Cribl Stream 4.19.1 (Coming Soon)
| PRODUCT | DATE | RELEASE | ADDITIONAL RESOURCES |
|---|---|---|---|
| Stream | 2026-08-19 | Maintenance | Known Issues, Cribl Edge Release Notes |
The following draft provides early access to release notes for the upcoming Cribl Suite product release. Features or functionality presented are not considered binding commitments and are subject to change at the discretion of Cribl at any time for any reason without notice. This information should not be relied upon in making purchasing decisions.
Important Changes
This release introduces deprecations and notices that require action if you use the affected features:
- Notice: Cribl as Code TypeScript and Go SDK Discontinuation
- Deprecation Notice: Smart Mode for Source Persistent Queue
Review the full list of important changes for additional critical updates.
New Features
This release provides the following improvements:
Centralize Credentials in On-Prem Deployments with Global Secrets
On-prem deployments now support global secrets, which you can retrieve from HashiCorp Vault or the built-in Cribl secret store. Use global secrets to define credentials once and reuse them across Cribl Stream and Edge. Teams can share and rotate credentials in one place instead of maintaining duplicates.
CORS Support for Raw HTTP Source
The Raw HTTP Source now supports configurable CORS, including allowed origins, methods, and headers. Browser-based OTLP/HTTP clients can send telemetry directly to Cribl without a reverse proxy.
Apps (Preview): Cribl Marketplace
Cribl Marketplace is the in-product catalog of Cribl-supported Apps. Administrators can install Apps from the catalog without importing package files from App builders or GitHub. You can browse each App’s overview, declared permissions, and external API access to see what is available and what an App will use before an administrator installs it.
Experience Improvements
- The OTLP Metrics Function now includes a Resource attributes field that matches attribute names exactly unless an entry includes a
*wildcard. Wildcards and!negation are supported. Resource attribute prefixes are deprecated but continue to work unchanged for existing configurations. When Resource attributes is set, it takes precedence. To migrate, copy each prefix entry to Resource attributes and append*where prefix matching is still desired.
Sources and Destinations
- OpenTelemetry Destinations now report more detailed metrics in the Destination Status tab, including batches flushed over time and a breakdown of metric types such as counters, gauges, and histograms.
- The Prometheus Remote Write Source now parses Prometheus native histograms for both Remote Write v1 and v2, including exponential histograms and native histograms with custom buckets. Parsed histogram data is available on events for downstream processing. The OTLP Metrics Function and OpenTelemetry Destination convert these native histograms to OTLP formats.
- New Cribl HTTP and Cribl TCP Destinations now exclude
__rawfrom the event payload by default, reducing serialization and wire volume. Existing Destination configurations are unchanged. - Destination metrics now include a throttling chart that tracks how often a Destination is throttled, making it easier to diagnose performance issues caused by rate limiting.
- HTTP-based Destinations now honor the Retry timed out HTTP requests setting. Previously, timed-out requests were retried indefinitely even when this setting was disabled or had never been saved. After upgrade, Destinations that never saved this setting (or have it disabled) drop timed-out batches instead of retrying them. To restore timeout retries, re-save the Destination with Retry timed out HTTP requests enabled.
- The Google Pub/Sub Source can now connect with subscription-only permissions when you select Monitor subscription for new messages. This enables ingestion from hosted Pub/Sub topics that grant only subscription consume access or use non-standard topic names.
Important Changes
Notice: Cribl as Code TypeScript and Go SDK Discontinuation
Cribl is stopping active development of the Cribl as Code Go and TypeScript SDKs, which were previously in preview. To give existing users a clear path forward, we are moving the SDKs from the criblio GitHub organization to the Cribl Community GitHub organization and open sourcing them as community resources. This allows customers and community members to continue using the SDKs and build on them, while Cribl steps back from active feature development and long-term support.
The SDKs will continue to be available through their new home in the Cribl Community GitHub organization, where users can keep using them, fork them, and extend them based on their own needs. Customers looking to stay on a supported integration should consider migrating to either the Python SDK, Terraform Provider, or direct Cribl API access. Cribl support will be limited to critical issues only, such as security vulnerabilities or P0 blockers, for the defined transition period. On October 1, 2026, the SDK repositories will be archived and marked read-only.
Deprecation Notice: Smart Mode for Source Persistent Queue
To improve data integrity, Smart mode is now deprecated for Source persistent queue for hybrid and on-prem deployments. In January 2027, configurations for all deployments will automatically migrate to Always On mode, which uses a persistent queue buffer for all events.
Consider updating existing configurations to Always On mode prior to the automatic migration date. Before changing the configuration:
- Monitor your persistent queue needs to correctly size your persistent queue disk space needs and then allocate sufficient disk space.
- When making changes to your persistent queue, remember to first drain queues before disabling them to avoid orphaned data.
- Verify that data routing and filtering behaves as expected in a test environment before rolling out the new configuration to production.
Deprecation Notice: Disable Node Persistence
The Disable Node persistence setting is deprecated and will be removed in a future release. Node information is persisted by default. Use the Worker Group-level Time to keep disconnected Nodes setting to control how long Nodes are tracked.
Notice: Future Removal of AppScope Source
The AppScope Source has reached End of Support (EOS) and will be removed from Cribl Stream in a future release.
Corrections
Security Fixes
| ID | Description |
|---|---|
AI-4653 | Authentication header values for external MCP server connections are now obscured by default, with a show/hide toggle for when you need to view them. |
Operational Fixes
| ID | Description |
|---|---|
CRIBL-31682 | Fixed an issue where Live Capture on a Route or Pipeline inside a Pack returned 403 Forbidden when the Leader was in GitOps Push (read-only) mode. |
| CRIBL-43444 | Fixed an issue where tooltips on the Routes page could remain stuck on screen and overlap the UI, making Routes hard to edit. |
| CRIBL-36573 | Fixed an issue in the Schema Library where schemas that declared JSON Schema Draft 06 or earlier showed a false validation error in the UI (for example, No schema request service available), even though the schema was valid and usable. |
| CRIBL-43070 | Fixed case-sensitive Pack ID lookups for get, update, upgrade, and delete operations. Packs installed with mixed-case IDs before the lowercase-ID requirement was implemented in 4.17.0 could return not found or block CI/CD when referenced with a different casing. |
| CRIBL-42722 | Fixed an issue where Cribl.Cloud Worker Groups did not protect system.* host metrics by default on the Metrics never-drop list. Under heartbeat backpressure, CPU and memory metrics could be dropped, which left gaps or empty charts on the Monitoring page. |
| PLAT-11792 | Fixed High Data Volume Notifications that reported about twice the actual input bytes for some service-path Sources (such as Cribl TCP and Google Pub/Sub). Notification volume now matches the Monitoring UI. |
| PLAT-14643 | Fixed an issue that could cause task artifacts from long-running or recurring Collector jobs to accumulate on Worker disk when high-availability Collectors was enabled. |
| PLAT-14736 | Fixed an issue where editing a HashiCorp Vault secret store failed when you changed non-secret fields, such as the description. |
| AI-4308 | AI agents can now read and write Pipeline configurations scoped by Worker Group, and filter Worker Groups by product type (Cribl Stream, Edge, or Search) when listing available groups. Configuration changes made through MCP now apply correctly. Previously, Pipeline configuration writes were silently failing. |
| AI-4647 | The MCP system metrics tool now works correctly in distributed (Group) deployments. Previously, it could return incomplete or malformed data when targeting a Worker Group. |
| AI-4275 | Cribl Copilot no longer crashes when an external MCP server is configured with an invalid URL. The invalid server is skipped gracefully. |
| AI-4669 | Organizations that previously opted out of AI features are now correctly preserved during upgrades. AI settings remain disabled as intended. |
| AI-4693 | Improved upgrade reliability so that AI consent and provider settings are correctly retained when configuration is rehydrated from replica or Git sources. |
Source and Destination Fixes
| ID | Description |
|---|---|
CRIBL-43560 | When Hash length configured for File Monitor exceeds 16384 bytes, which can cause issues when re-ingesting files, the UI now shows a warning. |
| CRIBL-37506 | Fixed an issue where the S3 Source left empty temporary directories behind after processing Parquet files, which could exhaust disk space or inodes over time. |
| CRIBL-29558 | Fixed an issue where the Google Cloud Logging Destination could lose data when a single log entry exceeded Google’s 256 KB per-entry limit. Oversized entries are now detected and handled so they no longer cause the entire batch request to fail. |
| CRIBL-43048 | Fixed an issue where the Google Cloud Observability Destination rejected native OTLP Sum and Histogram metrics that were missing aggregation temporality. |
| CRIBL-43049 | Fixed an issue where OpenTelemetry and Google Cloud Observability Destinations could error when serializing histograms with negative or non-integer bucket counts. |
| CRIBL-43056 | Fixed an issue where the Google Cloud Observability Destination could error with Duplicate TimeSeries encountered when a batch contained multiple points for the same time series. |
| CRIBL-43135 | Fixed an issue where the OTLP Logs Function mishandled long-form AnyValue wrappers for body and attributes, causing downstream systems to see protobuf field names such as string_value as literal data instead of typed OTLP values. Other OTLP Functions and OpenTelemetry Destinations can opt in to the corrected behavior with the new Preserve native AnyValue wrappers setting. Existing configurations keep the previous behavior until you enable this setting; new configurations enable it by default. |
| CRIBL-42296 | Fixed an issue where the Google Cloud SecOps Destination did not JSON-escape __logType and __namespace override fields, which could produce invalid JSON and cause HTTP 400 failures with data loss. |
| CRIBL-41930 | Fixed an issue where setting Active Connection Limit to 0 on an OpenTelemetry (gRPC) Source blocked all inbound data, even though the UI indicates that 0 means unlimited. |
| CRIBL-42745 | Fixed an issue where idle FileSystemOut-based Destinations rewrote open-file state to disk every second with no change detection, generating unnecessary disk I/O even when no events were flowing. |
| CRIBL-41956 | Fixed an issue where the Syslog Source with TLS mutual authentication did not log client certificate information at debug or silly log levels. |
| CRIBL-43571 | OAuth authentication now correctly handles client secrets containing special characters (backticks, single quotes, backslashes). This affects all Sources and Destinations that use OAuth client credentials or refresh token flows. |
| CRIBL-41796 | Fixed an issue where Syslog UDP Destinations using IP Spoofing did not update Destination Worker Process metrics such as total_requests, failed_requests, and duration. |
Other Functional Fixes
| ID | Description |
|---|---|
AI-4674 | Background detection remains enabled now after configuration changes. |
| AI-4675 | Recommendations in Background detection can now be regenerated when sampled data is still available. |
| AI-4611 | Generate Recommendations now shows clear progress indicators and status messaging throughout the analysis flow. |
SDK Changelogs
The Cribl SDKs help you integrate with Cribl and reduce the need for repetitive tasks. We maintain changelogs for each version of the Cribl SDKs in their GitHub repositories:
- Go SDK changelogs: control plane and management plane
- Python SDK changelogs: control plane and management plane
- Typescript SDK changelogs: control plane and management plane