MeshMonitor v4.8.1

Patch release combining a MeshCore automation suite (auto-announce, auto-responder, timer triggers, and auto-acknowledge), a connection-stability fix that eliminates the deterministic 3×/min reconnect loop on TCP Meshtastic sources, and a round of CodeQL-driven security hardening (polynomial-ReDoS, log-injection, regex-DoS) plus MeshCore neighbor publicKey input validation. Also includes a translations refresh from Hosted Weblate.

Features

MeshCore Automations

• #3249 feat(meshcore) Auto-announce, auto-responder, and timer triggers — three new per-source automations in the MeshCore Automation view:
  • Auto-Announce — periodically broadcast a templated status message to selected channels on an interval or cron schedule, with an optional advert burst, live preview, and Send Now.
  • Auto-Responder — reply to incoming messages matching an operator-defined regex with a text response or a script, with per-channel/DM filtering and per-sender cooldown.
  • Timer Triggers — schedule recurring text/advert/script actions, each on its own cron or interval.
  • Shared token expansion ({VERSION}, {DURATION}, {CONTACTCOUNT}, {COMPANIONCOUNT}, {REPEATERCOUNT}, {ROOMCOUNT}, {NODE_NAME}, {NODE_ID}) across all three, surfaced in the UI via an inline token legend.
• #3245 feat(meshcore) Auto-acknowledge automation with channels, DM, and macros — operator-configurable auto-ACK rules per source with per-channel/DM scope and templated macro responses.

Bug Fixes

• #3248 fix(stability) Guard handleConnected against transport-swap race (closes #3247) — on TCP Meshtastic sources, handleConnected could observe this.transport get nulled during its own async setup chain (notifyNodeConnected, channel snapshot), causing sendWantConfigId to throw Transport not initialized. The catch block then treated that as a transient post-connect reset and tore down the (still-healthy) session, reproducing the same race on the next reconnect — producing a deterministic 3×/min reconnect loop on otherwise-fine TCP sockets. The handler now captures the transport reference at entry, and the catch block distinguishes "transport went away mid-handshake" (silent bail) from a genuine transport-layer send failure (existing teardown path preserved).
• #3240 fix Add input validation for MeshCore neighbor publicKey parameters — validate-and-extract pubkey for neighbor endpoints to address CodeQL js/user-controlled-bypass.

Security

• #3246 fix(security) Close CodeQL polynomial-ReDoS + harden regex compile and logger sanitization — hardens several user-input code paths against denial-of-service via crafted regular expressions and log-injection patterns surfaced by CodeQL static analysis.

Other

• #3208 chore(i18n) Translations update from Hosted Weblate.

Issues Resolved

• #3247 [BUG] Per-minute reconnect loop: 'Transport not initialized' race tears down healthy TCP sessions — closed by #3248.

Upgrade Notes

No breaking changes. Standard upgrade: pull the new image / Helm chart / desktop bundle.

Full Changelog: https://github.com/Yeraze/meshmonitor/compare/v4.8.0...v4.8.1

🚀 MeshMonitor v4.8.1

📦 Installation

Docker (recommended):

docker run -d \
  --name meshmonitor \
  -p 8080:3001 \
  -v meshmonitor-data:/data \
  ghcr.io/Yeraze/meshmonitor:4.8.1

🧪 Testing

✅ All tests passed
✅ TypeScript checks passed
✅ Docker images built for linux/amd64, linux/arm64, linux/arm/v7

📋 Changes

See commit history for detailed changes.