From c41fb4979decaa5773bfdc5885333bf1ef858be0 Mon Sep 17 00:00:00 2001
From: permissionBRICK <40219477+permissionBRICK@users.noreply.github.com>
Date: Sun, 12 Jul 2026 01:32:54 +0000
Subject: [PATCH] fix: bump espMqttClient v1.7.0 -> v1.7.3 to fix outbox
 use-after-free
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

espMqttClient v1.6.0/v1.7.0 has a use-after-free in Outbox::remove()
that corrupts the heap on every MQTT TCP disconnect when >=2 QoS-0
packets are queued — the root cause of the ESP8266 total-freeze bug.
Fixed upstream in v1.7.3 (bertmelis/espMqttClient#166).

Also pin ESP32Async/AsyncTCP#v3.4.10 for ESP32 builds: espMqttClient
v1.7.3 declares a new dependency on ESP32Async/AsyncTCP >= 3.4.0 which
conflicts with ESPAsyncWebServer's transitive mathieucarbou/AsyncTCP
3.3.2 (same library, different registry owner). The explicit pin resolves
the duplicate-symbol link error.

The existing patches/espMqttClientSemaphore.patch applies cleanly to
v1.7.3.
---
 src/platformio.ini | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/platformio.ini b/src/platformio.ini
index f5c75a10..465c0c08 100644
--- a/src/platformio.ini
+++ b/src/platformio.ini
@@ -28,7 +28,7 @@ extra_scripts =
 lib_deps =
     https://github.com/nRF24/RF24.git#v1.4.8
     paulstoffregen/Time @ ^1.6.1
-    https://github.com/bertmelis/espMqttClient#v1.7.0
+    https://github.com/bertmelis/espMqttClient#v1.7.3
     bblanchon/ArduinoJson @ ^6.21.5
     https://github.com/JChristensen/Timezone @ ^1.2.4
     olikraus/U8g2 @ ^2.35.9
@@ -157,6 +157,7 @@ board = lolin_d32
 lib_deps =
     ${env.lib_deps}
     https://github.com/mathieucarbou/ESPAsyncWebServer#v3.3.12
+    https://github.com/ESP32Async/AsyncTCP#v3.4.10
 build_flags = ${env.build_flags}
     -DSPI_HAL
 monitor_filters =