From 4878aed1157fbe45589d47e06b9601c3423b6b5a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabr=C3=ADcio=20Bracht?= Date: Wed, 14 Oct 2026 12:12:29 -0700 Subject: [PATCH 1/2] release mqtt5 0.48.1, mqttv5-cli 0.29.8 --- CHANGELOG.md | 15 ++++++++++++--- crates/mqtt5/Cargo.toml | 2 +- crates/mqttv5-cli/Cargo.toml | 4 ++-- 3 files changed, 15 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2cce9226..ed630573 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,7 +5,11 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). -## [Unreleased] +## [mqtt5 0.48.1] - 2026-10-14 + +### Breaking + +- **The broker's maximum packet size counts the whole packet** (MQTT 5 §3.1.2.26). On TCP, TLS and the QUIC control stream it counted only the remaining length, so a packet up to 5 bytes over the limit was accepted. Such a packet now closes the connection. ### Fixed @@ -17,8 +21,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 A refused bidirectional stream gets STOP_SENDING and RESET_STREAM with the code, a unidirectional one STOP_SENDING. Unidirectional streams without a flow header are still read as MQTT. - **Discarding a flow now removes its subscriptions** (#207). A discard removed the flow's state but left its flow-bound subscriptions, so the broker kept delivering to a flow the client had discarded. §9.21.2 counts subscriptions as part of the flow state that §9.16 says to discard. The broker now removes them before it answers the discard with FIN. - **Only a flow header followed directly by FIN is a discard** (§9.16). A bidirectional stream whose header carried the discard flags was treated as a discard even when MQTT data followed, and the data was dropped. Such a stream is now refused with `ERROR_FLOW_REFUSED`. -- **The QUIC broker enforces its maximum packet size on data streams and datagrams.** Only the control stream checked `max_packet_size`. A packet over the limit on a client data stream or in a datagram was read in full and delivered, so a client could make the broker buffer up to the limit's maximum of 256 MB per stream by announcing a large packet. An oversized ack on a stream the broker opened only stopped that stream, so the flow's later acks were never read. The broker now refuses all of these from the fixed header and closes the connection with `ERROR_PROTOCOL_L0` (0xB4), as it does on the control stream. -- **The broker's maximum packet size counts the whole packet** (MQTT 5 §3.1.2.26). On TCP, TLS and the QUIC control stream it counted only the remaining length, so packets up to 5 bytes over the limit were accepted. +- **The QUIC broker enforces its maximum packet size on data streams and datagrams.** Only the control stream checked `max_packet_size`. A packet over the limit on a client data stream or in a datagram was read in full and delivered, whatever the limit, so a client could make the broker buffer up to 256 MB per stream by announcing a large packet. An oversized ack on a stream the broker opened only stopped that stream, so the flow's later acks were never read. The broker now refuses all of these from the fixed header and closes the connection with `ERROR_PROTOCOL_L0` (0xB4), as it does on the control stream. + +## [mqttv5-cli 0.29.8] - 2026-10-14 + +### Changed + +- Requires mqtt5 0.48.1, so `mqttv5 broker` gets its QUIC stream and maximum packet size fixes. See mqtt5 0.48.1. ## [mqtt5 0.48.0] - 2026-10-11 diff --git a/crates/mqtt5/Cargo.toml b/crates/mqtt5/Cargo.toml index a336bfd0..ccba7e0e 100644 --- a/crates/mqtt5/Cargo.toml +++ b/crates/mqtt5/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "mqtt5" -version = "0.48.0" +version = "0.48.1" edition.workspace = true rust-version.workspace = true authors.workspace = true diff --git a/crates/mqttv5-cli/Cargo.toml b/crates/mqttv5-cli/Cargo.toml index 1a79b0ba..b9f4ffe2 100644 --- a/crates/mqttv5-cli/Cargo.toml +++ b/crates/mqttv5-cli/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "mqttv5-cli" -version = "0.29.7" +version = "0.29.8" edition.workspace = true rust-version.workspace = true authors.workspace = true @@ -22,7 +22,7 @@ opentelemetry = ["mqtt5/opentelemetry"] codec = ["mqtt5/codec-all"] [dependencies] -mqtt5 = { path = "../mqtt5", version = "0.48" } +mqtt5 = { path = "../mqtt5", version = "0.48.1" } anyhow = "1.0.103" tracing = "0.1" serde = { version = "1.0", features = ["derive"] } From 002a0b9e9b9c7b05d0d17f5e38975833a6ff2b04 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabr=C3=ADcio=20Bracht?= Date: Thu, 15 Oct 2026 10:24:30 -0700 Subject: [PATCH 2/2] date the 0.48.1 changelog 2026-10-15 --- CHANGELOG.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ed630573..e4f9d36b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,7 +5,7 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). -## [mqtt5 0.48.1] - 2026-10-14 +## [mqtt5 0.48.1] - 2026-10-15 ### Breaking @@ -23,7 +23,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - **Only a flow header followed directly by FIN is a discard** (§9.16). A bidirectional stream whose header carried the discard flags was treated as a discard even when MQTT data followed, and the data was dropped. Such a stream is now refused with `ERROR_FLOW_REFUSED`. - **The QUIC broker enforces its maximum packet size on data streams and datagrams.** Only the control stream checked `max_packet_size`. A packet over the limit on a client data stream or in a datagram was read in full and delivered, whatever the limit, so a client could make the broker buffer up to 256 MB per stream by announcing a large packet. An oversized ack on a stream the broker opened only stopped that stream, so the flow's later acks were never read. The broker now refuses all of these from the fixed header and closes the connection with `ERROR_PROTOCOL_L0` (0xB4), as it does on the control stream. -## [mqttv5-cli 0.29.8] - 2026-10-14 +## [mqttv5-cli 0.29.8] - 2026-10-15 ### Changed