🚀 Release: v4.4.0

[github-actions[bot]]

🚀 New Release: v4.4.0

View full release and download on GitHub

---

TaskMate v4.4.0 is a major release that rolls up the entire codebase-audit remediation campaign plus 14 new features — 49 PRs (#583–#631) since v4.3.1. The integration is now meaningfully more secure, more correct, faster, and substantially more capable.

Install / upgrade: HACS → TaskMate → Redownload → pick 4.4.0, then restart Home Assistant. Hard-refresh the browser afterwards so the updated cards load.

---

✨ New features

• Chore dependencies / unlocks (FEAT-1, feat(chores): chore dependencies / unlocks (FEAT-1) #603) — a chore can be gated until another is approved.
• Leaderboard seasons (FEAT-2, feat(leaderboard): monthly seasons + champion (FEAT-2) #624) — monthly reset + champion badge so a perpetual leader doesn't demoralise siblings.
• Allowance / real-money payout ledger (FEAT-3, feat(allowance): real-money payout ledger (FEAT-3) #627) — convert points into a parent-confirmable allowance with a payout log (fixed-cost only).
• Family co-op goals (FEAT-4, feat(goals): family co-op goal (FEAT-4) #628) — a shared target ("everyone hits 500 → movie night") with a progress card.
• Per-child quiet hours / DND (FEAT-5, feat(notifications): per-child quiet hours / DND (FEAT-5) #605) — suppress reminders during school/bedtime windows.
• Reminder escalation (FEAT-6, feat(notifications): mandatory reminder escalation (FEAT-6) #606) — nudge → reminder → parent alert when a mandatory chore stays incomplete.
• Negative-balance policy (FEAT-7, feat(points): negative-balance policy (FEAT-7) #595) — allow_negative / floor-at-zero behaviour when a penalty would push a child below zero.
• Native todo platform (FEAT-8, feat(todo): native per-child to-do list platform (FEAT-8) #602) — each child's due chores as a Home Assistant To-do list (works with the native to-do card and voice assistants).
• number / select config entities (FEAT-9, feat(entities): expose key settings as number/select entities (FEAT-9) #601) — key settings (multipliers, costs, streak-reset mode, card design) exposed as entities for automation.
• ICS / calendar subscription export (FEAT-10, feat(calendar): ICS subscription feed (FEAT-10) #625) — a subscribe URL so chores appear in Google/Apple Calendar.
• Automation blueprint pack (FEAT-11, feat(blueprints): automation blueprint pack (FEAT-11) #622) — ready-made blueprints shipped with the integration.
• Voice / conversation intents (FEAT-12, feat(intents): voice/conversation intents (FEAT-12) #629) — ask your assistant about chore status.
• Photo-proof gallery card (FEAT-13, feat(cards): photo-proof gallery card (FEAT-13) #626) — browse submitted evidence photos.
• Monthly report-card summary (FEAT-14, feat(notifications): monthly report (FEAT-14) #623) — per-child monthly recap notification.

🔒 Security

• SEC-1 (fix(security): sanitize header_color before CSS interpolation (SEC-1) #584) — sanitize header_color before CSS interpolation across the affected cards (closes a config-author CSS-injection vector).
• SEC-2 (feat(photos): disk quota + orphan sweep for evidence photos (SEC-2) #591) — disk quota + orphan sweep for evidence photos.
• SEC-3 (fix(audit): record mutating service calls in the admin audit log (SEC-3) #592) — mutating service calls are now written to the admin audit log (previously only panel/WS actions were).
• SEC-4 / SEC-6 (fix(security): tighten kiosk cross-child gate + clamp negative point args (SEC-4/6) #599) — tighten the kiosk cross-child completion gate; clamp negative point arguments at the coordinator layer.
• SEC-5 (fix(storage): re-validate photo_url on config import (SEC-5) #616) — re-validate photo_url on config import.
• Plus the foreign-photo_url rejection in complete_chore (fix(security): reject foreign photo_url in complete_chore #583).

🐛 Fixes

• ERR-1 (fix(points): reverse streak-milestone bonuses on reject/undo (ERR-1) #585) — reverse streak-milestone bonuses on reject/undo (fixes points drift).
• ERR-2 (fix(calendar): project interval recurrences without recurrence_start (ERR-2, QUAL-1) #590) — project interval recurrences correctly when recurrence_start is unset (availability vs calendar no longer diverge).
• ERR-3 (fix(points): count todays completion when resuming a paused streak (ERR-3) #586) — count today's completion when resuming a paused streak.
• ERR-4 (fix(points-card): track and clear toast auto-hide timer (ERR-4) #587) — track and clear the points-card toast auto-hide timer.
• ERR-5 (fix(cards): guard bonuses/penalties create+edit against double-submit (ERR-5) #588) — guard bonuses/penalties create+edit against double-submit.
• ERR-6 / ERR-8 / ERR-9 (fix(cards): observer leak, badge subscribe race, mdi-icon-size typo (ERR-6/8/9) #594) — config-sounds observer leak, child-card badge subscribe race, --mdc-icon-size typo.
• ERR-7 (fix(graph-card): resolve Today/Yesterday tooltip labels in HA timezone (ERR-7) #600) — resolve Today/Yesterday graph tooltip labels in the HA timezone.
• [Bug]: Reward Card in Playroom style should have fluid height #604 (fix(rewards): grow card to fit all rewards in designed styles (#604) #615) — rewards card grows to fit all rewards in designed styles.

⚡ Performance

• PERF-1 (perf(availability): memoize per-build chore matrix work (PERF-1) #607) — memoize the per-build chore-availability matrix.
• PERF-2 (perf(coordinator): cache data snapshot by storage version (PERF-2) #613) — cache the data snapshot keyed by storage version.
• PERF-3 (perf(storage): debounce saves via async_delay_save (PERF-3) #614) — debounce storage saves via async_delay_save.
• PERF-4 (perf(services): gate service-desc rebuild on data_version (PERF-4) #618) — gate service-description rebuilds on a cheap data_version fingerprint.
• PERF-5 (fix(assignments): run availability listener on loop + cache tracked entities (PERF-5) #593) — run the availability listener on the loop + cache tracked entities.

🧹 Refactor & quality

• QUAL-2 (refactor(cards): merge bonuses/penalties into one component (QUAL-2) #631) — merge the ~95%-identical bonuses/penalties cards into one shared taskmate-incentive-card.js component.
• QUAL-3 (refactor(cards): extract header-colour picker to shared layer (QUAL-3) #630) — extract the copy-pasted header-colour picker into the shared taskmate-design.js layer.
• QUAL-6 (chore(lint): enable ruff isort (I) + bugbear (B) (QUAL-6) #619) — enable Ruff isort (I) + bugbear (B).
• ARCH-1 (refactor(storage): typed accessors for root flags (ARCH-1) #617) — typed storage accessors for root flags.
• Dead-code removal and set_setting typing fix (chore: remove dead code + correct set_setting typing (ERR-9, dead code) #598).

🌍 i18n

• I18N-1 / I18N-2 (i18n: add 7 missing service translations + first_come selector key (I18N-1/2) #589) — back-fill 7 missing service translations + the first_come selector key across all locales (de/fr/nb/nn/pt/pt-BR/en/en-GB).

🧪 CI & tests

• CI-1 (ci: pin test deps, drop unpinned HA harness (CI-1) #620) — pin the HA test harness to a py3.12-compatible version.
• CI-3 (ci: add ESLint gate over www/ cards + panel (CI-3) #621) — add an ESLint gate over www/ cards + panel.
• TEST-1 / TEST-2 (test(button): add coverage for the button platform (TEST-1) #596, test(timed): cover the timed-task lifecycle (TEST-2) #597) — coverage for the button platform and the timed-task lifecycle.

---

Validated on the dev HA instance before release: the integration loads cleanly with no tracebacks, the new services and number/select/todo entity surfaces register, and the refactored incentive cards serve correctly.

---

Upgrading

Update via HACS or by downloading the latest release and copying to /config/custom_components/taskmate/.

After updating, restart Home Assistant. Lovelace resources will update automatically on restart.

---

💬 Questions or issues with this release? Reply below or open an issue.