upgrade mqtt5 to 0.39.2 from crates.io and pin rust toolchain to 1.98.0

.github/workflows/release.yml

@@ -18,7 +18,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@1.98.0
 
       - name: Cache dependencies
         uses: Swatinem/rust-cache@v2
@@ -72,7 +72,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@1.98.0
         with:
           targets: ${{ matrix.target }}
 

.github/workflows/rust.yml

@@ -24,7 +24,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@1.98.0
         with:
           components: rustfmt
       - name: Check formatting (workspace)
@@ -38,7 +38,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@1.98.0
         with:
           components: clippy
       - name: Cache dependencies
@@ -52,7 +52,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@1.98.0
       - name: Cache dependencies
         uses: Swatinem/rust-cache@v2
       - name: Run tests
@@ -64,7 +64,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@1.98.0
       - name: Cache dependencies
         uses: Swatinem/rust-cache@v2
       - name: Build documentation
@@ -78,7 +78,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@1.98.0
         with:
           targets: wasm32-unknown-unknown
       - name: Cache dependencies

CHANGELOG.md

@@ -4,6 +4,13 @@ All notable changes to this project will be documented in this file.
 
 Each entry lists the date and the crate versions that were released.
 
+## 2026-09-07 — mqdb-agent 0.8.27, mqdb-cluster 0.4.13, mqdb-vault 0.1.5, mqdb-cli 0.8.36
+
+### Changed
+
+- **Upgraded `mqtt5` from a git dependency (`0.35.1`) to the published crate `0.39.2`** (pulling `mqtt5-protocol 0.15.0`), and removed the `[patch.crates-io]` git override so all builds resolve mqtt5 from crates.io. The upgrade is API-compatible for everything MQDB uses (client, broker config/auth/events/bridge/acl, message types) — no source changes were needed. `mqtt5 0.39` adds `user_id` to the broker's client connect/disconnect events, which the upcoming presence feed depends on.
+- **Pinned the Rust toolchain to 1.98.0** via `rust-toolchain.toml`, matching the mqtt5 library, and changed CI from `dtolnay/rust-toolchain@stable` to `@1.98.0` so local, CI, and the upstream library build on the same compiler. This removes the local-vs-CI clippy skew that previously let a lint pass locally and fail in CI.
+
 ## 2026-09-05 — mqdb-core 0.7.12, mqdb-agent 0.8.26, mqdb-cluster 0.4.12, mqdb-vault 0.1.4, mqdb-wasm 0.3.6
 
 ### Added

Cargo.toml

@@ -33,7 +33,7 @@ zeroize = "1.8.2"
 clap = { version = "4.5", features = ["derive", "env"] }
 comfy-table = "7.2"
 fjall = "3.0"
-mqtt5 = "0.35"
+mqtt5 = "0.39"
 tokio = { version = "1.49", features = ["full"] }
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 lru = "0.16"
@@ -78,7 +78,3 @@ lto = true
 codegen-units = 1
 panic = "abort"
 opt-level = "z"
-
-[patch.crates-io]
-mqtt5 = { git = "https://github.com/LabOverWire/mqtt-lib.git" }
-mqtt5-protocol = { git = "https://github.com/LabOverWire/mqtt-lib.git" }

crates/mqdb-agent/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "mqdb-agent"
-version = "0.8.26"
+version = "0.8.27"
 edition.workspace = true
 license = "Apache-2.0"
 authors.workspace = true

crates/mqdb-cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "mqdb-cli"
-version = "0.8.35"
+version = "0.8.36"
 publish = false
 edition.workspace = true
 license = "AGPL-3.0-only"

crates/mqdb-cluster/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "mqdb-cluster"
-version = "0.4.12"
+version = "0.4.13"
 publish = false
 edition.workspace = true
 license = "AGPL-3.0-only"

crates/mqdb-vault/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "mqdb-vault"
-version = "0.1.4"
+version = "0.1.5"
 publish = false
 edition.workspace = true
 license = "AGPL-3.0-only"

deny.toml

@@ -39,4 +39,3 @@ wildcards = "allow"
 [sources]
 unknown-registry = "warn"
 unknown-git = "allow"
-allow-git = ["https://github.com/LabOverWire/mqtt-lib"]

docs/design/hold-reclaim.md

@@ -154,15 +154,14 @@ larger change than the agent's batch tweak.
 1. **Per-connection vs per-user binding.** Per-connection false-reclaims a user who still
    has another live connection. **Rec: per-user** (`_bound_user_id` + user-level presence
    aggregation).
-2. **mqtt-lib `user_id`.** ✅ RESOLVED — shipped in mqtt5 `0.38.4` (pin `mqtt5 = "0.38.4"`,
-   replacing the git dep). Both `ClientConnectEvent` and `ClientDisconnectEvent` now carry
+2. **mqtt-lib `user_id`.** ✅ RESOLVED & LANDED — the workspace is pinned to the published
+   `mqtt5 = "0.39"` (`0.39.2`), replacing the git dependency (done in its own step, ahead of
+   PR 3). Both `ClientConnectEvent` and `ClientDisconnectEvent` carry
    `pub user_id: Option<Arc<str>>` (mirrors `ClientPublishEvent::user_id`; the authenticated
    username, `None` for anonymous). Read as `event.user_id.as_deref()`. `ClientDisconnectEvent`
    also has `client_id: Arc<str>` + `unexpected: bool`, so the presence payload
    `{client_id, user_id, event, unexpected, ts}` is fully available (generate `ts`). This
-   unblocks the per-user binding in decision 1. The pin is a workspace dependency bump done
-   as its own step (it swaps a git dep for the published crate and needs its own build/test
-   verification), landing with or before PR 3.
+   unblocks the per-user binding in decision 1.
 3. **Crash-detection latency.** Sub-second reclaim holds only for **graceful** disconnects;
    a hard crash is detected at the MQTT keepalive timeout. **Rec: short keepalive on hold
    connections + document** the crash-path bound.

rust-toolchain.toml

@@ -0,0 +1,4 @@
+[toolchain]
+channel = "1.98.0"
+components = ["clippy", "rustfmt"]
+targets = ["wasm32-unknown-unknown"]