Bump pyisy to 3.6.1 and modernize TLS handling for isy994 by shbatm · Pull Request #170136 · home-assistant/core

shbatm · 2026-05-08T16:15:05Z

Proposed change

Bumps pyisy to 3.6.1 and modernizes TLS handling for the isy994 integration:

Drops the legacy TLS-version dropdown (tls_ver). pyisy 3.6.x negotiates TLS automatically with a TLSv1.2 floor, so users no longer need to know what their controller supports.
Adds a "Verify SSL" toggle (default off). The default matches how eisy/Polisy/ISY-994 ship — they use a self-signed certificate out of the box, so verifying would fail for the vast majority of users. Power users who front their controller with a reverse proxy or trusted cert can opt in. The flag is passed both into pyisy and into async_get_clientsession(..., verify_ssl=verify_ssl), so the user's choice applies at both the session layer and pyisy's per-request SSL context.
Migrates legacy "tls" key on existing config entries via a MINOR_VERSION = 2 bump — async_migrate_entry drops the obsolete "tls" value and seeds CONF_VERIFY_SSL with the default. A minor-version bump (rather than a major one) preserves rollback for users who need to downgrade, mirroring the pattern used in yale_smart_alarm.
Distinguishes TLS handshake failures from generic connection errors in the config flow, surfacing a dedicated ssl_error message. Detection uses isinstance(error.__cause__, aiohttp.ClientSSLError), which covers both protocol mismatch (ClientConnectorSSLError) and certificate verification failure (ClientConnectorCertificateError).

Library changes

Diff: automicus/PyISY@v3.5.1...v3.6.1
Release notes: https://github.com/automicus/PyISY/releases/tag/v3.6.1
Key upstream PRs: feat: support TLS 1.3 + auto-negotiate, add verify_ssl (#494) automicus/PyISY#499 (TLS modernization), fix: raise ISYConnectionError on SSL/TLS handshake failures automicus/PyISY#507 (chained __cause__ for SSL errors), fix: enable legacy-renegotiation TLS compat on demand for ISY-994 automicus/PyISY#508 (legacy-renegotiation TLS compat for ISY-994)

Type of change

Dependency upgrade
Bugfix (non-breaking change which fixes an issue)
New integration (thank you!)
New feature (which adds functionality to an existing integration)
Deprecation (breaking change to happen in the future)
Breaking change (fix/feature causing existing functionality to break)
Code quality improvements to existing code or addition of tests

Additional information

This PR fixes or closes issue: fixes #
This PR is related to issue:
Link to documentation pull request:
Link to developer documentation pull request:
Link to frontend pull request:

Checklist

I understand the code I am submitting and can explain how it works.
The code change is tested and works locally.
Local tests pass. Your PR cannot be merged unless tests pass
There is no commented out code in this PR.
I have followed the [development checklist][dev-checklist]
I have followed the [perfect PR recommendations][perfect-pr]
The code has been formatted using Ruff (ruff format homeassistant tests)
Tests have been added to verify that the new code works.
Any generated code has been carefully reviewed for correctness and compliance with project standards.

If user exposed functionality or configuration variables are added/changed:

Documentation added/updated for [www.home-assistant.io][docs-repository]

If the code communicates with devices, web services, or third-party tools:

The [manifest file][manifest-docs] has all fields filled out correctly.
Updated and included derived files by running: python3 -m script.hassfest.
New or updated dependencies have been added to requirements_all.txt.
Updated by running python3 -m script.gen_requirements_all.
For the updated dependencies a diff between library versions and ideally a link to the changelog/release notes is added to the PR description.

Drop the legacy TLS-version dropdown and let pyisy 3.6.0 negotiate TLS automatically with a 1.2 floor. Add a "Verify SSL" toggle (default off) that matches how eisy/Polisy/ISY-994 ship their self-signed certificates. Existing v1 config entries are migrated to v2 by silently dropping the stored "tls" key — no reauth required. Also distinguish TLS handshake failures from generic connection errors in the config flow, surfacing a dedicated "ssl_error" message via __cause__ inspection on aiohttp.ClientSSLError. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

home-assistant · 2026-05-08T16:15:15Z

Hey there @bdraco, mind taking a look at this pull request as it has been labeled with an integration (isy994) you are listed as a code owner for? Thanks!

Code owner commands

Code owners of isy994 can trigger bot actions by commenting:

@home-assistant close Closes the pull request.
@home-assistant mark-draft Mark the pull request as draft.
@home-assistant ready-for-review Remove the draft status from the pull request.
@home-assistant rename Awesome new title Renames the pull request.
@home-assistant reopen Reopen the pull request.
@home-assistant unassign isy994 Removes the current integration label and assignees on the pull request, add the integration domain after the command.
@home-assistant update-branch Update the pull request branch with the base branch.
@home-assistant add-label needs-more-information Add a label (needs-more-information, problem in dependency, problem in custom component, problem in config, problem in device, feature-request) to the pull request.
@home-assistant remove-label needs-more-information Remove a label (needs-more-information, problem in dependency, problem in custom component, problem in config, problem in device, feature-request) on the pull request.

Copilot

Pull request overview

Updates the isy994 integration to use pyisy 3.6.0 and shifts TLS handling from a user-selected TLS version to automatic negotiation plus an explicit “Verify SSL” option.

Changes:

Bump pyisy dependency to 3.6.0 (and update derived requirements files).
Remove legacy TLS version selection and add verify_ssl handling + a dedicated ssl_error flow error.
Add config entry migration (v1 → v2) to drop the stored legacy "tls" key, with new/updated tests.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tests/components/isy994/test_init.py	Adds coverage for config entry migration behavior.
tests/components/isy994/test_config_flow.py	Updates config flow tests for the new `verify_ssl` field (TLS version removed).
requirements_test_all.txt	Updates pinned test dependency for `pyisy`.
requirements_all.txt	Updates pinned runtime dependency for `pyisy`.
homeassistant/components/isy994/strings.json	Adds `ssl_error` messaging and updates user-step fields for `verify_ssl`.
homeassistant/components/isy994/manifest.json	Bumps integration requirement to `pyisy==3.6.0`.
homeassistant/components/isy994/const.py	Removes TLS-version constants and introduces `DEFAULT_VERIFY_SSL`.
homeassistant/components/isy994/config_flow.py	Implements `verify_ssl` + SSL-specific error mapping and bumps config flow version.
homeassistant/components/isy994/init.py	Adds config entry migration and passes `verify_ssl` into pyisy initialization.

- Bump pyisy 3.6.0 → 3.6.1 (drops the stray top-level tests/ dir from the published wheel that hassfest rejected). - Pass verify_ssl into the aiohttp ClientSession for HTTPS in both the config flow and async_setup_entry, so the user's "Verify SSL" choice takes effect at the session level instead of relying solely on pyisy's per-request SSL context. - Add a config flow test covering the new ssl_error mapping path (ISYConnectionError chained from aiohttp.ClientSSLError). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.

Codecov flagged the new ssl_error catch in async_step_reauth_confirm and the verify_ssl-aware HTTPS session branch in validate_input as uncovered: - Extend test_reauth to chain a ClientSSLError-cause through the reauth flow before the success path, exercising the new except SslError branch. - Switch test_form_isy_ssl_error to use an HTTPS URL so the async_get_clientsession(..., verify_ssl=...) line in the HTTPS branch is also covered. Brings config_flow.py patch coverage to 100%; only remaining miss is a pre-existing line in OptionsFlowHandler unrelated to this PR. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

shbatm · 2026-05-13T14:57:34Z

@home-assistant update-branch

home-assistant · 2026-05-13T14:57:40Z

Failed to update branch: refusing to allow a GitHub App to create or update workflow .github/workflows/builder.yml without workflows permission

Copilot

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

tests/components/isy994/test_init.py:45

Remove the unused mock_isy fixture argument (it’s not referenced in the test body); relying on the autouse fixture avoids unused test parameters and keeps the test signature minimal.

async def test_migrate_future_version_fails(
    hass: HomeAssistant,
    mock_isy: MagicMock,
) -> None:

joostlek · 2026-05-13T16:53:19Z

+async def async_migrate_entry(hass: HomeAssistant, entry: IsyConfigEntry) -> bool:
+    """Migrate old config entries."""
+    _LOGGER.debug("Migrating ISY config entry from version %s", entry.version)
+
+    if entry.version > 2:
+        return False
+
+    if entry.version == 1:
+        # Drop the legacy "tls" version field; pyisy now negotiates automatically.
+        new_data = {key: value for key, value in entry.data.items() if key != "tls"}
+        hass.config_entries.async_update_entry(entry, data=new_data, version=2)
+
+    return True


So in a way I am like, by bumping the major version and removing the value, we kinda eliminate the ability to rollback for people, so I'd almost just avoid migrating

I will re-work it to just add the new config option and silently ignore the old tls_version key without migrating. Now that I'm looking at it again I remember doing something similar back in #80984 and not forcing a migration. Do you want the version to be tagged as a minor bump (e.g. 1.1) if I do that?

Reworked in b41568b to use MINOR_VERSION = 2 instead of bumping the major version — mirrors the pattern in yale_smart_alarm (drop legacy key + seed new key, no major bump, rollback preserved).

home-assistant · 2026-05-13T16:54:24Z

Please take a look at the requested changes, and use the Ready for review button when you are done, thanks 👍

Learn more about our pull request process.

Address review feedback on home-assistant#170136: instead of bumping the major config entry version (which would have broken rollback), use MINOR_VERSION = 2 with an async_migrate_entry that drops the legacy "tls" key and seeds verify_ssl. Mirrors the pattern in yale_smart_alarm. Also use direct key indexing for verify_ssl now that migration guarantees the key is present, switch test_config_flow string literals to the matching CONF_* constants, and drop the unused mock_isy fixture arg in the new test_init. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

shbatm · 2026-05-13T20:04:04Z

Failed test on 89883bc looks unrelated (zha/test_repairs.py::test_detect_radio_hardware)

Copilot

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

Add parametrized assertions that the verify_ssl entry option is forwarded to pyisy's ISY constructor during async_setup_entry and to its Connection during config flow validation, so a future regression that drops the plumbing cannot pass tests. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

-
-    # Optional
-    tls_version = isy_config.get(CONF_TLS_VER)
+    verify_ssl = isy_config[CONF_VERIFY_SSL]


    password = data[CONF_PASSWORD]
    host = urlparse(data[CONF_HOST])
-    tls_version = data.get(CONF_TLS_VER)
+    verify_ssl = data[CONF_VERIFY_SSL]


+    ssl_cause = aiohttp.ClientSSLError(
+        connection_key=None, os_error=ssl.SSLError("handshake failed")
+    )


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

+async def async_migrate_entry(hass: HomeAssistant, entry: IsyConfigEntry) -> bool:
+    """Migrate old config entries."""
+    if entry.version == 1 and entry.minor_version == 1:
+        new_data = {key: value for key, value in entry.data.items() if key != "tls"}
+        new_data.setdefault(CONF_VERIFY_SSL, DEFAULT_VERIFY_SSL)
+        hass.config_entries.async_update_entry(entry, data=new_data, minor_version=2)
+
+    return True


shbatm · 2026-05-20T15:42:27Z

-
-    # Optional
-    tls_version = isy_config.get(CONF_TLS_VER)
+    verify_ssl = isy_config[CONF_VERIFY_SSL]


This is contrary to reviewer's original suggestion to NOT use .get(). Holding for @joostlek's preference.

shbatm · 2026-05-20T15:44:01Z

      "invalid_auth": "[%key:common::config_flow::error::invalid_auth%]",
      "invalid_host": "The host entry was not in full URL format, e.g., {sample_ip}",
      "reauth_successful": "[%key:common::config_flow::abort::reauth_successful%]",
+      "ssl_error": "TLS handshake failed. The controller may require a newer TLS version, or SSL verification may be failing due to a self-signed certificate.",


Copilot doesn't like it's own suggested change...

Copilot AI review requested due to automatic review settings May 8, 2026 16:15

shbatm requested a review from bdraco as a code owner May 8, 2026 16:15

home-assistant Bot added cla-signed dependency Pull requests marked as a dependency upgrade has-tests integration: isy994 labels May 8, 2026

home-assistant Bot assigned bdraco May 8, 2026

home-assistant Bot added by-code-owner Quality Scale: No score labels May 8, 2026

Copilot started reviewing on behalf of shbatm May 8, 2026 16:16 View session

shbatm marked this pull request as draft May 8, 2026 16:19

Copilot AI reviewed May 8, 2026

View reviewed changes

Comment thread homeassistant/components/isy994/config_flow.py

Comment thread homeassistant/components/isy994/config_flow.py

Comment thread homeassistant/components/isy994/__init__.py Outdated

shbatm mentioned this pull request May 8, 2026

fix: exclude tests/ from built wheel automicus/PyISY#509

Merged

shbatm changed the title ~~Bump pyisy to 3.6.0 and modernize TLS handling for isy994~~ Bump pyisy to 3.6.1 and modernize TLS handling for isy994 May 8, 2026

shbatm marked this pull request as ready for review May 8, 2026 16:38

Copilot AI review requested due to automatic review settings May 8, 2026 16:38

Copilot started reviewing on behalf of shbatm May 8, 2026 16:39 View session

Copilot AI reviewed May 8, 2026

View reviewed changes

Merge branch 'dev' into isy994/tls-modernization-499

7089b6b

Copilot AI review requested due to automatic review settings May 13, 2026 14:58

Copilot started reviewing on behalf of shbatm May 13, 2026 14:59 View session

Copilot AI reviewed May 13, 2026

View reviewed changes

Comment thread tests/components/isy994/test_init.py Outdated

joostlek requested changes May 13, 2026

View reviewed changes

home-assistant Bot marked this pull request as draft May 13, 2026 16:54

shbatm and others added 2 commits May 13, 2026 14:38

Merge branch 'dev' into isy994/tls-modernization-499

89883bc

Copilot AI review requested due to automatic review settings May 13, 2026 19:40

Copilot started reviewing on behalf of shbatm May 13, 2026 19:40 View session

Copilot AI reviewed May 13, 2026

View reviewed changes

shbatm marked this pull request as ready for review May 13, 2026 20:03

home-assistant Bot requested a review from joostlek May 13, 2026 20:03

shbatm and others added 2 commits May 14, 2026 21:41

Merge branch 'dev' into isy994/tls-modernization-499

663b360

Merge branch 'dev' into isy994/tls-modernization-499

afb3c16

Copilot AI review requested due to automatic review settings May 18, 2026 21:25

Copilot AI reviewed May 18, 2026

View reviewed changes

Comment thread homeassistant/components/isy994/__init__.py

Comment thread homeassistant/components/isy994/config_flow.py

Comment thread homeassistant/components/isy994/__init__.py

Copilot started reviewing on behalf of joostlek May 18, 2026 21:51 View session

shbatm and others added 2 commits May 20, 2026 09:43

Merge branch 'dev' into isy994/tls-modernization-499

b87474e

Copilot AI review requested due to automatic review settings May 20, 2026 15:30

Copilot AI reviewed May 20, 2026

View reviewed changes

Potential fix for pull request finding

85c3a64

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings May 20, 2026 15:35

Copilot AI reviewed May 20, 2026

View reviewed changes

joostlek approved these changes May 20, 2026

View reviewed changes

joostlek merged commit 6159516 into home-assistant:dev May 20, 2026
49 checks passed

github-actions Bot locked and limited conversation to collaborators May 21, 2026

Uh oh!

Conversation

shbatm commented May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed change

Library changes

Type of change

Additional information

Checklist

Uh oh!

home-assistant Bot commented May 8, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

shbatm commented May 13, 2026

Uh oh!

home-assistant Bot commented May 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

joostlek May 13, 2026

Choose a reason for hiding this comment

Uh oh!

shbatm May 13, 2026

Choose a reason for hiding this comment

Uh oh!

shbatm May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

home-assistant Bot commented May 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

shbatm commented May 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

shbatm May 20, 2026

Choose a reason for hiding this comment

Uh oh!

shbatm May 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

shbatm commented May 8, 2026 •

edited

Loading

shbatm May 13, 2026 •

edited

Loading