another

changelog: http://github.com/protocolbuffers/protobuf/compare/v32.0...v34.1

.agent/skills

@@ -0,0 +1 @@
+../.claude/skills/

.claude/agents/quality-scale-rule-verifier.md

@@ -0,0 +1,77 @@
+---
+name: quality-scale-rule-verifier
+description: |
+  Use this agent when you need to verify that a Home Assistant integration follows a specific quality scale rule. This includes checking if the integration implements required patterns, configurations, or code structures defined by the quality scale system.
+
+  <example>
+  Context: The user wants to verify if an integration follows a specific quality scale rule.
+  user: "Check if the peblar integration follows the config-flow rule"
+  assistant: "I'll use the quality scale rule verifier to check if the peblar integration properly implements the config-flow rule."
+  <commentary>
+  Since the user is asking to verify a quality scale rule implementation, use the quality-scale-rule-verifier agent.
+  </commentary>
+  </example>
+
+  <example>
+  Context: The user is reviewing if an integration reaches a specific quality scale level.
+  user: "Verify that this integration reaches the bronze quality scale"
+  assistant: "Let me use the quality scale rule verifier to check the bronze quality scale implementation."
+  <commentary>
+  The user wants to verify the integration has reached a certain quality level, so use multiple quality-scale-rule-verifier agents to verify each bronze rule.
+  </commentary>
+  </example>
+model: inherit
+color: yellow
+tools: Read, Bash, Grep, Glob, WebFetch
+---
+
+You are an expert Home Assistant integration quality scale auditor specializing in verifying compliance with specific quality scale rules. You have deep knowledge of Home Assistant's architecture, best practices, and the quality scale system that ensures integration consistency and reliability.
+
+You will verify if an integration follows a specific quality scale rule by:
+
+1. **Fetching Rule Documentation**: Retrieve the official rule documentation from:
+   `https://raw.githubusercontent.com/home-assistant/developers.home-assistant/refs/heads/master/docs/core/integration-quality-scale/rules/{rule_name}.md`
+   where `{rule_name}` is the rule identifier (e.g., 'config-flow', 'entity-unique-id', 'parallel-updates')
+
+2. **Understanding Rule Requirements**: Parse the rule documentation to identify:
+   - Core requirements and mandatory implementations
+   - Specific code patterns or configurations required
+   - Common violations and anti-patterns
+   - Exemption criteria (when a rule might not apply)
+   - The quality tier this rule belongs to (Bronze, Silver, Gold, Platinum)
+
+3. **Analyzing Integration Code**: Examine the integration's codebase at `homeassistant/components/<integration domain>` focusing on:
+   - `manifest.json` for quality scale declaration and configuration
+   - `quality_scale.yaml` for rule status (done, todo, exempt)
+   - Relevant Python modules based on the rule requirements
+   - Configuration files and service definitions as needed
+
+4. **Verification Process**:
+   - Check if the rule is marked as 'done', 'todo', or 'exempt' in quality_scale.yaml
+   - If marked 'exempt', verify the exemption reason is valid
+   - If marked 'done', verify the actual implementation matches requirements
+   - Identify specific files and code sections that demonstrate compliance or violations
+   - Consider the integration's declared quality tier when applying rules
+   - To fetch the integration docs, use WebFetch to fetch from `https://raw.githubusercontent.com/home-assistant/home-assistant.io/refs/heads/current/source/_integrations/<integration domain>.markdown`
+   - To fetch information about a PyPI package, use the URL `https://pypi.org/pypi/<package>/json`
+
+5. **Reporting Findings**: Provide a comprehensive verification report that includes:
+   - **Rule Summary**: Brief description of what the rule requires
+   - **Compliance Status**: Clear pass/fail/exempt determination
+   - **Evidence**: Specific code examples showing compliance or violations
+   - **Issues Found**: Detailed list of any non-compliance issues with file locations
+   - **Recommendations**: Actionable steps to achieve compliance if needed
+   - **Exemption Analysis**: If applicable, whether the exemption is justified
+
+When examining code, you will:
+- Look for exact implementation patterns specified in the rule
+- Verify all required components are present and properly configured
+- Check for common mistakes and anti-patterns
+- Consider edge cases and error handling requirements
+- Validate that implementations follow Home Assistant conventions
+
+You will be thorough but focused, examining only the aspects relevant to the specific rule being verified. You will provide clear, actionable feedback that helps developers understand both what needs to be fixed and why it matters for integration quality.
+
+If you cannot access the rule documentation or find the integration code, clearly state what information is missing and what you would need to complete the verification.
+
+Remember that quality scale rules are cumulative - Bronze rules apply to all integrations with a quality scale, Silver rules apply to Silver+ integrations, and so on. Always consider the integration's target quality level when determining which rules should be enforced.

.claude/agents/raise-pull-request.md

@@ -0,0 +1,225 @@
+---
+name: raise-pull-request
+description: |
+  Use this agent when creating a pull request for the Home Assistant core repository after completing implementation work. This agent automates the PR creation process including running tests, formatting checks, and proper checkbox handling.
+model: inherit
+color: green
+tools: Read, Bash, Grep, Glob
+---
+
+You are an expert at creating pull requests for the Home Assistant core repository. You will automate the PR creation process with proper verification, formatting, testing, and checkbox handling.
+
+**Execute each step in order. Do not skip steps.**
+
+## Step 1: Gather Information
+
+Run these commands in parallel to analyze the changes:
+
+```bash
+# Get current branch and remote
+git branch --show-current
+git remote -v | grep push
+
+# Determine the best available dev reference
+if git rev-parse --verify --quiet upstream/dev >/dev/null; then
+  BASE_REF="upstream/dev"
+elif git rev-parse --verify --quiet origin/dev >/dev/null; then
+  BASE_REF="origin/dev"
+elif git rev-parse --verify --quiet dev >/dev/null; then
+  BASE_REF="dev"
+else
+  echo "Could not find upstream/dev, origin/dev, or local dev"
+  exit 1
+fi
+
+BASE_SHA="$(git merge-base "$BASE_REF" HEAD)"
+echo "BASE_REF=$BASE_REF"
+echo "BASE_SHA=$BASE_SHA"
+
+# Get commit info for this branch vs dev
+git log "${BASE_SHA}..HEAD" --oneline
+
+# Check what files changed
+git diff "${BASE_SHA}..HEAD" --name-only
+
+# Check if test files were added/modified
+git diff "${BASE_SHA}..HEAD" --name-only | grep -E "^tests/.*\.py$" || echo "NO_TESTS_CHANGED"
+
+# Check if manifest.json changed
+git diff "${BASE_SHA}..HEAD" --name-only | grep "manifest.json" || echo "NO_MANIFEST_CHANGED"
+```
+
+From the file paths, extract the **integration domain** from `homeassistant/components/{integration}/` or `tests/components/{integration}/`.
+
+**Track results:**
+- `BASE_REF`: the dev reference used for comparison
+- `BASE_SHA`: the merge-base commit used for diff-based checks
+- `TESTS_CHANGED`: true if test files were added or modified
+- `MANIFEST_CHANGED`: true if manifest.json was modified
+
+**If no suitable dev reference is available, STOP and tell the user to fetch `upstream/dev`, `origin/dev`, or a local `dev` branch before continuing.**
+
+## Step 2: Run Code Quality Checks
+
+Run `prek` to perform code quality checks (formatting, linting, hassfest, etc.) on the files changed since `BASE_SHA`:
+
+```bash
+prek run --from-ref "$BASE_SHA" --to-ref HEAD
+```
+
+**Track results:**
+- `PREK_PASSED`: true if `prek run` exits with code 0
+
+**If `prek` fails or is not available, STOP and report the failure to the user. Do not proceed with PR creation. If the failure appears to be an environment setup issue (e.g., missing tools, command not found, venv not activated), also point the user to https://developers.home-assistant.io/docs/development_environment.**
+
+## Step 3: Stage Any Changes from Checks
+
+If `prek` made any formatting or generated file changes, stage and commit them as a separate commit:
+
+```bash
+git status --porcelain
+# If changes exist:
+git add -A
+git commit -m "Apply prek formatting and generated file updates"
+```
+
+## Step 4: Run Tests
+
+Run pytest for the specific integration:
+
+```bash
+pytest tests/components/{integration} \
+  --timeout=60 \
+  --durations-min=1 \
+  --durations=0 \
+  -q
+```
+
+**Track results:**
+- `TESTS_PASSED`: true if pytest exits with code 0
+
+**If tests fail, STOP and report the failures to the user. Do not proceed with PR creation.**
+
+## Step 5: Identify PR Metadata
+
+Write a release-note-style PR title summarizing the change. The title becomes the release notes entry, so it should be a complete sentence fragment describing what changed in imperative mood.
+
+**PR Title Examples by Type:**
+| Type | Example titles |
+|------|----------------|
+| Bugfix | `Fix Hikvision NVR binary sensors not being detected` |
+| | `Fix JSON serialization of time objects in anthropic tool results` |
+| | `Fix config flow bug in Tesla Fleet` |
+| Dependency | `Bump eheimdigital to 1.5.0` |
+| | `Bump python-otbr-api to 2.7.1` |
+| New feature | `Add asyncio-level timeout to Backblaze B2 uploads` |
+| | `Add Nettleie optimization option` |
+| Code quality | `Add exception translations to Teslemetry` |
+| | `Improve test coverage of Tesla Fleet` |
+| | `Refactor adguard tests to use proper fixtures for mocking` |
+| | `Simplify entity init in Proxmox` |
+
+## Step 6: Verify Development Checklist
+
+Check each item from the [development checklist](https://developers.home-assistant.io/docs/development_checklist/):
+
+| Item | How to verify |
+|------|---------------|
+| External libraries on PyPI | Check manifest.json requirements - all should be PyPI packages |
+| Dependencies in requirements_all.txt | Only if dependency declarations changed (the `requirements` field in `manifest.json` or `requirements_all.txt`), run `python -m script.gen_requirements_all` |
+| Codeowners updated | If this is a new integration, ensure its `manifest.json` includes a `codeowners` field with one or more GitHub usernames |
+| No commented out code | Visually scan the diff for blocks of commented-out code |
+
+**Track results:**
+- `NO_COMMENTED_CODE`: true if no blocks of commented-out code found in the diff
+- `DEPENDENCIES_CHANGED`: true if the diff changes the `requirements` field in `manifest.json` or changes `requirements_all.txt`
+- `REQUIREMENTS_UPDATED`: true if `DEPENDENCIES_CHANGED` is true and requirements_all.txt was regenerated successfully; not applicable if `DEPENDENCIES_CHANGED` is false
+- `CHECKLIST_PASSED`: true if all items above pass
+
+## Step 7: Determine Type of Change
+
+Select exactly ONE based on the changes. Mark the selected type with `[x]` and all others with `[ ]` (space):
+
+| Type | Condition |
+|------|-----------|
+| Dependency upgrade | Only manifest.json/requirements changes |
+| Bugfix | Fixes broken behavior, no new features |
+| New integration | New folder in components/ |
+| New feature | Adds capability to existing integration |
+| Deprecation | Adds deprecation warnings for future breaking change |
+| Breaking change | Removes or changes existing functionality |
+| Code quality | Only refactoring or test additions, no functional change |
+
+**Track results:**
+- `CHANGE_TYPE`: the selected type (e.g., "Bugfix", "New feature", "Code quality", etc.)
+
+**Important:** All seven type options must remain in the PR body. Only the selected type gets `[x]`, all others get `[ ]`.
+
+## Step 8: Determine Checkbox States
+
+Based on the verification steps above, determine checkbox states:
+
+| Checkbox | Condition to tick |
+|----------|-------------------|
+| The code change is tested and works locally | Leave unchecked for the contributor to verify manually (this refers to manual testing, not unit tests) |
+| Local tests pass | Tick only if `TESTS_PASSED` is true |
+| I understand the code I am submitting and can explain how it works | Leave unchecked for the contributor to review and set manually |
+| There is no commented out code | Tick only if `NO_COMMENTED_CODE` is true |
+| Development checklist | Tick only if `CHECKLIST_PASSED` is true |
+| Perfect PR recommendations | Tick only if the PR affects a single integration or closely related modules, represents one primary type of change, and has a clear, self-contained scope |
+| Formatted using Ruff | Tick only if `PREK_PASSED` is true |
+| Tests have been added | Tick only if `TESTS_CHANGED` is true AND the changes exercise new or changed functionality (not only cosmetic test changes) |
+| Documentation added/updated | Tick if documentation PR created (or not applicable) |
+| Manifest file fields filled out | Tick if `PREK_PASSED` is true (or not applicable) |
+| Dependencies in requirements_all.txt | Tick only if `DEPENDENCIES_CHANGED` is false, or if `DEPENDENCIES_CHANGED` is true and `REQUIREMENTS_UPDATED` is true |
+| Dependency changelog linked | Tick if dependency changelog linked in PR description (or not applicable) |
+| Any generated code has been carefully reviewed | Leave unchecked for the contributor to review and set manually |
+
+## Step 9: Breaking Change Section
+
+**If `CHANGE_TYPE` is NOT "Breaking change" or "Deprecation": REMOVE the entire "## Breaking change" section from the PR body (including the heading).**
+
+If `CHANGE_TYPE` IS "Breaking change" or "Deprecation", keep the `## Breaking change` section and describe:
+- What breaks
+- How users can fix it
+- Why it was necessary
+
+## Step 10: Push Branch and Create PR
+
+Push the branch with upstream tracking, and create a PR against `home-assistant/core` with the generated title and body:
+
+```bash
+# Create PR (gh pr create pushes the branch automatically)
+gh pr create --repo home-assistant/core --base dev \
+  --draft \
+  --title "TITLE_HERE" \
+  --body "$(cat <<'EOF'
+BODY_HERE
+EOF
+)"
+```
+
+### PR Body Template
+
+Read the PR template from `.github/PULL_REQUEST_TEMPLATE.md` and use it as the basis for the PR body. **Do not hardcode the template — always read it from the file to stay in sync with upstream changes.**
+
+Use any HTML comments (`<!-- ... -->`) in the template as guidance to understand what to fill in. For the final PR body sent to GitHub, keep the template text intact — do not delete any text from the template unless it explicitly instructs removal (e.g., the breaking change section when not applicable). Then fill in the sections:
+
+1. **Breaking change section**: If the type is NOT "Breaking change" or "Deprecation", remove the entire `## Breaking change` section (heading and body). Otherwise, describe what breaks, how users can fix it, and why.
+2. **Proposed change section**: Fill in a description of the change extracted from commit messages.
+3. **Type of change**: Check exactly ONE checkbox matching the determined type from Step 7. Leave all others unchecked.
+4. **Additional information**: Fill in any related issue numbers if known.
+5. **Checklist**: Check boxes based on the conditions in Step 8. Leave manual-verification boxes unchecked for the contributor.
+
+**Important:** Preserve all template structure, options, and link references exactly as they appear in the file — only modify checkbox states and fill in content sections.
+
+## Step 11: Report Result
+
+Provide the user with:
+1. **PR URL** - The created pull request link
+2. **Verification Summary** - Which checks passed/failed
+3. **Unchecked Items** - List any checkboxes left unchecked and why
+4. **User Action Required** - Remind user to:
+   - Review and set manual-verification checkboxes ("I understand the code..." and "Any generated code...") as applicable
+   - Consider reviewing two other open PRs
+   - Add any related issue numbers if applicable

.claude/skills/github-pr-reviewer/SKILL.md

@@ -0,0 +1,38 @@
+---
+name: github-pr-reviewer
+description: Reviews GitHub pull requests and provides feedback comments. This is the top skill to use for reviewing Pull Requests from GitHub.
+---
+
+# Review GitHub Pull Request
+
+## Follow these steps:
+1. Use 'gh pr view' to get the PR details and description.
+2. Use 'gh pr diff' to see all the changes in the PR.
+3. Analyze the code changes for:
+   - Code quality and style consistency
+   - Potential bugs or issues
+   - Performance implications
+   - Security concerns
+   - Test coverage
+   - Documentation updates if needed
+4. Ensure any existing review comments have been addressed.
+5. Generate constructive review comments in the CONSOLE. DO NOT POST TO GITHUB YOURSELF.
+
+## IMPORTANT:
+- Just review. DO NOT make any changes
+- Be constructive and specific in your comments
+- Suggest improvements where appropriate
+- Only provide review feedback in the CONSOLE. DO NOT ACT ON GITHUB.
+- No need to run tests or linters, just review the code changes.
+- No need to highlight things that are already good.
+
+## Output format:
+- List specific comments for each file/line that needs attention
+- In the end, summarize with an overall assessment (approve, request changes, or comment) and bullet point list of changes suggested, if any.
+  - Example output:
+    ```
+    Overall assessment: request changes.
+    - [CRITICAL] Memory leak in homeassistant/components/sensor/my_sensor.py:143
+    - [PROBLEM] Inefficient algorithm in homeassistant/helpers/data_processing.py:87
+    - [SUGGESTION] Improve variable naming in homeassistant/helpers/config_validation.py:45
+    ```

.claude/skills/integrations/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: Home Assistant Integration knowledge
+description: Everything you need to know to build, test and review Home Assistant Integrations. If you're looking at an integration, you must use this as your primary reference.
+---
+
+## File Locations
+- **Integration code**: `./homeassistant/components/<integration_domain>/`
+- **Integration tests**: `./tests/components/<integration_domain>/`
+
+## General guidelines
+
+- When looking for examples, prefer integrations with the platinum or gold quality scale level first.
+- Polling intervals are NOT user-configurable. Never add scan_interval, update_interval, or polling frequency options to config flows or config entries.
+- Do NOT allow users to set config entry names in config flows. Names are automatically generated or can be customized later in UI. Exception: helper integrations may allow custom names.
+- For entity actions and entity services, avoid requesting redundant defensive checks for fields already enforced by Home Assistant validation schemas and entity filters; only request extra guards when values bypass validation or are transformed unsafely.
+- When validation guarantees a key is present, prefer direct dictionary indexing (`data["key"]`) over `.get("key")` so invalid assumptions fail fast.
+
+The following platforms have extra guidelines:
+- **Diagnostics**: [`platform-diagnostics.md`](platform-diagnostics.md) for diagnostic data collection
+- **Repairs**: [`platform-repairs.md`](platform-repairs.md) for user-actionable repair issues
+
+
+## Integration Quality Scale
+
+- When validating the quality scale rules, check them at https://developers.home-assistant.io/docs/core/integration-quality-scale/rules
+- When implementing or reviewing an integration, always consider the quality scale rules, since they promote best practices.
+
+Template scale file: `./script/scaffold/templates/integration/integration/quality_scale.yaml`
+
+### How Rules Apply
+1. **Check `manifest.json`**: Look for `"quality_scale"` key to determine integration level
+2. **Bronze Rules**: Always required for any integration with quality scale
+3. **Higher Tier Rules**: Only apply if integration targets that tier or higher
+4. **Rule Status**: Check `quality_scale.yaml` in integration folder for:
+   - `done`: Rule implemented
+   - `exempt`: Rule doesn't apply (with reason in comment)
+   - `todo`: Rule needs implementation
+
+
+## Testing Requirements
+
+- Tests should avoid interacting or mocking internal integration details. For more info, see https://developers.home-assistant.io/docs/development_testing/#writing-tests-for-integrations

.claude/skills/integrations/platform-diagnostics.md

@@ -0,0 +1,6 @@
+# Integration Diagnostics
+
+Platform exists as `homeassistant/components/<domain>/diagnostics.py`.
+
+- **Required**: Implement diagnostic data collection
+- **Security**: Never expose passwords, tokens, or sensitive coordinates

.claude/skills/integrations/platform-repairs.md

@@ -0,0 +1,21 @@
+# Repairs platform
+
+Platform exists as `homeassistant/components/<domain>/repairs.py`.
+
+- **Actionable Issues Required**: All repair issues must be actionable for end users
+- **Issue Content Requirements**:
+  - Clearly explain what is happening
+  - Provide specific steps users need to take to resolve the issue
+  - Use friendly, helpful language
+  - Include relevant context (device names, error details, etc.)
+- **String Content Must Include**:
+  - What the problem is
+  - Why it matters
+  - Exact steps to resolve (numbered list when multiple steps)
+  - What to expect after following the steps
+- **Avoid Vague Instructions**: Don't just say "update firmware" - provide specific steps
+- **Severity Guidelines**:
+  - `CRITICAL`: Reserved for extreme scenarios only
+  - `ERROR`: Requires immediate user attention
+  - `WARNING`: Indicates future potential breakage
+- Only create issues for problems users can potentially resolve

.core_files.yaml

@@ -13,6 +13,7 @@ core: &core
 
 # Our base platforms, that are used by other integrations
 base_platforms: &base_platforms
+  - homeassistant/components/ai_task/**
   - homeassistant/components/air_quality/**
   - homeassistant/components/alarm_control_panel/**
   - homeassistant/components/assist_satellite/**
@@ -21,6 +22,7 @@ base_platforms: &base_platforms
   - homeassistant/components/calendar/**
   - homeassistant/components/camera/**
   - homeassistant/components/climate/**
+  - homeassistant/components/conversation/**
   - homeassistant/components/cover/**
   - homeassistant/components/date/**
   - homeassistant/components/datetime/**
@@ -32,6 +34,7 @@ base_platforms: &base_platforms
   - homeassistant/components/humidifier/**
   - homeassistant/components/image/**
   - homeassistant/components/image_processing/**
+  - homeassistant/components/infrared/**
   - homeassistant/components/lawn_mower/**
   - homeassistant/components/light/**
   - homeassistant/components/lock/**
@@ -52,12 +55,14 @@ base_platforms: &base_platforms
   - homeassistant/components/update/**
   - homeassistant/components/vacuum/**
   - homeassistant/components/valve/**
+  - homeassistant/components/wake_word/**
   - homeassistant/components/water_heater/**
   - homeassistant/components/weather/**
 
 # Extra components that trigger the full suite
 components: &components
   - homeassistant/components/alexa/**
+  - homeassistant/components/analytics/**
   - homeassistant/components/application_credentials/**
   - homeassistant/components/assist_pipeline/**
   - homeassistant/components/auth/**
@@ -68,7 +73,6 @@ components: &components
   - homeassistant/components/cloud/**
   - homeassistant/components/config/**
   - homeassistant/components/configurator/**
-  - homeassistant/components/conversation/**
   - homeassistant/components/demo/**
   - homeassistant/components/device_automation/**
   - homeassistant/components/dhcp/**
@@ -89,6 +93,7 @@ components: &components
   - homeassistant/components/input_number/**
   - homeassistant/components/input_select/**
   - homeassistant/components/input_text/**
+  - homeassistant/components/labs/**
   - homeassistant/components/logbook/**
   - homeassistant/components/logger/**
   - homeassistant/components/lovelace/**

.devcontainer/devcontainer.json

@@ -8,7 +8,6 @@
     "PYTHONASYNCIODEBUG": "1"
   },
   "features": {
-    "ghcr.io/anthropics/devcontainer-features/claude-code:1.0": {},
     "ghcr.io/devcontainers/features/github-cli:1": {}
   },
   // Port 5683 udp is used by Shelly integration
@@ -25,13 +24,12 @@
         "charliermarsh.ruff",
         "ms-python.pylint",
         "ms-python.vscode-pylance",
-        "visualstudioexptteam.vscodeintellicode",
         "redhat.vscode-yaml",
         "esbenp.prettier-vscode",
         "GitHub.vscode-pull-request-github",
         "GitHub.copilot"
       ],
-      // Please keep this file in sync with settings in home-assistant/.vscode/settings.default.json
+      // Please keep this file in sync with settings in home-assistant/.vscode/settings.default.jsonc
       "settings": {
         "python.experiments.optOutFrom": ["pythonTestAdapter"],
         "python.defaultInterpreterPath": "/home/vscode/.local/ha-venv/bin/python",
@@ -39,6 +37,8 @@
         "python.terminal.activateEnvInCurrentTerminal": true,
         "python.testing.pytestArgs": ["--no-cov"],
         "pylint.importStrategy": "fromEnvironment",
+        // Pyright type checking is not compatible with mypy which Home Assistant uses for type checking
+        "python.analysis.typeCheckingMode": "off",
         "editor.formatOnPaste": false,
         "editor.formatOnSave": true,
         "editor.formatOnType": true,
@@ -60,6 +60,15 @@
         "[python]": {
           "editor.defaultFormatter": "charliermarsh.ruff"
         },
+        "[json]": {
+          "editor.defaultFormatter": "esbenp.prettier-vscode"
+        },
+        "[jsonc]": {
+          "editor.defaultFormatter": "esbenp.prettier-vscode"
+        },
+        "[yaml]": {
+          "editor.defaultFormatter": "esbenp.prettier-vscode"
+        },
         "json.schemas": [
           {
             "fileMatch": ["homeassistant/components/*/manifest.json"],

.dockerignore

@@ -14,7 +14,8 @@ tests
 
 # Other virtualization methods
 venv
+.venv
 .vagrant
 
 # Temporary files
-**/__pycache__
+**/__pycache__

.gemini/skills

@@ -0,0 +1 @@
+../.claude/skills

.gitattributes

@@ -16,6 +16,7 @@ Dockerfile.dev linguist-language=Dockerfile
 CODEOWNERS linguist-generated=true
 Dockerfile linguist-generated=true
 homeassistant/generated/*.py linguist-generated=true
+machine/* linguist-generated=true
 mypy.ini linguist-generated=true
 requirements.txt linguist-generated=true
 requirements_all.txt linguist-generated=true

.github/PULL_REQUEST_TEMPLATE.md

@@ -55,8 +55,12 @@
   creating the PR. If you're unsure about any of them, don't hesitate to ask.
   We're here to help! This is simply a reminder of what we are going to look
   for before merging your code.
+
+  AI tools are welcome, but contributors are responsible for *fully*
+  understanding the code before submitting a PR.
 -->
 
+- [ ] I understand the code I am submitting and can explain how it works.
 - [ ] The code change is tested and works locally.
 - [ ] Local tests pass. **Your PR cannot be merged unless tests pass**
 - [ ] There is no commented out code in this PR.
@@ -64,6 +68,7 @@
 - [ ] I have followed the [perfect PR recommendations][perfect-pr]
 - [ ] The code has been formatted using Ruff (`ruff format homeassistant tests`)
 - [ ] Tests have been added to verify that the new code works.
+- [ ] Any generated code has been carefully reviewed for correctness and compliance with project standards.
 
 If user exposed functionality or configuration variables are added/changed:
 
@@ -75,7 +80,7 @@ If the code communicates with devices, web services, or third-party tools:
       Updated and included derived files by running: `python3 -m script.hassfest`.
 - [ ] New or updated dependencies have been added to `requirements_all.txt`.  
       Updated by running `python3 -m script.gen_requirements_all`.
-- [ ] For the updated dependencies - a link to the changelog, or at minimum a diff between library versions is added to the PR description.
+- [ ] For the updated dependencies a diff between library versions and ideally a link to the changelog/release notes is added to the PR description.
 
 <!--
   This project is very active and we have a high turnover of pull requests.

.github/dependabot.yml

@@ -9,3 +9,5 @@ updates:
     labels:
       - dependency
       - github_actions
+    cooldown:
+      default-days: 7

.github/renovate.json

@@ -0,0 +1,216 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+
+  "enabledManagers": [
+    "pep621",
+    "pip_requirements",
+    "pre-commit",
+    "regex",
+    "homeassistant-manifest"
+  ],
+
+  "pre-commit": {
+    "enabled": true
+  },
+
+  "pip_requirements": {
+    "managerFilePatterns": [
+      "/(^|/)requirements[\\w_-]*\\.txt$/",
+      "/(^|/)homeassistant/package_constraints\\.txt$/"
+    ]
+  },
+
+  "homeassistant-manifest": {
+    "managerFilePatterns": [
+      "/^homeassistant/components/[^/]+/manifest\\.json$/"
+    ]
+  },
+
+  "regexManagers": [
+    {
+      "description": "Update ruff required-version in pyproject.toml",
+      "managerFilePatterns": ["/^pyproject\\.toml$/"],
+      "matchStrings": ["required-version = \">=(?<currentValue>[\\d.]+)\""],
+      "depNameTemplate": "ruff",
+      "datasourceTemplate": "pypi"
+    }
+  ],
+
+  "minimumReleaseAge": "7 days",
+  "prConcurrentLimit": 10,
+  "prHourlyLimit": 2,
+  "schedule": ["before 6am"],
+
+  "semanticCommits": "disabled",
+  "commitMessageAction": "Update",
+  "commitMessageTopic": "{{depName}}",
+  "commitMessageExtra": "to {{newVersion}}",
+
+  "automerge": false,
+
+  "vulnerabilityAlerts": {
+    "enabled": false
+  },
+
+  "packageRules": [
+    {
+      "description": "Deny all by default — allowlist below re-enables specific packages",
+      "matchPackageNames": ["*"],
+      "enabled": false
+    },
+    {
+      "description": "Core runtime dependencies (allowlisted)",
+      "matchPackageNames": [
+        "aiohttp",
+        "aiohttp-fast-zlib",
+        "aiohttp_cors",
+        "aiohttp-asyncmdnsresolver",
+        "yarl",
+        "httpx",
+        "requests",
+        "urllib3",
+        "certifi",
+        "orjson",
+        "PyYAML",
+        "Jinja2",
+        "cryptography",
+        "pyOpenSSL",
+        "PyJWT",
+        "SQLAlchemy",
+        "Pillow",
+        "attrs",
+        "uv",
+        "voluptuous",
+        "voluptuous-serialize",
+        "voluptuous-openapi",
+        "zeroconf"
+      ],
+      "enabled": true,
+      "labels": ["dependency", "core"]
+    },
+    {
+      "description": "Common Python utilities (allowlisted)",
+      "matchPackageNames": [
+        "astral",
+        "atomicwrites-homeassistant",
+        "audioop-lts",
+        "awesomeversion",
+        "bcrypt",
+        "ciso8601",
+        "cronsim",
+        "defusedxml",
+        "fnv-hash-fast",
+        "getmac",
+        "ical",
+        "ifaddr",
+        "lru-dict",
+        "mutagen",
+        "propcache",
+        "pyserial",
+        "python-slugify",
+        "PyTurboJPEG",
+        "securetar",
+        "standard-aifc",
+        "standard-telnetlib",
+        "ulid-transform",
+        "url-normalize",
+        "xmltodict"
+      ],
+      "enabled": true,
+      "labels": ["dependency"]
+    },
+    {
+      "description": "Home Assistant ecosystem packages (core-maintained, no cooldown)",
+      "matchPackageNames": [
+        "hassil",
+        "home-assistant-bluetooth",
+        "home-assistant-frontend",
+        "home-assistant-intents",
+        "infrared-protocols"
+      ],
+      "enabled": true,
+      "minimumReleaseAge": null,
+      "labels": ["dependency", "core"]
+    },
+    {
+      "description": "Test dependencies (allowlisted)",
+      "matchPackageNames": [
+        "pytest",
+        "pytest-asyncio",
+        "pytest-aiohttp",
+        "pytest-cov",
+        "pytest-freezer",
+        "pytest-github-actions-annotate-failures",
+        "pytest-socket",
+        "pytest-sugar",
+        "pytest-timeout",
+        "pytest-unordered",
+        "pytest-picked",
+        "pytest-xdist",
+        "pylint",
+        "pylint-per-file-ignores",
+        "astroid",
+        "coverage",
+        "freezegun",
+        "syrupy",
+        "respx",
+        "requests-mock",
+        "ruff",
+        "codespell",
+        "yamllint",
+        "zizmor"
+      ],
+      "enabled": true,
+      "labels": ["dependency"]
+    },
+    {
+      "description": "For types-* stubs, only allow patch updates. Major/minor bumps track the upstream runtime package version and must be manually coordinated with the corresponding pin.",
+      "matchPackageNames": ["/^types-/"],
+      "matchUpdateTypes": ["patch"],
+      "enabled": true,
+      "labels": ["dependency"]
+    },
+    {
+      "description": "Pre-commit hook repos (allowlisted, matched by owner/repo)",
+      "matchPackageNames": [
+        "astral-sh/ruff-pre-commit",
+        "codespell-project/codespell",
+        "adrienverge/yamllint",
+        "zizmorcore/zizmor-pre-commit"
+      ],
+      "enabled": true,
+      "labels": ["dependency"]
+    },
+    {
+      "description": "Group ruff pre-commit hook with its PyPI twin into one PR",
+      "matchPackageNames": ["astral-sh/ruff-pre-commit", "ruff"],
+      "groupName": "ruff",
+      "groupSlug": "ruff"
+    },
+    {
+      "description": "Group codespell pre-commit hook with its PyPI twin into one PR",
+      "matchPackageNames": ["codespell-project/codespell", "codespell"],
+      "groupName": "codespell",
+      "groupSlug": "codespell"
+    },
+    {
+      "description": "Group yamllint pre-commit hook with its PyPI twin into one PR",
+      "matchPackageNames": ["adrienverge/yamllint", "yamllint"],
+      "groupName": "yamllint",
+      "groupSlug": "yamllint"
+    },
+    {
+      "description": "Group zizmor pre-commit hook with its PyPI twin into one PR",
+      "matchPackageNames": ["zizmorcore/zizmor-pre-commit", "zizmor"],
+      "groupName": "zizmor",
+      "groupSlug": "zizmor"
+    },
+    {
+      "description": "Group pylint with astroid (their versions are linked and must move together)",
+      "matchPackageNames": ["pylint", "astroid"],
+      "groupName": "pylint",
+      "groupSlug": "pylint"
+    }
+  ]
+}

.github/workflows/builder.yml

@@ -10,44 +10,51 @@ on:
 
 env:
   BUILD_TYPE: core
-  DEFAULT_PYTHON: "3.13"
   PIP_TIMEOUT: 60
   UV_HTTP_TIMEOUT: 60
   UV_SYSTEM_PYTHON: "true"
+  # Base image version from https://github.com/home-assistant/docker
+  BASE_IMAGE_VERSION: "2026.01.0"
+  ARCHITECTURES: '["amd64", "aarch64"]'
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   init:
     name: Initialize build
     if: github.repository_owner == 'home-assistant'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # To check out the repository
     outputs:
-      architectures: ${{ steps.info.outputs.architectures }}
       version: ${{ steps.version.outputs.version }}
       channel: ${{ steps.version.outputs.channel }}
       publish: ${{ steps.version.outputs.publish }}
+      architectures: ${{ env.ARCHITECTURES }}
+      base_image_version: ${{ env.BASE_IMAGE_VERSION }}
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          fetch-depth: 0
+          persist-credentials: false
 
-      - name: Set up Python ${{ env.DEFAULT_PYTHON }}
-        uses: actions/setup-python@v5.6.0
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: ${{ env.DEFAULT_PYTHON }}
-
-      - name: Get information
-        id: info
-        uses: home-assistant/actions/helpers/info@master
+          python-version-file: ".python-version"
 
       - name: Get version
         id: version
-        uses: home-assistant/actions/helpers/version@master
+        uses: home-assistant/actions/helpers/version@master # zizmor: ignore[unpinned-uses]
         with:
           type: ${{ env.BUILD_TYPE }}
 
       - name: Verify version
-        uses: home-assistant/actions/helpers/verify-version@master
+        uses: home-assistant/actions/helpers/verify-version@master # zizmor: ignore[unpinned-uses]
         with:
           ignore-dev: true
 
@@ -62,14 +69,14 @@ jobs:
       - name: Download Translations
         run: python3 -m script.translations download
         env:
-          LOKALISE_TOKEN: ${{ secrets.LOKALISE_TOKEN }}
+          LOKALISE_TOKEN: ${{ secrets.LOKALISE_TOKEN }} # zizmor: ignore[secrets-outside-env]
 
       - name: Archive translations
         shell: bash
         run: find ./homeassistant/components/*/translations -name "*.json" | tar zcvf translations.tar.gz -T -
 
       - name: Upload translations
-        uses: actions/upload-artifact@v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: translations
           path: translations.tar.gz
@@ -79,22 +86,29 @@ jobs:
     name: Build ${{ matrix.arch }} base core image
     if: github.repository_owner == 'home-assistant'
     needs: init
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.os }}
     permissions:
-      contents: read
-      packages: write
-      id-token: write
+      contents: read # To check out the repository
+      packages: write # To push to GHCR
+      id-token: write # For cosign signing
     strategy:
       fail-fast: false
       matrix:
         arch: ${{ fromJson(needs.init.outputs.architectures) }}
+        include:
+          - arch: amd64
+            os: ubuntu-24.04
+          - arch: aarch64
+            os: ubuntu-24.04-arm
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Download nightly wheels of frontend
         if: needs.init.outputs.channel == 'dev'
-        uses: dawidd6/action-download-artifact@v11
+        uses: dawidd6/action-download-artifact@8305c0f1062bb0d184d09ef4493ecb9288447732 # v20
         with:
           github_token: ${{secrets.GITHUB_TOKEN}}
           repo: home-assistant/frontend
@@ -105,7 +119,7 @@ jobs:
 
       - name: Download nightly wheels of intents
         if: needs.init.outputs.channel == 'dev'
-        uses: dawidd6/action-download-artifact@v11
+        uses: dawidd6/action-download-artifact@8305c0f1062bb0d184d09ef4493ecb9288447732 # v20
         with:
           github_token: ${{secrets.GITHUB_TOKEN}}
           repo: OHF-Voice/intents-package
@@ -114,22 +128,23 @@ jobs:
           workflow_conclusion: success
           name: package
 
-      - name: Set up Python ${{ env.DEFAULT_PYTHON }}
+      - name: Set up Python
         if: needs.init.outputs.channel == 'dev'
-        uses: actions/setup-python@v5.6.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: ${{ env.DEFAULT_PYTHON }}
+          python-version-file: ".python-version"
 
       - name: Adjust nightly version
         if: needs.init.outputs.channel == 'dev'
         shell: bash
         env:
           UV_PRERELEASE: allow
+          VERSION: ${{ needs.init.outputs.version }}
         run: |
           python3 -m pip install "$(grep '^uv' < requirements.txt)"
           uv pip install packaging tomli
           uv pip install .
-          python3 script/version_bump.py nightly --set-nightly-version "${{ needs.init.outputs.version }}"
+          python3 script/version_bump.py nightly --set-nightly-version "${VERSION}"
 
           if [[ "$(ls home_assistant_frontend*.whl)" =~ ^home_assistant_frontend-(.*)-py3-none-any.whl$ ]]; then
             echo "Found frontend wheel, setting version to: ${BASH_REMATCH[1]}"
@@ -159,23 +174,11 @@ jobs:
             sed -i "s|home-assistant-intents==.*|home-assistant-intents==${BASH_REMATCH[1]}|" \
               homeassistant/package_constraints.txt
 
-            sed -i "s|home-assistant-intents==.*||" requirements_all.txt
+            sed -i "s|home-assistant-intents==.*||" requirements_all.txt requirements.txt
           fi
 
-      - name: Adjustments for armhf
-        if: matrix.arch == 'armhf'
-        run: |
-          # Pandas has issues building on armhf, it is expected they
-          # will drop the platform in the near future (they consider it
-          # "flimsy" on 386). The following packages depend on pandas,
-          # so we comment them out.
-          sed -i "s|env-canada|# env-canada|g" requirements_all.txt
-          sed -i "s|noaa-coops|# noaa-coops|g" requirements_all.txt
-          sed -i "s|pyezviz|# pyezviz|g" requirements_all.txt
-          sed -i "s|pykrakenapi|# pykrakenapi|g" requirements_all.txt
-
       - name: Download translations
-        uses: actions/download-artifact@v5.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: translations
 
@@ -187,89 +190,97 @@ jobs:
       - name: Write meta info file
         shell: bash
         run: |
-          echo "${{ github.sha }};${{ github.ref }};${{ github.event_name }};${{ github.actor }}" > rootfs/OFFICIAL_IMAGE
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3.5.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          echo "${GITHUB_SHA};${GITHUB_REF};${GITHUB_EVENT_NAME};${GITHUB_ACTOR}" > rootfs/OFFICIAL_IMAGE
 
       - name: Build base image
-        uses: home-assistant/builder@2025.03.0
+        uses: home-assistant/builder/actions/build-image@62a1597b84b3461abad9816d9cd92862a2b542c3 # 2026.03.2
         with:
-          args: |
-            $BUILD_ARGS \
-            --${{ matrix.arch }} \
-            --cosign \
-            --target /data \
-            --generic ${{ needs.init.outputs.version }}
+          arch: ${{ matrix.arch }}
+          build-args: |
+            BUILD_FROM=ghcr.io/home-assistant/${{ matrix.arch }}-homeassistant-base:${{ needs.init.outputs.base_image_version }}
+          cache-gha: false
+          container-registry-password: ${{ secrets.GITHUB_TOKEN }}
+          cosign-base-identity: "https://github.com/home-assistant/docker/.*"
+          cosign-base-verify: ghcr.io/home-assistant/${{ matrix.arch }}-homeassistant-base:${{ needs.init.outputs.base_image_version }}
+          image: ghcr.io/home-assistant/${{ matrix.arch }}-homeassistant
+          image-tags: ${{ needs.init.outputs.version }}
+          push: true
+          version: ${{ needs.init.outputs.version }}
 
   build_machine:
     name: Build ${{ matrix.machine }} machine core image
     if: github.repository_owner == 'home-assistant'
     needs: ["init", "build_base"]
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.runs-on }}
     permissions:
-      contents: read
-      packages: write
-      id-token: write
+      contents: read # To check out the repository
+      packages: write # To push to GHCR
+      id-token: write # For cosign signing
     strategy:
       matrix:
         machine:
           - generic-x86-64
-          - intel-nuc
           - khadas-vim3
           - odroid-c2
           - odroid-c4
           - odroid-m1
           - odroid-n2
-          - odroid-xu
-          - qemuarm
           - qemuarm-64
-          - qemux86
           - qemux86-64
-          - raspberrypi
-          - raspberrypi2
-          - raspberrypi3
           - raspberrypi3-64
-          - raspberrypi4
           - raspberrypi4-64
           - raspberrypi5-64
-          - tinker
           - yellow
           - green
+        include:
+          # Default: aarch64 on native ARM runner
+          - arch: aarch64
+            runs-on: ubuntu-24.04-arm
+          # Overrides for amd64 machines
+          - machine: generic-x86-64
+            arch: amd64
+            runs-on: ubuntu-24.04
+          - machine: qemux86-64
+            arch: amd64
+            runs-on: ubuntu-24.04
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
-      - name: Set build additional args
+      - name: Compute extra tags
+        id: tags
+        shell: bash
+        env:
+          VERSION: ${{ needs.init.outputs.version }}
         run: |
-          # Create general tags
-          if [[ "${{ needs.init.outputs.version }}" =~ d ]]; then
-            echo "BUILD_ARGS=--additional-tag dev" >> $GITHUB_ENV
-          elif [[ "${{ needs.init.outputs.version }}" =~ b ]]; then
-            echo "BUILD_ARGS=--additional-tag beta" >> $GITHUB_ENV
+          if [[ "${VERSION}" =~ d ]]; then
+            echo "extra_tags=dev" >> "$GITHUB_OUTPUT"
+          elif [[ "${VERSION}" =~ b ]]; then
+            echo "extra_tags=beta" >> "$GITHUB_OUTPUT"
           else
-            echo "BUILD_ARGS=--additional-tag stable" >> $GITHUB_ENV
+            echo "extra_tags=stable" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3.5.0
+      - name: Build machine image
+        uses: home-assistant/builder/actions/build-image@62a1597b84b3461abad9816d9cd92862a2b542c3 # 2026.03.2
         with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build base image
-        uses: home-assistant/builder@2025.03.0
-        with:
-          args: |
-            $BUILD_ARGS \
-            --target /data/machine \
-            --cosign \
-            --machine "${{ needs.init.outputs.version }}=${{ matrix.machine }}"
+          arch: ${{ matrix.arch }}
+          build-args: |
+            BUILD_FROM=ghcr.io/home-assistant/${{ matrix.arch }}-homeassistant:${{ needs.init.outputs.version }}
+          cache-gha: false
+          container-registry-password: ${{ secrets.GITHUB_TOKEN }}
+          context: machine/
+          cosign-base-identity: "https://github.com/home-assistant/core/.*"
+          cosign-base-verify: ghcr.io/home-assistant/${{ matrix.arch }}-homeassistant:${{ needs.init.outputs.version }}
+          file: machine/${{ matrix.machine }}
+          image: ghcr.io/home-assistant/${{ matrix.machine }}-homeassistant
+          image-tags: |
+            ${{ needs.init.outputs.version }}
+            ${{ steps.tags.outputs.extra_tags }}
+          push: true
+          version: ${{ needs.init.outputs.version }}
 
   publish_ha:
     name: Publish version files
@@ -277,33 +288,39 @@ jobs:
     if: github.repository_owner == 'home-assistant'
     needs: ["init", "build_machine"]
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Initialize git
-        uses: home-assistant/actions/helpers/git-init@master
+        uses: home-assistant/actions/helpers/git-init@master # zizmor: ignore[unpinned-uses]
         with:
           name: ${{ secrets.GIT_NAME }}
           email: ${{ secrets.GIT_EMAIL }}
           token: ${{ secrets.GIT_TOKEN }}
 
       - name: Update version file
-        uses: home-assistant/actions/helpers/version-push@master
+        uses: home-assistant/actions/helpers/version-push@master # zizmor: ignore[unpinned-uses]
         with:
           key: "homeassistant[]"
           key-description: "Home Assistant Core"
           version: ${{ needs.init.outputs.version }}
           channel: ${{ needs.init.outputs.channel }}
+          exclude-list: '["odroid-xu","qemuarm","qemux86","raspberrypi","raspberrypi2","raspberrypi3","raspberrypi4","tinker"]'
 
       - name: Update version file (stable -> beta)
         if: needs.init.outputs.channel == 'stable'
-        uses: home-assistant/actions/helpers/version-push@master
+        uses: home-assistant/actions/helpers/version-push@master # zizmor: ignore[unpinned-uses]
         with:
           key: "homeassistant[]"
           key-description: "Home Assistant Core"
           version: ${{ needs.init.outputs.version }}
           channel: beta
+          exclude-list: '["odroid-xu","qemuarm","qemux86","raspberrypi","raspberrypi2","raspberrypi3","raspberrypi4","tinker"]'
 
   publish_container:
     name: Publish meta container for ${{ matrix.registry }}
@@ -312,136 +329,136 @@ jobs:
     needs: ["init", "build_base"]
     runs-on: ubuntu-latest
     permissions:
-      contents: read
-      packages: write
-      id-token: write
+      contents: read # To check out the repository
+      packages: write # To push to GHCR
+      id-token: write # For cosign signing
     strategy:
       fail-fast: false
       matrix:
         registry: ["ghcr.io/home-assistant", "docker.io/homeassistant"]
     steps:
-      - name: Checkout the repository
-        uses: actions/checkout@v5.0.0
-
       - name: Install Cosign
-        uses: sigstore/cosign-installer@v3.9.2
+        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
         with:
-          cosign-release: "v2.2.3"
+          cosign-release: "v2.5.3"
 
       - name: Login to DockerHub
         if: matrix.registry == 'docker.io/homeassistant'
-        uses: docker/login-action@v3.5.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to GitHub Container Registry
-        if: matrix.registry == 'ghcr.io/home-assistant'
-        uses: docker/login-action@v3.5.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Build Meta Image
+      - name: Verify architecture image signatures
         shell: bash
+        env:
+          ARCHITECTURES: ${{ needs.init.outputs.architectures }}
+          VERSION: ${{ needs.init.outputs.version }}
         run: |
-          export DOCKER_CLI_EXPERIMENTAL=enabled
+          ARCHS=$(echo "${ARCHITECTURES}" | jq -r '.[]')
+          for arch in $ARCHS; do
+            echo "Verifying ${arch} image signature..."
+            cosign verify \
+              --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+              --certificate-identity-regexp https://github.com/home-assistant/core/.* \
+              "ghcr.io/home-assistant/${arch}-homeassistant:${VERSION}"
+          done
+          echo "✓ All images verified successfully"
 
-          function create_manifest() {
-            local tag_l=${1}
-            local tag_r=${2}
-            local registry=${{ matrix.registry }}
+      # Generate all Docker tags based on version string
+      # Version format: YYYY.MM.PATCH, YYYY.MM.PATCHbN (beta), or YYYY.MM.PATCH.devYYYYMMDDHHMM (dev)
+      # Examples:
+      #   2025.12.1     (stable)    -> tags: 2025.12.1, 2025.12, stable, latest, beta, rc
+      #   2025.12.0b3   (beta)      -> tags: 2025.12.0b3, beta, rc
+      #   2025.12.0.dev202511250240 -> tags: 2025.12.0.dev202511250240, dev
+      - name: Generate Docker metadata
+        id: meta
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+        with:
+          images: ${{ matrix.registry }}/home-assistant
+          sep-tags: ","
+          tags: |
+            type=raw,value=${{ needs.init.outputs.version }},priority=9999
+            type=raw,value=dev,enable=${{ contains(needs.init.outputs.version, 'd') }}
+            type=raw,value=beta,enable=${{ !contains(needs.init.outputs.version, 'd') }}
+            type=raw,value=rc,enable=${{ !contains(needs.init.outputs.version, 'd') }}
+            type=raw,value=stable,enable=${{ !contains(needs.init.outputs.version, 'd') && !contains(needs.init.outputs.version, 'b') }}
+            type=raw,value=latest,enable=${{ !contains(needs.init.outputs.version, 'd') && !contains(needs.init.outputs.version, 'b') }}
+            type=semver,pattern={{major}}.{{minor}},value=${{ needs.init.outputs.version }},enable=${{ !contains(needs.init.outputs.version, 'd') && !contains(needs.init.outputs.version, 'b') }}
 
-            docker manifest create "${registry}/home-assistant:${tag_l}" \
-              "${registry}/amd64-homeassistant:${tag_r}" \
-              "${registry}/i386-homeassistant:${tag_r}" \
-              "${registry}/armhf-homeassistant:${tag_r}" \
-              "${registry}/armv7-homeassistant:${tag_r}" \
-              "${registry}/aarch64-homeassistant:${tag_r}"
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v3.7.1
 
-            docker manifest annotate "${registry}/home-assistant:${tag_l}" \
-              "${registry}/amd64-homeassistant:${tag_r}" \
-              --os linux --arch amd64
+      - name: Copy architecture images to DockerHub
+        if: matrix.registry == 'docker.io/homeassistant'
+        shell: bash
+        env:
+          ARCHITECTURES: ${{ needs.init.outputs.architectures }}
+          VERSION: ${{ needs.init.outputs.version }}
+        run: |
+          # Use imagetools to copy image blobs directly between registries
+          # This preserves provenance/attestations and seems to be much faster than pull/push
+          ARCHS=$(echo "${ARCHITECTURES}" | jq -r '.[]')
+          for arch in $ARCHS; do
+            echo "Copying ${arch} image to DockerHub..."
+            for attempt in 1 2 3; do
+              if docker buildx imagetools create \
+                --tag "docker.io/homeassistant/${arch}-homeassistant:${VERSION}" \
+                "ghcr.io/home-assistant/${arch}-homeassistant:${VERSION}"; then
+                break
+              fi
+              echo "Attempt ${attempt} failed, retrying in 10 seconds..."
+              sleep 10
+              if [ "${attempt}" -eq 3 ]; then
+                echo "Failed after 3 attempts"
+                exit 1
+              fi
+            done
+            cosign sign --yes "docker.io/homeassistant/${arch}-homeassistant:${VERSION}"
+          done
 
-            docker manifest annotate "${registry}/home-assistant:${tag_l}" \
-              "${registry}/i386-homeassistant:${tag_r}" \
-              --os linux --arch 386
+      - name: Create and push multi-arch manifests
+        shell: bash
+        env:
+          ARCHITECTURES: ${{ needs.init.outputs.architectures }}
+          REGISTRY: ${{ matrix.registry }}
+          VERSION: ${{ needs.init.outputs.version }}
+          META_TAGS: ${{ steps.meta.outputs.tags }}
+        run: |
+          # Build list of architecture images dynamically
+          ARCHS=$(echo "${ARCHITECTURES}" | jq -r '.[]')
+          ARCH_IMAGES=()
+          for arch in $ARCHS; do
+            ARCH_IMAGES+=("${REGISTRY}/${arch}-homeassistant:${VERSION}")
+          done
 
-            docker manifest annotate "${registry}/home-assistant:${tag_l}" \
-              "${registry}/armhf-homeassistant:${tag_r}" \
-              --os linux --arch arm --variant=v6
+          # Build list of all tags for single manifest creation
+          # Note: Using sep-tags=',' in metadata-action for easier parsing
+          TAG_ARGS=()
+          IFS=',' read -ra TAGS <<< "${META_TAGS}"
+          for tag in "${TAGS[@]}"; do
+            TAG_ARGS+=("--tag" "${tag}")
+          done
 
-            docker manifest annotate "${registry}/home-assistant:${tag_l}" \
-              "${registry}/armv7-homeassistant:${tag_r}" \
-              --os linux --arch arm --variant=v7
+          # Create manifest with ALL tags in a single operation (much faster!)
+          echo "Creating multi-arch manifest with tags: ${TAGS[*]}"
+          docker buildx imagetools create "${TAG_ARGS[@]}" "${ARCH_IMAGES[@]}"
 
-            docker manifest annotate "${registry}/home-assistant:${tag_l}" \
-              "${registry}/aarch64-homeassistant:${tag_r}" \
-              --os linux --arch arm64 --variant=v8
+          # Sign each tag separately (signing requires individual tag names)
+          echo "Signing all tags..."
+          for tag in "${TAGS[@]}"; do
+            echo "Signing ${tag}"
+            cosign sign --yes "${tag}"
+          done
 
-            docker manifest push --purge "${registry}/home-assistant:${tag_l}"
-            cosign sign --yes "${registry}/home-assistant:${tag_l}"
-          }
-
-          function validate_image() {
-            local image=${1}
-            if ! cosign verify --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp https://github.com/home-assistant/core/.* "${image}"; then
-              echo "Invalid signature!"
-              exit 1
-            fi
-          }
-
-          function push_dockerhub() {
-            local image=${1}
-            local tag=${2}
-
-            docker tag "ghcr.io/home-assistant/${image}:${tag}" "docker.io/homeassistant/${image}:${tag}"
-            docker push "docker.io/homeassistant/${image}:${tag}"
-            cosign sign --yes "docker.io/homeassistant/${image}:${tag}"
-          }
-
-          # Pull images from github container registry and verify signature
-          docker pull "ghcr.io/home-assistant/amd64-homeassistant:${{ needs.init.outputs.version }}"
-          docker pull "ghcr.io/home-assistant/i386-homeassistant:${{ needs.init.outputs.version }}"
-          docker pull "ghcr.io/home-assistant/armhf-homeassistant:${{ needs.init.outputs.version }}"
-          docker pull "ghcr.io/home-assistant/armv7-homeassistant:${{ needs.init.outputs.version }}"
-          docker pull "ghcr.io/home-assistant/aarch64-homeassistant:${{ needs.init.outputs.version }}"
-
-          validate_image "ghcr.io/home-assistant/amd64-homeassistant:${{ needs.init.outputs.version }}"
-          validate_image "ghcr.io/home-assistant/i386-homeassistant:${{ needs.init.outputs.version }}"
-          validate_image "ghcr.io/home-assistant/armhf-homeassistant:${{ needs.init.outputs.version }}"
-          validate_image "ghcr.io/home-assistant/armv7-homeassistant:${{ needs.init.outputs.version }}"
-          validate_image "ghcr.io/home-assistant/aarch64-homeassistant:${{ needs.init.outputs.version }}"
-
-          if [[ "${{ matrix.registry }}" ==  "docker.io/homeassistant" ]]; then
-            # Upload images to dockerhub
-            push_dockerhub "amd64-homeassistant" "${{ needs.init.outputs.version }}"
-            push_dockerhub "i386-homeassistant" "${{ needs.init.outputs.version }}"
-            push_dockerhub "armhf-homeassistant" "${{ needs.init.outputs.version }}"
-            push_dockerhub "armv7-homeassistant" "${{ needs.init.outputs.version }}"
-            push_dockerhub "aarch64-homeassistant" "${{ needs.init.outputs.version }}"
-          fi
-
-          # Create version tag
-          create_manifest "${{ needs.init.outputs.version }}" "${{ needs.init.outputs.version }}"
-
-          # Create general tags
-          if [[ "${{ needs.init.outputs.version }}" =~ d ]]; then
-            create_manifest "dev" "${{ needs.init.outputs.version }}"
-          elif [[ "${{ needs.init.outputs.version }}" =~ b ]]; then
-            create_manifest "beta" "${{ needs.init.outputs.version }}"
-            create_manifest "rc" "${{ needs.init.outputs.version }}"
-          else
-            create_manifest "stable" "${{ needs.init.outputs.version }}"
-            create_manifest "latest" "${{ needs.init.outputs.version }}"
-            create_manifest "beta" "${{ needs.init.outputs.version }}"
-            create_manifest "rc" "${{ needs.init.outputs.version }}"
-
-            # Create series version tag (e.g. 2021.6)
-            v="${{ needs.init.outputs.version }}"
-            create_manifest "${v%.*}" "${{ needs.init.outputs.version }}"
-          fi
+          echo "All manifests created and signed successfully"
 
   build_python:
     name: Build PyPi package
@@ -449,20 +466,22 @@ jobs:
     needs: ["init", "build_base"]
     runs-on: ubuntu-latest
     permissions:
-      contents: read
-      id-token: write
+      contents: read # To check out the repository
+      id-token: write # For PyPI trusted publishing
     if: github.repository_owner == 'home-assistant' && needs.init.outputs.publish == 'true'
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v5.0.0
-
-      - name: Set up Python ${{ env.DEFAULT_PYTHON }}
-        uses: actions/setup-python@v5.6.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          python-version: ${{ env.DEFAULT_PYTHON }}
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version-file: ".python-version"
 
       - name: Download translations
-        uses: actions/download-artifact@v5.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: translations
 
@@ -480,7 +499,7 @@ jobs:
           python -m build
 
       - name: Upload package to PyPI
-        uses: pypa/gh-action-pypi-publish@v1.12.4
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
         with:
           skip-existing: true
 
@@ -488,10 +507,10 @@ jobs:
     name: Build and test hassfest image
     runs-on: ubuntu-latest
     permissions:
-      contents: read
-      packages: write
-      attestations: write
-      id-token: write
+      contents: read # To check out the repository
+      packages: write # To push to GHCR
+      attestations: write # For build provenance attestation
+      id-token: write # For build provenance attestation
     needs: ["init"]
     if: github.repository_owner == 'home-assistant'
     env:
@@ -499,17 +518,19 @@ jobs:
       HASSFEST_IMAGE_TAG: ghcr.io/home-assistant/hassfest:${{ needs.init.outputs.version }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build Docker image
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
         with:
           context: . # So action will not pull the repository again
           file: ./script/hassfest/docker/Dockerfile
@@ -517,12 +538,12 @@ jobs:
           tags: ${{ env.HASSFEST_IMAGE_TAG }}
 
       - name: Run hassfest against core
-        run: docker run --rm -v ${{ github.workspace }}:/github/workspace ${{ env.HASSFEST_IMAGE_TAG }} --core-path=/github/workspace
+        run: docker run --rm -v "${GITHUB_WORKSPACE}":/github/workspace "${HASSFEST_IMAGE_TAG}" --core-path=/github/workspace
 
       - name: Push Docker image
         if: needs.init.outputs.channel != 'dev' && needs.init.outputs.publish == 'true'
         id: push
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
         with:
           context: . # So action will not pull the repository again
           file: ./script/hassfest/docker/Dockerfile
@@ -531,7 +552,7 @@ jobs:
 
       - name: Generate artifact attestation
         if: needs.init.outputs.channel != 'dev' && needs.init.outputs.publish == 'true'
-        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
         with:
           subject-name: ${{ env.HASSFEST_IMAGE_NAME }}
           subject-digest: ${{ steps.push.outputs.digest }}

.github/workflows/codeql.yml

@@ -5,6 +5,8 @@ on:
   schedule:
     - cron: "30 18 * * 4"
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -15,20 +17,22 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 360
     permissions:
-      actions: read
-      contents: read
-      security-events: write
+      actions: read # To read workflow information for CodeQL
+      contents: read # To check out the repository
+      security-events: write # To upload CodeQL results
 
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3.29.9
+        uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
         with:
           languages: python
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3.29.9
+        uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
         with:
           category: "/language:python"

.github/workflows/detect-duplicate-issues.yml

@@ -5,18 +5,23 @@ on:
   issues:
     types: [labeled]
 
-permissions:
-  issues: write
-  models: read
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.issue.number }}
 
 jobs:
   detect-duplicates:
+    name: Detect duplicate issues
     runs-on: ubuntu-latest
+    permissions:
+      issues: write # To comment on and label issues
+      models: read # For AI-based duplicate detection
 
     steps:
       - name: Check if integration label was added and extract details
         id: extract
-        uses: actions/github-script@v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             // Debug: Log the event payload
@@ -113,7 +118,7 @@ jobs:
       - name: Fetch similar issues
         id: fetch_similar
         if: steps.extract.outputs.should_continue == 'true'
-        uses: actions/github-script@v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           INTEGRATION_LABELS: ${{ steps.extract.outputs.integration_labels }}
           CURRENT_NUMBER: ${{ steps.extract.outputs.current_number }}
@@ -231,7 +236,7 @@ jobs:
       - name: Detect duplicates using AI
         id: ai_detection
         if: steps.extract.outputs.should_continue == 'true' && steps.fetch_similar.outputs.has_similar == 'true'
-        uses: actions/ai-inference@v2.0.0
+        uses: actions/ai-inference@e09e65981758de8b2fdab13c2bfb7c7d5493b0b6 # v2.0.7
         with:
           model: openai/gpt-4o
           system-prompt: |
@@ -280,7 +285,7 @@ jobs:
       - name: Post duplicate detection results
         id: post_results
         if: steps.extract.outputs.should_continue == 'true' && steps.fetch_similar.outputs.has_similar == 'true'
-        uses: actions/github-script@v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           AI_RESPONSE: ${{ steps.ai_detection.outputs.response }}
           SIMILAR_ISSUES: ${{ steps.fetch_similar.outputs.similar_issues }}

.github/workflows/detect-non-english-issues.yml

@@ -5,18 +5,23 @@ on:
   issues:
     types: [opened]
 
-permissions:
-  issues: write
-  models: read
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.issue.number }}
 
 jobs:
   detect-language:
+    name: Detect non-English issues
     runs-on: ubuntu-latest
+    permissions:
+      issues: write # To comment on, label, and close issues
+      models: read # For AI-based language detection
 
     steps:
       - name: Check issue language
         id: detect_language
-        uses: actions/github-script@v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           ISSUE_NUMBER: ${{ github.event.issue.number }}
           ISSUE_TITLE: ${{ github.event.issue.title }}
@@ -57,7 +62,7 @@ jobs:
       - name: Detect language using AI
         id: ai_language_detection
         if: steps.detect_language.outputs.should_continue == 'true'
-        uses: actions/ai-inference@v2.0.0
+        uses: actions/ai-inference@e09e65981758de8b2fdab13c2bfb7c7d5493b0b6 # v2.0.7
         with:
           model: openai/gpt-4o-mini
           system-prompt: |
@@ -90,7 +95,7 @@ jobs:
 
       - name: Process non-English issues
         if: steps.detect_language.outputs.should_continue == 'true'
-        uses: actions/github-script@v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           AI_RESPONSE: ${{ steps.ai_language_detection.outputs.response }}
           ISSUE_NUMBER: ${{ steps.detect_language.outputs.issue_number }}

.github/workflows/lock.yml

@@ -5,12 +5,22 @@ on:
   schedule:
     - cron: "0 * * * *"
 
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
 jobs:
   lock:
+    name: Lock inactive threads
     if: github.repository_owner == 'home-assistant'
     runs-on: ubuntu-latest
+    permissions:
+      issues: write # To lock issues
+      pull-requests: write # To lock pull requests
     steps:
-      - uses: dessant/lock-threads@v5.0.1
+      - uses: dessant/lock-threads@7266a7ce5c1df01b1c6db85bf8cd86c737dadbe7 # v6.0.0
         with:
           github-token: ${{ github.token }}
           issue-inactive-days: "30"

.github/workflows/matchers/check-executables-have-shebangs.json

@@ -4,7 +4,7 @@
       "owner": "check-executables-have-shebangs",
       "pattern": [
         {
-          "regexp": "^(.+):\\s(.+)$",
+          "regexp": "^(.+):\\s(marked executable but has no \\(or invalid\\) shebang!.*)$",
           "file": 1,
           "message": 2
         }

.github/workflows/restrict-task-creation.yml

@@ -5,14 +5,44 @@ on:
   issues:
     types: [opened]
 
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.issue.number }}
+
 jobs:
-  check-authorization:
+  add-no-stale:
+    name: Add no-stale label
     runs-on: ubuntu-latest
+    permissions:
+      issues: write # To add labels to issues
+    if: >-
+      github.event.issue.type.name == 'Task'
+      || github.event.issue.type.name == 'Epic'
+      || github.event.issue.type.name == 'Opportunity'
+    steps:
+      - name: Add no-stale label
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            await github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              labels: ['no-stale']
+            });
+
+  check-authorization:
+    name: Check authorization
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read # To read CODEOWNERS file
+      issues: write # To comment on, label, and close issues
     # Only run if this is a Task issue type (from the issue form)
     if: github.event.issue.type.name == 'Task'
     steps:
       - name: Check if user is authorized
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const issueAuthor = context.payload.issue.user.login;

.github/workflows/stale.yml

@@ -6,10 +6,20 @@ on:
     - cron: "0 * * * *"
   workflow_dispatch:
 
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
 jobs:
   stale:
+    name: Mark stale issues and PRs
     if: github.repository_owner == 'home-assistant'
     runs-on: ubuntu-latest
+    permissions:
+      issues: write # To label and close stale issues
+      pull-requests: write # To label and close stale PRs
     steps:
       # The 60 day stale policy for PRs
       # Used for:
@@ -17,7 +27,7 @@ jobs:
       # - No PRs marked as no-stale
       # - No issues (-1)
       - name: 60 days stale PRs policy
-        uses: actions/stale@v9.1.0
+        uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-stale: 60
@@ -48,8 +58,8 @@ jobs:
         # v1.7.0
         uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
         with:
-          app_id: ${{ secrets.ISSUE_TRIAGE_APP_ID }}
-          private_key: ${{ secrets.ISSUE_TRIAGE_APP_PEM }}
+          app_id: ${{ secrets.ISSUE_TRIAGE_APP_ID }} # zizmor: ignore[secrets-outside-env]
+          private_key: ${{ secrets.ISSUE_TRIAGE_APP_PEM }} # zizmor: ignore[secrets-outside-env]
 
       # The 90 day stale policy for issues
       # Used for:
@@ -57,7 +67,7 @@ jobs:
       # - No issues marked as no-stale or help-wanted
       # - No PRs (-1)
       - name: 90 days stale issues
-        uses: actions/stale@v9.1.0
+        uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
         with:
           repo-token: ${{ steps.token.outputs.token }}
           days-before-stale: 90
@@ -87,7 +97,7 @@ jobs:
       # - No Issues marked as no-stale or help-wanted
       # - No PRs (-1)
       - name: Needs more information stale issues policy
-        uses: actions/stale@v9.1.0
+        uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
         with:
           repo-token: ${{ steps.token.outputs.token }}
           only-labels: "needs-more-information"

.github/workflows/translations.yml

@@ -9,8 +9,11 @@ on:
     paths:
       - "**strings.json"
 
-env:
-  DEFAULT_PYTHON: "3.13"
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
 
 jobs:
   upload:
@@ -19,14 +22,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v5.0.0
-
-      - name: Set up Python ${{ env.DEFAULT_PYTHON }}
-        uses: actions/setup-python@v5.6.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          python-version: ${{ env.DEFAULT_PYTHON }}
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version-file: ".python-version"
 
       - name: Upload Translations
+        env:
+          LOKALISE_TOKEN: ${{ secrets.LOKALISE_TOKEN }} # zizmor: ignore[secrets-outside-env]
         run: |
-          export LOKALISE_TOKEN="${{ secrets.LOKALISE_TOKEN }}"
           python3 -m script.translations upload

.github/workflows/wheels.yml

@@ -16,8 +16,7 @@ on:
       - "requirements.txt"
       - "script/gen_requirements_all.py"
 
-env:
-  DEFAULT_PYTHON: "3.13"
+permissions: {}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref_name}}
@@ -28,17 +27,17 @@ jobs:
     name: Initialize wheels builder
     if: github.repository_owner == 'home-assistant'
     runs-on: ubuntu-latest
-    outputs:
-      architectures: ${{ steps.info.outputs.architectures }}
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v5.0.0
-
-      - name: Set up Python ${{ env.DEFAULT_PYTHON }}
-        id: python
-        uses: actions/setup-python@v5.6.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          python-version: ${{ env.DEFAULT_PYTHON }}
+          persist-credentials: false
+
+      - name: Set up Python
+        id: python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version-file: ".python-version"
           check-latest: true
 
       - name: Create Python virtual environment
@@ -49,13 +48,9 @@ jobs:
           pip install "$(grep '^uv' < requirements.txt)"
           uv pip install -r requirements.txt
 
-      - name: Get information
-        id: info
-        uses: home-assistant/actions/helpers/info@master
-
       - name: Create requirements_diff file
         run: |
-          if [[ ${{ github.event_name }} =~ (schedule|workflow_dispatch) ]]; then
+          if [[ "${GITHUB_EVENT_NAME}" =~ (schedule|workflow_dispatch) ]]; then
             touch requirements_diff.txt
           else
             curl -s -o requirements_diff.txt https://raw.githubusercontent.com/home-assistant/core/master/requirements.txt
@@ -76,37 +71,18 @@ jobs:
 
             # Use C-Extension for SQLAlchemy
             echo "REQUIRE_SQLALCHEMY_CEXT=1"
-
-            # Add additional pip wheel build constraints
-            echo "PIP_CONSTRAINT=build_constraints.txt"
           ) > .env_file
 
-      - name: Write pip wheel build constraints
-        run: |
-          (
-            # ninja 1.11.1.2 + 1.11.1.3 seem to be broken on at least armhf
-            # this caused the numpy builds to fail
-            # https://github.com/scikit-build/ninja-python-distributions/issues/274
-            echo "ninja==1.11.1.1"
-          ) > build_constraints.txt
-
       - name: Upload env_file
-        uses: actions/upload-artifact@v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: env_file
           path: ./.env_file
           include-hidden-files: true
           overwrite: true
 
-      - name: Upload build_constraints
-        uses: actions/upload-artifact@v4.6.2
-        with:
-          name: build_constraints
-          path: ./build_constraints.txt
-          overwrite: true
-
       - name: Upload requirements_diff
-        uses: actions/upload-artifact@v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: requirements_diff
           path: ./requirements_diff.txt
@@ -118,7 +94,7 @@ jobs:
           python -m script.gen_requirements_all ci
 
       - name: Upload requirements_all_wheels
-        uses: actions/upload-artifact@v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: requirements_all_wheels
           path: ./requirements_all_wheels_*.txt
@@ -127,28 +103,30 @@ jobs:
     name: Build Core wheels ${{ matrix.abi }} for ${{ matrix.arch }} (musllinux_1_2)
     if: github.repository_owner == 'home-assistant'
     needs: init
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
-        abi: ["cp313"]
-        arch: ${{ fromJson(needs.init.outputs.architectures) }}
+        abi: ["cp314"]
+        arch: ["amd64", "aarch64"]
+        include:
+          - arch: amd64
+            os: ubuntu-latest
+          - arch: aarch64
+            os: ubuntu-24.04-arm
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Download env_file
-        uses: actions/download-artifact@v5.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: env_file
 
-      - name: Download build_constraints
-        uses: actions/download-artifact@v5.0.0
-        with:
-          name: build_constraints
-
       - name: Download requirements_diff
-        uses: actions/download-artifact@v5.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: requirements_diff
 
@@ -159,12 +137,12 @@ jobs:
           sed -i "/uv/d" requirements_diff.txt
 
       - name: Build wheels
-        uses: home-assistant/wheels@2025.07.0
+        uses: home-assistant/wheels@e5742a69d69f0e274e2689c998900c7d19652c21 # 2025.12.0
         with:
           abi: ${{ matrix.abi }}
           tag: musllinux_1_2
           arch: ${{ matrix.arch }}
-          wheels-key: ${{ secrets.WHEELS_KEY }}
+          wheels-key: ${{ secrets.WHEELS_KEY }} # zizmor: ignore[secrets-outside-env]
           env-file: true
           apk: "libffi-dev;openssl-dev;yaml-dev;nasm;zlib-ng-dev"
           skip-binary: aiohttp;multidict;propcache;yarl;SQLAlchemy
@@ -176,42 +154,40 @@ jobs:
     name: Build wheels ${{ matrix.abi }} for ${{ matrix.arch }}
     if: github.repository_owner == 'home-assistant'
     needs: init
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
-        abi: ["cp313"]
-        arch: ${{ fromJson(needs.init.outputs.architectures) }}
+        abi: ["cp314"]
+        arch: ["amd64", "aarch64"]
+        include:
+          - arch: amd64
+            os: ubuntu-latest
+          - arch: aarch64
+            os: ubuntu-24.04-arm
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Download env_file
-        uses: actions/download-artifact@v5.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: env_file
 
-      - name: Download build_constraints
-        uses: actions/download-artifact@v5.0.0
-        with:
-          name: build_constraints
-
       - name: Download requirements_diff
-        uses: actions/download-artifact@v5.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: requirements_diff
 
       - name: Download requirements_all_wheels
-        uses: actions/download-artifact@v5.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: requirements_all_wheels
 
       - name: Adjust build env
         run: |
-          if [ "${{ matrix.arch }}" = "i386" ]; then
-            echo "NPY_DISABLE_SVML=1" >> .env_file
-          fi
-
           # Do not pin numpy in wheels building
           sed -i "/numpy/d" homeassistant/package_constraints.txt
           # Don't build wheels for uv as uv requires a greater version of rust as currently available on alpine
@@ -219,15 +195,15 @@ jobs:
           sed -i "/uv/d" requirements_diff.txt
 
       - name: Build wheels
-        uses: home-assistant/wheels@2025.07.0
+        uses: home-assistant/wheels@e5742a69d69f0e274e2689c998900c7d19652c21 # 2025.12.0
         with:
           abi: ${{ matrix.abi }}
           tag: musllinux_1_2
           arch: ${{ matrix.arch }}
-          wheels-key: ${{ secrets.WHEELS_KEY }}
+          wheels-key: ${{ secrets.WHEELS_KEY }} # zizmor: ignore[secrets-outside-env]
           env-file: true
-          apk: "bluez-dev;libffi-dev;openssl-dev;glib-dev;eudev-dev;libxml2-dev;libxslt-dev;libpng-dev;libjpeg-turbo-dev;tiff-dev;cups-dev;gmp-dev;mpfr-dev;mpc1-dev;ffmpeg-dev;gammu-dev;yaml-dev;openblas-dev;fftw-dev;lapack-dev;gfortran;blas-dev;eigen-dev;freetype-dev;glew-dev;harfbuzz-dev;hdf5-dev;libdc1394-dev;libtbb-dev;mesa-dev;openexr-dev;openjpeg-dev;uchardet-dev;nasm;zlib-ng-dev"
+          apk: "bluez-dev;libffi-dev;openssl-dev;glib-dev;eudev-dev;libxml2-dev;libxslt-dev;libpng-dev;libjpeg-turbo-dev;tiff-dev;gmp-dev;mpfr-dev;mpc1-dev;ffmpeg-dev;yaml-dev;openblas-dev;fftw-dev;lapack-dev;gfortran;blas-dev;eigen-dev;freetype-dev;glew-dev;harfbuzz-dev;hdf5-dev;libdc1394-dev;libtbb-dev;mesa-dev;openexr-dev;openjpeg-dev;uchardet-dev;nasm;zlib-ng-dev"
           skip-binary: aiohttp;charset-normalizer;grpcio;multidict;SQLAlchemy;propcache;protobuf;pymicro-vad;yarl
           constraints: "homeassistant/package_constraints.txt"
           requirements-diff: "requirements_diff.txt"
-          requirements: "requirements_all.txt"
+          requirements: "requirements_all_wheels_${{ matrix.arch }}.txt"

.gitignore

@@ -79,7 +79,6 @@ junit.xml
 .project
 .pydevproject
 
-.python-version
 .tool-versions
 
 # emacs auto backups
@@ -93,6 +92,7 @@ pip-selfcheck.json
 venv
 .venv
 Pipfile*
+uv.lock
 share/*
 /Scripts/
 
@@ -112,6 +112,7 @@ virtualization/vagrant/config
 !.vscode/cSpell.json
 !.vscode/extensions.json
 !.vscode/tasks.json
+!.vscode/settings.default.jsonc
 .env
 
 # Windows Explorer
@@ -140,5 +141,7 @@ tmp_cache
 pytest_buckets.txt
 
 # AI tooling
-.claude
+.claude/settings.local.json
+.claude/worktrees/
+.serena/
 

.pre-commit-config.yaml

@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.12.1
+    rev: v0.15.10
     hooks:
       - id: ruff-check
         args:
@@ -8,7 +8,7 @@ repos:
       - id: ruff-format
         files: ^((homeassistant|pylint|script|tests)/.+)?[^/]+\.(py|pyi)$
   - repo: https://github.com/codespell-project/codespell
-    rev: v2.4.1
+    rev: v2.4.2
     hooks:
       - id: codespell
         args:
@@ -17,6 +17,12 @@ repos:
           - --quiet-level=2
         exclude_types: [csv, json, html]
         exclude: ^tests/fixtures/|homeassistant/generated/|tests/components/.*/snapshots/
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.24.1
+    hooks:
+      - id: zizmor
+        args:
+          - --pedantic
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v6.0.0
     hooks:
@@ -30,20 +36,23 @@ repos:
           - --branch=master
           - --branch=rc
   - repo: https://github.com/adrienverge/yamllint.git
-    rev: v1.37.1
+    rev: v1.38.0
     hooks:
       - id: yamllint
-  - repo: https://github.com/pre-commit/mirrors-prettier
-    rev: v3.0.3
+  - repo: https://github.com/rbubley/mirrors-prettier
+    rev: v3.6.2
     hooks:
       - id: prettier
+        additional_dependencies:
+          - prettier@3.6.2
+          - prettier-plugin-sort-json@4.2.0
   - repo: https://github.com/cdce8p/python-typing-update
     rev: v0.6.0
     hooks:
       # Run `python-typing-update` hook manually from time to time
       # to update python typing syntax.
       # Will require manual work, before submitting changes!
-      # pre-commit run --hook-stage manual python-typing-update --all-files
+      # prek run --hook-stage manual python-typing-update --all-files
       - id: python-typing-update
         stages: [manual]
         args:
@@ -78,20 +87,27 @@ repos:
         language: script
         types: [text]
         files: ^(homeassistant/.+/manifest\.json|homeassistant/brands/.+\.json|pyproject\.toml|\.pre-commit-config\.yaml|script/gen_requirements_all\.py)$
+      - id: gen_copilot_instructions
+        name: gen_copilot_instructions
+        entry: script/run-in-env.sh python3 -m script.gen_copilot_instructions
+        pass_filenames: false
+        language: script
+        types: [text]
+        files: ^(AGENTS\.md|\.claude/skills/(?!github-pr-reviewer/).+/SKILL\.md|\.github/copilot-instructions\.md|script/gen_copilot_instructions\.py)$
       - id: hassfest
         name: hassfest
         entry: script/run-in-env.sh python3 -m script.hassfest
         pass_filenames: false
         language: script
         types: [text]
-        files: ^(homeassistant/.+/(icons|manifest|strings)\.json|homeassistant/.+/(quality_scale)\.yaml|homeassistant/brands/.*\.json|homeassistant/.+/services\.yaml|script/hassfest/(?!metadata|mypy_config).+\.py|requirements.+\.txt)$
+        files: ^(homeassistant/.+/(icons|manifest|strings)\.json|homeassistant/.+/(conditions|quality_scale|services|triggers)\.yaml|homeassistant/brands/.*\.json|script/hassfest/(?!metadata|mypy_config).+\.py|requirements.+\.txt)$
       - id: hassfest-metadata
         name: hassfest-metadata
         entry: script/run-in-env.sh python3 -m script.hassfest -p metadata,docker
         pass_filenames: false
         language: script
         types: [text]
-        files: ^(script/hassfest/metadata\.py|homeassistant/const\.py$|pyproject\.toml|homeassistant/components/go2rtc/const\.py)$
+        files: ^(script/hassfest/(metadata|docker)\.py|homeassistant/const\.py$|pyproject\.toml)$
       - id: hassfest-mypy-config
         name: hassfest-mypy-config
         entry: script/run-in-env.sh python3 -m script.hassfest -p mypy_config

.prettierrc.js

@@ -0,0 +1,24 @@
+/** @type {import("prettier").Config} */
+module.exports = {
+  overrides: [
+    {
+      files: "./homeassistant/**/*.json",
+      options: {
+        plugins: [require.resolve("prettier-plugin-sort-json")],
+        jsonRecursiveSort: true,
+        jsonSortOrder: JSON.stringify({ [/.*/]: "numeric" }),
+      },
+    },
+    {
+      files: ["manifest.json", "./**/brands/*.json"],
+      options: {
+        // domain and name should stay at the top
+        jsonSortOrder: JSON.stringify({
+          domain: null,
+          name: null,
+          [/.*/]: "numeric",
+        }),
+      },
+    },
+  ],
+};

.python-version

@@ -0,0 +1 @@
+3.14.2

.strict-typing

@@ -46,13 +46,16 @@ homeassistant.components.accuweather.*
 homeassistant.components.acer_projector.*
 homeassistant.components.acmeda.*
 homeassistant.components.actiontec.*
+homeassistant.components.actron_air.*
 homeassistant.components.adax.*
 homeassistant.components.adguard.*
 homeassistant.components.aftership.*
+homeassistant.components.ai_task.*
 homeassistant.components.air_quality.*
 homeassistant.components.airgradient.*
 homeassistant.components.airly.*
 homeassistant.components.airnow.*
+homeassistant.components.airobot.*
 homeassistant.components.airos.*
 homeassistant.components.airq.*
 homeassistant.components.airthings.*
@@ -83,6 +86,7 @@ homeassistant.components.androidtv_remote.*
 homeassistant.components.anel_pwrctrl.*
 homeassistant.components.anova.*
 homeassistant.components.anthemav.*
+homeassistant.components.anthropic.*
 homeassistant.components.apache_kafka.*
 homeassistant.components.apcupsd.*
 homeassistant.components.api.*
@@ -107,6 +111,7 @@ homeassistant.components.automation.*
 homeassistant.components.awair.*
 homeassistant.components.axis.*
 homeassistant.components.azure_storage.*
+homeassistant.components.backblaze_b2.*
 homeassistant.components.backup.*
 homeassistant.components.baf.*
 homeassistant.components.bang_olufsen.*
@@ -119,8 +124,6 @@ homeassistant.components.blueprint.*
 homeassistant.components.bluesound.*
 homeassistant.components.bluetooth.*
 homeassistant.components.bluetooth_adapters.*
-homeassistant.components.bluetooth_tracker.*
-homeassistant.components.bmw_connected_drive.*
 homeassistant.components.bond.*
 homeassistant.components.bosch_alarm.*
 homeassistant.components.braviatv.*
@@ -128,12 +131,14 @@ homeassistant.components.bring.*
 homeassistant.components.brother.*
 homeassistant.components.browser.*
 homeassistant.components.bryant_evolution.*
+homeassistant.components.bsblan.*
 homeassistant.components.bthome.*
 homeassistant.components.button.*
 homeassistant.components.calendar.*
 homeassistant.components.cambridge_audio.*
 homeassistant.components.camera.*
 homeassistant.components.canary.*
+homeassistant.components.casper_glow.*
 homeassistant.components.cert_expiry.*
 homeassistant.components.clickatell.*
 homeassistant.components.clicksend.*
@@ -142,6 +147,7 @@ homeassistant.components.cloud.*
 homeassistant.components.co2signal.*
 homeassistant.components.comelit.*
 homeassistant.components.command_line.*
+homeassistant.components.compit.*
 homeassistant.components.config.*
 homeassistant.components.configurator.*
 homeassistant.components.cookidoo.*
@@ -169,8 +175,11 @@ homeassistant.components.dnsip.*
 homeassistant.components.doorbird.*
 homeassistant.components.dormakaba_dkey.*
 homeassistant.components.downloader.*
+homeassistant.components.dropbox.*
+homeassistant.components.droplet.*
 homeassistant.components.dsmr.*
 homeassistant.components.duckdns.*
+homeassistant.components.duco.*
 homeassistant.components.dunehd.*
 homeassistant.components.duotecno.*
 homeassistant.components.easyenergy.*
@@ -180,12 +189,12 @@ homeassistant.components.efergy.*
 homeassistant.components.eheimdigital.*
 homeassistant.components.electrasmart.*
 homeassistant.components.electric_kiwi.*
-homeassistant.components.elevenlabs.*
 homeassistant.components.elgato.*
 homeassistant.components.elkm1.*
 homeassistant.components.emulated_hue.*
 homeassistant.components.energenie_power_sockets.*
 homeassistant.components.energy.*
+homeassistant.components.energyid.*
 homeassistant.components.energyzero.*
 homeassistant.components.enigma2.*
 homeassistant.components.enphase_envoy.*
@@ -201,10 +210,13 @@ homeassistant.components.feedreader.*
 homeassistant.components.file_upload.*
 homeassistant.components.filesize.*
 homeassistant.components.filter.*
+homeassistant.components.firefly_iii.*
 homeassistant.components.fitbit.*
 homeassistant.components.flexit_bacnet.*
 homeassistant.components.flux_led.*
+homeassistant.components.folder_watcher.*
 homeassistant.components.forecast_solar.*
+homeassistant.components.freshr.*
 homeassistant.components.fritz.*
 homeassistant.components.fritzbox.*
 homeassistant.components.fritzbox_callmonitor.*
@@ -212,12 +224,15 @@ homeassistant.components.fronius.*
 homeassistant.components.frontend.*
 homeassistant.components.fujitsu_fglair.*
 homeassistant.components.fully_kiosk.*
+homeassistant.components.fumis.*
 homeassistant.components.fyta.*
 homeassistant.components.generic_hygrostat.*
 homeassistant.components.generic_thermostat.*
 homeassistant.components.geo_location.*
 homeassistant.components.geocaching.*
+homeassistant.components.ghost.*
 homeassistant.components.gios.*
+homeassistant.components.github.*
 homeassistant.components.glances.*
 homeassistant.components.go2rtc.*
 homeassistant.components.goalzero.*
@@ -227,6 +242,7 @@ homeassistant.components.google_cloud.*
 homeassistant.components.google_drive.*
 homeassistant.components.google_photos.*
 homeassistant.components.google_sheets.*
+homeassistant.components.google_weather.*
 homeassistant.components.govee_ble.*
 homeassistant.components.gpsd.*
 homeassistant.components.greeneye_monitor.*
@@ -235,6 +251,7 @@ homeassistant.components.guardian.*
 homeassistant.components.habitica.*
 homeassistant.components.hardkernel.*
 homeassistant.components.hardware.*
+homeassistant.components.hdfury.*
 homeassistant.components.heos.*
 homeassistant.components.here_travel_time.*
 homeassistant.components.history.*
@@ -260,12 +277,15 @@ homeassistant.components.homekit_controller.storage
 homeassistant.components.homekit_controller.utils
 homeassistant.components.homewizard.*
 homeassistant.components.homeworks.*
+homeassistant.components.hr_energy_qube.*
 homeassistant.components.http.*
 homeassistant.components.huawei_lte.*
 homeassistant.components.humidifier.*
 homeassistant.components.husqvarna_automower.*
+homeassistant.components.huum.*
 homeassistant.components.hydrawise.*
 homeassistant.components.hyperion.*
+homeassistant.components.hypontech.*
 homeassistant.components.ibeacon.*
 homeassistant.components.idasen_desk.*
 homeassistant.components.image.*
@@ -275,10 +295,13 @@ homeassistant.components.imap.*
 homeassistant.components.imgw_pib.*
 homeassistant.components.immich.*
 homeassistant.components.incomfort.*
+homeassistant.components.inels.*
+homeassistant.components.infrared.*
 homeassistant.components.input_button.*
 homeassistant.components.input_select.*
 homeassistant.components.input_text.*
 homeassistant.components.integration.*
+homeassistant.components.intelliclima.*
 homeassistant.components.intent.*
 homeassistant.components.intent_script.*
 homeassistant.components.ios.*
@@ -286,6 +309,7 @@ homeassistant.components.iotty.*
 homeassistant.components.ipp.*
 homeassistant.components.iqvia.*
 homeassistant.components.iron_os.*
+homeassistant.components.isal.*
 homeassistant.components.islamic_prayer_times.*
 homeassistant.components.isy994.*
 homeassistant.components.jellyfin.*
@@ -296,6 +320,7 @@ homeassistant.components.knocki.*
 homeassistant.components.knx.*
 homeassistant.components.kraken.*
 homeassistant.components.kulersky.*
+homeassistant.components.labs.*
 homeassistant.components.lacrosse.*
 homeassistant.components.lacrosse_view.*
 homeassistant.components.lamarzocco.*
@@ -307,7 +332,10 @@ homeassistant.components.ld2410_ble.*
 homeassistant.components.led_ble.*
 homeassistant.components.lektrico.*
 homeassistant.components.letpot.*
+homeassistant.components.lg_infrared.*
+homeassistant.components.libre_hardware_monitor.*
 homeassistant.components.lidarr.*
+homeassistant.components.liebherr.*
 homeassistant.components.lifx.*
 homeassistant.components.light.*
 homeassistant.components.linkplay.*
@@ -322,6 +350,8 @@ homeassistant.components.london_underground.*
 homeassistant.components.lookin.*
 homeassistant.components.lovelace.*
 homeassistant.components.luftdaten.*
+homeassistant.components.lunatone.*
+homeassistant.components.lutron.*
 homeassistant.components.madvr.*
 homeassistant.components.manual.*
 homeassistant.components.mastodon.*
@@ -353,7 +383,7 @@ homeassistant.components.my.*
 homeassistant.components.mysensors.*
 homeassistant.components.myuplink.*
 homeassistant.components.nam.*
-homeassistant.components.nanoleaf.*
+homeassistant.components.namecheapdns.*
 homeassistant.components.nasweb.*
 homeassistant.components.neato.*
 homeassistant.components.nest.*
@@ -367,6 +397,7 @@ homeassistant.components.no_ip.*
 homeassistant.components.nordpool.*
 homeassistant.components.notify.*
 homeassistant.components.notion.*
+homeassistant.components.nrgkick.*
 homeassistant.components.ntfy.*
 homeassistant.components.number.*
 homeassistant.components.nut.*
@@ -374,21 +405,24 @@ homeassistant.components.ohme.*
 homeassistant.components.onboarding.*
 homeassistant.components.oncue.*
 homeassistant.components.onedrive.*
+homeassistant.components.onedrive_for_business.*
 homeassistant.components.onewire.*
 homeassistant.components.onkyo.*
 homeassistant.components.open_meteo.*
 homeassistant.components.open_router.*
 homeassistant.components.openai_conversation.*
+homeassistant.components.openevse.*
 homeassistant.components.openexchangerates.*
 homeassistant.components.opensky.*
 homeassistant.components.openuv.*
+homeassistant.components.opnsense.*
 homeassistant.components.opower.*
 homeassistant.components.oralb.*
 homeassistant.components.otbr.*
+homeassistant.components.otp.*
 homeassistant.components.overkiz.*
 homeassistant.components.overseerr.*
 homeassistant.components.p1_monitor.*
-homeassistant.components.pandora.*
 homeassistant.components.panel_custom.*
 homeassistant.components.paperless_ngx.*
 homeassistant.components.peblar.*
@@ -399,7 +433,10 @@ homeassistant.components.person.*
 homeassistant.components.pi_hole.*
 homeassistant.components.ping.*
 homeassistant.components.plugwise.*
+homeassistant.components.pooldose.*
+homeassistant.components.portainer.*
 homeassistant.components.powerfox.*
+homeassistant.components.powerfox_local.*
 homeassistant.components.powerwall.*
 homeassistant.components.private_ble_device.*
 homeassistant.components.prometheus.*
@@ -418,10 +455,13 @@ homeassistant.components.radarr.*
 homeassistant.components.radio_browser.*
 homeassistant.components.rainforest_raven.*
 homeassistant.components.rainmachine.*
+homeassistant.components.random.*
 homeassistant.components.raspberry_pi.*
 homeassistant.components.rdw.*
 homeassistant.components.recollect_waste.*
 homeassistant.components.recorder.*
+homeassistant.components.recovery_mode.*
+homeassistant.components.redgtech.*
 homeassistant.components.remember_the_milk.*
 homeassistant.components.remote.*
 homeassistant.components.remote_calendar.*
@@ -438,18 +478,21 @@ homeassistant.components.rituals_perfume_genie.*
 homeassistant.components.roborock.*
 homeassistant.components.roku.*
 homeassistant.components.romy.*
+homeassistant.components.route_b_smart_meter.*
 homeassistant.components.rpi_power.*
 homeassistant.components.rss_feed_template.*
 homeassistant.components.russound_rio.*
 homeassistant.components.ruuvi_gateway.*
 homeassistant.components.ruuvitag_ble.*
 homeassistant.components.samsungtv.*
+homeassistant.components.saunum.*
 homeassistant.components.scene.*
 homeassistant.components.schedule.*
 homeassistant.components.schlage.*
 homeassistant.components.scrape.*
 homeassistant.components.script.*
 homeassistant.components.search.*
+homeassistant.components.season.*
 homeassistant.components.select.*
 homeassistant.components.sensibo.*
 homeassistant.components.sensirion_ble.*
@@ -458,6 +501,7 @@ homeassistant.components.sensorpush_cloud.*
 homeassistant.components.sensoterra.*
 homeassistant.components.senz.*
 homeassistant.components.sfr_box.*
+homeassistant.components.sftp_storage.*
 homeassistant.components.shell_command.*
 homeassistant.components.shelly.*
 homeassistant.components.shopping_list.*
@@ -468,12 +512,14 @@ homeassistant.components.skybell.*
 homeassistant.components.slack.*
 homeassistant.components.sleep_as_android.*
 homeassistant.components.sleepiq.*
+homeassistant.components.sma.*
 homeassistant.components.smhi.*
 homeassistant.components.smlight.*
 homeassistant.components.smtp.*
 homeassistant.components.snooz.*
 homeassistant.components.solarlog.*
 homeassistant.components.sonarr.*
+homeassistant.components.spaceapi.*
 homeassistant.components.speedtestdotnet.*
 homeassistant.components.spotify.*
 homeassistant.components.sql.*
@@ -498,6 +544,7 @@ homeassistant.components.synology_dsm.*
 homeassistant.components.system_health.*
 homeassistant.components.system_log.*
 homeassistant.components.systemmonitor.*
+homeassistant.components.systemnexa2.*
 homeassistant.components.tag.*
 homeassistant.components.tailscale.*
 homeassistant.components.tailwind.*
@@ -508,6 +555,8 @@ homeassistant.components.tcp.*
 homeassistant.components.technove.*
 homeassistant.components.tedee.*
 homeassistant.components.telegram_bot.*
+homeassistant.components.teleinfo.*
+homeassistant.components.teslemetry.*
 homeassistant.components.text.*
 homeassistant.components.thethingsnetwork.*
 homeassistant.components.threshold.*
@@ -531,21 +580,26 @@ homeassistant.components.trafikverket_train.*
 homeassistant.components.trafikverket_weatherstation.*
 homeassistant.components.transmission.*
 homeassistant.components.trend.*
+homeassistant.components.trmnl.*
 homeassistant.components.tts.*
 homeassistant.components.twentemilieu.*
 homeassistant.components.unifi.*
+homeassistant.components.unifi_access.*
 homeassistant.components.unifiprotect.*
 homeassistant.components.upcloud.*
 homeassistant.components.update.*
 homeassistant.components.uptime.*
 homeassistant.components.uptime_kuma.*
 homeassistant.components.uptimerobot.*
+homeassistant.components.usage_prediction.*
 homeassistant.components.usb.*
 homeassistant.components.uvc.*
 homeassistant.components.vacuum.*
 homeassistant.components.vallox.*
 homeassistant.components.valve.*
 homeassistant.components.velbus.*
+homeassistant.components.velux.*
+homeassistant.components.vivotek.*
 homeassistant.components.vlc_telnet.*
 homeassistant.components.vodafone_station.*
 homeassistant.components.volvo.*
@@ -554,8 +608,10 @@ homeassistant.components.wake_word.*
 homeassistant.components.wallbox.*
 homeassistant.components.waqi.*
 homeassistant.components.water_heater.*
+homeassistant.components.watts.*
 homeassistant.components.watttime.*
 homeassistant.components.weather.*
+homeassistant.components.web_rtc.*
 homeassistant.components.webhook.*
 homeassistant.components.webostv.*
 homeassistant.components.websocket_api.*
@@ -566,11 +622,13 @@ homeassistant.components.wiz.*
 homeassistant.components.wled.*
 homeassistant.components.workday.*
 homeassistant.components.worldclock.*
+homeassistant.components.xbox.*
 homeassistant.components.xiaomi_ble.*
 homeassistant.components.yale_smart_alarm.*
 homeassistant.components.yalexs_ble.*
 homeassistant.components.youtube.*
 homeassistant.components.zeroconf.*
+homeassistant.components.zinvolt.*
 homeassistant.components.zodiac.*
 homeassistant.components.zone.*
 homeassistant.components.zwave_js.*

.vscode/settings.default.json

@@ -1,19 +0,0 @@
-{
-  // Please keep this file (mostly!) in sync with settings in home-assistant/.devcontainer/devcontainer.json
-  // Added --no-cov to work around TypeError: message must be set
-  // https://github.com/microsoft/vscode-python/issues/14067
-  "python.testing.pytestArgs": ["--no-cov"],
-  // https://code.visualstudio.com/docs/python/testing#_pytest-configuration-settings
-  "python.testing.pytestEnabled": false,
-  // https://code.visualstudio.com/docs/python/linting#_general-settings
-  "pylint.importStrategy": "fromEnvironment",
-  "json.schemas": [
-        {
-            "fileMatch": [
-                "homeassistant/components/*/manifest.json"
-            ],
-            // This value differs between working with devcontainer and locally, therefor this value should NOT be in sync!
-            "url": "./script/json_schemas/manifest_schema.json"
-        }
-    ]
-}

.vscode/settings.default.jsonc

@@ -0,0 +1,25 @@
+{
+  // Please keep this file (mostly!) in sync with settings in home-assistant/.devcontainer/devcontainer.json
+  // Added --no-cov to work around TypeError: message must be set
+  // https://github.com/microsoft/vscode-python/issues/14067
+  "python.testing.pytestArgs": ["--no-cov"],
+  // https://code.visualstudio.com/docs/python/testing#_pytest-configuration-settings
+  "python.testing.pytestEnabled": false,
+  // https://code.visualstudio.com/docs/python/linting#_general-settings
+  "pylint.importStrategy": "fromEnvironment",
+  // Pyright type checking is not compatible with mypy which Home Assistant uses for type checking
+  "python.analysis.typeCheckingMode": "off",
+  "[python]": {
+    "editor.defaultFormatter": "charliermarsh.ruff",
+  },
+  "[json][jsonc][yaml]": {
+    "editor.defaultFormatter": "esbenp.prettier-vscode",
+  },
+  "json.schemas": [
+    {
+      "fileMatch": ["homeassistant/components/*/manifest.json"],
+      // This value differs between working with devcontainer and locally, therefore this value should NOT be in sync!
+      "url": "./script/json_schemas/manifest_schema.json",
+    },
+  ],
+}

.vscode/tasks.json

@@ -45,7 +45,7 @@
     {
       "label": "Ruff",
       "type": "shell",
-      "command": "pre-commit run ruff-check --all-files",
+      "command": "prek run ruff-check --all-files",
       "group": {
         "kind": "test",
         "isDefault": true
@@ -57,9 +57,9 @@
       "problemMatcher": []
     },
     {
-      "label": "Pre-commit",
+      "label": "Prek",
       "type": "shell",
-      "command": "pre-commit run --show-diff-on-failure",
+      "command": "prek run --show-diff-on-failure",
       "group": {
         "kind": "test",
         "isDefault": true
@@ -120,7 +120,7 @@
     {
       "label": "Generate Requirements",
       "type": "shell",
-      "command": "./script/gen_requirements_all.py",
+      "command": "${command:python.interpreterPath} -m script.gen_requirements_all",
       "group": {
         "kind": "build",
         "isDefault": true

AGENTS.md

@@ -0,0 +1,27 @@
+# GitHub Copilot & Claude Code Instructions
+
+This repository contains the core of Home Assistant, a Python 3 based home automation application.
+
+## Git Commit Guidelines
+
+- **Do NOT amend, squash, or rebase commits that have already been pushed to the PR branch after the PR is opened** - Reviewers need to follow the commit history, as well as see what changed since their last review
+
+## Development Commands
+
+.vscode/tasks.json contains useful commands used for development.
+
+## Python Syntax Notes
+
+- Python 3.14 explicitly allows `except TypeA, TypeB:` without parentheses.
+
+## Testing
+
+When writing or modifying tests, ensure all test function parameters have type annotations.
+Prefer concrete types (for example, `HomeAssistant`, `MockConfigEntry`, etc.) over `Any`.
+
+## Good practices
+
+Integrations with Platinum or Gold level in the Integration Quality Scale reflect a high standard of code quality and maintainability. When looking for examples of something, these are good places to start. The level is indicated in the manifest.json of the integration.
+
+When reviewing entity actions, do not suggest extra defensive checks for input fields that are already validated by Home Assistant's service/action schemas and entity selection filters. Suggest additional guards only when data bypasses those validators or is transformed into a less-safe form.
+When validation guarantees a dict key exists, prefer direct key access (`data["key"]`) instead of `.get("key")` so contract violations are surfaced instead of silently masked.

CLAUDE.md

@@ -1 +1 @@
-.github/copilot-instructions.md
+AGENTS.md

CONTRIBUTING.md

@@ -14,5 +14,8 @@ Still interested? Then you should take a peek at the [developer documentation](h
 
 ## Feature suggestions
 
-If you want to suggest a new feature for Home Assistant (e.g., new integrations), please open a thread in our [Community Forum: Feature Requests](https://community.home-assistant.io/c/feature-requests).
-We use [GitHub for tracking issues](https://github.com/home-assistant/core/issues), not for tracking feature requests.
+If you want to suggest a new feature for Home Assistant (e.g. new integrations), please [start a discussion](https://github.com/orgs/home-assistant/discussions) on GitHub.
+
+## Issue Tracker
+
+If you want to report an issue, please [create an issue](https://github.com/home-assistant/core/issues) on GitHub.

Dockerfile

@@ -1,45 +1,41 @@
+# syntax=docker/dockerfile@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769
 # Automatically generated by hassfest.
 #
 # To update, run python3 -m script.hassfest -p docker
 ARG BUILD_FROM
 FROM ${BUILD_FROM}
 
+LABEL \
+    io.hass.type="core" \
+    org.opencontainers.image.authors="The Home Assistant Authors" \
+    org.opencontainers.image.description="Open-source home automation platform running on Python 3" \
+    org.opencontainers.image.documentation="https://www.home-assistant.io/docs/" \
+    org.opencontainers.image.licenses="Apache-2.0" \
+    org.opencontainers.image.title="Home Assistant" \
+    org.opencontainers.image.url="https://www.home-assistant.io/"
+
 # Synchronize with homeassistant/core.py:async_stop
 ENV \
     S6_SERVICES_GRACETIME=240000 \
     UV_SYSTEM_PYTHON=true \
     UV_NO_CACHE=true
 
-ARG QEMU_CPU
+WORKDIR /usr/src
 
 # Home Assistant S6-Overlay
 COPY rootfs /
 
-# Needs to be redefined inside the FROM statement to be set for RUN commands
-ARG BUILD_ARCH
-# Get go2rtc binary
-RUN \
-    case "${BUILD_ARCH}" in \
-        "aarch64") go2rtc_suffix='arm64' ;; \
-        "armhf") go2rtc_suffix='armv6' ;; \
-        "armv7") go2rtc_suffix='arm' ;; \
-        *) go2rtc_suffix=${BUILD_ARCH} ;; \
-    esac \
-    && curl -L https://github.com/AlexxIT/go2rtc/releases/download/v1.9.9/go2rtc_linux_${go2rtc_suffix} --output /bin/go2rtc \
-    && chmod +x /bin/go2rtc \
-    # Verify go2rtc can be executed
-    && go2rtc --version
-
-# Install uv
-RUN pip3 install uv==0.8.9
-
-WORKDIR /usr/src
+# Add go2rtc binary
+COPY --from=ghcr.io/alexxit/go2rtc@sha256:675c318b23c06fd862a61d262240c9a63436b4050d177ffc68a32710d9e05bae /usr/local/bin/go2rtc /bin/go2rtc
 
 ## Setup Home Assistant Core dependencies
-COPY requirements.txt homeassistant/
-COPY homeassistant/package_constraints.txt homeassistant/homeassistant/
+COPY --parents requirements.txt homeassistant/package_constraints.txt homeassistant/
 RUN \
-    uv pip install \
+    # Verify go2rtc can be executed
+    go2rtc --version \
+    # Install uv at the version pinned in the requirements file
+    && pip3 install --no-cache-dir "uv==$(awk -F'==' '/^uv==/{print $2}' homeassistant/requirements.txt)" \
+    && uv pip install \
         --no-build \
         -r homeassistant/requirements.txt
 
@@ -53,7 +49,7 @@ RUN \
         -r homeassistant/requirements_all.txt
 
 ## Setup Home Assistant Core
-COPY . homeassistant/
+COPY --parents LICENSE* README* homeassistant/ pyproject.toml homeassistant/
 RUN \
     uv pip install \
         -e ./homeassistant \

Dockerfile.dev

@@ -1,10 +1,10 @@
+# syntax=docker/dockerfile@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769
 FROM mcr.microsoft.com/vscode/devcontainers/base:debian
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
 RUN \
-    curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | apt-key add - \
-    && apt-get update \
+    apt-get update \
     && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
         # Additional library needed by some tests and accordingly by VScode Tests Discovery
         bluez \
@@ -14,7 +14,6 @@ RUN \
         libavcodec-dev \
         libavdevice-dev \
         libavutil-dev \
-        libgammu-dev \
         libswscale-dev \
         libswresample-dev \
         libavfilter-dev \
@@ -35,25 +34,27 @@ WORKDIR /usr/src
 
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
 
-RUN uv python install 3.13.2
-
 USER vscode
-ENV VIRTUAL_ENV="/home/vscode/.local/ha-venv"
-RUN uv venv $VIRTUAL_ENV
-ENV PATH="$VIRTUAL_ENV/bin:$PATH"
 
-WORKDIR /tmp
+ENV VIRTUAL_ENV="/home/vscode/.local/ha-venv"
+RUN --mount=type=bind,source=.python-version,target=.python-version \
+    uv python install \
+    && uv venv $VIRTUAL_ENV
+ENV PATH="$VIRTUAL_ENV/bin:$PATH"
 
 # Setup hass-release
 RUN git clone --depth 1 https://github.com/home-assistant/hass-release ~/hass-release \
     && uv pip install -e ~/hass-release/
 
 # Install Python dependencies from requirements
-COPY requirements.txt ./
-COPY homeassistant/package_constraints.txt homeassistant/package_constraints.txt
-RUN uv pip install -r requirements.txt
-COPY requirements_test.txt requirements_test_pre_commit.txt ./
-RUN uv pip install -r requirements_test.txt
+RUN --mount=type=bind,source=requirements.txt,target=requirements.txt \
+    --mount=type=bind,source=homeassistant/package_constraints.txt,target=homeassistant/package_constraints.txt \
+    --mount=type=bind,source=requirements_test.txt,target=requirements_test.txt \
+    --mount=type=bind,source=requirements_test_pre_commit.txt,target=requirements_test_pre_commit.txt \
+    uv pip install -r requirements.txt -r requirements_test.txt
+
+# Claude Code native install
+RUN curl -fsSL https://claude.ai/install.sh | bash
 
 WORKDIR /workspaces
 

build.yaml

@@ -1,22 +0,0 @@
-image: ghcr.io/home-assistant/{arch}-homeassistant
-build_from:
-  aarch64: ghcr.io/home-assistant/aarch64-homeassistant-base:2025.05.0
-  armhf: ghcr.io/home-assistant/armhf-homeassistant-base:2025.05.0
-  armv7: ghcr.io/home-assistant/armv7-homeassistant-base:2025.05.0
-  amd64: ghcr.io/home-assistant/amd64-homeassistant-base:2025.05.0
-  i386: ghcr.io/home-assistant/i386-homeassistant-base:2025.05.0
-codenotary:
-  signer: notary@home-assistant.io
-  base_image: notary@home-assistant.io
-cosign:
-  base_identity: https://github.com/home-assistant/docker/.*
-  identity: https://github.com/home-assistant/core/.*
-labels:
-  io.hass.type: core
-  org.opencontainers.image.title: Home Assistant
-  org.opencontainers.image.description: Open-source home automation platform running on Python 3
-  org.opencontainers.image.source: https://github.com/home-assistant/core
-  org.opencontainers.image.authors: The Home Assistant Authors
-  org.opencontainers.image.url: https://www.home-assistant.io/
-  org.opencontainers.image.documentation: https://www.home-assistant.io/docs/
-  org.opencontainers.image.licenses: Apache-2.0

codecov.yml

@@ -10,6 +10,7 @@ coverage:
         target: auto
         threshold: 1
         paths:
+          - homeassistant/components/*/backup.py
           - homeassistant/components/*/config_flow.py
           - homeassistant/components/*/device_action.py
           - homeassistant/components/*/device_condition.py
@@ -28,6 +29,7 @@ coverage:
         target: 100
         threshold: 0
         paths:
+          - homeassistant/components/*/backup.py
           - homeassistant/components/*/config_flow.py
           - homeassistant/components/*/device_action.py
           - homeassistant/components/*/device_condition.py

homeassistant/__main__.py

@@ -187,36 +187,42 @@ def main() -> int:
 
     from . import config, runner  # noqa: PLC0415
 
-    safe_mode = config.safe_mode_enabled(config_dir)
+    # Ensure only one instance runs per config directory
+    with runner.ensure_single_execution(config_dir) as single_execution_lock:
+        # Check if another instance is already running
+        if single_execution_lock.exit_code is not None:
+            return single_execution_lock.exit_code
 
-    runtime_conf = runner.RuntimeConfig(
-        config_dir=config_dir,
-        verbose=args.verbose,
-        log_rotate_days=args.log_rotate_days,
-        log_file=args.log_file,
-        log_no_color=args.log_no_color,
-        skip_pip=args.skip_pip,
-        skip_pip_packages=args.skip_pip_packages,
-        recovery_mode=args.recovery_mode,
-        debug=args.debug,
-        open_ui=args.open_ui,
-        safe_mode=safe_mode,
-    )
+        safe_mode = config.safe_mode_enabled(config_dir)
 
-    fault_file_name = os.path.join(config_dir, FAULT_LOG_FILENAME)
-    with open(fault_file_name, mode="a", encoding="utf8") as fault_file:
-        faulthandler.enable(fault_file)
-        exit_code = runner.run(runtime_conf)
-        faulthandler.disable()
+        runtime_conf = runner.RuntimeConfig(
+            config_dir=config_dir,
+            verbose=args.verbose,
+            log_rotate_days=args.log_rotate_days,
+            log_file=args.log_file,
+            log_no_color=args.log_no_color,
+            skip_pip=args.skip_pip,
+            skip_pip_packages=args.skip_pip_packages,
+            recovery_mode=args.recovery_mode,
+            debug=args.debug,
+            open_ui=args.open_ui,
+            safe_mode=safe_mode,
+        )
 
-    # It's possible for the fault file to disappear, so suppress obvious errors
-    with suppress(FileNotFoundError):
-        if os.path.getsize(fault_file_name) == 0:
-            os.remove(fault_file_name)
+        fault_file_name = os.path.join(config_dir, FAULT_LOG_FILENAME)
+        with open(fault_file_name, mode="a", encoding="utf8") as fault_file:
+            faulthandler.enable(fault_file)
+            exit_code = runner.run(runtime_conf)
+            faulthandler.disable()
 
-    check_threads()
+        # It's possible for the fault file to disappear, so suppress obvious errors
+        with suppress(FileNotFoundError):
+            if os.path.getsize(fault_file_name) == 0:
+                os.remove(fault_file_name)
 
-    return exit_code
+        check_threads()
+
+        return exit_code
 
 
 if __name__ == "__main__":

homeassistant/auth/__init__.py

@@ -402,6 +402,8 @@ class AuthManager:
         if user.is_owner:
             raise ValueError("Unable to deactivate the owner")
         await self._store.async_deactivate_user(user)
+        for refresh_token in list(user.refresh_tokens.values()):
+            self.async_remove_refresh_token(refresh_token)
 
     async def async_remove_credentials(self, credentials: models.Credentials) -> None:
         """Remove credentials."""

homeassistant/auth/jwt_wrapper.py

@@ -7,23 +7,31 @@ to speed up the process.
 
 from __future__ import annotations
 
+from collections.abc import Container, Iterable, Sequence
 from datetime import timedelta
-from functools import lru_cache, partial
-from typing import Any
+from functools import lru_cache
+from typing import Any, override
 
-from jwt import DecodeError, PyJWS, PyJWT
+from jwt import DecodeError, PyJWK, PyJWS, PyJWT
+from jwt.algorithms import AllowedPublicKeys
+from jwt.types import Options
 
 from homeassistant.util.json import json_loads
 
 JWT_TOKEN_CACHE_SIZE = 16
 MAX_TOKEN_SIZE = 8192
 
-_VERIFY_KEYS = ("signature", "exp", "nbf", "iat", "aud", "iss", "sub", "jti")
-
-_VERIFY_OPTIONS: dict[str, Any] = {f"verify_{key}": True for key in _VERIFY_KEYS} | {
-    "require": []
-}
-_NO_VERIFY_OPTIONS = {f"verify_{key}": False for key in _VERIFY_KEYS}
+_NO_VERIFY_OPTIONS = Options(
+    verify_signature=False,
+    verify_exp=False,
+    verify_nbf=False,
+    verify_iat=False,
+    verify_aud=False,
+    verify_iss=False,
+    verify_sub=False,
+    verify_jti=False,
+    require=[],
+)
 
 
 class _PyJWSWithLoadCache(PyJWS):
@@ -38,9 +46,6 @@ class _PyJWSWithLoadCache(PyJWS):
         return super()._load(jwt)
 
 
-_jws = _PyJWSWithLoadCache()
-
-
 @lru_cache(maxsize=JWT_TOKEN_CACHE_SIZE)
 def _decode_payload(json_payload: str) -> dict[str, Any]:
     """Decode the payload from a JWS dictionary."""
@@ -56,21 +61,12 @@ def _decode_payload(json_payload: str) -> dict[str, Any]:
 class _PyJWTWithVerify(PyJWT):
     """PyJWT with a fast decode implementation."""
 
-    def decode_payload(
-        self, jwt: str, key: str, options: dict[str, Any], algorithms: list[str]
-    ) -> dict[str, Any]:
-        """Decode a JWT's payload."""
-        if len(jwt) > MAX_TOKEN_SIZE:
-            # Avoid caching impossible tokens
-            raise DecodeError("Token too large")
-        return _decode_payload(
-            _jws.decode_complete(
-                jwt=jwt,
-                key=key,
-                algorithms=algorithms,
-                options=options,
-            )["payload"]
-        )
+    def __init__(self) -> None:
+        """Initialize the PyJWT instance."""
+        # We require exp and iat claims to be present
+        super().__init__(Options(require=["exp", "iat"]))
+        # Override the _jws instance with our cached version
+        self._jws = _PyJWSWithLoadCache()
 
     def verify_and_decode(
         self,
@@ -79,37 +75,70 @@ class _PyJWTWithVerify(PyJWT):
         algorithms: list[str],
         issuer: str | None = None,
         leeway: float | timedelta = 0,
-        options: dict[str, Any] | None = None,
+        options: Options | None = None,
     ) -> dict[str, Any]:
         """Verify a JWT's signature and claims."""
-        merged_options = {**_VERIFY_OPTIONS, **(options or {})}
-        payload = self.decode_payload(
+        return self.decode(
             jwt=jwt,
             key=key,
-            options=merged_options,
             algorithms=algorithms,
-        )
-        # These should never be missing since we verify them
-        # but this is an additional safeguard to make sure
-        # nothing slips through.
-        assert "exp" in payload, "exp claim is required"
-        assert "iat" in payload, "iat claim is required"
-        self._validate_claims(
-            payload=payload,
-            options=merged_options,
             issuer=issuer,
             leeway=leeway,
+            options=options,
         )
-        return payload
+
+    @override
+    def decode(
+        self,
+        jwt: str | bytes,
+        key: AllowedPublicKeys | PyJWK | str | bytes = "",
+        algorithms: Sequence[str] | None = None,
+        options: Options | None = None,
+        verify: bool | None = None,
+        detached_payload: bytes | None = None,
+        audience: str | Iterable[str] | None = None,
+        subject: str | None = None,
+        issuer: str | Container[str] | None = None,
+        leeway: float | timedelta = 0,
+        **kwargs: Any,
+    ) -> dict[str, Any]:
+        """Decode a JWT, verifying the signature and claims."""
+        if len(jwt) > MAX_TOKEN_SIZE:
+            # Avoid caching impossible tokens
+            raise DecodeError("Token too large")
+        return super().decode(
+            jwt=jwt,
+            key=key,
+            algorithms=algorithms,
+            options=options,
+            verify=verify,
+            detached_payload=detached_payload,
+            audience=audience,
+            subject=subject,
+            issuer=issuer,
+            leeway=leeway,
+            **kwargs,
+        )
+
+    @override
+    def _decode_payload(self, decoded: dict[str, Any]) -> dict[str, Any]:
+        return _decode_payload(decoded["payload"])
 
 
 _jwt = _PyJWTWithVerify()
 verify_and_decode = _jwt.verify_and_decode
-unverified_hs256_token_decode = lru_cache(maxsize=JWT_TOKEN_CACHE_SIZE)(
-    partial(
-        _jwt.decode_payload, key="", algorithms=["HS256"], options=_NO_VERIFY_OPTIONS
+
+
+@lru_cache(maxsize=JWT_TOKEN_CACHE_SIZE)
+def unverified_hs256_token_decode(jwt: str) -> dict[str, Any]:
+    """Decode a JWT without verifying the signature."""
+    return _jwt.decode(
+        jwt=jwt,
+        key="",
+        algorithms=["HS256"],
+        options=_NO_VERIFY_OPTIONS,
     )
-)
+
 
 __all__ = [
     "unverified_hs256_token_decode",

homeassistant/auth/mfa_modules/notify.py

@@ -6,7 +6,6 @@ Sending HOTP through notify service
 from __future__ import annotations
 
 import asyncio
-from collections import OrderedDict
 import logging
 from typing import Any, cast
 
@@ -27,7 +26,7 @@ from . import (
     SetupFlow,
 )
 
-REQUIREMENTS = ["pyotp==2.8.0"]
+REQUIREMENTS = ["pyotp==2.9.0"]
 
 CONF_MESSAGE = "message"
 
@@ -304,14 +303,15 @@ class NotifySetupFlow(SetupFlow[NotifyAuthModule]):
         if not self._available_notify_services:
             return self.async_abort(reason="no_available_service")
 
-        schema: dict[str, Any] = OrderedDict()
-        schema["notify_service"] = vol.In(self._available_notify_services)
-        schema["target"] = vol.Optional(str)
-
-        return self.async_show_form(
-            step_id="init", data_schema=vol.Schema(schema), errors=errors
+        schema = vol.Schema(
+            {
+                vol.Required("notify_service"): vol.In(self._available_notify_services),
+                vol.Optional("target"): str,
+            }
         )
 
+        return self.async_show_form(step_id="init", data_schema=schema, errors=errors)
+
     async def async_step_setup(
         self, user_input: dict[str, str] | None = None
     ) -> FlowResult:

homeassistant/auth/mfa_modules/totp.py

@@ -20,7 +20,7 @@ from . import (
     SetupFlow,
 )
 
-REQUIREMENTS = ["pyotp==2.8.0", "PyQRCode==1.2.1"]
+REQUIREMENTS = ["pyotp==2.9.0", "PyQRCode==1.2.1"]
 
 CONFIG_SCHEMA = MULTI_FACTOR_AUTH_MODULE_SCHEMA.extend({}, extra=vol.PREVENT_EXTRA)
 
@@ -34,6 +34,9 @@ INPUT_FIELD_CODE = "code"
 
 DUMMY_SECRET = "FPPTH34D4E3MI2HG"
 
+GOOGLE_AUTHENTICATOR_URL = "https://support.google.com/accounts/answer/1066447"
+AUTHY_URL = "https://authy.com/"
+
 
 def _generate_qr_code(data: str) -> str:
     """Generate a base64 PNG string represent QR Code image of data."""
@@ -229,6 +232,8 @@ class TotpSetupFlow(SetupFlow[TotpAuthModule]):
                 "code": self._ota_secret,
                 "url": self._url,
                 "qr_code": self._image,
+                "google_authenticator_url": GOOGLE_AUTHENTICATOR_URL,
+                "authy_url": AUTHY_URL,
             },
             errors=errors,
         )

homeassistant/auth/permissions/events.py

@@ -7,6 +7,7 @@ from typing import Any, Final
 from homeassistant.const import (
     EVENT_COMPONENT_LOADED,
     EVENT_CORE_CONFIG_UPDATE,
+    EVENT_LABS_UPDATED,
     EVENT_LOVELACE_UPDATED,
     EVENT_PANELS_UPDATED,
     EVENT_RECORDER_5MIN_STATISTICS_GENERATED,
@@ -45,6 +46,7 @@ SUBSCRIBE_ALLOWLIST: Final[set[EventType[Any] | str]] = {
     EVENT_STATE_CHANGED,
     EVENT_THEMES_UPDATED,
     EVENT_LABEL_REGISTRY_UPDATED,
+    EVENT_LABS_UPDATED,
     EVENT_CATEGORY_REGISTRY_UPDATED,
     EVENT_FLOOR_REGISTRY_UPDATED,
 }

homeassistant/auth/providers/homeassistant.py

@@ -179,12 +179,18 @@ class Data:
         user_hash = base64.b64decode(found["password"])
 
         # bcrypt.checkpw is timing-safe
-        if not bcrypt.checkpw(password.encode(), user_hash):
+        # With bcrypt 5.0 passing a password longer than 72 bytes raises a ValueError.
+        # Previously the password was silently truncated.
+        # https://github.com/pyca/bcrypt/pull/1000
+        if not bcrypt.checkpw(password.encode()[:72], user_hash):
             raise InvalidAuth
 
     def hash_password(self, password: str, for_storage: bool = False) -> bytes:
         """Encode a password."""
-        hashed: bytes = bcrypt.hashpw(password.encode(), bcrypt.gensalt(rounds=12))
+        # With bcrypt 5.0 passing a password longer than 72 bytes raises a ValueError.
+        # Previously the password was silently truncated.
+        # https://github.com/pyca/bcrypt/pull/1000
+        hashed: bytes = bcrypt.hashpw(password.encode()[:72], bcrypt.gensalt(rounds=12))
 
         if for_storage:
             hashed = base64.b64encode(hashed)

homeassistant/backup_restore.py

@@ -4,7 +4,6 @@ from __future__ import annotations
 
 from collections.abc import Iterable
 from dataclasses import dataclass
-import hashlib
 import json
 import logging
 from pathlib import Path
@@ -40,17 +39,6 @@ class RestoreBackupFileContent:
     restore_homeassistant: bool
 
 
-def password_to_key(password: str) -> bytes:
-    """Generate a AES Key from password.
-
-    Matches the implementation in supervisor.backups.utils.password_to_key.
-    """
-    key: bytes = password.encode()
-    for _ in range(100):
-        key = hashlib.sha256(key).digest()
-    return key[:16]
-
-
 def restore_backup_file_content(config_dir: Path) -> RestoreBackupFileContent | None:
     """Return the contents of the restore backup file."""
     instruction_path = config_dir.joinpath(RESTORE_BACKUP_FILE)
@@ -96,15 +84,14 @@ def _extract_backup(
     """Extract the backup file to the config directory."""
     with (
         TemporaryDirectory() as tempdir,
-        securetar.SecureTarFile(
+        securetar.SecureTarArchive(
             restore_content.backup_file_path,
-            gzip=False,
             mode="r",
         ) as ostf,
     ):
-        ostf.extractall(
+        ostf.tar.extractall(
             path=Path(tempdir, "extracted"),
-            members=securetar.secure_path(ostf),
+            members=securetar.secure_path(ostf.tar),
             filter="fully_trusted",
         )
         backup_meta_file = Path(tempdir, "extracted", "backup.json")
@@ -126,10 +113,7 @@ def _extract_backup(
                 f"homeassistant.tar{'.gz' if backup_meta['compressed'] else ''}",
             ),
             gzip=backup_meta["compressed"],
-            key=password_to_key(restore_content.password)
-            if restore_content.password is not None
-            else None,
-            mode="r",
+            password=restore_content.password,
         ) as istf:
             istf.extractall(
                 path=Path(tempdir, "homeassistant"),

homeassistant/bootstrap.py

@@ -67,12 +67,10 @@ from .const import (
     BASE_PLATFORMS,
     FORMAT_DATETIME,
     KEY_DATA_LOGGING as DATA_LOGGING,
-    REQUIRED_NEXT_PYTHON_HA_RELEASE,
-    REQUIRED_NEXT_PYTHON_VER,
     SIGNAL_BOOTSTRAP_INTEGRATIONS,
 )
 from .core_config import async_process_ha_core_config
-from .exceptions import HomeAssistantError
+from .exceptions import HomeAssistantError, UnsupportedStorageVersionError
 from .helpers import (
     area_registry,
     category_registry,
@@ -176,6 +174,8 @@ FRONTEND_INTEGRATIONS = {
 STAGE_0_INTEGRATIONS = (
     # Load logging and http deps as soon as possible
     ("logging, http deps", LOGGING_AND_HTTP_DEPS_INTEGRATIONS, None),
+    # Setup labs for preview features
+    ("labs", {"labs"}, STAGE_0_SUBSTAGE_TIMEOUT),
     # Setup frontend
     ("frontend", FRONTEND_INTEGRATIONS, None),
     # Setup recorder
@@ -210,8 +210,10 @@ DEFAULT_INTEGRATIONS = {
     "analytics",  # Needed for onboarding
     "application_credentials",
     "backup",
+    "brands",
     "frontend",
     "hardware",
+    "labs",
     "logger",
     "network",
     "system_health",
@@ -234,9 +236,31 @@ DEFAULT_INTEGRATIONS = {
     "input_text",
     "schedule",
     "timer",
+    #
+    # Base platforms:
+    # Note: Calendar and todo are not included to prevent them from registering
+    # their frontend panels when there are no calendar or todo integrations.
+    *(BASE_PLATFORMS - {"calendar", "todo"}),
+    #
+    # Integrations providing triggers and conditions for base platforms:
+    "air_quality",
+    "battery",
+    "door",
+    "garage_door",
+    "gate",
+    "humidity",
+    "illuminance",
+    "moisture",
+    "motion",
+    "occupancy",
+    "power",
+    "temperature",
+    "window",
 }
 DEFAULT_INTEGRATIONS_RECOVERY_MODE = {
     # These integrations are set up if recovery mode is activated.
+    "backup",
+    "cloud",
     "frontend",
 }
 DEFAULT_INTEGRATIONS_SUPERVISOR = {
@@ -431,32 +455,57 @@ def _init_blocking_io_modules_in_executor() -> None:
     is_docker_env()
 
 
-async def async_load_base_functionality(hass: core.HomeAssistant) -> None:
-    """Load the registries and modules that will do blocking I/O."""
+async def async_load_base_functionality(hass: core.HomeAssistant) -> bool:
+    """Load the registries and modules that will do blocking I/O.
+
+    Return whether loading succeeded.
+    """
     if DATA_REGISTRIES_LOADED in hass.data:
-        return
+        return True
+
     hass.data[DATA_REGISTRIES_LOADED] = None
     entity.async_setup(hass)
     frame.async_setup(hass)
     template.async_setup(hass)
     translation.async_setup(hass)
-    await asyncio.gather(
-        create_eager_task(get_internal_store_manager(hass).async_initialize()),
-        create_eager_task(area_registry.async_load(hass)),
-        create_eager_task(category_registry.async_load(hass)),
-        create_eager_task(device_registry.async_load(hass)),
-        create_eager_task(entity_registry.async_load(hass)),
-        create_eager_task(floor_registry.async_load(hass)),
-        create_eager_task(issue_registry.async_load(hass)),
-        create_eager_task(label_registry.async_load(hass)),
-        hass.async_add_executor_job(_init_blocking_io_modules_in_executor),
-        create_eager_task(template.async_load_custom_templates(hass)),
-        create_eager_task(restore_state.async_load(hass)),
-        create_eager_task(hass.config_entries.async_initialize()),
-        create_eager_task(async_get_system_info(hass)),
-        create_eager_task(condition.async_setup(hass)),
-        create_eager_task(trigger.async_setup(hass)),
-    )
+
+    recovery = hass.config.recovery_mode
+    device_registry.async_setup(hass)
+    try:
+        await asyncio.gather(
+            create_eager_task(get_internal_store_manager(hass).async_initialize()),
+            create_eager_task(area_registry.async_load(hass, load_empty=recovery)),
+            create_eager_task(category_registry.async_load(hass, load_empty=recovery)),
+            create_eager_task(device_registry.async_load(hass, load_empty=recovery)),
+            create_eager_task(entity_registry.async_load(hass, load_empty=recovery)),
+            create_eager_task(floor_registry.async_load(hass, load_empty=recovery)),
+            create_eager_task(issue_registry.async_load(hass, load_empty=recovery)),
+            create_eager_task(label_registry.async_load(hass, load_empty=recovery)),
+            hass.async_add_executor_job(_init_blocking_io_modules_in_executor),
+            create_eager_task(template.async_load_custom_templates(hass)),
+            create_eager_task(restore_state.async_load(hass, load_empty=recovery)),
+            create_eager_task(hass.config_entries.async_initialize()),
+            create_eager_task(async_get_system_info(hass)),
+            create_eager_task(condition.async_setup(hass)),
+            create_eager_task(trigger.async_setup(hass)),
+        )
+    except UnsupportedStorageVersionError as err:
+        # If we're already in recovery mode, we don't want to handle the exception
+        # and activate recovery mode again, as that would lead to an infinite loop.
+        if recovery:
+            raise
+
+        _LOGGER.error(
+            "Storage file %s was created by a newer version of Home Assistant"
+            " (storage version %s > %s); activating recovery mode; on-disk data"
+            " is preserved; upgrade Home Assistant or restore from a backup",
+            err.storage_key,
+            err.found_version,
+            err.max_supported_version,
+        )
+        return False
+
+    return True
 
 
 async def async_from_config_dict(
@@ -473,7 +522,9 @@ async def async_from_config_dict(
     # Prime custom component cache early so we know if registry entries are tied
     # to a custom integration
     await loader.async_get_custom_components(hass)
-    await async_load_base_functionality(hass)
+
+    if not await async_load_base_functionality(hass):
+        return None
 
     # Set up core.
     _LOGGER.debug("Setting up %s", CORE_INTEGRATIONS)
@@ -513,38 +564,6 @@ async def async_from_config_dict(
 
     stop = monotonic()
     _LOGGER.info("Home Assistant initialized in %.2fs", stop - start)
-
-    if (
-        REQUIRED_NEXT_PYTHON_HA_RELEASE
-        and sys.version_info[:3] < REQUIRED_NEXT_PYTHON_VER
-    ):
-        current_python_version = ".".join(str(x) for x in sys.version_info[:3])
-        required_python_version = ".".join(str(x) for x in REQUIRED_NEXT_PYTHON_VER[:2])
-        _LOGGER.warning(
-            (
-                "Support for the running Python version %s is deprecated and "
-                "will be removed in Home Assistant %s; "
-                "Please upgrade Python to %s"
-            ),
-            current_python_version,
-            REQUIRED_NEXT_PYTHON_HA_RELEASE,
-            required_python_version,
-        )
-        issue_registry.async_create_issue(
-            hass,
-            core.DOMAIN,
-            f"python_version_{required_python_version}",
-            is_fixable=False,
-            severity=issue_registry.IssueSeverity.WARNING,
-            breaks_in_ha_version=REQUIRED_NEXT_PYTHON_HA_RELEASE,
-            translation_key="python_version",
-            translation_placeholders={
-                "current_python_version": current_python_version,
-                "required_python_version": required_python_version,
-                "breaks_in_ha_version": REQUIRED_NEXT_PYTHON_HA_RELEASE,
-            },
-        )
-
     return hass
 
 
@@ -616,34 +635,37 @@ async def async_enable_logging(
         ),
     )
 
-    # Log errors to a file if we have write access to file or config dir
+    logger = logging.getLogger()
+    logger.setLevel(logging.INFO if verbose else logging.WARNING)
+
     if log_file is None:
-        err_log_path = hass.config.path(ERROR_LOG_FILENAME)
+        default_log_path = hass.config.path(ERROR_LOG_FILENAME)
+        if "SUPERVISOR" in os.environ and "HA_DUPLICATE_LOG_FILE" not in os.environ:
+            # Rename the default log file if it exists, since previous versions created
+            # it even on Supervisor
+            def rename_old_file() -> None:
+                """Rename old log file in executor."""
+                if os.path.isfile(default_log_path):
+                    with contextlib.suppress(OSError):
+                        os.rename(default_log_path, f"{default_log_path}.old")
+
+            await hass.async_add_executor_job(rename_old_file)
+            err_log_path = None
+        else:
+            err_log_path = default_log_path
     else:
         err_log_path = os.path.abspath(log_file)
 
-    err_path_exists = os.path.isfile(err_log_path)
-    err_dir = os.path.dirname(err_log_path)
-
-    # Check if we can write to the error log if it exists or that
-    # we can create files in the containing directory if not.
-    if (err_path_exists and os.access(err_log_path, os.W_OK)) or (
-        not err_path_exists and os.access(err_dir, os.W_OK)
-    ):
+    if err_log_path:
         err_handler = await hass.async_add_executor_job(
             _create_log_file, err_log_path, log_rotate_days
         )
 
         err_handler.setFormatter(logging.Formatter(fmt, datefmt=FORMAT_DATETIME))
-
-        logger = logging.getLogger()
         logger.addHandler(err_handler)
-        logger.setLevel(logging.INFO if verbose else logging.WARNING)
 
         # Save the log file location for access by other components.
         hass.data[DATA_LOGGING] = err_log_path
-    else:
-        _LOGGER.error("Unable to set up error log %s (access denied)", err_log_path)
 
     async_activate_log_queue_handler(hass)
 
@@ -997,7 +1019,7 @@ class _WatchPendingSetups:
             # We log every LOG_SLOW_STARTUP_INTERVAL until all integrations are done
             # once we take over LOG_SLOW_STARTUP_INTERVAL (60s) to start up
             _LOGGER.warning(
-                "Waiting on integrations to complete setup: %s",
+                "Waiting for integrations to complete setup: %s",
                 self._setup_started,
             )
 

homeassistant/brands/american_standard.json

@@ -0,0 +1,5 @@
+{
+  "domain": "american_standard",
+  "name": "American Standard",
+  "integrations": ["nexia", "trane"]
+}

homeassistant/brands/bega.json

@@ -0,0 +1,5 @@
+{
+  "domain": "bega",
+  "name": "BEGA",
+  "iot_standards": ["zigbee"]
+}

homeassistant/brands/cloudflare.json

@@ -0,0 +1,5 @@
+{
+  "domain": "cloudflare",
+  "name": "Cloudflare",
+  "integrations": ["cloudflare", "cloudflare_r2"]
+}

homeassistant/brands/denon.json

@@ -1,5 +1,5 @@
 {
   "domain": "denon",
   "name": "Denon",
-  "integrations": ["denon", "denonavr", "heos"]
+  "integrations": ["denon", "denonavr", "denon_rs232", "heos"]
 }

homeassistant/brands/eltako.json

@@ -0,0 +1,5 @@
+{
+  "domain": "eltako",
+  "name": "Eltako",
+  "iot_standards": ["matter"]
+}

homeassistant/brands/fritzbox.json

@@ -1,5 +1,5 @@
 {
   "domain": "fritzbox",
-  "name": "FRITZ!Box",
+  "name": "FRITZ!",
   "integrations": ["fritz", "fritzbox", "fritzbox_callmonitor"]
 }

homeassistant/brands/google.json

@@ -2,11 +2,11 @@
   "domain": "google",
   "name": "Google",
   "integrations": [
+    "google_air_quality",
     "google_assistant",
     "google_assistant_sdk",
     "google_cloud",
     "google_drive",
-    "google_gemini",
     "google_generative_ai_conversation",
     "google_mail",
     "google_maps",
@@ -16,6 +16,7 @@
     "google_tasks",
     "google_translate",
     "google_travel_time",
+    "google_weather",
     "google_wifi",
     "google",
     "nest",

homeassistant/brands/heatit.json

@@ -0,0 +1,5 @@
+{
+  "domain": "heatit",
+  "name": "Heatit",
+  "iot_standards": ["zwave"]
+}

homeassistant/brands/heiman.json

@@ -0,0 +1,5 @@
+{
+  "domain": "heiman",
+  "name": "Heiman",
+  "iot_standards": ["matter", "zigbee"]
+}

homeassistant/brands/ibm.json

@@ -1,5 +0,0 @@
-{
-  "domain": "ibm",
-  "name": "IBM",
-  "integrations": ["watson_iot", "watson_tts"]
-}

homeassistant/brands/konnected.json

@@ -0,0 +1,5 @@
+{
+  "domain": "konnected",
+  "name": "Konnected",
+  "integrations": ["konnected", "konnected_esphome"]
+}

homeassistant/brands/level.json

@@ -0,0 +1,5 @@
+{
+  "domain": "level",
+  "name": "Level",
+  "iot_standards": ["matter"]
+}

homeassistant/brands/leviton.json

@@ -1,5 +1,6 @@
 {
   "domain": "leviton",
   "name": "Leviton",
+  "integrations": ["decora_wifi"],
   "iot_standards": ["zwave"]
 }

homeassistant/brands/lg.json

@@ -1,5 +1,11 @@
 {
   "domain": "lg",
   "name": "LG",
-  "integrations": ["lg_netcast", "lg_soundbar", "lg_thinq", "webostv"]
+  "integrations": [
+    "lg_infrared",
+    "lg_netcast",
+    "lg_soundbar",
+    "lg_thinq",
+    "webostv"
+  ]
 }

homeassistant/brands/microsoft.json

@@ -13,6 +13,7 @@
     "microsoft",
     "msteams",
     "onedrive",
+    "onedrive_for_business",
     "xbox"
   ]
 }

homeassistant/brands/philips.json

@@ -1,5 +1,5 @@
 {
   "domain": "philips",
   "name": "Philips",
-  "integrations": ["dynalite", "hue", "philips_js"]
+  "integrations": ["dynalite", "hue", "hue_ble", "philips_js"]
 }

homeassistant/brands/powerfox.json

@@ -0,0 +1,5 @@
+{
+  "domain": "powerfox",
+  "name": "Powerfox",
+  "integrations": ["powerfox", "powerfox_local"]
+}

homeassistant/brands/raspberry_pi.json

@@ -1,5 +1,5 @@
 {
   "domain": "raspberry_pi",
   "name": "Raspberry Pi",
-  "integrations": ["raspberry_pi", "rpi_camera", "rpi_power", "remote_rpi_gpio"]
+  "integrations": ["raspberry_pi", "rpi_power", "remote_rpi_gpio"]
 }

homeassistant/brands/trane.json

@@ -0,0 +1,5 @@
+{
+  "domain": "trane",
+  "name": "Trane",
+  "integrations": ["nexia", "trane"]
+}

homeassistant/brands/ubiquiti.json

@@ -1,5 +1,13 @@
 {
   "domain": "ubiquiti",
   "name": "Ubiquiti",
-  "integrations": ["airos", "unifi", "unifi_direct", "unifiled", "unifiprotect"]
+  "integrations": [
+    "airos",
+    "unifi",
+    "unifi_access",
+    "unifi_direct",
+    "unifi_discovery",
+    "unifiled",
+    "unifiprotect"
+  ]
 }

homeassistant/brands/ubisys.json

@@ -0,0 +1,5 @@
+{
+  "domain": "ubisys",
+  "name": "Ubisys",
+  "iot_standards": ["zigbee"]
+}

homeassistant/brands/victron.json

@@ -0,0 +1,5 @@
+{
+  "domain": "victron",
+  "name": "Victron",
+  "integrations": ["victron_gx", "victron_ble", "victron_remote_monitoring"]
+}

homeassistant/brands/yale.json

@@ -1,11 +1,5 @@
 {
   "domain": "yale",
-  "name": "Yale",
-  "integrations": [
-    "august",
-    "yale_smart_alarm",
-    "yalexs_ble",
-    "yale_home",
-    "yale"
-  ]
+  "name": "Yale (non-US/Canada)",
+  "integrations": ["yale", "yalexs_ble", "yale_smart_alarm"]
 }

homeassistant/brands/yale_august.json

@@ -0,0 +1,5 @@
+{
+  "domain": "yale_august",
+  "name": "Yale August (US/Canada)",
+  "integrations": ["august", "august_ble"]
+}

homeassistant/components/abode/__init__.py

@@ -67,13 +67,16 @@ class AbodeSystem:
     logout_listener: CALLBACK_TYPE | None = None
 
 
+type AbodeConfigEntry = ConfigEntry[AbodeSystem]
+
+
 async def async_setup(hass: HomeAssistant, config: ConfigType) -> bool:
     """Set up the Abode component."""
     async_setup_services(hass)
     return True
 
 
-async def async_setup_entry(hass: HomeAssistant, entry: ConfigEntry) -> bool:
+async def async_setup_entry(hass: HomeAssistant, entry: AbodeConfigEntry) -> bool:
     """Set up Abode integration from a config entry."""
     username = entry.data[CONF_USERNAME]
     password = entry.data[CONF_PASSWORD]
@@ -99,49 +102,54 @@ async def async_setup_entry(hass: HomeAssistant, entry: ConfigEntry) -> bool:
     except (AbodeException, ConnectTimeout, HTTPError) as ex:
         raise ConfigEntryNotReady(f"Unable to connect to Abode: {ex}") from ex
 
-    hass.data[DOMAIN] = AbodeSystem(abode, polling)
+    entry.runtime_data = AbodeSystem(abode, polling)
 
     await hass.config_entries.async_forward_entry_setups(entry, PLATFORMS)
 
-    await setup_hass_events(hass)
-    await hass.async_add_executor_job(setup_abode_events, hass)
+    await setup_hass_events(hass, entry)
+    await hass.async_add_executor_job(setup_abode_events, hass, entry)
 
     return True
 
 
-async def async_unload_entry(hass: HomeAssistant, entry: ConfigEntry) -> bool:
+def _shutdown_client(abode: Abode) -> None:
+    """Shutdown client."""
+    abode.events.stop()
+    abode.logout()
+
+
+async def async_unload_entry(hass: HomeAssistant, entry: AbodeConfigEntry) -> bool:
     """Unload a config entry."""
     unload_ok = await hass.config_entries.async_unload_platforms(entry, PLATFORMS)
 
-    await hass.async_add_executor_job(hass.data[DOMAIN].abode.events.stop)
-    await hass.async_add_executor_job(hass.data[DOMAIN].abode.logout)
+    await hass.async_add_executor_job(_shutdown_client, entry.runtime_data.abode)
 
-    hass.data[DOMAIN].logout_listener()
-    hass.data.pop(DOMAIN)
+    if logout_listener := entry.runtime_data.logout_listener:
+        logout_listener()
 
     return unload_ok
 
 
-async def setup_hass_events(hass: HomeAssistant) -> None:
+async def setup_hass_events(hass: HomeAssistant, entry: AbodeConfigEntry) -> None:
     """Home Assistant start and stop callbacks."""
 
     def logout(event: Event) -> None:
         """Logout of Abode."""
-        if not hass.data[DOMAIN].polling:
-            hass.data[DOMAIN].abode.events.stop()
+        if not entry.runtime_data.polling:
+            entry.runtime_data.abode.events.stop()
 
-        hass.data[DOMAIN].abode.logout()
+        entry.runtime_data.abode.logout()
         LOGGER.info("Logged out of Abode")
 
-    if not hass.data[DOMAIN].polling:
-        await hass.async_add_executor_job(hass.data[DOMAIN].abode.events.start)
+    if not entry.runtime_data.polling:
+        await hass.async_add_executor_job(entry.runtime_data.abode.events.start)
 
-    hass.data[DOMAIN].logout_listener = hass.bus.async_listen_once(
+    entry.runtime_data.logout_listener = hass.bus.async_listen_once(
         EVENT_HOMEASSISTANT_STOP, logout
     )
 
 
-def setup_abode_events(hass: HomeAssistant) -> None:
+def setup_abode_events(hass: HomeAssistant, entry: AbodeConfigEntry) -> None:
     """Event callbacks."""
 
     def event_callback(event: str, event_json: dict[str, str]) -> None:
@@ -178,6 +186,6 @@ def setup_abode_events(hass: HomeAssistant) -> None:
     ]
 
     for event in events:
-        hass.data[DOMAIN].abode.events.add_event_callback(
+        entry.runtime_data.abode.events.add_event_callback(
             event, partial(event_callback, event)
         )

homeassistant/components/abode/alarm_control_panel.py

@@ -9,22 +9,20 @@ from homeassistant.components.alarm_control_panel import (
     AlarmControlPanelEntityFeature,
     AlarmControlPanelState,
 )
-from homeassistant.config_entries import ConfigEntry
 from homeassistant.core import HomeAssistant
 from homeassistant.helpers.entity_platform import AddConfigEntryEntitiesCallback
 
-from . import AbodeSystem
-from .const import DOMAIN
+from . import AbodeConfigEntry
 from .entity import AbodeDevice
 
 
 async def async_setup_entry(
     hass: HomeAssistant,
-    entry: ConfigEntry,
+    entry: AbodeConfigEntry,
     async_add_entities: AddConfigEntryEntitiesCallback,
 ) -> None:
     """Set up Abode alarm control panel device."""
-    data: AbodeSystem = hass.data[DOMAIN]
+    data = entry.runtime_data
     async_add_entities(
         [AbodeAlarm(data, await hass.async_add_executor_job(data.abode.get_alarm))]
     )

homeassistant/components/abode/binary_sensor.py

@@ -10,23 +10,21 @@ from homeassistant.components.binary_sensor import (
     BinarySensorDeviceClass,
     BinarySensorEntity,
 )
-from homeassistant.config_entries import ConfigEntry
 from homeassistant.core import HomeAssistant
 from homeassistant.helpers.entity_platform import AddConfigEntryEntitiesCallback
 from homeassistant.util.enum import try_parse_enum
 
-from . import AbodeSystem
-from .const import DOMAIN
+from . import AbodeConfigEntry
 from .entity import AbodeDevice
 
 
 async def async_setup_entry(
     hass: HomeAssistant,
-    entry: ConfigEntry,
+    entry: AbodeConfigEntry,
     async_add_entities: AddConfigEntryEntitiesCallback,
 ) -> None:
     """Set up Abode binary sensor devices."""
-    data: AbodeSystem = hass.data[DOMAIN]
+    data = entry.runtime_data
 
     device_types = [
         "connectivity",

homeassistant/components/abode/camera.py

@@ -12,14 +12,13 @@ import requests
 from requests.models import Response
 
 from homeassistant.components.camera import Camera
-from homeassistant.config_entries import ConfigEntry
 from homeassistant.core import Event, HomeAssistant
 from homeassistant.helpers.dispatcher import async_dispatcher_connect
 from homeassistant.helpers.entity_platform import AddConfigEntryEntitiesCallback
 from homeassistant.util import Throttle
 
-from . import AbodeSystem
-from .const import DOMAIN, LOGGER
+from . import AbodeConfigEntry, AbodeSystem
+from .const import LOGGER
 from .entity import AbodeDevice
 
 MIN_TIME_BETWEEN_UPDATES = timedelta(seconds=90)
@@ -27,11 +26,11 @@ MIN_TIME_BETWEEN_UPDATES = timedelta(seconds=90)
 
 async def async_setup_entry(
     hass: HomeAssistant,
-    entry: ConfigEntry,
+    entry: AbodeConfigEntry,
     async_add_entities: AddConfigEntryEntitiesCallback,
 ) -> None:
     """Set up Abode camera devices."""
-    data: AbodeSystem = hass.data[DOMAIN]
+    data = entry.runtime_data
 
     async_add_entities(
         AbodeCamera(data, device, timeline.CAPTURE_IMAGE)

homeassistant/components/abode/config_flow.py

@@ -64,7 +64,7 @@ class AbodeFlowHandler(ConfigFlow, domain=DOMAIN):
             else:
                 errors = {"base": "cannot_connect"}
 
-        except (ConnectTimeout, HTTPError):
+        except ConnectTimeout, HTTPError:
             errors = {"base": "cannot_connect"}
 
         if errors:

homeassistant/components/abode/const.py

@@ -1,5 +1,7 @@
 """Constants for the Abode Security System component."""
 
+from __future__ import annotations
+
 import logging
 
 LOGGER = logging.getLogger(__package__)

homeassistant/components/abode/cover.py

@@ -5,22 +5,20 @@ from typing import Any
 from jaraco.abode.devices.cover import Cover
 
 from homeassistant.components.cover import CoverEntity
-from homeassistant.config_entries import ConfigEntry
 from homeassistant.core import HomeAssistant
 from homeassistant.helpers.entity_platform import AddConfigEntryEntitiesCallback
 
-from . import AbodeSystem
-from .const import DOMAIN
+from . import AbodeConfigEntry
 from .entity import AbodeDevice
 
 
 async def async_setup_entry(
     hass: HomeAssistant,
-    entry: ConfigEntry,
+    entry: AbodeConfigEntry,
     async_add_entities: AddConfigEntryEntitiesCallback,
 ) -> None:
     """Set up Abode cover devices."""
-    data: AbodeSystem = hass.data[DOMAIN]
+    data = entry.runtime_data
 
     async_add_entities(
         AbodeCover(data, device)

homeassistant/components/abode/entity.py

@@ -29,7 +29,7 @@ class AbodeEntity(Entity):
             self._update_connection_status,
         )
 
-        self.hass.data[DOMAIN].entity_ids.add(self.entity_id)
+        self._data.entity_ids.add(self.entity_id)
 
     async def async_will_remove_from_hass(self) -> None:
         """Unsubscribe from Abode connection status updates."""

homeassistant/components/abode/light.py

@@ -16,22 +16,20 @@ from homeassistant.components.light import (
     ColorMode,
     LightEntity,
 )
-from homeassistant.config_entries import ConfigEntry
 from homeassistant.core import HomeAssistant
 from homeassistant.helpers.entity_platform import AddConfigEntryEntitiesCallback
 
-from . import AbodeSystem
-from .const import DOMAIN
+from . import AbodeConfigEntry
 from .entity import AbodeDevice
 
 
 async def async_setup_entry(
     hass: HomeAssistant,
-    entry: ConfigEntry,
+    entry: AbodeConfigEntry,
     async_add_entities: AddConfigEntryEntitiesCallback,
 ) -> None:
     """Set up Abode light devices."""
-    data: AbodeSystem = hass.data[DOMAIN]
+    data = entry.runtime_data
 
     async_add_entities(
         AbodeLight(data, device)
@@ -100,7 +98,7 @@ class AbodeLight(AbodeDevice, LightEntity):
         return _hs
 
     @property
-    def color_mode(self) -> str | None:
+    def color_mode(self) -> ColorMode:
         """Return the color mode of the light."""
         if self._device.is_dimmable and self._device.is_color_capable:
             if self.hs_color is not None:
@@ -111,7 +109,7 @@ class AbodeLight(AbodeDevice, LightEntity):
         return ColorMode.ONOFF
 
     @property
-    def supported_color_modes(self) -> set[str] | None:
+    def supported_color_modes(self) -> set[ColorMode]:
         """Flag supported color modes."""
         if self._device.is_dimmable and self._device.is_color_capable:
             return {ColorMode.COLOR_TEMP, ColorMode.HS}

homeassistant/components/abode/lock.py

@@ -5,22 +5,20 @@ from typing import Any
 from jaraco.abode.devices.lock import Lock
 
 from homeassistant.components.lock import LockEntity
-from homeassistant.config_entries import ConfigEntry
 from homeassistant.core import HomeAssistant
 from homeassistant.helpers.entity_platform import AddConfigEntryEntitiesCallback
 
-from . import AbodeSystem
-from .const import DOMAIN
+from . import AbodeConfigEntry
 from .entity import AbodeDevice
 
 
 async def async_setup_entry(
     hass: HomeAssistant,
-    entry: ConfigEntry,
+    entry: AbodeConfigEntry,
     async_add_entities: AddConfigEntryEntitiesCallback,
 ) -> None:
     """Set up Abode lock devices."""
-    data: AbodeSystem = hass.data[DOMAIN]
+    data = entry.runtime_data
 
     async_add_entities(
         AbodeLock(data, device)

homeassistant/components/abode/manifest.json

@@ -9,6 +9,6 @@
   },
   "iot_class": "cloud_push",
   "loggers": ["jaraco.abode", "lomond"],
-  "requirements": ["jaraco.abode==6.2.1"],
+  "requirements": ["jaraco.abode==6.4.0"],
   "single_config_entry": true
 }

homeassistant/components/abode/sensor.py

@@ -12,14 +12,13 @@ from homeassistant.components.sensor import (
     SensorDeviceClass,
     SensorEntity,
     SensorEntityDescription,
+    SensorStateClass,
 )
-from homeassistant.config_entries import ConfigEntry
 from homeassistant.const import LIGHT_LUX, PERCENTAGE, UnitOfTemperature
 from homeassistant.core import HomeAssistant
 from homeassistant.helpers.entity_platform import AddConfigEntryEntitiesCallback
 
-from . import AbodeSystem
-from .const import DOMAIN
+from . import AbodeConfigEntry, AbodeSystem
 from .entity import AbodeDevice
 
 ABODE_TEMPERATURE_UNIT_HA_UNIT = {
@@ -40,6 +39,7 @@ SENSOR_TYPES: tuple[AbodeSensorDescription, ...] = (
     AbodeSensorDescription(
         key="temperature",
         device_class=SensorDeviceClass.TEMPERATURE,
+        state_class=SensorStateClass.MEASUREMENT,
         native_unit_of_measurement_fn=lambda device: ABODE_TEMPERATURE_UNIT_HA_UNIT[
             device.temp_unit
         ],
@@ -48,12 +48,14 @@ SENSOR_TYPES: tuple[AbodeSensorDescription, ...] = (
     AbodeSensorDescription(
         key="humidity",
         device_class=SensorDeviceClass.HUMIDITY,
+        state_class=SensorStateClass.MEASUREMENT,
         native_unit_of_measurement_fn=lambda _: PERCENTAGE,
         value_fn=lambda device: cast(float, device.humidity),
     ),
     AbodeSensorDescription(
         key="lux",
         device_class=SensorDeviceClass.ILLUMINANCE,
+        state_class=SensorStateClass.MEASUREMENT,
         native_unit_of_measurement_fn=lambda _: LIGHT_LUX,
         value_fn=lambda device: cast(float, device.lux),
     ),
@@ -62,11 +64,11 @@ SENSOR_TYPES: tuple[AbodeSensorDescription, ...] = (
 
 async def async_setup_entry(
     hass: HomeAssistant,
-    entry: ConfigEntry,
+    entry: AbodeConfigEntry,
     async_add_entities: AddConfigEntryEntitiesCallback,
 ) -> None:
     """Set up Abode sensor devices."""
-    data: AbodeSystem = hass.data[DOMAIN]
+    data = entry.runtime_data
 
     async_add_entities(
         AbodeSensor(data, device, description)

homeassistant/components/abode/services.py

@@ -2,19 +2,21 @@
 
 from __future__ import annotations
 
+from typing import TYPE_CHECKING
+
 from jaraco.abode.exceptions import Exception as AbodeException
 import voluptuous as vol
 
 from homeassistant.const import ATTR_ENTITY_ID
 from homeassistant.core import HomeAssistant, ServiceCall, callback
+from homeassistant.exceptions import ServiceValidationError
 from homeassistant.helpers import config_validation as cv
 from homeassistant.helpers.dispatcher import dispatcher_send
 
 from .const import DOMAIN, LOGGER
 
-SERVICE_SETTINGS = "change_setting"
-SERVICE_CAPTURE_IMAGE = "capture_image"
-SERVICE_TRIGGER_AUTOMATION = "trigger_automation"
+if TYPE_CHECKING:
+    from . import AbodeConfigEntry, AbodeSystem
 
 ATTR_SETTING = "setting"
 ATTR_VALUE = "value"
@@ -29,13 +31,21 @@ CAPTURE_IMAGE_SCHEMA = vol.Schema({ATTR_ENTITY_ID: cv.entity_ids})
 AUTOMATION_SCHEMA = vol.Schema({ATTR_ENTITY_ID: cv.entity_ids})
 
 
+def _get_abode_system(hass: HomeAssistant) -> AbodeSystem:
+    """Return the Abode system for the loaded config entry."""
+    entries: list[AbodeConfigEntry] = hass.config_entries.async_loaded_entries(DOMAIN)
+    if not entries:
+        raise ServiceValidationError("Abode integration is not loaded")
+    return entries[0].runtime_data
+
+
 def _change_setting(call: ServiceCall) -> None:
     """Change an Abode system setting."""
     setting = call.data[ATTR_SETTING]
     value = call.data[ATTR_VALUE]
 
     try:
-        call.hass.data[DOMAIN].abode.set_setting(setting, value)
+        _get_abode_system(call.hass).abode.set_setting(setting, value)
     except AbodeException as ex:
         LOGGER.warning(ex)
 
@@ -46,7 +56,7 @@ def _capture_image(call: ServiceCall) -> None:
 
     target_entities = [
         entity_id
-        for entity_id in call.hass.data[DOMAIN].entity_ids
+        for entity_id in _get_abode_system(call.hass).entity_ids
         if entity_id in entity_ids
     ]
 
@@ -61,7 +71,7 @@ def _trigger_automation(call: ServiceCall) -> None:
 
     target_entities = [
         entity_id
-        for entity_id in call.hass.data[DOMAIN].entity_ids
+        for entity_id in _get_abode_system(call.hass).entity_ids
         if entity_id in entity_ids
     ]
 
@@ -75,16 +85,13 @@ def async_setup_services(hass: HomeAssistant) -> None:
     """Home Assistant services."""
 
     hass.services.async_register(
-        DOMAIN, SERVICE_SETTINGS, _change_setting, schema=CHANGE_SETTING_SCHEMA
+        DOMAIN, "change_setting", _change_setting, schema=CHANGE_SETTING_SCHEMA
     )
 
     hass.services.async_register(
-        DOMAIN, SERVICE_CAPTURE_IMAGE, _capture_image, schema=CAPTURE_IMAGE_SCHEMA
+        DOMAIN, "capture_image", _capture_image, schema=CAPTURE_IMAGE_SCHEMA
     )
 
     hass.services.async_register(
-        DOMAIN,
-        SERVICE_TRIGGER_AUTOMATION,
-        _trigger_automation,
-        schema=AUTOMATION_SCHEMA,
+        DOMAIN, "trigger_automation", _trigger_automation, schema=AUTOMATION_SCHEMA
     )

homeassistant/components/abode/strings.json

@@ -1,70 +1,70 @@
 {
   "config": {
-    "step": {
-      "user": {
-        "title": "Fill in your Abode login information",
-        "data": {
-          "username": "[%key:common::config_flow::data::email%]",
-          "password": "[%key:common::config_flow::data::password%]"
-        }
-      },
-      "mfa": {
-        "title": "Enter your MFA code for Abode",
-        "data": {
-          "mfa_code": "MFA code (6-digits)"
-        }
-      },
-      "reauth_confirm": {
-        "title": "[%key:component::abode::config::step::user::title%]",
-        "data": {
-          "username": "[%key:common::config_flow::data::email%]",
-          "password": "[%key:common::config_flow::data::password%]"
-        }
-      }
-    },
-    "error": {
-      "invalid_auth": "[%key:common::config_flow::error::invalid_auth%]",
-      "cannot_connect": "[%key:common::config_flow::error::cannot_connect%]",
-      "invalid_mfa_code": "Invalid MFA code"
-    },
     "abort": {
       "reauth_successful": "[%key:common::config_flow::abort::reauth_successful%]"
+    },
+    "error": {
+      "cannot_connect": "[%key:common::config_flow::error::cannot_connect%]",
+      "invalid_auth": "[%key:common::config_flow::error::invalid_auth%]",
+      "invalid_mfa_code": "Invalid MFA code"
+    },
+    "step": {
+      "mfa": {
+        "data": {
+          "mfa_code": "MFA code (6-digits)"
+        },
+        "title": "Enter your MFA code for Abode"
+      },
+      "reauth_confirm": {
+        "data": {
+          "password": "[%key:common::config_flow::data::password%]",
+          "username": "[%key:common::config_flow::data::email%]"
+        },
+        "title": "[%key:component::abode::config::step::user::title%]"
+      },
+      "user": {
+        "data": {
+          "password": "[%key:common::config_flow::data::password%]",
+          "username": "[%key:common::config_flow::data::email%]"
+        },
+        "title": "Fill in your Abode login information"
+      }
     }
   },
   "services": {
     "capture_image": {
-      "name": "Capture image",
       "description": "Requests a new image capture from a camera device.",
       "fields": {
         "entity_id": {
-          "name": "Entity",
-          "description": "Entity ID of the camera to request an image from."
+          "description": "Entity ID of the camera to request an image from.",
+          "name": "Entity"
         }
-      }
+      },
+      "name": "Capture image"
     },
     "change_setting": {
-      "name": "Change setting",
       "description": "Changes an Abode system setting.",
       "fields": {
         "setting": {
-          "name": "Setting",
-          "description": "Setting to change."
+          "description": "Setting to change.",
+          "name": "Setting"
         },
         "value": {
-          "name": "Value",
-          "description": "Value of the setting."
+          "description": "Value of the setting.",
+          "name": "Value"
         }
-      }
+      },
+      "name": "Change setting"
     },
     "trigger_automation": {
-      "name": "Trigger automation",
       "description": "Triggers an Abode automation.",
       "fields": {
         "entity_id": {
-          "name": "Entity",
-          "description": "Entity ID of the automation to trigger."
+          "description": "Entity ID of the automation to trigger.",
+          "name": "Entity"
         }
-      }
+      },
+      "name": "Trigger automation"
     }
   }
 }

homeassistant/components/abode/switch.py

@@ -7,13 +7,11 @@ from typing import Any, cast
 from jaraco.abode.devices.switch import Switch
 
 from homeassistant.components.switch import SwitchEntity
-from homeassistant.config_entries import ConfigEntry
 from homeassistant.core import HomeAssistant
 from homeassistant.helpers.dispatcher import async_dispatcher_connect
 from homeassistant.helpers.entity_platform import AddConfigEntryEntitiesCallback
 
-from . import AbodeSystem
-from .const import DOMAIN
+from . import AbodeConfigEntry
 from .entity import AbodeAutomation, AbodeDevice
 
 DEVICE_TYPES = ["switch", "valve"]
@@ -21,11 +19,11 @@ DEVICE_TYPES = ["switch", "valve"]
 
 async def async_setup_entry(
     hass: HomeAssistant,
-    entry: ConfigEntry,
+    entry: AbodeConfigEntry,
     async_add_entities: AddConfigEntryEntitiesCallback,
 ) -> None:
     """Set up Abode switch devices."""
-    data: AbodeSystem = hass.data[DOMAIN]
+    data = entry.runtime_data
 
     entities: list[SwitchEntity] = [
         AbodeSwitch(data, device)

homeassistant/components/acaia/coordinator.py

@@ -8,14 +8,17 @@ import logging
 from aioacaia.acaiascale import AcaiaScale
 from aioacaia.exceptions import AcaiaDeviceNotFound, AcaiaError
 
+from homeassistant.components.bluetooth import async_get_scanner
 from homeassistant.config_entries import ConfigEntry
 from homeassistant.const import CONF_ADDRESS
 from homeassistant.core import HomeAssistant
+from homeassistant.helpers.debounce import Debouncer
 from homeassistant.helpers.update_coordinator import DataUpdateCoordinator
 
 from .const import CONF_IS_NEW_STYLE_SCALE
 
 SCAN_INTERVAL = timedelta(seconds=15)
+UPDATE_DEBOUNCE_TIME = 0.2
 
 _LOGGER = logging.getLogger(__name__)
 
@@ -37,11 +40,20 @@ class AcaiaCoordinator(DataUpdateCoordinator[None]):
             config_entry=entry,
         )
 
+        debouncer = Debouncer(
+            hass=hass,
+            logger=_LOGGER,
+            cooldown=UPDATE_DEBOUNCE_TIME,
+            immediate=True,
+            function=self.async_update_listeners,
+        )
+
         self._scale = AcaiaScale(
             address_or_ble_device=entry.data[CONF_ADDRESS],
             name=entry.title,
             is_new_style_scale=entry.data[CONF_IS_NEW_STYLE_SCALE],
-            notify_callback=self.async_update_listeners,
+            notify_callback=debouncer.async_schedule_call,
+            scanner=async_get_scanner(hass),
         )
 
     @property

homeassistant/components/acaia/icons.json

@@ -4,20 +4,20 @@
       "timer_running": {
         "default": "mdi:timer",
         "state": {
-          "on": "mdi:timer-play",
-          "off": "mdi:timer-off"
+          "off": "mdi:timer-off",
+          "on": "mdi:timer-play"
         }
       }
     },
     "button": {
-      "tare": {
-        "default": "mdi:scale-balance"
-      },
       "reset_timer": {
         "default": "mdi:timer-refresh"
       },
       "start_stop": {
         "default": "mdi:timer-play"
+      },
+      "tare": {
+        "default": "mdi:scale-balance"
       }
     }
   }

homeassistant/components/acaia/manifest.json

@@ -26,5 +26,5 @@
   "iot_class": "local_push",
   "loggers": ["aioacaia"],
   "quality_scale": "platinum",
-  "requirements": ["aioacaia==0.1.14"]
+  "requirements": ["aioacaia==0.1.17"]
 }

homeassistant/components/acaia/strings.json

@@ -1,6 +1,5 @@
 {
   "config": {
-    "flow_title": "{name}",
     "abort": {
       "already_configured": "[%key:common::config_flow::abort::already_configured_device%]",
       "no_devices_found": "[%key:common::config_flow::abort::no_devices_found%]",
@@ -10,18 +9,19 @@
       "device_not_found": "Device could not be found.",
       "unknown": "[%key:common::config_flow::error::unknown%]"
     },
+    "flow_title": "{name}",
     "step": {
       "bluetooth_confirm": {
         "description": "[%key:component::bluetooth::config::step::bluetooth_confirm::description%]"
       },
       "user": {
-        "description": "[%key:component::bluetooth::config::step::user::description%]",
         "data": {
           "address": "[%key:common::config_flow::data::device%]"
         },
         "data_description": {
           "address": "Select Acaia scale you want to set up"
-        }
+        },
+        "description": "[%key:component::bluetooth::config::step::user::description%]"
       }
     }
   },
@@ -32,14 +32,14 @@
       }
     },
     "button": {
-      "tare": {
-        "name": "Tare"
-      },
       "reset_timer": {
         "name": "Reset timer"
       },
       "start_stop": {
         "name": "Start/stop timer"
+      },
+      "tare": {
+        "name": "Tare"
       }
     }
   }

homeassistant/components/accuweather/__init__.py

@@ -2,21 +2,23 @@
 
 from __future__ import annotations
 
+import asyncio
 import logging
 
 from accuweather import AccuWeather
 
-from homeassistant.components.sensor import DOMAIN as SENSOR_PLATFORM
-from homeassistant.const import CONF_API_KEY, CONF_NAME, Platform
+from homeassistant.components.sensor import DOMAIN as SENSOR_DOMAIN
+from homeassistant.const import CONF_API_KEY, Platform
 from homeassistant.core import HomeAssistant
 from homeassistant.helpers import entity_registry as er
 from homeassistant.helpers.aiohttp_client import async_get_clientsession
 
-from .const import DOMAIN, UPDATE_INTERVAL_DAILY_FORECAST, UPDATE_INTERVAL_OBSERVATION
+from .const import DOMAIN
 from .coordinator import (
     AccuWeatherConfigEntry,
     AccuWeatherDailyForecastDataUpdateCoordinator,
     AccuWeatherData,
+    AccuWeatherHourlyForecastDataUpdateCoordinator,
     AccuWeatherObservationDataUpdateCoordinator,
 )
 
@@ -28,7 +30,6 @@ PLATFORMS = [Platform.SENSOR, Platform.WEATHER]
 async def async_setup_entry(hass: HomeAssistant, entry: AccuWeatherConfigEntry) -> bool:
     """Set up AccuWeather as config entry."""
     api_key: str = entry.data[CONF_API_KEY]
-    name: str = entry.data[CONF_NAME]
 
     location_key = entry.unique_id
 
@@ -41,26 +42,28 @@ async def async_setup_entry(hass: HomeAssistant, entry: AccuWeatherConfigEntry)
         hass,
         entry,
         accuweather,
-        name,
-        "observation",
-        UPDATE_INTERVAL_OBSERVATION,
     )
-
     coordinator_daily_forecast = AccuWeatherDailyForecastDataUpdateCoordinator(
         hass,
         entry,
         accuweather,
-        name,
-        "daily forecast",
-        UPDATE_INTERVAL_DAILY_FORECAST,
+    )
+    coordinator_hourly_forecast = AccuWeatherHourlyForecastDataUpdateCoordinator(
+        hass,
+        entry,
+        accuweather,
     )
 
-    await coordinator_observation.async_config_entry_first_refresh()
-    await coordinator_daily_forecast.async_config_entry_first_refresh()
+    await asyncio.gather(
+        coordinator_observation.async_config_entry_first_refresh(),
+        coordinator_daily_forecast.async_config_entry_first_refresh(),
+        coordinator_hourly_forecast.async_config_entry_first_refresh(),
+    )
 
     entry.runtime_data = AccuWeatherData(
         coordinator_observation=coordinator_observation,
         coordinator_daily_forecast=coordinator_daily_forecast,
+        coordinator_hourly_forecast=coordinator_hourly_forecast,
     )
 
     await hass.config_entries.async_forward_entry_setups(entry, PLATFORMS)
@@ -69,7 +72,7 @@ async def async_setup_entry(hass: HomeAssistant, entry: AccuWeatherConfigEntry)
     ent_reg = er.async_get(hass)
     for day in range(5):
         unique_id = f"{location_key}-ozone-{day}"
-        if entity_id := ent_reg.async_get_entity_id(SENSOR_PLATFORM, DOMAIN, unique_id):
+        if entity_id := ent_reg.async_get_entity_id(SENSOR_DOMAIN, DOMAIN, unique_id):
             _LOGGER.debug("Removing ozone sensor entity %s", entity_id)
             ent_reg.async_remove(entity_id)
 

homeassistant/components/accuweather/config_flow.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 from asyncio import timeout
+from collections.abc import Mapping
 from typing import Any
 
 from accuweather import AccuWeather, ApiError, InvalidApiKeyError, RequestsExceededError
@@ -22,6 +23,8 @@ class AccuWeatherFlowHandler(ConfigFlow, domain=DOMAIN):
     """Config flow for AccuWeather."""
 
     VERSION = 1
+    _latitude: float | None = None
+    _longitude: float | None = None
 
     async def async_step_user(
         self, user_input: dict[str, Any] | None = None
@@ -40,7 +43,7 @@ class AccuWeatherFlowHandler(ConfigFlow, domain=DOMAIN):
                         longitude=user_input[CONF_LONGITUDE],
                     )
                     await accuweather.async_get_location()
-            except (ApiError, ClientConnectorError, TimeoutError, ClientError):
+            except ApiError, ClientConnectorError, TimeoutError, ClientError:
                 errors["base"] = "cannot_connect"
             except InvalidApiKeyError:
                 errors[CONF_API_KEY] = "invalid_api_key"
@@ -50,6 +53,7 @@ class AccuWeatherFlowHandler(ConfigFlow, domain=DOMAIN):
                 await self.async_set_unique_id(
                     accuweather.location_key, raise_on_progress=False
                 )
+                self._abort_if_unique_id_configured()
 
                 return self.async_create_entry(
                     title=user_input[CONF_NAME], data=user_input
@@ -73,3 +77,46 @@ class AccuWeatherFlowHandler(ConfigFlow, domain=DOMAIN):
             ),
             errors=errors,
         )
+
+    async def async_step_reauth(
+        self, entry_data: Mapping[str, Any]
+    ) -> ConfigFlowResult:
+        """Handle configuration by re-auth."""
+        self._latitude = entry_data[CONF_LATITUDE]
+        self._longitude = entry_data[CONF_LONGITUDE]
+
+        return await self.async_step_reauth_confirm()
+
+    async def async_step_reauth_confirm(
+        self, user_input: dict[str, Any] | None = None
+    ) -> ConfigFlowResult:
+        """Dialog that informs the user that reauth is required."""
+        errors: dict[str, str] = {}
+
+        if user_input is not None:
+            websession = async_get_clientsession(self.hass)
+            try:
+                async with timeout(10):
+                    accuweather = AccuWeather(
+                        user_input[CONF_API_KEY],
+                        websession,
+                        latitude=self._latitude,
+                        longitude=self._longitude,
+                    )
+                    await accuweather.async_get_location()
+            except ApiError, ClientConnectorError, TimeoutError, ClientError:
+                errors["base"] = "cannot_connect"
+            except InvalidApiKeyError:
+                errors["base"] = "invalid_api_key"
+            except RequestsExceededError:
+                errors["base"] = "requests_exceeded"
+            else:
+                return self.async_update_reload_and_abort(
+                    self._get_reauth_entry(), data_updates=user_input
+                )
+
+        return self.async_show_form(
+            step_id="reauth_confirm",
+            data_schema=vol.Schema({vol.Required(CONF_API_KEY): str}),
+            errors=errors,
+        )

homeassistant/components/accuweather/const.py

@@ -69,5 +69,6 @@ POLLEN_CATEGORY_MAP = {
     4: "very_high",
     5: "extreme",
 }
-UPDATE_INTERVAL_OBSERVATION = timedelta(minutes=40)
+UPDATE_INTERVAL_OBSERVATION = timedelta(minutes=10)
 UPDATE_INTERVAL_DAILY_FORECAST = timedelta(hours=6)
+UPDATE_INTERVAL_HOURLY_FORECAST = timedelta(minutes=30)

homeassistant/components/accuweather/coordinator.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 from asyncio import timeout
+from collections.abc import Awaitable, Callable
 from dataclasses import dataclass
 from datetime import timedelta
 import logging
@@ -12,7 +13,9 @@ from accuweather import AccuWeather, ApiError, InvalidApiKeyError, RequestsExcee
 from aiohttp.client_exceptions import ClientConnectorError
 
 from homeassistant.config_entries import ConfigEntry
+from homeassistant.const import CONF_NAME
 from homeassistant.core import HomeAssistant
+from homeassistant.exceptions import ConfigEntryAuthFailed
 from homeassistant.helpers.device_registry import DeviceEntryType, DeviceInfo
 from homeassistant.helpers.update_coordinator import (
     DataUpdateCoordinator,
@@ -20,9 +23,15 @@ from homeassistant.helpers.update_coordinator import (
     UpdateFailed,
 )
 
-from .const import DOMAIN, MANUFACTURER
+from .const import (
+    DOMAIN,
+    MANUFACTURER,
+    UPDATE_INTERVAL_DAILY_FORECAST,
+    UPDATE_INTERVAL_HOURLY_FORECAST,
+    UPDATE_INTERVAL_OBSERVATION,
+)
 
-EXCEPTIONS = (ApiError, ClientConnectorError, InvalidApiKeyError, RequestsExceededError)
+EXCEPTIONS = (ApiError, ClientConnectorError, RequestsExceededError)
 
 _LOGGER = logging.getLogger(__name__)
 
@@ -33,6 +42,7 @@ class AccuWeatherData:
 
     coordinator_observation: AccuWeatherObservationDataUpdateCoordinator
     coordinator_daily_forecast: AccuWeatherDailyForecastDataUpdateCoordinator
+    coordinator_hourly_forecast: AccuWeatherHourlyForecastDataUpdateCoordinator
 
 
 type AccuWeatherConfigEntry = ConfigEntry[AccuWeatherData]
@@ -43,18 +53,18 @@ class AccuWeatherObservationDataUpdateCoordinator(
 ):
     """Class to manage fetching AccuWeather data API."""
 
+    config_entry: AccuWeatherConfigEntry
+
     def __init__(
         self,
         hass: HomeAssistant,
         config_entry: AccuWeatherConfigEntry,
         accuweather: AccuWeather,
-        name: str,
-        coordinator_type: str,
-        update_interval: timedelta,
     ) -> None:
         """Initialize."""
         self.accuweather = accuweather
         self.location_key = accuweather.location_key
+        name = config_entry.data[CONF_NAME]
 
         if TYPE_CHECKING:
             assert self.location_key is not None
@@ -65,8 +75,8 @@ class AccuWeatherObservationDataUpdateCoordinator(
             hass,
             _LOGGER,
             config_entry=config_entry,
-            name=f"{name} ({coordinator_type})",
-            update_interval=update_interval,
+            name=f"{name} (observation)",
+            update_interval=UPDATE_INTERVAL_OBSERVATION,
         )
 
     async def _async_update_data(self) -> dict[str, Any]:
@@ -80,29 +90,39 @@ class AccuWeatherObservationDataUpdateCoordinator(
                 translation_key="current_conditions_update_error",
                 translation_placeholders={"error": repr(error)},
             ) from error
+        except InvalidApiKeyError as err:
+            raise ConfigEntryAuthFailed(
+                translation_domain=DOMAIN,
+                translation_key="auth_error",
+                translation_placeholders={"entry": self.config_entry.title},
+            ) from err
 
         _LOGGER.debug("Requests remaining: %d", self.accuweather.requests_remaining)
 
         return result
 
 
-class AccuWeatherDailyForecastDataUpdateCoordinator(
+class AccuWeatherForecastDataUpdateCoordinator(
     TimestampDataUpdateCoordinator[list[dict[str, Any]]]
 ):
-    """Class to manage fetching AccuWeather data API."""
+    """Base class for AccuWeather forecast."""
+
+    config_entry: AccuWeatherConfigEntry
 
     def __init__(
         self,
         hass: HomeAssistant,
         config_entry: AccuWeatherConfigEntry,
         accuweather: AccuWeather,
-        name: str,
         coordinator_type: str,
         update_interval: timedelta,
+        fetch_method: Callable[..., Awaitable[list[dict[str, Any]]]],
     ) -> None:
         """Initialize."""
         self.accuweather = accuweather
         self.location_key = accuweather.location_key
+        self._fetch_method = fetch_method
+        name = config_entry.data[CONF_NAME]
 
         if TYPE_CHECKING:
             assert self.location_key is not None
@@ -118,24 +138,71 @@ class AccuWeatherDailyForecastDataUpdateCoordinator(
         )
 
     async def _async_update_data(self) -> list[dict[str, Any]]:
-        """Update data via library."""
+        """Update forecast data via library."""
         try:
             async with timeout(10):
-                result = await self.accuweather.async_get_daily_forecast(
-                    language=self.hass.config.language
-                )
+                result = await self._fetch_method(language=self.hass.config.language)
         except EXCEPTIONS as error:
             raise UpdateFailed(
                 translation_domain=DOMAIN,
                 translation_key="forecast_update_error",
                 translation_placeholders={"error": repr(error)},
             ) from error
+        except InvalidApiKeyError as err:
+            raise ConfigEntryAuthFailed(
+                translation_domain=DOMAIN,
+                translation_key="auth_error",
+                translation_placeholders={"entry": self.config_entry.title},
+            ) from err
 
         _LOGGER.debug("Requests remaining: %d", self.accuweather.requests_remaining)
-
         return result
 
 
+class AccuWeatherDailyForecastDataUpdateCoordinator(
+    AccuWeatherForecastDataUpdateCoordinator
+):
+    """Coordinator for daily forecast."""
+
+    def __init__(
+        self,
+        hass: HomeAssistant,
+        config_entry: AccuWeatherConfigEntry,
+        accuweather: AccuWeather,
+    ) -> None:
+        """Initialize."""
+        super().__init__(
+            hass,
+            config_entry,
+            accuweather,
+            "daily forecast",
+            UPDATE_INTERVAL_DAILY_FORECAST,
+            fetch_method=accuweather.async_get_daily_forecast,
+        )
+
+
+class AccuWeatherHourlyForecastDataUpdateCoordinator(
+    AccuWeatherForecastDataUpdateCoordinator
+):
+    """Coordinator for hourly forecast."""
+
+    def __init__(
+        self,
+        hass: HomeAssistant,
+        config_entry: AccuWeatherConfigEntry,
+        accuweather: AccuWeather,
+    ) -> None:
+        """Initialize."""
+        super().__init__(
+            hass,
+            config_entry,
+            accuweather,
+            "hourly forecast",
+            UPDATE_INTERVAL_HOURLY_FORECAST,
+            fetch_method=accuweather.async_get_hourly_forecast,
+        )
+
+
 def _get_device_info(location_key: str, name: str) -> DeviceInfo:
     """Get device info."""
     return DeviceInfo(

homeassistant/components/accuweather/icons.json

@@ -1,6 +1,9 @@
 {
   "entity": {
     "sensor": {
+      "air_quality": {
+        "default": "mdi:air-filter"
+      },
       "cloud_ceiling": {
         "default": "mdi:weather-fog"
       },
@@ -34,9 +37,6 @@
       "thunderstorm_probability_night": {
         "default": "mdi:weather-lightning"
       },
-      "translation_key": {
-        "default": "mdi:air-filter"
-      },
       "tree_pollen": {
         "default": "mdi:tree-outline"
       },