What kuzzleio/kuzzle shipped
Written by FoxPlug from the repository's own releases; not affiliated with Kuzzle. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/kuzzleio/kuzzle; Kuzzle did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- Kuzzle 2.61.0 stable shipped, the version in which a storage engine can come as a separate npm package installed next to Kuzzle and named in services.storageEngine.driver. Pull request #3167
- OpenSearch 2 and 3 are supported as storage engines through two external drivers, kuzzle-storage-opensearch-2 and kuzzle-storage-opensearch-3, both published as 1.0.0-beta.2 betas from their own repositories. Pull request #3125
- Plugins and applications can now ask which storage engine Kuzzle runs on through getEngine and getStorageEngine instead of guessing from the major version. Pull request #3154
- A storage driver can now release its engine connections on graceful shutdown through an optional close() driver hook. Pull request #3155
- Storage error messages now say storage engine instead of Elasticsearch when an OpenSearch driver is in use; error ids, codes, classes and status are unchanged. Pull request #3153
- Graceful shutdown now waits for plugin requests made through the SDK accessors before closing the storage, fixing a regression from beta.6. Pull request #3161
- The storage driver loader is hardened so external drivers get the running Kuzzle copy when Kuzzle runs as its own application, such as the official Docker image. Pull request #3150
- A cluster node refused for its storage driver now does so before the storage initializes, so it has written nothing to the storage. Pull request #3149
- Storage reads triggered by index cache misses are now rate-limited, so concurrent misses no longer each read the whole storage schema. Pull request #3147
- A compatibility guide page was added covering Node.js, operating systems, storage engines per driver, Redis and Valkey, and deployment modes, with CI running on Redis 6.2 and Valkey 9. Pull request #3177
Why it matters
This week 2.61.0 stable shipped, opening Kuzzle to storage engines delivered as separate npm packages, with OpenSearch 2 and 3 available through their own drivers. The betas before the stable release also fixed cluster index checks, shutdown handling for plugin requests, driver loading and error wording. For people running Kuzzle, the storage layer is now more configurable and its errors and shutdown behaviour are more predictable.
Changelog entry
- Release 2.61.0: storage engines can be separate npm packages named in services.storageEngine.driver. Pull request #3167
- Storage: OpenSearch 2 and 3 drivers in the functional matrix (ADR-0003 step 07). Pull request #3125
- Storage: expose the selected storage engine to plugins and applications. Pull request #3154
- Storage: optional close() driver hook called on shutdown. Pull request #3155
- Storage: engine-neutral wording in storage error messages. Pull request #3153
- Shutdown: wait for plugin requests before closing the storage (fixes a beta.6 regression). Pull request #3161
- Test: storage driver conformance kit covers 11 more behaviours, 32 to 43 cases. Pull request #3151
- Storage: harden the storage driver loader for external drivers. Pull request #3150
- Cluster: compare storage drivers before the storage initializes. Pull request #3149
- Storage: rate-limit the storage reads that index cache misses trigger. Pull request #3147
- CI: pin storage driver versions and run the core-only driver profile. Pull request #3146
- Docs: compatibility matrix page, and CI on Redis 6.2 and Valkey 9. Pull request #3177
Kuzzle 2.61.0 is out. Storage engines can now come as separate npm packages named in services.storageEngine.driver, with OpenSearch 2 and 3 available through their own drivers. This release also ships a driver close() hook, engine-neutral storage errors and a compatibility guide.
Kuzzle 2.61.0 is released. The main change is that a storage engine can now be a separate npm package installed next to Kuzzle and named in services.storageEngine.driver, which opens the project to engines beyond the built-in ones. OpenSearch 2 and 3 are supported through two external drivers, kuzzle-storage-opensearch-2 and kuzzle-storage-opensearch-3. The release also adds an optional close() hook so a driver can release its engine connections on graceful shutdown, lets plugins and applications ask which storage engine runs, and makes storage error messages engine-neutral. A new compatibility guide covers Node.js, operating systems, storage engines, Redis and Valkey, and deployment modes.
Week of October 12, 2026
What shipped
- Fixed HTTP requests with Content-Length: 0 hanging until the uWS idle timeout and then getting a 502 from a reverse proxy. Pull request #2972
- Released v2.60.0-beta.1, upgrading kuzzle-logger to 1.5.0 and including the empty-body HTTP fix. Release
- Added an accepted ADR documenting how Redis access is secured and configuration secrets are redacted. Pull request #2973
- Switched the CI token action from the deprecated app-id input to client-id without changing the existing app ID variable. Pull request #2974
- Applied the same CI token input update to the second workflow using the deprecated app-id input. Pull request #2975
- Applied the same CI token input update to the third workflow using the deprecated app-id input. Pull request #2976
Why it matters
This week brings a beta release that fixes a real HTTP hang for empty-body requests, which could surface as 502 errors behind a reverse proxy. It also documents the current Redis authentication and secret redaction behavior in an accepted ADR, and keeps CI working with the non-deprecated client-id input.
Changelog entry
- Http: answer empty-body requests without waiting for uWS data. Pull request #2972
- Release 2.60.0-beta.1: upgrade kuzzle-logger to 1.5.0; include the HTTP empty-body fix. Release
- Docs(adr): add accepted ADR-0004 on securing Redis access and redacting configuration secrets. Pull request #2973
- Ci: use client-id instead of the deprecated app-id input. Pull request #2974
- Ci: use client-id instead of the deprecated app-id input. Pull request #2975
- Ci: use client-id instead of the deprecated app-id input. Pull request #2976
V2.60.0-beta.1 is out with kuzzle-logger 1.5.0 and a fix for empty-body HTTP requests that hung until uWS idle timeout. ADR-0004 documenting Redis access security and config secret redaction is accepted. CI token setup now uses client-id instead of deprecated app-id.
Kuzzle v2.60.0-beta.1 is available. It upgrades kuzzle-logger to 1.5.0 and fixes HTTP requests with Content-Length: 0 that previously hung until the uWS idle timeout, after which a reverse proxy could answer 502. The project also accepted ADR-0004, which documents how Redis access is secured and how configuration secrets are redacted. Finally, the CI workflows now use client-id instead of the deprecated app-id input for the GitHub App token action, with no change needed to the existing configuration variable.
Week of September 28, 2026
What shipped
- Released v2.59.0 with collection write locks and unmanaged indices, two opt-in storage primitives that enable the mapping-migration plugin to rebuild collections without breaking changes. Release
- Released v2.58.0 taking API contract types from the new kuzzle-types package, unifying type definitions between server and SDK without breaking changes. Release
- Released v2.57.0, the first Kuzzle built entirely in TypeScript strict mode with no behavior changes, including API key deletion by fingerprint and cluster sync message retransmission. Release
- Added collection write locks and unmanaged indices to storage, generic opt-in primitives with no effect until explicitly used by code like the mapping-migration plugin. Pull request #2962
- Upgraded kuzzle-logger to 1.5.0, changing how errors are logged to include name, message, stack, cause, and custom properties like KuzzleError id. Pull request #2967
- Fixed plugin ESClient constructor to follow the configured Elasticsearch major version, so plugins on Elasticsearch 8 deployments now receive 8.x clients instead of always receiving 7.x. Pull request #2947
- Refactored RoleDefinition to build on the API contract, reconciling duplicate types between server and SDK without breaking changes to public types. Pull request #2959
- Added v3-breaking-changes.md documenting 90 items across 9 categories that Kuzzle 2 keeps only to avoid breaking changes, serving as the backlog for v3. Pull request #2961
- Introduced ADR-0003 proposing storage engines as installable drivers, an npm package implementing a StorageDriver contract selected by configuration. Pull request #2948
- Fixed API key deletion by key or fingerprint on upgraded installs, which was returning 404 for every key including those created after upgrade. Pull request #2942
Why it matters
Kuzzle 2.59.0 ships new storage primitives enabling safer collection migrations, while 2.57.0 reached TypeScript strict mode with no behavior changes, and 2.58.0 unified type definitions with the SDK. These releases maintain backward compatibility while preparing infrastructure for future enterprise features and v3.
Changelog entry
- Storage: collection write locks and unmanaged indices Release
- Take the API contract types from kuzzle-types Release
- ApiKeys: allow an api key to be deleted by the key itself or its fingerprint Release
- Ci: ratchet implicit any, and count as unknown as any Release
- Cluster: retransmit lost sync messages before evicting Release
- Logger: upgrade kuzzle-logger to 1.5.0 Pull request #2967
- Plugin: context.constructors.ESClient follows the configured major version Pull request #2947
- Bug: API keys deletable by key or fingerprint on upgraded installs Release
- Bug: logstash access logs carry the request headers once Release
- Bug: published typings compile without dev dependencies Release
- Storage: mark the IndexCache maps readonly Pull request #2963
Kuzzle 2.59.0 out now: collection write locks and unmanaged indices for safer storage operations. 2.57.0 is the first fully TypeScript strict build. 2.58.0 shares types with the SDK.
Three new Kuzzle releases this week: 2.59.0 with collection write locks and unmanaged indices for safer migrations; 2.57.0 as the first fully TypeScript strict build with zero behavior changes; 2.58.0 unifying API contract types with kuzzle-types. All maintain backward compatibility while strengthening the platform.
Week of September 14, 2026
What shipped
- Both Elasticsearch services moved to strict TypeScript and adopted into the ratchet guard in step 12 K3. Pull request #2802
- API keys can now be deleted by _id, fingerprint, or key value in security/deleteApiToken and auth/deleteApiToken actions. Pull request #2683
- Fixed TD-69: a node that loses the mappings-import race now refuses to boot instead of continuing with stale state. Pull request #2786
- Fixed TD-70: removed artificial order pinning from an unordered search test that was causing flaky assertions. Pull request #2787
- Sprint 8 J3b completed: node.js converted to TypeScript, the last JavaScript file in lib/cluster. Pull request #2792
- Fixed CI ratchets for implicit-any and casts to fail closed when the measuring tool cannot run. Pull request #2795
- Fixed preflight conversion reminder to see uncommitted work, closing TD-66. Pull request #2796
- Fixed docker unit runner to stop rewriting the host's
node_modulesduring bind-mounted test execution. Pull request #2797
Why it matters
The project continues TypeScript migration with strict type checking spreading from Elasticsearch services into core libraries, while fixing critical cluster startup races and API key deletion edge cases discovered during the conversion process. CI tooling was hardened to prevent false negatives in type safety gatekeeping.
Changelog entry
- Fix(types): Elasticsearch services elasticsearch.ts strict-clean and adopted in step 12 K3 Pull request #2802
- Feat(apiKeys): deleteApiToken actions accept _id, fingerprint, or key to select api key Pull request #2683
- Fix(kuzzle): node losing mappings-import lock now refuses to boot, closes TD-69 Pull request #2786
- Fix(tests): removed artificial order pinning from unordered search test, closes TD-70 Pull request #2787
- Refactor(cluster): node.js converted to TypeScript in sprint 8 J3b Pull request #2792
- Fix(ci): implicit-any and casts ratchets now fail closed when measuring tool fails Pull request #2795
- Fix(ci): preflight conversion reminder sees uncommitted work, closes TD-66 Pull request #2796
- Fix(ci): docker unit runner no longer rewrites host
node_modulesduring bind-mount test Pull request #2797
Step 12 slice K3 ships: Elasticsearch services now strict-clean and adopted. API keys delete by _id, fingerprint or key. Fixed cluster startup race (TD-69) and flaky search test (TD-70).
Kuzzle advances TypeScript migration: Elasticsearch services now strict-typed and protected by ratchets. Simultaneously shipping API key deletion flexibility, a fix for cluster startup failures when nodes lose the mappings-import race, and hardened CI tooling that prevents type safety regressions. lib/cluster is now entirely TypeScript.