Prepare release 2.5.0

[wimaha]

Prepares release 2.5.0, following "Releasing" in CHANGELOG.md.

What

• CHANGELOG: ## Unreleased becomes ## 2.5.0 - 2026-10-19, with a new, empty ## Unreleased above it. Missing PR references (Serialize BLE access, stop replaced command loops, release the adapter when idle #174, Publish a Docker test image :pr-<number> for each pull request #175, Show vehicle status on the dashboard (#168) #176, Update to Go 1.27 and refresh dependencies #178) are added to the entries.
• README and docs: every *(unreleased)* marker becomes *(since 2.5.0)*.
• README note at the top points to the README of 2.5.0.

scripts/check-release-docs.sh 2.5.0 passes, and so does go test ./....

After merging

1. Tag the merge commit on main as 2.5.0 (no v, like 2.4.0) and push the tag. Until then, the link in the README note points to a tag that does not exist yet.
2. The release workflow checks the docs, then publishes :2.5.0 and :latest.
3. GitHub release notes: copy the 2.5.0 section of the CHANGELOG.

Highlights of 2.5.0

• Upgrade notes: normal evcc/HA setups need no changes. A dashboard behind a plain-HTTP reverse proxy needs trustedOrigins. /gen_keys and /remove_keys are POST only. Failed requests always return result: false.
• Security: cross-site browser requests are rejected (403). New trustedOrigins for reverse proxies over plain HTTP.
• Dashboard: vehicle status with data timestamps. Refresh without waking, or Wake & refresh (Feature Request: Enhanced Web Dashboard with Live Vehicle Status #168).
• Bluetooth: one connection at a time. releaseAdapterWhenIdle shares the adapter with other BlueZ services (allow sharing bluetooth by either remove HCIDEVDOWN ioctl or (better) switch to a BlueZ D-Bus based Go library (e.g., muka/go-bluetooth) #158, thanks @AloisKlingler). connectionTimeout is configurable.
• Go 1.27. Test images :pr-<number> for pull requests.

🤖 Generated with Claude Code

[github-actions]

🟡 Merge after the to-dos

This PR only changes docs (CHANGELOG, README, env var docs). No code changes. The risk is in what gets released: 2.5.0 has breaking changes and will become :latest.

Impact on existing users: Users who pull :latest get the breaking changes at once: GET /gen_keys and /remove_keys return 405, failed requests now return result: false (503) where some said true, and cross-site browser requests get 403 (a reverse proxy over plain HTTP may need trustedOrigins).

To-do for the author

• Confirm you are happy to ship these breaking changes in a minor version (2.5.0) to everyone on :latest. Put the "Breaking" section first in the GitHub release notes.
• Tag 2.5.0 right after merging. Until then the README link points to a missing tag.

Test before merging: On a real setup, check that evcc vehicle_data and a command still work on the :dev/:pr-179 image, and that the dashboard works behind your reverse proxy.

Technical details

• CHANGELOG.md: the breaking items (Harden HTTP endpoints against cross-site requests and XSS #170, Serialize BLE access, stop replaced command loops, release the adapter when idle #174) are documented correctly. PR references added look consistent.
• README.md:3: the note still says sections marked (unreleased) exist, but none are left. Optional wording cleanup.
• Not verified: I did not run scripts/check-release-docs.sh or the tests. I only read the diff, which has no code changes.

[wimaha]

Bewusst 2.5.0: alle Änderungen betreffen nur fehlerhafte Requests, undokumentierte Endpunkte oder Browser von fremden Origins; Integrationen wie evcc/HA sind nicht betroffen.

[wimaha]

Shipping this as 2.5.0 on purpose. None of the changes touch the routes or JSON that integrations use. Normal evcc or Home Assistant setups need no changes:

• POST-only key routes: they were never documented and are only called by the dashboard forms, which ship in the same release and already send POST.
• result: false for failed requests: this fixes false success replies (for example set_charging_amps without a body). Valid requests behave as before.
• 403 for cross-site browser requests: evcc, HA and curl send no Origin/Sec-Fetch-Site. The only realistic case is a dashboard behind a plain-HTTP reverse proxy, and trustedOrigins covers it.

The CHANGELOG section is now called "Upgrade notes", says this up front and lists the reverse-proxy case first (1d1aafd).

🤖 Addressed by Claude Code