doctor-io/homeio v1.9.6

Homeio v1.9.6

on GitHub

Homeio moves from MIT to the Business Source License 1.1, and this ships with a round of security fixes. Supersedes the Dependabot PRs #45 and #46.

License

Versions released after 1.9.5 are source-available under BSL 1.1:

• Free: production use for yourself, your household or your organization, including modified versions.
• Needs a commercial license: offering Homeio to others as a hosted or managed service, or selling it, including preinstalled on hardware.
• Change License: each version becomes Apache 2.0 four years after release.
• 1.9.5 and earlier stay MIT.

README, CONTRIBUTING, CHANGELOG and the license field in package.json are updated. Commercial inquiries go to tebib.ahmed0@gmail.com.

Security

• Dependencies: Next.js 16.3.6, systeminformation 5.33 (command injection in networkInterfaces(), which we call), drizzle-orm 0.45.3, js-yaml 4.3.2, ws 8.22, plus patched transitive packages. npm audit --omit=dev reports 0. The 4 moderate alerts left are in drizzle-kit's dev tooling.
• dbus-next chain: usocket depended on node-gyp 7, which pulled in request, tar, form-data, qs and tough-cookie. An override builds it with node-gyp 11, and a second one moves dbus-next to xml2js 0.6.
• Mount points (code scanning #3): partitions mount only inside /mnt, /media, /srv or /DATA, never on those folders themselves. Before this, a partition could be mounted over /etc/ssh or /root.
• Slow regexes (code scanning #1, #2): the /\/+$/ and /-+$/ trims in the Cloudflare Tunnel settings are replaced with linear scans.
• apps/mobile: Vite 8 and patched build tooling.

Next 16.3 made the tsc CLI the default type checker, which also checks test files and fails the build on 105 existing type errors in tests. useTypeScriptCli: false keeps the check on app code, as in 16.2. This is also why #45 and #46 alone would have broken the build.

Tested

• 846 unit tests pass, with new tests for the mount rule and the regex fixes. Lint is clean and npm run build passes, as does the mobile build.
• Docker: built the image on the server and ran it as a separate instance. Registration, app store indexing, login, desktop, system stats and terminal work. The mount rule refuses bad paths and normalizes /mnt//x/, and a domain with 50,000 slashes is handled in 75 ms.
• Server (192.168.1.43): deployed with update.sh. The health check passes, all three services are running, usocket builds with node-gyp 11, and there are no errors in the journal.
• Public hostname (homeio.ahmedtabib.com): health, login, the register → login redirect, static assets, 9 API endpoints and the terminal WebSocket all work. Every response has cache-control: private, no-store and cf-cache-status: BYPASS.