---
schema_version: "1"
id: 80d235bbe18754b1dd7461b805a5d51a087a46a48c75fa2197994b0475175be3
title: Mule Runtime Patch Update Release Notes for Mule Apps on Runtime Fabric
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/release-notes/runtime-fabric/runtime-fabric-runtimes-release-notes.md
canonical_url: https://docs.mulesoft.com/release-notes/runtime-fabric/runtime-fabric-runtimes-release-notes
source_site: docs.mulesoft.com
content_type: documentation
content_hash: ce4127e564bd5a347d241f0e2c2ed84b07aa8cf376f7593835d387293833793e
description: MuleSoft Documentation Site
latest: true
---
---
product: Release Notes
version: master
keywords: runtimes, release notes, runtime fabric, runtimefabric, fabric, rtf
---

# Mule Runtime Patch Update Release Notes for Mule Apps on Runtime Fabric

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

These release notes describe monthly date-patch updates to the Mule runtime engine on Runtime
Fabric. In addition to these release notes, see the
[Anypoint Runtime Fabric release notes](https://docs.mulesoft.com/release-notes/runtime-fabric/runtime-fabric-release-notes) and the complete
[Anypoint Runtime Fabric](https://docs.mulesoft.com/runtime-fabric/latest/) documentation.

For further information on Mule runtime patch updates, see
[Managing Mule runtime patch updates for Runtime Fabric](https://docs.mulesoft.com/runtime-fabric/latest/runtime-patch-updates).

## Mule Runtime Release Cadence Support

This table shows the Mule runtime release cadence support for Runtime Fabric:

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Mule Version</th><th>Release Date</th><th>Java Version</th><th>End of Standard Support</th><th>End of Extended Support</th></tr></thead><tbody><tr><td><p>4.13 Edge</p></td><td><p>October 2026</p></td><td><p>17</p></td><td><p>March 2027</p></td><td><p>June 2027</p></td></tr><tr><td><p>4.12 Edge</p></td><td><p>June 2026</p></td><td><p>17</p></td><td><p>November 2026</p></td><td><p>February 2027</p></td></tr><tr><td><p>4.11 Edge</p></td><td><p>February 2026</p></td><td><p>17</p></td><td><p>July 2026</p></td><td><p>October 2026</p></td></tr><tr><td><p>4.10 Edge</p></td><td><p>October 2025</p></td><td><p>17</p></td><td><p>March 2026</p></td><td><p>June 2026</p></td></tr><tr><td><p>4.9 LTS</p></td><td><p>February 2025</p></td><td><p>17</p></td><td><p>August 2027</p></td><td><p>February 2028</p></td></tr><tr><td><p>4.9 Edge</p></td><td><p>February 2025</p></td><td><p>17</p></td><td><p>November 2025</p></td><td><p>February 2026</p></td></tr><tr><td><p>4.8 Edge</p></td><td><p>October 2024</p></td><td><p>8, 11, and 17</p></td><td><p>March 2025</p></td><td><p>June 2025</p></td></tr><tr><td><p>4.7 Edge</p></td><td><p>June 2024</p></td><td><p>8, 11, and 17</p></td><td><p>October 2024</p></td><td><p>February 2025</p></td></tr><tr><td><p>4.6 LTS</p></td><td><p>February 2024</p></td><td><p>8, 11, and 17</p></td><td><p>August 2026</p></td><td><p>February 2027</p></td></tr><tr><td><p>4.6 Edge</p></td><td><p>February 2024</p></td><td><p>8, 11, and 17</p></td><td><p>June 2024</p></td><td><p>October 2024</p></td></tr><tr><td><p>4.5 Edge</p></td><td><p>October 2023</p></td><td><p>8 and 11</p></td><td><p>February 2024</p></td><td><p>June 2024</p></td></tr></tbody></table>

> [!NOTE] MuleSoft provides an extended support window for version 4.6 LTS due to its compatibility
> with Java 8, 11, and 17.

Runtime Fabric doesn’t support Mule runtime engine version 4.6.x and later on Runtime Fabric 1.13.x
appliance-based clusters.

## Runtime Fabric Release Monthly Cadence

This table shows the current schedule for monthly updates.

Updates are packaged as `<major version>-<runtime patch package version>-<image build number>`

<table><colgroup><col> <col> <col> <col> <col> <col> <col> <col> <col> <col></colgroup><thead><tr><th>Monthly updates</th><th><a href="https://docs.mulesoft.com/release-notes/mule-runtime/mule-4.13.0-release-notes">4.13 Edge Patch</a></th><th><a href="https://docs.mulesoft.com/release-notes/mule-runtime/mule-4.12.0-release-notes">4.12 Edge Patch</a></th><th><a href="https://docs.mulesoft.com/release-notes/mule-runtime/mule-4.11.0-release-notes">4.11 Edge Patch</a></th><th><a href="https://docs.mulesoft.com/release-notes/mule-runtime/mule-4.9.0-release-notes">4.9 LTS Patch</a></th><th><a href="https://docs.mulesoft.com/release-notes/mule-runtime/mule-4.9.0-release-notes">4.9 Edge Patch (EOL)</a></th><th><a href="https://docs.mulesoft.com/release-notes/mule-runtime/mule-4.6.0-release-notes">4.6 LTS Patch</a></th><th><a href="https://docs.mulesoft.com/release-notes/mule-runtime/mule-4.6.0-release-notes">4.6 Edge Patch (EOL)</a></th><th><a href="https://docs.mulesoft.com/release-notes/mule-runtime/mule-4.4.0-release-notes">4.4 Patch (EOL)</a></th><th><a href="https://docs.mulesoft.com/release-notes/mule-runtime/mule-4.3.0-release-notes">4.3 Patch (EOL)</a></th></tr></thead><tbody><tr><td><p>October 2026</p></td><td><div><div><ul><li><p><a href="#patch-4-13-1-2e-java17">4.13.1:2e-java17</a></p></li><li><p><a href="#patch-4-13-0-16e-java17">4.13.0:16e-java17</a></p></li></ul></div></div></td><td><div><div><ul><li><p><a href="#patch-4-12-5-2e-java17">4.12.5:2e-java17</a></p></li><li><p><a href="#patch-4-12-4-9e-java17">4.12.4:9e-java17</a></p></li></ul></div></div></td><td><p>-</p></td><td><div><div><ul><li><p><a href="#patch-4-9-23-4-java17">4.9.23:4-java17</a></p></li><li><p><a href="#patch-4-9-22-8-java17">4.9.22:8-java17</a></p></li></ul></div></div></td><td><p>-</p></td><td><div><div><ul><li><p><a href="#patch-4-6-36-2-java17">4.6.36:2-java17</a></p></li><li><p><a href="#patch-4-6-36-2-java8">4.6.36:2-java8</a></p></li><li><p><a href="#patch-4-6-35-4-java17">4.6.35:4-java17</a></p></li><li><p><a href="#patch-4-6-35-4-java8">4.6.35:4-java8</a></p></li></ul></div></div></td><td><p>-</p></td><td><p>-</p></td><td><p>-</p></td></tr><tr><td><p>September 2026</p></td><td><p>-</p></td><td><p><a href="#patch-4-12-3-4e-java17">4.12.3:4e-java17</a></p></td><td><p>-</p></td><td><p><a href="#patch-4-9-21-4-java17">4.9.21:4-java17</a></p></td><td><p>-</p></td><td><p><a href="#patch-4-6-34-6-java17">4.6.34:6-java17</a></p></td><td><p><a href="#patch-4-6-34-6-java8">4.6.34:6-java8</a></p></td><td><p>-</p></td><td><p>-</p></td></tr><tr><td><p>August 2026</p></td><td><p>-</p></td><td><p><a href="#patch-4-12-2-8e-java17">4.12.2:8e-java17</a></p></td><td><p><a href="#patch-4-11-6-7e-java17">4.11.6:7e-java17</a></p></td><td><p><a href="#patch-4-9-20-9-java17">4.9.20:9-java17</a></p></td><td><p>-</p></td><td><p><a href="#patch-4-6-33-9-java17">4.6.33:9-java17</a></p></td><td><p><a href="#patch-4-6-33-9-java8">4.6.33:9-java8</a></p></td><td><p>-</p></td><td><p>-</p></td></tr><tr><td><p>July 2026</p></td><td><p>-</p></td><td><p><a href="#patch-4-12-1-4e-java17">4.12.1:4e-java17</a></p></td><td><p><a href="#patch-4-11-6-4e-java17">4.11.6:4e-java17</a></p></td><td><div><div><ul><li><p><a href="#patch-4-9-19-9-java17">4.9.19:9-java17</a></p></li><li><p><a href="#patch-4-9-19-8-java17">4.9.19:8-java17</a></p></li></ul></div></div></td><td><p>-</p></td><td><div><div><ul><li><p><a href="#patch-4-6-32-5-java17">4.6.32:5-java17</a></p></li><li><p><a href="#patch-4-6-32-4-java17">4.6.32:4-java17</a></p></li></ul></div></div></td><td><div><div><ul><li><p><a href="#patch-4-6-32-5-java8">4.6.32:5-java8</a></p></li><li><p><a href="#patch-4-6-32-4-java8">4.6.32:4-java8</a></p></li></ul></div></div></td><td><p>-</p></td><td><p>-</p></td></tr><tr><td><p>June 2026</p></td><td><p>-</p></td><td><p><a href="#patch-4-12-0-10e-java17">4.12.0:10e-java17</a></p></td><td><p><a href="#patch-4-11-5-4e-java17">4.11.5:4e-java17</a></p></td><td><p><a href="#patch-4-9-18-3-java17">4.9.18:3-java17</a></p></td><td><p>-</p></td><td><p><a href="#patch-4-6-31-3-java17">4.6.31:3-java17</a></p></td><td><p><a href="#patch-4-6-31-3-java8">4.6.31:3-java8</a></p></td><td><p>-</p></td><td><p>-</p></td></tr><tr><td><p>May 2026</p></td><td><p>-</p></td><td><p>-</p></td><td><p><a href="#patch-4-11-4-4e-java17">4.11.4:4e-java17</a></p></td><td><div><div><ul><li><p><a href="#patch-4-9-17-5-java17">4.9.17:5-java17</a></p></li><li><p><a href="#patch-4-9-17-4-java17">4.9.17:4-java17</a></p></li></ul></div></div></td><td><p>-</p></td><td><div><div><ul><li><p><a href="#patch-4-6-30-5-java17">4.6.30:5-java17</a></p></li><li><p><a href="#patch-4-6-30-5-java8">4.6.30:5-java8</a></p></li><li><p><a href="#patch-4-6-30-4-java17">4.6.30:4-java17</a></p></li><li><p><a href="#patch-4-6-30-4-java8">4.6.30:4-java8</a></p></li></ul></div></div></td><td><p>-</p></td><td><p>-</p></td><td><p>-</p></td></tr><tr><td><p>April 2026</p></td><td><p>-</p></td><td><p>-</p></td><td><p><a href="#patch-4-11-3-4e-java17">4.11.3:4e-java17</a></p></td><td><p><a href="#patch-4-9-16-4-java17">4.9.16:4-java17</a></p></td><td><p>-</p></td><td><div><div><ul><li><p><a href="#patch-4-6-29-6-java17">4.6.29:6-java17</a></p></li><li><p><a href="#patch-4-6-29-6-java8">4.6.29:6-java8</a></p></li></ul></div></div></td><td><p>-</p></td><td><p>-</p></td><td><p>-</p></td></tr><tr><td><p>March 2026</p></td><td><p>-</p></td><td><p>-</p></td><td><p><a href="#patch-4-11-2-3e-java17">4.11.2:3e-java17</a></p></td><td><p><a href="#patch-4-9-15-3-java17">4.9.15:3-java17</a></p></td><td><p>-</p></td><td><div><div><ul><li><p><a href="#patch-4-6-28-3-java17">4.6.28:3-java17</a></p></li><li><p><a href="#patch-4-6-28-3-java8">4.6.28:3-java8</a></p></li></ul></div></div></td><td><p>-</p></td><td><p>-</p></td><td><p>-</p></td></tr><tr><td><p>February 2026</p></td><td><p>-</p></td><td><p>-</p></td><td><div><div><ul><li><p><a href="#patch-4-11-1-2e-java17">4.11.1:2e-java17</a></p></li><li><p><a href="#patch-4-11-0-10e-java17">4.11.0:10e-java17</a></p></li></ul></div></div></td><td><div><div><ul><li><p><a href="#patch-4-9-14-1-java17">4.9.14:1-java17</a></p></li><li><p><a href="#patch-4-9-13-2-java17">4.9.13:2-java17</a></p></li></ul></div></div></td><td><div><div><ul><li><p><a href="#patch-4-9-14-1e-java17">4.9.14:1e-java17</a></p></li><li><p><a href="#patch-4-9-13-2e-java17">4.9.13:2e-java17</a></p></li></ul></div></div></td><td><div><div><ul><li><p><a href="#patch-4-6-27-1-java8">4.6.27:1-java8</a></p></li><li><p><a href="#patch-4-6-27-1-java17">4.6.27:1-java17</a></p></li><li><p><a href="#patch-4-6-26-2-java8">4.6.26:2-java8</a></p></li><li><p><a href="#patch-4-6-26-2-java17">4.6.26:2-java17</a></p></li></ul></div></div></td><td><div><div><p>-</p></div></div></td><td><p>-</p></td><td><p>-</p></td></tr><tr><td><p>January 2026</p></td><td><p>-</p></td><td><p>-</p></td><td><p>-</p></td><td><p><a href="#patch-4-9-12-5-java17">4.9.12:5-java17</a></p></td><td><p><a href="#patch-4-9-12-5e-java17">4.9.12:5e-java17</a></p></td><td><div><div><ul><li><p><a href="#patch-4-6-25-5-java8">4.6.25:5-java8</a></p></li><li><p><a href="#patch-4-6-25-5-java17">4.6.25:5-java17</a></p></li></ul></div></div></td><td><p>-</p></td><td><p>-</p></td><td><p>-</p></td></tr><tr><td><p>December 2025</p></td><td><p>-</p></td><td><p>-</p></td><td><p>-</p></td><td><p>-</p></td><td><p>-</p></td><td><p>-</p></td><td><p>-</p></td><td><p>-</p></td><td><p>-</p></td></tr><tr><td><p>November 2025</p></td><td><p>-</p></td><td><p>-</p></td><td><p>-</p></td><td><div><div><ul><li><p><a href="#patch-4-9-11-4-java17">4.9.11:4-java17</a></p></li><li><p><a href="#patch-4-9-11-6-java17">4.9.11:6-java17</a></p></li></ul></div></div></td><td><div><div><ul><li><p><a href="#patch-4-9-11-4e-java17">4.9.11:4e-java17</a></p></li><li><p><a href="#patch-4-9-11-6e-java17">4.9.11:6e-java17</a></p></li></ul></div></div></td><td><div><div><ul><li><p><a href="#patch-4-6-24-4-java8">4.6.24:4-java8</a></p></li><li><p><a href="#patch-4-6-24-4-java17">4.6.24:4-java17</a></p></li><li><p><a href="#patch-4-6-24-7-java8">4.6.24:7-java8</a></p></li><li><p><a href="#patch-4-6-24-7-java17">4.6.24:7-java17</a></p></li></ul></div></div></td><td><p>-</p></td><td><div><div><ul><li><p><a href="#patch-4-4-0-20250919-5">4.4.0:20250919-5</a></p></li><li><p><a href="#patch-4-4-0-20250919-6">4.4.0:20250919-6</a></p></li></ul></div></div></td><td><p>-</p></td></tr><tr><td><p>October 2025</p></td><td><p>-</p></td><td><p>-</p></td><td><p>-</p></td><td><p><a href="#patch-4-9-10-4-java17">4.9.10:4-java17</a></p></td><td><p><a href="#patch-4-9-10-4e-java17">4.9.10:4e-java17</a></p></td><td><div><div><ul><li><p><a href="#patch-4-6-23-4-java8">4.6.23:4-java8</a></p></li><li><p><a href="#patch-4-6-23-4-java17">4.6.23:4-java17</a></p></li></ul></div></div></td><td><p>-</p></td><td><p><a href="#patch-4-4-0-20250919-3">4.4.0:20250919-3</a></p></td><td><p>-</p></td></tr><tr><td><p>September 2025</p></td><td><p>-</p></td><td><p>-</p></td><td><p>-</p></td><td><p><a href="#patch-4-9-9-5-java17">4.9.9:5-java17</a></p></td><td><p><a href="#patch-4-9-9-5e-java17">4.9.9:5e-java17</a></p></td><td><div><div><ul><li><p><a href="#patch-4-6-22-4-java8">4.6.22:4-java8</a></p></li><li><p><a href="#patch-4-6-22-4-java17">4.6.22:4-java17</a></p></li></ul></div></div></td><td><p>-</p></td><td><p><a href="#patch-4-4-0-20250829-1">4.4.0:20250829-1</a></p></td><td><p>-</p></td></tr></tbody></table>

- EOSS (End of Standard Support)

- EOES (End of Extended Support)

- EOL (End of Life)

> [!IMPORTANT] The security fix SE-21834, from the August 3, 2021 patch release, disables TLS v1 and
> TLS v1.1 by default. When you
> [deploy an application to Runtime Fabric](https://docs.mulesoft.com/runtime-fabric/latest/deploy-to-runtime-fabric),
> you can enable TLS v1 or TLS v1.1 using the following JVM args:
>
> - Enable TLS v1.0 and TLS v1.1: `-Drtf.allow.TLSv1.0+`
>
> - Enable TLS v1.1: `-Drtf.allow.TLSv1.1`
>
> This change affects all Mule versions for Anypoint Runtime Fabric. Future patches to these
> releases and future minor releases of Mule will also incorporate this new default.

## October 15, 2026

### What’s New

**4.13.1, 4.12.5, 4.9.23, and 4.6.36 Runtime Updates**

- This update addresses regressions introduced in the October release.

- This release of 4.13.1, 4.12.5, and 4.9.23 includes Runtime Manager agent 2.8.5, and 4.6.36
  includes Runtime Manager agent 2.7.20. For information, see
  [Runtime Manager Agent 2.8.5 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.8.x-release-notes#2-8-5)
  and
  [Runtime Manager Agent 2.7.20 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-20).

### Fixed Issues

### 4.13.1:2e-java17

**4.13.1 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.18+8

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Applications no longer fail to deploy when the type of an on-error-propagate or on-error-continue is a property placeholder and the flow contains a component that supports streaming and requires a connection, such as an HTTP Request or Kafka operation.</p></div></div></td><td><div><div><p>W-24456406</p></div></div></td></tr><tr><td><div><div><p>A JMS connection that doesn’t use XA transactions no longer logs an error, or fails application initialization, when the application doesn’t declare a bti:transaction-manager.</p></div></div></td><td><div><div><p>W-24443844</p></div></div></td></tr><tr><td><div><div><p>Configuring the DELTA aggregation temporality for metrics export now works when running on CloudHub, CloudHub 2.0, and Runtime Fabric.</p></div></div></td><td><div><div><p>W-24492022</p></div></div></td></tr><tr><td><div><div><p>Polling sources that use a CloudHub Object Store v2 for watermarks now track processed items in the object store’s configured partition instead of the default partition.</p></div></div></td><td><div><div><p>W-24459240</p></div></div></td></tr><tr><td><div><div><p>SLA-based rate limiting policies no longer reject valid client requests because the client is validated twice.</p></div></div></td><td><div><div><p>W-24447995</p></div></div></td></tr></tbody></table>

### 4.12.5:2e-java17

**4.12.5 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.18+8

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>A JMS connection that doesn’t use XA transactions no longer logs an error, or fails application initialization, when the application doesn’t declare a bti:transaction-manager.</p></div></div></td><td><div><div><p>W-24443844</p></div></div></td></tr><tr><td><div><div><p>Configuring the DELTA aggregation temporality for metrics export now works when running on CloudHub, CloudHub 2.0, and Runtime Fabric.</p></div></div></td><td><div><div><p>W-24492022</p></div></div></td></tr><tr><td><div><div><p>SLA-based rate limiting policies no longer reject valid client requests because the client is validated twice.</p></div></div></td><td><div><div><p>W-24447995</p></div></div></td></tr></tbody></table>

### 4.9.23:4-java17

**4.9.23 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.18+8

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>SLA-based rate limiting policies no longer reject valid client requests because the client is validated twice.</p></div></div></td><td><div><div><p>W-24447995</p></div></div></td></tr></tbody></table>

### 4.6.36:2-java17

**4.6.36 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.18+8

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>SLA-based rate limiting policies no longer reject valid client requests because the client is validated twice.</p></div></div></td><td><div><div><p>W-24447995</p></div></div></td></tr></tbody></table>

### 4.6.36:2-java8

**4.6.36 LTS Runtime Updates**

- Bundled JDK version: OpenJDK "1.8.0\_452"

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>SLA-based rate limiting policies no longer reject valid client requests because the client is validated twice.</p></div></div></td><td><div><div><p>W-24447995</p></div></div></td></tr></tbody></table>

## October 6, 2026

### What’s New

- Mule runtime engine 4.13.0 is now available.

  For information about the release notes, see
  [Mule Runtime Engine 4.13.0 Release Notes](https://docs.mulesoft.com/release-notes/mule-runtime/mule-4.13.0-release-notes). For
  information about the new release cadence, see
  [Edge and LTS Releases for Mule](https://docs.mulesoft.com/release-notes/mule-runtime/lts-edge-release-cadence).

- This release of 4.13.0, 4.12.4, and 4.9.22 includes Runtime Manager agent 2.8.5, and 4.6.35
  includes Runtime Manager agent 2.7.20. For information, see
  [Runtime Manager Agent 2.8.5 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.8.x-release-notes#2-8-5)
  and
  [Runtime Manager Agent 2.7.20 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-20).

### Fixed Issues

### 4.13.0:16e-java17

**4.13.0 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.18+8

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.41`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>The jsoup library is upgraded to 1.23.2.</p></div></div></td><td><div><div><p>W-23987955</p></div></div></td></tr><tr><td><div><div><p>The Jackson library is upgraded to 2.22.3.</p></div></div></td><td><div><div><p>W-24335732</p></div></div></td></tr><tr><td><div><div><p>The Reactor Core library is upgraded to 3.8.7.</p></div></div></td><td><div><div><p>W-23987958</p></div></div></td></tr><tr><td><div><div><p>The Netty library is upgraded to 4.2.18.Final.</p></div></div></td><td><div><div><p>W-24336011</p></div></div></td></tr><tr><td><div><div><p>The Apache Neethi library is upgraded to 3.2.4.</p></div></div></td><td><div><div><p>W-24335736</p></div></div></td></tr><tr><td><div><div><p>The Spring Framework library is upgraded to 7.0.9.</p></div></div></td><td><div><div><p>W-24232049</p></div></div></td></tr><tr><td><div><div><p>The raml-parser-2 library is upgraded to 1.2.1.</p></div></div></td><td><div><div><p>W-23570110</p></div></div></td></tr><tr><td><div><div><p>Error-mapping preservation during error propagation is now enabled by default. An error whose type was already resolved inside a scope, including any remapping by an error mapping, now keeps that resolved type as it propagates out of the scope, instead of reverting to the raw connector error type. You can disable this behavior by setting the <code>mule.honourErrorMappingsOnErrorPropagation</code> system property to <code>false</code>.</p></div></div></td><td><div><div><p>W-23955755</p></div></div></td></tr><tr><td><div><div><p>OpenTelemetry metric exporters now support per-exporter view enrichment and resource attribute overrides.</p></div></div></td><td><div><div><p>W-23367495</p></div></div></td></tr><tr><td><div><div><p>JSON schema validation is migrated from the everit library to networknt, with everit retained as a fallback.</p></div></div></td><td><div><div><p>W-16530105</p></div></div></td></tr><tr><td><div><div><p>HTTP header values containing CR/LF characters are now sanitized instead of causing the request to be rejected.</p></div></div></td><td><div><div><p>W-22252135</p></div></div></td></tr><tr><td><div><div><p><code>minMuleVersion</code> values are now normalized when loaded, preventing the patch or revision portion from being truncated.</p></div></div></td><td><div><div><p>W-24231362</p></div></div></td></tr><tr><td><div><div><p>Configuration property placeholder resolution now stops once it exceeds a maximum nesting depth, instead of continuing to recurse through a cyclic or excessively deep reference chain. You can configure the depth limit through the <code>mule.properties.resolution.maxDepth</code> system property, which defaults to 10.</p></div></div></td><td><div><div><p>W-23650198</p></div></div></td></tr><tr><td><div><div><p>Reads from the repeatable streaming buffer are now lock-free when data is already available, reducing thread contention. You can control this behavior by using the <code>mule.repeatableStreaming.lockFreeRead</code> system property.</p></div></div></td><td><div><div><p>W-24012839</p></div></div></td></tr><tr><td><div><div><p>You can now configure a full request timeout for the HTTP server by using the <code>mule.http.server.fullRequestTimeout</code> system property, in milliseconds. This property is disabled by default.</p></div></div></td><td><div><div><p>W-22040113</p></div></div></td></tr><tr><td><div><div><p>OpenTelemetry flow-statistics counters now emit one datapoint per flow, labeled with the <code>mule.flow.name</code> dimension, instead of a single artifact-level total. You can disable this behavior by setting the <code>mule.enable.otel.flow.statistics.detailed</code> system property to <code>false</code>.</p></div></div></td><td><div><div><p>W-23616483</p></div></div></td></tr><tr><td><div><div><p>Logging export reconfiguration is fixed for single application mode.</p></div></div></td><td><div><div><p>W-20908857</p></div></div></td></tr><tr><td><div><div><p>The ObjectStore API is extended with an <code>upsert</code> operation and an <code>isThreadSafe</code> indicator.</p></div></div></td><td><div><div><p>W-23090592</p></div></div></td></tr><tr><td><div><div><p>An omitted <code>eagerRead</code> attribute on <code>&lt;repeatable-in-memory-stream&gt;</code> now correctly takes its default value from the <code>mule.repeatableStreaming.bytes.eagerRead</code> system property, instead of a fixed value.</p></div></div></td><td><div><div><p>W-24043809</p></div></div></td></tr><tr><td><div><div><p>A <code>java.lang.UnsupportedClassVersionError</code> thrown when a connector’s compiled target doesn’t match the running JVM is now handled gracefully.</p></div></div></td><td><div><div><p>W-24193358</p></div></div></td></tr><tr><td><div><div><p>A connector’s message source no longer deadlocks when its connection-retry logic triggers a stop of the retry scheduler from one of that scheduler’s own worker threads.</p></div></div></td><td><div><div><p>W-24234538</p></div></div></td></tr><tr><td><div><div><p>Network information listening ports are now scoped to the Mule process.</p></div></div></td><td><div><div><p>W-24043880</p></div></div></td></tr><tr><td><div><div><p><code>NullPointerException</code> errors no longer occur when loading the extension model of a connector whose connection provider uses the <code>@ClientCredentials</code> or <code>@AuthorizationCode</code> OAuth annotation with <code>credentialsPlacement</code> configured.</p></div></div></td><td><div><div><p>W-24086656</p></div></div></td></tr><tr><td><div><div><p>Policy logging context is no longer lost when a dynamic Flow Reference resolves to a subflow.</p></div></div></td><td><div><div><p>W-24026465</p></div></div></td></tr><tr><td><div><div><p>The new <code>loggingConfiguration</code> troubleshooting operation helps you diagnose logging configuration issues.</p></div></div></td><td><div><div><p>W-23998256</p></div></div></td></tr><tr><td><div><div><p>The log level for <code>disallowConcurrentExecution</code> messages is changed from WARN to DEBUG, reducing log noise.</p></div></div></td><td><div><div><p>W-24164028</p></div></div></td></tr><tr><td><div><div><p>The new on-demand connectivity-testing troubleshooting operation is now available.</p></div></div></td><td><div><div><p>W-23629284</p></div></div></td></tr><tr><td><div><div><p>The OpenTelemetry exporter TLS property <code>mule.openTelemetry.exporter.tls.certificatesStrategy</code> is now properly resolved.</p></div></div></td><td><div><div><p>W-24009827</p></div></div></td></tr><tr><td><div><div><p>A source policy that uses Async, Parallel For Each, or Scatter-Gather no longer builds its response from the failure response parameters instead of the success response parameters, and no longer silently drops the forked route’s response processing.</p></div></div></td><td><div><div><p>W-23938349</p></div></div></td></tr><tr><td><div><div><p>The new on-demand <code>connectionCount</code> troubleshooting operation is now available.</p></div></div></td><td><div><div><p>W-23716301</p></div></div></td></tr><tr><td><div><div><p>The commons-beanutils library and its transitive commons-collections 3.2.2 dependency are removed from Mule Runtime modules.</p></div></div></td><td><div><div><p>W-16918287</p></div></div></td></tr><tr><td><div><div><p>OpenTelemetry metrics export now supports delta aggregation temporality.</p></div></div></td><td><div><div><p>W-23448781</p></div></div></td></tr><tr><td><div><div><p>An unresolved placeholder in the meter-exporter configuration now degrades to its default value at tracer startup instead of causing a failure.</p></div></div></td><td><div><div><p>W-23650358</p></div></div></td></tr><tr><td><div><div><p>Dynamic reload of the metrics exporter configuration is now supported.</p></div></div></td><td><div><div><p>W-21921629</p></div></div></td></tr><tr><td><div><div><p>OpenTelemetry flow statistics counters now report total flow counts as well as per-flow totals.</p></div></div></td><td><div><div><p>W-23232729</p></div></div></td></tr><tr><td><div><div><p><code>OutputHandler</code> is deprecated and its support is removed.</p></div></div></td><td><div><div><p>W-23660888</p></div></div></td></tr><tr><td><div><div><p>A <code>SerializationException</code> now raises a <code>MULE:SERIALIZATION</code> error, instead of <code>MULE:UNKNOWN</code>.</p></div></div></td><td><div><div><p>W-21381359</p></div></div></td></tr><tr><td><div><div><p>The exporter-health backpressure-alert cadence for OpenTelemetry tracing, metrics, and logging is now configured through a single system property, <code>mule.openTelemetry.meter.exporter.healthMetrics.alertingFrequency</code>, instead of the separate per-signal <code>metricsLogFrequency</code> properties, which are deprecated and no longer consumed.</p></div></div></td><td><div><div><p>W-22193713</p></div></div></td></tr><tr><td><div><div><p><code>MULE:INVALID_INPUT_PARAM</code> is now preserved as a suppressed error when a <code>MULE:SOURCE_RESPONSE_GENERATE</code> error occurs.</p></div></div></td><td><div><div><p>W-22293407</p></div></div></td></tr><tr><td><div><div><p>SDK parameter validation errors are now mapped to the <code>MULE:INVALID_INPUT_PARAM</code> error type.</p></div></div></td><td><div><div><p>W-2227652</p></div></div></td></tr><tr><td><div><div><p>Mule-generated tracing spans no longer truncate attribute values at OpenTelemetry’s default 128-character limit. Attribute values are now preserved up to 4096 characters before truncation.</p></div></div></td><td><div><div><p>W-20091299</p></div></div></td></tr><tr><td><div><div><p>Client-side read backpressure is now applied to streamed HTTP responses, preventing out-of-memory errors when consuming large response bodies.</p></div></div></td><td><div><div><p>W-24103497</p></div></div></td></tr><tr><td><div><div><p>The Netty-based HTTP client now defers DNS resolution of the target host to the proxy when a proxy is configured, regardless of the configured scheme.</p></div></div></td><td><div><div><p>W-24010245</p></div></div></td></tr><tr><td><div><div><p>Unresolved placeholders in Batch AST properties no longer cause a <code>ClassCastException</code> during packaging validation.</p></div></div></td><td><div><div><p>W-24088827</p></div></div></td></tr><tr><td><div><div><p>In a clustered deployment, the DiscoverySPI HTTP client no longer fails to start when PCF or Kubernetes discovery is configured through the <code>.mule/mule-cluster.properties</code> file instead of a JVM system property.</p></div></div></td><td><div><div><p>W-24211100</p></div></div></td></tr><tr><td><div><div><p><code>SQSQueueManagementService</code> is added to the serialization allowlist.</p></div></div></td><td><div><div><p>W-24197744</p></div></div></td></tr><tr><td><div><div><p>Fallback is now enabled as the default strategy for contracts collection. You can change this behavior by configuring the <code>anypoint.platform.clients_fetch_mode</code> system property with the values <code>sharded</code>, <code>legacy</code>, or <code>fallback</code>.</p></div></div></td><td><div><div><p>W-24179706</p></div></div></td></tr><tr><td><div><div><p>When API Gateway authenticates with Anypoint Platform, a transient failure of the <code>/login</code> request no longer discards an otherwise valid Access Management token. The token is now invalidated only on an actual authentication failure (401 or 403).</p></div></div></td><td><div><div><p>W-24144244</p></div></div></td></tr><tr><td><div><div><p>Netty’s Java Flight Recorder (JFR) integration is now disabled by default.</p></div></div></td><td><div><div><p>W-20926401</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>Memory usage for <code>text/plain</code> output is reduced.</p></div></div></td><td><div><div><p>W-20063270</p></div></div></td></tr><tr><td><div><div><p>Eagerly materialize executable Weave reader results.</p></div></div></td><td><div><div><p>W-23837275</p></div></div></td></tr><tr><td><div><div><p>Thread safety is improved when processing Java map values.</p></div></div></td><td><div><div><p>W-23661641</p></div></div></td></tr><tr><td><div><div><p>DataWeave tooling now reports design-time warnings when Java classes referenced in <code>application/java</code> schemas can’t be found or are inaccessible through JPMS.</p></div></div></td><td><div><div><p>W-22797049</p></div></div></td></tr><tr><td><div><div><p>DataWeave now filters Java classes in JPMS-unexported packages during Java module resolution, preventing runtime <code>IllegalAccessException</code> failures. This behavior is enabled by default on JDK 17 and later with DataWeave language version 2.13 and later. To keep the previous behavior, set <code>mule.dw.filter_jpms_inaccessible_modules=false</code>.</p></div></div></td><td><div><div><p>W-22779527</p></div></div></td></tr><tr><td><div><div><p>Cryptographic security warnings and errors now include call stacks.</p></div></div></td><td><div><div><p>W-22144340</p></div></div></td></tr></tbody></table>

### 4.12.4:9e-java17

**4.12.4 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.18+8

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.41`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>The Log4j library is upgraded to 2.26.1.</p></div></div></td><td><div><div><p>W-24061648</p></div></div></td></tr><tr><td><div><div><p>The Jackson library is upgraded to 2.22.3.</p></div></div></td><td><div><div><p>W-24335732</p></div></div></td></tr><tr><td><div><div><p>The Netty library is upgraded to 4.2.18.Final.</p></div></div></td><td><div><div><p>W-24336011</p></div></div></td></tr><tr><td><div><div><p>The Apache Neethi library is upgraded to 3.2.4.</p></div></div></td><td><div><div><p>W-24335736</p></div></div></td></tr><tr><td><div><div><p>The Spring Framework library is upgraded to 7.0.9.</p></div></div></td><td><div><div><p>W-24232049</p></div></div></td></tr><tr><td><div><div><p>Configuration property placeholder resolution now stops once it exceeds a maximum nesting depth, instead of continuing to recurse through a cyclic or excessively deep reference chain. You can configure the depth limit through the <code>mule.properties.resolution.maxDepth</code> system property, which defaults to 10.</p></div></div></td><td><div><div><p>W-23650198</p></div></div></td></tr><tr><td><div><div><p>Reads from the repeatable streaming buffer are now lock-free when data is already available, reducing thread contention. You can control this behavior by using the <code>mule.repeatableStreaming.lockFreeRead</code> system property.</p></div></div></td><td><div><div><p>W-24012839</p></div></div></td></tr><tr><td><div><div><p>Error-mapping preservation during error propagation can now be enabled through the <code>mule.honourErrorMappingsOnErrorPropagation</code> system property. When enabled, an error whose type was already resolved inside a scope, including any remapping by an error mapping, keeps that resolved type as it propagates out of the scope, instead of reverting to the raw connector error type.</p></div></div></td><td><div><div><p>W-23955755</p></div></div></td></tr><tr><td><div><div><p>OpenTelemetry flow-statistics counters now emit one datapoint per flow, labeled with the <code>mule.flow.name</code> dimension, instead of a single artifact-level total. You can disable this behavior by setting the <code>mule.enable.otel.flow.statistics.detailed</code> system property to <code>false</code>.</p></div></div></td><td><div><div><p>W-23616483</p></div></div></td></tr><tr><td><div><div><p>You can now configure a full request timeout for the HTTP server by using the <code>mule.http.server.fullRequestTimeout</code> system property, in milliseconds. This property is disabled by default.</p></div></div></td><td><div><div><p>W-22040113</p></div></div></td></tr><tr><td><div><div><p>Network information listening ports are now scoped to the Mule process.</p></div></div></td><td><div><div><p>W-24043880</p></div></div></td></tr><tr><td><div><div><p>OpenTelemetry metrics export now supports delta aggregation temporality.</p></div></div></td><td><div><div><p>W-23448781</p></div></div></td></tr><tr><td><div><div><p><code>NullPointerException</code> errors no longer occur when loading the extension model of a connector whose connection provider uses the <code>@ClientCredentials</code> or <code>@AuthorizationCode</code> OAuth annotation with <code>credentialsPlacement</code> configured.</p></div></div></td><td><div><div><p>W-24086656</p></div></div></td></tr><tr><td><div><div><p>Policy logging context is no longer lost when a dynamic Flow Reference resolves to a subflow.</p></div></div></td><td><div><div><p>W-24026465</p></div></div></td></tr><tr><td><div><div><p>The new <code>loggingConfiguration</code> troubleshooting operation helps you diagnose logging configuration issues.</p></div></div></td><td><div><div><p>W-23998256</p></div></div></td></tr><tr><td><div><div><p>The log level for <code>disallowConcurrentExecution</code> messages is changed from WARN to DEBUG, reducing log noise.</p></div></div></td><td><div><div><p>W-24164028</p></div></div></td></tr><tr><td><div><div><p>The OpenTelemetry exporter TLS property <code>mule.openTelemetry.exporter.tls.certificatesStrategy</code> is now properly resolved.</p></div></div></td><td><div><div><p>W-24009827</p></div></div></td></tr><tr><td><div><div><p>On CloudHub 2.0 and Runtime Fabric deployments, container logs exported through OpenTelemetry now correctly use the deployed application’s configured service name, instead of the generic <code>mule-container</code> name.</p></div></div></td><td><div><div><p>W-23734353</p></div></div></td></tr><tr><td><div><div><p>OpenTelemetry flow statistics counters now report total flow counts as well as per-flow totals.</p></div></div></td><td><div><div><p>W-23232729</p></div></div></td></tr><tr><td><div><div><p>The new on-demand <code>connectionCount</code> troubleshooting operation is now available.</p></div></div></td><td><div><div><p>W-23716301</p></div></div></td></tr><tr><td><div><div><p>Client-side read backpressure is now applied to streamed HTTP responses, preventing out-of-memory errors when consuming large response bodies.</p></div></div></td><td><div><div><p>W-24103497</p></div></div></td></tr><tr><td><div><div><p>HTTP/1-only HTTPS listeners backed by the Netty HTTP service no longer fail to establish TLS connections when an application loads the Bouncy Castle JSSE provider from a shared library outside the runtime’s classloader.</p></div></div></td><td><div><div><p>W-23355657</p></div></div></td></tr><tr><td><div><div><p>The Netty-based HTTP client now defers DNS resolution of the target host to the proxy when a proxy is configured, regardless of the configured scheme.</p></div></div></td><td><div><div><p>W-24010245</p></div></div></td></tr><tr><td><div><div><p>A warning is now logged when NTLM authentication is configured but the server doesn’t issue an NTLM challenge.</p></div></div></td><td><div><div><p>W-17651806</p></div></div></td></tr><tr><td><div><div><p>Unresolved placeholders in Batch AST properties no longer cause a <code>ClassCastException</code> during packaging validation.</p></div></div></td><td><div><div><p>W-24088827</p></div></div></td></tr><tr><td><div><div><p>In a clustered deployment, the DiscoverySPI HTTP client no longer fails to start when PCF or Kubernetes discovery is configured through the <code>.mule/mule-cluster.properties</code> file instead of a JVM system property.</p></div></div></td><td><div><div><p>W-24211100</p></div></div></td></tr><tr><td><div><div><p>Fallback is now enabled as the default strategy for contracts collection. You can change this behavior by configuring the <code>anypoint.platform.clients_fetch_mode</code> system property with the values <code>sharded</code>, <code>legacy</code>, or <code>fallback</code>.</p></div></div></td><td><div><div><p>W-24179706</p></div></div></td></tr><tr><td><div><div><p>When API Gateway authenticates with Anypoint Platform, a transient failure of the <code>/login</code> request no longer discards an otherwise valid Access Management token. The token is now invalidated only on an actual authentication failure (401 or 403).</p></div></div></td><td><div><div><p>W-24144244</p></div></div></td></tr><tr><td><div><div><p>Netty’s Java Flight Recorder (JFR) integration is now disabled by default.</p></div></div></td><td><div><div><p>W-20926401</p></div></div></td></tr><tr><td><div><div><p>An omitted <code>eagerRead</code> attribute on <code>&lt;repeatable-in-memory-stream&gt;</code> now correctly takes its default value from the <code>mule.repeatableStreaming.bytes.eagerRead</code> system property, instead of a fixed value.</p></div></div></td><td><div><div><p>W-24043809</p></div></div></td></tr></tbody></table>

### 4.9.22:8-java17

**4.9.22 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.18+8

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.41`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>The Reactor Core library is upgraded to 3.8.7.</p></div></div></td><td><div><div><p>W-23953702</p></div></div></td></tr><tr><td><div><div><p>The Jackson library is upgraded to 2.22.3.</p></div></div></td><td><div><div><p>W-24335732</p></div></div></td></tr><tr><td><div><div><p>The Netty library is upgraded to 4.2.18.Final.</p></div></div></td><td><div><div><p>W-24336011</p></div></div></td></tr><tr><td><div><div><p>The Apache Neethi library is upgraded to 3.2.4.</p></div></div></td><td><div><div><p>W-24335736</p></div></div></td></tr><tr><td><div><div><p>The Spring Framework library is upgraded to 7.0.9.</p></div></div></td><td><div><div><p>W-24232049</p></div></div></td></tr><tr><td><div><div><p>Configuration property placeholder resolution now stops once it exceeds a maximum nesting depth, instead of continuing to recurse through a cyclic or excessively deep reference chain. You can configure the depth limit through the <code>mule.properties.resolution.maxDepth</code> system property, which defaults to 10.</p></div></div></td><td><div><div><p>W-23650198</p></div></div></td></tr><tr><td><div><div><p>Reads from the repeatable streaming buffer are now lock-free when data is already available, reducing thread contention. You can control this behavior by using the <code>mule.repeatableStreaming.lockFreeRead</code> system property.</p></div></div></td><td><div><div><p>W-24012839</p></div></div></td></tr><tr><td><div><div><p>Error-mapping preservation during error propagation can now be enabled through the <code>mule.honourErrorMappingsOnErrorPropagation</code> system property. When enabled, an error whose type was already resolved inside a scope, including any remapping by an error mapping, keeps that resolved type as it propagates out of the scope, instead of reverting to the raw connector error type.</p></div></div></td><td><div><div><p>W-23955755</p></div></div></td></tr><tr><td><div><div><p>You can now configure a full request timeout for the HTTP server by using the <code>mule.http.server.fullRequestTimeout</code> system property, in milliseconds. This property is disabled by default.</p></div></div></td><td><div><div><p>W-22040113</p></div></div></td></tr><tr><td><div><div><p>A connector’s message source no longer deadlocks when its connection-retry logic triggers a stop of the retry scheduler from one of that scheduler’s own worker threads.</p></div></div></td><td><div><div><p>W-24234538</p></div></div></td></tr><tr><td><div><div><p>Network information listening ports are now scoped to the Mule process.</p></div></div></td><td><div><div><p>W-24043880</p></div></div></td></tr><tr><td><div><div><p><code>NullPointerException</code> errors no longer occur when loading the extension model of a connector whose connection provider uses the <code>@ClientCredentials</code> or <code>@AuthorizationCode</code> OAuth annotation with <code>credentialsPlacement</code> configured.</p></div></div></td><td><div><div><p>W-24086656</p></div></div></td></tr><tr><td><div><div><p>Policy logging context is no longer lost when a dynamic Flow Reference resolves to a subflow.</p></div></div></td><td><div><div><p>W-24026465</p></div></div></td></tr><tr><td><div><div><p>The new <code>loggingConfiguration</code> troubleshooting operation helps you diagnose logging configuration issues.</p></div></div></td><td><div><div><p>W-23998256</p></div></div></td></tr><tr><td><div><div><p>The log level for <code>disallowConcurrentExecution</code> messages is changed from WARN to DEBUG, reducing log noise.</p></div></div></td><td><div><div><p>W-24164028</p></div></div></td></tr><tr><td><div><div><p>The new on-demand connectivity-testing troubleshooting operation is now available.</p></div></div></td><td><div><div><p>W-23629284</p></div></div></td></tr><tr><td><div><div><p>The new on-demand <code>connectionCount</code> troubleshooting operation is now available.</p></div></div></td><td><div><div><p>W-23716301</p></div></div></td></tr><tr><td><div><div><p>HTTP/1-only HTTPS listeners backed by the Netty HTTP service no longer fail to establish TLS connections when an application loads the Bouncy Castle JSSE provider from a shared library outside the runtime’s classloader.</p></div></div></td><td><div><div><p>W-23355657</p></div></div></td></tr><tr><td><div><div><p>The Netty-based HTTP client now defers DNS resolution of the target host to the proxy when a proxy is configured, regardless of the configured scheme.</p></div></div></td><td><div><div><p>W-24010245</p></div></div></td></tr><tr><td><div><div><p>A warning is now logged when NTLM authentication is configured but the server doesn’t issue an NTLM challenge.</p></div></div></td><td><div><div><p>W-17651806</p></div></div></td></tr><tr><td><div><div><p>Fallback is now enabled as the default strategy for contracts collection. You can change this behavior by configuring the <code>anypoint.platform.clients_fetch_mode</code> system property with the values <code>sharded</code>, <code>legacy</code>, or <code>fallback</code>.</p></div></div></td><td><div><div><p>W-24179706</p></div></div></td></tr><tr><td><div><div><p>When API Gateway authenticates with Anypoint Platform, a transient failure of the <code>/login</code> request no longer discards an otherwise valid Access Management token. The token is now invalidated only on an actual authentication failure (401 or 403).</p></div></div></td><td><div><div><p>W-24144244</p></div></div></td></tr></tbody></table>

### 4.6.35:4-java17

**4.6.35 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.18+8

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.41`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>The Reactor Core library is upgraded to 3.8.7.</p></div></div></td><td><div><div><p>W-3300013</p></div></div></td></tr><tr><td><div><div><p>The Jackson library is upgraded to 2.22.2.</p></div></div></td><td><div><div><p>W-23947149</p></div></div></td></tr><tr><td><div><div><p>The jsoup library is upgraded to 1.23.2.</p></div></div></td><td><div><div><p>W-23987949</p></div></div></td></tr><tr><td><div><div><p>Configuration property placeholder resolution now stops once it exceeds a maximum nesting depth, instead of continuing to recurse through a cyclic or excessively deep reference chain. You can configure the depth limit through the <code>mule.properties.resolution.maxDepth</code> system property, which defaults to 10.</p></div></div></td><td><div><div><p>W-23650198</p></div></div></td></tr><tr><td><div><div><p>Error-mapping preservation during error propagation can now be enabled through the <code>mule.honourErrorMappingsOnErrorPropagation</code> system property. When enabled, an error whose type was already resolved inside a scope, including any remapping by an error mapping, keeps that resolved type as it propagates out of the scope, instead of reverting to the raw connector error type.</p></div></div></td><td><div><div><p>W-23955755</p></div></div></td></tr><tr><td><div><div><p>A connector’s message source no longer deadlocks when its connection-retry logic triggers a stop of the retry scheduler from one of that scheduler’s own worker threads.</p></div></div></td><td><div><div><p>W-24234538</p></div></div></td></tr><tr><td><div><div><p>Network information listening ports are now scoped to the Mule process.</p></div></div></td><td><div><div><p>W-24043880</p></div></div></td></tr><tr><td><div><div><p><code>NullPointerException</code> errors no longer occur when loading the extension model of a connector whose connection provider uses the <code>@ClientCredentials</code> or <code>@AuthorizationCode</code> OAuth annotation with <code>credentialsPlacement</code> configured.</p></div></div></td><td><div><div><p>W-24086656</p></div></div></td></tr><tr><td><div><div><p>Policy logging context is no longer lost when a dynamic Flow Reference resolves to a subflow.</p></div></div></td><td><div><div><p>W-24026465</p></div></div></td></tr><tr><td><div><div><p>The new <code>loggingConfiguration</code> troubleshooting operation helps you diagnose logging configuration issues.</p></div></div></td><td><div><div><p>W-23998256</p></div></div></td></tr><tr><td><div><div><p>The log level for <code>disallowConcurrentExecution</code> messages is changed from WARN to DEBUG, reducing log noise.</p></div></div></td><td><div><div><p>W-24164028</p></div></div></td></tr><tr><td><div><div><p>The new on-demand connectivity-testing troubleshooting operation is now available.</p></div></div></td><td><div><div><p>W-23629284</p></div></div></td></tr><tr><td><div><div><p>An SDK API for queues (VM usage) and core adapters is added.</p></div></div></td><td><div><div><p>W-19439432</p></div></div></td></tr><tr><td><div><div><p>The new on-demand <code>connectionCount</code> troubleshooting operation is now available.</p></div></div></td><td><div><div><p>W-23716301</p></div></div></td></tr><tr><td><div><div><p>A warning is now logged when NTLM authentication is configured but the server doesn’t issue an NTLM challenge.</p></div></div></td><td><div><div><p>W-17651806</p></div></div></td></tr><tr><td><div><div><p>Fallback is now enabled as the default strategy for contracts collection. To change the behavior, configure the <code>anypoint.platform.clients_fetch_mode</code> system property with the values <code>sharded</code>, <code>legacy</code>, or <code>fallback</code>.</p></div></div></td><td><div><div><p>W-24179706</p></div></div></td></tr><tr><td><div><div><p>When API Gateway authenticates with Anypoint Platform, a transient failure of the <code>/login</code> request no longer discards an otherwise valid Access Management token. The token is now invalidated only on an actual authentication failure (401 or 403).</p></div></div></td><td><div><div><p>W-24144244</p></div></div></td></tr></tbody></table>

### 4.6.35:4-java8

**4.6.35 LTS Runtime Updates**

- Bundled JDK version: OpenJDK "1.8.0\_452"

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.41`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>The Reactor Core library is upgraded to 3.8.7.</p></div></div></td><td><div><div><p>W-3300013</p></div></div></td></tr><tr><td><div><div><p>The Jackson library is upgraded to 2.22.2.</p></div></div></td><td><div><div><p>W-23947149</p></div></div></td></tr><tr><td><div><div><p>The jsoup library is upgraded to 1.23.2.</p></div></div></td><td><div><div><p>W-23987949</p></div></div></td></tr><tr><td><div><div><p>Configuration property placeholder resolution now stops once it exceeds a maximum nesting depth, instead of continuing to recurse through a cyclic or excessively deep reference chain. You can configure the depth limit through the <code>mule.properties.resolution.maxDepth</code> system property, which defaults to 10.</p></div></div></td><td><div><div><p>W-23650198</p></div></div></td></tr><tr><td><div><div><p>Error-mapping preservation during error propagation can now be enabled through the <code>mule.honourErrorMappingsOnErrorPropagation</code> system property. When enabled, an error whose type was already resolved inside a scope, including any remapping by an error mapping, keeps that resolved type as it propagates out of the scope, instead of reverting to the raw connector error type.</p></div></div></td><td><div><div><p>W-23955755</p></div></div></td></tr><tr><td><div><div><p>A connector’s message source no longer deadlocks when its connection-retry logic triggers a stop of the retry scheduler from one of that scheduler’s own worker threads.</p></div></div></td><td><div><div><p>W-24234538</p></div></div></td></tr><tr><td><div><div><p>Network information listening ports are now scoped to the Mule process.</p></div></div></td><td><div><div><p>W-24043880</p></div></div></td></tr><tr><td><div><div><p><code>NullPointerException</code> errors no longer occur when loading the extension model of a connector whose connection provider uses the <code>@ClientCredentials</code> or <code>@AuthorizationCode</code> OAuth annotation with <code>credentialsPlacement</code> configured.</p></div></div></td><td><div><div><p>W-24086656</p></div></div></td></tr><tr><td><div><div><p>Policy logging context is no longer lost when a dynamic Flow Reference resolves to a subflow.</p></div></div></td><td><div><div><p>W-24026465</p></div></div></td></tr><tr><td><div><div><p>The new <code>loggingConfiguration</code> troubleshooting operation helps you diagnose logging configuration issues.</p></div></div></td><td><div><div><p>W-23998256</p></div></div></td></tr><tr><td><div><div><p>The log level for <code>disallowConcurrentExecution</code> messages is changed from WARN to DEBUG, reducing log noise.</p></div></div></td><td><div><div><p>W-24164028</p></div></div></td></tr><tr><td><div><div><p>The new on-demand connectivity-testing troubleshooting operation is now available.</p></div></div></td><td><div><div><p>W-23629284</p></div></div></td></tr><tr><td><div><div><p>An SDK API for queues (VM usage) and core adapters is added.</p></div></div></td><td><div><div><p>W-19439432</p></div></div></td></tr><tr><td><div><div><p>The new on-demand <code>connectionCount</code> troubleshooting operation is now available.</p></div></div></td><td><div><div><p>W-23716301</p></div></div></td></tr><tr><td><div><div><p>A warning is now logged when NTLM authentication is configured but the server doesn’t issue an NTLM challenge.</p></div></div></td><td><div><div><p>W-17651806</p></div></div></td></tr><tr><td><div><div><p>Fallback is now enabled as the default strategy for contracts collection. To change the behavior, configure the <code>anypoint.platform.clients_fetch_mode</code> system property with the values <code>sharded</code>, <code>legacy</code>, or <code>fallback</code>.</p></div></div></td><td><div><div><p>W-24179706</p></div></div></td></tr><tr><td><div><div><p>When API Gateway authenticates with Anypoint Platform, a transient failure of the <code>/login</code> request no longer discards an otherwise valid Access Management token. The token is now invalidated only on an actual authentication failure (401 or 403).</p></div></div></td><td><div><div><p>W-24144244</p></div></div></td></tr></tbody></table>

## September 4, 2026

### What’s New

- This release of 4.12.3 and 4.9.21 includes Runtime Manager agent 2.8.4, and 4.6.34 includes
  Runtime Manager agent 2.7.16. For information, see
  [Runtime Manager Agent 2.8.4 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.8.x-release-notes#2-8-4)
  and
  [Runtime Manager Agent 2.7.16 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-16).

### Fixed Issues

### 4.12.3:4e-java17

**4.12.3 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.18+8

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.41`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>An <code>&lt;async&gt;</code> scope can now be configured to wait for its in-flight events to finish before flows are stopped during a graceful shutdown, which helps avoid dropped or canceled async work. This behavior is disabled by default and can be enabled through the <code>mule.async.gracefulShutdown.drainInflight</code> system property.</p></div></div></td><td><div><div><p>W-23602447</p></div></div></td></tr><tr><td><div><div><p>An SDK-based reconnectable message source no longer attempts to reconnect while a graceful shutdown is in progress.</p></div></div></td><td><div><div><p>W-23122573</p></div></div></td></tr><tr><td><div><div><p>Custom error mappings in the Tracing module are no longer lost on error propagation when an operation inside a <code>tracing:with-correlation-id</code> scope fails, which previously reverted the mapped error type to the raw connector error.</p></div></div></td><td><div><div><p>W-21815402</p></div></div></td></tr><tr><td><div><div><p>A disposed source policy is no longer left in the policy cache when a flow is stopped and restarted while cache population and flow-stop invalidation occur concurrently.</p></div></div></td><td><div><div><p>W-23564125</p></div></div></td></tr><tr><td><div><div><p>A memory leak no longer occurs when <code>parallel-foreach</code> and <code>scatter-gather</code> routes leave the route event pinned in a worker thread’s memory after route completion.</p></div></div></td><td><div><div><p>W-23829061</p></div></div></td></tr><tr><td><div><div><p>Artifact descriptor validation failures during deployment now report more specific exceptions.</p></div></div></td><td><div><div><p>W-23047228</p></div></div></td></tr><tr><td><div><div><p>A malformed authorization URL no longer occurs when the configured OAuth <code>authorizationUrl</code> contains an existing query parameter.</p></div></div></td><td><div><div><p>W-23064254</p></div></div></td></tr><tr><td><div><div><p>A worker thread no longer hangs indefinitely, eventually exhausting the runtime’s thread pool, when a client drops the connection while its HTTP request body is being read.</p></div></div></td><td><div><div><p>W-23612974</p></div></div></td></tr><tr><td><div><div><p>Netty-based HTTP client requests no longer fail when the response contains a header section larger than 8 KB and a larger response header size limit is configured.</p></div></div></td><td><div><div><p>W-23443375</p></div></div></td></tr><tr><td><div><div><p>DIGEST authentication in the Netty-based HTTP client no longer fails with a 401 Unauthorized response when the server issues an RFC 7616-compliant challenge.</p></div></div></td><td><div><div><p>W-23075291</p></div></div></td></tr><tr><td><div><div><p>A <code>NullPointerException</code> no longer occurs during cluster node discovery when using PCF or Kubernetes-based cluster discovery.</p></div></div></td><td><div><div><p>W-23466789</p></div></div></td></tr><tr><td><div><div><p>Analytics events for requests rejected due to back-pressure are no longer incorrectly reported as HTTP 500 and now correctly report 503 by default. Custom status codes for other error scenarios can also be configured through the <code>anypoint.platform.error.mapping</code> (format <code>NAMESPACE:IDENTIFIER:STATUS_CODE</code>, comma-separated for multiple mappings) and <code>anypoint.platform.error.default</code> system properties.</p></div></div></td><td><div><div><p>W-23509148</p></div></div></td></tr><tr><td><div><div><p>API Gateway no longer fails to read shard checksums from an ETag header that contains commas.</p></div></div></td><td><div><div><p>W-23572494</p></div></div></td></tr><tr><td><div><div><p>The fix for idle connections being destroyed and recreated instead of reused when the number of idle connections reached the configured <code>maxIdle</code> limit under concurrent load, introduced in a previous release, is reverted in this release.</p></div></div></td><td><div><div><p>W-22716456</p></div></div></td></tr><tr><td><div><div><p>The jsoup library is upgraded to 1.23.1.</p></div></div></td><td><div><div><p>W-23671475</p></div></div></td></tr><tr><td><div><div><p>The Netty library is upgraded to 4.2.17.Final.</p></div></div></td><td><div><div><p>W-3300013</p></div></div></td></tr><tr><td><div><div><p>The RAML Parser library is upgraded to 2-1.2.1.</p></div></div></td><td><div><div><p>W-23328350</p></div></div></td></tr><tr><td><div><div><p>The <code>com.mulesoft.mule.runtime.gw.api.analytics</code> package is now open to all modules, so the Runtime Manager agent can serialize analytics events.</p></div></div></td><td><div><div><p>W-23846531</p></div></div></td></tr><tr><td><div><div><p><code>FileNotFoundException</code> no longer happens when trying to load a BCFKS truststore in FIPS mode.</p></div></div></td><td><div><div><p>W-24059868</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>You can now configure the size of the DataWeave script parser cache by using the <code>mule.weave.script.parser.cache.size</code> system property.</p></div></div></td><td><div><div><p>W-23138851</p></div></div></td></tr><tr><td><div><div><p>A thread-safety livelock no longer occurs in the Java module builder and converter caches.</p></div></div></td><td><div><div><p>W-23652160</p></div></div></td></tr></tbody></table>

### 4.9.21:4-java17

**4.9.21 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.18+8

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.41`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>An <code>&lt;async&gt;</code> scope can now be configured to wait for its in-flight events to finish before flows are stopped during a graceful shutdown, which helps avoid dropped or canceled async work. This behavior is disabled by default and can be enabled through the <code>mule.async.gracefulShutdown.drainInflight</code> system property.</p></div></div></td><td><div><div><p>W-23602447</p></div></div></td></tr><tr><td><div><div><p>An SDK-based reconnectable message source no longer attempts to reconnect while a graceful shutdown is in progress.</p></div></div></td><td><div><div><p>W-23122573</p></div></div></td></tr><tr><td><div><div><p>Custom error mappings in the Tracing module are no longer lost on error propagation when an operation inside a <code>tracing:with-correlation-id</code> scope fails, which previously reverted the mapped error type to the raw connector error.</p></div></div></td><td><div><div><p>W-21815402</p></div></div></td></tr><tr><td><div><div><p>A disposed source policy is no longer left in the policy cache when a flow is stopped and restarted while cache population and flow-stop invalidation occur concurrently.</p></div></div></td><td><div><div><p>W-23564125</p></div></div></td></tr><tr><td><div><div><p>A memory leak no longer occurs when <code>parallel-foreach</code> and <code>scatter-gather</code> routes leave the route event pinned in a worker thread’s memory after route completion.</p></div></div></td><td><div><div><p>W-23829061</p></div></div></td></tr><tr><td><div><div><p>Artifact descriptor validation failures during deployment now report more specific exceptions.</p></div></div></td><td><div><div><p>W-23047228</p></div></div></td></tr><tr><td><div><div><p>A malformed authorization URL no longer occurs when the configured OAuth <code>authorizationUrl</code> contains an existing query parameter.</p></div></div></td><td><div><div><p>W-23064254</p></div></div></td></tr><tr><td><div><div><p>The HTTP client configurer now includes a method to control whether sensitive headers are filtered when a request is redirected to a different domain.</p></div></div></td><td><div><div><p>W-21045658</p></div></div></td></tr><tr><td><div><div><p>A forward-proxy client no longer sends a malformed, path-only request line.</p></div></div></td><td><div><div><p>W-23384645</p></div></div></td></tr><tr><td><div><div><p>A worker thread no longer hangs indefinitely, eventually exhausting the runtime’s thread pool, when a client drops the connection while its HTTP request body is being read.</p></div></div></td><td><div><div><p>W-23612974</p></div></div></td></tr><tr><td><div><div><p>Netty-based HTTP client requests no longer fail when the response contains a header section larger than 8 KB and a larger response header size limit is configured.</p></div></div></td><td><div><div><p>W-23443375</p></div></div></td></tr><tr><td><div><div><p>DIGEST authentication in the Netty-based HTTP client no longer fails with a 401 Unauthorized response when the server issues an RFC 7616-compliant challenge.</p></div></div></td><td><div><div><p>W-23075291</p></div></div></td></tr><tr><td><div><div><p>A <code>NullPointerException</code> no longer occurs during cluster node discovery when using PCF or Kubernetes-based cluster discovery.</p></div></div></td><td><div><div><p>W-23466789</p></div></div></td></tr><tr><td><div><div><p>Analytics events for requests rejected due to back-pressure are no longer incorrectly reported as HTTP 500 and now correctly report 503 by default. Custom status codes for other error scenarios can also be configured through the <code>anypoint.platform.error.mapping</code> (format <code>NAMESPACE:IDENTIFIER:STATUS_CODE</code>, comma-separated for multiple mappings) and <code>anypoint.platform.error.default</code> system properties.</p></div></div></td><td><div><div><p>W-23509148</p></div></div></td></tr><tr><td><div><div><p>API Gateway no longer fails to read shard checksums from an ETag header that contains commas.</p></div></div></td><td><div><div><p>W-23572494</p></div></div></td></tr><tr><td><div><div><p>The fix for idle connections being destroyed and recreated instead of reused when the number of idle connections reached the configured <code>maxIdle</code> limit under concurrent load, introduced in a previous release, is reverted in this release.</p></div></div></td><td><div><div><p>W-22716456</p></div></div></td></tr><tr><td><div><div><p>The jsoup library is upgraded to 1.23.1.</p></div></div></td><td><div><div><p>W-23715606</p></div></div></td></tr><tr><td><div><div><p>The Netty library is upgraded to 4.2.17.Final.</p></div></div></td><td><div><div><p>W-3300013</p></div></div></td></tr><tr><td><div><div><p>The Jackson library is upgraded to 2.22.1.</p></div></div></td><td><div><div><p>W-23540341</p></div></div></td></tr><tr><td><div><div><p>The RAML Parser library is upgraded to 2-1.2.1.</p></div></div></td><td><div><div><p>W-23328348</p></div></div></td></tr><tr><td><div><div><p>The <code>com.mulesoft.mule.runtime.gw.api.analytics</code> package is now open to all modules, so the Runtime Manager agent can serialize analytics events.</p></div></div></td><td><div><div><p>W-23846531</p></div></div></td></tr><tr><td><div><div><p><code>FileNotFoundException</code> no longer happens when trying to load a BCFKS truststore in FIPS mode.</p></div></div></td><td><div><div><p>W-24059868</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>Vulnerable dependencies are upgraded to address reported security vulnerabilities.</p></div></div></td><td><div><div><p>W-23924223</p></div></div></td></tr><tr><td><div><div><p>You can now configure the size of the DataWeave script parser cache by using the <code>mule.weave.script.parser.cache.size</code> system property.</p></div></div></td><td><div><div><p>W-23138851</p></div></div></td></tr><tr><td><div><div><p>A thread-safety livelock no longer occurs in the Java module builder and converter caches.</p></div></div></td><td><div><div><p>W-23652160</p></div></div></td></tr></tbody></table>

### 4.6.34:6-java17

**4.6.34 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.18+8

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.41`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>An <code>&lt;async&gt;</code> scope can now be configured to wait for its in-flight events to finish before flows are stopped during a graceful shutdown, which helps avoid dropped or canceled async work. This behavior is disabled by default and can be enabled through the <code>mule.async.gracefulShutdown.drainInflight</code> system property.</p></div></div></td><td><div><div><p>W-23602447</p></div></div></td></tr><tr><td><div><div><p>An SDK-based reconnectable message source no longer attempts to reconnect while a graceful shutdown is in progress.</p></div></div></td><td><div><div><p>W-23122573</p></div></div></td></tr><tr><td><div><div><p>Custom error mappings in the Tracing module are no longer lost on error propagation when an operation inside a <code>tracing:with-correlation-id</code> scope fails, which previously reverted the mapped error type to the raw connector error.</p></div></div></td><td><div><div><p>W-21815402</p></div></div></td></tr><tr><td><div><div><p>A memory leak no longer occurs when <code>parallel-foreach</code> and <code>scatter-gather</code> routes leave the route event pinned in a worker thread’s memory after route completion.</p></div></div></td><td><div><div><p>W-23829061</p></div></div></td></tr><tr><td><div><div><p>Artifact descriptor validation failures during deployment now report more specific exceptions.</p></div></div></td><td><div><div><p>W-23047228</p></div></div></td></tr><tr><td><div><div><p>Analytics events for requests rejected due to back-pressure are no longer incorrectly reported as HTTP 500 and now correctly report 503 by default. Custom status codes for other error scenarios can also be configured through the <code>anypoint.platform.error.mapping</code> (format <code>NAMESPACE:IDENTIFIER:STATUS_CODE</code>, comma-separated for multiple mappings) and <code>anypoint.platform.error.default</code> system properties.</p></div></div></td><td><div><div><p>W-23509148</p></div></div></td></tr><tr><td><div><div><p>API Gateway no longer fails to read shard checksums from an ETag header that contains commas.</p></div></div></td><td><div><div><p>W-23572494</p></div></div></td></tr><tr><td><div><div><p>The fix for idle connections being destroyed and recreated instead of reused when the number of idle connections reached the configured <code>maxIdle</code> limit under concurrent load, introduced in a previous release, is reverted in this release.</p></div></div></td><td><div><div><p>W-22716456</p></div></div></td></tr><tr><td><div><div><p>The jsoup library is upgraded to 1.23.1.</p></div></div></td><td><div><div><p>W-23715606</p></div></div></td></tr><tr><td><div><div><p>The Apache Commons Compress library is upgraded to 1.26.0.</p></div></div></td><td><div><div><p>W-3300013</p></div></div></td></tr><tr><td><div><div><p>The Jackson library is upgraded to 2.22.1.</p></div></div></td><td><div><div><p>W-23540335</p></div></div></td></tr><tr><td><div><div><p>The RAML Parser library is upgraded to 2-1.2.1.</p></div></div></td><td><div><div><p>W-23328350</p></div></div></td></tr><tr><td><div><div><p>The <code>com.mulesoft.mule.runtime.gw.api.analytics</code> package is now open to all modules, so the Runtime Manager agent can serialize analytics events.</p></div></div></td><td><div><div><p>W-23846531</p></div></div></td></tr><tr><td><div><div><p><code>FileNotFoundException</code> no longer happens when trying to load a BCFKS truststore in FIPS mode.</p></div></div></td><td><div><div><p>W-24059868</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>You can now configure the size of the DataWeave script parser cache by using the <code>mule.weave.script.parser.cache.size</code> system property.</p></div></div></td><td><div><div><p>W-23138851</p></div></div></td></tr><tr><td><div><div><p>A thread-safety livelock no longer occurs in the Java module builder and converter caches.</p></div></div></td><td><div><div><p>W-23652160</p></div></div></td></tr></tbody></table>

### 4.6.34:6-java8

**4.6.34 LTS Runtime Updates**

- Bundled JDK version: OpenJDK "1.8.0\_452"

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.41`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>An <code>&lt;async&gt;</code> scope can now be configured to wait for its in-flight events to finish before flows are stopped during a graceful shutdown, which helps avoid dropped or canceled async work. This behavior is disabled by default and can be enabled through the <code>mule.async.gracefulShutdown.drainInflight</code> system property.</p></div></div></td><td><div><div><p>W-23602447</p></div></div></td></tr><tr><td><div><div><p>An SDK-based reconnectable message source no longer attempts to reconnect while a graceful shutdown is in progress.</p></div></div></td><td><div><div><p>W-23122573</p></div></div></td></tr><tr><td><div><div><p>Custom error mappings in the Tracing module are no longer lost on error propagation when an operation inside a <code>tracing:with-correlation-id</code> scope fails, which previously reverted the mapped error type to the raw connector error.</p></div></div></td><td><div><div><p>W-21815402</p></div></div></td></tr><tr><td><div><div><p>A memory leak no longer occurs when <code>parallel-foreach</code> and <code>scatter-gather</code> routes leave the route event pinned in a worker thread’s memory after route completion.</p></div></div></td><td><div><div><p>W-23829061</p></div></div></td></tr><tr><td><div><div><p>Artifact descriptor validation failures during deployment now report more specific exceptions.</p></div></div></td><td><div><div><p>W-23047228</p></div></div></td></tr><tr><td><div><div><p>Analytics events for requests rejected due to back-pressure are no longer incorrectly reported as HTTP 500 and now correctly report 503 by default. Custom status codes for other error scenarios can also be configured through the <code>anypoint.platform.error.mapping</code> (format <code>NAMESPACE:IDENTIFIER:STATUS_CODE</code>, comma-separated for multiple mappings) and <code>anypoint.platform.error.default</code> system properties.</p></div></div></td><td><div><div><p>W-23509148</p></div></div></td></tr><tr><td><div><div><p>API Gateway no longer fails to read shard checksums from an ETag header that contains commas.</p></div></div></td><td><div><div><p>W-23572494</p></div></div></td></tr><tr><td><div><div><p>The fix for idle connections being destroyed and recreated instead of reused when the number of idle connections reached the configured <code>maxIdle</code> limit under concurrent load, introduced in a previous release, is reverted in this release.</p></div></div></td><td><div><div><p>W-22716456</p></div></div></td></tr><tr><td><div><div><p>The jsoup library is upgraded to 1.23.1.</p></div></div></td><td><div><div><p>W-23715606</p></div></div></td></tr><tr><td><div><div><p>The Apache Commons Compress library is upgraded to 1.26.0.</p></div></div></td><td><div><div><p>W-3300013</p></div></div></td></tr><tr><td><div><div><p>The Jackson library is upgraded to 2.22.1.</p></div></div></td><td><div><div><p>W-23540335</p></div></div></td></tr><tr><td><div><div><p>The RAML Parser library is upgraded to 2-1.2.1.</p></div></div></td><td><div><div><p>W-23328350</p></div></div></td></tr><tr><td><div><div><p>The <code>com.mulesoft.mule.runtime.gw.api.analytics</code> package is now open to all modules, so the Runtime Manager agent can serialize analytics events.</p></div></div></td><td><div><div><p>W-23846531</p></div></div></td></tr><tr><td><div><div><p><code>FileNotFoundException</code> no longer happens when trying to load a BCFKS truststore in FIPS mode.</p></div></div></td><td><div><div><p>W-24059868</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>You can now configure the size of the DataWeave script parser cache by using the <code>mule.weave.script.parser.cache.size</code> system property.</p></div></div></td><td><div><div><p>W-23138851</p></div></div></td></tr><tr><td><div><div><p>A thread-safety livelock no longer occurs in the Java module builder and converter caches.</p></div></div></td><td><div><div><p>W-23652160</p></div></div></td></tr></tbody></table>

## August 12, 2026

### What’s New

- This release of 4.12.2, 4.11.6, and 4.9.20 includes Runtime Manager agent 2.8.3, and 4.6.33
  includes Runtime Manager agent 2.7.18. For information, see
  [Runtime Manager Agent 2.8.3 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.8.x-release-notes#2-8-3)
  and
  [Runtime Manager Agent 2.7.18 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-18).

### Fixed Issues

### 4.12.2:8e-java17

**4.12.2 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.41`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Lazy initialization no longer fails with a <code>NullPointerException</code> when an application using the VM connector’s publish operation also configures a global error handler.</p></div></div></td><td><div><div><p>W-23156632</p></div></div></td></tr><tr><td><div><div><p>Idle connections are no longer destroyed and recreated instead of being reused when the number of idle connections reaches the configured <code>maxIdle</code> limit under concurrent load.</p></div></div></td><td><div><div><p>W-22716456</p></div></div></td></tr><tr><td><div><div><p>An HTTP request client connecting through a proxy no longer hangs when the proxy responds with a 407 (Proxy Authentication Required) response during the CONNECT tunnel handshake.</p></div></div></td><td><div><div><p>W-23384719</p></div></div></td></tr><tr><td><div><div><p>The HTTP request client now sends a correctly formed request line when connecting through a forward proxy.</p></div></div></td><td><div><div><p>W-23384645</p></div></div></td></tr><tr><td><div><div><p>A <code>NullPointerException</code> no longer occurs when the HTTP request client reuses a pooled connection to a forward proxy.</p></div></div></td><td><div><div><p>W-23384744</p></div></div></td></tr><tr><td><div><div><p>HTTP/3 requests sent to an HTTP/1 server now correctly fail with a 505 (HTTP Version Not Supported) response.</p></div></div></td><td><div><div><p>W-23029577</p></div></div></td></tr><tr><td><div><div><p>Requests with a non-numeric <code>Content-Length</code> header are now rejected with a 400 (Bad Request) response.</p></div></div></td><td><div><div><p>W-23029480</p></div></div></td></tr><tr><td><div><div><p>A batch job no longer fails with a <code>MULE:CANCELLED</code> error during graceful shutdown.</p></div></div></td><td><div><div><p>W-23426859</p></div></div></td></tr><tr><td><div><div><p>Potential errors thrown during runtime shutdown are now handled correctly.</p></div></div></td><td><div><div><p>W-23051939</p></div></div></td></tr><tr><td><div><div><p>The Batch module now provides a public API to configure a custom queue manager and queue timeout.</p></div></div></td><td><div><div><p>W-23371797</p></div></div></td></tr><tr><td><div><div><p>When running in FIPS mode on a standalone server, the runtime now logs a warning at startup if the JVM <code>java.security</code> file isn’t configured with the required FIPS providers, instead of silently masking the misconfiguration.</p></div></div></td><td><div><div><p>W-22794711</p></div></div></td></tr><tr><td><div><div><p>The <code>Sec-WebSocket-Protocol</code> header is now forwarded on outbound WebSocket connections, so subprotocol negotiation with the server succeeds.</p></div></div></td><td><div><div><p>W-23071781</p></div></div></td></tr><tr><td><div><div><p>The Diagnostic Information Analysis File (DIAF) now includes network information.</p></div></div></td><td><div><div><p>W-22383655</p></div></div></td></tr><tr><td><div><div><p>The Diagnostic Information Analysis File (DIAF) now includes Mule agent information.</p></div></div></td><td><div><div><p>W-22383660</p></div></div></td></tr><tr><td><div><div><p>The Diagnostic Information Analysis File (DIAF) now includes a platform connectivity check.</p></div></div></td><td><div><div><p>W-22383679</p></div></div></td></tr><tr><td><div><div><p>The API Gateway resource cache is enabled by default. You can now disable it by setting the <code>anypoint.platform.resource_cache_enabled</code> system property to <code>false</code>.</p></div></div></td><td><div><div><p>W-23542185</p></div></div></td></tr><tr><td><div><div><p>The Jackson library is upgraded to 2.22.0.</p></div></div></td><td><div><div><p>W-23165634</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>The repeated attribute selector (<code>.*@</code>) now correctly preserves values when processing data structures containing empty map slots.</p></div></div></td><td><div><div><p>W-23457314</p></div></div></td></tr><tr><td><div><div><p>Type metadata processing now correctly handles sibling references that target the same type, preventing duplicate annotations.</p></div></div></td><td><div><div><p>W-23424037</p></div></div></td></tr><tr><td><div><div><p>DataWeave now handles Java Platform Module System (JPMS) access restrictions more gracefully when running on Java 17 and later in Mule runtime 4.6.0 and later.</p></div></div></td><td><div><div><p>W-23354139</p></div></div></td></tr><tr><td><div><div><p>The Jackson library is upgraded to 2.21.5.</p></div></div></td><td><div><div><p>W-23037592</p></div></div></td></tr><tr><td><div><div><p>The <code>per_app_java_bean_cache</code> compatibility flag now correctly reports its creation version as 2.9.</p></div></div></td><td><div><div><p>W-22417507</p></div></div></td></tr></tbody></table>

### 4.11.6:7e-java17

**4.11.6 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.33`

- Updated to the latest operating system security patches.

### 4.9.20:9-java17

**4.9.20 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.41`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Idle connections are no longer destroyed and recreated instead of being reused when the number of idle connections reaches the configured <code>maxIdle</code> limit under concurrent load.</p></div></div></td><td><div><div><p>W-22716456</p></div></div></td></tr><tr><td><div><div><p>HTTP/3 requests sent to an HTTP/1 server now correctly fail with a 505 (HTTP Version Not Supported) response.</p></div></div></td><td><div><div><p>W-23029577</p></div></div></td></tr><tr><td><div><div><p>Requests with a non-numeric <code>Content-Length</code> header are now rejected with a 400 (Bad Request) response.</p></div></div></td><td><div><div><p>W-23029480</p></div></div></td></tr><tr><td><div><div><p>A batch job no longer fails with a <code>MULE:CANCELLED</code> error during graceful shutdown.</p></div></div></td><td><div><div><p>W-23426859</p></div></div></td></tr><tr><td><div><div><p>Potential errors thrown during runtime shutdown are now handled correctly.</p></div></div></td><td><div><div><p>W-23051939</p></div></div></td></tr><tr><td><div><div><p>When running in FIPS mode on a standalone server, the runtime now logs a warning at startup if the JVM <code>java.security</code> file isn’t configured with the required FIPS providers, instead of silently masking the misconfiguration.</p></div></div></td><td><div><div><p>W-22794711</p></div></div></td></tr><tr><td><div><div><p>The Diagnostic Information Analysis File (DIAF) now includes network information.</p></div></div></td><td><div><div><p>W-22383655</p></div></div></td></tr><tr><td><div><div><p>The Diagnostic Information Analysis File (DIAF) now includes Mule agent information.</p></div></div></td><td><div><div><p>W-22383660</p></div></div></td></tr><tr><td><div><div><p>The Diagnostic Information Analysis File (DIAF) now includes a platform connectivity check.</p></div></div></td><td><div><div><p>W-22383679</p></div></div></td></tr><tr><td><div><div><p>The API gateway resource cache is enabled by default. You can now disable it by setting the <code>anypoint.platform.resource_cache_enabled</code> system property to <code>false</code>.</p></div></div></td><td><div><div><p>W-23542185</p></div></div></td></tr><tr><td><div><div><p>The Jackson library is upgraded to 2.22.0.</p></div></div></td><td><div><div><p>W-23131090</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>The repeated attribute selector (<code>.*@</code>) now correctly preserves values when processing data structures containing empty map slots.</p></div></div></td><td><div><div><p>W-23457314</p></div></div></td></tr><tr><td><div><div><p>The Jackson library is upgraded to 2.21.5.</p></div></div></td><td><div><div><p>W-23037592</p></div></div></td></tr><tr><td><div><div><p>The <code>per_app_java_bean_cache</code> compatibility flag now correctly reports its creation version as 2.9.</p></div></div></td><td><div><div><p>W-22417507</p></div></div></td></tr></tbody></table>

### 4.6.33:9-java17

**4.6.33 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.41`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Idle connections are no longer destroyed and recreated instead of being reused when the number of idle connections reaches the configured <code>maxIdle</code> limit under concurrent load.</p></div></div></td><td><div><div><p>W-22716456</p></div></div></td></tr><tr><td><div><div><p>A batch job no longer fails with a <code>MULE:CANCELLED</code> error during graceful shutdown.</p></div></div></td><td><div><div><p>W-23426859</p></div></div></td></tr><tr><td><div><div><p>Potential errors thrown during runtime shutdown are now handled correctly.</p></div></div></td><td><div><div><p>W-23051939</p></div></div></td></tr><tr><td><div><div><p>The Diagnostic Information Analysis File (DIAF) now includes network information.</p></div></div></td><td><div><div><p>W-22383655</p></div></div></td></tr><tr><td><div><div><p>The Diagnostic Information Analysis File (DIAF) now includes Mule agent information.</p></div></div></td><td><div><div><p>W-22383660</p></div></div></td></tr><tr><td><div><div><p>The Diagnostic Information Analysis File (DIAF) now includes a platform connectivity check.</p></div></div></td><td><div><div><p>W-22383679</p></div></div></td></tr><tr><td><div><div><p>The API gateway resource cache is enabled by default. You can now disable it by setting the <code>anypoint.platform.resource_cache_enabled</code> system property to <code>false</code>.</p></div></div></td><td><div><div><p>W-23542185</p></div></div></td></tr><tr><td><div><div><p>The Jackson library is upgraded to 2.22.0.</p></div></div></td><td><div><div><p>W-23121654</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>The repeated attribute selector (<code>.*@</code>) now correctly preserves values when processing data structures containing empty map slots.</p></div></div></td><td><div><div><p>W-23457314</p></div></div></td></tr><tr><td><div><div><p>The Jackson library is upgraded to 2.21.5.</p></div></div></td><td><div><div><p>W-23037592</p></div></div></td></tr></tbody></table>

### 4.6.33:9-java8

**4.6.33 LTS Runtime Updates**

- Bundled JDK version: OpenJDK "1.8.0\_452"

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.41`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Idle connections are no longer destroyed and recreated instead of being reused when the number of idle connections reaches the configured <code>maxIdle</code> limit under concurrent load.</p></div></div></td><td><div><div><p>W-22716456</p></div></div></td></tr><tr><td><div><div><p>A batch job no longer fails with a <code>MULE:CANCELLED</code> error during graceful shutdown.</p></div></div></td><td><div><div><p>W-23426859</p></div></div></td></tr><tr><td><div><div><p>Potential errors thrown during runtime shutdown are now handled correctly.</p></div></div></td><td><div><div><p>W-23051939</p></div></div></td></tr><tr><td><div><div><p>The Diagnostic Information Analysis File (DIAF) now includes network information.</p></div></div></td><td><div><div><p>W-22383655</p></div></div></td></tr><tr><td><div><div><p>The Diagnostic Information Analysis File (DIAF) now includes Mule agent information.</p></div></div></td><td><div><div><p>W-22383660</p></div></div></td></tr><tr><td><div><div><p>The Diagnostic Information Analysis File (DIAF) now includes a platform connectivity check.</p></div></div></td><td><div><div><p>W-22383679</p></div></div></td></tr><tr><td><div><div><p>The API gateway resource cache is enabled by default. You can now disable it by setting the <code>anypoint.platform.resource_cache_enabled</code> system property to <code>false</code>.</p></div></div></td><td><div><div><p>W-23542185</p></div></div></td></tr><tr><td><div><div><p>The Jackson library is upgraded to 2.22.0.</p></div></div></td><td><div><div><p>W-23121654</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>The repeated attribute selector (<code>.*@</code>) now correctly preserves values when processing data structures containing empty map slots.</p></div></div></td><td><div><div><p>W-23457314</p></div></div></td></tr><tr><td><div><div><p>The Jackson library is upgraded to 2.21.5.</p></div></div></td><td><div><div><p>W-23037592</p></div></div></td></tr></tbody></table>

## July 14, 2026

The July 14 patch update 4.9.19:9-java17, 4.6.32:5-java17, and 4.6.32:5-java8 addresses an issue in
the previous July 7 patch update and includes the fixes in those patches.

### 4.9.19:9-java17

**4.9.19 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.33`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>The runtime no longer logs this warning:</p></div><div><div><pre>Cannot start plugin 'rtf-cluster-server-plugin'. Plugin will be unregistered
java.lang.reflect.UndeclaredThrowableException</pre></div></div></div></td><td><div><div><p>W-23373633</p></div></div></td></tr></tbody></table>

### 4.6.32:5-java17

**4.6.32 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.33`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>The runtime no longer logs this warning:</p></div><div><div><pre>Cannot start plugin 'rtf-cluster-server-plugin'. Plugin will be unregistered
java.lang.reflect.UndeclaredThrowableException</pre></div></div></div></td><td><div><div><p>W-23373633</p></div></div></td></tr></tbody></table>

### 4.6.32:5-java8

**4.6.32 LTS Runtime Updates**

- Bundled JDK version: OpenJDK "1.8.0\_452"

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.33`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>The runtime no longer logs this warning:</p></div><div><div><pre>Cannot start plugin 'rtf-cluster-server-plugin'. Plugin will be unregistered
java.lang.reflect.UndeclaredThrowableException</pre></div></div></div></td><td><div><div><p>W-23373633</p></div></div></td></tr></tbody></table>

## July 7, 2026

### What’s New

- Runtime Manager agent 2.7.16. See
  [Runtime Manager Agent 2.7.16 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-16).

### Fixed Issues

### 4.12.1:4e-java17

**4.12.1 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.33`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Clustered applications deployed with two or more replicas no longer fail to start with a <code>NullPointerException</code> error during cluster node discovery.</p></div></div></td><td><div><div><p>W-22843942</p></div></div></td></tr><tr><td><div><div><p>Cluster node IDs are no longer generated with negative values.</p></div></div></td><td><div><div><p>W-22294724</p></div></div></td></tr><tr><td><div><div><p>Graceful shutdown no longer times out when a global error handler runs for a flow.</p></div></div></td><td><div><div><p>W-22434375</p></div></div></td></tr><tr><td><div><div><p>Long-running internal tasks no longer use the shared <code>forkJoin</code> pool during parallel flow shutdown and bootstrap configuration, preventing thread starvation.</p></div></div></td><td><div><div><p>W-22279521</p></div></div></td></tr><tr><td><div><div><p>Race conditions in <code>outerFluxCompletionScheduler</code> no longer occur during graceful shutdown.</p></div></div></td><td><div><div><p>W-22343018</p></div></div></td></tr><tr><td><div><div><p>Mule no longer hangs during shutdown when a parameter validation exception occurs during flow execution.</p></div></div></td><td><div><div><p>W-22248534</p></div></div></td></tr><tr><td><div><div><p>Connectivity testing of configurations in clustered deployments no longer uses distributed locks, preventing deadlocks.</p></div></div></td><td><div><div><p>W-22248198</p></div></div></td></tr><tr><td><div><div><p>Fatal errors such as <code>StackOverflowError</code> are now logged instead of being consumed by internal error handling.</p></div></div></td><td><div><div><p>W-22496803</p></div></div></td></tr><tr><td><div><div><p>Object Store retrieved from the registry in <code>OAuthHandler</code> is now properly initialized and started.</p></div></div></td><td><div><div><p>W-22373641</p></div></div></td></tr><tr><td><div><div><p>SDK parameter validation errors now raise the <code>MULE:VALIDATION</code> error type instead of <code>MULE:UNKNOWN</code>.</p></div></div></td><td><div><div><p>W-22276522</p></div></div></td></tr><tr><td><div><div><p><code>ConcurrentModificationException</code> errors no longer occur when multiple plugins with shared dependencies are deployed simultaneously.</p></div></div></td><td><div><div><p>W-21193046</p></div></div></td></tr><tr><td><div><div><p>The error type in the EE cache scope is now correctly reported as <code>MULE:RETRY_EXHAUSTED</code> instead of <code>EE:RETRY_EXHAUSTED</code> when until-successful exhausts its retries.</p></div></div></td><td><div><div><p>W-21525972</p></div></div></td></tr><tr><td><div><div><p>Test Connection for the HTTP listener now correctly reports a failure when an unresolvable hostname is configured in the host field.</p></div></div></td><td><div><div><p>W-21921687</p></div></div></td></tr><tr><td><div><div><p>HTTP Server now supports upgrade requests to h2c even when the request contains a non-empty body.</p></div></div></td><td><div><div><p>W-22506085</p></div></div></td></tr><tr><td><div><div><p>Duplicate XSD elements are no longer generated for connection providers declared at both the extension and configuration levels.</p></div></div></td><td><div><div><p>W-20824537</p></div></div></td></tr><tr><td><div><div><p>Shutdown validation for dynamic configurations can now be skipped by enabling the <code>mule.forcefulShutdown.dynamicConfig.disableStoppingCheck</code> system property.</p></div></div></td><td><div><div><p>W-22772644</p></div></div></td></tr><tr><td><div><div><p>Flows with a scheduler source are no longer left in an invalid state after a flow restart.</p></div></div></td><td><div><div><p>W-22918240</p></div></div></td></tr><tr><td><div><div><p>Stopping a flow no longer waits unnecessarily when no events are being processed.</p></div></div></td><td><div><div><p>W-22969411</p></div></div></td></tr><tr><td><div><div><p>Project versions defined with properties are now resolved recursively.</p></div></div></td><td><div><div><p>W-22845430</p></div></div></td></tr><tr><td><div><div><p>Extension packager validation no longer fails for operations annotated with <code>@Validator</code> that use a <code>CompletionCallback</code> operation.</p></div></div></td><td><div><div><p>W-22817376</p></div></div></td></tr><tr><td><div><div><p>Events that are dropped within a processing hook are now properly completed and terminated.</p></div></div></td><td><div><div><p>W-22470584</p></div></div></td></tr><tr><td><div><div><p>In-memory Object Store partitions are now created correctly when an application is deployed to a cluster with the Object Store plugin enabled.</p></div></div></td><td><div><div><p>W-17714668</p></div></div></td></tr><tr><td><div><div><p>Deserialization errors no longer occur in the Object Store during a runtime patch upgrade.</p></div></div></td><td><div><div><p>W-20880559</p></div></div></td></tr><tr><td><div><div><p>Applications deployed with a serialized AST now include all Mule error types in the error type repository.</p></div></div></td><td><div><div><p>W-22399271</p></div></div></td></tr><tr><td><div><div><p>Applications that use HTTP request attributes no longer fail annotation processing due to default constructor validation.</p></div></div></td><td><div><div><p>W-22385620</p></div></div></td></tr><tr><td><div><div><p>The Netty HTTP listener now rejects <code>HTTP/1.1</code> requests that have a missing or duplicate host header, in compliance with RFC 9112.</p></div></div></td><td><div><div><p>W-23052713</p></div></div></td></tr><tr><td><div><div><p>The maximum size of the dynamic <code>flow-ref</code> cache is now configurable through the <code>mule.flowRef.dynamicCacheMaxSize</code> system property, which defaults to 20.</p></div></div></td><td><div><div><p>W-22219018</p></div></div></td></tr><tr><td><div><div><p>API Gateway contract persistence can now be disabled by setting the <code>anypoint.platform.contracts_persistence_enabled</code> system property to <code>false</code>, avoiding errors when persisting large numbers of contracts.</p></div></div></td><td><div><div><p>W-22568982</p></div></div></td></tr><tr><td><div><div><p>Large Anypoint Platform authentication failure responses no longer cause excessive log bloat.</p></div></div></td><td><div><div><p>W-21882516</p></div></div></td></tr><tr><td><div><div><p>SDK sources that don’t implement <code>Reconnectable</code> are no longer restarted during graceful shutdown.</p></div></div></td><td><div><div><p>W-21563258</p></div></div></td></tr><tr><td><div><div><p>OpenTelemetry flow statistics now report metrics correctly for applications with more than one flow.</p></div></div></td><td><div><div><p>W-23051614</p></div></div></td></tr><tr><td><div><div><p>The artifact type (domain, policy, or application) is now included as an OpenTelemetry resource attribute.</p></div></div></td><td><div><div><p>W-21768636</p></div></div></td></tr><tr><td><div><div><p>OpenTelemetry metric attribute names now use a consistent notation.</p></div></div></td><td><div><div><p>W-21921584</p></div></div></td></tr><tr><td><div><div><p>The <code>mule.openTelemetry.logging.exporter.resource.container.service.name</code> system property is now available to set the service name that the Mule container reports for OpenTelemetry telemetry.</p></div></div></td><td><div><div><p>W-22861497</p></div></div></td></tr><tr><td><div><div><p>Event dumps now include a state for events that are waiting on a non-blocking operation.</p></div></div></td><td><div><div><p>W-22142952</p></div></div></td></tr><tr><td><div><div><p>The Netty library is upgraded to 4.2.15.Final.</p></div></div></td><td><div><div><p>W-22831076</p></div></div></td></tr><tr><td><div><div><p>The c3p0 library is upgraded to 0.14.1.</p></div></div></td><td><div><div><p>W-22990155</p></div></div></td></tr><tr><td><div><div><p>The Bitronix Transaction Manager library is upgraded to 3.0.2.</p></div></div></td><td><div><div><p>W-22405007</p></div></div></td></tr><tr><td><div><div><p>The Reactor Netty library is upgraded to 1.3.6.</p></div></div></td><td><div><div><p>W-3300013</p></div></div></td></tr><tr><td><div><div><p>The Jackson Core library is upgraded to 2.21.1.</p></div></div></td><td><div><div><p>W-22839747</p></div></div></td></tr><tr><td><div><div><p>The Apache Neethi library is upgraded to 3.2.1.</p></div></div></td><td><div><div><p>W-22839752</p></div></div></td></tr><tr><td><div><div><p>The OpenTelemetry API library is upgraded to 1.62.0.</p></div></div></td><td><div><div><p>W-22849469</p></div></div></td></tr><tr><td><div><div><p>The Spring Framework is upgraded to 6.2.19.</p></div></div></td><td><div><div><p>W-22939417</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>Scope resolution errors no longer occur when importing Java classes with self-referential array properties.</p></div></div></td><td><div><div><p>W-22914494</p></div></div></td></tr><tr><td><div><div><p><code>StackOverflowError</code> errors no longer occur when computing or converting type metadata for self-referencing recursive types.</p></div></div></td><td><div><div><p>W-21712344</p></div></div></td></tr></tbody></table>

### 4.11.6:4e-java17

**4.11.6 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.33`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Cluster node IDs are no longer generated with negative values.</p></div></div></td><td><div><div><p>W-22294724</p></div></div></td></tr><tr><td><div><div><p>Graceful shutdown no longer times out when a global error handler runs for a flow.</p></div></div></td><td><div><div><p>W-22434375</p></div></div></td></tr><tr><td><div><div><p>Long-running internal tasks no longer use the shared <code>forkJoin</code> pool during parallel flow shutdown and bootstrap configuration, preventing thread starvation.</p></div></div></td><td><div><div><p>W-22279521</p></div></div></td></tr><tr><td><div><div><p>Duplicate XSD elements are no longer generated for connection providers declared at both the extension and configuration levels.</p></div></div></td><td><div><div><p>W-20824537</p></div></div></td></tr><tr><td><div><div><p>Shutdown validation for dynamic configurations can now be skipped by enabling the <code>mule.forcefulShutdown.dynamicConfig.disableStoppingCheck</code> system property.</p></div></div></td><td><div><div><p>W-22772644</p></div></div></td></tr><tr><td><div><div><p>Flows with a scheduler source are no longer left in an invalid state after a flow restart.</p></div></div></td><td><div><div><p>W-22918240</p></div></div></td></tr><tr><td><div><div><p>Stopping a flow no longer waits unnecessarily when no events are being processed.</p></div></div></td><td><div><div><p>W-22969411</p></div></div></td></tr><tr><td><div><div><p>Project versions defined with properties are now resolved recursively.</p></div></div></td><td><div><div><p>W-22845430</p></div></div></td></tr><tr><td><div><div><p>Extension packager validation no longer fails for operations annotated with <code>@Validator</code> that use a <code>CompletionCallback</code> operation.</p></div></div></td><td><div><div><p>W-22817376</p></div></div></td></tr><tr><td><div><div><p>Events that are dropped within a processing hook are now properly completed and terminated.</p></div></div></td><td><div><div><p>W-22470584</p></div></div></td></tr><tr><td><div><div><p>The Netty HTTP listener now rejects <code>HTTP/1.1</code> requests that have a missing or duplicate host header, in compliance with RFC 9112.</p></div></div></td><td><div><div><p>W-23052713</p></div></div></td></tr><tr><td><div><div><p>The maximum size of the dynamic <code>flow-ref</code> cache is now configurable through the <code>mule.flowRef.dynamicCacheMaxSize</code> system property, which defaults to 20.</p></div></div></td><td><div><div><p>W-22219018</p></div></div></td></tr><tr><td><div><div><p>API Gateway contract persistence can now be disabled by setting the <code>anypoint.platform.contracts_persistence_enabled</code> system property to <code>false</code>, avoiding errors when persisting large numbers of contracts.</p></div></div></td><td><div><div><p>W-22568982</p></div></div></td></tr><tr><td><div><div><p>The c3p0 library is upgraded to 0.14.1.</p></div></div></td><td><div><div><p>W-22990152</p></div></div></td></tr><tr><td><div><div><p>The Spring Framework is upgraded to 6.2.19.</p></div></div></td><td><div><div><p>W-3300013</p></div></div></td></tr><tr><td><div><div><p>The Bitronix Transaction Manager library is upgraded to 3.0.2.</p></div></div></td><td><div><div><p>W-22405007</p></div></div></td></tr><tr><td><div><div><p>The OpenTelemetry API library is upgraded to 1.62.0.</p></div></div></td><td><div><div><p>W-22806044</p></div></div></td></tr><tr><td><div><div><p>The Netty library is upgraded to 4.2.15.Final.</p></div></div></td><td><div><div><p>W-22888966</p></div></div></td></tr><tr><td><div><div><p>The Reactor Netty library is upgraded to 1.3.6.</p></div></div></td><td><div><div><p>W-22939412</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>Scope resolution errors no longer occur when importing Java classes with self-referential array properties.</p></div></div></td><td><div><div><p>W-22914494</p></div></div></td></tr><tr><td><div><div><p><code>AvroReader</code> no longer causes memory leaks when processing Avro data in long-running flows.</p></div></div></td><td><div><div><p>W-22364385</p></div></div></td></tr></tbody></table>

### 4.9.19:8-java17

**4.9.19 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.33`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Cluster node IDs are no longer generated with negative values.</p></div></div></td><td><div><div><p>W-22294724</p></div></div></td></tr><tr><td><div><div><p>Graceful shutdown no longer times out when a global error handler runs for a flow.</p></div></div></td><td><div><div><p>W-22434375</p></div></div></td></tr><tr><td><div><div><p>Long-running internal tasks no longer use the shared <code>forkJoin</code> pool during parallel flow shutdown and bootstrap configuration, preventing thread starvation.</p></div></div></td><td><div><div><p>W-22279521</p></div></div></td></tr><tr><td><div><div><p>Duplicate XSD elements are no longer generated for connection providers declared at both the extension and configuration levels.</p></div></div></td><td><div><div><p>W-20824537</p></div></div></td></tr><tr><td><div><div><p>Shutdown validation for dynamic configurations can now be skipped by enabling the <code>mule.forcefulShutdown.dynamicConfig.disableStoppingCheck</code> system property.</p></div></div></td><td><div><div><p>W-22772644</p></div></div></td></tr><tr><td><div><div><p>Flows with a scheduler source are no longer left in an invalid state after a flow restart.</p></div></div></td><td><div><div><p>W-22918240</p></div></div></td></tr><tr><td><div><div><p>Stopping a flow no longer waits unnecessarily when no events are being processed.</p></div></div></td><td><div><div><p>W-22969411</p></div></div></td></tr><tr><td><div><div><p>Project versions defined with properties are now resolved recursively.</p></div></div></td><td><div><div><p>W-22845430</p></div></div></td></tr><tr><td><div><div><p>Extension packager validation no longer fails for operations annotated with <code>@Validator</code> that use a <code>CompletionCallback</code> operation.</p></div></div></td><td><div><div><p>W-22817376</p></div></div></td></tr><tr><td><div><div><p>Events that are dropped within a processing hook are now properly completed and terminated.</p></div></div></td><td><div><div><p>W-22470584</p></div></div></td></tr><tr><td><div><div><p>The Netty HTTP listener now rejects <code>HTTP/1.1</code> requests that have a missing or duplicate Host header, in compliance with RFC 9112.</p></div></div></td><td><div><div><p>W-23052713</p></div></div></td></tr><tr><td><div><div><p>The Content-Length header is now removed based on the actual entity byte length.</p></div></div></td><td><div><div><p>W-22570070</p></div></div></td></tr><tr><td><div><div><p>SDK sources that don’t implement <code>Reconnectable</code> are no longer restarted during graceful shutdown.</p></div></div></td><td><div><div><p>W-21563258</p></div></div></td></tr><tr><td><div><div><p>The maximum size of the dynamic <code>flow-ref</code> cache is now configurable through the <code>mule.flowRef.dynamicCacheMaxSize</code> system property, which defaults to 20.</p></div></div></td><td><div><div><p>W-22219018</p></div></div></td></tr><tr><td><div><div><p>The Jackson Databind library is upgraded to 2.21.4.</p></div></div></td><td><div><div><p>W-3300013</p></div></div></td></tr><tr><td><div><div><p>The OpenTelemetry API library is upgraded to 1.62.0.</p></div></div></td><td><div><div><p>W-22806027</p></div></div></td></tr><tr><td><div><div><p>The c3p0 library is upgraded to 0.14.1.</p></div></div></td><td><div><div><p>W-23012713</p></div></div></td></tr><tr><td><div><div><p>The Apache Neethi library is upgraded to 3.2.1.</p></div></div></td><td><div><div><p>W-22939389</p></div></div></td></tr><tr><td><div><div><p>The Apache CXF library is upgraded to 3.6.11.</p></div></div></td><td><div><div><p>W-23037617</p></div></div></td></tr><tr><td><div><div><p>The Rhino library is upgraded to 1.8.1.</p></div></div></td><td><div><div><p>W-22939391</p></div></div></td></tr><tr><td><div><div><p>The Log4j library is upgraded to 2.25.4.</p></div></div></td><td><div><div><p>W-22939403</p></div></div></td></tr><tr><td><div><div><p>The Reactor Netty library is upgraded to 1.2.18.</p></div></div></td><td><div><div><p>W-22939384</p></div></div></td></tr><tr><td><div><div><p>The Spring Framework is upgraded to 6.2.19.</p></div></div></td><td><div><div><p>W-22956997</p></div></div></td></tr><tr><td><div><div><p>The Netty library is upgraded to 4.2.15.Final.</p></div></div></td><td><div><div><p>W-22956998</p></div></div></td></tr><tr><td><div><div><p>The Bitronix Transaction Manager library is upgraded to 2.1.21.</p></div></div></td><td><div><div><p>W-22405007</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>Scope resolution errors no longer occur when importing Java classes with self-referential array properties.</p></div></div></td><td><div><div><p>W-22914494</p></div></div></td></tr><tr><td><div><div><p><code>AvroReader</code> no longer causes memory leaks when processing Avro data in long-running flows.</p></div></div></td><td><div><div><p>W-22364385</p></div></div></td></tr></tbody></table>

### 4.6.32:4-java17

**4.6.32 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.33`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>A <code>NullPointerException</code> error no longer occurs in event context handling when a flow times out while a non-blocking operation is still in flight.</p></div></div></td><td><div><div><p>W-22902839</p></div></div></td></tr><tr><td><div><div><p>Cluster node IDs are no longer generated with negative values.</p></div></div></td><td><div><div><p>W-22294724</p></div></div></td></tr><tr><td><div><div><p>Graceful shutdown no longer times out when a global error handler runs for a flow.</p></div></div></td><td><div><div><p>W-22434375</p></div></div></td></tr><tr><td><div><div><p>Long-running internal tasks no longer use the shared <code>forkJoin</code> pool during parallel flow shutdown and bootstrap configuration, preventing thread starvation.</p></div></div></td><td><div><div><p>W-22279521</p></div></div></td></tr><tr><td><div><div><p>Duplicate XSD elements are no longer generated for connection providers declared at both the extension and configuration levels.</p></div></div></td><td><div><div><p>W-20824537</p></div></div></td></tr><tr><td><div><div><p>Shutdown validation for dynamic configurations can now be skipped by enabling the <code>mule.forcefulShutdown.dynamicConfig.disableStoppingCheck</code> system property.</p></div></div></td><td><div><div><p>W-22772644</p></div></div></td></tr><tr><td><div><div><p>Flows with a scheduler source are no longer left in an invalid state after a flow restart.</p></div></div></td><td><div><div><p>W-22918240</p></div></div></td></tr><tr><td><div><div><p>Stopping a flow no longer waits unnecessarily when no events are being processed.</p></div></div></td><td><div><div><p>W-22969411</p></div></div></td></tr><tr><td><div><div><p>Project versions defined with properties are now resolved recursively.</p></div></div></td><td><div><div><p>W-22845430</p></div></div></td></tr><tr><td><div><div><p>Extension packager validation no longer fails for operations annotated with <code>@Validator</code> that use a <code>CompletionCallback</code> operation.</p></div></div></td><td><div><div><p>W-22817376</p></div></div></td></tr><tr><td><div><div><p>The Netty HTTP listener now rejects <code>HTTP/1.1</code> requests that have a missing or duplicate Host header, in compliance with RFC 9112.</p></div></div></td><td><div><div><p>W-23052713</p></div></div></td></tr><tr><td><div><div><p>SDK sources that don’t implement <code>Reconnectable</code> are no longer restarted during graceful shutdown.</p></div></div></td><td><div><div><p>W-21563258</p></div></div></td></tr><tr><td><div><div><p>The maximum size of the dynamic <code>flow-ref</code> cache is now configurable through the <code>mule.flowRef.dynamicCacheMaxSize</code> system property, which defaults to 20.</p></div></div></td><td><div><div><p>W-22219018</p></div></div></td></tr><tr><td><div><div><p>Sensitive headers are no longer forwarded when an HTTP request is redirected to a different host. This can be configured with <code>FILTER_SENSITIVE_HEADERS_ON_REDIRECT</code>.</p></div></div></td><td><div><div><p>W-21045658</p></div></div></td></tr><tr><td><div><div><p>API Gateway contract persistence can now be disabled by setting the <code>anypoint.platform.contracts_persistence_enabled</code> system property to <code>false</code>, avoiding errors when persisting large numbers of contracts.</p></div></div></td><td><div><div><p>W-22568982</p></div></div></td></tr><tr><td><div><div><p>The Joda-Time library is upgraded to 2.13.0.</p></div></div></td><td><div><div><p>W-3300013</p></div></div></td></tr><tr><td><div><div><p>The Rhino library is upgraded to 1.7.15.1.</p></div></div></td><td><div><div><p>W-22805996</p></div></div></td></tr><tr><td><div><div><p>The Apache Neethi library is upgraded to 3.2.1.</p></div></div></td><td><div><div><p>W-22805997</p></div></div></td></tr><tr><td><div><div><p>The OpenTelemetry API library is upgraded to 1.62.0.</p></div></div></td><td><div><div><p>W-22806011</p></div></div></td></tr><tr><td><div><div><p>The Apache CXF library is upgraded to 3.5.11.</p></div></div></td><td><div><div><p>W-23037585</p></div></div></td></tr><tr><td><div><div><p>The c3p0 library is upgraded to 0.14.1.</p></div></div></td><td><div><div><p>W-23012711</p></div></div></td></tr><tr><td><div><div><p>The Bitronix Transaction Manager library is upgraded to 2.1.21.</p></div></div></td><td><div><div><p>W-22405007</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>Scope resolution errors no longer occur when importing Java classes with self-referential array properties.</p></div></div></td><td><div><div><p>W-22914494</p></div></div></td></tr><tr><td><div><div><p>The Java bean metadata cache no longer performs unnecessary evictions when processing Java POJOs. A new per-app Java bean cache can be enabled with the <code>per_app_java_bean_cache</code> compatibility flag.</p></div></div></td><td><div><div><p>W-22417507</p></div></div></td></tr></tbody></table>

### 4.6.32:4-java8

**4.6.32 LTS Runtime Updates**

- Bundled JDK version: OpenJDK "1.8.0\_452"

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.33`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>A <code>NullPointerException</code> error no longer occurs in event context handling when a flow times out while a non-blocking operation is still in flight.</p></div></div></td><td><div><div><p>W-22902839</p></div></div></td></tr><tr><td><div><div><p>Cluster node IDs are no longer generated with negative values.</p></div></div></td><td><div><div><p>W-22294724</p></div></div></td></tr><tr><td><div><div><p>Graceful shutdown no longer times out when a global error handler runs for a flow.</p></div></div></td><td><div><div><p>W-22434375</p></div></div></td></tr><tr><td><div><div><p>Long-running internal tasks no longer use the shared <code>forkJoin</code> pool during parallel flow shutdown and bootstrap configuration, preventing thread starvation.</p></div></div></td><td><div><div><p>W-22279521</p></div></div></td></tr><tr><td><div><div><p>Duplicate XSD elements are no longer generated for connection providers declared at both the extension and configuration levels.</p></div></div></td><td><div><div><p>W-20824537</p></div></div></td></tr><tr><td><div><div><p>Shutdown validation for dynamic configurations can now be skipped by enabling the <code>mule.forcefulShutdown.dynamicConfig.disableStoppingCheck</code> system property.</p></div></div></td><td><div><div><p>W-22772644</p></div></div></td></tr><tr><td><div><div><p>Flows with a scheduler source are no longer left in an invalid state after a flow restart.</p></div></div></td><td><div><div><p>W-22918240</p></div></div></td></tr><tr><td><div><div><p>Stopping a flow no longer waits unnecessarily when no events are being processed.</p></div></div></td><td><div><div><p>W-22969411</p></div></div></td></tr><tr><td><div><div><p>Project versions defined with properties are now resolved recursively.</p></div></div></td><td><div><div><p>W-22845430</p></div></div></td></tr><tr><td><div><div><p>Extension packager validation no longer fails for operations annotated with <code>@Validator</code> that use a <code>CompletionCallback</code> operation.</p></div></div></td><td><div><div><p>W-22817376</p></div></div></td></tr><tr><td><div><div><p>The Netty HTTP listener now rejects <code>HTTP/1.1</code> requests that have a missing or duplicate Host header, in compliance with RFC 9112.</p></div></div></td><td><div><div><p>W-23052713</p></div></div></td></tr><tr><td><div><div><p>SDK sources that don’t implement <code>Reconnectable</code> are no longer restarted during graceful shutdown.</p></div></div></td><td><div><div><p>W-21563258</p></div></div></td></tr><tr><td><div><div><p>The maximum size of the dynamic <code>flow-ref</code> cache is now configurable through the <code>mule.flowRef.dynamicCacheMaxSize</code> system property, which defaults to 20.</p></div></div></td><td><div><div><p>W-22219018</p></div></div></td></tr><tr><td><div><div><p>Sensitive headers are no longer forwarded when an HTTP request is redirected to a different host. This can be configured with <code>FILTER_SENSITIVE_HEADERS_ON_REDIRECT</code>.</p></div></div></td><td><div><div><p>W-21045658</p></div></div></td></tr><tr><td><div><div><p>API Gateway contract persistence can now be disabled by setting the <code>anypoint.platform.contracts_persistence_enabled</code> system property to <code>false</code>, avoiding errors when persisting large numbers of contracts.</p></div></div></td><td><div><div><p>W-22568982</p></div></div></td></tr><tr><td><div><div><p>The Joda-Time library is upgraded to 2.13.0.</p></div></div></td><td><div><div><p>W-3300013</p></div></div></td></tr><tr><td><div><div><p>The Rhino library is upgraded to 1.7.15.1.</p></div></div></td><td><div><div><p>W-22805996</p></div></div></td></tr><tr><td><div><div><p>The Apache Neethi library is upgraded to 3.2.1.</p></div></div></td><td><div><div><p>W-22805997</p></div></div></td></tr><tr><td><div><div><p>The OpenTelemetry API library is upgraded to 1.62.0.</p></div></div></td><td><div><div><p>W-22806011</p></div></div></td></tr><tr><td><div><div><p>The Apache CXF library is upgraded to 3.5.11.</p></div></div></td><td><div><div><p>W-23037585</p></div></div></td></tr><tr><td><div><div><p>The c3p0 library is upgraded to 0.14.1.</p></div></div></td><td><div><div><p>W-23012711</p></div></div></td></tr><tr><td><div><div><p>The Bitronix Transaction Manager library is upgraded to 2.1.21.</p></div></div></td><td><div><div><p>W-22405007</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>Scope resolution errors no longer occur when importing Java classes with self-referential array properties.</p></div></div></td><td><div><div><p>W-22914494</p></div></div></td></tr><tr><td><div><div><p>The Java bean metadata cache no longer performs unnecessary evictions when processing Java POJOs. A new per-app Java bean cache can be enabled with the <code>per_app_java_bean_cache</code> compatibility flag.</p></div></div></td><td><div><div><p>W-22417507</p></div></div></td></tr></tbody></table>

## June 2, 2026

### What’s New

- Mule runtime engine 4.12.0 is now available.

  For information about the release notes, see
  [Mule Runtime Engine 4.12.0 Release Notes](https://docs.mulesoft.com/release-notes/mule-runtime/mule-4.12.0-release-notes). For
  information about the new release cadence, see
  [Edge and LTS Releases for Mule](https://docs.mulesoft.com/release-notes/mule-runtime/lts-edge-release-cadence).

- Runtime Manager agent 2.7.15. See
  [Runtime Manager Agent 2.7.15 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-15).

### Fixed Issues

### 4.12.0:10e-java17

**4.12.0 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.33`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Upstream HTTP requests are now cancelled when a downstream client disconnects, preventing unnecessary data transfer.</p></div></div></td><td><div><div><p>W-20084343</p></div></div></td></tr><tr><td><div><div><p>The Netty HTTP client no longer throws <code>NullPointerException</code> when handling Expect 100-Continue responses.</p></div></div></td><td><div><div><p>W-21513490</p></div></div></td></tr><tr><td><div><div><p>Sensitive headers are no longer forwarded when an HTTP request is redirected to a different host. This can be configured with <code>FILTER_SENSITIVE_HEADERS_ON_REDIRECT</code>.</p></div></div></td><td><div><div><p>W-21045658</p></div></div></td></tr><tr><td><div><div><p>The Apache CXF library is upgraded to 3.6.8.</p></div></div></td><td><div><div><p>W-20541600</p></div></div></td></tr><tr><td><div><div><p>Cluster encryption now uses the configured algorithm correctly instead of defaulting to Blowfish.</p></div></div></td><td><div><div><p>W-21666905</p></div></div></td></tr><tr><td><div><div><p>Race conditions during policy redeployment that caused Mule to stop processing events permanently no longer occur.</p></div></div></td><td><div><div><p>W-22343705</p></div></div></td></tr><tr><td><div><div><p>Redelivery policy logging now includes additional context for troubleshooting.</p></div></div></td><td><div><div><p>W-20636028</p></div></div></td></tr><tr><td><div><div><p>The Tanuki Java Service Wrapper is upgraded to 3.6.4.</p></div></div></td><td><div><div><p>W-17051070</p></div></div></td></tr><tr><td><div><div><p>The RAML parser is upgraded to 1.1.10.</p></div></div></td><td><div><div><p>W-21768014</p></div></div></td></tr><tr><td><div><div><p>The OpenTelemetry SDK is upgraded to 1.60.1.</p></div></div></td><td><div><div><p>W-21808539</p></div></div></td></tr><tr><td><div><div><p>Persistent ObjectStore or Batch data serialized before a patch upgrade now deserializes correctly after upgrading.</p></div></div></td><td><div><div><p>W-22623626</p></div></div></td></tr><tr><td><div><div><p><code>OutOfMemory</code> errors no longer occur when establishing SSL connections with HTTP endpoints.</p></div></div></td><td><div><div><p>W-22547971</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>DataWeave now supports the <code>private</code> modifier on <code>fun</code>, <code>var</code>, <code>ns</code>, and <code>type</code> declarations to hide them from importers.</p></div></div></td><td><div><div><p>W-21148967</p></div></div></td></tr><tr><td><div><div><p><code>internal</code> is no longer a reserved word and can now be used as an identifier in DataWeave scripts.</p></div></div></td><td><div><div><p>W-21508044</p></div></div></td></tr><tr><td><div><div><p>The compiler now reports an error when overloads of the same function declare different visibility modifiers.</p></div></div></td><td><div><div><p>W-21362539</p></div></div></td></tr><tr><td><div><div><p><code>StackOverflowError</code> no longer occurs in the type checker when resolving intersections of unbound type parameters.</p></div></div></td><td><div><div><p>W-20124753</p></div></div></td></tr><tr><td><div><div><p>Runtime errors no longer occur when invoking overloaded functions across modules.</p></div></div></td><td><div><div><p>W-21811015</p></div></div></td></tr><tr><td><div><div><p>Spurious type-check errors no longer occur when an optional key-value pair is assigned to a required one.</p></div></div></td><td><div><div><p>W-21351058</p></div></div></td></tr><tr><td><div><div><p><code>deferred</code> values passed to the <code>write</code> function now terminate correctly.</p></div></div></td><td><div><div><p>W-20925604</p></div></div></td></tr><tr><td><div><div><p>Out-of-memory errors no longer occur when reading large text or CDATA sections with the indexed XML reader.</p></div></div></td><td><div><div><p>W-21006104</p></div></div></td></tr><tr><td><div><div><p>The Java module bean introspection cache no longer causes memory leaks.</p></div></div></td><td><div><div><p>W-22419118</p></div></div></td></tr></tbody></table>

### 4.11.5:4e-java17

**4.11.5 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.33`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Connectivity testing of configurations in clustered deployments no longer uses distributed locks, preventing deadlocks.</p></div></div></td><td><div><div><p>W-22248198</p></div></div></td></tr><tr><td><div><div><p>Fatal errors such as <code>StackOverflowError</code> are now logged instead of being consumed by internal error handling.</p></div></div></td><td><div><div><p>W-22496803</p></div></div></td></tr><tr><td><div><div><p>Mule no longer hangs during shutdown when a parameter validation exception occurs during flow execution.</p></div></div></td><td><div><div><p>W-22248534</p></div></div></td></tr><tr><td><div><div><p>Race conditions in <code>outerFluxCompletionScheduler</code> no longer occur during graceful shutdown.</p></div></div></td><td><div><div><p>W-22343018</p></div></div></td></tr><tr><td><div><div><p>The ObjectStore retrieved from the Registry in <code>OAuthHandler</code> is now properly initialized and started.</p></div></div></td><td><div><div><p>W-22373641</p></div></div></td></tr><tr><td><div><div><p>SDK parameter validation errors now raise the <code>MULE:VALIDATION</code> error type instead of <code>MULE:UNKNOWN</code>.</p></div></div></td><td><div><div><p>W-22276522</p></div></div></td></tr><tr><td><div><div><p>Race conditions during policy redeployment that caused Mule to stop processing events permanently no longer occur.</p></div></div></td><td><div><div><p>W-22343705</p></div></div></td></tr><tr><td><div><div><p><code>ConcurrentModificationException</code> errors no longer occur when multiple plugins with shared dependencies are deployed simultaneously.</p></div></div></td><td><div><div><p>W-21193046</p></div></div></td></tr><tr><td><div><div><p>Cluster encryption now uses the configured algorithm correctly instead of defaulting to Blowfish.</p></div></div></td><td><div><div><p>W-21666905</p></div></div></td></tr><tr><td><div><div><p>The error type in the EE Cache scope is now correctly reported as <code>MULE:RETRY_EXHAUSTED</code> instead of <code>EE:RETRY_EXHAUSTED</code> when until-successful exhausts its retries.</p></div></div></td><td><div><div><p>W-21525972</p></div></div></td></tr><tr><td><div><div><p>Large Anypoint Platform authentication failure responses no longer cause excessive log bloat.</p></div></div></td><td><div><div><p>W-21882516</p></div></div></td></tr><tr><td><div><div><p>HTTP Server now supports Upgrade requests to h2c even when the request contains a non-empty body.</p></div></div></td><td><div><div><p>W-22506085</p></div></div></td></tr><tr><td><div><div><p>Test Connection for The HTTP listener now correctly reports a failure when an unresolvable hostname is configured in the Host field.</p></div></div></td><td><div><div><p>W-21921687</p></div></div></td></tr><tr><td><div><div><p>The Spring Core library is upgraded to 6.2.18.</p></div></div></td><td><div><div><p>W-22169898</p></div></div></td></tr><tr><td><div><div><p>Persistent ObjectStore or Batch data serialized before a patch upgrade now deserializes correctly after upgrading.</p></div></div></td><td><div><div><p>W-22623626</p></div></div></td></tr><tr><td><div><div><p><code>OutOfMemory</code> errors no longer occur when establishing SSL connections with HTTP endpoints.</p></div></div></td><td><div><div><p>W-22547971</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p><code>StackOverflowError</code> errors no longer occur when computing or converting type metadata for self-referencing recursive types.</p></div></div></td><td><div><div><p>W-21712344</p></div></div></td></tr><tr><td><div><div><p>The Java bean metadata cache no longer performs unnecessary evictions when processing Java POJOs. A new per-app Java bean cache can be enabled with the <code>per_app_java_bean_cache</code> compatibility flag.</p></div></div></td><td><div><div><p>W-22417507</p></div></div></td></tr><tr><td><div><div><p>The Java module bean introspection cache no longer causes memory leaks.</p></div></div></td><td><div><div><p>W-22419118</p></div></div></td></tr></tbody></table>

### 4.9.18:3-java17

**4.9.18 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.33`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Connectivity testing of configurations in clustered deployments no longer uses distributed locks, preventing deadlocks.</p></div></div></td><td><div><div><p>W-22248198</p></div></div></td></tr><tr><td><div><div><p>Fatal errors such as <code>StackOverflowError</code> are now logged instead of being consumed by internal error handling.</p></div></div></td><td><div><div><p>W-22496803</p></div></div></td></tr><tr><td><div><div><p>Mule no longer hangs during shutdown when a parameter validation exception occurs during flow execution.</p></div></div></td><td><div><div><p>W-22248534</p></div></div></td></tr><tr><td><div><div><p>Race conditions in <code>outerFluxCompletionScheduler</code> no longer occur during graceful shutdown.</p></div></div></td><td><div><div><p>W-22343018</p></div></div></td></tr><tr><td><div><div><p>The ObjectStore retrieved from the Registry in <code>OAuthHandler</code> is now properly initialized and started.</p></div></div></td><td><div><div><p>W-22373641</p></div></div></td></tr><tr><td><div><div><p>SDK parameter validation errors now raise the <code>MULE:VALIDATION</code> error type instead of <code>MULE:UNKNOWN</code>.</p></div></div></td><td><div><div><p>W-22276522</p></div></div></td></tr><tr><td><div><div><p>Race conditions during policy redeployment that caused Mule to stop processing events permanently no longer occur.</p></div></div></td><td><div><div><p>W-22343705</p></div></div></td></tr><tr><td><div><div><p><code>ConcurrentModificationException</code> errors no longer occur when multiple plugins with shared dependencies are deployed simultaneously.</p></div></div></td><td><div><div><p>W-21193046</p></div></div></td></tr><tr><td><div><div><p>Cluster encryption now uses the configured algorithm correctly instead of defaulting to Blowfish.</p></div></div></td><td><div><div><p>W-21666905</p></div></div></td></tr><tr><td><div><div><p>The error type in the EE Cache scope is now correctly reported as <code>MULE:RETRY_EXHAUSTED</code> instead of <code>EE:RETRY_EXHAUSTED</code> when until-successful exhausts its retries.</p></div></div></td><td><div><div><p>W-21525972</p></div></div></td></tr><tr><td><div><div><p>Large Anypoint Platform authentication failure responses no longer cause excessive log bloat.</p></div></div></td><td><div><div><p>W-21882516</p></div></div></td></tr><tr><td><div><div><p>Persistent ObjectStore or Batch data serialized before a patch upgrade now deserializes correctly after upgrading.</p></div></div></td><td><div><div><p>W-22623626</p></div></div></td></tr><tr><td><div><div><p><code>OutOfMemory</code> errors no longer occur when establishing SSL connections with HTTP endpoints.</p></div></div></td><td><div><div><p>W-22547971</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p><code>StackOverflowError</code> errors no longer occur when computing or converting type metadata for self-referencing recursive types.</p></div></div></td><td><div><div><p>W-21712344</p></div></div></td></tr><tr><td><div><div><p>The Java bean metadata cache no longer performs unnecessary evictions when processing Java POJOs. A new per-app Java bean cache can be enabled with the <code>per_app_java_bean_cache</code> compatibility flag.</p></div></div></td><td><div><div><p>W-22417507</p></div></div></td></tr></tbody></table>

### 4.6.31:3-java17

**4.6.31 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.33`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Connectivity testing of configurations in clustered deployments no longer uses distributed locks, preventing deadlocks.</p></div></div></td><td><div><div><p>W-22248198</p></div></div></td></tr><tr><td><div><div><p>Fatal errors such as <code>StackOverflowError</code> are now logged instead of being consumed by internal error handling.</p></div></div></td><td><div><div><p>W-22496803</p></div></div></td></tr><tr><td><div><div><p>Mule no longer hangs during shutdown when a parameter validation exception occurs during flow execution.</p></div></div></td><td><div><div><p>W-22248534</p></div></div></td></tr><tr><td><div><div><p>Race conditions in <code>outerFluxCompletionScheduler</code> no longer occur during graceful shutdown.</p></div></div></td><td><div><div><p>W-22343018</p></div></div></td></tr><tr><td><div><div><p>The ObjectStore retrieved from the Registry in <code>OAuthHandler</code> is now properly initialized and started.</p></div></div></td><td><div><div><p>W-22373641</p></div></div></td></tr><tr><td><div><div><p>SDK parameter validation errors now raise the <code>MULE:VALIDATION</code> error type instead of <code>MULE:UNKNOWN</code>.</p></div></div></td><td><div><div><p>W-22276522</p></div></div></td></tr><tr><td><div><div><p>Race conditions during policy redeployment that caused Mule to stop processing events permanently no longer occur.</p></div></div></td><td><div><div><p>W-22343705</p></div></div></td></tr><tr><td><div><div><p><code>ConcurrentModificationException</code> errors no longer occur when multiple plugins with shared dependencies are deployed simultaneously.</p></div></div></td><td><div><div><p>W-21193046</p></div></div></td></tr><tr><td><div><div><p>Cluster encryption now uses the configured algorithm correctly instead of defaulting to Blowfish.</p></div></div></td><td><div><div><p>W-21666905</p></div></div></td></tr><tr><td><div><div><p>The error type in the EE Cache scope is now correctly reported as <code>MULE:RETRY_EXHAUSTED</code> instead of <code>EE:RETRY_EXHAUSTED</code> when until-successful exhausts its retries.</p></div></div></td><td><div><div><p>W-21525972</p></div></div></td></tr><tr><td><div><div><p>Large Anypoint Platform authentication failure responses no longer cause excessive log bloat.</p></div></div></td><td><div><div><p>W-21882516</p></div></div></td></tr><tr><td><div><div><p>In-memory Object Store partitions now correctly use cluster-wide storage when deployed to a cluster with the Object Store plugin enabled.</p></div></div></td><td><div><div><p>W-17714668</p></div></div></td></tr><tr><td><div><div><p>Persistent ObjectStore or Batch data serialized before a patch upgrade now deserializes correctly after upgrading.</p></div></div></td><td><div><div><p>W-22623626</p></div></div></td></tr><tr><td><div><div><p><code>OutOfMemory</code> errors no longer occur when establishing SSL connections with HTTP endpoints.</p></div></div></td><td><div><div><p>W-22547971</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>The Java bean metadata cache no longer performs unnecessary evictions when processing Java POJOs. A new per-app Java bean cache can be enabled with the <code>per_app_java_bean_cache</code> compatibility flag.</p></div></div></td><td><div><div><p>W-22417507</p></div></div></td></tr></tbody></table>

### 4.6.31:3-java8

**4.6.31 LTS Runtime Updates**

- Bundled JDK version: OpenJDK "1.8.0\_452"

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.33`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Connectivity testing of configurations in clustered deployments no longer uses distributed locks, preventing deadlocks.</p></div></div></td><td><div><div><p>W-22248198</p></div></div></td></tr><tr><td><div><div><p>Fatal errors such as <code>StackOverflowError</code> are now logged instead of being consumed by internal error handling.</p></div></div></td><td><div><div><p>W-22496803</p></div></div></td></tr><tr><td><div><div><p>Mule no longer hangs during shutdown when a parameter validation exception occurs during flow execution.</p></div></div></td><td><div><div><p>W-22248534</p></div></div></td></tr><tr><td><div><div><p>Race conditions in <code>outerFluxCompletionScheduler</code> no longer occur during graceful shutdown.</p></div></div></td><td><div><div><p>W-22343018</p></div></div></td></tr><tr><td><div><div><p>The ObjectStore retrieved from the Registry in <code>OAuthHandler</code> is now properly initialized and started.</p></div></div></td><td><div><div><p>W-22373641</p></div></div></td></tr><tr><td><div><div><p>SDK parameter validation errors now raise the <code>MULE:VALIDATION</code> error type instead of <code>MULE:UNKNOWN</code>.</p></div></div></td><td><div><div><p>W-22276522</p></div></div></td></tr><tr><td><div><div><p>Race conditions during policy redeployment that caused Mule to stop processing events permanently no longer occur.</p></div></div></td><td><div><div><p>W-22343705</p></div></div></td></tr><tr><td><div><div><p><code>ConcurrentModificationException</code> errors no longer occur when multiple plugins with shared dependencies are deployed simultaneously.</p></div></div></td><td><div><div><p>W-21193046</p></div></div></td></tr><tr><td><div><div><p>Cluster encryption now uses the configured algorithm correctly instead of defaulting to Blowfish.</p></div></div></td><td><div><div><p>W-21666905</p></div></div></td></tr><tr><td><div><div><p>The error type in the EE Cache scope is now correctly reported as <code>MULE:RETRY_EXHAUSTED</code> instead of <code>EE:RETRY_EXHAUSTED</code> when until-successful exhausts its retries.</p></div></div></td><td><div><div><p>W-21525972</p></div></div></td></tr><tr><td><div><div><p>Large Anypoint Platform authentication failure responses no longer cause excessive log bloat.</p></div></div></td><td><div><div><p>W-21882516</p></div></div></td></tr><tr><td><div><div><p>In-memory Object Store partitions now correctly use cluster-wide storage when deployed to a cluster with the Object Store plugin enabled.</p></div></div></td><td><div><div><p>W-17714668</p></div></div></td></tr><tr><td><div><div><p>Persistent ObjectStore or Batch data serialized before a patch upgrade now deserializes correctly after upgrading.</p></div></div></td><td><div><div><p>W-22623626</p></div></div></td></tr><tr><td><div><div><p><code>OutOfMemory</code> errors no longer occur when establishing SSL connections with HTTP endpoints.</p></div></div></td><td><div><div><p>W-22547971</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>The Java bean metadata cache no longer performs unnecessary evictions when processing Java POJOs. A new per-app Java bean cache can be enabled with the <code>per_app_java_bean_cache</code> compatibility flag.</p></div></div></td><td><div><div><p>W-22417507</p></div></div></td></tr></tbody></table>

## May 19, 2026

The May 19 patch update 4.9.17:5-java17, 4.6.30:5-java17, 4.6.30:5-java8 addresses a regression in
the previous May 5 patch update and includes the fixes in those patches.

### 4.9.17:5-java17

**4.9.17 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.33`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>Incoming header names no longer use strict CRLF validation when an HTTP configuration without a listener receives an HTTPS request, avoiding out-of-memory errors. In this scenario, Mule logs a warning entry in <code>mule_ee.log</code>, but the warning doesn’t affect application behavior.</p></div></div></td><td><div><div><p>W-22571733</p></div></div></td></tr></tbody></table>

### 4.6.30:5-java17

**4.6.30 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.33`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>Incoming header names no longer use strict CRLF validation when an HTTP configuration without a listener receives an HTTPS request, avoiding out-of-memory errors. In this scenario, Mule logs a warning entry in <code>mule_ee.log</code>, but the warning doesn’t affect application behavior.</p></div></div></td><td><div><div><p>W-22571733</p></div></div></td></tr></tbody></table>

### 4.6.30:5-java8

**4.6.30 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.33`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><td><div><div><p>Incoming header names no longer use strict CRLF validation when an HTTP configuration without a listener receives an HTTPS request, avoiding out-of-memory errors. In this scenario, Mule logs a warning entry in <code>mule_ee.log</code>, but the warning doesn’t affect application behavior.</p></div></div></td><td><div><div><p>W-22571733</p></div></div></td></tr></tbody></table>

## May 5, 2026

### What’s New

- Runtime Manager agent 2.7.13. See
  [Runtime Manager Agent 2.7.13 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-13).

- The Anypoint Monitoring Sidecar now supports 64-bit systems.

### Fixed Issues

### 4.11.4:4e-java17

**4.11.4 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.33`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Configuration references to configs defined in a parent domain are now properly validated at deployment time, preventing unclear runtime errors.</p></div></div></td><td><div><div><p>W-11453332</p></div></div></td></tr><tr><td><div><div><p>Extension operations using <code>@Content</code> parameters with complex map structures no longer fail to deploy.</p></div></div></td><td><div><div><p>W-18034452</p></div></div></td></tr><tr><td><div><div><p>The Grizzly HTTP library is upgraded to 2.3.36-MULE-029.</p></div></div></td><td><div><div><p>W-21337433</p></div></div></td></tr><tr><td><div><div><p>Netty HTTP client NTLM authentication no longer fails due to missing TCP connection affinity during the handshake.</p></div></div></td><td><div><div><p>W-21615520</p></div></div></td></tr><tr><td><div><div><p>The plexus-utils library is upgraded to 4.0.3.</p></div></div></td><td><div><div><p>W-21774430</p></div></div></td></tr><tr><td><div><div><p>The HTTP listener now gracefully handles non-RFC-compliant date formats in Set-Cookie <code>Expires</code> attributes.</p></div></div></td><td><div><div><p>W-21860840</p></div></div></td></tr><tr><td><div><div><p>The Netty library is upgraded to 4.2.12.Final.</p></div></div></td><td><div><div><p>W-21913252</p></div></div></td></tr><tr><td><div><div><p>HTTP 304 (Not Modified) responses sent through the HTTP listener no longer include an incorrect Content-Length header.</p></div></div></td><td><div><div><p>W-21632770</p></div></div></td></tr><tr><td><div><div><p>Netty HTTP client no longer sends an incorrect WWW-Authenticate header during the NTLM authentication handshake.</p></div></div></td><td><div><div><p>W-21762949</p></div></div></td></tr><tr><td><div><div><p>In-memory Object Store partitions now correctly use cluster-wide storage when deployed to a cluster with the Object Store plugin enabled.</p></div></div></td><td><div><div><p>W-17714668</p></div></div></td></tr><tr><td><div><div><p>A memory leak in dynamic <code>flow-ref</code> resolution that could eventually lead to an <code>OutOfMemoryError</code> no longer occurs.</p></div></div></td><td><div><div><p>W-22013292</p></div></div></td></tr><tr><td><div><div><p>Deserialization errors no longer occur in Redis-backed Object Stores when accessing cached data created on an earlier Mule runtime version.</p></div></div></td><td><div><div><p>W-20880559</p></div></div></td></tr><tr><td><div><div><p>A serialization error that could occur when deserializing data after a Mule runtime upgrade no longer occurs.</p></div></div></td><td><div><div><p>W-21951097</p></div></div></td></tr><tr><td><div><div><p>API Gateway contracts for public OAuth clients using PKCE are no longer dropped when the client secret is null.</p></div></div></td><td><div><div><p>W-21177224</p></div></div></td></tr><tr><td><div><div><p>The support-tools-installer is removed from the Mule runtime distribution.</p></div></div></td><td><div><div><p>W-21842339</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p><code>atBeginningOfDay</code> now returns the midnight offset on DST days, instead of the input offset.</p></div></div></td><td><div><div><p>W-21614817</p></div></div></td></tr></tbody></table>

### 4.9.17:4-java17

**4.9.17 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.33`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Configuration references to configs defined in a parent domain are now properly validated at deployment time, preventing unclear runtime errors.</p></div></div></td><td><div><div><p>W-11453332</p></div></div></td></tr><tr><td><div><div><p>Extension operations using <code>@Content</code> parameters with complex map structures no longer fail to deploy.</p></div></div></td><td><div><div><p>W-18034452</p></div></div></td></tr><tr><td><div><div><p>The Grizzly HTTP library is upgraded to 2.3.36-MULE-029.</p></div></div></td><td><div><div><p>W-21337433</p></div></div></td></tr><tr><td><div><div><p>The plexus-utils library is upgraded to 4.0.3.</p></div></div></td><td><div><div><p>W-21774430</p></div></div></td></tr><tr><td><div><div><p>HTTP 304 (Not Modified) responses sent through the HTTP listener no longer include an incorrect Content-Length header.</p></div></div></td><td><div><div><p>W-21632770</p></div></div></td></tr><tr><td><div><div><p>The HTTP listener now gracefully handles non-RFC-compliant date formats in Set-Cookie <code>Expires</code> attributes.</p></div></div></td><td><div><div><p>W-21860840</p></div></div></td></tr><tr><td><div><div><p>The Netty library is upgraded to 4.2.12.Final.</p></div></div></td><td><div><div><p>W-21795152</p></div></div></td></tr><tr><td><div><div><p>In-memory Object Store partitions now correctly use cluster-wide storage when deployed to a cluster with the Object Store plugin enabled.</p></div></div></td><td><div><div><p>W-17714668</p></div></div></td></tr><tr><td><div><div><p>A memory leak in dynamic <code>flow-ref</code> resolution that could eventually lead to an <code>OutOfMemoryError</code> no longer occurs.</p></div></div></td><td><div><div><p>W-22013292</p></div></div></td></tr><tr><td><div><div><p>Deserialization errors no longer occur in Redis-backed Object Stores when accessing cached data created on an earlier Mule runtime version.</p></div></div></td><td><div><div><p>W-20880559</p></div></div></td></tr><tr><td><div><div><p>API Gateway contracts for public OAuth clients using PKCE are no longer dropped when the client secret is null.</p></div></div></td><td><div><div><p>W-21177224</p></div></div></td></tr><tr><td><div><div><p>The support-tools-installer is removed from the Mule runtime distribution.</p></div></div></td><td><div><div><p>W-21842339</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p><code>atBeginningOfDay</code> now returns the midnight offset on DST days, instead of the input offset.</p></div></div></td><td><div><div><p>W-21614817</p></div></div></td></tr></tbody></table>

### 4.6.30:4-java17

**4.6.30 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.33`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Configuration references to configs defined in a parent domain are now properly validated at deployment time, preventing unclear runtime errors.</p></div></div></td><td><div><div><p>W-11453332</p></div></div></td></tr><tr><td><div><div><p>Extension operations using <code>@Content</code> parameters with complex map structures no longer fail to deploy.</p></div></div></td><td><div><div><p>W-18034452</p></div></div></td></tr><tr><td><div><div><p>The Grizzly HTTP library is upgraded to 2.3.36-MULE-029.</p></div></div></td><td><div><div><p>W-21337433</p></div></div></td></tr><tr><td><div><div><p>The plexus-utils library is upgraded to 4.0.3.</p></div></div></td><td><div><div><p>W-21774430</p></div></div></td></tr><tr><td><div><div><p>A memory leak in dynamic <code>flow-ref</code> resolution that could eventually lead to an <code>OutOfMemoryError</code> no longer occurs.</p></div></div></td><td><div><div><p>W-22013292</p></div></div></td></tr><tr><td><div><div><p>Deserialization errors no longer occur in Redis-backed Object Stores when accessing cached data created on an earlier Mule runtime version.</p></div></div></td><td><div><div><p>W-20880559</p></div></div></td></tr><tr><td><div><div><p>API Gateway contracts for public OAuth clients using PKCE are no longer dropped when the client secret is null.</p></div></div></td><td><div><div><p>W-21177224</p></div></div></td></tr><tr><td><div><div><p>The support-tools-installer is removed from the Mule runtime distribution.</p></div></div></td><td><div><div><p>W-21842339</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p><code>atBeginningOfDay</code> now returns the midnight offset on DST days, instead of the input offset.</p></div></div></td><td><div><div><p>W-21614817</p></div></div></td></tr></tbody></table>

### 4.6.30:4-java8

**4.6.30 LTS Runtime Updates**

- Bundled JDK version: OpenJDK "1.8.0\_452"

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.33`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Configuration references to configs defined in a parent domain are now properly validated at deployment time, preventing unclear runtime errors.</p></div></div></td><td><div><div><p>W-11453332</p></div></div></td></tr><tr><td><div><div><p>Extension operations using <code>@Content</code> parameters with complex map structures no longer fail to deploy.</p></div></div></td><td><div><div><p>W-18034452</p></div></div></td></tr><tr><td><div><div><p>The Grizzly HTTP library is upgraded to 2.3.36-MULE-029.</p></div></div></td><td><div><div><p>W-21337433</p></div></div></td></tr><tr><td><div><div><p>The plexus-utils library is upgraded to 4.0.3.</p></div></div></td><td><div><div><p>W-21774430</p></div></div></td></tr><tr><td><div><div><p>A memory leak in dynamic <code>flow-ref</code> resolution that could eventually lead to an <code>OutOfMemoryError</code> no longer occurs.</p></div></div></td><td><div><div><p>W-22013292</p></div></div></td></tr><tr><td><div><div><p>Deserialization errors no longer occur in Redis-backed Object Stores when accessing cached data created on an earlier Mule runtime version.</p></div></div></td><td><div><div><p>W-20880559</p></div></div></td></tr><tr><td><div><div><p>API Gateway contracts for public OAuth clients using PKCE are no longer dropped when the client secret is null.</p></div></div></td><td><div><div><p>W-21177224</p></div></div></td></tr><tr><td><div><div><p>The support-tools-installer is removed from the Mule runtime distribution.</p></div></div></td><td><div><div><p>W-21842339</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p><code>atBeginningOfDay</code> now returns the midnight offset on DST days, instead of the input offset.</p></div></div></td><td><div><div><p>W-21614817</p></div></div></td></tr></tbody></table>

## April 7, 2026

### What’s New

Runtime Manager agent 2.7.11. See
[Runtime Manager Agent 2.7.11 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-11).

### Fixed Issues

### 4.11.3:4e-java17

**4.11.3 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.24`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>The c3p0 library is upgraded to 0.12.0.</p></div></div></td><td><div><div><p>W-21391116</p></div></div></td></tr><tr><td><div><div><p>The mchange-commons-java library is upgraded to 0.4.0.</p></div></div></td><td><div><div><p>W-21391115</p></div></div></td></tr><tr><td><div><div><p><code>NullPointerException</code> errors no longer occur in the Log4j boot configuration during application shutdown when shutdown callbacks are canceled while the Log4j context factory is disposing, which previously caused failures due to concurrent execution of <code>dispose()</code> and <code>cancel()</code>.</p></div></div></td><td><div><div><p>W-20256082</p></div></div></td></tr><tr><td><div><div><p>Until Successful scopes no longer continue retrying during application shutdown when using flow-ref.</p></div></div></td><td><div><div><p>W-20267296</p></div></div></td></tr><tr><td><div><div><p><code>NullPointerException: No Context at location</code> errors no longer occur when using operation policies with routers or scopes.</p></div></div></td><td><div><div><p>W-20791354</p></div></div></td></tr><tr><td><div><div><p>OAuth token storage now correctly uses custom <code>ObjectStores</code> (such as Redis) configured through the Object Store parameter when they’re registered in the application registry instead of the <code>ObjectStoreManager</code>.</p></div></div></td><td><div><div><p>W-19811593</p></div></div></td></tr><tr><td><div><div><p><code>Exception reached subscriber</code> errors no longer occur when combining interceptors and operation policies.</p></div></div></td><td><div><div><p>W-21250126</p></div></div></td></tr><tr><td><div><div><p>Scheduler jobs no longer deadlock during flow shutdown.</p></div></div></td><td><div><div><p>W-21263748</p></div></div></td></tr><tr><td><div><div><p>TLS Context can now be initialized during application deployment by using the <code>mule.enable.inline.tls.context.initialization</code> feature flag.</p></div></div></td><td><div><div><p>W-20038933</p></div></div></td></tr><tr><td><div><div><p>OpenTelemetry Direct streaming now supports FIPS-compatible keystore format.</p></div></div></td><td><div><div><p>W-20623905</p></div></div></td></tr><tr><td><div><div><p>A warning now appears when an OpenTelemetry property is incorrectly used as a deployment property.</p></div></div></td><td><div><div><p>W-21018072</p></div></div></td></tr><tr><td><div><div><p><code>NullPointerException</code> errors no longer occur in message processor chain alerting when reporting dropped errors or events if alerting support isn’t found for the current classloader. When alerting support isn’t available, the hooks now skip the alert and log the condition instead of invoking it on a null reference.</p></div></div></td><td><div><div><p>W-20192960</p></div></div></td></tr><tr><td><div><div><p>Netty no longer attempts to send more bytes than specified in the Content-Length header.</p></div></div></td><td><div><div><p>W-21184863</p></div></div></td></tr><tr><td><div><div><p>Netty server read timeouts now consider requests being read instead of requests being processed.</p></div></div></td><td><div><div><p>W-21321115</p></div></div></td></tr><tr><td><div><div><p>Netty HTTP Client no longer throws exceptions when a proxy server returns a 407 response and now returns the 407 response instead.</p></div></div></td><td><div><div><p>W-21465366</p></div></div></td></tr><tr><td><div><div><p>Netty response timeout behavior is now consistent with Grizzly.</p></div></div></td><td><div><div><p>W-21547186</p></div></div></td></tr><tr><td><div><div><p>Netty TLS connection failures now appear as DEBUG logs instead of WARN logs.</p></div></div></td><td><div><div><p>W-21428392</p></div></div></td></tr><tr><td><div><div><p>Netty HTTP Client now filters duplicate Content-Type headers.</p></div></div></td><td><div><div><p>W-21344116</p></div></div></td></tr><tr><td><div><div><p>The exception raised by Netty for unresolved addresses is now consistent with the Grizzly implementation.</p></div></div></td><td><div><div><p>W-21515340</p></div></div></td></tr><tr><td><div><div><p>HTTP Netty implementation performance is now improved.</p></div></div></td><td><div><div><p>W-20969515</p></div></div></td></tr><tr><td><div><div><p>HTTP Server no longer logs an error when a client closes an idle keep-alive connection.</p></div></div></td><td><div><div><p>W-21431822</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>The Avro library is upgraded to 1.12.1. The Jackson Core library is upgraded to 2.21.1.</p></div></div></td><td><div><div><p>W-21415439</p></div></div></td></tr><tr><td><div><div><p>The Jakarta Mail library is upgraded to 2.1.5.</p></div></div></td><td><div><div><p>W-21320250</p></div></div></td></tr><tr><td><div><div><p>The range operator now returns null for invalid ranges.</p></div></div></td><td><div><div><p>W-21781423</p></div></div></td></tr></tbody></table>

### 4.9.16:4-java17

**4.9.16 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.24`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>The c3p0 library is upgraded to 0.12.0.</p></div></div></td><td><div><div><p>W-21391116</p></div></div></td></tr><tr><td><div><div><p>The mchange-commons-java library is upgraded to 0.4.0.</p></div></div></td><td><div><div><p>W-21391115</p></div></div></td></tr><tr><td><div><div><p>The Jackson Core library is upgraded to 2.18.6.</p></div></div></td><td><div><div><p>W-21420104</p></div></div></td></tr><tr><td><div><div><p><code>NullPointerException</code> errors no longer occur in the Log4j boot configuration during application shutdown when shutdown callbacks are canceled while the Log4j context factory is disposing, which previously caused failures due to concurrent execution of <code>dispose()</code> and <code>cancel()</code>.</p></div></div></td><td><div><div><p>W-20256082</p></div></div></td></tr><tr><td><div><div><p>Until Successful scopes no longer continue retrying during application shutdown when using flow-ref.</p></div></div></td><td><div><div><p>W-20267296</p></div></div></td></tr><tr><td><div><div><p><code>NullPointerException: No Context at location</code> errors no longer occur when using operation policies with routers or scopes.</p></div></div></td><td><div><div><p>W-20791354</p></div></div></td></tr><tr><td><div><div><p>OAuth token storage now correctly uses custom <code>ObjectStores</code> (such as Redis) configured through the Object Store parameter when they’re registered in the application registry instead of the <code>ObjectStoreManager</code>.</p></div></div></td><td><div><div><p>W-19811593</p></div></div></td></tr><tr><td><div><div><p><code>Exception reached subscriber</code> errors no longer occur when combining interceptors and operation policies.</p></div></div></td><td><div><div><p>W-21250126</p></div></div></td></tr><tr><td><div><div><p>Scheduler jobs no longer deadlock during flow shutdown.</p></div></div></td><td><div><div><p>W-21263748</p></div></div></td></tr><tr><td><div><div><p>TLS Context can now be initialized during application deployment by using the <code>mule.enable.inline.tls.context.initialization</code> feature flag.</p></div></div></td><td><div><div><p>W-20038933</p></div></div></td></tr><tr><td><div><div><p>Netty no longer attempts to send more bytes than specified in the Content-Length header.</p></div></div></td><td><div><div><p>W-21184863</p></div></div></td></tr><tr><td><div><div><p>Netty server read timeouts now consider requests being read instead of requests being processed.</p></div></div></td><td><div><div><p>W-21321115</p></div></div></td></tr><tr><td><div><div><p>Netty HTTP Client no longer throws exceptions when a proxy server returns a 407 response and now returns the 407 response instead.</p></div></div></td><td><div><div><p>W-21465366</p></div></div></td></tr><tr><td><div><div><p>Netty response timeout behavior is now consistent with Grizzly.</p></div></div></td><td><div><div><p>W-21547186</p></div></div></td></tr><tr><td><div><div><p>Netty TLS connection failures now appear as DEBUG logs instead of WARN logs.</p></div></div></td><td><div><div><p>W-21428392</p></div></div></td></tr><tr><td><div><div><p>Netty HTTP Client now filters duplicate Content-Type headers.</p></div></div></td><td><div><div><p>W-21344116</p></div></div></td></tr><tr><td><div><div><p>The exception raised by Netty for unresolved addresses is now consistent with the Grizzly implementation.</p></div></div></td><td><div><div><p>W-21515340</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>The Avro library is upgraded to 1.12.1. The Jackson Core library is upgraded to 2.21.1.</p></div></div></td><td><div><div><p>W-21415439</p></div></div></td></tr><tr><td><div><div><p>The Jakarta Mail library is upgraded to 2.1.5.</p></div></div></td><td><div><div><p>W-21320250</p></div></div></td></tr><tr><td><div><div><p>The range operator now returns null for invalid ranges.</p></div></div></td><td><div><div><p>W-21781423</p></div></div></td></tr></tbody></table>

### 4.6.29:6-java17

**4.6.29 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.24`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>The c3p0 library is upgraded to 0.12.0.</p></div></div></td><td><div><div><p>W-21391116</p></div></div></td></tr><tr><td><div><div><p>The mchange-commons-java library is upgraded to 0.4.0.</p></div></div></td><td><div><div><p>W-21391115</p></div></div></td></tr><tr><td><div><div><p><code>NullPointerException</code> errors no longer occur in the Log4j boot configuration during application shutdown when shutdown callbacks are canceled while the Log4j context factory is disposing, which previously caused failures due to concurrent execution of <code>dispose()</code> and <code>cancel()</code>.</p></div></div></td><td><div><div><p>W-20256082</p></div></div></td></tr><tr><td><div><div><p>Until Successful scopes no longer continue retrying during application shutdown when using flow-ref.</p></div></div></td><td><div><div><p>W-20267296</p></div></div></td></tr><tr><td><div><div><p><code>NullPointerException: No Context at location</code> errors no longer occur when using operation policies with routers or scopes.</p></div></div></td><td><div><div><p>W-20791354</p></div></div></td></tr><tr><td><div><div><p>OAuth token storage now correctly uses custom <code>ObjectStores</code> (such as Redis) configured through the Object Store parameter when they’re registered in the application registry instead of the <code>ObjectStoreManager</code>.</p></div></div></td><td><div><div><p>W-19811593</p></div></div></td></tr><tr><td><div><div><p><code>Exception reached subscriber</code> errors no longer occur when combining interceptors and operation policies.</p></div></div></td><td><div><div><p>W-21250126</p></div></div></td></tr><tr><td><div><div><p>Scheduler jobs no longer deadlock during flow shutdown.</p></div></div></td><td><div><div><p>W-21263748</p></div></div></td></tr><tr><td><div><div><p>TLS Context can now be initialized during application deployment by using the <code>mule.enable.inline.tls.context.initialization</code> feature flag.</p></div></div></td><td><div><div><p>W-20038933</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>The Avro library is upgraded to 1.12.1. The Jackson Core library is upgraded to 2.21.1.</p></div></div></td><td><div><div><p>W-21415439</p></div></div></td></tr><tr><td><div><div><p>The Jakarta Mail library is upgraded to 2.1.5.</p></div></div></td><td><div><div><p>W-21320250</p></div></div></td></tr><tr><td><div><div><p>The range operator now returns null for invalid ranges.</p></div></div></td><td><div><div><p>W-21781423</p></div></div></td></tr></tbody></table>

### 4.6.29:6-java8

**4.6.29 LTS Runtime Updates**

- Bundled JDK version: OpenJDK "1.8.0\_452"

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.24`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>The c3p0 library is upgraded to 0.12.0.</p></div></div></td><td><div><div><p>W-21391116</p></div></div></td></tr><tr><td><div><div><p>The mchange-commons-java library is upgraded to 0.4.0.</p></div></div></td><td><div><div><p>W-21391115</p></div></div></td></tr><tr><td><div><div><p><code>NullPointerException</code> errors no longer occur in the Log4j boot configuration during application shutdown when shutdown callbacks are canceled while the Log4j context factory is disposing, which previously caused failures due to concurrent execution of <code>dispose()</code> and <code>cancel()</code>.</p></div></div></td><td><div><div><p>W-20256082</p></div></div></td></tr><tr><td><div><div><p>Until Successful scopes no longer continue retrying during application shutdown when using flow-ref.</p></div></div></td><td><div><div><p>W-20267296</p></div></div></td></tr><tr><td><div><div><p><code>NullPointerException: No Context at location</code> errors no longer occur when using operation policies with routers or scopes.</p></div></div></td><td><div><div><p>W-20791354</p></div></div></td></tr><tr><td><div><div><p>OAuth token storage now correctly uses custom <code>ObjectStores</code> (such as Redis) configured through the Object Store parameter when they’re registered in the application registry instead of the <code>ObjectStoreManager</code>.</p></div></div></td><td><div><div><p>W-19811593</p></div></div></td></tr><tr><td><div><div><p><code>Exception reached subscriber</code> errors no longer occur when combining interceptors and operation policies.</p></div></div></td><td><div><div><p>W-21250126</p></div></div></td></tr><tr><td><div><div><p>Scheduler jobs no longer deadlock during flow shutdown.</p></div></div></td><td><div><div><p>W-21263748</p></div></div></td></tr><tr><td><div><div><p>TLS Context can now be initialized during application deployment by using the <code>mule.enable.inline.tls.context.initialization</code> feature flag.</p></div></div></td><td><div><div><p>W-20038933</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>The Avro library is upgraded to 1.12.1. The Jackson Core library is upgraded to 2.21.1.</p></div></div></td><td><div><div><p>W-21415439</p></div></div></td></tr><tr><td><div><div><p>The Jakarta Mail library is upgraded to 2.1.5.</p></div></div></td><td><div><div><p>W-21320250</p></div></div></td></tr><tr><td><div><div><p>The range operator now returns null for invalid ranges.</p></div></div></td><td><div><div><p>W-21781423</p></div></div></td></tr></tbody></table>

## March 3, 2026

### What’s New

Runtime Manager agent 2.7.10. See
[Runtime Manager Agent 2.7.10 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-10).

### Fixed Issues

### 4.11.2:3e-java17

**4.11.2 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.24`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>When the <code>mule.forcefulShutdown.dynamicConfig.disableStoppingCheck</code> system property is enabled, the dynamic configuration check is disabled during graceful shutdown.</p></div></div></td><td><div><div><p>W-20890587</p></div></div></td></tr><tr><td><div><div><p>When the <code>mule.forcefulShutdown.raiseCancelledError</code> feature flag is enabled, Mule runtime now raises a <code>MULE:CANCELLED</code> error instead of a <code>MULE:UNKNOWN</code> error if it attempts to create a dynamic configuration during shutdown.</p></div></div></td><td><div><div><p>W-20890613</p></div></div></td></tr><tr><td><div><div><p>Extensions no longer export <code>mule-sdk-api</code> and <code>jakarta</code> dependencies in the <code>mule-artifact.json</code> file.</p></div></div></td><td><div><div><p>W-21001749</p></div></div></td></tr><tr><td><div><div><p>Client certificates (optional) are no longer requested when no trust store is configured.</p></div></div></td><td><div><div><p>W-21220031</p></div></div></td></tr><tr><td><div><div><p>Public flows now stop concurrently during graceful shutdown.</p></div></div></td><td><div><div><p>W-21228085</p></div></div></td></tr><tr><td><div><div><p>Deadlocks no longer occur during log reconfiguration when policies are applied.</p></div></div></td><td><div><div><p>W-21231834</p></div></div></td></tr><tr><td><div><div><p>When the <code>mule.enableLogEventDumpOnShutdown</code> system property is enabled, the event dump is now logged during application shutdown.</p></div></div></td><td><div><div><p>W-21232374</p></div></div></td></tr><tr><td><div><div><p>XSD validations are now enabled by default during deployment.</p></div></div></td><td><div><div><p>W-21139633</p></div></div></td></tr><tr><td><div><div><p>Errors that are not <code>MessagingException</code> errors are no longer silenced.</p></div></div></td><td><div><div><p>W-21043969</p></div></div></td></tr><tr><td><div><div><p>The reactor.netty.version library is upgraded to 1.3.2.</p></div></div></td><td><div><div><p>W-3300013</p></div></div></td></tr><tr><td><div><div><p>When the <code>mule.propagate.objectStore.customization.to.policies</code> feature flag is enabled, policies now respect their configured TTL when using Object Store v2.</p></div></div></td><td><div><div><p>W-21215761</p></div></div></td></tr><tr><td><div><div><p>The <code>"java.lang.IllegalStateException: The client must be started before use."</code> error no longer occurs when requesting an OAuth access token.</p></div></div></td><td><div><div><p>W-17689958</p></div></div></td></tr><tr><td><div><div><p>The <code>"API is blocked (unavailable)"</code> log message no longer appears during policy updates without a corresponding unblocked message.</p></div></div></td><td><div><div><p>W-20633888</p></div></div></td></tr><tr><td><div><div><p>APIkit flows that use non-default names and are mapped through the <code>flow-mapping</code> parameter on <code>apikit:config</code> are now correctly counted as public flows instead of being treated as private.</p></div></div></td><td><div><div><p>W-18668900</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>The Array range selector operator no longer experiences performance degradation.</p></div></div></td><td><div><div><p>W-20220578</p></div></div></td></tr><tr><td><div><div><p>Concurrent access to <code>KeyValuePairs</code> inside lazy materialized objects no longer causes unexpected behavior.</p></div></div></td><td><div><div><p>W-21045501</p></div></div></td></tr><tr><td><div><div><p>The Mapping Editor API now supports attributes in Anypoint Code Builder.</p></div></div></td><td><div><div><p>W-20662336</p></div></div></td></tr><tr><td><div><div><p>Updating the expression model in the Mapping Editor API now works correctly.</p></div></div></td><td><div><div><p>W-20611263</p></div></div></td></tr></tbody></table>

### 4.10.5:2e-java17

**4.10.5 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.24`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>When the <code>mule.forcefulShutdown.dynamicConfig.disableStoppingCheck</code> system property is enabled, the dynamic configuration check is disabled during graceful shutdown.</p></div></div></td><td><div><div><p>W-20890587</p></div></div></td></tr><tr><td><div><div><p>When the <code>mule.forcefulShutdown.raiseCancelledError</code> feature flag is enabled, Mule runtime now raises a <code>MULE:CANCELLED</code> error instead of a <code>MULE:UNKNOWN</code> error if it attempts to create a dynamic configuration during shutdown.</p></div></div></td><td><div><div><p>W-20890613</p></div></div></td></tr><tr><td><div><div><p>Extensions no longer export <code>mule-sdk-api</code> and <code>jakarta</code> dependencies in the <code>mule-artifact.json</code> file.</p></div></div></td><td><div><div><p>W-21001749</p></div></div></td></tr><tr><td><div><div><p>The <code>"java.lang.IllegalStateException: The client must be started before use."</code> error no longer occurs when requesting an OAuth access token.</p></div></div></td><td><div><div><p>W-17689958</p></div></div></td></tr><tr><td><div><div><p>The <code>"API is blocked (unavailable)"</code> log message no longer appears during policy updates without a corresponding unblocked message.</p></div></div></td><td><div><div><p>W-20633888</p></div></div></td></tr><tr><td><div><div><p>Streaming manager initialization failures no longer occur in certain scenarios.</p></div></div></td><td><div><div><p>W-20641469</p></div></div></td></tr><tr><td><div><div><p>APIkit flows that use non-default names and are mapped through the <code>flow-mapping</code> parameter on <code>apikit:config</code> are now correctly counted as public flows instead of being treated as private.</p></div></div></td><td><div><div><p>W-18668900</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>The Array range selector operator no longer experiences performance degradation.</p></div></div></td><td><div><div><p>W-20220578</p></div></div></td></tr><tr><td><div><div><p>Concurrent access to <code>KeyValuePairs</code> inside lazy materialized objects no longer causes unexpected behavior.</p></div></div></td><td><div><div><p>W-21045501</p></div></div></td></tr></tbody></table>

### 4.9.15:3-java17

**4.9.15 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.24`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>The jakarta.mail library is upgraded to 1.6.8.</p></div></div></td><td><div><div><p>W-21138257</p></div></div></td></tr><tr><td><div><div><p>When the <code>mule.forcefulShutdown.dynamicConfig.disableStoppingCheck</code> system property is enabled, the dynamic configuration check is disabled during graceful shutdown.</p></div></div></td><td><div><div><p>W-20890587</p></div></div></td></tr><tr><td><div><div><p>When the <code>mule.forcefulShutdown.raiseCancelledError</code> feature flag is enabled, Mule runtime now raises a <code>MULE:CANCELLED</code> error instead of a <code>MULE:UNKNOWN</code> error if it attempts to create a dynamic configuration during shutdown.</p></div></div></td><td><div><div><p>W-20890613</p></div></div></td></tr><tr><td><div><div><p>Extensions no longer export <code>mule-sdk-api</code> and <code>jakarta</code> dependencies in the <code>mule-artifact.json</code> file.</p></div></div></td><td><div><div><p>W-21001749</p></div></div></td></tr><tr><td><div><div><p>Client certificates (optional) are no longer requested when no trust store is configured.</p></div></div></td><td><div><div><p>W-21220031</p></div></div></td></tr><tr><td><div><div><p>Public flows now stop concurrently during graceful shutdown.</p></div></div></td><td><div><div><p>W-21228085</p></div></div></td></tr><tr><td><div><div><p>Deadlocks no longer occur during log reconfiguration when policies are applied.</p></div></div></td><td><div><div><p>W-21231834</p></div></div></td></tr><tr><td><div><div><p>Errors that are not <code>MessagingException</code> errors are no longer silenced.</p></div></div></td><td><div><div><p>W-21043969</p></div></div></td></tr><tr><td><div><div><p>When the <code>mule.enableLogEventDumpOnShutdown</code> system property is enabled, the event dump is now logged during application shutdown.</p></div></div></td><td><div><div><p>W-21232374</p></div></div></td></tr><tr><td><div><div><p>The <code>"java.lang.IllegalStateException: The client must be started before use."</code> errors no longer occur when requesting an OAuth access token.</p></div></div></td><td><div><div><p>W-17689958</p></div></div></td></tr><tr><td><div><div><p>When the <code>mule.propagate.objectStore.customization.to.policies</code> feature flag is enabled, policies now respect their configured TTL when using Object Store v2.</p></div></div></td><td><div><div><p>W-21215761</p></div></div></td></tr><tr><td><div><div><p>The <code>"API is blocked (unavailable)"</code> log message no longer appears during policy updates without a corresponding unblocked message.</p></div></div></td><td><div><div><p>W-20633888</p></div></div></td></tr><tr><td><div><div><p>APIkit flows that use non-default names and are mapped through the <code>flow-mapping</code> parameter on <code>apikit:config</code> are now correctly counted as public flows instead of being treated as private.</p></div></div></td><td><div><div><p>W-18668900</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>The Array range selector operator no longer experiences performance degradation.</p></div></div></td><td><div><div><p>W-20220578</p></div></div></td></tr><tr><td><div><div><p>Concurrent access to <code>KeyValuePairs</code> inside lazy materialized objects no longer causes unexpected behavior.</p></div></div></td><td><div><div><p>W-21045501</p></div></div></td></tr></tbody></table>

### 4.6.28:3-java17

**4.6.28 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.24`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>When the <code>mule.forcefulShutdown.dynamicConfig.disableStoppingCheck</code> system property is enabled, the dynamic configuration check is disabled during graceful shutdown.</p></div></div></td><td><div><div><p>W-20890587</p></div></div></td></tr><tr><td><div><div><p>When the <code>mule.forcefulShutdown.raiseCancelledError</code> feature flag is enabled, Mule runtime now raises a <code>MULE:CANCELLED</code> error instead of a <code>MULE:UNKNOWN</code> error if it attempts to create a dynamic configuration during shutdown.</p></div></div></td><td><div><div><p>W-20890613</p></div></div></td></tr><tr><td><div><div><p>Extensions no longer export <code>mule-sdk-api</code> and <code>jakarta</code> dependencies in the <code>mule-artifact.json</code> file.</p></div></div></td><td><div><div><p>W-21001749</p></div></div></td></tr><tr><td><div><div><p>Public flows now stop concurrently during graceful shutdown.</p></div></div></td><td><div><div><p>W-21228085</p></div></div></td></tr><tr><td><div><div><p>Deadlocks no longer occur during log reconfiguration when policies are applied.</p></div></div></td><td><div><div><p>W-21231834</p></div></div></td></tr><tr><td><div><div><p>When the <code>mule.enableLogEventDumpOnShutdown</code> system property is enabled, the event dump is now logged during application shutdown.</p></div></div></td><td><div><div><p>W-21232374</p></div></div></td></tr><tr><td><div><div><p>The <code>"java.lang.IllegalStateException: The client must be started before use."</code> error no longer occurs when requesting an OAuth access token.</p></div></div></td><td><div><div><p>W-17689958</p></div></div></td></tr><tr><td><div><div><p>When the <code>mule.propagate.objectStore.customization.to.policies</code> feature flag is enabled, policies now respect their configured TTL when using Object Store v2.</p></div></div></td><td><div><div><p>W-21215761</p></div></div></td></tr><tr><td><div><div><p>The tika-core library is upgraded to 3.2.3.</p></div></div></td><td><div><div><p>W-21179465</p></div></div></td></tr><tr><td><div><div><p>The <code>"API is blocked (unavailable)"</code> log message no longer appears during policy updates without a corresponding unblocked message.</p></div></div></td><td><div><div><p>W-20633888</p></div></div></td></tr><tr><td><div><div><p>APIkit flows that use non-default names and are mapped through the <code>flow-mapping</code> parameter on <code>apikit:config</code> are now correctly counted as public flows instead of being treated as private.</p></div></div></td><td><div><div><p>W-18668900</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>The Array range selector operator no longer experiences performance degradation.</p></div></div></td><td><div><div><p>W-20220578</p></div></div></td></tr><tr><td><div><div><p>Concurrent access to <code>KeyValuePairs</code> inside lazy materialized objects no longer causes unexpected behavior.</p></div></div></td><td><div><div><p>W-21045501</p></div></div></td></tr></tbody></table>

### 4.6.28:3-java8

**4.6.28 LTS Runtime Updates**

- Bundled JDK version: OpenJDK "1.8.0\_452"

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.24`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>When the <code>mule.forcefulShutdown.dynamicConfig.disableStoppingCheck</code> system property is enabled, the dynamic configuration check is disabled during graceful shutdown.</p></div></div></td><td><div><div><p>W-20890587</p></div></div></td></tr><tr><td><div><div><p>When the <code>mule.forcefulShutdown.raiseCancelledError</code> feature flag is enabled, Mule runtime now raises a <code>MULE:CANCELLED</code> error instead of a <code>MULE:UNKNOWN</code> error if it attempts to create a dynamic configuration during shutdown.</p></div></div></td><td><div><div><p>W-20890613</p></div></div></td></tr><tr><td><div><div><p>Extensions no longer export <code>mule-sdk-api</code> and <code>jakarta</code> dependencies in the <code>mule-artifact.json</code> file.</p></div></div></td><td><div><div><p>W-21001749</p></div></div></td></tr><tr><td><div><div><p>Public flows now stop concurrently during graceful shutdown.</p></div></div></td><td><div><div><p>W-21228085</p></div></div></td></tr><tr><td><div><div><p>Deadlocks no longer occur during log reconfiguration when policies are applied.</p></div></div></td><td><div><div><p>W-21231834</p></div></div></td></tr><tr><td><div><div><p>When the <code>mule.enableLogEventDumpOnShutdown</code> system property is enabled, the event dump is now logged during application shutdown.</p></div></div></td><td><div><div><p>W-21232374</p></div></div></td></tr><tr><td><div><div><p>The <code>"java.lang.IllegalStateException: The client must be started before use."</code> error no longer occurs when requesting an OAuth access token.</p></div></div></td><td><div><div><p>W-17689958</p></div></div></td></tr><tr><td><div><div><p>When the <code>mule.propagate.objectStore.customization.to.policies</code> feature flag is enabled, policies now respect their configured TTL when using Object Store v2.</p></div></div></td><td><div><div><p>W-21215761</p></div></div></td></tr><tr><td><div><div><p>The tika-core library is upgraded to 3.2.3.</p></div></div></td><td><div><div><p>W-21179465</p></div></div></td></tr><tr><td><div><div><p>The <code>"API is blocked (unavailable)"</code> log message no longer appears during policy updates without a corresponding unblocked message.</p></div></div></td><td><div><div><p>W-20633888</p></div></div></td></tr><tr><td><div><div><p>APIkit flows that use non-default names and are mapped through the <code>flow-mapping</code> parameter on <code>apikit:config</code> are now correctly counted as public flows instead of being treated as private.</p></div></div></td><td><div><div><p>W-18668900</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>The Array range selector operator no longer experiences performance degradation.</p></div></div></td><td><div><div><p>W-20220578</p></div></div></td></tr><tr><td><div><div><p>Concurrent access to <code>KeyValuePairs</code> inside lazy materialized objects no longer causes unexpected behavior.</p></div></div></td><td><div><div><p>W-21045501</p></div></div></td></tr></tbody></table>

## February 14, 2026

### Fixed Issues

### 4.11.1:2e-java17

**4.11.1 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.41`

- This patch update reverts the fixes for these Mule issues: W-20618734 and W-20628990.

### 4.10.4:1e-java17

**4.10.4 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.41`

- This patch update reverts the fixes for these Mule issues: W-20618734 and W-20628990.

### 4.9.14:1e-java17

**4.9.14 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.41`

- This patch update reverts the fixes for these Mule issues: W-20618734 and W-20628990.

### 4.9.14:1-java17

**4.9.14 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.41`

- This patch update reverts the fixes for these Mule issues: W-20618734 and W-20628990.

### 4.6.27:1-java17

**4.6.27 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.41`

- This patch update reverts the fixes for these Mule issues: W-20618734 and W-20628990.

### 4.6.27:1-java18

**4.6.27 LTS Runtime Updates**

- Bundled JDK version: OpenJDK "1.8.0\_452"

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.41`

- This patch update reverts the fixes for these Mule issues: W-20618734 and W-20628990.

## February 4, 2026

### What’s New

- Mule runtime engine 4.11.0 is now available.

  For information about the release notes, see
  [Mule Runtime Engine 4.11.0 Release Notes](https://docs.mulesoft.com/release-notes/mule-runtime/mule-4.11.0-release-notes). For
  information about the new release cadence, see
  [Edge and LTS Releases for Mule](https://docs.mulesoft.com/release-notes/mule-runtime/lts-edge-release-cadence).

Runtime Manager agent 2.7.9. See
[Runtime Manager Agent 2.7.9 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-9).

### Fixed Issues

### 4.11.0:10e-java17

**4.11.0 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.23`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>HTTP/2 connections now correctly multiplex when processing concurrent requests, reducing connection creation and latency.</p></div></div></td><td><div><div><p>W-19860076</p></div></div></td></tr><tr><td><div><div><p>The runtime now leverages the AST file for applications with the until-successful component instead of parsing configuration XML files.</p></div></div></td><td><div><div><p>W-20283146</p></div></div></td></tr><tr><td><div><div><p>Batch record deserialization no longer fails when a Netty exception occurs.</p></div></div></td><td><div><div><p>W-20552358</p></div></div></td></tr><tr><td><div><div><p>Inbound HTTP/2 header validation is now improved.</p></div></div></td><td><div><div><p>W-19873453</p></div></div></td></tr><tr><td><div><div><p>The org.apache.logging.log4j:log4j-core dependency is upgraded to 2.25.3.</p></div></div></td><td><div><div><p>W-20679050</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>AST scope navigation now works correctly for cross-file references when using the Tooling API.</p></div></div></td><td><div><div><p>W-20212809</p></div></div></td></tr><tr><td><div><div><p>A specific overload for <code>isEmpty</code> on binaries is now available to prevent implicit coercion to other types.</p></div></div></td><td><div><div><p>W-20049958</p></div></div></td></tr><tr><td><div><div><p>Materialized Java values are now cached to allow multiple executions using the same value.</p></div></div></td><td><div><div><p>W-20091279</p></div></div></td></tr><tr><td><div><div><p>Semantic tokens are now supported in the Tooling API.</p></div></div></td><td><div><div><p>W-19846990</p></div></div></td></tr><tr><td><div><div><p><code>NullPointerException</code> no longer occurs when handling annotation types.</p></div></div></td><td><div><div><p>W-19853000</p></div></div></td></tr><tr><td><div><div><p><code>LogLevel</code> documentation is now included directly in the code.</p></div></div></td><td><div><div><p>W-17800393</p></div></div></td></tr><tr><td><div><div><p>The commons-beanutils library is upgraded.</p></div></div></td><td><div><div><p>W-3300013</p></div></div></td></tr><tr><td><div><div><p>Base64 encoding and decoding now support payloads larger than memory.</p></div></div></td><td><div><div><p>W-18575719</p></div></div></td></tr><tr><td><div><div><p>Eager materialization is now supported on values, enabling caching of all exceptions inside the <code>try</code> function.</p></div></div></td><td><div><div><p>W-19717874</p></div></div></td></tr><tr><td><div><div><p>Avro <code>enum</code>, <code>map</code>, <code>union</code>, and <code>fixed</code> types are now supported as top-level elements.</p></div></div></td><td><div><div><p>W-19596039</p></div></div></td></tr><tr><td><div><div><p><code>WeaveCompiler</code> now allows precompiling mappings and modules without validation or type checking.</p></div></div></td><td><div><div><p>W-19667273</p></div></div></td></tr><tr><td><div><div><p>Type check errors are now correctly reported when resolving type checking on subgraphs.</p></div></div></td><td><div><div><p>W-19564697</p></div></div></td></tr><tr><td><div><div><p>Lazy loading of source files is now enabled during binary compilation, avoiding unnecessary memory usage.</p></div></div></td><td><div><div><p>W-19594703</p></div></div></td></tr><tr><td><div><div><p>Type inference now works correctly when using the <code>--</code> operator to subtract a key from an object.</p></div></div></td><td><div><div><p>W-19595907</p></div></div></td></tr><tr><td><div><div><p>Warning and error messages now propagate correctly between compilation phases.</p></div></div></td><td><div><div><p>W-19386849</p></div></div></td></tr><tr><td><div><div><p>Base types are now used to validate accepted values, preventing premature materialization.</p></div></div></td><td><div><div><p>W-18943395</p></div></div></td></tr><tr><td><div><div><p>Optional types now propagate correctly through chains of value selectors.</p></div></div></td><td><div><div><p>W-19272070</p></div></div></td></tr><tr><td><div><div><p>The syntax version is now added to <code>TypeGraph</code> and <code>WeaveTypeResolution</code>.</p></div></div></td><td><div><div><p>W-19271992</p></div></div></td></tr><tr><td><div><div><p>The classloader resource resolver now resolves paths correctly on Windows systems.</p></div></div></td><td><div><div><p>W-19407283</p></div></div></td></tr></tbody></table>

## February 3, 2026

### What’s New

Runtime Manager agent 2.7.9. See
[Runtime Manager Agent 2.7.9 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-9).

### Fixed Issues

### 4.10.3:2e-java17

**4.10.3 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.23`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>HTTP/2 handling now correctly multiplexes connections during concurrent request processing. Previously, a failure to multiplex caused excessive connection creation and significantly increased latency.</p></div></div></td><td><div><div><p>W-19860076</p></div></div></td></tr><tr><td><div><div><p>Improved the validation logic for inbound HTTP/2 headers to ensure better protocol compliance and security.</p></div></div></td><td><div><div><p>W-19873453</p></div></div></td></tr><tr><td><div><div><p>Optimized the logging service to avoid creating unnecessary logging contexts when running a single application.</p></div></div></td><td><div><div><p>W-19965379</p></div></div></td></tr><tr><td><div><div><p>JDK Flight Recorder (JFR) is now disabled by default.</p></div></div></td><td><div><div><p>W-19990145</p></div></div></td></tr><tr><td><div><div><p>Implemented minor improvements to Mule classloading structures to enhance efficiency and stability.</p></div></div></td><td><div><div><p>W-20028988</p></div></div></td></tr><tr><td><div><div><p>Reduced memory consumption by removing deployment-specific objects after application deployment.</p></div></div></td><td><div><div><p>W-20053979</p></div></div></td></tr><tr><td><div><div><p>The Abstract Syntax Tree (AST) file of applications using the until-successful component is now leveraged by Mule runtime instead of parsing the configuration XML files.</p></div></div></td><td><div><div><p>W-20283146</p></div></div></td></tr><tr><td><div><div><p>Optimized the HTTP Service to avoid regenerating static attributes for every request when using Netty.</p></div></div></td><td><div><div><p>W-20615232</p></div></div></td></tr><tr><td><div><div><p>Thread Context Classloader (TCCL) is no longer wrongly set to the connector after an operation policy <code>execute-next</code>.</p></div></div></td><td><div><div><p>W-20618734</p></div></div></td></tr><tr><td><div><div><p>Mule application unresponsiveness no longer occurs after a policy that uses the until-successful component is undeployed or redeployed.</p></div></div></td><td><div><div><p>W-20628990</p></div></div></td></tr><tr><td><div><div><p>The org.apache.logging.log4j:log4j-core library is upgraded to 2.25.3.</p></div></div></td><td><div><div><p>W-20679050</p></div></div></td></tr><tr><td><div><div><p>The org.apache.cxf:cxf-core library is upgraded to 3.6.9.</p></div></div></td><td><div><div><p>W-20659822</p></div></div></td></tr><tr><td><div><div><p>The io.netty:netty-bom library is upgraded to 4.2.9.Final.</p></div></div></td><td><div><div><p>W-3300013</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>Starting in Mule runtime 4.6, you can now configure materialization settings (<code>mule.dw.enable_vars_materialization_pass</code>).</p></div></div></td><td><div><div><p>W-19580992</p></div></div></td></tr></tbody></table>

### 4.9.13:2e-java17

**4.9.13 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.23`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Optimized the logging service to avoid creating unnecessary logging contexts when running a single application.</p></div></div></td><td><div><div><p>W-19965379</p></div></div></td></tr><tr><td><div><div><p>JDK Flight Recorder (JFR) is now disabled by default.</p></div></div></td><td><div><div><p>W-19990145</p></div></div></td></tr><tr><td><div><div><p>Implemented minor improvements to Mule classloading structures to enhance efficiency and stability.</p></div></div></td><td><div><div><p>W-20028988</p></div></div></td></tr><tr><td><div><div><p>Reduced memory consumption by removing deployment-specific objects after application deployment.</p></div></div></td><td><div><div><p>W-20053979</p></div></div></td></tr><tr><td><div><div><p>The Abstract Syntax Tree (AST) file of applications using the until-successful component is now leveraged by Mule runtime instead of parsing the configuration XML files.</p></div></div></td><td><div><div><p>W-20283146</p></div></div></td></tr><tr><td><div><div><p>Mule application unresponsiveness no longer occurs after a policy that uses the until-successful component is undeployed or redeployed.</p></div></div></td><td><div><div><p>W-20628990</p></div></div></td></tr><tr><td><div><div><p>Optimized the HTTP Service to avoid regenerating static attributes for every request when using Netty.</p></div></div></td><td><div><div><p>W-20615232</p></div></div></td></tr><tr><td><div><div><p>The io.netty:netty-bom library is upgraded to 4.2.9.Final.</p></div></div></td><td><div><div><p>W-3300013</p></div></div></td></tr><tr><td><div><div><p>The org.apache.logging.log4j:log4j-core library is upgraded to 2.25.3.</p></div></div></td><td><div><div><p>W-20679050</p></div></div></td></tr><tr><td><div><div><p>Fastutil is now replaced with fastutil-core.</p></div></div></td><td><div><div><p>W-20729870</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>Starting in Mule runtime 4.6, you can now configure materialization settings (<code>mule.dw.enable_vars_materialization_pass</code>).</p></div></div></td><td><div><div><p>W-19580992</p></div></div></td></tr></tbody></table>

### 4.9.13:2-java17

**4.9.13 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.23`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Optimized the logging service to avoid creating unnecessary logging contexts when running a single application.</p></div></div></td><td><div><div><p>W-19965379</p></div></div></td></tr><tr><td><div><div><p>JDK Flight Recorder (JFR) is now disabled by default.</p></div></div></td><td><div><div><p>W-19990145</p></div></div></td></tr><tr><td><div><div><p>Implemented minor improvements to Mule classloading structures to enhance efficiency and stability.</p></div></div></td><td><div><div><p>W-20028988</p></div></div></td></tr><tr><td><div><div><p>Reduced memory consumption by removing deployment-specific objects after application deployment.</p></div></div></td><td><div><div><p>W-20053979</p></div></div></td></tr><tr><td><div><div><p>The Abstract Syntax Tree (AST) file of applications using the until-successful component is now leveraged by Mule runtime instead of parsing the configuration XML files.</p></div></div></td><td><div><div><p>W-20283146</p></div></div></td></tr><tr><td><div><div><p>Mule application unresponsiveness no longer occurs after a policy that uses the until-successful component is undeployed or redeployed.</p></div></div></td><td><div><div><p>W-20628990</p></div></div></td></tr><tr><td><div><div><p>Optimized the HTTP Service to avoid regenerating static attributes for every request when using Netty.</p></div></div></td><td><div><div><p>W-20615232</p></div></div></td></tr><tr><td><div><div><p>The io.netty:netty-bom library is upgraded to 4.2.9.Final.</p></div></div></td><td><div><div><p>W-3300013</p></div></div></td></tr><tr><td><div><div><p>The org.apache.logging.log4j:log4j-core library is upgraded to 2.25.3.</p></div></div></td><td><div><div><p>W-20679050</p></div></div></td></tr><tr><td><div><div><p>Fastutil is now replaced with fastutil-core.</p></div></div></td><td><div><div><p>W-20729870</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>Starting in Mule runtime 4.6, you can now configure materialization settings (<code>mule.dw.enable_vars_materialization_pass</code>).</p></div></div></td><td><div><div><p>W-19580992</p></div></div></td></tr></tbody></table>

### 4.6.26:2-java17

**4.6.26 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.23`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>JDK Flight Recorder (JFR) is now disabled by default.</p></div></div></td><td><div><div><p>W-19990145</p></div></div></td></tr><tr><td><div><div><p>The Abstract Syntax Tree (AST) file of applications using the until-successful component is now leveraged by Mule runtime instead of parsing the configuration XML files.</p></div></div></td><td><div><div><p>W-20283146</p></div></div></td></tr><tr><td><div><div><p>Mule application unresponsiveness no longer occurs after a policy that uses the until-successful component is undeployed or redeployed.</p></div></div></td><td><div><div><p>W-20628990</p></div></div></td></tr><tr><td><div><div><p>Implemented minor improvements to Mule classloading structures to enhance efficiency and stability.</p></div></div></td><td><div><div><p>W-20028988</p></div></div></td></tr><tr><td><div><div><p>Thread Context Classloader (TCCL) is no longer wrongly set to the connector after an operation policy <code>execute-next</code>.</p></div></div></td><td><div><div><p>W-20618734</p></div></div></td></tr><tr><td><div><div><p>Fastutil is now replaced with fastutil-core.</p></div></div></td><td><div><div><p>W-20729870</p></div></div></td></tr></tbody></table>

### 4.6.26:2-java8

**4.6.26 LTS Runtime Updates**

- Bundled JDK version: OpenJDK "1.8.0\_452"

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.23`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>JDK Flight Recorder (JFR) is now disabled by default.</p></div></div></td><td><div><div><p>W-19990145</p></div></div></td></tr><tr><td><div><div><p>The Abstract Syntax Tree (AST) file of applications using the until-successful component is now leveraged by Mule runtime instead of parsing the configuration XML files.</p></div></div></td><td><div><div><p>W-20283146</p></div></div></td></tr><tr><td><div><div><p>Mule application unresponsiveness no longer occurs after a policy that uses the until-successful component is undeployed or redeployed.</p></div></div></td><td><div><div><p>W-20628990</p></div></div></td></tr><tr><td><div><div><p>Implemented minor improvements to Mule classloading structures to enhance efficiency and stability.</p></div></div></td><td><div><div><p>W-20028988</p></div></div></td></tr><tr><td><div><div><p>Thread Context Classloader (TCCL) is no longer wrongly set to the connector after an operation policy <code>execute-next</code>.</p></div></div></td><td><div><div><p>W-20618734</p></div></div></td></tr><tr><td><div><div><p>Fastutil is now replaced with fastutil-core.</p></div></div></td><td><div><div><p>W-20729870</p></div></div></td></tr></tbody></table>

## January 6, 2026

### What’s New

Runtime Manager agent 2.7.9. See
[Runtime Manager Agent 2.7.9 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-9).

### Fixed Issues

### 4.10.2:5e-java17

**4.10.2 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.19`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Batch jobs no longer hang when errors occur in steps that use try scopes with global error handlers.</p></div></div></td><td><div><div><p>W-17738563</p></div></div></td></tr><tr><td><div><div><p>Applications no longer become unresponsive after thread pool exhaustion when using Netty as the HTTP Service implementation with the Anypoint MQ Connector.</p></div></div></td><td><div><div><p>W-19806707</p></div></div></td></tr><tr><td><div><div><p>Design-time operations on primary content parameters with non-Java types now work correctly.</p></div></div></td><td><div><div><p>W-20187776</p></div></div></td></tr><tr><td><div><div><p>Logging information is now improved during graceful shutdown.</p></div></div></td><td><div><div><p>W-20278970</p></div></div></td></tr><tr><td><div><div><p>A deadlock between Log4j Mule log support during application initialization no longer occurs.</p></div></div></td><td><div><div><p>W-20419795</p></div></div></td></tr><tr><td><div><div><p>The HTTP Client can now establish an SSE source when the content-type header doesn’t exactly match <code>text/event-stream</code>.</p></div></div></td><td><div><div><p>W-20420476</p></div></div></td></tr><tr><td><div><div><p>MUnit tests no longer fail intermittently when running on Java 17.</p></div></div></td><td><div><div><p>W-17044721</p></div></div></td></tr><tr><td><div><div><p>Batch processing not longer fails with serialization error when LDAP action throws an error in Java 17.</p></div></div></td><td><div><div><p>W-19524600</p></div></div></td></tr><tr><td><div><div><p>Dynamic configurations now work correctly during initialization when using <code>hashCode</code> and <code>equals</code> methods on a <code>TLSConfiguration</code> class.</p></div></div></td><td><div><div><p>W-18835469</p></div></div></td></tr><tr><td><div><div><p>A memory leak after application undeployment no longer occurs when using connections from configurations defined in a domain.</p></div></div></td><td><div><div><p>W-13521171</p></div></div></td></tr><tr><td><div><div><p>Connections now close properly on the server side after an HTTP/2 client disconnects.</p></div></div></td><td><div><div><p>W-19861068</p></div></div></td></tr><tr><td><div><div><p>The JMS connector no longer closes XA-enlisted connections.</p></div></div></td><td><div><div><p>W-20266983</p></div></div></td></tr><tr><td><div><div><p>Connections from providers that implement both <code>CachedConnectionProvider</code> and <code>XaTransactionalConnectionProvider</code> are no longer cached if the provided connection is XA.</p></div></div></td><td><div><div><p>W-20267068</p></div></div></td></tr><tr><td><div><div><p>The alert context in the DIAF file is now reset after the configured time interval expires.</p></div></div></td><td><div><div><p>W-20140036</p></div></div></td></tr><tr><td><div><div><p>The HTTP Server now returns a 400 error when the HTTP/1 to HTTP/2 upgrade mechanism receives an invalid <code>HTTP2-Settings</code> header.</p></div></div></td><td><div><div><p>W-19895731</p></div></div></td></tr><tr><td><div><div><p><code>ERROR StatusLogger Attempted to append to non-started appender AnypointMonitoringFileAppender</code> errors no longer occur when Anypoint Monitoring is enabled.</p></div></div></td><td><div><div><p>W-15577414</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>Functions now materialize correctly when the function body contains a single <code>var</code> declaration.</p></div></div></td><td><div><div><p>W-20365331</p></div></div></td></tr><tr><td><div><div><p>The stream reader now processes input with multi-byte characters correctly.</p></div></div></td><td><div><div><p>W-20016549</p></div></div></td></tr><tr><td><div><div><p>The Apache Commons Lang library included in the distribution is upgraded.</p></div></div></td><td><div><div><p>W-20004786</p></div></div></td></tr><tr><td><div><div><p>DataWeave grammar transformation performance is improved.</p></div></div></td><td><div><div><p>W-19840284</p></div></div></td></tr><tr><td><div><div><p>Memory usage is improved for binary compilation and AST-related utilities.</p></div></div></td><td><div><div><p>W-19706956</p></div></div></td></tr></tbody></table>

### 4.9.12:5e-java17

**4.9.12 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.19`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Batch jobs no longer hang when errors occur in steps that use try scopes with global error handlers.</p></div></div></td><td><div><div><p>W-17738563</p></div></div></td></tr><tr><td><div><div><p>Applications no longer become unresponsive after thread pool exhaustion when using Netty as the HTTP Service implementation with the Anypoint MQ Connector.</p></div></div></td><td><div><div><p>W-19806707</p></div></div></td></tr><tr><td><div><div><p>Design-time operations on primary content parameters with non-Java types now work correctly.</p></div></div></td><td><div><div><p>W-20187776</p></div></div></td></tr><tr><td><div><div><p>Logging information is now improved during graceful shutdown.</p></div></div></td><td><div><div><p>W-20278970</p></div></div></td></tr><tr><td><div><div><p>A deadlock between Log4j Mule log support during application initialization no longer occurs.</p></div></div></td><td><div><div><p>W-20419795</p></div></div></td></tr><tr><td><div><div><p>The HTTP Client can now establish an SSE source when the content-type header doesn’t exactly match <code>text/event-stream</code>.</p></div></div></td><td><div><div><p>W-20420476</p></div></div></td></tr><tr><td><div><div><p>MUnit tests no longer fail intermittently when running on Java 17.</p></div></div></td><td><div><div><p>W-17044721</p></div></div></td></tr><tr><td><div><div><p>Batch processing no longer fails with serialization error when LDAP action throws an error in Java 17.</p></div></div></td><td><div><div><p>W-19524600</p></div></div></td></tr><tr><td><div><div><p>Dynamic configurations now work correctly during initialization when using <code>hashCode</code> and <code>equals</code> methods on a <code>TLSConfiguration</code> class.</p></div></div></td><td><div><div><p>W-18835469</p></div></div></td></tr><tr><td><div><div><p><code>ERROR StatusLogger Attempted to append to non-started appender AnypointMonitoringFileAppender</code> errors no longer occur when Anypoint Monitoring is enabled.</p></div></div></td><td><div><div><p>W-15577414</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>Functions now materialize correctly when the function body contains a single <code>var</code> declaration.</p></div></div></td><td><div><div><p>W-20365331</p></div></div></td></tr><tr><td><div><div><p>The stream reader now processes input with multi-byte characters correctly.</p></div></div></td><td><div><div><p>W-20016549</p></div></div></td></tr></tbody></table>

### 4.9.12:5-java17

**4.9.12 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.19`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Batch jobs no longer hang when errors occur in steps that use try scopes with global error handlers.</p></div></div></td><td><div><div><p>W-17738563</p></div></div></td></tr><tr><td><div><div><p>Applications no longer become unresponsive after thread pool exhaustion when using Netty as the HTTP Service implementation with the Anypoint MQ Connector.</p></div></div></td><td><div><div><p>W-19806707</p></div></div></td></tr><tr><td><div><div><p>Design-time operations on primary content parameters with non-Java types now work correctly.</p></div></div></td><td><div><div><p>W-20187776</p></div></div></td></tr><tr><td><div><div><p>Logging information is now improved during graceful shutdown.</p></div></div></td><td><div><div><p>W-20278970</p></div></div></td></tr><tr><td><div><div><p>A deadlock between Log4j Mule log support during application initialization no longer occurs.</p></div></div></td><td><div><div><p>W-20419795</p></div></div></td></tr><tr><td><div><div><p>The HTTP Client can now establish an SSE source when the content-type header doesn’t exactly match <code>text/event-stream</code>.</p></div></div></td><td><div><div><p>W-20420476</p></div></div></td></tr><tr><td><div><div><p>MUnit tests no longer fail intermittently when running on Java 17.</p></div></div></td><td><div><div><p>W-17044721</p></div></div></td></tr><tr><td><div><div><p>Batch processing no longer fails with serialization error when LDAP action throws an error in Java 17.</p></div></div></td><td><div><div><p>W-19524600</p></div></div></td></tr><tr><td><div><div><p>Dynamic configurations now work correctly during initialization when using <code>hashCode</code> and <code>equals</code> methods on a <code>TLSConfiguration</code> class.</p></div></div></td><td><div><div><p>W-18835469</p></div></div></td></tr><tr><td><div><div><p><code>ERROR StatusLogger Attempted to append to non-started appender AnypointMonitoringFileAppender</code> errors no longer occur when Anypoint Monitoring is enabled.</p></div></div></td><td><div><div><p>W-15577414</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>Functions now materialize correctly when the function body contains a single <code>var</code> declaration.</p></div></div></td><td><div><div><p>W-20365331</p></div></div></td></tr><tr><td><div><div><p>The stream reader now processes input with multi-byte characters correctly.</p></div></div></td><td><div><div><p>W-20016549</p></div></div></td></tr></tbody></table>

### 4.6.25:5-java17

**4.6.25 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.19`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Batch jobs no longer hang when errors occur in steps that use try scopes with global error handlers.</p></div></div></td><td><div><div><p>W-17738563</p></div></div></td></tr><tr><td><div><div><p>Design-time operations on primary content parameters with non-Java types now work correctly.</p></div></div></td><td><div><div><p>W-20187776</p></div></div></td></tr><tr><td><div><div><p>Logging information is now improved during graceful shutdown.</p></div></div></td><td><div><div><p>W-20278970</p></div></div></td></tr><tr><td><div><div><p>A deadlock between Log4j Mule log support during application initialization no longer occurs.</p></div></div></td><td><div><div><p>W-20419795</p></div></div></td></tr><tr><td><div><div><p>MUnit tests no longer fail intermittently when running on Java 17.</p></div></div></td><td><div><div><p>W-17044721</p></div></div></td></tr><tr><td><div><div><p>Batch processing no longer fails with serialization error when LDAP action throws an error in Java 17.</p></div></div></td><td><div><div><p>W-19524600</p></div></div></td></tr><tr><td><div><div><p>Dynamic configurations now work correctly during initialization when using <code>hashCode</code> and <code>equals</code> methods on a <code>TLSConfiguration</code> class.</p></div></div></td><td><div><div><p>W-18835469</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>The stream reader now processes input with multi-byte characters correctly.</p></div></div></td><td><div><div><p>W-20016549</p></div></div></td></tr><tr><td><div><div><p>The org.apache.commons:commons-text library is upgraded to 1.14.0.</p></div></div></td><td><div><div><p>W-20618375</p></div></div></td></tr><tr><td><div><div><p>Each variable is now extracted from <code>vars</code>, allowing its materialization to be managed individually. The <code>mule.dw.enable_vars_materialization_pass</code> compatibility flag is added to preserve the previous materialization behavior.</p></div></div></td><td><div><div><p>W-19580992 / W-17167283</p></div></div></td></tr></tbody></table>

### 4.6.25:5-java8

**4.6.25 LTS Runtime Updates**

- Bundled JDK version: OpenJDK "1.8.0\_452"

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.19`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Batch jobs no longer hang when errors occur in steps that use try scopes with global error handlers.</p></div></div></td><td><div><div><p>W-17738563</p></div></div></td></tr><tr><td><div><div><p>Design-time operations on primary content parameters with non-Java types now work correctly.</p></div></div></td><td><div><div><p>W-20187776</p></div></div></td></tr><tr><td><div><div><p>Logging information is now improved during graceful shutdown.</p></div></div></td><td><div><div><p>W-20278970</p></div></div></td></tr><tr><td><div><div><p>A deadlock between Log4j Mule log support during application initialization no longer occurs.</p></div></div></td><td><div><div><p>W-20419795</p></div></div></td></tr><tr><td><div><div><p>MUnit tests no longer fail intermittently when running on Java 17.</p></div></div></td><td><div><div><p>W-17044721</p></div></div></td></tr><tr><td><div><div><p>Batch processing no longer fails with serialization error when LDAP action throws an error in Java 17.</p></div></div></td><td><div><div><p>W-19524600</p></div></div></td></tr><tr><td><div><div><p>Dynamic configurations now work correctly during initialization when using <code>hashCode</code> and <code>equals</code> methods on a <code>TLSConfiguration</code> class.</p></div></div></td><td><div><div><p>W-18835469</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>The stream reader now processes input with multi-byte characters correctly.</p></div></div></td><td><div><div><p>W-20016549</p></div></div></td></tr><tr><td><div><div><p>The org.apache.commons:commons-text library is upgraded to 1.14.0.</p></div></div></td><td><div><div><p>W-20618375</p></div></div></td></tr><tr><td><div><div><p>Each variable is now extracted from <code>vars</code>, allowing its materialization to be managed individually. The <code>mule.dw.enable_vars_materialization_pass</code> compatibility flag is added to preserve the previous materialization behavior.</p></div></div></td><td><div><div><p>W-19580992 / W-17167283</p></div></div></td></tr></tbody></table>

## November 7, 2025

The November 7 patch update 4.10.1:12e-java17, 4.9.11:6e-java17, 4.9.11:6-java17, 4.6.24:7-java17,
4.6.24:7-java8, and 4.4.0:20250919-6 address a regression in the previous November 4 patch update
and includes the fixes in those patches.

### 4.10.1:12e-java17

**4.10.1 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.19`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>The diagnostic file now generates correctly.</p></div></div></td><td><div><div><p>W-20139801</p></div></div></td></tr><tr><td><div><div><p>Readiness and liveness probes now use HTTP GET checks instead of command-based checks, improving reliability.</p></div></div></td><td><div><div><p>W-19853421</p></div></div></td></tr></tbody></table>

### 4.9.11:6e-java17

**4.9.11 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.19`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>The diagnostic file now generates correctly.</p></div></div></td><td><div><div><p>W-20139801</p></div></div></td></tr><tr><td><div><div><p>Readiness and liveness probes now use HTTP GET checks instead of command-based checks, improving reliability.</p></div></div></td><td><div><div><p>W-19853421</p></div></div></td></tr></tbody></table>

### 4.9.11:6-java17

**4.9.11 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.19`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>The diagnostic file now generates correctly.</p></div></div></td><td><div><div><p>W-20139801</p></div></div></td></tr><tr><td><div><div><p>Readiness and liveness probes now use HTTP GET checks instead of command-based checks, improving reliability.</p></div></div></td><td><div><div><p>W-19853421</p></div></div></td></tr></tbody></table>

### 4.6.24:7-java17

**4.6.24 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.19`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>The diagnostic file now generates correctly.</p></div></div></td><td><div><div><p>W-20139801</p></div></div></td></tr><tr><td><div><div><p>Readiness and liveness probes now use HTTP GET checks instead of command-based checks, improving reliability.</p></div></div></td><td><div><div><p>W-19853421</p></div></div></td></tr></tbody></table>

### 4.6.24:7-java8

**4.6.24 LTS Runtime Updates**

- Bundled JDK version: OpenJDK "1.8.0\_452"

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.19`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Readiness and liveness probes now use HTTP GET checks instead of command-based checks, improving reliability.</p></div></div></td><td><div><div><p>W-19853421</p></div></div></td></tr></tbody></table>

### 4.4.0:20250919-6

**4.4.0 Runtime Updates**

- Bundled JDK version: OpenJDK "1.8.0\_452"

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.15`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Readiness and liveness probes now use HTTP GET checks instead of command-based checks, improving reliability.</p></div></div></td><td><div><div><p>W-19853421</p></div></div></td></tr></tbody></table>

## November 4, 2025

### What’s New

Runtime Manager agent 2.7.8. See
[Runtime Manager Agent 2.7.8 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-8).

### Fixed Issues

### 4.10.1:10e-java17

**4.10.1 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.19`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>OpenTelemetry current API sampling decisions now propagate correctly through <code>http:requester</code> calls to downstream APIs.</p></div></div></td><td><div><div><p>W-19784910</p></div></div></td></tr><tr><td><div><div><p><code>UndeclaredThrowableException</code> errors no longer occur during Bitronix reconnection.</p></div></div></td><td><div><div><p>W-15196888</p></div></div></td></tr><tr><td><div><div><p><code>InaccessibleObjectException</code> errors no longer occur during deployment when the <code>mule.classloading.verbose</code> property is set.</p></div></div></td><td><div><div><p>W-18563387</p></div></div></td></tr><tr><td><div><div><p>MDC information is now properly preserved when using loggers inside custom Java code invoked from a DataWeave script.</p></div></div></td><td><div><div><p>W-18912999</p></div></div></td></tr><tr><td><div><div><p>Batch queuestore files now clean up correctly in rare load failure scenarios such as out-of-memory errors.</p></div></div></td><td><div><div><p>W-17935223</p></div></div></td></tr><tr><td><div><div><p>Builds no longer fail when running tests from an extension that uses Mule SDK with Java 8 through Java 17.</p></div></div></td><td><div><div><p>W-18964335</p></div></div></td></tr><tr><td><div><div><p>The until-successful scope now honors the graceful shutdown timeout. To enable this behavior, set these system properties: <code>mule.untilSuccessful.retryOnCriticalError.disallow=true</code> and <code>mule.forcefulShutdown.raiseCancelledError=true</code>.</p></div></div></td><td><div><div><p>W-19648397</p></div></div></td></tr><tr><td><div><div><p>Hashing now uses <code>toHex</code> conversion to prevent “null character” or other invalid characters from being used as IDs in the redelivery policy. This change is feature-flagged. To enable it in version 4.10, set the <code>mule.redeliveryPolicy.encode.secureHash</code> system property to <code>true</code>.</p></div></div></td><td><div><div><p>W-18584560</p></div></div></td></tr><tr><td><div><div><p><code>IllegalAccessException</code> errors no longer occur when DataWeave serializes <code>error.errorMessage</code> in a Scatter-Gather error route.</p></div></div></td><td><div><div><p>W-19340663</p></div></div></td></tr><tr><td><div><div><p>Mule applications that use TLS KeyStore configurations no longer fail to deploy with “NO MODEL RESOLVED” warnings and <code>ConfigurationException</code> errors.</p></div></div></td><td><div><div><p>W-16565012</p></div></div></td></tr><tr><td><div><div><p>Mule Troubleshooting Plugin executions no longer fail when the IP address changes.</p></div></div></td><td><div><div><p>W-19802474</p></div></div></td></tr><tr><td><div><div><p>The reactor.netty library is upgraded to 1.2.10.</p></div></div></td><td><div><div><p>W-17264514</p></div></div></td></tr><tr><td><div><div><p>The netty library is upgraded to 4.1.127.Final.</p></div></div></td><td><div><div><p>W-19995637</p></div></div></td></tr><tr><td><div><div><p>The spring-core library is upgraded to 6.2.11.</p></div></div></td><td><div><div><p>W-19674953</p></div></div></td></tr><tr><td><div><div><p>The Bump handlebars library is upgraded to 4.4.0.</p></div></div></td><td><div><div><p>W-1906465</p></div></div></td></tr><tr><td><div><div><p>The HTTP listener now correctly populates <code>attributes.queryParams</code> when using HTTP/2.</p></div></div></td><td><div><div><p>W-19802358</p></div></div></td></tr><tr><td><div><div><p><code>close_notify</code> events sent by a server are now properly handled by the HTTP/2 client.</p></div></div></td><td><div><div><p>W-19973575</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>Materialization errors no longer occur in run function.</p></div></div></td><td><div><div><p>W-19884071</p></div></div></td></tr><tr><td><div><div><p>The org.apache.commons:commons-lang3 library is upgraded to 3.18.</p></div></div></td><td><div><div><p>W-19803454</p></div></div></td></tr><tr><td><div><div><p>Single variable materialization now works correctly for <code>unsafe</code> and <code>exists</code> selectors.</p></div></div></td><td><div><div><p>W-19581017</p></div></div></td></tr><tr><td><div><div><p>The SnakeYAML library is upgraded.</p></div></div></td><td><div><div><p>W-19749213</p></div></div></td></tr><tr><td><div><div><p>Each variable is now extracted from <code>vars</code>, allowing its materialization to be managed individually. The <code>mule.dw.enable_vars_materialization_pass</code> compatibility flag is added to preserve the previous materialization behavior.</p></div></div></td><td><div><div><p>W-19580992 / W-17167283</p></div></div></td></tr><tr><td><div><div><p>The <code>--</code> operator now returns the correct type without the subtracted keys.</p></div></div></td><td><div><div><p>W-19595907</p></div></div></td></tr><tr><td><div><div><p>Debug logging is now enabled for <code>DefaultLoggingService</code>.</p></div></div></td><td><div><div><p>W-19650046</p></div></div></td></tr><tr><td><div><div><p>The <code>take</code> function no longer fails in streaming mode when <code>n</code> is larger than the array length.</p></div></div></td><td><div><div><p>W-19168279</p></div></div></td></tr><tr><td><div><div><p>The Java Module now supports object field access with different capitalizations.</p></div></div></td><td><div><div><p>W-19477334</p></div></div></td></tr><tr><td><div><div><p>The Runtime Compiler now uses the Parser Manager to look for resources provided as parameters.</p></div></div></td><td><div><div><p>W-19376888</p></div></div></td></tr><tr><td><div><div><p>A null check is now performed before closing the <code>InputStream</code>.</p></div></div></td><td><div><div><p>W-19395982</p></div></div></td></tr><tr><td><div><div><p>Parsing metrics printing now includes a missing line ending.</p></div></div></td><td><div><div><p>W-19440583</p></div></div></td></tr><tr><td><div><div><p>Constants are now used to prevent incorrect loader identifiers for binary compiled scripts.</p></div></div></td><td><div><div><p>W-18455133</p></div></div></td></tr><tr><td><div><div><p>Generated POM files now include license information.</p></div></div></td><td><div><div><p>W-19439330</p></div></div></td></tr><tr><td><div><div><p><code>SchemaProvider</code> resolution on Types is improved to prevent Execution reference leaks.</p></div></div></td><td><div><div><p>W-19389019</p></div></div></td></tr><tr><td><div><div><p>The classloader weave resource resolver now uses the correct path in Windows environments.</p></div></div></td><td><div><div><p>W-19407283</p></div></div></td></tr></tbody></table>

### 4.9.11:4e-java17

**4.9.11 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.19`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>OpenTelemetry current API sampling decisions now propagate correctly through <code>http:requester</code> calls to downstream APIs.</p></div></div></td><td><div><div><p>W-19784910</p></div></div></td></tr><tr><td><div><div><p><code>UndeclaredThrowableException</code> errors no longer occur during Bitronix reconnection.</p></div></div></td><td><div><div><p>W-15196888</p></div></div></td></tr><tr><td><div><div><p><code>InaccessibleObjectException</code> errors no longer occur during deployment when the <code>mule.classloading.verbose</code> property is set.</p></div></div></td><td><div><div><p>W-18563387</p></div></div></td></tr><tr><td><div><div><p>MDC information is now properly preserved when using loggers inside custom Java code invoked from a DataWeave script.</p></div></div></td><td><div><div><p>W-18912999</p></div></div></td></tr><tr><td><div><div><p>Batch queuestore files now clean up correctly in rare load failure scenarios such as out-of-memory errors.</p></div></div></td><td><div><div><p>W-17935223</p></div></div></td></tr><tr><td><div><div><p>Builds no longer fail when running tests from an extension that uses Mule SDK with Java 8 through Java 17.</p></div></div></td><td><div><div><p>W-18964335</p></div></div></td></tr><tr><td><div><div><p>Starvation no longer occurs when sending HTTP responses that are generated slowly.</p></div></div></td><td><div><div><p>W-1982570</p></div></div></td></tr><tr><td><div><div><p>The until-successful scope now honors the graceful shutdown timeout. To enable this behavior, set these system properties: <code>mule.untilSuccessful.retryOnCriticalError.disallow=true</code> and <code>mule.forcefulShutdown.raiseCancelledError=true</code>.</p></div></div></td><td><div><div><p>W-19648397</p></div></div></td></tr><tr><td><div><div><p>Hashing now uses <code>toHex</code> conversion to prevent “null character” or other invalid characters from being used as IDs in the redelivery policy. This change is feature-flagged. To enable it in version 4.9, set the <code>mule.redeliveryPolicy.encode.secureHash</code> system property to <code>true</code>.</p></div></div></td><td><div><div><p>W-18584560</p></div></div></td></tr><tr><td><div><div><p><code>IllegalAccessException</code> errors no longer occur when DataWeave serializes <code>error.errorMessage</code> in a Scatter-Gather error route.</p></div></div></td><td><div><div><p>W-19340663</p></div></div></td></tr><tr><td><div><div><p>Mule applications that use TLS KeyStore configurations no longer fail to deploy with “NO MODEL RESOLVED” warnings and <code>ConfigurationException</code> errors.</p></div></div></td><td><div><div><p>W-16565012</p></div></div></td></tr><tr><td><div><div><p>Mule Troubleshooting Plugin executions no longer fail when the IP address changes.</p></div></div></td><td><div><div><p>W-19802474</p></div></div></td></tr><tr><td><div><div><p>SSE clients can now parse <code>events</code> that do not include an event field. These events now default to <code>message</code>, as described in the specification.</p></div></div></td><td><div><div><p>W-19667148</p></div></div></td></tr><tr><td><div><div><p>The reactor.netty library is upgraded to 1.2.10.</p></div></div></td><td><div><div><p>W-17264514</p></div></div></td></tr><tr><td><div><div><p>The netty library is upgraded to 4.2.7.Final.</p></div></div></td><td><div><div><p>W-19995637</p></div></div></td></tr><tr><td><div><div><p>The spring-core library is upgraded to 6.2.11.</p></div></div></td><td><div><div><p>W-19674953</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>The Apache Commons Lang dependency is removed from the distribution.</p></div></div></td><td><div><div><p>W-19803454</p></div></div></td></tr><tr><td><div><div><p>Materialization errors no longer occur when running functions.</p></div></div></td><td><div><div><p>W-19884071</p></div></div></td></tr><tr><td><div><div><p>Single variable materialization now works correctly for <code>unsafe</code> and <code>exists</code> selectors.</p></div></div></td><td><div><div><p>W-19581017</p></div></div></td></tr><tr><td><div><div><p>Each variable is now extracted from <code>vars</code>, allowing its materialization to be managed individually. The <code>mule.dw.enable_vars_materialization_pass</code> compatibility flag is added to preserve the previous materialization behavior.</p></div></div></td><td><div><div><p>W-19580992 / W-17167283</p></div></div></td></tr></tbody></table>

### 4.9.11:4-java17

**4.9.11 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.19`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>OpenTelemetry current API sampling decisions now propagate correctly through <code>http:requester</code> calls to downstream APIs.</p></div></div></td><td><div><div><p>W-19784910</p></div></div></td></tr><tr><td><div><div><p><code>UndeclaredThrowableException</code> errors no longer occur during Bitronix reconnection.</p></div></div></td><td><div><div><p>W-15196888</p></div></div></td></tr><tr><td><div><div><p><code>InaccessibleObjectException</code> errors no longer occur during deployment when the <code>mule.classloading.verbose</code> property is set.</p></div></div></td><td><div><div><p>W-18563387</p></div></div></td></tr><tr><td><div><div><p>MDC information is now properly preserved when using loggers inside custom Java code invoked from a DataWeave script.</p></div></div></td><td><div><div><p>W-18912999</p></div></div></td></tr><tr><td><div><div><p>Batch queuestore files now clean up correctly in rare load failure scenarios such as out-of-memory errors.</p></div></div></td><td><div><div><p>W-17935223</p></div></div></td></tr><tr><td><div><div><p>Builds no longer fail when running tests from an extension that uses Mule SDK with Java 8 through Java 17.</p></div></div></td><td><div><div><p>W-18964335</p></div></div></td></tr><tr><td><div><div><p>Starvation no longer occurs when sending HTTP responses that are generated slowly.</p></div></div></td><td><div><div><p>W-1982570</p></div></div></td></tr><tr><td><div><div><p>The until-successful scope now honors the graceful shutdown timeout. To enable this behavior, set these system properties: <code>mule.untilSuccessful.retryOnCriticalError.disallow=true</code> and <code>mule.forcefulShutdown.raiseCancelledError=true</code>.</p></div></div></td><td><div><div><p>W-19648397</p></div></div></td></tr><tr><td><div><div><p>Hashing now uses <code>toHex</code> conversion to prevent “null character” or other invalid characters from being used as IDs in the redelivery policy. This change is feature-flagged. To enable it in version 4.9, set the <code>mule.redeliveryPolicy.encode.secureHash</code> system property to <code>true</code>.</p></div></div></td><td><div><div><p>W-18584560</p></div></div></td></tr><tr><td><div><div><p><code>IllegalAccessException</code> errors no longer occur when DataWeave serializes <code>error.errorMessage</code> in a Scatter-Gather error route.</p></div></div></td><td><div><div><p>W-19340663</p></div></div></td></tr><tr><td><div><div><p>Mule applications that use TLS KeyStore configurations no longer fail to deploy with “NO MODEL RESOLVED” warnings and <code>ConfigurationException</code> errors.</p></div></div></td><td><div><div><p>W-16565012</p></div></div></td></tr><tr><td><div><div><p>Mule Troubleshooting Plugin executions no longer fail when the IP address changes.</p></div></div></td><td><div><div><p>W-19802474</p></div></div></td></tr><tr><td><div><div><p>SSE clients can now parse <code>events</code> that do not include an event field. These events now default to <code>message</code>, as described in the specification.</p></div></div></td><td><div><div><p>W-19667148</p></div></div></td></tr><tr><td><div><div><p>The reactor.netty library is upgraded to 1.2.10.</p></div></div></td><td><div><div><p>W-17264514</p></div></div></td></tr><tr><td><div><div><p>The netty library is upgraded to 4.2.7.Final.</p></div></div></td><td><div><div><p>W-19995637</p></div></div></td></tr><tr><td><div><div><p>The spring-core library is upgraded to 6.2.11.</p></div></div></td><td><div><div><p>W-19674953</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>The Apache Commons Lang dependency is removed from the distribution.</p></div></div></td><td><div><div><p>W-19803454</p></div></div></td></tr><tr><td><div><div><p>Materialization errors no longer occur when running functions.</p></div></div></td><td><div><div><p>W-19884071</p></div></div></td></tr><tr><td><div><div><p>Single variable materialization now works correctly for <code>unsafe</code> and <code>exists</code> selectors.</p></div></div></td><td><div><div><p>W-19581017</p></div></div></td></tr><tr><td><div><div><p>Each variable is now extracted from <code>vars</code>, allowing its materialization to be managed individually. The <code>mule.dw.enable_vars_materialization_pass</code> compatibility flag is added to preserve the previous materialization behavior.</p></div></div></td><td><div><div><p>W-19580992 / W-17167283</p></div></div></td></tr></tbody></table>

### 4.6.24:4-java17

**4.6.24 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.19`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>OpenTelemetry current API sampling decisions now propagate correctly through <code>http:requester</code> calls to downstream APIs.</p></div></div></td><td><div><div><p>W-19784910</p></div></div></td></tr><tr><td><div><div><p><code>UndeclaredThrowableException</code> errors no longer occur during Bitronix reconnection.</p></div></div></td><td><div><div><p>W-15196888</p></div></div></td></tr><tr><td><div><div><p><code>InaccessibleObjectException</code> errors no longer occur during deployment when the <code>mule.classloading.verbose</code> property is set.</p></div></div></td><td><div><div><p>W-18563387</p></div></div></td></tr><tr><td><div><div><p>MDC information is now properly preserved when using loggers inside custom Java code invoked from a DataWeave script.</p></div></div></td><td><div><div><p>W-18912999</p></div></div></td></tr><tr><td><div><div><p>Batch queuestore files now clean up correctly in rare load failure scenarios such as out-of-memory errors.</p></div></div></td><td><div><div><p>W-17935223</p></div></div></td></tr><tr><td><div><div><p>Builds no longer fail when running tests from an extension that uses Mule SDK with Java 8 through Java 17.</p></div></div></td><td><div><div><p>W-18964335</p></div></div></td></tr><tr><td><div><div><p>The until-successful scope now properly honors the graceful shutdown timeout. In versions earlier than 4.11.0, you must enable this behavior using these system properties: <code>mule.untilSuccessful.retryOnCriticalError.disallow=true</code> and <code>mule.forcefulShutdown.raiseCancelledError=true</code>.</p></div></div></td><td><div><div><p>W-19340663</p></div></div></td></tr><tr><td><div><div><p>Hashing now uses <code>toHex</code> conversion to prevent “null character” or other invalid characters from being used as IDs in the redelivery policy. This change is feature-flagged. To enable it in version 4.6, set the <code>mule.redeliveryPolicy.encode.secureHash</code> system property to <code>true</code>.</p></div></div></td><td><div><div><p>W-18584560</p></div></div></td></tr><tr><td><div><div><p><code>IllegalAccessException</code> no longer thrown when DW serializes <code>error.errorMessage</code> in Scatter-Gather error route.</p></div></div></td><td><div><div><p>W-19340663</p></div></div></td></tr><tr><td><div><div><p>Mule applications that use TLS KeyStore configurations no longer fail to deploy with “NO MODEL RESOLVED” warnings and <code>ConfigurationException</code> errors.</p></div></div></td><td><div><div><p>W-16565012</p></div></div></td></tr><tr><td><div><div><p>Mule Troubleshooting Plugin executions no longer fail when the IP address changes.</p></div></div></td><td><div><div><p>W-19802474</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>The Apache Commons Lang dependency is removed from the distribution.</p></div></div></td><td><div><div><p>W-19803454</p></div></div></td></tr><tr><td><div><div><p>Materialization errors no longer occur when running functions.</p></div></div></td><td><div><div><p>W-19884071</p></div></div></td></tr></tbody></table>

### 4.6.24:4-java8

**4.6.24 LTS Runtime Updates**

- Bundled JDK version: OpenJDK "1.8.0\_452"

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.19`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>OpenTelemetry current API sampling decisions now propagate correctly through <code>http:requester</code> calls to downstream APIs.</p></div></div></td><td><div><div><p>W-19784910</p></div></div></td></tr><tr><td><div><div><p><code>UndeclaredThrowableException</code> errors no longer occur during Bitronix reconnection.</p></div></div></td><td><div><div><p>W-15196888</p></div></div></td></tr><tr><td><div><div><p><code>InaccessibleObjectException</code> errors no longer occur during deployment when the <code>mule.classloading.verbose</code> property is set.</p></div></div></td><td><div><div><p>W-18563387</p></div></div></td></tr><tr><td><div><div><p>MDC information is now properly preserved when using loggers inside custom Java code invoked from a DataWeave script.</p></div></div></td><td><div><div><p>W-18912999</p></div></div></td></tr><tr><td><div><div><p>Batch queuestore files now clean up correctly in rare load failure scenarios such as out-of-memory errors.</p></div></div></td><td><div><div><p>W-17935223</p></div></div></td></tr><tr><td><div><div><p>Builds no longer fail when running tests from an extension that uses Mule SDK with Java 8 through Java 17.</p></div></div></td><td><div><div><p>W-18964335</p></div></div></td></tr><tr><td><div><div><p>The until-successful scope now properly honors the graceful shutdown timeout. In versions earlier than 4.11.0, you must enable this behavior using these system properties: <code>mule.untilSuccessful.retryOnCriticalError.disallow=true</code> and <code>mule.forcefulShutdown.raiseCancelledError=true</code>.</p></div></div></td><td><div><div><p>W-19340663</p></div></div></td></tr><tr><td><div><div><p>Hashing now uses <code>toHex</code> conversion to prevent “null character” or other invalid characters from being used as IDs in the redelivery policy. This change is feature-flagged. To enable it in version 4.6, set the <code>mule.redeliveryPolicy.encode.secureHash</code> system property to <code>true</code>.</p></div></div></td><td><div><div><p>W-18584560</p></div></div></td></tr><tr><td><div><div><p><code>IllegalAccessException</code> no longer thrown when DW serializes <code>error.errorMessage</code> in Scatter-Gather error route.</p></div></div></td><td><div><div><p>W-19340663</p></div></div></td></tr><tr><td><div><div><p>Mule applications that use TLS KeyStore configurations no longer fail to deploy with “NO MODEL RESOLVED” warnings and <code>ConfigurationException</code> errors.</p></div></div></td><td><div><div><p>W-16565012</p></div></div></td></tr><tr><td><div><div><p>Mule Troubleshooting Plugin executions no longer fail when the IP address changes.</p></div></div></td><td><div><div><p>W-19802474</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>The Apache Commons Lang dependency is removed from the distribution.</p></div></div></td><td><div><div><p>W-19803454</p></div></div></td></tr><tr><td><div><div><p>Materialization errors no longer occur when running functions.</p></div></div></td><td><div><div><p>W-19884071</p></div></div></td></tr></tbody></table>

### 4.4.0:20250919-5

**4.4.0 Runtime Updates**

- Bundled JDK version: OpenJDK "1.8.0\_452"

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.15`

- The operating system is updated to the latest security patches.

## October 2, 2025

### What’s New

- Mule runtime engine 4.10.0 is now available.

  For information about the new release cadence, see
  [Edge and LTS Releases for Mule](https://docs.mulesoft.com/release-notes/mule-runtime/lts-edge-release-cadence).

Runtime Manager agent 2.7.7. See
[Runtime Manager Agent 2.7.7 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-7).

### Fixed Issues

### 4.10.0:23e-java17

**4.10.0 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.15`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>The org.quartz-scheduler:quartz library is upgraded to 2.5.0.</p></div></div></td><td><div><div><p>W-17406808</p></div></div></td></tr><tr><td><div><div><p>The org.vibur:vibur-object-pool library is upgraded to 26.</p></div></div></td><td><div><div><p>W-17570586</p></div></div></td></tr><tr><td><div><div><p>The commons-beanutils:commons-beanutils library is upgraded to 1.10.0.</p></div></div></td><td><div><div><p>W-17571116</p></div></div></td></tr><tr><td><div><div><p>The jakarta-annotation library is upgraded to 2.1.1.</p></div></div></td><td><div><div><p>W-17927646</p></div></div></td></tr><tr><td><div><div><p>The Mockito monorepo is upgraded to 5.</p></div></div></td><td><div><div><p>W-18685961</p></div></div></td></tr><tr><td><div><div><p>The Log4j2 monorepo is upgraded to 2.25.1.</p></div></div></td><td><div><div><p>W-18834079</p></div></div></td></tr><tr><td><div><div><p>The Netty library is upgraded to 4.1.127.Final.</p></div></div></td><td><div><div><p>W-19559645</p></div></div></td></tr><tr><td><div><div><p>The Rhino library is upgraded to 1.8.0.</p></div></div></td><td><div><div><p>W-17636627</p></div></div></td></tr><tr><td><div><div><p>The org.springframework : spring-core library is upgraded to 6.2.10.</p></div></div></td><td><div><div><p>W-19353311</p></div></div></td></tr><tr><td><div><div><p>The org.apache.cxf:cxf-core library is now upgraded to 3.5.11.</p></div></div></td><td><div><div><p>W-17264514</p></div></div></td></tr><tr><td><div><div><p>Memory leaks no longer occur when a reconnection is configured in a Mule domain and referenced from multiple applications.</p></div></div></td><td><div><div><p>W-17857080</p></div></div></td></tr><tr><td><div><div><p><code>InaccessibleObjectException</code> errors no longer occur when using cluster mode on Java 17.</p></div></div></td><td><div><div><p>W-18667744</p></div></div></td></tr><tr><td><div><div><p>Fork-join routers no longer create unnecessary schedules when the timeout is set to infinite.</p></div></div></td><td><div><div><p>W-18347293</p></div></div></td></tr><tr><td><div><div><p>Potential deadlocks during deployment no longer occur when using some custom Log4j appenders.</p></div></div></td><td><div><div><p>W-19675881</p></div></div></td></tr><tr><td><div><div><p>Cookies now propagate correctly across multiple redirect scenarios.</p></div></div></td><td><div><div><p>W-18971065</p></div></div></td></tr><tr><td><div><div><p>The Netty library is upgraded to 4.1.124.Final.</p></div></div></td><td><div><div><p>W-19341592</p></div></div></td></tr><tr><td><div><div><p>The <code>org.mule.runtime.api.serialization.SerializationException: Could not deserialize object</code> errors no longer occur when processing the payload of a Query XML stream using transfer message in a Choice Router.</p></div></div></td><td><div><div><p>W-18902280</p></div></div></td></tr><tr><td><div><div><p>SSE clients now parse events that don’t include an <code>event</code> field. They default to <code>message</code> as described in the spec.</p></div></div></td><td><div><div><p>W-19667148</p></div></div></td></tr><tr><td><div><div><p>Possible starvation no longer occurs when sending HTTP responses that are generated slowly.</p></div></div></td><td><div><div><p>W-19471841</p></div></div></td></tr><tr><td><div><div><p>Gatekeeper deadlock errors no longer occur during race conditions among contract downloads and policy application.</p></div></div></td><td><div><div><p>W-19407164</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>The <code>take</code> function now works with streaming when argument is larger than the array length.</p></div></div></td><td><div><div><p>W-19168279</p></div></div></td></tr><tr><td><div><div><p><code>java-module</code> now supports object fields access when using different capitalizations.</p></div></div></td><td><div><div><p>W-19477334</p></div></div></td></tr></tbody></table>

### 4.9.10:4e-java17

**4.9.10 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.15`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Memory leaks no longer occur when a reconnection is configured in a Mule domain and referenced from multiple applications.</p></div></div></td><td><div><div><p>W-17857080</p></div></div></td></tr><tr><td><div><div><p><code>InaccessibleObjectException</code> errors no longer occur when using cluster mode on Java 17.</p></div></div></td><td><div><div><p>W-18667744</p></div></div></td></tr><tr><td><div><div><p>Fork-join routers no longer create unnecessary schedules when the timeout is set to infinite.</p></div></div></td><td><div><div><p>W-18347293</p></div></div></td></tr><tr><td><div><div><p>Potential deadlocks during deployment no longer occur when using some custom Log4j appenders.</p></div></div></td><td><div><div><p>W-19675881</p></div></div></td></tr><tr><td><div><div><p>Cookies now propagate correctly across multiple redirect scenarios.</p></div></div></td><td><div><div><p>W-18971065</p></div></div></td></tr><tr><td><div><div><p>The Netty library is upgraded to 4.1.124.Final.</p></div></div></td><td><div><div><p>W-19341592</p></div></div></td></tr><tr><td><div><div><p>The Handlebars library is upgraded to 4.4.0.</p></div></div></td><td><div><div><p>W-19064659</p></div></div></td></tr><tr><td><div><div><p>The org.apache.commons : commons-lang3 library is upgraded to 3.17.0.</p></div></div></td><td><div><div><p>W-19383955</p></div></div></td></tr><tr><td><div><div><p>The io.netty : netty-codec library is upgraded to 4.1.127.Final.</p></div></div></td><td><div><div><p>W-19568278</p></div></div></td></tr><tr><td><div><div><p>The org.springframework : spring-core library is upgraded to 6.2.10.</p></div></div></td><td><div><div><p>W-19353311</p></div></div></td></tr><tr><td><div><div><p>The org.apache.cxf:cxf-core library is now upgraded to 3.5.11.</p></div></div></td><td><div><div><p>W-17264514</p></div></div></td></tr><tr><td><div><div><p>The <code>org.mule.runtime.api.serialization.SerializationException: Could not deserialize object</code> errors no longer occur when processing the payload of a Query XML stream using transfer message in a Choice Router.</p></div></div></td><td><div><div><p>W-18902280</p></div></div></td></tr><tr><td><div><div><p>Scheduler name generation no longer breaks the platform logging aggregator when processor chains have null or empty names.</p></div></div></td><td><div><div><p>W-19432758</p></div></div></td></tr><tr><td><div><div><p>SSE clients now parse events that don’t include an <code>event</code> field. They default to <code>message</code> as described in the spec.</p></div></div></td><td><div><div><p>W-19667148</p></div></div></td></tr><tr><td><div><div><p>Possible starvation no longer occurs when sending HTTP responses that are generated slowly.</p></div></div></td><td><div><div><p>W-19471841</p></div></div></td></tr><tr><td><div><div><p>Gatekeeper deadlock errors no longer occur during race conditions between contract downloads and policy application.</p></div></div></td><td><div><div><p>W-19407164</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>The <code>take</code> function now works with streaming when argument is larger than the array length.</p></div></div></td><td><div><div><p>W-19168279</p></div></div></td></tr><tr><td><div><div><p><code>java-module</code> now supports object fields access when using different capitalizations.</p></div></div></td><td><div><div><p>W-19477334</p></div></div></td></tr></tbody></table>

### 4.9.10:4-java17

**4.9.10 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.15`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Memory leaks no longer occur when a reconnection is configured in a Mule domain and referenced from multiple applications.</p></div></div></td><td><div><div><p>W-17857080</p></div></div></td></tr><tr><td><div><div><p><code>InaccessibleObjectException</code> errors no longer occur when using cluster mode on Java 17.</p></div></div></td><td><div><div><p>W-18667744</p></div></div></td></tr><tr><td><div><div><p>Fork-join routers no longer create unnecessary schedules when the timeout is set to infinite.</p></div></div></td><td><div><div><p>W-18347293</p></div></div></td></tr><tr><td><div><div><p>Potential deadlocks during deployment no longer occur when using some custom Log4j appenders.</p></div></div></td><td><div><div><p>W-19675881</p></div></div></td></tr><tr><td><div><div><p>Cookies now propagate correctly across multiple redirect scenarios.</p></div></div></td><td><div><div><p>W-18971065</p></div></div></td></tr><tr><td><div><div><p>The Netty library is upgraded to 4.1.124.Final.</p></div></div></td><td><div><div><p>W-19341592</p></div></div></td></tr><tr><td><div><div><p>The Handlebars library is upgraded to 4.4.0.</p></div></div></td><td><div><div><p>W-19064659</p></div></div></td></tr><tr><td><div><div><p>The org.apache.commons : commons-lang3 library is upgraded to 3.17.0.</p></div></div></td><td><div><div><p>W-19383955</p></div></div></td></tr><tr><td><div><div><p>The io.netty : netty-codec library is upgraded to 4.1.127.Final.</p></div></div></td><td><div><div><p>W-19568278</p></div></div></td></tr><tr><td><div><div><p>The org.springframework : spring-core library is upgraded to 6.2.10.</p></div></div></td><td><div><div><p>W-19353311</p></div></div></td></tr><tr><td><div><div><p>The org.apache.cxf:cxf-core library is now upgraded to 3.5.11.</p></div></div></td><td><div><div><p>W-17264514</p></div></div></td></tr><tr><td><div><div><p>The <code>org.mule.runtime.api.serialization.SerializationException: Could not deserialize object</code> errors no longer occur when processing the payload of a Query XML stream using transfer message in a Choice Router.</p></div></div></td><td><div><div><p>W-18902280</p></div></div></td></tr><tr><td><div><div><p>Scheduler name generation no longer breaks the platform logging aggregator when processor chains have null or empty names.</p></div></div></td><td><div><div><p>W-19432758</p></div></div></td></tr><tr><td><div><div><p>SSE clients now parse events that don’t include an <code>event</code> field. They default to <code>message</code> as described in the spec.</p></div></div></td><td><div><div><p>W-19667148</p></div></div></td></tr><tr><td><div><div><p>Possible starvation no longer occurs when sending HTTP responses that are generated slowly.</p></div></div></td><td><div><div><p>W-19471841</p></div></div></td></tr><tr><td><div><div><p>Gatekeeper deadlock errors no longer occur during race conditions between contract downloads and policy application.</p></div></div></td><td><div><div><p>W-19407164</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>The <code>take</code> function now works with streaming when argument is larger than the array length.</p></div></div></td><td><div><div><p>W-19168279</p></div></div></td></tr><tr><td><div><div><p><code>java-module</code> now supports object fields access when using different capitalizations.</p></div></div></td><td><div><div><p>W-19477334</p></div></div></td></tr></tbody></table>

### 4.6.23:4-java17

**4.6.23 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.15`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>The org.springframework library is upgraded to 5.3.45.</p></div></div></td><td><div><div><p>W-18603096</p></div></div></td></tr><tr><td><div><div><p>Memory leaks no longer occur when a reconnection is configured in a Mule domain and referenced from multiple applications.</p></div></div></td><td><div><div><p>W-17857080</p></div></div></td></tr><tr><td><div><div><p><code>InaccessibleObjectException</code> errors no longer occur when using cluster mode on Java 17.</p></div></div></td><td><div><div><p>W-18667744</p></div></div></td></tr><tr><td><div><div><p>Fork-join routers no longer create unnecessary schedules when the timeout is set to infinite.</p></div></div></td><td><div><div><p>W-18347293</p></div></div></td></tr><tr><td><div><div><p>Potential deadlocks during deployment no longer occur when using some custom Log4j appenders.</p></div></div></td><td><div><div><p>W-19675881</p></div></div></td></tr><tr><td><div><div><p>This release reverts the changes introduced in W-17340911.</p></div></div></td><td><div><div><p>W-17340911</p></div></div></td></tr><tr><td><div><div><p>Cookies now propagate correctly across multiple redirect scenarios.</p></div></div></td><td><div><div><p>W-18971065</p></div></div></td></tr><tr><td><div><div><p>Batch queuestore files now clean up correctly in rare load failure scenarios, such as out of memory errors.</p></div></div></td><td><div><div><p>W-17935223</p></div></div></td></tr><tr><td><div><div><p>Gatekeeper deadlock errors no longer occur during race conditions among contract downloads and policy application.</p></div></div></td><td><div><div><p>W-19407164</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>The <code>take</code> function now works with streaming when argument is larger than the array length.</p></div></div></td><td><div><div><p>W-19168279</p></div></div></td></tr><tr><td><div><div><p><code>java-module</code> now supports object fields access when using different capitalizations.</p></div></div></td><td><div><div><p>W-19477334</p></div></div></td></tr><tr><td><div><div><p>Module compilation performance is improved when running concurrently.</p></div></div></td><td><div><div><p>W-19376546</p></div></div></td></tr></tbody></table>

### 4.6.23:4-java8

**4.6.23 LTS Runtime Updates**

- Bundled JDK version: OpenJDK "1.8.0\_452"

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.15`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>The org.springframework library is upgraded to 5.3.45.</p></div></div></td><td><div><div><p>W-18603096</p></div></div></td></tr><tr><td><div><div><p>Memory leaks no longer occur when a reconnection is configured in a Mule domain and referenced from multiple applications.</p></div></div></td><td><div><div><p>W-17857080</p></div></div></td></tr><tr><td><div><div><p><code>InaccessibleObjectException</code> errors no longer occur when using cluster mode on Java 17.</p></div></div></td><td><div><div><p>W-18667744</p></div></div></td></tr><tr><td><div><div><p>Fork-join routers no longer create unnecessary schedules when the timeout is set to infinite.</p></div></div></td><td><div><div><p>W-18347293</p></div></div></td></tr><tr><td><div><div><p>Potential deadlocks during deployment no longer occur when using some custom Log4j appenders.</p></div></div></td><td><div><div><p>W-19675881</p></div></div></td></tr><tr><td><div><div><p>This release reverts the changes introduced in W-17340911.</p></div></div></td><td><div><div><p>W-17340911</p></div></div></td></tr><tr><td><div><div><p>Cookies now propagate correctly across multiple redirect scenarios.</p></div></div></td><td><div><div><p>W-18971065</p></div></div></td></tr><tr><td><div><div><p>Batch queuestore files now clean up correctly in rare load failure scenarios, such as out of memory errors.</p></div></div></td><td><div><div><p>W-17935223</p></div></div></td></tr><tr><td><div><div><p>Gatekeeper deadlock errors no longer occur during race conditions among contract downloads and policy application.</p></div></div></td><td><div><div><p>W-19407164</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>The <code>take</code> function now works with streaming when argument is larger than the array length.</p></div></div></td><td><div><div><p>W-19168279</p></div></div></td></tr><tr><td><div><div><p><code>java-module</code> now supports object fields access when using different capitalizations.</p></div></div></td><td><div><div><p>W-19477334</p></div></div></td></tr><tr><td><div><div><p>Module compilation performance is improved when running concurrently.</p></div></div></td><td><div><div><p>W-19376546</p></div></div></td></tr></tbody></table>

### 4.4.0:20250919-3

**4.4.0 Runtime Updates**

- Bundled JDK version: OpenJDK "1.8.0\_452"

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.15`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p><code>BufferOverFlowException</code> errors no longer occur when inter-node communication gets stuck in clusters with encryption under heavy load.</p></div></div></td><td><div><div><p>W-16517561</p></div></div></td></tr><tr><td><div><div><p>Gatekeeper deadlock errors no longer occur during race conditions between contract downloads and policy application.</p></div></div></td><td><div><div><p>W-19407164</p></div></div></td></tr></tbody></table>

## September 2, 2025

### What’s New

Runtime Manager agent 2.7.7. See
[Runtime Manager Agent 2.7.7 Release Notes](https://docs.mulesoft.com/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-7).

### Fixed Issues

### 4.9.9:5e-java17

**4.9.9 Edge Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.15`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>TLS configuration for FIPS-140-2 is now upgraded.</p></div></div></td><td><div><div><p>W-16315176</p></div></div></td></tr><tr><td><div><div><p>Applications using Scheduler component in a strict FIPS-140-2 environment no longer fail to deploy due to the unavailability of the MD5 algorithm.</p></div></div></td><td><div><div><p>W-19319437</p></div></div></td></tr><tr><td><div><div><p>io.projectreactor.netty : reactor-netty-http is upgraded to 1.2.8.</p></div></div></td><td><div><div><p>W-19074903</p></div></div></td></tr><tr><td><div><div><p>Component annotations, such as <code>location</code>, are no longer overwritten by other components.</p></div></div></td><td><div><div><p>W-18269859</p></div></div></td></tr><tr><td><div><div><p>org.apache.commons : commons-lang3 is upgraded to 3.18.0.</p></div></div></td><td><div><div><p>W-19059553</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>A memory leak during Weave type schema resolution is now fixed.</p></div></div></td><td><div><div><p>W-19389019</p></div></div></td></tr><tr><td><div><div><p>Potential deadlocks no longer occur when increasing concurrency while parsing DataWeave scripts.</p></div></div></td><td><div><div><p>W-19376546</p></div></div></td></tr></tbody></table>

### 4.9.9:5-java17

**4.9.9 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.15`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>TLS configuration for FIPS-140-2 is now upgraded.</p></div></div></td><td><div><div><p>W-16315176</p></div></div></td></tr><tr><td><div><div><p>Applications using Scheduler component in a strict FIPS-140-2 environment no longer fail to deploy due to the unavailability of the MD5 algorithm.</p></div></div></td><td><div><div><p>W-19319437</p></div></div></td></tr><tr><td><div><div><p>io.projectreactor.netty : reactor-netty-http is upgraded to 1.2.8.</p></div></div></td><td><div><div><p>W-19074903</p></div></div></td></tr><tr><td><div><div><p>Component annotations, such as <code>location</code>, are no longer overwritten by other components.</p></div></div></td><td><div><div><p>W-18269859</p></div></div></td></tr><tr><td><div><div><p>org.apache.commons : commons-lang3 is upgraded to 3.18.0.</p></div></div></td><td><div><div><p>W-19059553</p></div></div></td></tr><tr><th colspan="2"><p>DataWeave</p></th></tr><tr><td><div><div><p>A memory leak during Weave type schema resolution is now fixed.</p></div></div></td><td><div><div><p>W-19389019</p></div></div></td></tr><tr><td><div><div><p>Potential deadlocks no longer occur when increasing concurrency while parsing DataWeave scripts.</p></div></div></td><td><div><div><p>W-19376546</p></div></div></td></tr></tbody></table>

### 4.6.22:4-java17

**4.6.22 LTS Runtime Updates**

- Bundled JDK version: OpenJDK version 17.0.15+6

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.15`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>TLS configuration for FIPS-140-2 is now upgraded.</p></div></div></td><td><div><div><p>W-16315176</p></div></div></td></tr><tr><td><div><div><p>Applications using Scheduler component in a strict FIPS-140-2 environment no longer fail to deploy due to the unavailability of the MD5 algorithm.</p></div></div></td><td><div><div><p>W-19319437</p></div></div></td></tr><tr><td><div><div><p>OAuth token is now refreshed when used through <code>ExtensionClient</code>.</p></div></div></td><td><div><div><p>W-19248279</p></div></div></td></tr></tbody></table>

### 4.6.22:4-java8

**4.6.22 LTS Runtime Updates**

- Bundled JDK version: OpenJDK "1.8.0\_452"

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.15`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>TLS configuration for FIPS-140-2 is now upgraded.</p></div></div></td><td><div><div><p>W-16315176</p></div></div></td></tr><tr><td><div><div><p>Applications using Scheduler component in a strict FIPS-140-2 environment no longer fail to deploy due to the unavailability of the MD5 algorithm.</p></div></div></td><td><div><div><p>W-19319437</p></div></div></td></tr><tr><td><div><div><p>OAuth token is now refreshed when used through <code>ExtensionClient</code>.</p></div></div></td><td><div><div><p>W-19248279</p></div></div></td></tr></tbody></table>

### 4.4.0:20250829-1

**4.4.0 Runtime Updates**

- Bundled JDK version: OpenJDK "1.8.0\_452"

- Sidecar version: `mulesoft/dias-anypoint-monitoring-sidecar:2.2.15`

This release includes security updates.

<table><colgroup><col> <col></colgroup><thead><tr><th>Issue Resolution</th><th>ID</th></tr></thead><tbody><tr><th colspan="2"><p>Mule</p></th></tr><tr><td><div><div><p>Performance degradation no longer occurs when using repeatable streaming.</p></div></div></td><td><div><div><p>W-19175330</p></div></div></td></tr></tbody></table>

## See Also

- [Troubleshooting Runtime Fabric with RTFCTL](https://docs.mulesoft.com/runtime-fabric/latest/troubleshoot-rtf-rtfctl)

- [Known Issues](https://help.salesforce.com/s/issues)