Dependency Dashboard

[ha-mcp-renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.11.33
• chore(deps): update ghcr.io/home-assistant/home-assistant docker tag to v2026.7.4
• Click on this checkbox to rebase all open PRs at once

Detected Dependencies

dockerfile (6)

Dockerfile (2)

• docker/dockerfile 1
• ghcr.io/astral-sh/uv 0.11.28-python3.13-trixie-slim@sha256:08477888ac23d6cfbeb8c7dc6fc70cf297fd38b7bf35522be33ce832750ca242 → [Updates: 0.11.33-python3.13-trixie-slim]

homeassistant-addon-dev/Dockerfile (2)

• docker/dockerfile 1
• ghcr.io/astral-sh/uv 0.11.28-python3.13-trixie-slim@sha256:08477888ac23d6cfbeb8c7dc6fc70cf297fd38b7bf35522be33ce832750ca242 → [Updates: 0.11.33-python3.13-trixie-slim]

homeassistant-addon-webhook-proxy-dev/Dockerfile (1)

• docker/dockerfile 1

homeassistant-addon-webhook-proxy/Dockerfile (1)

• docker/dockerfile 1

homeassistant-addon/Dockerfile (2)

• docker/dockerfile 1
• ghcr.io/astral-sh/uv 0.11.28-python3.13-trixie-slim@sha256:08477888ac23d6cfbeb8c7dc6fc70cf297fd38b7bf35522be33ce832750ca242 → [Updates: 0.11.33-python3.13-trixie-slim]

tests/haos_image_build/screenshot_engine_mock/Dockerfile

git-submodules (1)

.gitmodules (1)

• src/ha_mcp/resources/skills-vendor main@191cfec77fb33a7e34a6f946bddfad68090324e4

regex (10)

.github/workflows/e2e-tests.yml (1)

• ghcr.io/home-assistant/home-assistant 2026.7.2 → [Updates: 2026.7.4]

.github/workflows/e2e-tests.yml (1)

• ghcr.io/home-assistant/home-assistant 2026.7.2 → [Updates: 2026.7.4]

.github/workflows/performance-tests.yml (1)

• ghcr.io/home-assistant/home-assistant 2026.7.2 → [Updates: 2026.7.4]

.github/workflows/performance-tests.yml (1)

• ghcr.io/home-assistant/home-assistant 2026.7.2 → [Updates: 2026.7.4]

.github/workflows/pr.yml (6)

• ghcr.io/home-assistant/home-assistant 2026.7.2 → [Updates: 2026.7.4]
• ghcr.io/astral-sh/uv 0.11.28 → [Updates: 0.11.33]
• ghcr.io/astral-sh/uv 0.11.28 → [Updates: 0.11.33]
• ghcr.io/astral-sh/uv 0.11.28 → [Updates: 0.11.33]
• ghcr.io/astral-sh/uv 0.11.28 → [Updates: 0.11.33]
• ghcr.io/astral-sh/uv 0.11.28 → [Updates: 0.11.33]

.github/workflows/pr.yml (6)

• ghcr.io/home-assistant/home-assistant 2026.7.2 → [Updates: 2026.7.4]
• ghcr.io/astral-sh/uv 0.11.28 → [Updates: 0.11.33]
• ghcr.io/astral-sh/uv 0.11.28 → [Updates: 0.11.33]
• ghcr.io/astral-sh/uv 0.11.28 → [Updates: 0.11.33]
• ghcr.io/astral-sh/uv 0.11.28 → [Updates: 0.11.33]
• ghcr.io/astral-sh/uv 0.11.28 → [Updates: 0.11.33]

tests/haos_image_build/build_image.py (1)

• home-assistant/operating-system 18.1

tests/haos_image_build/build_image.py (1)

• home-assistant/operating-system 18.1

tests/test_constants.py (1)

• ghcr.io/home-assistant/home-assistant 2026.7.2 → [Updates: 2026.7.4]

tests/test_constants.py (1)

• ghcr.io/home-assistant/home-assistant 2026.7.2 → [Updates: 2026.7.4]

[github-actions]

🔍 Analysis

This issue is an automated Dependency Dashboard created by Renovate. It serves as a centralized hub for tracking and managing dependency updates across the ha-mcp repository. Currently, it identifies two available updates: upgrading the uv tool to v0.11.13 and updating the home-assistant Docker image used in tests to v2026.5.1.

The dashboard also highlights a warning regarding vulnerability alerts. Renovate is currently unable to access these alerts, which typically happens when the integration lacks the necessary permissions in the repository settings. This doesn't prevent Renovate from functioning, but it means security-related metadata for these updates might be missing from the dashboard.

🛠️ Suggested Steps

1. Review and Merge PRs: Visit the already created pull requests for these updates:
   • #1233: uv update to v0.11.13.
   • #1236: home-assistant update to v2026.5.1.
2. Fix Permissions: To resolve the vulnerability alerts warning, a maintainer should go to Settings > Code security and analysis in the GitHub repository and ensure that "Dependabot alerts" and "Dependabot security updates" are enabled. Additionally, verify that the Renovate integration has the security_events: read permission.
3. Use the Dashboard: If you need to rebase or retry any of the listed updates, you can simply click the checkboxes in the issue description, and Renovate will automatically trigger the corresponding action.

📊 Technical Analysis (for maintainers)

Root Cause

This is an automated tracking issue generated by Renovate based on the configuration in renovate.json. It uses both standard managers (dockerfile) and custom regex managers to track versions across Dockerfiles, GitHub Workflows, and Python test constants.

Affected Code

The following files are being tracked for the dependencies mentioned in this dashboard:

• Dockerfile - Tracks ghcr.io/astral-sh/uv
• homeassistant-addon/Dockerfile - Tracks ghcr.io/astral-sh/uv
• homeassistant-addon-dev/Dockerfile - Tracks ghcr.io/astral-sh/uv
• .github/workflows/pr.yml - Tracks both uv and home-assistant images
• .github/workflows/e2e-tests.yml - Tracks home-assistant image
• .github/workflows/performance-tests.yml - Tracks home-assistant image
• tests/test_constants.py - Tracks HA_TEST_IMAGE version

Related Issues/PRs

• chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.11.13 #1233 - Update uv to v0.11.13
• chore(deps): update ghcr.io/home-assistant/home-assistant docker tag to v2026.5.1 #1236 - Update home-assistant to v2026.5.1

---

🤖 Automated analysis by Issue Bot

[Patch76]

Audited the hidden-Unicode warning at HEAD 499ebf0:

• Bidi-override (Trojan Source class — U+202A–U+202E, U+2066–U+2069): 0 matches across repo (excluding .git, node_modules, .venv, __pycache__, vendored output).
• Zero-width / invisible (U+200B–U+200D, U+2060, U+FEFF, U+00AD, U+2061–U+2063): 2 matches, both legitimate emoji ZWJ-sequences:
  • site/README.md:7 — 🧑‍🚀 (Astro starter astronaut)
  • tests/initial_test_state/.storage/hacs.repositories:1453 — 🏳️‍🌈 🏴‍☠️ (HACS fixture description)

No Trojan-Source vulnerability. Renovate's warning is a conservative ZWJ-flag, not an attack signal — no code action required.

[kingpanther13]

@Patch76 I think that this should remain open, renovate handles everything on its end. I will separately try to clear the warning