chore(deps): bump mqtt from 5.15.2 to 5.16.0

[dependabot]

Bumps mqtt from 5.15.2 to 5.16.0.

Release notes

Sourced from mqtt's releases.

Release 5.16.0

Security

This release fixes six advisories. All are reachable from a malicious or misbehaving broker — or anyone who can inject packets into a cleartext mqtt:// hop — with no special client configuration beyond speaking MQTT 5. Upgrade to 5.16.0; everything <= 5.15.2 is affected, including the v4 line, and there is no backport.

Advisory	Severity	Impact
GHSA-c8jq-r765-cq7g	High	An unsolicited MQTT 5 Topic Alias throws an uncaught TypeError in the stream write path — kills the Node process, repeatable on every reconnect.
GHSA-rj8f-4655-cgg2	High	A SUBACK with the wrong number of reason codes crashes the process, or silently misreports which topics are subscribed.
GHSA-gfxc-3w7m-8ch4	High	CONNACK properties were merged into the caller's own options object. A maximumPacketSize of 1 permanently kills the client, survives reconnects, and escapes to other clients built from the same options.
GHSA-fwrw-4mhv-wxvm	High	A single unsolicited AUTH packet crashes the process on a default MQTT 5 client. Enhanced authentication did not have to be configured.
GHSA-8phv-jwjm-93rr	Medium	A duplicate CONNACK re-runs connection setup mid-session: in-flight QoS 1 resent under the same ids, all topics resubscribed, message-id state reset.
GHSA-h8jm-hm87-fqw3	Low	The advertised receiveMaximum was ignored for inbound QoS 2, letting a broker grow the incoming store without bound. Reconnecting does not clear it.

Reproduction steps and full analysis stay in the advisories. CVE ids have been requested and will be added here once assigned.

Behaviour changes to check before upgrading

• options is no longer mutated by a CONNACK. Code that read negotiated values back off options.properties.maximumPacketSize or options.keepalive must use the new client.serverProperties / client.keepalive getters instead.
• A refused CONNACK now always closes the socket. With reconnectOnConnackError: false (the default) the client previously sat on an open connection and kept delivering message events after telling the application the connection was refused.
• Protocol violations now drop the connection: a SUBACK reason-code count mismatch, an invalid Topic Alias, an unsolicited or out-of-spec AUTH, and a broker exceeding receiveMaximum on inbound QoS 2 (reason code 0x93). Reconnect stays armed in all cases.
• An ack that does not answer the command pending on that message id is dropped and reported via error, instead of running the wrong completion path.
• The unregistered-alias case now emits reason code 0x82 (Protocol Error) instead of 0x94.
• AUTH reason code 0 ends the exchange successfully; previously it produced an error with an empty reason string.
• properties.receiveMaximum outside 1..65535, or not an integer, is ignored and 65535 is enforced and advertised instead.
• The inbound packet-size cap now measures total wire size rather than Remaining Length, so it triggers on packets a few bytes smaller than before.
• New exports: PacketPump (src/lib/shared.ts), PendingCommand from the entry point.

Reported by @​afldl, @​acorn421 and @​hibrian827. Thanks to all three.

5.16.0 (2026-09-16)

Bug Fixes

• bounds-check the suback granted array against subscriptions sent (GHSA-rj8f-4655-cgg2) (#2061) (46ee23f), closes #2060
• enforce MQTT 5 Receive Maximum for inbound QoS 2 messages (GHSA-h8jm-hm87-fqw3) (#2065) (ec5bf3e), closes #2064 #2063 #2062 #2061 #2060
• keep broker CONNACK properties out of the user options object (GHSA-gfxc-3w7m-8ch4) (#2062) (3db16f5), closes #2061 #2060 #2060 #2060
• reject a duplicate CONNACK instead of re-running connection setup (GHSA-8phv-jwjm-93rr) (#2064) (7108ea5), closes #2063 #2062 #2061 #2060
• reject an unsolicited AUTH instead of crashing the process (GHSA-fwrw-4mhv-wxvm) (#2063) (b511e7b), closes #2062 #2061 #2060 #2060
• reject unsolicited MQTT 5 topic alias instead of crashing (GHSA-c8jq-r765-cq7g) (#2060) (7d07757)

Changelog

Sourced from mqtt's changelog.

5.16.0 (2026-09-16)

Bug Fixes

• bounds-check the suback granted array against subscriptions sent (GHSA-rj8f-4655-cgg2) (#2061) (46ee23f), closes #2060
• enforce MQTT 5 Receive Maximum for inbound QoS 2 messages (GHSA-h8jm-hm87-fqw3) (#2065) (ec5bf3e), closes #2064 #2063 #2062 #2061 #2060
• keep broker CONNACK properties out of the user options object (GHSA-gfxc-3w7m-8ch4) (#2062) (3db16f5), closes #2061 #2060 #2060 #2060
• reject a duplicate CONNACK instead of re-running connection setup (GHSA-8phv-jwjm-93rr) (#2064) (7108ea5), closes #2063 #2062 #2061 #2060
• reject an unsolicited AUTH instead of crashing the process (GHSA-fwrw-4mhv-wxvm) (#2063) (b511e7b), closes #2062 #2061 #2060 #2060
• reject unsolicited MQTT 5 topic alias instead of crashing (GHSA-c8jq-r765-cq7g) (#2060) (7d07757)

Commits

• 1019eff chore(release): 5.16.0
• e53dd6e chore: unbreak release workflow under npm 12 (#2067)
• ec5bf3e fix: enforce MQTT 5 Receive Maximum for inbound QoS 2 messages (GHSA-h8jm-hm8...
• 7108ea5 fix: reject a duplicate CONNACK instead of re-running connection setup (GHSA-...
• b511e7b fix: reject an unsolicited AUTH instead of crashing the process (GHSA-fwrw-4m...
• 3db16f5 fix: keep broker CONNACK properties out of the user options object (GHSA-gfxc...
• 46ee23f fix: bounds-check the suback granted array against subscriptions sent (GHSA-r...
• 7d07757 fix: reject unsolicited MQTT 5 topic alias instead of crashing (GHSA-c8jq-r76...
• 6e3a676 chore: replace number-allocator with inline Set-based implementation (#2041)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)