service Broker: Bump Ruby gem dependencies.
a9s PostgreSQL:
- a9s PostgreSQL 13:
  - pgvector to v0.8.2.
- a9s PostgreSQL 15:
  - pgvector to v0.8.2.
  - Update internal dependencies.
- a9s PostgreSQL 17:
  - pgvector to v0.8.2.
  - Update internal dependencies.
- a9s Service Broker: Bump Ruby gem dependencies.
a9s Prometheus:
- a9s Service Broker: Bump Ruby gem dependencies.
- prometheus2:
  - collectd_exporter to v0.7.1.
  - statsd_exporter to v0.29.0.
  - postgres_exporter to v0.19.1.
  - mysqld_exporter to v0.19.0.
  - Update internal dependencies.
- prometheus-legacy:
  - statsd_exporter to v0.29.0.
  - postgres_exporter to v0.19.1.
  - Update internal dependencies.
- promgraf2:
  - collectd_exporter to v0.7.1.
  - statsd_exporter to v0.29.0.
  - postgres_exporter to v0.19.1.
  - mysqld_exporter to v0.19.0.
  - Update internal dependencies.
a9s Redis:
- a9s Redis 7: redis to v7.2.13.
- a9s Service Broker: Bump Ruby gem dependencies.
a9s Search:
- a9s Service Broker: Bump Ruby gem dependencies.
- opensearch to v2.19.5.
- opensearch-dashboards to v2.19.5.
- opensearch-plugin-repository-azure to v2.19.5.
- opensearch-plugin-repository-s3 to v2.19.5.

Fixed

all services: a9s Backup Agent: Fix port configuration in the backup store used for OpenSearch backups. The ports given for backup storages are now used during the creation of OpenSearch backups.
all services: a9s BOSH Deployer: Fix update process of the deployment status. This fixes a failure that caused the a9s Deployer to keep the Service Instance's state as deploying, which prevented further operations from taking place.
all services: a9s Smoke Tests: Fix a9s Smoke Tests issue by choosing the correct App URL based on the "Apps Domain" in the a9s Data Service manifest when multiple Cloud Foundry App domains are configured.
all services: a9s SPIs: Fix parameter parsing to accept Service Plan names with special characters like ..
a9s Backup Services: a9s Backup Manager: Improve cronparser to work more reliabily when triggering automated backups.
a9s MongoDB: a9s MongoDB SPI: Fix the handling of Intermediate Wildcard CAs to ensure the complete CA chain is used to validate the a9s MongoDB Service Instance certificates.
a9s Service Dashboard: Extend error notification when provided by the backend components.
docs: Application Developer: a9s Public API: Fix example API call to update the Service Instance settings via cURL. For more information, see API V1 Endpoints - Update Instance Settings.
docs: Platform Operator: a9s MongoDB: Simplify the manual cluster restore instructions, and fix minor issues in the provided commands. For more information, see Manual Logical Backup Recovery.
INTERNAL RELEASE a9s KeyValue: Fix issue with reconnection to the cluster after the failover on the unit tests.

Security

all services:
- a9s Backup Agent: Fix CVE-2026-22860.
- a9s Bee:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
- a9s BOSH Deployer: Fix CVE-2026-22860.
- a9s Dashboard API:
  - Fix CVE-2026-27601.
  - Fix CVE-2026-26996.
  - Fix CVE-2026-27903.
  - Fix CVE-2026-27904.
  - Fix CVE-2026-32141.
  - Fix CVE-2026-33228.
- a9s Public API:
  - Fix CVE-2026-27601.
  - Fix CVE-2026-26996.
  - Fix CVE-2026-27903.
  - Fix CVE-2026-27904.
  - Fix CVE-2026-32141.
  - Fix CVE-2026-33228.
- a9s Service Dashboard:
  - Fix CVE-2026-27601.
  - Fix CVE-2026-27606.
  - Fix CVE-2026-26996.
  - Fix CVE-2026-27903.
  - Fix CVE-2026-27904.
  - Fix CVE-2026-29063.
  - Fix CVE-2026-29074.
  - Fix CVE-2026-32141.
  - Fix CVE-2026-33228.
- a9s Smoke Tests:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-22860.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
- a9s SPIs: Fix CVE-2026-22860.
- a9s SSO Proxy: Fix CVE-2026-22860.
a9s-pg:
- Fix CVE-2025-4674.
- Fix CVE-2025-58187.
- Fix CVE-2025-58188.
- Fix CVE-2025-61723.
- Fix CVE-2026-25679.
- Fix CVE-2026-27137.
- Fix CVE-2026-27142.
a9s Backup Services:
- a9s Backup Agent: Fix CVE-2026-22860.
- a9s Backup Manager: Fix CVE-2026-22860.
- a9s Backup Monit: Fix CVE-2026-22860.
a9s Billing: Fix CVE-2026-22860.
a9s CF Service Guard: Fix CVE-2026-22860.
a9s KeyValue: a9s Service Broker: Fix CVE-2026-22860.
a9s LogMe2: a9s Service Broker: Fix CVE-2026-22860.
a9s MariaDB:
- a9s MariaDB 10.6:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
- a9s MariaDB 10.11:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
- a9s Service Broker: Fix CVE-2026-22860.
a9s Messaging:
- a9s Messaging 4:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
- a9s Service Broker: Fix CVE-2026-22860.
a9s MongoDB:
- a9s MongoDB 7: Fix CVEs:
  - CVE-2026-4147
  - CVE-2026-4148
- a9s MongoDB 8: Fix CVEs:
  - CVE-2026-4147
  - CVE-2026-4148
- a9s Service Broker: Fix CVE-2026-22860.
a9s PostgreSQL:
- a9s PostgreSQL 13: Fix CVE-2026-3172.
- a9s PostgreSQL 15:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-3172.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
- a9s PostgreSQL 17:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-3172.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
- a9s Service Broker: Fix CVE-2026-22860.
a9s Prometheus:
- a9s Service Broker: Fix CVE-2026-22860.
- prometheus2:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
- prometheus-legacy:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
- promgraf2:
  - Fix CVE-2025-4674.
  - Fix CVE-2025-58187.
  - Fix CVE-2025-58188.
  - Fix CVE-2025-61723.
  - Fix CVE-2026-25679.
  - Fix CVE-2026-27137.
  - Fix CVE-2026-27142.
a9s Redis: a9s Service Broker: Fix CVE-2026-22860.
a9s Search: a9s Service Broker: Fix CVE-2026-22860.

70.0.0

February 24, 2026 · 8 min read

Added

breaking change a9s MongoDB: Introduce a9s MongoDB 8.0 SSPL (Add-on) as an a9s Release Candidate.
all services: a9s Service Broker: Add two new fields, state and locked to the script instance-information.
all services: a9s Template Uploader Errand: Add templates for a9s MongoDB 8.0 SSPL (Add-on).
docs: Application Developer: Add an admonition to notify Application Developers about the deprecation & unsupport of a9s PostgreSQL 13 Data Service. For more information, see a9s PostgreSQL.
docs: Application Developer: Add an admonition to notify Application Developers about the deprecation & unsupport of the a9s Redis® Data Service. For more information, see a9s Redis®.
docs: Platform Operator: Add an admonition to notify Platform Operators about the deprecation & unsupport of the a9s Redis® Data Service. For more information, see a9s Redis®.
docs: Platform Operator: a9s Service Broker: Update the instance-information script documentation to include the new fields, state and locked. For more information, see a9s Service Broker - Retrieve Service Instance Information.

Changed

breaking change all services: a9s Service Broker: Adapt the script instance-information.erb in the a9s Service Broker BOSH release to provide the context of a Service Instance instead of the metadata.
breaking change a9s MongoDB: Update addons/mongodbsspl/ops/add-mongodb-sspl.yml with the following new properties to introduce a9s MongoDB 8.0 SSPL (Add-on) as an a9s Release Candidate:
- mongodb_service.services.a9s-mongodb80.name
- mongodb_service.services.a9s-mongodb80.guid
- mongodb_service.services.a9s-mongodb80.description
- mongodb_service.services.a9s-mongodb80.label
- mongodb_service.services.a9s-mongodb80.version
- mongodb_service.services.a9s-mongodb80.bindable
- mongodb_service.services.a9s-mongodb80.requires
- mongodb_service.services.a9s-mongodb80.tags
- mongodb_service.services.a9s-mongodb80.documentation_url
- mongodb_service.services.a9s-mongodb80.metadata
- mongodb_service.services.a9s-mongodb80.dashboard_client.id
- mongodb_service.services.a9s-mongodb80.plans-to-test
- mongodb_service.services.a9s-mongodb80.planupdates-to-test
all services: a9s Backup Agent: Change the logging level of the a9s Backup Agent's task from error to info for better visibility.
all services: a9s Public API: Extend functionality of the operations endpoints of the Stop/Start Experimental Feature to allow to forward pagination related query parameters. For more information, see Experimental Features - Stop/Start Feature.
all services: a9s Public API: Update CF API v2 calls to v3.
all services: a9s Service Broker: Improve behavior and reliability of the Stop/Start Experimental Feature. For more information, see Experimental Features - Stop/Start Feature.
all services: a9s Service Broker: Update CF API v2 calls to v3.
all services: a9s Smoke Tests: Update CF API v2 calls to v3.
all services: a9s SSO Proxy: Update CF API v2 calls to v3.
a9s MariaDB: a9s Logstash: Transform ON/OFF metrics to 1/0 and include them in the metrics.
a9s Messaging: Move legacy templates from folder messaging41 to messaging4.
a9s MongoDB: a9s Logstash: Stream all available additional metrics that are compatible with the Graphite standard.
a9s MongoDB: a9s MongoDB SPI: Enhance the validation for the ssl_ciphers custom parameter to ensure no malicious strings can be injected into the configuration.
a9s PostgreSQL: a9s PostgreSQL SPI: Enhance the validation for the ssl_ciphers custom parameter to ensure no malicious strings can be injected into the configuration.
docs: Application Developer: a9s MongoDB: Adapt the MongoDB metrics documentation page to reflect the information that all available metrics are streamed. For more information, see Service Instance Metrics.
docs: Application Developer: a9s MongoDB: Update the migration documentation to reflect the current State and include a clear migration path for all supported a9s MongoDB Data Service versions. For more information, see Forking and Migration.
docs: Platform Operator: Add a9s MongoDB 8.0 RC to the "a9s Data Service Release Lifecycle" table. For more information, see a9s Platform Operator - Sunrise Sunset.
docs: Platform Operator: Update the Vendor DS version for MariaDB 10.6 in the "a9s Data Service Release Lifecycle" table. For more information, see a9s Platform Operator - Sunrise Sunset.
docs: Platform Operator: Add the available templates for MongoDB 8.0 RC to the documentation. For more information, see Available Templates.
docs: Platform Operator: Add the required ports for a9s MongoDB 8.0 RC to the documentation. For more information, see Required Ports.
BOSH stemcell: all services: Update Jammy stemcell to version 1.1065 for internal tests of all supported services.

Updated Dependencies

all services:
- a9s Service Dashboard:
  - Update internal dependencies.
- a9s Public API:
  - krakend-custom-plugins to v2.13.1.
  - krakend to v2.13.1.
  - nginx to v1.29.5.
- a9s Smoke Tests: Update internal dependencies.
- bpm to v1.4.26.
- nginx:
  - nginx to v1.29.5.
- routing to v0.366.0.
a9s-pg: a9s PostgreSQL: a9s PostgreSQL 15: Update internal dependencies.
consul-dns: Dnsmasq: Update internal dependencies.
a9s Billing: Update internal dependencies.
a9s KeyValue: a9s Valkey 8: Update internal dependencies.
a9s LogMe2:
- Fluentd:
  - Bump openssl from 3.3.0 to 4.0.0.
  - Bump uri from 1.0.3 to 1.0.4.
  - Update internal dependencies.
- a9s Search: Update internal dependencies.
a9s MariaDB:
- a9s MariaDB 10.6:
  - MariaDB to v10.6.25.
  - Update internal dependencies.
- a9s MariaDB 10.11:
  - MariaDB to v10.11.16.
  - Update internal dependencies.
a9s Messaging:
- a9s Messaging 4:
  - erlang to v27.3.4.8.
  - rabbitmq to v4.2.4.
  - Update internal dependencies.
a9s MongoDB:
- a9s MongoDB 5: Update internal dependencies.
- a9s MongoDB 7:
  - mongodb to v7.0.30.
  - mongosh to v2.7.0.
  - Update internal dependencies.
a9s PostgreSQL:
- a9s PostgreSQL 13:
  - cmake3 to v3.31.11.
  - Update internal dependencies.
- a9s PostgreSQL 15:
  - PostgreSQL to 15.16.
  - Update internal dependencies.
- a9s PostgreSQL 17:
  - PostgreSQL to 17.8.
  - Update internal dependencies.
a9s Prometheus:
- prometheus2:
  - alertmanager to v0.31.1.
  - memcached_exporter to v0.15.5.
  - postgres_exporter to v0.19.0.
  - Update internal dependencies.
- prometheus-legacy:
  - alertmanager to v0.31.1.
  - postgres_exporter to v0.19.0.
  - Update internal dependencies.
- promgraf2:
  - alertmanager to v0.31.1.
  - postgres_exporter to v0.19.0.
  - Update internal dependencies.
a9s Redis: a9s Redis 7: Update internal dependencies.
a9s Search: Update internal dependencies.

Deprecated

a9s Redis®: Deprecation: Deprecate the following Data Service:
- a9s Redis®
The whole Data Service will be discontinued and no new versions will be released for it. Please ensure that you organize the migration of your existing Service Instances to the supported a9s KeyValue Data Service:
- for a9s Redis®: a9s KeyValue 8 is available as GA version.
Existing a9s Redis® Service Instances can be migrated to a9s KeyValue by forking them using the Disaster Recovery feature, or by applying manual migration steps. For more information about the available migration options, please see the Forking and Migration documentation page.

This deprecation follows the announcement in v67.0.0. The deprecation phase is planned to last until v73.0.0 (expected end of May). With that release, the unsupport phase of the deprecated Data Service will start. The creation of new a9s Data Service Instances for this Data Service will be disabled by default in the a9s Data Service Bundle when the unsupport occurs in v76.0.0 (expected end of August) and we will not provide regular support for this Data Service. The corresponding documentation will also be removed. Therefore, we strongly recommend that you start your migrations to a supported Data Service as soon as possible and complete them until the end of the deprecation phase. For more information see a9s Platform Operator Sunrise Sunset.

Fixed

all services: a9s SPIs: Remove the possibility to set undocumented custom parameters during Service Instance creation, that could be used for a command injection attack.
all services: a9s SPIs: Merge SPI's custom parameter config with the Service Plan's custom parameter config, so that the Service Plan's settings can override, but not entirely replace, the SPI's settings.
docs: all services: Fix small typos across both documentation paths.
docs: Application Developer: a9s PostgreSQL: Fix the note admonition in the max_connections custom parameter section by properly closing it. For more information, see a9s PosgreSQL - Custom Parameters - max_connections.

Security

all services:
- a9s Service Dashboard: Fix CVE-2026-1615.
- a9s Smoke Tests:
  - Fix CVE-2025-69419.
  - Fix CVE-2025-69420.
  - Fix CVE-2025-69421.
a9s Billing: Fix CVE-2025-68696.
a9s MongoDB: Fix CVEs:
- CVE-2026-1847
- CVE-2026-1848
- CVE-2026-1849
- CVE-2026-1850
- CVE-2026-25609
- CVE-2026-25610
- CVE-2026-25611
- CVE-2026-25612
- CVE-2026-25613
- CVE-2025-69419
- CVE-2025-69420
- CVE-2025-69421
a9s MongoDB: Hardened custom parameter handling to close code and config injection vulnerabilities.
a9s PostgreSQL: Fix CVEs:
- CVE-2026-2004
- CVE-2026-2005
- CVE-2026-2006
a9s PostgreSQL: Hardened custom parameter handling to close config injection vulnerabilities.

Upcoming

a9s PostgreSQL: End of Support: Terminate support, starting from anynines deployment v73.0.0 (expected end of May 2026), for the following deprecated a9s Data Service version:
- a9s PostgreSQL 13: PostgreSQL 13 is end-of-life by their vendor since November 2025.
The creation of new a9s Data Service Instances for this deprecated version will be disabled by default in the a9s Data Service Bundle, and we will not provide regular support for this version. The corresponding documentation will also be removed.

Although we will not intentionally break running Service Instances of this unsupported version, it cannot be guaranteed that they still work as expected after an update to v73.0.0.

69.0.0

January 27, 2026 · 5 min read

Added

all services: Introduce the "a9s Data Services Experimental Features". This will allow Platform Operators to test out new and upcoming functionality alongside the default anynines-deployment release. For more information, see Experimental Features.
docs: Application Developer: a9s Search: Add an explanation about why the backup size of an a9s Search Service Instance always shows 0 B. For more information, see a9s Search - Backups and Restores Considerations.

Changed

a9s Messaging: Add legacy templates messaging41-* which contain the latest version of RabbitMQ 4.1. Once RabbitMQ 4.3 is supported, these legacy templates will be removed and new templates messaging42-* will be created. These templates provide a last resort rollback to the previous minor version of RabbitMQ, in case there are problems with the latest version of a9s Messaging. For more information, see a9s Messaging - Rollback to Legacy Version.
a9s MongoDB: a9s Backup Agent: Extend the logging of the backup process for Single Service Instances to make information more accessible for debugging purposes.
a9s PostgreSQL: Extend the stop process to execute CHECKPOINT before stopping replication, in order to facilitate the conditions for a graceful shutdown during an update. For more information, see CHECKPOINT.
docs: Application Developer: a9s MariaDB: Update the a9s MariaDB metric table to only include the custom metrics, with an admonition pointing towards the official MariaDB documentation for a detailed description of the available metrics. The full list of available metrics has been added to the "Metrics" summary under said table. For more information, see Service Instance Metrics
docs: Application Developer: a9s Messaging: Add rabbitmq_event_exchange to the available plugins list. For more information, see a9s Messaging - Custom Parameters.
docs: Application Developer: a9s Messaging: Update links on the Metrics page, explain metric formats and remove references to Ghost Queues. For more information, see a9s Messaging - Metrics.
docs: Application Developer: a9s Search: Extend documentation regarding the available plugins, and how any of the bundled plugins of the vendored OpenSearch can be enabled at the discretion of the Platform Operator. For more information, see a9s Search - Custom Parameters.
docs: Platform Operator: a9s LogMe2: Add a "Bundled Plugins" section to the "Resource Considerations" page, describing the imposed restrictions on the Data Service's available plugins. For more information, see a9s LogMe2 - Resource Considerations.
docs: Platform Operator: a9s Search: Extend documentation regarding the bundled plugins of the vendored OpenSearch, specify the ones enabled by default, how all are actually available to be enabled by the Platform Operator, and clarify the limitations and caveats surrounding their use. For more information, see a9s Search - SPI Configuration.
docs: Platform Operator: a9s Search: Refactor the backup size admonition to be reusable across the Application Developer documentation. For more information, see a9s Search - Backups and Restores Considerations.
BOSH stemcell: all services: Update Jammy stemcell to version 1.1028 for internal tests of all supported services.

Updated Dependencies

all services:
- a9s Backup Agent: Bump Ruby gem dependencies.
- a9s BOSH Deployer: Bump Ruby gem dependencies.
- a9s Deployment Updater Errand: Bump Ruby gem dependencies.
- a9s Logstash: a9s Logstash 8: Bump Ruby gem dependencies.
- a9s Public API:
  - krakend-custom-plugins to v2.12.1.
  - krakend to v2.12.1.
  - Update internal dependencies.
- a9s Service Broker: Bump Ruby gem dependencies.
- a9s Service Dashboard:
  - Node.JS to v22.22.0.
  - Update internal dependencies.
- a9s Smoke Tests: Bump Ruby gem dependencies.
- a9s SPIs:
  - Bump Ruby gem dependencies.
- a9s SSO Proxy: Bump Ruby gem dependencies.
- a9s Template Uploader Errand: Bump Ruby gem dependencies.
- bpm to v1.4.24.
- logstash to v8.19.10.
- routing to v0.362.0.
a9s-pg: a9s Logstash: a9s Logstash 8: Bump Ruby gem dependencies.
a9s Backup Services:
- a9s Backup Agent: Bump Ruby gem dependencies.
- a9s Backup Monit: Bump Ruby gem dependencies.
- a9s Logstash: a9s Logstash 8: Bump Ruby gem dependencies.
a9s CF Service Guard: Bump Ruby gem dependencies.
a9s Messaging:
- a9s Messaging 4:
  - erlang to v27.3.4.6.
  - rabbitmq to v4.2.3.
a9s MongoDB:
- a9s MongoDB 5:
  - mongodb to v7.0.28.
- a9s MongoDB 7:
  - mongodb to v5.0.32.
  - mongosh to v2.6.0.
a9s Prometheus:
- prometheus2:
  - alertmanager to v0.30.1.
  - cadvisor to v0.56.2.
- prometheus-legacy:
  - alertmanager to v0.30.1.
  - cadvisor to v0.56.2.
  - memcached_exporter to v0.15.5.
- promgraf2:
  - alertmanager to v0.30.1.
  - cadvisor to v0.56.2.
  - memcached_exporter to v0.15.5.

Fixed

a9s Backup Services: a9s Backup Manager: Fix the task-handler process to avoid deadlocking single Service Instances. This prevents it from immediately rescheduling a backup that is already running, ensuring continuous processing without repeatedly picking the same Service Instance.
a9s MariaDB: a9s Backup Agent: Fix the LOCK TABLES error when restoring an a9s MariaDB backup, by adding --skip-add-locks to the backup's creation command. The function of LOCK TABLES is already covered by the internal restore-prepare step already ensures that no connections are made to MariaDB, which protects the tables as they are being restored.
a9s MongoDB: Set 'no' as default value for the i_agree_with_the_underlying_license_agreement property. Although the license agreement must be accepted in order to deploy the Data Service deployment, a default value is necessary to properly output the error for not accepting the license.
docs: Platform Operator: a9s LogMe2: Fix minor typos. For more information, see a9s LogMe2 - SPI Configuration.

Security

all services:
- a9s Backup Agent: Fix CVE-2025-68696.
- a9s BOSH Deployer: Fix CVE-2025-68696.
- a9s Deployment Updater Errand: Fix CVE-2025-68696.
- a9s Logstash: a9s Logstash 8: Fix CVE-2025-68696.
- a9s Public API: Fix CVEs:
  - CVE-2025-15284
  - CVE-2025-68696
- a9s Service Broker: Fix CVE-2025-68696.
- a9s Service Dashboard: Fix CVEs:
  - CVE-2025-15284
  - CVE-2025-55130
  - CVE-2025-55131
  - CVE-2025-59465
- a9s Smoke Tests: Fix CVE-2025-68696.
- a9s SPIs: Fix CVE-2025-68696.
- a9s SSO Proxy: Fix CVE-2025-68696.
- a9s Template Uploader Errand: Fix CVE-2025-68696.
a9s-pg: a9s Logstash: a9s Logstash 8: Fix CVE-2025-68696.
a9s Backup Services:
- a9s Backup Agent: Fix CVE-2025-68696.
- a9s Backup Monit: Fix CVE-2025-68696.
- a9s Logstash: a9s Logstash 8: Fix CVE-2025-68696.
a9s CF Service Guard: Fix CVE-2025-68696.
a9s MongoDB: Fix CVE-2025-14847.

68.0.0

December 22, 2025 · 8 min read

Added

all services: a9s Service Broker: Add HTTPS port to the Service Brokers of all Data Services.
all services: a9s Service Broker: Add an Ops file that removes the billing configuration in the a9s Service Broker running in offline environments. For more information, see remove-billing-configuration-from-broker.yml.
a9s Backup Manager: Add an internal health‑check endpoint to a9s Backup Manager.
a9s MariaDB: Make the net_read_timeout and net_write_timeout parameters configurable through custom parameters. For more information, see a9s MariaDB.
a9s Prometheus: Introduce a GUID filter to enable the viewing of metrics for one or all Service Instances.
docs: Application Developer: a9s KeyValue: Add information about the upper size limit for values in the Data Service. For more information, see: Object Size Limit.
docs: Application Developer: a9s MariaDB: Add information about the new custom parameters net_read_timeout and net_write_timeout. For more information, see a9s MariaDB.
docs: Application Developer: a9s MariaDB: Add information about the upper size limit for object types in the Data Service. For more information, see: Object Size Limit.
docs: Application Developer: a9s Messaging: Add documentation about verifying the compatibility of new minor updates for a9s Messaging Service Instances and client applications. For more information, see Safely Evaluating RabbitMQ 4.x Minor Updates.
docs: Application Developer: a9s Messaging: Add information about the upper size limit for objects in the Data Service. For more information, see: Object Size Limit.
docs: Application Developer: a9s MongoDB: Add information about the upper size limit for documents in the Data Service. For more information, see: Object Size Limit.
docs: Application Developer: a9s MongoDB: Add a documentation page to describe the configuration and replication behaviour of cluster Service Instances. For more information, see Cluster Replication.
docs: Application Developer: a9s PostgreSQL: Add information about the upper size limit for object types in the Data Service. For more information, see: Object Size Limit.
docs: Application Developer: a9s Search: Add information about the upper size limit for objects in the Data Service. For more information, see: Object Size Limit.
docs: Platform Operator: a9s MariaDB: Add information about the new custom parameters net_read_timeout and net_write_timeout. For more information, see a9s MariaDB.
docs: Platform Operator: a9s PostgreSQL: Add an instruction page on how to enable AppDynamics support. For more information, see a9s PostgreSQL Enable AppDynamics Support

Changed

breaking change all services: a9s Service Broker: Rename the forbid-automatic-update-of-service-instance.yml Ops file to enable-ad-to-manage-maintenance-updates.yml to better align with the underlying functionality.
breaking change all services: a9s Service Broker: Update the billing configuration in the a9s Service Broker to be able to configure multiple billing endpoints. For more information, see UPGRADE - Upgrading to v68.0.0.
breaking change a9s Messaging: Rename templates messaging40* to messaging4*. These templates will always contain the latest supported version of RabbitMQ 4.X.
breaking change a9s Messaging: Rename the reference to the Service Offering from a9s-messaging40 to a9s-messaging4 in the Service Instance manifests.
breaking change a9s Messaging: Rename BOSH release rabbitmq40 to rabbitmq4 and reset its version number (latest version:1.0.2). The latest version of a9s Messaging will always be available with rabbitmq4.
all services: a9s Service Broker: Adapt the response of the endpoint GET /v2/service_usage_events to only include events that are relevant for a9s Billing; transitional events such as CREATING or UPDATING are omitted. This reduces the response size and as a result the size of the usage_data file in offline environments.
all services: Extend the bin/rotate_ca_certificate.rb script to include a parameter for the CA name. For more information, see rotate_ca_certificate.rb.
all services: a9s Service Broker: Extend the response of the endpoint GET /v2/service_instances/:instance_id/service_bindings/:binding_id to also include the credentials.
all services: a9s Template Uploader Errand: Extend the a9s MariaDB templates to allow adding the custom parameters net_read_timeout and net_write_timeout.
a9s Backup Services: a9s Backup Monit: Update graphite metrics to include skipped_metrics, ensuring that failed metric fetches are properly tracked and logged. For more information, see Metrics - General Metrics.
a9s PostgreSQL: Add retry logic for the cloning phase of the node startup to prevent malfunctioning standby nodes.
a9s Prometheus: Add missing metrics dashboards to Grafana for a9s KeyValue, a9s Parachute and a9s Search.
a9s Prometheus: Migrate dashboards from Angular panels to new replacement panels.
docs: all services: Rename a9s Messaging 4.X to a9s Messaging 4 to reflect the transition to minor versioning.
docs: Application Developer: all services: Update the documentation to use the primary/secondary role names and add information about the naming conventions the Data Service vendors use for node roles.
docs: Application Developer: a9s Messaging: Improve the migration documentation. For more information, see Forking and Migration
docs: Application Developer: a9s Messaging: Rename occurrences of a9s-messaging40 to a9s-messaging4.
docs: Application Developer: a9s Messaging: Update the information and examples regarding the provided protocols. For more information, see a9s Messaging - Service Instance Access.
docs: Application Developer: a9s Messaging: Correct wrong plugin names (rabbitmq_webmqtt to rabbitmq_web_mqtt and rabbitmq_webstomp to rabbitmq_web_stomp). For more information, see a9s Messaging - Service Instance Access.
docs: Application Developer: a9s PostgreSQL: Add information about the Sync Property Update feature in relation to max_connections and max_wal_senders. For more information, see:
- Custom Parameters - max_connections.
- Custom Parameters - max_wal_senders.
docs: Platform Operator: Update the TLS documentation to include the root CA a9s_public_components_ca. For more information, see Root CAs.
docs: Platform Operator: all services: Add information about the number of nodes in single and cluster service plans. For more information, see Available Templates.
docs: Platform Operator: all services: Update the documentation to use the primary/secondary role names and add information about the naming conventions the Data Service vendors use for node roles.
docs: Platform Operator: a9s Messaging: Rename occurrences of a9s-messaging40 to a9s-messaging4.
docs: Platform Operator: a9s MongoDB: Reformat the service bindings information for AppDynamics support into an admonition. For more information, see a9s MongoDB Enable AppDynamics Support
docs: Platform Operator: a9s PostgreSQL: Add information about the Sync Property Update feature in relation to max_connections and max_wal_senders. For more information, see:
- Custom Parameters - max_connections.
- Custom Parameters - max_wal_senders.
docs: Platform Operator: a9s Service Broker: Add the HTTPS port for the a9s Service Broker to the documentation. For more information, see Required Ports.
docs: Platform Operator: a9s Service Broker: Describe the new secure communication channel that is provided by the a9s Service Broker. For more information, see Secure HTTPS Endpoint.
BOSH stemcell: all services: Update Jammy stemcell to version 1.999 for internal tests of all supported services.

Updated Dependencies

all services:
- a9s Public API:
  - a9s-beehive to v1.2.3.
  - nginx to v1.29.4.
- a9s Logstash: a9s Logstash 8: logstash8 to v8.19.8.
- a9s Service Dashboard: Update internal dependencies.
- a9s Smoke Tests: CF CLI to v8.17.0.
- a9s Template Uploader to v665.
- bpm to v1.4.23.
- nginx:
  - nginx to v1.29.4.
- routing to v0.355.0.
a9s-pg: Update internal dependencies.
a9s Billing: CF CLI to v8.17.0.
a9s KeyValue: a9s KeyValue 8: valkey to v8.1.5.
a9s Messaging:
- a9s Messaging 4:
  - rabbitmq to v4.1.7.
  - Update internal dependencies.
- a9s Messaging SPI: Update internal dependencies.
a9s MongoDB: a9s MongoDB 7:
- mongodb to v7.0.27.
- mongosh to v2.5.10.
a9s PostgreSQL:
- a9s PostgreSQL 13: Update internal dependencies.
- a9s PostgreSQL 15: Update internal dependencies.
- a9s PostgreSQL 17: Update internal dependencies.
a9s Prometheus:
- prometheus2:
  - alertmanager to v0.30.0
  - blackbox_exporter to v0.28.0.
  - cadvisor to v0.55.0
  - elasticsearch_exporter to v1.10.0
- prometheus-legacy:
  - alertmanager to v0.30.0.
  - blackbox_exporter to v0.28.0.
  - cadvisor to v0.55.0.
  - elasticsearch_exporter to v1.10.0.
- promgraf2:
  - alertmanager to v0.30.0.
  - blackbox_exporter to v0.28.0.
  - cadvisor to v0.55.0.
  - elasticsearch_exporter to v1.10.0.

Fixed

a9s Backup Services: a9s Backup Manager: Fix the listing logic for failed restores. By making it more robust under certain edge cases, the logic will no longer affect the funtionality a9s Service Dashboard.
a9s Backup Services: a9s Backup Manager: Ensure correct transaction handling when syncing deleted Service Instances from the a9s Service Broker.
a9s Backup Services: a9s Backup Manager: Improve the logic through which Service Instances are selected to have their backups deleted, so that all relevant backup files are included in the deletion loop.
a9s CF Service Guard: Harden API validation to ensure that the asg_guid is not missing, and that it is properly synced between the CF Service Guard and Cloud Foundry after an update.
a9s MongoDB: a9s Backup Agent: Fix an issue with performing disaster recovery on Single Service Instances when the restored data contains indexes.
a9s PostgreSQL:
- a9s PostgreSQL 15: Add a Sync Property Update to manage and synchronize updates to the max_connections and max_wal_senders parameters. This enables safe adjustment of their values, both increases and decreases, resolving the previous issues where increasing these parameters caused downtime and decreasing them resulted in update failures.
- a9s PostgreSQL 17: Add a Sync Property Update feature to manage and synchronize updates to the max_connections and max_wal_senders parameters. This enables safe adjustment of their values, both increases and decreases, resolving the previous issues where increasing these parameters caused downtime and decreasing them resulted in update failures.
docs: Platform Operator: a9s MariaDB: Fix the outdated external link to MariaDB's documentation in the binlog_expire_days custom parameter section. For more information, see a9s MariaDB.

Security

all services:
- a9s Public API: a9s Beehive: Fix CVE: CVE-2025-65637
- a9s Service Dashboard: Fix CVEs:
  - CVE-2025-12816
  - CVE-2025-66031
- a9s Smoke Tests: Fix CVE: CVE-2025-22869
a9s-pg: Fix CVE: CVE-2025-22869
a9s Billing: Fix CVE: CVE-2025-22869
a9s PostgreSQL: Fix CVE: CVE-2025-22869

67.0.0

November 25, 2025 · 21 min read

Added

a9s Backup Services: a9s Backup Agent: Introduce a dedicated a9s Parachute v2 plugin that works independently of any a9s Data Service.
docs: Application Developer: a9s Public API: Add an admonition to the documentation about setting the encryption key using the API endpoints. For more information, see API V1 Endpoints.
docs: Platform Operator: a9s Public API: Add resource considerations for the a9s Service Dashboard and a9s Public API regarding the required memory. For more information, see a9s Data Services Resource Considerations.
docs: Platform Operator: a9s Service Dashboard: Add a section to document the behavior of the disable-backup-download.yml Ops file. For more information, see Disable Backup Downloads in the a9s Service Dashboard.
docs: Platform Operator: Service Catalog: Add a section describing the required key usage extensions for a9s LogMe2, a9s MariaDB and a9s Search when using wildcard certificates for TLS Service Plans. For more information, see Wildcard Certificates - Key Usage Extension.

Changed

all services: a9s Public API: Adjust the GET /v1/instances/:instance_id endpoint to keep the response consistent.
all services: a9s Service Broker: Extend the Service Instance database model to better reflect which parameters have been set by the Application Developer and the Platform Operator.
all services: a9s SPIs: Extend the information for each custom parameter available in each Service Plan. This information is used internally by the a9s Service Broker.
a9s Backup Services: a9s Backup Manager: Extend the internal instances database model to store the type of backup that is used, e.g. continuous_archiving or basic backups. This information is used in the a9s Service Dashboard to load the correct form in the UI.
a9s CF Service Guard: Adapt the communication to the a9s Service Broker to handle the new information in the response.
a9s KeyValue: a9s Logstash: Keep streaming Logstash metrics, even when a9s Parachute has been activated.
a9s LogMe2: a9s Logstash: Keep streaming Logstash metrics, even when a9s Parachute has been activated.
a9s Messaging: a9s Logstash: Keep streaming Logstash metrics, even when a9s Parachute has been activated.
a9s MongoDB: a9s Logstash: Keep streaming Logstash metrics, even when a9s Parachute has been activated.
a9s PostgreSQL:
- a9s PostgreSQL 15: a9s Logstash: Keep streaming Logstash metrics, even when a9s Parachute has been activated.
- a9s PostgreSQL 17: a9s Logstash: Keep streaming Logstash metrics, even when a9s Parachute has been activated.
a9s Search: a9s Logstash: Keep streaming Logstash metrics, even when a9s Parachute has been activated.
docs: Application Developer: Clarify that, for Application Developers to be able to block Maintenance Updates, the Platform Operator must enable this feature first. If the Platform Operator does not enable it, the corresponding API endpoint will be inaccessible, and the a9s Service Dashboards of the affected Service Instances will not offer the option to block Maintenance Updates. For more information, see API V1 Endpoints - Update Instance Settings.
docs: Application Developer: a9s Messaging: Add information on how to migrate messages using RabbitMQ shovels. For more information, see a9s Messaging - Forking and Migration.
docs: Application Developer: a9s Messaging: Add page explaining the limitations regarding messages and queue definitions in the context of a9s Messaging's backups. For more information, see a9s Messaging - Known Limitations.
docs: Application Developer: a9s Messaging: Correct metric name messages_unacknowledged_details to messages_unacknowledged_details.rate, as it is emitted by a9s Messaging. For more information, see a9s Messaging - Service Instance Metrics.
docs: Application Developer: a9s Messaging: Update information about High Availability/Quorum Queues. For more information, see Custom Parameters.
docs: Platform Operator: Clarify that disabling the Maintenance Updates feature makes corresponding a9s Service Dashboard's settings and API endpoints inaccessible. For more information, see Maintenance Updates.
docs: Platform Operator: a9s Backup Monit: Add a warning, to explain the some metrics of the a9s Backup Monit are not working correctly for some a9s Data Services, to the "Metrics" section. For more information, see Metrics.
docs: Platform Operator: a9s Parachute: Update documentation to specify which a9s Data Services use a9s Parachute v1, and which ones use a9s Parachute v2. For more information, see:
- a9s Parachute v1
- a9s Parachute v2
docs: Platform Operator: a9s Parachute: Update information on the specific actions that a9s Parachute applies to each a9s Data Service. For more information, see Platform Operator - a9s Parachute v2.
docs: Platform Operator: a9s Public API: Improve the documentation of the a9s Public API. For more information, see a9s Service Dashboard and Public API.
docs: Platform Operator: a9s Service Dashboard: Move the a9s Service Dashboard "Theme Customization" and "Configuration" pages from the a9s Public API documentation into a dedicated section for the a9s Service Dashboard. For more information, see a9s Service Dashboard.
BOSH stemcell: all services: Update Jammy stemcell to version 1.954 for internal tests of all supported services.

Updated Dependencies

all services:
- a9s Public API:
  - krakend-custom-plugins to v2.12.0.
  - krakend to v2.12.0.
  - nginx to v1.29.3.
  - node to v23.11.1.
- a9s Logstash:
  - a9s Logstash 8:
    - Logstash to v8.19.7.
- a9s Service Dashboard: Update internal dependencies.
- a9s Template Uploader to v663.
- bpm to v1.4.22.
- nginx:
  - nginx to v1.29.3.
- routing to v0.352.0.
a9s KeyValue:
- a9s Backup Agent to v147.4.3.
- a9s Parachute 1 to a9s Parachute 2 v1.2.1.
- Ruby gem dependencies minor versions.
a9s LogMe2:
- a9s Backup Agent to v147.4.3.
- a9s Parachute 1 to a9s Parachute 2 v1.2.1.
- opensearch to v2.19.4.
- opensearch-dashboards to v2.19.4.
- opensearch-plugin-repository-azure to v2.19.4.
- opensearch-plugin-repository-s3 to v2.19.4.
a9s MariaDB:
- a9s Parachute 2 to v1.2.1.
- a9s MariaDB 10.6: MariaDB to v10.6.24.
- a9s MariaDB 10.11: MariaDB to v10.11.15.
a9s Messaging:
- a9s Messaging 4:
  - a9s Backup Agent to v147.4.3.
  - a9s Parachute 1 to a9s Parachute 2 v1.2.1.
  - erlang to v26.2.5.16.
  - rabbitmq to v4.1.6.
a9s MongoDB:
- a9s MongoDB 7:
  - a9s Backup Agent to v147.4.3.
  - a9s Parachute 1 to a9s Parachute 2 v1.2.1.
  - mongodb to v7.0.26.
  - mongosh to v2.5.9.
a9s PostgreSQL:
- a9s PostgreSQL 13:
  - cmake3 to v3.31.10.
  - postgresql13 to v13.23.
- a9s PostgreSQL 15:
  - a9s Backup Agent to v147.4.3.
  - a9s Parachute 1 to a9s Parachute 2 v1.2.1.
  - postgresql15 to v15.15.
- a9s PostgreSQL 17:
  - a9s Backup Agent to v147.4.3.
  - a9s Parachute 1 to a9s Parachute 2 v1.2.1.
  - postgresql17 to v17.7.
a9s Prometheus:
- prometheus2:
  - alertmanager to v0.29.0.
  - memcached_exporter to v0.15.4.
- prometheus-legacy:
  - alertmanager to v0.29.0.
  - memcached_exporter to v0.15.4.
- promgraf2:
  - alertmanager to v0.29.0.
  - memcached_exporter to v0.15.4.
a9s Redis: a9s Redis 7: redis to v7.2.12.
a9s Search:
- a9s Backup Agent to v147.4.3.
- a9s Parachute 1 to a9s Parachute 2 v1.2.1.
- opensearch to v2.19.4.
- opensearch-dashboards to v2.19.4.
- opensearch-plugin-repository-azure to v2.19.4.
- opensearch-plugin-repository-s3 to v2.19.4.

Deprecated

a9s PostgreSQL: Deprecation: Deprecate the following a9s Data Service version:
- a9s PostgreSQL 13: PostgreSQL 13 is end-of-life by their vendor since November 2025
Please ensure that you organize the migration of your existing Service Instances to a more up-to-date version of the same a9s Data Service:
- for a9s PostgreSQL 13: a9s PostgreSQL 15 and 17 are available as GA versions
This deprecation follows the announcement in v64.0.0. The deprecation phase is planned to last until v70.0.0 (expected end of February 2026), in which the unsupport phase of the deprecated version will start. The creation of new a9s Data Service Instances for this particular version will then be disabled by default in the a9s Data Service Bundle and we will not provide regular support for this version. The corresponding documentation will also be removed. Therefore, we strongly recommend that you start your migrations to a supported GA version as soon as possible and complete them until the end of the deprecation phase. For more information see a9s Platform Operator - Sunrise Sunset.

To inquire about extended support for a deprecated version, please get in contact with our sales department at sales@anynines.com.

Removed

docs: Application Developer: a9s Messaging: Remove documentation entry about non-existent metric partitioned. For more information, see a9s Messaging - Service Instance Metrics.
docs: Platform Operator: a9s Backup Manager: Remove the obsolete initialize_backup_deletion_job job from the a9s Backup Manager worker's queues list, as it is no longer supported. For more information, see a9s Backup Manager - Queues.

Fixed

a9s Backup Services: a9s Backup Manager: Prevent backups that are running without a registered a9s Backup Agent from blocking the backup queue, by setting them to failed.
a9s Backup Services: a9s Backup Manager: Provide a maintenance task for resolving duplicate entries for the same a9s Service Broker in the a9s Backup Manager Database.
a9s Backup Services: a9s Backup Monit: Fix an issue that was causing the streaming of incorrect data for following metrics: backup_date, minutes_since_last_backup, and last_backup_time_store for a9s Search and a9s LogMe2.
a9s LogMe2: Update a9s Consul TLS properties in the custom Ops file add_service_instances_consul_tls_properties.yml to fix outdated Instance Group names for a9s LogMe2 Service Instances.
a9s LogMe2: a9s Backup Agent: Prevent the a9s Backup Agent from marking a backup as failed prematurely, when the OpenSearch process is busy.
a9s MariaDB: a9s Backup Agent: Set the max_allowed_packet property, used by the mariadb-dump, to match the client configuration. This fixes an issue that can occur when backing up databases that contain binary data (e.g of type longblob).
a9s MariaDB: a9s Backup Agent: Raise an error as soon as a problem occurs when fetching the user databases at the start of the backup process, thus preventing the a9s Backup Manager from incorrectly marking empty backups as done.
a9s Messaging: Remove erroneous parentheses from the Ops file rabbitmq-enable-management-ui-as-route.yml.
a9s Search: a9s Backup Agent: Prevent the Backup Agent from marking a backup as failed prematurely, when the OpenSearch process is busy.
docs: Application Developer: a9s KeyValue: Fix typos and small errors in the "Forking and Migration" page. For more information, see: a9s KeyValue - Forking and Migration.
docs: Platform Operator: Ensure the use of consistent naming regarding the backup-manager-service-instance-id and encryption-key parameters across multiple pages.
docs: Platform Operator: a9s-pg: Improve the description of restores in regards to the manual logical backup recovery of a9s-pg, as well as the associated caveats. For more information, see a9s-pg - Manual Logical Backup Recovery.

Security

all services:
- a9s Service Dashboard: Fix CVE: CVE-2025-64756
- bpm: Fix CVEs:
  - CVE-2025-31133
  - CVE-2025-52565
  - CVE-2025-52881

Upcoming

a9s Messaging: In-Place Version Upgrade with Breaking Changes planned for v69.0.0 (End of January 2026):

Within a9s Messaging 4, RabbitMQ 4.1 will be replaced with RabbitMQ 4.2. There are now Breaking Changes between Minor Versions of RabbitMQ 4, which usually only affect the client side, but require attention. Nevertheless, these RabbitMQ Minor Versions will be released as Minor Versions of a9s Messaging 4.

Due to recent changes in the RabbitMQ release policy, Minor Versions of RabbitMQ 4 now have a maintenance overlap period of 3 months. Previous versions of RabbitMQ 4 did not have any maintenance overlap period.

As a consequence of the Data Service vendor's decision to make the maintenance overlap periods for the open source version of RabbitMQ 4 unusually short, we have decided with the release of a9s Messaging 4 to treat each minor version of RabbitMQ 4 as a minor version of a9s Messaging 4 as well, although some breaking changes between these minor versions may occur.

Therefore we do not follow our usual process for releasing, deprecating and unsupporting these versions as Major Versions: RabbitMQ 4.1 will not be deprecated and unsupported with our default processes, due to the aforementioned situation.

The version upgrade from RabbitMQ 4.1 to 4.2 will be handled as fully automatic in-place upgrade of the a9s Messaging 4 Service Instances, as is currently the case for all minor version upgrades of our Data Services. Thus, RabbitMQ 4.1 will be unsupported, as soon as RabbitMQ 4.2 is available with a9s Data Services.

a9s Data Service will only support one minor version of RabbitMQ 4 (offered as a9s Messaging 4) at any given time. Breaking Changes about future Minor Versions of RabbitMQ will be announced in the Upcoming section of the CHANGELOG to give all customers enough time to prepare for this in-place version upgrade.

This message has the purpose to inform you and recommends to already take the required actions now to be compatible with the new RabbitMQ Minor Version that will be rolled out with v69.0.0 (End of January 2026):

The following Breaking Changes must be considered and the Recommended Actions must be take before upgrading to v69.0.0. We recommend to take care of these changes immediately to ensure a smooth transition.
- Default Value for AMQP 1.0 durable Field.
  
  Starting with RabbitMQ 4.2, if a sending client omits the header section, RabbitMQ assumes the durable field to be false complying with the AMQP 1.0 spec:
  
  <field name="durable" type="boolean" default="false"/>
  
  AMQP 1.0 applications, or client libraries, must set the durable field of the header section to true to mark the message as durable.
  
  The RabbitMQ team recommends client libraries to send messages as durable by default. None of the AMQP 1.0 client libraries maintained by the RabbitMQ team are affected, as they send all messages as durable by default. Some clients however, do not specify in the header when a message is durable, as they expect the RabbitMQ server to set any message as durable by default, if the durable field was not set. This is the behavior with versions previous to RabbitMQ 4.2. This changes in RabbitMQ 4.2, as messages that do not have the durable field specified in the header will be set to transient (durable=false) by default.
  - Scope and Recommendation
    
    These breaking changes only affect the AMQP 1.0 protocol. The difference between the AMQP 1.0 and AMQP 0.9.1 is further explained here.
    
    To verify if the AMQP 1.0 protocol is in use, the following command can be executed on the RabbitMQ Service Instance:
    $ rabbitmq-plugins list -e | grep amqp1_0 E*] rabbitmq_amqp1_0 4.1.4
    If the AMQP 1.0 protocol is used, all used client libraries must be checked to see if they recognize this change and set the durable field by default to true, if the message is durable. Otherwise, a message may be sent without thedurable field specified in the header. Then, this message will be transient, which means it will be lost in case of any server restart, system crash, or power outage (only with classical queues).
    
    If the field is omitted, the client should not be used. For more details, check this Github page.
  - Frequently Asked Questions
    
    Are the messages that I push into a durable (classic) queue still durable after the automated update to RabbitMQ 4.2 or are these new messages now transient by default?
    
    Answer: Messages that have been added as durable before the upgrade (no matter if they are durable because the client set them durable or because the client omitted the durable header field and the server set the message as durable by default) are still durable. Messages that are added after the update that do not have the durable field set by the client will be transient by default.
    
    The client libraries I use set the durability field for each message (i.e. with the official clients) - does this affect me?
    
    Answer: No, if the client sets the durability field for each message, then there is no change in behavior.
    
    What happens after a graceful restart of a RabbitMQ Single Instance , e.g. due to a parameter change, with transient messages inside of durable (classic) queues? Are those lost or not?
    
    Answer: Messages published as transient will be discarded during reboot, even if they were stored in durable queues. This is the default behavior of RabbitMQ that has been there before.
    
    What happens after a graceful restart of a RabbitMQ Cluster, e.g. due to a parameter change, with transient messages inside of durable (classic) queues? Are those lost or not?
    
    Answer: By default, queues are not replicated across cluster nodes. Therefore, messages in these queues are not replicated either. To replicate queues across nodes in a cluster, use a queue type that supports replication (e.g. Quorum Queues). With Quorum Queues, your messages will also be replicated across all cluster nodes.
    
    How is the durability specified with AMQP 0.9.1?
    
    Answer: With AMQP 0.9.1, the durability is determined by the message property delivery mode. This is a required property for each message, therefore nothing changes for the AMQP 0.9.1 protocol. More information about the message properties for AMQP 0.9.1 can be found here.
    
    Is there any queue type that ensures that messages are durable by default?
    
    Answer: Yes, for Quorum queues, all messages are durable by default, regardless of the message's durability setting (transient or persistent).
    
    What happens when I combine non-durable (classic) queues with durable messages and vice versa?
    
    Answer: Queues and messages can be durable or transient. The durability setting of the queues does NOT affect the durability of the messages. A transient message will be lost after a system shutdown, regardless of whether it is in a durable or a transient queue. For more information about queue and message durability, check the RabbitMQ documentation about Durability.
    
    The RabbitMQ documentation states here that support for transient queues will be removed in RabbitMQ 4.0. Why do these changes even matter then?
    
    Answer: There seems to be a discrepancy in the information from the RabbitMQ documentation, as it is still possible to create transient queues which will also disappear after a restart. A transient queue could be for example created like this:
    rabbitmqadmin declare queue name=my-transient-queue durable=false arguments='{"x-queue-type":"classic"}'
    Keep in mind, that this likely to change in the upcoming releases of RabbitMQ.
    
    How can I check if my queues are durable or transient or if I have quorum queues?
    
    Answer: The rabbitmqctl or the rabbitmqadmin CLI tools can be used to check for all queues and their status:
    rabbitmqctl list_queues name durable arguments Timeout: 60.0 seconds ... Listing queues for vhost / ... name durable arguments my-transient-queue false [{"x-queue-type","classic"}] my-quorum-queue true [{"x-queue-type","quorum"}] rabbitmqadmin list queues name durable arguments +--------------------+---------+-----------+ | name | durable | arguments | +--------------------+---------+-----------+ | my-quorum-queue | True | | | my-transient-queue | False | |
- Mandatory Flag in Direct Reply-To
  
  If an AMQP 0.9.1 Direct Reply-To responder (RPC server) publishes with the mandatory flag set, then amq.rabbitmq.reply-to.* is treated as a queue. Whether the requester (RPC client) is still there to consume the reply is not checked at routing time. In other words, if the responder publishes to only this queue name, then the message will be considered "routed" and RabbitMQ will therefore not send a basic.return.
  - Scope and Recommendation
    
    This breaking change only affects the AMQP 0.9.1 protocol. Other protocols are not affected. More information about the difference between AMQP 1.0 and AMQP 0.9.1 is available here. If Direct Reply-To is not used, then the RabbitMQ Instance is also not affected.
    
    It must be checked if RPC Clients are used as publishers and RPC servers are used as consumers. Furthermore it should be checked, if any RPC server is configured to send replies with the mandatory flag set. If this is the case, then the reply message may be lost in case the client disconnects. To mitigate this problem, the client could automatically send the message again in case he disconnects from the message broker.
  - Frequently Asked Questions
    
    What is Direct Reply-To?
    
    Answer: Usually, when using RabbitMQs as a message queue for a client and a RPC server, the client needs to define a reply queue in the message which is then used by the RPC server to send the reply. The name of this queue is stored in the reply-to message header. As creating queues is a quite expensive operation, there is a way for the RPC server to send the answer without a custom queue.
    
    Direct Reply-To eliminates the need for a reply queue. This benefits the request-reply implementations with short-lived queues and transient responses at the cost of giving up all control over how the responses are stored. With Direct Reply-To, RPC clients will receive replies directly from their RPC server, without going through a reply queue. "Directly" here still means going through the same channel and a RabbitMQ node; there is no direct network connection between RPC client and RPC server processes.
    
    How does the client receive the message with Direct Reply-To?
    
    Client-side:
    - Consume from the pseudo-queue amq.rabbitmq.reply-to in no-ack mode.
    - Set the reply-to property in their request message to amq.rabbitmq.reply-to.
    Server:
    - The RPC server will then see a Reply-To property with a generated name. It should publish to the default exchange ("") with the routing key set to this value (i.e. just as if it were sending to a reply queue as usual). The message will then be sent straight to the client consumer.
    Can I use Direct Reply-To with AMQP 1.0?
    
    Answer: Yes, with RabbitMQ 4.2, Direct Reply-To support was added for AMQP 1.0, alongside the existing AMQP 0.9.1 implementation.
    
    What where the Limitations of Direct-Reply-To with RabbitMQ 4.1?
    
    Answer: With RabbitMQ 4.1, Reply messages sent using this mechanism were in general not fault-tolerant; they will be discarded if the client that published the original request subsequently disconnects. The assumption is that an RPC client will reconnect and submit another request in this case. If the RPC server publishes with the mandatory flag set then amq.rabbitmq.reply-to.* is not treated as a queue; i.e. if the server only publishes to this name then the message will be considered "not routed"; a basic.return will be sent if the mandatory flag was set. For more information, see here.
- Very Rarely Used *.cacerts Settings are Removed from rabbitmq.conf
  
  *.cacerts (not to be confused with cacertfile) settings in rabbitmq.conf did not have the expected effect and were removed to eliminate confusion.
  - Scope and Recommendation
    
    By default, a9s Messaging does not use the *.cacerts setting in rabbitmq.conf and it is also not possible to activate this setting using the a9s Messaging SPI. Therefore, customers of anynines are not affected by this change.
- Quorum Queue Metric Changes
  
  Metrics emitted for Ra-based components (quorum queues, Khepri, Stream Coordinator) have changed. Some metrics were removed, many were added, some changed their names. Users relying on Prometheus metrics starting with rabbitmq_raft or rabbitmq_detailed_raft will need to update their dashboards and/or alerts. If the RabbitMQ-Quorum-Queues-Raft dashboard is used, please update it to the latest version for RabbitMQ 4.2 compatibility.
  - Scope and Recommendation
    
    This change only affects metrics that are emitted for observability purposes.
    
    When metrics are collected and dashboards or alerts created based on them (i.e. with a9s Prometheus), then it should be checked if any metrics that are not supported anymore are used. A list of all supported metrics can be found here.
  - Frequently Asked Questions
    
    What are Ra-based components?
    
    Answer: RabbitMQ Ra-based components refer to the elements within RabbitMQ that leverage the Ra library (a robust implementation of the Raft consensus algorithm) to provide distributed, fault-tolerant state machines for highly available messaging features such as quorum queues, stream queues, and metadata storage. More information is available here.
For more detailed information, see the official RabbitMQ 4.2 release notes.
a9s Redis®: Deprecation: Prepare for the upcoming deprecation, planned for the release v70.0.0 (expected end of February 2026):

The whole Data Service will be discontinued and no new versions will be released for it. Please ensure that you organize the migration of your existing Service Instances to the supported a9s KeyValue Data Service:
- for a9s Redis®: a9s KeyValue 8 is available as GA version.
Existing a9s Redis® Service Instances can be migrated to a9s KeyValue by forking them using the Disaster Recovery feature, or by applying manual migration steps. For more information about the available migration options, please see the Forking and Migration documentation page.

The deprecation phase is planned to last until v73.0.0 (expected end of May 2026). With this release, the unsupport phase of the deprecated Data Service will start. The creation of new a9s Data Service Instances for the a9s Redis® Data Service will be disabled by default in the a9s Data Service Bundle, when the unsupport occurs in v76.0.0 (expected end of August 2026) and we will not provide regular support for this Data Service. The corresponding documentation will also be removed. Therefore, we strongly recommend that you start your migration to a supported Data Service as soon as possible and complete it until the end of the deprecation phase. For more information see a9s Platform Operator Sunrise Sunset.

66.0.0

October 28, 2025 · 9 min read

Added

all services: a9s Public API: Introduce a9s Public API as a new framework component combining the functionality of the a9s DS API Gateway and a9s SSO Proxy. This reduces complexity and improves backup download flow. For more information, see a9s Public API.
all services: a9s Public API: Introduce the endpoint PATCH /v1/instances/:instance_id/broker/edit in order to allow Application Developers to more easily block or forbid Maintenance (aka Automatic) Updates. For more information, see API V1 Endpoints - Update Instance Settings.
all services: a9s Service Broker: Introduce the endpoint GET /v2/service_bindings/:binding_id following the specifications set in OSBAPI specification - Fetching a Service Binding.
all services: a9s SPIs: Provide the available custom parameters for each Service Plan. This information is used to comply with the OSBAPI specification to return the configured parameters of a Service Instance or a Service Binding. For more information, see Custom Parameters.
a9s PostgreSQL: Add support to the pg_squeeze extension for a9s PostgreSQL 15 and a9s PostgreSQL 17. For more information, see Metrics - pg_squeeze Requirements and Usage.
a9s PostgreSQL: SPI: Add ability to install pg_squeeze extension using custom parameters, and set the fn_squeezer function, allowing binding users to use the extension.
docs: Application Developer: Add a note clarifying that metrics are only available for a9s Parachute v2. For more information, see a9s Parachute Metrics.
docs: Application Developer: Add information on how to retrieve parameters of a Service Instance. For more information, see Custom Parameters.
docs: Application Developer: Add pg_squeeze to the list of available PostgreSQL extensions and describe its required parameters, usage and limitations. For more information, see Service Instance Metrics - Available Extensions. and Migration Matrix.
docs: Application Developer: a9s Service Dashboard: Add a section to explain the asynchron data retrival behaviour of the a9s Service Dashboard. For more information, see Asynchron Data in the a9s Service Dashboard.
docs: Platform Operator: Add a note clarifying that metrics are only available for a9s Parachute v2. For more information, see a9s Parachute Metrics.
docs: Platform Operator: Add an example on how to rotate the a9s Backup Manager database's encryption salts in the "a9s Data Services Administrative Tasks" page. For more information, see a9s Data Services Administrative Tasks - Rotate database encryption salts.
docs: Platform Operator: Restructure information regarding "Automatic Updates" in a new page with more information about the types of updates, implementation details, blocking capabilities, and important limitations. For more information, see Maintenance Updates.
docs: Platform Operator: a9s Prometheus: Specify ports required for the installation of a9s Prometheus. For more information, see a9s Data Services Installation - Required Ports.
docs: Platform Operator: a9s Service Broker: Add documentation for the new a9s Service Broker property anynines_service_broker.service_broker.redact_parameters. For more information, see a9s Service Broker - Properties.

Changed

breaking change all services: a9s Public API: Extend IaaS config to add Cloud Foundry System Domain Certificate to ensure secure communication between a9s Public API and Cloud Foundry. For more information, see IaaS Configuration Properties - Cloud Foundry Object.
breaking change all services: a9s Public API: Rename the service-dashboard BOSH Instance Group to public-api. This reflects the refactoring of a9s Dashboard API, a9s DS API Gateway, and a9s SSO Proxy into a9s Public API.
all services: a9s Public API: Re-enable the backup download endpoint for a9s Public API v1, after improving the download streaming flow. For more information, see API V1 Endpoints.
all services: a9s Service Dashboard: Restore the use of the backup download endpoint of a9s Public API V1, after re-enabling the endpoint.
a9s CF Service Guard: Enforce stricter code-style checks as part of ongoing security improvements.
docs: Application Developer: Adapt a9s Public API v1 documentation after re-enabling the endpoint for backup downloads. For more information, see API V1 Endpoints.
docs: Application Developer: Adapt the example cURL commands to fetch a new bearer token for each API request. For more information, see API V1 Endpoints.
docs: Application Developer: Clarify the relationship between the backup_id and backup_guid parameters on the "Forking a Service Instance" documentation. For more information, see Forking a Service Instance - Retrieving the Wanted Backup's ID.
docs: Application Developer: Restructure the page "Custom Parameters" for better readability. For more information, see Custom Parameters.
docs: Application Developer: Improve the information regarding Automatic (aka Maintenance) Updates in the Using a9s Service Dashboard page.
docs: Application Developer: a9s Service Dashboard: Update the documentation to contain further informations about the automatic reload feature. For more information, see Automatic Reload.
docs: Platform Operator: Rename mentions of the 'Automatic Updates' and/or 'Available Updates' to 'Maintenance Updates'. These names have been observed to be misleading, hence why they are being gradually replaced. For more information, see Maintenance Updates.
docs: Platform Operator: all services: Update Instance Groups from service-dashboard to public-api. For more information, see Required Ports.
docs: Platform Operator: a9s Parachute: Emphasize that the parachute usage limit should not be set to values >90%. For more information, see Parachute Resource Considerations.
docs: Platform Operator: a9s Public API: Update documentation to reflect changes to a9s Public API. For more information, see a9s Public API.
BOSH stemcell: all services: Update Jammy stemcell to version 1.926 for internal tests of all supported services.

Updated Dependencies

all services:
- a9s DS API Gateway:
  - krakend-custom-plugins to v2.11.2.
  - krakend to v2.11.2.
- a9s SPIs:
  - Update internal dependencies.
- a9s Logstash:
  - a9s Logstash 8:
    - Logstash to v8.19.5.
- nginx:
  - PCRE2 to v10.47.
  - nginx to v1.29.2.
- routing to v0.351.0.
a9s Backup Services:
- a9s Backup Agent: Bump Ruby gem dependencies.
- a9s Backup Manager: Bump Ruby gem dependencies.
- a9s Backup Monit: Bump Ruby gem dependencies.
a9s Billing:
- routing to v0.348.0.
- Bump Ruby gem dependencies.
a9s BOSH Deployer: Bump Ruby gem dependencies.
a9s CF Service Guard: Bump Ruby gem dependencies.
a9s Elasticsearch: a9s Elasticsearch SPI: Bump Ruby gem dependencies.
a9s MongoDB: a9s MongoDB 7: mongodb to v7.0.25.
a9s MySQL: a9s MySQL SPI: Bump Ruby gem dependencies.
a9s PostgreSQL:
- a9s PostgreSQL SPI: Bump Ruby gem dependencies.
- a9s PostgreSQL 13: cmake3 to v3.31.9.
- a9s PostgreSQL 17: tiff4 to v4.7.1.
a9s Prometheus:
- prometheus2:
  - bosh_exporter to v3.7.2.
  - mysqld_exporter to v0.18.0.
  - postgres_exporter to v0.18.1.
- prometheus-legacy:
  - bosh_exporter to v3.7.2.
  - mysqld_exporter to v0.18.0.
  - postgres_exporter to v0.18.1.
- promgraf2:
  - bosh_exporter to v3.7.2.
  - mysqld_exporter to v0.18.0.
  - postgres_exporter to v0.18.1.
a9s Redis: a9s Redis SPI: Bump Ruby gem dependencies.
a9s Service Broker: Bump Ruby gem dependencies.
a9s Smoke Tests: Bump Ruby gem dependencies.
a9s SSO Proxy: Bump Ruby gem dependencies.

Removed

breaking change all services: a9s Dashboard API: Remove the a9s Dashboard API BOSH release in favor of a9s Public API BOSH release.
breaking change all services: a9s DS API Gateway: Remove the a9s DS API Gateway BOSH release in favor of a9s Public API BOSH release.
breaking change all services: a9s Public API: Remove a9s Public API v0 endpoint for backup downloads. You can now use the restored a9s Public API v1 endpoint. For more information, see API V1 Endpoints.
breaking change all services: a9s SSO Proxy: Remove the a9s SSO Proxy BOSH release in favor of the a9s Public API BOSH release.
docs: Platform Operator: Remove the outdated Browser Compatibility section from the a9s Service Dashboard Considerations documentation page.

Fixed

all services: a9s Backup Manager: Fix the restored_from time of Disaster Recovery restores to use the time when source backup file was last modified.
a9s Backup Services: a9s Backup Manager: Ensure that the a9s Backup Manager selects the proper backup store for retrieving backup files when performing a Disaster Recovery in a Two Sites Two Backup Stores setup. For more information, see Disaster Recovery - Two Sites Two Backup Stores.
a9s PostgreSQL: a9s PostgreSQL 17: Revert min_wal_size and max_wal_size to their original default value, 80MB and 1GB, respectively. The default values of the parameters are being reverted, so that smaller plans do not consume more resources than necessary during data manipulation processes.
docs: Application Developer: Fix the default value of the max_replication_slots custom parameter, and clarify its description. Update the documented default value of max_replication_slots to 0, as the previous value was incorrectly stated in the documentation. For more information, see max_replication_slots.
docs: Platform Operator: a9s KeyValue: Fix the documented modifiable value of the custom parameters repl-backlog-size, min-replicas-to-write, and min-replicas-max-lag. For more information, see a9s KeyValue SPI Configuration.
docs: Platform Operator: a9s LogMe2: Fix the documented default value of thejava_maxmetaspace custom parameter. For more information, see a9s LogMe2 SPI Configuration.
docs: Platform Operator: a9s MariaDB: Fix the documented modifiable value of the databases custom parameter. For more information, see a9s MariaDB SPI Configuration.

Security

a9s Backup Services:
- a9s Backup Agent:
  - CVE-2025-61919
  - CVE-2025-61770
  - CVE-2025-61771
  - CVE-2025-61772
- a9s Backup Manager:
  - CVE-2025-61919
  - CVE-2025-61770
  - CVE-2025-61771
  - CVE-2025-61772
- a9s Backup Monit: Fix CVEs:
  - CVE-2025-59830
a9s Billing:
- CVE-2025-24293
- CVE-2025-59830
- CVE-2025-61919
- CVE-2025-61770
- CVE-2025-61771
- CVE-2025-61772
a9s BOSH Deployer:
- CVE-2025-61919
- CVE-2025-61770
- CVE-2025-61771
- CVE-2025-61772
a9s CF Service Guard:
- CVE-2025-61919
- CVE-2025-61770
- CVE-2025-61771
- CVE-2025-61772
a9s Elasticsearch:
- a9s Elasticsearch SPI: Fix CVEs:
  - CVE-2025-59830
  - CVE-2025-61919
  - CVE-2025-61770
  - CVE-2025-61771
a9s KeyValue:
- a9s KeyValue SPI: Fix CVEs:
  - CVE-2025-61770
  - CVE-2025-61771
  - CVE-2025-61772
  - CVE-2025-61919
- a9s Valkey 8: Fix CVEs:
  - CVE-2025-49844
  - CVE-2025-46817
  - CVE-2025-46818
  - CVE-2025-46819
a9s LogMe2:
- a9s LogMe2 SPI: Fix CVEs:
  - CVE-2025-59830
  - CVE-2025-61770
  - CVE-2025-61771
  - CVE-2025-61772
  - CVE-2025-61919
a9s MariaDB:
- a9s MariaDB SPI: Fix CVEs:
  - CVE-2025-61770
  - CVE-2025-61771
  - CVE-2025-61772
  - CVE-2025-61919
a9s Messaging:
- a9s Messaging SPI: Fix CVEs:
  - CVE-2025-59830
  - CVE-2025-61770
  - CVE-2025-61771
  - CVE-2025-61772
  - CVE-2025-61919
a9s MongoDB:
- a9s MongoDB SPI: Fix CVEs:
  - CVE-2025-59830
  - CVE-2025-61770
  - CVE-2025-61771
  - CVE-2025-61772
  - CVE-2025-61919
a9s MySQL:
- a9s MySQL SPI: Fix CVEs:
  - CVE-2025-59830
  - CVE-2025-61919
  - CVE-2025-61770
  - CVE-2025-61771
  - CVE-2025-61772
a9s PostgreSQL:
- a9s PostgreSQL SPI: Fix CVEs:
  - CVE-2025-61919
  - CVE-2025-61770
  - CVE-2025-61771
  - CVE-2025-61772
a9s Prometheus:
- a9s Prometheus SPI:
  - CVE-2025-61770
  - CVE-2025-61771
  - CVE-2025-61772
  - CVE-2025-61919
a9s Redis:
- a9s Redis SPI: Fix CVEs:
  - CVE-2025-59830
  - CVE-2025-61770
  - CVE-2025-61771
  - CVE-2025-61772
  - CVE-2025-61919
- a9s Redis 7: Fix CVEs:
  - CVE-2025-49844
a9s Search:
- a9s Search SPI: Fix CVEs:
  - CVE-2025-61770
  - CVE-2025-61771
  - CVE-2025-61772
  - CVE-2025-61919
a9s Service Broker:
- CVE-2025-61919
- CVE-2025-61770
- CVE-2025-61771
- CVE-2025-61772
a9s Smoke Tests:
- CVE-2025-61919
- CVE-2025-61770
- CVE-2025-61771
- CVE-2025-61772
a9s SSO Proxy:
- CVE-2025-61919
- CVE-2025-61770
- CVE-2025-61771
- CVE-2025-61772

65.0.0

September 22, 2025 · 6 min read

Added

all services: a9s Service Broker: Introduce the endpoint GET /v2/service_instances/:instance_id following the specifications set in OSBAPI specification - Fetch a Service Instance. This endpoint is used to retrieve the configuration parameters of a Service Instance that have been set or changed by the Application Developer, via the Cloud Foundry CLI. This feature is currently available only for a9s PostgreSQL.
a9s LogMe2: Add logstash8 to a9s LogMe2 Data Service Instances.
a9s PostgreSQL: SPI: Provide the available custom parameters for each Service Plan. This information is used to comply with the OSBAPI specification to return the configured parameters of a Service Instance.
docs: Platform Operator: a9s Search: Add an explanation why the backup size of an a9s Search Service Instance always shows 0 B and why this does not indicate a failure of the backup process. For more information, see a9s Search - Backups and Restores.

Changed

breaking change all services: a9s Backup Manager: Adapt the Ops files backup-service-without-backup-monit.yml and enable-backup-manager-audit-logs.yml to use the latest a9s Logstash 8 version. The variable audit_endpoints must be adapted to comply with the new format that is described in the Audit Logs documentation page.
breaking change all services: a9s Service Broker: Update the Ops file enable-service-broker-audit-logs.yml to use the a9s Logstash 8 version. The variable audit_endpoints must be adapted to comply with the new format that is described in the Audit Logs documentation page.
all services: a9s Backup Agent: Divert the health logs from INFO to DEBUG, to reduce noise in the main logs.
all services: a9s Service Broker: Enable instances_retrievable in the a9s Service Broker catalog for all Service Offerings.
docs: Application Developer: Remove a9s LogMe2 from the exception list of a9s Data Services using the legacy format to stream logs to Syslog endpoints. For more information, see Add a Syslog Endpoint.
docs: Application Developer: Update the documentation on how to configure Syslog endpoints to better reflect the current settings. For more information, see Add a Syslog Endpoint.
docs: Platform Operator: Add a warning admonition explaining the impact of expired leaf certificates on a9s Data Service Framework components. For more information, see Secure Communication with TLS - a9s Data Service Framework Components.
docs: Platform Operator: Add an information admonition describing the downtime an Application Developer might face when a Platform Operator performs a leaf certificate rotation. For more information, see Certificate Rotation.
docs: Platform Operator: Update the "Audit Logs" documentation page to comply with the format used by a9s Logstash 8. For more information, see Audit Logs.
docs: Platform Operator: a9s Template Uploader Errand: Correct misleading information about global_syslog_endpoints parameter. For more information, see Template Uploader Errand.
BOSH stemcell: all services: Update Jammy stemcell to version 1.906 for internal tests of all supported services.
INTERNAL RELEASE all services: a9s BOSH Deployer: Refactor internal components.
INTERNAL RELEASE all services: a9s DS API Gateway: Refactor internal endpoints.
INTERNAL RELEASE all services: a9s Service Broker: Refactor internal components.
INTERNAL RELEASE all services: a9s SSO Proxy: Refactor internal components.
INTERNAL RELEASE a9s KeyValue: SPI: Refactor internal endpoints.
INTERNAL RELEASE a9s MariaDB: SPI: Refactor internal endpoints.
INTERNAL RELEASE a9s Redis®*: SPI: Refactor internal endpoints.

Updated Dependencies

all services:
- a9s Logstash:
  - a9s Logstash 8:
    - Logstash to v8.19.3.
- nginx:
  - PCRE2 to v10.46.
- routing to v0.346.0.
a9s Messaging:
- a9s Messaging 3.13:
  - erlang to v26.2.5.15.
- a9s Messaging 4:
  - rabbitmq to v4.1.4.
  - erlang to v26.2.5.15.
a9s MongoDB:
- a9s MongoDB 7:
  - mongodb to v7.0.24.
  - mongosh to v2.5.8.

Unsupported

a9s Messaging: End of Support: Terminate support for the following deprecated a9s Data Service versions:
- a9s Messaging 3.12: RabbitMQ 3.12 is end-of-life by their vendor since June 2024
- a9s Messaging 3.13: RabbitMQ 3.13 is end-of-life by their vendor since Sept 2024
The creation of new a9s Data Service Instances for these deprecated versions is now disabled by default in the a9s Data Service Bundle and we no longer provide regular support for these versions. The corresponding documentation has been removed.

Although we will not intentionally break running Service Instances of these unsupported versions, it cannot be guaranteed that they still work as expected after an update to this release.

Removed

docs: all services: Remove outdated information about a9s Messaging 3.12 and a9s Messaging 3.13 within the scope of unsupporting a9s Messaging 3.12 and a9s Messaging 3.13.

Fixed

all services: a9s Smoke Tests: Improve the clean-up process to ensure that all applications pushed to Cloud Foundry are deleted once the a9s Smoke Tests have finished.
all services: a9s SPIs: Fix the validation of Graphite and legacy Syslog endpoints to only accept hosts in the recommended host:port format. Any other forms, such as username:password@host:port, will be rejected. For more information, see Set Up Monitoring.
a9s MariaDB: a9s MariaDB SPI: Create the default database when the Service Instance is created, instead of when the first Service Binding is created.
maintenance: Since the release of anynines-deployment v49.0.0, the wrong Redis® license had been included in the OSDF file. The Redis® Source Available License was included, even though it is not valid for Redis® 7.2.X and earlier versions. The Open.Source.Disclosure.File.txt file has been fixed to only include the correct BSD3 licence for Redis®.
docs: all services: Adapt certain admonitions to fix a visualization issue in light-mode which caused the text of code-blocks to be the same color as the background.
docs: Application Developer: Fix a broken admonition in the "Forking a Service Instance" page of the "Common Features" section. For more information, see Forking a Service Instance.
docs: Platform Operator: Fix a typo in the "a9s Data Service Release Lifecycle" table where a9s Messaging 4 was named a9s Messaging 4.0. For more information, see a9s Platform Operator - Sunrise Sunset.
docs: Platform Operator: Update the example Ops file in the "Security Logs" page to use a9s Logstash 8 instead of a9s Logstash 6. For more information, see Security Logs.
docs: Platform Operator: a9s Smoke Tests: Fix the description of the required ports used by the metrics streaming tests in a9s Smoke Tests. For more information, see Required Ports - smoke-tests.

Added​

Changed​

Updated Dependencies​

Unsupported​

Removed​

Security​

Upcoming​

Changed​

Updated Dependencies​

Deprecated​

Fixed​

Security​

Upcoming​

Fixed​

Added​

Changed​

Updated Dependencies​

Fixed​

Security​

Added​

Changed​

Updated Dependencies​

Deprecated​

Fixed​

Security​

Upcoming​

Added​

Changed​

Updated Dependencies​

Fixed​

Security​

Added​

Changed​

Updated Dependencies​

Fixed​

Security​

Added​

Changed​

Updated Dependencies​

Deprecated​

Removed​

Fixed​

Security​

Upcoming​

Added​

Changed​

Updated Dependencies​

Removed​

Fixed​

Security​

Added​

Changed​

Updated Dependencies​

Unsupported​

Removed​

Fixed​

Added

Changed

Updated Dependencies

Unsupported

Removed

Security

Upcoming

Changed

Updated Dependencies

Deprecated

Fixed

Security

Upcoming

Fixed

Added

Changed

Updated Dependencies

Fixed

Security

Added

Changed

Updated Dependencies

Deprecated

Fixed

Security

Upcoming

Added

Changed

Updated Dependencies

Fixed

Security

Added

Changed

Updated Dependencies

Fixed

Security

Added

Changed

Updated Dependencies

Deprecated

Removed

Fixed

Security

Upcoming

Added

Changed

Updated Dependencies

Removed

Fixed

Security

Added

Changed

Updated Dependencies

Unsupported

Removed

Fixed