2026.1 | ClearBlade IoT Enterprise and Edge

2026.1.16 (2026-10-26)

Platform:

Enhancement: systemupload no longer removes a deployment's edges when the deployment .json omits the edges property; a missing edges property now means no change to edges. An explicit empty edges list still removes all edges.
Fix: Updating system developers with an unchanged owner no longer restarts auto-balanced services running as the system owner
Fix: Race during RPC handshake could cause decode failures
Fix: When compression is enabled for RPC, no longer drop messages that cannot be compressed
Fix: Instantiating or deleting a bucket set could cause a concurrent map write without a lock

Platform:

Feature: Developer accounts have a two_factor_status (always_on, always_off, same_as_platform) that overrides the platform-wide two-factor setting; only a platform admin may set always_off.
Enhancement: Set default values for listener BrokerMaxConcurrentConnectsPerNode and MaxConnectionsPerNodePerSecond.
Enhancement: two_factor_enabled on developer accounts is kept in step with two_factor_status (true is always_on, false is same_as_platform) and is no longer read at login; the toggletwofactor developer CLI subcommand accepts an optional two_factor_status and without it toggles as before.
Fix: An auto-balanced service that was updated or restarted while waiting to restart after a quick exit could keep running with its previous engine type, transform settings, or run-as user
Fix: The autoscaler could start extra instances of a service whose runner exits quickly, and could not scale it down while those instances waited to restart

Platform:

Feature: Add listeners section to config. The config file is migrated to use this new format at startup and re-written to disk.
Feature: Add mqtt_client_history table to track client broker activity
Feature: Add ClearBladeAsync.Devices().clientHistory to query client broker activity
Enhancement: Log when connections are rejected before TLS termination
Enhancement: Allow set subcommand to work with nested paths separated by "."
Enhancement: Set default value of RPC.EncoderDecoderType to json
Enhancement: Add per-service Prometheus counters for code service CPU seconds, memory byte-seconds, and invocations, plus per-instance CPU seconds for stream services, with an Engine.TrackCpuUsage setting to disable CPU tracking
Enhancement: Export CPU usage by category (GC, code services, database, MQTT, TLS, password hashing, etc.) as the clearblade_cpu_seconds_total Prometheus metric, updated every 10 seconds. Requires EnablePrometheus and the CPU profiler (DisablePprof false, PprofCPUInterval > 0)
Enhancement: Upgrade to Go 1.27
Enhancement: Set default value of Database.UseLegacyParser to false, making the new SQL parser the default for raw queries

Platform:

Enhancement: Rejected MQTT connects log the client's auth method and identity.
Enhancement: Support HTTP HEAD method on webhooks
Enhancement: Support PKCE (S256) for OIDC login with a per-provider use_pkce setting, off by default
Enhancement: Broker tracing can target all clients in a system, all clients globally, or CONNECT packets only (broker trace system <systemKey>, broker trace all, broker trace connects).
Fix: Duktape services report the timeout error instead of DoubleError when timing out mid-execution.
Fix: Duktape execution timeouts are enforced at millisecond precision instead of firing up to a second early.
Fix: Device auth triggers fired with an empty device name for basic auth, JWT, and shared access signature MQTT connects.
Fix: Autoscaled services could scale down to zero prematurely
Fix: Autoscaler can race while rebalancing

Platform:

Fix: Broker fails to decode MQTT5 messages that omit reason code or property length
Fix: Autoscaler could deadlock when a service is deleted while queue stats are being reported
Fix: Apply security patches for dependencies
Fix: Cancelled service could cause a panic with context: internal error: missing cancel error
Fix: Add bounds checks to objects passed from Go to V8

Platform:

Breaking: Validation links issued before this upgrade must be re-requested
Fix: Two-factor codes now allow 3 attempts before lockout
Fix: Two-factor codes stay valid for the full 5 minutes and validation links for the full 24 hours
Fix: Small amount of memory leaked when V8 engine is destroyed
Fix: Heap snapshot memory leaked for lifetime of V8 isolate
Enhancement: The two-factor intermediate token lifetime is now configurable via Security.TwoFactorInterimTokenTTLMinutes (default 15 minutes)
Enhancement: Allow headers to be specified multiple times in JavaScript responses

Platform:

Platform:

Breaking: Config option MessageHistory.MinDeviceStatesToKeep renamed to MessageHistory.MaxDeviceStatesToKeep
Feature: Support heap profiles in V8
Feature: Support system aliases
Enhancement: Static metadata may be attached to timers which will be sent in the timer topic payload
Enhancement: Add HTTP and JS APIs for creating partial indexes
Enhancement: Add Collection.listIndexes function to clearblade_async
Enhancement: Support upserting timers in JavaScript and HTTP APIs
Enhancement: Support Messaging Services in Twilio 2fa config