v1.5.9

Security fixes

• Upgrade the Go toolchain baseline and CI to Go 1.26.6, resolving all 19 reachable standard-library vulnerabilities reported for Go 1.26.0.
• Upgrade github.com/quic-go/quic-go from v0.59.0 to v0.61.0 to resolve the reachable HTTP/3 QPACK trailer expansion vulnerability.
• Upgrade golang.org/x/net to v0.58.0 and its related x/crypto, x/sys, and x/text dependencies.
• Upgrade github.com/klauspost/compress to v1.19.2, resolving its reported s2 out-of-bounds read vulnerability.

Verification

• go test ./...
• go test -race ./...
• govulncheck -show verbose ./... reports zero reachable or imported-package vulnerabilities.

Remaining upstream advisories

• golang.org/x/crypto/openpgp remains an upstream unmaintained package with no fixed version. It is transitively required by Sarama's Kerberos dependency path but is not imported or called by HMQ.
• Dependabot continues to report 13 x/crypto SSH/agent advisories and one x/net/html parser advisory with no patched version. They are not reachable from HMQ according to govulncheck; the required modules remain for Sarama Kerberos support and the x/net/websocket transport.