Mule Runtime Engine 4.9.0 Release Notes

An <async> scope can now be configured to wait for its in-flight events to finish before flows are stopped during a graceful shutdown, which helps avoid dropped or canceled async work. This behavior is disabled by default and can be enabled through the mule.async.gracefulShutdown.drainInflight system property.

W-23602447

An SDK-based reconnectable message source no longer attempts to reconnect while a graceful shutdown is in progress.

W-23122573

Custom error mappings in the Tracing module are no longer lost on error propagation when an operation inside a tracing:with-correlation-id scope fails, which previously reverted the mapped error type to the raw connector error.

W-21815402

A disposed source policy is no longer left in the policy cache when a flow is stopped and restarted while cache population and flow-stop invalidation occur concurrently.

W-23564125

A memory leak no longer occurs when parallel-foreach and scatter-gather routes leave the route event pinned in a worker thread’s memory after route completion.

W-23829061

Artifact descriptor validation failures during deployment now report more specific exceptions.

W-23047228

A malformed authorization URL no longer occurs when the configured OAuth authorizationUrl contains an existing query parameter.

W-23064254

The HTTP client configurer now includes a method to control whether sensitive headers are filtered when a request is redirected to a different domain.

W-21045658

A forward-proxy client no longer sends a malformed, path-only request line.

W-23384645

A worker thread no longer hangs indefinitely, eventually exhausting the runtime’s thread pool, when a client drops the connection while its HTTP request body is being read.

W-23612974

Netty-based HTTP client requests no longer fail when the response contains a header section larger than 8 KB and a larger response header size limit is configured.

W-23443375

DIGEST authentication in the Netty-based HTTP client no longer fails with a 401 Unauthorized response when the server issues an RFC 7616-compliant challenge.

W-23075291

A NullPointerException no longer occurs during cluster node discovery when using PCF or Kubernetes-based cluster discovery.

W-23466789

Analytics events for requests rejected due to back-pressure are no longer incorrectly reported as HTTP 500 and now correctly report 503 by default. Custom status codes for other error scenarios can also be configured through the anypoint.platform.error.mapping (format NAMESPACE:IDENTIFIER:STATUS_CODE, comma-separated for multiple mappings) and anypoint.platform.error.default system properties.

W-23509148

API Gateway no longer fails to read shard checksums from an ETag header that contains commas.

W-23572494

The fix for idle connections being destroyed and recreated instead of reused when the number of idle connections reached the configured maxIdle limit under concurrent load, introduced in a previous release, is reverted in this release.

W-22716456

The jsoup library is upgraded to 1.23.1.

W-23715606

The Netty library is upgraded to 4.2.17.Final.

W-3300013

The Jackson library is upgraded to 2.22.1.

W-23540341

The RAML Parser library is upgraded to 2-1.2.1.

W-23328348

The com.mulesoft.mule.runtime.gw.api.analytics package is now open to all modules, so the Runtime Manager agent can serialize analytics events.

W-23846531

Worker TLS configuration for Government Cloud is strengthened.

W-23819316

Vulnerable dependencies are upgraded to address reported security vulnerabilities.

W-23924223

You can now configure the size of the DataWeave script parser cache by using the mule.weave.script.parser.cache.size system property.

W-23138851

A thread-safety livelock no longer occurs in the Java module builder and converter caches.

W-23652160

Idle connections are no longer destroyed and recreated instead of being reused when the number of idle connections reaches the configured maxIdle limit under concurrent load.

W-22716456

HTTP/3 requests sent to an HTTP/1 server now correctly fail with a 505 (HTTP Version Not Supported) response.

W-23029577

Requests with a non-numeric Content-Length header are now rejected with a 400 (Bad Request) response.

W-23029480

A batch job no longer fails with a MULE:CANCELLED error during graceful shutdown.

W-23426859

Potential errors thrown during runtime shutdown are now handled correctly.

W-23051939

When running in FIPS mode on a standalone server, the runtime now logs a warning at startup if the JVM java.security file isn’t configured with the required FIPS providers, instead of silently masking the misconfiguration.

W-22794711

The Diagnostic Information Analysis File (DIAF) now includes network information.

W-22383655

The Diagnostic Information Analysis File (DIAF) now includes Mule agent information.

W-22383660

The Diagnostic Information Analysis File (DIAF) now includes a platform connectivity check.

W-22383679

The API gateway resource cache is enabled by default. You can now disable it by setting the anypoint.platform.resource_cache_enabled system property to false.

W-23542185

The Jackson library is upgraded to 2.22.0.

W-23131090

The repeated attribute selector (.*@) now correctly preserves values when processing data structures containing empty map slots.

W-23457314

The Jackson library is upgraded to 2.21.5.

W-23037592

The per_app_java_bean_cache compatibility flag now correctly reports its creation version as 2.9.

W-22417507

Cluster node IDs are no longer generated with negative values.

W-22294724

Graceful shutdown no longer times out when a global error handler runs for a flow.

W-22434375

Long-running internal tasks no longer use the shared forkJoin pool during parallel flow shutdown and bootstrap configuration, preventing thread starvation.

W-22279521

Duplicate XSD elements are no longer generated for connection providers declared at both the extension and configuration levels.

W-20824537

Shutdown validation for dynamic configurations can now be skipped by enabling the mule.forcefulShutdown.dynamicConfig.disableStoppingCheck system property.

W-22772644

Flows with a scheduler source are no longer left in an invalid state after a flow restart.

W-22918240

Stopping a flow no longer waits unnecessarily when no events are being processed.

W-22969411

Project versions defined with properties are now resolved recursively.

W-22845430

Extension packager validation no longer fails for operations annotated with @Validator that use a CompletionCallback operation.

W-22817376

Events that are dropped within a processing hook are now properly completed and terminated.

W-22470584

The Netty HTTP listener now rejects HTTP/1.1 requests that have a missing or duplicate Host header, in compliance with RFC 9112.

W-23052713

The Content-Length header is now removed based on the actual entity byte length.

W-22570070

SDK sources that don’t implement Reconnectable are no longer restarted during graceful shutdown.

W-21563258

The maximum size of the dynamic flow-ref cache is now configurable through the mule.flowRef.dynamicCacheMaxSize system property, which defaults to 20.

W-22219018

The Jackson Databind library is upgraded to 2.21.4.

W-3300013

The OpenTelemetry API library is upgraded to 1.62.0.

W-22806027

The c3p0 library is upgraded to 0.14.1.

W-23012713

The Apache Neethi library is upgraded to 3.2.1.

W-22939389

The Apache CXF library is upgraded to 3.6.11.

W-23037617

The Rhino library is upgraded to 1.8.1.

W-22939391

The Log4j library is upgraded to 2.25.4.

W-22939403

The Reactor Netty library is upgraded to 1.2.18.

W-22939384

The Spring Framework is upgraded to 6.2.19.

W-22956997

The Netty library is upgraded to 4.2.15.Final.

W-22956998

The Bitronix Transaction Manager library is upgraded to 2.1.21.

W-22405007

Scope resolution errors no longer occur when importing Java classes with self-referential array properties.

W-22914494

AvroReader no longer causes memory leaks when processing Avro data in long-running flows.

W-22364385

Connectivity testing of configurations in clustered deployments no longer uses distributed locks, preventing deadlocks.

W-22248198

Fatal errors such as StackOverflowError are now logged instead of being consumed by internal error handling.

W-22496803

Mule no longer hangs during shutdown when a parameter validation exception occurs during flow execution.

W-22248534

Race conditions in outerFluxCompletionScheduler no longer occur during graceful shutdown.

W-22343018

The ObjectStore retrieved from the Registry in OAuthHandler is now properly initialized and started.

W-22373641

SDK parameter validation errors now raise the MULE:VALIDATION error type instead of MULE:UNKNOWN.

W-22276522

Race conditions during policy redeployment that caused Mule to stop processing events permanently no longer occur.

W-22343705

ConcurrentModificationException errors no longer occur when multiple plugins with shared dependencies are deployed simultaneously.

W-21193046

Cluster encryption now uses the configured algorithm correctly instead of defaulting to Blowfish.

W-21666905

The error type in the EE Cache scope is now correctly reported as MULE:RETRY_EXHAUSTED instead of EE:RETRY_EXHAUSTED when until-successful exhausts its retries.

W-21525972

Large Anypoint Platform authentication failure responses no longer cause excessive log bloat.

W-21882516

Persistent ObjectStore or Batch data serialized before a patch upgrade now deserializes correctly after upgrading.

W-22623626

OutOfMemory errors no longer occur when establishing SSL connections with HTTP endpoints.

W-22547971

StackOverflowError errors no longer occur when computing or converting type metadata for self-referencing recursive types.

W-21712344

The Java bean metadata cache no longer performs unnecessary evictions when processing Java POJOs. A new per-app Java bean cache can be enabled with the per_app_java_bean_cache compatibility flag.

W-22417507

Configuration references to configs defined in a parent domain are now properly validated at deployment time, preventing unclear runtime errors.

W-11453332

Extension operations using @Content parameters with complex map structures no longer fail to deploy.

W-18034452

The Grizzly HTTP library is upgraded to 2.3.36-MULE-029.

W-21337433

The plexus-utils library is upgraded to 4.0.3.

W-21774430

HTTP 304 (Not Modified) responses sent through the HTTP listener no longer include an incorrect Content-Length header.

W-21632770

The HTTP listener now gracefully handles non-RFC-compliant date formats in Set-Cookie Expires attributes.

W-21860840

The Netty library is upgraded to 4.2.12.Final.

W-21795152

In-memory Object Store partitions now correctly use cluster-wide storage when deployed to a cluster with the Object Store plugin enabled.

W-17714668

A memory leak in dynamic flow-ref resolution that could eventually lead to an OutOfMemoryError no longer occurs.

W-22013292

Deserialization errors no longer occur in Redis-backed Object Stores when accessing cached data created on an earlier Mule runtime version.

W-20880559

API Gateway contracts for public OAuth clients using PKCE are no longer dropped when the client secret is null.

W-21177224

The support-tools-installer is removed from the Mule runtime distribution.

W-21842339

atBeginningOfDay now returns the midnight offset on DST days, instead of the input offset.

W-21614817

The c3p0 library is upgraded to 0.12.0.

W-21391116

The mchange-commons-java library is upgraded to 0.4.0.

W-21391115

The Jackson Core library is upgraded to 2.18.6.

W-21420104

NullPointerException errors no longer occur in the Log4j boot configuration during application shutdown when shutdown callbacks are canceled while the Log4j context factory is disposing, which previously caused failures due to concurrent execution of dispose() and cancel().

W-20256082

Until Successful scopes no longer continue retrying during application shutdown when using flow-ref.

W-20267296

NullPointerException: No Context at location errors no longer occur when using operation policies with routers or scopes.

W-20791354

OAuth token storage now correctly uses custom ObjectStores (such as Redis) configured through the Object Store parameter when they’re registered in the application registry instead of the ObjectStoreManager.

W-19811593

Exception reached subscriber errors no longer occur when combining interceptors and operation policies.

W-21250126

Scheduler jobs no longer deadlock during flow shutdown.

W-21263748

TLS Context can now be initialized during application deployment by using the mule.enable.inline.tls.context.initialization feature flag.

W-20038933

Netty no longer attempts to send more bytes than specified in the Content-Length header.

W-21184863

Netty server read timeouts now consider requests being read instead of requests being processed.

W-21321115

Netty HTTP Client no longer throws exceptions when a proxy server returns a 407 response and now returns the 407 response instead.

W-21465366

Netty response timeout behavior is now consistent with Grizzly.

W-21547186

Netty TLS connection failures now appear as DEBUG logs instead of WARN logs.

W-21428392

Netty HTTP Client now filters duplicate Content-Type headers.

W-21344116

The exception raised by Netty for unresolved addresses is now consistent with the Grizzly implementation.

W-21515340

The Avro library is upgraded to 1.12.1. The Jackson Core library is upgraded to 2.21.1.

W-21415439

The Jakarta Mail library is upgraded to 2.1.5.

W-21320250

The range operator now returns null for invalid ranges.

W-21781423

The jakarta.mail library is upgraded to 1.6.8.

W-21138257

When the mule.forcefulShutdown.dynamicConfig.disableStoppingCheck system property is enabled, the dynamic configuration check is disabled during graceful shutdown.

W-20890587

When the mule.forcefulShutdown.raiseCancelledError feature flag is enabled, Mule runtime now raises a MULE:CANCELLED error instead of a MULE:UNKNOWN error if it attempts to create a dynamic configuration during shutdown.

W-20890613

Extensions no longer export mule-sdk-api and jakarta dependencies in the mule-artifact.json file.

W-21001749

Client certificates (optional) are no longer requested when no trust store is configured.

W-21220031

Public flows now stop concurrently during graceful shutdown.

W-21228085

Deadlocks no longer occur during log reconfiguration when policies are applied.

W-21231834

Errors that are not MessagingException errors are no longer silenced.

W-21043969

When the mule.enableLogEventDumpOnShutdown system property is enabled, the event dump is now logged during application shutdown.

W-21232374

The "java.lang.IllegalStateException: The client must be started before use." errors no longer occur when requesting an OAuth access token.

W-17689958

When the mule.propagate.objectStore.customization.to.policies feature flag is enabled, policies now respect their configured TTL when using Object Store v2.

W-21215761

The "API is blocked (unavailable)" log message no longer appears during policy updates without a corresponding unblocked message.

W-20633888

APIkit flows that use non-default names and are mapped through the flow-mapping parameter on apikit:config are now correctly counted as public flows instead of being treated as private.

W-18668900

The Array range selector operator no longer experiences performance degradation.

W-20220578

Concurrent access to KeyValuePairs inside lazy materialized objects no longer causes unexpected behavior.

W-21045501

Batch jobs no longer hang when errors occur in steps that use try scopes with global error handlers.

W-17738563

Applications no longer become unresponsive after thread pool exhaustion when using Netty as the HTTP Service implementation with the Anypoint MQ Connector.

W-19806707

Design-time operations on primary content parameters with non-Java types now work correctly.

W-20187776

Logging information is now improved during graceful shutdown.

W-20278970

A deadlock between Log4j Mule log support during application initialization no longer occurs.

W-20419795

The HTTP Client can now establish an SSE source when the content-type header doesn’t exactly match text/event-stream.

W-20420476

MUnit tests no longer fail intermittently when running on Java 17.

W-17044721

Batch processing no longer fails with serialization error when LDAP action throws an error in Java 17.

W-19524600

Dynamic configurations now work correctly during initialization when using hashCode and equals methods on a TLSConfiguration class.

W-18835469

Functions now materialize correctly when the function body contains a single var declaration.

W-20365331

The stream reader now processes input with multi-byte characters correctly.

W-20016549

OpenTelemetry current API sampling decisions now propagate correctly through http:requester calls to downstream APIs.

W-19784910

UndeclaredThrowableException errors no longer occur during Bitronix reconnection.

W-15196888

InaccessibleObjectException errors no longer occur during deployment when the mule.classloading.verbose property is set.

W-18563387

MDC information is now properly preserved when using loggers inside custom Java code invoked from a DataWeave script.

W-18912999

Batch queuestore files now clean up correctly in rare load failure scenarios such as out-of-memory errors.

W-17935223

Builds no longer fail when running tests from an extension that uses Mule SDK with Java 8 through Java 17.

W-18964335

Starvation no longer occurs when sending HTTP responses that are generated slowly.

W-1982570

The until-successful scope now honors the graceful shutdown timeout. To enable this behavior, set these system properties: mule.untilSuccessful.retryOnCriticalError.disallow=true and mule.forcefulShutdown.raiseCancelledError=true.

W-19648397

Hashing now uses toHex conversion to prevent “null character” or other invalid characters from being used as IDs in the redelivery policy. This change is feature-flagged. To enable it in version 4.9, set the mule.redeliveryPolicy.encode.secureHash system property to true.

W-18584560

IllegalAccessException errors no longer occur when DataWeave serializes error.errorMessage in a Scatter-Gather error route.

W-19340663

Mule applications that use TLS KeyStore configurations no longer fail to deploy with “NO MODEL RESOLVED” warnings and ConfigurationException errors.

W-16565012

Mule Troubleshooting Plugin executions no longer fail when the IP address changes.

W-19802474

SSE clients can now parse events that do not include an event field. These events now default to message, as described in the specification.

W-19667148

The reactor.netty library is upgraded to 1.2.10.

W-17264514

The netty library is upgraded to 4.2.7.Final.

W-19995637

The spring-core library is upgraded to 6.2.11.

W-19674953

The Apache Commons Lang dependency is removed from the distribution.

W-19803454

Materialization errors no longer occur when running functions.

W-19884071

Single variable materialization now works correctly for unsafe and exists selectors.

W-19581017

Each variable is now extracted from vars to manage materialization individually.

W-19580992

Memory leaks no longer occur when a reconnection is configured in a Mule domain and referenced from multiple applications.

W-17857080

InaccessibleObjectException errors no longer occur when using cluster mode on Java 17.

W-18667744

Fork-join routers no longer create unnecessary schedules when the timeout is set to infinite.

W-18347293

Potential deadlocks during deployment no longer occur when using some custom Log4j appenders.

W-19675881

Cookies now propagate correctly across multiple redirect scenarios.

W-18971065

The Netty library is upgraded to 4.1.124.Final.

W-19341592

The Handlebars library is upgraded to 4.4.0.

W-19064659

The org.apache.commons : commons-lang3 library is upgraded to 3.17.0.

W-19383955

The io.netty : netty-codec library is upgraded to 4.1.127.Final.

W-19568278

The org.springframework : spring-core library is upgraded to 6.2.10.

W-19353311

The org.apache.cxf:cxf-core library is now upgraded to 3.5.11.

W-17264514

The org.mule.runtime.api.serialization.SerializationException: Could not deserialize object errors no longer occur when processing the payload of a Query XML stream using transfer message in a Choice Router.

W-18902280

Scheduler name generation no longer breaks the platform logging aggregator when processor chains have null or empty names.

W-19432758

SSE clients now parse events that don’t include an event field. They default to message as described in the spec.

W-19667148

Possible starvation no longer occurs when sending HTTP responses that are generated slowly.

W-19471841

Gatekeeper deadlock errors no longer occur during race conditions between contract downloads and policy application.

W-19407164

The take function now works with streaming when argument is larger than the array length.

W-19168279

java-module now supports object fields access when using different capitalizations.

W-19477334

TLS configuration for FIPS-140-2 is now upgraded.

W-16315176

Applications using Scheduler component in a strict FIPS-140-2 environment no longer fail to deploy due to the unavailability of the MD5 algorithm.

W-19319437

io.projectreactor.netty : reactor-netty-http is upgraded to 1.2.8.

W-19074903

Component annotations, such as location, are no longer overwritten by other components.

W-18269859

org.apache.commons : commons-lang3 is upgraded to 3.18.0.

W-19059553

A memory leak during Weave type schema resolution is now fixed.

W-19389019

Potential deadlocks no longer occur when increasing concurrency while parsing DataWeave scripts.

W-19376546

Silent errors and hangs no longer occur when a component fails to start within a foreach/subflow combination.

W-18589595

An incorrect error level message no longer shows during deployment when using APIKit with no flow mappings.

W-19004884

Logging behavior when combining properties and expressions is reverted to the previous behavior.

W-18822321

Performance degradation no longer occurs when using repeatable streaming.

W-19175330

OAuth token is now refreshed when used through ExtensionClient.

W-19248279

A stackOverflowException error no longer occurs during materialization.

W-18981240

The distinctBy function in dw::core::Core now works as expected when used with a CSV input.

W-18990604

DataWeave runtime types are now correctly written when outputting Java.

W-18942349

Access to multipart content raw value no longer reads the part content.

W-18892158

The sizeOf function now works correctly in DataWeave 2.6.14 and later.

W-18850597

The orderBy function now evaluates ordering criteria only when required.

W-18851259

DataWeave now correctly serializes CompositeRoutingException to JSON.

W-16562974

The Parser Template now correctly resolves placeholder expressions.

W-16761707

The commons-beanutils:commons-beanutils library is upgraded to v1.11.0.

W-18687846

Repeatable streams now make data available before the buffer is full. To enable this behavior, set the system property mule.repeatableStreaming.bytes.eagerRead to true.

W-18716253

Schedulers are no longer triggered during graceful shutdown.

W-17981248

OAuth logging is now added when doing token update.

W-18622349

Serialization now works correctly with API Gateway internal classes.

W-18475283

Reading a CSV file inside a MultiPart body now works correctly when performed more than once.

W-17167283

XML encoding detection now works correctly when the declaration header is missing.

W-18853667

The fromCharCode function in dw::core::Strings. now manages surrogate characters correctly.

W-17204482

Unicode characters now render correctly at the beginning of the string when using the DataWeave writer function with the onlyData flag enabled.

W-14855645

The Apache POI library is now upgraded.

W-18253747

Experimental warning messages are no longer logged on DataWeave SDK files.

W-16384926

Loader constraint violation errors no longer occur when http-connector dependencies exist in both the domain and the policy.

W-17340911

Serialization of result objects with Kryo no longer fails with InaccessibleObjectException in Java 17.

W-17774685

Class loading no longer results in deadlocks caused by a race condition.

W-18388443

A serialization exception no longer occurs when using caching scope.

W-17703164

A classloader leak no longer occurs on undeployment when using lazy service initialization.

W-17750750

The mule.parse.template.use.legacy.default.targetValue compatibility switch is reintroduced to use the legacy default value for the targetValue parameter of the parse-template component. A one-time warning is now logged when enabled.

W-18324755

Preemtive analytics queue deletion is now added.

W-17529530

XML encoding is now detected before selecting a parser.

W-17637749

The performance of the orderBy function is now improved.

W-18439576

Reading a CSV file inside a MultiPart body now works correctly when performed more than once.

W-17147598

A memory leak of the binding context no longer occurs when using the foreach scope.

W-18472194

CompilationResult no longer retains a reference to the execution frame, which previously caused a memory leak.

W-18288980

The Netty codec library is now updated to 4.1.119.Final.

W-17980407

You can now use the mule --verifyLicenseDetails [path-to-license.lic] command to verify a given license file.

W-17340620

DuplicateMessageException is now correctly serialized with Kryo.

W-17844603

Error type in raise-error is now correctly resolved when defined with a static property.

W-17339304

org.apache.cxf:cxf-core is now upgraded to version 3.5.10.

W-17896358

The mule-sdk-api dependency now contains all the required license information.

W-18033237

Concurrency issues no longer occur when loading modules.

W-17918619

The flat file module no longer fails when loading files with a nested depth greater than 50.

W-17495145

xerces-j is now updated to 2.12.2.

W-16918194

Resources are now properly released after a timeout when using the Scatter-Gather or Parallel For Each routers. The mule.forkJoin.completeChildContextsOnTimeout feature flag is now added to enable this behavior.

W-16941297

MessagingException can now be converted to JSON using DataWeave.

W-16629236

Performance degradation no longer occurs when the nonBlockingWriter is enabled for response streaming.

W-17627284

A race condition introduced by W-17048606 no longer occurs, where the last part of the response body was truncated when streamResponse flag is set to true in request-connection.

W-17617940

grizzly-ahc is now upgraded in HTTP Service.

W-17667949

When using sdk-api version of @Connection and ConnectionProvider in a source, a validation saying that @Connection can only be used with the extensions-api version of ConnectionProvider is no longer triggered.

W-17559243

Kryo serialization issue no longer occurs in Java 17 when running with distributed cluster using authentication, caching policy, and persistent Object Store.

W-16912085

Performance during cache scope execution is now improved.

W-17671126

The com.hazelcast:hazelcast dependency is downgraded to 5.2.5.

W-17905862

The Java reflection lookup strategy is now improved for bean instances.

W-17624594

Consuming values now work as expected when using overloaded materialized functions.

W-17588914