Readiness report
Meshtastic LoRa Mesh Radio Node · 2026-09-03 03:11 · complete · 54 searches, 10 pages fetched
Cybersecurity — software & network: Do not place on an open network · 21 findings
Details in the Cybersecurity section of the report below.
Readiness: Meshtastic LoRa Mesh Radio Node
Verdict: Ready with caveats · 2026-09-03 · est. parts cost $35–$60 per core node (optional telemetry sensors add $1.40–$54 each) Cybersecurity — software & network: Do not place on an open network
This is the cold check — no previous readiness report exists for this lab, so every price, stock level and lifecycle status below establishes the baseline that the next check will measure drift against. The core node is fully sourceable today: the Heltec WiFi LoRa 32 V3 is listed by the vendor at $17.90–$19.90 with no end-of-life notice and sells through US resellers at $28.57–$35.99, and the antenna, U.FL-to-SMA pigtail, 1S LiPo and USB-C data cable are all commodity items in stock. The caveats are entirely in the optional telemetry-sensor menu: two sensors are obsolete (DPS310XTSA1, TSL2561FN), one is discontinued with no authorized stock anywhere (LTR-390UV-01), one is Not For New Designs (BH1750FVI-TR), and two BOM part numbers (SCD41-2090, WS2812B-B) are listed by no authorized distributor at all. A further group of bare sensor ICs has zero distributor stock with 8–45 week factory lead times, but the snapshot explicitly permits breakout modules for each of them and those breakouts are Active and in stock.
Action required
| Part | Problem | Recommended action |
|---|---|---|
| DPS310XTSA1 | Obsolete at Infineon; zero stock at Newark, Mouser and DigiKey (14-week factory lead); ECIA lifecycle risk High | Substitute DPS368XTSA1 ($2.70, 196 in stock) — identical package and supply rail, but confirm absolute-vs-gauge pressure reference and Adafruit DPS310 library support first. See Substitutes. |
| TSL2561FN | Obsolete; zero stock at DigiKey (16-week lead) and Mouser; ECIA lifecycle risk High | Switch the optional light sensor to TSL25911FN ($1.74, 29,061 in stock), which this lab already supports as its own BOM line and driver. Not a footprint drop-in. |
| LTR-390UV-01 | "Discontinued at DigiKey"; zero stock at Avnet, Mouser and DigiKey (18-week lead) | No verified substitute found — this is the BOM's only UV-capable sensor. Source manually or drop the UV module from the exercise. |
| SCD41-2090 | No authorized distributor lists this part number (DigiKey 0 results; ECIA "no authorized distributor") | Order SCD41-D-R2 ($20.54, 13,032 in stock) — Sensirion's actual catalog code for this sensor. |
| WS2812B-B | No authorized distributor lists this part number (DigiKey 0 results; ECIA "no authorized distributor") | Order a generic 5050 WS2812B: SparkFun 16347 ($0.68, 196,668 in stock). Confirm the 3.3 V data-logic threshold from the datasheet. |
| BH1750FVI-TR | Not For New Designs; only one ECIA distributor holds stock | Buildable today (2,532 in stock at $3.42) — buy what the course needs now, and expect to switch to VEML7700 or OPT3001 at the next check. |
| BME280, BME680, BMM150, MPU-6050, ICM-20948 (bare ICs) | Zero stock across ECIA-authorized distributors; 8–45 week factory lead times; MPU-6050 and ICM-20948 carry High lifecycle and supply-chain risk | Buy the vendor breakout boards the snapshot already permits — all Active and in stock. See Substitutes. |
| USB Type-A to Type-C cable | Heltec's own FAQ states the board reboots intermittently below 600 mA; the snapshot specifies only "minimum 500 mA rated" | Specify a data cable rated 600 mA or better. The Adafruit #4474 cable below is forced to 5 V at up to ~2 A. |
| DFRobot Lark Weather Station | Not carried by DigiKey or any ECIA distributor (SKU EDU0157-EN returned 0 results); vendor page carried no price | Order direct from DFRobot; price not established this run. |
Cybersecurity — software & network
Do not place on an open network — The firmware grants unauthenticated administrative access - including export of the node's private keys - to anyone on its Bluetooth, USB, Wi-Fi or Ethernet interfaces by design, and that has no fix, only isolation.
| Component | Version | How known | Support status |
|---|---|---|---|
| Meshtastic firmware (meshtastic/firmware) | not determined | not determined (The lab's firmware_platformio.ini pins library archives, not a firmware release; its -DAPP_VERSION=1.0.0 is a build placeholder, not the firmware's version.) | — |
| Meshtastic Python client and CLI (meshtastic, PyPI) | not determined | unpinned (python_cli_README.md installs from PyPI with no version constraint, so an instructor gets whatever is current on the day.) | — |
| PlatformIO Core build toolchain | not determined | unpinned (firmware_platformio.ini names PlatformIO as the build system without a version.) | — |
| Espressif Arduino core framework | not determined | unpinned (firmware_platformio.ini line 80 sets framework = arduino with no version.) | — |
| Cppcheck static analysis tool | not determined | not determined (firmware_platformio.ini line 71 sets check_tool = cppcheck with no version.) | — |
| RadioLib (LoRa transceiver driver) | 510e00cfb05bbc3c2b7b524262785454944adb6e | inferred (Commit-pinned GitHub archive at firmware_platformio.ini line 105, as recorded in the snapshot; not re-read from a file fetched this run.) | — |
| meshtastic/device-ui (on-device and web UI) | 5870d3a55254aa46bbcab13a5a700d533ab304e3 | inferred (Commit-pinned GitHub archive at firmware_platformio.ini line 109, as recorded in the snapshot.) | — |
| Nanopb (protocol buffer runtime) | 0.4.92 | inferred (GitHub tag archive at firmware_platformio.ini line 68, as recorded in the snapshot; PyPI has no such version (see Not checked).) | — |
| TBPubSubClient (MQTT client) | v2.12.1 | inferred (Tag archive at firmware_platformio.ini line 94, as recorded in the snapshot.) | — |
| NTPClient | 3.2.1 | inferred (Tag archive at firmware_platformio.ini line 96, as recorded in the snapshot.) | — |
| Syslog (UDP logging client) | v2.0 | inferred (Tag archive at firmware_platformio.ini line 101, as recorded in the snapshot.) | — |
| Arduino/PlatformIO library set (about 50 further archives) | not determined | not determined (Each is pinned by git tag or commit in firmware_platformio.ini; none belongs to a package registry with an advisory database.) | — |
| urllib3 | 2.6.3 | read from project (poetry.lock of meshtastic/python, fetched this run) | — |
| click | 8.1.8 | read from project (poetry.lock of meshtastic/python, fetched this run) | — |
| requests | 2.32.5 | read from project (poetry.lock of meshtastic/python, fetched this run) | — |
| pillow | 11.3.0 | read from project (poetry.lock of meshtastic/python, fetched this run (12.0.0 is also pinned there and carries the same advisories)) | — |
| jupyterlab | 4.5.7 | read from project (poetry.lock of meshtastic/python, fetched this run) | — |
| jupyter-server | 2.18.2 | read from project (poetry.lock of meshtastic/python, fetched this run (2.19.0 also pinned there, same advisory)) | — |
| mistune | 3.2.1 | read from project (poetry.lock of meshtastic/python, fetched this run) | — |
| tornado | 6.5.6 | read from project (poetry.lock of meshtastic/python, fetched this run) | — |
| soupsieve | 2.8 | read from project (poetry.lock of meshtastic/python, fetched this run) | — |
| pyarrow | 18.1.0 | read from project (poetry.lock of meshtastic/python, fetched this run (22.0.0 also pinned there, same advisory)) | — |
| bleach | 6.3.0 | read from project (poetry.lock of meshtastic/python, fetched this run (6.2.0 also pinned there)) | — |
| werkzeug | 3.0.6 | read from project (poetry.lock of meshtastic/python, fetched this run) | — |
| flask | 3.0.3 | read from project (poetry.lock of meshtastic/python, fetched this run) | — |
| pytest | 8.4.2 | read from project (poetry.lock of meshtastic/python, fetched this run) | — |
| setuptools | 82.0.1 | read from project (poetry.lock of meshtastic/python, fetched this run) | — |
| Component | Finding | Severity | Fix available? |
|---|---|---|---|
| jupyter-server | The notebook server pinned in the Meshtastic Python project's poetry.lock stores cross-site scripting through its nbconvert handlers; it runs on the instructor's computer, not on the radio node. — GHSA-fcw5-x6j4-ccmp, CVE-2026-44727 | critical | Yes - update to 2.20.0 |
| click | The command-line parsing library pinned in the project's lockfile lets an unprivileged caller inject operating-system commands through click.edit(). — PYSEC-2026-2132, CVE-2026-7246 | high | Yes - update to 8.3.3 |
| jupyterlab | The notebook environment declared in pyproject.toml has several cross-site scripting and extension-blocklist bypass flaws; it is analysis tooling on the instructor's computer, not firmware on the node. — GHSA-gx64-gj6p-pc4c, GHSA-pppj-hq3g-57pj, GHSA-89vp-jrxv-24w8, GHSA-h5v5-8746-g7mm (+2 more) | high | Yes - update to 4.5.10 |
| mistune | The markdown renderer that comes with the notebook toolchain can be stalled by crafted input and can be tricked into emitting javascript: URLs. — GHSA-qcq2-496w-v96p, GHSA-4j32-57v6-6g45, GHSA-c8j7-8cv4-2xmq, GHSA-ffq3-xpv3-j92q (+2 more) | high | Yes - update to 3.3.0 |
| pillow | The image library used by the project's plotting and notebook extras has several out-of-bounds writes and decompression-bomb bypasses that a malicious image file could trigger on the instructor's computer. — GHSA-xj96-63gp-2gmr, GHSA-pwv6-vv43-88gr, GHSA-jjj6-mw9f-p565, GHSA-6r8x-57c9-28j4 (+2 more) | high | Yes - update to 12.3.0 |
| pyarrow | The data-table library used by the project's analysis extras has a use-after-free when reading a crafted Arrow IPC file. — GHSA-rgxp-2hwp-jwgg, CVE-2026-25087 | high | Yes - update to 23.0.1 |
| soupsieve | The CSS selector library used by the HTML tooling can be driven into memory exhaustion or a regular-expression denial of service by long selector lists. — GHSA-2wc2-fm75-p42x, GHSA-836r-79rf-4m37 | high | Yes - update to 2.8.4 |
| tornado | The web server underneath the notebook toolchain can be stalled by a single crafted request and leaks per-request credentials when its curl client reuses handles. — GHSA-mpf4-983q-p7j4, GHSA-pw6j-qg29-8w7f, GHSA-8423-8fgw-73vq, GHSA-wwv5-g3v4-889x | high | Yes - update to 6.5.8 |
| urllib3 | The HTTP library the CLI uses to talk to the network can be made to bypass decompression-bomb limits and can leak sensitive headers across origins on proxied redirects. — GHSA-mf9v-mfxr-j63j, GHSA-qccp-gfcp-xxvc | high | Yes - update to 2.7.0 |
| bleach | The HTML sanitiser used by the notebook toolchain lets some dangerous URI schemes through, and one of its three flaws - CPU exhaustion in linkify(parse_email=True) - has no fixed version at all. — GHSA-gj48-438w-jh9v, GHSA-g75f-g53v-794x, GHSA-8rfp-98v4-mmr6 | moderate | Mitigation only - updating to 6.4.0 fixes two of the three; for the email-linkify CPU exhaustion there is no fixed release, so avoid linkify(parse_email=True) on untrusted text. |
| pytest | The test runner declared in pyproject.toml handles temporary directories unsafely; it matters only to someone running the project's own test suite. — GHSA-6w46-j5rx-g56g, CVE-2025-71176 | moderate | Yes - update to 9.0.3 |
| requests | The HTTP client the CLI uses reuses an insecure temporary file in extract_zipped_paths(), which a local user on the same machine could exploit. — GHSA-gc5v-m9x4-r6x2, CVE-2026-25645 | moderate | Yes - update to 2.33.0 |
| setuptools | The Python packaging tool can be tricked into including files a MANIFEST.in meant to exclude when building a source distribution on macOS. — GHSA-h35f-9h28-mq5c, CVE-2026-59890 | moderate | Yes - update to 83.0.0 |
| werkzeug | The web toolkit under the project's dashboard extras mishandles Windows special device names in safe_join(), which can be used to reach unintended files on a Windows host. — GHSA-29vq-49wr-vm6x, GHSA-87hc-h4r5-73f7, GHSA-hgf8-39gv-g3f2 | moderate | Yes - update to 3.1.6 |
| flask | The web framework under the project's dashboard extras omits a Vary: Cookie header in some session paths, which can cause a shared cache to serve one user's page to another. — GHSA-68rp-wp8r-4726, CVE-2026-27205 | low | Yes - update to 3.1.3 |
| LoRa channel encryption | Group and broadcast channel traffic is protected only by a shared pre-shared key with AES256-CTR and is unauthenticated on firmware 2.7.x and earlier, so anyone holding the channel key can transmit as any node; because this lab's firmware version is not determined, it is unknown whether the 2.8.x packet signing applies. | posture | Mitigation only - give each class its own channel key rather than a shared default, and treat everything sent on a channel as readable by anyone who has that key. |
| Meshtastic firmware - local trust boundary | By design the node grants full, unauthenticated administrative access over Bluetooth LE, USB serial, Wi-Fi and Ethernet: anyone who reaches one of those links can read decrypted traffic, transmit as the node, change its configuration and export its private keys. | posture | Mitigation only - treat any BLE, USB, Wi-Fi or Ethernet access as complete control of the node: set the BLE pairing PIN, keep nodes physically supervised, and do not enable the Wi-Fi or Ethernet interfaces on a shared campus network. |
| Meshtastic Python CLI dependencies | Dependencies unpinned: 42 of 42 in pyproject.toml, and the lab itself pins no version of the meshtastic CLI, so what an instructor installs has no fixed, checkable security state. | posture | Mitigation only - pin versions / install from the project's poetry.lock rather than letting pip resolve whatever is current. |
| MQTT bridge (TBPubSubClient) | The node can bridge mesh packets outward to an MQTT broker over TCP/IP, which republishes classroom mesh traffic beyond the room. | posture | Mitigation only - leave the MQTT uplink disabled unless publishing mesh traffic is an intended part of the exercise. |
| Syslog and NTP clients | When enabled the node broadcasts log telemetry unencrypted on UDP port 514 and sends unauthenticated time queries on UDP port 123. | posture | Mitigation only - leave syslog off outside debugging, and expect the node to reach a time server if it is on a network. |
| Wi-Fi device administration | Setting Wi-Fi credentials or administering the node over an untrusted Wi-Fi link sends those credentials and the control traffic unencrypted onto the local network. | posture | Mitigation only - do all device configuration over the USB serial link, never over untrusted Wi-Fi. |
What this means for your lab
Two things matter here, and neither is a software bug. First, a Meshtastic node hands out complete control to anyone who can reach it over Bluetooth, USB, Wi-Fi or Ethernet - there is no password, by design. Someone within Bluetooth range, or on the same Wi-Fi network, can read the messages your mesh is carrying, send messages that appear to come from your node, change its settings and copy out its private keys. So keep these nodes off the campus network: configure them over the USB cable, leave the Wi-Fi and Ethernet interfaces switched off, set the Bluetooth pairing PIN, and do not leave a node unattended where a stranger can pick it up. Second, the radio channel itself is protected only by a shared key: everyone who has that key can read and send on the channel, so give each class its own key instead of a default one, and treat anything sent over the mesh as readable by anyone you handed the key to. On the software side, the lab pins no version of the Meshtastic firmware or of the Python command-line tool, so we could not check either against a vulnerability database - that is an unknown, not a clean bill of health. The advisories listed above were found in the Meshtastic Python project's own dependency lockfile, and most of them affect notebook and plotting tools that run on your computer rather than anything on the radio; the ones worth acting on are the HTTP libraries the command-line tool actually uses. Before connecting these nodes to anything the campus runs, raise it with campus IT.
Not checked
- Meshtastic firmware (meshtastic/firmware): Version not determined - the lab pins library archives and a placeholder -DAPP_VERSION=1.0.0 rather than a firmware release, so no advisory database could be queried for the firmware itself. This is a real gap, not a clean result.
- Meshtastic Python CLI (the meshtastic package itself): Unpinned - the lab installs whatever PyPI serves on the day, so there is no specific version to check. The advisories above come from the upstream project's own poetry.lock, which is what the project developers pin, not necessarily what pip resolves for an instructor.
- Arduino and PlatformIO libraries pinned in firmware_platformio.ini (about 50 archives): No vulnerability database covers Arduino/PlatformIO library archives pinned by git tag or commit - including RadioLib, meshtastic/device-ui, TBPubSubClient, NTPClient, Syslog, TinyGPSPlus, OneButton, ArduinoThread, arduino-fsm, Fusion, the Adafruit, SparkFun, Sensirion and DFRobot driver sets. Absence of an advisory here means nothing was checked, not that they are clean.
- PlatformIO Core build toolchain: Version not stated in the sources, so neither a support-status nor an advisory lookup was possible.
- Espressif Arduino core framework: Version not stated in the root configuration (framework = arduino only).
- Cppcheck static analysis tool: Version not stated in the sources.
- nanopb 0.4.92: this version does not exist in the package registry (a kit or hardware release number is not a software version)
Parts
Primary host platform
| Part | Spec/Package | Status | Stock | Price | Source |
|---|---|---|---|---|---|
| Heltec WiFi LoRa 32 (V3) | ESP32-S3FN8 + SX1262, 18-pin DIP module, onboard 0.96" OLED, SH1.25-2 battery header | Active, no EOL notice on vendor page | Vendor listing live; US resellers stocking | $17.90–$19.90 (Heltec) · $29.97 (Rokland) | Heltec Automation; Rokland, AliExpress $28.57, Banggood $35.99 |
Modular core components (DIY / custom builds)
| Part | Spec/Package | Status | Stock | Price | Source |
|---|---|---|---|---|---|
| SX1262IMLTRT | 150–960 MHz, 22 dBm, 1.8–3.7 V, 24-VFQFN (4x4) | Active | 37,721 (DigiKey); Newark 2,188, Mouser 28 | $8.53 | DigiKey (Semtech) |
| Sub-GHz antenna, 915 MHz, SMA | 50 Ω, SMA male whip/paddle | Available (retail) | Multiple sellers | $3.40–$12.99 | Elecrow $3.40, Nooelec $8.95, Bingfu $9.99, Meshnology $12.99. One antenna ships with the Heltec board. |
| U.FL to SMA female pigtail | RG178, 15 cm, panel-mount SMA | Available | In stock | $3.95 | Adafruit #851 (SMA, not RP-SMA — #852 is the RP-SMA version and is not compatible) |
| 1S LiPo battery, 1.25 mm connector | 3.7 V, 2000 mAh, JST 1.25, PCM protection | Available (retail) | Multiple sellers | $7.95 | Ameridroid $7.95, MakerNova $7.99, MakerFocus 4-pack $24.99. 1.25 mm connectors have no standard polarity — check before connecting. |
| USB 2.0 Type-A to Type-C cable | ~1 m, 28 AWG data + 24 AWG power, 5 V up to ~2 A | Available | In stock | $4.95 | Adafruit #4474 (data cable — power-only cables fail flashing) |
Displays, indicators and user controls
| Part | Spec/Package | Status | Stock | Price | Source |
|---|---|---|---|---|---|
| 0.96" I2C OLED module (SSD1306) | 128x64, 4-pin 2.54 mm, 3.3–5 V | Available (retail); integrated on the Heltec V3 | Multiple sellers | $2.07–$19.50 | AliExpress $2.07, BuyDisplay $2.49, Elecrow $3.10, CANADUINO via DigiKey $4.99 |
| PTS645SM43SMTR92 LFS (tactile switch, x2) | SPST NO, finger-accessible tactile | Active | 173,986 | $0.36 | DigiKey (C&K) |
| WS2812B-B (addressable RGB LED) | 5050 SMD, single-wire 800 kHz | Part number not listed by any authorized distributor | — | — | DigiKey 0 results; ECIA: no authorized distributor lists this exact part number. See Substitutes. |
GNSS / location peripherals
| Part | Spec/Package | Status | Stock | Price | Source |
|---|---|---|---|---|---|
| Serial GNSS module (u-blox NEO-8M class) | Breakout with ceramic patch antenna, 3.3 V UART, NMEA-0183 | Available (retail); bare u-blox modules via distribution | Multiple sellers | $5.00–$49.99 | GY-NEO-6M/7M/8M breakout $5.00 (Xpart); bare u-blox NEO-M8M-0 $13.26 (DigiKey), $8.39 (Richardson RFPD) |
Environmental telemetry sensors (all optional)
| Part | Spec/Package | Status | Stock | Price | Source |
|---|---|---|---|---|---|
| BME280 | LGA-8 or breakout, 1.71–3.6 V, I2C | Bare IC hard to obtain (0 stock ECIA-wide, 12-week lead); breakout Active | 2,603 (breakout) | $14.95 | Adafruit #2652 breakout (bare Bosch BME280 unavailable) |
| DPS310XTSA1 | 8-VFLGA (PG-VLGA-8-1), 1.7–3.6 V | Obsolete | 0 everywhere; 14-week factory lead | no price | DigiKey (Infineon) — see Substitutes |
| LPS22HBTR | 10-WFLGA / 10-HLGA (2x2), 1.7–3.6 V | Active | 0 at DigiKey; Future 16,000, Newark 11,973, Arrow 2,914, Mouser 86 | $3.18 (DigiKey list) · $3.12 Newark | ST via Newark/Future/Arrow |
| MCP9808-E/MS | 8-MSOP, 2.7–5.5 V | Active | 4,965 | $1.40 | DigiKey (Microchip) |
| PCT2075DP,118 | 8-TSSOP, 2.7–5.5 V | Active | 61,665 | $0.76 | DigiKey (NXP) |
| AHT20 | SMD-6 or breakout, 2.0–5.5 V, I2C 0x38 | Bare part not ECIA-listed; module Active | 1,183 | $4.50 | Adafruit #5183 (2.2–5.5 V, 4-SIP); #4566 STEMMA QT also $4.50, 833 |
| SHT31-DIS-B | 8-VFDFN / 8-DFN (2.5x2.5), 2.15–5.5 V | Active | 18,534 (reel code B2.5KS); Newark 9,573 on the base number | $4.50 · $4.88 Newark | DigiKey stocks SHT31-DIS-B2.5KS (same die/package, reel quantity suffix) |
| SCD41-2090 | SMD-20 or breakout, 2.4–5.5 V | Part number not listed by any authorized distributor | — | — | DigiKey 0 results; ECIA: none. Order SCD41-D-R2 instead — see Substitutes. |
| SCD30 | Module, 3.3–5.5 V, 75 mA | Active | 6,690 | $47.36 | DigiKey (Sensirion) |
| SFA30 | Module, 4-pin header, 3.15–5.5 V | Active | 111 | $54.00 | Seeed Grove SFA30 via DigiKey (bare SFA30 not ECIA-listed) |
| BME680 | LGA-8 or breakout, 1.71–3.6 V | Bare IC hard to obtain (0 stock ECIA-wide, 12-week lead); breakout Active | 269 (breakout) | $18.95 | Adafruit #3660; DFRobot SEN0248 $18.90 (52) |
| HM3301 (PM2.5) | Module, 8-pin, 3.3–5 V | Active | 52 | $32.90 | Seeed Grove HM3301 via DigiKey (Seeed's own page returned no price) |
| MLX90614ESF-BAA-000-TU | TO-39, 3.3 V (BAA variant) | Active | 1,280 | $10.42 | DigiKey (Melexis) |
| MLX90632SLD-DCB-000-RE | 5-SFN (3x3), 3.0–3.6 V | Active | 3,021 | $11.76 | DigiKey (Melexis) |
| MPU-6050 | QFN-24 or GY-521 breakout, 2.375–3.46 V | Bare IC hard to obtain (0 stock, 26-week lead, lifecycle risk High); breakout Active | 895 (breakout) | $12.95 | Adafruit #3886; DFRobot SEN0142 $12.90 (557) |
| ICM-20948 | QFN-24 or breakout, 1.71–1.95 V logic | Bare IC hard to obtain (0 stock, 45-week lead, lifecycle risk High); Adafruit breakout Active | 822 (breakout) | $19.95 | Adafruit #4554. SparkFun #15335 is Obsolete — do not order it. |
| ICM-42670-P | 14-VFLGA (2.5x3), 1.71–3.6 V | Active but thin | 0 at DigiKey (45-week lead); Mouser 72 | $2.89 DigiKey list · $3.47 Mouser · $32.45 chip carrier | Buy from Mouser while stock holds |
| LIS3DHTR | 16-VFLGA (3x3), 1.71–3.6 V | Active but thin | 0 at DigiKey; Mouser 150 | $1.94 | ST via Mouser |
| LSM6DSOXTR | 14-VFLGA (2.5x3) | Active | 32 at DigiKey; Newark 18,486 | $5.30 · $3.43 Newark | ST |
| QMC5883L | LCC-16 (3x3) or breakout, 2.16–3.6 V | Bare IC not ECIA-listed; module Active | 39 | $4.56 | Olimex MOD-QMC5883L. DigiKey's description reads "EVAL BOARD FOR HMC5883" — see Substitutes before ordering. |
| BMM150 | WLCSP-12 or breakout, 1.62–3.6 V | Bare IC hard to obtain (0 stock, 8-week lead, lifecycle risk High); breakout Active | 30 (breakout) | $6.90 | DFRobot SEN0419 Fermion; Seeed #101020492 $11.80 (57) |
| MMC5983MA | 16-VFLGA (3x3), 2.8–3.5 V | Active | 39,569 | $3.32 | DigiKey (MEMSIC) |
| TSL25911FN | 6-WFDFN / 6-DFN (2x2.2), 2.7–3.6 V | Active | 29,061 | $1.74 | DigiKey (ams OSRAM) |
| TSL2561FN | 6-WDFN / 6-DFN (2x2), 2.7–3.6 V | Obsolete | 0 at DigiKey (16-week lead) and Mouser | no price | DigiKey (ams OSRAM) — see Substitutes |
| BH1750FVI-TR | 6-WSOF, 2.4–3.6 V | Not For New Designs | 2,532 (DigiKey only) | $3.42 | DigiKey (ROHM) |
| VEML7700-TR | 4-SMD J-lead, 2.5–3.6 V | Active | 7,520 | $1.44 | DigiKey (Vishay) |
| OPT3001DNPR | 6-UDFN / 6-USON (2x2), 1.6–3.6 V | Active | 14,936 | $1.48 | DigiKey (TI) |
| LTR-390UV-01 | 6-WFDFN, 1.7–3.6 V | Discontinued at DigiKey | 0 at Avnet, Mouser, DigiKey (18-week lead) | no price | DigiKey (Lite-On) — no substitute verified |
| AS3935-BQFT | MLPQ-16 (4x4), 2.4–5.5 V | Active | 1,421 (DigiKey); Mouser 4,001 | $9.35 | DigiKey (ScioSense) |
| MAX30102EFD+T | 14-pin OESIP | Active | 2,173 | $14.72 | DigiKey (ADI/Maxim) |
Power and telemetry monitor hardware
| Part | Spec/Package | Status | Stock | Price | Source |
|---|---|---|---|---|---|
| INA219AIDR | SOT-23-8, 3.0–5.5 V | Active | 29,736 | $2.12 | DigiKey (TI) |
| INA226AIDGSR | VSSOP-10, 2.7–5.5 V | Active | 95,750 | $2.82 | DigiKey (TI) |
| INA260AIPWR | TSSOP-16, 2.7–5.5 V | Active | 9,274 | $6.56 | DigiKey (TI) |
| INA3221AIRGVR | QFN-16 (4x4), 2.7–5.5 V | Active | 74,078 | $3.47 | DigiKey (TI) |
| MAX17048G+T10 | TDFN-8 (2x3), 2.5–4.5 V | Active | 16,471 | $4.61 | DigiKey (ADI/Maxim) |
| NAU7802SGI | SOP-16, 2.7–5.5 V | Active | 129,489 | $2.07 | DigiKey (Nuvoton) |
| ADS1115IDGSR | VSSOP-10, 2.0–5.5 V | Active | 42,250 | $5.28 | DigiKey (TI) |
| DS2482S-100+T&R | SOIC-8, 1.71–5.5 V | Active | 34,009 | $3.57 | DigiKey (ADI/Maxim) |
| DFRobot Rainfall Sensor | Tipping bucket, I2C/UART, 3.3–5 V | Active | 73 | $29.90 | DFRobot SEN0575 via DigiKey. Vendor page warns the signal adapter board is not waterproof. |
| DFRobot Lark Weather Station | 5-in-1 module, UART/I2C, 3.3–5 V | not checked (no distributor listing, vendor page carried no price) | — | — | Product confirmed current on DFRobot's page; order direct |
Substitutes
| For part | Substitute | Differences | Verified | Judgment |
|---|---|---|---|---|
| DPS310XTSA1 (obsolete) | DPS368XTSA1 — $2.70, 196 in stock | Package identical (8-VFLGA, supplier package PG-VLGA-8-1 on both); supply identical (1.7–3.6 V both, covers the 3.3 V rail); operating temperature identical (-40 to 85 °C). DigiKey's descriptions differ: DPS310XTSA1 "17.4PSIA" (absolute) vs DPS368XTSA1 "17.4PSIG" (gauge) — absolute is what barometry needs. | verified: package + supplier device package (DigiKey parametrics, both parts), supply range (DigiKey parametrics, both parts), operating temperature (DigiKey parametrics, both parts). not verified: pressure reference type (absolute vs gauge), Adafruit DPS310 library compatibility | Acceptable on footprint and supply rail — confirm the pressure reference and driver support against the datasheet before ordering |
| TSL2561FN (obsolete) | TSL25911FN — $1.74, 29,061 in stock | Supply identical (2.7–3.6 V both). Package NOT equivalent: 6-DFN (2x2) vs 6-DFN (2x2.2) — a hard stop for a shared PCB land pattern, though this lab wires breakout modules on 2.54 mm headers rather than a custom board. Different driver too: Adafruit_TSL2561 vs Adafruit TSL2591, and the lab already supports TSL2591 in its own right. | verified: supply range (DigiKey parametrics, both parts). not verified — disproved: footprint equivalence (DigiKey parametrics show 6-DFN 2x2 vs 6-DFN 2x2.2) | Acceptable as a sensor swap with the TSL2591 driver; NOT a footprint-compatible drop-in |
| SCD41-2090 (no distributor listing) | SCD41-D-R2 — $20.54, 13,032 in stock | Part-number correction rather than a component change: SCD41-D-R2 is Sensirion's catalog code. Supply 2.4–5.5 V matches the snapshot's 2.4–5.5 V requirement; operating range -10 to 60 °C. | verified: supply range (DigiKey parametrics vs snapshot). not verified: package/footprint (no package parametric returned for either number), and that "SCD41-2090" and SCD41-D-R2 name the same catalog item | Acceptable — order SCD41-D-R2 |
| WS2812B-B (no distributor listing) | SparkFun 16347 — $0.68, 196,668 in stock; XINGLIGHT XL-5050RGBC-WS2812B-S $0.0625, 70,000 in stock | Body size matches the snapshot's 5050 requirement: 5.00 mm x 5.00 mm on both, 4-SMD J-lead on the XINGLIGHT part. Supply and logic threshold are NOT established — the only voltage figure returned is a forward voltage, not a supply rail or a data-logic threshold. | verified: package/body size 5050 (DigiKey parametrics, both candidates). not verified: supply range, 3.3 V logic-level compatibility | Plausible and cheap, not fully verified — confirm the 3.3 V data threshold before driving it from the ESP32-S3 rail |
| QMC5883L (bare IC unlisted) | Olimex MOD-QMC5883L — $4.56, 39 in stock (3.95 EUR direct from Olimex) | The claim this hinges on is that the module carries QMC5883L, not HMC5883L — the snapshot warns their I2C register maps differ, and DigiKey's description misleadingly reads "EVAL BOARD FOR HMC5883". Olimex's product page, fetched this run, sells MOD-HMC5883L and MOD-QMC5883L as two variants of one page and states the QMC5883 replaced the obsolete HMC5883. | verified: sensor identity, QMC5883L not HMC5883L (Olimex product page fetched this run). not verified: supply range and footprint (no DigiKey parametrics returned for this module); Olimex's "same functionality" wording is the vendor's, and the snapshot says the register maps differ | Acceptable — order by the MOD-QMC5883L variant code, never by the DigiKey description |
| BME280, BME680, MPU-6050, ICM-20948, BMM150, AHT20, SFA30, HM3301 (bare ICs with no distributor stock) | Adafruit 2652 $14.95 · Adafruit 3660 $18.95 · Adafruit 3886 $12.95 · Adafruit 4554 $19.95 · DFRobot SEN0419 $6.90 · Adafruit 5183 $4.50 · Seeed 101020972 $54.00 · Seeed 101020613 $32.90 | Breakout board instead of a bare LGA/QFN die. The snapshot names a breakout board as an allowed footprint for every one of these parts, and this lab wires modules on 2.54 mm headers rather than a custom PCB, so the package change costs nothing. Each breakout is Active and in stock where the bare IC is not. | verified: lifecycle, price and stock for each breakout (DigiKey lookups this run); the snapshot's own text permitting a breakout footprint for each part. not verified: that each breakout carries the exact sensor die and I2C address the firmware driver expects — the DigiKey descriptions name the sensor, but no datasheet or vendor page was fetched for these eight modules | Acceptable — this is the intended sourcing path for the optional sensors |
| LTR-390UV-01 (discontinued) | None proposed | The lab's other light sensors (TSL2591, VEML7700, OPT3001, BH1750) are ambient-light only and do not provide the UV channel. DigiKey's top keyword hit, MikroElektronika MIKROE-6856 "Ambient 26 Click" ($19.00, 3 in stock), is not evidenced to carry an LTR-390UV part, so it is not proposed. | not stated — no substitute was verified | No substitute: source the LTR390 module manually or drop the UV measurement from the exercise |
Verify any substitute against its datasheet before ordering.
Other dependencies
- PCB fabrication — not applicable. The snapshot records that no Gerber, drill or layout files were supplied, and that the Heltec V3's own fabrication parameters are internal to Heltec Automation. The DIY variant is breadboard or an unspecified 2/4-layer carrier board, so there is nothing to quote.
- Meshtastic project documentation (meshtastic.org/docs, the build guide, flashing instructions, the encryption technical reference, the Python CLI installation guide, python.meshtastic.org) — not checked this run.
- PlatformIO project documentation (docs.platformio.org) — not checked this run.
- github.com/meshtastic/python — live: the repository was listed successfully during this run's dependency check.
- github.com/meshtastic/firmware and the ghcr.io/meshtastic/python container image — not checked this run as download locations.
- Heltec vendor documentation (heltec.org product page, schematics, datasheet, user manual links) — page reachable and current as of this run.
Watch list
- Heltec WiFi LoRa 32 V3 — a single-vendor COTS board that the entire default build environment (
heltec-v3) depends on. Vendor price $17.90–$19.90 today, US resellers $28.57–$35.99. A discontinuation here would force a variant build target for the whole lab. - BH1750FVI-TR — Not For New Designs with exactly one distributor holding stock. Most likely part to become unobtainable before the next check.
- ICM-42670-P and LIS3DHTR — each has exactly one ECIA distributor with stock, against 24–45 week factory lead times.
- LSM6DSOXTR at DigiKey — 32 pieces; Newark carries the depth, so ordering channel matters more than availability.
- The bare-IC group (BME280, BME680, BMM150, MPU-6050, ICM-20948) — zero authorized stock today. The breakout workaround holds only while the module vendors keep building them; MPU-6050 and ICM-20948 both carry High lifecycle and supply-chain risk.
- DPS310XTSA1 and TSL2561FN — already obsolete; remaining channel inventory will drain.