release-notes/4.2.6.md
RabbitMQ 4.2.6 is a maintenance release in the 4.2.x release series.
It is strongly recommended that you read 4.2.0 release notes
in detail if upgrading from a version prior to 4.2.0.
RabbitMQ and Erlang/OTP Compatibility Matrix has more details on Erlang version requirements for RabbitMQ.
Nodes will fail to start on older Erlang releases.
Release notes can be found on GitHub at rabbitmq-server/release-notes.
Quorum queues: get_checked_out aux command could return messages in incorrect order
GitHub issue: #16008
rabbitmqctl forget_cluster_node now removes all quorum queue and stream members (replicas)
before proceeding to leave the metadata store cluster.
This order minimizes the risk of some replicas being left behind on the leaving node.
GitHub issue: #15729
The channel limit exceeded error message now correctly identifies the per-user limit as the reason
GitHub issue: #15750
AMQP 0-9-1: configure permission checks now apply to passive queue and exchange declarations,
matching the behavior of their regular counterparts
Khepri: missing keys are now correctly distinguished from errors in certain internal operations, avoiding spurious error-level log messages
GitHub issue: #15942
Bindings targeting Direct Reply-to pseudo-queues are now rejected instead of being silently accepted without any functional effect
GitHub issue: #15935
More rabbitmq.conf keys now accept tagged values (e.g., encrypted:...)
GitHub issue: #15808
When quorum queue members (replicas) are deleted from a node, either manually
via rabbitmq-queues shrink or as part of rabbitmqctl forget_cluster_node,
the members are stopped in parallel
GitHub issue: #15081
GitHub issue: #16085
AMQP 0-9-1: when a connection's credentials are refreshed, the permissions cache is now cleared and consumer permissions are re-validated immediately
GitHub issue: #16092
effective_policy_definition in HTTP API responses now returns an empty JSON object
(not an array or empty string) when no policy applies to a queue
GitHub issue: #16017
Management UI: OAuth 2 combined with basic_auth could fail to reload provider configuration correctly
GitHub issue: #15858
Management UI: preference cookie expiry now respects the configured session timeout setting rather than using a hardcoded value
GitHub issue: #15814
Management UI: users were presented with a 401 error after changing their own password via the UI. The session is now refreshed automatically
GitHub issue: #15730
The deprecated, unused GET /api/auth endpoint was removed
It has been out of use since 3.11 but never removed.
GitHub issue: #16083
POST /api/users/bulk-delete now respects the protected_users configuration,
matching the behavior of the single-user DELETE /api/users/:name endpoint
GitHub issue: #16143
Quorum queue status and stream tracking endpoints now enforce virtual host access checks, consistent with all other vhost-scoped endpoints
GitHub issue: #16104
HTTP API displays static connection info (peer address, TLS details, auth mechanism)
even when stats collection is disabled via rabbitmq.conf
GitHub issue: #16009
Super stream creation via HTTP API now verifies configure permission, matching
the stream protocol code path
GitHub issue: #16099
Management API regex filters (?name=...&use_regex=true) now enforce match limits,
preventing pathological patterns from consuming excessive CPU time
GitHub issue: #16074
Fixed a timing-sensitive issue around Last Will message delivery and session expiration
GitHub commit: 6f761130a7
MQTT QoS 0 queue type now reports member information in management API responses
GitHub issue: #15656
A default max_frame_size is now set on WebSocket connections, bounding decompressed frame sizes.
The limit starts at mqtt.max_packet_size_unauthenticated and is raised after successful CONNECT
GitHub issue: #16180
A login_timeout is now enforced for WebSocket connections, matching the TCP listener behavior
GitHub issue: #16120
WebSocket Origin header validation is now available via web_mqtt.allow_origins
GitHub issue: #16158
A default max_frame_size is now set on WebSocket connections. A smaller pre-authentication
limit is raised after successful STOMP CONNECT, matching the Web MQTT pattern
GitHub issue: #16180
A login_timeout is now enforced for WebSocket connections, matching the TCP listener behavior
GitHub issue: #16120
WebSocket Origin header validation is now available via web_stomp.allow_origins
GitHub issue: #16158
AMQP 1.0 shovels now properly detach links when closing connections, preventing spurious error log entries during shutdown
GitHub issue: #15603
AMQP 1.0 shovel status no longer includes full connection URIs in API responses and CLI output
GitHub issue: #16108
DELETE operations now require the policymaker tag, matching the
federation plugin counterpart
GitHub issue: #16051
Federation link restart operations now require the policymaker tag
GitHub issue: #16051
The auth cache backend now correctly delegates token expiry timestamps to the wrapped backend, ensuring connections are closed when tokens expire
GitHub issue: #16100
OAuth 2 management UI: improved provider configuration loading and rendering
GitHub issue: #15858
DN values are now handled per RFC 4514
GitHub issue: #16101
Refactored certificate identification to avoid (unlikely) conflicts
GitHub issue: #16116
Proper CLI commands for trust store certificate management have been introduced
GitHub issue: #15746
Rejected certificates are now logged with additional diagnostic details
GitHub issue: #15889
Binding weights above 10,000 are now rejected. Previously, extremely large weights could cause excessive memory allocation
GitHub issue: #16118