v2.2.4

What's Changed

• feat(topo): add observability to shared connection by @ngjaying in #4028
• fix(planner): register shared connection refs by @ngjaying in #4027
• fix: add connection pool log by @Yisaer in #4031

Full Changelog: v2.2.3...v2.2.4

v2.4.0-beta.6

What's Changed

• feat: Open-source ekuiper manager by @ankur-paan in #3987
• fix: fix cve issue by @Yisaer in #4014

Full Changelog: v2.4.0-beta.5...v2.4.0-beta.6

v2.4.0-beta.5

What's Changed

• feat: add mqtt properties in meta by @Yisaer in #4010
• build(deps): bump google.golang.org/grpc by @dependabot[bot] in #4011
• fix: fix cve issue by @Yisaer in #4012

Full Changelog: v2.4.0-beta.4...v2.4.0-beta.5

v2.4.0-beta.4

What's Changed in v2.4.0-beta.4

✨ New Features

• Protobuf: Added support for loading protobuf schemas directly from a directory (#4006)

🐛 Bug Fixes

• Kafka: Revised consumer groupid settings to ensure proper streaming assignments (#4009)
• SQL Planner: Fixed mock source emitting incorrect names during unnest operations (#4008)

🔧 Improvements & Maintenance

• Optimized tests for faster table loading (#4001)
• Added markdown linter to ensure documentation consistency (#4004)
• Bumped dependencies: go.opentelemetry.io/otel/sdk (#4007) and filippo.io/edwards25519 (#4005)

v2.4.0-beta.3

What's Changed

• ci: fix perf action by @Yisaer in #3990
• ci: add explicit permissions to semgrep workflow by @ngjaying in #3992
• fix(test): resolve flaky FVT test by @ngjaying in #3993
• fix: enable race ci and fix problems by @ngjaying in #3996
• feat(trial): replace websocket with sse by @ngjaying in #3991
• fix: fix TestWindowState race test by @Yisaer in #3997
• test(http): add oauth test with header by @ngjaying in #3998

Full Changelog: v2.4.0-beta.2...v2.4.0-beta.3

v2.4.0-beta.2

What's Changed

• ci: add perf action by @Yisaer in #3985
• ci: add semgrep for nested lock detection by @ngjaying in #3988
• fix: add syncx wrapper and fix deadlocks by @ngjaying in #3989

Full Changelog: v2.4.0-beta.1...v2.4.0-beta.2

v2.4.0-beta.1

What's Changed

• docs: add Swagger API playground link by @ankur-paan in #3975
• fix(server): prevent cpu api panic by @ngjaying in #3978
• fix(stream): allow deleting corrupted streams by @ngjaying in #3979
• docs: update helm installation to use OCI registry by @ngjaying in #3980
• docs: update Kafka Docker image by @igor-soldev in #3977
• fix(conf): add log symlink validation by @ngjaying in #3981
• fix: replace path.Join with filepath.Join by @ngjaying in #3982
• fix: fix sql sink quote string value by @Yisaer in #3983
• fix(video): enforce image2pipe by @ngjaying in #3984

New Contributors

• @ankur-paan made their first contribution in #3975
• @igor-soldev made their first contribution in #3977

Full Changelog: v2.4.0-alpha.3...v2.4.0-beta.1

v2.4.0-alpha.3

Features

Video Source Refactoring

Refactored the video source to use a push model, improving efficiency and performance (#3959).

Sink Enhancements

Added HasFields support to sinks, enabling more flexible field validation (#3964).

Server Improvements

Implemented version-based conflict resolution for concurrent upserts (#3970).

---

Bug Fixes

• Fixed function channel timeout issues in Go SDK (#3965)
• Fixed function channel timeout issues in Python SDK (#3967)

---

Full Changelog: v2.4.0-alpha.2...v2.4.0-alpha.3

v2.4.0-alpha.2

⚠️ Breaking Changes

IMPORTANT: This release includes security enhancements that may affect existing deployments.

1. SSRF Protection Enabled by Default

   • The new enablePrivateNet configuration defaults to false, which blocks access to private network addresses (e.g., localhost, 127.0.0.1, internal IPs).
   • Action Required: If your rules rely on accessing local resources (local REST services, local databases, etc.), you must set enablePrivateNet: true in etc/kuiper.yaml.
   • Documentation

2. File Access Restriction Enabled by Default

   • The new allowExternalFileAccess configuration defaults to false, restricting file access to the data/uploads directory only.
   • Action Required: If your plugins or schemas need to access files outside the uploads directory, set allowExternalFileAccess: true.
   • Documentation

---

New Features

Temporary Streams (#3940)

Introduced temporary streams that exist only in memory and are not persisted. They are defined using TEMP="true" in the stream definition and are ideal for intermediate data processing or testing. Temporary streams cannot be replaced and can only be used by temporary rules.

• Documentation

State Window Partition By (#3936)

State windows now support the PARTITION BY clause, enabling data partitioning into separate window groups. This allows more granular state tracking across different partitions.

• Documentation

Tuple Sink Format Support (#3954)

Tuple-based sinks now support configurable output formats, providing more flexibility in data serialization.

Video Source Enhancements (#3955)

Added new properties to the video source for better ffmpeg control:

• debugResp: Output ffmpeg response to logs for debugging
• inputArgs: Custom input arguments for ffmpeg (e.g., rtsp_transport: tcp)
• Documentation

Global Configuration Provider (#3942)

Added a global configuration provider that allows portable plugins and external components to access eKuiper's configuration settings programmatically.

API ID Validation (#3951)

Added comprehensive validation for resource identifiers. Stream, table, rule, connection, plugin, schema, and service names are now validated to prevent invalid characters.

---

Security Enhancements

SSRF Protection

Implemented Server-Side Request Forgery (SSRF) protection across all HTTP clients. Private network access is blocked by default.

• Configuration

File Access Restriction (#3950)

Added configurable file access restrictions to prevent unauthorized file system access.

• Configuration

Path Traversal Prevention

• Fixed upload embedded path traversal (#3958)
• Fixed path traversal in file downloads
• Enforced safe path validation for user input (#3911)
• Safe unzip implementation (#3931)

---

Bug Fixes

• Fixed HTTP refresh token support (#3922)
• Fixed REST sink access token handling
• Fixed SQL lookup unsafe string (#3930)
• Fixed wildcard expander limit in slice mode (#3925)
• Fixed bool type conversion issues (#3917, #3918)
• Fixed state window with GROUP BY key (#3916)

---

Dependency Updates

• Upgraded Go version
• Upgraded FoundationDB client to 7.3 (#3938)
• Bumped logrus, paho.mqtt.golang, golang.org/x/crypto, jose2go, gorilla/schema

---

Full Changelog: v2.4.0-alpha.1...v2.4.0-alpha.2

v2.3.1

What's Changed

• fix(trial): rename rule trial mock stream by @ngjaying in #3920
• fix: merge bugfixes for v2.3.1 by @ngjaying in #3935

Full Changelog: v2.3.0...v2.3.1