Repository navigation
Home 2.2.1: security updates, ARP alert detail, monthly Dependabot - #110
Merged
Merged
Conversation
The alert detail sheet only special-cased port risk. Every other type fell through to the decoy SOURCE and INTRUSION cards, which read keys that ARP conflict, review reminder and anomaly alerts never store, so those sheets rendered empty cards. App: AlertDetailPresentation routes each alert type to the cards that read its stored shape and drops any card with no rows. ARP conflicts get a section with one plain-language entry per conflict, its IPs and MACs, the known device behind each address, the stored risk and fix, and the resolved state. Sensor: record_arp_conflicts attaches known_devices (matched by IP or MAC) to each stored conflict and keeps the last conflicts on auto-resolve. Event emission is unchanged: a device-only change is written silently, so a rename cannot re-page Slack or push. New and updated events carry an address-only summary for outbound channels.
The Known Gotchas section existed only in a local checkout, so agents working from a fresh clone never saw it. Commit it as written, with the example MAC replaced by a documentation-range value of the same unpadded shape. Add a Public Disclosure Rule: no real machine names, hostnames, addresses, usernames, or other test-environment details in commits, committed files, pull requests, issues, release notes, or tags.
Fifteen operator-facing mentions said only "Studio". The quoted sensor log message and LM Studio references are unchanged.
Weekly version updates opened up to three pull requests a week, and each one reran full CI on every other open pull request because main requires branches to be up to date. Move all three ecosystems to monthly. Vulnerability fixes no longer depend on this schedule: Dependabot security updates, grouped per ecosystem, are now enabled in repository settings. The supply-chain test parses the config and pins the monthly schedule for each ecosystem.
Enabling security updates opened one pull request per package even with the repository's grouped setting on. Declare a security-updates group next to each version-updates group so an advisory batch arrives as one pull request per ecosystem. The supply-chain test pins both groups.
certifi 2026.10.23 drops the emSign roots whose intermediate keys were compromised (GHSA-6q48-6c7w-9gw2, critical). httpx trusts certifi's bundle, so the sensor's AI endpoint clients were affected. multidict 6.9.1 fixes a reference leak in items-view union and subtraction (GHSA-54p9-h82j-f925, medium). Stay on the 6.x line rather than the 7.x major that an unconstrained upgrade selects.
Home 2.2.0 was tagged but not published: a critical certifi advisory arrived while its release waited for approval. 2.2.1 carries everything 2.2.0 contained plus the certifi and multidict security updates, the ARP identity conflict alert detail, and monthly Dependabot version updates. Bump the app, sensor, and installer versions, move the release notes to 2.2.1 with the new changes, and document ARP identity conflict alerts in the user guide under the name the app shows.
# Conflicts: # sensor/uv.lock
chrissyrocket
approved these changes
Nov 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prepares Home 2.2.1. Home 2.2.0 was tagged at
75ff60dbut never published: its release run was cancelled before any approval because a critical certifi advisory arrived while it waited. 2.2.1 contains everything 2.2.0 had, plus the changes below.Changes
mainthrough chore(deps): bump certifi from 2026.7.22 to 2026.10.18 in /sensor #108 and chore(deps): bump multidict from 6.7.1 to 6.9.1 in /sensor #109. This branch carries the same versions. The sensor's httpx clients (AI endpoints, Home Assistant over HTTPS) trust certifi's bundle. aiohttp, used for Slack and webhooks, does not.AlertDetailPresentationtype routes each alert type to the cards that match its stored fields and drops empty cards. ARP conflicts list each conflict with its IPs, MACs, the known device behind each address, likely benign causes, and the stored risk and fix text. The sensor recordsknown_devicesper conflict, keeps the last conflicts on auto-resolve, and adds an address-only summary to new and updated events. Event emission rules, severity, and dedup are unchanged.security-updatesgroup, so an advisory batch is one PR per ecosystem. Dependabot security updates are now enabled in repository settings. The supply-chain test parses the config and pins both.AGENTS.md, and adds a Public Disclosure Rule. The user guide names the Studio Build Mac in full and documents ARP Identity Conflict alerts.docs/releases/2.2.1.md. The lock differs frommainonly in the sensor's own version line.Testing
uv run pytest tests/ -q: 2657 passed, 6 skipped.ruff check .clean,uv lock --checkpasses.swift testpassed: 437, 130, and 39 tests.AlertDetailPresentationTestssuite (12 tests), and the Dependabot schedule and grouping assertions.