This is a security and bugfix release.
- Don’t allow access to clients when authenticating if a security plugin returns an application error. Fixes bug #1340782.
- Ensure that bridges verify certificates by default when using TLS.
- Fix possible crash when using pattern ACLs that do not include a %u and clients that connect without a username.
- Fix subscriptions being deleted when clients subscribed to a topic beginning with a $ but that is not $SYS.
- When a durable client reconnects, its queued messages are now checked against ACLs in case of a change in username/ACL state since it last connected.
- Anonymous clients are no longer accidently disconnected from the broker after a SIGHUP.
- Fix bug #1324411, which could have had unexpected consequences for delayed messages in rare circumstances.
- Fix topic matching edge case.
- Fix callback deadlocks after calling mosquitto_disconnect(), when using the threaded interfaces. Closes bug #1313725.
- Fix SRV support when building with CMake.
- Use $(STRIP) for stripping binaries when installing, to allow easier cross compilation.