From 69a70037274d0f0c5d4ee6469aeda2f78347aa21 Mon Sep 17 00:00:00 2001 From: Lobinux Date: Fri, 27 Mar 2026 14:39:10 -0300 Subject: [PATCH 1/3] fix: escape base64 data in CEF JavaScript evaluation Use js_string() helper for base64_data parameter in set_custom_artwork() to prevent JavaScript injection via crafted artwork data. All other methods already used this helper correctly. Closes #231 --- crates/steam/src/cef.rs | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/crates/steam/src/cef.rs b/crates/steam/src/cef.rs index f3c4e060..953e1172 100644 --- a/crates/steam/src/cef.rs +++ b/crates/steam/src/cef.rs @@ -203,7 +203,8 @@ impl CefClient { self.clear_custom_artwork(app_id, asset_type).await?; let js = format!( - r#"SteamClient.Apps.SetCustomArtworkForApp({app_id}, "{base64_data}", "png", {asset_type})"#, + "SteamClient.Apps.SetCustomArtworkForApp({app_id}, {}, \"png\", {asset_type})", + js_string(base64_data), ); self.evaluate_void(&js).await } From bda8f227bfbb7488c85f41eb9063ba6316a309b2 Mon Sep 17 00:00:00 2001 From: Lobinux Date: Fri, 27 Mar 2026 15:10:07 -0300 Subject: [PATCH 2/3] ci: bump GitHub Actions to Node.js 24 versions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - actions/checkout v4 → v6 - actions/upload-artifact v4 → v7 - actions/download-artifact v4 → v8 Node.js 20 actions are deprecated and will stop working after September 2026. These new major versions use Node.js 24. --- .github/workflows/ci.yml | 10 +++++----- .github/workflows/release.yml | 18 +++++++++--------- 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 055895f4..c62d5713 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -15,7 +15,7 @@ jobs: name: Rust Lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - uses: dtolnay/rust-toolchain@stable with: @@ -47,7 +47,7 @@ jobs: name: Rust Test runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - uses: dtolnay/rust-toolchain@stable @@ -86,7 +86,7 @@ jobs: hub_bin: capydeploy-hub-tauri.exe agent_bin: capydeploy-agent-tauri.exe steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - uses: dtolnay/rust-toolchain@stable @@ -113,7 +113,7 @@ jobs: run: cargo build --release -p capydeploy-hub-tauri -p capydeploy-agent-tauri - name: Upload build artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: build-${{ matrix.target }} path: | @@ -125,7 +125,7 @@ jobs: name: Frontend checks runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - uses: oven-sh/setup-bun@v2 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 14478472..4e1786ae 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -33,7 +33,7 @@ jobs: hub_bin: capydeploy-hub-tauri.exe agent_bin: capydeploy-agent-tauri.exe steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 with: ref: ${{ inputs.tag_name }} @@ -62,13 +62,13 @@ jobs: run: cargo build --release -p capydeploy-hub-tauri -p capydeploy-agent-tauri - name: Upload Hub binary - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: hub-${{ matrix.target }} path: target/release/${{ matrix.hub_bin }} - name: Upload Agent binary - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: agent-${{ matrix.target }} path: target/release/${{ matrix.agent_bin }} @@ -78,18 +78,18 @@ jobs: needs: build runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 with: ref: ${{ inputs.tag_name }} - name: Download Hub Linux binary - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: hub-linux-amd64 path: artifacts/hub - name: Download Agent Linux binary - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: agent-linux-amd64 path: artifacts/agent @@ -415,7 +415,7 @@ jobs: ARCH=x86_64 ./appimagetool agent.AppDir CapyDeploy_Agent.AppImage - name: Upload AppImages - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: appimages path: | @@ -427,13 +427,13 @@ jobs: needs: [build, appimage] runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 with: ref: ${{ inputs.tag_name }} fetch-depth: 0 - name: Download all artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: path: artifacts From 33af6156876a5efb30b64bc54eb4020efa6747cd Mon Sep 17 00:00:00 2001 From: Lobinux Date: Fri, 27 Mar 2026 15:43:49 -0300 Subject: [PATCH 3/3] chore: update decky submodule to v1.0.2 Includes timing-safe token comparison fix (decky-capydeploy#20). --- apps/agents/decky | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/agents/decky b/apps/agents/decky index 9c4e4484..59647bae 160000 --- a/apps/agents/decky +++ b/apps/agents/decky @@ -1 +1 @@ -Subproject commit 9c4e44840f6cc62c693f02d245b64a85789f3c0d +Subproject commit 59647bae0365adbf5fd867b975d7ba925cb442ce