Release v1.7.5

Fixed

• Code Quality: Fixed ruff E501 line-too-long error in api_client.py (#95)
  • Split warning message across two lines using implicit string concatenation
  • Ensures compliance with 100-character line length limit
• JSON Parsing: Enhanced error handling when JSON parsing fails (#94)
  • Now raises ApiError instead of silently returning raw text
  • Prevents type confusion in API client callers
• Hostname Validation: Corrected URL validation for owners.vacasa.com (#94)
  • Fixed endswith() check that incorrectly matched malicious hostnames
  • Now uses proper domain-parts validation
• Rate Limiting: Added API request rate limiting to prevent throttling (#94)
  • Implemented asyncio.Semaphore with max 5 concurrent requests
  • Prevents hitting Vacasa API rate limits during heavy operations
• Thread Safety: Improved signal handler implementations (#94)
  • Added @callback decorator to _handle_reservation_state methods
  • Removed fragile call_soon_threadsafe fallback code
  • Signal handlers now correctly run on event loop

Changed

• Constants: Replaced magic numbers with named constants (#94)
  • CLIENT_ID_CACHE_TTL replaces hardcoded 3600
  • CALENDAR_LOOKBACK_DAYS / CALENDAR_LOOKAHEAD_DAYS replace 60 / 365
  • DEFAULT_CHECKIN_TIME / DEFAULT_CHECKOUT_TIME replace "16:00:00" / "10:00:00"
• Logging: Adjusted log levels for normal operations (#94)
  • Occupancy changes now logged at info level instead of warning
  • Boundary timer scheduling logged at debug level instead of warning
  • Reduces noise in default logging configuration
• Error Reporting: Added warning log when statement parsing fails (#94)
  • _coerce_amount now logs warnings instead of silently returning None

What's Changed

• Refactor: Extract constants and add request rate limiting by @samspade21 in #94
• fix: Resolve ruff line length error in api_client.py by @samspade21 in #95
• Release v1.7.5 by @samspade21 in #96

Full Changelog: v1.7.4...v1.7.5

Release v1.7.4

Fixed

• CRITICAL: Fixed occupancy sensor not updating at checkout/checkin times
  • Calendar now queries events from 60 days in the past to capture active reservations
  • Previously only queried from "today", missing guests who checked in before today
  • Fixed thread safety violation in boundary timer callback
  • Boundary timer now uses call_soon_threadsafe() to properly schedule updates on event loop
  • Resolves issue where boundary timers would fire but fail silently due to thread errors
  • Occupancy now correctly changes to vacant at exact 10 AM checkout time
• Fixed options flow initialization causing 500 Internal Server Error (complete fix)
  • Removed manual config_entry assignment in OptionsFlowHandler.init
  • Framework now properly injects config_entry automatically
  • Settings page now opens without errors

Added

• Enhanced debug logging for occupancy state changes and boundary timer events
• Detailed timestamp comparisons in event evaluation for easier troubleshooting
• Thread safety documentation in boundary timer callback

What's Changed

• Release v1.7.4 by @samspade21 in #93

Full Changelog: v1.7.3...v1.7.4

Release v1.7.3

Fixed

• Fixed thread safety violations in sensor signal handlers (#91)
• Eliminated RuntimeError when sensors update from coordinator threads
• Replaced direct async_write_ha_state() calls with call_soon_threadsafe()
• Ensured occupancy and next stay sensors update correctly at check-in time
• Prevented sensor update failures occurring every 2 hours during reservation updates
• Fixed options flow initialization causing 500 Internal Server Error when opening integration settings
• Corrected OptionsFlow base class initialization to not pass config_entry argument

What's Changed

• Fix thread safety violations in sensor signal handlers by @samspade21 in #91
• Release v1.7.3 by @samspade21 in #92

Full Changelog: v1.7.2...v1.7.3

Release v1.7.2

Fixed

• Fixed options flow initialization to prevent 500 errors when opening Vacasa settings

What's Changed

• docs: Streamline README.md and remove legacy content by @samspade21 in #89
• Release 1.7.2 — options flow initialization fix by @samspade21 in #90

Full Changelog: v1.7.1...v1.7.2

Release v1.7.1

Fixed

• Calendar boundary refresh now enables real-time sensor updates at exact checkin/checkout times
• Removed blocking coordinator refresh that caused sensors to update hours late

Security

• Added URL sanitization to prevent token exposure in debug logs
• Added HTML escaping for user-provided display content (XSS protection)
• Improved exception handling with specific exception types
• Added comprehensive JWT parsing documentation

Changed

• Exception handling now uses specific types instead of broad catches

What's Changed

• Handle midnight reservation times by @samspade21 in #83
• deps(deps): bump pre-commit from 4.5.0 to 4.5.1 by @dependabot[bot] in #86
• deps(deps): bump actions/upload-artifact from 5 to 6 by @dependabot[bot] in #85
• deps(deps): bump mypy from 1.19.0 to 1.19.1 by @dependabot[bot] in #84
• Fix: Calendar timing fixes and security improvements by @samspade21 in #87
• Release v1.7.1 by @samspade21 in #88

Full Changelog: v1.7.0...v1.7.1

Release v1.7.0

Fixed

• CRITICAL: Fixed premature occupancy state changes during active guest stays (#71)
  • Checkout times now default to 10:00 AM instead of midnight
  • Check-in times now default to 4:00 PM instead of midnight
  • Prevents system from incorrectly showing vacancy 10+ hours before actual checkout
• Fixed occupancy sensor setup and tests (#74)
• Fixed automation examples using non-existent trigger.calendar_event.category field (#81)

Added

• Event-driven updates for reservation sensors (#70)
• Coordinator-based caching for Vacasa units (#72)
• Comprehensive entity attributes documentation in README (#81)
• Stay types reference table with all available categories (#81)

Changed

• Refactored next stay sensor to use shared reservation state (#79)
• Improved automation examples with three working alternatives (#81)

Dependencies

• Bumped pre-commit from 4.4.0 to 4.5.0 (#78)
• Bumped mypy from 1.18.2 to 1.19.0 (#80)
• Bumped actions/github-script from 7 to 8 (#77)
• Bumped actions/checkout from 5 to 6 (#76)
• Bumped actions/upload-artifact from 4 to 5 (#75)

What's Changed

• Add event-driven refreshes for Vacasa occupancy and reservation sensors by @samspade21 in #70
• Fix: Prevent mid-stay occupancy changes due to midnight checkout default by @samspade21 in #71
• Cache Vacasa units via coordinator by @samspade21 in #72
• Fix occupancy sensor setup regression by @samspade21 in #74
• Refactor next stay sensor to use shared reservation state by @samspade21 in #79
• deps(deps): bump pre-commit from 4.4.0 to 4.5.0 by @dependabot[bot] in #78
• deps(deps): bump actions/github-script from 7 to 8 by @dependabot[bot] in #77
• deps(deps): bump actions/checkout from 5 to 6 by @dependabot[bot] in #76
• deps(deps): bump actions/upload-artifact from 4 to 5 by @dependabot[bot] in #75
• deps(deps): bump mypy from 1.18.2 to 1.19.0 by @dependabot[bot] in #80
• docs: Fix incorrect automation examples and add entity attributes documentation by @samspade21 in #81
• Release v1.7.0 by @samspade21 in #82

Full Changelog: v1.6.0...v1.7.0

Release v1.6.0

Added

• Upcoming Stay Coverage: Enhanced sensor.py to include coverage for upcoming Vacasa stays with improved visibility into future reservations (PR #65)
• Test Coverage Expansion: Added comprehensive tests for cached data utilities in test_cached_data.py to improve code reliability and maintainability (PR #58)

Fixed

• Home Status Sensor Removal: Removed Home Status sensor due to inaccessible API endpoints that prevented reliable data retrieval (PR #67)
• Payload Parsing: Fixed home status sensor payload parsing issues that caused data processing errors (PR #64)
• Next Stay Calculations: Corrected next stay sensor day calculation logic and added time information for more accurate stay tracking in sensor.py (PR #63)
• CI Forked PR Checkout: Resolved GitHub Actions checkout issues for forked pull requests to enable proper CI testing (PR #59)
• Test Failures: Fixed GitHub Actions test execution failures to restore CI/CD pipeline reliability (PR #54)

Changed

• API Modernization: Refactored home info aggregation to support new inspection APIs in api_client.py (PR #66)
• Code Cleanup: Removed unused legacy constants from const.py to reduce technical debt (PR #62)
• Test Infrastructure: Restored sensor imports and extended Home Assistant stubs for improved test compatibility (PR #61)
• Workflow Protection: Prevented workflow autofixes from modifying CI workflow files to maintain deployment integrity (PR #56)
• Error Messaging: Adjusted Vacasa API fallback error message for clearer user communication (PR #55)

Technical Improvements

• Dependency Updates: Updated multiple GitHub Actions and Python dependencies for improved security and compatibility:
  • actions/checkout: 4 → 5 (PR #46)
  • actions/setup-python: 5 → 6 (PR #47)
  • github/codeql-action: 3 → 4 (PR #48)
  • codecov/codecov-action: 3 → 5 (PR #50)
  • actions/stale: 7 → 10 (PR #52)
  • colorlog: 6.8.2 → 6.10.1 (PR #51)
  • mypy: 1.3.0 → 1.18.2 (PR #53)
  • pre-commit: 3.0.0 → 4.4.0 (PR #49)

This release focuses on API modernization, improved test coverage, and critical bug fixes while maintaining compatibility with the latest Home Assistant platform updates.

What's Changed

• Development by @samspade21 in #45
• Fix GitHub Actions test failures by @samspade21 in #54
• deps(deps): bump pre-commit from 3.0.0 to 4.4.0 by @dependabot[bot] in #49
• deps(deps): bump mypy from 1.3.0 to 1.18.2 by @dependabot[bot] in #53
• deps(deps): bump colorlog from 6.8.2 to 6.10.1 by @dependabot[bot] in #51
• deps(deps): bump actions/stale from 7 to 10 by @dependabot[bot] in #52
• deps(deps): bump codecov/codecov-action from 3 to 5 by @dependabot[bot] in #50
• deps(deps): bump github/codeql-action from 3 to 4 by @dependabot[bot] in #48
• deps(deps): bump actions/setup-python from 5 to 6 by @dependabot[bot] in #47
• deps(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in #46
• Adjust Vacasa API fallback error message by @samspade21 in #55
• Prevent workflow autofixes from updating CI workflows by @samspade21 in #56
• Fix CI checkout for forked pull requests by @samspade21 in #59
• Add comprehensive tests for cached data utilities by @samspade21 in #58
• Restore sensor imports and extend HA stubs by @samspade21 in #61
• Remove unused legacy constants by @samspade21 in #62
• Fix next stay sensor timing and messaging by @samspade21 in #63
• Handle nested Vacasa home info payloads by @samspade21 in #64
• Add regression test for upcoming Vacasa stays by @samspade21 in #65
• Update home info sensor to aggregate inspection APIs by @samspade21 in #66
• fix: remove Home Status sensor due to inaccessible API endpoints by @samspade21 in #67
• Release v1.6.0 by @samspade21 in #68

New Contributors

• @dependabot[bot] made their first contribution in #49

Full Changelog: v1.5.0...v1.6.0

Release v1.5.0

Added

• Next Stay Sensor: New VacasaNextStaySensor for tracking upcoming and current reservations
  • Displays next upcoming or current reservation with human-readable state messages
  • Comprehensive attributes: check-in/check-out dates, stay type, guest information
  • Computed values: days until check-in/check-out, stay duration nights
  • Supports guest, owner, maintenance, and block stay classifications
  • PR #32, #33, #34
• API Throttling: Implemented sensor update throttling to respect coordinator refresh interval
  • Prevents excessive API calls for multiple sensors
  • All API-backed sensors now coordinate updates efficiently

Fixed

• Critical Entity Registration Fix: Added entity_id validation before state writes to prevent AttributeError during initialization (PR #38)
• JSON Parsing Enhancement: Handle charset in API content-type headers (application/json; charset=utf-8) with fallback parsing and diagnostic logging
• Missing Import Fix: Added missing random import in cached_data.py required for retry jitter calculations
• Occupancy Sensor Alignment: Fixed occupancy sensor to stay properly aligned with reservation data (PR #37)
• Token Handling: Resolved token access issues and cleaned up cache imports (PR #35)

Improved

• API Resilience: Enhanced API client with better error handling, retry logic, and rich sensor support (PR #25)
• Blocking I/O Performance: Refactored blocking I/O helpers for improved performance (PR #28)
• Sensor Setup Efficiency: Streamlined sensor platform setup, reducing code by 99 lines (PR #27)
• Configuration Simplification: Removed unused stay_type_mapping and API version configuration options

Changed

• Dependency Updates: Updated project dependencies to latest versions (PR #26, #30)
• Code Quality: Fixed linting errors for improved CI/CD compliance
• Coordinator Integration: Statement sensor now uses coordinator updates for better consistency
• Diagnostic Logging: Enhanced logging for VacasaNextStaySensor troubleshooting

Technical Improvements

• All sensors now properly coordinate with data update coordinator
• Enhanced error recovery and diagnostic capabilities
• Improved code maintainability and reduced technical debt
• Better separation of concerns in sensor architecture

This release introduces the highly-requested next stay sensor feature while delivering critical bug fixes for production stability and enhanced API resilience.

What's Changed

• fix: grant permissions for dependency workflow by @samspade21 in #24
• chore: update dependencies by @samspade21 in #30
• Merge development into main by @samspade21 in #31
• Merge development into main: Next stay sensor and API improvements by @samspade21 in #34
• Critical bug fixes: Entity registration, JSON parsing, and missing imports by @samspade21 in #38
• Development by @samspade21 in #39
• Release v1.5.0 by @samspade21 in #41

Full Changelog: v1.4.2...v1.5.0

Release v1.4.2

Testing

• Release Pipeline Validation: End-to-end testing of the completely rebuilt release automation system
• Consolidated Workflow Verification: Validating that the single auto-release.yml workflow performs all release functions correctly
• VERSION Detection Testing: Confirming the fixed multi-commit VERSION detection logic works properly
• Release Creation Testing: Verifying automated tag creation, HACS validation, and GitHub release generation
• Changelog Extraction Testing: Ensuring the fixed Python f-string bug in changelog processing is resolved

Validation Objectives

• Complete Pipeline Testing: From VERSION detection through GitHub release creation
• Error Resolution Confirmation: Verifying all previous GITHUB_TOKEN and changelog extraction issues are resolved
• Release Format Standards: Ensuring continued compatibility with v1.3.2 release format expectations
• Automation Reliability: Confirming the streamlined single-workflow approach provides consistent results

This release specifically tests the comprehensive release automation fixes implemented in v1.4.1 to validate the complete tag → release pipeline is now fully operational and reliable.

What's Changed

• Fix Release Pipeline v1.4.1 - Critical Release Automation Fixes by @samspade21 in #21
• Release v1.4.2: End-to-End Pipeline Validation by @samspade21 in #22

Full Changelog: v1.4.1...v1.4.2

v1.3.2

[1.3.2] - 2025-08-18

Security

• Fixed URL Sanitization Vulnerability: Enhanced hostname validation in api_client.py to prevent URL manipulation attacks by using proper hostname parsing instead of substring matching
• Fixed Exception Handling: Corrected potential TypeError in cached_data.py where None could be raised instead of a proper exception

Technical Improvements

• CodeQL Compliance: Addressed all security findings from GitHub CodeQL code scanning
• Defensive Programming: Added null checks and proper exception handling to prevent runtime errors
• Security Best Practices: Implemented proper hostname validation to prevent bypass attacks using malicious URLs

This release addresses GitHub security findings identified by CodeQL code scanning while maintaining full backward compatibility and functionality.