## RabbitMQ 4.3.5 RabbitMQ `4.3.5` is a maintenance release in the `4.3.x` [release series](https://www.rabbitmq.com/release-information). It is **strongly recommended** that you read [4.3.0 release notes](https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0) in detail if upgrading from a version prior to `4.3.0`. ### Minimum Supported Erlang Version The minimum supported Erlang version for this release series is `27.0`. [RabbitMQ and Erlang/OTP Compatibility Matrix](https://www.rabbitmq.com/docs/which-erlang) has more details on Erlang version requirements for RabbitMQ. Nodes **will fail to start** on older Erlang releases. ## Changes Worth Mentioning Release notes can be found on GitHub at [rabbitmq-server/release-notes](https://github.com/rabbitmq/rabbitmq-server/tree/v4.3.x/release-notes). ### Core Server #### Bug Fixes * With [direct reply-to](https://www.rabbitmq.com/docs/direct-reply-to), a message routed to multiple targets that resolved to the same process could be delivered to it more than once. GitHub issue: [#17071](https://github.com/rabbitmq/rabbitmq-server/pull/17071) * Quorum queue recovery from a recovery checkpoint could leave a part of the queue's internal state only partially initialized. GitHub issue: [#17012](https://github.com/rabbitmq/rabbitmq-server/pull/17012) * In clusters that run a mix of `4.2.x` and `4.3.x` nodes during a rolling upgrade, local quorum queue queries now fall back to the previous state machine version instead of failing. GitHub issue: [#17128](https://github.com/rabbitmq/rabbitmq-server/pull/17128) * A malformed AMQP 1.0 frame now results in a framing error returned to the client instead of an exception. GitHub issue: [#17101](https://github.com/rabbitmq/rabbitmq-server/pull/17101) * The AMQP 1.0 message parser now validates message sections more strictly and decodes certain types of arrays more efficiently. GitHub issue: [#17049](https://github.com/rabbitmq/rabbitmq-server/pull/17049) * Topic exchanges now limit the number of multi-segment (`#`) wildcards a binding key can use to two. The `#` wildcard is meant to be used as the final segment, that is, just once. GitHub issue: [#17039](https://github.com/rabbitmq/rabbitmq-server/pull/17039) * When connection credentials are refreshed (for example, when an [OAuth 2](https://www.rabbitmq.com/docs/oauth2) token is renewed), the user's tags are now updated instead of being carried over from the original state. GitHub issue: [#17029](https://github.com/rabbitmq/rabbitmq-server/pull/17029) * [Definition import](https://www.rabbitmq.com/docs/definitions#import-on-boot) from an HTTPS endpoint no longer fails when a password-protected TLS (HTTPS) client certificate is used. Contributed by @Pyolar. GitHub issue: [#16973](https://github.com/rabbitmq/rabbitmq-server/pull/16973) * The AMQP 1.0 Erlang client no longer logs an exception when a link is already detached. Workloads that use short lived links could produce a substantial amount of log noise. GitHub issue: [#17124](https://github.com/rabbitmq/rabbitmq-server/pull/17124) #### Enhancements * Authentication events are now logged under a new logging category, `user`. Successful logins are logged at the `info` level, failed login attempts at the `warning` level. GitHub issue: [#16907](https://github.com/rabbitmq/rabbitmq-server/pull/16907) ### CLI Tools #### Enhancements * `rabbitmqctl hash_password` now supports more password hashing functions. GitHub issues: [#14215](https://github.com/rabbitmq/rabbitmq-server/issues/14215), [#17108](https://github.com/rabbitmq/rabbitmq-server/pull/17108) ### Stream Plugin #### Bug Fixes * A stream protocol connection can have at most 256 publishers and 256 subscriptions, a limit that comes from the protocol's wire format. Attempts to go over these limits are now rejected early with a clear error instead of failing later with an unrelated one. GitHub issue: [#17123](https://github.com/rabbitmq/rabbitmq-server/pull/17123) #### Enhancements * Before a stream client connection completes authentication and authorization (that is, before a successful `open`), the server now enforces a low `frame_max` ceiling instead of the full configured value. The default, 8192 bytes, is high enough to accommodate realistic [JWT tokens](https://www.rabbitmq.com/docs/oauth2) used with SASL PLAIN authentication, and mirrors a mechanism already in place for AMQP 0-9-1 connections. It can be adjusted with the new `stream.initial_frame_max` setting. GitHub issue: [#17053](https://github.com/rabbitmq/rabbitmq-server/pull/17053) * New setting: `stream.max_uncompressed_sub_entry_batch_size`. It bounds the declared uncompressed size of a published sub-entry batch, and defaults to 67108864 (64 MiB), the same default already used by the Java client's `maxUncompressedSubEntryBatchSize`. The broker and any client publishing to it should be configured with the same value. GitHub issue: [#17103](https://github.com/rabbitmq/rabbitmq-server/pull/17103) ### Management Plugin #### Bug Fixes * HTTP API endpoints that accept a node name, including the federation and tracing related ones, now validate that the target node is a cluster member. GitHub issues: [#17106](https://github.com/rabbitmq/rabbitmq-server/pull/17106), [#17118](https://github.com/rabbitmq/rabbitmq-server/pull/17118) * The management UI no longer displays certain alert messages twice. GitHub issue: [#17127](https://github.com/rabbitmq/rabbitmq-server/pull/17127) #### Enhancements * When `management.credential_encryption_secret` is configured, the management UI login endpoint (`POST /api/login`) returns client credentials encrypted using `AES-256-GCM` with a key derived from the configured secret, and returns the ciphertext as an opaque token prefixed with `rmqe.`. The browser stores this token and presents it on all subsequent requests using the `Authorization: Bearer rmqe.` header. The secret MUST be identical on every node in the cluster. **Important**: during a rolling cluster upgrade, enable this feature only after all nodes have been upgraded. This is particularly important for clusters behind a load balancer: nodes that run older versions will not recognize the encrypted tokens and will reject the requests, unexpectedly logging users out. GitHub issue: [#16705](https://github.com/rabbitmq/rabbitmq-server/pull/16705) * `GET /api/definitions` now supports conditional requests (`ETag`). The `ETag` value is derived from the metadata store Raft index, so the tag will naturally change as the metadata store serves writes. GitHub issues: [#16724](https://github.com/rabbitmq/rabbitmq-server/issues/16724), [#17121](https://github.com/rabbitmq/rabbitmq-server/pull/17121) * The `Referrer-Policy` HTTP response header can now be configured with the `management.headers.referrer_policy` setting. GitHub issue: [#16893](https://github.com/rabbitmq/rabbitmq-server/pull/16893) * When `management.http.hide_allow_header` is set to `true`, the `Allow` HTTP response header is omitted from all responses except `405 Method Not Allowed` ones, where it is required by the HTTP specification. This avoids disclosing the supported HTTP methods to clients. GitHub issue: [#16893](https://github.com/rabbitmq/rabbitmq-server/pull/16893) * When `management.definitions.require_json_extension` is set to `true`, both the management UI and the HTTP API will reject definition upload where the file does not have a `.json` extension. The setting defaults to `false`. Regardless of this setting, the server always validates that the uploaded content is valid JSON before importing it. GitHub issue: [#16946](https://github.com/rabbitmq/rabbitmq-server/pull/16946) ### OAuth 2 AuthN and AuthZ Backend Plugin #### Bug Fixes * When RabbitMQ is behind a proxy that terminates TLS, the [OAuth 2](https://www.rabbitmq.com/docs/oauth2) login flow now honors the `X-Forwarded-Proto`, `X-Forwarded-Host` and `X-Forwarded-Port` headers when rewriting the token endpoint URL in the OpenID discovery payload. GitHub issue: [#17153](https://github.com/rabbitmq/rabbitmq-server/pull/17153) ### Shovel Plugin #### Bug Fixes * Reduced log noise. GitHub issue: [#17028](https://github.com/rabbitmq/rabbitmq-server/pull/17028) * Static shovels that do not define any `declarations` failed to start. GitHub issues: [#17063](https://github.com/rabbitmq/rabbitmq-server/issues/17063), [#17067](https://github.com/rabbitmq/rabbitmq-server/pull/17067) * When a topology setup failure stops a shovel worker, the specific reason is now reported instead of a generic one. GitHub issue: [#17135](https://github.com/rabbitmq/rabbitmq-server/pull/17135) * The Shovel HTTP API now processes shovel URIs the same way the federation plugin processes its upstream URIs. GitHub issue: [#17134](https://github.com/rabbitmq/rabbitmq-server/pull/17134) #### Enhancements * Shovel TTL: dynamic shovels support a new setting, `src-delete-after-duration`, that instructs the shovel to self-delete after at least the specified duration. Contributed by @michalovits. GitHub issues: [#17055](https://github.com/rabbitmq/rabbitmq-server/pull/17055), [#17064](https://github.com/rabbitmq/rabbitmq-server/pull/17064) ### Federation Plugin #### Bug Fixes * A malformed upstream URI could prevent a federation link from starting even when other, well-formed URIs were available. All candidate URIs are now tried. Contributed by @sauravonwww. GitHub issue: [#17046](https://github.com/rabbitmq/rabbitmq-server/pull/17046) ### MQTT Plugin #### Bug Fixes * Packets split across many network fragments are now parsed more efficiently. GitHub issue: [#17093](https://github.com/rabbitmq/rabbitmq-server/pull/17093) * MQTT 5.0 properties are now parsed strictly: a property that is not valid for a given packet type is rejected. GitHub issue: [#17039](https://github.com/rabbitmq/rabbitmq-server/pull/17039) * A `Receive Maximum` value of 0, prohibited by the MQTT 5.0 specification, is now rejected. GitHub issue: [#17035](https://github.com/rabbitmq/rabbitmq-server/pull/17035) ### STOMP Plugin #### Bug Fixes * Frame size limits are now enforced earlier in the connection lifecycle. GitHub issue: [#17116](https://github.com/rabbitmq/rabbitmq-server/pull/17116) ### Web STOMP Plugin #### Bug Fixes * The accumulated frame size is now checked against `max_frame_size` after a connection has authenticated, matching the behavior of "regular" STOMP connections. GitHub issue: [#17065](https://github.com/rabbitmq/rabbitmq-server/pull/17065) ### Consistent Hash Exchange Plugin #### Bug Fixes * An edge case in bucket selection is now handled gracefully. GitHub issue: [#17081](https://github.com/rabbitmq/rabbitmq-server/pull/17081) ### Dependency Changes * `cowboy` was upgraded to [`2.18.0`](https://github.com/ninenines/cowboy/releases) * `cowlib` was upgraded to [`2.19.0`](https://github.com/ninenines/cowlib/releases) * `gun` was upgraded to [`2.5.0`](https://github.com/ninenines/gun/releases) * `ra` was upgraded to [`3.1.10`](https://github.com/rabbitmq/ra/releases/tag/v3.1.10) * `ranch` was upgraded to [`2.2.1`](https://github.com/ninenines/ranch/releases/tag/2.2.1)