NATS vs Apache ActiveMQ

ActiveMQ maintains three lines in parallel — 5.19.x, 6.2.x and the new 6.3.0 — and ships them within seconds of each other, with the same fixes carried across each branch. Almost every change is defensive: AMQP frame size validation with a 10 MB default cap, MQTT control packet and wireformat validation, Stomp transport validation, WireFormatInfo checks, and a steadily growing JMX denied list. One maintainer authors the overwhelming majority of it.

The project is walking its defaults inward — disabling the message servlet, blocking XBeanBrokerFactory inside VMTransportFactory, restricting BrokerView URIs, capping frame sizes — so that a stock broker exposes far less than it did a year ago. That is a posture change, not a patch series: each release trades some deployment compatibility for a smaller attack surface, and operators upgrading will find things switched off that used to be on.

Expect the remaining permissive defaults to keep falling one release at a time, and expect 6.3.0 to inherit the same hardening backports rather than diverge on features. The repo metadata dropping 'classic' mentions suggests the branding split with Artemis is being finalized, but the entries do not show what replaces it.