Open repair issue when deprecated trigger behavior is used

refactor(energyid): replace datetime.now with dt_util.utcnow (#173241 )
Bump pydaikin to 2.18.1 (#173249 )
2026-06-08 10:13:36 +02:00 · 2026-06-08 09:11:48 +02:00 · 2026-06-08 09:05:28 +02:00 · 2026-06-08 08:46:55 +02:00 · 2026-06-08 08:20:47 +02:00 · 2026-06-07 22:09:52 -04:00
17498 changed files with 1393220 additions and 356681 deletions
@@ -0,0 +1 @@
+../.claude/skills/
@@ -0,0 +1,225 @@
+---
+name: raise-pull-request
+description: |
+  Use this agent when creating a pull request for the Home Assistant core repository after completing implementation work. This agent automates the PR creation process including running tests, formatting checks, and proper checkbox handling.
+model: inherit
+color: green
+tools: Read, Bash, Grep, Glob
+---
+
+You are an expert at creating pull requests for the Home Assistant core repository. You will automate the PR creation process with proper verification, formatting, testing, and checkbox handling.
+
+**Execute each step in order. Do not skip steps.**
+
+## Step 1: Gather Information
+
+Run these commands in parallel to analyze the changes:
+
+```bash
+# Get current branch and remote
+git branch --show-current
+git remote -v | grep push
+
+# Determine the best available dev reference
+if git rev-parse --verify --quiet upstream/dev >/dev/null; then
+  BASE_REF="upstream/dev"
+elif git rev-parse --verify --quiet origin/dev >/dev/null; then
+  BASE_REF="origin/dev"
+elif git rev-parse --verify --quiet dev >/dev/null; then
+  BASE_REF="dev"
+else
+  echo "Could not find upstream/dev, origin/dev, or local dev"
+  exit 1
+fi
+
+BASE_SHA="$(git merge-base "$BASE_REF" HEAD)"
+echo "BASE_REF=$BASE_REF"
+echo "BASE_SHA=$BASE_SHA"
+
+# Get commit info for this branch vs dev
+git log "${BASE_SHA}..HEAD" --oneline
+
+# Check what files changed
+git diff "${BASE_SHA}..HEAD" --name-only
+
+# Check if test files were added/modified
+git diff "${BASE_SHA}..HEAD" --name-only | grep -E "^tests/.*\.py$" || echo "NO_TESTS_CHANGED"
+
+# Check if manifest.json changed
+git diff "${BASE_SHA}..HEAD" --name-only | grep "manifest.json" || echo "NO_MANIFEST_CHANGED"
+```
+
+From the file paths, extract the **integration domain** from `homeassistant/components/{integration}/` or `tests/components/{integration}/`.
+
+**Track results:**
+- `BASE_REF`: the dev reference used for comparison
+- `BASE_SHA`: the merge-base commit used for diff-based checks
+- `TESTS_CHANGED`: true if test files were added or modified
+- `MANIFEST_CHANGED`: true if manifest.json was modified
+
+**If no suitable dev reference is available, STOP and tell the user to fetch `upstream/dev`, `origin/dev`, or a local `dev` branch before continuing.**
+
+## Step 2: Run Code Quality Checks
+
+Run `prek` to perform code quality checks (formatting, linting, hassfest, etc.) on the files changed since `BASE_SHA`:
+
+```bash
+prek run --from-ref "$BASE_SHA" --to-ref HEAD
+```
+
+**Track results:**
+- `PREK_PASSED`: true if `prek run` exits with code 0
+
+**If `prek` fails or is not available, STOP and report the failure to the user. Do not proceed with PR creation. If the failure appears to be an environment setup issue (e.g., missing tools, command not found, venv not activated), also point the user to https://developers.home-assistant.io/docs/development_environment.**
+
+## Step 3: Stage Any Changes from Checks
+
+If `prek` made any formatting or generated file changes, stage and commit them as a separate commit:
+
+```bash
+git status --porcelain
+# If changes exist:
+git add -A
+git commit -m "Apply prek formatting and generated file updates"
+```
+
+## Step 4: Run Tests
+
+Run pytest for the specific integration:
+
+```bash
+pytest tests/components/{integration} \
+  --timeout=60 \
+  --durations-min=1 \
+  --durations=0 \
+  -q
+```
+
+**Track results:**
+- `TESTS_PASSED`: true if pytest exits with code 0
+
+**If tests fail, STOP and report the failures to the user. Do not proceed with PR creation.**
+
+## Step 5: Identify PR Metadata
+
+Write a release-note-style PR title summarizing the change. The title becomes the release notes entry, so it should be a complete sentence fragment describing what changed in imperative mood.
+
+**PR Title Examples by Type:**
+| Type | Example titles |
+|------|----------------|
+| Bugfix | `Fix Hikvision NVR binary sensors not being detected` |
+| | `Fix JSON serialization of time objects in anthropic tool results` |
+| | `Fix config flow bug in Tesla Fleet` |
+| Dependency | `Bump eheimdigital to 1.5.0` |
+| | `Bump python-otbr-api to 2.7.1` |
+| New feature | `Add asyncio-level timeout to Backblaze B2 uploads` |
+| | `Add Nettleie optimization option` |
+| Code quality | `Add exception translations to Teslemetry` |
+| | `Improve test coverage of Tesla Fleet` |
+| | `Refactor adguard tests to use proper fixtures for mocking` |
+| | `Simplify entity init in Proxmox` |
+
+## Step 6: Verify Development Checklist
+
+Check each item from the [development checklist](https://developers.home-assistant.io/docs/development_checklist/):
+
+| Item | How to verify |
+|------|---------------|
+| External libraries on PyPI | Check manifest.json requirements - all should be PyPI packages |
+| Dependencies in requirements_all.txt | Only if dependency declarations changed (the `requirements` field in `manifest.json` or `requirements_all.txt`), run `python -m script.gen_requirements_all` |
+| Codeowners updated | If this is a new integration, ensure its `manifest.json` includes a `codeowners` field with one or more GitHub usernames |
+| No commented out code | Visually scan the diff for blocks of commented-out code |
+
+**Track results:**
+- `NO_COMMENTED_CODE`: true if no blocks of commented-out code found in the diff
+- `DEPENDENCIES_CHANGED`: true if the diff changes the `requirements` field in `manifest.json` or changes `requirements_all.txt`
+- `REQUIREMENTS_UPDATED`: true if `DEPENDENCIES_CHANGED` is true and requirements_all.txt was regenerated successfully; not applicable if `DEPENDENCIES_CHANGED` is false
+- `CHECKLIST_PASSED`: true if all items above pass
+
+## Step 7: Determine Type of Change
+
+Select exactly ONE based on the changes. Mark the selected type with `[x]` and all others with `[ ]` (space):
+
+| Type | Condition |
+|------|-----------|
+| Dependency upgrade | Only manifest.json/requirements changes |
+| Bugfix | Fixes broken behavior, no new features |
+| New integration | New folder in components/ |
+| New feature | Adds capability to existing integration |
+| Deprecation | Adds deprecation warnings for future breaking change |
+| Breaking change | Removes or changes existing functionality |
+| Code quality | Only refactoring or test additions, no functional change |
+
+**Track results:**
+- `CHANGE_TYPE`: the selected type (e.g., "Bugfix", "New feature", "Code quality", etc.)
+
+**Important:** All seven type options must remain in the PR body. Only the selected type gets `[x]`, all others get `[ ]`.
+
+## Step 8: Determine Checkbox States
+
+Based on the verification steps above, determine checkbox states:
+
+| Checkbox | Condition to tick |
+|----------|-------------------|
+| The code change is tested and works locally | Leave unchecked for the contributor to verify manually (this refers to manual testing, not unit tests) |
+| Local tests pass | Tick only if `TESTS_PASSED` is true |
+| I understand the code I am submitting and can explain how it works | Leave unchecked for the contributor to review and set manually |
+| There is no commented out code | Tick only if `NO_COMMENTED_CODE` is true |
+| Development checklist | Tick only if `CHECKLIST_PASSED` is true |
+| Perfect PR recommendations | Tick only if the PR affects a single integration or closely related modules, represents one primary type of change, and has a clear, self-contained scope |
+| Formatted using Ruff | Tick only if `PREK_PASSED` is true |
+| Tests have been added | Tick only if `TESTS_CHANGED` is true AND the changes exercise new or changed functionality (not only cosmetic test changes) |
+| Documentation added/updated | Tick if documentation PR created (or not applicable) |
+| Manifest file fields filled out | Tick if `PREK_PASSED` is true (or not applicable) |
+| Dependencies in requirements_all.txt | Tick only if `DEPENDENCIES_CHANGED` is false, or if `DEPENDENCIES_CHANGED` is true and `REQUIREMENTS_UPDATED` is true |
+| Dependency changelog linked | Tick if dependency changelog linked in PR description (or not applicable) |
+| Any generated code has been carefully reviewed | Leave unchecked for the contributor to review and set manually |
+
+## Step 9: Breaking Change Section
+
+**If `CHANGE_TYPE` is NOT "Breaking change" or "Deprecation": REMOVE the entire "## Breaking change" section from the PR body (including the heading).**
+
+If `CHANGE_TYPE` IS "Breaking change" or "Deprecation", keep the `## Breaking change` section and describe:
+- What breaks
+- How users can fix it
+- Why it was necessary
+
+## Step 10: Push Branch and Create PR
+
+Push the branch with upstream tracking, and create a PR against `home-assistant/core` with the generated title and body:
+
+```bash
+# Create PR (gh pr create pushes the branch automatically)
+gh pr create --repo home-assistant/core --base dev \
+  --draft \
+  --title "TITLE_HERE" \
+  --body "$(cat <<'EOF'
+BODY_HERE
+EOF
+)"
+```
+
+### PR Body Template
+
+Read the PR template from `.github/PULL_REQUEST_TEMPLATE.md` and use it as the basis for the PR body. **Do not hardcode the template — always read it from the file to stay in sync with upstream changes.**
+
+Use any HTML comments (`<!-- ... -->`) in the template as guidance to understand what to fill in. For the final PR body sent to GitHub, keep the template text intact — do not delete any text from the template unless it explicitly instructs removal (e.g., the breaking change section when not applicable). Then fill in the sections:
+
+1. **Breaking change section**: If the type is NOT "Breaking change" or "Deprecation", remove the entire `## Breaking change` section (heading and body). Otherwise, describe what breaks, how users can fix it, and why.
+2. **Proposed change section**: Fill in a description of the change extracted from commit messages.
+3. **Type of change**: Check exactly ONE checkbox matching the determined type from Step 7. Leave all others unchecked.
+4. **Additional information**: Fill in any related issue numbers if known.
+5. **Checklist**: Check boxes based on the conditions in Step 8. Leave manual-verification boxes unchecked for the contributor.
+
+**Important:** Preserve all template structure, options, and link references exactly as they appear in the file — only modify checkbox states and fill in content sections.
+
+## Step 11: Report Result
+
+Provide the user with:
+1. **PR URL** - The created pull request link
+2. **Verification Summary** - Which checks passed/failed
+3. **Unchecked Items** - List any checkboxes left unchecked and why
+4. **User Action Required** - Remind user to:
+   - Review and set manual-verification checkboxes ("I understand the code..." and "Any generated code...") as applicable
+   - Consider reviewing two other open PRs
+   - Add any related issue numbers if applicable
@@ -0,0 +1,15 @@
+---
+name: github-pr-reviewer
+description: Reviews GitHub pull requests and provides feedback comments. This is the top skill to use for reviewing Pull Requests from GitHub.
+---
+
+# Review GitHub Pull Request
+
+## Follow these steps:
+1. Use 'gh pr view' to get the PR details and description.
+2. Use 'gh pr diff' to see all the changes in the PR.
+3. Review the changes following the `review` skill. It is VERY IMPORTANT to follow the `review` skill instructions.
+4. Check if all existing review comments have been addressed.
+
+## IMPORTANT:
+- Only provide review feedback in the CONSOLE. DO NOT ACT ON GITHUB.
@@ -0,0 +1,48 @@
+---
+name: ha-integration-knowledge
+description: Everything you need to know to build, test and review Home Assistant Integrations. If you're looking at an integration, you must use this as your primary reference.
+---
+
+## File Locations
+- **Integration code**: `./homeassistant/components/<integration_domain>/`
+- **Integration tests**: `./tests/components/<integration_domain>/`
+
+## General guidelines
+
+- When looking for examples, prefer integrations with the platinum or gold quality scale level first.
+- Polling intervals are NOT user-configurable. Never add scan_interval, update_interval, or polling frequency options to config flows or config entries.
+- Do NOT allow users to set config entry names in config flows. Names are automatically generated or can be customized later in UI. Exception: helper integrations may allow custom names.
+- For entity actions and entity services, avoid requesting redundant defensive checks for fields already enforced by Home Assistant validation schemas and entity filters; only request extra guards when values bypass validation or are transformed unsafely.
+- When validation guarantees a key is present, prefer direct dictionary indexing (`data["key"]`) over `.get("key")` so invalid assumptions fail fast.
+- Integrations should be thin wrappers. Protocol parsing, device state machines, or other domain logic belong in a separate PyPI library, not in the integration itself. If unsure, ask before inlining.
+- Integrations should not implement fixes or workarounds for limitations in libraries. Instead, the library should be updated to fix the issue.
+
+The following platforms have extra guidelines:
+- **Diagnostics**: [`platform-diagnostics.md`](platform-diagnostics.md) for diagnostic data collection
+- **Repairs**: [`platform-repairs.md`](platform-repairs.md) for user-actionable repair issues
+
+## Entity platforms
+
+- Ensure `async_added_to_hass()` and `async_will_remove_from_hass()` have symmetrical behavior. For example, if a subscription is created in `async_added_to_hass()`, it should be unsubscribed in `async_will_remove_from_hass()`. Also, if something is torn down in `async_will_remove_from_hass()`, it should be set up in `async_added_to_hass()`.
+- Entity base class (e.g. `SensorEntity`, `TrackerEntity`) provide a stable API for child classes to inherit from. Do not suggest redeclaring or duplicating attributes, properties, or methods the base class already provides, and do not add guards against the parent's behavior changing — rely on the base class instead.
+
+## Integration Quality Scale
+
+- When validating the quality scale rules, check them at https://developers.home-assistant.io/docs/core/integration-quality-scale/rules
+- When implementing or reviewing an integration, always consider the quality scale rules, since they promote best practices.
+
+Template scale file: `./script/scaffold/templates/integration/integration/quality_scale.yaml`
+
+### How Rules Apply
+1. **Check `manifest.json`**: Look for `"quality_scale"` key to determine integration level
+2. **Bronze Rules**: Always required for any integration with quality scale
+3. **Higher Tier Rules**: Only apply if integration targets that tier or higher
+4. **Rule Status**: Check `quality_scale.yaml` in integration folder for:
+   - `done`: Rule implemented
+   - `exempt`: Rule doesn't apply (with reason in comment)
+   - `todo`: Rule needs implementation
+
+
+## Testing Requirements
+
+- Tests should avoid interacting or mocking internal integration details. For more info, see https://developers.home-assistant.io/docs/development_testing/#writing-tests-for-integrations
@@ -0,0 +1,6 @@
+# Integration Diagnostics
+
+Platform exists as `homeassistant/components/<domain>/diagnostics.py`.
+
+- **Required**: Implement diagnostic data collection
+- **Security**: Never expose passwords, tokens, or sensitive coordinates
@@ -0,0 +1,21 @@
+# Repairs platform
+
+Platform exists as `homeassistant/components/<domain>/repairs.py`.
+
+- **Actionable Issues Required**: All repair issues must be actionable for end users
+- **Issue Content Requirements**:
+  - Clearly explain what is happening
+  - Provide specific steps users need to take to resolve the issue
+  - Use friendly, helpful language
+  - Include relevant context (device names, error details, etc.)
+- **String Content Must Include**:
+  - What the problem is
+  - Why it matters
+  - Exact steps to resolve (numbered list when multiple steps)
+  - What to expect after following the steps
+- **Avoid Vague Instructions**: Don't just say "update firmware" - provide specific steps
+- **Severity Guidelines**:
+  - `CRITICAL`: Reserved for extreme scenarios only
+  - `ERROR`: Requires immediate user attention
+  - `WARNING`: Indicates future potential breakage
+- Only create issues for problems users can potentially resolve
@@ -0,0 +1,38 @@
+---
+name: review
+description: Reviews code changes and provides constructive feedback. Should be used when a review is requested to provide a consistent review behavior and output format. This skill can be used for code reviews in general, not just for GitHub pull requests.
+---
+
+# Review Code Changes
+
+## Analyze the code changes for:
+- Code quality and style consistency
+- Potential bugs or issues
+- Performance implications
+- Security concerns
+- Test coverage
+- Documentation updates if needed
+
+## Verification:
+- After the review, run parallel subagents for each finding to double-check it.
+- Spawn up to a maximum of 10 parallel subagents at a time.
+- Gather the results from the subagents and summarize them in the final review comments.
+
+## IMPORTANT:
+- Just review. DO NOT make any changes.
+- Be constructive and specific in your comments.
+- Suggest improvements where appropriate.
+- No need to run tests or linters, just review the code changes.
+- No need to highlight things that are already good.
+
+## Output format:
+- List specific comments for each file/line that needs attention.
+- In the end, summarize with an overall assessment (approve, request changes, or comment) and bullet point list of changes suggested, if any.
+  - Example output:
+    ```
+    Overall assessment: request changes.
+    - [CRITICAL] sensor.py:143 - Memory leak
+    - [PROBLEM] data_processing.py:87 - Inefficient algorithm
+    - [SUGGESTION] test_init.py:45 - Improve x variable name
+    ```
+  - Make sure to include the file and line number when possible in the bullet points.
@@ -13,6 +13,7 @@ core: &core

 # Our base platforms, that are used by other integrations
 base_platforms: &base_platforms
+  - homeassistant/components/ai_task/**
  - homeassistant/components/air_quality/**
  - homeassistant/components/alarm_control_panel/**
  - homeassistant/components/assist_satellite/**
@@ -21,6 +22,7 @@ base_platforms: &base_platforms
  - homeassistant/components/calendar/**
  - homeassistant/components/camera/**
  - homeassistant/components/climate/**
+  - homeassistant/components/conversation/**
  - homeassistant/components/cover/**
  - homeassistant/components/date/**
  - homeassistant/components/datetime/**
@@ -32,7 +34,9 @@ base_platforms: &base_platforms
  - homeassistant/components/humidifier/**
  - homeassistant/components/image/**
  - homeassistant/components/image_processing/**
+  - homeassistant/components/infrared/**
  - homeassistant/components/lawn_mower/**
+  - homeassistant/components/radio_frequency/**
  - homeassistant/components/light/**
  - homeassistant/components/lock/**
  - homeassistant/components/media_player/**
@@ -52,6 +56,7 @@ base_platforms: &base_platforms
  - homeassistant/components/update/**
  - homeassistant/components/vacuum/**
  - homeassistant/components/valve/**
+  - homeassistant/components/wake_word/**
  - homeassistant/components/water_heater/**
  - homeassistant/components/weather/**

@@ -69,7 +74,6 @@ components: &components
  - homeassistant/components/cloud/**
  - homeassistant/components/config/**
  - homeassistant/components/configurator/**
-  - homeassistant/components/conversation/**
  - homeassistant/components/demo/**
  - homeassistant/components/device_automation/**
  - homeassistant/components/dhcp/**
@@ -90,6 +94,7 @@ components: &components
  - homeassistant/components/input_number/**
  - homeassistant/components/input_select/**
  - homeassistant/components/input_text/**
+  - homeassistant/components/labs/**
  - homeassistant/components/logbook/**
  - homeassistant/components/logger/**
  - homeassistant/components/lovelace/**
@@ -0,0 +1,9 @@
+{
+  "features": {
+    "ghcr.io/devcontainers/features/github-cli:1": {
+      "version": "1.1.0",
+      "resolved": "ghcr.io/devcontainers/features/github-cli@sha256:d22f50b70ed75339b4eed1ba9ecde3a1791f90e88d37936517e3bace0bbad671",
+      "integrity": "sha256:d22f50b70ed75339b4eed1ba9ecde3a1791f90e88d37936517e3bace0bbad671"
+    }
+  }
+}
@@ -8,9 +8,6 @@
    "PYTHONASYNCIODEBUG": "1"
  },
  "features": {
-    // Node feature required for Claude Code until fixed https://github.com/anthropics/devcontainer-features/issues/28
-    "ghcr.io/devcontainers/features/node:1": {},
-    "ghcr.io/anthropics/devcontainer-features/claude-code:1.0": {},
    "ghcr.io/devcontainers/features/github-cli:1": {}
  },
  // Port 5683 udp is used by Shelly integration
@@ -27,13 +24,12 @@
        "charliermarsh.ruff",
        "ms-python.pylint",
        "ms-python.vscode-pylance",
-        "visualstudioexptteam.vscodeintellicode",
        "redhat.vscode-yaml",
        "esbenp.prettier-vscode",
        "GitHub.vscode-pull-request-github",
        "GitHub.copilot"
      ],
-      // Please keep this file in sync with settings in home-assistant/.vscode/settings.default.json
+      // Please keep this file in sync with settings in home-assistant/.vscode/settings.default.jsonc
      "settings": {
        "python.experiments.optOutFrom": ["pythonTestAdapter"],
        "python.defaultInterpreterPath": "/home/vscode/.local/ha-venv/bin/python",
@@ -41,7 +37,8 @@
        "python.terminal.activateEnvInCurrentTerminal": true,
        "python.testing.pytestArgs": ["--no-cov"],
        "pylint.importStrategy": "fromEnvironment",
-        "python.analysis.typeCheckingMode": "basic",
+        // Pyright type checking is not compatible with mypy which Home Assistant uses for type checking
+        "python.analysis.typeCheckingMode": "off",
        "editor.formatOnPaste": false,
        "editor.formatOnSave": true,
        "editor.formatOnType": true,
@@ -63,6 +60,15 @@
        "[python]": {
          "editor.defaultFormatter": "charliermarsh.ruff"
        },
+        "[json]": {
+          "editor.defaultFormatter": "esbenp.prettier-vscode"
+        },
+        "[jsonc]": {
+          "editor.defaultFormatter": "esbenp.prettier-vscode"
+        },
+        "[yaml]": {
+          "editor.defaultFormatter": "esbenp.prettier-vscode"
+        },
        "json.schemas": [
          {
            "fileMatch": ["homeassistant/components/*/manifest.json"],
@@ -0,0 +1 @@
+../.claude/skills
@@ -14,11 +14,12 @@ Dockerfile.dev linguist-language=Dockerfile

 # Generated files
 CODEOWNERS linguist-generated=true
-Dockerfile linguist-generated=true
 homeassistant/generated/*.py linguist-generated=true
+pylint/plugins/pylint_home_assistant/generated/*.py linguist-generated=true
+machine/* linguist-generated=true
 mypy.ini linguist-generated=true
 requirements.txt linguist-generated=true
 requirements_all.txt linguist-generated=true
-requirements_test_all.txt linguist-generated=true
 requirements_test_pre_commit.txt linguist-generated=true
 script/hassfest/docker/Dockerfile linguist-generated=true
+.github/workflows/*.lock.yml linguist-generated=true
@@ -80,7 +80,7 @@ If the code communicates with devices, web services, or third-party tools:
      Updated and included derived files by running: `python3 -m script.hassfest`.
 - [ ] New or updated dependencies have been added to `requirements_all.txt`.  
      Updated by running `python3 -m script.gen_requirements_all`.
- [ ] For the updated dependencies - a link to the changelog, or at minimum a diff between library versions is added to the PR description.
+- [ ] For the updated dependencies a diff between library versions and ideally a link to the changelog/release notes is added to the PR description.

 <!--
  This project is very active and we have a high turnover of pull requests.
@@ -0,0 +1,52 @@
+name: Cache and install APT packages
+description: >-
+  Wraps awalsh128/cache-apt-pkgs-action with the workarounds Home Assistant CI
+  needs. Removes the conflicting Microsoft apt source before any apt run, and
+  points the dynamic linker at the host's multiarch lib subdirectories so
+  shared libraries that rely on update-alternatives or postinst-managed paths
+  (eg libblas, liblapack pulled in by ffmpeg) stay reachable since the upstream
+  action does not execute postinst scripts on cache restore.
+
+inputs:
+  packages:
+    description: Space-delimited list of apt packages to install.
+    required: true
+  version:
+    description: Cache version. Bump to invalidate the cache.
+    required: false
+    default: "1"
+  execute_install_scripts:
+    description: >-
+      Pass-through to awalsh128/cache-apt-pkgs-action. Postinst scripts are not
+      actually cached by the upstream action, so this is largely a no-op today.
+    required: false
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - name: Remove conflicting Microsoft apt source
+      shell: bash
+      run: sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
+    - name: Install apt packages via cache
+      uses: awalsh128/cache-apt-pkgs-action@acb598e5ddbc6f68a970c5da0688d2f3a9f04d05 # v1.5.3
+      with:
+        packages: ${{ inputs.packages }}
+        version: ${{ inputs.version }}
+        execute_install_scripts: ${{ inputs.execute_install_scripts }}
+    - name: Refresh dynamic linker cache
+      shell: bash
+      run: |
+        # awalsh128/cache-apt-pkgs-action does not run postinst scripts on
+        # cache restore, so update-alternatives symlinks (eg the one libblas
+        # creates at /usr/lib/<multiarch>/libblas.so.3) are never produced.
+        # Add every /usr/lib/<multiarch> subdirectory that holds shared
+        # libraries to the ldconfig search path so the dynamic linker still
+        # finds them.  Use dpkg-architecture to derive the host's multiarch
+        # tuple so this works on non-x86_64 runners too.
+        multiarch="$(dpkg-architecture -qDEB_HOST_MULTIARCH)"
+        find "/usr/lib/${multiarch}" -mindepth 2 -maxdepth 2 \
+          -name '*.so.*' -printf '%h\n' \
+          | sort -u \
+          | sudo tee /etc/ld.so.conf.d/zzz-cache-apt-extras.conf > /dev/null
+        sudo ldconfig
@@ -9,3 +9,8 @@ updates:
    labels:
      - dependency
      - github_actions
+    cooldown:
+      default-days: 7
+    ignore:
+      # Managed by gh aw compile. Version-locked to the gh-aw compiler; do not bump.
+      - dependency-name: "github/gh-aw-actions/**"
@@ -0,0 +1,51 @@
+---
+applyTo: "homeassistant/components/**, tests/components/**"
+excludeAgent: "cloud-agent"
+---
+
+<!-- Automatically generated by gen_copilot_instructions.py, do not edit -->
+
+
+## File Locations
+- **Integration code**: `./homeassistant/components/<integration_domain>/`
+- **Integration tests**: `./tests/components/<integration_domain>/`
+
+## General guidelines
+
+- When looking for examples, prefer integrations with the platinum or gold quality scale level first.
+- Polling intervals are NOT user-configurable. Never add scan_interval, update_interval, or polling frequency options to config flows or config entries.
+- Do NOT allow users to set config entry names in config flows. Names are automatically generated or can be customized later in UI. Exception: helper integrations may allow custom names.
+- For entity actions and entity services, avoid requesting redundant defensive checks for fields already enforced by Home Assistant validation schemas and entity filters; only request extra guards when values bypass validation or are transformed unsafely.
+- When validation guarantees a key is present, prefer direct dictionary indexing (`data["key"]`) over `.get("key")` so invalid assumptions fail fast.
+- Integrations should be thin wrappers. Protocol parsing, device state machines, or other domain logic belong in a separate PyPI library, not in the integration itself. If unsure, ask before inlining.
+- Integrations should not implement fixes or workarounds for limitations in libraries. Instead, the library should be updated to fix the issue.
+
+The following platforms have extra guidelines:
+- **Diagnostics**: [`platform-diagnostics.md`](platform-diagnostics.md) for diagnostic data collection
+- **Repairs**: [`platform-repairs.md`](platform-repairs.md) for user-actionable repair issues
+
+## Entity platforms
+
+- Ensure `async_added_to_hass()` and `async_will_remove_from_hass()` have symmetrical behavior. For example, if a subscription is created in `async_added_to_hass()`, it should be unsubscribed in `async_will_remove_from_hass()`. Also, if something is torn down in `async_will_remove_from_hass()`, it should be set up in `async_added_to_hass()`.
+- Entity base class (e.g. `SensorEntity`, `TrackerEntity`) provide a stable API for child classes to inherit from. Do not suggest redeclaring or duplicating attributes, properties, or methods the base class already provides, and do not add guards against the parent's behavior changing — rely on the base class instead.
+
+## Integration Quality Scale
+
+- When validating the quality scale rules, check them at https://developers.home-assistant.io/docs/core/integration-quality-scale/rules
+- When implementing or reviewing an integration, always consider the quality scale rules, since they promote best practices.
+
+Template scale file: `./script/scaffold/templates/integration/integration/quality_scale.yaml`
+
+### How Rules Apply
+1. **Check `manifest.json`**: Look for `"quality_scale"` key to determine integration level
+2. **Bronze Rules**: Always required for any integration with quality scale
+3. **Higher Tier Rules**: Only apply if integration targets that tier or higher
+4. **Rule Status**: Check `quality_scale.yaml` in integration folder for:
+   - `done`: Rule implemented
+   - `exempt`: Rule doesn't apply (with reason in comment)
+   - `todo`: Rule needs implementation
+
+
+## Testing Requirements
+
+- Tests should avoid interacting or mocking internal integration details. For more info, see https://developers.home-assistant.io/docs/development_testing/#writing-tests-for-integrations
@@ -0,0 +1,245 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+
+  "enabledManagers": [
+    "pep621",
+    "pip_requirements",
+    "pre-commit",
+    "dockerfile",
+    "custom.regex",
+    "homeassistant-manifest"
+  ],
+
+  "pre-commit": {
+    "enabled": true
+  },
+
+  "pip_requirements": {
+    "managerFilePatterns": [
+      "/(^|/)requirements[\\w_-]*\\.txt$/",
+      "/(^|/)homeassistant/package_constraints\\.txt$/"
+    ]
+  },
+
+  "dockerfile": {
+    "managerFilePatterns": ["/^Dockerfile$/"]
+  },
+
+  "homeassistant-manifest": {
+    "managerFilePatterns": [
+      "/^homeassistant/components/[^/]+/manifest\\.json$/"
+    ]
+  },
+
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": "Update ruff required-version in pyproject.toml",
+      "managerFilePatterns": ["/^pyproject\\.toml$/"],
+      "matchStrings": ["required-version = \">=(?<currentValue>[\\d.]+)\""],
+      "depNameTemplate": "ruff",
+      "datasourceTemplate": "pypi"
+    },
+    {
+      "customType": "regex",
+      "description": "Update go2rtc RECOMMENDED_VERSION in const.py alongside the Dockerfile pin",
+      "managerFilePatterns": ["/^homeassistant/components/go2rtc/const\\.py$/"],
+      "matchStrings": ["RECOMMENDED_VERSION = \"(?<currentValue>[\\d.]+)\""],
+      "depNameTemplate": "ghcr.io/alexxit/go2rtc",
+      "datasourceTemplate": "docker"
+    }
+  ],
+
+  "minimumReleaseAge": "7 days",
+  "prConcurrentLimit": 10,
+  "prHourlyLimit": 2,
+  "schedule": ["before 6am"],
+
+  "semanticCommits": "disabled",
+  "commitMessageAction": "Update",
+  "commitMessageTopic": "{{depName}}",
+  "commitMessageExtra": "to {{newVersion}}",
+
+  "automerge": false,
+
+  "vulnerabilityAlerts": {
+    "enabled": false
+  },
+
+  "packageRules": [
+    {
+      "description": "Deny all by default — allowlist below re-enables specific packages",
+      "matchPackageNames": ["*"],
+      "enabled": false
+    },
+    {
+      "description": "Core runtime dependencies (allowlisted)",
+      "matchPackageNames": [
+        "aiohttp",
+        "aiohttp-fast-zlib",
+        "aiohttp_cors",
+        "aiohttp-asyncmdnsresolver",
+        "yarl",
+        "httpx",
+        "requests",
+        "urllib3",
+        "certifi",
+        "orjson",
+        "PyYAML",
+        "Jinja2",
+        "cryptography",
+        "pyOpenSSL",
+        "PyJWT",
+        "SQLAlchemy",
+        "Pillow",
+        "attrs",
+        "uv",
+        "voluptuous",
+        "voluptuous-serialize",
+        "voluptuous-openapi",
+        "zeroconf"
+      ],
+      "enabled": true,
+      "labels": ["dependency", "core"]
+    },
+    {
+      "description": "Common Python utilities (allowlisted)",
+      "matchPackageNames": [
+        "astral",
+        "atomicwrites-homeassistant",
+        "audioop-lts",
+        "awesomeversion",
+        "bcrypt",
+        "ciso8601",
+        "cronsim",
+        "defusedxml",
+        "fnv-hash-fast",
+        "getmac",
+        "ical",
+        "ifaddr",
+        "lru-dict",
+        "mutagen",
+        "propcache",
+        "pyserial",
+        "python-slugify",
+        "PyTurboJPEG",
+        "securetar",
+        "standard-aifc",
+        "standard-telnetlib",
+        "ulid-transform",
+        "unidiff",
+        "url-normalize",
+        "xmltodict"
+      ],
+      "enabled": true,
+      "labels": ["dependency"]
+    },
+    {
+      "description": "Home Assistant ecosystem packages (core-maintained, no cooldown)",
+      "matchPackageNames": [
+        "hassil",
+        "home-assistant-bluetooth",
+        "home-assistant-frontend",
+        "home-assistant-intents",
+        "infrared-protocols",
+        "rf-protocols"
+      ],
+      "enabled": true,
+      "minimumReleaseAge": null,
+      "labels": ["dependency", "core"]
+    },
+    {
+      "description": "Test dependencies (allowlisted)",
+      "matchPackageNames": [
+        "pytest",
+        "pytest-asyncio",
+        "pytest-aiohttp",
+        "pytest-cov",
+        "pytest-freezer",
+        "pytest-github-actions-annotate-failures",
+        "pytest-socket",
+        "pytest-sugar",
+        "pytest-timeout",
+        "pytest-unordered",
+        "pytest-picked",
+        "pytest-xdist",
+        "pylint",
+        "pylint-per-file-ignores",
+        "astroid",
+        "coverage",
+        "freezegun",
+        "syrupy",
+        "respx",
+        "requests-mock",
+        "ruff",
+        "codespell",
+        "yamllint",
+        "zizmor"
+      ],
+      "enabled": true,
+      "labels": ["dependency"]
+    },
+    {
+      "description": "For types-* stubs, only allow patch updates. Major/minor bumps track the upstream runtime package version and must be manually coordinated with the corresponding pin.",
+      "matchPackageNames": ["/^types-/"],
+      "matchUpdateTypes": ["patch"],
+      "enabled": true,
+      "labels": ["dependency"]
+    },
+    {
+      "description": "Pre-commit hook repos (allowlisted, matched by owner/repo)",
+      "matchPackageNames": [
+        "astral-sh/ruff-pre-commit",
+        "codespell-project/codespell",
+        "adrienverge/yamllint",
+        "zizmorcore/zizmor-pre-commit"
+      ],
+      "enabled": true,
+      "labels": ["dependency"]
+    },
+    {
+      "description": "Docker allowlist (ghcr.io exposes no release timestamps so the global cooldown needs to be bypassed)",
+      "matchPackageNames": ["ghcr.io/alexxit/go2rtc"],
+      "enabled": true,
+      "minimumReleaseAge": null,
+      "labels": ["dependency"]
+    },
+    {
+      "description": "Group ruff pre-commit hook with its PyPI twin into one PR",
+      "matchPackageNames": ["astral-sh/ruff-pre-commit", "ruff"],
+      "groupName": "ruff",
+      "groupSlug": "ruff"
+    },
+    {
+      "description": "Group codespell pre-commit hook with its PyPI twin into one PR",
+      "matchPackageNames": ["codespell-project/codespell", "codespell"],
+      "groupName": "codespell",
+      "groupSlug": "codespell"
+    },
+    {
+      "description": "Group yamllint pre-commit hook with its PyPI twin into one PR",
+      "matchPackageNames": ["adrienverge/yamllint", "yamllint"],
+      "groupName": "yamllint",
+      "groupSlug": "yamllint"
+    },
+    {
+      "description": "Group zizmor pre-commit hook with its PyPI twin into one PR",
+      "matchPackageNames": ["zizmorcore/zizmor-pre-commit", "zizmor"],
+      "groupName": "zizmor",
+      "groupSlug": "zizmor"
+    },
+    {
+      "description": "Group pylint with astroid (their versions are linked and must move together)",
+      "matchPackageNames": ["pylint", "astroid"],
+      "groupName": "pylint",
+      "groupSlug": "pylint"
+    },
+    {
+      "description": "Group go2rtc Dockerfile pin with const.py RECOMMENDED_VERSION into one PR",
+      "matchPackageNames": ["ghcr.io/alexxit/go2rtc"],
+      "groupName": "go2rtc",
+      "groupSlug": "go2rtc"
+    }
+  ]
+}
@@ -10,44 +10,51 @@ on:

 env:
  BUILD_TYPE: core
-  DEFAULT_PYTHON: "3.13"
  PIP_TIMEOUT: 60
  UV_HTTP_TIMEOUT: 60
  UV_SYSTEM_PYTHON: "true"
+  # Base image version from https://github.com/home-assistant/docker
+  BASE_IMAGE_VERSION: "2026.05.0"
+  ARCHITECTURES: '["amd64", "aarch64"]'
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true

 jobs:
  init:
    name: Initialize build
    if: github.repository_owner == 'home-assistant'
    runs-on: ubuntu-latest
+    permissions:
+      contents: read # To check out the repository
    outputs:
-      architectures: ${{ steps.info.outputs.architectures }}
      version: ${{ steps.version.outputs.version }}
      channel: ${{ steps.version.outputs.channel }}
      publish: ${{ steps.version.outputs.publish }}
+      architectures: ${{ env.ARCHITECTURES }}
+      base_image_version: ${{ env.BASE_IMAGE_VERSION }}
    steps:
      - name: Checkout the repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
-          fetch-depth: 0
+          persist-credentials: false

-      - name: Set up Python ${{ env.DEFAULT_PYTHON }}
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
-          python-version: ${{ env.DEFAULT_PYTHON }}
-
-      - name: Get information
-        id: info
-        uses: home-assistant/actions/helpers/info@master
+          python-version-file: ".python-version"

      - name: Get version
        id: version
-        uses: home-assistant/actions/helpers/version@master
+        uses: home-assistant/actions/helpers/version@master # zizmor: ignore[unpinned-uses]
        with:
          type: ${{ env.BUILD_TYPE }}

      - name: Verify version
-        uses: home-assistant/actions/helpers/verify-version@master
+        uses: home-assistant/actions/helpers/verify-version@master # zizmor: ignore[unpinned-uses]
        with:
          ignore-dev: true

@@ -62,14 +69,14 @@ jobs:
      - name: Download Translations
        run: python3 -m script.translations download
        env:
-          LOKALISE_TOKEN: ${{ secrets.LOKALISE_TOKEN }}
+          LOKALISE_TOKEN: ${{ secrets.LOKALISE_TOKEN }} # zizmor: ignore[secrets-outside-env]

      - name: Archive translations
        shell: bash
        run: find ./homeassistant/components/*/translations -name "*.json" | tar zcvf translations.tar.gz -T -

      - name: Upload translations
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: translations
          path: translations.tar.gz
@@ -79,22 +86,29 @@ jobs:
    name: Build ${{ matrix.arch }} base core image
    if: github.repository_owner == 'home-assistant'
    needs: init
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.os }}
    permissions:
-      contents: read
-      packages: write
-      id-token: write
+      contents: read # To check out the repository
+      packages: write # To push to GHCR
+      id-token: write # For cosign signing
    strategy:
      fail-fast: false
      matrix:
        arch: ${{ fromJson(needs.init.outputs.architectures) }}
+        include:
+          - arch: amd64
+            os: ubuntu-24.04
+          - arch: aarch64
+            os: ubuntu-24.04-arm
    steps:
      - name: Checkout the repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false

      - name: Download nightly wheels of frontend
        if: needs.init.outputs.channel == 'dev'
-        uses: dawidd6/action-download-artifact@ac66b43f0e6a346234dd65d4d0c8fbb31cb316e5 # v11
+        uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21
        with:
          github_token: ${{secrets.GITHUB_TOKEN}}
          repo: home-assistant/frontend
@@ -105,7 +119,7 @@ jobs:

      - name: Download nightly wheels of intents
        if: needs.init.outputs.channel == 'dev'
-        uses: dawidd6/action-download-artifact@ac66b43f0e6a346234dd65d4d0c8fbb31cb316e5 # v11
+        uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21
        with:
          github_token: ${{secrets.GITHUB_TOKEN}}
          repo: OHF-Voice/intents-package
@@ -114,22 +128,23 @@ jobs:
          workflow_conclusion: success
          name: package

-      - name: Set up Python ${{ env.DEFAULT_PYTHON }}
+      - name: Set up Python
        if: needs.init.outputs.channel == 'dev'
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
-          python-version: ${{ env.DEFAULT_PYTHON }}
+          python-version-file: ".python-version"

      - name: Adjust nightly version
        if: needs.init.outputs.channel == 'dev'
        shell: bash
        env:
          UV_PRERELEASE: allow
+          VERSION: ${{ needs.init.outputs.version }}
        run: |
          python3 -m pip install "$(grep '^uv' < requirements.txt)"
          uv pip install packaging tomli
          uv pip install .
-          python3 script/version_bump.py nightly --set-nightly-version "${{ needs.init.outputs.version }}"
+          python3 script/version_bump.py nightly --set-nightly-version "${VERSION}"

          if [[ "$(ls home_assistant_frontend*.whl)" =~ ^home_assistant_frontend-(.*)-py3-none-any.whl$ ]]; then
            echo "Found frontend wheel, setting version to: ${BASH_REMATCH[1]}"
@@ -159,23 +174,11 @@ jobs:
            sed -i "s|home-assistant-intents==.*|home-assistant-intents==${BASH_REMATCH[1]}|" \
              homeassistant/package_constraints.txt

-            sed -i "s|home-assistant-intents==.*||" requirements_all.txt
+            sed -i "s|home-assistant-intents==.*||" requirements_all.txt requirements.txt
          fi

-      - name: Adjustments for armhf
-        if: matrix.arch == 'armhf'
-        run: |
-          # Pandas has issues building on armhf, it is expected they
-          # will drop the platform in the near future (they consider it
-          # "flimsy" on 386). The following packages depend on pandas,
-          # so we comment them out.
-          sed -i "s|env-canada|# env-canada|g" requirements_all.txt
-          sed -i "s|noaa-coops|# noaa-coops|g" requirements_all.txt
-          sed -i "s|pyezviz|# pyezviz|g" requirements_all.txt
-          sed -i "s|pykrakenapi|# pykrakenapi|g" requirements_all.txt
-
      - name: Download translations
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: translations

@@ -187,91 +190,97 @@ jobs:
      - name: Write meta info file
        shell: bash
        run: |
-          echo "${{ github.sha }};${{ github.ref }};${{ github.event_name }};${{ github.actor }}" > rootfs/OFFICIAL_IMAGE
+          echo "${GITHUB_SHA};${GITHUB_REF};${GITHUB_EVENT_NAME};${GITHUB_ACTOR}" > rootfs/OFFICIAL_IMAGE

-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      # home-assistant/builder doesn't support sha pinning
      - name: Build base image
-        uses: home-assistant/builder@2025.09.0
+        uses: home-assistant/builder/actions/build-image@62a1597b84b3461abad9816d9cd92862a2b542c3 # 2026.03.2
        with:
-          args: |
-            $BUILD_ARGS \
-            --${{ matrix.arch }} \
-            --cosign \
-            --target /data \
-            --generic ${{ needs.init.outputs.version }}
+          arch: ${{ matrix.arch }}
+          build-args: |
+            BUILD_FROM=ghcr.io/home-assistant/${{ matrix.arch }}-homeassistant-base:${{ needs.init.outputs.base_image_version }}
+          cache-gha: false
+          container-registry-password: ${{ secrets.GITHUB_TOKEN }}
+          cosign-base-identity: "https://github.com/home-assistant/docker/.*"
+          cosign-base-verify: ghcr.io/home-assistant/${{ matrix.arch }}-homeassistant-base:${{ needs.init.outputs.base_image_version }}
+          image: ghcr.io/home-assistant/${{ matrix.arch }}-homeassistant
+          image-tags: ${{ needs.init.outputs.version }}
+          push: true
+          version: ${{ needs.init.outputs.version }}

  build_machine:
    name: Build ${{ matrix.machine }} machine core image
    if: github.repository_owner == 'home-assistant'
    needs: ["init", "build_base"]
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.runs-on }}
    permissions:
-      contents: read
-      packages: write
-      id-token: write
+      contents: read # To check out the repository
+      packages: write # To push to GHCR
+      id-token: write # For cosign signing
    strategy:
      matrix:
        machine:
          - generic-x86-64
-          - intel-nuc
          - khadas-vim3
          - odroid-c2
          - odroid-c4
          - odroid-m1
          - odroid-n2
-          - odroid-xu
-          - qemuarm
          - qemuarm-64
-          - qemux86
          - qemux86-64
-          - raspberrypi
-          - raspberrypi2
-          - raspberrypi3
          - raspberrypi3-64
-          - raspberrypi4
          - raspberrypi4-64
          - raspberrypi5-64
-          - tinker
          - yellow
          - green
+        include:
+          # Default: aarch64 on native ARM runner
+          - arch: aarch64
+            runs-on: ubuntu-24.04-arm
+          # Overrides for amd64 machines
+          - machine: generic-x86-64
+            arch: amd64
+            runs-on: ubuntu-24.04
+          - machine: qemux86-64
+            arch: amd64
+            runs-on: ubuntu-24.04
    steps:
      - name: Checkout the repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false

-      - name: Set build additional args
+      - name: Compute extra tags
+        id: tags
+        shell: bash
+        env:
+          VERSION: ${{ needs.init.outputs.version }}
        run: |
-          # Create general tags
-          if [[ "${{ needs.init.outputs.version }}" =~ d ]]; then
-            echo "BUILD_ARGS=--additional-tag dev" >> $GITHUB_ENV
-          elif [[ "${{ needs.init.outputs.version }}" =~ b ]]; then
-            echo "BUILD_ARGS=--additional-tag beta" >> $GITHUB_ENV
+          if [[ "${VERSION}" =~ d ]]; then
+            echo "extra_tags=dev" >> "$GITHUB_OUTPUT"
+          elif [[ "${VERSION}" =~ b ]]; then
+            echo "extra_tags=beta" >> "$GITHUB_OUTPUT"
          else
-            echo "BUILD_ARGS=--additional-tag stable" >> $GITHUB_ENV
+            echo "extra_tags=stable" >> "$GITHUB_OUTPUT"
          fi

-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+      - name: Build machine image
+        uses: home-assistant/builder/actions/build-image@62a1597b84b3461abad9816d9cd92862a2b542c3 # 2026.03.2
        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      # home-assistant/builder doesn't support sha pinning
-      - name: Build base image
-        uses: home-assistant/builder@2025.09.0
-        with:
-          args: |
-            $BUILD_ARGS \
-            --target /data/machine \
-            --cosign \
-            --machine "${{ needs.init.outputs.version }}=${{ matrix.machine }}"
+          arch: ${{ matrix.arch }}
+          build-args: |
+            BUILD_FROM=ghcr.io/home-assistant/${{ matrix.arch }}-homeassistant:${{ needs.init.outputs.version }}
+          cache-gha: false
+          container-registry-password: ${{ secrets.GITHUB_TOKEN }}
+          context: machine/
+          cosign-base-identity: "https://github.com/home-assistant/core/.*"
+          cosign-base-verify: ghcr.io/home-assistant/${{ matrix.arch }}-homeassistant:${{ needs.init.outputs.version }}
+          file: machine/${{ matrix.machine }}
+          image: ghcr.io/home-assistant/${{ matrix.machine }}-homeassistant
+          image-tags: |
+            ${{ needs.init.outputs.version }}
+            ${{ steps.tags.outputs.extra_tags }}
+          push: true
+          version: ${{ needs.init.outputs.version }}

  publish_ha:
    name: Publish version files
@@ -279,171 +288,177 @@ jobs:
    if: github.repository_owner == 'home-assistant'
    needs: ["init", "build_machine"]
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
    steps:
      - name: Checkout the repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false

      - name: Initialize git
-        uses: home-assistant/actions/helpers/git-init@master
+        uses: home-assistant/actions/helpers/git-init@master # zizmor: ignore[unpinned-uses]
        with:
          name: ${{ secrets.GIT_NAME }}
          email: ${{ secrets.GIT_EMAIL }}
          token: ${{ secrets.GIT_TOKEN }}

      - name: Update version file
-        uses: home-assistant/actions/helpers/version-push@master
+        uses: home-assistant/actions/helpers/version-push@master # zizmor: ignore[unpinned-uses]
        with:
          key: "homeassistant[]"
          key-description: "Home Assistant Core"
          version: ${{ needs.init.outputs.version }}
          channel: ${{ needs.init.outputs.channel }}
+          exclude-list: '["odroid-xu","qemuarm","qemux86","raspberrypi","raspberrypi2","raspberrypi3","raspberrypi4","tinker"]'

      - name: Update version file (stable -> beta)
        if: needs.init.outputs.channel == 'stable'
-        uses: home-assistant/actions/helpers/version-push@master
+        uses: home-assistant/actions/helpers/version-push@master # zizmor: ignore[unpinned-uses]
        with:
          key: "homeassistant[]"
          key-description: "Home Assistant Core"
          version: ${{ needs.init.outputs.version }}
          channel: beta
+          exclude-list: '["odroid-xu","qemuarm","qemux86","raspberrypi","raspberrypi2","raspberrypi3","raspberrypi4","tinker"]'

  publish_container:
-    name: Publish meta container for ${{ matrix.registry }}
+    name: Publish to ${{ matrix.registry }}
    environment: ${{ needs.init.outputs.channel }}
    if: github.repository_owner == 'home-assistant'
    needs: ["init", "build_base"]
    runs-on: ubuntu-latest
    permissions:
-      contents: read
-      packages: write
-      id-token: write
+      contents: read # To check out the repository
+      packages: write # To push to GHCR
+      id-token: write # For cosign signing
    strategy:
      fail-fast: false
      matrix:
        registry: ["ghcr.io/home-assistant", "docker.io/homeassistant"]
    steps:
-      - name: Checkout the repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-
      - name: Install Cosign
-        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
        with:
-          cosign-release: "v2.2.3"
+          cosign-release: "v2.5.3"

      - name: Login to DockerHub
        if: matrix.registry == 'docker.io/homeassistant'
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Login to GitHub Container Registry
-        if: matrix.registry == 'ghcr.io/home-assistant'
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

-      - name: Build Meta Image
+      - name: Verify architecture image signatures
        shell: bash
+        env:
+          ARCHITECTURES: ${{ needs.init.outputs.architectures }}
+          VERSION: ${{ needs.init.outputs.version }}
        run: |
-          export DOCKER_CLI_EXPERIMENTAL=enabled
+          ARCHS=$(echo "${ARCHITECTURES}" | jq -r '.[]')
+          for arch in $ARCHS; do
+            echo "Verifying ${arch} image signature..."
+            cosign verify \
+              --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+              --certificate-identity-regexp https://github.com/home-assistant/core/.* \
+              "ghcr.io/home-assistant/${arch}-homeassistant:${VERSION}"
+          done
+          echo "✓ All images verified successfully"

-          function create_manifest() {
-            local tag_l=${1}
-            local tag_r=${2}
-            local registry=${{ matrix.registry }}
+      # Generate all Docker tags based on version string
+      # Version format: YYYY.MM.PATCH, YYYY.MM.PATCHbN (beta), or YYYY.MM.PATCH.devYYYYMMDDHHMM (dev)
+      # Examples:
+      #   2025.12.1     (stable)    -> tags: 2025.12.1, 2025.12, stable, latest, beta, rc
+      #   2025.12.0b3   (beta)      -> tags: 2025.12.0b3, beta, rc
+      #   2025.12.0.dev202511250240 -> tags: 2025.12.0.dev202511250240, dev
+      - name: Generate Docker metadata
+        id: meta
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        with:
+          images: ${{ matrix.registry }}/home-assistant
+          sep-tags: ","
+          tags: |
+            type=raw,value=${{ needs.init.outputs.version }},priority=9999
+            type=raw,value=dev,enable=${{ contains(needs.init.outputs.version, 'd') }}
+            type=raw,value=beta,enable=${{ !contains(needs.init.outputs.version, 'd') }}
+            type=raw,value=rc,enable=${{ !contains(needs.init.outputs.version, 'd') }}
+            type=raw,value=stable,enable=${{ !contains(needs.init.outputs.version, 'd') && !contains(needs.init.outputs.version, 'b') }}
+            type=raw,value=latest,enable=${{ !contains(needs.init.outputs.version, 'd') && !contains(needs.init.outputs.version, 'b') }}
+            type=semver,pattern={{major}}.{{minor}},value=${{ needs.init.outputs.version }},enable=${{ !contains(needs.init.outputs.version, 'd') && !contains(needs.init.outputs.version, 'b') }}

-            docker manifest create "${registry}/home-assistant:${tag_l}" \
-              "${registry}/amd64-homeassistant:${tag_r}" \
-              "${registry}/i386-homeassistant:${tag_r}" \
-              "${registry}/armhf-homeassistant:${tag_r}" \
-              "${registry}/armv7-homeassistant:${tag_r}" \
-              "${registry}/aarch64-homeassistant:${tag_r}"
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v3.7.1

-            docker manifest annotate "${registry}/home-assistant:${tag_l}" \
-              "${registry}/amd64-homeassistant:${tag_r}" \
-              --os linux --arch amd64
+      - name: Copy architecture images to DockerHub
+        if: matrix.registry == 'docker.io/homeassistant'
+        shell: bash
+        env:
+          ARCHITECTURES: ${{ needs.init.outputs.architectures }}
+          VERSION: ${{ needs.init.outputs.version }}
+        run: |
+          # Use imagetools to copy image blobs directly between registries
+          # This preserves provenance/attestations and seems to be much faster than pull/push
+          ARCHS=$(echo "${ARCHITECTURES}" | jq -r '.[]')
+          for arch in $ARCHS; do
+            echo "Copying ${arch} image to DockerHub..."
+            for attempt in 1 2 3; do
+              if docker buildx imagetools create \
+                --tag "docker.io/homeassistant/${arch}-homeassistant:${VERSION}" \
+                "ghcr.io/home-assistant/${arch}-homeassistant:${VERSION}"; then
+                break
+              fi
+              echo "Attempt ${attempt} failed, retrying in 10 seconds..."
+              sleep 10
+              if [ "${attempt}" -eq 3 ]; then
+                echo "Failed after 3 attempts"
+                exit 1
+              fi
+            done
+            cosign sign --yes "docker.io/homeassistant/${arch}-homeassistant:${VERSION}"
+          done

-            docker manifest annotate "${registry}/home-assistant:${tag_l}" \
-              "${registry}/i386-homeassistant:${tag_r}" \
-              --os linux --arch 386
+      - name: Create and push multi-arch manifests
+        shell: bash
+        env:
+          ARCHITECTURES: ${{ needs.init.outputs.architectures }}
+          REGISTRY: ${{ matrix.registry }}
+          VERSION: ${{ needs.init.outputs.version }}
+          META_TAGS: ${{ steps.meta.outputs.tags }}
+        run: |
+          # Build list of architecture images dynamically
+          ARCHS=$(echo "${ARCHITECTURES}" | jq -r '.[]')
+          ARCH_IMAGES=()
+          for arch in $ARCHS; do
+            ARCH_IMAGES+=("${REGISTRY}/${arch}-homeassistant:${VERSION}")
+          done

-            docker manifest annotate "${registry}/home-assistant:${tag_l}" \
-              "${registry}/armhf-homeassistant:${tag_r}" \
-              --os linux --arch arm --variant=v6
+          # Build list of all tags for single manifest creation
+          # Note: Using sep-tags=',' in metadata-action for easier parsing
+          TAG_ARGS=()
+          IFS=',' read -ra TAGS <<< "${META_TAGS}"
+          for tag in "${TAGS[@]}"; do
+            TAG_ARGS+=("--tag" "${tag}")
+          done

-            docker manifest annotate "${registry}/home-assistant:${tag_l}" \
-              "${registry}/armv7-homeassistant:${tag_r}" \
-              --os linux --arch arm --variant=v7
+          # Create manifest with ALL tags in a single operation (much faster!)
+          echo "Creating multi-arch manifest with tags: ${TAGS[*]}"
+          docker buildx imagetools create "${TAG_ARGS[@]}" "${ARCH_IMAGES[@]}"

-            docker manifest annotate "${registry}/home-assistant:${tag_l}" \
-              "${registry}/aarch64-homeassistant:${tag_r}" \
-              --os linux --arch arm64 --variant=v8
+          # Sign each tag separately (signing requires individual tag names)
+          echo "Signing all tags..."
+          for tag in "${TAGS[@]}"; do
+            echo "Signing ${tag}"
+            cosign sign --yes "${tag}"
+          done

-            docker manifest push --purge "${registry}/home-assistant:${tag_l}"
-            cosign sign --yes "${registry}/home-assistant:${tag_l}"
-          }
-
-          function validate_image() {
-            local image=${1}
-            if ! cosign verify --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp https://github.com/home-assistant/core/.* "${image}"; then
-              echo "Invalid signature!"
-              exit 1
-            fi
-          }
-
-          function push_dockerhub() {
-            local image=${1}
-            local tag=${2}
-
-            docker tag "ghcr.io/home-assistant/${image}:${tag}" "docker.io/homeassistant/${image}:${tag}"
-            docker push "docker.io/homeassistant/${image}:${tag}"
-            cosign sign --yes "docker.io/homeassistant/${image}:${tag}"
-          }
-
-          # Pull images from github container registry and verify signature
-          docker pull "ghcr.io/home-assistant/amd64-homeassistant:${{ needs.init.outputs.version }}"
-          docker pull "ghcr.io/home-assistant/i386-homeassistant:${{ needs.init.outputs.version }}"
-          docker pull "ghcr.io/home-assistant/armhf-homeassistant:${{ needs.init.outputs.version }}"
-          docker pull "ghcr.io/home-assistant/armv7-homeassistant:${{ needs.init.outputs.version }}"
-          docker pull "ghcr.io/home-assistant/aarch64-homeassistant:${{ needs.init.outputs.version }}"
-
-          validate_image "ghcr.io/home-assistant/amd64-homeassistant:${{ needs.init.outputs.version }}"
-          validate_image "ghcr.io/home-assistant/i386-homeassistant:${{ needs.init.outputs.version }}"
-          validate_image "ghcr.io/home-assistant/armhf-homeassistant:${{ needs.init.outputs.version }}"
-          validate_image "ghcr.io/home-assistant/armv7-homeassistant:${{ needs.init.outputs.version }}"
-          validate_image "ghcr.io/home-assistant/aarch64-homeassistant:${{ needs.init.outputs.version }}"
-
-          if [[ "${{ matrix.registry }}" ==  "docker.io/homeassistant" ]]; then
-            # Upload images to dockerhub
-            push_dockerhub "amd64-homeassistant" "${{ needs.init.outputs.version }}"
-            push_dockerhub "i386-homeassistant" "${{ needs.init.outputs.version }}"
-            push_dockerhub "armhf-homeassistant" "${{ needs.init.outputs.version }}"
-            push_dockerhub "armv7-homeassistant" "${{ needs.init.outputs.version }}"
-            push_dockerhub "aarch64-homeassistant" "${{ needs.init.outputs.version }}"
-          fi
-
-          # Create version tag
-          create_manifest "${{ needs.init.outputs.version }}" "${{ needs.init.outputs.version }}"
-
-          # Create general tags
-          if [[ "${{ needs.init.outputs.version }}" =~ d ]]; then
-            create_manifest "dev" "${{ needs.init.outputs.version }}"
-          elif [[ "${{ needs.init.outputs.version }}" =~ b ]]; then
-            create_manifest "beta" "${{ needs.init.outputs.version }}"
-            create_manifest "rc" "${{ needs.init.outputs.version }}"
-          else
-            create_manifest "stable" "${{ needs.init.outputs.version }}"
-            create_manifest "latest" "${{ needs.init.outputs.version }}"
-            create_manifest "beta" "${{ needs.init.outputs.version }}"
-            create_manifest "rc" "${{ needs.init.outputs.version }}"
-
-            # Create series version tag (e.g. 2021.6)
-            v="${{ needs.init.outputs.version }}"
-            create_manifest "${v%.*}" "${{ needs.init.outputs.version }}"
-          fi
+          echo "All manifests created and signed successfully"

  build_python:
    name: Build PyPi package
@@ -451,20 +466,22 @@ jobs:
    needs: ["init", "build_base"]
    runs-on: ubuntu-latest
    permissions:
-      contents: read
-      id-token: write
+      contents: read # To check out the repository
+      id-token: write # For PyPI trusted publishing
    if: github.repository_owner == 'home-assistant' && needs.init.outputs.publish == 'true'
    steps:
      - name: Checkout the repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-
-      - name: Set up Python ${{ env.DEFAULT_PYTHON }}
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
-          python-version: ${{ env.DEFAULT_PYTHON }}
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version-file: ".python-version"

      - name: Download translations
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: translations

@@ -482,7 +499,7 @@ jobs:
          python -m build

      - name: Upload package to PyPI
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
        with:
          skip-existing: true

@@ -490,10 +507,10 @@ jobs:
    name: Build and test hassfest image
    runs-on: ubuntu-latest
    permissions:
-      contents: read
-      packages: write
-      attestations: write
-      id-token: write
+      contents: read # To check out the repository
+      packages: write # To push to GHCR
+      attestations: write # For build provenance attestation
+      id-token: write # For build provenance attestation
    needs: ["init"]
    if: github.repository_owner == 'home-assistant'
    env:
@@ -501,17 +518,19 @@ jobs:
      HASSFEST_IMAGE_TAG: ghcr.io/home-assistant/hassfest:${{ needs.init.outputs.version }}
    steps:
      - name: Checkout repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build Docker image
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: . # So action will not pull the repository again
          file: ./script/hassfest/docker/Dockerfile
@@ -519,12 +538,12 @@ jobs:
          tags: ${{ env.HASSFEST_IMAGE_TAG }}

      - name: Run hassfest against core
-        run: docker run --rm -v ${{ github.workspace }}:/github/workspace ${{ env.HASSFEST_IMAGE_TAG }} --core-path=/github/workspace
+        run: docker run --rm -v "${GITHUB_WORKSPACE}":/github/workspace "${HASSFEST_IMAGE_TAG}" --core-path=/github/workspace

      - name: Push Docker image
        if: needs.init.outputs.channel != 'dev' && needs.init.outputs.publish == 'true'
        id: push
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: . # So action will not pull the repository again
          file: ./script/hassfest/docker/Dockerfile
@@ -533,7 +552,7 @@ jobs:

      - name: Generate artifact attestation
        if: needs.init.outputs.channel != 'dev' && needs.init.outputs.publish == 'true'
-        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
        with:
          subject-name: ${{ env.HASSFEST_IMAGE_NAME }}
          subject-digest: ${{ steps.push.outputs.digest }}
@@ -0,0 +1,74 @@
+name: Check requirements (deterministic)
+
+# Stage 1 of the Check requirements pipeline.
+#
+# Runs the deterministic Python checks and uploads the structured
+# results as an artifact. Stage 2 (the agentic workflow defined in
+# `check-requirements.md`) consumes the artifact on completion.
+
+# yamllint disable-line rule:truthy
+on:
+  # Auto-trigger on PRs that touch tracked requirement files is disabled
+  # for now while we iterate — testing the workflow_run handoff to the
+  # agentic stage is hard with an auto-trigger. Re-enable once the chain
+  # has been validated end-to-end.
+  # pull_request:
+  #   types: [opened, synchronize, reopened]
+  #   paths:
+  #     - "**/requirements*.txt"
+  #     - "homeassistant/package_constraints.txt"
+  workflow_dispatch:
+    inputs:
+      pull_request_number:
+        description: "Pull request number to (re-)check"
+        required: true
+        type: number
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ inputs.pull_request_number || github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  deterministic:
+    name: Run deterministic requirement checks
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      pull-requests: read # To fetch the PR diff via gh CLI
+    timeout-minutes: 10
+    steps:
+      - name: Check out code from GitHub
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version-file: ".python-version"
+          check-latest: true
+      - name: Install script dependencies
+        run: pip install -r script/check_requirements/requirements.txt
+      - name: Collect PR diff
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ inputs.pull_request_number || github.event.pull_request.number }}
+        run: |
+          mkdir -p deterministic
+          gh pr diff "${PR_NUMBER}" > deterministic/pr.diff
+      - name: Run deterministic checks
+        env:
+          PR_NUMBER: ${{ inputs.pull_request_number || github.event.pull_request.number }}
+        run: |
+          python -m script.check_requirements \
+            --pr-number "${PR_NUMBER}" \
+            --diff deterministic/pr.diff \
+            --output deterministic/results.json
+      - name: Upload deterministic-results artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: check-requirements-deterministic
+          path: deterministic/results.json
+          if-no-files-found: error
+          retention-days: 7
@@ -0,0 +1,378 @@
+---
+on:
+  workflow_run:
+    workflows: ["Check requirements (deterministic)"]
+    types: [completed]
+permissions:
+  contents: read
+  actions: read
+  issues: read
+  pull-requests: read
+network:
+  allowed:
+    - python
+tools:
+  web-fetch: {}
+  github:
+    toolsets: [default, actions]
+    min-integrity: unapproved
+safe-outputs:
+  add-comment:
+    max: 1
+    target: "${{ needs.extract_pr_number.outputs.pr_number }}"
+  needs:
+    - extract_pr_number
+jobs:
+  extract_pr_number:
+    if: github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+    outputs:
+      pr_number: ${{ steps.extract.outputs.pr_number }}
+    steps:
+      - name: Download deterministic-results artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: check-requirements-deterministic
+          path: /tmp/deterministic
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Extract PR number from artifact
+        id: extract
+        run: |
+          PR=$(jq -r '.pr_number' /tmp/deterministic/results.json)
+          echo "pr_number=${PR}" >> "${GITHUB_OUTPUT}"
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.workflow_run.head_sha }}
+  cancel-in-progress: true
+steps:
+  - name: Download deterministic-results artifact
+    if: github.event.workflow_run.conclusion == 'success'
+    uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+    with:
+      name: check-requirements-deterministic
+      path: /tmp/gh-aw/deterministic
+      run-id: ${{ github.event.workflow_run.id }}
+      github-token: ${{ secrets.GITHUB_TOKEN }}
+post-steps:
+  - name: Verify agent produced an add_comment safe-output
+    if: always() && github.event.workflow_run.conclusion == 'success'
+    run: |
+      OUTPUT=/tmp/gh-aw/agent_output.json
+      if [ ! -f "${OUTPUT}" ]; then
+        echo "::error::Agent output file ${OUTPUT} is missing; the agent did not run to completion."
+        exit 1
+      fi
+      if ! grep -q '"add_comment"' "${OUTPUT}"; then
+        echo "::error::Agent did not emit an add_comment safe-output; no review comment was posted to the PR."
+        echo "Agent output:"
+        cat "${OUTPUT}"
+        exit 1
+      fi
+description: >
+  Resolves the deterministic-stage artifact's NEEDS_AGENT checks for changed
+  Python package requirements on PRs targeting the core repo, then posts the
+  final review comment. Triggered by completion of the deterministic workflow.
+  Reads the uploaded artifact from disk, replaces placeholders for any check
+  whose status is `needs_agent`, and posts the merged comment using the PR
+  number recorded inside the artifact itself. Each check kind has a dedicated
+  instruction section below; if the artifact contains a check kind that does
+  not have a section here, the agent fails hard rather than guess.
+---
+
+# Check requirements (AW)
+
+You are a code review assistant for the Home Assistant project. The
+deterministic stage has already evaluated every check it can on its own
+and produced an artifact containing the PR number, per-package check
+results, and a pre-rendered comment with placeholders. **Your only job is
+to read that artifact, resolve any `needs_agent` checks, and post the
+final comment.**
+
+## Step 1 — Read the deterministic-stage artifact
+
+The deterministic stage uploaded its results to the runner at
+`/tmp/gh-aw/deterministic/results.json`.
+
+The JSON has this shape:
+
+- `pr_number` — the PR being checked. The `add_comment` safe-output is
+  already targeted at this PR (a pre-job extracts `pr_number` from the
+  artifact and the workflow wires it into the safe-output config via
+  `needs.extract_pr_number.outputs.pr_number`), so **you do not need to
+  set `item_number` yourself** — just emit `add_comment` with the
+  rendered body.
+- `needs_agent` — `true` iff any package's check needs resolution.
+- `packages[]` — one entry per changed package. Each entry has:
+  - `name`, `old_version` (`null` for a newly added package; otherwise the
+    previous pin), `new_version`, `repo_url`, `publisher_kind`.
+  - `checks` — a dict keyed by **check kind** (string). Each value has a
+    `status` (`pass`, `warn`, `fail`, or `needs_agent`) and `details`.
+- `rendered_comment` — the final PR comment body, already rendered. For
+  every check whose status is `needs_agent` it contains two placeholders
+  you must replace:
+  - `{{CHECK_CELL:<pkg-name>:<check-kind>}}` — one cell of the summary
+    table. Replace with exactly one of `✅`, `⚠️`, `❌`.
+  - `{{CHECK_DETAIL:<pkg-name>:<check-kind>}}` — the body of one bullet
+    in the package's `<details>` block. Replace with
+    `<icon> <one-line explanation>` (the bullet's leading
+    `- **<label>**:` is already rendered — replace only the placeholder).
+
+You **must not** modify any other content in `rendered_comment`. Do not
+re-evaluate checks that already have a deterministic status. Do not add
+or remove packages.
+
+## Step 2 — Resolve each `needs_agent` check
+
+For each `package` in `packages`:
+
+For each `(check_kind, result)` in `package.checks` where
+`result.status == "needs_agent"`:
+
+1. Look up `## Check kind: <check_kind>` in the **Check instructions**
+   section below.
+2. **If no matching section exists**: emit a single `add_comment` whose
+   body is:
+
+   ```
+   <!-- requirements-check -->
+   ## Check requirements
+
+   ❌ Internal error: the deterministic artifact contains a check kind
+   (`<check_kind>` on package `<pkg-name>`) that this workflow has no
+   instructions for. Update `.github/workflows/check-requirements.md`
+   to add a matching `## Check kind: <check_kind>` section, or remove
+   the kind from the deterministic stage.
+   ```
+
+   Then stop. **Do not improvise** a verdict for an unknown check kind.
+3. Otherwise, follow the instructions in that section. They tell you
+   which icon (✅/⚠️/❌) and one-line explanation to produce.
+
+## Step 3 — Post the comment
+
+1. Replace every `{{CHECK_CELL:…}}` and `{{CHECK_DETAIL:…}}` placeholder
+   in `rendered_comment` with the resolved value.
+2. Emit the resulting markdown using `add_comment` — set `body` to the
+   merged `rendered_comment` verbatim (the leading
+   `<!-- requirements-check -->` marker must be preserved). The PR
+   target is already set by the workflow; do not pass `item_number`.
+
+If the artifact's top-level `needs_agent` is `false` (no checks need
+you), emit `rendered_comment` unchanged.
+
+## Check instructions
+
+### Check kind: `repo_public`
+
+Verify that the package's source repository is publicly reachable.
+
+1. Read `package.repo_url`.
+2. Use the `web-fetch` tool to GET that URL.
+3. Decide the verdict:
+   - HTTP 200, returns a public repository page → ✅
+     `<repo_url> is publicly accessible.`
+   - HTTP 4xx/5xx, or the response redirects to a login / sign-in page →
+     ❌ `Source repository at <repo_url> is not publicly accessible.
+     Home Assistant requires all dependencies to have publicly available
+     source code.`
+   - Any other inconclusive result → ⚠️ with a one-line description.
+
+If `repo_public` resolves to ❌ for a package, **also** mark that
+package's `release_pipeline` and `async_blocking` cells/details as `—`
+(em dash) and explain `Skipped because the source repository is not
+publicly accessible.` — neither check can be performed without a public
+repo.
+
+### Check kind: `pr_link`
+
+Verify the PR description contains the right link for the change.
+
+1. Fetch the PR body via the GitHub MCP tool, using the `pr_number`
+   field from the artifact.
+2. Extract all URLs from the body.
+3. For a **new package** (`package.old_version` is `null`):
+   - The PR body must contain a URL that points at `package.repo_url`
+     (any sub-path of the same `owner/repo` on the same host is
+     acceptable). A PyPI link is **not** sufficient.
+   - ✅ if such a URL is present.
+   - ❌ otherwise:
+     `PR description must link to the source repository at <repo_url>.
+     A PyPI page link is not sufficient.`
+4. For a **version bump** (`package.old_version` is not `null`):
+   - The PR body must contain a URL on the same host as
+     `package.repo_url` that references **both** `package.old_version`
+     and `package.new_version` (e.g. a GitHub compare URL
+     `compare/vX...vY`, a release / changelog URL containing both
+     versions, etc.).
+   - ✅ if such a URL is present and the versions match the actual bump.
+   - ❌ otherwise:
+     `PR description should link to a changelog or compare URL on
+     <repo_url> that mentions both <old_version> and <new_version>.`
+
+### Check kind: `release_pipeline`
+
+Inspect the upstream project's release / publish CI pipeline.
+
+For each package needing inspection, determine the source repository
+host from `package.repo_url`, then apply the corresponding checklist.
+
+#### GitHub repositories (`github.com`)
+
+1. List workflows: `GET /repos/{owner}/{repo}/actions/workflows`.
+2. Identify any workflow whose name or filename suggests publishing to
+   PyPI (`release`, `publish`, `pypi`, or `deploy`).
+3. Fetch the workflow file and check:
+   - **Trigger sanity**: triggered by `push` to tags,
+     `release: published`, or `workflow_run` on a release job —
+     **not** solely `workflow_dispatch` with no environment-protection
+     guard.
+   - **OIDC / Trusted Publisher**: look for `id-token: write` and one of
+     `pypa/gh-action-pypi-publish`, `actions/attest-build-provenance`,
+     or `TWINE_PASSWORD` from a static `secrets.PYPI_TOKEN`.
+   - **No manual upload bypass**: no ungated `twine upload` or
+     `pip upload`.
+4. Verdict:
+   - ✅ if OIDC + sane triggers + no bypass.
+   - ⚠️ if static token but version bump, or details unclear.
+   - ❌ if static token on a new package, or only-manual triggers with
+     no environment protection.
+
+#### GitLab repositories (`gitlab.com` or self-hosted GitLab)
+
+1. Resolve the project ID via
+   `GET https://gitlab.com/api/v4/projects/{url-encoded-namespace-and-name}`.
+2. Fetch `.gitlab-ci.yml` via
+   `GET https://gitlab.com/api/v4/projects/{id}/repository/files/.gitlab-ci.yml/raw?ref=HEAD`.
+3. Apply the same conceptual checks: tag-only / protected-branch
+   triggers, GitLab OIDC `id_tokens` or CI/CD protected `PYPI_TOKEN`, no
+   ungated `twine upload`. Same verdict rules as GitHub.
+
+#### Other code hosting providers (Bitbucket, Codeberg, Gitea, Sourcehut, …)
+
+1. Use `web-fetch` to retrieve any visible CI configuration
+   (`.circleci/config.yml`, `Jenkinsfile`, `azure-pipelines.yml`,
+   `bitbucket-pipelines.yml`, `.builds/*.yml`).
+2. Apply the conceptual checks: automated triggers, CI-injected
+   credentials, no manual `twine upload`.
+3. If no CI config can be retrieved: ⚠️ `Release pipeline could not be
+   inspected; hosting provider is not GitHub or GitLab.`
+
+### Check kind: `async_blocking`
+
+Verify whether the dependency performs blocking I/O inside async code
+paths. Home Assistant runs on a single asyncio event loop, so a library
+that exposes an `async` surface must not call blocking APIs from inside
+its `async def` functions — that stalls the whole loop. A purely sync
+library is fine: Home Assistant integrations are expected to wrap such
+calls in an executor.
+
+**Two modes — pick by inspecting `package.old_version`:**
+
+- `old_version` is `null` → **new package**: review the *entire current
+  source tree*. Nothing about this dependency has been vetted before.
+- `old_version` is a string → **version bump**: review only the *diff
+  between `old_version` and `new_version`*. The previous version was
+  already accepted, so blocking calls that were present in
+  `old_version` are not regressions; report only what `new_version`
+  introduces.
+
+#### Step 1 — Decide whether the library exposes an async surface
+
+Use the `github` MCP tool (for `github.com` repos) or `web-fetch`
+(other hosts) on `package.repo_url`. Always inspect the tag /
+ref matching `new_version` (e.g. `v{new_version}` or `{new_version}`).
+
+- Locate the top-level package directory (usually named after the
+  import name, often equal or close to `package.name`).
+- Check `pyproject.toml` / `setup.py` / `setup.cfg` / `README*` for
+  async indicators (`Framework :: AsyncIO` trove classifier, `asyncio`
+  / `aiohttp` / `httpx` / `anyio` in dependencies, an async usage
+  example in the README).
+- Grep the package source for `async def`. A handful of `async def`
+  entries in the public modules is enough to treat the library as
+  having an async surface.
+
+If the library is **sync-only** (no `async def` in its public modules
+and no async framework dependency) → ✅
+`Sync-only library; Home Assistant integrations must wrap calls in an
+executor.` *This verdict is the same in both modes.*
+
+#### Step 2a — Mode: new package (`old_version` is `null`)
+
+Inspect **every `async def` in the public modules** for blocking
+patterns. Walk transitively into helpers the async functions call.
+
+#### Step 2b — Mode: version bump (`old_version` is a string)
+
+Fetch the diff between the two tags and review **only changed lines**:
+
+- GitHub: `GET /repos/{owner}/{repo}/compare/{old_tag}...{new_tag}` via
+  the `github` MCP tool, or
+  `https://github.com/{owner}/{repo}/compare/{old_tag}...{new_tag}.diff`
+  via `web-fetch`. Try the common tag formats in order until one
+  resolves: `v{version}`, `{version}`, `release-{version}`.
+- GitLab: `https://gitlab.com/{namespace}/{project}/-/compare/{old_tag}...{new_tag}.diff`.
+- Other hosts: use the project's equivalent compare URL via
+  `web-fetch`.
+
+If neither tag format resolves on the host, fall back to a full review
+(Step 2a) and mention in the detail that the diff was unavailable.
+
+When reviewing the diff, only flag blocking patterns that appear in
+**added lines** *inside or reachable from* an `async def`. A blocking
+call that existed in `old_version` and is unchanged is not a regression
+for this bump.
+
+#### Step 3 — Blocking patterns to look for
+
+In both modes, the patterns to flag inside `async def` bodies are:
+
+- Sync HTTP: `requests.`, `urllib.request`, `urllib3.` direct use,
+  `http.client.`, sync `httpx.Client(` / `httpx.get(` (NOT the
+  `AsyncClient`), `pycurl`.
+- `time.sleep(` (must be `await asyncio.sleep(`).
+- Sync sockets: bare `socket.socket` reads/writes, `ssl.wrap_socket`,
+  blocking `select.select`.
+- File I/O: `open(` / `pathlib.Path.read_*` / `.write_*` for
+  non-trivial sizes (small one-shot reads during import are
+  acceptable; reads/writes on the request path are not — prefer
+  `aiofiles` / executor).
+- Sync DB drivers used directly: `sqlite3`, `psycopg2`, `pymysql`,
+  `pymongo` (sync client), `redis.Redis` (sync client).
+- `subprocess.run` / `subprocess.call` / `os.system` (must be
+  `asyncio.create_subprocess_*`).
+
+A call that is clearly dispatched to an executor
+(`run_in_executor`, `asyncio.to_thread`, `anyio.to_thread.run_sync`)
+does NOT count as blocking.
+
+#### Step 4 — Verdict
+
+- ✅ — no offending blocking pattern in the surface being reviewed
+  (whole tree for a new package, added lines for a bump). For a bump,
+  phrase the detail as `No new blocking calls introduced in
+  {old_version} → {new_version}.`.
+- ⚠️ — blocking calls exist only in sync helpers that the async API
+  does not call, or only on a clearly non-hot path (e.g. one-shot
+  setup before the event loop is running). Cite at least one
+  `<file>:<line>` and explain why it is not on the hot path.
+- ❌ — a blocking call is reachable from an `async def` that is part
+  of the public API on the request / polling path (for a bump: the
+  call was introduced or moved onto the hot path by this version).
+  Cite the offending `<file>:<line>` as a clickable link on the repo
+  host so the contributor can jump to it.
+
+## Notes
+
+- Be constructive and helpful. Reference the inspected workflow / CI
+  file by URL where useful so the contributor can fix the issue.
+- The dedup of the requirements-check comment is handled by gh-aw's
+  `add_comment` safe-output via the `<!-- requirements-check -->`
+  marker on the first line of `rendered_comment`.
+- If the deterministic workflow concluded with a non-success status,
+  this workflow's `if:` guard on `Download deterministic-results
+  artifact` skipped the download. If you find no file at
+  `/tmp/gh-aw/deterministic/results.json`, emit nothing — the post-step
+  verification is also gated and will not complain.
@@ -5,6 +5,8 @@ on:
  schedule:
    - cron: "30 18 * * 4"

+permissions: {}
+
 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
@@ -15,20 +17,22 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 360
    permissions:
-      actions: read
-      contents: read
-      security-events: write
+      actions: read # To read workflow information for CodeQL
+      contents: read # To check out the repository
+      security-events: write # To upload CodeQL results

    steps:
      - name: Check out code from GitHub
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false

      - name: Initialize CodeQL
-        uses: github/codeql-action/init@16140ae1a102900babc80a33c44059580f687047 # v4.30.9
+        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
        with:
          languages: python

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@16140ae1a102900babc80a33c44059580f687047 # v4.30.9
+        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
        with:
          category: "/language:python"
@@ -5,18 +5,23 @@ on:
  issues:
    types: [labeled]

-permissions:
-  issues: write
-  models: read
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.issue.number }}

 jobs:
  detect-duplicates:
+    name: Detect duplicate issues
    runs-on: ubuntu-latest
+    permissions:
+      issues: write # To comment on and label issues
+      models: read # For AI-based duplicate detection

    steps:
      - name: Check if integration label was added and extract details
        id: extract
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            // Debug: Log the event payload
@@ -113,7 +118,7 @@ jobs:
      - name: Fetch similar issues
        id: fetch_similar
        if: steps.extract.outputs.should_continue == 'true'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          INTEGRATION_LABELS: ${{ steps.extract.outputs.integration_labels }}
          CURRENT_NUMBER: ${{ steps.extract.outputs.current_number }}
@@ -231,7 +236,7 @@ jobs:
      - name: Detect duplicates using AI
        id: ai_detection
        if: steps.extract.outputs.should_continue == 'true' && steps.fetch_similar.outputs.has_similar == 'true'
-        uses: actions/ai-inference@a1c11829223a786afe3b5663db904a3aa1eac3a2 # v2.0.1
+        uses: actions/ai-inference@a7805884c80886efc241e94a5351df715968a0ad # v2.1.1
        with:
          model: openai/gpt-4o
          system-prompt: |
@@ -280,7 +285,7 @@ jobs:
      - name: Post duplicate detection results
        id: post_results
        if: steps.extract.outputs.should_continue == 'true' && steps.fetch_similar.outputs.has_similar == 'true'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          AI_RESPONSE: ${{ steps.ai_detection.outputs.response }}
          SIMILAR_ISSUES: ${{ steps.fetch_similar.outputs.similar_issues }}
@@ -5,18 +5,23 @@ on:
  issues:
    types: [opened]

-permissions:
-  issues: write
-  models: read
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.issue.number }}

 jobs:
  detect-language:
+    name: Detect non-English issues
    runs-on: ubuntu-latest
+    permissions:
+      issues: write # To comment on, label, and close issues
+      models: read # For AI-based language detection

    steps:
      - name: Check issue language
        id: detect_language
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          ISSUE_NUMBER: ${{ github.event.issue.number }}
          ISSUE_TITLE: ${{ github.event.issue.title }}
@@ -57,7 +62,7 @@ jobs:
      - name: Detect language using AI
        id: ai_language_detection
        if: steps.detect_language.outputs.should_continue == 'true'
-        uses: actions/ai-inference@a1c11829223a786afe3b5663db904a3aa1eac3a2 # v2.0.1
+        uses: actions/ai-inference@a7805884c80886efc241e94a5351df715968a0ad # v2.1.1
        with:
          model: openai/gpt-4o-mini
          system-prompt: |
@@ -90,7 +95,7 @@ jobs:

      - name: Process non-English issues
        if: steps.detect_language.outputs.should_continue == 'true'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          AI_RESPONSE: ${{ steps.ai_language_detection.outputs.response }}
          ISSUE_NUMBER: ${{ steps.detect_language.outputs.issue_number }}
@@ -5,12 +5,22 @@ on:
  schedule:
    - cron: "0 * * * *"

+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
 jobs:
  lock:
+    name: Lock inactive threads
    if: github.repository_owner == 'home-assistant'
    runs-on: ubuntu-latest
+    permissions:
+      issues: write # To lock issues
+      pull-requests: write # To lock pull requests
    steps:
-      - uses: dessant/lock-threads@1bf7ec25051fe7c00bdd17e6a7cf3d7bfb7dc771 # v5.0.1
+      - uses: dessant/lock-threads@89ae32b08ed1a541efecbab17912962a5e38981c # v6.0.2
        with:
          github-token: ${{ github.token }}
          issue-inactive-days: "30"
@@ -4,7 +4,7 @@
      "owner": "check-executables-have-shebangs",
      "pattern": [
        {
-          "regexp": "^(.+):\\s(.+)$",
+          "regexp": "^(.+):\\s(marked executable but has no \\(or invalid\\) shebang!.*)$",
          "file": 1,
          "message": 2
        }
@@ -5,14 +5,44 @@ on:
  issues:
    types: [opened]

+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.issue.number }}
+
 jobs:
-  check-authorization:
+  add-no-stale:
+    name: Add no-stale label
    runs-on: ubuntu-latest
+    permissions:
+      issues: write # To add labels to issues
+    if: >-
+      github.event.issue.type.name == 'Task'
+      || github.event.issue.type.name == 'Epic'
+      || github.event.issue.type.name == 'Opportunity'
+    steps:
+      - name: Add no-stale label
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            await github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              labels: ['no-stale']
+            });
+
+  check-authorization:
+    name: Check authorization
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read # To read CODEOWNERS file
+      issues: write # To comment on, label, and close issues
    # Only run if this is a Task issue type (from the issue form)
    if: github.event.issue.type.name == 'Task'
    steps:
      - name: Check if user is authorized
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const issueAuthor = context.payload.issue.user.login;
@@ -6,26 +6,50 @@ on:
    - cron: "0 * * * *"
  workflow_dispatch:

+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
 jobs:
  stale:
+    name: Mark stale issues and PRs
    if: github.repository_owner == 'home-assistant'
    runs-on: ubuntu-latest
+    permissions:
+      issues: write # To label and close stale issues
+      pull-requests: write # To label and close stale PRs
+      actions: write # To delete stalebot state
    steps:
+      # Generate a token for the GitHub App, we use this method to avoid
+      # hitting API limits for our GitHub actions + have a higher rate limit.
+      - name: Generate app token
+        id: token
+        # Pinned to a specific version of the action for security reasons
+        # v3.2.0
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ secrets.ISSUE_TRIAGE_APP_ID }} # zizmor: ignore[secrets-outside-env]
+          private-key: ${{ secrets.ISSUE_TRIAGE_APP_PEM }} # zizmor: ignore[secrets-outside-env]
+
      # The 60 day stale policy for PRs
      # Used for:
      # - PRs
      # - No PRs marked as no-stale
-      # - No issues (-1)
-      - name: 60 days stale PRs policy
-        uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
+      # The 90 day stale policy for issues
+      # Used for:
+      # - Issues
+      # - No issues marked as no-stale or help-wanted
+      - name: 60 days stale PRs policy and 90 days stale issue policy
+        uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
        with:
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-          days-before-stale: 60
-          days-before-close: 7
-          days-before-issue-stale: -1
-          days-before-issue-close: -1
-          operations-per-run: 150
+          repo-token: ${{ steps.token.outputs.token }}
          remove-stale-when-updated: true
+          operations-per-run: 350
+          # pr policy
+          days-before-pr-stale: 60
+          days-before-pr-close: 7
          stale-pr-label: "stale"
          exempt-pr-labels: "no-stale"
          stale-pr-message: >
@@ -38,65 +62,9 @@ jobs:
            branch to ensure that it's up to date with the latest changes.

            Thank you for your contribution!
-
-      # Generate a token for the GitHub App, we use this method to avoid
-      # hitting API limits for our GitHub actions + have a higher rate limit.
-      # This is only used for issues.
-      - name: Generate app token
-        id: token
-        # Pinned to a specific version of the action for security reasons
-        # v1.7.0
-        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
-        with:
-          app_id: ${{ secrets.ISSUE_TRIAGE_APP_ID }}
-          private_key: ${{ secrets.ISSUE_TRIAGE_APP_PEM }}
-
-      # The 90 day stale policy for issues
-      # Used for:
-      # - Issues
-      # - No issues marked as no-stale or help-wanted
-      # - No PRs (-1)
-      - name: 90 days stale issues
-        uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
-        with:
-          repo-token: ${{ steps.token.outputs.token }}
-          days-before-stale: 90
-          days-before-close: 7
-          days-before-pr-stale: -1
-          days-before-pr-close: -1
-          operations-per-run: 250
-          remove-stale-when-updated: true
-          stale-issue-label: "stale"
-          exempt-issue-labels: "no-stale,help-wanted,needs-more-information"
-          stale-issue-message: >
-            There hasn't been any activity on this issue recently. Due to the
-            high number of incoming GitHub notifications, we have to clean some
-            of the old issues, as many of them have already been resolved with
-            the latest updates.
-
-            Please make sure to update to the latest Home Assistant version and
-            check if that solves the issue. Let us know if that works for you by
-            adding a comment 👍
-
-            This issue has now been marked as stale and will be closed if no
-            further activity occurs. Thank you for your contributions.
-
-      # The 30 day stale policy for issues
-      # Used for:
-      # - Issues that are pending more information (incomplete issues)
-      # - No Issues marked as no-stale or help-wanted
-      # - No PRs (-1)
-      - name: Needs more information stale issues policy
-        uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
-        with:
-          repo-token: ${{ steps.token.outputs.token }}
-          only-labels: "needs-more-information"
-          days-before-stale: 14
-          days-before-close: 7
-          days-before-pr-stale: -1
-          days-before-pr-close: -1
-          operations-per-run: 250
-          remove-stale-when-updated: true
+          # issue policy
+          days-before-issue-stale: 90
+          days-before-issue-close: 7
          stale-issue-label: "stale"
          exempt-issue-labels: "no-stale,help-wanted"
          stale-issue-message: >
@@ -9,8 +9,11 @@ on:
    paths:
      - "**strings.json"

-env:
-  DEFAULT_PYTHON: "3.13"
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true

 jobs:
  upload:
@@ -19,14 +22,17 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout the repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-
-      - name: Set up Python ${{ env.DEFAULT_PYTHON }}
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
-          python-version: ${{ env.DEFAULT_PYTHON }}
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version-file: ".python-version"

      - name: Upload Translations
+        env:
+          LOKALISE_TOKEN: ${{ secrets.LOKALISE_TOKEN }} # zizmor: ignore[secrets-outside-env]
        run: |
-          export LOKALISE_TOKEN="${{ secrets.LOKALISE_TOKEN }}"
          python3 -m script.translations upload
@@ -16,8 +16,7 @@ on:
      - "requirements.txt"
      - "script/gen_requirements_all.py"

-env:
-  DEFAULT_PYTHON: "3.13"
+permissions: {}

 concurrency:
  group: ${{ github.workflow }}-${{ github.ref_name}}
@@ -28,18 +27,17 @@ jobs:
    name: Initialize wheels builder
    if: github.repository_owner == 'home-assistant'
    runs-on: ubuntu-latest
-    outputs:
-      architectures: ${{ steps.info.outputs.architectures }}
    steps:
-      - &checkout
-        name: Checkout the repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-
-      - name: Set up Python ${{ env.DEFAULT_PYTHON }}
-        id: python
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+      - name: Checkout the repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
-          python-version: ${{ env.DEFAULT_PYTHON }}
+          persist-credentials: false
+
+      - name: Set up Python
+        id: python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version-file: ".python-version"
          check-latest: true

      - name: Create Python virtual environment
@@ -50,13 +48,9 @@ jobs:
          pip install "$(grep '^uv' < requirements.txt)"
          uv pip install -r requirements.txt

-      - name: Get information
-        id: info
-        uses: home-assistant/actions/helpers/info@master
-
      - name: Create requirements_diff file
        run: |
-          if [[ ${{ github.event_name }} =~ (schedule|workflow_dispatch) ]]; then
+          if [[ "${GITHUB_EVENT_NAME}" =~ (schedule|workflow_dispatch) ]]; then
            touch requirements_diff.txt
          else
            curl -s -o requirements_diff.txt https://raw.githubusercontent.com/home-assistant/core/master/requirements.txt
@@ -77,37 +71,18 @@ jobs:

            # Use C-Extension for SQLAlchemy
            echo "REQUIRE_SQLALCHEMY_CEXT=1"
-
-            # Add additional pip wheel build constraints
-            echo "PIP_CONSTRAINT=build_constraints.txt"
          ) > .env_file

-      - name: Write pip wheel build constraints
-        run: |
-          (
-            # ninja 1.11.1.2 + 1.11.1.3 seem to be broken on at least armhf
-            # this caused the numpy builds to fail
-            # https://github.com/scikit-build/ninja-python-distributions/issues/274
-            echo "ninja==1.11.1.1"
-          ) > build_constraints.txt
-
      - name: Upload env_file
-        uses: &actions-upload-artifact actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: env_file
          path: ./.env_file
          include-hidden-files: true
          overwrite: true

-      - name: Upload build_constraints
-        uses: *actions-upload-artifact
-        with:
-          name: build_constraints
-          path: ./build_constraints.txt
-          overwrite: true
-
      - name: Upload requirements_diff
-        uses: *actions-upload-artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: requirements_diff
          path: ./requirements_diff.txt
@@ -119,7 +94,7 @@ jobs:
          python -m script.gen_requirements_all ci

      - name: Upload requirements_all_wheels
-        uses: *actions-upload-artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: requirements_all_wheels
          path: ./requirements_all_wheels_*.txt
@@ -131,38 +106,27 @@ jobs:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
-      matrix: &matrix-build
-        abi: ["cp313", "cp314"]
-        arch: ${{ fromJson(needs.init.outputs.architectures) }}
+      matrix:
+        abi: ["cp314"]
+        arch: ["amd64", "aarch64"]
        include:
-          - os: ubuntu-latest
+          - arch: amd64
+            os: ubuntu-latest
          - arch: aarch64
            os: ubuntu-24.04-arm
-        exclude:
-          - abi: cp314
-            arch: armv7
-          - abi: cp314
-            arch: armhf
-          - abi: cp314
-            arch: i386
    steps:
-      - *checkout
+      - name: Checkout the repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false

-      - &download-env-file
-        name: Download env_file
-        uses: &actions-download-artifact actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+      - name: Download env_file
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: env_file

-      - &download-build-constraints
-        name: Download build_constraints
-        uses: *actions-download-artifact
-        with:
-          name: build_constraints
-
-      - &download-requirements-diff
-        name: Download requirements_diff
-        uses: *actions-download-artifact
+      - name: Download requirements_diff
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: requirements_diff

@@ -172,14 +136,13 @@ jobs:
          sed -i "/uv/d" requirements.txt
          sed -i "/uv/d" requirements_diff.txt

-      # home-assistant/wheels doesn't support sha pinning
      - name: Build wheels
-        uses: &home-assistant-wheels home-assistant/wheels@2025.10.0
+        uses: home-assistant/wheels@34957438948e0b3dcde73c77750643dadae594f5 # 2026.06.0
        with:
          abi: ${{ matrix.abi }}
          tag: musllinux_1_2
          arch: ${{ matrix.arch }}
-          wheels-key: ${{ secrets.WHEELS_KEY }}
+          wheels-key: ${{ secrets.WHEELS_KEY }} # zizmor: ignore[secrets-outside-env]
          env-file: true
          apk: "libffi-dev;openssl-dev;yaml-dev;nasm;zlib-ng-dev"
          skip-binary: aiohttp;multidict;propcache;yarl;SQLAlchemy
@@ -194,42 +157,53 @@ jobs:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
-      matrix: *matrix-build
+      matrix:
+        abi: ["cp314"]
+        arch: ["amd64", "aarch64"]
+        include:
+          - arch: amd64
+            os: ubuntu-latest
+          - arch: aarch64
+            os: ubuntu-24.04-arm
    steps:
-      - *checkout
+      - name: Checkout the repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false

-      - *download-env-file
-      - *download-build-constraints
-      - *download-requirements-diff
+      - name: Download env_file
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: env_file
+
+      - name: Download requirements_diff
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: requirements_diff

      - name: Download requirements_all_wheels
-        uses: *actions-download-artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: requirements_all_wheels

      - name: Adjust build env
        run: |
-          if [ "${{ matrix.arch }}" = "i386" ]; then
-            echo "NPY_DISABLE_SVML=1" >> .env_file
-          fi
-
          # Do not pin numpy in wheels building
          sed -i "/numpy/d" homeassistant/package_constraints.txt
          # Don't build wheels for uv as uv requires a greater version of rust as currently available on alpine
          sed -i "/uv/d" requirements.txt
          sed -i "/uv/d" requirements_diff.txt

-      # home-assistant/wheels doesn't support sha pinning
      - name: Build wheels
-        uses: *home-assistant-wheels
+        uses: home-assistant/wheels@34957438948e0b3dcde73c77750643dadae594f5 # 2026.06.0
        with:
          abi: ${{ matrix.abi }}
          tag: musllinux_1_2
          arch: ${{ matrix.arch }}
-          wheels-key: ${{ secrets.WHEELS_KEY }}
+          wheels-key: ${{ secrets.WHEELS_KEY }} # zizmor: ignore[secrets-outside-env]
          env-file: true
-          apk: "bluez-dev;libffi-dev;openssl-dev;glib-dev;eudev-dev;libxml2-dev;libxslt-dev;libpng-dev;libjpeg-turbo-dev;tiff-dev;cups-dev;gmp-dev;mpfr-dev;mpc1-dev;ffmpeg-dev;gammu-dev;yaml-dev;openblas-dev;fftw-dev;lapack-dev;gfortran;blas-dev;eigen-dev;freetype-dev;glew-dev;harfbuzz-dev;hdf5-dev;libdc1394-dev;libtbb-dev;mesa-dev;openexr-dev;openjpeg-dev;uchardet-dev;nasm;zlib-ng-dev"
+          apk: "bluez-dev;libffi-dev;openssl-dev;glib-dev;eudev-dev;libxml2-dev;libxslt-dev;libpng-dev;libjpeg-turbo-dev;tiff-dev;gmp-dev;mpfr-dev;mpc1-dev;ffmpeg-dev;yaml-dev;openblas-dev;fftw-dev;lapack-dev;gfortran;blas-dev;eigen-dev;freetype-dev;glew-dev;harfbuzz-dev;hdf5-dev;libdc1394-dev;libtbb-dev;mesa-dev;openexr-dev;openjpeg-dev;uchardet-dev;nasm;zlib-ng-dev"
          skip-binary: aiohttp;charset-normalizer;grpcio;multidict;SQLAlchemy;propcache;protobuf;pymicro-vad;yarl
          constraints: "homeassistant/package_constraints.txt"
          requirements-diff: "requirements_diff.txt"
-          requirements: "requirements_all.txt"
+          requirements: "requirements_all_wheels_${{ matrix.arch }}.txt"
@@ -92,6 +92,7 @@ pip-selfcheck.json
 venv
 .venv
 Pipfile*
+uv.lock
 share/*
 /Scripts/

@@ -111,6 +112,7 @@ virtualization/vagrant/config
 !.vscode/cSpell.json
 !.vscode/extensions.json
 !.vscode/tasks.json
+!.vscode/settings.default.jsonc
 .env

 # Windows Explorer
@@ -140,4 +142,6 @@ pytest_buckets.txt

 # AI tooling
 .claude/settings.local.json
+.claude/worktrees/
+.serena/

@@ -1,6 +1,6 @@
 repos:
  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.13.0
+    rev: v0.15.15
    hooks:
      - id: ruff-check
        args:
@@ -8,7 +8,7 @@ repos:
      - id: ruff-format
        files: ^((homeassistant|pylint|script|tests)/.+)?[^/]+\.(py|pyi)$
  - repo: https://github.com/codespell-project/codespell
-    rev: v2.4.1
+    rev: v2.4.2
    hooks:
      - id: codespell
        args:
@@ -17,6 +17,13 @@ repos:
          - --quiet-level=2
        exclude_types: [csv, json, html]
        exclude: ^tests/fixtures/|homeassistant/generated/|tests/components/.*/snapshots/
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.24.1
+    hooks:
+      - id: zizmor
+        args:
+          - --pedantic
+        exclude: ^\.github/workflows/.*\.lock\.yml$
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v6.0.0
    hooks:
@@ -30,20 +37,24 @@ repos:
          - --branch=master
          - --branch=rc
  - repo: https://github.com/adrienverge/yamllint.git
-    rev: v1.37.1
+    rev: v1.38.0
    hooks:
      - id: yamllint
-  - repo: https://github.com/pre-commit/mirrors-prettier
-    rev: v3.0.3
+  - repo: https://github.com/rbubley/mirrors-prettier
+    rev: v3.6.2
    hooks:
      - id: prettier
+        additional_dependencies:
+          - prettier@3.6.2
+          - prettier-plugin-sort-json@4.2.0
+        exclude: ^\.github/workflows/.*\.lock\.yml$
  - repo: https://github.com/cdce8p/python-typing-update
    rev: v0.6.0
    hooks:
      # Run `python-typing-update` hook manually from time to time
      # to update python typing syntax.
      # Will require manual work, before submitting changes!
-      # pre-commit run --hook-stage manual python-typing-update --all-files
+      # prek run --hook-stage manual python-typing-update --all-files
      - id: python-typing-update
        stages: [manual]
        args:
@@ -78,20 +89,27 @@ repos:
        language: script
        types: [text]
        files: ^(homeassistant/.+/manifest\.json|homeassistant/brands/.+\.json|pyproject\.toml|\.pre-commit-config\.yaml|script/gen_requirements_all\.py)$
+      - id: gen_copilot_instructions
+        name: gen_copilot_instructions
+        entry: script/run-in-env.sh python3 -m script.gen_copilot_instructions
+        pass_filenames: false
+        language: script
+        types: [text]
+        files: ^(AGENTS\.md|\.claude/skills/(?!github-pr-reviewer/).+/SKILL\.md|\.github/copilot-instructions\.md|script/gen_copilot_instructions\.py)$
      - id: hassfest
        name: hassfest
        entry: script/run-in-env.sh python3 -m script.hassfest
        pass_filenames: false
        language: script
        types: [text]
-        files: ^(homeassistant/.+/(icons|manifest|strings)\.json|homeassistant/.+/(quality_scale)\.yaml|homeassistant/brands/.*\.json|homeassistant/.+/services\.yaml|script/hassfest/(?!metadata|mypy_config).+\.py|requirements.+\.txt)$
+        files: ^(homeassistant/.+/(icons|manifest|strings)\.json|homeassistant/.+/(conditions|quality_scale|services|triggers)\.yaml|homeassistant/brands/.*\.json|script/hassfest/(?!metadata|mypy_config).+\.py|requirements.+\.txt)$
      - id: hassfest-metadata
        name: hassfest-metadata
        entry: script/run-in-env.sh python3 -m script.hassfest -p metadata,docker
        pass_filenames: false
        language: script
        types: [text]
-        files: ^(script/hassfest/metadata\.py|homeassistant/const\.py$|pyproject\.toml|homeassistant/components/go2rtc/const\.py)$
+        files: ^(script/hassfest/(metadata|docker)\.py|homeassistant/const\.py$|pyproject\.toml)$
      - id: hassfest-mypy-config
        name: hassfest-mypy-config
        entry: script/run-in-env.sh python3 -m script.hassfest -p mypy_config
@@ -0,0 +1,24 @@
+/** @type {import("prettier").Config} */
+module.exports = {
+  overrides: [
+    {
+      files: "./homeassistant/**/*.json",
+      options: {
+        plugins: [require.resolve("prettier-plugin-sort-json")],
+        jsonRecursiveSort: true,
+        jsonSortOrder: JSON.stringify({ [/.*/]: "numeric" }),
+      },
+    },
+    {
+      files: ["manifest.json", "./**/brands/*.json"],
+      options: {
+        // domain and name should stay at the top
+        jsonSortOrder: JSON.stringify({
+          domain: null,
+          name: null,
+          [/.*/]: "numeric",
+        }),
+      },
+    },
+  ],
+};
@@ -1 +1 @@
-3.13
+3.14.5
@@ -46,13 +46,16 @@ homeassistant.components.accuweather.*
 homeassistant.components.acer_projector.*
 homeassistant.components.acmeda.*
 homeassistant.components.actiontec.*
+homeassistant.components.actron_air.*
 homeassistant.components.adax.*
 homeassistant.components.adguard.*
 homeassistant.components.aftership.*
+homeassistant.components.ai_task.*
 homeassistant.components.air_quality.*
 homeassistant.components.airgradient.*
 homeassistant.components.airly.*
 homeassistant.components.airnow.*
+homeassistant.components.airobot.*
 homeassistant.components.airos.*
 homeassistant.components.airq.*
 homeassistant.components.airthings.*
@@ -83,6 +86,7 @@ homeassistant.components.androidtv_remote.*
 homeassistant.components.anel_pwrctrl.*
 homeassistant.components.anova.*
 homeassistant.components.anthemav.*
+homeassistant.components.anthropic.*
 homeassistant.components.apache_kafka.*
 homeassistant.components.apcupsd.*
 homeassistant.components.api.*
@@ -107,6 +111,7 @@ homeassistant.components.automation.*
 homeassistant.components.awair.*
 homeassistant.components.axis.*
 homeassistant.components.azure_storage.*
+homeassistant.components.backblaze_b2.*
 homeassistant.components.backup.*
 homeassistant.components.baf.*
 homeassistant.components.bang_olufsen.*
@@ -119,8 +124,6 @@ homeassistant.components.blueprint.*
 homeassistant.components.bluesound.*
 homeassistant.components.bluetooth.*
 homeassistant.components.bluetooth_adapters.*
-homeassistant.components.bluetooth_tracker.*
-homeassistant.components.bmw_connected_drive.*
 homeassistant.components.bond.*
 homeassistant.components.bosch_alarm.*
 homeassistant.components.braviatv.*
@@ -128,12 +131,15 @@ homeassistant.components.bring.*
 homeassistant.components.brother.*
 homeassistant.components.browser.*
 homeassistant.components.bryant_evolution.*
+homeassistant.components.bsblan.*
 homeassistant.components.bthome.*
 homeassistant.components.button.*
 homeassistant.components.calendar.*
 homeassistant.components.cambridge_audio.*
 homeassistant.components.camera.*
 homeassistant.components.canary.*
+homeassistant.components.casper_glow.*
+homeassistant.components.centriconnect.*
 homeassistant.components.cert_expiry.*
 homeassistant.components.clickatell.*
 homeassistant.components.clicksend.*
@@ -150,6 +156,7 @@ homeassistant.components.counter.*
 homeassistant.components.cover.*
 homeassistant.components.cpuspeed.*
 homeassistant.components.crownstone.*
+homeassistant.components.data_grand_lyon.*
 homeassistant.components.date.*
 homeassistant.components.datetime.*
 homeassistant.components.deako.*
@@ -170,9 +177,11 @@ homeassistant.components.dnsip.*
 homeassistant.components.doorbird.*
 homeassistant.components.dormakaba_dkey.*
 homeassistant.components.downloader.*
+homeassistant.components.dropbox.*
 homeassistant.components.droplet.*
 homeassistant.components.dsmr.*
 homeassistant.components.duckdns.*
+homeassistant.components.duco.*
 homeassistant.components.dunehd.*
 homeassistant.components.duotecno.*
 homeassistant.components.easyenergy.*
@@ -187,6 +196,7 @@ homeassistant.components.elkm1.*
 homeassistant.components.emulated_hue.*
 homeassistant.components.energenie_power_sockets.*
 homeassistant.components.energy.*
+homeassistant.components.energyid.*
 homeassistant.components.energyzero.*
 homeassistant.components.enigma2.*
 homeassistant.components.enphase_envoy.*
@@ -206,7 +216,9 @@ homeassistant.components.firefly_iii.*
 homeassistant.components.fitbit.*
 homeassistant.components.flexit_bacnet.*
 homeassistant.components.flux_led.*
+homeassistant.components.folder_watcher.*
 homeassistant.components.forecast_solar.*
+homeassistant.components.freshr.*
 homeassistant.components.fritz.*
 homeassistant.components.fritzbox.*
 homeassistant.components.fritzbox_callmonitor.*
@@ -214,11 +226,13 @@ homeassistant.components.fronius.*
 homeassistant.components.frontend.*
 homeassistant.components.fujitsu_fglair.*
 homeassistant.components.fully_kiosk.*
+homeassistant.components.fumis.*
 homeassistant.components.fyta.*
 homeassistant.components.generic_hygrostat.*
 homeassistant.components.generic_thermostat.*
 homeassistant.components.geo_location.*
 homeassistant.components.geocaching.*
+homeassistant.components.ghost.*
 homeassistant.components.gios.*
 homeassistant.components.github.*
 homeassistant.components.glances.*
@@ -230,14 +244,17 @@ homeassistant.components.google_cloud.*
 homeassistant.components.google_drive.*
 homeassistant.components.google_photos.*
 homeassistant.components.google_sheets.*
+homeassistant.components.google_weather.*
 homeassistant.components.govee_ble.*
 homeassistant.components.gpsd.*
 homeassistant.components.greeneye_monitor.*
 homeassistant.components.group.*
 homeassistant.components.guardian.*
+homeassistant.components.guntamatic.*
 homeassistant.components.habitica.*
 homeassistant.components.hardkernel.*
 homeassistant.components.hardware.*
+homeassistant.components.hdfury.*
 homeassistant.components.heos.*
 homeassistant.components.here_travel_time.*
 homeassistant.components.history.*
@@ -263,12 +280,16 @@ homeassistant.components.homekit_controller.storage
 homeassistant.components.homekit_controller.utils
 homeassistant.components.homewizard.*
 homeassistant.components.homeworks.*
+homeassistant.components.hr_energy_qube.*
 homeassistant.components.http.*
 homeassistant.components.huawei_lte.*
 homeassistant.components.humidifier.*
 homeassistant.components.husqvarna_automower.*
+homeassistant.components.huum.*
+homeassistant.components.hvv_departures.*
 homeassistant.components.hydrawise.*
 homeassistant.components.hyperion.*
+homeassistant.components.hypontech.*
 homeassistant.components.ibeacon.*
 homeassistant.components.idasen_desk.*
 homeassistant.components.image.*
@@ -278,11 +299,14 @@ homeassistant.components.imap.*
 homeassistant.components.imgw_pib.*
 homeassistant.components.immich.*
 homeassistant.components.incomfort.*
+homeassistant.components.indevolt.*
 homeassistant.components.inels.*
+homeassistant.components.infrared.*
 homeassistant.components.input_button.*
 homeassistant.components.input_select.*
 homeassistant.components.input_text.*
 homeassistant.components.integration.*
+homeassistant.components.intelliclima.*
 homeassistant.components.intent.*
 homeassistant.components.intent_script.*
 homeassistant.components.ios.*
@@ -290,6 +314,7 @@ homeassistant.components.iotty.*
 homeassistant.components.ipp.*
 homeassistant.components.iqvia.*
 homeassistant.components.iron_os.*
+homeassistant.components.isal.*
 homeassistant.components.islamic_prayer_times.*
 homeassistant.components.isy994.*
 homeassistant.components.jellyfin.*
@@ -300,6 +325,7 @@ homeassistant.components.knocki.*
 homeassistant.components.knx.*
 homeassistant.components.kraken.*
 homeassistant.components.kulersky.*
+homeassistant.components.labs.*
 homeassistant.components.lacrosse.*
 homeassistant.components.lacrosse_view.*
 homeassistant.components.lamarzocco.*
@@ -311,8 +337,11 @@ homeassistant.components.ld2410_ble.*
 homeassistant.components.led_ble.*
 homeassistant.components.lektrico.*
 homeassistant.components.letpot.*
+homeassistant.components.lg_infrared.*
+homeassistant.components.lg_tv_rs232.*
 homeassistant.components.libre_hardware_monitor.*
 homeassistant.components.lidarr.*
+homeassistant.components.liebherr.*
 homeassistant.components.lifx.*
 homeassistant.components.light.*
 homeassistant.components.linkplay.*
@@ -328,8 +357,10 @@ homeassistant.components.lookin.*
 homeassistant.components.lovelace.*
 homeassistant.components.luftdaten.*
 homeassistant.components.lunatone.*
+homeassistant.components.lutron.*
 homeassistant.components.madvr.*
 homeassistant.components.manual.*
+homeassistant.components.marantz_infrared.*
 homeassistant.components.mastodon.*
 homeassistant.components.matrix.*
 homeassistant.components.matter.*
@@ -359,7 +390,7 @@ homeassistant.components.my.*
 homeassistant.components.mysensors.*
 homeassistant.components.myuplink.*
 homeassistant.components.nam.*
-homeassistant.components.nanoleaf.*
+homeassistant.components.namecheapdns.*
 homeassistant.components.nasweb.*
 homeassistant.components.neato.*
 homeassistant.components.nest.*
@@ -373,6 +404,7 @@ homeassistant.components.no_ip.*
 homeassistant.components.nordpool.*
 homeassistant.components.notify.*
 homeassistant.components.notion.*
+homeassistant.components.nrgkick.*
 homeassistant.components.ntfy.*
 homeassistant.components.number.*
 homeassistant.components.nut.*
@@ -380,11 +412,13 @@ homeassistant.components.ohme.*
 homeassistant.components.onboarding.*
 homeassistant.components.oncue.*
 homeassistant.components.onedrive.*
+homeassistant.components.onedrive_for_business.*
 homeassistant.components.onewire.*
 homeassistant.components.onkyo.*
 homeassistant.components.open_meteo.*
 homeassistant.components.open_router.*
 homeassistant.components.openai_conversation.*
+homeassistant.components.openevse.*
 homeassistant.components.openexchangerates.*
 homeassistant.components.opensky.*
 homeassistant.components.openuv.*
@@ -392,10 +426,13 @@ homeassistant.components.opnsense.*
 homeassistant.components.opower.*
 homeassistant.components.oralb.*
 homeassistant.components.otbr.*
+homeassistant.components.otp.*
+homeassistant.components.ouman_eh_800.*
 homeassistant.components.overkiz.*
 homeassistant.components.overseerr.*
+homeassistant.components.ovhcloud_ai_endpoints.*
 homeassistant.components.p1_monitor.*
-homeassistant.components.pandora.*
+homeassistant.components.paj_gps.*
 homeassistant.components.panel_custom.*
 homeassistant.components.paperless_ngx.*
 homeassistant.components.peblar.*
@@ -406,13 +443,16 @@ homeassistant.components.person.*
 homeassistant.components.pi_hole.*
 homeassistant.components.ping.*
 homeassistant.components.plugwise.*
+homeassistant.components.pooldose.*
 homeassistant.components.portainer.*
 homeassistant.components.powerfox.*
+homeassistant.components.powerfox_local.*
 homeassistant.components.powerwall.*
 homeassistant.components.private_ble_device.*
 homeassistant.components.prometheus.*
 homeassistant.components.proximity.*
 homeassistant.components.prusalink.*
+homeassistant.components.ptdevices.*
 homeassistant.components.pure_energie.*
 homeassistant.components.purpleair.*
 homeassistant.components.pushbullet.*
@@ -426,10 +466,13 @@ homeassistant.components.radarr.*
 homeassistant.components.radio_browser.*
 homeassistant.components.rainforest_raven.*
 homeassistant.components.rainmachine.*
+homeassistant.components.random.*
 homeassistant.components.raspberry_pi.*
 homeassistant.components.rdw.*
 homeassistant.components.recollect_waste.*
 homeassistant.components.recorder.*
+homeassistant.components.recovery_mode.*
+homeassistant.components.redgtech.*
 homeassistant.components.remember_the_milk.*
 homeassistant.components.remote.*
 homeassistant.components.remote_calendar.*
@@ -452,13 +495,16 @@ homeassistant.components.rss_feed_template.*
 homeassistant.components.russound_rio.*
 homeassistant.components.ruuvi_gateway.*
 homeassistant.components.ruuvitag_ble.*
+homeassistant.components.samsung_infrared.*
 homeassistant.components.samsungtv.*
+homeassistant.components.saunum.*
 homeassistant.components.scene.*
 homeassistant.components.schedule.*
 homeassistant.components.schlage.*
 homeassistant.components.scrape.*
 homeassistant.components.script.*
 homeassistant.components.search.*
+homeassistant.components.season.*
 homeassistant.components.select.*
 homeassistant.components.sensibo.*
 homeassistant.components.sensirion_ble.*
@@ -485,6 +531,7 @@ homeassistant.components.smtp.*
 homeassistant.components.snooz.*
 homeassistant.components.solarlog.*
 homeassistant.components.sonarr.*
+homeassistant.components.spaceapi.*
 homeassistant.components.speedtestdotnet.*
 homeassistant.components.spotify.*
 homeassistant.components.sql.*
@@ -509,6 +556,7 @@ homeassistant.components.synology_dsm.*
 homeassistant.components.system_health.*
 homeassistant.components.system_log.*
 homeassistant.components.systemmonitor.*
+homeassistant.components.systemnexa2.*
 homeassistant.components.tag.*
 homeassistant.components.tailscale.*
 homeassistant.components.tailwind.*
@@ -519,6 +567,9 @@ homeassistant.components.tcp.*
 homeassistant.components.technove.*
 homeassistant.components.tedee.*
 homeassistant.components.telegram_bot.*
+homeassistant.components.teleinfo.*
+homeassistant.components.teltonika.*
+homeassistant.components.teslemetry.*
 homeassistant.components.text.*
 homeassistant.components.thethingsnetwork.*
 homeassistant.components.threshold.*
@@ -542,21 +593,27 @@ homeassistant.components.trafikverket_train.*
 homeassistant.components.trafikverket_weatherstation.*
 homeassistant.components.transmission.*
 homeassistant.components.trend.*
+homeassistant.components.trmnl.*
 homeassistant.components.tts.*
 homeassistant.components.twentemilieu.*
 homeassistant.components.unifi.*
+homeassistant.components.unifi_access.*
 homeassistant.components.unifiprotect.*
 homeassistant.components.upcloud.*
 homeassistant.components.update.*
 homeassistant.components.uptime.*
 homeassistant.components.uptime_kuma.*
 homeassistant.components.uptimerobot.*
+homeassistant.components.usage_prediction.*
 homeassistant.components.usb.*
 homeassistant.components.uvc.*
 homeassistant.components.vacuum.*
 homeassistant.components.vallox.*
 homeassistant.components.valve.*
 homeassistant.components.velbus.*
+homeassistant.components.velux.*
+homeassistant.components.victron_gx.*
+homeassistant.components.vistapool.*
 homeassistant.components.vivotek.*
 homeassistant.components.vlc_telnet.*
 homeassistant.components.vodafone_station.*
@@ -566,8 +623,10 @@ homeassistant.components.wake_word.*
 homeassistant.components.wallbox.*
 homeassistant.components.waqi.*
 homeassistant.components.water_heater.*
+homeassistant.components.watts.*
 homeassistant.components.watttime.*
 homeassistant.components.weather.*
+homeassistant.components.web_rtc.*
 homeassistant.components.webhook.*
 homeassistant.components.webostv.*
 homeassistant.components.websocket_api.*
@@ -578,11 +637,13 @@ homeassistant.components.wiz.*
 homeassistant.components.wled.*
 homeassistant.components.workday.*
 homeassistant.components.worldclock.*
+homeassistant.components.xbox.*
 homeassistant.components.xiaomi_ble.*
 homeassistant.components.yale_smart_alarm.*
 homeassistant.components.yalexs_ble.*
 homeassistant.components.youtube.*
 homeassistant.components.zeroconf.*
+homeassistant.components.zinvolt.*
 homeassistant.components.zodiac.*
 homeassistant.components.zone.*
 homeassistant.components.zwave_js.*
@@ -1,21 +0,0 @@
-{
-  // Please keep this file (mostly!) in sync with settings in home-assistant/.devcontainer/devcontainer.json
-  // Added --no-cov to work around TypeError: message must be set
-  // https://github.com/microsoft/vscode-python/issues/14067
-  "python.testing.pytestArgs": ["--no-cov"],
-  // https://code.visualstudio.com/docs/python/testing#_pytest-configuration-settings
-  "python.testing.pytestEnabled": false,
-  // https://code.visualstudio.com/docs/python/linting#_general-settings
-  "pylint.importStrategy": "fromEnvironment",
-  // Pyright is too pedantic for Home Assistant
-  "python.analysis.typeCheckingMode": "basic",
-  "json.schemas": [
-        {
-            "fileMatch": [
-                "homeassistant/components/*/manifest.json"
-            ],
-            // This value differs between working with devcontainer and locally, therefor this value should NOT be in sync!
-            "url": "./script/json_schemas/manifest_schema.json"
-        }
-    ]
-}
@@ -0,0 +1,25 @@
+{
+  // Please keep this file (mostly!) in sync with settings in home-assistant/.devcontainer/devcontainer.json
+  // Added --no-cov to work around TypeError: message must be set
+  // https://github.com/microsoft/vscode-python/issues/14067
+  "python.testing.pytestArgs": ["--no-cov"],
+  // https://code.visualstudio.com/docs/python/testing#_pytest-configuration-settings
+  "python.testing.pytestEnabled": false,
+  // https://code.visualstudio.com/docs/python/linting#_general-settings
+  "pylint.importStrategy": "fromEnvironment",
+  // Pyright type checking is not compatible with mypy which Home Assistant uses for type checking
+  "python.analysis.typeCheckingMode": "off",
+  "[python]": {
+    "editor.defaultFormatter": "charliermarsh.ruff",
+  },
+  "[json][jsonc][yaml]": {
+    "editor.defaultFormatter": "esbenp.prettier-vscode",
+  },
+  "json.schemas": [
+    {
+      "fileMatch": ["homeassistant/components/*/manifest.json"],
+      // This value differs between working with devcontainer and locally, therefore this value should NOT be in sync!
+      "url": "./script/json_schemas/manifest_schema.json",
+    },
+  ],
+}
@@ -45,7 +45,7 @@
    {
      "label": "Ruff",
      "type": "shell",
-      "command": "pre-commit run ruff-check --all-files",
+      "command": "prek run ruff-check --all-files",
      "group": {
        "kind": "test",
        "isDefault": true
@@ -57,9 +57,9 @@
      "problemMatcher": []
    },
    {
-      "label": "Pre-commit",
+      "label": "Prek",
      "type": "shell",
-      "command": "pre-commit run --show-diff-on-failure",
+      "command": "prek run --show-diff-on-failure",
      "group": {
        "kind": "test",
        "isDefault": true
@@ -120,7 +120,7 @@
    {
      "label": "Generate Requirements",
      "type": "shell",
-      "command": "./script/gen_requirements_all.py",
+      "command": "${command:python.interpreterPath} -m script.gen_requirements_all",
      "group": {
        "kind": "build",
        "isDefault": true
@@ -132,7 +132,7 @@
      "problemMatcher": []
    },
    {
-      "label": "Install all Requirements",
+      "label": "Install all production Requirements",
      "type": "shell",
      "command": "uv pip install -r requirements_all.txt",
      "group": {
@@ -146,9 +146,9 @@
      "problemMatcher": []
    },
    {
-      "label": "Install all Test Requirements",
+      "label": "Install all (test & production) Requirements",
      "type": "shell",
-      "command": "uv pip install -r requirements.txt -r requirements_test_all.txt",
+      "command": "uv pip install -r requirements_all.txt -r requirements_test.txt",
      "group": {
        "kind": "build",
        "isDefault": true
@@ -1,5 +1,6 @@
 ignore: |
  tests/fixtures/core/config/yaml_errors/
+  .github/workflows/*.lock.yml
 rules:
  braces:
    level: error
@@ -1 +0,0 @@
-.github/copilot-instructions.md
@@ -0,0 +1,43 @@
+# GitHub Copilot & Claude Code Instructions
+
+This repository contains the core of Home Assistant, a Python 3 based home automation application.
+
+## Git Commit Guidelines
+
+- **Do NOT amend, squash, or rebase commits that have already been pushed to the PR branch after the PR is opened** - Reviewers need to follow the commit history, as well as see what changed since their last review
+
+## Pull Requests
+
+- When opening a pull request, use the repository's PR template (`.github/PULL_REQUEST_TEMPLATE.md`). NEVER REMOVE ANYTHING from the template.
+- Do not remove checkboxes that are not checked — leave all unchecked checkboxes in place so reviewers can see which options were not selected.
+
+## Development Commands
+
+- When entering a new environment or worktree, run `script/setup` to set up the virtual environment with all development dependencies (pylint, pre-commit hooks, etc.). This is required before committing.
+- .vscode/tasks.json contains useful commands used for development.
+- After finishing a code session, run `uv run prek run --all-files` to check for linting and formatting issues.
+
+## Python Syntax Notes
+
+- Home Assistant officially supports Python 3.14 as its minimum version. Do not flag syntax or features that require Python 3.14 as issues, and do not suggest workarounds for older Python versions.
+- Python 3.14 explicitly allows `except TypeA, TypeB:` without parentheses. Never flag this as an issue.
+- Python 3.14 evaluates annotations lazily (PEP 649). Forward references in annotations do not need to be quoted — annotations can reference names defined later in the module without quoting them or using `from __future__ import annotations`. Do not flag unquoted forward references in annotations as issues.
+
+## Testing
+
+- Use `uv run pytest` to run tests
+- After modifying `strings.json` for an integration, regenerate the English translation file before running tests: `.venv/bin/python3 -m script.translations develop --integration <integration_name>`. Tests load translations from the generated `translations/en.json`, not directly from `strings.json`.
+- When writing or modifying tests, ensure all test function parameters have type annotations.
+- Prefer concrete types (for example, `HomeAssistant`, `MockConfigEntry`, etc.) over `Any`.
+- Prefer `@pytest.mark.usefixtures` over arguments, if the argument is not going to be used.
+- Avoid using conditions/branching in tests. Instead, either split tests or adjust the test parametrization to cover all cases without branching.
+- If multiple tests share most of their code, use `pytest.mark.parametrize` to merge them into a single parameterized test instead of duplicating the body. Use `pytest.param` with an `id` parameter to name the test cases clearly.
+- We use Syrupy for snapshot testing. Leverage `.ambr` snapshots instead of repetitive and exhaustive generation of test data within Python code itself.
+- Hardcoded `entity_id`s in tests are fine. If the same one is repeated, use a constant.
+
+## Good practices
+
+- Integrations with Platinum or Gold level in the Integration Quality Scale reflect a high standard of code quality and maintainability. When looking for examples of something, these are good places to start. The level is indicated in the manifest.json of the integration.
+- When reviewing entity actions, do not suggest extra defensive checks for input fields that are already validated by Home Assistant's service/action schemas and entity selection filters. Suggest additional guards only when data bypasses those validators or is transformed into a less-safe form.
+- When validation guarantees a dict key exists, prefer direct key access (`data["key"]`) instead of `.get("key")` so contract violations are surfaced instead of silently masked.
+- Do not add comments that just restate the code on the following line(s) (e.g. `# Check if initialized` above `if self.initialized:`). Comments should only explain why — non-obvious constraints, surprising behavior, or workarounds — never what.
@@ -1 +1 @@
-.github/copilot-instructions.md
+AGENTS.md
@@ -1,45 +1,41 @@
-# Automatically generated by hassfest.
+# syntax=docker/dockerfile@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769
+# Partly generated by hassfest.
 #
 # To update, run python3 -m script.hassfest -p docker
 ARG BUILD_FROM
 FROM ${BUILD_FROM}

+LABEL \
+    io.hass.type="core" \
+    org.opencontainers.image.authors="The Home Assistant Authors" \
+    org.opencontainers.image.description="Open-source home automation platform running on Python 3" \
+    org.opencontainers.image.documentation="https://www.home-assistant.io/docs/" \
+    org.opencontainers.image.licenses="Apache-2.0" \
+    org.opencontainers.image.title="Home Assistant" \
+    org.opencontainers.image.url="https://www.home-assistant.io/"
+
 # Synchronize with homeassistant/core.py:async_stop
 ENV \
    S6_SERVICES_GRACETIME=240000 \
    UV_SYSTEM_PYTHON=true \
    UV_NO_CACHE=true

-ARG QEMU_CPU
+WORKDIR /usr/src

 # Home Assistant S6-Overlay
 COPY rootfs /

-# Needs to be redefined inside the FROM statement to be set for RUN commands
-ARG BUILD_ARCH
-# Get go2rtc binary
-RUN \
-    case "${BUILD_ARCH}" in \
-        "aarch64") go2rtc_suffix='arm64' ;; \
-        "armhf") go2rtc_suffix='armv6' ;; \
-        "armv7") go2rtc_suffix='arm' ;; \
-        *) go2rtc_suffix=${BUILD_ARCH} ;; \
-    esac \
-    && curl -L https://github.com/AlexxIT/go2rtc/releases/download/v1.9.11/go2rtc_linux_${go2rtc_suffix} --output /bin/go2rtc \
-    && chmod +x /bin/go2rtc \
-    # Verify go2rtc can be executed
-    && go2rtc --version
-
-# Install uv
-RUN pip3 install uv==0.9.5
-
-WORKDIR /usr/src
+# Add go2rtc binary
+COPY --from=ghcr.io/alexxit/go2rtc:1.9.14@sha256:675c318b23c06fd862a61d262240c9a63436b4050d177ffc68a32710d9e05bae /usr/local/bin/go2rtc /bin/go2rtc

 ## Setup Home Assistant Core dependencies
-COPY requirements.txt homeassistant/
-COPY homeassistant/package_constraints.txt homeassistant/homeassistant/
+COPY --parents requirements.txt homeassistant/package_constraints.txt homeassistant/
 RUN \
-    uv pip install \
+    # Verify go2rtc can be executed
+    go2rtc --version \
+    # Install uv at the version pinned in the requirements file
+    && pip3 install --no-cache-dir "uv==$(awk -F'==' '/^uv==/{print $2}' homeassistant/requirements.txt)" \
+    && uv pip install \
        --no-build \
        -r homeassistant/requirements.txt

@@ -53,7 +49,7 @@ RUN \
        -r homeassistant/requirements_all.txt

 ## Setup Home Assistant Core
-COPY . homeassistant/
+COPY --parents LICENSE* README* homeassistant/ pyproject.toml homeassistant/
 RUN \
    uv pip install \
        -e ./homeassistant \
@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769
 FROM mcr.microsoft.com/vscode/devcontainers/base:debian

 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
@@ -13,7 +14,6 @@ RUN \
        libavcodec-dev \
        libavdevice-dev \
        libavutil-dev \
-        libgammu-dev \
        libswscale-dev \
        libswresample-dev \
        libavfilter-dev \
@@ -36,25 +36,25 @@ COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv

 USER vscode

-COPY .python-version ./
-RUN uv python install
-
 ENV VIRTUAL_ENV="/home/vscode/.local/ha-venv"
-RUN uv venv $VIRTUAL_ENV
+RUN --mount=type=bind,source=.python-version,target=.python-version \
+    uv python install \
+    && uv venv $VIRTUAL_ENV
 ENV PATH="$VIRTUAL_ENV/bin:$PATH"

-WORKDIR /tmp
-
 # Setup hass-release
 RUN git clone --depth 1 https://github.com/home-assistant/hass-release ~/hass-release \
    && uv pip install -e ~/hass-release/

 # Install Python dependencies from requirements
-COPY requirements.txt ./
-COPY homeassistant/package_constraints.txt homeassistant/package_constraints.txt
-RUN uv pip install -r requirements.txt
-COPY requirements_test.txt requirements_test_pre_commit.txt ./
-RUN uv pip install -r requirements_test.txt
+RUN --mount=type=bind,source=requirements.txt,target=requirements.txt \
+    --mount=type=bind,source=homeassistant/package_constraints.txt,target=homeassistant/package_constraints.txt \
+    --mount=type=bind,source=requirements_test.txt,target=requirements_test.txt \
+    --mount=type=bind,source=requirements_test_pre_commit.txt,target=requirements_test_pre_commit.txt \
+    uv pip install -r requirements.txt -r requirements_test.txt
+
+# Claude Code native install
+RUN curl -fsSL https://claude.ai/install.sh | bash

 WORKDIR /workspaces

@@ -1,19 +0,0 @@
-image: ghcr.io/home-assistant/{arch}-homeassistant
-build_from:
-  aarch64: ghcr.io/home-assistant/aarch64-homeassistant-base:2025.10.1
-  armhf: ghcr.io/home-assistant/armhf-homeassistant-base:2025.10.1
-  armv7: ghcr.io/home-assistant/armv7-homeassistant-base:2025.10.1
-  amd64: ghcr.io/home-assistant/amd64-homeassistant-base:2025.10.1
-  i386: ghcr.io/home-assistant/i386-homeassistant-base:2025.10.1
-cosign:
-  base_identity: https://github.com/home-assistant/docker/.*
-  identity: https://github.com/home-assistant/core/.*
-labels:
-  io.hass.type: core
-  org.opencontainers.image.title: Home Assistant
-  org.opencontainers.image.description: Open-source home automation platform running on Python 3
-  org.opencontainers.image.source: https://github.com/home-assistant/core
-  org.opencontainers.image.authors: The Home Assistant Authors
-  org.opencontainers.image.url: https://www.home-assistant.io/
-  org.opencontainers.image.documentation: https://www.home-assistant.io/docs/
-  org.opencontainers.image.licenses: Apache-2.0
@@ -10,6 +10,7 @@ coverage:
        target: auto
        threshold: 1
        paths:
+          - homeassistant/components/*/backup.py
          - homeassistant/components/*/config_flow.py
          - homeassistant/components/*/device_action.py
          - homeassistant/components/*/device_condition.py
@@ -28,6 +29,7 @@ coverage:
        target: 100
        threshold: 0
        paths:
+          - homeassistant/components/*/backup.py
          - homeassistant/components/*/config_flow.py
          - homeassistant/components/*/device_action.py
          - homeassistant/components/*/device_condition.py
@@ -1,7 +1,5 @@
 """Start Home Assistant."""

-from __future__ import annotations
-
 import argparse
 from contextlib import suppress
 import faulthandler
@@ -1,7 +1,5 @@
 """Provide an authentication layer for Home Assistant."""

-from __future__ import annotations
-
 import asyncio
 from collections import OrderedDict
 from collections.abc import Mapping
@@ -75,10 +73,12 @@ async def auth_manager_from_config(
        provider_hash[key] = provider

        if isinstance(provider, HassAuthProvider):
-            # Can be removed in 2026.7 with the legacy mode of homeassistant auth provider
-            # We need to initialize the provider to create the repair if needed as otherwise
-            # the provider will be initialized on first use, which could be rare as users
-            # don't frequently change auth settings
+            # Can be removed in 2026.7 with the legacy mode of
+            # homeassistant auth provider.
+            # We need to initialize the provider to create the repair
+            # if needed as otherwise the provider will be initialized
+            # on first use, which could be rare as users don't
+            # frequently change auth settings
            await provider.async_initialize()

    if module_configs:
@@ -134,7 +134,7 @@ class AuthManagerFlowManager(
        """
        flow = cast(LoginFlow, flow)

-        if result["type"] != FlowResultType.CREATE_ENTRY:
+        if result["type"] is not FlowResultType.CREATE_ENTRY:
            return result

        # we got final result
@@ -402,6 +402,8 @@ class AuthManager:
        if user.is_owner:
            raise ValueError("Unable to deactivate the owner")
        await self._store.async_deactivate_user(user)
+        for refresh_token in list(user.refresh_tokens.values()):
+            self.async_remove_refresh_token(refresh_token)

    async def async_remove_credentials(self, credentials: models.Credentials) -> None:
        """Remove credentials."""
@@ -1,7 +1,5 @@
 """Storage for auth models."""

-from __future__ import annotations
-
 from datetime import timedelta
 import hmac
 import itertools
@@ -5,25 +5,31 @@ we can cache the result of the decode of valid tokens
 to speed up the process.
 """

-from __future__ import annotations
-
+from collections.abc import Container, Iterable, Sequence
 from datetime import timedelta
-from functools import lru_cache, partial
-from typing import Any
+from functools import lru_cache
+from typing import Any, override

-from jwt import DecodeError, PyJWS, PyJWT
+from jwt import DecodeError, PyJWK, PyJWS, PyJWT
+from jwt.algorithms import AllowedPublicKeys
+from jwt.types import Options

 from homeassistant.util.json import json_loads

 JWT_TOKEN_CACHE_SIZE = 16
 MAX_TOKEN_SIZE = 8192

-_VERIFY_KEYS = ("signature", "exp", "nbf", "iat", "aud", "iss", "sub", "jti")
-
-_VERIFY_OPTIONS: dict[str, Any] = {f"verify_{key}": True for key in _VERIFY_KEYS} | {
-    "require": []
-}
-_NO_VERIFY_OPTIONS = {f"verify_{key}": False for key in _VERIFY_KEYS}
+_NO_VERIFY_OPTIONS = Options(
+    verify_signature=False,
+    verify_exp=False,
+    verify_nbf=False,
+    verify_iat=False,
+    verify_aud=False,
+    verify_iss=False,
+    verify_sub=False,
+    verify_jti=False,
+    require=[],
+)


 class _PyJWSWithLoadCache(PyJWS):
@@ -38,9 +44,6 @@ class _PyJWSWithLoadCache(PyJWS):
        return super()._load(jwt)


-_jws = _PyJWSWithLoadCache()
-
-
@lru_cache(maxsize=JWT_TOKEN_CACHE_SIZE)
 def _decode_payload(json_payload: str) -> dict[str, Any]:
    """Decode the payload from a JWS dictionary."""
@@ -56,21 +59,12 @@ def _decode_payload(json_payload: str) -> dict[str, Any]:
 class _PyJWTWithVerify(PyJWT):
    """PyJWT with a fast decode implementation."""

-    def decode_payload(
-        self, jwt: str, key: str, options: dict[str, Any], algorithms: list[str]
-    ) -> dict[str, Any]:
-        """Decode a JWT's payload."""
-        if len(jwt) > MAX_TOKEN_SIZE:
-            # Avoid caching impossible tokens
-            raise DecodeError("Token too large")
-        return _decode_payload(
-            _jws.decode_complete(
-                jwt=jwt,
-                key=key,
-                algorithms=algorithms,
-                options=options,
-            )["payload"]
-        )
+    def __init__(self) -> None:
+        """Initialize the PyJWT instance."""
+        # We require exp and iat claims to be present
+        super().__init__(Options(require=["exp", "iat"]))
+        # Override the _jws instance with our cached version
+        self._jws = _PyJWSWithLoadCache()

    def verify_and_decode(
        self,
@@ -79,37 +73,70 @@ class _PyJWTWithVerify(PyJWT):
        algorithms: list[str],
        issuer: str | None = None,
        leeway: float | timedelta = 0,
-        options: dict[str, Any] | None = None,
+        options: Options | None = None,
    ) -> dict[str, Any]:
        """Verify a JWT's signature and claims."""
-        merged_options = {**_VERIFY_OPTIONS, **(options or {})}
-        payload = self.decode_payload(
+        return self.decode(
            jwt=jwt,
            key=key,
-            options=merged_options,
            algorithms=algorithms,
-        )
-        # These should never be missing since we verify them
-        # but this is an additional safeguard to make sure
-        # nothing slips through.
-        assert "exp" in payload, "exp claim is required"
-        assert "iat" in payload, "iat claim is required"
-        self._validate_claims(
-            payload=payload,
-            options=merged_options,
            issuer=issuer,
            leeway=leeway,
+            options=options,
        )
-        return payload
+
+    @override
+    def decode(
+        self,
+        jwt: str | bytes,
+        key: AllowedPublicKeys | PyJWK | str | bytes = "",
+        algorithms: Sequence[str] | None = None,
+        options: Options | None = None,
+        verify: bool | None = None,
+        detached_payload: bytes | None = None,
+        audience: str | Iterable[str] | None = None,
+        subject: str | None = None,
+        issuer: str | Container[str] | None = None,
+        leeway: float | timedelta = 0,
+        **kwargs: Any,
+    ) -> dict[str, Any]:
+        """Decode a JWT, verifying the signature and claims."""
+        if len(jwt) > MAX_TOKEN_SIZE:
+            # Avoid caching impossible tokens
+            raise DecodeError("Token too large")
+        return super().decode(
+            jwt=jwt,
+            key=key,
+            algorithms=algorithms,
+            options=options,
+            verify=verify,
+            detached_payload=detached_payload,
+            audience=audience,
+            subject=subject,
+            issuer=issuer,
+            leeway=leeway,
+            **kwargs,
+        )
+
+    @override
+    def _decode_payload(self, decoded: dict[str, Any]) -> dict[str, Any]:
+        return _decode_payload(decoded["payload"])


 _jwt = _PyJWTWithVerify()
 verify_and_decode = _jwt.verify_and_decode
-unverified_hs256_token_decode = lru_cache(maxsize=JWT_TOKEN_CACHE_SIZE)(
-    partial(
-        _jwt.decode_payload, key="", algorithms=["HS256"], options=_NO_VERIFY_OPTIONS
+
+
+@lru_cache(maxsize=JWT_TOKEN_CACHE_SIZE)
+def unverified_hs256_token_decode(jwt: str) -> dict[str, Any]:
+    """Decode a JWT without verifying the signature."""
+    return _jwt.decode(
+        jwt=jwt,
+        key="",
+        algorithms=["HS256"],
+        options=_NO_VERIFY_OPTIONS,
    )
-)
+

 __all__ = [
    "unverified_hs256_token_decode",
@@ -1,7 +1,5 @@
 """Pluggable auth modules for Home Assistant."""

-from __future__ import annotations
-
 import logging
 import types
 from typing import Any
@@ -1,7 +1,5 @@
 """Example auth module."""

-from __future__ import annotations
-
 from typing import Any

 import voluptuous as vol
@@ -3,10 +3,7 @@
 Sending HOTP through notify service
 """

-from __future__ import annotations
-
 import asyncio
-from collections import OrderedDict
 import logging
 from typing import Any, cast

@@ -304,14 +301,15 @@ class NotifySetupFlow(SetupFlow[NotifyAuthModule]):
        if not self._available_notify_services:
            return self.async_abort(reason="no_available_service")

-        schema: dict[str, Any] = OrderedDict()
-        schema["notify_service"] = vol.In(self._available_notify_services)
-        schema["target"] = vol.Optional(str)
-
-        return self.async_show_form(
-            step_id="init", data_schema=vol.Schema(schema), errors=errors
+        schema = vol.Schema(
+            {
+                vol.Required("notify_service"): vol.In(self._available_notify_services),
+                vol.Optional("target"): str,
+            }
        )

+        return self.async_show_form(step_id="init", data_schema=schema, errors=errors)
+
    async def async_step_setup(
        self, user_input: dict[str, str] | None = None
    ) -> FlowResult:
@@ -1,7 +1,5 @@
 """Time-based One Time Password auth module."""

-from __future__ import annotations
-
 import asyncio
 from io import BytesIO
 from typing import Any, cast
@@ -1,7 +1,5 @@
 """Auth models."""

-from __future__ import annotations
-
 from datetime import datetime, timedelta
 from ipaddress import IPv4Address, IPv6Address
 import secrets
@@ -1,8 +1,7 @@
 """Permissions for Home Assistant."""

-from __future__ import annotations
-
-from collections.abc import Callable
+from collections.abc import Callable, Iterable
+from typing import TYPE_CHECKING

 import voluptuous as vol

@@ -13,6 +12,9 @@ from .models import PermissionLookup
 from .types import PolicyType
 from .util import test_all

+if TYPE_CHECKING:
+    from ..models import User
+
 POLICY_SCHEMA = vol.Schema({vol.Optional(CAT_ENTITIES): ENTITY_POLICY_SCHEMA})

 __all__ = [
@@ -22,10 +24,21 @@ __all__ = [
    "PermissionLookup",
    "PolicyPermissions",
    "PolicyType",
+    "filter_entity_ids_by_permission",
    "merge_policies",
 ]


+def filter_entity_ids_by_permission(
+    user: User, entity_ids: Iterable[str], key: str
+) -> list[str]:
+    """Filter entity IDs to those the user can access for the given policy key."""
+    if user.is_admin or user.permissions.access_all_entities(key):
+        return list(entity_ids)
+    check_entity = user.permissions.check_entity
+    return [entity_id for entity_id in entity_ids if check_entity(entity_id, key)]
+
+
 class AbstractPermissions:
    """Default permissions class."""

@@ -1,7 +1,5 @@
 """Entity permissions."""

-from __future__ import annotations
-
 from collections import OrderedDict
 from collections.abc import Callable

@@ -1,12 +1,11 @@
 """Permission for events."""

-from __future__ import annotations
-
 from typing import Any, Final

 from homeassistant.const import (
    EVENT_COMPONENT_LOADED,
    EVENT_CORE_CONFIG_UPDATE,
+    EVENT_LABS_UPDATED,
    EVENT_LOVELACE_UPDATED,
    EVENT_PANELS_UPDATED,
    EVENT_RECORDER_5MIN_STATISTICS_GENERATED,
@@ -45,6 +44,7 @@ SUBSCRIBE_ALLOWLIST: Final[set[EventType[Any] | str]] = {
    EVENT_STATE_CHANGED,
    EVENT_THEMES_UPDATED,
    EVENT_LABEL_REGISTRY_UPDATED,
+    EVENT_LABS_UPDATED,
    EVENT_CATEGORY_REGISTRY_UPDATED,
    EVENT_FLOOR_REGISTRY_UPDATED,
 }
@@ -1,7 +1,5 @@
 """Merging of policies."""

-from __future__ import annotations
-
 from typing import cast

 from .types import CategoryType, PolicyType
@@ -1,7 +1,5 @@
 """Models for permissions."""

-from __future__ import annotations
-
 from typing import TYPE_CHECKING

 import attr
@@ -1,7 +1,5 @@
 """Helpers to deal with permissions."""

-from __future__ import annotations
-
 from collections.abc import Callable
 from functools import wraps
 from typing import cast
@@ -1,7 +1,5 @@
 """Auth providers for Home Assistant."""

-from __future__ import annotations
-
 from collections.abc import Mapping
 import logging
 import types
@@ -1,7 +1,5 @@
 """Auth provider that validates credentials via an external command."""

-from __future__ import annotations
-
 import asyncio
 from collections.abc import Mapping
 import logging
@@ -1,7 +1,5 @@
 """Home Assistant auth provider."""

-from __future__ import annotations
-
 import asyncio
 import base64
 from collections.abc import Mapping
@@ -122,9 +120,10 @@ class Data:
            if self.normalize_username(username, force_normalize=True) != username:
                logging.getLogger(__name__).warning(
                    (
-                        "Home Assistant auth provider is running in legacy mode "
-                        "because we detected usernames that are normalized (lowercase and without spaces)."
-                        " Please change the username: '%s'."
+                        "Home Assistant auth provider is running in"
+                        " legacy mode because we detected usernames"
+                        " that are normalized (lowercase and without"
+                        " spaces). Please change the username: '%s'."
                    ),
                    username,
                )
@@ -141,7 +140,9 @@ class Data:
                severity=ir.IssueSeverity.WARNING,
                translation_key="homeassistant_provider_not_normalized_usernames",
                translation_placeholders={
-                    "usernames": f'- "{'"\n- "'.join(sorted(not_normalized_usernames))}"'
+                    "usernames": (
+                        f'- "{'"\n- "'.join(sorted(not_normalized_usernames))}"'
+                    )
                },
                learn_more_url="homeassistant://config/users",
            )
@@ -179,12 +180,18 @@ class Data:
        user_hash = base64.b64decode(found["password"])

        # bcrypt.checkpw is timing-safe
-        if not bcrypt.checkpw(password.encode(), user_hash):
+        # With bcrypt 5.0 passing a password longer than 72 bytes raises a ValueError.
+        # Previously the password was silently truncated.
+        # https://github.com/pyca/bcrypt/pull/1000
+        if not bcrypt.checkpw(password.encode()[:72], user_hash):
            raise InvalidAuth

    def hash_password(self, password: str, for_storage: bool = False) -> bytes:
        """Encode a password."""
-        hashed: bytes = bcrypt.hashpw(password.encode(), bcrypt.gensalt(rounds=12))
+        # With bcrypt 5.0 passing a password longer than 72 bytes raises a ValueError.
+        # Previously the password was silently truncated.
+        # https://github.com/pyca/bcrypt/pull/1000
+        hashed: bytes = bcrypt.hashpw(password.encode()[:72], bcrypt.gensalt(rounds=12))

        if for_storage:
            hashed = base64.b64encode(hashed)
@@ -1,7 +1,5 @@
 """Example auth provider."""

-from __future__ import annotations
-
 from collections.abc import Mapping
 import hmac

@@ -4,8 +4,6 @@ It shows list of users if access from trusted network.
 Abort login flow if not access from trusted network.
 """

-from __future__ import annotations
-
 from collections.abc import Mapping
 from ipaddress import (
    IPv4Address,
@@ -1,10 +1,7 @@
 """Home Assistant module to handle restoring backups."""

-from __future__ import annotations
-
 from collections.abc import Iterable
 from dataclasses import dataclass
-import hashlib
 import json
 import logging
 from pathlib import Path
@@ -40,17 +37,6 @@ class RestoreBackupFileContent:
    restore_homeassistant: bool


-def password_to_key(password: str) -> bytes:
-    """Generate a AES Key from password.
-
-    Matches the implementation in supervisor.backups.utils.password_to_key.
-    """
-    key: bytes = password.encode()
-    for _ in range(100):
-        key = hashlib.sha256(key).digest()
-    return key[:16]
-
-
 def restore_backup_file_content(config_dir: Path) -> RestoreBackupFileContent | None:
    """Return the contents of the restore backup file."""
    instruction_path = config_dir.joinpath(RESTORE_BACKUP_FILE)
@@ -74,7 +60,10 @@ def restore_backup_file_content(config_dir: Path) -> RestoreBackupFileContent |


 def _clear_configuration_directory(config_dir: Path, keep: Iterable[str]) -> None:
-    """Delete all files and directories in the config directory except entries in the keep list."""
+    """Delete all files and directories in the config dir.
+
+    Entries in the keep list are preserved.
+    """
    keep_paths = [config_dir.joinpath(path) for path in keep]
    entries_to_remove = sorted(
        entry for entry in config_dir.iterdir() if entry not in keep_paths
@@ -96,16 +85,14 @@ def _extract_backup(
    """Extract the backup file to the config directory."""
    with (
        TemporaryDirectory() as tempdir,
-        securetar.SecureTarFile(
+        securetar.SecureTarArchive(
            restore_content.backup_file_path,
-            gzip=False,
            mode="r",
        ) as ostf,
    ):
-        ostf.extractall(
+        ostf.tar.extractall(
            path=Path(tempdir, "extracted"),
-            members=securetar.secure_path(ostf),
-            filter="fully_trusted",
+            filter="tar",
        )
        backup_meta_file = Path(tempdir, "extracted", "backup.json")
        backup_meta = json.loads(backup_meta_file.read_text(encoding="utf8"))
@@ -116,7 +103,8 @@ def _extract_backup(
            )
        ) > HA_VERSION:
            raise ValueError(
-                f"You need at least Home Assistant version {backup_meta_version} to restore this backup"
+                f"You need at least Home Assistant version"
+                f" {backup_meta_version} to restore this backup"
            )

        with securetar.SecureTarFile(
@@ -126,15 +114,11 @@ def _extract_backup(
                f"homeassistant.tar{'.gz' if backup_meta['compressed'] else ''}",
            ),
            gzip=backup_meta["compressed"],
-            key=password_to_key(restore_content.password)
-            if restore_content.password is not None
-            else None,
-            mode="r",
+            password=restore_content.password,
        ) as istf:
            istf.extractall(
                path=Path(tempdir, "homeassistant"),
-                members=securetar.secure_path(istf),
-                filter="fully_trusted",
+                filter="tar",
            )
            if restore_content.restore_homeassistant:
                keep = list(KEEP_BACKUPS)
@@ -1,7 +1,5 @@
 """Provide methods to bootstrap a Home Assistant instance."""

-from __future__ import annotations
-
 import asyncio
 from collections import defaultdict
 import contextlib
@@ -19,7 +17,8 @@ from time import monotonic
 from typing import TYPE_CHECKING, Any

 # Import cryptography early since import openssl is not thread-safe
-# _frozen_importlib._DeadlockError: deadlock detected by _ModuleLock('cryptography.hazmat.backends.openssl.backend')
+# _frozen_importlib._DeadlockError: deadlock detected by
+# _ModuleLock('cryptography.hazmat.backends.openssl.backend')
 import cryptography.hazmat.backends.openssl.backend  # noqa: F401
 import voluptuous as vol
 import yarl
@@ -67,12 +66,10 @@ from .const import (
    BASE_PLATFORMS,
    FORMAT_DATETIME,
    KEY_DATA_LOGGING as DATA_LOGGING,
-    REQUIRED_NEXT_PYTHON_HA_RELEASE,
-    REQUIRED_NEXT_PYTHON_VER,
    SIGNAL_BOOTSTRAP_INTEGRATIONS,
 )
 from .core_config import async_process_ha_core_config
-from .exceptions import HomeAssistantError
+from .exceptions import HomeAssistantError, UnsupportedStorageVersionError
 from .helpers import (
    area_registry,
    category_registry,
@@ -169,13 +166,19 @@ FRONTEND_INTEGRATIONS = {
    # visible in frontend
    "frontend",
 }
-# Stage 0 is divided into substages. Each substage has a name, a set of integrations and a timeout.
-# The substage containing recorder should have no timeout, as it could cancel a database migration.
-# Recorder freezes "recorder" timeout during a migration, but it does not freeze other timeouts.
-# If we add timeouts to the frontend substages, we should make sure they don't apply in recovery mode.
+# Stage 0 is divided into substages. Each substage has a name,
+# a set of integrations and a timeout.
+# The substage containing recorder should have no timeout, as it
+# could cancel a database migration.
+# Recorder freezes "recorder" timeout during a migration, but it
+# does not freeze other timeouts.
+# If we add timeouts to the frontend substages, we should make sure
+# they don't apply in recovery mode.
 STAGE_0_INTEGRATIONS = (
    # Load logging and http deps as soon as possible
    ("logging, http deps", LOGGING_AND_HTTP_DEPS_INTEGRATIONS, None),
+    # Setup labs for preview features
+    ("labs", {"labs"}, STAGE_0_SUBSTAGE_TIMEOUT),
    # Setup frontend
    ("frontend", FRONTEND_INTEGRATIONS, None),
    # Setup recorder
@@ -210,8 +213,10 @@ DEFAULT_INTEGRATIONS = {
    "analytics",  # Needed for onboarding
    "application_credentials",
    "backup",
+    "brands",
    "frontend",
    "hardware",
+    "labs",
    "logger",
    "network",
    "system_health",
@@ -234,9 +239,31 @@ DEFAULT_INTEGRATIONS = {
    "input_text",
    "schedule",
    "timer",
+    #
+    # Base platforms:
+    # Note: Calendar and todo are not included to prevent them from registering
+    # their frontend panels when there are no calendar or todo integrations.
+    *(BASE_PLATFORMS - {"calendar", "todo"}),
+    #
+    # Integrations providing triggers and conditions for base platforms:
+    "air_quality",
+    "battery",
+    "door",
+    "garage_door",
+    "gate",
+    "humidity",
+    "illuminance",
+    "moisture",
+    "motion",
+    "occupancy",
+    "power",
+    "temperature",
+    "window",
 }
 DEFAULT_INTEGRATIONS_RECOVERY_MODE = {
    # These integrations are set up if recovery mode is activated.
+    "backup",
+    "cloud",
    "frontend",
 }
 DEFAULT_INTEGRATIONS_SUPERVISOR = {
@@ -431,32 +458,57 @@ def _init_blocking_io_modules_in_executor() -> None:
    is_docker_env()


-async def async_load_base_functionality(hass: core.HomeAssistant) -> None:
-    """Load the registries and modules that will do blocking I/O."""
+async def async_load_base_functionality(hass: core.HomeAssistant) -> bool:
+    """Load the registries and modules that will do blocking I/O.
+
+    Return whether loading succeeded.
+    """
    if DATA_REGISTRIES_LOADED in hass.data:
-        return
+        return True
+
    hass.data[DATA_REGISTRIES_LOADED] = None
    entity.async_setup(hass)
    frame.async_setup(hass)
    template.async_setup(hass)
    translation.async_setup(hass)
-    await asyncio.gather(
-        create_eager_task(get_internal_store_manager(hass).async_initialize()),
-        create_eager_task(area_registry.async_load(hass)),
-        create_eager_task(category_registry.async_load(hass)),
-        create_eager_task(device_registry.async_load(hass)),
-        create_eager_task(entity_registry.async_load(hass)),
-        create_eager_task(floor_registry.async_load(hass)),
-        create_eager_task(issue_registry.async_load(hass)),
-        create_eager_task(label_registry.async_load(hass)),
-        hass.async_add_executor_job(_init_blocking_io_modules_in_executor),
-        create_eager_task(template.async_load_custom_templates(hass)),
-        create_eager_task(restore_state.async_load(hass)),
-        create_eager_task(hass.config_entries.async_initialize()),
-        create_eager_task(async_get_system_info(hass)),
-        create_eager_task(condition.async_setup(hass)),
-        create_eager_task(trigger.async_setup(hass)),
-    )
+
+    recovery = hass.config.recovery_mode
+    device_registry.async_setup(hass)
+    try:
+        await asyncio.gather(
+            create_eager_task(get_internal_store_manager(hass).async_initialize()),
+            create_eager_task(area_registry.async_load(hass, load_empty=recovery)),
+            create_eager_task(category_registry.async_load(hass, load_empty=recovery)),
+            create_eager_task(device_registry.async_load(hass, load_empty=recovery)),
+            create_eager_task(entity_registry.async_load(hass, load_empty=recovery)),
+            create_eager_task(floor_registry.async_load(hass, load_empty=recovery)),
+            create_eager_task(issue_registry.async_load(hass, load_empty=recovery)),
+            create_eager_task(label_registry.async_load(hass, load_empty=recovery)),
+            hass.async_add_executor_job(_init_blocking_io_modules_in_executor),
+            create_eager_task(template.async_load_custom_templates(hass)),
+            create_eager_task(restore_state.async_load(hass, load_empty=recovery)),
+            create_eager_task(hass.config_entries.async_initialize()),
+            create_eager_task(async_get_system_info(hass)),
+            create_eager_task(condition.async_setup(hass)),
+            create_eager_task(trigger.async_setup(hass)),
+        )
+    except UnsupportedStorageVersionError as err:
+        # If we're already in recovery mode, we don't want to handle the exception
+        # and activate recovery mode again, as that would lead to an infinite loop.
+        if recovery:
+            raise
+
+        _LOGGER.error(
+            "Storage file %s was created by a newer version of Home Assistant"
+            " (storage version %s > %s); activating recovery mode; on-disk data"
+            " is preserved; upgrade Home Assistant or restore from a backup",
+            err.storage_key,
+            err.found_version,
+            err.max_supported_version,
+        )
+        return False
+
+    return True


 async def async_from_config_dict(
@@ -473,7 +525,9 @@ async def async_from_config_dict(
    # Prime custom component cache early so we know if registry entries are tied
    # to a custom integration
    await loader.async_get_custom_components(hass)
-    await async_load_base_functionality(hass)
+
+    if not await async_load_base_functionality(hass):
+        return None

    # Set up core.
    _LOGGER.debug("Setting up %s", CORE_INTEGRATIONS)
@@ -513,38 +567,6 @@ async def async_from_config_dict(

    stop = monotonic()
    _LOGGER.info("Home Assistant initialized in %.2fs", stop - start)
-
-    if (
-        REQUIRED_NEXT_PYTHON_HA_RELEASE
-        and sys.version_info[:3] < REQUIRED_NEXT_PYTHON_VER
-    ):
-        current_python_version = ".".join(str(x) for x in sys.version_info[:3])
-        required_python_version = ".".join(str(x) for x in REQUIRED_NEXT_PYTHON_VER[:2])
-        _LOGGER.warning(
-            (
-                "Support for the running Python version %s is deprecated and "
-                "will be removed in Home Assistant %s; "
-                "Please upgrade Python to %s"
-            ),
-            current_python_version,
-            REQUIRED_NEXT_PYTHON_HA_RELEASE,
-            required_python_version,
-        )
-        issue_registry.async_create_issue(
-            hass,
-            core.DOMAIN,
-            f"python_version_{required_python_version}",
-            is_fixable=False,
-            severity=issue_registry.IssueSeverity.WARNING,
-            breaks_in_ha_version=REQUIRED_NEXT_PYTHON_HA_RELEASE,
-            translation_key="python_version",
-            translation_placeholders={
-                "current_python_version": current_python_version,
-                "required_python_version": required_python_version,
-                "breaks_in_ha_version": REQUIRED_NEXT_PYTHON_HA_RELEASE,
-            },
-        )
-
    return hass


@@ -621,13 +643,16 @@ async def async_enable_logging(

    if log_file is None:
        default_log_path = hass.config.path(ERROR_LOG_FILENAME)
-        if "SUPERVISOR" in os.environ:
-            _LOGGER.info("Running in Supervisor, not logging to file")
+        if "SUPERVISOR" in os.environ and "HA_DUPLICATE_LOG_FILE" not in os.environ:
            # Rename the default log file if it exists, since previous versions created
            # it even on Supervisor
-            if os.path.isfile(default_log_path):
-                with contextlib.suppress(OSError):
-                    os.rename(default_log_path, f"{default_log_path}.old")
+            def rename_old_file() -> None:
+                """Rename old log file in executor."""
+                if os.path.isfile(default_log_path):
+                    with contextlib.suppress(OSError):
+                        os.rename(default_log_path, f"{default_log_path}.old")
+
+            await hass.async_add_executor_job(rename_old_file)
            err_log_path = None
        else:
            err_log_path = default_log_path
@@ -997,7 +1022,7 @@ class _WatchPendingSetups:
            # We log every LOG_SLOW_STARTUP_INTERVAL until all integrations are done
            # once we take over LOG_SLOW_STARTUP_INTERVAL (60s) to start up
            _LOGGER.warning(
-                "Waiting on integrations to complete setup: %s",
+                "Waiting for integrations to complete setup: %s",
                self._setup_started,
            )

@@ -0,0 +1,5 @@
+{
+  "domain": "american_standard",
+  "name": "American Standard",
+  "integrations": ["nexia", "trane"]
+}
@@ -0,0 +1,5 @@
+{
+  "domain": "bega",
+  "name": "BEGA",
+  "iot_standards": ["zigbee"]
+}
@@ -0,0 +1,5 @@
+{
+  "domain": "cloudflare",
+  "name": "Cloudflare",
+  "integrations": ["cloudflare", "cloudflare_r2"]
+}
@@ -1,5 +1,5 @@
 {
  "domain": "denon",
  "name": "Denon",
-  "integrations": ["denon", "denonavr", "heos"]
+  "integrations": ["denon", "denonavr", "denon_rs232", "heos"]
 }
@@ -2,6 +2,7 @@
  "domain": "google",
  "name": "Google",
  "integrations": [
+    "google_air_quality",
    "google_assistant",
    "google_assistant_sdk",
    "google_cloud",
@@ -15,6 +16,7 @@
    "google_tasks",
    "google_translate",
    "google_travel_time",
+    "google_weather",
    "google_wifi",
    "google",
    "nest",
@@ -0,0 +1,5 @@
+{
+  "domain": "heatit",
+  "name": "Heatit",
+  "iot_standards": ["zwave"]
+}
@@ -0,0 +1,5 @@
+{
+  "domain": "heiman",
+  "name": "Heiman",
+  "iot_standards": ["matter", "zigbee"]
+}
@@ -1,5 +1,5 @@
 {
  "domain": "honeywell",
  "name": "Honeywell",
-  "integrations": ["lyric", "evohome", "honeywell"]
+  "integrations": ["lyric", "evohome", "honeywell", "honeywell_string_lights"]
 }
@@ -1,5 +1,6 @@
 {
  "domain": "leviton",
  "name": "Leviton",
+  "integrations": ["decora_wifi"],
  "iot_standards": ["zwave"]
 }
@@ -1,5 +1,12 @@
 {
  "domain": "lg",
  "name": "LG",
-  "integrations": ["lg_netcast", "lg_soundbar", "lg_thinq", "webostv"]
+  "integrations": [
+    "lg_infrared",
+    "lg_netcast",
+    "lg_soundbar",
+    "lg_thinq",
+    "lg_tv_rs232",
+    "webostv"
+  ]
 }
@@ -0,0 +1,5 @@
+{
+  "domain": "marantz",
+  "name": "Marantz",
+  "integrations": ["marantz", "marantz_infrared"]
+}
@@ -13,6 +13,7 @@
    "microsoft",
    "msteams",
    "onedrive",
+    "onedrive_for_business",
    "xbox"
  ]
 }
@@ -0,0 +1,5 @@
+{
+  "domain": "mitsubishi",
+  "name": "Mitsubishi",
+  "integrations": ["melcloud", "mitsubishi_comfort"]
+}
@@ -1,5 +1,5 @@
 {
  "domain": "philips",
  "name": "Philips",
-  "integrations": ["dynalite", "hue", "philips_js"]
+  "integrations": ["dynalite", "hue", "hue_ble", "philips_js"]
 }
@@ -0,0 +1,5 @@
+{
+  "domain": "powerfox",
+  "name": "Powerfox",
+  "integrations": ["powerfox", "powerfox_local"]
+}
@@ -1,5 +1,5 @@
 {
  "domain": "raspberry_pi",
  "name": "Raspberry Pi",
-  "integrations": ["raspberry_pi", "rpi_camera", "rpi_power", "remote_rpi_gpio"]
+  "integrations": ["raspberry_pi", "rpi_power", "remote_rpi_gpio"]
 }
@@ -1,5 +1,5 @@
 {
  "domain": "samsung",
  "name": "Samsung",
-  "integrations": ["familyhub", "samsungtv", "syncthru"]
+  "integrations": ["familyhub", "samsung_infrared", "samsungtv", "syncthru"]
 }
@@ -0,0 +1,5 @@
+{
+  "domain": "sensereo",
+  "name": "Sensereo",
+  "iot_standards": ["matter"]
+}
@@ -0,0 +1,5 @@
+{
+  "domain": "trane",
+  "name": "Trane",
+  "integrations": ["nexia", "trane"]
+}
@@ -1,5 +1,13 @@
 {
  "domain": "ubiquiti",
  "name": "Ubiquiti",
-  "integrations": ["airos", "unifi", "unifi_direct", "unifiled", "unifiprotect"]
+  "integrations": [
+    "airos",
+    "unifi",
+    "unifi_access",
+    "unifi_direct",
+    "unifi_discovery",
+    "unifiled",
+    "unifiprotect"
+  ]
 }
@@ -0,0 +1,5 @@
+{
+  "domain": "ubisys",
+  "name": "Ubisys",
+  "iot_standards": ["zigbee"]
+}
@@ -0,0 +1,5 @@
+{
+  "domain": "victron",
+  "name": "Victron",
+  "integrations": ["victron_gx", "victron_ble", "victron_remote_monitoring"]
+}
@@ -1,11 +1,5 @@
 {
  "domain": "yale",
-  "name": "Yale",
-  "integrations": [
-    "august",
-    "yale_smart_alarm",
-    "yalexs_ble",
-    "yale_home",
-    "yale"
-  ]
+  "name": "Yale (non-US/Canada)",
+  "integrations": ["yale", "yalexs_ble", "yale_smart_alarm"]
 }
@@ -0,0 +1,5 @@
+{
+  "domain": "yale_august",
+  "name": "Yale August (US/Canada)",
+  "integrations": ["august", "august_ble"]
+}
@@ -0,0 +1,5 @@
+{
+  "domain": "zunzunbee",
+  "name": "Zunzunbee",
+  "iot_standards": ["zigbee"]
+}
@@ -1,7 +1,5 @@
 """Support for the Abode Security System."""

-from __future__ import annotations
-
 from dataclasses import dataclass, field
 from functools import partial
 from pathlib import Path
@@ -67,13 +65,16 @@ class AbodeSystem:
    logout_listener: CALLBACK_TYPE | None = None


+type AbodeConfigEntry = ConfigEntry[AbodeSystem]
+
+
 async def async_setup(hass: HomeAssistant, config: ConfigType) -> bool:
    """Set up the Abode component."""
    async_setup_services(hass)
    return True


-async def async_setup_entry(hass: HomeAssistant, entry: ConfigEntry) -> bool:
+async def async_setup_entry(hass: HomeAssistant, entry: AbodeConfigEntry) -> bool:
    """Set up Abode integration from a config entry."""
    username = entry.data[CONF_USERNAME]
    password = entry.data[CONF_PASSWORD]
@@ -99,49 +100,54 @@ async def async_setup_entry(hass: HomeAssistant, entry: ConfigEntry) -> bool:
    except (AbodeException, ConnectTimeout, HTTPError) as ex:
        raise ConfigEntryNotReady(f"Unable to connect to Abode: {ex}") from ex

-    hass.data[DOMAIN] = AbodeSystem(abode, polling)
+    entry.runtime_data = AbodeSystem(abode, polling)

    await hass.config_entries.async_forward_entry_setups(entry, PLATFORMS)

-    await setup_hass_events(hass)
-    await hass.async_add_executor_job(setup_abode_events, hass)
+    await setup_hass_events(hass, entry)
+    await hass.async_add_executor_job(setup_abode_events, hass, entry)

    return True


-async def async_unload_entry(hass: HomeAssistant, entry: ConfigEntry) -> bool:
+def _shutdown_client(abode: Abode) -> None:
+    """Shutdown client."""
+    abode.events.stop()
+    abode.logout()
+
+
+async def async_unload_entry(hass: HomeAssistant, entry: AbodeConfigEntry) -> bool:
    """Unload a config entry."""
    unload_ok = await hass.config_entries.async_unload_platforms(entry, PLATFORMS)

-    await hass.async_add_executor_job(hass.data[DOMAIN].abode.events.stop)
-    await hass.async_add_executor_job(hass.data[DOMAIN].abode.logout)
+    await hass.async_add_executor_job(_shutdown_client, entry.runtime_data.abode)

-    hass.data[DOMAIN].logout_listener()
-    hass.data.pop(DOMAIN)
+    if logout_listener := entry.runtime_data.logout_listener:
+        logout_listener()

    return unload_ok


-async def setup_hass_events(hass: HomeAssistant) -> None:
+async def setup_hass_events(hass: HomeAssistant, entry: AbodeConfigEntry) -> None:
    """Home Assistant start and stop callbacks."""

    def logout(event: Event) -> None:
        """Logout of Abode."""
-        if not hass.data[DOMAIN].polling:
-            hass.data[DOMAIN].abode.events.stop()
+        if not entry.runtime_data.polling:
+            entry.runtime_data.abode.events.stop()

-        hass.data[DOMAIN].abode.logout()
+        entry.runtime_data.abode.logout()
        LOGGER.info("Logged out of Abode")

-    if not hass.data[DOMAIN].polling:
-        await hass.async_add_executor_job(hass.data[DOMAIN].abode.events.start)
+    if not entry.runtime_data.polling:
+        await hass.async_add_executor_job(entry.runtime_data.abode.events.start)

-    hass.data[DOMAIN].logout_listener = hass.bus.async_listen_once(
+    entry.runtime_data.logout_listener = hass.bus.async_listen_once(
        EVENT_HOMEASSISTANT_STOP, logout
    )


-def setup_abode_events(hass: HomeAssistant) -> None:
+def setup_abode_events(hass: HomeAssistant, entry: AbodeConfigEntry) -> None:
    """Event callbacks."""

    def event_callback(event: str, event_json: dict[str, str]) -> None:
@@ -178,6 +184,6 @@ def setup_abode_events(hass: HomeAssistant) -> None:
    ]

    for event in events:
-        hass.data[DOMAIN].abode.events.add_event_callback(
+        entry.runtime_data.abode.events.add_event_callback(
            event, partial(event_callback, event)
        )
@@ -1,7 +1,5 @@
 """Support for Abode Security System alarm control panels."""

-from __future__ import annotations
-
 from jaraco.abode.devices.alarm import Alarm

 from homeassistant.components.alarm_control_panel import (
@@ -9,22 +7,20 @@ from homeassistant.components.alarm_control_panel import (
    AlarmControlPanelEntityFeature,
    AlarmControlPanelState,
 )
-from homeassistant.config_entries import ConfigEntry
 from homeassistant.core import HomeAssistant
 from homeassistant.helpers.entity_platform import AddConfigEntryEntitiesCallback

-from . import AbodeSystem
-from .const import DOMAIN
+from . import AbodeConfigEntry
 from .entity import AbodeDevice


 async def async_setup_entry(
    hass: HomeAssistant,
-    entry: ConfigEntry,
+    entry: AbodeConfigEntry,
    async_add_entities: AddConfigEntryEntitiesCallback,
 ) -> None:
    """Set up Abode alarm control panel device."""
-    data: AbodeSystem = hass.data[DOMAIN]
+    data = entry.runtime_data
    async_add_entities(
        [AbodeAlarm(data, await hass.async_add_executor_job(data.abode.get_alarm))]
    )
@@ -1,7 +1,5 @@
 """Support for Abode Security System binary sensors."""

-from __future__ import annotations
-
 from typing import cast

 from jaraco.abode.devices.binary_sensor import BinarySensor
@@ -10,23 +8,21 @@ from homeassistant.components.binary_sensor import (
    BinarySensorDeviceClass,
    BinarySensorEntity,
 )
-from homeassistant.config_entries import ConfigEntry
 from homeassistant.core import HomeAssistant
 from homeassistant.helpers.entity_platform import AddConfigEntryEntitiesCallback
 from homeassistant.util.enum import try_parse_enum

-from . import AbodeSystem
-from .const import DOMAIN
+from . import AbodeConfigEntry
 from .entity import AbodeDevice


 async def async_setup_entry(
    hass: HomeAssistant,
-    entry: ConfigEntry,
+    entry: AbodeConfigEntry,
    async_add_entities: AddConfigEntryEntitiesCallback,
 ) -> None:
    """Set up Abode binary sensor devices."""
-    data: AbodeSystem = hass.data[DOMAIN]
+    data = entry.runtime_data

    device_types = [
        "connectivity",
@@ -1,7 +1,5 @@
 """Support for Abode Security System cameras."""

-from __future__ import annotations
-
 from datetime import timedelta
 from typing import Any, cast

@@ -12,14 +10,13 @@ import requests
 from requests.models import Response

 from homeassistant.components.camera import Camera
-from homeassistant.config_entries import ConfigEntry
 from homeassistant.core import Event, HomeAssistant
 from homeassistant.helpers.dispatcher import async_dispatcher_connect
 from homeassistant.helpers.entity_platform import AddConfigEntryEntitiesCallback
 from homeassistant.util import Throttle

-from . import AbodeSystem
-from .const import DOMAIN, LOGGER
+from . import AbodeConfigEntry, AbodeSystem
+from .const import LOGGER
 from .entity import AbodeDevice

 MIN_TIME_BETWEEN_UPDATES = timedelta(seconds=90)
@@ -27,11 +24,11 @@ MIN_TIME_BETWEEN_UPDATES = timedelta(seconds=90)

 async def async_setup_entry(
    hass: HomeAssistant,
-    entry: ConfigEntry,
+    entry: AbodeConfigEntry,
    async_add_entities: AddConfigEntryEntitiesCallback,
 ) -> None:
    """Set up Abode camera devices."""
-    data: AbodeSystem = hass.data[DOMAIN]
+    data = entry.runtime_data

    async_add_entities(
        AbodeCamera(data, device, timeline.CAPTURE_IMAGE)
--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .13
 .14.5