Sync r510 into r6

dir.yaml

@@ -440,25 +440,25 @@
     - data-integration/rule-sql-builtin-functions
     - data-integration/rule-sql-jq
     # - data-integration/rule-sql-user-defined-function
-    - title_en: Smart Data Hub
-      title_cn: 数据智能中心
-      title_ja: スマートデータハブ
-      path: data-integration/smart-data-hub
+
+- title_en: Smart Data Hub
+  title_cn: 数据智能中心
+  title_ja: スマートデータハブ
+  path: data-integration/smart-data-hub
+  collapsed: true
+  children:
+    - title_en: Schema Registry
+      title_cn: Schema Registry
+      title_ja: スキーマレジストリ
+      path: data-integration/schema-registry
       collapsed: true
       children:
-        - title_en: Schema Registry
-          title_cn: Schema Registry
-          title_ja: スキーマレジストリ
-          path: data-integration/schema-registry
-          collapsed: true
-          children:
-            - data-integration/schema-registry-example-avro
-            - data-integration/schema-registry-example-protobuf
-            - data-integration/schema-registry-example-external-http
-            - data-integration/sparkplug
-        - data-integration/schema-validation
-        - data-integration/message-transformation
-
+        - data-integration/schema-registry-example-avro
+        - data-integration/schema-registry-example-protobuf
+        - data-integration/schema-registry-example-external-http
+        - data-integration/sparkplug
+    - data-integration/schema-validation
+    - data-integration/message-transformation
 - title_en: Flow Designer
   title_cn: Flow 设计器
   title_ja: Flow デザイナー
@@ -920,7 +920,51 @@
           path: gateway/gbt32960
         #- gateway/tcp
     - client-attributes/client-attributes
-
+- title_en: EMQX AI
+  title_cn: EMQX AI
+  title_ja: EMQX AI
+  path: emqx-ai/overview
+  collapsed: true
+  children:
+    - title_en: MCP over MQTT
+      title_cn: MCP over MQTT
+      title_ja: MCP over MQTT
+      path: emqx-ai/mcp-over-mqtt/overview
+      collapsed: true
+      children:
+        - emqx-ai/mcp-over-mqtt/architecture
+        - emqx-ai/mcp-over-mqtt/specification
+    - title_en: Multimedia Server
+      title_cn: 多媒体服务器
+      title_ja: Multimedia Server
+      path: emqx-ai/multimedia-ai/overview
+      collapsed: true
+      children:
+        - emqx-ai/multimedia-ai/architecture
+        - emqx-ai/multimedia-ai/message-protocol
+    - title_en: MCP over MQTT & Multimedia Service SDKs
+      title_cn: MCP over MQTT 和多媒体服务 SDK
+      title_ja: MCP over MQTT & Multimedia Service SDKs
+      path: emqx-ai/sdks/overview
+      collapsed: true
+      children: 
+        - title_en: Clients Compatible with Multimedia Services
+          title_cn: 与多媒体服务适配的客户端
+          title_ja: Clients Compatible with Multimedia Services
+          path: emqx-ai/sdks/multimedia-ai/overview
+          collapsed: true
+          children:
+            - emqx-ai/sdks/multimedia-ai/webrtc-typescript
+        - title_en: MCP over MQTT SDKs
+          title_cn: MCP over MQTT SDKs
+          title_ja: MCP over MQTT SDKs
+          collapsed: true
+          children:
+            - emqx-ai/sdks/mcp-sdk-erlang
+            - emqx-ai/sdks/mcp-sdk-esp32-c
+            - emqx-ai/sdks/mcp-sdk-paho-c
+            - emqx-ai/sdks/mcp-sdk-python
+            - emqx-ai/sdks/mcp-sdk-typescript
 - title_en: Tutorials
   title_cn: 实用教程
   title_ja: 実用的なチュートリアル

en_US/changes/all-changes-ee.md

@@ -4,6 +4,7 @@ The release notes page for EMQX Enterprise provides a comprehensive and detailed
 
 ## v5.10
 
+- [5.10.1](./changes-ee-v5.md#_5-10-1): 2025-09-18
 - [5.10.0](./changes-ee-v5.md#_5-10-0): 2025-06-10
 
 ## v5.9

en_US/changes/breaking-changes-5.10.md

@@ -1,5 +1,9 @@
 # Incompatible Changes in EMQX 5.10
 
+## 5.10.1
+
+- [#15752](https://github.com/emqx/emqx/pull/15752) Listener connection rate limits (`max_conn_rate` and `max_conn_burst`) are now enforced per listener rather than per acceptor, restoring the pre-5.9.0 behavior. As a result, configurations from versions 5.9.0, 5.9.1, and 5.10.0 are incompatible: specified rates must be scaled up by the number of acceptors configured for respective listeners.
+
 ## 5.10.0
 
 - [#15289](https://github.com/emqx/emqx/pull/15289) Added a new `resource_opts.health_check_timeout` configuration to all Connectors, Actions, and Sources, with a default value of 60 seconds.  If a health check takes more than this to return a response, the Connector/Action/Source will be deemed `disconnected`.

en_US/changes/changes-ee-v5.md

@@ -1,5 +1,167 @@
 # EMQX Enterprise Version 5
 
+## 5.10.1
+
+*Release Date: 2025-09-18*
+
+Make sure to check the breaking changes and known issues before upgrading to EMQX 5.10.1.
+
+### Enhancements
+
+#### Performance
+
+- [#15899](https://github.com/emqx/emqx/pull/15899) Authorization (authz) cache is now cleared immediately when a client disconnects, reducing unnecessary memory consumption.
+
+- [#15907](https://github.com/emqx/emqx/pull/15907) Improved system memory usage. Fields such as client ID, username, password, and topic are copied into new binaries (when more than 64 bytes) instead of being slices from the raw packet to reduce 'binary' part of memory usage in Erlang VM.
+
+#### Access Control
+
+- [#15294](https://github.com/emqx/emqx/pull/15294) Enhanced LDAP authentication and authorization.
+  LDAP authorization now supports an extended ACL rule format using JSON, in addition to the existing simple topic list. ACL rules can also be fetched from LDAP during authentication based on client information, and are cached in the client’s metadata to avoid repeated LDAP queries during authorization.
+
+- [#15349](https://github.com/emqx/emqx/pull/15349) Optimized external resource management for authentication and authorization. Previously, EMQX could remain connected to a resource configured for a disabled authentication or authorization provider.
+
+#### Data Integration
+
+- [#15360](https://github.com/emqx/emqx/pull/15360) Added support for writing data files in Parquet format for Amazon S3 Tables Action.
+
+- [#15387](https://github.com/emqx/emqx/pull/15387) Added rate limiting to Kinesis Producer Connector and Action health checks to comply with AWS API quotas and improve cluster behavior.
+
+  - Health check calls to `ListStreams` and `DescribeStream` are now limited to 5/s and 10/s per Connector, respectively, matching AWS rate limits.
+  - A distributed limiter is coordinated by a core node in the cluster to enforce these limits consistently.
+  - If a health check is throttled or times out, the Connector or Action will now retain its previous status instead of being marked as disconnected.
+
+  Also introduced a new `resource_opts.health_check_interval_jitter`, which adds a uniform random delay to `resource_opts.health_check_interval` to reduce the chance of multiple Actions under the same Connector running health checks at the same time.
+
+- [#15542](https://github.com/emqx/emqx/pull/15542) Upgraded our `erlcloud` library to `3.8.3.0`.  This allows one to setup a S3 Connector without specifying Access Key Id and Secret Access Key, so long as the EC2 instance EMQX is running in has the correct IAM permissions to read/write to the configured bucket(s).
+
+- [#15845](https://github.com/emqx/emqx/pull/15845) The `static_clientids` configuration for the MQTT Connector now supports specifying a username and password for each client ID. This is particularly useful for scenarios like connecting to Azure IoT Hub, where each device (client ID) requires a unique set of credentials. This enhancement helps ensure successful connections across multiple nodes in a clustered environment.
+
+- [#15911](https://github.com/emqx/emqx/pull/15911) The HTTP request timeout for the HTTP Action is now configurable via the `resource_opts.request_ttl` setting. Previously, this timeout was fixed at 30 seconds and could not be adjusted. 
+
+#### Observability
+
+- [#15499](https://github.com/emqx/emqx/pull/15499) Added a force deactivate alarm API endpoint to allow administrators to forcibly deactivate active alarms.
+- [#15364](https://github.com/emqx/emqx/pull/15364) Added HTTP header configuration items to the OpenTelemetry integration to adapt to collectors with HTTP authentication.
+- [#15944](https://github.com/emqx/emqx/pull/15944) Improved the information returned when a resource is marked as `disconnected` for the following Connectors: LDAP, Syskeeper, IoTDB, Snowflake (aggregated), JWKS Authentication.
+- [#15371](https://github.com/emqx/emqx/pull/15371) Added `tags` fields to the responses of `GET /actions_summary` and `GET /sources_summary` endpoints, and to the fallback actions returned by the `GET /actions/:id` endpoint.
+
+#### CLI
+
+- [#15399](https://github.com/emqx/emqx/pull/15399) The `node_dump` tool now exports the current system configuration in HOCON format, with sensitive information (such as passwords and secrets) automatically redacted for security.
+
+### Bug Fixes
+
+#### Core MQTT Functionalities
+
+- [#15361](https://github.com/emqx/emqx/pull/15361) Fixed a `function_clause` error when parsing a malformed `User-Property` pair with invalid (too short) length.
+
+- [#15396](https://github.com/emqx/emqx/pull/15396) Removed redundant cleanup operations for shared subscriptions of disconnected clients. These operations were prone to crashes under high disconnect volumes and could lead to inconsistencies in the global broker state.
+
+- [#15416](https://github.com/emqx/emqx/pull/15416) Fixed occasional warning-level log events and crashes during session expiration of WebSocket connections. This issue was introduced by recent WebSocket performance improvements. If did not affect broker capacity, but produced log entries like the following:
+  * `error: {function_clause,[{gen_tcp,send,[closed,[]],[{file,“gen_tcp.erl”},{line,966}]},{cowboy_websocket_linger,commands,3,[{file,“cowboy_websocket_linger.erl”},{line,665}]},...`
+  * `message: {tcp,#Port<0.364>,<<136,130,...>>}, msg: emqx_session_mem_unknown_message`
+
+- [#15872](https://github.com/emqx/emqx/pull/15872) Eliminated warning log `unclean_terminate` when disconnected after CONNACK is sent with a non-zero reason code.
+
+- [#15518](https://github.com/emqx/emqx/pull/15518) Resolve a race condition that could cause accumulating inconsistencies in the routing table and shared subscriptions state across the cluster when a large number of shared subscribers disconnect simultaneously.
+
+#### Access Control
+
+- [#15818](https://github.com/emqx/emqx/pull/15818) Corrected handling of `{allow|deny, all}` ACL rules.
+
+  Previously, these rules were internally translated to match `#`, which incorrectly failed to match topics prefixed with `$` (e.g. `$testtopic/1`) due to MQTT spec restrictions.
+  Now, a special internal value is used to ensure `{allow|deny, all}` rules correctly match any topic, including `$`-prefixed ones.
+
+- [#15844](https://github.com/emqx/emqx/pull/15844) Added validation to forbid adding empty usernames to the built-in database authenticator.  Such users cannot be deleted via the HTTP API later, since they mess up the API path.
+
+  If you have such an user and wish to delete it, run the following in an EMQX console:
+
+  ```erlang
+  mria:transaction(emqx_authn_shard, fun() -> mnesia:delete(emqx_authn_mnesia, {'mqtt:global',<<>>}, write) end).
+  ```
+
+- [#15899](https://github.com/emqx/emqx/pull/15899) Improved memory management by ensuring that the authorization (authz) cache is cleared immediately when a client disconnects, reducing unnecessary memory consumption.
+
+#### Deployment
+
+- [#15553](https://github.com/emqx/emqx/pull/15553) Fixed an issue in the Helm chart where deploying EMQX with default values started multiple replicas and caused all nodes except one to crash. The chart now defaults to a single replica, since clustered deployments require an Commercial License.
+
+- [#15712](https://github.com/emqx/emqx/pull/15712) Fix node boot-up failure during rolling upgrade from older versions (before 5.9)
+
+  In previous EMQX versions (before 5.9), a bug in the ZIP timestamp encoder could store an invalid “seconds” value in archive entries (values corresponding to the 30th or 31st 2-second slot in DOS time format).
+
+- [#15863](https://github.com/emqx/emqx/pull/15863) Fixed license quota alarm text.
+
+#### Clustering
+
+- [#15788](https://github.com/emqx/emqx/pull/15788) Fixed etcd cluster discovery issue. Resolved an issue where EMQX nodes from different clusters could mistakenly join each other when using a shared etcd server. This was caused by a bug in the etcd client library.
+
+#### Smart Data Hub
+
+- [#15810](https://github.com/emqx/emqx/pull/15810) Introduced `spb_{en,de}code` functions to correct handling of `bytes_value` Metrics. Fixed an issue with the original `sparkplug_{en,de}code` functions, which did not base64 encode/decode `bytes_value` metric values as required by the [Protobuf specification](https://protobuf.dev/programming-guides/json/). To address this, new `spb_{en,de}code` functions have been introduced for correct encoding/decoding of such fields. The old `sparkplug_{en,de}code` functions are now deprecated to maintain backward compatibility.
+
+#### Data Integration
+
+- [#15394](https://github.com/emqx/emqx/pull/15394) Fixed a rare race condition where Action metrics could become inconsistent due to unexpected asynchronous replies.
+
+- [#15603](https://github.com/emqx/emqx/pull/15603) Fixed an issue in the MQTT bridge where a stale connection could be shown as `Connected` and would not automatically reconnect.
+
+- [#15826](https://github.com/emqx/emqx/pull/15826) Improved Kafka consumer connector health check behavior with restricted ACLs. Previously, Kafka Consumer Connector health checks could fail if the configured user lacked permission to access the internal `____emqx_consumer_probe` consumer group used for the check. With this fix, if the Kafka broker returns an "ACL denied" response, EMQX will treat the connection as healthy.
+
+- [#15827](https://github.com/emqx/emqx/pull/15827) Fixed atom and process leaks in the GreptimeDB driver.
+
+  Fixed a `function_clause` error that could arise if certain incorrect write syntaxes were used in GreptimeDB Actions.
+
+- [#15836](https://github.com/emqx/emqx/pull/15836) Enriched the returned information when a Kafka Consumer Source fails to be added, for example, due to denied topic ACLs
+
+- [#15866](https://github.com/emqx/emqx/pull/15866) Upgraded Kafka producer lib wollf to `4.0.12` to improve handling of temporarily missing partitions in Kafka metadata responses.
+
+  In rare race conditions, Kafka may return an incomplete partition list. Previously, this was only handled when a topic was recreated with fewer partitions, but not when partitions were temporarily missing. This gap could cause the partition producer to stall and block shutdown indefinitely.
+
+- [#15906](https://github.com/emqx/emqx/pull/15906) Upgraded Kafka producer library Wolff from `4.0.12` to `4.0.13`, which adds handling for the `record_list_too_large` error in `ProduceResponse`.
+
+- [#15902](https://github.com/emqx/emqx/pull/15902) Upgraded MQTT client library to 1.13.8. This improves MQTT bridge connectivity with:
+
+  - Connector will automatically reconnect when peer broker does not reply PINGRESP.
+  - Bridge over TLS failure is more promptly handled if connection breaks while waiting for CONNACK.
+
+- [#15910](https://github.com/emqx/emqx/pull/15910) Fixed an issue with Connectors where a pool of workers could fail to recover from a failure if multiple workers crashed simultaneously in large worker pools.
+
+  Connectors affected and fixed:
+
+  - MySQL
+  - PostgreSQL
+  - Oracle
+  - SQLServer
+  - TDEngine
+  - Cassandra
+  - Dynamo
+  - HTTP
+  - Couchbase
+  - GCP PubSub
+  - Snowflake
+
+  Upgraded `gun` and related dependencies to 2.1.0.
+
+#### API
+
+- [#15547](https://github.com/emqx/emqx/pull/15547) Resolved an issue where EMQX would fail to process HTTP requests with large bodies (e.g., 10MB) in the REST API.
+
+- [#15797](https://github.com/emqx/emqx/pull/15797) To improve compatibility with EMQX 4.x, the `encoding` parameter has been reintroduced in the batch publish HTTP API (`/api/v5/publish/bulk`) as an alias for `payload_encoding`. This change addresses migration issues for users relying on the original `encoding` parameter, and ensures existing integrations using EMQX v4 APIs can continue working without requiring software-level changes.
+
+#### Rate Limit
+
+- [#15794](https://github.com/emqx/emqx/pull/15794) Improved the behavior of connection rate limit updates to ensure that changes (e.g., to burst rate or rate thresholds) are applied immediately after the listener configuration is updated. Previously, parts of the internal limiter state were not refreshed correctly, which could result in rate limits appearing stricter than configured.
+
+#### Observability
+
+- [#15785](https://github.com/emqx/emqx/pull/15785) Resolved a crash that occurred when MQTT usernames containing non-ASCII characters were used in formatting network congestion alarm messages.
+
+#### Gateway
+
+- [#15342](https://github.com/emqx/emqx/pull/15342) Fixed a crash in the NATS gateway caused by client info override templates referencing undefined packet fields. The system now returns an empty binary instead of undefined atom.
+
 ## 5.10.0
 
 *Release Date: 2025-06-10*