Release OpenHomeB 2.0.4

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 2.0.4 — 2026-10-14
+
+- Update rustls to 0.23.46 and quinn-proto to 0.11.18 to address security advisories.
+- Update log to 0.4.34, tokio to 1.53.2, and openaction to 2.8.0.
+- Preserve existing action identifiers and saved-settings format.
+
 ## 2.0.3 — 2026-09-21
 
 - Updated rustls from 0.23.42 to 0.23.45 to fix RUSTSEC-2026-0285.

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "openhomeb"
-version = "2.0.3"
+version = "2.0.4"
 edition = "2024"
 authors = ["Infamous Pattern"]
 description = "A Linux-native OpenDeck plugin for discovering and controlling Homebridge accessories, including brightness."

README.md

@@ -2,7 +2,7 @@
 
 A Linux-native OpenDeck/OpenAction plugin for discovering and controlling accessories exposed by Homebridge Config UI.
 
-**Current version: 2.0.3**
+**Current version: 2.0.4**
 
 ![OpenHomeB overview](docs/screenshots/overview.png)
 
@@ -17,7 +17,7 @@ A Linux-native OpenDeck/OpenAction plugin for discovering and controlling access
 
 </details>
 
-Version 2.0.3 updates rustls to 0.23.45 to fix RUSTSEC-2026-0285, with rustls-webpki updated to 0.103.15.
+Version 2.0.4 updates rustls and quinn-proto to address security advisories, and includes maintenance updates to log, tokio, and openaction. Upgrading is recommended.
 
 Version 2.0.2 adds automatic startup and reconnect recovery so OpenHomeB refreshes itself when Fedora networking or Homebridge becomes available after OpenDeck starts. It also retains the complete 2.0 feature set: dedicated brightness controls, shared discovery caching, proactive authentication renewal, richer device metadata, compatibility parsing, and configurable button labels.
 

RELEASE_NOTES_2.0.4.md

@@ -0,0 +1,22 @@
+# OpenHomeB 2.0.4
+
+OpenHomeB 2.0.4 is a security and dependency maintenance release. Upgrading from earlier versions is recommended.
+
+## What changed
+
+- Updated rustls from 0.23.45 to 0.23.46 to address RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, and RUSTSEC-2026-0349.
+- Updated quinn-proto from 0.11.16 to 0.11.18 to address RUSTSEC-2026-0338, RUSTSEC-2026-0340, and RUSTSEC-2026-0342 in the lockfile's optional QUIC dependency chain.
+- Updated log to 0.4.34, tokio to 1.53.2, and openaction to 2.8.0.
+- Includes x86_64 and aarch64 Linux binaries and the universal plugin package.
+
+## Installation
+
+Download `openhomeb-2.0.4-linux-universal.streamDeckPlugin` and install it through OpenDeck's Plugins screen. Restart OpenDeck after replacing the older build.
+
+This release does not change action identifiers or the project's saved-settings format. No action reassignment is required when upgrading from 2.0.3.
+
+## Validation
+
+Automated Rust, JavaScript, Python API/package, dependency-review, CodeQL, and security-audit checks are required before publication. Live OpenDeck/Homebridge interaction has not been retested for this maintenance release.
+
+The existing allowed warning for yanked `chacha20 0.10.1` remains in the optional QUIC dependency chain.

VALIDATION.md

@@ -1,3 +1,16 @@
+# Validation status — version 2.0.4
+
+## Local checks — 14 October 2026
+
+- Rust formatting, all 13 Rust tests, and Clippy with warnings denied passed with the locked dependency versions.
+- Property-inspector JavaScript syntax and behavior checks and all 22 Python API/package tests passed.
+- Version metadata, HTTP user agent, release helper, and contract expectations are aligned at 2.0.4.
+- The merged dependency changes passed GitHub CI, CodeQL, dependency review, and Cargo audit. The release preparation PR is checked again before tagging.
+- The existing allowed warning for yanked optional chacha20 0.10.1 remains.
+- Live OpenDeck/Homebridge interaction was not retested. Release packages are built for x86_64 and aarch64 and inspected before public publication.
+
+## Previous release validation
+
 # Validation status — version 2.0.3
 
 ## Local checks — 21 September 2026

assets/manifest.json

@@ -2,7 +2,7 @@
   "Name": "OpenHomeB",
   "Description": "OpenHomeB controls Homebridge accessories from OpenDeck on Linux with live state, brightness, caching, and token management.",
   "Author": "Infamous Pattern",
-  "Version": "2.0.3",
+  "Version": "2.0.4",
   "CodePaths": {
     "x86_64-unknown-linux-gnu": "x86_64-unknown-linux-gnu/bin/openhomeb",
     "aarch64-unknown-linux-gnu": "aarch64-unknown-linux-gnu/bin/openhomeb"

scripts/prepare-release.sh

@@ -2,7 +2,7 @@
 set -euo pipefail
 
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-VERSION="${1:-2.0.3}"
+VERSION="${1:-2.0.4}"
 PLUGIN_ID="com.infamous-pattern.openhomeb"
 BINARY="openhomeb"
 ASSET_DIR="${ROOT_DIR}/release-assets"

src/homebridge.rs

@@ -85,7 +85,7 @@ impl HomebridgeClient {
         let client = Client::builder()
             .connect_timeout(Duration::from_secs(5))
             .timeout(Duration::from_secs(20))
-            .user_agent("OpenHomeB/2.0.3")
+            .user_agent("OpenHomeB/2.0.4")
             .build()
             .context("could not create the Homebridge HTTP client")?;
 

test/test_package_contract.py

@@ -24,7 +24,7 @@ def test_manifest_exposes_version_2_action_set_and_linux_targets(self):
         self.assertEqual(manifest["Name"], "OpenHomeB")
         self.assertEqual(manifest["Category"], "OpenHomeB")
         self.assertEqual(manifest["Author"], "Infamous Pattern")
-        self.assertEqual(manifest["Version"], "2.0.3")
+        self.assertEqual(manifest["Version"], "2.0.4")
         self.assertEqual(manifest["OS"], [{"Platform": "linux"}])
         self.assertIn("x86_64-unknown-linux-gnu", manifest["CodePaths"])
         self.assertIn("aarch64-unknown-linux-gnu", manifest["CodePaths"])
@@ -183,16 +183,16 @@ def test_characteristics_use_uuid_first_with_type_fallback(self):
         self.assertIn("function characteristicKey", inspector)
         self.assertIn("characteristicUuid", inspector)
 
-    def test_version_2_0_3_is_consistent_across_release_metadata(self):
+    def test_version_2_0_4_is_consistent_across_release_metadata(self):
         cargo = (ROOT / "Cargo.toml").read_text()
         manifest = json.loads((ROOT / "assets" / "manifest.json").read_text())
         homebridge = (ROOT / "src" / "homebridge.rs").read_text()
         release_workflow = (ROOT / ".github" / "workflows" / "release.yml").read_text()
 
-        self.assertIn('version = "2.0.3"', cargo)
-        self.assertEqual(manifest["Version"], "2.0.3")
-        self.assertIn('OpenHomeB/2.0.3', homebridge)
-        self.assertTrue((ROOT / "RELEASE_NOTES_2.0.3.md").is_file())
+        self.assertIn('version = "2.0.4"', cargo)
+        self.assertEqual(manifest["Version"], "2.0.4")
+        self.assertIn('OpenHomeB/2.0.4', homebridge)
+        self.assertTrue((ROOT / "RELEASE_NOTES_2.0.4.md").is_file())
         self.assertNotIn("RELEASE_NOTES_2.0.0.md", release_workflow)
         self.assertIn('RELEASE_NOTES_${version}.md', release_workflow)