v4.13.0-rc1

What's Changed

• docs: remediation plan + epic status doc (#3962) by @Yeraze in #3966
• feat(server): process-level safety net for unhandledRejection/uncaughtException (#3962) by @Yeraze in #3967
• fix(security)!: default trust proxy to false when TRUST_PROXY is unset (#3962) by @Yeraze in #3968
• chore(deps): pin meshcore.js fork to commit SHA (#3962) by @Yeraze in #3969
• fix(security): strip hot-path console logging and CSRF token exposure in api.ts (#3962) by @Yeraze in #3970
• chore(lint): enable @typescript-eslint/no-floating-promises as error (#3962) by @Yeraze in #3972
• feat(db)!: withSourceScope fails closed — omitting sourceId throws, ALL_SOURCES sentinel for intentional cross-source (#3962) by @Yeraze in #3976
• feat(automations): multi-channel message trigger OR-list (#3974) by @Yeraze in #3982
• feat(map): add polar grid overlay to Map Analysis and Unified maps (#3971) by @Yeraze in #3983
• fix(meshcore): auto-retry DM via same-path + flood cadence on ack timeout by @Yeraze in #3980
• ci(types): type-check test files via tsconfig.tests.json, non-blocking first (#3962) by @Yeraze in #3985
• fix(meshcore): populate fromName on DM automation triggers, clarify trigger.from vs fromName by @Yeraze in #3978
• feat(meshcore): delete/purge messages — per-message, per-conversation, purge-all (#3981) by @Yeraze in #3984
• test(routes): integration-grade route-test harness with real auth middleware (#3962) by @Yeraze in #3986
• fix(meshcore): exact decrypt-and-match for channel 'repeaters relayed' echo (#3979 pt1) by @Yeraze in #3987
• feat(meshcore): opt-in auto-retry for automated channel sends (#3979 Part 2) by @Yeraze in #3988
• chore(lint): count-based lint ratchet — new violations block, existing debt baselined; CI lint now blocking (#3962) by @Yeraze in #3989
• feat(server): codify the { success, error, code } response envelope in ok()/fail() helpers (#3962) by @Yeraze in #3990
• feat(meshcore-vn): relay SendStatusReq(27) status requests to the physical node (#3904) by @Yeraze in #3991
• test(db): schema-drift tripwire — CI fails on createTables vs migration-replay divergence (#3962) by @Yeraze in #3992
• feat(meshcore-vn): relay GetNeighbours via SendBinaryReq(50) to the physical node (#3904) by @Yeraze in #3993
• chore(logging): trim default log volume — reclassify routine info→debug, add trace tier by @Yeraze in #3994
• refactor(registry)!: MeshCoreManager implements ISourceManager — one unified source registry (#3962) by @Yeraze in #4004
• Fix Virtual Node Server boot race and listen-error zombie state by @Yeraze in #4001
• feat(automation): add "Send via sources" selector to the tapback action by @Yeraze in #3997
• feat(automation): add scheduled device-reboot action (#3995) by @Yeraze in #4002
• fix(meshcore): match-scope replies unscoped for unnameable trigger scope (#3998) by @Yeraze in #4003
• refactor(heartbeat): extract protocol-agnostic HeartbeatScheduler; MeshCore adopts (#3962) by @Yeraze in #4005
• test(automation): fix rebootDevice tests broken by #4004/#4002 merge race by @Yeraze in #4007
• refactor(announce): extract CronOrIntervalScheduler; both managers delegate arming (#3962) by @Yeraze in #4009
• feat(map): node selection & emphasis on Map Analysis (#3788 Phase 1) by @Yeraze in #4010
• refactor(auto-responder): extract Meshtastic DSL matcher — tests now guard production code (#3962) by @Yeraze in #4011
• feat(map): Follow & Auto-zoom on Map Analysis (#3788 Phase 2) by @Yeraze in #4012
• refactor(distance-delete): formalize scheduler lifecycle on ISourceManager; Meshtastic adopts the shared class (#3962) by @Yeraze in #4014
• feat(map): node-to-node LOS distance measurement tool on all maps (#3636) by @Yeraze in #4013
• refactor(startup)!: retire the Meshtastic singleton's special-casing — uniform construction, live primary alias (#3962) by @Yeraze in #4017
• refactor(db): split misc.ts — extract solarEstimates, upgradeHistory, newsCache, backupHistory repos (#3962) by @Yeraze in #4023
• fix(map): decouple popup from spiderfy + declutter obscured markers (#4015, #4016) by @Yeraze in #4022
• refactor(db): split misc.ts — extract autoTraceroute, timeSync, distanceDeleteLog, mapPreferences, themes repos (#3962) by @Yeraze in #4030
• feat(map): extend popup/spiderfy fix + obscured-marker offset to all maps by @Yeraze in #4028
• fix(meshcore): remove non-functional Stats quick-action from remote console by @Yeraze in #4031
• fix(automation): resolve MeshCore DM destination as a pubkey string, not Number() by @Yeraze in #4019
• fix(meshcore): danger-command guard no longer fires on dotted config-path args by @Yeraze in #4029
• refactor(db): split misc.ts — packetLog + keyRepair repos; delete misc.ts (#3962) by @Yeraze in #4032
• feat(meshcore): configurable remote/local CLI reply timeout (#4027) by @Yeraze in #4033
• chore(migrations): shared idempotency helpers + registry-derived count test (#3962) by @Yeraze in #4034
• refactor(db): key-repair parity — 3-backend Drizzle repository, facade raw SQL deleted (#3962) by @Yeraze in #4036
• fix(notifications): low-battery alerts lost to split preference rows by @Yeraze in #4035
• feat(db): migration 113 — normalize bootstrap-only indexes across backends (#3962) by @Yeraze in #4040
• feat(meshcore): Auto-Pathfinding target filtering (#4024) by @Yeraze in #4039
• refactor(db)!: fresh installs bootstrap via migration replay — createTables() deleted (#3962) by @Yeraze in #4041
• refactor(db): migrate last sync-facade callers; extract node cache, mobility, traceroute-selection, packet-rate services (#3962) by @Yeraze in #4043
• refactor(db): delete the sync-legacy API surface — Phase 3 complete (#3962) by @Yeraze in #4048
• fix(api): require sourceId on always-500 endpoints + enforcement foundation (1/N) by @Yeraze in #4053
• fix(api): scope telemetry-delete & channel-export to a required sourceId (2/N) by @Yeraze in #4054
• fix(system-tests): scope message send/read to a sourceId by @Yeraze in #4052
• fix(api): require sourceId on telemetry + position-override, wire frontend (Phase 2a) by @Yeraze in #4056
• fix(api): require sourceId on neighbor-info/:nodeNum; fix embed neighbor 500 (Phase 2b) by @Yeraze in #4058
• fix(api): require sourceId on security reads, wire SecurityTab (Phase 2c) by @Yeraze in #4059
• fix(api): require sourceId on channel-write routes, wire config callers (Phase 2d) by @Yeraze in #4061
• fix(api): scope security node-clear to a required sourceId by @Yeraze in #4062
• fix(api): scope v1 GET /packets/:id to the caller's source by @Yeraze in #4063
• test(system): send sourceId to endpoints hardened by the sourceid remediation by @Yeraze in #4069
• chore: bump version to 4.13.0-rc1 by @Yeraze in #4050

Full Changelog: v4.12.5...v4.13.0-rc1

🚀 MeshMonitor v4.13.0-rc1

📦 Installation

Docker (recommended):

docker run -d \
  --name meshmonitor \
  -p 8080:3001 \
  -v meshmonitor-data:/data \
  ghcr.io/Yeraze/meshmonitor:4.13.0-rc1

🧪 Testing

✅ All tests passed
✅ TypeScript checks passed
✅ Docker images built for linux/amd64, linux/arm64, linux/arm/v7

📋 Changes

See commit history for detailed changes.