diff --git a/Makefile b/Makefile
index babd66b85..6fac2d622 100644
--- a/Makefile
+++ b/Makefile
@@ -6,8 +6,8 @@ export EMQX_DEFAULT_BUILDER = ghcr.io/emqx/emqx-builder/5.0-28:1.13.4-24.3.4.2-2
 export EMQX_DEFAULT_RUNNER = debian:11-slim
 export OTP_VSN ?= $(shell $(CURDIR)/scripts/get-otp-vsn.sh)
 export ELIXIR_VSN ?= $(shell $(CURDIR)/scripts/get-elixir-vsn.sh)
-export EMQX_DASHBOARD_VERSION ?= v1.1.9
-export EMQX_EE_DASHBOARD_VERSION ?= e1.0.5-beta.1
+export EMQX_DASHBOARD_VERSION ?= v1.2.0
+export EMQX_EE_DASHBOARD_VERSION ?= e1.0.5-beta.3
 export EMQX_REL_FORM ?= tgz
 export QUICER_DOWNLOAD_FROM_RELEASE = 1
 ifeq ($(OS),Windows_NT)
diff --git a/apps/emqx/include/emqx_release.hrl b/apps/emqx/include/emqx_release.hrl
index 1783e7c05..fb8b19b69 100644
--- a/apps/emqx/include/emqx_release.hrl
+++ b/apps/emqx/include/emqx_release.hrl
@@ -35,7 +35,7 @@
 -define(EMQX_RELEASE_CE, "5.0.21").
 
 %% Enterprise edition
--define(EMQX_RELEASE_EE, "5.0.2-alpha.2").
+-define(EMQX_RELEASE_EE, "5.0.2-rc.1").
 
 %% the HTTP API version
 -define(EMQX_API_VERSION, "5.0").
diff --git a/apps/emqx/rebar.config b/apps/emqx/rebar.config
index 4c8e2569f..3ec5b6c30 100644
--- a/apps/emqx/rebar.config
+++ b/apps/emqx/rebar.config
@@ -29,7 +29,7 @@
     {esockd, {git, "https://github.com/emqx/esockd", {tag, "5.9.6"}}},
     {ekka, {git, "https://github.com/emqx/ekka", {tag, "0.14.6"}}},
     {gen_rpc, {git, "https://github.com/emqx/gen_rpc", {tag, "2.8.1"}}},
-    {hocon, {git, "https://github.com/emqx/hocon.git", {tag, "0.37.0"}}},
+    {hocon, {git, "https://github.com/emqx/hocon.git", {tag, "0.37.2"}}},
     {emqx_http_lib, {git, "https://github.com/emqx/emqx_http_lib.git", {tag, "0.5.2"}}},
     {pbkdf2, {git, "https://github.com/emqx/erlang-pbkdf2.git", {tag, "2.0.4"}}},
     {recon, {git, "https://github.com/ferd/recon", {tag, "2.5.1"}}},
diff --git a/apps/emqx/src/emqx.app.src b/apps/emqx/src/emqx.app.src
index d2831b74d..1cecd7b61 100644
--- a/apps/emqx/src/emqx.app.src
+++ b/apps/emqx/src/emqx.app.src
@@ -3,7 +3,7 @@
     {id, "emqx"},
     {description, "EMQX Core"},
     % strict semver, bump manually!
-    {vsn, "5.0.20"},
+    {vsn, "5.0.21"},
     {modules, []},
     {registered, []},
     {applications, [
diff --git a/apps/emqx/src/emqx_schema.erl b/apps/emqx/src/emqx_schema.erl
index 433fb20e5..19fc3aae4 100644
--- a/apps/emqx/src/emqx_schema.erl
+++ b/apps/emqx/src/emqx_schema.erl
@@ -1321,6 +1321,8 @@ fields("listener_wss_opts") ->
     );
 fields("listener_quic_ssl_opts") ->
     %% Mark unsupported TLS options deprecated.
+    Schema0 = server_ssl_opts_schema(#{}, false),
+    Schema1 = lists:keydelete("ocsp", 1, Schema0),
     lists:map(
         fun({Name, Schema}) ->
             case is_quic_ssl_opts(Name) of
@@ -1330,7 +1332,7 @@ fields("listener_quic_ssl_opts") ->
                     {Name, Schema#{deprecated => {since, "5.0.20"}}}
             end
         end,
-        server_ssl_opts_schema(#{}, false)
+        Schema1
     );
 fields("ssl_client_opts") ->
     client_ssl_opts_schema(#{});
@@ -2296,6 +2298,8 @@ server_ssl_opts_schema(Defaults, IsRanchListener) ->
                         ref("ocsp"),
                         #{
                             required => false,
+                            %% TODO: remove after e5.0.2
+                            hidden => true,
                             validator => fun ocsp_inner_validator/1
                         }
                     )},
diff --git a/apps/emqx/test/emqx_ocsp_cache_SUITE.erl b/apps/emqx/test/emqx_ocsp_cache_SUITE.erl
index 90cb5fd4d..3c3fd0341 100644
--- a/apps/emqx/test/emqx_ocsp_cache_SUITE.erl
+++ b/apps/emqx/test/emqx_ocsp_cache_SUITE.erl
@@ -677,15 +677,9 @@ do_t_update_listener(Config) ->
     %% no ocsp at first
     ListenerId = "ssl:default",
     {ok, {{_, 200, _}, _, ListenerData0}} = get_listener_via_api(ListenerId),
-    ?assertMatch(
-        #{
-            <<"ssl_options">> :=
-                #{
-                    <<"ocsp">> :=
-                        #{<<"enable_ocsp_stapling">> := false}
-                }
-        },
-        ListenerData0
+    ?assertEqual(
+        undefined,
+        emqx_map_lib:deep_get([<<"ssl_options">>, <<"ocsp">>], ListenerData0, undefined)
     ),
     assert_no_http_get(),
 
diff --git a/apps/emqx_bridge/src/emqx_bridge.app.src b/apps/emqx_bridge/src/emqx_bridge.app.src
index 99a49f8fd..f5bcb23e2 100644
--- a/apps/emqx_bridge/src/emqx_bridge.app.src
+++ b/apps/emqx_bridge/src/emqx_bridge.app.src
@@ -1,7 +1,7 @@
 %% -*- mode: erlang -*-
 {application, emqx_bridge, [
     {description, "EMQX bridges"},
-    {vsn, "0.1.13"},
+    {vsn, "0.1.14"},
     {registered, [emqx_bridge_sup]},
     {mod, {emqx_bridge_app, []}},
     {applications, [
diff --git a/apps/emqx_dashboard/src/emqx_dashboard.app.src b/apps/emqx_dashboard/src/emqx_dashboard.app.src
index 3970d76e4..8a4764c84 100644
--- a/apps/emqx_dashboard/src/emqx_dashboard.app.src
+++ b/apps/emqx_dashboard/src/emqx_dashboard.app.src
@@ -2,7 +2,7 @@
 {application, emqx_dashboard, [
     {description, "EMQX Web Dashboard"},
     % strict semver, bump manually!
-    {vsn, "5.0.15"},
+    {vsn, "5.0.16"},
     {modules, []},
     {registered, [emqx_dashboard_sup]},
     {applications, [kernel, stdlib, mnesia, minirest, emqx, emqx_ctl]},
diff --git a/apps/emqx_gateway/src/emqx_gateway.app.src b/apps/emqx_gateway/src/emqx_gateway.app.src
index 59eed7f3f..ced013497 100644
--- a/apps/emqx_gateway/src/emqx_gateway.app.src
+++ b/apps/emqx_gateway/src/emqx_gateway.app.src
@@ -1,7 +1,7 @@
 %% -*- mode: erlang -*-
 {application, emqx_gateway, [
     {description, "The Gateway management application"},
-    {vsn, "0.1.13"},
+    {vsn, "0.1.14"},
     {registered, []},
     {mod, {emqx_gateway_app, []}},
     {applications, [kernel, stdlib, grpc, emqx, emqx_authn, emqx_ctl]},
diff --git a/apps/emqx_management/src/emqx_management.app.src b/apps/emqx_management/src/emqx_management.app.src
index 966358f47..9863f5cf6 100644
--- a/apps/emqx_management/src/emqx_management.app.src
+++ b/apps/emqx_management/src/emqx_management.app.src
@@ -2,7 +2,7 @@
 {application, emqx_management, [
     {description, "EMQX Management API and CLI"},
     % strict semver, bump manually!
-    {vsn, "5.0.16"},
+    {vsn, "5.0.17"},
     {modules, []},
     {registered, [emqx_management_sup]},
     {applications, [kernel, stdlib, emqx_plugins, minirest, emqx, emqx_ctl]},
diff --git a/apps/emqx_resource/src/emqx_resource.app.src b/apps/emqx_resource/src/emqx_resource.app.src
index 7be1bcb1c..fbfe8c1fa 100644
--- a/apps/emqx_resource/src/emqx_resource.app.src
+++ b/apps/emqx_resource/src/emqx_resource.app.src
@@ -1,7 +1,7 @@
 %% -*- mode: erlang -*-
 {application, emqx_resource, [
     {description, "Manager for all external resources"},
-    {vsn, "0.1.10"},
+    {vsn, "0.1.11"},
     {registered, []},
     {mod, {emqx_resource_app, []}},
     {applications, [
diff --git a/apps/emqx_rule_engine/src/emqx_rule_engine.app.src b/apps/emqx_rule_engine/src/emqx_rule_engine.app.src
index 1681297ec..8d50f60e3 100644
--- a/apps/emqx_rule_engine/src/emqx_rule_engine.app.src
+++ b/apps/emqx_rule_engine/src/emqx_rule_engine.app.src
@@ -2,7 +2,7 @@
 {application, emqx_rule_engine, [
     {description, "EMQX Rule Engine"},
     % strict semver, bump manually!
-    {vsn, "5.0.11"},
+    {vsn, "5.0.12"},
     {modules, []},
     {registered, [emqx_rule_engine_sup, emqx_rule_engine]},
     {applications, [kernel, stdlib, rulesql, getopt, emqx_ctl]},
diff --git a/changes/ce/feat-10022.zh.md b/changes/ce/feat-10022.zh.md
new file mode 100644
index 000000000..dbae1af77
--- /dev/null
+++ b/changes/ce/feat-10022.zh.md
@@ -0,0 +1 @@
+开始发布Rocky Linux 9（与Enterprise Linux 9兼容）和 MacOS 12 软件包。
diff --git a/changes/ce/feat-10139.en.md b/changes/ce/feat-10139.en.md
new file mode 100644
index 000000000..e2ec5f863
--- /dev/null
+++ b/changes/ce/feat-10139.en.md
@@ -0,0 +1,2 @@
+Add `extraVolumeMounts` to EMQX Helm Chart, it will have the ability to mount the user-own files into the EMQX instance, for example, ACL rule files as mentioned in [#9052](https://github.com/emqx/emqx/issues/9052)
+Done of [#10116](https://github.com/emqx/emqx/issues/10116)
diff --git a/changes/ce/feat-10139.zh.md b/changes/ce/feat-10139.zh.md
new file mode 100644
index 000000000..936db78c8
--- /dev/null
+++ b/changes/ce/feat-10139.zh.md
@@ -0,0 +1,2 @@
+将 `extraVolumeMounts` 添加到 EMQX Helm Chart 中，它将能够挂载用户自己的文件到 EMQX 实例中，例如在 [#9052](https://github.com/emqx/emqx/issues/9052) 中提到的 ACL 规则文件。
+修复了 issue [#10116](https://github.com/emqx/emqx/issues/10116)
diff --git a/changes/ce/fix-10055.en.md b/changes/ce/fix-10055.en.md
new file mode 100644
index 000000000..15237c135
--- /dev/null
+++ b/changes/ce/fix-10055.en.md
@@ -0,0 +1 @@
+Fix: configuration parameter `mqtt.max_awaiting_rel` had no effect.
diff --git a/changes/ce/fix-10055.zh.md b/changes/ce/fix-10055.zh.md
new file mode 100644
index 000000000..35469af57
--- /dev/null
+++ b/changes/ce/fix-10055.zh.md
@@ -0,0 +1 @@
+修复配置项 `mqtt.max_awaiting_rel` 更新不生效问题。
diff --git a/changes/ce/fix-10098.zh.md b/changes/ce/fix-10098.zh.md
new file mode 100644
index 000000000..d8a50e43c
--- /dev/null
+++ b/changes/ce/fix-10098.zh.md
@@ -0,0 +1 @@
+当 MongoDB 授权模块查询数据库时，在日志文件中发生的崩溃与错误已经被修复。
diff --git a/changes/ce/fix-10117.en.md b/changes/ce/fix-10117.en.md
new file mode 100644
index 000000000..a2d305db3
--- /dev/null
+++ b/changes/ce/fix-10117.en.md
@@ -0,0 +1,2 @@
+Fix an error occurring when a joining node doesn't have plugins that are installed on other nodes in the cluster.
+After this fix, the joining node will copy all the necessary plugins from other nodes.
diff --git a/changes/ce/fix-10117.zh.md b/changes/ce/fix-10117.zh.md
new file mode 100644
index 000000000..a56f1a962
--- /dev/null
+++ b/changes/ce/fix-10117.zh.md
@@ -0,0 +1,2 @@
+修复节点加入集群时，由于缺少集其它节点已安装的插件所导致的错误。
+在此修复后，加入集群的节点将从其它节点复制所有必须的插件。
diff --git a/changes/ce/fix-10124.zh.md b/changes/ce/fix-10124.zh.md
new file mode 100644
index 000000000..0e4bd596a
--- /dev/null
+++ b/changes/ce/fix-10124.zh.md
@@ -0,0 +1 @@
+增加了 MongoDB 的默认心跳周期，以减少 MongoDB 日志文件记录过多的风险。
diff --git a/changes/ce/fix-10132.en.md b/changes/ce/fix-10132.en.md
new file mode 100644
index 000000000..937c579a4
--- /dev/null
+++ b/changes/ce/fix-10132.en.md
@@ -0,0 +1,2 @@
+Fix some error logs generated by `systemctl stop emqx` command.
+Prior to the fix, the command was not stopping jq and os_mon applications properly.
diff --git a/changes/ce/fix-10132.zh.md b/changes/ce/fix-10132.zh.md
new file mode 100644
index 000000000..a24558246
--- /dev/null
+++ b/changes/ce/fix-10132.zh.md
@@ -0,0 +1 @@
+修复 `systemctl stop emqx` 命令没有正常停止 jq、os_mon 组件所产生一些错误日志。
diff --git a/changes/ce/fix-10144.en.md b/changes/ce/fix-10144.en.md
new file mode 100644
index 000000000..02bfdd527
--- /dev/null
+++ b/changes/ce/fix-10144.en.md
@@ -0,0 +1 @@
+Add `-setcookie` emulator flag when invoking `emqx ctl` to prevent problems with emqx cli when home directory is read only. Fixes [#10142](https://github.com/emqx/emqx/issues/10142).
diff --git a/changes/ce/fix-10144.zh.md b/changes/ce/fix-10144.zh.md
new file mode 100644
index 000000000..063ed0923
--- /dev/null
+++ b/changes/ce/fix-10144.zh.md
@@ -0,0 +1 @@
+为 emqx 可执行文件加入 `-setcookie` 标志，以避免由于 home 目录只读，导致 emqx cli 所提供的 `emqx ctl` 等命令在执行时出现的一些问题。修复 [#10142](https://github.com/emqx/emqx/issues/10142)。
diff --git a/changes/ce/fix-10157.en.md b/changes/ce/fix-10157.en.md
new file mode 100644
index 000000000..80d3443d0
--- /dev/null
+++ b/changes/ce/fix-10157.en.md
@@ -0,0 +1 @@
+Fixed default rate limit configuration not being applied correctly when creating a new listener.
diff --git a/changes/ce/fix-10157.zh.md b/changes/ce/fix-10157.zh.md
new file mode 100644
index 000000000..5c5601ce4
--- /dev/null
+++ b/changes/ce/fix-10157.zh.md
@@ -0,0 +1 @@
+修复在创建新的监听器时，没有正确应用速率限制默认配置的问题。
diff --git a/changes/ce/perf-10123.en.md b/changes/ce/perf-10123.en.md
new file mode 100644
index 000000000..13a7deee8
--- /dev/null
+++ b/changes/ce/perf-10123.en.md
@@ -0,0 +1,2 @@
+Improve the performance of `/bridges` API.
+Earlier, when the number of nodes in the cluster was large or the node was busy, the API may have a request timeout.
diff --git a/changes/ce/perf-10123.zh.md b/changes/ce/perf-10123.zh.md
new file mode 100644
index 000000000..17ee0ad9e
--- /dev/null
+++ b/changes/ce/perf-10123.zh.md
@@ -0,0 +1,2 @@
+改进 `/bridges` API 的性能。
+此前，当集群中节点数目较多或节点忙时，该 API 可能出现请求超时的情况。
diff --git a/changes/ee/fix-10095.zh.md b/changes/ee/fix-10095.zh.md
new file mode 100644
index 000000000..5c8d107b5
--- /dev/null
+++ b/changes/ee/fix-10095.zh.md
@@ -0,0 +1 @@
+优化 MySQL 桥接在批量模式下能更高效的使用预处理语句 ，减少了对 MySQL 服务器的写入压力， 并确保对 SQL 语句进行更安全和谨慎的转义。
diff --git a/changes/v5.0.21.en.md b/changes/v5.0.21.en.md
new file mode 100644
index 000000000..ca8043e3f
--- /dev/null
+++ b/changes/v5.0.21.en.md
@@ -0,0 +1,97 @@
+# v5.0.21
+
+## Enhancements
+
+- [#10022](https://github.com/emqx/emqx/pull/10022) Start releasing Rocky Linux 9 (compatible with Enterprise Linux 9) and MacOS 12 packages
+
+- [#10139](https://github.com/emqx/emqx/pull/10139) Add `extraVolumeMounts` to EMQX Helm Chart, it will have the ability to mount the user-own files into the EMQX instance, for example, ACL rule files as mentioned in [#9052](https://github.com/emqx/emqx/issues/9052)
+
+  Done of [#10116](https://github.com/emqx/emqx/issues/10116)
+
+- [#9893](https://github.com/emqx/emqx/pull/9893) When connecting with the flag `clean_start=false`, EMQX will filter out messages that published by banned clients.
+  Previously, the messages sent by banned clients may still be delivered to subscribers in this scenario.
+
+- [#9986](https://github.com/emqx/emqx/pull/9986) For helm charts, add MQTT ingress bridge; and removed stale `mgmt` references.
+
+- [#10123](https://github.com/emqx/emqx/pull/10123) Improve the performance of `/bridges` API.
+  Earlier, when the number of nodes in the cluster was large or the node was busy, the API may have a request timeout.
+
+- [#9998](https://github.com/emqx/emqx/pull/9998) Redact the HTTP request body in the authentication error logs for security reasons.
+
+## Bug Fixes
+
+- [#10013](https://github.com/emqx/emqx/pull/10013) Fix return type structure for error case in API schema for `/gateways/:name/clients`.
+
+- [#10014](https://github.com/emqx/emqx/pull/10014) In dashboard API for `/monitor(_current)/nodes/:node` return `404` instead of `400` if node does not exist.
+
+- [#10026](https://github.com/emqx/emqx/pull/10026) Metrics are now only exposed via the /bridges/:id/metrics endpoint. Metrics are no longer returned in other API operations such as getting the list of all bridges, or in the response when a bridge has been created.
+
+- [#10027](https://github.com/emqx/emqx/pull/10027) Allow setting node name from `EMQX_NODE__NAME` when running in docker.
+  Prior to this fix, only `EMQX_NODE_NAME` is allowed.
+
+- [#10050](https://github.com/emqx/emqx/pull/10050) Ensure Bridge API returns `404` status code consistently for resources that don't exist.
+
+- [#10052](https://github.com/emqx/emqx/pull/10052) Improve daemon mode startup failure logs.
+
+  Before this change, it was difficult for users to understand the reason for EMQX 'start' command failed to boot the node.
+  The only information they received was that the node did not start within the expected time frame,
+  and they were instructed to boot the node with 'console' command in the hope of obtaining some logs.
+  However, the node might actually be running, which could cause 'console' mode to fail for a different reason.
+
+  With this new change, when daemon mode fails to boot, a diagnosis is issued. Here are the possible scenarios:
+
+  * If the node cannot be found from `ps -ef`, the user is instructed to find information in log files `erlang.log.*`.
+  * If the node is found to be running but not responding to pings, the user is advised to check if the host name is resolvable and reachable.
+  * If the node is responding to pings, but the EMQX app is not running, it is likely a bug. In this case, the user is advised to report a Github issue.
+
+- [#10055](https://github.com/emqx/emqx/pull/10055) Fix: configuration parameter `mqtt.max_awaiting_rel` had no effect.
+
+- [#10056](https://github.com/emqx/emqx/pull/10056) Fix `/bridges` API status code.
+  - Return `400` instead of `403` in case of removing a data bridge that is dependent on an active rule.
+  - Return `400` instead of `403` in case of calling operations (start|stop|restart) when Data-Bridging is not enabled.
+
+- [#10066](https://github.com/emqx/emqx/pull/10066) Improve error messages for `/briges_probe` and `[/node/:node]/bridges/:id/:operation` API calls to make them more readable. And set HTTP status code to `400` instead of `500`.
+
+- [#10074](https://github.com/emqx/emqx/pull/10074) Check if type in `PUT /authorization/sources/:type` matches `type` given in body of request.
+
+- [#10079](https://github.com/emqx/emqx/pull/10079) Fix description of `shared_subscription_strategy`.
+
+- [#10085](https://github.com/emqx/emqx/pull/10085) Consistently return `404` for all requests on non existent source in `/authorization/sources/:source[/*]`.
+
+- [#10098](https://github.com/emqx/emqx/pull/10098) A crash with an error in the log file that happened when the MongoDB authorization module queried the database has been fixed.
+
+- [#10100](https://github.com/emqx/emqx/pull/10100) Fix channel crash for slow clients with enhanced authentication.
+  Previously, when the client was using enhanced authentication, but the Auth message was sent slowly or the Auth message was lost, the client process would crash.
+
+- [#10107](https://github.com/emqx/emqx/pull/10107) For operations on `bridges API` if `bridge-id` is unknown we now return `404`
+  instead of `400`. Also a bug was fixed that caused a crash if that was a node
+  operation. Additionally we now also check if the given bridge is enabled when
+  doing the cluster operation `start` . Affected endpoints:
+  * [cluster] `/bridges/:id/:operation`,
+  * [node] `/nodes/:node/bridges/:id/:operation`, where `operation` is one of
+  `[start|stop|restart]`.
+  Moreover, for a node operation, EMQX checks if node name is in our cluster and
+  return `404` instead of `501`.
+
+- [#10117](https://github.com/emqx/emqx/pull/10117) Fix an error occurring when a joining node doesn't have plugins that are installed on other nodes in the cluster.
+  After this fix, the joining node will copy all the necessary plugins from other nodes.
+
+- [#10118](https://github.com/emqx/emqx/pull/10118) Fix problems related to manual joining of EMQX replicant nodes to the cluster.
+  Previously, after manually executing joining and then leaving the cluster, the `replicant` node can only run normally after restarting the node after joining the cluster again.
+
+  [Mria PR](https://github.com/emqx/mria/pull/128)
+
+- [#10119](https://github.com/emqx/emqx/pull/10119) Fix crash when `statsd.server` is set to an empty string.
+
+- [#10124](https://github.com/emqx/emqx/pull/10124) The default heartbeat period for MongoDB has been increased to reduce the risk of too excessive logging to the MongoDB log file.
+
+- [#10130](https://github.com/emqx/emqx/pull/10130) Fix garbled config display in dashboard when the value is originally from environment variables.
+  For example, `env EMQX_STATSD__SERVER='127.0.0.1:8124' . /bin/emqx start` results in unreadable string (not '127.0.0.1:8124') displayed in Dashboard's Statsd settings page.
+  Related PR: [HOCON#234](https://github.com/emqx/hocon/pull/234).
+
+- [#10132](https://github.com/emqx/emqx/pull/10132) Fix some error logs generated by `systemctl stop emqx` command.
+  Prior to the fix, the command was not stopping jq and os_mon applications properly.
+
+- [#10144](https://github.com/emqx/emqx/pull/10144) Add `-setcookie` emulator flag when invoking `emqx ctl` to prevent problems with emqx cli when home directory is read only. Fixes [#10142](https://github.com/emqx/emqx/issues/10142).
+
+- [#10157](https://github.com/emqx/emqx/pull/10157) Fixed default rate limit configuration not being applied correctly when creating a new listener.
diff --git a/changes/v5.0.21.zh.md b/changes/v5.0.21.zh.md
new file mode 100644
index 000000000..2de7e8a56
--- /dev/null
+++ b/changes/v5.0.21.zh.md
@@ -0,0 +1,94 @@
+# v5.0.21
+
+## 增强
+
+- [#10022](https://github.com/emqx/emqx/pull/10022) 开始发布Rocky Linux 9（与Enterprise Linux 9兼容）和 MacOS 12 软件包。
+
+- [#10139](https://github.com/emqx/emqx/pull/10139) 将 `extraVolumeMounts` 添加到 EMQX Helm Chart 中，它将能够挂载用户自己的文件到 EMQX 实例中，例如在 [#9052](https://github.com/emqx/emqx/issues/9052) 中提到的 ACL 规则文件。
+  修复了 issue [#10116](https://github.com/emqx/emqx/issues/10116)
+
+- [#9893](https://github.com/emqx/emqx/pull/9893) 当使用 `clean_start=false` 标志连接时，EMQX 将会从消息队列中过滤出被封禁客户端发出的消息，使它们不能被下发给订阅者。
+  此前被封禁客户端发出的消息仍可能在这一场景下被下发给订阅者。
+
+- [#9986](https://github.com/emqx/emqx/pull/9986) 在 helm chart 中新增了 MQTT 桥接 ingress 的配置参数；并删除了旧版本遗留的 `mgmt` 配置。
+
+- [#10123](https://github.com/emqx/emqx/pull/10123) 改进 `/bridges` API 的性能。
+  此前，当集群中节点数目较多或节点忙时，该 API 可能出现请求超时的情况。
+
+- [#9998](https://github.com/emqx/emqx/pull/9998) 出于安全原因，在身份验证错误日志中模糊 HTTP 请求正文。
+
+## 修复
+
+- [#10013](https://github.com/emqx/emqx/pull/10013) 修复 API `/gateways/:name/clients` 返回值的类型结构错误。
+
+- [#10014](https://github.com/emqx/emqx/pull/10014) 如果 API 查询的节点不存在，将会返回 404 而不再是 400。
+
+- [#10026](https://github.com/emqx/emqx/pull/10026) 现在只有显式调用 `/bridges/:id/metrics` 接口时才可以获得指标数据，而其他 API 接口将不再返回相关数据。
+
+- [#10027](https://github.com/emqx/emqx/pull/10027) 在 docker 中启动时，允许使用 `EMQX_NODE__NAME` 环境变量来配置节点名。
+  在此修复前，只能使 `EMQX_NODE_NAME`。
+
+- [#10050](https://github.com/emqx/emqx/pull/10050) 确保 Bridge API 对不存在的资源一致返回 `404` 状态代码。
+
+- [#10052](https://github.com/emqx/emqx/pull/10052) 优化 EMQX daemon 模式启动启动失败的日志。
+
+  在进行此更改之前，当 EMQX 用 `start` 命令启动失败时，用户很难理解出错的原因。
+  所知道的仅仅是节点未能在预期时间内启动，然后被指示以 `console` 式引导节点以获取一些日志。
+  然而，节点实际上可能正在运行，这可能会导致 `console` 模式因不同的原因而失败。
+
+  此次修复后，启动脚本会发出诊断：
+
+  * 如果无法从 `ps -ef` 中找到节点，则指示用户在 `erlang.log.*` 中查找信息。
+  * 如果发现节点正在运行但不响应 ping，则建议用户检查节点主机名是否有效并可达。
+  * 如果节点响应 ping 但 EMQX 应用程序未运行，则很可能是一个错误。在这种情况下，建议用户报告一个Github issue。
+
+- [#10055](https://github.com/emqx/emqx/pull/10055) 修复配置项 `mqtt.max_awaiting_rel` 更新不生效问题。
+
+- [#10056](https://github.com/emqx/emqx/pull/10056) 修复 `/bridges` API 的 HTTP 状态码。
+  - 当删除被活动中的规则依赖的数据桥接时，将返回 `400` 而不是 `403` 。
+  - 当数据桥接未启用时，调用操作（启动|停止|重启）将返回 `400` 而不是 `403`。
+
+- [#10066](https://github.com/emqx/emqx/pull/10066) 改进 `/briges_probe` 和 `[/node/:node]/bridges/:id/:operation` API 调用的错误信息，使之更加易读。并将 HTTP 状态代码设置为 `400` 而不是 `500`。
+
+- [#10074](https://github.com/emqx/emqx/pull/10074) 检查 `PUT /authorization/sources/:type` 中的类型是否与请求正文中的 `type` 相符。
+
+- [#10079](https://github.com/emqx/emqx/pull/10079) 修正对 `shared_subscription_strategy` 的描述。
+
+
+- [#10085](https://github.com/emqx/emqx/pull/10085) 如果向 `/authorization/sources/:source[/*]`  请求的 `source` 不存在，将一致地返回 `404`。
+
+- [#10098](https://github.com/emqx/emqx/pull/10098) 当 MongoDB 授权模块查询数据库时，在日志文件中发生的崩溃与错误已经被修复。
+
+- [#10100](https://github.com/emqx/emqx/pull/10100) 修复响应较慢的客户端在使用增强认证时可能出现崩溃的问题。
+  此前，当客户端使用增强认证功能，但发送 Auth 报文较慢或 Auth 报文丢失时会导致客户端进程崩溃。
+
+- [#10107](https://github.com/emqx/emqx/pull/10107) 现在对桥接的 API 进行调用时，如果 `bridge-id` 不存在，将会返回 `404`，而不再是`400`。
+  然后，还修复了这种情况下，在节点级别上进行 API 调用时，可能导致崩溃的问题。
+  另外，在启动某个桥接时，会先检查指定桥接是否已启用。
+  受影响的接口有：
+  * [cluster] `/bridges/:id/:operation`,
+  * [node] `/nodes/:node/bridges/:id/:operation`,
+  其中 `operation` 是 `[start|stop|restart]` 之一。
+  此外，对于节点操作，EMQX 将检查节点是否存在于集群中，如果不在，则会返回`404`，而不再是`501`。
+
+- [#10117](https://github.com/emqx/emqx/pull/10117) 修复节点加入集群时，由于缺少集其它节点已安装的插件所导致的错误。
+  在此修复后，加入集群的节点将从其它节点复制所有必须的插件。
+
+- [#10118](https://github.com/emqx/emqx/pull/10118) 修复 `replicant` 节点因为手动加入 EMQX 集群导致的相关问题。
+  此前，手动执行 `加入集群-离开集群` 后，`replicant` 节点再次加入集群后只有重启节点才能正常运行。
+
+  [Mria PR](https://github.com/emqx/mria/pull/128)
+
+- [#10119](https://github.com/emqx/emqx/pull/10119) 修复 `statsd.server` 配置为空字符串时启动崩溃的问题。
+
+- [#10124](https://github.com/emqx/emqx/pull/10124) 增加了 MongoDB 的默认心跳周期，以减少 MongoDB 日志文件记录过多的风险。
+
+- [#10130](https://github.com/emqx/emqx/pull/10130) 修复通过环境变量配置启动的 EMQX 节点无法通过HTTP API获取到正确的配置信息。
+  比如：`EMQX_STATSD__SERVER='127.0.0.1:8124' ./bin/emqx start` 后通过 Dashboard看到的 Statsd 配置信息是乱码。
+  相关 PR: [HOCON:234](https://github.com/emqx/hocon/pull/234).
+
+- [#10132](https://github.com/emqx/emqx/pull/10132) 修复 `systemctl stop emqx` 命令没有正常停止 jq、os_mon 组件所产生一些错误日志。
+
+- [#10144](https://github.com/emqx/emqx/pull/10144) 为 emqx 可执行文件加入 `-setcookie` 标志，以避免由于 home 目录只读，导致 emqx cli 所提供的 `emqx ctl` 等命令在执行时出现的一些问题。修复 [#10142](https://github.com/emqx/emqx/issues/10142)。
+
+- [#10157](https://github.com/emqx/emqx/pull/10157) 修复在创建新的监听器时，没有正确应用速率限制默认配置的问题。
diff --git a/lib-ee/emqx_ee_bridge/i18n/emqx_ee_bridge_kafka.conf b/lib-ee/emqx_ee_bridge/i18n/emqx_ee_bridge_kafka.conf
index 00f1f1031..39b9d48f4 100644
--- a/lib-ee/emqx_ee_bridge/i18n/emqx_ee_bridge_kafka.conf
+++ b/lib-ee/emqx_ee_bridge/i18n/emqx_ee_bridge_kafka.conf
@@ -629,21 +629,38 @@ emqx_ee_bridge_kafka {
             zh: "主题映射关系"
         }
     }
-    consumer_encoding_mode {
+    consumer_key_encoding_mode {
         desc {
-            en: "Defines how the key or value from the Kafka message is"
+            en: "Defines how the key from the Kafka message is"
                 " dealt with before being forwarded via MQTT.\n"
-                "<code>none</code> Uses the key or value from the Kafka message unchanged."
-                "  Note: in this case, then the key or value must be a valid UTF-8 string.\n"
-                "<code>base64</code> Uses base-64 encoding on the received key or value."
-            zh: "定义了在通过MQTT转发之前如何处理Kafka消息的键或值。"
-                "<code>none</code> 使用Kafka消息中的键或值，不改变。"
-                "  注意：在这种情况下，那么键或值必须是一个有效的UTF-8字符串。\n"
+                "<code>none</code> Uses the key from the Kafka message unchanged."
+                "  Note: in this case, then the key must be a valid UTF-8 string.\n"
+                "<code>base64</code> Uses base-64 encoding on the received key."
+            zh: "定义了在通过MQTT转发之前如何处理Kafka消息的 Key。"
+                "<code>none</code> 使用Kafka消息中的 Key 原始值，不进行编码。"
+                "  注意：在这种情况下，Key 必须是一个有效的UTF-8字符串。\n"
                 "<code>base64</code> 对收到的密钥或值使用base-64编码。"
         }
         label {
-            en: "Encoding Mode"
-            zh: "编码模式"
+            en: "Key Encoding Mode"
+            zh: "Key 编码模式"
+        }
+    }
+    consumer_value_encoding_mode {
+        desc {
+            en: "Defines how the value from the Kafka message is"
+                " dealt with before being forwarded via MQTT.\n"
+                "<code>none</code> Uses the value from the Kafka message unchanged."
+                "  Note: in this case, then the value must be a valid UTF-8 string.\n"
+                "<code>base64</code> Uses base-64 encoding on the received value."
+            zh: "定义了在通过MQTT转发之前如何处理Kafka消息的 Value。"
+                "<code>none</code> 使用Kafka消息中的 Value 原始值，不进行编码。"
+                "  注意：在这种情况下，Value 必须是一个有效的UTF-8字符串。\n"
+                "<code>base64</code> 对收到的 Value 使用base-64编码。"
+        }
+        label {
+            en: "Value Encoding Mode"
+            zh: "Value 编码模式"
         }
     }
 }
diff --git a/lib-ee/emqx_ee_bridge/src/emqx_ee_bridge.app.src b/lib-ee/emqx_ee_bridge/src/emqx_ee_bridge.app.src
index 6647ec212..156c3eeac 100644
--- a/lib-ee/emqx_ee_bridge/src/emqx_ee_bridge.app.src
+++ b/lib-ee/emqx_ee_bridge/src/emqx_ee_bridge.app.src
@@ -1,6 +1,6 @@
 {application, emqx_ee_bridge, [
     {description, "EMQX Enterprise data bridges"},
-    {vsn, "0.1.7"},
+    {vsn, "0.1.8"},
     {registered, [emqx_ee_bridge_kafka_consumer_sup]},
     {applications, [
         kernel,
diff --git a/lib-ee/emqx_ee_bridge/src/emqx_ee_bridge_kafka.erl b/lib-ee/emqx_ee_bridge/src/emqx_ee_bridge_kafka.erl
index 30a58e4e0..3db8dd5f1 100644
--- a/lib-ee/emqx_ee_bridge/src/emqx_ee_bridge_kafka.erl
+++ b/lib-ee/emqx_ee_bridge/src/emqx_ee_bridge_kafka.erl
@@ -338,11 +338,11 @@ fields(consumer_opts) ->
             )},
         {key_encoding_mode,
             mk(enum([none, base64]), #{
-                default => none, desc => ?DESC(consumer_encoding_mode)
+                default => none, desc => ?DESC(consumer_key_encoding_mode)
             })},
         {value_encoding_mode,
             mk(enum([none, base64]), #{
-                default => none, desc => ?DESC(consumer_encoding_mode)
+                default => none, desc => ?DESC(consumer_value_encoding_mode)
             })}
     ];
 fields(consumer_topic_mapping) ->
diff --git a/lib-ee/emqx_ee_connector/src/emqx_ee_connector.app.src b/lib-ee/emqx_ee_connector/src/emqx_ee_connector.app.src
index d8921198c..6a9f8f924 100644
--- a/lib-ee/emqx_ee_connector/src/emqx_ee_connector.app.src
+++ b/lib-ee/emqx_ee_connector/src/emqx_ee_connector.app.src
@@ -1,6 +1,6 @@
 {application, emqx_ee_connector, [
     {description, "EMQX Enterprise connectors"},
-    {vsn, "0.1.7"},
+    {vsn, "0.1.8"},
     {registered, []},
     {applications, [
         kernel,
diff --git a/mix.exs b/mix.exs
index 66268e13c..3c3ce0766 100644
--- a/mix.exs
+++ b/mix.exs
@@ -72,7 +72,7 @@ defmodule EMQXUmbrella.MixProject do
       # in conflict by emqtt and hocon
       {:getopt, "1.0.2", override: true},
       {:snabbkaffe, github: "kafka4beam/snabbkaffe", tag: "1.0.7", override: true},
-      {:hocon, github: "emqx/hocon", tag: "0.37.0", override: true},
+      {:hocon, github: "emqx/hocon", tag: "0.37.2", override: true},
       {:emqx_http_lib, github: "emqx/emqx_http_lib", tag: "0.5.2", override: true},
       {:esasl, github: "emqx/esasl", tag: "0.2.0"},
       {:jose, github: "potatosalad/erlang-jose", tag: "1.11.2"},
diff --git a/rebar.config b/rebar.config
index 9e874e109..04470030a 100644
--- a/rebar.config
+++ b/rebar.config
@@ -75,7 +75,7 @@
     , {system_monitor, {git, "https://github.com/ieQu1/system_monitor", {tag, "3.0.3"}}}
     , {getopt, "1.0.2"}
     , {snabbkaffe, {git, "https://github.com/kafka4beam/snabbkaffe.git", {tag, "1.0.7"}}}
-    , {hocon, {git, "https://github.com/emqx/hocon.git", {tag, "0.37.0"}}}
+    , {hocon, {git, "https://github.com/emqx/hocon.git", {tag, "0.37.2"}}}
     , {emqx_http_lib, {git, "https://github.com/emqx/emqx_http_lib.git", {tag, "0.5.2"}}}
     , {esasl, {git, "https://github.com/emqx/esasl", {tag, "0.2.0"}}}
     , {jose, {git, "https://github.com/potatosalad/erlang-jose", {tag, "1.11.2"}}}
diff --git a/scripts/rel/cut.sh b/scripts/rel/cut.sh
index 08fa37192..71033035a 100755
--- a/scripts/rel/cut.sh
+++ b/scripts/rel/cut.sh
@@ -246,8 +246,8 @@ generate_changelog () {
     fi
     ./scripts/rel/format-changelog.sh -b "${from_tag}" -l 'en' -v "$TAG" > "changes/${TAG}.en.md"
     ./scripts/rel/format-changelog.sh -b "${from_tag}" -l 'zh' -v "$TAG" > "changes/${TAG}.zh.md"
-    if [ -n "$(git diff --stat)" ]; then
-        git add changes/"${TAG}".*.md
+    git add changes/"${TAG}".*.md
+    if [ -n "$(git diff --staged --stat)" ]; then
         git commit -m "docs: Generate changelog for ${TAG}"
     else
         logmsg "No changelog update."