Home Assistant Core 2026.10.2 came out on the evening of 16 October 2026 (22:04 Warsaw time), with 50 changes listed in the release notes. Most are fixes for single integrations, but a few affect everyone who uses MQTT, state conditions or more than one user account.

Account fixes

The fix covered here earlier this week is now in a stable release: deleting a user revokes all of that user's refresh tokens (#186558), which also closes their open connections. Before, a removed administrator could keep working through an open browser tab or a running phone app for as long as the connection stayed up.

A second change (#186398) guards the command that adds login credentials to an account. It no longer attaches a second password to a user who already has one, and it refuses to add new credentials to the owner account.

MQTT triggers and tags

After the MQTT integration was reloaded, a discovered MQTT device trigger ran its automation twice for a single message, and a discovered tag scanner reported every scan twice (#185998). The broker delivered the message once; Home Assistant had kept the old subscription and added a new one next to it. Besides an explicit reload, the same thing happened about 30 seconds after enabling disabled MQTT entities, because that reloads the entry too. A restart cleared it.

One MQTT fix that had been assigned to this release is not in it: the change that stops Home Assistant from deleting a whole discovered device when a single component is removed (#186084). On 16 October that pull request no longer had a milestone, and it is missing from the 2026.10.2 changes.

State conditions with a duration

A change merged in September and shipped in 2026.10.0 (#174083) made the configuration check reject state conditions that combined a list of states with a duration (for:). It turned out people use them, and the state trigger accepts the same combination, so 2026.10.2 allows it again (#186165). If an automation failed the configuration check after the update to 2026.10, this may be the reason.

Integrations

  • Broadlink: the integration now uses the broadlink-async library, which installs into its own folder. Custom integrations that still need the original broadlink package can be installed next to it again without breaking it (#186053).
  • SolarEdge: module statistics no longer reset to zero when the integration had not updated for more than a week. That reset showed up as a large negative jump in the statistics graph, and the next update also repairs windows already damaged (#186753).
  • Ecovacs: accounts that ask for device verification on every password login no longer need a new code at each reload (#186796).
  • Group: a group sensor with no members no longer crashes (#185931).
  • Enphase Envoy, FRITZ!Box, Nanoleaf, KNX, Modbus: fixes for background tasks, discovery, event handling, start-up and reloading without YAML.

The release also updates the frontend to 20260930.4.