Release Note 🎉

CLI Update Command · Security Improvements · Benchmark Fixes

MQTTX 1.13.3 adds a CLI update command, improves Desktop and Agent security, and fixes and optimizes the CLI benchmark command.

Update MQTTX CLI ⬆️

Run mqttx update to update an existing CLI installation. Standalone binaries update in place; npm and Homebrew installations use their package manager.

Security improvements 🔒

Strengthen Agent operation approvals, script execution, and content handling, and improve API key storage and CLI download verification.

Other improvements 🌈

Desktop:

• Support more payload formats for Last-Will messages.
• Show more complete operation details on Agent approval cards.

Distribution:

• Include SHA256SUMS with release downloads.

Fixes 🛠

CLI:

• Correct benchmark publish and subscribe rates and active connection counts.
• Fix workloads failing to start after an initial connection retry and split-file replay stalling after a disconnect.
• Fix %c not using the actual ClientId in benchmark and simulation topics.
• Accept whitespace around MQTT version options.

After upgrading, check subscriptions to topics that use %c.

Desktop:

• Correct Last-Will topics in connection history and Hex payload encoding.
• Improve Agent replies, MCP tool handling, and desktop startup compatibility.

简体中文

**CLI 更新命令 · 安全提升 · benchmark 修复** MQTTX 1.13.3 新增 CLI 更新命令，提升 Desktop 与 Agent 的安全性，并修复、优化 CLI benchmark 命令。 ### MQTTX CLI 更新 ⬆️ 运行 `mqttx update` 即可更新已有 CLI。独立二进制原位更新，npm 和 Homebrew 安装通过相应包管理器更新。 ### 安全提升 🔒 加强 Agent 操作审批、脚本执行和内容处理的安全性，改进 API Key 存储与 CLI 下载校验。 ## 其他改进 🌈 **Desktop：** - 遗嘱消息支持更多 Payload 格式。 - Agent 审批卡片展示更完整的操作信息。 **发布：** - 下载产物新增 `SHA256SUMS` 校验文件。 ## 修复 🛠 **CLI：** - 修正 benchmark 发布、订阅速率及活动连接统计。 - 修复初次连接重试成功后任务未启动，以及断线后拆分文件回放停滞的问题。 - 修复 benchmark 和模拟主题中的 `%c` 未使用实际 ClientId 的问题。 - 支持 MQTT 版本参数前后的空白字符。 > 升级后请检查使用 `%c` 的主题订阅。 **Desktop：** - 修正连接历史中的遗嘱主题及 Hex Payload 编码。 - 改进 Agent 回复、MCP 工具处理及桌面启动兼容性。

What's Changed

• docs: recommend the one-line MQTTX CLI installer by @ysfscream in https://github.com/emqx/MQTTX/pull/2128
• docs: give each CLI install command its own code block by @ysfscream in https://github.com/emqx/MQTTX/pull/2135
• docs: refresh Agent and Dashboard content for v1.13.2 by @ysfscream in https://github.com/emqx/MQTTX/pull/2137
• docs: restore general product documentation scope by @ysfscream in https://github.com/emqx/MQTTX/pull/2138
• fix(agent): disable raw HTML in chat replies by @ysfscream in https://github.com/emqx/MQTTX/pull/2141
• fix(agent): require approval for every script change by @ysfscream in https://github.com/emqx/MQTTX/pull/2142
• fix(desktop): harden payload script execution by @ysfscream in https://github.com/emqx/MQTTX/pull/2143
• fix(agent): keep the first MCP tool when names collide by @ysfscream in https://github.com/emqx/MQTTX/pull/2152
• fix(desktop): verify the CLI download before installing it by @ysfscream in https://github.com/emqx/MQTTX/pull/2150
• fix(agent): store the API key with the OS keychain by @ysfscream in https://github.com/emqx/MQTTX/pull/2151
• fix(desktop): sanitize changelog HTML and drop Node from the update window by @ysfscream in https://github.com/emqx/MQTTX/pull/2149
• fix(agent): stop KaTeX from rendering raw HTML in replies by @ysfscream in https://github.com/emqx/MQTTX/pull/2144
• fix(agent): show what will run on approval cards by @ysfscream in https://github.com/emqx/MQTTX/pull/2145
• fix(cli): correct benchmark rates and connection recovery by @ysfscream in https://github.com/emqx/MQTTX/pull/2153
• fix(agent): treat tool output as untrusted data by @ysfscream in https://github.com/emqx/MQTTX/pull/2147
• fix(cli): trim whitespace around MQTT version options by @ysfscream in https://github.com/emqx/MQTTX/pull/2157
• docs: clarify Agent permissions for v1.13.3 by @ysfscream in https://github.com/emqx/MQTTX/pull/2156
• fix(desktop): restrict external links and remote images by @ysfscream in https://github.com/emqx/MQTTX/pull/2148
• fix(agent): tighten approval for deletes and other state changes by @ysfscream in https://github.com/emqx/MQTTX/pull/2146
• ci(release): publish SHA256SUMS with each release by @ysfscream in https://github.com/emqx/MQTTX/pull/2155
• feat(cli): add update command by @ysfscream in https://github.com/emqx/MQTTX/pull/2154
• feat(connections): support all payload formats for Last-Will messages by @Killian0812 in https://github.com/emqx/MQTTX/pull/2140
• refactor(cli): simplify the update command by @ysfscream in https://github.com/emqx/MQTTX/pull/2158
• chore: bump version to 1.13.3 by @ysfscream in https://github.com/emqx/MQTTX/pull/2159

New Contributors

• @Killian0812 made their first contribution in https://github.com/emqx/MQTTX/pull/2140

Full Changelog: https://github.com/emqx/MQTTX/compare/v1.13.2...v1.13.3