This release adds 5 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
Affected surfaces
Summary
AI summaryBroad release touches Bug Fixes, Refactoring, Issues Resolved, and mqtt-bridge.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
Adds per-gateway publisher pool to MQTT bridge (default on) Adds per-gateway publisher pool to MQTT bridge (default on) Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Feature | Low |
Honors `ok_to_mqtt` bit on uplink for MQTT bridge (default on) Honors `ok_to_mqtt` bit on uplink for MQTT bridge (default on) Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Feature | Low |
Adds direction mode dropdown to enable quiet publish‑only MQTT servers Adds direction mode dropdown to enable quiet publish‑only MQTT servers Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Feature | Low |
Adds upstream identity mode control in dashboard bridge form Adds upstream identity mode control in dashboard bridge form Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Feature | Low |
Shows per‑gateway publisher status badge on MQTT bridge cards Shows per‑gateway publisher status badge on MQTT bridge cards Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Feature | Low |
Manages MQTT bridge topic rewrites from broker settings Manages MQTT bridge topic rewrites from broker settings Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Feature | Low |
Adds collapsible node list to Direct Messages view for MeshCore sources Adds collapsible node list to Direct Messages view for MeshCore sources Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Feature | Low |
Allows importing channels from a Meshtastic URL into channel‑db Allows importing channels from a Meshtastic URL into channel‑db Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Feature | Low |
Enables setting unified pages as default landing destination in settings Enables setting unified pages as default landing destination in settings Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Bugfix | Medium |
Fixes out‑of‑order message display by sorting messages using server‑side receipt time Fixes out‑of‑order message display by sorting messages using server‑side receipt time Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Bugfix | Medium |
Scope security key fetch by sourceId in device configuration Scope security key fetch by sourceId in device configuration Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
| Bugfix | Medium |
Renders only configured channels in the user permission grid Renders only configured channels in the user permission grid Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
| Bugfix | Medium |
Splits Connection permission into separate Read/Write checkboxes Splits Connection permission into separate Read/Write checkboxes Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
| Bugfix | Medium |
Drops legacy `psk_length` CHECK constraint blocking MQTT bootstrap Drops legacy `psk_length` CHECK constraint blocking MQTT bootstrap Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
| Bugfix | Low |
Fixes save hang and adds reconnect backoff for MQTT bridge Fixes save hang and adds reconnect backoff for MQTT bridge Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
| Bugfix | Low |
Improves telemetry label formatting, auto‑login spam handling, and DM page layout in MeshCore Improves telemetry label formatting, auto‑login spam handling, and DM page layout in MeshCore Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
| Bugfix | Low |
Skips auto‑upgrade check while migrations are running on the server Skips auto‑upgrade check while migrations are running on the server Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
| Bugfix | Low |
Rejects out‑of‑range nodeNum values and resolves publicKey destinations in nodes handling Rejects out‑of‑range nodeNum values and resolves publicKey destinations in nodes handling Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
| Bugfix | Low |
Hides global Channel Database entries in per‑source view Hides global Channel Database entries in per‑source view Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
Full changelog
MeshMonitor v4.7.3
This release brings significant MQTT bridge enhancements, multi-source bug fixes, and UI improvements. The MQTT bridge now supports per-gateway publisher pools, upstream identity modes, direction mode control for quiet publish-only servers, and honors the ok_to_mqtt bit on uplink. Several per-source scoping bugs were fixed including security key display in Device Configuration, channel database visibility, and permission grid rendering. Message sorting now uses server-side receipt time rather than the sender clock, preventing out-of-order displays. MeshCore sources gain a collapsible node list on the Direct Messages view and improved telemetry labels. The user permission system has been refined with separate Read/Write checkboxes for Connection permissions. Unified pages can now be set as the default landing page.
Features
- feat(mqtt-bridge): per-gateway publisher pool (default on) (#3200)
- feat(mqtt-bridge): honor ok_to_mqtt bit on uplink (default on) (#3204)
- feat(mqtt-bridge): direction mode dropdown — quiet publish-only public servers (#3189)
- feat(dashboard): bridge form control for upstream identity mode (#3202)
- feat(dashboard): per-gateway publisher status badge on bridge cards (#3203)
- feat(mqtt): bridge topic rewrites managed from broker settings (#3173)
- feat(meshcore): collapsible node list on Direct Messages view (#3193)
- feat(channel-db): import channels from a Meshtastic URL (#3191)
- feat(settings): allow unified pages as default landing destinations (#3194)
Bug Fixes
- fix(config): scope security key fetch by sourceId (#3207)
- fix(mqtt-bridge): resolve save hang and add reconnect backoff (#3206)
- fix(meshcore): pretty telemetry labels + auto-login spam + DM page-scroll layout (#3205)
- fix(users): render only configured channels in the permission grid (#3201)
- fix(users): split Connection permission into separate Read/Write checkboxes (#3199)
- fix(server): skip auto-upgrade check while migrations are still running (#3196)
- fix(messages): sort by server-side receipt time, not sender clock (#3190)
- fix(nodes): reject out-of-range nodeNum + resolve publicKey destinations (#3188)
- fix(channel-db): drop legacy psk_length CHECK constraint blocking MQTT bootstrap (#3185)
- fix(channels): hide global Channel Database entries in per-source view (#3175)
Refactoring
- revert(mqtt): restore v4.6.6 per-source dashboard (#3172)
Dependencies
- chore(deps): bump the production-dependencies group with 9 updates (#3182)
- chore(deps): bump protobufjs from 8.3.0 to 8.4.2 (#3181)
- chore(deps): bump pg from 8.20.0 to 8.21.0 (#3180)
- chore(deps): bump helmet from 8.1.0 to 8.2.0 (#3179)
- chore(deps-dev): bump the development-dependencies group with 3 updates (#3176)
Translations
- Translations update from Hosted Weblate (#2996)
Issues Resolved
- #3197 — MQTT bridge: per-gateway identity for upstream connections
- #3192 — Collapsible node list on Node DM page for MeshCore sources
- #3187 — Nodes with bad time stay at the bottom of channels tab
- #3186 — nodeNum overflow causes DrizzleQueryError for bigint
- #3184 — MQTT channel_database bootstrap fails with CHECK constraint
- #3183 — Option to set Unified Messages as default landing page
Full Changelog: https://github.com/Yeraze/meshmonitor/compare/v4.7.2...v4.7.3
🚀 MeshMonitor v4.7.3
📦 Installation
Docker (recommended):
docker run -d \
--name meshmonitor \
-p 8080:3001 \
-v meshmonitor-data:/data \
ghcr.io/Yeraze/meshmonitor:4.7.3
🧪 Testing
✅ All tests passed
✅ TypeScript checks passed
✅ Docker images built for linux/amd64, linux/arm64, linux/arm/v7
📋 Changes
See commit history for detailed changes.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Yeraze/meshmonitor
All releases →Related context
Related tools
Earlier breaking changes
- v4.7.2 Route `destination` field now rejects non‑8‑hex nodeId or 64‑hex publicKey, returning HTTP 400.
Beta — feedback welcome: [email protected]