This release includes 1 security fix for security teams reviewing exposed deployments.
Published 1mo
Home Automation
✓ No known CVEs patched
This release patches 1 known CVE
Topics
asyncio
home-automation
internet-of-things
iot
mqtt
python
+1 more
raspberry-pi
Affected surfaces
auth
Summary
AI summaryFixed Growatt total_output_power scaling error, prevented Immich API key leakage in logs, and added Subaru API_GEN_4 support.
Full changelog
- Fix Growatt total_output_power 1000x too low with V1 API (@johanzander - #172474) (growatt_server docs)
- Solve issue with double slash in url when writing data to InfluxDB (@RobBie1221 - #173395) (influxdb docs)
- Avoid leaking Immich API key in error logs (@frenck - #173541) (immich docs)
- Stop validating # of slots in zwave_js.set_credential action (@raman325 - #173644) (zwave_js docs)
- Add missing Miele dishwasher codes (@astrandb - #173662) (miele docs)
- Bump aiodiscover to 3.3.1 (@bdraco - #172882) (dhcp docs) (dependency)
- Bump aiodiscover to 3.3.2 (@bdraco - #173705) (dhcp docs) (dependency)
- Skip Miele fan set_percentage when already at the target step (@frenck - #173725) (miele docs)
- Add missing flow form field translation in tuya (@frenck - #173745) (tuya docs)
- Add missing flow form field translation in flux_led (@frenck - #173746) (flux_led docs)
- Add missing flow form field translation in hue (@frenck - #173747) (hue docs)
- Bump lxml to 6.1.1 (@gjohansson-ST - #173748) (scrape docs) (dependency)
- Add missing flow form field translations in islamic_prayer_times (@frenck - #173749) (islamic_prayer_times docs)
- Add missing flow form field translation in lacrosse_view (@frenck - #173750) (lacrosse_view docs)
- Fix flow form field translation key in lookin (@frenck - #173751) (lookin docs)
- Add missing flow form field translation in melnor (@frenck - #173752) (melnor docs)
- Add missing flow form field translation in gogogate2 (@frenck - #173753) (gogogate2 docs)
- Fix flow form field translation key in meteoclimatic (@frenck - #173754) (meteoclimatic docs)
- Fix options flow form field translation key in plaato (@frenck - #173755) (plaato docs)
- Add missing flow form field translation in blink (@frenck - #173756) (blink docs)
- Add missing flow form field translation in motionblinds_ble (@frenck - #173758) (motionblinds_ble docs)
- Add missing flow form field translation in snooz (@frenck - #173760) (snooz docs)
- Bump aioamazondevices to 14.0.4 (@frenck - #173761) (alexa_devices docs) (dependency)
- Bump pyrainbird to 6.3.1 (@frenck - #173786) (rainbird docs) (dependency)
- Bump pyituran to 0.1.6 (@shmuelzon - #173833) (ituran docs) (dependency)
- Add API_GEN_4 support to Subaru integration (@jpettitt - #173956) (subaru docs)
- Fix flow form field translation keys in here_travel_time (@frenck - #173992) (here_travel_time docs)
- Fix flow form field translations in hlk_sw16 (@frenck - #173993) (hlk_sw16 docs)
- Add missing flow form field translation in otp (@frenck - #173994) (otp docs)
- Add missing flow form field translation in honeywell (@frenck - #173996) (honeywell docs)
- Fix flow form field translations in local_calendar (@frenck - #173997) (local_calendar docs)
- Fix flow form field translation key in sia (@frenck - #173998) (sia docs)
- Fix flow form field translations in modem_callerid (@frenck - #173999) (modem_callerid docs)
- Add missing flow form field translation in airvisual (@frenck - #174000) (airvisual docs)
- Add missing flow form field translations in ecobee (@frenck - #174002) (ecobee docs)
- Add missing flow form field translation in iskra (@frenck - #174004) (iskra docs)
- Add missing flow form field translations in tractive (@frenck - #174005) (tractive docs)
- Add missing subentry flow translations in scrape (@frenck - #174006) (scrape docs)
- Fix MQTT discovery option unjustly added to entry data (@jbouwh - #174073) (mqtt docs)
- Cast numeric firmware to string for squeezebox hw_version (@frenck - #174076) (squeezebox docs)
- Retry webdav setup on connection errors (@frenck - #174077) (webdav docs)
- Bump opower to 0.18.5 (@frenck - #174080) (opower docs) (dependency)
- Cast system version to string for simplisafe device model (@frenck - #174081) (simplisafe docs)
- Filter out closed sites in Amber Electric config flow (@frenck - #174084) (amberelectric docs)
- Bump aioamazondevices to 14.1.2 (@chemelli74 - #174114) (alexa_devices docs) (dependency)
- Fix stale routine entities removal for Alexa Devices (@chemelli74 - #174138) (alexa_devices docs)
- Bump aioamazondevices to 14.1.3 (@chemelli74 - #174158) (alexa_devices docs) (dependency)
- Cast SwitchBot Cloud device sw_version to string (@gaborbernat - #174167) (switchbot_cloud docs)
- Bump aiocomelit to 2.0.5 (@frenck - #173800) (comelit docs) (dependency)
- Bump aiocomelit to 2.0.7 (@chemelli74 - #174183) (comelit docs) (dependency)
- Update max prebrew numbers in lamarzocco (@zweckj - #174204) (lamarzocco docs)
- Fix Elk-M1 reconfigure failing when entry has no unique_id (@frenck - #174230) (elkm1 docs)
- Include Sonos favorites in source list and gate SELECT_SOURCE dynamically (@frenck - #174231) (sonos docs)
- Skip fill sensor for Rituals diffusers without fill data (@frenck - #174232) (rituals_perfume_genie docs)
- Handle Weheat API errors during config flow entry creation (@frenck - #174234) (weheat docs)
- Re-raise non-401 HTTP errors in Tank Utility setup (@frenck - #174272) (tank_utility docs)
- Fix econet fan mode select returning int instead of str (@frenck - #174274) (econet docs)
- Update frontend to 20260527.7 (@bramkragten - #174285) (frontend docs) (dependency)
- Cast Xiaomi Gateway sub-device firmware version to string (@frenck - #174294) (xiaomi_miio docs)
- Remove event entities from virtual groups for Alexa Devices (@chemelli74 - #174303) (alexa_devices docs)
- Bump pyroute2 to 0.9.6 (@bdraco - #172521) (thread docs) (dependency)
- Bump aioimmich to 0.15.0 (@mib1185 - #174305) (immich docs) (dependency)
- Bump dsmr-parser to 1.9.0 (@TheJulianJES - #174307) (dsmr docs) (dependency)
Security Fixes
- Avoid leaking Immich API key in error logs
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Home Assistant
house_with_garden: Open source home automation that puts local control and privacy first.
Related context
Related tools
Beta — feedback welcome: [email protected]