Apache ActiveMQ vs Auth0

ActiveMQ maintains three active branches — 5.19.x, 6.2.x, and the newly bootstrapped 6.3.x — and releases them in lockstep. On 6 August all three shipped the same AMQP object-message decompression fix within six hours of each other, and the same pattern holds back through July and June. The dominant theme is security hardening rather than features: AMQP frame-size validation with a lower default maxFrameSize, MQTT control-packet and wireformat validation, the message servlet disabled by default, the web console restricted to the admin role, and more transport types denied in JMX.

The work is a sustained audit of the broker's exposed surface, and it consistently tightens defaults rather than adding options — disable, restrict, validate, lower the limit. Each change is then backported across all three branches, which is why releases arrive in triplets and why the changelogs read as near-duplicates. Resource accounting is the secondary thread, with fixes preventing cursors from exceeding temp store, correcting topic store and temp usage tracking, and fixing queue size for non-persistent messages with a TTL.

Expect the triplet release pattern to continue, with fixes landing on 6.3.x and backporting to 6.2.x and 5.19.x. Operators moving across minors should read the default changes closely, since several of these are behaviour changes rather than additions.