UI Changes
- chore: migrate v4-style font awesome icons to v6 syntax
- fix: linking accessory to shared child bridge fails protocol guard
- fix: restore autofocus on username field at login page load
- feat: add toolbar with search/download/clear to Homebridge Logs widget
- fix(accessories): add screen reader live regions to HAP sensor tiles (@rfiorentino1)
- fix(accessories): add ARIA labels, live regions, and keyboard handlers to HAP/matter tiles (@rfiorentino1)
- fix(plugins): improve screen reader support in plugin card, manage, uninstall, config modals (@rfiorentino1)
- fix(plugins): include plugin name in info button label and convert donate anchor (@rfiorentino1)
- chore(i18n): translate new plugin a11y labels (@rfiorentino1)
- fix(status): add aria-hidden to icons and convert anchors to buttons in dashboard widgets (@rfiorentino1)
- fix(layout): mark active sidebar item and hide decorative icons (@rfiorentino1)
- fix(settings): hide decorative icons and group backup actions for screen readers (@rfiorentino1)
- fix(a11y): improve screen-reader announcements for xterm and plugin install completion (@rfiorentino1)
- fix(plugins): tighten screen-reader coverage for plugins page and bridge modal (@rfiorentino1)
- fix(status): tighten screen-reader coverage for status widgets (@rfiorentino1)
- fix(logs): wire search button aria-expanded + hide decorative toolbar icons (@rfiorentino1)
- fix(settings): wire search button aria-expanded + hide redundant row labels (@rfiorentino1)
- fix(accessories): apply switch a11y pattern to matter on/off variants (@rfiorentino1)
- fix(status): add screen-reader expand/collapse to terminal widget (@rfiorentino1)
- fix(plugins): announce install/uninstall/update progress to screen readers (@rfiorentino1)
- fix(plugins): tighten xterm screen-reader behaviour in plugin-logs modal (@rfiorentino1)
- fix(status): announce bridge restart completion to screen readers (@rfiorentino1)
- fix(settings): make restart-required toast keyboard accessible (@rfiorentino1)
- fix(status): add keyboard-driven widget reorder mode (@rfiorentino1)
- fix(accessories): extend a11y pattern to 9 remaining matter types (@rfiorentino1)
- fix(login): hide decorative icons from screen readers
- fix(setup-wizard): tighten icons and convert restore-backup anchor to button
- fix(support): hide decorative icons and add keyboard activation to section headers
- fix(accessories): hide decorative icons from screen readers
- fix(users): hide decorative icons and make 2FA copy button accessible
- fix(power-options): hide decorative power-off icon from screen readers
- fix(accessory-info): make copy buttons accessible
- fix(plugins): hide decorative icons across plugin and shared modals
- fix(settings): add keyboard activation to collapsible section headers
- fix(spinner): announce loading state to screen readers
- fix(layout): use buttons for sidebar items and trim duplicate menu announcements (@rfiorentino1)
- fix(status): announce bridge rows as one button with status + matter + restart (@rfiorentino1)
- fix(status): announce matter state on all rows when matter support is enabled (@rfiorentino1)
- fix(status): drop duplicate text and widget-name announcements in show/hide widgets modal (@rfiorentino1)
- fix(a11y): hide xterm helper textarea from screen readers on read-only terminals (@rfiorentino1)
- fix(plugins): drop redundant plugin name from info button aria-label (@rfiorentino1)
- fix(layout): announce active sidebar item as "current page" (@rfiorentino1)
- fix(lint): restore HTML comments and silence false
spaced-commentrule - fix(a11y): use real for collapsible disclosure sections (settings, support)
- fix(plugins): drop shell-injection vector in
cleanNpmCache - fix(backup): block path-traversal and symlink entries in restores
- fix(backup): reject concurrent restore uploads via a singleton slot
- fix(installer): validate
--userbefore writing sudoers entries - fix(installer): switch Win32 nssm/sc to
execFileSyncarg arrays - fix(auth): reject JWTs with stale
instanceId(except live wizard) - fix(auth): enforce
instanceIdcheck on WS + WS-admin guards - fix(auth): tighten route guards on auth/setup/admin transitions
- fix(plugins): flip
hasInstalledPluginsflag locally on first install - fix(auth): re-decode user payload on session refresh
- fix(routing): cancel route activation when a resolver fails
- fix(ws): repair socket cache lifecycle and token rotation
- fix(plugins): guard restart modal against missing
affectedBridges - fix(status): only apply dashboard layout on first connect
- fix(users): clear stale
matchPassworderror when mismatch resolves - fix(users): case-insensitive duplicate-username form validation
- fix(config-editor): sync Monaco model on save and dispose on destroy
- fix(accessories): write new rooms reference on inner services reorder
- fix(config-editor): write
config.jsonatomically - fix(config-editor): treat restart-info IPC as best-effort
- fix(plugins): cache npm-managed plugin list until after npm exits
- fix(config-editor): gate writes on bootstrap migration completion
- fix(child-bridges): send the correct IPC event from Start
- chore(setup-wizard): remove dead duplicate /backup gateway
- fix(ipc): de-duplicate restartHomebridge SIGKILL timers and listeners
- fix(log): scope the tail-ending flag per client
- fix(custom-plugins): make custom-UI cleanup idempotent
- fix(server): require admin to PUT /server/restart
- fix(auth): reserve OTP cache slot before verifying
- fix(installer): await start() in macOS / Windows restart()
- fix(installer): harden macOS install command
- fix(installer): fix FreeBSD rc script for custom service names
- fix(hb-service): cork log stream around truncate sequence
- fix(hb-service): validate plugin version and use execFileSync for CLI install
- fix(backup): re-register scheduled backup cron when the toggle changes
- fix(toast): centralise error toasts on a shared helper
- fix(server): allowlist restart/shutdown commands and use spawn-array
- fix(fs): serialise JSON mutations through a shared JsonFileStore
- fix(plugins): translate install/update toast template
- fix(accessories): show lightbulb modal when adaptive lighting is absent
- fix(config-editor): reject prototype-chain keys in UI property patch
- fix(plugins): strip secret-shaped env vars from npm spawn
- fix(backup): write
config.jsonatomically during restore - fix(plugins): build plugin-list caches in locals before swapping refs
- fix(ipc): clean up
requestResponselistener whensendMessagethrows - fix(scheduler): catch and log rejections from fire-and-forget cron callbacks
- fix(accessories): route Matter IPC replies through a single shared dispatcher
- fix(accessories): short-circuit accessory loads after client disconnect
- fix(backup): only self-kill the UI after Homebridge SIGKILL is delivered
- fix(plugins): reject dynamic schema paths that escape
storagePath - fix(status): skip post-unsubscribe emit on disconnected stats clients
- fix(plugins): validate plugin version regex on install/update DTO
- fix(accessories): drop double-subscribe in lock-mechanism slider
- fix(accessories): keep live-update streams alive across reloads
- fix(auth): global HTTP 401 interceptor triggers clean logout
- fix(auth): invalidate token cache on cross-tab storage events
- fix(layout): block ESC on version-mismatch and restart-required modals
- fix(terminal): defer xterm FitAddon.fit() to next tick inside modals
- fix(setup-wizard): reject oversized backup archives in the file picker
- fix(settings): reject oversized wallpaper uploads in the file picker
- fix(settings): bind HAP/Matter toggle valueChanges to component lifecycle
- fix(setup-wizard): tie post-restore poll interval to component lifecycle
- fix(plugins): bind manage-version update-pref subscribe to component lifecycle
- fix(terminal): strip stacked socket listeners on terminal remount
- fix(layout): tear down the app namespace socket on layout destroy
- fix(restart): bind reconnect handler in RestartComponent to lifecycle
- fix(schema-form): track
lastDataReferenceon the internal-change skip path - fix(config-editor): prompt before navigating away with unsaved changes
- fix(accessories): surface a warning toast when the accessory cache fails to load
- fix(users): surface errors when the users list fails to reload
- fix(custom-plugins): fall back to en.json when locale require() fails
- fix(routing): reload the app on chunk-load failures after a deploy
- fix(auth): clamp inactivity timer to the setTimeout 32-bit ms limit
- fix(layout): throttle reconnect-driven checkToken to dampen restart storms
- fix(config-editor): drop hard-coded
restartRequiredfield from restart-info response - fix(setup): use
crypto.randomIntfor HomeKit PIN and bridge username - fix(server): validate cache file name on delete-cached-accessory endpoints
- fix(config-editor): sort config backups by numeric timestamp
- fix(ipc): log when SIGTERM/SIGKILL delivery to Homebridge is refused
- fix(hb-service): cache
isAvahiDaemonRunningresult for the install session - fix(installer): skip
chmod a+xon Linux start when already executable - fix(auth): throw
WsExceptionon WS guard auth failure - fix(backup): return
+1from scheduled-backups sort comparator - fix(hb-service): line-buffer Homebridge stdout/stderr to prevent log interleave
- chore(terminal): drop per-byte debug logs from terminal service
- fix(custom-plugins): attach custom-UI request handler before cleanup listeners
- fix(ws): cap socket.io reconnect attempts and delay
- fix(status): surface dashboard init errors as a toast
- fix(layout): clean up color-scheme and sidebar resize listeners on destroy
- fix(config-editor): guard
_bridge?.usernamebefore.toUpperCase() - fix(login): default empty
target_routeto/ - fix(i18n): persist selected language to bootstrap before server settings
- fix(auth): clear expired stored token quietly on bootstrap
- fix(auth): cap the noauth-mode auto-reload retries per session
- fix(auth): expose
tokenReadyso loginGuard waits for stored-token load - fix(settings): use
*target origin for theme postMessage to plugin iframes - fix(status): use
setInput()for the widget signal input on dynamic widgets - fix(config-editor): add plain-text editor option for screen reader users (@rfiorentino1)
- fix(toast): announce each toast once for screen readers
- feat(plugins): hide child bridge set-up per plugin
- fix(search): focus the search input when opening the search bar
- fix(accessories): skip matter ipc when matter isn't configured
- fix(status): show all update-info tiles immediately on load
- fix(log): release the tail-log guard on early exits so logs aren't blank after navigating
- feat: allow disabling both HAP and Matter on main and child bridges
- feat(matter): allow disabling natter in place, preserving commissioning
- fix(toast): rework restart-required toast into a shared, keyboard-accessible component
- fix(accessories): hide eve history service exposed by hap-client v5
- fix(accessories): re-render tile immediately after editing custom type
- fix(a11y): announce disclosure state on schema-form sections and docker widget (@rfiorentino1)
- fix(accessories): gate first matter accessories load on core monitoring ack
- feat(accessories): show current consumption on outlet-compatible hap tiles
- feat(plugins): use new font-awesome
venmo-vicon for donate modal - fix(status): add screen-reader-only collapse to homebridge logs widget (@rfiorentino1)
- fix(plugins): drop duplicate aria-label on plugin actions dropdown menu (@rfiorentino1)
- feat: support nested hap config and externalsOnly mode
Other Changes
- chore: drop
lodashfrom backend deps - chore: replace
ngx-mdwith a small in-house markdown component - enable dependabot for dependency and github-action updates (#2811) (@NorthernMan54)
- chore: register only the
chart.jscomponents the widgets use - chore: replace 168kb homebridge logo
svgwith 10kbwebp - chore: subset font awesome fonts to icons used in the ui
- chore: patch
@ng-formworksto importlodash-es - chore: replace
emoji-jswith a generated short-name lookup - chore: small fix in deprecate-past-releases workflow
- chore: add some extra eslint rules for test files
- chore(format): apply prettier formatting to a11y-touched templates
- chore(test): pin runningOnRaspberryPi=false in flaky status-gateway test
- chore(api): validate port-range bodies with a class-validator DTO
- test(audit): cover audit coverage gaps and close concurrent-PATCH race they exposed
- chore(test): use type cast for private logger spy
- fix(matter): type fabricId and nodeId as strings
- chore(plugins): align npm search result types with the live registry response
- chore: update deprecation script from homebridge repo
- chore(deps): bump the actions group with 2 updates (#2831) (@dependabot)
- chore: dependency updates
Homebridge Dependencies
@homebridge/hap-client@v5.0.0@homebridge/node-pty-prebuilt-multiarch@v0.13.1@homebridge/plugin-ui-utils@v2.2.4