RabbitMQ v4.3.5

RabbitMQ 4.3.5 is a maintenance release in the 4.3.x release series.

It is strongly recommended that you read 4.3.0 release notes in detail if upgrading from a version prior to 4.3.0.

Minimum Supported Erlang Version

The minimum supported Erlang version for this release series is 27.0.

RabbitMQ and Erlang/OTP Compatibility Matrix has more details on Erlang version requirements for RabbitMQ.

Nodes will fail to start on older Erlang releases.

Changes Worth Mentioning

Release notes can be found on GitHub at rabbitmq-server/release-notes.

Core Server

Bug Fixes

• With direct reply-to, a message routed to multiple targets that resolved to the same process could be delivered to it more than once.

  GitHub issue: #17071

• Quorum queue recovery from a recovery checkpoint could leave a part of the queue's internal state only partially initialized.

  GitHub issue: #17012

• In clusters that run a mix of 4.2.x and 4.3.x nodes during a rolling upgrade, local quorum queue queries now fall back to the previous state machine version instead of failing.

  GitHub issue: #17128

• A malformed AMQP 1.0 frame now results in a framing error returned to the client instead of an exception.

  GitHub issue: #17101

• The AMQP 1.0 message parser now validates message sections more strictly and decodes certain types of arrays more efficiently.

  GitHub issue: #17049

• Topic exchanges now limit the number of multi-segment (#) wildcards a binding key can use to two. The # wildcard is meant to be used as the final segment, that is, just once.

  GitHub issue: #17039

• When connection credentials are refreshed (for example, when an OAuth 2 token is renewed), the user's tags are now updated instead of being carried over from the original state.

  GitHub issue: #17029

• Definition import from an HTTPS endpoint no longer fails when a password-protected TLS (HTTPS) client certificate is used.

  Contributed by @Pyolar.

  GitHub issue: #16973

• The AMQP 1.0 Erlang client no longer logs an exception when a link is already detached. Workloads that use short lived links could produce a substantial amount of log noise.

  GitHub issue: #17124

Enhancements

• Authentication events are now logged under a new logging category, user. Successful logins are logged at the info level, failed login attempts at the warning level.

  GitHub issue: #16907

CLI Tools

Enhancements

• rabbitmqctl hash_password now supports more password hashing functions.

  GitHub issues: #14215, #17108

Stream Plugin

Bug Fixes

• A stream protocol connection can have at most 256 publishers and 256 subscriptions, a limit that comes from the protocol's wire format. Attempts to go over these limits are now rejected early with a clear error instead of failing later with an unrelated one.

  GitHub issue: #17123

Enhancements

• Before a stream client connection completes authentication and authorization (that is, before a successful open), the server now enforces a low frame_max ceiling instead of the full configured value. The default, 8192 bytes, is high enough to accommodate realistic JWT tokens used with SASL PLAIN authentication, and mirrors a mechanism already in place for AMQP 0-9-1 connections. It can be adjusted with the new stream.initial_frame_max setting.

  GitHub issue: #17053

• New setting: stream.max_uncompressed_sub_entry_batch_size. It bounds the declared uncompressed size of a published sub-entry batch, and defaults to 67108864 (64 MiB), the same default already used by the Java client's maxUncompressedSubEntryBatchSize. The broker and any client publishing to it should be configured with the same value.

  GitHub issue: #17103

Management Plugin

Bug Fixes

• HTTP API endpoints that accept a node name, including the federation and tracing related ones, now validate that the target node is a cluster member.

  GitHub issues: #17106, #17118

• The management UI no longer displays certain alert messages twice.

  GitHub issue: #17127

Enhancements

• When management.credential_encryption_secret is configured, the management UI login endpoint (POST /api/login) returns client credentials encrypted using AES-256-GCM with a key derived from the configured secret, and returns the ciphertext as an opaque token prefixed with rmqe.. The browser stores this token and presents it on all subsequent requests using the Authorization: Bearer rmqe.<token> header.

  The secret MUST be identical on every node in the cluster.

  Important: during a rolling cluster upgrade, enable this feature only after all nodes have been upgraded. This is particularly important for clusters behind a load balancer: nodes that run older versions will not recognize the encrypted tokens and will reject the requests, unexpectedly logging users out.

  GitHub issue: #16705

• GET /api/definitions now supports conditional requests (ETag).

  The ETag value is derived from the metadata store Raft index, so the tag will naturally change as the metadata store serves writes.

  GitHub issues: #16724, #17121

• The Referrer-Policy HTTP response header can now be configured with the management.headers.referrer_policy setting.

  GitHub issue: #16893

• When management.http.hide_allow_header is set to true, the Allow HTTP response header is omitted from all responses except 405 Method Not Allowed ones, where it is required by the HTTP specification. This avoids disclosing the supported HTTP methods to clients.

  GitHub issue: #16893

• When management.definitions.require_json_extension is set to true, both the management UI and the HTTP API will reject definition upload where the file does not have a .json extension. The setting defaults to false. Regardless of this setting, the server always validates that the uploaded content is valid JSON before importing it.

  GitHub issue: #16946

OAuth 2 AuthN and AuthZ Backend Plugin

Bug Fixes

• When RabbitMQ is behind a proxy that terminates TLS, the OAuth 2 login flow now honors the X-Forwarded-Proto, X-Forwarded-Host and X-Forwarded-Port headers when rewriting the token endpoint URL in the OpenID discovery payload.

  GitHub issue: #17153

Shovel Plugin

Bug Fixes

• Reduced log noise.

  GitHub issue: #17028

• Static shovels that do not define any declarations failed to start.

  GitHub issues: #17063, #17067

• When a topology setup failure stops a shovel worker, the specific reason is now reported instead of a generic one.

  GitHub issue: #17135

• The Shovel HTTP API now processes shovel URIs the same way the federation plugin processes its upstream URIs.

  GitHub issue: #17134

Enhancements

• Shovel TTL: dynamic shovels support a new setting, src-delete-after-duration, that instructs the shovel to self-delete after at least the specified duration.

  Contributed by @michalovits.

  GitHub issues: #17055, #17064

Federation Plugin

Bug Fixes

• A malformed upstream URI could prevent a federation link from starting even when other, well-formed URIs were available. All candidate URIs are now tried.

  Contributed by @sauravonwww.

  GitHub issue: #17046

MQTT Plugin

Bug Fixes

• Packets split across many network fragments are now parsed more efficiently.

  GitHub issue: #17093

• MQTT 5.0 properties are now parsed strictly: a property that is not valid for a given packet type is rejected.

  GitHub issue: #17039

• A Receive Maximum value of 0, prohibited by the MQTT 5.0 specification, is now rejected.

  GitHub issue: #17035

STOMP Plugin

Bug Fixes

• Frame size limits are now enforced earlier in the connection lifecycle.

  GitHub issue: #17116

Web STOMP Plugin

Bug Fixes

• The accumulated frame size is now checked against max_frame_size after a connection has authenticated, matching the behavior of "regular" STOMP connections.

  GitHub issue: #17065

Consistent Hash Exchange Plugin

Bug Fixes

• An edge case in bucket selection is now handled gracefully.

  GitHub issue: #17081

Dependency Changes

• cowboy was upgraded to 2.18.0
• cowlib was upgraded to 2.19.0
• gun was upgraded to 2.5.0
• ra was upgraded to 3.1.10
• ranch was upgraded to 2.2.1