Home Assistant 2026.10.3: eighty percent integration fixes, the rest chasing infrastructure

Home Assistant 2026.10.3 shipped on October 23. The changelog looks long but its structure is simple: eighty percent concrete integration bugs, twenty percent base-layer upgrades. A few entries are worth reading closely.

One: three classic integration mistakes

Shared state mutated in place

Fix Sensibo full_state action modifying the coordinator data (#187014)

Home Assistant integrations mostly use the coordinator pattern: one object polls device state on a schedule and every entity reads from it. The bug appears when an action (say “set full state”) writes fields directly into the coordinator’s data structure:

• every entity immediately sees a state that is not real;
• the next poll brings the truth back and the UI jumps;
• automations running in between act on the fake state.

The correct shape is “build a new state → send it to the device → wait for the poll to confirm”, never mutate in place. This bug is extremely common in hand-written integrations because it only shows up when the device rejects the change.

A shared SSL context

Create new SSL context instead of sharing context in SMTP integration (#186812)

The SMTP integration shared one SSL context across all notifications. Sharing is not wrong by itself, but a context is a mutable object — change the verification mode or add a certificate anywhere and the effect is global. Creating one per use costs a little memory and buys isolation.

A pinned dependency

Constrain bitstring<5 to fix edl21 (pysml incompatibility) (#186985)

Pure technical debt: the edl21 integration depends on pysml, which is incompatible with bitstring 5.x. The fix is not code, it is pinning an upper bound. Patches like this will keep appearing in the Python ecosystem because nobody can unilaterally demand upstream compatibility.

Two: startup timing, the KNX entry

Hold off the bootstrap timeout while the KNX telegram store initializes (#186980)

KNX is a building bus protocol, and the integration loads a “telegram store” at startup — potentially large. Home Assistant has a startup timeout: an integration taking too long is treated as failed.

Hence the contradiction: the timeout exists to prevent hangs, and it kills an integration that is legitimately loading a big file. The fix lets the integration tell the framework “still working”, so the clock stops.

That is a general lesson in startup design: timeouts are necessary, but they need a progress-signal exit, otherwise slow equals dead.

Three: the base layer

The second half of the changelog is infrastructure, and it is informative:

Item	Change
Python	3.14.8
uv	0.12.24 → 0.13.0 → 0.13.4 → 0.13.5 (four bumps in one cycle)
Build runner	Ubuntu 26.04
wheels / base image	2026.10.0 → 2026.10.1
Frontend	20260930.5

The uv line is the interesting one: four uv releases inside a single patch cycle. Home Assistant treats uv as build and resolution infrastructure and follows upstream security and certificate fixes — the same point I made last week about tools that bundle a trust store needing to ship often.

Four: what a patch list tells you

I read these lists for three things:

1. Any “data mutated in place” fix. Those bugs do the most damage: no error, just UI and automations briefly lying. The Sensibo entry is one.
2. Any pinned upper bound. It means a long-standing ecosystem conflict exists and your upgrade path has a pothole.
3. The cadence of base upgrades. Python and uv version movement shows how fast the project absorbs upstream security fixes.

By those three, 2026.10.3 is a healthy patch release: nothing dramatic on the security side, but a batch of “lies under specific conditions” removed.

Five: upgrade or not

Upgrade. Home Assistant patch releases rarely change behavior, and these integration bugs tend to appear exactly when you least want them — an automation acting on fake state at 3 a.m.

The one thing to do afterwards: if you use any of the fixed integrations (Proxmox, UniFi Access, Sensibo, KNX, FRITZ!SmartHome, Home Connect, Synology DSM), check those entities’ history for abnormal jumps. On the first day after a fix, the history usually looks suspiciously smooth — that is the previously polluted data being left behind.