Home Assistant 2026.10.4 came out on 24 October 2026 at 22:03 Polish time, one day after 2026.10.3. It has only two changes, and both repair things that broke last week. If you use Lutron Caséta, this is the update to install.
Lutron Caséta could not reach the bridge
After updating to 2026.10.3, Caséta users found the integration could no longer connect to the Smart Bridge. The log kept repeating Reconnecting after error: check_hostname requires server_hostname, while the lights still worked from the Lutron app. Three separate reports were filed on GitHub between 23 and 24 October, one of them from a Docker install, so this was not limited to Home Assistant OS.
The cause was not in the integration itself. Home Assistant 2026.10.3 moved to Python 3.14.8. The pylutron-caseta library builds its TLS context with PROTOCOL_TLS_CLIENT, which turns hostname checking on, and then connects with an empty server_hostname so that it does not send SNI. Python 3.14.8 started rejecting that combination. Version 0.30.0 of the library turns off check_hostname, which lets the connection without SNI work again.
Certificate checking stays in place. The bridge's certificate still has to match the CA that was stored when you paired it (CERT_REQUIRED), so the change removes only the hostname comparison, which this connection never used anyway.
Pull request #188388 states openly that the change was not tested on a real bridge. Other users report that the new library fixes the problem, and with the integration completely broken on 2026.10.3 there was little left to make worse.
The new library also adds IPv6 connections, support for Athena processors, CCO zones and a constant for a long button hold. The pull request says Home Assistant's integration does not use any of these yet.
Firmware checks failed on a GitHub header
The second change is the Core version of the fix that Supervisor 2026.10.4 got earlier the same day. GitHub's release download redirects now carry a Content-Security-Policy header of about 9 KiB, above the 8190-byte default of the aiohttp library. Requests failed with Got more than 8190 bytes when reading. The reported case was the firmware update check in the Home Assistant Hardware integration, on a Raspberry Pi 4 with a Connect ZBT-2. Web sessions that integrations get from Home Assistant now accept header lines and fields up to 64 KiB.
The same error also hit HACS and other projects that download from GitHub, according to the issue. Whether a given custom integration recovers depends on whether it uses Home Assistant's shared web session.