MeshMonitor v4.17.3-rc6

⚠️ Pre-release. This is a release candidate for testing. Do not run it on a production install you can't roll back.

Summary

This RC is the result of a full pre-release review of the 4.17.3 work: code review across the backend and frontend, plus live UI passes on desktop, phone portrait and phone landscape. The most important fix is security: the v1 API no longer returns MeshCore channel secrets to callers without write access to that channel, and deleting a source now removes its channel secrets. The poll endpoint no longer blanks the node and channel lists when one section fails. MeshCore automated senders got tighter limits: the Auto Welcome hourly cap is now enforced under concurrent arrivals, multi-channel timers wait 10 s between channels and send to at most 4, and duplicate split sequences are dropped. Opening a MeshCore Room Server no longer logs in automatically; use the new Login button. MeshCore pages now work in phone landscape, and many dialogs, rails, headers and tables were fixed for small screens. Unconnected MeshCore sources show a clear "not connected" notice instead of raw errors. Dashboard telemetry charts gain a fixed Y-axis min/max per widget. System restore no longer fails on legacy backup columns, the MySQL backup list loads again, and no longer purges an old backup's telemetry on the first boot.

Features

• Dashboard: per-widget fixed Y-axis min/max on telemetry charts #6349

Security

• Channel PSKs in the v1 API, source-delete secrets, gateway membership (review P1) #6359
• Bridge: bump msgpack to 1.2.3 (CVE-2026-114613) #6355

Bug Fixes

• Poll: one failing section no longer blanks nodes and channels; slow retry while down; error notice (review P2) #6358
• MeshCore senders: Auto Welcome cap race, MeshWars hop count, split-timer floor (review P3) #6360
• MeshCore policies: automatic-trace alerts toggle, split queue, timer channels, explicit room login, gate retry pause, NeighborInfo age, combined digest (review P6) #6363
• Layout: MeshCore in phone landscape, dialogs, section rails, themes (review P4) #6361
• Copy and polish: i18n keys, icons, tooltips, danger buttons (review P5) #6362
• MeshCore not-connected state, danger button, header status, icons (review P7b) #6366
• Layout: source page titles, landscape channel menu, Reticulum tables, modal overlay, sidebar, connection banner (review P7a) #6367
• Restore: skip startup retention purges on the boot that restores a backup #6357
• Dashboard: connection banner names the viewed source's host:port #6356
• Backup: skip backup columns the target table lacks on restore #6351
• Backup: MySQL backup list no longer fails with a collation error #6372

CI/DevOps

• Fix the MeshCore timer multi-channel test hang on slow CI #6364
• Bump version to 4.17.3-rc6 #6371

Issues Resolved

• #6348 Dashboard chart widget: user-set Y-axis min/max
• #6350 System restore fails on backup columns the target table lacks
• #6352 Bump msgpack to 1.2.3 in bridge (CVE-2026-114613)
• #6353 Connection Error banner shows the env placeholder IP, not the source's host
• #6354 Restoring an old backup purges all its telemetry on first boot

Upgrade notes

• MeshCore Room Servers: selecting a room no longer logs in. Saved posts show read-only; press Login to log in. Scheduled room auto-sync is unchanged.
• Automatic-trace notifications: a new "notify on automatic traces" toggle defaults to off. Traces you start yourself still notify under the existing traceroute setting.
• MeshCore multi-channel timers: at most 4 channels per timer, 10 s apart. Extra channels are skipped with a log warning.
• Security digest: POST /api/security/digest/send now needs a sourceId and nodes:read on that source. The UI "Send Now" button and the daily scheduled digest are unchanged. When per-source digest URLs fall back to the global URL, you now get one combined daily digest instead of one per source.
• Automations: existing trigger.telemetry automations with no source filter now also fire on MeshCore readings.
• Restoring an old backup: startup retention purges skip the restore boot; the hourly purge applies retention afterwards.

Full changelog: v4.17.3-rc5...v4.17.3-rc6

🚀 MeshMonitor v4.17.3-rc6

📦 Installation

Docker (recommended):

docker run -d \
  --name meshmonitor \
  -p 8080:3001 \
  -v meshmonitor-data:/data \
  ghcr.io/Yeraze/meshmonitor:4.17.3-rc6

🧪 Testing

✅ All tests passed
✅ TypeScript checks passed
✅ Docker images built for linux/amd64, linux/arm64, linux/arm/v7

📋 Changes

See commit history for detailed changes.