LoginSign Up
← Back to all sparks
Z

Z-Wave JS UI

DEVOPS
Velocity5.0

Web interface and MQTT gateway for Z-Wave networks

zwave-js.github.io/zwave-js-ui ↗

Z-Wave JS UI is hardening its network surface while handing issue triage to agents.

zwavehome-automationsecurity-hardeningagentic-workflowscredential-management
◆Current state
Releases land every few weeks, most of them bumping the underlying zwave-js and @zwave-js/server dependencies. Underneath that cadence, two threads have substance. The security thread produced symlink escape prevention, store path confinement, a password hash removed from an API response, owner-only TLS key permissions, enforced session secrets, authentication on the snippet endpoint, and a credential management UI. The feature thread added multicast and broadcast group support, trusted API on a separate network, interface and port, and interview progress reporting.
◆Where it's heading
The security work reads as a systematic pass over an application that is typically exposed on a home network and increasingly on more than that — the trusted-API-on-separate-interface change is what you build when operators are segmenting it. In parallel, the project's repository bot has been rebuilt around agentic workflows for issue classification and docs answering, with embeddings now computed locally rather than through GitHub Models.
◆Prediction
Expect further work on the bot's local embedding path and index freshness, given how many of the recent fixes have gone into index staleness and cache eviction.

◆Recent moves

  1. 2d ago

    Server dependency bumped to 3.10.1

    A single dependency bump cut twelve minutes after the previous release. Packaging follow-up, not a change of its own.

    View source ↗
  2. 2d ago

    Repository bot moves to agentic triage with local embeddings

    Almost all of this release is project infrastructure: issue classification and docs-answer judging move to agentic workflows, and embeddings are now computed locally instead of through GitHub Models. It changes how the project handles its issue load rather than what the application does.

    View source ↗
  3. 19d ago

    Credential management UI and trusted API on a separate network

    Two changes that matter for exposed deployments: credentials get a real management interface, and the trusted API can be bound to its own network, IP and port. Statistics opt-in becoming externally configurable helps operators managing fleets.

    View source ↗
  4. 1mo ago

    Store path confinement, symlink escape and password hash leak fixed

    A concentrated security patch: symlinks can no longer escape the store directory, store paths are confined against the resolved directory, the password hash is no longer returned from the password endpoint, and self-signed TLS material is written owner-only.

    View source ↗
  5. 1mo ago

    Dependency bumps and interview progress percentage

    Mostly dependency bumps, with interview progress now reportable as a percentage and virtual nodes excluded from the network map.

    View source ↗
  6. 1mo ago

    Multicast and broadcast groups; API authentication tightened

    Multicast and broadcast group support is the substantive feature, letting commands reach many devices at once. It ships alongside the first wave of the hardening pass — authentication required on the snippet endpoint, a strong session secret enforced, and the JSON body limit reduced.

    View source ↗