FlashMQ 1.27.1 released

Version 1.27.0 was internal only. 1.27.1 contains a minor fix.

Security fixes

Fix UTF-8 validity checks (like on topics) on x64 builds where non-printable ascii characters were not detected as invalid under certain conditions.
Fix x509 authentication bypass when a listener is configured to require x509 authentication and allow_anonymous is true. It’s an unlikely configuration to exist, but could still exist as a result of a misconfiguration.
Fix clients being able to set retained messages on the $SYS tree.

Fix websocket frame bypass by specifying zero-byte extended frame length. Not a security issue because it doesn’t grant additional abilities beyond what a client could already do.
Fix not checking non-compliant values for four least significant bits in first packet byte. Improves standard compliance, but had no other impact.
Better logging of custom thread names (when making threads in plugins) in log file.
QoS 2 retransmissions are now correctly replied to with ‘success’, instead ‘packet identifier in use’.
Fix race condition in retained message cleanup, which could cause newly created message to be purged instantly.
Improve retained message tree purging. It will complete more of the tree in one pass. The new metric $SYS/broker/retained messages/node_count can be used to track tree leaf count.

Add retained_messages_node_creation_limit and related settings, to impose limits to retained messages clients can set.
Add retained_message_max_payload_size setting.
Add plugin function flashmq_set_sys_topic.

Upgraded C++ version to 20. This required dropping support for Ubuntu 20 and Debian 10 and 11. Ubuntu 20 support ended in 2025. Debian 11 reached end of extended support on 2026-08-31.