MeshMonitor v4.14.1-rc5

⚠️ Pre-release — release candidate for testing. Do not use in production.

Small focused bump over rc4 to get the proxy-auth session-fixation fix out to Windows desktop users, plus one MeshCore Virtual Node delivery fix.

Regenerate session on proxy-auth identity binding (#4672) — the proxy-auth path in authMiddleware used to write user identity into whatever session came in with the request, without rotating the session ID. On deployments with PROXY_AUTH_ENABLED=true (Authelia, oauth2-proxy, Cloudflare Access, Authentik, etc.) this let an attacker who could plant a meshmonitor.sid cookie on a victim's browser ride the post-authentication session. Now regenerates the session ID on the first identity bind, mirroring what local/MFA/OIDC login already did. CSRF token is preserved across regeneration. If PROXY_AUTH_ENABLED=false (the default), no impact.

MeshCore-VN: deliver MeshMonitor-originated channel messages to VN clients (#4668, external contribution from @pfmos) — closes #4535. When a MeshCore Virtual Node was running, channel messages sent from MeshMonitor's web UI (or from another connected MeshCore app client) were silently dropped for every other connected client. Per-client attribution now delivers each message to every client except the one that originated it, so all connected apps see the same conversation. DMs stay suppressed with an in-docs explanation of the companion-protocol constraint.

#4535 [BUG] Messages sent to MeshCore Virtual Node app only work in one direction

Full changelog: v4.14.1-rc4...v4.14.1-rc5

🚀 MeshMonitor v4.14.1-rc5

Docker (recommended):

docker run -d \
  --name meshmonitor \
  -p 8080:3001 \
  -v meshmonitor-data:/data \
  ghcr.io/Yeraze/meshmonitor:4.14.1-rc5

✅ All tests passed
✅ TypeScript checks passed
✅ Docker images built for linux/amd64, linux/arm64, linux/arm/v7

See commit history for detailed changes.