MeshMonitor v4.10.0

This release is about seeing more of the mesh you don't physically touch. The headline feature, Auto Remote LocalStats (#3398), is a new per-source automation that periodically requests local_stats telemetry — noise floor, channel/air utilization, uptime, and packet counts — from remote nodes, so you can graph the health of infrastructure you don't own; requests go out as channel unicasts (so REPEATER/CLIENT nodes answer too) with a polite round-robin scheduler. Map Analysis got four upgrades (#3399): a marker search box, marker spiderfy so overlapping nodes fan out and become individually selectable, inbound/outbound traceroute separation with directional SNR arrows, and weak-link filtering with a per-node summary. GeoJSON overlays (#3407) can now be flagged public and rendered on the anonymous, embed, and dashboard maps, and desktop builds now bundle Apprise as a frozen sidecar (#3405) for full local notification support with no system Python. The new firmware noise-floor LocalStats field (#3396) is captured and charted. On the fix side: the Security tab no longer leaks dead-nodes/key-mismatch rows across sources, the Radio Statistics legend stops clipping counts, and custom-analytics CSP domains reach the header.

Features

Auto Remote LocalStats — periodic local_stats requests to remote nodes (#3398, #3403) — per-source automation (modeled on Auto Traceroute) that polls remote nodes for noise floor, channel/air utilization, uptime, and packet counts. Targets are the union of node-list / role / favorite / name-regex filters; requests are channel unicasts sized to the target's distance, with jitter, a schedule window, an airtime gate, and a per-target rate limit. Passive-mode aware; replies persist through the existing telemetry pipeline.
Map Analysis: node search, marker spiderfy, directional + weak-link traceroutes (#3399, #3404) — a search box that filters markers and traceroute endpoints by name/node-id/nodeNum; overlapping markers fan out so each node is selectable; traceroutes split into inbound (RX) / outbound (TX) legs with direction colours and SNR arrows; persisted min-occurrence/min-SNR filters plus a per-node link summary.
GeoJSON overlays on public, anonymous, embed, and dashboard maps (#3407, #3408) — per-layer opt-in Public flag (default off); flagged layers render on every public surface while private layers stay private (anonymous data 404s).
Desktop: Apprise bundled as a frozen sidecar (#3405) — Apprise (with all plugins) is frozen into a self-contained executable shipped alongside the desktop app and started on a loopback-only port, giving desktop full local Apprise support with no system Python. (Intel macOS falls back to a remote Apprise API; arm64 macOS / Windows / Linux ship the sidecar.)
Noise Floor in LocalStats telemetry (#3396, #3397) — the noiseFloor (dBm) field from Meshtastic firmware 2.7.25 is captured and graphed alongside the other LocalStats metrics, on Device Info and every local-stats chart. Protobufs submodule bumped v2.7.23 → v2.7.25 (additive).

Bug Fixes

Security tab leaked dead nodes and key-mismatch events across sources (#3406) — GET /api/security/dead-nodes and /api/security/key-mismatches ignored sourceId and returned rows from every source; both are now scoped to the requested source. The same change wires the (previously unreachable) Auto Remote LocalStats section into the Automation sub-nav.
Radio Statistics legend clipped counts; Packet Distribution lacked a total (#3400, #3401, #3402) — the legend no longer clips the raw count mid-value (truncation now only in stacked mode), and the Packet Distribution panel shows a prominent grand total.
Custom analytics "CSP Allowed Domains" were silently dropped (#3409, #3410) — the custom analytics provider was caught by the same early-return as none, so configured origins never reached the Content-Security-Policy header; they now flow through to script-src/connect-src.

Issues Resolved

#3398, #3399, #3407, #3405, #3396, #3406, #3400, #3401, #3409

Full changelog: v4.9.4...v4.10.0