AI-generated editorial illustration; not a documentary photograph.
Alibaba has published Nacos 3.3.0-RC, a pre-release build that expands the platform's AI Registry, introduces optional DNS-based service discovery, and changes several security and compatibility defaults. The cumulative release includes work from 3.3.0-BETA alongside additional fixes and dependency updates.
Broader AI Resource Management
The release candidate adds protocol-neutral management for AI agents, covering registration, endpoint publication, discovery, transport negotiation, Watch/Push behavior, Java SDKs, and Console workflows. Agentic Resource Discovery can search Agent, AgentSpec, Skill, Prompt, and MCP resources through shared indexes, with artifact retrieval and visibility filtering.
Nacos also introduces a managed MCP lifecycle spanning drafts, review, publication, online and offline states, and visibility controls. Historical A2A and MCP data may require explicit migration, and some transitions are one-way, so operators are directed to preserve migration state and rehearse upgrades before production deployment.
DNS and Client Changes
Service discovery can now answer optional DNS A-record queries over UDP or TCP. Other infrastructure additions include distributed reentrant and non-reentrant locks, dynamic plugin management, Config SDK request/result methods, encrypted compare-and-set publishing, Jackson 2 and Jackson 3 runtime support, Spring Boot 4 compatibility, and Linux RISC-V support with RocksDB.
The mandatory Prometheus dependency has been removed from nacos-client in favor of a pluggable metrics SPI. Metrics become a no-op unless an implementation of NacosClientMetricsProvider is installed, even when client metrics are enabled.
Authentication Now Defaults On
Client API authentication is enabled by default in Nacos 3.3.0-RC: an absent nacos.core.auth.enabled setting now behaves as true, while an explicit false remains effective. Deployments whose clients lack credentials must retain the old setting temporarily or provision identities and permissions before enabling authentication consistently across cluster members.
Native JRaft gRPC requests also gain server-identity authentication. Enforcement begins after all members advertise support and persists across restarts, making rolling downgrades to members without compatible credentials potentially disruptive.
Upgrade Boundaries
Selected deprecated Pipeline and Console MCP import endpoints now return HTTP 410 by default, although a temporary compatibility switch can reopen them. Operators may also need to migrate legacy Config tables, historical AI resource keys, A2A records, and old untagged Raft logs before upgrading. The release further tightens validation for network targets, archive layouts, filesystem paths, authorization, and invalid bearer tokens, while upgrading gRPC to 1.81.0 to address CVE-2026-33871.
Source: Alibaba Nacos — 3.3.0-RC
SIGNAL TITANS
Leave a Reply