v2.9.0

This release makes local publish confirms wait until messages are flushed to disk with syncfs, reworks clustered durability so confirms and durable definition changes are acknowledged only once every in-sync replica holds the data, and adds OAuth2/OIDC SSO login to the management UI. It also adds PROXY protocol trusted sources, load_definitions, per-queue-type policy apply-to targets and a configurable control socket, alongside a wide range of bugfixes and performance optimizations across the broker.

Release Highlights

Disk-Flushed Publish Confirms

Local publish confirms are now sent only after messages are flushed to disk with syncfs, strengthening durability guarantees on standalone nodes. Because this flushes to disk more often, throughput-sensitive workloads may see higher publish latency and more disk I/O. The new --no-sync option restores the previous behavior for workloads that prefer throughput over per-message disk durability. #1891

Durable Clustered Confirms

In a cluster, a publish is confirmed only once every in-sync follower has the data, and durable definition changes (queue/exchange declares, deletes, bindings) are acknowledged only once every in-sync follower has acked them. If a follower disconnects mid-confirm, the confirm is held until that follower's removal from the etcd ISR is committed, so a leader crash right after a confirm or Declare-Ok can no longer elect a replica that lacks acknowledged data. #2002

OAuth2/OIDC SSO Login

The management UI now supports OAuth2/OIDC single sign-on, letting you log in through an identity provider (Keycloak, Auth0, Microsoft Entra ID, or any OIDC-compliant provider) instead of local credentials. #1768

Performance & Optimizations

This release also lands a number of optimizations across the hot path, replication and idle-resource management:

• Eliminate heap allocations in the message publish/deliver hot path #2045
• Zero-allocation MQTT subscription-tree matching #2090
• Fiber-free synchronous replication a011ec99
• On-demand deliver_loop fibers for AMQP consumers #1722
• Idle fiber management for queue message expiration #1614
• Replace periodic GC.collect with on-demand GC #2016

Taken together, these changes shift a server's resource profile a little. Expect slightly lower RAM usage overall, and somewhat more disk IOPS from syncfs on publish confirms. Memory graphs may also look different than before: LavinMQ no longer forces a GC every 30 seconds, so the regular sawtooth pattern is gone and memory is reclaimed on demand instead.

Beyond the highlights, this release includes a large number of bugfixes across streams, clustering, federation, MQTT and the HTTP API.

Changes Worth Mentioning

• proxy_protocol_trusted_sources config option supporting individual IPs and CIDR notation #1601
• load_definitions config option #1828
• Per-queue-type policy apply-to targets (classic_queues, quorum_queues, streams) for RabbitMQ definitions compatibility #2015
• Bindings count in overview, CLI status and Prometheus metrics #2018
• control_unix_path config option to make the lavinmqctl control socket path configurable #2029

Breaking Changes / Deprecations

• Removed the unix_proxy_protocol config option; Unix sockets always auto-detect PROXY protocol headers #1601
• clustering_max_unsynced_actions is now a no-op (still accepted to avoid breaking existing configs); the follower ack buffer is a fixed size and how far a follower may lag is governed by the leader's ack deadline #2002

---

For the full list of changes, see the changelog.