fix(container): update image public.ecr.aws/emqx/emqx ( 5.8.8 ➔ 5.8.9 )

[mortyops]

This PR contains the following updates:

Package	Update	Change
public.ecr.aws/emqx/emqx (source)	patch	5.8.8 → 5.8.9

---

Release Notes

emqx/emqx (public.ecr.aws/emqx/emqx)

v5.8.9: EMQX v5.8.9

Compare Source

Enhancements

• #​16491 Start releasing packages for macOS 15 (Sequoia)

• #​15911 Now, for the HTTP Action, the HTTP request timeout is taken to be the same as resource_opts.request_ttl. Previously, it was a fixed, non-configurable value of 30 seconds.

• #​15845 Extended the static_clientids configuration of MQTT Connector to allow specifying usernames and passwords associated with each clientid.

Bug Fixes

Core MQTT Functionalities

• #​16349 Fixed a crash in MQTT v5 connections caused by a type mismatch when processing the request-response-information property.

• #​16081 Fixed an issue where, if a client used extended authentication mechanisms and memory sessions, they could crash with an session_stepdown_request_exception error and calling_self reason.

  e.g.:

  2025-09-24T07:13:08.973954+08:00 [error] clientid: someclientid, msg: session_stepdown_request_exception, peername: 127.0.0.1:41782, username: admin, error: exit, reason: calling_self, stacktrace: [{gen_server,call,3,[{file,"gen_server.erl"},{line,1222}]},{emqx_cm,request_stepdown,4,[{file,"emqx_cm.erl"},{line,427}]},{emqx_cm,do_takeover_begin,2,[{file,"emqx_cm.erl"},{line,398}]},{emqx_cm,takeover_session,2,[{file,"emqx_cm.erl"},{line,384}]},{emqx_cm,takeover_session_begin,2,[{file,"emqx_cm.erl"},{line,305}]},{emqx_session_mem,open,4,[{file,"emqx_session_mem.erl"},{line,210}]},{emqx_session,open,3,[{file,"emqx_session.erl"},{line,263}]},{emqx_cm,'-open_session/4-fun-1-',4,[{file,"emqx_cm.erl"},{line,290}]},{emqx_cm_locker,trans,2,[{file,"emqx_cm_locker.erl"},{line,32}]},{emqx_channel,post_process_connect,2,[{file,"emqx_channel.erl"},{line,575}]},{emqx_connection,with_channel,3,[{file,"emqx_connection.erl"},{line,852}]},{emqx_connection,process_msg,2,[{file,"emqx_connection.erl"},{line,470}]},{emqx_connection,process_msgs,2,[{file,"emqx_connection.erl"},{line,462}]},{emqx_connection,handle_recv,3,[{file,"emqx_connection.erl"},{line,406}]},{proc_lib,wake_up,3,[{file,"proc_lib.erl"},{line,340}]}], action: {takeover,'begin'}, ...
  

• #​15872 Eliminate warning log unclean_terminate when disconnected after CONNACK is sent with a non-zero reason code.

• #​15902 Upgraded MQTT client library to 1.13.8

  This improves MQTT bridge connectivity with:

  • Connector will automatically reconnect when peer broker does not reply PINGRESP.
  • Bridge over TLS failure is more promptly handled if connection breaks while waiting for CONNACK.

• #​15884 Resolved an issue where, in rare cases, the global routing table could indefinitely retain routing information for nodes that had long since left the cluster.

  This also fixes a race condition that could cause accumulating inconsistencies in the routing table and shared subscription state when a large number of shared subscribers disconnect simultaneously.

Clustering

• #​16452 Upgraded gen_rpc to 3.5.1.

  Prior to the gen_rpc upgrade, EMQX may experience long tail of crash logs due to connect timeout if a peer node is unreachable.
  The new version gen_rpc no longer has the long tail and converted crash logs to more readable error logs,
  and the frequent log "failed_to_connect_server" is also throttled to avoid spamming.

Security and Authentication

• #​15844 Added validation to forbid adding empty usernames to the built-in database authenticator. Such users cannot be deleted via the HTTP API later, since they mess up the API path.

  If you have such an user and wish to delete it, run the following in an EMQX console:

  mria:transaction(emqx_authn_shard, fun() -> mnesia:delete(emqx_authn_mnesia, {'mqtt:global',<<>>}, write) end).

• #​15818 Corrected handling of {allow|deny, all} ACL rules.

  Previously, these rules were internally translated to match #, which incorrectly failed to match topics prefixed with $ (e.g. $testtopic/1) due to MQTT spec restrictions.
  Now, a special internal value is used to ensure {allow|deny, all} rules correctly match any topic, including $-prefixed ones.

• #​15899 Improved memory usage: authorization (authz) cache is now cleared immediately when a client disconnects, reducing unnecessary memory consumption.

Rule Engine

• #​16028 Fixed rule engine jq function memory leak.

  Previously if jq built-in function index is used (e.g. .key | index("name")), it would result in memory leak.

Durable Storage

• #​14674 Limited the number and size of RocksDB info log files created by EMQX durable storage.

Breaking Changes

• #​16491 Stop releasing packages for macOS 13 (Ventura)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[mortyops]

--- kubernetes/apps/database/emqx/cluster Kustomization: database/emqx-cluster EMQX: database/emqx

+++ kubernetes/apps/database/emqx/cluster Kustomization: database/emqx-cluster EMQX: database/emqx

@@ -53,13 +53,13 @@

         subPath: init-acl
       extraVolumes:
       - name: init-user
         secret:
           secretName: emqx-init-user-secret
       replicas: 2
-  image: public.ecr.aws/emqx/emqx:5.8.8
+  image: public.ecr.aws/emqx/emqx:5.8.9
   listenersServiceTemplate:
     metadata:
       annotations:
         lbipam.cilium.io/ips: 10.50.0.30
     spec:
       type: LoadBalancer