Readiness report
OpenFlexure Microscope (high-res build, v7.0.0-beta5) · 2026-09-02 17:00 · complete · 45 searches, 4 pages fetched, est. $0.30
Cybersecurity — software & network: Review before networking · 4 findings
Details in the Cybersecurity section of the report below.
Readiness: OpenFlexure Microscope (high-res build, v7.0.0-beta5)
Verdict: Ready · 2026-09-02 · est. parts cost $230–$330 Cybersecurity — software & network: Review before networking
The High-Resolution OpenFlexure build is fully implementable. All specialized electromechanical and optical components remain sourceable, and the sourcing status for the camera ribbon cable has significantly improved since the 2026-09-01 report: the primary BOM component is now in stock at an authorized distributor. While the hardware remains "Ready," the software posture requires attention due to high-severity vulnerabilities in client-side libraries and unpinned server dependencies.
Action required
None — all checked parts are sourceable.
Parts
Core Electronics and Compute
| Part | Spec/Package | Status | Stock | Price | Source | Drift |
|---|---|---|---|---|---|---|
| Raspberry Pi v4 (Model 4B) | Single-board computer | Ready | High | $35.00 | CanaKit | — |
| Sangaboard v0.5 Motor Controller | Pi-Hat form factor | Ready | Active | £28.00 | TauLab | — |
| Raspberry Pi Camera Module v2 | Sony IMX219 sensor | Ready | High | $15.00 | Seeed Studio | -$2.33 |
| Raspberry Pi Power Supply | 5.1 V, 3.0 A USB-C | Ready | High | $8.80 | PiShop USA | +$0.81 |
| Micro SD card | 16 GB minimum | Ready | High | $5.38 | Filmtools | — |
Electromechanical and Illumination
| Part | Spec/Package | Status | Stock | Price | Source | Drift |
|---|---|---|---|---|---|---|
| 28BYJ-48 Steppers | 5 V geared | Ready | High | $4.14 | StepperOnline (5-pk) | — |
| Illumination PCB | OFMv7 Kit | Ready | Active | £4.50 | TauLab | — |
| 200mm Camera Ribbon Cable | MP-FFCA10152003B | Ready | 1,384 | $0.85 | Newark | -$1.15 |
| Jumper Cable (Red) | 30 cm FF DuPont | Ready | High | $1.45 | Tinkersphere | +$0.78 |
| Jumper Cable (Black) | 30 cm FF DuPont | Ready | High | $0.95 | Pinsto | — |
| 2-pin Housing | 2.54 mm pitch | Ready | High | $0.05 | PICcircuit | — |
Optical Components
| Part | Spec/Package | Status | Stock | Price | Source | Drift |
|---|---|---|---|---|---|---|
| Achromatic Lens | ThorLabs AC127-050-A | Ready | In stock | $64.83 | ThorLabs | — |
| Microscope Objective | Standard RMS Thread | Ready | High | $18.99 | AmScope | +$6.50 |
| Condenser Lens | 13 mm x 5 mm PMMA | Ready | High | $5.81 | AliExpress | +$4.82 |
Fasteners and Mechanical Hardware
| Part | Spec/Package | Status | Stock | Price | Source | Drift |
|---|---|---|---|---|---|---|
| M3 Nut | A2 Stainless | Ready | High | $0.01 | Albany County | — |
| M3 Brass Nut | Brass | Ready | High | $0.05 | Metric Specialties | — |
| M3x10 Cap Screw | A2 Stainless | Ready | High | $0.09 | Boltsandnuts.com | -$0.97 |
| M3x25 Hex Bolt | Full Thread | Ready | High | $1.69 | Accu Components | +$1.50 |
| M3 Washers | Form A Stainless | Ready | High | $0.04 | Boltsandnuts.com | — |
| No. 2 Screws | 6.5 mm Pozi Pan | Ready | High | $1.29 | Accu Components | — |
| Viton O-ring | 30 mm x 2 mm | Ready | In stock | $6.30 | Vacuum Pump Supply | — |
Fabrication Materials, Tools, and Consumables
| Part | Spec/Package | Status | Stock | Price | Source | Drift |
|---|---|---|---|---|---|---|
| PLA Filament | 1.75 mm | Ready | High | $9.99 | Micro Center | -$1.00 |
| Polypropylene Sheet | 0.5 mm White | Ready | Active | $1.63 | Minimum World | — |
| Light Oil | Liquid Wrench | Ready | High | $4.68 | Walmart | — |
| #1 Pozidrive Screwdriver | Wiha Precision | Ready | High | $5.58 | Wiha Tools | — |
| 2.5 mm Allen Key | Ball-end | not checked | — | — | — | — |
| Wire Cutters | Precision | not checked | — | — | — | — |
| Pi Camera Lens Tool | Bundled/3D Printed | not checked | — | — | — | — |
Substitutes
| For part | Substitute | Differences | Verified | Judgment |
|---|---|---|---|---|
| MP-FFCA10152003B | Generic 15-pin FFC | Generic 1mm pitch Type B cable; identical electrical and physical properties. | pitch, pin count, length | Acceptable |
Instructors should verify any substitute against its datasheet before ordering.
Cybersecurity — software & network
Review before networking — Multiple high-severity dependencies affect the client application, the server dependencies are largely unpinned, and network-facing service authentication configurations require verification.
| Component | Version | How known | Support status |
|---|---|---|---|
| openflexure-microscope-server | 3.0.0-beta1 | read from project (https://gitlab.com/openflexure/openflexure-microscope-server/-/raw/v3/pyproject.toml) | — |
| openflexure-connect | 5.0.0 | read from project (https://gitlab.com/openflexure/openflexure-connect/-/raw/master/package-lock.json) | — |
| Raspberry Pi OS | not determined | not determined | — |
| Raspberry Pi 4B | 4-b | inferred (Snapshot hardware check plan specifies Raspberry Pi 4B platform) | supported until 2034-01-01 |
| Python | 3.11 | read from project (https://gitlab.com/openflexure/openflexure-microscope-server/-/raw/v3/pyproject.toml) | supported until 2027-10-31 |
| electron | 36.9.5 | read from project (https://gitlab.com/openflexure/openflexure-connect/-/raw/master/package-lock.json) | — |
| extract-zip | 2.0.1 | read from project (https://gitlab.com/openflexure/openflexure-connect/-/raw/master/package-lock.json) | — |
| js-yaml | 4.3.0 | read from project (https://gitlab.com/openflexure/openflexure-connect/-/raw/master/package-lock.json) | — |
| Component | Finding | Severity | Fix available? |
|---|---|---|---|
| electron | Multiple high-severity vulnerabilities in Electron permit context isolation bypasses, cross-origin reads, and memory corruption. — GHSA-532V-XPQ5-8H95, GHSA-9WFR-W7MM-PC7F, GHSA-H7RP-CF8H-J98X, GHSA-8337-3P73-46F4 (+2 more) | high | Yes — update to 39.8.10 |
| extract-zip | An unvalidated symlink path traversal vulnerability allows arbitrary file writes when extracting archives. — GHSA-JMR9-QJV8-65GV | high | Mitigation only — avoid processing untrusted zip archives until an upstream patch is released |
| js-yaml | Quadratic CPU consumption during YAML omap parsing can cause application denial of service. — GHSA-5P4M-2WFM-XMQJ | high | Yes — update to 4.3.1 |
| openflexure-microscope-server | dependencies unpinned: 23 of 27 in pyproject.toml | posture | Mitigation only — pin versions / use the lockfile |
What this means for your lab
The microscope attaches to the local network via Wi-Fi or Ethernet and exposes web control services and potentially SSH. Anyone on the same local network could interact with the microscope's motor controls, view and manipulate live image feeds, or attempt to log into the underlying Raspberry Pi. Furthermore, several client-side libraries have known security vulnerabilities, and server dependencies remain unpinned. To protect the instrument, place it on an isolated, dedicated laboratory network segment rather than an open campus network, ensure default Raspberry Pi credentials are changed before connecting, and confirm authentication settings with campus IT.
Not checked
- Raspberry Pi OS: version not determined in project sources
- Raspberry Pi 4 Firmware: no advisory database for the ecosystem
- openflexure-microscope-server unpinned dependencies: unpinned; exact versions not pinned in pyproject.toml
- openflexure-connect dependencies: beyond the 200-row automatic check cap
- 258 dependencies (@vue/compiler-dom 3.5.39, @vue/compiler-sfc 3.5.39, @vue/compiler-ssr 3.5.39, @vue/reactivity 3.5.39, @vue/runtime-core 3.5.39, ...): beyond the 200-dependency automatic check cap
- openflexure-microscope-server 3.0.0-beta1: no package by this name in the registry
- openflexure-connect 5.0.0: no package by this name in the registry
- raspberry-pi 4: support status: version matches no release cycle on endoflife.date
Other dependencies
- 3D Fabrication: Requires FFF printer with minimum 180 x 180 x 180 mm build volume. Status: Ready.
- External Documentation: Build server (
build.openflexure.org) and community discourse (openflexure.discourse.group) sites are active. Status: Ready. - Source Repositories: GitLab repositories for hardware and software modules are active. Status: Ready.
Watch list
- ThorLabs AC127-050-A: This is a precision single-source component from ThorLabs. While stock is currently stable, any unavailability would halt optics assembly as no drop-in alternatives are verified.
- Sangaboard v5: Sourcing is reliant on UK specialty vendors. International lead times and customs should be planned for.
- No. 2 Self-Tapping Screws: Pricing from primary suppliers ($1.29 per screw) is high; bulk sourcing from generic fastener distributors is recommended to reduce total build cost.