Dependency Dashboard

[ha-mcp-renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Repository Problems

Renovate tried to run on this repository, but found these problems.

• ⚠️ WARN: Some release(s) did not have a releaseTimestamp, but as we're running with minimumReleaseAgeBehaviour=timestamp-optional, proceeding. See debug logs for more information

Awaiting Schedule

The following updates are awaiting their schedule. To get an update now, click on a checkbox below.

• chore(deps): update ghcr.io/home-assistant/home-assistant docker tag to v2026.8.1
• chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.12.3
• 🔐 Create all awaiting schedule PRs at once 🔐

Detected Dependencies

dockerfile (6)

Dockerfile (2)

• docker/dockerfile 1
• ghcr.io/astral-sh/uv 0.11.33-python3.13-trixie-slim@sha256:ddcc6242921ee120cf279fdcedfc8bb917c9af4de9ad791495e4c7deb479a296 → [Updates: 0.12.3-python3.13-trixie-slim]

homeassistant-addon-dev/Dockerfile (2)

• docker/dockerfile 1
• ghcr.io/astral-sh/uv 0.11.33-python3.13-trixie-slim@sha256:ddcc6242921ee120cf279fdcedfc8bb917c9af4de9ad791495e4c7deb479a296 → [Updates: 0.12.3-python3.13-trixie-slim]

homeassistant-addon-webhook-proxy-dev/Dockerfile (1)

• docker/dockerfile 1

homeassistant-addon-webhook-proxy/Dockerfile (1)

• docker/dockerfile 1

homeassistant-addon/Dockerfile (2)

• docker/dockerfile 1
• ghcr.io/astral-sh/uv 0.11.33-python3.13-trixie-slim@sha256:ddcc6242921ee120cf279fdcedfc8bb917c9af4de9ad791495e4c7deb479a296 → [Updates: 0.12.3-python3.13-trixie-slim]

tests/haos_image_build/screenshot_engine_mock/Dockerfile

git-submodules (1)

.gitmodules (1)

• src/ha_mcp/resources/skills-vendor main@9e4eff281112218953dc708687d24601777f9ccb

regex (12)

.github/workflows/e2e-tests.yml (1)

• ghcr.io/home-assistant/home-assistant 2026.8.0 → [Updates: 2026.8.1]

.github/workflows/e2e-tests.yml (1)

• ghcr.io/home-assistant/home-assistant 2026.8.0 → [Updates: 2026.8.1]

.github/workflows/performance-tests.yml (1)

• ghcr.io/home-assistant/home-assistant 2026.8.0 → [Updates: 2026.8.1]

.github/workflows/performance-tests.yml (1)

• ghcr.io/home-assistant/home-assistant 2026.8.0 → [Updates: 2026.8.1]

.github/workflows/pr.yml (6)

• ghcr.io/home-assistant/home-assistant 2026.8.0 → [Updates: 2026.8.1]
• ghcr.io/astral-sh/uv 0.11.33 → [Updates: 0.12.3]
• ghcr.io/astral-sh/uv 0.11.33 → [Updates: 0.12.3]
• ghcr.io/astral-sh/uv 0.11.33 → [Updates: 0.12.3]
• ghcr.io/astral-sh/uv 0.11.33 → [Updates: 0.12.3]
• ghcr.io/astral-sh/uv 0.11.33 → [Updates: 0.12.3]

.github/workflows/pr.yml (6)

• ghcr.io/home-assistant/home-assistant 2026.8.0 → [Updates: 2026.8.1]
• ghcr.io/astral-sh/uv 0.11.33 → [Updates: 0.12.3]
• ghcr.io/astral-sh/uv 0.11.33 → [Updates: 0.12.3]
• ghcr.io/astral-sh/uv 0.11.33 → [Updates: 0.12.3]
• ghcr.io/astral-sh/uv 0.11.33 → [Updates: 0.12.3]
• ghcr.io/astral-sh/uv 0.11.33 → [Updates: 0.12.3]

src/ha_mcp/_vendor/requirements.txt (1)

• websockets 17.0.1

src/ha_mcp/_vendor/requirements.txt (1)

• websockets 17.0.1

tests/haos_image_build/build_image.py (1)

• home-assistant/operating-system 18.2

tests/haos_image_build/build_image.py (1)

• home-assistant/operating-system 18.2

tests/test_constants.py (1)

• ghcr.io/home-assistant/home-assistant 2026.8.0 → [Updates: 2026.8.1]

tests/test_constants.py (1)

• ghcr.io/home-assistant/home-assistant 2026.8.0 → [Updates: 2026.8.1]

[github-actions]

🔍 Analysis

This issue is an automated Dependency Dashboard created by Renovate. It serves as a centralized hub for tracking and managing dependency updates across the ha-mcp repository. Currently, it identifies two available updates: upgrading the uv tool to v0.11.13 and updating the home-assistant Docker image used in tests to v2026.5.1.

The dashboard also highlights a warning regarding vulnerability alerts. Renovate is currently unable to access these alerts, which typically happens when the integration lacks the necessary permissions in the repository settings. This doesn't prevent Renovate from functioning, but it means security-related metadata for these updates might be missing from the dashboard.

🛠️ Suggested Steps

1. Review and Merge PRs: Visit the already created pull requests for these updates:
   • #1233: uv update to v0.11.13.
   • #1236: home-assistant update to v2026.5.1.
2. Fix Permissions: To resolve the vulnerability alerts warning, a maintainer should go to Settings > Code security and analysis in the GitHub repository and ensure that "Dependabot alerts" and "Dependabot security updates" are enabled. Additionally, verify that the Renovate integration has the security_events: read permission.
3. Use the Dashboard: If you need to rebase or retry any of the listed updates, you can simply click the checkboxes in the issue description, and Renovate will automatically trigger the corresponding action.

📊 Technical Analysis (for maintainers)

Root Cause

This is an automated tracking issue generated by Renovate based on the configuration in renovate.json. It uses both standard managers (dockerfile) and custom regex managers to track versions across Dockerfiles, GitHub Workflows, and Python test constants.

Affected Code

The following files are being tracked for the dependencies mentioned in this dashboard:

• Dockerfile - Tracks ghcr.io/astral-sh/uv
• homeassistant-addon/Dockerfile - Tracks ghcr.io/astral-sh/uv
• homeassistant-addon-dev/Dockerfile - Tracks ghcr.io/astral-sh/uv
• .github/workflows/pr.yml - Tracks both uv and home-assistant images
• .github/workflows/e2e-tests.yml - Tracks home-assistant image
• .github/workflows/performance-tests.yml - Tracks home-assistant image
• tests/test_constants.py - Tracks HA_TEST_IMAGE version

Related Issues/PRs

• chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.11.13 #1233 - Update uv to v0.11.13
• chore(deps): update ghcr.io/home-assistant/home-assistant docker tag to v2026.5.1 #1236 - Update home-assistant to v2026.5.1

---

🤖 Automated analysis by Issue Bot

[Patch76]

Audited the hidden-Unicode warning at HEAD 499ebf0:

• Bidi-override (Trojan Source class — U+202A–U+202E, U+2066–U+2069): 0 matches across repo (excluding .git, node_modules, .venv, __pycache__, vendored output).
• Zero-width / invisible (U+200B–U+200D, U+2060, U+FEFF, U+00AD, U+2061–U+2063): 2 matches, both legitimate emoji ZWJ-sequences:
  • site/README.md:7 — 🧑‍🚀 (Astro starter astronaut)
  • tests/initial_test_state/.storage/hacs.repositories:1453 — 🏳️‍🌈 🏴‍☠️ (HACS fixture description)

No Trojan-Source vulnerability. Renovate's warning is a conservative ZWJ-flag, not an attack signal — no code action required.

[kingpanther13]

@Patch76 I think that this should remain open, renovate handles everything on its end. I will separately try to clear the warning