This release adds 1 notable feature for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
Affected surfaces
Summary
AI summaryFixed MFA verification on SQLite and corrected otpauth URI double-issuer bug.
Full changelog
MeshMonitor v3.4.10 - Hotfix: MFA verification on SQLite
Bug Fixes
- MFA verification broken on SQLite (#1831) - The SQLite fallback UserModel SELECT queries were missing
mfa_enabled,mfa_secret, andmfa_backup_codescolumns, causing MFA setup verification and login to fail with a 400 error. All five query methods (findById,findByUsername,findByOIDCSubject,findAll,findByEmail) are now fixed. - Double-issuer in otpauth URI (#1831) - The QR code for authenticator apps showed
MeshMonitor:MeshMonitor:usernameinstead ofMeshMonitor:username.
Full Changelog
- #1831 - fix: MFA verification broken on SQLite - missing columns in SELECT queries
Proxmox LXC Template
This release includes a Proxmox-compatible LXC container template for MeshMonitor.
Installation
- Download the
.tar.gztemplate file - Verify the SHA256 checksum (optional but recommended)
- Upload to your Proxmox server:
scp meshmonitor-*.tar.gz root@proxmox:/var/lib/vz/template/cache/ - Create a new LXC container from the template via Proxmox web UI
- Configure
/etc/meshmonitor/meshmonitor.envwith your Meshtastic node IP - Start the container and access the web UI on port 8080
Documentation
See the Proxmox LXC Deployment Guide for detailed instructions.
Limitations
- Auto-upgrade feature is not supported in LXC deployments
- Manual updates required (download new template for each version)
- Community-supported (Docker remains the primary deployment method)
🚀 MeshMonitor v3.4.10
📦 Installation
Docker (recommended):
docker run -d \
--name meshmonitor \
-p 8080:3001 \
-v meshmonitor-data:/data \
ghcr.io/Yeraze/meshmonitor:3.4.10
🧪 Testing
✅ All tests passed
✅ TypeScript checks passed
✅ Docker images built for linux/amd64, linux/arm64, linux/arm/v7
📋 Changes
See commit history for detailed changes.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Yeraze/meshmonitor
All releases →Related context
Related tools
Earlier breaking changes
- v4.7.2 Route `destination` field now rejects non‑8‑hex nodeId or 64‑hex publicKey, returning HTTP 400.
Beta — feedback welcome: [email protected]