LoginSign Up
← Back to all sparks
Z

Z-Wave JS UI

DEVOPS
Velocity5.0

Web interface and MQTT gateway for Z-Wave networks

zwave-js.github.io/zwave-js-ui ↗

Z-Wave JS UI is hardening its network surface while handing issue triage to agents.

zwavehome-automationsecurity-hardeningagentic-workflowscredential-managementdependency-tracking
◆Current state
The current tags are dependency bumps tracking the upstream zwave-js driver and server, which is the project's default rhythm between feature rounds. Behind them sit two substantive threads from the last two months: a security pass that confined store paths, blocked symlink escapes, stopped returning a password hash from the password endpoint and tightened TLS key permissions; and a repository bot rebuilt around agentic workflows with locally computed embeddings.
◆Where it's heading
Two directions are running in parallel. The product is tightening what a self-hosted controller exposes — credential management UI, trusted API on a separate network or port, store path confinement — which matters for a component that sits between a home network and physical devices. Separately, the maintainers are automating their own issue and docs workload with agentic triage, moving embedding computation in-house rather than depending on a hosted model service.
◆Prediction
Expect continued driver-bump patch releases, with the next feature round most likely extending the trusted-API isolation or credential management surface, since those are the threads with unfinished work visible in the entries.

◆Recent moves

  1. 4d ago

    Driver bumped to zwave-js 15.27.1

    A single upstream driver bump, tagged as a release. Whatever changed for users landed in zwave-js rather than here — this feed tracks the dependency, not the device behaviour.

    View source ↗
  2. 11d ago

    Server dependency bumped to 3.10.1

    A @zwave-js/server patch bump and nothing else. Routine upstream tracking between feature rounds.

    View source ↗
  3. 11d ago

    Repository bot moves to agentic triage with local embeddings

    The maintainers' bot gains agentic issue classification and docs-answer judging, and computes embeddings locally instead of calling GitHub Models. It is maintainer tooling rather than product, but it changes who does the triage work on this project.

    View source ↗
  4. 28d ago

    Credential management UI and trusted API on a separate network

    A credential management UI lands alongside the ability to serve the trusted API on a separate network, IP or port — the two together let operators separate privileged control from general access. The strongest product round in this window.

    View source ↗
  5. 1mo ago

    Store path confinement, symlink escape and password hash leak fixed

    Store paths are confined against the resolved store directory, symlinks can no longer escape it, the password endpoint stops returning a hash, and self-signed TLS material is written owner-only. A concentrated security pass that reads as the outcome of one review.

    View source ↗
  6. 1mo ago

    Dependency bumps and interview progress percentage

    Driver and server bumps plus interview progress reported as a percentage and virtual nodes excluded from the network map. Minor surface polish alongside upstream tracking.

    View source ↗