build(deps-dev): bump amqtt from 0.11.3 to 0.12.1

[dependabot]

Bumps amqtt from 0.11.3 to 0.12.1.

Release notes

Sourced from amqtt's releases.

v0.12.1

This is a security and maintenance release addressing a vulnerability in the handling of QoS2 messages.

Security Fixes

• A remote denial of service can be caused by incomplete MQTT QoS 2 transactions remaining allocated after the associated client disconnects. An attacker can repeatedly connect to the broker, initiate QoS 2 transactions, and disconnect before completing the handshake. Each incomplete transaction leaves state allocated in memory. Repeating this process causes broker memory consumption to grow continuously.

Official Advisory: GHSA-wcqj-wx85-c75p

Known affected versions: >= 0.11.0, <= 0.12.0

Versions before 0.11.0 were not evaluated.

A formal CVE identifier has been requested for this vulnerability and will be updated in these notes once assigned. Once assigned, the GHSA record will be updated automatically.

Test Coverage

The 0.12.1 QoS 2 security fix is covered by automated regression tests in tests/mqtt/protocol/test_handler_extended.py, including:

• test_qos2_outgoing_timeout_cleans_waiter_and_inflight

Features & Enhancements

This release strictly contains the security patch.

v0.12.0

• new: added support for python 3.14
• fix: authentication failure needs to send connack before disconnecting [PR #335](Yakifo/amqtt#335)
• new: enable multiple sqlalchemy db backends for persistence plugin [PR #333](Yakifo/amqtt#333)
• new: contrib plugin for authenticating against django's user models [PR #323](Yakifo/amqtt#323)
• new: example of plugin that allows clients to publish on $ [PR #315](Yakifo/amqtt#315)
• disable TLS certificate verification via config `[PR #312](Yakifo/amqtt#312)
• fix: handle special characters in passwords [PR #307](Yakifo/amqtt#307)
• fix: explicit close/release allowing proper v3.10 cleanup [PR #304](Yakifo/amqtt#304)
• fix: prevent failure when sys_interval is unset or None [PR #303](Yakifo/amqtt#303)
• reduce noisy reconnect logging [PR #310](Yakifo/amqtt#310)
• fix: publish coroutines in client documentation [PR #302](Yakifo/amqtt#302)
• fix: exception names in client documentation [PR #305](Yakifo/amqtt#305)
• fix: amqtt_sub reference page name [PR #299](Yakifo/amqtt#299)
• remove obselete pytests, add additional coverage [PR #309](Yakifo/amqtt#309)
• documentation now includes version number alongside every deprecation warning
• clarified CONTRIBUTING.md, expanded SECURITY.md with more robust security practices, added ROADMAP.md

Security Fixes

The amqtt project now includes OpenSSF's scorecard evaluation as part of its CI, including usage of bandit and semgrep for static security checking. Current scorecard status for openssf baseline level 1 and openssf best practices,

Test Coverage

• compatibility with mqttjs, java mqtt and go mqtt.

... (truncated)

Changelog

Sourced from amqtt's changelog.

0.12.1

This is a security and maintenance release addressing a vulnerability in the handling of QoS2 messages.

Security Fixes

• A remote denial of service can be caused by incomplete MQTT QoS 2 transactions remaining allocated after the associated client disconnects. An attacker can repeatedly connect to the broker, initiate QoS 2 transactions, and disconnect before completing the handshake. Each incomplete transaction leaves state allocated in memory. Repeating this process causes broker memory consumption to grow continuously.

Official Advisory: GHSA-wcqj-wx85-c75p

Known affected versions: >= 0.11.0, <= 0.12.0

Versions before 0.11.0 were not evaluated.

A formal CVE identifier has been requested for this vulnerability and will be updated in these notes once assigned. Once assigned, the GHSA record will be updated automatically.

Test Coverage

The 0.12.1 QoS 2 security fix is covered by automated regression tests in tests/mqtt/protocol/test_handler_extended.py, including:

• test_qos2_outgoing_timeout_cleans_waiter_and_inflight

Features & Enhancements

This release strictly contains the security patch.

0.12.0

• new: added support for python 3.14
• fix: authentication failure needs to send connack before disconnecting [PR #335](Yakifo/amqtt#335)
• new: enable multiple sqlalchemy db backends for persistence plugin [PR #333](Yakifo/amqtt#333)
• new: contrib plugin for authenticating against django's user models [PR #323](Yakifo/amqtt#323)
• new: example of plugin that allows clients to publish on $ [PR #315](Yakifo/amqtt#315)
• disable TLS certificate verification via config `[PR #312](Yakifo/amqtt#312)
• fix: handle special characters in passwords [PR #307](Yakifo/amqtt#307)
• fix: explicit close/release allowing proper v3.10 cleanup [PR #304](Yakifo/amqtt#304)
• fix: prevent failure when sys_interval is unset or None [PR #303](Yakifo/amqtt#303)
• reduce noisy reconnect logging [PR #310](Yakifo/amqtt#310)
• fix: publish coroutines in client documentation [PR #302](Yakifo/amqtt#302)
• fix: exception names in client documentation [PR #305](Yakifo/amqtt#305)
• fix: amqtt_sub reference page name [PR #299](Yakifo/amqtt#299)
• remove obselete pytests, add additional coverage [PR #309](Yakifo/amqtt#309)
• documentation now includes version number alongside every deprecation warning
• clarified CONTRIBUTING.md, expanded SECURITY.md with more robust security practices, added ROADMAP.md

Security Fixes

The amqtt project now includes OpenSSF's scorecard evaluation as part of its CI, including usage of bandit and semgrep for static security checking. Current scorecard status for openssf baseline level 1 and openssf best practices,

... (truncated)

Commits

• 2755fd8 This is an urgent security and maintenance release addressing a vulnerability...
• 64a6f8c fix: time out QoS2 PUBREC and PUBCOMP waits
• 5ebbf36 Merge pull request #383 from Yakifo/release/v0.12.0
• 082df5a update version number
• 4f85ff6 deprecation warning cleanup (#382)
• e142bc9 fix/broker shutdown (#381)
• 172a75e fixing release-drafter workflow (#380)
• b2b84a3 release/0.12.0 (#378)
• c945045 test coverage increase (#379)
• 175202e updating js-yaml to fix GHSA-5p4m-2wfm-xmqj vulnerability (#376)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)