Bump github.com/nats-io/nats-server/v2 from 2.1.9 to 2.8.2 in /distributor

[dependabot]

Bumps github.com/nats-io/nats-server/v2 from 2.1.9 to 2.8.2.

Release notes

Sourced from github.com/nats-io/nats-server/v2's releases.

Release v2.8.2

Changelog

Go Version

• 1.17.9: Both release executables and Docker images are built with this Go release.

Added

• JetStream:
  • A JSConsumerDeliveryNakAdvisory when a message is nak'ed. Thanks to @​Coffeeri for the contribution (#3074)

Improved:

• JetStream:
  • KeyValue memory store performance for history of 1 (#3081)
  • A check was done twice (per message) for max_msg_per_subject and discard_new policy, which is the case for KV stores (#3101)
  • Reduce the number of RAFT warnings to 1 per second (for exact same log line) (#3100)
  • Bumped the default file store block size (#3102)

Changed

• JetStream:
  • When reaching the max number of pull requests, the server would evict existing pending requests (with a 408 Request Canceled) instead of sending a 409 Exceeded MaxWaiting to the new request (#3099)

Fixed

• JetStream:
  • Step-down timing for consumers or streams. When becoming leader a consumer's stream sequence number could be reset (#3079)
  • Not able to recover a consumer if a source based stream which housed the consumer filter subject was removed. Also made updates to the /healthz behavior (#3080)
  • File store compaction would not work well for blocks with small messages and lots of interior deletes. The index file was also written too often (#3087)
  • Subject transforms and delivery subjects (#3088)
  • Lock inversion, but no known situations that would have triggered it (#3092)
  • Possible panic when checking for RAFT group leaderless status (#3094)
  • A pull consumer with a MaxWaiting of 1 would not send the notification that the request timed-out (#3099)
  • RAFT and clustering issues that may have contributed to repeated warnings about inability to store an entry to WAL and expected first catchup entry to be a snapshot and peer state (#3100)
• Permissions:
  • Queue subscription's deny subjects were not always enforced. CVE-2022-29946 (#3090)

Complete Changes

nats-io/nats-server@v2.8.1...v2.8.2

Release v2.8.1

Changelog

Go Version

• 1.17.9: Both release executables and Docker images are built with this Go release.

Changed:

• JetStream:
  • Enforce a minimum of 100ms for "max age" and "duplicates window" settings (#3056)

... (truncated)

Commits

• 9e5d25b Merge pull request #3104 from nats-io/release_2_8_2
• 10c020e Release v2.8.2
• 9e60fe2 Merge pull request #3103 from nats-io/revert-3091-DisallowBearerToken
• 3cdbba1 Revert "[added] support for jwt operator option DisallowBearerToken"
• 12dd727 Merge pull request #3091 from nats-io/DisallowBearerToken
• 39c8421 Merge pull request #3102 from nats-io/fs-blk-sz
• 7246edc Bump up default block sizes
• 7c9a2d9 Bump to 2.8.2-beta.5
• 074efca Merge pull request #3101 from nats-io/js_max_per_sub_improvement
• 5d90c8e [IMPROVED] JetStream: check max-per-subject once
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #376.