What's Changed
- docs: remediation plan + epic status doc (#3962) by @Yeraze in #3966
- feat(server): process-level safety net for unhandledRejection/uncaughtException (#3962) by @Yeraze in #3967
- fix(security)!: default trust proxy to false when TRUST_PROXY is unset (#3962) by @Yeraze in #3968
- chore(deps): pin meshcore.js fork to commit SHA (#3962) by @Yeraze in #3969
- fix(security): strip hot-path console logging and CSRF token exposure in api.ts (#3962) by @Yeraze in #3970
- chore(lint): enable @typescript-eslint/no-floating-promises as error (#3962) by @Yeraze in #3972
- feat(db)!: withSourceScope fails closed — omitting sourceId throws, ALL_SOURCES sentinel for intentional cross-source (#3962) by @Yeraze in #3976
- feat(automations): multi-channel message trigger OR-list (#3974) by @Yeraze in #3982
- feat(map): add polar grid overlay to Map Analysis and Unified maps (#3971) by @Yeraze in #3983
- fix(meshcore): auto-retry DM via same-path + flood cadence on ack timeout by @Yeraze in #3980
- ci(types): type-check test files via tsconfig.tests.json, non-blocking first (#3962) by @Yeraze in #3985
- fix(meshcore): populate fromName on DM automation triggers, clarify trigger.from vs fromName by @Yeraze in #3978
- feat(meshcore): delete/purge messages — per-message, per-conversation, purge-all (#3981) by @Yeraze in #3984
- test(routes): integration-grade route-test harness with real auth middleware (#3962) by @Yeraze in #3986
- fix(meshcore): exact decrypt-and-match for channel 'repeaters relayed' echo (#3979 pt1) by @Yeraze in #3987
- feat(meshcore): opt-in auto-retry for automated channel sends (#3979 Part 2) by @Yeraze in #3988
- chore(lint): count-based lint ratchet — new violations block, existing debt baselined; CI lint now blocking (#3962) by @Yeraze in #3989
- feat(server): codify the { success, error, code } response envelope in ok()/fail() helpers (#3962) by @Yeraze in #3990
- feat(meshcore-vn): relay SendStatusReq(27) status requests to the physical node (#3904) by @Yeraze in #3991
- test(db): schema-drift tripwire — CI fails on createTables vs migration-replay divergence (#3962) by @Yeraze in #3992
- feat(meshcore-vn): relay GetNeighbours via SendBinaryReq(50) to the physical node (#3904) by @Yeraze in #3993
- chore(logging): trim default log volume — reclassify routine info→debug, add trace tier by @Yeraze in #3994
- refactor(registry)!: MeshCoreManager implements ISourceManager — one unified source registry (#3962) by @Yeraze in #4004
- Fix Virtual Node Server boot race and listen-error zombie state by @Yeraze in #4001
- feat(automation): add "Send via sources" selector to the tapback action by @Yeraze in #3997
- feat(automation): add scheduled device-reboot action (#3995) by @Yeraze in #4002
- fix(meshcore): match-scope replies unscoped for unnameable trigger scope (#3998) by @Yeraze in #4003
- refactor(heartbeat): extract protocol-agnostic HeartbeatScheduler; MeshCore adopts (#3962) by @Yeraze in #4005
- test(automation): fix rebootDevice tests broken by #4004/#4002 merge race by @Yeraze in #4007
- refactor(announce): extract CronOrIntervalScheduler; both managers delegate arming (#3962) by @Yeraze in #4009
- feat(map): node selection & emphasis on Map Analysis (#3788 Phase 1) by @Yeraze in #4010
- refactor(auto-responder): extract Meshtastic DSL matcher — tests now guard production code (#3962) by @Yeraze in #4011
- feat(map): Follow & Auto-zoom on Map Analysis (#3788 Phase 2) by @Yeraze in #4012
- refactor(distance-delete): formalize scheduler lifecycle on ISourceManager; Meshtastic adopts the shared class (#3962) by @Yeraze in #4014
- feat(map): node-to-node LOS distance measurement tool on all maps (#3636) by @Yeraze in #4013
- refactor(startup)!: retire the Meshtastic singleton's special-casing — uniform construction, live primary alias (#3962) by @Yeraze in #4017
- refactor(db): split misc.ts — extract solarEstimates, upgradeHistory, newsCache, backupHistory repos (#3962) by @Yeraze in #4023
- fix(map): decouple popup from spiderfy + declutter obscured markers (#4015, #4016) by @Yeraze in #4022
- refactor(db): split misc.ts — extract autoTraceroute, timeSync, distanceDeleteLog, mapPreferences, themes repos (#3962) by @Yeraze in #4030
- feat(map): extend popup/spiderfy fix + obscured-marker offset to all maps by @Yeraze in #4028
- fix(meshcore): remove non-functional Stats quick-action from remote console by @Yeraze in #4031
- fix(automation): resolve MeshCore DM destination as a pubkey string, not Number() by @Yeraze in #4019
- fix(meshcore): danger-command guard no longer fires on dotted config-path args by @Yeraze in #4029
- refactor(db): split misc.ts — packetLog + keyRepair repos; delete misc.ts (#3962) by @Yeraze in #4032
- feat(meshcore): configurable remote/local CLI reply timeout (#4027) by @Yeraze in #4033
- chore(migrations): shared idempotency helpers + registry-derived count test (#3962) by @Yeraze in #4034
- refactor(db): key-repair parity — 3-backend Drizzle repository, facade raw SQL deleted (#3962) by @Yeraze in #4036
- fix(notifications): low-battery alerts lost to split preference rows by @Yeraze in #4035
- feat(db): migration 113 — normalize bootstrap-only indexes across backends (#3962) by @Yeraze in #4040
- feat(meshcore): Auto-Pathfinding target filtering (#4024) by @Yeraze in #4039
- refactor(db)!: fresh installs bootstrap via migration replay — createTables() deleted (#3962) by @Yeraze in #4041
- refactor(db): migrate last sync-facade callers; extract node cache, mobility, traceroute-selection, packet-rate services (#3962) by @Yeraze in #4043
- refactor(db): delete the sync-legacy API surface — Phase 3 complete (#3962) by @Yeraze in #4048
- fix(api): require sourceId on always-500 endpoints + enforcement foundation (1/N) by @Yeraze in #4053
- fix(api): scope telemetry-delete & channel-export to a required sourceId (2/N) by @Yeraze in #4054
- fix(system-tests): scope message send/read to a sourceId by @Yeraze in #4052
- fix(api): require sourceId on telemetry + position-override, wire frontend (Phase 2a) by @Yeraze in #4056
- fix(api): require sourceId on neighbor-info/:nodeNum; fix embed neighbor 500 (Phase 2b) by @Yeraze in #4058
- fix(api): require sourceId on security reads, wire SecurityTab (Phase 2c) by @Yeraze in #4059
- fix(api): require sourceId on channel-write routes, wire config callers (Phase 2d) by @Yeraze in #4061
- fix(api): scope security node-clear to a required sourceId by @Yeraze in #4062
- fix(api): scope v1 GET /packets/:id to the caller's source by @Yeraze in #4063
- test(system): send sourceId to endpoints hardened by the sourceid remediation by @Yeraze in #4069
- chore: bump version to 4.13.0-rc1 by @Yeraze in #4050
Full Changelog: v4.12.5...v4.13.0-rc1
🚀 MeshMonitor v4.13.0-rc1
📦 Installation
Docker (recommended):
docker run -d \
--name meshmonitor \
-p 8080:3001 \
-v meshmonitor-data:/data \
ghcr.io/Yeraze/meshmonitor:4.13.0-rc1🧪 Testing
✅ All tests passed
✅ TypeScript checks passed
✅ Docker images built for linux/amd64, linux/arm64, linux/arm/v7
📋 Changes
See commit history for detailed changes.