Bump pywaze to 1.2.3 and close Waze clients on unload by eifinger · Pull Request #183923 · home-assistant/core · GitHub
Skip to content

Bump pywaze to 1.2.3 and close Waze clients on unload - #183923

Merged
erwindouna merged 1 commit into
home-assistant:devfrom
eifinger:bump-pywaze-to-1.2.3
Oct 1, 2026
Merged

erwindouna merged 1 commit into
home-assistant:devfrom
eifinger:bump-pywaze-to-1.2.3

Conversation

@eifinger

@eifinger eifinger commented Oct 1, 2026 •

Copy link
Copy Markdown
Contributor

Breaking change

Proposed change

eifinger/pywaze@v1.2.1...v1.2.3

Adds a fallback when 403 is encountered. The fallback uses curl-cffi to impersonate a chrome browser.
This is not chosen as the default as I hope that the 403 errors will go away on its own, being caused by a misconfiguration on Waze's backend.

In addition to the version bump we need to close the new curl-cffi client when unloading/reloading the integration and in single-use locations to avoid resource leaks.

Type of change

  • Dependency upgrade
  • Bugfix (non-breaking change which fixes an issue)
  • New integration (thank you!)
  • New feature (which adds functionality to an existing integration)
  • Deprecation (breaking change to happen in the future)
  • Breaking change (fix/feature causing existing functionality to break)
  • Code quality improvements to existing code or addition of tests

Additional information

Checklist

  • I understand the code I am submitting and can explain how it works.
  • The code change is tested and works locally.
  • Local tests pass. Your PR cannot be merged unless tests pass
  • There is no commented out code in this PR.
  • I have followed the development checklist
  • I have followed the perfect PR recommendations
  • The code has been formatted using Ruff (ruff format homeassistant tests)
  • Tests have been added to verify that the new code works.
  • Any generated code has been carefully reviewed for correctness and compliance with project standards.

If user exposed functionality or configuration variables are added/changed:

If the code communicates with devices, web services, or third-party tools:

  • The manifest file has all fields filled out correctly.
    Updated and included derived files by running: python3 -m script.hassfest.
  • New or updated dependencies have been added to requirements_all.txt.
    Updated by running python3 -m script.gen_requirements_all.
  • For the updated dependencies a diff between library versions and ideally a link to the changelog/release notes is added to the PR description.

To help with the load of incoming pull requests:

Copilot AI balanced review requested due to automatic review settings October 1, 2026 16:41

@home-assistant home-assistant Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @ampagent

It seems you haven't yet signed a CLA. Please do so here.

Once you do that we will be able to review and accept this pull request.

Thanks!

@home-assistant home-assistant Bot added bugfix cla-needed Hacktoberfest integration: waze_travel_time small-pr PRs with less than 30 lines. Top 200 Integration is ranked within the top 200 by usage labels Oct 1, 2026
@home-assistant
home-assistant Bot marked this pull request as draft October 1, 2026 16:41
@home-assistant

home-assistant Bot commented Oct 1, 2026

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

Temporary clients used by services and config validation remain unclosed, and lifecycle cleanup lacks test coverage.

Review effort: Balanced
Findings: 1 Medium severity

Open (1)
What changed in this PR

Bumps pywaze to restore Waze routing after HTTP 403 responses and adds client cleanup during config-entry unload.

Changes:

  • Updates pywaze from 1.2.1 to 1.2.3.
  • Registers the config-entry client for cleanup on unload.
  • Introduces curl-cffi fallback support through pywaze.
File Description
requirements_all.txt Updates the generated pywaze requirement.
homeassistant/​components/​waze_travel_time/​manifest.json Updates the integration dependency.
homeassistant/​components/​waze_travel_time/​__init__.py Closes the entry client during unload.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread homeassistant/components/waze_travel_time/__init__.py
@eifinger
eifinger force-pushed the bump-pywaze-to-1.2.3 branch from b389814 to 0863ffb Compare October 1, 2026 16:44

@home-assistant home-assistant Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @ampagent

It seems you haven't yet signed a CLA. Please do so here.

Once you do that we will be able to review and accept this pull request.

Thanks!

@github-actions

github-actions Bot commented Oct 1, 2026

Copy link
Copy Markdown
Contributor

Check requirements

Checked at commit b389814.

All requirements checks passed. ✅

Package Old New No Advisories Not Yanked Repo Public CI Upload Release Pipeline Security PR Link Async Safe
pywaze 1.2.1 1.2.3 ✅ ✅ ✅ ✅ ✅ ☑️ ✅ ✅
📦 pywaze: 1.2.1 → 1.2.3
  • No Advisories: ✅ No active advisories reported by PyPI for version 1.2.3.
  • Not Yanked: ✅ Version 1.2.3 is a live (non-yanked) release.
  • Repo Public: ✅ eifinger/pywaze is publicly accessible.
  • CI Upload: ✅ Trusted Publisher attestation found (GitHub).
  • Release Pipeline: ✅ OIDC via Trusted Publisher attestation (GitHub); automated CI upload verified by PyPI.
  • Security: ☑️ Baseline scan found nothing obvious in pyproject.toml, src/pywaze/__init__.py, src/pywaze/route_calculator.py. This is not a security review — only the cheap checks were run.
  • PR Link: ✅ PR description links to the compare view, which mentions both 1.2.1 and 1.2.3.
  • Async Safe: ✅ No new blocking calls introduced in 1.2.1 → 1.2.3. The only network calls use httpx.AsyncClient and curl_cffi.requests.AsyncSession (both async-native); the new 403-fallback path in route_calculator.py still awaits these async clients.

Generated by Check requirements (AW) · copilot · auto · 39.2 AIC · ⌖ 7.33 AIC · ⊞ 13.3K · ◷

@github-actions

github-actions Bot commented Oct 1, 2026

Copy link
Copy Markdown
Contributor

Check requirements

Checked at commit 0863ffb.

All requirements checks passed. ✅

Package Old New No Advisories Not Yanked Repo Public CI Upload Release Pipeline Security PR Link Async Safe
pywaze 1.2.1 1.2.3 ✅ ✅ ✅ ✅ ✅ ☑️ ✅ ✅
📦 pywaze: 1.2.1 → 1.2.3
  • No Advisories: ✅ No active advisories reported by PyPI for version 1.2.3.
  • Not Yanked: ✅ Version 1.2.3 is a live (non-yanked) release.
  • Repo Public: ✅ https://github.com/eifinger/pywaze is publicly accessible.
  • CI Upload: ✅ Trusted Publisher attestation found (GitHub).
  • Release Pipeline: ✅ OIDC via Trusted Publisher attestation (GitHub); automated CI upload verified by PyPI.
  • Security: ☑️ Baseline scan found nothing obvious in pyproject.toml, src/pywaze/__init__.py, src/pywaze/route_calculator.py. This is not a security review — only the cheap checks were run.
  • PR Link: ✅ PR description links to eifinger/pywaze@v1.2.1...v1.2.3, which mentions both 1.2.1 and 1.2.3 on the same host as the source repository.
  • Async Safe: ✅ No new blocking calls introduced in 1.2.1 → 1.2.3. The diff adds a curl_cffi.requests.AsyncSession fallback used only via await in get_routes/close, with no sync HTTP, filesystem, subprocess, or socket calls added inside async def bodies.

Generated by Check requirements (AW) · copilot · auto · 38 AIC · ⌖ 6.81 AIC · ⊞ 13.3K · ◷

Copilot AI balanced review requested due to automatic review settings October 1, 2026 17:00
@eifinger
eifinger force-pushed the bump-pywaze-to-1.2.3 branch from 0863ffb to 864ed9d Compare October 1, 2026 17:00

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🔵 Needs a closer look

The newly introduced unload cleanup lacks a test verifying that the client is closed.

Review effort: Balanced
Findings: None

Resolved since last review (1)

@github-actions

github-actions Bot commented Oct 1, 2026

Copy link
Copy Markdown
Contributor

Check requirements

Checked at commit 864ed9d.

All requirements checks passed. ✅

Package Old New No Advisories Not Yanked Repo Public CI Upload Release Pipeline Security PR Link Async Safe
pywaze 1.2.1 1.2.3 ✅ ✅ ✅ ✅ ✅ ☑️ ✅ ✅
📦 pywaze: 1.2.1 → 1.2.3
  • No Advisories: ✅ No active advisories reported by PyPI for version 1.2.3.
  • Not Yanked: ✅ Version 1.2.3 is a live (non-yanked) release.
  • Repo Public: ✅ https://github.com/eifinger/pywaze is publicly accessible.
  • CI Upload: ✅ Trusted Publisher attestation found (GitHub).
  • Release Pipeline: ✅ OIDC via Trusted Publisher attestation (GitHub); automated CI upload verified by PyPI.
  • Security: ☑️ Baseline scan found nothing obvious in pyproject.toml and src/pywaze/route_calculator.py (full diff for 1.2.1 → 1.2.3 reviewed). Standard hatchling build backend, no custom build hooks/entry points, no network calls at import time, no decode-and-exec patterns, no access to HA internals or secrets. This is not a security review — only the cheap checks were run.
  • PR Link: ✅ PR description links to eifinger/pywaze@v1.2.1...v1.2.3, which mentions both 1.2.1 and 1.2.3.
  • Async Safe: ✅ No new blocking calls introduced in 1.2.1 → 1.2.3. The diff adds a 403-fallback path using curl_cffi.requests.AsyncSession (async) alongside the existing httpx.AsyncClient (async); both are awaited. No sync HTTP, time.sleep, blocking sockets, blocking file I/O, sync DB drivers, or subprocess calls were introduced in async def bodies.

Generated by Check requirements (AW) · copilot · auto · 50.7 AIC · ⌖ 6.15 AIC · ⊞ 13.3K · ◷

@eifinger
eifinger marked this pull request as ready for review October 1, 2026 17:09
@home-assistant
home-assistant Bot dismissed stale reviews from themself October 1, 2026 17:09

Stale

@erwindouna erwindouna left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @eifinger!

@erwindouna
erwindouna merged commit 3325066 into home-assistant:dev Oct 1, 2026
56 checks passed
@github-actions github-actions Bot locked and limited conversation to collaborators Oct 2, 2026
@silamon silamon added this to the 2026.10.0 milestone Oct 5, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Waze Travel Time: routing requests return HTTP 403 Forbidden for coordinates too (all regions)

5 participants