This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
Affected surfaces
Summary
AI summaryIntroduces Waypoints as a first‑class data type with UI editing and new permissions.
Full changelog
MeshMonitor v4.3.0 — Waypoints
This minor release introduces Waypoints as a first-class data type alongside nodes, messages, and telemetry. MeshMonitor now stores every WAYPOINT_APP packet per source, renders them on both the per-source dashboard map and Map Analysis using each waypoint's emoji as its icon, and lets users with the new waypoints:write permission create, edit, and delete waypoints in place from the Map Features panel — broadcasting the result back to the mesh. A daily maintenance sweep handles expiry (with expire_at = 0 correctly treated as "no expiration"), and the existing source-scoped WebSocket fan-out delivers waypoint:upserted / :deleted / :expired events in real time. Migrations 053–055 add the per-source waypoints table and seed the new waypoints:read|write permissions for every user that already had matching messages grants. Beyond Waypoints, the release adds Tile Selection / Legend visibility toggles to the Map Features panel, fixes a dashboard bug where the active tileset wasn't applied on load, corrects the channel encryption label for unencrypted and shorthand PSKs, irons out several mobile-browser interface issues, and bootstraps the very first OIDC user as an admin so SSO-only deployments can complete onboarding.
✨ Features
- Waypoints — basic support (#2936 / #2938) — per-source
waypointstable (migration 053),WAYPOINT_APPdispatch + broadcast/delete-tombstone helpers,/api/sources/:id/waypoints(GET/POST/PATCH/DELETE) gated by newwaypoints:read|writepermission,useWaypointshook with WS-cache invalidation,WaypointsLayerfor Map Analysis, daily expire sweep with grace window. Permission seeding via migrations 054/055 clones each user's per-sourcemessagesgrants. - Waypoints — authoring UI (#2942) — in-place create/edit/delete on the per-source dashboard map. Map-click and right-click placement modes (crosshair cursor, ESC to cancel), emoji icon picker with VS-16 forcing, optional expiry, lock-to-self checkbox; popup actions (Edit / Delete) gated by
canEdit/canDeleteand suppressed for waypoints locked to other nodes. Create button lives inside the Map Features dropdown. - Map Features: Tile Selection + Legend visibility toggles (#2945) — adds two toggles to the Map Features panel that hide the bottom-center tileset picker and the SNR legend, persisted per-user.
🐛 Bug Fixes
- fix: map tileset selection not applying on dashboard (#2948)
- fix(mobile): mobile browser interface fixes (#2946 / #2940)
- fix: correct channel encryption label for unencrypted and shorthand PSKs (#2944 / #2939)
- fix(auth): bootstrap first OIDC user as admin (#2937 / #2749)
📚 Documentation
- New Waypoints feature page in the docs site, plus a Waypoints sub-section in the Maps overview. Version-Highlights nav sections were retired and their pages folded into the regular Features sidebar.
- docs: add Canadaverse Mesh to the Site Gallery (#2943)
⚙️ Release
- chore(release): bump version to 4.3.0 (#2949)
⚠️ Known follow-ups
- Waypoint rebroadcast scheduler is not yet wired. The
rebroadcast_interval_scolumn is persisted and accepted by the API, but no timer fires it — owned waypoints are broadcast once on save. Tracked under #2936. - Automation hooks for the waypoint message type are not yet available — Auto-Responders and Geofence Triggers do not currently match on waypoint events.
Full Changelog
https://github.com/Yeraze/meshmonitor/compare/v4.2.3...v4.3.0
🚀 MeshMonitor v4.3.0
📦 Installation
Docker (recommended):
docker run -d \
--name meshmonitor \
-p 8080:3001 \
-v meshmonitor-data:/data \
ghcr.io/Yeraze/meshmonitor:4.3.0
🧪 Testing
✅ All tests passed
✅ TypeScript checks passed
✅ Docker images built for linux/amd64, linux/arm64, linux/arm/v7
📋 Changes
See commit history for detailed changes.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Yeraze/meshmonitor
All releases →Related context
Related tools
Earlier breaking changes
- v4.7.2 Route `destination` field now rejects non‑8‑hex nodeId or 64‑hex publicKey, returning HTTP 400.
Beta — feedback welcome: [email protected]