Apache NiFi 2.12.0 - SQS Visibility, Cluster TLS, and Deprecations

Apache NiFi 2.12.0 was published on 13 September 2026 under tag rel/nifi-2.12.0. It is a feature improvement and bug fix release with over 115 issues resolved, and the cluster item to test first is TLS endpoint identification, along with a new SQS visibility timeout processor and a deprecation of FlowFile package versions 1 and 2.

The full release notes and downloads are on the GitHub release page. Per issue text is in the Jira release notes for 2.12.0.

NIFI-16113 adds ChangeSQSMessageVisibilityTimeout. The processor changes the visibility timeout of an SQS message the flow already received, so a slow downstream step can keep the message hidden or return it to the queue sooner.

NIFI-16187 adds a FlowFile grouping strategy on ConsumeKafka. Grouping changes how many consumed records share one FlowFile, which changes batch size downstream. The release line does not name the strategy values or the property key.

Record changes are smaller. NIFI-16177 adds an epoch second timestamp form on the JSON record writer. NIFI-16161 lets ValidateJson check a JSON schema before that schema is used. NIFI-15758 adds fragment attributes to the FlowFile format inside UnpackContent. NIFI-16175 only documents ValidateRecord for input with zero records. NIFI-16213 null checks MapRecord so a missing value does not throw a null pointer exception.

PropertyEncryptionProvider is a new framework extension with a standard implementation. No property keys, config file, or migration command are listed.

NIFI-16184 adds TLS endpoint identification for cluster communication. That check compares the peer certificate to the name used to open the connection. The notes do not say whether the check is on by default, or which property turns it off. Run two nodes in staging and confirm the cluster link before the rest of the roll.

NIFI-16207 switches CaptureChangeMySQL to SSLContextProvider. NIFI-16212 switches the MQTT processors the same way. Flows that still point them at another service need an edit. Renamed property names are not listed.

NIFI-16137 lets JWTBearerOAuth2AccessTokenProvider accept a client assertion supplied outside NiFi, for token setups that already sign the assertion elsewhere. NIFI-16170 improves Content-Encoding handling on the REST API. NIFI-16205 tightens authorization for objects a connector references. NIFI-16156 adds a GET for a connector scoped controller service. NIFI-16169 fixes multiple UI dependency security issues.

Several graph and queue fixes are in this tag. NIFI-14944 fixes upgrade when a controller service reference moves from an external service to a scoped service. NIFI-16228 applies auto termination during a versioned flow update for a relationship that was already connected. NIFI-16082 allows a connection update while the current destination is running. NIFI-16182 corrects revision equality in WaitNotifyProtocol. NIFI-16215 includes current transaction enqueues in connection status events, so reported queue depth counts FlowFiles still inside the open transaction.

NIFI-14737 adds a flow analysis rule that requires load balanced connections from a source processor. The rule reports violations. The notes do not say it rewrites existing connections.

NIFI-15683 fixes the SFTP Move strategy when the destination file already exists. NIFI-16225 fixes SFTP DNS resolution through a SOCKS proxy. NIFI-16210 adjusts the time zone validator on GetSplunk. NIFI-15280 removes DisabledOnJre from processors in nifi-hadoop-bundle that were disabled for Java 25, so those processors can load on that runtime again.

Shaded custom NARs should track the library pins named in this tag. Later entries set HTTP Client5 to 5.6.4, Groovy to 5.1.0, and Logback to 1.6.3, after earlier bumps to HTTPClient5 5.6.3, Groovy 5.0.8, and Logback 1.6.2. The same notes also pin JSoup 1.23.1, Netty 4.2.17.Final, Jetty 12.1.12, httpcore5 5.4.3, LZ4 1.11.2, MongoDB 5.9.2, Parquet 1.18.0, Lucene 10.5.1, OkHTTP 5.5.0, Jackson 2.22.2, Snowflake JDBC 4.3.3, Reactor 3.8.7, and Avro 1.12.2.

Reproducible builds are packaging only. NIFI-16208 sorts manifest extension files. NIFI-16209 sets a deterministic build timestamp. NIFI-16211 does the same for the Registry web UI. Artifact bytes stabilize. Flow execution does not change.

Most remaining pulls are internal. Unused types such as ControllerServiceNotValidException and the Unpackage utility go away. NIFI-16181 makes MockProcessSession#commitAsync null safe, and NIFI-16183 adds active polling stopConnector(Duration) on the connector mock. Flaky tests, including PutCouchbaseIT and ClusteredProviderParamFlowSyncIT, are repaired. None of that changes a running dataflow.

This tag deprecates APIs for a later removal. Deprecated callers still compile, except for two StreamUtils methods that were deleted because they were unused.

NIFI-16186 deprecates FlowFile package versions 1 and 2. Readers and writers of those formats need a retirement plan. The surviving package version is not named, and neither is the release that will drop the old ones.

Fine grained process group and component authorization is deprecated for removal. AbstractPolicyBasedAuthorizer is on the same path. A custom authorizer that subclasses it will stop compiling when the class is deleted. PutUDP is deprecated for removal. No replacement processor is named.

NIFI-16162 deprecates a StreamUtils copy method in favor of InputStream.transferTo. NIFI-16189 deprecates StreamUtils#read. Both remain on this tag. NIFI-16199 removes copyInclusive and copyExclusive. Callers of that pair will not compile against 2.12.0.

NIFI-16157 adds milliseconds to formatDurationToWords. The method stays compatible. The formatted text grows when a duration includes milliseconds.