Enhancement

• #14869 Added the connected_at timestamp field to the $events/client_disconnected event payload. This enhancement enables tracking the original connection session time for disconnected clients, preventing outdated disconnect events from overriding newer connection states.

  Previously, when clients frequently reconnected due to unstable networks, delayed disconnect events could lead to incorrect session tracking. With this update, the connected_at field is now included in the event payload, aligning its behavior with system topics and ensuring accurate session state management.

Bug Fixes

Core MQTT Functionalities

• #14815 Fixed packet ID release for QoS 2 messages. Previously, if a client failed to send a PUBREL for the maximum configured number of pending QoS 2 messages and then disconnected, the packet IDs remained occupied even after exceeding the configured Max Awaiting PUBREL Timeout.

Installation and Deployment

• #14797 Fixed macOS release package startup issue due to OpenSSL dynamic linking (backport #14624).

  Previously, the EMQX ZIP package on macOS could fail to start because the quicer application dynamically linked to the system-installed OpenSSL, which was not signed during the EMQX build process. Now we have disabled dynamic linking for OpenSSL, aligning with the OTP shipped on macOS. This ensures EMQX starts reliably on macOS 13 and later.

Authentication

• #14847 Fixed JWKS authentication failure for wildcard HTTPS endpoints. Previously, JWKS authentication failed to retrieve keys from HTTPS endpoints that used wildcard hostnames, preventing successful authentication.
• #14786 Fixed JWT authentication settings update when using an external JWKS endpoint. Previously, when updating JWT authentication settings with JWKS (key server) enabled in both the old and new configurations, some settings were not correctly applied.

REST API

• #14834 Fixed incorrect Content-Type header when downloading data backup files. Previously, the response header for downloaded backup files incorrectly used application/json instead of application/octet-stream.

Rule Engine

• #14824 Fixed HTTP 500 error in SQL Rule Tester when handling details key in alarm events. Previously, when testing alarm_activated or alarm_deactivated events in the SQL Rule Tester, certain values in the details key could cause an HTTP 500 error due to improper handling of nested map keys.

Observability

• #14800 Throttled warning level log dropped_qos0_msg.

• #14793 Added trace log for protocol_error in MQTT connections.

  Previously, when a client sent invalid or unexpected MQTT packets causing a protocol_error, EMQX logs provided limited details, making it difficult to diagnose the issue.

  For example, if a client sent a second CONNECT packet while already connected, EMQX would log socket_force_closed with protocol_error, but without indicating the exact cause.

  With this update, EMQX now logs unexpected_connect_packet with conn_state=connected before socket_force_closed, providing clearer context for debugging protocol violations.

Plugin

• #14802 Introduced a new CLI command for plugins:

   emqx ctl plugins allow NAME-VSN
  

Breaking Changes

• #14802 Starting from this version, plugin installation via the REST API or Dashboard requires explicit permission. Users must obtain this permission using the following CLI command before installing.

  emqx ctl plugins allow NAME-VSN
  

  This change enhances security by preventing unauthorized plugin installations. Users managing plugins via the API or Dashboard must adjust their workflows accordingly.