chore(deps): update Home Assistant test baseline

[eXPerience83]

Context

The repository currently has two intentionally different Home Assistant dependency environments:

• the normal locked development/test environment in pyproject.toml / uv.lock, currently based on homeassistant==2026.8.0 and pytest-homeassistant-custom-component==0.13.354;
• the minimum-supported compatibility environment in .github/requirements/minimum-ha.in / .github/requirements/minimum-ha.txt, intentionally pinned to Home Assistant 2026.5.0 and its matching test harness.

The Home Assistant 2026.5.0 floor is a public compatibility contract. The 4.0.0 release preparation treats the increase from 2026.3.0 to 2026.5.0 as a breaking change. Do not raise that minimum again merely to reduce Dependabot findings.

GitHub Dependabot currently reports multiple vulnerable dependencies for this repository. These alerts may originate from one or both lock graphs and are development/CI dependencies rather than packages bundled in the HACS release ZIP. Pollen Levels does not currently ship Home Assistant, pytest, PHACC, or their transitive dependencies inside pollenlevels.zip.

This issue should be handled after the 4.0.0 release work is complete so dependency maintenance does not expand the release PR scope.

Goal

Refresh the normal Home Assistant development/test baseline to the latest compatible Home Assistant 2026.8.x generation available at implementation time, together with the matching pytest-homeassistant-custom-component version, then regenerate the normal uv.lock and measure which Dependabot alerts are resolved.

After that update, audit any remaining Dependabot findings separately, especially those originating from the minimum-HA compatibility lock.

Scope

• Confirm current main and current dependency pins before changing anything.
• Review the active Dependabot alerts and record, for each relevant alert:
  • affected package;
  • GHSA/CVE when available;
  • severity;
  • vulnerable version/range;
  • fixed version/range;
  • dependency path / lock source where GitHub exposes it.
• Classify findings by dependency graph:
  • normal uv.lock / HA 2026.8.x test environment;
  • .github/requirements/minimum-ha.txt / minimum HA 2026.5.0 compatibility environment;
  • other workflow/tooling dependency if applicable.
• Update the normal Home Assistant pin from 2026.8.0 to the latest appropriate 2026.8.x release available at implementation time.
• Update pytest-homeassistant-custom-component to the matching compatible release.
• Keep the normal HA/PHACC pair synchronized; do not update one independently if the harness metadata requires an exact Home Assistant version.
• Regenerate uv.lock using the repository-required uv version and existing lock policy.
• Do not use uv lock --upgrade as an unbounded dependency refresh. Keep the update targeted and review all transitive lock movement caused by the HA/PHACC baseline change.
• Compare Dependabot before/after and document which alerts are resolved by the normal baseline update.
• Audit remaining alerts in the minimum-HA lock separately instead of automatically raising the supported Home Assistant floor.
• If a remaining minimum-HA alert has a fixed dependency version that is compatible with Home Assistant 2026.5.0, prefer a focused minimum-lock update that preserves the declared support floor.
• If a serious/exploitable minimum-HA vulnerability cannot be fixed while retaining Home Assistant 2026.5.0, report that evidence separately before proposing another support-floor change.

Minimum Home Assistant policy

Keep the public minimum supported Home Assistant version at 2026.5.0 for this issue.

Do not change these solely to make Dependabot cleaner:

• hacs.json minimum Home Assistant version;
• README minimum-version guidance;
• .github/requirements/minimum-ha.in Home Assistant floor;
• AGENTS compatibility guidance.

Changing the public minimum support floor is a compatibility decision and requires separate evidence and release/versioning analysis.

Important dependency boundary

The normal test baseline is not the HACS runtime dependency contract.

The integration package does not declare Home Assistant/pytest/PHACC as integration requirements, and the HACS release ZIP contains the integration source rather than the repository test environments. Treat Dependabot findings seriously for development and CI security, but do not present them as user-installed Pollen Levels runtime packages unless evidence shows otherwise.

Validation

At minimum run the repository-standard checks after the targeted dependency update:

uv lock --check

uv sync --locked --only-group lint
uv run --locked --no-sync ruff check .
uv run --locked --no-sync ruff format --check .

uv sync --locked --only-group test
PYTHONPATH=. uv run --locked --no-sync python -m pytest -q

uv run --locked --no-sync python -m compileall -q custom_components tests

git diff --check

Also verify the hosted gates appropriate to the final diff, including the normal locked test suite, minimum Home Assistant compatibility lane, package validation, hassfest, HACS validation, and workflow/security checks where triggered.

Lockfile review

The PR must explicitly summarize the transitive lock changes introduced by the HA/PHACC update.

Do not accept unrelated dependency churn without explanation. In particular, review security-relevant packages called out by Dependabot and confirm whether the resulting locked versions are fixed or still affected.

Non-goals

• raising the minimum supported Home Assistant version from 2026.5.0 without separate evidence;
• changing runtime behavior;
• changing migration or registry identity;
• changing entity IDs, unique IDs, device identifiers, forecast attributes, Recorder behavior, or public services;
• mixing the 4.0.0 release preparation with this dependency maintenance;
• broad dependency upgrades unrelated to the Home Assistant test baseline;
• suppressing or dismissing Dependabot alerts simply because affected packages are development-only.

Acceptance criteria

1. The normal Home Assistant/PHACC test baseline is updated as a matched compatible pair to the selected current 2026.8.x generation.
2. uv.lock is regenerated reproducibly with the repository-required uv version and all resulting changes are reviewed.
3. The full normal test suite passes.
4. The minimum HA 2026.5.0 compatibility lane remains green and the public support floor remains unchanged.
5. Dependabot findings are compared before and after the update, with resolved and remaining alerts documented.
6. Remaining minimum-HA findings are assessed on their own security/compatibility merits rather than by automatically increasing the support floor.
7. No runtime, migration, registry identity, release metadata, or unrelated documentation changes are introduced.

Proposed PR

chore(deps): update Home Assistant test baseline

Keep this as a focused dependency/CI maintenance PR after Pollen Levels 4.0.0 is released.

[eXPerience83]

Dependabot audit plan

Repository state

• Repository: eXPerience83/pollenlevels
• Inspected origin/main: a046e00c314ca00ec4695f025d6c901fb3f089ab
• Local branch during the audit: release/4.0.0 at 6ee4816a7fb59a77df5a52c0b364d391fa80735b
• The local checkout and origin/main had identical file trees.
• Release metadata: Pollen Levels 4.0.0
• Normal baseline:
  • homeassistant==2026.8.0
  • pytest-homeassistant-custom-component==0.13.354
• Minimum baseline:
  • homeassistant==2026.5.0
  • pytest-homeassistant-custom-component==0.13.329
• Open Dependabot alerts: 45
• No .github/dependabot.yml is present.
• gh auth status succeeded. The exact alert inventory was retrieved through the authenticated GitHub REST endpoint GET /repos/eXPerience83/pollenlevels/dependabot/alerts?state=open&per_page=100 with pagination and GitHub API version 2022-11-28. No alert state was changed.
• The audit's final git status --short was empty. The audit made no repository modifications.

The installed default uv was 0.12.5, while the repository requires 0.12.4. Dependency-tree inspection therefore used an ephemeral invocation of uv 0.12.4.

Executive findings

• 44 unique advisories across 45 alerts. One cryptography advisory appears in both dependency graphs.
• Severity:
  • Critical: 1
  • High: 17
  • Medium: 22
  • Low: 5
• Dependency graph:
  • Normal uv.lock: 1
  • Minimum .github/requirements/minimum-ha.txt: 44
  • Other tooling: 0
  • Unclassified: 0
• Latest stable matched 2026.8.x pair found during the audit:
  • homeassistant==2026.8.2
  • pytest-homeassistant-custom-component==0.13.356
• Alerts resolved by that normal baseline update: 0
• Alerts remaining in the minimum HA 2026.5.0 graph: 44
• None of the minimum-graph vulnerable packages can be independently upgraded while retaining valid HA 2026.5.0 metadata: HA pins all of them exactly.
• Repository-specific priority:
  • P0: 0
  • P1: 0
  • P2: 4
  • P3: 41
• No active alert justifies raising the public HA support floor. These packages are test/CI dependencies, are not bundled in the HACS ZIP, and the vulnerable application features are not exposed by the test workflow. The findings remain real and should continue to be tracked.

Alert inventory

All alerts use the pip ecosystem and GitHub labels their scope runtime. Alerts #22 and #45 are direct dependencies; all others are transitive.

Alert	Package	Manifest	GHSA/CVE	Severity	Locked/vulnerable	Fixed	Dependency source	Priority
#45	homeassistant	.github/requirements/minimum-ha.txt	GHSA-5hxg-r395-fqxx / CVE-2026-64825	Critical, CVSS 9.3	2026.5.0; <2026.6.0	2026.6.0	Direct minimum pin	P2
#44	cryptography	.github/requirements/minimum-ha.txt	GHSA-m2h6-j472-rp4c / CVE-2026-69248	Medium	47.0.0; <=48.0.0	49.0.0	HA exact pin	P3
#43	cryptography	.github/requirements/minimum-ha.txt	GHSA-jwv3-5hgf-82ww / CVE-2026-69249	High	47.0.0; <=48.0.0	49.0.0	HA exact pin	P3
#42	cryptography	.github/requirements/minimum-ha.txt	GHSA-g6cj-pr64-35w5 / CVE-2026-69247	High	47.0.0; >=44,<50	50.0.0	HA exact pin	P3
#41	aiohttp	.github/requirements/minimum-ha.txt	GHSA-cq5v-8q36-5273 / CVE-2026-69244	High	3.13.5; <=3.14.2	3.14.3	HA exact pin	P2
#40	aiohttp	.github/requirements/minimum-ha.txt	GHSA-mfx4-hv73-q22v / CVE-2026-69243	Medium	3.13.5; <=3.14.1	3.14.2	HA exact pin	P3
#39	aiohttp	.github/requirements/minimum-ha.txt	GHSA-mq44-7p77-q5h7 / CVE-2026-59881	Medium	3.13.5; <=3.14.1	3.14.2	HA exact pin	P3
#38	PyJWT	.github/requirements/minimum-ha.txt	GHSA-993g-76c3-p5m4 / CVE-2026-48522	Medium, CVSS 4.2	2.12.1; >=2.0,<=2.12.1	2.13.0	HA exact pin	P3
#37	PyJWT	.github/requirements/minimum-ha.txt	GHSA-fhv5-28vv-h8m8 / CVE-2026-48524	Low, CVSS 3.7	2.12.1; >=2.0,<=2.12.1	2.13.0	HA exact pin	P3
#36	Pillow	.github/requirements/minimum-ha.txt	GHSA-9hw9-ch79-4vh6 / CVE-2026-59205	High, CVSS 7.5	12.2.0; <12.3.0	12.3.0	HA exact pin	P3
#35	Pillow	.github/requirements/minimum-ha.txt	GHSA-vjc4-5qp5-m44j / CVE-2026-59204	High	12.2.0; >=8.2,<12.3	12.3.0	HA exact pin	P3
#34	Pillow	.github/requirements/minimum-ha.txt	GHSA-pg7v-jwj7-p798 / CVE-2026-59203	Medium, CVSS 5.3	12.2.0; >=12.0,<12.3	12.3.0	HA exact pin	P3
#33	Pillow	.github/requirements/minimum-ha.txt	GHSA-jjj6-mw9f-p565 / CVE-2026-59200	High, CVSS 7.5	12.2.0; >=5.1,<12.3	12.3.0	HA exact pin	P3
#32	Pillow	.github/requirements/minimum-ha.txt	GHSA-6r8x-57c9-28j4 / CVE-2026-59199	High, CVSS 7.5	12.2.0; <12.3.0	12.3.0	HA exact pin	P3
#31	Pillow	.github/requirements/minimum-ha.txt	GHSA-fj7v-r99m-22gq / CVE-2026-59198	Medium, CVSS 6.5	12.2.0; >=5.2,<12.3	12.3.0	HA exact pin	P3
#30	Pillow	.github/requirements/minimum-ha.txt	GHSA-xj96-63gp-2gmr / CVE-2026-59197	High, CVSS 8.2	12.2.0; <12.3.0	12.3.0	HA exact pin	P3
#29	Pillow	.github/requirements/minimum-ha.txt	GHSA-4x4j-2g7c-83w6 / CVE-2026-55798	Medium, CVSS 4.5	12.2.0; <12.3.0	12.3.0	HA exact pin	P3
#28	Pillow	.github/requirements/minimum-ha.txt	GHSA-phj9-mv4w-65pm / CVE-2026-55380	High, CVSS 7.5	12.2.0; <12.3.0	12.3.0	HA exact pin	P3
#27	Pillow	.github/requirements/minimum-ha.txt	GHSA-45hq-cxwh-f6vc / CVE-2026-55379	High, CVSS 7.5	12.2.0; <12.3.0	12.3.0	HA exact pin	P3
#26	Pillow	.github/requirements/minimum-ha.txt	GHSA-5x94-69rx-g8h2 / CVE-2026-54060	High, CVSS 7.5	12.2.0; <12.3.0	12.3.0	HA exact pin	P3
#25	Pillow	.github/requirements/minimum-ha.txt	GHSA-8v84-f9pq-wr9x / CVE-2026-54059	High, CVSS 7.5	12.2.0; <12.3.0	12.3.0	HA exact pin	P3
#24	Pillow	.github/requirements/minimum-ha.txt	GHSA-62p4-gmf7-7g93 / CVE-2026-54058	High	12.2.0; <12.3.0	12.3.0	HA exact pin	P3
#23	zeroconf	.github/requirements/minimum-ha.txt	GHSA-qc2x-6f54-m6h9 / CVE-2026-48487	Medium, CVSS 6.5	0.148.0; <0.149.16	0.149.16	HA exact pin	P3
#22	homeassistant	.github/requirements/minimum-ha.txt	GHSA-x84v-g949-293w / CVE-2026-54317	High, CVSS 7.6	2026.5.0; <2026.6.0	2026.6.0	Direct minimum pin	P3
#21	cryptography	.github/requirements/minimum-ha.txt	GHSA-537c-gmf6-5ccf / no CVE	High, CVSS 7.5	47.0.0; <48.0.1	48.0.1	HA exact pin	P2
#20	aiohttp	.github/requirements/minimum-ha.txt	GHSA-xcgm-r5h9-7989 / CVE-2026-54274	Medium	3.13.5; <=3.14.0	3.14.1	HA exact pin	P3
#19	aiohttp	.github/requirements/minimum-ha.txt	GHSA-4m7w-qmgq-4wj5 / CVE-2026-54275	Low	3.13.5; <=3.14.0	3.14.1	HA exact pin	P3
#18	aiohttp	.github/requirements/minimum-ha.txt	GHSA-9x8q-7h8h-wcw9 / CVE-2026-54280	Low	3.13.5; <=3.14.0	3.14.1	HA exact pin	P3
#17	aiohttp	.github/requirements/minimum-ha.txt	GHSA-4fvr-rgm6-gqmc / CVE-2026-54273	Medium	3.13.5; <=3.14.0	3.14.1	HA exact pin	P3
#16	aiohttp	.github/requirements/minimum-ha.txt	GHSA-g3cq-j2xw-wf74 / CVE-2026-54278	Medium	3.13.5; <=3.14.0	3.14.1	HA exact pin	P3
#15	aiohttp	.github/requirements/minimum-ha.txt	GHSA-63hw-fmq6-xxg2 / CVE-2026-54277	Medium	3.13.5; <=3.14.0	3.14.1	HA exact pin	P3
#14	aiohttp	.github/requirements/minimum-ha.txt	GHSA-hpj7-wq8m-9hgp / CVE-2026-54276	Medium	3.13.5; <=3.14.0	3.14.1	HA exact pin	P3
#13	aiohttp	.github/requirements/minimum-ha.txt	GHSA-2fqr-mr3j-6wp8 / CVE-2026-54279	Low	3.13.5; <=3.14.0	3.14.1	HA exact pin	P3
#12	aiohttp	.github/requirements/minimum-ha.txt	GHSA-m6qw-4cw2-hm4m / CVE-2026-50269	Low	3.13.5; <=3.13.5	3.14.0	HA exact pin	P3
#11	PyJWT	.github/requirements/minimum-ha.txt	GHSA-w7vc-732c-9m39 / CVE-2026-48525	Medium, CVSS 5.3	2.12.1; >=2.8,<=2.12.1	2.13.0	HA exact pin	P3
#10	PyJWT	.github/requirements/minimum-ha.txt	GHSA-xgmm-8j9v-c9wx / CVE-2026-48526	High, CVSS 7.4	2.12.1; <2.13.0	2.13.0	HA exact pin	P3
#9	PyJWT	.github/requirements/minimum-ha.txt	GHSA-jq35-7prp-9v3f / CVE-2026-48523	Medium, CVSS 5.4	2.12.1; >=2.9,<2.13	2.13.0	HA exact pin	P3
#8	zeroconf	.github/requirements/minimum-ha.txt	GHSA-9663-mqmp-p9mm / CVE-2026-48045	Medium, CVSS 6.5	0.148.0; <0.149.12	0.149.12	HA exact pin	P3
#7	aiohttp	.github/requirements/minimum-ha.txt	GHSA-hg6j-4rv6-33pg / CVE-2026-47265	Medium	3.13.5; <3.14.0	3.14.0	HA exact pin	P3
#6	aiohttp	.github/requirements/minimum-ha.txt	GHSA-jg22-mg44-37j8 / CVE-2026-34993	Medium, CVSS 6.4	3.13.5; <3.14.0	3.14.0	HA exact pin	P3
#5	zeroconf	.github/requirements/minimum-ha.txt	GHSA-rfg2-pjw2-56x2 / CVE-2026-47184	Medium, CVSS 6.5	0.148.0; <0.149.7	0.149.7	HA exact pin	P3
#4	zeroconf	.github/requirements/minimum-ha.txt	GHSA-phvx-9mgw-67r5 / CVE-2026-47183	Medium, CVSS 6.5	0.148.0; <0.149.6	0.149.6	HA exact pin	P3
#3	zeroconf	.github/requirements/minimum-ha.txt	GHSA-9pgc-3ccv-5297 / CVE-2026-47180	Medium, CVSS 6.5	0.148.0; <0.149.5	0.149.5	HA exact pin	P3
#2	uv	.github/requirements/minimum-ha.txt	GHSA-4gg8-gxpx-9rph / no CVE	Medium	0.11.8; <0.11.15	0.11.15	HA exact pin	P3
#1	cryptography	uv.lock	GHSA-g6cj-pr64-35w5 / CVE-2026-69247	High	48.0.1; >=44,<50	50.0.0	HA 2026.8 exact pin	P2

GitHub advisory publication dates were:

• 2026-08-03: Can't see logo on HACS #1 and Update actions/checkout action to v6 #39–BU update #44
• 2026-07-21: Bump to 1.8.6-alpha1 and refine typing and tests #45; updated 2026-08-13
• 2026-07-20: E x perience83 forecast #24–Redact config flow coordinate logs and bump rc4 #36
• 2026-06-22: E x perience83 forecast new #23
• 2026-06-19: style: apply Ruff fixes and Black formatting #22; updated 2026-07-20
• 2026-06-15: Create ru.json #9–E x perience83 new sensors #21 and Format test suite #37–Configure Renovate #38; Format test suite #37–Configure Renovate #38 updated 2026-07-31
• 2026-06-11: Separate sensors by type #8
• 2026-06-03: Update sensor.py #6–Add languageCode #7
• 2026-05-29: Itegradion doesn't appears on http://homeassistant.local:8123/config/integrations/dashboard #2–Only accepts one location #5

Unless noted, the advisory update date was the publication date. GitHub returned no usable numeric CVSS score/vector for rows where the table omits a score.

Normal test-baseline analysis

Current pair:

• homeassistant==2026.8.0
• pytest-homeassistant-custom-component==0.13.354

Latest stable pair found as of 2026-08-18:

• homeassistant==2026.8.2, released 2026-08-14 and shown by PyPI as the latest release. PyPI, upstream release
• pytest-homeassistant-custom-component==0.13.356, released 2026-08-15. Its metadata explicitly requires homeassistant==2026.8.2. PyPI metadata

Comparing authoritative Requires-Dist metadata:

• HA 2026.8.0 and 2026.8.2 have identical runtime dependency requirements.
• Both exactly require:
  • aiohttp==3.14.3
  • PyJWT==2.13.0
  • cryptography==48.0.1
  • Pillow==12.3.0
  • uv==0.11.31
  • zeroconf==0.150.0
• PHACC 0.13.354 and 0.13.356 have identical dependency requirements except that the HA requirement moves from 2026.8.0 to 2026.8.2.

Consequently, only the HA and PHACC package records/hashes are expected to move in a targeted lock update. The existing pyproject comment naming HA 2026.8.0 would also need synchronization. This is a projection from published metadata; an actual targeted lock regeneration is still required to confirm the complete lock diff.

Normal alert #1 is NOT RESOLVED by this baseline update. HA 2026.8.2 continues to require cryptography==48.0.1, while GHSA-g6cj-pr64-35w5 requires cryptography 50.0.0 or newer. A lock containing 50.0.0 would contradict HA 2026.8.2's exact metadata.

The alert's dependency paths include:

• homeassistant -> cryptography
• homeassistant -> hass-nabucasa -> acme/josepy -> cryptography
• homeassistant -> pyOpenSSL -> cryptography
• homeassistant -> securetar -> cryptography
• PHACC -> PyGithub[crypto] -> PyJWT[crypto] -> cryptography

Repository exposure is limited: the advisory requires repeated attacker-controlled PKCS#7 EnvelopedData decryption with externally distinguishable results. Pollen Levels and its tests do not provide that service. It remains a real P2 test-environment advisory, but not a credible CI compromise path from current evidence.

An actual targeted lock regeneration remains necessary during implementation to verify hashes and ensure no resolver-specific movement occurs. It is not expected to make alert #1 disappear.

Minimum-HA analysis

The minimum input chain is:

PHACC 0.13.329 -> homeassistant==2026.5.0 -> affected exact pins

HA 2026.5.0's published metadata exactly requires aiohttp==3.13.5, PyJWT==2.12.1, cryptography==47.0.0, Pillow==12.2.0, uv==0.11.8, and zeroconf==0.148.0. PyPI metadata

HA 2026.5.4 retains the same six exact transitive pins, so moving only to the last 2026.5 patch would not solve these alerts. The two direct HA advisories require HA 2026.6.0.

Home Assistant — alerts #45 and #22

• Classification: B — structurally pinned by HA 2026.5.0
• Bump to 1.8.6-alpha1 and refine typing and tests #45 concerns unauthenticated backup upload during onboarding and arbitrary host file write.
• style: apply Ruff fixes and Black formatting #22 concerns the unauthenticated Konnected HTTP endpoint.
• The minimum workflow creates a private venv and runs pytest. It does not expose a production HA HTTP listener, run onboarding backup restore, or configure Konnected.
• Bump to 1.8.6-alpha1 and refine typing and tests #45 is P2 because of the critical primitive, despite very low workflow reachability. style: apply Ruff fixes and Black formatting #22 is P3.
• Action: retain the support floor, keep tracking upstream, and do not treat the minimum lock as suitable for deploying a general HA server.

cryptography — alerts #21, #42, #43, and #44

• Path: HA directly and through HA dependencies such as hass-nabucasa, acme, josepy, PyJWT, pyOpenSSL, securetar, and snitun.
• HA requires 47.0.0 exactly.
• Safe versions range from 48.0.1 through 50.0.0, none of which satisfy HA 2026.5.0 metadata.
• E x perience83 new sensors #21 covers vulnerable OpenSSL components in cryptography wheels and is P2.
• Improve config validation logging and test robustness #42 requires an attacker-facing PKCS#7 decryption oracle.
• Add map-based location selector for configuration #43 requires malicious duplicate self-signed certificate chains.
• BU update #44 requires use of cryptography's certificate verifier with constrained intermediate CAs and wildcard names.
• Those specialized verification/decryption paths are not exercised by the integration tests; Improve config validation logging and test robustness #42–BU update #44 are P3.
• Action: no invalid transitive override. Track upstream-pinned exposure separately.

aiohttp — alerts #6, #7, #12–#20, and #39–#41

• Path: HA directly, plus aiointercept and multiple HA/PHACC helper packages.
• HA requires 3.13.5 exactly; safe versions range from 3.14.0 through 3.14.3.
• The integration uses HA's shared aiohttp client, but tests mock/intercept external requests. The minimum workflow does not expose an untrusted HTTP/WebSocket server.
• Server request-smuggling, pipelining, body-limit, cookie persistence, DigestAuth redirect, and WebSocket paths are not part of this integration's test behavior.
• Dependency Dashboard #41 is P2 because it is a native-parser out-of-bounds read reachable through a malicious chunked response, although no such untrusted response source exists in current tests.
• The remaining aiohttp alerts are P3.
• Action: do not override HA's exact aiohttp pin; retain normal network mocking and reassess when the minimum floor changes for compatibility reasons.

PyJWT — alerts #9–#11 and #37–#38

• Path: HA directly and through hass-nabucasa/pycognito.
• HA requires 2.12.1 exactly; all five alerts are fixed in 2.13.0.
• Pollen Levels does not implement JWT verification, JWK retrieval, or an attacker-facing token service. Tests do not enable the affected HA authentication paths.
• Classification: B and C — structurally pinned, tooling-only/low exposure
• Priority: P3.
• Action: no override.

Pillow — alerts #24–#36

• Path: direct exact HA dependency.
• HA requires 12.2.0; all thirteen alerts are fixed in 12.3.0.
• Pollen Levels performs no image, font, PDF, JPEG2000, TGA, color-management, or Windows image-viewer processing. CI uses Linux.
• Classification: B and C — structurally pinned, tooling-only/low exposure
• Priority: P3.
• Action: no override.

zeroconf — alerts #3–#5, #8, and #23

• Path: HA directly and via aiohttp-asyncmdnsresolver.
• HA requires 0.148.0; safe versions range from 0.149.5 to 0.149.16.
• These advisories require malicious LAN-local mDNS traffic. Pollen Levels is a cloud-polling integration and does not use zeroconf discovery. The GitHub-hosted pytest lane does not expose a Home Assistant mDNS service to an untrusted local network.
• Classification: B and C — structurally pinned, tooling-only/low exposure
• Priority: P3.
• Action: no override.

uv — alert #2

• Path: exact HA dependency, homeassistant -> uv==0.11.8.
• The advisory is fixed in 0.11.15.
• The vulnerable Python package is merely installed in the minimum venv. The workflow's installer commands use the separately provisioned repository-required uv 0.12.4, which is not vulnerable.
• Classification: B and C — structurally pinned, tooling-only/low exposure
• Priority: P3.
• Action: no override.

No minimum alert is category A, "fixable while keeping HA 2026.5.0." No evidence currently requires category D, "needs further security investigation," although P2 findings should be rechecked if CI behavior begins exposing the affected surfaces.

Recommended PR sequence

PR A

Title:

chore(deps): update Home Assistant test baseline

Exact scope:

• Change normal HA from 2026.8.0 to 2026.8.2.
• Change PHACC from 0.13.354 to 0.13.356.
• Synchronize the nearby HA-version comment in pyproject.toml.
• Perform a targeted uv.lock regeneration using uv 0.12.4.
• Accept only HA/PHACC records and transitive movement demonstrably required by those two updates.
• Confirm that cryptography remains 48.0.1 and document that alert Can't see logo on HACS #1 remains open.
• Do not touch the minimum requirements, support floor, changelog, release metadata, runtime, or unrelated Renovate updates.

PR B

No PR B is currently justified. Every vulnerable minimum-graph package is exactly pinned by HA 2026.5.0, and the normal cryptography alert is exactly pinned by HA 2026.8.2. A standalone transitive bump would create an invalid or unsupported environment.

Separate tracking issue

Suggested title:

security(deps): track advisories pinned by Home Assistant test baselines

Scope:

• Track normal cryptography alert Can't see logo on HACS #1.
• Track minimum alerts Itegradion doesn't appears on http://homeassistant.local:8123/config/integrations/dashboard #2–Bump to 1.8.6-alpha1 and refine typing and tests #45 as support-floor/test-baseline debt.
• Reassess reachability if CI begins exposing HA HTTP, onboarding, certificate-processing, JWT, image, WebSocket, or mDNS surfaces.
• Reassess package constraints when a future compatibility/versioning decision independently considers a support-floor change.
• Do not dismiss alerts solely because they are test dependencies.

Support-floor recommendation

NO.

Pollen Levels should not raise its minimum Home Assistant version above 2026.5.0 because of these alerts.

The minimum lock intentionally tests a compatibility contract; it is not distributed in the HACS ZIP and is not a supported Home Assistant deployment image. Every minimum alert is structurally tied to HA 2026.5.0's exact metadata, and the affected application features are not exposed by the current isolated pytest workflow. Raising the floor would remove compatibility coverage without fixing a vulnerability in the shipped integration.

The critical Home Assistant advisory still matters to anyone running an affected full HA installation, but Pollen Levels supporting that HA version neither installs nor activates the vulnerable onboarding backup path. Home Assistant deployment security and Pollen Levels' minimum compatibility declaration are separate decisions.

Uncertainties and remaining verification

Confirmed findings are the retrieved alert inventory, current locked versions, published dependency constraints, dependency paths, and current latest matched HA/PHACC pair as of 2026-08-18.

The expected narrow lock movement is a projection from published package metadata. The implementation PR must still perform and inspect an actual targeted lock regeneration. That regeneration is required to confirm package hashes and rule out resolver-specific movement, but it is not expected to resolve alert #1 because HA 2026.8.2 exactly requires vulnerable cryptography 48.0.1.

Security reachability assessments are based on the current repository tests and minimum-compatibility workflow. They should be revisited if those workflows begin accepting untrusted network traffic or exercising the affected HA subsystems.

Next implementation prompt

Implement chore(deps): update Home Assistant test baseline as a focused dependency-only PR:

1. Verify main and a clean worktree.
2. Update only the normal pins to HA 2026.8.2 and PHACC 0.13.356, plus the directly related version comment.
3. Regenerate uv.lock with repository-required uv 0.12.4 using a targeted HA/PHACC update.
4. Review the lock diff and reject unexplained dependency churn.
5. Confirm cryptography remains 48.0.1 and explicitly record that Dependabot alert Can't see logo on HACS #1 is not resolved.
6. Leave .github/requirements/minimum-ha.in, .github/requirements/minimum-ha.txt, hacs.json, release metadata, and runtime code unchanged.
7. Run all repository-required locked lint, compile, test, minimum-HA, package, and workflow-security validation.

[eXPerience83]

Lock probe audit — HA 2026.8.3 / PHACC 0.13.357

Baseline

• Exact origin/main SHA used: d7318a18b15e6b4a8134b50f405e69eb1dd557b7
• Current normal baseline:
  • homeassistant==2026.8.0
  • pytest-homeassistant-custom-component==0.13.354
• Required uv: 0.12.5 (required-version = "==0.12.5")
• Cooldown policy: exclude-newer = "3 days"
• Supported lock resolution range: python_full_version >= '3.14.2' and python_full_version < '3.15'
• Exact .python-version: 3.14.7
• Minimum compatibility lane (unchanged):
  • homeassistant==2026.5.0
  • pytest-homeassistant-custom-component==0.13.329

Candidate verification

• Candidate PHACC: 0.13.357
• Candidate Home Assistant: 2026.8.3
• PHACC 0.13.357 metadata requires exactly homeassistant==2026.8.3.
• 0.13.357 is the latest published PHACC release; Home Assistant 2026.8.3 is the latest stable 2026.8.x release.
• No newer stable matched 2026.8.x pair was found.
• 2026.9.x was not considered.

Cooldown / resolver result

The targeted normal-lock probe used uv 0.12.5 and the exact command:

uv lock --upgrade-package homeassistant --upgrade-package pytest-homeassistant-custom-component

It was run with the repository's normal exclude-newer = "3 days" policy. It did not complete:

homeassistant was filtered by exclude-newer to only include packages uploaded before 2026-08-21T12:48:46.993762246Z.
The requested version, v2026.8.3, was published at 2026-08-21T20:56:19.286Z.

• Home Assistant 2026.8.3 was therefore ineligible at probe time.
• PHACC 0.13.357 was also not yet eligible: its two uploaded artifacts were timestamped 2026-08-22T05:21:55.216022Z and 2026-08-22T05:21:56.443783Z.
• Probe time was 2026-08-24T12:48:45Z.
• Based on the later PHACC upload, the same probe should become eligible at approximately 2026-08-25T05:22Z, assuming no upstream changes.
• UV_EXCLUDE_NEWER=false was not used for the normal lock probe. That exception is specific to the compatibility canary introduced in ci: keep Home Assistant compatibility canary aligned with latest stable #356 and does not apply to the normal lock.

Expected lock delta

The exact requested comparison was:

Package	Current	Candidate
Home Assistant	2026.8.0	2026.8.3
pytest-homeassistant-custom-component	0.13.354	0.13.357

No candidate uv.lock was produced because the cooldown prevented resolution. Therefore this probe does not certify an exact lock-file delta, hash delta, or source delta.

Published metadata comparison found that Home Assistant 2026.8.0 and 2026.8.3 have identical complete dependency metadata. PHACC changes only its exact Home Assistant requirement. The inspected HA-pulled packages remain:

Package	Current lock	HA 2026.8.3 requirement
cryptography	48.0.1	48.0.1
aiohttp	3.14.3	3.14.3
PyJWT	2.13.0	2.13.0
Pillow	12.3.0	12.3.0
zeroconf	0.150.0	0.150.0
uv (pulled by Home Assistant)	0.11.31	0.11.31

Accordingly, once the cooldown expires, only HA and PHACC are expected to move; this remains an expectation, not a certified lock delta. No hash-only changes, source changes, or material dependency-metadata changes were observed. The scratch uv.lock remained unchanged.

Security

The authenticated current default-branch Dependabot query returned:

• Open alerts: 45
• Unique advisories: 44
• Severity counts: 1 critical, 17 high, 22 medium, 5 low
• .github/requirements/minimum-ha.txt: 44 alerts / 44 unique advisories
• uv.lock: 1 alert / 1 unique advisory
• Other manifests: 0 alerts

Normal uv.lock

Package	GHSA / CVE	Severity	Vulnerable range	Fixed version	Source
cryptography	GHSA-g6cj-pr64-35w5 / CVE-2026-69247	high	>=44.0.0, <50.0.0	50.0.0	uv.lock

The exact normal locked version is cryptography==48.0.1. HA 2026.8.3 still requires cryptography==48.0.1, so this advisory remains affected; the candidate does not change that package to the fixed 50.0.0.

.github/requirements/minimum-ha.txt

The following is the complete 44-alert inventory. Entries sharing package, severity, vulnerable range, and fixed version are grouped; every GHSA/CVE is retained.

Package	GHSA / CVE	Severity	Vulnerable range	Fixed	Source
homeassistant	GHSA-5hxg-r395-fqxx / CVE-2026-64825; GHSA-x84v-g949-293w / CVE-2026-54317	critical; high	<2026.6.0	2026.6.0	minimum-ha.txt
cryptography	GHSA-537c-gmf6-5ccf / no CVE	high	>=0.5.0, <48.0.1	48.0.1	minimum-ha.txt
cryptography	GHSA-g6cj-pr64-35w5 / CVE-2026-69247	high	>=44.0.0, <50.0.0	50.0.0	minimum-ha.txt
cryptography	GHSA-jwv3-5hgf-82ww / CVE-2026-69249	high	<=48.0.0	49.0.0	minimum-ha.txt
cryptography	GHSA-m2h6-j472-rp4c / CVE-2026-69248	medium	<=48.0.0	49.0.0	minimum-ha.txt
aiohttp	GHSA-cq5v-8q36-5273 / CVE-2026-69244	high	<=3.14.2	3.14.3	minimum-ha.txt
aiohttp	GHSA-m6qw-4cw2-hm4m / CVE-2026-50269	low	<=3.13.5	3.14.0	minimum-ha.txt
aiohttp	GHSA-2fqr-mr3j-6wp8 / CVE-2026-54279; GHSA-4m7w-qmgq-4wj5 / CVE-2026-54275; GHSA-9x8q-7h8h-wcw9 / CVE-2026-54280	low	<=3.14.0	3.14.1	minimum-ha.txt
aiohttp	GHSA-hg6j-4rv6-33pg / CVE-2026-47265; GHSA-jg22-mg44-37j8 / CVE-2026-34993	medium	<3.14.0	3.14.0	minimum-ha.txt
aiohttp	GHSA-xcgm-r5h9-7989 / CVE-2026-54274; GHSA-4fvr-rgm6-gqmc / CVE-2026-54273; GHSA-g3cq-j2xw-wf74 / CVE-2026-54278; GHSA-63hw-fmq6-xxg2 / CVE-2026-54277; GHSA-hpj7-wq8m-9hgp / CVE-2026-54276	medium	<=3.14.0	3.14.1	minimum-ha.txt
aiohttp	GHSA-mfx4-hv73-q22v / CVE-2026-69243; GHSA-mq44-7p77-q5h7 / CVE-2026-59881	medium	<=3.14.1	3.14.2	minimum-ha.txt
Pillow	GHSA-6r8x-57c9-28j4 / CVE-2026-59199; GHSA-xj96-63gp-2gmr / CVE-2026-59197	high	<12.3.0	12.3.0	minimum-ha.txt
Pillow	GHSA-jjj6-mw9f-p565 / CVE-2026-59200	high	>=5.1.0, <12.3.0	12.3.0	minimum-ha.txt
Pillow	GHSA-4x4j-2g7c-83w6 / CVE-2026-55798	medium	<12.3.0	12.3.0	minimum-ha.txt
Pillow	GHSA-fj7v-r99m-22gq / CVE-2026-59198	medium	>=5.2.0, <12.3.0	12.3.0	minimum-ha.txt
pillow	GHSA-9hw9-ch79-4vh6 / CVE-2026-59205; GHSA-phj9-mv4w-65pm / CVE-2026-55380; GHSA-45hq-cxwh-f6vc / CVE-2026-55379; GHSA-5x94-69rx-g8h2 / CVE-2026-54060; GHSA-8v84-f9pq-wr9x / CVE-2026-54059; GHSA-62p4-gmf7-7g93 / CVE-2026-54058	high	<12.3.0	12.3.0	minimum-ha.txt
pillow	GHSA-vjc4-5qp5-m44j / CVE-2026-59204	high	>=8.2.0, <12.3.0	12.3.0	minimum-ha.txt
pillow	GHSA-pg7v-jwj7-p798 / CVE-2026-59203	medium	>=12.0.0, <12.3.0	12.3.0	minimum-ha.txt
PyJWT	GHSA-993g-76c3-p5m4 / CVE-2026-48522	medium	>=2.0.0, <=2.12.1	2.13.0	minimum-ha.txt
pyjwt	GHSA-xgmm-8j9v-c9wx / CVE-2026-48526	high	<2.13.0	2.13.0	minimum-ha.txt
pyjwt	GHSA-fhv5-28vv-h8m8 / CVE-2026-48524	low	>=2.0.0, <=2.12.1	2.13.0	minimum-ha.txt
pyjwt	GHSA-w7vc-732c-9m39 / CVE-2026-48525; GHSA-jq35-7prp-9v3f / CVE-2026-48523	medium	>=2.8.0, <=2.12.1 and >=2.9.0, <2.13.0 respectively	2.13.0	minimum-ha.txt
zeroconf	GHSA-9663-mqmp-p9mm / CVE-2026-48045	medium	<0.149.12	0.149.12	minimum-ha.txt
zeroconf	GHSA-qc2x-6f54-m6h9 / CVE-2026-48487	medium	<0.149.16	0.149.16	minimum-ha.txt
zeroconf	GHSA-9pgc-3ccv-5297 / CVE-2026-47180	medium	<0.149.5	0.149.5	minimum-ha.txt
zeroconf	GHSA-phvx-9mgw-67r5 / CVE-2026-47183	medium	<0.149.6	0.149.6	minimum-ha.txt
zeroconf	GHSA-rfg2-pjw2-56x2 / CVE-2026-47184	medium	<0.149.7	0.149.7	minimum-ha.txt
uv	GHSA-4gg8-gxpx-9rph / no CVE	medium	<0.11.15	0.11.15	minimum-ha.txt

No alerts were dismissed or suppressed.

Repository integrity

• Scratch method: disposable shared-object git clone at /tmp/pollenlevels-issue345-probe-i8L77o/repo, detached at the exact SHA above; only the scratch pyproject.toml was edited for the probe.
• Scratch directory was removed after the probe.
• Temporary Dependabot response /tmp/pollenlevels-345-alerts.json was removed.
• Final real-repository status: clean; git status --porcelain produced no output.
• Real worktree remained on its pre-existing ci/353-latest-ha-canary branch.
• No tracked or untracked repository files were changed.
• No minimum-HA, runtime, release, migration, lock, commit, push, or PR changes were made.

Decision

HOLD

The candidate matched correctly and the expected update appears focused. The blocker is the mandatory three-day exclude-newer policy. The candidate must not be forced into the normal lock by disabling the cooldown. Re-run the same targeted probe once both candidate artifacts become eligible, approximately after 2026-08-25T05:22Z.