v5.1.18

Blob replication reliability

• Blob apply loop could freeze on wire-carried save flags (#1641) — the apply path gated a receiver's commit on the sender's in-flight save state, which could freeze the whole apply loop if that stream stalled. Apply commits are no longer gated on those flags at all; instead, a local write with a fresh blob now gates its own commit on the blob's durable save, so a record can no longer commit (and replicate) a not-yet-durable blob reference.
• Cache record headers could be corrupted after a shared response body (#1709) — mutating a cached record's headers/status in finalizeResponse could mutate the live cached record itself when the response body was shared, corrupting future reads of that record. The response path now copies before mutating.

Fleet upgrade & deployment

• Graceful worker-shutdown drain hook (#1621) — adds a registry (registerShutdownDrain) that lets in-flight work (e.g. in-progress blob sends) finish before a worker thread exits, instead of being cut off mid-transfer during a rolling restart or upgrade.
• Deploy could silently truncate the tarball on a dangling symlink (#1718) — deploy_component reported success even when a dangling symlink caused the packaging walker to stop early and drop every entry queued after it. The packager now pre-scans for dangling symlinks and excludes just those, instead of the walk bailing out silently.
• Docker entrypoint exec-format error on 5.1.x (#1619) — the container entrypoint could be written empty via a RUN heredoc redirect, producing an exec format error at startup. It's now written via a COPY heredoc so the image boots reliably.
• npm latest/next dist-tags could be stolen by an older release line (#1690) — publishing any release moved the latest/next tag regardless of version, so a 5.0.x patch published after a 5.1.x release could steal latest back onto 5.0.x. The tag now only moves forward for the line it belongs to.
• Periodic re-read safety net for the TLS cert watcher (#1394) — adds a polling fallback alongside the filesystem watcher so a missed cert-rotation event (e.g. from certain volume mounts) doesn't leave a node running on a stale certificate indefinitely.

MQTT

• Shared MQTT port across workers (#1603) — workers now share the MQTT listener port (except on macOS), so MQTT works correctly on multi-worker instances.

MCP

• Missing MCP-Protocol-Version header on an established session no longer 400s (#1694) — clients that negotiated a newer protocol version but omit the header on individual requests (permitted by spec) were incorrectly rejected. The session's already-negotiated version is now used when the header is absent.
• Static plugin serving nothing when urlPath is configured (#1584) — fixes a static-file plugin regression where a configured urlPath resulted in no files being served.

Also in this release

• threads.preload config to preload modules (e.g. APM agents) on worker threads (#1569).
• fix(queue): waitForDrain no longer hangs if the queue empties without emitting a drained event (#1643).

Full Changelog: v5.1.17...v5.1.18

v5.1.17

Replication & blob reliability

• Blob catch-up no longer 404s mid-transfer (#1563) — an in-flight replication blob receive now returns 503 instead of 404. A receiver catching up on a blob that is still streaming retries cleanly instead of treating it as permanently missing and advancing past it.

Fleet upgrade & deployment

• Docker entrypoint exec-format error on 5.1.x (#1619) — the container entrypoint could be written empty via a RUN heredoc redirect, producing an exec format error at startup. It is now written via a COPY heredoc so the image boots reliably.
• Ship npm-shrinkwrap.json in the published package (#1623) — locks the published dependency tree so installs of the release resolve a reproducible set of dependencies.

MQTT

• Shared MQTT port across workers (#1603) — workers now share the MQTT listener port (except on macOS), so MQTT works correctly on multi-worker instances.

Full Changelog: v5.1.15...v5.1.17

v5.0.32

Build & packaging

• Publish a pinned dependency tree — the published package now includes npm-shrinkwrap.json, so npm install harper resolves the exact dependency tree Harper built and tested against instead of floating ^ ranges. Previously the shrinkwrap was generated at pack time but omitted from the package files allowlist, so releases shipped unpinned — which could let native-addon dependencies drift onto a broken upstream patch at install time.

Replay & recovery

• Bound skip-dominated boot replay (#1266) — boot-time replay that is dominated by skips is now bounded so it can't grind indefinitely without making progress.
• Bound write-throw storms — replay write-throw storms are now bounded and use a monotonic clock, so a burst of write failures during recovery can't spin unbounded.

Full Changelog: v5.0.31...v5.0.32

v5.1.15

Fleet-upgrade hardening, an MCP authorization fix, and several replication/deploy reliability fixes.

Fleet upgrade

• v4→v5 migration structure-fork prevention. shapeForStructure wasn't recursing into RecordObject-shaped migration records, so the canonical shared-structure dictionary could come up empty after a v4→v5 upgrade and fork under load. Fixed to recurse any non-leaf object; validated against a live 4.7.34→5.1.14 migration.

Security

• MCP row-level RBAC bypass fixed. MCP tool handlers resolved the table class captured at registration time (table-level RBAC only), which allowed a write fail-open and a point-read bypass on row-restricted tables. Handlers now resolve the live registry Resource at call time.

Replication & reliability

• Three ITC (inter-thread-communication) fixes for add_role/alter_role and user/schema mutations, which could return before other worker threads' auth caches finished updating — a source of spurious 403s and flaky auth checks under load.
• New reload audit marker type so subscribers correctly re-read a table after a copyApply bulk system-DB reload.

Deploy

• Component directory swap on deploy is now atomic, avoiding an ENOTEMPTY crash on live apps mid-deploy.
• Large deployment payload blobs are auto-dropped once every peer has installed successfully, instead of accumulating.
• Extension packages living outside ROOTPATH are now resolved correctly during the node_modules walk.

Performance

• Analytics' last-aggregation lookup is now bounded instead of falling back to a main-thread full table scan.
• describe_table/describe_all/describe_schema accept an opt-in skip_record_count to skip the per-table count scan when only schema is needed.

Models extension API

• Public registerBackend/defineBackend for custom model backends, config-selectable backends via backend: <module>, and pluggable routing with capability-aware selection/fallback plus a namespaced extension API. The routing/extension-API change is breaking for the pre-1.0 models surface — no known consumers yet.

Also in this release

• Startup crash fix in role validation (getDatabases()).
• Regression-anchor test promotions, CI calibration, and dependency bumps.

Full Changelog: v5.1.14...v5.1.15

v5.1.14

What's Changed

• chore: bump version to v5.1.13 (sync with RC-branch release)
• fix(blob): mark a retriable source-stream write-abort PENDING (503) instead of incomplete (500) (harper-pro#481) (#1480)
• fix(replication): skip keyed audit-dedup lookup for versions older than transaction-log retention (#1486)
• fix(blob): progress-gate the source-idle watchdog so a stalled paused receive recovers (#1492)
• chore(deps): Update rocksdb-js to 2.3.0
• feat(replication): add replication_copyTimeout config param
• test(integration): address review feedback on scale suite
• test(integration): add scale correctness suite (#1192)
• Merge pull request #1479 from HarperFast/kris/copy-apply-snapshot-core
• feat(replication): apply bulk base-copy frames as snapshots without audit entries
• Merge pull request #1478 from HarperFast/safe-mode-notify-log
• Merge pull request #1477 from HarperFast/docs/clarify-runtime-globals-and-symlink
• chore: drop accidentally committed node_modules symlink
• fix(migration): feed only record shape to the structure observer
• chore: format + lint (drop unused import, accurate test comments)
• fix(migration): persist canonical classic structures so v5 workers don't fork
• test(encoder): reproduce v4→v5 migration structure-id fork + reload recovery
• Log a notify message at startup when HARPER_SAFE_MODE is set
• docs: clarify that tables/databases are live process-wide singletons
• feat(resources): support parameterised paths in Resource exports (#602) (#1460)
• Fix deploy packaging an empty component when installed under a node_modules path (#1466)

Full Changelog: v5.1.12...v5.1.14

v5.1.13

What's Changed

• Merge harper #1479: Apply bulk base-copy frames as snapshots without audit entries
• Merge harper #1478: Log notify message at startup when HARPER_SAFE_MODE is set
• Merge harper #1477: docs: clarify that tables/databases are live process-wide singletons
• feat(replication): apply bulk base-copy frames as snapshots without audit entries
• chore: drop accidentally committed node_modules symlink
• fix(migration): feed only record shape to the structure observer
• chore: format + lint (drop unused import, accurate test comments)
• fix(migration): persist canonical classic structures so v5 workers don't fork
• test(encoder): reproduce v4→v5 migration structure-id fork + reload recovery
• Log a notify message at startup when HARPER_SAFE_MODE is set
• docs: clarify that tables/databases are live process-wide singletons
• feat(resources): support parameterised paths in Resource exports (#602) (#1460)
• Fix deploy packaging an empty component when installed under a node_modules path (#1466)
• fix(blob): wrap entry.value decode in decodeFromDatabase in findIncompleteBlobRefs
• test(blob): add unit tests for isBlobComplete and findIncompleteBlobRefs
• chore: format blob.test.js
• test(blob): fix startPreCommitBlobsForRecord.complete() assertion for already-saving blobs
• feat(blob): add findIncompleteBlobRefs generator and isBlobComplete for repair sweep

Full Changelog: v5.1.12...v5.1.13

v5.1.12

What's Changed

• fix: use getSync for system-table point reads (RocksDB MaybePromise)

Full Changelog: v5.1.11...v5.1.12

v5.1.11

What's Changed

• feat(blob): add findIncompleteBlobRefs and isBlobComplete for repair sweep (#1387)

Full Changelog: v5.1.10...v5.1.11

v5.1.10

What's Changed

• fix(deps): update alasql
• refactor(componentLoader): reuse resolvedFolder for the once-per-component key
• fix: invoke startOnMainThread at most once per component
• feat(mcp): complete the MCP v1 protocol surface (#1349) (#1404)

Full Changelog: v5.1.9...v5.1.10

v5.1.9

What's Changed

• Merge pull request #1444 from HarperFast/fix/blob-receive-idle-watchdog
• fix(test): eliminate race in Txn Expiration flaky test
• Merge branch 'main' into fix/blob-receive-idle-watchdog
• fix(blob): bound the stream() incomplete-content wait so a truncated blob can't spin a worker at 100% CPU (#1454) (#1456)
• style(blob): prettier — drop stray blank line in opt-in test block (#1444 format check)
• fix(blob): make source-idle watchdog opt-in (per-stream arm), not default-on (#1458)
• fix(blob): narrow stream type to Readable, drop redundant casts (review)
• Clarify upgrade migration log: show the data→software transition and migration purpose (#1452)
• fix(blob): default the source-stream idle watchdog ON (120s)
• fix(blob): re-arm idle timer on pipeline backpressure, remove data listener on finish (review)
• chore: prettier --write
• fix(blob): idle watchdog on writeBlobWithStream source to unwedge stalled replication receives

Full Changelog: v5.1.8...v5.1.9