Update emqx/emqx Docker tag to v6.2.3

[renovate]

This PR contains the following updates:

Package	Update	Change
emqx/emqx (source)	patch	6.2.2 → 6.2.3

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

emqx/emqx (emqx/emqx)

v6.2.3: EMQX Enterprise 6.2.3

Compare Source

6.2.3

Enhancements

Access Control

• #​17813 The Dashboard user and API-key endpoints now reject scope lists that mix privilege scopes (system, user_management, api_key_management, sso_management) with other scopes. Each of the four privilege scopes is administrator-equivalent in effect, so combining them with a restricted scope list cannot meaningfully restrict the account. Use either a privilege-only scope list or a non-privilege-only scope list, depending on whether the account should have administrator-equivalent capability. Pre-existing records with a mixed scope set continue to function until the next update; the next update must split the list to succeed.

• #​17980 In the hardened security profile, respect topic validation, authorization, MQTT capability checks, and client subscribe hooks for internal subscriptions.

• #​18002 Enabled SAML response and assertion signature verification by default in the hardened security profile.

• #​18296 Added a new is_jwt(value) function usable in authenticator precondition expressions (and anywhere variform expressions are accepted). It returns true only when the value is structurally a JWT (JWS compact form), without verifying the signature. This lets a JWT authenticator be skipped cleanly for clients that present a non-JWT password — useful for chains serving both JWT and legacy credential clients, especially under the hardened security profile where a non-JWT credential would otherwise be rejected by the JWT authenticator.

Multi-tenancy

• #​17732 Added a namespace field to the API key creation and update endpoints, so operators no longer need to encode the namespace inside the role string (the existing ns:<namespace>::<role> form keeps working). When both forms are supplied they must agree.

• #​17855 Namespace-scoped dashboard administrators can now create, list, read, update, and delete API keys within their own namespace. They cannot create global API keys or keys in another namespace, and API keys outside their namespace are hidden from them.

Data Integration

• #​17933 RabbitMQ connector supports a multi-node servers list (e.g. rmq1:5672,rmq2:5672) with connect-time failover and rotated pool start offsets. Legacy server/port remain when servers is unset.

• #​17944 Added OAuth2 Client Credentials authentication to the HTTP connector and HTTP authentication/authorization. When enabled, EMQX obtains and refreshes an access token from the configured token endpoint and adds it to outbound requests as a Bearer authorization header.

  The connector health check reports disconnected when a token cannot be obtained. Configurations that enable OAuth2 and also provide an Authorization header are rejected.

  EMQX sends the client ID and client secret as form fields in the token request body. Sending the credentials in the HTTP Basic Authorization header is not supported.

• #​18014 Datalayers Arrow Flight connector now enables automatic rebuild of prepared statements.
  When the server loses a prepared statement (e.g., after restart), the client will automatically recreate it and retry the write operation, avoiding write failures.

• #​18042 Added AWS IAM role credential support to DynamoDB connectors.

  When both the access key ID and secret access key are omitted, EMQX obtains temporary credentials from an ECS task role or EC2 instance metadata and refreshes them before they expire.

• #​18081 Improved resiliency of Snowflake Streaming Action. Under certain error types when appending rows (specifically, when the channel internal states becomes out of sync), the Action will retry the rows that failed and attempt to re-open the channel without manual intervention.

• #​18085 Added new configuration options for the Kafka, Confluent, and Azure Event Hubs producers:

  • max_batch_age (action): drop messages that stay in the producer buffer longer than this duration instead of sending them; counted in the dropped.expired metric. Default: infinity (never drop).
  • max_retries (action): drop a message batch after this many failed retries; counted in the failed metric. The retry counter is incremented only when Kafka explicitly responds with an error code; resends after a connection loss do not increment it. Default: infinity (retry forever).
  • reconnect_delay (action): delay before the producer reconnects after a connection loss. Default: 2s (previously hard-coded).
  • request_timeout (connector): how long to wait for a reply from Kafka before the connection is considered stale and gets re-established. Default: 30s.

  Additionally, the Kafka client library upgrade (wolff 4.2.1) restores max_linger_time support for memory-mode buffers: an under-sized batch now waits up to max_linger_time for more messages, reducing the produce request rate; full batches are sent without delay.

• #​18110 Added support for JSON Schema drafts 2019-09 and 2020-12 in Schema Registry.

• #​18137 The GCP Pub/Sub producer and consumer now accept a fully-qualified topic path (projects/<project-id>/topics/<topic-name>) in the topic configuration, making it possible to publish to or consume from a topic that lives in a different GCP project than the service account's own. A bare topic name keeps resolving against the service account's project as before. For consumers, the subscription is still created in the service account's project; only the topic reference may point to another project.

Rule Engine

• #​18253 Added two Rule-Engine SQL functions: map_to_range(value, min, max) and hash_to_range(value, min, max). They map a value (or its hash) into an inclusive integer range, which is useful for sharding or bucketing — for example, distributing a large device fleet across several rules by deriving a shard index from a topic segment: hash_to_range(nth(2, tokens(topic, '/')), 0, 3).

• #​18306 Added the lz4_compress and lz4_uncompress rule functions for LZ4 Frame compression and decompression.

Plugins

• #​18012 Added the emqx_sync_request plugin for synchronous MQTT request/response flows through the EMQX REST API. It also provides node-local CLI diagnostics for request counters and current pending state.

• #​18353 Added a new plugin emqx_maptabs providing named mapping tables for rule SQL.

  Tables are seeded from JSON files and held in memory for fast lookups from the
  rule engine hot path. The new maptab_lookup(Table, Key), maptab_lookup(Table, Key, Field), and maptab_lookup(Table, Key, Field, Default) rule SQL functions
  turn long CASE ... WHEN ... THEN ladders into a single table lookup; the
  looked-up fields can drive the builtin subbits function directly to decode
  binary payloads.

  Tables are managed with the emqx ctl maptabs CLI: loading or deleting a table
  on one node replicates the change to every node in the cluster, and a node that
  was down during an update catches up automatically when it rejoins.

  The plugin configuration provides safety limits: max_tables (default 100),
  max_rows_per_table (default 10000), and max_table_file_bytes (default
  1000000).

Packaging

• #​18037 Added Enterprise Linux 10 (EL10) packages, for Red Hat Enterprise Linux 10, Rocky Linux 10, and compatible distributions.

• #​18127 Start releasing macOS 26 (Tahoe) packages.

Performance

• #​18185 Improved deep-page queries in the subscriptions HTTP API by accumulating in-memory subscription rows on each target node, avoiding one RPC per pagination batch.

• #​18229 Reduced CPU overhead on the data-integration send path. The broker no longer builds a formatted error string for every message routed through a resource that is not an action or source (for example, cluster-link message forwarding), which could previously trigger long-scheduler warnings under high message volume.

Bug Fixes

Core MQTT Functionalities

• #​17895 #​18062 Switching a TLS/WSS listener from a managed certificate bundle back to file-based certificates now succeeds even if the referenced bundle has already been removed, including when the request clears managed_certs by sending it as null (as the Dashboard does).

• #​17911 Allow DTLS listeners to validate the ECDHE-PSK-CHACHA20-POLY1305 cipher suite when the runtime OTP ssl application supports it.

• #​18102 Fixed an issue where MQTT clients could receive QoS 1 and QoS 2 messages out of order when a delivery rate limit was active. EMQX now keeps later messages queued until the blocked message can be sent.

  Affected versions: 6.1.2, 6.1.3, and 6.2.0 to 6.2.2. Only sessions with a delivery rate limit configured (delivery_messages_rate or delivery_bytes_rate) are affected; no delivery rate limit is configured by default.

• #​18108 Deleting a managed certificate bundle (or a single file in it) that is still referenced by some configuration now always fails with a clear error listing the referencing configurations; the force_delete query parameter no longer bypasses this check and has been removed from the API schema.

  Additionally, the Prometheus stats endpoint no longer fails entirely when a listener references a certificate bundle that is missing from disk; the affected listener is skipped in the certificate expiry metric and a warning is logged.

• #​18111 When mqtt.strict_mode is enabled, MQTT v3.1 CONNECT packets that set the password flag without the username flag are now rejected, matching the existing behavior for MQTT v3.1.1. The MQTT v3.1 specification states that it is not valid to supply a password without a user name.

  Additionally improved connection log readability: the CONNECT packet trace now prints Password=undefined when no password was supplied (previously indistinguishable from an empty password), and the peername field in logs is now always rendered as a plain string such as 10.0.0.1:54123.

• #​18181 Fixed an issue where rate limiters configured with a burst value of 0 could still allow an extra burst of traffic. This made limits such as MQTT delivery message rate limits less strict than configured.

• #​18236 Fixed an issue where clients using socket-backed TCP listeners could be unexpectedly disconnected under high load, due to occasional readiness signals arriving for not-yet-ready sockets.

  [error] crasher: initial call: emqx_socket_connection:init/4, ..., error: {{case_clause,{select,{select_info,recv,#Ref<...>}}},[{emqx_socket_connection,handle_msg,2,[{file,"emqx_socket_connection.erl"},{line,827}]}, ...
  

• #​18293 Upgrade QUIC stack to quicer-0.4.8 (msquic 2.5.7).

• #​18357 #​18375 MQTT connections are now refused until node startup completes, so listeners no longer serve traffic before authentication, authorization, and plugin hooks are active.

  The GET /status API now returns HTTP 503 until startup completes, so load balancers can route new connections to other nodes in the cluster.

  A cluster join request toward a node that has not finished starting is now refused with a message that asks to retry later.

Durable Storage

• #​18143 Fixed an issue where durable shared subscriptions could fail to communicate with the shared-subscription leader when subscribers were connected to a different node. This could cause an unexplained spike in CPU usage.

Rule Engine

• #​17957 Fixed an issue where multiple rule events (for example, $events/client/connack) would not trigger rules in the global namespace when rule_engine.limit_selects_in_namespace = true.

• #​18049 Fixed an issue where setting rule_engine.limit_selects_in_namespace = true would prevent alarm activated/deactivated-triggered global rules from firing.

• #​18388 Fixed the Rule Engine republish action for rules that belong to a namespace. When rule_engine.limit_selects_in_namespace is enabled (the default), the republished message is now published under the rule's namespace (<namespace>/<topic>), matching the namespace confinement already applied to the rule's SELECT side. A rendered topic that already starts with <namespace>/ is published unchanged, so republish templates that add the prefix themselves keep working. Previously the message was published to the rendered topic without the namespace prefix. Setting rule_engine.limit_selects_in_namespace = false keeps the previous behavior.

Data Integration

• #​17859 Fixed the MQTT connector so it can connect to IPv6 brokers.

  Previously, configuring an MQTT connector to an IPv6 broker failed in two ways: an IPv6 literal such as [::1]:1883 was rejected at save time with a bad_host_port validation error, and a hostname that only resolves to an IPv6 (AAAA) address failed to connect with a "Could not resolve host" error because the connection defaulted to IPv4.

  The server address parser now accepts bracketed IPv6 literals (for example [::1], [::1]:1883, and mqtt://[::1]:1883), and the MQTT connector now enables IPv6 probing when connecting, so IPv6-only brokers can be reached.

  The MQTT connector and cluster link server address now accept the official MQTT URI schemes mqtt (plain TCP) and mqtts (TLS), for example mqtt://broker:1883 and mqtts://broker:8883. A scheme-less host:port is still accepted. Any other scheme is now rejected with an unsupported_scheme validation error.

• #​17947 Fixed an issue where updating an HTTP connector could leave its action buffer workers blocked after the connector was recreated, causing messages to remain queued until the next retry interval.

• #​17955 Fix GreptimeDB async batches that could remain unflushed after health checks at low write rates.

• #​17961 Fixed an issue where a Kafka or Pulsar Connector would transition to a disconnected state on health check timeouts, potentially recreating its internal queue. Now, they transition to connecting.

• #​17970 When SSRF protection is enabled, managing connectors is no longer disrupted by an existing connector whose address is now blocked by the policy.

  Previously, enabling SSRF protection (or extending its deny list) after connectors were created could make unrelated connector operations fail with an internal error, and deleting an affected connector could leave it behind after its actions and rules were already removed.

  SSRF protection now applies to HTTP and MQTT connectors and is enforced when a connector is created or updated: creating or updating such a connector with a blocked address is rejected. Enabling, disabling and deleting connectors are never blocked, and other connector types are not subject to the policy.

• #​17973 Fixed Kafka producer action retry metrics. The retried, retried.success, and retried.failed counters on an action's metrics now reflect messages that the internal buffer re-sends after a broker reconnect, so an operator can tell whether retried messages ultimately succeeded or failed. Previously these counters stayed at 0 regardless of how many internal retries occurred. The success and failed counters are unaffected and are not double-counted.

• #​17982 GCP PubSub Consumer now uses HTTP2 and cancels its pull request when it reaches the timeout. This signals more cleanly to the GCP server that it may lease the messages to a new pull request, reducing tail latencies.

• #​18055 Fixed an issue where Snowflake Streaming Actions on different nodes in a cluster would start to fail with the following error:

  {unrecoverable_error,#{body => <<"{\"code\":\"STALE_CONTINUATION_TOKEN_SEQUENCER\",\"message\":\"Channel sequencer in the continuation token is stale. Please reopen the channel\"}">>,...
  

• #​18110 Fixed an issue where using the examples annotation in a draft-06 JSON Schema in Schema Registry would result in valid data being rejected as invalid.

• #​18174 The MQTT connector now reports a clear error message when the server address scheme is inconsistent with the SSL settings, for example an mqtts:// (TLS) address while SSL is disabled.

  Previously, such a configuration failed with an internal error and a noisy log, because the connector attempted a plain TCP connection to a TLS port and could not interpret the server's reply. Connection attempts that receive non-MQTT data from the server (for example, when the port expects TLS) now also produce a clear explanation instead of an internal error.

• #​18193 Fixed an issue where a running GCP Pub/Sub Consumer source could show as disconnected (with reason timeout) after "Test Connection" was used on a GCP Pub/Sub Consumer connector or source, and would stay that way until manually disabled and re-enabled.

  Affected versions: 6.1.3 and 6.2.2.

  The temporary worker pool created for the connection test shared its health-status bookkeeping with the pools of running sources, so cleaning up the test pool also discarded the running source's health status. Each pool now keeps its own bookkeeping, and testing a connection no longer affects running sources. A hot-upgrade hook is included so consumers started by older versions are restarted to pick up the new bookkeeping.

• #​18198 Fixed two JSON Schema Registry issues:

  • Schemas containing non-ASCII characters (for example Chinese property names or example values) can now be registered through the HTTP API. Previously, registration failed with an internal badarg error.
  • $ref references pointing at definition names containing non-ASCII characters now resolve correctly during validation and decoding, both in percent-encoded form (for example #/definitions/%E5%A7%93%E5%90%8D%E7%B1%BB%E5%9E%8B) and in raw UTF-8 form. Previously, such references failed to resolve, and decoding failed with an internal badmatch error.

  In addition, a payload that does not conform to its JSON schema now produces a clear schema validation error during Rule Engine decoding instead of an internal error.

• #​18242 Fix Datalayers connectors failing with function_clause when database or credentials are left blank. A clear configuration error is reported instead.

• #​18270 Fix GreptimeDB connectors that could fail to restart when a stale gRPC channel remained after a worker was force-stopped.

• #​18274 Fixed the Tablestore connector health check listing all timeseries tables on every check. Health checks now use a DescribeTimeseriesTable probe against the configured probe_table_name, falling back to listing all timeseries tables when it is unset.

• #​18299 Fixed an issue where the Snowflake connector's configured TLS (ssl) settings were not applied to its outbound HTTPS connections (both Streaming and Aggregated modes). Settings such as verify, cacertfile, client certificates, and server_name_indication were accepted and displayed but had no effect on the actual connections. The configured values are now honoured. Connectors that never customized the ssl settings keep the previous connection behavior.

• #​18302 Elasticsearch action index and id values are now URL-encoded when composing the request path, so characters such as # or / in a templated value are treated as literal text within a single path segment instead of altering the request target. The JSON request body is not affected.

• #​18303 Sparkplug B alias-to-name mappings are now maintained only for messages published directly by MQTT clients. Messages arriving through bridges or other internal paths no longer share alias mappings, which prevents one publisher's mapping from being applied to another publisher's decoded metrics. As a consequence, spb_decode no longer resolves aliases to metric names for data messages ingested through an MQTT bridge.

Clustering

• #​17995 Fixed an issue that could terminate a node while it joined a cluster whose persisted mqtt.max_packet_size differed from its local configuration. EMQX now skips listener refresh side effects before listener startup and creates the listeners from the synchronized configuration when the EMQX application starts.

• #​17999 Fixed a startup crash-loop that could occur when a node using the community (single-node) license joins a cluster whose peers hold a clustering-capable license.

  Previously, if cluster membership was established before the peer's license was replicated to the joining node, the node would refuse to start with a SINGLE_NODE_LICENSE error and, under an automatic-restart supervisor, keep crash-looping. The node now waits a bounded grace period for the clustering license to sync before it starts. A cluster in which no node ever obtains a clustering license is still rejected after the grace period elapses.

• #​18077 Fixed a crash when a node received a cluster join request (CLI or API) before it had fully booted: joining restarts the internal database while applications are still starting, which could bring the whole node down. Such requests are now rejected with a clear error message; retry after the node is fully started.

• #​18277 Improved reliability of persisting configuration changes to cluster.hocon: the update is now written and synced to disk before atomically replacing the file, and a failure to read the previous file for backup no longer prevents the new configuration from being saved.

• #​18287 Improved REST API resilience when a cluster node becomes unreachable or fails while serving a request. A number of endpoints previously returned an opaque 500 error (or, in a few cases, reported success while part of the work had failed) when an RPC to a peer node did not complete; they now return a descriptive error response, and cluster-wide reads degrade gracefully to the results from the reachable nodes.

  Affected areas include: listing and describing plugins, listing clients (v2), streaming and downloading trace logs, reading configuration in HOCON format from a specific node, deleting a delayed message on a specific node, resetting topic metrics, importing a data backup, per-node action/source operations, rule listing, file-transfer downloads, and deleting message queues. Retained-message reindexing and session takeover also now tolerate an unreachable peer node instead of aborting.

• #​18347 Fix a problem with Mnesia RocksDB backend that caused table inconsistency on core nodes when keys were deleted while core node is down.

  From the EMQX point of view, this problem could lead to delayed release of dashboard login locks,
  as well as wasted disk space by the EMQX schema registry, since deletion of old schemas could be missed.

• #​18383 Fixed an issue where submitting a configuration containing an invalid Unicode escape sequence through PUT /configs returned an internal error. Such requests now return a validation error that names the invalid escape.

Access Control

• #​17806 Aligned the data backup import and export endpoints with the principle of least privilege: Dashboard users whose scope set does not include both user_management and api_key_management can no longer import or export archives containing the dashboard_users or api_keys table sets. Global administrators and API-key callers with the necessary scopes are unaffected.

• #​17853 Improved redaction of sensitive HTTP request headers in connector debug logs. x-api-key, x-auth-token, api-key, and cookie headers are now stored as secrets in connector state (matching the existing behaviour for Authorization / Proxy-Authorization), so their values are not printed when connector state is emitted at trace / debug level. In addition, the shared header-redaction helper now recognises header names that are stored as iolists (a shape produced by the connector's template parser), which previously slipped through the sensitivity check.

• #​17871 Creating a super-user in a non-global namespace is now rejected when importing built-in-database users in bulk or via a bootstrap file, matching the per-user management API. Such rows are reported as failed and are not stored.

• #​17974 Raw MQTT packet data is now redacted by default in connection logs; trusted client IP addresses can be allowlisted per listener for diagnostics.

• #​18005 Fixed an issue where CLI audit logs could store sensitive command arguments.

• #​18009 Made scope handling consistent for administrator and API key records that use their role's implicit default scopes (shown as unset). Reads and writes now accept the unset-equivalent scope list, and such records keep their forward-compatible implicit scopes instead of a frozen list, so they automatically gain scopes introduced in future releases.

  • Editing only the note (description) of the default administrator via the Dashboard user API no longer fails; the user API now treats a scope list that matches the role's implicit full set (and the unset value) as "no explicit scopes".
  • #​18196 The API key create and update requests accept the same unset-equivalent scope list, so re-submitting the value returned by a read no longer fails.
  • #​18221 The default administrator is no longer created with an explicit scope list at startup, and existing default administrator records that carry an explicit list are updated to the implicit form at boot.

• #​18146 Hardened scope-based authorization for the dashboard and management API so that access-control checks are applied consistently across equivalent request paths.

• #​18177 Fixed an issue where frame_parse_error logs could expose packet data in received_prefix when the client was not allowed by allow_log_packet_data_from.

• #​18204 Strengthened validation of data backup archives during import so a backup file's contents are restored only into the table it is meant for.

• #​18225 Improved the warning logged when an API key bootstrap file entry contains scopes that are dropped during loading. The warning now groups the dropped scope names by the reason they were dropped -- an unknown scope name, a scope not allowed for the publisher role, or a privilege scope that cannot be combined with other scopes -- instead of reporting every dropped scope as an unknown scope name.

• #​18314 When reading GCP Connectors (GCP PubSub Producer/Consumer, Bigquery) that use JSON Service Account authentication via the HTTP API, now the values are redacted.

• #​18330 Add more secrets redaction to Read-only REST endpoints.

• #​18344 Upgraded HOCON to 0.46.3. This release renders sensitive values inside array-typed config fields as ****** and no longer prints sensitive field values in config validation error logs.

• #​18386 Fix password leak in logs for InfluxDB v1 connectors using query-string authentication (including the Datalayers connector). The password was logged in clear text as part of the client's path and auth_path fields.

• #​18391 Fixed an authentication cache key collision. Two different credentials whose fields concatenate to the same bytes could share a cache entry, letting one client receive another client's cached authentication result within the cache TTL.

Multi-tenancy

• #​17807 Namespaced administrators now have an isolated data backup space. Their exports, uploads, listings, downloads, imports and deletes through the data backup endpoints (/data/export, /data/import, /data/files, /data/files/:filename) only ever act on their own namespace's backups. A namespaced administrator can no longer see, download, or delete global backups or another namespace's backups.

  Global administrators continue to manage global backups by default (including any created before this change), and may additionally pass a namespace query parameter to GET/DELETE /data/files and GET /data/files/:filename to inspect or clean up a specific namespace's backups.

• #​17975 The /tracing configuration endpoint (PUT /api/v5/tracing) is now restricted to the global administrator. Namespaced dashboard administrators and API keys can no longer mutate the global [trace] configuration; such requests are rejected with HTTP 403.

• #​18008 Data backup: a global administrator can now import or upload a namespaced backup by passing the namespace query parameter, consistent with listing and downloading. Previously, importing a namespaced backup directly failed while uploading it first (which silently moved it to the global scope) succeeded — the two now behave the same. Namespaced administrators remain confined to their own namespace on every operation.

• #​18117 Deleting a namespace now also removes the namespace's built-in database authentication users (both password-based and SCRAM) and authorization rules. Previously, these records persisted after namespace deletion and reappeared if a namespace with the same name was created later.

  Additionally, a new emqx ctl mt purge_ns <namespace> CLI command deletes a namespace and purges all data belonging to it. The command is idempotent and does not require the namespace to exist, so it can be used as a last resort to clean up leftover data if a previous namespace deletion was interrupted.

• #​18164 Improved backup import feedback when working within a namespace. Importing an archive that does not belong to the target namespace -- for example one exported from a different namespace, or a global backup -- now returns a clear error instead of appearing to succeed while importing nothing. A global administrator can still restore a specific namespace's backup using the namespace query parameter.

  Global backups are now complete cluster snapshots: a global export also includes every namespace's configuration, and a global import restores each namespace's configuration back into its own namespace. A cluster without namespaces produces and reads exactly the same archives as before.

• #​18222 Namespaced administrator API keys now get the same default scope list as namespaced dashboard users. In particular, the default no longer includes the publish scope, which was misleading: the publish API is global-only and cannot be used by namespaced API keys. Creating a new namespaced API key with an explicit scope list containing publish, or including publish when changing an existing namespaced API key's scope list, now returns a validation error. Existing API keys are unaffected: previously stored scope lists (including ones containing publish) are kept as-is and continue to work exactly as before.

• #​18227 Fixed an issue where clients of a deleted managed namespace could temporarily publish without namespace rate limits while asynchronous client kicking was in progress.

• #​18339 Fixed a data backup import isolation issue where an uploaded archive could delete or write backup files that belong to other namespaces. Import now extracts and cleans up within the caller's own namespace directory. Backup archives that contain symlink or hardlink members are now rejected.

• #​18372 #​18378 Make sure that backup file and managed certificate bundle operations for a namespace always stay within that namespace's own directory. These operations are not available for a namespace whose name cannot be used as a directory name, such as ., .., an empty name, or a name containing a path separator.

Gateway

• #​17796 Fixed a crash in the MQTT-SN gateway when a new device connects from a UDP
  source port that was recently used by a disconnected device (common on
  loopback and behind NAT, where the OS or NAT box re-assigns the same port).
  The stale channel is now retired cleanly and the new connection is processed
  as a fresh session.

• #​17805 Fixed an issue where re-loading a gateway could fail with an already_started error after a previous load attempt aborted partway through (for example due to an invalid configuration or a busy listener port). The leftover locker process from the failed attempt is now reclaimed automatically, so the next load (or operator retry) starts from a clean state.

• #​17815 Fixed MQTT-SN UDP session routing when UDP source tuples change or are reused.

  MQTT-SN UDP listeners now route packets by the ClientId parsed from the packet through esockd_udp_proxy, allowing asleep sessions to resume from a different UDP source tuple while preventing a reused UDP source tuple from delivering another ClientId's packets to the old session.

• #​17888 Fixed an issue where the LwM2M gateway could include sensitive REGISTER query fields such as password, secret, private_key, and access_token in registration/update MQTT reports.

• #​18051 Fix CoAP debug logs leaking sensitive URI-query values.

Plugins

• #​17861 Restored the previous plugin startup behavior by no longer deleting local plugin packages that are missing from the cluster plugin configuration when a node starts or rejoins the cluster.

• #​17884 Fixed plugin management HTTP APIs to ignore stale unpacked plugin directories that are not present in the cluster plugin config and are not running locally.

  Such stale packages no longer appear in plugin list/detail/config/schema responses, cannot be acted on by plugin operation APIs, and no longer block reinstalling the same package through the HTTP install API. Configured pre-installed plugins are still visible and continue to follow the documented pre-install workflow.

  EMQX now logs an error on startup and HTTP API access when a plugin package is unpacked but is neither enabled nor disabled in plugins.states.

• #​17932 Fixed noisy failed_to_get_plugin_config_from_cluster warning when installing plugins via CLI.

  The emqx ctl plugins install command now installs plugins in fresh_install mode (matching the HTTP API behavior), which skips the cluster config lookup for newly installed plugins, avoiding repeated config_not_found_on_node warnings on every node in the cluster.

  Added --cluster flag to emqx ctl plugins install for cluster-wide installation. When specified, the plugin package is distributed to and installed on all running nodes in a single command.

• #​18018 Fixed plugin package installation loading code before validating the package's application declarations, configuration schema, and default configuration.

• #​18153 #​18172 Fixed the plugin configuration API to return a readable validation error when the root JSON value has the wrong type, instead of returning 500 INTERNAL_ERROR.

• #​18304 The UNS Governance plugin now validates message payloads on every publish to a governed topic. Previously, payload validation could be skipped for repeated publishes to the same topic while the authorization cache was warm.

• #​18333 Fixed plugin startup after a node restart for plugins that declare emqx_plugins in their application dependency list.

  Plugins start while the plugin subsystem itself is starting. A plugin that declared emqx_plugins as a dependency made its own startup wait for the plugin subsystem, so the plugin start timed out and the plugin was left enabled but not running after every node restart. EMQX now ignores this dependency declaration and logs a warning that asks the plugin author to remove it.

  When a plugin fails to start with a timeout, the error log now lists the declared dependency applications that were not running at that moment.

• #​18337 Start plugins after all EMQX applications have started. A plugin may now declare any EMQX application in its applications list. Previously, a plugin that declared an application which starts late in the boot sequence (for example emqx_management) failed to start after a node restart.

Observability

• #​17886 Exposed the publish quota-exceeded packet metric in Prometheus as emqx_packets_publish_quota_exceeded.

• #​18114 Fixed an issue where the dashboard metrics APIs (GET /api/v5/monitor_current and GET /api/v5/monitor) returned 500 INTERNAL_ERROR while a node was joining the cluster.

  While a joining node is restarting its applications, sampling its metrics fails; this failure is now tolerated: the APIs return the aggregate of the remaining reachable nodes and log a warning, instead of failing the whole request.

  Also fixed a spurious clear_monitor_metrics_rpc_errors warning that was logged on every successful DELETE /api/v5/monitor request.

• #​18183 Fixed an issue where the Prometheus metrics collection could fail repeatedly (logging errors on every scrape) when the multi-tenancy feature is not enabled. Namespaced session, authentication, and authorization metrics are now simply omitted when their corresponding features are not active.

• #​18292 Fixed an issue where the /prometheus/namespaced_stats endpoint reported zero-valued metrics for a namespace that does not exist. When the requested namespace is not known, its metrics are now omitted from the output, consistent with the collection of metrics for all namespaces.

File Transfer

• #​18069 Fixed the file transfer files API (GET /api/v5/file_transfer/files) failing with a 500 error when listing files whose names contain non-ASCII characters.

• #​18315 MQTT File Transfer file listing and download REST endpoints are now available only to global (non-namespaced) Dashboard users and API keys. Namespaced users and API keys can no longer read files uploaded by clients outside their namespace.

Deployment

• #​17877 Fixed the emqx-enterprise Helm chart hardcoding svc.cluster.local in the node's host name. On a Kubernetes cluster whose DNS domain is not cluster.local, a node named itself with an unresolvable FQDN, so Erlang distribution could not start and the nodes failed to form a cluster. The host name now follows the chart's clusterDomain value, which already governed the DNS and Kubernetes discovery settings.

AI Interoperability

• #​17936 Fixed the formatting of A2A cards belonging to the global namespace in the HTTP API. Previously, they would show as the string "global". Now, they are formatted as null to distinguish them from specific namespaces.

Download

Ubuntu / Debian

• ubuntu24.04 (amd64): .deb — .tar.gz
• ubuntu24.04 (arm64): .deb — .tar.gz
• ubuntu22.04 (amd64): .deb — .tar.gz
• ubuntu22.04 (arm64): .deb — .tar.gz
• debian13 (amd64): .deb — .tar.gz
• debian13 (arm64): .deb — .tar.gz
• debian12 (amd64): .deb — .tar.gz
• debian12 (arm64): .deb — .tar.gz
• debian11 (amd64): .deb — .tar.gz
• debian11 (arm64): .deb — .tar.gz

RHEL / Rocky / Amazon Linux

• el10 (amd64): .rpm — .tar.gz
• el10 (arm64): .rpm — .tar.gz
• el9 (amd64): .rpm — .tar.gz
• el9 (arm64): .rpm — .tar.gz
• el8 (amd64): .rpm — .tar.gz
• el8 (arm64): .rpm — .tar.gz
• amzn2023 (amd64): .rpm — .tar.gz
• amzn2023 (arm64): .rpm — .tar.gz
• el7 (amd64): .rpm — .tar.gz

macOS

• macos14 (arm64): .zip
• macos15 (arm64): .zip
• macos26 (arm64): .zip

Plugins

• emqx_acme-0.2.0
• emqx_backup_sync-0.1.2
• emqx_bridge_mqtt_dq-0.5.2
• emqx_maptabs-0.1.2
• emqx_offline_messages-2.0.0
• emqx_relup-1.0.1
• emqx_sync_request-0.1.1
• emqx_unsgov-0.1.4
• emqx_username_quota-1.2.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.