Skip to main content

58 posts tagged with "anynines-deployment"

View All Tags

76.0.0

· 9 min read

Added​

  • a9s PostgreSQL: Allow new fine-tuning parameter configuration via custom parameters. Supported parameters are
    • autovacuum_vacuum_scale_factor
    • autovacuum_analyze_scale_factor
    • autovacuum_vacuum_insert_scale_factor
    • autovacuum_work_mem
    • autovacuum_max_workers
    • autovacuum_vacuum_cost_delay
    • vacuum_cost_limit
    • min_wal_size
    • max_wal_size
    • checkpoint_timeout
    • checkpoint_completion_target
    • default_statistics_target
    • log_checkpoints
    • log_lock_waits
    • log_autovacuum_min_duration For more information see a9s PostgreSQL - Configuration Parameters.
  • a9s Template Uploader Errand: a9s Prometheus: Add the a9s Prometheus 3 Data Service templates.
  • a9s Template Uploader Errand: Support new custom parameters for a9s PostgreSQL fine-tuning configuration.
  • docs: Application Developer: a9s PostgreSQL: Document how to use new fine-tuning parameters via custom parameters. For more information see a9s PostgreSQL - Configuration Parameters.
  • docs: Application Developer: a9s Prometheus: Create a migration guide to provide information on how to migrate a9s Prometheus 2 dashboards to the new a9s Prometheus 3 Service Instances. For more information, see a9s Prometheus - Migration.
  • docs: Platform Operator: all services: Introduce the Architecture section to describe the general architecture of the a9s Data Services Framework, in particular its deployment topology and network design. For more information, see Getting Started - Architecture.
  • docs: Platform Operator: a9s Billing: Add documentation on how to manage Service Plan pricing in a9s Billing. For more information, see Supporting Services - a9s Billing - Manage Plans.
  • docs: Platform Operator: a9s PostgreSQL: Document how to enable new fine-tuning parameters at the service plan level. For more information, see a9s PostgreSQL - SPI Configuration.
  • docs: Platform Operator: a9s Prometheus: Document considerations to migrate a9s Prometheus 2 Service Instances to the new a9s Prometheus 3. For more information, see a9s Prometheus - Migration Considerations.

Changed​

  • breaking change docs: Platform Operator: all services: Restructure the anynines Data Services Framework Installation Guide from a monolith page into a full-fledged section with dedicated page for every major step. For more information, see Getting Started - a9s Data Services Installation.
  • breaking change a9s Prometheus: Introduce a9s Prometheus 3, with Grafana 13, as the latest Beta (non-GA) version. Starting from Prometheus 3, credentials (such as Authorization header, basic auth, bearer token, OAuth2, and configured headers) are no longer forwarded when following a redirect to a different host. This can affect the authentication if the remote_write or custom scrape_configs are set to an endpoint behind a load balancer or proxy that does a 302 redirection to another host.
  • all services: a9s Public API: Adapt the colocated nginx to serve the a9s Service Dashboard. Previously, the a9s Service Dashboard was served by the now-removed a9s Dashboard API component.
  • a9s-pg: a9s PostgreSQL: a9s PostgreSQL 15: Bump BOSH release version to 2.34.0.
  • a9s Billing: Make the dependency on a9s Consul optional, allowing for it to be deployed independently.
  • a9s MariaDB: a9s MariaDB SPI: Extend the validation of the custom parameter databases to permit whitespaces.
  • docs: all services: Extend cross-referencing across the entire documentation and update links accordingly.
  • docs: all services: Improve the Introduction page of the anynines Data Services Framework documentation, by including an overview of the Framework and its core capabilities, key concepts, and a summary of the documentation's structure. For more information, see Intro.
  • docs: all services: Improve the organization of information regarding the available templates, the overall footprint and resource requirements for all a9s Data Services and their Service Instances. For more information, see Available Templates.
  • docs: Application Developer: a9s KeyValue: Update the master_link_status and role metrics documentation to reflect that they are exposed as integer values instead of text. For more information, see a9s KeyValue - Metrics.
  • docs: Application Developer: a9s Prometheus: Add a warning about the upcoming unsupport of the a9s Prometheus 2 Data Service. For more information, see a9s Prometheus
  • docs: Application Developer: a9s Prometheus: Update screenshots and information to reflect a9s Prometheus 3.
  • docs: Application Developer: a9s Prometheus: Update the documentation to include information about the new Prometheus 3 version. For more information, see Application Developer - a9s Prometheus.
  • docs: Platform Operator: a9s Billing: Extend the existing a9s Billing documentation to better describe its function, configuration, and API usage. For more information, see Supporting Services - a9s Billing.
  • docs: Platform Operator: a9s Prometheus: Add information about the a9s Prometheus 3 templates in the Service Catalog. For more information, see Service Catalog - Available Templates.
  • docs: Platform Operator: a9s Prometheus: Update the documentation to include information about the new Prometheus 3 version in the "a9s Data Service Release Lifecycle Table" section. For more information, see a9s Platform Operator Sunrise Sunset - a9s Data Service Release Lifecycle Table.
  • BOSH stemcell: all services: Update Jammy stemcell to version 1.1364 for internal tests of all supported services.

Updated Dependencies​

  • all services:
    • bpm to v1.4.37.
    • logstash to v8.19.20.
    • routing to v0.391.0.
    • a9s Public API:
      • a9s-beehive to v1.2.15.
    • a9s Service Dashboard: Update internal dependencies.
  • a9s-pg:
    • postgresql15 to v15.19.
    • sqlite3 to v3.53.4.
  • a9s Billing: Update internal dependencies.
  • a9s MariaDB:
    • a9s MariaDB 10.6:
      • mariadb to v10.6.27.
    • a9s MariaDB 10.11:
      • mariadb to v10.11.18.
  • a9s Messaging:
    • a9s Messaging 4:
      • erlang to v27.3.4.16.
      • rabbitmq to v4.3.4.
  • a9s MongoDB:
    • a9s MongoDB 7:
      • mongodb to v7.0.40.
    • a9s MongoDB 8:
      • mongosh to v2.10.0.
      • mongodb to v8.0.29.
  • a9s PostgreSQL:
    • a9s PostgreSQL 17:
      • sqlite3 to v3.53.4.
    • a9s PostgreSQL 15:
      • sqlite3 to v3.53.4.
  • a9s Prometheus:
    • a9s Prometheus SPI:
      • Update internal dependencies.
    • prometheus2:
      • alertmanager to v0.34.0.
      • memcached_exporter to v0.17.0.
      • mysqld_exporter to v0.20.0.
      • bosh_exporter to v3.8.1.
    • promgraf2:
      • bosh_exporter to v3.8.1.
    • prometheus-legacy:
      • alertmanager to v0.34.0.
      • memcached_exporter to v0.17.0.
      • mysqld_exporter to v0.20.0.
      • bosh_exporter to v3.8.1.
  • a9s Redis:
    • a9s Redis 7: redis to v7.2.16.

Unsupported​

  • a9s Redis®: End of Support: Terminate support for the following a9s Data Service:

    • a9s Redis® Data Service

    Existing a9s Redis® Service Instances can be migrated to a9s KeyValue by forking them using the Disaster Recovery feature, or by applying manual migration steps. For more information about the available migration options, please see the a9s KeyValue - Forking and Migration documentation page.

    The creation of new a9s Data Service Instances for this deprecated Data Service is now disabled by default in the a9s Data Service Bundle and we no longer provide regular support for this Data Service. The corresponding documentation has been removed.

    Although we will not intentionally break running Service Instances of this unsupported Data Service, it cannot be guaranteed that they still work as expected after an update to this release.

    Redis is a registered trademark of Redis Ltd. Any rights therein are reserved to Redis Ltd. Any use by anynines GmbH is for referential purposes only and does not indicate any sponsorship, endorsement or affiliation between Redis and anynines GmbH.

Removed​

  • breaking change all services: a9s Public API: Remove a9s Dashboard API component and its related dependencies. It was serving v0 of the a9s Public API. For more information, see UPGRADE.md.
  • a9s Backup Services: a9s Backup Manager: Remove endpoints used exclusively by the now-removed version v0 of the a9s Public API.
  • docs: Application Developer: a9s PostgreSQL: Remove documented restriction on the minimum value of max_connections custom parameter as it's no longer valid. For more information, see a9s PostgreSQL - Custom Parameters.

Fixed​

  • all services: a9s Logstash 8: Fix minor issues in Graphite plugins for the preparation of Data Service metrics.
  • a9s KeyValue: a9s Logstash 8: Fix the data type of the master_link_status and role metrics, which must be exposed as integer values instead of text. For more information, see a9s KeyValue - Metrics.

Security​

  • all services:
    • a9s Service Dashboard:
      • Fix CVE-2025-69873.
      • Fix CVE-2025-71329.
      • Fix CVE-2025-71330.
      • Fix CVE-2026-1615.
      • Fix CVE-2026-2391.
      • Fix CVE-2026-6321.
      • Fix CVE-2026-6322.
      • Fix CVE-2026-13149.
      • Fix CVE-2026-13676.
      • Fix CVE-2026-14257.
      • Fix CVE-2026-16221.
      • Fix CVE-2026-18446.
      • Fix CVE-2026-33671.
      • Fix CVE-2026-33750.
      • Fix CVE-2026-34043.
      • Fix CVE-2026-40895.
      • Fix CVE-2026-44728.
      • Fix CVE-2026-45623.
      • Fix CVE-2026-54466.
      • Fix CVE-2026-54490.
      • Fix CVE-2026-56846.
      • Fix CVE-2026-56848.
      • Fix CVE-2026-58043.
      • Fix CVE-2026-59869.
      • Fix CVE-2026-59879.
      • Fix CVE-2026-59880.
      • Fix CVE-2026-67213.
      • Fix CVE-2026-67214.
      • Fix CVE-2026-69152.
      • Fix CVE-2026-73086.
      • Fix CVE-2026-73088.
      • Fix CVE-2026-73089.
      • Fix CVE-2026-73646.
  • a9s-pg:
    • Fix CVE-2026-6471.
    • Fix CVE-2026-14673.
    • Fix CVE-2026-14677.
    • Fix CVE-2026-14678.
    • Fix CVE-2026-14679.
    • Fix CVE-2026-14680.
  • a9s Billing: Fix CVE-2026-54904.
  • a9s Messaging:
    • a9s Messaging 4:
      • Fix CVE-2026-42792.
      • Fix CVE-2026-47078.
      • Fix CVE-2026-54890.
      • Fix CVE-2026-55737.
      • Fix CVE-2026-55953.
      • Fix CVE-2026-58227.
      • Fix CVE-2026-59250.
      • Fix CVE-2026-59251.
  • a9s MongoDB:
    • a9s MongoDB 7:
      • Fix CVE-2026-18688.
      • Fix CVE-2026-18690.
      • Fix CVE-2026-18691.
      • Fix CVE-2026-18693.
      • Fix CVE-2026-18694.
      • Fix CVE-2026-18695.
      • Fix CVE-2026-18696.
      • Fix CVE-2026-18697.
      • Fix CVE-2026-18698.
      • Fix CVE-2026-18699.
      • Fix CVE-2026-18700.
      • Fix CVE-2026-18701.
      • Fix CVE-2026-18702.
      • Fix CVE-2026-18705.
      • Fix CVE-2026-18708.
      • Fix CVE-2026-18709.
      • Fix CVE-2026-18712.
    • a9s MongoDB 8:
      • Fix CVE-2026-18687.
      • Fix CVE-2026-18688.
      • Fix CVE-2026-18690.
      • Fix CVE-2026-18691.
      • Fix CVE-2026-18693.
      • Fix CVE-2026-18694.
      • Fix CVE-2026-18695.
      • Fix CVE-2026-18696.
      • Fix CVE-2026-18697.
      • Fix CVE-2026-18698.
      • Fix CVE-2026-18699.
      • Fix CVE-2026-18700.
      • Fix CVE-2026-18701.
      • Fix CVE-2026-18702.
      • Fix CVE-2026-18705.
      • Fix CVE-2026-18708.
      • Fix CVE-2026-18709.
      • Fix CVE-2026-18711.
      • Fix CVE-2026-18712.
  • a9s PostgreSQL:
    • a9s PostgreSQL 15:
      • Fix CVE-2026-6471.
      • Fix CVE-2026-14673.
      • Fix CVE-2026-14677.
      • Fix CVE-2026-14678.
      • Fix CVE-2026-14679.
      • Fix CVE-2026-14680.
    • a9s PostgreSQL 17:
      • Fix CVE-2026-6471.
      • Fix CVE-2026-14677.
      • Fix CVE-2026-14678.
      • Fix CVE-2026-14679.
      • Fix CVE-2026-14680.
      • Fix CVE-2026-14681.

Upcoming​

  • a9s Prometheus: End of Support: Terminate support, starting from anynines deployment v79.0.0 (expected end of November 2026), for the following deprecated a9s Data Service version:

    • a9s Prometheus 2: Prometheus 2 is end-of-life by their vendor since July 2025.

    The creation of new a9s Data Service Instances for this deprecated version will be disabled by default in the a9s Data Service Bundle and we will not provide regular support for this version. The corresponding documentation will also be removed.

    Please ensure that you organize the migration of your existing Service Instances to a more up-to-date version of the same a9s Data Service:

    • for a9s Prometheus 2: a9s Prometheus 3 is available as the latest Beta (non-GA) version.

    Although we will not intentionally break running Service Instances of this unsupported version, it cannot be guaranteed that they still work as expected after an update to v79.0.0.

75.0.1

· 2 min read

Changed​

  • docs: Application Developer: Update the links in the Disaster Recovery documentation. For more information, see Disaster Recovery.

Updated Dependencies​

  • a9s MongoDB:
    • a9s MongoDB 7: mongodb to v7.0.39.
    • a9s MongoDB 8: mongodb to v8.0.28.
  • a9s Redis:
    • a9s Redis 7: redis to v7.2.15.

Security​

  • a9s MongoDB:
    • a9s MongoDB 7:
      • Fix CVE-2026-9737.
      • Fix CVE-2026-13055.
      • Fix CVE-2026-13059.
      • Fix CVE-2026-13060.
      • Fix CVE-2026-13061.
      • Fix CVE-2026-13062.
      • Fix CVE-2026-13065.
      • Fix CVE-2026-13066.
      • Fix CVE-2026-13068.
      • Fix CVE-2026-13069.
      • Fix CVE-2026-13070.
      • Fix CVE-2026-13071.
      • Fix CVE-2026-13072.
      • Fix CVE-2026-13074.
      • Fix CVE-2026-13077.
      • Fix CVE-2026-13078.
    • a9s MongoDB 8:
      • Fix CVE-2026-9737.
      • Fix CVE-2026-13055.
      • Fix CVE-2026-13056.
      • Fix CVE-2026-13057.
      • Fix CVE-2026-13058.
      • Fix CVE-2026-13059.
      • Fix CVE-2026-13060.
      • Fix CVE-2026-13061.
      • Fix CVE-2026-13062.
      • Fix CVE-2026-13064.
      • Fix CVE-2026-13065.
      • Fix CVE-2026-13066.
      • Fix CVE-2026-13067.
      • Fix CVE-2026-13068.
      • Fix CVE-2026-13069.
      • Fix CVE-2026-13070.
      • Fix CVE-2026-13071.
      • Fix CVE-2026-13072.
      • Fix CVE-2026-13073.
      • Fix CVE-2026-13074.
      • Fix CVE-2026-13077.
      • Fix CVE-2026-13078.
  • a9s Redis: a9s Redis 7: Fix CVE-2026-66373.

75.0.0

· 9 min read

Added​

  • a9s Backup Services: a9s Backup Manager: Add api.max_backup_list_limit and api.max_restore_list_limit BOSH properties to configure the maximum number of items returned by the a9s Backup Manager API. Both values default to 50, with the minimum accepted value being 1 and the maximum being 1000. The Ops file backup-service-max-backup-list-limit.yml is provided for ease of configuration.
  • a9s MariaDB: Make the wsrep_max_ws_size MariaDB Galera parameter configurable through custom parameters. For more information, see a9s MariaDB - Custom Parameters.
  • a9s Search: a9s Search SPI: Allow the Platform Operator to define which plugins can be enabled by the Application Developer. This change directly impacts the plugins custom parameter.
  • docs: Application Developer: a9s MariaDB: Add information about the new custom parameter wsrep_max_ws_size. For more information, see a9s MariaDB - Custom Parameters.
  • docs: Platform Operator: a9s Backup Services: a9s Backup Manager: Document the new api.max_backup_list_limit and api.max_restore_list_limit properties, their usage, and the performance impact of increasing these limits. For more information, see a9s Backup Manager - Properties.
  • docs: Platform Operator: a9s MariaDB: Add information about the new custom parameter wsrep_max_ws_size. For more information, see a9s MariaDB - SPI Configuration.
  • docs: Platform Operator: a9s Messaging: Add information about TLS hostname verification for shovel and federation links. For more information, see a9s Messaging - Configuration and Features.

Changed​

  • breaking change a9s Messaging: Update Erlang/OTP to 27.3.4.14, fixing CVE-2026-42790. Following RFC 9525, TLS hostname verification no longer falls back to the certificate's Common Name (CN): shovel and federation amqps:// links to brokers whose certificate does not carry the connection hostname in a SAN dNSName entry (e.g. CN-only certificates) now fail hostname verification. Wildcard SAN entries continue to be matched, as a9s Messaging enables RFC 6125/9525-compliant wildcard matching for these links. The fix also closes a name-constraints bypass, so certificates issued by a DNS-name-constrained intermediate CA for out-of-scope hostnames are now rejected as well. For more information, see UPGRADE.md.
  • all services: a9s Public API: Adapt the endpoint /v1/instances/:instance_id to contain allowed_update_time in its response when retrieving the Service Instance overview. For more information, see API V1 Endpoints - Instance Endpoints - Get Instance Overview.
  • all services: a9s Service Dashboard: Change the endpoint used to get Service Instance information from a9s Public API v0 to a9s Public API v1.
  • a9s Backup Monit: Reduce the number of outbound requests made to the backup storage when computing the content length of a backup. This prevents high request volumes from overwhelming firewalls.
  • a9s CF Service Guard: Update a9s CF Service Guard to prevent matching the details of a new Service Instance to a "deleted" Service Instance when searching across Service Brokers to mark it for synchronization.
  • a9s MariaDB: Update the dashboard_client.id for the a9s Public API Auth Provider and the smoke-test errand name to a supported Data Service version in the Data Service manifest.
  • a9s Messaging: Update the dashboard_client.id for the a9s Public API Auth Provider and the smoke-test errand name to a supported Data Service version in the Data Service manifest.
  • a9s MongoDB: Update the dashboard_client.id for the a9s Public API Auth Provider to a supported Data Service version in the add-mongodb-sspl.yml Ops file.
  • a9s PostgreSQL: Update the dashboard_client.id for the a9s Public API Auth Provider and the smoke-test errand name to a supported Data Service version in the Data Service manifest.
  • a9s Search: a9s Search SPI: Fix an issue where the custom parameters reset to their default in certain conditions.
  • a9s Search: Allow the Application Developer to configure any supported plugin that has been allowed by the Platform Operator. This change directly impacts the plugins custom parameter.
  • a9s Template Uploader Errand: a9s MariaDB: Extend the a9s MariaDB templates to allow adding the custom parameter wsrep_max_ws_size.
  • docs: Application Developer: a9s Search: Update the documentation for the plugins custom parameter to reflect the new behavior. For more information, see a9s Search - Enable Custom Plugins.
  • docs: Platform Operator: a9s LogMe2: Update the "Plugins" section to improve clarity on the enabled plugins. For more information, see a9s LogMe2 - Resource Considerations.
  • docs: Platform Operator: a9s Search: Update the documentation for the plugins custom parameter to reflect the new behavior. For more information, see a9s Search - Enable Custom Plugins.
  • BOSH stemcell: all services: Update Jammy stemcell to version 1.1298 for internal tests of all supported services.

Updated Dependencies​

  • all services:
    • bpm to v1.4.34.
    • routing to v0.387.0.
    • a9s Backup Agent: Update internal dependencies.
    • a9s Bee: Update internal dependencies.
    • a9s Public API:
      • Update internal dependencies.
      • Node.JS to v24.18.0.
      • a9s-beehive to v1.2.13.
      • krakend to v2.13.8.
      • krakend-custom-plugins to v2.13.8.
      • nginx to v1.31.3.
    • a9s Service Dashboard:
      • Node.JS to v22.23.1.
      • Update internal dependencies.
    • a9s Smoke Tests: Update internal dependencies.
    • logstash to v8.19.19.
    • nginx:
      • nginx to v1.31.3.
  • a9s-pg: Update internal dependencies.
  • a9s Backup Services:
    • a9s Backup Manager: Update internal dependencies.
    • a9s Backup Monit: Update internal dependencies.
  • a9s CF Service Guard: Bump Ruby gem dependencies.
  • a9s KeyValue: a9s KeyValue 8: valkey to v8.1.9.
  • a9s LogMe2:
    • Update internal dependencies.
    • fluentd to 1.19.3.
    • OpenSearch to v2.19.6.
  • a9s MariaDB:
    • a9s MariaDB 10.6: Update internal dependencies.
    • a9s MariaDB 10.11: Update internal dependencies.
  • a9s Messaging:
    • a9s Messaging 4:
      • erlang to v27.3.4.14.
      • RabbitMQ to 4.3.3.
      • Update internal dependencies.
  • a9s MongoDB:
    • a9s MongoDB 8:
      • mongosh to v2.9.2.
    • a9s MongoDB 7:
      • mongosh to v2.9.2.
  • a9s PostgreSQL:
    • a9s PostgreSQL 15: Update internal dependencies.
    • a9s PostgreSQL 17: Update internal dependencies.
  • a9s Prometheus:
    • prometheus2: Update internal dependencies.
    • prometheus-legacy: Update internal dependencies.
    • promgraf2: Update internal dependencies.
    • a9s Dashboard API:
      • Update internal dependencies.
      • Node.JS to v22.23.1.
  • a9s Search:
    • OpenSearch to v2.19.6.

Deprecated​

  • a9s MariaDB: Deprecation: Deprecate the following a9s Data Service version:

    • a9s MariaDB 10.6: MariaDB 10.6 is end-of-life by their vendor since July 2026

    Please ensure that you organize the migration of your existing Service Instances to a more up-to-date version of the same a9s Data Service:

    • for a9s MariaDB 10.6: a9s MariaDB 10.11 is available as GA version.

    This deprecation follows the announcement in v73.0.0. The deprecation phase is planned to last until v78.0.0 (expected end of October 2026), in which the unsupport phase of the deprecated version will start. The creation of new a9s Data Service Instances for this particular version will then be disabled by default in the a9s Data Service Bundle when the unsupport occurs in v81.0.0 (expected end of January 2027) and we will not provide regular support for this version. The corresponding documentation will also be removed. Therefore, we strongly recommend that you start your migrations to a supported GA version as soon as possible and complete them until the end of the deprecation phase. For more information see a9s Platform Operator - Sunrise Sunset.

Fixed​

  • a9s Search: Fix an installation issue in the analysis-phonetic plugin.

Security​

  • all services:
    • a9s Bee:
      • Fix CVE-2026-33811.
      • Fix CVE-2026-33814.
      • Fix CVE-2026-39820.
      • Fix CVE-2026-39822.
      • Fix CVE-2026-39829.
      • Fix CVE-2026-39830.
      • Fix CVE-2026-39831.
      • Fix CVE-2026-39832.
      • Fix CVE-2026-39833.
      • Fix CVE-2026-39834.
      • Fix CVE-2026-39836.
      • Fix CVE-2026-42499.
      • Fix CVE-2026-42501.
      • Fix CVE-2026-42508.
      • Fix CVE-2026-46595.
      • Fix CVE-2026-46597.
    • a9s Public API:
      • Fix CVE-2026-33811.
      • Fix CVE-2026-33814.
      • Fix CVE-2026-39820.
      • Fix CVE-2026-39822.
      • Fix CVE-2026-39836.
      • Fix CVE-2026-42499.
      • Fix CVE-2026-42501.
    • a9s Service Dashboard:
      • Fix CVE-2026-9277.
      • Fix CVE-2026-12143.
      • Fix CVE-2026-48619.
      • Fix CVE-2026-48779.
      • Fix CVE-2026-48930.
      • Fix CVE-2026-48933.
    • a9s Smoke Tests:
      • Fix CVE-2026-33811.
      • Fix CVE-2026-33814.
      • Fix CVE-2026-39820.
      • Fix CVE-2026-39822.
      • Fix CVE-2026-39829.
      • Fix CVE-2026-39830.
      • Fix CVE-2026-39831.
      • Fix CVE-2026-39832.
      • Fix CVE-2026-39833.
      • Fix CVE-2026-39834.
      • Fix CVE-2026-39836.
      • Fix CVE-2026-42499.
      • Fix CVE-2026-42501.
      • Fix CVE-2026-42508.
      • Fix CVE-2026-46595.
      • Fix CVE-2026-46597.
      • Improve measures to prevent credential leakage in the Smoke Tests logs.
    • a9s SSO Proxy: Fix a reflected cross-site scripting (XSS) vulnerability in the SSO proxy authentication failure page.
    • nginx:
      • Fix CVE-2026-42533.
      • Fix CVE-2026-60005.
  • a9s-pg:
    • Fix CVE-2026-11822.
    • Fix CVE-2026-11824.
    • Fix CVE-2026-33811.
    • Fix CVE-2026-33814.
    • Fix CVE-2026-39820.
    • Fix CVE-2026-39822.
    • Fix CVE-2026-39829.
    • Fix CVE-2026-39830.
    • Fix CVE-2026-39831.
    • Fix CVE-2026-39832.
    • Fix CVE-2026-39833.
    • Fix CVE-2026-39834.
    • Fix CVE-2026-39836.
    • Fix CVE-2026-42499.
    • Fix CVE-2026-42501.
    • Fix CVE-2026-42508.
    • Fix CVE-2026-46595.
    • Fix CVE-2026-46597.
  • a9s LogMe2:
    • Fix CVE-2026-34477.
    • Fix CVE-2026-34478.
    • Fix CVE-2026-34480.
    • Fix CVE-2026-44024.
    • Fix CVE-2026-44025.
    • Fix CVE-2026-44160.
    • Fix CVE-2026-44161.
  • a9s MariaDB:
    • a9s MariaDB 10.6: Fix CVE-2026-39822.
    • a9s MariaDB 10.11: Fix CVE-2026-39822.
  • a9s Messaging:
    • a9s Messaging 4:
      • Fix CVE-2026-33811.
      • Fix CVE-2026-33814.
      • Fix CVE-2026-39820.
      • Fix CVE-2026-39822.
      • Fix CVE-2026-39836.
      • Fix CVE-2026-42499.
      • Fix CVE-2026-42501.
      • Fix CVE-2026-42790.
      • Fix CVE-2026-49759.
  • a9s PostgreSQL:
    • a9s PostgreSQL 15:
      • Fix CVE-2026-11822.
      • Fix CVE-2026-11824.
      • Fix CVE-2026-33811.
      • Fix CVE-2026-33814.
      • Fix CVE-2026-39820.
      • Fix CVE-2026-39822.
      • Fix CVE-2026-39829.
      • Fix CVE-2026-39830.
      • Fix CVE-2026-39831.
      • Fix CVE-2026-39832.
      • Fix CVE-2026-39833.
      • Fix CVE-2026-39834.
      • Fix CVE-2026-39836.
      • Fix CVE-2026-42499.
      • Fix CVE-2026-42501.
      • Fix CVE-2026-42508.
      • Fix CVE-2026-46595.
      • Fix CVE-2026-46597.
    • a9s PostgreSQL 17:
      • Fix CVE-2026-11822.
      • Fix CVE-2026-11824.
      • Fix CVE-2026-33811.
      • Fix CVE-2026-33814.
      • Fix CVE-2026-39820.
      • Fix CVE-2026-39822.
      • Fix CVE-2026-39829.
      • Fix CVE-2026-39830.
      • Fix CVE-2026-39831.
      • Fix CVE-2026-39832.
      • Fix CVE-2026-39833.
      • Fix CVE-2026-39834.
      • Fix CVE-2026-39836.
      • Fix CVE-2026-42499.
      • Fix CVE-2026-42501.
      • Fix CVE-2026-42508.
      • Fix CVE-2026-46595.
      • Fix CVE-2026-46597.
  • a9s Prometheus:
    • prometheus2: Fix CVE-2026-39822.
    • prometheus-legacy: Fix CVE-2026-39822.
    • promgraf2: Fix CVE-2026-39822.
    • a9s Dashboard API:
      • Fix CVE-2026-48619.
      • Fix CVE-2026-48930.
      • Fix CVE-2026-48933.
  • a9s Search:
    • Fix CVE-2026-34477.
    • Fix CVE-2026-34478.
    • Fix CVE-2026-34480.

74.0.0

· 5 min read

Added​

  • docs: Application Developer: all services: Add admonitions to highlight the limitations of backups and restores of stopped Service Instances. For more information, see a9s Service Dashboard.
  • docs: Application Developer: all services: Add an admonition to highlight the limitation of manual updates for stopped Service Instances. For more information, see a9s Service Dashboard - Update Service Instance.
  • docs: Application Developer: all services: Add known limitations about backups and restores to the documentation of the Stop/Start feature. For more information, see Stop/Start Feature - Known Limitations.
  • docs: Application Developer: all services: Add known limitations about manual updates to the documentation of the Stop/Start feature. For more information, see Stop/Start Feature - Known Limitations.
  • docs: Application Developer: a9s Public API: Add admonitions to highlight the limitations of backups, restores and updates for stopped Service Instances in the API V1 Endpoints documentation. For more information, see API V1 Endpoints.
  • docs: Platform Operator: Add a section to highlight the behavior of updates for stopped Service Instances in the documentation of known limitations for Maintenance Updates. For more information, see Maintenance Updates - Known Limitations
  • docs: Platform Operator: a9s Service Broker: Add known limitations about manual updates to the documentation of the Stop/Start feature. For more information, see Stop/Start Feature - Known Limitations.

Changed​

  • breaking change all services: a9s Logstash 8: Add internal queues to syslog and graphite output plugins. It now drops messages when the configured output service cannot empty the queue fast enough. This will ensure that Logstash will not block any output when a service has reached its limit.
  • all services: a9s Public API: Make the platform property optional in the ops/enable-stop-start-feature.yml Ops file.
  • all services: a9s Service Broker: Extend the ServiceUsage API of the a9s Service Broker, so that when the strategy=transform is used, the usage events that are returned have entity.event_type set to service_broker. Other strategies keep entity.event_type as service_instance.
  • a9s Backup Manager: Improve backup queue handling to reduce the risk of stuck backups.
  • a9s MariaDB: The Galera Healthcheck post-start script now blocks the task's lifecycle until the node's Consul DNS entry is resolvable.
  • a9s PostgreSQL: a9s PostgreSQL SPI: Sanitize logs, and streamline them into one file, to prevent sensitive connection details from appearing in log output, as a security hardening measure.
  • docs: Application Developer: all services: Highlight the expected behavior of the metrics and alerts for stopped Service Instances in the documentation of the Stop/Start feature. For more information, see Stop/Start Feature - Expected Behavior.
  • docs: Application Developer: a9s MariaDB: Update documentation to fix minor issues and improve readability. For more information, see: a9s MariaDB - Forking and Migration.
  • docs: Application Developer: a9s PostgreSQL: Add an admonition to highlight the expected behavior of metrics for stopped Service Instances. For more information, see a9s PostgreSQL - Metrics.
  • docs: Platform Operator: all services: Add an admonition to highlight the limitations of metrics and alerts for stopped Service Instances. For more information, see Data Services - Metrics.
  • docs: Platform Operator: a9s Service Broker: Update the documentation to extend the paragraph to enable or disable the Stop/Start feature. For more information, see Stop/Start Feature - Enable or Disable.
  • BOSH stemcell: all services: Update Jammy stemcell to version 1.1250 for internal tests of all supported services.

Updated Dependencies​

  • all services:
    • bpm to v1.4.33.
    • routing to v0.385.0.
    • a9s Public API:
      • krakend-custom-plugins to v2.13.7.
      • krakend to v2.13.7.
      • nginx to v1.31.2.
    • nginx:
      • nginx to v1.31.2.
  • a9s KeyValue: a9s KeyValue 8: valkey to v8.1.8.
  • a9s MariaDB:
    • a9s MariaDB 10.6:
      • mariadb to v10.6.27.
      • golang to 1.26.
    • a9s MariaDB 10.11:
      • mariadb to v10.11.18.
  • a9s Messaging:
    • a9s Messaging 4:
      • RabbitMQ to 4.3.2.
  • a9s MongoDB:
    • a9s MongoDB 5:
      • mongodb to v5.0.34.
    • a9s MongoDB 7:
      • mongodb to v7.0.37.
    • a9s MongoDB 8:
      • mongodb to v8.0.26.
  • a9s Prometheus:
    • prometheus2:
      • stackdriver_exporter to v0.19.0.
      • alertmanager to v0.33.0.
      • statsd_exporter to v0.30.0.
    • prometheus-legacy:
      • stackdriver_exporter to v0.19.0.
      • alertmanager to v0.33.0.
      • statsd_exporter to v0.30.0.
    • promgraf2:
      • stackdriver_exporter to v0.19.0.
      • alertmanager to v0.33.0.
      • statsd_exporter to v0.30.0.

Removed​

  • breaking change docs: Application Developer: a9s PostgreSQL: Remove the documentation on the use of CREATEDB as a configuration parameter for a9s PostgreSQL due to the limitations in the use of custom databases. Since the a9s Data Services' automation is not aware of the custom databases, the desired level of support cannot be expected for custom databases. For more information, see a9s PostgreSQL - Custom Parameters - Role Privileges.
  • breaking change docs: Platform Operator: a9s PostgreSQL: Remove the documentation on the use of CREATEDB as a configuration parameter for a9s PostgreSQL due to the limitations in the use of custom databases. Since the a9s Data Services' automation is not aware of the custom databases, the desired level of support cannot be expected for custom databases. For more information, see a9s PostgreSQL - SPI Configuration - Role Privileges.
  • a9s Billing: Remove unneeded job and its related dependencies.

Fixed​

  • a9s Backup Services: a9s Backup Manager: Block restore requests when a backup is in progress on the Service Instance, and respond with 409 ConcurrencyError. This prevents restores from failing inside the Backup Agent's info call, which previously left the restore in a bad state.

Security​

  • a9s MariaDB:
    • a9s MariaDB 10.6:
      • Fix CVE-2026-49261.
      • Fix CVE-2026-48163.
      • Fix CVE-2026-48165.
    • a9s MariaDB 10.11:
      • Fix CVE-2026-49261.
      • Fix CVE-2026-48163.
      • Fix CVE-2026-48165.
  • a9s MongoDB:
    • a9s MongoDB 8:
      • Fix CVE-2026-9740.
      • Fix CVE-2026-9741.
      • Fix CVE-2026-9746.
      • Fix CVE-2026-9749.
      • Fix CVE-2026-9750.
      • Fix CVE-2026-9751.
      • Fix CVE-2026-9752.
      • Fix CVE-2026-9753.
      • Fix CVE-2026-9754.
      • Fix CVE-2026-11933.
      • Fix CVE-2026-9743.
    • a8s MongoDB 7:
      • Fix CVE-2026-9740.
      • Fix CVE-2026-9741.
      • Fix CVE-2026-9746.
      • Fix CVE-2026-9748.
      • Fix CVE-2026-9749.
      • Fix CVE-2026-9750.
      • Fix CVE-2026-9751.
      • Fix CVE-2026-9752.
      • Fix CVE-2026-9753.
      • Fix CVE-2026-9754.
      • Fix CVE-2026-11933.

73.0.0

· 8 min read

Added​

  • a9s-pg: a9s PostgreSQL: a9s PostgreSQL 15: Support BOSH CPI migration by addressing cluster nodes via a9s Consul DNS names instead of static IPs, and by falling back to the BOSH deployment index when node IDs are reassigned during the migration. The feature is opt-in via the a9s-pg/ops/use-consul-dns-names.yml Ops file.
  • a9s PostgreSQL: Support BOSH CPI migration by addressing cluster nodes via a9s Consul DNS names instead of static IPs, and by falling back to the BOSH deployment index when node IDs are reassigned during the migration. The feature is opt-in via the postgresql-service/ops/use-consul-dns-names.yml Ops file.
  • docs: Application Developer: Update the Disaster Recovery documentation to specify how to fork from specific backups. For more information, see Disaster Recovery - Retrieve the Backup ID of a specific Backup.
  • docs: Application Developer: Update the Forking documentation to add additional information regarding forking from a specific backup. For more information, see Forking a Service Instance - Retrieving the Wanted Backup's ID.
  • docs: Application Developer: a9s Messaging: Add references to the concerns relevant to the upgrade to RabbitMQ 4.3. For more information, see a9s Messaging Concerns.
  • docs: Platform Operator: a9s Billing: Add the missing prerequisite step in the deployment of a9s Billing to add required databases to a9s-pg. For more information, see a9s Data Services Setup - Deploy a9s Billing.
  • docs: Platform Operator: a9s Parachute: Update the documentation to add a disclaimer about the intended usage of a9s Parachute. For more information, see a9s Parachute.
  • docs: Platform Operator: a9s Parachute: Update the documentation to add limitations associated with the use of a9s Parachute for a9s MariaDB. For more information, see a9s Parachute.

Changed​

  • breaking change a9s Backup Services: a9s Backup Manager: Fix duplicate Service Instance entries in the a9s Backup Manager database by adding a uniqueness validation and database constraint for instance_id per broker_id. Duplicate entries could cause backup creation failures and incorrect backup details in the dashboard. For more information, see UPGRADE - Merge Duplicate Service Instances.
  • a9s Template Uploader Errand: all services: Improve internal upload logic for hardcoded release versions.
  • a9s Template Uploader Errand: all services: Increased BOSH release version due to internal changes.
  • a9s Template Uploader Errand: a9s Messaging: Add legacy templates messaging42-* which contain the latest version of RabbitMQ 4.2. Once RabbitMQ 4.4 is supported, these legacy templates will be removed and new templates messaging43-* will be created. These templates provide a last resort rollback to the previous minor version of RabbitMQ, in case there are problems with the latest version of a9s Messaging. For more information, see a9s Messaging - Rollback to Legacy Version.
  • docs: Application Developer: a9s Messaging: Update documentation to include rabbitmqadmin v2 references. For more information, see: Forking and Migration.
  • docs: Platform Operator: a9s Messaging: Add warning about rollback limitation for RabbitMQ 4.3 instances. For more information, see: Rollback Limitation for RabbitMQ 4.3 and Later.
  • BOSH stemcell: all services: Update Jammy stemcell to version 1.1202 for the internal tests of all supported services.

Updated Dependencies​

  • all services:
    • bpm to v1.4.31.
    • routing to v0.381.0.
    • a9s Public API:
      • nginx to v1.31.0.
      • krakend-custom-plugins to v2.13.5.
      • krakend to v2.13.5.
      • Update internal dependencies.
    • logstash to v8.19.15.
    • nginx:
      • nginx to v1.31.0.
  • a9s-pg:
    • postgresql15 to v15.18.
  • consul-dns: Dnsmasq: Update internal dependencies.
  • a9s KeyValue: a9s KeyValue 8: valkey to v8.1.7.
  • a9s LogMe: Update internal dependencies.
  • a9s MariaDB:
    • a9s MariaDB 10.6:
      • mariadb to v10.6.26.
    • a9s MariaDB 10.11:
      • mariadb to v10.11.17.
    • Update internal dependencies.
  • a9s Messaging:
    • a9s Messaging 4:
      • RabbitMQ to 4.3.1.
  • a9s MongoDB:
    • a9s MongoDB 5:
      • mongodb to v5.0.33.
    • a9s MongoDB 7:
      • mongodb to v7.0.34.
      • mongosh to v2.8.3.
    • a9s MongoDB 8:
      • mongosh to v2.8.3.
      • mongodb to v8.0.23.
  • a9s MySQL: Update internal dependencies.
  • a9s PostgreSQL:
    • a9s PostgreSQL 15:
      • postgresql15 to v15.18.
    • a9s PostgreSQL 17:
      • postgresql17 to v17.10.
      • Update internal dependencies.
  • a9s Prometheus:
    • prometheus2:
      • cadvisor to v0.57.0.
      • alertmanager to v0.32.1.
      • bosh_exporter to v3.8.0.
    • prometheus-legacy:
      • cadvisor to v0.57.0.
      • alertmanager to v0.32.1.
      • bosh_exporter to v3.8.0.
    • promgraf2:
      • cadvisor to v0.57.0.
      • alertmanager to v0.32.1.
      • bosh_exporter to v3.8.0.
    • a9s Node Guard:
      • nginx to v1.31.0.
      • Update internal dependencies.
    • a9s SSO Proxy:
      • nginx to v1.31.0.
      • Update internal dependencies.
  • a9s Redis:
    • a9s Redis 7: redis to v7.2.14.

Unsupported​

  • a9s PostgreSQL: End of Support: Terminate support for the following deprecated a9s Data Service version:

    • a9s PostgreSQL v13: PostgreSQL 13 is end-of-life by their vendor since November 2025

    The creation of new a9s Data Service Instances for this deprecated version is now disabled by default in the a9s Data Service Bundle and we no longer provide regular support for this version. The corresponding documentation has been removed.

    Although we will not intentionally break running Service Instances of this unsupported version, it cannot be guaranteed that they still work as expected after an update to this release.

Removed​

  • docs: Platform Operator: a9s PostgreSQL: Remove a9s PostgreSQL 13 from the "a9s Data Service Release Lifecycle Table" page. For more information, see a9s Platform Operator Sunrise Sunset - a9s Data Service Release Lifecycle Table.
  • docs: Platform Operator: a9s Search: Remove the deprecated "Backup and Restores" section from the a9s Search Platform Operator documentation, as that configuration is no longer necessary due to the refactoring of the a9s Backup Agent.

Security​

  • all services:
    • a9s Public API:
      • Fix CVE-2026-42945.
      • Fix CVE-2026-42946.
    • nginx:
      • Fix CVE-2026-42945.
      • Fix CVE-2026-42946.
  • a9s-pg:
    • Fix CVE-2026-6475.
    • Fix CVE-2026-6477.
    • Fix CVE-2026-6479.
    • Fix CVE-2026-6637.
  • consul-dns:
    • Dnsmasq:
      • Fix CVE-2026-4890.
      • Fix CVE-2026-4891.
      • Fix CVE-2026-4892.
      • Fix CVE-2026-4893.
      • Fix CVE-2026-2291.
      • Fix CVE-2026-5172.
  • a9s KeyValue: a9s KeyValue 8:
    • Fix CVE-2026-23479.
    • Fix CVE-2026-23631.
    • Fix CVE-2026-25243.
  • a9s LogMe: a9s Service Broker:
    • Fix CVE-2026-34827.
    • Fix CVE-2026-34829.
  • a9s MariaDB:
    • a9s MariaDB 10.6:
      • Fix CVE-2026-44168.
    • a9s MariaDB 10.11:
      • Fix CVE-2026-44168.
  • a9s MongoDB:
    • a9s MongoDB 5:
      • Fix CVE-2026-8053
    • a9s MongoDB 7:
      • Fix CVE-2026-6914.
      • Fix CVE-2026-8053.
      • Fix CVE-2026-8199.
      • Fix CVE-2026-8201.
      • Fix CVE-2026-8843.
    • a9s MongoDB 8:
      • Fix CVE-2026-6914.
      • Fix CVE-2026-8053.
      • Fix CVE-2026-8199.
      • Fix CVE-2026-8201.
      • Fix CVE-2026-8843.
  • a9s MySQL: a9s Service Broker:
    • Fix CVE-2026-34827.
    • Fix CVE-2026-34829.
  • a9s PostgreSQL:
    • a9s PostgreSQL 17:
      • Fix CVE-2025-70873.
      • Fix CVE-2026-6475.
      • Fix CVE-2026-6476.
      • Fix CVE-2026-6477.
      • Fix CVE-2026-6479.
      • Fix CVE-2026-6637.
    • a9s PostgreSQL 15:
      • Fix CVE-2026-6475.
      • Fix CVE-2026-6477.
      • Fix CVE-2026-6479.
      • Fix CVE-2026-6637.
  • a9s Prometheus:
    • a9s Node Guard:
      • Fix CVE-2026-42945.
      • Fix CVE-2026-42946.
    • a9s SSO Proxy:
      • Fix CVE-2026-42945.
      • Fix CVE-2026-42946.
  • a9s Redis: a9s Redis 7:
    • Fix CVE-2026-23479.
    • Fix CVE-2026-23631.
    • Fix CVE-2026-25243.

Upcoming​

  • a9s MariaDB: Deprecation: Prepare for the upcoming deprecation, planned for the release v75.0.0 (expected end of July 2026), of the following a9s Data Service version:

    • a9s MariaDB 10.6: MariaDB 10.6 will become end-of-life by their vendor by 6th of July 2026.

    Please ensure that you organize the migration of your existing Service Instances to a more up-to-date version of the same a9s Data Service:

    • for a9s MariaDB 10.6: a9s MariaDB 10.11 is available as GA version.

    The deprecation phase is planned to last until v78.0.0 (expected end of October). With this release, the unsupport phase of the deprecated version will start. The creation of new a9s Data Service Instances for this particular version will be disabled by default in the a9s Data Service Bundle when the unsupport occurs in v81.0.0 (expected end of January 2027) and we will not provide regular support for this version. The corresponding documentation will also be removed. Therefore, we strongly recommend that you start your migrations to a supported GA version as soon as possible and complete them until the end of the deprecation phase. For more information see a9s Platform Operator Sunrise Sunset.

  • a9s Redis®: End of Support: Terminate support, starting from anynines deployment v76.0.0 (expected end of August 2026).

    The whole Data Service will be discontinued and no new versions will be released for it. Please ensure that you organize the migration of your existing Service Instances to the supported a9s KeyValue Data Service:

    • for a9s Redis®: a9s KeyValue 8 is available as GA version.

    Existing a9s Redis® Service Instances can be migrated to a9s KeyValue by forking them using the Disaster Recovery feature, or by applying manual migration steps. For more information about the available migration options, please see the Forking and Migration documentation page.

    The creation of new a9s Data Service Instances for this deprecated Data Service will be disabled by default in the a9s Data Service Bundle, and we will not provide regular support for this Data Service. The corresponding documentation will also be removed.

    Although we will not intentionally break running Service Instances of this unsupported Data Service, it cannot be guaranteed that they still work as expected after an update to v76.0.0.

73.0.0

· 8 min read

Added​

  • a9s-pg: a9s PostgreSQL: a9s PostgreSQL 15: Support BOSH CPI migration by addressing cluster nodes via a9s Consul DNS names instead of static IPs, and by falling back to the BOSH deployment index when node IDs are reassigned during the migration. The feature is opt-in via the a9s-pg/ops/use-consul-dns-names.yml Ops file.
  • a9s PostgreSQL: Support BOSH CPI migration by addressing cluster nodes via a9s Consul DNS names instead of static IPs, and by falling back to the BOSH deployment index when node IDs are reassigned during the migration. The feature is opt-in via the postgresql-service/ops/use-consul-dns-names.yml Ops file.
  • docs: Application Developer: Update the Disaster Recovery documentation to specify how to fork from specific backups. For more information, see Disaster Recovery - Retrieve the Backup ID of a specific Backup.
  • docs: Application Developer: Update the Forking documentation to add additional information regarding forking from a specific backup. For more information, see Forking a Service Instance - Retrieving the Wanted Backup's ID.
  • docs: Application Developer: a9s Messaging: Add references to the concerns relevant to the upgrade to RabbitMQ 4.3. For more information, see a9s Messaging Concerns.
  • docs: Platform Operator: a9s Billing: Add the missing prerequisite step in the deployment of a9s Billing to add required databases to a9s-pg. For more information, see a9s Data Services Setup - Deploy a9s Billing.
  • docs: Platform Operator: a9s Parachute: Update the documentation to add a disclaimer about the intended usage of a9s Parachute. For more information, see a9s Parachute.
  • docs: Platform Operator: a9s Parachute: Update the documentation to add limitations associated with the use of a9s Parachute for a9s MariaDB. For more information, see a9s Parachute.

Changed​

  • breaking change a9s Backup Services: a9s Backup Manager: Fix duplicate Service Instance entries in the a9s Backup Manager database by adding a uniqueness validation and database constraint for instance_id per broker_id. Duplicate entries could cause backup creation failures and incorrect backup details in the dashboard. For more information, see UPGRADE - Merge Duplicate Service Instances.
  • a9s Template Uploader Errand: all services: Improve internal upload logic for hardcoded release versions.
  • a9s Template Uploader Errand: all services: Increased BOSH release version due to internal changes.
  • a9s Template Uploader Errand: a9s Messaging: Add legacy templates messaging42-* which contain the latest version of RabbitMQ 4.2. Once RabbitMQ 4.4 is supported, these legacy templates will be removed and new templates messaging43-* will be created. These templates provide a last resort rollback to the previous minor version of RabbitMQ, in case there are problems with the latest version of a9s Messaging. For more information, see a9s Messaging - Rollback to Legacy Version.
  • docs: Application Developer: a9s Messaging: Update documentation to include rabbitmqadmin v2 references. For more information, see: Forking and Migration.
  • docs: Platform Operator: a9s Messaging: Add warning about rollback limitation for RabbitMQ 4.3 instances. For more information, see: Rollback Limitation for RabbitMQ 4.3 and Later.
  • BOSH stemcell: all services: Update Jammy stemcell to version 1.1202 for the internal tests of all supported services.

Updated Dependencies​

  • all services:
    • bpm to v1.4.31.
    • routing to v0.381.0.
    • a9s Public API:
      • nginx to v1.31.0.
      • krakend-custom-plugins to v2.13.5.
      • krakend to v2.13.5.
      • Update internal dependencies.
    • logstash to v8.19.15.
    • nginx:
      • nginx to v1.31.0.
  • a9s-pg:
    • postgresql15 to v15.18.
  • consul-dns: Dnsmasq: Update internal dependencies.
  • a9s KeyValue: a9s KeyValue 8: valkey to v8.1.7.
  • a9s LogMe: Update internal dependencies.
  • a9s MariaDB:
    • a9s MariaDB 10.6:
      • mariadb to v10.6.26.
    • a9s MariaDB 10.11:
      • mariadb to v10.11.17.
    • Update internal dependencies.
  • a9s Messaging:
    • a9s Messaging 4:
      • RabbitMQ to 4.3.1.
  • a9s MongoDB:
    • a9s MongoDB 5:
      • mongodb to v5.0.33.
    • a9s MongoDB 7:
      • mongodb to v7.0.34.
      • mongosh to v2.8.3.
    • a9s MongoDB 8:
      • mongosh to v2.8.3.
      • mongodb to v8.0.23.
  • a9s MySQL: Update internal dependencies.
  • a9s PostgreSQL:
    • a9s PostgreSQL 15:
      • postgresql15 to v15.18.
    • a9s PostgreSQL 17:
      • postgresql17 to v17.10.
      • Update internal dependencies.
  • a9s Prometheus:
    • prometheus2:
      • cadvisor to v0.57.0.
      • alertmanager to v0.32.1.
      • bosh_exporter to v3.8.0.
    • prometheus-legacy:
      • cadvisor to v0.57.0.
      • alertmanager to v0.32.1.
      • bosh_exporter to v3.8.0.
    • promgraf2:
      • cadvisor to v0.57.0.
      • alertmanager to v0.32.1.
      • bosh_exporter to v3.8.0.
    • a9s Node Guard:
      • nginx to v1.31.0.
      • Update internal dependencies.
    • a9s SSO Proxy:
      • nginx to v1.31.0.
      • Update internal dependencies.
  • a9s Redis:
    • a9s Redis 7: redis to v7.2.14.

Unsupported​

  • a9s PostgreSQL: End of Support: Terminate support for the following deprecated a9s Data Service version:

    • a9s PostgreSQL v13: PostgreSQL 13 is end-of-life by their vendor since November 2025

    The creation of new a9s Data Service Instances for this deprecated version is now disabled by default in the a9s Data Service Bundle and we no longer provide regular support for this version. The corresponding documentation has been removed.

    Although we will not intentionally break running Service Instances of this unsupported version, it cannot be guaranteed that they still work as expected after an update to this release.

Removed​

  • docs: Platform Operator: a9s PostgreSQL: Remove a9s PostgreSQL 13 from the "a9s Data Service Release Lifecycle Table" page. For more information, see a9s Platform Operator Sunrise Sunset - a9s Data Service Release Lifecycle Table.
  • docs: Platform Operator: a9s Search: Remove the deprecated "Backup and Restores" section from the a9s Search Platform Operator documentation, as that configuration is no longer necessary due to the refactoring of the a9s Backup Agent.

Security​

  • all services:
    • a9s Public API:
      • Fix CVE-2026-42945.
      • Fix CVE-2026-42946.
    • nginx:
      • Fix CVE-2026-42945.
      • Fix CVE-2026-42946.
  • a9s-pg:
    • Fix CVE-2026-6475.
    • Fix CVE-2026-6477.
    • Fix CVE-2026-6479.
    • Fix CVE-2026-6637.
  • consul-dns:
    • Dnsmasq:
      • Fix CVE-2026-4890.
      • Fix CVE-2026-4891.
      • Fix CVE-2026-4892.
      • Fix CVE-2026-4893.
      • Fix CVE-2026-2291.
      • Fix CVE-2026-5172.
  • a9s KeyValue: a9s KeyValue 8:
    • Fix CVE-2026-23479.
    • Fix CVE-2026-23631.
    • Fix CVE-2026-25243.
  • a9s LogMe: a9s Service Broker:
    • Fix CVE-2026-34827.
    • Fix CVE-2026-34829.
  • a9s MariaDB:
    • a9s MariaDB 10.6:
      • Fix CVE-2026-44168.
    • a9s MariaDB 10.11:
      • Fix CVE-2026-44168.
  • a9s MongoDB:
    • a9s MongoDB 5:
      • Fix CVE-2026-8053
    • a9s MongoDB 7:
      • Fix CVE-2026-6914.
      • Fix CVE-2026-8053.
      • Fix CVE-2026-8199.
      • Fix CVE-2026-8201.
      • Fix CVE-2026-8843.
    • a9s MongoDB 8:
      • Fix CVE-2026-6914.
      • Fix CVE-2026-8053.
      • Fix CVE-2026-8199.
      • Fix CVE-2026-8201.
      • Fix CVE-2026-8843.
  • a9s MySQL: a9s Service Broker:
    • Fix CVE-2026-34827.
    • Fix CVE-2026-34829.
  • a9s PostgreSQL:
    • a9s PostgreSQL 17:
      • Fix CVE-2025-70873.
      • Fix CVE-2026-6475.
      • Fix CVE-2026-6476.
      • Fix CVE-2026-6477.
      • Fix CVE-2026-6479.
      • Fix CVE-2026-6637.
    • a9s PostgreSQL 15:
      • Fix CVE-2026-6475.
      • Fix CVE-2026-6477.
      • Fix CVE-2026-6479.
      • Fix CVE-2026-6637.
  • a9s Prometheus:
    • a9s Node Guard:
      • Fix CVE-2026-42945.
      • Fix CVE-2026-42946.
    • a9s SSO Proxy:
      • Fix CVE-2026-42945.
      • Fix CVE-2026-42946.
  • a9s Redis: a9s Redis 7:
    • Fix CVE-2026-23479.
    • Fix CVE-2026-23631.
    • Fix CVE-2026-25243.

Upcoming​

  • a9s MariaDB: Deprecation: Prepare for the upcoming deprecation, planned for the release v75.0.0 (expected end of July 2026), of the following a9s Data Service version:

    • a9s MariaDB 10.6: MariaDB 10.6 will become end-of-life by their vendor by 6th of July 2026.

    Please ensure that you organize the migration of your existing Service Instances to a more up-to-date version of the same a9s Data Service:

    • for a9s MariaDB 10.6: a9s MariaDB 10.11 is available as GA version.

    The deprecation phase is planned to last until v78.0.0 (expected end of October). With this release, the unsupport phase of the deprecated version will start. The creation of new a9s Data Service Instances for this particular version will be disabled by default in the a9s Data Service Bundle when the unsupport occurs in v81.0.0 (expected end of January 2027) and we will not provide regular support for this version. The corresponding documentation will also be removed. Therefore, we strongly recommend that you start your migrations to a supported GA version as soon as possible and complete them until the end of the deprecation phase. For more information see a9s Platform Operator Sunrise Sunset.

  • a9s Redis®: End of Support: Terminate support, starting from anynines deployment v76.0.0 (expected end of August 2026).

    The whole Data Service will be discontinued and no new versions will be released for it. Please ensure that you organize the migration of your existing Service Instances to the supported a9s KeyValue Data Service:

    • for a9s Redis®: a9s KeyValue 8 is available as GA version.

    Existing a9s Redis® Service Instances can be migrated to a9s KeyValue by forking them using the Disaster Recovery feature, or by applying manual migration steps. For more information about the available migration options, please see the Forking and Migration documentation page.

    The creation of new a9s Data Service Instances for this deprecated Data Service will be disabled by default in the a9s Data Service Bundle, and we will not provide regular support for this Data Service. The corresponding documentation will also be removed.

    Although we will not intentionally break running Service Instances of this unsupported Data Service, it cannot be guaranteed that they still work as expected after an update to v76.0.0.

72.0.0

· 13 min read

Changed​

  • all services: Update the enable-service-instances-aws-instance-profiles.yml Ops file to extend the list of vm_extensions instead of overwriting it.
  • all services: a9s Backup Agent: Improve backup connection handling with automatic retries for temporary backup storage errors.
  • a9s-pg: Update the enable-service-instances-aws-instance-profiles.yml Ops file to extend the list of vm_extensions instead of overwriting it.
  • a9s Backup Services: Update the enable-backup-services-aws-instance-profiles Ops file to extend the list of vm_extensions for the a9s Backup Manager and a9s Backup Monit instead of overwriting it.
  • a9s Backup Services: a9s Backup Manager: Improve backup connection handling with automatic retries for temporary backup storage errors.
  • a9s MongoDB: a9s MongoDB SPI: Consolidate logging into one file.
  • a9s Service Broker: Instance deletion Rake task now handles potential state inconsistency when communicating with a9s Deployer.
  • docs: all services: Extend admonitions within the a9s Backup Manager documentation, to explicitly state the limitations of automatic/periodic backups when a Service Instance has been stopped. For more information, see a9s Backup Manager - Properties.
  • docs: all services: Extend the documentation of the Stop/Start feature, to better explain the current limitations, expected behavior, and extend the cross-referencing within the pages. For more information, see Stop/Start.
  • docs: Application Developer: a9s Public API: Restructure the API V1 Endpoints page into a new section, divided into subpages by topic. For more information, see API V1 Endpoints.
  • docs: Platform Operator: a9s Backup Services: Update the examples to use AWS IAM Instance Profiles via Ops file to extend the list of vm_extensions instead of overwriting it. For more information, see Using AWS Instance Profiles.
  • BOSH stemcell: all services: Update Jammy stemcell to version 1.1183 for internal tests of all supported services.

Updated Dependencies​

  • all services:
    • a9s Bee:
      • Update dependencies to resolve GO CVEs.
    • a9s Public API:
      • a9s-beehive to v1.2.6.
      • krakend-custom-plugins to v2.13.4.
      • krakend to v2.13.4.
      • nginx to v1.30.0.
      • Update internal dependencies.
    • bpm to v1.4.29.
    • logstash to v8.19.14.
    • nginx:
      • nginx to v1.30.0.
    • routing to v0.379.0.
    • a9s Backup Agent: Update internal dependencies.
    • a9s BOSH Deployer: Update internal dependencies.
    • a9s Service Broker: Update internal dependencies.
    • a9s Smoke Tests:
      • Update internal dependencies.
    • a9s SPIs: Update internal dependencies.
  • a9s-pg: Update internal dependencies.
  • a9s Backup Services:
    • a9s Backup Manager: Update internal dependencies.
    • a9s Backup Monit: Update internal dependencies.
  • a9s Billing: Update internal dependencies.
  • a9s CF Service Guard: Update internal dependencies.
  • a9s MariaDB:
    • a9s MariaDB 10.6:
      • Update internal dependencies.
    • a9s MariaDB 10.11:
      • Update internal dependencies.
  • a9s Messaging:
    • a9s Messaging 3.8:
      • Update internal dependencies.
    • a9s Messaging 3.10:
      • Update internal dependencies.
    • a9s Messaging 3.12:
      • Update internal dependencies.
    • a9s Messaging 3.13:
      • Update internal dependencies.
    • a9s Messaging 4:
      • erlang to v27.3.4.11.
      • rabbitmq to v4.2.6
      • Update internal dependencies.
  • a9s MongoDB:
    • a9s MongoDB 8:
      • mongosh to v2.8.2.
    • a9s MongoDB 7:
      • mongosh to v2.8.2.
  • a9s MySQL:
    • a9s MariaDB 10.4:
      • Update internal dependencies.
  • a9s PostgreSQL:
    • a9s PostgreSQL 17:
      • postgresql-info-webservice to v3.8.4
      • Update internal dependencies.
    • a9s PostgreSQL 15:
      • postgresql-info-webservice to v3.8.4
      • Update internal dependencies.
    • a9s PostgreSQL 13:
      • postgresql-info-webservice to v3.8.4
      • cmake3 to v3.31.12
      • Update internal dependencies.
  • a9s Prometheus:
    • prometheus2:
      • alertmanager to v0.32.0
      • memcached_exporter to v0.16.0
      • influxdb_exporter to v0.12.1
      • Update internal dependencies.
    • prometheus-legacy:
      • alertmanager to v0.32.0
      • memcached_exporter to v0.16.0
      • influxdb_exporter to v0.12.1
      • Update internal dependencies.
    • promgraf2:
      • alertmanager to v0.32.0
      • memcached_exporter to v0.16.0
      • influxdb_exporter to v0.12.1
      • Update internal dependencies.

Deprecated​

  • breaking change all services: Deprecation: Deprecate the a9s Environment Info service.

    The whole a9s Environment Info service will be discontinued and no new versions will be released for it. Please ensure that any internal usage of this component is appropriately removed.

    This direct deprecation phase will be followed by immediate removal, planned for the release v73.0.0 (expected end of May 2026). Therefore, we strongly recommend that any and all adjustments are made, if necessary, soon as possible and to complete them before upgrading to v73.0.0.

    To inquire about extended support for a deprecated component, please get in contact with our sales department at sales@anynines.com.

Fixed​

  • a9s MongoDB: a9s MongoDB SPI: Introduce a timeout for the Mongo client. This was done to prevent the client from infinitely calling any unreachable MongoDB Service Instance, which would exhaust the SPI VM resources.
  • docs: Platform Operator: Fix incorrect statements regarding the blocking of Maintenance Updates. Previously, the admonition provided misleading information about the types of updates the feature is concerned with. For more information, see Block Maintenance Updates

Security​

  • all services:
    • a9s Backup Agent:
      • Fix CVE-2026-34827.
      • Fix CVE-2026-34829.
  • all services:
    • a9s BOSH Deployer:
      • Fix CVE-2026-34827.
      • Fix CVE-2026-34829.
  • all services:
    • a9s Logstash: Fix CVE-2026-33466.
  • all services:
    • a9s Public API:
      • Fix CVE-2026-34827.
      • Fix CVE-2026-34829.
      • Fix CVE-2026-35611.
  • all services:
    • a9s Service Broker:
      • Fix CVE-2026-34827.
      • Fix CVE-2026-34829.
      • Fix CVE-2026-35611.
  • all services:
    • a9s Service Dashboard:
      • Fix CVE-2026-33937.
      • Fix CVE-2026-33941.
      • Fix CVE-2026-33940.
      • Fix CVE-2026-33939.
      • Fix CVE-2026-33938.
      • Fix CVE-2026-33891.
      • Fix CVE-2026-33895.
      • Fix CVE-2026-33894.
      • Fix CVE-2026-33896.
      • Fix CVE-2026-4800.
  • all services:
    • a9s Smoke Tests:
      • Fix CVE-2026-27143.
      • Fix CVE-2026-27140.
      • Fix CVE-2026-32280.
      • Fix CVE-2026-32281.
      • Fix CVE-2026-32283.
      • Fix CVE-2026-27144.
  • all services:
    • a9s Bee:
      • Fix CVE-2026-27140.
      • Fix CVE-2026-27143.
      • Fix CVE-2026-32280.
      • Fix CVE-2026-32281.
      • Fix CVE-2026-32283.
      • Fix CVE-2026-27144.
    • a9s SPIs:
      • Fix CVE-2026-34827.
      • Fix CVE-2026-34829.
      • Fix CVE-2026-35611.
  • a9s-pg:
    • Fix CVE-2025-70873.
    • Fix CVE-2026-27143.
    • Fix CVE-2026-27140.
    • Fix CVE-2026-32280.
    • Fix CVE-2026-32281.
    • Fix CVE-2026-32283.
    • Fix CVE-2026-27144.
  • a9s Backup Services:
    • a9s Backup Manager:
      • Fix CVE-2026-34827.
      • Fix CVE-2026-34829.
    • a9s Backup Monit:
      • Fix CVE-2026-34827.
      • Fix CVE-2026-34829.
  • a9s Billing: Fix CVE-2026-22860.
  • a9s CF Service Guard:
    • Fix CVE-2026-34827.
    • Fix CVE-2026-34829.
  • a9s MariaDB:
    • a9s MariaDB 10.4:
      • Fix CVE-2025-4674.
      • Fix CVE-2025-58187.
      • Fix CVE-2025-58188.
      • Fix CVE-2025-61723.
      • Fix CVE-2026-25679.
      • Fix CVE-2026-27137.
      • Fix CVE-2026-27142.
    • a9s MariaDB 10.6:
      • Fix CVE-2026-27143.
      • Fix CVE-2026-27140.
      • Fix CVE-2026-32280.
      • Fix CVE-2026-32281.
      • Fix CVE-2026-32283.
      • Fix CVE-2026-27144.
    • a9s MariaDB 10.11:
      • Fix CVE-2026-27143.
      • Fix CVE-2026-27140.
      • Fix CVE-2026-32280.
      • Fix CVE-2026-32281.
      • Fix CVE-2026-32283.
      • Fix CVE-2026-27144.
  • a9s Messaging:
    • a9s Messaging 3.8:
      • Fix CVE-2025-4674.
      • Fix CVE-2025-58187.
      • Fix CVE-2025-58188.
      • Fix CVE-2025-61723.
      • Fix CVE-2026-25679.
      • Fix CVE-2026-27137.
      • Fix CVE-2026-27142.
      • Fix CVE-2026-27143.
      • Fix CVE-2026-27140.
      • Fix CVE-2026-32280.
      • Fix CVE-2026-32281.
      • Fix CVE-2026-32283.
      • Fix CVE-2026-27144.
    • a9s Messaging 3.10:
      • Fix CVE-2025-4674.
      • Fix CVE-2025-58187.
      • Fix CVE-2025-58188.
      • Fix CVE-2025-61723.
      • Fix CVE-2026-25679.
      • Fix CVE-2026-27137.
      • Fix CVE-2026-27142.
      • Fix CVE-2026-27143.
      • Fix CVE-2026-27140.
      • Fix CVE-2026-32280.
      • Fix CVE-2026-32281.
      • Fix CVE-2026-32283.
      • Fix CVE-2026-27144.
    • a9s Messaging 3.12:
      • Fix CVE-2025-4674.
      • Fix CVE-2025-58187.
      • Fix CVE-2025-58188.
      • Fix CVE-2025-61723.
      • Fix CVE-2026-25679.
      • Fix CVE-2026-27137.
      • Fix CVE-2026-27142.
      • Fix CVE-2026-27143.
      • Fix CVE-2026-27140.
      • Fix CVE-2026-32280.
      • Fix CVE-2026-32281.
      • Fix CVE-2026-32283.
      • Fix CVE-2026-27144.
    • a9s Messaging 3.13:
      • Fix CVE-2025-4674.
      • Fix CVE-2025-58187.
      • Fix CVE-2025-58188.
      • Fix CVE-2025-61723.
      • Fix CVE-2026-25679.
      • Fix CVE-2026-27137.
      • Fix CVE-2026-27142.
      • Fix CVE-2026-27143.
      • Fix CVE-2026-27140.
      • Fix CVE-2026-32280.
      • Fix CVE-2026-32281.
      • Fix CVE-2026-32283.
      • Fix CVE-2026-27144.
    • a9s Messaging 4:
      • Fix CVE-2026-27143.
      • Fix CVE-2026-27140.
      • Fix CVE-2026-32280.
      • Fix CVE-2026-32281.
      • Fix CVE-2026-32283.
      • Fix CVE-2026-27144.
  • a9s MongoDB:
    • a9s MongoDB SPI: Fix CVEs:
      • CVE-2026-34829.
      • CVE-2026-34827.
  • a9s MySQL:
    • a9s MariaDB 10.4:
      • Fix CVE-2026-27143.
      • Fix CVE-2026-27140.
      • Fix CVE-2026-32280.
      • Fix CVE-2026-32281.
      • Fix CVE-2026-32283.
      • Fix CVE-2026-27144.
  • a9s PostgreSQL:
    • a9s PostgreSQL 17:
      • Fix CVE-2026-27143.
      • Fix CVE-2026-27140.
      • Fix CVE-2026-32280.
      • Fix CVE-2026-32281.
      • Fix CVE-2026-32283.
      • Fix CVE-2026-27144.
    • a9s PostgreSQL 15:
      • Fix CVE-2025-70873.
      • Fix CVE-2026-27143.
      • Fix CVE-2026-27140.
      • Fix CVE-2026-32280.
      • Fix CVE-2026-32281.
      • Fix CVE-2026-32283.
      • Fix CVE-2026-27144.
    • a9s PostgreSQL 13:
      • Fix CVE-2026-27143.
      • Fix CVE-2026-27140.
      • Fix CVE-2026-32280.
      • Fix CVE-2026-32281.
      • Fix CVE-2026-32283.
      • Fix CVE-2026-27144.
      • Fix CVE-2025-4674.
      • Fix CVE-2025-58187.
      • Fix CVE-2025-58188.
      • Fix CVE-2025-61723.
      • Fix CVE-2026-25679.
      • Fix CVE-2026-27137.
      • Fix CVE-2026-27142.
    • a9s PostgreSQL 11:
      • Fix CVE-2025-4674.
      • Fix CVE-2025-58187.
      • Fix CVE-2025-58188.
      • Fix CVE-2025-61723.
      • Fix CVE-2026-25679.
      • Fix CVE-2026-27137.
      • Fix CVE-2026-27142.
    • a9s PostgreSQL 10:
      • Fix CVE-2025-4674.
      • Fix CVE-2025-58187.
      • Fix CVE-2025-58188.
      • Fix CVE-2025-61723.
      • Fix CVE-2026-25679.
      • Fix CVE-2026-27137.
      • Fix CVE-2026-27142.
  • a9s Prometheus:
    • prometheus2:
      • Fix CVE-2026-27143.
      • Fix CVE-2026-27140.
      • Fix CVE-2026-32280.
      • Fix CVE-2026-32281.
      • Fix CVE-2026-32283.
      • Fix CVE-2026-27144.
    • prometheus-legacy:
      • Fix CVE-2026-27143.
      • Fix CVE-2026-27140.
      • Fix CVE-2026-32280.
      • Fix CVE-2026-32281.
      • Fix CVE-2026-32283.
      • Fix CVE-2026-27144.
    • promgraf2:
      • Fix CVE-2026-27143.
      • Fix CVE-2026-27140.
      • Fix CVE-2026-32280.
      • Fix CVE-2026-32281.
      • Fix CVE-2026-32283.
      • Fix CVE-2026-27144.

Upcoming​

  • a9s Messaging: Version Upgrade with Breaking Changes planned for v73.0.0 (End of May 2026):

    Within a9s Messaging 4, RabbitMQ 4.2 will be replaced with RabbitMQ 4.3. There are now Breaking Changes between Minor Versions of RabbitMQ 4, which usually only affect the client side, but require attention. Nevertheless, these RabbitMQ Minor Versions will be released as Minor Versions of a9s Messaging 4.

    Due to recent changes in the RabbitMQ release policy, Minor Versions of RabbitMQ 4 now have a maintenance overlap period of 3 months. Previous versions of RabbitMQ 4 did not have any maintenance overlap period.

    RabbitMQ 4.2 will be supported by the vendor until the 31st of July.

    As a consequence of the Data Service vendor's decision to make the maintenance overlap periods for the open source version of RabbitMQ 4 unusually short, we have decided with the release of a9s Messaging 4 to treat each minor version of RabbitMQ 4 as a minor version of a9s Messaging 4 as well, although some breaking changes between these minor versions may occur.

    Therefore we do not follow our usual process for releasing, deprecating and unsupporting these versions as Major Versions: RabbitMQ 4.2 will not be deprecated and unsupported with our default processes, due to the aforementioned situation.

    The version upgrade from RabbitMQ 4.2 to 4.3 will be handled as fully automatic in-place upgrade of the a9s Messaging 4 Service Instances, as is currently the case for all minor version upgrades of our Data Services. Thus, RabbitMQ 4.2 will be unsupported, as soon as RabbitMQ 4.3 is available with a9s Data Services.

    a9s Data Service will only support one minor version of RabbitMQ 4 (offered as a9s Messaging 4) at any given time.

    Please take the necessary steps now to ensure compatibility with the new RabbitMQ Minor Version to be shipped with v73.0.0, which will be released at the end of May 2026.

    The following Breaking Changes must be considered and the Recommended Actions must be taken before upgrading to v73.0.0. We recommend to take care of these changes immediately to ensure a smooth transition.

    • Classic Queues v1 Storage (CQv1) is Removed

      Starting with RabbitMQ 4, all classic queues will be automatically converted to version 2 (CQv2), even if they are defined as version 1 (CQv1). If there are existing version 1 (CQv1) queues, they will be converted at RabbitMQ service start.

      RabbitMQ 4.3 removes the original classic queue storage implementation these days known as CQv1. This will lead to all attempts to fail that try to create classic queues with the following parameters:

      • x-queue-mode set to any value
      • x-queue-version set to 1

      All applications or automations that should be adapted to not set those parameters for the declaration of queues.

    • Consumer Timeout

      Starting with RabbitMQ 4.3, quorum queues will support configurable consumer timeouts. For more information, please see the RabbitMQ 4.3 documentation of the vendor.

      In addition to this change, consumer timeouts are removed for classic queues. Therefore, all applications should be evaluated if they depend on the consumer timeouts for classic queues and use quorum queues instead.

    • Quorum Queues support unlimited returns

      Up to RabbitMQ 4.2, every requeued message incremented its delivery-count by 1, regardless of the reason. Poison message handling would dead-letter the message once this count exceeded the queue's delivery-limit. Starting with RabbitMQ 4.3, quorum queues track two distinct counters: acquired-count and delivery-count.

      The delivery limit will based on delivery-count rather than the new header acquired-count. This can lead to unlimited explicit message returns (by nack or AMQP 1.0 modify with delivery_failed=false) without counting towards the delivery limit.

      The header x-acquired-count will track the number of times a messages was aquired by a consumer. And x-delivery-count will track the actual number of failed deliveries.

      All applications should be evaluated if quorum queues are used with poison message handling and, if required, adapt the application accordingly.

    • Khepri is Now The Only Metadata Store

      Starting with RabbitMQ 4.3, the Mnesia Storage Engine will be removed in favor of the new Khepri Storage Engine. The Khepri Storage Engine was introduced with RabbitMQ 4.0 and is the new default since RabbitMQ 4.2 for all newly created Service Instances.

      All a9s Messaging Service Instance that were updated from a9s Messaging 4.1 (or prior) to 4.2, are still using the Mnesia Storage Engine. If a9s Messaging Service Instances with Mnesia are upgraded to RabbitMQ 4.3, they will automatically migrate their data to the new Khepri Storage Engine on the first start. Even though this process should work without issues, we recommend to use the Strategy to safely evaluate RabbitMQ 4.X minor updates to safely update a9s Messaging Service Instances to RabbitMQ 4.3. Because if those Service Instances would break during the Storage Engine migration process, there could be issues to do a rollback.

      With the following command it can be identified if the Khepri Storage Engine is already being used:

      curl -k -s -u <user>:<pass> 'https://<node-hostname_or_alias>:15672/api/feature-flags' | grep khepri_db

      If there is a object with the name khepri_db, then the Khepri Storage Engine is used on the Service Instance.

71.0.1

· One min read

Fixed​

  • all services: a9s SPIs: Fix the issue that caused custom parameter configuration set at Service Plan level to be used for all plans, as it overwrote the referenced object in memory as well.

71.0.0

· 10 min read

Added​

  • breaking change a9s MongoDB: Introduce a9s MongoDB 8.0 SSPL (Add-on) as an a9s Generally Available (GA). For more information, see a9s Platform Operator - Sunrise Sunset.
  • all services: a9s Service Broker: Introduce the Beta release of the Stop/Start feature. For more information, see Common Features - Stop/Start Feature.
  • all services: a9s Public API: Add the Stop/Start feature related endpoints to the a9s Public API V1. For more information, see API V1 Endpoints - Stop/Start.
  • a9s MongoDB: Add support to configure TLS 1.3 cipher suites via the tls13_cipher_suites custom parameter. This maps to the MongoDB opensslCipherSuiteConfig startup parameter.
  • a9s MongoDB: a9s MongoDB SPI: Implement the new custom parameter tls13_cipher_suites to support the MongoDB opensslCipherSuiteConfig startup parameter.
  • a9s PostgreSQL: Create external bootstrap lock to prevent reinitialization of databases already created.
  • docs: Application Developer: all services: Add initial documentation for the Stop/Start feature. For more information, see Common Features - Stop/Start Feature.
  • docs: Application Developer: a9s MongoDB: Add an admonition regarding the migration path for the Disaster Recovery feature. For more information, see Forking and Migration.
  • docs: Application Developer: a9s PostgreSQL: Add references to the external bootstrap lock introduced to the a9s PostgreSQL Continuous Archiving Service Instances. For more information, see Continuous Archiving and Point-in-Time Recovery (PITR) - Data Protection.
  • docs: Platform Operator: a9s PostgreSQL: Add new section to the PostgreSQL Cluster Recovery documentation explaining the recovery of the external bootstrap lock. For more information, see Cluster Recovery - Recreate bootstrap_initialized.lock File.
  • docs: Platform Operator: a9s Service Broker: Add initial documentation for the Stop/Start feature. For more information, see Stop/Start Feature.
  • INTERNAL RELEASE a9s Backup Manager: Add script to find unknown files in the backup storage.

Changed​

  • all services: a9s Beehive: Improve the a9s Bee discovery in a9s Beehive by replacing API calls to a9s Service Broker with a9s Consul.
  • all services: a9s Deployer: Extend the definition of outdated Service Instances to include stopped Service Instances.
  • all services: a9s Deployment Updater Errand: Extend the functionality of the update strategy, using the outdated instance type, to skip all stopped Service Instances. The output of the errand has also been extended to reflect this additional Service Instance state. For more information, see a9s Deployment Updater - Update.
  • all services: a9s Public API: Add Secure attribute to session cookie, which is set after the Oauth Handshake between CF UAA and a9s Public API.
  • all services: a9s Public API: Extend internal plugin to better handle and sanitize the response from the endpoints that are in communication with the a9s Service Broker.
  • all services: a9s Service Broker: Improve performance by extending the a9s Service Broker from single threaded to multithreaded. It now able to run up to five threads.
  • all services: a9s Service Broker: Improve error handling to be more explicit about the error that occurred. This change also extends to concurrency errors.
  • all services: a9s Service Dashboard: Remove reference to manifest.json to avoid unnecessary API calls to the a9s Public API.
  • a9s KeyValue: Rename the occurrence of keyvalue to valkey in the enable-service-instances-aws-instance-profiles.yml Ops file.
  • a9s MongoDB: Enforce SSL communication in internal create-admin and update-admin scripts for a9s MongoDB 8.0 BOSH release.
  • a9s Prometheus: Add internal configuration to Grafana.
  • docs: Application Developer: Update the links in the Disaster Recovery documentation to use the latest version of the a9s Cloud Foundry CLI Plugin. For more information, see Disaster Recovery.
  • docs: Application Developer: a9s PostgreSQL: Move the "PostgreSQL Extensions" section from the "Metrics" page into the "Custom Parameters" page. For more information, see a9s PostgreSQL - Custom Parameters - PostgreSQL Extensions.
  • docs: Application Developer: a9s PostgreSQL: Refactor the contents of the "Custom Parameters" page to improve readability. For more information, see a9s PostgreSQL - Custom Parameters.
  • docs: Application Developer: a9s Public API: Extend the API V1 Endpoints documentation with the Stop/Start feature related enpdoints. For more information, see API V1 Endpoints - Stop/Start.
  • docs: Platform Operator: Rename the occurrence of keyvalue to valkey in the "Extending the a9s Data Services' Templates" section. For more information, see Using AWS Instance Profiles.
  • BOSH stemcell: all services: Update Jammy stemcell to version 1.1107, for internal tests of all supported services.

Updated Dependencies​

  • all services:
    • a9s Backup Agent: Bump Ruby gem dependencies.
    • a9s Bee:
      • Update dependencies to resolve CVEs.
    • a9s BOSH Deployer: Bump Ruby gem dependencies.
    • a9s Dashboard API: Update internal dependencies.
    • a9s Public API:
      • a9s-beehive to v1.2.5
      • krakend-custom-plugins to v2.13.3.
      • krakend to v2.13.3.
      • nginx to v1.29.7.
    • a9s Service Dashboard:
      • Node.JS to v22.22.2.
      • Update internal dependencies.
    • a9s Smoke Tests: Update internal dependencies.
    • a9s SPIs: Bump Ruby gem dependencies.
    • a9s SSO Proxy: Bump Ruby gem dependencies.
    • bpm to v1.4.27.
    • logstash to v8.19.12.
    • nginx:
      • nginx to v1.29.7.
    • routing to v0.370.0.
  • a9s-pg:
    • a9s PostgreSQL: a9s PostgreSQL 15: Update internal dependencies.
    • Update internal dependencies.
  • a9s Backup Services:
    • a9s Backup Agent: Bump Ruby gem dependencies.
    • a9s Backup Manager: Bump Ruby gem dependencies.
    • a9s Backup Monit: Bump Ruby gem dependencies.
  • a9s Billing: Update internal dependencies.
  • a9s CF Service Guard: Bump Ruby gem dependencies.
  • a9s KeyValue: a9s Service Broker: Bump Ruby gem dependencies.
  • a9s LogMe2:
    • a9s Service Broker: Bump Ruby gem dependencies.
    • opensearch to v2.19.5.
    • opensearch-dashboards to v2.19.5.
    • opensearch-plugin-repository-azure to v2.19.5.
    • opensearch-plugin-repository-s3 to v2.19.5.
  • a9s MariaDB:
    • a9s MariaDB 10.6:
      • Update internal dependencies.
    • a9s MariaDB 10.11:
      • Update internal dependencies.
    • a9s Service Broker: Bump Ruby gem dependencies.
  • a9s Messaging:
    • a9s Messaging 4:
      • erlang to v27.3.4.9.
      • rabbitmq to v4.2.5.
      • Update internal dependencies.
    • a9s Service Broker: Bump Ruby gem dependencies.
  • a9s MongoDB:
    • a9s MongoDB 7:
      • mongodb to v7.0.31
      • mongosh to v2.8.1.
      • Update internal dependencies.
    • a9s MongoDB 8:
      • mongodb to v8.0.20
      • mongosh to v2.8.1.
      • Update internal dependencies.
    • a9s Service Broker: Bump Ruby gem dependencies.
  • a9s PostgreSQL:
    • a9s PostgreSQL 13:
      • pgvector to v0.8.2.
    • a9s PostgreSQL 15:
      • pgvector to v0.8.2.
      • Update internal dependencies.
    • a9s PostgreSQL 17:
      • pgvector to v0.8.2.
      • Update internal dependencies.
    • a9s Service Broker: Bump Ruby gem dependencies.
  • a9s Prometheus:
    • a9s Service Broker: Bump Ruby gem dependencies.
    • prometheus2:
      • collectd_exporter to v0.7.1.
      • statsd_exporter to v0.29.0.
      • postgres_exporter to v0.19.1.
      • mysqld_exporter to v0.19.0.
      • Update internal dependencies.
    • prometheus-legacy:
      • statsd_exporter to v0.29.0.
      • postgres_exporter to v0.19.1.
      • Update internal dependencies.
    • promgraf2:
      • collectd_exporter to v0.7.1.
      • statsd_exporter to v0.29.0.
      • postgres_exporter to v0.19.1.
      • mysqld_exporter to v0.19.0.
      • Update internal dependencies.
  • a9s Redis:
    • a9s Redis 7: redis to v7.2.13.
    • a9s Service Broker: Bump Ruby gem dependencies.
  • a9s Search:
    • a9s Service Broker: Bump Ruby gem dependencies.
    • opensearch to v2.19.5.
    • opensearch-dashboards to v2.19.5.
    • opensearch-plugin-repository-azure to v2.19.5.
    • opensearch-plugin-repository-s3 to v2.19.5.

Fixed​

  • all services: a9s Backup Agent: Fix port configuration in the backup store used for OpenSearch backups. The ports given for backup storages are now used during the creation of OpenSearch backups.
  • all services: a9s BOSH Deployer: Fix update process of the deployment status. This fixes a failure that caused the a9s Deployer to keep the Service Instance's state as deploying, which prevented further operations from taking place.
  • all services: a9s Smoke Tests: Fix a9s Smoke Tests issue by choosing the correct App URL based on the "Apps Domain" in the a9s Data Service manifest when multiple Cloud Foundry App domains are configured.
  • all services: a9s SPIs: Fix parameter parsing to accept Service Plan names with special characters like ..
  • a9s Backup Services: a9s Backup Manager: Improve cronparser to work more reliabily when triggering automated backups.
  • a9s MongoDB: a9s MongoDB SPI: Fix the handling of Intermediate Wildcard CAs to ensure the complete CA chain is used to validate the a9s MongoDB Service Instance certificates.
  • a9s Service Dashboard: Extend error notification when provided by the backend components.
  • docs: Application Developer: a9s Public API: Fix example API call to update the Service Instance settings via cURL. For more information, see API V1 Endpoints - Update Instance Settings.
  • docs: Platform Operator: a9s MongoDB: Simplify the manual cluster restore instructions, and fix minor issues in the provided commands. For more information, see Manual Logical Backup Recovery.
  • INTERNAL RELEASE a9s KeyValue: Fix issue with reconnection to the cluster after the failover on the unit tests.

Security​

  • all services:
    • a9s Backup Agent: Fix CVE-2026-22860.
    • a9s Bee:
      • Fix CVE-2025-4674.
      • Fix CVE-2025-58187.
      • Fix CVE-2025-58188.
      • Fix CVE-2025-61723.
      • Fix CVE-2026-25679.
      • Fix CVE-2026-27137.
      • Fix CVE-2026-27142.
    • a9s BOSH Deployer: Fix CVE-2026-22860.
    • a9s Dashboard API:
      • Fix CVE-2026-27601.
      • Fix CVE-2026-26996.
      • Fix CVE-2026-27903.
      • Fix CVE-2026-27904.
      • Fix CVE-2026-32141.
      • Fix CVE-2026-33228.
    • a9s Public API:
      • Fix CVE-2026-27601.
      • Fix CVE-2026-26996.
      • Fix CVE-2026-27903.
      • Fix CVE-2026-27904.
      • Fix CVE-2026-32141.
      • Fix CVE-2026-33228.
    • a9s Service Dashboard:
      • Fix CVE-2026-27601.
      • Fix CVE-2026-27606.
      • Fix CVE-2026-26996.
      • Fix CVE-2026-27903.
      • Fix CVE-2026-27904.
      • Fix CVE-2026-29063.
      • Fix CVE-2026-29074.
      • Fix CVE-2026-32141.
      • Fix CVE-2026-33228.
    • a9s Smoke Tests:
      • Fix CVE-2025-4674.
      • Fix CVE-2025-58187.
      • Fix CVE-2025-58188.
      • Fix CVE-2025-61723.
      • Fix CVE-2026-22860.
      • Fix CVE-2026-25679.
      • Fix CVE-2026-27137.
      • Fix CVE-2026-27142.
    • a9s SPIs: Fix CVE-2026-22860.
    • a9s SSO Proxy: Fix CVE-2026-22860.
  • a9s-pg:
    • Fix CVE-2025-4674.
    • Fix CVE-2025-58187.
    • Fix CVE-2025-58188.
    • Fix CVE-2025-61723.
    • Fix CVE-2026-25679.
    • Fix CVE-2026-27137.
    • Fix CVE-2026-27142.
  • a9s Backup Services:
    • a9s Backup Agent: Fix CVE-2026-22860.
    • a9s Backup Manager: Fix CVE-2026-22860.
    • a9s Backup Monit: Fix CVE-2026-22860.
  • a9s Billing: Fix CVE-2026-22860.
  • a9s CF Service Guard: Fix CVE-2026-22860.
  • a9s KeyValue: a9s Service Broker: Fix CVE-2026-22860.
  • a9s LogMe2: a9s Service Broker: Fix CVE-2026-22860.
  • a9s MariaDB:
    • a9s MariaDB 10.6:
      • Fix CVE-2025-4674.
      • Fix CVE-2025-58187.
      • Fix CVE-2025-58188.
      • Fix CVE-2025-61723.
      • Fix CVE-2026-25679.
      • Fix CVE-2026-27137.
      • Fix CVE-2026-27142.
    • a9s MariaDB 10.11:
      • Fix CVE-2025-4674.
      • Fix CVE-2025-58187.
      • Fix CVE-2025-58188.
      • Fix CVE-2025-61723.
      • Fix CVE-2026-25679.
      • Fix CVE-2026-27137.
      • Fix CVE-2026-27142.
    • a9s Service Broker: Fix CVE-2026-22860.
  • a9s Messaging:
    • a9s Messaging 4:
      • Fix CVE-2025-4674.
      • Fix CVE-2025-58187.
      • Fix CVE-2025-58188.
      • Fix CVE-2025-61723.
      • Fix CVE-2026-25679.
      • Fix CVE-2026-27137.
      • Fix CVE-2026-27142.
    • a9s Service Broker: Fix CVE-2026-22860.
  • a9s MongoDB:
    • a9s MongoDB 7: Fix CVEs:
      • CVE-2026-4147
      • CVE-2026-4148
    • a9s MongoDB 8: Fix CVEs:
      • CVE-2026-4147
      • CVE-2026-4148
    • a9s Service Broker: Fix CVE-2026-22860.
  • a9s PostgreSQL:
    • a9s PostgreSQL 13: Fix CVE-2026-3172.
    • a9s PostgreSQL 15:
      • Fix CVE-2025-4674.
      • Fix CVE-2025-58187.
      • Fix CVE-2025-58188.
      • Fix CVE-2025-61723.
      • Fix CVE-2026-3172.
      • Fix CVE-2026-25679.
      • Fix CVE-2026-27137.
      • Fix CVE-2026-27142.
    • a9s PostgreSQL 17:
      • Fix CVE-2025-4674.
      • Fix CVE-2025-58187.
      • Fix CVE-2025-58188.
      • Fix CVE-2025-61723.
      • Fix CVE-2026-3172.
      • Fix CVE-2026-25679.
      • Fix CVE-2026-27137.
      • Fix CVE-2026-27142.
    • a9s Service Broker: Fix CVE-2026-22860.
  • a9s Prometheus:
    • a9s Service Broker: Fix CVE-2026-22860.
    • prometheus2:
      • Fix CVE-2025-4674.
      • Fix CVE-2025-58187.
      • Fix CVE-2025-58188.
      • Fix CVE-2025-61723.
      • Fix CVE-2026-25679.
      • Fix CVE-2026-27137.
      • Fix CVE-2026-27142.
    • prometheus-legacy:
      • Fix CVE-2025-4674.
      • Fix CVE-2025-58187.
      • Fix CVE-2025-58188.
      • Fix CVE-2025-61723.
      • Fix CVE-2026-25679.
      • Fix CVE-2026-27137.
      • Fix CVE-2026-27142.
    • promgraf2:
      • Fix CVE-2025-4674.
      • Fix CVE-2025-58187.
      • Fix CVE-2025-58188.
      • Fix CVE-2025-61723.
      • Fix CVE-2026-25679.
      • Fix CVE-2026-27137.
      • Fix CVE-2026-27142.
  • a9s Redis: a9s Service Broker: Fix CVE-2026-22860.
  • a9s Search: a9s Service Broker: Fix CVE-2026-22860.

70.0.0

· 8 min read

Added​

  • breaking change a9s MongoDB: Introduce a9s MongoDB 8.0 SSPL (Add-on) as an a9s Release Candidate.
  • all services: a9s Service Broker: Add two new fields, state and locked to the script instance-information.
  • all services: a9s Template Uploader Errand: Add templates for a9s MongoDB 8.0 SSPL (Add-on).
  • docs: Application Developer: Add an admonition to notify Application Developers about the deprecation & unsupport of a9s PostgreSQL 13 Data Service. For more information, see a9s PostgreSQL.
  • docs: Application Developer: Add an admonition to notify Application Developers about the deprecation & unsupport of the a9s Redis® Data Service. For more information, see a9s Redis®.
  • docs: Platform Operator: Add an admonition to notify Platform Operators about the deprecation & unsupport of the a9s Redis® Data Service. For more information, see a9s Redis®.
  • docs: Platform Operator: a9s Service Broker: Update the instance-information script documentation to include the new fields, state and locked. For more information, see a9s Service Broker - Retrieve Service Instance Information.

Changed​

  • breaking change all services: a9s Service Broker: Adapt the script instance-information.erb in the a9s Service Broker BOSH release to provide the context of a Service Instance instead of the metadata.
  • breaking change a9s MongoDB: Update addons/mongodbsspl/ops/add-mongodb-sspl.yml with the following new properties to introduce a9s MongoDB 8.0 SSPL (Add-on) as an a9s Release Candidate:
    • mongodb_service.services.a9s-mongodb80.name
    • mongodb_service.services.a9s-mongodb80.guid
    • mongodb_service.services.a9s-mongodb80.description
    • mongodb_service.services.a9s-mongodb80.label
    • mongodb_service.services.a9s-mongodb80.version
    • mongodb_service.services.a9s-mongodb80.bindable
    • mongodb_service.services.a9s-mongodb80.requires
    • mongodb_service.services.a9s-mongodb80.tags
    • mongodb_service.services.a9s-mongodb80.documentation_url
    • mongodb_service.services.a9s-mongodb80.metadata
    • mongodb_service.services.a9s-mongodb80.dashboard_client.id
    • mongodb_service.services.a9s-mongodb80.plans-to-test
    • mongodb_service.services.a9s-mongodb80.planupdates-to-test
  • all services: a9s Backup Agent: Change the logging level of the a9s Backup Agent's task from error to info for better visibility.
  • all services: a9s Public API: Extend functionality of the operations endpoints of the Stop/Start Experimental Feature to allow to forward pagination related query parameters. For more information, see Experimental Features - Stop/Start Feature.
  • all services: a9s Public API: Update CF API v2 calls to v3.
  • all services: a9s Service Broker: Improve behavior and reliability of the Stop/Start Experimental Feature. For more information, see Experimental Features - Stop/Start Feature.
  • all services: a9s Service Broker: Update CF API v2 calls to v3.
  • all services: a9s Smoke Tests: Update CF API v2 calls to v3.
  • all services: a9s SSO Proxy: Update CF API v2 calls to v3.
  • a9s MariaDB: a9s Logstash: Transform ON/OFF metrics to 1/0 and include them in the metrics.
  • a9s Messaging: Move legacy templates from folder messaging41 to messaging4.
  • a9s MongoDB: a9s Logstash: Stream all available additional metrics that are compatible with the Graphite standard.
  • a9s MongoDB: a9s MongoDB SPI: Enhance the validation for the ssl_ciphers custom parameter to ensure no malicious strings can be injected into the configuration.
  • a9s PostgreSQL: a9s PostgreSQL SPI: Enhance the validation for the ssl_ciphers custom parameter to ensure no malicious strings can be injected into the configuration.
  • docs: Application Developer: a9s MongoDB: Adapt the MongoDB metrics documentation page to reflect the information that all available metrics are streamed. For more information, see Service Instance Metrics.
  • docs: Application Developer: a9s MongoDB: Update the migration documentation to reflect the current State and include a clear migration path for all supported a9s MongoDB Data Service versions. For more information, see Forking and Migration.
  • docs: Platform Operator: Add a9s MongoDB 8.0 RC to the "a9s Data Service Release Lifecycle" table. For more information, see a9s Platform Operator - Sunrise Sunset.
  • docs: Platform Operator: Update the Vendor DS version for MariaDB 10.6 in the "a9s Data Service Release Lifecycle" table. For more information, see a9s Platform Operator - Sunrise Sunset.
  • docs: Platform Operator: Add the available templates for MongoDB 8.0 RC to the documentation. For more information, see Available Templates.
  • docs: Platform Operator: Add the required ports for a9s MongoDB 8.0 RC to the documentation. For more information, see Required Ports.
  • BOSH stemcell: all services: Update Jammy stemcell to version 1.1065 for internal tests of all supported services.

Updated Dependencies​

  • all services:
    • a9s Service Dashboard:
      • Update internal dependencies.
    • a9s Public API:
      • krakend-custom-plugins to v2.13.1.
      • krakend to v2.13.1.
      • nginx to v1.29.5.
    • a9s Smoke Tests: Update internal dependencies.
    • bpm to v1.4.26.
    • nginx:
      • nginx to v1.29.5.
    • routing to v0.366.0.
  • a9s-pg: a9s PostgreSQL: a9s PostgreSQL 15: Update internal dependencies.
  • consul-dns: Dnsmasq: Update internal dependencies.
  • a9s Billing: Update internal dependencies.
  • a9s KeyValue: a9s Valkey 8: Update internal dependencies.
  • a9s LogMe2:
    • Fluentd:
      • Bump openssl from 3.3.0 to 4.0.0.
      • Bump uri from 1.0.3 to 1.0.4.
      • Update internal dependencies.
    • a9s Search: Update internal dependencies.
  • a9s MariaDB:
    • a9s MariaDB 10.6:
      • MariaDB to v10.6.25.
      • Update internal dependencies.
    • a9s MariaDB 10.11:
      • MariaDB to v10.11.16.
      • Update internal dependencies.
  • a9s Messaging:
    • a9s Messaging 4:
      • erlang to v27.3.4.8.
      • rabbitmq to v4.2.4.
      • Update internal dependencies.
  • a9s MongoDB:
    • a9s MongoDB 5: Update internal dependencies.
    • a9s MongoDB 7:
      • mongodb to v7.0.30.
      • mongosh to v2.7.0.
      • Update internal dependencies.
  • a9s PostgreSQL:
    • a9s PostgreSQL 13:
      • cmake3 to v3.31.11.
      • Update internal dependencies.
    • a9s PostgreSQL 15:
      • PostgreSQL to 15.16.
      • Update internal dependencies.
    • a9s PostgreSQL 17:
      • PostgreSQL to 17.8.
      • Update internal dependencies.
  • a9s Prometheus:
    • prometheus2:
      • alertmanager to v0.31.1.
      • memcached_exporter to v0.15.5.
      • postgres_exporter to v0.19.0.
      • Update internal dependencies.
    • prometheus-legacy:
      • alertmanager to v0.31.1.
      • postgres_exporter to v0.19.0.
      • Update internal dependencies.
    • promgraf2:
      • alertmanager to v0.31.1.
      • postgres_exporter to v0.19.0.
      • Update internal dependencies.
  • a9s Redis: a9s Redis 7: Update internal dependencies.
  • a9s Search: Update internal dependencies.

Deprecated​

  • a9s Redis®: Deprecation: Deprecate the following Data Service:

    • a9s Redis®

    The whole Data Service will be discontinued and no new versions will be released for it. Please ensure that you organize the migration of your existing Service Instances to the supported a9s KeyValue Data Service:

    • for a9s Redis®: a9s KeyValue 8 is available as GA version.

    Existing a9s Redis® Service Instances can be migrated to a9s KeyValue by forking them using the Disaster Recovery feature, or by applying manual migration steps. For more information about the available migration options, please see the Forking and Migration documentation page.

    This deprecation follows the announcement in v67.0.0. The deprecation phase is planned to last until v73.0.0 (expected end of May). With that release, the unsupport phase of the deprecated Data Service will start. The creation of new a9s Data Service Instances for this Data Service will be disabled by default in the a9s Data Service Bundle when the unsupport occurs in v76.0.0 (expected end of August) and we will not provide regular support for this Data Service. The corresponding documentation will also be removed. Therefore, we strongly recommend that you start your migrations to a supported Data Service as soon as possible and complete them until the end of the deprecation phase. For more information see a9s Platform Operator Sunrise Sunset.

Fixed​

  • all services: a9s SPIs: Remove the possibility to set undocumented custom parameters during Service Instance creation, that could be used for a command injection attack.
  • all services: a9s SPIs: Merge SPI's custom parameter config with the Service Plan's custom parameter config, so that the Service Plan's settings can override, but not entirely replace, the SPI's settings.
  • docs: all services: Fix small typos across both documentation paths.
  • docs: Application Developer: a9s PostgreSQL: Fix the note admonition in the max_connections custom parameter section by properly closing it. For more information, see a9s PosgreSQL - Custom Parameters - max_connections.

Security​

  • all services:
    • a9s Service Dashboard: Fix CVE-2026-1615.
    • a9s Smoke Tests:
      • Fix CVE-2025-69419.
      • Fix CVE-2025-69420.
      • Fix CVE-2025-69421.
  • a9s Billing: Fix CVE-2025-68696.
  • a9s MongoDB: Fix CVEs:
    • CVE-2026-1847
    • CVE-2026-1848
    • CVE-2026-1849
    • CVE-2026-1850
    • CVE-2026-25609
    • CVE-2026-25610
    • CVE-2026-25611
    • CVE-2026-25612
    • CVE-2026-25613
    • CVE-2025-69419
    • CVE-2025-69420
    • CVE-2025-69421
  • a9s MongoDB: Hardened custom parameter handling to close code and config injection vulnerabilities.
  • a9s PostgreSQL: Fix CVEs:
    • CVE-2026-2004
    • CVE-2026-2005
    • CVE-2026-2006
  • a9s PostgreSQL: Hardened custom parameter handling to close config injection vulnerabilities.

Upcoming​

  • a9s PostgreSQL: End of Support: Terminate support, starting from anynines deployment v73.0.0 (expected end of May 2026), for the following deprecated a9s Data Service version:

    • a9s PostgreSQL 13: PostgreSQL 13 is end-of-life by their vendor since November 2025.

    The creation of new a9s Data Service Instances for this deprecated version will be disabled by default in the a9s Data Service Bundle, and we will not provide regular support for this version. The corresponding documentation will also be removed.

    Although we will not intentionally break running Service Instances of this unsupported version, it cannot be guaranteed that they still work as expected after an update to v73.0.0.