This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
Affected surfaces
Summary
AI summaryFixed SQLite migration skipping that caused crashes when upgrading from pre-3.9 on SQLite.
Full changelog
What's Changed in v3.9.5
Bug Fixes
- fix: SQLite migrations 083/084 skipped due to early return in 082 — Users upgrading from pre-3.9 on SQLite were missing the
lastMeshReceivedKeycolumn, crashing node queries and auto-delete-by-distance. (#2301, fixes #2296) - fix: allow 0 for traceroute expiration hours setting — Backend rejected 0 for "Re-traceroute after" even though the frontend and server route allowed it. (#2300)
- fix: polish Auto Delete by Distance UI — Aligned header checkbox pattern, Run Now button, disabled states, and fixed "Invalid Date" on PostgreSQL. (#2297)
- fix: use correct column names for inactive node queries on PostgreSQL/MySQL — Fixed nullable
lastHeardcausing TypeScript null check failures. (#2282, fixes #2281) - fix: guard against local node echo processing and reboot-merge races — Prevents local node echoed NodeInfo from overwriting data or triggering false key mismatch flags. (#2278, fixes #2277)
- fix: stop broadcasting stale public key in NodeInfo exchanges — Fixed MeshMonitor broadcasting cached stale keys, causing firmware 2.7.19 to reject the node. (#2276, fixes #2275)
- fix: adjust auto-traceroute interval and expiration limits — (#2272)
- fix: preserve traceroute request node order from virtual node — (#2279)
- fix: rename Exchange User Info to Exchange Node Info — (#2280)
Features
- feat: auto delete nodes by distance — Automatically remove nodes outside a configured radius. (#2270)
- feat: direct radio links visualization with simplified map overlays — (#2268)
Dependency Updates
- better-sqlite3 12.6.2 → 12.8.0 (#2295)
- mysql2 3.19.0 → 3.20.0 (#2288)
- jsdom 28.1.0 → 29.0.0 (#2292)
- docker/build-push-action 6 → 7 (#2285)
- dorny/paths-filter 3 → 4 (#2284)
- @typescript-eslint/eslint-plugin 8.56.1 → 8.57.0 (#2294)
- @typescript-eslint/parser 8.56.1 → 8.57.0 (#2289)
- @vitest/coverage-v8 4.0.18 → 4.1.0 (#2290)
- puppeteer 24.38.0 → 24.39.1 (#2291)
- Production dependencies group update (#2287)
- Development dependencies group update (#2286)
Other
- chore: add /create-pr slash command for PR workflow (#2298)
- Translations update from Hosted Weblate (#2271)
Full Changelog: https://github.com/Yeraze/meshmonitor/compare/v3.9.4...v3.9.5
🚀 MeshMonitor v3.9.5
📦 Installation
Docker (recommended):
docker run -d \
--name meshmonitor \
-p 8080:3001 \
-v meshmonitor-data:/data \
ghcr.io/Yeraze/meshmonitor:3.9.5
🧪 Testing
✅ All tests passed
✅ TypeScript checks passed
✅ Docker images built for linux/amd64, linux/arm64, linux/arm/v7
📋 Changes
See commit history for detailed changes.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Yeraze/meshmonitor
All releases →Related context
Related tools
Earlier breaking changes
- v4.7.2 Route `destination` field now rejects non‑8‑hex nodeId or 64‑hex publicKey, returning HTTP 400.
Beta — feedback welcome: [email protected]