[Snyk] Security upgrade mqtt from 2.18.8 to 4.2.7

[mramshaw]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • node.js/package.json
  • node.js/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-WS-1296835	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: mqtt

The new version differs by 138 commits.

• cc82753 Merge pull request #1291 from mqttjs/release_6_21_2021
• e6fc579 release: 4.2.7
• 6d817af Merge pull request #1209 from nosovk/patch-3
• 185307e Merge pull request #1224 from cameronelliott/master
• c8cebbf Merge pull request #1256 from nmggithub/master
• f3401a7 Update client-options.d.ts
• 6308dea Merge branch 'master' into master
• be17dd7 Merge pull request #1236 from ogis-yamazaki/fix_multi_protocol_test_mechanism
• 949e22a remove 10.x from gate
• 71dae75 Merge pull request #1249 from bkp7/bkp7-typescript-changes
• 59d257a Merge pull request #1239 from ogis-yamazaki/fix_close_websocket_stream
• 0725798 Merge pull request #1266 from simnalamburt/duplexify
• acb6117 Merge branch 'master' into duplexify
• a9d269b Merge pull request #1289 from LaurentGoderre/fix-production-vulnerability
• 8ef5ffc Fix production vulnerability
• 845561e Add missing 'duplexify' dependency
• d93c193 The stream's _writableState may still be false when the WebSocket close event occurs.
• 51c5c02 improved type definition for 'wsOptions'
• 61bcbe6 fix missing event types
• 2203585 reverse out changes to client.d.ts
• 063aa31 change reference to mqtt-packet v6.8.0
• 746c0bc Improved TypeScript declarations for userProperties
• e04e0f8 fix #1235, WebSocket client does not emit close event when disconnected from the server side.
• 4bd3f3c fix multi protocol test mechanism.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)