Update module github.com/eclipse/paho.mqtt.golang to v1.5.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/eclipse/paho.mqtt.golang	v1.5.0 → v1.5.1

---

Release Notes

eclipse/paho.mqtt.golang (github.com/eclipse/paho.mqtt.golang)

v1.5.1

Compare Source

This is a minor release incorporating changes made in the 14 months since v1.5.0 (including updating dependencies, and raising the Go version to 1.24). The changes are relatively minor but address a potential security issue (CVE-2025-10543), possible panic, enable users to better monitor the connection status, and incorporate a few optimisations.

Thanks to those who have provided fixes/enhancements included in this release!

Special thanks to Paul Gerste at Sonar for reporting issue #​730 via the Eclipse security team (fix was implemented in PR #​714 in May, github issue created just prior to this release). This issue arose where a topic > 65535 bytes was passed to the Publish function, due to the way the data was encoded the topic could leak into the message body. Please see issue #​730 or CVE-2025-10543 for further details.

What's Changed

• Updating go dependencies from pub and sub into the containers before building by @​JefJrFigueiredo in eclipse-paho#691
• Optimize TCP connection logic by @​geekeryy in eclipse-paho#713
• Fields over 65535 bytes not encoded correctly by @​MattBrittan in eclipse-paho#714
• Reduce slice allocations in route dispatch by @​alespour in eclipse-paho#710
• Add a ConnectionNotificationHandler by @​RangelReale in eclipse-paho#727
• Potential panic when using manual ACK by @​MattBrittan in eclipse-paho#729

Full Changelog: eclipse-paho/paho.mqtt.golang@v1.5.0...v1.5.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "every 2 months"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 3 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.22.6 -> 1.24.0
golang.org/x/net	v0.27.0 -> v0.44.0
golang.org/x/sync	v0.7.0 -> v0.17.0
golang.org/x/sys	v0.26.0 -> v0.36.0