update mqtt to v5

[karlismelderis-mckinsey]

Describe the feature

you're still using mqtt v4, that pulls in old help-me and that pulls in very old glob

Use Case

keep up to date and close vulnerabilities from sub-dependencies

Proposed Solution

No response

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

[xiazhvera]

We supported MQTTv5. If you have further concern, please give more details. Close the issue.

---

Update: My fault. Sub-dependencies does have MQTT v4, reopen it.

[Ranexia04]

Any news on this issue?

[sam-super]

Be good to get this moving as currently this package includes a vulnerability (high) CVE-2026-26996 in transient dependency: minimatch 3.1.3

│   └─┬ aws-crt@1.29.0
│     └─┬ mqtt@4.3.8
│       └─┬ help-me@3.0.0
│         └─┬ glob@7.2.3
│           └── minimatch@3.1.3

Changes to mqtt via help-me mean it no longer requires glob: https://github.com/mcollina/help-me/blob/master/package.json
https://nvd.nist.gov/vuln/detail/CVE-2026-26996

[xiazhvera]

Thank you for bringing this to our attention. We have been actively working on removing the MQTT.js package dependency from our SDK.

For additional context: Both the vulnerable library and mqtt v4 dependency are introduced into the SDK through MQTT.js. Unfortunately, there is little we can do to address this without removing the MQTT.js dependency entirely. Upgrading MQTT.js is not a viable option, as the newer version breaks webpack support (mqttjs/MQTT.js#1934), and no workaround has been identified at this time.

It is also worth noting that the vulnerable library is used within the MQTT.js library as an argument parser for bin files (example: https://github.com/mqttjs/MQTT.js/blob/v4.3.7/bin/sub.js). Direct use of our SDK should not be affected by this vulnerability.

I will keep updating the thread if we had further progress.