0.7.0

MQTT service release for DreamFactory 7.7.1: two security fixes, plus the Laravel 13 / PHP 8.3 platform upgrade.

Security fixes

• Scope the MQTT subscribe consumer to the subscriber's role (RBAC bypass): the subscription callback previously dispatched the triggered service request with permission checks disabled, so any user with pub/sub access on a queue could invoke admin-only endpoints. The callback now runs under the subscriber's captured identity with normal permission checks, matching the df-amqp fix. (#18)
• Validate the publish topic shape: POST publish previously accepted any topic from request input. Topics are now required to be non-empty strings up to 64 KiB, with no NUL bytes and no MQTT wildcards (+/# are subscribe-only). (#17)

Maintenance

• Upgrade to Laravel 13.7 (composer-only, no source changes). PHP requirement is now ^8.3. php-mqtt/client is widened to ^1.7 || ^2.1, so the v2 major of the client library is now allowed/used (same public surface as used here). Also pins dreamfactory/df-core to ~1.0.4, adds laravel/helpers ^1.8 for the helper polyfills removed from Laravel core, and adds the standard L13 require-dev block. (#16)
• README: add standard platform Overview section.