# What changed in mqtt

> 21 changes in mqtt 5 from its official release notes, upgrade guides and advisories: 8 breaking, 4 security, 3 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/mqtt/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## mqtt 5

### Breaking changes

- An acknowledgment that does not match the pending command for its message id is dropped and reported through error. (5.16.0) — [release notes](https://github.com/mqttjs/MQTT.js/releases/tag/v5.16.0)
- A getter provides access to negotiated keepalive now that CONNACK no longer mutates the options object. (5.16.0) — [release notes](https://github.com/mqttjs/MQTT.js/releases/tag/v5.16.0)
- A getter provides access to negotiated server properties now that CONNACK no longer mutates the options object. (5.16.0) — [release notes](https://github.com/mqttjs/MQTT.js/releases/tag/v5.16.0)
- The cap measures total wire size rather than Remaining Length, so it triggers on packets a few bytes smaller than before. (5.16.0) — [release notes](https://github.com/mqttjs/MQTT.js/releases/tag/v5.16.0)
- CONNACK properties no longer mutate the caller's options object; read negotiated values from the client getters instead. (5.16.0) — [release notes](https://github.com/mqttjs/MQTT.js/releases/tag/v5.16.0)
- Invalid or non-integer values outside 1..65535 are ignored; 65535 is enforced and advertised instead. (5.16.0) — [release notes](https://github.com/mqttjs/MQTT.js/releases/tag/v5.16.0)
- Protocol violations drop the connection, with reconnect remaining armed. (5.16.0) — [release notes](https://github.com/mqttjs/MQTT.js/releases/tag/v5.16.0)
- A refused CONNACK always closes the socket, including when reconnectOnConnackError is false. (5.16.0) — [release notes](https://github.com/mqttjs/MQTT.js/releases/tag/v5.16.0)

### Security

- Unsolicited or out-of-spec AUTH packets are rejected rather than crashing the process. (5.16.0) — [release notes](https://github.com/mqttjs/MQTT.js/releases/tag/v5.16.0)
- The advertised Receive Maximum is enforced for inbound QoS 2 messages, preventing an unbounded incoming store. (5.16.0) — [release notes](https://github.com/mqttjs/MQTT.js/releases/tag/v5.16.0)
- SUBACK reason-code counts are checked against subscriptions sent, preventing crashes or incorrect subscription reports. (5.16.0) — [release notes](https://github.com/mqttjs/MQTT.js/releases/tag/v5.16.0)
- Unsolicited MQTT 5 Topic Aliases are rejected rather than crashing the process; the unregistered-alias case reports reason code 0x82. (5.16.0) — [release notes](https://github.com/mqttjs/MQTT.js/releases/tag/v5.16.0)

### New APIs and options

- PacketPump is newly exported from src/lib/shared.ts. (5.16.0) — [release notes](https://github.com/mqttjs/MQTT.js/releases/tag/v5.16.0)
- PendingCommand is newly exported from the entry point. (5.16.0) — [release notes](https://github.com/mqttjs/MQTT.js/releases/tag/v5.16.0)
- Topic validation functions are exported for external use. (5.15.0) — [release notes](https://github.com/mqttjs/MQTT.js/releases/tag/v5.15.0)

### Fixes and other changes

- Reconnects instead of ending a client whose stream is already destroyed. (5.16.1) — [release notes](https://github.com/mqttjs/MQTT.js/releases/tag/v5.16.1)
- Schedules browser process.nextTick with queueMicrotask. (5.16.1) — [release notes](https://github.com/mqttjs/MQTT.js/releases/tag/v5.16.1)
- AUTH reason code 0 now ends the exchange successfully instead of producing an error with an empty reason string. (5.16.0) — [release notes](https://github.com/mqttjs/MQTT.js/releases/tag/v5.16.0)
- Duplicate CONNACK packets are rejected instead of rerunning connection setup mid-session. (5.16.0) — [release notes](https://github.com/mqttjs/MQTT.js/releases/tag/v5.16.0)
- An explicit servername (SNI) is no longer overwritten when connecting over TLS. (5.15.2) — [release notes](https://github.com/mqttjs/MQTT.js/releases/tag/v5.15.2)
- WebSocket connections now support relative URLs. (5.15.2) — [release notes](https://github.com/mqttjs/MQTT.js/releases/tag/v5.15.2)