2026.1

2026.1.13 (2026-09-14)

Platform:

• Enhancement: Rejected MQTT connects log the client's auth method and identity.

• Enhancement: Support HTTP HEAD method on webhooks

• Enhancement: Support PKCE (S256) for OIDC login with a per-provider use_pkce setting, off by default

• Enhancement: Broker tracing can target all clients in a system, all clients globally, or CONNECT packets only (broker trace system <systemKey>, broker trace all, broker trace connects).

• Fix: Duktape services report the timeout error instead of DoubleError when timing out mid-execution.

• Fix: Duktape execution timeouts are enforced at millisecond precision instead of firing up to a second early.

• Fix: Device auth triggers fired with an empty device name for basic auth, JWT, and shared access signature MQTT connects.

• Fix: Autoscaled services could scale down to zero prematurely

• Fix: Autoscaler can race while rebalancing

2026.1.12 (2026-09-01)

Platform:

• Fix: Broker fails to decode MQTT5 messages that omit reason code or property length

• Fix: Autoscaler could deadlock when a service is deleted while queue stats are being reported

• Fix: Apply security patches for dependencies

• Fix: Cancelled service could cause a panic with context: internal error: missing cancel error

• Fix: Add bounds checks to objects passed from Go to V8

See 2025.4.23

2026.1.11 (2026-08-12)

See 2025.4.22

2026.1.10 (2026-08-05)

See 2025.4.21

2026.1.9 (2026-07-14)

Platform:

• Breaking: Validation links issued before this upgrade must be re-requested

• Fix: Two-factor codes now allow 3 attempts before lockout

• Fix: Two-factor codes stay valid for the full 5 minutes and validation links for the full 24 hours

• Fix: Small amount of memory leaked when V8 engine is destroyed

• Fix: Heap snapshot memory leaked for lifetime of V8 isolate

• Enhancement: The two-factor intermediate token lifetime is now configurable via Security.TwoFactorInterimTokenTTLMinutes (default 15 minutes)

• Enhancement: Allow headers to be specified multiple times in JavaScript responses

2026.1.8 (2026-07-06)

See 2025.4.20

2026.1.7 (2026-06-26)

See 2025.4.19

2026.1.6 (2026-06-16)

See 2025.4.18

2026.1.5 (2026-06-02)

See 2025.4.17

2026.1.4 (2026-05-14)

See 2025.4.16

2026.1.3 (2026-05-06)

See 2025.4.15

2026.1.2 (2026-04-15)

See 2025.4.14

2026.1.1 (2026-04-13)

Platform:

• Fix: Database deadlock on edge when syncing system aliases from platform

• Enhancement: Add admin endpoints to fetch debug profiles

• Enhancement: Reduce minimum system alias length from 3 characters to 1

See also 2025.4.13

2026.1.0 (2026-04-02)

Platform:

• Breaking: Config option MessageHistory.MinDeviceStatesToKeep renamed to MessageHistory.MaxDeviceStatesToKeep

• Feature: Support heap profiles in V8

• Feature: Support system aliases

• Enhancement: Static metadata may be attached to timers which will be sent in the timer topic payload

• Enhancement: Add HTTP and JS APIs for creating partial indexes

• Enhancement: Add Collection.listIndexes function to clearblade_async

• Enhancement: Support upserting timers in JavaScript and HTTP APIs

• Enhancement: Support Messaging Services in Twilio 2fa config