Release OpenHomeB 2.0.3 security update

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 2.0.3 — 2026-09-21
+
+- Updated rustls from 0.23.42 to 0.23.45 to fix RUSTSEC-2026-0285.
+- Updated rustls-webpki from 0.103.13 to 0.103.15 to satisfy the patched rustls dependency.
+- Rebuilt Linux plugin packages with the patched dependencies.
+
 ## 2.0.2 — 2026-08-12
 
 - Added automatic startup connection recovery after Fedora login.

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "openhomeb"
-version = "2.0.2"
+version = "2.0.3"
 edition = "2024"
 authors = ["Infamous Pattern"]
 description = "A Linux-native OpenDeck plugin for discovering and controlling Homebridge accessories, including brightness."

README.md

@@ -2,7 +2,7 @@
 
 A Linux-native OpenDeck/OpenAction plugin for discovering and controlling accessories exposed by Homebridge Config UI.
 
-**Current version: 2.0.2**
+**Current version: 2.0.3**
 
 ![OpenHomeB overview](docs/screenshots/overview.png)
 
@@ -17,6 +17,8 @@ A Linux-native OpenDeck/OpenAction plugin for discovering and controlling access
 
 </details>
 
+Version 2.0.3 updates rustls to 0.23.45 to fix RUSTSEC-2026-0285, with rustls-webpki updated to 0.103.15.
+
 Version 2.0.2 adds automatic startup and reconnect recovery so OpenHomeB refreshes itself when Fedora networking or Homebridge becomes available after OpenDeck starts. It also retains the complete 2.0 feature set: dedicated brightness controls, shared discovery caching, proactive authentication renewal, richer device metadata, compatibility parsing, and configurable button labels.
 
 ## Highlights

RELEASE_NOTES_2.0.3.md

@@ -0,0 +1,19 @@
+# OpenHomeB 2.0.3
+
+OpenHomeB 2.0.3 is a security maintenance release.
+
+## What changed
+
+- Updated rustls from 0.23.42 to 0.23.45 to fix [RUSTSEC-2026-0285](https://rustsec.org/advisories/RUSTSEC-2026-0285.html), concerning TLS 1.3 handshake encryption-level validation.
+- Updated rustls-webpki from 0.103.13 to 0.103.15 as required by the patched rustls dependency.
+- Rebuilt x86_64 and aarch64 Linux binaries and the universal plugin package with the fix.
+
+## Installation
+
+Download `openhomeb-2.0.3-linux-universal.streamDeckPlugin` from this release and install it through OpenDeck's Plugins screen. Restart OpenDeck after replacing the older build.
+
+Action identifiers and saved-settings formats are unchanged from 2.0.2.
+
+## Audit note
+
+The dependency audit reports no vulnerabilities. It retains an allowed warning for yanked `chacha20 0.10.1`, which belongs to an optional QUIC dependency chain that is inactive with this project's enabled features.

VALIDATION.md

@@ -1,3 +1,19 @@
+# Validation status — version 2.0.3
+
+## Local checks — 21 September 2026
+
+- Cargo audit passed with no vulnerabilities; one allowed warning remains for inactive optional `chacha20 0.10.1`.
+- Rust formatting passed (`cargo fmt --all -- --check`).
+- All 13 Rust tests passed (`cargo test --all-targets --locked`).
+- Clippy passed with warnings denied (`cargo clippy --all-targets --locked -- -D warnings`).
+- Property-inspector JavaScript syntax and behaviour checks passed.
+- All 22 Python API and package-contract tests passed. Python emitted HTTPError cleanup ResourceWarnings; no tests failed.
+- Package version, manifest version, HTTP user agent, release helper, and package-contract expectations are aligned at 2.0.3.
+
+The tagged release workflow validates the source again, builds both x86_64 and aarch64 Linux binaries, and publishes the universal plugin package, source archives, release notes, and checksums. Live OpenDeck/Homebridge interaction was not retested for this dependency maintenance release.
+
+## Historical validation
+
 # Validation status — version 2.0.2
 
 Validated in the artifact-generation environment on 12 August 2026.

assets/manifest.json

@@ -2,7 +2,7 @@
   "Name": "OpenHomeB",
   "Description": "OpenHomeB controls Homebridge accessories from OpenDeck on Linux with live state, brightness, caching, and token management.",
   "Author": "Infamous Pattern",
-  "Version": "2.0.2",
+  "Version": "2.0.3",
   "CodePaths": {
     "x86_64-unknown-linux-gnu": "x86_64-unknown-linux-gnu/bin/openhomeb",
     "aarch64-unknown-linux-gnu": "aarch64-unknown-linux-gnu/bin/openhomeb"

scripts/prepare-release.sh

@@ -2,7 +2,7 @@
 set -euo pipefail
 
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-VERSION="${1:-2.0.2}"
+VERSION="${1:-2.0.3}"
 PLUGIN_ID="com.infamous-pattern.openhomeb"
 BINARY="openhomeb"
 ASSET_DIR="${ROOT_DIR}/release-assets"

src/homebridge.rs

@@ -85,7 +85,7 @@ impl HomebridgeClient {
         let client = Client::builder()
             .connect_timeout(Duration::from_secs(5))
             .timeout(Duration::from_secs(20))
-            .user_agent("OpenHomeB/2.0.2")
+            .user_agent("OpenHomeB/2.0.3")
             .build()
             .context("could not create the Homebridge HTTP client")?;
 

test/test_package_contract.py

@@ -24,7 +24,7 @@ def test_manifest_exposes_version_2_action_set_and_linux_targets(self):
         self.assertEqual(manifest["Name"], "OpenHomeB")
         self.assertEqual(manifest["Category"], "OpenHomeB")
         self.assertEqual(manifest["Author"], "Infamous Pattern")
-        self.assertEqual(manifest["Version"], "2.0.2")
+        self.assertEqual(manifest["Version"], "2.0.3")
         self.assertEqual(manifest["OS"], [{"Platform": "linux"}])
         self.assertIn("x86_64-unknown-linux-gnu", manifest["CodePaths"])
         self.assertIn("aarch64-unknown-linux-gnu", manifest["CodePaths"])
@@ -183,16 +183,16 @@ def test_characteristics_use_uuid_first_with_type_fallback(self):
         self.assertIn("function characteristicKey", inspector)
         self.assertIn("characteristicUuid", inspector)
 
-    def test_version_2_0_2_is_consistent_across_release_metadata(self):
+    def test_version_2_0_3_is_consistent_across_release_metadata(self):
         cargo = (ROOT / "Cargo.toml").read_text()
         manifest = json.loads((ROOT / "assets" / "manifest.json").read_text())
         homebridge = (ROOT / "src" / "homebridge.rs").read_text()
         release_workflow = (ROOT / ".github" / "workflows" / "release.yml").read_text()
 
-        self.assertIn('version = "2.0.2"', cargo)
-        self.assertEqual(manifest["Version"], "2.0.2")
-        self.assertIn('OpenHomeB/2.0.2', homebridge)
-        self.assertTrue((ROOT / "RELEASE_NOTES_2.0.2.md").is_file())
+        self.assertIn('version = "2.0.3"', cargo)
+        self.assertEqual(manifest["Version"], "2.0.3")
+        self.assertIn('OpenHomeB/2.0.3', homebridge)
+        self.assertTrue((ROOT / "RELEASE_NOTES_2.0.3.md").is_file())
         self.assertNotIn("RELEASE_NOTES_2.0.0.md", release_workflow)
         self.assertIn('RELEASE_NOTES_${version}.md', release_workflow)