home-assistant / core
Repository health
Security advisories, maintenance activity, dependencies and license for home-assistant/core, with what was checked and what was not.
Security
25 dependencies checked (25 direct), pypi, via deps.dev. Findings apply only to the packages and versions checked.
OpenSSF Scorecard · 8.2/10
Checks sorted from strongest to weakest.
- Maintained30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 1010/10
- Code-Reviewall changesets reviewed10/10
- Dangerous-Workflowno dangerous workflow patterns detected10/10
- Token-PermissionsGitHub workflow tokens follow principle of least privilege10/10
- Licenselicense file detected10/10
- Binary-Artifactsno binaries found in the repo10/10
- Packagingpackaging workflow detected10/10
- Security-Policysecurity policy file detected9/10
- Pinned-Dependenciesdependency not pinned by hash detected -- score normalized to 88/10
- SASTSAST tool detected but not run on all commits7/10
- Branch-Protectionbranch protection is not maximal on development and all release branches5/10
- CII-Best-Practicesno effort to earn an OpenSSF best practices badge detected0/10
- Fuzzingproject is not fuzzed0/10
- Signed-Releasesno releases foundnot scored
Maintenance
Outside contributions: 4 of 85 external pull requests merged (22% of those decided), median 0 days to merge.From the 100 most recently updated pull requests, bots excluded.
Recent releases
- 2026.10.110 Oct 2026 · 3 days after previous
- 2026.10.07 Oct 2026 · same day as previous
- 2026.10.0b77 Oct 2026 · same day as previous
- 2026.10.0b67 Oct 2026 · same day as previous
- 2026.10.0b57 Oct 2026 · same day as previous
- 2026.10.0b47 Oct 2026 · same day as previous
Commit activity
100 commits sampledClick a bar to browse commits — or open GitHub for the full month ↓
Work rhythm
Commits by day of week
Pull request health
How fast do PRs resolve?
Days from open to merged / closed, last 20 PRs.
Pending right now10 open PRs
Recently merged16 PRs in the recent window
Issue triage — last 12 weeks
Blue bars = issues opened that week, green = closed. Healthy projects keep these roughly in balance — a persistently bigger blue bar means an opening backlog. open issues on GitHub ↗
Release cadence· median 0d between releases
Latest 2026.10.1 shipped 4d ago · typical gap 0d · shipping faster than before · 10 releases sampled.
New faces — last 90 days33 contributors appearing for the first time in this window
Heuristic: contributors whose earliest commit in the recent sample is < 90 days old AND who have ≤ 3 commits in the window. Click a name for their commits in this repo.
Top contributors
Issue health
Computed from GitHub Issues — no estimates. Per-issue rates use the 74 most-recently-updated issues (recent, not all-time); the open total and oldest-open age are repo-wide.
Total open on the repo (authoritative).
From 22 recently-closed issues. p90 7mo.
Age of the longest-open unresolved issue.
0 of 52 recent open issues have no comments yet.
0 of 52 recent open issues had no update in 30d+.
1 of 52 recent open issues are unlabeled.
What the backlog is about
AI-generatedOpen issues grouped into themes by an LLM from their titles — a summary, not an authoritative classification. Numbers reflect the 40 most-recently-active open issues.
Most-wanted
Open issues with the most positive reactions — what the community is asking for.
Apple TV Integration No Longer Works
#145046 · opened 1y ago · @jimRoper
Detected that integration 'ipp' passes a non-string value of type list as sw_version
#172541 · opened 4mo ago · @mib1185
Mikrotik integration stopped working, After updating to 2026.4
#167977 · opened 6mo ago · @Lucaspog
OpenRGB no longer works with 1.0 release
#182151 · opened 1mo ago · @amaisano
Snapshot timeout on ffmpeg camera
#51073 · opened 5y ago · @slydiman
Most-discussed
Open issues with the most comments — where the conversation is.
Snapshot timeout on ffmpeg camera
#51073 · opened 5y ago · @slydiman
Apple TV Integration No Longer Works
#145046 · opened 1y ago · @jimRoper
Add support for Tuya category "tdq" (T & H Sensor with external probe, product_id: jc1afi7ow32okd0h)
#163205 · opened 7mo ago · @kslivins
Mikrotik integration stopped working, After updating to 2026.4
#167977 · opened 6mo ago · @Lucaspog
Honeywell does not handle thermostat connection loss
#139142 · opened 1y ago · @chadwackerman
Labels in the recent sample
Per-issue rates are computed from a sample of 74 most-recently-updated issues, so they describe recent behavior rather than the all-time backlog. Reaction and comment counts come straight from GitHub.
Dependencies
Checked packages and import counts
Checked counts describe advisory coverage, not the repository’s complete dependency inventory. External imports come from a separate source-code graph.