This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+3 more
Affected surfaces
ReleasePort's take
Moderate signalEsphome 2026.5.1 updates the zeroconf dependency to 0.149.13 and adds several bug‑fixes, features, and a breaking API change.
Why it matters: Bumping zeroconf to version 0.149.13 resolves known issues; critical fixes prevent tarfile extraction crashes on Python 3.11, and the new version.txt output ensures accurate bootloader reporting.
Summary
AI summaryBroad release touches https://github.com/swoboda1337, https://github.com/bdraco, https://github.com/apps/dependabot, and https://github.com/esphome/esphome/pull/16520.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Breaking | Medium |
Break api_connection/api_server include cycle to drop custom unique_ptr deleter. Break api_connection/api_server include cycle to drop custom unique_ptr deleter. Source: llm_adapter@2026-05-25 Confidence: high |
— |
| Feature | Medium |
Persist & restore CORE.toolchain through StorageJSON. Persist & restore CORE.toolchain through StorageJSON. Source: llm_adapter@2026-05-25 Confidence: low |
— |
| Feature | Medium |
Write version.txt after extract so bootloader shows the real version. Write version.txt after extract so bootloader shows the real version. Source: llm_adapter@2026-05-25 Confidence: low |
— |
| Feature | Medium |
Default to remote HEAD when cg.add_library URL has no #ref. Default to remote HEAD when cg.add_library URL has no #ref. Source: llm_adapter@2026-05-25 Confidence: low |
— |
| Feature | Medium |
Honor the dict shorthand for library.json dependencies. Honor the dict shorthand for library.json dependencies. Source: llm_adapter@2026-05-25 Confidence: low |
— |
| Feature | Low |
Assert NSS before wait_busy so SX126x commands wake the chip from sleep. Assert NSS before wait_busy so SX126x commands wake the chip from sleep. Source: granite4.1:30b@2026-05-25-audit Confidence: low |
— |
| Feature | Low |
Use os_timer-based esp_delay() for ESP8266 delay(). Use os_timer-based esp_delay() for ESP8266 delay(). Source: granite4.1:30b@2026-05-25-audit Confidence: low |
— |
| Feature | Low |
Wake main loop on ESP8266 software serial RX. Wake main loop on ESP8266 software serial RX. Source: granite4.1:30b@2026-05-25-audit Confidence: low |
— |
| Dependency | Medium |
Bump zeroconf from 0.149.12 to 0.149.13. Bump zeroconf from 0.149.12 to 0.149.13. Source: llm_adapter@2026-05-25 Confidence: low |
— |
| Dependency | Low |
Bump sendspin-cpp to v0.6.1. Bump sendspin-cpp to v0.6.1. Source: granite4.1:30b@2026-05-25-audit Confidence: low |
— |
| Bugfix | Medium |
Fix tarfile extract crashing on Python 3.11 with None mode. Fix tarfile extract crashing on Python 3.11 with None mode. Source: llm_adapter@2026-05-25 Confidence: high |
— |
| Bugfix | Medium |
Filter noisy 'git rev-parse' errors when .git is stripped. Filter noisy 'git rev-parse' errors when .git is stripped. Source: llm_adapter@2026-05-25 Confidence: high |
— |
| Bugfix | Medium |
Backport ninja linux‑arm64 entry into tools.json on aarch64 hosts. Backport ninja linux‑arm64 entry into tools.json on aarch64 hosts. Source: llm_adapter@2026-05-25 Confidence: low |
— |
| Bugfix | Medium |
Defer esp_panic_handler wrap so arduino-esp32 IDF component skips it. Defer esp_panic_handler wrap so arduino-esp32 IDF component skips it. Source: granite4.1:30b@2026-05-25-audit Confidence: low |
— |
| Bugfix | Medium |
Refresh compiled config cache after upload/logs fallback in core. Refresh compiled config cache after upload/logs fallback in core. Source: granite4.1:30b@2026-05-25-audit Confidence: low |
— |
| Bugfix | Low |
Restore null guard on status_pin lost in #16353 for Tuya integration. Restore null guard on status_pin lost in #16353 for Tuya integration. Source: granite4.1:30b@2026-05-25-audit Confidence: low |
— |
| Bugfix | Low |
Fix LN882H IRAM_ATTR injection point in libretiny patch_linker.py. Fix LN882H IRAM_ATTR injection point in libretiny patch_linker.py. Source: granite4.1:30b@2026-05-25-audit Confidence: low |
— |
| Bugfix | Low |
Recover Bluetooth proxy slot stuck in DISCONNECTING when CLOSE_EVT is dropped. Recover Bluetooth proxy slot stuck in DISCONNECTING when CLOSE_EVT is dropped. Source: granite4.1:30b@2026-05-25-audit Confidence: low |
— |
Full changelog
- Bump zeroconf from 0.149.12 to 0.149.13 esphome#16520 by @dependabot[bot]
- Bump zeroconf from 0.149.13 to 0.149.16 esphome#16533 by @dependabot[bot]
- [espidf] Filter noisy 'git rev-parse' errors when .git is stripped esphome#16521 by @swoboda1337
- [espidf] Fix tarfile extract crashing on Python 3.11 with None mode esphome#16530 by @swoboda1337
- [espidf] Write version.txt after extract so bootloader shows the real version esphome#16532 by @swoboda1337
- [core] Persist & restore CORE.toolchain through StorageJSON esphome#16531 by @swoboda1337
- [espidf] Backport ninja linux-arm64 entry into tools.json on aarch64 hosts esphome#16527 by @swoboda1337
- [espidf] Default to remote HEAD when cg.add_library URL has no #ref esphome#16535 by @swoboda1337
- [espidf] Honor the dict shorthand for library.json dependencies esphome#16537 by @swoboda1337
- [esp32] Defer esp_panic_handler wrap so arduino-esp32 IDF component skips it esphome#16538 by @swoboda1337
- [tuya] Restore null guard on status_pin lost in #16353 esphome#16539 by @swoboda1337
- [api] Break api_connection/api_server include cycle to drop custom unique_ptr deleter esphome#16542 by @bdraco
- [sx126x] Assert NSS before wait_busy so commands wake the chip from sleep esphome#16546 by @swoboda1337
- [core] Refresh compiled config cache after upload/logs fallback esphome#16548 by @bdraco
- [sendspin] Bump sendspin-cpp to v0.6.1 esphome#16553 by @kahrendt
- [dashboard] Fix flaky test_websocket_refresh_command on Windows CI esphome#16565 by @bdraco
- [libretiny] Fix LN882H IRAM_ATTR injection point in patch_linker.py esphome#16570 by @Bl00d-B0b
- [esp8266] Use os_timer-based esp_delay() in delay() esphome#16563 by @bdraco
- [uart] Wake main loop on ESP8266 software serial RX esphome#16562 by @bdraco
- [esp32] Demote IDF #warning deprecations from error under ESP-IDF toolchain esphome#16584 by @swoboda1337
- [bluetooth_proxy] Recover slot stuck in DISCONNECTING when CLOSE_EVT is dropped esphome#16588 by @bdraco
- [esp32] Replace per-class -Wno-error=X demotes with blanket -Wno-error for ESP-IDF toolchain esphome#16599 by @swoboda1337
- [esp32] Disable IDF's COMPILER_DISABLE_DEFAULT_ERRORS so -Wno-error actually undoes -Werror esphome#16604 by @swoboda1337
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About esphome
ESPHome is a system to control your ESP32, ESP8266, BK72xx, RP2040 by simple yet powerful configuration files and control them remotely through Home Automation systems.
Related context
Related tools
Featured in
Beta — feedback welcome: [email protected]