homebridge-withings-environment-data 1.5.0 → 1.6.2

package/CHANGELOG.md

@@ -6,6 +6,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+## [1.6.2] - 2026-08-21
+
+### Changed
+- Config UI: Authentication fieldset now starts collapsed
+- Config UI: "Expose sensors as HomeKit Accessories" moved below the Air
+  Quality fieldset
+- Host field's description now notes it defaults to port 1883 when the
+  port is omitted
+
+## [1.6.1] - 2026-08-21
+
+### Fixed
+- Publish workflow's CI Node version bumped to 22 — the first real run
+  failed at `npm install -g npm@latest`, since the latest npm now
+  requires Node `^22.22.2 || ^24.15.0 || >=26.0.0` and the workflow had
+  pinned Node 20
+
+## [1.6.0] - 2026-08-21
+
+### Added
+- "Requires authentication" checkbox in the MQTT fieldset; Username and
+  Password only appear (and are only sent to the broker) when it's checked
+
+### Changed
+- MQTT Host and Port merged into a single "Host" field including the port,
+  e.g. `localhost:1883` (the new default)
+- Publishing to npm now happens automatically via GitHub Actions on tagged
+  releases, using npm's OIDC trusted publishing (no npm tokens in CI)
+
 ## [1.5.0] - 2026-08-19
 
 ### Added

package/README.md

@@ -1,4 +1,4 @@
-# Withings Environment Data v1.5.0
+# Withings Environment Data v1.6.2
 
 **This Homebridge plugin has been 100% vibe coded with Claude.**
 
@@ -93,15 +93,17 @@ Fields:
   Anything above the Inferior boundary is reported as Poor.
 - **Expose sensors as HomeKit Accessories**: see [Usage](#usage) above.
   Default on.
-- **Publish to MQTT / Host / Port / Username / Password / Last Seen /
-  Retain**: see [Usage](#usage) above. Publishing is off by default; Port
-  defaults to 1883. Username/Password are optional, for brokers that
-  require auth. **Last Seen** controls the format of the `last_seen`
-  field, which always reflects the time the scale actually took the
-  measurement (not when the plugin polled or published it): `ISO_8601`
-  (default, UTC), `ISO_8601 local` (with UTC offset), `epoch`
-  (milliseconds), or `disabled` to omit the field entirely. Retain is on
-  by default.
+- **Publish to MQTT / Host / Requires authentication / Username / Password /
+  Last Seen / Retain**: see [Usage](#usage) above. Publishing is off by
+  default. **Host** includes the port, e.g. `localhost:1883` (the
+  default); if the port is omitted it defaults to 1883. Username/Password
+  only apply, and only appear, when **Requires authentication** is
+  checked. **Last Seen** controls the
+  format of the `last_seen` field, which always reflects the time the
+  scale actually took the measurement (not when the plugin polled or
+  published it): `ISO_8601` (default, UTC), `ISO_8601 local` (with UTC
+  offset), `epoch` (milliseconds), or `disabled` to omit the field
+  entirely. Retain is on by default.
 - **Stale Data Warning Threshold (hours)**: if the newest reading from the
   scale itself (not the plugin's poll) is older than this many hours — e.g.
   nobody's stood on the scale in a while — a warning is logged on every

package/config.schema.json

@@ -87,13 +87,12 @@
       "mqttHost": {
         "title": "Host",
         "type": "string",
-        "default": "localhost",
-        "description": "Broker hostname or IP address."
+        "default": "localhost:1883",
+        "description": "Broker hostname or IP address, including port. Defaults to port 1883 if the port is omitted."
       },
-      "mqttPort": {
-        "title": "Port",
-        "type": "integer",
-        "default": 1883
+      "mqttRequiresAuth": {
+        "title": "Requires authentication",
+        "type": "boolean"
       },
       "mqttUsername": {
         "title": "Username",
@@ -155,7 +154,7 @@
       "type": "fieldset",
       "title": "Authentication",
       "expandable": true,
-      "expanded": true,
+      "expanded": false,
       "items": [
         "email",
         "password",
@@ -163,7 +162,6 @@
         "trustCookieValue"
       ]
     },
-    "exposeAsHomekitAccessories",
     {
       "type": "fieldset",
       "title": "MQTT",
@@ -172,9 +170,19 @@
       "items": [
         "publishToMqtt",
         "mqttHost",
-        "mqttPort",
-        "mqttUsername",
-        "mqttPassword",
+        "mqttRequiresAuth",
+        {
+          "key": "mqttUsername",
+          "condition": {
+            "functionBody": "return model.mqttRequiresAuth === true;"
+          }
+        },
+        {
+          "key": "mqttPassword",
+          "condition": {
+            "functionBody": "return model.mqttRequiresAuth === true;"
+          }
+        },
         "mqttLastSeen",
         "mqttRetain"
       ]
@@ -192,6 +200,7 @@
         "airQualityInferiorMaxPpm"
       ]
     },
+    "exposeAsHomekitAccessories",
     "pollIntervalMinutes",
     "noResponseAfterMissedPolls",
     "staleDataWarningThresholdHours",

package/index.js

@@ -256,19 +256,38 @@ class WithingsEnvironmentDataPlatform {
     return this.config.publishToMqtt === true;
   }
 
+  // mqttHost is a single "host[:port]" field; older configs saved before that
+  // merge may still have a separate mqttPort value sitting in config.json
+  // (config UI stops writing it once resaved, but doesn't retroactively
+  // delete it), so fall back to that before the hardcoded default.
+  getMqttHostAndPort() {
+    const raw = this.config.mqttHost || '';
+    const colonIndex = raw.lastIndexOf(':');
+    if (colonIndex > -1) {
+      const host = raw.slice(0, colonIndex);
+      const port = Number(raw.slice(colonIndex + 1));
+      if (host && Number.isFinite(port) && port > 0) {
+        return { host, port };
+      }
+    }
+    const legacyPort = Number(this.config.mqttPort);
+    return { host: raw, port: Number.isFinite(legacyPort) && legacyPort > 0 ? legacyPort : 1883 };
+  }
+
   connectMqtt() {
     if (!this.getPublishToMqtt()) return;
 
-    if (!this.config.mqttHost) {
+    const { host, port } = this.getMqttHostAndPort();
+    if (!host) {
       this.log.warn('Publish to MQTT is enabled but no MQTT Host is configured; MQTT publishing is disabled.');
       return;
     }
 
-    const port = Number(this.config.mqttPort);
-    const url = `mqtt://${this.config.mqttHost}:${Number.isFinite(port) && port > 0 ? port : 1883}`;
+    const url = `mqtt://${host}:${port}`;
+    const requiresAuth = this.config.mqttRequiresAuth === true;
     this.mqttClient = mqtt.connect(url, {
-      username: this.config.mqttUsername || undefined,
-      password: this.config.mqttPassword || undefined,
+      username: requiresAuth ? this.config.mqttUsername || undefined : undefined,
+      password: requiresAuth ? this.config.mqttPassword || undefined : undefined,
     });
     this.mqttClient.on('error', (err) => this.log.warn(`MQTT connection error: ${err.message}`));
     // Without this, a silently-never-connecting client looks identical in the

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "homebridge-withings-environment-data",
   "displayName": "Withings Environment Data",
-  "version": "1.5.0",
+  "version": "1.6.2",
   "description": "Homebridge plugin exposing ambient CO2/air-quality and room temperature readings from a Withings WS-50 scale as HomeKit sensors",
   "main": "index.js",
   "files": [