Skip to content

Yeraze/meshmonitor

v3.12.0 Feature

This release adds 3 notable features for engineering teams evaluating rollout.

Published 2mo Monitoring & Metrics
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

meshcore meshtastic mqtt

Affected surfaces

auth

Summary

AI summary

Reverse proxy authentication adds Cloudflare Access and oauth2-proxy support.

Full changelog

What's New in v3.12.0

Features

  • Reverse proxy authentication — Support for Cloudflare Access, oauth2-proxy, and other reverse proxy auth providers (#2539)
  • Telemetry widget display modes — Gauge and numeric display modes for telemetry widgets with per-widget persistence (MM-67, MM-80, #2537, #2550, #2554)
  • Per-channel/DM notification muting — Mute notifications per channel or DM with time-based options (MM-77, #2549)
  • Auto heap management — Prevents node OOM crashes with automatic memory management (#2555, MM-100, #2563)
  • Delete channel — Delete channel button with message and DB record cleanup (#2531, #2533)
  • V1 API status endpoint/api/v1/status endpoint and WebSocket Bearer token auth (#2527)
  • Custom tileserver style — Generate default style.json from custom tileserver (#2551)
  • System tests CI — Self-hosted runner workflow for hardware-integrated system tests (#2569)
  • Homepage refresh — Updated MeshMonitor.org homepage content and structure (#2542)

Bug Fixes

  • WebSocket connection with BASE_URL — Fixed Socket.io silently failing when <base> tag is present; explicit URL + polling-first transport (#2567)
  • CSP WebSocket support — Added ws:/wss: to Content-Security-Policy connect-src (#2567)
  • Widget mode/range BASE_URLuseWidgetMode/useWidgetRange now respect BASE_URL for API calls (#2567)
  • Notification muting — Unread count badges and notification sounds now properly respect mute settings (#2570)
  • Device config cache — Config changes (LoRa, network, position, MQTT, etc.) immediately update the in-memory cache (#2568)
  • Telemetry gauge/numeric display bugs — Fixed mode display issues (MM-99, #2564)
  • Private channel data masking — Extended masking to telemetry and traceroute fields; prevent location data leaking through nodes API (MM-47, #2544, #2546)
  • Mark-as-read PostgreSQL — Fixed mark-as-read failing on PostgreSQL (#2535)
  • Map preferences migration — Migrated from raw SQL to Drizzle ORM (#2524, #2526)
  • Packet monitor resize — Invalidate map size when packet monitor is resized (#2553)
  • PSK preservation — Preserve AQ== PSK shorthand verbatim in channel database on save (#2559)
  • MeshCore auto-connect — Auto-connect MeshCore on startup (MM-31, #2543)
  • Packet monitor encryption check — Use decryptedBy flag for isEncrypted check (#2541)
  • Zoom-based label visibility — Apply to MeshCore map markers (#2525, #2529)
  • Database migration test — Fixed pipefail, empty count guards, auto build:server (#2568)
  • System test reliability — Favorites ±1 variance, missing .env for CI (#2572)

Other

  • Translations update from Hosted Weblate (#2516)
  • Test coverage — Phase 1 and Phase 2 coverage tests toward 50% target (MM-49, #2547, #2552)
  • PirateWeatherADV — Added community script to User Scripts Gallery (#2561)
  • Tulsa/Broken Arrow Mesh — Added to site gallery (#2523)
  • Documentation — Telemetry widgets, homepage refresh, notification muting docs (MM-77, MM-78, MM-79, #2556)

Full Changelog: https://github.com/Yeraze/meshmonitor/compare/v3.11.1...v3.12.0

🚀 MeshMonitor v3.12.0

📦 Installation

Docker (recommended):

docker run -d \
  --name meshmonitor \
  -p 8080:3001 \
  -v meshmonitor-data:/data \
  ghcr.io/Yeraze/meshmonitor:3.12.0

🧪 Testing

✅ All tests passed
✅ TypeScript checks passed
✅ Docker images built for linux/amd64, linux/arm64, linux/arm/v7

📋 Changes

See commit history for detailed changes.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Yeraze/meshmonitor

Get notified when new releases ship.

Sign up free

About Yeraze/meshmonitor

All releases →

Related context

Earlier breaking changes

  • v4.7.2 Route `destination` field now rejects non‑8‑hex nodeId or 64‑hex publicKey, returning HTTP 400.

Beta — feedback welcome: [email protected]