# home-assistant — triage (group D)
Pin: ghcr.io/home-assistant/home-assistant:2026.9.4. Gates: setup_gate.
## GHSA-jff5-5j3g-vhqc (low, 2023) — NOT-A-FINDING: GitHub Actions expression injection in the separate
home-assistant/actions repo (`helpers/version/action.yml`, ecosystem "actions", fixed 2023-09-05); CI, not the product.
Release bodies 2026.10.0..2026.10.4: no security mention.
Lane: NOT_A_FINDING. No target.
Classifier note: skip advisories with package ecosystem "actions".