--- schema_version: "1" id: d9a19a0437abf6e3256163bcfbd25f192fb221220b19533e6ffec8f9f1db4dd3 title: CloudHub Runtime and Operating System Patch Update Release Notes collection: mulesoft version: current locale: ja-jp portal_url: https://docs.salesforce.com/mulesoft/current/ja-jp/release-notes/cloudhub/cloudhub-runtimes-release-notes.md canonical_url: https://docs.mulesoft.com/jp/release-notes/cloudhub/cloudhub-runtimes-release-notes source_site: docs.mulesoft.com content_type: documentation content_hash: 5cdc421668ec155e1ba73b05a4a8dbde2e78061507388dcdf9bba000a8c9a48d description: MuleSoft Documentation Site latest: true --- # CloudHub Runtime and Operating System Patch Update Release Notes These release notes describe monthly date-patch updates to Mule runtime engine and security updates to the underlying operating system for CloudHub. In addition to these release notes, see: - [CloudHub Runtime Continuous Updates](https://docs.mulesoft.com/cloudhub/cloudhub-app-runtime-version-updates) - [CloudHub Release Notes](https://docs.mulesoft.com/jp/release-notes/cloudhub/cloudhub-release-notes) - [CloudHub documentation](https://docs.mulesoft.com/cloudhub/) ## [](#mulesoft-commercial-and-government-cloud-schedule)MuleSoft Commercial and Government Cloud Schedule This table shows the current schedule for monthly updates. These dates are subject to change.
Month Release Available Sandbox Environment Auto-Update Production Environment Auto-Update

December

December 1

December 15-19

December 20-21

November

November 3

November 16-20

November 21-22

October

October 6**

October 19-23

October 24-25

September

September 4*

September 21-25

September 26-27
The release notes for an update are published in the same week in which the runtime patch is released for all Mule versions on CloudHub.
All releases occur in GMT-3 time. All automatic updates occur in the local time zone of the app’s deployment region. For example, CloudHub applies updates to apps deployed in the Asia-Pacific (Sydney) region in the AEST time zone and to apps deployed in the US West region in the PST time zone.
** The October 2026 Government Cloud monthly patch release was rescheduled from October 6 to October 7. All subsequent update windows remain unchanged.
* The September 2026 monthly patch release is rescheduled from September 8 to September 4. All subsequent update windows remain unchanged.
Using a runtime version that is more than three months old can introduce security vulnerabilities. If your application doesn’t update automatically within two monthly patching cycles, CloudHub stops the application and force-updates the application to the latest patch version. If an application doesn’t automatically start after the forced patch update, make sure the patch is applied and start the application. For more information, see Failed Automated Updates.
CloudHub doesn’t auto-upgrade apps when the target Mule runtime version introduces incompatibilities with the application configuration, such as TLS or Java version changes. For example, apps that use TLS 1.1 in Mule 4.9 aren’t auto-upgraded to Mule 4.10 because Mule 4.10 doesn’t support TLS 1.1. Similarly, apps aren’t auto-upgraded across incompatible Java versions.
## [](#october-15-2026)October 15, 2026 ### What’s New **4.13.1, 4.12.5, 4.9.23, and 4.6.36 Runtime Updates** This update addresses regressions introduced in the October release. **Runtime Manager agent versions included in Runtime 4.13.1, 4.12.5, 4.9.23, and 4.6.36** This release of 4.13.1, 4.12.5, and 4.9.23 includes Runtime Manager agent 2.8.5, and 4.6.36 includes Runtime Manager agent 2.7.20. For information, see [Runtime Manager Agent 2.8.5 Release Notes](https://docs.mulesoft.com/jp/release-notes/runtime-manager-agent/runtime-manager-agent-2.8.x-release-notes#2-8-5) and [Runtime Manager Agent 2.7.20 Release Notes](https://docs.mulesoft.com/jp/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-20). ### Fixed Issues **4.13.1 Runtime Updates** For Mule runtime 4.13.1 on CloudHub, the image name that corresponds with this update is 4.13.1:2e.
Issue Resolution ID

Mule

Applications no longer fail to deploy when the type of an on-error-propagate or on-error-continue is a property placeholder and the flow contains a component that supports streaming and requires a connection, such as an HTTP Request or Kafka operation.

W-24456406

A JMS connection that doesn’t use XA transactions no longer logs an error, or fails application initialization, when the application doesn’t declare a bti:transaction-manager.

W-24443844

Configuring the DELTA aggregation temporality for metrics export now works when running on CloudHub, CloudHub 2.0, and Runtime Fabric.

W-24492022

Polling sources that use a CloudHub Object Store v2 for watermarks now track processed items in the object store’s configured partition instead of the default partition.

W-24459240

SLA-based rate limiting policies no longer reject valid client requests because the client is validated twice.

W-24447995
**4.12.5 Runtime Updates** For Mule runtime 4.12.5 on CloudHub, the image name that corresponds with this update is 4.12.5:2e.
Issue Resolution ID

Mule

A JMS connection that doesn’t use XA transactions no longer logs an error, or fails application initialization, when the application doesn’t declare a bti:transaction-manager.

W-24443844

Configuring the DELTA aggregation temporality for metrics export now works when running on CloudHub, CloudHub 2.0, and Runtime Fabric.

W-24492022

SLA-based rate limiting policies no longer reject valid client requests because the client is validated twice.

W-24447995
**4.9.23 Runtime Updates** - For Mule runtime 4.9.23 on CloudHub and Government Cloud with FIPS 140-2, the image name that corresponds with this update is 4.9.23:4. - For Mule runtime 4.9.23 on Government Cloud with FIPS 140-3, the image name that corresponds with this update is 4.9.23:4-fips1403.
Issue Resolution ID

Mule

SLA-based rate limiting policies no longer reject valid client requests because the client is validated twice.

W-24447995
**4.6.36 Runtime Updates** For Mule runtime 4.6.36 on CloudHub, the image name that corresponds with this update is 4.6.36:2.
Issue Resolution ID

Mule

SLA-based rate limiting policies no longer reject valid client requests because the client is validated twice.

W-24447995
## [](#october-6-2026)October 6, 2026 ### What’s New - Mule runtime engine 4.13.0 is now available. For information about the release notes, see [Mule Runtime Engine 4.13.0 Release Notes](https://docs.mulesoft.com/jp/release-notes/mule-runtime/mule-4.13.0-release-notes). For information about the new release cadence, see [Edge and LTS Releases for Mule](https://docs.mulesoft.com/jp/release-notes/mule-runtime/lts-edge-release-cadence). **4.13.0, 4.12.4, 4.9.22, and 4.6.35 Runtime Updates** - Updated to the latest operating system security patches. **Runtime Manager agent versions included in Runtime 4.13.0, 4.12.4, 4.9.22, and 4.6.35** This release of 4.13.0, 4.12.4, and 4.9.22 includes Runtime Manager agent 2.8.5, and 4.6.35 includes Runtime Manager agent 2.7.20. For information, see [Runtime Manager Agent 2.8.5 Release Notes](https://docs.mulesoft.com/jp/release-notes/runtime-manager-agent/runtime-manager-agent-2.8.x-release-notes#2-8-5) and [Runtime Manager Agent 2.7.20 Release Notes](https://docs.mulesoft.com/jp/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-20). ### Fixed Issues **4.13.0 Runtime Updates** For Mule runtime 4.13.0 on CloudHub, the image name that corresponds with this update is 4.13.0:16e.
Issue Resolution ID

Mule

The jsoup library is upgraded to 1.23.2.

W-23987955

The Jackson library is upgraded to 2.22.3.

W-24335732

The Reactor Core library is upgraded to 3.8.7.

W-23987958

The Netty library is upgraded to 4.2.18.Final.

W-24336011

The Apache Neethi library is upgraded to 3.2.4.

W-24335736

The Spring Framework library is upgraded to 7.0.9.

W-24232049

The raml-parser-2 library is upgraded to 1.2.1.

W-23570110

Error-mapping preservation during error propagation is now enabled by default. An error whose type was already resolved inside a scope, including any remapping by an error mapping, now keeps that resolved type as it propagates out of the scope, instead of reverting to the raw connector error type. You can disable this behavior by setting the mule.honourErrorMappingsOnErrorPropagation system property to false.

W-23955755

OpenTelemetry metric exporters now support per-exporter view enrichment and resource attribute overrides.

W-23367495

JSON schema validation is migrated from the everit library to networknt, with everit retained as a fallback.

W-16530105

HTTP header values containing CR/LF characters are now sanitized instead of causing the request to be rejected.

W-22252135

minMuleVersion values are now normalized when loaded, preventing the patch or revision portion from being truncated.

W-24231362

Configuration property placeholder resolution now stops once it exceeds a maximum nesting depth, instead of continuing to recurse through a cyclic or excessively deep reference chain. You can configure the depth limit through the mule.properties.resolution.maxDepth system property, which defaults to 10.

W-23650198

Reads from the repeatable streaming buffer are now lock-free when data is already available, reducing thread contention. You can control this behavior by using the mule.repeatableStreaming.lockFreeRead system property.

W-24012839

You can now configure a full request timeout for the HTTP server by using the mule.http.server.fullRequestTimeout system property, in milliseconds. This property is disabled by default.

W-22040113

OpenTelemetry flow-statistics counters now emit one datapoint per flow, labeled with the mule.flow.name dimension, instead of a single artifact-level total. You can disable this behavior by setting the mule.enable.otel.flow.statistics.detailed system property to false.

W-23616483

Logging export reconfiguration is fixed for single application mode.

W-20908857

The ObjectStore API is extended with an upsert operation and an isThreadSafe indicator.

W-23090592

An omitted eagerRead attribute on <repeatable-in-memory-stream> now correctly takes its default value from the mule.repeatableStreaming.bytes.eagerRead system property, instead of a fixed value.

W-24043809

A java.lang.UnsupportedClassVersionError thrown when a connector’s compiled target doesn’t match the running JVM is now handled gracefully.

W-24193358

A connector’s message source no longer deadlocks when its connection-retry logic triggers a stop of the retry scheduler from one of that scheduler’s own worker threads.

W-24234538

Network information listening ports are now scoped to the Mule process.

W-24043880

NullPointerException errors no longer occur when loading the extension model of a connector whose connection provider uses the @ClientCredentials or @AuthorizationCode OAuth annotation with credentialsPlacement configured.

W-24086656

Policy logging context is no longer lost when a dynamic Flow Reference resolves to a subflow.

W-24026465

The new loggingConfiguration troubleshooting operation helps you diagnose logging configuration issues.

W-23998256

The log level for disallowConcurrentExecution messages is changed from WARN to DEBUG, reducing log noise.

W-24164028

The new on-demand connectivity-testing troubleshooting operation is now available.

W-23629284

The OpenTelemetry exporter TLS property mule.openTelemetry.exporter.tls.certificatesStrategy is now properly resolved.

W-24009827

A source policy that uses Async, Parallel For Each, or Scatter-Gather no longer builds its response from the failure response parameters instead of the success response parameters, and no longer silently drops the forked route’s response processing.

W-23938349

The new on-demand connectionCount troubleshooting operation is now available.

W-23716301

The commons-beanutils library and its transitive commons-collections 3.2.2 dependency are removed from Mule Runtime modules.

W-16918287

OpenTelemetry metrics export now supports delta aggregation temporality.

W-23448781

An unresolved placeholder in the meter-exporter configuration now degrades to its default value at tracer startup instead of causing a failure.

W-23650358

Dynamic reload of the metrics exporter configuration is now supported.

W-21921629

OpenTelemetry flow statistics counters now report total flow counts as well as per-flow totals.

W-23232729

OutputHandler is deprecated and its support is removed.

W-23660888

A SerializationException now raises a MULE:SERIALIZATION error, instead of MULE:UNKNOWN.

W-21381359

The exporter-health backpressure-alert cadence for OpenTelemetry tracing, metrics, and logging is now configured through a single system property, mule.openTelemetry.meter.exporter.healthMetrics.alertingFrequency, instead of the separate per-signal metricsLogFrequency properties, which are deprecated and no longer consumed.

W-22193713

MULE:INVALID_INPUT_PARAM is now preserved as a suppressed error when a MULE:SOURCE_RESPONSE_GENERATE error occurs.

W-22293407

SDK parameter validation errors are now mapped to the MULE:INVALID_INPUT_PARAM error type.

W-2227652

Mule-generated tracing spans no longer truncate attribute values at OpenTelemetry’s default 128-character limit. Attribute values are now preserved up to 4096 characters before truncation.

W-20091299

Client-side read backpressure is now applied to streamed HTTP responses, preventing out-of-memory errors when consuming large response bodies.

W-24103497

The Netty-based HTTP client now defers DNS resolution of the target host to the proxy when a proxy is configured, regardless of the configured scheme.

W-24010245

Unresolved placeholders in Batch AST properties no longer cause a ClassCastException during packaging validation.

W-24088827

In a clustered deployment, the DiscoverySPI HTTP client no longer fails to start when PCF or Kubernetes discovery is configured through the .mule/mule-cluster.properties file instead of a JVM system property.

W-24211100

SQSQueueManagementService is added to the serialization allowlist.

W-24197744

Fallback is now enabled as the default strategy for contracts collection. You can change this behavior by configuring the anypoint.platform.clients_fetch_mode system property with the values sharded, legacy, or fallback.

W-24179706

When API Gateway authenticates with Anypoint Platform, a transient failure of the /login request no longer discards an otherwise valid Access Management token. The token is now invalidated only on an actual authentication failure (401 or 403).

W-24144244

Netty’s Java Flight Recorder (JFR) integration is now disabled by default.

W-20926401

DataWeave

Memory usage for text/plain output is reduced.

W-20063270

Eagerly materialize executable Weave reader results.

W-23837275

Thread safety is improved when processing Java map values.

W-23661641

DataWeave tooling now reports design-time warnings when Java classes referenced in application/java schemas can’t be found or are inaccessible through JPMS.

W-22797049

DataWeave now filters Java classes in JPMS-unexported packages during Java module resolution, preventing runtime IllegalAccessException failures. This behavior is enabled by default on JDK 17 and later with DataWeave language version 2.13 and later. To keep the previous behavior, set mule.dw.filter_jpms_inaccessible_modules=false.

W-22779527

Cryptographic security warnings and errors now include call stacks.

W-22144340
**4.12.4 Runtime Updates** For Mule runtime 4.12.4 on CloudHub, the image name that corresponds with this update is 4.12.4:9e.
Issue Resolution ID

Mule

The Log4j library is upgraded to 2.26.1.

W-24061648

The Jackson library is upgraded to 2.22.3.

W-24335732

The Netty library is upgraded to 4.2.18.Final.

W-24336011

The Apache Neethi library is upgraded to 3.2.4.

W-24335736

The Spring Framework library is upgraded to 7.0.9.

W-24232049

Configuration property placeholder resolution now stops once it exceeds a maximum nesting depth, instead of continuing to recurse through a cyclic or excessively deep reference chain. You can configure the depth limit through the mule.properties.resolution.maxDepth system property, which defaults to 10.

W-23650198

Reads from the repeatable streaming buffer are now lock-free when data is already available, reducing thread contention. You can control this behavior by using the mule.repeatableStreaming.lockFreeRead system property.

W-24012839

Error-mapping preservation during error propagation can now be enabled through the mule.honourErrorMappingsOnErrorPropagation system property. When enabled, an error whose type was already resolved inside a scope, including any remapping by an error mapping, keeps that resolved type as it propagates out of the scope, instead of reverting to the raw connector error type.

W-23955755

OpenTelemetry flow-statistics counters now emit one datapoint per flow, labeled with the mule.flow.name dimension, instead of a single artifact-level total. You can disable this behavior by setting the mule.enable.otel.flow.statistics.detailed system property to false.

W-23616483

You can now configure a full request timeout for the HTTP server by using the mule.http.server.fullRequestTimeout system property, in milliseconds. This property is disabled by default.

W-22040113

Network information listening ports are now scoped to the Mule process.

W-24043880

OpenTelemetry metrics export now supports delta aggregation temporality.

W-23448781

NullPointerException errors no longer occur when loading the extension model of a connector whose connection provider uses the @ClientCredentials or @AuthorizationCode OAuth annotation with credentialsPlacement configured.

W-24086656

Policy logging context is no longer lost when a dynamic Flow Reference resolves to a subflow.

W-24026465

The new loggingConfiguration troubleshooting operation helps you diagnose logging configuration issues.

W-23998256

The log level for disallowConcurrentExecution messages is changed from WARN to DEBUG, reducing log noise.

W-24164028

The OpenTelemetry exporter TLS property mule.openTelemetry.exporter.tls.certificatesStrategy is now properly resolved.

W-24009827

On CloudHub 2.0 and Runtime Fabric deployments, container logs exported through OpenTelemetry now correctly use the deployed application’s configured service name, instead of the generic mule-container name.

W-23734353

OpenTelemetry flow statistics counters now report total flow counts as well as per-flow totals.

W-23232729

The new on-demand connectionCount troubleshooting operation is now available.

W-23716301

Client-side read backpressure is now applied to streamed HTTP responses, preventing out-of-memory errors when consuming large response bodies.

W-24103497

HTTP/1-only HTTPS listeners backed by the Netty HTTP service no longer fail to establish TLS connections when an application loads the Bouncy Castle JSSE provider from a shared library outside the runtime’s classloader.

W-23355657

The Netty-based HTTP client now defers DNS resolution of the target host to the proxy when a proxy is configured, regardless of the configured scheme.

W-24010245

A warning is now logged when NTLM authentication is configured but the server doesn’t issue an NTLM challenge.

W-17651806

Unresolved placeholders in Batch AST properties no longer cause a ClassCastException during packaging validation.

W-24088827

In a clustered deployment, the DiscoverySPI HTTP client no longer fails to start when PCF or Kubernetes discovery is configured through the .mule/mule-cluster.properties file instead of a JVM system property.

W-24211100

Fallback is now enabled as the default strategy for contracts collection. You can change this behavior by configuring the anypoint.platform.clients_fetch_mode system property with the values sharded, legacy, or fallback.

W-24179706

When API Gateway authenticates with Anypoint Platform, a transient failure of the /login request no longer discards an otherwise valid Access Management token. The token is now invalidated only on an actual authentication failure (401 or 403).

W-24144244

Netty’s Java Flight Recorder (JFR) integration is now disabled by default.

W-20926401

An omitted eagerRead attribute on <repeatable-in-memory-stream> now correctly takes its default value from the mule.repeatableStreaming.bytes.eagerRead system property, instead of a fixed value.

W-24043809
**4.9.22 Runtime Updates** - For Mule runtime 4.9.22 on CloudHub and Government Cloud with FIPS 140-2, the image name that corresponds with this update is 4.9.22:8. - For Mule runtime 4.9.22 on Government Cloud with FIPS 140-3, the image name that corresponds with this update is 4.9.22:8-fips1403.
Issue Resolution ID

Mule

The Reactor Core library is upgraded to 3.8.7.

W-23953702

The Jackson library is upgraded to 2.22.3.

W-24335732

The Netty library is upgraded to 4.2.18.Final.

W-24336011

The Apache Neethi library is upgraded to 3.2.4.

W-24335736

The Spring Framework library is upgraded to 7.0.9.

W-24232049

Configuration property placeholder resolution now stops once it exceeds a maximum nesting depth, instead of continuing to recurse through a cyclic or excessively deep reference chain. You can configure the depth limit through the mule.properties.resolution.maxDepth system property, which defaults to 10.

W-23650198

Reads from the repeatable streaming buffer are now lock-free when data is already available, reducing thread contention. You can control this behavior by using the mule.repeatableStreaming.lockFreeRead system property.

W-24012839

Error-mapping preservation during error propagation can now be enabled through the mule.honourErrorMappingsOnErrorPropagation system property. When enabled, an error whose type was already resolved inside a scope, including any remapping by an error mapping, keeps that resolved type as it propagates out of the scope, instead of reverting to the raw connector error type.

W-23955755

You can now configure a full request timeout for the HTTP server by using the mule.http.server.fullRequestTimeout system property, in milliseconds. This property is disabled by default.

W-22040113

A connector’s message source no longer deadlocks when its connection-retry logic triggers a stop of the retry scheduler from one of that scheduler’s own worker threads.

W-24234538

Network information listening ports are now scoped to the Mule process.

W-24043880

NullPointerException errors no longer occur when loading the extension model of a connector whose connection provider uses the @ClientCredentials or @AuthorizationCode OAuth annotation with credentialsPlacement configured.

W-24086656

Policy logging context is no longer lost when a dynamic Flow Reference resolves to a subflow.

W-24026465

The new loggingConfiguration troubleshooting operation helps you diagnose logging configuration issues.

W-23998256

The log level for disallowConcurrentExecution messages is changed from WARN to DEBUG, reducing log noise.

W-24164028

The new on-demand connectivity-testing troubleshooting operation is now available.

W-23629284

The new on-demand connectionCount troubleshooting operation is now available.

W-23716301

HTTP/1-only HTTPS listeners backed by the Netty HTTP service no longer fail to establish TLS connections when an application loads the Bouncy Castle JSSE provider from a shared library outside the runtime’s classloader.

W-23355657

The Netty-based HTTP client now defers DNS resolution of the target host to the proxy when a proxy is configured, regardless of the configured scheme.

W-24010245

A warning is now logged when NTLM authentication is configured but the server doesn’t issue an NTLM challenge.

W-17651806

Fallback is now enabled as the default strategy for contracts collection. You can change this behavior by configuring the anypoint.platform.clients_fetch_mode system property with the values sharded, legacy, or fallback.

W-24179706

When API Gateway authenticates with Anypoint Platform, a transient failure of the /login request no longer discards an otherwise valid Access Management token. The token is now invalidated only on an actual authentication failure (401 or 403).

W-24144244
**4.6.35 Runtime Updates** - For Mule runtime 4.6.35 on CloudHub and Government Cloud with FIPS 140-2, the image name that corresponds with this update is 4.6.35:4. - For Mule runtime 4.6.35 on Government Cloud with FIPS 140-3, the image name that corresponds with this update is 4.6.35:4-fips1403.
Issue Resolution ID

Mule

The Reactor Core library is upgraded to 3.8.7.

W-3300013

The Jackson library is upgraded to 2.22.2.

W-23947149

The jsoup library is upgraded to 1.23.2.

W-23987949

Configuration property placeholder resolution now stops once it exceeds a maximum nesting depth, instead of continuing to recurse through a cyclic or excessively deep reference chain. You can configure the depth limit through the mule.properties.resolution.maxDepth system property, which defaults to 10.

W-23650198

Error-mapping preservation during error propagation can now be enabled through the mule.honourErrorMappingsOnErrorPropagation system property. When enabled, an error whose type was already resolved inside a scope, including any remapping by an error mapping, keeps that resolved type as it propagates out of the scope, instead of reverting to the raw connector error type.

W-23955755

A connector’s message source no longer deadlocks when its connection-retry logic triggers a stop of the retry scheduler from one of that scheduler’s own worker threads.

W-24234538

Network information listening ports are now scoped to the Mule process.

W-24043880

NullPointerException errors no longer occur when loading the extension model of a connector whose connection provider uses the @ClientCredentials or @AuthorizationCode OAuth annotation with credentialsPlacement configured.

W-24086656

Policy logging context is no longer lost when a dynamic Flow Reference resolves to a subflow.

W-24026465

The new loggingConfiguration troubleshooting operation helps you diagnose logging configuration issues.

W-23998256

The log level for disallowConcurrentExecution messages is changed from WARN to DEBUG, reducing log noise.

W-24164028

The new on-demand connectivity-testing troubleshooting operation is now available.

W-23629284

An SDK API for queues (VM usage) and core adapters is added.

W-19439432

The new on-demand connectionCount troubleshooting operation is now available.

W-23716301

A warning is now logged when NTLM authentication is configured but the server doesn’t issue an NTLM challenge.

W-17651806

Fallback is now enabled as the default strategy for contracts collection. To change the behavior, configure the anypoint.platform.clients_fetch_mode system property with the values sharded, legacy, or fallback.

W-24179706

When API Gateway authenticates with Anypoint Platform, a transient failure of the /login request no longer discards an otherwise valid Access Management token. The token is now invalidated only on an actual authentication failure (401 or 403).

W-24144244
## [](#september-23-2026)September 23, 2026 ### What’s New **4.12.3 and 4.11.6 Runtime Updates** - Updated to the latest operating system security patches. **Runtime Manager agent versions included in Runtime 4.12.3 and 4.11.6** This release of 4.12.3 and 4.11.6 includes Runtime Manager agent 2.8.4. For information, see [Runtime Manager Agent 2.8.4 Release Notes](https://docs.mulesoft.com/jp/release-notes/runtime-manager-agent/runtime-manager-agent-2.8.x-release-notes#2-8-4). **4.12.3 Runtime Updates** For Mule runtime 4.12.3 on CloudHub and Government Cloud with FIPS 140-2, the image name that corresponds with this update is 4.12.3:6e.
Issue Resolution ID

Workers running Mule runtime Edge versions on non-micro instance sizes now correctly allocate JVM heap memory.

W-22534602
**4.11.6 Runtime Updates** For Mule runtime 4.11.6 on CloudHub and Government Cloud with FIPS 140-2, the image name that corresponds with this update is 4.11.6:7e.
Issue Resolution ID

Workers running Mule runtime Edge versions on non-micro instance sizes now correctly allocate JVM heap memory.

W-22534602
## [](#september-4-2026)September 4, 2026 ### What’s New **4.12.3, 4.9.21, and 4.6.34 Runtime Updates** - Updated to the latest operating system security patches. **Runtime Manager agent versions included in Runtime 4.12.3, 4.9.21, and 4.6.34** This release of 4.12.3 and 4.9.21 includes Runtime Manager agent 2.8.4, and 4.6.34 includes Runtime Manager agent 2.7.16. For information, see [Runtime Manager Agent 2.8.4 Release Notes](https://docs.mulesoft.com/jp/release-notes/runtime-manager-agent/runtime-manager-agent-2.8.x-release-notes#2-8-4) and [Runtime Manager Agent 2.7.16 Release Notes](https://docs.mulesoft.com/jp/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-16). ### Fixed Issues **4.12.3 Runtime Updates** For Mule runtime 4.12.3 on CloudHub and Government Cloud with FIPS 140-2, the image name that corresponds with this update is 4.12.3:5e.
Issue Resolution ID

Mule

An <async> scope can now be configured to wait for its in-flight events to finish before flows are stopped during a graceful shutdown, which helps avoid dropped or canceled async work. This behavior is disabled by default and can be enabled through the mule.async.gracefulShutdown.drainInflight system property.

W-23602447

An SDK-based reconnectable message source no longer attempts to reconnect while a graceful shutdown is in progress.

W-23122573

Custom error mappings in the Tracing module are no longer lost on error propagation when an operation inside a tracing:with-correlation-id scope fails, which previously reverted the mapped error type to the raw connector error.

W-21815402

A disposed source policy is no longer left in the policy cache when a flow is stopped and restarted while cache population and flow-stop invalidation occur concurrently.

W-23564125

A memory leak no longer occurs when parallel-foreach and scatter-gather routes leave the route event pinned in a worker thread’s memory after route completion.

W-23829061

Artifact descriptor validation failures during deployment now report more specific exceptions.

W-23047228

A malformed authorization URL no longer occurs when the configured OAuth authorizationUrl contains an existing query parameter.

W-23064254

A worker thread no longer hangs indefinitely, eventually exhausting the runtime’s thread pool, when a client drops the connection while its HTTP request body is being read.

W-23612974

Netty-based HTTP client requests no longer fail when the response contains a header section larger than 8 KB and a larger response header size limit is configured.

W-23443375

DIGEST authentication in the Netty-based HTTP client no longer fails with a 401 Unauthorized response when the server issues an RFC 7616-compliant challenge.

W-23075291

A NullPointerException no longer occurs during cluster node discovery when using PCF or Kubernetes-based cluster discovery.

W-23466789

Analytics events for requests rejected due to back-pressure are no longer incorrectly reported as HTTP 500 and now correctly report 503 by default. Custom status codes for other error scenarios can also be configured through the anypoint.platform.error.mapping (format NAMESPACE:IDENTIFIER:STATUS_CODE, comma-separated for multiple mappings) and anypoint.platform.error.default system properties.

W-23509148

API Gateway no longer fails to read shard checksums from an ETag header that contains commas.

W-23572494

The fix for idle connections being destroyed and recreated instead of reused when the number of idle connections reached the configured maxIdle limit under concurrent load, introduced in a previous release, is reverted in this release.

W-22716456

The jsoup library is upgraded to 1.23.1.

W-23671475

The Netty library is upgraded to 4.2.17.Final.

W-3300013

The RAML Parser library is upgraded to 2-1.2.1.

W-23328350

The com.mulesoft.mule.runtime.gw.api.analytics package is now open to all modules, so the Runtime Manager agent can serialize analytics events.

W-23846531

DataWeave

You can now configure the size of the DataWeave script parser cache by using the mule.weave.script.parser.cache.size system property.

W-23138851

A thread-safety livelock no longer occurs in the Java module builder and converter caches.

W-23652160
**4.9.21 Runtime Updates** - For Mule runtime 4.9.21 on CloudHub and Government Cloud with FIPS 140-2, the image name that corresponds with this update is 4.9.21:4. - For Mule runtime 4.9.21 on Government Cloud with FIPS 140-3, the image name that corresponds with this update is 4.9.21:4-fips1403.
Issue Resolution ID

Mule

An <async> scope can now be configured to wait for its in-flight events to finish before flows are stopped during a graceful shutdown, which helps avoid dropped or canceled async work. This behavior is disabled by default and can be enabled through the mule.async.gracefulShutdown.drainInflight system property.

W-23602447

An SDK-based reconnectable message source no longer attempts to reconnect while a graceful shutdown is in progress.

W-23122573

Custom error mappings in the Tracing module are no longer lost on error propagation when an operation inside a tracing:with-correlation-id scope fails, which previously reverted the mapped error type to the raw connector error.

W-21815402

A disposed source policy is no longer left in the policy cache when a flow is stopped and restarted while cache population and flow-stop invalidation occur concurrently.

W-23564125

A memory leak no longer occurs when parallel-foreach and scatter-gather routes leave the route event pinned in a worker thread’s memory after route completion.

W-23829061

Artifact descriptor validation failures during deployment now report more specific exceptions.

W-23047228

A malformed authorization URL no longer occurs when the configured OAuth authorizationUrl contains an existing query parameter.

W-23064254

The HTTP client configurer now includes a method to control whether sensitive headers are filtered when a request is redirected to a different domain.

W-21045658

A forward-proxy client no longer sends a malformed, path-only request line.

W-23384645

A worker thread no longer hangs indefinitely, eventually exhausting the runtime’s thread pool, when a client drops the connection while its HTTP request body is being read.

W-23612974

Netty-based HTTP client requests no longer fail when the response contains a header section larger than 8 KB and a larger response header size limit is configured.

W-23443375

DIGEST authentication in the Netty-based HTTP client no longer fails with a 401 Unauthorized response when the server issues an RFC 7616-compliant challenge.

W-23075291

A NullPointerException no longer occurs during cluster node discovery when using PCF or Kubernetes-based cluster discovery.

W-23466789

Analytics events for requests rejected due to back-pressure are no longer incorrectly reported as HTTP 500 and now correctly report 503 by default. Custom status codes for other error scenarios can also be configured through the anypoint.platform.error.mapping (format NAMESPACE:IDENTIFIER:STATUS_CODE, comma-separated for multiple mappings) and anypoint.platform.error.default system properties.

W-23509148

API Gateway no longer fails to read shard checksums from an ETag header that contains commas.

W-23572494

The fix for idle connections being destroyed and recreated instead of reused when the number of idle connections reached the configured maxIdle limit under concurrent load, introduced in a previous release, is reverted in this release.

W-22716456

The jsoup library is upgraded to 1.23.1.

W-23715606

The Netty library is upgraded to 4.2.17.Final.

W-3300013

The Jackson library is upgraded to 2.22.1.

W-23540341

The RAML Parser library is upgraded to 2-1.2.1.

W-23328348

The com.mulesoft.mule.runtime.gw.api.analytics package is now open to all modules, so the Runtime Manager agent can serialize analytics events.

W-23846531

DataWeave

Vulnerable dependencies are upgraded to address reported security vulnerabilities.

W-23924223

You can now configure the size of the DataWeave script parser cache by using the mule.weave.script.parser.cache.size system property.

W-23138851

A thread-safety livelock no longer occurs in the Java module builder and converter caches.

W-23652160

Additional fixes for Government Cloud with FIPS 140-2

Worker TLS configuration for Government Cloud is strengthened.

W-23819316

TLS hostname verification no longer falls back to the certificate’s Common Name (CN) when a DNS Subject Alternative Name (SAN) isn’t present. The server hostname must now be included in the certificate’s DNS SAN. Otherwise, hostname verification fails and the TLS connection may be rejected with certificate_unknown(46).

W-23730329

Additional fixes for Government Cloud with FIPS 140-3

Worker TLS configuration for Government Cloud is strengthened.

W-23819316
**4.6.34 Runtime Updates** - For Mule runtime 4.6.34 on CloudHub and Government Cloud with FIPS 140-2, the image name that corresponds with this update is 4.6.34:6. - For Mule runtime 4.6.34 on Government Cloud with FIPS 140-3, the image name that corresponds with this update is 4.6.34:6-fips1403.
Issue Resolution ID

Mule

An <async> scope can now be configured to wait for its in-flight events to finish before flows are stopped during a graceful shutdown, which helps avoid dropped or canceled async work. This behavior is disabled by default and can be enabled through the mule.async.gracefulShutdown.drainInflight system property.

W-23602447

An SDK-based reconnectable message source no longer attempts to reconnect while a graceful shutdown is in progress.

W-23122573

Custom error mappings in the Tracing module are no longer lost on error propagation when an operation inside a tracing:with-correlation-id scope fails, which previously reverted the mapped error type to the raw connector error.

W-21815402

A memory leak no longer occurs when parallel-foreach and scatter-gather routes leave the route event pinned in a worker thread’s memory after route completion.

W-23829061

Artifact descriptor validation failures during deployment now report more specific exceptions.

W-23047228

Analytics events for requests rejected due to back-pressure are no longer incorrectly reported as HTTP 500 and now correctly report 503 by default. Custom status codes for other error scenarios can also be configured through the anypoint.platform.error.mapping (format NAMESPACE:IDENTIFIER:STATUS_CODE, comma-separated for multiple mappings) and anypoint.platform.error.default system properties.

W-23509148

API Gateway no longer fails to read shard checksums from an ETag header that contains commas.

W-23572494

The fix for idle connections being destroyed and recreated instead of reused when the number of idle connections reached the configured maxIdle limit under concurrent load, introduced in a previous release, is reverted in this release.

W-22716456

The jsoup library is upgraded to 1.23.1.

W-23715606

The Apache Commons Compress library is upgraded to 1.26.0.

W-3300013

The Jackson library is upgraded to 2.22.1.

W-23540335

The RAML Parser library is upgraded to 2-1.2.1.

W-23328350

The com.mulesoft.mule.runtime.gw.api.analytics package is now open to all modules, so the Runtime Manager agent can serialize analytics events.

W-23846531

DataWeave

You can now configure the size of the DataWeave script parser cache by using the mule.weave.script.parser.cache.size system property.

W-23138851

A thread-safety livelock no longer occurs in the Java module builder and converter caches.

W-23652160

Additional fixes for Government Cloud with FIPS 140-2

Worker TLS configuration for Government Cloud is strengthened.

W-23819316

TLS hostname verification no longer falls back to the certificate’s Common Name (CN) when a DNS Subject Alternative Name (SAN) isn’t present. The server hostname must now be included in the certificate’s DNS SAN. Otherwise, hostname verification fails and the TLS connection may be rejected with certificate_unknown(46).

W-23730329

Additional fixes for Government Cloud with FIPS 140-3

Worker TLS configuration for Government Cloud is strengthened.

W-23819316
## [](#august-4-2026)August 4, 2026 ### What’s New **4.12.2, 4.9.20, and 4.6.33 Runtime Updates** - Updated to the latest operating system security patches. **Runtime Manager agent versions included in Runtime 4.12.2, 4.9.20, and 4.6.33** This release of 4.12.2 and 4.9.20 includes Runtime Manager agent 2.8.3, and 4.6.33 includes Runtime Manager agent 2.7.18. For information, see [Runtime Manager Agent 2.8.3 Release Notes](https://docs.mulesoft.com/jp/release-notes/runtime-manager-agent/runtime-manager-agent-2.8.x-release-notes#2-8-3) and [Runtime Manager Agent 2.7.18 Release Notes](https://docs.mulesoft.com/jp/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-18). ### Fixed Issues **4.12.2 Runtime Updates** For Mule runtime 4.12.2, the image name that corresponds with this fix is 4.12.2:5e.
Issue Resolution ID

Mule

Lazy initialization no longer fails with a NullPointerException when an application using the VM connector’s publish operation also configures a global error handler.

W-23156632

Idle connections are no longer destroyed and recreated instead of being reused when the number of idle connections reaches the configured maxIdle limit under concurrent load.

W-22716456

An HTTP request client connecting through a proxy no longer hangs when the proxy responds with a 407 (Proxy Authentication Required) response during the CONNECT tunnel handshake.

W-23384719

The HTTP request client now sends a correctly formed request line when connecting through a forward proxy.

W-23384645

A NullPointerException no longer occurs when the HTTP request client reuses a pooled connection to a forward proxy.

W-23384744

HTTP/3 requests sent to an HTTP/1 server now correctly fail with a 505 (HTTP Version Not Supported) response.

W-23029577

Requests with a non-numeric Content-Length header are now rejected with a 400 (Bad Request) response.

W-23029480

A batch job no longer fails with a MULE:CANCELLED error during graceful shutdown.

W-23426859

Potential errors thrown during runtime shutdown are now handled correctly.

W-23051939

The Batch module now provides a public API to configure a custom queue manager and queue timeout.

W-23371797

When running in FIPS mode on a standalone server, the runtime now logs a warning at startup if the JVM java.security file isn’t configured with the required FIPS providers, instead of silently masking the misconfiguration.

W-22794711

The Sec-WebSocket-Protocol header is now forwarded on outbound WebSocket connections, so subprotocol negotiation with the server succeeds.

W-23071781

The Diagnostic Information Analysis File (DIAF) now includes network information.

W-22383655

The Diagnostic Information Analysis File (DIAF) now includes Mule agent information.

W-22383660

The Diagnostic Information Analysis File (DIAF) now includes a platform connectivity check.

W-22383679

The API Gateway resource cache is enabled by default. You can now disable it by setting the anypoint.platform.resource_cache_enabled system property to false.

W-23542185

The Jackson library is upgraded to 2.22.0.

W-23165634

DataWeave

The repeated attribute selector (.*@) now correctly preserves values when processing data structures containing empty map slots.

W-23457314

Type metadata processing now correctly handles sibling references that target the same type, preventing duplicate annotations.

W-23424037

DataWeave now handles Java Platform Module System (JPMS) access restrictions more gracefully when running on Java 17 and later in Mule runtime 4.6.0 and later.

W-23354139

The Jackson library is upgraded to 2.21.5.

W-23037592

The per_app_java_bean_cache compatibility flag now correctly reports its creation version as 2.9.

W-22417507
**4.9.20 Runtime Updates** For Mule runtime 4.9.20, the image name that corresponds with this fix is 4.9.20:6.
Issue Resolution ID

Mule

Idle connections are no longer destroyed and recreated instead of being reused when the number of idle connections reaches the configured maxIdle limit under concurrent load.

W-22716456

HTTP/3 requests sent to an HTTP/1 server now correctly fail with a 505 (HTTP Version Not Supported) response.

W-23029577

Requests with a non-numeric Content-Length header are now rejected with a 400 (Bad Request) response.

W-23029480

A batch job no longer fails with a MULE:CANCELLED error during graceful shutdown.

W-23426859

Potential errors thrown during runtime shutdown are now handled correctly.

W-23051939

When running in FIPS mode on a standalone server, the runtime now logs a warning at startup if the JVM java.security file isn’t configured with the required FIPS providers, instead of silently masking the misconfiguration.

W-22794711

The Diagnostic Information Analysis File (DIAF) now includes network information.

W-22383655

The Diagnostic Information Analysis File (DIAF) now includes Mule agent information.

W-22383660

The Diagnostic Information Analysis File (DIAF) now includes a platform connectivity check.

W-22383679

The API gateway resource cache is enabled by default. You can now disable it by setting the anypoint.platform.resource_cache_enabled system property to false.

W-23542185

The Jackson library is upgraded to 2.22.0.

W-23131090

DataWeave

The repeated attribute selector (.*@) now correctly preserves values when processing data structures containing empty map slots.

W-23457314

The Jackson library is upgraded to 2.21.5.

W-23037592

The per_app_java_bean_cache compatibility flag now correctly reports its creation version as 2.9.

W-22417507
**4.6.33 Runtime Updates** For Mule runtime 4.6.33, the image name that corresponds with this fix is 4.6.33:7.
Issue Resolution ID

Mule

Idle connections are no longer destroyed and recreated instead of being reused when the number of idle connections reaches the configured maxIdle limit under concurrent load.

W-22716456

A batch job no longer fails with a MULE:CANCELLED error during graceful shutdown.

W-23426859

Potential errors thrown during runtime shutdown are now handled correctly.

W-23051939

The Diagnostic Information Analysis File (DIAF) now includes network information.

W-22383655

The Diagnostic Information Analysis File (DIAF) now includes Mule agent information.

W-22383660

The Diagnostic Information Analysis File (DIAF) now includes a platform connectivity check.

W-22383679

The API gateway resource cache is enabled by default. You can now disable it by setting the anypoint.platform.resource_cache_enabled system property to false.

W-23542185

The Jackson library is upgraded to 2.22.0.

W-23121654

DataWeave

The repeated attribute selector (.*@) now correctly preserves values when processing data structures containing empty map slots.

W-23457314

The Jackson library is upgraded to 2.21.5.

W-23037592
## [](#july-7-2026)July 7, 2026 ### What’s New **4.12.1, 4.11.6, 4.9.19, and 4.6.32 Runtime Updates** - Updated to the latest operating system security patches. **Runtime Manager Agent versions included in Runtime 4.12.1, 4.11.6, 4.9.19, and 4.6.32** This release of 4.12.1, 4.11.6, 4.9.19, and 4.6.32 includes Runtime Manager Agent 2.7.16. For information, see [Runtime Manager Agent 2.7.16 Release Notes](https://docs.mulesoft.com/jp/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-16). ### Fixed Issues **4.12.1 Runtime Updates** For Mule runtime 4.12.1, the image name that corresponds with this fix is 4.12.1:4e.
Issue Resolution ID

Mule

Clustered applications deployed with two or more replicas no longer fail to start with a NullPointerException error during cluster node discovery.

W-22843942

Cluster node IDs are no longer generated with negative values.

W-22294724

Graceful shutdown no longer times out when a global error handler runs for a flow.

W-22434375

Long-running internal tasks no longer use the shared forkJoin pool during parallel flow shutdown and bootstrap configuration, preventing thread starvation.

W-22279521

Race conditions in outerFluxCompletionScheduler no longer occur during graceful shutdown.

W-22343018

Mule no longer hangs during shutdown when a parameter validation exception occurs during flow execution.

W-22248534

Connectivity testing of configurations in clustered deployments no longer uses distributed locks, preventing deadlocks.

W-22248198

Fatal errors such as StackOverflowError are now logged instead of being consumed by internal error handling.

W-22496803

Object Store retrieved from the registry in OAuthHandler is now properly initialized and started.

W-22373641

SDK parameter validation errors now raise the MULE:VALIDATION error type instead of MULE:UNKNOWN.

W-22276522

ConcurrentModificationException errors no longer occur when multiple plugins with shared dependencies are deployed simultaneously.

W-21193046

The error type in the EE cache scope is now correctly reported as MULE:RETRY_EXHAUSTED instead of EE:RETRY_EXHAUSTED when until-successful exhausts its retries.

W-21525972

Test Connection for the HTTP listener now correctly reports a failure when an unresolvable hostname is configured in the host field.

W-21921687

HTTP Server now supports upgrade requests to h2c even when the request contains a non-empty body.

W-22506085

Duplicate XSD elements are no longer generated for connection providers declared at both the extension and configuration levels.

W-20824537

Shutdown validation for dynamic configurations can now be skipped by enabling the mule.forcefulShutdown.dynamicConfig.disableStoppingCheck system property.

W-22772644

Flows with a scheduler source are no longer left in an invalid state after a flow restart.

W-22918240

Stopping a flow no longer waits unnecessarily when no events are being processed.

W-22969411

Project versions defined with properties are now resolved recursively.

W-22845430

Extension packager validation no longer fails for operations annotated with @Validator that use a CompletionCallback operation.

W-22817376

Events that are dropped within a processing hook are now properly completed and terminated.

W-22470584

In-memory Object Store partitions are now created correctly when an application is deployed to a cluster with the Object Store plugin enabled.

W-17714668

Deserialization errors no longer occur in the Object Store during a runtime patch upgrade.

W-20880559

Applications deployed with a serialized AST now include all Mule error types in the error type repository.

W-22399271

Applications that use HTTP request attributes no longer fail annotation processing due to default constructor validation.

W-22385620

The Netty HTTP listener now rejects HTTP/1.1 requests that have a missing or duplicate host header, in compliance with RFC 9112.

W-23052713

The maximum size of the dynamic flow-ref cache is now configurable through the mule.flowRef.dynamicCacheMaxSize system property, which defaults to 20.

W-22219018

API Gateway contract persistence can now be disabled by setting the anypoint.platform.contracts_persistence_enabled system property to false, avoiding errors when persisting large numbers of contracts.

W-22568982

Large Anypoint Platform authentication failure responses no longer cause excessive log bloat.

W-21882516

SDK sources that don’t implement Reconnectable are no longer restarted during graceful shutdown.

W-21563258

OpenTelemetry flow statistics now report metrics correctly for applications with more than one flow.

W-23051614

The artifact type (domain, policy, or application) is now included as an OpenTelemetry resource attribute.

W-21768636

OpenTelemetry metric attribute names now use a consistent notation.

W-21921584

The mule.openTelemetry.logging.exporter.resource.container.service.name system property is now available to set the service name that the Mule container reports for OpenTelemetry telemetry.

W-22861497

Event dumps now include a state for events that are waiting on a non-blocking operation.

W-22142952

The Netty library is upgraded to 4.2.15.Final.

W-22831076

The c3p0 library is upgraded to 0.14.1.

W-22990155

The Bitronix Transaction Manager library is upgraded to 3.0.2.

W-22405007

The Reactor Netty library is upgraded to 1.3.6.

W-3300013

The Jackson Core library is upgraded to 2.21.1.

W-22839747

The Apache Neethi library is upgraded to 3.2.1.

W-22839752

The OpenTelemetry API library is upgraded to 1.62.0.

W-22849469

The Spring Framework is upgraded to 6.2.19.

W-22939417

Concurrent polling sources no longer fail with ConcurrentModificationException when creating Cloud Object Store partitions during application startup.

W-22809694

DataWeave

Scope resolution errors no longer occur when importing Java classes with self-referential array properties.

W-22914494

StackOverflowError errors no longer occur when computing or converting type metadata for self-referencing recursive types.

W-21712344
**4.11.6 Runtime Updates** For Mule runtime 4.11.6, the image name that corresponds with this fix is 4.11.6:4e.
Issue Resolution ID

Mule

Cluster node IDs are no longer generated with negative values.

W-22294724

Graceful shutdown no longer times out when a global error handler runs for a flow.

W-22434375

Long-running internal tasks no longer use the shared forkJoin pool during parallel flow shutdown and bootstrap configuration, preventing thread starvation.

W-22279521

Duplicate XSD elements are no longer generated for connection providers declared at both the extension and configuration levels.

W-20824537

Shutdown validation for dynamic configurations can now be skipped by enabling the mule.forcefulShutdown.dynamicConfig.disableStoppingCheck system property.

W-22772644

Flows with a scheduler source are no longer left in an invalid state after a flow restart.

W-22918240

Stopping a flow no longer waits unnecessarily when no events are being processed.

W-22969411

Project versions defined with properties are now resolved recursively.

W-22845430

Extension packager validation no longer fails for operations annotated with @Validator that use a CompletionCallback operation.

W-22817376

Events that are dropped within a processing hook are now properly completed and terminated.

W-22470584

The Netty HTTP listener now rejects HTTP/1.1 requests that have a missing or duplicate host header, in compliance with RFC 9112.

W-23052713

The maximum size of the dynamic flow-ref cache is now configurable through the mule.flowRef.dynamicCacheMaxSize system property, which defaults to 20.

W-22219018

API Gateway contract persistence can now be disabled by setting the anypoint.platform.contracts_persistence_enabled system property to false, avoiding errors when persisting large numbers of contracts.

W-22568982

The c3p0 library is upgraded to 0.14.1.

W-22990152

The Spring Framework is upgraded to 6.2.19.

W-3300013

The Bitronix Transaction Manager library is upgraded to 3.0.2.

W-22405007

The OpenTelemetry API library is upgraded to 1.62.0.

W-22806044

The Netty library is upgraded to 4.2.15.Final.

W-22888966

The Reactor Netty library is upgraded to 1.3.6.

W-22939412

Concurrent polling sources no longer fail with ConcurrentModificationException when creating Cloud Object Store partitions during application startup.

W-22809694

DataWeave

Scope resolution errors no longer occur when importing Java classes with self-referential array properties.

W-22914494

AvroReader no longer causes memory leaks when processing Avro data in long-running flows.

W-22364385
**4.9.19 Runtime Updates** For Mule runtime 4.9.19, the image name that corresponds with this fix is 4.9.19:8.
Issue Resolution ID

Mule

Cluster node IDs are no longer generated with negative values.

W-22294724

Graceful shutdown no longer times out when a global error handler runs for a flow.

W-22434375

Long-running internal tasks no longer use the shared forkJoin pool during parallel flow shutdown and bootstrap configuration, preventing thread starvation.

W-22279521

Duplicate XSD elements are no longer generated for connection providers declared at both the extension and configuration levels.

W-20824537

Shutdown validation for dynamic configurations can now be skipped by enabling the mule.forcefulShutdown.dynamicConfig.disableStoppingCheck system property.

W-22772644

Flows with a scheduler source are no longer left in an invalid state after a flow restart.

W-22918240

Stopping a flow no longer waits unnecessarily when no events are being processed.

W-22969411

Project versions defined with properties are now resolved recursively.

W-22845430

Extension packager validation no longer fails for operations annotated with @Validator that use a CompletionCallback operation.

W-22817376

Events that are dropped within a processing hook are now properly completed and terminated.

W-22470584

The Netty HTTP listener now rejects HTTP/1.1 requests that have a missing or duplicate Host header, in compliance with RFC 9112.

W-23052713

The Content-Length header is now removed based on the actual entity byte length.

W-22570070

SDK sources that don’t implement Reconnectable are no longer restarted during graceful shutdown.

W-21563258

The maximum size of the dynamic flow-ref cache is now configurable through the mule.flowRef.dynamicCacheMaxSize system property, which defaults to 20.

W-22219018

The Jackson Databind library is upgraded to 2.21.4.

W-3300013

The OpenTelemetry API library is upgraded to 1.62.0.

W-22806027

The c3p0 library is upgraded to 0.14.1.

W-23012713

The Apache Neethi library is upgraded to 3.2.1.

W-22939389

The Apache CXF library is upgraded to 3.6.11.

W-23037617

The Rhino library is upgraded to 1.8.1.

W-22939391

The Log4j library is upgraded to 2.25.4.

W-22939403

The Reactor Netty library is upgraded to 1.2.18.

W-22939384

The Spring Framework is upgraded to 6.2.19.

W-22956997

The Netty library is upgraded to 4.2.15.Final.

W-22956998

The Bitronix Transaction Manager library is upgraded to 2.1.21.

W-22405007

Concurrent polling sources no longer fail with ConcurrentModificationException when creating Cloud Object Store partitions during application startup.

W-22809694

DataWeave

Scope resolution errors no longer occur when importing Java classes with self-referential array properties.

W-22914494

AvroReader no longer causes memory leaks when processing Avro data in long-running flows.

W-22364385
**4.6.32 Runtime Updates** For Mule runtime 4.6.32, the image name that corresponds with this fix is 4.6.32:4.
Issue Resolution ID

Mule

A NullPointerException error no longer occurs in event context handling when a flow times out while a non-blocking operation is still in flight.

W-22902839

Cluster node IDs are no longer generated with negative values.

W-22294724

Graceful shutdown no longer times out when a global error handler runs for a flow.

W-22434375

Long-running internal tasks no longer use the shared forkJoin pool during parallel flow shutdown and bootstrap configuration, preventing thread starvation.

W-22279521

Duplicate XSD elements are no longer generated for connection providers declared at both the extension and configuration levels.

W-20824537

Shutdown validation for dynamic configurations can now be skipped by enabling the mule.forcefulShutdown.dynamicConfig.disableStoppingCheck system property.

W-22772644

Flows with a scheduler source are no longer left in an invalid state after a flow restart.

W-22918240

Stopping a flow no longer waits unnecessarily when no events are being processed.

W-22969411

Project versions defined with properties are now resolved recursively.

W-22845430

Extension packager validation no longer fails for operations annotated with @Validator that use a CompletionCallback operation.

W-22817376

The Netty HTTP listener now rejects HTTP/1.1 requests that have a missing or duplicate Host header, in compliance with RFC 9112.

W-23052713

SDK sources that don’t implement Reconnectable are no longer restarted during graceful shutdown.

W-21563258

The maximum size of the dynamic flow-ref cache is now configurable through the mule.flowRef.dynamicCacheMaxSize system property, which defaults to 20.

W-22219018

Sensitive headers are no longer forwarded when an HTTP request is redirected to a different host. This can be configured with FILTER_SENSITIVE_HEADERS_ON_REDIRECT.

W-21045658

API Gateway contract persistence can now be disabled by setting the anypoint.platform.contracts_persistence_enabled system property to false, avoiding errors when persisting large numbers of contracts.

W-22568982

The Joda-Time library is upgraded to 2.13.0.

W-3300013

The Rhino library is upgraded to 1.7.15.1.

W-22805996

The Apache Neethi library is upgraded to 3.2.1.

W-22805997

The OpenTelemetry API library is upgraded to 1.62.0.

W-22806011

The Apache CXF library is upgraded to 3.5.11.

W-23037585

The c3p0 library is upgraded to 0.14.1.

W-23012711

The Bitronix Transaction Manager library is upgraded to 2.1.21.

W-22405007

Concurrent polling sources no longer fail with ConcurrentModificationException when creating Cloud Object Store partitions during application startup.

W-22809694

DataWeave

Scope resolution errors no longer occur when importing Java classes with self-referential array properties.

W-22914494

The Java bean metadata cache no longer performs unnecessary evictions when processing Java POJOs. A new per-app Java bean cache can be enabled with the per_app_java_bean_cache compatibility flag.

W-22417507
## [](#june-18-2026)June 18, 2026
Update for image 4.9.18:1-fips1403 applies to Government Cloud only.
### What’s New **4.9.18 Runtime Updates** For Mule runtime 4.9.18, the image name that corresponds with this release is 4.9.18:1-fips1403. The patch update now supports FIPS 140-3 compliance. ## [](#june-2-2026)June 2, 2026 ### What’s New - Mule runtime engine 4.12.0 is now available. For information about the release notes, see [Mule Runtime Engine 4.12.0 Release Notes](https://docs.mulesoft.com/jp/release-notes/mule-runtime/mule-4.12.0-release-notes). For information about the new release cadence, see [Edge and LTS Releases for Mule](https://docs.mulesoft.com/jp/release-notes/mule-runtime/lts-edge-release-cadence). **4.12.0, 4.11.5, 4.9.18, and 4.6.31 Runtime Updates** - Updated to the latest operating system security patches. **Runtime Manager Agent versions included in Runtime 4.12.0, 4.11.5, 4.9.18, and 4.6.31** This release of 4.12.0, 4.11.5, 4.9.18, and 4.6.31 includes Runtime Manager Agent 2.7.15. For information, see [Runtime Manager Agent 2.7.15 Release Notes](https://docs.mulesoft.com/jp/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-15). ### Fixed Issues **4.12.0 Runtime Updates** For Mule runtime 4.12.0, the image name that corresponds with this fix is 4.12.0:10e.
Issue Resolution ID

Mule

Upstream HTTP requests are now cancelled when a downstream client disconnects, preventing unnecessary data transfer.

W-20084343

The Netty HTTP client no longer throws NullPointerException when handling Expect 100-Continue responses.

W-21513490

Sensitive headers are no longer forwarded when an HTTP request is redirected to a different host. This can be configured with FILTER_SENSITIVE_HEADERS_ON_REDIRECT.

W-21045658

The Apache CXF library is upgraded to 3.6.8.

W-20541600

Cluster encryption now uses the configured algorithm correctly instead of defaulting to Blowfish.

W-21666905

Race conditions during policy redeployment that caused Mule to stop processing events permanently no longer occur.

W-22343705

Redelivery policy logging now includes additional context for troubleshooting.

W-20636028

The Tanuki Java Service Wrapper is upgraded to 3.6.4.

W-17051070

The RAML parser is upgraded to 1.1.10.

W-21768014

The OpenTelemetry SDK is upgraded to 1.60.1.

W-21808539

Persistent ObjectStore or Batch data serialized before a patch upgrade now deserializes correctly after upgrading.

W-22623626

OutOfMemory errors no longer occur when establishing SSL connections with HTTP endpoints.

W-22547971

DataWeave

DataWeave now supports the private modifier on fun, var, ns, and type declarations to hide them from importers.

W-21148967

internal is no longer a reserved word and can now be used as an identifier in DataWeave scripts.

W-21508044

The compiler now reports an error when overloads of the same function declare different visibility modifiers.

W-21362539

StackOverflowError no longer occurs in the type checker when resolving intersections of unbound type parameters.

W-20124753

Runtime errors no longer occur when invoking overloaded functions across modules.

W-21811015

Spurious type-check errors no longer occur when an optional key-value pair is assigned to a required one.

W-21351058

deferred values passed to the write function now terminate correctly.

W-20925604

Out-of-memory errors no longer occur when reading large text or CDATA sections with the indexed XML reader.

W-21006104

The Java module bean introspection cache no longer causes memory leaks.

W-22419118
**4.11.5 Runtime Updates** For Mule runtime 4.11.5, the image name that corresponds with this fix is 4.11.5:4e.
Issue Resolution ID

Mule

Connectivity testing of configurations in clustered deployments no longer uses distributed locks, preventing deadlocks.

W-22248198

Fatal errors such as StackOverflowError are now logged instead of being consumed by internal error handling.

W-22496803

Mule no longer hangs during shutdown when a parameter validation exception occurs during flow execution.

W-22248534

Race conditions in outerFluxCompletionScheduler no longer occur during graceful shutdown.

W-22343018

The ObjectStore retrieved from the Registry in OAuthHandler is now properly initialized and started.

W-22373641

SDK parameter validation errors now raise the MULE:VALIDATION error type instead of MULE:UNKNOWN.

W-22276522

Race conditions during policy redeployment that caused Mule to stop processing events permanently no longer occur.

W-22343705

ConcurrentModificationException errors no longer occur when multiple plugins with shared dependencies are deployed simultaneously.

W-21193046

Cluster encryption now uses the configured algorithm correctly instead of defaulting to Blowfish.

W-21666905

The error type in the EE Cache scope is now correctly reported as MULE:RETRY_EXHAUSTED instead of EE:RETRY_EXHAUSTED when until-successful exhausts its retries.

W-21525972

Large Anypoint Platform authentication failure responses no longer cause excessive log bloat.

W-21882516

HTTP Server now supports Upgrade requests to h2c even when the request contains a non-empty body.

W-22506085

Test Connection for The HTTP listener now correctly reports a failure when an unresolvable hostname is configured in the Host field.

W-21921687

The Spring Core library is upgraded to 6.2.18.

W-22169898

Persistent ObjectStore or Batch data serialized before a patch upgrade now deserializes correctly after upgrading.

W-22623626

OutOfMemory errors no longer occur when establishing SSL connections with HTTP endpoints.

W-22547971

DataWeave

StackOverflowError errors no longer occur when computing or converting type metadata for self-referencing recursive types.

W-21712344

The Java bean metadata cache no longer performs unnecessary evictions when processing Java POJOs. A new per-app Java bean cache can be enabled with the per_app_java_bean_cache compatibility flag.

W-22417507

The Java module bean introspection cache no longer causes memory leaks.

W-22419118
**4.9.18 Runtime Updates** For Mule runtime 4.9.18, the image name that corresponds with this fix is 4.9.18:3.
Issue Resolution ID

Mule

Connectivity testing of configurations in clustered deployments no longer uses distributed locks, preventing deadlocks.

W-22248198

Fatal errors such as StackOverflowError are now logged instead of being consumed by internal error handling.

W-22496803

Mule no longer hangs during shutdown when a parameter validation exception occurs during flow execution.

W-22248534

Race conditions in outerFluxCompletionScheduler no longer occur during graceful shutdown.

W-22343018

The ObjectStore retrieved from the Registry in OAuthHandler is now properly initialized and started.

W-22373641

SDK parameter validation errors now raise the MULE:VALIDATION error type instead of MULE:UNKNOWN.

W-22276522

Race conditions during policy redeployment that caused Mule to stop processing events permanently no longer occur.

W-22343705

ConcurrentModificationException errors no longer occur when multiple plugins with shared dependencies are deployed simultaneously.

W-21193046

Cluster encryption now uses the configured algorithm correctly instead of defaulting to Blowfish.

W-21666905

The error type in the EE Cache scope is now correctly reported as MULE:RETRY_EXHAUSTED instead of EE:RETRY_EXHAUSTED when until-successful exhausts its retries.

W-21525972

Large Anypoint Platform authentication failure responses no longer cause excessive log bloat.

W-21882516

Persistent ObjectStore or Batch data serialized before a patch upgrade now deserializes correctly after upgrading.

W-22623626

OutOfMemory errors no longer occur when establishing SSL connections with HTTP endpoints.

W-22547971

DataWeave

StackOverflowError errors no longer occur when computing or converting type metadata for self-referencing recursive types.

W-21712344

The Java bean metadata cache no longer performs unnecessary evictions when processing Java POJOs. A new per-app Java bean cache can be enabled with the per_app_java_bean_cache compatibility flag.

W-22417507
**4.6.31 Runtime Updates** For Mule runtime 4.6.31, the image name that corresponds with this fix is 4.6.31:3.
Issue Resolution ID

Mule

Connectivity testing of configurations in clustered deployments no longer uses distributed locks, preventing deadlocks.

W-22248198

Fatal errors such as StackOverflowError are now logged instead of being consumed by internal error handling.

W-22496803

Mule no longer hangs during shutdown when a parameter validation exception occurs during flow execution.

W-22248534

Race conditions in outerFluxCompletionScheduler no longer occur during graceful shutdown.

W-22343018

The ObjectStore retrieved from the Registry in OAuthHandler is now properly initialized and started.

W-22373641

SDK parameter validation errors now raise the MULE:VALIDATION error type instead of MULE:UNKNOWN.

W-22276522

Race conditions during policy redeployment that caused Mule to stop processing events permanently no longer occur.

W-22343705

ConcurrentModificationException errors no longer occur when multiple plugins with shared dependencies are deployed simultaneously.

W-21193046

Cluster encryption now uses the configured algorithm correctly instead of defaulting to Blowfish.

W-21666905

The error type in the EE Cache scope is now correctly reported as MULE:RETRY_EXHAUSTED instead of EE:RETRY_EXHAUSTED when until-successful exhausts its retries.

W-21525972

Large Anypoint Platform authentication failure responses no longer cause excessive log bloat.

W-21882516

In-memory Object Store partitions now correctly use cluster-wide storage when deployed to a cluster with the Object Store plugin enabled.

W-17714668

Persistent ObjectStore or Batch data serialized before a patch upgrade now deserializes correctly after upgrading.

W-22623626

OutOfMemory errors no longer occur when establishing SSL connections with HTTP endpoints.

W-22547971

DataWeave

The Java bean metadata cache no longer performs unnecessary evictions when processing Java POJOs. A new per-app Java bean cache can be enabled with the per_app_java_bean_cache compatibility flag.

W-22417507
## [](#may-19-2026)May 19, 2026 The May 19 patch update for Mule versions 4.11.4, 4.10.5, 4.9.17, and 4.6.30 addresses a regression in the May 5 patch update. This patch includes all fixes from May 5 patch. ### Fixed Issues **4.11.4 Runtime Updates** For Mule runtime 4.11.4, the image name that corresponds with these fixes is 4.11.4:5e.
Issue Resolution ID

Workers running Edge Mule runtime versions on non-micro instance sizes now correctly allocate JVM heap memory.

W-22534602
**4.10.5 Runtime Updates** For Mule runtime 4.10.5, the image name that corresponds with these fixes is 4.10.5:8e.
Issue Resolution ID

Workers running Edge Mule runtime versions on non-micro instance sizes now correctly allocate JVM heap memory.

W-22534602
**4.9.17 Runtime Updates** For Mule runtime 4.9.17, the image name that corresponds with these fixes is 4.9.17:5.
Issue Resolution ID

Incoming header names no longer use strict CRLF validation when an HTTP configuration without a listener receives an HTTPS request, avoiding out-of-memory errors. In this scenario, Mule logs a warning entry in mule_ee.log, but the warning doesn’t affect application behavior.

W-22571733
**4.6.30 Runtime Updates** For Mule runtime 4.6.30, the image name that corresponds with these fixes is 4.6.30:5.
Issue Resolution ID

Incoming header names no longer use strict CRLF validation when an HTTP configuration without a listener receives an HTTPS request, avoiding out-of-memory errors. In this scenario, Mule logs a warning entry in mule_ee.log, but the warning doesn’t affect application behavior.

W-22571733
## [](#may-5-2026)May 5, 2026 ### What’s New **4.6, 4.9, and 4.11 Runtime Updates** - Updated to the latest operating system security patches. **Runtime Manager Agent versions included in Runtime 4.6.30, 4.9.17, and 4.11.4** This release of 4.6.30, 4.9.17, and 4.11.4 includes Runtime Manager Agent 2.7.13. For information, see [Runtime Manager Agent 2.7.13 Release Notes](https://docs.mulesoft.com/jp/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-13). ### Fixed Issues **4.11.4 Runtime Updates** For Mule runtime 4.11.4, the image name that corresponds with this fix is 4.11.4:4e.
Issue Resolution ID

Mule

Configuration references to configs defined in a parent domain are now properly validated at deployment time, preventing unclear runtime errors.

W-11453332

Extension operations using @Content parameters with complex map structures no longer fail to deploy.

W-18034452

The Grizzly HTTP library is upgraded to 2.3.36-MULE-029.

W-21337433

Netty HTTP client NTLM authentication no longer fails due to missing TCP connection affinity during the handshake.

W-21615520

The plexus-utils library is upgraded to 4.0.3.

W-21774430

The HTTP listener now gracefully handles non-RFC-compliant date formats in Set-Cookie Expires attributes.

W-21860840

The Netty library is upgraded to 4.2.12.Final.

W-21913252

HTTP 304 (Not Modified) responses sent through the HTTP listener no longer include an incorrect Content-Length header.

W-21632770

Netty HTTP client no longer sends an incorrect WWW-Authenticate header during the NTLM authentication handshake.

W-21762949

In-memory Object Store partitions now correctly use cluster-wide storage when deployed to a cluster with the Object Store plugin enabled.

W-17714668

A memory leak in dynamic flow-ref resolution that could eventually lead to an OutOfMemoryError no longer occurs.

W-22013292

Deserialization errors no longer occur in Redis-backed Object Stores when accessing cached data created on an earlier Mule runtime version.

W-20880559

A serialization error that could occur when deserializing data after a Mule runtime upgrade no longer occurs.

W-21951097

API Gateway contracts for public OAuth clients using PKCE are no longer dropped when the client secret is null.

W-21177224

The support-tools-installer is removed from the Mule runtime distribution.

W-21842339

DataWeave

atBeginningOfDay now returns the midnight offset on DST days, instead of the input offset.

W-21614817
**4.9.17 Runtime Updates** For Mule runtime 4.9.17, the image name that corresponds with this fix is 4.9.17:4.
Issue Resolution ID

Mule

Configuration references to configs defined in a parent domain are now properly validated at deployment time, preventing unclear runtime errors.

W-11453332

Extension operations using @Content parameters with complex map structures no longer fail to deploy.

W-18034452

The Grizzly HTTP library is upgraded to 2.3.36-MULE-029.

W-21337433

The plexus-utils library is upgraded to 4.0.3.

W-21774430

HTTP 304 (Not Modified) responses sent through the HTTP listener no longer include an incorrect Content-Length header.

W-21632770

The HTTP listener now gracefully handles non-RFC-compliant date formats in Set-Cookie Expires attributes.

W-21860840

The Netty library is upgraded to 4.2.12.Final.

W-21795152

In-memory Object Store partitions now correctly use cluster-wide storage when deployed to a cluster with the Object Store plugin enabled.

W-17714668

A memory leak in dynamic flow-ref resolution that could eventually lead to an OutOfMemoryError no longer occurs.

W-22013292

Deserialization errors no longer occur in Redis-backed Object Stores when accessing cached data created on an earlier Mule runtime version.

W-20880559

API Gateway contracts for public OAuth clients using PKCE are no longer dropped when the client secret is null.

W-21177224

The support-tools-installer is removed from the Mule runtime distribution.

W-21842339

DataWeave

atBeginningOfDay now returns the midnight offset on DST days, instead of the input offset.

W-21614817
**4.6.30 Runtime Updates** For Mule runtime 4.6.30, the image name that corresponds with this fix is 4.6.30:4.
Issue Resolution ID

Mule

Configuration references to configs defined in a parent domain are now properly validated at deployment time, preventing unclear runtime errors.

W-11453332

Extension operations using @Content parameters with complex map structures no longer fail to deploy.

W-18034452

The Grizzly HTTP library is upgraded to 2.3.36-MULE-029.

W-21337433

The plexus-utils library is upgraded to 4.0.3.

W-21774430

A memory leak in dynamic flow-ref resolution that could eventually lead to an OutOfMemoryError no longer occurs.

W-22013292

Deserialization errors no longer occur in Redis-backed Object Stores when accessing cached data created on an earlier Mule runtime version.

W-20880559

API Gateway contracts for public OAuth clients using PKCE are no longer dropped when the client secret is null.

W-21177224

The support-tools-installer is removed from the Mule runtime distribution.

W-21842339

DataWeave

atBeginningOfDay now returns the midnight offset on DST days, instead of the input offset.

W-21614817
## [](#april-7-2026)April 7, 2026 ### What’s New **4.6, 4.9, and 4.11 Runtime Updates** - Updated to the latest operating system security patches. **Runtime Manager Agent versions included in Runtime 4.6.29, 4.9.16, and 4.11.3** This release of 4.6.29, 4.9.16, and 4.11.3 includes Runtime Manager Agent 2.7.11. For information, see [Runtime Manager Agent 2.7.11 Release Notes](https://docs.mulesoft.com/jp/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-11). ### Fixed Issues **4.11.3 Runtime Updates** For Mule runtime 4.11.3, the image name that corresponds with this fix is 4.11.3:4e.
Issue Resolution ID

Mule

The c3p0 library is upgraded to 0.12.0.

W-21391116

The mchange-commons-java library is upgraded to 0.4.0.

W-21391115

NullPointerException errors no longer occur in the Log4j boot configuration during application shutdown when shutdown callbacks are canceled while the Log4j context factory is disposing, which previously caused failures due to concurrent execution of dispose() and cancel().

W-20256082

Until Successful scopes no longer continue retrying during application shutdown when using flow-ref.

W-20267296

NullPointerException: No Context at location errors no longer occur when using operation policies with routers or scopes.

W-20791354

OAuth token storage now correctly uses custom ObjectStores (such as Redis) configured through the Object Store parameter when they’re registered in the application registry instead of the ObjectStoreManager.

W-19811593

Exception reached subscriber errors no longer occur when combining interceptors and operation policies.

W-21250126

Scheduler jobs no longer deadlock during flow shutdown.

W-21263748

TLS Context can now be initialized during application deployment by using the mule.enable.inline.tls.context.initialization feature flag.

W-20038933

OpenTelemetry Direct streaming now supports FIPS-compatible keystore format.

W-20623905

A warning now appears when an OpenTelemetry property is incorrectly used as a deployment property.

W-21018072

NullPointerException errors no longer occur in message processor chain alerting when reporting dropped errors or events if alerting support isn’t found for the current classloader. When alerting support isn’t available, the hooks now skip the alert and log the condition instead of invoking it on a null reference.

W-20192960

Netty no longer attempts to send more bytes than specified in the Content-Length header.

W-21184863

Netty server read timeouts now consider requests being read instead of requests being processed.

W-21321115

Netty HTTP Client no longer throws exceptions when a proxy server returns a 407 response and now returns the 407 response instead.

W-21465366

Netty response timeout behavior is now consistent with Grizzly.

W-21547186

Netty TLS connection failures now appear as DEBUG logs instead of WARN logs.

W-21428392

Netty HTTP Client now filters duplicate Content-Type headers.

W-21344116

The exception raised by Netty for unresolved addresses is now consistent with the Grizzly implementation.

W-21515340

HTTP Netty implementation performance is now improved.

W-20969515

HTTP Server no longer logs an error when a client closes an idle keep-alive connection.

W-21431822

DataWeave

The Avro library is upgraded to 1.12.1. The Jackson Core library is upgraded to 2.21.1.

W-21415439

The Jakarta Mail library is upgraded to 2.1.5.

W-21320250

The range operator now returns null for invalid ranges.

W-21781423
**4.9.16 Runtime Updates** For Mule runtime 4.9.16, the image name that corresponds with this fix is 4.9.16:4.
Issue Resolution ID

Mule

The c3p0 library is upgraded to 0.12.0.

W-21391116

The mchange-commons-java library is upgraded to 0.4.0.

W-21391115

The Jackson Core library is upgraded to 2.18.6.

W-21420104

NullPointerException errors no longer occur in the Log4j boot configuration during application shutdown when shutdown callbacks are canceled while the Log4j context factory is disposing, which previously caused failures due to concurrent execution of dispose() and cancel().

W-20256082

Until Successful scopes no longer continue retrying during application shutdown when using flow-ref.

W-20267296

NullPointerException: No Context at location errors no longer occur when using operation policies with routers or scopes.

W-20791354

OAuth token storage now correctly uses custom ObjectStores (such as Redis) configured through the Object Store parameter when they’re registered in the application registry instead of the ObjectStoreManager.

W-19811593

Exception reached subscriber errors no longer occur when combining interceptors and operation policies.

W-21250126

Scheduler jobs no longer deadlock during flow shutdown.

W-21263748

TLS Context can now be initialized during application deployment by using the mule.enable.inline.tls.context.initialization feature flag.

W-20038933

Netty no longer attempts to send more bytes than specified in the Content-Length header.

W-21184863

Netty server read timeouts now consider requests being read instead of requests being processed.

W-21321115

Netty HTTP Client no longer throws exceptions when a proxy server returns a 407 response and now returns the 407 response instead.

W-21465366

Netty response timeout behavior is now consistent with Grizzly.

W-21547186

Netty TLS connection failures now appear as DEBUG logs instead of WARN logs.

W-21428392

Netty HTTP Client now filters duplicate Content-Type headers.

W-21344116

The exception raised by Netty for unresolved addresses is now consistent with the Grizzly implementation.

W-21515340

DataWeave

The Avro library is upgraded to 1.12.1. The Jackson Core library is upgraded to 2.21.1.

W-21415439

The Jakarta Mail library is upgraded to 2.1.5.

W-21320250

The range operator now returns null for invalid ranges.

W-21781423
**4.6.29 Runtime Updates** For Mule runtime 4.6.29, the image name that corresponds with this fix is 4.6.29:6.
Issue Resolution ID

Mule

The c3p0 library is upgraded to 0.12.0.

W-21391116

The mchange-commons-java library is upgraded to 0.4.0.

W-21391115

NullPointerException errors no longer occur in the Log4j boot configuration during application shutdown when shutdown callbacks are canceled while the Log4j context factory is disposing, which previously caused failures due to concurrent execution of dispose() and cancel().

W-20256082

Until Successful scopes no longer continue retrying during application shutdown when using flow-ref.

W-20267296

NullPointerException: No Context at location errors no longer occur when using operation policies with routers or scopes.

W-20791354

OAuth token storage now correctly uses custom ObjectStores (such as Redis) configured through the Object Store parameter when they’re registered in the application registry instead of the ObjectStoreManager.

W-19811593

Exception reached subscriber errors no longer occur when combining interceptors and operation policies.

W-21250126

Scheduler jobs no longer deadlock during flow shutdown.

W-21263748

TLS Context can now be initialized during application deployment by using the mule.enable.inline.tls.context.initialization feature flag.

W-20038933

DataWeave

The Avro library is upgraded to 1.12.1. The Jackson Core library is upgraded to 2.21.1.

W-21415439

The Jakarta Mail library is upgraded to 2.1.5.

W-21320250

The range operator now returns null for invalid ranges.

W-21781423
## [](#march-3-2026)March 3, 2026 ### What’s New **4.6, 4.9, 4.10, and 4.11 Runtime Updates** - Updated to the latest operating system security patches. **Runtime Manager Agent versions included in Runtime 4.6.28, 4.9.15, 4.10.5, and 4.11.2** This release of 4.6.28, 4.9.15, 4.10.5, and 4.11.2 includes Runtime Manager Agent 2.7.10. For information, see [Runtime Manager Agent 2.7.10 Release Notes](https://docs.mulesoft.com/jp/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-10). ### Fixed Issues **4.11.2 Runtime Updates** For Mule runtime 4.11.2, the image name that corresponds with this fix is 4.11.2:3e.
Issue Resolution ID

Mule

When the mule.forcefulShutdown.dynamicConfig.disableStoppingCheck system property is enabled, the dynamic configuration check is disabled during graceful shutdown.

W-20890587

When the mule.forcefulShutdown.raiseCancelledError feature flag is enabled, Mule runtime now raises a MULE:CANCELLED error instead of a MULE:UNKNOWN error if it attempts to create a dynamic configuration during shutdown.

W-20890613

Extensions no longer export mule-sdk-api and jakarta dependencies in the mule-artifact.json file.

W-21001749

Client certificates (optional) are no longer requested when no trust store is configured.

W-21220031

Public flows now stop concurrently during graceful shutdown.

W-21228085

Deadlocks no longer occur during log reconfiguration when policies are applied.

W-21231834

When the mule.enableLogEventDumpOnShutdown system property is enabled, the event dump is now logged during application shutdown.

W-21232374

XSD validations are now enabled by default during deployment.

W-21139633

Errors that are not MessagingException errors are no longer silenced.

W-21043969

The reactor.netty.version library is upgraded to 1.3.2.

W-3300013

When the mule.propagate.objectStore.customization.to.policies feature flag is enabled, policies now respect their configured TTL when using Object Store v2.

W-21215761

The "java.lang.IllegalStateException: The client must be started before use." error no longer occurs when requesting an OAuth access token.

W-17689958

The "API is blocked (unavailable)" log message no longer appears during policy updates without a corresponding unblocked message.

W-20633888

APIkit flows that use non-default names and are mapped through the flow-mapping parameter on apikit:config are now correctly counted as public flows instead of being treated as private.

W-18668900

DataWeave

The Array range selector operator no longer experiences performance degradation.

W-20220578

Concurrent access to KeyValuePairs inside lazy materialized objects no longer causes unexpected behavior.

W-21045501

The Mapping Editor API now supports attributes in Anypoint Code Builder.

W-20662336

Updating the expression model in the Mapping Editor API now works correctly.

W-20611263
**4.10.5 Runtime Updates** For Mule runtime 4.10.5, the image name that corresponds with this fix is 4.10.5:2e.
Issue Resolution ID

Mule

When the mule.forcefulShutdown.dynamicConfig.disableStoppingCheck system property is enabled, the dynamic configuration check is disabled during graceful shutdown.

W-20890587

When the mule.forcefulShutdown.raiseCancelledError feature flag is enabled, Mule runtime now raises a MULE:CANCELLED error instead of a MULE:UNKNOWN error if it attempts to create a dynamic configuration during shutdown.

W-20890613

Extensions no longer export mule-sdk-api and jakarta dependencies in the mule-artifact.json file.

W-21001749

The "java.lang.IllegalStateException: The client must be started before use." error no longer occurs when requesting an OAuth access token.

W-17689958

The "API is blocked (unavailable)" log message no longer appears during policy updates without a corresponding unblocked message.

W-20633888

Streaming manager initialization failures no longer occur in certain scenarios.

W-20641469

APIkit flows that use non-default names and are mapped through the flow-mapping parameter on apikit:config are now correctly counted as public flows instead of being treated as private.

W-18668900

DataWeave

The Array range selector operator no longer experiences performance degradation.

W-20220578

Concurrent access to KeyValuePairs inside lazy materialized objects no longer causes unexpected behavior.

W-21045501
**4.9.15 Runtime Updates** For Mule runtime 4.9.15, the image name that corresponds with this fix is 4.9.15:3.
Issue Resolution ID

Mule

The jakarta.mail library is upgraded to 1.6.8.

W-21138257

When the mule.forcefulShutdown.dynamicConfig.disableStoppingCheck system property is enabled, the dynamic configuration check is disabled during graceful shutdown.

W-20890587

When the mule.forcefulShutdown.raiseCancelledError feature flag is enabled, Mule runtime now raises a MULE:CANCELLED error instead of a MULE:UNKNOWN error if it attempts to create a dynamic configuration during shutdown.

W-20890613

Extensions no longer export mule-sdk-api and jakarta dependencies in the mule-artifact.json file.

W-21001749

Client certificates (optional) are no longer requested when no trust store is configured.

W-21220031

Public flows now stop concurrently during graceful shutdown.

W-21228085

Deadlocks no longer occur during log reconfiguration when policies are applied.

W-21231834

Errors that are not MessagingException errors are no longer silenced.

W-21043969

When the mule.enableLogEventDumpOnShutdown system property is enabled, the event dump is now logged during application shutdown.

W-21232374

The "java.lang.IllegalStateException: The client must be started before use." errors no longer occur when requesting an OAuth access token.

W-17689958

When the mule.propagate.objectStore.customization.to.policies feature flag is enabled, policies now respect their configured TTL when using Object Store v2.

W-21215761

The "API is blocked (unavailable)" log message no longer appears during policy updates without a corresponding unblocked message.

W-20633888

APIkit flows that use non-default names and are mapped through the flow-mapping parameter on apikit:config are now correctly counted as public flows instead of being treated as private.

W-18668900

DataWeave

The Array range selector operator no longer experiences performance degradation.

W-20220578

Concurrent access to KeyValuePairs inside lazy materialized objects no longer causes unexpected behavior.

W-21045501
**4.6.28 Runtime Updates** For Mule runtime 4.6.28, the image name that corresponds with this fix is 4.6.28:3.
Issue Resolution ID

Mule

When the mule.forcefulShutdown.dynamicConfig.disableStoppingCheck system property is enabled, the dynamic configuration check is disabled during graceful shutdown.

W-20890587

When the mule.forcefulShutdown.raiseCancelledError feature flag is enabled, Mule runtime now raises a MULE:CANCELLED error instead of a MULE:UNKNOWN error if it attempts to create a dynamic configuration during shutdown.

W-20890613

Extensions no longer export mule-sdk-api and jakarta dependencies in the mule-artifact.json file.

W-21001749

Public flows now stop concurrently during graceful shutdown.

W-21228085

Deadlocks no longer occur during log reconfiguration when policies are applied.

W-21231834

When the mule.enableLogEventDumpOnShutdown system property is enabled, the event dump is now logged during application shutdown.

W-21232374

The "java.lang.IllegalStateException: The client must be started before use." error no longer occurs when requesting an OAuth access token.

W-17689958

When the mule.propagate.objectStore.customization.to.policies feature flag is enabled, policies now respect their configured TTL when using Object Store v2.

W-21215761

The tika-core library is upgraded to 3.2.3.

W-21179465

The "API is blocked (unavailable)" log message no longer appears during policy updates without a corresponding unblocked message.

W-20633888

APIkit flows that use non-default names and are mapped through the flow-mapping parameter on apikit:config are now correctly counted as public flows instead of being treated as private.

W-18668900

DataWeave

The Array range selector operator no longer experiences performance degradation.

W-20220578

Concurrent access to KeyValuePairs inside lazy materialized objects no longer causes unexpected behavior.

W-21045501
## [](#february-14-2026)February 14, 2026 ### Fixed Issues **4.11.1 Runtime Updates** For Mule runtime 4.11.1, the image name that corresponds with these fixes is 4.11.1:2e. - This patch update reverts the fixes for these Mule issues: W-20618734 and W-20628990. **4.10.4 Runtime Updates** For Mule runtime 4.10.4, the image name that corresponds with these fixes is 4.10.4:1e. - This patch update reverts the fixes for these Mule issues: W-20618734 and W-20628990. **4.9.14 Runtime Updates** For Mule runtime 4.9.14, the image name that corresponds with these fixes is 4.9.14:1. - This patch update reverts the fixes for these Mule issues: W-20618734 and W-20628990. **4.6.27 Runtime Updates** For Mule runtime 4.6.27, the image name that corresponds with these fixes is 4.6.27:1. - This patch update reverts the fixes for these Mule issues: W-20618734 and W-20628990. ## [](#february-6-2026)February 6, 2026 ### Fixed Issues **4.11.0 Runtime Updates** For Mule runtime 4.11.0, the image name that corresponds with this fix is 4.11.0:11e.
Issue Resolution ID

Anypoint Monitoring now processes logs with reduced latency.

W-20876620
**4.10.3 Runtime Updates** For Mule runtime 4.10.3, the image name that corresponds with this fix is 4.10.3:3e.
Issue Resolution ID

Anypoint Monitoring now processes logs with reduced latency.

W-20876620
**4.9.13 Runtime Updates** For Mule runtime 4.9.13, the image name that corresponds with this fix is 4.9.13:3.
Issue Resolution ID

Anypoint Monitoring now processes logs with reduced latency.

W-20876620
**4.8.6 Runtime Updates** For Mule runtime 4.8.6, the image name that corresponds with this fix is 4.8.6:13e.
Issue Resolution ID

Anypoint Monitoring now processes logs with reduced latency.

W-20876620
**4.6.26 Runtime Updates** For Mule runtime 4.6.26, the image name that corresponds with this fix is 4.6.26:3.
Issue Resolution ID

Anypoint Monitoring now processes logs with reduced latency.

W-20876620
## [](#february-4-2026)February 4, 2026 ### What’s New - Mule runtime engine 4.11.0 is now available. For information about the release notes, see [Mule Runtime Engine 4.11.0 Release Notes](https://docs.mulesoft.com/jp/release-notes/mule-runtime/mule-4.11.0-release-notes). For information about the new release cadence, see [Edge and LTS Releases for Mule](https://docs.mulesoft.com/jp/release-notes/mule-runtime/lts-edge-release-cadence). **Runtime Manager Agent versions included in Runtime 4.11.0** This release of 4.11.0 includes Runtime Manager Agent 2.7.9. For information, see [Runtime Manager Agent 2.7.9 Release Notes](https://docs.mulesoft.com/jp/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-9). ### Fixed Issues **4.11.0 Runtime Updates** For Mule runtime 4.11.0, the image name that corresponds with this fix is 4.11.0:10e.
Issue Resolution ID

Mule

HTTP/2 connections now correctly multiplex when processing concurrent requests, reducing connection creation and latency.

W-19860076

The runtime now leverages the AST file for applications with the until-successful component instead of parsing configuration XML files.

W-20283146

Batch record deserialization no longer fails when a Netty exception occurs.

W-20552358

Inbound HTTP/2 header validation is now improved.

W-19873453

The org.apache.logging.log4j:log4j-core dependency is upgraded to 2.25.3.

W-20679050

Applications no longer experience infinite restart loops when CloudHub log files contain corrupted records.

W-20396002

DataWeave

AST scope navigation now works correctly for cross-file references when using the Tooling API.

W-20212809

A specific overload for isEmpty on binaries is now available to prevent implicit coercion to other types.

W-20049958

Materialized Java values are now cached to allow multiple executions using the same value.

W-20091279

Semantic tokens are now supported in the Tooling API.

W-19846990

NullPointerException no longer occurs when handling annotation types.

W-19853000

LogLevel documentation is now included directly in the code.

W-17800393

The commons-beanutils library is upgraded.

W-3300013

Base64 encoding and decoding now support payloads larger than memory.

W-18575719

Eager materialization is now supported on values, enabling caching of all exceptions inside the try function.

W-19717874

Avro enum, map, union, and fixed types are now supported as top-level elements.

W-19596039

WeaveCompiler now allows precompiling mappings and modules without validation or type checking.

W-19667273

Type check errors are now correctly reported when resolving type checking on subgraphs.

W-19564697

Lazy loading of source files is now enabled during binary compilation, avoiding unnecessary memory usage.

W-19594703

Type inference now works correctly when using the -- operator to subtract a key from an object.

W-19595907

Warning and error messages now propagate correctly between compilation phases.

W-19386849

Base types are now used to validate accepted values, preventing premature materialization.

W-18943395

Optional types now propagate correctly through chains of value selectors.

W-19272070

The syntax version is now added to TypeGraph and WeaveTypeResolution.

W-19271992

The classloader resource resolver now resolves paths correctly on Windows systems.

W-19407283
## [](#february-3-2026)February 3, 2026 ### What’s New **4.6, 4.9, and 4.10 Runtime Updates** - Updated to the latest operating system security patches. **Runtime Manager Agent versions included in Runtime 4.6.26, 4.9.13, and 4.10.3** This release of 4.6.26, 4.9.13, and 4.10.3 includes Runtime Manager Agent 2.7.9. For information, see [Runtime Manager Agent 2.7.9 Release Notes](https://docs.mulesoft.com/jp/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-9). ### Fixed Issues **4.10.3 Runtime Updates** For Mule runtime 4.10.3, the image name that corresponds with this fix is 4.10.3:2e.
Issue Resolution ID

Mule

HTTP/2 handling now correctly multiplexes connections during concurrent request processing. Previously, a failure to multiplex caused excessive connection creation and significantly increased latency.

W-19860076

Improved the validation logic for inbound HTTP/2 headers to ensure better protocol compliance and security.

W-19873453

Optimized the logging service to avoid creating unnecessary logging contexts when running a single application.

W-19965379

JDK Flight Recorder (JFR) is now disabled by default.

W-19990145

Implemented minor improvements to Mule classloading structures to enhance efficiency and stability.

W-20028988

Reduced memory consumption by removing deployment-specific objects after application deployment.

W-20053979

The Abstract Syntax Tree (AST) file of applications using the until-successful component is now leveraged by Mule runtime instead of parsing the configuration XML files.

W-20283146

Optimized the HTTP Service to avoid regenerating static attributes for every request when using Netty.

W-20615232

Thread Context Classloader (TCCL) is no longer wrongly set to the connector after an operation policy execute-next.

W-20618734

Mule application unresponsiveness no longer occurs after a policy that uses the until-successful component is undeployed or redeployed.

W-20628990

The org.apache.logging.log4j:log4j-core library is upgraded to 2.25.3.

W-20679050

The org.apache.cxf:cxf-core library is upgraded to 3.6.9.

W-20659822

The io.netty:netty-bom library is upgraded to 4.2.9.Final.

W-3300013

Applications no longer experience infinite restart loops when CloudHub log files contain corrupted records.

W-20396002

DataWeave

Starting in Mule runtime 4.6, you can now configure materialization settings (mule.dw.enable_vars_materialization_pass).

W-19580992
**4.9.13 Runtime Updates** For Mule runtime 4.9.13, the image name that corresponds with this fix is 4.9.13:2e.
Issue Resolution ID

Mule

Optimized the logging service to avoid creating unnecessary logging contexts when running a single application.

W-19965379

JDK Flight Recorder (JFR) is now disabled by default.

W-19990145

Implemented minor improvements to Mule classloading structures to enhance efficiency and stability.

W-20028988

Reduced memory consumption by removing deployment-specific objects after application deployment.

W-20053979

The Abstract Syntax Tree (AST) file of applications using the until-successful component is now leveraged by Mule runtime instead of parsing the configuration XML files.

W-20283146

Mule application unresponsiveness no longer occurs after a policy that uses the until-successful component is undeployed or redeployed.

W-20628990

Optimized the HTTP Service to avoid regenerating static attributes for every request when using Netty.

W-20615232

The io.netty:netty-bom library is upgraded to 4.2.9.Final.

W-3300013

The org.apache.logging.log4j:log4j-core library is upgraded to 2.25.3.

W-20679050

Fastutil is now replaced with fastutil-core.

W-20729870

Applications no longer experience infinite restart loops when CloudHub log files contain corrupted records.

W-20396002

DataWeave

Starting in Mule runtime 4.6, you can now configure materialization settings (mule.dw.enable_vars_materialization_pass).

W-19580992
**4.6.26 Runtime Updates** For Mule runtime 4.6.26, the image name that corresponds with this fix is 4.6.26:2.
Issue Resolution ID

Mule

JDK Flight Recorder (JFR) is now disabled by default.

W-19990145

The Abstract Syntax Tree (AST) file of applications using the until-successful component is now leveraged by Mule runtime instead of parsing the configuration XML files.

W-20283146

Mule application unresponsiveness no longer occurs after a policy that uses the until-successful component is undeployed or redeployed.

W-20628990

Implemented minor improvements to Mule classloading structures to enhance efficiency and stability.

W-20028988

Thread Context Classloader (TCCL) is no longer wrongly set to the connector after an operation policy execute-next.

W-20618734

Fastutil is now replaced with fastutil-core.

W-20729870

Applications no longer experience infinite restart loops when CloudHub log files contain corrupted records.

W-20396002
## [](#january-6-2026)January 6, 2026 ### What’s New **4.6, 4.9, and 4.10 Runtime Updates** - Updated to the latest operating system security patches. **Runtime Manager Agent versions included in Runtime 4.6.25, 4.9.12, and 4.10.2** This release of 4.6.25, 4.9.12, and 4.10.2 includes Runtime Manager Agent 2.7.9. For information, see [Runtime Manager Agent 2.7.9 Release Notes](https://docs.mulesoft.com/jp/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-9). ### Fixed Issues **4.10.2 Runtime Updates** For Mule runtime 4.10.2, the image name that corresponds with this fix is 4.10.2:5e.
Issue Resolution ID

Mule

Batch jobs no longer hang when errors occur in steps that use try scopes with global error handlers.

W-17738563

Applications no longer become unresponsive after thread pool exhaustion when using Netty as the HTTP Service implementation with the Anypoint MQ Connector.

W-19806707

Design-time operations on primary content parameters with non-Java types now work correctly.

W-20187776

Logging information is now improved during graceful shutdown.

W-20278970

A deadlock between Log4j Mule log support during application initialization no longer occurs.

W-20419795

The HTTP Client can now establish an SSE source when the content-type header doesn’t exactly match text/event-stream.

W-20420476

MUnit tests no longer fail intermittently when running on Java 17.

W-17044721

Batch processing not longer fails with serialization error when LDAP action throws an error in Java 17.

W-19524600

Dynamic configurations now work correctly during initialization when using hashCode and equals methods on a TLSConfiguration class.

W-18835469

A memory leak after application undeployment no longer occurs when using connections from configurations defined in a domain.

W-13521171

Connections now close properly on the server side after an HTTP/2 client disconnects.

W-19861068

The JMS connector no longer closes XA-enlisted connections.

W-20266983

Connections from providers that implement both CachedConnectionProvider and XaTransactionalConnectionProvider are no longer cached if the provided connection is XA.

W-20267068

The alert context in the DIAF file is now reset after the configured time interval expires.

W-20140036

The HTTP Server now returns a 400 error when the HTTP/1 to HTTP/2 upgrade mechanism receives an invalid HTTP2-Settings header.

W-19895731

DataWeave

Functions now materialize correctly when the function body contains a single var declaration.

W-20365331

The stream reader now processes input with multi-byte characters correctly.

W-20016549

The Apache Commons Lang library included in the distribution is upgraded.

W-20004786

DataWeave grammar transformation performance is improved.

W-19840284

Memory usage is improved for binary compilation and AST-related utilities.

W-19706956
**4.9.12 Runtime Updates** For Mule runtime 4.9.12, the image name that corresponds with this fix is 4.9.12:5e.
Issue Resolution ID

Mule

Batch jobs no longer hang when errors occur in steps that use try scopes with global error handlers.

W-17738563

Applications no longer become unresponsive after thread pool exhaustion when using Netty as the HTTP Service implementation with the Anypoint MQ Connector.

W-19806707

Design-time operations on primary content parameters with non-Java types now work correctly.

W-20187776

Logging information is now improved during graceful shutdown.

W-20278970

A deadlock between Log4j Mule log support during application initialization no longer occurs.

W-20419795

The HTTP Client can now establish an SSE source when the content-type header doesn’t exactly match text/event-stream.

W-20420476

MUnit tests no longer fail intermittently when running on Java 17.

W-17044721

Batch processing no longer fails with serialization error when LDAP action throws an error in Java 17.

W-19524600

Dynamic configurations now work correctly during initialization when using hashCode and equals methods on a TLSConfiguration class.

W-18835469

DataWeave

Functions now materialize correctly when the function body contains a single var declaration.

W-20365331

The stream reader now processes input with multi-byte characters correctly.

W-20016549
**4.6.25 Runtime Updates** For Mule runtime 4.6.25, the image name that corresponds with this fix is 4.6.25:5.
Issue Resolution ID

Mule

Batch jobs no longer hang when errors occur in steps that use try scopes with global error handlers.

W-17738563

Design-time operations on primary content parameters with non-Java types now work correctly.

W-20187776

Logging information is now improved during graceful shutdown.

W-20278970

A deadlock between Log4j Mule log support during application initialization no longer occurs.

W-20419795

MUnit tests no longer fail intermittently when running on Java 17.

W-17044721

Batch processing no longer fails with serialization error when LDAP action throws an error in Java 17.

W-19524600

Dynamic configurations now work correctly during initialization when using hashCode and equals methods on a TLSConfiguration class.

W-18835469

DataWeave

The stream reader now processes input with multi-byte characters correctly.

W-20016549

The org.apache.commons:commons-text library is upgraded to 1.14.0.

W-20618375

Each variable is now extracted from vars, allowing its materialization to be managed individually. The mule.dw.enable_vars_materialization_pass compatibility flag is added to preserve the previous materialization behavior.

W-19580992 / W-17167283
## [](#december-2-2025)December 2, 2025 ### What’s New **4.6, 4.9, and 4.10 Runtime Updates** - Updated to the latest operating system security patches. **Runtime Manager Agent versions included in Runtime 4.6.24, 4.9.11, and 4.10.1** This release of 4.6.24, 4.9.11, and 4.10.1 includes Runtime Manager Agent 2.7.8. For information, see [Runtime Manager Agent 2.7.8 Release Notes](https://docs.mulesoft.com/jp/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-8). ### Fixed Issues **4.10.1 Runtime Updates** For Mule runtime 4.10.1, the image name that corresponds with this fix is 4.10.1:13e. - The operating system is updated to the latest security patches. **4.9.11 Runtime Updates** For Mule runtime 4.9.11, the image name that corresponds with this fix is 4.9.11:7. - The operating system is updated to the latest security patches. **4.6.24 Runtime Updates** For Mule runtime 4.6.24, the image name that corresponds with this fix is 4.6.24:8. - The operating system is updated to the latest security patches. ## [](#november-4-2025)November 4, 2025 ### What’s New **4.4, 4.6, 4.9, and 4.10 Runtime Updates** - Updated to the latest operating system security patches. **Runtime Manager Agent versions included in Runtime 4.4.0, 4.6.24, 4.9.11, and 4.10.1** This release of 4.4.0, 4.6.24, 4.9.11, and 4.10.1 includes Runtime Manager Agent 2.7.8. For information, see [Runtime Manager Agent 2.7.8 Release Notes](https://docs.mulesoft.com/jp/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-8). ### Fixed Issues **4.10.1 Runtime Updates** For Mule runtime 4.10.1, the image name that corresponds with these fixes is 4.10.1:10e.
Issue Resolution ID

Mule

OpenTelemetry current API sampling decisions now propagate correctly through http:requester calls to downstream APIs.

W-19784910

UndeclaredThrowableException errors no longer occur during Bitronix reconnection.

W-15196888

InaccessibleObjectException errors no longer occur during deployment when the mule.classloading.verbose property is set.

W-18563387

MDC information is now properly preserved when using loggers inside custom Java code invoked from a DataWeave script.

W-18912999

Batch queuestore files now clean up correctly in rare load failure scenarios such as out-of-memory errors.

W-17935223

Builds no longer fail when running tests from an extension that uses Mule SDK with Java 8 through Java 17.

W-18964335

The until-successful scope now honors the graceful shutdown timeout. To enable this behavior, set these system properties: mule.untilSuccessful.retryOnCriticalError.disallow=true and mule.forcefulShutdown.raiseCancelledError=true.

W-19648397

Hashing now uses toHex conversion to prevent “null character” or other invalid characters from being used as IDs in the redelivery policy. This change is feature-flagged. To enable it in version 4.10, set the mule.redeliveryPolicy.encode.secureHash system property to true.

W-18584560

IllegalAccessException errors no longer occur when DataWeave serializes error.errorMessage in a Scatter-Gather error route.

W-19340663

Mule applications that use TLS KeyStore configurations no longer fail to deploy with “NO MODEL RESOLVED” warnings and ConfigurationException errors.

W-16565012

Mule Troubleshooting Plugin executions no longer fail when the IP address changes.

W-19802474

The reactor.netty library is upgraded to 1.2.10.

W-17264514

The netty library is upgraded to 4.1.127.Final.

W-19995637

The spring-core library is upgraded to 6.2.11.

W-19674953

The Bump handlebars library is upgraded to 4.4.0.

W-1906465

The HTTP listener now correctly populates attributes.queryParams when using HTTP/2.

W-19802358

close_notify events sent by a server are now properly handled by the HTTP/2 client.

W-19973575

DataWeave

Materialization errors no longer occur in run function.

W-19884071

The org.apache.commons:commons-lang3 library is upgraded to 3.18.

W-19803454

Single variable materialization now works correctly for unsafe and exists selectors.

W-19581017

The SnakeYAML library is upgraded.

W-19749213

Each variable is now extracted from vars, allowing its materialization to be managed individually. The mule.dw.enable_vars_materialization_pass compatibility flag is added to preserve the previous materialization behavior.

W-19580992 / W-17167283

The -- operator now returns the correct type without the subtracted keys.

W-19595907

Debug logging is now enabled for DefaultLoggingService.

W-19650046

The take function no longer fails in streaming mode when n is larger than the array length.

W-19168279

The Java Module now supports object field access with different capitalizations.

W-19477334

The Runtime Compiler now uses the Parser Manager to look for resources provided as parameters.

W-19376888

A null check is now performed before closing the InputStream.

W-19395982

Parsing metrics printing now includes a missing line ending.

W-19440583

Constants are now used to prevent incorrect loader identifiers for binary compiled scripts.

W-18455133

Generated POM files now include license information.

W-19439330

SchemaProvider resolution on Types is improved to prevent Execution reference leaks.

W-19389019

The classloader weave resource resolver now uses the correct path in Windows environments.

W-19407283
**4.9.11 Runtime Updates** For Mule runtime 4.9.11, the image name that corresponds with these fixes is 4.9.11:4e.
Issue Resolution ID

Mule

OpenTelemetry current API sampling decisions now propagate correctly through http:requester calls to downstream APIs.

W-19784910

UndeclaredThrowableException errors no longer occur during Bitronix reconnection.

W-15196888

InaccessibleObjectException errors no longer occur during deployment when the mule.classloading.verbose property is set.

W-18563387

MDC information is now properly preserved when using loggers inside custom Java code invoked from a DataWeave script.

W-18912999

Batch queuestore files now clean up correctly in rare load failure scenarios such as out-of-memory errors.

W-17935223

Builds no longer fail when running tests from an extension that uses Mule SDK with Java 8 through Java 17.

W-18964335

Starvation no longer occurs when sending HTTP responses that are generated slowly.

W-1982570

The until-successful scope now honors the graceful shutdown timeout. To enable this behavior, set these system properties: mule.untilSuccessful.retryOnCriticalError.disallow=true and mule.forcefulShutdown.raiseCancelledError=true.

W-19648397

Hashing now uses toHex conversion to prevent “null character” or other invalid characters from being used as IDs in the redelivery policy. This change is feature-flagged. To enable it in version 4.9, set the mule.redeliveryPolicy.encode.secureHash system property to true.

W-18584560

IllegalAccessException errors no longer occur when DataWeave serializes error.errorMessage in a Scatter-Gather error route.

W-19340663

Mule applications that use TLS KeyStore configurations no longer fail to deploy with “NO MODEL RESOLVED” warnings and ConfigurationException errors.

W-16565012

Mule Troubleshooting Plugin executions no longer fail when the IP address changes.

W-19802474

SSE clients can now parse events that do not include an event field. These events now default to message, as described in the specification.

W-19667148

The reactor.netty library is upgraded to 1.2.10.

W-17264514

The netty library is upgraded to 4.2.7.Final.

W-19995637

The spring-core library is upgraded to 6.2.11.

W-19674953

DataWeave

The Apache Commons Lang dependency is removed from the distribution.

W-19803454

Materialization errors no longer occur when running functions.

W-19884071

Single variable materialization now works correctly for unsafe and exists selectors.

W-19581017

Each variable is now extracted from vars, allowing its materialization to be managed individually. The mule.dw.enable_vars_materialization_pass compatibility flag is added to preserve the previous materialization behavior.

W-19580992 / W-17167283
**4.6.24 Runtime Updates** For Mule runtime 4.6.24, the image name that corresponds with these fixes is 4.6.24:4.
Issue Resolution ID

OpenTelemetry current API sampling decisions now propagate correctly through http:requester calls to downstream APIs.

W-19784910

UndeclaredThrowableException errors no longer occur during Bitronix reconnection.

W-15196888

InaccessibleObjectException errors no longer occur during deployment when the mule.classloading.verbose property is set.

W-18563387

MDC information is now properly preserved when using loggers inside custom Java code invoked from a DataWeave script.

W-18912999

Batch queuestore files now clean up correctly in rare load failure scenarios such as out-of-memory errors.

W-17935223

Builds no longer fail when running tests from an extension that uses Mule SDK with Java 8 through Java 17.

W-18964335

The until-successful scope now properly honors the graceful shutdown timeout. In versions earlier than 4.11.0, you must enable this behavior using these system properties: mule.untilSuccessful.retryOnCriticalError.disallow=true and mule.forcefulShutdown.raiseCancelledError=true.

W-19340663

Hashing now uses toHex conversion to prevent “null character” or other invalid characters from being used as IDs in the redelivery policy. This change is feature-flagged. To enable it in version 4.6, set the mule.redeliveryPolicy.encode.secureHash system property to true.

W-18584560

IllegalAccessException no longer thrown when DW serializes error.errorMessage in Scatter-Gather error route.

W-19340663

Mule applications that use TLS KeyStore configurations no longer fail to deploy with “NO MODEL RESOLVED” warnings and ConfigurationException errors.

W-16565012

Mule Troubleshooting Plugin executions no longer fail when the IP address changes.

W-19802474

DataWeave

The Apache Commons Lang dependency is removed from the distribution.

W-19803454

Materialization errors no longer occur when running functions.

W-19884071
**4.4.0 Runtime Updates** For Mule runtime 4.4.0, the image name that corresponds with these fixes is 4.4.0-20250919-5. - The operating system is updated to the latest security patches. ## [](#october-2-2025)October 2, 2025 ### What’s New - Mule runtime engine 4.10.0 is now available. For information about the new release cadence, see [Edge and LTS Releases for Mule](https://docs.mulesoft.com/jp/release-notes/mule-runtime/lts-edge-release-cadence). **4.4, 4.6, 4.9, and 4.10 Runtime Updates** - Updated to the latest operating system security patches. **Runtime Manager Agent versions included in Runtime 4.4.0, 4.6.23, 4.9.10, and 4.10.0** This release of 4.4.0, 4.6.23, 4.9.10, and 4.10.0 includes Runtime Manager Agent 2.7.7. For information, see [Runtime Manager Agent 2.7.7 Release Notes](https://docs.mulesoft.com/jp/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-7). ### Fixed Issues **4.10.0 Runtime Updates** For Mule runtime 4.10.0, the image name that corresponds with these fixes is 4.10.3:2e.
Issue Resolution ID

Mule

The org.quartz-scheduler:quartz library is upgraded to 2.5.0.

W-17406808

The org.vibur:vibur-object-pool library is upgraded to 26.

W-17570586

The commons-beanutils:commons-beanutils library is upgraded to 1.10.0.

W-17571116

The jakarta-annotation library is upgraded to 2.1.1.

W-17927646

The Mockito monorepo is upgraded to 5.

W-18685961

The Log4j2 monorepo is upgraded to 2.25.1.

W-18834079

The Netty library is upgraded to 4.1.127.Final.

W-19559645

The Rhino library is upgraded to 1.8.0.

W-17636627

The org.springframework : spring-core library is upgraded to 6.2.10.

W-19353311

The org.apache.cxf:cxf-core library is now upgraded to 3.5.11.

W-17264514

Memory leaks no longer occur when a reconnection is configured in a Mule domain and referenced from multiple applications.

W-17857080

InaccessibleObjectException errors no longer occur when using cluster mode on Java 17.

W-18667744

Fork-join routers no longer create unnecessary schedules when the timeout is set to infinite.

W-18347293

Potential deadlocks during deployment no longer occur when using some custom Log4j appenders.

W-19675881

Cookies now propagate correctly across multiple redirect scenarios.

W-18971065

The Netty library is upgraded to 4.1.124.Final.

W-19341592

The org.mule.runtime.api.serialization.SerializationException: Could not deserialize object errors no longer occur when processing the payload of a Query XML stream using transfer message in a Choice Router.

W-18902280

SSE clients now parse events that don’t include an event field. They default to message as described in the spec.

W-19667148

Possible starvation no longer occurs when sending HTTP responses that are generated slowly.

W-19471841

Gatekeeper deadlock errors no longer occur during race conditions among contract downloads and policy application.

W-19407164

DataWeave

The take function now works with streaming when argument is larger than the array length.

W-19168279

java-module now supports object fields access when using different capitalizations.

W-19477334
**4.9.10 Runtime Updates** For Mule runtime 4.9.10, the image name that corresponds with these fixes is 4.9.10:4e.
Issue Resolution ID

Mule

Memory leaks no longer occur when a reconnection is configured in a Mule domain and referenced from multiple applications.

W-17857080

InaccessibleObjectException errors no longer occur when using cluster mode on Java 17.

W-18667744

Fork-join routers no longer create unnecessary schedules when the timeout is set to infinite.

W-18347293

Potential deadlocks during deployment no longer occur when using some custom Log4j appenders.

W-19675881

Cookies now propagate correctly across multiple redirect scenarios.

W-18971065

The Netty library is upgraded to 4.1.124.Final.

W-19341592

The Handlebars library is upgraded to 4.4.0.

W-19064659

The org.apache.commons : commons-lang3 library is upgraded to 3.17.0.

W-19383955

The io.netty : netty-codec library is upgraded to 4.1.127.Final.

W-19568278

The org.springframework : spring-core library is upgraded to 6.2.10.

W-19353311

The org.apache.cxf:cxf-core library is now upgraded to 3.5.11.

W-17264514

The org.mule.runtime.api.serialization.SerializationException: Could not deserialize object errors no longer occur when processing the payload of a Query XML stream using transfer message in a Choice Router.

W-18902280

Scheduler name generation no longer breaks the platform logging aggregator when processor chains have null or empty names.

W-19432758

SSE clients now parse events that don’t include an event field. They default to message as described in the spec.

W-19667148

Possible starvation no longer occurs when sending HTTP responses that are generated slowly.

W-19471841

Gatekeeper deadlock errors no longer occur during race conditions between contract downloads and policy application.

W-19407164

DataWeave

The take function now works with streaming when argument is larger than the array length.

W-19168279

java-module now supports object fields access when using different capitalizations.

W-19477334
**4.6.23 Runtime Updates** For Mule runtime 4.6.23, the image name that corresponds with these fixes is 4.6.23:4.
Issue Resolution ID

The org.springframework library is upgraded to 5.3.45.

W-18603096

Memory leaks no longer occur when a reconnection is configured in a Mule domain and referenced from multiple applications.

W-17857080

InaccessibleObjectException errors no longer occur when using cluster mode on Java 17.

W-18667744

Fork-join routers no longer create unnecessary schedules when the timeout is set to infinite.

W-18347293

Potential deadlocks during deployment no longer occur when using some custom Log4j appenders.

W-19675881

This release reverts the changes introduced in W-17340911.

W-17340911

Cookies now propagate correctly across multiple redirect scenarios.

W-18971065

Batch queuestore files now clean up correctly in rare load failure scenarios, such as out of memory errors.

W-17935223

Gatekeeper deadlock errors no longer occur during race conditions among contract downloads and policy application.

W-19407164

DataWeave

The take function now works with streaming when argument is larger than the array length.

W-19168279

java-module now supports object fields access when using different capitalizations.

W-19477334

Module compilation performance is improved when running concurrently.

W-19376546
**4.4.0 Runtime Updates** For Mule runtime 4.4.0, the image name that corresponds with these fixes is 4.4.0:20250919-3.
Issue Resolution ID

BufferOverFlowException errors no longer occur when inter-node communication gets stuck in clusters with encryption under heavy load.

W-16517561

Gatekeeper deadlock errors no longer occur during race conditions between contract downloads and policy application.

W-19407164
## [](#september-5-2025)September 5, 2025
Updates for images 4.9.9:6e and 4.6.22:5 apply to Government Cloud only.
### Fixed Issues **4.9.9 Runtime Updates** For Mule runtime 4.9.9, the image name that corresponds with these fixes is 4.9.9:6e.
Issue Resolution ID

Anypoint Monitoring metrics are now generated correctly.

W-19548148
**4.6.22 Runtime Updates** For Mule runtime 4.6.22, the image name that corresponds with these fixes is 4.6.22:5.
Issue Resolution ID

Anypoint Monitoring metrics are now generated correctly.

W-19548148
## [](#september-2-2025)September 2, 2025 ### What’s New **4.4, 4.6, and 4.9 Runtime Updates** - Updated to the latest operating system security patches. **Runtime Manager Agent versions included in Runtime 4.4.0, 4.6.22, and 4.9.9** This release of 4.4.0, 4.6.21, and 4.9.8 includes Runtime Manager Agent 2.7.7. For information, see [Runtime Manager Agent 2.7.7 Release Notes](https://docs.mulesoft.com/jp/release-notes/runtime-manager-agent/runtime-manager-agent-2.7.x-release-notes#2-7-7). ### Fixed Issues **4.9.9 Runtime Updates** For Mule runtime 4.9.9, the image name that corresponds with these fixes is 4.9.9:5e.
Issue Resolution ID

Mule

TLS configuration for FIPS-140-2 is now upgraded.

W-16315176

Applications using Scheduler component in a strict FIPS-140-2 environment no longer fail to deploy due to the unavailability of the MD5 algorithm.

W-19319437

io.projectreactor.netty : reactor-netty-http is upgraded to 1.2.8.

W-19074903

Component annotations, such as location, are no longer overwritten by other components.

W-18269859

org.apache.commons : commons-lang3 is upgraded to 3.18.0.

W-19059553

DataWeave

A memory leak during Weave type schema resolution is now fixed.

W-19389019

Potential deadlocks no longer occur when increasing concurrency while parsing DataWeave scripts.

W-19376546
**4.6.22 Runtime Updates** For Mule runtime 4.6.22, the image name that corresponds with these fixes is 4.6.22:4.
Issue Resolution ID

TLS configuration for FIPS-140-2 is now upgraded.

W-16315176

Applications using Scheduler component in a strict FIPS-140-2 environment no longer fail to deploy due to the unavailability of the MD5 algorithm.

W-19319437

OAuth token is now refreshed when used through ExtensionClient.

W-19248279
**4.4.0 Runtime Updates** For Mule runtime 4.4.0, the image name that corresponds with these fixes is 4.4.0:20250829-1.
Issue Resolution ID

Performance degradation no longer occurs when using repeatable streaming.

W-19175330
## [](#see-also)See Also - [Salesforce Help](https://help.salesforce.com) - [Known Issues](https://help.salesforce.com/s/issues)