Contact Us 1-800-596-4880

Mule Runtime Patch Update Release Notes for Mule Apps on Runtime Fabric

These release notes describe monthly date-patch updates to the Mule runtime engine on Runtime Fabric. In addition to these release notes, see the Anypoint Runtime Fabric release notes and the complete Anypoint Runtime Fabric documentation.

For further information on Mule runtime patch updates, see Managing Mule runtime patch updates for Runtime Fabric.

Mule Runtime Release Cadence Support

This table shows the Mule runtime release cadence support for Runtime Fabric:

Mule Version Release Date Java Version End of Standard Support End of Extended Support

4.12 Edge

June 2026

17

November 2026

February 2027

4.11 Edge

February 2026

17

July 2026

October 2026

4.10 Edge

October 2025

17

March 2026

June 2026

4.9 LTS

February 2025

17

August 2027

February 2028

4.9 Edge

February 2025

17

November 2025

February 2026

4.8 Edge

October 2024

8, 11, and 17

March 2025

June 2025

4.7 Edge

June 2024

8, 11, and 17

October 2024

February 2025

4.6 LTS

February 2024

8, 11, and 17

August 2026

February 2027

4.6 Edge

February 2024

8, 11, and 17

June 2024

October 2024

4.5 Edge

October 2023

8 and 11

February 2024

June 2024

MuleSoft provides an extended support window for version 4.6 LTS due to its compatibility with Java 8, 11, and 17.

Runtime Fabric doesn’t support Mule runtime engine version 4.6.x and later on Runtime Fabric 1.13.x appliance-based clusters.

Runtime Fabric Release Monthly Cadence

This table shows the current schedule for monthly updates.

Updates are packaged as <major version>-<runtime patch package version>-<image build number>

Monthly updates 4.12 Edge Patch 4.11 Edge Patch 4.9 LTS Patch 4.9 Edge Patch (EOL) 4.6 LTS Patch 4.6 Edge Patch (EOL) 4.4 Patch (EOL) 4.3 Patch (EOL)

August 2026

4.12.2:8e-java17

4.11.6:7e-java17

4.9.20:9-java17

-

4.6.33:9-java17

4.6.33:9-java8

-

-

July 2026

4.12.1:4e-java17

4.11.6:4e-java17

-

-

-

June 2026

4.12.0:10e-java17

4.11.5:4e-java17

4.9.18:3-java17

-

4.6.31:3-java17

4.6.31:3-java8

-

-

May 2026

-

4.11.4:4e-java17

-

-

-

-

April 2026

-

4.11.3:4e-java17

4.9.16:4-java17

-

-

-

-

March 2026

-

4.11.2:3e-java17

4.9.15:3-java17

-

-

-

-

February 2026

-

-

-

-

January 2026

-

-

4.9.12:5-java17

4.9.12:5e-java17

-

-

-

December 2025

-

-

-

-

-

-

-

-

November 2025

-

-

-

-

October 2025

-

-

4.9.10:4-java17

4.9.10:4e-java17

-

4.4.0:20250919-3

-

September 2025

-

-

4.9.9:5-java17

4.9.9:5e-java17

-

4.4.0:20250829-1

-

  • EOSS (End of Standard Support)

  • EOES (End of Extended Support)

  • EOL (End of Life)

The security fix SE-21834, from the August 3, 2021 patch release, disables TLS v1 and TLS v1.1 by default. When you deploy an application to Runtime Fabric, you can enable TLS v1 or TLS v1.1 using the following JVM args:

  • Enable TLS v1.0 and TLS v1.1: -Drtf.allow.TLSv1.0+

  • Enable TLS v1.1: -Drtf.allow.TLSv1.1

This change affects all Mule versions for Anypoint Runtime Fabric. Future patches to these releases and future minor releases of Mule will also incorporate this new default.

August 12, 2026

What’s New

Fixed Issues

4.12.2:8e-java17

4.12.2 Edge Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.41

This release includes security updates.

Issue Resolution ID

Mule

Lazy initialization no longer fails with a NullPointerException when an application using the VM connector’s publish operation also configures a global error handler.

W-23156632

Idle connections are no longer destroyed and recreated instead of being reused when the number of idle connections reaches the configured maxIdle limit under concurrent load.

W-22716456

An HTTP request client connecting through a proxy no longer hangs when the proxy responds with a 407 (Proxy Authentication Required) response during the CONNECT tunnel handshake.

W-23384719

The HTTP request client now sends a correctly formed request line when connecting through a forward proxy.

W-23384645

A NullPointerException no longer occurs when the HTTP request client reuses a pooled connection to a forward proxy.

W-23384744

HTTP/3 requests sent to an HTTP/1 server now correctly fail with a 505 (HTTP Version Not Supported) response.

W-23029577

Requests with a non-numeric Content-Length header are now rejected with a 400 (Bad Request) response.

W-23029480

A batch job no longer fails with a MULE:CANCELLED error during graceful shutdown.

W-23426859

Potential errors thrown during runtime shutdown are now handled correctly.

W-23051939

The Batch module now provides a public API to configure a custom queue manager and queue timeout.

W-23371797

When running in FIPS mode on a standalone server, the runtime now logs a warning at startup if the JVM java.security file isn’t configured with the required FIPS providers, instead of silently masking the misconfiguration.

W-22794711

The Sec-WebSocket-Protocol header is now forwarded on outbound WebSocket connections, so subprotocol negotiation with the server succeeds.

W-23071781

The Diagnostic Information Analysis File (DIAF) now includes network information.

W-22383655

The Diagnostic Information Analysis File (DIAF) now includes Mule agent information.

W-22383660

The Diagnostic Information Analysis File (DIAF) now includes a platform connectivity check.

W-22383679

The API Gateway resource cache is enabled by default. You can now disable it by setting the anypoint.platform.resource_cache_enabled system property to false.

W-23542185

The Jackson library is upgraded to 2.22.0.

W-23165634

DataWeave

The repeated attribute selector (.*@) now correctly preserves values when processing data structures containing empty map slots.

W-23457314

Type metadata processing now correctly handles sibling references that target the same type, preventing duplicate annotations.

W-23424037

DataWeave now handles Java Platform Module System (JPMS) access restrictions more gracefully when running on Java 17 and later in Mule runtime 4.6.0 and later.

W-23354139

The Jackson library is upgraded to 2.21.5.

W-23037592

The per_app_java_bean_cache compatibility flag now correctly reports its creation version as 2.9.

W-22417507

4.11.6:7e-java17

4.11.6 Edge Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.33

  • Updated to the latest operating system security patches.

4.9.20:9-java17

4.9.20 LTS Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.41

This release includes security updates.

Issue Resolution ID

Mule

Idle connections are no longer destroyed and recreated instead of being reused when the number of idle connections reaches the configured maxIdle limit under concurrent load.

W-22716456

HTTP/3 requests sent to an HTTP/1 server now correctly fail with a 505 (HTTP Version Not Supported) response.

W-23029577

Requests with a non-numeric Content-Length header are now rejected with a 400 (Bad Request) response.

W-23029480

A batch job no longer fails with a MULE:CANCELLED error during graceful shutdown.

W-23426859

Potential errors thrown during runtime shutdown are now handled correctly.

W-23051939

When running in FIPS mode on a standalone server, the runtime now logs a warning at startup if the JVM java.security file isn’t configured with the required FIPS providers, instead of silently masking the misconfiguration.

W-22794711

The Diagnostic Information Analysis File (DIAF) now includes network information.

W-22383655

The Diagnostic Information Analysis File (DIAF) now includes Mule agent information.

W-22383660

The Diagnostic Information Analysis File (DIAF) now includes a platform connectivity check.

W-22383679

The API gateway resource cache is enabled by default. You can now disable it by setting the anypoint.platform.resource_cache_enabled system property to false.

W-23542185

The Jackson library is upgraded to 2.22.0.

W-23131090

DataWeave

The repeated attribute selector (.*@) now correctly preserves values when processing data structures containing empty map slots.

W-23457314

The Jackson library is upgraded to 2.21.5.

W-23037592

The per_app_java_bean_cache compatibility flag now correctly reports its creation version as 2.9.

W-22417507

4.6.33:9-java17

4.6.33 LTS Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.41

This release includes security updates.

Issue Resolution ID

Mule

Idle connections are no longer destroyed and recreated instead of being reused when the number of idle connections reaches the configured maxIdle limit under concurrent load.

W-22716456

A batch job no longer fails with a MULE:CANCELLED error during graceful shutdown.

W-23426859

Potential errors thrown during runtime shutdown are now handled correctly.

W-23051939

The Diagnostic Information Analysis File (DIAF) now includes network information.

W-22383655

The Diagnostic Information Analysis File (DIAF) now includes Mule agent information.

W-22383660

The Diagnostic Information Analysis File (DIAF) now includes a platform connectivity check.

W-22383679

The API gateway resource cache is enabled by default. You can now disable it by setting the anypoint.platform.resource_cache_enabled system property to false.

W-23542185

The Jackson library is upgraded to 2.22.0.

W-23121654

DataWeave

The repeated attribute selector (.*@) now correctly preserves values when processing data structures containing empty map slots.

W-23457314

The Jackson library is upgraded to 2.21.5.

W-23037592

4.6.33:9-java8

4.6.33 LTS Runtime Updates

  • Bundled JDK version: OpenJDK "1.8.0_452"

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.41

This release includes security updates.

Issue Resolution ID

Mule

Idle connections are no longer destroyed and recreated instead of being reused when the number of idle connections reaches the configured maxIdle limit under concurrent load.

W-22716456

A batch job no longer fails with a MULE:CANCELLED error during graceful shutdown.

W-23426859

Potential errors thrown during runtime shutdown are now handled correctly.

W-23051939

The Diagnostic Information Analysis File (DIAF) now includes network information.

W-22383655

The Diagnostic Information Analysis File (DIAF) now includes Mule agent information.

W-22383660

The Diagnostic Information Analysis File (DIAF) now includes a platform connectivity check.

W-22383679

The API gateway resource cache is enabled by default. You can now disable it by setting the anypoint.platform.resource_cache_enabled system property to false.

W-23542185

The Jackson library is upgraded to 2.22.0.

W-23121654

DataWeave

The repeated attribute selector (.*@) now correctly preserves values when processing data structures containing empty map slots.

W-23457314

The Jackson library is upgraded to 2.21.5.

W-23037592

July 14, 2026

The July 14 patch update 4.9.19:9-java17, 4.6.32:5-java17, and 4.6.32:5-java8 addresses an issue in the previous July 7 patch update and includes the fixes in those patches.

4.9.19:9-java17

4.9.19 LTS Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.33

This release includes security updates.

Issue Resolution ID

The runtime no longer logs this warning:

Cannot start plugin 'rtf-cluster-server-plugin'. Plugin will be unregistered
java.lang.reflect.UndeclaredThrowableException

W-23373633

4.6.32:5-java17

4.6.32 LTS Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.33

This release includes security updates.

Issue Resolution ID

The runtime no longer logs this warning:

Cannot start plugin 'rtf-cluster-server-plugin'. Plugin will be unregistered
java.lang.reflect.UndeclaredThrowableException

W-23373633

4.6.32:5-java8

4.6.32 LTS Runtime Updates

  • Bundled JDK version: OpenJDK "1.8.0_452"

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.33

This release includes security updates.

Issue Resolution ID

The runtime no longer logs this warning:

Cannot start plugin 'rtf-cluster-server-plugin'. Plugin will be unregistered
java.lang.reflect.UndeclaredThrowableException

W-23373633

July 7, 2026

What’s New

Fixed Issues

4.12.1:4e-java17

4.12.1 Edge Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.33

This release includes security updates.

Issue Resolution ID

Mule

Clustered applications deployed with two or more replicas no longer fail to start with a NullPointerException error during cluster node discovery.

W-22843942

Cluster node IDs are no longer generated with negative values.

W-22294724

Graceful shutdown no longer times out when a global error handler runs for a flow.

W-22434375

Long-running internal tasks no longer use the shared forkJoin pool during parallel flow shutdown and bootstrap configuration, preventing thread starvation.

W-22279521

Race conditions in outerFluxCompletionScheduler no longer occur during graceful shutdown.

W-22343018

Mule no longer hangs during shutdown when a parameter validation exception occurs during flow execution.

W-22248534

Connectivity testing of configurations in clustered deployments no longer uses distributed locks, preventing deadlocks.

W-22248198

Fatal errors such as StackOverflowError are now logged instead of being consumed by internal error handling.

W-22496803

Object Store retrieved from the registry in OAuthHandler is now properly initialized and started.

W-22373641

SDK parameter validation errors now raise the MULE:VALIDATION error type instead of MULE:UNKNOWN.

W-22276522

ConcurrentModificationException errors no longer occur when multiple plugins with shared dependencies are deployed simultaneously.

W-21193046

The error type in the EE cache scope is now correctly reported as MULE:RETRY_EXHAUSTED instead of EE:RETRY_EXHAUSTED when until-successful exhausts its retries.

W-21525972

Test Connection for the HTTP listener now correctly reports a failure when an unresolvable hostname is configured in the host field.

W-21921687

HTTP Server now supports upgrade requests to h2c even when the request contains a non-empty body.

W-22506085

Duplicate XSD elements are no longer generated for connection providers declared at both the extension and configuration levels.

W-20824537

Shutdown validation for dynamic configurations can now be skipped by enabling the mule.forcefulShutdown.dynamicConfig.disableStoppingCheck system property.

W-22772644

Flows with a scheduler source are no longer left in an invalid state after a flow restart.

W-22918240

Stopping a flow no longer waits unnecessarily when no events are being processed.

W-22969411

Project versions defined with properties are now resolved recursively.

W-22845430

Extension packager validation no longer fails for operations annotated with @Validator that use a CompletionCallback operation.

W-22817376

Events that are dropped within a processing hook are now properly completed and terminated.

W-22470584

In-memory Object Store partitions are now created correctly when an application is deployed to a cluster with the Object Store plugin enabled.

W-17714668

Deserialization errors no longer occur in the Object Store during a runtime patch upgrade.

W-20880559

Applications deployed with a serialized AST now include all Mule error types in the error type repository.

W-22399271

Applications that use HTTP request attributes no longer fail annotation processing due to default constructor validation.

W-22385620

The Netty HTTP listener now rejects HTTP/1.1 requests that have a missing or duplicate host header, in compliance with RFC 9112.

W-23052713

The maximum size of the dynamic flow-ref cache is now configurable through the mule.flowRef.dynamicCacheMaxSize system property, which defaults to 20.

W-22219018

API Gateway contract persistence can now be disabled by setting the anypoint.platform.contracts_persistence_enabled system property to false, avoiding errors when persisting large numbers of contracts.

W-22568982

Large Anypoint Platform authentication failure responses no longer cause excessive log bloat.

W-21882516

SDK sources that don’t implement Reconnectable are no longer restarted during graceful shutdown.

W-21563258

OpenTelemetry flow statistics now report metrics correctly for applications with more than one flow.

W-23051614

The artifact type (domain, policy, or application) is now included as an OpenTelemetry resource attribute.

W-21768636

OpenTelemetry metric attribute names now use a consistent notation.

W-21921584

The mule.openTelemetry.logging.exporter.resource.container.service.name system property is now available to set the service name that the Mule container reports for OpenTelemetry telemetry.

W-22861497

Event dumps now include a state for events that are waiting on a non-blocking operation.

W-22142952

The Netty library is upgraded to 4.2.15.Final.

W-22831076

The c3p0 library is upgraded to 0.14.1.

W-22990155

The Bitronix Transaction Manager library is upgraded to 3.0.2.

W-22405007

The Reactor Netty library is upgraded to 1.3.6.

W-3300013

The Jackson Core library is upgraded to 2.21.1.

W-22839747

The Apache Neethi library is upgraded to 3.2.1.

W-22839752

The OpenTelemetry API library is upgraded to 1.62.0.

W-22849469

The Spring Framework is upgraded to 6.2.19.

W-22939417

DataWeave

Scope resolution errors no longer occur when importing Java classes with self-referential array properties.

W-22914494

StackOverflowError errors no longer occur when computing or converting type metadata for self-referencing recursive types.

W-21712344

4.11.6:4e-java17

4.11.6 Edge Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.33

This release includes security updates.

Issue Resolution ID

Mule

Cluster node IDs are no longer generated with negative values.

W-22294724

Graceful shutdown no longer times out when a global error handler runs for a flow.

W-22434375

Long-running internal tasks no longer use the shared forkJoin pool during parallel flow shutdown and bootstrap configuration, preventing thread starvation.

W-22279521

Duplicate XSD elements are no longer generated for connection providers declared at both the extension and configuration levels.

W-20824537

Shutdown validation for dynamic configurations can now be skipped by enabling the mule.forcefulShutdown.dynamicConfig.disableStoppingCheck system property.

W-22772644

Flows with a scheduler source are no longer left in an invalid state after a flow restart.

W-22918240

Stopping a flow no longer waits unnecessarily when no events are being processed.

W-22969411

Project versions defined with properties are now resolved recursively.

W-22845430

Extension packager validation no longer fails for operations annotated with @Validator that use a CompletionCallback operation.

W-22817376

Events that are dropped within a processing hook are now properly completed and terminated.

W-22470584

The Netty HTTP listener now rejects HTTP/1.1 requests that have a missing or duplicate host header, in compliance with RFC 9112.

W-23052713

The maximum size of the dynamic flow-ref cache is now configurable through the mule.flowRef.dynamicCacheMaxSize system property, which defaults to 20.

W-22219018

API Gateway contract persistence can now be disabled by setting the anypoint.platform.contracts_persistence_enabled system property to false, avoiding errors when persisting large numbers of contracts.

W-22568982

The c3p0 library is upgraded to 0.14.1.

W-22990152

The Spring Framework is upgraded to 6.2.19.

W-3300013

The Bitronix Transaction Manager library is upgraded to 3.0.2.

W-22405007

The OpenTelemetry API library is upgraded to 1.62.0.

W-22806044

The Netty library is upgraded to 4.2.15.Final.

W-22888966

The Reactor Netty library is upgraded to 1.3.6.

W-22939412

DataWeave

Scope resolution errors no longer occur when importing Java classes with self-referential array properties.

W-22914494

AvroReader no longer causes memory leaks when processing Avro data in long-running flows.

W-22364385

4.9.19:8-java17

4.9.19 LTS Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.33

This release includes security updates.

Issue Resolution ID

Mule

Cluster node IDs are no longer generated with negative values.

W-22294724

Graceful shutdown no longer times out when a global error handler runs for a flow.

W-22434375

Long-running internal tasks no longer use the shared forkJoin pool during parallel flow shutdown and bootstrap configuration, preventing thread starvation.

W-22279521

Duplicate XSD elements are no longer generated for connection providers declared at both the extension and configuration levels.

W-20824537

Shutdown validation for dynamic configurations can now be skipped by enabling the mule.forcefulShutdown.dynamicConfig.disableStoppingCheck system property.

W-22772644

Flows with a scheduler source are no longer left in an invalid state after a flow restart.

W-22918240

Stopping a flow no longer waits unnecessarily when no events are being processed.

W-22969411

Project versions defined with properties are now resolved recursively.

W-22845430

Extension packager validation no longer fails for operations annotated with @Validator that use a CompletionCallback operation.

W-22817376

Events that are dropped within a processing hook are now properly completed and terminated.

W-22470584

The Netty HTTP listener now rejects HTTP/1.1 requests that have a missing or duplicate Host header, in compliance with RFC 9112.

W-23052713

The Content-Length header is now removed based on the actual entity byte length.

W-22570070

SDK sources that don’t implement Reconnectable are no longer restarted during graceful shutdown.

W-21563258

The maximum size of the dynamic flow-ref cache is now configurable through the mule.flowRef.dynamicCacheMaxSize system property, which defaults to 20.

W-22219018

The Jackson Databind library is upgraded to 2.21.4.

W-3300013

The OpenTelemetry API library is upgraded to 1.62.0.

W-22806027

The c3p0 library is upgraded to 0.14.1.

W-23012713

The Apache Neethi library is upgraded to 3.2.1.

W-22939389

The Apache CXF library is upgraded to 3.6.11.

W-23037617

The Rhino library is upgraded to 1.8.1.

W-22939391

The Log4j library is upgraded to 2.25.4.

W-22939403

The Reactor Netty library is upgraded to 1.2.18.

W-22939384

The Spring Framework is upgraded to 6.2.19.

W-22956997

The Netty library is upgraded to 4.2.15.Final.

W-22956998

The Bitronix Transaction Manager library is upgraded to 2.1.21.

W-22405007

DataWeave

Scope resolution errors no longer occur when importing Java classes with self-referential array properties.

W-22914494

AvroReader no longer causes memory leaks when processing Avro data in long-running flows.

W-22364385

4.6.32:4-java17

4.6.32 LTS Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.33

This release includes security updates.

Issue Resolution ID

Mule

A NullPointerException error no longer occurs in event context handling when a flow times out while a non-blocking operation is still in flight.

W-22902839

Cluster node IDs are no longer generated with negative values.

W-22294724

Graceful shutdown no longer times out when a global error handler runs for a flow.

W-22434375

Long-running internal tasks no longer use the shared forkJoin pool during parallel flow shutdown and bootstrap configuration, preventing thread starvation.

W-22279521

Duplicate XSD elements are no longer generated for connection providers declared at both the extension and configuration levels.

W-20824537

Shutdown validation for dynamic configurations can now be skipped by enabling the mule.forcefulShutdown.dynamicConfig.disableStoppingCheck system property.

W-22772644

Flows with a scheduler source are no longer left in an invalid state after a flow restart.

W-22918240

Stopping a flow no longer waits unnecessarily when no events are being processed.

W-22969411

Project versions defined with properties are now resolved recursively.

W-22845430

Extension packager validation no longer fails for operations annotated with @Validator that use a CompletionCallback operation.

W-22817376

The Netty HTTP listener now rejects HTTP/1.1 requests that have a missing or duplicate Host header, in compliance with RFC 9112.

W-23052713

SDK sources that don’t implement Reconnectable are no longer restarted during graceful shutdown.

W-21563258

The maximum size of the dynamic flow-ref cache is now configurable through the mule.flowRef.dynamicCacheMaxSize system property, which defaults to 20.

W-22219018

Sensitive headers are no longer forwarded when an HTTP request is redirected to a different host. This can be configured with FILTER_SENSITIVE_HEADERS_ON_REDIRECT.

W-21045658

API Gateway contract persistence can now be disabled by setting the anypoint.platform.contracts_persistence_enabled system property to false, avoiding errors when persisting large numbers of contracts.

W-22568982

The Joda-Time library is upgraded to 2.13.0.

W-3300013

The Rhino library is upgraded to 1.7.15.1.

W-22805996

The Apache Neethi library is upgraded to 3.2.1.

W-22805997

The OpenTelemetry API library is upgraded to 1.62.0.

W-22806011

The Apache CXF library is upgraded to 3.5.11.

W-23037585

The c3p0 library is upgraded to 0.14.1.

W-23012711

The Bitronix Transaction Manager library is upgraded to 2.1.21.

W-22405007

DataWeave

Scope resolution errors no longer occur when importing Java classes with self-referential array properties.

W-22914494

The Java bean metadata cache no longer performs unnecessary evictions when processing Java POJOs. A new per-app Java bean cache can be enabled with the per_app_java_bean_cache compatibility flag.

W-22417507

4.6.32:4-java8

4.6.32 LTS Runtime Updates

  • Bundled JDK version: OpenJDK "1.8.0_452"

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.33

This release includes security updates.

Issue Resolution ID

Mule

A NullPointerException error no longer occurs in event context handling when a flow times out while a non-blocking operation is still in flight.

W-22902839

Cluster node IDs are no longer generated with negative values.

W-22294724

Graceful shutdown no longer times out when a global error handler runs for a flow.

W-22434375

Long-running internal tasks no longer use the shared forkJoin pool during parallel flow shutdown and bootstrap configuration, preventing thread starvation.

W-22279521

Duplicate XSD elements are no longer generated for connection providers declared at both the extension and configuration levels.

W-20824537

Shutdown validation for dynamic configurations can now be skipped by enabling the mule.forcefulShutdown.dynamicConfig.disableStoppingCheck system property.

W-22772644

Flows with a scheduler source are no longer left in an invalid state after a flow restart.

W-22918240

Stopping a flow no longer waits unnecessarily when no events are being processed.

W-22969411

Project versions defined with properties are now resolved recursively.

W-22845430

Extension packager validation no longer fails for operations annotated with @Validator that use a CompletionCallback operation.

W-22817376

The Netty HTTP listener now rejects HTTP/1.1 requests that have a missing or duplicate Host header, in compliance with RFC 9112.

W-23052713

SDK sources that don’t implement Reconnectable are no longer restarted during graceful shutdown.

W-21563258

The maximum size of the dynamic flow-ref cache is now configurable through the mule.flowRef.dynamicCacheMaxSize system property, which defaults to 20.

W-22219018

Sensitive headers are no longer forwarded when an HTTP request is redirected to a different host. This can be configured with FILTER_SENSITIVE_HEADERS_ON_REDIRECT.

W-21045658

API Gateway contract persistence can now be disabled by setting the anypoint.platform.contracts_persistence_enabled system property to false, avoiding errors when persisting large numbers of contracts.

W-22568982

The Joda-Time library is upgraded to 2.13.0.

W-3300013

The Rhino library is upgraded to 1.7.15.1.

W-22805996

The Apache Neethi library is upgraded to 3.2.1.

W-22805997

The OpenTelemetry API library is upgraded to 1.62.0.

W-22806011

The Apache CXF library is upgraded to 3.5.11.

W-23037585

The c3p0 library is upgraded to 0.14.1.

W-23012711

The Bitronix Transaction Manager library is upgraded to 2.1.21.

W-22405007

DataWeave

Scope resolution errors no longer occur when importing Java classes with self-referential array properties.

W-22914494

The Java bean metadata cache no longer performs unnecessary evictions when processing Java POJOs. A new per-app Java bean cache can be enabled with the per_app_java_bean_cache compatibility flag.

W-22417507

June 2, 2026

What’s New

Fixed Issues

4.12.0:10e-java17

4.12.0 Edge Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.33

This release includes security updates.

Issue Resolution ID

Mule

Upstream HTTP requests are now cancelled when a downstream client disconnects, preventing unnecessary data transfer.

W-20084343

The Netty HTTP client no longer throws NullPointerException when handling Expect 100-Continue responses.

W-21513490

Sensitive headers are no longer forwarded when an HTTP request is redirected to a different host. This can be configured with FILTER_SENSITIVE_HEADERS_ON_REDIRECT.

W-21045658

The Apache CXF library is upgraded to 3.6.8.

W-20541600

Cluster encryption now uses the configured algorithm correctly instead of defaulting to Blowfish.

W-21666905

Race conditions during policy redeployment that caused Mule to stop processing events permanently no longer occur.

W-22343705

Redelivery policy logging now includes additional context for troubleshooting.

W-20636028

The Tanuki Java Service Wrapper is upgraded to 3.6.4.

W-17051070

The RAML parser is upgraded to 1.1.10.

W-21768014

The OpenTelemetry SDK is upgraded to 1.60.1.

W-21808539

Persistent ObjectStore or Batch data serialized before a patch upgrade now deserializes correctly after upgrading.

W-22623626

OutOfMemory errors no longer occur when establishing SSL connections with HTTP endpoints.

W-22547971

DataWeave

DataWeave now supports the private modifier on fun, var, ns, and type declarations to hide them from importers.

W-21148967

internal is no longer a reserved word and can now be used as an identifier in DataWeave scripts.

W-21508044

The compiler now reports an error when overloads of the same function declare different visibility modifiers.

W-21362539

StackOverflowError no longer occurs in the type checker when resolving intersections of unbound type parameters.

W-20124753

Runtime errors no longer occur when invoking overloaded functions across modules.

W-21811015

Spurious type-check errors no longer occur when an optional key-value pair is assigned to a required one.

W-21351058

deferred values passed to the write function now terminate correctly.

W-20925604

Out-of-memory errors no longer occur when reading large text or CDATA sections with the indexed XML reader.

W-21006104

The Java module bean introspection cache no longer causes memory leaks.

W-22419118

4.11.5:4e-java17

4.11.5 Edge Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.33

This release includes security updates.

Issue Resolution ID

Mule

Connectivity testing of configurations in clustered deployments no longer uses distributed locks, preventing deadlocks.

W-22248198

Fatal errors such as StackOverflowError are now logged instead of being consumed by internal error handling.

W-22496803

Mule no longer hangs during shutdown when a parameter validation exception occurs during flow execution.

W-22248534

Race conditions in outerFluxCompletionScheduler no longer occur during graceful shutdown.

W-22343018

The ObjectStore retrieved from the Registry in OAuthHandler is now properly initialized and started.

W-22373641

SDK parameter validation errors now raise the MULE:VALIDATION error type instead of MULE:UNKNOWN.

W-22276522

Race conditions during policy redeployment that caused Mule to stop processing events permanently no longer occur.

W-22343705

ConcurrentModificationException errors no longer occur when multiple plugins with shared dependencies are deployed simultaneously.

W-21193046

Cluster encryption now uses the configured algorithm correctly instead of defaulting to Blowfish.

W-21666905

The error type in the EE Cache scope is now correctly reported as MULE:RETRY_EXHAUSTED instead of EE:RETRY_EXHAUSTED when until-successful exhausts its retries.

W-21525972

Large Anypoint Platform authentication failure responses no longer cause excessive log bloat.

W-21882516

HTTP Server now supports Upgrade requests to h2c even when the request contains a non-empty body.

W-22506085

Test Connection for The HTTP listener now correctly reports a failure when an unresolvable hostname is configured in the Host field.

W-21921687

The Spring Core library is upgraded to 6.2.18.

W-22169898

Persistent ObjectStore or Batch data serialized before a patch upgrade now deserializes correctly after upgrading.

W-22623626

OutOfMemory errors no longer occur when establishing SSL connections with HTTP endpoints.

W-22547971

DataWeave

StackOverflowError errors no longer occur when computing or converting type metadata for self-referencing recursive types.

W-21712344

The Java bean metadata cache no longer performs unnecessary evictions when processing Java POJOs. A new per-app Java bean cache can be enabled with the per_app_java_bean_cache compatibility flag.

W-22417507

The Java module bean introspection cache no longer causes memory leaks.

W-22419118

4.9.18:3-java17

4.9.18 LTS Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.33

This release includes security updates.

Issue Resolution ID

Mule

Connectivity testing of configurations in clustered deployments no longer uses distributed locks, preventing deadlocks.

W-22248198

Fatal errors such as StackOverflowError are now logged instead of being consumed by internal error handling.

W-22496803

Mule no longer hangs during shutdown when a parameter validation exception occurs during flow execution.

W-22248534

Race conditions in outerFluxCompletionScheduler no longer occur during graceful shutdown.

W-22343018

The ObjectStore retrieved from the Registry in OAuthHandler is now properly initialized and started.

W-22373641

SDK parameter validation errors now raise the MULE:VALIDATION error type instead of MULE:UNKNOWN.

W-22276522

Race conditions during policy redeployment that caused Mule to stop processing events permanently no longer occur.

W-22343705

ConcurrentModificationException errors no longer occur when multiple plugins with shared dependencies are deployed simultaneously.

W-21193046

Cluster encryption now uses the configured algorithm correctly instead of defaulting to Blowfish.

W-21666905

The error type in the EE Cache scope is now correctly reported as MULE:RETRY_EXHAUSTED instead of EE:RETRY_EXHAUSTED when until-successful exhausts its retries.

W-21525972

Large Anypoint Platform authentication failure responses no longer cause excessive log bloat.

W-21882516

Persistent ObjectStore or Batch data serialized before a patch upgrade now deserializes correctly after upgrading.

W-22623626

OutOfMemory errors no longer occur when establishing SSL connections with HTTP endpoints.

W-22547971

DataWeave

StackOverflowError errors no longer occur when computing or converting type metadata for self-referencing recursive types.

W-21712344

The Java bean metadata cache no longer performs unnecessary evictions when processing Java POJOs. A new per-app Java bean cache can be enabled with the per_app_java_bean_cache compatibility flag.

W-22417507

4.6.31:3-java17

4.6.31 LTS Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.33

This release includes security updates.

Issue Resolution ID

Mule

Connectivity testing of configurations in clustered deployments no longer uses distributed locks, preventing deadlocks.

W-22248198

Fatal errors such as StackOverflowError are now logged instead of being consumed by internal error handling.

W-22496803

Mule no longer hangs during shutdown when a parameter validation exception occurs during flow execution.

W-22248534

Race conditions in outerFluxCompletionScheduler no longer occur during graceful shutdown.

W-22343018

The ObjectStore retrieved from the Registry in OAuthHandler is now properly initialized and started.

W-22373641

SDK parameter validation errors now raise the MULE:VALIDATION error type instead of MULE:UNKNOWN.

W-22276522

Race conditions during policy redeployment that caused Mule to stop processing events permanently no longer occur.

W-22343705

ConcurrentModificationException errors no longer occur when multiple plugins with shared dependencies are deployed simultaneously.

W-21193046

Cluster encryption now uses the configured algorithm correctly instead of defaulting to Blowfish.

W-21666905

The error type in the EE Cache scope is now correctly reported as MULE:RETRY_EXHAUSTED instead of EE:RETRY_EXHAUSTED when until-successful exhausts its retries.

W-21525972

Large Anypoint Platform authentication failure responses no longer cause excessive log bloat.

W-21882516

In-memory Object Store partitions now correctly use cluster-wide storage when deployed to a cluster with the Object Store plugin enabled.

W-17714668

Persistent ObjectStore or Batch data serialized before a patch upgrade now deserializes correctly after upgrading.

W-22623626

OutOfMemory errors no longer occur when establishing SSL connections with HTTP endpoints.

W-22547971

DataWeave

The Java bean metadata cache no longer performs unnecessary evictions when processing Java POJOs. A new per-app Java bean cache can be enabled with the per_app_java_bean_cache compatibility flag.

W-22417507

4.6.31:3-java8

4.6.31 LTS Runtime Updates

  • Bundled JDK version: OpenJDK "1.8.0_452"

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.33

This release includes security updates.

Issue Resolution ID

Mule

Connectivity testing of configurations in clustered deployments no longer uses distributed locks, preventing deadlocks.

W-22248198

Fatal errors such as StackOverflowError are now logged instead of being consumed by internal error handling.

W-22496803

Mule no longer hangs during shutdown when a parameter validation exception occurs during flow execution.

W-22248534

Race conditions in outerFluxCompletionScheduler no longer occur during graceful shutdown.

W-22343018

The ObjectStore retrieved from the Registry in OAuthHandler is now properly initialized and started.

W-22373641

SDK parameter validation errors now raise the MULE:VALIDATION error type instead of MULE:UNKNOWN.

W-22276522

Race conditions during policy redeployment that caused Mule to stop processing events permanently no longer occur.

W-22343705

ConcurrentModificationException errors no longer occur when multiple plugins with shared dependencies are deployed simultaneously.

W-21193046

Cluster encryption now uses the configured algorithm correctly instead of defaulting to Blowfish.

W-21666905

The error type in the EE Cache scope is now correctly reported as MULE:RETRY_EXHAUSTED instead of EE:RETRY_EXHAUSTED when until-successful exhausts its retries.

W-21525972

Large Anypoint Platform authentication failure responses no longer cause excessive log bloat.

W-21882516

In-memory Object Store partitions now correctly use cluster-wide storage when deployed to a cluster with the Object Store plugin enabled.

W-17714668

Persistent ObjectStore or Batch data serialized before a patch upgrade now deserializes correctly after upgrading.

W-22623626

OutOfMemory errors no longer occur when establishing SSL connections with HTTP endpoints.

W-22547971

DataWeave

The Java bean metadata cache no longer performs unnecessary evictions when processing Java POJOs. A new per-app Java bean cache can be enabled with the per_app_java_bean_cache compatibility flag.

W-22417507

May 19, 2026

The May 19 patch update 4.9.17:5-java17, 4.6.30:5-java17, 4.6.30:5-java8 addresses a regression in the previous May 5 patch update and includes the fixes in those patches.

4.9.17:5-java17

4.9.17 Edge Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.33

This release includes security updates.

Issue Resolution ID

Incoming header names no longer use strict CRLF validation when an HTTP configuration without a listener receives an HTTPS request, avoiding out-of-memory errors. In this scenario, Mule logs a warning entry in mule_ee.log, but the warning doesn’t affect application behavior.

W-22571733

4.6.30:5-java17

4.6.30 Edge Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.33

This release includes security updates.

Issue Resolution ID

Incoming header names no longer use strict CRLF validation when an HTTP configuration without a listener receives an HTTPS request, avoiding out-of-memory errors. In this scenario, Mule logs a warning entry in mule_ee.log, but the warning doesn’t affect application behavior.

W-22571733

4.6.30:5-java8

4.6.30 Edge Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.33

This release includes security updates.

Issue Resolution ID

Incoming header names no longer use strict CRLF validation when an HTTP configuration without a listener receives an HTTPS request, avoiding out-of-memory errors. In this scenario, Mule logs a warning entry in mule_ee.log, but the warning doesn’t affect application behavior.

W-22571733

May 5, 2026

What’s New

Fixed Issues

4.11.4:4e-java17

4.11.4 Edge Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.33

This release includes security updates.

Issue Resolution ID

Mule

Configuration references to configs defined in a parent domain are now properly validated at deployment time, preventing unclear runtime errors.

W-11453332

Extension operations using @Content parameters with complex map structures no longer fail to deploy.

W-18034452

The Grizzly HTTP library is upgraded to 2.3.36-MULE-029.

W-21337433

Netty HTTP client NTLM authentication no longer fails due to missing TCP connection affinity during the handshake.

W-21615520

The plexus-utils library is upgraded to 4.0.3.

W-21774430

The HTTP listener now gracefully handles non-RFC-compliant date formats in Set-Cookie Expires attributes.

W-21860840

The Netty library is upgraded to 4.2.12.Final.

W-21913252

HTTP 304 (Not Modified) responses sent through the HTTP listener no longer include an incorrect Content-Length header.

W-21632770

Netty HTTP client no longer sends an incorrect WWW-Authenticate header during the NTLM authentication handshake.

W-21762949

In-memory Object Store partitions now correctly use cluster-wide storage when deployed to a cluster with the Object Store plugin enabled.

W-17714668

A memory leak in dynamic flow-ref resolution that could eventually lead to an OutOfMemoryError no longer occurs.

W-22013292

Deserialization errors no longer occur in Redis-backed Object Stores when accessing cached data created on an earlier Mule runtime version.

W-20880559

A serialization error that could occur when deserializing data after a Mule runtime upgrade no longer occurs.

W-21951097

API Gateway contracts for public OAuth clients using PKCE are no longer dropped when the client secret is null.

W-21177224

The support-tools-installer is removed from the Mule runtime distribution.

W-21842339

DataWeave

atBeginningOfDay now returns the midnight offset on DST days, instead of the input offset.

W-21614817

4.9.17:4-java17

4.9.17 LTS Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.33

This release includes security updates.

Issue Resolution ID

Mule

Configuration references to configs defined in a parent domain are now properly validated at deployment time, preventing unclear runtime errors.

W-11453332

Extension operations using @Content parameters with complex map structures no longer fail to deploy.

W-18034452

The Grizzly HTTP library is upgraded to 2.3.36-MULE-029.

W-21337433

The plexus-utils library is upgraded to 4.0.3.

W-21774430

HTTP 304 (Not Modified) responses sent through the HTTP listener no longer include an incorrect Content-Length header.

W-21632770

The HTTP listener now gracefully handles non-RFC-compliant date formats in Set-Cookie Expires attributes.

W-21860840

The Netty library is upgraded to 4.2.12.Final.

W-21795152

In-memory Object Store partitions now correctly use cluster-wide storage when deployed to a cluster with the Object Store plugin enabled.

W-17714668

A memory leak in dynamic flow-ref resolution that could eventually lead to an OutOfMemoryError no longer occurs.

W-22013292

Deserialization errors no longer occur in Redis-backed Object Stores when accessing cached data created on an earlier Mule runtime version.

W-20880559

API Gateway contracts for public OAuth clients using PKCE are no longer dropped when the client secret is null.

W-21177224

The support-tools-installer is removed from the Mule runtime distribution.

W-21842339

DataWeave

atBeginningOfDay now returns the midnight offset on DST days, instead of the input offset.

W-21614817

4.6.30:4-java17

4.6.30 LTS Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.33

This release includes security updates.

Issue Resolution ID

Mule

Configuration references to configs defined in a parent domain are now properly validated at deployment time, preventing unclear runtime errors.

W-11453332

Extension operations using @Content parameters with complex map structures no longer fail to deploy.

W-18034452

The Grizzly HTTP library is upgraded to 2.3.36-MULE-029.

W-21337433

The plexus-utils library is upgraded to 4.0.3.

W-21774430

A memory leak in dynamic flow-ref resolution that could eventually lead to an OutOfMemoryError no longer occurs.

W-22013292

Deserialization errors no longer occur in Redis-backed Object Stores when accessing cached data created on an earlier Mule runtime version.

W-20880559

API Gateway contracts for public OAuth clients using PKCE are no longer dropped when the client secret is null.

W-21177224

The support-tools-installer is removed from the Mule runtime distribution.

W-21842339

DataWeave

atBeginningOfDay now returns the midnight offset on DST days, instead of the input offset.

W-21614817

4.6.30:4-java8

4.6.30 LTS Runtime Updates

  • Bundled JDK version: OpenJDK "1.8.0_452"

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.33

This release includes security updates.

Issue Resolution ID

Mule

Configuration references to configs defined in a parent domain are now properly validated at deployment time, preventing unclear runtime errors.

W-11453332

Extension operations using @Content parameters with complex map structures no longer fail to deploy.

W-18034452

The Grizzly HTTP library is upgraded to 2.3.36-MULE-029.

W-21337433

The plexus-utils library is upgraded to 4.0.3.

W-21774430

A memory leak in dynamic flow-ref resolution that could eventually lead to an OutOfMemoryError no longer occurs.

W-22013292

Deserialization errors no longer occur in Redis-backed Object Stores when accessing cached data created on an earlier Mule runtime version.

W-20880559

API Gateway contracts for public OAuth clients using PKCE are no longer dropped when the client secret is null.

W-21177224

The support-tools-installer is removed from the Mule runtime distribution.

W-21842339

DataWeave

atBeginningOfDay now returns the midnight offset on DST days, instead of the input offset.

W-21614817

April 7, 2026

What’s New

Runtime Manager agent 2.7.11. See Runtime Manager Agent 2.7.11 Release Notes.

Fixed Issues

4.11.3:4e-java17

4.11.3 Edge Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.24

This release includes security updates.

Issue Resolution ID

Mule

The c3p0 library is upgraded to 0.12.0.

W-21391116

The mchange-commons-java library is upgraded to 0.4.0.

W-21391115

NullPointerException errors no longer occur in the Log4j boot configuration during application shutdown when shutdown callbacks are canceled while the Log4j context factory is disposing, which previously caused failures due to concurrent execution of dispose() and cancel().

W-20256082

Until Successful scopes no longer continue retrying during application shutdown when using flow-ref.

W-20267296

NullPointerException: No Context at location errors no longer occur when using operation policies with routers or scopes.

W-20791354

OAuth token storage now correctly uses custom ObjectStores (such as Redis) configured through the Object Store parameter when they’re registered in the application registry instead of the ObjectStoreManager.

W-19811593

Exception reached subscriber errors no longer occur when combining interceptors and operation policies.

W-21250126

Scheduler jobs no longer deadlock during flow shutdown.

W-21263748

TLS Context can now be initialized during application deployment by using the mule.enable.inline.tls.context.initialization feature flag.

W-20038933

OpenTelemetry Direct streaming now supports FIPS-compatible keystore format.

W-20623905

A warning now appears when an OpenTelemetry property is incorrectly used as a deployment property.

W-21018072

NullPointerException errors no longer occur in message processor chain alerting when reporting dropped errors or events if alerting support isn’t found for the current classloader. When alerting support isn’t available, the hooks now skip the alert and log the condition instead of invoking it on a null reference.

W-20192960

Netty no longer attempts to send more bytes than specified in the Content-Length header.

W-21184863

Netty server read timeouts now consider requests being read instead of requests being processed.

W-21321115

Netty HTTP Client no longer throws exceptions when a proxy server returns a 407 response and now returns the 407 response instead.

W-21465366

Netty response timeout behavior is now consistent with Grizzly.

W-21547186

Netty TLS connection failures now appear as DEBUG logs instead of WARN logs.

W-21428392

Netty HTTP Client now filters duplicate Content-Type headers.

W-21344116

The exception raised by Netty for unresolved addresses is now consistent with the Grizzly implementation.

W-21515340

HTTP Netty implementation performance is now improved.

W-20969515

HTTP Server no longer logs an error when a client closes an idle keep-alive connection.

W-21431822

DataWeave

The Avro library is upgraded to 1.12.1. The Jackson Core library is upgraded to 2.21.1.

W-21415439

The Jakarta Mail library is upgraded to 2.1.5.

W-21320250

The range operator now returns null for invalid ranges.

W-21781423

4.9.16:4-java17

4.9.16 LTS Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.24

This release includes security updates.

Issue Resolution ID

Mule

The c3p0 library is upgraded to 0.12.0.

W-21391116

The mchange-commons-java library is upgraded to 0.4.0.

W-21391115

The Jackson Core library is upgraded to 2.18.6.

W-21420104

NullPointerException errors no longer occur in the Log4j boot configuration during application shutdown when shutdown callbacks are canceled while the Log4j context factory is disposing, which previously caused failures due to concurrent execution of dispose() and cancel().

W-20256082

Until Successful scopes no longer continue retrying during application shutdown when using flow-ref.

W-20267296

NullPointerException: No Context at location errors no longer occur when using operation policies with routers or scopes.

W-20791354

OAuth token storage now correctly uses custom ObjectStores (such as Redis) configured through the Object Store parameter when they’re registered in the application registry instead of the ObjectStoreManager.

W-19811593

Exception reached subscriber errors no longer occur when combining interceptors and operation policies.

W-21250126

Scheduler jobs no longer deadlock during flow shutdown.

W-21263748

TLS Context can now be initialized during application deployment by using the mule.enable.inline.tls.context.initialization feature flag.

W-20038933

Netty no longer attempts to send more bytes than specified in the Content-Length header.

W-21184863

Netty server read timeouts now consider requests being read instead of requests being processed.

W-21321115

Netty HTTP Client no longer throws exceptions when a proxy server returns a 407 response and now returns the 407 response instead.

W-21465366

Netty response timeout behavior is now consistent with Grizzly.

W-21547186

Netty TLS connection failures now appear as DEBUG logs instead of WARN logs.

W-21428392

Netty HTTP Client now filters duplicate Content-Type headers.

W-21344116

The exception raised by Netty for unresolved addresses is now consistent with the Grizzly implementation.

W-21515340

DataWeave

The Avro library is upgraded to 1.12.1. The Jackson Core library is upgraded to 2.21.1.

W-21415439

The Jakarta Mail library is upgraded to 2.1.5.

W-21320250

The range operator now returns null for invalid ranges.

W-21781423

4.6.29:6-java17

4.6.29 LTS Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.24

This release includes security updates.

Issue Resolution ID

Mule

The c3p0 library is upgraded to 0.12.0.

W-21391116

The mchange-commons-java library is upgraded to 0.4.0.

W-21391115

NullPointerException errors no longer occur in the Log4j boot configuration during application shutdown when shutdown callbacks are canceled while the Log4j context factory is disposing, which previously caused failures due to concurrent execution of dispose() and cancel().

W-20256082

Until Successful scopes no longer continue retrying during application shutdown when using flow-ref.

W-20267296

NullPointerException: No Context at location errors no longer occur when using operation policies with routers or scopes.

W-20791354

OAuth token storage now correctly uses custom ObjectStores (such as Redis) configured through the Object Store parameter when they’re registered in the application registry instead of the ObjectStoreManager.

W-19811593

Exception reached subscriber errors no longer occur when combining interceptors and operation policies.

W-21250126

Scheduler jobs no longer deadlock during flow shutdown.

W-21263748

TLS Context can now be initialized during application deployment by using the mule.enable.inline.tls.context.initialization feature flag.

W-20038933

DataWeave

The Avro library is upgraded to 1.12.1. The Jackson Core library is upgraded to 2.21.1.

W-21415439

The Jakarta Mail library is upgraded to 2.1.5.

W-21320250

The range operator now returns null for invalid ranges.

W-21781423

4.6.29:6-java8

4.6.29 LTS Runtime Updates

  • Bundled JDK version: OpenJDK "1.8.0_452"

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.24

This release includes security updates.

Issue Resolution ID

Mule

The c3p0 library is upgraded to 0.12.0.

W-21391116

The mchange-commons-java library is upgraded to 0.4.0.

W-21391115

NullPointerException errors no longer occur in the Log4j boot configuration during application shutdown when shutdown callbacks are canceled while the Log4j context factory is disposing, which previously caused failures due to concurrent execution of dispose() and cancel().

W-20256082

Until Successful scopes no longer continue retrying during application shutdown when using flow-ref.

W-20267296

NullPointerException: No Context at location errors no longer occur when using operation policies with routers or scopes.

W-20791354

OAuth token storage now correctly uses custom ObjectStores (such as Redis) configured through the Object Store parameter when they’re registered in the application registry instead of the ObjectStoreManager.

W-19811593

Exception reached subscriber errors no longer occur when combining interceptors and operation policies.

W-21250126

Scheduler jobs no longer deadlock during flow shutdown.

W-21263748

TLS Context can now be initialized during application deployment by using the mule.enable.inline.tls.context.initialization feature flag.

W-20038933

DataWeave

The Avro library is upgraded to 1.12.1. The Jackson Core library is upgraded to 2.21.1.

W-21415439

The Jakarta Mail library is upgraded to 2.1.5.

W-21320250

The range operator now returns null for invalid ranges.

W-21781423

March 3, 2026

What’s New

Runtime Manager agent 2.7.10. See Runtime Manager Agent 2.7.10 Release Notes.

Fixed Issues

4.11.2:3e-java17

4.11.2 Edge Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.24

This release includes security updates.

Issue Resolution ID

Mule

When the mule.forcefulShutdown.dynamicConfig.disableStoppingCheck system property is enabled, the dynamic configuration check is disabled during graceful shutdown.

W-20890587

When the mule.forcefulShutdown.raiseCancelledError feature flag is enabled, Mule runtime now raises a MULE:CANCELLED error instead of a MULE:UNKNOWN error if it attempts to create a dynamic configuration during shutdown.

W-20890613

Extensions no longer export mule-sdk-api and jakarta dependencies in the mule-artifact.json file.

W-21001749

Client certificates (optional) are no longer requested when no trust store is configured.

W-21220031

Public flows now stop concurrently during graceful shutdown.

W-21228085

Deadlocks no longer occur during log reconfiguration when policies are applied.

W-21231834

When the mule.enableLogEventDumpOnShutdown system property is enabled, the event dump is now logged during application shutdown.

W-21232374

XSD validations are now enabled by default during deployment.

W-21139633

Errors that are not MessagingException errors are no longer silenced.

W-21043969

The reactor.netty.version library is upgraded to 1.3.2.

W-3300013

When the mule.propagate.objectStore.customization.to.policies feature flag is enabled, policies now respect their configured TTL when using Object Store v2.

W-21215761

The "java.lang.IllegalStateException: The client must be started before use." error no longer occurs when requesting an OAuth access token.

W-17689958

The "API is blocked (unavailable)" log message no longer appears during policy updates without a corresponding unblocked message.

W-20633888

APIkit flows that use non-default names and are mapped through the flow-mapping parameter on apikit:config are now correctly counted as public flows instead of being treated as private.

W-18668900

DataWeave

The Array range selector operator no longer experiences performance degradation.

W-20220578

Concurrent access to KeyValuePairs inside lazy materialized objects no longer causes unexpected behavior.

W-21045501

The Mapping Editor API now supports attributes in Anypoint Code Builder.

W-20662336

Updating the expression model in the Mapping Editor API now works correctly.

W-20611263

4.10.5:2e-java17

4.10.5 Edge Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.24

This release includes security updates.

Issue Resolution ID

Mule

When the mule.forcefulShutdown.dynamicConfig.disableStoppingCheck system property is enabled, the dynamic configuration check is disabled during graceful shutdown.

W-20890587

When the mule.forcefulShutdown.raiseCancelledError feature flag is enabled, Mule runtime now raises a MULE:CANCELLED error instead of a MULE:UNKNOWN error if it attempts to create a dynamic configuration during shutdown.

W-20890613

Extensions no longer export mule-sdk-api and jakarta dependencies in the mule-artifact.json file.

W-21001749

The "java.lang.IllegalStateException: The client must be started before use." error no longer occurs when requesting an OAuth access token.

W-17689958

The "API is blocked (unavailable)" log message no longer appears during policy updates without a corresponding unblocked message.

W-20633888

Streaming manager initialization failures no longer occur in certain scenarios.

W-20641469

APIkit flows that use non-default names and are mapped through the flow-mapping parameter on apikit:config are now correctly counted as public flows instead of being treated as private.

W-18668900

DataWeave

The Array range selector operator no longer experiences performance degradation.

W-20220578

Concurrent access to KeyValuePairs inside lazy materialized objects no longer causes unexpected behavior.

W-21045501

4.9.15:3-java17

4.9.15 LTS Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.24

This release includes security updates.

Issue Resolution ID

Mule

The jakarta.mail library is upgraded to 1.6.8.

W-21138257

When the mule.forcefulShutdown.dynamicConfig.disableStoppingCheck system property is enabled, the dynamic configuration check is disabled during graceful shutdown.

W-20890587

When the mule.forcefulShutdown.raiseCancelledError feature flag is enabled, Mule runtime now raises a MULE:CANCELLED error instead of a MULE:UNKNOWN error if it attempts to create a dynamic configuration during shutdown.

W-20890613

Extensions no longer export mule-sdk-api and jakarta dependencies in the mule-artifact.json file.

W-21001749

Client certificates (optional) are no longer requested when no trust store is configured.

W-21220031

Public flows now stop concurrently during graceful shutdown.

W-21228085

Deadlocks no longer occur during log reconfiguration when policies are applied.

W-21231834

Errors that are not MessagingException errors are no longer silenced.

W-21043969

When the mule.enableLogEventDumpOnShutdown system property is enabled, the event dump is now logged during application shutdown.

W-21232374

The "java.lang.IllegalStateException: The client must be started before use." errors no longer occur when requesting an OAuth access token.

W-17689958

When the mule.propagate.objectStore.customization.to.policies feature flag is enabled, policies now respect their configured TTL when using Object Store v2.

W-21215761

The "API is blocked (unavailable)" log message no longer appears during policy updates without a corresponding unblocked message.

W-20633888

APIkit flows that use non-default names and are mapped through the flow-mapping parameter on apikit:config are now correctly counted as public flows instead of being treated as private.

W-18668900

DataWeave

The Array range selector operator no longer experiences performance degradation.

W-20220578

Concurrent access to KeyValuePairs inside lazy materialized objects no longer causes unexpected behavior.

W-21045501

4.6.28:3-java17

4.6.28 LTS Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.24

This release includes security updates.

Issue Resolution ID

Mule

When the mule.forcefulShutdown.dynamicConfig.disableStoppingCheck system property is enabled, the dynamic configuration check is disabled during graceful shutdown.

W-20890587

When the mule.forcefulShutdown.raiseCancelledError feature flag is enabled, Mule runtime now raises a MULE:CANCELLED error instead of a MULE:UNKNOWN error if it attempts to create a dynamic configuration during shutdown.

W-20890613

Extensions no longer export mule-sdk-api and jakarta dependencies in the mule-artifact.json file.

W-21001749

Public flows now stop concurrently during graceful shutdown.

W-21228085

Deadlocks no longer occur during log reconfiguration when policies are applied.

W-21231834

When the mule.enableLogEventDumpOnShutdown system property is enabled, the event dump is now logged during application shutdown.

W-21232374

The "java.lang.IllegalStateException: The client must be started before use." error no longer occurs when requesting an OAuth access token.

W-17689958

When the mule.propagate.objectStore.customization.to.policies feature flag is enabled, policies now respect their configured TTL when using Object Store v2.

W-21215761

The tika-core library is upgraded to 3.2.3.

W-21179465

The "API is blocked (unavailable)" log message no longer appears during policy updates without a corresponding unblocked message.

W-20633888

APIkit flows that use non-default names and are mapped through the flow-mapping parameter on apikit:config are now correctly counted as public flows instead of being treated as private.

W-18668900

DataWeave

The Array range selector operator no longer experiences performance degradation.

W-20220578

Concurrent access to KeyValuePairs inside lazy materialized objects no longer causes unexpected behavior.

W-21045501

4.6.28:3-java8

4.6.28 LTS Runtime Updates

  • Bundled JDK version: OpenJDK "1.8.0_452"

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.24

This release includes security updates.

Issue Resolution ID

Mule

When the mule.forcefulShutdown.dynamicConfig.disableStoppingCheck system property is enabled, the dynamic configuration check is disabled during graceful shutdown.

W-20890587

When the mule.forcefulShutdown.raiseCancelledError feature flag is enabled, Mule runtime now raises a MULE:CANCELLED error instead of a MULE:UNKNOWN error if it attempts to create a dynamic configuration during shutdown.

W-20890613

Extensions no longer export mule-sdk-api and jakarta dependencies in the mule-artifact.json file.

W-21001749

Public flows now stop concurrently during graceful shutdown.

W-21228085

Deadlocks no longer occur during log reconfiguration when policies are applied.

W-21231834

When the mule.enableLogEventDumpOnShutdown system property is enabled, the event dump is now logged during application shutdown.

W-21232374

The "java.lang.IllegalStateException: The client must be started before use." error no longer occurs when requesting an OAuth access token.

W-17689958

When the mule.propagate.objectStore.customization.to.policies feature flag is enabled, policies now respect their configured TTL when using Object Store v2.

W-21215761

The tika-core library is upgraded to 3.2.3.

W-21179465

The "API is blocked (unavailable)" log message no longer appears during policy updates without a corresponding unblocked message.

W-20633888

APIkit flows that use non-default names and are mapped through the flow-mapping parameter on apikit:config are now correctly counted as public flows instead of being treated as private.

W-18668900

DataWeave

The Array range selector operator no longer experiences performance degradation.

W-20220578

Concurrent access to KeyValuePairs inside lazy materialized objects no longer causes unexpected behavior.

W-21045501

February 14, 2026

Fixed Issues

4.11.1:2e-java17

4.11.1 Edge Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.41

  • This patch update reverts the fixes for these Mule issues: W-20618734 and W-20628990.

4.10.4:1e-java17

4.10.4 Edge Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.41

  • This patch update reverts the fixes for these Mule issues: W-20618734 and W-20628990.

4.9.14:1e-java17

4.9.14 Edge Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.41

  • This patch update reverts the fixes for these Mule issues: W-20618734 and W-20628990.

4.9.14:1-java17

4.9.14 LTS Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.41

  • This patch update reverts the fixes for these Mule issues: W-20618734 and W-20628990.

4.6.27:1-java17

4.6.27 LTS Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.41

  • This patch update reverts the fixes for these Mule issues: W-20618734 and W-20628990.

4.6.27:1-java18

4.6.27 LTS Runtime Updates

  • Bundled JDK version: OpenJDK "1.8.0_452"

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.41

  • This patch update reverts the fixes for these Mule issues: W-20618734 and W-20628990.

February 4, 2026

What’s New

Runtime Manager agent 2.7.9. See Runtime Manager Agent 2.7.9 Release Notes.

Fixed Issues

4.11.0:10e-java17

4.11.0 Edge Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.23

This release includes security updates.

Issue Resolution ID

Mule

HTTP/2 connections now correctly multiplex when processing concurrent requests, reducing connection creation and latency.

W-19860076

The runtime now leverages the AST file for applications with the until-successful component instead of parsing configuration XML files.

W-20283146

Batch record deserialization no longer fails when a Netty exception occurs.

W-20552358

Inbound HTTP/2 header validation is now improved.

W-19873453

The org.apache.logging.log4j:log4j-core dependency is upgraded to 2.25.3.

W-20679050

DataWeave

AST scope navigation now works correctly for cross-file references when using the Tooling API.

W-20212809

A specific overload for isEmpty on binaries is now available to prevent implicit coercion to other types.

W-20049958

Materialized Java values are now cached to allow multiple executions using the same value.

W-20091279

Semantic tokens are now supported in the Tooling API.

W-19846990

NullPointerException no longer occurs when handling annotation types.

W-19853000

LogLevel documentation is now included directly in the code.

W-17800393

The commons-beanutils library is upgraded.

W-3300013

Base64 encoding and decoding now support payloads larger than memory.

W-18575719

Eager materialization is now supported on values, enabling caching of all exceptions inside the try function.

W-19717874

Avro enum, map, union, and fixed types are now supported as top-level elements.

W-19596039

WeaveCompiler now allows precompiling mappings and modules without validation or type checking.

W-19667273

Type check errors are now correctly reported when resolving type checking on subgraphs.

W-19564697

Lazy loading of source files is now enabled during binary compilation, avoiding unnecessary memory usage.

W-19594703

Type inference now works correctly when using the -- operator to subtract a key from an object.

W-19595907

Warning and error messages now propagate correctly between compilation phases.

W-19386849

Base types are now used to validate accepted values, preventing premature materialization.

W-18943395

Optional types now propagate correctly through chains of value selectors.

W-19272070

The syntax version is now added to TypeGraph and WeaveTypeResolution.

W-19271992

The classloader resource resolver now resolves paths correctly on Windows systems.

W-19407283

February 3, 2026

What’s New

Runtime Manager agent 2.7.9. See Runtime Manager Agent 2.7.9 Release Notes.

Fixed Issues

4.10.3:2e-java17

4.10.3 Edge Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.23

This release includes security updates.

Issue Resolution ID

Mule

HTTP/2 handling now correctly multiplexes connections during concurrent request processing. Previously, a failure to multiplex caused excessive connection creation and significantly increased latency.

W-19860076

Improved the validation logic for inbound HTTP/2 headers to ensure better protocol compliance and security.

W-19873453

Optimized the logging service to avoid creating unnecessary logging contexts when running a single application.

W-19965379

JDK Flight Recorder (JFR) is now disabled by default.

W-19990145

Implemented minor improvements to Mule classloading structures to enhance efficiency and stability.

W-20028988

Reduced memory consumption by removing deployment-specific objects after application deployment.

W-20053979

The Abstract Syntax Tree (AST) file of applications using the until-successful component is now leveraged by Mule runtime instead of parsing the configuration XML files.

W-20283146

Optimized the HTTP Service to avoid regenerating static attributes for every request when using Netty.

W-20615232

Thread Context Classloader (TCCL) is no longer wrongly set to the connector after an operation policy execute-next.

W-20618734

Mule application unresponsiveness no longer occurs after a policy that uses the until-successful component is undeployed or redeployed.

W-20628990

The org.apache.logging.log4j:log4j-core library is upgraded to 2.25.3.

W-20679050

The org.apache.cxf:cxf-core library is upgraded to 3.6.9.

W-20659822

The io.netty:netty-bom library is upgraded to 4.2.9.Final.

W-3300013

DataWeave

Starting in Mule runtime 4.6, you can now configure materialization settings.

W-19580992

4.9.13:2e-java17

4.9.13 Edge Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.23

This release includes security updates.

Issue Resolution ID

Mule

Optimized the logging service to avoid creating unnecessary logging contexts when running a single application.

W-19965379

JDK Flight Recorder (JFR) is now disabled by default.

W-19990145

Implemented minor improvements to Mule classloading structures to enhance efficiency and stability.

W-20028988

Reduced memory consumption by removing deployment-specific objects after application deployment.

W-20053979

The Abstract Syntax Tree (AST) file of applications using the until-successful component is now leveraged by Mule runtime instead of parsing the configuration XML files.

W-20283146

Mule application unresponsiveness no longer occurs after a policy that uses the until-successful component is undeployed or redeployed.

W-20628990

Optimized the HTTP Service to avoid regenerating static attributes for every request when using Netty.

W-20615232

The io.netty:netty-bom library is upgraded to 4.2.9.Final.

W-3300013

The org.apache.logging.log4j:log4j-core library is upgraded to 2.25.3.

W-20679050

Fastutil is now replaced with fastutil-core.

W-20729870

DataWeave

Starting in Mule runtime 4.6, you can now configure materialization settings.

W-19580992

4.9.13:2-java17

4.9.13 LTS Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.23

This release includes security updates.

Issue Resolution ID

Mule

Optimized the logging service to avoid creating unnecessary logging contexts when running a single application.

W-19965379

JDK Flight Recorder (JFR) is now disabled by default.

W-19990145

Implemented minor improvements to Mule classloading structures to enhance efficiency and stability.

W-20028988

Reduced memory consumption by removing deployment-specific objects after application deployment.

W-20053979

The Abstract Syntax Tree (AST) file of applications using the until-successful component is now leveraged by Mule runtime instead of parsing the configuration XML files.

W-20283146

Mule application unresponsiveness no longer occurs after a policy that uses the until-successful component is undeployed or redeployed.

W-20628990

Optimized the HTTP Service to avoid regenerating static attributes for every request when using Netty.

W-20615232

The io.netty:netty-bom library is upgraded to 4.2.9.Final.

W-3300013

The org.apache.logging.log4j:log4j-core library is upgraded to 2.25.3.

W-20679050

Fastutil is now replaced with fastutil-core.

W-20729870

DataWeave

Starting in Mule runtime 4.6, you can now configure materialization settings.

W-19580992

4.6.26:2-java17

4.6.26 LTS Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.23

This release includes security updates.

Issue Resolution ID

Mule

JDK Flight Recorder (JFR) is now disabled by default.

W-19990145

The Abstract Syntax Tree (AST) file of applications using the until-successful component is now leveraged by Mule runtime instead of parsing the configuration XML files.

W-20283146

Mule application unresponsiveness no longer occurs after a policy that uses the until-successful component is undeployed or redeployed.

W-20628990

Implemented minor improvements to Mule classloading structures to enhance efficiency and stability.

W-20028988

Thread Context Classloader (TCCL) is no longer wrongly set to the connector after an operation policy execute-next.

W-20618734

Fastutil is now replaced with fastutil-core.

W-20729870

4.6.26:2-java8

4.6.26 LTS Runtime Updates

  • Bundled JDK version: OpenJDK "1.8.0_452"

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.23

This release includes security updates.

Issue Resolution ID

Mule

JDK Flight Recorder (JFR) is now disabled by default.

W-19990145

The Abstract Syntax Tree (AST) file of applications using the until-successful component is now leveraged by Mule runtime instead of parsing the configuration XML files.

W-20283146

Mule application unresponsiveness no longer occurs after a policy that uses the until-successful component is undeployed or redeployed.

W-20628990

Implemented minor improvements to Mule classloading structures to enhance efficiency and stability.

W-20028988

Thread Context Classloader (TCCL) is no longer wrongly set to the connector after an operation policy execute-next.

W-20618734

Fastutil is now replaced with fastutil-core.

W-20729870

January 6, 2026

What’s New

Runtime Manager agent 2.7.9. See Runtime Manager Agent 2.7.9 Release Notes.

Fixed Issues

4.10.2:5e-java17

4.10.2 Edge Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.19

This release includes security updates.

Issue Resolution ID

Mule

Batch jobs no longer hang when errors occur in steps that use try scopes with global error handlers.

W-17738563

Applications no longer become unresponsive after thread pool exhaustion when using Netty as the HTTP Service implementation with the Anypoint MQ Connector.

W-19806707

Design-time operations on primary content parameters with non-Java types now work correctly.

W-20187776

Logging information is now improved during graceful shutdown.

W-20278970

A deadlock between Log4j Mule log support during application initialization no longer occurs.

W-20419795

The HTTP Client can now establish an SSE source when the content-type header doesn’t exactly match text/event-stream.

W-20420476

MUnit tests no longer fail intermittently when running on Java 17.

W-17044721

Batch processing not longer fails with serialization error when LDAP action throws an error in Java 17.

W-19524600

Dynamic configurations now work correctly during initialization when using hashCode and equals methods on a TLSConfiguration class.

W-18835469

A memory leak after application undeployment no longer occurs when using connections from configurations defined in a domain.

W-13521171

Connections now close properly on the server side after an HTTP/2 client disconnects.

W-19861068

The JMS connector no longer closes XA-enlisted connections.

W-20266983

Connections from providers that implement both CachedConnectionProvider and XaTransactionalConnectionProvider are no longer cached if the provided connection is XA.

W-20267068

The alert context in the DIAF file is now reset after the configured time interval expires.

W-20140036

The HTTP Server now returns a 400 error when the HTTP/1 to HTTP/2 upgrade mechanism receives an invalid HTTP2-Settings header.

W-19895731

ERROR StatusLogger Attempted to append to non-started appender AnypointMonitoringFileAppender errors no longer occur when Anypoint Monitoring is enabled.

W-15577414

DataWeave

Functions now materialize correctly when the function body contains a single var declaration.

W-20365331

The stream reader now processes input with multi-byte characters correctly.

W-20016549

The Apache Commons Lang library included in the distribution is upgraded.

W-20004786

DataWeave grammar transformation performance is improved.

W-19840284

Memory usage is improved for binary compilation and AST-related utilities.

W-19706956

4.9.12:5e-java17

4.9.12 Edge Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.19

This release includes security updates.

Issue Resolution ID

Mule

Batch jobs no longer hang when errors occur in steps that use try scopes with global error handlers.

W-17738563

Applications no longer become unresponsive after thread pool exhaustion when using Netty as the HTTP Service implementation with the Anypoint MQ Connector.

W-19806707

Design-time operations on primary content parameters with non-Java types now work correctly.

W-20187776

Logging information is now improved during graceful shutdown.

W-20278970

A deadlock between Log4j Mule log support during application initialization no longer occurs.

W-20419795

The HTTP Client can now establish an SSE source when the content-type header doesn’t exactly match text/event-stream.

W-20420476

MUnit tests no longer fail intermittently when running on Java 17.

W-17044721

Batch processing no longer fails with serialization error when LDAP action throws an error in Java 17.

W-19524600

Dynamic configurations now work correctly during initialization when using hashCode and equals methods on a TLSConfiguration class.

W-18835469

ERROR StatusLogger Attempted to append to non-started appender AnypointMonitoringFileAppender errors no longer occur when Anypoint Monitoring is enabled.

W-15577414

DataWeave

Functions now materialize correctly when the function body contains a single var declaration.

W-20365331

The stream reader now processes input with multi-byte characters correctly.

W-20016549

4.9.12:5-java17

4.9.12 LTS Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.19

This release includes security updates.

Issue Resolution ID

Mule

Batch jobs no longer hang when errors occur in steps that use try scopes with global error handlers.

W-17738563

Applications no longer become unresponsive after thread pool exhaustion when using Netty as the HTTP Service implementation with the Anypoint MQ Connector.

W-19806707

Design-time operations on primary content parameters with non-Java types now work correctly.

W-20187776

Logging information is now improved during graceful shutdown.

W-20278970

A deadlock between Log4j Mule log support during application initialization no longer occurs.

W-20419795

The HTTP Client can now establish an SSE source when the content-type header doesn’t exactly match text/event-stream.

W-20420476

MUnit tests no longer fail intermittently when running on Java 17.

W-17044721

Batch processing no longer fails with serialization error when LDAP action throws an error in Java 17.

W-19524600

Dynamic configurations now work correctly during initialization when using hashCode and equals methods on a TLSConfiguration class.

W-18835469

ERROR StatusLogger Attempted to append to non-started appender AnypointMonitoringFileAppender errors no longer occur when Anypoint Monitoring is enabled.

W-15577414

DataWeave

Functions now materialize correctly when the function body contains a single var declaration.

W-20365331

The stream reader now processes input with multi-byte characters correctly.

W-20016549

4.6.25:5-java17

4.6.25 LTS Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.19

This release includes security updates.

Issue Resolution ID

Mule

Batch jobs no longer hang when errors occur in steps that use try scopes with global error handlers.

W-17738563

Design-time operations on primary content parameters with non-Java types now work correctly.

W-20187776

Logging information is now improved during graceful shutdown.

W-20278970

A deadlock between Log4j Mule log support during application initialization no longer occurs.

W-20419795

MUnit tests no longer fail intermittently when running on Java 17.

W-17044721

Batch processing no longer fails with serialization error when LDAP action throws an error in Java 17.

W-19524600

Dynamic configurations now work correctly during initialization when using hashCode and equals methods on a TLSConfiguration class.

W-18835469

DataWeave

The stream reader now processes input with multi-byte characters correctly.

W-20016549

The org.apache.commons:commons-text library is upgraded to 1.14.0.

W-20618375

4.6.25:5-java8

4.6.25 LTS Runtime Updates

  • Bundled JDK version: OpenJDK "1.8.0_452"

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.19

This release includes security updates.

Issue Resolution ID

Mule

Batch jobs no longer hang when errors occur in steps that use try scopes with global error handlers.

W-17738563

Design-time operations on primary content parameters with non-Java types now work correctly.

W-20187776

Logging information is now improved during graceful shutdown.

W-20278970

A deadlock between Log4j Mule log support during application initialization no longer occurs.

W-20419795

MUnit tests no longer fail intermittently when running on Java 17.

W-17044721

Batch processing no longer fails with serialization error when LDAP action throws an error in Java 17.

W-19524600

Dynamic configurations now work correctly during initialization when using hashCode and equals methods on a TLSConfiguration class.

W-18835469

DataWeave

The stream reader now processes input with multi-byte characters correctly.

W-20016549

The org.apache.commons:commons-text library is upgraded to 1.14.0.

W-20618375

November 7, 2025

The November 7 patch update 4.10.1:12e-java17, 4.9.11:6e-java17, 4.9.11:6-java17, 4.6.24:7-java17, 4.6.24:7-java8, and 4.4.0:20250919-6 address a regression in the previous November 4 patch update and includes the fixes in those patches.

4.10.1:12e-java17

4.10.1 Edge Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.19

This release includes security updates.

Issue Resolution ID

Mule

The diagnostic file now generates correctly.

W-20139801

Readiness and liveness probes now use HTTP GET checks instead of command-based checks, improving reliability.

W-19853421

4.9.11:6e-java17

4.9.11 Edge Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.19

This release includes security updates.

Issue Resolution ID

Mule

The diagnostic file now generates correctly.

W-20139801

Readiness and liveness probes now use HTTP GET checks instead of command-based checks, improving reliability.

W-19853421

4.9.11:6-java17

4.9.11 LTS Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.19

This release includes security updates.

Issue Resolution ID

Mule

The diagnostic file now generates correctly.

W-20139801

Readiness and liveness probes now use HTTP GET checks instead of command-based checks, improving reliability.

W-19853421

4.6.24:7-java17

4.6.24 LTS Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.19

This release includes security updates.

Issue Resolution ID

Mule

The diagnostic file now generates correctly.

W-20139801

Readiness and liveness probes now use HTTP GET checks instead of command-based checks, improving reliability.

W-19853421

4.6.24:7-java8

4.6.24 LTS Runtime Updates

  • Bundled JDK version: OpenJDK "1.8.0_452"

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.19

This release includes security updates.

Issue Resolution ID

Mule

Readiness and liveness probes now use HTTP GET checks instead of command-based checks, improving reliability.

W-19853421

4.4.0:20250919-6

4.4.0 Runtime Updates

  • Bundled JDK version: OpenJDK "1.8.0_452"

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.15

This release includes security updates.

Issue Resolution ID

Mule

Readiness and liveness probes now use HTTP GET checks instead of command-based checks, improving reliability.

W-19853421

November 4, 2025

What’s New

Runtime Manager agent 2.7.8. See Runtime Manager Agent 2.7.8 Release Notes.

Fixed Issues

4.10.1:10e-java17

4.10.1 Edge Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.19

This release includes security updates.

Issue Resolution ID

Mule

OpenTelemetry current API sampling decisions now propagate correctly through http:requester calls to downstream APIs.

W-19784910

UndeclaredThrowableException errors no longer occur during Bitronix reconnection.

W-15196888

InaccessibleObjectException errors no longer occur during deployment when the mule.classloading.verbose property is set.

W-18563387

MDC information is now properly preserved when using loggers inside custom Java code invoked from a DataWeave script.

W-18912999

Batch queuestore files now clean up correctly in rare load failure scenarios such as out-of-memory errors.

W-17935223

Builds no longer fail when running tests from an extension that uses Mule SDK with Java 8 through Java 17.

W-18964335

The until-successful scope now honors the graceful shutdown timeout. To enable this behavior, set these system properties: mule.untilSuccessful.retryOnCriticalError.disallow=true and mule.forcefulShutdown.raiseCancelledError=true.

W-19648397

Hashing now uses toHex conversion to prevent “null character” or other invalid characters from being used as IDs in the redelivery policy. This change is feature-flagged. To enable it in version 4.10, set the mule.redeliveryPolicy.encode.secureHash system property to true.

W-18584560

IllegalAccessException errors no longer occur when DataWeave serializes error.errorMessage in a Scatter-Gather error route.

W-19340663

Mule applications that use TLS KeyStore configurations no longer fail to deploy with “NO MODEL RESOLVED” warnings and ConfigurationException errors.

W-16565012

Mule Troubleshooting Plugin executions no longer fail when the IP address changes.

W-19802474

The reactor.netty library is upgraded to 1.2.10.

W-17264514

The netty library is upgraded to 4.1.127.Final.

W-19995637

The spring-core library is upgraded to 6.2.11.

W-19674953

The Bump handlebars library is upgraded to 4.4.0.

W-1906465

The HTTP listener now correctly populates attributes.queryParams when using HTTP/2.

W-19802358

close_notify events sent by a server are now properly handled by the HTTP/2 client.

W-19973575

DataWeave

Materialization errors no longer occur in run function.

W-19884071

The org.apache.commons:commons-lang3 library is upgraded to 3.18.

W-19803454

Single variable materialization now works correctly for unsafe and exists selectors.

W-19581017

The SnakeYAML library is upgraded.

W-19749213

Each variable is now extracted from vars to manage materialization individually.

W-19580992

The -- operator now returns the correct type without the subtracted keys.

W-19595907

Debug logging is now enabled for DefaultLoggingService.

W-19650046

The take function no longer fails in streaming mode when n is larger than the array length.

W-19168279

The Java Module now supports object field access with different capitalizations.

W-19477334

The Runtime Compiler now uses the Parser Manager to look for resources provided as parameters.

W-19376888

A null check is now performed before closing the InputStream.

W-19395982

Parsing metrics printing now includes a missing line ending.

W-19440583

Constants are now used to prevent incorrect loader identifiers for binary compiled scripts.

W-18455133

Generated POM files now include license information.

W-19439330

SchemaProvider resolution on Types is improved to prevent Execution reference leaks.

W-19389019

The classloader weave resource resolver now uses the correct path in Windows environments.

W-19407283

4.9.11:4e-java17

4.9.11 Edge Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.19

This release includes security updates.

Issue Resolution ID

Mule

OpenTelemetry current API sampling decisions now propagate correctly through http:requester calls to downstream APIs.

W-19784910

UndeclaredThrowableException errors no longer occur during Bitronix reconnection.

W-15196888

InaccessibleObjectException errors no longer occur during deployment when the mule.classloading.verbose property is set.

W-18563387

MDC information is now properly preserved when using loggers inside custom Java code invoked from a DataWeave script.

W-18912999

Batch queuestore files now clean up correctly in rare load failure scenarios such as out-of-memory errors.

W-17935223

Builds no longer fail when running tests from an extension that uses Mule SDK with Java 8 through Java 17.

W-18964335

Starvation no longer occurs when sending HTTP responses that are generated slowly.

W-1982570

The until-successful scope now honors the graceful shutdown timeout. To enable this behavior, set these system properties: mule.untilSuccessful.retryOnCriticalError.disallow=true and mule.forcefulShutdown.raiseCancelledError=true.

W-19648397

Hashing now uses toHex conversion to prevent “null character” or other invalid characters from being used as IDs in the redelivery policy. This change is feature-flagged. To enable it in version 4.9, set the mule.redeliveryPolicy.encode.secureHash system property to true.

W-18584560

IllegalAccessException errors no longer occur when DataWeave serializes error.errorMessage in a Scatter-Gather error route.

W-19340663

Mule applications that use TLS KeyStore configurations no longer fail to deploy with “NO MODEL RESOLVED” warnings and ConfigurationException errors.

W-16565012

Mule Troubleshooting Plugin executions no longer fail when the IP address changes.

W-19802474

SSE clients can now parse events that do not include an event field. These events now default to message, as described in the specification.

W-19667148

The reactor.netty library is upgraded to 1.2.10.

W-17264514

The netty library is upgraded to 4.2.7.Final.

W-19995637

The spring-core library is upgraded to 6.2.11.

W-19674953

DataWeave

The Apache Commons Lang dependency is removed from the distribution.

W-19803454

Materialization errors no longer occur when running functions.

W-19884071

Single variable materialization now works correctly for unsafe and exists selectors.

W-19581017

Each variable is now extracted from vars to manage materialization individually.

W-19580992

4.9.11:4-java17

4.9.11 LTS Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.19

This release includes security updates.

Issue Resolution ID

Mule

OpenTelemetry current API sampling decisions now propagate correctly through http:requester calls to downstream APIs.

W-19784910

UndeclaredThrowableException errors no longer occur during Bitronix reconnection.

W-15196888

InaccessibleObjectException errors no longer occur during deployment when the mule.classloading.verbose property is set.

W-18563387

MDC information is now properly preserved when using loggers inside custom Java code invoked from a DataWeave script.

W-18912999

Batch queuestore files now clean up correctly in rare load failure scenarios such as out-of-memory errors.

W-17935223

Builds no longer fail when running tests from an extension that uses Mule SDK with Java 8 through Java 17.

W-18964335

Starvation no longer occurs when sending HTTP responses that are generated slowly.

W-1982570

The until-successful scope now honors the graceful shutdown timeout. To enable this behavior, set these system properties: mule.untilSuccessful.retryOnCriticalError.disallow=true and mule.forcefulShutdown.raiseCancelledError=true.

W-19648397

Hashing now uses toHex conversion to prevent “null character” or other invalid characters from being used as IDs in the redelivery policy. This change is feature-flagged. To enable it in version 4.9, set the mule.redeliveryPolicy.encode.secureHash system property to true.

W-18584560

IllegalAccessException errors no longer occur when DataWeave serializes error.errorMessage in a Scatter-Gather error route.

W-19340663

Mule applications that use TLS KeyStore configurations no longer fail to deploy with “NO MODEL RESOLVED” warnings and ConfigurationException errors.

W-16565012

Mule Troubleshooting Plugin executions no longer fail when the IP address changes.

W-19802474

SSE clients can now parse events that do not include an event field. These events now default to message, as described in the specification.

W-19667148

The reactor.netty library is upgraded to 1.2.10.

W-17264514

The netty library is upgraded to 4.2.7.Final.

W-19995637

The spring-core library is upgraded to 6.2.11.

W-19674953

DataWeave

The Apache Commons Lang dependency is removed from the distribution.

W-19803454

Materialization errors no longer occur when running functions.

W-19884071

Single variable materialization now works correctly for unsafe and exists selectors.

W-19581017

Each variable is now extracted from vars to manage materialization individually.

W-19580992

4.6.24:4-java17

4.6.24 LTS Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.19

This release includes security updates.

Issue Resolution ID

Mule

OpenTelemetry current API sampling decisions now propagate correctly through http:requester calls to downstream APIs.

W-19784910

UndeclaredThrowableException errors no longer occur during Bitronix reconnection.

W-15196888

InaccessibleObjectException errors no longer occur during deployment when the mule.classloading.verbose property is set.

W-18563387

MDC information is now properly preserved when using loggers inside custom Java code invoked from a DataWeave script.

W-18912999

Batch queuestore files now clean up correctly in rare load failure scenarios such as out-of-memory errors.

W-17935223

Builds no longer fail when running tests from an extension that uses Mule SDK with Java 8 through Java 17.

W-18964335

The until-successful scope now properly honors the graceful shutdown timeout. In versions earlier than 4.11.0, you must enable this behavior using these system properties: mule.untilSuccessful.retryOnCriticalError.disallow=true and mule.forcefulShutdown.raiseCancelledError=true.

W-19340663

Hashing now uses toHex conversion to prevent “null character” or other invalid characters from being used as IDs in the redelivery policy. This change is feature-flagged. To enable it in version 4.6, set the mule.redeliveryPolicy.encode.secureHash system property to true.

W-18584560

IllegalAccessException no longer thrown when DW serializes error.errorMessage in Scatter-Gather error route.

W-19340663

Mule applications that use TLS KeyStore configurations no longer fail to deploy with “NO MODEL RESOLVED” warnings and ConfigurationException errors.

W-16565012

Mule Troubleshooting Plugin executions no longer fail when the IP address changes.

W-19802474

DataWeave

The Apache Commons Lang dependency is removed from the distribution.

W-19803454

Materialization errors no longer occur when running functions.

W-19884071

4.6.24:4-java8

4.6.24 LTS Runtime Updates

  • Bundled JDK version: OpenJDK "1.8.0_452"

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.19

This release includes security updates.

Issue Resolution ID

Mule

OpenTelemetry current API sampling decisions now propagate correctly through http:requester calls to downstream APIs.

W-19784910

UndeclaredThrowableException errors no longer occur during Bitronix reconnection.

W-15196888

InaccessibleObjectException errors no longer occur during deployment when the mule.classloading.verbose property is set.

W-18563387

MDC information is now properly preserved when using loggers inside custom Java code invoked from a DataWeave script.

W-18912999

Batch queuestore files now clean up correctly in rare load failure scenarios such as out-of-memory errors.

W-17935223

Builds no longer fail when running tests from an extension that uses Mule SDK with Java 8 through Java 17.

W-18964335

The until-successful scope now properly honors the graceful shutdown timeout. In versions earlier than 4.11.0, you must enable this behavior using these system properties: mule.untilSuccessful.retryOnCriticalError.disallow=true and mule.forcefulShutdown.raiseCancelledError=true.

W-19340663

Hashing now uses toHex conversion to prevent “null character” or other invalid characters from being used as IDs in the redelivery policy. This change is feature-flagged. To enable it in version 4.6, set the mule.redeliveryPolicy.encode.secureHash system property to true.

W-18584560

IllegalAccessException no longer thrown when DW serializes error.errorMessage in Scatter-Gather error route.

W-19340663

Mule applications that use TLS KeyStore configurations no longer fail to deploy with “NO MODEL RESOLVED” warnings and ConfigurationException errors.

W-16565012

Mule Troubleshooting Plugin executions no longer fail when the IP address changes.

W-19802474

DataWeave

The Apache Commons Lang dependency is removed from the distribution.

W-19803454

Materialization errors no longer occur when running functions.

W-19884071

4.4.0:20250919-5

4.4.0 Runtime Updates

  • Bundled JDK version: OpenJDK "1.8.0_452"

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.15

  • The operating system is updated to the latest security patches.

October 2, 2025

What’s New

Runtime Manager agent 2.7.7. See Runtime Manager Agent 2.7.7 Release Notes.

Fixed Issues

4.10.0:23e-java17

4.10.0 Edge Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.15

This release includes security updates.

Issue Resolution ID

Mule

The org.quartz-scheduler:quartz library is upgraded to 2.5.0.

W-17406808

The org.vibur:vibur-object-pool library is upgraded to 26.

W-17570586

The commons-beanutils:commons-beanutils library is upgraded to 1.10.0.

W-17571116

The jakarta-annotation library is upgraded to 2.1.1.

W-17927646

The Mockito monorepo is upgraded to 5.

W-18685961

The Log4j2 monorepo is upgraded to 2.25.1.

W-18834079

The Netty library is upgraded to 4.1.127.Final.

W-19559645

The Rhino library is upgraded to 1.8.0.

W-17636627

The org.springframework : spring-core library is upgraded to 6.2.10.

W-19353311

The org.apache.cxf:cxf-core library is now upgraded to 3.5.11.

W-17264514

Memory leaks no longer occur when a reconnection is configured in a Mule domain and referenced from multiple applications.

W-17857080

InaccessibleObjectException errors no longer occur when using cluster mode on Java 17.

W-18667744

Fork-join routers no longer create unnecessary schedules when the timeout is set to infinite.

W-18347293

Potential deadlocks during deployment no longer occur when using some custom Log4j appenders.

W-19675881

Cookies now propagate correctly across multiple redirect scenarios.

W-18971065

The Netty library is upgraded to 4.1.124.Final.

W-19341592

The org.mule.runtime.api.serialization.SerializationException: Could not deserialize object errors no longer occur when processing the payload of a Query XML stream using transfer message in a Choice Router.

W-18902280

SSE clients now parse events that don’t include an event field. They default to message as described in the spec.

W-19667148

Possible starvation no longer occurs when sending HTTP responses that are generated slowly.

W-19471841

Gatekeeper deadlock errors no longer occur during race conditions among contract downloads and policy application.

W-19407164

DataWeave

The take function now works with streaming when argument is larger than the array length.

W-19168279

java-module now supports object fields access when using different capitalizations.

W-19477334

4.9.10:4e-java17

4.9.10 Edge Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.15

This release includes security updates.

Issue Resolution ID

Mule

Memory leaks no longer occur when a reconnection is configured in a Mule domain and referenced from multiple applications.

W-17857080

InaccessibleObjectException errors no longer occur when using cluster mode on Java 17.

W-18667744

Fork-join routers no longer create unnecessary schedules when the timeout is set to infinite.

W-18347293

Potential deadlocks during deployment no longer occur when using some custom Log4j appenders.

W-19675881

Cookies now propagate correctly across multiple redirect scenarios.

W-18971065

The Netty library is upgraded to 4.1.124.Final.

W-19341592

The Handlebars library is upgraded to 4.4.0.

W-19064659

The org.apache.commons : commons-lang3 library is upgraded to 3.17.0.

W-19383955

The io.netty : netty-codec library is upgraded to 4.1.127.Final.

W-19568278

The org.springframework : spring-core library is upgraded to 6.2.10.

W-19353311

The org.apache.cxf:cxf-core library is now upgraded to 3.5.11.

W-17264514

The org.mule.runtime.api.serialization.SerializationException: Could not deserialize object errors no longer occur when processing the payload of a Query XML stream using transfer message in a Choice Router.

W-18902280

Scheduler name generation no longer breaks the platform logging aggregator when processor chains have null or empty names.

W-19432758

SSE clients now parse events that don’t include an event field. They default to message as described in the spec.

W-19667148

Possible starvation no longer occurs when sending HTTP responses that are generated slowly.

W-19471841

Gatekeeper deadlock errors no longer occur during race conditions between contract downloads and policy application.

W-19407164

DataWeave

The take function now works with streaming when argument is larger than the array length.

W-19168279

java-module now supports object fields access when using different capitalizations.

W-19477334

4.9.10:4-java17

4.9.10 LTS Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.15

This release includes security updates.

Issue Resolution ID

Mule

Memory leaks no longer occur when a reconnection is configured in a Mule domain and referenced from multiple applications.

W-17857080

InaccessibleObjectException errors no longer occur when using cluster mode on Java 17.

W-18667744

Fork-join routers no longer create unnecessary schedules when the timeout is set to infinite.

W-18347293

Potential deadlocks during deployment no longer occur when using some custom Log4j appenders.

W-19675881

Cookies now propagate correctly across multiple redirect scenarios.

W-18971065

The Netty library is upgraded to 4.1.124.Final.

W-19341592

The Handlebars library is upgraded to 4.4.0.

W-19064659

The org.apache.commons : commons-lang3 library is upgraded to 3.17.0.

W-19383955

The io.netty : netty-codec library is upgraded to 4.1.127.Final.

W-19568278

The org.springframework : spring-core library is upgraded to 6.2.10.

W-19353311

The org.apache.cxf:cxf-core library is now upgraded to 3.5.11.

W-17264514

The org.mule.runtime.api.serialization.SerializationException: Could not deserialize object errors no longer occur when processing the payload of a Query XML stream using transfer message in a Choice Router.

W-18902280

Scheduler name generation no longer breaks the platform logging aggregator when processor chains have null or empty names.

W-19432758

SSE clients now parse events that don’t include an event field. They default to message as described in the spec.

W-19667148

Possible starvation no longer occurs when sending HTTP responses that are generated slowly.

W-19471841

Gatekeeper deadlock errors no longer occur during race conditions between contract downloads and policy application.

W-19407164

DataWeave

The take function now works with streaming when argument is larger than the array length.

W-19168279

java-module now supports object fields access when using different capitalizations.

W-19477334

4.6.23:4-java17

4.6.23 LTS Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.15

This release includes security updates.

Issue Resolution ID

Mule

The org.springframework library is upgraded to 5.3.45.

W-18603096

Memory leaks no longer occur when a reconnection is configured in a Mule domain and referenced from multiple applications.

W-17857080

InaccessibleObjectException errors no longer occur when using cluster mode on Java 17.

W-18667744

Fork-join routers no longer create unnecessary schedules when the timeout is set to infinite.

W-18347293

Potential deadlocks during deployment no longer occur when using some custom Log4j appenders.

W-19675881

This release reverts the changes introduced in W-17340911.

W-17340911

Cookies now propagate correctly across multiple redirect scenarios.

W-18971065

Batch queuestore files now clean up correctly in rare load failure scenarios, such as out of memory errors.

W-17935223

Gatekeeper deadlock errors no longer occur during race conditions among contract downloads and policy application.

W-19407164

DataWeave

The take function now works with streaming when argument is larger than the array length.

W-19168279

java-module now supports object fields access when using different capitalizations.

W-19477334

Module compilation performance is improved when running concurrently.

W-19376546

4.6.23:4-java8

4.6.23 LTS Runtime Updates

  • Bundled JDK version: OpenJDK "1.8.0_452"

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.15

This release includes security updates.

Issue Resolution ID

Mule

The org.springframework library is upgraded to 5.3.45.

W-18603096

Memory leaks no longer occur when a reconnection is configured in a Mule domain and referenced from multiple applications.

W-17857080

InaccessibleObjectException errors no longer occur when using cluster mode on Java 17.

W-18667744

Fork-join routers no longer create unnecessary schedules when the timeout is set to infinite.

W-18347293

Potential deadlocks during deployment no longer occur when using some custom Log4j appenders.

W-19675881

This release reverts the changes introduced in W-17340911.

W-17340911

Cookies now propagate correctly across multiple redirect scenarios.

W-18971065

Batch queuestore files now clean up correctly in rare load failure scenarios, such as out of memory errors.

W-17935223

Gatekeeper deadlock errors no longer occur during race conditions among contract downloads and policy application.

W-19407164

DataWeave

The take function now works with streaming when argument is larger than the array length.

W-19168279

java-module now supports object fields access when using different capitalizations.

W-19477334

Module compilation performance is improved when running concurrently.

W-19376546

4.4.0:20250919-3

4.4.0 Runtime Updates

  • Bundled JDK version: OpenJDK "1.8.0_452"

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.15

This release includes security updates.

Issue Resolution ID

Mule

BufferOverFlowException errors no longer occur when inter-node communication gets stuck in clusters with encryption under heavy load.

W-16517561

Gatekeeper deadlock errors no longer occur during race conditions between contract downloads and policy application.

W-19407164

September 2, 2025

What’s New

Runtime Manager agent 2.7.7. See Runtime Manager Agent 2.7.7 Release Notes.

Fixed Issues

4.9.9:5e-java17

4.9.9 Edge Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.15

This release includes security updates.

Issue Resolution ID

Mule

TLS configuration for FIPS-140-2 is now upgraded.

W-16315176

Applications using Scheduler component in a strict FIPS-140-2 environment no longer fail to deploy due to the unavailability of the MD5 algorithm.

W-19319437

io.projectreactor.netty : reactor-netty-http is upgraded to 1.2.8.

W-19074903

Component annotations, such as location, are no longer overwritten by other components.

W-18269859

org.apache.commons : commons-lang3 is upgraded to 3.18.0.

W-19059553

DataWeave

A memory leak during Weave type schema resolution is now fixed.

W-19389019

Potential deadlocks no longer occur when increasing concurrency while parsing DataWeave scripts.

W-19376546

4.9.9:5-java17

4.9.9 LTS Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.15

This release includes security updates.

Issue Resolution ID

Mule

TLS configuration for FIPS-140-2 is now upgraded.

W-16315176

Applications using Scheduler component in a strict FIPS-140-2 environment no longer fail to deploy due to the unavailability of the MD5 algorithm.

W-19319437

io.projectreactor.netty : reactor-netty-http is upgraded to 1.2.8.

W-19074903

Component annotations, such as location, are no longer overwritten by other components.

W-18269859

org.apache.commons : commons-lang3 is upgraded to 3.18.0.

W-19059553

DataWeave

A memory leak during Weave type schema resolution is now fixed.

W-19389019

Potential deadlocks no longer occur when increasing concurrency while parsing DataWeave scripts.

W-19376546

4.6.22:4-java17

4.6.22 LTS Runtime Updates

  • Bundled JDK version: OpenJDK version 17.0.15+6

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.15

This release includes security updates.

Issue Resolution ID

Mule

TLS configuration for FIPS-140-2 is now upgraded.

W-16315176

Applications using Scheduler component in a strict FIPS-140-2 environment no longer fail to deploy due to the unavailability of the MD5 algorithm.

W-19319437

OAuth token is now refreshed when used through ExtensionClient.

W-19248279

4.6.22:4-java8

4.6.22 LTS Runtime Updates

  • Bundled JDK version: OpenJDK "1.8.0_452"

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.15

This release includes security updates.

Issue Resolution ID

Mule

TLS configuration for FIPS-140-2 is now upgraded.

W-16315176

Applications using Scheduler component in a strict FIPS-140-2 environment no longer fail to deploy due to the unavailability of the MD5 algorithm.

W-19319437

OAuth token is now refreshed when used through ExtensionClient.

W-19248279

4.4.0:20250829-1

4.4.0 Runtime Updates

  • Bundled JDK version: OpenJDK "1.8.0_452"

  • Sidecar version: mulesoft/dias-anypoint-monitoring-sidecar:2.2.15

This release includes security updates.

Issue Resolution ID

Mule

Performance degradation no longer occurs when using repeatable streaming.

W-19175330