3.0.1

🎯 Core

• 🐛 Go security update: RoadRunner uses Go 1.27.3 to address CVE-2026-111943 in crypto/x509. The update rejects known untrusted intermediate certificates during certificate verification. See BUG.

3.0.0 (2026-10-08)

RoadRunner v3 uses v6 Go plugins. See Upgrade from v2025 to v3 for the required configuration and API changes.

🎯 Core

• ✨ Go module: Import RoadRunner through github.com/roadrunner-server/roadrunner/v3. See Embedding a server.
• ✨ Plugin API: Protobuf schemas, generated Go messages, and Go plugin contracts now have separate repositories: api, api-go/v6, and api-plugins/v6. Custom plugins use log/slog, pool/v2, and goridge/v4. See Writing a Plugin, PR.
• ✨ Unix sockets: Configure socket mode, owner, and group for supported listeners and worker relays. See Configuration, FR.
• ✨ Environment files: Load the root envfile without experimental mode. A configured file is required when the server starts. See Environment.
• ✨ RPC codecs: Goridge v4 removes MessagePack support. JSON, protobuf, Gob, and raw payloads remain available through the existing Goridge RPC transport. See RPC, PR.
• ✨ Worker scaling: Retry worker acquisition after automatic scale-up and revise idle-worker removal. dynamic_allocator.max_workers counts workers added above the base pool size. See Auto workers scaling, FR.
• ✨ Initialization environment: Values in server.on_init.env override inherited values. See Server, PR.
• ✨ Default plugins: Add NSQ, HTTP rate limiting, Zstd compression, and the protobuf registry to the default container. TCP requires a custom build. See NSQ and TCP, rate limiting, and Zstd and Protoreg.

📦 http plugin

• ✨ Middleware order: Requests enter http.middleware from left to right. Reverse a v5 list to keep its previous order. See Middleware order, PR.
• ✨ Cleartext HTTP/2: Use HTTP/2 prior knowledge for H2C connections. HTTP/1.1 Upgrade: h2c is no longer supported. See HTTP/2.
• ✨ PROXY protocol: Accept v1 and v2 headers on HTTP and HTTPS listeners with explicit trusted proxy addresses. See HTTP, FR.

📦 proxy_ip_parser middleware

• ✨ Trusted headers: Select forwarding headers and their priority through http.trusted_headers. See Proxy IP parser, FR.

📦 static middleware

• ✨ File serving controls: Configure URL prefixes, metadata cache TTL, missing-file cache TTL, and cache limits. Reset both caches with rr reset static. Weak ETags now use file size and modification time. See Static files, PR.

📦 rate_limiter middleware

• ✨ Request limits: Limit requests by global, IP, or header key. Rejected requests return 429 with Retry-After. See Rate limiter, FR.

📦 zstd middleware

• ✨ Response compression: Compress HTTP responses with Zstandard when the client accepts zstd. See Zstd, FR.

📦 grpc plugin

• ✨ Server reflection: Discover services through reflection and retrieve PHP service descriptors through the bundled Protoreg plugin. See Protoreg, FR.
• ✨ Error details: Include supported google.rpc.Status details in failed unary-call logs. See gRPC, FR.

📦 amqp driver

• ✨ Named connections: Connect pipelines to different brokers. Static pipelines require config.connection and nested exchange and queue settings; AMQP config.version is removed. See RabbitMQ, FR.
• ✨ Declaration controls: Configure queue and exchange declarations independently. Use existing broker resources with accounts that cannot declare them. See RabbitMQ, FR.

📦 jobs plugin

• ✨ Named worker pools: Assign pipelines to separate PHP worker pools with their own commands and capacity. The pool header selects the destination pool. See Jobs, PR.
• ✨ Trace continuity: Preserve valid producer trace context when jobs are submitted through RPC. See Jobs, FR.
• ✨ Outcome metrics: Count successful, failed, and requeued attempts separately with rr_jobs_jobs_requeue. Outcome and push totals use counters. See Metrics, FR.

📦 nsq driver

• ✨ NSQ jobs: Publish and consume jobs through NSQ topics and channels. Support broker discovery, delayed delivery, acknowledgements, and configurable reconnection intervals. See NSQ, FR.

📦 nats driver

• ✨ Stream retention: Preserve stream contents when a pipeline stops unless stream deletion is enabled. Review retention and repeated-delivery handling when upgrading. See NATS, PR.
• ✨ Acknowledgment wait: Configure ack_wait for JetStream redelivery timing. See NATS, PR.

📦 kafka driver

• ✨ Direct partition consumption: Apply consume_partitions to select topic partitions and starting offsets. See Kafka, PR.
• 🐛 Requeue isolation: A requeued job, or a job nacked with redelivery, goes back to the RoadRunner priority queue. The driver no longer produces a copy to the source topic, so other consumer groups do not receive the retry. The driver honors the requested delay. A burst of retries no longer drops jobs. A retry waits in memory: it is lost after a stop, restart, or crash once a later offset of its partition is committed. See Kafka, BUG.
• 🐛 Consumer recovery: When the consumer gets a non-retriable Kafka error, for example when the broker denies access to the topic or removes the consumer from the group, the jobs plugin restarts the pipeline. The old consumer closes, and a pipeline in jobs.consume continues with a new consumer. If the restart of a configured pipeline fails, RoadRunner stops with an error. See Kafka, BUG.

📦 sqs driver

• 🐛 FIFO retry delivery: Use a fresh broker deduplication ID for each republished retry while retaining the application job ID. This prevents SQS from discarding the retry as a duplicate of the deleted original. See SQS, PR.

📦 beanstalk driver

• ✨ Job headers: Preserve headers through storage and retries, including trace context and named-pool routing. Existing messages cannot recover headers that were not stored. See [Beanstalk](https://github.com/roadrunner-server/docs/blob/rele...

🚀 v2025.1.15 🚀

🎯 Core

• 🐛 CVE Fixes: Updated Go toolchain to 1.26.4 to resolve CVE-2026-42504. Note: fiber is only used transitively by the fileserver plugin, BUG #2355 (thanks @dmitryuk).

Contributors

🚀 v2025.1.14 🚀

🎯 Core

• 🐛 CVE Fixes: Updated Go toolchain to 1.26.3 and bumped github.com/gofiber/fiber/v2 to v2.52.13 to resolve CVE-2026-33811, CVE-2026-33814, CVE-2026-39820, CVE-2026-39836, and CVE-2026-42499. Note: fiber is only used transitively by the fileserver plugin, BUG #2339 (thanks @dmitryuk).

🧰 Plugins

🧪 Temporal

• ✨ LocalActivityParams (Go SDK compatibility): Added DataConverter, FailureConverter, and Attempt fields to LocalActivityParams to match the required Go SDK fields, preventing a potential nil-pointer dereference during local activity execution. Includes new unit tests covering default and populated values, PR #761 (thanks @xepozz).

Contributors

🚀 v2025.1.13 🚀

Changelog

🎯 Core

• 🐛 CVE Fixes: Updated dependencies and Go version to 1.26.2 to resolve CVE-2026-32280 and CVE-2026-39883 (go/stdlib), CHORE (thanks @rebecca-canyon)

Contributors

Changelog

🎯 Core

• 🐛 CVE Fix (deps): Updated google.golang.org/grpc to v1.79.3 to resolve CVE-2026-33186 — a server-side authorization bypass where malformed :path headers could circumvent path-based restricted deny rules in gRPC interceptors, CHORE (thanks @rebecca-canyon)

Contributors

Changelog

📦 otel plugin

• 🐛 OTEL Semconv: Fixed a regression where the OpenTelemetry plugin failed to start due to conflicting semconv Schema URLs (v1.39.0 vs v1.40.0); updated semconv to v1.40, BUG (thanks @dmitryuk)

🎯 Core

• ✨ E2E Tests: Added end-to-end test suite with plugins (HTTP, gRPC, Jobs) including OpenTelemetry integration to prevent plugin compatibility regressions, FR

Contributors

📦 grpc plugin

• ✨ Glob Patterns: Added support for ** (globstar/recursive) and brace expansion {pattern1,pattern2} in grpc.proto configuration paths, FR (thanks @Nyholm)

🎯 Core

• 🐛 CVE Fixes (deps): Updated Go packages to resolve CVE-2026-27141 and CVE-2026-25882, Issue (thanks @Orrison)
• 🐛 CVE Fixes (stdlib): Updated Go version to 1.26.1 to address CVE-2026-25679, CVE-2026-27142, CVE-2026-27137 in go/stdlib, Issue (thanks @Orrison)

Contributors

Changelog

📦 gzip middleware

• 🐛 Gzip Middleware: Fixed a regression where responses could be encoded with zstd after upgrading to v2025.1.7; the middleware now enforces gzip-only compression BUG (thanks @dmitryuk)

Contributors

Changelog

🎯 Core

• 🐛 Go Version: Updated minimum Go version to 1.26 to address CVE-2025-61726 in go/stdlib BUG (thanks @Orrison)

Contributors