Relay Proxy

Updated the bundled go-server-sdk dependency to v7.19.0.

New options configure connect and read timeouts for Redis, and the Relay Proxy adopts go-server-sdk-redis-redigo v4 with an opt-in atomic upsert mode. Streams now end when their initial data cannot be read.

Credentials in all URL components are now redacted in the status resource's dbServer output, and golang.org/x/crypto was bumped to v0.56.0 for CVE-2026-78662 and CVE-2026-56855. Also fixes auto-config refresh of stored environment defaults, a nil replay result panic in streams, and adds health reporting for the auto-configuration stream.

Relay Proxy now supports multiple SDK and mobile keys per environment, enabling key rotation without downtime, per-key access control, and expiration dates. This applies to auto-configured (Relay Auto Config) environments only; manually configured environments remain single-key. Analytics events are attributed to the primary key.

OTel attributes were renamed to follow semantic conventions and a single vendor namespace, the relay.id resource attribute was removed, and high-cardinality attributes were trimmed from request metrics. The events send-error metric was renamed to launchdarkly.relay.events.failed, and several OTel-related CVE patches were applied.

Each environment can now hold multiple SDK keys and mobile keys simultaneously, enabling key rotation without downtime and key-level access control. Client-side IDs remain single per environment, and the feature requires Relay Auto Config.

Usage metrics event publisher capacity is now configurable, and REPORT eval request body size can be limited. Patched CVEs in gRPC, x/net, x/text, otel, and klauspost/compress dependencies.

Each environment can now support multiple SDK keys with names, descriptions, and optional expiration dates, enabling key rotation without downtime and per-key access control. Available for auto-configured environments only; analytics events are attributed to the primary SDK key.

Fixed FDv2 replay singleflight key to include the basis parameter, ensuring correct deduplication of replay requests. Also bumped Go versions to 1.26.5 and 1.25.12, updated Docker base image to Alpine 3.24.1, and removed EasyJSON dependency via SDK updates.

Eliminated a send-on-closed-channel race condition in StartHTTPServer that could crash the server. Added X-LaunchDarkly-Instance-Id to the browser CORS allowlist and bumped supported Go versions to 1.26.5 and 1.25.12.

Reverted v4 core libraries and downstream cascade back to v3, and updated Dockerfiles from Alpine 3.23.4 to 3.24.1.

Go toolchain and golang.org/x/* dependencies are bumped to address CVEs. Fixed log level prefix parsing that was failing without trailing space.

SDK dependencies bumped for EasyJSON removal, and supported Go versions updated to 1.26.4 and 1.25.11.

Updated golang.org/x/* dependencies to address CVEs and removed a Prometheus transitive dependency.

Go toolchain and dependencies bumped to address CVEs.

9.0.0-rc.3 (2026-05-04)

BREAKING CHANGES

• The EVENTS_INLINE_USERS configuration option (and its [Events] InlineUsers file equivalent) has been removed. The setting has had no…

8.19.1 (2026-04-29)

8.19.0 (2026-04-22)

9.0.0-rc.2 (2026-04-09)

⚠ BREAKING CHANGES

• Metrics system replaced: OpenCensus has been replaced with OpenTelemetry. Direct integrations for Datadog, Stackdriver, and Prometheus have…

8.18.0 (2026-04-09)