0.7.0

MQTT service release for DreamFactory 7.7.1: two security fixes, plus the Laravel 13 / PHP 8.3 platform upgrade.

Security fixes

• Scope the MQTT subscribe consumer to the subscriber's role (RBAC bypass): the subscription callback previously dispatched the triggered service request with permission checks disabled, so any user with pub/sub access on a queue could invoke admin-only endpoints. The callback now runs under the subscriber's captured identity with normal permission checks, matching the df-amqp fix. (#18)
• Validate the publish topic shape: POST publish previously accepted any topic from request input. Topics are now required to be non-empty strings up to 64 KiB, with no NUL bytes and no MQTT wildcards (+/# are subscribe-only). (#17)

Maintenance

• Upgrade to Laravel 13.7 (composer-only, no source changes). PHP requirement is now ^8.3. php-mqtt/client is widened to ^1.7 || ^2.1, so the v2 major of the client library is now allowed/used (same public surface as used here). Also pins dreamfactory/df-core to ~1.0.4, adds laravel/helpers ^1.8 for the helper polyfills removed from Laravel core, and adds the standard L13 require-dev block. (#16)
• README: add standard platform Overview section.

0.6.1

Provider moved to OSS

0.6.0

DP-460 Upgrade to PHP 8.1 / Laravel 9

0.5.1

DP-205 Simplify release process (composer files)

0.5.0

Add Laravel 6 support

0.4.3

Bump df-pubsub

0.4.2

• DP-59 Configure Dependabot

0.4.1

Bump df-pubsub