WeeWX Weather Station

This lab focuses on automated meteorological data acquisition, sensor interfacing, and environmental telemetry using the WeeWX software architecture deployed on single-board computers or POSIX systems. Students configure communication links with weather station consoles, software-defined radio telemetry receivers, or 1-Wire sensor buses using serial RS-232, UART, and USB protocols. Through hands-on instrumentation, learners capture atmospheric variables such as temperature, barometric pressure, humidity, wind velocity, and rainfall, archiving the readings into embedded relational or time-series databases. Students gain practical skills in Linux system administration, sensor communications, automated report and plot generation, and data distribution through MQTT and networked weather observation protocols.

automated weather station meteorological monitoring environmental sensing data logging telemetry single board computer Raspberry Pi WeeWX 1-Wire software defined radio RTL-SDR serial communication RS-232 MQTT SQLite time-series data Python Linux

Uploaded by demo on 2026-09-03 · ready · Electronics · Original source ↗

Files: README.md · pyproject.toml

Readiness checks

  • complete 2026-09-03 18:33 🛡 Cybersecurity: Review before networking · 6 findings 10 searches · 4 pages
    view · PDF

Latest report — 2026-09-03 18:33

Readiness: WeeWX Weather Station

Verdict: Ready with caveats · 2026-09-03 · est. parts cost $135–$1,765 Cybersecurity — software & network: Review before networking

This is the cold check for this lab — there is no previous report, so everything below is the baseline the next check will measure drift against. Every item on the bill of materials is sourceable today from a live seller, and nothing is discontinued in a way that stops the lab running. Three things keep it off a clean "Ready". The cost swings by more than a factor of ten depending on which weather station console you buy ($100 to $1,730 in the prices found this run), so it is easy to budget badly. The Davis bundles actually on sale ship with a "WeatherLink Console", and WeeWX's own supported-hardware page requires a serial, USB, or WeatherLinkIP interface — no page read this run says which interface those bundles expose, so console compatibility is unconfirmed. And the cheap Ecowitt alternative is priced but the gateway model inside the kit was not confirmed against WeeWX's supported list. None of these is a sourcing failure; all three are "confirm before you order" items. Note also that this lab has no PCB, schematic, or component-level parts list — the bill of materials is five whole-unit purchases, so no footprint or supply-rail checks apply anywhere in this report.

Action required

Part Problem Recommended action
Maxim/ADI DS9490R 1-Wire adapter DigiKey's catalogue entry for the bare part number DS9490R is Obsolete with zero stock. The snapshot and WeeWX's hardware page both write the part this way, so searching that exact string lands you on a dead listing. Order the packaging variant DS9490R# instead — Active, 1,587 in stock, $49.93 at DigiKey. Budget roughly double any older quote: the obsolete entry shows $26.34.
Davis Vantage Pro2 console Not unobtainable, but 3×–9× the price of a snapshot-sanctioned alternative ($625.00–$1,730.00 against $199.99 for an Ecowitt Wittboy), and the interface question below is unresolved. Before ordering, confirm the exact bundle exposes a serial, USB, or WeatherLinkIP interface (WeeWX supports the Vantage Pro2 only through one of those). If budget matters more than the Davis sensor suite, price the Ecowitt route in Substitutes — but verify its gateway model first.

Cybersecurity — software & network

Review before networking — WeeWX 5.5.0 itself is clean and opens no inbound port, but the committed lockfile pins library versions carrying critical advisories, every dependency is declared unpinned, and the documented upload paths include cleartext FTP and MQTT.

Component Version How known Support status
Raspberry Pi OS (Debian 'bookworm' base) bookworm inferred (Not pinned anywhere in the project files; the snapshot records the OS version as 'not stated' and its check plan names Raspberry Pi OS Bookworm, whose Debian 12 base was looked up. Any other host OS the instructor picks has a different support status.) extended/LTS support only until 2028-06-30
Python (lowest runtime the project accepts) 3.7 inferred (requires-python = ">=3.7" in fetched/01-pyproject.toml is a range, not a pin, so 3.7 is the declared floor; the Python actually installed on the host is not determined.) unsupported since 2023-06-27
weewx 5.5.0 read from project (version = "5.5.0" in fetched/01-pyproject.toml, printed from the fetched file by run_python.) —
Pillow 8.4.0 read from project (Pinned in fetched/02-poetry.lock (the project's committed lockfile); pyproject.toml declares only Pillow >=5.2 with no upper bound.) —
PyMySQL 1.0.2 read from project (Pinned in fetched/02-poetry.lock; pyproject.toml declares only PyMySQL >=1.0 with no upper bound.) —
configobj 5.0.8 read from project (Pinned in fetched/02-poetry.lock; pyproject.toml declares only configobj >=5.0 with no upper bound.) —
CT3 (Cheetah3 template engine) 3.3.3 read from project (Pinned in fetched/02-poetry.lock; pyproject.toml declares only CT3 >=3.1.) —
ephem 4.1.5 read from project (Pinned in fetched/02-poetry.lock; pyproject.toml declares only ephem >=4.1.) —
pyserial 3.5 read from project (Pinned in fetched/02-poetry.lock; pyproject.toml declares only pyserial >=3.4.) —
pyusb 1.2.1 read from project (Pinned in fetched/02-poetry.lock; pyproject.toml declares only pyusb >=1.0.2.) —
poetry-core (build backend) not determined unpinned (Build requirement requires = ["poetry-core>=2.0.0"] in fetched/01-pyproject.toml: a minimum bound only, and not present in poetry.lock.) —
cryptography (dev group) not determined unpinned (Listed with no version constraint under dependency-groups.dev in fetched/01-pyproject.toml and absent from fetched/02-poetry.lock.) —
poetry (dev group) not determined unpinned (Listed with no version constraint under dependency-groups.dev in fetched/01-pyproject.toml and absent from fetched/02-poetry.lock.) —
pytest (dev group) not determined unpinned (Listed with no version constraint under dependency-groups.dev in fetched/01-pyproject.toml and absent from fetched/02-poetry.lock.) —
zensical (dev group) not determined unpinned (Listed with no version constraint under dependency-groups.dev in fetched/01-pyproject.toml and absent from fetched/02-poetry.lock.) —
SQLite (default data store) not determined not determined (Bundled with whatever Python the host runs; no version is stated in the project files or the snapshot.) —
MySQL server (optional data store, reached over the network via PyMySQL) not determined not determined (Optional external server; no version stated in the project files or the snapshot.) —
InfluxDB (optional data store) not determined not determined (Mentioned in README.md per the snapshot; no version stated in the project files or the snapshot.) —
Component Finding Severity Fix available?
Pillow The Pillow version pinned in the project's committed lockfile (8.4.0) carries 25 known advisories, several of which let a booby-trapped image file run code on the machine that generates the station's plots; six are cited here and the rest are in the evidence. — GHSA-8vj2-vxx3-667w, GHSA-3f63-hfp8-52jq, GHSA-9j59-75qj-795w, GHSA-j7hp-h8jx-5ppr (+2 more) critical Yes — update to 12.3.0 or later, which fixes every advisory cited here; pyproject.toml declares only Pillow >=5.2 with no upper bound, so nothing in the project blocks the upgrade.
PyMySQL The PyMySQL version pinned in the project's committed lockfile (1.0.2) has a SQL injection flaw, so crafted weather data written to a MySQL archive could be executed as database commands rather than stored as values. — GHSA-v9hf-5j83-6xpp critical Yes — update to 1.1.1 or later; pyproject.toml declares only PyMySQL >=1.0 with no upper bound, so nothing in the project blocks the upgrade.
configobj The configobj version pinned in the project's committed lockfile (5.0.8) has a denial-of-service flaw in its configuration validation, which pyproject.toml's own inline comment says WeeWX does not use. — GHSA-c33w-24p9-8m24 low Yes — update to 5.0.9 or later; pyproject.toml declares only configobj >=5.0 with no upper bound, so nothing in the project blocks the upgrade.
Python (lowest runtime the project accepts) The project declares requires-python >=3.7, and Python 3.7 stopped receiving security fixes on 2023-06-27, so the lowest runtime this lab officially accepts is one that no longer gets patched. posture Mitigation only — install on a Python release that is still supported; the project sets no upper bound, so a current Python is allowed.
Report upload and publishing paths The publishing options the lab documents include plain FTP on port 21 and unencrypted MQTT on port 1883, both of which carry the account credentials and the station data across the network in readable form. posture Mitigation only — publish over rsync/SSH (port 22) or FTPS instead of FTP, use MQTT over TLS (port 8883), and leave any upload the class does not need switched off.
WeeWX dependency declarations Dependencies unpinned: 11 of 11 in pyproject.toml — every runtime and development dependency is declared as a minimum bound or with no constraint at all, so two installations of this lab can end up with different library versions and neither has a checkable security state. posture Mitigation only — pin versions / use the lockfile, and regenerate the lockfile so it resolves to current releases rather than the years-old ones it holds today.

What this means for your lab

WeeWX itself came back clean this run: version 5.5.0 has no known published vulnerabilities, and the project's documentation describes no inbound network port opened by the weather daemon, so someone else on the campus network cannot simply connect to it and take it over. The risks are quieter than that. If you install from the project's source repository using its committed lockfile, you get library versions that are several years old — the image library in particular has flaws serious enough that a malformed image file could run code on the Raspberry Pi, and the database library has one that could let crafted data reach a MySQL database as commands; installing with pip, or updating those libraries afterwards, avoids this, and nothing in the project prevents the upgrade. The lab's report-publishing options also include plain FTP and unencrypted MQTT, which put the username and password on the network in readable form for anyone sharing it, so prefer rsync over SSH or FTPS and MQTT over TLS. Finally, this check could not examine the weather station console or gateway at all — that is a network-connected device in its own right. Treat both it and the Pi as untrusted equipment: put them on a segmented or guest network rather than the main campus LAN, change any default password the console ships with, and check with campus IT before connecting anything permanently.

Not checked

  • cryptography, poetry, pytest, zensical (dev group): Declared with no version constraint in pyproject.toml and absent from poetry.lock, so there is no exact version to check.
  • poetry-core (build backend): Declared as a minimum bound (>=2.0.0) only and not present in the lockfile, so there is no exact version to check.
  • SQLite: No version stated in the project files or the snapshot; it ships with whichever Python the host runs, which was not determined.
  • MySQL server: Optional external database; no version stated in the project files or the snapshot.
  • InfluxDB: Optional external database; no version stated in the project files or the snapshot.
  • Host operating system as actually installed: Unpinned — the instructor chooses it. Bookworm was assumed from the snapshot's check plan; a different OS or release has a different support status.
  • Weather station console and gateway firmware: Not recorded in the snapshot's software section, and no public advisory database covers consumer weather-station firmware — absence of advisories here is not evidence of safety.
  • WeeWX source modules (weecfg, weectllib, weedb, weeimport, weeplot, weeutil, weewx, weewx_data): The snapshot notes the src directory was omitted from the uploaded files, so the lab's own code was not available to inspect.

Parts

Part Spec/Package Status Stock Price Source
Host computing platform (single-board computer or POSIX workstation) Raspberry Pi form factor or x86_64 PC; 5.0–5.25 V DC via USB-C/micro-USB, ≥ 2.5 A readily available multiple sellers $35.00 (RAM tier not stated in listing) — $61.05 4GB starter kit Seeed Studio / Vilros (Google Shopping)
External automated weather station console or sensor array Mast-mounted outdoor ISS + indoor receiver/bridge; outdoor 3.0 V DC cells, indoor 5 V or 9–12 V DC readily available; interface compatibility unconfirmed multiple sellers $625.00 – $1,730.00 across Vantage Pro2 configurations Davis Instruments (Google Shopping)
RF telemetry receiver / SDR (optional) USB Type-A dongle, 5 V USB bus powered, 433/868/915 MHz ISM readily available multiple sellers $33.24 for the named RTL-SDR Blog V4 eBay – dhamm1ik_0 (Google Shopping)
Dallas/Maxim 1-Wire bus master adapter (optional) USB to 1-Wire bridge, RJ11; 5 V USB bus power readily available as DS9490R# (bare DS9490R entry is Obsolete) 1,587 $49.93 DigiKey (authorized)
Host-to-station interface cable / converter USB to RS-232 DB9 converter, FTDI or Prolific chipset, 1 m readily available 702 $26.80 for FTDI US232R-100-BULK; same part at retail DigiKey (authorized)

Notes on the table. The $35.00 Raspberry Pi listing is titled only "Raspberry Pi 4 Model B" and does not state its RAM tier, so treat it as the floor of the family rather than a confirmed 2GB/4GB price; a confirmed 4GB kit is $61.05. A "CM4104000 Raspberry Pi CM4 4GB" result at $144.00 also came back — that is a Compute Module 4, a different form factor needing a carrier board, and is not the Model B this lab calls for. The manufacturer's own product page could not be read this run (the site blocked the fetch), so no claim is made here about the Pi 4B's remaining production life. For the interface cable, DigiKey's description reads "CABLE USB RS232 PREMIUM 1M DB9" and returned no parametric detail, so the DB9 connector gender is not verified — the snapshot asks for a female DB9, and you must match the cable to your console's port before ordering. Cheaper retail cables exist ($9.99 Sabrent, $20.99 Valley Enterprises) but most do not state a chipset in the listing, which the snapshot requires.

Substitutes

For part Substitute Differences Verified Judgment
External weather station console (Davis Vantage Pro2) Ecowitt GW2001 Wittboy complete wireless system, $199.99 — also Ecowitt GW1201 + WS69 array + GW1200 gateway, $99.75 $425–$1,530 cheaper than the Davis configurations priced. 7-in-1 solar-powered outdoor array against the Davis ISS; both meet the snapshot's "mast-mounted outdoor integrated sensor suite" requirement. Vendor family is named in the snapshot's own BOM line (Fine Offset / Ecowitt, incl. GW1000, GW1100, GW2000). Driver compatibility is the open question: WeeWX's supported-hardware page names the Ecowitt/Fine Offset GW1000 gateway and does not name a GW2001, GW1200, or GW3001. verified: current retail price, seller and product title (Google Shopping this run); WeeWX support for the Ecowitt/Fine Offset GW1000 gateway family (fetched weewx.com/hardware.html). not verified: which gateway model the GW2001 kit actually ships, and therefore whether a WeeWX driver speaks its protocol — no vendor product page could be read this run. plausible, unverified — excellent value and a snapshot-sanctioned vendor family, but confirm the kit's gateway model appears on WeeWX's supported-hardware page before ordering. Do not treat $199.99 as a confirmed working configuration.
1-Wire adapter DS9490R (Obsolete catalogue entry, no stock, $26.34) DS9490R#, $49.93, 1,587 in stock Identical manufacturer (Analog Devices Inc./Maxim Integrated) and identical DigiKey description, "IC BRIDGE USB TO 1-WIRE RJ11". Only the suffix differs. Price is $23.59 higher than the dead entry's listed figure. verified: lifecycle status, stock and price for both entries from DigiKey this run; identical manufacturer and catalogue description. not verified: what the "#" suffix encodes — DigiKey returned no parametric block, so the usual "packaging code" reading is assumed, not evidenced. acceptable — the same catalogue product under the active packaging SKU, and the only one with stock. WeeWX's hardware page names "DS9490R", which both entries carry.

Verify any substitute against its datasheet — and, for a weather console, against WeeWX's supported-hardware list — before ordering.

Other dependencies

  • Fabrication: none applicable. The lab has no PCBs, Gerbers, schematics, or mechanical manufacturing files. Physical fabrication is limited to commodity mounting hardware — mast clamps, U-bolts, solar radiation shields, tripod mounts. Not checked: the snapshot gives no sourcing plan for these and no lookup was dispatched.
  • https://www.weewx.com/hardware.html — live. Fetched successfully this run (3,202 characters of supported-hardware tables). This is the page to check a console against before buying; it lists roughly 30 supported station families including AcuRite, Fine Offset/Ecowitt, LaCrosse, Oregon Scientific, Peet Bros, RainWise, Hideki, Texas Weather Instruments, Vaisala and WeatherFlow.
  • https://www.raspberrypi.com/products/raspberry-pi-4-model-b/ — fetch failed. The page could not be downloaded this run (blocked, timeout, or gone). The site most likely blocks automated fetches; this is not evidence the page is gone, but the manufacturer's price tiers and production commitments are not on the record.
  • Not checked: the remaining external sites the lab links — weewx.com homepage, /docs/ and /docs/quickstarts.html, /downloads, hwcmp.html, showcase.html and stations.html, the GitHub repository and its issue tracker and wiki, and the weewx-user Google Group. No lookups were dispatched for them. The GitHub repository was reachable at the v5.5.0 tag during this run, which is indirect evidence that that URL is live.

Watch list

  • DS9490R# (1-Wire adapter) — the bare DS9490R catalogue entry is already Obsolete. The packaging variant is Active with healthy stock today, but this is a single-source, end-of-life-adjacent part on one distributor; check its lifecycle status first at the next run.
  • Davis Vantage Pro2 interface — the unresolved question of which bundles expose a serial, USB, or WeatherLinkIP interface is the most likely thing to strand a purchase. Worth resolving from a Davis product page next run rather than leaving it to the instructor.
  • Ecowitt gateway model — the low-cost route hinges on a gateway model that WeeWX's page does not name. If the Ecowitt line moves on from the GW1000 family, the cheap path to this lab closes; re-check the supported-hardware page against current Ecowitt SKUs.
  • Raspberry Pi 4 Model B — the Pi 5 is the current flagship and the 4B's remaining production life could not be established this run. Price spread is already wide ($35.00 to $165.00). Watch for the 4B thinning out; the snapshot's high substitution latitude (any Pi or x86_64 PC) means this is a price-and-convenience risk, not a blocker.
  • Weather console prices generally — this lab's cost is dominated by one purchase that ranged $99.75 to $1,730.00 this run. Drift here matters far more to an instructor's budget than any other line.
Snapshot What the lab depended on when it was uploaded — the baseline the readiness checks research against.

This project comprises the WeeWX Weather Station software system (version 5.5.0), an open-source weather data collection, logging, and reporting suite. Rather than specifying a custom printed circuit board, the system relies on a host computing platform—predominantly a single-board computer such as a Raspberry Pi running Linux, or a workstation running macOS, Solaris, or *BSD—interfacing with commercial or DIY automated weather station hardware, sensor suites, radio-frequency transceivers, or 1-Wire buses. System power and electrical rails depend on the host and interfacing sensors: the host SBC runs on standard 5 V DC logic (typically supplied via USB-C or Micro-USB at 2.5 A to 3 A), USB-attached weather bridges and dongles operate from the 5 V DC USB bus rail, serial devices communicate over standard RS-232 signal levels (±5 V to ±12 V) or 3.3 V/5 V UART, 1-Wire sensor buses operate at 5 V or 3.3 V DC, and external outdoor weather sensor consoles operate independently via internal battery banks (1.5 V to 3 V DC) or external 5 V to 12 V DC wall adapters.

Bill of Materials

No PCB layout, Gerber files, schematic diagrams, or physical circuit board component manifests (R, C, D, Q, U) were included in this repository upload. The physical hardware footprint is defined entirely by the host computer, physical telemetry interface adapters, and external weather station hardware described in the documentation.

Host Computing Platform (Single-Board Computer or POSIX Workstation)

  • Quantity: 1
  • Package / Footprint: Standalone single-board computer (e.g., Raspberry Pi form factor) or chassis-mount workstation
  • Electrical constraints: 5.0 V to 5.25 V DC input via USB-C or micro-USB, minimum 2.5 A current delivery (Raspberry Pi 3/4/5 spec); logic interfaces operate at 3.3 V / 5 V; host mains power 100–240 V AC if running on a traditional PC or server
  • Substitution latitude: High latitude. The software supports POSIX/Linux, macOS, Solaris, and *BSD running Python ≥ 3.7. Any Raspberry Pi (Model B+, 2B, 3B, 3B+, 4B, 5, Zero 2 W) or x86_64 PC meeting Python runtime requirements is functionally interchangeable.
  • Operator control: No (automated headless server).
  • Sourcing plan: retail shopping search: Raspberry Pi 4 Model B 2GB or 4GB single board computer

External Automated Weather Station Console or Sensor Array

  • Quantity: 1 minimum
  • Package / Footprint: Mast-mounted outdoor integrated sensor suite (ISS) paired with an indoor desktop receiver console or bridge unit
  • Electrical constraints: Outdoor sensors typically 3.0 V DC (2× AA 1.5 V lithium or alkaline cells) with solar capacitor backup; indoor console powered by 5 V DC (USB/adapter) or 9 V–12 V DC wall transformer
  • Specific models cited in project documentation (README.md):
    • Davis Instruments: Vantage Pro, Vantage Pro2, Vantage Vue, Weather Envoy
    • Oregon Scientific: WMR100, WMR300, WMR9x8, LW300, LW301, LW302
    • Fine Offset / Ecowitt: WH10xx, WH20xx, WH30xx, WH23xx, WH4000, WH2600, HP1000, GW1000, GW1100, GW2000
    • LaCrosse Technology: WS-23XX, WS-28XX, GW1000U bridge
    • Hideki: TE923, TE831, TE838, DV928 (including OEM brands TFA, Cresta, Honeywell)
    • Peet Bros: Ultimeter (100, 800, 2100)
    • RainWise: CC3000, MKIII
    • AcuRite: 5-in-1 (via USB console or AcuRite Access/bridge), AcuRite Atlas
    • Argent Data Systems: WS1
    • Additional supported stations: Dyacon, Texas Weather Instruments, AirMar 150WX, New Mountain, Ventus W820, TFA KlimaLogg Pro
  • Substitution latitude: High latitude across any of the supported vendor lines; WeeWX provides modular station drivers tailored to the packet protocol of each console family.
  • Operator control: Initial console configuration buttons operated during setup; unattended during continuous logging.
  • Sourcing plan: retail shopping search: Davis Instruments 6252 Vantage Pro2 or Ecowitt Wittboy weather station

RF Telemetry Receiver / Software Defined Radio (Optional Alternative Interface)

  • Quantity: 1 (optional, used when bypassing commercial indoor consoles)
  • Package / Footprint: USB Type-A dongle or standalone transceiver module
  • Electrical constraints: 5 V DC USB bus powered; RF receiving range centered at 433 MHz, 868 MHz, or 915 MHz (depending on local ISM band and station transmitter)
  • Specific models cited in project documentation (README.md):
    • RTL-SDR Software Defined Radio (RTL2832U-based tuner dongle)
    • Silicon Labs Si1000 radio receiver / Meteostick
  • Substitution latitude: Must be compatible with the rtl_433 demodulation suite or the Meteostick serial protocol.
  • Operator control: None.
  • Sourcing plan: retail shopping search: RTL-SDR Blog V4 R828D RTL2832U USB Dongle Receiver

Dallas/Maxim 1-Wire Bus Master Adapter (Optional Alternative Interface)

  • Quantity: 1 (optional, used for 1-Wire sensor topologies)
  • Package / Footprint: USB Type-A or RS-232 adapter dongle with RJ11/RJ12/screw terminal outputs
  • Electrical constraints: 5 V DC USB bus power; 1-Wire bus signal pull-up to 5 V (or 3.3 V); compatible with 1-Wire environmental sensors (Inspeed anemometers, Dallas DS18B20 temperature probes, Hobby-Boards, AAG, ADS)
  • Substitution latitude: Any DS9490R-compatible USB bridge, passive serial adapter, or GPIO 1-Wire bus interface supported by OWFS/WeeWX.
  • Operator control: None.
  • Sourcing plan: retail shopping search: Maxim DS9490R USB to 1-Wire adapter

Host-to-Station Interface Cable / Converter

  • Quantity: 1
  • Package / Footprint: Cable assembly (USB Type-A to Type-B / Mini-B / Micro-B, or DB9 Female RS-232 to USB converter with FTDI/Prolific chipset)
  • Electrical constraints: Signal matching station console port (USB 2.0 full speed 12 Mbps or RS-232 ±12 V levels converted to 5 V/3.3 V USB serial)
  • Substitution latitude: Must match the physical output port of the selected weather console and the input port of the host computer.
  • Operator control: None.
  • Sourcing plan: retail shopping search: USB to RS232 DB9 serial adapter cable FTDI chipset

Software and network dependencies

The software application is packaged via Poetry and targets POSIX-compliant operating systems. Note that the project package manifest specifies internal modules located in a src directory (weecfg, weectllib, weedb, weeimport, weeplot, weeutil, weewx, weewx_data, weectl.py, weewxd.py), but the src directory itself was omitted from the uploaded files.

Operating System Platform

  • Name: POSIX-compliant OS (Debian GNU/Linux, Raspberry Pi OS, Ubuntu, macOS, Solaris, or *BSD)
  • Origin: OS vendor repositories (e.g., raspberrypi.com, debian.org)
  • Version: not stated (pyproject.toml lists OS classifiers: POSIX :: Linux, Unix, MacOS; README.md cites Linux, MacOSX, Solaris, *BSD, and Raspberry Pi)
  • Where version came from: not stated
  • Version pinning: unpinned
  • Check plan: support-status lookup: Raspberry Pi OS Bookworm

Base Runtime Environment

  • Name: Python
  • Origin: https://www.python.org/
  • Version: >=3.7 (pyproject.toml explicitly lists compatibility classifiers for Python 3.7, 3.8, 3.9, 3.10, 3.11, 3.12, 3.13, and 3.14)
  • Where version came from: pinned in pyproject.toml
  • Version pinning: minimum version bound only (requires-python = ">=3.7"), no upper lock
  • Manifest location: pyproject.toml
  • Check plan: support-status lookup: Python 3.7

Core Application Package

  • Name: weewx
  • Origin: https://github.com/weewx/weewx / https://weewx.com
  • Version: 5.5.0
  • Where version came from: pinned in pyproject.toml
  • Version pinning: exact version string in manifest (version = "5.5.0")
  • Manifest location: pyproject.toml
  • Check plan: vulnerability lookup: weewx / PyPI / 5.5.0

Packaging and Build System

  • Name: poetry-core
  • Origin: https://pypi.org/project/poetry-core/
  • Version: >=2.0.0
  • Where version came from: pinned in pyproject.toml
  • Version pinning: minimum version bound only (requires = ["poetry-core>=2.0.0"]), build backend poetry.core.masonry.api
  • Manifest location: pyproject.toml
  • Check plan: vulnerability lookup: poetry-core / PyPI / 2.0.0

Runtime Python Dependency: configobj

  • Name: configobj
  • Origin: https://pypi.org/project/configobj/
  • Version: >=5.0
  • Where version came from: pinned in pyproject.toml
  • Version pinning: minimum bound only (no upper pin). pyproject.toml contains an explicit inline comment noting: "versions of configobj earlier than 5.0.9 suffer from CVE-2023-26112, ReDoS attack, but we don't care because we don't use validation."
  • Manifest location: pyproject.toml
  • Check plan: vulnerability lookup: configobj / PyPI / 5.0

Runtime Python Dependency: CT3

  • Name: CT3 (Cheetah3 template engine fork)
  • Origin: https://pypi.org/project/CT3/
  • Version: >=3.1
  • Where version came from: pinned in pyproject.toml
  • Version pinning: minimum bound only (no upper pin)
  • Manifest location: pyproject.toml
  • Check plan: vulnerability lookup: CT3 / PyPI / 3.1

Runtime Python Dependency: Pillow

  • Name: Pillow
  • Origin: https://pypi.org/project/Pillow/
  • Version: >=5.2
  • Where version came from: pinned in pyproject.toml
  • Version pinning: minimum bound only (no upper pin)
  • Manifest location: pyproject.toml
  • Check plan: vulnerability lookup: Pillow / PyPI / 5.2

Runtime Python Dependency: ephem

  • Name: ephem
  • Origin: https://pypi.org/project/ephem/
  • Version: >=4.1
  • Where version came from: pinned in pyproject.toml
  • Version pinning: minimum bound only (no upper pin)
  • Manifest location: pyproject.toml
  • Check plan: vulnerability lookup: ephem / PyPI / 4.1

Runtime Python Dependency: PyMySQL

  • Name: PyMySQL
  • Origin: https://pypi.org/project/PyMySQL/
  • Version: >=1.0
  • Where version came from: pinned in pyproject.toml
  • Version pinning: minimum bound only (no upper pin)
  • Manifest location: pyproject.toml
  • Check plan: vulnerability lookup: PyMySQL / PyPI / 1.0

Runtime Python Dependency: pyserial

  • Name: pyserial
  • Origin: https://pypi.org/project/pyserial/
  • Version: >=3.4
  • Where version came from: pinned in pyproject.toml
  • Version pinning: minimum bound only (no upper pin)
  • Manifest location: pyproject.toml
  • Check plan: vulnerability lookup: pyserial / PyPI / 3.4

Runtime Python Dependency: pyusb

  • Name: pyusb
  • Origin: https://pypi.org/project/pyusb/
  • Version: >=1.0.2
  • Where version came from: pinned in pyproject.toml
  • Version pinning: minimum bound only (no upper pin)
  • Manifest location: pyproject.toml
  • Check plan: vulnerability lookup: pyusb / PyPI / 1.0.2

Development Dependency Group: cryptography

  • Name: cryptography
  • Origin: https://pypi.org/project/cryptography/
  • Version: not stated
  • Where version came from: not stated (listed without version constraints under dependency-groups.dev in pyproject.toml)
  • Version pinning: completely unpinned
  • Manifest location: pyproject.toml
  • Check plan: not checkable: unpinned version

Development Dependency Group: zensical

  • Name: zensical
  • Origin: https://pypi.org/project/zensical/
  • Version: not stated
  • Where version came from: not stated (listed without version constraints under dependency-groups.dev in pyproject.toml)
  • Version pinning: completely unpinned
  • Manifest location: pyproject.toml
  • Check plan: not checkable: unpinned version

Development Dependency Group: poetry

  • Name: poetry
  • Origin: https://pypi.org/project/poetry/
  • Version: not stated
  • Where version came from: not stated (listed without version constraints under dependency-groups.dev in pyproject.toml)
  • Version pinning: completely unpinned
  • Manifest location: pyproject.toml
  • Check plan: not checkable: unpinned version

Development Dependency Group: pytest

  • Name: pytest
  • Origin: https://pypi.org/project/pytest/
  • Version: not stated
  • Where version came from: not stated (listed without version constraints under dependency-groups.dev in pyproject.toml)
  • Version pinning: completely unpinned
  • Manifest location: pyproject.toml
  • Check plan: not checkable: unpinned version

Database Backends

  • SQLite: embedded file-based database engine bundled in standard Python runtime; version not stated in sources.
  • MySQL: optional network database engine accessed via PyMySQL; server version not stated in sources.
  • InfluxDB: time-series database integration mentioned in README.md; version not stated in sources.
  • Check plan: support-status lookup: SQLite 3

Network Exposure and Protocols

  • Device connectivity: Host connects via local Ethernet (802.3) or Wi-Fi (802.11) to local network and the Internet.
  • Listening services and open ports: The project documentation does not specify any default inbound listening network ports opened directly by the core daemon (weewxd). README.md notes that WeeWX "generates plots, HTML pages, and monthly and yearly summary reports" and can "push plots, pages, and reports to a web server", implying local file rendering or uploading rather than hosting an integrated HTTP listening server.
  • Outbound publishing protocols:
    • File transfer: Uploads generated HTML reports and plot imagery via FTP (port 21), FTPS (port 990/explicit), or rsync over SSH (port 22).
    • Messaging: MQTT client publishing (typically outbound to broker on port 1883 or TLS port 8883).
    • Database publishing: Remote MySQL connections (TCP port 3306) and InfluxDB HTTP/HTTPS API (port 8086).
    • Online weather cloud services: README.md identifies explicit outbound synchronization to third-party APIs including The Weather Underground, CWOP (Citizen Weather Observer Program / APRS-IS), PWSweather, UK Met Office WOW, WOW-BE, AWEKAS, Windy, OpenWeatherMap, WeatherBug, Weather Cloud, Wetter, and Windfinder.
  • Default credentials: None stated in the sources. Authentication relies on user-supplied credentials for remote databases, MQTT brokers, FTP hosts, and weather service API tokens.

Documentation and External URLs

External web resources and repositories referenced across README.md and pyproject.toml:

Fabrication Specifications

No custom circuit boards, bare printed circuit board layouts, or mechanical manufacturing files exist for this project. Layer count, board dimensions, trace widths, copper weight, and solder mask details are not applicable. Physical fabrication is limited to external mounting hardware for consumer weather stations (e.g., mast clamps, U-bolts, solar radiation shields, and tripod mountings).