This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
Affected surfaces
Summary
AI summaryPacket Monitor now appears as a sidebar tab and adds dedicated packetmonitor:read permission.
Full changelog
What's New
Features
- Packet Monitor as Sidebar Tab — The Packet Monitor is now available as a dedicated sidebar tab in addition to the map panel (#2180, closes #2179)
- Dedicated Packet Monitor Permission — New
packetmonitor:readpermission controls access to the Packet Monitor. Packets are filtered server-side based on channel and DM permissions (#2181) - Dashboard Widgets — Added hop distribution, distance distribution, and heatmap dashboard widgets (#2164, closes #2162)
Bug Fixes
- Virtual Node config loop — Fixed config request loop caused by cached rebooted messages (#2182)
- MeshCore contacts — Fixed contacts not auto-updating on map and monitor page (#2165)
- Backup modal UI — Wider modal, styled buttons, improved spacing (#2163)
- Mobile message input — Full-width text input with buttons below (#2161)
Performance
- SQL COUNT optimization — Use
COUNT(*)instead of loading entire tables for count queries (#2185) - Batch DELETE operations — Convert N+1 delete loops to batch DELETE statements (#2187)
Maintenance
- Removed 1,182 lines of unused legacy functions from meshtasticManager.ts (#2186)
- Removed debug leftovers and fixed desktop version (#2183)
- Added tested hardware configurations documentation (#2166, #2167)
- Translation updates from Weblate (#2128)
Dependency Updates
- mysql2 3.18.2 → 3.19.0 (#2178)
- express-rate-limit 8.2.1 → 8.3.0 (#2177)
- pg 8.19.0 → 8.20.0 (#2176)
- recharts 3.7.0 → 3.8.0 (#2175)
- puppeteer 24.37.5 → 24.38.0 (#2174)
- Production dependencies group update (#2173)
- Development dependencies group update (#2172)
- docker/login-action 3 → 4 (#2171)
- docker/setup-buildx-action 3 → 4 (#2170)
- docker/setup-qemu-action 3 → 4 (#2169)
- actions/upload-artifact 4 → 7 (#2094)
- actions/download-artifact 7 → 8 (#2095)
Action Required for Admins
The new packetmonitor:read permission is granted to all users (including Anonymous) by default. If you need to restrict Packet Monitor access, review user permissions in Settings → Users.
System Test Results
Test Run: 2026-03-09
| Test Suite | Result |
|------------|--------|
| Configuration Import | ✅ PASSED |
| Quick Start Test | ✅ PASSED |
| Security Test | ✅ PASSED |
| V1 API Test | ✅ PASSED |
| Reverse Proxy Test | ✅ PASSED |
| Reverse Proxy + OIDC | ✅ PASSED |
| Virtual Node CLI Test | ✅ PASSED |
| Backup & Restore Test | ✅ PASSED |
| Database Migration Test | ✅ PASSED |
| DB Backing Consistency | ✅ PASSED |
Unit Tests: 139 test files, 2,938 tests passed
Full Changelog: https://github.com/Yeraze/meshmonitor/compare/v3.8.4...v3.8.5
🚀 MeshMonitor v3.8.5
📦 Installation
Docker (recommended):
docker run -d \
--name meshmonitor \
-p 8080:3001 \
-v meshmonitor-data:/data \
ghcr.io/Yeraze/meshmonitor:3.8.5
🧪 Testing
✅ All tests passed
✅ TypeScript checks passed
✅ Docker images built for linux/amd64, linux/arm64, linux/arm/v7
📋 Changes
See commit history for detailed changes.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Yeraze/meshmonitor
All releases →Related context
Related tools
Earlier breaking changes
- v4.7.2 Route `destination` field now rejects non‑8‑hex nodeId or 64‑hex publicKey, returning HTTP 400.
Beta — feedback welcome: [email protected]