3.8.0

This is the stable 3.8.0 release. It consolidates everything shipped and hardened across the 3.8.0 beta series — all changes below are relative to the previous stable release, 3.7.4.

Highlights

• Entity tiles now use the Material Design icons Home Assistant supplies for each entity, with user overrides and domain icons as fallbacks.
• Separate Time Format and Date Format settings, a Weather source picker, and an accent-colour glow on tiles that are on.
• Profile Sync: Dropbox and OneDrive providers, safer conflict handling, automatic backups before applying remote profiles, and many races fixed.
• A long list of Quick Access camera preview fixes: no more wiped frames, honest LIVE/SNAPSHOT badges, bounded retries, and unavailable cameras handled gracefully.
• Weather icons are now bundled, deterministic SVGs that follow your theme colour on every platform.
• Linux Wayland: position and opacity work again via XWayland by default, with automatic fallback to native Wayland.
• Complete Arabic, Simplified Chinese, French, Hindi, and Spanish language packs.
• Hardened release pipeline, default-deny Electron permission policy, and an SSRF-safe media artwork proxy.

Added

• Settings > Personalization: separate Time Format (System default / 12-hour /
  24-hour) and Date Format (System default / Weekday, short date / Long date / Numeric
  date) settings, replacing the single "Use 24-hour clock" checkbox. A profile that had
  the 24-hour clock switched on keeps it; one that never changed it follows your language
  and region setting exactly as before.

• Settings > Home Assistant Connection: a Weather source list of the weather.
  entities Home Assistant is reporting, so the weather card's source no longer has to be
  found by long-pressing the card itself. A saved source that goes unavailable is kept and
  labelled rather than discarded, and the card falls back to the first available source
  until it returns.

• Quick Access: tiles whose entity is currently on now carry a subtle glow in your accent
  colour, so a switch, light, fan, player, cover, climate or vacuum that is running reads
  at a glance instead of only from its label. Read-only tiles (sensors, cameras,
  calendars, buttons) never glow. Toggle it under Personalization > Window Effects with
  "Glow tiles that are on"; it is on by default.

• Profile Sync: Dropbox and OneDrive are selectable providers, each suggesting the folder
  the installed client actually uses rather than assuming the default location.

• Profile Sync: warns when the chosen folder is this device's local app data folder, which
  syncs with nothing — previously that setup reported success while sharing no data.

• Profile Sync: warns when conflict copies from Syncthing, Dropbox, OneDrive or Drive
  appear next to the sync file, which means two devices saved at the same time.

• Profile Sync: warns that Google Drive has no official Linux client and points at
  Syncthing instead.

• Profile Sync: syncs when the widget regains focus and after the machine wakes from
  sleep, rather than only on the background interval, so changes from another device show
  up sooner. Rate limited to once a minute.

• Profile Sync: failed sync attempts no longer make the local profile look freshly
  edited. The app now tracks when profile content actually changed separately from when
  sync last ran, so a device that repeatedly failed to sync (for example, waiting for an
  encryption passphrase) can no longer silently overwrite newer changes from another
  device.

• Profile Sync: startup sync now compares content timestamps and keeps whichever side is
  newer, instead of always pulling and discarding edits made while offline.

• Profile Sync: interrupted sync-file writes now clean up their temporary file.

• Packaged smoke-test mode now uses an isolated temporary profile, opens the real
  window and tray, waits for a trusted renderer-ready handshake, and cleans up its
  profile. CI exercises the packaged Windows, macOS, and Linux applications with
  bounded timeouts.

• Electron sessions now use a default-deny permission policy. Only top-level
  notifications from the trusted local renderer are allowed; media capture, display
  capture, hardware devices, and chooser-based grants are rejected.

• Profile Sync key and encryption changes now use a recoverable, exact-envelope
  transaction with OS-encrypted old and new credentials, endpoint and remote-identity
  checks, identity-checked replacement, and restart recovery at every commit boundary.

Changed

• Production dependency security findings in the Linux D-Bus shortcut chain were
  remediated without removing Wayland portal support. The runtime-reachable XML parser is
  pinned to a patched release, the optional Unix-socket binding no longer brings the
  deprecated request stack into production installs, and its build-time archive tooling
  is updated past the audited vulnerable ranges.

• Desktop pins: the timer tile was rebuilt around the countdown. The icon, the duplicated
  "Timer" caption and the inner panel are gone; the remaining time now scales to fill the
  tile under the timer's name, with the finish time below it, a pulse dot while it runs,
  and a bar along the bottom edge showing how much is left when Home Assistant reports a
  total duration. Timers that are not running are labelled instead (Paused / Finished /
  Idle), and the tile warms to a warning tint for the last minute.

• Profile Sync: before a remote profile is applied, the previous local profile is backed
  up to profile-sync-backups/ in the app data folder (last 5 kept).

• Profile Sync: encryption passphrases must now be at least 8 characters (previously 4).

• Profile Sync: encryption key derivation no longer blocks the main process, and sync
  runs skip the redundant encryption work they previously did up front.

• Profile Sync: new device IDs are fully random instead of derived from the computer
  name, so the shared sync file no longer hints at your hostname.

• Profile Sync: choosing the Google Drive, iCloud Drive, or Syncthing provider now
  suggests that provider's local folder when one exists.

• Profile Sync: sync-file copies are restricted to folders you selected, the configured
  sync folder, or the app data folder on both ends (previously only one end was checked).

• Entity tiles now adopt explicit Material Design icons supplied by Home Assistant,
  while preserving user icon overrides and the existing domain icons as fallbacks.

• Release automation now requires a successful CI run for the exact release commit,
  validates tag ancestry and identity, checks out the validated SHA for every build and
  publish job, and revalidates the remote tag immediately before publication. Nightly
  and tag entry points dispatch the immutable tag rather than a mutable branch.

• In-app update installation is limited to the Windows installer and Linux AppImage.
  Portable, macOS, and Linux deb builds now use a truthful GitHub Releases download
  flow; macOS remains ad-hoc signed and is not notarized.

• Arabic, Chinese, French, Hindi, and Spanish packs are complete for the current
  English catalog, include command/control accessibility text, and can recover safely
  from missing, stale, or invalid downloaded packs.

• Packaged applications include the project MIT license and exclude development-only
  climate fixtures. Development dependency overrides were tightened so full and
  production audits can be evaluated separately.

Fixed

• Weather conditions now use bundled, deterministic SVG icons instead of platform-native
  emoji. All Home Assistant weather states, including fog, clear night, mixed
  precipitation, hail, lightning and wind, have an explicit icon; the icons inherit the
  theme's primary text colour so they remain visible in dark, light and custom-colour
  themes. The humidity and wind indicators no longer depend on native emoji either.

• Quick Access camera previews: a snapshot that fails to load no longer wipes the picture
  the tile is already showing. Snapshots now decode into a spare buffer and only replace
  the visible frame once they succeed, so a camera that times out once keeps its last
  frame and says "Showing last frame" instead of dropping to a placeholder icon for
  thirty seconds.

• Quick Access camera previews: a tile that scrolls out of view and back, or a window
  that regains focus, no longer refetches immediately. Both now respect the refresh
  interval you chose, so "Snapshot every 30 seconds" means that even while scrolling.
  Several cameras resuming at once are also staggered rather than fired simultaneously.

• Quick Access camera previews: the badge no longer claims "LIVE" while a still image is
  on screen. It says "SNAPSHOT" whenever the tile has fallen back, and the status text is
  short enough to fit the tile instead of being cut off mid-sentence.

• Quick Access camera previews: cameras Home Assistant reports as unavailable are no
  longer polled. The tile says "Camera unavailable", keeps its last frame dimmed rather
  than blanking, and resumes on its own when the camera comes back.

• Quick Access camera previews: a camera whose live stream cannot start is retried on a
  widening schedule (30s, 1m, then every 5 minutes) instead of every 30 seconds forever,
  and gives up on a stream sooner once it has failed before. Snapshot failures back off
  the same way. The snapshot fallback keeps refreshing on its normal cadence throughout,
  so the picture stays as current as the camera allows.

• Quick Access camera previews: live tiles now show a still image while the stream is
  negotiating rather than a bare camera icon, and portrait camera feeds are cropped
  towards the top so faces are not cut off in a landscape tile.

• Camera viewer: the full-screen viewer now closes on Escape, moves focus to its close
  button and back to whatever opened it, and is exposed to screen readers as a dialog. A
  snapshot that fails to load reports the failure instead of leaving a broken image.

• Camera streams: an MJPEG stream that stops sending frames is now ended rather than left
  open, so a frozen first frame is no longer presented as a live picture. Home Assistant
  stream playlists that never arrive are also given a bounded retry instead of holding a
  connection open until the preview gives up on its own.

• Diagnostics: renderer warnings now reach the log file, protocol errors name the request
  that failed (with stream tokens redacted), and a camera that returns the same image over
  and over is called out once in the log — that pattern means the integration is serving a
  cached frame, which otherwise looks identical to a working camera.

• Desktop pins: pinned tiles that are drawn from the clock rather than from entity
  updates — timer countdowns and media progress — now tick locally instead of freezing
  between Home Assistant state changes.

• Desktop pins: a pinned timer no longer shows its raw timestamp state (e.g.
  2026-07-24T19:51:57-02:30) across the top of the tile. It now shows a short status
  badge (Running / Paused / Idle / Finished), and the entity name stays visible so
  several pinned timers can be told apart at a glance.

• Profile Sync: the first settings change after pulling a remote profile now auto-pushes
  again. Previously a stale internal flag swallowed that push until the next change or
  the 5-minute interval. The app now recognises the redundant post-pull update by its
  content rather than by how soon it arrives, so a genuine edit made immediately after a
  pull is pushed straight away.

• Profile Sync: a redundant post-pull update can no longer be mistaken for a newer local
  edit and pushed over the profile that was just pulled.

• Profile Sync: a settings update already in flight when a remote profile arrives no
  longer quietly reverts that profile on the receiving device.

• Profile Sync: choosing a sync folder no longer probes for the provider's default folder
  on the main thread, so the folder picker cannot stall the window.

• Profile Sync: the sync file is re-checked immediately before it is overwritten, so a
  change saved by another device in the meantime is no longer silently discarded.

• Profile Sync: the Google Drive folder suggestion now finds current installs on macOS
  (~/Library/CloudStorage) and Windows (G:\My Drive), instead of only the long
  retired ~/Google Drive layout.

• Language packs: Arabic, Simplified Chinese, French, Hindi and Spanish were translated
  when the app had 172 strings and had not been updated since, leaving them at 46%
  coverage — everything added over the last few months, including onboarding, Quick
  Access pages, comparison graphs, tile settings and camera previews, fell back to
  English. All five packs are now complete at 343 strings and bumped to 1.1.0, so anyone
  with a pack installed will be offered an update.

• The popup hotkey now lands above full-screen windows instead of flashing and dropping
  behind them. Full-screen video players re-raise themselves for a frame or two after the
  widget appears, so the raise is held for the life of the popup and released when it
  hides, rather than being applied once and immediately reverted. Showing the widget from
  the tray icon, the tray menu, or Open Settings goes through the same path, and a
  temporary raise no longer overwrites your always-on-top preference.

• A saved window position that points at a monitor which is no longer connected, or at
  empty space between monitors, no longer opens the widget where nothing can see it. It is
  moved onto the nearest display instead.

• Linux Wayland: the widget now runs through XWayland by default, so it keeps the position
  you gave it across hide/show and restarts and the opacity setting works again — a
  Wayland compositor ignores both. If the GPU process cannot start under XWayland, the app
  relaunches itself on the native Wayland backend, records that so later starts skip the
  attempt, and says so in the log. Set HA_WIDGET_LINUX_NATIVE_WAYLAND=1 to opt out. See
  docs/linux-wayland-notes.md, which also has the KWin rule that keeps the position on a
  native Wayland session.

• Launching the widget while it is already running now shows the existing window instead
  of starting a second tray icon and window. Two instances shared one configuration file
  and overwrote each other's settings depending on which saved last. This is also the way
  back to a window hidden to a tray that is missing or broken.

• The climate control dialog no longer offers controls the entity does not advertise. A
  climate entity with no target temperature, no HVAC modes, or no fan/preset modes gets
  those sections omitted rather than shown with invented defaults, and says so when it
  supports nothing the widget can change. The temperature slider also follows the step
  size the entity reports (target_temp_step) instead of always moving in half degrees,
  and mode names like fan_only are labelled "Fan Only".

• Configuration mutations are serialized and acknowledge the exact durable snapshot
  requested. Failed writes restore the authoritative config, post-save runtime failures
  are reported separately, corrupt config recovery is explicit, and shutdown captures
  pending window and desktop-pin bounds before the final synchronous flush.

• Profile Sync now keeps first-enable conflict gates durable across restarts and errors,
  rechecks remote identity before either conflict choice, rejects vanished provider
  mounts, preserves a pre-pull recovery copy, distinguishes unlock from rekey, and
  prevents timestamp, passphrase, endpoint, or shutdown races from overwriting unseen
  remote or local changes.

• Quick Access pages, order, tiles, comparison graphs, and weather selection now send
  narrow owned patches, consume the authoritative response, roll back failed optimistic
  changes, serialize editor mutations, and show success only after persistence.

• Native Wayland no longer rewrites compositor-owned positions, handles hide-to-tray
  semantics explicitly, and distinguishes native Wayland from user-selected X11.
  Portal shortcuts rebind transactionally, reconnect after portal loss, and reject stale
  activations after a shortcut is removed.

• Popup, entity, and portal hotkeys now require modifiers, unregister the intended
  target, release temporary elevation reliably, and report rollback failures instead of
  claiming a binding was restored.

• Renderer state now removes deleted entities, prevents stale first-run and config
  snapshots from overwriting newer state, disposes replaced connections and camera
  streams, and rejects stale to-do responses.

• Climate, media, timer, to-do, desktop-pin, command-palette, and modal controls now
  honor advertised capabilities, roll back failed actions, support keyboard operation,
  restore focus, and expose localized accessible names and state.

Security

• External media artwork proxy requests now reject private, loopback, link-local,
  reserved, credential-bearing, and unsafe redirected targets, including DNS rebinding
  attempts.
• CI workflows declare least-privilege permissions, run the full dependency audit, and
  prevent release assets from being published from an unvalidated or moving source.

Known limitations

• macOS artifacts are universal builds but are temporarily not signed with an Apple
  Developer ID and are not notarized. The packaging step applies only an ad-hoc
  integrity signature; it does not establish the developer's identity or satisfy
  Gatekeeper. On first launch macOS may say it cannot verify the developer and block the
  app. If the app came from this project's official GitHub Releases page, Control-click
  the app and choose Open, or use System Settings > Privacy & Security > Open
  Anyway. Do not bypass Gatekeeper for copies obtained elsewhere.