v1.1.2

HACS-ready release with brand assets, validation CI, issue templates, and disclaimer.

v1.1.1

Fix 3 CodeQL alerts (py/incomplete-url-substring-sanitization):

• test_api_client.py: replaced 'in' substring checks with direct equality for gateway URLs
• test_const.py: replaced '.gwmcloud.com in' check with direct equality

All assertions still pass. Alerts will auto-close on next CodeQL analysis run.

v1.1.0

Drop Python 3.12/3.13 support — requires Python 3.14.2+ to match Home Assistant Core 2026.5+.

• Changed requires-python from >=3.12 to >=3.14.2
• uv.lock regenerated with updated dependencies

Note: uv.lock contains dual-version pins (python<3.14.2 / >=3.14.2) for backwards compatibility. Dependabot alerts for python<3.14.2 versions remain open but don't apply to the current runtime.

v1.0.9

Security upgrades:

• homeassistant 2026.4.4 → 2026.5.1 (brings newer orjson, pyopenssl, pyjwt)
• orjson 3.11.7/3.11.5 → 3.11.8 (fixes GHSA-hx9q-6w63-j58v: unbounded JSON recursion)
• pyopenssl 26.0.0 → 26.1.0 (fixes GHSA-5pwr-322w-8jr4: cookie buffer overflow)
• pyjwt 2.10.1 → 2.12.1 (fixes GHSA-752w-5fwx-jx9f: crit header bypass)
• cryptography 46.0.7 → 47.0.0
• Also removed unused pillow dependency (was transitively pulled by homeassistant, not used in ora2mqtt)

Note: 4 Pillow CVEs (GHSA-cfh3-3jmp-rvhc, GHSA-pwv6-vv43-88gr, GHSA-whj4-6x5x-4v2j, GHSA-wjx4-4jcj-g98j) remain in the lock file for python<3.14.2 due to homeassistant constraining pillow>=12.0.0. Upgrade homeassistant to a version that requires pillow>=12.2.0 to fully resolve.

v1.0.8

Remove unused dependencies and dead code.

• Removed pycryptodome (unused — code uses cryptography)
• Removed paho-mqtt (unused)
• Removed CONF_ACCOUNT constant (never referenced)
• Removed Country/Countrys dataclasses from auth.py and vehicles.py
• Removed send_email_code, get_customer_service_phone, _hash_pin, check_security_password methods
• Removed GwmResponse dataclass
• Stubbed get_countries() → return []
• Removed broken async_reload_entry import and test from test_integration.py
• 170 lines removed across 10 files

v1.0.7

Remove unused paho-mqtt dependency and dead MQTT constants (CONF_MQTT_PREFIX, CONF_MQTT_TOPIC). No functional changes.

v1.0.6

What's Changed

• Car image thumbnail: Added _attr_entity_picture to the device tracker entity, showing the car image from the GWM API as a thumbnail in the HA entity list.

Full Changelog: v1.0.5...v1.0.6

v1.0.5

What's Changed

• Car image URL: Added color_url from the GWM API (acquireVehicles). Exposed as image_url attribute on the device tracker entity, making the car photo available for dashboards and templates.

Full Changelog: v1.0.4...v1.0.5

v1.0.4

What's Changed

Added

• Charging Time Remaining sensor: Added OraChargingTimeSensor (code 2013022) — shows remaining charging time in minutes.
• SOC Target sensor: Added OraSocTargetSensor (code 2013023) — shows the target SOC percentage for charging.

Full Changelog: v1.0.3...v1.0.4

v1.0.3

What's Changed

Fixed

• Device card serial number: Use showedVin from the GWM API as the serial number in Home Assistant's device card, instead of the raw vin field. The showedVin is the VIN displayed in the OEM app and is the correct value users expect to see. Fallback to raw vin if showedVin is null.

Full Changelog: v1.0.2...v1.0.3