homebridge-config-ui-x 5.24.0

on Node.js NPM

UI Changes

• chore: migrate v4-style font awesome icons to v6 syntax
• fix: linking accessory to shared child bridge fails protocol guard
• fix: restore autofocus on username field at login page load
• feat: add toolbar with search/download/clear to Homebridge Logs widget
• fix(accessories): add screen reader live regions to HAP sensor tiles (@rfiorentino1)
• fix(accessories): add ARIA labels, live regions, and keyboard handlers to HAP/matter tiles (@rfiorentino1)
• fix(plugins): improve screen reader support in plugin card, manage, uninstall, config modals (@rfiorentino1)
• fix(plugins): include plugin name in info button label and convert donate anchor (@rfiorentino1)
• chore(i18n): translate new plugin a11y labels (@rfiorentino1)
• fix(status): add aria-hidden to icons and convert anchors to buttons in dashboard widgets (@rfiorentino1)
• fix(layout): mark active sidebar item and hide decorative icons (@rfiorentino1)
• fix(settings): hide decorative icons and group backup actions for screen readers (@rfiorentino1)
• fix(a11y): improve screen-reader announcements for xterm and plugin install completion (@rfiorentino1)
• fix(plugins): tighten screen-reader coverage for plugins page and bridge modal (@rfiorentino1)
• fix(status): tighten screen-reader coverage for status widgets (@rfiorentino1)
• fix(logs): wire search button aria-expanded + hide decorative toolbar icons (@rfiorentino1)
• fix(settings): wire search button aria-expanded + hide redundant row labels (@rfiorentino1)
• fix(accessories): apply switch a11y pattern to matter on/off variants (@rfiorentino1)
• fix(status): add screen-reader expand/collapse to terminal widget (@rfiorentino1)
• fix(plugins): announce install/uninstall/update progress to screen readers (@rfiorentino1)
• fix(plugins): tighten xterm screen-reader behaviour in plugin-logs modal (@rfiorentino1)
• fix(status): announce bridge restart completion to screen readers (@rfiorentino1)
• fix(settings): make restart-required toast keyboard accessible (@rfiorentino1)
• fix(status): add keyboard-driven widget reorder mode (@rfiorentino1)
• fix(accessories): extend a11y pattern to 9 remaining matter types (@rfiorentino1)
• fix(login): hide decorative icons from screen readers
• fix(setup-wizard): tighten icons and convert restore-backup anchor to button
• fix(support): hide decorative icons and add keyboard activation to section headers
• fix(accessories): hide decorative icons from screen readers
• fix(users): hide decorative icons and make 2FA copy button accessible
• fix(power-options): hide decorative power-off icon from screen readers
• fix(accessory-info): make copy buttons accessible
• fix(plugins): hide decorative icons across plugin and shared modals
• fix(settings): add keyboard activation to collapsible section headers
• fix(spinner): announce loading state to screen readers
• fix(layout): use buttons for sidebar items and trim duplicate menu announcements (@rfiorentino1)
• fix(status): announce bridge rows as one button with status + matter + restart (@rfiorentino1)
• fix(status): announce matter state on all rows when matter support is enabled (@rfiorentino1)
• fix(status): drop duplicate text and widget-name announcements in show/hide widgets modal (@rfiorentino1)
• fix(a11y): hide xterm helper textarea from screen readers on read-only terminals (@rfiorentino1)
• fix(plugins): drop redundant plugin name from info button aria-label (@rfiorentino1)
• fix(layout): announce active sidebar item as "current page" (@rfiorentino1)
• fix(lint): restore HTML comments and silence false spaced-comment rule
• fix(a11y): use real for collapsible disclosure sections (settings, support)
• fix(plugins): drop shell-injection vector in cleanNpmCache
• fix(backup): block path-traversal and symlink entries in restores
• fix(backup): reject concurrent restore uploads via a singleton slot
• fix(installer): validate --user before writing sudoers entries
• fix(installer): switch Win32 nssm/sc to execFileSync arg arrays
• fix(auth): reject JWTs with stale instanceId (except live wizard)
• fix(auth): enforce instanceId check on WS + WS-admin guards
• fix(auth): tighten route guards on auth/setup/admin transitions
• fix(plugins): flip hasInstalledPlugins flag locally on first install
• fix(auth): re-decode user payload on session refresh
• fix(routing): cancel route activation when a resolver fails
• fix(ws): repair socket cache lifecycle and token rotation
• fix(plugins): guard restart modal against missing affectedBridges
• fix(status): only apply dashboard layout on first connect
• fix(users): clear stale matchPassword error when mismatch resolves
• fix(users): case-insensitive duplicate-username form validation
• fix(config-editor): sync Monaco model on save and dispose on destroy
• fix(accessories): write new rooms reference on inner services reorder
• fix(config-editor): write config.json atomically
• fix(config-editor): treat restart-info IPC as best-effort
• fix(plugins): cache npm-managed plugin list until after npm exits
• fix(config-editor): gate writes on bootstrap migration completion
• fix(child-bridges): send the correct IPC event from Start
• chore(setup-wizard): remove dead duplicate /backup gateway
• fix(ipc): de-duplicate restartHomebridge SIGKILL timers and listeners
• fix(log): scope the tail-ending flag per client
• fix(custom-plugins): make custom-UI cleanup idempotent
• fix(server): require admin to PUT /server/restart
• fix(auth): reserve OTP cache slot before verifying
• fix(installer): await start() in macOS / Windows restart()
• fix(installer): harden macOS install command
• fix(installer): fix FreeBSD rc script for custom service names
• fix(hb-service): cork log stream around truncate sequence
• fix(hb-service): validate plugin version and use execFileSync for CLI install
• fix(backup): re-register scheduled backup cron when the toggle changes
• fix(toast): centralise error toasts on a shared helper
• fix(server): allowlist restart/shutdown commands and use spawn-array
• fix(fs): serialise JSON mutations through a shared JsonFileStore
• fix(plugins): translate install/update toast template
• fix(accessories): show lightbulb modal when adaptive lighting is absent
• fix(config-editor): reject prototype-chain keys in UI property patch
• fix(plugins): strip secret-shaped env vars from npm spawn
• fix(backup): write config.json atomically during restore
• fix(plugins): build plugin-list caches in locals before swapping refs
• fix(ipc): clean up requestResponse listener when sendMessage throws
• fix(scheduler): catch and log rejections from fire-and-forget cron callbacks
• fix(accessories): route Matter IPC replies through a single shared dispatcher
• fix(accessories): short-circuit accessory loads after client disconnect
• fix(backup): only self-kill the UI after Homebridge SIGKILL is delivered
• fix(plugins): reject dynamic schema paths that escape storagePath
• fix(status): skip post-unsubscribe emit on disconnected stats clients
• fix(plugins): validate plugin version regex on install/update DTO
• fix(accessories): drop double-subscribe in lock-mechanism slider
• fix(accessories): keep live-update streams alive across reloads
• fix(auth): global HTTP 401 interceptor triggers clean logout
• fix(auth): invalidate token cache on cross-tab storage events
• fix(layout): block ESC on version-mismatch and restart-required modals
• fix(terminal): defer xterm FitAddon.fit() to next tick inside modals
• fix(setup-wizard): reject oversized backup archives in the file picker
• fix(settings): reject oversized wallpaper uploads in the file picker
• fix(settings): bind HAP/Matter toggle valueChanges to component lifecycle
• fix(setup-wizard): tie post-restore poll interval to component lifecycle
• fix(plugins): bind manage-version update-pref subscribe to component lifecycle
• fix(terminal): strip stacked socket listeners on terminal remount
• fix(layout): tear down the app namespace socket on layout destroy
• fix(restart): bind reconnect handler in RestartComponent to lifecycle
• fix(schema-form): track lastDataReference on the internal-change skip path
• fix(config-editor): prompt before navigating away with unsaved changes
• fix(accessories): surface a warning toast when the accessory cache fails to load
• fix(users): surface errors when the users list fails to reload
• fix(custom-plugins): fall back to en.json when locale require() fails
• fix(routing): reload the app on chunk-load failures after a deploy
• fix(auth): clamp inactivity timer to the setTimeout 32-bit ms limit
• fix(layout): throttle reconnect-driven checkToken to dampen restart storms
• fix(config-editor): drop hard-coded restartRequired field from restart-info response
• fix(setup): use crypto.randomInt for HomeKit PIN and bridge username
• fix(server): validate cache file name on delete-cached-accessory endpoints
• fix(config-editor): sort config backups by numeric timestamp
• fix(ipc): log when SIGTERM/SIGKILL delivery to Homebridge is refused
• fix(hb-service): cache isAvahiDaemonRunning result for the install session
• fix(installer): skip chmod a+x on Linux start when already executable
• fix(auth): throw WsException on WS guard auth failure
• fix(backup): return +1 from scheduled-backups sort comparator
• fix(hb-service): line-buffer Homebridge stdout/stderr to prevent log interleave
• chore(terminal): drop per-byte debug logs from terminal service
• fix(custom-plugins): attach custom-UI request handler before cleanup listeners
• fix(ws): cap socket.io reconnect attempts and delay
• fix(status): surface dashboard init errors as a toast
• fix(layout): clean up color-scheme and sidebar resize listeners on destroy
• fix(config-editor): guard _bridge?.username before .toUpperCase()
• fix(login): default empty target_route to /
• fix(i18n): persist selected language to bootstrap before server settings
• fix(auth): clear expired stored token quietly on bootstrap
• fix(auth): cap the noauth-mode auto-reload retries per session
• fix(auth): expose tokenReady so loginGuard waits for stored-token load
• fix(settings): use * target origin for theme postMessage to plugin iframes
• fix(status): use setInput() for the widget signal input on dynamic widgets
• fix(config-editor): add plain-text editor option for screen reader users (@rfiorentino1)
• fix(toast): announce each toast once for screen readers
• feat(plugins): hide child bridge set-up per plugin
• fix(search): focus the search input when opening the search bar
• fix(accessories): skip matter ipc when matter isn't configured
• fix(status): show all update-info tiles immediately on load
• fix(log): release the tail-log guard on early exits so logs aren't blank after navigating
• feat: allow disabling both HAP and Matter on main and child bridges
• feat(matter): allow disabling natter in place, preserving commissioning
• fix(toast): rework restart-required toast into a shared, keyboard-accessible component
• fix(accessories): hide eve history service exposed by hap-client v5
• fix(accessories): re-render tile immediately after editing custom type
• fix(a11y): announce disclosure state on schema-form sections and docker widget (@rfiorentino1)
• fix(accessories): gate first matter accessories load on core monitoring ack
• feat(accessories): show current consumption on outlet-compatible hap tiles
• feat(plugins): use new font-awesome venmo-v icon for donate modal
• fix(status): add screen-reader-only collapse to homebridge logs widget (@rfiorentino1)
• fix(plugins): drop duplicate aria-label on plugin actions dropdown menu (@rfiorentino1)
• feat: support nested hap config and externalsOnly mode
• fix(ui): show plugin JSON config option on mobile
• fix(ui): preserve child bridge config when saving plugin settings

Other Changes

• chore: drop lodash from backend deps
• chore: replace ngx-md with a small in-house markdown component
• enable dependabot for dependency and github-action updates (#2811) (@NorthernMan54)
• chore: register only the chart.js components the widgets use
• chore: replace 168kb homebridge logo svg with 10kb webp
• chore: subset font awesome fonts to icons used in the ui
• chore: patch @ng-formworks to import lodash-es
• chore: replace emoji-js with a generated short-name lookup
• chore: small fix in deprecate-past-releases workflow
• chore: add some extra eslint rules for test files
• chore(format): apply prettier formatting to a11y-touched templates
• chore(test): pin runningOnRaspberryPi=false in flaky status-gateway test
• chore(api): validate port-range bodies with a class-validator DTO
• test(audit): cover audit coverage gaps and close concurrent-PATCH race they exposed
• chore(test): use type cast for private logger spy
• fix(matter): type fabricId and nodeId as strings
• chore(plugins): align npm search result types with the live registry response
• chore: update deprecation script from homebridge repo
• chore(deps): bump the actions group with 2 updates (#2831) (@dependabot)
• test: stop linux platform-tools e2e from shutting down the CI runner
• chore: dependency updates

Homebridge Dependencies

• @homebridge/hap-client @ v5.0.0
• @homebridge/node-pty-prebuilt-multiarch @ v0.13.1
• @homebridge/plugin-ui-utils @ v2.2.4