Weik.io 2026.2.2

Highlights

Images

The Weik.io images are on Docker Hub with the exact version as their tag, and images.env pins every image by its digest. No image is tagged latest.

Files

The checksums are from the release's SHA256SUMS files, and the Windows CLI and the agent installer are signed by Adafy Oy. curl -fsSL https://weik.io/install.sh | sh checks the CLI before it places it.

The open source projects inside the images, with their versions and licences, are listed in Third-party software. The release runs Apache Camel 4.22.1 and 4.18.5, and its store programs, message server and TLS terminator are the same versions as in 2026.2.1.

Upgrade notes

An installation of 2026.2.0 or 2026.2.1 upgrades in place with upgrade.sh, which makes a backup first and keeps every record and every file of yours. Check these before you upgrade:

• Schedule run records have storage of their own in each environment, 1 GiB per environment on a hub with more than one data server and 256 MiB otherwise. Before you upgrade a nearly full installation, run sudo sh ./upgrade.sh <images.env> --check. It says how much room is short and how to make it.
• The upgrade creates each server's message server again once, and every agent's link to the hub drops once.
• Every container of a hub's stack keeps its log in at most three files of 50 MB, so the upgrade creates every container again. A service's logging block in docker-compose.override.yaml changes the limits.
• The log, metric and trace stores run on the images weikio/weikio-logstore, weikio/weikio-metricstore and weikio/weikio-tracestore, which start the same store programs on the same volumes. A registry of your own that the stack pulls from needs these three images too.
• An agent that is offline with Maximum Control Line Exceeded in its leaf's log needs a new bundle. Issue it with weikio agent credentials <agent> --out <dir>, then copy the bundle's files to the agent's host and run its setup.sh, or install.cmd on Windows.
• A rollback to 2026.2.1 keeps the settings 2026.2.1 doesn't have and writes them back at the next upgrade.

Security

2026.2.2 closes these gaps and updates these libraries:

• The terminator of every stack gives its replies the Referrer-Policy, X-Content-Type-Options and Permissions-Policy headers the hub gives its own. A request no route of the terminator serves gets an empty 404 with these headers and Strict-Transport-Security.
• A hub reply that names no caching policy of its own carries Cache-Control: no-store.
• The gateway removes the X-Api-Key header from every request it forwards, whatever credential the subscription uses.
• A webhook receipt no longer carries the caller's Cookie header. It no longer passes the caller's X-Api-Key to the channel's integrations, nor the caller's Authorization when the gateway subscription checks an API key, a password or a sign-in token.
• Requests refused for carrying no credential no longer fill the audit log. Each caller address has an allowance for them, and a request over it gets 429 with the time to wait and leaves no audit record. Sign-in has an allowance of its own, and a sign-in whose e-mail address or password is longer than 1,024 characters is refused with 422.
• A user who isn't a platform administrator can look up 30 e-mail addresses a minute on each hub server. The next lookup gets 429 with Retry-After, and the audit log records each of their lookups.
• A write refused with 409 answers with the record as a read shows it, so the settings and a gateway no longer send the sealed keys of their uploaded certificates in that reply, and a secret no longer sends its sealed value.
• A warning about a channel, transfer or schedule that doesn't exist no longer names a project the caller can't read, and a refusal of an API path that is already taken names the API only to a caller who may read it. A refusal about an external secret store names no internal address of the installation.
• weikio login to an http address on another machine says first that the key will travel unencrypted. An API key typed for weikio login, or a value typed for weikio secret set, is no longer shown on the screen while the output goes to a file or another program.
• Every bundle ships log4j 2.25.5, which fixes CVE-2026-49844.
• The admin UI ships DOMPurify 3.4.17 and KaTeX 0.18.10, which fix four published advisories. None of them could be reached through the admin UI.

Known issues

• A 2026.2.1 weikio CLI that reads a trace of more than 5,000 spans from a 2026.2.2 installation shows its first 5,000 spans and doesn't say that the rest were left out. The trace list still shows the trace's full span count and its failure, and a 2026.2.2 CLI says how many spans it left out.
• During the upgrade from 2026.2.1, while a server's message server restarts, a call that reads a store's state and lands on a server still on 2026.2.1 can take 5 seconds or time out, a few times per server. Retry the call. Writes in that moment are refused with a retry hint and nothing is lost.
• During the upgrade from 2026.2.0 or 2026.2.1, the upgrade's doctor step can warn that the store of an environment's delivery notices differs from what this release sets, with the fix docker compose up -d backend. There is nothing to do. The backend sets the store within a minute, and doctor is clean when run again.
• On a hub of several servers, a rollback to 2026.2.1 followed by an upgrade to 2026.2.2 again sets the log retention to 30 days when the first server to start the upgrade is not the server that ran the rollback first. Metrics and traces keep their retention values, and no stored log line, metric or trace is erased by this. weikio settings get shows the value, and weikio settings set --logs-retention sets it again. A hub on one server is not affected. The fix is planned for 2026.2.3.
• If the agent that runs a transfer is cut off from the hub for more than about five minutes, the run summaries of transfers made during the cut are not kept. The transfers themselves run and their files move, but each later run of the same transfer starts only after the dropped summary's tries end, about five minutes per dropped summary, and a transfer that fails during the cut raises no transfer-failed problem. The agent's log says so, and the problems list does not.
• A schedule runs at most ten runs at a time. While the hub stores no run records, as during a cut between an agent and the hub, a run holds its place for its command's time plus about four and a half minutes of publish tries, or longer when the hub is reached but doesn't answer. A schedule that fires more often than one tenth of that time, about every 28 seconds for a command that ends at once, runs its fires in groups of ten with gaps between the groups, and the fires due in a gap are skipped without a log line and leave no record.
• A schedule's run record that the hub has not stored is kept on the agent's host only after about four and a half minutes of publish tries. If the schedule's deployment stops before those tries end, as when an agent that is cut off from the hub restarts, is upgraded or passes its environment's offline start limit, the records of the runs whose tries are still open are lost. The commands of those runs have run and the agent's log shows how each ended, but the hub lists no record for them and no line says that a record was lost. The fix is planned for 2026.2.3.
• When an integration is stopped, restarted or undeployed, a message that is being handled at that moment is given the integration's stop time to finish. Its log lines are kept, but its trace is not recorded.
• The Windows installer ships 18 programs and libraries from other projects as those projects publish them, without a signature from Adafy Oy or from their makers: nats-server.exe, otelcol-contrib.exe, rclone.exe, CliWrap.dll, NATS.Client.Abstractions.dll, NATS.Client.Core.dll, NATS.Client.JetStream.dll, NATS.Client.KeyValueStore.dll, NATS.Client.ObjectStore.dll, NATS.Client.OpenTelemetry.dll, NATS.Client.Services.dll, NATS.NKeys.dll, OpenTelemetry.Api.dll, OpenTelemetry.Api.ProviderBuilderExtensions.dll, OpenTelemetry.dll, OpenTelemetry.Exporter.OpenTelemetryProtocol.dll, OpenTelemetry.Exporter.Prometheus.AspNetCore.dll and OpenTelemetry.Extensions.Hosting.dll. The installer itself and the agent's own programs are signed by Adafy Oy. A machine whose policy runs only signed programs needs these 18 files allowed by hand.