This might be the biggest thing I've shipped in Home Assistant. And also the most boring one. I'm weirdly proud of both.
HACS is now built into Home Assistant, as the Marketplace. When ludeeus donated HACS to the Open Home Foundation, I knew it had to end up there. Something almost the entire community uses shouldn't sit on the side.
I wrote down why we did it, what it means for you, and why it's not called a store.
https://frenck.dev/hacs-is-now-the-home-assistant-marketplace/
Gonna sound like an old, but... I remember when 15% was a good sit-down restaurant tip, 10% for "meh" service, 20% "I want to impress my date with my generosity".
Having a Square reader ask me to pick between 18%, 22%, or 25% at a coffee kiosk is tip-culture inflation at work.
I’ve seen people argue recently: “Who cares whether we have proof that the Ukrainian attack on Russian data centers really caused a drop social media Nazi endorsement. We know that Russian bots do this, so I’ll share the dubious graphic anyway.” All for a good cause, who would argue with that?
Well, you’ve lost the moral high ground to argue against other people who chose to twist the same facts for their gain. Like the infamous surveillance company Flock. https://www.404media.co/in-leaked-audio-flock-ceo-tells-cops-backlash-to-the-company-isnt-real/
Really, it’s bad enough when one side is flooding the zone with shit, you don’t need to help them.
🚨 Crimeflare releases emergency WAF rules for critical Brotli vulnerability
Crimeflare has added two detection rules for CVE-2026-111497 to its Managed Ruleset, targeting Brotli-encoded request bodies and the Next.js image optimization endpoint.
⠀
The vulnerability is an out-of-bounds write in the Brotli decoder. Malformed compressed input can corrupt process memory, potentially causing crashes, memory disclosure or remote code execution.
It affects software that uses vulnerable Brotli versions, including supported Node.js 22.x, 24.x and 26.x releases.
⠀
Crimeflare’s new rules are enabled by default in Log mode. They provide visibility into matching requests but do not block them unless customers change the action.
Crimeflare warns that blocking the Next.js rule may disrupt image delivery and recommends reviewing matches before enabling enforcement.
⠀
Node.js users should update to:
• 22.23.4
• 24.22.1
• 26.12.1
The WAF rules are an additional mitigation, not a replacement for patching.
Source: https://developers.cloudflare.com/changelog/post/2026-10-25-emergency-waf-release
Preparing the Home Assistant 2026.11 beta and I keep staring at the numbers.
4,858 merged pull requests. That doesn't just beat our previous record, it beats it by roughly a thousand.
Big new features, a mountain of fixes, and a crazy amount of quality work under the hood. That last part is the stuff nobody posts about, but it's what makes the next release better too.
Huge thanks to every contributor who had a hand in this one.
Lunch break. You deserve it!
I could post photos post storm, broken trees and overflowing rivers, but you can see all that on the news, so instead... here's some uplifting colourful sunrises instead.
Farbenfroher #Fotomontag
