Weik.io 2026.2.1
Weik.io 2026.2.1 updates 2026.2 with the fixes from the release test of 2026.2.0 and with stricter security on the gateway and at the sites. The gateway adds security headers to every reply and passes a caller's cookies on only to an API that asks for them, and a site stops what it runs once it has been cut off from the hub for longer than its limit, 24 hours unless you set another. The texts of the admin UI and the CLI now say what happened and what to do next.
Highlights
API management
The gateway removes the caller's Cookie header from every call it forwards, so a service behind a shared hostname no longer receives the cookies that were set for other services. An API whose service needs them sets the Metadata key weikio-forward-cookies to "true" on its version's route. Every reply of the backend and the gateway, error replies included, carries Referrer-Policy: no-referrer, X-Content-Type-Options: nosniff and a Permissions-Policy that turns off the camera, microphone, location and payments. A site gateway stops serving a route table that the hub confirmed more than 24 hours ago, or longer when Weikio:Apim:OfflineStart:MaxAge sets another age.
Camel integrations
An installation that lists its own Maven repositories or a mirror builds on Camel 4.18.5 and on Camel 4.22.1 without access to the internet. A build fails when Camel couldn't download a jar that the integration, the platform or a kamelet declares, and its ERROR line shows the artifact and where it's declared, where before the build passed with a version that couldn't start. When Camel stops before it creates the routes, the build log shows Camel's own loading error. Each JVM a build starts runs with a fixed 256 MiB heap, so a first build adds about 650 MB to the server for its half minute.
Managed file transfer
When rclone refuses a run before its log opens, such as for an unknown flag, the run's error is rclone's own reason, and the run view, the Runs list and the problem say why it failed. The transfer that weikio init --kind mft writes runs as soon as it's deployed, from an empty memory remote, with the SFTP source kept as commented lines. weikio variable set and weikio secret set also list the transfers that use the value through a placeholder, and --restart restarts them.
Events
When a route publishes into a channel the project doesn't have, weikio apply --dry-run and weikio diff show the warning in the plan before anything is applied. weikio init --kind change-tracking writes a change tracking that publishes into the channel weikio init line that creates that channel. A change tracking fills a database port kept in a variable, and the rows it read when it first read a table show the operation Snapshot.
Observability
weikio logs -f, the log stream API and the live tail in the admin UI also send the lines that reach the log store late, such as the lines a site kept while it couldn't reach the hub, and mark each one late. An integration that logs long lines fast has its traces stored, because its spans keep at most 8,192 characters of each value and travel in parts of at most 4 MiB. A site's first telemetry batch is no longer refused, and a hub server shows as offline only when its figures are more than 90 seconds behind the newest. The backend runs with two malloc arenas, so its memory stays level on hub servers that run for weeks, which was the one finding of the 24-hour release test of 2026.2.0.
Delivery, security and operations
An agent stops its deployments once the hub hasn't replied for longer than the environment's offline limit, 24 hours unless --offline-start-max-age sets another, and starts them again at the hub's first reply. A site that was revoked while it was offline stops within that limit as well. weikio deploy and weikio promote into production first have the platform check the change and ask their question only when the check passes, and weikio delete environment runs a dry run of the delete before it asks for the name. weikio validate refuses a missing member or a value of the wrong type at its file and line, with the sentence the platform would refuse it with. The texts of the admin UI, the CLI and the API were rewritten to say what happened and what to do next.
Images
The images are on Docker Hub with the exact version as their tag, and images.env pins each one by its digest. No image is tagged latest.
| Image | Digest |
|---|---|
weikio/ | sha256:3f8effa15bef… |
weikio/ | sha256:84530db566b6… |
weikio/ | sha256:eafe64a7f414… |
weikio/ | sha256:bc73e96124f7… |
The table shows the start of each digest, and images.env has them in full, with the images of the stores and the message server.
CLI files
The checksums are from the release's SHA256SUMS, and the Windows CLI is signed by Adafy Oy. curl -fsSL https://weik.io/install.sh | sh checks them before it places the CLI.
| File | SHA-256 |
|---|---|
| weikio-2026.2.1-linux-x64 | 24f950e6cbab170e73c68530a4ac5770d2760346f89f77bfa3a326930ca4b999 |
| weikio-2026.2.1-win-x64.exe | ca2243a7b69e3e41f897eeee184887e1600018c2a3eb2dfe3e0e83d993b4b018 |
The open source projects inside the images, with their versions and licences, are listed in Third-party software. The release runs Apache Camel 4.22.1 and 4.18.5, and its stores, message server and TLS terminator are the same images as in 2026.2.0.
Upgrade notes
An installation of 2026.2.0 upgrades in place with upgrade.sh, which makes a backup first and keeps every record and every file of yours. Check these before you upgrade:
- A site stops what it runs once it has been cut off from the hub for longer than its environment's offline limit, 24 hours unless set. On every environment whose sites may stay cut off for longer, set
--offline-start-max-age, which Edit environment in the admin UI shows as the offline start limit, andWeikio:Apim:OfflineStart:MaxAgeon its gateways. - An API whose service needs the caller's cookies needs the Metadata key
weikio-forward-cookiesset to"true"on its version's route. - Upgrade the hub before anyone runs
weikio delete environment, orweikio deployandweikio promoteinto production on a terminal, from a 2026.2.1 CLI. Against a 2026.2.0 hub the CLI sends nothing and says which release the command needs. - The backup service now removes only the archives it marked as its own, so the archives taken before the upgrade stay in the backups folder until you remove them.
The upgrade also writes the stack's files again with the current texts and changes nothing else in them, and every site keeps the bundle it has.
$ sudo sh ./upgrade.sh https://weik.io/downloads/releases/2026.2.1/images.env
$ sudo sh ./upgrade.sh --rollbackUpgrades and rollback in the docs has the check before an upgrade, the rollback and the rolling upgrade of a hub on several servers.
Security
2026.2.1 fixes the medium finding of the security test of 2026.2.0, in which the gateway passed a caller's cookies on to the service behind it, and it closes these gaps as well:
- Renaming an integration or an API needs the author role in every environment that deploys it, and a refusal counts the environments the caller can't read instead of listing them.
- The refusal to delete a secret that an identity provider uses mentions the provider only to a platform administrator, because no other role may read providers.
- Requests with an API key or a sign-in callback that a server doesn't know yet share one read of the store every 100 ms at most, so a stream of them no longer makes the server read the store for each one.
- While the audit trail isn't accepting a backend node's records, the node keeps at most 100,000 of them in 256 MiB and writes the rest to its own log.
- The break-glass webhook also receives the record the hub writes when it ends an emergency session outside the break-glass window.
Known issues
Each of these is fixed in 2026.2.2.
weikio channel setwrites the channel again from the values it's given and the channel's stored type, parameters, retention and description, and resets the other members of the channel's document, such as labels, requirements and delivery, to their defaults. To change a channel that sets any of these, edit its document and runweikio apply, which also restores a channel that was already changed.weikio provider setreplaces the provider with exactly the flags it's given, andweikio member addfor an existing member replaces that person's grant. With either command, give every flag each time. In the admin UI, Grant access on someone who is already a member replaces their role and environments with the dialog's values, and an empty Environments field means every environment. To change an existing member's access, use Edit access.weikio agent set-capabilitiesreplaces the agent's whole capability list with the pairs it's given. Withoutgateway=pairs a gateway site stops serving its gateways and its APIs stop answering, and withoutenvironment=pairs the agent leaves its environments. Setting the gateway again brings back the APIs, subscriptions and routes, but the site orders new certificates for the names it ordered itself, which counts against the authority's limit on repeated certificates. Pass everygateway=andenvironment=pair each time, or use Set capabilities in the admin UI, which starts from the current values.- Requests that carry no credential write audit records with no limit per caller address, so a sustained flood of them pushes the oldest records out of the 8 GiB audit trail.