Release Notes — Coldwave YUKI Block DIO42 / LTE-M

First production release of the DIO42 LTE-M digital-I/O controller firmware — four debounced digital inputs and two relay outputs with on-device PLC-style scripting, secure boot and signed over-the-air updates.

Manufacturer: ImagineOn GmbH, Köln · Document generated from the curated public release-notes source.

1.0.02026

First production release of the DIO42 firmware and the baseline of the 1.x line, developed under an IEC 62443-4-1-tailored secure development lifecycle. It supersedes the 0.9.x pre-releases.

Added

Digital-I/O product surface — four debounced digital inputs and two normally-open relay outputs, with relay state persisted and restored on power-up. Device state and up to three alarm signals are exposed as Coldwave properties for backend read-out.
On-device PLC-style scripting via the Coldwave Script VM sandbox, running in a constrained profile (no raw I/O, enforced memory cap). Scripts are delivered over the TLS-protected property channel, and sunrise/sunset helper functions are available for time-of-day automation.
LTE-M connectivity through the Coldwave modem stack, with connectivity supervision and automatic reconnection.
Battery-backed real-time clock that retains a valid time across power loss for reliable time-based scheduling.
Monthly data-budget guard with a configurable cap, backend override and automatic reset on the month boundary.
Emergency property sync on power loss — a power-fail handler flushes queued property updates before the device shuts down.
Secure boot and signed over-the-air updates — firmware images are cryptographically signed and verified by the on-device bootloader before they are allowed to run.

Fixed

Hardened the script-upload bounds check against an integer-overflow that could allow an out-of-bounds write for a crafted script stream. The check was reworked so the length is validated first and can no longer wrap, and the fix is regression-guarded by a unit test and by continuous fuzzing of the upload path.

Security

This is the initial security-conformant baseline. Security-relevant fixes are listed under Fixed; there is no predecessor release from which issues carry over.

Quality and security assurance

The 1.0.0 image ships from a host quality pipeline enforced in CI: static analysis on security and quality rule-sets with no outstanding findings, software-composition analysis with no known critical or high-severity vulnerabilities in third-party components, a full unit-test suite, and continuous fuzzing of the script-upload parser.

Known limitations

The device carries no short-range wireless radio, so short-range radio conformity does not apply.
External RED / EN 18031-1 certification by an accredited body has not been performed for the 1.0.0 baseline; conformity is established on a self-assessment basis.
The EU Cyber Resilience Act reporting workflow is prepared but has not yet been exercised against a live notification. ENISA reporting obligations apply from 2026-09-11, with the full regulation applicable from 2027-12-11.