{"record":{"id":"d770ace370f39b8a","repo":"nats-io/nats-server","slug":"operator-s-expected-minor-version-d-server-min","errorCode":null,"errorMessage":"operator %s expected minor version %d > server minor version %d","messagePattern":"operator (.+?) expected minor version (.+?) > server minor version (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/jwt.go","lineNumber":137,"sourceCode":"\t\t// In case the system account is neither defined in config nor in the first operator.\n\t\t// If it would be needed due to the nats account resolver, raise an error.\n\t\tswitch o.AccountResolver.(type) {\n\t\tcase *DirAccResolver, *CacheDirAccResolver:\n\t\t\treturn fmt.Errorf(\"using nats based account resolver - the system account needs to be specified in configuration or the operator jwt\")\n\t\t}\n\t}\n\n\tsrvMajor, srvMinor, srvUpdate, _ := versionComponents(VERSION)\n\tfor _, opc := range o.TrustedOperators {\n\t\tif major, minor, update, err := jwt.ParseServerVersion(opc.AssertServerVersion); err != nil {\n\t\t\treturn fmt.Errorf(\"operator %s expects version %s got error instead: %s\",\n\t\t\t\topc.Subject, opc.AssertServerVersion, err)\n\t\t} else if major > srvMajor {\n\t\t\treturn fmt.Errorf(\"operator %s expected major version %d > server major version %d\",\n\t\t\t\topc.Subject, major, srvMajor)\n\t\t} else if srvMajor > major {\n\t\t} else if minor > srvMinor {\n\t\t\treturn fmt.Errorf(\"operator %s expected minor version %d > server minor version %d\",\n\t\t\t\topc.Subject, minor, srvMinor)\n\t\t} else if srvMinor > minor {\n\t\t} else if update > srvUpdate {\n\t\t\treturn fmt.Errorf(\"operator %s expected update version %d > server update version %d\",\n\t\t\t\topc.Subject, update, srvUpdate)\n\t\t}\n\t}\n\t// If we have operators, fill in the trusted keys.\n\t// FIXME(dlc) - We had TrustedKeys before TrustedOperators. The jwt.OperatorClaims\n\t// has a DidSign(). Use that longer term. For now we can expand in place.\n\tfor _, opc := range o.TrustedOperators {\n\t\tif o.TrustedKeys == nil {\n\t\t\to.TrustedKeys = make([]string, 0, 4)\n\t\t}\n\t\tif !opc.StrictSigningKeyUsage {\n\t\t\to.TrustedKeys = append(o.TrustedKeys, opc.Subject)\n\t\t}\n\t\to.TrustedKeys = append(o.TrustedKeys, opc.SigningKeys...)","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/jwt.go#L119-L155","documentation":"Similar to the major check: the operator asserts a minimum minor version. If the operator's minor version exceeds the running server's (with major equal), the server refuses to start since required features may be missing.","triggerScenarios":"Operator JWT asserts e.g. 2.11.0 while running nats-server 2.10.x; validateOptions minor comparison fails.","commonSituations":"Operator updated with newer nsc (asserting latest features) but the server cluster not yet upgraded; mixed-version fleets where one config is pushed everywhere.","solutions":["Upgrade nats-server to at least the asserted minor version","Or lower the operator's assert with `nsc edit operator ...` / reissue the JWT"],"exampleFix":"// before\nserver: 2.10.11, operator asserts 2.11.0\n// after\nupgrade server to >= 2.11.0  # or reissue operator asserting 2.10.0","handlingStrategy":"validation","validationCode":"// Go: compare asserted minor against running server before startup\n_, srvMinor, _, _ := versionComponents(VERSION)\nif _, minor, _, err := jwt.ParseServerVersion(opc.AssertServerVersion); err == nil && minor > srvMinor {\n    return fmt.Errorf(\"server too old for operator (minor %d > %d)\", minor, srvMinor)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Track operator assert versions in a fleet inventory","Roll server upgrades out before pushing new operator JWTs","Use staging to test version-asserting operators against target server versions"],"tags":["nats","jwt","version-mismatch","operator-mode"],"backgroundTag":"version-incompatible","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}