github openhab/openhab-distro 5.3.0.M2
openHAB 5.3.0.M2

5 hours ago

This is a monthly milestone build for the upcoming openHAB 5.3 release, which brings many fixes and improvements.

⚠️ Security fixes and breaking changes

This release fixes several security vulnerabilities. Updating is strongly recommended.

Advisory Component Fix Action required
GHSA-cwhr-cgmw-75gq Sitemap /proxy endpoint (SSRF) Proxy targets are restricted to an allowlist and the number of proxy threads is bounded Breaking: The new allowedHosts setting (Settings → System Settings → Sitemap) is empty by default, so proxied content (e.g. camera images or external widgets in sitemaps) stops working until the required hosts are added.
GHSA-v5qh-w8c6-7727 Trusted networks authentication bypass via spoofed X-Forwarded-For trustedNetworks is evaluated against the actual client address; X-Forwarded-For is no longer used Breaking: Behind a reverse proxy, all requests appear to come from the proxy. Do not list the proxy's address (or loopback) as a trusted network unless you intend to trust every client behind it.
GHSA-3523-gpwr-558p OAuth2 login (/auth): authorization code theft redirect_uri must be the same origin as openHAB and PKCE (S256) is mandatory Breaking: Third-party OAuth2 clients using another redirect origin or no PKCE can no longer use /auth. The openHAB UIs are not affected.
GHSA-5j66-4gjf-f7h9 OAuth2 login page (/auth): reflected XSS All values are HTML-escaped and the Content-Security-Policy is stricter None
GHSA-c3px-f8cr-493c IP Camera binding: XXE in /OnvifEvent Hardened XML parsing; endpoint only accepts the camera's IP or ipWhitelist entries Breaking: If events from your camera arrive from another address (NAT, proxy), add it to ipWhitelist.

New Add-ons

The following add-ons are newly introduced:

Add-on Type Issue
ATAG ONE Binding #21481
AutoBlind Binding #21036
Emerald Binding #21519
Liberty Global Horizon Binding #21661
LOQED Binding #21357
Modbus Anker SOLIX Binding #20890
Plivo Binding #21325
Rachio Binding #21081

The following improvements were made:

Runtime

Type Issue Change
Enhancements 5358 Monitor rule execution duration
5543 Nested sitemaps
5695 Restructure the org.openhab.core.voice package
5758 LLMItemSerializer: Get semantic relationships from metadata & Include semantic children of non-semantic groups
5775 Persistence DSL validation
5778 Do not report a missing store strategy when another config stores the items
5805 Make receive timeout configurable for TCP connections
5819 Document X-Atmosphere-Transport header for sitemap/page polling endpoints
5820 Restore SitemapWidgetEvent schema on sitemap events endpoints
5830 MQTT transport websocket path
5852 Add PersistenceExtensions::persist override for Number states
5858 [voice] Handle deprecation of FixedLengthAudioStream
5870 Log when sitemap proxy host allowlist is empty
Bug Fixes 1945 Fix Windows startup helper script handling
5788 Fix DSL implicit contexts variables for '.rules' based rules
5791 make slots in UIComponent optional
5816 Normalize config parameters when exporting to DSL or YAML
5817 Fix lastState time zone for item endpoint
5821 openapi: fixed required fields in RootUIComponent
5825 Sitemap subscriptions: avoid index out of bound exception
5843 ConfigUtil: Fix NPE on invalid type.
5848 De-duplicate system color temperature channel labels
5863 Stop flushing the SSE stream manually

Add-ons

Add-on Type Issue Change
amazonechocontrol Enhancements 21516 Handle PUSH_DND_STATE_CHANGE push messages
21557 Add MAC address to discovery
21583 Keep rejected-request traces at DEBUG
21795 Discover Sonos speakers
Bug Fixes 21446 Buffer push stream data until a message is complete
21561 Restart dispatcher on login
21573 Fix the servlet login after a logout
21575 Browser agent on all notification calls
21592 Fix status of Sonos media devices
21601 Fix the announcement delay check and document the volume restore
21608 Read the security panel arm state as a string
21609 Fix the comms host and name aborted requests
21614 Stop fetching unused list data
21706 Fix the smart home poll
21861 Renew tokens before expiry
21862 Lock the connection on logout
astro Bug Fixes 21554 Fix timezone related issues
asuswrt Enhancements 21693 Add channel to support read/write of router NVRAM variables
automower Bug Fixes 21714 Fix calendar tasks of other work areas being wiped on setCalendarTask
bambulab Enhancements 21607 JBambuAPI 1.7.0 Support firmware 1.12
bluelink Enhancements 20297 Implement CCS2 protocol support for EU
Bug Fixes 21702 Add password login for EU accounts
bluetooth.bluez Enhancements 20985 Improve stability of BlueZ adapter and align with interface
bluetooth.generic Bug Fixes 21528 Preserve decimals when writing integer fields with a DecimalExponent
bluetooth.govee Bug Fixes 20976 Fix retrieving data from BLE advertisements and enable encrypted communication for newer Govee devices
bluetooth.grundfosalpha Enhancements 21878 Harden Grundfos Alpha GENI response parsing
bticinosmarther Bug Fixes 21780 Delete OAuth token on bridge removal
chatgpt Enhancements 21555 Add Thing/channel params to set reasoning_effort
21716 Add Thing actions similar to Gemini binding
ddwrt Enhancements 21523 Enrich client names by MAC
21622 Refine client name precedence
Bug Fixes 21536 Detect generic Linux traffic interface
21544 Disable OpenWrt firewall discovery
21588 Fix wireless radio control
21828 Preserve replacement updater
deconz Enhancements 21563 Add support for particulate matter sensor
doorbird Enhancements 21879 Only allow whitelisted IPs to trigger webhooks
Bug Fixes 21175 Upgrade dependency and fix warnings
ecoflow Bug Fixes 21698 Improve connection stability
enphase Enhancements 21574 Add energy channels to inverter things
evcc Enhancements 21580 Switch to WebSocket transport with a message-routing architecture
Bug Fixes 21737 Fix EVCC loadpoint nested endpoint paths
fineoffsetweatherstation Enhancements 21030 Mirror discrete add-on sensors' values onto their sensor Thing
freeathome Enhancements 21559 Resolve channel types at boot
Bug Fixes 21632 Do not replace the executor in use
freeboxos Bug Fixes 21726 Fix division by 0
gemini Enhancements 21334 Make max model turns limit configurable
21717 Add thinkingLevel config property
generacmobilelink Bug Fixes 21859 Fix broken login
goecharger Enhancements 21642 Keep refresh job alive on unexpected errors
govee Bug Fixes 21655 Fix discovered device validation
heos Bug Fixes 21781 Fix connection leaks on reconnect and setup
homeassistant Bug Fixes 21755 Fix race condition expose by failing CI tests
homeconnectdirect Enhancements 21552 Unify program command channels
homewizard Bug Fixes 21658 Fix for transient communication problem during intialization
hue Enhancements 21530 Improve support for increase/decrease commands
Bug Fixes 21743 Fix switch and brightness state handling for dimmable lights
hydrawise Bug Fixes 21746 Populate system#lastcontact and allzones#suspenduntil
icalendar Bug Fixes 21630 Stop reusing stale connections
icloud Bug Fixes 21867 Fix/icloud srp protocol 401 error
ipcamera Enhancements 21810 Add PTZ via the Reolink API
jsscripting Enhancements 21827 Upgrade openhab-js to 5.22.0
mapdb Bug Fixes 21733 Fix restoring item with invalid persisted state
matter Enhancements 21626 Adds Thermostat Running State Channels
Bug Fixes 21616 Use clearAll for bridge resets
21666 Fix management of color temperature channels
21880 Fix Thread Connection Metrics
mercedesme Enhancements 21343 Adapt to API/proto changes
mideaac Enhancements 21585 Switch Default Cloud and add Little Endian Token Key Option
miele Enhancements 21647 Add UoM support for spinning speed
miio Enhancements 21770 Add support for Yeelight Smart Ceiling Fan S2001
21772 Add support for Xiaomi Robot Vacuum S20+
21776 Add support for Xiaomi Smart Air Fryer 6.5L
21777 Add support for Dreame L10s Pro Ultra Heat
21778 Add Yeelight color flow scene selection
21779 Fix Roborock map download and add map select
21789 Add support for Xiaomi Smart Pet Fountain
21790 Add support for WIDETECH WDH330EFW1
21791 Add support for Aqara Curtain Controller A1
21792 Add support for Xiaomi Robot Vacuum T12
21793 Add support for Xiaomi Robot Vacuum X10+
21799 Add extra clean zones to vacuum map
21822 Add error codes for newer Roborock vacuums
21824 Add FM radio channels to the Mi smart home gateway
21832 Add path and member selection to getJsonElement
21833 Add read once channel refresh interval
21835 Mask secrets and limit logged responses
Bug Fixes 21761 Remove Contact command support
21766 Fix invalid channel types in device database
21771 Fix invalid SetPoint semantic tag
21774 Fix duplicate MIoT actions and value ranges
21806 Detect rejected cloud token on HTTP 401
21823 Fix Yeelight ceiling color temperature mode
21834 Keep device status on cloud request errors
millheat Bug Fixes 21597 Migrate to the MillNorway cloud API
modbus Enhancements 21510 Make receive timeout configurable for TCP things
modbus.sungrow Enhancements 20900 Added support for the Sungrow iHomeManager
mqtt Enhancements 21759 Align bridge config parameters with parameters in mqtt transport
mqtt.awtrixlight Enhancements 21731 Fix showCustomNotification generics, add dismissNotification, enable MainUI action execution
nest Bug Fixes 21837 Add optional pubsubTopicName to subscribe to a self-hosted Pub/Sub topic
network Enhancements 21732 Add HTTP presence detection
nobohub Bug Fixes 21613 Fix ignored keepaliveInterval setting
openwebnet Bug Fixes 21819 Support DIM 4 lighting status frames
oppo Enhancements 21503 Consolidate player model information
21692 Use UPnP for discovery
21730 Add DV-983H support
pegelonline Enhancements 21757 Handle negative water levels
pioneeravr Enhancements 21713 Add speaker selection channel
renault Bug Fixes 21809 Catch RenaultForbiddenException to improve handling unsupported features
samsungtv Enhancements 21625 Make the legacy cipher suites optional
shelly Enhancements 19006 Add support for LoRa Add-On
19226 Add Plus/Pro Dimmer models (Gen3/Gen4): 1PM, 2PM, 10V, DALI
20909 Add support for Duo E27 G3 and Multicolor Bulb E27 G3
20992 Add Shelly Presence Gen4 (shellyplusspresence)
21286 Implement OH Lighting Convention
21548 Add extended features for BLU Ecowitt WS90 weather station
21627 Support for Shelly Flood S Gen4
21797 Add capacitor voltage channel to WS90 weather station
21858 Add support for Shelly Plug PM Gen3
21869 Add support for Shelly Pro 2CB, 3CB and 4CB
21871 Support for AZ H&T, i4 G4, EM G4, EM63 G4, Power Strip G4 V2 and Pro 4PM V3
Bug Fixes 21027 Fix Gen1 device discovery: shellyunknown inbox entries
21593 Fix Gen1 Bulb color/white mode switching
21598 Preserve Gen2 Cover detached in_mode instead of mapping it to onebutton
21599 Fix swapped WiFi Access Point Roaming action messages
21600 Fix various grammar and typo issues
21602 Handle ConfigurationAdmin unregistration during mDNS discovery
21605 Fix brightness slider flicker on dimmer/light status updates
21612 Create Sensor Addon input channel for standalone reed contact
21617 Fix spurious meter channels on non-PM relay devices
21641 Ignore thing status updates after dispose
21675 Don't create resetTotals for a relay device without a power meter
21690 Fix watchdog and re-init handling for sleeping battery devices
21725 Fix internal temperature reporting for multi-switch Gen2+ devices
21794 Fix power metering, meter reset and ON/OFF state of Plus/Pro RGBW PM
21808 Add missing power meter channels for Duo Bulb G3 and Multicolor Bulb G3
21876 Fix control#brightness channel handling on Gen 2 devices
smaenergymeter Enhancements 21629 Rework OBIS parsing and add channels
smartthings Bug Fixes 21760 Remove Contact command support
solaredge Enhancements 21399 Add Monitoring API V2 support
solarman Bug Fixes 21409 deye_hybrid definition: deduplicate A6 register
21710 Fix state pattern generation
somfytahoma Bug Fixes 21656 Fix Cozytouch authentication
21657 Fix exception when removing the bridge thing
sonos Enhancements 21676 Add channel to lock the buttons
21680 Fix model migration of zoneplayer things
21681 Add support for Sonos Roam 2
speedtest Bug Fixes 21821 Thing remains permanently OFFLINE after timeout
21855 Harden Speedtest handler lifecycle and process execution
spotify Enhancements 21646 Fix http redirect_uri when running behind an https reverse proxy
squeezebox Bug Fixes 21565 Fix notification race condition
tapocontrol Enhancements 21488 Add Tapo IP camera support
21553 Add legacy Kasa HS220 support
tesla Enhancements 21756 Update heater and navigation channels
21783 Add tire, window and presence channels
Bug Fixes 21719 Ignore products without VIN
21754 Recover from a failed access token renewal
21784 Average driver and passenger temperature
tuya Enhancements 21535 Add gateway support
21637 Map cloud schema type Bitmap to bitmap
21638 Add schema reload via console and thing option
Bug Fixes 21547 Backoff heartbeat if DP_REFRESH is acknowledged.
21671 Fix reconnect loop with devices that refuse DP_QUERY
21744 Check a connection is alive before giving up on it
unifi Bug Fixes 21769 Fix stale Network refresh coordinator
vdr Enhancements 21610 Support for listing available audio tracks and selecting active audio track
velux Enhancements 21581 Readme add sidebar
vesync Bug Fixes 21708 Fix units being swapped
21715 Fix airpurifier fan state pattern
wemo Enhancements 21589 Expose MAC address in discovery
yamlcomposer Enhancements 21505 Add !deep <<: tag to extend merge keys with recursive deep merge and conflict resolution
21539 Add output formatting configuration
21568 Add optional start index parameter to enumerate filter and function
21804 Add dynamic source registries (THINGS/ITEMS)
Bug Fixes 21635 Fix missing empty maps in the package output
zwavejs Bug Fixes 21678 Remove Contact command support

User Interfaces

UI Type Issue Change
Main UI Enhancements 4199 Update MainUI styling, add searchbar to config sheet, add advanced parameter indicators
4206 Sitemap editor: Support nested sitemaps
4346 oh-image: Add SVG embedding support & Refactor SVG embedding/canvas layout code to TS Composition API
4385 Add blocks to javaify and jsify data
4457 Add HTTP PATCH support to HTTP block
4462 Sitemap editor: Add confirmCmd support
4485 Harden Content-Security-Policy
4497 Add v-deferred directive to prevent loading flicker
4498 Inbox List: convert to rounded corner group-box
4499 thing-details: Wrap long ThingUID
4513 Consolidate breakpoints & DRY breakpoint handling
Bug Fixes 4459 Fix HTTP POST and PUT code generation with headers
4494 group-box: fix missing required props description and accordion
4502 group-box: Fix console error when title isn't used
4503 Parameter Text: Fix "Show Password" icon layout
4530 thing-action-popup: Handle request failure gracefully
4531 oh-clock-card: more intelligent font-sizing based on parent div vs. viewport
4553 Add-on store: Fix add-on READMEs not loading
4555 thing-action-popup: Wrap output text to newline & Padding fixes

Don't miss a new openhab-distro release

NewReleases is sending notifications on new releases.