This release includes 3 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
Affected surfaces
ReleasePort's take
Light signalMeshCore is now a first‑class source in the MeshMonitor dashboard and gains per‑source management without container restarts.
Why it matters: Per-source managers let operators control each device individually, eliminating global permission scope; no code changes are required for existing deployments.
Summary
AI summaryMeshCore graduates to a first-class source with per-source management and telemetry.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
MeshCore graduates to first-class source in MeshMonitor dashboard sidebar. MeshCore graduates to first-class source in MeshMonitor dashboard sidebar. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Per-source MeshCore managers added; each device is its own source row with no container restart required. Per-source MeshCore managers added; each device is its own source row with no container restart required. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Unified dashboard map enumerates every MeshCore source and renders contacts with valid coordinates. Unified dashboard map enumerates every MeshCore source and renders contacts with valid coordinates. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Multi-pane redesign of MeshCore page includes Nodes, Channels, Direct Messages, Configuration, Node Info tabs. Multi-pane redesign of MeshCore page includes Nodes, Channels, Direct Messages, Configuration, Node Info tabs. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Contact-detail panel shows hops, RSSI/SNR, last heard, position, full public key for each DM thread. Contact-detail panel shows hops, RSSI/SNR, last heard, position, full public key for each DM thread. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
UI permission gating dims and explains write controls for read-only users on MeshCore page. UI permission gating dims and explains write controls for read-only users on MeshCore page. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
MeshCore has expanded per-source permissions replacing legacy global meshcore permission. MeshCore has expanded per-source permissions replacing legacy global meshcore permission. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Local-node telemetry poller samples core/radio/packets, GetDeviceTime, DeviceQuery every 5 minutes (configurable). Local-node telemetry poller samples core/radio/packets, GetDeviceTime, DeviceQuery every 5 minutes (configurable). Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Node Info page graphs telemetry across 1h / 6h / 24h / 3d / 7d ranges. Node Info page graphs telemetry across 1h / 6h / 24h / 3d / 7d ranges. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Telemetry-mode toggles allow device-side base / loc / env classes from Configuration view. Telemetry-mode toggles allow device-side base / loc / env classes from Configuration view. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Per-node remote telemetry retrieval scheduled with per-node interval, gated by 60‑second cross‑mesh throttle. Per-node remote telemetry retrieval scheduled with per-node interval, gated by 60‑second cross‑mesh throttle. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Radio preset selector uses official MeshCore presets with Custom fallback in Configuration view. Radio preset selector uses official MeshCore presets with Custom fallback in Configuration view. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Persistent radio parameters; bridge propagates device-side errors instead of silent success. Persistent radio parameters; bridge propagates device-side errors instead of silent success. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Staged edits no longer revert during live push updates in Configuration view. Staged edits no longer revert during live push updates in Configuration view. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Location configuration and advert-location policy added. Location configuration and advert-location policy added. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Channel-message senders extracted from "Name: body" prefix and shown separately in UI. Channel-message senders extracted from "Name: body" prefix and shown separately in UI. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Expanded per-source permissions replace legacy global meshcore permission, using the sourcey set (connection, configuration, nodes, messages). Expanded per-source permissions replace legacy global meshcore permission, using the sourcey set (connection, configuration, nodes, messages). Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
Full changelog
MeshCore graduates from "experimental tab" to first-class source in MeshMonitor. It sits in the dashboard sidebar next to your Meshtastic nodes, has its own per-source permissions, its own multi-pane page, its own telemetry pipeline, and contributes contacts to the unified dashboard map. The 4.5 UI source-add flow is USB-only for MeshCore (Companion or Repeater); TCP-connected companions still work via the legacy env-var bootstrap path.
Source model
- Per-source MeshCore managers — each MeshCore device is its own source row, manageable from the Sources sidebar with no container restart (#3005, #3014)
- Permissions, expanded — the legacy global
+ "meshcore" +permission is gone; migration 058 expanded every grant into the per-source sourcey set (connection, configuration, nodes, messages) - Composite primary key on
+ "meshcore_nodes" +(sourceId, publicKey) — same device under two sources is tracked independently (#3023)
Dashboard + map
- Styled source cards matching the Meshtastic visual vocabulary (#3016)
- Unified dashboard map enumerates every MeshCore source and renders contacts with valid coordinates (#3015)
MeshCore page
- Multi-pane redesign — Nodes / Channels / Direct Messages / Configuration / Node Info (#3005)
- Contact-detail panel below each DM thread — hops, RSSI/SNR, last heard, position, full public key (#3017)
- UI permission gating — write controls dim and explain themselves for read-only users (#3019)
- Visual alignment with Meshtastic Info / Channels / Nodes rows (#3021)
Telemetry
- Local-node telemetry — background poller samples
+ "GetStats core/radio/packets" +,+ "GetDeviceTime" +,+ "DeviceQuery" +every 5 minutes (configurable, on-device, no RF) writing batched+ "mc_*" +rows into the shared telemetry table (#3020) - Node Info page graphing across 1h / 6h / 24h / 3d / 7d ranges
- Telemetry-mode toggles — device-side base / loc / env classes from the Configuration view (#3018)
- Per-node remote telemetry retrieval — scheduled
+ "req_telemetry_sync" +pulls with a per-node interval, gated by a shared 60-second cross-mesh throttle, with decoded LPP values written into the telemetry store (#3022)
Configuration
- Radio preset selector from the official MeshCore preset list, with a Custom fallback (#3015)
- Persistent radio params — bridge propagates device-side errors instead of silently returning success
- Staged edits no longer revert during live push updates
- Location configuration + advert-location policy
- Channel-message senders extracted from the
+ ""Name: body"" +prefix and shown separately
Still Early
MeshCore in MeshMonitor remains new and basic. Known gaps:
- Repeater / Room Server parity trails Companion — local-telemetry poller, remote-telemetry scheduler, and telemetry-mode toggles all need a Companion on the source side
- TCP MeshCore via the UI isn't shipped — TCP companions are env-var bootstrap only in 4.5
- No MeshCore remote-admin equivalent
- No scheduler integrations for auto-responder / auto-announce / auto-traceroute (primitives wired, user-facing features next)
- Minimal MeshCore notifications — apprise and push aren't first-class
- No MeshCore-specific map affordances yet
- MQTT source type still planned
The plan is incremental — one or two MeshCore features per release, keep aligning the UI vocabulary with Meshtastic, gradually close the parity gap.
📖 Updated MeshCore docs · 📝 Full 4.5 blog post
🚀 MeshMonitor v4.5.0
📦 Installation
Docker (recommended):
docker run -d \
--name meshmonitor \
-p 8080:3001 \
-v meshmonitor-data:/data \
ghcr.io/Yeraze/meshmonitor:4.5.0
🧪 Testing
✅ All tests passed
✅ TypeScript checks passed
✅ Docker images built for linux/amd64, linux/arm64, linux/arm/v7
📋 Changes
See commit history for detailed changes.
Breaking Changes
- Removed global `meshcore` permission; all grants migrated to per-source `sourcey` permissions (connection, configuration, nodes, messages).
- Composite primary key `(sourceId, publicKey)` added to `meshcore_nodes` table.
- UI source‑add flow for MeshCore is USB‑only; TCP-connected companions must use legacy env‑var bootstrap.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Yeraze/meshmonitor
All releases →Related context
Related tools
Earlier breaking changes
- v4.7.2 Route `destination` field now rejects non‑8‑hex nodeId or 64‑hex publicKey, returning HTTP 400.
Beta — feedback welcome: [email protected]