SECURITY: client: Harden file creation for log files and dispatch payloads [GH-28605] client: Refuse to migrate task directories that have been symlinked [GH-28605] security: Fixed a bug where the Prefix Search API allowed enumerating IDs for jobs, deployments, allocs, evals, scaling policies, and volume from disallowed namespaces [GH-28597] security: Fixed a bug where the Read Dynamic Host Volume…
SECURITY: client: Harden file creation for log files and dispatch payloads [GH-28605] client: Refuse to migrate task directories that have been symlinked [GH-28605] security: Fixed a bug where the Prefix Search API allowed enumerating IDs for jobs, deployments, allocs, evals, scaling policies, and volume from disallowed namespaces [GH-28597] security: Fixed a bug where the Read Dynamic Host Volume…
SECURITY: client: Harden file creation for log files and dispatch payloads [GH-28605] client: Refuse to migrate task directories that have been symlinked [GH-28605] security: Fixed a bug where the Prefix Search API allowed enumerating IDs for jobs, deployments, allocs, evals, scaling policies, and volume from disallowed namespaces [GH-28597] security: Fixed a bug where the Read Dynamic Host Volume…
FEATURES: batch jobs: An new (experimental) batch job queue can be configured on node pools with different queuing options: FIFO ensures batch jobs are placed in the order received, and Dynamic Priority can prioritize batch jobs by age and "fairness" of resources requested and/or placed. [GH-28674] BREAKING CHANGES: agent: Server join via the CLI or API now requires agent:write permission [GH-2855…
FEATURES: batch jobs: An new (experimental) batch job queue can be configured on node pools with different queuing options: FIFO ensures batch jobs are placed in the order received, and Dynamic Priority can prioritize batch jobs by age and "fairness" of resources requested and/or placed. [GH-28674] BREAKING CHANGES: agent: Server join via the CLI or API now requires agent:write permission [GH-2855…
IMPROVEMENTS: dependency: Upgrade to the latest buf (1.72.0), protoc-gen-go (1.36.6), and protoc-gen-go-grpc (1.5.1) [GH-28525] services: the default workload identity policy now allows using wildcard namespace queries for Nomad native services [GH-28534] ui: fixed accessibility color contrast issues [GH-28022] BUG FIXES: api: Fix job statuses error when request body is empty using HTTP2 [GH-28541…
SECURITY: dependency: Upgrade to the latests go-getter [GH-28510] IMPROVEMENTS: api: Updated the Go module to require at least 1.26.0 [GH-28460] build: Updated Go to v1.27.1 [GH-28451] client: Added the unique.host_id node attribute to the host fingerprint, when available [GH-28406] job: Allow setting reschedule.delay to values as low as 1s [GH-28477] jobspec2: Decouple from Nomad core with isolat…
BREAKING CHANGES: plugin: The DriverNetwork.Hash method has been removed from the plugin/drivers package. [GH-28342] IMPROVEMENTS: build: Update Go to v1.26.5 [GH-28260] checks: Nomad native service check IDs are now SHA256 [GH-28361] cli: add -json-output and -t flags to nomad job plan for structured plan output [GH-27369] consul: Added the issuing Nomad client's node ID to the metadata of Consul…
2.0.4 (July 07, 2026) SECURITY: docker: Enforce allowed_modes or allow_privileged requirement to set host namespace modes in task. This is CVE-2026-14891. [GH-28190] docker: Fixed a bug where docker tasks could use a symlink to bypass the plugin configuration for volumes.enabled=false. This is CVE-2026-14896. [GH-28177] dynamic host volumes: Fixed a bug where users with host-volume-delete in one n…
SECURITY: docker: Enforce allowed_modes or allow_privileged requirement to set host namespace modes in task. This is CVE-2026-14891. [GH-28190] docker: Fixed a bug where docker tasks could use a symlink to bypass the plugin configuration for volumes.enabled=false. This is CVE-2026-14896. [GH-28177] dynamic host volumes: Fixed a bug where users with host-volume-delete in one namespace could delete…
SECURITY: docker: Enforce allowed_modes or allow_privileged requirement to set host namespace modes in task. This is CVE-2026-14891. [GH-28190] docker: Fixed a bug where docker tasks could use a symlink to bypass the plugin configuration for volumes.enabled=false. This is CVE-2026-14896. [GH-28177] dynamic host volumes: Fixed a bug where users with host-volume-delete in one namespace could delete…
SECURITY: cli: Redact token and certificate key CLI flags and environment variables when writing debug bundle [GH-28063] IMPROVEMENTS: build: Updated Go to 1.26.4 [GH-28080] vault: adds token renewal retries [GH-27947] BUG FIXES: audit (Enterprise): Fixed a bug where alloc exec and job actions requests from the webbrowser would be marked as anonymous in audit logs [GH-28025] client: Fixed a bug wh…
SECURITY: cli: Redact token and certificate key CLI flags and environment variables when writing debug bundle [GH-28063] IMPROVEMENTS: build: Updated Go to 1.26.4 [GH-28080] vault: adds token renewal retries [GH-27947] BUG FIXES: audit (Enterprise): Fixed a bug where alloc exec and job actions requests from the webbrowser would be marked as anonymous in audit logs [GH-28025] client: Fixed a bug wh…
FEATURES: core: timeouts for batch jobs [GH-27803] SECURITY: cli: Redact token and certificate key CLI flags and environment variables when writing debug bundle [GH-28063] IMPROVEMENTS: acl: Support uploading client ACL tokens [GH-27741] alloc: don't restore when allocDir is inaccessible [GH-27933] api: added agent reload endpoint [GH-27106] build: Updated Go to 1.26.4 [GH-28080] client: Adds defa…
1.10.12 Enterprise (May 22, 2026) BUG FIXES: ui: Fixed a bug where the client detail page would fail to render [GH-27958] ui: Fixed a bug where the topology page would fail to render [GH-27958] ui: Fixed a bug where the evaluation detail panel would render improperly [GH-27987]
1.11.6 Enterprise (May 22, 2026) BUG FIXES: ui: Fixed a bug where the client detail page would fail to render [GH-27958] ui: Fixed a bug where the topology page would fail to render [GH-27958] ui: Fixed a bug where the evaluation detail panel would render improperly [GH-27987]
2.0.2 (May 22, 2026) BUG FIXES: acl: fix rpc permission denied error when using node_pool="all" [GH-27973] ui: Fixed a bug where the client detail page would fail to render [GH-27958] ui: Fixed a bug where the topology page would fail to render [GH-27958] ui: Fixed a bug where the evaluation detail panel would render improperly [GH-27987]
BREAKING CHANGES: logging: The allocation logs directory is bind-mounted read-only for task drivers that support with filesystem isolation [GH-27918] SECURITY: dynamic host volumes: Prevent unintended code execution outside the plugin directory (CVE-2026-7474) [GH-27919] logging: Protect logging FIFO from symlink swap attacks (CVE-2026-6959) [GH-27918] sentinel: require sentinel-override ACL capab…
BREAKING CHANGES: logging: The allocation logs directory is bind-mounted read-only for task drivers that support with filesystem isolation [GH-27918] SECURITY: dynamic host volumes: Prevent unintended code execution outside the plugin directory (CVE-2026-7474) [GH-27919] logging: Protect logging FIFO from symlink swap attacks (CVE-2026-6959) [GH-27918] sentinel: require sentinel-override ACL capab…
BREAKING CHANGES: logging: The allocation logs directory is bind-mounted read-only for task drivers that support with filesystem isolation [GH-27918] SECURITY: dynamic host volumes: Prevent unintended code execution outside the plugin directory (CVE-2026-7474) [GH-27919] logging: Protect logging FIFO from symlink swap attacks (CVE-2026-6959) [GH-27918] sentinel: require sentinel-override ACL capab…
FEATURES: config: add nonproduction config option for server, license, and reporting config [GH-27646] core (Enterprise): Enable parsing and reporting with IBM PAO licenses SECURITY: build: upgrade Go to 1.26.2 [GH-27831] ui: Increased the client-side generated OIDC nonce entropy to 256-bit. [GH-27749] IMPROVEMENTS: build (Enterprise): Added support for ppc64le CPU architecture on Linux build: Upg…