MeshMonitor v4.17.3

Summary

MeshMonitor 4.17.3 brings MeshCore close to Meshtastic across most of the app, built on one shared implementation where the two protocols overlap: maps, Packet Monitor, node and DM lists, messaging, settings, notifications, automations, Mesh Issues, dashboard widgets, the v1 API and Prometheus. MeshCore also gains a Security tab, Repeater and Room Server settings forms, per-source device backups, traces in the Traceroute Explorer and MeshCore One contact tokens. New for both protocols: multi-channel timer triggers, long-message splitting, an MQTT root topic finder, a fixed Y-axis range on dashboard charts, and an opt-in node-name anti-spam filter that strips invite links from node names on every source, MQTT included. The security fixes close a MeshCore channel-secret leak in the v1 API, a cross-source device backup read, and a Repeater secret in the debug log, and deleting a source now removes its channel secrets. Selecting a MeshCore Room Server no longer logs in; press Login instead. Queued channel sends no longer report a false ACK timeout, and one failing poll section no longer blanks the node and channel lists. Restore is more robust, and the MySQL backup list loads again. Upgrading runs migrations 223 to 232 automatically; read the upgrade notes below first.

Features

feat(meshcore): import/export MeshCore One contact-share tokens #6375
feat(dashboard): per-widget fixed Y-axis min/max on telemetry charts #6349
feat(mqtt): opt-in live refresh of the root finder's community directory #6346
feat(mqtt): offline geocoder for root finder subdivision and city rows #6345
feat(meshcore): IATA region finder for MeshCore MQTT ingest #6343
feat(automation): Meshtastic long-message split through the shared splitter #6339
feat(meshcore): optional senderName for API channel sends, per-source allowlist #6331
feat(automation): MeshCore confirmed new-neighbour alert #6334
feat(meshcore): show stored room posts read-only without a live login #6333
feat(meshcore): clock-out-of-sync alert from passive advert sampling #6327
feat(mqtt): root topic finder — subscribe-only broker sample #6328
feat(meshcore): split long messages in Auto Responder, Timer Triggers, Auto Announce and automations #6329
feat(notifications): configurable message text length per service #6326
feat(meshcore): Packet Monitor origin column never guesses, gates names on nodes:read, adds TX/RX marker #6324
feat(meshcore): Security rates, clock offset, scanner, digest, export, draft notification DM #6314
feat(backup): per-source, protocol-aware device backups; fix cross-source backup access #6313
feat(meshcore): Notifications tab for MQTT region feeds, broker-link alerts #6312
feat(meshcore): MeshCore traces in the Traceroute Explorer, trace attempt log #6311
feat(meshcore): Mesh Issues node-health rules A6-A9 for both protocols #6310
feat(meshcore): Repeater new-node alerts behind a learning window and hourly cap #6309
feat(meshcore): message, server-event and trace notifications #6305
feat(meshcore): remote structured settings for Repeaters and Room Servers #6302
feat(meshcore): Repeater structured settings, power-off and key restore; fix secret log leak and prv.key guard #6288
feat(meshcore): Companion BLE PIN, multi-ACKs, factory reset and channel share/import #6286
feat(meshcore): Security tab on MeshCore — dead contacts, path-hash collisions, advert signatures, own-key change #6283
feat(meshcore): MeshCore in v1 API, Prometheus, Dashboard widgets, Mesh Issues and embed maps #6280
feat(meshcore): map parity — shared map layers, trace on map, Map Analysis, estimated positions #6277
feat(meshcore): Packet Monitor + contact graph parity — paging, search, filters, distribution, link history #6275
feat(nodes): shared node/DM list tools for Meshtastic and MeshCore — sort, filters, grouping, export, DM filters #6270
feat(messages): MeshCore messaging parity — room unread, DM/room mute, mark-all-read, translation, shared composer #6269
feat(meshcore): Settings parity — telemetry, purge/outliers, dimming, hide-incomplete; solar + restart in Global Settings #6268
feat(meshcore): per-broker TLS verify toggle for the Analyzer Observer #6264
feat(meshcore): Auto Welcome automation section #6244
feat(server): BIND_ADDRESS env var to choose the bind address #6233
feat(meshcore): Auto Favorite automation section #6241
feat(meshcore): Auto Delete by Distance, Time Sync & Remote Telemetry automation sections #6236
feat(automation): multi-channel Timer Triggers for Meshtastic and MeshCore #6235
feat(meshcore): distinct channel markers for private/hashtag/public #6234
feat(meshcore): inline Script Management panel in Auto Responder #6227
feat(meshcore): store device private key encrypted + server-side DM decrypt #6218
feat(ui): relative-time tooltip on message timestamp hover #6215
feat(meshcore): show heard repeaters for sent DMs #6209
feat(map): colour nodes by gateway for MQTT sources #6205
feat(meshcore): Required Repeaters list with ANY/ALL mode and shared heard-by bubble #6206
feat(meshcore): add Public Key sort to node and DM lists #6196
feat(meshcore): resolve the Packet Decode relay chain per hop, shared with Message Route #6191
feat(meshcore): forward heard-repeater results to MeshWars #6005
feat(meshcore): per-source Required Repeater gate for message resend #6184
feat(meshcore): decrypt Companion OTA GRP_TXT with virtual channel keys and show them on the Channels page #6183
feat(config): pick a node's fixed position by dropping a pin on a map #6174

Bug Fixes

fix: grant remote_admin from Users tab; BASE_URL trailing slashes #6381
fix(messages): release queued channel sends on the local radio ACK #6374
fix(backup): list unowned backups without a cross-table collation compare #6372
fix(ui): 4.17.3 review P7a — layout (N1 N2 N3 N7 N9 N10 N11 N12) #6367
fix(meshcore): 4.17.3 review P7b — not-connected state, danger button, header status, icons #6366
fix(ui): 4.17.3 review P5 — copy and polish #6362
fix(ui): 4.17.3 review P4 layout fixes #6361
fix(meshcore): 4.17.3 review P6 — decided policies (auto-trace alerts, split queue, timer channels, room login, gate retry, NeighborInfo age, digest) #6363
fix(meshcore): 4.17.3 review P3 — MeshCore senders #6360
fix(poll): one failing poll section no longer blanks nodes and channels #6358
fix(restore): skip startup retention purges on the boot that restores a backup #6357
fix(dashboard): connection banner names the viewed source's host:port #6356
fix(backup): skip backup columns the target table lacks on restore #6351
fix(mqtt): reject invalid MQTT root topics server-side on save #6344
fix(automations): Template Gallery node picker and multi-automation naming #6322
fix(meshcore): message length caps match firmware #6323
fix(meshcore): change room Auto-sync from the login card without logging in #6320
fix(meshcore): key-gate MQTT feed channel messages by filing them under their key #6318
fix(backup): device backups export only the backed-up source's channels #6284
fix(notifications): name the node of the notification's own source; skip meshcore_mqtt in key scans #6266
fix(meshcore): put the heard-by antenna back on the sent-message header row #6249
fix(neighborinfo): honor a direct traceroute for request eligibility #6248
fix(meshcore): dedupe room-server posts re-pushed on every sync #6247
fix(automation): emit MeshCore remote telemetry to trigger.telemetry #6238
fix: exclude firmware 2.8 NodeDB replays from clock offset samples #6243
fix(meshcore): merge DM heard-by across history/live like channels #6225
fix(meshcore): record heard hop count for repeater-ingested adverts #6221
fix(meshcore): preserve channel relay confirmations across stale updates #6212
fix(ui): enable sentence auto-capitalization in chat input #6217
Wait up to 30 s for Apprise to send a notification #6207
fix(ui): landscape section-nav rail for all SectionNav pages #6216
fix(automation): cut Meshtastic sends to 200 bytes #6203
fix(virtual-node): pass hopStart and viaMqtt through the message replay #6189
fix(reticulum): prune interfaces absent from the latest stats snapshot #6192
fix(meshcore): page DM & Room history per peer so it survives channel traffic #6187
fix(meshcore): don't prefix non-hashtag channel names with '# ' #6182
fix(virtual-node): don't relay own want_config_id burst to VN clients #6180
fix(virtual-node): ack-and-drop blocked addContact so app DMs don't stall 30s #6179
fix(mqtt-bridge): uplink a node's own map report instead of dropping it on the ok_to_mqtt gate #6176
fix(config): Reload Config re-reads MQTT map reporting and Report Location #6177

Security

feat(security): opt-in node-name anti-spam sanitizer #6383
fix(security): 4.17.3 review P1 — channel PSKs, source-delete secrets, gateway membership #6359
fix(bridge): bump msgpack to 1.2.3 for CVE-2026-114613 #6355

Tests and CI/DevOps

test: real coverage for gaps left by #6379 #6380
chore(tests): remove dead, tautological and duplicate tests #6379
ci: run the test suite as 3 shards per Node version #6378
perf(tests): faster CI test run — template test DB, lean setup, lazy fallbackManager, quiet logs, static-check job #6377
test(meshcore): advance fake timers until the timer run settles #6364
ci(desktop): macOS x64 release build on macos-latest #6317
ci(desktop): use macos-latest for the x64 build runner #6231

Documentation

docs: add AlsaMesh to Site Gallery #6369
docs(readme): refresh screenshots from the live demo and add a Screenshots section #6208
docs(automation): add Meshtastic ↔ Reticulum DM relay recipe #6204
docs(gallery): add Orbit and Launch Alert user script #6199

Dependencies and Translations

build(deps): bump i18next from 26.5.11 to 27.0.0 #6298
build(deps): bump @noble/curves from 1.9.7 to 2.4.0 #6300
build(deps): bump leaflet.heat from 0.2.0 to 1.0.0 #6296
Translations update from Hosted Weblate #6222
build(deps-dev): bump the vitest group across 1 directory with 3 updates #6291
build(deps): bump otplib from 13.5.0 to 13.6.0 #6295
build(deps): bump node-notifier from 11.0.0 to 12.1.0 #6297
build(deps): bump the production-dependencies group across 1 directory with 8 updates #6325
build(deps-dev): bump jsdom from 30.1.3 to 31.0.0 #6294
build(deps): bump i18next-browser-languagedetector from 8.2.3 to 8.3.0 #6299
build(deps): bump @tanstack/react-query from 5.105.0 to 5.107.1 #6301
build(deps): bump docker/login-action from 4.7.0 to 4.8.0 #6290
build(deps): bump softprops/action-gh-release from 3.0.3 to 3.0.4 #6292
build(deps): bump the codeql-action group with 4 updates #6289
Translations update from Hosted Weblate #6173
chore(deps): npm audit fix — retire reachable prod high-severity advisories #6198

Issues Resolved

#5893 MQTT Bridge: single mode rejected by broker (invalid Client ID), per_gateway evicted, and uplink fails
#5974 [BUG] Station G2 TCP source loops connect/disconnect forever; Passive Mode reconnects also dropped
#6121 [BUG] Reticulum: disabled interfaces stay Online and in the interface count
#6123 Bug/Feature Request: Empty MQTT Bridge sources and no visual distinction of nodes by source on Map
#6151 [BUG] 4.17.1-rc3 : Request Neighbors from direct node denies action ....
#6153 [FEAT] Meshtastic favorites: send add_contact before set_favorite_node so favorites stick on nodes missing from the target NodeDB
#6154 [FEAT] Meshtastic remote admin: free-form CLI console with output view
#6157 Firmware #12281: decode and show DeviceMetadata.ble_address (needs protobufs bump)
#6159 [FEAT] MeshCore Companion: decrypt GRP_TXT from OTA packet log with virtual channel keys
#6160 [FEAT] Virtual Node: replay missed text messages when the Android app reconnects
#6161 [BUG] Virtual Node: the hourly node DB refresh makes the Android app lose its channel names
#6162 [BUG] Virtual Node: DMs sent from the web show up in a new chat in the Android app
#6163 [BUG] Virtual Node: every DM from the Android app waits 30 s because the blocked addContact gets no ack
#6164 [BUG] createFromRadioTextMessage takes the node number as the packet id
#6165 [i18n] es.json: 8 broken placeholders, and a complete Spanish translation available
#6170 [FEAT] MeshCore: don't prefix non-hashtag channel names with '# '
#6175 Backend does not track specific bridge sources for "Colour nodes by source" feature
#6178 [FEAT] MeshCore: per-source Required Repeater gate for message resend
#6185 [FEAT] MeshCore: add Public Key sort to node/DM list
#6186 [BUG] MeshCore DM history disappears once 100 newer messages arrive (DM view reads shared 100-message window)
#6190 [FEAT] MeshCore Packet Decode: resolve relay chain per hop (and drop redundant Resolved row in Message Route)
#6194 [FEAT] MeshCore: show heard repeaters for sent DMs
#6195 [FEAT] MeshCore: store source device private key (encrypted) for backup and server-side decrypt
#6202 [BUG] Automation Engine sends long text to Meshtastic without the 200-byte cut the other senders apply
#6214 [FEAT] Relative time tooltip on message timestamp hover
#6220 [BUG] MeshCore Repeater: advert-ingested nodes never get a hop count (path_len NULL → shown as 0 hops)
#6223 [FEAT] MeshCore Auto Responder: add inline Script Management panel (parity with Meshtastic)
#6224 [FEAT] Umbrella: MeshCore Automation parity with Meshtastic (Welcome, Delete by Distance, Favorite, Time Sync, Telemetry)
#6226 [FEAT] Audit: Meshtastic ↔ MeshCore feature parity across MeshMonitor
#6228 [UX] MeshCore channel list: distinct markers for Private (lock) and Public channels instead of hashtag
#6230 [FEAT] Timer Triggers: allow multiple channels (like Auto Responder) for Meshtastic and MeshCore
#6232 [FEAT] HOST env var to set the bind address
#6237 [BUG] Automation Telematry triggers never fires
#6239 [BUG] MeshCore: heard-by antenna moved to its own line below sent messages in 4.17.3-rc3
#6242 [BUG] Clock Offset chart spikes: firmware 2.8 NodeDB replays are sampled as clock skew
#6245 [SUPPORT] MeshMonitor v4.17.2 update and python scripts problems
#6246 [BUG] MeshCore room posts are not deduplicated: a room server re-pushing a post creates a new row on every sync
#6250 [FEAT] Analyzer Observer: per-broker option to skip TLS certificate verification (self-signed brokers)
#6251 [BUG] Notification "Prefix with node name" uses the Meshtastic primary's name for every source
#6252 [BUG] Duplicate-key scanner runs on meshcore_mqtt sources
#6253 [FEAT] MeshCore: message, server-event and trace notifications
#6254 [FEAT] MeshCore Security view (dead contacts, hash collisions, advert signatures, key change)
#6255 [FEAT] MeshCore Repeater: structured local settings and danger zone
#6256 [FEAT] MeshCore remote admin: structured config for Repeater / Room Server
#6257 [FEAT] MeshCore Companion: BLE PIN, factory reset, config backups, channel QR share
#6258 [FEAT] MeshCore Settings: telemetry retention, purge/outliers, node display; global items without a Meshtastic source
#6259 [FEAT] MeshCore Nodes and DM lists: sort, columns, filters, export
#6260 [FEAT] MeshCore map parity: shared layers, trace on map, Map Analysis, estimated positions
#6261 [FEAT] MeshCore messaging: Room unread, DM/Room mute, mark-all-read, translation, emoji picker
#6262 [FEAT] MeshCore Packet Monitor paging/search/charts and contact hop/signal graphs
#6263 [FEAT] MeshCore in Dashboard widgets, Mesh Issues, Prometheus, v1 API and embed maps
#6265 Feat(meshcore): show origin node name in Packet Monitor list view
#6267 [FEAT] MeshCore: change room Auto-sync without logging in (unreachable rooms)
#6271 [BUG] Template Gallery: Device Health 'Only watch these nodes' picker is empty (nodes={[]})
#6272 [UX] Template Gallery: Device Health Name/Description prefill with low-battery text; use generic seed + per-alert prefix
#6273 [FEAT] Device Health: alert when a MeshCore repeater's clock is out of sync
#6274 [FEAT] MeshCore: confirmed new-neighbor alert (N zero-hop adverts within a window) to filter ducting
#6276 [FEAT] Traceroute Explorer: include MeshCore traces
#6278 [FEAT] Configurable message text length in notifications (hardcoded 100-char cut)
#6279 [FEAT] Mesh Issues: protocol-neutral rules (stale, no position, low battery, bad position)
#6281 [FEAT] MeshCore Security P7b: advert/packet rates, clock-offset flag, digest, export, notification DM
#6282 [FEAT] MeshCore send API: optional senderName override for channel messages
#6285 [FEAT] Protocol-aware, per-source device-config backups (MeshCore Companion + Meshtastic) — P8b
#6287 [FEAT] MQTT root topic finder (follow meshtastic/design#167, like Apple Find Topics)
#6303 [BUG] MeshCore channel message cap ignores node-name prefix (fixed 130/120 vs firmware 160 − name − 2)
#6304 [BUG] MeshCore DM cap is 150 bytes but firmware allows 160
#6306 [FEAT] MeshCore Repeater: new-node notifications from adverts
#6307 [FEAT] MeshCore MQTT sources: Notifications tab
#6308 [FEAT] MeshCore MQTT ingest: file slot-decrypted channel rows under a keyed index
#6316 [FEAT] MeshCore: split long messages in Auto Responder, Timer Triggers, Auto Announce, and Automation Engine (parity with Meshtastic)
#6319 [BUG] Virtual node isn't working with meshcore
#6330 [FEAT] Meshtastic Auto Responder multiline: use the shared splitter (part cap, (i/N) markers)
#6332 [FEAT] MeshCore Rooms: show stored posts read-only without a live login
#6335 MQTT root finder: MeshCore IATA region finder
#6336 MQTT root finder: offline geocoder for subdivision and city rows (phase 2)
#6337 MQTT root finder: live refresh of the community root directory
#6338 Reject invalid MQTT root topics server-side on config save
#6348 [FEAT] Dashboard chart widget: user-set Y-axis min/max
#6350 [BUG] System restore fails on backup columns the target table lacks (legacy camelCase map-pref columns)
#6352 [SECURITY] Bump msgpack to 1.2.3 in bridge (CVE-2026-114613)
#6353 [BUG] Connection Error banner shows the env placeholder IP, not the source's host
#6354 [BUG] Restoring an old backup purges all its telemetry on first boot
#6368 Site Gallery Submission AlsaMesh
#6370 [FEAT] MeshCore: import/export MeshCore One contact-share tokens pubkey:type:name
#6373 Queued channel messages always report "ACK timeout" even though the radio confirms delivery
#6382 Anti-Spam: Sanitize longName and shortName on NodeInfo ingestion (RF and MQTT)

New Contributors

Thank you to everyone who sent their first merged PR in this release:

@williavs: BIND_ADDRESS env var, the Meshtastic ↔ Reticulum DM relay recipe and the 200-byte automation cut (#6233, #6204, #6203)
@mkrzywonski: MeshCore Repeater hop counts (#6221)
@AgentXenAI: sentence auto-capitalization in chat input (#6217)
@framortej: Virtual Node hop count and MQTT origin in message replay (#6189)

Thanks also to returning contributors @maxhayim and @enricolorenzoni59.

Upgrade notes

Migrations 223 to 232 run on start on SQLite, PostgreSQL and MySQL.
MeshCore Room Servers: selecting a room no longer logs in. Press Login to post or fetch new posts.
Device backups: download and create need configuration:write on the source (was read). The old global schedule moves to the primary Meshtastic source; other sources start with backups off. Older files go to the only Meshtastic source if there is exactly one, otherwise they are admin-only. Older backup files keep the private key; delete them if that matters to you.
Security digests: digest settings now save per source with a global fallback. An install with a global Apprise URL starts to receive MeshCore security digests, one per day when there are issues. The API digest call needs a sourceId.
Security permissions: security issues, export and key-mismatch reads need nodes:read on the source.
Automatic-trace notifications default to off.
MeshCore timers: at most 4 channels per timer, 10 seconds apart. Extra channels skip with a log warning.
MeshCore DM alerts: existing MeshCore push subscribers start to receive DM and room-post alerts. Turn off Direct messages and room posts on the source's Notifications tab to stop them.
Repeater new-node alerts: a Repeater source whose Newly Found Nodes toggle was saved as on starts alerting after a 48 hour learning period, capped at 10 an hour.
Meshtastic DM mute now also silences push and Apprise alerts for that DM.
Automations: trigger.telemetry automations with no source filter also fire on MeshCore readings.
MQTT root: saving a changed root that fails validation returns HTTP 400 (INVALID_MQTT_ROOT). Unchanged roots and restores still save.
v1 API: MeshCore traceroute rows are round trips, as described under Changed.

Full changelog: v4.17.2...v4.17.3