github.com/fhmq/hmq

Security fixes

• Upgrade the Go toolchain baseline and CI to Go 1.26.6, resolving all 19 reachable standard-library vulnerabilities reported for Go 1.26.0.
• Upgrade github.com/quic-go/quic-go from v0.59.0 to v0.61.0 to resolve the reachable HTTP/3 QPACK trailer expansion vulnerability.
• Upgrade golang.org/x/net to v0.58.0 and its related x/crypto, x/sys, and x/text dependencies.
• Upgrade github.com/klauspost/compress to v1.19.2, resolving its reported s2 out-of-bounds read vulnerability.

Verification

• go test ./...
• go test -race ./...
• govulncheck -show verbose ./... reports zero reachable or imported-package vulnerabilities.

Remaining upstream advisories

• golang.org/x/crypto/openpgp remains an upstream unmaintained package with no fixed version. It is transitively required by Sarama's Kerberos dependency path but is not imported or called by HMQ.
• Dependabot continues to report 13 x/crypto SSH/agent advisories and one x/net/html parser advisory with no patched version. They are not reachable from HMQ according to govulncheck; the required modules remain for Sarama Kerberos support and the x/net/websocket transport.

Changes

• Fix MQTT subscription topic validation to reject malformed UTF-8 and null characters.
• Fix QoS2 inflight and retry bookkeeping races, including retry timestamp updates without holding connection locks during writes.
• Prevent retained messages from being resent across unrelated subscribe batches.
• Add locking around in-memory session provider count and close operations.
• Handle SIGTERM for graceful shutdown instead of registering the non-catchable SIGKILL.
• Update broker connection error wrapping and upgrade CI Go version to 1.25.x.
• Upgrade dependencies, including migrating Kafka bridge from github.com/Shopify/sarama to github.com/IBM/sarama v1.50.1.

Verification

• go test ./...
• go test -race ./broker ./broker/lib/sessions ./broker/lib/topics ./plugins/bridge

fix: #215
upgrage: deps

Merge pull request #206 from xinkonglili/weilili

fix(hmq):Increased the log level of error #205

Merge pull request #202 from xinkonglili/weilili

fix(broker):Added windows pipe socket communication, compatible with other systems #199

Bump google.golang.org/protobuf from 1.30.0 to 1.33.0 (#196)

Bumps google.golang.org/protobuf from 1.30.0 to 1.33.0.

---
updated-dependencies:
- dependency-name: google.golang.org/protobuf
dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Merge pull request #193 from spit4520/master

HOTFIX | Fixed pubMsg when WillTopic is null