Skip to content

v2.0.0-beta#3816

Draft
bwp91 wants to merge 7 commits intolatestfrom
beta-2.0.0
Draft

v2.0.0-beta#3816
bwp91 wants to merge 7 commits intolatestfrom
beta-2.0.0

Conversation

@bwp91
Copy link
Contributor

@bwp91 bwp91 commented Jun 8, 2025 •
edited
Loading

Related PRs:

⚠️ Breaking Changes

  • For Users:

    • Before upgrading, you will want to ensure that the plugin(s) you are using are compatible with this new version of Homebridge. If you are unsure, see the link below or open an issue with the developer of your plugin(s) in question.

  • For Plugin Developers:

    • The new version of Homebridge includes a major version update to HAP-Nodejs. Some old deprecated functions have been removed. See the link below for a list of changes that you may need to make to your plugin(s).

  • Please visit the following link to learn more about the changes and how to prepare:

Added

  • set debug -D setting per child bridge

Changed

  • Address legacy deprecation cleanup (Address legacy deprecation cleanup #3648) (@hjdhjd)
  • general code modernisation:
    • move from commonjs to esm modules
    • use lint rules from @antfu/eslint-config
    • migrate from jest to vitest for testing
    • ⚠️ drop support for node v18

Removed

  • remove deprecated --remove-orphans flag

Homebridge Dependencies

  • hap-nodejs @ v2.0.0-beta

@github-actions github-actions bot added the latest label Jun 8, 2025
@coveralls
Copy link

coveralls commented Jun 8, 2025 •
edited
Loading

Pull Request Test Coverage Report for Build 18886117013

Details

  • 1955 of 3274 (59.71%) changed or added relevant lines in 44 files are covered.
  • 11 unchanged lines in 7 files lost coverage.
  • Overall coverage increased (+30.4%) to 57.837%
Changes Missing Coverage Covered Lines Changed/Added Lines %
src/matter/accessoryCache.ts 74 75 98.67%
src/matter/behaviors/BehaviorRegistry.ts 49 50 98.0%
src/user.ts 8 9 88.89%
src/ipcService.ts 9 12 75.0%
src/matter/behaviors/ServiceAreaBehavior.ts 4 7 57.14%
src/platformAccessory.ts 26 29 89.66%
src/matter/storage.ts 164 168 97.62%
src/matter/types.ts 31 37 83.78%
src/matter/behaviors/FanControlBehavior.ts 1 10 10.0%
src/storageService.ts 3 12 25.0%
Files with Coverage Reduction New Missed Lines %
src/bridgeService.ts 1 20.35%
src/childBridgeService.ts 1 8.1%
src/cli.ts 1 0.0%
src/ipcService.ts 1 75.0%
src/plugin.ts 1 0.91%
src/childBridgeFork.ts 3 0.0%
src/server.ts 3 36.75%
Totals Coverage Status
Change from base Build 17336010532: 30.4%
Covered Lines: 2024
Relevant Lines: 3545
💛 - Coveralls

This was referenced Jun 8, 2025
Merged
Merged
Closed
@bwp91 bwp91 force-pushed the beta-2.0.0 branch 3 times, most recently from 2ce3152 to 89f4a67 Compare October 26, 2025 12:14
github-advanced-security[bot]
github-advanced-security bot found potential problems Oct 26, 2025
View reviewed changes
@bwp91 bwp91 force-pushed the beta-2.0.0 branch 3 times, most recently from ec771cb to 7d444d1 Compare October 27, 2025 18:19
github-advanced-security[bot]
github-advanced-security bot found potential problems Oct 27, 2025
View reviewed changes
@bwp91 bwp91 force-pushed the beta-2.0.0 branch 8 times, most recently from 0210cb1 to e3ccb10 Compare November 4, 2025 02:08
@bwp91 bwp91 force-pushed the beta-2.0.0 branch 7 times, most recently from e3d4525 to ffeaf8b Compare November 7, 2025 01:01
@bwp91 bwp91 force-pushed the beta-2.0.0 branch 6 times, most recently from e11e24f to d6ded5e Compare December 5, 2025 22:17
github-advanced-security[bot]
github-advanced-security bot found potential problems Dec 21, 2025
View reviewed changes
@bwp91 bwp91 force-pushed the beta-2.0.0 branch 3 times, most recently from d4ff2de to 87717a3 Compare December 21, 2025 14:39
@bwp91 bwp91 force-pushed the beta-2.0.0 branch 2 times, most recently from 2e38c3f to a40e62f Compare February 14, 2026 14:11
@bwp91 bwp91 force-pushed the beta-2.0.0 branch 2 times, most recently from 8acfc86 to 9400017 Compare February 23, 2026 07:02
github-advanced-security[bot]
github-advanced-security bot found potential problems Feb 23, 2026
View reviewed changes
@bwp91 bwp91 force-pushed the beta-2.0.0 branch 2 times, most recently from aa0fea6 to 934fd1c Compare February 28, 2026 20:23
github-advanced-security[bot]
github-advanced-security bot found potential problems Mar 14, 2026
View reviewed changes
src/util/mac.ts
sha1sum.update(data);
const s = sha1sum.digest("hex");
const sha1sum = createHash('sha1')
sha1sum.update(data)

Check failure

Code scanning / CodeQL

Use of a broken or weak cryptographic algorithm High

A broken or weak cryptographic algorithm
Loading
depends on
sensitive data from an access to UUID
Loading
.
A broken or weak cryptographic algorithm
Loading
depends on
sensitive data from an access to uuid
Loading
.
A broken or weak cryptographic algorithm
Loading
depends on
sensitive data from an access to uuid
Loading
.
A broken or weak cryptographic algorithm
Loading
depends on
sensitive data from an access to uuid
Loading
.
A broken or weak cryptographic algorithm
Loading
depends on
sensitive data from an access to uuid
Loading
.
A broken or weak cryptographic algorithm
Loading
depends on
sensitive data from an access to uuid
Loading
.
A broken or weak cryptographic algorithm
Loading
depends on
sensitive data from an access to UUID
Loading
.
A broken or weak cryptographic algorithm
Loading
depends on
sensitive data from an access to uuid1
Loading
.
A broken or weak cryptographic algorithm
Loading
depends on
sensitive data from an access to uuid2
Loading
.
A broken or weak cryptographic algorithm
Loading
depends on
sensitive data from an access to UUID
Loading
.
A broken or weak cryptographic algorithm
Loading
depends on
sensitive data from an access to uuid
Loading
.

Copilot Autofix

AI 4 days ago

General approach: Replace the use of SHA‑1 with a modern, secure hash such as SHA‑256 (or SHA‑512) in the generate function in src/util/mac.ts. Since the function only uses the hex digest as a source of characters to fill a MAC template, changing the hash algorithm will not alter the external format, just the deterministic mapping from input data to MAC‑like address.

Best concrete fix without changing functionality:
In src/util/mac.ts, change createHash('sha1') to createHash('sha256'). No other code changes are required because:

  • createHash('sha256') is supported by Node’s built‑in crypto module already imported as createHash.
  • The hex digest from SHA‑256 is longer than SHA‑1, but generate only uses as many characters as needed to fill 'xx:xx:xx:xx:xx:xx' (12 hex characters), so behavior remains consistent: a deterministic, uppercase MAC‑formatted string derived from the input.

File/line details:

  • File: src/util/mac.ts
    • Around line 17: update const sha1sum = createHash('sha1') to use SHA‑256 instead.
    • Variable names can remain the same or be updated; to minimize change, we can keep the variable name even though it now holds a SHA‑256 hash object. This has no functional impact.

No new methods or imports are required; we continue to use Node’s crypto module.

Suggested changeset 1
src/util/mac.ts

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/src/util/mac.ts b/src/util/mac.ts
--- a/src/util/mac.ts
+++ b/src/util/mac.ts
@@ -14,9 +14,9 @@
 }
 
 export function generate(data: string | Buffer | NodeJS.TypedArray | DataView): MacAddress {
-  const sha1sum = createHash('sha1')
-  sha1sum.update(data)
-  const s = sha1sum.digest('hex')
+  const hash = createHash('sha256')
+  hash.update(data)
+  const s = hash.digest('hex')
 
   let i = 0
   return 'xx:xx:xx:xx:xx:xx'.replace(PLACEHOLDER_RE, () => s[i++]).toUpperCase()
EOF
@@ -14,9 +14,9 @@
}

export function generate(data: string | Buffer | NodeJS.TypedArray | DataView): MacAddress {
const sha1sum = createHash('sha1')
sha1sum.update(data)
const s = sha1sum.digest('hex')
const hash = createHash('sha256')
hash.update(data)
const s = hash.digest('hex')

let i = 0
return 'xx:xx:xx:xx:xx:xx'.replace(PLACEHOLDER_RE, () => s[i++]).toUpperCase()
Copilot is powered by AI and may make mistakes. Always verify output.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

latest

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@bwp91 @coveralls @hjdhjd