Merge remote-tracking branch 'origin/release-5.9' into 20250704-sync-release-5.9

Author: id

dir.yaml

@@ -818,16 +818,23 @@
         - gateway/coap
         - gateway/lwm2m
         - gateway/exproto
-        - gateway/ocpp
+        - title_en: OCPP Gateway
+          title_cn: OCPP 网关
+          title_ja: OCPP ゲートウェイ
+          path: gateway/ocpp
         - title_en: JT/T 808 Gateway
           title_cn: JT/T 808 协议网关
           title_ja: JT/T 808 ゲートウェイ
           path: gateway/jt808
           collapsed: true
           children:
             - gateway/jt808_data_exchange
-        - gateway/gbt32960
         - gateway/nats
+        - title_en: GB/T 32960 Gateway
+          title_cn: GB/T 32960 协议网关
+          title_ja: GB/T 32960 ゲートウェイ
+          path: gateway/gbt32960
+        #- gateway/tcp
     - client-attributes/client-attributes
 
 - title_en: Tutorials

en_US/changes/all-changes-ce.md

@@ -4,6 +4,7 @@ The release notes page for EMQX provides a comprehensive and detailed record of
 
 ## v5.8
 
+- [5.8.7](./changes-ce-v5.md#_5-8-7): 2025-07-02
 - [5.8.6](./changes-ce-v5.md#_5-8-6): 2025-03-25
 - [5.8.5](./changes-ce-v5.md#_5-8-5): 2025-02-25
 - [5.8.4](./changes-ce-v5.md#_5-8-4): 2024-12-26

en_US/changes/all-changes-ee.md

@@ -8,10 +8,12 @@ The release notes page for EMQX Enterprise provides a comprehensive and detailed
 
 ## v5.9
 
+- [5.9.1](./changes-ee-v5.md#_5-9-1): 2025-07-02
 - [5.9.0](./changes-ee-v5.md#_5-9-0): 2025-05-02
 
 ## v5.8
 
+- [5.8.7](./changes-ee-v5.md#_5-8-7): 2025-07-02
 - [5.8.6](./changes-ee-v5.md#_5-8-6): 2025-03-25
 - [5.8.5](./changes-ee-v5.md#_5-8-5): 2025-02-25
 - [5.8.4](./changes-ee-v5.md#_5-8-4): 2024-12-26

en_US/changes/breaking-changes-ee-5.9.md

@@ -1,5 +1,9 @@
 # Incompatible Changes in EMQX 5.9
 
+## 5.9.1
+
+- [#15156](https://github.com/emqx/emqx/pull/15156) Added strict schema validation for the `dashboard.sso.oidc.issuer` field. This field must now contain a valid URL. Previously, invalid configurations could be accepted by the API without errors but would cause EMQX to fail to restart, potentially resulting in a crash (`erl_crash.dump`).
+
 ## 5.9.0
 
 - [#14865](https://github.com/emqx/emqx/pull/14865) Dropped old LDAP authentication config layout (deprecated since v5.4).

en_US/changes/changes-ce-v5.md

@@ -1,5 +1,13 @@
 # EMQX Open Source Version 5
 
+## 5.8.7
+
+*Release Date: 2025-07-02*
+
+### Bug Fixes
+
+- [#15383](https://github.com/emqx/emqx/pull/15383) Fixed a potential resource leak in the MQTT bridge. When the bridge failed to start, the topic index table was not properly cleaned up. This fix ensures that the index table is correctly deleted to prevent resource leaks.
+
 ## 5.8.6
 
 *Release Date: 2025-03-25*

en_US/changes/changes-ee-v5.md

@@ -202,6 +202,78 @@ Make sure to check the breaking changes and known issues before upgrading to EMQ
 
 - [#15216](https://github.com/emqx/emqx/pull/15216) Fixed a crash of `emqx_telemetry` process when there are plugins activated.
 
+## 5.9.1
+
+*Release Date: 2025-07-02*
+
+Make sure to check the breaking changes and known issues before upgrading to EMQX 5.9.1.
+
+### Enhancements
+
+- [#15364](https://github.com/emqx/emqx/pull/15364) Added support for custom HTTP headers in the OpenTelemetry gRPC (over HTTP/2) integration. This enhancement enables compatibility with collectors that require HTTP authentication.
+
+- [#15160](https://github.com/emqx/emqx/pull/15160) Added the `DELETE /mt/bulk_delete_ns` API for multi-tenancy management, which allows deleting namespaces in bulk.
+
+- [#15158](https://github.com/emqx/emqx/pull/15158) Added new `emqx ctl conf remove x.y.z` command, which removes the configuration key path `x.y.z` from the existing configuration.
+
+- [#15157](https://github.com/emqx/emqx/pull/15157) Added support for specifying private key file path for Snowflake Connector instead of using password.
+
+  Users should either use password, private key, or neither (set parameters in `/etc/odbc.ini`).
+
+- [#15043](https://github.com/emqx/emqx/pull/15043) Instrument the DS Raft backend with basic metrics to provide insights into cluster status, database overview, shard replication, and replica transitions.
+
+### Bug Fixes
+
+#### Data Integration
+
+- [#15331](https://github.com/emqx/emqx/pull/15331) Fixed an issue in the InfluxDB action where line protocol conversion failed if the `timestamp` in `WriteSyntax` was left blank and no timestamp field was provided in the rule.
+  Now the system's current millisecond value is used instead, and millisecond precision is enforced.
+
+- [#15274](https://github.com/emqx/emqx/pull/15274) Improved the resilience of Postgres, Matrix, and TimescaleDB connectors by triggering a full reconnection on any health check failure. Previously, failed health checks could leave the connection in a broken state, causing operations to hang and potentially leading to out-of-memory issues.
+
+- [#15154](https://github.com/emqx/emqx/pull/15154) Fixed a rare race condition in Actions running in aggregated mode (e.g., S3, Azure Blob Storage, Snowflake) that could lead to a crash with errors like:
+
+  ```
+  ** Reason for termination ==
+  ** {function_clause,[{emqx_connector_aggregator,handle_close_buffer,[...], ...
+  ```
+
+- [#15147](https://github.com/emqx/emqx/pull/15147) Fixed an issue where some Actions failed to emit trace events during rule testing with simulated input data, even after request rendering.
+
+  Affected Actions:
+
+  - Couchbase
+  - Snowflake
+  - IoTDB (Thrift driver)
+
+- [#15383](https://github.com/emqx/emqx/pull/15383) Fixed a potential resource leak in the MQTT bridge. When the bridge failed to start, the topic index table was not properly cleaned up. This fix ensures that the index table is correctly deleted to prevent resource leaks.
+
+#### Smart Data Hub
+
+- [#15224](https://github.com/emqx/emqx/pull/15224) Fixed an issue where updating an External Schema Registry via the Dashboard would unintentionally overwrite the existing password with `******`. The password is now correctly preserved during updates.
+- [#15190](https://github.com/emqx/emqx/pull/15190) Enhanced Message Transformation by allowing hard-coded values for QoS and topic.
+
+#### Observability
+
+- [#15299](https://github.com/emqx/emqx/pull/15299) Fixed a `badarg` error that occurred when exporting OpenTelemetry metrics.
+
+#### Telemetry
+
+- [#15216](https://github.com/emqx/emqx/pull/15216) Fixed a crash in the `emqx_telemetry` process that could occur when plugins were activated.
+
+#### Access Control
+
+- [#15184](https://github.com/emqx/emqx/pull/15184) Fixed the formatting of error messages returned when creating a blacklist fails.
+
+#### Clustering
+
+- [#15180](https://github.com/emqx/emqx/pull/15180) Reduced the risk of deadlocks during channel registration by fixing improper handling of `badrpc` errors in the `ekka_locker` module. These errors previously led to false positives in lock operations, potentially causing inconsistent cluster state and deadlocks.
+
+#### Security
+
+
+- [#15159](https://github.com/emqx/emqx/pull/15159) Improved handling of Certificate Revocation List (CRL) Distribution Point URLs by stopping their refresh after repeated failures (default: 60 seconds). This prevents excessive error logs from unreachable URLs and improves overall system stability.
+
 ## 5.9.0
 
 *Release Date: 2025-05-02*
@@ -636,6 +708,41 @@ Make sure to check the breaking changes and known issues before upgrading to EMQ
 
 - [#14775](https://github.com/emqx/emqx/pull/14775) QUIC Listener: Fixed issue where zone configurations are not applied after a config reload.
 
+## 5.8.7
+
+*Release Date: 2025-07-02*
+
+### Enhancements
+
+- [#15364](https://github.com/emqx/emqx/pull/15364) Added support for custom HTTP headers in the OpenTelemetry gRPC (over HTTP/2) integration. This enhancement enables compatibility with collectors that require HTTP authentication.
+
+### Bug Fixes
+
+- [#15383](https://github.com/emqx/emqx/pull/15383) Fixed a potential resource leak in the MQTT bridge. When the bridge failed to start, the topic index table was not properly cleaned up. This fix ensures that the index table is correctly deleted to prevent resource leaks.
+- [#15331](https://github.com/emqx/emqx/pull/15331) Fixed an issue in the InfluxDB action where line protocol conversion failed if the `timestamp` in `WriteSyntax` was left blank and no timestamp field was provided in the rule. Now the system's current millisecond value is used instead, and millisecond precision is enforced.
+- [#15274](https://github.com/emqx/emqx/pull/15274) Improved the resilience of Postgres, Matrix, and TimescaleDB connectors by triggering a full reconnection on any health check failure. Previously, failed health checks could leave the connection in a broken state, causing operations to hang and potentially leading to out-of-memory issues.
+- [#15224](https://github.com/emqx/emqx/pull/15224) Fixed an issue where updating an External Schema Registry via the Dashboard would unintentionally overwrite the existing password with `******`. The password is now correctly preserved during updates.
+- [#14989](https://github.com/emqx/emqx/pull/14989) Optimized the Kinesis Connector and Action to significantly reduce the number of AWS API calls during startup and health checks. This change helps prevent exceeding AWS Kinesis API rate limits (e.g., `ListStreams` and `DescribeStream`), which previously led to frequent health check failures when using larger connection pools or multiple connectors.
+- [#15299](https://github.com/emqx/emqx/pull/15299) Fixed a `badarg` error that occurred when exporting OpenTelemetry metrics.
+
+## 5.8.7
+
+*Release Date: 2025-07-02*
+
+### Enhancements
+
+- [#15364](https://github.com/emqx/emqx/pull/15364) Added support for custom HTTP headers in the OpenTelemetry gRPC (over HTTP/2) integration. This enhancement enables compatibility with collectors that require HTTP authentication.
+
+### Bug Fixes
+
+- [#15383](https://github.com/emqx/emqx/pull/15383) Fixed a potential resource leak in the MQTT bridge. When the bridge failed to start, the topic index table was not properly cleaned up. This fix ensures that the index table is correctly deleted to prevent resource leaks.
+- [#15331](https://github.com/emqx/emqx/pull/15331) Fixed an issue in the InfluxDB action where line protocol conversion failed if the `timestamp` in `WriteSyntax` was left blank and no timestamp field was provided in the rule.
+  Now the system's current millisecond value is used instead, and millisecond precision is enforced.
+- [#15274](https://github.com/emqx/emqx/pull/15274) Improved the resilience of Postgres, Matrix, and TimescaleDB connectors by triggering a full reconnection on any health check failure. Previously, failed health checks could leave the connection in a broken state, causing operations to hang and potentially leading to out-of-memory issues.
+- [#15224](https://github.com/emqx/emqx/pull/15224) Fixed an issue where updating an External Schema Registry via the Dashboard would unintentionally overwrite the existing password with `******`. The password is now correctly preserved during updates.
+- [#14989](https://github.com/emqx/emqx/pull/14989) Optimized the Kinesis Connector and Action to significantly reduce the number of AWS API calls during startup and health checks. This change helps prevent exceeding AWS Kinesis API rate limits (e.g., `ListStreams` and `DescribeStream`), which previously led to frequent health check failures when using larger connection pools or multiple connectors.
+- [#15299](https://github.com/emqx/emqx/pull/15299) Fixed a `badarg` error that occurred when exporting OpenTelemetry metrics.
+
 ## 5.8.6
 
 *Release Date: 2025-03-25*

en_US/dashboard/introduction.md

@@ -58,6 +58,45 @@ For users who have installed EMQX for the first time, you can use the default us
 
 After logging in for the first time, the system will automatically detect that you are logging in with the default username and password. It will force you to change the default password, which is good for the security of accessing the Dashboard. Note that the changed password cannot be the same as the original password, and it is not recommended to use `public` as the login password again.
 
+### Token-Based Login via URL
+
+Starting from EMQX 5.6.0, the Dashboard supports a token-based login method that allows users to log in directly by embedding authentication information in the URL.
+
+This feature is particularly useful for seamless redirection and integration scenarios where a user should be logged in automatically without entering credentials manually.
+
+#### How To Use This Login Method
+
+1. Use the `/login` endpoint to obtain an authentication token. Since the response does not include the username, you will need to manually add it before encoding the full JSON payload.
+
+   You can perform all steps, including requesting the token, injecting the username, and encoding the result in Base64, in a single command, as shown below:
+
+   ```
+   curl -s -X POST "http://127.0.0.1:18083/api/v5/login" \
+     -H 'accept: application/json' \
+     -H 'Content-Type: application/json' \
+     -d '{"username": "admin","password": "public"}' | jq '.username = "admin"' | base64
+   ```
+
+2. Construct the login URL. Embed the encoded string in the `login_meta` query parameter of the Dashboard URL. For example:
+
+   For EMQX versions **before 5.6.0**:
+
+   ```bash
+   http://localhost:18083?login_meta=BASE64_ENCODED_STRING
+   ```
+
+   This redirects to the default cluster overview page.
+
+   For EMQX **version 5.6.0 and later**:
+
+   ```bash
+   http://localhost:18083/#/dashboard/overview?login_meta=BASE64_ENCODED_STRING
+   ```
+
+   This allows specifying the target page after login.
+
+This method provides a smooth, pre-authenticated user experience for accessing the EMQX Dashboard. Make sure to handle the token securely and ensure it has appropriate expiration and scope limits.
+
 ### Reset Password
 
 You can reset your Dashboard login password via the `admins` command. For details, see [CLI - admins](../admin/cli.md#admins).

en_US/data-integration/rule-sql-builtin-functions.md

@@ -1437,7 +1437,7 @@ Parses the datetime string `DateTimeString` according to the format string `Form
 The placeholders that can be used in `FormatString` are as follows:
 
 | Placeholder | Meaning | Value range |
-| ------ | ---------------------------------- | ----- ---------------- |
+| ----------- | ------- | ------------|
 | `%Y` | Four-digit year | 0000 - 9999 |
 | `%m` | Two-digit month | 01 - 12 |
 | `%d` | Two-digit day of the month | 01 - 31 |

en_US/data-integration/snowflake.md

@@ -50,18 +50,71 @@ For more information, refer to the official [ODBC Driver](https://docs.snowflake
 
 #### Linux
 
-Run the following script to install the Snowflake ODBC driver and configure the `odbc.ini` file:
-
-```
-scripts/install-snowflake-driver.sh
-```
+EMQX provides an [installation script](https://github.com/emqx/emqx/blob/master/scripts/install-snowflake-driver.sh) designed specifically for the quick deployment of the Snowflake ODBC driver on Debian-based systems (such as Ubuntu), along with the required system configuration.
 
 ::: tip Note
 
 This script is for testing only, not a recommendation on how to set up the ODBC driver in production environments. You can refer to the official [installation instructions for Linux](https://docs.snowflake.com/en/developer-guide/odbc/odbc-linux).
 
 :::
 
+**Run the Installation Script**
+
+Copy the `scripts/install-snowflake-driver.sh` script to your local machine. Run `chmod a+x` to make the script executable, and run it with `sudo`:
+
+```bash
+chmod a+x scripts/install-snowflake-driver.sh
+sudo ./scripts/install-snowflake-driver.sh
+```
+
+The script automatically downloads the Snowflake ODBC `.deb` installation package (e.g., `snowflake-odbc-3.4.1.x86_64.deb`) to the current working directory. It then installs the driver and updates the following system configuration files:
+
+- `/etc/odbc.ini`: Adds the Snowflake data source configuration
+- `/etc/odbcinst.ini`: Registers the Snowflake driver path
+
+**Sample Configuration**
+
+Run the following command to view the configurations in the `/etc/odbc.ini` file:
+
+```
+emqx@emqx-0:~$ cat /etc/odbc.ini 
+
+[snowflake]
+Description=SnowflakeDB
+Driver=SnowflakeDSIIDriver
+Locale=en-US
+PORT=443
+SSL=on
+
+[ODBC Data Sources]
+snowflake = SnowflakeDSIIDriver
+```
+
+Run the following command to view the configurations in the  `/etc/odbcinst.ini` file:
+
+```
+emqx@emqx-0:~$ cat /etc/odbcinst.ini 
+
+[ODBC Driver 18 for SQL Server]
+Description=Microsoft ODBC Driver 18 for SQL Server
+Driver=/opt/microsoft/msodbcsql18/lib64/libmsodbcsql-18.5.so.1.1
+UsageCount=1
+
+[ODBC Driver 17 for SQL Server]
+Description=Microsoft ODBC Driver 17 for SQL Server
+Driver=/opt/microsoft/msodbcsql17/lib64/libmsodbcsql-17.10.so.6.1
+UsageCount=1
+
+[SnowflakeDSIIDriver]
+APILevel=1
+ConnectFunctions=YYY
+Description=Snowflake DSII
+Driver=/usr/lib/snowflake/odbc/lib/libSnowflake.so
+DriverODBCVer=03.52
+SQLLevel=1
+UsageCount=1
+```
+
 #### macOS
 
 To install and configure the Snowflake ODBC driver on macOS, follow these steps:
@@ -108,7 +161,7 @@ To install and configure the Snowflake ODBC driver on macOS, follow these steps:
 
 ### Create a User Account and Database
 
-Once the Snowflake ODBC driver is installed, you need to set up a user account, database, and related resources for data ingestion. The following credentials will be required later for configuring the connector and Sink in EMQX:
+Once the Snowflake ODBC driver is installed, you need to set up a user account, database, and related resources for data ingestion. The following credentials will be required later for configuring the Connector and Sink in EMQX:
 
 | Field                  | Value                                            |
 | ---------------------- | ------------------------------------------------ |
@@ -364,4 +417,4 @@ This section delves into the advanced configuration options available for the Sn
 | **Inflight  Window**      | "In-flight queue requests" refer to requests that have been initiated but have not yet received a response or acknowledgment. This setting controls the maximum number of in-flight queue requests that can exist simultaneously during Sink communication with Snowflake. <br/>When **Request Mode** is set to `asynchronous`, the "Request In-flight Queue Window" parameter becomes particularly important. If strict sequential processing of messages from the same MQTT client is crucial, then this value should be set to `1`. | `100`          |
 | **Connect Timeout**       | This specifies the time (in seconds) the system will wait for a connection to Snowflake before timing out. For example, you can set this to `30` seconds. If the connection cannot be established within this time, EMQX will attempt to retry (based on your **Max Retries** setting) or raise an error. This setting is useful for managing network latency or connection reliability. | `15`           |
 | **HTTP Pipelining **      | Specifies the maximum number of HTTP requests that can be sent out before waiting for responses. | `100`          |
-| **Connection Pool Size**  | Defines how many connections EMQX can maintain simultaneously to Snowflake. A larger pool size allows for more concurrent requests, which is important in high-load scenarios, but it also consumes more system resources. | `8`            |
+| **Connection Pool Size**  | Defines how many connections EMQX can maintain simultaneously to Snowflake. A larger pool size allows for more concurrent requests, which is important in high-load scenarios, but it also consumes more system resources. | `8`            |