home-assistant/core
:house_with_garden: Open source home automation that puts local control and privacy first.
How core is put together
This is Home Assistant Core, an open-source home automation platform written in Python 3.14 that runs as an asyncio-based application launched via the `hass` CLI entrypoint. Its architecture is built around a central `HomeAssistant` core object with an event bus, a plugin-style integration/component system, config entries and data-entry flows for setting up integrations, and a YAML/storage-backed configuration layer. It provides a pluggable authentication layer (auth providers, MFA modules, JWT-based refresh/access tokens) and persists state via a Store abstraction and SQLAlchemy-backed recorder. Data flows from device/service integrations through the core state machine and event bus to consumers such as the HTTP/websocket API and frontend.
Languages
Frameworks
Datastores
Infrastructure
Major components
Core (homeassistant/core.py, core_config.py)
Provides the central HomeAssistant object, event bus, state machine, and core configuration schema/handling.
Auth layer (homeassistant/auth)
Manages users, groups, credentials, refresh/access tokens, auth providers and MFA modules with permission policies.
Config entries & data entry flow
Manages integration setup lifecycle, config/options/subentry flows, and discovery sources (bluetooth, dhcp, mqtt, zeroconf, etc.).
Configuration system (homeassistant/config.py)
Parses and validates YAML configuration, merges packages, handles secrets and default config generation.
Bootstrap & runner
Handles application startup, single-instance locking, runtime config, and the asyncio run loop.
Integration loader & requirements
Discovers integrations, loads component modules, and installs their Python requirements at runtime.
Helpers (storage, entity/device registries, dispatcher)
Shared utilities for persistent storage, entity/device/issue registries, event tracking and dispatch.
Brands & generated metadata
Defines vendor brand groupings and code-generated integration metadata (config_flows, dhcp, bluetooth, zeroconf) for discovery.
A very busy week centered on rolling out a shared device-lookup helper across dozens of integrations while adding new supported brands and fixing assorted bugs.
3 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A very busy week centered on rolling out a shared device-lookup helper across dozens of integrations while adding new supported brands and fixing assorted bugs.
Week of 2026-08-17
Another busy week combining Z-Wave and UniFi Protect improvements, new device support, and many small reliability fixes and library updates.
Week of 2026-08-10
A quiet week with only a handful of dependency bumps and one small bug fix.
Over the past few weeks the Home Assistant project ramped from a very quiet week into two large, busy weeks focused on tidying up how device services work, adding support for more brands of smart-home hardware, and fixing many small bugs. A recurring theme was a behind-the-scenes cleanup that gave dozens of integrations a shared, simpler way to look up which device and account a service call applies to. Alongside that, the team kept adding new supported products, updated many third-party software dependencies, and steadily patched reliability issues.
Week by week
2026-08-24A very busy week centered on rolling out a shared device-lookup helper across dozens of integrations while adding new supported brands and fixing assorted bugs.latest6 changes
Refactor
Shared device-and-account lookup helper adopted widely
A new common helper for finding the right device and account was introduced and switched on across many integrations like Reolink, SamsungTV, Yolink, and SimpliSafe, replacing repeated custom code.
Feature
New brands added as supported products
Placeholder integrations were added so Inventor, Pro Breeze, Rotenso, and Olimpia Splendid devices are recognized and routed to their underlying platform.
Chore
Updated cloud and hardware libraries
Underlying software components such as hass-nabucasa (cloud services) and the Modbus connection library were upgraded to newer versions.
Fix
Corrected data-cleanup and history behavior
Fixes stopped the database purge tool from wrongly removing group entities and excluded certain KNX status data from being recorded.
Fix
Assorted device reliability fixes
Patches corrected a Yeelight lighting effect, handled self-signed certificates for WiiM artwork, and set a solar inverter's clock from the configured time zone.
Fix
Safer date/time handling
Avoided ambiguous timestamps in the Monarch Money integration to prevent time-related glitches.
2026-08-17Another busy week combining Z-Wave and UniFi Protect improvements, new device support, and many small reliability fixes and library updates.6 changes
Fix
Z-Wave setup made more robust
Several changes hardened the Z-Wave add-on against overlapping or abandoned configuration attempts and fixed legacy security key handling.
Feature
Expanded UniFi Protect camera features
Camera controls were moved to the official interface and new infrared/night-vision modes were added for UniFi Protect cameras.
Feature
More supported devices and modes
Added a controls panel for Midea, support for a SwitchBot curtain model, and a Midea window AC to the Matter dry-mode list.
Fix
Crash and outage fixes
Resolved a PlayStation 4 data-fetch crash and helped LG ThinQ recover from temporary network outages during setup.
Chore
Numerous dependency updates
Refreshed many third-party libraries powering integrations such as Opower, Midea, and air-quality monitors.
Fix
Cleaner logging and data handling
Reduced repetitive Netatmo availability log messages and filtered duplicate bed entries from the SleepIQ service before setup.
2026-08-10A quiet week with only a handful of dependency bumps and one small bug fix.2 changes
Chore
Minor library updates
Upgraded a few underlying components including the calendar (ical), Google Health, and holidays libraries.
Fix
Shelly Wall Display status fix
Handled a case where status information could be missing to avoid errors on Shelly Wall Display devices.
Dependencies and code review
Dependency advisories
Security Watch
1 vulnerable package (2 advisories) across 53 scanned dependencies.
cryptography 48.0.1
2 advisories. Fixed in 50.0.0.
How it can be abusedAnyone running Home Assistant that connects out over HTTPS could be hit: a malicious server can present certificates that make the library spend huge time building trust paths, stalling or freezing the hub. The decryption flaw only matters if the app decrypts encrypted messages, which Home Assistant does not normally do.
- highGHSA-g6cj-pr64-35w5cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing
- highGHSA-jwv3-5hgf-82wwpython-cryptography: Duplicate self-signed intermediates can cause exponential path-building
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required