From 4058bb18fd0350c3f30196a5993194dea7d6075a Mon Sep 17 00:00:00 2001 From: James Senecal Date: Mon, 21 Sep 2026 15:13:24 -0400 Subject: [PATCH] release: prepare OpenHomeB 2.0.3 security update --- CHANGELOG.md | 6 ++++++ Cargo.lock | 2 +- Cargo.toml | 2 +- README.md | 4 +++- RELEASE_NOTES_2.0.3.md | 19 +++++++++++++++++++ VALIDATION.md | 16 ++++++++++++++++ assets/manifest.json | 2 +- scripts/prepare-release.sh | 2 +- src/homebridge.rs | 2 +- test/test_package_contract.py | 12 ++++++------ 10 files changed, 55 insertions(+), 12 deletions(-) create mode 100644 RELEASE_NOTES_2.0.3.md diff --git a/CHANGELOG.md b/CHANGELOG.md index a09b216..ef663df 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,11 @@ # Changelog +## 2.0.3 — 2026-09-21 + +- Updated rustls from 0.23.42 to 0.23.45 to fix RUSTSEC-2026-0285. +- Updated rustls-webpki from 0.103.13 to 0.103.15 to satisfy the patched rustls dependency. +- Rebuilt Linux plugin packages with the patched dependencies. + ## 2.0.2 — 2026-08-12 - Added automatic startup connection recovery after Fedora login. diff --git a/Cargo.lock b/Cargo.lock index c4819de..2237fc7 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -618,7 +618,7 @@ dependencies = [ [[package]] name = "openhomeb" -version = "2.0.2" +version = "2.0.3" dependencies = [ "anyhow", "log", diff --git a/Cargo.toml b/Cargo.toml index adc94a0..209cc70 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "openhomeb" -version = "2.0.2" +version = "2.0.3" edition = "2024" authors = ["Infamous Pattern"] description = "A Linux-native OpenDeck plugin for discovering and controlling Homebridge accessories, including brightness." diff --git a/README.md b/README.md index 4801786..7164943 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ A Linux-native OpenDeck/OpenAction plugin for discovering and controlling accessories exposed by Homebridge Config UI. -**Current version: 2.0.2** +**Current version: 2.0.3** ![OpenHomeB overview](docs/screenshots/overview.png) @@ -17,6 +17,8 @@ A Linux-native OpenDeck/OpenAction plugin for discovering and controlling access +Version 2.0.3 updates rustls to 0.23.45 to fix RUSTSEC-2026-0285, with rustls-webpki updated to 0.103.15. + Version 2.0.2 adds automatic startup and reconnect recovery so OpenHomeB refreshes itself when Fedora networking or Homebridge becomes available after OpenDeck starts. It also retains the complete 2.0 feature set: dedicated brightness controls, shared discovery caching, proactive authentication renewal, richer device metadata, compatibility parsing, and configurable button labels. ## Highlights diff --git a/RELEASE_NOTES_2.0.3.md b/RELEASE_NOTES_2.0.3.md new file mode 100644 index 0000000..1900dc2 --- /dev/null +++ b/RELEASE_NOTES_2.0.3.md @@ -0,0 +1,19 @@ +# OpenHomeB 2.0.3 + +OpenHomeB 2.0.3 is a security maintenance release. + +## What changed + +- Updated rustls from 0.23.42 to 0.23.45 to fix [RUSTSEC-2026-0285](https://rustsec.org/advisories/RUSTSEC-2026-0285.html), concerning TLS 1.3 handshake encryption-level validation. +- Updated rustls-webpki from 0.103.13 to 0.103.15 as required by the patched rustls dependency. +- Rebuilt x86_64 and aarch64 Linux binaries and the universal plugin package with the fix. + +## Installation + +Download `openhomeb-2.0.3-linux-universal.streamDeckPlugin` from this release and install it through OpenDeck's Plugins screen. Restart OpenDeck after replacing the older build. + +Action identifiers and saved-settings formats are unchanged from 2.0.2. + +## Audit note + +The dependency audit reports no vulnerabilities. It retains an allowed warning for yanked `chacha20 0.10.1`, which belongs to an optional QUIC dependency chain that is inactive with this project's enabled features. diff --git a/VALIDATION.md b/VALIDATION.md index b959bdd..5317bce 100644 --- a/VALIDATION.md +++ b/VALIDATION.md @@ -1,3 +1,19 @@ +# Validation status — version 2.0.3 + +## Local checks — 21 September 2026 + +- Cargo audit passed with no vulnerabilities; one allowed warning remains for inactive optional `chacha20 0.10.1`. +- Rust formatting passed (`cargo fmt --all -- --check`). +- All 13 Rust tests passed (`cargo test --all-targets --locked`). +- Clippy passed with warnings denied (`cargo clippy --all-targets --locked -- -D warnings`). +- Property-inspector JavaScript syntax and behaviour checks passed. +- All 22 Python API and package-contract tests passed. Python emitted HTTPError cleanup ResourceWarnings; no tests failed. +- Package version, manifest version, HTTP user agent, release helper, and package-contract expectations are aligned at 2.0.3. + +The tagged release workflow validates the source again, builds both x86_64 and aarch64 Linux binaries, and publishes the universal plugin package, source archives, release notes, and checksums. Live OpenDeck/Homebridge interaction was not retested for this dependency maintenance release. + +## Historical validation + # Validation status — version 2.0.2 Validated in the artifact-generation environment on 12 August 2026. diff --git a/assets/manifest.json b/assets/manifest.json index 02374fe..e7c1e16 100644 --- a/assets/manifest.json +++ b/assets/manifest.json @@ -2,7 +2,7 @@ "Name": "OpenHomeB", "Description": "OpenHomeB controls Homebridge accessories from OpenDeck on Linux with live state, brightness, caching, and token management.", "Author": "Infamous Pattern", - "Version": "2.0.2", + "Version": "2.0.3", "CodePaths": { "x86_64-unknown-linux-gnu": "x86_64-unknown-linux-gnu/bin/openhomeb", "aarch64-unknown-linux-gnu": "aarch64-unknown-linux-gnu/bin/openhomeb" diff --git a/scripts/prepare-release.sh b/scripts/prepare-release.sh index ec1a8ff..0ffa01a 100755 --- a/scripts/prepare-release.sh +++ b/scripts/prepare-release.sh @@ -2,7 +2,7 @@ set -euo pipefail ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" -VERSION="${1:-2.0.2}" +VERSION="${1:-2.0.3}" PLUGIN_ID="com.infamous-pattern.openhomeb" BINARY="openhomeb" ASSET_DIR="${ROOT_DIR}/release-assets" diff --git a/src/homebridge.rs b/src/homebridge.rs index 7354496..ba9be6e 100644 --- a/src/homebridge.rs +++ b/src/homebridge.rs @@ -85,7 +85,7 @@ impl HomebridgeClient { let client = Client::builder() .connect_timeout(Duration::from_secs(5)) .timeout(Duration::from_secs(20)) - .user_agent("OpenHomeB/2.0.2") + .user_agent("OpenHomeB/2.0.3") .build() .context("could not create the Homebridge HTTP client")?; diff --git a/test/test_package_contract.py b/test/test_package_contract.py index f915ffa..7d5b4b9 100644 --- a/test/test_package_contract.py +++ b/test/test_package_contract.py @@ -24,7 +24,7 @@ def test_manifest_exposes_version_2_action_set_and_linux_targets(self): self.assertEqual(manifest["Name"], "OpenHomeB") self.assertEqual(manifest["Category"], "OpenHomeB") self.assertEqual(manifest["Author"], "Infamous Pattern") - self.assertEqual(manifest["Version"], "2.0.2") + self.assertEqual(manifest["Version"], "2.0.3") self.assertEqual(manifest["OS"], [{"Platform": "linux"}]) self.assertIn("x86_64-unknown-linux-gnu", manifest["CodePaths"]) self.assertIn("aarch64-unknown-linux-gnu", manifest["CodePaths"]) @@ -183,16 +183,16 @@ def test_characteristics_use_uuid_first_with_type_fallback(self): self.assertIn("function characteristicKey", inspector) self.assertIn("characteristicUuid", inspector) - def test_version_2_0_2_is_consistent_across_release_metadata(self): + def test_version_2_0_3_is_consistent_across_release_metadata(self): cargo = (ROOT / "Cargo.toml").read_text() manifest = json.loads((ROOT / "assets" / "manifest.json").read_text()) homebridge = (ROOT / "src" / "homebridge.rs").read_text() release_workflow = (ROOT / ".github" / "workflows" / "release.yml").read_text() - self.assertIn('version = "2.0.2"', cargo) - self.assertEqual(manifest["Version"], "2.0.2") - self.assertIn('OpenHomeB/2.0.2', homebridge) - self.assertTrue((ROOT / "RELEASE_NOTES_2.0.2.md").is_file()) + self.assertIn('version = "2.0.3"', cargo) + self.assertEqual(manifest["Version"], "2.0.3") + self.assertIn('OpenHomeB/2.0.3', homebridge) + self.assertTrue((ROOT / "RELEASE_NOTES_2.0.3.md").is_file()) self.assertNotIn("RELEASE_NOTES_2.0.0.md", release_workflow) self.assertIn('RELEASE_NOTES_${version}.md', release_workflow)