// Module included in the following assemblies:
//
// * nodes/pods/nodes-cma-autoscaling-custom-rn-past.adoc

:_mod-docs-content-type: REFERENCE
[id="nodes-pods-autoscaling-custom-rn-212_{context}"]
= Custom Metrics Autoscaler Operator 2.12 release notes

[role="_abstract"]
You can review the following release notes to learn about changes in the 2.12.z releases.

[id="nodes-pods-autoscaling-custom-rn-2121-394_{context}"]
== Custom Metrics Autoscaler Operator 2.12.1-394 release notes

This release of the Custom Metrics Autoscaler Operator 2.12.1-394 provides a bug fix for running the Operator in an {product-title} cluster. The following advisory is available for the Custom Metrics Autoscaler: link:https://access.redhat.com/errata/RHSA-2024:2901[RHSA-2024:2901].

[IMPORTANT]
====
Before installing this version of the Custom Metrics Autoscaler Operator, remove any previously installed Technology Preview versions or the community-supported version of Kubernetes-based Event Driven Autoscaler (KEDA).
====

Bug fixes::

* Before this update, the `protojson.Unmarshal` function entered into an infinite loop when unmarshaling certain forms of invalid JSON. This condition could occur when unmarshaling into a message that contains a `google.protobuf.Any` value or when the `UnmarshalOptions.DiscardUnknown` option is set. With this release, the issue is resolved. (link:https://issues.redhat.com/browse/OCPBUGS-30305[OCPBUGS-30305])

* Before this update, when parsing a multipart form, either explicitly with the `Request.ParseMultipartForm` method or implicitly with the `Request.FormValue`, `Request.PostFormValue`, or `Request.FormFile` method, the limits on the total size of the parsed form were not applied to the memory consumed. This could cause memory exhaustion. With this release, the parsing process now correctly limits the maximum size of form lines while reading a single form line. (link:https://issues.redhat.com/browse/OCPBUGS-30360[OCPBUGS-30360])

* Before this update, when following an HTTP redirect to a domain that is not on a  matching subdomain or on an exact match of the initial domain, an HTTP client would not forward sensitive headers, such as `Authorization` or `Cookie`. For example, a redirect from `example.com` to `www.example.com` would forward the `Authorization` header, but a redirect to `www.example.org` would not forward the header. With this release, the issue is resolved. (link:https://issues.redhat.com/browse/OCPBUGS-30365[OCPBUGS-30365])

* Before this update, verifying a certificate chain that contains a certificate with an unknown public key algorithm caused the certificate verification process to panic. This condition affected all crypto and  Transport Layer Security (TLS) clients and servers that set the `Config.ClientAuth` parameter to the `VerifyClientCertIfGiven` or `RequireAndVerifyClientCert` value. The default behavior is for TLS servers to not verify client certificates. With this release, the issue is resolved. (link:https://issues.redhat.com/browse/OCPBUGS-30370[OCPBUGS-30370])

* Before this update, if errors returned from the `MarshalJSON` method contained user-controlled data, an attacker could have used the data to break the contextual auto-escaping behavior of the HTML template package. This condition would allow for subsequent actions to inject unexpected content into the templates. With this release, the issue is resolved. (link:https://issues.redhat.com/browse/OCPBUGS-30397[OCPBUGS-30397])

* Before this update, the `net/http` and `golang.org/x/net/http2` Go packages did not limit the number of `CONTINUATION` frames for an HTTP/2 request. This condition could result in excessive CPU consumption. With this release, the issue is resolved. (link:https://issues.redhat.com/browse/OCPBUGS-30894[OCPBUGS-30894])

[id="nodes-pods-autoscaling-custom-rn-2121-384_{context}"]
== Custom Metrics Autoscaler Operator 2.12.1-384 release notes

This release of the Custom Metrics Autoscaler Operator 2.12.1-384 provides a bug fix for running the Operator in an {product-title} cluster. The following advisory is available for the Custom Metrics Autoscaler link:https://access.redhat.com/errata/RHBA-2024:2043[RHBA-2024:2043].

[IMPORTANT]
====
Before installing this version of the Custom Metrics Autoscaler Operator, remove any previously installed Technology Preview versions or the community-supported version of KEDA.
====

Bug fixes::

* Before this update, the `custom-metrics-autoscaler` and `custom-metrics-autoscaler-adapter` images were missing time zone information. As a consequence, scaled objects with `cron` triggers failed to work because the controllers were unable to find time zone information. With this release, the image builds are updated to include time zone information. As a result, scaled objects containing `cron` triggers now function properly. (link:https://issues.redhat.com/browse/OCPBUGS-32395[OCPBUGS-32395]) 

[id="nodes-pods-autoscaling-custom-rn-2121-376_{context}"]
== Custom Metrics Autoscaler Operator 2.12.1-376 release notes

This release of the Custom Metrics Autoscaler Operator 2.12.1-376 provides security updates and bug fixes for running the Operator in an {product-title} cluster. The following advisory is available for the Custom Metrics Autoscaler Operator: link:https://access.redhat.com/errata/RHSA-2024:1812[RHSA-2024:1812].

[IMPORTANT]
====
Before installing this version of the Custom Metrics Autoscaler Operator, remove any previously installed Technology Preview versions or the community-supported version of KEDA.
====

Bug fixes::

* Before this update, if invalid values such as nonexistent namespaces were specified in scaled object metadata, the underlying scaler clients would not free, or close, their client descriptors, resulting in a slow memory leak. With this release, the underlying client descriptors close when there are errors, preventing memory from leaking. (link:https://issues.redhat.com/browse/OCPBUGS-30145[OCPBUGS-30145])

* Before this update, the `ServiceMonitor` custom resource (CR) for the `keda-metrics-apiserver` pod was not functioning, because the CR referenced an incorrect metrics port name of `http`. With this release, the `ServiceMonitor` CR now references the proper port name of `metrics`. As a result, the Service Monitor functions properly. (link:https://issues.redhat.com/browse/OCPBUGS-25806[OCPBUGS-25806])
