Bump wiim to 0.3.2

[Linkplay2020]

Proposed change

• Fix Bluetooth input connections incorrectly changing the audio output state
• Fix audio output controls to remain device-local when grouped
• Linkplay2020/wiim@v0.3.0...v0.3.2

Type of change

• Dependency upgrade
• Bugfix (non-breaking change which fixes an issue)
• New integration (thank you!)
• New feature (which adds functionality to an existing integration)
• Deprecation (breaking change to happen in the future)
• Breaking change (fix/feature causing existing functionality to break)
• Code quality improvements to existing code or addition of tests

Additional information

• This PR fixes or closes issue: fixes #
• This PR is related to issue:
• Link to documentation pull request:
• Link to developer documentation pull request:
• Link to frontend pull request:

Checklist

• I understand the code I am submitting and can explain how it works.
• The code change is tested and works locally.
• Local tests pass. Your PR cannot be merged unless tests pass
• There is no commented out code in this PR.
• I have followed the development checklist
• I have followed the perfect PR recommendations
• The code has been formatted using Ruff (ruff format homeassistant tests)
• Tests have been added to verify that the new code works.
• Any generated code has been carefully reviewed for correctness and compliance with project standards.

If user exposed functionality or configuration variables are added/changed:

• Documentation added/updated for www.home-assistant.io

If the code communicates with devices, web services, or third-party tools:

• The manifest file has all fields filled out correctly.
  Updated and included derived files by running: python3 -m script.hassfest.
• New or updated dependencies have been added to requirements_all.txt.
  Updated by running python3 -m script.gen_requirements_all.
• For the updated dependencies a diff between library versions and ideally a link to the changelog/release notes is added to the PR description.

To help with the load of incoming pull requests:

• I have reviewed two other open pull requests in this repository.

[Copilot]

🔵 Needs a closer look

The pins are consistent, but upstream compatibility and integration test results remain unverified.

0 open findings

What changed in this PR

Updates Home Assistant’s WiiM dependency to 0.3.1 to address Bluetooth input connections incorrectly changing audio output state.

Changes:

• Bumps wiim from 0.3.0 to 0.3.1.
• Keeps integration and consolidated dependency pins aligned.

File	Description
requirements_all.txt	Updates the consolidated WiiM dependency pin.
homeassistant/​components/​wiim/​manifest.json	Updates the integration’s WiiM requirement.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Quality scale review

✅ No issues found at ee3696b. No done/exempt rule for wiim concerns the changed lines (dependency version bump only, no quality_scale.yaml change).

Generated by quality-scale-reviewer · copilot · auto · 14.1 AIC · ⌖ 6.71 AIC · ⊞ 8.4K · ◷

[github-actions]

Check requirements

Checked at commit ee3696b.

⚠️ Some checks require attention — see the details below.

Package	Old	New	No Advisories	Not Yanked	Repo Public	CI Upload	Release Pipeline	Security	PR Link	Async Safe
wiim	0.3.0	0.3.1	✅	✅	✅	⚠️	⚠️	☑️	✅	✅

📦 wiim: 0.3.0 → 0.3.1

• No Advisories: ✅ No active advisories reported by PyPI for version 0.3.1.
• Not Yanked: ✅ Version 0.3.1 is a live (non-yanked) release.
• Repo Public: ✅ https://github.com/Linkplay2020/wiim is publicly accessible.
• CI Upload: ⚠️ No PEP 740 provenance attestation present on PyPI. Upload method cannot be verified from PyPI alone.
• Release Pipeline: ⚠️ .github/workflows/release.yaml triggers only on manual workflow_dispatch (guarded by a protected pypi environment) and publishes via a static PYPI_API_TOKEN secret rather than OIDC trusted publishing. Acceptable for a bump but not best practice.
• Security: ☑️ Baseline scan found nothing obvious in setup.py, .github/workflows/release.yaml, src/wiim/__init__.py, and src/wiim/__main__.py. This is not a security review — only the cheap checks were run.
• PR Link: ✅ PR description links to Linkplay2020/wiim@v0.3.0...v0.3.1, which mentions both 0.3.0 and 0.3.1 on the same host as the repository.
• Async Safe: ✅ No new blocking calls introduced in 0.3.0 → 0.3.1. The only functional change (9ab40ec) is a conditional-logic tweak in src/wiim/wiim_device.py's event handler; no I/O was added.

Generated by Check requirements (AW) · copilot · auto · 55.4 AIC · ⌖ 6.88 AIC · ⊞ 13.4K · ◷

[Copilot]

🔵 Needs a closer look

The intended release needs confirmation because the pins target 0.3.2 while the title and comparison cover only 0.3.1.

1 open finding

• Align dependency pins with the PR title and release comparison · New

🧠 Review effort: Balanced

[github-actions]

Check requirements

Checked at commit 2d2bdb3.

⚠️ Some checks require attention — see the details below.

Package	Old	New	No Advisories	Not Yanked	Repo Public	CI Upload	Release Pipeline	Security	PR Link	Async Safe
wiim	0.3.0	0.3.2	✅	✅	✅	⚠️	⚠️	☑️	✅	✅

📦 wiim: 0.3.0 → 0.3.2

• No Advisories: ✅ No active advisories reported by PyPI for version 0.3.2.
• Not Yanked: ✅ Version 0.3.2 is a live (non-yanked) release.
• Repo Public: ✅ https://github.com/Linkplay2020/wiim is publicly accessible.
• CI Upload: ⚠️ No PEP 740 provenance attestation present on PyPI. Upload method cannot be verified from PyPI alone.
• Release Pipeline: ⚠️ release.yaml publishes via pypa/gh-action-pypi-publish using a static user/password: ${{ secrets.PYPI_API_TOKEN }} instead of OIDC trusted publishing, and is triggered only by manual workflow_dispatch (no tag push / release-event gate), though it does target a protected pypi environment. A static token on a bump with manual-only dispatch is acceptable but not best practice.
• Security: ☑️ Baseline scan found nothing obvious in setup.py, __init__.py, __main__.py, discovery.py, handler.py, endpoint.py, and the v0.3.0...v0.3.2 diff of wiim_device.py/controller.py. No execution of network input, no reads of credential/config material, no obfuscated code, and no off-purpose network destinations were found. This is not a security review — only the cheap checks were run.
• PR Link: ✅ PR description links to the compare view on the source repository, mentioning both 0.3.0 and 0.3.2.
• Async Safe: ✅ No new blocking calls introduced in 0.3.0 → 0.3.2. The diff in wiim_device.py only adds a guard condition to existing async methods (async_set_output_mode, get_audio_output_hw_mode, supported_output_modes, output_mode) around pre-existing non-blocking attribute/dict access; controller.py is unchanged between the two tags.

Generated by Check requirements (AW) · copilot · auto · 63.3 AIC · ⌖ 7.26 AIC · ⊞ 13.4K · ◷

[frenck]

This PR cannot be cleanly merged into the current stable branches, and thus removed from the milestone.

../Frenck

                       

Blogging my personal ramblings at frenck.dev