pkgsrc changes:
---------------
* The PID file does not need to be written in a dedicated subdirectory
and it can be written in ${VARBASE}/run directly instead.
* The configuration parameters which need to be tuned in mosquitto.conf
can be uncommented and set in according with pkgsrc variables.
upstream changes:
-----------------
2.0.5 - 2021-01-11
==================
Broker:
- Fix `auth_method` not being provided to the extended auth plugin event.
Closes#1975.
- Fix large packets not being completely published to slow clients.
Closes#1977.
- Fix bridge connection not relinquishing POLLOUT after messages are sent.
Closes#1979.
- Fix apparmor incorrectly denying access to
/var/lib/mosquitto/mosquitto.db.new. Closes#1978.
- Fix potential intermittent initial bridge connections when using poll().
- Fix `bind_interface` option. Closes#1999.
- Fix invalid behaviour in dynsec plugin if a group or client is deleted
before a role that was attached to the group or client is deleted.
Closes#1998.
- Improve logging in dynsec addGroupRole command. Closes#2005.
- Improve logging in dynsec addGroupClient command. Closes#2008.
Client library:
- Improve documentation around the `_v5()` and non-v5 functions, e.g.
`mosquitto_publish()` and `mosquitto_publish_v5().
Build:
- `install` Makefile target should depend on `all`, not `mosquitto`, to ensure
that man pages are always built. Closes#1989.
- Fixes for lots of minor build warnings highlighted by Visual Studio.
Apps:
- Disallow control characters in mosquitto_passwd usernames.
- Fix incorrect description in mosquitto_ctrl man page. Closes#1995.
- Fix `mosquitto_ctrl dynsec getGroup` not showing roles. Closes#1997.
2.0.4 - 2020-12-22
==================
Broker:
- Fix $SYS/broker/publish/messages/+ counters not being updated for QoS 1, 2
messages. Closes#1968.
- mosquitto_connect_bind_async() and mosquitto_connect_bind_v5() should not
reset the bind address option if called with bind_address == NULL.
- Fix dynamic security configuration possibly not being reloaded on Windows
only. Closes#1962.
- Add more log messages for dynsec load/save error conditions.
- Fix websockets connections blocking non-websockets connections on Windows.
Closes#1934.
Build:
- Fix man pages not being built when using CMake. Closes#1969.
2.0.3 - 2020-12-17
==================
Security:
- Running mosquitto_passwd with the following arguments only
`mosquitto_passwd -b password_file username password` would cause the
username to be used as the password.
Broker:
- Fix excessive CPU use on non-Linux systems when the open file limit is set
high. Closes#1947.
- Fix LWT not being sent on client takeover when the existing session wasn't
being continued. Closes#1946.
- Fix bridges possibly not completing connections when WITH_ADNS is in use.
Closes#1960.
- Fix QoS 0 messages not being delivered if max_queued_messages was set to 0.
Closes#1956.
- Fix local bridges being disconnected on SIGHUP. Closes#1942.
- Fix slow initial bridge connections for WITH_ADNS=no.
- Fix persistence_location not appending a '/'.
Clients:
- Fix mosquitto_sub being unable to terminate with Ctrl-C if a successful
connection is not made. Closes#1957.
Apps:
- Fix `mosquitto_passwd -b` using username as password (not if `-c` is also
used). Closes#1949.
Build:
- Fix `install` target when using WITH_CJSON=no. Closes#1938.
- Fix `generic` docker build. Closes#1945.
2.0.2 - 2020-12-10
==================
Broker:
- Fix build regression for WITH_WEBSOCKETS=yes on non-Linux systems.
2.0.1 - 2020-12-10
==================
Broker:
- Fix websockets connections on Windows blocking subsequent connections.
Closes#1934.
- Fix DH group not being set for TLS connections, which meant ciphers using
DHE couldn't be used. Closes#1925. Closes#1476.
- Fix websockets listeners not causing the main loop not to wake up.
Closes#1936.
Client library:
- Fix DH group not being set for TLS connections, which meant ciphers using
DHE couldn't be used. Closes#1925. Closes#1476.
Apps:
- Fix `mosquitto_passwd -U`
Build:
- Fix cjson include paths.
- Fix build using WITH_TLS=no when the openssl headers aren't available.
- Distribute cmake/ and snap/ directories in tar.
2.0.0 - 2020-12-03
==================
Breaking changes:
- When the Mosquitto broker is run without configuring any listeners it will
now bind to the loopback interfaces 127.0.0.1 and/or ::1. This means that
only connections from the local host will be possible.
Running the broker as `mosquitto` or `mosquitto -p 1883` will bind to the
loopback interface.
Running the broker with a configuration file with no listeners configured
will bind to the loopback interface with port 1883.
Running the broker with a listener defined will bind by default to `0.0.0.0`
/ `::` and so will be accessible from any interface. It is still possible to
bind to a specific address/interface.
If the broker is run as `mosquitto -c mosquitto.conf -p 1884`, and a
listener is defined in the configuration file, then the port defined on the
command line will be IGNORED, and no listener configured for it.
- All listeners now default to `allow_anonymous false` unless explicitly set
to true in the configuration file. This means that when configuring a
listener the user must either configure an authentication and access control
method, or set `allow_anonymous true`. When the broker is run without a
configured listener, and so binds to the loopback interface, anonymous
connections are allowed.
- If Mosquitto is run on as root on a unix like system, it will attempt to
drop privileges as soon as the configuration file has been read. This is in
contrast to the previous behaviour where elevated privileges were only
dropped after listeners had been started (and hence TLS certificates loaded)
and logging had been started. The change means that clients will never be
able to connect to the broker when it is running as root, unless the user
explicitly sets it to run as root, which is not advised. It also means that
all locations that the broker needs to access must be available to the
unprivileged user. In particular those people using TLS certificates from
Lets Encrypt will need to do something to allow Mosquitto to access
those certificates. An example deploy renewal hook script to help with this
is at `misc/letsencrypt/mosquitto-copy.sh`.
The user that Mosquitto will change to are the one provided in the
configuration, `mosquitto`, or `nobody`, in order of availability.
- The `pid_file` option will now always attempt to write a pid file,
regardless of whether the `-d` argument is used when running the broker.
- The `tls_version` option now defines the *minimum* TLS protocol version to
be used, rather than the exact version. Closes#1258.
- The `max_queued_messages` option has been increased from 100 to 1000 by
default, and now also applies to QoS 0 messages, when a client is connected.
- The mosquitto_sub, mosquitto_pub, and mosquitto_rr clients will now load
OS provided CA certificates by default if `-L mqtts://...` is used, or if
the port is set to 8883 and no other CA certificates are loaded.
- Minimum support libwebsockets version is now 2.4.0
- The license has changed from "EPL-1.0 OR EDL-1.0" to "EPL-2.0 OR EDL-1.0".
Broker features:
- New plugin interface which is more flexible, easier to develop for and
easier to extend.
- New dynamic security plugin, which allows clients, groups, and roles to be
defined and updated as the broker is running.
- Performance improvements, particularly for higher numbers of clients.
- When running as root, if dropping privileges to the "mosquitto" user fails,
then try "nobody" instead. This reduces the burden on users installing
Mosquitto themselves.
- Add support for Unix domain socket listeners.
- Add `bridge_outgoing_retain` option, to allow outgoing messages from a
bridge to have the retain bit completely disabled, which is useful when
bridging to e.g. Amazon or Google.
- Add support for MQTT v5 bridges to handle the "retain-available" property
being false.
- Allow MQTT v5.0 outgoing bridges to fall back to MQTT v3.1.1 if connecting
to a v3.x only broker.
- DLT logging is now configurable at runtime with `log_dest dlt`.
Closes#1735.
- Add `mosquitto_broker_publish()` and `mosquitto_broker_publish_copy()`
functions, which can be used by plugins to publish messages.
- Add `mosquitto_client_protocol_version()` function which can be used by
plugins to determine which version of MQTT a client has connected with.
- Add `mosquitto_kick_client_by_clientid()` and `mosquitto_kick_client_by_username()`
functions, which can be used by plugins to disconnect clients.
- Add support for handling $CONTROL/ topics in plugins.
- Add support for PBKDF2-SHA512 password hashing.
- Enabling certificate based TLS encryption is now through certfile and
keyfile, not capath or cafile.
- Added support for controlling UNSUBSCRIBE calls in v5 plugin ACL checks.
- Add "deny" acl type. Closes#1611.
- The broker now sends the receive-maximum property for MQTT v5 CONNACKs.
- Add the `bridge_max_packet_size` option. Closes#265.
- Add the `bridge_bind_address` option. Closes#1311.
- TLS certificates for the server are now reloaded on SIGHUP.
- Default for max_queued_messages has been changed to 1000.
- Add `ciphers_tls1.3` option, to allow setting TLS v1.3 ciphersuites.
Closes#1825.
- Bridges now obey MQTT v5 server-keepalive.
- Add bridge support for the MQTT v5 maximum-qos property.
- Log client port on new connections. Closes#1911.
Broker fixes:
- Send DISCONNECT with `malformed-packet` reason code on invalid PUBLISH,
SUBSCRIBE, and UNSUBSCRIBE packets.
- Document that X509_free() must be called after using
mosquitto_client_certificate(). Closes#1842.
- Fix listener not being reassociated with client when reloading a persistence
file and `per_listener_settings true` is set and the client did not set a
username. Closes#1891.
- Fix bridge sock not being removed from sock hash on error. Closes#1897.
- mosquitto_password now forbids the : character. Closes#1833.
- Fix `log_timestamp_format` not applying to `log_dest topic`. Closes#1862.
- Fix crash on Windows if loading a plugin fails. Closes#1866.
- Fix file logging on Windows. Closes#1880.
- Report an error if the config file is set to a directory. Closes#1814.
- Fix bridges incorrectly setting Wills to manage remote notifications when
`notifications_local_only` was set true. Closes#1902.
Client library features:
- Client no longer generates random client ids for v3.1.1 clients, these are
now expected to be generated on the broker. This matches the behaviour for
v5 clients. Closes#291.
- Add support for connecting to brokers through Unix domain sockets.
- Add `mosquitto_property_identifier()`, for retrieving the identifier integer
for a property.
- Add `mosquitto_property_identifier_to_string()` for converting a property
identifier integer to the corresponding property name string.
- Add `mosquitto_property_next()` to retrieve the next property in a list, for
iterating over property lists.
- mosquitto_pub now handles the MQTT v5 retain-available property by never
setting the retain bit.
- Added MOSQ_OPT_TCP_NODELAY, to allow disabling Nagle's algorithm on client
sockets. Closes#1526.
- Add `mosquitto_ssl_get()` to allow clients to access their SSL structure and
perform additional verification.
- Add MOSQ_OPT_BIND_ADDRESS to allow setting of a bind address independently
of the `mosquitto_connect*()` call.
- Add `MOSQ_OPT_TLS_USE_OS_CERTS` option, to instruct the client to load and
trust OS provided CA certificates for use with TLS connections.
Client library fixes:
- Fix send quota being incorrecly reset on reconnect. Closes#1822.
- Don't use logging until log mutex is initialised. Closes#1819.
- Fix missing mach/mach_time.h header on OS X. Closes#1831.
- Fix connect properties not being sent when the client automatically
reconnects. Closes#1846.
Client features:
- Add timeout return code (27) for `mosquitto_sub -W <secs>` and
`mosquitto_rr -W <secs>`. Closes#275.
- Add support for connecting to brokers through Unix domain sockets with the
`--unix` argument.
- Use cJSON library for producing JSON output, where available. Closes#1222.
- Add support for outputting MQTT v5 property information to mosquitto_sub/rr
JSON output. Closes#1416.
- Add `--pretty` option to mosquitto_sub/rr for formatted/unformatted JSON
output.
- Add support for v5 property printing to mosquitto_sub/rr in non-JSON mode.
Closes#1416.
- Add `--nodelay` to all clients to allow them to use the MOSQ_OPT_TCP_NODELAY
option.
- Add `-x` to all clients to all the session-expiry-interval property to be
easily set for MQTT v5 clients.
- Add `--random-filter` to mosquitto_sub, to allow only a certain proportion
of received messages to be printed.
- mosquitto_sub %j and %J timestamps are now in a ISO 8601 compatible format.
- mosquitto_sub now supports extra format specifiers for field width and
precision for some parameters.
- Add `--version` for all clients.
- All clients now load OS provided CA certificates if used with `-L
mqtts://...`, or if port is set to 8883 and no other CA certificates are
used. Closes#1824.
- Add the `--tls-use-os-certs` option to all clients.
Client fixes:
- mosquitto_sub will now exit if all subscriptions were denied.
- mosquitto_pub now sends 0 length files without an error when using `-f`.
- Fix description of `-e` and `-t` arguments in mosquitto_rr. Closes#1881.
- mosquitto_sub will now quit with an error if the %U option is used on
Windows, rather than just quitting. Closes#1908.
Changelog:
What's New
Extension API: Compose API now supports editing messages and templates as new
messages
Extension API: composeHtml is now exposed in MailIdentity
Extension API: windows.update and windows.create now support titlePreface
Extension API: new Accounts API functions: accounts.getDefault() and
accounts.getDefaultIdentity(accountId)
Changes
Extension API: body and plainTextBody are now used as compose mode selectors in
setComposeDetails and begin* functions in Compose API
Theme: removed the double border around the task description field on the Tasks
tab
Fixes
Account Manager: When deleting the last remaining account, the default account
was not getting cleared and still pointed to the no-longer-existing account
OpenPGP: Verification of an inline signed message would fail if it contained
leading whitespace
OpenPGP: Various other minor bug and stability fixes
Mail Window: Quickfilter bar buttons disappear when hovered on Windows 10 High
Contrast Black theme
Theme: folder properties dialog contained black text on a black background in
dark mode
Theme: recipient pills in compose window were not visible in high contrast dark
theme on Windows 10
Extension API: browserAction buttons were not restored after restart if they
were moved outside the default toolbar
Extension API: browser.compose.beginNew could not override identity plaintext
setting
Extension API: browser.compose.beginForward was ignoring ComposeDetails
Extension API: browser.compose.setComposeDetails did not properly handle
Windows-style line endings
Various security fixes
Security fixes:
#CVE-2021-23953: Cross-origin information leakage via redirected PDF requests
#CVE-2021-23954: Type confusion when using logical assignment operators in
JavaScript switch statements
#CVE-2020-15685: IMAP Response Injection when using STARTTLS
#CVE-2020-26976: HTTPS pages could have been intercepted by a registered
service worker when they should not have been
#CVE-2021-23960: Use-after-poison for incorrectly redeclared JavaScript
variables during GC
#CVE-2021-23964: Memory safety bugs fixed in Thunderbird 78.7
The way this is managed is gld is still installed, it's just that we do not
create the ld -> gld symlinks on SunOS so that it is not accidentally used
depending on the $PATH.
This may need tweaking for Darwin, but it's less critical there.
Changelog:
Changes
* Make sure to do priority app upgrades first (server#25077)
* Respect DB restrictions on number of arguments in statements and queries
(server#25120)
* Add a hint about the direction of priority (server#25143)
* Do not redirect to logout after login (server#25146)
* Fix comparison of PHP versions (server#25152)
* Add "composer.lock" for acceptance tests to git (server#25178)
* Update CRL due to revoked gravatar.crl (server#25190)
* Don't log keys on checkSignature (server#25193)
* Update 3rdparty after Archive_Tar (server#25199)
* Bump CA bundle (server#25219)
* Update handling of user credentials (server#25225)
* Fix encoding issue with OC.Notification.show (server#25244)
* Also use storage copy when dav copying directories (server#25261)
* Silence log message (server#25263)
* Extend ILDAPProvider to allow reading arbitrairy ldap attributes for users
(server#25276)
* Do not obtain userFolder of a federated user (server#25278)
* Bump pear/archive_tar from 1.4.11 to 1.4.12 (3rdparty#603)
* Add gitignore entry for .github folder of dependencies (3rdparty#604)
* Clear event array on getting them (activity#551)
CHANGES 3.5.60 22/01/2021
---------------------------
* Allow legend column control of vertical alignment
* Allow renderTextMode attribute in reportlab.graphics.shapes.String
* Allow renderTextMode drawString handling in renderPDF/PM/PS/SVG
* Some fixes to fillMode handling
CHANGES 3.5.59 04/01/2021
---------------------------
* Minor changes to table rounded corners; some documentation updates
CHANGES 3.5.58 01/01/2021
---------------------------
* Allow variant corners in Canvas.roundRect
* Allow tables to have rounded corners
CHANGES 3.5.57 27/12/2020
---------------------------
* added ddfStyle to Label
* allowed for embedded(and ordinary)Hyphenation to pre-empt splitting when embeddedHyphenation>=2
* fix extension escapePDF so it can handle unicode
* fix poundsign in Ean5BarcodeWidget
* Table can use __styledWrap__ for sizing
* test fixes so 3.9 and 2.7 produce same pdf
-allow dashes instead of underscores in conf property names. This fixes a
regression as "special-paths", "ext-colors" and "search-modes" were defined
with a dash up to version 1.0.7. Now both spellings are OK - Fix#330
-fix some problems with paths containing spaces
(regression since 1.1.11) - Fix#329
Upstream release notes:
- Added warning if the curl extension is not enabled as it significantly
degrades performance
- Fixed InstalledVersions to report all packages when several vendor dirs are
present in the same runtime
- Fixed download speed when downloading large files
- Fixed archive and path repo copies mishandling some .gitignore paths
- Fixed root package classes not being available to the plugins/scripts during
the initial install
- Fixed cache writes to be atomic and better support multiple Composer
processes running in parallel
- Fixed preg jit issues when config or require modifies large composer.json
files
- Fixed compatibility with envs having open_basedir restrictions
- Fixed exclude-from-classmap causing regex issues when having too many paths
- Fixed compatibility issue with Symfony 4/5
- Several small performance and debug output improvements
Fixes
#315529 Fixed a crash on open of a file with start repeat in continuous view
#315237 Fixed an issue with tab switch when opening a score when "Score migration dialog" is opened
#315599 Fi MuseScore 3.6 crashes when rearranging instrument positions and changing Ordering
Fixed an issue when window marked as modified, even when the last score is closed
#315627 Fixed a crash during openning large orchestration created in older versions of MuseScore
#315553 Fixed an issue with incorrect order of Violins in Orchestra template
#309333 Fixed a crash during hiding palettes
#316224 Fixed an export fail when part name contains slash
#316025 Fixed an issue with spacers do not function with vertical justification enabled
#316071 Added an option to Copy SMuFL Symbol Code for symbols in Master Palette
#315861 Clef changes are no more visible on hidden staves
#315841 Fixed an issue when "first system indent" can cause measures to not fit on system
#315638 Fixed an issue with wrong key signature on "reset styles" with concert pitch
#316071 Display sym smufl name in symbols palette
#315671 Corner radius from "default rehearsal mark style" is removed
#315503 Fixed an issue with ignored custom style defaults when creating new score from template
#315726 Fixed an issue when applying key change to a selection causes crash if transposing instrument is involved
#284796 Fixed an issue when incomplete voice in local time signature leads to corruption upon import
#315067 Fixed an issue with swapping notes in a two-note tremolo causes corrupt tremolo (and crash)
#315147 Fixed an issue with two-note tremolos displaying incorrectly when the stave has custom scale
#315781 Fixed an issue when measure number offset changes on reload
#290356 Now it's possible to copy-paste the LetRing, PalmMute and Vibrato elements
The link at "Score migration dialog" now leads to Bilibili if using Chinese
