v2.9.0-rc.2

Changed

• Eliminate heap allocations in the message publish/deliver hot path #2045
• Zero-allocation MQTT subscription-tree matching #2090
• A publish is confirmed once every in-sync follower has the data; local syncfs is only used as a fallback when there are no in-sync followers (or the node is standalone). When a follower disconnects mid-confirm, the confirm is held until the follower's removal from the etcd ISR is committed, so a leader crash right after the confirm can't elect a replica that lacks the data #2002
• Durable definition changes (queue/exchange declares, deletes, bindings) are likewise acknowledged only once every in-sync follower has acked them - or a non-acking follower's removal from the etcd ISR is committed - so a leader crash right after a Declare-Ok can't elect a replica that lacks the acknowledged definition #2002
• Followers ack replicated data incrementally as it's written, so a single large action (big message or file sync) keeps a healthy follower in the replica set instead of being evicted on the leader's ack deadline #2002

Fixed

• Bound pre-auth JWT verification cost to prevent an unauthenticated CPU-amplification vector via the oauth_token cookie #2106
• Apply security headers and login redirect to .html view paths #2063
• Fail loud on invalid proxy_protocol_trusted_sources entries instead of silently dropping them #2096
• Validate definitions-import entries up front so a malformed entry is a clean no-op #2087
• Tolerate a string expires_in in the OAuth token response (Microsoft Entra ID / Azure AD) #2088
• A node that won the etcd leader election while no longer in the ISR (its candidacy was queued before it fell behind or disconnected) now releases the lease and exits instead of serving, preventing confirmed messages from being lost cluster-wide when an out-of-sync replica would otherwise be promoted #2002
• A follower joining the replica set while the leader was publishing could duplicate bytes in its segment files (the local write to a segment races the full sync); the join now snapshots a per-file cut, caps the sync to it, and skips already-synced bytes from the change stream #2002
• A replication append that straddles a joining follower's full-sync cut now streams only the unsynced tail. The cut is a live file size and can land inside a record a publisher has written locally but not yet dispatched; skipping the whole append (as before) tore the record on the follower #2002
• A follower that was behind when it disconnected is now removed from the etcd ISR immediately instead of on the next replication write, so it can't be promoted on failover lacking already-confirmed data while the cluster is idle; caught-up followers stay in the ISR as valid candidates and are removed before the next durable operation or publish confirm is acknowledged #2002
• Clustered stream consumer-offsets compaction crash that broke all subsequent offset writes #2101
• Guard the stream consumer-offset store against a closed message store so a late ack no longer tears down the connection #2098
• Route all publisher confirms through the persister loop to avoid out-of-order acks when sync is toggled at runtime #2102
• Remove a dead follower inline in each_follower to stop "Follower disconnected" log spam #2103
• Restart the delayed-queue expire loop on a message-store error instead of stranding delayed messages #2104
• Federation exchange link leaking a dead observer when the upstream is deleted during startup #2105
• Lost exchange-federation bindings created during link startup #2037
• Use f_frsize for disk size reporting on Linux, fixing inflated disk_total/disk_free on virtiofs and NFS #2055
• Sub-second stats_interval produced NaN/Inf rates that broke stats-endpoint JSON #2024
• Guard against an empty destination in the Move messages UI #2042
• Bound the initial PROXY-protocol peek with a read timeout to prevent FD exhaustion from idle peers #2095
• Handle PROXY headers split across TCP segments, and match IPv4 trusted sources against IPv4-mapped IPv6 peers #2099
• Don't crash the broker on an invalid SIGHUP config reload #2091
• Refuse to steal a live lavinmqctl control socket #2036
• OAuth connection/FD leak when a token refresh arrives after expiry #2094
• Return HTTP 400 instead of 500 for an unsupported hashing_algorithm #2097
• Federation upstream-set deletion and per-entry overrides #2089

Deprecated

• clustering_max_unsynced_actions is now a no-op (still accepted to avoid breaking existing configs); the follower ack buffer is a fixed size and how far a follower may lag is governed by the leader's ack deadline #2002