Disclosure: Supervisor security vulnerability
We were made aware of a security issue impacting installations using the Home Assistant Supervisor. A fix for this security issue has been rolled out to all affected Home Assistant users via the Supervisor auto-update system and this issue is no longer present.
You can verify that you received the update on the Home Assistant About page and verify that you are running Supervisor 2023.03.1 or later. If you do not see a Supervisor version on your About page, you do not use one of the affected installation types and have not been vulnerable.
The issue has also been mitigated in Home Assistant 2023.3.0. This version was released on March 1 and has since been installed by 33% of our users.
The security issue affected installation types Home Assistant OS and Home Assistant Supervised. This includes installations running on the Home Assistant Blue and Home Assistant Yellow.
The two other installation types, Home Assistant Container (Docker) and Home Assistant Core (own Python environment), have not been affected.
The security issue was found by Joseph Surin from elttam. Many thanks for bringing this to our attention.
About the issue
The Supervisor is an application that is part of Home Assistant OS and Home Assistant Supervised installations and is responsible for system management. The issue allowed an attacker to remotely bypass authentication and interact directly with the Supervisor API. This gives an attacker access to install Home Assistant updates and manage add-ons and backups. Our analysis shows that this issue has been in Home Assistant since the introduction of the Supervisor in 2017.
We have published security advisory CVE-2023-27482 on GitHub.
Has this vulnerability been abused?
We don’t know. We have not heard any reports of people being hacked.
Is there a workaround?
In case one is not able to upgrade the Home Assistant Supervisor or the Home Assistant Core application at this time, it is advised to not expose your Home Assistant instance to the internet.
HELTUN joins Works with Home Assistant
Today we’re excited to announce a Works with Home Assistant partnership with HELTUN!
HELTUN’s thermostats, switches, and switch panels integrate with Home Assistant via Z-Wave (Z-Wave stick required) completely locally so that devices react instantly to your commands which allows for the best user experience with Home Assistant.
With automatic firmware updates via Home Assistant we will continue to provide the best user experience for their devices.
HELTUN is an Armenian-US high-tech hardware company focusing on Z-Wave-based smart home and building automation solutions. The company’s focus is to redefine energy management with smart programmable thermostats and switches, aiming to utilize the most advanced features and functionality on the market.
We’re proud to offer this new integration and can’t wait to hear what you’ll build on-top of it. To learn more about HELTUN products, have a look at their website.
Learn more about the Works with Home Assistant partner program.
Home Assistant Core 2023.3! 🎉
February was a short month, resulting in a short release cycle, but… That didn’t stop anybody from stuffing this release with many great improvements!
As the release title most fittingly puts it, most features of this release show up in dialogs. New dialogs, restyled dialogs, new features that appear in dialogs, and all sorts of new dialogues you can have with Assist. Something with “dialogs” all over these release notes!
Besides dialogs, this release brings in three new integrations, updates to Thread and Matter, and quite an impressive list of other noteworthy changes.
My personal favorite in this release is, undoubtedly, the all-new restart dialog. It brings in proper choice, less navigation, and it looks slick! I am genuinely really loving and enjoying the result. 🤩
Enjoy the release!
../FrenckRead on →
Matter & Thread: where we’re at
A lot is happening in Home Assistant around Matter and Thread. It can be hard to keep track of it all, so we wanted to take a moment to write an update on the current state, and what we’re planning next.
- Matter works, including Thread devices via Thread border routers from Apple and Google.
- The Thread border router in Home Assistant is operational but not integrated until the next release, Home Assistant 2023.3.
- We’ve expanded the documentation for Matter and Thread to cover most asked questions and include videos on how to add Matter devices to Home Assistant.
- Users using a Home Assistant Yellow hub can enable an experimental Thread border router.
- Users on other systems can get a Thread Border Router using a Home Assistant SkyConnect.
- Announcing SL Web Tools. It allows users to use their browser to update Zigbee/Thread sticks based on SiLabs chips, like the Home Assistant SkyConnect.
- We’re open sourcing our automated build scripts to create reproducible firmware builds for Zigbee/Thread sticks based on SiLabs chips.
Matter is a new smart home standard which works locally. Its first release was at the end of last year, and is in the process of being adopted throughout the industry. We’ve been working hard on making it work with Home Assistant.
Today Home Assistant can control the basic operation of most Matter devices. You can add both Wi-Fi and Thread based devices, and the most common device types work. Matter bridges do not work yet – this will be added in Home Assistant 2023.3.Read on →
2023.2: How can I Assist?
Home Assistant Core 2023.2! 🎉
This release covers the first month of development of 2023, and it is setting one heck of a high bar for the rest of the year! 😅
Undoubtedly, the most spectacular features are related to the first chapter of Year of the Voice. 🎙️ It is hard to sum up all of this in this release blog, so I’m not even going to try doing it in this introduction, but holy mother of smart homes: this is exciting stuff! 😮
My personal favorite this release: huge steps into an even tighter integration with our amazing sister project: ESPHome. Creating and maintaining your own secure DIY IoT devices just became a lot easier.
And since we are talking about awesomeness, have you noticed the large amount of logos in the release image above? So many new integrations! 🤩
Enjoy the release!
PS: Just a reminder that valentine’s day is coming up. Be sure to share the love! ❤️Read on →
Year of the Voice - Chapter 1: Assist
This year is Home Assistant’s year of the voice. It is our goal for 2023 to let users control Home Assistant in their own language. Today, one month into 2023, we start our first chapter.
At Home Assistant we believe that technology is meant to be played with, and projects should be usable as soon as possible. Together with the community we can then iterate and refine. That’s why today, we’re delivering a basic experience for 22 languages to interact with Home Assistant. Oh, and we are also releasing some fun stuff that we cooked up along the way.
To watch the video presentation of this blog post, including live demos, check the recording of our live stream.
The core of a voice assistant is to be able to understand the intention of a spoken sentence. What is it the user wants to do? To extract these intentions we created our own template sentence matching format and intent recognizer named Hassil.
This new format is used by our new Home Assistant Intents project. The goal of this project is to collect home automation sentences in every possible language. Since it’s start a month ago, we have had 112 people contribute. The project now supports 22 languages and 14 more are in progress.
We have added a new feature to Home Assistant: Assist. It allow users to use natural language to control Home Assistant. It is powered by Hassil and the sentences from the Home Assistant Intent project.Read on →
Want to help others? Leave your AI at the door
Today we’re introducing a new rule for the Home Assistant community: it’s no longer allowed to use ChatGPT or other AI systems to help others.
Although these systems generate elaborate and well structured answers, they are wrong. Often they are wrong in subtle ways which only someone with the right expertise could detect. And those people wouldn’t need AI to have written that answer.
We appreciate that people want to help others, but if you don’t have the knowledge, leave it to someone else. Giving an incorrect answer makes things worse. You are wasting everybody’s time, including the person asking the question. Trying out an answer that doesn’t work is frustrating because you think you’re doing something wrong.
Using an AI system to generate an answer while not providing attribution to AI will result in a ban. If you use attribution, we will delete your post and issue a warning. This also means suggesting someone “ask ChatGPT” is not an acceptable response.
If AI systems get better, we will revisit this rule.
Home Assistant coming for your car!
Hey everyone today we would like to announce that development has begun on Android Auto. In December, Google has released an update to Android Auto and are finally accepting IoT apps into the Play Store. As you guessed the team wanted to get features added immediately. Check out the new upcoming features the team has already started to add!
These features are currently available in our beta channel and will be released to stable in the next 2 weeks.
Once you launch the app from your head unit you will have easy access to devices like your garage door, lights, locks and even scenes.
Tapping on a category allows you to see its entities and their state (with instant updates!). There are also simple touch controls to do things like opening the garage door before heading out.
In addition to selecting a domain you can also navigate to anything in Home Assistant that has a location, like persons, devices or sensors.
We have also added a new binary sensor allowing you to automate when you are in the car and connected to the head unit. There is an additional attribute for the type of connection as well.
A big thank you to Jbassett and jpelgrom for their contributions to the new Android Auto app. We look forward to the continued improvements to this new experience.
2023.1: Happy New Year of the voice!
Happy New Year! 🍾
We wish you, and all the loved ones around you, all the best for 2023! 🥂
2023: What an exciting year this will be; The year of the voice! And not just that, many exciting things are expected this year. More spoilers can be found in the State of the Open Home 2022 recording on YouTube.
Starting this amazing year with: Home Assistant Core 2023.1! 🎊
A fairly small release, as we all enjoyed our Holidays. Yet, the first traces of the voice project are already visible: support for entity aliases!
Still, this release contains over 800 changes, most of which are quality improvements, bug and stability fixes, and other minor improvements. The perfect release to start the year with, an easy upgrade worth doing.
Enjoy the release!
PS: Did you know Home Assistant is now on Mastodon too?Read on →
2023: Home Assistant's year of Voice
TL;DR: It is our goal for 2023 to let users control Home Assistant in their own language. Mike Hansen, creator of Rhasspy, has joined Nabu Casa to lead this effort. We’re starting off by building a collection of intent matching sentences in every language.
Usually, the month of December is meant to reflect back. However, we already did that last month when we hosted the State of the Open Home 2022. We didn’t only reflect, we also announced our focus for next year: 2023 is going to be the year of voice.
It is our goal for 2023 to let users control Home Assistant in their own language.
It’s a big and bold goal, but achievable given the right constraints. The amount of work laid out for us can be summarised as follows:
Our #1 priority is supporting different languages. There are enough projects out there trying to create an English voice assistant. But for us, that just doesn’t cut it. People need to be able to speak in their own language, as that is the most accessible and only acceptable language for a voice assistant for the smart home.Read on →