Release date 2026/08/10
Security: Fixed CVE-2026-14916 by binding the JWT algorithm to the
verification key’s type in the jwt_verify node. This means that a symmetric algorithm can
no longer be verified against an asymmetric key, preventing an authentication
bypass where an attacker forges tokens by using the public key as an HMAC
shared secret, under configurations where the node uses a PEM key string and
allowed_algorithms is unset (any algorithm accepted).
Release date 2026/07/21
Added node source and runtime phase metadata to Datakit tracing events so Konnect Debugger can reconstruct the Datakit node graph from captured trace data.
Release date 2026/07/02
Added a non_nil config attribute to the property node. When set to true, GET operations fail with an error if the property is unset, and SET operations fail with an error if the input is nil/null.
Added Konnect Debugger support for Datakit execution, including per-node spans, sanitized trace content capture with vault-aware redaction, and local debug trace responses using the same tracing event model with inline values.
Added Lua control plane compatibility checks to prevent unsupported Datakit configurations from being pushed to older data planes in hybrid mode.
Release date 2026/08/10
Fixed CVE-2026-14916 by binding the JWT algorithm to the
verification key’s type in the jwt_verify node, so a symmetric algorithm can
no longer be verified against an asymmetric key. This prevents an authentication
bypass where an attacker forges tokens by using the public key as an HMAC
shared secret, under configurations where the node uses a PEM key string and
allowed_algorithms is unset (any algorithm accepted).
Release date 2026/07/02
Fixed an issue where configuration parsing failed in packaged builds due to a missing jq parser file.
Release date 2026/06/23
Added Lua control plane compatibility checks to prevent unsupported Datakit configurations from being pushed to older data planes in hybrid mode.
Release date 2026/04/07
Added more implicit node outputs:
* request.path
* request.raw_path
* request.port
* request.method
* request.scheme
* request.version
* service_response.status
* service_response.raw_body
* call.raw_body
Added JWT nodes: jwt_decode for decoding tokens without verification, jwt_verify for signature verification and claim validation using JWKS, and jwt_sign for creating and signing JWTs.
Consumer can now be set via property node.
the call node’s ssl_verify option to verify the TLS certificate
when making HTTPS requests is now enabled by default.
Fixed type system bug to allow defining maps with string values for vault node.
Fixed an issue where datakit cache node instantiate proxy-cache-advanced redis module at config time causing dependency issue on Koko.
Fixed xml_to_json node to recognize text/xml content-type in addition to application/xml for XML request body processing, ensuring RFC 7303 compliance.
Release date 2026/06/30
Added Lua control plane compatibility checks to prevent unsupported Datakit configurations from being pushed to older data planes in hybrid mode.
Release date 2026/02/01
Fixed xml_to_json node to recognize text/xml content-type in addition to application/xml for XML request body processing, ensuring RFC 7303 compliance.
Release date 2025/12/18
Added json_to_xml node to support converting JSON or lua table to XML data.
Added xml_to_json node to support converting XML data to lua table and JSON format.
Added support for dynamic url in call node.
Added support for using the call node in the post-proxy phase.
Add support for using application/x-www-form-urlencoded as the body encoding.
added the ssl_verify flag to the call node. This flag allows
users to control certificate verification when making HTTPS requests to the
configured url endpoint. It cannot be disabled when the
tls_certificate_verify global option is enabled.
Added support for clearing headers from the service_request and response nodes
Fixed implicit request node headers field to be correct type.
Release date 2025/10/01
Added caching support via a new cache node type.
Added support for conditional execution via the branch node.
Added vault support to the Datakit plugin. This unblocks common use cases such as storing secrets in Vault and retrieving them as tokens in Datakit.
Fixed plugin config validation to catch more invalid usage of the property node.
Fixed an issue where an invalid plugin instance could affect other plugins.
Release date 2026/02/26
Fixed plugin config validation to catch more invalid usage of the property node.