chore(release): 4.13.3-rc5

[Yeraze]

Version bump to 4.13.3-rc5 across all five version files (package.json, package-lock.json, helm/meshmonitor/Chart.yaml, desktop/package.json, desktop/src-tauri/tauri.conf.json).

Changes since rc4 (12)

Remote admin no longer holds an HTTP request across mesh round-trips — issue #4482, fixed by #4485 and #4486. Commands, session-passkey acquisition, and remote config import all return 202 Accepted with an operation id and complete in the background, polled via GET /api/admin/operations/:id. This fixes the reported upstream 502s behind a reverse proxy, where a single remote admin action could legitimately hold a connection open for up to 75s. Remote ignore/unignore also gained the routing-ACK confirmation that only favorites had. Documented in #4490.

Admin messages now use the node's configured LoRa hop limit (#4479) instead of a hardcoded 3, so nodes more than 3 hops away are administrable at all.

GET /stats no longer 500s when sourceId is omitted (#4470) — the cross-source aggregate path had never worked.

MeshCore: anon auth banner, channel-sync data loss, reply/trigger ordering (#4491); channel view scroll position and Delete (#4488); hop/route/scope preserved in channel message history (#4475).

Navigation: unified Meshtastic/MeshCore per-source navigation (#4481) and moved the Meshtastic phone nav to the shared bottom bar (#4484).

Full commit list

58d59ac7 docs(admin): document asynchronous remote-admin execution (#4490)
0687d6cf fix(api): GET /stats returns 500 whenever sourceId is omitted (#4470)
fdd983c2 fix(meshcore): anon auth banner, channel-sync data loss, and reply/trigger ordering (#4491)
6fde8514 fix(admin): decouple session-passkey and config-import from the HTTP request (#4486)
aaadb58b fix(meshcore): channel view opens at the top and Delete appears to do nothing (#4488)
ff158c7a feat(nav): move the Meshtastic phone nav to the shared bottom bar (#4473) (#4484)
d90ed1d3 fix(admin): decouple remote-admin commands from the HTTP request (#4482) (#4485)
97947e22 feat(nav): unify Meshtastic/MeshCore per-source navigation (#4473) (#4481)
92f7632d fix(admin): send admin messages at the node's configured hop limit (#4479)
14fa0057 fix(ui): restore the send-message button icon (#4478) (#4480)
c649635d fix(messaging): stop older-message loads from force-scrolling to bottom (#4477)
78890f62 fix(meshcore): preserve hop/route/scope info in channel message history (#4474) (#4475)

Why the system-test label matters on this one

Release bumps always carry it, but it is doing real work here: this is the first build to exercise the async remote-admin paths against actual hardware. None of #4485, #4486, or #4479 was hardware-validated when merged — they shipped on unit and route coverage alone.

The legs worth watching:

• Configuration Import — drives /api/admin/import-config, the longest of the newly-async sequences (passkey acquisition, then a burst of per-channel admin sends with 1s pacing). It also exercises the hop-limit change, since admin packets now carry the device's configured value rather than 3.
• Quick Start / Reverse Proxy — real HTTP paths through a proxy, which is the failure mode [BUG] Remote admin HTTP requests can block up to 75s (passkey + ACK waits), causing upstream 502s under RF retransmission #4482 was about.

If Configuration Import fails, check the rig's tx_enabled and modem preset before assuming the diff — that state has masqueraded as unrelated timeouts before.

🤖 Generated with Claude Code

https://claude.ai/code/session_015cgD5kSurLjdeVkZ6PcQD9

[github-actions]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[github-actions]

Claude finished @Yeraze's task —— View job

---

PR Review: chore(release): 4.13.3-rc5

Tasks:

• Gather context and understand PR
• Review changed files for version consistency
• Check CLAUDE.md versioning requirements
• Post final review

---

Review Summary

This is a pure version bump PR with no logic changes. The review scope is limited to version consistency.

Version Consistency ✅

All five required version files (per CLAUDE.md) are correctly updated to 4.13.3-rc5:

File	Version
package.json:3	4.13.3-rc5 ✅
package-lock.json:3 + :9 (both top-level entries)	4.13.3-rc5 ✅
helm/meshmonitor/Chart.yaml:5-6 (version + appVersion)	4.13.3-rc5 ✅
desktop/package.json:4	4.13.3-rc5 ✅
desktop/src-tauri/tauri.conf.json:4	4.13.3-rc5 ✅

All five files called out in CLAUDE.md's versioning requirements are present and consistent. The package-lock.json correctly shows both the top-level version field and the packages[""].version entry updated.

No Issues Found

This PR is a clean version bump with no code quality, security, performance, or test coverage concerns — there are no logic changes to evaluate. The PR description is thorough and accurately documents the scope of changes since rc4.

One observation worth noting (not a blocker): The PR description flags that #4485, #4486, and #4479 (async remote-admin paths and hop-limit change) were merged without hardware validation. The system-test leg on Configuration Import is the critical path to watch in CI.

LGTM for merge once CI passes.

---

[github-actions]

System Test Results

MeshMonitor System Test Results

Test Run: 2026-08-01 14:41:19 EDT

Test Summary

Test Suite	Result
Configuration Import	✅ PASSED
Quick Start Test	✅ PASSED
Security Test	✅ PASSED
V1 API Test	✅ PASSED
Reverse Proxy Test	✅ PASSED
Reverse Proxy + OIDC	✅ PASSED
Virtual Node CLI Test	✅ PASSED
Backup & Restore Test	✅ PASSED
Database Migration Test	✅ PASSED
DB Backing Consistency	✅ PASSED
API Exercise (3 DBs)	✅ PASSED
MeshCore Hardware Test	✅ PASSED

✅ Overall Result: PASSED

All deployment configurations are working correctly!

Test Details

Configuration Import:

• Tests configuration import and device reboot cycle
• Verifies channel roles, PSKs, and LoRa configuration
• Note: Channel name verification skipped due to architectural limitation

Quick Start Test:

• Zero-config deployment (no SESSION_SECRET or COOKIE_SECURE required)
• HTTP access without HSTS
• Auto-generated admin user with default credentials
• Session cookies work over HTTP
• Meshtastic node connection and message exchange verified

Security Test:

• Verifies Node IP address hidden from anonymous users in API responses
• Verifies MQTT configuration hidden from anonymous users
• Verifies Node IP address visible to authenticated users
• Verifies MQTT configuration visible to authenticated users
• Verifies protected endpoints require authentication

V1 API Test:

• Tests v1 REST API endpoints with Bearer token authentication
• Verifies Bearer token requests bypass CSRF protection
• Verifies POST/PUT/DELETE work without CSRF token when using Bearer auth
• Verifies session-based requests still require CSRF token

Reverse Proxy Test:

• Production deployment with COOKIE_SECURE=true
• HTTPS-ready configuration
• Trust proxy enabled for reverse proxy compatibility
• CORS configured for HTTPS domain
• Meshtastic node connection and message exchange verified

Reverse Proxy + OIDC Test:

• OIDC authentication integration
• Mock OIDC provider health checks
• Authorization flow and session creation
• Hybrid mode (OIDC + local auth)
• Meshtastic node connection verified

Virtual Node CLI Test:

• Virtual Node Server enabled on TCP port 4404
• Meshtastic Python client successfully connects
• Node data download and synchronization verified
• Test message sent on gauntlet channel (index 3)
• Message delivery confirmed via Web UI API
• Virtual Node Server connection logging verified

Backup & Restore Test:

• System backup created from running dev container
• New container spun up with RESTORE_FROM_BACKUP env var
• Data integrity verified (node count, message count, settings)
• Restore event logged in audit log
• Dev container unaffected by restore test

Database Migration Test:

• SQLite to PostgreSQL migration verified
• SQLite to MySQL migration verified
• Data integrity confirmed for both target databases
• Row counts match between source and target

DB Backing Consistency Test:

• SQLite, PostgreSQL, and MySQL backends tested with same device
• Node counts within ±10 across all three backends
• Favorite counts identical across all backends
• Key station verified as favorite on all backends