Openfire 5.1.1 Release

Improvement

• [OF-3300] - Improve handling of unexpected errors in MultiUserChatServiceImpl
• [OF-3304] - MUCPersistenceManager MUC history reload limit set to X log message is unhelpful
• [OF-3310] - Inconsistent duplicate-subscription policy for 'nodes' vs 'items' subscription types on collection nodes when multi-subscribe is enabled
• [OF-3312] - Replace string identity comparison when setting currentKey
• [OF-3317] - Log encryption property migration in audit log
• [OF-3333] - Upgrade Netty from 4.2.13.Final to 4.2.16.Final

Bug

• [OF-3301] - NullPointerException in OfflineMessageStore.getSize() due to unsafe cache access
• [OF-3305] - Unable to save XML properties during PBKDF2 migration
• [OF-3306] - Excessive memory consumption caused by bloated ofPubsubSubscription table
• [OF-3307] - PubSub subscriptions are incorrectly treated as unique per owner instead of per subscription JID
• [OF-3309] - Duplicate 'nodes'-type subscription to a collection node returns instead of current subscription state when multi-subscribe is disabled
• [OF-3311] - nodeMeetsPreconditions() ignores extra precondition values when the node configuration has only one value
• [OF-3314] - Harden null-handling and cache access in FaviconServlet
• [OF-3315] - Re-validate redirect targets to close residual SSRF in FaviconServlet
• [OF-3316] - Improve favicon caching behavior and response semantics
• [OF-3318] - SessionManager teardown ownership
• [OF-3319] - IQBindHandler busy-waits up to 20s on resource conflict, causing thread starvation and not working in a cluster
• [OF-3321] - ConcurrentModificationException while initializing outbound S2S
• [OF-3324] - IP addresses are encoded as dNSName instead of iPAddress in certificate SANs
• [OF-3325] - CI doesn't publish Docker images for tags
• [OF-3331] - Guard head-side pipeline handlers against duplicate channelActive execution after TLS handshake
• [OF-3332] - Outbound S2S DirectTLS connection fails with NullPointerException in NettyConnection.startTLS

sha256sum values

dc887032619b7ecf66cc8c17dc5cedc13c2479525cd93b41e5d999e4ec942adf  openfire-5.1.1-1.noarch.rpm
4f6c5ccfe44fdd494760ae5a6f00f971ea000ec6c69e1481d3546bed994598e2  openfire_5.1.1_all.deb
17eafa2641a5cbe226328d54e115fd1780a90d6fedb6d63d8bcea048f91f23ab  openfire_5_1_1.dmg
68b69309f22435e4996b18b21a451d8c3b98a543aa8680436694bf4a235b8299  openfire_5_1_1.exe
d930be11c93c995ee0a045118d0539629bd27d983ad99e6f174ded6453612a0d  openfire_5_1_1.tar.gz
b55659388274deedde92813ed830e1060c89b48fc3d61e6227c153bd4d96b57e  openfire_5_1_1_x64.exe
9faa8900c8aa56822deb83c82339842794b6e2e58be61ca08dbdf948ee931cd6  openfire_5_1_1.zip

Openfire 5.1.0 Release

Improvement

• [OF-536] - Upgrade JmDNS from pre 1.0 to 3.6.3
• [OF-1927] - Show TCP port used for server-to-server connections
• [OF-2694] - Add support for channel binding
• [OF-2970] - Have Cache-control headers on HTTP responses
• [OF-3037] - Admin console page to review failed S2S connection attempts
• [OF-3074] - Prevent hardcoded IV when encrypting parameters
• [OF-3075] - Weak SHA1 hash used as key for blowfish
• [OF-3102] - Improve Embedded DB error handling
• [OF-3105] - Improve MUC Avatar support
• [OF-3111] - Gracefully stop Jetty
• [OF-3115] - Improve detection of improperly ending user session
• [OF-3122] - Stop by default using Common Name based identities
• [OF-3128] - PluginMonitor to immediately reload parent/child plugins
• [OF-3150] - Eliminate unnecessary database lookups for MUC service identifiers by relying on in-memory mucServices data.
• [OF-3154] - Disable automatic kicking of inactive MUC occupants by default; make behavior configurable.
• [OF-3159] - Limit iteration over certificate Subject Alternative Names (SANs)
• [OF-3169] - Fix concurrency, ordering, and flush correctness issues in CachingPubsubPersistenceProvider
• [OF-3176] - Offload blocking operations from Netty event loop threads to improve performance
• [OF-3179] - Enforce deterministic ordering of ConnectionCloseListener execution
• [OF-3181] - Allow static configuration of cluster node ID
• [OF-3182] - Reuse EventLoopGroup and EventExecutorGroup for outbound S2S connections
• [OF-3184] - Have a healthcheck in the Docker image
• [OF-3185] - Improve error handling when inbound S2S does not offer any auth mechanism
• [OF-3186] - Generate less verbose log messages for network scanners
• [OF-3195] - Avoid writing closing stream stanza when Netty channel is inactive
• [OF-3196] - DefaultPubSubPersistenceProvider.loadNodes() has O(n²) complexity causing multi-hour startup times at scale
• [OF-3202] - Replace queue-emptiness check in PacketsProcessor.isDone() with an explicit completion flag
• [OF-3203] - HappyEyeballsResolver's 'done' method name can be confusing
• [OF-3204] - readSerializableMap incorrectly casts key type to String, violating Serializable contract
• [OF-3206] - Upgrade OJDBC from 23.7.0.25.01 to 23.26.2.0.0
• [OF-3211] - Make plugin directory destruction timeout configurable
• [OF-3214] - Check that the payload size does not exceed the node's configured maximum (XEP-0060 §7.1.3.5)
• [OF-3220] - Server does not parse client ACKs from BOSH requests
• [OF-3233] - Add timeout/fallback for synchronous cluster statistics request in admin page
• [OF-3240] - Modernize DB capability detection in DbConnectionManager to reduce stale hard-coded assumptions
• [OF-3242] - Add partial wildcard support to dnsutil.dnsOverride (for example *.external.com)
• [OF-3245] - DefaultPubSubPersistenceProvider should use DbConnectionManager large-text helpers for payload columns
• [OF-3250] - Support Recursive Re-lookup for DNS Override Resolution
• [OF-3251] - Add explicit IPv6 support to DNS Override
• [OF-3252] - Update org.apache.commons:commons-dbcp2 from 2.9.0 to 2.14.0 and commons-pool2 from 2.9.0 to 2.13.1
• [OF-3257] - Guard against timing attacks in ScramSha1SaslServer
• [OF-3258] - Guard against user enumeration in ScramSha1SaslServer
• [OF-3260] - Support RFC 7239 Forwarded header in addition to X-Forwarded-*
• [OF-3261] - Add configuration for trusted reverse proxies when using forwarded headers
• [OF-3262] - Replace IP-only login tracking with per-username + IP tracking
• [OF-3264] - IpUtils: handle IPv6 zone/scope ID suffixes in string-based address methods
• [OF-3268] - Refactor inbound S2S SASL EXTERNAL flow to remove duplicate post-auth checks in SASLAuthentication
• [OF-3273] - SASLAuthentication accepts mechanisms not advertised for the current connection/session
• [OF-3275] - Update log4j from 2.25.4 to 2.26.0
• [OF-3283] - Improve clustered outgoing session setup to reuse routes created by other nodes
• [OF-3286] - Replace fragmented/inconsistent locking strategy in GroupManager
• [OF-3288] - Unify cache clearing of paginated and non-paginated group names

Story

• [OF-3170] - Implement configurable rate limiting for new connections (C2S and S2S)

Task

• [OF-2554] - Merge docker documentation
• [OF-2957] - Upgrade to Netty 4.2
• [OF-3163] - Remove code marked to be removed in Openfire 5.1.0
• [OF-3207] - Update database used by unit tests (to 38)
• [OF-3235] - Fix malformed link markup in installation guide (hre instead of href)
• [OF-3237] - Add Firebird database support to Openfire
• [OF-3238] - Add CockroachDB database support to Openfire
• [OF-3239] - Add MariaDB database support to Openfire
• [OF-3253] - Update org.jsmpp:jsmpp library from version 2.3.10 to 3.0.2
• [OF-3254] - Update Jaxen
• [OF-3259] - Phase out legacy property self-signed certificate acceptance
• [OF-3271] - Im...

Openfire 5.0.5 Release

5.0.5 -- May 15, 2026

Improvement

• [OF-1499] - Do not show 'max users' count for a MUC when it is 0 (unlimited)
• [OF-2503] - Display newlines in details of logged SecurityAuditManager events
• [OF-3160] - Bump BouncyCastle.version from 1.78.1 to 1.84
• [OF-3226] - LDAP context-close failures are logged without their exception stack trace
• [OF-3246] - Upgrade MySQL Connector/J driver to 8.4.0 release
• [OF-3247] - Upgrade Jetty webserver library to 12.0.35 release
• [OF-3274] - Update org.glassfish.jaxb:jaxb-runtime to the latest of the 2.3.x line

Task

• [OF-3230] - Disabled performance benchmark in IQEntityTimeHandlerTest should be removed or converted
• [OF-3236] - Fix malformed link markup in upgrade guide (hre instead of href)
• [OF-3265] - Update postgresql driver to 42.7.11
• [OF-3270] - MultiUserChatServiceImpl#setIdleUserTaskInterval ignores value

Bug

• [OF-3213] - A user's User Group page cannot be used to remove user from group
• [OF-3225] - LDAP authentication logs the wrong exception when the alternate base-DN also fails
• [OF-3255] - PluginIconServlet does not set HTTP Content-Type header for gif
• [OF-3263] - xffHostHeader values not updated
• [OF-3266] - Wrong getter used in ConnectionListenser#setAcceptSelfSignedCertificates

sha256sum values:

4ba9b6476efefc54378c0fd4a2a402177fd94bc11512354db887eb446f37f211  openfire-5.0.5-1.noarch.rpm
3a870ef09415f3bf2eac315ac826b59997eba6bcc38a1eb3740856ff16ffc11c  openfire_5.0.5_all.deb
94d3a8a159a68fdff17394c415d3ce1feb557fb8ef0618a883180f668a359cc2  openfire_5_0_5.dmg
bbc4c1147ff1a4d8740a5e12929e650dc04e3c7a6c765ff13855da48c16f980a  openfire_5_0_5.exe
50028a20587ea9d6b5bcc8260ca626e022d223b39748ffe7b9851d9b344dba6b  openfire_5_0_5.tar.gz
649f3b14a5403275780a2344b2d575f163a2e182eefa9c4978bd325cbf7486d5  openfire_5_0_5_x64.exe
49edd9873a84d2f6b19c24d360ac964ea9180753f6dff4355d75be3943e20817  openfire_5_0_5.zip

Openfire 5.0.4 Release

Improvement

• [OF-3156] - Improve error handling when MUC service creation fails in admin console
• [OF-3160] - Bump BouncyCastle.version from 1.78.1 to 1.83
• [OF-3164] - High CPU usage caused by exception-based control flow in UserManager.isRegisteredUser()
• [OF-3177] - Improve logging when TrustManager initialization fails (exception currently suppressed)
• [OF-3200] - Improve InMemoryPubSubPersistenceProvider.purgeNode() to target the service cache entry directly instead of scanning all entries

Task

• [OF-3161] - Upgrade Netty to 4.1.131 version
• [OF-3162] - Upgrade Apache commons-text from 1.10.0 to 1.15.0
• [OF-3178] - Update install4j to 12.0.2

Bug

• [OF-2637] - Admin Console -> Logs viewer. Selecting 'All' lines causes exception
• [OF-3132] - When obtaining user sessions for bare JID, not all sessions are returned
• [OF-3165] - Fix incorrect message in closeNeverEncryptedConnection method
• [OF-3175] - Openfire startup deadlocks during autosetup when encrypted XML properties are processed
• [OF-3197] - updateSubscription() sets wrong parameter index when deleting a subscription in state none, silently failing to delete the correct row
• [OF-3198] - LOAD_LAST_ITEMS_LIMIT query returns items in ascending order, causing incorrect results for non-SQL Server, non-Oracle databases
• [OF-3205] - always update lastPublished when same item is overwritten (XEP-0060 §7.1.2)

sha256sum values for release artifacts

c49add8f50999b2d7fcdd8960bc7d70bf59eb95d12daedf92902e4b034c1c737  openfire-5.0.4-1.noarch.rpm
14d22bef24fb01770f51c655c8b3b54207125b1b70641175d8ad25b585e6332a  openfire_5.0.4_all.deb
ddd40e0bac4c4fae0678b6df4fd5ad28f77af50fd530e3327326f3b488f16ae4  openfire_5_0_4.dmg
8c2fcb27f9afe01b79d59f7bf0736b21cdb72b5464de25a183b596329e351099  openfire_5_0_4.exe
01c7314268d87b1f8eee0677bb89656f12a082e6461b207d3955f5d9632e2f78  openfire_5_0_4.tar.gz
13b579672b2ce238934aa919cd968636c0f5c8afda5aeb3aec08d60feca35df4  openfire_5_0_4_x64.exe
05b9e5fa976202ef97d183177f6de699cf68bf0cfd422f721a4c8dc5676c1612  openfire_5_0_4.zip

Openfire 5.0.3 Release

Improvement

• [OF-3130] - Update PostgreSQL JDBC driver to 42.7.8
• [OF-3134] - Upgrade HSLQDB from 2.7.1 to 2.7.4
• [OF-3135] - Improve wording of TLS Auth setting
• [OF-3139] - Remove obsolete transport icons

Bug

• [OF-3127] - ConcurrentModificationException on room join
• [OF-3133] - Fix datatype of muc#register_faqentry field
• [OF-3144] - Upgrade sqlserver JDBC driver to 10.2.4
• [OF-3146] - Chat room count value is incorrect
• [OF-3147] - server_bytes_out statistic is not being populated
• [OF-3148] - Admin MUC affiliations are not persisted in ofMucAffiliation (lost after restart)
• [OF-3149] - IllegalStateException occurs when removing shared groups due to multiple Iterator.remove() calls for a single Iterator.next().
• [OF-3155] - Resource policy "Always kick" does not function correctly

sha256sum values

a08493cb19bef6dd2b51ebe88d4ffd121553e2e4473ddbecf94f5ff350e367aa  openfire-5.0.3-1.noarch.rpm
3dd1e9de84d6b177f3b890bea7d6cd88359698bd82c2e656d4b937a8ef7af96e  openfire_5.0.3_all.deb
b3674baa3ab53a1f61db8846c3cdd16ce211917c4df3cee2d4a46fbba265ea76  openfire_5_0_3.dmg
cfabc92ab9e473e71f42ec40533a5d4ae7a9c1dc5ebd060784ce434ae1ba6c12  openfire_5_0_3.exe
fb13bd4e0aff7bd6cc16d78e6f2c35d8b59a95e4f4f886d353265306f151ec45  openfire_5_0_3.tar.gz
dcad510a8a7fda677b07281d08ebb29017555944eeb41c98fb4f38c743a341c4  openfire_5_0_3_x64.exe
0ee9a0837e75b785a40653f78b94a900431067f8a9d2bac5104d2971c46a9779  openfire_5_0_3.zip

Openfire 5.0.2 Release

Improvement

• [OF-3104] - When a MUC room's config gets changed, send appropriate status code
• [OF-3107] - Synchronize launch scripts
• [OF-3110] - Guard against unexpectedly empty input
• [OF-3112] - Less strict with regards to whitespace in base64 encoding
• [OF-3114] - AdHoc 'end user session' command to report how many sessions were ended
• [OF-3116] - IQLastActivityHandler should ignore IQ responses
• [OF-3118] - Bump org.apache.commons:commons-lang3 from 3.9 to 3.18.0
• [OF-3123] - For client mutual authentication, prefer Subject Alternative Name for identities

New Feature

• [OF-3100] - Have PEP 'process' function return a future

Bug

• [OF-3106] - /etc/init.d/openfire: when JAVA\_HOME is empty it fails to detect the best java version
• [OF-3108] - Certificate update breaks functionality
• [OF-3109] - HSQLDB database viewer doesn't always start
• [OF-3113] - UserNotFoundException in PresenceSubscribeHandler
• [OF-3117] - Unit test failures when there's a space in the base path
• [OF-3124] - CVE-2025-59154 Potential identity spoofing via unsafe CN parsing

sha256sum values

4e907c615b3a19af0a1b5ab68ae24825b737496f9cf1715c9feafe8f909086da  openfire-5.0.2-1.noarch.rpm
21271a6f22895852e50712236c45c7d213430171d5a3178474b8398f036ac07a  openfire_5.0.2_all.deb
06794a12acdd8f23ca3c40fcd7af1677d8108b4b23bb72424c2751b30cfb3d14  openfire_5_0_2.dmg
c1e830b5e016d0bcff40005cc7bb14c846fe0ec26fc5a3fc967c30e5b6d2e356  openfire_5_0_2.exe
c84ca15cd470d3233add97c852c738eb373859dc9968ad34ec581725164c8114  openfire_5_0_2.tar.gz
98b5cf96326c668efb18cd9347b808a5ef85162b4a0b703aaf8e29d82cc6c727  openfire_5_0_2_x64.exe
8e09ca3dc7fb84b116ce95d10bfa3ff045708cdac4b23bd3d78ccf318e8742d8  openfire_5_0_2.zip

Openfire 5.0.1 Release

Improvement

• [OF-3095] - Do not warn about cache max lifetime settings with default values

Task

• [OF-3096] - Update bundled Search plugin

Bug

• [OF-3093] - Windows Launcher failure (missing images)
• [OF-3094] - Client-to-Server SASL EXTERNAL incorrectly queries for authzid
• [OF-3098] - Federated occupants get incorrectly identified as 'ghost'

sha256sum values

f3ce9c3ca91b357ca1bcea6623e9e083fe3193dc2084e1e09a72b6a82d467a9c  openfire-5.0.1-1.noarch.rpm
3cf96db06ed0bb2f0121ea7a76e44fd2c98a9c4e6239dda99a83039bcff4fa1e  openfire_5.0.1_all.deb
d2295fe212221cf3b0c0d93c24180526ec70bdaa1d46d1735d8bf5d21b4cf690  openfire_5_0_1.dmg
ad82c41c96ee0e16209b0c2d65f80d3b62ce58b76fdab7bd84435f25814b0c3f  openfire_5_0_1.exe
91ca2a3644463cf1e6c8150ad874963e8f50e5f85ff48fccd91a6d849c17b231  openfire_5_0_1.tar.gz
65e78936e051b52257f02f37f42271b358a7d1ab7775f9f4cf80837593887fb7  openfire_5_0_1_x64.exe
ce2e18ae1357d18938d709724718e32cce592575632640ad76c38a18d4dd793b  openfire_5_0_1.zip

Openfire 5.0.0 Release

Improvement

• [OF-2132] - Use CRL as provided by CA
• [OF-2134] - Restore and improve Certificate Revocation support
• [OF-2280] - Guard against S2S connection inconsistency in cluster
• [OF-2453] - Disable Connection Manager ports by default
• [OF-2785] - Add IPv6 support when evaluating Client Session IP addresses
• [OF-2786] - IPv6/IPv4 fallback
• [OF-2787] - Add IPv6-specific documentation
• [OF-2811] - Do not block Netty EventLoop threads
• [OF-2821] - Allow session-summary to display resource string
• [OF-2859] - Rename MUCRole
• [OF-2862] - Refactor 'role' and 'affiliation' related privileges
• [OF-2871] - Allow optional password for alternate venue when destroying room
• [OF-2876] - Rise minimal required JRE to 17
• [OF-2877] - Reproducible builds
• [OF-2889] - i18n properties: don't convert from UTF-8 to Latin1
• [OF-2892] - Available Plugins page: redesign to make Documentation easier to see
• [OF-2902] - Update commons-fileupload for transitive CVE
• [OF-2903] - Upgrade Sitemesh
• [OF-2914] - Reduce verbosity of TLS issues
• [OF-2919] - Don't let XMPP-decoder decode TLS's End-of-Transmission
• [OF-2924] - Reduce duplicate code in Multi-providers
• [OF-2926] - Add documented configuration options for LdapAuthProvider's cache
• [OF-2927] - Allow LDAP alternateBaseDN to be configured in admin console
• [OF-2928] - Improve parallel execution of multi-providers
• [OF-2939] - Show plugin warning on index page
• [OF-2940] - Run all plugin database update scripts
• [OF-2942] - S2S outbound can give up faster when encryption and/or auth mechanisms are exhausted
• [OF-2945] - Suppress warning during JSPC precompilation
• [OF-2950] - RemoteSessionLocator should ignore local node
• [OF-2951] - Faster log-in \(with federated contacts\)
• [OF-2955] - Update PostgreSQL JDBC driver to 42.7.7
• [OF-2958] - Bump up timeout for MUC non-responsiveness check
• [OF-2967] - Remove newline before presence in ClientSession toString
• [OF-3027] - Give parent eventloop threads a recognizable name
• [OF-3028] - Netty threads from 'child' eventloop should use Netty-default settings
• [OF-3030] - "Setting locale to X" isn't a warning
• [OF-3033] - Modify Stream Management to account for short-lived background apps
• [OF-3034] - Stream Management optional close shouldn't log error
• [OF-3035] - Failure to get address from detached session over cluster shouldn't log an error
• [OF-3036] - Improve log messages when unable to connect to a remote host that is unreachable
• [OF-3038] - Reduce verbosity of Socket Connection reset log messages \(c2s only\)
• [OF-3048] - Load time of session-summary admin page in a cluster
• [OF-3052] - Consistently use pagination for ad-hoc commands
• [OF-3055] - When removing XML elements, don't expect there to be only one.
• [OF-3056] - Reduce reliance on RoutingTable when processing directed presence
• [OF-3059] - Deprecate concept of 'anonymous route'
• [OF-3061] - Improve DB query to get last pubsub items
• [OF-3062] - Ignore unexpected 'subscription' values in Roster Set
• [OF-3063] - CAPS calculation debug info
• [OF-3065] - Allow Connection Manager DirectTLS endpoint configuration
• [OF-3067] - Bump up xmpp.server.outgoing.max.threads
• [OF-3068] - SocketUtil should give up sooner
• [OF-3071] - Replace Pull Parser \(XPP3\) library for compat with Java 11
• [OF-3078] - JDBCAuthProvider: Default bcrypt log rounds 10
• [OF-3079] - Backwards compat plugins
• [OF-3083] - SerializingCache should dereference classes when unused

Task

• [OF-2717] - Migrate to Jetty 12
• [OF-2722] - Phase out commons-fileupload
• [OF-2729] - Setup IPv6 tests
• [OF-2754] - Deprecate FastDateFormat
• [OF-2793] - Include Oracle Database Driver in distribution
• [OF-2905] - Update Maven Wrapper to 3.3.2
• [OF-2943] - Update database used by unit tests
• [OF-2956] - Drop unused database table ofSASLAuthorized
• [OF-2961] - Update Netty to 4.1.118
• [OF-3051] - Update to Tinder 2.1.0
• [OF-3082] - Allow SerializingCache to use 'raw' types
• [OF-3084] - Remove code that is deprecated and scheduled for removal in 5.0.0

New Feature

• [OF-2607] - Implement XEP-0421: Anonymous unique occupant identifiers for MUCs
• [OF-2760] - Add option to tombstone/retire a MUC upon deletion, preventing the name from use in the future
• [OF-2885] - TaskEngine jobs to support Future
• [

Openfire 5.0.0 Beta Release

Improvement

• [OF-2132] - Use CRL as provided by CA
• [OF-2134] - Restore and improve Certificate Revocation support
• [OF-2280] - Guard against S2S connection inconsistency in cluster
• [OF-2453] - Disable Connection Manager ports by default
• [OF-2785] - Add IPv6 support when evaluating Client Session IP addresses
• [OF-2786] - IPv6/IPv4 fallback
• [OF-2787] - Add IPv6-specific documentation
• [OF-2811] - Do not block Netty EventLoop threads
• [OF-2821] - Allow session-summary to display resource string
• [OF-2859] - Rename MUCRole
• [OF-2862] - Refactor 'role' and 'affiliation' related privileges
• [OF-2871] - Allow optional password for alternate venue when destroying room
• [OF-2876] - Rise minimal required JRE to 17
• [OF-2877] - Reproducible builds
• [OF-2889] - i18n properties: don't convert from UTF-8 to Latin1
• [OF-2892] - Available Plugins page: redesign to make Documentation easier to see
• [OF-2902] - Update commons-fileupload for transitive CVE
• [OF-2903] - Upgrade Sitemesh
• [OF-2914] - Reduce verbosity of TLS issues
• [OF-2919] - Don't let XMPP-decoder decode TLS's End-of-Transmission
• [OF-2924] - Reduce duplicate code in Multi-providers
• [OF-2926] - Add documented configuration options for LdapAuthProvider's cache
• [OF-2927] - Allow LDAP alternateBaseDN to be configured in admin console
• [OF-2928] - Improve parallel execution of multi-providers
• [OF-2939] - Show plugin warning on index page
• [OF-2940] - Run all plugin database update scripts
• [OF-2942] - S2S outbound can give up faster when encryption and/or auth mechanisms are exhausted
• [OF-2945] - Suppress warning during JSPC precompilation
• [OF-2950] - RemoteSessionLocator should ignore local node
• [OF-2951] - Faster log-in \(with federated contacts\)
• [OF-2955] - Update PostgreSQL JDBC driver to 42.7.7
• [OF-2958] - Bump up timeout for MUC non-responsiveness check
• [OF-2967] - Remove newline before presence in ClientSession toString
• [OF-3027] - Give parent eventloop threads a recognizable name
• [OF-3028] - Netty threads from 'child' eventloop should use Netty-default settings
• [OF-3030] - "Setting locale to X" isn't a warning
• [OF-3033] - Modify Stream Management to account for short-lived background apps
• [OF-3034] - Stream Management optional close shouldn't log error
• [OF-3035] - Failure to get address from detached session over cluster shouldn't log an error
• [OF-3036] - Improve log messages when unable to connect to a remote host that is unreachable
• [OF-3038] - Reduce verbosity of Socket Connection reset log messages \(c2s only\)
• [OF-3048] - Load time of session-summary admin page in a cluster
• [OF-3052] - Consistently use pagination for ad-hoc commands
• [OF-3055] - When removing XML elements, don't expect there to be only one.
• [OF-3056] - Reduce reliance on RoutingTable when processing directed presence
• [OF-3059] - Deprecate concept of 'anonymous route'
• [OF-3061] - Improve DB query to get last pubsub items
• [OF-3062] - Ignore unexpected 'subscription' values in Roster Set
• [OF-3063] - CAPS calculation debug info
• [OF-3065] - Allow Connection Manager DirectTLS endpoint configuration
• [OF-3067] - Bump up xmpp.server.outgoing.max.threads
• [OF-3068] - SocketUtil should give up sooner
• [OF-3071] - Replace Pull Parser \(XPP3\) library for compat with Java 11
• [OF-3078] - JDBCAuthProvider: Default bcrypt log rounds 10
• [OF-3079] - Backwards compat plugins
• [OF-3083] - SerializingCache should dereference classes when unused

Task

• [OF-2717] - Migrate to Jetty 12
• [OF-2722] - Phase out commons-fileupload
• [OF-2729] - Setup IPv6 tests
• [OF-2754] - Deprecate FastDateFormat
• [OF-2793] - Include Oracle Database Driver in distribution
• [OF-2905] - Update Maven Wrapper to 3.3.2
• [OF-2943] - Update database used by unit tests
• [OF-2956] - Drop unused database table ofSASLAuthorized
• [OF-2961] - Update Netty to 4.1.118
• [OF-3051] - Update to Tinder 2.1.0
• [OF-3082] - Allow SerializingCache to use 'raw' types
• [OF-3084] - Remove code that is deprecated and scheduled for removal in 5.0.0

New Feature

• [OF-2607] - Implement XEP-0421: Anonymous unique occupant identifiers for MUCs
• [OF-2760] - Add option to tombstone/retire a MUC upon deletion, preventing the name from use in the future
• [OF-2885] - TaskEngine jobs to support Future
• [

Openfire 5.0.0 Alpha Release

To support an upcoming beta release of Openfire 5.0.0, we have created an alpha release to support some plugin development needs. API changes may still happen before a beta, so please use this release with caution / only for testing usage.

Improvement

OF-2132 Use CRL as provided by CA

OF-2134 Restore and improve Certificate Revocation support

OF-2785 Add IPv6 support when evaluating Client Session IP addresses

OF-2786 IPv6/IPv4 fallback

OF-2787 Add IPv6-specific documentation

OF-2789 Expose Netty executor pools

OF-2859 Rename MUCRole

OF-2862 Refactor 'role' and 'affiliation' related privileges

OF-2871 Allow optional password for alternate venue when destroying room

OF-2876 Rise minimal required JRE to 17

OF-2877 Reproducible builds

OF-2892 Available Plugins page: redesign to make Documentation easier to see

OF-2902 Update commons-fileupload for transitive CVE

OF-2903 Upgrade Sitemesh

OF-2914 Reduce verbosity of TLS issues

OF-2919 Don't let XMPP-decoder decode TLS's End-of-Transmission

OF-2922 FMUC compatibility with M-Link

OF-2924 Reduce duplicate code in Multi-providers

OF-2926 Add documented configuration options for LdapAuthProvider's cache

OF-2927 Allow LDAP alternateBaseDN to be configured in admin console

OF-2928 Improve parallel execution of multi-providers

OF-2939 Show plugin warning on index page

OF-2942 S2S outbound can give up faster when encryption and/or auth mechanisms are exhausted

New Feature

OF-2760 Add option to tombstone/retire a MUC upon deletion, preventing the name from use in the future

OF-2885 TaskEngine jobs to support Future

OF-2916 Add option to delete history on room deletion

OF-2917 Add option to preserve room history on room deletion

OF-2918 Add option to clear history for a given MUC

OF-2923 Use more than one AD/LDAP server

OF-2925 Have multi-providers for groups

Task

OF-2717 Migrate to Jetty 12

OF-2722 Phase out commons-fileupload

OF-2729 Setup IPv6 tests

OF-2905 Update Maven Wrapper to 3.3.2

OF-2943 Update database used by unit tests

Sub-task

OF-2861 Rename MUCRole, breaking changes

Bug

OF-2397 Subscription change requests for shared contacts are partially processed

OF-2631 Access model of leaf nodes is ignored

OF-2784 IPv6 addresses should be usable in Registration&Login settings

OF-2865 A moderator SHOULD NOT be allowed to revoke moderation privileges from someone with a higher affiliation than themselves

OF-2904 Invalid OtherName parsing of TLS certificates

OF-2911 NPE: Cannot invoke "java.lang.StringBuilder.length()" because "this.buffer" is null

OF-2912 Admin Console reports DNS Issue while dns-check.jsp reporting no issue

OF-2915 Database statistics don't observe end-time

OF-2930 Vulnerability discovered in netty-common- 4.1.108.Final.jar CVE-2024-47535

OF-2935 Unable to set the 'Retire room names on deletion..' check box in a clustered environment

OF-2938 Missing warnings for incompatible plugins

OF-2941 Incorrect detection of plugin update with SNAPSHOTs

sha256sum values

303cf1f37b48b50e9819ae19608eaca4c69317405188fab62748add1b75b42b9  openfire_5_0_0-alpha.exe
55b50617ce8029ad785f945d100d0a247a95a4ccf81615b2a3c63ed16451bfe2  openfire_5_0_0-alpha.tar.gz
5f7d074c2bb9fa9969b67c8f2776fa38b2cc57f6056cce1db7b6dc84aeff2b95  openfire_5_0_0-alpha_x64.exe
8e43b4f62c9d6b2362fa4f22d629c97e651deb5066f8162cad4fa49252bdf1d3  openfire_5_0_0-alpha.zip
2ae99276a48c2c7d21519a9a4ab3368e535e3f53a7f87fa3b670585e9e19e83c openfire_5.0.0_all.deb
9ce132179d0a0bb0902e1bde103e40f1b5f740e461c8173597ac38338b008f6d  openfire-5.0.0-1.noarch.rpm