v4.9.1

Some more styling, performance and bug fixes coming in v4.9.2.

Release Notes

Added

• Android Nearby: hotspot, Wi-Fi Direct, Wi-Fi Aware, and NFC tap link nearby phones with no router.
• Android satellite readiness: the app declares constrained-data optimization so the OS can route mesh traffic on a satellite attach.
• OIDC sign-on for the web UI via Authorization Code + PKCE.
• Native Android GPS location support through LocationManager.
• Customizable top navigation.
• Versioned Reticulum configuration snapshots with restore support.
• Contact sharing with display names and LXMF icon metadata.
• Actionable toast notifications.
• Automated desktop and mobile screenshot capture through task screenshots.

Security

• Added per-render nonces for message placeholders to prevent markdown and link-token injection.
• Improved KML sanitization for namespaced, attribute, and CDATA href values.
• Sandboxed uploaded Reticulum documentation with CSP-isolated iframe responses.
• Prevented the public setup endpoint from creating a local password on OIDC-only deployments.

Fixed

• Fixed Windows AppContainer startup failures.
• Added renderer crash recovery and GPU-disabled relaunch support.
• Fixed stale conversation pages and mobile navigation issues.
• Fixed reverse-proxy WebSocket upgrades with forwarded protocol and port headers.
• Fixed Docker entrypoint handling when arguments begin with flags.
• Improved Reticulum reload recovery and transport-thread callback handling.
• Fixed Android startup, WebView, GPS, and location-permission error handling.
• Improved mobile layouts for messages, relay chat, menus, settings, and maps.
• Added cached offline map tiles and restored the last map view after restart.
• Fixed NomadNet reconnect, download resume, dead-link eviction, and watchdog timeout behavior.

Changed

• Expanded installation documentation for reverse proxies, Kubernetes, command-line flags, and MESHCHAT_* variables.
• Added lifecycle bounds and cleanup for long-running sessions.
• Updated rns to 1.5.4.
• Updated lxst to 0.5.3.
• Replaced hardcoded UI palette colors with semantic theme tokens.
• Added a Windows AppContainer launch probe to the headless self-check.
• Added packaged Electron backend manifest validation to CI.
• GHCR images now use zstd-compressed OCI layers; Docker Hub images remain gzip-compatible.

Changelog

• 73b8a85 docs(changelog): date 4.9.1 and note the windows and nomadnet fixes.
• 71f2bee fix(nomadnet): guard i18n lookup in resend failure toast.
• acd9e67 fix(nomadnet): settle resent downloads when the socket drops again.
• 29fec15 chore(build): normalize crlf in preload bundler, refresh generated assets.
• c3fff16 style(nomadnet): tighten announces sort select sizing.
• 71653e7 fix(map): inline desktop search and re-anchor onboarding tooltip.
• b57778e fix(tutorial): pin page footer and honor bootstrap-only default.
• 34733f1 fix(nomadnet): resend in-flight downloads after websocket reconnect.
• 4833943 fix(nomadnet): bound link requests with a watchdog.
• aa384c3 fix(electron): drop chromium gpu and logging flags from backend argv.
• 23dc68c fix(nomadnet): cancel armed touch gestures on reversal or interruption.
• 4c3a2e6 fix(nomadnet): restore exclusive announces list branches.
• b204a8b electron: auto-fallback to software rendering on GPU crash storms.
• 7b9a230 electron: capture crash dumps and recover dead renderers.
• 878c7a4 fix(windows): make AppContainer opt-in after loader-init crashes.
• 37d586f docs(changelog): note service worker HEAD probe fix.
• 0d3932d fix(pwa): never cache-put non-GET requests in the service worker.
• 2749d8f test(backend): register reticulum config version GET contracts.
• 2a4eb4f fix(frontend): drop duplicate named export flagged by knip.
• bc5a057 fix(backend): narrow optional path before os.replace for pyright.
• 20e8b3b fix(ci): android lint errors and backend format drift.
• 2a7e2cd docs(changelog): record the batch.
• de19da7 chore(build): writable wasm_exec copy and regenerated artifacts.
• 6fbf8ea feat(i18n): strings for top nav, android gps, toasts, and config versions.
• 38fa656 feat(tooling): screenshot suite with seeded demo data.
• 375220c feat(docs): compact docs controls and custom dropdown.
• 2e48617 fix(contacts): semantic add-contact fab.
• d9de413 fix(call): voicemail without espeak and semantic audio colors.
• e87b37b fix(ui): carets on anchored popup menus.
• 07cd3f9 fix(nomadnet): mobile chrome.
• a04fd5d feat(messages): compact mobile composer and android gps sharing.
• 4664414 fix(mobile): relay chat header, interface cards, and map controls.
• 5a44958 feat(ui): toast action buttons and single toast on mobile.
• fc8969a fix(settings): gate reticulum stack panel and expose android gps source.
• 55e8f85 feat(android): native gps location source.
• 645986a feat(nav): customizable top navbar with nomadnet shortcut.
• 73d46cd feat(theme): per-theme outbound, failed, and waiting bubble colors.
• f4215e3 fix(bots): seed lxmfy bot icons from configured colors.
• 88b1108 feat(lxmf): structured error when no propagation node is configured.
• bd5d319 feat(contacts): shared cards carry display name and lxmf icon.
• 4d0e334 feat(backend): versioned reticulum config snapshots.
• 4fd8c77 fix(relay): collapse overflow tabs on mobile tab bar.
• 2eb90c5 docs(security): note privacy mode does not gate external-link opens.
• f991a85 feat(interfaces): iodine DNS tunnel preset for UDP transport.
• 8a65ec3 feat(android): stream downloads with progress notifications and chunked saves.
• 06edd51 style: fix ruff docstring and prettier formatting from issue batch.
• bfd5402 docs(README): update AI disclaimer for clarity on LLM usage.
• 3545871 fix: address reported crash, compose, notify, favourites, and bootstrap issues.
• 616d0c5 docs(contributing): document rngcs commit signing setup.
• c55de8d chore(git): add .mailmap unifying author identities.
• 465c042 feat(frontend): shared useIdentityScope for leak-proof scoped storage.
• 0dd5fe5 docs(agents): document load-time identity capture for scoped storage.
• e6f0696 fix(relay-chat): close draft, highlight, link, and completion edge cases.
• e9cc216 feat(relay-chat): unread pill, rrc:// links, nick completion, drafts, ignore, highlights.
• ea1c66e fix(android): gate local-only hotspot behind API 26.
• c9bb46d style: ruff format aware fixture config string.
• 7aecf63 fix(android): gate WifiAwareManager probe behind TargetApi 26.
• 630f3a0 fix(android): cover data path callback API levels for lint.
• 31e73b0 chore(security): add OpenVEX document and wire into trivy fs scan.
• 0d6085b fix(android): annotate AwareSession as API 26 for lint.
• 09d3fbe chore: changelog, license manifests, wasm integrity hashes.
• 17d42e4 feat(interfaces): WiFi Aware add flow and mobile card layout.
• 6ec1898 feat(android): nearby transports over local link.
• 3f2821f feat(map): render Natural Earth land in bundled starter basemap.
• a5c08c2 fix(frontend): mobile UI polish, apiClient timeout, emitter hardening.
• c8b465d fix(backend): hardening and correctness across http, ws, and managers.
• 4616be5 chore(deps): bump micron-parser-js for folds, field sizing, and a11y.
• 4d9fdb1 fix: verify transport runtime state and surface reload failures.
• 1f6886f chore: rebuild electron shell css and ignore playwright temp dir.
• fb3aa8d fix(nomad): unstick image loads and smooth the boot handoff.
• 498ddbc fix(wasm): retry loaders after failed script injection.
• 53a145a fix(messaging): split drop from cancel and bound chat trims.
• 3ebfdd6 fix(frontend): close live transport and socket lifecycle races.
• 99395a9 fix(nomad): purge stale page download callbacks.
• 9190e60 fix(map): validate mesh coordinates before projection.
• d55ffc8 fix(security): harden markup sanitizers and isolate docs pages.
• 72be25c fix(backend): serialize reticulum reload and close teardown leaks.
• bfe8e93 fix(auth): close OIDC boundary gaps in setup and settings.
• a2b78af fix(ws): rate-limit all frames and bound receive loop lifetime.
• 2d4805c fix(startup): sweep orphaned non-hex ratchet files before RNS init.
• 6db765a fix(frontend): bound retained state and harden live transport lifecycle.
• 4c32b6c feat(auth): add OIDC single sign-on for the web UI.
• 8c74342 fix(startup): landlock roots for custom TLS dirs and stdout log tee.
• 6d595a5 fix(docker): make entrypoint argv-safe for OCI command overrides.
• c441f30 fix(ws): honor forwarded proto and port in WebSocket origin check.
• 80fb531 fix(rns): degrade backbone clients to TCPClientInterface without epoll.
• 9e92299 style(ci): prettier-format the vitest unhandled-error filter.
• 80e4b12 fix(ci): ignore vitest worker console-log RPC teardown race.
• f89d33d fix(appcontainer): use a -c probe snippet for the sandboxed child.
• 36c9c4c fix(appcontainer): retry self-check probe without LPAC on loader-init exits.
• 48b8fd3 fix(appcontainer): run the probe child on the base interpreter.
• 60ba274 fix(appcontainer): grant traverse and file ACLs so the self-check child can start.
• 569e13d fix(rnode): repair desktop and Android RNode transports.
• 7a51faf fix(ci): repair self-test schema, AppContainer ACL calls, env contract, android lint.
• 221415b fix(nomad): keep crash tab frame rect in sync during animated moves.
• 46ac0cc fix(nomad): keep crash tab frame alive across keep-alive detach.
• be5ac70 fix(ui): keep list context when closing a view opened from it.
• 5e1fe21 fix(android): surface startup failures instead of silent process death.
• 2cf4c9a fix(messages): resync after painting a cached conversation first page.
• ea61d21 docs(changelog): note 4.9.1 windows sandbox, packaging and announce fixes.
• 9b4a9e4 feat(relay): show hub announce interval as hours and days.
• 785d365 test(self-check): probe a real AppContainer child launch on Windows.
• f98d1b1 fix(packaging): drop keep-marker hashing, verify manifest in CI.
• 6d92d1b fix(windows): grant AppContainer child window objects, fall back on init exits.
• dd652c8 test(frontend): widen sidebar memory bound for CI variance.
• 952e6c4 chore(deps): bump rns to 1.5.4 and lxst to 0.5.3.
• fbcd9b2 feat(scripts): add rngit release helper and document release flow.
• b143a65 chore(release): bump version to 4.9.1 and drop version from docs.

SHA256 Checksums

Asset	SHA256
ReticulumMeshChatX-v4.9.1-win-portable.exe	3135f3df4a5e632a7520818ca744d13fdda29928339f2d310e6dd00f2d0b931b
latest.yml	b1f7087dd646b34982af9079bc6c752c134f324d3f173d99762407bac73ade64
ReticulumMeshChatX-v4.9.1-linux-x86_64.rpm	0d897dae1e491b4d8722484894385124c95967a120ec43c1ada07344748ccc40
meshchatx-desktop-v4.9.1.intoto.jsonl	45958879320e1343a9f6684e455a3dc87eab19ee3567f87aa279f1b6d627866c
ReticulumMeshChatX-v4.9.1-android-universal.apk	901a0c47137ee43f10e203bf6a27eda3e637ce5979ae15a6a7a9895fd7aa759c
meshchatx-py314-linux-x64.pyz	331eb6d0e3c2b57ccb580b71e04c70d14b430dcf3b2289a4a46e6c1c43aea535
meshchatx-py311-linux-x64.pyz	48ab525832340fa65fd1152ad76e5595fb140d19cd724ca259704f118185e2be
reticulum_meshchatx-4.9.1-py3-none-any.whl	57be5c89cc00732f4a5f280810e542a8f1406b67b324a939450bf549ae56eefc
ReticulumMeshChatX-v4.9.1-mac-arm64.dmg.cosign.bundle	1d6e7366030dd09cd1e2bbaee1a3fac7f2f8bc36f5867d80b044fec3f828133a
ReticulumMeshChatX-v4.9.1-win-installer.exe	14a9a1b4b5c4aa9356498ed8e2c7ee2ce1eb58c1cb4dae296abae16b1d61dc41
meshchatx-py311-linux-arm64.pyz	3dd20cce00a52f25e2c9a2e7d59e92a16ad6a86a5c89b7a60d649dacb3078912
ReticulumMeshChatX-v4.9.1-linux-arm64.AppImage	f933d3de018992ccbd8ba419365033d330cc38d5ac91051b2dbfc2bd84770932
meshchatx-frontend.zip	55bfd05c05fb2789b6cc4688897dd6b34349009b12f6254a562adee3bd68f824
ReticulumMeshChatX-v4.9.1-mac-x64.dmg.cosign.bundle	d0755c2b2ae49a927294bb75baa256b8ef6e0f1025f34fe4997f2c3d1d11c748
ReticulumMeshChatX-v4.9.1-win-installer.exe.blockmap.cosign.bundle	0602c66ecc08b3a421ad3cedd125d6d47fe9027c497b21afe8b61c6053f822d8
ReticulumMeshChatX-v4.9.1-linux-x86_64.flatpak	4a3bc55a260985701d78aab9281627e7973a3d6ccdde0943baf3d54cb51bbb72
sbom.cyclonedx.json	00f336571d862dbbc7162b0dbfc0bd23de294ee66ffb14d4491ae5e75b917529
ReticulumMeshChatX-v4.9.1-win-installer.exe.cosign.bundle	ad6eef7867d0b4dd25ccc6ae751d52d6698214a21445abb19951e14e9a6d1c05
ReticulumMeshChatX-v4.9.1-win-installer.exe.blockmap	071e1b95fce3d5d7d9ef395a4dcc79035dd7d32ae49ffb6569865707aef8cc57
latest.yml.cosign.bundle	dfff8f43b4c96c1692082808b410738090fe4d1e592ec4758eb6c02824444510
ReticulumMeshChatX-v4.9.1-linux-alpine-x64.apk	773ac0b9a03bd3a9a0e32fd2e73cfe5c6aef9b7f2971805e093c85a98dcb010a
meshchatx-linux-v4.9.1.intoto.jsonl	5e27be47f26b6a2e25cbb6ada0292582bf8c0eebc0a8cb8db05b23f134d28ae5
meshchatx-android-flatpak-v4.9.1.intoto.jsonl	d1677b057fdc7f471d65b710af47fc0c2eb51f3e89f0d505c64ee2808244540d
ReticulumMeshChatX-v4.9.1-linux-arm64.deb	db986c82f4464ef8a0c52e585a3e46a534ae6b41ded0f76b01f1618b0091a15c
ReticulumMeshChatX-v4.9.1-mac-x64.dmg	2e132dbe1184bca148a659b49c6b0f275fa407a2299b992b1462c779d6c1ed9a
meshchatx-py314-linux-arm64.pyz	6f857e12923f2c88c9618458601ee989f0272758d186b9391de09c37266c2322
ReticulumMeshChatX-v4.9.1-win-portable.exe.cosign.bundle	67d7a4cd19487a765991e062fcefc2a8e43d0d7c45e3a74d8e5cd7d896c38cb4
ReticulumMeshChatX-v4.9.1-mac-arm64.dmg	93603e589ed7b0ee48104bff06b36da7406fe9969c224ff36de3c17b7b59abee
ReticulumMeshChatX-v4.9.1-linux-x86_64.AppImage	ed3c706fc86b63136538e479c082ece39f3ed40cd67f6f5d62a8c9e47a6a1d2d
ReticulumMeshChatX-v4.9.1-linux-amd64.deb	25a13a39a7fa264b35a0ad2ac5e01691bbc4162e8e673b1afc8bd3dbdb645ca5

Verification

• Cosign bundles (.cosign.bundle) are attached for keyless Sigstore verification.
• SLSA provenance (.intoto.jsonl) is available for supply-chain attestation.
• Verify manually with:

sha256sum <asset>