github Yeraze/meshmonitor v4.17.1
on GitHub

5 hours ago

MeshMonitor v4.17.1

This release rolls up ten release candidates. MeshCore gains reactions, a native Companion text CLI for firmware 1.18.0, saved remote-admin sessions, stored CLI history, and route hops resolved from other sources. Auto Responder, Timer Triggers, Auto Acknowledge and channel editing now share one workflow and one trigger syntax across Meshtastic and MeshCore, and trigger patterns accept emoji. Local accounts can sign in with a passkey. The Map tab and Dashboard map gain a tropospheric ducting overlay, waypoints round-trip the firmware's geofence fields, and the ADS-B layer adds OpenSky as a feed. Meshtastic channels can use AEAD (AES-CCM), and admins can set, clear and lock a node's channel by hand. Unified Telemetry gains a cross-source dashboard, Node Details shows rename history, and node battery icons show the charge level. Many MQTT fixes stop bridges from echoing each other, and the Packet Monitor now drops firmware 2.8 NodeDB replays. A security fix scopes traceroute history and unified telemetry to the sources a user may read. Database maintenance now runs on PostgreSQL and MySQL, and the Docker image moves to Node.js 24.22.1.

Features

MeshCore

  • Reactions (epic #5759): codec for the MeshCore One and meshcore-open formats (#5771), inbound reaction chips (#5775), sending reactions and automation tapbacks (#5776), and chips in Unified Messages plus CSV columns and an opt-in automation trigger (#5778)
  • Companion text CLI on firmware 1.18.0: local console, quick-action catalog and remote CLI (#5869)
  • Remember and resume remote-admin sessions (#5798)
  • Store CLI command history (#5897)
  • Resolve unknown route hops from other sources (#5911)
  • Radio contact list: auto-add mode and type filters, max hops, replace the oldest non-favourite when full, and "Remove non-favourite contacts from the radio" (#5783)
  • Override a contact's location (#5848)
  • Edit the Observer in MeshCore Configuration; quick configure joins the save (#5840)
  • Search and section buttons on MeshCore Configuration and Automations (#5855)

Automation and messaging

  • One Auto-Responder trigger syntax for Meshtastic and MeshCore, with Pattern and Regex modes and emoji support (#5930)
  • One Auto Responder workflow for Meshtastic and MeshCore (#5811)
  • One Timer Triggers workflow for Meshtastic and MeshCore (#5814)
  • Same field groups for Auto Acknowledge and Auto Announce on both protocols (#5817)
  • Shared config section shell for automation sections (#5809)
  • Auto Acknowledge: nearer nodes answer a channel message first (#5789)
  • Separate IP (MQTT/UDP) row in the Auto-Ack matrix (#5854)
  • Choose the 0-hop and MQTT tapback glyphs (#5894)
  • Draw SPIP1 pixel-image messages as images (#5945), thanks @maxhayim
  • Unified Messages remembers the last selected channel per browser (#5793), thanks @goodprogrammist
  • Remember Show MQTT/Bridge Messages per source (#5844)
  • Status Message: opt-in, per-source "Re-apply after a reboot" (#5784)

Maps, nodes and telemetry

  • Tropospheric ducting overlay on the Map tab and Dashboard map (#5875, #5913)
  • Round-trip firmware waypoint geofence fields (#5925)
  • ADS-B: add OpenSky Network as a feed (#5906)
  • ADS-B: re-check aircraft flight matches as the node moves (#5905)
  • Set, clear and lock a node's channel by hand (#5941)
  • Track node renames and show them in Node Details (#5865)
  • Battery icons show the charge level (#5947)
  • Cross-source Telemetry Dashboard on Unified Telemetry (#5907)

Channels, security and configuration

  • Decrypt AEAD (AES-CCM) channels server-side (#5860) and edit AEAD on device channels (#5861)
  • One channel editing model for Meshtastic and MeshCore (#5838)
  • Passkey sign-in for local accounts (#5841): storage (#5849), sign-in (#5850), passkey-only accounts, recovery codes and admin revoke (#5851), user guide (#5853) and design spec (#5847)
  • Split the traceroute permission into Read and Write; MeshCore trace-path takes traceroute:write (#5903)
  • Describe the reworked XEdDSA signing policy, and show the firmware's "Unsigned update ignored" notice (#5948)
  • Device Configuration pages on the shared section shell (#5819)
  • Danger zone last, in-app confirms and write gating on Device Configuration (#5839)
  • Shared password field with show/hide (#5837)
  • Saved MQTT broker presets, reusable across MQTT forms (#5873)
  • A prominent Global Settings banner on each source's Settings page (#5949)

Bug Fixes

  • MQTT: bridges stop relaying each other's upstream; close the echo race (#5799)
  • MQTT: drop automation uplinks on the client-proxy path too (#5787)
  • MQTT: raise encrypted uplinks by their real portnum (#5795)
  • MQTT: show a forwarder's own uplinked packets on its source (#5859)
  • MQTT: gate the device MQTT form on configuration:write (#5820)
  • MQTT bridge: single-mode client ID, eviction stop, uplink drop count (#5902)
  • Packet Monitor: recognise firmware 2.8 NodeDB replays by packet id (#5803)
  • Docker: the BLE bridge health check follows the BLE link, not the TCP port (#5802)
  • Database: run maintenance on PostgreSQL/MySQL, prune audit_log, tune PG (#5871)
  • Config: honor DATA_DIR for every data path (#5895)
  • Config: expect the reboot that most Device Configuration saves cause (#5836)
  • Config: SaveBar baselines follow successful saves and reloads (#5813)
  • Config: refetch channels after Reload Config on Device (#5920)
  • Channels: clearable PSK, meshcore_mqtt guard, MeshCore Public slot, missing strings (#5835)
  • Channels: send sourceId with channel export (#5810)
  • Nodes: record a node's channel only from its own key-decoded traffic (#5926)
  • Estimator: count unique anchor positions; explain estimates on Node Details (#5904)
  • Geofence: record trigger results on the source's own key (#5833)
  • Timers: keep the server's run state on save; one name, Timer Triggers (#5832)
  • Push: renew a rotated push subscription on its sources (#5864)
  • Traceroute: tapping a node in Traceroute mode draws its newest answered run (#5845)
  • Meshtastic: rebroadcast mode descriptions follow firmware behaviour (#5780), thanks @temalo
  • MeshCore: all three telemetry sharing modes now persist (#5781)
  • MeshCore: room post authors resolve to the right contact (#5782)
  • MeshCore: Observer credentials are set and cleared per broker (#5834)
  • MeshCore: per-node schedule toggles roll back on a failed save and ignore stale replies (#5822)
  • MeshCore: Notifications section bar sits flush with the top of the pane (#5856)
  • MeshCore: send a firmware-v3 DeviceInfo from the Virtual Node (#5917)
  • MeshCore: trace direct-neighbour repeaters through their own hash (#5915)
  • MeshCore: return empty channel info within advertised capacity (#5942), thanks @temalo
  • MeshCore: split the Nodes list header into two rows (#5937)
  • Virtual Node: prefer the MQTT proxy client as proxy delegate (#5928)

Security

  • Scope traceroute history and unified telemetry to permitted sources (#5901)
  • MeshCore CLI command text and replies are redacted before storage, in both the CLI history and the audit log (#5897)
  • Bump the Node.js base image to 24.22.1 (#5935)

Documentation

  • MQTT Setup Guide, linked from the app (#5800)
  • List ShackScreen under REST API clients (#5910)

CI/DevOps

  • Raise the amd64/arm64 Docker release build timeout to 70 minutes (#5804)
  • Version bumps for rc1–rc10 and the release

Dependencies

  • Production dependency group, 18 updates (#5882); react group (#5879); vitest group (#5878); development group (#5880); codeql-action group (#5881)
  • emoji-picker-react 5.0.0 (#5887), express 5.3.0 (#5886), node-notifier 11.0.0 (#5888), puppeteer 25.14.0 (#5883)
  • lucide-react 1.57.0 (#5754, #5885), maplibre-gl 6.14.0 (#5752, #5884), vite-plugin-pwa 2.0.0 (#5751)
  • engine.io 6.6.11 and a single mysql2 for express-mysql-session (#5846)
  • actions/setup-node 7.1.0 (#5758), actions/upload-artifact 7.0.2 (#5753), rollup musl/gnueabihf binaries (#5755, #5756)

Translations & Tests

  • Translations from Hosted Weblate (#5676, #5929)
  • Treat Weblate's empty-string keys as untranslated (#5938)

Issues Resolved

#5013, #5734, #5759, #5760, #5761, #5762, #5763, #5764, #5772, #5773, #5774, #5777, #5779, #5785, #5788, #5791, #5792, #5796, #5797, #5807, #5808, #5812, #5815, #5816, #5818, #5821, #5823, #5824, #5825, #5826, #5827, #5828, #5829, #5830, #5831, #5841, #5842, #5858, #5862, #5863, #5866, #5867, #5868, #5870, #5876, #5877, #5889, #5890, #5892, #5896, #5898, #5900, #5908, #5909, #5914, #5916, #5918, #5919, #5922, #5923, #5924, #5927, #5933, #5934, #5936, #5944, #5946

#5745 (Status Message lost on reboot) stays open because the cause is in firmware. This release adds a mitigation.

New Contributors

Thanks to @goodprogrammist (#5793) and @maxhayim (#5945) for their first contributions!

Upgrade notes

  • Migrations 203–217 run on first start, on all three backends. They add MeshCore reaction columns, admin sessions, CLI history, a traceroute:write backfill for MeshCore sources, aircraft re-check columns, advert signature status, waypoint geofence columns and nodes.channelLocked. Migration 210 adds an index on messages(sourceId, channel, timestamp) and, on PostgreSQL, sets per-table autovacuum thresholds.
  • PostgreSQL/MySQL: Database Maintenance now shows on your backend but stays off until you enable it under Settings → Database Maintenance. Large PostgreSQL installs should also run the one-off REINDEX TABLE CONCURRENTLY / VACUUM (ANALYZE) steps in docs/development/database.md.
  • BLE bridge users: pull the latest meshtastic-ble-bridge image and add HEALTH_FILE=/tmp/ble-bridge.health plus the new health check, or regenerate your compose file with the Docker Configurator.
  • Auto-Acknowledge: messages received over MQTT or multicast UDP now use the new IP row, which starts off. If you relied on the multi-hop or 0-hop row to answer them, turn on the IP row under Automation → Auto Acknowledge.
  • MQTT bridges on one broker: if you relied on one upstream being relayed into another through MeshMonitor, tick Relay traffic from other bridges on the bridge that should carry it.
  • Baremetal: you can set DATA_DIR in the .env your systemd unit names, and every data path follows it. Explicit DATABASE_PATH, BACKUP_DIR, SYSTEM_BACKUP_DIR, ACCESS_LOG_PATH and APPRISE_CONFIG_DIR still win.
  • MeshCore Observer: the single credential block becomes per-broker credentials. Existing credentials keep working.
  • MeshCore reactions: showing and sending them is on per source; Auto-Acknowledge answers to reactions are off. An automation fires on a reaction only when the rule ticks Also fire on MeshCore reactions.
  • CSV export appends reaction and reply_to_id columns; the first 13 columns keep their name and order.
  • Cross-source hop names are off by default: Settings → MeshCore Messaging.
  • Some estimated pins may disappear from the map. Stale estimates are deleted, and single-anchor estimates (5 km) are wider than the map's 2 km display limit.
  • Regexes in forwarding rules and MeshCore Auto-Acknowledge now accept emoji and other non-ASCII printable text. Control characters, the 100-character cap and the ReDoS checks still apply.
  • Passkeys are optional. Nothing changes until a user adds one. See the Passkeys guide.
  • "Timed Events" is now "Timer Triggers" on Meshtastic.
  • New setting: MeshCore CLI history retention (default 90 days, 7–365).

Full Changelog: v4.17.0...v4.17.1

🚀 MeshMonitor v4.17.1

📦 Installation

Docker (recommended): 

docker run -d \
  --name meshmonitor \
  -p 8080:3001 \
  -v meshmonitor-data:/data \
  ghcr.io/Yeraze/meshmonitor:4.17.1

🧪 Testing

✅ All tests passed
✅ TypeScript checks passed
✅ Docker images built for linux/amd64, linux/arm64, linux/arm/v7

📋 Changes

See commit history for detailed changes.

Check out latest releases or
releases around Yeraze/meshmonitor v4.17.1

Don't miss a new meshmonitor release

NewReleases is sending notifications on new releases.

Get notifications