Skip to content

v1.3.5 — critical: flashing fixed in the standalone build

Latest
Latest

Choose a tag to compare

View all tags
@LxveAce LxveAce released this 08 Aug 15:36
· 1 commit to main since this release
v1.3.5
9a5007a

Critical fix release. If you downloaded a v1.3.4 standalone binary, please replace it — flashing was broken in that build.

Fixed

  • Flashing works in the standalone build again (critical). In a PyInstaller/frozen binary, invoking esptool re-launched the app instead of running esptool, so every flash / erase / detect silently failed on the downloadable v1.3.4 executables. esptool is now invoked correctly under a frozen build.
  • The Connect button and status re-sync when the flasher drops the serial session, so the UI no longer shows a stale "connected" after a flash takes the port.
  • No more flasher-open freeze — opening the flasher panel could hang the UI; console output is now bounded and a window close during a flash is guarded.
  • Serial reader-thread race fixed — it could kill the web tables and leave a stale "connected" after the reader thread died.
  • Suicide provisioning no longer crashes — the build_bundle wrapper had dropped flash_passes / fast_wipe.

Security

  • Suicide provisioning bounds hardened — sd_passes, flash_passes, arm_pin, and max_att are clamped to the NVS u8 range before being written, and the suicide password is NUL-safe. build_bundle now enforces the same validate_password checks as the CLI (an armed board could otherwise self-wipe on a malformed password) and uses a fresh output dir per call. Web deadman/armed integer parsing is guarded.
  • Web / serial input hardened — a flash-busy connect guard, more robust list-routing / SSID parsing, and a de-duplicated git safe.directory entry.

Changed

  • Releases now publish a SHA256SUMS.txt so downloads can be integrity-checked (sha256sum -c).
  • The suicide provisioner package is bundled into the PyInstaller build.

Docs

  • README overhauled to the LxveLabs standard; points to the flagship cyber-controller for the full multi-firmware toolset and names LxveFlasher as the successor flasher. Internal planning notes removed so the repo reads as a self-contained standalone app.

Full changelog: v1.3.4...v1.3.5

Note: release binaries are built by CI (build-release.yml) and are unsigned — verify against the published SHA256SUMS.txt.

Assets 7
Loading