https://docs.varnish-software.com/news/ Recent content in News on Varnish Software Documentation Hugo -- gohugo.io en-us https://docs.varnish-software.com/releases/varnish-controller-7.4.1/ Fri, 13 Mar 2026 06:00:00 +0000 https://docs.varnish-software.com/releases/varnish-controller-7.4.1/ This release is only for the new feature keep-invalidations. Brainz, apigw, vcli and UI need to be updated for this release in order to get the keep-invalidation feature to work. Invalidations can now be marked with keep so that they are kept and not automatically removed. They can then be re-executed at a later time. Kept invalidations needs to be manually removed. Fixed a bug where the permission for purger tokens was missing in the UI. https://docs.varnish-software.com/releases/varnish-helm-chart-1.7.7/ Thu, 12 Mar 2026 15:00:00 +0900 https://docs.varnish-software.com/releases/varnish-helm-chart-1.7.7/ This is a patch release for the Varnish Helm Charts. For varnish-enterprise: Updated varnish-enterprise image to 6.0.16r13 See Varnish Helm Chart Changelog for a full changelog https://docs.varnish-software.com/releases/varnish-controller-7.4.0/ Tue, 10 Mar 2026 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-controller-7.4.0/ This is a minor release. It is most relevant for users using history-based routing, users who want to allow non-admin API tokens to trigger cache invalidation, or users experiencing incorrect error reporting on multi-domain invalidations. Added skipHistoryUtil option to routing rules. When enabled, the router checks endpoint utilization before returning cached history endpoints, skipping fully utilized ones. Added APIPurger template role and basicinvalidationrequest permission, allowing organization-level users to trigger basic cache invalidation without requiring system administrator privileges. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.16r13/ Fri, 06 Mar 2026 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.16r13/ About the release Varnish Enterprise 6.0.16r13 is a feature and bug fix release. This release contains important bug fixes and stability improvements, and all users are encouraged to upgrade. A major highlight of this release is that substantial work has been done to make Varnish run stable on aarch64 (ARM64) hardware. The ARM64 build has been promoted to General Availability (GA) status and is now part of our mainline repositories. https://docs.varnish-software.com/releases/varnish-helm-chart-1.7.6/ Thu, 05 Mar 2026 14:00:00 +0900 https://docs.varnish-software.com/releases/varnish-helm-chart-1.7.6/ This is a patch release for the Varnish Helm Charts. For varnish-enterprise: Updated varnish-enterprise image to 6.0.16r12 For varnish-controller: Updated varnish-controller images to 7.3.3 varnish-controller-router: Updated varnish-controller-router image to 7.3.3 See Varnish Helm Chart Changelog for a full changelog https://docs.varnish-software.com/releases/varnish-controller-7.3.4/ Thu, 05 Mar 2026 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-controller-7.3.4/ This is a patch release and each component can be individually upgraded from previous release. Improved router memory efficiency by caching and reusing internal resources. Reduced PostgreSQL log (WAL) file growth when no statistics retention is configured. Always use TCP to lookup CAA records for ACME certificates. Fixed unnecessary deployment checks during auto-deploy that could result in empty deployments. Improved API documentation by adding descriptions to enums in the Swagger documentation. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.16r12/ Thu, 26 Feb 2026 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.16r12/ About the release Varnish Enterprise 6.0.16r12 is a bug fix release addressing a regression introduced in the 6.0.16r11 release. It contains important bug fixes and stability improvements, and all users are encouraged to upgrade. References Changelog with the complete list of changes for both 6.0.16r11 and 6.0.16r12. Varnish Enterprise Documentation Varnish Enterprise Upgrade Notes https://docs.varnish-software.com/releases/varnish-enterprise-6.0.16r11/ Fri, 20 Feb 2026 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.16r11/ About the release Varnish Enterprise 6.0.16r11 is a feature and bug fix release. This release contains important bug fixes and stability improvements, and all users are encouraged to upgrade. Key highlights include new image processing capabilities in vmod_image, granular client certificate verification for TLS, and performance optimizations for vmod_slicer. The features and optimizations are highlighted below. Please see the changelog for the complete list of changes in this version and previous versions. https://docs.varnish-software.com/releases/varnish-controller-7.3.3/ Mon, 16 Feb 2026 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-controller-7.3.3/ This is a patch release and each component can be individually upgraded from previous release. Support for loading a custom VCL for all VCLGroup per agent (see Agent Configuration). Support router maintenance TCP port and file (see Router Configuration). New -git-tag flag for vcli to specify tag to use for deployment (can be used for deploy, compile and validate). Set a default of 15 database connections if no other values were configured before. https://docs.varnish-software.com/releases/varnish-helm-chart-1.7.5/ Wed, 28 Jan 2026 17:00:00 +0900 https://docs.varnish-software.com/releases/varnish-helm-chart-1.7.5/ This is a patch release for the Varnish Helm Chart. For varnish-enterprise: Change Varnish default listening port to 0.0.0.0 add missing extraEnvs to varnishncsa See Varnish Helm Chart Changelog for a full changelog https://docs.varnish-software.com/releases/varnish-controller-7.3.2/ Mon, 19 Jan 2026 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-controller-7.3.2/ Only brainz needs to be updated for this release. Implement the follow of symlinks in Git and increase the amount of Git files from 25 to 40. Add a new [neq] API operator that can be used to filter records. Add more information in monitoring data to the _info records. Add a new VCLI command to deploy only a few files that have been changed, without the need of specifying every file. https://docs.varnish-software.com/releases/varnish-helm-chart-1.7.4/ Fri, 16 Jan 2026 00:00:00 +0900 https://docs.varnish-software.com/releases/varnish-helm-chart-1.7.4/ This is a patch release for the Varnish Helm Chart. For varnish-enterprise: Updated varnish-enterprise image to 6.0.16r10 See Varnish Helm Chart Changelog for a full changelog https://docs.varnish-software.com/releases/varnish-helm-chart-1.7.3/ Thu, 15 Jan 2026 17:00:00 +0900 https://docs.varnish-software.com/releases/varnish-helm-chart-1.7.3/ This is a patch release for the Varnish Helm Charts. For varnish-enterprise: Re-added support for openTelemetry For varnish-controller Added support for fetching geoip csv file from URL For varnish-controller-router Added support for fetching geoip.mmdb and asn.mmdb files from URLs See Varnish Helm Chart Changelog for a full changelog https://docs.varnish-software.com/releases/varnish-enterprise-6.0.16r10/ Wed, 14 Jan 2026 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.16r10/ About the release Varnish Enterprise 6.0.16r10 is a feature and bug fix release that focuses on improved observability and scalable certificate management. This release contains important bug fixes and stability improvements, and all users are encouraged to upgrade. Key highlights include a new mechanism in vmod_ykey for hierarchical cache invalidation, allowing you to easily purge entire URL structures. Network observability has also been significantly enhanced with vmod_tcp, which can now report detailed TCP metrics at the end of a transaction. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.16r9/ Mon, 22 Dec 2025 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.16r9/ About the release Varnish Enterprise 6.0.16r9 is a feature release that introduces experimental support for next-generation token authentication. This release positions Varnish to handle the new industry standards for content protection, ensuring your delivery infrastructure is ready for modern anti-piracy workflows and seamless interoperability in multi-CDN environments. The new feature is highlighted below. For the complete list of changes, please see the Changelog. New features Experimental CWT and CAT support in vmod_cwt A new VMOD, vmod_cwt, has been added to enable the parsing, verification, and validation of CBOR Web Tokens (CWT) and Common Access Tokens (CAT). https://docs.varnish-software.com/releases/varnish-helm-chart-1.7.2/ Mon, 22 Dec 2025 00:00:00 +0900 https://docs.varnish-software.com/releases/varnish-helm-chart-1.7.2/ This is a patch release for the Varnish Helm Chart. For varnish-enterprise: Added support for licenseSecret Added support for externalTrafficPolicy Updated varnish-enterprise image to 6.0.16r9 For varnish-controller Updated varnish-controller images to 7.3.1 For varnish-controller-router Updated varnish-controller-router image to 7.3.1 See Varnish Helm Chart Changelog for a full changelog https://docs.varnish-software.com/releases/varnish-controller-7.3.1/ Thu, 18 Dec 2025 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-controller-7.3.1/ Only NATS, UI, and brainz need to be updated for this release. Fix a PostgreSQL scalability issue when aggregating large Varnish statistics by explicitly selecting a more efficient SQL query plan. UI: Fix a bug when logging in over unencrypted connections that resulted in a Forbidden - CSRF token not found in request error message. Upgrade NATS to version 2.12.3, built with Go 1.25.5. Test all FQDNs when probing CAA entries for ACME certificates. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.16r8/ Thu, 04 Dec 2025 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.16r8/ About the release Varnish Enterprise 6.0.16r8 is a bug fix release. All users are encouraged to upgrade, both to get the latest bug fixes and the rich set of features in the recent release. Please see the changelog for the complete list of changes in this version and previous versions. References Changelog with the complete list of changes. Varnish Enterprise Documentation General upgrading notes https://docs.varnish-software.com/releases/varnish-controller-7.3.0/ Wed, 03 Dec 2025 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-controller-7.3.0/ All components require to be upgraded for this release. After installing this upgrade, make sure to start Brainz before the Router. More details are in the upgrade notes. Fix potential transfer problems of transferring agents between organizations when running routers in grace mode. Provide internal metrics under new endpoint /api/v1/internal-metrics. Keep ownership when transferring an agent or router to another organization. Statistics can now be pruned with vcli stats prune . https://docs.varnish-software.com/releases/varnish-enterprise-6.0.16r7/ Wed, 26 Nov 2025 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.16r7/ About the release Varnish Enterprise 6.0.16r7 is a feature and bug fix release that focuses on hardening security workflows and improving backend failure handling. Key highlights include new vmod_s3 capabilities for verifying signed client requests and handling unsigned payloads, as well as more flexible TLS certificate loading. This release also introduces +rush_failure, a new mechanism to reduce latency during backend outages by waking up waiting lists faster. The features and optimizations are highlighted below. https://docs.varnish-software.com/releases/varnish-otel-2.1.0/ Mon, 24 Nov 2025 08:00:00 +0000 https://docs.varnish-software.com/releases/varnish-otel-2.1.0/ This version focuses on finer logging, introducing new environment variables that will impact the internal use of varnishlog-json and varnishncsa. Among others: OTEL_VARNISH_DURATION_BUCKETS and OTEL_VARNISH_SIZE_BUCKETS define bucke sizes for histograms OTEL_VARNISH_LOG_TOOL can be set to ncsa to reduce the log volume considerably (at the expense of missing information) OTEL_VARNISH_LOG_QUERY allows to filter out logs before they are processed by varnish-otel Check out the full varnish-otel changelog for more information. References varnish-otel changelog https://docs.varnish-software.com/releases/varnish-discovery-1.6.1/ Fri, 07 Nov 2025 08:00:00 +0000 https://docs.varnish-software.com/releases/varnish-discovery-1.6.1/ Bugfix release to correct a crash at startup introduced by 1.6.0. References Varnish Discovery changelog https://docs.varnish-software.com/releases/varnish-enterprise-6.0.16r6/ Mon, 27 Oct 2025 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.16r6/ About the release This is a bug fix release. Please see the changelog for the complete list of changes in this version and previous versions. Astute readers may notice the absence of a 6.0.16r5 release. The reason is that a candidate build for 6.0.16r5 encountered an issue during QA and was therefore not published. References Changelog with the complete list of changes. General upgrading notes https://docs.varnish-software.com/releases/varnish-helm-chart-1.7.0/ Wed, 22 Oct 2025 16:00:00 +0000 https://docs.varnish-software.com/releases/varnish-helm-chart-1.7.0/ This is a release for Varnish Helm Chart. If you’re using the default internal postgresql for the Varnish Controller helm chart, you need to manually upgrade Postgresql before upgrading the helm chart. Please read the changelog carefully for instructions before upgrading if you are not using an external postgresql service. If you are using an external postgresql service, you would have set postgresql.enable to false in your values.yaml. In that case, you do not need to perform this manual upgrade, and you can upgrade the helm chart normally without the extra steps. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.16r4/ Fri, 03 Oct 2025 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.16r4/ About the release This is a bug fix release. Please see the changelog for the complete list of changes in this version and previous versions. References Changelog with the complete list of changes. General upgrading notes https://docs.varnish-software.com/releases/varnish-controller-7.2.1/ Wed, 01 Oct 2025 06:00:00 +0000 https://docs.varnish-software.com/releases/varnish-controller-7.2.1/ Only UI and cli need to be updated for this release. UI and cli: Fix problem that upstream validation FQDN values can be accidentally deleted. See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. https://docs.varnish-software.com/releases/varnish-controller-7.2.0/ Wed, 01 Oct 2025 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-controller-7.2.0/ All components need to be upgraded for this release. ACME certificates with DNS validation can now fetch external validations for supporting multiple certificates. Handle failing ACME ARI with sane defaults and retry. Statistics cleanup cannot be blocked by statistics aggregation any longer. Fix database update when doing IDP organization updates. Updated unclear log messages for better readability. UI: Fixed a bug where a VCLGroup deployed with a gitconfig would not show the deployed files when the main VCL was located in a subdirectory from the root. https://docs.varnish-software.com/releases/varnish-discovery-1.6.0/ Mon, 29 Sep 2025 08:00:00 +0000 https://docs.varnish-software.com/releases/varnish-discovery-1.6.0/ Maintenance release, including: New supported distributions: debian:trixie centos:10 Retired distributions: ubuntu:xenial ubuntu:bionic ubuntu:focal vac sub command has been removed Go version updated to 1.25 Azure SDK module has been updated too References Varnish Discovery changelog https://docs.varnish-software.com/releases/varnish-enterprise-6.0.16r3/ Thu, 18 Sep 2025 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.16r3/ About the release This is a bug fix release. Most notably, it brings a fix to a regression that was introduced in 6.0.16r2 that caused us to pull that release from publication. Please see the changelog for the complete list of changes in this version and previous versions. References Changelog with the complete list of changes. General upgrading notes https://docs.varnish-software.com/announcements/varnish-enterprise-6.0.16r2-removed/ Tue, 16 Sep 2025 00:00:00 +0000 https://docs.varnish-software.com/announcements/varnish-enterprise-6.0.16r2-removed/ Release removed from the repository The release of Varnish Enterprise version 6.0.16r2 has been removed from the package repository due to a regression discovered in the latest release. This release introduced an optimization in the handling of bans, which is a method for doing cache invalidation in Varnish. While the optimization significantly reduces locking contention, it unfortunately introduced a regression that may in certain setups lead to a crash. We advise against using 6. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.16r2/ Thu, 11 Sep 2025 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.16r2/ Note: This release has been removed. Due to a regression bug it is not recommended for anyone to run this release. The packages have been removed from the package repository. See this announcement for more information. About the release This is a feature release. Among the changes there is a rework of how waitinglists are implemented in order to avoid spurious wake-ups, and the ban subsystem has been optimized to reduce the cost of object creation and removal. https://docs.varnish-software.com/releases/varnish-controller-7.1.5/ Thu, 11 Sep 2025 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-controller-7.1.5/ We recommend upgrading all components but they can be updated independently. Build with Go 1.25 NATS-Server version 2.11.8 Support for 0.0.0.0/0 and ::/0 in CIDR routing decision. Failing ACME renewals are not retried for an extended period of time. Domain-maps and CIDR rule CSV files now supports variable number of fields. Invalidations that has no domain and is not root deployed will now fail on create. Extended debug information for ACME HTTP challenges. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.16r1/ Thu, 11 Sep 2025 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.16r1/ About the release This is a bug fix release. Please see the changelog for the complete list of changes in this version and previous versions. References Changelog with the complete list of changes. General upgrading notes https://docs.varnish-software.com/releases/varnish-helm-chart-1.6.4/ Tue, 26 Aug 2025 16:00:00 +0900 https://docs.varnish-software.com/releases/varnish-helm-chart-1.6.4/ This is a patch release for Varnish Helm Chart. For varnish-enterprise: Fix for powerdns.service.annotations Make clustering easier Updated varnish-enterprise images to 6.0.14r8 For varnish-controller: Updated varnish-controller images to 6.6.7 For varnish-controller-router: Updated varnish-controller-router image to 6.6.7 See Varnish Helm Chart Changelog for a full changelog. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.15r1/ Mon, 25 Aug 2025 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.15r1/ About the release This release contains a number of smaller features and closes several issues. Please see the changelog for the complete list of changes in this version and previous versions. References Changelog with the complete list of changes. General upgrading notes https://docs.varnish-software.com/security/VSV00017/ Wed, 13 Aug 2025 00:00:01 +0000 https://docs.varnish-software.com/security/VSV00017/ Overview A denial of service attack can be performed on Varnish Cache and Varnish Enterprise servers that have the HTTP/2 protocol turned on. An attacker can create a large number of streams and immediately reset them without ever reaching the maximum number of concurrent streams allowed for the session, causing the Varnish server to consume unnecessary resources processing requests for which the response will not be delivered. This attack is a variant of the HTTP/2 Rapid Reset Attack, which was handled upstream as VSV00013. https://docs.varnish-software.com/releases/varnish-controller-7.1.4/ Tue, 12 Aug 2025 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-controller-7.1.4/ We recommend upgrading all components but they can be updated independently. Build with Go 1.24.6 NATS-Server version 2.11.7 Improved transfer of agents and routers to avoid a race condition where agents/routers registered as new ones during transfer. Fix eDNS subnet scopes for IPv6/IPv4, where the minimum mask was not applied correctly. Expire for vcli when creating a custom token/session now supports date. ACME contact can now be updated with empty contact information Adds extra database debug information for system-debug Adds extra debug information for communication with ACME certificate authorities See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. https://docs.varnish-software.com/announcements/openssl-3.0.17-bug/ Fri, 08 Aug 2025 00:00:01 +0000 https://docs.varnish-software.com/announcements/openssl-3.0.17-bug/ Varnish Enterprise running on Debian Bookworm with openssl/3.0.17-1~deb12u1 installed is affected by a bug in this specific version of OpenSSL. The Docker images provided by Varnish Software are built on Debian Bookworm, and are therefore affected by this. Update: As of 2025-08-10 a fixed OpenSSL package has been released in Debian Bookworm. The problem is now addressed by doing a regular package upgrade followed by a restart of Varnish. Impact The bug may cause a race condition, which manifests itself as a panic of the child process. https://docs.varnish-software.com/releases/varnish-controller-7.1.3/ Mon, 07 Jul 2025 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-controller-7.1.3/ Only brainz require to be upgraded. Upgrade agents to get the root.vcl fix. Deploylogs are now correctly removed when deleting a VCLGroup. Tags are now included correctly for agents that are passed to gRPC plugins in the Traffic Router. Improved root.vcl skipping toLower for domain matching (improves performance when many domains are deployed). See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.14r8/ Tue, 01 Jul 2025 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.14r8/ About the release This release fixes a backward compatibility issue in varnishlog introduced in Varnish Enterprise 6.0.14r6. Using log-consuming tools such as varnishlog or varnishncsa from 6.0.14r6 or 6.0.14r7 may result in incorrect log tags when reading logs generated by older Varnish versions. As a result, logs produced by 6.0.14r6 and 6.0.14r7 must only be read by tools built for those specific releases. References Changelog with the complete list of changes. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.14r7/ Fri, 27 Jun 2025 00:00:02 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.14r7/ About the release This release corrects a packaging error introduced in version 6.0.14r6, where vmod_kvstore was mistakenly included in the wrong RPM package. As a result, users relying on vmod_kvstore may have experienced failures when attempting to restart Varnish following a package upgrade. Users of Debian-based packages were not affected. References Changelog with the complete list of changes. General upgrading notes https://docs.varnish-software.com/releases/varnish-controller-7.1.2/ Wed, 25 Jun 2025 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-controller-7.1.2/ Only brainz and the UI require to be upgraded. Fixed a bug where the configured NICs were not returned from the API. Fixed a bug where the graphs in the UI dashboard stayed empty. Fixed a bug for loading TLS 1.3 certificates into Varnish. Fixed a bug where invalidations did not load domains correctly as an organization user. See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. https://docs.varnish-software.com/announcements/varnish-enterprise-licensed-add-ons/ Tue, 24 Jun 2025 00:00:01 +0000 https://docs.varnish-software.com/announcements/varnish-enterprise-licensed-add-ons/ With the release of Varnish Enterprise 6.0.14r6, we are streamlining access to Licensed Add-ons — advanced modules that extend Varnish beyond core Content Delivery use cases. While Add-ons such as DeviceAtlas, Akamai Connector, and WAF have been available for some time in separate repositories, this release marks the first step in making certain Add-ons directly available as part of the Varnish Enterprise software packages, simplifying deployment and evaluation for customers with the appropriate licenses. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.14r6/ Thu, 19 Jun 2025 00:00:02 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.14r6/ About the release This is a feature release of Varnish Enterprise introducing new core features and several new VMODs, in addition to several improvements to existing functionality. Notable highlights include support for fully automated OCSP handling and a new extended functionality key-value storage vmod_kv. Note that with this release, some add-ons have been added to the software packages, and will be included when upgrading Varnish Enterprise to the latest version. However, a software license is necessary to run the add-ons in production. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.14r5/ Thu, 19 Jun 2025 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.14r5/ About the release This is a bug fix release. Please see the changelog for the complete list of changes in this version and previous versions. References Changelog with the complete list of changes. General upgrading notes https://docs.varnish-software.com/releases/varnish-enterprise-6.0.14r4/ Fri, 13 Jun 2025 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.14r4/ About the release This release closes a handful of issues found after launching the redesigned HTTP/2 engine. Please see the changelog for the complete list of changes in this version and previous versions. References Changelog with the complete list of changes. General upgrading notes https://docs.varnish-software.com/releases/varnish-controller-7.1.1/ Thu, 05 Jun 2025 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-controller-7.1.1/ Only agents requires to be upgraded. Fixes a bug where renewed certificates were not loaded into varnish. See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. https://docs.varnish-software.com/releases/varnish-controller-7.1.0/ Wed, 04 Jun 2025 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-controller-7.1.0/ All components needs to be upgraded for this release. Support for revocation of ACME TLS Certificates. Normalization of NIC names in the agent. Fixes a bug where negative values for Longitude/Latitude was not saved correctly. Make it possible to remove deploylogs for undeployed VCLGroups. Hide NATS password in configs. Agent root.vcl is now using none case-sensitive domain matching. Domain validation is now more strict and follows RFC 1035. Support for Domain Maps for CIDR:Tag routing. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.14r3/ Wed, 28 May 2025 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.14r3/ About the release This release brings a redesigned HTTP/2 engine for improved performance and stability. The new engine features fully asynchronous handling of frame input/output within its dedicated session thread. This resolves several long-standing stability issues that could lead to infrequent crashes when combining HTTP/2 with in-core TLS. Please see the changelog for the complete list of changes in this version and previous versions. References Changelog with the complete list of changes. https://docs.varnish-software.com/security/VSV00016/ Tue, 13 May 2025 10:00:00 +0000 https://docs.varnish-software.com/security/VSV00016/ Overview A client-side desync vulnerability can be triggered in Varnish Cache and Varnish Enterprise. This vulnerability can be triggered under specific circumstances involving malformed HTTP/1 chunked requests. An attacker can abuse a flaw in Varnish’s handling of chunked transfer encoding which allows certain malformed HTTP/1 requests to exploit improper framing of the message body to smuggle additional requests. Specifically, Varnish incorrectly permits CRLF to be skipped to delimit chunk boundaries. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r16/ Mon, 12 May 2025 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r16/ About the release This release brings a number of smaller features and some important bug fixes. Some feature highlights: When using the MSE4 stevedore, three new log messages are now generated. These messages provide information on the time spent preparing resources (like time spent freeing buffer memory and time spent waiting for I/O). A selection of global parameters related to VCL transactions and thread pools are available as VCL variables. https://docs.varnish-software.com/releases/varnish-controller-6.6.11/ Fri, 25 Apr 2025 00:00:03 +0000 https://docs.varnish-software.com/releases/varnish-controller-6.6.11/ Only the Controller UI needs to be upgraded in this release. Adjustment of default behavior in the Controller-UI This release contains an updated version of the Gorilla CSRF protection library with a fix to CVE-2025-24358. This fix makes it necessary to explicitly turn off checks of the HTTPS-specific Origin header if plaintext connections are used. See the security settings for the Controller-UI examples for further details. Necessary change for plaintext installations Installations, that do NOT use TLS need to add the -no-tls flag to their UI server startup command. https://docs.varnish-software.com/releases/varnish-controller-7.0.1/ Thu, 24 Apr 2025 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-controller-7.0.1/ We suggest upgrading all components with this patch release. Adjustment of default behavior in the Controller-UI This release contains an updated version of the Gorilla CSRF protection library with a fix to CVE-2025-24358. This fix makes it necessary to explicitly turn off checks of the HTTPS-specific Origin header. See the security settings for the Controller-UI examples for further details. Necessary change for plaintext installations Installations, that do NOT use TLS need to add the -no-tls flag to their UI server startup command. https://docs.varnish-software.com/releases/varnish-controller-6.6.10/ Mon, 14 Apr 2025 00:00:03 +0000 https://docs.varnish-software.com/releases/varnish-controller-6.6.10/ Fixed cleaning counter names for S3 and UDO statistics from IP addresses Upgrade dependency “golang-jwt” to resolve CVE See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r15/ Mon, 14 Apr 2025 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r15/ About the release This release fixes a single bug which has eluded us for a long while. Bug fixed: Configurations using HTTP/2 with TLS were subject to a race condition that could produce corrupted logs leading to panics in log consumers like varnishncsa. Please see the changelog for the complete list of changes in this version and previous versions. References Changelog with the complete list of changes. General upgrading notes https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r14/ Wed, 09 Apr 2025 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r14/ About the release This release brings a number of smaller features and improvements. Some highlights: Optimized Ykey performance: We’ve introduced multiple trees for ephemeral objects, optimizing performance. Revamped VHA6 limits framework: The Varnish High Availability limits framework has been updated, where the previous max_requests_sec setting is replaced by more granular controls broadcast_limit, broadcast_rate_limit and request_rate_limit. The max_requests_sec setting used to contend with non-VHA usage of vmod_http. This may result in higher VHA6 activity for setups already operating at full broadcast capacity. https://docs.varnish-software.com/releases/varnish-controller-6.6.9/ Tue, 08 Apr 2025 00:00:03 +0000 https://docs.varnish-software.com/releases/varnish-controller-6.6.9/ This release only affects the Brainz component. Allow to stop aggregation queries from running when using the -keep-stats-* configurations. See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. https://docs.varnish-software.com/releases/varnish-controller-7.0.0/ Thu, 27 Mar 2025 00:00:03 +0000 https://docs.varnish-software.com/releases/varnish-controller-7.0.0/ This is a major release, all components requires upgrade. This release comes with a lot of breaking changes due to major changes to the deployment and file handling. Please see upgrade notes to see important changes. As a result of these major changes, the documentation has been divided into its own section for Version 7. This is to make it easier and to avoid no longer supported commands and examples. https://docs.varnish-software.com/security/VEV00001/ Tue, 18 Mar 2025 10:00:01 +0000 https://docs.varnish-software.com/security/VEV00001/ Overview When using the MSE4 cache storage engine (stevedore) in versions prior to 6.0.13r13, a buffer overflow vulnerability can be triggered in Varnish Enterprise. The vulnerability can be triggered when handling range requests on ephemeral (non-persisted) objects stored in the MSE4 stevedore, and may cause arbitrary data from the Varnish Enterprise server memory address space to be sent as response bytes to incoming client requests. The vulnerability is caused by an incorrect buffer boundary calculation when handling range requests for starting byte offsets that happen to be in the middle of a buffer. https://docs.varnish-software.com/security/VSV00015/ Tue, 18 Mar 2025 10:00:00 +0000 https://docs.varnish-software.com/security/VSV00015/ Overview A client-side desync vulnerability can be triggered in Varnish Cache and Varnish Enterprise. This vulnerability can be triggered under specific circumstances involving malformed HTTP/1 requests. Certain malformed HTTP/1 requests have been handled by issuing a 400 Bad Request response, and then allowing the connection to carry on with a subsequent request on that same connection. For the case where the initial malformed request contains a request body, the body is not properly processed and is instead treated as the basis for a subsequent request. https://docs.varnish-software.com/releases/varnish-controller-6.6.8/ Tue, 11 Mar 2025 00:00:03 +0000 https://docs.varnish-software.com/releases/varnish-controller-6.6.8/ Note: We suggest upgrading all components with this patch release. Fixed a bug in the aggregation logic when handling big statistics amounts. Improved performance for statistics with Prometheus format. See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. https://docs.varnish-software.com/announcements/container-base-bookworm/ Tue, 11 Mar 2025 00:00:01 +0000 https://docs.varnish-software.com/announcements/container-base-bookworm/ The latest versions of our container images are now based on Debian bookworm and continues to be updated daily with the latest OS updates. Affected container images: quay.io/varnish-software/varnish-plus quay.io/varnish-software/varnish-plus-waf quay.io/varnish-software/varnish-discovery quay.io/varnish-software/varnish-broadcaster Please note that it is only the latest version of each image and tag and (:latest) that are updated daily. This means that if you want to run a non-latest version of Varnish, the base OS will not be kept up to date automatically. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r13/ Fri, 14 Feb 2025 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r13/ About the release This release reverts some of the bug fixes that went into the last two releases of Varnish Enterprise. The changes that are being reverted are related to the TLS layer, and those fixes are being removed because they were causing issues with timeout management and hanging connections. The original reason for the changes to the TLS layer was to address a long standing issue related to TLS over HTTP/2 (tracked as VS issue #2027), which can cause occasional crashes and instability. https://docs.varnish-software.com/releases/varnish-controller-6.6.7/ Wed, 12 Feb 2025 00:00:03 +0000 https://docs.varnish-software.com/releases/varnish-controller-6.6.7/ Note: Only router requires update with this patch release. New Configuration Option. The concurrency parameter allows users to set the maximum number of concurrent connections on the router. See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. https://docs.varnish-software.com/announcements/varnish-enterprise-6.0.13r11-removed/ Wed, 12 Feb 2025 00:00:00 +0000 https://docs.varnish-software.com/announcements/varnish-enterprise-6.0.13r11-removed/ Release removed from the repository The release of Varnish Enterprise version 6.0.13r11 and 6.0.13r12 have been removed from the package repository. This is due to a regression in the latest releases. The issue that has been uncovered can lead to backend TLS backend traffic hanging, causing timeouts and delays in serving traffic. This can severely affect the Varnish Enterprise server throughput. We do not recommend anyone to use the 6.0.13r11 or 6. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r12/ Mon, 10 Feb 2025 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r12/ Note: This release has been removed Due to a regression bug it is not recommended for anyone to run this release. The packages have been removed from the package repository. See this announcement for more information. About the release This is a bug fix release with no new features. Most notably, it brings a fix to a regression that was introduced in 6.0.12r11 that caused us to pull that release from publication. https://docs.varnish-software.com/releases/varnish-broadcaster-1.6.2/ Tue, 04 Feb 2025 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-broadcaster-1.6.2/ This is a patch release. Built with Go 1.23 Packages for Amazonlinux-2023 See Broadcaster Changelog page for more details. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r11/ Wed, 29 Jan 2025 06:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r11/ Note: This release has been removed Due to a regression bug it is not recommended for anyone to run this release. The packages have been removed from the package repository. See this announcement for more information. About the release This release brings a brand new VMOD, a few improvements and some bug fixes. The new VMOD asn lets you look up IP addresses to get ASN and country codes from TSV databases. https://docs.varnish-software.com/releases/varnish-controller-6.6.6/ Thu, 23 Jan 2025 00:00:03 +0000 https://docs.varnish-software.com/releases/varnish-controller-6.6.6/ Note: Only api-gw requires update with this patch release. We summoned Prometheus 3.0 support back in 6.6.4, but it slipped the release. The devil’s in the details, fixed now! 😈 Support for Prometheus 3.x (api-gw now uses content-type tex/plain for Prometheus calls) See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. https://docs.varnish-software.com/releases/varnish-controller-6.6.5/ Wed, 22 Jan 2025 00:00:03 +0000 https://docs.varnish-software.com/releases/varnish-controller-6.6.5/ Note: We recommend updating all components for this patch release, as they all include fixes. See: versioning. Fixes a bug in router trace where the location would stripped from a / in http://. Fixes a bug in the agent where the backup was not performed of deployed VCL during root(dedicated) deployments due to missing root.vcl. Fixes a bug in brainz where a VCL was not deployed if the main VCL ID was changed. https://docs.varnish-software.com/releases/varnish-controller-6.6.4/ Tue, 14 Jan 2025 00:00:03 +0000 https://docs.varnish-software.com/releases/varnish-controller-6.6.4/ Note: We recommend updating all components for this patch release, as they all include fixes. See: versioning. Support for Prometheus 3.x (api-gw now uses content-type tex/plain for Prometheus calls) Fixes a bug in the Router when fetching debug information. Brainz will now warn for expiring license on stdout 30 days before it expires (previous 10 days before). Set From now shows correctly File for configuration that comes from file and was specified in the global scope of the configuration file. https://docs.varnish-software.com/releases/varnish-controller-6.6.3/ Fri, 20 Dec 2024 11:00:03 +0000 https://docs.varnish-software.com/releases/varnish-controller-6.6.3/ Note: Only nats, router and api-gw requires upgrading for this patch release, see versioning. Update nats-server due to CVE-2024-45337. Update golang.org/x/net for API-GW and Traffic Router due to CVE-2024-45338. See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r10/ Fri, 20 Dec 2024 06:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r10/ About the release This release brings multiple new features and some bug fixes. Most notably, A new VCL subroutine vcl_connect which is invoked for HTTP CONNECT after a return (connect); from sub vcl_recv. Use of this new functionality must be explicitly enabled by setting param.set experimental +vcl_connect. A new varnishlog-json utility has been added to produce JSON formatted logs. The JSON schema is subject to change in a future release. https://docs.varnish-software.com/releases/varnish-controller-6.6.2/ Tue, 17 Dec 2024 00:00:03 +0000 https://docs.varnish-software.com/releases/varnish-controller-6.6.2/ Update the Golang crypto library due to CVE-2024-45337. While Varnish Controller does not use the affected part of this library, this ensures we build with the latest version. See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. https://docs.varnish-software.com/releases/varnish-controller-6.6.1/ Mon, 09 Dec 2024 00:00:03 +0000 https://docs.varnish-software.com/releases/varnish-controller-6.6.1/ Note: Only brainz needs upgrading for this patch release, see versioning. Fixed an issue where statistics queries would fail to retrieve data. See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. This update is recommended for all users running version 6.6.0 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r9/ Thu, 28 Nov 2024 08:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r9/ About the release This is a small release which addresses a problem in our ESI solution that was introduced in the previous release. The fix addresses a race condition that would in certain cases result in a “use-after-free”, which would manifest itself as an assertion error. All users of ESI who already upgraded to 6.0.13r8 are strongly encouraged to upgrade. References Changelog with the complete list of changes. General upgrading notes https://docs.varnish-software.com/releases/varnish-controller-6.6.0/ Wed, 27 Nov 2024 00:00:03 +0000 https://docs.varnish-software.com/releases/varnish-controller-6.6.0/ Note: All components needs to be upgraded for this release, see versioning. Support for Roles. This feature offers a structured approach to combining and managing permissions across multiple users. Resolved an issue where removing a tag from an agent incorrectly returned a 500 Internal Server Error instead of the actual error reason. Fixed an issue where the CLI override flag for configs displayed an incorrect long value. Addressed a problem where statistics aggregation caused unnecessary growth in the WAL log. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r8/ Thu, 14 Nov 2024 08:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r8/ About the release This release introduces new features in vmod S3 and parallel ESI, and a significant performance and resource usage optimization in MSE4 when using ykey - among other things. Instances using a persistent cache with MSE4 will need to empty the cache as part of the upgrade process due to an update to the book and store format. More about this in the upgrade notes section. The features and optimizations are highlighted below. https://docs.varnish-software.com/releases/varnish-helm-chart-1.6.1/ Wed, 06 Nov 2024 16:00:00 +0900 https://docs.varnish-software.com/releases/varnish-helm-chart-1.6.1/ This is a patch release for Varnish Helm Chart. For varnish-enterprise: Added support for MSE4 for varnish-enterprise 6.0.13r7 image pulled after October 25, 2024 Updated varnish-enterprise image to 6.0.13r7 Updated varnish-controller-agent image to 6.5.0-6.0.13r7 For varnish-controller: Updated varnish-controller images to 6.5.0 For varnish-controller-router: Updated varnish-controller-router image to 6.5.0 See Varnish Helm Chart Changelog for a full changelog. https://docs.varnish-software.com/releases/varnish-controller-6.5.0/ Mon, 28 Oct 2024 00:00:03 +0000 https://docs.varnish-software.com/releases/varnish-controller-6.5.0/ Note: All components needs to be upgraded for this release, see versioning. Built with Go 1.23.2. NATS-server updated to v2.10.22. Support for Azure AD as IDP (Microsoft Entra) See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r7/ Mon, 14 Oct 2024 08:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r7/ About the release This release contains many new features and bug fixes. In this release, cluster.vcl has been updated to version 2.1 with several improvements. The Changelog includes information on this. Also added with this release is experimental support for HTTP CONNECT on the client side. In addition to the above, we have too many new features to mention here. There is also a sizable list of bug fixes. Important: All users of Varnish Enterprise upgrading from version 6. https://docs.varnish-software.com/releases/varnish-helm-chart-1.6.0/ Tue, 08 Oct 2024 16:00:00 +0900 https://docs.varnish-software.com/releases/varnish-helm-chart-1.6.0/ This is a patch release for Varnish Helm Chart. For varnish-enterprise: As this release migrated EmptyDir mount on /etc/varnish to /etc/varnish/shared, a manual migration may be required when upgrading from previous versions if the path is explicitly referenced in the values file. Please refer to the full changelogs for more details. Added an option to automatically de-registering Varnish Enterprise from Varnish Controller upon rollout Added an option to make Varnish Enterprise wait for connection draining for zero-downtime during rollout Added an option to no longer use init container for initializing Varnish Controller Agent state directory Added an option to configure autoscaling behavior Changed VCL configuration behavior so that bundled VCL in Docker image is used when VCL is not configured For varnish-controller: https://docs.varnish-software.com/releases/varnish-helm-chart-1.5.1/ Mon, 23 Sep 2024 21:00:00 +0900 https://docs.varnish-software.com/releases/varnish-helm-chart-1.5.1/ This is a patch release for Varnish Helm Chart. For varnish-enterprise: Updated varnish-enterprise image to 6.0.13r6 Updated varnish-controller-agent image to 6.4.1-6.0.13r6 For varnish-controller: Updated varnish-controller images to 6.4.1 For varnish-controller-router: Updated varnish-controller-router image to 6.4.1 See Varnish Helm Chart Changelog for more details. https://docs.varnish-software.com/releases/varnish-controller-6.4.1/ Fri, 20 Sep 2024 00:00:03 +0000 https://docs.varnish-software.com/releases/varnish-controller-6.4.1/ This is a patch release for Varnish Controller with the following fixes: Ability to configure HTTPS for IDP redirects on the varnish-controller-ui (-idp-https-redirect). Fixes a bug that prevented comma-separated ID filtering for specific resources (domains, configsets, tagroutes). See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-controller-6.4.0/ Tue, 17 Sep 2024 00:00:03 +0000 https://docs.varnish-software.com/releases/varnish-controller-6.4.0/ Note: All components needs to be upgraded for this release, see versioning. Built with Go 1.23.1. NATS-server updated to v2.10.20. Shared deployments now have 2 new headers added to the request to see which VCLGroup name and Agent name the request came from. X-Agent-Name X-VCLGroup-Name The agents now supports to gather statistics per domain. This has to be enabled manually and it will increase the size of the statistics depending on number of domains deployed. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r6/ Mon, 26 Aug 2024 08:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r6/ About the release This release contains new features and bug fixes. In this release, a new version of cluster.vcl is included. We have designed the new version such that upgrading should not significantly change existing setups, but bring new features and improvements. However, we cannot foresee all ways customers have integrated with, and configured the cluster VCL logic, so it is important that you test the new version of cluster.vcl before you deploy to production, or at least review the changes to understand how the new version affects you. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r5/ Fri, 12 Jul 2024 01:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r5/ About the release This release contains new features and bug fixes. Most notable is the new VMOD called vmod_deviceatlas3, which supports the version 3.x of the DeviceAtlas API and database. Important: All users of Varnish Enterprise upgrading from version 6.0.12r9 or lower are encouraged to test their VCL with this release before upgrading. If you encounter VCL compilation failures due to invalid VMOD usage, you will need to update your VCL before upgrading. https://docs.varnish-software.com/releases/varnish-helm-chart-1.5.0/ Thu, 11 Jul 2024 19:17:00 +0900 https://docs.varnish-software.com/releases/varnish-helm-chart-1.5.0/ This is a minor release for Varnish Helm Chart. For all components: Added global configuration for annotations, labels, podAnnotations, and podLabels For varnish-enterprise: Added configuration options for extraEnvs Added configuration options for extraVolumeMounts in agent and varnishncsa containers Added configuration options for varnish-controller-agent’s init container Changed securityContext to also applies to init container in addition to workload containers Updated varnish-enterprise to 6.0.13r4 Updated varnish-controller-agent to 6.3.2-6.0.13r4 For varnish-controller: Changed extraEnvs so it can be set as a dict, an object, or a template string Updated varnish-controller to 6. https://docs.varnish-software.com/releases/varnish-controller-6.3.2/ Wed, 10 Jul 2024 00:00:03 +0000 https://docs.varnish-software.com/releases/varnish-controller-6.3.2/ This is a patch release for Varnish Controller with the following fixes: Updated NATS to the latest version: 2.10.17. See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-controller-6.3.1/ Wed, 10 Jul 2024 00:00:02 +0000 https://docs.varnish-software.com/releases/varnish-controller-6.3.1/ This is a patch release for Varnish Controller with the following fixes: Backups on agents will now only be taken if there are deployments. This will remove a previous warning message that wasn’t critical. Version of varnish-controller-ui showed 0.0.0 in the 6.3.0 release, this has been fixed. The UI now validates the IDP client secret less strict. See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. https://docs.varnish-software.com/releases/varnish-controller-6.3.0/ Mon, 08 Jul 2024 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-6.3.0/ Note: All components needs to be upgraded for this release, see versioning. Binaries built with Go 1.22.5. This release includes the Basic Invalidation feature. This feature is exclusively API/CLI-based for integration purposes, designed for both heavy-duty and straightforward purging tasks. More information can be found here. See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. This release is intended for users interested in an integratable invalidation feature, ideal for simple and quick use cases. https://docs.varnish-software.com/announcements/massive-storage-engine-4-general-availability/ Thu, 20 Jun 2024 01:00:01 +0000 https://docs.varnish-software.com/announcements/massive-storage-engine-4-general-availability/ Introduction Massive Storage Engine 4 (MSE4) is the fourth generation in the series and was made generally available earlier this month. MSE is a stevedore, which is the component in Varnish that manages how and where cached data are stored. MSE can be used for ephemeral caching (in DRAM, called “memory-only”) and persistent caching (typically in SSDs). It is shipped with Varnish Enterprise. This post aims to share some information about the current status of MSE4 and plans for the first weeks and months of its general availability period. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r4/ Wed, 19 Jun 2024 01:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r4/ About the release This release contains only bug fixes to address issues found in the recently launched Massive Storage Engine 4 (MSE4). Important: All users of Varnish Enterprise upgrading from version 6.0.12r9 or lower are encouraged to test their VCL with this release before upgrading. If you encounter VCL compilation failures due to invalid VMOD usage, you will need to update your VCL before upgrading. If this VCL has never caused a problem for you before, it is likely that this VCL code was never reached. https://docs.varnish-software.com/releases/varnish-controller-6.2.0/ Tue, 18 Jun 2024 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-6.2.0/ Note: All components needs to be upgraded for this release, see versioning. Important Previous versions of the Varnish Controller aggregated UDO dynamic backends and S3 VMOD statistics with the IP and port in the counter names. These old statistic names will be deleted upon upgrading to version 6.2.0. The Varnish Controller agent will normalize the counter names and remove the IP and port to get a better aggregation of your statistics. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r3/ Fri, 14 Jun 2024 01:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r3/ About the release This release contains mostly bug fixes to address issues found in the recently launched Massive Storage Engine 4 (MSE4). Important: All users of Varnish Enterprise upgrading from version 6.0.12r9 or lower are encouraged to test their VCL with this release before upgrading. If you encounter VCL compilation failures due to invalid VMOD usage, you will need to update your VCL before upgrading. If this VCL has never caused a problem for you before, it is likely that this VCL code was never reached. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r2/ Mon, 10 Jun 2024 01:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r2/ Important update Please note that there is a known issue with MSE 4 in this release. This is described on our Known Issues page. About the release This release introduces Massive Storage Engine 4 (MSE4), a few minor features and some bug fixes. Please see the Changelog for more information. For easy transition between MSE3 and MSE4, Varnish Enterprise will contain both versions going forward. Environments using MSE3 will continue to use MSE3 after upgrading to 6. https://docs.varnish-software.com/releases/varnish-broadcaster-1.6.1/ Mon, 10 Jun 2024 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-broadcaster-1.6.1/ This is a patch release. Built with Go 1.22.4 Packages for Ubuntu 24.04 (Noble) Packages for Debian 12 (Bookworm) Packages for Alma 9.0 See Broadcaster Changelog page for more details. https://docs.varnish-software.com/releases/varnish-helm-chart-1.4.0/ Thu, 30 May 2024 16:58:00 +0900 https://docs.varnish-software.com/releases/varnish-helm-chart-1.4.0/ This is a minor release for varnish-enterprise with the following changes: Added configuration options to set base URL for Varnish Controller Added configuration options to set Kubernetes load balancer IP Fixed ingress service port when headless ClusterIP is used Updated varnish-enterprise to 6.0.13r1 Updated varnish-controller-agent to 6.1.2-6.0.13r1 For varnish-controller, the following changes: Updated varnish-controller to 6.1.2 Additionally, this release also contains a preview release of Varnish Controller Router Helm Chart. https://docs.varnish-software.com/releases/varnish-controller-6.1.3/ Wed, 29 May 2024 00:00:02 +0000 https://docs.varnish-software.com/releases/varnish-controller-6.1.3/ This is a patch release for Varnish Controller with the following fixes: Packages for Ubuntu 24.04 (Noble Numbat) Use VCLGroup directory first when loading a VCL, instead of system defaults. Some VCLs are shipped with Varnish (e.g. cluster.vcl). If a VCL included cluster.vcl it would use the Varnish provided VCL. With this release, if a file is included in a VCLGroup and named cluster.vcl, the included VCL will be used instead. https://docs.varnish-software.com/releases/varnish-controller-6.1.2/ Mon, 20 May 2024 00:00:02 +0000 https://docs.varnish-software.com/releases/varnish-controller-6.1.2/ If certificates are used within the controller, the controller must be updated before updating varnish to version 6.0.13 or above. This is a patch release for Varnish Controller with the following fixes: Fixed a bug where the TLS version check failed for Varnish versions 6.0.13 and above. Binaries built with Go 1.22.3. Fixed a bug in the invalidation handling when both VCLGroup and domain are provided as input arguments for shared deployments, but the domain didn’t exist, this will be rejected immediately. https://docs.varnish-software.com/releases/varnish-controller-6.0.3/ Mon, 20 May 2024 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-6.0.3/ If certificates are used within the controller, the controller must be updated before updating varnish to version 6.0.13 or above. This is a patch release for Varnish Controller with the following fix: Fixed a bug where the TLS version check failed for Varnish versions 6.0.13 and above. Components required for upgrade: Agent See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r1/ Wed, 15 May 2024 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.13r1/ About the release This release introduces a new VMOD feature, allowing VMOD developers to limit the set of VCL subroutines from where a VMOD function or method can be called. This feature has been applied to all existing VMODs, meaning that starting from this release, VCL configurations that used to compile with no errors and where VMOD functions/methods were misused will no longer compile. Important: All users of Varnish Enterprise are encouraged to test their VCL with this release before upgrading. https://docs.varnish-software.com/releases/varnish-controller-6.1.1/ Tue, 30 Apr 2024 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-6.1.1/ Note: Only the agent and the UI are affected by this release, see versioning. The release includes a few bug fixes. Revert setting the TMPDIR environment variable for varnishtest to agent’s base-dir. Show location of router traces in the UI. See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.12r9/ Tue, 30 Apr 2024 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.12r9/ About the release This release contains multiple improvements, new features and bug fixes. All users of Varnish Enterprise are encouraged to upgrade. See Changelog for more details. All users are encouraged to upgrade. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-controller-6.1.0/ Mon, 29 Apr 2024 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-6.1.0/ Note: All components needs to be upgraded for this release, see versioning. The release includes bug fixes, improvements and new functionality. New VCLGroup feature: Keep On Failure, keep the previous VCLGroup deployed on an agent if the new deployment fails. Support for compilation of files via vcli (see vcli file compile -h). Router Trace now includes location that shows the full redirect location (with respect to redirect template). Reload a VCLGroup on all agents or a specific agent. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.12r8/ Thu, 18 Apr 2024 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.12r8/ About the release This is a small release containing a single fix for an issue that could lead to an infrequent assert. See Changelog for more details. All users are encouraged to upgrade. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-helm-chart-1.3.0/ Tue, 09 Apr 2024 16:22:00 +0900 https://docs.varnish-software.com/releases/varnish-helm-chart-1.3.0/ This is a minor release for varnish-enterprise with the following changes: Added configuration options to use external secrets for secrets and passwords Fixed an issue where relocating HTTP or admin ports caused Varnish Controller Agent to fail Fixed a listening address in Varnish and a proper report of Pod IP to Varnish Controller And for varnish-controller, the following changes: Added configuration options to use external secrets for secrets and passwords Updated varnish-controller to 6. https://docs.varnish-software.com/announcements/http2-continuation-flood/ Thu, 04 Apr 2024 00:00:01 +0000 https://docs.varnish-software.com/announcements/http2-continuation-flood/ Today news surfaced about a new HTTP/2 vulnerability affecting a large number of HTTP/2 implementations. References here: https://kb.cert.org/vuls/id/421644 https://nowotarski.info/http2-continuation-flood/ This vulnerability has been under embargo until today. Varnish Sofware was notified and learned about this on 2024-03-26. We have done a thorough study of the vulnerability, and have come to the conclusion that Varnish is not affected. Memory consumption in Varnish in processing HPACK is limited to a fixed buffer size, regardless of the size of the incoming header set. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.12r7/ Thu, 04 Apr 2024 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.12r7/ About the release This release brings multiple improvements, in particular for vmod-udo, a new VMOD in vmod-prng and a number of important bug fixes. See Changelog for more details. All users are encouraged to upgrade. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-controller-6.0.2/ Wed, 13 Mar 2024 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-6.0.2/ This is a patch release for Varnish Controller with the following fixes: Added ownerships to the Controller Gather. Added caching for token validation to increase performance in the API-GW. UI: Fixed a bug where selecting a domain in a VCLGroup would only show 20 domains. UI: Add search field when selecting domains in VCLGroup. See Varnish Controller Changelog for more details. This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-controller-6.0.1/ Wed, 28 Feb 2024 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-6.0.1/ This is a patch release for Varnish Controller with the following fixes: Fix a migration issue that could affect Routing Rules cors_origin and cors_methods becoming lost during 6.0.0 upgrade. Skip verification of BaseURL if no BaseURL certificate is used for the agent. Log entries for transferring an agent/router is now created for generated private tokens. Output from -generate-config was missing its configuration section, now added correctly again. Fix VTC for compilation of VCLGroups, that could in some cases miss to validate paths to files used by vmods. https://docs.varnish-software.com/releases/varnish-controller-6.0.0/ Thu, 01 Feb 2024 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-6.0.0/ This is a major release of Varnish Controller and all its components need to be updated. The release contains several non backward compatible changes. These changes are described in the upgrade chapter. New Features Support for TLS certificates in both agents and routers. (see Certificates) Support for configuration of agent/routers via CLI/GUI/API (see Config/ConfigSet) Transfer agents and routers to and from organizations as private Drain traffic from agents for request routing Support for IDP login via GUI Custom response headers for request routing Specify number of DNS replies for request routing New flags for agents (backwards compatible with old flags): varnish-admin-host varnish-port varnish-invalidation-port Tags routing now supports multiple subdecisions Changes Staging of VCLGroups has been removed Permission system reworked and might require some updates of permissions for users/organizations. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.12r6/ Wed, 31 Jan 2024 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.12r6/ About the release This release contains multiple improvements, new features and bug fixes. Most notable is the implementation of a backend priority scheme in vmod_udo, and the introduction of support for JA3 TLS fingerprinting. There are multiple important bug fixes. All users are encouraged to upgrade. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-enterprise-6.0.12r5/ Thu, 07 Dec 2023 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.12r5/ About the release This release introduces CLI commands for handling TLS certificates. You can now load, discard and update certificates without restarting Varnish. See Changelog for more details. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-enterprise-6.0.12r4/ Wed, 29 Nov 2023 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.12r4/ About the release This release contains a few bug fixes and no new features. All users of Varnish Enterprise are encouraged to upgrade. See Changelog for more details. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-enterprise-6.0.12r3/ Fri, 17 Nov 2023 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.12r3/ About the release A mistake in the previous release introduced a race condition that could under certain conditions trigger an assert. We apologize for this slipping through the cracks of our QA procedure. The 6.0.12r2 release has been pulled from our repositories and will no longer be available. All users are encouraged to upgrade. See Changelog for more details. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-enterprise-6.0.12r2/ Thu, 16 Nov 2023 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.12r2/ About the release This release contains a couple bug fixes and one new feature. All users of Varnish Enterprise are encouraged to upgrade. See the changelog for a detailed description of the added mitigations. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-enterprise-6.0.12r1/ Mon, 23 Oct 2023 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.12r1/ About the release This release adds mitigations for the recently uncovered CVE-2023-44487. These mitigations address a denial of service attack where an attacker can rapidly create a large volume of HTTP/2 streams and immediately reset them, causing Varnish to consume unnecessary resources for processing requests where the response will not be delivered. See the changelog for a detailed description of the added mitigations. References Changelog Upgrade notes CVE-2023-44487 https://docs.varnish-software.com/releases/varnish-controller-5.3.2/ Fri, 20 Oct 2023 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-5.3.2/ This is a patch release for Varnish Controller with the following fixes: Improved router configuration reload Automatic host lookup of unconfigured IPv4/IPv6 for agents in the router is now only performed if DNS routing is enabled. If an agent is unable to load the root VCL, it will stay in failing state instead of flipping between running/failing. All components built with Go 1.21.3 UI: Fixed a bug in dashboard where the donut chart would show “No data to show”. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.11r7/ Wed, 27 Sep 2023 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.11r7/ About the release This release fixes a bug where timeout_reqbody was enabled by default. See Changelog for the complete list of features and bug fixes in this release. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-enterprise-6.0.11r6/ Thu, 21 Sep 2023 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.11r6/ About the release This release contains multiple new features. Most notably, A new fault tolerance facility for MSE 3. This allows MSE to deal with device failure in a more graceful manner. New commands socket.open, socket.close and socket.list for the CLI. They can be used to decide whether to accept or refuse new client traffic. When sockets are closed, ongoing requests are processed until they complete, but new requests are refused and connections are closed. https://docs.varnish-software.com/releases/varnish-controller-5.3.1/ Mon, 18 Sep 2023 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-5.3.1/ This is a patch release for Varnish Controller with the following fixes: Resolved a bug in migration logic Improved SQL query for inserting Varnish Statistics See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-controller-5.3.0/ Tue, 12 Sep 2023 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-5.3.0/ Note: All components needs to be upgraded for this release, see versioning. The release includes bug fixes and improvements. The traffic router default systemd file now has a LimitNOFILE set to 200000. This is to support a large number of connections towards the router. Improvements to file rollback functionality Improved performance for database queries Router logs for utilization of endpoints now includes the current utilization and the configured limit. vcli now support --clear-health-headers for RoutingRules, to clear existing health-headers. https://docs.varnish-software.com/security/VSV00012/ Thu, 17 Aug 2023 05:00:00 +0000 https://docs.varnish-software.com/security/VSV00012/ A base64 decoding vulnerability has been discovered in vmod-digest. This problem was discovered by an external party and not reported responsibly to Varnish Software or the Varnish Cache project. Since we don’t know exactly how widespread the knowledge about this vulnerability is, we have acted as though it is public knowledge or at least easily available. This warranted a fast-tracked process between discovery and disclosure. Impact The potential outcome of the vulnerability can be both authentication bypass and information disclosure, however the exact attack surface will depend on the particular VCL configuration in use. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.11r5/ Mon, 14 Aug 2023 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.11r5/ About the release This release contains a couple of new features and a bug fix. All users of Varnish Enterprise are encouraged to upgrade. See Changelog for more details. References Changelog Upgrade notes https://docs.varnish-software.com/releases/hitch-1.8.0/ Wed, 09 Aug 2023 15:00:00 +0200 https://docs.varnish-software.com/releases/hitch-1.8.0/ About the release This is a maintenance release with bug fixes and a few new features. Have a look at the changelog for more details. References Changelog Config file reference documentation https://docs.varnish-software.com/releases/varnish-enterprise-6.0.11r4/ Wed, 12 Jul 2023 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.11r4/ About the release This release contains several new features, including backend connection queues for managing connections when max_connections is reached, support for ECDSA algorithms in vmod_jwt and enhanced backend probes with expect_close for servers that don’t honor Connection: close. All users are encouraged to upgrade. VRT update The VRT version has been updated with this version of Varnish Enterprise, which means that VMODs need to be recompiled for this version to work with this version. https://docs.varnish-software.com/releases/varnish-controller-5.2.3/ Wed, 28 Jun 2023 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-5.2.3/ This is a patch release for Varnish Controller with the following fixes: Moving average has been added to avoid spiking values when the agent reports bandwidth utilization for varnish instances. Fixed a bug where the agent did not report in the values for: temperature, busy and status to the controller for root deployed VCLGroups. Fixed a bug in UI where “Related VCLGroups” wouldn’t show all the connected VCLGroups. See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. https://docs.varnish-software.com/releases/varnish-controller-5.2.2/ Tue, 20 Jun 2023 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-5.2.2/ This is a patch release for Varnish Controller with the following fixes: UI: Fixed a bug where certain includes wouldn’t be included in a VCLGroup. UI: Fixed a bug where it wasn’t possible to reset the tag in Geolocation route. See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.11r3/ Wed, 14 Jun 2023 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.11r3/ About the release This is a small release containing a few significant bug fixes in scoreboard task tracking, VMOD activedns, VMOD goto and the fast_304 feature. There are no new features. All users are encouraged to upgrade. See Changelog for more details. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-controller-5.2.1/ Tue, 13 Jun 2023 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-5.2.1/ This is a patch release for Varnish Controller with the following fixes: All components built with Go 1.20.5 Bug fix where organization user with only read access to agents/routers could assign/remove tags. Now write access to agent/routers is required to assign/remove tags. Bug fix for deleting a domain that is in use, the API previously returned status code 503 Internal Server Error, now it will return 403 Bad Request. Improved performance when using API filters. https://docs.varnish-software.com/releases/varnish-enterprise-6.0.11r2/ Thu, 01 Jun 2023 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-enterprise-6.0.11r2/ About the release This release contains a few new features, most notably introducing VMOD s3. VMOD s3 introduces functionality for using Varnish as a caching proxy in front of S3, including acting as a dynamic backend director for S3 endpoints. There are multiple important bug fixes. All users are encouraged to upgrade. See Changelog for more details. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-controller-5.2.0/ Thu, 25 May 2023 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-5.2.0/ Note: All components needs to be upgraded for this release, see versioning. The release includes bug fixes and improvements. All binaries built with Go 1.20.4 Various performance improvements to database calls. Improved CIDR routing decision that resolves an issue where two CIDR matches resulted in unpredicted match. Static tags for private agents/routers are now added to the owner organization. Note: This fix will produce duplicate tags with same name but new IDs, existing tags will still be used for existing deployments. https://docs.varnish-software.com/releases/varnish-controller-5.1.4/ Thu, 04 May 2023 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-5.1.4/ This is a patch release for Varnish Controller with the following fixes: Fixes a bug where the router would crash during health checks of external routes. This is a regression introduced in release 5.1.2. Releases prior to 5.1.2 are not affected. See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. Take a look at the Varnish Controller Deprecation page to prepare for upcoming major changes. https://docs.varnish-software.com/releases/varnish-controller-5.1.3/ Fri, 21 Apr 2023 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-5.1.3/ This is a patch release for Varnish Controller with the following fixes: Fixed a bug where removing a RoutingRules from a VCLGroup would remove the RoutingRules from all VCLGroups that used the same RoutingRules. Added support for mixed-casing DNS responses in the Router to support Google’s mixed-casing domain lookups. Build with Go 1.20.3. Fixed an error that appeared when content retrieval to a non existing path was requested through the UI-server. https://docs.varnish-software.com/releases/varnish-controller-5.1.2/ Wed, 22 Mar 2023 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-5.1.2/ This is a patch release for Varnish Controller with the following fixes: Fixed a bug in the Request Router where random was redirected to an unhealthy endpoint. Improved database indexes for faster queries. Headers set for health probes in the Routing Rules are now sent in the same casing as configured. Build with Go 1.20.2. vcli file now has -label support. Error log level when MMDB CSV file is not configured has been lowered to Info. https://docs.varnish-software.com/announcements/varnish-cache-plus-is-now-enterprise/ Tue, 14 Mar 2023 00:00:01 +0000 https://docs.varnish-software.com/announcements/varnish-cache-plus-is-now-enterprise/ Executive summary What From today, future releases of Varnish Cache Plus will be called Varnish Enterprise in release notes, changelog and documentation. Why This change brings Varnish documentation up to date with the current naming convention of the commercial version of Varnish. How This change is fully backwards compatible and no action needs to be taken in existing environments. Details The change is fully backwards compatible and no action needs to be taken since it doesn’t affect how Varnish is installed, configured or managed. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.11r1/ Fri, 10 Mar 2023 14:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.11r1/ About the release This release contains some new features and some bug fixes. The new features include new counters, improved TLS support in varnishtest and improvements in VMODs rewrite and http. All users of Varnish Enterprise are encouraged to upgrade. See the changelog for the list of changes in this release. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-controller-5.1.1/ Mon, 27 Feb 2023 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-5.1.1/ This is a patch release for Varnish Controller with the following fixes: UI: Fixed a bug where Tokens wouldn’t show in the menu for org-users. See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. Take a look at the Varnish Controller Deprecation page to prepare for upcoming major changes. This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-controller-5.1.0/ Thu, 23 Feb 2023 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-5.1.0/ Note: All components needs to be upgraded for this release, see versioning. The release includes bug fixes, new features and improvements. New Features Support for custom headers in router health checks. Support for CNAME for external routes. External routes location template support (for custom location format). getent used as fallback to get uid/gid for components running as a user/group (to support IDM). Flatbuffer schema for gRPC plugin now includes tags for endpoints and support for rejection decision. https://docs.varnish-software.com/releases/varnish-discovery-1.5.0/ Fri, 10 Feb 2023 08:00:00 +0000 https://docs.varnish-software.com/releases/varnish-discovery-1.5.0/ Maintenance release, including:\ Azure SDK minor version upgrade. AWS SDK major version upgrade from v1 to v2. Go 1.20.0 References Varnish Discovery changelog https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.10r5/ Wed, 25 Jan 2023 10:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.10r5/ About the release This release contains many bug fixes and minor features. All users of Varnish Enterprise are encouraged to upgrade. See the changelog for the list of changes in this release. References Changelog Upgrade notes https://docs.varnish-software.com/announcements/varnish-administration-console-eol/ Mon, 02 Jan 2023 01:00:01 +0000 https://docs.varnish-software.com/announcements/varnish-administration-console-eol/ End-of-life Varnish Administration Console (VAC) has reached end-of-life status. This means that we will no longer be providing updates, bug fixes, or technical support for the product. With the end-of-life status of VAC, it is important to transition to the Varnish Controller, which has replaced the VAC and has all its features and much more. Continuing to use Varnish Administration Console past its end-of-life date may present several risks, including: https://docs.varnish-software.com/announcements/container-base-bullseye/ Mon, 02 Jan 2023 00:00:01 +0000 https://docs.varnish-software.com/announcements/container-base-bullseye/ The latest versions of our container images are now based on Debian bullseye and will from now on be updated daily with the latest OS updates. Affected container images: quay.io/varnish-software/varnish-plus quay.io/varnish-software/varnish-plus-waf quay.io/varnish-software/varnish-discovery quay.io/varnish-software/varnish-broadcaster quay.io/varnish-software/varnish-controller-agent quay.io/varnish-software/varnish-controller-brainz quay.io/varnish-software/varnish-controller-nats quay.io/varnish-software/varnish-controller-router quay.io/varnish-software/varnish-controller-ui quay.io/varnish-software/varnish-controller-cli A new tagging scheme has also been implemented: For Varnish Enterprise: varnish-plus:6.0.10r1 quay.io/varnish-software/varnish-plus:latest quay.io/varnish-software/varnish-plus:6.0.10r1 quay.io/varnish-software/varnish-plus:6.0.10 quay.io/varnish-software/varnish-plus:6.0 quay.io/varnish-software/varnish-plus:6 Varnish Controller Agent is bit special as it is based on a Varnish Plus image and versioned with the Varnish Plus version. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.10r4/ Wed, 30 Nov 2022 10:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.10r4/ About the release This release contains many bug fixes and minor features. As an example, there are many updates to the Slicer feature. All users of Varnish Enterprise are encouraged to upgrade. See the changelog for the list of changes in this release. References Changelog Upgrade notes https://docs.varnish-software.com/security/VSV00011/ Tue, 08 Nov 2022 08:01:00 +0000 https://docs.varnish-software.com/security/VSV00011/ A request forgery attack can be performed on Varnish Cache and Varnish Cache Plus servers that have the HTTP/2 protocol turned on. An attacker may introduce characters through the HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This may in turn be used to successfully exploit vulnerabilities in a server behind the Varnish server. https://docs.varnish-software.com/security/VSV00010/ Tue, 08 Nov 2022 08:00:00 +0000 https://docs.varnish-software.com/security/VSV00010/ Note: This issue applies only to the open source version of Varnish Cache, in version 7.0.x, 7.1.x and 7.2.x. Varnish Enterprise is not affected. For more information please see the open source project’s advisory page. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend. Among the headers that can be filtered this way are both Content-Length and Host, making it possible for an attacker to both break the HTTP/1 protocol framing, and bypass request to host routing in VCL. https://docs.varnish-software.com/releases/varnish-controller-5.0.2/ Tue, 08 Nov 2022 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-5.0.2/ This is a patch release of Varnish Controller. This release includes bug fixes and minor improvements. The router now strips port from requested domain, to allow the router to run on none default ports. Improved logging for Varnish-admin interface (the agent now logs connection/disconnection towards Varnish) Improved logging for NATS connection/disconnection for api-gw/brainz/agent/router. Improved error logging for the VCLI. NATS updated to latest version, v2.9.6. All components built with Go 1. https://docs.varnish-software.com/releases/varnish-controller-5.0.1/ Tue, 25 Oct 2022 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-5.0.1/ This is a patch release of Varnish Controller. This release includes bug fixes. Fixes a bug where Brainz could panic when routers is used. Fixes a bug where invalidations got stuck for a removed VCLGroup. Fixes a bug where invalidations could get stuck in Retrying state. Fixes a bug where invalidations in Retrying state could not be deleted. Updated dependencies Fixes a bug where domains always was shown as required when creating/editing a VCLGroup in the web interface. https://docs.varnish-software.com/releases/varnish-broadcaster-1.6.0/ Tue, 18 Oct 2022 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-broadcaster-1.6.0/ This is a minor release. It includes bug fixes, improvements and some new features. Built with Go 1.19.2 New API endpoint /api/status/count (see API documentation) New flag to configure the job purger (-job-purger <duration>) for removing finished async job requests. See Broadcaster Changelog page for more details. https://docs.varnish-software.com/releases/varnish-controller-5.0.0/ Tue, 18 Oct 2022 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-5.0.0/ This is a major release of Varnish Controller and all its components need to be updated. The release contains several non backward compatible changes. These changes are described in the upgrade chapter. This release requires Varnish Enterprise 6.0.9r5 or later. This release includes bug fixes, new features and several improvements. New Features Private Agents that can be shared between organizations. Private Routers that can be shared between organizations. Support for adding custom Accounting keys to save custom statistics (agent configuration). https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.10r3/ Wed, 05 Oct 2022 07:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.10r3/ About the release This release is a bug fix release. All users of Varnish Enterprise are encouraged to upgrade. See the changelog for the list of changes in this release. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.10r2/ Wed, 17 Aug 2022 08:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.10r2/ About the release This release contains several bug fixes and a few minor features. New in this release is support for prometheus format for vmod_kvstore counters in vmod_stat, improved parallel ESI scheduling and better tracing of ESI requests in varnishscoreboard. See the changelog for the complete list of changes in this release. References Changelog Upgrade notes https://docs.varnish-software.com/security/VSV00009/ Tue, 09 Aug 2022 08:00:00 +0000 https://docs.varnish-software.com/security/VSV00009/ Note: This issue applies only to the open source version of Varnish Cache, in version 7.0.x and 7.1.x. Varnish Enterprise is not affected. For more information please see the open source project’s advisory page. A denial of service attack can be performed against Varnish Cache servers by specially formatting the reason phrase of the backend response status line. In order to execute an attack, the attacker would have to be able to influence the HTTP/1 responses that the Varnish Server receives from its configured backends. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.10r1/ Tue, 26 Jul 2022 10:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.10r1/ About the release This release contains both new features and several bug fixes. New in this release are preview packages of Varnish Cache Plus for Ubuntu 22.04 LTS (Jammy Jellyfish). This marks the first step in making Ubuntu 22.04 a fully supported platform. Other noteworthy changes are support for HTTP proxy tunneling in vmod_akamai, and new features in vmod_headerplus. See the changelog for the complete list of changes in this release. https://docs.varnish-software.com/releases/varnish-discovery-1.4.0/ Wed, 29 Jun 2022 10:00:00 +0000 https://docs.varnish-software.com/releases/varnish-discovery-1.4.0/ Maintenance release, including AWS SDK version upgrade. References Varnish Discovery changelog https://docs.varnish-software.com/releases/varnish-controller-4.1.3/ Mon, 27 Jun 2022 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-4.1.3/ This is a patch release for Varnish Controller with the following fixes: Fixed a bug when upgrading to 4.X.X the internal file name column stayed empty, causing compilation failures. See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. Take a look at the Varnish Controller Deprecation page to prepare for upcoming major changes. This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-custom-statistics-6.2.2/ Thu, 09 Jun 2022 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-custom-statistics-6.2.2/ About the release This release is a bug fix release that fixes an issue where vcs-server would leak connections if a write failure occurred when using the -O option. The full set of changes can be found on the changelog. We recommend you to upgrade to this release. References Varnish Custom Statistics changes Varnish Custom Statistics documentation https://docs.varnish-software.com/releases/varnish-controller-4.1.2/ Wed, 01 Jun 2022 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-4.1.2/ This is a patch release for Varnish Controller with the following fixes: Fixed a bug when upgrading to 4.0.0 the name of the file could be reset when deploying a VCLGroup. Fixed a bug where renaming a file would result in a compile failure. Minor UI bug fixes for the dashboard Fixed a bug where the UI validation hindered the invalidation when only domain was sent in. Fixed a autosuggestion with wrong formatting. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.9r7/ Fri, 20 May 2022 10:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.9r7/ About the release This release is a bug fix release to address a significant regression that first appeared in Varnish Cache Plus 6.0.9r5. Also released is the Varnish Web Application Firewall (WAF) version 1.1.1, which requires VCP version 6.0.9r7 (this release) or newer. New in this version are functions to skip rules by either an ID or a tag. From the changelog: A problem has been found in the change introduced in version 6. https://docs.varnish-software.com/releases/varnish-controller-4.1.1/ Tue, 17 May 2022 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-4.1.1/ This is a patch release for Varnish Controller with the following fixes: Fixed a bug where a VCLGroup could stay in a compiled state. Swagger docs compatible with Swagger 2.0 Minor router and UI bug fixes See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. Take a look at the Varnish Controller Deprecation page to prepare for upcoming major changes. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.9r6/ Wed, 04 May 2022 13:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.9r6/ About the release This release contains only a few changes, of which one represents a significant reimplementation. New features: New version of vmod_http. The new version allows for better connection reuse, caching of hostname lookups, and gives better performance when many simultaneous requests are active. The new version is VCL compatible with the previous version, and no adjustments to VCL programs is necessary. Note that this version will limit the protocols enabled in the underlying CURL execution engine to HTTP and HTTPS, and that HTTP/1. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.9r5/ Thu, 28 Apr 2022 11:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.9r5/ About the release This release contains several bug fixes and some new features. Note: The 6.0.9r5-1 packages released on 2022-04-28 contained a change to the way PID-files were handled in the package-included varnishd.service systemd service file. These changes caused upgrade issues on some systems depending on if and how the varnishd.service had local customizations. This was due to a missing -P %t/%N/varnishd.pid command line option in the options given to varnishd in the customized service files, causing varnishd to not produce the PID-file systemd was told to expect. https://docs.varnish-software.com/releases/varnish-controller-4.1.0/ Tue, 19 Apr 2022 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-4.1.0/ Note: All components needs to be upgraded for this release, see versioning. The release includes bug fixes, new features and improvements. New Features gRPC plugin support for the Router. vcli now support proxy (-proxy). Statistic counters can now be defined with wildcard in agent configuration. New section for help & support which include a debugging view for system administrators (UI). Improvements Improved logging with support for timestamps (-log-timestamps), default enabled. Unified router/agent log messages in brainz. https://docs.varnish-software.com/releases/varnish-controller-3.0.4/ Tue, 19 Apr 2022 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-controller-3.0.4/ The release includes a bug fix in the API-GW. Bug fixes Fixed a bug where some endpoints could return incorrect resources See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. Take a look at the Varnish Controller Deprecation page to prepare for upcoming major changes. This update is recommended for all users with version 3.0.3. https://docs.varnish-software.com/releases/varnish-broadcaster-1.5.3/ Wed, 02 Mar 2022 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-broadcaster-1.5.3/ Patch release, built using Go 1.17. See Broadcaster Changelog page for more details. https://docs.varnish-software.com/releases/varnish-discovery-1.3.0/ Thu, 24 Feb 2022 10:00:00 +0000 https://docs.varnish-software.com/releases/varnish-discovery-1.3.0/ “Maintenance release, including dependency updates. No changes are required by the user” References Varnish Discovery changelog https://docs.varnish-software.com/releases/varnish-agent-6.2.7/ Thu, 24 Feb 2022 00:30:01 +0000 https://docs.varnish-software.com/releases/varnish-agent-6.2.7/ About the release This release includes possibility to enforce version 1.2 and above of TLS, as well as new a JSON endpoint for backends and bug fixes. References See varnish-agent changelog for more details. https://docs.varnish-software.com/releases/varnish-controller-4.0.0/ Thu, 17 Feb 2022 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-4.0.0/ This release is NOT backward compatible with 3.0. All Varnish Controller components requires an upgrade. The release includes bug fixes, new features and improvements. New Features Varnish Controller (Traffic) Router, for HTTP and DNS routing. VCL Compile feature for VCL Files added (UI). Added drag and drop support in dashboard and invalidation sequence. Varnishadm CLI commands file generated by the agents. The file contains varnishadm commands for current deployed Varnish VCL configuration. https://docs.varnish-software.com/security/VSV00008/ Tue, 25 Jan 2022 10:00:00 +0000 https://docs.varnish-software.com/security/VSV00008/ A request smuggling attack can be performed on HTTP/1 connections on Varnish Cache and Varnish Enterprise servers. The smuggled request would be treated as an additional request by the Varnish server, go through normal VCL processing, and injected as a spurious response on the client connection. This problem was discovered and reported to us by James Kettle, Director of Research at PortSwigger. We wish to thank him for the responsible disclosure. https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.11r7/ Fri, 21 Jan 2022 10:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.11r7/ Important: If you are not running 4.1.9r1 (released November 30th 2017) or newer, make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.11r7. About the release This release is to reenable package building for Ubuntu Trusty. See the change log for details on this and previous releases. References Varnish Cache Plus changes Varnish Cache changes backported to this release of Varnish Cache Plus Upgrade notes https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.11r6/ Wed, 12 Jan 2022 10:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.11r6/ Important: If you are not running 4.1.9r1 (released November 30th 2017) or newer, make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.11r6. About the release This release is a bug fix release and fixes issues with certificate verification on platforms using OpenSSL version 1.0, a request body timing issue as well as the update frequency for DNS updates in libvmod_goto. It is a recommended update for all users of Varnish Cache Plus 4. https://docs.varnish-software.com/releases/varnish-administration-console-3.9.3/ Wed, 12 Jan 2022 01:00:01 +0000 https://docs.varnish-software.com/releases/varnish-administration-console-3.9.3/ About the release This is a patch release that includes Log4j2 version 2.17.1, with fixes for CVE-2021-44832. Varnish Administration Console is not vulnerable by default by CVE-2021-44832 as it requires specific configuration options that can be exploited. This release updates Log4j2 to the latest release to avoid keeping vulnerable versions of Log4j2 even if not affected by it by default. This version is recommended for all users. References Varnish Administration Console changelog Varnish Administration Console documentation https://www. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.9r4/ Tue, 21 Dec 2021 08:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.9r4/ About the release This is a bug fix release which addresses some issues with vmod_accounting, and is is a recommended upgrade for all users of Varnish Cache Plus 6.0.x. Also released is the Varnish Web Application Firewall (WAF) version 1.1.0, which requires VCP version 6.0.9r4. New in this version is the upgrade of ModSecurity from version 3.0.3 to 3.0.6. Note that this addresses a performance regression in ModSecurity 3.0.0 to 3. https://docs.varnish-software.com/releases/varnish-administration-console-3.9.2/ Mon, 20 Dec 2021 01:00:01 +0000 https://docs.varnish-software.com/releases/varnish-administration-console-3.9.2/ About the release This is a patch release that includes Log4j2 version 2.17.0, with fixes for CVE-2021-45105. Varnish Administration Console is not vulnerable by default by CVE-2021-45105 as it requires specific configuration options that can be exploited. This release updates Log4j2 to the latest release to avoid keeping vulnerable versions of Log4j2 even if not affected by it by default. This version is recommended for all users. References Varnish Administration Console changelog Varnish Administration Console documentation https://www. https://docs.varnish-software.com/releases/varnish-controller-3.0.3/ Thu, 16 Dec 2021 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-3.0.3/ This is a patch release for Varnish Controller with the following fixes: Added label support for root deployments Added support to filter on tags at the Varnish Stats endpoints Fixed a bug where filters with an operator returned incorrect results Improved Varnish Stats performance See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-administration-console-3.9.1/ Wed, 15 Dec 2021 01:00:01 +0000 https://docs.varnish-software.com/releases/varnish-administration-console-3.9.1/ About the release This is a patch release that includes Log4j2 version 2.16.0, with fixes for CVE-2021-44228 and CVE-2021-45046. This version is recommended for all users. References Varnish Administration Console Log4j2 CVE-2021-44228 and CVE-2021-45046 Varnish Administration Console changelog Varnish Administration Console documentation https://www.cve.org/CVERecord?id=CVE-2021-44228 https://www.cve.org/CVERecord?id=CVE-2021-45046 https://docs.varnish-software.com/security/CVE-2021-44228-45046/ Mon, 13 Dec 2021 00:00:00 +0000 https://docs.varnish-software.com/security/CVE-2021-44228-45046/ Updated December 15, 2021. Overview Two vulnerabilities have been discovered in the logging library Log4j2, which is used by Varnish Administration Console. These are identified as CVE-2021-44228 and CVE-2021-45046. Note that no other products from Varnish Software are affected by the same CVEs. An earlier version of this advisory indicated that a sufficient workaround for affected versions of Varnish Administration Console is to set the log4j2.formatMsgNoLookups=true parameter. As security research has continued to explore the potential of the vulnerabilities, it is clear that this workaround is not sufficient. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.9r3/ Thu, 09 Dec 2021 08:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.9r3/ About the release This release is a bug fix release, fixing several important issues in the new Slicer feature, as well as some minor bug fixes. See the changelog for the complete list of changes in this release. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.9r2/ Tue, 30 Nov 2021 08:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.9r2/ About the release This release corrects an important regression bug that was introduced in Varnish Cache Plus version 6.0.9r1. See the changelog for more information. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.9r1/ Thu, 25 Nov 2021 08:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.9r1/ About the release This release reintroduces the Slicer, which should now be ready for prime time. In addition to this, the release includes improvements in the probe-proxy VCL and several bug fixes. With this release the Via header changes to Via: 1.1 varnish (Varnish/6.0-plus) where -plus is new. You can undo this or remove the header entirely in sub vcl_deliver if you do not want to expose the Varnish version you are running. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.8r7/ Wed, 20 Oct 2021 15:55:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.8r7/ About the release This release contains a single change - the removal of the new Slicer feature. A regression was discovered shortly after the release of 6.0.8r6, and the right solution was to remove the Slicer feature altogether. The Slicer feature will be reintroduced when the problems have been solved. Important! MSE stores might have to be rebuilt There are two cases where you have to rebuild an MSE, where upgrading will not be enough: https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.8r6/ Wed, 20 Oct 2021 08:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.8r6/ Important! This release has been retracted Due to a regression in this release, the packages have been removed from the software repository, and are not available for installation. Version [6.0.8r7]({{ relref “/releases/varnish-cache-plus-6.0.8r7.md” >}}) has been released, and should be installed instead. Read the announcement if you have installed 6.0.8r6 on any of your servers. Contact support@varnish-software.com if you need assistance in this process. About the release The major highlights of this release are the new Image VMOD that enables image conversions from VCL, and also the new Slicer VMOD that can transparently break down very large objects into smaller parts that are individually cached. https://docs.varnish-software.com/releases/varnish-controller-3.0.2/ Tue, 19 Oct 2021 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-3.0.2/ This is a patch release for Varnish Controller with the following fixes: Fixed a bug where root deployments could not be used with invalidations Fixed a bug where organization accounts could not use invalidations Added deployedAt date and time to the agentStates property of the VCLGroups See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade. This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.8r5/ Fri, 08 Oct 2021 08:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.8r5/ About the release This release is a bug fix release. All users of Varnish Enterprise 6 are encouraged to update to this version. Bugs fixed: Fixed an off-by-one bug in xbody.log_body that would in rare cases lead to a panic. Fix a race in varnishtest cyclic barriers where the barrier could lose count of the number of waiters and deadlock the test. Experimental VMOD vmod_stat has received several format fixes to both its prometheus and JSON output backends. https://docs.varnish-software.com/releases/varnish-controller-3.0.1/ Wed, 06 Oct 2021 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-3.0.1/ This is a patch release for Varnish Controller with the following fixes: Persistent Statistics Update Statistics of the type counter is now showing the counts per time frame and not average. Statistics that are of the type boolean or gauge will still be averaged for the given time frame. MAIN.uptime will not be part of aggregation. Support for vmod-goto counters has been removed for now. Statistics of type bitmap are not persistently stored. https://docs.varnish-software.com/releases/varnish-controller-3.0.0/ Tue, 28 Sep 2021 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-3.0.0/ This release is NOT backward compatible with 2.0.5. All Varnish Controller components requires an upgrade. The release includes bug fixes, new features and improvements. In most cases, no configuration changes is required after upgrade. It will be enough to upgrade packages and make sure that the component services gets restarted. New Features Invalidation (purging, banning and tag-based) Per VCLGroup statistics via integration with from vmod-accounting Persistent statistics Customizable dashboards Updated and overhauled the web based UI Improvements Parallel asynchronous VCLGroup deployments CSV output from the CLI Compile state in the CLI Performance improvements And more… https://docs.varnish-software.com/releases/varnish-controller-2.0.5/ Wed, 15 Sep 2021 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-2.0.5/ This is a patch release that optimizes statistics inserts into the database, lowering CPU usage of Brainz. It also normalizes dynamic backends statistic counters for the vmod-goto. Meaning that stored statistic counters from vmod-goto in Varnish Controller will have the ID from the counter name removed. Example: goto.000004f.(127.0.0.1).(http://example.com:80).(ttl:10.000000).conn => goto.(127.0.0.1).(http://example.com:80).(ttl:10.000000).conn Upgrading from 2.0.4 does not require any configuration changes to any of the components. See Varnish Controller Changelog. This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.8r4/ Thu, 26 Aug 2021 12:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.8r4/ About the release This release contains several bug fixes and a few minor features. New features: Add urlplus.query_set() to update query values. In varnishadm, the backend.list commands now supports -j. A counter for the number of ESI sub requests has been added. For backend transactions, there are now new timestamps called Fetch, Connected and Process. The accounting VMOD’s counter set for keys now includes grace_hit. Bugs fixed: Backend_health log records no longer display (null) as the name the first time it is logged. https://docs.varnish-software.com/releases/varnish-controller-2.0.4/ Tue, 17 Aug 2021 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-2.0.4/ This is a patch release that includes a fix for growing snapshots database table and fixes a panic in brainz. Upgrading from 2.0.3 does not require any configuration changes to any of the components. See Varnish Controller Changelog for more details. This update is recommended for all users. https://docs.varnish-software.com/security/VSV00007/ Tue, 13 Jul 2021 10:00:00 +0000 https://docs.varnish-software.com/security/VSV00007/ Overview A request smuggling attack can be performed on Varnish Cache and Varnish Cache Plus servers that have the HTTP/2 protocol enabled. The smuggled requests do not go through normal VCL processing, and any authorization steps implemented in VCL would be bypassed. The responses to the smuggled requests can under some circumstances also be obtained by the attacker. Also, it may be possible for an attacker to use this for cache poisoning, where the response to a smuggled request is inserted as the cached content. https://docs.varnish-software.com/releases/varnish-broadcaster-1.5.2/ Mon, 12 Jul 2021 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-broadcaster-1.5.2/ Broadcasting statistics with methods Argument/man-page documentation updates for connection management Better UI support for a proxy environment. See Broadcaster Changelog page for more details. https://docs.varnish-software.com/releases/varnish-controller-2.0.3/ Wed, 30 Jun 2021 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-2.0.3/ This is a patch release that includes a couple minor bug fixes and improvements. Upgrading from 2.0.2 does not require any configuration changes to any of the components. See Varnish Controller Changelog for more details. This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.8r3/ Tue, 15 Jun 2021 10:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.8r3/ About the release This is a bugfix release fixing smaller issues, some of which was introduced in the previous feature release. New features: Increased the MAX_HDR limit in varnishtest from 50 to 256. Bugs fixed: Fix a vmod_goto bug introduced in 6.0.8r2, where creating two identical dns_director objects would trigger an assert. (VS issue #1176) Fix a NULL pointer dereference in an error handling path in the JWT VMOD. Fix a NULL pointer dereference when setting namespaces in the Accounting VMOD. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.8r2/ Wed, 02 Jun 2021 08:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.8r2/ About the release This release, contains a long list of new features and many bug fixes. The new features include the following: A new VMOD accounting has been added. It lets you create namespaces and add counters to each namespace which can track lot of useful statistics on traffic flowing in and out of Varnish. A new VMOD uri has been added. It makes it easy to parse a URI into the five generic components: scheme, authority, path, query and fragment. https://docs.varnish-software.com/releases/varnish-controller-2.0.2/ Mon, 10 May 2021 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-2.0.2/ This is a patch release that includes several minor bug fixes and improvements. Upgrading from 2.0.1 does not require any configuration changes to any of the components. See Varnish Controller Changelog for more details. This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-controller-2.0.1/ Tue, 04 May 2021 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-2.0.1/ This is a patch release that includes several minor bug fixes and improvements. Upgrading from 2.0.0 does not require any configuration changes to any of the components. Changes That Requires Action If the VCLI is used via automation the need for -y (or --yes) flag is required for several commands listed below. This is to prevent showing the interactive prompt that has been added for these commands. The need for interactive input has been added as a safeguard and can be circumvented using the -y flag for the commands that accept this flag. https://docs.varnish-software.com/releases/varnish-controller-2.0.0/ Fri, 23 Apr 2021 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-2.0.0/ This release is NOT backward compatible with 1.0.4. All Varnish Controller components requires an upgrade. The release includes bug fixes, new features and improvements. In most cases, no configuration changes is required after upgrade. It will be enough to upgrade packages and make sure that the component services gets restarted. New Features Draft and rollbacks of VCL files (VCLGroups) Organization private tags New endpoint /api/v1/ownerships (only accessible as system admin) Ownership of resources in the VCLI Agent locking if database has been reset/removed (see agents chapter) Sorting using query parameter sort=<column>[:asc|desc] (VCLI and API) Pagination using query parameter take=<limit>[,<offset>] (VCLI and API) Self-signed TLS support in VCLI Improvements Possible to fetch metrics per agent with VCLI VCLI no longer support -p for password (support for ENV variables instead) No longer required to input organization when logging in with VCLI Brainz arguments to specify TLS certs for the database VCLI JSON output improved Agents include what static tags they are configured with Assign an account to multiple organizations using filters in VCLI. https://docs.varnish-software.com/security/VSV00006/ Tue, 16 Mar 2021 08:00:00 +0000 https://docs.varnish-software.com/security/VSV00006/ Details A problem has been found in the Header VMOD of the Varnish Modules collection of frequently used VMODs. It applies to version 0.17.0 of Varnish Modules, which is only compatible with the 6.5 version of Varnish Cache. It makes it possible for common usage patterns of the Header VMOD in VCL to open up remote triggering of an assert or NULL pointer dereference in Varnish Cache, causing Varnish Cache to assert and restart. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.8r1/ Thu, 11 Mar 2021 09:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.8r1/ About the release This release, 6.0.8r1, fixes a number of bugs, and introduces a few minor features. The new features include the following: The file VMOD now supports 304 Not Modified. Improvements in the kvstore VMOD’s auto decrementing counters. The new function std.bytes() can convert strings like 1GB to a value of type BYTES. A new function called utils.hash_ignore_vary() can be used to force a hit on any variant that might be in the cache. https://docs.varnish-software.com/releases/varnish-controller-1.0.4/ Tue, 23 Feb 2021 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-1.0.4/ This release includes several bug fixes. See Varnish Controller Changelog for more details. This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.7r3/ Tue, 09 Feb 2021 15:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.7r3/ About the release This release, 6.0.7r3, fixes a number of bugs, and introduces a few minor features. The new features include the following: A new resp.send_timeout variable to set the send timeout on a per-request basis from vcl. varnishncsa now supports Epoch timestamps. MSE variable memory_target can now be negative for non % tagged value, indicating how much memory to leave unused on the system. Object misses can now be counted via utils. https://docs.varnish-software.com/releases/varnish-controller-1.0.3/ Tue, 09 Feb 2021 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-1.0.3/ This release includes several bug fixes and also some new backward compatible additions. See Varnish Controller Changelog for more details. This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-discovery-1.2.0/ Wed, 27 Jan 2021 10:00:00 +0000 https://docs.varnish-software.com/releases/varnish-discovery-1.2.0/ This release introduces two changes that help set up update-reload pipeline: nodes and groups are now sorted before being rendered, to ease comparison between two outputs. the -postudate argument has been introduced, allowing discovery to run commands after a group change. References Varnish Discovery changelog https://docs.varnish-software.com/releases/varnish-controller-1.0.2/ Tue, 26 Jan 2021 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-1.0.2/ A license file is now required. The license file is added to brainz. Please contact sales or support to retrieve a license file. The system will continue running without a license file, but login is disabled for all users. Small improvements and bug fixes in Brainz, Agent, API-GW, CLI, UI Server and the UI. Packaging has been updated with the following: RPM packages for brainz now installs nats.conf correctly. Varnish-Controller user is now part of the varnish group for the agent. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.7r2/ Thu, 14 Jan 2021 16:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.7r2/ About the release This release, 6.0.7r2, fixes a number of bugs, and introduces a few minor features. The new features include the following: A new counter, MAIN.fetch_stale_rearm for rearm() and revive() A new function, utils.resolve_backend() is now available. There is a new VHA6 setting for disabling VCS logging. In varnishncsa there is a new format option; log request time in milliseconds There is a port_rule optional parameter to vmod_goto. Default abide will use port from SRV record, while force will use the port parameter. https://docs.varnish-software.com/releases/varnish-controller-1.0.1/ Mon, 04 Jan 2021 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-controller-1.0.1/ First release of Varnish Controller. See Varnish Controller Documentation page for more details. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.7r1/ Mon, 21 Dec 2020 08:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.7r1/ About the release This release, 6.0.7r1, contains a number of improvements and fixes. Most notably, the following is new: A brand new varnishscoreboard is available. SSL/TLS backends now support transmitting a client certificate as part of the TLS handshake The tls VMOD can now also be used in vcl_backend_response, to inspect the state of a TLS backend connection. The kvstore VMOD has a static scope, which allows keeping kvstore content across VCL reloads. https://docs.varnish-software.com/releases/varnish-custom-statistics-6.1.0/ Mon, 16 Nov 2020 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-custom-statistics-6.1.0/ The vcs-agent will now send a PING ZMTP (heartbeat) command every 3000 milliseconds. Introduces a new user interface (v2). The full set of changes can be found on the changelog. We recommend you to upgrade to this release. References Varnish Custom Statistics changes Varnish Custom Statistics documentation https://docs.varnish-software.com/releases/varnish-broadcaster-1.5.1/ Tue, 03 Nov 2020 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-broadcaster-1.5.1/ Fixes a bug that could cause panic during hot-reload of configuration file. See Broadcaster Changelog page for more details. This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-broadcaster-1.5.0/ Tue, 20 Oct 2020 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-broadcaster-1.5.0/ New mgmt-host option added for binding to different host on management interface New mgmt-on option added to enable/disable management interface. Statistics endpoint added /api/v1/stats and /api/v1/stats/reset. Improved port validation for port arguments. See Broadcaster Changelog page for more details. This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.6r10/ Fri, 16 Oct 2020 08:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.6r10/ About the release This release introduces Brotli compression support in Varnish Cache Plus. This enables Varnish to handle Brotli compressed content from the backend, on the fly Brotli compression of fetched data, and serving of Brotli compressed content to clients that advertise Brotli support. See the Brotli VMOD documentation for more information. Several minor features and bug fixes are also in this release. For the complete list, please see the Changelog. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.6r9/ Wed, 30 Sep 2020 14:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.6r9/ About the release This is a bug fix release, that fixes a performance regression when using the built in client TLS termination. This problem would show up as an influx of client TLS connections being dropped as bad requests when the system is under load. For a complete list of features and bug fixes from this and previous versions, please see the Changelog. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-broadcaster-1.4.1/ Mon, 31 Aug 2020 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-broadcaster-1.4.1/ This release fixes a rare timeout issue that could occur at high load. See Broadcaster Changelog page for more details. This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-administration-console-3.9.0/ Mon, 24 Aug 2020 05:30:01 +0000 https://docs.varnish-software.com/releases/varnish-administration-console-3.9.0/ Minor release that fixes various CVEs due to usage of old libraries. This version is recommended for all users. References Varnish Administration Console changelog Varnish Administration Console documentation https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.6r8/ Tue, 11 Aug 2020 14:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.6r8/ About the release This release introduces the resolver VMOD that enables doing reverse IP DNS resolution and verification from VCL, as well as veribot VCL library to enable domain-based access controls. The Akamai Connector and it’s accompanying VCL library now has a VCL 4.1 version available, which makes it easier to integrate into existing configurations based off of VCL version 4.1. Several bug fixes are also in this release, notably in MSE and libvmod_goto. https://docs.varnish-software.com/releases/varnish-broadcaster-1.4.0/ Tue, 11 Aug 2020 04:00:01 +0000 https://docs.varnish-software.com/releases/varnish-broadcaster-1.4.0/ This release adds the -confwatch switch to reload configuration file automatically if it changes. See Broadcaster Changelog page for more details. This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-administration-console-3.8.6/ Wed, 08 Jul 2020 05:30:01 +0000 https://docs.varnish-software.com/releases/varnish-administration-console-3.8.6/ Patch release which fixes an issue of not showing the VAC version. This version is recommended for all users. References Varnish Administration Console changelog Varnish Administration Console documentation https://docs.varnish-software.com/releases/varnish-custom-statistics-6.0.4/ Fri, 03 Jul 2020 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-custom-statistics-6.0.4/ Fix an underflow issue causing some counters to display the wrong value. Counters have been added to track piped requests The full set of changes can be found on the changelog. We recommend you to upgrade to this release. References Varnish Custom Statistics changes Varnish Custom Statistics documentation https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.6r7/ Tue, 30 Jun 2020 14:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.6r7/ About the release This is a bug fix release to address a packaging issue with the previous release, as well as fixing some bugs in VHA6, MSE and a couple of VMODs. For a complete list of features and bug fixes from this and previous versions, see the Changelog. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.6r6/ Wed, 24 Jun 2020 15:20:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.6r6/ About the release This release introduces the new headerplus VMOD for advanced header manipulation. It also improves several VMODs (http, xbody and crypto) and VHA6. In addition to the above, several minor bugs are fixed. For a complete list of features and bug fixes from this and previous versions, see the Changelog. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-discovery-1.1.0/ Mon, 22 Jun 2020 10:00:00 +0000 https://docs.varnish-software.com/releases/varnish-discovery-1.1.0/ The biggest item of this release is the support for the Azure platform, but it also simplifies the AWS setup by automatically trying to find the AWS configuration file from the user name. References Varnish Discovery Azure example Varnish Discovery changelog https://docs.varnish-software.com/releases/varnish-broadcaster-1.3.1/ Mon, 15 Jun 2020 04:00:01 +0000 https://docs.varnish-software.com/releases/varnish-broadcaster-1.3.1/ This is a patch release to fix an issue with TLS automatic server name verification. See Broadcaster Changelog page for more details. This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-broadcaster-1.3.0/ Mon, 08 Jun 2020 04:00:01 +0000 https://docs.varnish-software.com/releases/varnish-broadcaster-1.3.0/ This Varnish Broadcaster release addresses some known issues and adds some new functionality. Some highlights of this update includes: New broadcasting headers added. User interface included in package and supports TLS enabled broadcaster. Various bug fixes. Performance improvements. Lower memory usage Modes for TLS verification towards nodes. See Broadcaster Changelog page for more details. This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-administration-console-3.8.5/ Wed, 27 May 2020 05:30:01 +0000 https://docs.varnish-software.com/releases/varnish-administration-console-3.8.5/ Mongo driver has been upgraded to 2.14.3. SSL support for self signed certificates. Various small fixes in regards to RRD issues. This version is recommended for all users. References Varnish Administration Console changelog Varnish Administration Console documentation https://docs.varnish-software.com/releases/varnish-agent-6.2.6/ Wed, 20 May 2020 00:30:01 +0000 https://docs.varnish-software.com/releases/varnish-agent-6.2.6/ This is a minor release with updated boot.vcl. The packaging for boot.vcl has been updated as well. See varnish-agent changelog for more details. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.6r5/ Tue, 28 Apr 2020 10:20:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.6r5/ About the release This release introduces a few minor feature updates and the new TLS vmod, which lets users of in-core TLS get additional information about the connection. There are also two bug fixes: Fix a bug introduced in 6.0.6r3 where local /etc/hosts resolution in VMOD goto did not work. Fix a bug in the MSE object iteration code that could assert when handling a range request, and the fetch thread aborted due to a short read (VS issue 809). https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.6r4/ Wed, 08 Apr 2020 10:40:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.6r4/ About the release This release contains two important bug fixes: Sometimes the Ban Lurker and the Memory Governor would step on each other’s toes, and MSE would not start up. The ban lurker now patiently waits until the Memory Governor has set itself up. The stale vmod would incorrectly treat a hit-for-miss object as a stale object for a transaction. This bug is now fixed. For a complete list of features and bug fixes from this and previous versions, see the Changelog. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.6r3/ Mon, 30 Mar 2020 16:40:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.6r3/ About the release This release contains both new features and a few bug fixes. All users of Varnish Enterprise are encouraged to upgrade. The main new features are: Support for SRV records in VMOD goto. VMOD sqlite3 in the varnish-plus-vmods-extra package. VMOD stale, a new way of doing stale-while-revalidate and stale-on-error without having to resort to restarts. For a complete list of features and bug fixes, see the Changelog. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-agent-6.2.5/ Mon, 23 Mar 2020 00:30:01 +0000 https://docs.varnish-software.com/releases/varnish-agent-6.2.5/ This release now supports loading of TLS certificates that are owned by root. See varnish-agent changelog for more details. This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.6r2/ Wed, 18 Mar 2020 10:30:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.6r2/ About the release This release contains several new features and a few bug fixes. All users of Varnish Enterprise are encouraged to upgrade. The main new features are: The new JWT VMOD. This VMOD makes it practical to manipulate JWT in VCL. Built in client side TLS support. This feature was developed for users who need to squeeze out the maximum amount of data on the newest network hardware. For other users we still recommend keeping hitch as the TLS terminator. https://docs.varnish-software.com/releases/varnish-agent-6.2.4/ Tue, 03 Mar 2020 00:30:01 +0000 https://docs.varnish-software.com/releases/varnish-agent-6.2.4/ This update fixes several issues and also adds some new functionality. The agent will no longer have to be restarted if it is started before VAC is running. It will now try to connect to VAC every 5 seconds if not yet registered. A new parameter has been added to better control commands towards varnishd. The new -w parameter configures number of seconds before timing out when trying to authenticate with varnishd. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.6r1/ Wed, 19 Feb 2020 14:51:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.6r1/ About the release This release contains many fixes and some new features. All users of Varnish Enterprise are encouraged to upgrade. Most notably we have fixes in H2 code and VHA, but there are also fixes in the JSON output of varnishlog and of how grace works when caching requests which have a request body. Among the new features are a faster MSE startup and more VHA counters. For a complete list of features and bug fixes, see the Changelog. https://docs.varnish-software.com/releases/varnish-broadcaster-1.2.4/ Tue, 18 Feb 2020 07:00:01 +0000 https://docs.varnish-software.com/releases/varnish-broadcaster-1.2.4/ This Varnish Broadcaster release addresses some known issues and adds some new functionalities. Fixes a rare race condition that could cause a panic while fetching status. Improved error handling for host parsing Versioning of management API added (/api/v1), /api/ still works and is the same as v1. Updated man page to describe the -log argument correctly and added missing parameters. Updated man page with header normalization information. Systemd service file updated to create pid file at startup. https://docs.varnish-software.com/security/VSV00005/ Tue, 04 Feb 2020 10:00:00 +0000 https://docs.varnish-software.com/security/VSV00005/ Overview An assert can be triggered in Varnish Cache and Varnish Enterprise when using Varnish with a TLS termination proxy, and the proxy and Varnish use the PROXY version 2 protocol to communicate connection details. Depending on the type of proxy used and the details it include in the proxy payload, it may be possible for remote clients to cause Varnish to assert and restart, making it a denial of service attack. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.5r3/ Tue, 07 Jan 2020 05:59:59 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.5r3/ About the release This release improves VHA6 by making it aware of fast_304. There are also a few bug fixes, and we encourage users to upgrade to the newest version. See Changelog for more details. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.11r5/ Thu, 05 Dec 2019 11:58:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.11r5/ Important: If you are not running 4.1.9r1 (released November 30th 2017) or newer, make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.11r5. About the release This release adds support for the -j flag in varnishncsa and fixes varnishreload for very big VCL files. Note that if you are not already running 4.1.11r4, this release also fixes a request and response parsing bug (vsv00003). https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.5r2/ Thu, 28 Nov 2019 05:59:59 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.5r2/ About the release This release introduces json.contains(), and support for if-range in conditional requests. There are also several important bug fixes, and we encourage users to upgrade to the newest version. See Changelog for more details. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-administration-console-3.8.4/ Wed, 13 Nov 2019 05:30:01 +0000 https://docs.varnish-software.com/releases/varnish-administration-console-3.8.4/ Fixes a bug where parameters in database were multiplied. If parameters are handled in VAC through the Web based UI, please review parameters for all parameter sets in VAC (Configure -> Parameters(gray button) -> Edit -> [Review all values]), then press ‘Save Changes’ even if no changes were made. Repeat for each parameter set. This will update the database correctly. Support for missing parameters in Varnish Enterprise 4.1 clock_step mse_delay_writes mse_membuf_pool mse_membuf_size mse_nuke_limit mse_pad_writes mse_prune_factor mse_prune_loop pool_sslbuffer ssl_buffer startup_timeout thread_pool_reserve Support for missing parameters in Varnish Enterprise 6. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.5r1/ Thu, 24 Oct 2019 13:00:02 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.5r1/ About the release This release introduces namespaces in VMOD ykey, the MSE vmod, last_byte_timeout in backend fetches, and several other other improvements. There are also some important bug fixes, and we encourage users to upgrade to the newest version. See Changelog for more details. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-broadcaster-1.2.3/ Tue, 22 Oct 2019 09:00:01 +0000 https://docs.varnish-software.com/releases/varnish-broadcaster-1.2.3/ Let systemd help the broadcaster to write its pid Handle IP with port in configuration file Put back client connection into connection pool This update is recommended for all users. https://docs.varnish-software.com/security/VSV00004/ Mon, 21 Oct 2019 10:00:00 +0000 https://docs.varnish-software.com/security/VSV00004/ Overview A bug has been discovered in Varnish Cache and Varnish Plus where we fail to clear a pointer between the handling of one client requests and the next on the same connection. This can under specific circumstances lead to information being leaked from the connection workspace. The vulnerability was discovered by Trygve Tønnesland of VG/Schibsted, a Varnish Software customer. We wish to thank them for their responsible disclosure. Impact The impact is an information leak, limited to the data in the workspace used for handling the connection. https://docs.varnish-software.com/releases/varnish-agent-6.2.3/ Thu, 10 Oct 2019 00:30:01 +0000 https://docs.varnish-software.com/releases/varnish-agent-6.2.3/ Make sure that vcl folder is correctly set. Write HTTP return code before write of body This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.4r3/ Fri, 27 Sep 2019 11:00:02 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.4r3/ About the release This release introduces a new experimental tool called varnishscoreboard, and a new string VMOD. It also adds a utils function and adds IPv6 support to the aclplus VMOD. It also fixes a few bugs, for example one which improves the format of the newly added -j option in varnishncsa. See Changelog for more details. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-agent-6.2.2/ Thu, 26 Sep 2019 00:30:01 +0000 https://docs.varnish-software.com/releases/varnish-agent-6.2.2/ Fixed leaking tcp connections against varnishadm. Fixed default boot.vcl template This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-custom-statistics-6.0.3/ Thu, 19 Sep 2019 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-custom-statistics-6.0.3/ Fix an issue where -O output would sometimes miss updates. The full set of changes can be found on the changelog. We recommend you to upgrade to this release. References Varnish Custom Statistics changes Varnish Custom Statistics documentation https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.4r2/ Wed, 11 Sep 2019 11:00:02 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.4r2/ About the release This release fixes a critical bug in the new VSM code and an extremely unlikely bug in MSE (discovered when running with very limited resources and heavy traffic). A new -j option for JSON compatible output has been added in varnishncsa. See Changelog for more details. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.4r1/ Thu, 05 Sep 2019 08:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.4r1/ About the release This release fixes several bugs and reduces the load in the utilities (varnishncsa, varnishstat etc.) In addition to improvements in VSM handling, VHA6 received fixes and improvements such as YKey support and HMAC signatures on origin responses. See Changelog for more details. References Changelog Upgrade notes https://docs.varnish-software.com/security/VSV00003/ Tue, 03 Sep 2019 10:00:00 +0000 https://docs.varnish-software.com/security/VSV00003/ Overview An assert can be triggered in Varnish Cache and Varnish Enterprise by a remote client sending specially crafted HTTP requests. Varnish will panic and restart when the assert is triggered, which constitutes a denial of service attack. This was discovered by Varnish Software. Impact The potential impact is reduced or completely lost availability. The cache will be empty after the restart unless Massive Storage Engine is used in persistence mode. https://docs.varnish-software.com/releases/varnish-custom-statistics-6.0.2/ Tue, 03 Sep 2019 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-custom-statistics-6.0.2/ Skip VHA6 requests when using default keys Fix JSON streaming output Handle -O write errors: Write on a closed socket would trigger a SIGPIPE which we fail to handle, leading to an immediate crash. The full set of changes can be found on the changelog. We recommend you to upgrade to this release. References Varnish Custom Statistics changes Varnish Custom Statistics documentation https://docs.varnish-software.com/releases/varnish-broadcaster-1.2.2/ Thu, 29 Aug 2019 11:00:01 +0000 https://docs.varnish-software.com/releases/varnish-broadcaster-1.2.2/ This Varnish Broadcaster release addresses a minor issue in regards with relaxing the parsing of the group names. It is now possible to include dashes and underscores in the group names. This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-agent-6.2.1/ Wed, 28 Aug 2019 11:00:01 +0000 https://docs.varnish-software.com/releases/varnish-agent-6.2.1/ Added gzip support over all endpoints. Added https support. Report X-Forwarded-Proto if https to vac Added gorilla mux Added a versioned api namespace under /api/v1 This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-administration-console-3.8.3/ Wed, 28 Aug 2019 09:30:01 +0000 https://docs.varnish-software.com/releases/varnish-administration-console-3.8.3/ Upgrade the mongo java driver to 2.13.2 Added various log calls throughout the code to help with support VCL editor improvements Added the options to secure the unrestricted /stats endpoint if a rest_api_token is set in the defaults file This version is recommended for all users. References Varnish Administration Console changelog Varnish Administration Console documentation https://docs.varnish-software.com/releases/varnish-broadcaster-1.2.1/ Thu, 22 Aug 2019 11:00:01 +0000 https://docs.varnish-software.com/releases/varnish-broadcaster-1.2.1/ This Varnish Broadcaster release addresses some known issues and adds some new functionalities. Fixed goroutine leak in async mode Added a configurable keep-alive Added a configurable broadcast req timeout Extended cors support Write a pid file to report the pid of the running instance This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.11r4/ Mon, 19 Aug 2019 08:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.11r4/ Important: If you are not running 4.1.9r1 (released November 30th 2017) or newer, make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.11r3. About the release This release is a bug fix release, and is recommended for all users of Varnish Cache Plus 4.1.x. The release fixes handling of null values in libvmod_urlplus, fixes a bug in MSE related to empty synthetic responses, and fixes a request and response parsing bug (vsv00003). https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.3r9/ Mon, 19 Aug 2019 08:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.3r9/ About the release This release fixes a corner case where the CPU usage improvements for the varnishlog family of utilities would only take effect if the utility was run as root, and a bug related to request and response parsing (vsv00003). This release is a bug fix release, and is recommended for all users of Varnish Cache Plus 6.0.x. See Changelog for more details. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.3r8/ Tue, 06 Aug 2019 07:30:02 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.3r8/ About the release This release fixes several bugs, and improves the efficiency of the shared memory counters framework. If you have many dynamic backends with various TTLs, many counters will be created and retired. This use case was previously not optimized, and tools like varnishncsa, varnishlog and varnishstat saw a lot of CPU usage. This has been fixed, but you may experience that it can take up to one second before the new counters appear in the varnishstat interface. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.3r7/ Wed, 24 Jul 2019 08:00:02 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.3r7/ About the release This release fixes some bugs, and adds a new VMOD mmdb. VMOD mmdb - Varnish Enterprise GeoIP2, supersedes the now deprecated VMOD geoip. Improve persisted MSE startup performance. At restarts of the cache, data structures for the persisted objects needs to be set up. This can be CPU intensive, and with this rewrite of the subsystem all of the available CPU resources will be utilized to get it done quickly. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.3r6/ Thu, 13 Jun 2019 11:00:02 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.3r6/ About the release This release fixes some bugs, and adds VHA 6. The old VHA is still supported, and customers who want to switch to the new version can do that when they are ready, with out installing new packages. See Changelog for more details. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.11r3/ Thu, 13 Jun 2019 11:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.11r3/ Important: If you are not running 4.1.9r1 (released November 30th 2017) or newer, make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.11r3. About the release This release is a bug fix release, and is recommended for all users of Varnish Cache Plus 4.1.x. This release contains a single fix: The varnishncsa will now also log lines when the backend produces responses with bad HTTP. https://docs.varnish-software.com/releases/varnish-discovery-1.0.4/ Fri, 07 Jun 2019 10:00:00 +0000 https://docs.varnish-software.com/releases/varnish-discovery-1.0.4/ Add an option to extend the format of the nodes.conf file. References Varnish Discovery –nodefile argument Varnish Discovery template https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.3r5/ Wed, 22 May 2019 11:50:02 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.3r5/ About the release This release fixes some bugs, and adds a few features. The main features are LDJSON (Line Delimited JSON) support for varnishlog A hash_body function in the xbody VMOD. See Changelog for more details. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.11r2/ Wed, 10 Apr 2019 12:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.11r2/ Important: If you are not running 4.1.9r1 (released November 30th 2017) or newer, make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.11r2. About the release This release is a bug fix release, and is recommended for all users of Varnish Cache Plus 4.1.x. The previous release, 4.1.11r1, changed the ABI slightly, and this release fixes it. For this reason, 4.1.11r1 will be removed from the repository. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.3r4/ Wed, 10 Apr 2019 09:30:02 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.3r4/ About the release It is a bugfix release, with two new features regsub support in VMOD cookieplus. ACL support in VMOD goto See Changelog for more details. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-administration-console-3.8.2/ Thu, 28 Mar 2019 09:30:01 +0000 https://docs.varnish-software.com/releases/varnish-administration-console-3.8.2/ This Varnish Administration Console (VAC) patch release fixes Purger bug concerning client SocketTimeouts. This version is recommended for all users. References Varnish Administration Console changelog Varnish Administration Console documentation https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.3r3/ Mon, 18 Mar 2019 14:00:02 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.3r3/ About the release It is a bugfix release, containing some important fixes mostly in the MSE / ESI / ES area. See Changelog for more details. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.3r2/ Tue, 05 Mar 2019 10:00:02 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.3r2/ About the release It is a bugfix release, containing various MSE3 and some SELinux fixes. See Changelog for all the details. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.3r1/ Tue, 26 Feb 2019 10:00:02 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.3r1/ About the release This update of Varnish Cache Plus 6 contains many updates from Varnish Cache (community edition) and also numerous change which is exclusive to Varnish Enterprise (previously Varnish Cache Plus). See Changelog for all the details. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-agent-6.2.0/ Tue, 19 Feb 2019 11:00:01 +0000 https://docs.varnish-software.com/releases/varnish-agent-6.2.0/ The stats endpoint can now return only specific counters when using the counters query param. Counters are specified by their name and are comma separated. E.g: /stats?counters="Main.client_req,Main.cache_hit". GET endpoints honor the Accept-encoding header and will return gzipped responses if asked for. Stats data are no longer pushed against the VAC if the -i option is set to 0. When upgrading from earlier versions, the agent_secret file is left untouched. Various other small improvements. https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.11r1/ Wed, 13 Feb 2019 07:25:01 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.11r1/ Important: If you are not running 4.1.9r1 (released November 30th 2017) or newer, make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.11r1. About the release This release contains the reintroduction of req.grace from Varnish Cache 3, and a fix of a rare bug in MSE. See the change log for details on this and previous releases. References Varnish Cache Plus changes Varnish Cache changes backported to this release of Varnish Cache Plus Upgrade notes https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.2r1/ Wed, 30 Jan 2019 10:00:02 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.2r1/ About the release This update of Varnish Cache Plus 6 contains many updates from Varnish Cache (community edition) and even more that is exclusive to Varnish Enterprise (previously Varnish Cache Plus). See Changelog for all the details. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.10r6/ Tue, 08 Jan 2019 16:25:01 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.10r6/ Important: If you are not running 4.1.9r1 (released November 30th) or newer, make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.10r6. About the release This release contains several bug fixes in the core some VMODs (urlplus and cookieplus). We encourage all users on 4.1 to upgrade to this version. See the change log for details on this and previous releases. References Varnish Cache Plus changes Varnish Cache changes backported to this release of Varnish Cache Plus Upgrade notes https://docs.varnish-software.com/releases/varnish-discovery-1.0.2/ Mon, 24 Dec 2018 10:00:00 +0000 https://docs.varnish-software.com/releases/varnish-discovery-1.0.2/ This is purely a feature release, adding support to AWS autoscaling groups. References Varnish Discovery documentation https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.1r5/ Tue, 18 Dec 2018 13:38:02 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.1r5/ About the release This update of Varnish Cache Plus 6 contains a couple of new features in XBody, as well as fixes for a couple of bugs found in the previous release. See Changelog for all the details. References Changelog Upgrade notes https://docs.varnish-software.com/releases/hitch-1.5.0/ Mon, 17 Dec 2018 15:12:03 +0100 https://docs.varnish-software.com/releases/hitch-1.5.0/ About the release This release brings support for UNIX domain sockets, TLS 1.3 and a few other new features. Have a look at the changelog for more details. References Changelog Config file reference documentation https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.1r4/ Wed, 05 Dec 2018 16:03:02 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.1r4/ About the release This update of Varnish Cache Plus 6 contains fixes for a couple of bugs found in the previous release. See Changelog for all the details. References Changelog Upgrade notes https://docs.varnish-software.com/releases/varnish-agent-6.1.0/ Mon, 03 Dec 2018 11:00:01 +0000 https://docs.varnish-software.com/releases/varnish-agent-6.1.0/ Ping endpoint does not check against a Varnish instance anymore. The stats payload has been stripped of unnecessary tags. The agent can now specify a bind address. (see -a parameter) Various other small improvements. This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.1r3/ Fri, 23 Nov 2018 16:23:02 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.1r3/ About the release This update of Varnish Cache Plus 6 contains the new version of MSE, MSE 3, which is a significant improvement over previous versions. This version has been tested thoroughly in the lab, and it has also been running successfully in production on some high traffic sites for several weeks. Varnish Software is very happy about its performance, and encourage all customers to try it out. The documentation on MSE 3 will be available here soon, but you can get a head start by reading the mkfs. https://docs.varnish-software.com/releases/varnish-broadcaster-1.2.0/ Wed, 21 Nov 2018 11:00:01 +0000 https://docs.varnish-software.com/releases/varnish-broadcaster-1.2.0/ This Varnish Broadcaster release addresses some known issues and adds some new functionalities. Broadcast client request body Fixed a bug concerning Hashmap keys memory release Various other small fixes This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-custom-statistics-6.0.1/ Sat, 03 Nov 2018 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-custom-statistics-6.0.1/ Fixed issue when logging in with no password Set all responses to Vary on Authorization The full set of changes can be found on the changelog. We recommend you to upgrade to this release. References Varnish Custom Statistics changes Varnish Custom Statistics documentation https://docs.varnish-software.com/releases/varnish-discovery-1.0.1/ Tue, 16 Oct 2018 10:00:00 +0000 https://docs.varnish-software.com/releases/varnish-discovery-1.0.1/ This release addresses a bug in the Kubernetes module causing a out-of-bound exception and crashing discovery. It also fixes two pain points in case of misconfiguration: For VAC and Kubernetes, in case of an HTTP error, the response is dumped as a comment to help debugging. In the same modules, if no matching group is found, discovery will output a comment too, instead of looping or exiting silently. Upgrading is safe and recommended. https://docs.varnish-software.com/releases/varnish-agent-4.1.4/ Thu, 04 Oct 2018 11:00:01 +0000 https://docs.varnish-software.com/releases/varnish-agent-4.1.4/ This Varnish Agent release addresses some known issues and adds some new functionalities. Fixed uploading large VCL files Fixed EL 6 compilation issue Added option to set the host for the running agent Fixed faulty probe json encoding Various other small fixes This update is recommended for all users. https://docs.varnish-software.com/releases/varnish-administration-console-3.8.1/ Tue, 02 Oct 2018 09:30:01 +0000 https://docs.varnish-software.com/releases/varnish-administration-console-3.8.1/ This Varnish Administration Console (VAC) release fixes some minor UI bugs, adds a feature to enable ReadOnly user to view VCL and Parameter sets and introduces MongoClient connection string. A new argument - mongoURI - is available in the defaults settings file. If this argument has any value assigned to it then it will be used as a connection string against Mongo. References Varnish Administration Console changelog Varnish Administration Console documentation https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.1r2/ Mon, 01 Oct 2018 11:00:02 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.1r2/ About the release This update of Varnish Cache Plus 6 is a bug fix release of Varnish Cache Plus 6. It contains a few bug fixes, and we encourage all users of 6.0.1r1 or earlier to upgrade. For users of Varnish Cache Plus 4 variants, the upgrade path is relatively simple. VCLs will typically work unmodified with the new version, but if you need Unix Domain Sockets support, you need to change the VCL version at the top of your VCL. https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.10r5/ Mon, 01 Oct 2018 10:00:01 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.10r5/ Important: If you are not running 4.1.9r1 (released November 30th) or newer, make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.10r5. About the release This release contains several bug fixes and some new features (updates to urlplus and rewrite plus a new VMOD: session). We encourage all users on 4.1 to upgrade to this version. See the change log for details on this and previous releases. https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.1r1/ Thu, 20 Sep 2018 11:00:01 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-6.0.1r1/ About the release This update of Varnish Cache Plus 6 contains a high number of bug fixes and improvements. With this release we also makes Varnish 6 available to more customers than the Limited Availability version 6.0.0, and we expect very few problems for those who upgrade from Varnish Cache Plus 4.1 versions. Recompiling VMODs and external tools is necessary, and in most cases the code will work unmodified. Customers upgrading from Limited Availability versions (6. https://docs.varnish-software.com/releases/varnish-administration-console-3.8.0/ Mon, 27 Aug 2018 12:00:01 +0000 https://docs.varnish-software.com/releases/varnish-administration-console-3.8.0/ Important: We have added a new configuration file /opt/vac/etc/logback.xml and made some changes in the /opt/vac/etc/log4j.xml, /opt/vac/etc/defaults and service unit file to introduce proper logging in systemd. If you have made any changes to these files you will have to update them. Please read the upgrade instructions for more information on the upgrade. This release fixes the following issues: Improve systemd to not output extra DEBUG logs. Clicking on text to add VCL, Node and Parameter to Group not working. https://docs.varnish-software.com/releases/varnish-plus-ha-2.1.5/ Mon, 06 Aug 2018 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-plus-ha-2.1.5/ Due to a bug in certain libcurl versions, VHA can push HTTPS replications requests to the wrong nodes in the cluster, leaving others untouched. This version works around the issue by closing the connection after each HTTPS request. On the other hand, plain HTTP requests now systematically request a connection keep-alive instead of inheriting the client request header. We also added the -k argument allowing VHA to trust HTTPS nodes even if the certificate doesn’t match the host, or if the trust chain isn’t valid (same as curl -k), this makes testing your setup easier when using self-signed certificates, notably. https://docs.varnish-software.com/releases/varnish-administration-console-3.7.0/ Thu, 28 Jun 2018 12:00:01 +0000 https://docs.varnish-software.com/releases/varnish-administration-console-3.7.0/ Varnish Administration Console (VAC) 3.7.0 has been updated to offer better user experiences to our customers. It is now fully responsive and has some various improvements to create a more modern look and layout. It also comes with the systemd compliant packages for CENTOS / RHEL 7. We have also made some improvements on URL patterns to make it easy to access different pages. New introduced URL patterns are: overview/realtime overview/historical overview/realtime? https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.10r4/ Thu, 14 Jun 2018 12:00:01 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.10r4/ Important: If you are not running 4.1.9r1 (released November 30th) or newer, make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.10r4. About the release This release contains three bug fixes but is otherwise the same as 4.1.10r3. We encourage every user on 4.1 to upgrade to this version. See the change log for details on this and previous releases. References Varnish Cache Plus changes Varnish Cache changes backported to this release of Varnish Cache Plus Upgrade notes https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.10r3/ Wed, 06 Jun 2018 13:30:01 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.10r3/ Important: If you are not running 4.1.9r1 (released November 30th) or newer, make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.10r3. About the release This release is very similar to 4.1.10r2, with only a single bug fix added. We encourage every user on 4.1 to upgrade to this version. See the change log for details on this and previous releases. References Varnish Cache Plus changes Varnish Cache changes backported to this release of Varnish Cache Plus Upgrade notes https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.10r2/ Tue, 05 Jun 2018 08:00:01 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.10r2/ Important: If you are not running 4.1.9r1 (released November 30th) or newer, make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.10r2. About the release This release is very similar to 4.1.10r1, with only a few bug fixes. We encourage every user on 4.1 to upgrade to this version. See the change log for details on this and previous releases. References Varnish Cache Plus changes Varnish Cache changes backported to this release of Varnish Cache Plus Upgrade notes https://docs.varnish-software.com/releases/varnish-administration-console-3.6.2/ Fri, 25 May 2018 12:30:01 +0000 https://docs.varnish-software.com/releases/varnish-administration-console-3.6.2/ This Varnish Administration Console (VAC) release fixes a purger bug where socket connections were not soaked across multiple requests. References Varnish Administration Console changelog Varnish Administration Console documentation https://docs.varnish-software.com/releases/varnish-administration-console-3.6.1/ Wed, 23 May 2018 15:50:01 +0000 https://docs.varnish-software.com/releases/varnish-administration-console-3.6.1/ This Varnish Administration Console (VAC) release fixes a purger bug where multiple requests on the same connection were not handled. References Varnish Administration Console changelog Varnish Administration Console documentation https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.10r1/ Wed, 02 May 2018 08:00:01 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.10r1/ Important: If you are not running 4.1.9r1 (released November 30th) or newer, make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.9r3. About the release In addition to the usual bug fixes, you will find a new VMOD; URL Plus. See the change log for a full list of bug fixes for this and previous versions. References Varnish Cache Plus changes Varnish Cache changes backported to this release of Varnish Cache Plus Upgrade notes https://docs.varnish-software.com/releases/varnish-custom-statistics-6.0.0/ Tue, 27 Mar 2018 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-custom-statistics-6.0.0/ Varnish 6.0.0 support. Renamed vcsprobe to vcs-agent Rebranded from vstatd to VCS. Move from mongoose to libmicrohttpd Move to the VUT public API Import option -K from vagent2 Try serving index.html for directory URLs Don’t kill the VCS if the DNS is down. Reject non GET methods. The -a option does not include the IP address IPv6 support without the dual stack mode Proof of concept for simple /match requests Dropping non-systemd support and environmentfiles. https://docs.varnish-software.com/releases/varnish-administration-console-3.6.0/ Wed, 14 Mar 2018 11:00:01 +0000 https://docs.varnish-software.com/releases/varnish-administration-console-3.6.0/ This Varnish Administration Console (VAC) release addresses some known issues and adds some new functionalities. This update is recommended for all users. This release is compatible with the forthcoming Varnish Enterprise 6 through Varnish agent 6. For the full set of changes check the VAC changelog. References Varnish Administration Console changelog Varnish Administration Console documentation https://docs.varnish-software.com/releases/varnish-cache-plus-4.0.4r3/ Mon, 12 Mar 2018 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-4.0.4r3/ About the release This release is a bug fixing release, with the following fixes: Nonblocking handshake for fetch transactions. Backport the fix of 1955. Don’t test gunzip for partial responses. This update is recommended for all users of 4.0. Users should also consider upgrading further to 4.1.9r3, which includes performance enhancements and bug fixes not available in the 4.0 series. https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.9r3/ Mon, 26 Feb 2018 00:00:01 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.9r3/ Important: If you are not running 4.1.9r1 (released November 30th) or newer, make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.9r3. About the release This release is primarily a bug fixing release, but it also contains some minor improvements: The latest version of varnish-modules New Edgestash multi JSON csv function New counter: n_lru_limitied tells you how many times storage allocation have failed due to nuke_limit. https://docs.varnish-software.com/releases/varnish-plus-ha-2.1.4/ Mon, 29 Jan 2018 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-plus-ha-2.1.4/ This release addresses an issue arising during VSL peak traffic, where the logger needs to prematurely flush transactions to keep track of things. This has been mitigated in version 2.1.4 by dropping truncated requests to guarantee replication faithfulness and to favor user traffic over replication requests. References Varnish High Availability changes Upgrade notes https://docs.varnish-software.com/releases/varnish-plus-ha-2.1.3/ Mon, 15 Jan 2018 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-plus-ha-2.1.3/ In the 2.1 series, due to a VSL parsing error, when an ESI subrequest containing an Accept-Encoding header is replicated, all headers are discarded and the Host header is set to the node IP. The release fixes the issue. The 2.0 series, as well as the 2.0.0 release are not affected. References Varnish High Availability changes Upgrade notes https://docs.varnish-software.com/releases/varnish-plus-ha-2.1.2/ Thu, 04 Jan 2018 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-plus-ha-2.1.2/ This revision release increase compatibility with VCL hashing the Accept headers. Before, VHA automatically added an Accept header if none was present, which would cause replication issues for request without this header. References Varnish High Availability changes Upgrade notes https://docs.varnish-software.com/releases/varnish-plus-discovery-1.0.0/ Tue, 19 Dec 2017 10:00:00 +0000 https://docs.varnish-software.com/releases/varnish-plus-discovery-1.0.0/ Today we release a new tool: Varnish Discovery. It aims to streamline VHA’s configuration by automatically producing the nodes.conf file that it needs, making HA setups using VAC or Kubernetes super easy to deploy as each node can automatically discover its peers, and keep that knowledge up-to-date over time. Configuration is minimal, and this initial supports the VAC, DNS and Kubernetes APIs. References Varnish Discovery documentation https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.9r2/ Tue, 19 Dec 2017 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.9r2/ Important: If you are not running 4.1.9r1 now (released November 30th), make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.9r2. About the release This release contains some updates to vmod_rewrite, a new counter and a few bug fixes. The changes to vmod_rewrite are: new feature: split find/match functions. new feature: multiple replacements can be defined for one regex. new parameters to control substitution: regsub, regsuball, only_matching deprecation: for consistency . https://docs.varnish-software.com/releases/varnish-custom-statistics-4.1.5/ Mon, 11 Dec 2017 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-custom-statistics-4.1.5/ This VCS release addresses several issues that where present in 4.1.4. The full set of changes can be found on the changelog. We recommend you to upgrade to this release. References Varnish Custom Statistics changes Varnish Custom Statistics documentation https://docs.varnish-software.com/releases/varnish-plus-ha-2.1.1/ Fri, 08 Dec 2017 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-plus-ha-2.1.1/ This VHA release builds on the 2.1.0 that notably brought request body replication, replication prevention and header addition from the VCL. The biggest change with this version is the way ESI requests are handled. In earlier releases, only the top request was replicated, which led to some (harmless) warnings because the replicated status codes could differ from the original ones (200 vs 304). With 2.1.0, VHA replicates each fragment individually, reducing the noise and clearing out these warnings. https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.9r1/ Thu, 30 Nov 2017 00:00:00 +0000 https://docs.varnish-software.com/releases/varnish-cache-plus-4.1.9r1/ This release increments the VMOD ABI version number, which means that VMODs will have to be recompiled in order to load. Packages for Varnish Cache Plus 4.1.9r1 and updated VMOD packages are available from our package repositories. Thirdparty VMODs will have to be recompiled manually. Some other changes include: Expose to VCL whether or not a fetch is a background fetch (bgfetch). Fix retrying backend fetches over reused connections. Fix rare resource leaking scenario related to an ESI delivery. https://docs.varnish-software.com/security/VSV00002/ Wed, 15 Nov 2017 10:00:00 +0000 https://docs.varnish-software.com/security/VSV00002/ Overview A data leak can be triggered in Varnish Cache by a remote client if Varnish Cache is using the file stevedore for synthetic error objects and the backend does not respond properly or times out. This was discovered and patched respectively by Carlo Cannas of Altervista.org and @shamger. Impact Potential impact is data leak and segmentation fault: The data leaked will be an excerpt from the anonymously mapped memory of the varnishd process, limited upwards to 4k bytes and it will be present in the body of the synthesized error object created in place of the failed backend fetch. https://docs.varnish-software.com/security/VSV00001/ Wed, 02 Aug 2017 10:00:00 +0000 https://docs.varnish-software.com/security/VSV00001/ Overview An assert can be triggered in Varnish Cache and Varnish Enterprise by a remote client sending a specially crafted HTTP request. Varnish will panic and restart when the assert is triggered, which constitutes a denial of service attack. This was discovered by StackPath. Impact The potential impact is reduced or completely lost availability. The cache will be empty after the restart unless Massive Storage Engine is used in persistence mode.