Skip to content

chore(release): open 4.14.0 - #4539

Merged
Yeraze merged 1 commit into
mainfrom
chore/release-4.14.0
Aug 3, 2026
Merged

chore(release): open 4.14.0#4539
Yeraze merged 1 commit into
mainfrom
chore/release-4.14.0

Conversation

@Yeraze

@Yeraze Yeraze commented Aug 3, 2026

Copy link
Copy Markdown
Owner

Version bump only — no code changes.

Why a minor, not another 4.13.3 rc

Since v4.13.2: 50 commits — 13 feat, 17 fix, 16 chore, 3 docs, 1 ci. No BREAKING CHANGE markers, no !: commits. Thirteen features on a patch number is the wrong shape.

The features aren't incidental:

Plus infrastructure users will feel: better-sqlite3 12 → 13 (N-API rework of the database driver) and MeshCore per-channel permission semantics (#4537 — additive, but grants behave differently).

It also unblocks a promise already made

Four docs say the v1 root paths are removed in 4.14 — api-reference.md, API.md, REST_API.md ("These paths will be REMOVED in 4.14. Migrate before upgrading.") and API_REFERENCE.md. Those paths are still live and still emitting Warning: 299.

#4189 removes them and has been held specifically until 4.14 opened. It is now unblocked — but merging it is a separate decision and is deliberately not part of this PR, because it turns 4.14.0 into a release that removes public API endpoints.

Changes

File
package.json 4.13.3-rc6 → 4.14.0
package-lock.json regenerated (--package-lock-only)
helm/meshmonitor/Chart.yaml version + appVersion
desktop/src-tauri/tauri.conf.json
desktop/package.json

Lockfile diff is the two version entries only — no dependency churn. git grep 4.13.3-rc6 is clean outside the changelog.

Note

This sets the version to a bare 4.14.0, as asked — not 4.14.0-rc1. If you'd rather stabilise through release candidates first (the 4.13.x line ran to rc6), that's a one-word change here before merge.

Per the release convention, this carries the system-test label.

🤖 Generated with Claude Code

https://claude.ai/code/session_01L9NzRtqE8eSMS8tvAeodUB

@Yeraze @claude
chore(release): open 4.14.0
77d33f3 
The 4.13.3 line had accumulated 13 `feat` commits since v4.13.2 — a minor
release's worth of work carried on a patch number.

Among them: the Analyzer Observer subsystem (#4457, three phases), the unified
per-source navigation and Meshtastic phone bottom bar (#4473), admin ACK
outcomes with opt-in auto-retry (#4487/#4492), position provenance on Node
Details (#4432/#4498), MeshCore SNR/RSSI on messages (#4504) and discovery
results (#4516), and Packet Monitor type-to-filter (#4512). Infrastructure
users will feel too: better-sqlite3 12 -> 13 (N-API rework of the DB driver)
and MeshCore per-channel permission semantics (#4537).

Opening 4.14 also makes good on a deprecation the docs promise in four places
("These paths will be REMOVED in 4.14"): the v1 root-path shims and the
/api/upgrade 410s. PR #4189 removes them and has been held for exactly this.
It is a separate decision and is NOT part of this commit.

Bumps all five version files; the lockfile diff is the two version entries
only, with no dependency churn.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01L9NzRtqE8eSMS8tvAeodUB
@Yeraze Yeraze added the system-test Trigger hardware system tests label Aug 3, 2026
@github-actions

github-actions Bot commented Aug 3, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @Yeraze's task —— View job

PR Review: chore(release): open 4.14.0

Tasks:

  • Gather context and analyze PR
  • Review changed files for version consistency
  • Check for potential issues
  • Post review feedback

This is a clean, well-scoped version bump. Here's the review:

Version Consistency ✅

All five required files (per CLAUDE.md versioning convention) are updated consistently to 4.14.0:

File Version
package.json 4.14.0 ✅
package-lock.json (both entries, lines 3 and 9) 4.14.0 ✅
helm/meshmonitor/Chart.yaml (version + appVersion) 4.14.0 ✅
desktop/src-tauri/tauri.conf.json 4.14.0 ✅
desktop/package.json 4.14.0 ✅

Residual 4.13.3 References ✅

A scan of the repository found five files still referencing 4.13.3, all of which are intentionally frozen:

  • scripts/watch-release.sh — comment about a historical rc3 bug
  • src/server/migrations/050_promote_globals_to_default_source.ts — "FROZEN as of 4.13.3" comment (correct, migration keys are intentionally frozen)
  • src/server/migrations/050_promote_globals_to_default_source.test.ts — test fixture
  • src/server/services/meshcoreObserverPacket.test.ts — hardcoded test fixture value (meshmonitor/4.13.3); this is test data, not a version marker
  • docs/internal/dev-notes/PER_SOURCE_NODE_DISPLAY_PHASE5_SPEC.md — historical spec doc

None of these need updating for the release.

Lockfile ✅

package-lock.json shows only the two expected version entries changed (lines 3 and 9). No dependency churn — consistent with the PR description.

Code Quality / Security / Performance

No code changes — nothing to review here. This PR is version metadata only.

Minor Observations (non-blocking)

  1. RC path still available: The PR body correctly notes that bare 4.14.0 (not 4.14.0-rc1) was chosen. This is fine per the stated convention, but worth confirming with the maintainer before merge since the 4.13.x line ran through 6 RCs.

  2. chore(api): remove 4.13 grace-period shims — v1 root paths + /api/upgrade 410s (closes #4117) #4189 (v1 path removal) is now unblocked: The PR body flags this explicitly. Since those docs warn users "These paths will be REMOVED in 4.14", merging chore(api): remove 4.13 grace-period shims — v1 root paths + /api/upgrade 410s (closes #4117) #4189 after this lands (but before the release tag) would fulfill the documented promise. Nothing to block this PR, but worth tracking.

  3. Desktop Tauri version: The desktop/src-tauri/tauri.conf.json version field controls the bundled application version. Verified it matches. No Cargo.toml in the changed files — confirming there's no separate Rust-side version that also needs bumping (would be a repo-specific concern, but worth noting if Tauri builds are in CI).

Summary

This PR is correct and safe to merge. All required version fields are consistently set to 4.14.0, the lockfile diff is minimal, and no residual rc6 markers remain in version-bearing files. The PR body's rationale for a minor bump (13 feat commits) is sound.

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
System Test Results

MeshMonitor System Test Results

Test Run: 2026-08-03 13:24:07 EDT

Test Summary

Test Suite Result
Configuration Import ✅ PASSED
Quick Start Test ✅ PASSED
Security Test ✅ PASSED
V1 API Test ✅ PASSED
Reverse Proxy Test ✅ PASSED
Reverse Proxy + OIDC ✅ PASSED
Virtual Node CLI Test ✅ PASSED
Backup & Restore Test ✅ PASSED
Database Migration Test ✅ PASSED
DB Backing Consistency ✅ PASSED
API Exercise (3 DBs) ✅ PASSED
MeshCore Hardware Test ✅ PASSED

✅ Overall Result: PASSED

All deployment configurations are working correctly!

Test Details

Configuration Import:

  • Tests configuration import and device reboot cycle
  • Verifies channel roles, PSKs, and LoRa configuration
  • Note: Channel name verification skipped due to architectural limitation

Quick Start Test:

  • Zero-config deployment (no SESSION_SECRET or COOKIE_SECURE required)
  • HTTP access without HSTS
  • Auto-generated admin user with default credentials
  • Session cookies work over HTTP
  • Meshtastic node connection and message exchange verified

Security Test:

  • Verifies Node IP address hidden from anonymous users in API responses
  • Verifies MQTT configuration hidden from anonymous users
  • Verifies Node IP address visible to authenticated users
  • Verifies MQTT configuration visible to authenticated users
  • Verifies protected endpoints require authentication

V1 API Test:

  • Tests v1 REST API endpoints with Bearer token authentication
  • Verifies Bearer token requests bypass CSRF protection
  • Verifies POST/PUT/DELETE work without CSRF token when using Bearer auth
  • Verifies session-based requests still require CSRF token

Reverse Proxy Test:

  • Production deployment with COOKIE_SECURE=true
  • HTTPS-ready configuration
  • Trust proxy enabled for reverse proxy compatibility
  • CORS configured for HTTPS domain
  • Meshtastic node connection and message exchange verified

Reverse Proxy + OIDC Test:

  • OIDC authentication integration
  • Mock OIDC provider health checks
  • Authorization flow and session creation
  • Hybrid mode (OIDC + local auth)
  • Meshtastic node connection verified

Virtual Node CLI Test:

  • Virtual Node Server enabled on TCP port 4404
  • Meshtastic Python client successfully connects
  • Node data download and synchronization verified
  • Test message sent on gauntlet channel (index 3)
  • Message delivery confirmed via Web UI API
  • Virtual Node Server connection logging verified

Backup & Restore Test:

  • System backup created from running dev container
  • New container spun up with RESTORE_FROM_BACKUP env var
  • Data integrity verified (node count, message count, settings)
  • Restore event logged in audit log
  • Dev container unaffected by restore test

Database Migration Test:

  • SQLite to PostgreSQL migration verified
  • SQLite to MySQL migration verified
  • Data integrity confirmed for both target databases
  • Row counts match between source and target

DB Backing Consistency Test:

  • SQLite, PostgreSQL, and MySQL backends tested with same device
  • Node counts within ±10 across all three backends
  • Favorite counts identical across all backends
  • Key station verified as favorite on all backends

@Yeraze
Yeraze merged commit bffe082 into main Aug 3, 2026
26 of 29 checks passed
@Yeraze
Yeraze deleted the chore/release-4.14.0 branch August 3, 2026 18:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

system-test Trigger hardware system tests

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Yeraze