Release 2.6.2: security, correctness, and blueprint fixes#123
Merged
Conversation
Security: - diagnostics: redact all credential and location fields (API keys, passwords, passcodes) in entry data/options, including nested blocks. Previously the full config was exported, leaking upload-network and forecast credentials in a file users are told to attach to bug reports. Fixed: - sensor: stop reverting user-renamed entity ids on every restart; ids are set once at creation via suggested_object_id and then left to the user. - blueprints: map inputs used in Jinja into variables: so cooldowns actually work; add the missing cooldown condition to the storm and fire-danger alerts (their cooldown_hours input previously did nothing). - algorithms: Penman-Monteith ET0 uses the real site latitude instead of a hardcoded 37 N; remove dead _phi. - algorithms: FWI DMC/DC day-length tables are hemisphere-aware (Southern Hemisphere seasons were six months out of phase). - timezone: current-condition classifier and weather forecast alignment use dt_util.now() instead of the host clock. - docs: README build badge (validate.yaml -> validate.yml), stale versions, and the false "24h windows reset on restart" claim. Changed: - sea-level pressure uses a 12h mean temperature (WMO) instead of the instantaneous reading, removing a diurnal wave that also fed Zambretti and rain probability; falls back to instantaneous until ~1h of history exists. Docs/meta: - add Data & Privacy egress section, uninstall steps, and fire/ET0 guidance to the README; document the source-priority/fusion model for forecasts; add root CONTRIBUTING.md and SECURITY.md; fill in LICENSE author; add integration_type; regenerate the entity map; bump to 2.6.2. Adds 8 regression tests. Full suite: 276 passed, ruff clean. Co-Authored-By: Claude Opus 4.8 <[email protected]>
…diagnostics.py diagnostics.py now reads the integration version from manifest.json at runtime instead of embedding a literal, so the old grep-for-literal step failed. Check manifest == pyproject only; the diagnostics runtime behaviour is covered by tests/test_integration.py::test_diagnostics_version. Co-Authored-By: Claude Opus 4.8 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release 2.6.2 - security, correctness, and blueprint fixes
Under-the-hood release. No new user-facing features; all items are bug or
security fixes plus one meteorological correctness change. Ships as a single
patch release.
Security
included full
entry.data/entry.options, exposing forecast and upload-networkAPI keys, passwords, and passcodes in a file users are told to attach to bug
reports. All credential-like and location fields (including nested per-network
blocks) are now redacted. Users who shared an earlier export should rotate keys.
Fixed
once at creation (fresh installs still get
sensor.ws_*) and then left to the user.variables:; the storm and fire-danger alerts gained their missing cooldowncondition (
cooldown_hourspreviously did nothing).dt_util.now()in the classifier and weatherforecast alignment).
validate.yaml->validate.yml, stale versions, and the false"24h windows reset on restart" claim.
Changed
instantaneous reading, removing a diurnal wave that also fed the Zambretti
forecast and rain probability. Falls back to instantaneous until ~1h of history
exists. MSLP/ET0/FWI values may shift slightly vs earlier versions - a correctness
improvement, documented in the changelog.
Docs / meta
documented forecast source-priority/fusion; added root
CONTRIBUTING.mdandSECURITY.md; LICENSE author;integration_type; regenerated entity map;bumped to 2.6.2.
Compatibility
No breaking changes: entity ids,
unique_ids, config schema, anddevice_class/state_class/units are all unchanged; new function params areoptional with defaults. Behavior changes (MSLP/ET0/FWI value shifts, working
blueprint cooldowns, non-reverting entity ids, redacted diagnostics) are intentional
and documented.
Validation
276 tests pass (+8 new regression tests), ruff check + format clean, all dashboards
and all 10 blueprints validate.
🤖 Generated with Claude Code