Apache ActiveMQ vs CodeRabbit

ActiveMQ maintains 5.19, 6.2 and 6.3 in parallel. Through July and August releases arrived as same-day clusters where one fix was cut across every supported line - the AMQP object message decompression fix went into all three at once, and the earlier pair lowered the default AMQP maxFrameSize to 10 MB with frame validation and a temp store ceiling. The August 28 release breaks that shape: 6.3.2 ships on its own, every item tagged for the 6.3.x branch alone, carrying a topic sendLock removal on the non-persistent send path plus five fixes and the usual dependency run.

Two things are now visible. The security posture around AMQP has been tightening all summer - a lower default frame size, explicit validation, a decompression fix and a temp store ceiling are all defenses against a client exhausting broker resources, and lowering a shipped default rather than documenting a limit means the project will change behaviour on existing deployments to close exposure. The second is that 6.3 has graduated: bootstrapped as its own branch on 6 August, it took the first release that no other line received three weeks later, which is what the branch becoming the development target looks like in practice.

Expect further 6.3.x-only releases while 5.19 and 6.2 receive backports of security and correctness fixes only. The AMQP resource-limit work has not obviously finished, so more hardening on that path is the likeliest next substantive change.