5.16.0 (2026-09-16)
Bug Fixes
- bounds-check the suback granted array against subscriptions sent (GHSA-rj8f-4655-cgg2) (#2061) (46ee23f), closes #2060
- enforce MQTT 5 Receive Maximum for inbound QoS 2 messages (GHSA-h8jm-hm87-fqw3) (#2065) (ec5bf3e), closes #2064 #2063 #2062 #2061 #2060
- keep broker CONNACK properties out of the user options object (GHSA-gfxc-3w7m-8ch4) (#2062) (3db16f5), closes #2061 #2060 #2060 #2060
- reject a duplicate CONNACK instead of re-running connection setup (GHSA-8phv-jwjm-93rr) (#2064) (7108ea5), closes #2063 #2062 #2061 #2060
- reject an unsolicited AUTH instead of crashing the process (GHSA-fwrw-4mhv-wxvm) (#2063) (b511e7b), closes #2062 #2061 #2060 #2060
- reject unsolicited MQTT 5 topic alias instead of crashing (GHSA-c8jq-r765-cq7g) (#2060) (7d07757)