Klipper 3D Printer Control Stack (Moonraker + Mainsail)

This lab explores modern additive manufacturing architectures by deploying and configuring a multi-tier 3D printer control stack comprising Klipper firmware, the Moonraker API middleware, and the Mainsail web dashboard. Operating across a dual-tier hardware platform that pairs a Linux-based single-board computer with a real-time microcontroller mainboard, students configure inter-process communication via Unix domain sockets and establish REST and WebSocket APIs for machine telemetry. Participants learn how host-level kinematic computation decouples from microcontroller pulse execution, interface peripheral sensors and camera video streams, and monitor real-time G-code execution and machine state diagnostics through a modern web application.

3D printing additive manufacturing Klipper Moonraker Mainsail single-board computer SBC Raspberry Pi microcontroller MCU motion control embedded Linux REST API WebSocket G-code stepper motor control firmware BIGTREETECH

Uploaded by demo on 2026-09-03 · ready · Electronics · Original source ↗

Files: klipper_README.md · mainsail_README.md · mainsail_package.json · moonraker_README.md · moonraker_SECURITY.md · moonraker_pyproject.toml

Readiness checks

  • complete 2026-09-03 03:49 🛡 Cybersecurity: Review before networking · 11 findings 7 searches · 9 pages
    view · PDF

Latest report — 2026-09-03 03:49

Readiness: Klipper 3D Printer Control Stack (Moonraker + Mainsail)

Verdict: Ready · 2026-09-03 · est. parts cost $70–$194 (required items; optional webcam and smart plug add about $27–$122) Cybersecurity — software & network: Review before networking

Every hardware line in this lab is a current, commodity item stocked by several sellers at ordinary retail prices — no obsolescence, no single-sourcing, and no stock problem anywhere in the bill of materials. The bill of materials is also unusually forgiving: it names categories (a Linux single-board computer, a Klipper-supported mainboard, a UVC webcam) rather than specific manufacturer part numbers, so substitution latitude is wide on every line. This is the cold check — there is no previous report for this lab, so the prices and availability below establish the baseline that the next check will measure drift against. The attention this lab needs is on its software and network posture, not on sourcing its parts.

Action required

None — all checked parts are sourceable.

Cybersecurity — software & network

Review before networking — Every tier resolved to pinned dependencies and was checked, but eight advisories (three high severity) and three network-posture defaults stand between this stack and a shared network.

Component Version How known Support status
Klipper (firmware + Klippy host daemon) not determined unpinned (installed from a git checkout of github.com/Klipper3d/klipper; the lab materials pin no tag or commit) —
Moonraker (API server) not determined unpinned (version is generated from git SCM by the PDM backend at build time (pyproject.toml source = scm); no static version exists to check) —
Mainsail (web frontend) 2.19.0 read from project (package.json name/version literal, confirmed by extraction; the repo also ships package-lock.json (901 pinned rows fetched this run), so Mainsail's caret ranges do resolve to pinned versions - the snapshot's 'no lockfile is provided' note is out of date) —
Node.js (Mainsail build/runtime) 20.19.0 inferred (lower bound of the engines constraint '^20.19.0 || >=22.12.0' in package.json) unsupported since 2026-04-30
Python (Moonraker runtime) 3.10 inferred (lower bound of requires-python '>=3.10' in Moonraker's pyproject.toml) supported until 2026-10-31
Jinja2 (Klippy G-code macros) 2.11.3 read from project (klippy-requirements.txt) —
setuptools (Klippy) 78.1.1 read from project (klippy-requirements.txt (applied on Python 3.12 and newer)) —
pyserial (Klippy MCU link) 3.4 read from project (klippy-requirements.txt) —
python-can (Klippy CAN bus link) 3.3.4 read from project (klippy-requirements.txt) —
tornado (Moonraker HTTP/WebSocket server) 6.5.8 read from project (uv.lock) —
Jinja2 (Moonraker) 3.1.6 read from project (uv.lock) —
zeroconf (Moonraker mDNS discovery) 0.150.0 read from project (uv.lock) —
paho-mqtt (Moonraker MQTT) 2.1.0 read from project (uv.lock) —
ldap3 (Moonraker LDAP authentication) 2.9.1 read from project (uv.lock) —
pillow (Moonraker image handling) 12.3.0 read from project (uv.lock) —
streaming-form-data (Moonraker file uploads) 2.1.0 read from project (uv.lock) —
vuetify (Mainsail UI framework) 2.7.2 read from project (package-lock.json) —
vue (Mainsail UI framework) 2.7.16 read from project (package-lock.json) —
echarts (Mainsail charts) 5.6.0 read from project (package-lock.json) —
nanoid (Mainsail, transitive) 3.3.16 read from project (package-lock.json) —
dompurify (Mainsail HTML sanitiser) 3.4.13 read from project (package-lock.json) —
hls.js (Mainsail video streaming) 1.6.16 read from project (package-lock.json) —
axios (Mainsail HTTP client) 1.18.1 read from project (package-lock.json) —
browserslist (Mainsail build toolchain, dev-only) 4.28.4 read from project (package-lock.json) —
vue-template-compiler (Mainsail build toolchain, dev-only) 2.7.16 read from project (package-lock.json) —
Component Finding Severity Fix available?
browserslist (Mainsail build toolchain, dev-only) The build toolchain used to compile Mainsail can crash or grow memory without bound on untrusted input; this affects whoever rebuilds Mainsail from source, not the printer at run time. — GHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx high Yes - update to 4.28.7
nanoid (Mainsail, transitive) A helper library bundled into the Mainsail interface can loop indefinitely when asked for a zero-length ID, which can hang the page. — GHSA-2v37-7h3g-55p8 high Yes - update to 3.3.18
vuetify (Mainsail UI framework) The version of Vuetify the Mainsail interface is built from has a prototype-pollution flaw and a cross-site scripting flaw in its date-picker, both reachable from the printer's web interface in a student's browser. — GHSA-3jp5-5f8r-q2wg, GHSA-9w3x-85mw-4fwm high No - project pins vue ^2.7.10 (package.json); the fixes only exist in Vuetify 3, which requires a move to Vue 3 upstream.
echarts (Mainsail charts) The charting library drawing Mainsail's temperature graphs has a cross-site scripting flaw. — GHSA-fgmj-fm8m-jvvx moderate No - project pins echarts ^5.5.0 (package.json); the fix lands in 6.1.0, outside that range.
Jinja2 (Klippy G-code macros) Klipper pins a 2021-era Jinja2 for its G-code macro engine; it carries four advisories including two template sandbox escapes, which matter if students or downloaded configs supply macro text the instructor has not reviewed. — GHSA-q2x7-8rv6-6q7h, GHSA-h75v-3vvj-5mfj, GHSA-h5c8-rqwp-cp95, GHSA-cpwx-vrp4-4pq7 moderate No - project pins Jinja2==2.11.3 (klippy-requirements.txt); treat printer.cfg macros as trusted code and review anything pasted in from the internet.
setuptools (Klippy) A packaging-time file-exclusion bypass on macOS filesystems; it affects building source distributions, not a Klipper install running on the Raspberry Pi. — GHSA-h35f-9h28-mq5c moderate No - project pins setuptools==78.1.1 (klippy-requirements.txt); no action needed for this lab's deployment.
vue-template-compiler (Mainsail build toolchain, dev-only) The Vue 2 template compiler has an unfixed cross-site scripting issue; it runs at build time only and is not shipped to the browser. — GHSA-g3ch-rx76-35fx moderate Mitigation only - no fixed version exists; build Mainsail only from the official repository.
vue (Mainsail UI framework) Vue 2's HTML parser can be slowed to a crawl by a crafted template, a denial-of-service rather than a data exposure. — GHSA-5j4c-8p2g-v4jx low No - project pins vue ^2.7.10 (package.json); the fix is in Vue 3.
Moonraker (API server) Moonraker's documented default binds the HTTP API to every IPv4 interface (host: 0.0.0.0) on port 7125 in clear text; the HTTPS listener on 7130 starts only if a certificate and key are configured, so printer control and G-code uploads cross the network unencrypted by default. posture Mitigation only - keep the printer on an isolated lab network or VLAN, and configure the SSL certificate and key options if the interface must cross networks.
Moonraker (API server) Moonraker does not require a user login by default (force_logins: False) and ships with no trusted_clients entries, so access control rests entirely on whatever the operator configures after install. posture Mitigation only - create a Moonraker user and set force_logins: True, and list only the instructor workstations or the lab subnet in trusted_clients.
Node.js (Mainsail build/runtime) The lower bound of Mainsail's engines constraint lands on Node.js 20, whose support ended 2026-04-30, so a build following the stated minimum runs on an end-of-life runtime. posture Yes - update to Node.js 22.12.0 or later, which the project's own engines constraint '^20.19.0 || >=22.12.0' already allows.

What this means for your lab

Moonraker is the service that actually drives the printer, and by default it listens on every network interface of the host computer on port 7125 in plain, unencrypted HTTP, with no login required until you turn one on. Anyone who can reach that address - any other machine on the same network - can therefore drive the printer: start and stop jobs, move the axes, set heater temperatures, and upload or download G-code files. Before this goes anywhere near a shared campus network, put the printer on an isolated lab network or VLAN, create a Moonraker user and set force_logins to True, list only the instructor workstations in trusted_clients, and raise it with campus IT before giving the device a routable address. Build the web interface with Node.js 22 rather than Node 20, which stopped receiving support in April 2026. The vulnerabilities found are mostly in the browser-side interface and the build tooling rather than in the printer control path; the two Vuetify ones cannot be fixed locally, because the fix only exists in a newer major version that Mainsail has not moved to yet.

Not checked

  • MainsailOS: no version stated in the lab materials; the prebuilt image bundles its own OS and application versions, none of which were pinned for this check
  • FluiddPi: no version stated in the lab materials
  • prind (Docker deployment suite): no version or image tag stated in the lab materials
  • Klipper firmware/Klippy itself: installed from an unpinned git checkout, so there is no release version to check against an advisory database; its pinned Python dependencies were checked
  • Moonraker itself: version is generated from git SCM at build time, so there is no static version to check; its locked Python dependencies were checked via uv.lock
  • pdm-backend: declared as a build-system requirement, so it is not part of the parsed runtime dependency set or uv.lock and no version was resolved this run
  • Host OS (Raspberry Pi OS / Debian): no OS version or release codename stated in the lab materials, so no support-status lookup was possible
  • moonraker-timelapse plugin: external plugin repository named in the snapshot with no version stated; no manifest was fetched for it this run
  • 398 further dependencies in package-lock.json: beyond the 500-dependency automatic check cap (e.g. commander, common-tags, concat-map, convert-source-map, core-js-compat)

Parts

Bill of Materials and Hardware Requirements

Part Spec/Package Status Stock Price Source
Host Single-Board Computer Raspberry Pi 4 Model B, 2 GB or 4 GB; 5.0–5.1 V DC, 2.5–3.0 A Readily available In stock, many sellers $35.00 (capacity not stated in listing); $61.05 confirmed 4 GB Seeed Studio; Vilros
3D Printer Microcontroller Mainboard BIGTREETECH SKR series or any Klipper-supported MCU board; 12 V or 24 V DC bus Readily available In stock, many sellers $32.05 (SKR V1.4); $39.99 (SKR Mini E3 V3.0) BIQU 3D; Micro Center
Host-to-MCU Serial/USB Interface Cable USB 2.0 A to B data cable, data lines wired Readily available In stock, many sellers $3.29 (right-angle A end); $10.67 (straight) USBGear; Walmart
USB / CSI Webcam or Video Streamer (optional) UVC USB webcam or Pi Camera Module; 5 V USB or 3.3 V CSI Readily available In stock, many sellers $13.29; $19.99 Walmart; Best Buy
External Power Control Relay / Smart Plug (optional) Tasmota / TP-Link HTTP API switch or GPIO relay; 110–240 V AC, 10–15 A Readily available In stock, many sellers $14.00 (SONOFF S31); $19.99 (Tasmota pre-flashed) CloudFree; eBay

Notes on the rows above, from the judge:

  • Raspberry Pi: the $35.00 listing does not state its memory capacity, so it is not confirmed as the 2 GB or 4 GB variant the lab calls for; $61.05 is the cheapest listing that explicitly says 4 GB. Listings from $130.00 to $165.00 are desktop/starter kits that bundle a power supply, case and SD card.
  • Mainboard: a $3.79 listing for an "SKR Mini E3 V3.0" also appeared. It is an order of magnitude below every other listing of the same board and should be treated as an accessory or a bad feed price, not as the board — the realistic floor is about $32. The boards priced above cover the STM32, LPC176x and RP2040 families the snapshot lists as Klipper-supported.
  • USB cable: the highest-ranked search results included a USB 3.0 A-to-A cable and a Micro-B to USB-C hard-drive cable. Both are the wrong connector type and are excluded; the prices given are for genuine A-to-B data cables. The low-priced USBGear items have a right-angle A connector.
  • Webcam: UVC compliance is not stated in any listing and no product page was fetched, so it is unverified. Confirm UVC support before ordering in quantity.
  • Smart plug: the SONOFF S31 listing does not state that it ships pre-flashed with Tasmota; the $19.99 eBay listing does. A Shelly Plug Gen4 ($24.99, Best Buy) also appeared but uses a control protocol the snapshot does not name.

Substitutes

None needed.

Other dependencies

  • github.com/Klipper3d/klipper — reachable this run (the scripts/ directory listed, 49 entries).
  • github.com/Arksine/moonraker — reachable this run (repository root listed, 18 entries).
  • github.com/mainsail-crew/mainsail — reachable this run (repository root listed, 31 entries).
  • klipper3d.org, moonraker.readthedocs.io, docs.mainsail.xyz — not checked (no page fetched this run).
  • github.com/mainsail-crew/moonraker-timelapse (external plugin) — not checked.
  • Board fabrication — not applicable. The snapshot records no PCB layout files, Gerber data, or board geometry; this is a software and configuration repository.

Watch list

  • Raspberry Pi 4 Model B — the oldest hardware line here and the one most exposed to supply swings and to being superseded; Pi 4 pricing has historically moved more than the rest of this BOM. Watch whether the sub-$40 listings still exist next check, and whether they state a memory capacity.
  • BIGTREETECH mainboards — model churn rather than scarcity is the risk. Specific SKR revisions get replaced regularly, so expect the exact board named here to rotate even while the category stays cheap and plentiful.
  • Optional webcam — the UVC claim is still unverified. If the lab depends on the camera, confirm UVC support on a specific model and pin that model, rather than re-checking the category.
  • Tasmota smart plugs — availability of pre-flashed units is thinner than the category overall, and vendors change what they ship pre-flashed without notice.
Snapshot What the lab depended on when it was uploaded — the baseline the readiness checks research against.

This project deploys the Klipper 3D Printer Control Stack, an embedded control and web-management architecture combining the Klipper microcontroller firmware and Klippy host daemon, the Moonraker Python 3/Tornado REST and WebSocket API web server, and the Mainsail responsive Vue.js/Vuetify web client. The architecture relies on a dual-tier hardware platform: a general-purpose host computer (typically a Linux single-board computer such as a Raspberry Pi) operating at 5 V DC logic, interfaced via USB or serial UART to one or more 3D printer microcontroller mainboards (such as BIGTREETECH mainboards) powered by a 12 V DC or 24 V DC main actuator/heater power bus. While the repository provides software packaging manifests, build definitions, and system integration documentation, it contains no electronic schematic sheets, CAD PCB layout files, or discrete component reference designators (R, C, Q, U).

Bill of Materials and Hardware Requirements

No schematic, PCB netlist, or discrete electronic component elements exist in the source repository. The physical deployment described across the stack documentation requires the following system-level hardware modules, electromechanical components, and interfaces:

  • Host Single-Board Computer (SBC)

    • Identity: Raspberry Pi 3 Model B+, Raspberry Pi 4 Model B, or Raspberry Pi Zero 2 W (described in documentation as target host for MainsailOS and FluiddPi images).
    • Quantity needed: 1.
    • Footprint/package: Single-board computer chassis/form-factor.
    • Electrical constraints: 5.0 V DC to 5.1 V DC supply rail via USB-C or micro-USB, minimum 2.5 A to 3.0 A current capability. Logic I/O operates at 3.3 V LVTTL.
    • Substitution latitude: Any 64-bit or 32-bit ARM/x86 general-purpose computer capable of running a supported Linux distribution (Debian/Raspbian) with Python ≥ 3.10 and Node.js ≥ 20.19.0.
    • Operator control: Host board; non-operator control during print execution (reboot/shutdown controlled via software).
    • Sourcing plan: retail shopping search: Raspberry Pi 4 Model B 2GB or 4GB

  • 3D Printer Microcontroller Mainboard

    • Identity: BIGTREETECH 3D printer control mainboard (explicitly identified in documentation as the official hardware partner of Mainsail, e.g., BIGTREETECH SKR series or Octopus series) or any Klipper-supported MCU board (STM32, RP2040, LPC176x, ATmega2560).
    • Quantity needed: 1 (or more microcontrollers for multi-MCU printer builds).
    • Footprint/package: 3D printer mainboard mounting form-factor.
    • Electrical constraints: Powered via primary DC power supply rail at 12 V DC or 24 V DC; onboard buck/LDO regulators supply 5 V and 3.3 V MCU logic rails.
    • Substitution latitude: Any microcontroller board supported by Klipper's firmware compilation toolchain with adequate stepper driver sockets/ICs and heater MOSFETs.
    • Operator control: Non-operated during normal operation (maintains emergency stop or reset buttons).
    • Sourcing plan: retail shopping search: BIGTREETECH 3D printer motherboard

  • Host-to-MCU Serial/USB Interface Cable

    • Identity: USB Type-A to USB Type-B, Micro-USB, or USB-C data cable (depending on MCU board connector).
    • Quantity needed: 1 per microcontroller board.
    • Footprint/package: Standard molded USB cable assembly.
    • Electrical constraints: 5 V VBUS line, differential USB 2.0 D+/D- signaling (or direct 3.3 V UART TX/RX lines). Must have data lines wired (not a charge-only cable).
    • Substitution latitude: Direct UART connection via SBC GPIO pins (3.3 V logic) or standard USB data cable.
    • Operator control: Fixed interconnect; not an operated control.
    • Sourcing plan: retail shopping search: USB A to USB B high speed shielded data cable

  • USB / CSI Webcam or Video Streamer

    • Identity: Multi-webcam support specified in Mainsail documentation; USB UVC-compatible webcam or Raspberry Pi Camera Module.
    • Quantity needed: 1 or more (optional, based on user monitoring configuration).
    • Footprint/package: Camera module / USB peripheral.
    • Electrical constraints: 5 V DC USB powered or 3.3 V CSI ribbon interface.
    • Substitution latitude: Any UVC-compliant USB video camera or RTSP/HLS/MJPEG network video streamer.
    • Operator control: Set-and-forget alignment; not an active operator control.
    • Sourcing plan: retail shopping search: 1080p UVC USB webcam

  • External Power Control Relay / Smart Plug

    • Identity: Mainsail-supported power control hardware (relays, Tasmota Wi-Fi switches, or TP-Link Kasa smart plugs as cited in documentation).
    • Quantity needed: 1 (optional, for printer power management).
    • Footprint/package: Inline AC smart plug or DIN-rail / chassis relay module.
    • Electrical constraints: Rated for local mains AC voltage (110 V to 240 V AC, 10 A to 15 A).
    • Substitution latitude: Any network-switchable power outlet supporting Tasmota, TP-Link HTTP API, or GPIO-switched 5 V relay module compatible with Moonraker.
    • Operator control: Switched remotely via web interface or manual override push-button.
    • Sourcing plan: retail shopping search: Tasmota compatible Wi-Fi smart plug relay

Software and network dependencies

The software stack consists of three tiers: the low-level Klipper firmware/daemon, the Moonraker Python API server, and the Mainsail client-side web application.

  • Platform and Operating System Images

    • MainsailOS: Raspberry Pi operating system distribution image bundling Klipper, Moonraker, and Mainsail. Source: repository at https://github.com/mainsail-crew/MainsailOS. Version: not stated in documentation. Pinned: no version constraint stated. Check plan: not checkable: version not stated.
    • FluiddPi: Raspberry Pi distribution image bundling Klipper, Moonraker, and Fluidd. Source: repository at https://github.com/fluidd-core/FluiddPi. Version: not stated in documentation. Pinned: no version constraint stated. Check plan: not checkable: version not stated.
    • prind: Docker containerized deployment suite for running Klipper and Moonraker. Source: repository at https://github.com/mkuf/prind. Version: not stated in documentation. Pinned: no version constraint stated. Check plan: not checkable: version not stated.

  • Core Applications and Firmware

    • Klipper: Core 3D printer host daemon (Klippy) and microcontroller firmware. Source: repository at https://github.com/KevinOConnor/klipper. Version: not stated in documentation. Pinned: unpinned (no tag or commit specified). Check plan: not checkable: version not stated.
    • Moonraker: Python-based API server for Klipper. Source: repository at https://github.com/Arksine/moonraker. Version: dynamically generated from Git SCM via PDM backend (source = "scm", writes to moonraker/version.py in moonraker_pyproject.toml); version not stated as a static literal. Check plan: not checkable: unpinned dynamic version.
    • Mainsail: Responsive web frontend for Klipper/Moonraker. Source: repository at https://github.com/mainsail-crew/mainsail. Version: 2.19.0, pinned in mainsail_package.json. Check plan: vulnerability lookup: mainsail / npm / 2.19.0.

  • Runtime Engines and Build Systems

    • Node.js: Required runtime for building and serving Mainsail. Engine constraint: ^20.19.0 || >=22.12.0, pinned in mainsail_package.json. Check plan: support-status lookup: Node.js 20.19.0.
    • Python: Required runtime for Moonraker. Engine constraint: >=3.10 (supported up to Python 3.14 per classifiers), pinned in moonraker_pyproject.toml. Check plan: support-status lookup: Python 3.10.
    • pdm-backend: Build backend for Moonraker. Version: <=2.4.9, pinned in moonraker_pyproject.toml. Check plan: vulnerability lookup: pdm-backend / PyPI / 2.4.9.

  • Moonraker Runtime Dependencies (Manifest: moonraker_pyproject.toml)

    • tornado: Version >=6.2.0,<=6.5.8, pinned in moonraker_pyproject.toml. Check plan: vulnerability lookup: tornado / PyPI / 6.5.8.
    • pyserial: Version ==3.4, pinned in moonraker_pyproject.toml. Check plan: vulnerability lookup: pyserial / PyPI / 3.4.
    • pillow: Version >=9.5.0,<=12.3.0, pinned in moonraker_pyproject.toml. Check plan: vulnerability lookup: pillow / PyPI / 12.3.0.
    • streaming-form-data: Version >=1.11.0, <=2.1.0, pinned in moonraker_pyproject.toml. Check plan: vulnerability lookup: streaming-form-data / PyPI / 2.1.0.
    • distro: Version ==1.9.0, pinned in moonraker_pyproject.toml. Check plan: vulnerability lookup: distro / PyPI / 1.9.0.
    • inotify-simple: Version ==2.0.1, pinned in moonraker_pyproject.toml. Check plan: vulnerability lookup: inotify-simple / PyPI / 2.0.1.
    • libnacl: Version ==2.1.0, pinned in moonraker_pyproject.toml. Check plan: vulnerability lookup: libnacl / PyPI / 2.1.0.
    • paho-mqtt: Version ==2.1.0, pinned in moonraker_pyproject.toml. Check plan: vulnerability lookup: paho-mqtt / PyPI / 2.1.0.
    • zeroconf: Version >=0.131.0, <=0.150.0, pinned in moonraker_pyproject.toml (build variable sets SKIP_CYTHON=1). Check plan: vulnerability lookup: zeroconf / PyPI / 0.150.0.
    • preprocess-cancellation: Version ==0.2.1, pinned in moonraker_pyproject.toml. Check plan: vulnerability lookup: preprocess-cancellation / PyPI / 0.2.1.
    • jinja2: Version ==3.1.6, pinned in moonraker_pyproject.toml. Check plan: vulnerability lookup: jinja2 / PyPI / 3.1.6.
    • dbus-fast: Version >=2.21.3, <=5.0.22, pinned in moonraker_pyproject.toml. Check plan: vulnerability lookup: dbus-fast / PyPI / 5.0.22.
    • apprise: Version >=1.9.3,<=1.13.0, pinned in moonraker_pyproject.toml. Check plan: vulnerability lookup: apprise / PyPI / 1.13.0.
    • ldap3: Version ==2.9.1, pinned in moonraker_pyproject.toml. Check plan: vulnerability lookup: ldap3 / PyPI / 2.9.1.
    • python-periphery: Version ==2.4.1, pinned in moonraker_pyproject.toml. Check plan: vulnerability lookup: python-periphery / PyPI / 2.4.1.
    • importlib_metadata: Version >=6.7.0, <=9.0.0, pinned in moonraker_pyproject.toml. Check plan: vulnerability lookup: importlib-metadata / PyPI / 9.0.0.
    • msgspec (optional speedup): Version >=0.18.4, pinned in moonraker_pyproject.toml. Check plan: vulnerability lookup: msgspec / PyPI / 0.18.4.
    • uvloop (optional speedup): Version >=0.17.0, pinned in moonraker_pyproject.toml. Check plan: vulnerability lookup: uvloop / PyPI / 0.17.0.
    • mkdocs-material (docs dependency): Version ==9.7.7, pinned in moonraker_pyproject.toml. Check plan: vulnerability lookup: mkdocs-material / PyPI / 9.7.7.
    • pymdown-extensions (docs dependency): Version ~=11.0.0, pinned in moonraker_pyproject.toml. Check plan: vulnerability lookup: pymdown-extensions / PyPI / 11.0.0.
    • compact_tables (docs dependency): Git repository https://github.com/Arksine/markdown-compact-tables, pinned at tag v1.1.0 in moonraker_pyproject.toml. Check plan: vulnerability lookup: markdown-compact-tables / PyPI / 1.1.0.
    • pre-commit, mypy, ruff, build (dev dependencies): Stated in moonraker_pyproject.toml without version specifiers (unpinned). Check plan: not checkable: unpinned version.

  • Mainsail Production Dependencies (Manifest: mainsail_package.json)

    • All packages are specified using npm caret ranges (^), which install non-pinned updates within the major version because no lockfile (package-lock.json) is provided:
    • vue: Version ^2.7.10, pinned in mainsail_package.json. Check plan: vulnerability lookup: vue / npm / 2.7.10.
    • vuetify: Version ^2.7.2, pinned in mainsail_package.json. Check plan: vulnerability lookup: vuetify / npm / 2.7.2.
    • vuex: Version ^3.6.2, pinned in mainsail_package.json. Check plan: vulnerability lookup: vuex / npm / 3.6.2.
    • vue-i18n: Version ^8.28.2, pinned in mainsail_package.json. Check plan: vulnerability lookup: vue-i18n / npm / 8.28.2.
    • vue-class-component: Version ^7.2.6, pinned in mainsail_package.json. Check plan: vulnerability lookup: vue-class-component / npm / 7.2.6.
    • vue-property-decorator: Version ^9.1.2, pinned in mainsail_package.json. Check plan: vulnerability lookup: vue-property-decorator / npm / 9.1.2.
    • vue-echarts: Version ^6.0.2, pinned in mainsail_package.json. Check plan: vulnerability lookup: vue-echarts / npm / 6.0.2.
    • vue-inline-svg: Version ^2.1.3, pinned in mainsail_package.json. Check plan: vulnerability lookup: vue-inline-svg / npm / 2.1.3.
    • vue-load-image: Version ^0.2.0, pinned in mainsail_package.json. Check plan: vulnerability lookup: vue-load-image / npm / 0.2.0.
    • vue-observe-visibility: Version ^1.0.0, pinned in mainsail_package.json. Check plan: vulnerability lookup: vue-observe-visibility / npm / 1.0.0.
    • vue-toast-notification: Version ^1.0.1, pinned in mainsail_package.json. Check plan: vulnerability lookup: vue-toast-notification / npm / 1.0.1.
    • vuedraggable: Version ^2.24.3, pinned in mainsail_package.json. Check plan: vulnerability lookup: vuedraggable / npm / 2.24.3.
    • axios: Version ^1.16.0, pinned in mainsail_package.json. Check plan: vulnerability lookup: axios / npm / 1.16.0.
    • codemirror: Version ^6.0.1, pinned in mainsail_package.json. Check plan: vulnerability lookup: codemirror / npm / 6.0.1.
    • @codemirror/commands: Version ^6.0.1, pinned in mainsail_package.json. Check plan: vulnerability lookup: @codemirror/commands / npm / 6.0.1.
    • @codemirror/lang-css: Version ^6.0.0, pinned in mainsail_package.json. Check plan: vulnerability lookup: @codemirror/lang-css / npm / 6.0.0.
    • @codemirror/lang-json: Version ^6.0.0, pinned in mainsail_package.json. Check plan: vulnerability lookup: @codemirror/lang-json / npm / 6.0.0.
    • @codemirror/lang-yaml: Version ^6.1.3, pinned in mainsail_package.json. Check plan: vulnerability lookup: @codemirror/lang-yaml / npm / 6.1.3.
    • @codemirror/language: Version ^6.2.0, pinned in mainsail_package.json. Check plan: vulnerability lookup: @codemirror/language / npm / 6.2.0.
    • @codemirror/legacy-modes: Version ^6.1.0, pinned in mainsail_package.json. Check plan: vulnerability lookup: @codemirror/legacy-modes / npm / 6.1.0.
    • @codemirror/search: Version ^6.0.0, pinned in mainsail_package.json. Check plan: vulnerability lookup: @codemirror/search / npm / 6.0.0.
    • @codemirror/state: Version ^6.1.0, pinned in mainsail_package.json. Check plan: vulnerability lookup: @codemirror/state / npm / 6.1.0.
    • @codemirror/view: Version ^6.0.3, pinned in mainsail_package.json. Check plan: vulnerability lookup: @codemirror/view / npm / 6.0.3.
    • @jaames/iro: Version ^5.5.2, pinned in mainsail_package.json. Check plan: vulnerability lookup: @jaames/iro / npm / 5.5.2.
    • @lezer/highlight: Version ^1.0.0, pinned in mainsail_package.json. Check plan: vulnerability lookup: @lezer/highlight / npm / 1.0.0.
    • @sindarius/gcodeviewer: Version ^3.7.18, pinned in mainsail_package.json. Check plan: vulnerability lookup: @sindarius/gcodeviewer / npm / 3.7.18.
    • @uiw/codemirror-theme-vscode: Version ^4.23.13, pinned in mainsail_package.json. Check plan: vulnerability lookup: @uiw/codemirror-theme-vscode / npm / 4.23.13.
    • core-js: Version ^3.16.0, pinned in mainsail_package.json. Check plan: vulnerability lookup: core-js / npm / 3.16.0.
    • detect-browser: Version ^5.3.0, pinned in mainsail_package.json. Check plan: vulnerability lookup: detect-browser / npm / 5.3.0.
    • dompurify: Version ^3.4.13, pinned in mainsail_package.json. Check plan: vulnerability lookup: dompurify / npm / 3.4.13.
    • echarts: Version ^5.5.0, pinned in mainsail_package.json. Check plan: vulnerability lookup: echarts / npm / 5.5.0.
    • echarts-gl: Version ^2.0.8, pinned in mainsail_package.json. Check plan: vulnerability lookup: echarts-gl / npm / 2.0.8.
    • hls.js: Version ^1.3.3, pinned in mainsail_package.json. Check plan: vulnerability lookup: hls.js / npm / 1.3.3.
    • jmuxer: Version ^2.0.5, pinned in mainsail_package.json. Check plan: vulnerability lookup: jmuxer / npm / 2.0.5.
    • js-sha256: Version ^0.11.1, pinned in mainsail_package.json. Check plan: vulnerability lookup: js-sha256 / npm / 0.11.1.
    • lodash.kebabcase: Version ^4.1.1, pinned in mainsail_package.json. Check plan: vulnerability lookup: lodash.kebabcase / npm / 4.1.1.
    • lodash.throttle: Version ^4.1.1, pinned in mainsail_package.json. Check plan: vulnerability lookup: lodash.throttle / npm / 4.1.1.
    • overlayscrollbars: Version ^1.13.1, pinned in mainsail_package.json. Check plan: vulnerability lookup: overlayscrollbars / npm / 1.13.1.
    • overlayscrollbars-vue: Version ^0.2.2, pinned in mainsail_package.json. Check plan: vulnerability lookup: overlayscrollbars-vue / npm / 0.2.2.
    • regenerator-runtime: Version ^0.14.0, pinned in mainsail_package.json. Check plan: vulnerability lookup: regenerator-runtime / npm / 0.14.0.
    • resize-observer-polyfill: Version ^1.5.1, pinned in mainsail_package.json. Check plan: vulnerability lookup: resize-observer-polyfill / npm / 1.5.1.
    • semver: Version ^7.5.2, pinned in mainsail_package.json. Check plan: vulnerability lookup: semver / npm / 7.5.2.
    • typed_janus_js: Version ^1.0.14, pinned in mainsail_package.json. Check plan: vulnerability lookup: typed_janus_js / npm / 1.0.14.
    • uuid: Version ^14.0.0, pinned in mainsail_package.json. Check plan: vulnerability lookup: uuid / npm / 14.0.0.

  • Mainsail Dev/Build Dependencies (Manifest: mainsail_package.json)

    • vite: Version ^8.1.2, pinned in mainsail_package.json. Check plan: vulnerability lookup: vite / npm / 8.1.2.
    • typescript: Version ^6.0.3, pinned in mainsail_package.json. Check plan: vulnerability lookup: typescript / npm / 6.0.3.
    • cypress: Version ^15.15.0, pinned in mainsail_package.json. Check plan: vulnerability lookup: cypress / npm / 15.15.0.
    • vitest: Version ^4.0.0, pinned in mainsail_package.json. Check plan: vulnerability lookup: vitest / npm / 4.0.0.
    • eslint: Version ^10.0.0, pinned in mainsail_package.json. Check plan: vulnerability lookup: eslint / npm / 10.0.0.
    • sass: Version ^1.97.2, pinned in mainsail_package.json. Check plan: vulnerability lookup: sass / npm / 1.97.2.
    • postcss: Version ^8.5.23, pinned in mainsail_package.json. Check plan: vulnerability lookup: postcss / npm / 8.5.23.
    • prettier: Version ^3.3.3, pinned in mainsail_package.json. Check plan: vulnerability lookup: prettier / npm / 3.3.3.
    • vue-template-compiler: Version ^2.7.16, pinned in mainsail_package.json. Check plan: vulnerability lookup: vue-template-compiler / npm / 2.7.16.
    • vue-router: Version ^3.5.2, pinned in mainsail_package.json. Check plan: vulnerability lookup: vue-router / npm / 3.5.2.
    • workbox-core: Version ^7.0.0, pinned in mainsail_package.json. Check plan: vulnerability lookup: workbox-core / npm / 7.0.0.
    • unplugin-vue-components: Version ^0.22.12, pinned in mainsail_package.json. Check plan: vulnerability lookup: unplugin-vue-components / npm / 0.22.12.
    • vite-plugin-pwa: Version ^1.3.0, pinned in mainsail_package.json. Check plan: vulnerability lookup: vite-plugin-pwa / npm / 1.3.0.
    • start-server-and-test: Version ^3.0.11, pinned in mainsail_package.json. Check plan: vulnerability lookup: start-server-and-test / npm / 3.0.11.

  • Package Dependency Overrides (Manifest: mainsail_package.json)

    • minimatch@>=9.0.0 <9.0.7 overridden to ~9.0.7
    • brace-expansion@<1.1.17 overridden to ~1.1.17
    • brace-expansion@>=2.0.0 <2.1.3 overridden to ~2.1.3
    • brace-expansion@>=4.0.0 <5.0.8 overridden to ^5.0.8
    • typed_janus_js overridden to require lodash >=4.17.23

  • Network Exposure and Protocol Requirements

    • Host IPC: Moonraker communicates with the Klippy host daemon locally over a Unix Domain Socket (stated in moonraker_README.md). No network exposure on this link.
    • HTTP/WebSocket API: Moonraker uses Tornado to expose REST APIs and JSON-RPC over WebSockets to client applications (stated in moonraker_README.md). Default listening port is not stated in the sources (standard ecosystem default is 7125, but unstated here).
    • Frontend Dev/Preview Server: Mainsail runs a local test/preview server bound to http://127.0.0.1:4173/ (cited in mainsail_package.json test script).
    • Remote Hosted UI: Documentation states Mainsail is hosted remotely at http://my.mainsail.xyz for connecting over the local network or browser (stated in mainsail_README.md).
    • Network Services & Protocols: Moonraker includes modules for Zeroconf/mDNS service discovery (zeroconf), MQTT pub/sub messaging (paho-mqtt), and LDAP directory authentication (ldap3).
    • Streaming Video: Web client connects to video streams over HTTP/WebSocket utilizing HLS (hls.js), raw stream parsing (jmuxer), and WebRTC via Janus (typed_janus_js).
    • Default Credentials: None stated in the sources. Authentication management is configured via Moonraker database/LDAP or trusted local network CIDR blocks.

Remaining Temporal Dependencies