Release 2.0.0-beta.1

• Merge remote-tracking branch 'origin/main' into mqttv5 (76e02bb)
• chore: add beta release npm command (61573ff)
• feat: MQTT 5.0 Server Reference / connect-time redirect (#838) [stacked on #1102] (#1115) (8fb6bdc)
• feat: MQTT 5.0 Request / Response Information (#1091) [stacked on #1100] (#1102) (a025504)
• feat: MQTT 5.0 reason codes & reason strings on ACKs (#822, #823, #1092) (#1100) (0f59242)
• fix(connect): reject zero-length ClientId with CleanSession=0 on MQTT 3.1/3.1.1 (#1097) (9938b2b)
• ci: MQTT 5.0 + 3.1.1 compatibility workflow (Paho interop) (#1094) (1774956)
• feat: MQTT 5.0 support (#1088) (e7d0ce9)

Release 1.1.1

• Merge commit from fork (b9024fa)
• types: add missing decodeProtocol, trustProxy, trustedProxies to AedesOptions (#1093) (b90fc58)

Release 1.1.0

• chore: reduce production dependencies (#1045) (cf28701)

Release 1.0.2

• fix: add .js extensions to .d.ts imports for node16 resolution (#1083) (fc36475)

Release 1.0.1

• fix: add types condition to package.json exports field (#1081) (d78fec9)
• docs: fix example (#1079) (3082ebe)

Release 1.0.0

What's changed

• fix: ensure broker always respond with PUBCOMP to a PUBREL in QoS 2 (#1056) (65d86c9)
• feat: add drainTimeout option to protect against slow/frozen clients (#1060) (af1ae4b)
• chore: remove release-it configuration from package.json and add to .release-it.json (#1052) (2c6882e)
• chore(dev): fix incorrect automated benchmark threshold handling (#1046) (9b76359)
• chore: replace tap by node:test (#1042) (9063215)
• chore: update dependencies (#1041) (b5178c0)
• chore: migrate to ESM (#1039) (d1cc2a3)
• chore: replace Coveralls with Codecov for coverage reporting (#1040) (8220f0a)
• feat: automate benchmark on PR requests using Github Actions (#1037) (86f5b45)
• feat!: migrate to async persistence (#1034) (f6a09bf)
• feat: automate benchmarking (#1035) (04e391f)
• chore: migrate to ES6 classes (#1032) (16e1886)
• chore: update aedes-persistence to 10 (#1031) (f874bb1)
• chore: migrate websocket-stream to ws (#1030) (ef5e1a8)
• chore: update dependencies (#1028) (f328ee1)
• chore: add type commonjs (#1027) (dcd1d39)

Breaking Changes in v1.0.0

1. Async/Await Broker Initialization (Breaking Change)

Aedes now requires async initialization. The old synchronous constructor has been replaced with Aedes.createBroker().

Before (v0.x):

const aedes = require('aedes')
const broker = aedes(opts)

After (v1.0.0):

const { Aedes } = require('aedes')
const broker = await Aedes.createBroker(opts)

Migration: See docs/MIGRATION.md for complete migration guide.

2. Default Export Removed (Breaking Change)

The default export has been removed to prevent confusion between v0.x and v1.x behavior. You must now use named import/require.

Before (v0.x):

import aedes from 'aedes'  // ❌ No longer works

After (v1.0.0):

import { Aedes } from 'aedes'  // ✅ Use named import

3. drainTimeout Default Changed (Breaking Change - Security Enhancement)

The drainTimeout option now defaults to 60000ms (60 seconds) instead of 0 (disabled). This protects against slow/frozen clients causing denial-of-service by blocking message delivery to all subscribers.

Impact:

• Before: Slow or frozen clients could cause complete system deadlock
• After: Unresponsive clients are automatically disconnected after 60 seconds

If you need the old behavior (not recommended due to DoS vulnerability):

const broker = await Aedes.createBroker({
  drainTimeout: 0  // Disable timeout - NOT RECOMMENDED
})

Why this change? A single frozen client (slow network, crashed app, or malicious actor) could previously block message delivery to ALL clients, causing complete deadlock. The default timeout prevents this DoS vulnerability.

See docs/Aedes.md for recommended drainTimeout settings.

4. Async Persistence Interface (Breaking Change)

The persistence interface has been changed from callback-based to async/await.

Minimum Required Versions:

• aedes-persistence: ≥10.2.2
• aedes-persistence-level: ≥9.1.2
• aedes-persistence-mongodb: ≥9.3.1
• aedes-persistence-redis: ≥11.2.1

Aedes will exit if it detects an incompatible persistence implementation.

---

For complete migration instructions, see docs/MIGRATION.md

Release 0.51.3

• fix: memory leak in connected clients counter (#979) (9b9d524)
• chore(deps): bump uuid from 9.0.1 to 10.0.0 (#958) (1a191b0)

Release 0.51.2

• fix: delete will from persistence on disconnect (#957) (a26b90b)
• chore(deps-dev): bump tsd from 0.30.7 to 0.31.0 (#947) (1bbff52)
• chore(deps-dev): bump markdownlint-cli from 0.40.0 to 0.41.0 (#956) (27218ed)
• chore(deps-dev): bump markdownlint-cli from 0.39.0 to 0.40.0 (#950) (c7abeda)
• chore(deps): bump mqemitter from 5.0.0 to 6.0.0 (#953) (86e85f5)

Release 0.51.1

• fix: remove console.error (#951) (#952) (ac4f2e0)
• chore: update SECURITY.md (bba422b)
• chore: update workflows (f98105e)
• chore: update allowed license, add funding (dcf95f5)
• chore(deps): bump deps (af96ae9)
• chore: update README.md (c75240a)

Release 0.51.0

• fix: delete already closed client on closeSameClients (#929) (f42882c)
• feat: add opts.keepaliveLimit (#930) (e1ee60c)
• chore(deps): bump github/codeql-action from 2 to 3 (#922) (f625f1b)