{"record":{"id":"9ec33af4c61cc733","repo":"nats-io/nats-server","slug":"operator-s-expected-update-version-d-server-up","errorCode":null,"errorMessage":"operator %s expected update version %d > server update version %d","messagePattern":"operator (.+?) expected update version (.+?) > server update version (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/jwt.go","lineNumber":141,"sourceCode":"\t\t\treturn fmt.Errorf(\"using nats based account resolver - the system account needs to be specified in configuration or the operator jwt\")\n\t\t}\n\t}\n\n\tsrvMajor, srvMinor, srvUpdate, _ := versionComponents(VERSION)\n\tfor _, opc := range o.TrustedOperators {\n\t\tif major, minor, update, err := jwt.ParseServerVersion(opc.AssertServerVersion); err != nil {\n\t\t\treturn fmt.Errorf(\"operator %s expects version %s got error instead: %s\",\n\t\t\t\topc.Subject, opc.AssertServerVersion, err)\n\t\t} else if major > srvMajor {\n\t\t\treturn fmt.Errorf(\"operator %s expected major version %d > server major version %d\",\n\t\t\t\topc.Subject, major, srvMajor)\n\t\t} else if srvMajor > major {\n\t\t} else if minor > srvMinor {\n\t\t\treturn fmt.Errorf(\"operator %s expected minor version %d > server minor version %d\",\n\t\t\t\topc.Subject, minor, srvMinor)\n\t\t} else if srvMinor > minor {\n\t\t} else if update > srvUpdate {\n\t\t\treturn fmt.Errorf(\"operator %s expected update version %d > server update version %d\",\n\t\t\t\topc.Subject, update, srvUpdate)\n\t\t}\n\t}\n\t// If we have operators, fill in the trusted keys.\n\t// FIXME(dlc) - We had TrustedKeys before TrustedOperators. The jwt.OperatorClaims\n\t// has a DidSign(). Use that longer term. For now we can expand in place.\n\tfor _, opc := range o.TrustedOperators {\n\t\tif o.TrustedKeys == nil {\n\t\t\to.TrustedKeys = make([]string, 0, 4)\n\t\t}\n\t\tif !opc.StrictSigningKeyUsage {\n\t\t\to.TrustedKeys = append(o.TrustedKeys, opc.Subject)\n\t\t}\n\t\to.TrustedKeys = append(o.TrustedKeys, opc.SigningKeys...)\n\t}\n\tfor _, key := range o.TrustedKeys {\n\t\tif !nkeys.IsValidPublicOperatorKey(key) {\n\t\t\treturn fmt.Errorf(\"trusted Keys %q are required to be a valid public operator nkey\", key)","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/jwt.go#L123-L159","documentation":"The final step of the version check: if the operator's asserted update (patch) version exceeds the running server's patch version (with major/minor equal), startup fails because the operator requires a newer patch release.","triggerScenarios":"Operator JWT asserts e.g. 2.10.9 while running nats-server 2.10.3; validateOptions update comparison fails.","commonSituations":"Security-reasserted operators after patch upgrades where only some hosts got the new server binary; conservative environments pinning old patch versions.","solutions":["Patch-upgrade nats-server to at least the asserted update version","Or reissue the operator JWT with an assert <= the deployed server version"],"exampleFix":"// before\nserver: 2.10.3, operator asserts 2.10.9\n// after\nupgrade server to >= 2.10.9  # or reissue operator asserting 2.10.3","handlingStrategy":"validation","validationCode":"// Go: compare asserted update version against running server\n_, _, srvUpdate, _ := versionComponents(VERSION)\nif _, _, update, err := jwt.ParseServerVersion(opc.AssertServerVersion); err == nil && update > srvUpdate {\n    return fmt.Errorf(\"server patch too old for operator (update %d > %d)\", update, srvUpdate)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Apply patch upgrades fleet-wide before re-asserting operators","Automate a preflight that compares nats-server version to every operator's assert","Avoid pinning servers to old patch releases in operator-mode clusters"],"tags":["nats","jwt","version-mismatch","operator-mode"],"backgroundTag":"version-incompatible","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}