## RabbitMQ 4.3.5

RabbitMQ `4.3.5` is a maintenance release in the `4.3.x` [release series](https://www.rabbitmq.com/release-information).

It is **strongly recommended** that you read [4.3.0 release notes](https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0)
in detail if upgrading from a version prior to `4.3.0`.

### Minimum Supported Erlang Version

The minimum supported Erlang version for this release series is `27.0`.

[RabbitMQ and Erlang/OTP Compatibility Matrix](https://www.rabbitmq.com/docs/which-erlang) has more details on Erlang version requirements for RabbitMQ.

Nodes **will fail to start** on older Erlang releases.


## Changes Worth Mentioning

Release notes can be found on GitHub at [rabbitmq-server/release-notes](https://github.com/rabbitmq/rabbitmq-server/tree/v4.3.x/release-notes).

### Core Server

#### Bug Fixes

 * With [direct reply-to](https://www.rabbitmq.com/docs/direct-reply-to), a message routed to multiple
   targets that resolved to the same process could be delivered to it more than once.

   GitHub issue: [#17071](https://github.com/rabbitmq/rabbitmq-server/pull/17071)

#### Enhancements

 * Authentication events are now logged under a new logging category, `user`.
   Successful logins are logged at the `info` level, failed login attempts at the `warning` level.

   GitHub issue: [#16907](https://github.com/rabbitmq/rabbitmq-server/pull/16907)


### Stream Plugin

#### Enhancements

 * Before a stream client connection completes authentication and authorization (that is, before
   a successful `open`), the server now enforces a low `frame_max` ceiling instead of
   the full configured value. The default, 8192 bytes, is high enough to accommodate realistic
   [JWT tokens](https://www.rabbitmq.com/docs/oauth2) used with SASL PLAIN authentication,
   and mirrors a mechanism already in place for AMQP 0-9-1 connections. It can be adjusted
   with the new `stream.initial_frame_max` setting.

   GitHub issue: [#17053](https://github.com/rabbitmq/rabbitmq-server/pull/17053)

 * `Deliver` frames sent to stream consumers are now checked against the connection's
   negotiated `frame_max`.

   GitHub issue: [#17083](https://github.com/rabbitmq/rabbitmq-server/pull/17083)

 * New setting: `stream.max_uncompressed_sub_entry_batch_size`. It bounds the declared
   uncompressed size of a published sub-entry batch, and defaults to 67108864 (64 MiB),
   the same default already used by the Java client's `maxUncompressedSubEntryBatchSize`.
   The broker and any client publishing to it should be configured with the same value.

   GitHub issue: [#17103](https://github.com/rabbitmq/rabbitmq-server/pull/17103)

 * The max frame size has been bumped from 1048576 (1 MiB) to 20971520 (20 MiB).
   This is a follow-up of the enforcement of `frame_max` for `Deliver` frames,
   to avoid breaking existing installations while keeping a reasonable default.
   It is possible to change the value with the `stream.frame_max` setting to adapt
   it to the size of stream chunks (if known).

   GitHub issue: [#17126](https://github.com/rabbitmq/rabbitmq-server/pull/17126)

### Management Plugin

#### Enhancements

 * When `management.credential_encryption_secret` is configured, the management UI login endpoint
   (`POST /api/login`) returns client credentials encrypted using `AES-256-GCM` with a key
   derived from the configured secret, and returns the ciphertext as an opaque token prefixed
   with `rmqe.`. The browser stores this token and presents it on all subsequent requests
   using the `Authorization: Bearer rmqe.<token>` header.

   The secret MUST be identical on every node in the cluster.

   **Important**: during a rolling cluster upgrade, enable this feature only after all nodes have been upgraded.
   This is particularly important for clusters behind a load balancer: nodes that run older
   versions will not recognize the encrypted tokens and will reject the requests,
   unexpectedly logging users out.

   GitHub issue: [#16705](https://github.com/rabbitmq/rabbitmq-server/pull/16705)

 * The `Referrer-Policy` HTTP response header can now be configured with
   the `management.headers.referrer_policy` setting.

   GitHub issue: [#16893](https://github.com/rabbitmq/rabbitmq-server/pull/16893)

 * When `management.http.hide_allow_header` is set to `true`, the `Allow` HTTP response header
   is omitted from all responses except `405 Method Not Allowed` ones, where it is required
   by the HTTP specification. This avoids disclosing the supported HTTP methods to clients.

   GitHub issue: [#16893](https://github.com/rabbitmq/rabbitmq-server/pull/16893)

 * When `management.definitions.require_json_extension` is set to `true`, both the management UI
   and the HTTP API will reject definition upload where the file does not have a `.json` extension.
   The setting defaults to `false`. Regardless of this setting, the server always validates
   that the uploaded content is valid JSON before importing it.

   GitHub issue: [#16946](https://github.com/rabbitmq/rabbitmq-server/pull/16946)


### Shovel Plugin

#### Bug Fixes

 * Reduced log noise.

   GitHub issue: [#17028](https://github.com/rabbitmq/rabbitmq-server/pull/17028)

#### Enhancements

 * Shovel TTL: dynamic shovels support a new setting, `src-delete-after-duration`,
   that instructs the shovel to self-delete after at least the specified duration.

   Contributed by @michalovits.

   GitHub issues: [#17055](https://github.com/rabbitmq/rabbitmq-server/pull/17055), [#17064](https://github.com/rabbitmq/rabbitmq-server/pull/17064)


### Federation Plugin

#### Bug Fixes

 * A malformed upstream URI could prevent a federation link from starting even when other,
   well-formed URIs were available. All candidate URIs are now tried.

   Contributed by @sauravonwww.

   GitHub issue: [#17046](https://github.com/rabbitmq/rabbitmq-server/pull/17046)


### MQTT Plugin

#### Bug Fixes

 * Packets split across many network fragments are now parsed more efficiently.

   GitHub commit: [`3f1ca3c3e2`](https://github.com/rabbitmq/rabbitmq-server/commit/3f1ca3c3e2)


### Consistent Hash Exchange Plugin

#### Bug Fixes

 * An edge case in bucket selection is now handled gracefully.

   GitHub issue: [#17081](https://github.com/rabbitmq/rabbitmq-server/pull/17081)


### Web STOMP Plugin

#### Bug Fixes

 * The accumulated frame size is now checked against `max_frame_size` after a connection
   has authenticated, matching the behavior of "regular" STOMP connections.

   GitHub issue: [#17065](https://github.com/rabbitmq/rabbitmq-server/pull/17065)


### Dependency Changes

 * `ra` was upgraded to [`3.1.10`](https://github.com/rabbitmq/ra/releases/tag/v3.1.10)
 * `ranch` was upgraded to [`2.2.1`](https://github.com/ninenines/ranch/releases/tag/2.2.1)
