This release introduces OAuth2/OIDC authentication, kernel TLS offloading, a rewritten configuration system, Jump consistent hash exchange algorithm, and the ability to restart closed queues. It also brings enhanced TLS capabilities including SNI and mTLS support, improved stream performance, improved clustering and federation management, and many bug fixes.
Added
OAuth2/OpenID Connect authentication support with JWT token validation (RS256), JWKS, scope-to-permission mapping, and token refresh via UpdateSecret #1632
Jump consistent hash algorithm for Consistent Hash Exchange #1604
kTLS (kernel TLS) support for OpenSSL servers, offloading TLS encryption to the kernel for improved performance 61bdb124
Restart closed queues via API/UI/lavinmqctl #1345
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [cloudamqp/lavinmq](https://github.com/cloudamqp/lavinmq) | minor | `2.6.11` → `2.7.0` |
---
### Release Notes
<details>
<summary>cloudamqp/lavinmq (cloudamqp/lavinmq)</summary>
### [`v2.7.0`](https://github.com/cloudamqp/lavinmq/blob/HEAD/CHANGELOG.md#270---2026-04-16)
[Compare Source](https://github.com/cloudamqp/lavinmq/compare/v2.6.11...v2.7.0)
This release introduces OAuth2/OIDC authentication, kernel TLS offloading, a rewritten configuration system, Jump consistent hash exchange algorithm, and the ability to restart closed queues. It also brings enhanced TLS capabilities including SNI and mTLS support, improved stream performance, improved clustering and federation management, and many bug fixes.
##### Added
- OAuth2/OpenID Connect authentication support with JWT token validation (RS256), JWKS, scope-to-permission mapping, and token refresh via UpdateSecret [#​1632](https://github.com/cloudamqp/lavinmq/pull/1632)
- Jump consistent hash algorithm for Consistent Hash Exchange [#​1604](https://github.com/cloudamqp/lavinmq/pull/1604)
- kTLS (kernel TLS) support for OpenSSL servers, offloading TLS encryption to the kernel for improved performance [61bdb124](https://github.com/cloudamqp/lavinmq/commit/61bdb124)
- Restart closed queues via API/UI/lavinmqctl [#​1345](https://github.com/cloudamqp/lavinmq/pull/1345)
- TLS keylog file (SSLKEYLOGFILE) support [#​1531](https://github.com/cloudamqp/lavinmq/pull/1531)
- TLS SNI and mTLS support [#​1516](https://github.com/cloudamqp/lavinmq/pull/1516)
- Shell command hooks for cluster leader transitions [#​1491](https://github.com/cloudamqp/lavinmq/pull/1491)
- Cache checksums on followers for faster failover [#​1554](https://github.com/cloudamqp/lavinmq/pull/1554)
- `--pidfile` CLI option [#​1570](https://github.com/cloudamqp/lavinmq/pull/1570)
- Connection duration logged on disconnect [#​1662](https://github.com/cloudamqp/lavinmq/pull/1662)
- Collapsible sidebar menu in the management UI [#​1553](https://github.com/cloudamqp/lavinmq/pull/1553)
- Support for mqtts in `lavinmqperf` [#​1702](https://github.com/cloudamqp/lavinmq/pull/1702)
##### Changed
- Configuration system rewritten with annotations and macros; clear precedence: CLI args > environment variables > INI file [#​917](https://github.com/cloudamqp/lavinmq/pull/917)
- Deprecated duplicate INI options in section-specific locations; these now forward to `[main]` with a deprecation warning [#​1636](https://github.com/cloudamqp/lavinmq/pull/1636)
- HTTP API permissions aligned with RabbitMQ: admin access required for definitions endpoints [#​1687](https://github.com/cloudamqp/lavinmq/pull/1687)
- Prometheus metrics grouped per metric with `# TYPE` and `# HELP` annotations [#​1598](https://github.com/cloudamqp/lavinmq/pull/1598)
- Server-side authentication validation for management UI views [#​1641](https://github.com/cloudamqp/lavinmq/pull/1641)
- Vhost selection disabled in vhost-specific management UI views [#​1575](https://github.com/cloudamqp/lavinmq/pull/1575)
- Convert queued message graph to stacked line graph [#​1565](https://github.com/cloudamqp/lavinmq/pull/1565)
- Stream: Store offset only for first message per segment [#​1479](https://github.com/cloudamqp/lavinmq/pull/1479)
- Use parallel execution context for clustering followers [#​1544](https://github.com/cloudamqp/lavinmq/pull/1544)
- Graceful shutdown for StandaloneRunner [#​1577](https://github.com/cloudamqp/lavinmq/pull/1577)
- MQTT performance improved by flushing socket per packet instead of per write [#​1651](https://github.com/cloudamqp/lavinmq/pull/1651)
- Crystal 1.19 compatibility [#​1620](https://github.com/cloudamqp/lavinmq/pull/1620)
- `lavinmqctl --help` touchups [#​1755](https://github.com/cloudamqp/lavinmq/pull/1755)
##### Fixed
- Dead letter cycle detection [#​1723](https://github.com/cloudamqp/lavinmq/pull/1723)
- MQTT subscribe permission check logic [#​1836](https://github.com/cloudamqp/lavinmq/pull/1836)
- MQTT sessions no longer deleted or cleared if a new client has already taken over the session [#​1665](https://github.com/cloudamqp/lavinmq/pull/1665)
- Honor `yield_each_delivered_bytes` setting for MQTT [#​1783](https://github.com/cloudamqp/lavinmq/pull/1783)
- Replicate files in closed message stores [#​1794](https://github.com/cloudamqp/lavinmq/pull/1794)
- Replication shouldn't break if mfiles are closed [#​1792](https://github.com/cloudamqp/lavinmq/pull/1792)
- Only allow one follower to do bulk sync at a time [#​1720](https://github.com/cloudamqp/lavinmq/pull/1720), [#​1780](https://github.com/cloudamqp/lavinmq/pull/1780)
- Add `Sync::Shared` lock for `@files` and `@checksums` in `Clustering::Server` [#​1753](https://github.com/cloudamqp/lavinmq/pull/1753)
- Don't delete metadata files during full sync [#​1814](https://github.com/cloudamqp/lavinmq/pull/1814)
- Persist `segment_last_ts` to prevent message loss on restart in streams with max-age [#​1760](https://github.com/cloudamqp/lavinmq/pull/1760)
- Reset position when crossing segment boundary in `find_offset_in_segments` [#​1772](https://github.com/cloudamqp/lavinmq/pull/1772)
- Gracefully close message store on corrupt segments [#​1710](https://github.com/cloudamqp/lavinmq/pull/1710)
- Don't expire messages before server is fully started [#​1714](https://github.com/cloudamqp/lavinmq/pull/1714)
- Delayed message store crash on corrupt segment data [#​1694](https://github.com/cloudamqp/lavinmq/pull/1694)
- Missing `x-stream-offset` header in StreamReader responses [#​1774](https://github.com/cloudamqp/lavinmq/pull/1774)
- Return frame error for corrupt frames with invalid frame end [#​1813](https://github.com/cloudamqp/lavinmq/pull/1813)
- Allow any timestamp in AMQP messages [#​1705](https://github.com/cloudamqp/lavinmq/pull/1705)
- Return 400 for invalid binding routing key [#​1734](https://github.com/cloudamqp/lavinmq/pull/1734)
- Use `openssl dgst` instead of `sha256sum` in Makefile for macOS portability [#​1818](https://github.com/cloudamqp/lavinmq/pull/1818)
- Consumer starvation in lavinmqperf throughput mode [#​1712](https://github.com/cloudamqp/lavinmq/pull/1712)
- Print usage on unexpected arguments in lavinmqperf [#​1796](https://github.com/cloudamqp/lavinmq/pull/1796)
- Prefetch button icons in CSS [#​1556](https://github.com/cloudamqp/lavinmq/pull/1556)
- UI: Chart color consistency [#​1756](https://github.com/cloudamqp/lavinmq/pull/1756)
- UI: Tooltip sizing [#​1700](https://github.com/cloudamqp/lavinmq/pull/1700)
- UI: Tooltip z-index to appear above menus [#​1729](https://github.com/cloudamqp/lavinmq/pull/1729)
- UI: Collapse whitespace in client capabilities display [#​1733](https://github.com/cloudamqp/lavinmq/pull/1733)
- UI: Empty cells in connection details for consistent rendering [#​1732](https://github.com/cloudamqp/lavinmq/pull/1732)
- UI: Rename "Routing key" to "Binding key" in binding view [#​1748](https://github.com/cloudamqp/lavinmq/pull/1748)
- UI: Overlapping sources in logs [#​1790](https://github.com/cloudamqp/lavinmq/pull/1790)
- UI: Invalid JSON warning on empty binding arguments [#​1749](https://github.com/cloudamqp/lavinmq/pull/1749)
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMTAuMTMiLCJ1cGRhdGVkSW5WZXIiOiI0My4xMTAuMTMiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
2.6.11→2.7.0Release Notes
cloudamqp/lavinmq (cloudamqp/lavinmq)
v2.7.0Compare Source
This release introduces OAuth2/OIDC authentication, kernel TLS offloading, a rewritten configuration system, Jump consistent hash exchange algorithm, and the ability to restart closed queues. It also brings enhanced TLS capabilities including SNI and mTLS support, improved stream performance, improved clustering and federation management, and many bug fixes.
Added
--pidfileCLI option #1570lavinmqperf#1702Changed
[main]with a deprecation warning #1636# TYPEand# HELPannotations #1598lavinmqctl --helptouchups #1755Fixed
yield_each_delivered_bytessetting for MQTT #1783Sync::Sharedlock for@filesand@checksumsinClustering::Server#1753segment_last_tsto prevent message loss on restart in streams with max-age #1760find_offset_in_segments#1772x-stream-offsetheader in StreamReader responses #1774openssl dgstinstead ofsha256sumin Makefile for macOS portability #1818Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.