Releases: igniterealtime/Openfire
Openfire 5.0.3 Release
Improvement
- [OF-3130] - Update PostgreSQL JDBC driver to 42.7.8
- [OF-3134] - Upgrade HSLQDB from 2.7.1 to 2.7.4
- [OF-3135] - Improve wording of TLS Auth setting
- [OF-3139] - Remove obsolete transport icons
Bug
- [OF-3127] - ConcurrentModificationException on room join
- [OF-3133] - Fix datatype of muc#register_faqentry field
- [OF-3144] - Upgrade sqlserver JDBC driver to 10.2.4
- [OF-3146] - Chat room count value is incorrect
- [OF-3147] - server_bytes_out statistic is not being populated
- [OF-3148] - Admin MUC affiliations are not persisted in ofMucAffiliation (lost after restart)
- [OF-3149] - IllegalStateException occurs when removing shared groups due to multiple Iterator.remove() calls for a single Iterator.next().
- [OF-3155] - Resource policy "Always kick" does not function correctly
sha256sum values
a08493cb19bef6dd2b51ebe88d4ffd121553e2e4473ddbecf94f5ff350e367aa openfire-5.0.3-1.noarch.rpm
3dd1e9de84d6b177f3b890bea7d6cd88359698bd82c2e656d4b937a8ef7af96e openfire_5.0.3_all.deb
b3674baa3ab53a1f61db8846c3cdd16ce211917c4df3cee2d4a46fbba265ea76 openfire_5_0_3.dmg
cfabc92ab9e473e71f42ec40533a5d4ae7a9c1dc5ebd060784ce434ae1ba6c12 openfire_5_0_3.exe
fb13bd4e0aff7bd6cc16d78e6f2c35d8b59a95e4f4f886d353265306f151ec45 openfire_5_0_3.tar.gz
dcad510a8a7fda677b07281d08ebb29017555944eeb41c98fb4f38c743a341c4 openfire_5_0_3_x64.exe
0ee9a0837e75b785a40653f78b94a900431067f8a9d2bac5104d2971c46a9779 openfire_5_0_3.zip
Openfire 5.0.2 Release
Improvement
- [OF-3104] - When a MUC room's config gets changed, send appropriate status code
- [OF-3107] - Synchronize launch scripts
- [OF-3110] - Guard against unexpectedly empty input
- [OF-3112] - Less strict with regards to whitespace in base64 encoding
- [OF-3114] - AdHoc 'end user session' command to report how many sessions were ended
- [OF-3116] - IQLastActivityHandler should ignore IQ responses
- [OF-3118] - Bump org.apache.commons:commons-lang3 from 3.9 to 3.18.0
- [OF-3123] - For client mutual authentication, prefer Subject Alternative Name for identities
New Feature
- [OF-3100] - Have PEP 'process' function return a future
Bug
- [OF-3106] - /etc/init.d/openfire: when JAVA\_HOME is empty it fails to detect the best java version
- [OF-3108] - Certificate update breaks functionality
- [OF-3109] - HSQLDB database viewer doesn't always start
- [OF-3113] - UserNotFoundException in PresenceSubscribeHandler
- [OF-3117] - Unit test failures when there's a space in the base path
- [OF-3124] - CVE-2025-59154 Potential identity spoofing via unsafe CN parsing
sha256sum values
4e907c615b3a19af0a1b5ab68ae24825b737496f9cf1715c9feafe8f909086da openfire-5.0.2-1.noarch.rpm
21271a6f22895852e50712236c45c7d213430171d5a3178474b8398f036ac07a openfire_5.0.2_all.deb
06794a12acdd8f23ca3c40fcd7af1677d8108b4b23bb72424c2751b30cfb3d14 openfire_5_0_2.dmg
c1e830b5e016d0bcff40005cc7bb14c846fe0ec26fc5a3fc967c30e5b6d2e356 openfire_5_0_2.exe
c84ca15cd470d3233add97c852c738eb373859dc9968ad34ec581725164c8114 openfire_5_0_2.tar.gz
98b5cf96326c668efb18cd9347b808a5ef85162b4a0b703aaf8e29d82cc6c727 openfire_5_0_2_x64.exe
8e09ca3dc7fb84b116ce95d10bfa3ff045708cdac4b23bd3d78ccf318e8742d8 openfire_5_0_2.zip
Openfire 5.0.1 Release
Improvement
- [OF-3095] - Do not warn about cache max lifetime settings with default values
Task
- [OF-3096] - Update bundled Search plugin
Bug
- [OF-3093] - Windows Launcher failure (missing images)
- [OF-3094] - Client-to-Server SASL EXTERNAL incorrectly queries for authzid
- [OF-3098] - Federated occupants get incorrectly identified as 'ghost'
sha256sum values
f3ce9c3ca91b357ca1bcea6623e9e083fe3193dc2084e1e09a72b6a82d467a9c openfire-5.0.1-1.noarch.rpm
3cf96db06ed0bb2f0121ea7a76e44fd2c98a9c4e6239dda99a83039bcff4fa1e openfire_5.0.1_all.deb
d2295fe212221cf3b0c0d93c24180526ec70bdaa1d46d1735d8bf5d21b4cf690 openfire_5_0_1.dmg
ad82c41c96ee0e16209b0c2d65f80d3b62ce58b76fdab7bd84435f25814b0c3f openfire_5_0_1.exe
91ca2a3644463cf1e6c8150ad874963e8f50e5f85ff48fccd91a6d849c17b231 openfire_5_0_1.tar.gz
65e78936e051b52257f02f37f42271b358a7d1ab7775f9f4cf80837593887fb7 openfire_5_0_1_x64.exe
ce2e18ae1357d18938d709724718e32cce592575632640ad76c38a18d4dd793b openfire_5_0_1.zip
Openfire 5.0.0 Release
Improvement
- [OF-2132] - Use CRL as provided by CA
- [OF-2134] - Restore and improve Certificate Revocation support
- [OF-2280] - Guard against S2S connection inconsistency in cluster
- [OF-2453] - Disable Connection Manager ports by default
- [OF-2785] - Add IPv6 support when evaluating Client Session IP addresses
- [OF-2786] - IPv6/IPv4 fallback
- [OF-2787] - Add IPv6-specific documentation
- [OF-2811] - Do not block Netty EventLoop threads
- [OF-2821] - Allow session-summary to display resource string
- [OF-2859] - Rename MUCRole
- [OF-2862] - Refactor 'role' and 'affiliation' related privileges
- [OF-2871] - Allow optional password for alternate venue when destroying room
- [OF-2876] - Rise minimal required JRE to 17
- [OF-2877] - Reproducible builds
- [OF-2889] - i18n properties: don't convert from UTF-8 to Latin1
- [OF-2892] - Available Plugins page: redesign to make Documentation easier to see
- [OF-2902] - Update commons-fileupload for transitive CVE
- [OF-2903] - Upgrade Sitemesh
- [OF-2914] - Reduce verbosity of TLS issues
- [OF-2919] - Don't let XMPP-decoder decode TLS's End-of-Transmission
- [OF-2924] - Reduce duplicate code in Multi-providers
- [OF-2926] - Add documented configuration options for LdapAuthProvider's cache
- [OF-2927] - Allow LDAP alternateBaseDN to be configured in admin console
- [OF-2928] - Improve parallel execution of multi-providers
- [OF-2939] - Show plugin warning on index page
- [OF-2940] - Run all plugin database update scripts
- [OF-2942] - S2S outbound can give up faster when encryption and/or auth mechanisms are exhausted
- [OF-2945] - Suppress warning during JSPC precompilation
- [OF-2950] - RemoteSessionLocator should ignore local node
- [OF-2951] - Faster log-in \(with federated contacts\)
- [OF-2955] - Update PostgreSQL JDBC driver to 42.7.7
- [OF-2958] - Bump up timeout for MUC non-responsiveness check
- [OF-2967] - Remove newline before presence in ClientSession toString
- [OF-3027] - Give parent eventloop threads a recognizable name
- [OF-3028] - Netty threads from 'child' eventloop should use Netty-default settings
- [OF-3030] - "Setting locale to X" isn't a warning
- [OF-3033] - Modify Stream Management to account for short-lived background apps
- [OF-3034] - Stream Management optional close shouldn't log error
- [OF-3035] - Failure to get address from detached session over cluster shouldn't log an error
- [OF-3036] - Improve log messages when unable to connect to a remote host that is unreachable
- [OF-3038] - Reduce verbosity of Socket Connection reset log messages \(c2s only\)
- [OF-3048] - Load time of session-summary admin page in a cluster
- [OF-3052] - Consistently use pagination for ad-hoc commands
- [OF-3055] - When removing XML elements, don't expect there to be only one.
- [OF-3056] - Reduce reliance on RoutingTable when processing directed presence
- [OF-3059] - Deprecate concept of 'anonymous route'
- [OF-3061] - Improve DB query to get last pubsub items
- [OF-3062] - Ignore unexpected 'subscription' values in Roster Set
- [OF-3063] - CAPS calculation debug info
- [OF-3065] - Allow Connection Manager DirectTLS endpoint configuration
- [OF-3067] - Bump up xmpp.server.outgoing.max.threads
- [OF-3068] - SocketUtil should give up sooner
- [OF-3071] - Replace Pull Parser \(XPP3\) library for compat with Java 11
- [OF-3078] - JDBCAuthProvider: Default bcrypt log rounds 10
- [OF-3079] - Backwards compat plugins
- [OF-3083] - SerializingCache should dereference classes when unused
Task
- [OF-2717] - Migrate to Jetty 12
- [OF-2722] - Phase out commons-fileupload
- [OF-2729] - Setup IPv6 tests
- [OF-2754] - Deprecate FastDateFormat
- [OF-2793] - Include Oracle Database Driver in distribution
- [OF-2905] - Update Maven Wrapper to 3.3.2
- [OF-2943] - Update database used by unit tests
- [OF-2956] - Drop unused database table ofSASLAuthorized
- [OF-2961] - Update Netty to 4.1.118
- [OF-3051] - Update to Tinder 2.1.0
- [OF-3082] - Allow SerializingCache to use 'raw' types
- [OF-3084] - Remove code that is deprecated and scheduled for removal in 5.0.0
New Feature
Openfire 5.0.0 Beta Release
Improvement
- [OF-2132] - Use CRL as provided by CA
- [OF-2134] - Restore and improve Certificate Revocation support
- [OF-2280] - Guard against S2S connection inconsistency in cluster
- [OF-2453] - Disable Connection Manager ports by default
- [OF-2785] - Add IPv6 support when evaluating Client Session IP addresses
- [OF-2786] - IPv6/IPv4 fallback
- [OF-2787] - Add IPv6-specific documentation
- [OF-2811] - Do not block Netty EventLoop threads
- [OF-2821] - Allow session-summary to display resource string
- [OF-2859] - Rename MUCRole
- [OF-2862] - Refactor 'role' and 'affiliation' related privileges
- [OF-2871] - Allow optional password for alternate venue when destroying room
- [OF-2876] - Rise minimal required JRE to 17
- [OF-2877] - Reproducible builds
- [OF-2889] - i18n properties: don't convert from UTF-8 to Latin1
- [OF-2892] - Available Plugins page: redesign to make Documentation easier to see
- [OF-2902] - Update commons-fileupload for transitive CVE
- [OF-2903] - Upgrade Sitemesh
- [OF-2914] - Reduce verbosity of TLS issues
- [OF-2919] - Don't let XMPP-decoder decode TLS's End-of-Transmission
- [OF-2924] - Reduce duplicate code in Multi-providers
- [OF-2926] - Add documented configuration options for LdapAuthProvider's cache
- [OF-2927] - Allow LDAP alternateBaseDN to be configured in admin console
- [OF-2928] - Improve parallel execution of multi-providers
- [OF-2939] - Show plugin warning on index page
- [OF-2940] - Run all plugin database update scripts
- [OF-2942] - S2S outbound can give up faster when encryption and/or auth mechanisms are exhausted
- [OF-2945] - Suppress warning during JSPC precompilation
- [OF-2950] - RemoteSessionLocator should ignore local node
- [OF-2951] - Faster log-in \(with federated contacts\)
- [OF-2955] - Update PostgreSQL JDBC driver to 42.7.7
- [OF-2958] - Bump up timeout for MUC non-responsiveness check
- [OF-2967] - Remove newline before presence in ClientSession toString
- [OF-3027] - Give parent eventloop threads a recognizable name
- [OF-3028] - Netty threads from 'child' eventloop should use Netty-default settings
- [OF-3030] - "Setting locale to X" isn't a warning
- [OF-3033] - Modify Stream Management to account for short-lived background apps
- [OF-3034] - Stream Management optional close shouldn't log error
- [OF-3035] - Failure to get address from detached session over cluster shouldn't log an error
- [OF-3036] - Improve log messages when unable to connect to a remote host that is unreachable
- [OF-3038] - Reduce verbosity of Socket Connection reset log messages \(c2s only\)
- [OF-3048] - Load time of session-summary admin page in a cluster
- [OF-3052] - Consistently use pagination for ad-hoc commands
- [OF-3055] - When removing XML elements, don't expect there to be only one.
- [OF-3056] - Reduce reliance on RoutingTable when processing directed presence
- [OF-3059] - Deprecate concept of 'anonymous route'
- [OF-3061] - Improve DB query to get last pubsub items
- [OF-3062] - Ignore unexpected 'subscription' values in Roster Set
- [OF-3063] - CAPS calculation debug info
- [OF-3065] - Allow Connection Manager DirectTLS endpoint configuration
- [OF-3067] - Bump up xmpp.server.outgoing.max.threads
- [OF-3068] - SocketUtil should give up sooner
- [OF-3071] - Replace Pull Parser \(XPP3\) library for compat with Java 11
- [OF-3078] - JDBCAuthProvider: Default bcrypt log rounds 10
- [OF-3079] - Backwards compat plugins
- [OF-3083] - SerializingCache should dereference classes when unused
Task
- [OF-2717] - Migrate to Jetty 12
- [OF-2722] - Phase out commons-fileupload
- [OF-2729] - Setup IPv6 tests
- [OF-2754] - Deprecate FastDateFormat
- [OF-2793] - Include Oracle Database Driver in distribution
- [OF-2905] - Update Maven Wrapper to 3.3.2
- [OF-2943] - Update database used by unit tests
- [OF-2956] - Drop unused database table ofSASLAuthorized
- [OF-2961] - Update Netty to 4.1.118
- [OF-3051] - Update to Tinder 2.1.0
- [OF-3082] - Allow SerializingCache to use 'raw' types
- [OF-3084] - Remove code that is deprecated and scheduled for removal in 5.0.0
New Feature
Openfire 5.0.0 Alpha Release
To support an upcoming beta release of Openfire 5.0.0, we have created an alpha release to support some plugin development needs. API changes may still happen before a beta, so please use this release with caution / only for testing usage.
Improvement
OF-2132 Use CRL as provided by CA
OF-2134 Restore and improve Certificate Revocation support
OF-2785 Add IPv6 support when evaluating Client Session IP addresses
OF-2786 IPv6/IPv4 fallback
OF-2787 Add IPv6-specific documentation
OF-2789 Expose Netty executor pools
OF-2859 Rename MUCRole
OF-2862 Refactor 'role' and 'affiliation' related privileges
OF-2871 Allow optional password for alternate venue when destroying room
OF-2876 Rise minimal required JRE to 17
OF-2877 Reproducible builds
OF-2892 Available Plugins page: redesign to make Documentation easier to see
OF-2902 Update commons-fileupload for transitive CVE
OF-2903 Upgrade Sitemesh
OF-2914 Reduce verbosity of TLS issues
OF-2919 Don't let XMPP-decoder decode TLS's End-of-Transmission
OF-2922 FMUC compatibility with M-Link
OF-2924 Reduce duplicate code in Multi-providers
OF-2926 Add documented configuration options for LdapAuthProvider's cache
OF-2927 Allow LDAP alternateBaseDN to be configured in admin console
OF-2928 Improve parallel execution of multi-providers
OF-2939 Show plugin warning on index page
OF-2942 S2S outbound can give up faster when encryption and/or auth mechanisms are exhausted
New Feature
OF-2760 Add option to tombstone/retire a MUC upon deletion, preventing the name from use in the future
OF-2885 TaskEngine jobs to support Future
OF-2916 Add option to delete history on room deletion
OF-2917 Add option to preserve room history on room deletion
OF-2918 Add option to clear history for a given MUC
OF-2923 Use more than one AD/LDAP server
OF-2925 Have multi-providers for groups
Task
OF-2717 Migrate to Jetty 12
OF-2722 Phase out commons-fileupload
OF-2729 Setup IPv6 tests
OF-2905 Update Maven Wrapper to 3.3.2
OF-2943 Update database used by unit tests
Sub-task
OF-2861 Rename MUCRole, breaking changes
Bug
OF-2397 Subscription change requests for shared contacts are partially processed
OF-2631 Access model of leaf nodes is ignored
OF-2784 IPv6 addresses should be usable in Registration&Login settings
OF-2865 A moderator SHOULD NOT be allowed to revoke moderation privileges from someone with a higher affiliation than themselves
OF-2904 Invalid OtherName parsing of TLS certificates
OF-2911 NPE: Cannot invoke "java.lang.StringBuilder.length()" because "this.buffer" is null
OF-2912 Admin Console reports DNS Issue while dns-check.jsp reporting no issue
OF-2915 Database statistics don't observe end-time
OF-2930 Vulnerability discovered in netty-common- 4.1.108.Final.jar CVE-2024-47535
OF-2935 Unable to set the 'Retire room names on deletion..' check box in a clustered environment
OF-2938 Missing warnings for incompatible plugins
OF-2941 Incorrect detection of plugin update with SNAPSHOTs
sha256sum values
303cf1f37b48b50e9819ae19608eaca4c69317405188fab62748add1b75b42b9 openfire_5_0_0-alpha.exe
55b50617ce8029ad785f945d100d0a247a95a4ccf81615b2a3c63ed16451bfe2 openfire_5_0_0-alpha.tar.gz
5f7d074c2bb9fa9969b67c8f2776fa38b2cc57f6056cce1db7b6dc84aeff2b95 openfire_5_0_0-alpha_x64.exe
8e43b4f62c9d6b2362fa4f22d629c97e651deb5066f8162cad4fa49252bdf1d3 openfire_5_0_0-alpha.zip
2ae99276a48c2c7d21519a9a4ab3368e535e3f53a7f87fa3b670585e9e19e83c openfire_5.0.0_all.deb
9ce132179d0a0bb0902e1bde103e40f1b5f740e461c8173597ac38338b008f6d openfire-5.0.0-1.noarch.rpm
Openfire 4.9.2 Release
Bug
- [OF-2900] - LocalIncomingServerSessionTest.incomingTest failures on Rocky Linux 9 / openjdk 11
- [OF-2901] - Reduce noisy logging of insecure LDAP
- [OF-2906] - Cannot proceed with setup error
sha256sum values
56b172229ff355c54caaba01f2d93ede05c636ccf113502ae512a6a9be9f4ebc openfire-4.9.2-1.noarch.rpm
2d81b8ed858146c135b862c200c81c48d67101b0d7108c0aa96346dbec45e559 openfire_4.9.2_all.deb
fd3b4d9a6bae21033396aef014a2d7e98979312289e6c193baa7517906af0cb9 openfire_4_9_2.dmg
4576e361daa48e7f25356a2a2ddf1a75fec8fac09290a96b83f106219288567b openfire_4_9_2.exe
029858da4cd82165b059f21787ae41d2ca327aca22fdadbc087b8eb12c48284c openfire_4_9_2.tar.gz
8c993828e58c7f0277e817783411121b653b2e73df42bfa6b9ebb03466a5b1db openfire_4_9_2_x64.exe
4eb6bcc89aca3dd1cd81363e453de22c354f2df22442ff639685d55aa2fe0742 openfire_4_9_2.zip
Please note that the openfire RPM artefact was refreshed after inital upload to correct compatibility level.
Openfire 4.9.1 Release
Improvement
- [OF-2880] - Disable directory listing of admin console
- [OF-2893] - Make it clearer when a plugin exposes HTTP wildcard routes
Bug
- [OF-2868] - NullPointerException while configuration encryption algorithms
- [OF-2873] - Improvements to debian build
- [OF-2874] - RPM build script fails when date locale non-english
- [OF-2884] - Making a group member a group admin removes the user from the group
- [OF-2890] - CSRF bug prevents AD admin test
- [OF-2891] - Misaligned button in directory service admin setup
- [OF-2896] - Memory Leak PreAuthSessions
- [OF-2897] - No-such-user detection misses anonymous users
- [OF-2898] - Session Destroyed event no longer published
- [OF-2899] - Handle null SASL mechanisms
sha256sum values
8c489503f24e35003e2930873037950a4a08bc276be1338b6a0928db0f0eb37d openfire-4.9.1-1.noarch.rpm
1e80a119c4e1d0b57d79aa83cbdbccf138a1dc8a4086ac10ae851dec4f78742d openfire_4.9.1_all.deb
69a946dacd5e4f515aa4d935c05978b5a60279119379bcfe0df477023e7a6f05 openfire_4_9_1.dmg
c4d7b15ab6814086ce5e8a1d6b243a442b8743a21282a1a4c5b7d615f9e52638 openfire_4_9_1.exe
d9f0dd50600ee726802bba8bc8415bf9f0f427be54933e6c987cef7cca012bb4 openfire_4_9_1.tar.gz
de45aaf1ad01235f2b812db5127af7d3dc4bc63984a9e4852f1f3d5332df7659 openfire_4_9_1_x64.exe
89b61cbdab265981fad4ab4562066222a2c3a9a68f83b6597ab2cb5609b2b1d7 openfire_4_9_1.zip
Openfire 4.9.0 Release
Improvement
- [OF-2854] - Do not build a distribution.jar
- [OF-2855] - Avoid non-cross platform filesystem references in Maven assembly
- [OF-2856] - Do not attempt to attach basic-distribution directory as a Maven artifact
- [OF-2857] - Replace bundled install4j runtime with a Maven dependency
- [OF-2864] - Deprecate custom Base64 class
- [OF-2869] - Add support for Persian/Farsi
Task
- [OF-2867] - Remove code marked for deprecation in 4.9.0 or later
Sub-task
- [OF-2860] - Rename MUCRole, non-breaking changes
Bug
- [OF-2830] - Plugin servlet mapping not precise
- [OF-2848] - Presence sent after room destruction sometimes doesn't include required element
- [OF-2853] - Admin console cluster overview bars are wrong
- [OF-2872] - Unexpected disconnects (possibly involving cyrillic character usage)
sha256sum values
7973cc2faef01cb2f03d3f2ec59aff9b2001d16b2755b4cc0da48cc92b74d18a openfire-4.9.0-1.noarch.rpm
a0cd627c629b00bb65b6080e06b8d13376ec0a4170fd27e863af0573e3b4f791 openfire_4.9.0_all.deb
bf62c02b0efe1d37fc505f6942a9cf058975746453d6d0218007b75b908a5c3c openfire_4_9_0.dmg
1082d9864df897befa47230c251d91ec0780930900b2ab2768aaabd96d7b5dd9 openfire_4_9_0.exe
12a4a5e5794ecb64a7da718646208390d0eb593c02a33a630f968eec6e5a93a0 openfire_4_9_0.tar.gz
c86bdb1c6afd4e2e013c4909a980cbac088fc51401db6e9792d43e532963df72 openfire_4_9_0_x64.exe
97efe5bfe8a7ab3ea73a01391af436096a040d202f3d06f599bc4af1cd7bccf0 openfire_4_9_0.zip
Openfire 4.8.3 Release
Improvement
- [OF-2846] - Update zh_CN translation
Bug
- [OF-2843] - When admin attempts to ban owner, incorrect error condition is returned
- [OF-2844] - Admins and owners must not be able to ban themselves
- [OF-2845] - Failing close listener can severely delay closure of connection
sha256sum values
b86bf8c01ede9cb2ae4f43dfd2f49239d9af2d73f650c7c2d52e5a936035e520 openfire-4.8.3-1.noarch.rpm
3f6da6c89ce701d974f6a1afe5ac0245f7112c5d165934eb1a85a749a1f040e2 openfire_4.8.3_all.deb
4fce60210033216556881fd9c988bea3ce30c0ed845f4dec3d4284ee835e8208 openfire_4_8_3.dmg
28b64c144001b0f6fb6eb4705d0bb1a92581774369378196182b8d35237b83be openfire_4_8_3.exe
43d3b042357a5c975785f3f223490e3dd18b1f499c206be6cd0857172cc005fc openfire_4_8_3.tar.gz
a09752fbe1226724d466028036fc65d31fe88e60a0efb27a87f1e10ab100fbb1 openfire_4_8_3_x64.exe
5c0638f150ccb61471b4b5152743b6d18cbe008473f454ed0091a13d7b80cb85 openfire_4_8_3.zip