1.37.9 (October 12, 2026)

Bug fixes

Changes expected to improve the state of the world and are unlikely to have negative effects

  • aws: Fixed a race where the route level configuration of the AWS request signing and AWS Lambda filters could be destroyed on a worker thread when an RDS update replaced the route configuration.

  • local_ratelimit: Fixed a race where the share provider manager owned by a local rate limit route level configuration could be destroyed on a worker thread. The manager is an unpinned singleton that owns a cluster membership callback handle, so a route level configuration may own the last reference to it and release it when an RDS update replaces the route configuration. It is now handed to the main dispatcher alongside the rate limiter, which was already posted there.

  • sds: Fixed a race where a generic secret provider shared with worker threads could be destroyed on a worker thread.

  • wasm: Bumped wasmtime to 24.0.10 to resolve CVE-2026-54786.