v0.51.0

Nodes upgrade independently: nothing on the air changes. Existing installs keep their settings. A brand new install now needs an app token before apps can use MQTT or REST.

The first start after upgrading builds some new database indexes. On a Pi with a long message history that can take a minute or more, once.

What you will notice

MCP is gone (#308, #344). The /mcp endpoint was unauthenticated and could change settings, transmit and read every message, and nothing was using it. It has been removed entirely rather than secured. It may come back later, behind proper authentication.

New installs require app tokens, and there is a page to make them (#316, #343). On a fresh install, MQTT and REST apps need a per-app token from the start. The new Tokens page on the dashboard creates a token for an app (shown once, with a copy button), lists the apps that have one, and revokes them. Revoking or replacing a token stops REST at once and drops the app's open MQTT connections. Existing installs keep whatever they had. The install docs now say plainly that the dashboard listens on every interface with no password until Setup is finished, and that the MQTT broker listens on every interface; bind to localhost or firewall them on an untrusted network.

A relay no longer floods (#295, #345). Over packet links, a node with no route for a message passing through used to start a fresh flood to every neighbour, including the one it came from, so one message could reach every node in the network. Now only the node that sent a message floods it. A relay with no route keeps it queued until a route turns up or it expires. A message is never sent back to the neighbour it came from, including a neighbour that calls through BPQ with its SSID inverted.

Saving settings no longer drops your links (#273, #346). Any save, including the TX STOP and RESUME buttons, used to close the connection to BPQ or XRouter, which dropped every live session on air. Now only a change to the bearer, callsign, node host, port or RHP login reconnects.

Also

• Forwarded and delivered messages are deleted 30 days after they finished, and drop records after 90 days, so the database and the dashboard stay quick (#286, #348).
• A repeated message id in the dropped list could stop the forwarder sending anything ever again, or wedge a neighbour's link at one message. Fixed, and delivered mail no longer shows as "ttl-expired" on the Dropped tab (#284, #285, #342).
• One malicious offer could make the node allocate about 2 GB. Message lengths are now capped at 16 MB per hop before anything is allocated (#262, #341).
• AGW: frame lengths are checked before allocating, one bad frame no longer drops every session, a dial can no longer hang the forwarder for ever, and a node with two AGW discovery ports hears beacons again (#274, #276, #278, #349).
• MQTT: an app can only publish under dapps/ to its own out and ack topics, so nobody can fake heartbeat or audit messages. An ack only marks the acking app's own messages; before, any app could stop another app's mail being forwarded. Reconnecting with the same client id keeps its auth. Refusals answer NotAuthorized on MQTT 5 (#291, #310, #311, #312, #350).
• Apps on the same node can still read each other's MQTT traffic. That is by design.

For app developers

• An app that acks a message that is not its own now gets 404 on REST, or NotAuthorized on MQTT 5.
• App names are lowercased and must be plain ASCII without /, +, # or spaces.

Known issues

• The optional meshcore routing algorithm still floods at relays and does not learn paths (#295, #296). The default routing is not affected.
• Route gossip can still advertise a route back to the neighbour it came from (#297). Mail caught by that now waits at the far node instead of being lost.