• Cloudron HA package 1.23.1, image cloudron/io.homeassistant.cloudronapp:202609071958520000
• HA Core 2026.9.2, Python 3.14.6 (x86_64)
• Fresh install on Cloudron 9.x, app at 1071.customdomain.com

Problem

On a fresh install, every integration that pulls in pycryptodome fails to import. Example: Yale.

ERROR (ImportExecutor_0) [homeassistant.loader] Unexpected exception importing platform homeassistant.components.yale.config_flow
ERROR (MainThread) [homeassistant.setup] Setup failed for yale: Unable to import component
Exception: Version mismatch: this is the 'cffi' package version 2.0.0, located in
'/app/code/lib/python3.14/site-packages/cffi/api.py'. When we import the top-level
'_cffi_backend' extension module, we get version 2.1.1, located in
'/app/code/lib/python3.14/site-packages/_cffi_backend.cpython-314-x86_64-linux-gnu.so'.

Import chain: yale -> yalexs -> pubnub -> Cryptodome -> FFI() -> version check fails.

Affected integrations are any that import pycryptodome / cryptography through cffi (Yale, roborock, google, etc.).

Root cause

HA Core pins cffi==2.0.0 in homeassistant/package_constraints.txt (added in PR #175907, released in 2026.8.0, to match the pre-baked _cffi_backend in official HA images). The Cloudron image venv ends up with the cffi 2.0.0 Python package but a _cffi_backend 2.1.1 binary — mismatched halves, and cffi hard-fails on that at import time.

Same bug class as home-assistant/core#175882 (there the direction was reversed: 2.1.0 package vs 2.0.0 backend).

Workaround (user-side, lost on every app update)

In the app Web Terminal:

/app/code/bin/pip install --no-cache-dir --force-reinstall --no-deps cffi==2.0.0
/app/code/bin/python -c "import cffi, _cffi_backend; print(cffi.__version__, _cffi_backend.__version__)"

Must print 2.0.0 2.0.0 (the 2.0.0 wheel ships its own matching backend .so and replaces the 2.1.1 binary). Then restart the app.

Verified working after this: Yale integration loads normally (19 devices / 89 entities in our case).

Suggested package fix

Align both halves in the image build. Either:

1. Force cffi==2.0.0 as the final pip step of the Dockerfile (matches HA's own constraint, wheel includes the 2.0.0 backend .so), or
2. Ship cffi 2.1.1 + backend 2.1.1 and override HA's package constraint.

Anything so that in the final image this prints two equal versions:

/app/code/bin/python -c "import cffi, _cffi_backend; print(cffi.__version__, _cffi_backend.__version__)"

Refs

• https://github.com/home-assistant/core/issues/175882
• https://github.com/home-assistant/core/pull/175907