This is a bugfix and security release.

Version 1.5.4 changes

Security

When using a TLS enabled websockets listener with require_certificate enabled, the mosquitto broker does not correctly verify client certificates. This is now fixed. All other security measures operate as expected, and in particular non-websockets listeners are not affected by this. Closes #996.

Broker

Process all pending messages even when a client has disconnected. This means a client that send a PUBLISH then DISCONNECT quickly, then disconnects will have its DISCONNECT message processed properly and so no Will will be sent. Closes #7.
$SYS/broker/clients/disconnected should never be negative. Closes #287.
Give better error message if a client sends a password without a username. Closes #1015.
Fix bridge not honoring restart_timeout. Closes #1019.
Don't disconnect a client if an auth plugin denies access to SUBSCRIBE. Closes #1016.

Library

Fix memory leak that occurred if mosquitto_reconnect() was used when TLS errors were present. Closes #592.
Fix TLS connections when using an external event loop with mosquitto_loop_read() and mosquitto_write(). Closes #990.

Build

Fix clients not being compiled with threading support when using CMake. Closes #983.
Header fixes for FreeBSD. Closes #977.
Use _GNU_SOURCE to fix build errors in websockets and getaddrinfo usage. Closes [#862] and #933.
Fix builds on QNX 7.0.0. Closes #1018.