Skip to content

v1.3.3 — Hardened API validation & public-release CI

Choose a tag to compare

View all tags
@CaputoDavide93 CaputoDavide93 released this 10 Aug 10:34
· 33 commits to main since this release
v1.3.3
b71b79e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Hardening release: exact-origin API-link validation, a public-release CI pipeline, and the fixes from an adversarial review of the hardening itself.

Security & correctness

  • Exact-origin HATEOAS validation — discovered API links are accepted only on https://www.mixergy.io (default port, no embedded credentials); redirects are never followed, and a permanent redirect on a cached endpoint now clears the discovery cache so an endpoint rotation self-heals on the next poll.
  • Malformed discovered URLs raise a clean MixergyConnectionError instead of an untyped ValueError.
  • Invalid heat-source writes fail before any network request; the allowlist is derived from the enum.
  • Diagnostics survive a config entry that failed before its coordinator loaded.
  • UnitOfRatio.PERCENTAGE on HA 2026.7+, value-identical fallback on the 2025.8 floor.
  • Polling-interval help text corrected to 30–300 s in every locale (it/de/fr), with a guard test parametrised over all of them.

CI

  • Every change now tests the advertised minimum HA 2025.8.0 and current HA 2026.8.1; a weekly latest-HA canary asserts it truly resolved the newest core release.
  • GitHub Actions pinned to immutable commits, read-only tokens, repository-hygiene tests (both workflow extensions, job-level permission widening rejected).
  • Security policy + private vulnerability reporting; Dependabot enabled.

Brand

  • Banner wordmark now Mixergy Home Assistant; canonical repository name Mixergy-Home-Assistant across all badges and links.

91/91 tests green on HA 2025.8.0 and 2026.8.1. Requires Home Assistant 2025.8.0 or newer.

Assets 2
Loading