This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
ReleasePort's take
Light signalMeshCore now supports full channel CRUD via MeshCoreManager and a dedicated UI section for create/edit/delete actions with secret handling.
Why it matters: Enables operators to manage MeshCore channels directly from the UI, improving control over network topology without backend changes; no migration required for existing channels.
Summary
AI summaryEnd‑to‑end MeshCore channel management with CRUD UI and per‑node position precision fixes.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
MeshCore channel CRUD + connect-time sync (phase 1/3). MeshCoreManager exposes listChannels, setChannel, deleteChannel; mirrors device's channel list into shared channels table on every connect. MeshCore channel CRUD + connect-time sync (phase 1/3). MeshCoreManager exposes listChannels, setChannel, deleteChannel; mirrors device's channel list into shared channels table on every connect. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Display device channels in MeshCoreChannelsView (phase 2/3). One tab per device-reported channel, per-channel filter for received and locally-sent messages. Display device channels in MeshCoreChannelsView (phase 2/3). One tab per device-reported channel, per-channel filter for received and locally-sent messages. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Channel create / edit / delete UI (phase 3/3). New MeshCoreChannelsConfigSection adds, edits, regenerates AES-128 secret, or deletes channels; secrets shown as masked hex with show/copy toggles. Channel create / edit / delete UI (phase 3/3). New MeshCoreChannelsConfigSection adds, edits, regenerates AES-128 secret, or deletes channels; secrets shown as masked hex with show/copy toggles. Source: granite4.1:30b@2026-05-22-audit Confidence: high |
— |
| Feature | Medium |
Channel create / edit / delete UI (phase 3/3). New MeshCoreChannelsConfigSection mounts inside MeshCoreConfigurationView; add, edit, regenerate-secret, delete channels with hex secret display. Channel create / edit / delete UI (phase 3/3). New MeshCoreChannelsConfigSection mounts inside MeshCoreConfigurationView; add, edit, regenerate-secret, delete channels with hex secret display. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Changelog links now open in a new tab to prevent page unload on click. Changelog links now open in a new tab to prevent page unload on click. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Dependency | Medium |
Docker image built for linux/amd64, linux/arm64, linux/arm/v7; no migrations required for existing channels table. Docker image built for linux/amd64, linux/arm64, linux/arm/v7; no migrations required for existing channels table. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Per-node position precision boxes now use each sending node's own precision_bits instead of local node's setting. Per-node position precision boxes now use each sending node's own precision_bits instead of local node's setting. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Filters out empty slots so firmware's MAX_CHANNELS (typically 40) don't leak placeholder rows into the UI; auto-cleans leaked rows after upgrade. Filters out empty slots so firmware's MAX_CHANNELS (typically 40) don't leak placeholder rows into the UI; auto-cleans leaked rows after upgrade. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
DM-view sidebar excludes channel pseudo-pubkeys and locally-connected node from display. DM-view sidebar excludes channel pseudo-pubkeys and locally-connected node from display. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Route layer now retrieves MeshCore manager from correct `meshcoreManagerRegistry`, fixing "mcManager.setChannel is not a function" errors. Route layer now retrieves MeshCore manager from correct `meshcoreManagerRegistry`, fixing "mcManager.setChannel is not a function" errors. Source: granite4.1:30b@2026-05-22-audit Confidence: high |
— |
| Bugfix | Medium |
Route layer now talks to correct MeshCore manager registry instead of silent Meshtastic fallback, fixing mcManager.setChannel errors. Route layer now talks to correct MeshCore manager registry instead of silent Meshtastic fallback, fixing mcManager.setChannel errors. Source: llm_adapter@2026-05-21 Confidence: low |
— |
Full changelog
MeshMonitor v4.5.2 — MeshCore Channel Support
A focused follow-up to v4.5.1 — MeshCore TCP Support that closes the last big gap in the MeshCore subsystem: end-to-end channel management from the MeshMonitor UI. Connect a MeshCore Companion and MeshMonitor now reads the device's channel list on connect, displays each channel as its own tab in the MeshCore page with the sent/received messages segregated correctly, and exposes a per-source Configuration UI to add, rename, regenerate the AES-128 secret of, or delete channels — every write goes to the device first and the local mirror is reconciled afterwards. The new send path is channel-idx aware so a message typed in any tab actually reaches that channel instead of falling back to slot 0. Several rough edges from initial real-hardware testing are also smoothed over: the firmware's MAX_CHANNELS placeholders (typically 40 on Companion builds) are filtered out so you only see configured slots, stale empty rows from earlier syncs are auto-cleaned, the DM-view sidebar excludes the channel pseudo-pubkeys and the local node, and the route layer now talks to the correct MeshCore manager registry instead of silently falling back to the Meshtastic singleton. On the Meshtastic side, a long-standing map issue is fixed: per-node position-accuracy boxes now reflect each sending node's own precision_bits instead of the local node's channel setting. The release also flips the changelog links to open in a new tab so a context-switch doesn't blow away the page.
✨ Features
- #3034 — MeshCore channel CRUD + connect-time sync (phase 1/3).
MeshCoreManagerexposeslistChannels/setChannel/deleteChanneland mirrors the device's channel list into the sharedchannelstable on every connect. AES-128 secrets are stored base64-encoded in the existingpskcolumn;cleanupInvalidChannelsis source-type-aware so MeshCore's higher channel indices survive cleanup. - #3038 — Display device channels in MeshCoreChannelsView (phase 2/3). The hardcoded single "Public" entry is replaced by one tab per device-reported channel. Per-channel filter handles both received and locally-sent messages; the manager's
sendMessageand the/api/meshcore/messages/sendroute both grew an optionalchannelIdxso non-channel-0 sends actually go to the right channel. - #3039 — Channel create / edit / delete UI (phase 3/3). New
MeshCoreChannelsConfigSectionmounted insideMeshCoreConfigurationView. Add channel (auto-assigns the lowest free idx, seeds a 16-byte random secret viacrypto.getRandomValues), edit, regenerate-secret, and delete. Secret displayed as hex with masked-by-default show/copy toggles. BackendPUT/DELETE /api/channels/:idroutes are source-type-aware — MeshCore drops the 0-7 cap, widens name to 31 bytes, and routes the write through the manager.
🐛 Bug Fixes
- #3033 — Per-node position precision boxes. Map accuracy boxes now use each sending node's own
precision_bitsinstead of the local MeshMonitor node's channel setting. Removed the local-channel fallback in both the Position and NodeInfo handlers, plus the "smart upgrade/downgrade" logic that was holding onto a stored higher precision for up to 12 hours and refusing legitimate downgrades. Closes #3030. - #3040 — MeshCore channels post-deploy polish. Filters out empty slots so the firmware's MAX_CHANNELS (typically 40 on Companion builds) doesn't leak placeholder rows into the UI; the next sync after upgrade auto-cleans existing leaked rows from the DB. Fixes the route layer to pull the MeshCore manager from the correct
meshcoreManagerRegistryinstead of the Meshtastic fallback (was producingmcManager.setChannel is not a function). DM-view sidebar now filters out thechannel-Nsynthetic pubkeys and the locally-connected node.
🪟 UX
- #3037 — Changelog links open in a new tab so clicking through doesn't unload the page. Closes #3035.
⬆️ Upgrade Notes
- No migrations. The MeshCore channels feature reuses the existing
channelstable — Meshtastic-only columns (role,uplinkEnabled,downlinkEnabled,positionPrecision) stay null for MeshCore rows. - Existing MeshCore installs: after upgrade, the next connect-time sync will run the new reconcile pass and automatically remove the 38-or-so empty placeholder rows that older builds wrote to the
channelstable. No manual cleanup needed. - Position accuracy boxes will start reflecting each remote node's actual
precision_bits. If you had previously seen all boxes mirror your local node's setting, that was the old smart upgrade/downgrade behavior holding stale precision; the new packets will repopulate within minutes. - API change (additive):
PUT/DELETE /api/channels/:idaccept higher channel IDs (>7) when the target source is MeshCore. The Meshtastic 0-7 cap is unchanged.
Issues Resolved
Full Changelog
https://github.com/Yeraze/meshmonitor/compare/v4.5.1...v4.5.2
🚀 MeshMonitor v4.5.2
📦 Installation
Docker (recommended):
docker run -d \
--name meshmonitor \
-p 8080:3001 \
-v meshmonitor-data:/data \
ghcr.io/Yeraze/meshmonitor:4.5.2
🧪 Testing
✅ All tests passed
✅ TypeScript checks passed
✅ Docker images built for linux/amd64, linux/arm64, linux/arm/v7
📋 Changes
See commit history for detailed changes.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Yeraze/meshmonitor
All releases →Related context
Related tools
Earlier breaking changes
- v4.7.2 Route `destination` field now rejects non‑8‑hex nodeId or 64‑hex publicKey, returning HTTP 400.
Beta — feedback welcome: [email protected]