diff --git a/CHANGELOG.md b/CHANGELOG.md index ef663df..e979176 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,11 @@ # Changelog +## 2.0.4 — 2026-10-14 + +- Update rustls to 0.23.46 and quinn-proto to 0.11.18 to address security advisories. +- Update log to 0.4.34, tokio to 1.53.2, and openaction to 2.8.0. +- Preserve existing action identifiers and saved-settings format. + ## 2.0.3 — 2026-09-21 - Updated rustls from 0.23.42 to 0.23.45 to fix RUSTSEC-2026-0285. diff --git a/Cargo.lock b/Cargo.lock index 75bdc84..4282a6c 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -618,7 +618,7 @@ dependencies = [ [[package]] name = "openhomeb" -version = "2.0.3" +version = "2.0.4" dependencies = [ "anyhow", "log", diff --git a/Cargo.toml b/Cargo.toml index 209cc70..81f4818 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "openhomeb" -version = "2.0.3" +version = "2.0.4" edition = "2024" authors = ["Infamous Pattern"] description = "A Linux-native OpenDeck plugin for discovering and controlling Homebridge accessories, including brightness." diff --git a/README.md b/README.md index 7164943..d9a2055 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ A Linux-native OpenDeck/OpenAction plugin for discovering and controlling accessories exposed by Homebridge Config UI. -**Current version: 2.0.3** +**Current version: 2.0.4** ![OpenHomeB overview](docs/screenshots/overview.png) @@ -17,7 +17,7 @@ A Linux-native OpenDeck/OpenAction plugin for discovering and controlling access -Version 2.0.3 updates rustls to 0.23.45 to fix RUSTSEC-2026-0285, with rustls-webpki updated to 0.103.15. +Version 2.0.4 updates rustls and quinn-proto to address security advisories, and includes maintenance updates to log, tokio, and openaction. Upgrading is recommended. Version 2.0.2 adds automatic startup and reconnect recovery so OpenHomeB refreshes itself when Fedora networking or Homebridge becomes available after OpenDeck starts. It also retains the complete 2.0 feature set: dedicated brightness controls, shared discovery caching, proactive authentication renewal, richer device metadata, compatibility parsing, and configurable button labels. diff --git a/RELEASE_NOTES_2.0.4.md b/RELEASE_NOTES_2.0.4.md new file mode 100644 index 0000000..926847a --- /dev/null +++ b/RELEASE_NOTES_2.0.4.md @@ -0,0 +1,22 @@ +# OpenHomeB 2.0.4 + +OpenHomeB 2.0.4 is a security and dependency maintenance release. Upgrading from earlier versions is recommended. + +## What changed + +- Updated rustls from 0.23.45 to 0.23.46 to address RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, and RUSTSEC-2026-0349. +- Updated quinn-proto from 0.11.16 to 0.11.18 to address RUSTSEC-2026-0338, RUSTSEC-2026-0340, and RUSTSEC-2026-0342 in the lockfile's optional QUIC dependency chain. +- Updated log to 0.4.34, tokio to 1.53.2, and openaction to 2.8.0. +- Includes x86_64 and aarch64 Linux binaries and the universal plugin package. + +## Installation + +Download `openhomeb-2.0.4-linux-universal.streamDeckPlugin` and install it through OpenDeck's Plugins screen. Restart OpenDeck after replacing the older build. + +This release does not change action identifiers or the project's saved-settings format. No action reassignment is required when upgrading from 2.0.3. + +## Validation + +Automated Rust, JavaScript, Python API/package, dependency-review, CodeQL, and security-audit checks are required before publication. Live OpenDeck/Homebridge interaction has not been retested for this maintenance release. + +The existing allowed warning for yanked `chacha20 0.10.1` remains in the optional QUIC dependency chain. diff --git a/VALIDATION.md b/VALIDATION.md index 5317bce..7f65779 100644 --- a/VALIDATION.md +++ b/VALIDATION.md @@ -1,3 +1,16 @@ +# Validation status — version 2.0.4 + +## Local checks — 14 October 2026 + +- Rust formatting, all 13 Rust tests, and Clippy with warnings denied passed with the locked dependency versions. +- Property-inspector JavaScript syntax and behavior checks and all 22 Python API/package tests passed. +- Version metadata, HTTP user agent, release helper, and contract expectations are aligned at 2.0.4. +- The merged dependency changes passed GitHub CI, CodeQL, dependency review, and Cargo audit. The release preparation PR is checked again before tagging. +- The existing allowed warning for yanked optional chacha20 0.10.1 remains. +- Live OpenDeck/Homebridge interaction was not retested. Release packages are built for x86_64 and aarch64 and inspected before public publication. + +## Previous release validation + # Validation status — version 2.0.3 ## Local checks — 21 September 2026 diff --git a/assets/manifest.json b/assets/manifest.json index e7c1e16..cdda7c9 100644 --- a/assets/manifest.json +++ b/assets/manifest.json @@ -2,7 +2,7 @@ "Name": "OpenHomeB", "Description": "OpenHomeB controls Homebridge accessories from OpenDeck on Linux with live state, brightness, caching, and token management.", "Author": "Infamous Pattern", - "Version": "2.0.3", + "Version": "2.0.4", "CodePaths": { "x86_64-unknown-linux-gnu": "x86_64-unknown-linux-gnu/bin/openhomeb", "aarch64-unknown-linux-gnu": "aarch64-unknown-linux-gnu/bin/openhomeb" diff --git a/scripts/prepare-release.sh b/scripts/prepare-release.sh index 0ffa01a..a36acab 100755 --- a/scripts/prepare-release.sh +++ b/scripts/prepare-release.sh @@ -2,7 +2,7 @@ set -euo pipefail ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" -VERSION="${1:-2.0.3}" +VERSION="${1:-2.0.4}" PLUGIN_ID="com.infamous-pattern.openhomeb" BINARY="openhomeb" ASSET_DIR="${ROOT_DIR}/release-assets" diff --git a/src/homebridge.rs b/src/homebridge.rs index ba9be6e..80ae501 100644 --- a/src/homebridge.rs +++ b/src/homebridge.rs @@ -85,7 +85,7 @@ impl HomebridgeClient { let client = Client::builder() .connect_timeout(Duration::from_secs(5)) .timeout(Duration::from_secs(20)) - .user_agent("OpenHomeB/2.0.3") + .user_agent("OpenHomeB/2.0.4") .build() .context("could not create the Homebridge HTTP client")?; diff --git a/test/test_package_contract.py b/test/test_package_contract.py index 7d5b4b9..a6496e9 100644 --- a/test/test_package_contract.py +++ b/test/test_package_contract.py @@ -24,7 +24,7 @@ def test_manifest_exposes_version_2_action_set_and_linux_targets(self): self.assertEqual(manifest["Name"], "OpenHomeB") self.assertEqual(manifest["Category"], "OpenHomeB") self.assertEqual(manifest["Author"], "Infamous Pattern") - self.assertEqual(manifest["Version"], "2.0.3") + self.assertEqual(manifest["Version"], "2.0.4") self.assertEqual(manifest["OS"], [{"Platform": "linux"}]) self.assertIn("x86_64-unknown-linux-gnu", manifest["CodePaths"]) self.assertIn("aarch64-unknown-linux-gnu", manifest["CodePaths"]) @@ -183,16 +183,16 @@ def test_characteristics_use_uuid_first_with_type_fallback(self): self.assertIn("function characteristicKey", inspector) self.assertIn("characteristicUuid", inspector) - def test_version_2_0_3_is_consistent_across_release_metadata(self): + def test_version_2_0_4_is_consistent_across_release_metadata(self): cargo = (ROOT / "Cargo.toml").read_text() manifest = json.loads((ROOT / "assets" / "manifest.json").read_text()) homebridge = (ROOT / "src" / "homebridge.rs").read_text() release_workflow = (ROOT / ".github" / "workflows" / "release.yml").read_text() - self.assertIn('version = "2.0.3"', cargo) - self.assertEqual(manifest["Version"], "2.0.3") - self.assertIn('OpenHomeB/2.0.3', homebridge) - self.assertTrue((ROOT / "RELEASE_NOTES_2.0.3.md").is_file()) + self.assertIn('version = "2.0.4"', cargo) + self.assertEqual(manifest["Version"], "2.0.4") + self.assertIn('OpenHomeB/2.0.4', homebridge) + self.assertTrue((ROOT / "RELEASE_NOTES_2.0.4.md").is_file()) self.assertNotIn("RELEASE_NOTES_2.0.0.md", release_workflow) self.assertIn('RELEASE_NOTES_${version}.md', release_workflow)