Hubitat 2.5.2: Z-Wave JS Comes to Older Hubs, and Matter Gets Firmware Updates

Hubitat's 2.5.2 release is the biggest change to its Z-Wave side in a long time. C-5, C-7 and C-8 hubs can now switch their Z-Wave stack to Z-Wave JS, which until this release was a C-8 Pro thing. It's the same open-source Z-Wave stack Home Assistant's Z-Wave integration runs on. There's a solid batch of Matter changes too. The release thread started September 29 with 2.5.2.126 and had reached 2.5.2.139 by October 16. If you're planning to switch, which build you're on matters, so here's what I found and the order I'd do it in.

What switching to Z-Wave JS gets you

Hubitat's announcement puts the switch at Settings > Z-Wave Details > Switch to ZWave-JS. The hub installs the right runtime for its hardware and migrates your network configuration and security keys. Devices "should not need to be excluded and re-included." That's the line that makes this worth doing at all.

What you get depends on the hub:

C-5. The biggest jump. It has an older 500-series radio, but after switching it gains SmartStart, S2 security, better inclusion and interviews, and better diagnostics, while keeping your S0 devices. The existing S0 key is preserved and S2 keys are generated during migration.
C-7 and C-8. These move off ZIP Gateway onto the same Z-Wave JS foundation as the C-8 Pro: better startup recovery, interviews, SmartStart management, diagnostics, firmware updates, and the new local Z-Wave backup, restore and import tools.

Hubitat warns that older hubs have slower processors, so first startup and node loading take longer.

The release bumps Z-Wave JS to 15.29.0 (from 15.26.0) and Z-Wave JS Server to 3.10.1. It adds newer command classes: UserCode v2, UserCredential v1/v2, FirmwareUpdateMD v7/v8, Indicator v4, Association v4 and Multi Channel Association v5. There's a new Generic Z-Wave Lock DT driver built on UserCode v2 and UserCredential, so lock owners have the most to gain here, and also the most to check.

The tooling is the part I'd actually use:

A batch Z-Wave firmware updater for Z-Wave JS, with device search and better messaging for sleepy devices.
Local Z-Wave backup, restore and import. Backups now validate critical keys before they're marked good.
A guided SmartStart flow in the web UI that uses location to put the device in a room.
A Z-Wave Details CSV export.

One catch: Z-Wave firmware updates are blocked over Remote Admin "due to timeouts." Do them from your own network.

The Matter changes

Four items in the notes stood out to me:

Matter firmware updates. All built-in Matter drivers except bridge devices get an updateFirmware command. Hubitat's note is refreshingly honest: this "obviously" presumes the manufacturer has any updates available. The hub can deliver them now. Whether there's anything to deliver is up to each brand.
Attestation against the CSA's online DCL. Matter devices prove they're genuine during setup, and Hubitat now checks them against the Connectivity Standards Alliance's online database. The notes say this should fix devices that failed commissioning at the attestation step. If you've had a Matter device that just wouldn't pair to Hubitat, this is the one to retry after updating.
Hubitat now has a CSA vendor ID and fabric alias. Other Matter controllers will show "Hubitat, Inc" plus your hub's name in connected services. That only applies to newly added devices.
BLE commissioning fixes, filed under "various fixes for matter certification."

The DCL change is the sleeper. "Why won't this pair" problems eat whole evenings.

The builds after .126 matter

2.5.2 didn't ship once. Hubitat kept pushing builds, and two of the fixes change my advice:

2.5.2.134 (October 8): "Fix for ZWave-JS migration interview causing some locks to lose user codes." It also switches a hub to Z-Wave JS automatically if it has no Z-Wave devices, and adds code update functionality to Hubitat's built-in AI (MCP) connector.
2.5.2.135 (October 9): repeated actions in Visual Rule Builder 2.
2.5.2.139 (October 16): "Fixed backup failures being reported as successful or downloaded as backup files." Sleeping Z-Wave JS devices with no messages for 48 hours now show as Not Responding. Also a likely fix for Zigbee send-queue stalls, plus Z-Wave JS fixes for Alfred locks, the Aeotec Smart Switch 6 and the Zooz RGBW Dimmer, and the missing logs button on a C-5 running Z-Wave JS.

Read those two together. One bug cost some locks their user codes during migration. Another meant a failed backup could look like a good one. Per the notes, both are fixed by .139. But they're exactly the things you'd lean on during a migration, so don't migrate on an older build.

What users are seeing

A forum thread from October 10 is a useful reality check. A C-8 owner with about 70 devices ran the migration overnight. By morning most mains devices and a few battery devices had interviewed. A Refresh fixed the remaining mains devices, and waking the battery devices got most of those going. A few battery devices got stuck "almost" finishing, and a couple of nameless nodes showed up that the owner suspects were old failed devices force-removed under the old stack. One of those finally removed after the owner just waited. Another user on a C-8 Pro said two old Fibaro Flood Sensors stayed stuck, so after two days they removed and re-included them.

Two people isn't a survey. But it matches what Hubitat itself says: slower loading on older hubs, battery devices that need a nudge.

The rest of 2.5.2

Full local backup support.
A new Sonos Integrator; the old Sonos integration is deprecated.
A Reolink integration.
Lutron LEAP adds RadioRA 3, keypads, fans and shades.
Maker API gets curl and bearer-token examples, and "Same bearer token authentication is available to all apps." It also gets Zigbee quality reporting.
Hub mode support in the Alexa skill.
New device support including the Zooz ZSE43 800LR Tilt Shock XS Sensor.
2.5.2.129 redesigned the Logs page with a Cloud calls tab to track cloud usage. On a hub sold on local control, being able to see what leaves the house is a nice touch.

If you use the community Hubitat local MCP server to connect an AI client, note that its 4.8.0 release (October 17) added per-client access tokens, and those require firmware 2.5.2 or later. Each client gets its own token with its own tool list and read/write access, which is how I'd want any AI agent near a lock scoped anyway.

The order I'd do it in

Update to 2.5.2.139 or newer first. That gets you the lock-code fix and the honest backup reporting.
Write down your lock user codes. The bug is fixed, but a list on paper is cheap insurance.
Make a fresh backup after updating, and download it. Don't count on one made before .139.
Migrate from your own network at a quiet hour. It takes a while on a C-5 or C-7, and your Z-Wave devices will be in flux.
Refresh mains devices, then wake battery devices. Give stragglers a day before you remove and re-include anything.
Watch the Not Responding flag on sleepy devices over the next couple of days.
For Matter devices, try updateFirmware. If nothing comes down, the maker hasn't published an update. That's a question for them, not Hubitat.

If you've been on the fence about Hubitat versus a Home Assistant box with a Z-Wave stick, this narrows the gap on the radio side. Both now run on Z-Wave JS. The difference is how much of the rest you want to manage yourself.