Verification Request: homebridge-sanremo-cube-coffeemachine

[fdierer]

Plugin Name

homebridge-sanremo-cube-coffeemachine

Link To GitHub Repo

https://github.com/fdierer/homebridge-sanremo-coffee-machines

Plugin Icon (Optional)

The plugin does not offer the same nor less functionality than that of any existing verified plugin.

🟢 Yes

The plugin successfully installs and does not start unless it is configured.

🟢 Yes

The plugin does not require the user to run Homebridge in a TTY or with non-standard startup parameters, even for initial configuration.

🟢 Yes

The plugin does not contain any analytics or calls that enable you to track the user.

🟢 Yes

If the plugin needs to write files to disk (cache, keys, etc.), it stores them inside the Homebridge storage directory.

🟢 Yes

The plugin does not throw unhandled exceptions, the plugin must catch and log its own errors.

🟢 Yes

More Information

This plugin is a maintained fork of the original Sanremo Cube Homebridge integration by Nareg Sinenian.
The fork implements full Homebridge v2 compatibility, improved stability, expanded configuration options,
config.schema.json GUI support, and real-time status polling/syncing.

As a courtesy, I have notified the original developer about the fork:
nsinenian/homebridge-sanremo-coffee-machines#2

Full compliance documentation:
https://github.com/fdierer/homebridge-sanremo-coffee-machines/blob/main/HOMEBRIDGE_V2_COMPLIANCE.md

Summary overview:
https://github.com/fdierer/homebridge-sanremo-coffee-machines/blob/main/V2_COMPLIANCE_SUMMARY.md

The plugin is actively maintained, communicates only with the user’s local Sanremo Cube,
uses no analytics or telemetry, and adheres fully to the Verified Plugin requirements.

[github-actions]

🔴 Failed Checks

• Config Schema JSON: schema is invalid - required should not be a boolean property on individual fields. In JSON Schema, required must be an array at the object level listing required property names. Remove "required": true/false from individual properties and use "required": ["property1", "property2"] at the object level instead.
• Security: found 2 critical vulnerabilities in dependencies
• GitHub Repo: should have issues enabled
• GitHub Repo: should contain releases

🟢 Passed Checks

• Installation: successfully installed
• Package JSON: homepage exists
• Package JSON: bugs.url exists and seems a valid URL
• Package JSON: keywords exist and contain 'homebridge-plugin'
• Package JSON: 'preinstall' in scripts is not present
• Package JSON: 'install' in scripts is not present
• Package JSON: 'postinstall' in scripts is not present
• Package JSON: engines.node property is compatible with Node 20
• Package JSON: engines.node property is compatible with Node 22
• Package JSON: engines.node property is compatible with Node 24
• Package JSON: engines.homebridge property is compatible with Homebridge 1.11.1
• Package JSON: initializer function found
• NPM Package: has not been deprecated
• GitHub Repo: version in package.json (v1.4.2) matches NPM version (v1.4.2)
• Config Schema JSON: exists and is valid JSON
• Config Schema JSON: contains a valid pluginAlias
• Config Schema JSON: the pluginType is set to 'platform'
• Config Schema JSON: contains a name schema property
• Dependencies: homebridge was not installed as a dependency
• Dependencies: hap-nodejs was not installed as a dependency
• Security: no unsafe code patterns detected
• Security: no privilege escalation attempts detected
• GitHub Repo: repository is public
• GitHub Repo: repository is not archived

ℹ️ Check Details

• These checks were run against v1.4.2 of the plugin.
• Link to the run workflow: visit →.

📋 Next Steps

• Please action these failures and then comment /check to run the checks again.
• If updating your package.json and config.schema.json files, don't forget to publish a new version to NPM.
• Remember this is an automatic script: if you think something has been marked as a failure in error, let us know with a reply.
• Feel free to ask any questions you have by replying to this issue.

[fdierer]

v1.4.5 has now been published with the config schema fixes, repository hygiene updates, and stability improvements.

Please re-run the automated checks.

/check

[fdierer]

/check

[github-actions]

🔴 Failed Checks

• Security: found 2 critical vulnerabilities in dependencies

🟢 Passed Checks

• Installation: successfully installed
• Package JSON: homepage exists
• Package JSON: bugs.url exists and seems a valid URL
• Package JSON: keywords exist and contain 'homebridge-plugin'
• Package JSON: 'preinstall' in scripts is not present
• Package JSON: 'install' in scripts is not present
• Package JSON: 'postinstall' in scripts is not present
• Package JSON: engines.node property is compatible with Node 20
• Package JSON: engines.node property is compatible with Node 22
• Package JSON: engines.node property is compatible with Node 24
• Package JSON: engines.homebridge property is compatible with Homebridge 1.11.1
• Package JSON: initializer function found
• NPM Package: has not been deprecated
• GitHub Repo: version in package.json (v1.4.5) matches NPM version (v1.4.5)
• Config Schema JSON: exists and is valid JSON
• Config Schema JSON: contains valid JSON Schema
• Config Schema JSON: schema has valid type property
• Config Schema JSON: schema has valid properties for object type
• Config Schema JSON: contains a valid pluginAlias
• Config Schema JSON: the pluginType is set to 'platform'
• Config Schema JSON: contains a name schema property
• Dependencies: homebridge was not installed as a dependency
• Dependencies: hap-nodejs was not installed as a dependency
• Security: no unsafe code patterns detected
• Security: no privilege escalation attempts detected
• GitHub Repo: repository is public
• GitHub Repo: repository is not archived
• GitHub Repo: issues are enabled
• GitHub Repo: contains releases

ℹ️ Check Details

• These checks were run against v1.4.5 of the plugin.
• Link to the run workflow: visit →.

📋 Next Steps

• Please action these failures and then comment /check to run the checks again.
• If updating your package.json and config.schema.json files, don't forget to publish a new version to NPM.
• Remember this is an automatic script: if you think something has been marked as a failure in error, let us know with a reply.
• Feel free to ask any questions you have by replying to this issue.

[fdierer]

Thank you for reviewing this plugin.

A brief update on its current status:

Current version: homebridge-sanremo-cube-coffeemachine@1.4.5
This is the stable, published version and the one under review. It is running in production on a real Sanremo Cube and has been validated in a Homebridge Docker environment on Synology NAS.

All automated verification checks now pass with the exception of two critical vulnerabilities reported in the dependency tree.

Dependency and Security Notes

The plugin itself has no direct vulnerable dependencies.
In version 1.4.5, all deprecated or outdated HTTP-related dependencies were removed, and the plugin communicates only with the user’s Sanremo Cube over the local network. It does not expose any external HTTP endpoints or accept user-supplied URLs.

The remaining advisories originate from transitive dependencies of the hap-js library, specifically from older versions of request and form-data. These packages are not used by the plugin, and the vulnerable code paths are not exercised by its execution model.

A detailed breakdown is provided in the repository documentation:

• HOMEBRIDGE_V2_COMPLIANCE.md
• V2_COMPLIANCE_SUMMARY.md
• SECURITY_NOTES.md

An experimental branch explored replacing the full HTTP/request stack with a modern implementation. However, that change caused the Sanremo Cube to return unsupported responses and could not be shipped without compromising reliability on actual hardware. For this reason, version 1.4.5 retains the known-stable implementation.

Compatibility

Version 1.4.5 is fully compatible with:

• Homebridge v1.6+
• Homebridge v2.0
• Node.js >= 18.20.4 < 25
• Child bridge mode

It uses only supported Homebridge APIs and does not rely on deprecated HAP-NodeJS imports.
The configuration schema has also been updated to follow correct JSON Schema conventions.

Next Steps

I am happy to answer any questions or make adjustments if required.
If you prefer that I explore alternative approaches or libraries in a future release to eliminate the remaining transitive advisories, I am open to evaluating that.

Thank you again for your time and review.

[github-actions]

This issue has been automatically closed due to inactivity while awaiting changes.