Readiness report
WLED LED Controller · 2026-09-03 18:36 · complete · 31 searches, 8 pages fetched
Cybersecurity — software & network: Review before networking · 7 findings
Details in the Cybersecurity section of the report below.
Readiness: WLED LED Controller
Verdict: Ready with caveats · 2026-09-03 · est. parts cost $25–$120 (one host board, one 5 m strip and a level shifter at the low end; adding the microphone, remote, encoder, OLED and temperature sensor at the high end) Cybersecurity — software & network: Review before networking
Every function this lab needs has an in-stock, evidence-backed source today. The recommended primary host (ESP32-DevKitC-32E) and the default ESP8266 build target (NodeMCU v2) are both readily available, as are the LED strips, HUB75 panels, IR receiver and remote, rotary encoder, OLED display, temperature sensor and level shifter. Five catalogue lines came back Obsolete with zero stock corroborated across at least two authorized distributors, but four of them have an in-stock successor verified this run, and all five are alternative or experimental host targets rather than the build the lab recommends — the snapshot asks for one host board out of eleven listed, so an obsolete alternative is a catalogue problem, not a blocker. The caveats are the ESP32-P4 successor, whose stock is unconfirmed at $59.92, and the audio-reactive microphone, which rests on end-of-life MEMS silicon whichever of the three sensors the snapshot names you choose. This is the cold check for this lab: there is no previous report, so these prices and stock levels establish the baseline that the next run will measure drift against.
Action required
| Part | Problem | Recommended action |
|---|---|---|
| ESP32-C3-DEVKITM-1 | Obsolete; 0 stock at DigiKey and Mouser (ECIA lifecycle risk High) | Order ESP32-C3-DEVKITM-1-N4X, $8.00, stock 95 instead — same board family and price, meets the 4 MB flash minimum |
| ESP32-S3-DEVKITC-1-N8 | Obsolete and unpriced; 0 stock at DigiKey and Mouser | Order ESP32-S3-DEVKITC-1-N8R8, $15.00; build with the esp32s3dev_8MB_opi environment, not _qspi, because the substitute adds octal PSRAM |
| ESP32-C5-DEVKITC-1-N8R4 | Obsolete; 0 stock at DigiKey and Mouser | Order the manufacturer's successor ESP32-C5-DEVKITC-1-N8R8, $14.37, stock 72 |
| ESP32-P4-FUNCTION-EV-BOARD | Obsolete; 0 stock, 16-week factory lead time | Successor ESP32-P4X-FUNCTION-EV-BOARD, $59.92 is Active but DigiKey reports no stock figure — confirm availability before ordering, and prefer any other host board for coursework |
| INMP441ACEZ-R7 (microphone) | Obsolete; 0 stock at DigiKey (19-week lead) and Mouser | Buy a finished breakout instead: Adafruit 6049 I2S MEMS Microphone Breakout, $8.95, stock 907. Generic retail INMP441 modules also remain plentiful from $1.23 |
Cybersecurity — software & network
Review before networking — The controller exposes an unauthenticated web interface, opt-in-only OTA protection and six network listeners by design, and the build host runs an end-of-life Node.js, but every issue has a practical mitigation and no advisory this run touches the firmware that runs on the device.
| Component | Version | How known | Support status |
|---|---|---|---|
| WLED firmware (source tree, github.com/wled/WLED) | 17.0.0-devV5 | inferred (The repo's package.json declares version 17.0.0-devV5 for the 'Tools for WLED project' package; the firmware binary's own version is not separately pinned in the fetched sources.) | — |
| Node.js (web asset build host) | 20.18 | read from project (fetched/01-.nvmrc pins 20.18 (package.json engines separately declares the range >=20.0.0)) | unsupported since 2026-04-30 |
| PlatformIO Core / CLI | 6.1.19 | read from project (fetched/04-requirements.txt pins platformio==6.1.19) | — |
| Python 3 (PlatformIO helper scripts, build host) | 3.13 | inferred (fetched/04-requirements.txt header records it was generated by pip-compile with Python 3.13; the sources pin no Python runtime version.) | supported until 2029-10-31 |
| clean-css (npm) | 5.3.3 | read from project (fetched/03-package-lock.json pins 5.3.3; package.json declares the caret range ^5.3.3) | — |
| html-minifier-terser (npm) | 7.2.0 | read from project (fetched/03-package-lock.json pins 7.2.0; package.json declares the caret range ^7.2.0) | — |
| web-resource-inliner (npm) | 7.0.0 | read from project (fetched/03-package-lock.json pins 7.0.0; package.json declares the caret range ^7.0.0) | — |
| nodemon (npm, dev) | 3.1.14 | read from project (fetched/03-package-lock.json pins 3.1.14; package.json declares the caret range ^3.1.14) | — |
| click (PyPI, via PlatformIO/uvicorn) | 8.1.7 | read from project (fetched/04-requirements.txt pins click==8.1.7) | — |
| starlette (PyPI, via PlatformIO) | 0.46.2 | read from project (fetched/04-requirements.txt pins starlette==0.46.2) | — |
| urllib3 (PyPI, via requests) | 2.5.0 | read from project (fetched/04-requirements.txt pins urllib3==2.5.0) | — |
| idna (PyPI, via anyio/requests) | 3.10 | read from project (fetched/04-requirements.txt pins idna==3.10) | — |
| marshmallow (PyPI, via PlatformIO) | 3.26.1 | read from project (fetched/04-requirements.txt pins marshmallow==3.26.1) | — |
| Espressif 8266 platform (PlatformIO) | 4.2.1 | inferred (fetched/05-platformio.ini pins espressif8266@4.2.1; compatibility builds pin espressif8266@4.2.0; validation: this version appears in no file fetched this run) | — |
| Tasmota / pioarduino ESP32 platform packages | not determined | not determined (fetched/05-platformio.ini pins these by release-URL zip tag (Tasmota 2024.06.00 and 2026.05.50; pioarduino 55.03.39 and 55.03.37), not by a registry version.) | — |
| IRremoteESP8266 (Arduino library) | 2.9.0 | inferred (fetched/05-platformio.ini pins crankyoldgit/IRremoteESP8266@2.9.0; validation: this version appears in no file fetched this run) | — |
| AsyncTCP (Arduino library, ESP32) | 3.4.10 | inferred (fetched/05-platformio.ini pins esp32async/AsyncTCP@3.4.10; validation: this version appears in no file fetched this run) | — |
| AsyncMqttClient (Arduino library) | 0.9.0 | read from project (fetched/05-platformio.ini pins version 0.9.0) | — |
| ESPAsyncTCP (Arduino library, ESP8266) | 1.2.2 | inferred (fetched/05-platformio.ini pins version 1.2.2; validation: this version appears in no file fetched this run) | — |
| AnimatedGIF (Arduino library) | 1.4.7 | inferred (fetched/05-platformio.ini declares bitbank2/AnimatedGIF@^1.4.7 - a caret range, not an exact pin, so the built version may be any 1.x above 1.4.7.) | — |
| ESPAsyncWebServerWLED (Git checkout) | ac44e32abf2a69ae650412fb6bc193c59ccac38a | inferred (fetched/05-platformio.ini pins this Git commit of github.com/Aircoookie/ESPAsyncWebServer; validation: this version appears in no file fetched this run) | — |
| NeoPixelBus (Git checkout) | 1d7ff38f14d04a976f9c6e365c83a232bcba04fc | inferred (fetched/05-platformio.ini pins this Git commit of github.com/Makuna/NeoPixelBus; validation: this version appears in no file fetched this run) | — |
| ArduinoJson (vendored in source tree) | 5.13.5 | inferred (fetched/05-platformio.ini records the vendored copy as version 5.13.5; validation: this version appears in no file fetched this run) | — |
| esp_dmx (ESP32 IDF V5 branch checkout) | not determined | unpinned (fetched/05-platformio.ini references github.com/netmindz/esp_dmx#esp-idf-v5-fixes - a moving branch with no commit or version pin.) | — |
| Component | Finding | Severity | Fix available? |
|---|---|---|---|
| click (PyPI, via PlatformIO/uvicorn) | The build toolchain installs click 8.1.7, whose click.edit() function can be used to run arbitrary operating-system commands - it only bites on the build machine, and only where an unprivileged user can influence what the toolchain opens in an editor. — PYSEC-2026-2132 | high | No - project pins click==8.1.7 in requirements.txt as a transitive dependency of platformio and uvicorn. |
| starlette (PyPI, via PlatformIO) | The PlatformIO build toolchain installs starlette 0.46.2, which carries denial-of-service, host-header-poisoning and (on Windows) SSRF/credential-theft flaws - these affect the developer workstation that builds the firmware, not the LED controller itself, and only matter if that machine runs PlatformIO's local web service where others can reach it. — GHSA-82w8-qh3p-5jfq, GHSA-wqp7-x3pw-xc5r, GHSA-7f5h-v6xp-fcq8, GHSA-86qp-5c8j-p5mr (+2 more) | high | No - project pins starlette==0.46.2 in requirements.txt as a transitive dependency of platformio 6.1.19. |
| urllib3 (PyPI, via requests) | The build toolchain installs urllib3 2.5.0, which mishandles highly compressed HTTP responses and can forward sensitive headers across origins during proxied redirects - relevant to the build machine when PlatformIO downloads platform archives, not to the controller. — GHSA-38jv-5279-wg99, GHSA-qccp-gfcp-xxvc, GHSA-2xpw-w6gg-jr37, GHSA-gm62-xv2j-4w53 | high | No - project pins urllib3==2.5.0 in requirements.txt as a transitive dependency of requests. |
| idna (PyPI, via anyio/requests) | The build toolchain installs idna 3.10, where specially crafted domain names passed to idna.encode() can slip past an earlier fix - a build-host concern only. — GHSA-65pc-fj4g-8rjx | moderate | No - project pins idna==3.10 in requirements.txt as a transitive dependency of anyio and requests. |
| marshmallow (PyPI, via PlatformIO) | The build toolchain installs marshmallow 3.26.1, which can be driven into a denial of service when loading many records at once - a build-host concern only. — GHSA-428g-f7cq-pgp5 | moderate | No - project pins marshmallow==3.26.1 in requirements.txt as a transitive dependency of platformio. |
| Node.js (web asset build host) | The build host's Node.js version is pinned to 20.18, and the Node.js 20 cycle passed end-of-life on 2026-04-30, so the machine that builds the web UI assets is running a runtime that no longer receives standard security support. | posture | Yes - update to a Node.js release still receiving security support; package.json already declares engines node >=20.0.0, so a newer release satisfies the project's own constraint without any source change. |
| WLED network services on the controller | The controller listens on TCP 80 for its web interface and JSON API and on five UDP lighting-control ports (E1.31 5568, Art-Net 6454, DDP 4048, TPM2.net 65506, WLED sync 21324), plus SSDP/UPnP on 1900, and the sources document no authentication for any of them and no default credentials; OTA update is described only as 'password-protectable', meaning the password is opt-in. | posture | Mitigation only - put the controller on an isolated VLAN or a dedicated lab SSID, set the OTA password and the web-interface lock before it joins any shared network, and never port-forward it to the internet. |
What this means for your lab
This controller is designed to be reachable over the network, and out of the box it does not ask anyone who to be. Its web page and control API answer on the normal web port, and it also listens on five separate lighting-control channels plus a discovery service. The uploaded materials do not describe any password on the web interface, and the over-the-air update feature is only described as password-protectable, which means the password is something you have to turn on. In practice that means anyone else on the same Wi-Fi or wired network - a student, a guest, anyone who found the lab SSID - can open the controller's page, change the lights, alter its settings, and quite possibly push new firmware to it. Nothing here can reach out and attack the rest of your network on its own, but the device should be treated as an open control panel. Before it goes on any shared or campus network: put it on an isolated VLAN or a dedicated lab SSID, turn on the over-the-air update password, and do not forward it through a firewall to the internet. Raise it with campus IT if it needs to sit on the main network. Separately, the security problems found in this project's dependencies are all in the build toolchain that compiles the firmware on a developer's computer - Node.js 20.18, which stopped receiving security updates in April 2026, and five Python packages pulled in by PlatformIO. None of them ship to the controller itself. Keep the build toolchain in its own virtual environment rather than on a shared machine, and update Node.js, which the project's own settings already allow. Finally, most of the firmware's own C++ libraries simply cannot be checked - no vulnerability database covers Arduino libraries or code pinned to a Git commit - so treat their clean look as unknown rather than safe.
Not checked
- WLED firmware itself: No advisory database covers the WLED firmware source tree, and the fetched sources pin no firmware release version - absence of an advisory here is not evidence of safety.
- Arduino and C++ firmware libraries (IRremoteESP8266 2.9.0, AsyncTCP 3.4.10, AsyncMqttClient 0.9.0, ESPAsyncTCP 1.2.2, AnimatedGIF 1.4.7): The Arduino library registry is not an OSV ecosystem, so no vulnerability database could be queried for these versions.
- Git-pinned library checkouts (ESPAsyncWebServerWLED, NeoPixelBus, GifDecoder, ArduinoUZlib, esp_dmx, WLED-AudioReactive-Usermod): Pinned to Git commit hashes or branches rather than published registry releases; source-hosted projects have no advisory database to check against.
- esp_dmx (ESP32 IDF V5): Tracked to the moving branch netmindz/esp_dmx#esp-idf-v5-fixes with no commit pin, so there is no fixed version whose security state could be checked.
- Espressif 8266 platform 4.2.1 and 4.2.0: Dispatched to OSV as ecosystem 'PlatformIO', which returned unknown_ecosystem - PlatformIO is not an OSV registry, so nothing was queried. This is not 'no vulnerabilities'.
- Tasmota and pioarduino ESP32 platform packages: Distributed as release-URL zip archives (Tasmota 2024.06.00 / 2026.05.50, pioarduino 55.03.39 / 55.03.37); no package registry or advisory database applies.
- Vendored C++ libraries (ArduinoJson 5.13.5, E131 1.0.0 modified, Time 1.5, Timezone 1.2.1): Embedded in the source tree and, in E131's case, locally modified - there is no upstream registry release to match them against.
- ESP8266 toolchain packages (toolchain-xtensa ~2.100300.220621, tool-esptool, tool-esptoolpy): Vendor toolchain archives; two of the three are unpinned in platformio.ini and none is published to an advisory-tracked registry.
- Unpinned ESP8266 helper libraries (ESPAsyncUDP, ESP8266PWM): Declared in platformio.ini with no version constraint, so no specific version exists to check.
- Third-party network integrations (Philips Hue sync, Alexa/SSDP emulation, Hyperion, diyHue, external MQTT brokers): External services and protocols named in the snapshot; no version or endpoint in the sources to look up.
- validation: Espressif 8266 platform (PlatformIO): 'read from project' downgraded to 'inferred' - version '4.2.1' not in any fetched file
- validation: IRremoteESP8266 (Arduino library): 'read from project' downgraded to 'inferred' - version '2.9.0' not in any fetched file
- validation: AsyncTCP (Arduino library, ESP32): 'read from project' downgraded to 'inferred' - version '3.4.10' not in any fetched file
- validation: ESPAsyncTCP (Arduino library, ESP8266): 'read from project' downgraded to 'inferred' - version '1.2.2' not in any fetched file
- validation: ESPAsyncWebServerWLED (Git checkout): 'read from project' downgraded to 'inferred' - version 'ac44e32abf2a69ae650412fb6bc193c59ccac38a' not in any fetched file
- validation: NeoPixelBus (Git checkout): 'read from project' downgraded to 'inferred' - version '1d7ff38f14d04a976f9c6e365c83a232bcba04fc' not in any fetched file
- validation: ArduinoJson (vendored in source tree): 'read from project' downgraded to 'inferred' - version '5.13.5' not in any fetched file
Parts
Host microcontroller boards
The lab needs one of these, not all eleven.
| Part | Spec/Package | Status | Stock | Price | Source |
|---|---|---|---|---|---|
| NodeMCU v2 / ESP-12E / ESP-12F | 30-pin DIP module, 2.54 mm pitch, 4 MB flash | Readily available (retail) | 8 sellers | $10.00 | Jameco.com (range $3.44–$28.80) |
| ESP-01 / ESP-01S | 2x4 8-pin DIL header, 2.54 mm pitch, 1 MB flash | Readily available (retail) | 8 sellers | $5.05 | Addicore, listed as 1 MB (8 Mbit) flash (range $1.80–$27.76) |
| ESP32-DEVKITC-32E | ESP32-WROOM-32E, 4 MB flash, 38-pin DIP | Active | DigiKey 0 (8-wk lead); Mouser 2,640 | $10.00 | DigiKey listing; order from Mouser at $10.20 |
| ESP32-DEVKITC-VE | ESP32-WROVER-E, 8 MB flash + PSRAM | Active | DigiKey 0 (8-wk lead); Mouser 693 | $11.00 | DigiKey listing; order from Mouser at $11.00 |
| ESP32-EVB (Olimex) | Ethernet PHY + RJ45 MagJack, terminal headers | Active | 147 | $23.01 | DigiKey |
| LOLIN S2 Mini (ESP32-S2FN4R2) | 2x8 header module, 4 MB flash, 2 MB PSRAM | Readily available (retail) | 8 sellers | $5.25 | Pinsto (range $2.05–$24.26) |
| ESP32-C3-DEVKITM-1 | ESP32-C3-MINI-1, 4 MB flash | Obsolete | 0 (DigiKey and Mouser) | — | See Action required |
| ESP32-S3-DEVKITC-1-N8 | ESP32-S3-WROOM-1-N8, 8 MB flash | Obsolete | 0 (DigiKey and Mouser) | — | See Action required |
| ESP32-C5-DEVKITC-1-N8R4 | ESP32-C5-WROOM-1 eval board, dual-band | Obsolete | 0 (DigiKey and Mouser) | — | See Action required |
| ESP32-C6-DEVKITC-1-N8 | ESP32-C6 DevKitC-1, 8 MB flash | Active | 897 | $9.00 | DigiKey |
| ESP32-P4-FUNCTION-EV-BOARD | ESP32-P4 evaluation module | Obsolete | 0 (DigiKey 16-wk lead, Mouser 0) | — | See Action required |
LED loads
| Part | Spec/Package | Status | Stock | Price | Source |
|---|---|---|---|---|---|
| Addressable RGB/RGBW LED strip (WS2812B et al.) | Flexible PCB, 60 LEDs/m, 5 V, 3-pin VCC/DATA/GND | Readily available (retail) | 8 sellers | $29.99 | BTF-LIGHTING, 5 m / 300 px (range $1.95–$36.99) |
| HUB75 RGB LED matrix panel | 64x32, 16-pin 2x8 IDC, 5 V | Readily available (retail) | 8 sellers | $49.95 | DigiKey (AliExpress P2.5 modules from $11.07) |
Sensors, input and display peripherals
| Part | Spec/Package | Status | Stock | Price | Source |
|---|---|---|---|---|---|
| I2S microphone module (INMP441 / SPH0645 / ICS-43434) | 6-pin 2.54 mm breakout, 3.3 V | Module readily available; all named MEMS dies are EOL | 8 retail sellers; Adafruit 6049 stock 907 | $4.95 | Vetco (range $1.23–$9.99); distributor option Adafruit 6049, $8.95 |
| TSOP38238 (IR receiver) | 3-pin TO-92-style, 38 kHz, 3.3–5 V | Active | 24,869 | $0.84 | DigiKey |
| 24-key IR remote control | Handheld, 24 membrane keys, CR2025/CR2032 | Readily available (retail) | 8 sellers | $6.95 | Skycraft Parts and Surplus (range $5.29–$18.95) |
| Rotary encoder module (KY-040) | 5-pin breakout, quadrature + push switch, 3.3 V | Readily available (retail) | 8 sellers | $1.95 | Alpha 3DLab (range $1.26–$39.99) |
| SSD1306 / SH1106 OLED, 128x64 I2C | 4-pin header GND/VCC/SCL/SDA, 3.3 V | Readily available (retail) | 8 sellers | $4.99 | DigiKey (CANADUINO) (range $2.49–$19.50) |
| DS18B20+ (temperature sensor) | TO-226-3 / TO-92-3, supply 3–5.5 V | Active | 5,196 (DigiKey); Rochester 20,230; Newark 5,354 | $7.35 | DigiKey |
Signal conditioning
Named in the snapshot's architecture note for 3.3 V to 5 V data-line conversion on 5 V strips, but not itemised as a numbered BOM line — listed here for completeness.
| Part | Spec/Package | Status | Stock | Price | Source |
|---|---|---|---|---|---|
| SN74AHCT125N | 14-DIP (0.300in, 7.62 mm), supply 4.5–5.5 V | Active | 19,817 | $0.95 | DigiKey (SOIC sibling SN74AHCT125NSR $0.85 is surface mount) |
Substitutes
| For part | Substitute | Differences | Verified | Judgment |
|---|---|---|---|---|
| ESP32-C3-DEVKITM-1 | ESP32-C3-DEVKITM-1-N4X $8.00, stock 95 | Same ESP32-C3-MINI-1 module and DevKitM-1 board family per DigiKey descriptions; -N4X is the 4 MB-flash catalogue variant, meeting the snapshot's ≥ 4 MB minimum. Same price, no cost penalty. | verified: lifecycle (Active) and stock from DigiKey this run; board family and module identity from DigiKey descriptions; flash size against the snapshot. not verified: footprint / pin pitch — DigiKey parametrics carry only "Mounting Type: Fixed", no dimensions or pitch. not verified: meaning of the "X" suffix (assumed a packaging code). | Acceptable |
| ESP32-S3-DEVKITC-1-N8 | ESP32-S3-DEVKITC-1-N8R8 $15.00 | Same DevKitC-1 board and 8 MB flash; adds 8 MB octal PSRAM — exceeding the requirement, which is acceptable. But the snapshot requires flash and PSRAM mode to match the binary environment, so this board must be built as esp32s3dev_8MB_opi, not esp32s3dev_8MB_qspi. |
verified: lifecycle (Active), price, flash size and PSRAM presence from DigiKey descriptions; build-environment constraint from the snapshot. not verified: current warehouse stock (DigiKey returned no quantity). not verified: footprint / pin pitch — parametrics carry only "Frequency: 2.4GHz". | Acceptable, with a build-target caveat |
| ESP32-C5-DEVKITC-1-N8R4 | ESP32-C5-DEVKITC-1-N8R8 $14.37, stock 72 | DigiKey's manufacturer-recommended substitute. Same DevKitC-1 board and 8 MB flash; PSRAM 4 MB → 8 MB, exceeding the requirement. The snapshot only requires an Espressif ESP32-C5 development kit, which this is. | verified: lifecycle (Active), stock and price from a direct DigiKey lookup this run; MFR-recommended relationship from DigiKey; kit-family requirement against the snapshot. not verified: footprint / pin pitch (parametrics carry only "Frequency: 2.4GHz, 5GHz"). not verified: that the esp32c5dev build environment targets the R8 PSRAM variant unchanged. |
Acceptable |
| ESP32-P4-FUNCTION-EV-BOARD | ESP32-P4X-FUNCTION-EV-BOARD $59.92 | DigiKey's manufacturer-recommended successor "X" revision of the same evaluation board. Price is 4–6x every other host board in this BOM. | verified: lifecycle (Active) and price from a direct DigiKey lookup this run; MFR-recommended relationship from DigiKey. not verified: stock (DigiKey returned no quantity). not verified: footprint, flash/PSRAM size, and whether the esp32p4_16MB / esp32p4_32MB environments build unchanged for the X revision. |
Plausible, stock unconfirmed — verify with the distributor before committing |
| INMP441ACEZ-R7 | Adafruit 6049, I2S MEMS Microphone Breakout (ICS-43434) $8.95, stock 907 | A finished breakout module, which is what the BOM line actually calls for, stocked at an authorized distributor; ICS-43434 is one of the three sensors the snapshot names. Supply 1.6–3.6 V covers the lab's 3.3 V rail. Frequency response 60 Hz–20 kHz vs the INMP441's 60 Hz–15 kHz — wider, exceeding the requirement. As bare dies the two are NOT interchangeable (3.50 x 2.65 mm vs 4.72 x 3.76 mm); the substitution is valid only at module level. | verified: supply-voltage range from both DigiKey parametrics (INMP441 1.62–3.63 V, ICS-43434 1.65–3.63 V) and the fetched Adafruit product page (1.6–3.6 V); I2S pin function (Clock, Data, Word Select) and ESP32 host support from the fetched Adafruit page; lifecycle, price and stock from DigiKey this run. not verified: module footprint and header pinout — the page gives no board dimensions or pin order, so this is not a mechanical drop-in for a generic INMP441 breakout and wiring must be checked against the pin labels. | Acceptable as a module-level substitute |
| INMP441ACEZ-R7 (onward path) | Adafruit 3421, I2S MEMS Microphone Breakout (SPH0645LM4H) $6.95 | The fetched Adafruit page for product 6049 states the ICS-43434 has been discontinued and names SPH0645LM4H as its drop-in replacement; SPH0645 is also named as acceptable by the snapshot. Same 1.6–3.6 V, same three-pin I2S interface. However the bare MPN SPH0645LM4H-B is itself high-risk: DigiKey stock 0, 26-week factory lead time, ECIA lifecycle and supply-chain risk both High. | verified: price and the 1.6–3.6 V / three-digital-pin I2S description from its fetched product page; the discontinuation notice and replacement recommendation from the fetched Adafruit 6049 page. not verified: current stock — no distributor lookup returned a stocked listing for this breakout this run. | Plausible onward path, stock unverified |
Verify any substitute against its datasheet before ordering — footprint and pin pitch could not be confirmed from distributor parametrics for any of the development boards above.
Other dependencies
- PCB fabrication — not applicable. The snapshot records that no Gerber archives, drill charts, mechanical drawings or CAD layout files were included, and that the build uses off-the-shelf boards wired to lighting power rails. Nothing to fabricate.
- Third-party carrier boards (QuinLED-Dig-Uno, QuinLED-Dig-Quad) — named as an option in the snapshot; not checked, no sourcing plan was given and no lookup was dispatched.
- Primary source repository, github.com/wled/WLED — live. Its root listing and five project files were fetched successfully this run, so the main download path works.
- Other GitHub organisations serving releases (Aircoookie, wled-dev, tasmota, pioarduino, Makuna, crankyoldgit) — not checked; individual release URLs were not fetched.
- Documentation portal kno.wled.ge — not checked this run.
- Community forums (wled.discourse.group, discord.gg/QAh7wJHrRM) — not checked this run.
- WLED native mobile apps (Google Play
ca.cgagnier.wlednativeandroid, Apple App Store6446207239) — not checked this run. - CORS proxy service corsfix.com — not checked this run.
- ESP32-P4 / C6 coprocessor radio firmware portal esp32-c6-firmware-update.github.io — not checked this run.
- LED strip power supply — the snapshot describes 5 V / 12 V / 24 V high-current rails but does not itemise a PSU as a BOM line, so none was priced. Budget for one: up to 60 mA per pixel at peak white means a 300-pixel 5 V strip can draw about 18 A at full brightness.
- 4.7 kΩ 1-Wire pull-up resistor for the DS18B20 — commodity passive, not itemised in the BOM and not priced.
Watch list
- The I2S microphone is the real long-term risk. All three sensors the snapshot names are end-of-life: INMP441ACEZ-R7 is Obsolete with zero distributor stock, ICS-43434 is Obsolete (though 112,462 units remain at DigiKey), and SPH0645LM4H-B carries a 26-week lead time with ECIA lifecycle and supply-chain risk both High. Cheap retail modules exist today because they are built on that remaining stock. Buy spares now if the audio-reactive usermod matters to the course.
- ESP32-P4 support may not survive the next check. The board is Obsolete, the successor costs $59.92 with no confirmed stock, and the snapshot already flags it as experimental and needing a separate C6 coprocessor for networking.
- Espressif's DevKit catalogue churns fast. Four of the eleven host boards turned over to new suffixes this cycle (C3, S3, C5, P4). Expect the exact part numbers in the snapshot to keep drifting; the board families remain available, so re-check suffixes rather than assuming discontinuation.
- ESP32-DevKitC-32E and -VE both show zero DigiKey stock behind an 8-week factory lead. They are comfortably in stock at Mouser today, but a single-distributor view would have called them unobtainable — worth re-checking that both warehouses do not empty together.
- ESP8266 boards (NodeMCU, ESP-01S) are retail-only commodities. No authorized-distributor lifecycle signal exists for them, so a supply change will show up as prices rising or listings thinning rather than as an Obsolete flag.