Skip to content

Changelog¤

0.12.0¤

  • new: added support for python 3.14
  • fix: authentication failure needs to send connack before disconnecting PR #335
  • new: enable multiple sqlalchemy db backends for persistence plugin PR #333
  • new: contrib plugin for authenticating against django's user models PR #323
  • new: example of plugin that allows clients to publish on $ PR #315
  • disable TLS certificate verification via config `PR #312
  • fix: handle special characters in passwords PR #307
  • fix: explicit close/release allowing proper v3.10 cleanup PR #304
  • fix: prevent failure when sys_interval is unset or None PR #303
  • reduce noisy reconnect logging PR #310
  • fix: publish coroutines in client documentation PR #302
  • fix: exception names in client documentation PR #305
  • fix: amqtt_sub reference page name PR #299
  • remove obselete pytests, add additional coverage PR #309
  • documentation now includes version number alongside every deprecation warning
  • clarified CONTRIBUTING.md, expanded SECURITY.md with more robust security practices, added ROADMAP.md

Security Fixes¤

The amqtt project now includes OpenSSF's scorecard evaluation as part of its CI, including usage of bandit and semgrep for static security checking. Current scorecard status for openssf baseline level 1 and openssf best practices,

Test Coverage¤

Deprecations & Migrations¤

passlib is no longer a supported library and, as of python 3.13, the standard library crypthas been removed, reducing the project's ability to support pbkdf2_sha256, sha512_crypt and script. It has been replaced with pwdlib which only supports argon2 or bcrypt. In this release, we provide legacy HashProtocol for each to enable backwards compatibility for verification of these deprecated hashing schemes. - AuthDBPlugin's hash schemes config now only support argon2 and bcrypt. For this release, specifying pbkdf2_sha256 or scrypt will result in (1) a DeprecationWarning and (2) upon positive verification of the provided password, pwdlib's verify_and_update function will be used to update the row to an argon2 hash. - The FileAuthPlugin hash scheme has migrated from sha512_crypt to argon2. For this release, the sha512_crypt passwords will be accepted alongside argon2 hashes. A DeprecationWarning is displayed, but automatic migration is not supported; see FileAuthPlugin for information on how to create a new password file. - BrokerSysPlugin: psutil installation as part of required amqtt dependencies has been deprecated and will be removed in a future release. the package is now an optional dependency and can be installed with: amqtt[dollarsys].

Retired¤

none

0.11.4¤

This is an urgent security and maintenance release addressing a privately disclosed vulnerability in the MQTT topic matching layer. All users are strongly advised to upgrade immediately.

Security Fixes¤

  • Invalid wildcard topic subscriptions could trigger a Regular Expression Denial of Service (ReDoS) attack, allowing a malicious client to spike CPU utilization to 100% and completely stall the application. We have refactored the topic evaluation mechanism to a strict linear-time O(n) validation algorithm, eliminating the risk of regular expression backtracking and improving performance.

Official Advisory: GHSA-2hjf-7455-w946

Known affected versions: >= 0.11.0, <= 0.11.3

Versions before 0.11.0 were not evaluated.

A formal CVE identifier has been requested for this vulnerability and will be updated in these notes once assigned. Once assigned, the GHSA record will be updated automatically.

Test Coverage¤

The 0.11.4 topic matching security fix is covered by automated regression tests in tests/test_broker.py, including:

  • test_matches_plus_wildcard_redos_protection
  • test_matches_fails_safely_on_all_invalid_filters
  • test_invalid_wildcard_subscriptions

Features & Enhancements¤

This release strictly contains the security patch and associated performance optimizations. Pending feature PRs remain on schedule for our upcoming v0.12.0 release.

0.11.3¤

API changes:

  • broker and client configuration via dataclasses and enums instead of unstructured dictionaries (backwards compatible)
  • MESSAGE_RECIEVE event moved to after topic filtering
  • MESSAGE_BROADCAST event added for prior topic filtering
  • RETAINED_MESSAGE event added for messages with retained flag or offline clients without setting clean session flag
  • method retain_message changed to coroutine (broker)
  • change add_subscription to a public method (broker)
  • add listener type for external servers and api method for passing new connection via external_connected method (broker)
  • for TLS sessions, properly load the key and cert file (client)
  • added abstract method get_ssl_info to WriterAdapter

Details:

0.11.2¤

  • config-file based plugin loading PR #240
  • dockerfile build update to support psutils PR #239
  • pass client session info to event callbacks PR #241
  • Require at least one auth PR #244
  • improvements in retaining messages PR #248
  • updating docker compose with resource limits PR #253
  • improve static type checking for plugin's Config class PR #249
  • broker shouldn't allow clients to publish to '$' topics PR #254
  • publishing to a topic with * is allowed, while # and + are not PR #251
  • updated samples; plugin config consistency (yaml and python dict) PR #252
  • add cpu, mem and broker version to dashboard PR #257
  • Issue 246 don't retain QoS 1 or 2 messages if client connects with clean session true
  • Issue 175 plugin examples
  • Issue 81 Abstract factory for plugins
  • Issue 74 模拟500个客户端并发，连接broker。
  • Issue 60 amqtt server not relaying traffic
  • Issue 31 Plugin config in yaml file not under - plugins entry
  • Issue 27 don't retain messages from anonymous clients
  • Issue 250 client doesn't prevent publishing to wildcard topics
  • Issue 245 prevent clients from publishing to $ topics
  • Issue 196 proposal: enhancement to broker plugin configuration
  • Issue 187 anonymous login allowed even if plugin isn't enabled
  • Issue 123 Messages sent to mqtt can be consumed in time, but they occupy more and more memory

0.11.1¤

0.11.0¤

  • upgrades to support python 3.10, 3.11, 3.12 and 3.13
  • complete type hinting of the entire codebase
  • linting with ruff, pylint and mypy to keep the codebase consistent in format and structure
  • github workflow CI of linting before pull requests can be merged
  • run linting with git pre-commit hooks
  • add docker container
  • switch to discord
  • updates to community contribution guidance, code of conduct, etc.
  • overhaul of the documentation, including move to mkdocs with the materials UI
  • updated plugin documentation and full docs for the broker/client configuration
  • updated doc strings and cli help messages, including auto generation of those aspects into the docs
  • Issue #215 test_sys.py fails on github, but not locally
  • Issue #210 NoDataError thrown instead of ConnectError when client fails authentication
  • Issue #199 will message being sent even if client properly disconnects
  • Issue #180 plugin broker sys: incorrect uptime topic
  • Issue #178 consolidate broker configuration documentation
  • Issue #170 compatibility test cases: paho-mqtt
  • Issue #159 Client last will (LWT) example and documentation
  • Issue #157 loop = asyncio.get_event_loop() is deprecated
  • Issue #154 broker rejects connect with empty will message
  • Issue #144 Allow amqtt.client.MQTTClient to always reconnect via config
  • Issue #105 Add stack traces to logging
  • Issue #95 asyncio.get_event_loop() deprecated in Python 3.10
  • Issue #94 test matrix for dependencies
  • Issue #70 event and plugin documentation
  • Issue #67 MQTTClient fails to raise appropriate exception if URI is broken
  • Issue #51 failing plugin kills the broker
  • Issue #48 Setup unit tests running against different versions of dependencies
  • Issue #35 plugin interface and optimization

0.10.2¤

  • create the necessary .readthedocs.yaml to generate sphinx docs from the 0.10.x series

0.10.1¤

  • First release under new package name: amqtt
  • Reworked unit tests
  • Dropped support for python3.5 and earlier
  • Added support for python3.8 and 3.9
  • Pass in loop to PluginManager, from PR #126
  • Fixes taboo topic checking without session username, from PR #151
  • Move scripts module into hbmqtt module, from PR #167
  • Download mosquitto certificate on the fly
  • Importing hbmqtt is deprecated, use amqtt
  • Security fix: If an attacker could produce a KeyError inside an authentication plugin, the authentication was accepted instead of rejected

0.9.5¤

0.9.2¤

0.9.1¤

  • See commit log

0.9.0¤

  • fixes: milestone 0.9.0
  • improve plugin performance
  • support Python 3.6
  • upgrade to websockets 3.3.0

0.8.0¤

0.7.3¤

  • fix deliver message client method to raise TimeoutError (#40)
  • fix topic filter matching in broker (#41)

Version 0.7.2 has been jumped due to troubles with pypi...

0.7.1¤

0.7.0¤

0.6.3¤

  • Fix issue #22

0.6.2¤

  • Fix issue #20 (mqtt subprotocol was missing)
  • Upgrade to websockets 3.0

0.6.1¤

  • Fix issue #19

0.6¤

  • Added compatibility with Python 3.5
  • Rewritten documentation
  • Add command-line tools amqtt, amqtt_pub and amqtt_sub