Reporting the local stack, from radio to automations.
The Briefing
20 October 2026
The Matter SDK moved to Matter 1.6.1 overnight: matter.js 0.18.0 went stable with the Groupcast cluster and the Access Control auxiliary ACL enabled by default, plus native ML-DSA post-quantum key support. The Supervisor pin moved to 2026.10.3 — its pwned-secrets check is now opt-in — and HAOS 18.4.rc1 is the first candidate to ship signed release images. Aqara's dual-protocol outdoor plug, the Outdoor Plug H2 EU, is live in Europe.
Disclosure: HA News earns a commission from qualifying purchases made through the Amazon links on this page. We link only to products covered editorially, and no story placement is sponsored.
01 · Matter & Thread / JavaScript SDK
matter.js 0.18.0 ships Matter 1.6.1 — Groupcast and the auxiliary ACL are on by default
What happened: The matter.js SDK went stable at v0.18.0 today, and the headline is the spec version underneath it: Matter 1.6.1. The changelog calls the upgrade itself breaking, because 1.6.1 carries specification changes that need code adjustments. Two behavior changes land with it: the Groupcast cluster and the Access Control auxiliary ACL are now enabled by default for devices and bridges, so controllers that assumed neither exists will have to account for them. The release also adds native ML-DSA-44 and ML-DSA-65 (FIPS 204) key creation, signing and verification in @matter/general — post-quantum signing, usable on Node.js where the platform supports it and via @noble/post-quantum otherwise.
Why it matters:matter.js is the engine under Home Assistant's Matter server, so this is the point where Matter 1.6.1 starts being implementable in the ecosystem rather than merely specified. Turning Groupcast on by default is the part to watch: it is a mechanism for one controller to address a group of devices as a unit, and "on by default" means implementations need to handle it whether or not a product explicitly asks for it.
Supervisor 2026.10.3 is the stable pin — the pwned-secrets check is now opt-in
What happened:stable.json now points at Supervisor 2026.10.3, which carries two breaking changes. The pwned-secrets check becomes opt-in (#7382) rather than a default, and log timestamps from the systemd journal are localized (#7372), with a new timestamp log format and API format selection (#7365). Under the fixes: auth API request parsing for Bearer tokens and content types (#7332), revalidation of auth cache mismatches with Home Assistant Core (#7331), securetar errors when restoring Core (#7346), and rejection of control characters in backup filenames (#7338).
Why it matters: The pwned check going opt-in changes what a fresh install does by default, so a password that was never checked against a breach corpus can now stay unchecked unless you turn it on. Anyone running the Supervisor in a non-English locale will see log timestamps change format. The Bearer-token parsing fix matters if you script against the Supervisor API.
HAOS 18.4.rc1 — the release candidates now ship signed, and 18.3's kernel regressions get fixed
What happened:18.4.rc1 is out as a candidate for the next Home Assistant OS release. The notes call it a small bugfix and security release that mainly addresses kernel regressions introduced in 18.3, plus VLAN networking on Realtek adapters and several boot and USB storage issues. The notable new artifact: release downloads now include SHA256SUMS and a signature bundle, SHA256SUMS.sigstore.json, so images can be checked with Cosign to confirm they came from Home Assistant and were not modified.
Underneath: Docker 29.8.2, containerd 2.3.6, OS Agent 1.14.0, Buildroot 2025.02.18, Linux kernel 6.18.57 on Home Assistant Green, the OVA and generic x86-64, RTL8761CU Bluetooth controller firmware, EROFS deduplication disabled on all boards, and UAS disabled for the Argon ONE M.2 and the UGREEN CM300. Stable boards remain on 18.3.
Why it matters: The Cosign bundle is the concrete one — it is a step toward verifiable OS images, which matters if you flash HAOS yourself or mirror it internally. And the 18.3 kernel regressions being corrected in a candidate rather than a patch is the reason to run 18.4 when it goes stable if you had network trouble after updating to 18.3.
Aqara Outdoor Plug H2 EU: one outdoor socket that speaks Matter over Thread and plain Zigbee
What happened: Aqara's Outdoor Plug H2 EU is live in Europe, and the Matter device database listed it today as SP-P06E / SP-P06D, certificate CSA25B92MAT47844-24, certified to Matter 1.4 as a Thread router (FTD) with a Bluetooth radio alongside. Aqara's own product page is explicit about the unusual part: in Thread mode the plug needs no Aqara hub to join third-party Matter ecosystems, while in Zigbee mode it keeps exclusive Aqara functionality and can still be bridged into Matter through an Aqara hub. It is rated IP44, handles 16 A / 3680 W, draws at most 0.4 W at idle, cuts out at 80 °C or on overload, has a configurable load limit, a child lock, a configurable status LED, and a configurable 30-minute charging cut-off below 3 W. The LED-indicator configuration is a Zigbee-mode feature for now — Aqara flags Thread support for it as a future update.
Why it matters: Most outdoor Matter plugs are Wi-Fi or Thread-only, and Aqara's own Zigbee ecosystem rarely mixes with Matter. A single socket that can be commissioned over Thread for Google Home or Apple Home and still be paired to an Aqara hub is a genuinely different supply of Zigbee sensors — the same reason the Aqara H2 power plug matters, extended to a weatherproof body.
What happened: No new Core patch this morning — stable.json still advertises 2026.10.2, released Friday 16 October at 20:04 UTC. The last patch fixed MQTT device triggers and tags firing twice after a reload, a crash on empty groups, Tesla Fleet diagnostics redaction, KNX telegram-store initialization timeouts, and aiohttp 3.14.5.
ESPHome still on 2026.10.0b5; stable remains 2026.9.0
What happened: No new tag since 2026.10.0b5 (19 Oct, 01:03 UTC) and the stable channel is still 2026.9.0. For reference, that beta carried the recommended ESP-IDF bump to 5.5.6, tcp_uart/uart_tcp as new platforms, and usb_uart gaining interface_class and port_number.
Hue Play Gradient Pro 65": still not orderable in the US
What happened: We re-checked Hue's own US product page for the pro 65" this morning — there is still no way to order it in the US. No change to the standing picture: Amazon listings at $179.99, UK page in stock at £139.99 since late September.
Shelly: no movement on Schneider clearance; ThreadLink still ~December
What happened: No regulatory decision or company announcement on Schneider's €70/share tender offer for Shelly Group, which the board backed last week. Gen4 ThreadLink firmware unchanged — still the IFA framing of roughly December, delivered as an opt-in per-device update.
What happened: No change since Friday: prod-firmware 61 offline drops remain community-sourced, not vendor-confirmed, and no change in the Matter test firmware line.
