esphome

ESPHome is a system to configure your microcontrollers by simple yet powerful configuration files and control them remotely through Home Automation systems.

View on Pypi

Activity

Latest release: 3d ago
Total releases: 629
Cadence: ~2 days
Last 12 months: 115

Details

License: MIT
First release: Feb 11, 2019

Releases

Version	Released
`2026.10.1` patch	Oct 27, 2026
`2026.10.0` minor	Oct 21, 2026
`2026.10.0b6` pre	Oct 21, 2026
`2026.10.0b5` pre	Oct 19, 2026
`2026.10.0b4` pre	Oct 13, 2026
`2026.10.0b3` pre	Oct 12, 2026
`2026.10.0b2` pre	Oct 09, 2026
`2026.10.0b1` pre	Oct 07, 2026
`2026.9.1` patch	Sep 29, 2026
`2026.9.0` minor	Sep 16, 2026
`2026.9.0b5` pre	Sep 16, 2026
`2026.9.0b4` pre	Sep 14, 2026
`2026.9.0b3` pre	Sep 09, 2026
`2026.9.0b2` pre	Sep 07, 2026
`2026.9.0b1` pre	Sep 03, 2026
`2026.8.2` patch	Aug 31, 2026
`2026.8.1` patch	Aug 23, 2026
`2026.8.0` minor	Aug 20, 2026
`2026.8.0b6` pre	Aug 19, 2026
`2026.8.0b5` pre	Aug 18, 2026
`2026.8.0b4` pre	Aug 16, 2026
`2026.8.0b3` pre	Aug 14, 2026
`2026.8.0b2` pre	Aug 13, 2026
`2026.8.0b1` pre	Aug 12, 2026
`2026.7.4` patch	Aug 05, 2026
`2026.7.3` patch	Jul 28, 2026
`2026.7.2` patch	Jul 23, 2026
`2026.7.1` patch	Jul 20, 2026
`2026.7.0` minor	Jul 16, 2026
`2026.7.0b4` pre	Jul 15, 2026
`2026.7.0b3` pre	Jul 14, 2026
`2026.7.0b2` pre	Jul 13, 2026
`2026.7.0b1` pre	Jul 09, 2026
`2026.6.5` patch	Jul 09, 2026
`2026.6.4` patch	Jul 01, 2026
`2026.6.3` patch	Jun 29, 2026
`2026.6.2` patch	Jun 20, 2026
`2026.6.1` patch	Jun 18, 2026
`2026.6.0` minor	Jun 18, 2026
`2026.6.0b4` pre	Jun 17, 2026
`2026.6.0b3` pre	Jun 16, 2026
`2026.6.0b2` pre	Jun 15, 2026
`2026.6.0b1` pre	Jun 11, 2026
`2026.5.3` patch	Jun 05, 2026
`2026.5.2` patch	Jun 02, 2026
`2026.5.1` patch	May 24, 2026
`2026.5.0` minor	May 21, 2026
`2026.5.0b4` pre	May 20, 2026
`2026.5.0b3` pre	May 20, 2026
`2026.5.0b2` pre	May 18, 2026

1–50 of 629

Dependencies (51)

Depends on

2026.10.1

Used by

Supply-chain exposure

5 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (6)

CVE-2026-23833 PYSEC-2026-1326 GHSA-4h3h-63v6-88qx Jul 07, 2026

ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component

High
Adjacent Low High None

Summary

An integer overflow in the API component's protobuf decoder allows denial-of-service attacks when API encryption is not used.

Details

The bounds check ptr + field_length > end in components/api/proto.cpp can overflow when a malicious client sends a large field_length value. This affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny). The overflow bypasses the out-of-bounds check, causing the device to read invalid memory and crash.

When using the plaintext API protocol, this attack can be performed without authentication. When noise encryption is enabled, knowledge of the encryption key is required.

Affected Versions

ESPHome 2025.9.0 through 2025.12.6

Mitigation

Upgrade to ESPHome 2025.12.7 or later (or 2026.1.0b3 or later)

Enable API encryption with a unique key per device

Follow the Security Best Practices

Severity

Low - Users following Security Best Practices with API encryption enabled are not affected without knowledge of the encryption key.

Impact

Denial-of-service. An attacker with network access to port 6053 can crash and reboot the device.

Credits

Thanks to @Mat931 for responsibly reporting this vulnerability.

Affected versions

2025.10.02025.10.0b12025.10.0b22025.10.0b32025.10.0b42025.10.12025.10.22025.10.32025.10.42025.10.52025.11.02025.11.0b1

+ 25 more Show less

2025.11.0b22025.11.0b32025.11.0b42025.11.0b52025.11.12025.11.22025.11.32025.11.42025.11.52025.12.02025.12.0b12025.12.0b22025.12.0b32025.12.0b42025.12.0b52025.12.12025.12.22025.12.32025.12.42025.12.52025.12.62025.9.02025.9.12025.9.22025.9.3

Fixed in

2025.12.7

References

https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx
https://nvd.nist.gov/vuln/detail/CVE-2026-23833
https://github.com/esphome/esphome/pull/13306
https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6
https://esphome.io/guides/security_best_practices
https://github.com/esphome/esphome

Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-57808 PYSEC-2026-1330 GHSA-mxh2-ccgj-8635 Jul 07, 2026

ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header

8.1 / 10
High
Adjacent Low None None Unchanged High High None

Summary

On the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value is empty or is a substring of the correct value (e.g., correct username with partial password). This allows access to web_server functionality (including OTA, if enabled) without knowing any information about the correct username or password.

Details

The HTTP basic auth check in web_server_idf's AsyncWebServerRequest::authenticate only compares up to auth.value().size() - auth_prefix_len bytes of the base64-encoded user:pass string. This means a client-provided valuer like dXNlcjpz (user:s) will pass the check when the correct value is much longer, e.g., dXNlcjpzb21lcmVhbGx5bG9uZ3Bhc3M= (user:somereallylongpass).

Furthermore, the check will also pass when the supplied value is the empty string, which removes the need to know (or brute force) the username. A browser won't generally issue such a request, but it can easily be done by manually constructing the Authorizaztion request header (e.g., via curl).

PoC

Configure ESPHome as follows:

esp32: board: ... framework: type: esp-idf web_server: auth: username: user password: somereallylongpass

In a browser, you can correctly log in by supplying username user and password somereallylongpass... but you can also incorrectly log in by supplying substrings of the password whose base64-encoded digest matches a prefix of the correct digest. (For example, I was able to log into an ESPHome device so configured by supplying password some... or even just s.)

You can also use a tool like curl to manually set an Authorization request header that always passes the check without any knowledge of the username:

$ curl -D- http://example.local/ HTTP/1.1 401 Unauthorized ... $ curl -D- -H 'Authorization: Basic ' http://example.local/ HTTP/1.1 200 OK ...

Impact

This vulnerability effectively nullifies basic auth support for the ESP-IDF web_server, allowing auth bypass from another device on the local network with no knowledge of the correct username or password required.

Remediation

This vulnerability is fixed in 2025.8.1 and later.

For older versions, disabling the web_server component on ESP-IDF devices may be prudent, particularly if OTA updates through web_server are enabled.

Affected versions

1.10.11.11.01.11.0b11.11.0b21.11.0b31.11.11.11.21.12.01.12.0b11.12.0b21.12.0b31.12.0b4

+ 482 more Show less

1.12.11.12.21.13.01.13.0b11.13.0b21.13.0b31.13.0b41.13.0b51.13.0b61.13.0b71.13.11.13.21.13.31.13.41.13.51.13.61.14.01.14.0b11.14.0b21.14.0b31.14.0b41.14.0b51.14.11.14.21.14.31.14.41.14.51.15.01.15.0b11.15.0b21.15.0b31.15.0b41.15.11.15.21.15.31.16.01.16.0b11.16.0b21.16.0b31.16.0b41.16.0b51.16.0b61.16.0b71.16.0b81.16.11.16.21.17.01.17.0b11.17.11.17.21.18.01.18.0b11.18.0b21.18.0b31.18.0b41.19.01.19.0b11.19.0b21.19.0b31.19.0b41.19.0b51.19.0b61.19.0b71.19.11.19.21.19.31.19.41.20.01.20.0b11.20.0b21.20.0b31.20.0b41.20.0b51.20.0b61.20.11.20.21.20.31.20.41.21.0b11.21.0b21.21.0b32021.10.02021.10.0b12021.10.0b102021.10.0b112021.10.0b22021.10.0b32021.10.0b42021.10.0b52021.10.0b62021.10.0b72021.10.0b82021.10.0b92021.10.12021.10.22021.10.32021.11.02021.11.0b12021.11.0b22021.11.0b32021.11.0b42021.11.0b52021.11.0b62021.11.0b72021.11.0b82021.11.0b92021.11.12021.11.22021.11.32021.11.42021.12.02021.12.0b12021.12.0b22021.12.0b32021.12.0b42021.12.0b52021.12.0b62021.12.12021.12.22021.12.32021.8.02021.8.12021.8.22021.9.02021.9.0b12021.9.0b22021.9.0b32021.9.0b42021.9.0b52021.9.12021.9.22021.9.32022.1.02022.1.0b12022.1.0b22022.1.0b32022.1.0b42022.1.12022.1.22022.1.32022.1.42022.10.02022.10.0b12022.10.0b22022.10.12022.10.22022.11.02022.11.0b12022.11.0b22022.11.0b32022.11.0b42022.11.0b52022.11.0b62022.11.12022.11.22022.11.32022.11.42022.11.52022.12.02022.12.0b12022.12.0b22022.12.0b32022.12.0b42022.12.0b52022.12.0b62022.12.12022.12.22022.12.32022.12.42022.12.52022.12.62022.12.72022.12.82022.2.02022.2.0b12022.2.0b22022.2.0b32022.2.12022.2.22022.2.32022.2.42022.2.52022.2.62022.3.02022.3.0b12022.3.0b22022.3.12022.3.22022.4.02022.4.0b12022.4.0b22022.4.0b32022.4.0b42022.5.02022.5.0b12022.5.0b22022.5.0b32022.5.0b42022.5.12022.6.02022.6.0b12022.6.0b22022.6.0b32022.6.0b42022.6.12022.6.22022.6.32022.8.02022.8.0b12022.8.0b22022.8.0b32022.8.12022.8.22022.8.32022.9.02022.9.0b12022.9.0b22022.9.0b32022.9.0b42022.9.0b52022.9.12022.9.22022.9.32022.9.42023.10.02023.10.0b12023.10.0b22023.10.0b32023.10.0b42023.10.12023.10.22023.10.32023.10.42023.10.52023.10.62023.11.02023.11.0b12023.11.0b22023.11.0b32023.11.0b42023.11.0b52023.11.0b62023.11.0b72023.11.12023.11.22023.11.32023.11.42023.11.52023.11.62023.12.02023.12.0b12023.12.0b22023.12.0b32023.12.0b42023.12.0b52023.12.0b62023.12.12023.12.22023.12.32023.12.42023.12.52023.12.62023.12.72023.12.82023.12.92023.2.02023.2.0b12023.2.0b22023.2.0b32023.2.0b42023.2.0b52023.2.12023.2.22023.2.32023.2.42023.3.02023.3.0b12023.3.0b22023.3.0b32023.3.0b42023.3.0b52023.3.0b62023.3.12023.3.22023.4.02023.4.0b12023.4.0b22023.4.0b32023.4.0b42023.4.12023.4.22023.4.32023.4.42023.5.02023.5.0b12023.5.0b22023.5.0b32023.5.0b42023.5.0b52023.5.12023.5.22023.5.32023.5.42023.5.52023.6.02023.6.0b12023.6.0b22023.6.0b32023.6.0b42023.6.0b52023.6.0b62023.6.0b72023.6.12023.6.22023.6.32023.6.42023.6.52023.7.02023.7.0b12023.7.0b22023.7.0b32023.7.12023.8.02023.8.0b12023.8.0b22023.8.0b32023.8.0b42023.8.12023.8.22023.8.32023.9.02023.9.0b12023.9.0b22023.9.0b32023.9.0b42023.9.12023.9.22023.9.32024.10.02024.10.0b12024.10.0b22024.10.12024.10.22024.10.32024.11.02024.11.0b12024.11.0b22024.11.0b32024.11.0b42024.11.12024.11.22024.11.32024.12.02024.12.0b12024.12.0b22024.12.0b32024.12.12024.12.22024.12.32024.12.42024.2.02024.2.0b12024.2.0b22024.2.0b32024.2.12024.2.22024.3.02024.3.0b12024.3.0b22024.3.0b32024.3.0b42024.3.0b52024.3.12024.3.22024.4.02024.4.0b12024.4.0b22024.4.0b32024.4.12024.4.22024.5.02024.5.0b12024.5.0b22024.5.0b32024.5.0b42024.5.0b52024.5.0b62024.5.12024.5.22024.5.32024.5.42024.5.52024.6.02024.6.0b12024.6.0b22024.6.0b32024.6.0b42024.6.0b52024.6.12024.6.22024.6.32024.6.42024.6.52024.6.62024.7.02024.7.0b12024.7.0b22024.7.0b32024.7.0b42024.7.12024.7.22024.7.32024.8.02024.8.0b12024.8.0b22024.8.0b32024.8.0b42024.8.12024.8.22024.8.32024.9.02024.9.0b12024.9.0b22024.9.0b32024.9.0b42024.9.12024.9.22025.2.02025.2.0b12025.2.0b22025.2.0b32025.2.0b42025.2.0b52025.2.0b62025.2.12025.2.22025.3.02025.3.0b12025.3.0b22025.3.0b32025.3.0b42025.3.0b52025.3.12025.3.22025.3.32025.4.02025.4.0b12025.4.0b22025.4.0b32025.4.12025.4.22025.5.02025.5.0b22025.5.0b32025.5.0b42025.5.0b52025.5.0b62025.5.12025.5.22025.6.02025.6.0b12025.6.0b22025.6.0b32025.6.12025.6.22025.6.32025.7.02025.7.0b12025.7.0b22025.7.0b32025.7.0b42025.7.0b52025.7.12025.7.22025.7.32025.7.42025.7.52025.8.02025.8.0b12025.8.0b22025.8.0b32025.8.0b4

Fixed in

2025.8.1

References

https://github.com/esphome/esphome/security/advisories/GHSA-mxh2-ccgj-8635
https://nvd.nist.gov/vuln/detail/CVE-2025-57808
https://github.com/esphome/esphome/commit/2aceb56606ec8afec5f49c92e140c8050a6ccbe5
https://github.com/esphome/esphome
https://pypi.org/project/esphome
https://github.com/advisories/GHSA-mxh2-ccgj-8635

Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-29019 PYSEC-2026-1327 GHSA-5925-88xh-6h99 Jul 07, 2026

ESPHome vulnerable to Authentication bypass via Cross site request forgery

8.1 / 10
High
Network Low None Required Unchanged High High None

Summary

API endpoints in dashboard component of ESPHome version 2023.12.9 (command line installation) are vulnerable to Cross-Site Request Forgery (CSRF) allowing remote attackers to carry out attacks against a logged user of the dashboard to perform operations on configuration files (create, edit, delete).

Details

It is possible for a malicious actor to create a specifically crafted web page that triggers a cross site request against ESPHome, this allows bypassing the authentication for API calls on the platform.

PoC

An example of malicious web page that abuses this vulnerability:

<script> document.forms[0].submit(); </script> <script> </script>

In which an attacker creates and weaponizes "poc.yaml" config file containing a cookie exfiltration script and forces the payload triggering visiting the vulnerable page.

Example of such script:

Impact

This vulnerability allows bypassing authentication on API calls accessing configuration file operations on the behalf of a logged user. In order to trigger the vulnerability, the victim must visit a weaponized page.

In addition to this, it is possible to chain this vulnerability with GHSA-9p43-hj5j-96h5 (as seen in the PoC) to obtain a complete takeover of the user account.

Affected versions

2023.12.92024.2.02024.2.0b12024.2.0b22024.2.0b32024.2.12024.2.22024.3.0b12024.3.0b22024.3.0b32024.3.0b42024.3.0b5

Fixed in

2024.3.0

References

https://github.com/esphome/esphome/security/advisories/GHSA-5925-88xh-6h99
https://nvd.nist.gov/vuln/detail/CVE-2024-29019
https://github.com/esphome/esphome/pull/6396
https://github.com/esphome/esphome/pull/6397
https://github.com/esphome/esphome/commit/c56c40cb824e34ed2b89ba1cb8a3a5eb31459c74
https://github.com/advisories/GHSA-9p43-hj5j-96h5

Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-27287 PYSEC-2026-1329 GHSA-9p43-hj5j-96h5 Jul 07, 2026

esphome vulnerable to stored Cross-site Scripting in edit configuration file API

6.5 / 10
Medium
Network Low High None Unchanged High High None

Summary

Edit configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation and Home Assistant add-on) serves unsanitized data with “Content-Type: text/html; charset=UTF-8”, allowing remote authenticated user to inject arbitrary web script and exfiltrate session cookies via Cross-Site scripting (XSS).

Credits

Spike Reply Cybersecurity Teams

Details

It is possible for a malicious authenticated user to inject arbitrary Javascript in configuration files using a POST request to the /edit endpoint, the configuration parameter allows to specify the file to write.

To trigger the XSS vulnerability, the victim must visit the page /edit?configuration=[xss file].

PoC

To reproduce the issue, it is possible to perform a POST request to inject the payload:

request: POST /edit?configuration=xss.yaml HTTP/1.1 Host: localhost:6052 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/116.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: http://localhost:6052/ Connection: close Cookie: authenticated=[replace with valid cookie] Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin Content-Length: 40

response: HTTP/1.1 200 OK Server: TornadoServer/6.3.3 Content-Type: text/html; charset=UTF-8 Date: Thu, 30 Nov 2023 11:02:27 GMT Content-Length: 0 Connection: close

And subsequently trigger the XSS with a GET request to the same endpoint:

request: GET /edit?configuration=xss.yaml HTTP/1.1 Host: localhost:6052 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/116.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: http://localhost:6052/ Connection: close Cookie: authenticated=2|1:0|10:1701341719|13:authenticated|4:eWVz|0907127d7274094cc5a2490b95becf5c11fd52b8c3ee3655d65fe9fda099108c Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin Content-Length: 0

response: HTTP/1.1 200 OK Server: TornadoServer/6.3.3 Content-Type: text/html; charset=UTF-8 Date: Thu, 30 Nov 2023 11:04:12 GMT Etag: "ec6c9889f5c9a6c8e9d2d5e4ce1b1a85e6e7da2b" Content-Length: 40 Connection: close

Impact

Abusing this vulnerability a malicious actor could perform operations on the dashboard on the behalf of a logged user, access sensitive information, create, edit and delete configuration files and flash firmware on managed boards. In addition to this, cookies are not correctly secured, allowing the exfiltration of session cookie values.

Credits

Spike Reply Cybersecurity Team

Affected versions

2023.12.92024.2.02024.2.0b12024.2.0b22024.2.0b32024.2.1

Fixed in

2024.2.2

References

https://github.com/esphome/esphome/security/advisories/GHSA-9p43-hj5j-96h5
https://github.com/esphome/esphome/commit/37d2b3c7977a4ccbec59726ca7549cb776661455
https://github.com/esphome/esphome
https://pypi.org/project/esphome
https://github.com/advisories/GHSA-9p43-hj5j-96h5
https://nvd.nist.gov/vuln/detail/CVE-2024-27287

Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-27081 PYSEC-2026-1328 GHSA-8p25-3q46-8q2p Jul 07, 2026

ESPHome vulnerable to remote code execution via arbitrary file write

7.2 / 10
High
Network Low High None Unchanged High High High

Summary

Security misconfiguration in edit configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation) allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible.

Details

It is possible to abuse this path traversal vulnerability both in command line installation and Home Assistant add-on, but it is possible to read and write files only under the configuration directory.

The vulnerability is present and exploitable in the command line installation, but it was not possible to confirm an impact in the home assistant add-on version.

PoC

Impact

The issue gives read and write access to files under the configuration directory and allows malicious users to write arbitrary code in python scripts executed during the compilation and flashing of firmwares for ESP boards.

If chained with GHSA-9p43-hj5j-96h5 and GHSA-5925-88xh-6h99, this issue could allow an unauthenticated remote user to gain remote code execution on the machine hosting the dashboard.

It also allows accessing sensitive information such as esphome.json and board firmware source code allowing a user to modify the board firmware, and leaking secrets such as: WiFi network credentials, fallback hotspot WiFi credentials, OTA component authentication password and API encryption key.

Credits

Spike Reply Cybersecurity Team

Affected versions

2023.12.92024.2.02024.2.0b12024.2.0b22024.2.0b3

Fixed in

2024.2.1

References

https://github.com/esphome/esphome/security/advisories/GHSA-8p25-3q46-8q2p
https://nvd.nist.gov/vuln/detail/CVE-2024-27081
https://github.com/esphome/esphome/commit/d814ed1d4adc71fde47c4df41215bee449884513
https://github.com/esphome/esphome
https://pypi.org/project/esphome
https://github.com/advisories/GHSA-8p25-3q46-8q2p

Updated Jul 07, 2026 · Source: OSV.dev
CVE-2021-41104 GHSA-48mj-p7x2-5jfm PYSEC-2021-351 Sep 29, 2021

Basic auth bypass in esphome

High
Network Low None None

Impact

Anyone with web_server enabled and HTTP basic auth configured on 2021.9.1 or older

web_server allows OTA update without checking user defined basic auth username & password

Patches

Patch released in 2021.9.2

Workarounds

Disable/remove web_server

Affected versions

1.10.11.11.01.11.0b11.11.0b21.11.0b31.11.11.11.21.12.01.12.0b11.12.0b21.12.0b31.12.0b4

+ 91 more Show less

1.12.11.12.21.13.01.13.0b11.13.0b21.13.0b31.13.0b41.13.0b51.13.0b61.13.0b71.13.11.13.21.13.31.13.41.13.51.13.61.14.01.14.0b11.14.0b21.14.0b31.14.0b41.14.0b51.14.11.14.21.14.31.14.41.14.51.15.01.15.0b11.15.0b21.15.0b31.15.0b41.15.11.15.21.15.31.16.01.16.0b11.16.0b21.16.0b31.16.0b41.16.0b51.16.0b61.16.0b71.16.0b81.16.11.16.21.17.01.17.0b11.17.11.17.21.18.01.18.0b11.18.0b21.18.0b31.18.0b41.19.01.19.0b11.19.0b21.19.0b31.19.0b41.19.0b51.19.0b61.19.0b71.19.11.19.21.19.31.19.41.20.01.20.0b11.20.0b21.20.0b31.20.0b41.20.0b51.20.0b61.20.11.20.21.20.31.20.41.21.0b11.21.0b21.21.0b32021.8.02021.8.12021.8.22021.9.02021.9.0b12021.9.0b22021.9.0b32021.9.0b42021.9.0b52021.9.1

Fixed in

2021.9.2

References

https://github.com/esphome/esphome/security/advisories/GHSA-48mj-p7x2-5jfm
https://nvd.nist.gov/vuln/detail/CVE-2021-41104
https://github.com/esphome/esphome/pull/2409
https://github.com/esphome/esphome/commit/2234f6aacf8cc653307fed80f3750317a82c4f83
https://github.com/esphome/esphome/commit/be965a60eba6bb769e2a5afdbc8eed132f077a59
https://github.com/esphome/esphome

Updated May 04, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 6
minor 63
patch 240
pre 319

629 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More