---
schema_version: "1"
id: c0afec64403fbe0436a146eda895de3dbf9468a03feb8436109c262ec30add1b
title: Mule Runtime Engine 4.9.0 Release Notes
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/release-notes/mule-runtime/mule-4.9.0-release-notes.md
canonical_url: https://docs.mulesoft.com/release-notes/mule-runtime/mule-4.9.0-release-notes
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 7e2758b24e6b7b05a39f00c704f1a0d7d6ab34c1d283e9c93e973bd3d53c7e1b
description: MuleSoft Documentation Site
latest: true
---
---
product: Release Notes
version: master
---

# Mule Runtime Engine 4.9.0 Release Notes

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Mule runtime engine (Mule) is a lightweight integration engine that runs Mule applications and
supports domains and policies.

This version of Mule provides important enhancements and fixes. Deploy all your new and existing
applications to the latest version to benefit from the improvements.

## October 2026

### Fixed Issues

### Patch 4.9.23

The October patch update 4.9.23 addresses regressions in the October patch update 4.9.22.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>SLA-based rate limiting policies no longer reject valid client requests because the client is validated twice.</p></div></div></td><td><div><div><p>W-24447995</p></div></div></td></tr></tbody></table>

### Patch 4.9.22

### What’s New

Runtime Manager agent:

- This release of Mule runtime 4.9.22 includes Runtime Manager agent 2.8.5. See
  [Runtime Manager Agent 2.8.5 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.8.x-release-notes#2-8-5).

### Fixed Issues

Patch release version: 4.9.22

This patch update addresses these Mule issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>The Reactor Core library is upgraded to 3.8.7.</p></div></div></td><td><div><div><p>W-23953702</p></div></div></td></tr><tr><td><div><div><p>The Jackson library is upgraded to 2.22.3.</p></div></div></td><td><div><div><p>W-24335732</p></div></div></td></tr><tr><td><div><div><p>The Netty library is upgraded to 4.2.18.Final.</p></div></div></td><td><div><div><p>W-24336011</p></div></div></td></tr><tr><td><div><div><p>The Apache Neethi library is upgraded to 3.2.4.</p></div></div></td><td><div><div><p>W-24335736</p></div></div></td></tr><tr><td><div><div><p>The Spring Framework library is upgraded to 7.0.9.</p></div></div></td><td><div><div><p>W-24232049</p></div></div></td></tr><tr><td><div><div><p>Configuration property placeholder resolution now stops once it exceeds a maximum nesting depth, instead of continuing to recurse through a cyclic or excessively deep reference chain. You can configure the depth limit through the <code>mule.properties.resolution.maxDepth</code> system property, which defaults to 10.</p></div></div></td><td><div><div><p>W-23650198</p></div></div></td></tr><tr><td><div><div><p>Reads from the repeatable streaming buffer are now lock-free when data is already available, reducing thread contention. You can control this behavior by using the <code>mule.repeatableStreaming.lockFreeRead</code> system property.</p></div></div></td><td><div><div><p>W-24012839</p></div></div></td></tr><tr><td><div><div><p>Error-mapping preservation during error propagation can now be enabled through the <code>mule.honourErrorMappingsOnErrorPropagation</code> system property. When enabled, an error whose type was already resolved inside a scope, including any remapping by an error mapping, keeps that resolved type as it propagates out of the scope, instead of reverting to the raw connector error type.</p></div></div></td><td><div><div><p>W-23955755</p></div></div></td></tr><tr><td><div><div><p>You can now configure a full request timeout for the HTTP server by using the <code>mule.http.server.fullRequestTimeout</code> system property, in milliseconds. This property is disabled by default.</p></div></div></td><td><div><div><p>W-22040113</p></div></div></td></tr><tr><td><div><div><p>A connector’s message source no longer deadlocks when its connection-retry logic triggers a stop of the retry scheduler from one of that scheduler’s own worker threads.</p></div></div></td><td><div><div><p>W-24234538</p></div></div></td></tr><tr><td><div><div><p>Network information listening ports are now scoped to the Mule process.</p></div></div></td><td><div><div><p>W-24043880</p></div></div></td></tr><tr><td><div><div><p><code>NullPointerException</code> errors no longer occur when loading the extension model of a connector whose connection provider uses the <code>@ClientCredentials</code> or <code>@AuthorizationCode</code> OAuth annotation with <code>credentialsPlacement</code> configured.</p></div></div></td><td><div><div><p>W-24086656</p></div></div></td></tr><tr><td><div><div><p>Policy logging context is no longer lost when a dynamic Flow Reference resolves to a subflow.</p></div></div></td><td><div><div><p>W-24026465</p></div></div></td></tr><tr><td><div><div><p>The new <code>loggingConfiguration</code> troubleshooting operation helps you diagnose logging configuration issues.</p></div></div></td><td><div><div><p>W-23998256</p></div></div></td></tr><tr><td><div><div><p>The log level for <code>disallowConcurrentExecution</code> messages is changed from WARN to DEBUG, reducing log noise.</p></div></div></td><td><div><div><p>W-24164028</p></div></div></td></tr><tr><td><div><div><p>The new on-demand connectivity-testing troubleshooting operation is now available.</p></div></div></td><td><div><div><p>W-23629284</p></div></div></td></tr><tr><td><div><div><p>The new on-demand <code>connectionCount</code> troubleshooting operation is now available.</p></div></div></td><td><div><div><p>W-23716301</p></div></div></td></tr><tr><td><div><div><p>HTTP/1-only HTTPS listeners backed by the Netty HTTP service no longer fail to establish TLS connections when an application loads the Bouncy Castle JSSE provider from a shared library outside the runtime’s classloader.</p></div></div></td><td><div><div><p>W-23355657</p></div></div></td></tr><tr><td><div><div><p>The Netty-based HTTP client now defers DNS resolution of the target host to the proxy when a proxy is configured, regardless of the configured scheme.</p></div></div></td><td><div><div><p>W-24010245</p></div></div></td></tr><tr><td><div><div><p>A warning is now logged when NTLM authentication is configured but the server doesn’t issue an NTLM challenge.</p></div></div></td><td><div><div><p>W-17651806</p></div></div></td></tr><tr><td><div><div><p>Fallback is now enabled as the default strategy for contracts collection. You can change this behavior by configuring the <code>anypoint.platform.clients_fetch_mode</code> system property with the values <code>sharded</code>, <code>legacy</code>, or <code>fallback</code>.</p></div></div></td><td><div><div><p>W-24179706</p></div></div></td></tr><tr><td><div><div><p>When API Gateway authenticates with Anypoint Platform, a transient failure of the <code>/login</code> request no longer discards an otherwise valid Access Management token. The token is now invalidated only on an actual authentication failure (401 or 403).</p></div></div></td><td><div><div><p>W-24144244</p></div></div></td></tr></tbody></table>

There is no DataWeave update for this version.

For guidance with the patching process, see
[Apply Patch Updates](https://docs.mulesoft.com/release-notes/mule-runtime/patching-mule-versions#apply_patch_updates).

## September 2026

### What’s New

Runtime Manager agent:

- This release of Mule runtime 4.9.21 includes Runtime Manager agent 2.8.4. See
  [Runtime Manager Agent 2.8.4 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.8.x-release-notes#2-8-4).

General improvements:

- The Mule Troubleshooting plugin now includes additional diagnostic sections in the Diagnostic
  Information Analysis File (DIAF). See
  [Mule Troubleshooting Plugin](https://docs.mulesoft.com/mule-runtime/latest/mule-troubleshooting-plugin) for more
  information.

  - Health Signals: Evaluates a small set of fast host- and JVM-level health signals and reports
    those that triggered, including low memory, high CPU steal, and JVM crash logs.

  - Memory Detail: Provides a JVM memory-pool breakdown and garbage-collector statistics, showing
    heap and non-heap usage with metrics such as initial, used, committed, and maximum memory
    values.

  - Known Issues: Scans the runtime logs and deployed applications for well-known problem
    signatures, including out-of-memory conditions, abnormal terminations, and MUnit packaging
    issues.

### Fixed Issues

Patch release version: 4.9.21

This patch update addresses these Mule issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>An <code>&lt;async&gt;</code> scope can now be configured to wait for its in-flight events to finish before flows are stopped during a graceful shutdown, which helps avoid dropped or canceled async work. This behavior is disabled by default and can be enabled through the <code>mule.async.gracefulShutdown.drainInflight</code> system property.</p></div></div></td><td><div><div><p>W-23602447</p></div></div></td></tr><tr><td><div><div><p>An SDK-based reconnectable message source no longer attempts to reconnect while a graceful shutdown is in progress.</p></div></div></td><td><div><div><p>W-23122573</p></div></div></td></tr><tr><td><div><div><p>Custom error mappings in the Tracing module are no longer lost on error propagation when an operation inside a <code>tracing:with-correlation-id</code> scope fails, which previously reverted the mapped error type to the raw connector error.</p></div></div></td><td><div><div><p>W-21815402</p></div></div></td></tr><tr><td><div><div><p>A disposed source policy is no longer left in the policy cache when a flow is stopped and restarted while cache population and flow-stop invalidation occur concurrently.</p></div></div></td><td><div><div><p>W-23564125</p></div></div></td></tr><tr><td><div><div><p>A memory leak no longer occurs when <code>parallel-foreach</code> and <code>scatter-gather</code> routes leave the route event pinned in a worker thread’s memory after route completion.</p></div></div></td><td><div><div><p>W-23829061</p></div></div></td></tr><tr><td><div><div><p>Artifact descriptor validation failures during deployment now report more specific exceptions.</p></div></div></td><td><div><div><p>W-23047228</p></div></div></td></tr><tr><td><div><div><p>A malformed authorization URL no longer occurs when the configured OAuth <code>authorizationUrl</code> contains an existing query parameter.</p></div></div></td><td><div><div><p>W-23064254</p></div></div></td></tr><tr><td><div><div><p>The HTTP client configurer now includes a method to control whether sensitive headers are filtered when a request is redirected to a different domain.</p></div></div></td><td><div><div><p>W-21045658</p></div></div></td></tr><tr><td><div><div><p>A forward-proxy client no longer sends a malformed, path-only request line.</p></div></div></td><td><div><div><p>W-23384645</p></div></div></td></tr><tr><td><div><div><p>A worker thread no longer hangs indefinitely, eventually exhausting the runtime’s thread pool, when a client drops the connection while its HTTP request body is being read.</p></div></div></td><td><div><div><p>W-23612974</p></div></div></td></tr><tr><td><div><div><p>Netty-based HTTP client requests no longer fail when the response contains a header section larger than 8 KB and a larger response header size limit is configured.</p></div></div></td><td><div><div><p>W-23443375</p></div></div></td></tr><tr><td><div><div><p>DIGEST authentication in the Netty-based HTTP client no longer fails with a 401 Unauthorized response when the server issues an RFC 7616-compliant challenge.</p></div></div></td><td><div><div><p>W-23075291</p></div></div></td></tr><tr><td><div><div><p>A <code>NullPointerException</code> no longer occurs during cluster node discovery when using PCF or Kubernetes-based cluster discovery.</p></div></div></td><td><div><div><p>W-23466789</p></div></div></td></tr><tr><td><div><div><p>Analytics events for requests rejected due to back-pressure are no longer incorrectly reported as HTTP 500 and now correctly report 503 by default. Custom status codes for other error scenarios can also be configured through the <code>anypoint.platform.error.mapping</code> (format <code>NAMESPACE:IDENTIFIER:STATUS_CODE</code>, comma-separated for multiple mappings) and <code>anypoint.platform.error.default</code> system properties.</p></div></div></td><td><div><div><p>W-23509148</p></div></div></td></tr><tr><td><div><div><p>API Gateway no longer fails to read shard checksums from an ETag header that contains commas.</p></div></div></td><td><div><div><p>W-23572494</p></div></div></td></tr><tr><td><div><div><p>The fix for idle connections being destroyed and recreated instead of reused when the number of idle connections reached the configured <code>maxIdle</code> limit under concurrent load, introduced in a previous release, is reverted in this release.</p></div></div></td><td><div><div><p>W-22716456</p></div></div></td></tr><tr><td><div><div><p>The jsoup library is upgraded to 1.23.1.</p></div></div></td><td><div><div><p>W-23715606</p></div></div></td></tr><tr><td><div><div><p>The Netty library is upgraded to 4.2.17.Final.</p></div></div></td><td><div><div><p>W-3300013</p></div></div></td></tr><tr><td><div><div><p>The Jackson library is upgraded to 2.22.1.</p></div></div></td><td><div><div><p>W-23540341</p></div></div></td></tr><tr><td><div><div><p>The RAML Parser library is upgraded to 2-1.2.1.</p></div></div></td><td><div><div><p>W-23328348</p></div></div></td></tr><tr><td><div><div><p>The <code>com.mulesoft.mule.runtime.gw.api.analytics</code> package is now open to all modules, so the Runtime Manager agent can serialize analytics events.</p></div></div></td><td><div><div><p>W-23846531</p></div></div></td></tr><tr><td><div><div><p>Worker TLS configuration for Government Cloud is strengthened.</p></div></div></td><td><div><div><p>W-23819316</p></div></div></td></tr></tbody></table>

DataWeave 2.9.18 is bundled with the Mule 4.9.21 release. This patch release addresses these
DataWeave issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>Vulnerable dependencies are upgraded to address reported security vulnerabilities.</p></div></div></td><td><div><div><p>W-23924223</p></div></div></td></tr><tr><td><div><div><p>You can now configure the size of the DataWeave script parser cache by using the <code>mule.weave.script.parser.cache.size</code> system property.</p></div></div></td><td><div><div><p>W-23138851</p></div></div></td></tr><tr><td><div><div><p>A thread-safety livelock no longer occurs in the Java module builder and converter caches.</p></div></div></td><td><div><div><p>W-23652160</p></div></div></td></tr></tbody></table>

For guidance with the patching process, see
[Apply Patch Updates](https://docs.mulesoft.com/release-notes/mule-runtime/patching-mule-versions#apply_patch_updates).

## August 2026

### What’s New

Runtime Manager agent:

- This release of Mule runtime 4.9.20 includes Runtime Manager agent 2.8.3. See
  [Runtime Manager Agent 2.8.3 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.8.x-release-notes#2-8-3).

General improvements:

- The Mule Troubleshooting plugin now includes additional diagnostic sections in the Diagnostic
  Information Analysis File (DIAF). See
  [Mule Troubleshooting Plugin](https://docs.mulesoft.com/mule-runtime/latest/mule-troubleshooting-plugin) for more
  information.

  - Network Info: Shows host-level network diagnostics, including the hostname, network interfaces
    with their assigned IP addresses and I/O counters, and active and listening network connections.

  - Agent Info: Reports the installation and health of the Mule agent that pairs the runtime with
    Anypoint Platform, including whether the agent is installed, its version, key configuration
    values, keystore certificate details, and the most recent connection status.

  - Platform Connectivity: Checks TCP connectivity from the Mule runtime host to the Anypoint
    Platform endpoints and dumps the TLS certificate chain presented by the platform.

### Fixed Issues

Patch release version: 4.9.20

This patch update addresses these Mule issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>Idle connections are no longer destroyed and recreated instead of being reused when the number of idle connections reaches the configured <code>maxIdle</code> limit under concurrent load.</p></div></div></td><td><div><div><p>W-22716456</p></div></div></td></tr><tr><td><div><div><p>HTTP/3 requests sent to an HTTP/1 server now correctly fail with a 505 (HTTP Version Not Supported) response.</p></div></div></td><td><div><div><p>W-23029577</p></div></div></td></tr><tr><td><div><div><p>Requests with a non-numeric <code>Content-Length</code> header are now rejected with a 400 (Bad Request) response.</p></div></div></td><td><div><div><p>W-23029480</p></div></div></td></tr><tr><td><div><div><p>A batch job no longer fails with a <code>MULE:CANCELLED</code> error during graceful shutdown.</p></div></div></td><td><div><div><p>W-23426859</p></div></div></td></tr><tr><td><div><div><p>Potential errors thrown during runtime shutdown are now handled correctly.</p></div></div></td><td><div><div><p>W-23051939</p></div></div></td></tr><tr><td><div><div><p>When running in FIPS mode on a standalone server, the runtime now logs a warning at startup if the JVM <code>java.security</code> file isn’t configured with the required FIPS providers, instead of silently masking the misconfiguration.</p></div></div></td><td><div><div><p>W-22794711</p></div></div></td></tr><tr><td><div><div><p>The Diagnostic Information Analysis File (DIAF) now includes network information.</p></div></div></td><td><div><div><p>W-22383655</p></div></div></td></tr><tr><td><div><div><p>The Diagnostic Information Analysis File (DIAF) now includes Mule agent information.</p></div></div></td><td><div><div><p>W-22383660</p></div></div></td></tr><tr><td><div><div><p>The Diagnostic Information Analysis File (DIAF) now includes a platform connectivity check.</p></div></div></td><td><div><div><p>W-22383679</p></div></div></td></tr><tr><td><div><div><p>The API gateway resource cache is enabled by default. You can now disable it by setting the <code>anypoint.platform.resource_cache_enabled</code> system property to <code>false</code>.</p></div></div></td><td><div><div><p>W-23542185</p></div></div></td></tr><tr><td><div><div><p>The Jackson library is upgraded to 2.22.0.</p></div></div></td><td><div><div><p>W-23131090</p></div></div></td></tr></tbody></table>

DataWeave 2.9.17 is bundled with the Mule 4.9.20 release. This patch release addresses these
DataWeave issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>The repeated attribute selector (<code>.*@</code>) now correctly preserves values when processing data structures containing empty map slots.</p></div></div></td><td><div><div><p>W-23457314</p></div></div></td></tr><tr><td><div><div><p>The Jackson library is upgraded to 2.21.5.</p></div></div></td><td><div><div><p>W-23037592</p></div></div></td></tr><tr><td><div><div><p>The <code>per_app_java_bean_cache</code> compatibility flag now correctly reports its creation version as 2.9.</p></div></div></td><td><div><div><p>W-22417507</p></div></div></td></tr></tbody></table>

For guidance with the patching process, see
[Apply Patch Updates](https://docs.mulesoft.com/release-notes/mule-runtime/patching-mule-versions#apply_patch_updates).

## July 2026

### What’s New

Runtime Manager agent:

- This release of Mule runtime 4.9.19 includes Runtime Manager agent 2.7.16. See
  [Runtime Manager Agent 2.7.16 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-16).

Feature Flagging Mechanism:

- Mule 4.9 incorporates new feature flags. See
  [Feature Flagging Mechanism](https://docs.mulesoft.com/mule-runtime/latest/feature-flagging) for a detailed
  description of each feature flag and configuration instructions.

General improvements:

- The Mule Troubleshooting plugin now includes additional diagnostic sections in the Diagnostic
  Information Analysis File (DIAF). See
  [Mule Troubleshooting Plugin](https://docs.mulesoft.com/mule-runtime/latest/mule-troubleshooting-plugin) for more
  information.

  - System Info: Reports host-level diagnostics including OS details, CPU metrics, memory, and disk
    input and output statistics.

  - JVM Agents: Lists agents attached at JVM startup via `-javaagent`, `-agentpath`, or `-agentlib`
    arguments.

  - Connectors State: Shows connector configuration states, connection pools, errors, and TLS
    details.

  - Cluster Info: Reports clustering configuration and distributed lock diagnostics.

### Fixed Issues

Patch release version: 4.9.19

This patch update addresses these Mule issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>Cluster node IDs are no longer generated with negative values.</p></div></div></td><td><div><div><p>W-22294724</p></div></div></td></tr><tr><td><div><div><p>Graceful shutdown no longer times out when a global error handler runs for a flow.</p></div></div></td><td><div><div><p>W-22434375</p></div></div></td></tr><tr><td><div><div><p>Long-running internal tasks no longer use the shared <code>forkJoin</code> pool during parallel flow shutdown and bootstrap configuration, preventing thread starvation.</p></div></div></td><td><div><div><p>W-22279521</p></div></div></td></tr><tr><td><div><div><p>Duplicate XSD elements are no longer generated for connection providers declared at both the extension and configuration levels.</p></div></div></td><td><div><div><p>W-20824537</p></div></div></td></tr><tr><td><div><div><p>Shutdown validation for dynamic configurations can now be skipped by enabling the <code>mule.forcefulShutdown.dynamicConfig.disableStoppingCheck</code> system property.</p></div></div></td><td><div><div><p>W-22772644</p></div></div></td></tr><tr><td><div><div><p>Flows with a scheduler source are no longer left in an invalid state after a flow restart.</p></div></div></td><td><div><div><p>W-22918240</p></div></div></td></tr><tr><td><div><div><p>Stopping a flow no longer waits unnecessarily when no events are being processed.</p></div></div></td><td><div><div><p>W-22969411</p></div></div></td></tr><tr><td><div><div><p>Project versions defined with properties are now resolved recursively.</p></div></div></td><td><div><div><p>W-22845430</p></div></div></td></tr><tr><td><div><div><p>Extension packager validation no longer fails for operations annotated with <code>@Validator</code> that use a <code>CompletionCallback</code> operation.</p></div></div></td><td><div><div><p>W-22817376</p></div></div></td></tr><tr><td><div><div><p>Events that are dropped within a processing hook are now properly completed and terminated.</p></div></div></td><td><div><div><p>W-22470584</p></div></div></td></tr><tr><td><div><div><p>The Netty HTTP listener now rejects <code>HTTP/1.1</code> requests that have a missing or duplicate Host header, in compliance with RFC 9112.</p></div></div></td><td><div><div><p>W-23052713</p></div></div></td></tr><tr><td><div><div><p>The Content-Length header is now removed based on the actual entity byte length.</p></div></div></td><td><div><div><p>W-22570070</p></div></div></td></tr><tr><td><div><div><p>SDK sources that don’t implement <code>Reconnectable</code> are no longer restarted during graceful shutdown.</p></div></div></td><td><div><div><p>W-21563258</p></div></div></td></tr><tr><td><div><div><p>The maximum size of the dynamic <code>flow-ref</code> cache is now configurable through the <code>mule.flowRef.dynamicCacheMaxSize</code> system property, which defaults to 20.</p></div></div></td><td><div><div><p>W-22219018</p></div></div></td></tr><tr><td><div><div><p>The Jackson Databind library is upgraded to 2.21.4.</p></div></div></td><td><div><div><p>W-3300013</p></div></div></td></tr><tr><td><div><div><p>The OpenTelemetry API library is upgraded to 1.62.0.</p></div></div></td><td><div><div><p>W-22806027</p></div></div></td></tr><tr><td><div><div><p>The c3p0 library is upgraded to 0.14.1.</p></div></div></td><td><div><div><p>W-23012713</p></div></div></td></tr><tr><td><div><div><p>The Apache Neethi library is upgraded to 3.2.1.</p></div></div></td><td><div><div><p>W-22939389</p></div></div></td></tr><tr><td><div><div><p>The Apache CXF library is upgraded to 3.6.11.</p></div></div></td><td><div><div><p>W-23037617</p></div></div></td></tr><tr><td><div><div><p>The Rhino library is upgraded to 1.8.1.</p></div></div></td><td><div><div><p>W-22939391</p></div></div></td></tr><tr><td><div><div><p>The Log4j library is upgraded to 2.25.4.</p></div></div></td><td><div><div><p>W-22939403</p></div></div></td></tr><tr><td><div><div><p>The Reactor Netty library is upgraded to 1.2.18.</p></div></div></td><td><div><div><p>W-22939384</p></div></div></td></tr><tr><td><div><div><p>The Spring Framework is upgraded to 6.2.19.</p></div></div></td><td><div><div><p>W-22956997</p></div></div></td></tr><tr><td><div><div><p>The Netty library is upgraded to 4.2.15.Final.</p></div></div></td><td><div><div><p>W-22956998</p></div></div></td></tr><tr><td><div><div><p>The Bitronix Transaction Manager library is upgraded to 2.1.21.</p></div></div></td><td><div><div><p>W-22405007</p></div></div></td></tr></tbody></table>

DataWeave 2.9.16 is bundled with the Mule 4.9.19 release. This patch release addresses these
DataWeave issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>Scope resolution errors no longer occur when importing Java classes with self-referential array properties.</p></div></div></td><td><div><div><p>W-22914494</p></div></div></td></tr><tr><td><div><div><p><code>AvroReader</code> no longer causes memory leaks when processing Avro data in long-running flows.</p></div></div></td><td><div><div><p>W-22364385</p></div></div></td></tr></tbody></table>

For guidance with the patching process, see
[Apply Patch Updates](https://docs.mulesoft.com/release-notes/mule-runtime/patching-mule-versions#apply_patch_updates).

## June 2026

### What’s New

Runtime Manager agent:

- This release of Mule runtime 4.9.18 includes Runtime Manager agent 2.7.15. See
  [Runtime Manager Agent 2.7.15 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-15).

### Fixed Issues

Patch release version: 4.9.18

This patch update addresses these Mule issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>Connectivity testing of configurations in clustered deployments no longer uses distributed locks, preventing deadlocks.</p></div></div></td><td><div><div><p>W-22248198</p></div></div></td></tr><tr><td><div><div><p>Fatal errors such as <code>StackOverflowError</code> are now logged instead of being consumed by internal error handling.</p></div></div></td><td><div><div><p>W-22496803</p></div></div></td></tr><tr><td><div><div><p>Mule no longer hangs during shutdown when a parameter validation exception occurs during flow execution.</p></div></div></td><td><div><div><p>W-22248534</p></div></div></td></tr><tr><td><div><div><p>Race conditions in <code>outerFluxCompletionScheduler</code> no longer occur during graceful shutdown.</p></div></div></td><td><div><div><p>W-22343018</p></div></div></td></tr><tr><td><div><div><p>The ObjectStore retrieved from the Registry in <code>OAuthHandler</code> is now properly initialized and started.</p></div></div></td><td><div><div><p>W-22373641</p></div></div></td></tr><tr><td><div><div><p>SDK parameter validation errors now raise the <code>MULE:VALIDATION</code> error type instead of <code>MULE:UNKNOWN</code>.</p></div></div></td><td><div><div><p>W-22276522</p></div></div></td></tr><tr><td><div><div><p>Race conditions during policy redeployment that caused Mule to stop processing events permanently no longer occur.</p></div></div></td><td><div><div><p>W-22343705</p></div></div></td></tr><tr><td><div><div><p><code>ConcurrentModificationException</code> errors no longer occur when multiple plugins with shared dependencies are deployed simultaneously.</p></div></div></td><td><div><div><p>W-21193046</p></div></div></td></tr><tr><td><div><div><p>Cluster encryption now uses the configured algorithm correctly instead of defaulting to Blowfish.</p></div></div></td><td><div><div><p>W-21666905</p></div></div></td></tr><tr><td><div><div><p>The error type in the EE Cache scope is now correctly reported as <code>MULE:RETRY_EXHAUSTED</code> instead of <code>EE:RETRY_EXHAUSTED</code> when until-successful exhausts its retries.</p></div></div></td><td><div><div><p>W-21525972</p></div></div></td></tr><tr><td><div><div><p>Large Anypoint Platform authentication failure responses no longer cause excessive log bloat.</p></div></div></td><td><div><div><p>W-21882516</p></div></div></td></tr><tr><td><div><div><p>Persistent ObjectStore or Batch data serialized before a patch upgrade now deserializes correctly after upgrading.</p></div></div></td><td><div><div><p>W-22623626</p></div></div></td></tr><tr><td><div><div><p><code>OutOfMemory</code> errors no longer occur when establishing SSL connections with HTTP endpoints.</p></div></div></td><td><div><div><p>W-22547971</p></div></div></td></tr></tbody></table>

DataWeave 2.9.15 is bundled with the Mule 4.9.18 release. This patch release addresses these
DataWeave issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p><code>StackOverflowError</code> errors no longer occur when computing or converting type metadata for self-referencing recursive types.</p></div></div></td><td><div><div><p>W-21712344</p></div></div></td></tr><tr><td><div><div><p>The Java bean metadata cache no longer performs unnecessary evictions when processing Java POJOs. A new per-app Java bean cache can be enabled with the <code>per_app_java_bean_cache</code> compatibility flag.</p></div></div></td><td><div><div><p>W-22417507</p></div></div></td></tr></tbody></table>

For guidance with the patching process, see
[Apply Patch Updates](https://docs.mulesoft.com/release-notes/mule-runtime/patching-mule-versions#apply_patch_updates).

## May 2026

### What’s New

Runtime Manager agent:

- This release of Mule runtime 4.9.17 includes Runtime Manager agent 2.7.13. See
  [Runtime Manager Agent 2.7.13 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-13).

FIPS 140-3 Compliance Support:

- You can now configure Mule runtime to operate in a FIPS 140-3-compliant environment using
  certified cryptography providers. See
  [FIPS 140-3 Compliance Support](https://docs.mulesoft.com/mule-runtime/latest/fips-140-3-compliance-support) for more
  information.

General improvements:

- The `diaf` Event Dump now includes two additional `eventContextState` values: `PENDING` and
  `WAITING_NON_BLOCKING`. See
  [Mule Troubleshooting Plugin](https://docs.mulesoft.com/mule-runtime/latest/mule-troubleshooting-plugin) for more
  information.

### Fixed Issues

Patch release version: 4.9.17

This patch update addresses these Mule issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>Configuration references to configs defined in a parent domain are now properly validated at deployment time, preventing unclear runtime errors.</p></div></div></td><td><div><div><p>W-11453332</p></div></div></td></tr><tr><td><div><div><p>Extension operations using <code>@Content</code> parameters with complex map structures no longer fail to deploy.</p></div></div></td><td><div><div><p>W-18034452</p></div></div></td></tr><tr><td><div><div><p>The Grizzly HTTP library is upgraded to 2.3.36-MULE-029.</p></div></div></td><td><div><div><p>W-21337433</p></div></div></td></tr><tr><td><div><div><p>The plexus-utils library is upgraded to 4.0.3.</p></div></div></td><td><div><div><p>W-21774430</p></div></div></td></tr><tr><td><div><div><p>HTTP 304 (Not Modified) responses sent through the HTTP listener no longer include an incorrect Content-Length header.</p></div></div></td><td><div><div><p>W-21632770</p></div></div></td></tr><tr><td><div><div><p>The HTTP listener now gracefully handles non-RFC-compliant date formats in Set-Cookie <code>Expires</code> attributes.</p></div></div></td><td><div><div><p>W-21860840</p></div></div></td></tr><tr><td><div><div><p>The Netty library is upgraded to 4.2.12.Final.</p></div></div></td><td><div><div><p>W-21795152</p></div></div></td></tr><tr><td><div><div><p>In-memory Object Store partitions now correctly use cluster-wide storage when deployed to a cluster with the Object Store plugin enabled.</p></div></div></td><td><div><div><p>W-17714668</p></div></div></td></tr><tr><td><div><div><p>A memory leak in dynamic <code>flow-ref</code> resolution that could eventually lead to an <code>OutOfMemoryError</code> no longer occurs.</p></div></div></td><td><div><div><p>W-22013292</p></div></div></td></tr><tr><td><div><div><p>Deserialization errors no longer occur in Redis-backed Object Stores when accessing cached data created on an earlier Mule runtime version.</p></div></div></td><td><div><div><p>W-20880559</p></div></div></td></tr><tr><td><div><div><p>API Gateway contracts for public OAuth clients using PKCE are no longer dropped when the client secret is null.</p></div></div></td><td><div><div><p>W-21177224</p></div></div></td></tr><tr><td><div><div><p>The support-tools-installer is removed from the Mule runtime distribution.</p></div></div></td><td><div><div><p>W-21842339</p></div></div></td></tr></tbody></table>

DataWeave 2.9.14 is bundled with the Mule 4.9.17 release. This patch release addresses these
DataWeave issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p><code>atBeginningOfDay</code> now returns the midnight offset on DST days, instead of the input offset.</p></div></div></td><td><div><div><p>W-21614817</p></div></div></td></tr></tbody></table>

For guidance with the patching process, see
[Apply Patch Updates](https://docs.mulesoft.com/release-notes/mule-runtime/patching-mule-versions#apply_patch_updates).

## April 2026

### What’s New

Runtime Manager agent:

- This release of Mule runtime 4.9.16 includes Runtime Manager agent 2.7.11. See
  [Runtime Manager Agent 2.7.11 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-11).

Feature Flagging Mechanism:

- Mule 4.9 incorporates new feature flags. See
  [Feature Flagging Mechanism](https://docs.mulesoft.com/mule-runtime/latest/feature-flagging) for a detailed
  description of each feature flag and configuration instructions.

### Fixed Issues

Patch release version: 4.9.16

This patch update addresses these Mule issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>The c3p0 library is upgraded to 0.12.0.</p></div></div></td><td><div><div><p>W-21391116</p></div></div></td></tr><tr><td><div><div><p>The mchange-commons-java library is upgraded to 0.4.0.</p></div></div></td><td><div><div><p>W-21391115</p></div></div></td></tr><tr><td><div><div><p>The Jackson Core library is upgraded to 2.18.6.</p></div></div></td><td><div><div><p>W-21420104</p></div></div></td></tr><tr><td><div><div><p><code>NullPointerException</code> errors no longer occur in the Log4j boot configuration during application shutdown when shutdown callbacks are canceled while the Log4j context factory is disposing, which previously caused failures due to concurrent execution of <code>dispose()</code> and <code>cancel()</code>.</p></div></div></td><td><div><div><p>W-20256082</p></div></div></td></tr><tr><td><div><div><p>Until Successful scopes no longer continue retrying during application shutdown when using flow-ref.</p></div></div></td><td><div><div><p>W-20267296</p></div></div></td></tr><tr><td><div><div><p><code>NullPointerException: No Context at location</code> errors no longer occur when using operation policies with routers or scopes.</p></div></div></td><td><div><div><p>W-20791354</p></div></div></td></tr><tr><td><div><div><p>OAuth token storage now correctly uses custom <code>ObjectStores</code> (such as Redis) configured through the Object Store parameter when they’re registered in the application registry instead of the <code>ObjectStoreManager</code>.</p></div></div></td><td><div><div><p>W-19811593</p></div></div></td></tr><tr><td><div><div><p><code>Exception reached subscriber</code> errors no longer occur when combining interceptors and operation policies.</p></div></div></td><td><div><div><p>W-21250126</p></div></div></td></tr><tr><td><div><div><p>Scheduler jobs no longer deadlock during flow shutdown.</p></div></div></td><td><div><div><p>W-21263748</p></div></div></td></tr><tr><td><div><div><p>TLS Context can now be initialized during application deployment by using the <code>mule.enable.inline.tls.context.initialization</code> feature flag.</p></div></div></td><td><div><div><p>W-20038933</p></div></div></td></tr><tr><td><div><div><p>Netty no longer attempts to send more bytes than specified in the Content-Length header.</p></div></div></td><td><div><div><p>W-21184863</p></div></div></td></tr><tr><td><div><div><p>Netty server read timeouts now consider requests being read instead of requests being processed.</p></div></div></td><td><div><div><p>W-21321115</p></div></div></td></tr><tr><td><div><div><p>Netty HTTP Client no longer throws exceptions when a proxy server returns a 407 response and now returns the 407 response instead.</p></div></div></td><td><div><div><p>W-21465366</p></div></div></td></tr><tr><td><div><div><p>Netty response timeout behavior is now consistent with Grizzly.</p></div></div></td><td><div><div><p>W-21547186</p></div></div></td></tr><tr><td><div><div><p>Netty TLS connection failures now appear as DEBUG logs instead of WARN logs.</p></div></div></td><td><div><div><p>W-21428392</p></div></div></td></tr><tr><td><div><div><p>Netty HTTP Client now filters duplicate Content-Type headers.</p></div></div></td><td><div><div><p>W-21344116</p></div></div></td></tr><tr><td><div><div><p>The exception raised by Netty for unresolved addresses is now consistent with the Grizzly implementation.</p></div></div></td><td><div><div><p>W-21515340</p></div></div></td></tr></tbody></table>

DataWeave 2.9.13 is bundled with the Mule 4.9.16 release. This patch release addresses these
DataWeave issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>The Avro library is upgraded to 1.12.1. The Jackson Core library is upgraded to 2.21.1.</p></div></div></td><td><div><div><p>W-21415439</p></div></div></td></tr><tr><td><div><div><p>The Jakarta Mail library is upgraded to 2.1.5.</p></div></div></td><td><div><div><p>W-21320250</p></div></div></td></tr><tr><td><div><div><p>The range operator now returns null for invalid ranges.</p></div></div></td><td><div><div><p>W-21781423</p></div></div></td></tr></tbody></table>

For guidance with the patching process, see
[Apply Patch Updates](https://docs.mulesoft.com/release-notes/mule-runtime/patching-mule-versions#apply_patch_updates).

## March 2026

### What’s New

Runtime Manager agent:

- This release of Mule runtime 4.9.15 includes Runtime Manager agent 2.7.10. See
  [Runtime Manager Agent 2.7.10 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-10).

Feature Flagging Mechanism:

- Mule 4.9 incorporates new feature flags. See
  [Feature Flagging Mechanism](https://docs.mulesoft.com/mule-runtime/latest/feature-flagging) for a detailed
  description of each feature flag and configuration instructions.

### Fixed Issues

Patch release version: 4.9.15

This patch update addresses these Mule issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>The jakarta.mail library is upgraded to 1.6.8.</p></div></div></td><td><div><div><p>W-21138257</p></div></div></td></tr><tr><td><div><div><p>When the <code>mule.forcefulShutdown.dynamicConfig.disableStoppingCheck</code> system property is enabled, the dynamic configuration check is disabled during graceful shutdown.</p></div></div></td><td><div><div><p>W-20890587</p></div></div></td></tr><tr><td><div><div><p>When the <code>mule.forcefulShutdown.raiseCancelledError</code> feature flag is enabled, Mule runtime now raises a <code>MULE:CANCELLED</code> error instead of a <code>MULE:UNKNOWN</code> error if it attempts to create a dynamic configuration during shutdown.</p></div></div></td><td><div><div><p>W-20890613</p></div></div></td></tr><tr><td><div><div><p>Extensions no longer export <code>mule-sdk-api</code> and <code>jakarta</code> dependencies in the <code>mule-artifact.json</code> file.</p></div></div></td><td><div><div><p>W-21001749</p></div></div></td></tr><tr><td><div><div><p>Client certificates (optional) are no longer requested when no trust store is configured.</p></div></div></td><td><div><div><p>W-21220031</p></div></div></td></tr><tr><td><div><div><p>Public flows now stop concurrently during graceful shutdown.</p></div></div></td><td><div><div><p>W-21228085</p></div></div></td></tr><tr><td><div><div><p>Deadlocks no longer occur during log reconfiguration when policies are applied.</p></div></div></td><td><div><div><p>W-21231834</p></div></div></td></tr><tr><td><div><div><p>Errors that are not <code>MessagingException</code> errors are no longer silenced.</p></div></div></td><td><div><div><p>W-21043969</p></div></div></td></tr><tr><td><div><div><p>When the <code>mule.enableLogEventDumpOnShutdown</code> system property is enabled, the event dump is now logged during application shutdown.</p></div></div></td><td><div><div><p>W-21232374</p></div></div></td></tr><tr><td><div><div><p>The <code>"java.lang.IllegalStateException: The client must be started before use."</code> errors no longer occur when requesting an OAuth access token.</p></div></div></td><td><div><div><p>W-17689958</p></div></div></td></tr><tr><td><div><div><p>When the <code>mule.propagate.objectStore.customization.to.policies</code> feature flag is enabled, policies now respect their configured TTL when using Object Store v2.</p></div></div></td><td><div><div><p>W-21215761</p></div></div></td></tr><tr><td><div><div><p>The <code>"API is blocked (unavailable)"</code> log message no longer appears during policy updates without a corresponding unblocked message.</p></div></div></td><td><div><div><p>W-20633888</p></div></div></td></tr><tr><td><div><div><p>APIkit flows that use non-default names and are mapped through the <code>flow-mapping</code> parameter on <code>apikit:config</code> are now correctly counted as public flows instead of being treated as private.</p></div></div></td><td><div><div><p>W-18668900</p></div></div></td></tr></tbody></table>

DataWeave 2.9.12 is bundled with the Mule 4.9.15 release. This patch release addresses these
DataWeave issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>The Array range selector operator no longer experiences performance degradation.</p></div></div></td><td><div><div><p>W-20220578</p></div></div></td></tr><tr><td><div><div><p>Concurrent access to <code>KeyValuePairs</code> inside lazy materialized objects no longer causes unexpected behavior.</p></div></div></td><td><div><div><p>W-21045501</p></div></div></td></tr></tbody></table>

For guidance with the patching process, see
[Apply Patch Updates](https://docs.mulesoft.com/release-notes/mule-runtime/patching-mule-versions#apply_patch_updates).

## February 2026

### Patch 4.9.14

- This patch update reverts the fixes for these Mule issues: W-20618734 and W-20628990.

### Patch 4.9.13

### What’s New

Runtime Manager agent:

- This release of Mule runtime 4.9.13 includes Runtime Manager agent 2.7.9. See
  [Runtime Manager Agent 2.7.9 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-9).

### Fixed Issues

Patch release version: 4.9.13

This patch update addresses these Mule issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>Optimized the logging service to avoid creating unnecessary logging contexts when running a single application.</p></div></div></td><td><div><div><p>W-19965379</p></div></div></td></tr><tr><td><div><div><p>JDK Flight Recorder (JFR) is now disabled by default.</p></div></div></td><td><div><div><p>W-19990145</p></div></div></td></tr><tr><td><div><div><p>Implemented minor improvements to Mule classloading structures to enhance efficiency and stability.</p></div></div></td><td><div><div><p>W-20028988</p></div></div></td></tr><tr><td><div><div><p>Reduced memory consumption by removing deployment-specific objects after application deployment.</p></div></div></td><td><div><div><p>W-20053979</p></div></div></td></tr><tr><td><div><div><p>The Abstract Syntax Tree (AST) file of applications using the until-successful component is now leveraged by Mule runtime instead of parsing the configuration XML files.</p></div></div></td><td><div><div><p>W-20283146</p></div></div></td></tr><tr><td><div><div><p>Mule application unresponsiveness no longer occurs after a policy that uses the until-successful component is undeployed or redeployed.</p></div></div></td><td><div><div><p>W-20628990</p></div></div></td></tr><tr><td><div><div><p>Optimized the HTTP Service to avoid regenerating static attributes for every request when using Netty.</p></div></div></td><td><div><div><p>W-20615232</p></div></div></td></tr><tr><td><div><div><p>The io.netty:netty-bom library is upgraded to 4.2.9.Final.</p></div></div></td><td><div><div><p>W-3300013</p></div></div></td></tr><tr><td><div><div><p>The org.apache.logging.log4j:log4j-core library is upgraded to 2.25.3.</p></div></div></td><td><div><div><p>W-20679050</p></div></div></td></tr><tr><td><div><div><p>Fastutil is now replaced with fastutil-core.</p></div></div></td><td><div><div><p>W-20729870</p></div></div></td></tr></tbody></table>

DataWeave 2.9.11 is bundled with the Mule 4.9.13 release. This patch release addresses these
DataWeave issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>Starting in Mule runtime 4.6, you can now configure materialization settings (<code>mule.dw.enable_vars_materialization_pass</code>).</p></div></div></td><td><div><div><p>W-19580992</p></div></div></td></tr></tbody></table>

For guidance with the patching process, see
[Apply Patch Updates](https://docs.mulesoft.com/release-notes/mule-runtime/patching-mule-versions#apply_patch_updates).

## January 2026

### What’s New

Runtime Manager agent:

- This release of Mule runtime 4.9.12 includes Runtime Manager agent 2.7.9. See
  [Runtime Manager Agent 2.7.9 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-9).

MUnit:

- MUnit version 3.6.3 is now required. See
  [MUnit 3.6.3 Release Notes](https://docs.mulesoft.com/release-notes/munit/munit-3.6.3-release-notes).

General improvements:

- You can now view deployment information in the `diaf` file. See
  [Mule Troubleshooting Plugin](https://docs.mulesoft.com/mule-runtime/latest/mule-troubleshooting-plugin) for more
  information.

### Fixed Issues

Patch release version: 4.9.12

This patch update addresses these Mule issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>Batch jobs no longer hang when errors occur in steps that use try scopes with global error handlers.</p></div></div></td><td><div><div><p>W-17738563</p></div></div></td></tr><tr><td><div><div><p>Applications no longer become unresponsive after thread pool exhaustion when using Netty as the HTTP Service implementation with the Anypoint MQ Connector.</p></div></div></td><td><div><div><p>W-19806707</p></div></div></td></tr><tr><td><div><div><p>Design-time operations on primary content parameters with non-Java types now work correctly.</p></div></div></td><td><div><div><p>W-20187776</p></div></div></td></tr><tr><td><div><div><p>Logging information is now improved during graceful shutdown.</p></div></div></td><td><div><div><p>W-20278970</p></div></div></td></tr><tr><td><div><div><p>A deadlock between Log4j Mule log support during application initialization no longer occurs.</p></div></div></td><td><div><div><p>W-20419795</p></div></div></td></tr><tr><td><div><div><p>The HTTP Client can now establish an SSE source when the content-type header doesn’t exactly match <code>text/event-stream</code>.</p></div></div></td><td><div><div><p>W-20420476</p></div></div></td></tr><tr><td><div><div><p>MUnit tests no longer fail intermittently when running on Java 17.</p></div></div></td><td><div><div><p>W-17044721</p></div></div></td></tr><tr><td><div><div><p>Batch processing no longer fails with serialization error when LDAP action throws an error in Java 17.</p></div></div></td><td><div><div><p>W-19524600</p></div></div></td></tr><tr><td><div><div><p>Dynamic configurations now work correctly during initialization when using <code>hashCode</code> and <code>equals</code> methods on a <code>TLSConfiguration</code> class.</p></div></div></td><td><div><div><p>W-18835469</p></div></div></td></tr></tbody></table>

DataWeave 2.9.10 is bundled with the Mule 4.9.12 release. This patch release addresses these
DataWeave issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>Functions now materialize correctly when the function body contains a single <code>var</code> declaration.</p></div></div></td><td><div><div><p>W-20365331</p></div></div></td></tr><tr><td><div><div><p>The stream reader now processes input with multi-byte characters correctly.</p></div></div></td><td><div><div><p>W-20016549</p></div></div></td></tr></tbody></table>

For guidance with the patching process, see
[Apply Patch Updates](https://docs.mulesoft.com/release-notes/mule-runtime/patching-mule-versions#apply_patch_updates).

## November 2025

### What’s New

Runtime Manager agent:

- This release of Mule runtime 4.9.11 includes Runtime Manager agent 2.7.8. See
  [Runtime Manager Agent 2.7.8 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-8).

General improvements:

- You can now view CPU usage information in the `diaf` file. See
  [Mule Troubleshooting Plugin](https://docs.mulesoft.com/mule-runtime/latest/mule-troubleshooting-plugin) for more
  information.

### Fixed Issues

Patch release version: 4.9.11

This patch update addresses these Mule issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>OpenTelemetry current API sampling decisions now propagate correctly through <code>http:requester</code> calls to downstream APIs.</p></div></div></td><td><div><div><p>W-19784910</p></div></div></td></tr><tr><td><div><div><p><code>UndeclaredThrowableException</code> errors no longer occur during Bitronix reconnection.</p></div></div></td><td><div><div><p>W-15196888</p></div></div></td></tr><tr><td><div><div><p><code>InaccessibleObjectException</code> errors no longer occur during deployment when the <code>mule.classloading.verbose</code> property is set.</p></div></div></td><td><div><div><p>W-18563387</p></div></div></td></tr><tr><td><div><div><p>MDC information is now properly preserved when using loggers inside custom Java code invoked from a DataWeave script.</p></div></div></td><td><div><div><p>W-18912999</p></div></div></td></tr><tr><td><div><div><p>Batch queuestore files now clean up correctly in rare load failure scenarios such as out-of-memory errors.</p></div></div></td><td><div><div><p>W-17935223</p></div></div></td></tr><tr><td><div><div><p>Builds no longer fail when running tests from an extension that uses Mule SDK with Java 8 through Java 17.</p></div></div></td><td><div><div><p>W-18964335</p></div></div></td></tr><tr><td><div><div><p>Starvation no longer occurs when sending HTTP responses that are generated slowly.</p></div></div></td><td><div><div><p>W-1982570</p></div></div></td></tr><tr><td><div><div><p>The until-successful scope now honors the graceful shutdown timeout. To enable this behavior, set these system properties: <code>mule.untilSuccessful.retryOnCriticalError.disallow=true</code> and <code>mule.forcefulShutdown.raiseCancelledError=true</code>.</p></div></div></td><td><div><div><p>W-19648397</p></div></div></td></tr><tr><td><div><div><p>Hashing now uses <code>toHex</code> conversion to prevent “null character” or other invalid characters from being used as IDs in the redelivery policy. This change is feature-flagged. To enable it in version 4.9, set the <code>mule.redeliveryPolicy.encode.secureHash</code> system property to <code>true</code>.</p></div></div></td><td><div><div><p>W-18584560</p></div></div></td></tr><tr><td><div><div><p><code>IllegalAccessException</code> errors no longer occur when DataWeave serializes <code>error.errorMessage</code> in a Scatter-Gather error route.</p></div></div></td><td><div><div><p>W-19340663</p></div></div></td></tr><tr><td><div><div><p>Mule applications that use TLS KeyStore configurations no longer fail to deploy with “NO MODEL RESOLVED” warnings and <code>ConfigurationException</code> errors.</p></div></div></td><td><div><div><p>W-16565012</p></div></div></td></tr><tr><td><div><div><p>Mule Troubleshooting Plugin executions no longer fail when the IP address changes.</p></div></div></td><td><div><div><p>W-19802474</p></div></div></td></tr><tr><td><div><div><p>SSE clients can now parse <code>events</code> that do not include an event field. These events now default to <code>message</code>, as described in the specification.</p></div></div></td><td><div><div><p>W-19667148</p></div></div></td></tr><tr><td><div><div><p>The reactor.netty library is upgraded to 1.2.10.</p></div></div></td><td><div><div><p>W-17264514</p></div></div></td></tr><tr><td><div><div><p>The netty library is upgraded to 4.2.7.Final.</p></div></div></td><td><div><div><p>W-19995637</p></div></div></td></tr><tr><td><div><div><p>The spring-core library is upgraded to 6.2.11.</p></div></div></td><td><div><div><p>W-19674953</p></div></div></td></tr></tbody></table>

DataWeave 2.9.9 is bundled with the Mule 4.9.11 release. This patch release addresses these
DataWeave issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>The Apache Commons Lang dependency is removed from the distribution.</p></div></div></td><td><div><div><p>W-19803454</p></div></div></td></tr><tr><td><div><div><p>Materialization errors no longer occur when running functions.</p></div></div></td><td><div><div><p>W-19884071</p></div></div></td></tr><tr><td><div><div><p>Single variable materialization now works correctly for <code>unsafe</code> and <code>exists</code> selectors.</p></div></div></td><td><div><div><p>W-19581017</p></div></div></td></tr><tr><td><div><div><p>Each variable is now extracted from <code>vars</code>, allowing its materialization to be managed individually. The <code>mule.dw.enable_vars_materialization_pass</code> compatibility flag is added to preserve the previous materialization behavior.</p></div></div></td><td><div><div><p>W-19580992 / W-17167283</p></div></div></td></tr></tbody></table>

For guidance with the patching process, see
[Apply Patch Updates](https://docs.mulesoft.com/release-notes/mule-runtime/patching-mule-versions#apply_patch_updates).

## October 2025

### What’s New

Runtime Manager agent:

- This release of Mule runtime 4.9.10 includes Runtime Manager agent 2.7.7. See
  [Runtime Manager Agent 2.7.7 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-7).

Mule Troubleshooting Plugin:

- Mule 4.9.10 introduces the Mule Troubleshooting plugin, which generates a structured diagnostic
  archive (DIAF) to simplify troubleshooting, consolidate runtime metrics, and provide consistent
  data for MuleSoft Support. It works across all deployment models and helps investigate performance
  issues, application errors, and scheduler activity. See
  [Mule Troubleshooting Plugin](https://docs.mulesoft.com/mule-runtime/latest/mule-troubleshooting-plugin) for more
  information.

### Fixed Issues

Patch release version: 4.9.10

This patch update addresses these Mule issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>Memory leaks no longer occur when a reconnection is configured in a Mule domain and referenced from multiple applications.</p></div></div></td><td><div><div><p>W-17857080</p></div></div></td></tr><tr><td><div><div><p><code>InaccessibleObjectException</code> errors no longer occur when using cluster mode on Java 17.</p></div></div></td><td><div><div><p>W-18667744</p></div></div></td></tr><tr><td><div><div><p>Fork-join routers no longer create unnecessary schedules when the timeout is set to infinite.</p></div></div></td><td><div><div><p>W-18347293</p></div></div></td></tr><tr><td><div><div><p>Potential deadlocks during deployment no longer occur when using some custom Log4j appenders.</p></div></div></td><td><div><div><p>W-19675881</p></div></div></td></tr><tr><td><div><div><p>Cookies now propagate correctly across multiple redirect scenarios.</p></div></div></td><td><div><div><p>W-18971065</p></div></div></td></tr><tr><td><div><div><p>The Netty library is upgraded to 4.1.124.Final.</p></div></div></td><td><div><div><p>W-19341592</p></div></div></td></tr><tr><td><div><div><p>The Handlebars library is upgraded to 4.4.0.</p></div></div></td><td><div><div><p>W-19064659</p></div></div></td></tr><tr><td><div><div><p>The org.apache.commons : commons-lang3 library is upgraded to 3.17.0.</p></div></div></td><td><div><div><p>W-19383955</p></div></div></td></tr><tr><td><div><div><p>The io.netty : netty-codec library is upgraded to 4.1.127.Final.</p></div></div></td><td><div><div><p>W-19568278</p></div></div></td></tr><tr><td><div><div><p>The org.springframework : spring-core library is upgraded to 6.2.10.</p></div></div></td><td><div><div><p>W-19353311</p></div></div></td></tr><tr><td><div><div><p>The org.apache.cxf:cxf-core library is now upgraded to 3.5.11.</p></div></div></td><td><div><div><p>W-17264514</p></div></div></td></tr><tr><td><div><div><p>The <code>org.mule.runtime.api.serialization.SerializationException: Could not deserialize object</code> errors no longer occur when processing the payload of a Query XML stream using transfer message in a Choice Router.</p></div></div></td><td><div><div><p>W-18902280</p></div></div></td></tr><tr><td><div><div><p>Scheduler name generation no longer breaks the platform logging aggregator when processor chains have null or empty names.</p></div></div></td><td><div><div><p>W-19432758</p></div></div></td></tr><tr><td><div><div><p>SSE clients now parse events that don’t include an <code>event</code> field. They default to <code>message</code> as described in the spec.</p></div></div></td><td><div><div><p>W-19667148</p></div></div></td></tr><tr><td><div><div><p>Possible starvation no longer occurs when sending HTTP responses that are generated slowly.</p></div></div></td><td><div><div><p>W-19471841</p></div></div></td></tr><tr><td><div><div><p>Gatekeeper deadlock errors no longer occur during race conditions between contract downloads and policy application.</p></div></div></td><td><div><div><p>W-19407164</p></div></div></td></tr></tbody></table>

DataWeave 2.9.8 is bundled with the Mule 4.9.10 release. This patch release addresses these
DataWeave issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>The <code>take</code> function now works with streaming when argument is larger than the array length.</p></div></div></td><td><div><div><p>W-19168279</p></div></div></td></tr><tr><td><div><div><p><code>java-module</code> now supports object fields access when using different capitalizations.</p></div></div></td><td><div><div><p>W-19477334</p></div></div></td></tr></tbody></table>

For guidance with the patching process, see
[Apply Patch Updates](https://docs.mulesoft.com/release-notes/mule-runtime/patching-mule-versions#apply_patch_updates).

## September 2025

### What’s New

Runtime Manager agent:

- This release of Mule runtime 4.9.9 includes Runtime Manager agent 2.7.7. See
  [Runtime Manager Agent 2.7.7 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-7).

### Fixed Issues

Patch release version: 4.9.9

This patch update addresses the following Mule issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>TLS configuration for FIPS-140-2 is now upgraded.</p></div></div></td><td><div><div><p>W-16315176</p></div></div></td></tr><tr><td><div><div><p>Applications using Scheduler component in a strict FIPS-140-2 environment no longer fail to deploy due to the unavailability of the MD5 algorithm.</p></div></div></td><td><div><div><p>W-19319437</p></div></div></td></tr><tr><td><div><div><p>io.projectreactor.netty : reactor-netty-http is upgraded to 1.2.8.</p></div></div></td><td><div><div><p>W-19074903</p></div></div></td></tr><tr><td><div><div><p>Component annotations, such as <code>location</code>, are no longer overwritten by other components.</p></div></div></td><td><div><div><p>W-18269859</p></div></div></td></tr><tr><td><div><div><p>org.apache.commons : commons-lang3 is upgraded to 3.18.0.</p></div></div></td><td><div><div><p>W-19059553</p></div></div></td></tr></tbody></table>

DataWeave 2.9.7 is bundled with the Mule 4.9.9 release. This patch release addresses the following
DataWeave issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>A memory leak during Weave type schema resolution is now fixed.</p></div></div></td><td><div><div><p>W-19389019</p></div></div></td></tr><tr><td><div><div><p>Potential deadlocks no longer occur when increasing concurrency while parsing DataWeave scripts.</p></div></div></td><td><div><div><p>W-19376546</p></div></div></td></tr></tbody></table>

For guidance with the patching process, see
[Apply Patch Updates](https://docs.mulesoft.com/release-notes/mule-runtime/patching-mule-versions#apply_patch_updates).

## August 2025

### What’s New

Runtime Manager agent:

- This release of Mule runtime 4.9.8 includes Runtime Manager agent 2.7.6. See
  [Runtime Manager Agent 2.7.6 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-6).

General improvements:

- License Delivery Update: Starting with Mule 4.9.8, Enterprise licenses are now provided either as
  a single `license.lic` file or as a `.zip` that contains both FIPS and non-FIPS licenses. See
  [FIPS 140-2 Compliance Support](https://docs.mulesoft.com/mule-runtime/latest/fips-140-2-compliance-support) for
  details.

General improvements:

- When running Mule runtime in FIPS security mode with clustering enabled, the encryption key
  defined in `mule.cluster.network.encryption.key` must have a length of 16, 24, or 32 bytes. See
  [Enable Clustering in FIPS Mode](https://docs.mulesoft.com/on-premises/latest/mule-high-availability-ha-clusters#cluster_fips)
  for details.

### Fixed Issues

Patch release version: 4.9.8

This patch update addresses the following Mule issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>Silent errors and hangs no longer occur when a component fails to start within a foreach/subflow combination.</p></div></div></td><td><div><div><p>W-18589595</p></div></div></td></tr><tr><td><div><div><p>An incorrect error level message no longer shows during deployment when using APIKit with no flow mappings.</p></div></div></td><td><div><div><p>W-19004884</p></div></div></td></tr><tr><td><div><div><p>Logging behavior when combining properties and expressions is reverted to the previous behavior.</p></div></div></td><td><div><div><p>W-18822321</p></div></div></td></tr><tr><td><div><div><p>Performance degradation no longer occurs when using repeatable streaming.</p></div></div></td><td><div><div><p>W-19175330</p></div></div></td></tr><tr><td><div><div><p>OAuth token is now refreshed when used through <code>ExtensionClient</code>.</p></div></div></td><td><div><div><p>W-19248279</p></div></div></td></tr></tbody></table>

DataWeave 2.9.6 is bundled with the Mule 4.9.8 release. This patch release addresses the following
DataWeave issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>A <code>stackOverflowException</code> error no longer occurs during materialization.</p></div></div></td><td><div><div><p>W-18981240</p></div></div></td></tr><tr><td><div><div><p>The <code>distinctBy</code> function in <code>dw::core::Core</code> now works as expected when used with a CSV input.</p></div></div></td><td><div><div><p>W-18990604</p></div></div></td></tr><tr><td><div><div><p>DataWeave runtime types are now correctly written when outputting Java.</p></div></div></td><td><div><div><p>W-18942349</p></div></div></td></tr><tr><td><div><div><p>Access to multipart content raw value no longer reads the part content.</p></div></div></td><td><div><div><p>W-18892158</p></div></div></td></tr><tr><td><div><div><p>The <code>sizeOf</code> function now works correctly in DataWeave 2.6.14 and later.</p></div></div></td><td><div><div><p>W-18850597</p></div></div></td></tr><tr><td><div><div><p>The <code>orderBy</code> function now evaluates ordering criteria only when required.</p></div></div></td><td><div><div><p>W-18851259</p></div></div></td></tr></tbody></table>

For guidance with the patching process, see
[Apply Patch Updates](https://docs.mulesoft.com/release-notes/mule-runtime/patching-mule-versions#apply_patch_updates).

## July 2025

### What’s New

Runtime Manager agent:

- This release of Mule runtime 4.9.7 includes Runtime Manager agent 2.7.5. See
  [Runtime Manager Agent 2.7.5 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-5).

### Fixed Issues

Patch release version: 4.9.7

This patch update addresses the following Mule issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>DataWeave now correctly serializes <code>CompositeRoutingException</code> to JSON.</p></div></div></td><td><div><div><p>W-16562974</p></div></div></td></tr><tr><td><div><div><p>The Parser Template now correctly resolves placeholder expressions.</p></div></div></td><td><div><div><p>W-16761707</p></div></div></td></tr><tr><td><div><div><p>The commons-beanutils:commons-beanutils library is upgraded to v1.11.0.</p></div></div></td><td><div><div><p>W-18687846</p></div></div></td></tr><tr><td><div><div><p>Repeatable streams now make data available before the buffer is full. To enable this behavior, set the system property <code>mule.repeatableStreaming.bytes.eagerRead</code> to <code>true</code>.</p></div></div></td><td><div><div><p>W-18716253</p></div></div></td></tr><tr><td><div><div><p>Schedulers are no longer triggered during graceful shutdown.</p></div></div></td><td><div><div><p>W-17981248</p></div></div></td></tr><tr><td><div><div><p>OAuth logging is now added when doing token update.</p></div></div></td><td><div><div><p>W-18622349</p></div></div></td></tr><tr><td><div><div><p>Serialization now works correctly with API Gateway internal classes.</p></div></div></td><td><div><div><p>W-18475283</p></div></div></td></tr></tbody></table>

DataWeave 2.9.5 is bundled with the Mule 4.9.7 release. This patch release addresses the following
DataWeave issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>This patch update reverts the fix.</p></div></div></td><td><div><div><p>W-17167283</p></div></div></td></tr><tr><td><div><div><p>XML encoding detection now works correctly when the declaration header is missing.</p></div></div></td><td><div><div><p>W-18853667</p></div></div></td></tr><tr><td><div><div><p>The <code>fromCharCode</code> function in <code>dw::core::Strings.</code> now manages surrogate characters correctly.</p></div></div></td><td><div><div><p>W-17204482</p></div></div></td></tr><tr><td><div><div><p>Unicode characters now render correctly at the beginning of the string when using the DataWeave <code>writer</code> function with the <code>onlyData</code> flag enabled.</p></div></div></td><td><div><div><p>W-14855645</p></div></div></td></tr><tr><td><div><div><p>The Apache POI library is now upgraded.</p></div></div></td><td><div><div><p>W-18253747</p></div></div></td></tr><tr><td><div><div><p>Experimental warning messages are no longer logged on DataWeave SDK files.</p></div></div></td><td><div><div><p>W-16384926</p></div></div></td></tr></tbody></table>

For guidance with the patching process, see
[Apply Patch Updates](https://docs.mulesoft.com/release-notes/mule-runtime/patching-mule-versions#apply_patch_updates).

## June 2025

### What’s New

Runtime Manager agent:

- This release of Mule runtime 4.9.6 includes Runtime Manager agent 2.7.4. See
  [Runtime Manager Agent 2.7.4 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-4).

General improvements:

- Log4J is upgraded to 2.24.3.

### Fixed Issues

Patch release version: 4.9.6

This patch update addresses the following Mule issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>Loader constraint violation errors no longer occur when <code>http-connector</code> dependencies exist in both the domain and the policy.</p></div></div></td><td><div><div><p>W-17340911</p></div></div></td></tr><tr><td><div><div><p>Serialization of result objects with Kryo no longer fails with <code>InaccessibleObjectException</code> in Java 17.</p></div></div></td><td><div><div><p>W-17774685</p></div></div></td></tr><tr><td><div><div><p>Class loading no longer results in deadlocks caused by a race condition.</p></div></div></td><td><div><div><p>W-18388443</p></div></div></td></tr><tr><td><div><div><p>A serialization exception no longer occurs when using caching scope.</p></div></div></td><td><div><div><p>W-17703164</p></div></div></td></tr><tr><td><div><div><p>A classloader leak no longer occurs on undeployment when using lazy service initialization.</p></div></div></td><td><div><div><p>W-17750750</p></div></div></td></tr><tr><td><div><div><p>The <code>mule.parse.template.use.legacy.default.targetValue</code> compatibility switch is reintroduced to use the legacy default value for the <code>targetValue</code> parameter of the <code>parse-template</code> component. A one-time warning is now logged when enabled.</p></div></div></td><td><div><div><p>W-18324755</p></div></div></td></tr><tr><td><div><div><p>Preemtive analytics queue deletion is now added.</p></div></div></td><td><div><div><p>W-17529530</p></div></div></td></tr></tbody></table>

DataWeave 2.9.4 is bundled with the Mule 4.9.6 release. This patch release addresses the following
DataWeave issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>XML encoding is now detected before selecting a parser.</p></div></div></td><td><div><div><p>W-17637749</p></div></div></td></tr><tr><td><div><div><p>The performance of the <code>orderBy</code> function is now improved.</p></div></div></td><td><div><div><p>W-18439576</p></div></div></td></tr><tr><td><div><div><p>Reading a CSV file inside a MultiPart body now works correctly when performed more than once.</p></div></div></td><td><div><div><p>W-17147598</p></div></div></td></tr><tr><td><div><div><p>A memory leak of the binding context no longer occurs when using the <code>foreach</code> scope.</p></div></div></td><td><div><div><p>W-18472194</p></div></div></td></tr><tr><td><div><div><p><code>CompilationResult</code> no longer retains a reference to the execution frame, which previously caused a memory leak.</p></div></div></td><td><div><div><p>W-18288980</p></div></div></td></tr></tbody></table>

For guidance with the patching process, see
[Apply Patch Updates](https://docs.mulesoft.com/release-notes/mule-runtime/patching-mule-versions#apply_patch_updates).

## May 2025

### Patch 4.9.5

The May patch update 4.9.5 addresses a regression in the previous May patch update, 4.9.4, and
includes the fixes in the patch.

Patch release version: 4.9.5

This patch update addresses the following Mule issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>Cluster discovery mechanism now works as expected on Runtime Fabric, CloudHub 2.0, and Anypoint Platform PCE environments, ensuring that schedulers are executed only on the primary node.</p></div></div></td><td><div><div><p>W-18528551</p></div></div></td></tr></tbody></table>

For guidance with the patching process, see
[Apply Patch Updates](https://docs.mulesoft.com/release-notes/mule-runtime/patching-mule-versions#apply_patch_updates).

### Patch 4.9.4

### What’s New

Runtime Manager agent:

- This release of Mule runtime 4.9.4 includes Runtime Manager agent 2.7.2. See
  [Runtime Manager Agent 2.7.2 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-2).

### Fixed Issues

Patch release version: 4.9.4

This patch update addresses the following Mule issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>Parallel For Each events no longer randomly timeout after a <code>NullPointerException</code> error.</p></div></div></td><td><div><div><p>W-17980769</p></div></div></td></tr><tr><td><div><div><p>The error message "Couldn’t parse instance of ReentrantReadWriteLock" in ReentrantReadWriteLockSerializer no longer occurs.</p></div></div></td><td><div><div><p>W-18057570</p></div></div></td></tr><tr><td><div><div><p>Parameters field isn’t serialized in <code>InternalEventImplementation</code>.</p></div></div></td><td><div><div><p>W-17703164</p></div></div></td></tr><tr><td><div><div><p>Connectivity tests in MTS are now fixed for Java 17.</p></div></div></td><td><div><div><p>W-18075077</p></div></div></td></tr><tr><td><div><div><p>Exceptions no longer occur when using WebSocket close codes outside a predefined subset. The code now correctly handles all standard/custom WebSocket close codes.</p></div></div></td><td><div><div><p>W-17846088</p></div></div></td></tr><tr><td><div><div><p>Configuration for <code>preserveHeaderCase</code> is now added in <code>SseSource</code>.</p></div></div></td><td><div><div><p>W-18085890</p></div></div></td></tr><tr><td><div><div><p><code>DefaultMessageBuilder</code> no longer contains missing fields.</p></div></div></td><td><div><div><p>W-17607446</p></div></div></td></tr><tr><td><div><div><p>Contention between transaction and APIkit is now avoided due to tracing initialization.</p></div></div></td><td><div><div><p>W-18194349</p></div></div></td></tr><tr><td><div><div><p>A schedule is now added to consume the slowly populated pipe to an IO Executor.</p></div></div></td><td><div><div><p>W-17444122</p></div></div></td></tr><tr><td><div><div><p>org.glassfish:jakarta.json was removed form the distribution.</p></div></div></td><td><div><div><p>W-17896357</p></div></div></td></tr><tr><td><div><div><p>com.google.code.gson:gson is upgraded to 2.12.1.</p></div></div></td><td><div><div><p>W-17896347</p></div></div></td></tr><tr><td><div><div><p>com.google.protobuf:protobuf-java is upgraded to v3.25.6.</p></div></div></td><td><div><div><p>W-17986761</p></div></div></td></tr><tr><td><div><div><p>Custom notifications are now properly dispatched.</p></div></div></td><td><div><div><p>W-16091925</p></div></div></td></tr></tbody></table>

DataWeave 2.9.3 is bundled with the Mule 4.9.4 release. This patch release addresses the following
DataWeave issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>Materialization issues no longer occur when using CSV content inside variables.</p></div></div></td><td><div><div><p>W-17167283</p></div></div></td></tr><tr><td><div><div><p>DataWeave now preserves trailing zeroes of single-element sum.</p></div></div></td><td><div><div><p>W-17283050</p></div></div></td></tr><tr><td><div><div><p>A compatibility flag is now added to address the different results produced by calling <code>sizeOf</code> with <code>NumberType</code>.</p></div></div></td><td><div><div><p>W-18020856</p></div></div></td></tr><tr><td><div><div><p>An unnecessary import is now removed from <code>dw::util::Diff</code> to eliminate a warning when running MUnit.</p></div></div></td><td><div><div><p>W-17670504</p></div></div></td></tr><tr><td><div><div><p>DataWeave no longer returns a format error on <code>readUnquotedString</code>.</p></div></div></td><td><div><div><p>W-18118138</p></div></div></td></tr><tr><td><div><div><p>Overflowing no longer occurs while reading large file on multipart format.</p></div></div></td><td><div><div><p>W-17644871</p></div></div></td></tr><tr><td><div><div><p>Performance issues no longer occur when using Message in DataWeave scripts.</p></div></div></td><td><div><div><p>W-18034217</p></div></div></td></tr></tbody></table>

For guidance with the patching process, see
[Apply Patch Updates](https://docs.mulesoft.com/release-notes/mule-runtime/patching-mule-versions#apply_patch_updates).

## April 2025

### What’s New

Runtime Manager agent:

- This release of Mule runtime 4.9.3 includes Runtime Manager agent 2.7.2. See
  [Runtime Manager Agent 2.7.2 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-2).

Enterprise Edition License:

- The command `mule -verifyLicenseDetails [path_to_license]` that verifies the license before
  installing it is now added. See
  [Verify or Remove Enterprise Edition License](https://docs.mulesoft.com/on-premises/latest/installing-an-enterprise-license#verify-or-remove-enterprise-edition-license).

MuleSoft Government Cloud support coverage:

- Government Cloud now supports Mule runtime 4.9. See
  [Features Included in Government Cloud](https://docs.mulesoft.com/gov-cloud/#features-included-in-government-cloud).

### Fixed Issues

Patch release version: 4.9.3

This patch update addresses the following Mule issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>The Netty codec library is now updated to 4.1.119.Final.</p></div></div></td><td><div><div><p>W-17980407</p></div></div></td></tr><tr><td><div><div><p>You can now use the <code>mule --verifyLicenseDetails [path-to-license.lic]</code> command to verify a given license file.</p></div></div></td><td><div><div><p>W-17340620</p></div></div></td></tr><tr><td><div><div><p><code>DuplicateMessageException</code> is now correctly serialized with Kryo.</p></div></div></td><td><div><div><p>W-17844603</p></div></div></td></tr><tr><td><div><div><p>Error type in raise-error is now correctly resolved when defined with a static property.</p></div></div></td><td><div><div><p>W-17339304</p></div></div></td></tr><tr><td><div><div><p><code>org.apache.cxf:cxf-core</code> is now upgraded to version 3.5.10.</p></div></div></td><td><div><div><p>W-17896358</p></div></div></td></tr><tr><td><div><div><p>The mule-sdk-api dependency now contains all the required license information.</p></div></div></td><td><div><div><p>W-18033237</p></div></div></td></tr></tbody></table>

DataWeave 2.9.2 is bundled with the Mule 4.9.3 release. This patch release addresses the following
DataWeave issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>Concurrency issues no longer occur when loading modules.</p></div></div></td><td><div><div><p>W-17918619</p></div></div></td></tr><tr><td><div><div><p>The flat file module no longer fails when loading files with a nested depth greater than 50.</p></div></div></td><td><div><div><p>W-17495145</p></div></div></td></tr><tr><td><div><div><p><code>xerces-j</code> is now updated to 2.12.2.</p></div></div></td><td><div><div><p>W-16918194</p></div></div></td></tr></tbody></table>

For guidance with the patching process, see
[Apply Patch Updates](https://docs.mulesoft.com/release-notes/mule-runtime/patching-mule-versions#apply_patch_updates).

## March 2025

### What’s New

Runtime Manager agent:

- This release of Mule runtime 4.9.2 includes Runtime Manager agent 2.6.7. See
  [Runtime Manager Agent 2.6.7 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.6.x-release-notes#2-6-7).

Feature Flagging Mechanism:

- Mule 4.9 incorporates new feature flags. See
  [Feature Flagging Mechanism](https://docs.mulesoft.com/mule-runtime/latest/feature-flagging) for a detailed
  description of each feature flag and configuration instructions.

### Fixed Issues

Patch release version: 4.9.2

This patch update addresses the following Mule issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>Resources are now properly released after a timeout when using the Scatter-Gather or Parallel For Each routers. The <code>mule.forkJoin.completeChildContextsOnTimeout</code> feature flag is now added to enable this behavior.</p></div></div></td><td><div><div><p>W-16941297</p></div></div></td></tr><tr><td><div><div><p><code>MessagingException</code> can now be converted to JSON using DataWeave.</p></div></div></td><td><div><div><p>W-16629236</p></div></div></td></tr><tr><td><div><div><p>Performance degradation no longer occurs when the <code>nonBlockingWriter</code> is enabled for response streaming.</p></div></div></td><td><div><div><p>W-17627284</p></div></div></td></tr><tr><td><div><div><p>A race condition introduced by W-17048606 no longer occurs, where the last part of the response body was truncated when <code>streamResponse</code> flag is set to true in <code>request-connection</code>.</p></div></div></td><td><div><div><p>W-17617940</p></div></div></td></tr><tr><td><div><div><p><code>grizzly-ahc</code> is now upgraded in HTTP Service.</p></div></div></td><td><div><div><p>W-17667949</p></div></div></td></tr><tr><td><div><div><p>When using <code>sdk-api</code> version of <code>@Connection</code> and <code>ConnectionProvider</code> in a source, a validation saying that <code>@Connection</code> can only be used with the extensions-api version of <code>ConnectionProvider</code> is no longer triggered.</p></div></div></td><td><div><div><p>W-17559243</p></div></div></td></tr><tr><td><div><div><p>Kryo serialization issue no longer occurs in Java 17 when running with distributed cluster using authentication, caching policy, and persistent Object Store.</p></div></div></td><td><div><div><p>W-16912085</p></div></div></td></tr><tr><td><div><div><p>Performance during cache scope execution is now improved.</p></div></div></td><td><div><div><p>W-17671126</p></div></div></td></tr><tr><td><div><div><p>The <code>com.hazelcast:hazelcast</code> dependency is downgraded to 5.2.5.</p></div></div></td><td><div><div><p>W-17905862</p></div></div></td></tr></tbody></table>

DataWeave 2.9.1 is bundled with the Mule 4.9.2 release. This patch release addresses the following
DataWeave issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>The Java reflection lookup strategy is now improved for bean instances.</p></div></div></td><td><div><div><p>W-17624594</p></div></div></td></tr><tr><td><div><div><p>Consuming values now work as expected when using overloaded materialized functions.</p></div></div></td><td><div><div><p>W-17588914</p></div></div></td></tr></tbody></table>

For guidance with the patching process, see
[Apply Patch Updates](https://docs.mulesoft.com/release-notes/mule-runtime/patching-mule-versions#apply_patch_updates).

## February 2025

### Patch 4.9.1

The February patch update 4.9.1 addresses a regression in the previous February patch update, 4.9.0,
and includes the fixes in the patch.

Patch release version: 4.9.1

This patch update addresses the following Mule issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p><code>ConfigurationException</code> no longer occurs while performing Amazon DynamoDB Connector operations.</p></div></div></td><td><div><div><p>W-17801971</p></div></div></td></tr></tbody></table>

For guidance with the patching process, see
[Apply Patch Updates](https://docs.mulesoft.com/release-notes/mule-runtime/patching-mule-versions#apply_patch_updates).

### February 6, 2025

### What’s New

The 4.9.0 version of Mule runtime introduces the following enhancements:

Java adoption:

- In Mule 4.9.0 and later, you can compile any Mule project and additional dependencies for Java 17.

- You can now run applications on Java 17 only.

- This release supports auto minor upgrades for Java 17 apps between Mule 4.8 Edge and Mule 4.9
  Edge, as well as from Mule 4.6 LTS to Mule 4.9 LTS.

- Java 8 and 11 apps won’t be auto minor upgraded to Mule 4.9, so plan your upgrade path for apps
  that are running on Java 8 or 11 accordingly.

Feature Flagging Mechanism:

- Mule 4.9 incorporates new feature flags. See
  [Feature Flagging Mechanism](https://docs.mulesoft.com/mule-runtime/latest/feature-flagging) for a detailed
  description of each feature flag and configuration instructions.

Runtime Manager agent:

- This release of Mule runtime 4.9.0 includes Runtime Manager agent 2.6.7. See
  [Runtime Manager Agent 2.6.7 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.6.x-release-notes#2-6-7).

General improvements:

- Mule 4.9 upgrades the subset of libraries from included third-party software. See
  [Third-Party Software in Mule](https://docs.mulesoft.com/mule-runtime/latest/third-party-software-in-mule) for a
  detailed description.

### DataWeave Features

The 2.9.0 version of DataWeave introduces these new features and enhancements:

Extended format support:

- DataWeave introduces support for the Event Stream format. See
  [Event Stream Format](https://docs.mulesoft.com/dataweave/latest/dataweave-formats-eventstream).

General improvements:

- DataWeave incorporates new system properties. See
  [DataWeave System Properties](https://docs.mulesoft.com/dataweave/latest/dataweave-system-properties).

### Fixed Issues

The release addresses the following Mule issues and incorporates all patch updates from the 4.8.0
Mule release through January 2025:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>Spring is upgraded to 6.2.0.</p></div></div></td><td><div><div><p>W-16639197</p></div></div></td></tr><tr><td><div><div><p>The <code>org.jgrapht:jgrapht-core</code> is upgraded to v1.5.2.</p></div></div></td><td><div><div><p>W-16494546</p></div></div></td></tr><tr><td><div><div><p>The <code>com.github.ben-manes.caffeine:caffeine</code> is upgraded to v3.</p></div></div></td><td><div><div><p>W-16494569</p></div></div></td></tr><tr><td><div><div><p>The <code>plexus-component-annotations</code> is upgraded to v2.2.0.</p></div></div></td><td><div><div><p>W-16541666</p></div></div></td></tr><tr><td><div><div><p>The <code>org.apache.commons:commons-compress</code> is upgraded to v1.27.0.</p></div></div></td><td><div><div><p>W-16515101</p></div></div></td></tr><tr><td><div><div><p>The <code>com.hazelcast:hazelcast</code> is upgraded to v5.4.0.</p></div></div></td><td><div><div><p>W-16594688</p></div></div></td></tr><tr><td><div><div><p>The <code>Xerces-J</code> is upgraded to v2.12.2.</p></div></div></td><td><div><div><p>W-16980865</p></div></div></td></tr><tr><td><div><div><p>The <code>org.jetbrains:annotations</code> is upgraded to v26.</p></div></div></td><td><div><div><p>W-16944403</p></div></div></td></tr><tr><td><div><div><p>The <code>kotlin</code> is upgraded to v2.</p></div></div></td><td><div><div><p>W-16908778</p></div></div></td></tr><tr><td><div><div><p>The <code>org.togglz:togglz-core</code> is upgraded to v4.</p></div></div></td><td><div><div><p>W-16881509</p></div></div></td></tr><tr><td><div><div><p>The <code>graal-sdk</code> is upgraded to v24.1.1.</p></div></div></td><td><div><div><p>W-16772392</p></div></div></td></tr><tr><td><div><div><p>The <code>byteBuddy</code> is upgraded to v1.15.1.</p></div></div></td><td><div><div><p>W-16778624</p></div></div></td></tr><tr><td><div><div><p>The <code>org.apache.xmlbeans:xmlbeans</code> is upgraded to v5.</p></div></div></td><td><div><div><p>W-15263392</p></div></div></td></tr><tr><td><div><div><p>The <code>com.lmax:disruptor</code> is upgraded to v4.</p></div></div></td><td><div><div><p>W-16514909</p></div></div></td></tr><tr><td><div><div><p>Compile target is now set to Java 17.</p></div></div></td><td><div><div><p>W-16045353</p></div></div></td></tr><tr><td><div><div><p>An error message now indicates if a classloader fails to be created for a service.</p></div></div></td><td><div><div><p>W-17244755</p></div></div></td></tr></tbody></table>

DataWeave 2.9.0 is bundled with the Mule 4.9.0 release. This release addresses the following
DataWeave issues:

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>Java module now honors Java bean accessor methods.</p></div></div></td><td><div><div><p>W-17142345</p></div></div></td></tr></tbody></table>

### Bundled Components

- DataWeave version 2.9.0

- Runtime Manager Agent plugin version 2.6.7

### Upgrade

If you are upgrading to this version of Mule from an earlier Mule 4.x version, see
[Mule Upgrades and Patch Updates](https://docs.mulesoft.com/release-notes/mule-runtime/mule-esb#mule-upgrades).

To ensure optimal performance with this version of Mule and avoid unexpected issues, update these
modules and extensions to their latest version at the time of this release:

<table><colgroup><col> <col></colgroup><thead><tr><th>Module or Extension</th><th>Version</th></tr></thead><tbody><tr><td><p>APIkit for Mule 4</p></td><td><p>1.11.3</p></td></tr><tr><td><p>APIkit for OData</p></td><td><p>2.3.0</p></td></tr><tr><td><p>APIkit for OData 4</p></td><td><p>1.5.2</p></td></tr><tr><td><p>APIkit for SOAP</p></td><td><p>1.6.0</p></td></tr><tr><td><p>APIkit for GraphQL</p></td><td><p>1.1.0</p></td></tr><tr><td><p>Spring module</p></td><td><p>1.4</p></td></tr><tr><td><p>MUnit plugin</p></td><td><p>3.4.0</p></td></tr></tbody></table>

### Considerations for Mule Extension Developers

If you update the version of your parent `pom.xml` file to 1.4.0 or later when you build a Mule
extension, ensure that the dependencies in your `pom.xml` file do not override dependencies defined
in the parent `pom.xml` file, and declare only the dependencies you need. If you need to declare a
dependency that is already declared in the parent `pom.xml` file, do not specify a version so it
uses the version from the parent `pom.xml` file.

## See Also

- [Salesforce Help](https://help.salesforce.com)

- [MuleSoft Services](https://www.mulesoft.com/support-and-services)

- [Mule Troubleshooting Plugin](https://docs.mulesoft.com/mule-runtime/4.9/mule-troubleshooting-plugin)

- [Known Issues](https://help.salesforce.com/s/issues)