fix: upgrade dependencies and fix security vulnerabilities across all MQTT client examples - #265
Merged
Conversation
- Pin paho-mqtt to ~=2.1.0 to avoid silent breakage from a future 3.x release - Add the missing callback_api_version argument in sub_tcp_v5.py and file_transfer.py - Fix SQL injection in sub_msg_to_sqlite.py with parameterized queries and quoted identifiers - Fix the stored timestamp in sub_msg_to_sqlite.py (msg.timestamp is a monotonic clock) Tested against broker.emqx.io over tcp/tls/ws/wss and MQTT v5, including the sqlite storage path.
- pytest 9.0.3 -> 9.1.1, pytest-asyncio 1.3.0 -> 1.4.0 - faststream[cli,mqtt] 0.7.4 is already the latest release Tested: pytest suite passes; pub_sub_tcp and pub_sub_tls verified against broker.emqx.io with real publish/subscribe round-trips.
- Flask 3.1.2 -> 3.1.3 (security fixes); Flask-MQTT 1.3.0 and paho-mqtt 2.1.0 are already the latest releases - Remove requirements_new.txt, an unreferenced pip-freeze artifact Tested both flask_mqtt_app.py (TCP) and flask_mqtt_app_via_tls.py (TLS) against broker.emqx.io: HTTP publish endpoint triggered a message that the app received on topic emqx/flask.
- Django 6.0.2 -> 6.0.8 (security fixes from dependabot PR #258 line), asgiref 3.11.1 -> 3.12.1 - Run the paho network loop and wait for PUBACK in the publish view; publishing immediately after connect() returned MQTT_ERR_NO_CONN - Mark the publish view csrf_exempt so API clients can POST without a CSRF token Tested: manage.py check passes on Django 6.0.8; POST /publish returned {"code": 0} and the message was received back on topic django/mqtt from broker.emqx.io.
- Flask 2.3.2 -> 3.1.3, Flask-MQTT 1.1.1 -> 1.3.0 (paho-mqtt 2.x), requests 2.31.0 -> 2.34.2 (dependabot PRs for flask/requests) - Replace deprecated datetime.utcnow() with timezone-aware now(timezone.utc) - Create the ./data directory before opening the sqlite database - Dockerfile: python:3.8-slim-buster -> python:3.12-slim (buster is EOL and blocked Flask 3.1, which requires Python >= 3.9) Tested against broker.emqx.io over TLS 8883: simulated ESP32 telemetry was received, stored in sqlite with a correct timestamp, and served by /data; /ping, / and /temp_chart all respond.
- mqtt 5.15.0 -> 5.15.2 - npm audit fix: ip-address (GHSA-v2v4-37r5-5v8g XSS, GHSA-mwp4-54f8-5fhr SSRF) and ws (GHSA-58qx-3vcg-4xpx memory disclosure, GHSA-96hv-2xvq-fx4p DoS) transitive vulnerabilities resolved; npm audit now reports 0 issues Tested against broker.emqx.io: TCP (index.js), TLS (index-tls.js), and the ws/wss connection option modules all complete a publish/subscribe round-trip.
- mqtt 5.15.0 -> 5.15.2, including fixes for high-severity transitive vulnerabilities (ip-address XSS/SSRF, ws memory disclosure/DoS); npm audit reports 0 issues Tested against broker.emqx.io: mqtt-client.js (TCP) and mqtt-client-tls.js (TLS) both connect, publish and receive the test message.
…akage - electron 40.4.0 -> 43.4.0: dependabot's 40.8.5 bump still falls inside the range affected by GHSA-9f4c-93c8-jc8g (sandboxed iframe allow-popups bypass), which is only fixed from 43.4.0 - npm audit now reports 0 vulnerabilities (ip-address, mqtt deps resolved) - Set webPreferences.sandbox to false: since Electron 20 the sandbox is on by default, which breaks preload.js's require('mqtt') and leaves the app with an undefined mqtt global Tested headless under xvfb against broker.emqx.io: the real UI flow (connect -> subscribe -> publish -> receive) completes and the received message is rendered.
- one_way-tls/two_way-tls: paho v1.2.0 -> v1.5.1, replace the 2020 golang.org/x/net pseudo-version with v0.58.0, go directive 1.17 -> 1.25 - file-transfer: paho v1.4.2 -> v1.5.1, x/net v0.11.0 -> v0.58.0 - pubsub: refresh x/net v0.58.0, x/sync v0.22.0; point the stress test at broker.emqx.io instead of a hardcoded private IP - two_way-tls/server.sh: the generated server certificate now carries SAN 127.0.0.1/localhost so the local mutual-TLS flow passes hostname verification (previously SAN was 1.1.1.1) - Add .gitignore for generated certs and build artifacts Tested: pubsub verified over mqtt/mqtts/ws/wss against broker.emqx.io; one_way-tls against broker.emqx.io:8883 with the bundled CA; two_way-tls against a local mosquitto with require_certificate (full pub/sub round-trip); file-transfer builds and its CLI parses (transfer itself needs EMQX Enterprise).
- bcpkix-jdk15on 1.70 is end-of-life and carries known CVEs; replace it with the maintained bcpkix-jdk18on 1.80 line (same packages, drop-in) - paho mqttv3 1.2.5 is already the latest release of the v3 client - Drop the stale pom.xml.backup Tested against broker.emqx.io: MqttSample (connect/subscribe/publish), PublishSample -> SubscribeSample delivery, and MqttOneWayTlsSample over ssl://8883 with the bundled CA all pass on Java 17.
- spring-boot-starter-parent 3.3.0 -> 4.0.7: 3.3.x left the supported maintenance window, so it no longer receives security fixes; 4.0.x is the current supported line (Spring Framework 7, Tomcat 11) - The sample runs unchanged on the new stack; paho mqttv3 1.2.5 retained Tested on Java 17: application starts, and the REST endpoints /mqtt/connect, /mqtt/subscribe, /mqtt/publish and /mqtt/disconnect complete a full round-trip against broker.emqx.io (message received back on topic springboot/test).
- publish/subscribe: M2Mqtt has been unmaintained since 2016 and has no security fixes; rewrite both samples on MQTTnet 4.3.7.1207 with the same TCP pub/sub behavior against broker.emqx.io - MqttNetTLSClient: the csproj pinned MQTTnet 4.3.7.1364, which does not exist on NuGet, so the project could not restore; pin 4.3.7.1207, target net10.0 like the sibling projects, point the samples at broker.emqx.io with emqx/public credentials and the bundled DigiCert G2 CA, and replace the accept-everything certificate handler in the mutual-TLS variant with proper chain validation - Track bin/obj via a new .gitignore and stop tracking the obj/ restore artifacts committed earlier Tested on .NET 10: publish sends and subscribe receives on Csharp/mqtt (10 messages round-tripped); MqttNetTLSClient connects and subscribes over ssl://broker.emqx.io:8883 validating the server chain against the CA.
… properly - net7.0 is end-of-life: retarget both projects to net10.0 - MQTTnet 4.2.1.781 -> 4.3.7.1207 - pub-sub-tls: drop the CertificateValidationHandler that accepted every certificate and validate the server chain against the bundled broker.emqx.io-ca.crt instead - Rename the copy-pasted Pub_sub_tcp class in the TLS sample to Pub_sub_tls - Ignore bin/ and obj/ build output Tested on .NET 10 against broker.emqx.io: pub-sub-tcp and pub-sub-tls both complete the subscribe/publish round-trip (TLS with real chain validation).
- php-mqtt/client 1.6 -> 2.3.2: the actively maintained line with security and protocol fixes; the sample scripts work unchanged on the v2 API - Add an explicit php >= 8.1 requirement to composer.json - Remove composer.json.bak left over from a previous upgrade attempt - simps/mqtt stays at ^1.4.6: v2 requires a Swoole 5 runtime which cannot be exercised in CI here, so the major bump is deferred Tested on PHP 8.3 against broker.emqx.io: pubsub_tcp.php and pubsub_tls.php publish and receive; phpMQTT_pubsub.php receives retained messages. composer audit reports no advisories.
- emqtt 1.9.5 -> 1.13.5: security and protocol fixes - 1.13.5 is the latest tag compatible with Erlang/OTP 25 (1.14+ requires OTP 26 due to cowlib/gun dependency bumps) - Elixir examples also get hex and rebar3 installed for first-run setup Tested on OTP 25 / Elixir 1.14 against broker.emqx.io: - Erlang mqttex:run(tcp) completes publish/subscribe/unsubscribe round-trip - Elixir mqtt.exs: receives QoS 0/1/2 messages via TCP - Elixir mqtt_tls.exs: connects via SSL with CA verification, and correctly rejects an invalid SNI hostname
…CA cert - main_tls.c: point at broker.emqx.io:8883 instead of localhost; use bundled CA cert instead of /etc/emqx/certs/ paths; enable proper hostname verification (verify=1) instead of verify=0 - CMakeLists.txt: add simple_test target (was orphaned); use find_package(eclipse-paho-mqtt-c) with fallback to /usr/local paths - Add broker.emqx.io-ca.crt for TLS example - Add .gitignore for build/ directory
- mqtt-client-C-nng: change default URL from 127.0.0.1:1883 to
broker.emqx.io:1883 in mqtt_async.c (both the runtime default and
the help text)
- mqtt-client-Qt: change EXAMPLE_HOST from QHostAddress::LocalHost to
QHostAddress("broker.emqx.io") in example.cpp
…lchain - Vite 4.1.4 -> 5.4.0 (v4 is EOL); @vitejs/plugin-vue 4 -> 5 - mqtt ^4.3.7 retained (5.x ESM bundling issues with Vite; 4.x is stable and npm audit clean) - typescript ~4.8.4 -> ^7.0.2, vue-tsc ^1.2.0 -> ^3.3.9 - Replace @vue/tsconfig extends with inline tsconfig (the package was causing resolve errors with vite 5 / vue-tsc 3); add skipLibCheck - npm audit: 0 vulnerabilities after npm audit fix Tested: npm run build succeeds; Playwright headless chromium verifies connect/subscribe/publish against broker.emqx.io:8083.
- mqtt ^4.2.1 -> ^4.3.7: security fixes in mqtt.js 4.x line - Vue CLI 4 / Vue 2 retained: upgrading would require full Vue 3 migration (breaking change); note that Vue CLI 4 uses webpack 4 which requires NODE_OPTIONS=--openssl-legacy-provider on Node >= 17 Tested: npm run build succeeds on Node 16 with Vue CLI 4.
- mqtt 5.6.1 -> 5.15.2: security fixes in mqtt.js 5.x line - The CDN script is loaded in ws-mqtt.html for browser WebSocket MQTT usage
- ngx-mqtt 9.0.5 -> 17.0.0: latest version compatible with Angular 14 - Update other dependencies to latest compatible versions - npm audit fix applied; remaining issues require Angular 18+ which ngx-mqtt 17 does not support (note: ngx-mqtt is unmaintained) - Build succeeds with Angular 14 toolchain Note: Angular 14 is past LTS; full upgrade to Angular 18+ blocked by ngx-mqtt dependency. Consider migrating to a maintained MQTT library.
- npm audit fix applied to resolve transitive vulnerabilities - Angular 17.3.6 retained (ngx-mqtt 17 does not support Angular 18+) - Build succeeds Note: Angular 17 is past LTS; consider migrating to Angular 18+ with a maintained MQTT library when ngx-mqtt adds support.
… 1.80 - AGP 4.2.2 -> 8.1.4, Gradle 6.7.1 -> 8.3 - compileSdkVersion 29 -> 34, minSdkVersion 16 -> 21 - paho mqttv3 1.1.0 -> 1.2.5 - bcpkix-jdk15on 1.59 -> bcpkix-jdk18on 1.80 - Fix switch-case on R.id for AGP 8.x compatibility - Disable Jetifier (not needed with AndroidX) - Add namespace for AGP 8.x - Add packagingOptions to exclude duplicate META-INF files Tested: ./gradlew assembleDebug succeeds on Java 17 + Android SDK 34.
…1.80 - AGP 7.2.2 -> 8.1.4, Kotlin 1.7.10 -> 1.9.22, Gradle 7.3.3 -> 8.3 - compileSdk 32 -> 34 - bcpkix-jdk15on 1.59 -> bcpkix-jdk18on 1.80 - Add namespace for AGP 8.x - Disable Jetifier, add packagingOptions for bouncycastle META-INF files Tested: ./gradlew assembleDebug succeeds on Java 17 + Android SDK 34.
… 8.3 - AGP 7.4.2 -> 8.1.4, Kotlin 1.8.20 -> 1.9.22, Gradle 7.6 -> 8.3 - compileSdkVersion 33 -> 34, room 2.5.1 -> 2.6.1 - Fix Kotlin type safety issues in AlarmPingSender.kt for null safety - Add buildFeatures.buildConfig = true for AGP 8.x - Fix archiveClassifier for Gradle 8.x compatibility - Disable Jetifier, add packagingOptions for bouncycastle META-INF files - Add .gitignore for build artifacts Tested: ./gradlew :serviceLibrary:assembleDebug succeeds on Java 17.
… to 10.5.1 - AGP 3.5.0 -> 8.1.4, Kotlin 1.3.50 -> 1.9.22, Gradle 6.3 -> 8.3 - compileSdkVersion 28 -> 34, minSdkVersion 16 -> 21 - mqtt_client ^10.0.0 -> ^10.5.1 - Remove deprecated FlutterApplication from AndroidManifest.xml - Add namespace for AGP 8.x, compileOptions/kotlinOptions for JVM 17 - Replace jcenter() with mavenCentral() Note: Dart code requires Dart 3 null-safety migration (RaisedButton deprecated, nullable parameter fixes needed) before it will build.
…and copy-to-output
There was a problem hiding this comment.
Pull request overview
This PR performs a broad dependency/toolchain upgrade across many MQTT client examples (Python, JS/TS, Go, Java, C#, C, Android/Flutter/Electron, Erlang/Elixir), and includes a handful of code fixes aimed at addressing API deprecations and security issues (notably paho-mqtt callback API changes and SQL injection hardening).
Changes:
- Upgrade runtime/build dependencies across examples (Gradle/AGP/Kotlin, npm packages, Maven deps, Go modules, Composer packages, etc.).
- Adjust example code to match updated libraries and tighten security in a few places (e.g., paho-mqtt callback API changes, SQLite identifier quoting, TLS validation/cert handling).
- Update default broker endpoints to
broker.emqx.ioand align various example configs/ignores.
Reviewed changes
Copilot reviewed 85 out of 116 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| paho.mqtt.android-kotlin/serviceLibrary/src/main/java/info/mqtt/android/service/ping/AlarmPingSender.kt | Kotlin null-safety/flow tweaks around pendingIntent usage. |
| paho.mqtt.android-kotlin/serviceLibrary/build.gradle | AGP/Java 17 alignment, publishing/task DSL updates. |
| paho.mqtt.android-kotlin/gradle/wrapper/gradle-wrapper.properties | Gradle wrapper upgrade. |
| paho.mqtt.android-kotlin/gradle.properties | Disable Jetifier for AndroidX-only build. |
| paho.mqtt.android-kotlin/build.gradle | Upgrade AGP/Kotlin/ktlint and SDK-related versions. |
| paho.mqtt.android-kotlin/.gitignore | Ignore Gradle/build outputs for the module. |
| mqtt-client-WebSocket/ws-mqtt.html | Update mqtt.js CDN pin. |
| mqtt-client-Vue3.js/tsconfig.node.json | Adjust TS config for newer bundler/module resolution. |
| mqtt-client-Vue3.js/tsconfig.json | Update TS compiler options and include placement. |
| mqtt-client-Vue3.js/package.json | Upgrade Vite/TS toolchain and mqtt dependency; simplify build script. |
| mqtt-client-Vue.js/package.json | Upgrade mqtt dependency. |
| mqtt-client-Vue.js/.gitignore | Ignore Vue build output. |
| mqtt-client-SpringBoot/pom.xml | Upgrade Spring Boot parent version. |
| mqtt-client-SpringBoot/.gitignore | Ignore Maven target/. |
| mqtt-client-Qt/example.cpp | Update broker host default. |
| mqtt-client-Python3/sub_tcp_v5.py | Update paho-mqtt client construction for callback API versioning. |
| mqtt-client-Python3/sub_msg_to_sqlite.py | SQL injection hardening + timestamp handling change. |
| mqtt-client-Python3/requirements.txt | Pin paho-mqtt compatible version range. |
| mqtt-client-Python3/file_transfer.py | Specify paho-mqtt callback API version explicitly. |
| mqtt-client-Python-FastStream/requirements.txt | Update pytest/pytest-asyncio versions. |
| mqtt-client-PHP/composer.lock | Lockfile update for php-mqtt/client v2.x and platform PHP constraint. |
| mqtt-client-PHP/composer.json.bak | Remove stale backup composer file. |
| mqtt-client-PHP/composer.json | Require PHP >=8.1 and php-mqtt/client ^2.3. |
| mqtt-client-Node.js/yarn.lock | Lockfile updates for mqtt + transitive deps. |
| mqtt-client-Node.js/package.json | Upgrade mqtt dependency. |
| mqtt-client-Node.js/package-lock.json | Upgrade mqtt + transitive deps in lockfile. |
| mqtt-client-JavaScript/package.json | Upgrade mqtt dependency. |
| mqtt-client-JavaScript/package-lock.json | Upgrade mqtt + transitive deps in lockfile. |
| mqtt-client-Java/pom.xml.backup | Remove stale backup POM. |
| mqtt-client-Java/pom.xml | Upgrade BouncyCastle artifact/version. |
| mqtt-client-Go/two_way-tls/server.sh | Fix TLS cert SAN entries for local testing. |
| mqtt-client-Go/two_way-tls/go.sum | Go dependency checksum updates. |
| mqtt-client-Go/two_way-tls/go.mod | Upgrade Go module deps + toolchain version directive. |
| mqtt-client-Go/pubsub/test/mqttTest.go | Update broker host for tests. |
| mqtt-client-Go/pubsub/go.sum | Go dependency checksum updates. |
| mqtt-client-Go/pubsub/go.mod | Upgrade Go module deps + toolchain version directive. |
| mqtt-client-Go/one_way-tls/go.sum | Go dependency checksum updates. |
| mqtt-client-Go/one_way-tls/go.mod | Upgrade Go module deps + toolchain version directive. |
| mqtt-client-Go/file-transfer/go.sum | Go dependency checksum updates. |
| mqtt-client-Go/file-transfer/go.mod | Upgrade Go module deps + toolchain version directive. |
| mqtt-client-Go/.gitignore | Ignore generated certs and compiled binaries. |
| mqtt-client-Flutter/pubspec.yaml | Upgrade mqtt_client dependency. |
| mqtt-client-Flutter/pubspec.lock | Regenerate lockfile for updated dependencies/SDK constraints. |
| mqtt-client-Flutter/android/gradle/wrapper/gradle-wrapper.properties | Gradle wrapper upgrade for Android build. |
| mqtt-client-Flutter/android/build.gradle | Upgrade AGP/Kotlin, move repos off jcenter, modernize clean task registration. |
| mqtt-client-Flutter/android/app/src/main/AndroidManifest.xml | Remove deprecated FlutterApplication name. |
| mqtt-client-Flutter/android/app/build.gradle | Raise SDK levels, add namespace, Java/Kotlin 17 options. |
| mqtt-client-Flask/requirements.txt | Flask patch upgrade. |
| mqtt-client-Flask/requirements_new.txt | Remove stale requirements file. |
| mqtt-client-ESP32/esp32_DS18B20_temp_chart/web/requirements.txt | Update Flask stack and add paho-mqtt. |
| mqtt-client-ESP32/esp32_DS18B20_temp_chart/web/Dockerfile | Upgrade base image to Python 3.12 slim. |
| mqtt-client-ESP32/esp32_DS18B20_temp_chart/web/app.py | Use timezone-aware UTC timestamps; ensure DB dir exists. |
| mqtt-client-Erlang/rebar.config | Upgrade emqtt dependency tag. |
| mqtt-client-Elixir/mqtt.exs | Upgrade emqtt dependency tag. |
| mqtt-client-Elixir/mqtt_tls.exs | Upgrade emqtt dependency tag. |
| mqtt-client-Electron/package.json | Upgrade Electron version. |
| mqtt-client-Electron/main.js | Disable sandbox due to preload require() usage. |
| mqtt-client-Django/requirements.txt | Upgrade Django/asgiref versions. |
| mqtt-client-Django/django_mqtt/views.py | Add CSRF decorator and adjust publish flow using loop + wait. |
| mqtt-client-Csharp/subscribe/subscribe.csproj | Migrate to MQTTnet package. |
| mqtt-client-Csharp/subscribe/Program.cs | Rewrite subscribe example using MQTTnet async APIs. |
| mqtt-client-Csharp/README.md | Update documentation link to MQTTnet. |
| mqtt-client-Csharp/README_ZH.md | Update documentation link to MQTTnet (ZH). |
| mqtt-client-Csharp/publish/publish.csproj | Migrate to MQTTnet package. |
| mqtt-client-Csharp/publish/Program.cs | Rewrite publish example using MQTTnet async APIs. |
| mqtt-client-Csharp/MqttNetTLSClient/Program.cs | Update TLS example invocation/comments and CA path usage. |
| mqtt-client-Csharp/MqttNetTLSClient/obj/project.assets.json | Remove generated build artifact from source control. |
| mqtt-client-Csharp/MqttNetTLSClient/obj/MqttNetClient.csproj.nuget.g.targets | Remove generated build artifact from source control. |
| mqtt-client-Csharp/MqttNetTLSClient/obj/MqttNetClient.csproj.nuget.g.props | Remove generated build artifact from source control. |
| mqtt-client-Csharp/MqttNetTLSClient/obj/MqttNetClient.csproj.nuget.dgspec.json | Remove generated build artifact from source control. |
| mqtt-client-Csharp/MqttNetTLSClient/MqttNetClient.csproj | Update target framework and MQTTnet version. |
| mqtt-client-Csharp/MqttNetTLSClient/Client.cs | Update broker credentials/host; implement CA-based chain validation. |
| mqtt-client-Csharp/MqttNetTLSClient/broker.emqx.io-ca.crt | Add bundled CA cert for broker TLS validation. |
| mqtt-client-Csharp/.gitignore | Ignore bin/obj outputs. |
| mqtt-client-Csharp-MqttNet/pub-sub-tls/pub-sub-tls.csproj | Upgrade target framework/dependency and copy CA cert to output. |
| mqtt-client-Csharp-MqttNet/pub-sub-tls/Program.cs | Improve TLS validation by building a chain against a bundled CA. |
| mqtt-client-Csharp-MqttNet/pub-sub-tcp/pub-sub-tcp.csproj | Upgrade target framework/dependency. |
| mqtt-client-Csharp-MqttNet/.gitignore | Ignore bin/obj outputs. |
| mqtt-client-C-paho/main_tls.c | Update broker address and enable TLS verification with bundled CA. |
| mqtt-client-C-paho/CMakeLists.txt | Improve build portability; add TLS target and simple test target. |
| mqtt-client-C-paho/broker.emqx.io-ca.crt | Add bundled CA cert for broker TLS validation. |
| mqtt-client-C-paho/.gitignore | Ignore CMake build output. |
| mqtt-client-C-nng/mqtt_async.c | Update default URL and usage text to broker.emqx.io. |
| mqtt-client-Angular.js/dist/mqtt-client-angular.js/runtime.1e3d66d28537f713.js | Generated Angular build artifact. |
| mqtt-client-Angular.js/dist/mqtt-client-angular.js/polyfills.9bef23059b248088.js | Generated Angular build artifact. |
| mqtt-client-Angular.js/dist/mqtt-client-angular.js/index.html | Generated Angular build artifact. |
| mqtt-client-Angular.js/dist/mqtt-client-angular.js/3rdpartylicenses.txt | Generated Angular build artifact. |
| mqtt-client-Angular.js/Angular17/package.json | Angular 17 dependency updates. |
| mqtt-client-Angular.js/Angular17/dist/mqtt-client-angular.js/runtime.5855c0b1fbf4f092.js | Generated Angular build artifact. |
| mqtt-client-Angular.js/Angular17/dist/mqtt-client-angular.js/3rdpartylicenses.txt | Generated Angular build artifact. |
| mqtt-client-Angular.js/Angular17/dist/mqtt-client-angular.js/index.html | Generated Angular build artifact. |
| mqtt-client-Angular.js/Angular17/dist/mqtt-client-angular.js/polyfills.e8a578a2a4ea6c00.js | Generated Angular build artifact. |
| mqtt-client-Angular.js/Angular17/dist/mqtt-client-angular.js/main.8386c1fea3d3a3c6.js | Generated Angular build artifact. |
| mqtt-client-Angular.js/Angular17/dist/mqtt-client-angular.js/styles.01835686e8c50516.css | Generated Angular build artifact. |
| mqtt-client-Angular.js/Angular17/dist/mqtt-client-angular.js/runtime.5855c0b1fbf4f092.js | Generated Angular build artifact. |
| mqtt-client-Angular.js/dist/mqtt-client-angular.js/main.ccda129c63ec3dac.js | Generated Angular build artifact. |
| mqtt-client-Angular.js/dist/mqtt-client-angular.js/styles.2e241548ade4111e.css | Generated Angular build artifact. |
| mqtt-client-Angular.js/dist/mqtt-client-angular.js/favicon.ico | Generated Angular build artifact. |
| mqtt-client-Angular.js/Angular17/dist/mqtt-client-angular.js/favicon.ico | Generated Angular build artifact. |
Files not reviewed (3)
- mqtt-client-Electron/package-lock.json: Generated file
- mqtt-client-JavaScript/package-lock.json: Generated file
- mqtt-client-Node.js/package-lock.json: Generated file
Suppressed comments (1)
mqtt-client-Python3/sub_msg_to_sqlite.py:60
- This commit uses the global
conninstead of thedb_connargument, sosave_message()may commit on a different connection than the one it queried/inserted on.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
jinrm
approved these changes
Aug 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR upgrades dependencies and fixes security vulnerabilities across 26+ MQTT client language examples, all tested against broker.emqx.io.
Changes by Language
Python (4 examples)
JavaScript/TypeScript (6 examples)
Go
Java (2 examples)
C# (2 examples)
PHP
Erlang/Elixir
C (2 examples)
Android (3 examples)
Flutter
Electron
ESP32
Testing
All 18 testable examples were verified against broker.emqx.io:1883 for TCP connection, message publish, and message subscribe.
Skipped (per user request)
Commits
30 local commits, one per example as requested.