Releases · Tasmota

Tasmota v16.0.0 ships a fix worth applying and a stricter upgrade path

The first v16 major of the ESP8266/ESP32 firmware fixes unauthenticated UFS writes on password-protected web interfaces, removes direct migration from versions before v8.1.0, and adds ESP32-S31, C61 and P4R3 support, optional MQTT 5.0, Matter 1.6.1 and expanded DALI-2.

By BoneFriday 16 October 20263 min readReleases

entryread only

filedFriday 16 October 2026

length3 min

sectionReleases

subjectTasmota

sourceson the page

Tasmota v16.0.0 “Theo”, released on 16 October, is the first v16 major of the alternative ESP8266/ESP32 firmware that many self-hosted smart homes run on. It carries one fix to act on, a stricter upgrade path than usual, and an unusually long feature list.

The security fix

The one to take first is in the release’s own fix list: “Unauthenticated UFS writes on web password enabled systems,” with no issue link and no CVE attached. Read plainly, devices that expose their web interface with a password set get an unauthenticated write path closed by this release. That is the extent of the public detail; treat it as a reason to upgrade, not as a severity rating.

The upgrade path

Upgrades are stricter this time. Direct migration from versions before v8.1.0 (Doris) is no longer supported, so old devices need the documented step ladder: 3.9.x, 4.x, 5.14, 6.7.1, 7.2.0, 8.5.1, 9.1, then the latest release. The project repeats a warning worth heeding: “Do not upgrade from minimal to minimal version. It will most likely fail at some point and will require flashing via serial.” The support floors moved as well: ESP8266 Arduino Core 2.7.8 and above, ESP32 Core v3.3.12 and above. Older cores are dropped.

What’s new

The release adds initial ESP32-S31 support along with ESP32-C61 and ESP32-P4R3; optional MQTT 5.0 focused on request/response; and Matter at spec 1.6.1, with new Soil Sensor and Garage Door device types, a Wi-Fi Network Diagnostics cluster, and an electrical power measurement cluster. DALI-2 support grows: input-device events from push buttons, occupancy and light sensors are decoded for rules and MQTT, commissioning and instance queries come through DaliDeviceScan and DaliDevice, and buttons bind to control gear with DaliBind. Heating and climate users get a MiELHVAC panel on the web main page with Home Assistant MQTT discovery and a Modbus RTU slave on a second RS485 port, plus a second OpenTherm heating circuit. Smaller additions include a HwDump command for GPIO configuration, a TFA Dostmann 868 MHz pool thermometer driver, and Xiaomi body-composition scale support. Under the hood: the ESP32 framework moved to 3.3.12 with IDF 5.5.5, LVGL to 9.6, and the ESP8266 platform to 2026.09. Binaries are the usual pair, tasmota.bin for ESP8266 and tasmota32.bin for ESP32, with per-chip builds for the new targets; initial installs go through the Tasmota WebInstaller, and OTA URLs live under ota.tasmota.com.

The Tasmota web UI main page on a Shelly DALI Dimmer Gen3: time and temperature status rows, three dimmer sliders (B, G1, G2), the Configuration, Information, Firmware Upgrade, Tools and Restart buttons, and a footer reading Tasmota 14.3.0.4. — The built-in Tasmota web UI main page on a Shelly DALI Dimmer Gen3, from the project's official documentation; the capture predates v16.0.0 and does not show this release's firmware. Image: Tasmota docs.

My read

For firmware that many homes flash and then forget, the ordering of this release matters: the security entry first, the upgrade rules second, the feature list third. A device that is far behind has the step ladder to climb; a current one gets a routine over-the-air update with a real fix inside. The Matter, DALI-2 and MiELHVAC work is what Home Assistant users will notice; the new chips matter at the next hardware purchase.

Source: the v16.0.0 release notes and the migration path documentation.

ReleasesHomebridge 2.5.0 is a Matter release: new device types, and fixes for identity and cacheHomebridge 2.5.0 adds Matter device types for solar, battery, EV chargers, meters, tariffs and water heaters, and spends the rest of its list on behaviour that used to go wrong: air quality reporting only two levels, thermostats registering late, restored accessories losing their uniqueId or owner, and cache reads that took the accessory with them. It also bumps @matter/main to v0.18.0 and @homebridge/hap-nodejs to v2.3.0.

ReleasesMealie 3.30.0 lets you own the AI prompt, time each step, and plan a whole weekMealie 3.30.0 moves AI prompt control into the app, so prompts can be appended to, replaced or extended with global instructions, and it retires the OPENAI_CUSTOM_PROMPT_DIR variable while importing existing prompts automatically. Instruction steps gain individual durations, meal plan entries can cover a full week, and a batch of fixes tightens import scoping, locale lookup and the permissions needed to manage units, tools, labels and recipe actions.

ReleasesMemos 26.10.0 signs API clients out, stops reading /etc/secrets and makes export an admin jobMemos 26.10.0 is the first release under calendar versioning, and its upgrade notes matter more than its features: old installs need a 0.31.0 waypoint, cached access tokens expire on upgrade, the /etc/secrets files from 0.31.0 are no longer read, member export disappears, and the old upload and memo-length settings are replaced without migration. The features are a rich editor by default, per-user usage limits and declarative configuration.