v2025.1.14

🚀 v2025.1.14 🚀

🎯 Core

• 🐛 CVE Fixes: Updated Go toolchain to 1.26.3 and bumped github.com/gofiber/fiber/v2 to v2.52.13 to resolve CVE-2026-33811, CVE-2026-33814, CVE-2026-39820, CVE-2026-39836, and CVE-2026-42499. Note: fiber is only used transitively by the fileserver plugin, BUG #2339 (thanks @dmitryuk).

🧰 Plugins

🧪 Temporal

• ✨ LocalActivityParams (Go SDK compatibility): Added DataConverter, FailureConverter, and Attempt fields to LocalActivityParams to match the required Go SDK fields, preventing a potential nil-pointer dereference during local activity execution. Includes new unit tests covering default and populated values, PR #761 (thanks @xepozz).

v2025.1.13

🚀 v2025.1.13 🚀

Changelog

🎯 Core

• 🐛 CVE Fixes: Updated dependencies and Go version to 1.26.2 to resolve CVE-2026-32280 and CVE-2026-39883 (go/stdlib), CHORE (thanks @rebecca-canyon)

v2025.1.12

Changelog

🎯 Core

• 🐛 CVE Fix (deps): Updated google.golang.org/grpc to v1.79.3 to resolve CVE-2026-33186 — a server-side authorization bypass where malformed :path headers could circumvent path-based restricted deny rules in gRPC interceptors, CHORE (thanks @rebecca-canyon)

v2025.1.11

Changelog

📦 otel plugin

• 🐛 OTEL Semconv: Fixed a regression where the OpenTelemetry plugin failed to start due to conflicting semconv Schema URLs (v1.39.0 vs v1.40.0); updated semconv to v1.40, BUG (thanks @dmitryuk)

🎯 Core

• ✨ E2E Tests: Added end-to-end test suite with plugins (HTTP, gRPC, Jobs) including OpenTelemetry integration to prevent plugin compatibility regressions, FR

v2025.1.9

📦 grpc plugin

• ✨ Glob Patterns: Added support for ** (globstar/recursive) and brace expansion {pattern1,pattern2} in grpc.proto configuration paths, FR (thanks @Nyholm)

🎯 Core

• 🐛 CVE Fixes (deps): Updated Go packages to resolve CVE-2026-27141 and CVE-2026-25882, Issue (thanks @Orrison)
• 🐛 CVE Fixes (stdlib): Updated Go version to 1.26.1 to address CVE-2026-25679, CVE-2026-27142, CVE-2026-27137 in go/stdlib, Issue (thanks @Orrison)

v2025.1.8

Changelog

📦 gzip middleware

• 🐛 Gzip Middleware: Fixed a regression where responses could be encoded with zstd after upgrading to v2025.1.7; the middleware now enforces gzip-only compression BUG (thanks @dmitryuk)

v2025.1.7

Changelog

🎯 Core

• 🐛 Go Version: Updated minimum Go version to 1.26 to address CVE-2025-61726 in go/stdlib BUG (thanks @Orrison)

v2025.1.6

🚀 v2025.1.6 🚀

Changelog

🎯 Core

• ✨ Go Version: Updated minimum Go version to 1.25.5.

v2025.1.5

🚀 v2025.1.5 🚀

Changelog

🎯 Core

• ✨ SIGUSR2 Signal Support: Added support for the SIGUSR2 signal on Unix-like systems to enable graceful process restarts. When the configuration file is a symlink, RoadRunner will properly re-read the configuration from the symlink target after restart FR (thanks @koren88)
• ✨ Go Version: Updated minimum Go version to 1.25.4.

📦 Velox

• ✨ Velox: Updated to version v2025.1.5 with an updated template that pinned third-party dep tablewriter that caused problems when building RR.

v2025.1.4

Changelog

🎯 Core

• ✨ Fileserver Plugin: The Fileserver plugin has been restored to the standard bundle because of the resolution of all CVEs in its dependency, GoFiber.
• ✨ Green Tea Garbage Collector: The Green Tea garbage collector has been disabled by default after receiving several bug reports related to its use. For more details, see the Go RFC.
• ✨ Automaxprocs: The automaxprocs library from Uber has been removed, as Go 1.25 now includes this functionality natively.

📦 Velox

• ✨ Velox: Updated to version v2025.1.4 with an updated template that removed the automaxprocs dependency.