v5.28.0

Highlights

• 💡 Better Matter support, including smarter controls for lights, thermostats, blinds, smoke/CO alarms, and child bridges
• 🔎 Plugin search now clearly shows whether plugins support HAP, Matter, or both
• 🔐 Stronger security for logins, sessions, plugin UIs, terminals, and child-bridge controls
• 🖥️ Added Node.js 26 and Windows ARM support
• 🛠️ Fixed accessory updates freezing across multiple browser tabs
• 🔌 Improved plugin installation, updating, reconnection, and restart handling
• ⚙️ Various reliability fixes for the config editor, dashboard metrics, CPU temperature reporting, and UI self-updates

UI Changes

• fix(ui): keep status widget values and units on one line (#2913) (@tbaur)
• feat(settings): support HAP disableIdentifyingMaterial option (#2924) (@naterator)
• feat(plugins): detect the supports-matter keyword on plugins
• fix(plugins): re-establish custom ui sessions on socket reconnect (#2931) (@hjdhjd)
• feat(plugins): show commissioned matter fabrics on child bridges
• fix(settings): return metrics and package path settings in env (#2934)
• fix(status): skip metrics collection when monitoring is disabled (#2934)
• feat(status): show message on widgets when metrics monitoring is disabled (#2934)
• feat(plugins): default new child bridges to matter without hap for matter-only plugins (#3975)
• feat(plugins): show hap and matter support icons when searching for plugins
• chore(ui): remove beta badges from graduated features
• feat(plugins): hide the hap options on child bridges for matter-only plugins (#3975)
• fix(plugins): keep the running homebridge version when a second install is found (#2897)
• Update NodeJS Version checker for NodeJS 26 (#2938) (@NorthernMan54)
• fix(plugins): offer the restart after a first-time plugin config, even when the child bridge is declined (#2946) (@BKeyport)
• fix(plugins): even up the space either side of the hap and matter icons on the child bridge sections
• feat(ui): render github style alerts in markdown, instead of showing the raw marker
• feat(accessories): only offer the thermostat modes a matter device actually has
• feat(accessories): only offer the colour controls a matter light actually has
• feat(accessories): add a tilt control for matter window coverings that support it
• feat(accessories): add tilt controls for hap window coverings that support them
• fix(accessories): announce a matter co-only alarm as a carbon monoxide sensor, not a smoke sensor
• feat(accessories): show the smoke or co face on a matter alarm that only senses one of them
• fix(accessories): stop a matter light with no hue support painting its tile icon grey
• fix(accessories): read and drive the tilt on a matter covering that only tilts
• fix(accessories): paint an unsaturated bulb white rather than grey, on both hap and matter
• fix(ui): sanitise rendered markdown to prevent stored XSS
• feat(log): let admins restrict the Homebridge log to administrators
• fix(status): support degrees as well as millidegrees in the configured cpu temp file (#2966) (@lidonius1122)
• fix(plugins): find the running Homebridge when it is installed outside the scanned paths (#2897) (@lidonius1122)
• fix(logs): restore the injection context before the logs guard delegates, so the page loads

Other Changes

• chore(deps): dependency updates
• chore(deps): add node 26 support and bump node-pty (#2916) (#2930) (@NorthernMan54)
• ci: validate and release against node 26 (#2917) (#2918) (@NorthernMan54)
• fix(plugins): pass allow-scripts to plugin installs (#2921) (@bcomnes)
• fix(plugins): only pass allow-scripts to global installs
• fix(plugins): honour the beta preference when a stable update is also available
• feat: add windows arm support (#2927) (@NorthernMan54)
• fix(deps): bump @fastify/static to v10 (security)
• fix(ci): resolve intermittent backup test timeouts in validate.yml (#2933)
• feat(auth): always return temp. units in settings
• fix(plugins): only warn about skipped install scripts when one would actually be skipped
• fix(build): copy the monaco chunks renamed in v0.56, so the json config editor is not a blank page
• fix(deps): bump @homebridge/hap-client to v5.1.1 so child bridges sharing a hostname are discovered (#2936)
• fix(test): reset the accessory layout so the default-room test passes on repeat runs
• Fix for CSP Errors (#2960)
• fix(security): stop a caller-supplied origin reaching the plugin ui script tag and csp (reported by @yowie)
• fix(plugins): always use the ui installation that is actually running
• fix(child-bridges): require admin to start/stop/restart a bridge over websocket
• fix(terminal): restrict persistent-session HTTP endpoints to admins
• fix(auth): make first-user setup atomic against concurrent requests
• fix(auth): pin the plugin-UI cookie guard to this instance
• fix(server): set frame-ancestors to block clickjacking of the UI
• fix(auth): hash passwords at OWASP work factor with transparent upgrade
• fix(auth): throttle failed logins to stop credential and 2FA brute force
• fix(auth): revoke tokens when a user is deleted, demoted or changes password
• fix(ws): send the session token in the handshake payload, not the query string
• fix(server): drop 'unsafe-inline' from the app's script-src
• fix(auth): hold the access token in memory instead of localStorage
• test(status): stop the dashboard e2e tests clobbering the dev storage layout
• fix(custom-plugins): allow plugin UI webfonts from the dev server origin
• chore(build): stop copying monaco's unused json language sources
• fix(plugins): cancel the pending ui self-restart when the module is torn down
• fix(test): stop the plugin update tests firing the real ui restart
• feat: replace plugin ui session cookie with short-lived single-use tickets (#2972) (@NorthernMan54)
• fix(test): poll for the tailed log lines instead of sleeping, so a slow runner cannot fail the job
• fix(users): refuse to demote the only admin, matching the existing delete protection
• fix(config-editor): create the ui platform block on demand instead of crashing when a config has none
• fix(accessories): stop a malformed accessory-control message taking down the ui process
• fix(accessories): reject a non-numeric characteristic value instead of sending NaN to homebridge
• fix(terminal): stop one client's disconnect muting the exit notice of every other terminal session
• fix(accessories): share one characteristic monitor so a second tab no longer freezes live updates in the first
• fix(config-editor): run the targeted config mutations inside the file lock so concurrent saves cannot clobber each other
• fix(scripts): make the ui self-update rollback actually restore the previous version on failure
• fix(scripts): import esm plugins via a file url so alias extraction works on windows
• fix(scripts): wait for the alias message to flush before the extract child exits
• fix(test): restore the shared test storage directory after a run, so the suite stops clobbering dev state
• refactor(plugins): extract a restart-free package update path shared by single updates and update all
• fix(auth): let a plugin authenticate as a service, instead of every self-minted token now failing
• fix(accessories): send each child bridge its own pin, so its accessories are not hidden (#2936)

Homebridge Dependencies

• @homebridge/hap-client @ v5.2.0
• @homebridge/node-pty-prebuilt-multiarch @ v0.14.1
• @homebridge/plugin-ui-utils @ v2.2.5