Skip to content

chore: prepare 0.3.5 security release #31

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
steipete merged 1 commit into from
Oct 23, 2026
Merged

chore: prepare 0.3.5 security release #31

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/release-allowed-signers
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
steipete namespaces="git" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII9XsaCcr8TInPnHcuTVfvXXcsoUFrOE7menfbEIHFW9 steipete@gmail.com

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Enable signed-tag verification for the new allowlist

For a live release, .github/workflows/release-unified.yml does not pass require-signed-tag, so this file is never read and the workflow can create and publish from an unsigned tag. The reusable @v1 workflow defaults that input to false and conditionally runs tag verification only when it is enabled; pass require-signed-tag: true in the caller so the newly added release trust policy is actually enforced.

Useful? React with 👍 / 👎.

6 changes: 4 additions & 2 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,11 @@
# Changelog

## [0.3.5] - Unreleased

## [Unreleased]

## [0.3.5] - 2026-10-23

**Highlights:** Fix the reachable crypto/x509 vulnerability GO-2026-6809 with Go 1.27.3, explain SMAPI API-client identity rejections, and correctly label initial watch events.

### Fixed
- Explain SMAPI API-client identity rejections and suggest supported playback alternatives without exposing service response bodies. Thanks @DonnieFi.
- Label initial `watch` notifications with the correct service even when they arrive before subscription setup finishes.
Expand Down
4 changes: 2 additions & 2 deletions docs/install.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,13 +28,13 @@ go install github.com/steipete/sonoscli/cmd/sonos@latest
sonos --version
```

Source builds retain Go 1.26 as the minimum and prefer Go 1.26.8 via `go.mod`. CI and Docker builds use the same preferred patch version.
Source builds retain Go 1.26 as the minimum and prefer Go 1.27.3 via `go.mod`. CI and Docker builds use the same preferred patch version.

The binary lands in `$(go env GOBIN)` (defaults to `$HOME/go/bin`) — make sure that's on your `PATH`.

## Prebuilt release archives

Each tagged release publishes archives for macOS (universal, plus Intel and Apple Silicon compatibility archives), Linux (amd64 + arm64), and Windows (amd64 + arm64) on the [GitHub releases page](https://github.com/steipete/sonoscli/releases). Download, extract, drop the `sonos` binary somewhere on your `PATH`.
Each tagged release publishes archives for macOS (universal, plus Intel and Apple Silicon compatibility archives), Linux (amd64 + arm64), and Windows (amd64 + arm64) on the [GitHub releases page](https://github.com/steipete/sonoscli/releases). The prebuilt macOS binaries require macOS 13 or later. Download, extract, drop the `sonos` binary somewhere on your `PATH`.

## From source

Expand Down
Loading