LoginSign Up
← Back to all sparks
O

Openfire

COMMS
Velocity2.5

Real-time collaboration server using the XMPP protocol.

www.igniterealtime.org/projects/openfire ↗

Openfire keeps its XMPP server current without changing what it is.

xmppmessaging-serverself-hostedmaintenancedependency-updatesprotocol-conformance
◆Current state
Openfire ships a maintenance release every one to two months, each a mix of dependency upgrades, MUC and pubsub correctness fixes, and occasional security hardening. 5.1.2 follows that shape exactly: Jetty, log4j2, and the PostgreSQL driver moved forward, three inapplicable Tomcat CVEs suppressed, and a set of MUC self-ping errors corrected to return the right XMPP error types. The last release with real feature content was 5.1.0 in June, which added channel binding and an admin console for failed server-to-server connections.
◆Where it's heading
The project's direction is protocol conformance and operational currency rather than new capability. Recent cycles have gone into XEP compliance details - self-ping error semantics, XEP-0398 presence handling, base64 whitespace tolerance - and into keeping the dependency tree clean enough to pass a scanner. That is a reasonable posture for infrastructure a decade into deployment, and nothing in the last six releases suggests a change of scope.
◆Prediction
Expect the same cadence: another patch in four to eight weeks carrying library bumps and MUC or pubsub conformance fixes, with anything larger held for a 5.2 line.

◆Recent moves

  1. 1d ago

    Openfire 5.1.2: MUC self-ping errors and library upgrades

    Library currency (Jetty 12.0.x, log4j2, PostgreSQL 42.7.12), three inapplicable Tomcat CVEs suppressed, and MUC self-ping corrections so a removed occupant no longer gets a misleading password error. The one item filed as a new feature - row-value comparison detection in DbConnectionManager - is internal capability probing with no user-facing effect.

    View source ↗
  2. 1mo ago

    Openfire 5.1.1: MUC and pubsub subscription fixes

    Error handling in the MUC service, duplicate-subscription policy consistency for collection nodes under multi-subscribe, and a Netty bump. Same maintenance shape as the release that followed it.

    View source ↗
  3. 2mo ago

    Channel binding support and S2S connection diagnostics

    The last release in this window with real feature content: channel binding support, an admin console page for reviewing failed server-to-server connection attempts, TCP port visibility for S2S, and removal of hardcoded IVs and a weak SHA1-derived blowfish key. Security posture and operator visibility both moved.

    View source ↗
  4. 3mo ago

    Openfire 5.0.5: dependency currency and logging fixes

    BouncyCastle, MySQL Connector/J, Jetty, and jaxb-runtime all moved forward, with better LDAP and security-audit logging. Routine upkeep on the 5.0 line.

    View source ↗
  5. 5mo ago

    Fixes high CPU from exception-based control flow

    A real performance fix - UserManager.isRegisteredUser() was using exceptions for control flow and burning CPU - alongside targeted pubsub cache purging and better TrustManager failure logging. The kind of item that matters more to operators than the version number suggests.

    View source ↗
  6. 8mo ago

    Openfire 5.0.3: driver upgrades and MUC fixes

    JDBC driver bumps, a ConcurrentModificationException on room join, an incorrect chat room count, and an unpopulated server_bytes_out statistic. Maintenance, and the oldest release still in this window.

    View source ↗