Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: alibaba/nacos
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: 2.5.2
Choose a base ref
...
head repository: alibaba/nacos
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: 2.5.3
Choose a head ref
  • 11 commits
  • 29 files changed
  • 6 contributors

Commits on Dec 8, 2025

  1. fix(CVE-2025-55752):upgrade tomcat version to 9.0109.(#13998) (#14007)

    @chunhai1127
    chunhai1127 authored Dec 8, 2025
    Configuration menu
    Copy the full SHA
    ed41399 View commit details
    Browse the repository at this point in the history

Commits on Dec 19, 2025

  1. Eliminate ClassUnload during config reload using Configuration.initia… 

    …lize() (#14025)

Fixes #13940 - Apply official PR #14000 fix to v2.x-develop branch

This commit applies the official fix from alibaba/nacos PR #14000 (commit 90747d4)
to resolve ClassUnload issues during Log4j2 configuration reload.

Key changes:
1. Add NacosLog4j2Configurator class using Configuration.initialize()
   instead of Configuration.start() to avoid plugin reinitialization
2. Refactor Log4J2NacosLoggingAdapter to delegate to new configurator
3. Remove deprecated helper methods and simplify test implementation
4. Add thread-safe double-checked locking pattern
5. Additively merge Nacos config without replacing user's logging setup

The fix follows framework-compliant pattern similar to Logback adapter.

Adapted from: #14000
Original commit: 90747d4
    @JGoP-L
    JGoP-L authored Dec 19, 2025
    Configuration menu
    Copy the full SHA
    fe80f2e View commit details
    Browse the repository at this point in the history

Commits on Feb 9, 2026

  1. fix: No exception is thrown when form parameters are too large. (#14456) 

    * fix: No exception is thrown when form parameters are too large. (#14423).

* style: Adjust some formatting. (#14423).

* style: Fix Checkstyle violation by replacing /// comments with standard Javadoc
    @youngledo
    youngledo authored Feb 9, 2026
    Configuration menu
    Copy the full SHA
    a0572d5 View commit details
    Browse the repository at this point in the history

Commits on May 25, 2026

  1. fix(CVE-2025-31650,CVE-2025-48988,CVE-2025-49125): upgrade tomcat to … 

    …9.0.118 (#15220)

Upgrade embedded Tomcat from 9.0.109 to 9.0.118 to address multiple
security vulnerabilities including CVE-2025-31650, CVE-2025-48988,
CVE-2025-49125.

Assisted-by: Claude Code

Signed-off-by: cxhello <caixiaohuichn@gmail.com>
    @cxhello
    cxhello authored May 25, 2026
    Configuration menu
    Copy the full SHA
    881658a View commit details
    Browse the repository at this point in the history

Commits on Jun 2, 2026

  1. fix(CVE-2023-35116,CVE-2025-52999): upgrade jackson to 2.16.2 (Relate… 

    …d to #15025) (#15288)
    @zmz789
    zmz789 authored Jun 2, 2026
    Configuration menu
    Copy the full SHA
    79acb21 View commit details
    Browse the repository at this point in the history

Commits on Jun 30, 2026

  1. [ISSUE #15437] fix: backport thread leak and executor safety fixes to… 

    … v2.x (#15449)

* [ISSUE #15437] fix: release leaked threads and executors on client shutdown

* [ISSUE #15437] fix: Concurrent safety of executor creation
    @zmz789
    zmz789 authored Jun 30, 2026
    Configuration menu
    Copy the full SHA
    6506576 View commit details
    Browse the repository at this point in the history

Commits on Jul 13, 2026

  1. fix: isolate config id operations by namespace (#15497) 

    Scope config ID-based export and batch delete by tenant, add sourceTenant handling and source namespace READ auth for clone, and rebuild legacy console UI assets.

Also add the form size default fallback needed by the latest v2.x branch.

Assisted-by: Claude Code
    @KomachiSion
    KomachiSion authored Jul 13, 2026
    Configuration menu
    Copy the full SHA
    60e311f View commit details
    Browse the repository at this point in the history

  2. [ISSUE #15451] Upgrade compatible dependencies for v2.x (#15501)

    @KomachiSion
    KomachiSion authored Jul 13, 2026
    Configuration menu
    Copy the full SHA
    71b46af View commit details
    Browse the repository at this point in the history

Commits on Jul 14, 2026

  1. Prepare release 2.5.3

    @KomachiSion
    KomachiSion committed Jul 14, 2026
    Configuration menu
    Copy the full SHA
    c4d2623 View commit details
    Browse the repository at this point in the history

  2. [ISSUE #12323] Sync logback packagingData config for v2.x (#15503) 

    Backport #15327 to v2.x-develop for the 2.5.3 release.

Assisted-by: Claude Code
    @KomachiSion
    KomachiSion authored Jul 14, 2026
    Configuration menu
    Copy the full SHA
    6f6b111 View commit details
    Browse the repository at this point in the history

  3. Upgrade central publishing plugin

    @KomachiSion
    KomachiSion committed Jul 14, 2026
    Configuration menu
    Copy the full SHA
    8d49753 View commit details
    Browse the repository at this point in the history
Loading