Skip to content

fix(deps): [OCISDEV-834] recover from dead NATS connections in nats-js-kv (stable-8.1)#12402

Merged
kobergj merged 1 commit into
owncloud:stable-8.1from
kobergj:fix/OCISDEV-834-natsjskv-hasconn-stable-8.1
Jun 15, 2026
Merged

fix(deps): [OCISDEV-834] recover from dead NATS connections in nats-js-kv (stable-8.1)#12402
kobergj merged 1 commit into
owncloud:stable-8.1from
kobergj:fix/OCISDEV-834-natsjskv-hasconn-stable-8.1

Conversation

@kobergj

@kobergj kobergj commented Jun 11, 2026

Copy link
Copy Markdown
Contributor

Backport of #12401 to stable-8.1.

Problem

The nats-js-kv go-micro store plugin's hasConn() only checked n.conn != nil, not whether the connection was still alive. Once the underlying NATS client exhausted its reconnect attempts (e.g. a NATS pod restart longer than the client's reconnect window), n.conn stayed non-nil but permanently closed. Because initConn() is gated on !hasConn(), it never re-ran, so every subsequent KV operation failed with nats: connection closed until the affected pod was restarted.

This is a base-layer bug in the store plugin used by every oCIS service backed by the NATS KV cache. Confirmed BYCS production manifestations:

  • storage-users → ListStorageSpaces: all spaces become invisible to all users (SE-1220, SE-1329, SE-1335)
  • ocs → signing-key: 500s, desktop client cannot construct signed download URLs, "X-Request Error downloading Files" (SE-1366)
  • sharing pods: same dead-connection symptom (SE-1335)

OPS workaround to date: rolling-restart the affected pod(s).

Fix

This is a dependency bump only. The replace directive for github.com/go-micro/plugins/v4/store/nats-js-kv is pointed at kobergj/plugins commit fc78af4, whose hasConn() now treats a closed connection as no connection:

func (n *natsStore) hasConn() bool {
    return n.conn != nil && !n.conn.IsClosed()
}

so the next operation transparently re-initializes the connection. (See go-micro/plugins#142 for the upstream change.)

No oCIS source changes — only go.mod, go.sum, the re-vendored plugin, and a changelog entry.

Scope note

This backport is intentionally minimal: it ships only the plugin fix, which is the load-bearing change that lets the system self-heal. The complementary hardening discussed in OCISDEV-834 (proactive MaxReconnect=-1 + connection-state handlers in reva's pkg/store and oCIS's natsjsregistry) lands on master only, not on this stable branch.

Refs OCISDEV-834.

@kw-security

kw-security commented Jun 11, 2026

Copy link
Copy Markdown

Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

…s-kv

Bumps the kobergj/plugins nats-js-kv replace pin to fc78af4, which fixes
hasConn() to treat a permanently-closed NATS connection as no connection.
Previously hasConn() only checked n.conn != nil, so once the client
exhausted its reconnect attempts the connection stayed non-nil but dead,
initConn() never re-ran, and every KV operation failed with
'nats: connection closed' until the pod was restarted.

Backport of owncloud#12401 to stable-8.1.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
@kobergj kobergj force-pushed the fix/OCISDEV-834-natsjskv-hasconn-stable-8.1 branch from eb11d93 to 74a4df4 Compare June 12, 2026 13:02
@mzner mzner self-requested a review June 12, 2026 13:08
@kobergj kobergj merged commit 71d91a0 into owncloud:stable-8.1 Jun 15, 2026
59 checks passed
@kobergj kobergj deleted the fix/OCISDEV-834-natsjskv-hasconn-stable-8.1 branch June 15, 2026 06:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants