Apache ActiveMQ 6.3.0

What's Changed

• NO-JIRA: update repo meta-data to drop 'classic' mentions by @gemmellr in #1545
• AMQ-9810 - Add additional validation for MQTT control packets by @cshannon in #1546
• AMQ-9810 - Add additional validation for MQTT wireformat by @cshannon in #1547
• AMQ-9813 - fix wrong QueueSize for non-persistent message with TTL by @lenoch7 in #1551
• AMQ-9813 - Minor updates by @cshannon in #1553
• Bump to 6.3.0-SNAPSHOT by @jbonofre in #1548
• AMQ-8525: TransactedStoreUsageSuspendResumeTest slow fix by @jeanouii in #1539
• [NO-JIRA] Jenkinsfile: Update with parallelTests flag by @mattrpav in #1559
• AMQ-9808: Dead lock when using CRON schedule with AMQ_SCHEDULED_REPEAT by @jeanouii in #1536
• AMQ-9809: org.apache.activemq.perf.InactiveDurableTopicTest hanging by @jeanouii in #1537
• [AMQ-9817] Fix long running KahaDBOffsetRecoveryListenerTest on CI by @jeanouii in #1555
• [AMQ-9818] JournalCorruptionEofIndexRecoveryTest failing with OOME by @jeanouii in #1561
• AMQ-8525: improve stomp module performances by @jeanouii in #1540
• AMQ-8525 Improve execution of unit tests module by @jeanouii in #1542
• [AMQ-9820]: closed connections leaking into the pool when reconnectOnException is used by @jeanouii in #1564
• AMQ-9819 - Rework Rest test fix by @cshannon in #1565
• AMQ-9823 - properly clear ack set from ackAndPreparedMap by @cshannon in #1566
• Bump org.apache.logging.log4j:log4j-core from 2.25.2 to 2.25.3 by @dependabot[bot] in #1568
• AMQ-8525 Improve performance of amqp + kahadb store modules by @jeanouii in #1544
• AMQ-9824 - Cleanup code in KahaDB classes by @cshannon in #1567
• Use of GitHub Actions, and enable dependabot by @jbonofre in #1497
• Update the check context to use CI Quick by @jbonofre in #1606
• [AMQ-9815] Add additional attributes to ConnectorView by @mattrpav in #1556
• Bump org.apache.geronimo.specs:geronimo-atinject_1.0_spec from 1.0 to 1.2 by @dependabot[bot] in #1602
• Until Java 25 work is finished by @jeanouii in #1607
• Bump jolokia-version from 2.4.0 to 2.4.3 by @dependabot[bot] in #1611
• Facky tests revealed mainly with faster CI (aka Github Actions but also with Java 25) by @jeanouii in #1610
• Revert "Facky tests revealed mainly with faster CI (aka Github Actions but also with Java 25) (#1610)" by @mattrpav in #1617
• Bump camel-version from 4.14.2 to 4.14.4 by @jbonofre in #1615
• Bump org.apache.commons:commons-pool2 from 2.12.1 to 2.13.1 by @dependabot[bot] in #1605
• Bump spring-version from 6.2.12 to 6.2.15 by @dependabot[bot] in #1573
• ActiveMQ on Java until Java 24 (allow SecurityManager for tests) by @jeanouii in #1612
• Flaky tests GitHub actions by @jeanouii in #1621
• Bump org.apache.commons:commons-dbcp2 from 2.13.0 to 2.14.0 by @dependabot[bot] in #1586
• AMQ-9829 Track prefetched messages for duplicate suppression during failover by @jeanouii in #1616
• Update CI schedule to run hourly by @jeanouii in #1625
• Batch of flaky tests fixes by @jeanouii in #1622
• Configure broker to check for expired messages every second in tests by @jeanouii in #1626
• Bump org.ops4j.pax.url:pax-url-aether from 2.6.11 to 2.6.17 by @dependabot[bot] in #1589
• Bump org.easymock:easymock from 3.2 to 3.6 by @dependabot[bot] in #1581
• Bump org.apache.aries.blueprint:org.apache.aries.blueprint.core from 1.10.2 to 1.10.3 by @dependabot[bot] in #1580
• Refactor JMSConsumerTest and ZeroPrefetchConsumerTest by @jeanouii in #1628
• Bump org.apache.groovy:groovy-ant from 5.0.2 to 5.0.4 by @dependabot[bot] in #1623
• Bump org.apache.groovy:groovy from 5.0.2 to 5.0.4 by @dependabot[bot] in #1624
• Bump com.fasterxml.jackson.core:jackson-annotations from 2.20 to 2.21 by @dependabot[bot] in #1620
• Bump jackson-version from 2.20.1 to 2.21.0 by @dependabot[bot] in #1619
• Bump org.codehaus.mojo:javacc-maven-plugin from 3.1.1 to 3.2.0 by @dependabot[bot] in #1618
• Bump org.ow2.asm:asm from 9.9 to 9.9.1 by @dependabot[bot] in #1604
• Bump karaf-version from 4.3.7 to 4.4.9 by @dependabot[bot] in #1603
• Bump org.apache.cxf:cxf-xjc-plugin from 4.0.2 to 4.1.1 by @dependabot[bot] in #1600
• Bump org.apache.geronimo.specs:geronimo-annotation_1.3_spec from 1.0 to 1.3 by @dependabot[bot] in #1599
• Bump org.jmdns:jmdns from 3.6.2 to 3.6.3 by @dependabot[bot] in #1596
• [AMQ-9830] Replaces commons-io usage in activemq-jaas with Java nio by @mattrpav in #1629
• Bump jakarta.servlet.jsp.jstl:jakarta.servlet.jsp.jstl-api from 3.0.0 to 3.0.2 by @dependabot[bot] in #1597
• Bump jakarta.websocket:jakarta.websocket-api from 2.1.1 to 2.2.0 by @dependabot[bot] in #1593
• Bump org.apache.maven.plugins:maven-rar-plugin from 3.0.0 to 3.1.0 by @dependabot[bot] in #1592
• Bump org.codehaus.mojo:taglist-maven-plugin from 3.2.1 to 3.2.2 by @dependabot[bot] in #1591
• Bump org.owasp:dependency-check-maven from 12.1.8 to 12.2.0 by @dependabot[bot] in #1590
• Bump commons-io:commons-io from 2.20.0 to 2.21.0 by @dependabot[bot] in #1583
• Bump xbean-version from 4.28 to 4.29 by @dependabot[bot] in #1577
• Upgrade to Apache POM 37 by @jbonofre in #1570
• Bump org.apache.qpid:qpid-jms-client from 2.4.0 to 2.9.0 by @dependabot[bot] in #1598
• Bump pax-exam-version from 4.13.1 to 4.14.0 by @dependabot[bot] in #1584
• Bump commons-codec:commons-codec from 1.15 to 1.20.0 by @dependabot[bot] in #1576
• Bump org.eclipse.jdt:ecj from 3.17.0 to 3.44.0 by @dependabot[bot] in #1575
• Bump maven-core-version from 3.8.6 to 3.9.12 by @dependabot[bot] in #1601
• Bump org.sonarsource.scanner.maven:sonar-maven-plugin from 5.2.0.4988 to 5.5.0.6356 by @dependabot[bot] in #1585
• Enable publishing of test results in CI workflows by @jeanouii in #1637
• Add VM transport broker restart test by @pradeep85841 in #1631
• the Apache org only allows EnricoMi/publish-unit-test-result-action by @jeanouii in #1638
• AMQ-9851 Set preallocation scope to NONE in JournalFdRecoveryTest by @jeanouii in #1640
• AMQ-9852 Ensure advisory consumer receives producer advisory before creation to prevent race conditions by @jeanouii in #1641
• AMQ-9853 Ensure consumer is closed after all acknowledgments are processed by @jeanouii in #1643
• AMQ-9845 Fix race condition in AMQ4889Test by @jeanouii in #1630
• AMQ-9843 Handle InstanceNotFoundException during MBean unregistration… by @jeanouii in #1635
• AMQ-9854 Add wait for broker to process disconnect before publishing … by @jeanouii in #1646
• Bump org.apache.cxf:cxf-xjc-plugin from 4.1.1 to 4.1.2 by @dependabot[bot] in #1632
• Bump org.jvnet.jaxb:jaxb-plugins-runtime from 4.0.8 to 4.0.12 by @dependabot[bot] in #1578
• Bump commons-codec:commons-codec from 1.20.0 to 1.21.0 by @dependabot[bot] in #1642
• AMQ9844 Refactor ReloadableProperties and PropertiesLoginModuleRaceCo… by @jeanouii in #1636
• Bump xbean-version from 4.29 to 4.30 by @dependabot[bot] in #1639
• Bump netty-version from 4.1.94.Final to 4.2.9.Final by @dependabot[bot] in #1572
• Flaky Tests and bug fixes by @jeanouii in #1634
• Multi broker setup hardening by @jeanouii in #1627
• [#] Ignore JournalFdRecoveryTest due to flakiness by @jeanouii in #1650
• [#] Disable fail-fast in CI strategy to improve job resilience by @jeanouii in #1651
• Decrease to 4 times a day by @jeanouii in #1653
• Bump org.ops4j.pax.url:pax-url-aether from 2.6.17 to 2.7.0 by @dependabot[bot] in #1652
• Bump netty-version from 4.2.9.Final to 4.2.10.Final by @dependabot[bot] in #1658
• Bump shiro-version from 2.0.6 to 2.1.0 by @dependabot[bot] in #1660
• ActiveMQ on Java 25 by @jeanouii in #1563
• Enhance JournalFdRecoveryTest to verify message recovery after journal file deletion by @jeanouii in #1644
• [AMQ-9806] Add H2 database support by @mattrpav in #1535
• AMQ-9812: Allow user to set ACTIVEMQ_OPTS and ACTIVEMQ_OPTS_MEMORY env variables in Docker image by @jbonofre in #1664
• [AMQ-9859] IOHelper: Do not swallow thrown exception to lose stacktrace when move fails (esp on windows) by @mattrpav in #1655
• [AMQ-9769] Add name property to connector interface and MBean. by @thezbyg in #1493
• AMQ-9775: Add the maxBrowsePageSize attribute to the JMX destination MBean by @jbonofre in #1500
• [AMQ-9860] [AMQ-9861] connection async exception handling and activemq pool tests connection leaks to other tests by @jeanouii in #1657
• AMQ-9588: Run ActiveMQ with regular user in Docker container, and hook to easily stop the container by @jbonofre in #1665
• Spring tests: refactor listener and broker config to use ephemeral ports by @jeanouii in #1672
• Build: consolidate surefire reuseForks configuration to avoid each mo… by @jeanouii in #1671
• Bump spring-version from 6.2.15 to 6.2.16 by @dependabot[bot] in #1676
• For connections created outside the global field, use try-with-resour… by @jeanouii in #1667
• Introduce weekly CI build for comprehensive testing, and limit multi … by @jeanouii in #1678
• Feat/introduce weekly build by @jeanouii in #1681
• Fix copy-paste bug in MessageGroupLateArrivalsTest assertion by @jeanouii in #1680
• Update GitHub configuration by @jbonofre in #1682
• Remove required checks to avoid blocking PRs again in the future by @jbonofre in #1683
• Bump jolokia-version from 2.4.3 to 2.5.0 by @dependabot[bot] in #1663
• Bump karaf-version from 4.4.9 to 4.4.10 by @dependabot[bot] in #1684
• MQTT: stabilize offline durable subscription waits by @jeanouii in #1677
• Tolerate flaky tests here because it would fail the entire matrix. by @jeanouii in #1685
• Replace Thread.sleep with Wait.waitFor in FailoverClusterTest by @jeanouii in #1679
• Use ephemeral ports in HTTP/WS transport tests by @jeanouii in #1675
• Use destination statistics instead of global statistics to avoid side… by @jeanouii in #1668
• Increase timeout for weekly CI build and ensure test results are always uploaded by @jeanouii in #1686
• [AMQ-9856] Journal move fails on Windows by @jeanouii in #1654
• Refactor AMQ3529v2Test to improve thread handling and logging consistency by @jeanouii in #1649
• Update copyright year in NOTICE files by @jbonofre in #1690
• Add stale PR and issue policy by @jbonofre in #1689
• Enable GitHub Issues and Discussions by @jbonofre in #1688
• Proper Appender lifecycle to assert log messages by @jeanouii in #1670
• Remove unnecessary test profiles from pom.xml and consolidate performance/load test exclusions by @jeanouii in #1692
• Windows does not like -P followed by -D by @jeanouii in #1693
• Bump actions/stale from 10.1.1 to 10.2.0 by @dependabot[bot] in #1696
• Bump camel-version from 4.14.4 to 4.18.0 by @dependabot[bot] in #1695
• Update CI configuration to use bash on Windows and profile for quick … by @jeanouii in #1700
• Support ephemeral ports in network config and Spring by @jeanouii in #1674
• Protect the active branches by @jbonofre in #1697
• Publish test results on failure by @cshannon in #1705
• Flaky tests by @jeanouii in #1704
• Fix/more ephemeral ports by @jeanouii in #1703
• Bump jackson-version from 2.21.0 to 2.21.1 by @dependabot[bot] in #1709
• Bump jolokia-version from 2.5.0 to 2.5.1 by @dependabot[bot] in #1694
• fix(kahadb-store): Fix Windows CI hanging by adding timeout for forke… by @jeanouii in #1708
• Relax timeouts and macOS exclusions + small fixes by @jeanouii in #1673
• Improve duplex network wait conditions and ports by @jeanouii in #1669
• test(unit-tests): improve reliability of message consumption in tests by @jeanouii in #1711
• #AMQ-8525 run mqtt parallel-friendly tests into separate forks in parallel by @jeanouii in #1541
• feat(tck): Add Jakarta Messaging 3.1 TCK with some fixes by @jeanouii in #1712
• Bump org.mockito:mockito-core from 5.21.0 to 5.22.0 by @dependabot[bot] in #1730
• Bump org.apache.felix:maven-bundle-plugin from 6.0.0 to 6.0.2 by @dependabot[bot] in #1729
• fix(#1731): adapter deadlock by @jeanouii in #1735
• fix(test): fix CompositeConsumerNetworkBridgeTest flakiness by @jbonofre in #1742
• fix(test): fix ZeroPrefetchConsumerTest flakiness caused by receiveNoWait() reace by @jbonofre in #1741
• Bump commons-logging:commons-logging from 1.3.5 to 1.3.6 by @dependabot[bot] in #1744
• Improve PortfolioPublishServlet encoding by @cshannon in #1745
• fix(test): replace Thread.sleep with Wait.waitFor in ZeroPrefetchConsumerTest by @jbonofre in #1746
• fix(footer): update copyright year to 2026 in footer files by @caapos in #1749
• fix(test): fix CachedLDAPAuthorizationModuleLegacyTest flakiness caused by Thread.sleep() by @jbonofre in #1748
• Add parallel test annotations to multiple test classes by @jeanouii in #1687
• fix(test): fix MQTTTest#testReceiveMessageSentWhileOffline flakiness by @jbonofre in #1751
• Bump org.eclipse.jdt:ecj from 3.44.0 to 3.45.0 by @dependabot[bot] in #1750
• fix(tests): fix flaky tests by @jeanouii in #1753
• fix(test): update DurableSyncNetworkBridgeTest by @jeanouii in #1755
• fix(assembly): add missing jolokia-core to assembly descriptor by @jbonofre in #1758
• Bump org.mockito:mockito-core from 5.22.0 to 5.23.0 by @dependabot[bot] in #1760
• Fix Jakarta 3.1 compliance for Character property types by @pradeep85841 in #1736
• Bump spring-version from 6.2.16 to 6.2.17 by @dependabot[bot] in #1764
• Bump maven-core-version from 3.9.12 to 3.9.14 by @dependabot[bot] in #1763
• fix(#1776): honor ACTIVEMQ_WEB_USER variable by @jeanouii in #1767
• fix(test): batch of fixes for weekly only tests by @jeanouii in #1759
• feat(#1739): Add requestTimeout to ConnectionFactory to prevent hanging threads in syncSendPacket() by @jbonofre in #1740
• fix(broker): improve error message for RMI registry creation failure by @jbonofre in #1762
• feat(assembly): add Docker image build support via Maven profile (#1701) by @jbonofre in #1757
• feat(ci): improve GitHub Actions workflows by @jbonofre in #1773
• fix(test): resolve flaky tests by @jeanouii in #1774
• fix(dependabot): catch all dependency updates by @jbonofre in #1775
• feat(helm): add Helm chart for ActiveMQ broker deployment by @jbonofre in #1761
• build(deps): bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #1779
• build(deps): bump osgi-version from 6.0.0 to 7.0.0 by @dependabot[bot] in #1780
• build(deps): bump org.glassfish.jaxb:jaxb-bom from 4.0.6 to 4.0.7 by @dependabot[bot] in #1783
• build(deps): bump actions/checkout from 4 to 6 by @dependabot[bot] in #1777
• build(deps-dev): bump io.fabric8:docker-maven-plugin from 0.45.1 to 0.48.1 by @dependabot[bot] in #1776
• fix(test): set queue prefetch in UsageBlockedDispatchTest to prevent flaky failure by @jbonofre in #1765
• Improve FactoryFinder Validation by @cshannon in #1793
• AMQP: added transport factory unit tests for mutex stripping and monitor wiring. by @anmol-saxena-14 in #1725
• chore: remove unused dependencies and version properties by @jbonofre in #1812
• build(deps): bump org.codehaus.jettison:jettison from 1.5.4 to 1.5.5 by @dependabot[bot] in #1811
• build(deps): bump org.apache.felix:org.apache.felix.framework from 5.6.12 to 7.0.5 by @dependabot[bot] in #1790
• build(deps): bump actions/setup-java from 4 to 5 by @dependabot[bot] in #1778
• chore: remove obsolete Maven profiles by @jbonofre in #1813
• AMQ-9365 - use ephemeral port and disable JMX in tests to prevent parallel CI conflicts. by @anmol-saxena-14 in #1819
• build(deps): bump org.ops4j.pax.url:pax-url-aether from 2.7.0 to 3.0.2 by @dependabot[bot] in #1788
• build(deps): bump jackson-version from 2.21.1 to 2.21.2 by @dependabot[bot] in #1820
• chore: migrate tests from JMock to Mockito by @jbonofre in #1814
• Fix/recuring flaky tests by @jeanouii in #1791
• build(deps-dev): bump netty-version from 4.2.10.Final to 4.2.11.Final by @dependabot[bot] in #1827
• Fix FactoryFinder path resolution in Windows by @cshannon in #1831
• (fix/test) flaky testAdvisoryForwardingDuplexNC by @gurpartap3697 in #1832
• [#1823] Align DestinationView and DestinationViewMBean by @mattrpav in #1824
• Prevent a VM transport from being used with BrokerView by @cshannon in #1840
• Also validate nested composite URIs used with BrokerView by @cshannon in #1847
• (Fix/test) flaky testForceExpirationZeroOverrideDLQ in MessageInterceptorStrategyTest by @gurpartap3697 in #1852
• build(deps-dev): bump netty-version from 4.2.11.Final to 4.2.12.Final by @dependabot[bot] in #1833
• build(deps): bump org.apache.groovy:groovy-ant from 5.0.4 to 5.0.5 by @dependabot[bot] in #1856
• build(deps): bump org.apache.groovy:groovy from 5.0.4 to 5.0.5 by @dependabot[bot] in #1857
• Ensure AMQP protocol marshals messages before passing to broker by @cshannon in #1859
• build(deps): bump camel-version from 4.18.0 to 4.18.1 by @dependabot[bot] in #1855
• build(deps): bump org.apache.ant:ant from 1.10.15 to 1.10.16 by @dependabot[bot] in #1866
• build(deps): bump log4j-version from 2.25.3 to 2.25.4 by @dependabot[bot] in #1854
• Fix flaky XACompletionTest by adding wait for async states by @gurpartap3697 in #1862
• AMQ-9386: Remove legacy IBM JDK-specific test paths from MBeanTest and StompTest. by @anmol-saxena-14 in #1863
• [#1842] [AMQ-9858] Support purging the first number of messages from a queue by @mattrpav in #1662
• Optimize SecurityContext#isInOneOf by @cshannon in #1874
• Revert "Optimize SecurityContext#isInOneOf (#1874)" by @cshannon in #1875
• Fix flaky AMQ6133PersistJMSRedeliveryTest by @gurpartap3697 in #1872
• Fix flakiness in AdvisoryViaNetworkTest by verifying peer broker info on both sides of duplex network by @gurpartap3697 in #1867
• [#1826] fix(test): Fix flakiness in AMQ4930Test by @gurpartap3697 in #1825
• [#NI] Add back in rerunFailingTests flag for unit tests by @cshannon in #1880
• Optimize SecurityContext#isInOneOf attempt 2 by @cshannon in #1879
• Properly handle SSL handshake updates by @cshannon in #1885
• [AMQ-9569][#1882] SSL handshake write timeout enforcement by @jeanouii in #1883
• (test/fix) race condition in network bridge advisory subscription initialization in AMQ6366Test by @gurpartap3697 in #1895
• (Fix/ci) remove surefire rerun flag when tests are skipped by @gurpartap3697 in #1897
• Also add rerunFailingTestFlag back to Jenkins builds by @cshannon in #1881
• Minor bug fix for BrokerView#validateAllowedUri by @cshannon in #1900
• build(deps): bump org.apache.ant:ant from 1.10.16 to 1.10.17 by @dependabot[bot] in #1909
• Restrict URL protocol types loaded by XBeanBrokerFactory by @cshannon in #1910
• build(deps-dev): bump org.owasp:dependency-check-maven from 12.2.0 to 12.2.1 by @dependabot[bot] in #1908
• Make brokerName immutable in RegionBroker by @cshannon in #1917
• Add Http discovery transport to denied list for JMX by @cshannon in #1918
• [#1911] Update resource cleanup on queueBrowse servlet by @mattrpav in #1912
• [#1913] Update DestinationView uri resolution by @mattrpav in #1914
• Fix flaky DurableSubInBrokerNetworkTest by replacing fixed sleeps with Wait.waitFor polling by @gurpartap3697 in #1906
• Fix 'occured' -> 'occurred' typos in 3 files by @SAY-5 in #1939
• Queue browse improvements in webconsole by @cshannon in #1938
• build(deps): bump maven-core-version from 3.9.14 to 3.9.15 by @dependabot[bot] in #1941
• Fix variable rename by @cshannon in #1944
• fix(webconsole): the webconsole now redirect to the slave.jsp when required by @jbonofre in #1931
• build(deps-dev): bump org.sonarsource.scanner.maven:sonar-maven-plugin from 5.5.0.6356 to 5.6.0.6792 by @dependabot[bot] in #1947
• Add more transport types to the denied list for JMX by @cshannon in #1949
• Add remote file filtering for XBeanBrokerFactory by @cshannon in #1950
• build(deps): bump org.javassist:javassist from 3.30.2-GA to 3.31.0-GA by @dependabot[bot] in #1948
• fix(test): avoid race condition in TwoBrokerVirtualTopicSelectorAwareForwardingTest by @jbonofre in #1951
• build(deps-dev): bump commons-io:commons-io from 2.21.0 to 2.22.0 by @dependabot[bot] in #1956
• Fix flaky NetworkAdvancedStatisticsTest race condition by @pradeep85841 in #1960
• Add more transport types to the denied list for JMX part 2 by @cshannon in #1972
• build(deps): bump commons-codec:commons-codec from 1.21.0 to 1.22.0 by @dependabot[bot] in #1971
• build(deps): bump org.ops4j.pax.url:pax-url-aether from 3.0.2 to 3.0.3 by @dependabot[bot] in #1969
• build(deps): bump jolokia-version from 2.5.1 to 2.6.0 by @dependabot[bot] in #1977
• build(deps): bump jackson-version from 2.21.2 to 2.21.3 by @dependabot[bot] in #1976
• Execute CI on activemq-5.19.x and activemq-6.2.x branches by @jbonofre in #1957
• [AMQ-9485] Host activemq-protobuf modules for modernization by @mattrpav in #1209
• [#1981] Convert deprecated TransportConnector.conenctionCount() calls to use TransportConnector.getConnectionCount() by @mattrpav in #1982
• build(deps-dev): bump netty-version from 4.2.12.Final to 4.2.13.Final by @dependabot[bot] in #1989
• build(deps): bump org.apache.groovy:groovy-ant from 5.0.5 to 5.0.6 by @dependabot[bot] in #1995
• build(deps): bump log4j-version from 2.25.4 to 2.26.0 by @dependabot[bot] in #1994
• build(deps): bump org.jvnet.jaxb:jaxb-plugins-runtime from 4.0.12 to 4.0.13 by @dependabot[bot] in #1990
• build(deps): bump org.apache.groovy:groovy from 5.0.5 to 5.0.6 by @dependabot[bot] in #1996
• build(deps-dev): bump org.apache.cxf:cxf-xjc-plugin from 4.1.2 to 4.2.0 by @dependabot[bot] in #1991
• build(deps): bump org.glassfish.jaxb:jaxb-bom from 4.0.7 to 4.0.8 by @dependabot[bot] in #1988
• build(deps-dev): bump org.owasp:dependency-check-maven from 12.2.1 to 12.2.2 by @dependabot[bot] in #1987
• [#1979] activemq-protobuf: Convert to using Long.valueOf Double.valueOf by @mattrpav in #1980
• build(deps): bump org.apache:apache from 37 to 38 by @dependabot[bot] in #2002
• build(deps): bump slf4j-version from 2.0.17 to 2.0.18 by @dependabot[bot] in #2007
• Block the XBeanBrokerFactory by default inside VMTransportFactory by @cshannon in #2003
• Handle validation for Composite URIs without parens by @cshannon in #2004
• Disable the message servlet by default by @cshannon in #2000
• [#2005] Fix authorization check on removeDestination by @mattrpav in #2006
• build(deps): bump org.jvnet.jaxb:jaxb-plugins-runtime from 4.0.13 to 4.0.14 by @dependabot[bot] in #2001
• build(deps): bump org.ow2.asm:asm from 9.9.1 to 9.10 by @dependabot[bot] in #2021
• [#] Updated SECURITY.md by @mattrpav in #2018
• build(deps): bump maven-core-version from 3.9.15 to 3.9.16 by @dependabot[bot] in #2024
• Remove "java.lang" package as a default allowed serializable package by @cshannon in #2026
• build(deps-dev): bump netty-version from 4.2.13.Final to 4.2.14.Final by @dependabot[bot] in #2032
• build(deps): bump actions/stale from 10.2.0 to 10.3.0 by @dependabot[bot] in #2033
• Harden web console and Jolokia access by default by @jbonofre in #2025
• [#] Fix flaky test: ActiveDurableSubscriptionBrowseExpireTest.java by @mattrpav in #1986
• [#] SECURITY.md updates by @mattrpav in #2034
• build(deps): bump shiro-version from 2.1.0 to 2.2.0 by @dependabot[bot] in #2023
• Harden default broker and web console configuration by @jbonofre in #2029
• build(deps): bump org.ow2.asm:asm from 9.10 to 9.10.1 by @dependabot[bot] in #2043
• build(deps): bump karaf-version from 4.4.10 to 4.4.11 by @dependabot[bot] in #1978
• build(deps): bump camel-version from 4.18.1 to 4.20.0 by @dependabot[bot] in #1970
• Add dependabot on activemq-6.2.x and activemq-5.19.x branches by @jbonofre in #2040
• Ensure connection info is processed before durable sync by @cshannon in #2047
• Update docs and default configs for advisory topics by @cshannon in #2055
• Update Stomp transports with improved validation by @cshannon in #2064
• Improve Stomp protocol error messages by @cshannon in #2067
• Send advisory messages using Broker connection context by @cshannon in #2071
• Add https to BrokerView restricted list by @cshannon in #2073
• Add validation for WireFormatInfo by @cshannon in #2080
• Ensure at most one BrokerInfo command is received by @cshannon in #2083
• Adding missing jsp escapes by @cshannon in #2089
• Restrict full web console URI to admins role by @jbonofre in #2074
• Limit WireFormatInfo platform details to a reasonable length by @cshannon in #2088
• build(deps): bump org.jvnet.jaxb:jaxb-plugins-runtime from 4.0.14 to 4.0.16 by @dependabot[bot] in #2084
• build(deps-dev): bump netty-version from 4.2.14.Final to 4.2.15.Final by @dependabot[bot] in #2069
• build(deps): bump org.glassfish.jaxb:jaxb-bom from 4.0.8 to 4.0.9 by @dependabot[bot] in #2053
• build(deps-dev): bump org.eclipse.jdt:ecj from 3.45.0 to 3.46.0 by @dependabot[bot] in #2085
• build(deps-dev): bump org.sonarsource.scanner.maven:sonar-maven-plugin from 5.6.0.6792 to 5.7.0.6970 by @dependabot[bot] in #2050
• build(deps): bump jackson-version from 2.21.3 to 2.22.0 by @dependabot[bot] in #2072
• build(deps): bump com.fasterxml.jackson.core:jackson-annotations from 2.21 to 2.22 by @dependabot[bot] in #2070
• build(deps): bump org.springframework:spring-webmvc from 6.2.17 to 6.2.18 by @dependabot[bot] in #2096
• Add validation for LDAP network connector URIs by @cshannon in #2077
• Update SECURITY.md with more details by @cshannon in #2103
• Add back missing closing tag by @cshannon in #2100
• Validate Stomp headers against max frame size by @cshannon in #2104
• Remove extra buffer copy in StompNIOSSLTransport by @cshannon in #2107
• Replace active temp dests map with set by @cshannon in #2113
• Refactor network connections to process after ConnectionInfo by @cshannon in #2112
• [#1984] Refactor use of deprecated StatsImpl.addStatistic to use addStatistics(Set.of(..)) by @mattrpav in #1985
• Provide a flexible filter style input stream that limits read amounts by @tabish121 in #2118
• Add flag to optionally enable temp destination stealing by @cshannon in #2122
• build(deps): bump org.codehaus.jettison:jettison from 1.5.5 to 1.5.6 by @dependabot[bot] in #2128
• Improve the broker's handling of message corruption by @cshannon in #2136
• Add support for maxInflateDataSize to limit uncompressed buffers by @cshannon in #2139
• [#2140] Improve KahaDB extensibility by @mattrpav in #2141
• #2020 Add expiryCheckEnabled option to MessageEvictionStrategy to skip O(n) expiry scan by @mwashburn2 in #2019
• Fix test by enabling allowTempDestinationStealing by @cshannon in #2146
• [#2137] Fix maxUncommittedCount usage across a network of brokers by @mattrpav in #2138
• build(deps): bump shiro-version from 2.2.0 to 2.2.1 by @dependabot[bot] in #2124
• Improve handling of partial reads and EOF in Frame size limited filter by @cshannon in #2154
• Preserve ${...} placeholders when removing/modifying networkConnectors in RuntimeConfigurationPlugin by @jbonofre in #2123
• build(deps): bump org.javassist:javassist from 3.31.0-GA to 3.32.0-GA by @dependabot[bot] in #2131
• Remove all author tags by @cshannon in #2159
• More security.md updates by @cshannon in #2163
• [#] GitHub DevOps: Disable GH Actions on forked repositories to reduc… by @mattrpav in #2164
• build(deps): bump org.apache:apache from 38 to 39 by @dependabot[bot] in #2162
• build(deps-dev): bump commons-logging:commons-logging from 1.3.6 to 1.4.0 by @dependabot[bot] in #2127
• Lower default maxFrameSize to 10 MB in xml config by @cshannon in #2166
• Add better frame size validation for AMQP by @cshannon in #2167
• Prevent cursor from using more than 100% temp store by @cshannon in #2165
• Fire message discarded advisory on format errors by @cshannon in #2177
• build(deps): bump log4j-version from 2.26.0 to 2.26.1 by @dependabot[bot] in #2181
• chore: Update Spring to 6.2.19 by @coheigea in #2184
• Fix Topic store/temp usage tracking by @cshannon in #2178
• build(deps): bump jackson-version from 2.22.0 to 2.22.1 by @dependabot[bot] in #2200
• build(deps): bump xbean-version from 4.30 to 4.31 by @dependabot[bot] in #2189
• build(deps): bump org.apache.groovy:groovy from 5.0.6 to 5.0.7 by @dependabot[bot] in #2190
• Fix TextMessage body thread safety by @cshannon in #2188
• build(deps): bump org.apache.groovy:groovy-ant from 5.0.6 to 5.0.7 by @dependabot[bot] in #2191
• build(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in #2129
• feat(#1797): add message delivery tracking to QueueMessageReference by @jeanouii in #1796
• feat(#1828): Expose NetworkConnector URI and local URI in JMX MBean by @jbonofre in #1829
• Add tests validating TextMessage body thread safety fix by @cshannon in #2207
• #2119 Update spring.schemas to include missing 'spring-beans.xsd' map… by @lichtin in #2202
• Minor updates to text message sync by @cshannon in #2209
• build(deps-dev): bump netty-version from 4.2.15.Final to 4.2.16.Final by @dependabot[bot] in #2195
• build(deps): bump camel-version from 4.20.0 to 4.21.0 by @dependabot[bot] in #2173
• Add a draft security threat model (THREAT_MODEL.md) + discoverability wiring by @potiuk in #2186
• [#] Questions answered for THREAD_MODEL.md by @mattrpav in #2216
• Ensure composite temp dests are handled in AuthorizationBroker by @cshannon in #2219
• [#1734] Jetty 12.1 refactor by @mattrpav in #2217
• feat(#1798) Performance fix for topic send by @jeanouii in #1792
• Move JMH version to root pom by @cshannon in #2223
• [#] Fix flaky Topic eviction expiry disabled test by @mattrpav in #2218
• Fix network bridge silent death when transport exception occurs during broker info handshake by @TylerMurali in #1865
• build(deps): bump actions/stale from 10.3.0 to 10.4.0 by @dependabot[bot] in #2212
• Bump default JVM heap and add OOM diagnostics by @jbonofre in #2044
• [#2230] KahaDB dedicated cursor iterator by @mattrpav in #2231
• [#1843] [AMQ-9687] Add metrics about error and reconnect counts to network co… by @mattrpav in #1726
• build(deps): bump spring-version from 6.2.19 to 7.0.8 by @dependabot[bot] in #2102

New Contributors

• @lenoch7 made their first contribution in #1551
• @pradeep85841 made their first contribution in #1631
• @caapos made their first contribution in #1749
• @anmol-saxena-14 made their first contribution in #1725
• @gurpartap3697 made their first contribution in #1832
• @SAY-5 made their first contribution in #1939
• @tabish121 made their first contribution in #2118
• @mwashburn2 made their first contribution in #2019
• @lichtin made their first contribution in #2202
• @potiuk made their first contribution in #2186
• @TylerMurali made their first contribution in #1865

Full Changelog: activemq-6.2.7...activemq-6.3.0