1.0.16 (#94)

* version changes

* update node version requirement

* Bump axios from 0.21.4 to 0.28.0

Bumps [axios](https://github.com/axios/axios) from 0.21.4 to 0.28.0.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v0.28.0/CHANGELOG.md)
- [Commits](axios/axios@v0.21.4...v0.28.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* mosquitto example dockerfile

* use fixed engine range, remove unused deps

* removed old directories from .gitignore

* updated node version

* add vscode workspace settings

* updated dockerfile example

* coding style

* information about CVE-2022-32214 resolution in node >21 that affects parsing device responses

* update packages and engines

* update to new versions

* 1.0.16

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: bytespider

.github/workflows/npm-publish.yml

@@ -1,34 +1,25 @@
 # This workflow will run tests using node and then publish a package to GitHub Packages when a release is created
 # For more information see: https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages
 
-name: Node.js Package
+name: Publish Package to npmjs
 
 on:
   release:
-    types: [created]
-  workflow_dispatch:
+    types: [published]
+    branches:
+      - main
 
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
         with:
-          node-version: 18
+          node-version: '20.x'
+          registry-url: https://registry.npmjs.org
       - run: npm ci
       - run: npm test
-
-  publish-npm:
-    needs: build
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
-        with:
-          node-version: 18
-          registry-url: https://registry.npmjs.org/
-      - run: npm ci
-      - run: npm publish
+      - run: npm publish --access public
         env:
           NODE_AUTH_TOKEN: ${{secrets.npm_token}}

.github/workflows/stale.yml

@@ -0,0 +1,3 @@
+- name: Close Stale Issues
+  uses: actions/stale@v9.0.0
+            

.gitignore

@@ -1,4 +1,4 @@
-bin/src/node_modules
-cmd/
-dumps/
-old_certs/
+# directories
+node_modules/
+
+#files

.npmignore

@@ -1,6 +1,2 @@
-certs/
-cmd/
-dumps/
 mosquito/
-old_certs/
 teardown/

.prettierrc

@@ -3,5 +3,7 @@
   "useTabs": false,
   "semi": true,
   "arrowParens": "always",
-  "singleQuote": true
+  "singleQuote": true,
+  "trailingComma": "all",
+  "printWidth": 80
 }

.vscode/settings.json

@@ -0,0 +1,4 @@
+{
+  "editor.tabSize": 2,
+  "editor.defaultFormatter": "esbenp.prettier-vscode"
+}

Dockerfile

@@ -0,0 +1,16 @@
+FROM eclipse-mosquitto:1.6.15-openssl
+
+COPY mosquitto/basic.conf ./mosquitto/config/mosquitto.conf
+RUN apk add --update --no-cache openssl && \
+    mkdir /mosquitto/config/certs && \
+    cd /mosquitto/config/certs && \
+    openssl genrsa -out ca.key 2048 && \
+    openssl req -x509 -new -nodes -key ca.key -days 3650 -out ca.crt -subj '/CN=My Root' && \
+    openssl req -new -nodes -out server.csr -newkey rsa:2048 -keyout server.key -subj '/CN=Mosquitto' && \
+    openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 3650 && \
+    c_rehash . && \
+    chown -R mosquitto:mosquitto /mosquitto && \
+    chmod 600 /mosquitto/config/certs/*
+
+EXPOSE 1883
+EXPOSE 8883

README.md

@@ -6,7 +6,8 @@ Tools to help configure the Meross devices for purpose of utilising our <a href=
 
 Before you can use the tool to setup your device you need to put it into paring mode and connect to it's Access Point. It's IP address is known as the `--gateway` parameter and is typically `10.10.10.1`.
 
-Requires `node` v18+.
+Requires `node` >=18  
+For Node.js >=21 you need to prepend commands with `NODE_OPTIONS='--insecure-http-parser'`. This is because the responses from some (if not all) versions of the Meross firmware incorrectly terminate headers with LF instead of CRLF. [CVE-2022-32214](https://nvd.nist.gov/vuln/detail/CVE-2022-32214)
 
 ## Home Assistant