What heroiclabs/nakama shipped
Written by FoxPlug from the repository's own releases; not affiliated with Heroiclabs. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/heroiclabs/nakama; Heroiclabs did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- Released v3.42.0 with Hiro Streaks support in the console, Go runtime IAP providers and subscription validation through IAP providers. Release
- Added an IAP plugin for in-app purchase handling. Pull request #2573
- Fixed runtime request hooks that were registered but never ran, bringing feature parity among runtime hooks. Pull request #2588
- Improved authenticate and link email import, making auth provider email import optionally opt-out. Pull request #2568
- Stopped requiring the shared password for StoreKit v2. Pull request #2585
- Fixed the console to accept shorter ACL bitmaps from pre-upgrade tokens. Pull request #2591
- Fixed resolution of quoted registerMatch handler keys in the JavaScript runtime. Pull request #2580
- Fixed JavaScript bindings beyond the first in a declaration. Pull request #2581
- Added missing Lua IAP callback register functions. Pull request #2582
- Registered the Lua shutdown hook. Pull request #2587
Why it matters
This week brings a new release with Hiro Streaks in the console and new IAP functionality, including Go runtime providers and subscription validation. Several fixes address runtime hooks and JavaScript binding resolution that developers may have hit. Console ACL handling and StoreKit v2 authentication were also adjusted.
Changelog entry
- Release v3.42.0 with Hiro Streaks console support, Go runtime IAP providers and subscription validation. Release
- Add IAP plugin. Pull request #2573
- Fix runtime request hooks that were registered but never ran. Pull request #2588
- Make auth provider email import optionally opt-out. Pull request #2568
- Stop requiring the shared password for StoreKit v2. Pull request #2585
- Accept shorter ACL bitmaps from pre-upgrade tokens in the console. Pull request #2591
- Resolve quoted JS registerMatch handler keys. Pull request #2580
- Resolve JS bindings beyond the first in a declaration. Pull request #2581
- Add missing Lua IAP callback register functions. Pull request #2582
- Register Lua shutdown hook. Pull request #2587
- Adjust ACL and console audit definitions for Hiro Streaks. Pull request #2558
- Build with Go 1.27.3 and upgrade dependencies. Pull request #2583
V3.42.0 is out with Hiro Streaks in the console, Go runtime IAP providers and subscription validation. Also this week: runtime hook fixes, JS binding resolution fixes, and auth email import improvements.
V3.42.0 shipped this week. It adds Hiro Streaks support to the console with its own ACL resource and audit logging, Go runtime IAP providers validated through the ValidatePurchase client API and PurchaseValidate function, and subscription validation through IAP providers. Alongside the release, runtime request hooks that were registered but never ran are now fixed, JavaScript bindings beyond the first in a declaration resolve correctly, and quoted registerMatch handler keys are handled. Auth provider email import is now optionally opt-out, StoreKit v2 no longer requires the shared password, and the console accepts shorter ACL bitmaps from pre-upgrade tokens.
Week of October 26, 2026
What shipped
- Fixed the leaderboard scheduler skipping leaderboard resets and tournament end and reset hooks. Pull request #2570
- Fixed a data race when evaluating cron schedules concurrently and corrected year rollover in the Last helpers. Pull request #2572
- Fixed returning the user id on unpersisted Samsung and Huawei purchases. Pull request #2575
- Fixed a malformed Huawei verification URL in in-app purchase verification. Pull request #2574
- Fixed logging of after-hook registrations so they are reported as after hooks. Pull request #2579
Why it matters
This week's changes address a scheduler issue that could silently skip leaderboard resets and tournament end and reset hooks, along with a concurrency data race in cron schedule evaluation. In-app purchase handling also gets fixes for Huawei URL verification and user id reporting on unpersisted Samsung and Huawei purchases. Together these reduce missed resets and incorrect purchase results for developers relying on these features.
Changelog entry
- Fixed the leaderboard scheduler skipping leaderboard resets and tournament end and reset hooks. Pull request #2570
- Fixed a data race when evaluating cron schedules concurrently and fixed year rollover in the Last helpers. Pull request #2572
- Fixed returning the user id on unpersisted Samsung and Huawei purchases. Pull request #2575
- Fixed a malformed Huawei verification URL. Pull request #2574
- Fixed logging after-hook registrations as after hooks. Pull request #2579
This week: fixed the leaderboard scheduler skipping resets and tournament end/reset hooks, fixed a cron schedule data race and year rollover, and fixed Huawei and Samsung in-app purchase handling, including user id on unpersisted purchases and a malformed Huawei verification URL.
This week we shipped fixes across scheduling and in-app purchases. The leaderboard scheduler could silently skip leaderboard resets and tournament end and reset hooks; that is now fixed. Cron schedule evaluation had a data race and a year rollover issue in the Last helpers, both addressed. In-app purchases get two fixes: the user id is now returned on unpersisted Samsung and Huawei purchases, and a malformed Huawei verification URL is corrected. We also fixed after-hook registrations being logged incorrectly.
Week of September 14, 2026
What shipped
- Released v3.41.0 with Console UI for Storage Search indices, namespaced multi fleet manager registration, and websocket connection upgrade http headers exposed to session context. Release
- Added AuthenticateProvider registry to support authentication through registered providers via new Authenticate module function. Pull request #2543
- Storage writes with optimistic concurrency failures now return gRPC FAILED_PRECONDITION status instead of INVALID_ARGUMENT to better distinguish version conflicts from permission denials. Pull request #2557
- WebSocket acceptor now validates sessions using JWT tokenId instead of full bearer string, fixing per-session logout for socket connections and aligning with HTTP/gRPC behavior. Pull request #2555
Why it matters
This release improves storage reliability by correctly distinguishing concurrency conflicts from permission errors, fixes session logout consistency across connection types, and adds new authentication and storage management capabilities. These changes address core session handling and data persistence issues that affect production deployments.
Changelog entry
- V3.41.0 released Release
- Add Console UI to list and query registered Storage Search indices Release
- Add support for namespaced multi fleet manager registration Release
- Expose websocket connection upgrade http headers to session context Release
- Add Authenticate module function to authenticate through registered provider Pull request #2543
- Storage writes with optimistic concurrency failures return FAILED_PRECONDITION instead of INVALID_ARGUMENT Pull request #2557
- WebSocket acceptor passes JWT tokenId to IsValidSession for proper per-session logout Pull request #2555
Nakama v3.41.0 is out. Storage concurrency errors now correctly return FAILED_PRECONDITION, WebSocket sessions validate consistently with HTTP/gRPC, and new provider authentication registry added.
Nakama v3.41.0 release includes improved error handling for storage concurrency conflicts, WebSocket session validation fixes ensuring consistent logout behavior across connection types, new AuthenticateProvider registry for flexible authentication flows, Console UI enhancements for Storage Search, and namespaced multi fleet manager support.
More from heroiclabs/nakama on GitHub
Merged pull requests
- fix(proto): pin protoc plugins as buf remote plugins and add openapiv2 (#2594, merged November 5, 2026 by flaviofernandes004) (source)
- fix(console): accept shorter ACL bitmaps from pre-upgrade tokens (#2591, merged November 3, 2026 by flaviofernandes004) (source)
- [HIRO-391] ACL and Console Audit adjustments for Hiro Streaks (#2558, merged November 3, 2026 by VBorisof) (source)
- Prepare v3.42.0 release. (#2589, merged November 3, 2026 by zyro) (source)
- fix(runtime): run request hooks that were registered but never ran (#2588, merged November 3, 2026 by flaviofernandes004) (source)
- fix(runtime): register Lua shutdown hook (#2587, merged November 2, 2026 by flaviofernandes004) (source)
- Build with Go 1.27.3 (#2583, merged November 2, 2026 by sesposito) (source)
- Update to gopher-lua v1.1.2 (#2584, merged November 2, 2026 by sesposito) (source)
- Authenticate and Link email import improvements (#2568, merged November 2, 2026 by sesposito) (source)
- Stop requiring the shared password for StoreKit v2 (#2585, merged November 2, 2026 by Calm0) (source)
- Lowercase Fleet Manager namespace (#2569, merged November 2, 2026 by sesposito) (source)
- fix(runtime): resolve quoted JS registerMatch handler keys (#2580, merged November 2, 2026 by flaviofernandes004) (source)
Releases
- v3.42.0, published November 3, 2026. First change listed: Add Hiro Streaks support to the console, with its own ACL resource and audit logging. (source)
- v3.41.0, published September 18, 2026. First change listed: Add Console UI to list and query registered Storage Search indices. (source)
- v3.40.0, published July 13, 2026. First change listed: Add Samsung Galaxy Store purchase validation request type and SAMSUNGGALAXYSTORE store provider enum. (source)
- v3.39.0, published May 20, 2026. First change listed: Add new runtime function to update storage objects with retries. (source)
- v3.38.0, published March 20, 2026. First change listed: Add runtime Satori client feature to delete identities. (source)
- v3.37.0, published February 12, 2026. First change listed: Support Apple JWS receipts in In-App Purchase validation APIs. (source)