homebridge/homebridge-config-ui-x v5.28.0 on GitHub

Highlights

💡 Better Matter support, including smarter controls for lights, thermostats, blinds, smoke/CO alarms, and child bridges
🔎 Plugin search now clearly shows whether plugins support HAP, Matter, or both
🔐 Stronger security for logins, sessions, plugin UIs, terminals, and child-bridge controls
🖥️ Added Node.js 26 and Windows ARM support
🛠️ Fixed accessory updates freezing across multiple browser tabs
🔌 Improved plugin installation, updating, reconnection, and restart handling
⚙️ Various reliability fixes for the config editor, dashboard metrics, CPU temperature reporting, and UI self-updates

UI Changes

fix(ui): keep status widget values and units on one line (#2913) (@tbaur)
feat(settings): support HAP disableIdentifyingMaterial option (#2924) (@naterator)
feat(plugins): detect the supports-matter keyword on plugins
fix(plugins): re-establish custom ui sessions on socket reconnect (#2931) (@hjdhjd)
feat(plugins): show commissioned matter fabrics on child bridges
fix(settings): return metrics and package path settings in env (#2934)
fix(status): skip metrics collection when monitoring is disabled (#2934)
feat(status): show message on widgets when metrics monitoring is disabled (#2934)
feat(plugins): default new child bridges to matter without hap for matter-only plugins (#3975)
feat(plugins): show hap and matter support icons when searching for plugins
chore(ui): remove beta badges from graduated features
feat(plugins): hide the hap options on child bridges for matter-only plugins (#3975)
fix(plugins): keep the running homebridge version when a second install is found (#2897)
Update NodeJS Version checker for NodeJS 26 (#2938) (@NorthernMan54)
fix(plugins): offer the restart after a first-time plugin config, even when the child bridge is declined (#2946) (@BKeyport)
fix(plugins): even up the space either side of the hap and matter icons on the child bridge sections
feat(ui): render github style alerts in markdown, instead of showing the raw marker
feat(accessories): only offer the thermostat modes a matter device actually has
feat(accessories): only offer the colour controls a matter light actually has
feat(accessories): add a tilt control for matter window coverings that support it
feat(accessories): add tilt controls for hap window coverings that support them
fix(accessories): announce a matter co-only alarm as a carbon monoxide sensor, not a smoke sensor
feat(accessories): show the smoke or co face on a matter alarm that only senses one of them
fix(accessories): stop a matter light with no hue support painting its tile icon grey
fix(accessories): read and drive the tilt on a matter covering that only tilts
fix(accessories): paint an unsaturated bulb white rather than grey, on both hap and matter
fix(ui): sanitise rendered markdown to prevent stored XSS
feat(log): let admins restrict the Homebridge log to administrators
fix(status): support degrees as well as millidegrees in the configured cpu temp file (#2966) (@lidonius1122)
fix(plugins): find the running Homebridge when it is installed outside the scanned paths (#2897) (@lidonius1122)
fix(logs): restore the injection context before the logs guard delegates, so the page loads

Other Changes

chore(deps): dependency updates
chore(deps): add node 26 support and bump node-pty (#2916) (#2930) (@NorthernMan54)
ci: validate and release against node 26 (#2917) (#2918) (@NorthernMan54)
fix(plugins): pass allow-scripts to plugin installs (#2921) (@bcomnes)
fix(plugins): only pass allow-scripts to global installs
fix(plugins): honour the beta preference when a stable update is also available
feat: add windows arm support (#2927) (@NorthernMan54)
fix(deps): bump @fastify/static to v10 (security)
fix(ci): resolve intermittent backup test timeouts in validate.yml (#2933)
feat(auth): always return temp. units in settings
fix(plugins): only warn about skipped install scripts when one would actually be skipped
fix(build): copy the monaco chunks renamed in v0.56, so the json config editor is not a blank page
fix(deps): bump @homebridge/hap-client to v5.1.1 so child bridges sharing a hostname are discovered (#2936)
fix(test): reset the accessory layout so the default-room test passes on repeat runs
Fix for CSP Errors (#2960)
fix(security): stop a caller-supplied origin reaching the plugin ui script tag and csp (reported by @yowie)
fix(plugins): always use the ui installation that is actually running
fix(child-bridges): require admin to start/stop/restart a bridge over websocket
fix(terminal): restrict persistent-session HTTP endpoints to admins
fix(auth): make first-user setup atomic against concurrent requests
fix(auth): pin the plugin-UI cookie guard to this instance
fix(server): set frame-ancestors to block clickjacking of the UI
fix(auth): hash passwords at OWASP work factor with transparent upgrade
fix(auth): throttle failed logins to stop credential and 2FA brute force
fix(auth): revoke tokens when a user is deleted, demoted or changes password
fix(ws): send the session token in the handshake payload, not the query string
fix(server): drop 'unsafe-inline' from the app's script-src
fix(auth): hold the access token in memory instead of localStorage
test(status): stop the dashboard e2e tests clobbering the dev storage layout
fix(custom-plugins): allow plugin UI webfonts from the dev server origin
chore(build): stop copying monaco's unused json language sources
fix(plugins): cancel the pending ui self-restart when the module is torn down
fix(test): stop the plugin update tests firing the real ui restart
feat: replace plugin ui session cookie with short-lived single-use tickets (#2972) (@NorthernMan54)
fix(test): poll for the tailed log lines instead of sleeping, so a slow runner cannot fail the job
fix(users): refuse to demote the only admin, matching the existing delete protection
fix(config-editor): create the ui platform block on demand instead of crashing when a config has none
fix(accessories): stop a malformed accessory-control message taking down the ui process
fix(accessories): reject a non-numeric characteristic value instead of sending NaN to homebridge
fix(terminal): stop one client's disconnect muting the exit notice of every other terminal session
fix(accessories): share one characteristic monitor so a second tab no longer freezes live updates in the first
fix(config-editor): run the targeted config mutations inside the file lock so concurrent saves cannot clobber each other
fix(scripts): make the ui self-update rollback actually restore the previous version on failure
fix(scripts): import esm plugins via a file url so alias extraction works on windows
fix(scripts): wait for the alias message to flush before the extract child exits
fix(test): restore the shared test storage directory after a run, so the suite stops clobbering dev state
refactor(plugins): extract a restart-free package update path shared by single updates and update all
fix(auth): let a plugin authenticate as a service, instead of every self-minted token now failing
fix(accessories): send each child bridge its own pin, so its accessories are not hidden (#2936)

Homebridge Dependencies

@homebridge/hap-client @ v5.2.0
@homebridge/node-pty-prebuilt-multiarch @ v0.14.1
@homebridge/plugin-ui-utils @ v2.2.5