Skip to content

Yeraze/meshmonitor

v4.10.2 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

Published 1mo Monitoring & Metrics
βœ“ No known CVEs patched
Read the diff β†’ Tool health β†’ What is this tool? β†’

✓ No known CVEs patched in this version

Topics

meshcore meshtastic mqtt

Affected surfaces

auth

ReleasePort's take

Light signal
editorial:auto 1mo

MeshMonitor v4.10.2 introduces server‑side PKI direct‑message decryption (off by default) and adds a configurable pre‑send delay to Auto Welcome.

Why it matters: The new PKI decryption feature enhances security for cross‑source messaging when enabled, while the configurable delay prevents Auto Welcome failures after nodeDB resets.

Summary

AI summary

Updates Bug Fixes, Dependencies / i18n, and πŸš€ MeshMonitor v4.10.2 across a mixed release.

Changes in this release

Feature Low

Adds server-side PKI direct-message decryption across sources (off by default).

Adds server-side PKI direct-message decryption across sources (off by default).

Source: llm_adapter@2026-06-14

Confidence: high

β€”
Feature Low

Integrates MeshCore channel/DM traffic into Unified Messages with per-channel backlogs.

Integrates MeshCore channel/DM traffic into Unified Messages with per-channel backlogs.

Source: llm_adapter@2026-06-14

Confidence: high

β€”
Feature Low

Allows user scripts to declare and install Python/Node package dependencies via admin panel.

Allows user scripts to declare and install Python/Node package dependencies via admin panel.

Source: llm_adapter@2026-06-14

Confidence: high

β€”
Feature Low

Renders MeshCore Traffic Management telemetry as labelled graphs for firmware v2.7.22+.

Renders MeshCore Traffic Management telemetry as labelled graphs for firmware v2.7.22+.

Source: llm_adapter@2026-06-14

Confidence: high

β€”
Feature Low

Adds "maximum age" slider control in Map Features panel.

Adds "maximum age" slider control in Map Features panel.

Source: llm_adapter@2026-06-14

Confidence: high

β€”
Feature Low

Introduces optional Gateway API HTTPRoute in Helm chart.

Introduces optional Gateway API HTTPRoute in Helm chart.

Source: llm_adapter@2026-06-14

Confidence: high

β€”
Feature Low

Publishes MeshMonitor Helm chart repository at meshmonitor.org/charts.

Publishes MeshMonitor Helm chart repository at meshmonitor.org/charts.

Source: llm_adapter@2026-06-14

Confidence: high

β€”
Bugfix Medium

Adds configurable pre‑send delay to Auto Welcome to survive nodeDB resets.

Adds configurable pre‑send delay to Auto Welcome to survive nodeDB resets.

Source: llm_adapter@2026-06-14

Confidence: high

β€”
Bugfix Medium

Enables removal of MeshCore contacts with malformed or short public keys.

Enables removal of MeshCore contacts with malformed or short public keys.

Source: llm_adapter@2026-06-14

Confidence: high

β€”
Bugfix Low

Stabilizes telemetry graph order to prevent reshuffling on updates.

Stabilizes telemetry graph order to prevent reshuffling on updates.

Source: llm_adapter@2026-06-14

Confidence: high

β€”
Full changelog

MeshMonitor v4.10.2

MeshMonitor v4.10.2 is a feature-rich point release centered on cross-source messaging and extensibility. It adds server-side PKI direct-message decryption so DMs relayed still-encrypted through MQTT can be aggregated into the unified view, and brings MeshCore channel/DM traffic into Unified Messages while fixing a long-standing ~50-message-per-source cap with per-channel backlogs. User scripts can now declare and install Python/Node package dependencies. Meshtastic Traffic Management telemetry (firmware v2.7.22+) now renders as labelled graphs. Auto Welcome gained a configurable pre-send delay so first-contact welcomes survive a nodeDB reset, and malformed-key MeshCore contacts can finally be removed. The Map Features panel gained a "maximum age" slider, and the Helm chart now publishes a proper chart repository plus an optional Gateway API HTTPRoute. Rounding things out are a stable telemetry-graph order and an embed-map popup-padding fix.

Features

  • PKI direct-message decryption across sources (#3445) β€” decrypt PKI DMs server-side (incl. MQTT-relayed) and surface them in Unified Messages; off by default behind a global + per-source opt-in, keys encrypted at rest.
  • MeshCore in Unified Messages + per-channel backlog (#3442) β€” MeshCore channels/DMs join the cross-source feed; each channel loads its own history.
  • User-script Python/Node dependencies (#3448) β€” declare via requirements.txt/package.json, install from an admin panel; persisted next to scripts.
  • Traffic Management telemetry graphs (#3447) β€” the firmware module's stats now render as labelled, integer series.
  • Map Features "maximum age" slider (#3435).
  • Helm: optional Gateway API HTTPRoute (#3434).
  • Helm: published chart repository at meshmonitor.org/charts (#3433).

Bug Fixes

  • Auto Welcome pre-send delay β€” fixes DM failures on first contact after a nodeDB reset (#3440).
  • Remove MeshCore contacts with malformed/short public keys (#3444).
  • Stable telemetry graph order β€” graphs no longer reshuffle on every update (#3437).
  • Embed map GeoJSON popup padding restored in dark theme (#3430).

Docs / CI

  • Correct mislabeled #3441 β†’ #3442 references in the MeshCore changelog/comments (#3446).

Dependencies / i18n

  • Translations update from Hosted Weblate (#3427).

Issues Resolved

#3441, #3443, #3439, #3436, #3432, #3431, #3429

Upgrade Notes

No breaking changes. PKI direct-message decryption is off by default β€” it requires a configured SESSION_SECRET plus a global (Settings β†’ Security) and per-source opt-in. Installing script dependencies is admin-gated and runs third-party code.

Full changelog: https://github.com/Yeraze/meshmonitor/compare/v4.10.1...v4.10.2

πŸš€ MeshMonitor v4.10.2

πŸ“¦ Installation

Docker (recommended):

docker run -d \
  --name meshmonitor \
  -p 8080:3001 \
  -v meshmonitor-data:/data \
  ghcr.io/Yeraze/meshmonitor:4.10.2

πŸ§ͺ Testing

βœ… All tests passed
βœ… TypeScript checks passed
βœ… Docker images built for linux/amd64, linux/arm64, linux/arm/v7

πŸ“‹ Changes

See commit history for detailed changes.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Yeraze/meshmonitor

Get notified when new releases ship.

Sign up free

About Yeraze/meshmonitor

All releases β†’

Related context

Earlier breaking changes

  • v4.13.0 Source‑scoped API endpoints now require an explicit `sourceId` parameter.
  • v4.13.0 Auto-Upgrade is retired; remove upgrade sidecar and related config.
  • v4.7.2 Route `destination` field now rejects non‑8‑hex nodeId or 64‑hex publicKey, returning HTTPβ€―400.

Beta — feedback welcome: [email protected]