evcc Solar EV Charge Controller

This lab explores smart electric vehicle supply equipment (EVSE) integration and home energy management systems (HEMS) through the configuration and deployment of an automated solar EV charge controller. Students set up and analyze central coordination software running on a host computer or single-board system to dynamically balance electric vehicle charging against real-time solar photovoltaic generation, stationary battery storage levels, and grid import or export constraints. Working with smart-grid and industrial communication protocols including Modbus RTU/TCP, SunSpec, OCPP, EEBus, and MQTT, students interface energy meters, solar inverters, and modular charge controllers. Through live system monitoring and telemetry data collection, learners evaluate IEC 61851-1 signaling, dynamic load balancing, and PV-surplus charging algorithms designed to maximize local renewable energy self-consumption.

electric vehicle supply equipment (EVSE) EV charging solar energy photovoltaic (PV) home energy management system (HEMS) dynamic load management Modbus RTU Modbus TCP Open Charge Point Protocol (OCPP) EEBus MQTT SunSpec IEC 61851-1 smart meters solar inverters smart grid RS-485 telematics

Uploaded by demo on 2026-09-03 · ready · Electronics · Original source ↗

Files: evcc_README.md · go.mod · package.json

Readiness checks

  • complete 2026-09-03 03:06 🛡 Cybersecurity: Review before networking · 5 findings 12 searches · 11 pages
    view · PDF

Latest report — 2026-09-03 03:06

Readiness: evcc Solar EV Charge Controller

Verdict: Ready with caveats · 2026-09-03 · est. parts cost $588–$645 Cybersecurity — software & network: Review before networking

This is the cold check for this lab — there is no previous report, so it establishes the baseline every future check will measure drift against. The lab itself is software: evcc runs on a Raspberry Pi or Linux host and talks to commercial charging hardware, so there is no PCB, no schematic and no component-level BOM to source. What the snapshot does list is three external assemblies, and two of the three cannot be ordered as written. The Phoenix Contact EM-CP-PP-ETH charge controller (2902802) is Obsolete with zero stock at all five authorized distributors checked, and its sibling EV-CC-AC1-M3-CBC-RCM-ETH (1018701) is Obsolete too — Phoenix Contact's whole legacy charge-controller generation is end-of-life. The bare EVSE DIN module has no US retail source. The lab stays implementable because the snapshot allows any IEC 61851-1 DIN-rail controller that evcc supports, and Phoenix Contact's own recommended successor — the CHARX SEC-3000 — is Active, in stock at DigiKey, and listed on evcc's supported-charger page. The caveats are cost (about $220 more than the obsolete part), thin stock (2 units at the only distributor holding any), and a supply voltage that could not be verified from any source reachable this run.

Action required

Part Problem Recommended action
Phoenix Contact 2902802 (EM-CP-PP-ETH) Lifecycle Obsolete. Zero stock at all five authorized distributors checked (DigiKey, RS, Onlinecomponents.com, Master Electronics, TTI); lead times 42 days to 13 weeks. ECIA lifecycle risk High. Substitute the Phoenix Contact CHARX SEC-3000 (order no. 1139022), the manufacturer's own recommended successor — see Substitutes. Confirm its supply voltage against the datasheet first.
EVSE DIN Charge Controller No US retail source. Two Google Shopping searches returned only solar MPPT controllers and complete wallboxes ($1,058.77–$3,971.97), never the bare DIN-rail module. Either import from an EU specialty vendor (EV Racing lists the EVSE DIN RS485, DIN-rail, RS-485 Modbus at 9600 8N1 as the snapshot requires — no price shown on the page), or substitute the CHARX SEC-3000 and drive it over Modbus/TCP instead of RS-485.
Phoenix Contact EV-CC-AC1-M3-CBC-RCM-ETH (1018701) Named in the snapshot as the alternative example for the same BOM line. Also Obsolete, $519.86, no stock; 0 of 3 authorized distributors hold any. Same successor applies. Do not order this as a way around the 2902802 shortage.

Cybersecurity — software & network

Review before networking — The pinned golang.org/x/crypto has advisories with an available upgrade, the lab's copy of the frontend ships no lockfile, and evcc opens eight network ports with the container running as root — all manageable, but they should be settled before the host joins a shared network.

Component Version How known Support status
evcc (application) not determined not determined (No release or version string is pinned in go.mod, package.json, package-lock.json or the Dockerfile fetched this run.) —
Go toolchain 1.27.0 read from project (go directive in fetched/01-go.mod; the build stage of fetched/04-Dockerfile uses golang:1.27.0-alpine.) supported
Node.js runtime 26.0.0 inferred (Lower bound of engines.node ">=26.0.0" in fetched/02-package.json; the project pins no exact runtime, so the minimum it allows was checked.) supported until 2029-04-30
npm package manager not determined unpinned (engines.npm and devEngines.packageManager in fetched/02-package.json give a lower bound ">=10.0.0", not a version.) —
Alpine Linux (container base image) 3.23 read from project (Runtime stage FROM alpine:3.23@sha256:5b10f432... in fetched/04-Dockerfile.) supported until 2027-11-01
golang.org/x/crypto v0.55.0 read from project (Pinned in fetched/01-go.mod.) —
github.com/eclipse/paho.mqtt.golang (MQTT client) v1.5.1 read from project (Pinned in fetched/01-go.mod.) —
github.com/lorenzodonini/ocpp-go (OCPP central system) v0.19.0 read from project (Pinned in fetched/01-go.mod; go.mod redirects it to github.com/evcc-io/ocpp-go via a replace directive.) —
github.com/andig/mbserver (Modbus TCP server) v0.0.0-20230310211055-1d29cbb5820e read from project (Pinned in fetched/01-go.mod.) —
Vue (web UI framework) 3.5.41 read from project (Resolved in fetched/03-package-lock.json; package.json declares the range ^3.5.41.) —
@voidzero-dev/vite-plus-core (frontend build toolchain) 0.2.6 read from project (fetched/02-package.json declares devDependencies.vite and overrides.vite as npm:@voidzero-dev/vite-plus-core@0.2.6; fetched/03-package-lock.json resolves node_modules/vite to the vite-plus-core tarball.) —
Component Finding Severity Fix available?
golang.org/x/crypto v0.55.0 The version of golang.org/x/crypto that evcc pins has two denial-of-service flaws in its SSH sub-package, which would let a peer that can open an SSH connection to the affected code hang it; whether evcc's build actually uses that sub-package was not established here. — GO-2026-6354, GO-2026-6355 moderate Yes — update to 0.56.0
golang.org/x/crypto v0.55.0 (openpgp) The OpenPGP sub-package shipped inside the pinned golang.org/x/crypto is unmaintained and flagged unsafe by design, and no release of the library fixes it. — GO-2026-5932 low Mitigation only — no fixed release exists; nothing in the lab's documented workflow uses OpenPGP, so treat it as a reason to keep the host off open networks rather than a blocker.
evcc container image The runtime stage of evcc's Dockerfile declares no non-root USER, so the published container runs all of those network services as root. posture Mitigation only — run the container as a non-root user, or use the packaged Linux install instead, which creates a dedicated evcc account during installation.
evcc network services evcc's own container image declares eight listening ports on the local network — the web UI and REST API on 7070/tcp, OCPP on 8887/tcp, EEBus on 4712/tcp, Modbus on 8899/udp, and discovery on 5353, 7090, 28376 and 9522/udp — so a host running evcc is reachable on far more than a web page. posture Mitigation only — put the charger host on its own VLAN or lab subnet, expose only 7070/tcp to the classroom, and confirm the arrangement with campus IT before connecting.
Frontend dependencies (package.json) dependencies unpinned: 58 of 60 in package.json — the lab's copy shipped no package-lock.json, so building the web UI from the uploaded materials with npm install resolves those caret ranges to whatever is current instead of to the set checked here. posture Mitigation only — build with the upstream package-lock.json using npm ci rather than npm install, so the versions checked in this report are the versions installed.

What this means for your lab

evcc is a network service, not a desktop program: the host you install it on starts listening on the classroom network as soon as it runs. Its own container image opens the web interface and REST API on port 7070, an OCPP endpoint on 8887 for wallboxes to connect back to, an EEBus port on 4712, Modbus on 8899, and several discovery ports. evcc's install guide has you set an administrator password the first time you open the web interface, and you should make sure that actually happened on every student host — but the password protects the web interface, not the other protocol ports, and the published container runs everything as root. In practice that means someone else on the same network who can reach the machine may be able to talk to the charging and metering interfaces directly, and if a student builds the web UI from the lab's own copy of the materials they will pull whatever dependency versions npm resolves that day rather than the set checked here. Nothing found in this check is being exploited by anyone at a distance today, and the platform pieces (Go 1.27, Node.js 26, Alpine 3.23) are all still supported. The sensible handling is to give the charger host its own VLAN or lab subnet, expose only the web interface to the classroom, set and record the administrator password, build the UI with npm ci against the project's lockfile, and talk to campus IT before putting any of it on the main network.

Not checked

  • vite 0.2.6 (npm alias row in package-lock.json): FALSE POSITIVE, dismissed: this lockfile row is an npm alias. package.json declares vite as npm:@voidzero-dev/vite-plus-core@0.2.6 and the lockfile resolves node_modules/vite to the vite-plus-core tarball, so the 16 advisories OSV returned for the real 'vite' package at 0.2.6 do not apply to anything installed. The package actually installed, @voidzero-dev/vite-plus-core 0.2.6, was checked this run and has no known advisories. It is also a build-time tool that never runs on the charger host.
  • Reachability of the golang.org/x/crypto advisories: The two SSH flaws and the OpenPGP warning are in sub-packages. The lab's Go source files were not fetched, so whether evcc imports golang.org/x/crypto/ssh or /openpgp at all was not determined.
  • evcc application release version: No release or version string is pinned in any file fetched this run, so the application itself has no version to check against an advisory database.
  • npm package manager: engines.npm gives the lower bound ">=10.0.0", not a version, and endoflife.date publishes no npm product, so no support status could be computed.
  • Go tool-block entries (enumer, gok, mockgen, modernize, cmd/implement): The go.mod tool directives carry no version tags, as the snapshot records, so there is no version to look up.
  • Web UI authentication as actually deployed: evcc's own install guide instructs the operator to set an administrator password at first start, but whether any given classroom host has one set cannot be checked from the project files.
  • 320 further dependencies in package-lock.json: beyond the 500-dependency automatic check cap (e.g. ansi-regex, ansi-styles, ansi-styles, argparse, aria-query)

Parts

Hardware Bill of Materials

Part Spec/Package Status Stock Price Source
Phoenix Contact 2902802 (EM-CP-PP-ETH) DIN-rail AC charge controller; 230 V AC supply; IEC 61851-1 CP/PP; Modbus RTU/TCP. Qty 1 Obsolete — discontinued 0 at all 5 distributors checked (13-week factory lead at DigiKey) $342.34 DigiKey (Obsolete); ECIA: RS $411.21, Onlinecomponents.com / Master Electronics $350.78, TTI out of stock
EVSE DIN Charge Controller DIN-rail module; 230 V AC or 12 V DC; IEC 61851-1 CP/PP; RS-485 Modbus. Qty 1 Hard to obtain — no US retail listing — — Product confirmed at EV Racing (CZ); no price in the fetched page. Supported by evcc as "EVSE DIN"
USB to RS-485 / serial adapter External dongle or DIN-rail converter; 5 V USB power; differential A/B. Any FTDI, CH340 or CP2102 part. Qty 1 (optional) Readily available 95 at DigiKey; 125 at RS $28.30 DigiKey, FTDI USB-COM485-PLUS1 (Active). Alternative: USB-RS485-WE-1800-BT $33.70 (Active; 1,008 at Mouser). Retail band $20.39–$35.49

The snapshot names EV-CC-AC1-M3-CBC-RCM-ETH as an alternative for the first line; it resolves to Phoenix Contact 1018701, $519.86 and is also Obsolete with no stock, so it is not a way out.

Substitutes

For part Substitute Differences Verified Judgment
Phoenix Contact 2902802 (EM-CP-PP-ETH) Phoenix Contact CHARX SEC-3000, order no. 1139022 — $560.00, 2 in stock (also $616.40 at RS Supply, "Normally In Stock") Same class and same manufacturer, and DigiKey returns it as the "MFR Recommended" substitute for both obsolete parts. DIN-rail mount: matches. IEC 61851-1: matches. Communication: Modbus/TCP (plus OCPP 1.6J and MQTT) rather than Modbus RTU over RS-485 — the snapshot allows either, but this is an Ethernet device, so the USB-RS485 adapter is not used with it. Supply voltage: unknown, so it may not drop onto the same feed as the 230 V AC original. Cost: +$218 to +$274. Stock: 2 units, every other authorized distributor on 4–5 week lead. Verified: DIN-rail mounting, IEC 61851-1 compliance and Modbus/TCP support against a fetched RS Supply product page; evcc support against evcc's fetched supported-charger list, which carries CHARX under Phoenix Contact; lifecycle, price and stock against DigiKey and ECIA. Not verified: supply voltage / operating rail (DigiKey publishes no parametrics for this part, the manufacturer page returned HTTP 403, and no text could be extracted from the vendor datasheet PDF); terminal layout and pinout; physical width. Acceptable with caveats — right device class, manufacturer's own successor, evcc-supported and in stock, but more expensive, thin stock, and the supply rail is an open question.
EVSE DIN Charge Controller Phoenix Contact CHARX SEC-3000, order no. 1139022 — $560.00 Replaces an RS-485 Modbus RTU device with a Modbus/TCP one, so the wiring exercise changes from a serial fieldbus to Ethernet and the USB-RS485 adapter is no longer needed. Roughly four times the cost of a bare EVSE DIN module. Same DIN-rail form and same IEC 61851-1 role. As above. Not verified: supply voltage. Acceptable with caveats, and the only substitute priced and stocked in the US this run. The snapshot also permits openWB and Bender CC612/CC613, both confirmed on evcc's fetched charger list, but neither was priced or stock-checked here.

An EVSE controller that surfaced in the shopping search — the OpenEVSE v5.5 at $149.00 — is not offered as a substitute: "OpenEVSE" does not appear anywhere on evcc's fetched supported-charger list, so the snapshot's "supported by evcc" condition is unmet on the evidence gathered.

Verify any substitute against its own datasheet before ordering — especially the CHARX SEC-3000's supply voltage, which this check could not confirm.

Other dependencies

  • Upstream GitHub repository — https://github.com/evcc-io/evcc — live. Four project files were fetched from it successfully during this check.
  • Documentation portal — https://docs.evcc.io/en/ — live. Two pages were fetched successfully (the supported-charger index and the EVSE DIN charger page).
  • Service status dashboard — https://status.evcc.io/ — not checked.
  • Package and binary repository — https://cloudsmith.io/~evcc/packages/ — not checked.
  • Translation platform — https://hosted.weblate.org/engage/evcc/ — not checked.
  • Container registry — Docker Hub, evcc/evcc — not checked.
  • Third-party vehicle telematics services — Tesla Fleet API, Nissan Carwings, EcoFlow, Tapo — not checked. These are vendor cloud APIs subject to deprecation and authentication changes; a distributor pass cannot verify them.
  • Push messaging gateways — Telegram Bot API, Pushover, Shoutrrr providers — not checked.
  • Fabrication — not applicable. The snapshot records no PCB, Gerber, drill or board mechanical files.

Watch list

  • Phoenix Contact CHARX SEC-3000 (1139022) stock. DigiKey held 2 units at the time of this check and no other authorized distributor held any. This is the lab's only priced, in-stock controller path, and 2 units is one classroom order away from empty.
  • The CHARX SEC-3000's supply voltage. Still unverified. If it turns out to need a supply the lab's bench cannot provide, the substitution needs rethinking, and that would change the verdict.
  • Phoenix Contact 2902802 and 1018701. Both Obsolete with zero channel stock; expect the remaining broker listings and prices to keep drifting upward. Neither should return.
  • The EVSE DIN module's US availability. Absent from US retail across two searches. If a US distributor picks it up, the cheapest path back to the snapshot's original design reopens.
  • USB-RS485 adapters. No concern — Active, deep stock at several distributors, and the snapshot allows any FTDI, CH340 or CP2102 part. Included only as a baseline for the next check.
Snapshot What the lab depended on when it was uploaded — the baseline the readiness checks research against.

evcc is an extensible open-source Electric Vehicle (EV) Charge Controller and home energy management software application written in Go with a Vue 3 web interface. The system acts as a central coordinator that orchestrates EV charging based on solar photovoltaic (PV) generation, battery storage state, grid import/export tariffs, and vehicle telematics. evcc does not include a proprietary hardware PCB or custom discrete circuitry; instead, it executes on a host operating system or single-board computer (such as a Raspberry Pi, Linux server, or Docker host) and communicates with commercial or DIY charging hardware, energy meters, solar inverters, and home automation switches. Host communication interfaces utilize local IP networks (Ethernet, Wi-Fi), serial fieldbuses (RS-485 Modbus RTU at 9600 to 115200 baud), direct Linux GPIO/I2C buses (3.3 V logic levels typical for single-board computers), and Bluetooth. Mains power electrical constraints (nominal 230 V single-phase or 400 V three-phase AC at 16 A to 32 A, or high-voltage DC PV strings and stationary battery banks) are handled entirely by external commercial hardware (e.g., DIN-rail charge controllers, wallboxes, contactors, and smart meters).

Hardware Bill of Materials

No PCB CAD files, Gerber archives, circuit schematics, or physical electronic component lists are present in the provided workspace. The repository consists purely of application source code, UI assets, and dependency manifests. Discrete electronic components (resistors, capacitors, integrated circuits, connectors, relays) are not present.

The documentation defines support for external commercial modular controller assemblies for user-assembled EVSEs (wallboxes):

  • Phoenix Contact EV Charge Controller (e.g., EM-CP-PP-ETH or EV-CC-AC1-M3 series) / ESL Walli. Quantity: 1. Footprint: DIN-rail mount module. Electrical constraints: 230 V AC operating supply, standard IEC 61851-1 Control Pilot (CP) and Proximity Pilot (PP) signaling (1 kHz PWM, +12 V to -12 V), Modbus RTU (RS-485) or Modbus TCP communication. Substitution latitude: Any IEC 61851-1 compliant DIN-rail controller supported by evcc (e.g., Phoenix Contact, EVSE DIN, openWB, or Bender CC612/CC613). Sourcing plan: distributor lookup (representative example — sources give spec only): Phoenix Contact 2902802 (EM-CP-PP-ETH).
  • EVSE DIN Charge Controller. Quantity: 1. Footprint: DIN-rail module. Electrical constraints: 230 V AC or 12 V DC supply, IEC 61851-1 CP/PP terminal control, RS-485 Modbus interface. Substitution latitude: Interchangeable with other evcc-compatible charge controllers. Sourcing plan: retail shopping search: Simple EVSE DIN charge controller.
  • USB to RS-485 / Serial Interface Adapter. Quantity: 1 (optional, required when connecting Modbus RTU meters or EVSEs via host USB). Footprint: External dongle or DIN-rail converter. Electrical constraints: 5 V USB host power, differential RS-485 A/B lines. Substitution latitude: Any FTDI, CH340, or CP2102-based USB-to-RS485 transceiver. Sourcing plan: retail shopping search: USB to RS485 converter adapter FTDI.

Software and network dependencies

The project is divided into a Go backend service and a Node.js/Vue.js frontend application. Version pinning status: Go dependencies in go.mod are pinned to specific semantic tags, commit hashes, or pseudo-versions, but no go.sum checksum file was included in the workspace; frontend dependencies in package.json use loose caret ranges (^), and no package-lock.json was provided, meaning exact frontend dependency versions are unpinned and will resolve to the latest compatible minor/patch release at install time.

Host Platforms and Runtimes

  • Go Toolchain: Version 1.27.0. Where version came from: pinned in go.mod. Pinning: pinned to specific version. Manifest location: go.mod. Check plan: support-status lookup: Go 1.27.0.
  • Node.js Runtime Engine: Version constraint >=26.0.0. Where version came from: pinned in package.json under engines.node. Pinning: unpinned lower-bound range. Manifest location: package.json. Check plan: support-status lookup: Node.js >=26.0.0.
  • npm Package Manager: Version constraint >=10.0.0. Where version came from: pinned in package.json under engines.npm and devEngines.packageManager. Pinning: unpinned lower-bound range. Manifest location: package.json. Check plan: support-status lookup: npm >=10.0.0.

Go Backend Tooling (go.mod)

  • github.com/dmarkham/enumer: Version not stated in tool directive. Where version came from: pinned in go.mod tool directive without explicit version tag. Check plan: not checkable: version not stated in tool block.
  • github.com/evcc-io/evcc/cmd/implement: Internal project command. Where version came from: pinned in go.mod tool directive. Check plan: not checkable: internal repository tool.
  • github.com/gokrazy/tools/cmd/gok: Version not stated in tool directive. Where version came from: pinned in go.mod tool directive. Check plan: not checkable: version not stated in tool block.
  • go.uber.org/mock/mockgen: Version not stated in tool directive. Where version came from: pinned in go.mod tool directive. Check plan: not checkable: version not stated in tool block.
  • golang.org/x/tools/gopls/internal/analysis/modernize/cmd/modernize: Version not stated in tool directive. Where version came from: pinned in go.mod tool directive. Check plan: not checkable: version not stated in tool block.

Go Backend Direct Dependencies (go.mod)

  • dario.cat/mergo: Version v1.0.2. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: dario.cat/mergo / Go / v1.0.2.
  • github.com/AlecAivazis/survey/v2: Version v2.3.7. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/AlecAivazis/survey/v2 / Go / v2.3.7.
  • github.com/Masterminds/sprig/v3: Version v3.3.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/Masterminds/sprig/v3 / Go / v3.3.0.
  • github.com/PanterSoft/comlynx-go: Version v0.1.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/PanterSoft/comlynx-go / Go / v0.1.0.
  • github.com/PuerkitoBio/goquery: Version v1.13.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/PuerkitoBio/goquery / Go / v1.13.0.
  • github.com/WulfgarW/sensonet: Version v0.0.8. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/WulfgarW/sensonet / Go / v0.0.8.
  • github.com/andig/go-powerwall: Version v0.3.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/andig/go-powerwall / Go / v0.3.0.
  • github.com/andig/gosunspec: Version v0.0.0-20260705113727-6d585e133512. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/andig/gosunspec / Go / v0.0.0-20260705113727-6d585e133512.
  • github.com/andig/mbserver: Version v0.0.0-20230310211055-1d29cbb5820e. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/andig/mbserver / Go / v0.0.0-20230310211055-1d29cbb5820e.
  • github.com/asaskevich/EventBus: Version v0.0.0-20200907212545-49d423059eef. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/asaskevich/EventBus / Go / v0.0.0-20200907212545-49d423059eef.
  • github.com/aws/aws-sdk-go-v2: Version v1.45.1. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/aws/aws-sdk-go-v2 / Go / v1.45.1.
  • github.com/aws/aws-sdk-go-v2/config: Version v1.33.2. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/aws/aws-sdk-go-v2/config / Go / v1.33.2.
  • github.com/aws/aws-sdk-go-v2/credentials: Version v1.20.2. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/aws/aws-sdk-go-v2/credentials / Go / v1.20.2.
  • github.com/aws/aws-sdk-go-v2/service/cognitoidentity: Version v1.40.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/aws/aws-sdk-go-v2/service/cognitoidentity / Go / v1.40.0.
  • github.com/basgys/goxml2json: Version v1.1.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/basgys/goxml2json / Go / v1.1.0.
  • github.com/benbjohnson/clock: Version v1.3.5. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/benbjohnson/clock / Go / v1.3.5.
  • github.com/cenkalti/backoff/v4: Version v4.3.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/cenkalti/backoff/v4 / Go / v4.3.0.
  • github.com/cli/browser: Version v1.3.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/cli/browser / Go / v1.3.0.
  • github.com/cloudfoundry/jibber_jabber: Version v0.0.0-20151120183258-bcc4c8345a21. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/cloudfoundry/jibber_jabber / Go / v0.0.0-20151120183258-bcc4c8345a21.
  • github.com/coder/websocket: Version v1.8.15. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/coder/websocket / Go / v1.8.15.
  • github.com/coreos/go-oidc/v3: Version v3.21.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/coreos/go-oidc/v3 / Go / v3.21.0.
  • github.com/d2r2/go-i2c: Version v0.0.0-20191123181816-73a8a799d6bc. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/d2r2/go-i2c / Go / v0.0.0-20191123181816-73a8a799d6bc.
  • github.com/denisbrodbeck/machineid: Version v1.0.1. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/denisbrodbeck/machineid / Go / v1.0.1.
  • github.com/dylanmei/iso8601: Version v0.1.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/dylanmei/iso8601 / Go / v0.1.0.
  • github.com/eclipse/paho.mqtt.golang: Version v1.5.1. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/eclipse/paho.mqtt.golang / Go / v1.5.1.
  • github.com/enbility/eebus-go: Version v0.7.1-0.20260720111250-363db3c5c262 (Replaced by github.com/andig/eebus-go v0.0.0-20260831161745-7e1f121e46ad). Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/andig/eebus-go / Go / v0.0.0-20260831161745-7e1f121e46ad.
  • github.com/enbility/ship-go: Version v0.6.1-0.20260720110450-0aa90f64ac76 (Replaced by github.com/andig/ship-go v0.6.1-0.20260901124541-3de7acda5f88). Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/andig/ship-go / Go / v0.6.1-0.20260901124541-3de7acda5f88.
  • github.com/enbility/spine-go: Version v0.7.1-0.20260629113257-b3bcc643f323 (Replaced by github.com/andig/spine-go v0.7.1-0.20260831161702-3757d61432fb). Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/andig/spine-go / Go / v0.7.1-0.20260831161702-3757d61432fb.
  • github.com/evcc-io/openapi-mcp: Version v0.6.1-0.20260701153510-26c442199ef4. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/evcc-io/openapi-mcp / Go / v0.6.1-0.20260701153510-26c442199ef4.
  • github.com/evcc-io/optimizer: Version v0.0.0-20260816074151-cab3d297ea7c. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/evcc-io/optimizer / Go / v0.0.0-20260816074151-cab3d297ea7c.
  • github.com/evcc-io/rct: Version v0.2.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/evcc-io/rct / Go / v0.2.0.
  • github.com/evcc-io/tesla-proxy-client: Version v0.0.0-20260722080120-05ada06c7368. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/evcc-io/tesla-proxy-client / Go / v0.0.0-20260722080120-05ada06c7368.
  • github.com/fatih/structs: Version v1.1.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/fatih/structs / Go / v1.1.0.
  • github.com/getkin/kin-openapi: Version v0.149.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/getkin/kin-openapi / Go / v0.149.0.
  • github.com/go-http-utils/etag: Version v0.0.0-20161124023236-513ea8f21eb1. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/go-http-utils/etag / Go / v0.0.0-20161124023236-513ea8f21eb1.
  • github.com/go-playground/validator/v10: Version v10.30.3. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/go-playground/validator/v10 / Go / v10.30.3.
  • github.com/go-telegram/bot: Version v1.25.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/go-telegram/bot / Go / v1.25.0.
  • github.com/go-viper/mapstructure/v2: Version v2.5.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/go-viper/mapstructure/v2 / Go / v2.5.0.
  • github.com/godbus/dbus/v5: Version v5.2.2. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/godbus/dbus/v5 / Go / v5.2.2.
  • github.com/gokrazy/updater: Version v0.0.0-20260620140544-0a84d8ab3878. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/gokrazy/updater / Go / v0.0.0-20260620140544-0a84d8ab3878.
  • github.com/golang-jwt/jwt/v5: Version v5.3.1. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/golang-jwt/jwt/v5 / Go / v5.3.1.
  • github.com/google/go-github/v32: Version v32.1.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/google/go-github/v32 / Go / v32.1.0.
  • github.com/gorilla/handlers: Version v1.5.2. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/gorilla/handlers / Go / v1.5.2.
  • github.com/gorilla/mux: Version v1.8.1. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/gorilla/mux / Go / v1.8.1.
  • github.com/gosimple/slug: Version v1.15.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/gosimple/slug / Go / v1.15.0.
  • github.com/gregdel/pushover: Version v1.4.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/gregdel/pushover / Go / v1.4.0.
  • github.com/grid-x/modbus: Version v0.0.0-20260701064235-82e41c9acfb6 (Replaced by github.com/evcc-io/modbus v0.0.0-20250501165638-8b6f1fbdb7ea). Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/evcc-io/modbus / Go / v0.0.0-20250501165638-8b6f1fbdb7ea.
  • github.com/hashicorp/go-version: Version v1.9.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/hashicorp/go-version / Go / v1.9.0.
  • github.com/hashicorp/yamux: Version v0.1.2. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/hashicorp/yamux / Go / v0.1.2.
  • github.com/hasura/go-graphql-client: Version v0.16.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/hasura/go-graphql-client / Go / v0.16.0.
  • github.com/holoplot/go-evdev: Version v0.0.0-20260504100651-66d1748fe847. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/holoplot/go-evdev / Go / v0.0.0-20260504100651-66d1748fe847.
  • github.com/icholy/digest: Version v1.2.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/icholy/digest / Go / v1.2.0.
  • github.com/influxdata/influxdb-client-go/v2: Version v2.14.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/influxdata/influxdb-client-go/v2 / Go / v2.14.0.
  • github.com/insomniacslk/tapo: Version v1.1.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/insomniacslk/tapo / Go / v1.1.0.
  • github.com/itchyny/gojq: Version v0.12.19. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/itchyny/gojq / Go / v0.12.19.
  • github.com/jarcoal/httpmock: Version v1.4.2. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/jarcoal/httpmock / Go / v1.4.2.
  • github.com/jeremywohl/flatten: Version v1.0.1. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/jeremywohl/flatten / Go / v1.0.1.
  • github.com/jinzhu/now: Version v1.1.5. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/jinzhu/now / Go / v1.1.5.
  • github.com/joeshaw/carwings: Version v0.0.0-20250704173606-1708e349f36c. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/joeshaw/carwings / Go / v0.0.0-20250704173606-1708e349f36c.
  • github.com/joho/godotenv: Version v1.5.1. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/joho/godotenv / Go / v1.5.1.
  • github.com/kballard/go-shellquote: Version v0.0.0-20180428030007-95032a82bc51. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/kballard/go-shellquote / Go / v0.0.0-20180428030007-95032a82bc51.
  • github.com/koron/go-ssdp: Version v0.9.1. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/koron/go-ssdp / Go / v0.9.1.
  • github.com/korylprince/ipnetgen: Version v1.0.1. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/korylprince/ipnetgen / Go / v1.0.1.
  • github.com/libp2p/zeroconf/v2: Version v2.2.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/libp2p/zeroconf/v2 / Go / v2.2.0.
  • github.com/libtnb/sqlite: Version v1.2.2. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/libtnb/sqlite / Go / v1.2.2.
  • github.com/lorenzodonini/ocpp-go: Version v0.19.0 (Replaced by github.com/evcc-io/ocpp-go v0.0.0-20260812074841-a8aa5fef8a9e). Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/evcc-io/ocpp-go / Go / v0.0.0-20260812074841-a8aa5fef8a9e.
  • github.com/lunixbochs/struc: Version v0.0.0-20241101090106-8d528fa2c543. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/lunixbochs/struc / Go / v0.0.0-20241101090106-8d528fa2c543.
  • github.com/mabunixda/wattpilot: Version v1.8.5. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/mabunixda/wattpilot / Go / v1.8.5.
  • github.com/mitchellh/go-homedir: Version v1.1.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/mitchellh/go-homedir / Go / v1.1.0.
  • github.com/modelcontextprotocol/go-sdk: Version v1.7.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/modelcontextprotocol/go-sdk / Go / v1.7.0.
  • github.com/muka/go-bluetooth: Version v0.0.0-20240701044517-04c4f09c514e. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/muka/go-bluetooth / Go / v0.0.0-20240701044517-04c4f09c514e.
  • github.com/nicholas-fedor/shoutrrr: Version v0.19.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/nicholas-fedor/shoutrrr / Go / v0.19.0.
  • github.com/nicksnyder/go-i18n/v2: Version v2.6.1. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/nicksnyder/go-i18n/v2 / Go / v2.6.1.
  • github.com/olekukonko/tablewriter: Version v1.1.4. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/olekukonko/tablewriter / Go / v1.1.4.
  • github.com/philippseith/signalr: Version v0.11.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/philippseith/signalr / Go / v0.11.0.
  • github.com/prometheus-community/pro-bing: Version v0.9.1. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/prometheus-community/pro-bing / Go / v0.9.1.
  • github.com/prometheus/client_golang: Version v1.24.1. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/prometheus/client_golang / Go / v1.24.1.
  • github.com/prometheus/common: Version v0.71.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/prometheus/common / Go / v0.71.0.
  • github.com/robertkrimen/otto: Version v0.5.1. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/robertkrimen/otto / Go / v0.5.1.
  • github.com/samber/lo: Version v1.53.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/samber/lo / Go / v1.53.0.
  • github.com/sandrolain/httpcache: Version v1.4.2. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/sandrolain/httpcache / Go / v1.4.2.
  • github.com/sethvargo/go-password: Version v0.4.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/sethvargo/go-password / Go / v0.4.0.
  • github.com/sirupsen/logrus: Version v1.10.2. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/sirupsen/logrus / Go / v1.10.2.
  • github.com/skratchdot/open-golang: Version v0.0.0-20200116055534-eef842397966. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/skratchdot/open-golang / Go / v0.0.0-20200116055534-eef842397966.
  • github.com/smallnest/chanx: Version v1.2.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/smallnest/chanx / Go / v1.2.0.
  • github.com/spali/go-rscp: Version v0.2.2. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/spali/go-rscp / Go / v0.2.2.
  • github.com/spf13/cast: Version v1.10.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/spf13/cast / Go / v1.10.0.
  • github.com/spf13/cobra: Version v1.10.2. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/spf13/cobra / Go / v1.10.2.
  • github.com/spf13/jwalterweatherman: Version v1.1.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/spf13/jwalterweatherman / Go / v1.1.0.
  • github.com/spf13/viper: Version v1.21.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/spf13/viper / Go / v1.21.0.
  • github.com/stretchr/testify: Version v1.12.1. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/stretchr/testify / Go / v1.12.1.
  • github.com/teslamotors/vehicle-command: Version v0.4.1. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/teslamotors/vehicle-command / Go / v0.4.1.
  • github.com/tess1o/go-ecoflow: Version v1.1.1-0.20251003083510-2ccc15a17e29. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/tess1o/go-ecoflow / Go / v1.1.1-0.20251003083510-2ccc15a17e29.
  • github.com/traefik/yaegi: Version v0.16.1. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/traefik/yaegi / Go / v0.16.1.
  • github.com/volkszaehler/mbmd: Version v0.0.0-20260824053034-eef6045ae30e. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/volkszaehler/mbmd / Go / v0.0.0-20260824053034-eef6045ae30e.
  • github.com/warthog618/go-gpiocdev: Version v0.9.1. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/warthog618/go-gpiocdev / Go / v0.9.1.
  • github.com/xuri/excelize/v2: Version v2.11.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: github.com/xuri/excelize/v2 / Go / v2.11.0.
  • gitlab.com/bboehmke/sunny: Version v0.17.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: gitlab.com/bboehmke/sunny / Go / v0.17.0.
  • go.bug.st/serial: Version v1.8.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: go.bug.st/serial / Go / v1.8.0.
  • go.uber.org/mock: Version v0.6.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: go.uber.org/mock / Go / v0.6.0.
  • go.yaml.in/yaml/v4: Version v4.0.0-rc.6. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: go.yaml.in/yaml/v4 / Go / v4.0.0-rc.6.
  • golang.org/x/crypto: Version v0.55.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: golang.org/x/crypto / Go / v0.55.0.
  • golang.org/x/crypto/x509roots/fallback: Version v0.0.0-20260902180247-86efde54dc70. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: golang.org/x/crypto/x509roots/fallback / Go / v0.0.0-20260902180247-86efde54dc70.
  • golang.org/x/exp: Version v0.0.0-20260824195058-e88cd73687aa. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: golang.org/x/exp / Go / v0.0.0-20260824195058-e88cd73687aa.
  • golang.org/x/net: Version v0.58.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: golang.org/x/net / Go / v0.58.0.
  • golang.org/x/oauth2: Version v0.36.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: golang.org/x/oauth2 / Go / v0.36.0.
  • golang.org/x/sync: Version v0.22.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: golang.org/x/sync / Go / v0.22.0.
  • golang.org/x/text: Version v0.41.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: golang.org/x/text / Go / v0.41.0.
  • golang.org/x/tools: Version v0.49.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: golang.org/x/tools / Go / v0.49.0.
  • google.golang.org/grpc: Version v1.83.2. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: google.golang.org/grpc / Go / v1.83.2.
  • google.golang.org/protobuf: Version v1.36.12. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: google.golang.org/protobuf / Go / v1.36.12.
  • gorm.io/gorm: Version v1.31.2. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: gorm.io/gorm / Go / v1.31.2.
  • modernc.org/sqlite: Version v1.58.0. Where version came from: pinned in go.mod. Check plan: vulnerability lookup: modernc.org/sqlite / Go / v1.58.0.

Frontend Runtime Dependencies (package.json)

  • @codemirror/commands: Version constraint ^6.11.0. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: @codemirror/commands / npm / ^6.11.0.
  • @codemirror/lang-yaml: Version constraint ^6.1.3. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: @codemirror/lang-yaml / npm / ^6.1.3.
  • @codemirror/language: Version constraint ^6.12.4. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: @codemirror/language / npm / ^6.12.4.
  • @codemirror/state: Version constraint ^6.7.1. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: @codemirror/state / npm / ^6.7.1.
  • @codemirror/view: Version constraint ^6.43.9. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: @codemirror/view / npm / ^6.43.9.
  • @formkit/drag-and-drop: Version constraint ^0.6.1. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: @formkit/drag-and-drop / npm / ^0.6.1.
  • @h2d2/shopicons: Version constraint ^1.9.1. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: @h2d2/shopicons / npm / ^1.9.1.
  • @lezer/highlight: Version constraint ^1.2.3. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: @lezer/highlight / npm / ^1.2.3.
  • @popperjs/core: Version constraint ^2.11.8. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: @popperjs/core / npm / ^2.11.8.
  • @unhead/vue: Version constraint ^2.1.17. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: @unhead/vue / npm / ^2.1.17.
  • axios: Version constraint ^1.19.0. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: axios / npm / ^1.19.0.
  • bootstrap: Version constraint ^5.3.8. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: bootstrap / npm / ^5.3.8.
  • canvas-confetti: Version constraint ^1.9.4. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: canvas-confetti / npm / ^1.9.4.
  • countup.js: Version constraint ^2.10.1. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: countup.js / npm / ^2.10.1.
  • dayjs: Version constraint ^1.11.23. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: dayjs / npm / ^1.11.23.
  • echarts: Version constraint ^6.1.0. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: echarts / npm / ^6.1.0.
  • qrcode: Version constraint ^1.5.4. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: qrcode / npm / ^1.5.4.
  • smoothscroll-polyfill: Version constraint ^0.4.4. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: smoothscroll-polyfill / npm / ^0.4.4.
  • snarkdown: Version constraint ^2.0.0. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: snarkdown / npm / ^2.0.0.
  • vue: Version constraint ^3.5.41. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: vue / npm / ^3.5.41.
  • vue-i18n: Version constraint ^11.4.9. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: vue-i18n / npm / ^11.4.9.
  • vue-router: Version constraint ^5.2.0. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: vue-router / npm / ^5.2.0.

Frontend Development & Build Dependencies (package.json)

  • @playwright/test: Version constraint ^1.62.1. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: @playwright/test / npm / ^1.62.1.
  • @redocly/openapi-core: Version constraint ^2.47.0. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: @redocly/openapi-core / npm / ^2.47.0.
  • @storybook/vue3: Version constraint ^10.4.4. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: @storybook/vue3 / npm / ^10.4.4.
  • @storybook/vue3-vite: Version constraint ^10.5.10. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: @storybook/vue3-vite / npm / ^10.5.10.
  • @types/body-parser: Version constraint ^1.19.6. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: @types/body-parser / npm / ^1.19.6.
  • @types/bootstrap: Version constraint ^5.2.11. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: @types/bootstrap / npm / ^5.2.11.
  • @types/canvas-confetti: Version constraint ^1.9.0. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: @types/canvas-confetti / npm / ^1.9.0.
  • @types/kill-port: Version constraint ^2.0.3. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: @types/kill-port / npm / ^2.0.3.
  • @types/qrcode: Version constraint ^1.5.6. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: @types/qrcode / npm / ^1.5.6.
  • @types/smoothscroll-polyfill: Version constraint ^0.3.4. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: @types/smoothscroll-polyfill / npm / ^0.3.4.
  • @types/wait-on: Version constraint ^5.3.4. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: @types/wait-on / npm / ^5.3.4.
  • @types/ws: Version constraint ^8.18.1. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: @types/ws / npm / ^8.18.1.
  • @vitejs/plugin-legacy: Version constraint ^8.2.3. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: @vitejs/plugin-legacy / npm / ^8.2.3.
  • @vitejs/plugin-vue: Version constraint ^6.0.8. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: @vitejs/plugin-vue / npm / ^6.0.8.
  • @vue/compiler-sfc: Version constraint ^3.5.38. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: @vue/compiler-sfc / npm / ^3.5.38.
  • @vue/test-utils: Version constraint ^2.4.11. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: @vue/test-utils / npm / ^2.4.11.
  • @vue/tsconfig: Version constraint ^0.9.1. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: @vue/tsconfig / npm / ^0.9.1.
  • ajv: Version constraint ^8.20.0. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: ajv / npm / ^8.20.0.
  • ajv-formats: Version constraint ^3.0.1. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: ajv-formats / npm / ^3.0.1.
  • body-parser: Version constraint ^2.3.0. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: body-parser / npm / ^2.3.0.
  • cross-env: Version constraint ^10.1.0. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: cross-env / npm / ^10.1.0.
  • happy-dom: Version constraint ^20.11.6. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: happy-dom / npm / ^20.11.6.
  • kill-port: Version constraint ^2.0.1. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: kill-port / npm / ^2.0.1.
  • license-compliance: Version constraint ^4.0.0. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: license-compliance / npm / ^4.0.0.
  • mqtt: Version constraint ^5.15.2. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: mqtt / npm / ^5.15.2.
  • rollup-plugin-visualizer: Version constraint ^7.1.1. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: rollup-plugin-visualizer / npm / ^7.1.1.
  • storybook: Version constraint ^10.5.10. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: storybook / npm / ^10.5.10.
  • terser: Version constraint ^5.50.0. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: terser / npm / ^5.50.0.
  • ts-json-schema-generator: Version constraint ^2.9.0. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: ts-json-schema-generator / npm / ^2.9.0.
  • tsx: Version constraint ^4.23.12. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: tsx / npm / ^4.23.12.
  • typescript: Version constraint ^5.9.3. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: typescript / npm / ^5.9.3.
  • vite: Overridden and pinned as npm:@voidzero-dev/vite-plus-core@0.2.6. Where version came from: pinned in package.json under overrides.vite and devDependencies.vite. Pinning: pinned to exact registry alias. Check plan: vulnerability lookup: @voidzero-dev/vite-plus-core / npm / 0.2.6.
  • vite-plus: Version 0.2.6. Where version came from: pinned in package.json under devDependencies.vite-plus. Pinning: pinned to exact version. Check plan: vulnerability lookup: vite-plus / npm / 0.2.6.
  • vitest: Overridden and pinned as 4.1.10. Where version came from: pinned in package.json under overrides.vitest and devDependencies.vitest. Pinning: pinned to exact version. Check plan: vulnerability lookup: vitest / npm / 4.1.10.
  • vue-hot-reload-api: Version constraint ^2.3.4. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: vue-hot-reload-api / npm / ^2.3.4.
  • vue-tsc: Version constraint ^3.3.11. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: vue-tsc / npm / ^3.3.11.
  • wait-on: Version constraint ^9.1.0. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: wait-on / npm / ^9.1.0.
  • ws: Version constraint ^8.21.3. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: ws / npm / ^8.21.3.
  • yaml: Version constraint ^2.9.0. Where version came from: pinned in package.json. Pinning: unpinned minor/patch range. Check plan: vulnerability lookup: yaml / npm / ^2.9.0.

Network Exposure and Operational Services

  • Network Connection: The host machine joins local area networks via standard Ethernet or Wi-Fi interfaces.
  • Web Application & User Interface: Exposed over HTTP. The development Storybook environment listens explicitly on TCP port 6006 (package.json: storybook dev -p 6006). Standard production evcc web UI and REST API default listening port is not explicitly assigned in the manifests (typically port 7070 in default documentation).
  • REST API: Exposed over HTTP alongside the main web UI for home automation integrations (Home Assistant, openHAB).
  • MQTT API: evcc acts as an MQTT client connecting to an external MQTT broker or exposes topics for state publishing and remote control (eclipse/paho.mqtt.golang).
  • OCPP Protocol: evcc acts as an OCPP 1.6J/2.0.1 Central System / CSMS receiving WebSocket connections from compliant wallboxes (lorenzodonini/ocpp-go, coder/websocket).
  • EEBus Protocol (SHIP / SPINE): Discovers and pairs with EEBus-compliant EVSEs (e.g., Porsche Mobile Charger Connect, Elli) and inverters using mDNS/Zeroconf and secure WebSockets (enbility/eebus-go, enbility/ship-go, enbility/spine-go).
  • Modbus Server & Client: Listens for incoming Modbus TCP connections (andig/mbserver) and polls external Modbus TCP/RTU devices (grid-x/modbus).
  • SSDP & mDNS Service Discovery: Broadcasts discovery announcements and listens on local multicast groups (koron/go-ssdp, libp2p/zeroconf/v2).
  • Prometheus Metrics Exporter: Exposes Prometheus-compatible operational metrics over HTTP (prometheus/client_golang).
  • Default Credentials: Not stated in the sources. The software uses a sponsorship token mechanism for commercial integration features as described in the documentation (evcc_README.md).
  • Remote Access Instructions: Documentation does not instruct enabling SSH; administrative control and vehicle/charger setup are handled via the web browser interface.

Temporal downloads and external services

The software relies on several external repositories, registries, and cloud APIs:

Fabrication

No printed circuit board design files, Gerber files, drill files, or board mechanical layouts exist in this repository. Physical fabrication parameters (layer count, PCB thickness, copper weight, physical dimensions) are not applicable.