---
schema_version: "1"
id: 19a7906aaaa0281e4745a801701054a23cd2cb2df11b2dab41635d2c45c75ecf
title: Mule Runtime Engine 4.13.0 Release Notes
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/release-notes/mule-runtime/mule-4.13.0-release-notes.md
canonical_url: https://docs.mulesoft.com/release-notes/mule-runtime/mule-4.13.0-release-notes
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 04a998b33182c92b310432eeef7e7ef88bc03309bac10d35543d747d0229af7d
description: MuleSoft Documentation Site
latest: true
---
---
product: Release Notes
version: master
---

# Mule Runtime Engine 4.13.0 Release Notes

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Mule runtime engine (Mule) is a lightweight integration engine that runs Mule applications and
supports domains and policies.

This version of Mule provides important enhancements and fixes. Deploy all your new and existing
applications to the latest version to benefit from the improvements.

For guidance with the patching process, see
[Apply Patch Updates](https://docs.mulesoft.com/release-notes/mule-runtime/patching-mule-versions#apply_patch_updates).

## October 2026

### Fixed Issues

### Patch 4.13.1

The October patch update 4.13.1 addresses regressions in the October patch update 4.13.0.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Applications no longer fail to deploy when the type of an on-error-propagate or on-error-continue is a property placeholder and the flow contains a component that supports streaming and requires a connection, such as an HTTP Request or Kafka operation.</p></div></div></td><td><div><div><p>W-24456406</p></div></div></td></tr><tr><td><div><div><p>A JMS connection that doesn’t use XA transactions no longer logs an error, or fails application initialization, when the application doesn’t declare a bti:transaction-manager.</p></div></div></td><td><div><div><p>W-24443844</p></div></div></td></tr><tr><td><div><div><p>Configuring the DELTA aggregation temporality for metrics export now works when running on CloudHub, CloudHub 2.0, and Runtime Fabric.</p></div></div></td><td><div><div><p>W-24492022</p></div></div></td></tr><tr><td><div><div><p>Polling sources that use a CloudHub Object Store v2 for watermarks now track processed items in the object store’s configured partition instead of the default partition.</p></div></div></td><td><div><div><p>W-24459240</p></div></div></td></tr><tr><td><div><div><p>SLA-based rate limiting policies no longer reject valid client requests because the client is validated twice.</p></div></div></td><td><div><div><p>W-24447995</p></div></div></td></tr></tbody></table>

### Patch 4.13.0

## October 6, 2026

### What’s New

The 4.13.0 version of Mule runtime introduces these enhancements:

Cache Scope:

- Mule 4.13 updates the Cache scope so that it persists only the message payload and attributes
  instead of the full Mule event. The `mule.serialize.message.in.cache` feature flag controls this
  behavior, and Mule migrates existing cache entries from the full-event format on demand. As a
  result, the Key Generator, Response Generator, and Event Copy Strategy customizations are
  deprecated for applications that set `minMuleVersion` to 4.13.0 or later. See
  [Set Up a Caching Strategy](https://docs.mulesoft.com/mule-runtime/latest/cache-scope-strategy) for a detailed
  description of the feature.

OpenTelemetry Direct Telemetry Stream:

See [OpenTelemetry Support in Mule Runtime](https://docs.mulesoft.com/mule-runtime/latest/otel-support) for a detailed
description of the feature.

- Tracing:

  - You can now set the OpenTelemetry tracing level for specific components or flow locations, in
    addition to the application-wide level. See
    [Tracing Levels](https://docs.mulesoft.com/mule-runtime/latest/otel-support#tracing-levels) for more information.

  - Traces for the same API resource now share one span name. When APIkit Router routes a request,
    the root span name uses the HTTP method and the matched route template, such as
    `GET /api/books/{bookId}`, instead of the raw listener path.

  - The Mule Tracing module now includes the `add-root-span-attributes` operation, which adds custom
    attributes to a transaction’s root span from anywhere in the flow. See
    [Add Root Span Attributes](https://docs.mulesoft.com/tracing-module/latest/tracing-module-reference#add-root-span-attributes)
    for more information.

- Metrics:

  - Flow statistics counters (`received.events`, `dispatched.messages`, `execution.errors`,
    `fatal.errors`, and `dispatched.primary.messages`) now report per-flow values by default through
    the `mule.flow.name` attribute. See
    [Message Processing Metrics](https://docs.mulesoft.com/mule-runtime/latest/otel-support#message-processing-metrics)
    for more information.

  - You can now set `service.name` and `service.namespace` for JVM metrics at the container level,
    separately from the application level. See
    [Custom Service Name and Service Namespace](https://docs.mulesoft.com/mule-runtime/latest/otel-support#custom-service-name)
    for more information.

  - You can now set the aggregation temporality for exported metrics through the
    `mule.openTelemetry.meter.exporter.aggregationTemporality` property. Supported values are
    `CUMULATIVE` (default), `DELTA_PREFERRED`, `LOW_MEMORY`, and `FULLY_DELTA`. See
    [Metrics Temporality](https://docs.mulesoft.com/mule-runtime/latest/otel-support#metrics-temporality) for more
    information.

- Resource Attributes:

  - Mule runtime now adds a `mule.artifact.type` resource attribute (`app`, `domain`, or `policy`)
    to every exported span, log record, and metric data point. See
    [Automatically Added Resource Attributes](https://docs.mulesoft.com/mule-runtime/latest/otel-support#automatically-added-resource-attributes)
    for more information.

  - Anypoint Platform metadata resource attributes now use the `mule.anypoint.` prefix, for example,
    `mule.anypoint.org.id`. All Mule-generated attribute keys in traces, logs, and metrics now use
    dot notation. The previous unprefixed keys are deprecated, but Mule still exports them alongside
    the new keys. See
    [Automatically Added Resource Attributes](https://docs.mulesoft.com/mule-runtime/latest/otel-support#automatically-added-resource-attributes)
    for more information.

Feature Flagging Mechanism:

- Mule 4.13 incorporates new feature flags. See
  [Feature Flagging Mechanism](https://docs.mulesoft.com/mule-runtime/latest/feature-flagging) for a detailed
  description of each feature flag and configuration instructions.

Runtime Manager agent:

- This release of Mule runtime 4.13.0 includes Runtime Manager agent 2.8.5. See
  [Runtime Manager Agent 2.8.5 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.8.x-release-notes#2-8-5).

## DataWeave Features

The 2.13.0 version of DataWeave introduces these new features and enhancements:

JSON Web Token Signing:

- DataWeave introduces the `dw::util::jwt::HMAC` module for creating signed JSON Web Tokens (JWTs)
  with the HS256, HS384, and HS512 algorithms. See
  [HMAC (dw::util::jwt::HMAC)](https://docs.mulesoft.com/dataweave/latest/dw-hmac).

- DataWeave introduces the `dw::util::jwt::RSA` module for creating signed JWTs with the RS256,
  RS384, and RS512 algorithms using unencrypted PKCS#1 or PKCS#8 PEM private keys. See
  [RSA (dw::util::jwt::RSA)](https://docs.mulesoft.com/dataweave/latest/dw-rsa).

### Fixed Issues

The release addresses these Mule issues and incorporates all patch updates from the 4.12.0 Mule
release through October 2026:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>The jsoup library is upgraded to 1.23.2.</p></div></div></td><td><div><div><p>W-23987955</p></div></div></td></tr><tr><td><div><div><p>The Jackson library is upgraded to 2.22.3.</p></div></div></td><td><div><div><p>W-24335732</p></div></div></td></tr><tr><td><div><div><p>The Reactor Core library is upgraded to 3.8.7.</p></div></div></td><td><div><div><p>W-23987958</p></div></div></td></tr><tr><td><div><div><p>The Netty library is upgraded to 4.2.18.Final.</p></div></div></td><td><div><div><p>W-24336011</p></div></div></td></tr><tr><td><div><div><p>The Apache Neethi library is upgraded to 3.2.4.</p></div></div></td><td><div><div><p>W-24335736</p></div></div></td></tr><tr><td><div><div><p>The Spring Framework library is upgraded to 7.0.9.</p></div></div></td><td><div><div><p>W-24232049</p></div></div></td></tr><tr><td><div><div><p>The raml-parser-2 library is upgraded to 1.2.1.</p></div></div></td><td><div><div><p>W-23570110</p></div></div></td></tr><tr><td><div><div><p>Error-mapping preservation during error propagation is now enabled by default. An error whose type was already resolved inside a scope, including any remapping by an error mapping, now keeps that resolved type as it propagates out of the scope, instead of reverting to the raw connector error type. You can disable this behavior by setting the <code>mule.honourErrorMappingsOnErrorPropagation</code> system property to <code>false</code>.</p></div></div></td><td><div><div><p>W-23955755</p></div></div></td></tr><tr><td><div><div><p>OpenTelemetry metric exporters now support per-exporter view enrichment and resource attribute overrides.</p></div></div></td><td><div><div><p>W-23367495</p></div></div></td></tr><tr><td><div><div><p>JSON schema validation is migrated from the everit library to networknt, with everit retained as a fallback.</p></div></div></td><td><div><div><p>W-16530105</p></div></div></td></tr><tr><td><div><div><p>HTTP header values containing CR/LF characters are now sanitized instead of causing the request to be rejected.</p></div></div></td><td><div><div><p>W-22252135</p></div></div></td></tr><tr><td><div><div><p><code>minMuleVersion</code> values are now normalized when loaded, preventing the patch or revision portion from being truncated.</p></div></div></td><td><div><div><p>W-24231362</p></div></div></td></tr><tr><td><div><div><p>Configuration property placeholder resolution now stops once it exceeds a maximum nesting depth, instead of continuing to recurse through a cyclic or excessively deep reference chain. You can configure the depth limit through the <code>mule.properties.resolution.maxDepth</code> system property, which defaults to 10.</p></div></div></td><td><div><div><p>W-23650198</p></div></div></td></tr><tr><td><div><div><p>Reads from the repeatable streaming buffer are now lock-free when data is already available, reducing thread contention. You can control this behavior by using the <code>mule.repeatableStreaming.lockFreeRead</code> system property.</p></div></div></td><td><div><div><p>W-24012839</p></div></div></td></tr><tr><td><div><div><p>You can now configure a full request timeout for the HTTP server by using the <code>mule.http.server.fullRequestTimeout</code> system property, in milliseconds. This property is disabled by default.</p></div></div></td><td><div><div><p>W-22040113</p></div></div></td></tr><tr><td><div><div><p>OpenTelemetry flow-statistics counters now emit one datapoint per flow, labeled with the <code>mule.flow.name</code> dimension, instead of a single artifact-level total. You can disable this behavior by setting the <code>mule.enable.otel.flow.statistics.detailed</code> system property to <code>false</code>.</p></div></div></td><td><div><div><p>W-23616483</p></div></div></td></tr><tr><td><div><div><p>Logging export reconfiguration is fixed for single application mode.</p></div></div></td><td><div><div><p>W-20908857</p></div></div></td></tr><tr><td><div><div><p>The ObjectStore API is extended with an <code>upsert</code> operation and an <code>isThreadSafe</code> indicator.</p></div></div></td><td><div><div><p>W-23090592</p></div></div></td></tr><tr><td><div><div><p>An omitted <code>eagerRead</code> attribute on <code>&lt;repeatable-in-memory-stream&gt;</code> now correctly takes its default value from the <code>mule.repeatableStreaming.bytes.eagerRead</code> system property, instead of a fixed value.</p></div></div></td><td><div><div><p>W-24043809</p></div></div></td></tr><tr><td><div><div><p>A <code>java.lang.UnsupportedClassVersionError</code> thrown when a connector’s compiled target doesn’t match the running JVM is now handled gracefully.</p></div></div></td><td><div><div><p>W-24193358</p></div></div></td></tr><tr><td><div><div><p>A connector’s message source no longer deadlocks when its connection-retry logic triggers a stop of the retry scheduler from one of that scheduler’s own worker threads.</p></div></div></td><td><div><div><p>W-24234538</p></div></div></td></tr><tr><td><div><div><p>Network information listening ports are now scoped to the Mule process.</p></div></div></td><td><div><div><p>W-24043880</p></div></div></td></tr><tr><td><div><div><p><code>NullPointerException</code> errors no longer occur when loading the extension model of a connector whose connection provider uses the <code>@ClientCredentials</code> or <code>@AuthorizationCode</code> OAuth annotation with <code>credentialsPlacement</code> configured.</p></div></div></td><td><div><div><p>W-24086656</p></div></div></td></tr><tr><td><div><div><p>Policy logging context is no longer lost when a dynamic Flow Reference resolves to a subflow.</p></div></div></td><td><div><div><p>W-24026465</p></div></div></td></tr><tr><td><div><div><p>The new <code>loggingConfiguration</code> troubleshooting operation helps you diagnose logging configuration issues.</p></div></div></td><td><div><div><p>W-23998256</p></div></div></td></tr><tr><td><div><div><p>The log level for <code>disallowConcurrentExecution</code> messages is changed from WARN to DEBUG, reducing log noise.</p></div></div></td><td><div><div><p>W-24164028</p></div></div></td></tr><tr><td><div><div><p>The new on-demand connectivity-testing troubleshooting operation is now available.</p></div></div></td><td><div><div><p>W-23629284</p></div></div></td></tr><tr><td><div><div><p>The OpenTelemetry exporter TLS property <code>mule.openTelemetry.exporter.tls.certificatesStrategy</code> is now properly resolved.</p></div></div></td><td><div><div><p>W-24009827</p></div></div></td></tr><tr><td><div><div><p>A source policy that uses Async, Parallel For Each, or Scatter-Gather no longer builds its response from the failure response parameters instead of the success response parameters, and no longer silently drops the forked route’s response processing.</p></div></div></td><td><div><div><p>W-23938349</p></div></div></td></tr><tr><td><div><div><p>The new on-demand <code>connectionCount</code> troubleshooting operation is now available.</p></div></div></td><td><div><div><p>W-23716301</p></div></div></td></tr><tr><td><div><div><p>The commons-beanutils library and its transitive commons-collections 3.2.2 dependency are removed from Mule Runtime modules.</p></div></div></td><td><div><div><p>W-16918287</p></div></div></td></tr><tr><td><div><div><p>OpenTelemetry metrics export now supports delta aggregation temporality.</p></div></div></td><td><div><div><p>W-23448781</p></div></div></td></tr><tr><td><div><div><p>An unresolved placeholder in the meter-exporter configuration now degrades to its default value at tracer startup instead of causing a failure.</p></div></div></td><td><div><div><p>W-23650358</p></div></div></td></tr><tr><td><div><div><p>Dynamic reload of the metrics exporter configuration is now supported.</p></div></div></td><td><div><div><p>W-21921629</p></div></div></td></tr><tr><td><div><div><p>OpenTelemetry flow statistics counters now report total flow counts as well as per-flow totals.</p></div></div></td><td><div><div><p>W-23232729</p></div></div></td></tr><tr><td><div><div><p><code>OutputHandler</code> is deprecated and its support is removed.</p></div></div></td><td><div><div><p>W-23660888</p></div></div></td></tr><tr><td><div><div><p>A <code>SerializationException</code> now raises a <code>MULE:SERIALIZATION</code> error, instead of <code>MULE:UNKNOWN</code>.</p></div></div></td><td><div><div><p>W-21381359</p></div></div></td></tr><tr><td><div><div><p>The exporter-health backpressure-alert cadence for OpenTelemetry tracing, metrics, and logging is now configured through a single system property, <code>mule.openTelemetry.meter.exporter.healthMetrics.alertingFrequency</code>, instead of the separate per-signal <code>metricsLogFrequency</code> properties, which are deprecated and no longer consumed.</p></div></div></td><td><div><div><p>W-22193713</p></div></div></td></tr><tr><td><div><div><p><code>MULE:INVALID_INPUT_PARAM</code> is now preserved as a suppressed error when a <code>MULE:SOURCE_RESPONSE_GENERATE</code> error occurs.</p></div></div></td><td><div><div><p>W-22293407</p></div></div></td></tr><tr><td><div><div><p>SDK parameter validation errors are now mapped to the <code>MULE:INVALID_INPUT_PARAM</code> error type.</p></div></div></td><td><div><div><p>W-2227652</p></div></div></td></tr><tr><td><div><div><p>Mule-generated tracing spans no longer truncate attribute values at OpenTelemetry’s default 128-character limit. Attribute values are now preserved up to 4096 characters before truncation.</p></div></div></td><td><div><div><p>W-20091299</p></div></div></td></tr><tr><td><div><div><p>Client-side read backpressure is now applied to streamed HTTP responses, preventing out-of-memory errors when consuming large response bodies.</p></div></div></td><td><div><div><p>W-24103497</p></div></div></td></tr><tr><td><div><div><p>The Netty-based HTTP client now defers DNS resolution of the target host to the proxy when a proxy is configured, regardless of the configured scheme.</p></div></div></td><td><div><div><p>W-24010245</p></div></div></td></tr><tr><td><div><div><p>Unresolved placeholders in Batch AST properties no longer cause a <code>ClassCastException</code> during packaging validation.</p></div></div></td><td><div><div><p>W-24088827</p></div></div></td></tr><tr><td><div><div><p>In a clustered deployment, the DiscoverySPI HTTP client no longer fails to start when PCF or Kubernetes discovery is configured through the <code>.mule/mule-cluster.properties</code> file instead of a JVM system property.</p></div></div></td><td><div><div><p>W-24211100</p></div></div></td></tr><tr><td><div><div><p><code>SQSQueueManagementService</code> is added to the serialization allowlist.</p></div></div></td><td><div><div><p>W-24197744</p></div></div></td></tr><tr><td><div><div><p>Fallback is now enabled as the default strategy for contracts collection. You can change this behavior by configuring the <code>anypoint.platform.clients_fetch_mode</code> system property with the values <code>sharded</code>, <code>legacy</code>, or <code>fallback</code>.</p></div></div></td><td><div><div><p>W-24179706</p></div></div></td></tr><tr><td><div><div><p>When API Gateway authenticates with Anypoint Platform, a transient failure of the <code>/login</code> request no longer discards an otherwise valid Access Management token. The token is now invalidated only on an actual authentication failure (401 or 403).</p></div></div></td><td><div><div><p>W-24144244</p></div></div></td></tr><tr><td><div><div><p>Netty’s Java Flight Recorder (JFR) integration is now disabled by default.</p></div></div></td><td><div><div><p>W-20926401</p></div></div></td></tr></tbody></table>

DataWeave 2.13.0 is bundled with the Mule 4.13.0 release. This release addresses these DataWeave
issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>Memory usage for <code>text/plain</code> output is reduced.</p></div></div></td><td><div><div><p>W-20063270</p></div></div></td></tr><tr><td><div><div><p>Eagerly materialize executable Weave reader results.</p></div></div></td><td><div><div><p>W-23837275</p></div></div></td></tr><tr><td><div><div><p>Thread safety is improved when processing Java map values.</p></div></div></td><td><div><div><p>W-23661641</p></div></div></td></tr><tr><td><div><div><p>DataWeave tooling now reports design-time warnings when Java classes referenced in <code>application/java</code> schemas can’t be found or are inaccessible through JPMS.</p></div></div></td><td><div><div><p>W-22797049</p></div></div></td></tr><tr><td><div><div><p>DataWeave now filters Java classes in JPMS-unexported packages during Java module resolution, preventing runtime <code>IllegalAccessException</code> failures. This behavior is enabled by default on JDK 17 and later with DataWeave language version 2.13 and later. To keep the previous behavior, set <code>mule.dw.filter_jpms_inaccessible_modules=false</code>.</p></div></div></td><td><div><div><p>W-22779527</p></div></div></td></tr><tr><td><div><div><p>Cryptographic security warnings and errors now include call stacks.</p></div></div></td><td><div><div><p>W-22144340</p></div></div></td></tr></tbody></table>

## Bundled Components

- DataWeave version 2.13.0

- Runtime Manager Agent plugin version 2.8.5

### Upgrade

If you’re upgrading to this version of Mule from an earlier Mule 4.x version, see
[Mule Upgrades and Patch Updates](https://docs.mulesoft.com/release-notes/mule-runtime/mule-esb#mule-upgrades).

To ensure optimal performance with this version of Mule and avoid unexpected issues, update these
modules and extensions to their latest version at the time of this release:

<table><colgroup><col> <col></colgroup><thead><tr><th>Module or Extension</th><th>Version</th></tr></thead><tbody><tr><td><p>APIkit for Mule 4</p></td><td><p>1.11.17</p></td></tr><tr><td><p>APIkit for OData</p></td><td><p>2.4.0</p></td></tr><tr><td><p>APIkit for OData 4</p></td><td><p>1.6.0</p></td></tr><tr><td><p>APIkit for SOAP</p></td><td><p>2.1.0</p></td></tr><tr><td><p>APIkit for GraphQL</p></td><td><p>1.2.0</p></td></tr><tr><td><p>Spring module</p></td><td><p>2.1.2</p></td></tr><tr><td><p>MUnit plugin</p></td><td><p>3.7.1</p></td></tr></tbody></table>

## Considerations for Mule Extension Developers

When you build a Mule extension, if you update the version of your parent `pom.xml` file to 1.4.0 or
later, ensure that the dependencies in your `pom.xml` file don’t override dependencies in the parent
`pom.xml` file. Declare only the dependencies you need. If you declare a dependency that’s already
in the parent `pom.xml` file, don’t specify a version, so that it uses the version from the parent
`pom.xml` file.

## See Also

- [Salesforce Help](https://help.salesforce.com)

- [MuleSoft Services](https://www.mulesoft.com/support-and-services)

- [Mule Troubleshooting Plugin](https://docs.mulesoft.com/mule-runtime/latest/mule-troubleshooting-plugin)

- [Known Issues](https://help.salesforce.com/s/issues)