v0.8.49

First release since v0.8.11. It covers mqdb-cli 0.8.12 through 0.8.49; each change is described in detail in CHANGELOG.md.

Crate versions: mqdb-core 0.7.12, mqdb-agent 0.8.35, mqdb-wasm 0.3.6 (published to crates.io); mqdb-cluster 0.4.21 and mqdb-vault 0.1.7 ship inside the binaries.

Security

• Agent mode no longer executes its own responses as requests. A client could point its response topic at a request topic and have the internal service account run it, bypassing ownership and ACLs (#164, #169).
• Agent mode refuses requests whose response topic the sender may not publish to (#169). Behaviour change: under an ACL, a client now needs publish permission on its response topic.
• $DB/_sub control operations verify subscription ownership.
• $DB/u/# is always publish-protected.
• rustls 0.23.45 (GHSA-2mjx-qc3c-rqvc) and xxhash-rust 0.8.19 (GHSA-6g2r-675j-hx59).

Added

• Sparkplug Aware MQTT server, agent mode (--sparkplug-aware). Stores each edge node's latest NBIRTH and DBIRTH as retained certificates on $sparkplug/certificates/... (#173).
• Presence feed, agent and cluster (--presence). Retained connect/disconnect state on $DB/_presence/{client_id}.
• Compare-and-set on update and delete (_expected_version, terminal 412).
• Diagram sharing in cluster mode (password/username and identity modes), and pending grants for unregistered emails. Grantee emails are no longer stored in plaintext.
• mqdb share, unshare, shares, shared commands.
• mqdb dev test --sharing and --presence.
• Incomplete-mesh detection for clusters.

Fixed: cluster

• Raft: no two leaders in one term when nodes start with partial peer lists. Followers reject and stop persisting entries that do not attach to their log. A node joining after log compaction now receives the partition map. A Raft storage failure stops the node.
• Unique constraints: several oversell windows are closed, including membership changes, correlated node loss and an empty voter set. Deleting a record releases its unique claim.
• Peer transport: a timed-out send no longer corrupts the stream. Heartbeats and Raft traffic are prioritised over bulk data. Dead peers are re-dialled.
• Sessions (with mqtt5 0.47): a persistent client that reconnects is reachable from other nodes again. Disconnect cleanup follows session expiry.
• Data: TTL cleanup goes through the replicated delete path. shared returns resources rather than grant rows. Subscriptions survive a missed broadcast.

Fixed: agent

• on_delete=set_null no longer corrupts typed fields.
• add_index keeps earlier indexes and survives a crash mid-backfill.
• TTL cleanup releases unique guards.
• Writes right after ready publish their change events.
• Graceful shutdown on SIGINT/SIGTERM.
• Nodes no longer rewrite the password file at startup. Behaviour change: --passwd must point to an existing file.

Upgrade notes

• mqtt5 0.39 → 0.47.2. Agent-mode MQTT storage at <db>/mqtt_storage migrates one-way to format 2, so older binaries cannot read it afterwards.
• Session expiry: the 1-hour session expiry cap is now enforced.
• IDs: server-generated ids are UUID v7.
• Toolchain: the Rust toolchain is pinned to 1.98.0.

Known limitations

• Cluster retained messages can go stale on other nodes after an update (#172). Sparkplug Aware is agent-only until that is fixed.
• MQTT 3.1.1 subscribers receive MQTT 5 properties inside retained payloads (LabOverWire/mqtt-lib#213). Use MQTT 5 clients until mqtt5 ships the fix.