> ## Documentation Index > Fetch the complete documentation index at: https://doc.lucidworks.com/llms.txt > Use this file to discover all available pages before exploring further. # Fusion 5.9.4 [localhost link]: http://localhost:3000/docs/5/fusion/release-notes/5.9.4-release-notes [mintlify link]: https://doc.lucidworks.com/docs/5/fusion/release-notes/5.9.4-release-notes [old doc.lw link]: https://doc.lucidworks.com/fusion/5.9/kgbb0r Released on June 25, 2024, this [maintenance release](/docs/policies/lifecycle-policies/lw-version-support-lifecycle#maintenance-release-support-policy) includes improvements to Jira and Confluence connectors for GDPR mode support, and access control lists (ACLs) to the Graph Security Trimming query pipeline. To learn more, skip to the [release notes](#improvements). **Security patch available for api-gateway: Netty request smuggling vulnerabilities** A patch is available for the `api-gateway` service to address critical Netty request smuggling vulnerabilities (CVE-2026-42581, CVE-2026-42585, CVE-2026-42587). These vulnerabilities allow attackers to smuggle HTTP requests through the gateway, potentially bypassing security controls. The `api-gateway` service requires the Netty security patch. Follow these steps to apply the patched image: 1. Open your Fusion Helm values file. 2. Add or update the `api-gateway` image configuration: ```yaml theme={"dark"} api-gateway: image: repository: lucidworks name: api-gateway tag: 5.9.9-SUST-1634-patch imagePullPolicy: IfNotPresent ``` 3. Save the values file. 4. For Fusion Cloud Native deployments, run the `upgrade_fusion.sh` script you used for your current deployment. For Helm deployments, run: ```bash theme={"dark"} helm upgrade --namespace NAMESPACE RELEASE_NAME PATH_TO_VALUES ``` Replace `NAMESPACE` with your Kubernetes namespace, `RELEASE_NAME` with your Helm release name, and `PATH_TO_VALUES` with the path to your updated values file. 5. Wait for the `api-gateway` pods to restart and verify they are using the patched image. **Urgent action required by November 26, 2025** A patch is required by November 26, 2025 for all self-hosted Fusion deployments running on Amazon Elastic Kubernetes Service (EKS). Certain Java versions used by Fusion components reach end of life on this date. Failure to apply the patch will result in compatibility issues. The following Fusion services require the `cgroupv2` patch: | Service | Affected Fusion versions | Patch tag | | ---------------- | ------------------------ | ---------------------------------------------- | | `insights` | 5.9.4 to 5.9.15 | `lucidworks/insights:5.9-cgroupv2-patch` | | `spark-solr-etl` | 5.9.4 to 5.9.11 | `lucidworks/spark-solr-etl:5.9-cgroupv2-patch` | | `keytool-utils` | 5.9.4 to 5.9.10 | `lucidworks/keytool-utils:5.9-cgroupv2-patch` | Follow these steps to apply the patched images: 1. Open your Fusion Helm values file. For Fusion Cloud Native deployments, use the values file for your current deployment. For Helm deployments, use the values file you used to create the deployment. 2. For each service listed in the following table that applies to your Fusion version, add or update the image configuration: Expand the following code snippet for the complete image configuration list. ```yaml expandable theme={"dark"} global: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" sql-service: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" reverse-search: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" solr: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" zookeeper: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" kafka: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" zookeeper: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" ml-model-service: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" fusion-admin: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" fusion-indexing: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" query-pipeline: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" async-parsing: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" admin-ui: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" api-gateway: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" auth-ui: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" classic-rest-service: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" fusion-resources: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" job-config: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" insights: image: imagePullPolicy: Always name: insights repository: lucidworks tag: 5.9-cgroupv2-patch keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" job-launcher: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" job-rest-server: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" connectors: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" connector-plugin: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" connectors-backend: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" rules-ui: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" pm-ui: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" lwai-gateway: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" webapps: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" apps-manager: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" templating: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" tikaserver: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" argo: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" seldon-core-operator: keytoolUtils: image: repository: lucidworks name: "keytool-utils" tag: "5.9-cgroupv2-patch" imagePullPolicy: "IfNotPresent" argo-common-workflows: image: imagePullPolicy: Always repository: lucidworks sparkSolrEtlTag: 5.9-cgroupv2-patch utilitiesTag: 5.9.11 ``` ```yaml theme={"dark"} insights: image: name: insights pullPolicy: IfNotPresent repository: lucidworks tag: 5.9-cgroupv2-patch argo-common-workflows: image: imagePullPolicy: IfNotPresent repository: lucidworks sparkSolrEtlTag: 5.9-cgroupv2-patch ``` ```yaml theme={"dark"} insights: image: name: insights pullPolicy: IfNotPresent repository: lucidworks tag: insights:5.9-cgroupv2-patch ``` 3. Save the values file. 4. For Fusion Cloud Native deployments, run the `upgrade_fusion.sh` script you used for your current deployment. For Helm deployments, run the following command: ```bash theme={"dark"} helm upgrade --namespace NAMESPACE RELEASE_NAME PATH_TO_VALUES ``` Replace `NAMESPACE` with your Kubernetes namespace. Replace `RELEASE_NAME` with your Helm release name. Replace `PATH_TO_VALUES` with the path to your updated values file. 5. Wait for the affected service pods to restart and verify they are using the patched images. ## Platform Support and Component Versions ### Kubernetes platform support Lucidworks has tested and validated support for the following Kubernetes platforms and versions: * **Google Kubernetes Engine (GKE):** 1.29 * **Microsoft Azure Kubernetes Service (AKS):** 1.29 * **Amazon Elastic Kubernetes Service (EKS):** 1.29 Support is also offered for Rancher Kubernetes Engine (RKE) and OpenShift 4 versions that are based on Kubernetes 1.29. OpenStack and customized Kubernetes installations are *not* supported. For more information on Kubernetes version support, see the [Kubernetes support policy](/docs/policies/lifecycle-policies/lw-version-support-lifecycle#kubernetes-support). ### Component versions The following table details the versions of key components that may be critical to deployments and upgrades. | Component | Version | | ----------------------- | ----------------------------------------------------------------------- | | **Solr** | fusion-solr 5.9.4 *(based on Solr 9.1.1)* | | **ZooKeeper** | 3.7.1 | | **Spark** | 3.2.2 | | **Ingress Controllers** | Nginx, Ambassador (Envoy), GKE Ingress Controller Istio not supported. | **More information about support dates can be found at [Lucidworks Fusion Product Lifecycle](/docs/policies/lifecycle-policies/lw-version-support-lifecycle).** **Looking to upgrade?** Fusion 5.9.5 introduced changes that affect Spark jobs. If you are upgrading from any Fusion version earlier than 5.9.5 to a version later than 5.9.5, Lucidworks recommends first upgrading to Fusion 5.9.5 before proceeding to the target version. See [Fusion 5 Upgrades](/docs/5/fusion/operations/fusion-5-upgrades) for detailed instructions. ## Improvements * Fusion now supports Kubernetes 1.29. This applies to GKE, AKS, and EKS. It also applies to Rancher (RKE) and OpenShift 4 versions that are compatible with Kubernetes 1.29. Refer to Kubernetes documentation at [Kubernetes v1.29](https://kubernetes.io/blog/2023/12/13/kubernetes-v1-29-release/) for more information. * The Jira and Confluence classic connectors now support GDPR mode. * The Graph Security Trimming query pipeline stage now supports two new types of access control lists (ACLs) in addition to the main ACL represented by the `_lw_acl_ss` field: * A "deny" ACL list (`_lw_deny_acl_ss`). * A "share" ACL list (`_lw_share_acl_ss`) for connectors such as SMB that support it. * The Graph Security Trimming query pipeline stage has built the **Join Method**, **ACL Solr Collection**, and **Join Field** properties directly into the stage. These fields have been removed from the stage, and you no longer have to configure them. ## Bug fixes * Fixed an issue that caused counters from discarded `query-service` instances to be propagated to subsequent days, leading to inaccurate numbers on the Consumption Dashboard. * Fixed an issue that caused an NRT replica to be created even when `nrtReplicas` is set to `0`. * Fixed an issue that caused Kafka poll timeouts and commit errors, primarily impacting the SharePoint Optimized V2 connector. * This release fixes issues with several V1 connectors: * Fixed an issue that prevented the Jira Cloud V1 connector from handling `429` errors correctly. * Fixed an issue that prevented the Jira V1 connector from indexing attachments. * Fixed an issue that prevented the Salesforce V1 connector from indexing data and applying security trimming. * Fixed an issue that caused datasource jobs to time out prematurely when data takes some time to process. * Fixed an issue that sometimes led to connector crawls becoming stuck in an infinite loop. ## Deprecations For full details on deprecations, see [Deprecations and Removals](/docs/5/fusion/deprecations-and-removals). * The Fusion Search [Domain-Specific Language (DSL)](/docs/5/fusion/getting-data-out/query-basics/domain-specific-language) is deprecated in this release. Be aware that it can cause significant performance degradation in queries. ## Known issues * New Kerberos security realms cannot be configured successfully in this version of Fusion.