Zigbee2MQTT Home Automation Bridge

In this lab, students construct and configure an open-source smart home automation gateway that bridges IEEE 802.15.4 Zigbee wireless mesh networks with IP-based networks using MQTT. Working with a host computer, a Zigbee radio coordinator adapter, and wireless peripheral sensors and actuators, students set up an MQTT broker and the Zigbee2MQTT service to communicate with peripheral devices without proprietary cloud dependencies. They commission wireless nodes into a personal area network, observe real-time device telemetry and state changes over MQTT topics, and test bidirectional device actuation. Through this practical implementation, students master core Internet of Things concepts including publish-subscribe message routing, Zigbee cluster translation, 2.4 GHz RF coexistence and noise mitigation, and network security mechanisms such as 128-bit AES encryption and install-code pairing.

Internet of Things IoT Zigbee IEEE 802.15.4 MQTT Zigbee2MQTT home automation smart home wireless sensor networks WSN IoT gateway publish-subscribe architecture Mosquitto embedded systems network security serial communication RF communication

Uploaded by demo on 2026-09-03 · ready · Electronics · Original source ↗

Files: README.md · docs_adapters.md · docs_getting_started.md · docs_securing.md · package.json

Readiness checks

  • complete 2026-09-03 18:30 🛡 Cybersecurity: Review before networking · 5 findings 8 searches · 3 pages
    view · PDF

Latest report — 2026-09-03 18:30

Readiness: Zigbee2MQTT Home Automation Bridge

Verdict: Ready with caveats · 2026-09-03 · est. parts cost $67–$275 per station Cybersecurity — software & network: Review before networking

Every line of this lab's bill of materials is buyable today and nothing is obsolete, discontinued or single-sourced. A host computer starts at $35.00, a Zigbee coordinator from one of the two chip families the lab requires costs $19.04–$24.90 from the manufacturer's own store, a USB extension cable costs $2.19, and a Zigbee end device costs $10.90 — roughly $67 to $275 for one complete station depending on how the host is specified. Two caveats keep this off a clean "Ready". First, the coordinator product line has moved on a chip generation since this lab was written (a SONOFF "Dongle Plus MG24" now appears at retail), and although the Zigbee2MQTT supported-adapters page was fetched this run, its per-model tables render client-side and were not in the retrieved text — so which specific dongle models sit under "Recommended" today could not be confirmed from evidence, and the model must be checked against that page before an order goes in. Second, the Raspberry Pi listings are not like-for-like: the cheapest does not state its RAM size, and two of the priced entries are a desktop kit and a Compute Module rather than a plain Model B board. This is the cold check for this lab — there is no previous report, so these prices and availability establish the baseline for the next drift comparison.

Action required

Part Problem Recommended action
Zigbee Coordinator Radio Adapter Model-level compatibility could not be confirmed this run — the supported-adapters page's model tables did not render in the fetched text, and SONOFF now also sells a newer MG24-based Dongle Plus Before ordering, check the exact model against the Recommended list at zigbee2mqtt.io/guide/adapters. Both families the lab names (TI CC2652P, Silicon Labs EFR32MG21) are on sale at $19–$25
Host Computing Platform (Raspberry Pi 4 Model B 4GB) Listings are not like-for-like: the $35.00 offer does not state 4 GB, the $165.00 offer is a desktop kit, and the $144.00 offer is a Compute Module 4 with no USB-A host ports Read the listing rather than sorting by price. Substitution latitude is broad — any machine running Node.js 22+ with a USB host port or Ethernet satisfies the lab
CP2102N-A02-GQFN28 (USB-to-UART bridge) The exact cut-tape part shows no DigiKey stock and a 31-week factory lead time No action for this lab — the IC ships pre-soldered on the coordinator dongle. For a self-built adapter, Arrow holds 197 pcs at $1.989 and Mouser 58 pcs at $5.68, or use the tape-and-reel CP2102N-A02-GQFN28R (9,173 in stock, $5.36)

Cybersecurity — software & network

Review before networking — Every one of the 302 dependencies pinned by the project's lockfile checked clean, but the bridge ships an unauthenticated web frontend bound to all interfaces plus a plaintext MQTT link, and the pinned package manager carries high-severity install-time advisories.

Component Version How known Support status
zigbee2mqtt 2.14.0 read from project (version field of the fetched package.json (fetched/01-package.json, tag 2.14.0)) —
zigbee-herdsman 10.9.1 read from project (exact pin in package.json dependencies, resolved in pnpm-lock.yaml) —
zigbee-herdsman-converters 26.103.0 read from project (exact pin in package.json dependencies, resolved in pnpm-lock.yaml) —
zigbee2mqtt-frontend 0.9.21 read from project (exact pin in package.json dependencies, resolved in pnpm-lock.yaml) —
zigbee2mqtt-windfront 2.15.0 read from project (exact pin in package.json dependencies, resolved in pnpm-lock.yaml) —
Node.js runtime 22 inferred (inferred from the engines range "^22.2.0 || ^24 || <=26.2" in the fetched package.json; the project pins no single Node version, 22 is the lowest accepted line) supported until 2027-04-30
pnpm (package manager) 10.18.3 read from project (packageManager field of the fetched package.json (pnpm@10.18.3)) —
mqtt (MQTT client library) 5.15.2 read from project (resolved version in the fetched pnpm-lock.yaml (package.json declares ^5.15.2)) —
ws (WebSocket server library) 8.21.3 read from project (resolved version in the fetched pnpm-lock.yaml (package.json declares ^8.21.3)) —
ajv (config schema validation) 8.20.0 read from project (resolved version in the fetched pnpm-lock.yaml (package.json declares ^8.20.0)) —
js-yaml (configuration.yaml parser) 5.4.1 read from project (resolved version in the fetched pnpm-lock.yaml (package.json declares ^5.4.1)) —
@serialport/bindings-cpp (coordinator serial access) 13.0.1 read from project (resolved transitively and pinned in the fetched pnpm-lock.yaml; the snapshot recorded it as unpinned in the root manifest) —
esbuild (build toolchain) 0.28.2 read from project (resolved transitively and pinned in the fetched pnpm-lock.yaml; the snapshot recorded it as unpinned in the root manifest) —
Eclipse Mosquitto (MQTT broker) not determined not determined (recommended by the lab documentation; no version stated anywhere in the materials) —
Host operating system (Linux / Windows / macOS) not determined not determined (the lab lets the instructor choose the host OS and states no distribution or version) —
Coordinator firmware (TI Z-Stack or Silicon Labs EmberZNet NCP) not determined not determined (vendor firmware flashed to the dongle; the lab documentation states no version) —
Koenkk/zigbee-OTA device firmware mirror not determined unpinned (a continuously updated Git mirror the bridge pulls device firmware from; no release is pinned) —
Component Finding Severity Fix available?
pnpm (package manager) The package manager the project pins, pnpm 10.18.3, matched 26 advisories including six rated high, in which a tampered or hostile dependency can write files outside node_modules or run its own install scripts while the bridge is being built; the risk is on the machine doing the install, not on the running Zigbee network — GHSA-hwx4-2j3j-g496, GHSA-w466-c33r-3gjp, GHSA-379q-355j-w6rj, GHSA-qrv3-253h-g69c (+2 more) high Yes — update to 10.34.5 or newer in the 10.x line (change the packageManager field in package.json before installing)
Inter-PAN (Touchlink) commissioning Touchlink factory reset and pairing use unsecured single-hop radio messages, so someone within range can reset or re-pair the lab's end devices without any credential posture Mitigation only — treat Touchlink as unauthenticated: run pairing exercises away from other Zigbee networks and re-pair devices that reset unexpectedly
MQTT broker connection The bridge's MQTT link defaults to unencrypted TCP on port 1883, so device state and commands cross the network in clear text and any host that can reach the broker can publish commands to the lab's devices posture Mitigation only — use TLS on port 8883 and turn on broker authentication in Mosquitto
Zigbee network key The documentation warns that the legacy hardcoded default network key is still accepted, and a bridge left on it lets anyone within radio range decrypt the mesh and join it posture Mitigation only — set advanced.network_key: GENERATE in configuration.yaml before the first start
Zigbee2MQTT onboarding and frontend web server On first start with no configuration.yaml the onboarding and frontend web server binds to all network interfaces on TCP 8080 with no authentication configured, so anyone who can reach the host on that port can see and control every paired Zigbee device posture Mitigation only — set frontend.host to 127.0.0.1 or a Unix socket and set auth_token in configuration.yaml (or Z2M_ONBOARD_NO_SERVER=1) before the host touches a shared network

What this means for your lab

The Zigbee2MQTT software itself came back clean this run: all 302 packages the project's pnpm lockfile pins exactly were checked against the public vulnerability database and none had a known problem, and the Node.js line the project asks for is still supported. The real risk in this lab is how the bridge is set up rather than what it is built from. Out of the box the web interface listens on every network interface on port 8080 with no password, so anyone else on the same campus or classroom network can open it and switch the lab's lights, plugs and sensors, and read everything they report; the connection to the MQTT broker is plain text on port 1883, so that traffic can be read and commands injected by anyone who can reach it. On the radio side, the lab must set advanced.network_key to GENERATE before the first start, because the old published default key would let anyone in range decrypt and join the mesh, and Touchlink pairing is unauthenticated by design, so a nearby transmitter can reset student devices. Before students connect this to anything, put the host on an isolated lab network or restrict the frontend to 127.0.0.1, set an auth_token, turn on TLS and a username and password on Mosquitto, and talk to campus IT before it goes on a shared network. Two things stay unknown: nobody stated which operating system, which Mosquitto version or which coordinator firmware version the lab uses, so none of those could be checked and none of them should be assumed clean.

Not checked

  • Host operating system (Linux / Windows / macOS): the lab states no distribution or version, so no support or advisory lookup was possible
  • Eclipse Mosquitto (MQTT broker): the lab recommends it but states no version; there is no version to check
  • Coordinator firmware (TI Z-Stack / Silicon Labs EmberZNet NCP): vendor firmware with no pinned version and no vulnerability database covering it
  • Koenkk/zigbee-OTA device firmware mirror: a continuously updated Git mirror with no pinned release, so there is no fixed version to check

Parts

Bill of Materials

Part Spec/Package Status Stock Price Source
Host Computing Platform (Raspberry Pi 4 Model B 4GB, Intel NUC, or any Linux PC) Single-board computer or small-form-factor PC; 5 V DC ≥ 3.0 A USB-C, or 12–19 V DC adapter readily available not published by seller $35.00 – $165.00 Seeed Studio ($35.00, RAM size not stated), Vilros 4GB kit $61.05, PiShop USA desktop kit $165.00
Zigbee Coordinator Radio Adapter (SONOFF ZBDongle-P / CC2652P, or ZBDongle-E / EFR32MG21) USB Type-A dongle, external antenna; 5 V DC VBUS, 3.3 V internal rail, 2.4 GHz IEEE 802.15.4 readily available (model compatibility unverified) not published by seller $19.04 – $52.53 Sonoff Official Store, ZBDongle-E $19.90; AliExpress ZBDongle-P $19.04; Newegg $52.53 outlier
USB Extension Cable USB 2.0/3.0 Type-A male to Type-A female, 0.5–1.5 m, 5 V pass-through ≥ 500 mA readily available not published by seller $2.19 – $10.49 CableWholesale $2.23, Walmart C2G $8.99, Best Buy $9.99
Zigbee Peripheral Device (sensor, plug or bulb) Commercial Zigbee end device; 3.0 V CR2032/CR2450 or 100–240 V AC; channels 11–26 readily available not published by seller $10.90 – $46.95 SONOFF door/window sensor $10.90; Aqara T1 $11.69; Tuya/MOES $13.99
CP2102N-A02-GQFN28 (USB-to-UART bridge, pre-soldered on the adapter) 28-WFQFN Exposed Pad, 28-QFN (5x5); supply 3 V ~ 3.6 V, 9.5 mA, -40 °C ~ 85 °C Active — no DigiKey stock, 31-week factory lead; stocked elsewhere DigiKey 0; Arrow 197; Mouser 58 (22,995 on order) $5.36 (Arrow $1.989 at qty 1533; Mouser $5.68) DigiKey — CP2102N-A02-GQFN28; ECIA/TrustedParts corroboration: lifecycle risk Low, supply-chain risk Low-Med

Substitutes

For part Substitute Differences Verified Judgment
CP2102N-A02-GQFN28 CP2102N-A02-GQFN28R — Silicon Labs, Active, 9,173 in stock, $5.36 Same manufacturer and description (IC USB TO UART BRIDGE QFN28); same Package/Case 28-WFQFN Exposed Pad and Supplier Device Package 28-QFN (5x5); same supply range 3 V ~ 3.6 V (the lab runs this rail at 3.3 V, inside the range); same 9.5 mA supply current; same -40 °C ~ 85 °C range; same $5.36 unit price. Only difference is the trailing R, assumed to denote tape-and-reel packaging verified: package/case and supplier device package (DigiKey parametrics, both parts), supply-voltage range 3 V ~ 3.6 V against the lab's 3.3 V logic rail (DigiKey parametrics, both parts), lifecycle status and price (DigiKey, both parts). not verified: what the R suffix encodes (assumed packaging only); pin-for-pin pinout (no datasheet fetched) Acceptable for a self-built adapter, with the packaging assumption stated. Not needed for the lab as written, which buys the assembled dongle

Verify any substitute against its datasheet before ordering.

Other dependencies

  • Zigbee2MQTT Git source repository (https://github.com/Koenkk/zigbee2mqtt.git) — reachable this run: the 2.14.0 tag's package.json and pnpm-lock.yaml were both fetched successfully.
  • Official documentation and hardware compatibility guides (https://www.zigbee2mqtt.io/) — live; the adapters guide returned 2,781 characters this run. Its per-model tables render client-side and did not come through as text, which is why coordinator model compatibility is flagged above.
  • USB-to-UART VCP driver pages (Silicon Labs, FTDI, WCH) — not fetched directly, but the fetched Zigbee2MQTT adapters page still points users to the same three vendors for VCP drivers, so the dependency remains current in the project's own documentation.
  • Mosquitto download portal (https://www.mosquitto.org/download/) — not checked; no lookup was dispatched for it this run.
  • Fabrication — none. The lab has no Gerbers, CAD, drill files or board dimensions; the system is assembled entirely from commercial off-the-shelf hardware, so there is no PCB fabrication dependency.

Watch list

  • Zigbee coordinator dongle — the most likely thing to break by the next check. SONOFF has already introduced an MG24-based Dongle Plus, and the Zigbee2MQTT project moves models between its Recommended, Not recommended and Not maintained lists over time. Re-confirm the model against the supported-adapters page each term.
  • Raspberry Pi 4 Model B 4GB — a superseded board with a 5x price spread across sellers and several look-alike listings (Compute Module, desktop kits). Expect this line to drift toward a Pi 5 or a generic mini-PC; the lab's own substitution latitude already permits it.
  • CP2102N-A02-GQFN28 — DigiKey's 31-week factory lead on the cut-tape part is worth re-checking only if anyone builds a custom adapter; the reel variant and two other authorized distributors currently cover it.
  • Zigbee end-device models — individual consumer models are discontinued and replaced constantly. The lab is insulated because any device supported by zigbee-herdsman-converters works, but the specific model named in a lab handout will go stale.
  • Stock levels generally — four of the five lines are retail, and shopping listings publish no inventory. Prices here are current; quantity on hand is unknown for every retail line.
Snapshot What the lab depended on when it was uploaded — the baseline the readiness checks research against.

This lab builds an open-source Zigbee2MQTT home automation bridge gateway, interfacing IEEE 802.15.4 (2.4 GHz) Zigbee smart home peripheral devices (sensors, actuators, light bulbs) to an MQTT broker and automation platforms without proprietary vendor hubs. The hardware implementation relies on an external host computer running a Node.js runtime, an MQTT broker, and an attached Zigbee radio coordinator adapter connected via USB, GPIO, or Ethernet. System operating rails comprise a 5 V DC nominal supply provided over the host USB bus (or single-board computer power input), an internal 3.3 V DC regulated logic rail for the Zigbee microcontroller and USB-to-UART interface chips, and auxiliary power supplies powering the end devices (typically 3 V DC via lithium coin cells for wireless sensors, or 100 V to 240 V AC mains for smart plugs and bulbs).

Bill of Materials

Because this repository contains software and deployment documentation without custom PCB CAD or Gerber layouts, the hardware components below reflect the complete physical infrastructure specified in the laboratory setup and deployment documentation.

Host Computing Platform

  • Identity: Single-board computer or compact personal computer specified as a Raspberry Pi (e.g., Raspberry Pi 4 Model B), Intel NUC, or x86_64/ARM PC running Linux, Windows, or macOS.
  • Quantity: 1
  • Footprint/package: Enclosed single-board computer PCB or small form factor chassis.
  • Electrical constraints: 5 V DC (≥ 3.0 A via USB-C for Raspberry Pi 4) or 12 V to 19 V DC via external AC/DC adapter for Intel NUC; internal system logic operates at 3.3 V / 1.8 V / core voltages.
  • Substitution latitude: Broad. Any computer architecture capable of running Node.js (version 22.2.0 or higher) and hosting an MQTT broker (Mosquitto) with USB 2.0/3.0 host ports or an Ethernet interface is acceptable.
  • Control operated during lab: Yes; power switch/supply insertion and host terminal/keyboard input operated during deployment.
  • Sourcing plan: retail shopping search: Raspberry Pi 4 Model B 4GB or Intel NUC mini PC

Zigbee Coordinator Radio Adapter

  • Identity: Radio coordinator adapter based on Texas Instruments Z-Stack (CC2652P, CC2652R, CC2652RB, CC1352P, CC1352R; legacy CC2530, CC2531 noted) or Silicon Labs EmberZNet (EFR32MG21, such as Sonoff ZBDongle-E, SMLight SLZB-06M) or Dresden Elektronik deCONZ (ConBee / RaspBee series). Models with power amplifiers (suffix P) provide up to +20 dBm RF output compared to +5 dBm on suffix R/RB models.
  • Quantity: 1
  • Footprint/package: USB Type-A dongle module with metal shielding and external SMA/RP-SMA antenna or PCB trace antenna; alternatively 40-pin Raspberry Pi GPIO HAT or RJ45 Ethernet module.
  • Electrical constraints: Supply voltage 5.0 V DC via USB VBUS (current consumption typically 50 mA to 200 mA peak during +20 dBm transmit pulses); internal RF SoC logic rail operates at 3.3 V DC from an onboard LDO regulator. RF frequency: 2.4 GHz IEEE 802.15.4.
  • Substitution latitude: Must use a coordinator microcontroller supported by the zigbee-herdsman driver layer (Texas Instruments CC2652/CC1352 family or Silicon Labs EFR32 family recommended; ZiGate is deprecated/not maintained; Nordic ZBOSS is experimental).
  • Control operated during lab: Yes; physical push button (bootloader / BSL button or S2 button) operated to enter bootloader flashing mode or perform router factory reset.
  • Sourcing plan: retail shopping search: Sonoff Zigbee 3.0 USB Dongle Plus CC2652P or ZBDongle-E

USB Extension Cable

  • Identity: USB 2.0 or USB 3.0 Type-A Male to Type-A Female extension cable, length 0.5 m to 1.5 m.
  • Quantity: 1
  • Footprint/package: Molded cable assembly with male Type-A plug on one end and female Type-A receptacle on the other.
  • Electrical constraints: 5 V DC power pass-through (minimum 500 mA rating) and 90 Ω nominal differential data lines.
  • Substitution latitude: Any functional USB extension cable. Required by documentation to physically separate the Zigbee 2.4 GHz RF dongle from USB 3.0 port and motherboard radiation noise to prevent packet drop and pairing timeouts.
  • Control operated during lab: No.
  • Sourcing plan: retail shopping search: USB 2.0 extension cable A-male to A-female 1m

Zigbee Peripheral Device (Node / Sensor / Actuator)

  • Identity: One or more Zigbee end devices or routers (such as Xiaomi Aqara door/temperature sensor, IKEA TRÅDFRI bulb/plug, Philips Hue luminaire, or Tuya Zigbee sensor).
  • Quantity: 1 or more.
  • Footprint/package: Commercial smart home device housing (sensor puck, wall switch, plug-in receptacle, or E26/E27 light bulb).
  • Electrical constraints: Battery-powered sensors typically run on 3.0 V DC (CR2032 or CR2450 lithium cell); mains-powered actuators run on 100 V to 240 V AC at 50/60 Hz. RF communication operates on 2.4 GHz Zigbee channels 11 to 26.
  • Substitution latitude: Any device documented in the Zigbee2MQTT supported devices repository (supported by zigbee-herdsman-converters).
  • Control operated during lab: Yes; physical reset/pairing button pressed by student for 5 to 10 seconds to initiate network pairing / interview.
  • Sourcing plan: retail shopping search: Zigbee 3.0 door window sensor or smart plug

USB-to-UART Bridge Controller (Integrated on coordinator adapter)

  • Identity: Silicon Labs CP2102N, FTDI FT232R, or WCH CH340 / CH9102.
  • Quantity: 1 (pre-assembled on coordinator adapter board).
  • Footprint/package: QFN-28, SSOP-28, or SOP-16 surface-mount IC on adapter PCB.
  • Electrical constraints: Powered from 5 V USB VBUS; 3.3 V UART logic signals connected to coordinator RX/TX lines.
  • Substitution latitude: Pre-soldered on commercial coordinator dongles; matching Virtual COM Port (VCP) drivers must be supported by host operating system.
  • Control operated during lab: No.
  • Sourcing plan: distributor lookup (representative example — sources give spec only): CP2102N-A02-GQFN28

Software and network dependencies

Operating System and Runtime Environments

  • Host Operating System: Linux (e.g., Debian / Raspberry Pi OS, Ubuntu), Microsoft Windows, or Apple macOS. Version: not stated. Where version came from: stated in documentation (docs_getting_started.md). Version pinned: No. Check plan: not checkable: OS distribution and version not stated.
  • Node.js Engine Runtime: Node.js JavaScript runtime. Version: ^22.2.0 || ^24 || <=26.2. Where version came from: pinned in package.json (engines field). Version pinned: Range-pinned. Check plan: support-status lookup: Node.js 22.
  • PNPM Package Manager: Fast, disk space efficient package manager. Version: 10.18.3. Where version came from: pinned in package.json (packageManager field). Version pinned: Yes. Check plan: vulnerability lookup: pnpm / npm / 10.18.3.
  • MQTT Broker: Eclipse Mosquitto (or alternative MQTT broker). Version: not stated. Where version came from: stated in documentation (docs_getting_started.md recommends Mosquitto). Version pinned: No. Check plan: not checkable: version not stated.

Core Application and Direct Subsystems

  • zigbee2mqtt: Primary application daemon bridging Zigbee clusters to MQTT topics. Version: 2.14.0. Where version came from: pinned in package.json. Version pinned: Yes. Manifest location: package.json. Check plan: vulnerability lookup: zigbee2mqtt / npm / 2.14.0.
  • zigbee-herdsman: Low-level serial communication protocol driver for Zigbee coordinators (TI Z-Stack, Silabs EmberZNet, deCONZ). Version: 10.9.1. Where version came from: pinned in package.json (and defined in pnpm.overrides). Version pinned: Yes. Manifest location: package.json. Check plan: vulnerability lookup: zigbee-herdsman / npm / 10.9.1.
  • zigbee-herdsman-converters: Translation definitions mapping device fingerprints and Zigbee clusters to high-level state attributes. Version: 26.103.0. Where version came from: pinned in package.json. Version pinned: Yes. Manifest location: package.json. Check plan: vulnerability lookup: zigbee-herdsman-converters / npm / 26.103.0.
  • zigbee2mqtt-frontend: Embedded web frontend interface for monitoring and device management. Version: 0.9.21. Where version came from: pinned in package.json. Version pinned: Yes. Manifest location: package.json. Check plan: vulnerability lookup: zigbee2mqtt-frontend / npm / 0.9.21.
  • zigbee2mqtt-windfront: Alternative web frontend package. Version: 2.15.0. Where version came from: pinned in package.json. Version pinned: Yes. Manifest location: package.json. Check plan: vulnerability lookup: zigbee2mqtt-windfront / npm / 2.15.0.

Runtime Dependencies (Declared in package.json)

  • ajv: Version: ^8.20.0. Where version came from: pinned in package.json. Version pinned: Caret-pinned. Check plan: vulnerability lookup: ajv / npm / 8.20.0.
  • bind-decorator: Version: ^1.0.11. Where version came from: pinned in package.json. Version pinned: Caret-pinned. Check plan: vulnerability lookup: bind-decorator / npm / 1.0.11.
  • debounce: Version: ^3.0.0. Where version came from: pinned in package.json. Version pinned: Caret-pinned. Check plan: vulnerability lookup: debounce / npm / 3.0.0.
  • fast-deep-equal: Version: ^3.1.3. Where version came from: pinned in package.json. Version pinned: Caret-pinned. Check plan: vulnerability lookup: fast-deep-equal / npm / 3.1.3.
  • fflate: Version: ^0.8.3. Where version came from: pinned in package.json. Version pinned: Caret-pinned. Check plan: vulnerability lookup: fflate / npm / 0.8.3.
  • humanize-duration: Version: ^3.34.1. Where version came from: pinned in package.json. Version pinned: Caret-pinned. Check plan: vulnerability lookup: humanize-duration / npm / 3.34.1.
  • js-yaml: Version: ^5.4.1. Where version came from: pinned in package.json. Version pinned: Caret-pinned. Check plan: vulnerability lookup: js-yaml / npm / 5.4.1.
  • mqtt: Version: ^5.15.2. Where version came from: pinned in package.json. Version pinned: Caret-pinned. Check plan: vulnerability lookup: mqtt / npm / 5.15.2.
  • semver: Version: ^7.8.5. Where version came from: pinned in package.json. Version pinned: Caret-pinned. Check plan: vulnerability lookup: semver / npm / 7.8.5.
  • srvx: Version: ^0.12.7. Where version came from: pinned in package.json. Version pinned: Caret-pinned. Check plan: vulnerability lookup: srvx / npm / 0.12.7.
  • throttleit: Version: ^3.0.0. Where version came from: pinned in package.json. Version pinned: Caret-pinned. Check plan: vulnerability lookup: throttleit / npm / 3.0.0.
  • winston: Version: ^3.19.0. Where version came from: pinned in package.json. Version pinned: Caret-pinned. Check plan: vulnerability lookup: winston / npm / 3.19.0.
  • winston-syslog: Version: ^2.7.1. Where version came from: pinned in package.json. Version pinned: Caret-pinned. Check plan: vulnerability lookup: winston-syslog / npm / 2.7.1.
  • winston-transport: Version: ^4.9.0. Where version came from: pinned in package.json. Version pinned: Caret-pinned. Check plan: vulnerability lookup: winston-transport / npm / 4.9.0.
  • ws: Version: ^8.21.3. Where version came from: pinned in package.json. Version pinned: Caret-pinned. Check plan: vulnerability lookup: ws / npm / 8.21.3.

Optional and Native Build Dependencies

  • unix-dgram: Version: ^2.0.7. Where version came from: pinned in package.json (optionalDependencies). Version pinned: Caret-pinned. Check plan: vulnerability lookup: unix-dgram / npm / 2.0.7.
  • @serialport/bindings-cpp: Native C++ bindings for coordinator serial port access. Version: not stated in root manifest. Where version came from: declared in pnpm.onlyBuiltDependencies in package.json (resolved transitively by zigbee-herdsman). Version pinned: No. Check plan: not checkable: transitive dependency unpinned in root manifest.
  • esbuild: JavaScript bundler. Version: not stated in root manifest. Where version came from: declared in pnpm.onlyBuiltDependencies in package.json. Version pinned: No. Check plan: not checkable: transitive dependency unpinned in root manifest.

Development and Build Toolchain Dependencies (Declared in package.json)

  • @biomejs/biome: Version: ^2.5.11. Where version came from: pinned in package.json (devDependencies). Version pinned: Caret-pinned. Check plan: vulnerability lookup: @biomejs/biome / npm / 2.5.11.
  • @types/humanize-duration: Version: ^3.27.4. Where version came from: pinned in package.json. Version pinned: Caret-pinned. Check plan: vulnerability lookup: @types/humanize-duration / npm / 3.27.4.
  • @types/node: Version: ^26.4.0. Where version came from: pinned in package.json. Version pinned: Caret-pinned. Check plan: vulnerability lookup: @types/node / npm / 26.4.0.
  • @types/readable-stream: Version: 4.0.24. Where version came from: pinned in package.json. Version pinned: Yes. Check plan: vulnerability lookup: @types/readable-stream / npm / 4.0.24.
  • @types/ws: Version: 8.18.1. Where version came from: pinned in package.json. Version pinned: Yes. Check plan: vulnerability lookup: @types/ws / npm / 8.18.1.
  • @vitest/coverage-v8: Version: ^3.2.7. Where version came from: pinned in package.json. Version pinned: Caret-pinned. Check plan: vulnerability lookup: @vitest/coverage-v8 / npm / 3.2.7.
  • tmp: Version: ^0.2.7. Where version came from: pinned in package.json. Version pinned: Caret-pinned. Check plan: vulnerability lookup: tmp / npm / 0.2.7.
  • typescript: Version: ^7.0.2. Where version came from: pinned in package.json. Version pinned: Caret-pinned. Check plan: vulnerability lookup: typescript / npm / 7.0.2.
  • vitest: Version: ^3.2.7. Where version came from: pinned in package.json. Version pinned: Caret-pinned. Check plan: vulnerability lookup: vitest / npm / 3.2.7.

Microcontroller Coordinator Firmware and Over-The-Air Repositories

  • Texas Instruments Z-Stack Coordinator Firmware or Silicon Labs EmberZNet NCP Firmware: Flashed to coordinator SoC. Version: not stated. Where version came from: stated in documentation (docs_adapters.md). Version pinned: No. Check plan: not checkable: vendor firmware with unpinned version and no vulnerability database.
  • Koenkk/zigbee-OTA: Online repository mirror for device OTA firmware updates. Version: not stated. Where version came from: stated in documentation (docs_securing.md). Version pinned: No. Check plan: not checkable: continuously updated Git mirror.

Network Exposure and Communication Topology

  • Host Network Attachment: Host connects via local Ethernet (wired recommended) or Wi-Fi (docs_adapters.md notes Wi-Fi coordinator links can suffer packet loss and latency issues).
  • Onboarding and Frontend Web Server: Listens on TCP port 8080 by default. Binds to all network interfaces (0.0.0.0:8080) on first startup when no configuration.yaml is present (docs_getting_started.md, docs_securing.md). Accessible locally at http://localhost:8080. Environment variables Z2M_ONBOARD_URL can alter the bind address, Z2M_ONBOARD_NO_SERVER=1 disables the onboarding server, and configuration parameter frontend.host can restrict binding to 127.0.0.1 or to a local Unix domain socket (e.g., /run/zigbee2mqtt/zigbee2mqtt.sock).
  • WebSockets: Frontend uses WebSockets on the same port (TCP 8080) for real-time state and message dispatching.
  • MQTT Broker Connection: Outbound TCP client connection to the MQTT broker, typically connecting to port 1883 (unencrypted TCP) or port 8883 (TLS/SSL).
  • Zigbee RF Mesh (IEEE 802.15.4): Wireless communication on 2.4 GHz radio channels. Encrypted using 128-bit AES network key. Documentation explicitly warns against using the legacy hardcoded default key [1, 3, 5, 7, 9, 11, 13, 15, 0, 2, 4, 6, 8, 10, 12, 13] and specifies setting advanced.network_key: GENERATE to create a random key. Supports joining encryption via Install Codes (pre-shared keys derived from QR/label).
  • Inter-PAN (Touchlink): Uses unsecured 1-hop wireless RF messaging for factory reset/pairing operations.
  • Default Credentials: None documented out-of-the-box for the frontend or onboarding server. Authentication can be enforced by adding auth_token to configuration.yaml or secret.yaml.
  • Remote Management: Documentation advises against exposing MQTT or frontend ports publicly and instructs setting file permissions on configuration.yaml and secret.yaml to chmod 600 under an unprivileged system user.

Remaining Temporal Dependencies

Downloads and External URLs

Fabrication Specifications

  • No custom PCB Gerber files, CAD files, drill files, layer counts, or physical board dimensions exist in this project. The system is assembled entirely from commercial off-the-shelf single-board computers, USB dongle modules, standard cabling, and commercial Zigbee consumer hardware.