Infrastructure agent v2.0.1

Improvements and enhancements

• Breaking change: The safe_dir_check_enabled setting now defaults to true. When enabled, the agent rejects and recreates any directory it manages (such as the data directory and integration temporary directories) that isn't a real directory owned by the user or group running the agent. Directories that are writable by group or other users are also recreated, unless they are a distinct mount point. To change this behavior, set safe_dir_check_enabled in your configuration file or the NRIA_SAFE_DIR_CHECK_ENABLED environment variable. #2386
• Hardened the agent temporary folder. #2369
• Updated the New Relic Fluent Bit output plugin to v3.12.0. #2382
• Updated nri-docker to v2.9.1. #2389

Security updates

• Removed legacy Fluent Bit 1.9 and legacy out_newrelic.dll (Go 1.20.7) from the Windows installer, fixing CVE-2026-27143, CVE-2025-68121, CVE-2025-22871, and CVE-2024-24790. #2378
• Updated nri-flex to v1.18.17 (golang.org/x/net v0.62.0), fixing CVE-2026-78661 and CVE-2026-97045. #2384
• Updated nri-docker to v2.9.0 (github.com/cilium/ebpf v0.22.0), fixing CVE-2026-10722, a low-severity denial of service caused by integer overflow. #2385

Support statement:

A new version of the agent has been released. Follow standard procedures to update the Infrastructure agent.

We recommend updating to the latest agent version as soon as it's available. If you can't upgrade to the latest version, update your agents to a version no more than 90 days old. Read more about keeping agents up to date.

See the New Relic Infrastructure agent EOL policy for information about agent releases and support dates.