Breaking Changes

• N/A

New Features

• Go:
  • Contains() checks parameter existence on configs, experiments, layers, and parameter stores, while ParameterStore.GetParameterList() lists configured keys
• Elixir:
  • Statsig.ObservabilityClient and Statsig.Options.observability_client let applications forward SDK metrics and errors to their observability backend.
• Java, Go, .NET, PHP, C++ (shared FFI):
  • gRPC websocket streaming to the Statsig Forward Proxy is now enabled in the shared native library.
• Java:
  • SpecAdapterType and AuthenticationMode constants simplify configuring spec adapters and authentication.

Improvements & Fixes

• All SDKs (rust core): automatic exposures preserve the contextual bandit's explore suffix in the rule ID.
• PHP: request teardown stops the shared runtime after flushing events, preventing native-library unload crashes on Windows/IIS.
• Go: persistent-storage callbacks release native argument memory and retain safely terminated load results, fixing memory leaks and unsafe reads.
• Java: unset or non-positive spec-adapter initialization timeouts now use the core default of 3,000 ms.

Included In This Release

• 56e2cbe80083bbc1f617ea3bc009f80f46e60a57 statsig-kong[bot]
  • [automated] chore: bump version to 0.23.1-beta.2609230207 (#3205)
• da7bfcd9c6a8ce381954a56e7420a14fc635e113 Kenneth Yeh
  • Fix the node core RC bump workflow: pin pnpm, reclaim runner disk, raise the Node heap (#3203)
• 510d266b911a3523b08711f291dd51a00c6ee22c statsig-kong[bot]
  • [automated] chore: bump version to 0.23.1-beta.2609170207 (#3202)
• 826595dc5a35703440bdd11c8b198b5d7df6eba7 statsig-kong[bot]
  • [automated] chore: bump version to 0.23.1-rc.2609161923 (#3201)
• 75672df222781d33c8f53ad85081c6e43982b6ef statsig-kong[bot]
  • [automated] sync rc with main (#3200)
• 4c71556 statsig-kong[bot]
  • [automated] chore: bump version to 0.23.1-beta.2609160206 (#3198)
• 46a0795 Jacob O'Quinn
  • STADXP-457: Preserve CMAB explore suffix in automatic exposures (#3196)
• 1f569a6 statsig-kong[bot]
  • [automated] chore: bump version to 0.23.1-beta.2609100206 (#3195)
• dd8201d Jacob O'Quinn
  • STADXP-435 Restore the PHP scheduled benchmark (#3194)
• e77a8ba statsig-kong[bot]
  • [automated] chore: bump version to 0.23.1-beta.2609090206 (#3193)
• 2dd959f Kenneth Yeh
  • [STADXP-359] PHP: stop the shared runtime during request teardown (#3179)
• 661a440 Kenneth Yeh
  • feat(go): add Contains and GetParameterList for parameter key existence (STADXP-353) (#3177)
• 1d23146 Peter Zhu
  • [S2SDK-111] elixir: expose ObservabilityClient on StatsigOptions (#3051)
• dd091f9 statsig-kong[bot]
  • [automated] chore: bump version to 0.23.0-rc.1 (#3191)
• 5c1906e statsig-kong[bot]
  • [automated] chore: bump version to 0.22.0-beta.2609040206 (#3186)
• 19c796a Peter Zhu
  • feat(java/ffi): enable gRPC websocket streaming (with_grpc) [S2SDK-146] (#3066)
• 39ed8e6 Kenneth Yeh
  • fix(ci): split Go package verification into as-shipped and upgraded coverage (#3184)
• cb5cb16 statsig-kong[bot]
  • [automated] chore: bump version to 0.22.0-beta.2609030212 (#3183)
• bff4319 Peter Zhu
  • [STADXP-229] go: free persistent-storage FFI args + NUL-terminate load result (#3141)
• 0537018 Jacob O'Quinn
  • CI: verify and apply docs from private tooling (#3163)
• 2100071 Jacob O'Quinn
  • fix: assert thread-count delta instead of absolute ceiling in NumThreads test (#3165)
• 63559fe statsig-kong[bot]
  • [automated] chore: bump version to 0.22.0-beta.2609020216 (#3170)
• 125681f statsig-kong[bot]
  • [automated] chore: bump version to 0.22.0-rc.2609012332 (#3169)
• d6c4469 statsig-kong[bot]
  • [automated] sync rc with main (#3168)

Included In This Release

• 02a7942 statsig-kong[bot]
  • chore: bump version to 0.23.1-rc.2609161922
• cb5778d Xin Li (Bot)
  • [automated] sync rc with main
• 4c71556 statsig-kong[bot]
  • [automated] chore: bump version to 0.23.1-beta.2609160206 (#3198)
• 46a0795 Jacob O'Quinn
  • STADXP-457: Preserve CMAB explore suffix in automatic exposures (#3196)
• 1f569a6 statsig-kong[bot]
  • [automated] chore: bump version to 0.23.1-beta.2609100206 (#3195)
• dd8201d Jacob O'Quinn
  • STADXP-435 Restore the PHP scheduled benchmark (#3194)
• e77a8ba statsig-kong[bot]
  • [automated] chore: bump version to 0.23.1-beta.2609090206 (#3193)
• 2dd959f Kenneth Yeh
  • [STADXP-359] PHP: stop the shared runtime during request teardown (#3179)
• 661a440 Kenneth Yeh
  • feat(go): add Contains and GetParameterList for parameter key existence (STADXP-353) (#3177)
• 1d23146 Peter Zhu
  • [S2SDK-111] elixir: expose ObservabilityClient on StatsigOptions (#3051)
• dd091f9 statsig-kong[bot]
  • [automated] chore: bump version to 0.23.0-rc.1 (#3191)
• 5c1906e statsig-kong[bot]
  • [automated] chore: bump version to 0.22.0-beta.2609040206 (#3186)
• 19c796a Peter Zhu
  • feat(java/ffi): enable gRPC websocket streaming (with_grpc) [S2SDK-146] (#3066)
• 39ed8e6 Kenneth Yeh
  • fix(ci): split Go package verification into as-shipped and upgraded coverage (#3184)
• cb5cb16 statsig-kong[bot]
  • [automated] chore: bump version to 0.22.0-beta.2609030212 (#3183)
• bff4319 Peter Zhu
  • [STADXP-229] go: free persistent-storage FFI args + NUL-terminate load result (#3141)
• 0537018 Jacob O'Quinn
  • CI: verify and apply docs from private tooling (#3163)
• 2100071 Jacob O'Quinn
  • fix: assert thread-count delta instead of absolute ceiling in NumThreads test (#3165)
• 63559fe statsig-kong[bot]
  • [automated] chore: bump version to 0.22.0-beta.2609020216 (#3170)
• 125681f statsig-kong[bot]
  • [automated] chore: bump version to 0.22.0-rc.2609012332 (#3169)
• d6c4469 statsig-kong[bot]
  • [automated] sync rc with main (#3168)

Full Changelog: 0.23.0...0.23.1

Breaking Changes

• None.

New Features

• Node.js:
  • getLayerList() — Enumerate layer names in the current config snapshot without evaluating a user or logging an exposure.
• Java:
  • getLayerList() — Enumerate layer names in the current config snapshot without evaluating a user or logging an exposure.
• Python:
  • get_layer_list() — Enumerate layer names in the current config snapshot without evaluating a user or logging an exposure.
  • SDK event subscriptions — subscribe(), unsubscribe(), unsubscribe_by_id(), and unsubscribe_all() now support specs_updated, gate/config/experiment/layer evaluation events, and *. Callbacks receive the event payload as a dictionary.
• Rust:
  • None.
• .NET:
  • None.
• Elixir:
  • get_parameter_store_list() — Enumerate Parameter Store names, completing the Elixir entity-list API surface.
• Go:
  • GetLayerList() — Enumerate layer names in the current config snapshot without evaluating a user or logging an exposure.
• PHP:
  • getParameterStoreList() — Enumerate Parameter Store names, completing the PHP entity-list API surface.

Improvements & Fixes

• Node.js:
  • None.
• Java:
  • Harden native-library loading so musl-detection and other resolver failures cannot crash SDK initialization.
  • Add the statsig.skip.musl.detection system property and preserve thread interrupt status during fallback handling.
• Python:
  • None.
• Rust:
  • Box tonic::Status inside StatsigGrpcErr, reducing the gRPC error enum’s size and restoring compatibility with the corrected clippy::result_large_err lint. This does not change public behavior.
• .NET:
  • None.
• Elixir:
  • None.
• Go:
  • None.
• PHP:
  • None.

Included In This Release

• d3a1aee statsig-kong[bot]
  • chore: bump version to 0.22.0-rc.2609012331
• 469b04f Xin Li (Bot)
  • [automated] sync rc with main
• 7fcd024 Jacob O'Quinn
  • [release] 0.22.0-rc.2608272101 - Layer List APIs, Parameter Store List APIs, Python SDK Event Subscriptions, and Java Native-Loader Hardening (#3162)
• 0ed02e0 statsig-kong[bot]
  • [automated] chore: bump version to 0.22.0-beta.2608270338 (#3160)
• a10ad64 Kenneth Yeh
  • [S2SDK-55] Python: expose specs_updated event subscription (#2982)
• cb9b9ff Jacob O'Quinn
  • fix: box tonic::Status in StatsigGrpcErr to satisfy clippy::result_large_err (#3156)
• df3c0cc statsig-kong[bot]
  • [automated] chore: bump version to 0.22.0-beta.2608260228 (#3157)
• 79fb718 statsig-kong[bot]
  • [automated] chore: bump version to 0.22.0-rc.2608242236 (#3152)
• f7089c4 Jacob O'Quinn
  • [release] 0.22.0-rc.2608242235 - [rc] (#3151)
• f436de7 statsig-kong[bot]
  • [automated] chore: bump version to 0.22.1-beta.2608220222 (#3150)
• 1a7966e Kenneth Yeh
  • fix(java): keep musl-detection failures from crashing SDK init (#3083)
• f9120d3 statsig-kong[bot]
  • [automated] chore: bump version to 0.22.1-beta.2608210228 (#3149)
• 037a2f6 Jacob O'Quinn
  • [STADXP-89] PHP: expose getParameterStoreList (#3139)
• 559055f Jacob O'Quinn
  • [STADXP-91] Elixir: expose get_parameter_store_list (#3140)
• 4117b19 Jacob O'Quinn
  • [STADXP-340] go: expose GetLayerList (#3145)
• 57f2a23 Jacob O'Quinn
  • [STADXP-339] java: expose getLayerList (#3144)
• eebd40c statsig-kong[bot]
  • [automated] chore: bump version to 0.22.1-beta.2608200223 (#3147)
• 0c57c30 Jacob O'Quinn
  • [STADXP-338] python: expose get_layer_list (#3143)
• 978c866 Jacob O'Quinn
  • [STADXP-337] node: expose get_layer_list (#3142)
• 53d0b6b statsig-kong[bot]
  • [automated] chore: bump version to 0.22.1-beta.2608150221 (#3138)
• 5c62915 statsig-kong[bot]
  • [automated] chore: bump version to 0.22.0-rc.1 (#3137)
• 52c8a14 statsig-kong[bot]
  • [automated] chore: bump version to 0.21.1-beta.2608130252 (#3129)
• 2623332 statsig-kong[bot]
  • [automated] chore: bump version to 0.21.1-rc.2608122242 (#3128)
• 5a09d1f statsig-kong[bot]
  • [automated] sync rc with main (#3127)

Full Changelog: 0.22.0...0.23.0

Breaking Changes

• N/A

New Features

• Node.js: N/A
• Java:
  • ParameterStore.getParameterList() — names of every parameter mapped inside a single Parameter Store, sorted alphabetically. Lets a store be the authoritative list of app-config / feature-flag IDs instead of hardcoding key names. Works for entries backed by gates, dynamic configs, experiments, layers, or static values, since the key set is read without evaluating any parameter. Unrecognized store returns an empty list, never null. Distinct from Statsig.getParameterStoreList(), which enumerates store names.
  • Also available as Statsig.getParameterNamesFromParameterStore(user, storeName).
  • Behavior note: logs no exposures, but does emit statsig::non_exposed_checks.
• Python: N/A
• Rust:
  • ParameterStore::get_parameter_names() / Statsig::get_parameter_names_from_store(user, store_name). Resolves via the user-aware path, so Parameter Store overrides are reflected in the key set.
• .NET: N/A
• Elixir:
  • Persistent assignment (previously absent): user_persisted_values, enforce_overrides, enforce_targeting on experiment/layer options; new Statsig.PersistentStorage behaviour.
• C++:
  • Persistent assignment (previously absent): enforceOverrides, enforceTargeting, userPersistedValues; new PersistentStorageBase.

Included In This Release

• cffbba251628d6206924d568a050a3290ff8b55f statsig-kong[bot]
  • chore: bump version to 0.21.1-rc.2608122241
• 696331e19792d6792676592fd40fd6f096ff7c70 Xin Li (Bot)
  • [automated] sync rc with main
• 20c2b1acc8d6fb5a13664d71d28687c094bf9d99 statsig-kong[bot]
  • [automated] chore: bump version to 0.21.0-rc.1 (#3126)
• fbfb47bae5616652ae396d2c7f45cd9d3c81ed5f cresten-stclair-amplitude
  • Remove legacy Statsig identity references (#3115)
• ef02884f10f0bc03d9caab06b1962e2d386499f9 devops-bot-amplitude
  • Migrate scheduled workflow actor to devops bot (#3121)
• 52ff7054744d220ec3d7272245c9f057085724e3 statsig-kong[bot]
  • [automated] chore: bump version to 0.20.3-beta.2608120251 (#3124)
• ab1b324071e9b81c3bb32662d5150d90363c3fa7 Jacob O'Quinn
  • feat(java): add ParameterStore.getParameterList() (#3113)
• c681c456e5ab8524e2a0dddd3f26f631d1c17438 Jacob O'Quinn
  • feat: enumerate parameter names within a Parameter Store (core + FFI) (#3110)
• 59500cbc968ea07acdacebc0f678e69ea1509eaa statsig-kong[bot]
  • [automated] chore: bump version to 0.20.3-beta.2608070259 (#3112)
• 7a6809f460a0ee1c29d39c397152805fa79eb802 Peter Zhu
  • [S2SDK-115] java: follow-up review nits from #3041 (#3085)
• 9726f968288db171ebc91079f4286b724fb62e99 Peter Zhu
  • [S2SDK-122] cpp: expose persistent assignment + enforceOverrides/enforceTargeting (#3048)
• 1182f684e861720229ae237dada6dfd19c77c8e6 Peter Zhu
  • [S2SDK-120] elixir: expose persistent assignment + enforce_overrides/enforce_targeting (#3046)
• 16a5dbf5710b2d748604002e04d58cf85d017969 statsig-kong[bot]
  • [automated] chore: bump version to 0.20.3-beta.2608060457 (#3109)
• 1d8bd380f0bcb9081e180faa77f6017390c3f931 cresten-stclair-amplitude
  • PLAT-1216: rename LRS bot PAT secret (#3107)
• 80cfd17d283c5382de2be2a2a067644a4d45f84c Jacob O'Quinn
  • ci: remove invalid --include=optional flag from rc bump pnpm update (#3108)
• 76052002305f8203ff28a68e2bb6e9e9b38b93f6 statsig-kong[bot]
  • [automated] chore: bump version to 0.20.3-rc.2608051828 (#3106)
• b0c1ddf6d73df54c51f65083d3c97cb84f6accac statsig-kong[bot]
  • [automated] sync rc with main (#3105)

Full Changelog: https://github.com/statsig-io/statsig-server-core/compare/0.21.0...0.22.0

Breaking Changes

• N/A

New Features

• .NET, PHP, Elixir, C++:   - Entity-list getters — getFeatureGateList(), getDynamicConfigList(), getExperimentList(), and getLayerList() (idiomatic casing per binding), mirroring the existing getAutotuneList(). Returns the names of all entities in the current config snapshot without running an evaluation or logging an exposure.
• C FFI:   - statsig_get_layer_list — layer was the only core list method without a C export, an asymmetry left by the original parity work (which scoped to the gate/config/experiment/autotune set). Wraps the already-present Statsig::get_layer_list().
• Node.js, Python, Go, .NET, PHP:   - enforceOverrides / enforceTargeting on the experiment and layer evaluation options (naming per binding: enforce_overrides / enforce_targeting). When a user has a persisted sticky value, a matching console override rule (enforceOverrides) or a failed targeting re-check (enforceTargeting) now takes precedence over the persisted value. Both default to false, so existing behavior is unchanged. Extends the Rust/Java support shipped in 0.20.1 to five more bindings. PHP required no source plumbing — its options already ride through to core as a JSON blob — so support there is now tested and documented rather than newly added.   - Note: these options are only honored when a persistent storage adapter is configured (pre-existing core behavior).
• .NET, C++:   - ObservabilityClient registration on StatsigOptions / StatsigOptionsBuilder, reaching parity with the Go and Node bindings. Implement init, increment, gauge, dist, error, and should_enable_high_cardinality_for_this_tag to route SDK metrics into your own telemetry pipeline. The Rust core and C FFI already supported this; these are the managed/C++ wrappers.

Improvements & Fixes

• All SDKs (rust core): the SDK now works behind TLS-inspecting corporate proxies (Zscaler, Netskope, Palo Alto), where initialization previously failed outright — every gate evaluated false and the only surfaced error was an opaque error sending request ... status(None). Four fixes, no API surface changes:   - OS trust roots honored — the HTTP client now trusts the OS trust store and SSL_CERT_FILE / SSL_CERT_DIR alongside the bundled webpki roots, so a corporate root CA installed in the container or OS works with zero SDK configuration.   - Multi-cert CA bundles — proxy_config.ca_cert_path previously failed the entire client build if any certificate in a standard system bundle was webpki-rejected, then silently fell back to a default client with neither the custom CA nor the proxy. A lenient parser now loads every usable certificate and skips bad entries with a counted warning, and the silent fallback is gone.   - Actionable TLS errors — request errors now surface the underlying cause (e.g. invalid peer certificate: UnknownIssuer) plus a remediation hint naming the OS trust store, SSL_CERT_FILE, and ca_cert_path.   - Config no longer bypassed — /v1/sdk_exception (always) and /v1/log_event (with connection reuse enabled) used a bare HTTP client that ignored proxy and CA configuration entirely. Clients are now cached per configuration; the log_event_connection_reuse=false contract is preserved via a cached no-keep-alive client.   - Behavior notes: a ca_cert_path yielding zero usable certificates now fails requests loudly instead of proceeding without it; network error strings are richer (anything string-matching on the old text will notice); spec-sync, ID-list, and sdk_exception requests now reuse pooled connections. REQUESTS_CA_BUNDLE remains unread — it is a Python-requests convention; use SSL_CERT_FILE.
• Java: StatsigUser construction is significantly cheaper.

Included In This Release

• f0916ffbca1c2c0d922f0c809eec05fd7831b78a statsig-kong[bot]
  • chore: bump version to 0.20.3-rc.2608051827
• eb596d5c7b7d0314dfdb3392bd9233ad58445528 Xin Li (Bot)
  • [automated] sync rc with main
• b83e8fd7d26ef3578b054fffdf38e1befb3cfa65 statsig-kong[bot]
  • [automated] chore: bump version to 0.20.3-beta.2608050456 (#3103)
• 642be57140d62cd997b4bc3fc2f2db029557993e Jacob O'Quinn
  • [S2SDK-90] cpp: expose entity list functions (incl. layer) (#3098)
• f830e5bea93ee2ccf00bcfc8d9a1555fb5d974ef Jacob O'Quinn
  • [S2SDK-89] PHP: expose entity list functions (#3093)
• 26352f1e41a461bb44632cac23a7176ab289516d Jacob O'Quinn
  • [S2SDK-91] Elixir: expose entity list functions (incl. layer) (#3096)
• b6cc81ed8af8eba72b61c1a14efb509ee46aa7f6 Jacob O'Quinn
  • [S2SDK-88] .NET: expose entity list functions (incl. layer) (#3095)
• d6fc0548971767a3cc910f4033454dc0e6f681d5 statsig-kong[bot]
  • [automated] chore: bump version to 0.20.3-beta.2608010300 (#3102)
• b49c3bd5f7bbfa7b638aed8203ab250f56de9283 Jacob O'Quinn
  • FFI: expose statsig_get_layer_list (#3094)
• 82e898c84e7eab2e3571995d8fc9c7f2f290297e Kenneth Yeh
  • [S2SDK-139] rust: support TLS-inspection environments (native roots, CA bundles, clear errors) (#3034)
• e1a50203e33d1953d0a00aac28c3f08a970dba59 statsig-kong[bot]
  • [automated] chore: bump version to 0.20.3-beta.2607310301 (#3101)
• b8201db338c88c95187ace6ba4e054521b1d2025 Peter Zhu
  • [S2SDK-110] cpp: expose ObservabilityClient on StatsigOptionsBuilder (#3050)
• 0a1c4a0b7e097c8fc42f498b7376d3f5d1566ca8 Kenneth Yeh
  • ci(java): publish to Maven Central via the Portal API (OSSRH bridge retired) (#3089)
• 8bb83f526d2297cbccbf0fd87bf92e62d5b2a363 statsig-kong[bot]
  • [automated] chore: bump version to 0.20.3-beta.2607300300 (#3097)
• db2060d0dab7c41cc4ff74e358554475f719bc80 Peter Zhu
  • [S2SDK-109] dotnet: expose ObservabilityClient on StatsigOptions (#3049)
• 75753a0a5fcb179ce9347b1762329c726a3f353e statsig-kong[bot]
  • [automated] chore: bump version to 0.20.3-beta.2607290300 (#3092)
• 1ed80f2cf0789b860d1d2e204b65816021bc6f7a Kenneth Yeh
  • ci(java): one-off recovery workflow to publish stranded 0.20.2 to Central (#3090)
• fa631ad330f0e8ce5297f2f96190f4b4e7727a70 statsig-kong[bot]
  • [automated] chore: bump version to 0.20.3-beta.2607250300 (#3091)
• 0942e067651e94c1746f56784f2580e5f6d3ca35 Peter Zhu
  • [S2SDK-121] php: test + document persistent-assignment enforce_overrides/enforce_targeting (#3047)
• da4c9254b29b85a431b15118d3c162ce3f5d0309 Peter Zhu
  • [S2SDK-117] python: expose enforce_overrides + enforce_targeting persistent-assignment options (#3043)
• 771bc8c345901312fd9c8e9dc53de5b2e0436a1a Peter Zhu
  • [S2SDK-119] dotnet: expose EnforceOverrides + EnforceTargeting persistent-assignment options (#3045)
• fd183ec2f7891a609b8b6d2cc8a9b401faafb188 statsig-kong[bot]
  • [automated] chore: bump version to 0.20.3-beta.2607240300 (#3088)
• 175a1fe76762b31ebdb29ff31ffadad2591fe873 statsig-kong[bot]
  • [automated] chore: bump version to 0.20.2-rc.1 (#3087)
• 0cd610553cd1c66270e592b393996bc4504e5207 statsig-kong[bot]
  • [automated] chore: bump version to 0.20.2-beta.2607230301 (#3084)
• e0001b8fdaf335126012a64d33decbf02949433b Peter Zhu
  • [S2SDK-118] go: expose EnforceOverrides + EnforceTargeting persistent-assignment options (#3044)
• 7acd3dfcde1d30830ea5e705bef8b6ad66a13628 Peter Zhu
  • [S2SDK-116] node: expose enforceOverrides + enforceTargeting persistent-assignment options (#3042)
• 44a959c44546e7ad8e5d603f7b718e0304398dd9 statsig-kong[bot]
  • [automated] chore: bump version to 0.20.2-beta.2607220301 (#3082)
• 8564e39b6e2089d90c6f0b28cd751cde094b3249 Sandeep Madugula
  • [S2SDK-165] java: replace JSON round trip in user construction with a binary payload (#3081)
• b15d7f14a6e1ef8db0afc967ce6ca45f1775aaec statsig-kong[bot]
  • [automated] chore: bump version to 0.20.2-rc.2607201629 (#3079)

Full Changelog: https://github.com/statsig-io/statsig-server-core/compare/0.20.2...0.21.0

Breaking Changes

• N/A

New Features

• All SDKs (rust core + Node.js, Python, Java, PHP, Go, .NET, Elixir, C++, and the C FFI):
  • get_experiment_groups(experiment_name) — returns the counterfactual view of an experiment: every group's configuration (group_name, rule_id, id_type, return_value) plus is_experiment_active, without running a user evaluation or logging an exposure. Lets callers log exposures only when variants would actually diverge (avoiding dilution). is_experiment_active is null for unknown names and non-experiment entities (dynamic config, autotune); groups are returned regardless of active state. Complements the get_experiment_by_group_name / get_experiment_by_group_id_advanced getters from 0.20.0. Community-contributed by @cam-matsui (Cameron Matsui, Whatnot) — statsig-io/statsig-server-core#54.
• Rust:
  • target_app_id on ClientInitResponseOptions — get_client_initialize_response (GCIR) can now be scoped to a target app independently of the client SDK key, enabling a single shared ("super") client key across all target apps. Resolution precedence: explicit target_app_id → key-derived app id → DCS global app_id; an empty string normalizes to unset. With neither a client key nor a target app id set, behavior is unchanged. Restores the legacy go-sdk/v2 GCIROptions{ClientKey, TargetAppID} capability.
• Go:
  • ClientInitResponseOptions.TargetAppID — exposes the key-independent GCIR target-app scoping in the Go binding, restoring parity with legacy go-sdk/v2.

Improvements & Fixes

• All SDKs (rust core): DCS delta-sync stall recovery. StatsigHttpSpecsAdapter now tracks consecutive background delta syncs that carry updates but make no LCUT progress and, past a threshold, forces one full (non-delta) resync — fixing the "sawtooth" config-staleness pattern where a wedged delta stream (server has newer data, client keeps failing to apply the delta) froze the in-memory snapshot indefinitely. A "no updates" response counts as progress, so an already-current config never triggers a needless resync.
• All SDKs (rust core): fixed iPadOS user-agent parsing. UAs such as ... iPadOS 26.5, iPad13,19 previously lost their OS version (surfaced as os_version = 0.0.0), breaking OS-version targeting; they now parse to os_name = iOS, os_version = 26.5, matching the equivalent iPhone UA.

Included In This Release

• e5738b2bfcc635c16b0f1300cc473d1b0941ad9b statsig-kong[bot]
  • chore: bump version to 0.20.2-rc.2607201627
• 5fc00f76575fe8ce4c7b053df9d2ac141c2f6495 Xin Li (Bot)
  • [automated] sync rc with main
• 41d7971cfe8cd5b59aa3ac519961e23eaec0902a statsig-kong[bot]
  • [automated] chore: bump version to 0.20.2-beta.2607180300 (#3077)
• fa1933d53f4751789f0f8170fed9a8583e7f7eeb Kenneth Yeh
  • feat: add get_experiment_groups() across all SDKs (#3062)
• 11c37d9ba107eb84b6df5ba48342aaaa42187d41 statsig-kong[bot]
  • [automated] chore: bump version to 0.20.2-beta.2607170300 (#3076)
• af560c89eb4ac882546f7776e31a7a00470bc4d2 statsig-kong[bot]
  • [automated] chore: bump version to 0.20.1-rc.1 (#3075)
• 3e51c05e12579f036bfe046f19c89f8bd10f8dd5 Sandeep Madugula
  • [S2SDK-132] core: force full DCS resync when delta syncs stall (#3032)
• 44929a6712ae552aa30056b9eac08f109ff7fa7c Kenneth Yeh
  • fix(go): SIGSEGV under concurrent evaluation — bump purego to v0.10.1 (#3065)
• 651b490755f071a7ec785b137d39ca191ab4c5ee statsig-kong[bot]
  • [automated] chore: bump version to 0.20.1-beta.2607150300 (#3064)
• 3137de66d049c5f41e2116472a61869b523a06c5 Kenneth Yeh
  • go: expose TargetAppID in GCIR ClientInitResponseOptions (#3063)
• 37afbb68cea0fe8c9d57821cfea00bbe61158e61 Kenneth Yeh
  • fix: recognize iPadOS user-agent strings in first-party UA parser (#3052)
• aeb71686c5e1706e20aa5a694bb31a7c69326828 Kenneth Yeh
  • feat: support key-independent target_app_id in GCIR ClientInitResponseOptions (#3059)
• 1c4d15244d3223a8a455e9e776226225562562aa statsig-kong[bot]
  • [automated] chore: bump version to 0.20.1-rc.2607140134 (#3061)
• 32d53c43c701bc085b218bf7cee650fef57eb603 statsig-kong[bot]
  • [automated] sync rc with main (#3060)

Full Changelog: https://github.com/statsig-io/statsig-server-core/compare/0.20.1...0.20.2

Breaking Changes

• N/A

New Features

• Rust:
  • enforce_overrides / enforce_targeting on ExperimentEvaluationOptions and LayerEvaluationOptions — when a user has a persisted sticky value, a matching console override rule (enforce_overrides) or a failed targeting re-check (enforce_targeting) now takes precedence over the persisted value, mirroring the legacy Java server SDK's sticky-evaluation behavior. Defaults unchanged (both off).
• Java:
  • GetExperimentOptions / GetLayerOptions gain enforceOverrides + enforceTargeting (new four-arg constructor; existing constructors unchanged, flags default to false).
• Node.js, Python, Java, .NET, PHP, Elixir, C++:
  • exposure_dedupe_max_keys StatsigOption — configurable cap (default 100_000) on the bounded LRU backing exposure dedupe. Previously only settable from Rust, Go, and the C FFI options JSON; now exposed in every binding.

Improvements & Fixes

• Go: fixed a process-fatal SIGSEGV under concurrent evaluation (double-free/return-value swap in purego's FFI frame pooling) — bumped ebitengine/purego to v0.10.1; also nil-guard core responses in GetFeatureGate/GetDynamicConfig/GetExperiment/GetLayer (statsig-io/statsig-server-core#53)
• All SDKs (rust core): evaluation hot path is now lock-free — refcount-free interning and a sharded eval-hash cache remove the remaining serialization points under concurrent load. In a reproduced high-concurrency workload (4-CPU pod, production-scale ruleset), throughput improved from 36k evals/sec with p99 = 100ms to 80k evals/sec with p99 = 200µs. Resolves the reported Java Core SDK performance issue and incorporates the community-contributed intern-store sharding fix from the Elixir SDK.

Included In This Release

• 8f97829a2230398e5e65c93b22928c680de4e1bc statsig-kong[bot]
  • chore: bump version to 0.20.1-rc.2607140133
• b20f2063b923457a15f811a4a77b1738b9486643 Xin Li (Bot)
  • [automated] sync rc with main
• ebe32f0760cddd980afd62242f32508724abe12e statsig-kong[bot]
  • [automated] chore: bump version to 0.20.1-rc.2607132133 (#3058)
• b822d505fe5803451118c8efdab9e46bd44b5f02 statsig-kong[bot]
  • chore: bump version to 0.20.1-rc.2607132132
• fa494e802dbf48c96afbab6aa1610af79a3d9621 statsig-kong[bot]
  • [automated] sync rc with main (#3057)
• b267db8d6f9ca0718f51531f60f8cf48061af410 Xin Li (Bot)
  • [automated] sync rc with main
• e636e62e2d3ae85ae4bfc85110609c495f35162a statsig-kong[bot]
  • [automated] chore: bump version to 0.20.0-rc.1 (#3056)
• 76f7efc750650f7160229aa1e1e114a2e982f37e statsig-kong[bot]
  • [automated] chore: bump version to 0.19.9-beta.2607110300 (#3054)
• 5232200585bc023527db212849bf9b0837ce462b Peter Zhu
  • [S2SDK-115] java: expose enforceOverrides + enforceTargeting persistent-assignment options (#3041)
• b26a7649a84131af2cfd955d03d3124f66785eaf Sandeep Madugula
  • [S2SDK-140] Make the eval hot path lock-free: refcount-free interning, sharded eval-hash cache (#3040)
• 52f6bcda664b0b2cfe70a585399cd8b22ff1e5f5 statsig-kong[bot]
  • [automated] chore: bump version to 0.19.9-beta.2607100302 (#3053)
• 4401edfb6329fd74f51e75efcdc8770e9227567a Peter Zhu
  • [S2SDK-114] rust-core: add enforceOverrides + enforceTargeting persistent-assignment options (#3030)
• ecd3da7ac4eb4d79e5a71123b275604fb810ce38 Peter Zhu
  • feat: expose exposure_dedupe_max_keys option in all SDK bindings (#3013)
• 5fd8b51b3c5ab0ccff62ca8a8abde55a85458286 statsig-kong[bot]
  • [automated] chore: bump version to 0.19.9-rc.2607090505 (#3039)
• 1f92bd76d234dbda8596a1b9f16e29df1ead4f59 statsig-kong[bot]
  • [automated] sync rc with main (#3038)

Full Changelog: https://github.com/statsig-io/statsig-server-core/compare/0.20.0...0.20.1

Breaking Changes

• N/A

New Features

• Node.js:
  • getAutotuneList() — enumerate autotune configs, matching the existing gate/config/experiment/parameter-store list methods.
  • getExperimentByGroupIdAdvanced() — completes the experiment group-targeting API set (getExperimentByGroupName / overrideExperimentByGroupName already
    existed).
• Java:
  • getAutotuneList() — enumerate autotune configs, matching the existing entity-list methods.
• Python:
  • get_autotune_list() — enumerate autotune configs.
  • get_experiment_by_group_name() and get_experiment_by_group_id_advanced() — experiment group-targeting getters.
• Rust:
  • New id_lists_request_timeout_ms StatsigOption — configurable per-request timeout for ID list manifest fetches and downloads (previously hardcoded to 10s;
    default unchanged when unset). Exposed in all SDK bindings.
• .NET:
  • GetAutotuneList() — enumerate autotune configs.
  • GetExperimentByGroupName() and GetExperimentByGroupIdAdvanced() — experiment group-targeting getters.
• Elixir:
  • get_autotune_list/0 — enumerate autotune configs.
  • get_experiment_by_group_name, get_experiment_by_group_id_advanced, and override_experiment_by_group_name — experiment group-targeting APIs.
• Go:
  • Entity-list methods: GetFeatureGateList, GetDynamicConfigList, GetExperimentList, GetAutotuneList, GetParameterStoreList.
  • Experiment group-targeting APIs: GetExperimentByGroupName, GetExperimentByGroupIDAdvanced, OverrideExperimentByGroupName.
  • WithObservabilityClient on StatsigOptionsBuilder — observability clients were previously silently dropped when configured.
• PHP:
  • getAutotuneList() — enumerate autotune configs.
  • getExperimentByGroupName() and getExperimentByGroupIdAdvanced() — experiment group-targeting getters.
• C++:
  • getAutotuneList() — enumerate autotune configs.
  • getExperimentByGroupName, getExperimentByGroupIdAdvanced, and overrideExperimentByGroupName — experiment group-targeting APIs.

Improvements & Fixes

• Node.js: N/A
• Java: N/A
• Python: N/A
• Rust: N/A
• .NET: N/A
• Elixir: N/A

Included In This Release

• 57f8cb2 statsig-kong[bot]
  • chore: bump version to 0.19.9-rc.2607090504
• 4bdd820 Xin Li (Bot)
  • [automated] sync rc with main
• a2f52f8 statsig-kong[bot]
  • [automated] chore: bump version to 0.19.9-beta.2607090302 (#3037)
• 6079d5d Peter Zhu
  • fix(php): warm allocator before baselining MemoryLeakTest RSS (#3016)
• 49dceae Peter Zhu
  • [S2SDK-124] python: add experiment group-targeting getters (#3026)
• 7be0809 Peter Zhu
  • [S2SDK-125] dotnet: add experiment group-targeting getters (#3029)
• fc57107 Peter Zhu
  • [S2SDK-126] php: add experiment group-targeting getters (#3024)
• a67dfd0 Peter Zhu
  • [S2SDK-128] elixir: expose experiment group-targeting APIs (#3027)
• 9919da7 Peter Zhu
  • [S2SDK-127] cpp: expose experiment group-targeting APIs (#3025)
• a14cda0 Peter Zhu
  • [S2SDK-108] go: expose WithObservabilityClient on StatsigOptionsBuilder (#3028)
• 50a1cfa statsig-kong[bot]
  • [automated] chore: bump version to 0.19.9-beta.2607080301 (#3035)
• 97fa17a Peter Zhu
  • [S2SDK-123] node: expose getExperimentByGroupIdAdvanced (#3023)
• 29734ee Peter Zhu
  • [S2SDK-82] php: expose getAutotuneList (#3011)
• d0137c0 Peter Zhu
  • [S2SDK-85] python: add get_autotune_list test (#3022)
• 95801b4 Peter Zhu
  • [S2SDK-84] node: add getAutotuneList test (#3021)
• 03cf5fe Peter Zhu
  • [S2SDK-81] dotnet: expose GetAutotuneList (#3012)
• 270de40 Peter Zhu
  • [S2SDK-45] Make ID list request timeout configurable (#3015)
• 993fd58 Peter Zhu
  • [S2SDK-83] cpp: expose getAutotuneList (#3010)
• a280ad3 statsig-kong[bot]
  • [automated] chore: bump version to 0.19.9-beta.2607020303 (#3031)
• e5b3266 Peter Zhu
  • [S2SDK-87] elixir: expose autotune list (#3009)
• e6d2b2f Peter Zhu
  • [S2SDK-86] java: expose getAutotuneList (#3008)
• 1bd2cf6 Peter Zhu
  • fix(ci): strip debug info from rust test build to stop linker Bus error (#3017)
• 1e53250 Peter Zhu
  • [S2SDK-85] python: expose get_autotune_list (#3007)
• 17bb201 Peter Zhu
  • [S2SDK-84] node: expose getAutotuneList (#3006)
• c1d8ade Peter Zhu
  • [S2SDK-77] core: add get_autotune_list test (binding-parity baseline) (#3005)
• 1e48297 Peter Zhu
  • [S2SDK-71] Go: expose gate/experiment/dynamic-config/autotune/parameter-store list methods (#3000)
• f44f8fb statsig-kong[bot]
  • [automated] chore: bump version to 0.19.9-rc.2607010924 (#3020)
• b3070ef statsig-kong[bot]
  • chore: bump version to 0.19.9-rc.2607010923
• b4c5713 statsig-kong[bot]
  • [automated] sync rc with main (#3019)
• eb8ae01 Xin Li (Bot)
  • [automated] sync rc with main

Full Changelog: 0.19.8...0.20.0

Breaking Changes

New Features

• Node.js:
• Java:
• Python:
• Rust:
• .NET:
• Elixir:

Improvements & Fixes

• Node.js:
• Java:
• Python:
• Rust:
• .NET:
• Elixir:
• Rolling forward version to fix publishing

Included In This Release

Full Changelog: https://github.com/statsig-io/statsig-server-core/compare/0.19.7...0.19.8

Breaking Changes

New Features

• Node.js:
• Java:
• Python:
• Rust:
• .NET:
• Elixir:

Improvements & Fixes

• Node.js:

• Java:

• Python:

• Rust:

• .NET:

• Elixir:

• Go: Add WithoutUserId() to StatsigUser builders to represent users with no userId value in go

• Cross Platform: fixed shutdown() to now flush pending events before completing

Included In This Release

• 34c9b3f5bf86b1ed082e041b7b4785de4f354b73 statsig-kong[bot]
  • chore: bump version to 0.19.6-rc.2606161623
• 7e4a7329077791dcd0c66f046b180001d15da70a Xin Li (Bot)
  • [automated] sync rc with main
• e63b32dd0b0809565bde686fb745dca96c8efdf4 Sandeep Madugula
  • S2SDK-12: Flush inflight events before shutdown (#2977)
• ca2ac1879dd15c76ba0a2bf68e510c329128c404 statsig-kong[bot]
  • [automated] chore: bump version to 0.19.6-rc.2606151903 (#2984)
• 1b855aec249bdec3436ccfef3f3c65d12c683560 Xin Li
  • fix scheduled rc release (#2958)
• bb08a93e4f4462ab39c3335586ead457049b24cc statsig-kong[bot]
  • chore: bump version to 0.19.6-rc.2606151902
• 880a1e91dadf15ad17e29237c5279cdd4d42561f statsig-kong[bot]
  • [automated] sync rc with main (#2983)
• b0f271d2eaf27720ad3e0c7ae5cf947c8323dc26 Xin Li (Bot)
  • [automated] sync rc with main
• 5aa0c469c77944e6c762e447deec3f8f08c2e3de statsig-kong[bot]
  • [automated] chore: bump version to 0.19.6-beta.2606100304 (#2980)
• 5cb65938f2ab96c75b8630efbd68efc4219e5b16 statsig-kong[bot]
  • [automated] chore: bump version to 0.19.5-rc.1 (#2979)
• 94c6194d74d31245d12be7ae9cda631b4f1b6f99 Kenneth Yeh
  • [Go-lang] add WithoutUserID to represent nil userID (#2976)
• 50ecd8e4d8a806a9a16f859c5467c72cac5de247 statsig-kong[bot]
  • [automated] chore: bump version to 0.19.5-beta.2606060303 (#2975)
• 8b274eb7053114f9aa78afaa85b875114992025e Kenneth Yeh
  • ci: fix rc bump minimum-release-age exclude to cover all node-core platform binaries (#2974)
• 8899938a2f9996440156fbd3f463753c9cb05c06 statsig-kong[bot]
  • [automated] chore: bump version to 0.19.5-rc.2606050349 (#2973)
• 519b6b6f15ba14168781ebc96bd34342262384f2 statsig-kong[bot]
  • [automated] sync rc with main (#2972)

Full Changelog: https://github.com/statsig-io/statsig-server-core/compare/0.19.5...0.19.6

Breaking Changes

New Features

• Node.js:
• Java:
• Python:
• Rust:
• .NET:
• Elixir:

Improvements & Fixes

• Node.js:
• Java:
• Python:
• Rust:
• .NET:
• Elixir:
• Go: bound exposure dedupe set with LRU to prevent unbounded memory growth

Included In This Release

• e340b205ecc8cd5a5a523336916f982123fa3303 statsig-kong[bot]
  • chore: bump version to 0.19.5-rc.2606050348
• 73149f681aa04865cb223d0ae08f4a5e0e922772 Xin Li (Bot)
  • [automated] sync rc with main
• 3784372d694db4f90ea7a5661d7dfe2519acba9b Kenneth Yeh
  • Revert "[release] 0.19.4-rc.2606032339" — restore RC version ordering (#2970)
• 35cb4d3c0d96f4cc0dc680cfd5d335c9057324cd statsig-kong[bot]
  • [automated] chore: bump version to 0.19.4-beta.2606050304 (#2971)
• d15ae18ca2de5ec601e3933e000e73070067b06c Kenneth Yeh
  • ci: restore nightly beta cron schedule (#2956)
• cfc79fb539c54adf769e8052d365627cbf0cc473 Kenneth Yeh
  • [release] 0.19.4-rc.2606032339 - (#2968)
• f96a778101f39a14767becfa7c3682e7e9cba61a Kenneth Yeh
  • ci: fix rc bump workflow (alias syntax + bypass minimumReleaseAge + Node 24) (#2960)
• 30c99dfd819bab96b1f784772046e15c4abe9546 Sandeep Madugula
  • S2SDK-1: [memory leak Fix] bound exposure dedupe set with LRU to prevent unbounded memory growth (#2966)
• 7cdedcd8a3c7d247f7022fd38b551b18701b7423 Kenneth Yeh
  • Revert "chore: configure workflow to support NPM Trusted Publishing" (#2967)
• 1214f9a022129d44a48599021cbded0cb1fd9105 statsig-kong[bot]
  • [automated] chore: bump version to 0.19.4-rc.1 (#2964)
• bfe96a610394818747a66f2b39235ab7947954ba Kenneth Yeh
  • fix: send User-Agent header in rust package verification crates.io request (#2962)
• 9144623407e319c29746e39426cc86cd3b5ccfff Daniel Graham
  • chore: configure workflow to support NPM Trusted Publishing (#2959)
• 12fcf11c6bd14bdbbbc43d40e47e55d79efd9aec Kenneth Yeh
  • ci: restore missing uses: refs in node_core_rc_bump workflow (#2957)
• 13a62a0b62f87c0a91856c1036d1b7c074d21997 statsig-kong[bot]
  • [automated] chore: bump version to 0.19.4-beta.2605212203 (#2955)
• 83154383d691e8f382c721830c01e4edd4be3a51 statsig-kong[bot]
  • [automated] chore: bump version to 0.19.4-rc.2605212136 (#2954)
• d4db8046b137f3648f0505640461bfc6cd7b8d77 statsig-kong[bot]
  • [automated] sync rc with main (#2953)

Full Changelog: https://github.com/statsig-io/statsig-server-core/compare/0.19.4...0.19.5