Skip to main content

2026-Q2: RR Upgrade (May 2026)

Major version​

Version: 9.2605

Breaking changes and required actions​

The following components have breaking changes compared to the previous release, or require specific actions. For more information, see the Release Notes of each listed component.

....

Components Changelog​

nevisadmin4 chart​

nevisadmin4 chart 9.2605.3 - 27.08.2026​

  • NEW: Added nevisAdmin4.trustStore.secretName/nevisAdmin4.trustStore.type to mount a Java truststore into the nevisAdmin4 pod (read-only, at a fixed path) for trusting a private/internal CA on HTTPS Git connections made by nevisAdmin4 itself, via -Djavax.net.ssl.trustStore in nevisAdmin4.config.env. Same shape as the existing nevisAdmin4.saml.idp.trustStoreSecret. (NEVISADMV4-10837)
  • NEW: Added git.caCert64 value (and an optional ca.crt key on git.credentialSecret) to trust a private/internal CA for HTTPS Git connections used by the git-init containers, wired into the GitCredentials custom resource's new caCert field. (NEVISADMV4-10837)
  • NEW: Added nevisOperator.certRetrievalTimeout to configure the timeout for cert-manager certificate retrieval. (IP-2670)
  • NEW: Added nevisOperator.shutdownTimer and nevisOperator.preStopSleepTime to configure the shutdown grace period (seconds) for deployed components and the pre-stop sleep time (seconds) before SIGTERM is sent to the container. Defaults: 30 and 32. (NOPE-69)

nevisadmin4 chart 9.2605.2 - 22.07.2026​

  • NEW: Added SAML IDP truststore support: configure nevisAdmin4.saml.idp.trustStoreSecret to reference an existing Kubernetes Secret containing a truststore, required when the IDP metadata URL is served with a certificate from a private or internal CA. (IP-2319)
    • nevisAdmin4.saml.idp.trustStoreType — truststore type (PKCS12 or JKS, case-insensitive, default PKCS12).
    • nevisAdmin4.saml.idp.hostnameVerificationEnabled — set to false to disable hostname verification for the IDP metadata URL (non-production only).
  • NEW: Added role-to-group mapping for SAML logins via the nevisAdmin4.saml.attribute passthrough: add roles-key and role-mappings to map SAML role attribute values to nevisAdmin group keys. (IP-2319)
  • CHANGED: Added support for Kubernetes v1.36 and removed support for v1.31. (IP-2334)
  • CHANGED: Updated the used nevisAdmin4 and nevisOperator version to the 9.2605.2 release. (IP-2334)
  • FIXED: The nevisadmin4-dbschema migration Job and nevisadmin4-dbschema-wait init container now use nevisAdmin4.migrationResources, reducing the resource footprint of these short-lived containers. (NEVISADMV4-10861)

nevisadmin4 chart 9.2605.1 - 25.06.2026​

  • CHANGED: Updated the used nevisAdmin4 and nevisOperator versions to the 9.2605.1 release.

nevisadmin4 chart 9.2605.0 - 20.05.2026​

  • BREAKING CHANGE: The Gateway API is now the default external traffic routing solution, replacing the Ingress controller. (IP-1409)
  • CHANGED: Reworked the nevisadmin4-dbschema job to use deterministic naming and Helm hooks (pre-install,pre-upgrade) instead of timestamp-based names, improving GitOps compatibility. To support fresh installs, the generated nevisadmin4-env Secret now runs in the same hook phase with a lower hook weight. (IP-1952)
  • CHANGED: Added support for Kubernetes v1.35 and removed support for v1.30. (NEVISADMV4-10760)
  • CHANGED: Updated the used Nevis component versions to the 9.2605.0 release.
  • NEW: Added values to configure the password policy for local users:
    • nevisAdmin4.passwordPolicy.minLength
    • nevisAdmin4.passwordPolicy.minLower
    • nevisAdmin4.passwordPolicy.minUpper
    • nevisAdmin4.passwordPolicy.minNumeric
    • nevisAdmin4.passwordPolicy.minNonAlnum - minimum number of special characters.
    • nevisAdmin4.passwordPolicy.passwordExpiration - duration value (e.g. 90d) after which passwords should be expired. Duration 0 is unlimited.
  • NEW: Add options nevisAdmin4.imagePullPolicy and nevisOperator.imagePullPolicy to configure the image pull policy for these containers. (NEVISADMV4-10701)
  • CHANGED: Update the imagePullPolicy to IfNotPresent for all nevis-ubi-tools usages. (NEVISADMV4-10701)
  • NEW: Added value nevisAdmin4.deployment.credentialSecret to configure ssh connection for Classic deployment. (IP-1956)
  • NEW: Added delete permission for nevisgateways in nevisoperator-role. (NOPE-38)

nevisadmin4-crd chart​

nevisadmin4-crd chart 9.2605.3 - 27.08.2026​

  • NEW: Add BackendRequestTimeout field to the NevisGateway CRD to configure the timeout for backend requests. (NOPE-60)
  • NEW: Add annotations field to NevisComponent and NevisDatabase CRDs. (NOPE-48)
  • NEW: Extend the GitCredentials CRD with a caCert field, to trust a private/internal CA for HTTPS Git connections used by git-init containers. (NEVISADMV4-10837)
  • NEW: Add httpRouteFilters field to NevisGateway CRD. (NOPE-63)
  • NEW: Add labels and annotations fields to NevisGateway CRD. (NOPE-49)

nevisadmin4-crd chart 9.2605.2 - 22.07.2026​

  • Technical rebuild to align the version numbers across all charts.

nevisadmin4-crd chart 9.2605.1 - 25.06.2026​

  • NEW: Extend the NevisGateway CRD with path configuration for the generated HTTPRoute. (NOPE-47)
  • CHANGED: Updated the NevisGateway CRD to align with the Gateway and Envoy APIs. (NOPE-43)

nevisadmin4-crd chart 9.2605.0 - 20.05.2026​

  • Technical rebuild to align the version numbers across all charts.

nevis-monitoring chart​

nevis-monitoring chart 9.2605.0 - 20.05.2026​

  • BREAKING CHANGE: Enabled HTTPRoute and disabled Ingress for Grafana by default. (IP-1409)

nevisOperator​

nevisOperator 9.2605.3 - 27.08.2026​

  • FIXED: Omit empty email SAN entry from generated CSR. (NOPE-61)
  • NEW: The backend request timeout is now configurable in NevisGateways via the optional backendRequestTimeout field. (NOPE-60)
  • NEW: Add annotations field to NevisComponent and NevisDatabase CRDs. (NOPE-48)
  • NEW: Add HTTPRoute filter configuration option to NevisGateways. (NOPE-63)
  • FIXED: Use a static error message on the 'Unavailable' condition of NevisComponents to prevent endless requeuing. (NOPE-62)
  • NEW: Add labels and annotations fields to NevisGateway CRD. (NOPE-49)
  • NEW: Add ShutdownTimer to configuration to set the time available for components to finish graceful shutdown. (NOPE-69)

nevisOperator 9.2605.2 - 22.07.2026​

  • FIXED: Prevent stale backup secret reuse when spec.database (Database Name) changes. (IP-1997)
  • NEW: Added a pre-flight check for configured namespaces in NevisOperator. (NOPE-57)
  • FIXED: Skip reconcile for NevisGateways marked for deletion, ensuring foreground deletion completes correctly (NOPE-54)

nevisOperator 9.2605.1 - 25.06.2026​

  • NEW: Add configurable path for generated HTTPRoute. (NOPE-47)
  • FIXED: Cookie-based session affinity is now always applied on the primary HTTPRoute rule for all Gateway API deployments, preventing CSRF failures and state loss when multiple nevisProxy replicas are running. (NOPE-52)
  • FIXED: Implement cookie-based session persistence for Gateway API < 1.4. (NOPE-53)
Dependency upgrades​
  • go 1.26.4
  • github.com/envoyproxy/gateway v1.8.1
  • go.uber.org/zap v1.28.0
  • k8s.io/api v0.35.3
  • k8s.io/apimachinery v0.35.3
  • k8s.io/client-go v0.35.3
  • sigs.k8s.io/gateway-api v1.5.1

nevisOperator 9.2605.0 - 20.05.2026​

  • NEW: Implemented a cleanup mechanism for stale NevisGateway resources not referenced in the spec of proxy NevisComponents. (NOPE-37)

Tools​

nevis-base 9.2605.1 - 27.08.2026​

  • CHANGED: Upgraded to ubi9/ubi-minimal:9.8-1786380870.
  • CHANGED: Upgraded nevis-opentelemetry-javaagent to version 3.2.0.0. (NEVISAUTH-5668)

nevis-base 9.2605.0 - 20.05.2026​

  • CHANGED: Upgraded to Java 25. (IP-1755)
  • CHANGED: Upgraded to ubi9/ubi-minimal:9.7-1778562320.
  • CHANGED: Upgraded nevis-opentelemetry-javaagent to version 3.1.0.0. (IP-1755)

nevis-base-flyway 9.2605.1 - 27.08.2026​

  • CHANGED: Rebuilt based on the new nevis-base:9.2605.1 image.

nevis-base-flyway 9.2605.0 - 20.05.2026​

  • CHANGED: Rebuilt based on the new nevis-base:9.2605.0 image.

nevis-git-init:2.0.0 - 27.08.2026​

  • CHANGED: This component was rewritten in Bash. We have found that it behaves identically to the old version; nonetheless if you experience a regression, it is possible to revert to the old version by setting git-init.version to 1.4.0 in the services section of your inventory. (IP-1759)
  • NEW: Support custom CA trust for SSH-based Git connections for git-init container. (NEVISADMV4-10837)

nevis-opentelemetry-javaagent 3.2.0.0 - 27.08.2026​

  • CHANGED: Upgraded OpenTelemetry SDK to version 1.62.0 (NEVISAUTH-5668)

  • CHANGED: Upgraded OpenTelemetry Java Agent to version 2.30.0 (NEVISAUTH-5668)

  • BREAKING CHANGE: The OpenTelemetry Java Agent 2.28.0 changed PrometheusHttpServer’s default bind host from 0.0.0.0 to localhost. So otel.properties must be adapted to bind the prometheus host explicitly back to 0.0.0.0. (NEVISAUTH-5668)

    otel.exporter.prometheus.host=0.0.0.0

nevis-opentelemetry-javaagent 3.1.0.0 - 20.05.2026​

  • CHANGED: Upgraded OpenTelemetry SDK to version 1.56.0 (NEVISAUTH-5279)
  • CHANGED: Upgraded OpenTelemetry Java Agent to version 2.22.0 (NEVISAUTH-5279)

Component versions​

The following versions are part of this release. All of them are under Full Support until the next RR upgrade becomes available.

ComponentArtifact nameVersion*
nevisAdaptnevisadapt9.2605.1.2
9.2605.0.24
nevisAdmin 4nevisadmin49.2605.3.3
9.2605.2.4
9.2605.1.2
9.2605.0.40
nevisAuthnevisauth9.2605.3.1
9.2605.2.2
9.2605.1.1
9.2605.0.16
nevisCredneviscred2.0.20.0
nevisDataPorternevisdp9.2605.2.1
9.2605.1.1
9.2605.0.0
nevisDetectnevisdetect
nevisdetectcl		9.2605.0.17
nevisFIDOnevisfido
nevisfidocl		9.2605.3.2
9.2605.2.1
9.2605.1.1
9.2605.0.8
nevisIDMnevisidm
nevisidmcl
nevisidmdb		9.2605.3.2
9.2605.2.1
9.2605.0.5
nevisIDMadnooprint
nevisKeyboxneviskeybox2.2.5.0
nevisLogRendnevislogrend9.2605.2.1
9.2605.1.1
9.2605.0.3
nevisMetanevismeta9.2605.3.0
9.2605.2.1
9.2605.1.1
9.2605.0.12
nevisProxynevisproxy9.2605.2.1
9.2605.0.0
Ninjaninja9.2605.0.5
Ninwinninwin2.3.5.0

*) Versions in bold changed compared to the previous release.

Third-party dependencies​

The following third-party software is often used by Nevis components. Some of the software is included within nevisAppliance.

Below you find the latest supported versions.

Third-Party SoftwareVersion
JVM (OpenJDK)✅ 25.0.2
MariaDB✅ 11.4
PostgreSQL✅ 17

Mobile Apps​

Mobile apps and the Mobile SDK are released independently of the component releases. Refer to the following pages: