IAsDoubleYou/ha_mysql v1.3.0

Security Fix, Reconfigurable Connections and Brand Images

on GitHub

1.3.0 - 2026-09-25

This release closes a SQL injection gap in ha_mysql.set_query, makes it
possible to change a connection's host, port, username, password and database
without removing and re-adding the integration, and gives the integration its
own icon and logo in the Home Assistant UI.

Added

• Configure → Change the database connection, to edit the host, port,
  username, password and database of an existing connection from the
  integration card. The new connection is tested before it replaces the old
  one; the sensors are left untouched.
• values on ha_mysql.set_query, to bind values to %s placeholders in the
  query separately from its text. The driver quotes and escapes each value
  according to its type, so a quote, a semicolon or a stray backslash in the
  value can no longer change what the statement does. Templates in values
  are rendered with their native type, so a number or a boolean is bound as
  such instead of as text.
• Brand images shipped with the integration, in
  custom_components/ha_mysql/brand/: icon.png (256x256), icon@2x.png
  (512x512), logo.png (256x64) and logo@2x.png (512x128). Home Assistant
  2026.3.0 and later read these directly and give them priority over the
  brands CDN, so the integration now shows its own icon and logo in the UI.
  Older Home Assistant versions ignore the folder and are unaffected.
• scripts/build_brands.py, which generates those images from the raw
  artwork. It keys out the background with a flood fill from the image
  border, so dark elements inside the artwork are preserved, and typesets
  the wordmark.
• Releases ship a homeassistant-ha_mysql.zip asset again, built and
  attached automatically by .github/workflows/release.yaml when a release
  is published. HACS installs from it instead of fetching every file
  separately through the GitHub API, and the downloads badge counts again.

Changed

• Only a single, read-only statement is now accepted everywhere a query
  enters the integration: the user interface, configuration.yaml and
  ha_mysql.set_query. A query with more than one statement, or one that is
  not SELECT-style, is refused before it ever reaches the database.
  Previously, testing a sensor query when adding or editing it would run a
  write for real if the query happened to contain one.
• A newly added sensor's entity ID and friendly name now include the
  connection's device name, for example
  sensor.mydatabase_192_168_1_10_employees and "mydatabase @ 192.168.1.10
  Employees", the same way Home Assistant names every other entity that
  belongs to a device. Sensors that already existed keep the entity ID and
  history they already had; this only applies to sensors added from now on.