MeshMonitor v4.17.3-rc4

This release brings MeshCore up to parity with Meshtastic across most of the app, using one shared implementation for both protocols wherever they overlap. MeshCore gains Repeater and Room Server settings forms (local and remote), message, server-event and trace notifications, a Security view with packet-rate and clock-offset checks, per-source device-config backups, and MeshCore traces in the Traceroute Explorer. Mesh Issues gains node-health rules (stale, no position, low battery, bad position) for both protocols, and MeshCore MQTT region feeds get their own Notifications tab with broker-link alerts. Settings, messaging, node and DM lists, the Packet Monitor, maps, dashboard widgets, the v1 API and Prometheus now cover MeshCore too. It also closes a security hole where a user with configuration read access on one source could download another source's device backup (including channel keys), and writes backup files readable only by the server. Notifications now honour per-DM mutes for push and Apprise on Meshtastic as well, and desktop-only installs receive message alerts.

Upgrade notes

• Migrations 225–227 run on start (MeshCore trace attempt log, per-source backup history, MeshCore security flags) on SQLite, PostgreSQL and MySQL.
• Device backups: downloading or creating a backup now needs configuration:write on the source (was read). Backups and their schedule are per source; the old global schedule moves to the primary Meshtastic source and other sources start with backups off. Pre-upgrade files go to the only Meshtastic source if there is exactly one, otherwise they are admin-only. Files are now saved with mode 0600 (existing files are tightened on first start) and named mt-… / mc-… in UTC.
• Meshtastic backups no longer include the node's private key. Older backup files are unchanged; delete them if that matters to you.
• Security digests: the digest settings saved in the Security tab were never read before, so the digest reported "No Apprise URL configured". They are now saved per source with a fallback to the global value, so installs with a global Apprise URL start receiving MeshCore security digests (one per MeshCore source per day, only when there are issues).
• Security permissions: the Security issues, export and key-mismatch reads now need nodes:read on the source, for Meshtastic too.
• v1 API: for MeshCore Companion sources, /api/v1/traceroutes (and /network, /network/topology) reported toNodeId equal to fromNodeId. Traces are now a round trip: fromNode* is your radio, toNode* is the target or turnaround hop, and routeBack/snrBack hold the return leg.
• MeshCore DM alerts: saved MeshCore notification settings already had "Direct messages" on (the control was hidden), so existing MeshCore push subscribers start receiving DM and room-post alerts. Turn Direct messages and room posts off on that source's Notifications tab if you don't want them.
• Repeater new-node alerts: Repeater sources whose "Newly Found Nodes" toggle was saved as on start alerting after a 48 h learning period (an existing Repeater that has logged longer alerts from the first new node), capped at 10 per hour per source.
• Meshtastic DM mute: muting a DM now also silences its push and Apprise alerts (it previously only affected the unread badge).

Features

• MeshCore Security P7b: packet rates, clock offset, scanner, digest, export, draft notification DM (#6281) #6314
• Per-source, protocol-aware device backups (Meshtastic and MeshCore Companion) (#6285) #6313
• Notifications tab for MeshCore MQTT region feeds, broker-link alerts for MeshCore MQTT and Meshtastic MQTT bridges (#6307) #6312
• MeshCore traces in the Traceroute Explorer and a trace attempt log (#6276) #6311
• Mesh Issues node-health rules A6–A9 for both protocols (#6279) #6310
• Repeater new-node alerts behind a learning window and hourly cap (#6306) #6309
• MeshCore message, server-event and trace notifications; shared audio settings; notification click-through (#6253) #6305
• Remote structured settings for Repeaters and Room Servers, settings export/import (#6256) #6302
• Repeater structured settings, power-off and private-key restore (#6255) #6288
• Companion BLE PIN, multi-ACKs, factory reset and channel share/import (#6257) #6286
• Security tab on MeshCore: dead contacts, path-hash collisions, advert signatures, own-key change (#6254) #6283
• MeshCore in the v1 API, Prometheus, Dashboard widgets, Mesh Issues and embed maps (#6263) #6280
• MeshCore map parity: shared layers, trace on map, Map Analysis, estimated positions (#6260) #6277
• MeshCore Packet Monitor and contact graph parity (#6262) #6275
• Shared node and DM list tools: sort, filters, grouping, export (#6259) #6270
• MeshCore messaging parity: room unread, DM/room mute, mark-all-read, translation, shared composer (#6261) #6269
• MeshCore Settings parity: telemetry, purge/outliers, dimming; solar and restart in Global Settings (#6258) #6268
• Per-broker TLS verify toggle for the Analyzer Observer (#6250) #6264
• MeshCore Auto Welcome, Auto Favorite, Auto Delete by Distance, Time Sync and Remote Telemetry automation sections (#6224) #6244 #6241 #6236
• Multi-channel Timer Triggers for Meshtastic and MeshCore (#6230) #6235
• Distinct MeshCore channel markers for private / hashtag / public (#6228) #6234
• BIND_ADDRESS environment variable to choose the bind address #6233

Bug Fixes

• Device backups export only the backed-up source's channels #6284
• Notifications name the node of their own source; the key scanner skips MeshCore MQTT sources (#6251, #6252) #6266
• MeshCore heard-by antenna back on the sent-message header row (#6239) #6249
• NeighborInfo request eligibility honours a direct traceroute (#6151) #6248
• Room-server posts re-pushed on every sync are deduplicated (#6246) #6247
• MeshCore remote telemetry reaches trigger.telemetry automations (#6237) #6238
• Firmware 2.8 NodeDB replays excluded from clock-offset samples (#6242) #6243

Security

• Closed cross-source backup access by filename; backup files written 0600; Meshtastic backups no longer store the private key #6313
• Repeater secret debug-log leak fixed and set prv.key added to the CLI danger guard #6288
• Notifications gated on channel key access, so mentions no longer leak channel text decrypted with another source's key #6305

CI/DevOps

• Desktop x64 build on macos-latest #6231

Dependencies

• softprops/action-gh-release 3.0.3 → 3.0.4 #6292
• codeql-action group (4 updates) #6289

Issues Resolved

#6151, #6224, #6228, #6230, #6237, #6239, #6242, #6246, #6250, #6251, #6252, #6253, #6254, #6255, #6256, #6257, #6258, #6259, #6260, #6261, #6262, #6263, #6276, #6279, #6281, #6285, #6306, #6307

Thanks

Thanks to @williavs for the BIND_ADDRESS option (#6233).

Full changelog: v4.17.3-rc3...v4.17.3-rc4