This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
Affected surfaces
Summary
AI summaryReverse proxy authentication adds Cloudflare Access and oauth2-proxy support.
Full changelog
What's New in v3.12.0
Features
- Reverse proxy authentication — Support for Cloudflare Access, oauth2-proxy, and other reverse proxy auth providers (#2539)
- Telemetry widget display modes — Gauge and numeric display modes for telemetry widgets with per-widget persistence (MM-67, MM-80, #2537, #2550, #2554)
- Per-channel/DM notification muting — Mute notifications per channel or DM with time-based options (MM-77, #2549)
- Auto heap management — Prevents node OOM crashes with automatic memory management (#2555, MM-100, #2563)
- Delete channel — Delete channel button with message and DB record cleanup (#2531, #2533)
- V1 API status endpoint —
/api/v1/statusendpoint and WebSocket Bearer token auth (#2527) - Custom tileserver style — Generate default
style.jsonfrom custom tileserver (#2551) - System tests CI — Self-hosted runner workflow for hardware-integrated system tests (#2569)
- Homepage refresh — Updated MeshMonitor.org homepage content and structure (#2542)
Bug Fixes
- WebSocket connection with BASE_URL — Fixed Socket.io silently failing when
<base>tag is present; explicit URL + polling-first transport (#2567) - CSP WebSocket support — Added
ws:/wss:to Content-Security-Policyconnect-src(#2567) - Widget mode/range BASE_URL —
useWidgetMode/useWidgetRangenow respect BASE_URL for API calls (#2567) - Notification muting — Unread count badges and notification sounds now properly respect mute settings (#2570)
- Device config cache — Config changes (LoRa, network, position, MQTT, etc.) immediately update the in-memory cache (#2568)
- Telemetry gauge/numeric display bugs — Fixed mode display issues (MM-99, #2564)
- Private channel data masking — Extended masking to telemetry and traceroute fields; prevent location data leaking through nodes API (MM-47, #2544, #2546)
- Mark-as-read PostgreSQL — Fixed mark-as-read failing on PostgreSQL (#2535)
- Map preferences migration — Migrated from raw SQL to Drizzle ORM (#2524, #2526)
- Packet monitor resize — Invalidate map size when packet monitor is resized (#2553)
- PSK preservation — Preserve
AQ==PSK shorthand verbatim in channel database on save (#2559) - MeshCore auto-connect — Auto-connect MeshCore on startup (MM-31, #2543)
- Packet monitor encryption check — Use
decryptedByflag forisEncryptedcheck (#2541) - Zoom-based label visibility — Apply to MeshCore map markers (#2525, #2529)
- Database migration test — Fixed pipefail, empty count guards, auto build:server (#2568)
- System test reliability — Favorites ±1 variance, missing
.envfor CI (#2572)
Other
- Translations update from Hosted Weblate (#2516)
- Test coverage — Phase 1 and Phase 2 coverage tests toward 50% target (MM-49, #2547, #2552)
- PirateWeatherADV — Added community script to User Scripts Gallery (#2561)
- Tulsa/Broken Arrow Mesh — Added to site gallery (#2523)
- Documentation — Telemetry widgets, homepage refresh, notification muting docs (MM-77, MM-78, MM-79, #2556)
Full Changelog: https://github.com/Yeraze/meshmonitor/compare/v3.11.1...v3.12.0
🚀 MeshMonitor v3.12.0
📦 Installation
Docker (recommended):
docker run -d \
--name meshmonitor \
-p 8080:3001 \
-v meshmonitor-data:/data \
ghcr.io/Yeraze/meshmonitor:3.12.0
🧪 Testing
✅ All tests passed
✅ TypeScript checks passed
✅ Docker images built for linux/amd64, linux/arm64, linux/arm/v7
📋 Changes
See commit history for detailed changes.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Yeraze/meshmonitor
All releases →Related context
Related tools
Earlier breaking changes
- v4.7.2 Route `destination` field now rejects non‑8‑hex nodeId or 64‑hex publicKey, returning HTTP 400.
Beta — feedback welcome: [email protected]