
Security News
Critical Security Vulnerability in React Server Components
React disclosed a CVSS 10.0 RCE in React Server Components and is advising users to upgrade affected packages and frameworks to patched versions now.
@homebridge/ciao
Advanced tools
[](https://www.npmjs.org/package/@homebridge/ciao) [](https://www.npmjs.org/package/@homebridge/ciao) [
implemented in plain Typescript/JavaScript.
It is used in HAP-NodeJS and is the successor of the bonjour-hap library, aiming to be more robust, more maintainable and RFC compliant.
ciao features a multicast dns responder to publish service on the local network.
It will gain browser functionality in the future to also discover existing services on the local network
(There is currently no schedule when discover functionality will arrive.
A possible querier implementation is limited as explained in RFC 6762 15.1.
as it can't recieve unicast responses).
Add ciao as a dependency to your project by running the following command:
npm install --save @homebridge/ciao
const ciao = require("@homebridge/ciao");
const responder = ciao.getResponder();
// create a service defining a web server running on port 3000
const service = responder.createService({
name: 'My Web Server',
type: 'http',
port: 3000,
txt: { // optional
key: "value",
}
})
service.advertise().then(() => {
// stuff you do when the service is published
console.log("Service is published :)");
});
// ....
service.updateTxt({
newKey: "newValue",
});
// ....
service.end().then(() => {
// service is now UNANNOUNCED and can be published again
});
The full documentation can be found here.
This section links to the most important aspects of the documentation as used in the example above.
First of all the getResponder function should be used to get a reference to a Responder object. The function takes some optional options to configure the underlying mdns server.
The createService method of the Responder
object can now be used to create a new CiaoService
supplying the desired configuration
as the first parameter.
The advertise method can now be called
on the service object to start advertising the service on the network.
An application should ideally listen to the NAME_CHANGE
event, in oder to persist any changes happening to the service name resulting of the conflict resolution algorithm.
The method updateTxt can be used
to update the contest of the txt exposed by the service.
Any application should ideally hook up a listener on events like SIGTERM or SIGINT and call the shutdown method of the responder object. This will ensure, that goodbye packets are sent out on all connected network interfaces and all hosts on the network get instantly notified of the shutdown.
As of RFC 6762 17. Multicast DNS Message Size DNS packets must avoid
IP Fragmentation and ensure that all sent packets are smaller than the Maximum Transmission Unit (MTU) defined by
the network interface. The MTU defaults to 1500 Bytes on pretty much all network cards for Ethernet and Wi-Fi.
ciao can't reliable detect modifications made to this default MTU size. Thus, if you know, that the MTU
differs on your machine, you can set the true MTU in bytes using the CIAO_MTU environment variable.
As described in RFC 6762 15.: "It is possible to have more than one Multicast DNS responder and/or querier implementation coexist on the same machine, but there are some known issues."
The RFC lists three possible issues:
As the RFC also states in 15.4, it is recommended to use
a single mDNS implementation where possible. It is recommended to use the mdns
library where possible, as the library is pretty much a binding for existing mDNS implementations running on your
system (like mDNSResponder on macOS or avahi on most linux based systems).
The one downside with the mdns library is that running it on Windows is not really straight forward.
Generally we experienced with homebridge that many users run into problems when trying to install mdns.
Thus bonjour-hap and then ciao was created to provide a much easier to set up system.
FAQs
ciao is a RFC 6763 compliant dns-sd library, advertising on multicast dns (RFC 6762) implemented in plain Typescript/JavaScript
The npm package @homebridge/ciao receives a total of 18,615 weekly downloads. As such, @homebridge/ciao popularity was classified as popular.
We found that @homebridge/ciao demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 9 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
React disclosed a CVSS 10.0 RCE in React Server Components and is advising users to upgrade affected packages and frameworks to patched versions now.

Research
/Security News
We spotted a wave of auto-generated “elf-*” npm packages published every two minutes from new accounts, with simple malware variants and early takedowns underway.

Security News
TypeScript 6.0 will be the last JavaScript-based major release, as the project shifts to the TypeScript 7 native toolchain with major build speedups.