v1.0.0 "reticulum"

This is the first stable release of the radio-mesh app suite Potato Mesh v1.0.0! 🎉

This release adds experimental Reticulum support along to the existing Meshtastic and Meshcore features. By default it only listens to RNode interfaces but it can be overwritten in environment. (HT @eknuth)

The other noteworthy change is a full interface overhaul. A lot of legacy information and visual overload was removed and in some places complemented by actual useful information (e.g., hops, paths, scope).

The remainder of this release is a lot of bug fixes, security hardening, and performance gains. (HT @tonghuaroot & @CardoSystems)

Take a look: https://potatomesh.net/

What's Changed

• Add Reticulum protocol support to the web tier by @eknuth in #889
• Add Reticulum announce ingestor provider by @eknuth in #890
• fix reticulum protocol loose ends from #888 review by @l5yth in #893
• web: add reticulum frontend support by @l5yth in #894
• Derive the Reticulum ingestor's own node id; scope CONNECTION out (#888) by @eknuth in #896
• data,web: key Reticulum nodes on identity; discover host aspects by @l5yth in #897
• docs: correct .env.example's reticulum node id derivation (RE8) by @eknuth in #898
• web: reticulum aspects, identity groups, identity page, honest detail views by @l5yth in #899
• data,web: Reticulum finalization — radio metadata, chat tags, federation zeros by @l5yth in #900
• harden: fix SSRF guard bypass via IPv6 transition addresses by @l5yth in #902
• docs: trim operator docs to instructions, close doc/behavior drift by @l5yth in #904
• Add MESHCORE_TELEMETRY_POLL_24H_EXEMPT cooldown exemption for telemetry by @nicjansma in #905
• docker,docs: resync the root Dockerfile and add a security policy by @l5yth in #907
• data,docs: pipe MESHCORE_TELEMETRY_POLL_24H_EXEMPT through every deployment by @l5yth in #908
• web: keep the mobile channel select alive across live refreshes (#882) by @l5yth in #910
• data: listen on both Meshtastic UDP multicast groups by default (#903) by @l5yth in #909
• matrix: add crates.io package metadata (#879) by @l5yth in #911
• data,web: honor channel filters on every packet and the node list; add DROP_VIA_MQTT (#784, #884) by @l5yth in #913
• web,data: stop MeshCore chat text from minting or reviving nodes (#883) by @l5yth in #912
• web: dedup MeshCore channel copies whose sender resolved differently (#880) by @l5yth in #914
• ci,deps: run Dependabot for every ecosystem and lock production builds by @l5yth in #915
• build(deps): bump websocket-driver from 0.8.0 to 0.8.2 in /web by @dependabot[bot] in #940
• build(deps): bump flutter_svg from 2.2.3 to 2.3.0 in /app by @dependabot[bot] in #936
• build(deps): bump docker/setup-qemu-action from 3 to 4 by @dependabot[bot] in #931
• build(deps): bump tokio from 1.49.0 to 1.50.0 in /matrix by @dependabot[bot] in #928
• build(deps): bump sqlite3 from 2.9.5 to 2.9.6 in /web by @dependabot[bot] in #939
• build(deps): bump serial_test from 3.3.1 to 4.0.1 in /matrix by @dependabot[bot] in #925
• build(deps): bump concurrent-ruby from 1.3.6 to 1.3.7 in /web by @dependabot[bot] in #938
• chore: bump version 0.7.6 by @l5yth in #927
• build(deps): bump actions/cache from 4 to 6 by @dependabot[bot] in #918
• build(deps): bump actions/setup-python from 5 to 7 by @dependabot[bot] in #920
• build(deps): bump tracing-subscriber from 0.3.22 to 0.3.23 in /matrix by @dependabot[bot] in #919
• build(deps): bump tempfile from 3.24.0 to 3.27.0 in /matrix by @dependabot[bot] in #922
• build(deps): bump clap from 4.5.54 to 4.5.60 in /matrix by @dependabot[bot] in #924
• build(deps): bump actions/download-artifact from 4 to 8 by @dependabot[bot] in #929
• build(deps): bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #930
• build(deps): bump flutter_native_splash from 2.4.7 to 2.4.8 in /app by @dependabot[bot] in #932
• build(deps): bump workmanager from 0.9.0+3 to 0.10.10 in /app by @dependabot[bot] in #934
• build(deps): bump nokogiri from 1.19.2 to 1.19.4 in /web by @dependabot[bot] in #937
• build(deps): bump package_info_plus from 9.0.0 to 10.2.2 in /app by @dependabot[bot] in #933
• build(deps): bump rack-session from 2.1.1 to 2.1.2 in /web by @dependabot[bot] in #941
• build(deps): bump prometheus-client from 4.2.5 to 5.0.0 in /web by @dependabot[bot] in #923
• data,ci: run the ingestor image on Python 3.13 and test 3.13 and 3.14 by @l5yth in #942
• web: honor the node opt-out marker on /api/destinations by @l5yth in #943
• data: retry the Reticulum host id through the provider every loop by @l5yth in #944
• app: bump flutter_local_notifications to 22.3.1 by @l5yth in #945
• chore: bump version to 0.8.0 by @l5yth in #946
• build(deps): bump erb from 4.0.4 to 6.0.7 in /web by @dependabot[bot] in #916
• build(deps): bump puma from 7.2.0 to 8.0.2 in /web by @dependabot[bot] in #921
• build(deps): bump cachix/install-nix-action from 30 to 31 by @dependabot[bot] in #953
• build(deps): bump anyhow from 1.0.100 to 1.0.104 in /matrix by @dependabot[bot] in #949
• build(deps): bump docker/build-push-action from 5 to 7 by @dependabot[bot] in #955
• build(deps): bump serde from 1.0.228 to 1.0.229 in /matrix by @dependabot[bot] in #950
• build(deps): bump docker/login-action from 3 to 4 by @dependabot[bot] in #960
• build(deps): bump serde_json from 1.0.149 to 1.0.151 in /matrix by @dependabot[bot] in #948
• build(deps): bump toml from 0.9.11+spec-1.1.0 to 1.1.6+spec-1.1.0 in /matrix by @dependabot[bot] in #952
• build(deps): bump shared_preferences from 2.5.3 to 2.5.5 in /app by @dependabot[bot] in #959
• build(deps): bump rustls from 0.23.36 to 0.23.45 in /matrix by @dependabot[bot] in #962
• nix: add rns to the flake ingestor and update the nixpkgs pin by @l5yth in #963
• build(deps): bump shared_preferences_android from 2.4.17 to 2.4.28 in /app by @dependabot[bot] in #956
• data: ingest only RNode interfaces by default under PROTOCOL=reticulum by @l5yth in #964
• build(deps): bump codecov/codecov-action from 5 to 7 by @dependabot[bot] in #961
• build(deps): bump docker/setup-buildx-action from 3 to 4 by @dependabot[bot] in #954
• data: refresh the Reticulum host's own destinations every hour by @l5yth in #969
• build(deps): bump shared_preferences_foundation from 2.5.6 to 2.5.7 in /app by @dependabot[bot] in #957
• build(deps-dev): bump simplecov from 0.22.0 to 1.3.2 in /web by @dependabot[bot] in #926
• build(deps): bump url_launcher from 6.3.2 to 6.3.3 in /app by @dependabot[bot] in #958
• tests: make the Reticulum host-id canonicalisation check able to fail by @l5yth in #965
• docs: scope Reticulum as experimental and announce-only by @l5yth in #966
• matrix: bump axum to 0.8.9 by @l5yth in #970
• web,matrix,app: name Reticulum as a known protocol in every consumer by @l5yth in #967
• build(deps): bump ferrum from 0.17.2 to 0.18.0 in /web by @dependabot[bot] in #917
• web,data: stop Reticulum destination placeholders from renaming by @l5yth in #968
• web: add mesh.dmz.pt as a federation seed node by @l5yth in #971
• web: drop potatomesh.jmrp.io as federation seeds by @l5yth in #972
• docs: describe the RA10/RE10 placeholder rules where they changed by @l5yth in #973
• app: use caret ranges for the shared_preferences platform deps by @l5yth in #974
• ci: upload test results with codecov-action v7 and move to checkout v7 by @l5yth in #975
• repo: move .claude to the spec tree by @l5yth in #976
• build(deps): bump mockito from 1.7.1 to 1.7.2 in /matrix by @dependabot[bot] in #977
• build(deps): bump tower from 0.5.2 to 0.5.3 in /matrix by @dependabot[bot] in #978
• build(deps): bump actions/setup-node from 4 to 7 by @dependabot[bot] in #979
• build(deps): bump softprops/action-gh-release from 2 to 3 by @dependabot[bot] in #980
• web: keep opted-out nodes out of /metrics by @l5yth in #981
• web: list only protocols in view in the map legend by @l5yth in #983
• data,web: capture MeshCore message path, RSSI and scope (#765) by @l5yth in #984
• web: scope Reticulum destination counts and floor /api/destinations by @l5yth in #982
• web: keep nodes-table rows and their state across live refreshes (#881) by @l5yth in #985
• web: keep the chat reader's place across live refreshes (#881) by @l5yth in #992
• web: keep map overlays open and repaint only what changed (#881) by @l5yth in #988
• web: stack the Reticulum legend group under MeshCore by @l5yth in #986
• web: keep federation peers for 7 days; pin 24-hour counts by @l5yth in #990
• web: check relayed federation records against the domain's key by @l5yth in #989
• data,web: put the Reticulum host on the map from its RNS config by @l5yth in #991
• data,web: use the receive time when the radio clock is off; cap battery by @l5yth in #987
• data,web: bind node rows to their key and records to their sender by @l5yth in #998
• data: check MeshCore RX-log adverts against their signatures by @l5yth in #996
• web,data: cap ingested strings by column and check node ids by @l5yth in #997
• web: serve no row of a hidden client in private mode by @l5yth in #993
• web,matrix: mark name-matched MeshCore senders as unverified by @l5yth in #999
• web: sandbox the OG capture and harden frontend escaping and lookups by @l5yth in #994
• data: let operators limit which hosts may send UDP packets by @l5yth in #995
• web: fetch each federation peer once per crawl and cooldown by @l5yth in #1000
• data: name MeshCore flood scopes from a built-in region table by @l5yth in #1001
• data: log why a Reticulum ingestor hears nothing; close failed connects by @l5yth in #1002
• data: lock mesh.sh venv installs and skip pip when nothing changed by @l5yth in #1003
• web: hide the unverified marker, show ?? for unknown scope, space legend by @l5yth in #1004
• data,web: queue uploads per instance and retry each on its own by @l5yth in #1005
• data: keep CodeQL off a blank UDP group and a test channel name by @l5yth in #1006
• web: draw the page chrome from one grey family of tokens by @l5yth in #1008
• data: keep snapshot node ages when the radio clock is off by @l5yth in #1007
• web: put table units in headers, align node views, fit phones by @l5yth in #1010
• web: chat lines lead with the time and text; tidier tab bar and panel by @l5yth in #1012
• web: unpin the phone footer, list pages in the menu, fix banner/header by @l5yth in #1013
• web: honour hidden, 44px touch targets, focus ring, named live toggle by @l5yth in #1009
• chore: bump version to 1.0.0 by @l5yth in #1011
• web: quiet map legend, themed zoom, role words, one overlay chrome by @l5yth in #1014
• chore: remove the Flutter app and its CI by @l5yth in #1015
• data: MeshCore scope table adds five German community regions by @l5yth in #1016
• build(deps): bump rns from 1.5.6 to 1.5.7 in /data by @dependabot[bot] in #1017
• build(deps-dev): bump black from 26.5.1 to 26.10.0 in /data by @dependabot[bot] in #1018
• web: banner and meta row keep the gutter, one footer row on desktop by @l5yth in #1020
• web: nodes table and static pages fit phones with long words by @l5yth in #1021
• web: one Log line anatomy, kind words, folded bursts by @l5yth in #1022
• data: MeshCore contacts post once per connect by @l5yth in #1024
• web: CSP and referrer policy, pinned scheme, scrubbed capture env by @l5yth in #1025
• web: a reused packet id never rewrites another node's rows by @l5yth in #1026
• web: atomic instance rows, crawl survives bad entry, keyfile fails loud by @l5yth in #1029
• web,data: bound neighbor and trace lists, coordinates, and odd sections by @l5yth in #1028
• web: the node filter repaints once typing pauses by @l5yth in #1030
• web: bound the Meshtastic payload decoder per request and process by @l5yth in #1027
• web: map tooltips build on open, one shared segmenter by @l5yth in #1031
• data: debug capture keeps metadata only and rotates by @l5yth in #1032
• web: canonical aggregate windows, rx_time predicates, bounded keys by @l5yth in #1038
• web: the node overlay reads roles from the dashboard's node registry by @l5yth in #1033
• web: route-labelled requests, scrape-time node series, true node count by @l5yth in #1034
• web,data: Reticulum interface names never carry peer addresses by @l5yth in #1035
• web: schema upgrades fail loudly, reach parity, index nodes.num by @l5yth in #1036
• web: one bounded initial load before the stream, no stale seed by @l5yth in #1037
• web: serve node public keys on the node read API by @l5yth in #1023
• web: chat history pages join the backfill's idle repaint by @l5yth in #1039
• web: keep the database open between requests, wait without the GVL by @l5yth in #1041
• web: bound the federation peer set, judge freshness on our clock by @l5yth in #1042
• web: race specs spawn the racing boot and hold its lock until released by @l5yth in #1044
• docs: centered README head with the 1.0 screenshot by @l5yth in #1043
• web: warm loads show every row; the cache writes changed rows only by @l5yth in #1045
• web: refused streams poll and retry; hidden tabs free their stream by @l5yth in #1046
• build(deps): bump serde_json from 1.0.151 to 1.0.152 in /matrix by @dependabot[bot] in #1047
• build(deps): bump toml from 1.1.6+spec-1.1.0 to 1.1.8+spec-1.1.0 in /matrix by @dependabot[bot] in #1048
• build(deps-dev): bump black from 26.10.0 to 26.10.1 in /data by @dependabot[bot] in #1049
• web,data: timeout specs hold their jobs on gates, not fixed sleeps by @l5yth in #1050
• web: keep federation on https, v1 counts from origin, close timeouts by @l5yth in #1051
• web: ingest POSTs take JSON only; no path takes a form body by @l5yth in #1052
• web: specs leave no temp dirs; a leaking spec fails the run by @l5yth in #1053
• web: delta reads and empty lists revalidate instead of reusing a cache by @l5yth in #1054
• web: one transaction per ingest batch, skipping a record that fails by @l5yth in #1055
• ci: each suite fails when coverage drops below its floor by @l5yth in #1056
• web,data: delete code no input reaches and raise the Ruby floor by @l5yth in #1057
• web: boot without INSTANCE_DOMAIN, and build the armv7 image without Chromium by @l5yth in #1058
• docs: put the unreleased CHANGELOG items under a v1.0.0 header by @l5yth in #1059

New Contributors

• @eknuth made their first contribution in #889

Full Changelog: v0.7.5...v1.0.0