Well, believe it or not, we are in the final weeks of 2025! It's been a great year as we navigated crucial growth in the community and, of course, some challenges along the way. Most importantly, we have new experiences that continuously make us better.
As this is the last summary of the year, I'll keep it short, highlight some of the details that happened in November and December, and give a quick glimpse of what to expect next year.
AsyncAPI Conferences
Paris
Paris hosted the last conference of the year, which spanned three busy days. The biggest highlight of the conference was the API Standards booth, which we shared with friends from GraphQL, JSON Schema, and OpenAPI. It was a busy moment with attendees interested in our work, and many ever surprised by our focus on promoting Open Source.
On the third day, we had the AsyncAPI track, which included a variety of talks, with the ambassador panel as the highlight of the event.
AsyncAPI Ambassadors Panel
A huge thank you to our speakers, TSC members, and Ambassadors for volunteering at the booth, delivering presentations, and sharing their valuable insights.
Daniel Kocot
Florence Njeri
Fran Méndez
Dale Lane
Hugo Guerrero
Jonas Lagoni
Ludovic Dussart
Samir Amzani
Naresh Jain
Laurent BroudouxDeveloper Week 2026
Planning for the AsyncAPI Conference at DeveloperWeek 2026 is underway. Speakers are selected, and final confirmation emails have also been sent. The agenda is being finalized, and the conference tickets will be shared at the beginning of January.
AsyncAPI Conference 2026
We're exploring new venues or partners who would love to host us for 2026. If you or your company can host us, or know conference organizers who would be open to have an AsyncAPI track, please share your thoughts and insights in the AsyncAPI conference venues for 2026 discussion.
AsyncAPI NPM Packages Security Update
Several AsyncAPI NPM packages were compromised after an attacker injected a worm into specific versions. Charlie Eriksen first identified and reported the compromised packages, while Łukasz Górnicki led the efforts to deprecate affected versions and worked through challenges with the NPM review process.
Ashish Padhy supported the investigation into a GitHub Actions workflow vulnerability that likely enabled the credential theft, and Fran Méndez rotated all secrets to secure our ecosystem moving forward.
Thanks to their quick action, the issue was contained and resolved. We’re grateful to each of them for their fast, transparent, and collaborative response. You can also read about the full incident details update written by Ashish Padhy and Florence Njeri.
Spec x Tooling
Official MIME types
The AsyncAPI media types are now officially registered under iana.org:
This transition from informal conventions to a globally recognized standard improves interoperability and strengthens tooling capabilities. Detailed information on this registration can be found in the original specification issue.
Spec Triage Meetings
We started doing public meetings about the specification, where we triage backlog and discuss proposals. Keep an eye on the spec meeting issue if you're interested in joining.
As a result of the last meeting, we scheduled the next AsyncAPI v3.1 release for January 2026. At the moment, we know that ROS 2 binding is scheduled for this release.
Stay tuned. We will for sure organize the third meeting in January. Three meetings in three months means we are getting regular and might transform into an official working group.
Adding AND Logic In Security Section
We are seeking community input on the proposal to change the security field type under the Server Object
Specifically, we would like to understand use cases where there is a technical requirement for multiple authentication methods to be fulfilled simultaneously. Please share your experiences, especially if you can provide:
- Publicly known use cases involving simultaneous authentication.
- Example AsyncAPI documents where you have implemented workarounds to support this.
- Technical stories explaining why a single security requirement was insufficient for your needs.
Final Remarks
I want to thank the community for taking the time to read the AsyncAPI monthly summary and for the consistent support. It has been amazing to contribute to our shared efforts throughout the year.
As we head to the holiday season, I wish everyone and your family a joyful time and a great 2026 ahead.
I'll be back next year with another detailed summary, including key insights and numbers.
Until then, stay safe and happy holidays!