LoginSign Up
← Back to all sparks
N

NanoMQ

COMMS
Velocity6.3

Lightweight MQTT broker for edge and IoT

nanomq.io ↗

A protocol-layer correctness pass, delivered largely by first-time contributors

mqttiotedge-brokerprotocol-conformancememory-safetycontributors
◆Current state
0.25.6 is a bug-fix release the maintainer recommends to every user on an earlier tag, and its weight sits in NanoNNG rather than the broker: unsuccessful CONNACK negotiation is now rejected, Session Expiry Interval is accepted in CONNACK, pipes closed during the unlocked auth window are no longer registered, receive pipes unlink on session handoff, and a strict property checker guards against malformed input. Two potential security issues are patched, SCRAM handling hardened, and a workaround added for an NNG TLS idle bug. Four of the contributors are making their first commit to the project.
◆Where it's heading
The hardening campaign that began with fuzzing on the 0.24 line has moved up into MQTT protocol conformance — this release is dense with spec-edge handling and lifecycle races rather than crashes. The more interesting shift is social: after 0.25.5 traded architecture breadth for correctness depth, the protocol layer is now attracting outside contributors, with four newcomers landing fixes in NanoNNG in a single release. That is a different growth mode than the maintainer-driven cadence of the 0.24 line.
◆Prediction
The 0.25 line looks set to continue on protocol conformance and session lifecycle correctness rather than new features. The SipHash client ID hashing question the maintainer raised in 0.25.2 is still open in these entries, with no resolution either way.

◆Recent moves

  1. 28d ago

    0.25.6 tightens MQTT conformance and auth-window pipe races

    The hardening arc moves from memory safety into protocol conformance: CONNACK negotiation failures are rejected, a strict property checker blocks malformed input, and pipes closed during the unlocked auth window no longer register. Two security fixes and a SCRAM safety pass sit alongside a workaround for the NNG TLS idle bug. Notable that four first-time contributors did much of this NanoNNG work.

    View source ↗
  2. 1mo ago

    MIPS and ARMel binaries dropped; lock-free config reload lands

    ⚡ SPARK

    The pivot of this window — narrowing hardware support to fund correctness work for safety-critical deployments. 0.25.6 follows directly on that budget, spending it on protocol conformance rather than features.

    View source ↗
  3. 2mo ago

    First official 0.25 build fixes a last-will memory leak

    The point where 0.25 stopped being a trial line. Its headline fix — a conn_param leak introduced by last-will handling in 0.24.14 — is the kind of regression the later fuzzing and conformance work is meant to catch earlier.

    View source ↗
  4. 2mo ago

    Temporary build tagged between 0.25.2 and 0.25.3

    A one-line temporary tag with no release content, sitting between the pre-release and the first official 0.25 build.

    View source ↗
  5. 2mo ago

    Client ID hashing moves from DJBHash to SipHash

    A security-motivated change the maintainer publishes with open ambivalence about its CPU cost, asking for feedback rather than declaring it settled. Nothing in the later entries resolves that question.

    View source ↗
  6. 3mo ago

    Trial pre-release opens the 0.25 line

    A trial build whose changes are dependency bumps and a REST API consolidation carried forward into later 0.25 tags. Marks the line opening rather than delivering anything itself.

    View source ↗