MeshMonitor v4.17.2

MeshMonitor 4.17.2 is a large reliability-and-security release that promotes the 4.17.2 RC series (rc1–rc8) plus a handful of follow-ups. The headline is a full security-hardening pass (findings C1–C9 and more): script-engine RCE holes closed, remote argv-injection via OTA node names blocked, SSRF holes closed with admin-gated global settings, a nonce-based CSP that drops unsafe-inline/unsafe-eval, channel-PSK and backup authorization tightened, per-source authorization enforced on automation run-now, and stored-XSS escaped in map popups. It adds first-class Reticulum (LXMF) support — automation send/reply, an RNode interface-status panel, a position-free Connections topology view, a Pin sidebar control, and persisted announce. MeshCore gains Rooms sort/custom-order, a discover.neighbors repeater button, a ducting overlay, receipt-time message ordering, and a room-post crash fix. Meshtastic gains a free-form remote-admin CLI console, DeviceMetadata.ble_address decode/display, an add_contact-before-set_favorite_node fix for remote favorites, a receive-only TX-safety fix, and first-request proxy auth. The map picks up live packet traffic, per-source and per-role markers, and a unified Map tab, alongside a 13-PR performance sweep (delta polls, socket coalescing, on-demand bundle loading, response compression). Rounded out with dependency updates (including croner 11) and translations.

Security

Close script-engine RCE holes — C1 (#6089)
Prevent remote argv injection via OTA node names in script runner (#6090)
Nonce-based CSP; drop unsafe-inline/unsafe-eval from script-src (#6092)
Close SSRF holes and admin-gate global settings — C7 (#6098)
Harden auth/session/DB surfaces — C9 (#6097)
Enforce per-source authz on automation run-now — C8/AUTHZ-07 (#6095)
Gate channel PSK exposure + channel-db ownership — C4 (#6093)
Confine backup file paths and tighten backup authz — C3 (#6094)
Gate per-source forwarding toggle on automation enable (#6096)
Escape GeoJSON popup/tooltip HTML to kill stored XSS (#6065)
Context-encode analytics values and admin-gate analytics settings (#6091)
Validate API token before skipping CSRF (#6088)

Features

Reticulum: send and reply over Reticulum (LXMF) from the Automation Engine (#6145)
Reticulum: RNode interface status on the Info page + battery/Ch/Air header (#6131)
Reticulum: position-free Connections topology view on the Map page (#6130)
Reticulum: Pin sidebar control in the main nav (#6126)
Reticulum: persisted LXMF display name, Announce now, periodic announce (#6013)
Virtual Node: replay missed text messages when a client reconnects, so an Android app that was backgrounded no longer shows a gap (#6171, closes #6160) — opt-in
Meshtastic: free-form remote-admin CLI console (#6156)
Meshtastic: decode and show DeviceMetadata.ble_address (#6158)
Meshtastic: send add_contact before set_favorite_node so remote favorites stick (#6155)
Meshtastic: configurable default source (#6021)
MeshCore: Rooms list sort dropdown + custom order, and click-to-deselect (#6152)
MeshCore: discover.neighbors quick-action button for repeaters (#6146)
MeshCore: ducting overlay on the per-source map (#5993)
MeshCore: order DMs/channel messages by receipt time (#5994)
MeshCore: purge non-favourite nodes from device config (#6110)
MeshCore: clear Trace SNR history per contact (#5995)
MeshCore: Auto Ping for Companion sources (#5962)
Map: live packet traffic on the map (#5971)
Map: colour node markers by source on the Unified map (#6129)
Map: distinct markers and badges per node role (#6014)
Nav: one Map tab across source types; MeshCore shows the map first on mobile (#5969)
Telemetry: retry burst + cooldown for missed scheduled pulls (#6042); merge objective telemetry across sources (#5966)
Automation: airtime-cutoff manual infrastructure picks (#5947)
Aircraft: optional all-sources manual mark (#6111)
Headless: first-boot env vars for headless installs (#5998); MeshCore default source from env (#6004)

Bug Fixes

meshtastic: default lora.txEnabled to false when a device config omits it — receive-only radios no longer read as TX-enabled (#6144)
meshtastic: recognize proxy-signed-in users on the first /auth/status request (#6031)
meshcore: stop crashing on room posts from serial and TCP radios (#6122)
meshcore: keep unread markers on one receipt clock (#6019)
meshcore: unread DMs sort to top of the conversation dropdown; fixes iOS scroll jump (#6128)
meshcore: channel auto-scroll + fold own outbound reactions into chips (#6108)
virtual-node: mark broadcast DM pki_encrypted for Android (#6166); take packet id from the last id segment (#6168)
reticulum: recover from a failed RNS start without a manual restart (#5957); host-networking attach mode (#5956)
mqtt: match default-key primary traffic to Primary #0 via modem-preset name (#6038)
i18n: repair broken interpolation placeholders in es.json (#6167)

Performance

Delta polls — send only what changed since the client's last poll (#6037)
Push MQTT node updates over the socket, coalesced per source (#6035)
Load tabs, MapLibre, recharts and config search on demand (#6029)
Compress responses and cache hashed assets (#6025)
Dashboard: read only live node rows, memoize merge/markers, trim bundles (#6024, #6026, #6028, #6032, #6034)
Memoize message rows and virtualize long MeshCore lists (#6036)
Keep compose draft and map view out of app-wide contexts (#6030)

Dependencies

croner 10 → 11, plus maplibre-gl, react-i18next, lucide-react, @tanstack/react-query (+devtools), rollup platform binaries, @types/node, and the production-dependencies group — 24 updates in all.

Docs

4.17.2 security-hardening + reliability blog post (#6117); 4.17.1 documentation pass (#5961)

Translations

Complete Spanish (es) translation — now 100% (#6172, includes the es.json placeholder fixes from #6167 and the Weblate bump from #6147)
Hosted Weblate updates (#6020, #6167)

Contributors

Thanks to this cycle's external contributors: @enricolorenzoni59 (first contribution — #6122), @geirgp (#6031), @temalo (#6019), and @framortej (complete Spanish translation, and the #6160 / #6165 reports with a tested patch).

Full changelog: v4.17.1...v4.17.2