release mqtt5 0.48.1, mqttv5-cli 0.29.8

CHANGELOG.md

@@ -5,7 +5,11 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [mqtt5 0.48.1] - 2026-10-15
+
+### Breaking
+
+- **The broker's maximum packet size counts the whole packet** (MQTT 5 §3.1.2.26). On TCP, TLS and the QUIC control stream it counted only the remaining length, so a packet up to 5 bytes over the limit was accepted. Such a packet now closes the connection.
 
 ### Fixed
 
@@ -17,8 +21,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   A refused bidirectional stream gets STOP_SENDING and RESET_STREAM with the code, a unidirectional one STOP_SENDING. Unidirectional streams without a flow header are still read as MQTT.
 - **Discarding a flow now removes its subscriptions** (#207). A discard removed the flow's state but left its flow-bound subscriptions, so the broker kept delivering to a flow the client had discarded. §9.21.2 counts subscriptions as part of the flow state that §9.16 says to discard. The broker now removes them before it answers the discard with FIN.
 - **Only a flow header followed directly by FIN is a discard** (§9.16). A bidirectional stream whose header carried the discard flags was treated as a discard even when MQTT data followed, and the data was dropped. Such a stream is now refused with `ERROR_FLOW_REFUSED`.
-- **The QUIC broker enforces its maximum packet size on data streams and datagrams.** Only the control stream checked `max_packet_size`. A packet over the limit on a client data stream or in a datagram was read in full and delivered, so a client could make the broker buffer up to the limit's maximum of 256 MB per stream by announcing a large packet. An oversized ack on a stream the broker opened only stopped that stream, so the flow's later acks were never read. The broker now refuses all of these from the fixed header and closes the connection with `ERROR_PROTOCOL_L0` (0xB4), as it does on the control stream.
-- **The broker's maximum packet size counts the whole packet** (MQTT 5 §3.1.2.26). On TCP, TLS and the QUIC control stream it counted only the remaining length, so packets up to 5 bytes over the limit were accepted.
+- **The QUIC broker enforces its maximum packet size on data streams and datagrams.** Only the control stream checked `max_packet_size`. A packet over the limit on a client data stream or in a datagram was read in full and delivered, whatever the limit, so a client could make the broker buffer up to 256 MB per stream by announcing a large packet. An oversized ack on a stream the broker opened only stopped that stream, so the flow's later acks were never read. The broker now refuses all of these from the fixed header and closes the connection with `ERROR_PROTOCOL_L0` (0xB4), as it does on the control stream.
+
+## [mqttv5-cli 0.29.8] - 2026-10-15
+
+### Changed
+
+- Requires mqtt5 0.48.1, so `mqttv5 broker` gets its QUIC stream and maximum packet size fixes. See mqtt5 0.48.1.
 
 ## [mqtt5 0.48.0] - 2026-10-11
 

crates/mqtt5/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "mqtt5"
-version = "0.48.0"
+version = "0.48.1"
 edition.workspace = true
 rust-version.workspace = true
 authors.workspace = true

crates/mqttv5-cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "mqttv5-cli"
-version = "0.29.7"
+version = "0.29.8"
 edition.workspace = true
 rust-version.workspace = true
 authors.workspace = true
@@ -22,7 +22,7 @@ opentelemetry = ["mqtt5/opentelemetry"]
 codec = ["mqtt5/codec-all"]
 
 [dependencies]
-mqtt5 = { path = "../mqtt5", version = "0.48" }
+mqtt5 = { path = "../mqtt5", version = "0.48.1" }
 anyhow = "1.0.103"
 tracing = "0.1"
 serde = { version = "1.0", features = ["derive"] }