Skip to content

Bump github.com/nats-io/nats-server/v2 from 2.15.1 to 2.15.2 - #708

Merged
github-actions[bot] merged 1 commit into
masterfrom
dependabot/go_modules/github.com/nats-io/nats-server/v2-2.15.2
Oct 31, 2026
Merged

github-actions[bot] merged 1 commit into
masterfrom
dependabot/go_modules/github.com/nats-io/nats-server/v2-2.15.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 31, 2026 •

Copy link
Copy Markdown
Contributor

Bumps github.com/nats-io/nats-server/v2 from 2.15.1 to 2.15.2.

Release notes

Sourced from github.com/nats-io/nats-server/v2's releases.

Release v2.15.2

Changelog

Refer to the 2.15 Upgrade Guide for backwards compatibility notes with 2.14.x.

Go Version

  • 1.27.3, which contains mitigations for CVE-2026-111943 by distrusting eMudhra intermediate certificates (#8798)

Dependencies

  • github.com/klauspost/compress v1.20.3 (#8798)
  • golang.org/x/crypto v0.58.0 (#8798)
  • golang.org/x/sys v0.49.0 (#8798)

Fixed

General

  • Allowed connection types are now correctly respected in auth callout setups
  • Fixed a potential queue sub weight amplification in the sublist
  • OCSP responses are now correctly bound to the certificate serial number

JetStream

  • Restored v1 stream snapshots now correctly guard against excessive subject lengths, subject counts or block counts

Leafnodes

  • ACLs on leafnode connections no longer override allow/deny lists to implicitly allow $MQTT.> permissions

MQTT

  • OCSP verification for MQTT connections now correctly obeys the ocsp_peer option in the mqtt block

Complete Changes

nats-io/nats-server@v2.15.1...v2.15.2

Commits
  • 5a815f1 Release v2.15.2
  • ce74e90 Cherry-picks for 2.15.2
  • d607b66 [FIXED] OCSP peer debug log for invalid cached delegation missing fingerprint
  • d999a7c [IMPROVED] Reuse OCSP delegation check for route/gateway staples
  • 6fe5aa7 [FIXED] OCSP staple status accepted from signers not authorized by the CA
  • a9ea248 [FIXED] OCSP responses not bound to the certificate's serial number
  • 74a69e6 [FIXED] MQTT ocsp_peer ignored in favor of top-level TLS options
  • eb1459a [FIXED] Leafnode permissions bypassed for $MQTT. subjects
  • 2e6d391 [FIXED] Bound counts and lengths when recovering stream state
  • c33a421 [FIXED] Queue weight overflow withdrawing route and leaf interest
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Oct 31, 2026
@github-actions
github-actions Bot enabled auto-merge (squash) October 31, 2026 12:31
@github-actions

Copy link
Copy Markdown

Gemini PR Review

Reviewed commit: 422e79b4e10d862afc1b781fc8ab278754c44c0f
Verdict: PASS

There are no actionable findings in the provided diff. The changes consist solely of minor version upgrades for Go dependencies and their corresponding checksums, which do not introduce new application logic or apparent security, correctness, or testing issues based on the diff content.

Bumps [github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server) from 2.15.1 to 2.15.2.
- [Release notes](https://github.com/nats-io/nats-server/releases)
- [Changelog](https://github.com/nats-io/nats-server/blob/main/RELEASES.md)
- [Commits](nats-io/nats-server@v2.15.1...v2.15.2)

---
updated-dependencies:
- dependency-name: github.com/nats-io/nats-server/v2
  dependency-version: 2.15.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/github.com/nats-io/nats-server/v2-2.15.2 branch from 422e79b to 1a82a8f Compare October 31, 2026 12:40
@github-actions

Copy link
Copy Markdown

Gemini PR Review

Reviewed commit: 1a82a8f7d6552d9786dce4d5ec8f7fad9e87b167
Verdict: PASS

@github-actions
github-actions Bot merged commit a139ad7 into master Oct 31, 2026
29 checks passed
@dependabot
dependabot Bot deleted the dependabot/go_modules/github.com/nats-io/nats-server/v2-2.15.2 branch October 31, 2026 12:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants