Release Notes — Coldwave Yuki Module (YMOD)

First production release of the Coldwave Yuki Module firmware — a cellular connectivity module that attaches a host MCU to the Coldwave backend over a hardened UART protocol, with secure boot and signed over-the-air updates.

Manufacturer: ImagineOn GmbH, Köln · Document generated from the curated public release-notes source.

1.0.02026

First production release of the YMOD firmware and the baseline of the 1.x line, developed under an IEC 62443-4-1-tailored secure development lifecycle. YMOD is a cellular connectivity module that attaches a host MCU to the Coldwave backend over a hardened UART protocol.

Added

Hardened UART protocol between the module and the host MCU — length-tagged, CRC-checked frames carrying a defined command set (property read/write, device-identity read, backend claim code and GPIO service tags). This local link is the module's primary interface and is hardened against malformed and truncated frames.
Cellular connectivity in two firmware variants from a single source tree: an LTE Cat-1 variant and an LTE-M / NB-IoT variant with GNSS positioning. Connectivity is supervised, with automatic reconnection and recovery.
Backend attach over a DTLS-protected cellular link. The backend server certificate is verified against a root CA embedded in the firmware image at build time. The module intentionally exposes no local network or TLS server — its only local interface is the UART link to the host MCU, which keeps the remote attack surface minimal.
Device identity and onboarding — an on-device ED25519 key pair held in a secure keystore, with the public key exported to the host and a derived claim code for backend onboarding.
Secure boot and signed OTA updates — firmware images are ECDSA-P256-signed and verified by the bootloader, with anti-rollback enforced through a monotonic firmware version.
Automatic time-zone resolution from the cellular network's country code.
Host-integration signals — status LEDs, a sync interrupt line and sleep / network-error indication pins for coordination with the host MCU.

Security

This is the initial security-conformant baseline. YMOD has no previously released version, so no issues carry over from a predecessor; the security-relevant capabilities of this baseline — the DTLS-protected backend link with server-certificate verification, the hardened UART frame parser, secure boot with signed, anti-rollback OTA, and release builds that do not emit verbose diagnostics — are listed under Added.

Quality and security assurance

The 1.0.0 image is produced by a host quality pipeline enforced in CI: static analysis on security and quality rule-sets with no outstanding findings, software-composition analysis with no known critical or high-severity vulnerabilities in third-party components, unit and end-to-end tests with code-coverage measurement, and continuous fuzzing of the UART protocol parser — the module's primary local attack surface.

Known limitations

External RED / EN 18031-1 certification by an accredited body has not been performed for the 1.0.0 baseline; conformity is established on a self-assessment basis, covering both cellular variants.
The EU Cyber Resilience Act reporting workflow is prepared. ENISA reporting obligations apply from 2026-09-11, with the full regulation applicable from 2027-12-11.