FarmBot Open-Source Farming Robot

This lab explores agricultural robotics and full-stack Internet of Things systems engineering using the open-source FarmBot platform. Students examine the software and hardware integration required for an automated farming robot, configuring an embedded Linux environment built with Elixir and the Nerves framework on a Raspberry Pi single-board computer to interface with machine peripherals over GPIO, UART, and I2C buses. They connect the embedded controller to a distributed management stack utilizing a Ruby on Rails backend, MQTT brokering for real-time telemetry and motion command dispatching, and a React and TypeScript frontend featuring 3D digital-twin visualization. Through setting up and validating these communication layers, students learn embedded operating system deployment, event-driven robotic control, asynchronous network messaging, and web-based automation applied to precision agriculture.

agricultural robotics precision agriculture Internet of Things IoT embedded systems Raspberry Pi single-board computer Nerves framework Elixir Ruby on Rails MQTT React TypeScript GPIO UART I2C robotics automation real-time telemetry

Uploaded by demo on 2026-09-03 · ready · Electronics · Original source ↗

Files: Gemfile · farmbot_os_README.md · mix.exs · webapp_README.md · webapp_package.json

Readiness checks

  • complete 2026-09-03 15:52 🛡 Cybersecurity: Do not place on an open network · 12 findings 88 searches · 18 pages
    view · PDF

Latest report — 2026-09-03 15:52

Readiness: FarmBot Open-Source Farming Robot

Verdict: Ready with caveats · 2026-09-03 · est. parts cost $13.28–$75.00 (controller board only; the host server is unpriced and no electromechanical BOM was uploaded) Cybersecurity — software & network: Do not place on an open network

This is the cold check for this lab — it establishes the baseline every future report will measure drift against. Every part the snapshot actually lists is easy to buy today and none is anywhere near end of production: all three Raspberry Pi controller options carry Raspberry Pi obsolescence statements running to 2030 or 2034, bare boards run $13.28 to $75.00 depending on which target you build for, and the host server is ordinary commodity hardware or a cloud instance. Nothing needed a substitute. The verdict is not a clean "Ready" for two reasons. First, this upload is the FarmBot software tree only: it contains no schematics, board files, Gerbers or parts list for the machine itself, so the motors, motor drivers, encoders, solenoid valves, gantry extrusions and power distribution that make a FarmBot move were never in scope and cannot be called ready or not ready. Second, the host machine is deliberately left unpriced because no specific machine or instance was chosen. An instructor can stand up the control software from these materials; they cannot build the robot from them.

Action required

None — all checked parts are sourceable.

Cybersecurity — software & network

Do not place on an open network — The device firmware runs on an end-of-life Erlang runtime with no fix path, ships a publicly known remote-connection secret alongside an enabled SSH daemon, and carries several high-severity flaws in the web stack it exposes on the network.

Component Version How known Support status
FarmBot OS (device firmware) 15.5.2 read from project (VERSION file in the farmbot_os repository (fetched/08-VERSION)) —
Elixir 1.16.2 read from project (.tool-versions (fetched/06-.tool-versions); ELIXIR_VERSION states the range ~> 1.16.2) supported
Erlang/OTP 26.2.5 read from project (.tool-versions (fetched/06-.tool-versions)) unsupported since 2026-05-26
Nerves system targets (farmbot_system_rpi / rpi3 / rpi4) v1.23.1-farmbot.1 inferred (git tag declared in mix.exs; mix.lock pins commits f3d3f1da4ca9 / 12835da22dd5 / 09062dde96d6) —
cowboy (device HTTP server) 2.12.0 read from project (mix.lock (fetched/04-mix.lock); transitive under plug_cowboy) —
cowlib 2.13.0 read from project (mix.lock (fetched/04-mix.lock)) —
plug 1.15.3 read from project (mix.lock (fetched/04-mix.lock)) —
plug_cowboy 2.7.1 read from project (mix.lock; mix.exs declares the constraint ~> 2.7) —
tesla (device HTTP client) 1.9.0 read from project (mix.lock; mix.exs declares the constraint ~> 1.9) —
hackney (HTTP transport under tesla) 1.20.1 read from project (mix.lock; mix.exs declares the constraint ~> 1.20) —
decimal 2.1.1 read from project (mix.lock; transitive under ecto) —
tortoise311 (device MQTT client) 0.11.7 read from project (mix.lock (fetched/04-mix.lock)) —
vintage_net_wifi 0.12.5 read from project (mix.lock (fetched/04-mix.lock)) —
mdns_lite (local network discovery) 0.8.8 read from project (mix.lock (fetched/04-mix.lock)) —
cors_plug 3.0.3 read from project (mix.lock (fetched/04-mix.lock)) —
nerves_runtime 0.13.6 read from project (mix.lock (fetched/04-mix.lock)) —
Ruby (web app runtime) 4.0.6 read from project (.ruby-version (fetched/09-.ruby-version) and the RUBY VERSION block of Gemfile.lock) supported until 2029-03-31
Ruby on Rails 8.1.3.1 read from project (Gemfile.lock (fetched/01-Gemfile.lock); the Gemfile itself declares no constraint) —
Devise (web app authentication) 5.0.4 read from project (Gemfile.lock (fetched/01-Gemfile.lock)) —
Phusion Passenger (application server) 6.2.0 read from project (Gemfile.lock (fetched/01-Gemfile.lock)) —
nokogiri 1.19.4 read from project (Gemfile.lock pins eight platform-specific builds of 1.19.4) —
PostgreSQL 17 read from project (docker-compose.yml pins the image postgres:17 (fetched/10-docker-compose.yml)) supported until 2029-11-08
Valkey (Redis-compatible cache) 9.0 read from project (docker-compose.yml pins the image valkey/valkey:9.0 (fetched/10-docker-compose.yml)) —
RabbitMQ / MQTT broker not determined not determined (docker-compose.yml builds it from docker_configs/rabbitmq.Dockerfile, which was not fetched, so no version is on record) —
Bun (frontend toolchain and runtime) not determined unpinned (package.json declares packageManager bun@1.x, a range rather than a pin) —
React (web frontend) 19.2.8 read from project (package.json (fetched/03-package.json)) —
TypeScript 6.0.3 read from project (package.json; the @typescript/native entry additionally aliases typescript 7.0.2, which was checked separately) —
Component Finding Severity Fix available?
cowboy 2.12.0 The web server FarmBot OS runs on the Raspberry Pi can be driven into denial of service by malformed multipart or duplicated headers, and used for HTTP request and response splitting, by anyone who can reach its port. — GHSA-jfc2-q6qh-g5x8, GHSA-w4f7-4cxr-rv3c, EEF-CVE-2026-65624 high Yes — update to 2.18.0
cowlib 2.13.0 The protocol library beneath the device's web server can be made to exhaust the Raspberry Pi's memory with a single crafted compressed or oversized-header request, and allows CRLF and cookie injection. — GHSA-84f2-rp86-235p, GHSA-32p9-57cr-4x65, GHSA-hv23-4qp7-8c8r, GHSA-g2wm-735q-3f56 (+2 more) high Mitigation only — updating to 2.19.0 clears four of the seven; three have no fixed release, so keep the device off untrusted networks
hackney 1.20.1 The HTTP transport underneath the device's web client has a server-side request forgery bypass, header injection, and a TLS upgrade with no timeout that can hang a connection indefinitely. — GHSA-gp9c-pm5m-5cxr, GHSA-j9wq-vxxc-94wf, GHSA-pj7v-xfvx-wmjq, GHSA-vq52-99r9-h5pw (+2 more) high No — project pins hackney ~> 1.20 in mix.exs; the fixes for the high-severity issues ship in 4.0.1
plug 1.15.3 The device's request-handling layer can be exhausted by multipart uploads and deeply nested query parameters, and allows cookie attribute injection, all reachable without logging in. — GHSA-468c-vq7p-gh64, EEF-CVE-2026-56813, EEF-CVE-2026-56814, EEF-CVE-2026-54892 high Yes — update to 1.19.5
plug_cowboy 2.7.1 An unauthenticated attacker on the same network can crash the device's web server with HTTP/2 requests that exhaust the Erlang atom table. — GHSA-q8x4-x7mp-5vg2 high Yes — update to 2.8.1
tesla 1.9.0 The HTTP client the device uses to reach the web app leaks its Authorization header when a request is redirected to another origin, and can be crashed by an oversized compressed response. — GHSA-9m9w-gxf7-rh8m, GHSA-h74c-q9j7-mpcm, GHSA-mc85-72gr-vm9f, GHSA-28jh-g32x-v9v4 (+1 more) high Yes — update to 1.18.3
decimal 2.1.1 A number with an oversized exponent makes this library allocate without bound, which an unauthenticated request carrying such a value could trigger on the device. — GHSA-rhv4-8758-jx7v moderate Mitigation only — the fix is decimal 3.0.0, a major bump pulled in transitively through ecto; verify ecto compatibility before updating
nokogiri 1.19.4 Eight XML-parsing advisories match the platform-specific nokogiri builds pinned in Gemfile.lock, but every one of them names 1.19.4 as its fixed version, the same release the lockfile pins, so this most likely reflects how platform suffixes sort rather than a live exposure. — GHSA-5prr-v3j2-97mh, GHSA-8678-w3jw-xfc2, GHSA-5v8h-3h3q-446p, GHSA-9cv2-cfxc-v4v2 (+2 more) moderate Mitigation only — confirm the installed nokogiri build reports 1.19.4 or later; no upgrade beyond the current pin is indicated
Erlang/OTP 26.2.5 The device firmware is built on Erlang/OTP 26, whose support ended on 2026-05-26, so no further security fixes are published for the runtime that FarmBot OS itself runs on. posture No — requires platform migration
FarmBot OS release configuration The firmware ships a hardcoded Erlang distribution cookie, the literal string 'democookie' (mix.exs line 63), and enables the Erlang SSH daemon (:ssh in extra_applications, mix.exs line 90); that cookie is the shared secret authorising a remote connection to the running node, and it is published in the source for anyone to read. posture Mitigation only — set a unique release cookie before building firmware and keep the device on an isolated network segment
Self-hosted web app broker (docker-compose) The self-hosted stack publishes the message broker straight to the host: ports 1883 (plaintext MQTT), 8883, 5672 (AMQP), 3002 (MQTT over WebSockets) and 15672 (the RabbitMQ management web interface), so anything that can route to the server can reach all of them. posture Mitigation only — bind these ports to localhost or a private interface and firewall the host; never expose 1883 or 15672 to a campus or public network
Web app Gemfile 49 of the 50 gems in the web app's Gemfile carry no version constraint at all, so a bundle update can move the entire Rails stack without review; the committed Gemfile.lock does pin all 184 resolved gems and is what was checked here. posture Mitigation only — install from the committed Gemfile.lock (bundle install --deployment) and review any bundle update

What this means for your lab

Treat this as equipment that must not sit on a shared campus or public network. The FarmBot controller runs a web server and an SSH service on the Raspberry Pi, and the firmware ships with a published connection secret (the literal word 'democookie') that is meant to be replaced before you build an image; leave it as shipped and anyone who can reach the device on the network can attach to the software running it and command the machine. The device's web and HTTP libraries also have known flaws that let a stranger crash it with a single malformed request, and the Erlang runtime it is built on stopped receiving security fixes in May 2026, so those will not be patched for you. If you self-host the web app, the default compose file also opens the message broker and its administration web page directly to the network. What to do: put the FarmBot and its server on their own isolated network segment or VLAN with no inbound access from outside, set your own release cookie and your own admin, database and Devise secrets before deploying, install the Ruby side from the committed lockfile rather than letting it pull the newest gems, and talk to campus IT before connecting any of it to the institutional network. Nothing here means the software is unusable in a lab - it means it should be run on a network you control.

Not checked

  • FarmBot Web App frontend transitive dependencies (bun.lock): bun.lock is not a lockfile format this pipeline parses; only the 95 direct pins in package.json were checked
  • RabbitMQ / MQTT broker image: version not determined - the compose file builds it from docker_configs/rabbitmq.Dockerfile, which was not fetched
  • Bun runtime: unpinned - package.json declares bun@1.x, a range, so there is no version to check
  • farmbot_system_rpi / farmbot_system_rpi3 / farmbot_system_rpi4: source-hosted GitHub dependencies pinned by git tag and commit; no package registry and no advisory database covers them
  • Linux kernel and Buildroot userland inside the Nerves firmware images: the built firmware images were not fetched or unpacked, so only the Elixir and Erlang layer above them was checked
  • Ubuntu Server (host operating system): no version is stated anywhere in the project or the snapshot, so no support-status lookup was possible
  • example.env: not a dependency manifest - the parser classified this environment-variable template as a requirements file, so its 60 rows are variable names, not packages, and no versions were checked from it

Parts

Bill of Materials

Part Spec/Package Status Stock Price Source
Raspberry Pi 4 Model B (RPi 4 target) SBC 85 × 56 mm, BCM2711, 5.0–5.25 V DC ≥ 3.0 A via USB-C, 3.3 V GPIO; 2/4/8 GB all acceptable for farmbot_system_rpi4 readily available; production guaranteed to 01 Jan 2034 not stated by retail listings $55.00 (2 GB) · $75.00 (8 GB) PiShop USA (2 GB), CanaKit.com (8 GB)
Raspberry Pi 3 Model B / B+ (RPi 3 target) SBC 85 × 56 mm, BCM2837/BCM2837B0, 5.0–5.25 V DC ≥ 2.5 A via Micro-USB, 3.3 V GPIO; farmbot_system_rpi3 readily available; B+ production guaranteed to 01 Jan 2030 (plain 3 Model B ends 01 Jan 2028 — prefer the B+) not stated by retail listings $40.00 · $52.59 PiShop USA, Best Buy
Raspberry Pi Zero W / Zero WH (RPi 1 / Zero target) SBC 65 × 30 mm, BCM2835 ARMv6, 5.0 V DC ≥ 1.2 A via Micro-USB, 3.3 V GPIO; farmbot_system_rpi readily available; Zero W/WH production guaranteed to 01 Jan 2030 not stated by retail listings $13.28 · $15.00 · $16.00 (Zero WH) JAK Electronics, Seeed Studio
Raspberry Pi 1 Model B+ (same RPi 1 / Zero target, wired only) SBC 85 × 56 mm, BCM2835 ARMv6, 512 MB; named on this BOM line by the snapshot; no Wi-Fi readily available; production guaranteed to 01 Jan 2030 not stated by retail listing $25.00 DigiKey
Host Application Server Machine Generic x86_64 Linux host or cloud VM; ≥ 2 cores, 4 GB RAM; Ubuntu Server with Docker, Ruby, PostgreSQL readily available (commodity); price not checked — no specific machine or instance chosen — — —
Electromechanical BOM (motors, motor drivers, encoders, solenoid valves, gantry extrusions, power distribution) — not checked — — —

Two near-match traps appeared in the shopping results and are recorded here so a future check does not mistake them for price movement. The $25.00 DigiKey listing "Raspberry Pi Model B+ 512MB RAM" surfaced under the Pi 3 Model B+ search but is the 2014 Pi 1 Model B+ — a different board, priced in its own row above. And the "Raspberry Pi Zero 2 W" listings at $18.00 and $28.93 surfaced under the Zero W search; the snapshot restricts that BOM line to the ARMv6 BCM2835 architecture the farmbot_system_rpi target builds for, so the Zero 2 W is out of spec, not a cheaper equivalent.

Substitutes

None needed.

Other dependencies

Watch list

  • The missing electromechanical BOM. Until the lab's hardware files are uploaded, every re-check will keep reporting the same three Raspberry Pi boards and nothing about the machine. Getting the parts list into the lab materials is worth more than any sourcing action in this report.
  • Raspberry Pi Zero W / Pi 1 Model B+ (the ARMv6 target). These are the oldest boards in the list and the ones a supplier is most likely to quietly swap for a Zero 2 W, which the farmbot_system_rpi build does not target. Check what actually arrives, and watch for the 01 Jan 2030 end-of-production date coming into view.
  • Raspberry Pi 3 Model B+. Now priced at or above a Pi 4 2 GB in several listings, so its cost advantage is gone; if that persists, standardising on the Pi 4 target is the cheaper and longer-lived choice (2034 versus 2030).
  • Retail-only pricing. All three boards were priced from consumer shopping listings rather than an authorized distributor catalog, so stock levels are unknown and prices move faster than distributor pricing. Expect noisier drift on these rows than on a typical BOM.
  • Host server sizing. Unpriced this run by design. Once a specific machine or cloud instance is chosen, record it so the next check has a baseline.
Snapshot What the lab depended on when it was uploaded — the baseline the readiness checks research against.

The FarmBot Open-Source Farming Robot project represented in this upload comprises the software control layers of an automated agricultural machine, consisting of FarmBot OS (an embedded Linux operating system built with Elixir and the Nerves framework for Raspberry Pi single-board computers) and the FarmBot Web App (a full-stack web management system featuring a Ruby on Rails RESTful API backend, PostgreSQL database, MQTT real-time messaging, and a React/TypeScript web frontend bundled via Bun). The physical embedded controller runs on a 5 V DC nominal power rail (typically 5.1 V DC at 2.5 A to 3.0 A via Micro-USB or USB-C) and interfaces with external peripherals, motor controllers, and sensor hardware over 3.3 V logic levels via standard Raspberry Pi 40-pin GPIO headers, UART, and I2C buses. The server backend runs on standard x86_64 Linux infrastructure (recommended Ubuntu Server). No PCB schematics, Gerber layouts, wiring harnesses, or electromechanical component BOMs (such as stepper motors, motor drivers, gantry extrusions, or solenoid valves) were provided in this upload.

Bill of Materials

Raspberry Pi Single-Board Computer (RPi 4 Target)

  • Identity: Raspberry Pi Foundation, Raspberry Pi 4 Model B (Broadcom BCM2711)
  • Quantity: 1 (primary target option)
  • Footprint/package: Single-board computer, 85 mm x 56 mm
  • Electrical constraints: 5.0 V to 5.25 V DC input (minimum 3.0 A) via USB-C; 3.3 V LVCMOS logic on 40-pin GPIO header; operating rails 5 V, 3.3 V, 1.8 V internal
  • Substitution latitude: Must be compatible with the Nerves system target farmbot_system_rpi4. Raspberry Pi 4 Model B (2 GB, 4 GB, or 8 GB RAM) or Raspberry Pi Compute Module 4 with carrier board are functional equivalents.
  • Operated control: No (automated embedded SBC)
  • Sourcing plan: retail shopping search: Raspberry Pi 4 Model B

Raspberry Pi Single-Board Computer (RPi 3 Target)

  • Identity: Raspberry Pi Foundation, Raspberry Pi 3 Model B or Raspberry Pi 3 Model B+ (Broadcom BCM2837/BCM2837B0)
  • Quantity: 1 (alternative target option)
  • Footprint/package: Single-board computer, 85 mm x 56 mm
  • Electrical constraints: 5.0 V to 5.25 V DC input (minimum 2.5 A) via Micro-USB; 3.3 V LVCMOS logic on 40-pin GPIO header
  • Substitution latitude: Must be compatible with the Nerves system target farmbot_system_rpi3. Raspberry Pi 3 Model B or Model B+ supported.
  • Operated control: No (automated embedded SBC)
  • Sourcing plan: retail shopping search: Raspberry Pi 3 Model B+

Raspberry Pi Single-Board Computer (RPi 1 / Zero Target)

  • Identity: Raspberry Pi Foundation, Raspberry Pi Zero W / Zero WH / Model B+ (Broadcom BCM2835)
  • Quantity: 1 (legacy / low-power alternative target option)
  • Footprint/package: Single-board computer, 65 mm x 30 mm (Zero) or 85 mm x 56 mm (Model B+)
  • Electrical constraints: 5.0 V DC input (minimum 1.2 A) via Micro-USB; 3.3 V LVCMOS logic on GPIO header
  • Substitution latitude: Must be compatible with the Nerves system target farmbot_system_rpi (ARMv6 BCM2835 architecture).
  • Operated control: No (automated embedded SBC)
  • Sourcing plan: retail shopping search: Raspberry Pi Zero W

Host Application Server Machine

  • Identity: Generic x86_64 host computer or cloud virtual machine running Linux (Ubuntu Server recommended per documentation)
  • Quantity: 1 (required for self-hosting the Web App)
  • Footprint/package: Server chassis, desktop workstation, or cloud compute instance
  • Electrical constraints: Standard mains power supply (100-240 V AC) or datacenter cloud instance; minimum 2 CPU cores, 4 GB RAM recommended for running Rails, PostgreSQL, Redis, and MQTT broker
  • Substitution latitude: Any standard Linux 64-bit compute platform running Ubuntu Server or a compatible distribution supporting Docker, Ruby, and PostgreSQL
  • Operated control: Yes (system administrator terminal/console)
  • Sourcing plan: general web research: Ubuntu Linux server hosting instance

Hardware Fabrication and Assembly Note

  • No printed circuit boards (Gerber files, drill files, KiCad PCB, Eagle BRD) or circuit schematics are present in this repository upload. Downstream physical build checking for motor drivers, rotary encoders, solenoid valves, and power distribution boards cannot be performed from the files provided.

Software and network dependencies

FarmBot OS Firmware and Nerves Systems

  • FarmBot OS Core Application: Repository https://github.com/Farmbot/farmbot_os, module FarmbotOS, version not stated (mix.exs attempts to read version dynamically from a missing VERSION file). Manifest location: mix.exs. Check plan: not checkable: version not stated in manifest.
  • Elixir Runtime: Specification defined dynamically in mix.exs via missing file ELIXIR_VERSION; version not stated. Manifest location: mix.exs. Check plan: not checkable: version not stated in manifest.
  • Nerves Bootstrap Archive: nerves_bootstrap, Hex package, version ~> 1.12, pinned in mix.exs line 23. Check plan: vulnerability lookup: nerves_bootstrap / hex / ~> 1.12.
  • Nerves System (RPi 4 Target): farmbot_system_rpi4, source repository https://github.com/FarmBot/farmbot_system_rpi4, version v1.23.1-farmbot.1, pinned in mix.exs line 77. Check plan: vulnerability lookup: farmbot_system_rpi4 / github / v1.23.1-farmbot.1.
  • Nerves System (RPi 3 Target): farmbot_system_rpi3, source repository https://github.com/FarmBot/farmbot_system_rpi3, version v1.23.1-farmbot.1, pinned in mix.exs line 72. Check plan: vulnerability lookup: farmbot_system_rpi3 / github / v1.23.1-farmbot.1.
  • Nerves System (RPi Target): farmbot_system_rpi, source repository https://github.com/FarmBot/farmbot_system_rpi, version v1.23.1-farmbot.1, pinned in mix.exs line 67. Check plan: vulnerability lookup: farmbot_system_rpi / github / v1.23.1-farmbot.1.

FarmBot OS Embedded Elixir Dependencies (Manifest: mix.exs) All dependencies are retrieved from Hex.pm unless otherwise specified and are pinned using pessimistic constraints (~>):

  • busybox: version ~> 0.1, pinned in mix.exs (targets: rpi4, rpi3, rpi). Check plan: vulnerability lookup: busybox / hex / ~> 0.1.
  • certifi: version ~> 2.12, pinned in mix.exs. Check plan: vulnerability lookup: certifi / hex / ~> 2.12.
  • circuits_gpio: version ~> 1.1, pinned in mix.exs (targets: rpi4, rpi3, rpi). Check plan: vulnerability lookup: circuits_gpio / hex / ~> 1.1.
  • circuits_i2c: version ~> 2.0, pinned in mix.exs (targets: rpi4, rpi3, rpi). Check plan: vulnerability lookup: circuits_i2c / hex / ~> 2.0.
  • circuits_uart: version ~> 1.5, pinned in mix.exs. Check plan: vulnerability lookup: circuits_uart / hex / ~> 1.5.
  • cors_plug: version ~> 3.0, pinned in mix.exs (targets: rpi4, rpi3, rpi). Check plan: vulnerability lookup: cors_plug / hex / ~> 3.0.
  • dns: version ~> 2.4, pinned in mix.exs. Check plan: vulnerability lookup: dns / hex / ~> 2.4.
  • ecto_sqlite3: version ~> 0.15, pinned in mix.exs. Check plan: vulnerability lookup: ecto_sqlite3 / hex / ~> 0.15.
  • ecto: version ~> 3.11, pinned in mix.exs. Check plan: vulnerability lookup: ecto / hex / ~> 3.11.
  • ex_doc: version ~> 0.32, pinned in mix.exs (dev, host). Check plan: vulnerability lookup: ex_doc / hex / ~> 0.32.
  • excoveralls: version ~> 0.18, pinned in mix.exs (test, host). Check plan: vulnerability lookup: excoveralls / hex / ~> 0.18.
  • junit_formatter: version ~> 3.4, pinned in mix.exs (test). Check plan: vulnerability lookup: junit_formatter / hex / ~> 3.4.
  • extty: version ~> 0.3, pinned in mix.exs. Check plan: vulnerability lookup: extty / hex / ~> 0.3.
  • hackney: version ~> 1.20, pinned in mix.exs. Check plan: vulnerability lookup: hackney / hex / ~> 1.20.
  • jason: version ~> 1.4, pinned in mix.exs. Check plan: vulnerability lookup: jason / hex / ~> 1.4.
  • luerl: version ~> 1.2, pinned in mix.exs. Check plan: vulnerability lookup: luerl / hex / ~> 1.2.
  • mdns_lite: version ~> 0.8, pinned in mix.exs (targets: rpi4, rpi3, rpi). Check plan: vulnerability lookup: mdns_lite / hex / ~> 0.8.
  • mimic: version ~> 1.7, pinned in mix.exs (test). Check plan: vulnerability lookup: mimic / hex / ~> 1.7.
  • mix_unused: version ~> 0.4, pinned in mix.exs (dev). Check plan: vulnerability lookup: mix_unused / hex / ~> 0.4.
  • muontrap: version ~> 1.5, pinned in mix.exs. Check plan: vulnerability lookup: muontrap / hex / ~> 1.5.
  • nerves_runtime: version ~> 0.13, pinned in mix.exs (targets: rpi4, rpi3, rpi). Check plan: vulnerability lookup: nerves_runtime / hex / ~> 0.13.
  • nerves_time: version ~> 0.4, pinned in mix.exs (targets: rpi4, rpi3, rpi). Check plan: vulnerability lookup: nerves_time / hex / ~> 0.4.
  • nerves: version ~> 1.10, pinned in mix.exs. Check plan: vulnerability lookup: nerves / hex / ~> 1.10.
  • phoenix_html: version ~> 4.1, pinned in mix.exs. Check plan: vulnerability lookup: phoenix_html / hex / ~> 4.1.
  • phoenix_html_helpers: version ~> 1.0, pinned in mix.exs. Check plan: vulnerability lookup: phoenix_html_helpers / hex / ~> 1.0.
  • plug_cowboy: version ~> 2.7, pinned in mix.exs. Check plan: vulnerability lookup: plug_cowboy / hex / ~> 2.7.
  • ring_logger: version ~> 0.11, pinned in mix.exs. Check plan: vulnerability lookup: ring_logger / hex / ~> 0.11.
  • rollbax: version ~> 0.11, pinned in mix.exs. Check plan: vulnerability lookup: rollbax / hex / ~> 0.11.
  • shoehorn: version ~> 0.8, pinned in mix.exs. Check plan: vulnerability lookup: shoehorn / hex / ~> 0.8.
  • telemetry: version ~> 1.2, pinned in mix.exs. Check plan: vulnerability lookup: telemetry / hex / ~> 1.2.
  • tesla: version ~> 1.9, pinned in mix.exs. Check plan: vulnerability lookup: tesla / hex / ~> 1.9.
  • timex: version ~> 3.7, pinned in mix.exs. Check plan: vulnerability lookup: timex / hex / ~> 3.7.
  • toolshed: version ~> 0.3, pinned in mix.exs (targets: rpi4, rpi3, rpi). Check plan: vulnerability lookup: toolshed / hex / ~> 0.3.
  • tortoise311: version ~> 0.11, pinned in mix.exs. Check plan: vulnerability lookup: tortoise311 / hex / ~> 0.11.
  • uuid: version ~> 1.1, pinned in mix.exs. Check plan: vulnerability lookup: uuid / hex / ~> 1.1.
  • vintage_net_ethernet: version ~> 0.11, pinned in mix.exs (targets: rpi4, rpi3, rpi). Check plan: vulnerability lookup: vintage_net_ethernet / hex / ~> 0.11.
  • vintage_net_wifi: version ~> 0.12, pinned in mix.exs (targets: rpi4, rpi3, rpi). Check plan: vulnerability lookup: vintage_net_wifi / hex / ~> 0.12.
  • vintage_net: version ~> 0.13, pinned in mix.exs (targets: rpi4, rpi3, rpi). Check plan: vulnerability lookup: vintage_net / hex / ~> 0.13.

FarmBot Web App Backend Dependencies (Manifest: Gemfile) Platform runtime: Ruby ~> 4.0.6, pinned in Gemfile line 2. Check plan: support-status lookup: Ruby ~> 4.0.6. CRITICAL FINDING: In Gemfile, almost all gems are completely UNPINNED with no version constraints. Unless noted as pinned below, each entry installs the latest available version at bundle time:

  • delayed_job: version 4.1.13, pinned in Gemfile line 8. Check plan: vulnerability lookup: delayed_job / rubygems / 4.1.13.
  • rails: version not pinned (unconstrained in Gemfile line 4). Check plan: not checkable: unpinned version.
  • active_model_serializers: version not pinned (unconstrained in Gemfile line 5). Check plan: not checkable: unpinned version.
  • bunny: version not pinned (unconstrained in Gemfile line 6). Check plan: not checkable: unpinned version.
  • delayed_job_active_record: version not pinned (unconstrained in Gemfile line 7). Check plan: not checkable: unpinned version.
  • devise: version not pinned (unconstrained in Gemfile line 9). Check plan: not checkable: unpinned version.
  • discard: version not pinned (unconstrained in Gemfile line 10). Check plan: not checkable: unpinned version.
  • google-cloud-storage: version not pinned (unconstrained in Gemfile line 11). Check plan: not checkable: unpinned version.
  • jwt: version not pinned (unconstrained in Gemfile line 12). Check plan: not checkable: unpinned version.
  • kaminari: version not pinned (unconstrained in Gemfile line 13). Check plan: not checkable: unpinned version.
  • logger: version not pinned (unconstrained in Gemfile line 14). Check plan: not checkable: unpinned version.
  • mutations: version not pinned (unconstrained in Gemfile line 15). Check plan: not checkable: unpinned version.
  • pg: version not pinned (unconstrained in Gemfile line 16). Check plan: not checkable: unpinned version.
  • rabbitmq_http_api_client: version not pinned (unconstrained in Gemfile line 17). Check plan: not checkable: unpinned version.
  • rack-attack: version not pinned (unconstrained in Gemfile line 18). Check plan: not checkable: unpinned version.
  • rack-cors: version not pinned (unconstrained in Gemfile line 19). Check plan: not checkable: unpinned version.
  • redis: version not pinned (unconstrained in Gemfile line 20). Check plan: not checkable: unpinned version.
  • request_store: version not pinned (unconstrained in Gemfile line 21). Check plan: not checkable: unpinned version.
  • rollbar: version not pinned (unconstrained in Gemfile line 22). Check plan: not checkable: unpinned version.
  • scenic: version not pinned (unconstrained in Gemfile line 23). Check plan: not checkable: unpinned version.
  • secure_headers: version not pinned (unconstrained in Gemfile line 24). Check plan: not checkable: unpinned version.
  • tzinfo: version not pinned (unconstrained in Gemfile line 25). Check plan: not checkable: unpinned version.
  • tzinfo-data: version not pinned (unconstrained in Gemfile line 26). Check plan: not checkable: unpinned version.
  • thwait: version not pinned (unconstrained in Gemfile line 27). Check plan: not checkable: unpinned version.
  • lograge: version not pinned (unconstrained in Gemfile line 28). Check plan: not checkable: unpinned version.
  • drb: version not pinned (unconstrained in Gemfile line 29). Check plan: not checkable: unpinned version.
  • benchmark: version not pinned (unconstrained in Gemfile line 30). Check plan: not checkable: unpinned version.
  • ostruct: version not pinned (unconstrained in Gemfile line 31). Check plan: not checkable: unpinned version.
  • bigdecimal: version not pinned (unconstrained in Gemfile line 32). Check plan: not checkable: unpinned version.
  • mutex_m: version not pinned (unconstrained in Gemfile line 33). Check plan: not checkable: unpinned version.
  • tsort: version not pinned (unconstrained in Gemfile line 34). Check plan: not checkable: unpinned version.
  • irb: version not pinned (unconstrained in Gemfile line 35). Check plan: not checkable: unpinned version.
  • passenger: version not pinned (unconstrained in Gemfile line 57). Check plan: not checkable: unpinned version.
  • Development / Test group gems (unpinned in Gemfile lines 38-55): csv, climate_control, database_cleaner, factory_bot_rails, faker, hashdiff, pry-rails, pry, rspec-rails, rspec, rspec_junit_formatter, simplecov, simplecov-cobertura, webmock, rubocop, rubocop-rails, brakeman. Check plan: not checkable: unpinned versions.

FarmBot Web App Frontend Dependencies (Manifest: webapp_package.json) Platform runtime: Bun engine 1.x, packageManager bun@1.x pinned in webapp_package.json. Application version 1.1.0 pinned in webapp_package.json. All runtime dependencies from webapp_package.json are pinned to exact versions:

  • @blueprintjs/core: version 6.18.0, pinned in webapp_package.json. Check plan: vulnerability lookup: @blueprintjs/core / npm / 6.18.0.
  • @blueprintjs/select: version 6.3.4, pinned in webapp_package.json. Check plan: vulnerability lookup: @blueprintjs/select / npm / 6.3.4.
  • @monaco-editor/react: version 4.7.0, pinned in webapp_package.json. Check plan: vulnerability lookup: @monaco-editor/react / npm / 4.7.0.
  • @react-spring/three: version 10.1.2, pinned in webapp_package.json. Check plan: vulnerability lookup: @react-spring/three / npm / 10.1.2.
  • @react-three/drei: version 10.7.8, pinned in webapp_package.json. Check plan: vulnerability lookup: @react-three/drei / npm / 10.7.8.
  • @react-three/fiber: version 9.7.0, pinned in webapp_package.json. Check plan: vulnerability lookup: @react-three/fiber / npm / 9.7.0.
  • @rollbar/react: version 1.0.0, pinned in webapp_package.json. Check plan: vulnerability lookup: @rollbar/react / npm / 1.0.0.
  • @types/bun: version 1.3.14, pinned in webapp_package.json. Check plan: vulnerability lookup: @types/bun / npm / 1.3.14.
  • @types/lodash: version 4.17.25, pinned in webapp_package.json. Check plan: vulnerability lookup: @types/lodash / npm / 4.17.25.
  • @types/markdown-it-emoji: version 3.0.1, pinned in webapp_package.json. Check plan: vulnerability lookup: @types/markdown-it-emoji / npm / 3.0.1.
  • @types/promise-timeout: version 1.3.3, pinned in webapp_package.json. Check plan: vulnerability lookup: @types/promise-timeout / npm / 1.3.3.
  • @types/react: version 19.2.18, pinned in webapp_package.json. Check plan: vulnerability lookup: @types/react / npm / 19.2.18.
  • @types/react-color: version 3.0.13, pinned in webapp_package.json. Check plan: vulnerability lookup: @types/react-color / npm / 3.0.13.
  • @types/react-dom: version 19.2.4, pinned in webapp_package.json. Check plan: vulnerability lookup: @types/react-dom / npm / 19.2.4.
  • @types/react-test-renderer: version 19.1.0, pinned in webapp_package.json. Check plan: vulnerability lookup: @types/react-test-renderer / npm / 19.1.0.
  • @types/redux-immutable-state-invariant: version 2.1.4, pinned in webapp_package.json. Check plan: vulnerability lookup: @types/redux-immutable-state-invariant / npm / 2.1.4.
  • @types/three: version 0.185.4, pinned in webapp_package.json. Check plan: vulnerability lookup: @types/three / npm / 0.185.4.
  • @types/ws: version 8.18.1, pinned in webapp_package.json. Check plan: vulnerability lookup: @types/ws / npm / 8.18.1.
  • @typescript/native: version npm:typescript@7.0.2, pinned in webapp_package.json. Check plan: vulnerability lookup: typescript / npm / 7.0.2.
  • @xterm/xterm: version 6.0.0, pinned in webapp_package.json. Check plan: vulnerability lookup: @xterm/xterm / npm / 6.0.0.
  • axios: version 1.19.0, pinned in webapp_package.json. Check plan: vulnerability lookup: axios / npm / 1.19.0.
  • bowser: version 2.14.1, pinned in webapp_package.json. Check plan: vulnerability lookup: bowser / npm / 2.14.1.
  • browser-speech: version 1.1.1, pinned in webapp_package.json. Check plan: vulnerability lookup: browser-speech / npm / 1.1.1.
  • delaunator: version 5.1.0, pinned in webapp_package.json. Check plan: vulnerability lookup: delaunator / npm / 5.1.0.
  • events: version 3.3.0, pinned in webapp_package.json. Check plan: vulnerability lookup: events / npm / 3.3.0.
  • farmbot: version 15.9.8, pinned in webapp_package.json. Check plan: vulnerability lookup: farmbot / npm / 15.9.8.
  • fengari: version 0.1.5, pinned in webapp_package.json. Check plan: vulnerability lookup: fengari / npm / 0.1.5.
  • fengari-web: version 0.1.4, pinned in webapp_package.json. Check plan: vulnerability lookup: fengari-web / npm / 0.1.4.
  • i18next: version 26.4.0, pinned in webapp_package.json. Check plan: vulnerability lookup: i18next / npm / 26.4.0.
  • lodash: version 4.18.1, pinned in webapp_package.json. Check plan: vulnerability lookup: lodash / npm / 4.18.1.
  • markdown-it: version 15.0.0, pinned in webapp_package.json. Check plan: vulnerability lookup: markdown-it / npm / 15.0.0.
  • markdown-it-emoji: version 3.1.0, pinned in webapp_package.json. Check plan: vulnerability lookup: markdown-it-emoji / npm / 3.1.0.
  • moment: version 2.30.1, pinned in webapp_package.json. Check plan: vulnerability lookup: moment / npm / 2.30.1.
  • monaco-editor: version 0.56.0, pinned in webapp_package.json. Check plan: vulnerability lookup: monaco-editor / npm / 0.56.0.
  • mqtt: version 5.15.2, pinned in webapp_package.json. Check plan: vulnerability lookup: mqtt / npm / 5.15.2.
  • process: version 0.11.10, pinned in webapp_package.json. Check plan: vulnerability lookup: process / npm / 0.11.10.
  • promise-timeout: version 1.3.0, pinned in webapp_package.json. Check plan: vulnerability lookup: promise-timeout / npm / 1.3.0.
  • punycode: version 2.3.1, pinned in webapp_package.json. Check plan: vulnerability lookup: punycode / npm / 2.3.1.
  • querystring-es3: version 0.2.1, pinned in webapp_package.json. Check plan: vulnerability lookup: querystring-es3 / npm / 0.2.1.
  • react: version 19.2.8, pinned in webapp_package.json. Check plan: vulnerability lookup: react / npm / 19.2.8.
  • react-color: version 2.19.3, pinned in webapp_package.json. Check plan: vulnerability lookup: react-color / npm / 2.19.3.
  • react-dom: version 19.2.8, pinned in webapp_package.json. Check plan: vulnerability lookup: react-dom / npm / 19.2.8.
  • react-redux: version 9.3.0, pinned in webapp_package.json. Check plan: vulnerability lookup: react-redux / npm / 9.3.0.
  • react-router: version 8.3.0, pinned in webapp_package.json. Check plan: vulnerability lookup: react-router / npm / 8.3.0.
  • redux: version 5.0.1, pinned in webapp_package.json. Check plan: vulnerability lookup: redux / npm / 5.0.1.
  • redux-immutable-state-invariant: version 2.1.0, pinned in webapp_package.json. Check plan: vulnerability lookup: redux-immutable-state-invariant / npm / 2.1.0.
  • redux-thunk: version 3.1.0, pinned in webapp_package.json. Check plan: vulnerability lookup: redux-thunk / npm / 3.1.0.
  • rollbar: version 3.1.0, pinned in webapp_package.json. Check plan: vulnerability lookup: rollbar / npm / 3.1.0.
  • suncalc: version 2.0.1, pinned in webapp_package.json. Check plan: vulnerability lookup: suncalc / npm / 2.0.1.
  • takeme: version 0.12.0, pinned in webapp_package.json. Check plan: vulnerability lookup: takeme / npm / 0.12.0.
  • three: version 0.185.1, pinned in webapp_package.json. Check plan: vulnerability lookup: three / npm / 0.185.1.
  • typescript: version 6.0.3, pinned in webapp_package.json. Check plan: vulnerability lookup: typescript / npm / 6.0.3.
  • url: version 0.11.4, pinned in webapp_package.json. Check plan: vulnerability lookup: url / npm / 0.11.4.
  • Frontend devDependencies (pinned in webapp_package.json lines 84-126): @eslint/js 10.0.1, @happy-dom/global-registrator 20.11.6, @react-three/eslint-plugin 0.1.2, @testing-library/dom 10.4.1, @testing-library/jest-dom 7.0.1, @testing-library/react 16.3.2, @testing-library/user-event 14.6.5, @types/delaunator 5.0.3, @types/jest 30.0.0, @types/readable-stream 4.0.24, @types/suncalc 1.9.2, @typescript-eslint/eslint-plugin 8.67.0, @typescript-eslint/parser 8.67.0, @unrs/resolver-binding-linux-x64-gnu 1.12.2, eslint 10.8.1, eslint-plugin-eslint-comments 3.2.0, eslint-plugin-import 2.32.0, eslint-plugin-jest 29.16.1, eslint-plugin-no-null 1.0.2, eslint-plugin-promise 7.3.0, eslint-plugin-react 7.37.5, eslint-plugin-react-hooks 7.1.1, happy-dom 20.11.6, jest 30.4.2, jest-canvas-mock 2.5.8, jest-cli 30.4.2, jest-environment-jsdom 30.4.1, jest-junit 17.0.0, jest-skipped-reporter 0.0.5, jshint 2.13.6, madge 8.0.0, path-browserify 1.0.1, playwright 1.62.1, postcss 8.5.26, postcss-scss 4.0.9, raf 3.4.1, react-test-renderer 19.2.8, sass 1.103.0, sass-lint 1.13.1, stylelint 17.14.1, stylelint-config-standard-scss 17.0.0, ts-jest 29.4.12, tslint 6.1.3. Check plan: vulnerability lookup for each package on npm.

Network Exposure and Protocols

  • Network Connectivity: FarmBot OS joins local area networks over Wi-Fi via vintage_net_wifi or wired Ethernet via vintage_net_ethernet.
  • Local Discovery: Broadcasts mDNS announcements using mdns_lite on target builds.
  • Web/HTTP Service: FarmBot OS runs plug_cowboy and cors_plug HTTP server on the embedded device (port not explicitly defined in mix.exs; defaults to 80/4000). The Web App backend runs a Rails RESTful JSON API via Passenger.
  • Real-Time Messaging: FarmBot OS communicates outbound/inbound via MQTT using tortoise311. The frontend connects to a Dockerized MQTT broker using mqtt over WebSockets. The Rails backend communicates with RabbitMQ via bunny and rabbitmq_http_api_client.
  • Remote Shell Access: FarmBot OS enables Erlang SSH (:ssh added to extra_applications in mix.exs).
  • Security and Default Credentials: The Erlang release distribution cookie is hardcoded in mix.exs line 48 to "democookie". In webapp_README.md, RSA encryption keys are auto-generated or loaded from ENV['RSA_KEY'] / local .pem files. User authentication is handled by Devise over the web interface; no hardcoded default user passwords are documented in the manifests.

External Downloads and URLs

Fabrication Specifications

  • Board Layer Count: Not stated (no PCB CAD files, Gerber archives, or fabrication documents provided).
  • Board Dimensions: Not stated (no physical layout geometries present in repository upload).