[dependabot]

Bumps paho-mqtt from 2.1.0 to 2.2.0.

Release notes

Sourced from paho-mqtt's releases.

v2.2.0

• Update supported Python versions (PR #916, #956, #969) Drop support for Python 3.7 and 3.8. Deprecation notice: next release is expected to drop Python 3.9 and 3.10.
• Possible breaking change: Change some exceptions from ValueError to TypeError (in max_queued_messages_set and Client callback_api_version parameter) (Closes #972) The breaking change is unlikely however, both exceptions are expected to only be raised with broken code (e.g. need to pass wrong type - not just wrong value).
• Type annotations fix: bytearray was missing as alternative of some payload (Closes #918)
• Add drop_out_messages to discard outgoing message queue. This could be needed if broker lost the session (Closes #935)
• Honor MQTTv5 Server Keep Alive from CONNACK Properties (Closes #905)
• Fix an keepalive disconnection when receiving large payload (Closes #914)
• Fix bug in inflight message tracking & QoS 2 message, which could result in negative counter (Closes #805)
• Various reinforcement against corrupted or malformed packets (Closes #900, #970, #955, #965, #964, #860)
• Expose ReasonCode names as documentation said (PR #913)
• Fix broken reinitialise() (Closes #824)

Changelog

Sourced from paho-mqtt's changelog.

v2.2.0 - 2026-11-xx

• Update supported Python versions (PR #916, #956, #969) Drop support for Python 3.7 and 3.8. Deprecation notice: next release is expected to drop Python 3.9 and 3.10.
• Possible breaking change: Change some exceptions from ValueError to TypeError (in max_queued_messages_set and Client callback_api_version parameter) (Closes #972) The breaking change is unlikely however, both exceptions are expected to only be raised with broken code (e.g. need to pass wrong type - not just wrong value).
• Type annotations fix: bytearray was missing as alternative of some payload (Closes #918)
• Add drop_out_messages to discard outgoing message queue. This could be needed if broker lost the session (Closes #935)
• Honor MQTTv5 Server Keep Alive from CONNACK Properties (Closes #905)
• Fix an keepalive disconnection when receiving large payload (Closes #914)
• Fix bug in inflight message tracking & QoS 2 message, which could result in negative counter (Closes #805)
• Various reinforcement against corrupted or malformed packets (Closes #900, #970, #955, #965, #964, #860)
• Expose ReasonCode names as documentation said (PR #913)
• Fix broken reinitialise() (Closes #824)

Commits

• 7a8dfbd Bump version to 2.2.0
• fdf7e65 Merge pull request #972 from eclipse-paho/update-pre-commit
• 8c6b0e8 Merge branch 'master' into update-pre-commit
• 887c1c4 Merge pull request #973 from eclipse-paho/changelog-for-next-release
• 4ffe681 Merge pull request #971 from eclipse-paho/update-pyproject-metadata
• b1f3973 Merge pull request #970 from eclipse-paho/reinforce-packet-decoding
• 3d7d0b7 Merge branch 'master' into update-pre-commit
• 3553f01 feat: prepare changelog for release 2.2.0
• 00019d1 feat: update pre-commit's tools version
• be95072 Merge pull request #958 from pswsm/docs/ai-policy
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
pip/paho-mqtt	2.2.0	Unknown	Unknown

Scanned Files

• uv.lock

[SebastianLopezO]

Approved. Verified compatibility and green test/build status for deps: bump paho-mqtt from 2.1.0 to 2.2.0. Proceeding with automated fast-forward merge into main and branch cleanup.