1.11.0 (November 11, 2025)

FEATURES:

• Client Identity: Nomad clients use identities for authenticating and authorizing itself when performing RPC calls. The identities are generated and rotated automatically by Nomad servers with configurable TTLs. [GH-26291]
• Client Introduction: Nomad clients can now be introduced to the cluster using a token-based approach. Nomad servers can be configured with introduction enforcement levels which dictate how clients can join the cluster resulting in logs and metrics to detail introduction violations. [GH-26430]
• scheduler: Enable deployments for system jobs [GH-26708]
• secrets: Adds secret block for fetching and interpolating secrets in job spec [GH-26681]

BREAKING CHANGES:

• metrics: Eval broker metrics that previously used the job ID as a label will now use the parent ID of dispatch and periodic jobs [GH-26737]
• sysbatch: Submitting a sysbatch job with a reschedule block will now return an error instead of being silently ignored [GH-26279]

SECURITY:

• build: Update go-getter to 1.8.3 that prevents a partially written file from remaining on disk with permissions that didn't include the umask. [GH-27034]
• build: Update toolchain to Go 1.25.2 to address Go stdlib CVE-2025-61724, CVE-2025-61725, CVE-2025-58187, CVE-2025-61723, CVE-2025-47912, CVE-2025-58185, CVE-2025-58186, CVE-2025-58188, and CVE-2025-58183 [GH-26909]
• job: Disallow tasks using the name "alloc" which breaks inter-task filesystem isolation [GH-27001]

IMPROVEMENTS:

• api: The Evaluations.Info method of the Go API now populates the RelatedEvals field. [GH-26156]
• build: Add tzdata to Docker container final image [GH-26794]
• build: Updated Go to 1.25.1 [GH-26823]
• cli: Add -preserve-resources flag for keeping resource block when updating jobs [GH-26841]
• cli: Added related evals and placed allocations tables to the eval status command, and exposed more fields without requiring the -verbose flag. [GH-26156]
• config: Added job_max_count option to limit number of allocs for a single job [GH-26858]
• consul connect: Allow cni/* network mode; use at your own risk [GH-26449]
• install (Enterprise): Updated license information displayed during post-install [GH-26791]

DEPRECATIONS:

• api: the Resources and Reserved fields on the Node struct in the Go API are deprecated and will be removed in Nomad 1.12.0. Use the NodeResources and ReservedResources fields instead [GH-26951]

BUG FIXES:

• acl: Fixed a bug where ACL policies would silently accept invalid or duplicate blocks [GH-26836]
• auth: Fixed a bug where workload identity tokens could not be used to list or get policies from the ACL API [GH-26772]
• build: Updated toolchain to Go 1.25.3 to address bug in TLS certificate validation [GH-26949]
• client: Fix unique identifiers for templates with same content [GH-26880]
• client: restore task network status on client restart so restarted tasks receive proper networking environment variables, hosts file, and resolv.conf. [GH-26699]
• consul (Enterprise): Fixed a bug where Consul fingerprinting would generate warning logs if there was no default cluster [GH-26787]
• core: Fixed a bug where GC batch sizes for jobs resulted in excessively large Raft logs [GH-26974]
• csi: Fixed a bug where multiple node plugin RPCs could be in-flight for a single volume []