In this edition
Project
Home Assistant
Arriving today, the release surfaces urgent security signals, traces why states changed and draws Wi-Fi and Thread connections inside Home Assistant.
Home Assistant 2026.9 arrives today with a clearer account of what is happening across the home: important security alerts stand out, History and Activity share a more useful source picker, and Matter devices gain an in-app network map.
ESPHome
An opt-in encrypted transfer stops firmware images—and the secrets inside them—from crossing a local network in plaintext.
Reviewed by jesserockzApproved by jesserockz
J. Nick Koston’s ESPHome work addresses a gap in wireless updates: the existing password authenticated the uploader, but the firmware image itself still travelled in plaintext. Someone listening on the local network could capture the Wi-Fi credentials and API encryption key embedded in that image.
Home Assistant Companion
The app keeps the last known network route during an access-point handoff, avoiding a jump to the external URL and a second reload when Wi-Fi returns.
An iPhone moving between access points on the same Wi-Fi network can briefly report no current network. The Home Assistant app treated that gap as leaving the internal network, switched to its external address and reloaded the whole interface—then reloaded it again seconds later when Wi-Fi reappeared.
Home Assistant
Home Assistant code now carries confirmed or tentative status from CalDAV, local calendars and Google Calendar into trigger data; cancelled-event filtering remains separate.
Reviewed by allenporter, MartinHjelmareApproved by allenporter, MartinHjelmare
Tom Mittelstädt’s first Home Assistant Core contribution adds an optional status to calendar events. CalDAV, Local Calendar and Google Calendar can mark an event as confirmed or tentative, and automations receive that value in the calendar trigger payload.
OHF Voice
A new Faster Whisper ranking favors areas, floors and controllable devices, so likely spoken names are less easily crowded out in large homes.
Read full articleMusic Assistant
AriaCast blocks unauthenticated metadata requests from making Music Assistant contact arbitrary internal or localhost services.
Read full article
