cert-manager vs RabbitMQ

RabbitMQ is maintaining 4.2.x and 4.3.x side by side, cutting matching patches into both on the same day, and both trains raised their floor to Erlang/OTP 27. Most of the window is correctness work in the Raft-backed subsystems — quorum queues losing metrics after a restart, leaders committing log entries too optimistically, classic queue index paths accumulating slashes, topic bindings with empty routing keys matching everything. The newest 4.3.5, however, is labelled a maintenance release while carrying encrypted management-UI login tokens, a new authentication logging category, ETag support on the definitions endpoint, and a self-deleting Shovel TTL.

The bug pattern remains the tell: nearly every fix is in quorum queues, Khepri or Raft, which is where RabbitMQ moved its metadata and durability story after 4.3.0 removed Mnesia and partition-handling strategies outright. Layered on top is a steady tightening of the operational perimeter — protocol parsers rejecting malformed input strictly across AMQP 1.0, MQTT 5.0 and STOMP, pre-authentication frame limits on stream connections, HTTP API endpoints validating node membership, and headers that stop disclosing supported methods. Feature work is arriving inside patch releases rather than waiting for a minor.

Expect the 4.2.x train to slow toward end-of-life while 4.3.x patches keep absorbing both Khepri edge cases and security-surface work. The encrypted login token, currently opt-in behind a shared cluster secret, is the kind of setting that gets promoted to a default once rolling-upgrade friction is behind it.