Home Assistant Supervisor 2026.10.4 reached the beta channel on 24 October 2026 at 10:12 Polish time. Stable installs were still on 2026.10.3 at the time of writing and will update on their own once the release is promoted. Two of its fixes deal with situations where a Home Assistant system could get stuck without any obvious cause.

OS updates and a 9 KiB header

Pull request #7425 explains a failure that had nothing to do with Home Assistant itself. GitHub's release download redirects now carry a Content-Security-Policy header of about 9 KiB. The aiohttp library that Supervisor uses rejects any single header field over 8190 bytes by default, so the download failed with 400, message="Got more than 8190 bytes when reading". Home Assistant OS updates were hit because os-artifacts.home-assistant.io redirects to GitHub release assets. Supervisor now accepts header lines and fields up to 64 KiB on its shared web session. Local connections, such as the socket to Core and the systemd journal gateway, keep the old limits.

Core that never came back

The second fix, #7376, covers a nastier case. Restoring a backup, updating Core or rebuilding it removes the Core container and starts a new one at the end. If Supervisor crashes in the middle, for example after being killed for running out of memory, it comes back, notices it was restarted and skips starting Core. Neither watchdog caught this, so Home Assistant stayed down until the host was rebooted or someone ran ha core start. The pull request describes seeing it on 2026.10.0 while restoring a backup that contained a 10 GB file. Supervisor now starts Core in this situation if the container is missing and start at boot is enabled, and writes a warning to the log. A Core you stopped yourself with ha core stop keeps its container and stays stopped.

Logs and apps

  • Supervisor log lines and the timestamped host log formats now include the UTC offset, matching what Core 2026.11 does for its own logs. The release notes mark this as a breaking change, which matters if you parse these logs with your own tools.
  • App developers can now pick a default log format (plain, timestamp or verbose), so an app that does not print its own timestamps can show them by default.
  • Ingress now passes the signed-in user's Home Assistant groups to apps in an X-Remote-User-Groups header, for example system-admin. The pull request names Music Assistant as an app that could then stop using admin-only Core commands for its login.
  • An app still in its healthcheck start period is no longer marked unhealthy after a Supervisor restart, which had led the watchdog to restart it for no reason.