v1.0.24

Highlights

• Your language everywhere: the card, entity names, attributes, error messages and the panels' names follow Home Assistant's language, English or Italian (#178).
• Reconfigure with a new pairing QR from the integration's ⋮ menu, without deleting it: entities, automations and options stay (#196).
• A repair tells you when the intercom refuses Home Assistant's registration (403/404), for example after another phone was paired on Home Assistant's slot, and how to pair again (#197).
• "Call Home (indoor)" rings the indoor monitor: it now calls the apartment's PICG instead of a fixed 55002 (#198) — see "Before you update".
• Video in calls no longer depends on the QR's VIDEO field, which in the Vimar apps only rules the ring preview (#204) — see "Before you update".

⚠ Before you update:

• the displayed entity names change (for example "Intercom Stato" becomes "Vimar Intercom Stato"); automations and dashboards that use entity_ids keep working, names you renamed yourself stay as they are, and only templates that read friendly_name may need a look (#191)
• the nota attribute now holds a short key (for example since_integration_start) instead of an Italian sentence; it is still shown as a sentence in Home Assistant, but a template that read its text must be updated (#194)
• on any install not in Italian the panel names change (for example "Targa Esterna" becomes "Entrance panel"); an automation or template that compared them to the Italian name must use the new one or the SIP id (chiamante_id, target_id) (#195)
• if "Call Home (indoor)" does not ring your indoor monitor, you may have 55002 stored from an earlier version (the settings form used to fill it in): run Configure → Find indoor monitor and confirm the proposed PICG, or clear the field. If it works for you with no target set, check it after updating: an empty field now calls the PICG; to keep 55002, set it there (#198).
• if your entrance panel really has no camera, turn off "Enable video in outgoing calls" (Configure → Network and actuators) after updating: a pairing QR with VIDEO=0 no longer turns it off. If your QR had VIDEO=0 and you ever saved that settings page, the switch was saved off: turn it on to get video (#204).

Enhancements

• The dashboard card, its visual editor and its card picker entry follow your Home Assistant language: Italian for Italian, English for every other language (#178) (#187)
• Entity names follow your Home Assistant language (English or Italian) and start with the device name, e.g. "Vimar Intercom Status"; entity_ids do not change (#178) (#191)
• Error messages from the buttons, the voicemail settings, the setup and the options follow your Home Assistant language (#178) (#193)
• Entity attributes are shown with names in your Home Assistant language, and the example package also comes in English (#178) (#194)
• The names of the plant's panels and monitor (Last caller, caller and panel attributes) follow your Home Assistant language (#178) (#195)
• Reconfigure (⋮ menu of the integration) takes a new pairing QR without deleting the integration: entities, automations and options stay (#196).
• When the intercom refuses Home Assistant's registration (403 or 404), a repair now says so and explains how to pair again, instead of the entities just going unavailable (#197).

Bug fixes

• A phone running the Video Door app on the same plant is no longer detected as an "Elvox Pixel" entrance panel (#190).
• Only the intercom's system messages (Panda: blue) are read: a text message can no longer change Do Not Disturb or voicemail, and a message with several commands, one per line, is read in full. The Last received message sensor no longer shows text messages (#192).
• "Call Home (indoor)" and "Find indoor monitor" use the apartment's PICG, which rings the indoor monitor, instead of a fixed 55002 that some intercoms reject (#198).
• On a page opened over HTTP the card's Audio button now says it needs HTTPS instead of doing nothing (#200).
• Reconfigure refuses a QR that belongs to another configured intercom instead of moving the entry onto it (#201).
• Over the cloud, the intercom's status request waits for the relay's slower answer and is no longer sent again at every registration renewal (#202).
• A pairing QR with VIDEO=0 no longer takes video out of the calls Home Assistant makes: in the Vimar apps that field only rules the preview while it rings (#204).

Documentation

• Record additional Tab 7S Up 40517 local-call refusals, development QR policy and same-VLAN VIEW cloud routing observations (#184).
• The Open door service no longer labels 55001 and 55002 as outdoor and indoor panel: they are only examples, the right address comes from the phonebook (#188).

Security

• Debug logs also hide other phones' 5-digit SIP ids (6xxxx), in SIP addresses and in plant messages; panels' extensions and the protocol's own addresses (60000-60002, 61000) stay readable (#203).

Other changes

• Reconfigure and the intercom's new address reload the integration through its update listener, as Home Assistant 2026.12 requires (#199).
• Tests no longer contain values of the development plant, and a guard keeps them out (#201).

v1.0.23

Highlights

• Better support for plants where the indoor monitor is not the SGA (e.g. a Tab 7S Up 40517): Configure → Find indoor monitor proposes the monitor the plant declares as Call Home destination, and nothing is saved until you confirm.
• Video in outgoing calls can now be switched on or off in the settings: if View outside connects with audio only ("Stream has no video") although the entrance has a camera, enable it.
• Clearer phonebook import: the cloud download tells a missing status reply apart from a missing token, and the import summary shows the real source and keeps SGA and PICG changes separate.

Thanks to @andreacasarin for all four changes and for testing them on a 40517.

Enhancements

• Propose a declared PICG as the Call Home destination when it differs from the SGA, preserving the current destination otherwise and distinguishing unavailable lookups from missing replies (#173).
• Enable or disable video in outgoing intercom calls from Settings, including when the pairing QR initially disables it (#175).

Bug fixes

• Cloud phonebook downloads distinguish an unanswered status request from a status reply without a token, with guidance to check the PICG address (#171).
• Phonebook import confirmation displays the correct source and no longer suggests that changing the SGA overwrites an independently configured PICG (#174).

v1.0.22

Highlights

• Smoother video over the Vimar cloud: the panel is back to 256 kbit/s by default when HA connects through the cloud, while local UDP stays at 2 Mbit/s. A new "Video quality from the panel" setting lets you pick Automatic, 256 kbit/s or 2 Mbit/s (see Before you update).
• A more accurate ring history in the card: a ring answered in the Vimar app (or on the indoor monitor, on plants that report it) shows as "Risposto altrove", and a ring where you opened the door from Home Assistant shows as "Aperto" instead of "Rifiutato".

⚠ Before you update:

• If your video was fine at 2 Mbit/s over the cloud (e.g. a Tab 5S Up 40515), set "Video quality from the panel" to 2 Mbit/s in the settings (#161).

Bug fixes

• Over the cloud the panel's video is back to 256 kbit/s by default: 2 Mbit/s smeared, froze and lagged on a Tab 7S Up 40517. A new setting, "Video quality from the panel", picks Automatic (2 Mbit/s on local UDP, 256 kbit/s over the cloud), 256 kbit/s or 2 Mbit/s (#161).
• A ring answered on the indoor monitor or in the Vimar app now shows as "Risposto altrove" in the card's ring history instead of "Nessuna risposta" (on plants that report it, like the 40517) (#165).
• "Risposto altrove" in the ring history no longer depends on the order of the values in the panel's Reason header, and a ring answered from HA (or by the away message) is never relabelled as answered elsewhere afterwards (#166).
• A ring where you opened the door from Home Assistant now shows as Aperto in the card history, instead of Rifiutato when you close the popup afterwards (#170).

Documentation

• The README says that Wi-Fi kits using the View Door app (e.g. K40955) are not supported (#169).

v1.0.21

Highlights

• Logs now hide most of your plant's data: IP addresses, SIP ids (yours and the other phones'), the apartment GID, the MAC, the SIP domains and the names. Still read a log before posting it, and never attach the pairing QR code.
• On Home Assistant running on Windows, the away message upload can no longer be made to write outside its folder through a symlink.
• New troubleshooting guide by symptom, and a page on how to get your plant's phonebook (intercom, cloud, file or by hand).

Documentation

• The entity list in the docs now covers every entity and action, with the key at the end of each unique id (#156).
• New troubleshooting table by symptom and a phonebook guide (which way works on your plant: intercom, cloud, file, by hand); clearer setup texts on the pairing QR and the SIP credentials (#144) (#158).
• The troubleshooting guide lists the plant data the logs now mask (addresses, SIP ids, GID, …), what is not masked yet, and that the pairing QR code must never be attached to an issue (#162).

Security

• Debug logs now also mask the plant's private IP addresses, the account's SIP id, IMEI and device name, and names and caller ids from the phonebook, so a log needs far less cleaning before it is shared in an issue (#157).
• The logs now also mask the other phones' ids in SIP addresses, public addresses in the Via header and in SIP addresses without a user, and the apartment GID (#159).
• On Home Assistant running on Windows, uploading the away message no longer writes through a symlink left in the messages folder (follow-up to #91) (#160).

Other changes

• ci: bump actions/checkout from 4 to 7 (#150)
• ci: bump actions/setup-python from 5 to 7 (#151)
• chore: bump the dev-tools group with 7 updates (#152)
• Code kept for Home Assistant versions older than 2025.10 removed (#155)
• A test keeps docs/ENTITIES.md in line with the entities and actions in the code (#156).

v1.0.20

Highlights

• More reliable over the cloud. A stray packet from the relay no longer freezes the camera, go2rtc, Frigate or HomeKit picture, calls no longer lose audio and video when the relay jumps packet numbers, and the status sensor no longer goes "offline" in the middle of a call (#119, #121, #122).
• The door opens once, and says so honestly. Over the cloud it no longer sends a second open command after a timeout, and a relay that only queued the command (202) is no longer reported as an open door. The same now applies to lights, relays and switches (#120, #139), which also wait 20 s over the cloud like the door (#143).
• Messages in your language. Door errors follow the Home Assistant language instead of always being in Italian (#132).
• Clearer microphone errors in the card. It tells you why the microphone can't start instead of doing nothing (#124).
• Faster ring photo. Taken from the first keyframe: about 3 s sooner, and also on panels that send a single keyframe per ring (#141).
• Less upload when you watch remotely. The card no longer receives every media twice (#142).
• New home. The project now lives in the ha-vimar organisation; old links and HACS keep working through GitHub's redirect (#136).
• Coming from the original noiseheroes integration? See the migration notes (#147).

⚠ Before you update:

• Home Assistant 2025.10 or newer is now required (#127)
• automations that read the open_door response (result) or the "Ultima Apertura" esito attribute now get a key instead of Italian text: opened, busy, queued, unconfirmed, not_registered, timeout, error or send_failed, plus the SIP code in code / codice (#132).
• automations reading the send_command response or the "Last Command" sensor get ok: false and queued where a 202 used to give ok: true and OK (202) (#139).

Enhancements

• The card no longer receives every media twice over the network: less upload from home when you watch the intercom remotely (#142).

Bug fixes

• The status sensor no longer goes "offline" in the middle of a call or a ring while a registration renewal is retried (#119).
• Opening the door over the cloud no longer sends a second open command after a timeout; the card asks you to wait before trying again (#120).
• A "202 Accepted" answer to a door command is no longer counted as an open door (#120).
• A stray video packet from the cloud relay no longer freezes the HA camera, go2rtc, Frigate or HomeKit picture for several seconds (#121).
• Video and audio no longer fail for the rest of a call when the cloud relay jumps the packet numbers right before a wrap, and reordered packets no longer move the SRTP window (#122).
• The card now says why the microphone can't start (permission denied, Home Assistant opened over HTTP, or no microphone in the app) instead of doing nothing (#124).
• Door command errors (lock, Open Door buttons, card) now follow the Home Assistant language instead of always being in Italian (#132).
• Light, relay and switch commands the cloud relay only queued (202) are no longer reported as done (#139).
• The ring photo is taken from the first keyframe, so it shows up about 3 s sooner and also on panels that send a single keyframe per ring (#141).
• Over the cloud, commands (phonebook actuators, voicemail and DND switches, voicemail delay, send_command) now wait 20 s like the door, so a late answer from the relay is no longer reported as a failure (#143).

Documentation

• docs(github): issue templates point to Discussions Q&A (#116)
• docs(contributing): version bump only in release PRs (#118)
• Links point to the new ha-vimar organisation (#136)
• Migration notes for users of the original noiseheroes integration (#147)

Other changes

• test(homekit): give the port reservation test its own clock (#117)
• ci: declare read-only permissions in the Validate workflow (#125)
• Changelog entries now come from the PR descriptions; PR template and CI check for them (#126)
• Home Assistant 2025.10 or newer is now required; CI runs on Python 3.13 and 3.14 (#127)
• Regression tests for cloud and local ring edge cases (renewal during a ring, forked and crossed CANCELs, retransmitted INVITE, two cards, crossed hang-ups) (#131)
• The open_door response and the last door sensor report a result key (opened, busy, timeout, ...) and the SIP code instead of Italian text (#132).
• Card upload tests follow the config entry lookup used since 1.0.19 (#133)
• The ring photo decoder now logs what it does (debug log), to help find why a ring sometimes has no photo (#134).
• GOVERNANCE.md and CODEOWNERS: roles, who tests what, reviews, releases (#137)
• Release notes and the changelog are composed from the PR descriptions (tools/release_notes.py) (#138)

v1.0.19

Highlights

• The door opens with your plant's own command (#58): the lock, the Open Door button, HomeKit and open_door now send the door actuator's MSG from your phonebook, as the VIEW app does, instead of a fixed OPEN_2F. It takes effect on update, with no new import. If your door stops opening, see the note under Fixed and please report it on #58.
• /av key (#63, @m4r1k's idea): plain /av (which calls the panel) now wants a Home Assistant user or the installation's key. The integration's camera adds it by itself; passive URLs for go2rtc, Frigate and Scrypted keep working without it for now (docs/EXTERNAL.md).
• Rings end when the panel gives up (#60): on local UDP an unanswered ring no longer goes on for 90 s.
• No call again after a hang-up when a dashboard is left open (#57).
• Passive /av stream (#87, @Apeiv): no frozen panel frame after a call, smoother cloud video, a lighter decoder, no more "bind failed".
• Sharper video from the 40515 (2 Mbit/s instead of 256 kbit/s) and correct colours in the card.
• Away message upload from the integration settings and from the card, and a Test ring button.
• Security: the low findings of #46 (SRTP replay window, bounded regexes, no links followed in the snapshot folder) and admin-only Test ring and upload.

Before you update: if you filter debug logs on custom_components.vimar_intercom.hub, the plant messages and ring media now log under ...plant_messages and ...ring_media.

Added

• Docs: clear the ring notification on the other phones (#99): a recipe in
  docs/ENTITIES.md (and the Italian page) that sends the ring notification with a fixed tag and clears it
  with clear_notification when the ringing binary sensor goes off, so nobody taps a ring that is already taken.
• Test ring button (diagnostic, on the device page): a 20 s test ring in one tap, the same as the
  simulate_ring service, to try your ring automations and notifications without writing YAML. It reports an
  error if a real call or ring is in progress.
• Upload the away message from the settings: a file field next to Message if nobody answers (audio file)
  takes an mp3, wav or m4a (max 5 MB), saves it in <media folder>/citofono/messaggi and makes it the away
  message. Only the file name is kept (no paths); a different file with the same name gets -2 added instead of
  being overwritten.
• Upload the away message from the card: in the card's Intercom settings, under Away message audio file,
  an Upload button (Replace when a file is already chosen) sends the file to the new admin-only
  POST /api/vimar_intercom/away_upload, with the same rules as the settings upload, and selects it. The old file
  stays in the folder. The file list now shows None (use the text) instead of none.

Changed

• Debug logs: the plant message parsing now logs under custom_components.vimar_intercom.plant_messages and
  the ring media under custom_components.vimar_intercom.ring_media, no longer under ...hub. Adjust your
  logger: entry if you filter on the old name.
• README: an Open in HACS button (My Home Assistant) and a last-commit badge; the release, downloads and
  stars badges are gone, since HACS already shows them at the top of the page.

Fixed

• Card popup, iPhone: closing it no longer taps the card underneath. The tap on X or Hang up also landed on the compact card that takes the popup's place: during a ring it hit Answer (the popup came back and the card answered), after a hang-up it reopened the popup and called the panel. For 0.8 s after the popup closes, taps on the compact card are ignored.
• Card popup: X during a ring means "not now". It sends nothing to the panel (the ring goes on for everyone else) and the popup no longer opens by itself again for that ring, whatever follows (answered elsewhere, call ended, the card rebuilt). A new ring opens it as before.
• Card: no black box while waiting for video. Until the first frame arrives the live view shows the doorbell icon and "In attesa del video…".
• Away message upload errors (#91): an expired upload showed the raw text
  "File does not exist" in the form; any failure other than a wrong type or a too big file now shows the
  translated File not saved error. An empty file or a name over 200 bytes is refused as a wrong file instead of
  failing with an error in the log.
• Live video from the 40515 was soft and choppy (16 fps, ~14 KB keyframes) because we asked the panel for 256 kbit/s. We now ask for 2 Mbit/s: it sends 25 fps at about 1.5 Mbit/s, same 720x576 picture. A keyframe is now a burst of about 40 packets, which filled the 64-packet cap of the reorder buffer before the 80 ms wait ran out and dropped the picture until the next keyframe, so the cap is now 512.
• Card video colours looked off (skin and sky tints): the panel's SD H.264 carries no colour info, so browsers assumed BT.709. The decoder is now configured with BT.601.
• A dashboard left open no longer calls the panel again ~10 s after a hang-up (#57): go2rtc and the stream worker reconnect to /av with a growing back-off, and each refused reconnect moved the 5 s quick-reopen window forward, so the first one more than 5 s apart placed a call. Now a reconnect from a viewer that was watching /av when the call ended waits the full 60 s pause. Opening the camera within the minute still calls if /av was not open at the end (for example after answering from the card), and HomeKit is unchanged. So a viewer that was watching /av when the call ended now gets 503 for up to 60 s instead of about 5 s, for example when reopening the camera right after the panel closes a view at 120 s. That is intended.
• An unanswered ring now ends when the panel stops ringing (#60): on local UDP the panel
  gives up without a CANCEL, so HA kept ringing up to 90 s and a late answer opened a dead call. The panel
  does stop its ring preview when it gives up: 3 s without any preview RTP now ends the ring (ring_ended, end
  webhook, the card closes) and a late answer finds no ring. A panel that sends no preview keeps the 90 s limit.
  Cloud TLS is unchanged: the relay sends CANCEL, and a gap in the preview there must not end the ring.
• Passive stream stuck on the last panel frame (#87) (/av?autocall=0&idle=image): after a call the stream could keep the panel's last frame until restart; the standby frame now comes back one second after the video ends.
• Choppy or frozen /av video on cloud plants (#87): the RTP forward reaches ffmpeg in arrival order, and with
  its default 0.1 s max_delay ffmpeg gave up on late packets ("max delay reached") and dropped frames. The
  input now waits up to 0.3 s (-max_delay 300000 -reorder_queue_size 1024). This can add up to 0.3 s of latency to /av.
• Passive stream load on Home Assistant (#87): the live decoder now hands over the 10 fps the encoder uses, not all 25 (about 11 MB/s of raw video on the event loop).
• "bind failed" after an /av client left mid-start (#87): an /av client leaving while ffmpeg was starting could leave that ffmpeg running with the UDP ports, and
  the next call's ffmpeg failed with "bind failed". It is now killed, and the next one waits until it is gone.
• /audio_ws state messages carry ringing: a client that connects while the panel is ringing (an Echo
  Show through Scrypted) now knows it and can watch instead of placing a call over the ring.
• Live video froze for up to 3 s after each keyframe on cloud plants: packets the relay delivered a few milliseconds out of order were treated as lost. The reorder buffer now waits up to 80 ms for a gap.
• The door is opened with your plant's own command (#58): the lock, the Open Door button,
  HomeKit's gate and open_door without command now send the MSG of the phonebook's door actuator for that
  panel, as the VIEW app does, instead of a fixed OPEN_2F. The body is taken only together with its panel, since
  a relay module can use the same body towards another one. Without a door actuator in the phonebook nothing
  changes (OPEN_2F, with a log line saying so). The Last Door Open sensor shows the command sent and where it
  came from (phonebook, default, explicit). Takes effect on update, without a new import: if the
  phonebook you already imported has a door actuator, its MSG is used from now on (for example OPEN instead
  of OPEN_2F). If the door stops opening, set that actuator's msg back to OPEN_2F in Options → Actuators
  (JSON), and please report it on #58. A row naming the panel wins over an AUTO row, and the "no door
  actuator" line is logged once per panel.

Security

• Test ring button is admin only (#85): it starts the same fake ring as the admin-only
  simulate_ring service (ring webhooks, announcements, automations), but any user could press it. Now a
  non-admin user gets Unauthorized; automations and scripts (no user) can still press it, like they can call the
  service.
• Away message upload never writes through a link (#91): the file is created with
  O_CREAT|O_EXCL|O_NOFOLLOW, so a dangling symlink (or a file that appears in the meantime, including a
  concurrent upload with the same name) is never...

v1.0.18

Highlights

• A shorter page in HACS: what the integration does, compatibility, installation in four steps and links; the full reference is now in docs/, in English and Italian (#69), with badges at the top (#71).
• HACS installs from a release zip (#72), attached by a workflow to every release: nothing changes for you, and the README can now show a download count.
• One slow card no longer delays the others (#67, @Apeiv): each audio WebSocket client has its own queue.
• simulate_ring is a whole test ring (#68, @Apeiv): ringing state, doorbell event and webhooks, then it ends by itself, with no SIP traffic.

Changed

• HACS installs from a release zip: every release gets vimar_intercom.zip attached by a workflow, and
  HACS downloads that instead of the source archive (zip_release). Nothing changes for users; it lets the
  README show a download count (installs and updates from the first release with a zip on).
• README badges: latest release, HACS, minimum Home Assistant version, test status, licence and stars.
• Documentation: the README (the page HACS shows) is now short: what the integration does, compatibility,
  installation in four steps, and links. The reference moved, unchanged, to docs/ in English and Italian:
  CONFIGURATION, ENTITIES, CARD, TROUBLESHOOTING, plus an Italian HOMEKIT page. Three statements
  were corrected on the way: the away message entities are admin-only since 1.0.17, the 40515's port 80
  refuses the connection, and how long "Vedi esterno" lasts depends on the plant.

Fixed

• One slow card no longer delays the others: each audio WebSocket client gets its own small
  queue and sender, so the voice and video loops never wait for a client's network. A client that
  falls too far behind drops its own backlog and gets video again from the next keyframe (#54).
• vimar_intercom.simulate_ring now simulates a whole ring (#33 item 14): the
  state goes to ringing (card popup, sensors, binary sensor), the doorbell event and the start
  webhook fire, and after duration seconds (default 20) it ends like an unanswered ring, end
  webhook included. Before, the end never came and a doorbell switch driven by the webhooks stayed
  on. Still no SIP traffic: Answer just ends it, the away message never answers it, a real ring
  replaces it, and it is not written to the ring log or counted in the stats.

v1.0.17

Highlights

• "View outside" right after hanging up works again on local UDP (#41, #44, @m4r1k): the view waits for the panel to settle and retries an unanswered call within the time a person waits. Field test on a 40507: 31/32 views with video.
• Card on iPhone and voice (#53, #54, #64, @Apeiv): no more smearing between keyframes on iOS, and the visitor's voice no longer crackles (reordered on the server over the cloud relay, resampled continuously in the card).
• Card fixes (#64): the popup opens for a call already in progress (#35), history photos reload after their signed link expires, a new idle_picture option.
• Security (#46, #52, #64, #65): an mDNS announcement can no longer move the intercom's address without your confirmation, linear-time log redaction, away message entities admin-only, card shortcut names escaped, /av's SDP in a private temp file.
• HomeKit (#45, #48, #56): views open faster, no more port collisions between ffmpegs, re-encoder frame delay down from ~340 to ~70 ms on a Pi 5.
• find_sga reports a cloud relay 202 Accepted as queued, not as an answer (#14, #62).

Added

• Card idle_picture option (also in the visual editor): last_ring (default) keeps the last
  ring's photo in the scene and the compact photo button at rest; standby shows the doorbell icon
  there instead. The photos stay in the history drawer.

Fixed

• /av's input SDP is written to a private temporary file (mode 0600, an unpredictable name) instead
  of a fixed, guessable path in the temp directory, and removed when ffmpeg is stopped.
• Card history photos and clips no longer stay broken behind an expired signed path: a photo or
  clip the browser fetches again after the ~30 s signature has expired (HA logged "Login attempt or
  request with invalid authentication" for /api/vimar_intercom/rings/*.jpg) is signed again once
  and reloaded.
• Card voice playback no longer clicks 50 times a second: the 8 kHz voice is resampled to the
  audio context's rate continuously across packets and low-passed at 3.6 kHz, and the playout
  buffer starts 120 ms ahead and grows by 40 ms at every underrun, up to 300 ms (#53).
• The visitor's voice clicked on the cloud relay: audio never looked at the RTP sequence number, so a
  packet lost or reordered on the way was skipped or played out of place. Audio is now put back in
  order like the video, duplicates are dropped, and a lost packet is filled with the previous 20 ms at
  half volume, and a source that restarts its sequence numbers is followed. The server keeps at most
  1 s of voice waiting instead of 4 s (#53).
• Card live video on iPhone no longer smears between keyframes: the WebCodecs decoder is fed
  AVC (an avcC description built from SPS/PPS, length-prefixed NAL units) instead of Annex B, is
  reconfigured only when SPS/PPS change, and runs with optimizeForLatency off on iOS (#53).
• Away message text and audio file can be changed by administrators only. The two entities
  were writable by any user who could call the service; a call with no user (automations) still works.
• Card shortcut buttons no longer inject markup: the friendly_name and icon of a button.*
  entity are escaped, and an icon not shaped like prefix:name falls back to the default.
• Card popup layout: the popup now opens when the card first sees a call already in progress
  (notification "Answer", app reopened after the ring), not only on ringing or with the anchor in
  the URL. A period that starts with calling (a tap on the card, HomeKit, Alexa) still needs the
  anchor (#35).
• "View outside" opened right after hanging up no longer fails after 25 s on local UDP (#41). The
  view waits for the panel to answer our BYE (at most 6 s) before calling it again. A call to the
  video panel (a view's, the card's "view outside", the call buttons) that the panel leaves
  unanswered is cancelled and tried again, within 21 s of the first try and 24 s of the tap
  (inside /av's 25 s): after 3 s when the panel's proxy said 100
  Trying and the panel never rang, else after 6 s. Every try waits until 5 s after the last call
  on the line (or our own cancelled try) ended: a 2-wire panel ignores an INVITE that comes
  sooner. Calls to a flat or the switchboard, and cloud plants, are unchanged. The 487 that ends our own cancelled INVITE is
  logged at DEBUG, and /av's "call not established" says how long it really waited.
• The card's Fill/Fit button (#42). It is hidden while the video and its box have the same shape
  (a 4:3 panel in the default 4:3 box), where filling and fitting draw the same picture and the
  button seemed to do nothing. When the card falls back to Home Assistant's picture card (no
  WebCodecs, or the card's player failed), the choice now reaches it as fit_mode.
• In cloud mode, finding the local IP resolved the proxy's name on the event loop, at setup and at
  every reconnect: with the network down (Home Assistant starting before the router) that DNS
  lookup froze every integration for seconds. It runs in the executor now.
• HomeKit: two ffmpegs starting together (the re-encoder and a view) could be handed overlapping
  loopback ports, and one logged "bind failed: Address in use". Every ffmpeg RTP input now gets an
  even port with the next one free (RTCP), and a pair handed out is not handed out again for 10 s.

Changed

• SRTP costs a quarter less per packet (28 µs instead of 38 µs for a video packet on a Raspberry
  Pi 5): the IV is one integer XOR, the AES-CTR cipher is set up without a Counter object, and the
  HMAC is copied from one keyed once. The bytes on the wire are the same (known-answer tests).
• The voice to the panel (the card's microphone, HomeKit's Talk, the away message) is μ-law encoded
  through a lookup table: 13 µs instead of 113 µs per 20 ms packet on a Raspberry Pi 5, the same
  bytes, on the event loop that also carries the call's video.
• HomeKit views open faster. The view's audio no longer waits for the video path (re-encoder and
  keyframe included), and with Smoother video on, the re-encoder starts while the view's call is
  still connecting instead of after its video arrives.
• find_sga reports a 202 Accepted as queued instead of exists: the cloud relay accepted the
  probe but no device took it, so nothing at that address can answer over the cloud (#14). The
  service's sip_timeout now goes up to 30 s, because over the relay that 202 can take ~15 s.

Security

• One crafted SIP datagram could stall Home Assistant for seconds: the Authorization pattern in
  log_redact was quadratic on a run of bare line feeds, and every received message goes through it
  on the event loop. The pattern now matches only spaces and tabs around the header name, and a log
  line longer than 16 KB is cut once it has been redacted (#46).
• A device on the local network could change the intercom's address in Home Assistant by announcing
  the Tab's MAC (which the Tab publishes) over mDNS with another address: REGISTER, door commands
  and calls then went there. A new address is now offered only when it is a private IPv4 address that
  the record announces as its own, and applied only after you confirm it under Discovered (#46).

1.0.16

Highlights

• Native HomeKit video doorbell (#32, @m4r1k), off by default. Turn it on in Options → HomeKit and pair it with the Home app using the QR or setup code shown there (administrators only). One accessory with ring notification and picture, live video, two-way audio (Talk) and the gate. Everyone in the Apple home gets video, Talk and the gate: the integration's allowed_users does not apply to them. Details in docs/HOMEKIT.md.
• The three libraries HomeKit needs (HAP-python, PyQRCode, base36) are installed only when you turn it on; with the option off nothing changes.
• Fixes: the admin probe of a panel no longer reports "Errore: 100" when the proxy challenges and then answers 100 Trying; saving the network settings no longer drops options that page does not show.
• For contributors (#40, @m4r1k): AGENTS.md, and CI now fails below 95% line and branch coverage.

Full list in the CHANGELOG.

Field check

With HomeKit off on a Tab 7S 2F+ 40507 (local UDP): ring answered with video during the ring, two-way audio, photo and clip with audio, "view outside": same as 1.0.15. The HomeKit accessory itself runs daily on a Tab 7S Up 40517 (2-wire V2, cloud) at @m4r1k's; it has not been tried on other plants yet, feedback welcome.

Known issue

Opening "view outside" right after hanging up a ring can fail after 25 s on 2-wire panels, which stay busy for a few seconds; a second try works (#41, fix in progress).

---

In breve

• Videocitofono HomeKit nativo (#32, @m4r1k), spento di default. Si attiva in Opzioni → HomeKit e si abbina all'app Casa col QR o il codice mostrati lì (solo amministratori). Un solo accessorio con notifica di squillo e foto, video dal vivo, audio nei due sensi (Parla) e cancello. Chiunque sia nella casa Apple vede il video, parla e apre il cancello: l'opzione allowed_users dell'integrazione per loro non vale. Dettagli in docs/HOMEKIT.md.
• Le tre librerie che servono a HomeKit (HAP-python, PyQRCode, base36) si installano solo quando lo attivi; con l'opzione spenta non cambia nulla.
• Correzioni: la verifica di un indirizzo dal pannello admin non segnala più «Errore: 100» quando il proxy chiede le credenziali e poi risponde 100 Trying; salvare le impostazioni di rete non cancella più le opzioni che quella pagina non mostra.
• Per chi contribuisce (#40, @m4r1k): AGENTS.md, e la CI fallisce sotto il 95% di copertura.

Prova sul campo

Con HomeKit spento su un Tab 7S 2F+ 40507 (UDP locale): squillo risposto con video durante lo squillo, audio nei due sensi, foto e clip con audio, «Vedi esterno»: come nella 1.0.15. L'accessorio HomeKit gira ogni giorno su un Tab 7S Up 40517 (2 fili V2, cloud) di @m4r1k; su altri impianti non è ancora stato provato, i riscontri sono benvenuti.

Problema noto

«Vedi esterno» aperto subito dopo aver riagganciato uno squillo può fallire dopo 25 s sui 2 fili, perché la targa resta occupata qualche secondo; al secondo tentativo funziona (#41, correzione in arrivo).

1.0.15

Highlights

• SIP, media, setup and entity fixes from @m4r1k (#31): plain RTP accepted only from the call's address, registration renewed before the granted lifetime runs out, answering no longer waits for the keyframe INFO, no periodic keyframe requests, duplicate relay messages broadcast once, a sturdier SIP framer, SRTP keys out of the logs.
• New "Intercom Dispositivi" sensor: the devices seen on the plant.
• The video panel can be learned from the last ring when camera_target is empty.
• Between calls the camera shows the last ring photo instead of an error.
• /av no longer starts with a wrapped audio timestamp (#37, @m4r1k): Home Assistant's stream worker stopped logging Timestamp discontinuity and restarting at every view.
• Security (#36): fetch_local accepts only a bare private IP (a host@elsewhere form sent the SIP Digest elsewhere); four log shapes that leaked passwords or tokens are now masked.
• One installation per Home Assistant (#38), enforced in the config flow. Existing installations are not touched; discovery still follows the Tab's new address after a DHCP change.

Full list in the CHANGELOG.

Field check

Tab 7S 2F+ 40507, local UDP: ring with video before answering, two-way audio, outcome answered, photo and clip with audio saved; "view outside" opens faster and stays smooth; no plain RTP dropped; no timestamp discontinuity on /av.

Upgrading

Update from HACS and restart Home Assistant. If you ever added the integration twice, keep the entry you use and delete the other: a second entry never worked reliably, and a new one can no longer be added.

---

In breve

• Correzioni SIP, media, configurazione ed entità di @m4r1k (#31): RTP in chiaro accettato solo dall'indirizzo della chiamata, registrazione rinnovata prima della scadenza concessa, risposta senza attendere l'INFO del keyframe, niente richieste periodiche di keyframe, messaggi duplicati del relay inoltrati una volta sola, framer SIP più robusto, chiavi SRTP fuori dai log.
• Nuovo sensore «Intercom Dispositivi»: i dispositivi visti sull'impianto.
• La targa video si impara dall'ultimo squillo quando camera_target è vuoto.
• Fra una chiamata e l'altra la camera mostra l'ultima foto dello squillo invece di un errore.
• /av non parte più con un timestamp audio «girato» (#37, @m4r1k): il worker stream di Home Assistant non segnala più Timestamp discontinuity e non si riavvia a ogni visione.
• Sicurezza (#36): fetch_local accetta solo un IP privato scritto per esteso (la forma host@altrove mandava il Digest SIP altrove); quattro forme di log che lasciavano in chiaro password o token ora sono oscurate.
• Una sola installazione per Home Assistant (#38), controllata dal config flow. Le installazioni esistenti non cambiano; il discovery continua a seguire il nuovo indirizzo del Tab dopo un cambio DHCP.

Prova sul campo

Tab 7S 2F+ 40507, UDP locale: squillo con video prima di rispondere, audio nei due sensi, esito answered, foto e clip con audio salvate; «Vedi esterno» si apre più in fretta e resta fluido; nessun RTP scartato; nessuna discontinuità di timestamp su /av.

Aggiornamento

Da HACS, poi riavvio di Home Assistant. Se avevi aggiunto l'integrazione due volte, tieni quella che usi ed elimina l'altra: una seconda entry non ha mai funzionato bene, e ora non se ne può aggiungere una nuova.