MeshMonitor v4.13.2-rc2

⚠️ Pre-release (Release Candidate). This build is for testing ahead of the v4.13.2 stable release. Docker :latest tags are not updated. Report any issues you hit.

This release candidate closes out the large multi-phase remediation epic (#3962) and the server-route extraction effort (#3502), decomposing the monolithic server.ts into focused route and service modules, migrating the frontend onto real routes + TanStack query hooks, and driving raw fetch() usage to zero. On the feature side it adds cross-source NodeInfo Enrichment (analysis report + apply API, #3837), a Portainer Stack export format in the configurator (#3724), richer MeshCore route popups (packet-flow mini map, {ROUTE_NAMES}/{HASH_SIZE} tokens, accessible detail modals), a per-trigger pre-send delay for the MeshCore Auto-Responder (#3953), configurable Auto-Ack DM resend attempts (#4266), and a map distinction between ROUTER_LATE and ROUTER with an unmessageable badge (#4295). Security fixes suppress a false-positive duplicate-key warning on the Meshtastic 2.8 NodeNum renumber (#4251) and add a self-service Clear action for stale security-risk warnings (#4302). CI hardening pins all GitHub Actions to commit SHAs. This is a testing build ahead of v4.13.2 stable.

✨ Features

• NodeInfo Enrichment — cross-source analysis + apply API (#4287) and a report under Analysis & Reports (#4289) — resolves #3837
• Portainer Stack export format in the configurator (#4282) — resolves #3724
• Map: distinguish ROUTER_LATE from ROUTER, add unmessageable badge (#4303) — resolves #4295
• MeshCore: {ROUTE_NAMES} / {HASH_SIZE} tokens + clickable route-detail popup (#4276)
• MeshCore: packet-flow mini map in route popup + accessible detail modals (#4277)
• MeshCore: per-trigger pre-send delay for the Auto-Responder (#4281) — resolves #3953
• Automation: configurable Auto-Ack DM resend attempts (#4273) — resolves #4266

🐛 Bug Fixes & Security

• Security: self-service Clear action for stale security-risk warnings (#4304) — resolves #4302
• Security: suppress false-positive duplicate-key warning for the Meshtastic 2.8 NodeNum renumber (#4272) — resolves #4251

♻️ Refactoring

server.ts route extraction (#3502):

• Extract settings + admin routes (#4263)
• Extract nodes routes + composition-root teardown (#4265)

Remediation epic — finish the half-migrated abstractions (#3962):

• 4.2a — retire meshcoreRegistry shim + meshtasticManager Proxy alias, and extract services: MQTT bridge/NodeDB, announce scheduler, admin-ack + favorites, device/remote-admin (#4267, #4268, #4269, #4270, #4271)
• 4.2b — explicit connection state machine for meshtasticManager (#4274)
• 4.3 — split meshcoreRoutes into concern modules (#4275)
• 5.1–5.2 — memoize context providers + TanStack version-check (#4280)
• 5.3 — SettingsTab draft-object rewrite (#4284)
• 5.4 — router scaffold + full tab-to-route migration (#4285, #4286, #4288, #4290, #4291, #4292, #4293, #4296)
• 5.5 — migrate raw fetch() sites to ApiService, baseline to zero (#4297, #4298)
• 5.6 — nodes.css cascade-order fix + CSS containment convention (#4299)

🔧 CI / DevOps

• Pin all GitHub Actions to commit SHAs (#4283)

📝 Docs

• Epic #3962 Phase 4+5 close-out (#4300)
• Add MeshEC to the Site Gallery (#4279)
• Record the two verification gaps from the session (#4264)

✅ Issues Resolved

#3502, #3724, #3837, #3953, #3962, #4251, #4266, #4278, #4295, #4302

🙏 New Contributors

• @mirkosalvato1-ctrl — first contribution in #4283 (pinning Actions to SHAs). Welcome!

Full changelog: v4.13.2-rc1...v4.13.2-rc2

🚀 MeshMonitor v4.13.2-rc2

📦 Installation

Docker (recommended):

docker run -d \
  --name meshmonitor \
  -p 8080:3001 \
  -v meshmonitor-data:/data \
  ghcr.io/Yeraze/meshmonitor:4.13.2-rc2

🧪 Testing

✅ All tests passed
✅ TypeScript checks passed
✅ Docker images built for linux/amd64, linux/arm64, linux/arm/v7

📋 Changes

See commit history for detailed changes.