v1.11.0-beta.1

FEATURES:

• Client Identity: Nomad clients use identities for authenticating and authorizing itself when performing RPC calls. The identities are generated and rotated automatically by Nomad servers with configurable TTLs. [GH-26291]
• Client Introduction: Nomad clients can now be introduced to the cluster using a token-based approach. Nomad servers can be configured with introduction enforcement levels which dictate how clients can join the cluster resulting in logs and metrics to detail introduction violations. [GH-26430]
• Job Specification Secrets Block: Adds secret block for fetching and interpolating secrets in job spec [GH-26681]
• System Job Deployments: Enable deployments for system jobs [GH-26708]

BREAKING CHANGES:

• metrics: Eval broker metrics that previously used the job ID as a label will now use the parent ID of dispatch and periodic jobs [GH-26737]
• sysbatch: Submitting a sysbatch job with a reschedule block will now return an error instead of being silently ignored [GH-26279]

SECURITY:

• build: Update toolchain to Go 1.25.2 to address Go stdlib CVE-2025-61724, CVE-2025-61725, CVE-2025-58187, CVE-2025-61723, CVE-2025-47912, CVE-2025-58185, CVE-2025-58186, CVE-2025-58188, and CVE-2025-58183 [GH-26909]

IMPROVEMENTS:

• api: The Evaluations.Info method of the Go API now populates the RelatedEvals field. [GH-26156]
• build: Add tzdata to Docker container final image [GH-26794]
• build: Updated Go to 1.25.1 [GH-26823]
• cli: Add -preserve-resources flag for keeping resource block when updating jobs [GH-26841]
• cli: Added related evals and placed allocations tables to the eval status command, and exposed more fields without requiring the -verbose flag. [GH-26156]
• config: Added job_max_count option to limit number of allocs for a single job [GH-26858]
• consul connect: Allow cni/* network mode; use at your own risk [GH-26449]
• install (Enterprise): Updated license information displayed during post-install [GH-26791]
• metrics: Reduce memory usage on the Nomad leader for collecting eval broker metrics. [GH-26737]
• scheduler: Add reconciler annotations to the output of the eval status command [GH-26188]
• scheduler: Debug-level logs emitted by the scheduler are now single-line structured logs [GH-26169]
• scheduler: For service and batch jobs, the scheduler no longer includes stops for already-stopped canaries in plans it submits. [GH-26292]
• scheduler: For service and batch jobs, the scheduler treats a group.count=0 identically to removing the task group from the job, and will stop all non-terminal allocations. [GH-26292]

BUG FIXES:

• acl: Fixed a bug where ACL policies would silently accept invalid or duplicate blocks [GH-26836]
• auth: Fixed a bug where workload identity tokens could not be used to list or get policies from the ACL API [GH-26772]
• build: Updated toolchain to Go 1.25.3 to address bug in TLS certificate validation [GH-26949]
• client: Fix unique identifiers for templates with same content [GH-26880]
• client: restore task network status on client restart so restarted tasks receive proper networking environment variables, hosts file, and resolv.conf. [GH-26699]
• consul (Enterprise): Fixed a bug where Consul fingerprinting would generate warning logs if there was no default cluster [GH-26787]
• csi: Fixed a bug where multiple node plugin RPCs could be in-flight for a single volume [GH-26832]
• csi: Fixed a bug where volumes could be unmounted while in use by a task that was shutting down [GH-26831]
• docker: Fixed a bug where cpu usage percentage was incorrectly measured when container was stopped [GH-26902]
• keyring: fixes an issue with Vault transit configuration where tls_skip_verify was not defaulting to false [GH-26664]
• networking: Fixed network interface detection failure with bridge or CNI mode on IPv6-only interfaces [GH-26910]
• scheduler: allow use of different vendor/models when checking for device counts while filtering feasible nodes [GH-26649]
• scheduler: fixes a bug selecting nodes for updated jobs with ephemeral disks when nodepool changes [GH-26662]
• state: Fixed a bug where the server could panic when attempting to remove unneeded evals from the eval broker [GH-26872]
• windows: Fixed a bug where agents would not gracefully shut down on Ctrl-C [GH-26780]

v1.9.13 (Enterprise)

1.9.13 Enterprise (September 19, 2025)

SECURITY:

• build: Update go-getter to 1.7.9 to address CVE-2025-8959. Nomad Client Agents with Landlock support are not impacted by this vulnerability. [GH-26533]
• client: inspect artifacts for sandbox escape when landlock is unavailable [GH-26608]

IMPROVEMENTS:

• config: Validate the keyring configuration block label against supported values on agent startup [GH-26673]
• scheduling: Improve performance of scheduling when checking reserved ports usage [GH-26712]
• ui: Updated icons to the newest design system [GH-25353]

BUG FIXES:

• consul: Fixed a bug where restarting the Nomad agent would cause Consul ACL tokens to be recreated [GH-26604]
• dispatch: Fixed a bug where evaluations were not created atomically with dispatched jobs, which could prevent dispatch jobs from creating allocations [GH-26710]
• exec: Adjust USER and HOME env vars when user value is set [GH-25859]
• exec: Correctly set the LOGNAME env var when the job specification user value is set [GH-26703]
• logs: skip logging SIGPIPE [GH-26582]

v1.8.17 (Enterprise)

1.8.17 Enterprise (September 19, 2025)

SECURITY:

• build: Update go-getter to 1.7.9 to address CVE-2025-8959. Nomad Client Agents with Landlock support are not impacted by this vulnerability. [GH-26533]
• client: inspect artifacts for sandbox escape when landlock is unavailable [GH-26608]

IMPROVEMENTS:

• config: Validate the keyring configuration block label against supported values on agent startup [GH-26673]
• scheduling: Improve performance of scheduling when checking reserved ports usage [GH-26712]
• ui: Updated icons to the newest design system [GH-25353]

BUG FIXES:

• consul: Fixed a bug where restarting the Nomad agent would cause Consul ACL tokens to be recreated [GH-26604]
• dispatch: Fixed a bug where evaluations were not created atomically with dispatched jobs, which could prevent dispatch jobs from creating allocations [GH-26710]
• exec: Adjust USER and HOME env vars when user value is set [GH-25859]
• exec: Correctly set the LOGNAME env var when the job specification user value is set [GH-26703]
• logs: skip logging SIGPIPE [GH-26582]

v1.10.5

1.10.5 (September 09, 2025)

SECURITY:

• build: Update Go to 1.24.7 to address CVE-2025-47910 [GH-26713]
• build: Update go-getter to 1.7.9 to address CVE-2025-8959. Nomad Client Agents with Landlock support are not impacted by this vulnerability. [GH-26533]
• client: inspect artifacts for sandbox escape when landlock is unavailable [GH-26608]

IMPROVEMENTS:

• agent: Allow agent logging to the Windows Event Log [GH-26441]
• cli: Add commands for installing and uninstalling Windows system service [GH-26442]
• config: Validate the keyring configuration block label against supported values on agent startup [GH-26673]
• scheduling: Improve performance of scheduling when checking reserved ports usage [GH-26712]

BUG FIXES:

• consul: Fixed a bug where restarting the Nomad agent would cause Consul ACL tokens to be recreated [GH-26604]
• csi: fix EOF error when registering volumes [GH-26642]
• dispatch: Fixed a bug where evaluations were not created atomically with dispatched jobs, which could prevent dispatch jobs from creating allocations [GH-26710]
• exec: Adjust USER and HOME env vars when user value is set [GH-25859]
• exec: Correctly set the LOGNAME env var when the job specification user value is set [GH-26703]
• logs: skip logging SIGPIPE [GH-26582]

v1.9.12 (Enterprise)

1.9.12 Enterprise (August 13, 2025)

SECURITY:

• build: Update Go to 1.24.3 to address CVE-2025-47906 [GH-26451]

BUG FIXES:

• alloc exec: Fixed executor panic when exec-ing a rootless raw_exec task [GH-26401]
• client: run all allocrunner postrun (cleanup) hooks, even if any of them error [GH-26271]
• consul: Add AllocIPv6 option to allow IPv6 address being used for service registration [GH-25632]
• jobspec: Validate required hook field in lifecycle block [GH-26285]
• reporting (Enterprise): Fixed a bug where older servers could panic if the leader upgrades to version with offline reporting
• services: Fixed a bug where Nomad services were deleted if a node missed heartbeats and recovered before allocs were migrated [GH-26424]

v1.8.16 (Enterprise)

1.8.16 Enterprise (August 13, 2025)

SECURITY:

• build: Update Go to 1.24.3 to address CVE-2025-47906 [GH-26451]

BUG FIXES:

• client: run all allocrunner postrun (cleanup) hooks, even if any of them error [GH-26271]
• jobspec: Validate required hook field in lifecycle block [GH-26285]
• reporting (Enterprise): Fixed a bug where older servers could panic if the leader upgrades to version with offline reporting
• services: Fixed a bug where Nomad services were deleted if a node missed heartbeats and recovered before allocs were migrated [GH-26424]

v1.10.4

1.10.4 (August 13, 2025)

SECURITY:

• build: Update Go to 1.24.3 to address CVE-2025-47906 [GH-26451]

IMPROVEMENTS:

• cli: Added monitor export cli command to retrieve journald logs or the contents of the Nomad log file for a given Nomad agent [GH-26178]
• command: Add historical log capture to nomad operator debug command with -log-lookback and -log-file-export flags [GH-26410]
• metrics: Added node_pool label to blocked_evals metrics [GH-26215]
• sentinel (Enterprise): Added policy scope for csi-volumes [GH-26438]

BUG FIXES:

• alloc exec: Fixed executor panic when exec-ing a rootless raw_exec task [GH-26401]
• cli: Fixed a bug where acl policy self command would output all policies when used with a management token [GH-26396]
• client: run all allocrunner postrun (cleanup) hooks, even if any of them error [GH-26271]
• consul: Add AllocIPv6 option to allow IPv6 address being used for service registration [GH-25632]
• jobspec: Validate required hook field in lifecycle block [GH-26285]
• services: Fixed a bug where Nomad services were deleted if a node missed heartbeats and recovered before allocs were migrated [GH-26424]

v1.10.3

1.10.3 (July 08, 2025)

IMPROVEMENTS:

• consul: Added kind field to service block for Consul service registrations [GH-26170]
• docker: Added support for cgroup namespaces in the task config [GH-25927]
• task environment: new NOMAD_UNIX_ADDR env var points to the task API unix socket, for use with workload identity [GH-25598]

BUG FIXES:

• agent: Fixed a bug to prevent a possible panic during graceful shutdown [GH-26018]
• agent: Fixed a bug to prevent panic during graceful server shutdown [GH-26171]
• agent: Fixed bug where agent would exit early from graceful shutdown when managed by systemd [GH-26023]
• cli: Fix panic when restarting stopped job with no scaling policies [GH-26131]
• cli: Fixed a bug in the tls cert create command that always added "<role>.global.nomad"` to the certificate DNS names, even when the specified region was not "global"`. [GH-26086]
• cli: Fixed a bug where the acl token self command only performed lookups for tokens set as environment variables and not by the -token flag. [GH-26183]
• client: Attempt to rollback directory creation when the mkdir plugin fails to perform ownership changes on it [GH-26194]
• client: Fixed bug where drained batch jobs would not be rescheduled if no eligible nodes were immediately available [GH-26025]
• docker: Fixed a bug where very low resources.cpu values could generate invalid cpu weights on hosts with very large client.cpu_total_compute values [GH-26081]
• host volumes: Fixed a bug where volumes with server-terminal allocations could be deleted from clients but not the state store [GH-26213]
• tls: Fixed a bug where reloading the Nomad server process with an updated tls.verify_server_hostname configuration parameter would not apply an update to internal RPC handler verification and require a full server restart [GH-26107]
• vault: Fixed a bug where non-periodic tokens would not have their TTL incremented to the lease duration [GH-26041]

v1.9.11 (Enterprise)

1.9.11 Enterprise (July 8, 2025)

BUG FIXES:

• agent: Fixed a bug to prevent a possible panic during graceful shutdown [GH-26018]
• agent: Fixed a bug to prevent panic during graceful server shutdown [GH-26171]
• agent: Fixed bug where agent would exit early from graceful shutdown when managed by systemd [GH-26023]
• cli: Fixed a bug in the tls cert create command that always added "<role>.global.nomad"` to the certificate DNS names, even when the specified region was not "global"`. [GH-26086]
• client: Fixed bug where drained batch jobs would not be rescheduled if no eligible nodes were immediately available [GH-26025]
• docker: Fixed a bug where very low resources.cpu values could generate invalid cpu weights on hosts with very large client.cpu_total_compute values [GH-26081]
• tls: Fixed a bug where reloading the Nomad server process with an updated tls.verify_server_hostname configuration parameter would not apply an update to internal RPC handler verification and require a full server restart [GH-26107]
• vault: Fixed a bug where non-periodic tokens would not have their TTL incremented to the lease duration [GH-26041]

v1.8.15 (Enterprise)

1.8.15 Enterprise (July 8, 2025)

BUG FIXES:

• agent: Fixed a bug to prevent a possible panic during graceful shutdown [GH-26018]
• agent: Fixed a bug to prevent panic during graceful server shutdown [GH-26171]
• agent: Fixed bug where agent would exit early from graceful shutdown when managed by systemd [GH-26023]
• cli: Fixed a bug in the tls cert create command that always added "<role>.global.nomad"` to the certificate DNS names, even when the specified region was not "global"`. [GH-26086]
• client: Fixed bug where drained batch jobs would not be rescheduled if no eligible nodes were immediately available [GH-26025]
• docker: Fixed a bug where very low resources.cpu values could generate invalid cpu weights on hosts with very large client.cpu_total_compute values [GH-26081]
• encrypter: Fixes a bug where waiting for the active keyset wouldn't return correctly
• tls: Fixed a bug where reloading the Nomad server process with an updated tls.verify_server_hostname configuration parameter would not apply an update to internal RPC handler verification and require a full server restart [GH-26107]
• vault: Fixed a bug where non-periodic tokens would not have their TTL incremented to the lease duration [GH-26041]