github openhab/openhab-distro 5.2.2
openHAB 5.2.2

latest release: 5.3.0.M2
4 hours ago

This patch release contains the following bug fixes:

⚠️ Security fixes and breaking changes

This release fixes several security vulnerabilities. Updating is strongly recommended.

Advisory Component Fix Action required
GHSA-cwhr-cgmw-75gq Sitemap /proxy endpoint (SSRF) Proxy targets are restricted to an allowlist and the number of proxy threads is bounded Breaking: The new allowedHosts setting (Settings → System Settings → Sitemap) is empty by default, so proxied content (e.g. camera images or external widgets in sitemaps) stops working until the required hosts are added.
GHSA-v5qh-w8c6-7727 Trusted networks authentication bypass via spoofed X-Forwarded-For trustedNetworks is evaluated against the actual client address; X-Forwarded-For is no longer used Breaking: Behind a reverse proxy, all requests appear to come from the proxy. Do not list the proxy's address (or loopback) as a trusted network unless you intend to trust every client behind it.
GHSA-3523-gpwr-558p OAuth2 login (/auth): authorization code theft redirect_uri must be the same origin as openHAB and PKCE (S256) is mandatory Breaking: Third-party OAuth2 clients using another redirect origin or no PKCE can no longer use /auth. The openHAB UIs are not affected.
GHSA-5j66-4gjf-f7h9 OAuth2 login page (/auth): reflected XSS All values are HTML-escaped and the Content-Security-Policy is stricter None
GHSA-c3px-f8cr-493c IP Camera binding: XXE in /OnvifEvent Hardened XML parsing; endpoint only accepts the camera's IP or ipWhitelist entries Breaking: If events from your camera arrive from another address (NAT, proxy), add it to ipWhitelist.

Runtime

Type Issue Change
Enhancements 5752 Add RGBW and RGBCW "no brightness" modes
5776 Keep resolveConfig in sync
5870 Log when sitemap proxy host allowlist is empty
Bug Fixes 5788 Fix DSL implicit contexts variables for '.rules' based rules

Add-ons

Add-on Type Issue Change
astro Bug Fixes 21554 Fix timezone related issues
chatgpt Bug Fixes 21459 Use max_completion_tokens for OpenAI requests
21467 Fix ChatGPT binding tools with reasoning models
chromecast Bug Fixes 21324 Do not cast the background discovery setting to String
discovery Bug Fixes 21355 Handle Boolean background discovery configuration
ecoflow Bug Fixes 21698 Improve connection stability
ecovacs Bug Fixes 21292 Adjust to server side login changes
enocean Bug Fixes 21354 Don't limit serial port options
evcc Bug Fixes 21737 Fix EVCC loadpoint nested endpoint paths
fineoffsetweatherstation Bug Fixes 21485 Update WS85 sensor battery status type to VOLTAGE_FINE_STEPS
freeboxos Bug Fixes 21726 Fix division by 0
homeconnectdirect Bug Fixes 21373 Avoid Thing status flapping when appliance is unreachable
21517 Fix channel options update for washer appliance
21518 Fix program progress reset
21520 Fix hood channel options update
homematic Bug Fixes 21191 Fix large number parsing
hydrawise Bug Fixes 21746 Populate system#lastcontact and allzones#suspenduntil
jrubyscripting Bug Fixes 21381 Fix karaf console command newline #2
linkplay Bug Fixes 21491 Fix discovery method
mapdb Bug Fixes 21733 Fix restoring item with invalid persisted state
matter Bug Fixes 21285 Avoid redundant status update events when status is unchanged
21666 Fix management of color temperature channels
mcp Bug Fixes 21311 Fix local oAuth
misc Bug Fixes 21365 Transform bindings to getConfigAs
nikohomecontrol Bug Fixes 21302 Fix exception on car charger bad data
nobohub Bug Fixes 21613 Fix ignored keepaliveInterval setting
openwebnet Bug Fixes 21374 Prevent NullPointerExeption in openwebnet dim message
pythonscripting Bug Fixes 21428 Fix pip initialisation
ring Bug Fixes 21319 Backport relevant parts of PR21019 to avoid ratelimits
roborock Bug Fixes 21342 Clear credentials which roborock has marked as expired
21498 Fix reset of consumables
shelly Bug Fixes 21316 Fix Gen1 flapping roller position
solaredge Bug Fixes 21245 Fix PrivateApi
solarman Bug Fixes 21710 Fix state pattern generation
somfytahoma Bug Fixes 21656 Fix Cozytouch authentication
21657 Fix exception when removing the bridge thing
squeezebox Bug Fixes 21565 Fix notification race condition
tesla Bug Fixes 21719 Ignore products without VIN
vesync Bug Fixes 21708 Fix units being swapped
21715 Fix airpurifier fan state pattern
viessman Bug Fixes 21525 Fix capitalized Celsius unit
whisperstt Bug Fixes 21453 Fix vad endless loop
worxlandroid Bug Fixes 21331 Fix NumberFormatException when sending a Command to mode Channel
yamlcomposer Bug Fixes 21635 Fix missing empty maps in the package output
zwavejs Bug Fixes 21458 Ignore problematic websocket messages
21463 Fix Z-Wave JS channel and shutter handling

User Interfaces

UI Type Issue Change
Main UI Enhancements 4460 Chat page: Update splash screen to be vendor-agnostic
Bug Fixes 4432 Fix missing Day.js locale definitions for en/en-us locale
4452 Charts: Apply series offset before rendering series components (fix oh-aggregate-series with offset being empty)
4453 oh-repeater: fix when sourceType is an array of objects
4459 Fix HTTP POST and PUT code generation with headers

Don't miss a new openhab-distro release

NewReleases is sending notifications on new releases.