LoginSign Up
← Back to all sparks
N

NanoMQ

COMMS
Velocity2.5

Lightweight MQTT broker for edge and IoT

nanomq.io ↗

NanoMQ follows its hardening run by moving onto Zephyr microcontrollers.

mqttiotembeddedzephyredge-brokertls
◆Current state
NanoMQ 0.25.7, published on 21 October and described as a beta, runs on the Zephyr RTOS after platform-layer work on memory allocation for microkernel environments. It also pushes the multi-tenant mountpoint logic down into the transport layer, gives each bridge its own cache with REST control, lets operators kick clients by ID over the API, and supports PKCS#11 hardware keys with certificate-to-username mapping. 0.25.6 in August had been a protocol-conformance and auth-race fix release.
◆Where it's heading
0.25.5 dropped MIPS and ARMel binaries to concentrate on correctness, and 0.25.6 spent that effort on MQTT conformance. 0.25.7 points the broker at smaller and more locked-down hardware instead: an RTOS target, hardware security modules and per-device certificate identity. That is a move toward embedded, fleet-managed deployments rather than gateway servers.
◆Prediction
Expect follow-up 0.25.x releases fixing Zephyr-specific issues, since 0.25.7 is labelled a first beta. The SipHash client ID question raised in 0.25.2 still has no resolution in these entries.

◆Recent moves

  1. 19d ago

    0.25.7 beta: NanoMQ runs on Zephyr RTOS

    NanoMQ now runs on Zephyr RTOS, with mountpoints moved into the transport layer, per-bridge caches, client kick over REST and PKCS#11 hardware key support. It turns the 0.25 line from conformance work toward embedded, hardware-secured deployments.

    View source ↗
  2. 2mo ago

    0.25.6 tightens MQTT conformance and auth-window pipe races

    The hardening arc moves from memory safety into protocol conformance: CONNACK negotiation failures are rejected, a strict property checker blocks malformed input, and pipes closed during the unlocked auth window no longer register. Two security fixes and a SCRAM safety pass sit alongside a workaround for the NNG TLS idle bug. Notable that four first-time contributors did much of this NanoNNG work.

    View source ↗
  3. 3mo ago

    MIPS and ARMel binaries dropped; lock-free config reload lands

    ⚡ SPARK

    The pivot of this window — narrowing hardware support to fund correctness work for safety-critical deployments. 0.25.6 follows directly on that budget, spending it on protocol conformance rather than features.

    View source ↗
  4. 3mo ago

    First official 0.25 build fixes a last-will memory leak

    The point where 0.25 stopped being a trial line. Its headline fix — a conn_param leak introduced by last-will handling in 0.24.14 — is the kind of regression the later fuzzing and conformance work is meant to catch earlier.

    View source ↗
  5. 4mo ago

    Temporary build tagged between 0.25.2 and 0.25.3

    A one-line temporary tag with no release content, sitting between the pre-release and the first official 0.25 build.

    View source ↗
  6. 4mo ago

    Client ID hashing moves from DJBHash to SipHash

    A security-motivated change the maintainer publishes with open ambivalence about its CPU cost, asking for feedback rather than declaring it settled. Nothing in the later entries resolves that question.

    View source ↗