core

Home Assistant's cloud drop is mostly one version check --- title: "Home Assistant's cloud drop is mostly one version check" published: true description: "Home Assistant's analytics show installs leaning less on the cloud since 2021. Most of that is one retired update check, which on most installs still runs." tags: "opensource, privacy, iot, homeassistant" canonical_url: "blog.peng.ly" cover_image: "blog.peng.ly" ai_assisted: true --- Home Assistant will tell you which integrations everyone else runs. About 565,000 installs share that through its opt-in analytics, and nearly every device and service integration says in its manifest whether it talks to a cloud or stays on your network (its IoT class). Put the two together and you can see how cloud-heavy the average install is. Add up every integration in every install that shares, and in August 2021, 36% of them were cloud ones. Today it's 29%. Matter went from nothing to running in 41% of those installs over the same time. That looks a lot like local-first winning, so I went looking for where the drop came from. !Share of installs running each integration Share of installs running each integration (the data) _Of the installs that share integrations with Home Assistant's analytics: 60,321 in August 2021 (from the [Wayback Machine](web.archive.org)) and 565,267 on 27 October 2026._ It was the updater More than two-thirds of the drop is one integration leaving the list, and on most installs the thing it did never stopped. In 2021, 99% of installs had updater, which asked Home Assistant's servers once a day whether there was a new version. It was a cloud integration, and it came with default_config, so you had it whether you'd thought about it or not. It was deprecated in February 2022, dropped from default_config, and it's down to 0.2% now. Leave it out of 2021 and the cloud share then was 31%, not 36%. Four in five installs run Home Assistant OS or Supervised, and there the Supervisor checks version.home-assistant.io itself. It did in 2021 as well, every two hours back then and once a day now. It isn't an integration, so the analytics never counted it. Plain container installs did go quiet. The one I ran today never asked, which also means nothing tells it when there's an update. The cloud didn't go anywhere The average install that shares ran 4.8 cloud integrations in 2021, and it runs 5.2 now. Local ones went from 8.4 to 12.9. The share fell because people added a lot more local stuff, not because they dropped cloud ones. Tuya's the clearest case. Its integration goes through Tuya's cloud for everything, and it doubled from 15% of installs to 30% over the same years Matter turned up. People aren't swapping one for the other, they're running both. Matter's 41% isn't all people choosing it, either. Since 2024.5, a new Home Assistant OS install that spots a Matter device on the network sets Matter up, add-on and all, before you've finished onboarding. Thread does the same when it sees a border router, like an Apple TV or a Nest hub. Most of today's 565,000 installs didn't exist in 2021, so all of this is what installs looked like then against what they look like now, not the same people changing their minds. The shopping list test The shopping list shows how much a default does. It's a local integration nobody feels strongly about, and it sat at 5% of installs from 2021 to late 2022. Onboarding started adding it to new installs in 2023.9, and it's at 76% now. It also turned into a to-do list in 2023.11, so onboarding doesn't get all the credit, but nobody suddenly needed a shopping list. Onboarding adds four things today (here's the list): the shopping list, met.no's weather, Radio Browser and Google Translate's text-to-speech. The last three are cloud, and between them they're half of every cloud integration in installs that share. Google Translate doesn't call anyone until you ask Home Assistant to say something out loud, so that's a bit unfair on it. The two that do call, met.no and Radio Browser, are still nearly a third. What a new install calls So I started a fresh Home Assistant 2026.10.4 in a container this afternoon, onboarded it with a home location and nothing else, and logged every DNS lookup and new connection it made (UTC): 16:07:46 container starts 16:08:48 alerts.home-assistant.io 16:08:59 onboarding finished 16:08:59 aa015h6buqvih86i1.api.met.no 16:09:00 de1.api.radio-browser.info 16:09:30 alerts.home-assistant.io 17:08:00 aa015h6buqvih86i1.api.met.no The alerts feed is Home Assistant's own list of known problems with integrations. It's fetched every three hours, and again 30 seconds after any integration loads, which is the second one. Radio Browser asks for its stats every time Home Assistant starts, whether or not you ever play a station. Google Translate stayed quiet. That odd met.no hostname isn't yours, it's everyone's. met.no made it for Home Assistant in 2017 after complaining about how much traffic HA sent, so they could keep an eye on it. What does come from you is your home's latitude and longitude rounded to four decimal places, about 11 metres, plus its altitude, and it's sent again every hour or so (mine came back after 59 minutes). met.no's the Norwegian Meteorological Institute, not an ad network, and the forecast's useful. It's still your house to 11 metres, every hour, from a box a lot of people bought to keep that sort of thing at home. Keeping them on purpose The four onboarding added are in Settings --> Devices & services. Delete Radio Browser if you don't listen to internet radio, and Google Translate if you don't use voice. The shopping list's local, so keep it or don't. The alerts feed comes with default_config, so you'd have to drop that and everything in it to lose it, and tbh it's the one I'd keep. For met.no, open it, hit Configure and drag the pin to the middle of town, and the forecast for your high street is the same forecast. Do move it, though. Saving the form as it opens just pins it to your house.

Home Assistant 2026.10: actualiza directamente a 2026.10.3 y revisa estas integraciones > En breve: Sí, conviene actualizar, y lo razonable es saltar directamente a 2026.10.3. A fecha de 2026-10-24, según las notas de publicación consultadas, 2026.10.3 (publicada el 23 de octubre) figura como Latest. Resumen Sí, conviene actualizar, y lo razonable es saltar directamente a 2026.10.3. A fecha de 2026-10-24, según las notas de publicación consultadas, 2026.10.3 (publicada el 23 de octubre) figura como Latest. La rama salió el 7 de octubre con 2026.10.0, y después llegaron 2026.10.1 (10 de octubre), 2026.10.2 (16 de octubre) y 2026.10.3. Como los parches corrigen integraciones habituales en un homelab, no hay motivo para quedarse en 10.0 ni para instalar un parche intermedio. Criterio de decisión: si usas MQTT, Modbus, KNX, FRITZ!Box, UniFi o Proxmox, los parches te afectan de forma directa. Si no usas ninguna, el cambio más visible para ti será el mapa. Qué ha cambiado Cambios de fondo de 2026.10.0 Mapa. El proveedor de mapas anterior empezó a exigir API key y rompió todos los mapas en 2026.9. Ahora se usan teselas vectoriales de OpenStreetMap servidas por la nueva integración Map tiles, que las obtiene y cachea a través de tu instancia, de modo que el navegador no contacta con servidores externos de teselas. Quien puede verse afectado son los dispositivos antiguos incapaces de renderizar mapas vectoriales, como una tablet de pared vieja: vuelven automáticamente al mapa clásico. Trigger IDs. Ahora tienen interfaz: la condición «Triggered by» permite marcar triggers y Home Assistant gestiona los IDs. Tus IDs escritos a mano en YAML siguen funcionando igual, compartir ID entre triggers sigue permitido y Home Assistant no añade IDs a tu YAML. El campo de ID desaparece del editor. Por tanto, tus automatizaciones no deberían cambiar; lo único distinto es la edición desde la UI. Modbus. Hay 15 integraciones nuevas, entre ellas SolarEdge Modbus (local por Modbus TCP, sin cuenta ni cloud) y KACO Modbus, además de un panel para conexiones Modbus. Si tienes un inversor solar, puede interesarte, pero no es un motivo para actualizar por sí solo. Parches relevantes en un homelab - 2026.10.1: trae un cambio marcado como breaking-change: se elimina el intervalo de sondeo configurable por el usuario en omnilogic. También restauró TLS sin verificar para fuentes de stream con la opción verify_ssl y omitió la verificación TLS en streams RTSPS de UniFi Protect. - 2026.10.2: MQTT device triggers y tags ya no se disparan dos veces tras recargar; se arregló la validación de permisos de ProxmoxVE; FRITZ!Box Tools ignora dispositivos sin TR-064 en el descubrimiento SSDP y el setup de Fritz ya no falla si falta la clave NewEnable; se arregló la recarga de Modbus sin config YAML. - 2026.10.3: correcciones en Proxmox VE (detección de versión de actualización), UniFi Access (eventos de acceso duplicados), Omada, SMTP (nuevo contexto SSL en lugar de uno compartido), Synology DSM, Home Connect, EnergyZero y KNX (se retiene el timeout de arranque mientras inicializa el almacén de telegramas). Incluye además Python 3.14.8. Seguridad y privacidad 2026.10.2 revoca los refresh tokens al eliminar un usuario y oculta credenciales o datos identificativos en los diagnósticos de SFR Box, NRGkick, Teslemetry y Tesla Fleet. Si compartes diagnósticos para pedir ayuda, esto reduce el riesgo de filtrar datos, pero solo en esas integraciones. Qué comprobar en tu homelab 1. Omnilogic: si lo usas y habías configurado un intervalo de sondeo propio, ese ajuste desaparece. 2. Streams de cámaras: si dependías de verify_ssl en fuentes de stream, o tienes UniFi Protect con RTSPS, revisa que sigan funcionando, porque 10.1 modificó el comportamiento de la verificación TLS. Que RTSPS de UniFi Protect omita la verificación es un matiz de seguridad a tener en cuenta si tu cámara está en una red que no controlas por completo. 3. MQTT, Modbus, KNX, FRITZ!Box, Proxmox: si en 10.0 notaste disparos duplicados, fallos al recargar, setups de Fritz que fallaban o permisos de Proxmox rechazados, estos son los síntomas que 10.2 y 10.3 corrigen. 4. UniFi Access: si registras eventos de acceso, los duplicados deberían desaparecer con 10.3. 5. SMTP: si envías notificaciones por correo, comprueba tras actualizar que siguen llegando, ya que ahora se crea un contexto SSL nuevo en lugar de compartido. 6. Dispositivos con pantalla: si tienes tablets antiguas mostrando mapas, espera el mapa clásico como alternativa automática. 7. Automatizaciones con triggers: no hace falta tocar nada si ya usas IDs en YAML. Aviso de futuro Home Assistant Cloud pasará a llamarse Home Assistant Link en la versión de diciembre; es solo un cambio de nombre anunciado. Límites Las notas disponibles no permiten confirmar la lista completa de cambios incompatibles de 2026.10.0, ni requisitos de instalación o problemas conocidos al actualizar. Tampoco hay compatibilidad documentada entre una versión concreta de Proxmox VE y la integración de Home Assistant. ¿Lo usas en tu homelab? Cuéntalo en los comentarios. Fuentes - Release 2026.10.0 - Release 2026.10.1 - Release 2026.10.2 - Release 2026.10.3 - 2026.10: You are here Este artículo se ha elaborado con asistencia automatizada

Reduce API surface for BLAKE2 to match OpenSSL semantics This is an updated version of the original post which reduces the scope of the work on BLAKE2. I originally wanted to remove non-standard parameters to BLAKE2 to make the module more maintainable in the future as well as SIMD support, but I am planning to only remove SIMD support for now. I still think it's wrong to use tree-hashing with BLAKE2 since BLAKE3 exists and should be used instead. Nonetheless, after looking at the deprecation PRs (gh-160374 and gh-160375) and the long period this would require to actually remove the code, I don't think it's really worth it. It would at least reduce the impact to downstream users almost to zero. Instead, I suggest that we soft-deprecate the interface for tree hashing in the docs and suggest BLAKE3 instead. ---- Original post: I want to reduce BLAKE2 in hashlib to a minimal API matching OpenSSL. More precisely, BLAKE2 is kept without SIMD and matches the API of OpenSSL's BLAKE2 (digest, MAC): data and digest_size for the hash, and salt/person with a key. Tree hashing, salt/person without a key, and HMAC-BLAKE2 will be deprecated in 3.16 and removed in 3.21. If necessary, the deprecation period will be extended to a few more releases but I really want to get rid of the annoying API surface. BLAKE2 is already a keyed hash function, it doesn't make sense to use HMAC on top of it, despite some libraries using the HMAC-BLAKE2 HACL* sources for that (see gh-138114). In an ideal world, I would remove BLAKE2 and recommend BLAKE3 or SHA-based alternatives. Note that currently (and likely in the future), there are no plans to add BLAKE3 to hashlib (see gh-83479). For a fast secure hash, BLAKE3 is available as the blake3 package. It is maintained by the BLAKE3 authors, has a hashlib-like API, supports keyed hashing and key derivation, and has wheels for all major platforms. Maintenance pain BLAKE2 has been in hashlib since 3.6, first as a custom module with our own implementation, then as a wrapper around the vendored HACL* sources (support for HACL* HMAC was added in 3.14, together with support for BLAKE2 despite numerous shortcomings on some platforms). BLAKE2 has the largest API in hashlib (key, salt, person and seven tree-hashing parameters). Most of its maintenance cost comes from the SIMD code: it needs per-platform compiler flags and CPU detection as well as dedicated code paths for the vectorized versions, is only enabled on (some) x86-64, and usually breaks on non-Tier-1 platforms: - gh-123748: macOS universal2 builds failed (SIMD256 compiles for x86-64 but not ARM64); - gh-124304: SIMD had to be disabled on older Android versions; - gh-126458: SIMD support wrongly detected under WASI; - gh-128134: missing aligned_alloc check on older macOS; - gh-130213: older toolchains failed without the SIMD flags; - gh-133042: duplicate symbols when cross-compiling for Emscripten (still unfixed); - gh-138114: HMAC-BLAKE2 does not properly use the SIMD implementations (still unfixed). The module also needed several correctness fixes (gh-152851, gh-155830, gh-155835). Impact GitHub code search (excluding forks, CPython copies and vendored site-packages) finds about 34,000 Python files using hashlib.blake2b, 4,800 using hashlib.blake2s, and 300 using hashlib.new("blake2b") or hashlib.new("blake2s"). 62 of the 500 most-starred active Python repositories on GitHub use BLAKE2, e.g. PyTorch, Transformers, Home Assistant, Sentry, Streamlit, Gradio and Airflow. Of 1,753 sampled call sites (1,420 repositories), 1,649 (1,336 repositories) only use digest_size, 59 (51 repositories) use key, and 45 (38 repositories) use salt or person without a key. None use tree hashing. Most of them only need a fast hash, for which SHA-2, SHA-3 or BLAKE3 also work. This includes: - projects that store digests, such as Home Assistant (cache filenames), Mathesar (database identifiers) and Onyx (search-index IDs); - projects that depend on the exact BLAKE2 output, such as networkx (graph hashes), LangChain (indexing), apprise and a minisign verifier (BLAKE2b-512 signatures), copyparty (client checksums); - projects that use keyed BLAKE2 such as agno (MinHash) and openai-python (Bedrock helper); or - projects such as PyPI or Poetry for checksums, Warehouse for storage and publishing (though it looks like a legacy API), or python-tuf. One popular project affected by this change would be ComfyUI (which uses person without a key). In particular, I don't expect too much of downstream breakage (considering the long deprecation period) but I would appreciate if anyone against this proposal could explain why SIMD BLAKE2 should be kept (note that I already plan to remove SIMD support in 3.16 without a deprecation notice as it created too many issues, while exposing the OpenSSL implementation). Note that projects can rely on nacl.hash.blake2b (PyNaCl does not offer a 2s version) or PyCryptodome for blake2b and blake2s. AFAIK, there is no PyPI packages providing the tree-hashing feature but the latter is neither standardized by an RFC nor used in the wild. ---- > AI disclosure: Opus 5.5 was used for collecting and classifying data.

Smart home devices stuck in separate apps? 🏠 Home Assistant brings compatible devices and automations together. Set routines for lights and sensors. 💡 home-assistant/core #SmartHome #浇朋友 #蓝朋友 #互关 #fo

家里的智能灯、插座分散在好几个 App？🏠 Home Assistant 把兼容设备接进一个自动化平台。定时开灯、联动传感器都能设置。💡 home-assistant/core #SmartHome #浇朋友 #蓝朋友 #互关 #fo

Home Assistant sensors not working I just bought a Reolink Doorbell Camera 2nd Gen and I've been trying to setup some automations with Home Assistant but I've been running into the following issues: - The live camera view seems to drop out sometimes despite having a strong WiFi signal (around -50dBm). I have also had an issue where I can't access some Reolink app settings for seemingly the same reason. - More importantly, when I press the button, the Visitor sensor in HA is not changing to On. I have the same issue with the motion detection sensors too which aren't triggering. The Reolink app is working fine when it comes to these events. I get the full screen call when pressing the button and I get notifications for motion. These notifications are instant. I updated the firmware during the setup process to v3.0.0.7261_26092204 although it sounds like there might be some improvements coming soon based on this issue. Also the camera is on a IoT network whereas my HA server is wired. Not sure if that makes a difference although I did try connecting the camera to the main wireless network and it didn't seem to change anything. Anyone else encountered these issues?

Hive integration currently failing to set up after a restart due to Hive-side changes Just an FYI if you have Hive and are seeing an issue. Fix PRs are open and awaiting merge but if you can't wait a workaround is described in the issue comments.

How we used FalkorDB, Graph Theory (WCC, Betweenness, PageRank), and Multi-Agent simulation to catch breaking ecosystem changes before merge. What if a clean refactor breaks 32 integrations? On October 16, 2026, Home Assistant merged PR #186863, a refactor that moved sensor entity classes into a separate module. The core tests passed. Linting was green. Everything looked fine. But there was a catch: 32 custom integrations depended on internal symbols that the refactor stopped exposing. Those integrations could fail to load when the change reaches users. This is a classic example of Hyrum’s Law: if enough people depend on your system, someone will depend on behavior you never intended to support. And with AI coding agents writing and refactoring code faster than ever, catching these issues is becoming increasingly important. Introducing ShadowGraph Built for the WeMakeDevs × FalkorDB Graph Hacks Hackathon, ShadowGraph helps developers understand the impact of a code change before merging it. Instead of checking only the core repository, it maps dependencies across Home Assistant and its external custom integrations. How it works: - Builds a dependency graph: Uses Python AST analysis to identify which integrations import which symbols. - Simulates changes: Creates an isolated graph copy and checks what would break if a symbol were removed or changed. - Identifies the blast radius: Distinguishes between integrations that fail during import and those that may fail later at runtime. - Uses AI agents for verification: Investigates potential breakages and compares findings against static analysis. - Suggests migration fixes: Generates draft patches that maintainers can review and apply. The Home Assistant dataset contains 4,814 integrations and 562,444 import relationships. Why FalkorDB? FalkorDB lets ShadowGraph represent dependencies as a graph and efficiently explore how a change can affect downstream projects. Its graph-copy capability also enables isolated simulations without modifying the live graph. Beyond traditional CI Traditional CI tells you whether your own tests pass. ShadowGraph asks a different question: “Your tests pass, but what breaks for everyone depending on your code?” It also exposes tools through MCP, allowing AI coding agents such as Claude Code, Cursor, and Codex to check the potential impact of a change before making it. ShadowGraph is open source under the MIT License. GitHub: prem-programs/shadowGraph Built for Graph Hacks across three tracks: connected data, agent memory and coordination, and company knowledge. The goal is simple: catch breaking changes before your users do. How does your team check the downstream impact of a refactor today?

Home Assistant 2026.10.0 / 2026.10.2 breaks startup, leaves 115 automations unavailable, then rolls back to 2026.9.4 Hi everyone, I'm having serious issues upgrading Home Assistant Core from 2026.9.4 to 2026.10.x on my Intel NUC (HA OS 18.3). I've attempted the upgrade twice: first to 2026.10.0, then to 2026.10.2. Both attempts caused major startup problems. What happens: - HA becomes unreachable locally and through Nabu Casa. - Supervisor remains healthy, and Samba shares remain accessible. - After a long startup, HA sometimes becomes accessible but many integrations fail to load. - All 115 YAML automations become unavailable, even though automations.yaml is intact. - The Automations page is empty, and automation.reload is missing. - Several integrations fail or time out, including FRITZ!Box, Plex, Google Calendar, and HomeKit. Main errors from the logs: Setup of 'stream' is taking longer than 300 seconds. Setup failed for 'default_config': Could not setup dependencies: stream Global task timeout: Bootstrap stage 2 timeout The YAML configuration check passes successfully. What I've tried: - Restored a missing InfluxDB instance and fixed its connection. No improvement to the Core bootstrap issue. - Restarted Core. Same behavior. - Restored my previous 2026.9.4 backup, which immediately brought back all 115 automations and normal functionality. - Attempted upgrading again to 2026.10.2 on October 17. HA became unreachable again. Interestingly, after the second failed upgrade, HA became accessible and reported: Core: 2026.9.4 Supervisor: 2026.10.2 OS: 18.3 This suggests Supervisor may have automatically rolled back Core, although I haven't confirmed that in the logs yet. Possibly related issues: - #178690 – Bootstrap timeout / automations unavailable - #184775 – Stream regression in 2026.10 - #185571 – Upgrade fails and rolls back - #184973 – Similar upgrade issues I've also read about oversized known_devices.yaml files causing similar issues, but haven't confirmed whether that applies to my setup. My questions: 1. Has anyone experienced this with 2026.10.2, especially on an Intel NUC? 2. Could stream or a custom integration prevent the entire automation subsystem from loading? 3. Has anyone identified a reliable fix without downgrading to 2026.9.4? 4. What would you investigate first to identify the actual root cause? I have multiple HACS integrations and can share sanitized logs if needed. 2026.9.4 works reliably. Both 2026.10.0 and 2026.10.2 have failed on the same installation. I'd really like to upgrade without breaking my entire home automation setup again. Any suggestions would be appreciated!

Control all the lights, thermostats, cameras and other devices in your home from one dashboard that runs locally, so everything keeps working even when the internet goes down. home-assistant/core