chore(release): bump version to 4.6.3 by Yeraze · Pull Request #3111 · Yeraze/meshmonitor

Yeraze · 2026-05-20T18:23:01Z

Summary

Cuts the v4.6.3 patch release. Five files bumped per the CLAUDE.md recipe (package.json, package-lock.json regenerated, helm/meshmonitor/Chart.yaml, desktop/src-tauri/tauri.conf.json, desktop/package.json), CLAUDE.md banner line updated, CHANGELOG entry added, and a release blog post written for docs/blog/.

Scope of 4.6.3

Six PRs merged since 4.6.2-1:

fix(unified): preserve tapback metadata across MQTT ingest + cross-source merge #3105 fix(unified) — preserve tapback metadata across MQTT ingest + cross-source merge.
docs(claude): drop worktree restriction #3106 docs(claude) — drop worktree restriction from CLAUDE.md.
fix(meshcore): persist contact advType to meshcore_nodes (#3092) #3107 fix(meshcore) — persist contact advType to meshcore_nodes (closes [BUG] MeshCore telemetry retrieval fails on every repeater (meshcore-only setup, v4.6.1) #3092 for users with repeaters that don't anonymously answer LPP).
feat(mqtt): route MQTT channel permissions through channel_database #3108 feat(mqtt) — route MQTT channel permissions through channel_database (Virtual Channel Permissions).
fix(users): readable MQTT permissions hint banner (Catppuccin vars) #3109 fix(users) — Catppuccin variables for the MQTT permissions hint banner.
fix(mqtt): stamp node.channel on ingest so the map honors VC permissions #3110 fix(mqtt) — stamp node.channel on ingest + channel-gate traceroutes and neighbor-info (the "No nodes visible" + floating-lines fix).

Blog post focus

Per the request, the blog post focuses on the permissions story — what changed in the Users tab for MQTT scopes, why maps may have gone empty after upgrading, the floating-lines fix, and the action items operators should take after upgrading (chiefly: grant Anonymous + non-admin users View on Map and Read on Virtual Channel Permissions for the relevant channel-database rows).

Test plan

Verify the five version files all show 4.6.3.
Confirm CHANGELOG renders the new section above 4.6.2-1.
Confirm the blog post appears on meshmonitor.org/blog/ after deploy.
CI green.

🤖 Generated with Claude Code

Five user-visible files bumped per the CLAUDE.md version recipe: package.json, package-lock.json (regenerated), helm/meshmonitor/Chart.yaml, desktop/src-tauri/tauri.conf.json, desktop/package.json. CLAUDE.md banner line bumped to match. CHANGELOG entry covers the five PRs since 4.6.2-1: - #3105 unified tapback metadata fix - #3106 docs: drop worktree restriction - #3107 meshcore contact advType persistence - #3108 MQTT channel permissions via channel_database - #3109 hint banner Catppuccin restyle - #3110 node.channel ingest + traceroute/neighbor channel gate Companion blog post (docs/blog/2026-05-20-v4.6.3-permissions.md) walks operators through the new Virtual Channel Permissions flow, the map-visibility behavior change, and the floating-lines fix. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

github-actions · 2026-05-20T18:23:19Z

Claude encountered an error —— View job

PR Review in Progress

Reviewing this version bump PR for v4.6.3. I'll provide feedback on code quality, potential issues, and adherence to project standards.

Review Checklist:

Gather context and read changed files
Verify version consistency across all 5 required files
Review CHANGELOG entry format and content
Review blog post content and structure
Check CLAUDE.md changes
Provide comprehensive feedback summary

github-actions · 2026-05-20T18:24:52Z

Claude finished @Yeraze's task —— View job

PR Review Complete ✅

I've completed a comprehensive review of this v4.6.3 version bump PR. Overall, this is a well-executed version bump that follows project conventions correctly.

Review Checklist:

Gather context and read changed files
Verify version consistency across all 5 required files
Review CHANGELOG entry format and content
Review blog post content and structure
Check CLAUDE.md changes
Provide comprehensive feedback summary

✅ Strengths

Perfect Version Consistency: All 5 required files correctly updated to 4.6.3:

package.json:3 ✅
package-lock.json (multiple entries) ✅
helm/meshmonitor/Chart.yaml:5,6 (both version and appVersion) ✅
desktop/src-tauri/tauri.conf.json:4 ✅
desktop/package.json:4 ✅

Excellent CHANGELOG Entry: Well-structured with clear categorization (Features/Fixes/Docs), proper PR references (#3105-#3110), and detailed technical explanations. Follows Keep a Changelog format perfectly.

Outstanding Blog Post: The blog post at docs/blog/2026-05-20-v4.6.3-permissions.md is exceptionally well-written:

Clear problem/solution narrative focusing on MQTT permissions
Excellent technical explanation of the channel-database architecture change
Actionable troubleshooting guidance ("Why your map went empty")
Proper frontmatter with all required fields
User-friendly action items for post-upgrade tasks

Proper CLAUDE.md Update: Version banner correctly updated from 4.6.2 to 4.6.3 (line 3).

🔍 Code Quality Assessment

Adherence to Project Standards: Perfect compliance with CLAUDE.md versioning recipe - all 5 files updated as specified.

Documentation Quality: Both CHANGELOG and blog post demonstrate strong technical writing with clear explanations of complex permission system changes.

Release Scope Appropriateness: The scope is well-suited for a patch release - focused bug fixes and permission system improvements without breaking changes.

🚀 Final Assessment

This version bump PR demonstrates excellent release engineering practices:

Complete version file coverage
High-quality documentation
Clear scope and rationale
User-focused communication in the blog post

Recommendation: APPROVE ✅
This PR is ready for merge with no changes required.

github-actions · 2026-05-20T18:31:03Z

System Test Results

MeshMonitor System Test Results

Test Run: 2026-05-20 14:31:00 EDT

❌ Overall Result: FAILED

Aborted on first failing test (fail-fast mode). Remaining tests skipped.

Failed Test

Quick Start Test

The desktop sub-project carries its own lockfile and the bump to 4.6.3 left it pinned to 4.6.1. The Windows Desktop CI job runs `npm install` without `--legacy-peer-deps` and fails on the package.json / package-lock.json version mismatch. Regenerate to match. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

github-actions · 2026-05-20T18:31:42Z

Claude finished @Yeraze's task —— View job

PR Review Complete ✅

I've completed a comprehensive review of this v4.6.3 version bump PR. This is a well-executed version bump that demonstrates excellent release engineering practices.

Review Checklist:

Read and analyze all changed files
Verify version consistency across all 5 required files
Review CHANGELOG entry format and content
Review blog post content and structure
Check CLAUDE.md changes
Analyze potential causes for system test failure
Provide comprehensive feedback summary

✅ Code Quality & Best Practices

Perfect Version Consistency: All 5 required files correctly updated to 4.6.3:

package.json:3 ✅
package-lock.json:3,9 ✅
helm/meshmonitor/Chart.yaml:5,6 (both version and appVersion) ✅
desktop/src-tauri/tauri.conf.json:4 ✅
desktop/package.json:4 ✅
desktop/package-lock.json:3,9 ✅

Adherence to Project Standards: Perfect compliance with CLAUDE.md versioning recipe - all 5 files updated exactly as specified.

✅ Documentation Quality

Excellent CHANGELOG Entry: Well-structured with:

Clear categorization (Features/Fixes/Docs)
Proper PR references (fix(unified): preserve tapback metadata across MQTT ingest + cross-source merge #3105-fix(mqtt): stamp node.channel on ingest so the map honors VC permissions #3110)
Detailed technical explanations of complex permission system changes
Follows Keep a Changelog format perfectly

Outstanding Blog Post (docs/blog/2026-05-20-v4.6.3-permissions.md):

Clear problem/solution narrative focusing on MQTT permissions
Excellent technical explanation of the channel-database architecture change
User-friendly troubleshooting guidance ("Why your map went empty")
Proper frontmatter with all required fields
Actionable post-upgrade guidance

Proper CLAUDE.md Update: Version banner correctly updated from 4.6.2 to 4.6.3 (line 3).

🔍 Security & Performance Assessment

Security: No security concerns identified. This is a version bump with documentation updates only.

Performance: No performance implications from this version bump itself. The underlying features (MQTT permissions, channel routing) were implemented in prior PRs.

⚠️ System Test Failure Analysis

The Quick Start Test failure is likely unrelated to this version bump since:

No functional code changes - only version numbers and documentation
Environmental factors - The test uses TEST_NODE_IP="${TEST_NODE_IP:-192.168.5.106}" which may not be reachable in CI
Network-dependent test - Quick start tests typically require actual Meshtastic node connectivity

Recommendation: This failure appears environmental rather than code-related. The version bump itself is solid.

✅ Test Coverage Assessment

No test coverage concerns for this PR type:

Version bumps don't require new tests
Underlying features were tested in their original PRs (fix(unified): preserve tapback metadata across MQTT ingest + cross-source merge #3105-fix(mqtt): stamp node.channel on ingest so the map honors VC permissions #3110)
CHANGELOG and documentation changes are appropriate

🚀 Final Assessment

Recommendation: APPROVE ✅

This version bump PR demonstrates excellent release engineering:

Complete version file coverage
High-quality documentation
Clear release scope and rationale
User-focused communication in the blog post

The system test failure appears to be environmental/network-related rather than caused by the version bump changes.

github-actions · 2026-05-20T18:39:05Z

System Test Results

MeshMonitor System Test Results

Test Run: 2026-05-20 14:39:03 EDT

❌ Overall Result: FAILED

Aborted on first failing test (fail-fast mode). Remaining tests skipped.

Failed Test

Quick Start Test

github-actions · 2026-05-20T18:52:44Z

System Test Results

MeshMonitor System Test Results

Test Run: 2026-05-20 14:52:41 EDT

❌ Overall Result: FAILED

Aborted on first failing test (fail-fast mode). Remaining tests skipped.

Failed Test

Quick Start Test

github-actions · 2026-05-20T21:24:36Z

System Test Results

MeshMonitor System Test Results

Test Run: 2026-05-20 17:24:34 EDT

Test Summary

Test Suite	Result
Configuration Import	✅ PASSED
Quick Start Test	✅ PASSED
Security Test	✅ PASSED
V1 API Test	✅ PASSED
Reverse Proxy Test	✅ PASSED
Reverse Proxy + OIDC	✅ PASSED
Virtual Node CLI Test	✅ PASSED
Backup & Restore Test	✅ PASSED
Database Migration Test	✅ PASSED
DB Backing Consistency	✅ PASSED
API Exercise (3 DBs)	✅ PASSED

✅ Overall Result: PASSED

All deployment configurations are working correctly!

Test Details

Configuration Import:

Tests configuration import and device reboot cycle
Verifies channel roles, PSKs, and LoRa configuration
Note: Channel name verification skipped due to architectural limitation

Quick Start Test:

Zero-config deployment (no SESSION_SECRET or COOKIE_SECURE required)
HTTP access without HSTS
Auto-generated admin user with default credentials
Session cookies work over HTTP
Meshtastic node connection and message exchange verified

Security Test:

Verifies Node IP address hidden from anonymous users in API responses
Verifies MQTT configuration hidden from anonymous users
Verifies Node IP address visible to authenticated users
Verifies MQTT configuration visible to authenticated users
Verifies protected endpoints require authentication

V1 API Test:

Tests v1 REST API endpoints with Bearer token authentication
Verifies Bearer token requests bypass CSRF protection
Verifies POST/PUT/DELETE work without CSRF token when using Bearer auth
Verifies session-based requests still require CSRF token

Reverse Proxy Test:

Production deployment with COOKIE_SECURE=true
HTTPS-ready configuration
Trust proxy enabled for reverse proxy compatibility
CORS configured for HTTPS domain
Meshtastic node connection and message exchange verified

Reverse Proxy + OIDC Test:

OIDC authentication integration
Mock OIDC provider health checks
Authorization flow and session creation
Hybrid mode (OIDC + local auth)
Meshtastic node connection verified

Virtual Node CLI Test:

Virtual Node Server enabled on TCP port 4404
Meshtastic Python client successfully connects
Node data download and synchronization verified
Test message sent on gauntlet channel (index 3)
Message delivery confirmed via Web UI API
Virtual Node Server connection logging verified

Backup & Restore Test:

System backup created from running dev container
New container spun up with RESTORE_FROM_BACKUP env var
Data integrity verified (node count, message count, settings)
Restore event logged in audit log
Dev container unaffected by restore test

Database Migration Test:

SQLite to PostgreSQL migration verified
SQLite to MySQL migration verified
Data integrity confirmed for both target databases
Row counts match between source and target

DB Backing Consistency Test:

SQLite, PostgreSQL, and MySQL backends tested with same device
Node counts within ±10 across all three backends
Favorite counts identical across all backends
Key station verified as favorite on all backends

Yeraze added the system-test Trigger hardware system tests label May 20, 2026

Yeraze merged commit f63d708 into main May 20, 2026
24 of 26 checks passed

Uh oh!

Conversation

Yeraze commented May 20, 2026

Summary

Scope of 4.6.3

Blog post focus

Test plan

Uh oh!

github-actions Bot commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review in Progress

Review Checklist:

Uh oh!

github-actions Bot commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review Complete ✅

Review Checklist:

✅ Strengths

🔍 Code Quality Assessment

🚀 Final Assessment

Uh oh!

github-actions Bot commented May 20, 2026

MeshMonitor System Test Results

❌ Overall Result: FAILED

Failed Test

Uh oh!

github-actions Bot commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review Complete ✅

Review Checklist:

✅ Code Quality & Best Practices

✅ Documentation Quality

🔍 Security & Performance Assessment

⚠️ System Test Failure Analysis

✅ Test Coverage Assessment

🚀 Final Assessment

Uh oh!

github-actions Bot commented May 20, 2026

MeshMonitor System Test Results

❌ Overall Result: FAILED

Failed Test

Uh oh!

github-actions Bot commented May 20, 2026

MeshMonitor System Test Results

❌ Overall Result: FAILED

Failed Test

Uh oh!

github-actions Bot commented May 20, 2026

MeshMonitor System Test Results

Test Summary

✅ Overall Result: PASSED

Test Details

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions Bot commented May 20, 2026 •

edited

Loading

github-actions Bot commented May 20, 2026 •

edited

Loading

github-actions Bot commented May 20, 2026 •

edited

Loading