Restate v1.7.14

Restate v1.7.14 is a security release. Restate now rejects TLS certificates issued through compromised emSign intermediate CAs. The release also updates the bundled TLS library to fix several recently disclosed vulnerabilities, and refreshes the OS trust store shipped in the Docker image.

🔒 Reject Certificates from Compromised emSign Intermediates

The private keys of several emSign (eMudhra) intermediate certificate authorities are publicly known, so anyone can use them to issue certificates that impersonate any server.

Restate now rejects any certificate chain that passes through these intermediates, including their cross-signed variants. This applies to all outgoing TLS connections, such as calls to service deployments, AWS Lambda, and object stores.

Upgrade guidance: No action is required. A server presenting a certificate from one of these intermediates will now fail the TLS handshake. Replace such certificates with ones from a trusted CA.

Related: RUSTSEC-2026-0381, RUSTSEC-2026-0382, RUSTSEC-2026-0383

🛡️ TLS Library Security Update

The TLS library (rustls) is updated to 0.23.46, which fixes:

• TLS secrets being exposed in debug output.
• A pre-authentication memory allocation of up to 1 GiB during certificate decompression.
• An unauthenticated downgrade of later connections to classical key exchange.

Related: RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, RUSTSEC-2026-0349

🐳 Up-to-Date OS Trust Store in the Docker Image

The Docker image now installs Debian's current ca-certificates package instead of carrying a fixed copy of the trust store from an older build image. Previous images still trusted the emSign ECC Root CA - G3 and Comodo AAA Services roots, which Debian has since removed.

This trust store is used by Kafka connections and by curl in the image. Future security refreshes of the image will also keep it current.

No action is required.

📖 Full Release Notes

Install

Pull the Docker images

docker pull docker.restate.dev/restatedev/restate:1.7.14
docker pull docker.restate.dev/restatedev/restate-cli:1.7.14

Install prebuilt binaries via Homebrew

brew install restatedev/tap/restate-server
brew install restatedev/tap/restate
brew install restatedev/tap/restatectl

Install prebuilt binaries into your npm project

npm install @restatedev/restate-server@1.7.14
npm install @restatedev/restate@1.7.14
npm install @restatedev/restatectl@1.7.14

Download binary archives