Z-Wave JS UI vs Apache bRPC

Releases land every few weeks, most of them bumping the underlying zwave-js and @zwave-js/server dependencies. Underneath that cadence, two threads have substance. The security thread produced symlink escape prevention, store path confinement, a password hash removed from an API response, owner-only TLS key permissions, enforced session secrets, authentication on the snippet endpoint, and a credential management UI. The feature thread added multicast and broadcast group support, trusted API on a separate network, interface and port, and interview progress reporting.

The security work reads as a systematic pass over an application that is typically exposed on a home network and increasingly on more than that — the trusted-API-on-separate-interface change is what you build when operators are segmenting it. In parallel, the project's repository bot has been rebuilt around agentic workflows for issue classification and docs answering, with embeddings now computed locally rather than through GitHub Models.

Expect further work on the bot's local embedding path and index freshness, given how many of the recent fixes have gone into index staleness and cache eviction.