This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
ReleasePort's take
Light signalMeshMonitor v4.9.0 adds lowβbattery alerts, an airtimeβutilization cutoff for automations, and several UI/telemetry improvements while fixing key bugs such as MQTT telemetry normalization and a PostgreSQL GROUP BY error.
Why it matters: The release prevents HTTPβ―500 errors in the Telemetry API by fixing a PostgreSQL GROUP BY bug and stabilizes MQTT ingestion with normalized keys, directly improving reliability for deployments using those services.
Summary
AI summaryUpdates Bug Fixes, π MeshMonitor v4.9.0, and recommended across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Adds low-battery alerts for monitored nodes via Apprise/Web Push/Desktop. Adds low-battery alerts for monitored nodes via Apprise/Web Push/Desktop. Source: llm_adapter@2026-06-05 Confidence: high |
β |
| Feature | Medium |
Adds airtime-utilization cutoff that pauses transmitting automations when channel utilization exceeds threshold. Adds airtime-utilization cutoff that pauses transmitting automations when channel utilization exceeds threshold. Source: llm_adapter@2026-06-05 Confidence: high |
β |
| Feature | Medium |
Adds telemetry time-range selector (15mβ7d) with scalable averaging on Device Info graphs. Adds telemetry time-range selector (15mβ7d) with scalable averaging on Device Info graphs. Source: llm_adapter@2026-06-05 Confidence: high |
β |
| Feature | Medium |
Adds `{LAST_HOP}` automation variable resolving the last relay node. Adds `{LAST_HOP}` automation variable resolving the last relay node. Source: llm_adapter@2026-06-05 Confidence: high |
β |
| Feature | Medium |
Makes per-source ignore list authoritative, reβapplying and reβpushing the ignore flag when a device drops it. Makes per-source ignore list authoritative, reβapplying and reβpushing the ignore flag when a device drops it. Source: llm_adapter@2026-06-05 Confidence: high |
β |
| Feature | Low |
Adds MeshCore chat date separators between messages from different days. Adds MeshCore chat date separators between messages from different days. Source: granite4.1:30b@2026-06-05-audit Confidence: low |
β |
| Feature | Low |
Uses lucide icons matching MQTT/Meshtastic styling for MeshCore sidebar icons. Uses lucide icons matching MQTT/Meshtastic styling for MeshCore sidebar icons. Source: granite4.1:30b@2026-06-05-audit Confidence: low |
β |
| Bugfix | Medium |
Fixes MQTT telemetry key normalization and migrates existing rows to canonical keys. Fixes MQTT telemetry key normalization and migrates existing rows to canonical keys. Source: llm_adapter@2026-06-05 Confidence: high |
β |
| Bugfix | Medium |
Fixes PostgreSQL GROUP BY bug in averaged telemetry query, preventing HTTP 500 errors. Fixes PostgreSQL GROUP BY bug in averaged telemetry query, preventing HTTP 500 errors. Source: llm_adapter@2026-06-05 Confidence: high |
β |
| Bugfix | Medium |
Exempts RFC 1918 and loopback IPs from API rate limiter to avoid throttling local/reverseβproxy traffic. Exempts RFC 1918 and loopback IPs from API rate limiter to avoid throttling local/reverseβproxy traffic. Source: llm_adapter@2026-06-05 Confidence: high |
β |
| Bugfix | Medium |
Removes dead space below the chat input in the installed PWA. Removes dead space below the chat input in the installed PWA. Source: llm_adapter@2026-06-05 Confidence: high |
β |
| Bugfix | Medium |
Widens `meshcore_packet_log` timestamp/createdAt columns to BIGINT for larger values. Widens `meshcore_packet_log` timestamp/createdAt columns to BIGINT for larger values. Source: llm_adapter@2026-06-05 Confidence: high |
β |
| Bugfix | Low |
Fixes UNIQUE constraint error when configuring Apprise for a second source. Fixes UNIQUE constraint error when configuring Apprise for a second source. Source: granite4.1:30b@2026-06-05-audit Confidence: low |
β |
| Bugfix | Low |
Includes MeshCore nodes in the unified source node count. Includes MeshCore nodes in the unified source node count. Source: granite4.1:30b@2026-06-05-audit Confidence: low |
β |
Full changelog
MeshMonitor v4.9.0
A feature release focused on keeping your mesh healthy and your automations polite. v4.9.0 adds low-battery alerts for monitored nodes and an airtime-utilization cutoff that automatically pauses bot automations (auto-traceroute, auto-announce, timers, and more) whenever the connected node's Channel Utilization climbs above a threshold β so bots back off while real people are using the channel and resume once it quiets down. The Device Info telemetry graphs gain a time-range selector (15mβ7d) with averaging that scales correctly across long windows on every database backend. Automation templates pick up a new {LAST_HOP} variable that resolves the last relay node. The per-source ignore list is now authoritative, re-applying the ignore flag (and re-pushing it to the radio) when a device drops it. On the fixes side, MQTT environment telemetry is visible again (keys now match serial ingestion, with a migration to repair history), and a PostgreSQL GROUP BY bug in the new averaged telemetry query β which returned HTTP 500 on Postgres deployments β was caught by the release system tests and fixed, with a Postgres regression test added to standard CI so it can't recur.
Features
- Low-battery alerts for monitored nodes (#3310, closes #3305) β notify via Apprise / Web Push / Desktop when a monitored node's battery drops below a configurable threshold.
- Airtime-utilization cutoff (#3311) β a "Cutoff Airtime Utilization Threshold" on the Automation page pauses all transmitting automations while the mesh is busy; live status banner, manual sends never blocked.
- Telemetry time-range selector + scalable averaging (#3312) β 15mβ7d window selector on the Device Info graphs, remembered per browser, with averaging that no longer truncates long windows.
{LAST_HOP}automation variable (#3320, closes #3318) β resolves the last relay node (short name β hex byte βunknown) in autoresponder/auto-ack templates.- Ignored-node auto-reapply (#3313, closes #2601) β the per-source ignore list is authoritative; re-applies and re-pushes the ignore flag when a device's node DB drops it.
- MeshCore chat date separators (#3319, closes #3316) β separators between messages from different days.
Bug Fixes
- Averaged telemetry graph query on PostgreSQL (#3327) β fixed an HTTP 500 from
GET /api/telemetry/:nodeIdon Postgres (GROUP BYfunctional-dependency error); added a Postgres regression test topr-testsCI. - MQTT telemetry key normalization (#3315, closes #3314) β MQTT environment metrics now use the canonical keys serial uses, with a migration to repair existing rows, so they show in the graphs.
- Unified source node count (#3323, closes #3321) β include MeshCore nodes in the count.
- Apprise configuration (#3325, closes #3324) β fixed a UNIQUE constraint error when configuring Apprise for a second source.
- MeshCore packet-log timestamps (#3317) β widened
meshcore_packet_logtimestamp/createdAt to BIGINT. - API rate limiter (#3309, closes #3308) β exempt RFC 1918 / loopback IPs so local/reverse-proxy traffic isn't throttled.
- PWA chat input (#3307) β removed dead space below the chat input in the installed PWA.
- MeshCore sidebar icons (#3306) β use lucide icons matching the MQTT/Meshtastic styling.
Issues Resolved
#3305, #3308, #3314, #3316, #3318, #3321, #3324, #2601
Full changelog: https://github.com/Yeraze/meshmonitor/compare/v4.8.3...v4.9.0
π MeshMonitor v4.9.0
π¦ Installation
Docker (recommended):
docker run -d \
--name meshmonitor \
-p 8080:3001 \
-v meshmonitor-data:/data \
ghcr.io/Yeraze/meshmonitor:4.9.0
π§ͺ Testing
β
All tests passed
β
TypeScript checks passed
β
Docker images built for linux/amd64, linux/arm64, linux/arm/v7
π Changes
See commit history for detailed changes.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Yeraze/meshmonitor
All releases βRelated context
Related tools
Earlier breaking changes
- v4.7.2 Route `destination` field now rejects nonβ8βhex nodeId or 64βhex publicKey, returning HTTPβ―400.
Beta — feedback welcome: [email protected]