This release includes 2 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
ReleasePort's take
Moderate signalMeshCore now runs natively in JavaScript, eliminating the Python sidecar and reducing startup time and memory usage.
Why it matters: Running MeshCore in‑process JavaScript cuts startup latency and memory footprint versus the prior Python bridge.
Summary
AI summaryNative JavaScript MeshCore backend replaces the Python sidecar and adds TCP transport support from the UI.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
MeshCore TCP transport from the UI added via Sources sidebar. MeshCore TCP transport from the UI added via Sources sidebar. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Native JavaScript MeshCore backend implemented using meshcore.js. Native JavaScript MeshCore backend implemented using meshcore.js. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
MeshCore TCP transport documentation added to MeshCore feature page. MeshCore TCP transport documentation added to MeshCore feature page. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Performance | Medium |
Startup time, memory footprint reduced by running MeshCore in‑process JavaScript instead of Python bridge. Startup time, memory footprint reduced by running MeshCore in‑process JavaScript instead of Python bridge. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Deprecation | Medium |
Python bridge and 3.x addon removed; only native JS backend remains. Python bridge and 3.x addon removed; only native JS backend remains. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
NeighborInfo links now persist when neighbor row has NULL lastHeard but fresh NI report. NeighborInfo links now persist when neighbor row has NULL lastHeard but fresh NI report. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Refactor | Medium |
MeshCore subsystem simplified to single Node process, removing Python sidecar and cross-process serialization. MeshCore subsystem simplified to single Node process, removing Python sidecar and cross-process serialization. Source: llm_adapter@2026-05-21 Confidence: high |
— |
Full changelog
MeshMonitor v4.5.1 — MeshCore TCP Support
A focused follow-up to v4.5.0 — MeshCore Levels Up, closing the last two big gaps called out in the 4.5 announcement: TCP transport for MeshCore Companions from the UI, and a native JavaScript MeshCore backend that replaces the Python bridge entirely. TCP-attached Companions (esp-link, ser2net, or native TCP firmware) are now added through the same Sources sidebar flow as everything else — no env-var bootstrap, no container restart. The new in-process meshcore.js integration removes the Python sidecar from the container, cutting startup time, memory footprint, and a whole class of cross-process serialization bugs. Two small bugs from 4.5 are also fixed: a MeshCore TCP source that wouldn't appear in the source list and a Meshtastic NeighborInfo link that disappeared when the neighbor row had a NULL lastHeard despite a fresh NI report.
✨ Features
- #3027 — MeshCore TCP transport from the UI. The Sources sidebar now offers USB and TCP for MeshCore Companions (default port
4403); works with esp-link, ser2net, or any native TCP-capable MeshCore firmware. Closes #3028. - #3029 — Native JavaScript MeshCore backend. Initial port of the MeshCore protocol layer onto
meshcore.js, running in-process inside the Node server. - #3031 — Python bridge and 3.x addon removed. The native JS backend is now the only path; the Python sidecar process, its requirements, and the legacy 3.x firmware addon are gone.
🐛 Bug Fixes
- #3026 — NeighborInfo links survive NULL
lastHeard. When a neighbor row has nolastHeardbut the NeighborInfo report itself is fresh, the link is now kept in the topology view instead of being filtered out. Closes #3025.
📝 Documentation
- #3032 — MeshCore TCP transport documentation added to the MeshCore feature page, covering host/port form fields, common deployment patterns (native TCP firmware /
ser2net/esp-link), container-networking guidance, and updated USB-vs-TCP troubleshooting.
🧹 Architecture
The MeshCore subsystem is now considerably simpler:
- One process — the entire MeshCore stack (companion protocol, channel/contact state, telemetry collection) runs inside the Node server. No more Python sidecar to coordinate with, no more cross-process JSON shuttling.
- Two transports for Companions — USB serial and TCP, both wired through the same per-source manager registry that handles Meshtastic sources. Hot connect/disconnect, source create/update/delete, no container restart for any of it.
- Repeater path unchanged — Repeater is still USB-only and still uses the direct-serial text CLI path.
⬆️ Upgrade Notes
- No migrations. Database schema is unchanged from 4.5.0.
- Python is no longer required. If you maintain a custom image or compose override that mounted Python deps for the MeshCore bridge, you can drop them.
- MeshCore env-var bootstrap stays removed. The
MESHCORE_*env vars that 3.x used were already gone in 4.5.0; configure MeshCore sources from the Sources sidebar.
Issues Resolved
- #3028 — TCP/WiFi MeshCore source not showing in source list
- #3025 — Meshtastic NeighborInfo response received but not shown in UI
Full Changelog
https://github.com/Yeraze/meshmonitor/compare/v4.5.0...v4.5.1
🚀 MeshMonitor v4.5.1
📦 Installation
Docker (recommended):
docker run -d \
--name meshmonitor \
-p 8080:3001 \
-v meshmonitor-data:/data \
ghcr.io/Yeraze/meshmonitor:4.5.1
🧪 Testing
✅ All tests passed
✅ TypeScript checks passed
✅ Docker images built for linux/amd64, linux/arm64, linux/arm/v7
📋 Changes
See commit history for detailed changes.
Breaking Changes
- Python sidecar and associated requirements removed; native JavaScript backend (`meshcore.js`) is now the sole implementation.
- Env‑var bootstrap (`MESHCORE_*`) for MeshCore sources discontinued.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Yeraze/meshmonitor
All releases →Related context
Related tools
Earlier breaking changes
- v4.7.2 Route `destination` field now rejects non‑8‑hex nodeId or 64‑hex publicKey, returning HTTP 400.
Beta — feedback welcome: [email protected]