github rabbitmq/rabbitmq-server v4.4.0
RabbitMQ 4.4.0
on GitHub

2 hours ago

RabbitMQ 4.4.0 is a new feature release.

Breaking Changes and Compatibility Notes

  • The following AMQP 0-9-1 headers are no longer parsed: 

    x-amqp-1.0-properties
x-amqp-1.0-app-properties
x-amqp-1.0-message-annotations
x-amqp-1.0-footer

    RabbitMQ 3.13 and earlier used them to carry the AMQP 1.0 sections of a
    message received over AMQP 1.0. Nothing has written them since 4.0, so only
    a message stored by a 3.13 or earlier node and not read since carries them.
    Such a message is still delivered, with these headers converted like any
    other x- header rather than restored as AMQP 1.0 sections.

  • Likewise, the x-basic-delivery-mode, x-basic-priority and
    x-basic-expiration message annotations are no longer parsed. They were
    written before 4.0 when an AMQP 0-9-1 message was encoded as AMQP 1.0 for a
    stream, so only a stream entry written by a 3.13 or earlier node carries
    them, and reading it no longer restores those three properties.

  • OpenID Connect discovery responses are now validated more strictly. A
    deployment whose identity provider serves non-HTTPS (http://) endpoints,
    or whose issuer claim does not match the discovery endpoint used to
    retrieve it, will fail discovery validation after the upgrade.

    This is known to affect Cloud Foundry UAA, whose issuer is its token endpoint URL
    rather than a prefix of its discovery endpoint.

    Set auth_oauth2.discovery.verify_issuer and/or
    auth_oauth2.discovery.verify_https_endpoints to false before upgrading
    installations with non-compliant IdPs such as Cloud Foundry UAA.

    See Discovery Payload Validation
    for details on validation rules and configuration options.

  • GET /api/auth/hash_password/{password} was replaced with another endpoint, POST /api/auth/hash_password.
    The new endpoint consumes a POST body with JSON document with one key {"password": "..."}

Changes Worth Mentioning

Core Server

Enhancements

  • This version fully supports Erlang 28 and 29 series for both new clusters
    and rolling upgrade scenarios, assuming that .

    Important: in cases where RabbitMQ is upgraded to 4.4.0 and Erlang is upgraded to 28+ at the same time, we highly recommend first
    upgrading to 4.3.7 or a later patch, a 4.3 version that supports those two Erlang series
    and would use metadata store versions that are guaranteed to be interoperable.

  • Quorum queues now support delayed messages.

    A message with an x-opt-delivery-time annotation or header set to a future time,
    in milliseconds since the Unix epoch, is routed and enqueued immediately but only
    delivered to consumers once that time is reached.

    AMQP 1.0 clients set it as a message annotation, AMQP 0-9-1 clients as a
    long header.

    An AMQP 1.0 consumer can also delay redelivery of a message by setting
    x-opt-delivery-time in the annotations of a modified outcome.

    GitHub issue: #16583

  • AMQP 1.0 clients can now request sole (exclusive) ownership of a container ID.

    In case of a conflict, the server either refuses the new connection or closes the existing one,
    depending on what the client requested, per the AMQP 1.0 Connection Uniqueness
    protocol extension.

    GitHub issue: #16669

  • A new, optional x-name-prefix queue argument sets the prefix used for a server-named
    queue's generated name, capped at 64 bytes. The default prefix remains
    amq.gen.

    This feature is specific to AMQP 0-9-1.

    GitHub issue: #16233

  • The classic queue shared message store gained a new v2 on-disk file format (.sqs).
    New files are written in v2 automatically. Existing v1 files (.rdq) are left as-is.

    Note that a node with v2 files present cannot be downgraded to 4.3.x or earlier.

    GitHub issue: #17166

  • Classic queues now perform compaction more efficiently.

    GitHub issue: #16194

  • x-modulus-hash exchange routing is now stable: assuming a topology that does not change,
    messages carrying the same routing key are now routed to the same bound destination.

    Note: the exchange type has been moved from rabbitmq_sharding to the core, so it is
    now available even when said plugin is not enabled.

    GitHub issue: #15849

  • A change to the delivery-limit policy key now takes effect for existing quorum queues.

    Previously the delivery limit could not be updated from a policy. Now quorum queues
    reconfigure their delivery-limit value when a policy is added or updated.

    When the policy is removed the queue goes back to the default limit (20).

    A negative policy value means "no limit".

    GitHub issue: #16035

  • A passive declaration of a queue or an exchange (a check that it exists) requires any one of
    the configure, write or read permissions on that queue or exchange.

    This applies to queue.declare and exchange.declare with passive set to true in
    AMQP 0-9-1, and to queue lookups in AMQP 1.0 management.

    GitHub issue: #16272

  • Reduce boot time of blank (brand new) nodes.

    GitHub issue: #16479

  • Encrypted value support
    for the definitions.https.url key in rabbitmq.conf.

    GitHub issue: #16632

  • Password salts for internal users are now generated using a cryptographically secure
    pseudorandom number generator (CPRNG).

    GitHub issue: #16775

  • A topic exchange binding key can now contain at most two multi-segment (#) wildcards.

    GitHub issue: #17039

  • Redeclaring a stream with an x-max-age value that is equal to the existing one but written in
    different units, for example 1D as 24h, is no longer rejected as having non-equivalent arguments.

    GitHub issues: #8509, #17259

  • A stream can now start at an offset other than 0, set with the new
    x-stream-initial-offset optional queue argument. While the stream is empty,
    the first and next offset specifications resolve to this offset. The stream
    protocol accepts the same value as the stream-initial-offset argument of the
    Create command.

    The initial offset is fixed when the stream is created, so there is no policy
    for it, and redeclaring the stream with a different value is rejected.

    GitHub issue: #17300

  • Multiple stream coordinator efficiency improvements.

    For example, the stream coordinator now retries failed stream member actions sooner, with
    keeping a related stream partition process blocked for the retry delay.

    Failed operations are now retried after a short randomised delay, and actions that
    failed because a node was down are retried when that node comes back.

    GitHub issue: #16515

  • Certain classic queue recovery scenarios now avoid a counterproductive timeout of 60s.

    GitHub issue: #17733

  • Reduce CPU use of mostly idle quorum queues that do not have any queue decorators configured
    (which is the common, baseline case).

    GitHub issues: #17702, #17758

  • PBKDF2-HMAC-SHA256 now can be used for password hashing: 

    password_hashing_module = rabbit_password_hashing_pbkdf2_sha256

    GitHub issue: #17316

  • AMQP listeners can now bind to a Unix domain socket, using the same listeners.tcp.*
    settings as a TCP listener: 

    listeners.tcp.1 = unix:/var/run/rabbitmq/rabbitmq.sock:0

    GitHub issue: #16963

  • connection_max and channel_max were renamed to max_connections and max_channels,
    respectively, in rabbitmq.conf. The original names are still supported.

    GitHub issue: #16347

  • Messages are now converted from AMQP 0-9-1 to
    AMQP 1.0 as a single data section, unless its payload consists of valid AMQP 1.0 body sections.

    An expiration value that cannot be parsed is now ignored during that conversion.

    GitHub issue: #17272

  • Client connection listener startup now can be delayed by a configurable number of seconds
    (default: no additional delay): 

    listeners.startup_delay = 10

    GitHub issues: #13153, #17289

  • Internal peer discovery improvements.

    GitHub issue: #17450

Bug Fixes

  • The stream coordinator could leave a stream without a writer and never recover it,
    keep a stale start action after a leader election, or leave a replica
    disconnected after its node came back.

    GitHub issue: #16515

  • Multiple bug fixes and optimizations to Single Active Consumers on streams.

    GitHub issues: #15695, #16515, #16976

  • AMQP 1.0: link handle uniqueness is now enforced per the protocol spec.

    GitHub issue: #15780

  • Fix an issue that could trip an upgrade from 3.13 to 4.2 and then immediately to 4.3.

    GitHub issue: #16990

  • Upgrade safety improvements in mixed-version clusters (during rolling upgrades).

    GitHub issue: #17128

  • Several bug fixes around binding deletion.

    GitHub issues: #17255, #17257

  • Quorum queue Continuous Membership Reconciliation (CMR)
    could add more members (replicas) than the configured limit.

    GitHub issues: #17310, #17311

  • Fixed an off-by-one issue in classic queue shared message store after an unclean shutdown.

    GitHub issue: #17351

  • Routing to queues now handles concurrent queue deletion gracefully in more places, avoiding
    confusing (and also non-actionable) exceptions.

    GitHub issue: #17664

  • The basic.cancel notification sent on a consumer delivery timeout
    now properly clears consumer state even if the client does not respond with basic.cancel-ok.

    GitHub issue: #17734

CLI Tools

Enhancements

  • Two new commands, rabbitmqctl sole_connection_status and
    rabbitmqctl sole_connection_force_delete, inspect and manage AMQP 1.0 sole connections.

    GitHub issue: #16669

  • CLI commands that accept sensitive values as interactive input now suppress terminal echoing
    where possible. This behavior is specific to Erlang 28 and 29.

    GitHub issue: #17585

Stream Plugin

Enhancements

  • stream.max_connections is a new rabbitmq.conf setting that limits the concurrent
    number of RabbitMQ Stream Protocol client connections.

    GitHub issue: #16347

  • stream.max_super_stream_partitions is a new rabbitmq.conf setting that limits the number of
    partitions a super stream can have.

    GitHub issue: #16689

Management Plugin

Enhancements

  • A new endpoint, GET /api/init, cuts the number of blocking requests the UI
    has to make with certain authentication and login flows.

    GitHub issue: #17287

  • The Referrer-Policy response header value of the HTTP API and the UI can now be configured
    using the management.headers.referrer_policy key.

    GitHub issue: #16893

  • Support for multiple listeners for all HTTP-based protocols and the HTTP API.

    GitHub issues: #11526, #17365

Bug Fixes

  • The HTTP API did not return the status of blocked consumers.

    GitHub issue: #16532

MQTT Plugin

Enhancements

  • mqtt.max_connections is a new rabbitmq.conf setting that limits the concurrent
    number of MQTT client connections.

    GitHub issue: #16367

  • MQTT 5.0: a Receive Maximum value of 0 is now rejected per the protocol spec.

    GitHub issue: #17057

  • The MQTT retained message store now has per-virtual host limits on the number of retained
    messages and their total size. A message that would exceed either limit is not retained.

    The defaults are 100,000 messages and 1 GiB. Both can be changed, or set to infinity: 

    mqtt.retained_message_store.max_messages = 100000
mqtt.retained_message_store.max_size_bytes = 1073741824

    GitHub issue: #17189

STOMP Plugin

Enhancements

  • Following the footsteps of AMQP 1.0 and MQTT in previous years,
    the STOMP is now a standardlone protocol, that is, it is no longer built on AMQP 0-9-1.

    GitHub issue: #9141

    • stomp.max_connections is a new rabbitmq.conf setting that limits the concurrent
      number of STOMP client connections.

    GitHub issue: #16368

Web MQTT Plugin

Enhancements

  • The Strict-Transport-Security (HSTS) header value can now be configured
    using the web_mqtt.hsts.policy key: 

    web_mqtt.hsts.policy = max-age=31536000; includeSubDomains

    GitHub issue: #16772

  • A new web_mqtt.strict_origin_validation configuration key makes the plugin reject a WebSocket upgrade
    request without an Origin header when web_mqtt.allow_origins restricts the allowed origins.

    web_mqtt.allow_origins also accepts a new value, same_origin, which only allows requests whose
    Origin matches the origin of the request itself: 

    web_mqtt.allow_origins = same_origin
web_mqtt.strict_origin_validation = true

    GitHub issue: #16813

Web STOMP Plugin

Enhancements

  • The Strict-Transport-Security (HSTS) header value can now be configured
    using the web_stomp.hsts.policy key: 

    web_stomp.hsts.policy = max-age=31536000; includeSubDomains

    GitHub issue: #16772

  • A new web_stomp.strict_origin_validation configuration key makes the plugin reject a WebSocket upgrade
    request without an Origin header when web_stomp.allow_origins restricts the allowed origins.

    web_stomp.allow_origins also accepts a new value, same_origin, which only allows requests whose
    Origin matches the origin of the request itself: 

    web_stomp.allow_origins = same_origin
web_stomp.strict_origin_validation = true

    GitHub issue: #16813

Auth Backend OAuth 2 Plugin

Enhancements

  • OpenID Connect discovery responses fetched from identity providers are now
    validated according to OpenID Connect Discovery 1.0 spec seciton §4.3. See
    Discovery Payload Validation
    for details on validation rules and configuration options.

    GitHub issue: #17363

  • OAuth 2.0 scopes now ca be extracted using regular expressions.

    GitHub issue: #16196

Auth Backend Cache Plugin

Bug Fixes

  • The cache was never hit when the same user reconnected with the same credentials.

    On busy deployments this could put significant extra load on the upstream authentication
    backend and its dependencies, for example, the LDAP backend and the LDAP server(s) it uses.

    GitHub issues: #16255, #16258

Consistent Hashing Exchange Plugin

Bug Fixes

  • Routing no longer fails when the header it hashes on holds an empty array.

    GitHub issue: #17081

Federation Plugin

Bug Fixes

  • Under certain conditions, deleting a federated queue could modify an exchange with the same
    name in the same virtual host.

    GitHub issues: #16991, #16997

Shovel Plugin

Bug Fixes

  • Deleting a shovel that was still in the starting state left its status behind instead of deleting it.

    GitHub issue: #16767

  • A local shovel with src-delete-after set could transfer more messages than the configured number.

    GitHub issue: #17209

  • When the destination rejects a message, for example because the destination queue
    has x-overflow set to reject-publish and has reached its maximum length, the shovel
    now returns the message to the source queue as a failed delivery. A quorum source queue
    therefore dead-letters the message once it exceeds the delivery limit,
    instead of redelivering it to the shovel over and over (a regression in 4.3.0).

    With an AMQP 1.0 source, such a message used to be dead-lettered on the first rejection.
    Now this happens once it exceeds the delivery limit. A classic source queue has no
    delivery limit, so the message is returned to it until the destination accepts it.

    GitHub issue: #17794

  • A shovel with an AMQP 1.0 destination did not settle a message at the source when
    the destination rejected or released it, and eventually stopped forwarding messages.

    GitHub issue: #17794

  • A shovel with an AMQP 1.0 source could restart and forward some messages twice when
    the destination confirmed messages out of order.

    GitHub issue: #17794

  • A shovel with an AMQP 1.0 source could settle messages incorrectly after more than
    4 billion deliveries. With a local destination, it could acknowledge a message at the
    source before the destination confirmed it.

    GitHub issue: #17794

Erlang AMQP 0-9-1 Client

Enhancements

  • The auth_mechanism query parameter of an AMQP 0-9-1 URI is now restricted to
    the mechanisms the client actually supports (plain, amqplain, external,
    crdemo), and an unsupported value is now rejected when the URI is parsed
    rather than when the connection is established. This also applies to the
    Shovel and federation plugins, which parse URIs the same way.

  • Likewise, the verify query parameter of an AMQP 0-9-1 URI now only accepts
    verify_peer or verify_none, and an unsupported value is rejected when the
    URI is parsed rather than when the TLS connection is established.

Erlang AMQP 1.0 Client

Enhancements

  • Connection configuration now accepts a connect_timeout, applied to the socket
    connect and, for TLS, to the handshake as well. Without it, a peer that accepts the
    TCP connection and then stops responding blocks amqp10_client_sup indefinitely,
    which in turn blocks every other connection attempt in the node.
    Defaults are unchanged: infinity for TCP and TLS, 5000 ms for WebSockets.

Dependency Changes

  • osiris was upgraded to 1.14.1
  • ra was upgraded to 3.2.0
  • khepri was upgraded to 0.19.3
  • portunus was introduced at 0.14.0
  • thoas was dropped: JSON encoding and decoding now uses the Erlang/OTP json module

Source Code Archives

To obtain source code of the entire distribution, please download the archive named rabbitmq-server-4.4.0.tar.xz
instead of the source tarball produced by GitHub.

Check out latest releases or
releases around rabbitmq/rabbitmq-server v4.4.0

Don't miss a new rabbitmq-server release

NewReleases is sending notifications on new releases.

Get notifications