Skip to content

Yeraze/meshmonitor

v4.13.1 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

Published 6d Monitoring & Metrics
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

meshcore meshtastic mqtt

Summary

AI summary

Broad release touches Map Analysis, Messages, Nodes & Automation, Configuration, Infrastructure & Security, and MQTT.

Full changelog

MeshMonitor v4.13.1

Building on 4.13's unified map core, this release adds a suite of Link Quality tools for the RF-minded, an early preview of several Meshtastic 2.8 features, and a broad round of map, MQTT, and messaging fixes.

Highlights: a Terrain Link Profile tool (elevation cross-section, Fresnel zone, and link-budget verdict) on Map Analysis; a per-node signal-trend / link-attenuation badge; Noise Floor on the Node Detail card; and position accuracy + location source surfaced in node popups. The Map Analysis toolbar is now icon-based with Show RF / UDP / MQTT transport toggles, and obscured markers offset intelligently by cell occupancy. On the 2.8 front (an early preview — 2.8 is not officially released yet, so this is built against the firmware development branch and is subject to change), MeshMonitor now decodes the XEdDSA signing shield, MeshBeacon packets, and the MEDIUM_TURBO preset. Also notable: telemetry requests now auto-recover from an upstream firmware NeighborInfo-hijack, a new noindex/robots.txt privacy toggle, and a gateway-aware MQTT Packet Monitor.

See the release blog post for the narrative walkthrough.

Link Quality & Terrain Link Profile

  • Terrain Link Profile tool: elevation cross-section + Fresnel zone + link-budget verdict, auto-frequency by region, DEM-void handling, map-mirrored graph cursor (#4143, #4147, #4151, #4170, #4156)
  • Derived signal-trend / link-attenuation badge per node (#4204)
  • Noise Floor on the Node Detail quick-stats card (#4201)
  • Position accuracy + location source in node popups, map & chat (#4188)
  • Latitude/longitude/elevation shown as text in Node Info / Node Details (#4134)

Map Analysis

  • Icon-based toolbar with labels in tooltips (#4171)
  • Show RF / UDP / MQTT transport toggles (#4135)
  • Occupancy-scaled, distance-capped obscured-node precision offset (#4164, #4168, #4181)
  • "Discard invalid positions" setting, honored on ingest and render (#4158, #4182)
  • Per-theme (light/dark) tileset preferences (#4118)
  • Keep router short-name visible in Official pin style (#4184)
  • Honor Default Map Center on Unified/Dashboard maps (#4128)
  • Fixes: spiderfy opens the correct node (#4203), SNR overlay pins to merged marker (#4169), no route/heatmap render for marker-less or deleted nodes (#4167, #4175)

Meshtastic 2.8 — Early Preview

⚠️ Meshtastic 2.8 is not officially released. This support is built against the firmware development branch and is subject to change as 2.8 evolves.

  • Pin 2.8-preview protobufs (develop@ba16bfc) with a 2.7 TrafficManagement compat shim (#4205)
  • XEdDSA packet-signing shield in the Packet Monitor (#4209)
  • MeshBeacon (MESH_BEACON_APP) decode + firmware-verified preset channel names (#4207)
  • MEDIUM_TURBO modem preset + 2.8 opt-in FAQ (#4200)

MQTT

  • Gateway-aware MQTT Packet Monitor — per-gateway reception capture + UI (#4127, #4138)
  • Geo-ignore epic: fail-open geo filter, per-source ignore list, retroactive purge/sweep, observability (#4123, #4131, #4132, #4136)
  • Route directed MQTT messages to the DM view, not their channel (#4161)
  • Guard MQTT POSITION ingestion against Null Island fixes (#4150)

Messages, Nodes & Automation

  • Auto-retry telemetry requests hijacked by the firmware NeighborInfo behavior (#4214)
  • Stop unsynced-clock nodes rendering chat at ~1970 (#4208)
  • MeshCore own-node messages show name, not public key (#4197)
  • Short name shown alongside long name on message senders (#4196)
  • "Message anyway" override for unmessageable nodes (#4187), and clearer hidden-composer messaging (#4140)
  • Remote-admin (non-local) reboot target for the device-reboot automation (#4186)
  • Compose draft scoped per-conversation (#4185)
  • Reliably un-hide nodes from the map across sources (#4141)
  • Traceroute no longer sends on a DISABLED channel slot (#4180)
  • Reject precision-obscured Null Island fixes on ingest (#4149)

Configuration, Infrastructure & Security

  • New privacy toggle: X-Robots-Tag: noindex + disallow-all robots.txt (#4212)
  • Case-insensitive TRUST_PROXY and boolean env-var parsing (#4218, #4219)
  • Don't abort startup when the S4 fallback Meshtastic connect fails (#4146)
  • Migration 122 MySQL 8 collation fix (#4145); Mqtt/→MQTT/ case-collision build fix (#4144)
  • Meshview Link Responder added to the User Scripts gallery (#4179)

Dependencies & CI

  • actions/setup-node and setup-python 6→7, and a batch of npm patch/minor updates
  • Dependabot now ignores TypeScript major bumps (TS7 tooling gap); dropped the unused pbf direct dep
  • Node-24 coverage hang no longer blocks merges (#4172)

Issues Resolved

Closes #4210, #4216, #4206, #4202, #4199, #4194, #4193, #4183, #4177, #4176, #4173, #4166, #4163, #4162, #4157, #4155, #4154, #4153, #4152, #4148, #4139, #4137, #4130, #4129, #4126, #4125, #4124, #4115, #4111, #4110, #4109, #4096, #4074, #3999, #3547.

Full changelog: https://github.com/Yeraze/meshmonitor/compare/v4.13.0...v4.13.1

🚀 MeshMonitor v4.13.1

📦 Installation

Docker (recommended):

docker run -d \
  --name meshmonitor \
  -p 8080:3001 \
  -v meshmonitor-data:/data \
  ghcr.io/Yeraze/meshmonitor:4.13.1

🧪 Testing

✅ All tests passed
✅ TypeScript checks passed
✅ Docker images built for linux/amd64, linux/arm64, linux/arm/v7

📋 Changes

See commit history for detailed changes.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Yeraze/meshmonitor

Get notified when new releases ship.

Sign up free

About Yeraze/meshmonitor

All releases →

Related context

Earlier breaking changes

  • v4.13.0 Source‑scoped API endpoints now require an explicit `sourceId` parameter.
  • v4.13.0 Auto-Upgrade is retired; remove upgrade sidecar and related config.
  • v4.7.2 Route `destination` field now rejects non‑8‑hex nodeId or 64‑hex publicKey, returning HTTP 400.

Beta — feedback welcome: [email protected]