Meshtastic LoRa Mesh Radio Node

This lab explores decentralized, off-grid wireless communication and remote sensing by building and configuring a Meshtastic LoRa mesh radio node. Students assemble and program an embedded hardware platform integrating a 32-bit microcontroller, a Sub-GHz spread-spectrum LoRa transceiver, an OLED display, and optional environmental telemetry sensors covering temperature, humidity, pressure, and air quality. Throughout the lab, students configure radio operational parameters, observe multi-hop mesh packet routing across unlicensed ISM bands, interface digital sensor buses over I2C and SPI, and evaluate low-power power management profiles. Students gain hands-on experience in wireless sensor networks, spread-spectrum radio frequency modulation, embedded firmware deployment, serial CLI administration, and modern cryptographic protections for mesh communication.

LoRa Long Range radio mesh networking Meshtastic wireless sensor networks WSN Internet of Things IoT ESP32 SX1262 embedded systems telemetry Sub-GHz RF communication I2C PlatformIO

Uploaded by demo on 2026-09-03 · ready · Electronics · Original source ↗

Files: firmware_README.md · firmware_SECURITY.md · firmware_platformio.ini · python_cli_README.md

Readiness checks

  • complete 2026-09-03 03:11 🛡 Cybersecurity: Do not place on an open network · 21 findings 54 searches · 10 pages
    view · PDF

Latest report — 2026-09-03 03:11

Readiness: Meshtastic LoRa Mesh Radio Node

Verdict: Ready with caveats · 2026-09-03 · est. parts cost $35–$60 per core node (optional telemetry sensors add $1.40–$54 each) Cybersecurity — software & network: Do not place on an open network

This is the cold check — no previous readiness report exists for this lab, so every price, stock level and lifecycle status below establishes the baseline that the next check will measure drift against. The core node is fully sourceable today: the Heltec WiFi LoRa 32 V3 is listed by the vendor at $17.90–$19.90 with no end-of-life notice and sells through US resellers at $28.57–$35.99, and the antenna, U.FL-to-SMA pigtail, 1S LiPo and USB-C data cable are all commodity items in stock. The caveats are entirely in the optional telemetry-sensor menu: two sensors are obsolete (DPS310XTSA1, TSL2561FN), one is discontinued with no authorized stock anywhere (LTR-390UV-01), one is Not For New Designs (BH1750FVI-TR), and two BOM part numbers (SCD41-2090, WS2812B-B) are listed by no authorized distributor at all. A further group of bare sensor ICs has zero distributor stock with 8–45 week factory lead times, but the snapshot explicitly permits breakout modules for each of them and those breakouts are Active and in stock.

Action required

Part Problem Recommended action
DPS310XTSA1 Obsolete at Infineon; zero stock at Newark, Mouser and DigiKey (14-week factory lead); ECIA lifecycle risk High Substitute DPS368XTSA1 ($2.70, 196 in stock) — identical package and supply rail, but confirm absolute-vs-gauge pressure reference and Adafruit DPS310 library support first. See Substitutes.
TSL2561FN Obsolete; zero stock at DigiKey (16-week lead) and Mouser; ECIA lifecycle risk High Switch the optional light sensor to TSL25911FN ($1.74, 29,061 in stock), which this lab already supports as its own BOM line and driver. Not a footprint drop-in.
LTR-390UV-01 "Discontinued at DigiKey"; zero stock at Avnet, Mouser and DigiKey (18-week lead) No verified substitute found — this is the BOM's only UV-capable sensor. Source manually or drop the UV module from the exercise.
SCD41-2090 No authorized distributor lists this part number (DigiKey 0 results; ECIA "no authorized distributor") Order SCD41-D-R2 ($20.54, 13,032 in stock) — Sensirion's actual catalog code for this sensor.
WS2812B-B No authorized distributor lists this part number (DigiKey 0 results; ECIA "no authorized distributor") Order a generic 5050 WS2812B: SparkFun 16347 ($0.68, 196,668 in stock). Confirm the 3.3 V data-logic threshold from the datasheet.
BH1750FVI-TR Not For New Designs; only one ECIA distributor holds stock Buildable today (2,532 in stock at $3.42) — buy what the course needs now, and expect to switch to VEML7700 or OPT3001 at the next check.
BME280, BME680, BMM150, MPU-6050, ICM-20948 (bare ICs) Zero stock across ECIA-authorized distributors; 8–45 week factory lead times; MPU-6050 and ICM-20948 carry High lifecycle and supply-chain risk Buy the vendor breakout boards the snapshot already permits — all Active and in stock. See Substitutes.
USB Type-A to Type-C cable Heltec's own FAQ states the board reboots intermittently below 600 mA; the snapshot specifies only "minimum 500 mA rated" Specify a data cable rated 600 mA or better. The Adafruit #4474 cable below is forced to 5 V at up to ~2 A.
DFRobot Lark Weather Station Not carried by DigiKey or any ECIA distributor (SKU EDU0157-EN returned 0 results); vendor page carried no price Order direct from DFRobot; price not established this run.

Cybersecurity — software & network

Do not place on an open network — The firmware grants unauthenticated administrative access - including export of the node's private keys - to anyone on its Bluetooth, USB, Wi-Fi or Ethernet interfaces by design, and that has no fix, only isolation.

Component Version How known Support status
Meshtastic firmware (meshtastic/firmware) not determined not determined (The lab's firmware_platformio.ini pins library archives, not a firmware release; its -DAPP_VERSION=1.0.0 is a build placeholder, not the firmware's version.) —
Meshtastic Python client and CLI (meshtastic, PyPI) not determined unpinned (python_cli_README.md installs from PyPI with no version constraint, so an instructor gets whatever is current on the day.) —
PlatformIO Core build toolchain not determined unpinned (firmware_platformio.ini names PlatformIO as the build system without a version.) —
Espressif Arduino core framework not determined unpinned (firmware_platformio.ini line 80 sets framework = arduino with no version.) —
Cppcheck static analysis tool not determined not determined (firmware_platformio.ini line 71 sets check_tool = cppcheck with no version.) —
RadioLib (LoRa transceiver driver) 510e00cfb05bbc3c2b7b524262785454944adb6e inferred (Commit-pinned GitHub archive at firmware_platformio.ini line 105, as recorded in the snapshot; not re-read from a file fetched this run.) —
meshtastic/device-ui (on-device and web UI) 5870d3a55254aa46bbcab13a5a700d533ab304e3 inferred (Commit-pinned GitHub archive at firmware_platformio.ini line 109, as recorded in the snapshot.) —
Nanopb (protocol buffer runtime) 0.4.92 inferred (GitHub tag archive at firmware_platformio.ini line 68, as recorded in the snapshot; PyPI has no such version (see Not checked).) —
TBPubSubClient (MQTT client) v2.12.1 inferred (Tag archive at firmware_platformio.ini line 94, as recorded in the snapshot.) —
NTPClient 3.2.1 inferred (Tag archive at firmware_platformio.ini line 96, as recorded in the snapshot.) —
Syslog (UDP logging client) v2.0 inferred (Tag archive at firmware_platformio.ini line 101, as recorded in the snapshot.) —
Arduino/PlatformIO library set (about 50 further archives) not determined not determined (Each is pinned by git tag or commit in firmware_platformio.ini; none belongs to a package registry with an advisory database.) —
urllib3 2.6.3 read from project (poetry.lock of meshtastic/python, fetched this run) —
click 8.1.8 read from project (poetry.lock of meshtastic/python, fetched this run) —
requests 2.32.5 read from project (poetry.lock of meshtastic/python, fetched this run) —
pillow 11.3.0 read from project (poetry.lock of meshtastic/python, fetched this run (12.0.0 is also pinned there and carries the same advisories)) —
jupyterlab 4.5.7 read from project (poetry.lock of meshtastic/python, fetched this run) —
jupyter-server 2.18.2 read from project (poetry.lock of meshtastic/python, fetched this run (2.19.0 also pinned there, same advisory)) —
mistune 3.2.1 read from project (poetry.lock of meshtastic/python, fetched this run) —
tornado 6.5.6 read from project (poetry.lock of meshtastic/python, fetched this run) —
soupsieve 2.8 read from project (poetry.lock of meshtastic/python, fetched this run) —
pyarrow 18.1.0 read from project (poetry.lock of meshtastic/python, fetched this run (22.0.0 also pinned there, same advisory)) —
bleach 6.3.0 read from project (poetry.lock of meshtastic/python, fetched this run (6.2.0 also pinned there)) —
werkzeug 3.0.6 read from project (poetry.lock of meshtastic/python, fetched this run) —
flask 3.0.3 read from project (poetry.lock of meshtastic/python, fetched this run) —
pytest 8.4.2 read from project (poetry.lock of meshtastic/python, fetched this run) —
setuptools 82.0.1 read from project (poetry.lock of meshtastic/python, fetched this run) —
Component Finding Severity Fix available?
jupyter-server The notebook server pinned in the Meshtastic Python project's poetry.lock stores cross-site scripting through its nbconvert handlers; it runs on the instructor's computer, not on the radio node. — GHSA-fcw5-x6j4-ccmp, CVE-2026-44727 critical Yes - update to 2.20.0
click The command-line parsing library pinned in the project's lockfile lets an unprivileged caller inject operating-system commands through click.edit(). — PYSEC-2026-2132, CVE-2026-7246 high Yes - update to 8.3.3
jupyterlab The notebook environment declared in pyproject.toml has several cross-site scripting and extension-blocklist bypass flaws; it is analysis tooling on the instructor's computer, not firmware on the node. — GHSA-gx64-gj6p-pc4c, GHSA-pppj-hq3g-57pj, GHSA-89vp-jrxv-24w8, GHSA-h5v5-8746-g7mm (+2 more) high Yes - update to 4.5.10
mistune The markdown renderer that comes with the notebook toolchain can be stalled by crafted input and can be tricked into emitting javascript: URLs. — GHSA-qcq2-496w-v96p, GHSA-4j32-57v6-6g45, GHSA-c8j7-8cv4-2xmq, GHSA-ffq3-xpv3-j92q (+2 more) high Yes - update to 3.3.0
pillow The image library used by the project's plotting and notebook extras has several out-of-bounds writes and decompression-bomb bypasses that a malicious image file could trigger on the instructor's computer. — GHSA-xj96-63gp-2gmr, GHSA-pwv6-vv43-88gr, GHSA-jjj6-mw9f-p565, GHSA-6r8x-57c9-28j4 (+2 more) high Yes - update to 12.3.0
pyarrow The data-table library used by the project's analysis extras has a use-after-free when reading a crafted Arrow IPC file. — GHSA-rgxp-2hwp-jwgg, CVE-2026-25087 high Yes - update to 23.0.1
soupsieve The CSS selector library used by the HTML tooling can be driven into memory exhaustion or a regular-expression denial of service by long selector lists. — GHSA-2wc2-fm75-p42x, GHSA-836r-79rf-4m37 high Yes - update to 2.8.4
tornado The web server underneath the notebook toolchain can be stalled by a single crafted request and leaks per-request credentials when its curl client reuses handles. — GHSA-mpf4-983q-p7j4, GHSA-pw6j-qg29-8w7f, GHSA-8423-8fgw-73vq, GHSA-wwv5-g3v4-889x high Yes - update to 6.5.8
urllib3 The HTTP library the CLI uses to talk to the network can be made to bypass decompression-bomb limits and can leak sensitive headers across origins on proxied redirects. — GHSA-mf9v-mfxr-j63j, GHSA-qccp-gfcp-xxvc high Yes - update to 2.7.0
bleach The HTML sanitiser used by the notebook toolchain lets some dangerous URI schemes through, and one of its three flaws - CPU exhaustion in linkify(parse_email=True) - has no fixed version at all. — GHSA-gj48-438w-jh9v, GHSA-g75f-g53v-794x, GHSA-8rfp-98v4-mmr6 moderate Mitigation only - updating to 6.4.0 fixes two of the three; for the email-linkify CPU exhaustion there is no fixed release, so avoid linkify(parse_email=True) on untrusted text.
pytest The test runner declared in pyproject.toml handles temporary directories unsafely; it matters only to someone running the project's own test suite. — GHSA-6w46-j5rx-g56g, CVE-2025-71176 moderate Yes - update to 9.0.3
requests The HTTP client the CLI uses reuses an insecure temporary file in extract_zipped_paths(), which a local user on the same machine could exploit. — GHSA-gc5v-m9x4-r6x2, CVE-2026-25645 moderate Yes - update to 2.33.0
setuptools The Python packaging tool can be tricked into including files a MANIFEST.in meant to exclude when building a source distribution on macOS. — GHSA-h35f-9h28-mq5c, CVE-2026-59890 moderate Yes - update to 83.0.0
werkzeug The web toolkit under the project's dashboard extras mishandles Windows special device names in safe_join(), which can be used to reach unintended files on a Windows host. — GHSA-29vq-49wr-vm6x, GHSA-87hc-h4r5-73f7, GHSA-hgf8-39gv-g3f2 moderate Yes - update to 3.1.6
flask The web framework under the project's dashboard extras omits a Vary: Cookie header in some session paths, which can cause a shared cache to serve one user's page to another. — GHSA-68rp-wp8r-4726, CVE-2026-27205 low Yes - update to 3.1.3
LoRa channel encryption Group and broadcast channel traffic is protected only by a shared pre-shared key with AES256-CTR and is unauthenticated on firmware 2.7.x and earlier, so anyone holding the channel key can transmit as any node; because this lab's firmware version is not determined, it is unknown whether the 2.8.x packet signing applies. posture Mitigation only - give each class its own channel key rather than a shared default, and treat everything sent on a channel as readable by anyone who has that key.
Meshtastic firmware - local trust boundary By design the node grants full, unauthenticated administrative access over Bluetooth LE, USB serial, Wi-Fi and Ethernet: anyone who reaches one of those links can read decrypted traffic, transmit as the node, change its configuration and export its private keys. posture Mitigation only - treat any BLE, USB, Wi-Fi or Ethernet access as complete control of the node: set the BLE pairing PIN, keep nodes physically supervised, and do not enable the Wi-Fi or Ethernet interfaces on a shared campus network.
Meshtastic Python CLI dependencies Dependencies unpinned: 42 of 42 in pyproject.toml, and the lab itself pins no version of the meshtastic CLI, so what an instructor installs has no fixed, checkable security state. posture Mitigation only - pin versions / install from the project's poetry.lock rather than letting pip resolve whatever is current.
MQTT bridge (TBPubSubClient) The node can bridge mesh packets outward to an MQTT broker over TCP/IP, which republishes classroom mesh traffic beyond the room. posture Mitigation only - leave the MQTT uplink disabled unless publishing mesh traffic is an intended part of the exercise.
Syslog and NTP clients When enabled the node broadcasts log telemetry unencrypted on UDP port 514 and sends unauthenticated time queries on UDP port 123. posture Mitigation only - leave syslog off outside debugging, and expect the node to reach a time server if it is on a network.
Wi-Fi device administration Setting Wi-Fi credentials or administering the node over an untrusted Wi-Fi link sends those credentials and the control traffic unencrypted onto the local network. posture Mitigation only - do all device configuration over the USB serial link, never over untrusted Wi-Fi.

What this means for your lab

Two things matter here, and neither is a software bug. First, a Meshtastic node hands out complete control to anyone who can reach it over Bluetooth, USB, Wi-Fi or Ethernet - there is no password, by design. Someone within Bluetooth range, or on the same Wi-Fi network, can read the messages your mesh is carrying, send messages that appear to come from your node, change its settings and copy out its private keys. So keep these nodes off the campus network: configure them over the USB cable, leave the Wi-Fi and Ethernet interfaces switched off, set the Bluetooth pairing PIN, and do not leave a node unattended where a stranger can pick it up. Second, the radio channel itself is protected only by a shared key: everyone who has that key can read and send on the channel, so give each class its own key instead of a default one, and treat anything sent over the mesh as readable by anyone you handed the key to. On the software side, the lab pins no version of the Meshtastic firmware or of the Python command-line tool, so we could not check either against a vulnerability database - that is an unknown, not a clean bill of health. The advisories listed above were found in the Meshtastic Python project's own dependency lockfile, and most of them affect notebook and plotting tools that run on your computer rather than anything on the radio; the ones worth acting on are the HTTP libraries the command-line tool actually uses. Before connecting these nodes to anything the campus runs, raise it with campus IT.

Not checked

  • Meshtastic firmware (meshtastic/firmware): Version not determined - the lab pins library archives and a placeholder -DAPP_VERSION=1.0.0 rather than a firmware release, so no advisory database could be queried for the firmware itself. This is a real gap, not a clean result.
  • Meshtastic Python CLI (the meshtastic package itself): Unpinned - the lab installs whatever PyPI serves on the day, so there is no specific version to check. The advisories above come from the upstream project's own poetry.lock, which is what the project developers pin, not necessarily what pip resolves for an instructor.
  • Arduino and PlatformIO libraries pinned in firmware_platformio.ini (about 50 archives): No vulnerability database covers Arduino/PlatformIO library archives pinned by git tag or commit - including RadioLib, meshtastic/device-ui, TBPubSubClient, NTPClient, Syslog, TinyGPSPlus, OneButton, ArduinoThread, arduino-fsm, Fusion, the Adafruit, SparkFun, Sensirion and DFRobot driver sets. Absence of an advisory here means nothing was checked, not that they are clean.
  • PlatformIO Core build toolchain: Version not stated in the sources, so neither a support-status nor an advisory lookup was possible.
  • Espressif Arduino core framework: Version not stated in the root configuration (framework = arduino only).
  • Cppcheck static analysis tool: Version not stated in the sources.
  • nanopb 0.4.92: this version does not exist in the package registry (a kit or hardware release number is not a software version)

Parts

Primary host platform

Part Spec/Package Status Stock Price Source
Heltec WiFi LoRa 32 (V3) ESP32-S3FN8 + SX1262, 18-pin DIP module, onboard 0.96" OLED, SH1.25-2 battery header Active, no EOL notice on vendor page Vendor listing live; US resellers stocking $17.90–$19.90 (Heltec) · $29.97 (Rokland) Heltec Automation; Rokland, AliExpress $28.57, Banggood $35.99

Modular core components (DIY / custom builds)

Part Spec/Package Status Stock Price Source
SX1262IMLTRT 150–960 MHz, 22 dBm, 1.8–3.7 V, 24-VFQFN (4x4) Active 37,721 (DigiKey); Newark 2,188, Mouser 28 $8.53 DigiKey (Semtech)
Sub-GHz antenna, 915 MHz, SMA 50 Ω, SMA male whip/paddle Available (retail) Multiple sellers $3.40–$12.99 Elecrow $3.40, Nooelec $8.95, Bingfu $9.99, Meshnology $12.99. One antenna ships with the Heltec board.
U.FL to SMA female pigtail RG178, 15 cm, panel-mount SMA Available In stock $3.95 Adafruit #851 (SMA, not RP-SMA — #852 is the RP-SMA version and is not compatible)
1S LiPo battery, 1.25 mm connector 3.7 V, 2000 mAh, JST 1.25, PCM protection Available (retail) Multiple sellers $7.95 Ameridroid $7.95, MakerNova $7.99, MakerFocus 4-pack $24.99. 1.25 mm connectors have no standard polarity — check before connecting.
USB 2.0 Type-A to Type-C cable ~1 m, 28 AWG data + 24 AWG power, 5 V up to ~2 A Available In stock $4.95 Adafruit #4474 (data cable — power-only cables fail flashing)

Displays, indicators and user controls

Part Spec/Package Status Stock Price Source
0.96" I2C OLED module (SSD1306) 128x64, 4-pin 2.54 mm, 3.3–5 V Available (retail); integrated on the Heltec V3 Multiple sellers $2.07–$19.50 AliExpress $2.07, BuyDisplay $2.49, Elecrow $3.10, CANADUINO via DigiKey $4.99
PTS645SM43SMTR92 LFS (tactile switch, x2) SPST NO, finger-accessible tactile Active 173,986 $0.36 DigiKey (C&K)
WS2812B-B (addressable RGB LED) 5050 SMD, single-wire 800 kHz Part number not listed by any authorized distributor — — DigiKey 0 results; ECIA: no authorized distributor lists this exact part number. See Substitutes.

GNSS / location peripherals

Part Spec/Package Status Stock Price Source
Serial GNSS module (u-blox NEO-8M class) Breakout with ceramic patch antenna, 3.3 V UART, NMEA-0183 Available (retail); bare u-blox modules via distribution Multiple sellers $5.00–$49.99 GY-NEO-6M/7M/8M breakout $5.00 (Xpart); bare u-blox NEO-M8M-0 $13.26 (DigiKey), $8.39 (Richardson RFPD)

Environmental telemetry sensors (all optional)

Part Spec/Package Status Stock Price Source
BME280 LGA-8 or breakout, 1.71–3.6 V, I2C Bare IC hard to obtain (0 stock ECIA-wide, 12-week lead); breakout Active 2,603 (breakout) $14.95 Adafruit #2652 breakout (bare Bosch BME280 unavailable)
DPS310XTSA1 8-VFLGA (PG-VLGA-8-1), 1.7–3.6 V Obsolete 0 everywhere; 14-week factory lead no price DigiKey (Infineon) — see Substitutes
LPS22HBTR 10-WFLGA / 10-HLGA (2x2), 1.7–3.6 V Active 0 at DigiKey; Future 16,000, Newark 11,973, Arrow 2,914, Mouser 86 $3.18 (DigiKey list) · $3.12 Newark ST via Newark/Future/Arrow
MCP9808-E/MS 8-MSOP, 2.7–5.5 V Active 4,965 $1.40 DigiKey (Microchip)
PCT2075DP,118 8-TSSOP, 2.7–5.5 V Active 61,665 $0.76 DigiKey (NXP)
AHT20 SMD-6 or breakout, 2.0–5.5 V, I2C 0x38 Bare part not ECIA-listed; module Active 1,183 $4.50 Adafruit #5183 (2.2–5.5 V, 4-SIP); #4566 STEMMA QT also $4.50, 833
SHT31-DIS-B 8-VFDFN / 8-DFN (2.5x2.5), 2.15–5.5 V Active 18,534 (reel code B2.5KS); Newark 9,573 on the base number $4.50 · $4.88 Newark DigiKey stocks SHT31-DIS-B2.5KS (same die/package, reel quantity suffix)
SCD41-2090 SMD-20 or breakout, 2.4–5.5 V Part number not listed by any authorized distributor — — DigiKey 0 results; ECIA: none. Order SCD41-D-R2 instead — see Substitutes.
SCD30 Module, 3.3–5.5 V, 75 mA Active 6,690 $47.36 DigiKey (Sensirion)
SFA30 Module, 4-pin header, 3.15–5.5 V Active 111 $54.00 Seeed Grove SFA30 via DigiKey (bare SFA30 not ECIA-listed)
BME680 LGA-8 or breakout, 1.71–3.6 V Bare IC hard to obtain (0 stock ECIA-wide, 12-week lead); breakout Active 269 (breakout) $18.95 Adafruit #3660; DFRobot SEN0248 $18.90 (52)
HM3301 (PM2.5) Module, 8-pin, 3.3–5 V Active 52 $32.90 Seeed Grove HM3301 via DigiKey (Seeed's own page returned no price)
MLX90614ESF-BAA-000-TU TO-39, 3.3 V (BAA variant) Active 1,280 $10.42 DigiKey (Melexis)
MLX90632SLD-DCB-000-RE 5-SFN (3x3), 3.0–3.6 V Active 3,021 $11.76 DigiKey (Melexis)
MPU-6050 QFN-24 or GY-521 breakout, 2.375–3.46 V Bare IC hard to obtain (0 stock, 26-week lead, lifecycle risk High); breakout Active 895 (breakout) $12.95 Adafruit #3886; DFRobot SEN0142 $12.90 (557)
ICM-20948 QFN-24 or breakout, 1.71–1.95 V logic Bare IC hard to obtain (0 stock, 45-week lead, lifecycle risk High); Adafruit breakout Active 822 (breakout) $19.95 Adafruit #4554. SparkFun #15335 is Obsolete — do not order it.
ICM-42670-P 14-VFLGA (2.5x3), 1.71–3.6 V Active but thin 0 at DigiKey (45-week lead); Mouser 72 $2.89 DigiKey list · $3.47 Mouser · $32.45 chip carrier Buy from Mouser while stock holds
LIS3DHTR 16-VFLGA (3x3), 1.71–3.6 V Active but thin 0 at DigiKey; Mouser 150 $1.94 ST via Mouser
LSM6DSOXTR 14-VFLGA (2.5x3) Active 32 at DigiKey; Newark 18,486 $5.30 · $3.43 Newark ST
QMC5883L LCC-16 (3x3) or breakout, 2.16–3.6 V Bare IC not ECIA-listed; module Active 39 $4.56 Olimex MOD-QMC5883L. DigiKey's description reads "EVAL BOARD FOR HMC5883" — see Substitutes before ordering.
BMM150 WLCSP-12 or breakout, 1.62–3.6 V Bare IC hard to obtain (0 stock, 8-week lead, lifecycle risk High); breakout Active 30 (breakout) $6.90 DFRobot SEN0419 Fermion; Seeed #101020492 $11.80 (57)
MMC5983MA 16-VFLGA (3x3), 2.8–3.5 V Active 39,569 $3.32 DigiKey (MEMSIC)
TSL25911FN 6-WFDFN / 6-DFN (2x2.2), 2.7–3.6 V Active 29,061 $1.74 DigiKey (ams OSRAM)
TSL2561FN 6-WDFN / 6-DFN (2x2), 2.7–3.6 V Obsolete 0 at DigiKey (16-week lead) and Mouser no price DigiKey (ams OSRAM) — see Substitutes
BH1750FVI-TR 6-WSOF, 2.4–3.6 V Not For New Designs 2,532 (DigiKey only) $3.42 DigiKey (ROHM)
VEML7700-TR 4-SMD J-lead, 2.5–3.6 V Active 7,520 $1.44 DigiKey (Vishay)
OPT3001DNPR 6-UDFN / 6-USON (2x2), 1.6–3.6 V Active 14,936 $1.48 DigiKey (TI)
LTR-390UV-01 6-WFDFN, 1.7–3.6 V Discontinued at DigiKey 0 at Avnet, Mouser, DigiKey (18-week lead) no price DigiKey (Lite-On) — no substitute verified
AS3935-BQFT MLPQ-16 (4x4), 2.4–5.5 V Active 1,421 (DigiKey); Mouser 4,001 $9.35 DigiKey (ScioSense)
MAX30102EFD+T 14-pin OESIP Active 2,173 $14.72 DigiKey (ADI/Maxim)

Power and telemetry monitor hardware

Part Spec/Package Status Stock Price Source
INA219AIDR SOT-23-8, 3.0–5.5 V Active 29,736 $2.12 DigiKey (TI)
INA226AIDGSR VSSOP-10, 2.7–5.5 V Active 95,750 $2.82 DigiKey (TI)
INA260AIPWR TSSOP-16, 2.7–5.5 V Active 9,274 $6.56 DigiKey (TI)
INA3221AIRGVR QFN-16 (4x4), 2.7–5.5 V Active 74,078 $3.47 DigiKey (TI)
MAX17048G+T10 TDFN-8 (2x3), 2.5–4.5 V Active 16,471 $4.61 DigiKey (ADI/Maxim)
NAU7802SGI SOP-16, 2.7–5.5 V Active 129,489 $2.07 DigiKey (Nuvoton)
ADS1115IDGSR VSSOP-10, 2.0–5.5 V Active 42,250 $5.28 DigiKey (TI)
DS2482S-100+T&R SOIC-8, 1.71–5.5 V Active 34,009 $3.57 DigiKey (ADI/Maxim)
DFRobot Rainfall Sensor Tipping bucket, I2C/UART, 3.3–5 V Active 73 $29.90 DFRobot SEN0575 via DigiKey. Vendor page warns the signal adapter board is not waterproof.
DFRobot Lark Weather Station 5-in-1 module, UART/I2C, 3.3–5 V not checked (no distributor listing, vendor page carried no price) — — Product confirmed current on DFRobot's page; order direct

Substitutes

For part Substitute Differences Verified Judgment
DPS310XTSA1 (obsolete) DPS368XTSA1 — $2.70, 196 in stock Package identical (8-VFLGA, supplier package PG-VLGA-8-1 on both); supply identical (1.7–3.6 V both, covers the 3.3 V rail); operating temperature identical (-40 to 85 °C). DigiKey's descriptions differ: DPS310XTSA1 "17.4PSIA" (absolute) vs DPS368XTSA1 "17.4PSIG" (gauge) — absolute is what barometry needs. verified: package + supplier device package (DigiKey parametrics, both parts), supply range (DigiKey parametrics, both parts), operating temperature (DigiKey parametrics, both parts). not verified: pressure reference type (absolute vs gauge), Adafruit DPS310 library compatibility Acceptable on footprint and supply rail — confirm the pressure reference and driver support against the datasheet before ordering
TSL2561FN (obsolete) TSL25911FN — $1.74, 29,061 in stock Supply identical (2.7–3.6 V both). Package NOT equivalent: 6-DFN (2x2) vs 6-DFN (2x2.2) — a hard stop for a shared PCB land pattern, though this lab wires breakout modules on 2.54 mm headers rather than a custom board. Different driver too: Adafruit_TSL2561 vs Adafruit TSL2591, and the lab already supports TSL2591 in its own right. verified: supply range (DigiKey parametrics, both parts). not verified — disproved: footprint equivalence (DigiKey parametrics show 6-DFN 2x2 vs 6-DFN 2x2.2) Acceptable as a sensor swap with the TSL2591 driver; NOT a footprint-compatible drop-in
SCD41-2090 (no distributor listing) SCD41-D-R2 — $20.54, 13,032 in stock Part-number correction rather than a component change: SCD41-D-R2 is Sensirion's catalog code. Supply 2.4–5.5 V matches the snapshot's 2.4–5.5 V requirement; operating range -10 to 60 °C. verified: supply range (DigiKey parametrics vs snapshot). not verified: package/footprint (no package parametric returned for either number), and that "SCD41-2090" and SCD41-D-R2 name the same catalog item Acceptable — order SCD41-D-R2
WS2812B-B (no distributor listing) SparkFun 16347 — $0.68, 196,668 in stock; XINGLIGHT XL-5050RGBC-WS2812B-S $0.0625, 70,000 in stock Body size matches the snapshot's 5050 requirement: 5.00 mm x 5.00 mm on both, 4-SMD J-lead on the XINGLIGHT part. Supply and logic threshold are NOT established — the only voltage figure returned is a forward voltage, not a supply rail or a data-logic threshold. verified: package/body size 5050 (DigiKey parametrics, both candidates). not verified: supply range, 3.3 V logic-level compatibility Plausible and cheap, not fully verified — confirm the 3.3 V data threshold before driving it from the ESP32-S3 rail
QMC5883L (bare IC unlisted) Olimex MOD-QMC5883L — $4.56, 39 in stock (3.95 EUR direct from Olimex) The claim this hinges on is that the module carries QMC5883L, not HMC5883L — the snapshot warns their I2C register maps differ, and DigiKey's description misleadingly reads "EVAL BOARD FOR HMC5883". Olimex's product page, fetched this run, sells MOD-HMC5883L and MOD-QMC5883L as two variants of one page and states the QMC5883 replaced the obsolete HMC5883. verified: sensor identity, QMC5883L not HMC5883L (Olimex product page fetched this run). not verified: supply range and footprint (no DigiKey parametrics returned for this module); Olimex's "same functionality" wording is the vendor's, and the snapshot says the register maps differ Acceptable — order by the MOD-QMC5883L variant code, never by the DigiKey description
BME280, BME680, MPU-6050, ICM-20948, BMM150, AHT20, SFA30, HM3301 (bare ICs with no distributor stock) Adafruit 2652 $14.95 · Adafruit 3660 $18.95 · Adafruit 3886 $12.95 · Adafruit 4554 $19.95 · DFRobot SEN0419 $6.90 · Adafruit 5183 $4.50 · Seeed 101020972 $54.00 · Seeed 101020613 $32.90 Breakout board instead of a bare LGA/QFN die. The snapshot names a breakout board as an allowed footprint for every one of these parts, and this lab wires modules on 2.54 mm headers rather than a custom PCB, so the package change costs nothing. Each breakout is Active and in stock where the bare IC is not. verified: lifecycle, price and stock for each breakout (DigiKey lookups this run); the snapshot's own text permitting a breakout footprint for each part. not verified: that each breakout carries the exact sensor die and I2C address the firmware driver expects — the DigiKey descriptions name the sensor, but no datasheet or vendor page was fetched for these eight modules Acceptable — this is the intended sourcing path for the optional sensors
LTR-390UV-01 (discontinued) None proposed The lab's other light sensors (TSL2591, VEML7700, OPT3001, BH1750) are ambient-light only and do not provide the UV channel. DigiKey's top keyword hit, MikroElektronika MIKROE-6856 "Ambient 26 Click" ($19.00, 3 in stock), is not evidenced to carry an LTR-390UV part, so it is not proposed. not stated — no substitute was verified No substitute: source the LTR390 module manually or drop the UV measurement from the exercise

Verify any substitute against its datasheet before ordering.

Other dependencies

  • PCB fabrication — not applicable. The snapshot records that no Gerber, drill or layout files were supplied, and that the Heltec V3's own fabrication parameters are internal to Heltec Automation. The DIY variant is breadboard or an unspecified 2/4-layer carrier board, so there is nothing to quote.
  • Meshtastic project documentation (meshtastic.org/docs, the build guide, flashing instructions, the encryption technical reference, the Python CLI installation guide, python.meshtastic.org) — not checked this run.
  • PlatformIO project documentation (docs.platformio.org) — not checked this run.
  • github.com/meshtastic/python — live: the repository was listed successfully during this run's dependency check.
  • github.com/meshtastic/firmware and the ghcr.io/meshtastic/python container image — not checked this run as download locations.
  • Heltec vendor documentation (heltec.org product page, schematics, datasheet, user manual links) — page reachable and current as of this run.

Watch list

  • Heltec WiFi LoRa 32 V3 — a single-vendor COTS board that the entire default build environment (heltec-v3) depends on. Vendor price $17.90–$19.90 today, US resellers $28.57–$35.99. A discontinuation here would force a variant build target for the whole lab.
  • BH1750FVI-TR — Not For New Designs with exactly one distributor holding stock. Most likely part to become unobtainable before the next check.
  • ICM-42670-P and LIS3DHTR — each has exactly one ECIA distributor with stock, against 24–45 week factory lead times.
  • LSM6DSOXTR at DigiKey — 32 pieces; Newark carries the depth, so ordering channel matters more than availability.
  • The bare-IC group (BME280, BME680, BMM150, MPU-6050, ICM-20948) — zero authorized stock today. The breakout workaround holds only while the module vendors keep building them; MPU-6050 and ICM-20948 both carry High lifecycle and supply-chain risk.
  • DPS310XTSA1 and TSL2561FN — already obsolete; remaining channel inventory will drain.
Snapshot What the lab depended on when it was uploaded — the baseline the readiness checks research against.

This lab builds an off-grid, decentralized LoRa mesh communicator and environmental telemetry radio node running the open-source Meshtastic firmware stack. The design is architected around Sub-GHz LoRa spread-spectrum transceivers paired with a low-power 32-bit microcontroller. While the firmware supports Espressif ESP32, Nordic Semiconductor nRF52/nRF54, Raspberry Pi RP2040/RP2350, and native Linux hosts, the default hardware environment defined in the build configuration is the Heltec WiFi LoRa 32 V3 platform. The node operates with a core 3.3 V DC logic rail powered by an onboard low-dropout voltage regulator fed from either a nominal 5.0 V USB VBUS supply (via USB Type-C) or a 3.7 V nominal single-cell Lithium-Polymer (LiPo) / Lithium-Ion battery (operating between 3.0 V cut-off and 4.2 V full charge). All I2C, SPI, and UART digital buses operate strictly at 3.3 V logic levels; connecting 5 V logic peripherals without level shifters will damage the core transceiver and MCU.

Bill of Materials

Primary Host Platform / Commercial Off-The-Shelf (COTS) Board

  • Identity: Heltec WiFi LoRa 32 (V3) Development Board. Integrates an Espressif ESP32-S3FN8 dual-core Xtensa LX7 MCU (Wi-Fi 2.4 GHz, BLE 5.0), a Semtech SX1262 LoRa transceiver, a 0.96-inch 128x64 monochrome OLED display, an onboard TP4054 LiPo charge management IC, a CP2102 or CH9102 USB-to-UART bridge, an IPEX/U.FL RF connector, and user/reset tactile switches.
  • Quantity: 1
  • Footprint/package: Dual-row 18-pin breadboard-compatible DIP module (25.4 mm row spacing, 2.54 mm pin pitch), dimensions approximately 50.8 mm x 22.8 mm.
  • Electrical constraints: Supply voltage 5.0 V DC via USB-C or 3.7 V nominal (3.0 V to 4.2 V max) via onboard 2-pin battery header. Logic rail is 3.3 V DC regulated. RF output power up to +22 dBm (160 mW). Peak transmit current up to 150 mA on RF bursts, up to 350 mA with Wi-Fi active.
  • Substitution latitude: Must match Heltec WiFi LoRa 32 V3 pin mapping and architecture to compile with default environment heltec-v3. Any other ESP32, nRF52840, or RP2040 Meshtastic board (e.g., LilyGO T-Beam, Seeed Studio Wio-E5, RAKwireless WisBlock 4631) can be substituted only if switching to its respective variant build target.
  • Control operated by student: Yes; onboard PRG/User momentary button is operated during node use for screen switching and channel beaconing, and RST button for manual resets.
  • Sourcing plan: retail shopping search: Heltec WiFi LoRa 32 V3 915MHz or 868MHz

Modular Core Components (for Custom / DIY Builds Referenced in extra_configs)

  • Identity: Semtech SX1262 LoRa Transceiver IC or integrated module (e.g., Ai-Thinker Ra-08, Ebyte E22-900M22S).

  • Quantity: 1

  • Footprint/package: QFN-24 (4 mm x 4 mm) for bare IC, or surface-mount castellated PCB module (e.g., 16 mm x 20 mm).

  • Electrical constraints: Supply voltage 1.8 V to 3.7 V DC (runs at 3.3 V rail). Frequency coverage 150 MHz to 960 MHz (typically tuned for 868 MHz or 915 MHz ISM band). TX power up to +22 dBm. Controlled via SPI bus (MOSI, MISO, SCK, NSS) plus DIO1, BUSY, and RESET lines.

  • Substitution latitude: Firmware explicitly excludes legacy transceivers (CC1101, NRF24, RF69, SX1231, SX1233, SI443X, RFM2X). Supported replacements are limited to Semtech SX126x (SX1262, SX1268), SX127x (SX1276, SX1278), SX128x (SX1280 2.4 GHz), or LR11x0 (LR1110, LR1120) transceivers supported by RadioLib.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: SX1262IMLTRT

  • Identity: Sub-GHz Tuned Dipole or Whip Antenna (frequency matched to regional ISM regulation: 915 MHz US/Americas, 868 MHz EU, or 433 MHz Asia/EU).

  • Quantity: 1

  • Footprint/package: IPEX MHF/U.FL connector or external SMA-Male whip antenna.

  • Electrical constraints: 50 Ω nominal impedance, VSWR ≤ 1.5:1 at center frequency.

  • Substitution latitude: Any 50 Ω antenna tuned to the operating LoRa frequency band. Operating the transceiver without a matched antenna will damage the RF power amplifier.

  • Control operated by student: No.

  • Sourcing plan: retail shopping search: 915MHz LoRa antenna SMA U.FL

  • Identity: RF Coaxial Adapter Cable (Pigtail). U.FL (IPEX MHF1) to SMA Female bulkhead.

  • Quantity: 1

  • Footprint/package: 1.13 mm micro-coaxial cable, length 100 mm to 150 mm; chassis bulkhead mount SMA female jack.

  • Electrical constraints: 50 Ω characteristic impedance, insertion loss ≤ 0.5 dB up to 1 GHz.

  • Substitution latitude: Any 50 Ω low-loss micro-coax with matching U.FL and SMA connectors.

  • Control operated by student: No.

  • Sourcing plan: retail shopping search: IPEX U.FL to SMA female pigtail cable 15cm

  • Identity: Single-cell Lithium-Polymer / Lithium-Ion Rechargeable Battery.

  • Quantity: 1

  • Footprint/package: Pouch cell or 18650 cylindrical cell terminated with 1.25 mm pitch 2-pin Molex/JST connector.

  • Electrical constraints: Nominal voltage 3.7 V DC, charge cutoff 4.2 V, discharge cutoff 3.0 V. Capacity 1000 mAh to 3500 mAh with integrated PCM (protection circuit module against short circuit, over-charge, and over-discharge).

  • Substitution latitude: Any 1S LiPo/Li-ion battery. Attention to pin polarity is mandatory as 1.25 mm battery connectors lack standardized +/- pin assignment across manufacturers.

  • Control operated by student: No.

  • Sourcing plan: retail shopping search: 3.7V 2000mAh LiPo battery 1.25mm connector

  • Identity: USB 2.0 Type-A to Type-C Cable.

  • Quantity: 1

  • Footprint/package: Standard USB Type-A male to Type-C male, length 1 meter.

  • Electrical constraints: 5.0 V VBUS, minimum 500 mA rated current, fully wired 4-wire shielded cable (VBUS, GND, D+, D-) to support 115200 baud serial programming and debugging. Power-only charge cables will fail flashing and CLI operations.

  • Substitution latitude: Any USB data cable with Type-C termination.

  • Control operated by student: Yes; repeatedly connected and disconnected by student during programming and field charging.

  • Sourcing plan: retail shopping search: USB-A to USB-C data cable 1m

Displays, Indicators, and User Controls

  • Identity: 0.96-inch Monochrome I2C OLED Display Module (integrated on Heltec V3 or standalone module).

  • Quantity: 1

  • Footprint/package: 4-pin 2.54 mm header (GND, VCC, SCL, SDA), module footprint 27 mm x 27 mm.

  • Electrical constraints: Supply voltage 3.3 V to 5.0 V DC (integrated charge pump). I2C communication at address 0x3C or 0x3D. Logic levels 3.3 V.

  • Substitution latitude: SSD1306, SH1106, or SH1107 controller based on driver libraries. Alternatively, E-ink panels supported by the niche graphics layer (e.g. UC8151D, SSD1680) via SPI bus when compiled with -D MESHTASTIC_INCLUDE_NICHE_GRAPHICS.

  • Control operated by student: No (visual indicator).

  • Sourcing plan: retail shopping search: 0.96 inch I2C OLED display 128x64 SSD1306

  • Identity: Tactile Pushbuttons (User Function and Reset).

  • Quantity: 2

  • Footprint/package: Surface-mount 3 mm x 4 mm or 6 mm x 6 mm through-hole tactile momentary switch.

  • Electrical constraints: SPST normally open, rated 12 V DC, 50 mA. Pulled up to 3.3 V via onboard resistors, pulling GPIO to GND when depressed.

  • Substitution latitude: Any momentary normally-open switch. Actuator style must be finger-accessible tactile switch.

  • Control operated by student: Yes; active control operated by the user to navigate device UI, send manual node beacons, or enter bootloader mode.

  • Sourcing plan: distributor lookup (representative example — sources give spec only): PTS645SM43SMTR92 LFS

  • Identity: Addressable RGB Status Indicator (NeoPixel).

  • Quantity: 1

  • Footprint/package: 5050 SMD or 3535 SMD (WS2812B or SK6812).

  • Electrical constraints: Supply voltage 3.3 V to 5.0 V DC, single-wire NRZ serial data input at 800 kHz. Logic threshold compatible with 3.3 V.

  • Substitution latitude: Any WS2812B, SK6812, or compatible single-wire RGB LED supported by Adafruit NeoPixel library.

  • Control operated by student: No (visual indicator).

  • Sourcing plan: distributor lookup (representative example — sources give spec only): WS2812B-B

GNSS / Location Peripherals

  • Identity: Serial GNSS / GPS Receiver Module (supported via TinyGPSPlus driver).
  • Quantity: 1
  • Footprint/package: External breakout module (e.g., u-blox NEO-6M, NEO-8M, or MAX-M10S) with ceramic patch antenna; 4-pin to 6-pin 2.54 mm connector (VCC, GND, TX, RX, PPS).
  • Electrical constraints: Supply voltage 3.3 V DC (or 5 V with onboard LDO). 3.3 V UART logic level at 9600 baud (or configurable up to 115200 baud).
  • Substitution latitude: Any NMEA-0183 standard UART GPS/GNSS receiver module.
  • Control operated by student: No.
  • Sourcing plan: retail shopping search: u-blox NEO-8M GPS module 3.3V UART

Environmental Telemetry Sensors (Driver Libraries in environmental_base and environmental_extra)

  • Identity: Bosch Sensortec BME280 Combined Pressure, Humidity, and Temperature Sensor.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: LGA-8 (2.5 mm x 2.5 mm x 0.93 mm) or 4-pin/6-pin I2C/SPI breakout module.

  • Electrical constraints: Supply voltage 1.71 V to 3.6 V DC (runs at 3.3 V rail). I2C interface (address 0x76 or 0x77).

  • Substitution latitude: Bosch BMP280 (temperature and pressure only) or Bosch BMP085 / BMP180 / BMP388 / BMP390 supported by corresponding Adafruit libraries.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: BME280

  • Identity: Infineon DPS310 High-Precision Barometric Pressure Sensor.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: 8-pin LGA (2.0 mm x 2.5 mm) or breakout board.

  • Electrical constraints: Supply voltage 1.7 V to 3.6 V DC. I2C interface (address 0x77 or 0x76).

  • Substitution latitude: Supported via Adafruit DPS310 library; substitutes include BMP280, LPS22HB.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: DPS310XTSA1

  • Identity: STMicroelectronics LPS22HB / LPS25HB Barometric Pressure and Temperature Sensor.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: HLGA-10 (2.0 mm x 2.0 mm) or breakout board.

  • Electrical constraints: Supply voltage 1.7 V to 3.6 V DC. I2C interface.

  • Substitution latitude: Supported via Adafruit LPS2X library.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: LPS22HBTR

  • Identity: Microchip MCP9808 Precision I2C Temperature Sensor.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: MSOP-8 or DFN-8 (or breakout board).

  • Electrical constraints: Supply voltage 2.7 V to 5.5 V DC. Accuracy ±0.25°C typ. I2C address 0x18–0x1F.

  • Substitution latitude: Supported via Adafruit MCP9808 library. Compatible alternatives include NXP PCT2075 supported by Adafruit PCT2075 library.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: MCP9808-E/MS

  • Identity: NXP PCT2075 Temperature Sensor and Thermal Watchdog.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: SO8, TSSOP8, or HVSON8 (or breakout board).

  • Electrical constraints: Supply voltage 2.7 V to 5.5 V DC. I2C addressable.

  • Substitution latitude: Supported via Adafruit PCT2075 library.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: PCT2075DP,118

  • Identity: Aosong AHT10 / AHT20 Temperature and Humidity Sensor.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: SMD-6 or breakout board.

  • Electrical constraints: Supply voltage 2.0 V to 5.5 V DC. I2C address 0x38.

  • Substitution latitude: Supported via Adafruit AHTX0 library. Alternatives include Sensirion SHT3x series.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: AHT20

  • Identity: Sensirion SHT30 / SHT31 / SHT35 Digital Humidity and Temperature Sensor.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: DFN-8 (2.5 mm x 2.5 mm) or breakout board.

  • Electrical constraints: Supply voltage 2.15 V to 5.5 V DC. I2C address 0x44 or 0x45.

  • Substitution latitude: Supported via arduino-sht library (compatible with SHT3x, SHT7x, SHT85).

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: SHT31-DIS-B

  • Identity: Sensirion SCD40 / SCD41 Photoacoustic NDIR CO2, Temperature, and Humidity Sensor.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: SMD-20 (10.1 mm x 10.1 mm x 6.5 mm) or breakout board.

  • Electrical constraints: Supply voltage 2.4 V to 5.5 V DC. Peak current ~205 mA during measurement. I2C interface.

  • Substitution latitude: Supported via Sensirion I2C SCD4x library. Alternative is Sensirion SCD30 (NDIR) supported via Sensirion I2C SCD30 library.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: SCD41-2090

  • Identity: Sensirion SCD30 NDIR CO2, Temperature, and Humidity Sensor Module.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: Integrated PCB module with pin header (35 mm x 23 mm x 7 mm).

  • Electrical constraints: Supply voltage 3.3 V to 5.5 V DC. Average current 19 mA at 2 s sample rate, peak 75 mA. I2C interface.

  • Substitution latitude: Supported via Sensirion I2C SCD30 library.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: SCD30

  • Identity: Sensirion SFA30 Formaldehyde (HCHO), Temperature, and Humidity Sensor Module.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: Pre-calibrated integrated module with 4-pin header connector.

  • Electrical constraints: Supply voltage 3.15 V to 5.5 V DC. I2C interface.

  • Substitution latitude: Supported via Sensirion I2C SFA3x library.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: SFA30

  • Identity: Bosch Sensortec BME680 Environmental Gas, Temperature, Humidity, and Barometric Pressure Sensor.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: LGA-8 (3.0 mm x 3.0 mm x 0.93 mm) or breakout board.

  • Electrical constraints: Supply voltage 1.71 V to 3.6 V DC. I2C/SPI interface. Gas sensor heater requires up to 18 mA pulse current.

  • Substitution latitude: Supported via Adafruit_BME680 library. Note that firmware uses an in-tree open IAQ estimator (BME680IaqEstimator) rather than Bosch proprietary BSEC binary blobs.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: BME680

  • Identity: Seeed Studio / Plantower HM3301 Laser Dust / PM2.5 Particulate Matter Sensor.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: Module with 8-pin connector interface.

  • Electrical constraints: Supply voltage 3.3 V to 5.0 V DC. Fan and laser consume up to 120 mA active. I2C interface.

  • Substitution latitude: Supported via Seeed_PM2_5_sensor_HM3301 library.

  • Control operated by student: No.

  • Sourcing plan: retail shopping search: Seeed Studio HM3301 laser PM2.5 dust sensor

  • Identity: Melexis MLX90614 Non-Contact Infrared Thermometer.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: TO-39 metal can package or 4-pin breakout board.

  • Electrical constraints: Supply voltage 3.3 V DC (3V version MLX90614BAA/BCC) or 5.0 V DC (MLX90614AAA). SMBus / I2C compatible interface. Must use 3.3 V model for direct 3.3 V bus connection.

  • Substitution latitude: Supported via Adafruit MLX90614 library. Miniature alternative is MLX90632 supported via EmotiBit MLX90632 library.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: MLX90614ESF-BAA-000-TU

  • Identity: Melexis MLX90632 Miniature Far-Infrared Temperature Sensor.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: 4-pin QFN (3.0 mm x 3.0 mm x 1.0 mm).

  • Electrical constraints: Supply voltage 3.0 V to 3.6 V DC. I2C interface.

  • Substitution latitude: Supported via EmotiBit MLX90632 library.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: MLX90632SLD-DCB-000-RE

  • Identity: TDK InvenSense MPU-6050 6-DoF Accelerometer and Gyroscope.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: QFN-24 (4 mm x 4 mm) or GY-521 breakout board.

  • Electrical constraints: Supply voltage 2.375 V to 3.46 V DC (3.3 V rail). I2C address 0x68 or 0x69.

  • Substitution latitude: Supported via Adafruit MPU6050 library. Supported alternatives include ST LSM6DS series or TDK ICM-20948 / ICM-42670-P.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup (representative example — sources give spec only): MPU-6050

  • Identity: TDK InvenSense ICM-20948 9-DoF Motion Tracking Device (3-axis Gyro, 3-axis Accel, 3-axis Compass).

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: QFN-24 (3.0 mm x 3.0 mm) or SparkFun breakout board.

  • Electrical constraints: Logic supply voltage 1.71 V to 1.95 V (breakout provides 3.3 V regulation and level shifting). I2C/SPI interface.

  • Substitution latitude: Supported via SparkFun 9DoF IMU Breakout ICM 20948 library.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: ICM-20948

  • Identity: TDK InvenSense ICM-42670-P High-Performance 6-Axis MotionTracking IMU.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: 14-pin LGA (2.5 mm x 3.0 mm).

  • Electrical constraints: VDD supply 1.71 V to 3.6 V DC. I2C/SPI interface.

  • Substitution latitude: Supported via TDK InvenSense ICM42670P library.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: ICM-42670-P

  • Identity: STMicroelectronics LIS3DH 3-Axis Ultra-Low Power Accelerometer.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: LGA-16 (3.0 mm x 3.0 mm) or breakout board.

  • Electrical constraints: Supply voltage 1.71 V to 3.6 V DC. I2C/SPI interface.

  • Substitution latitude: Supported via Adafruit LIS3DH library.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: LIS3DHTR

  • Identity: STMicroelectronics LSM6DSOX / LSM6DS33 6-DoF IMU.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: LGA-14 (2.5 mm x 3.0 mm) or Adafruit breakout board.

  • Electrical constraints: Supply voltage 1.71 V to 3.6 V DC. I2C/SPI interface.

  • Substitution latitude: Supported via Adafruit LSM6DS library.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: LSM6DSOXTR

  • Identity: QST QMC5883L 3-Axis Digital Magnetometer / Compass.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: LCC-16 (3.0 mm x 3.0 mm) or breakout board.

  • Electrical constraints: Supply voltage 2.16 V to 3.6 V DC. I2C address 0x0D.

  • Substitution latitude: Supported via QMC5883L Compass library. Must not be confused with Honeywell HMC5883L (different I2C register map). Alternatives include Bosch BMM150 or MEMSIC MMC5983MA.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup (representative example — sources give spec only): QMC5883L

  • Identity: Bosch Sensortec BMM150 3-Axis Geomagnetic Sensor.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: WLCSP-12 (1.56 mm x 1.56 mm) or DFRobot breakout board.

  • Electrical constraints: Supply voltage 1.62 V to 3.6 V DC. I2C/SPI interface.

  • Substitution latitude: Supported via DFRobot_BMM150 library.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: BMM150

  • Identity: MEMSIC MMC5983MA Tri-Axis Magnetometer.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: LGA-16 (3.0 mm x 3.0 mm x 1.0 mm) or SparkFun breakout board.

  • Electrical constraints: Supply voltage 2.8 V to 3.6 V DC. I2C/SPI interface.

  • Substitution latitude: Supported via SparkFun MMC5983MA library.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: MMC5983MA

  • Identity: AMS / TAOS TSL2591 High Dynamic Range Digital Light Sensor.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: ODFN-6 (2.0 mm x 2.4 mm) or Adafruit breakout board.

  • Electrical constraints: Supply voltage 3.0 V to 3.6 V DC. I2C address 0x29.

  • Substitution latitude: Supported via Adafruit TSL2591 library. Alternatives include TSL2561, BH1750, VEML7700, or OPT3001.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: TSL25911FN

  • Identity: AMS / TAOS TSL2561 Ambient Light Sensor.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: 6-pin TMB or breakout board.

  • Electrical constraints: Supply voltage 2.7 V to 3.6 V DC. I2C interface.

  • Substitution latitude: Supported via Adafruit_TSL2561 library.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: TSL2561FN

  • Identity: ROHM BH1750FVI Digital Ambient Light Sensor.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: WSOF-6 or GY-30 / BH1750 breakout board.

  • Electrical constraints: Supply voltage 2.4 V to 3.6 V DC. I2C interface.

  • Substitution latitude: Supported via BH1750_WE library.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: BH1750FVI-TR

  • Identity: Vishay VEML7700 High-Accuracy Ambient Light Sensor.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: SMD-4 (6.8 mm x 2.35 mm x 3.0 mm) or Adafruit breakout board.

  • Electrical constraints: Supply voltage 2.5 V to 3.6 V DC. I2C interface.

  • Substitution latitude: Supported via Adafruit VEML7700 library.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: VEML7700-TR

  • Identity: Texas Instruments OPT3001 Ambient Light Sensor.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: USON-6 (2.0 mm x 2.0 mm) or ClosedCube breakout board.

  • Electrical constraints: Supply voltage 1.6 V to 3.6 V DC. I2C interface.

  • Substitution latitude: Supported via ClosedCube OPT3001 library.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: OPT3001DNPR

  • Identity: Lite-On LTR-390UV Ambient Light and UV Sensor.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: ODLGA-6 (2.0 mm x 2.0 mm) or Adafruit breakout board.

  • Electrical constraints: Supply voltage 1.7 V to 3.6 V DC. I2C address 0x53.

  • Substitution latitude: Supported via Adafruit LTR390 Library.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: LTR-390UV-01

  • Identity: ScioSense / ams AS3935 Franklin Lightning Sensor IC.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: MLPQ-16 (4 mm x 4 mm) or SparkFun / CJMCU breakout board with integrated tuned inductor.

  • Electrical constraints: Supply voltage 2.4 V to 5.5 V DC (runs at 3.3 V rail). SPI or I2C interface.

  • Substitution latitude: Must be AS3935 due to proprietary RF lightning front-end algorithm.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: AS3935-BQFT

  • Identity: Maxim Integrated MAX30102 Optical Pulse Oximeter and Heart-Rate Sensor.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: 14-pin OESIP (5.6 mm x 3.3 mm x 1.55 mm) or SparkFun breakout board.

  • Electrical constraints: VDD power 1.8 V with 3.3 V LED power rails; 3.3 V I2C interface.

  • Substitution latitude: Supported via SparkFun MAX3010x library (MAX30100/MAX30102).

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: MAX30102EFD+T

Power and Telemetry Monitor Hardware

  • Identity: Texas Instruments INA219 Zero-Drift Bi-directional Current/Power Monitor.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: SOT-23-8 or breakout board with onboard 0.1 Ω shunt resistor.

  • Electrical constraints: Bus voltage 0 V to 26 V DC. Operating supply 3.0 V to 5.5 V DC. I2C interface.

  • Substitution latitude: Supported via Adafruit INA219 library. Alternatives include INA226 (up to 36 V bus) or INA260 (integrated 2 mΩ precision shunt).

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: INA219AIDR

  • Identity: Texas Instruments INA226 High-Side / Low-Side Bi-directional Current/Power Monitor.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: VSSOP-10 or breakout board.

  • Electrical constraints: Bus voltage 0 V to 36 V DC. Operating supply 2.7 V to 5.5 V DC. I2C interface.

  • Substitution latitude: Supported via RobTillaart INA226 library.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: INA226AIDGSR

  • Identity: Texas Instruments INA260 Precision Current and Power Monitor with Integrated Shunt.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: TSSOP-16 or Adafruit breakout board.

  • Electrical constraints: Bus voltage 0 V to 36 V DC, integrated 2 mΩ shunt resistor (up to 15 A continuous). Operating supply 2.7 V to 5.5 V DC. I2C interface.

  • Substitution latitude: Supported via Adafruit INA260 library.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: INA260AIPWR

  • Identity: Texas Instruments INA3221 3-Channel High-Side Current and Bus Voltage Monitor.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: QFN-16 (4 mm x 4 mm) or breakout board.

  • Electrical constraints: Bus voltage 0 V to 26 V DC across 3 independent channels. Supply voltage 2.7 V to 5.5 V DC. I2C interface.

  • Substitution latitude: Supported via RobTillaart INA3221_RT library.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: INA3221AIRGVR

  • Identity: Maxim Integrated MAX17043 / MAX17048 I2C LiPo Fuel Gauge.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: TDFN-8 (2 mm x 3 mm) or Adafruit breakout board.

  • Electrical constraints: Operates from single-cell LiPo battery voltage (2.5 V to 4.5 V). ModelGauge algorithm tracks state of charge over I2C (address 0x36).

  • Substitution latitude: Supported via Adafruit MAX1704X library.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: MAX17048G+T10

  • Identity: Nuvoton NAU7802 24-Bit Dual-Channel Precision ADC for Wheatstone Bridges and Load Cells.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: SOP-16, DIP-16, or SparkFun Qwiic Scale breakout board.

  • Electrical constraints: Analog supply 2.7 V to 5.5 V DC. I2C interface.

  • Substitution latitude: Supported via SparkFun Qwiic Scale NAU7802 library.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: NAU7802SGI

  • Identity: Texas Instruments ADS1015 / ADS1115 Precision ADC (12-bit / 16-bit 4-Channel).

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: VSSOP-10, QFN-10, or Adafruit breakout board.

  • Electrical constraints: Supply voltage 2.0 V to 5.5 V DC. I2C interface.

  • Substitution latitude: Supported via Adafruit ADS1X15 library.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: ADS1115IDGSR

  • Identity: Maxim Integrated DS2482-100 / DS2484 Single-Channel I2C to 1-Wire Bus Master.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: SOIC-8, SOT-23-6, or Adafruit breakout board.

  • Electrical constraints: Operating voltage 1.71 V to 5.5 V DC. Connects standard 1-Wire Dallas DS18B20 temperature probes over I2C.

  • Substitution latitude: Supported via Adafruit DS248x library.

  • Control operated by student: No.

  • Sourcing plan: distributor lookup: DS2482S-100+T&R

  • Identity: DFRobot Rainfall Sensor (Tipping Bucket Counter).

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: Rain gauge mechanical bucket enclosure with pulse reed switch or I2C counter interface board.

  • Electrical constraints: 3.3 V to 5.0 V DC. Digital pulse or I2C bus.

  • Substitution latitude: Supported via DFRobot_RainfallSensor library.

  • Control operated by student: No.

  • Sourcing plan: retail shopping search: DFRobot Gravity rainfall sensor

  • Identity: DFRobot Lark Weather Station Module.

  • Quantity: 1 (optional telemetry module)

  • Footprint/package: Integrated 5-in-1 wind speed, direction, temperature, humidity, pressure module with serial/I2C output.

  • Electrical constraints: Supply voltage 3.3 V to 5.0 V DC.

  • Substitution latitude: Supported via meshtastic-DFRobot_LarkWeatherStation library.

  • Control operated by student: No.

  • Sourcing plan: retail shopping search: DFRobot Lark weather station

Software and network dependencies

  • PlatformIO Core / Build Toolchain

    • Source: PlatformIO ecosystem (pip / standalone installer at docs.platformio.org)
    • Version: not stated in the sources (configuration specifies check_tool = cppcheck and -Os -std=gnu++17)
    • Pinning: unpinned (global build system tool)
    • Manifest location: firmware_platformio.ini
    • Check plan: support-status lookup: platformio not stated
  • Espressif Arduino Core Framework (Arduino Target Base)

    • Source: Arduino framework for ESP32 / PlatformIO platform integration
    • Version: not stated in root configuration (sub-variant configurations omitted)
    • Pinning: unpinned in root configuration
    • Manifest location: firmware_platformio.ini line 80 (framework = arduino)
    • Check plan: not checkable: version not stated
  • Cppcheck Static Analysis Tool

    • Source: Cppcheck project
    • Version: not stated (firmware_platformio.ini sets compile flag -DAPP_VERSION=1.0.0)
    • Pinning: unpinned
    • Manifest location: firmware_platformio.ini line 71
    • Check plan: not checkable: version not stated
  • meshtastic-esp8266-oled-ssd1306

    • Source: https://github.com/meshtastic/esp8266-oled-ssd1306/archive/bb93fd40685f22e850330ea162f1dd154a4e0685.zip
    • Version: git commit bb93fd40685f22e850330ea162f1dd154a4e0685
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 58
    • Check plan: not checkable: commit-pinned GitHub archive without upstream package registry
  • meshtastic-OneButton

    • Source: https://github.com/meshtastic/OneButton/archive/fa352d668c53f290cfa480a5f79ad422cd828c70.zip
    • Version: git commit fa352d668c53f290cfa480a5f79ad422cd828c70
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 60
    • Check plan: not checkable: commit-pinned GitHub archive without upstream package registry
  • meshtastic-arduino-fsm

    • Source: https://github.com/meshtastic/arduino-fsm/archive/7db3702bf0cfe97b783d6c72595e3f38e0b19159.zip
    • Version: git commit 7db3702bf0cfe97b783d6c72595e3f38e0b19159
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 62
    • Check plan: not checkable: commit-pinned GitHub archive without upstream package registry
  • meshtastic-TinyGPSPlus

    • Source: https://github.com/meshtastic/TinyGPSPlus/archive/71a82db35f3b973440044c476d4bcdc673b104f4.zip
    • Version: git commit 71a82db35f3b973440044c476d4bcdc673b104f4
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 64
    • Check plan: not checkable: commit-pinned GitHub archive without upstream package registry
  • meshtastic-ArduinoThread

    • Source: https://github.com/meshtastic/ArduinoThread/archive/b841b0415721f1341ea41cccfb4adccfaf951567.zip
    • Version: git commit b841b0415721f1341ea41cccfb4adccfaf951567
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 66
    • Check plan: not checkable: commit-pinned GitHub archive without upstream package registry
  • Nanopb

    • Source: https://github.com/nanopb/nanopb/archive/0.4.92.zip
    • Version: 0.4.92
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 68
    • Check plan: vulnerability lookup: Nanopb / github / 0.4.92
  • ErriezCRC32

    • Source: https://github.com/Erriez/ErriezCRC32/archive/refs/tags/1.0.1.zip
    • Version: 1.0.1
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 70
    • Check plan: not checkable: Arduino library without advisory database
  • NonBlockingRTTTL

    • Source: https://github.com/end2endzone/NonBlockingRTTTL/archive/refs/tags/1.4.0.zip
    • Version: 1.4.0
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 84
    • Check plan: not checkable: Arduino library without advisory database
  • TBPubSubClient

    • Source: https://github.com/thingsboard/pubsubclient/archive/refs/tags/v2.12.1.zip
    • Version: v2.12.1
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 94
    • Check plan: not checkable: Arduino library without advisory database
  • NTPClient

    • Source: https://github.com/arduino-libraries/NTPClient/archive/refs/tags/3.2.1.zip
    • Version: 3.2.1
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 96
    • Check plan: not checkable: Arduino library without advisory database
  • Syslog

    • Source: https://github.com/arcao/Syslog/archive/refs/tags/v2.0.zip
    • Version: v2.0
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 101
    • Check plan: not checkable: Arduino library without advisory database
  • RadioLib

    • Source: https://github.com/jgromes/RadioLib/archive/510e00cfb05bbc3c2b7b524262785454944adb6e.zip
    • Version: git commit 510e00cfb05bbc3c2b7b524262785454944adb6e
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 105
    • Check plan: not checkable: commit-pinned GitHub archive without upstream package registry
  • meshtastic/device-ui

    • Source: https://github.com/meshtastic/device-ui/archive/5870d3a55254aa46bbcab13a5a700d533ab304e3.zip
    • Version: git commit 5870d3a55254aa46bbcab13a5a700d533ab304e3
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 109
    • Check plan: not checkable: commit-pinned GitHub archive without upstream package registry
  • Adafruit BusIO

    • Source: https://github.com/adafruit/Adafruit_BusIO/archive/refs/tags/1.17.4.zip
    • Version: 1.17.4
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 117
    • Check plan: not checkable: Arduino library without advisory database
  • Adafruit Unified Sensor

    • Source: https://github.com/adafruit/Adafruit_Sensor/archive/refs/tags/1.1.15.zip
    • Version: 1.1.15
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 119
    • Check plan: not checkable: Arduino library without advisory database
  • Adafruit GFX Library

    • Source: https://github.com/adafruit/Adafruit-GFX-Library/archive/refs/tags/1.12.6.zip
    • Version: 1.12.6
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 121
    • Check plan: not checkable: Arduino library without advisory database
  • Adafruit NeoPixel

    • Source: https://github.com/adafruit/Adafruit_NeoPixel/archive/1.15.5.zip
    • Version: 1.15.5
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 123
    • Check plan: not checkable: Arduino library without advisory database
  • Adafruit SSD1306

    • Source: https://github.com/adafruit/Adafruit_SSD1306/archive/2.5.17.zip
    • Version: 2.5.17
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 125
    • Check plan: not checkable: Arduino library without advisory database
  • Adafruit BMP280 Library

    • Source: https://github.com/adafruit/Adafruit_BMP280_Library/archive/refs/tags/3.0.0.zip
    • Version: 3.0.0
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 127
    • Check plan: not checkable: Arduino library without advisory database
  • Adafruit BMP085 Library

    • Source: https://github.com/adafruit/Adafruit-BMP085-Library/archive/refs/tags/1.2.4.zip
    • Version: 1.2.4
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 129
    • Check plan: not checkable: Arduino library without advisory database
  • Adafruit BME280 Library

    • Source: https://github.com/adafruit/Adafruit_BME280_Library/archive/refs/tags/2.3.0.zip
    • Version: 2.3.0
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 131
    • Check plan: not checkable: Arduino library without advisory database
  • Adafruit DPS310

    • Source: https://github.com/adafruit/Adafruit_DPS310/archive/refs/tags/1.1.6.zip
    • Version: 1.1.6
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 133
    • Check plan: not checkable: Arduino library without advisory database
  • Adafruit SH110x

    • Source: https://github.com/adafruit/Adafruit_SH110x/archive/2.1.15.zip
    • Version: 2.1.15
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 135
    • Check plan: not checkable: Arduino library without advisory database
  • Adafruit MCP9808 Library

    • Source: https://github.com/adafruit/Adafruit_MCP9808_Library/archive/refs/tags/2.0.2.zip
    • Version: 2.0.2
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 137
    • Check plan: not checkable: Arduino library without advisory database
  • Adafruit INA260

    • Source: https://github.com/adafruit/Adafruit_INA260/archive/refs/tags/1.5.3.zip
    • Version: 1.5.3
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 139
    • Check plan: not checkable: Arduino library without advisory database
  • Adafruit INA219

    • Source: https://github.com/adafruit/Adafruit_INA219/archive/refs/tags/1.2.3.zip
    • Version: 1.2.3
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 141
    • Check plan: not checkable: Arduino library without advisory database
  • Adafruit MPU6050

    • Source: https://github.com/adafruit/Adafruit_MPU6050/archive/refs/tags/2.2.9.zip
    • Version: 2.2.9
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 143
    • Check plan: not checkable: Arduino library without advisory database
  • Adafruit LIS3DH

    • Source: https://github.com/adafruit/Adafruit_LIS3DH/archive/refs/tags/1.3.0.zip
    • Version: 1.3.0
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 145
    • Check plan: not checkable: Arduino library without advisory database
  • Adafruit AHTX0

    • Source: https://github.com/adafruit/Adafruit_AHTX0/archive/refs/tags/2.0.6.zip
    • Version: 2.0.6
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 147
    • Check plan: not checkable: Arduino library without advisory database
  • Adafruit LSM6DS

    • Source: https://github.com/adafruit/Adafruit_LSM6DS/archive/refs/tags/4.7.4.zip
    • Version: 4.7.4
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 149
    • Check plan: not checkable: Arduino library without advisory database
  • Adafruit TSL2591 Library

    • Source: https://github.com/adafruit/Adafruit_TSL2591_Library/archive/refs/tags/1.4.5.zip
    • Version: 1.4.5
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 151
    • Check plan: not checkable: Arduino library without advisory database
  • EmotiBit MLX90632

    • Source: https://github.com/EmotiBit/EmotiBit_MLX90632/archive/refs/tags/v1.0.8.zip
    • Version: v1.0.8
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 153
    • Check plan: not checkable: Arduino library without advisory database
  • Adafruit MLX90614 Library

    • Source: https://github.com/adafruit/Adafruit-MLX90614-Library/archive/refs/tags/2.1.6.zip
    • Version: 2.1.6
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 155
    • Check plan: not checkable: Arduino library without advisory database
  • INA3221_RT

    • Source: https://github.com/RobTillaart/INA3221_RT/archive/refs/tags/0.4.2.zip
    • Version: 0.4.2
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 157
    • Check plan: not checkable: Arduino library without advisory database
  • QMC5883L Compass

    • Source: https://github.com/mprograms/QMC5883LCompass/archive/refs/tags/v1.2.3.zip
    • Version: v1.2.3
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 159
    • Check plan: not checkable: Arduino library without advisory database
  • DFRobot_RTU

    • Source: https://github.com/DFRobot/DFRobot_RTU/archive/refs/tags/V1.0.6.zip
    • Version: V1.0.6
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 161
    • Check plan: not checkable: Arduino library without advisory database
  • DFRobot_RainfallSensor

    • Source: https://github.com/DFRobot/DFRobot_RainfallSensor/archive/38fea5e02b40a5430be6dab39a99a6f6347d667e.zip
    • Version: git commit 38fea5e02b40a5430be6dab39a99a6f6347d667e
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 163
    • Check plan: not checkable: commit-pinned GitHub archive without upstream package registry
  • SparkFun AS3935 Lightning Detector Arduino Library

    • Source: https://github.com/sparkfun/SparkFun_AS3935_Lightning_Detector_Arduino_Library/archive/refs/tags/v1.4.9.zip
    • Version: v1.4.9
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 165
    • Check plan: not checkable: Arduino library without advisory database
  • RobTillaart INA226

    • Source: https://github.com/RobTillaart/INA226/archive/refs/tags/0.6.6.zip
    • Version: 0.6.6
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 167
    • Check plan: not checkable: Arduino library without advisory database
  • SparkFun MAX3010x Sensor Library

    • Source: https://github.com/sparkfun/SparkFun_MAX3010x_Sensor_Library/archive/refs/tags/v1.1.2.zip
    • Version: v1.1.2
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 169
    • Check plan: not checkable: Arduino library without advisory database
  • SparkFun ICM-20948 Arduino Library

    • Source: https://github.com/sparkfun/SparkFun_ICM-20948_ArduinoLibrary/archive/refs/tags/v1.3.2.zip
    • Version: v1.3.2
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 171
    • Check plan: not checkable: Arduino library without advisory database
  • TDK InvenSense ICM42670P

    • Source: https://github.com/tdk-invn-oss/motion.arduino.ICM42670P/archive/refs/tags/1.0.8.zip
    • Version: 1.0.8
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 173
    • Check plan: not checkable: Arduino library without advisory database
  • Adafruit LTR390

    • Source: https://github.com/adafruit/Adafruit_LTR390/archive/refs/tags/1.1.2.zip
    • Version: 1.1.2
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 175
    • Check plan: not checkable: Arduino library without advisory database
  • Adafruit PCT2075

    • Source: https://github.com/adafruit/Adafruit_PCT2075/archive/1.3.1.zip
    • Version: 1.3.1
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 177
    • Check plan: not checkable: Arduino library without advisory database
  • DFRobot_BMM150

    • Source: https://github.com/DFRobot/DFRobot_BMM150/archive/refs/tags/V1.0.0.zip
    • Version: V1.0.0
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 179
    • Check plan: not checkable: Arduino library without advisory database
  • SparkFun MMC5983MA Magnetometer Arduino Library

    • Source: https://github.com/sparkfun/SparkFun_MMC5983MA_Magnetometer_Arduino_Library/archive/v1.1.5.zip
    • Version: v1.1.5
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 181
    • Check plan: not checkable: Arduino library without advisory database
  • Adafruit_TSL2561

    • Source: https://github.com/adafruit/Adafruit_TSL2561/archive/refs/tags/1.1.3.zip
    • Version: 1.1.3
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 183
    • Check plan: not checkable: Arduino library without advisory database
  • BH1750_WE

    • Source: https://github.com/wollewald/BH1750_WE/archive/refs/tags/1.1.10.zip
    • Version: 1.1.10
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 185
    • Check plan: not checkable: Arduino library without advisory database
  • meshtastic-Fusion

    • Source: https://github.com/meshtastic/Fusion/archive/936e1eb1e5ea19e8f4ed467526f91adeebb4f53c.zip
    • Version: git commit 936e1eb1e5ea19e8f4ed467526f91adeebb4f53c
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 187
    • Check plan: not checkable: commit-pinned GitHub archive without upstream package registry
  • Sensirion Core (arduino-core)

    • Source: https://github.com/Sensirion/arduino-core/archive/refs/tags/0.7.3.zip
    • Version: 0.7.3
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 189
    • Check plan: not checkable: Arduino library without advisory database
  • Sensirion I2C SCD4x (arduino-i2c-scd4x)

    • Source: https://github.com/Sensirion/arduino-i2c-scd4x/archive/refs/tags/1.1.0.zip
    • Version: 1.1.0
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 191
    • Check plan: not checkable: Arduino library without advisory database
  • Sensirion I2C SFA3x (arduino-i2c-sfa3x)

    • Source: https://github.com/Sensirion/arduino-i2c-sfa3x/archive/refs/tags/1.0.0.zip
    • Version: 1.0.0
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 193
    • Check plan: not checkable: Arduino library without advisory database
  • Sensirion I2C SCD30 (arduino-i2c-scd30)

    • Source: https://github.com/Sensirion/arduino-i2c-scd30/archive/1.1.1.zip
    • Version: 1.1.1
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 195
    • Check plan: not checkable: Arduino library without advisory database
  • arduino-sht

    • Source: https://github.com/Sensirion/arduino-sht/archive/refs/tags/v1.2.6.zip
    • Version: v1.2.6
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 197
    • Check plan: not checkable: Arduino library without advisory database
  • Adafruit SPA06_003

    • Source: https://github.com/adafruit/Adafruit_SPA06_003/archive/refs/tags/1.0.2.zip
    • Version: 1.0.2
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 199
    • Check plan: not checkable: Arduino library without advisory database
  • Seeed_PM2_5_sensor_HM3301

    • Source: https://github.com/meshtastic/Seeed_PM2_5_sensor_HM3301/archive/2704ca254c7e2136c52ac23198dd05f5ba1e2f04.zip
    • Version: git commit 2704ca254c7e2136c52ac23198dd05f5ba1e2f04
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 201
    • Check plan: not checkable: commit-pinned GitHub archive without upstream package registry
  • Adafruit BMP3XX

    • Source: https://github.com/adafruit/Adafruit_BMP3XX/archive/refs/tags/2.1.6.zip
    • Version: 2.1.6
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 209
    • Check plan: not checkable: Arduino library without advisory database
  • Adafruit MAX1704X

    • Source: https://github.com/adafruit/Adafruit_MAX1704X/archive/refs/tags/1.0.3.zip
    • Version: 1.0.3
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 211
    • Check plan: not checkable: Arduino library without advisory database
  • Adafruit LPS2X

    • Source: https://github.com/adafruit/Adafruit_LPS2X/archive/refs/tags/2.0.6.zip
    • Version: 2.0.6
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 213
    • Check plan: not checkable: Arduino library without advisory database
  • Adafruit VEML7700

    • Source: https://github.com/adafruit/Adafruit_VEML7700/archive/refs/tags/2.1.6.zip
    • Version: 2.1.6
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 215
    • Check plan: not checkable: Arduino library without advisory database
  • SparkFun Qwiic Scale NAU7802 Arduino Library

    • Source: https://github.com/sparkfun/SparkFun_Qwiic_Scale_NAU7802_Arduino_Library/archive/refs/tags/v1.0.6.zip
    • Version: v1.0.6
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 217
    • Check plan: not checkable: Arduino library without advisory database
  • ClosedCube OPT3001

    • Source: PlatformIO Registry closedcube/ClosedCube OPT3001@1.1.2
    • Version: 1.1.2
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 219
    • Check plan: not checkable: Arduino library without advisory database
  • meshtastic-DFRobot_LarkWeatherStation

    • Source: https://github.com/meshtastic/DFRobot_LarkWeatherStation/archive/4de3a9cadef0f6a5220a8a906cf9775b02b0040d.zip
    • Version: git commit 4de3a9cadef0f6a5220a8a906cf9775b02b0040d
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 221
    • Check plan: not checkable: commit-pinned GitHub archive without upstream package registry
  • Adafruit ADS1X15 Library

    • Source: https://github.com/adafruit/Adafruit_ADS1X15/archive/refs/tags/2.6.2.zip
    • Version: 2.6.2
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 233
    • Check plan: not checkable: Arduino library without advisory database
  • Adafruit DS248x

    • Source: https://github.com/adafruit/Adafruit_DS248x/archive/refs/tags/1.2.0.zip
    • Version: 1.2.0
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 235
    • Check plan: not checkable: Arduino library without advisory database
  • Adafruit_BME680

    • Source: https://github.com/adafruit/Adafruit_BME680/archive/refs/tags/2.0.6.zip
    • Version: 2.0.6
    • Pinning: pinned in firmware_platformio.ini
    • Manifest location: firmware_platformio.ini line 237
    • Check plan: not checkable: Arduino library without advisory database
  • Meshtastic Python Client and CLI (meshtastic)

    • Source: PyPI (meshtastic) and GitHub Container Registry (ghcr.io/meshtastic/python)
    • Version: not stated in python_cli_README.md
    • Pinning: unpinned
    • Manifest location: python_cli_README.md
    • Check plan: not checkable: version not stated

Network Exposure and Security Properties:

  • LoRa Mesh Physical Radio Interface:

    • Joins a decentralized off-grid Sub-GHz mesh network constrained by a 256-byte maximum packet transmission unit (MTU).
    • Channels (broadcast/group traffic) are encrypted with a pre-shared key (PSK) using AES256-CTR. Channel traffic is unauthenticated on firmware versions ≤ 2.7.x; firmware 2.8.x adds XEdDSA digital packet signatures.
    • Direct and administrative messages use asymmetric public key cryptography (X25519 key exchange with AES-CCM authenticated encryption). Node identity is managed via Trust-On-First-Use (TOFU).
    • Admin control sessions use short-lived session IDs to mitigate replay attacks.
  • Local Trust Boundary & Ingress Ports:

    • Full unauthenticated local API access is granted by design across Bluetooth (BLE), USB Serial (115200 baud direct via CDC ACM or CP2102/CH9102), Wi-Fi, and Ethernet per firmware_SECURITY.md. Any client on these physical or network links possesses administrative privileges (can read decrypted traffic, transmit as the node, modify device configurations, and export node private keys).
    • Wi-Fi networking provides an integrated web server interface and device management UI (meshtastic/device-ui). Port numbers are not stated in the sources.
    • Setting Wi-Fi credentials or performing local device administration over an untrusted Wi-Fi connection transmits credentials and control traffic unencrypted to the local network per firmware_SECURITY.md.
    • MQTT Client: Connects outwards to MQTT brokers via TBPubSubClient (ThingsBoard PubSub) to bridge mesh packets to TCP/IP networks. Listening port not applicable (client-initiated TCP socket).
    • NTP Client: Sends UDP time-synchronization queries to network time servers on UDP port 123 via NTPClient.
    • Syslog Client: Broadcasts logging telemetry via UDP port 514 using Syslog.
    • Documented Default Credentials: None exist; access control relies entirely on the assumption of a secure local trust boundary.

Downloads, URLs, and Fabrication

External URLs and Repositories Referenced:

  • Firmware project repository: https://github.com/meshtastic/firmware
  • Python client repository: https://github.com/meshtastic/python
  • Docker container image: ghcr.io/meshtastic/python
  • Meshtastic Project documentation: https://meshtastic.org/docs/
  • Firmware build guide: https://meshtastic.org/docs/development/firmware/build
  • Firmware flashing instructions: https://meshtastic.org/docs/getting-started/flashing-firmware/
  • Encryption technical reference: https://meshtastic.org/docs/development/reference/encryption-technical/
  • Python CLI installation guide: https://meshtastic.org/docs/software/python/cli/installation
  • Python API documentation: https://python.meshtastic.org
  • PlatformIO Project documentation: https://docs.platformio.org/page/projectconf.html

PCB Fabrication Specifications:

  • No Gerber files, drill files, or PCB layout files (.kicad_pcb, .brd) were provided in the design upload.
  • Physical fabrication parameters for the primary target board (Heltec WiFi LoRa 32 V3) are internal to Heltec Automation: multi-layer FR4 construction (typically 4 layers to accommodate high-density ESP32-S3 BGA breakout and 50 Ω controlled-impedance microstrip RF routing from SX1262 to U.FL connector), matte black soldermask with lead-free HASL or ENIG surface finish, board dimensions approximately 50.8 mm x 22.8 mm x 8 mm.
  • When assembling the node using modular breakouts (DIY variant), assembly uses a 2-layer or 4-layer carrier PCB or breadboard wiring with 3.3 V point-to-point connections for SPI, I2C, and UART peripherals.