This release includes 2 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
Affected surfaces
Summary
AI summaryMeshMonitor 4.0 introduces multi-source support with per‑source permissions and UI configuration.
Full changelog
MeshMonitor v4.0.0 — Multi-Source
This is the general availability release of MeshMonitor 4.0. The 4.0 line introduces Multi-Source support — a single MeshMonitor instance can now connect to multiple Meshtastic nodes simultaneously, each with its own Virtual Node, auto-responder, scheduler, and per-source permission matrix. 4.0 ships extensive schema migrations, a reorganized permission model, and removes several environment variables (including the Virtual Node env vars) in favor of per-source UI configuration. Since v4.0.0-beta14, this release rolls up two stabilization bug fixes, dev compose cleanup, dependency bumps, and the version bump to GA.
Action Required After Upgrade
- Permissions — The permission matrix is now per-source. Open Settings → Users and verify each user's access on every source transferred over correctly. See Per-Source Permissions.
- Automation — Auto-responder, AutoTraceroute, Auto Favorite, Auto-Ping, Auto-Acknowledge, geofences, and other automation settings are now per-source. Open the Automation tab on each source and confirm everything migrated as expected.
- Configuration — Several environment variables (including Virtual Node env vars) are removed; per-source settings now live in the UI. See Multi-Source.
- Back up your
/datavolume before upgrading.
Bug Fixes
- Stabilize Unified source node count when selected source changes (#2806, closes #2805)
- Clear
packet_logwhen purging all nodes (#2807, closes #2637)
CI / Dev
- Drop stale
RATE_LIMIT_*compose overrides (#2808) - Cut 4.0.0 release commit (#2819)
Dependencies
Production
- Production dependencies group — 7 updates (#2810)
express-rate-limit8.3.2 → 8.4.1 (#2813)maplibre-gl5.23.0 → 5.24.0 (#2814)lucide-react1.8.0 → 1.11.0 (#2816)
Development
vitest4.1.4 → 4.1.5 (#2809)jsdom29.0.2 → 29.1.0 (#2811)puppeteer24.41.0 → 24.42.0 (#2812)@tanstack/react-query-devtools5.99.2 → 5.100.5 (#2815)@typescript-eslint/parser8.58.2 → 8.59.0 (#2818)
Issues Resolved
- #2805 — [BUG] Unified source node count changes incorrectly based on selected source
- #2787 — [FEAT] separate node database for different frequency/modulation
- #2637 — [BUG] nodes not fully deleted
Need Help?
- Visit meshmonitor.org for the full 4.0 documentation and migration guide
- Submit bugs at github.com/Yeraze/meshmonitor/issues
- Join our Discord to discuss any issues you find
Full Changelog: https://github.com/Yeraze/meshmonitor/compare/v4.0.0-beta14...v4.0.0
🚀 MeshMonitor v4.0.0
📦 Installation
Docker (recommended):
docker run -d \
--name meshmonitor \
-p 8080:3001 \
-v meshmonitor-data:/data \
ghcr.io/yeraze/meshmonitor:4.0.0
🧪 Testing
✅ All tests passed
✅ TypeScript checks passed
✅ Docker images built for linux/amd64, linux/arm64, linux/arm/v7
📋 Changes
See commit history for detailed changes.
Breaking Changes
- Removed environment variables for Virtual Node configuration; per‑source settings now managed via UI.
- Permission matrix changed to be per‑source, requiring verification in Settings → Users.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Yeraze/meshmonitor
All releases →Related context
Related tools
Earlier breaking changes
- v4.7.2 Route `destination` field now rejects non‑8‑hex nodeId or 64‑hex publicKey, returning HTTP 400.
Beta — feedback welcome: [email protected]