Skip to content

Yeraze/meshmonitor

v4.3.0 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

Published 25d Monitoring & Metrics
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

meshcore meshtastic mqtt

Affected surfaces

auth rbac

Summary

AI summary

Introduces Waypoints as a first‑class data type with UI editing and new permissions.

Full changelog

MeshMonitor v4.3.0 — Waypoints

This minor release introduces Waypoints as a first-class data type alongside nodes, messages, and telemetry. MeshMonitor now stores every WAYPOINT_APP packet per source, renders them on both the per-source dashboard map and Map Analysis using each waypoint's emoji as its icon, and lets users with the new waypoints:write permission create, edit, and delete waypoints in place from the Map Features panel — broadcasting the result back to the mesh. A daily maintenance sweep handles expiry (with expire_at = 0 correctly treated as "no expiration"), and the existing source-scoped WebSocket fan-out delivers waypoint:upserted / :deleted / :expired events in real time. Migrations 053–055 add the per-source waypoints table and seed the new waypoints:read|write permissions for every user that already had matching messages grants. Beyond Waypoints, the release adds Tile Selection / Legend visibility toggles to the Map Features panel, fixes a dashboard bug where the active tileset wasn't applied on load, corrects the channel encryption label for unencrypted and shorthand PSKs, irons out several mobile-browser interface issues, and bootstraps the very first OIDC user as an admin so SSO-only deployments can complete onboarding.

✨ Features

  • Waypoints — basic support (#2936 / #2938) — per-source waypoints table (migration 053), WAYPOINT_APP dispatch + broadcast/delete-tombstone helpers, /api/sources/:id/waypoints (GET/POST/PATCH/DELETE) gated by new waypoints:read|write permission, useWaypoints hook with WS-cache invalidation, WaypointsLayer for Map Analysis, daily expire sweep with grace window. Permission seeding via migrations 054/055 clones each user's per-source messages grants.
  • Waypoints — authoring UI (#2942) — in-place create/edit/delete on the per-source dashboard map. Map-click and right-click placement modes (crosshair cursor, ESC to cancel), emoji icon picker with VS-16 forcing, optional expiry, lock-to-self checkbox; popup actions (Edit / Delete) gated by canEdit / canDelete and suppressed for waypoints locked to other nodes. Create button lives inside the Map Features dropdown.
  • Map Features: Tile Selection + Legend visibility toggles (#2945) — adds two toggles to the Map Features panel that hide the bottom-center tileset picker and the SNR legend, persisted per-user.

🐛 Bug Fixes

  • fix: map tileset selection not applying on dashboard (#2948)
  • fix(mobile): mobile browser interface fixes (#2946 / #2940)
  • fix: correct channel encryption label for unencrypted and shorthand PSKs (#2944 / #2939)
  • fix(auth): bootstrap first OIDC user as admin (#2937 / #2749)

📚 Documentation

  • New Waypoints feature page in the docs site, plus a Waypoints sub-section in the Maps overview. Version-Highlights nav sections were retired and their pages folded into the regular Features sidebar.
  • docs: add Canadaverse Mesh to the Site Gallery (#2943)

⚙️ Release

  • chore(release): bump version to 4.3.0 (#2949)

⚠️ Known follow-ups

  • Waypoint rebroadcast scheduler is not yet wired. The rebroadcast_interval_s column is persisted and accepted by the API, but no timer fires it — owned waypoints are broadcast once on save. Tracked under #2936.
  • Automation hooks for the waypoint message type are not yet available — Auto-Responders and Geofence Triggers do not currently match on waypoint events.

Full Changelog

https://github.com/Yeraze/meshmonitor/compare/v4.2.3...v4.3.0

🚀 MeshMonitor v4.3.0

📦 Installation

Docker (recommended):

docker run -d \
  --name meshmonitor \
  -p 8080:3001 \
  -v meshmonitor-data:/data \
  ghcr.io/Yeraze/meshmonitor:4.3.0

🧪 Testing

✅ All tests passed
✅ TypeScript checks passed
✅ Docker images built for linux/amd64, linux/arm64, linux/arm/v7

📋 Changes

See commit history for detailed changes.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Yeraze/meshmonitor

Get notified when new releases ship.

Sign up free

About Yeraze/meshmonitor

All releases →

Related context

Earlier breaking changes

  • v4.7.2 Route `destination` field now rejects non‑8‑hex nodeId or 64‑hex publicKey, returning HTTP 400.

Beta — feedback welcome: [email protected]