chore(deps): update docker.io/emqx/emqx-enterprise docker tag to v6 by renovate[bot] · Pull Request #731 · genebean/dots

renovate · 2026-09-24T06:11:59Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
docker.io/emqx/emqx-enterprise (source)	major	`5.10.5` → `6.3.1`

Release Notes

emqx/emqx (docker.io/emqx/emqx-enterprise)

`v6.3.1`: EMQX Enterprise (LTS) 6.3.1

Compare Source

Download

Ubuntu / Debian

OS	Arch	Package	Tarball
`ubuntu24.04`	amd64	.deb (sha256)	.tar.gz (sha256)
`ubuntu24.04`	arm64	.deb (sha256)	.tar.gz (sha256)
`ubuntu22.04`	amd64	.deb (sha256)	.tar.gz (sha256)
`ubuntu22.04`	arm64	.deb (sha256)	.tar.gz (sha256)
`debian13`	amd64	.deb (sha256)	.tar.gz (sha256)
`debian13`	arm64	.deb (sha256)	.tar.gz (sha256)
`debian12`	amd64	.deb (sha256)	.tar.gz (sha256)
`debian12`	arm64	.deb (sha256)	.tar.gz (sha256)
`debian11`	amd64	.deb (sha256)	.tar.gz (sha256)
`debian11`	arm64	.deb (sha256)	.tar.gz (sha256)

RHEL / Rocky / Amazon Linux

OS	Arch	Package	Tarball
`el10`	amd64	.rpm (sha256)	.tar.gz (sha256)
`el10`	arm64	.rpm (sha256)	.tar.gz (sha256)
`el9`	amd64	.rpm (sha256)	.tar.gz (sha256)
`el9`	arm64	.rpm (sha256)	.tar.gz (sha256)
`el8`	amd64	.rpm (sha256)	.tar.gz (sha256)
`el8`	arm64	.rpm (sha256)	.tar.gz (sha256)
`amzn2023`	amd64	.rpm (sha256)	.tar.gz (sha256)
`amzn2023`	arm64	.rpm (sha256)	.tar.gz (sha256)
`el7`	amd64	.rpm (sha256)	.tar.gz (sha256)

macOS

OS	Arch	Package
`macos14`	arm64	.zip (sha256)
`macos15`	arm64	.zip (sha256)
`macos26`	arm64	.zip (sha256)

Plugins

Plugin	Version	Package
`emqx_acme`	0.2.0	.tar.gz (sha256)
`emqx_agent`	1.0.0	.tar.gz (sha256)
`emqx_backup_sync`	0.1.3	.tar.gz (sha256)
`emqx_bridge_mqtt_dq`	0.5.2	.tar.gz (sha256)
`emqx_maptabs`	0.1.2	.tar.gz (sha256)
`emqx_offline_messages`	2.0.1	.tar.gz (sha256)
`emqx_relup`	1.0.2	.tar.gz (sha256)
`emqx_sync_request`	0.1.2	.tar.gz (sha256)
`emqx_unsgov`	0.1.4	.tar.gz (sha256)
`emqx_username_quota`	1.2.3	.tar.gz (sha256)

Breaking Changes

#18465 Fixed handling of templated INSERT SQL statements in the ClickHouse, TDengine, SQL Server, and MySQL bridges (when batch insert is enabled).

Previously, rendering SQL templates could often produce malformed SQL due to syntax errors in the manually entered template itself and due to interpolation issues.

Now, SQL statements are fully parsed when an action is created, and invalid SQL is rejected. During rendering, correct escaping is enforced. To provide consistent and predictable behavior, we limit the SQL features that can be used. Most notably, we reject comments in SQL statements. However, we support a large subset of syntax features: constant values, strings and string interpolation, arithmetic, functions, conditions, and conditional operators.

MySQL also supports ON DUPLICATE KEY UPDATE, ClickHouse supports FORMAT Values and FORMAT JSONCompactEachRow, and TDengine supports INSERT ... USING ... TAGS and table identifier interpolation.

To provide consistent rendering for MySQL templates, the MySQL bridge unconditionally disables ANSI_QUOTES and NO_BACKSLASH_ESCAPES modes for all connections, and treats the statements accordingly.

The ClickHouse bridge now infers the batch value separator from the SQL template and ignores the configured batch_value_separator value.
#18630 Namespaced administrator API keys can no longer be created, updated, or bootstrapped with scopes the namespaced role is not allowed to hold (such as gateways or audit), matching the existing dashboard user rule.

Rotate any existing namespaced API key that was granted such scopes, since keys already minted with them keep working until rotated.
#18824 Fixed a misspelled field name in the emqx ctl listeners output.

The command printed the listener's enabled flag as enbale. It now prints enable. Scripts that parse this output must be updated to match the corrected name.

Enhancements

Access Control

#18777 Added optional SCRAM-SHA-256 challenge-response authentication for Dashboard JSON API login and switched the embedded API Spec login page to SCRAM by default. The existing password login remains enabled by default.

When dashboard.password_login = scram_only, scripts and third-party clients using POST /api/v5/login with a username and password must migrate to the SCRAM challenge-response flow or use API keys.

Packaging

#18977 Switched the official EMQX Enterprise Docker release images to Docker Hardened Debian 13 (Trixie). The runtime images no longer include package managers such as apt and dpkg.

Release images now include build provenance and software bill of materials (SBOM) attestations, allowing Docker Scout to apply Docker's vulnerability assessments (VEX statements) for the hardened base image.

Performance

#18806 Reduced memory usage of MQTT connections.

Each connection allocated rate-limiter state at connect time, even when no rate limit is configured. The state is now allocated when the client first publishes or subscribes, so connections that only stay connected use about 2 KB less memory each. Configured rate limits behave the same as before.
#18807 Reduced memory usage of MQTT sessions.

Each session allocated delivery rate-limiter state at creation, even when no delivery rate limit is configured. The state is now allocated on first delivery after a delivery rate limit is configured, saving about 0.5 KB per session. Configured delivery rate limits behave the same as before.
#18808 Reduced memory usage of MQTT connections that publish or subscribe.

Rate-limiter state per connection is now allocated only for rate limits that are actually configured. With default settings (no rate limits) an active connection uses about 1.6 KB less memory. Configured rate limits behave the same as before, including limits added at runtime.
#18809 Reduced memory usage of MQTT connections when rate limits are configured.

Rate-limiter bookkeeping shared by all connections is no longer copied into each connection, saving about 0.5 KB per connection with rate limits enabled. Rate-limit behavior is unchanged.
#18875 Reduced memory usage of MQTT connections that belong to a multi-tenant namespace.

Rate-limiter state for namespace clients is now allocated when a client first publishes, subscribes or receives a message, and only for limits that are actually configured, matching the behavior of ordinary connections. Configured tenant and client rate limits behave the same as before, including denial after a namespace's limiter configuration is removed.

Bug Fixes

Core MQTT Functionalities

#18734 Fixed a TCP listener issue where tcp_options.buffer = 0 made every new connection fail on the default socket backend.

tcp_options.active_n is now clamped to the 1..1000 range and tcp_options.buffer to at least 5 bytes (the largest MQTT fixed header), on all listener types. Out-of-range values are still accepted and are silently adjusted.
#18789 MQTT and Gateway listener creation now rejects listener names longer than 64 bytes or not matching the restricted-name format with a clear BAD_REQUEST response. Existing listeners with longer names remain editable.
#18811 Fixed a regression in 6.3.0 that sent topic aliases to MQTT v5 clients which do not accept them.

A client that omits the Topic Alias Maximum property, or sets it to 0, was still sent PUBLISH packets carrying a Topic-Alias property when it authenticated with enhanced authentication, for example SCRAM.
#18828 MQTT listeners now close a connection when its first packet is not a CONNECT, without parsing the packet body.

Access Control

#18681 Fixed REST API authentication error messages to match what the target endpoint accepts. A rejected bearer token or missing authorization header on an endpoint that rejects API keys, such as POST /api/v5/logout, no longer suggests using one. The message also no longer names the api_key.bootstrap_file configuration key.
#18724 Dashboard SSO OIDC now rejects configuration where the issuer's URL scheme and the TLS option disagree (https with TLS disabled, or http with TLS enabled) at config time, instead of failing repeatedly at runtime with an unclear TLS error or silently ignoring the TLS option.
#18737 Fixed ${peerport} rendering as an empty string in authentication and authorization request templates.

Also added ${peername} to the client information available in these templates. It renders as the client's address and port, for example 192.168.0.1:51544.
#18852 Fixed bootstrap API keys being rejected by the nodes still running the older version during a rolling upgrade to 6.3.

When a 6.3 node started, it rewrote the cluster-shared API key record with a secret hash that older nodes cannot verify, so those nodes rejected the key. The bootstrap file loader now keeps the stored hash when the file still holds the same secret, and refreshes only the key metadata such as role and scopes.

Changing the secret in the bootstrap file still replaces the hash. Rotate a bootstrap secret only after the whole cluster runs 6.3.
#18904 Fixed an issue where creating or updating an enabled Dashboard SSO backend could fail with an internal error when its resource remained in the connecting state until the start timeout.

The backend now remains tracked with its resource ID so that it can be cleaned up after the start timeout.

Multi-tenancy

#18774 Fixed an issue where clients could connect to a deleted multi-tenancy namespace while its resources were still being cleaned up.

Data Integration

#18763 Fixed an error reported by the TDengine action. When the action could not be found, the error named the connector's ID instead of the action's ID, which made the error read as if a valid connector ID was invalid.
#18775 Renamed the RocketMQ connector's namespace configuration field to rocketmq_namespace.

The old name is still accepted, so existing configurations, API calls and imported backups keep working without change. The field was renamed because its name collided with the EMQX namespace reported by the connector API, which made the Dashboard treat the connector as owned by a namespace named after the RocketMQ instance.

The value is shown as rocketmq_namespace in API responses and in the Dashboard.
#18846 Fixed SQL template rendering in data integrations. Doris batch inserts now use Doris-compatible syntax and escaping for text and binary values. MySQL templates now handle escaped dollar signs correctly.
#18925 Fixed QuasarDB actions to validate SQL templates and escape interpolated values according to their SQL context.
#18941 Fixed GreptimeDB connectors that switched between connected and disconnected under heavy write load. The health check no longer waits behind pending writes, so it fails only when GreptimeDB does not respond.

Clustering

#18826 Backup import now confirms that every node in the cluster runs the same version before it starts.

Importing during a rolling upgrade could apply the backup through calls that the not-yet-upgraded nodes interpret differently. The import now stops before it begins and names the nodes still to be upgraded, so the cluster is left as it was.
#18862 Validate the options passed to emqx_router_tool:scan_missing_routes/1 and emqx_router_tool:reconcile_missing_routes/1.

Invalid chunk or sleep_ms values were accepted silently and disabled the scan throttling, so the scan ran at full speed while the operator believed it was throttled. The tool now raises an error naming the offending option instead. Unknown option keys, such as a misspelled chunks, are rejected as well.
#18899 Fixed a regression where GET /api/v5/listeners and GET /api/v5/listeners_status could return 500 INTERNAL_ERROR in a mixed-version cluster during a rolling upgrade from an earlier release.

Durable Storage

#18822 Fixed rare issues that could prevent Durable Storage shards from recovering after node restarts or leadership changes. EMQX now treats additional transient DS Raft leadership errors as retryable, and incomplete RocksDB schema initialization no longer prevents shards from recovering.

Gateway

#18755 Fixed an issue where saving an existing NATS Gateway configuration from the Dashboard could replace its authentication credentials with the masked value displayed in the form, causing NATS clients to fail authentication.

Authentication credentials are now preserved when users update other Gateway settings without changing the authentication configuration.

NATS Gateway authentication settings now reject duplicate authentication methods and credential entries, including duplicate NKeys and JWT account entries, to prevent ambiguous authentication behavior.
#18776 MQTT-SN now publishes configured Will messages when sleeping clients exceed their sleep duration and no longer publishes Will messages when clients disconnect normally.
#18842 Gateway connections now ignore clientid_override values returned by authentication backends, which is not supported by Gateway protocols. A warning is logged when this occurs.

Mountpoint templates for Gateway connections are now evaluated in the shared Gateway authentication flow after authentication results are merged.
#18855 Fixed MQTT-SN session wake-up authorization for DTLS clients authenticated with verified client certificates. A certificate-bound session can be resumed from a new association only when it presents the same peer certificate. Wake-up without a client certificate or with a different or reissued certificate is rejected.

Plaintext UDP and DTLS clients without a certificate retain the legacy ClientId-only PINGREQ wake-up behavior.

Plugins

#18891 Fixed an issue where installing and starting the Sync Request plugin on EMQX 6.x failed with a missing_i18n_ref error. The plugin now starts successfully and its API endpoint is available.

Observability

#18664 Audit records for namespaced requests now identify the namespace a request targeted. Previously, resetting a topic-metrics collection with the same name in different namespaces produced audit records that looked identical, so it was not possible to tell which namespace's collection was affected. The audit log now also records any query parameters a request carried.
#18677 Audit records for data-backup requests now identify the namespace a request targeted. Previously, exporting, importing, uploading, or deleting a backup in different namespaces produced audit records that looked identical, so it was not possible to tell which namespace's backup was affected. The audit log now also records any query parameters a request carried.
#18678 Audit records for A2A registry requests now identify the namespace a request targeted. Previously, registering or deleting an agent card in different namespaces produced audit records that looked identical, so it was not possible to tell which namespace's card was affected. The audit log now also records any query parameters a request carried.
#18684 Fixed a crash on connect when OpenTelemetry tracing was enabled and an MQTT 5 client's CONNECT packet carried will User-Property entries.
#18686 Audit records for authorization, authentication, connector, bridge, rule-engine and trace requests now identify the namespace a request targeted. Previously, these audit records looked identical across namespaces, so it was not possible to tell which namespace's resources a request affected. The audit log now also records any query parameters a request carried.
#18754 Stop creating audit log records for CLI commands that only print help.

Running a command such as emqx ctl api_keys without a subcommand prints the usage text. Previously this also wrote an audit log record with an empty argument list, which looked like an operation had been performed. Commands that do work are still audited, including read-only ones.
#18853 Fixed an issue where SSO MFA setup and verification credentials could be stored unredacted in audit logs when audit logging was enabled.

SSO MFA request bodies now keep only username and backend in audit records; temporary tokens, TOTP codes, and unknown credential fields are redacted before being written to audit files or the audit database.
#18961 Fixed a regression where audit log entries for emqx ctl plugins ... commands masked every argument as ******. All plugins arguments are non-sensitive (plugin name-version, boot position, and the package sha256 digest), so they are now recorded as-is instead of being redacted. The plugins install --cluster option, which was accidentally dropped in the same CLI refactoring, is restored.

Management

#18600 Fixed client list API filtering when durable sessions are enabled.

GET /api/v5/clients appended all disconnected durable sessions to the result, ignoring query-string filters such as conn_state, username, and clientid. For example, conn_state=connected also returned disconnected durable sessions. Now the filters apply to disconnected durable sessions as well.

When filters are applied and disconnected durable sessions exist, the response omits the meta.count field instead of reporting a wrong number. Queries that filter with conn_state=connected keep an exact meta.count.
#18666 GET /api/v5/topics now returns the full shared-subscription topic, for example $share/group/a/1, for a durable shared subscription.

Previously the response showed only the bare topic, for example a/1, so a durable shared subscription was indistinguishable from a normal durable subscription to the same topic.
#18817 Fixed PUT /api/v5/telemetry/status returning 500 INTERNAL_ERROR with an Erlang stack trace when the request body omits the enable field.

The endpoint now returns 400 BAD_REQUEST with a validation message. The API documentation marks enable as required and no longer shows a default value for it, because the endpoint has never applied that default.
#18859 Fixed an issue where changing only the letter casing of a sensitive HTTP header name while updating a configuration could remove its stored value.
#18860 Fixed client message pagination returning a continuation position on the final page.

GET /clients/{clientid}/mqueue_messages and GET /clients/{clientid}/inflight_messages now return meta.position as end_of_data when no more messages are available. API clients can stop without requesting an additional empty page.
#18963 #18975 Fixed POST /api/v5/api_key returning HTTP 500 when the optional desc or enable field is omitted from the request body. The key is now created with an empty note and enabled by default. Request body fields that are not part of the API key schema (for example description instead of desc) are still ignored by request validation.

Deployment and Security

#18836 Stopped including the result of a successful configuration change in the cluster configuration sync debug logs.

The result could carry compiled runtime state, such as the HTTP authenticator header templates, which held secrets that log redaction did not cover.

`v6.3.0`: EMQX Enterprise (LTS) 6.3.0

Compare Source

EMQX Enterprise 6.3.0 focuses on stronger security defaults, leaner deployments, and broader operational visibility.

Highlights include:

Feature Gates. Set EMQX_FEATURES=ESSENTIAL to run the core MQTT broker with an under-100 MB boot-time memory footprint;
Security Profile. Set EMQX_SECURITY_PROFILE=hardened for secure-by-default deployments;
A more performant socket backend for MQTT TCP listeners;
Refined QoS 0 flow control for slow or congested subscribers;
Topic Metrics v2 with wildcard matching and Prometheus scraping;
Authenticated OpenAPI and Prometheus endpoints;
Stronger credential hashing;
Improved MQTT session handling and rate limiting;
Bigtable integration.

In summary, this release includes 39 enhancements and 47 bug fixes comparing to version 6.2.3

Download

Ubuntu / Debian

OS	Arch	Package	Tarball
`ubuntu24.04`	amd64	.deb (sha256)	.tar.gz (sha256)
`ubuntu24.04`	arm64	.deb (sha256)	.tar.gz (sha256)
`ubuntu22.04`	amd64	.deb (sha256)	.tar.gz (sha256)
`ubuntu22.04`	arm64	.deb (sha256)	.tar.gz (sha256)
`debian13`	amd64	.deb (sha256)	.tar.gz (sha256)
`debian13`	arm64	.deb (sha256)	.tar.gz (sha256)
`debian12`	amd64	.deb (sha256)	.tar.gz (sha256)
`debian12`	arm64	.deb (sha256)	.tar.gz (sha256)
`debian11`	amd64	.deb (sha256)	.tar.gz (sha256)
`debian11`	arm64	.deb (sha256)	.tar.gz (sha256)

RHEL / Rocky / Amazon Linux

OS	Arch	Package	Tarball
`el10`	amd64	.rpm (sha256)	.tar.gz (sha256)
`el10`	arm64	.rpm (sha256)	.tar.gz (sha256)
`el9`	amd64	.rpm (sha256)	.tar.gz (sha256)
`el9`	arm64	.rpm (sha256)	.tar.gz (sha256)
`el8`	amd64	.rpm (sha256)	.tar.gz (sha256)
`el8`	arm64	.rpm (sha256)	.tar.gz (sha256)
`amzn2023`	amd64	.rpm (sha256)	.tar.gz (sha256)
`amzn2023`	arm64	.rpm (sha256)	.tar.gz (sha256)
`el7`	amd64	.rpm (sha256)	.tar.gz (sha256)

macOS

OS	Arch	Package
`macos14`	arm64	.zip (sha256)
`macos15`	arm64	.zip (sha256)
`macos26`	arm64	.zip (sha256)

Plugins

Plugin	Version	Package
`emqx_acme`	0.2.0	.tar.gz (sha256)
`emqx_agent`	1.0.0	.tar.gz (sha256)
`emqx_backup_sync`	0.1.3	.tar.gz (sha256)
`emqx_bridge_mqtt_dq`	0.5.2	.tar.gz (sha256)
`emqx_maptabs`	0.1.2	.tar.gz (sha256)
`emqx_offline_messages`	2.0.1	.tar.gz (sha256)
`emqx_relup`	1.0.2	.tar.gz (sha256)
`emqx_sync_request`	0.1.1	.tar.gz (sha256)
`emqx_unsgov`	0.1.4	.tar.gz (sha256)
`emqx_username_quota`	1.2.3	.tar.gz (sha256)

Breaking Changes

#17185 The MQTT parser now runs in strict mode by default. To restore the previous lenient behavior, set mqtt.strict_mode = false (globally or per-zone).

In strict mode, the broker validates incoming MQTT packets against the protocol specification and disconnects clients that send malformed packets. The validations enforced only in strict mode are:
- Fixed-header flags. Reserved DUP/QoS/RETAIN bits must be zero for non-PUBLISH packets, and PUBREL/SUBSCRIBE/UNSUBSCRIBE must use QoS=1 (bad_frame_header).
- CONNECT reserved bit must be zero (reserved_connect_flag).
- CONNECT Will flag consistency: Will Flag=0 requires Will QoS=0 and Will Retain=0; Will Flag=1 requires Will QoS in {0,1,2} (invalid_will_qos, invalid_will_retain).
- CONNECT Password/Username flags (MQTT 3.1.1 only). If Username Flag=0, Password Flag must also be 0, per [MQTT-3.1.2-22] (invalid_password_flag). MQTT 5.0 lifts this constraint and is unaffected.
- UTF-8 strings (proto name, client ID, topic, username, password, will topic, MQTT 5 string properties) must be valid UTF-8 and must not contain control characters U+0000–U+001F or U+007F–U+009F (utf8_string_invalid).
- Packet identifiers must be non-zero where required (PUBLISH QoS>0, PUBACK/REC/REL/COMP, SUBSCRIBE/SUBACK, UNSUBSCRIBE/UNSUBACK) (bad_packet_id).
When a client violates one of these checks, the broker logs an info-level entry with msg=frame_parse_error and a structured reason (for example, cause=invalid_password_flag, proto_ver, or received_prefix) for troubleshooting. For MQTT 5.0 connections, the broker also responds with CONNACK/DISCONNECT carrying reason code 0x81 Malformed Packet before closing; for MQTT 3.1/3.1.1, the connection is silently closed (no CONNACK reason code is defined for malformed packets in those versions).
#17215 Removed the bundled Swagger UI assets from the EMQX release package, reducing tarball size by approximately 11 MB.

/api-docs/swagger.json continues to serve the full OpenAPI 3 JSON spec, so external Swagger UI deployments that load it by URL keep working. The legacy /api-docs URL responds with an HTTP 308 redirect to /api-spec.html, the in-tree spec explorer introduced in 6.3.0. Other /api-docs/* subpaths (the embedded Swagger UI assets) are no longer served and return 404.
#17267 The node.max_ports config now defaults to auto, which scales the Erlang VM port limit (+Q) with the number of logical CPU cores: 65536 ports per core for up to 8 cores, and 1048576 (the historical fixed default) above that. Explicit integer values are still accepted.

This is a behavior change for nodes upgraded from earlier versions where max_ports defaulted to a fixed 1048576: hosts with 8 or fewer CPU cores will now boot with a smaller port table. Setups that rely on accepting more than cores * 65536 connections must set node.max_ports explicitly (and restart the node) before upgrading.

The hidden node.process_limit setting is reinstated as an override: when set to a value larger than the derived limit (2 * max_ports), it is respected; smaller values are ignored so the process table never under-sizes the port table.

A new node.schedulers setting (default auto) controls the Erlang scheduler count (+S). With auto, the count is capped at the number of logical processors actually available to the VM (sched_getaffinity on Linux), so containers limited via --cpuset-cpus or Kubernetes CPU requests no longer spawn scheduler OS threads they cannot run in parallel. Set it to a positive integer to override the auto-detected value.
#17437 Prometheus scrape endpoints (/api/v5/prometheus/*) now require authentication by default. Set prometheus.enable_basic_auth = false explicitly to restore the previous unauthenticated behavior. Deployments that scrape these endpoints without credentials will need to either configure credentials on the scraper or set the config field. The recommended setup is a dedicated API key with the monitoring scope, used with Bearer auth in the scraper.
#17582 Prometheus VM and Mnesia collector metric names now use the prometheus.erl 6.x promtool-compliant names.

Affected metric renames:
- erlang_mnesia_failed_transactions -> erlang_mnesia_failed_transactions_total
- erlang_mnesia_committed_transactions -> erlang_mnesia_committed_transactions_total
- erlang_mnesia_logged_transactions -> erlang_mnesia_logged_transactions_total
- erlang_mnesia_restarted_transactions -> erlang_mnesia_restarted_transactions_total
- erlang_vm_memory_atom_bytes_total -> erlang_vm_memory_atom_bytes
- erlang_vm_memory_bytes_total -> erlang_vm_memory_bytes
- erlang_vm_memory_processes_bytes_total -> erlang_vm_memory_processes_bytes
- erlang_vm_memory_system_bytes_total -> erlang_vm_memory_system_bytes
- erlang_vm_statistics_context_switches -> erlang_vm_statistics_context_switches_total
- erlang_vm_statistics_garbage_collection_number_of_gcs -> erlang_vm_statistics_garbage_collection_number_of_gcs_total
- erlang_vm_statistics_garbage_collection_words_reclaimed -> erlang_vm_statistics_garbage_collection_words_reclaimed_total
- erlang_vm_statistics_garbage_collection_bytes_reclaimed -> erlang_vm_statistics_garbage_collection_bytes_reclaimed_total
- erlang_vm_statistics_runtime_milliseconds -> erlang_vm_statistics_runtime_seconds_total
- erlang_vm_statistics_wallclock_time_milliseconds -> erlang_vm_statistics_wallclock_time_seconds_total
- erlang_vm_port_count -> erlang_vm_ports
- erlang_vm_process_count -> erlang_vm_processes
- erlang_vm_atom_count -> erlang_vm_atoms
#17596 Added authorization

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone America/New_York)

Branch creation
- "before 6am on thursday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot added the dependencies Pull requests that update a dependency file label Sep 24, 2026

chore(deps): update docker.io/emqx/emqx-enterprise docker tag to v6

33f2d12

renovate Bot force-pushed the renovate/major-oci-container-images branch from 0d5311e to 33f2d12 Compare September 27, 2026 01:34

Navigation Menu

Uh oh!

chore(deps): update docker.io/emqx/emqx-enterprise docker tag to v6 - #731

chore(deps): update docker.io/emqx/emqx-enterprise docker tag to v6#731
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-oci-container-images

renovate Bot commented Sep 24, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Sep 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v6.3.1: EMQX Enterprise (LTS) 6.3.1

Download

Ubuntu / Debian

RHEL / Rocky / Amazon Linux

macOS

Plugins

Breaking Changes

Enhancements

Access Control

Packaging

Performance

Bug Fixes

Core MQTT Functionalities

Access Control

Multi-tenancy

Data Integration

Clustering

Durable Storage

Gateway

Plugins

Observability

Management

Deployment and Security

v6.3.0: EMQX Enterprise (LTS) 6.3.0

Download

Ubuntu / Debian

RHEL / Rocky / Amazon Linux

macOS

Plugins

Breaking Changes

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Sep 24, 2026 •

edited

Loading

`v6.3.1`: EMQX Enterprise (LTS) 6.3.1

`v6.3.0`: EMQX Enterprise (LTS) 6.3.0