package/mosquitto: bump version

index cb4525d1a4..fb43994aed 100644
@@ -31,4 +31,11 @@ else
 CJSON_CONF_OPTS += -DENABLE_CJSON_UTILS=OFF
 endif
 
+HOST_CJSON_CONF_OPTS = \
+	-DENABLE_CJSON_TEST=OFF \
+	-DENABLE_CUSTOM_COMPILER_FLAGS=OFF \
+	-DBUILD_SHARED_AND_STATIC_LIBS=OFF \
+	-DENABLE_CJSON_UTILS=OFF
+
 $(eval $(cmake-package))
+$(eval $(host-cmake-package))

deleted file mode 100644
index 9445148f44..0000000000
@@ -1,50 +0,0 @@
-From 1ecc94d7b4ff495afd7f32c42072cdf4ea5407aa Mon Sep 17 00:00:00 2001
-From: Ben Marsh <[email protected]>
-Date: Mon, 21 Jul 2025 17:46:16 +0100
-Subject: [PATCH] Fix CMake builds with WITH_TLS=OFF
-
-Recent CMake changes caused CMake builds with the WITH_TLS option set to OFF to fail. The OpenSSL package is only found (find_package()) if WITH_TLS is ON, but linking to OpenSSL for the broker and library is not guarded by WITH_TLS. The build therefore fails.
-
-Guard linking to OpenSSL, only linking if WITH_TLS is set.
-
-Upstream: https://github.com/eclipse-mosquitto/mosquitto/pull/3321
-Signed-off-by: Scott Fan <[email protected]>
----
- lib/CMakeLists.txt | 4 +++-
- src/CMakeLists.txt | 5 ++++-
- 2 files changed, 7 insertions(+), 2 deletions(-)
-
-diff --git a/lib/CMakeLists.txt b/lib/CMakeLists.txt
-index 21b61497..e6b8235b 100644
---- a/lib/CMakeLists.txt
-+++ b/lib/CMakeLists.txt
-@@ -60,7 +60,9 @@ set(C_SRC
- 	util_mosq.c util_topic.c util_mosq.h
- 	will_mosq.c will_mosq.h)
- 
--set (LIBRARIES OpenSSL::SSL)
-+if (WITH_TLS)
-+	set (LIBRARIES OpenSSL::SSL)
-+endif()
- 
- if (UNIX AND NOT APPLE AND NOT ANDROID)
- 	find_library(LIBRT rt)
-diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
-index d4bae7cd..6fd0ee53 100644
---- a/src/CMakeLists.txt
-+++ b/src/CMakeLists.txt
-@@ -163,7 +163,10 @@ if (WITH_DLT)
-     set (MOSQ_LIBS ${MOSQ_LIBS} ${DLT_LIBRARIES})
- endif (WITH_DLT)
- 
--set (MOSQ_LIBS ${MOSQ_LIBS} OpenSSL::SSL)
-+if (WITH_TLS)
-+	set (MOSQ_LIBS ${MOSQ_LIBS} OpenSSL::SSL)
-+endif()
-+
- # Check for getaddrinfo_a
- include(CheckLibraryExists)
- check_library_exists(anl getaddrinfo_a  "" HAVE_GETADDRINFO_A)
--- 
-2.43.0
-

new file mode 100644
index 0000000000..23345183dd
@@ -0,0 +1,40 @@
+From 7ee523213c30b86ff723c192462f55b84d7714b9 Mon Sep 17 00:00:00 2001
+From: "Roger A. Light" <[email protected]>
+Date: Tue, 10 Feb 2026 18:42:36 +0000
+Subject: [PATCH] Fix MOSQ_EVT_DISCONNECT being called before
+ MOSQ_EVT_ACL_CHECK
+
+This occurs for the will of that client.
+
+Closes #3487. Thanks to ChrisBFX.
+
+Upstream: https://github.com/eclipse-mosquitto/mosquitto/commit/5f2a45d96a52e1e0135b48aec281d612aa1ecdea
+[[email protected]: drop the Changelog.txt entry]
+Signed-off-by: Yann E. MORIN <[email protected]>
+---
+ src/context.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/context.c b/src/context.c
+index ca4784d9..6b397d47 100644
+--- a/src/context.c
++++ b/src/context.c
+@@ -269,13 +269,14 @@ void context__disconnect(struct mosquitto *context, int reason)
+ 		}
+ 	}
+ 
++	context__send_will(context);
++
+ 	if(context->session_expiry_interval == MQTT_SESSION_EXPIRY_IMMEDIATE){
+ 		plugin__handle_disconnect(context, reason);
+ 	}else{
+ 		plugin__handle_client_offline(context, reason);
+ 	}
+ 
+-	context__send_will(context);
+ 	net__socket_close(context);
+ #ifdef WITH_BRIDGE
+ 	if(context->bridge == NULL)
+-- 
+2.34.1
+

47 lines not on this page · raw message

new file mode 100644
index 0000000000..4c62644cfe
@@ -0,0 +1,33 @@
+From 6834ff7b8304f74c044b8399f23fe69455bfeda8 Mon Sep 17 00:00:00 2001
+From: "Roger A. Light" <[email protected]>
+Date: Fri, 13 Feb 2026 00:36:47 +0000
+Subject: [PATCH] Fix potential crash if group id has no group name.
+
+This can occur if reading a file in restricted mode and the group id
+does not have an entry in /etc/groups.
+
+Closes #3498. Thanks to Stefan Kranich.
+
+Upstream: https://github.com/eclipse-mosquitto/mosquitto/commit/7958a85bae06c22c3beff2942b8c1ac04f6a6353
+[[email protected]: drop the Changelog.txt entry]
+Signed-off-by: Yann E. MORIN <[email protected]>
+---
+ libcommon/file_common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libcommon/file_common.c b/libcommon/file_common.c
+index 1998e6d0..8bde3009 100644
+--- a/libcommon/file_common.c
++++ b/libcommon/file_common.c
+@@ -235,7 +235,7 @@ FILE *mosquitto_fopen(const char *path, const char *mode, bool restrict_read)
+ 			char buf[4096];
+ 			struct group grp, *result;
+ 
+-			if(getgrgid_r(getgid(), &grp, buf, sizeof(buf), &result) == 0){
++			if(getgrgid_r(getgid(), &grp, buf, sizeof(buf), &result) == 0 && result){
+ 				libcommon_printf(
+ 						"Warning: File %s group is not %s. Future versions will refuse to load this file.\n",
+ 						path, result->gr_name);
+-- 
+2.34.1
+

59 lines not on this page · raw message

136 lines not on this page · raw message

231 lines not on this page · raw message

152 lines not on this page · raw message

212 lines not on this page · raw message

new file mode 100644
index 0000000000..521391fcec
@@ -0,0 +1,27 @@
+From 5ff7991df2743afaa7777822b7b4ffa471cf9b97 Mon Sep 17 00:00:00 2001
+From: "Roger A. Light" <[email protected]>
+Date: Wed, 18 Feb 2026 09:05:44 +0000
+Subject: [PATCH] Fix incorrect parsing of unix socket address in proxy v2
+
+Upstream: https://github.com/eclipse-mosquitto/mosquitto/commit/b21c9f2c9af97ac4bc90efea388ca27ce7f6e73a
+Signed-off-by: Yann E. MORIN <[email protected]>
+---
+ src/proxy_v2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/proxy_v2.c b/src/proxy_v2.c
+index 97932ad3..47adb302 100644
+--- a/src/proxy_v2.c
++++ b/src/proxy_v2.c
+@@ -280,7 +280,7 @@ int proxy_v2__read(struct mosquitto *context)
+ 			union proxy_addr *addr = (union proxy_addr *)context->proxy.buf;
+ 			context->address = mosquitto_strndup((char *)addr->unix_addr.src_addr, sizeof(addr->unix_addr.src_addr));
+ 			context->remote_port = 0;
+-			context->proxy.pos = (uint16_t)(strlen(context->address) + 1);
++			context->proxy.pos = (uint16_t)(sizeof(addr->unix_addr.src_addr) + 1);
+ 		}else{
+ 			/* Must be LOCAL */
+ 			/* Ignore address */
+-- 
+2.34.1
+

116 lines not on this page · raw message

new file mode 100644
index 0000000000..6c73495113
@@ -0,0 +1,35 @@
+From bc830cffee22a3498700f9038a4ceea47efe45de Mon Sep 17 00:00:00 2001
+From: "Yann E. MORIN" <[email protected]>
+Date: Tue, 10 Feb 2026 09:21:11 +0100
+Subject: [PATCH] broker: properly check for getaddrinfo_a()
+
+getaddrinfo_a( is protected by _GNU_SOURCE.
+
+This is properly accounted for in the source code, in lib/net_mosq.c,
+but the check in the CmakeList is missing that define, which causes
+the check to actually fail.
+
+Add that define when checking; this fixes builds on various C libraries,
+like uClibc-ng, musl, or newer/older glibc.
+
+Signed-off-by: Yann E. MORIN <[email protected]>
+Upstream: https://github.com/eclipse-mosquitto/mosquitto/commit/8c3bc32689346d7b86e2dad954ff482b5ad7aef1
+---
+ src/CMakeLists.txt | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
+index 8ac47d87..8576fea9 100644
+--- a/src/CMakeLists.txt
++++ b/src/CMakeLists.txt
+@@ -184,6 +184,7 @@ endif()
+ if(WITH_ADNS)
+ 	cmake_push_check_state()
+ 	set(ANL_CODE "
++		#define _GNU_SOURCE
+ 		#include <stdlib.h>
+ 		#include <netdb.h>
+ 		int main(){
+-- 
+2.34.1
+

56 lines not on this page · raw message

90 lines not on this page · raw message

index 339df8fddb..2667b60f57 100644
@@ -1,5 +1,8 @@
 config BR2_PACKAGE_MOSQUITTO
 	bool "mosquitto"
+	depends on BR2_USE_MMU  # lib peeks in malloc() internals; broker fork()s
+	depends on !BR2_STATIC_LIBS
+	select BR2_PACKAGE_CJSON
 	help
 	  Eclipse Mosquitto is an open source (EPL/EDL licensed) message
 	  broker that implements the MQTT protocol versions 5.0, 3.1.1

@@ -19,12 +22,11 @@ config BR2_PACKAGE_MOSQUITTO
 
 	  https://mosquitto.org/
 
+if BR2_PACKAGE_MOSQUITTO
+
 config BR2_PACKAGE_MOSQUITTO_BROKER
 	bool "install the mosquitto broker"
 	default y
-	depends on BR2_USE_MMU # fork()
-	depends on !BR2_STATIC_LIBS # include <dlfcn.h>
-	depends on BR2_PACKAGE_MOSQUITTO
 	select BR2_PACKAGE_LIBWEBSOCKETS_EXT_POLL if BR2_PACKAGE_LIBWEBSOCKETS
 	help
 	  Build and install the mosquitto broker onto target.

@@ -32,13 +34,16 @@ config BR2_PACKAGE_MOSQUITTO_BROKER
 config BR2_PACKAGE_MOSQUITTO_BROKER_DYNAMIC_SECURITY_PLUGIN
 	bool "dynamic security plugin"
 	depends on BR2_PACKAGE_MOSQUITTO_BROKER
-	select BR2_PACKAGE_CJSON
 	select BR2_PACKAGE_OPENSSL
 	help
 	  Build and install the dynamic security plugin for
 	  mosquitto broker onto target.
 
 comment "mosquitto broker needs a toolchain w/ dynamic library"
+	depends on BR2_STATIC_LIBS
+
+endif
+
+comment "mosquitto needs a toolchain w/ dynamic library"
 	depends on BR2_USE_MMU
 	depends on BR2_STATIC_LIBS
-	depends on BR2_PACKAGE_MOSQUITTO

index cf031f91e5..c0306161c7 100644
@@ -1,8 +1,7 @@
-# Locally calculated after checking gpg signature
-# from https://mosquitto.org/files/source/mosquitto-2.0.22.tar.gz.asc
-sha256  2f752589ef7db40260b633fbdb536e9a04b446a315138d64a7ff3c14e2de6b68  mosquitto-2.0.22.tar.gz
+# Locally calculated
+sha256  fd905380691ac65ea5a93779e8214941829e3d6e038d5edff9eac5fd74cbed02  mosquitto-2.1.2.tar.gz
 
 # License files
-sha256  d3c4ccace4e5d3cc89d34cf2a0bc85b8596bfc0a32b815d0d77f9b7c41b5350c  LICENSE.txt
+sha256  33d1851e40fddba7eff95bcc01d1a178a87340a1126893012892913d5e6fdfa6  LICENSE.txt
 sha256  8c349f80764d0648e645f41ef23772a70c995a0924b5235f735f4a3d09df127c  epl-v20
 sha256  86fc4a3f97cb769c04e8da557036c1066eb8bb22b2d0a5dd31464990fe84047c  edl-v10

230 lines not on this page · raw message

index 2667b60f57..d0f096e5cf 100644
@@ -24,6 +24,15 @@ config BR2_PACKAGE_MOSQUITTO
 
 if BR2_PACKAGE_MOSQUITTO
 
+config BR2_PACKAGE_MOSQUITTO_CLIENTS
+	bool "install clients"
+	default y  # Backward compatibility
+	help
+	  Install CLI tools to publish/subscribe to the broker:
+	    mosquitto_pub
+	    mosquitto_sub
+	    mosquitto_rr
+
 config BR2_PACKAGE_MOSQUITTO_BROKER
 	bool "install the mosquitto broker"
 	default y

index 6e9ad434ba..62934966ca 100644
@@ -19,7 +19,6 @@ MOSQUITTO_CONF_OPTS = \
 	-DWITH_TESTS=OFF \
 	-DWITH_STATIC_LIBRARIES=OFF \
 	-DWITH_BUNDLED_DEPS=ON \
-	-DWITH_CLIENTS=ON \
 	-DWITH_HTTP_API=OFF \
 	-DWITH_CTRL_SHELL=OFF
 

@@ -70,6 +69,12 @@ else
 MOSQUITTO_CONF_OPTS += -DWITH_LIB_CPP=OFF
 endif
 
+ifeq ($(BR2_PACKAGE_MOSQUITTO_CLIENTS),y)
+MOSQUITTO_CONF_OPTS += -DWITH_CLIENTS=ON
+else
+MOSQUITTO_CONF_OPTS += -DWITH_CLIENTS=OFF
+endif
+
 ifeq ($(BR2_PACKAGE_MOSQUITTO_BROKER),y)
 
 MOSQUITTO_CONF_OPTS += \

index d0f096e5cf..c19d80c943 100644
@@ -33,6 +33,22 @@ config BR2_PACKAGE_MOSQUITTO_CLIENTS
 	    mosquitto_sub
 	    mosquitto_rr
 
+config BR2_PACKAGE_MOSQUITTO_APPS
+	bool "install apps"
+	default y if BR2_PACKAGE_MOSQUITTO_BROKER  # Backward compatibility
+	depends on BR2_USE_WCHAR  # libedit
+	# For mosquitto_ctrl shell feature, mandatorily enabled:
+	select BR2_PACKAGE_READLINE if !BR2_PACKAGE_LIBEDIT
+	help
+	  Those apps can be used to interact with the broker:
+	    mosquitto_db_dump
+	    mosquitto_signal
+
+	  Additionally, when openssl is enabled, the following apps are
+	  also installed:
+	    mosquitto_ctrl
+	    mosquitto_passwd
+
 config BR2_PACKAGE_MOSQUITTO_BROKER
 	bool "install the mosquitto broker"
 	default y

index 62934966ca..a1848f96b3 100644
@@ -19,8 +19,7 @@ MOSQUITTO_CONF_OPTS = \
 	-DWITH_TESTS=OFF \
 	-DWITH_STATIC_LIBRARIES=OFF \
 	-DWITH_BUNDLED_DEPS=ON \
-	-DWITH_HTTP_API=OFF \
-	-DWITH_CTRL_SHELL=OFF
+	-DWITH_HTTP_API=OFF
 
 # adns uses getaddrinfo_a
 ifeq ($(BR2_TOOLCHAIN_USES_GLIBC),y)

@@ -75,12 +74,18 @@ else
 MOSQUITTO_CONF_OPTS += -DWITH_CLIENTS=OFF
 endif
 
+ifeq ($(BR2_PACKAGE_MOSQUITTO_APPS),y)
+MOSQUITTO_DEPENDENCIES += $(if $(BR2_PACKAGE_LIBEDIT),libedit,readline)
+MOSQUITTO_CONF_OPTS += -DWITH_APPS=ON -DWITH_CTRL_SHELL=ON
+else
+MOSQUITTO_CONF_OPTS += -DWITH_APPS=OFF -DWITH_CTRL_SHELL=OFF
+endif
+
 ifeq ($(BR2_PACKAGE_MOSQUITTO_BROKER),y)
 
 MOSQUITTO_CONF_OPTS += \
 	-DCMAKE_INSTALL_SYSCONFDIR=/etc \
 	-DWITH_BROKER=ON \
-	-DWITH_APPS=ON \
 	-DWITH_PLUGINS=ON \
 	-DWITH_PLUGIN_ACL_FILE=ON \
 	-DWITH_PLUGIN_PASSWORD_FILE=ON \

@@ -125,7 +130,6 @@ MOSQUITTO_POST_INSTALL_TARGET_HOOKS += MOSQUITTO_INSTALL_TARGET_CONF
 else # !BR2_PACKAGE_MOSQUITTO_BROKER
 MOSQUITTO_CONF_OPTS += \
 	-DWITH_BROKER=OFF \
-	-DWITH_APPS=OFF \
 	-DWITH_PLUGINS=OFF
 endif
 

index c19d80c943..bbc17bc00a 100644
@@ -24,6 +24,30 @@ config BR2_PACKAGE_MOSQUITTO
 
 if BR2_PACKAGE_MOSQUITTO
 
+choice
+	prompt "Websockets support"
+	help
+	  Choose what websocket implementation to use. Note that
+	  the mosquitto_{sub,pub,rr} clients (above) only support
+	  websockets with the builtin implementation, while the
+	  broker supports websockets with either libwebsockets
+	  or the builtin implementation.
+
+config BR2_PACKAGE_MOSQUITTO_WS_NONE
+	bool "none"
+
+config BR2_PACKAGE_MOSQUITTO_WS_LIBWS
+	bool "with libwebsockets"
+	select BR2_PACKAGE_OPENSSL
+	select BR2_PACKAGE_LIBWEBSOCKETS
+	select BR2_PACKAGE_LIBWEBSOCKETS_EXT_POLL
+
+config BR2_PACKAGE_MOSQUITTO_WS_BUILTIN
+	bool "with builtin implementation"
+	select BR2_PACKAGE_OPENSSL
+
+endchoice
+
 config BR2_PACKAGE_MOSQUITTO_CLIENTS
 	bool "install clients"
 	default y  # Backward compatibility

@@ -52,7 +76,6 @@ config BR2_PACKAGE_MOSQUITTO_APPS
 config BR2_PACKAGE_MOSQUITTO_BROKER
 	bool "install the mosquitto broker"
 	default y
-	select BR2_PACKAGE_LIBWEBSOCKETS_EXT_POLL if BR2_PACKAGE_LIBWEBSOCKETS
 	help
 	  Build and install the mosquitto broker onto target.
 

index a1848f96b3..9b3bcc1cf5 100644
@@ -41,9 +41,11 @@ MOSQUITTO_CONF_OPTS += \
 	-DWITH_TLS=ON \
 	-DWITH_TLS_PSK=ON
 
-ifeq ($(BR2_PACKAGE_LIBWEBSOCKETS),y)
+ifeq ($(BR2_PACKAGE_MOSQUITTO_WS_LIBWS),y)
 MOSQUITTO_DEPENDENCIES += libwebsockets
 MOSQUITTO_CONF_OPTS += -DWITH_WEBSOCKETS=ON -DWITH_WEBSOCKETS_BUILTIN=OFF
+else ifeq ($(BR2_PACKAGE_MOSQUITTO_WS_BUILTIN),y)
+MOSQUITTO_CONF_OPTS += -DWITH_WEBSOCKETS=ON -DWITH_WEBSOCKETS_BUILTIN=ON
 else
 MOSQUITTO_CONF_OPTS += -DWITH_WEBSOCKETS=OFF -DWITH_WEBSOCKETS_BUILTIN=OFF
 endif

index bbc17bc00a..54bb4faebe 100644
@@ -79,14 +79,24 @@ config BR2_PACKAGE_MOSQUITTO_BROKER
 	help
 	  Build and install the mosquitto broker onto target.
 
+if BR2_PACKAGE_MOSQUITTO_BROKER
+
+config BR2_PACKAGE_MOSQUITTO_BROKER_HTTP_API
+	bool "http_api"
+	select BR2_PACKAGE_LIBMICROHTTPD
+	help
+	  Add support for simple webserver as a listener to serve
+	  some of the HTTP API.
+
 config BR2_PACKAGE_MOSQUITTO_BROKER_DYNAMIC_SECURITY_PLUGIN
 	bool "dynamic security plugin"
-	depends on BR2_PACKAGE_MOSQUITTO_BROKER
 	select BR2_PACKAGE_OPENSSL
 	help
 	  Build and install the dynamic security plugin for
 	  mosquitto broker onto target.
 
+endif
+
 comment "mosquitto broker needs a toolchain w/ dynamic library"
 	depends on BR2_STATIC_LIBS
 

index 9b3bcc1cf5..160945d6d9 100644
@@ -18,8 +18,7 @@ MOSQUITTO_CONF_OPTS = \
 	-DWITH_DOCS=OFF \
 	-DWITH_TESTS=OFF \
 	-DWITH_STATIC_LIBRARIES=OFF \
-	-DWITH_BUNDLED_DEPS=ON \
-	-DWITH_HTTP_API=OFF
+	-DWITH_BUNDLED_DEPS=ON
 
 # adns uses getaddrinfo_a
 ifeq ($(BR2_TOOLCHAIN_USES_GLIBC),y)

@@ -95,6 +94,13 @@ MOSQUITTO_CONF_OPTS += \
 	-DWITH_PLUGIN_PERSIST_SQLITE=OFF \
 	-DWITH_PLUGIN_SPARKPLUG_AWARE=OFF
 
+ifeq ($(BR2_PACKAGE_MOSQUITTO_BROKER_HTTP_API),y)
+MOSQUITTO_DEPENDENCIES += libmicrohttpd
+MOSQUITTO_CONF_OPTS += -DWITH_HTTP_API=ON
+else
+MOSQUITTO_CONF_OPTS += -DWITH_HTTP_API=OFF
+endif
+
 ifeq ($(BR2_PACKAGE_MOSQUITTO_BROKER_DYNAMIC_SECURITY_PLUGIN),y)
 MOSQUITTO_CONF_OPTS += -DWITH_PLUGIN_DYNAMIC_SECURITY=ON
 else

index 54bb4faebe..1d7cd96aba 100644
@@ -88,6 +88,20 @@ config BR2_PACKAGE_MOSQUITTO_BROKER_HTTP_API
 	  Add support for simple webserver as a listener to serve
 	  some of the HTTP API.
 
+config BR2_PACKAGE_MOSQUITTO_BROKER_PLUGIN_STATIC_PASSWD
+	bool "static password file plugin"
+	default y
+	help
+	  Add support for authentication based on static files. using
+	  a plugin rather than the legacy builtin support.
+
+config BR2_PACKAGE_MOSQUITTO_BROKER_PLUGIN_STATIC_ACL
+	bool "static ACL file plugin"
+	default y
+	help
+	  Add support for authorization (ACL) based on static files,
+	  using a plugin rather than the legacy builtin support.
+
 config BR2_PACKAGE_MOSQUITTO_BROKER_DYNAMIC_SECURITY_PLUGIN
 	bool "dynamic security plugin"
 	select BR2_PACKAGE_OPENSSL

index 160945d6d9..d95583d768 100644
@@ -88,11 +88,12 @@ MOSQUITTO_CONF_OPTS += \
 	-DCMAKE_INSTALL_SYSCONFDIR=/etc \
 	-DWITH_BROKER=ON \
 	-DWITH_PLUGINS=ON \
-	-DWITH_PLUGIN_ACL_FILE=ON \
-	-DWITH_PLUGIN_PASSWORD_FILE=ON \
 	-DWITH_PLUGIN_EXAMPLES=OFF \
 	-DWITH_PLUGIN_PERSIST_SQLITE=OFF \
-	-DWITH_PLUGIN_SPARKPLUG_AWARE=OFF
+	-DWITH_PLUGIN_SPARKPLUG_AWARE=OFF \
+	-DWITH_PLUGIN_PASSWORD_FILE=$(if $(BR2_PACKAGE_MOSQUITTO_BROKER_PLUGIN_STATIC_PASSWD),ON,OFF) \
+	-DWITH_PLUGIN_ACL_FILE=$(if $(BR2_PACKAGE_MOSQUITTO_BROKER_PLUGIN_STATIC_ACL),ON,OFF) \
+	-DWITH_PLUGIN_DYNAMIC_SECURITY=$(if $(BR2_PACKAGE_MOSQUITTO_BROKER_DYNAMIC_SECURITY_PLUGIN),ON,OFF)
 
 ifeq ($(BR2_PACKAGE_MOSQUITTO_BROKER_HTTP_API),y)
 MOSQUITTO_DEPENDENCIES += libmicrohttpd

@@ -101,12 +102,6 @@ else
 MOSQUITTO_CONF_OPTS += -DWITH_HTTP_API=OFF
 endif
 
-ifeq ($(BR2_PACKAGE_MOSQUITTO_BROKER_DYNAMIC_SECURITY_PLUGIN),y)
-MOSQUITTO_CONF_OPTS += -DWITH_PLUGIN_DYNAMIC_SECURITY=ON
-else
-MOSQUITTO_CONF_OPTS += -DWITH_PLUGIN_DYNAMIC_SECURITY=OFF
-endif
-
 ifeq ($(BR2_PACKAGE_SYSTEMD),y)
 MOSQUITTO_DEPENDENCIES += systemd
 MOSQUITTO_CONF_OPTS += -DWITH_SYSTEMD=ON

index 1d7cd96aba..02a30c03e5 100644
@@ -109,6 +109,13 @@ config BR2_PACKAGE_MOSQUITTO_BROKER_DYNAMIC_SECURITY_PLUGIN
 	  Build and install the dynamic security plugin for
 	  mosquitto broker onto target.
 
+config BR2_PACKAGE_MOSQUITTO_BROKER_PLUGIN_PERSIST_SQLITE
+	bool "persist-sqlite plugin"
+	select BR2_PACKAGE_SQLITE
+	help
+	  Add the persist-sqlite plugin, to persist the broker
+	  state across restarts.
+
 endif
 
 comment "mosquitto broker needs a toolchain w/ dynamic library"

index d95583d768..246dcb8227 100644
@@ -89,7 +89,6 @@ MOSQUITTO_CONF_OPTS += \
 	-DWITH_BROKER=ON \
 	-DWITH_PLUGINS=ON \
 	-DWITH_PLUGIN_EXAMPLES=OFF \
-	-DWITH_PLUGIN_PERSIST_SQLITE=OFF \
 	-DWITH_PLUGIN_SPARKPLUG_AWARE=OFF \
 	-DWITH_PLUGIN_PASSWORD_FILE=$(if $(BR2_PACKAGE_MOSQUITTO_BROKER_PLUGIN_STATIC_PASSWD),ON,OFF) \
 	-DWITH_PLUGIN_ACL_FILE=$(if $(BR2_PACKAGE_MOSQUITTO_BROKER_PLUGIN_STATIC_ACL),ON,OFF) \

@@ -102,6 +101,13 @@ else
 MOSQUITTO_CONF_OPTS += -DWITH_HTTP_API=OFF
 endif
 
+ifeq ($(BR2_PACKAGE_MOSQUITTO_BROKER_PLUGIN_PERSIST_SQLITE),y)
+MOSQUITTO_DEPENDENCIES += sqlite
+MOSQUITTO_CONF_OPTS += -DWITH_PLUGIN_PERSIST_SQLITE=OM
+else
+MOSQUITTO_CONF_OPTS += -DWITH_PLUGIN_PERSIST_SQLITE=OFF
+endif
+
 ifeq ($(BR2_PACKAGE_SYSTEMD),y)
 MOSQUITTO_DEPENDENCIES += systemd
 MOSQUITTO_CONF_OPTS += -DWITH_SYSTEMD=ON

index 02a30c03e5..477e88a2be 100644
@@ -88,6 +88,12 @@ config BR2_PACKAGE_MOSQUITTO_BROKER_HTTP_API
 	  Add support for simple webserver as a listener to serve
 	  some of the HTTP API.
 
+config BR2_PACKAGE_MOSQUITTO_BROKER_BRIDGE
+	bool "bridge support"
+	default y  # legacy
+	help
+	  Include bridge support for connecting to other brokers
+
 config BR2_PACKAGE_MOSQUITTO_BROKER_PLUGIN_STATIC_PASSWD
 	bool "static password file plugin"
 	default y

index 246dcb8227..a8ea33fca5 100644
@@ -92,7 +92,8 @@ MOSQUITTO_CONF_OPTS += \
 	-DWITH_PLUGIN_SPARKPLUG_AWARE=OFF \
 	-DWITH_PLUGIN_PASSWORD_FILE=$(if $(BR2_PACKAGE_MOSQUITTO_BROKER_PLUGIN_STATIC_PASSWD),ON,OFF) \
 	-DWITH_PLUGIN_ACL_FILE=$(if $(BR2_PACKAGE_MOSQUITTO_BROKER_PLUGIN_STATIC_ACL),ON,OFF) \
-	-DWITH_PLUGIN_DYNAMIC_SECURITY=$(if $(BR2_PACKAGE_MOSQUITTO_BROKER_DYNAMIC_SECURITY_PLUGIN),ON,OFF)
+	-DWITH_PLUGIN_DYNAMIC_SECURITY=$(if $(BR2_PACKAGE_MOSQUITTO_BROKER_DYNAMIC_SECURITY_PLUGIN),ON,OFF) \
+	-DINC_BRIDGE_SUPPORT=$(if $(BR2_PACKAGE_MOSQUITTO_BROKER_BRIDGE),ON,OFF)
 
 ifeq ($(BR2_PACKAGE_MOSQUITTO_BROKER_HTTP_API),y)
 MOSQUITTO_DEPENDENCIES += libmicrohttpd

index 477e88a2be..1ffb60dc77 100644
@@ -94,6 +94,13 @@ config BR2_PACKAGE_MOSQUITTO_BROKER_BRIDGE
 	help
 	  Include bridge support for connecting to other brokers
 
+config BR2_PACKAGE_MOSQUITTO_BROKER_SYS
+	bool "$SYS tree support"
+	default y  # legacy
+	help
+	  Enable the $SYS/# tree structure, to export broker status as
+	  MQTT topics.
+
 config BR2_PACKAGE_MOSQUITTO_BROKER_PLUGIN_STATIC_PASSWD
 	bool "static password file plugin"
 	default y

index a8ea33fca5..cbb2db6281 100644
@@ -93,7 +93,8 @@ MOSQUITTO_CONF_OPTS += \
 	-DWITH_PLUGIN_PASSWORD_FILE=$(if $(BR2_PACKAGE_MOSQUITTO_BROKER_PLUGIN_STATIC_PASSWD),ON,OFF) \
 	-DWITH_PLUGIN_ACL_FILE=$(if $(BR2_PACKAGE_MOSQUITTO_BROKER_PLUGIN_STATIC_ACL),ON,OFF) \
 	-DWITH_PLUGIN_DYNAMIC_SECURITY=$(if $(BR2_PACKAGE_MOSQUITTO_BROKER_DYNAMIC_SECURITY_PLUGIN),ON,OFF) \
-	-DINC_BRIDGE_SUPPORT=$(if $(BR2_PACKAGE_MOSQUITTO_BROKER_BRIDGE),ON,OFF)
+	-DINC_BRIDGE_SUPPORT=$(if $(BR2_PACKAGE_MOSQUITTO_BROKER_BRIDGE),ON,OFF) \
+	-DWITH_SYS_TREE=$(if $(BR2_PACKAGE_MOSQUITTO_BROKER_SYS),ON,OFF)
 
 ifeq ($(BR2_PACKAGE_MOSQUITTO_BROKER_HTTP_API),y)
 MOSQUITTO_DEPENDENCIES += libmicrohttpd

index 1ffb60dc77..e603683508 100644
@@ -101,6 +101,13 @@ config BR2_PACKAGE_MOSQUITTO_BROKER_SYS
 	  Enable the $SYS/# tree structure, to export broker status as
 	  MQTT topics.
 
+config BR2_PACKAGE_MOSQUITTO_BROKER_CONTROL
+	bool "$CONTROL tree support"
+	default y  # legacy
+	help
+	  Enable the $CONTROL/# tree structure, to control the broker
+	  via messages posted to, or retrieved from, MQTT topics.
+
 config BR2_PACKAGE_MOSQUITTO_BROKER_PLUGIN_STATIC_PASSWD
 	bool "static password file plugin"
 	default y

index cbb2db6281..9147756449 100644
@@ -94,7 +94,8 @@ MOSQUITTO_CONF_OPTS += \
 	-DWITH_PLUGIN_ACL_FILE=$(if $(BR2_PACKAGE_MOSQUITTO_BROKER_PLUGIN_STATIC_ACL),ON,OFF) \
 	-DWITH_PLUGIN_DYNAMIC_SECURITY=$(if $(BR2_PACKAGE_MOSQUITTO_BROKER_DYNAMIC_SECURITY_PLUGIN),ON,OFF) \
 	-DINC_BRIDGE_SUPPORT=$(if $(BR2_PACKAGE_MOSQUITTO_BROKER_BRIDGE),ON,OFF) \
-	-DWITH_SYS_TREE=$(if $(BR2_PACKAGE_MOSQUITTO_BROKER_SYS),ON,OFF)
+	-DWITH_SYS_TREE=$(if $(BR2_PACKAGE_MOSQUITTO_BROKER_SYS),ON,OFF) \
+	-DWITH_CONTROL=$(if $(BR2_PACKAGE_MOSQUITTO_BROKER_CONTROL),ON,OFF)
 
 ifeq ($(BR2_PACKAGE_MOSQUITTO_BROKER_HTTP_API),y)
 MOSQUITTO_DEPENDENCIES += libmicrohttpd