LoginSign Up
← Back to all sparks
Z

Z-Wave JS

DEVOPS
Velocity5.0

Z-Wave protocol driver implementation for home automation in JavaScript

zwave-js.github.io/node-zwave-js ↗

Z-Wave JS v15.32.0 ships the findings of two full-codebase security reviews.

smart homez-wavesecurity hardeningdevice configsopen source
◆Current state
v15.32.0 is the result of two security and correctness reviews of the whole codebase. No major issues were found, but it hardens S2, ESPHome, Transport Service and config parsing, caps firmware file sizes, limits outstanding S0 nonces and makes every firmware update stage abortable. ESPHome encryption keys no longer need manual URL encoding, and the release adds seven device config changes.
◆Where it's heading
After a run of endpoint-grouping and controller-migration releases, the project spent a cycle on defensive hardening rather than features. Device config work continues alongside, now including endpoint grouping for more shutters. The development MCP server getting path restrictions shows the review reached tooling too.
◆Prediction
Expect a v15.32.x patch for regressions from the hardening, then a return to device config and endpoint grouping work.

◆Recent moves

  1. 5d ago

    v15.32.1 fixes multi-node OTA firmware update checks

    Two fixes: a node no longer reports an update in progress because another node is updating, and controller OTA updates can be queued for several nodes. A quick patch after the v15.32.0 hardening release.

    View source ↗
  2. 6d ago

    v15.32.0: fixes from two full-codebase security reviews

    Two codebase-wide reviews produced dozens of hardening fixes: crash-proof receive paths, stricter S2 and ESPHome parsing, capped firmware downloads and abortable firmware updates. It is the broadest robustness release in this range, with no headline feature beyond simpler ESPHome keys.

    View source ↗
  3. 18d ago

    v15.31.2: migration fixes and endpoint grouping for eight devices

    A patch that fixes controller-migration device classes and app preset overrides, then applies v15.31.0's endpoint grouping to eight more devices. It shows the new config feature paying off quickly.

    View source ↗
  4. 1mo ago

    v15.31.1: Application Busy retries, NVM restore, route rebuild fixes

    A patch for the controller and network paths: NVM restore and 500-series OTW updates stop aborting themselves during soft reset, Application Busy replies trigger a delayed retry, and overlapping network-wide route rebuilds are blocked. The Aeotec HEM 8 is the first config to use the endpoint grouping added in v15.31.0.

    View source ↗
  5. 1mo ago

    v15.31.0: endpoint grouping via config files, stricter config lints

    Endpoint grouping can now be defined in device config files, letting multi-endpoint devices be handled without driver code. New lint rules for firmware version ranges show the config database is being put under stricter quality control.

    View source ↗
  6. 1mo ago

    v15.30.0: rare command parsing and new Aeotec, Nice, Shelly configs

    Parsing for rarely seen commands plus about a dozen device config additions and corrections, including the Aeotec MultiSensor 8. It is a coverage release that follows the deduplication and RCP work of the previous two minors.

    View source ↗