LoginSign Up
← Back to all sparks
A

Apache ActiveMQ

DEVOPS
Velocity5.0

Multi-protocol open-source message broker

activemq.apache.org ↗

ActiveMQ ships every fix three times, across three parallel maintenance branches.

message-brokersecurity-hardeningamqpmulti-branch-releasesjms
◆Current state
ActiveMQ maintains three active branches — 5.19.x, 6.2.x, and the newly bootstrapped 6.3.x — and releases them in lockstep. On 6 August all three shipped the same AMQP object-message decompression fix within six hours of each other, and the same pattern holds back through July and June. The dominant theme is security hardening rather than features: AMQP frame-size validation with a lower default maxFrameSize, MQTT control-packet and wireformat validation, the message servlet disabled by default, the web console restricted to the admin role, and more transport types denied in JMX.
◆Where it's heading
The work is a sustained audit of the broker's exposed surface, and it consistently tightens defaults rather than adding options — disable, restrict, validate, lower the limit. Each change is then backported across all three branches, which is why releases arrive in triplets and why the changelogs read as near-duplicates. Resource accounting is the secondary thread, with fixes preventing cursors from exceeding temp store, correcting topic store and temp usage tracking, and fixing queue size for non-persistent messages with a TTL.
◆Prediction
Expect the triplet release pattern to continue, with fixes landing on 6.3.x and backporting to 6.2.x and 5.19.x. Operators moving across minors should read the default changes closely, since several of these are behaviour changes rather than additions.

◆Recent moves

  1. 12d ago

    5.19.10 backports the AMQP object-message decompression fix

    The 5.19.x cut of the AMQP object-message decompression fix, otherwise a wall of Maven plugin and slf4j bumps. One of three releases carrying the same fix to different branches on the same day.

    View source ↗
  2. 12d ago

    6.2.9 backports the AMQP object-message decompression fix

    The 6.2.x cut of the same decompression fix, with Groovy, JAXB, Karaf and slf4j bumps alongside. Substantively identical to the 5.19.10 and 6.3.1 releases published the same day.

    View source ↗
  3. 12d ago

    6.3.1 moves the Docker image to Eclipse Temurin 25

    The first patch on the new 6.3.x branch, carrying the shared decompression fix plus a move to Eclipse Temurin 25 for the Docker image. The JDK base-image bump is the one thing in this triplet that is not a straight backport.

    View source ↗
  4. 22d ago

    5.19.9 lowers the default AMQP frame size and fixes usage tracking

    A substantial hardening release: the default AMQP maxFrameSize drops to 10 MB, frame-size validation is tightened, cursors are prevented from exceeding 100% of temp store, and topic store and temp usage tracking are corrected. The lowered default is a behaviour change that operators with large messages need to notice before upgrading.

    View source ↗
  5. 22d ago

    6.2.8 mirrors the frame-size and temp store hardening

    The 6.2.x counterpart to 5.19.9, carrying the same frame-size default change, validation, and temp store limits, plus backported fixes for AMQ-9813. Released within seconds of its sibling, as usual for this project.

    View source ↗
  6. 22d ago

    6.3.0 opens a new branch with MQTT validation and a CRON deadlock fix

    The minor that opens the 6.3 line, adding MQTT control-packet and wireformat validation, fixing a deadlock in CRON scheduling, and correcting queue size for non-persistent messages with a TTL. It also drops 'classic' from the repository metadata, a naming change the notes do not explain.

    View source ↗