IMPROVEMENTS:

• dependency: Upgrade to the latest buf (1.72.0), protoc-gen-go (1.36.6), and protoc-gen-go-grpc (1.5.1) [GH-28525]
• services: the default workload identity policy now allows using wildcard namespace queries for Nomad native services [GH-28534]
• ui: fixed accessibility color contrast issues [GH-28022]

BUG FIXES:

• api: Fix job statuses error when request body is empty using HTTP2 [GH-28541]
• client: Fixed a bug where task restart skipped shutdown_delay [GH-25289]
• core: Fixed a bug where re-submitting an otherwise unchanged job with a different ACL token created a new job version and deployment [GH-26810]
• deployments: Fixed a bug where system job updates would not result in a new deployment if the prior deployment failed [GH-28545]
• docker: Fixed a bug where image_pull_timeout was not respected if more than 5min [GH-28543]
• identity: Fixed a bug where clients would not attempt to recreate expired node identities [GH-28566]
• namespaces: Fixed a bug where an invalid replication token could delete namespaces in a federated follower region [GH-28552]
• namespaces: Fixed a bug where namespaces could stop replicating between federated regions [GH-28552]
• node pools: Fixed a bug where an invalid replication token could delete node pools in a federated follower region [GH-28552]
• node pools: Fixed a bug where blocking queries would not unblock if a node pool was added automatically by registering a node [GH-28552]
• node pools: Fixed a bug where node pools could stop replicating between federated regions [GH-28552]

SECURITY:

• dependency: Upgrade to the latests go-getter [GH-28510]

IMPROVEMENTS:

• api: Updated the Go module to require at least 1.26.0 [GH-28460]
• build: Updated Go to v1.27.1 [GH-28451]
• client: Added the unique.host_id node attribute to the host fingerprint, when available [GH-28406]
• job: Allow setting reschedule.delay to values as low as 1s [GH-28477]
• jobspec2: Decouple from Nomad core with isolated Go module named github.com/hashicorp/nomad/jobspec2 [GH-28419]
• scheduler: Improved robustness of reschedule logic for invalid states [GH-28445]
• ui: prevent stuck requests due to exceeding connection limit, enable HTTP2 [GH-28364]

BUG FIXES:

• api: Fixed a bug where a job plan diff sorted indexed fields such as args lexically, listing args[10] before args[2] [GH-4421]
• client: prevent Alloc FS API from accessing secret dir when symlinked into task [GH-28468]
• core: Fixed a bug where an artifact checksum of the form file:<url> (fetching the checksum from a remote file) was rejected during job validation [GH-9764]
• jobspec: Fixed a bug where a task group containing only lifecycle tasks and no main task was accepted during job validation [GH-17570]
• planner: Fixed a bug where valid evaluations could be unnecessarily retried, delaying workload placement under load [GH-28452]
• scheduler: Fixed a bug where task groups with per_alloc volumes could skip real feasibility checks for allocs after the first placement failure in the same task group [GH-28422]
• state: Fixed a bug where plans from older versioned followers did not have allocation resource schemas upgraded when written on the leader [GH-28447]
• vault: Fixed a bug where a task's change_mode was triggered on each Vault token renewal [GH-28409]
• vault: fixes an issue where dead tasks continued to have their tokens renewed [GH-28501]

BREAKING CHANGES:

• plugin: The DriverNetwork.Hash method has been removed from the plugin/drivers package. [GH-28342]

IMPROVEMENTS:

• build: Update Go to v1.26.5 [GH-28260]
• checks: Nomad native service check IDs are now SHA256 [GH-28361]
• cli: add -json-output and -t flags to nomad job plan for structured plan output [GH-27369]
• consul: Added the issuing Nomad client's node ID to the metadata of Consul tokens created via workload identity [GH-28133]
• consul: Check IDs are now derived from SHA256 instead of SHA1 [GH-28362]
• jobspec: Removed the requirement that a variable validation error_message be a full English sentence, allowing messages written in any language [GH-28246]
• planner: Added plan_apply_pipeline configuration that allows the leader to have more outstanding Raft writes when evaluating plans [GH-28249]
• services: rendezvous hashes are now SHA256 [GH-28363]
• template: Add run_on_first_render option to change_script to execute scripts on the initial template render via the task Poststart lifecycle hook. [GH-27819]

BUG FIXES:

• agent: Fixed a bug where the startup banner would display the wrong node ID for servers after restart [GH-28276]
• api: Fixed a bug where the client allocation endpoints returned a 500 error instead of a 404 when the allocation's node could not be found [GH-28261]
• auth: Fixed a bug where nodes could not sync allocations placed on them after being moved to a different node pool [GH-28110]
• cli: Fixed a bug where nomad operator root keyring remove would not accept an abbreviated key ID [GH-24148]
• client: Fix issue where deleted allocations may remain running [GH-28394]
• client: Fixed a bug where a client could panic after an alloc is GC'd [GH-28187]
• client: Fixed a bug where the client would not remount the secret and private tmpfs after a restart [GH-28345]
• client: Fixed a bug where the previous allocation watcher would retry forever when the server returned a permanent error during data migration [GH-28191]
• csi: Fixed a bug where evals blocked on missing CSI volumes would not unblock [GH-28275]
• deployments: Fix garbage collection to respect threshold [GH-28225]
• docker: Fixed a bug where tasks could execute outside of their assigned cpuset range [GH-28272]
• drivers/java: Fixed a bug where the Java driver did not correctly decode the work_dir option [GH-28330]
• jobspec: Fixed a bug where a negative cores value in a task's resource block was accepted during job validation and registration [GH-10511]
• quota (Enterprise): Fixed a bug where disabling the use of cores in a quota would block the ability to use either cores or CPU in a job
• scheduler: Ensure deployment IDs are not written to an evaluation when the generated deployment is not persisted to state due to plan apply retries [GH-28307]
• scheduler: Fixed a bug where the scheduler could panic with a nil pointer dereference when checking host volume feasibility for an allocation whose job had been purged [GH-28301]
• secrets: Fixed hooks to allow refetch during prestart [GH-28237]
• services: Fixed a bug where task secrets were not interpolated into service check Header and Args, or into service Tags [GH-28212]
• ui: Fixed SSO sign in display not displaying when SSO enabled [GH-28262]
• ui: Fixed a bug where the job status panel would show "Complete" instead of "Scaled Down" for system and sysbatch jobs with zero allocations [GH-27949]
• ui: Fixed the region identifier header showing as empty in single region clusters [GH-28310]
• ui: Fixed version diff display and missing deployment version numbers [GH-28294]
• ui: check websocket upgrade headers with multiple values [GH-28234]
• ui: refetch nomad license when logging in with new token [GH-28284]

SECURITY:

• docker: Enforce allowed_modes or allow_privileged requirement to set host namespace modes in task. This is CVE-2026-14891. [GH-28190]
• docker: Fixed a bug where docker tasks could use a symlink to bypass the plugin configuration for volumes.enabled=false. This is CVE-2026-14896. [GH-28177]
• dynamic host volumes: Fixed a bug where users with host-volume-delete in one namespace could delete claims from another namespace [GH-28205]

IMPROVEMENTS:

• consul: Allow service, template, and connect blocks to fallback to the Nomad client agent's Consul token if workload identity is unavailable [GH-28106]
• driver: Added optional Init function for task driver plugins [GH-28104]
• driver: Added optional Shutdown function for task driver plugins [GH-28102]

BUG FIXES:

• api: allow using WI tokens on plan endpoint [GH-28139]
• cli: Fixed a bug where complex HCL variables passed via -var flag could not be edited in the web UI [GH-28138]
• dynamic host volumes: Fixed a bug where allocations claiming host volumes with the per_alloc flag would not prevent the volume from being deleted [GH-28198]
• metrics: expired metrics are now periodically cleared from the Prometheus sink even if no collection occurs [GH-28170]
• scheduler: Fixed a bug where a node could be marked feasible for a task group requesting multiple host volumes when a satisfied sticky volume request short-circuited the checks for the remaining requests [GH-28097]
• scheduler: Fixed a bug where setting sticky on a static host volume could fail the evaluation instead of being rejected during feasibility checking [GH-28097]
• scheduler: keep draining batch alloc counted when node is re-enabled [GH-28018]
• task runner: Improve the memory management for secrets [GH-28140]
• ui: Fixed a bug where jobs that share a ModifyIndex (for example, several jobs rescheduled in a single Raft transaction after a node failure) were omitted from the jobs page and the /v1/jobs/statuses endpoint [GH-28132]
• ui: fixes an issue where streaming task logs would error [GH-28137]

SECURITY:

• docker: Enforce allowed_modes or allow_privileged requirement to set host namespace modes in task. This is CVE-2026-14891. [GH-28190]
• docker: Fixed a bug where docker tasks could use a symlink to bypass the plugin configuration for volumes.enabled=false. This is CVE-2026-14896. [GH-28177]
• dynamic host volumes: Fixed a bug where users with host-volume-delete in one namespace could delete claims from another namespace [GH-28205]

IMPROVEMENTS:

• consul: Allow service, template, and connect blocks to fallback to the Nomad client agent's Consul token if workload identity is unavailable [GH-28106]
• driver: Added optional Init function for task driver plugins [GH-28104]
• driver: Added optional Shutdown function for task driver plugins [GH-28102]

BUG FIXES:

• api: allow using WI tokens on plan endpoint [GH-28139]
• cli: Fixed a bug where complex HCL variables passed via -var flag could not be edited in the web UI [GH-28138]
• dynamic host volumes: Fixed a bug where allocations claiming host volumes with the per_alloc flag would not prevent the volume from being deleted [GH-28198]
• metrics: expired metrics are now periodically cleared from the Prometheus sink even if no collection occurs [GH-28170]
• scheduler: Fixed a bug where a node could be marked feasible for a task group requesting multiple host volumes when a satisfied sticky volume request short-circuited the checks for the remaining requests [GH-28097]
• scheduler: Fixed a bug where setting sticky on a static host volume could fail the evaluation instead of being rejected during feasibility checking [GH-28097]
• scheduler: keep draining batch alloc counted when node is re-enabled [GH-28018]
• task runner: Improve the memory management for secrets [GH-28140]
• ui: Fixed a bug where jobs that share a ModifyIndex (for example, several jobs rescheduled in a single Raft transaction after a node failure) were omitted from the jobs page and the /v1/jobs/statuses endpoint [GH-28132]
• ui: fixes an issue where streaming task logs would error [GH-28137]

2.0.4 (July 07, 2026)

SECURITY:

• docker: Enforce allowed_modes or allow_privileged requirement to set host namespace modes in task. This is CVE-2026-14891. [GH-28190]
• docker: Fixed a bug where docker tasks could use a symlink to bypass the plugin configuration for volumes.enabled=false. This is CVE-2026-14896. [GH-28177]
• dynamic host volumes: Fixed a bug where users with host-volume-delete in one namespace could delete claims from another namespace [GH-28205]

IMPROVEMENTS:

• cli: Add a -kv-path flag to nomad setup vault to configure the Vault KV mount used by the generated workload policy [GH-28183]
• cli: Added -json and -t options to the operator autopilot get-config command. [GH-27991]
• client: Add tunable for Vault default lease duration on templates for paths without leases. [GH-28199]
• consul: Allow service, template, and connect blocks to fallback to the Nomad client agent's Consul token if workload identity is unavailable [GH-28106]
• driver: Added optional Init function for task driver plugins [GH-28104]
• driver: Added optional Shutdown function for task driver plugins [GH-28102]
• scheduler: Stop failed allocations first when downscaling a task group [GH-27971]

DEPRECATIONS:

• agent: Unauthenticated server join via the CLI or API is deprecated. [GH-28176]

BUG FIXES:

• api: allow using WI tokens on plan endpoint [GH-28139]
• cli: Fixed a bug where complex HCL variables passed via -var flag could not be edited in the web UI [GH-28138]
• client: Fixed a bug where a client could panic after an alloc is GC'd [GH-28187]
• dynamic host volumes: Fixed a bug where allocations claiming host volumes with the per_alloc flag would not prevent the volume from being deleted [GH-28198]
• metrics: expired metrics are now periodically cleared from the Prometheus sink even if no collection occurs [GH-28170]
• scheduler: Fixed a bug where a node could be marked feasible for a task group requesting multiple host volumes when a satisfied sticky volume request short-circuited the checks for the remaining requests [GH-28097]
• scheduler: Fixed a bug where setting sticky on a static host volume could fail the evaluation instead of being rejected during feasibility checking [GH-28097]
• scheduler: keep draining batch alloc counted when node is re-enabled [GH-28018]
• task runner: Improve the memory management for secrets [GH-28140]
• ui: Fixed a bug where jobs that share a ModifyIndex (for example, several jobs rescheduled in a single Raft transaction after a node failure) were omitted from the jobs page and the /v1/jobs/statuses endpoint [GH-28132]
• ui: fixes an issue where streaming task logs would error [GH-28137]

FEATURES:

• core: timeouts for batch jobs [GH-27803]

SECURITY:

• cli: Redact token and certificate key CLI flags and environment variables when writing debug bundle [GH-28063]

IMPROVEMENTS:

• acl: Support uploading client ACL tokens [GH-27741]
• alloc: don't restore when allocDir is inaccessible [GH-27933]
• api: added agent reload endpoint [GH-27106]
• build: Updated Go to 1.26.4 [GH-28080]
• client: Adds default_ineligible configuration option [GH-27965]
• identity: allow additional claims to be added to workload identities [GH-27786]
• vault: adds token renewal retries [GH-27947]

BUG FIXES:

• audit (Enterprise): Fixed a bug where alloc exec and job actions requests from the webbrowser would be marked as anonymous in audit logs [GH-28025]
• cli: Fixed job dispatch and job periodic force failing with a paginator error against servers older than the CLI [GH-27680]
• client: Fixed a bug where tasks could accidentally get killed mid-restart on template re-render [GH-27960]
• consul: re-write consul service identity token when reattaching to task [GH-27936]
• job (Enterprise): Renabled use of multiple vault namespaces in a single job
• plugins: store verified and canonicalised plugin configuration in the agent [GH-28083]
• template: Fixed a bug where templates with change_mode=noop would stop monitoring templates that fatally fail after initial rendering [GH-28016]
• ui: Fix a bug where jobs with HCL variables submitted via Terraform could not be started or stopped in the web UI [GH-28095]
• ui: Fix service detail page not rendering [GH-28005]
• ui: Fixed flickering on the log streaming pop out when viewing them from job overview page [GH-28074]
• ui: Fixed the client drain popover form to provide an accessible name for assistive technologies [GH-28047]
• ui: Fixed the drain popover deadline field so its label is properly associated with the input for improved accessibility [GH-28029]
• ui: Fixed the namespace list being continually fetched when on the job overview page [GH-28074]

SECURITY:

• cli: Redact token and certificate key CLI flags and environment variables when writing debug bundle [GH-28063]

IMPROVEMENTS:

• build: Updated Go to 1.26.4 [GH-28080]
• vault: adds token renewal retries [GH-27947]

BUG FIXES:

• audit (Enterprise): Fixed a bug where alloc exec and job actions requests from the webbrowser would be marked as anonymous in audit logs [GH-28025]
• client: Fixed a bug where tasks could accidentally get killed mid-restart on template re-render [GH-27960]
• client: fix a bug where we could accidentally overwrite task states [GH-27944]
• consul: re-write consul service identity token when reattaching to task [GH-27936]
• job (Enterprise): Renabled use of multiple vault namespaces in a single job
• plugins: store verified and canonicalised plugin configuration in the agent [GH-28083]
• template: Fixed a bug where templates with change_mode=noop would stop monitoring templates that fatally fail after initial rendering [GH-28016]
• ui: Fix a bug where jobs with HCL variables submitted via Terraform could not be started or stopped in the web UI [GH-28095]
• ui: Fix service detail page not rendering [GH-28005]
• ui: Fixed a bug where the evaluation detail panel would render improperly [GH-27987]
• ui: Fixed flickering on the log streaming pop out when viewing them from job overview page [GH-28074]
• ui: Fixed the client drain popover form to provide an accessible name for assistive technologies [GH-28047]
• ui: Fixed the drain popover deadline field so its label is properly associated with the input for improved accessibility [GH-28029]
• ui: Fixed the namespace list being continually fetched when on the job overview page [GH-28074]

SECURITY:

• cli: Redact token and certificate key CLI flags and environment variables when writing debug bundle [GH-28063]

IMPROVEMENTS:

• build: Updated Go to 1.26.4 [GH-28080]
• vault: adds token renewal retries [GH-27947]

BUG FIXES:

• audit (Enterprise): Fixed a bug where alloc exec and job actions requests from the webbrowser would be marked as anonymous in audit logs [GH-28025]
• client: Fixed a bug where tasks could accidentally get killed mid-restart on template re-render [GH-27960]
• client: fix a bug where we could accidentally overwrite task states [GH-27944]
• consul: re-write consul service identity token when reattaching to task [GH-27936]
• job (Enterprise): Renabled use of multiple vault namespaces in a single job
• plugins: store verified and canonicalised plugin configuration in the agent [GH-28083]
• template: Fixed a bug where templates with change_mode=noop would stop monitoring templates that fatally fail after initial rendering [GH-28016]
• ui: Fix a bug where jobs with HCL variables submitted via Terraform could not be started or stopped in the web UI [GH-28095]
• ui: Fix service detail page not rendering [GH-28005]
• ui: Fixed a bug where the evaluation detail panel would render improperly [GH-27987]
• ui: Fixed flickering on the log streaming pop out when viewing them from job overview page [GH-28074]
• ui: Fixed the client drain popover form to provide an accessible name for assistive technologies [GH-28047]
• ui: Fixed the drain popover deadline field so its label is properly associated with the input for improved accessibility [GH-28029]
• ui: Fixed the namespace list being continually fetched when on the job overview page [GH-28074]

2.0.2 (May 22, 2026)

BUG FIXES:

• acl: fix rpc permission denied error when using node_pool="all" [GH-27973]
• ui: Fixed a bug where the client detail page would fail to render [GH-27958]
• ui: Fixed a bug where the topology page would fail to render [GH-27958]
• ui: Fixed a bug where the evaluation detail panel would render improperly [GH-27987]