Merge branch 'master' into unify-tft

.trunk/trunk.yaml

@@ -9,7 +9,7 @@ plugins:
 lint:
   enabled:
     - checkov@3.2.436
-    - renovate@40.41.0
+    - renovate@40.42.2
     - prettier@3.5.3
     - trufflehog@3.88.35
     - yamllint@1.37.1

alpine.Dockerfile

@@ -3,7 +3,7 @@
 # trunk-ignore-all(hadolint/DL3018): Do not pin apk package versions
 # trunk-ignore-all(hadolint/DL3013): Do not pin pip package versions
 
-FROM python:3.13-alpine3.21 AS builder
+FROM python:3.13-alpine3.22 AS builder
 ARG PIO_ENV=native
 ENV PIP_ROOT_USER_ACTION=ignore
 
@@ -27,7 +27,7 @@ RUN bash ./bin/build-native.sh "$PIO_ENV" && \
 
 # ##### PRODUCTION BUILD #############
 
-FROM alpine:3.21
+FROM alpine:3.22
 LABEL org.opencontainers.image.title="Meshtastic" \
       org.opencontainers.image.description="Alpine Meshtastic daemon" \
       org.opencontainers.image.url="https://meshtastic.org" \

arch/esp32/esp32.ini

@@ -4,7 +4,7 @@ extends = arduino_base
 custom_esp32_kind = esp32
 platform =
   # renovate: datasource=custom.pio depName=platformio/espressif32 packageName=platformio/platform/espressif32
-  platformio/espressif32@6.10.0
+  platformio/espressif32@6.11.0
 
 build_src_filter = 
   ${arduino_base.build_src_filter} -<platform/nrf52/> -<platform/stm32wl> -<platform/rp2xx0> -<mesh/eth/> -<mesh/raspihttp>

bin/device-install.sh

@@ -73,7 +73,7 @@ set -e
 # Usage info
 show_help() {
     cat <<EOF
-Usage: $(basename $0) [-h] [-p ESPTOOL_PORT] [-P PYTHON] [-f FILENAME] [--web] [--1200bps-reset]
+Usage: $(basename "$0") [-h] [-p ESPTOOL_PORT] [-P PYTHON] [-f FILENAME] [--web] [--1200bps-reset]
 Flash image file to device, but first erasing and writing system information.
 
     -h               Display this help and exit.
@@ -127,18 +127,18 @@ if [[ $BPS_RESET == true ]]; then
 	exit 0
 fi
 
-[ -z "$FILENAME" -a -n "$1" ] && {
+[ -z "$FILENAME" ] && [ -n "$1" ] && {
-	FILENAME=$1
+    FILENAME="$1"
     shift
 }
 
-if [[ $FILENAME != firmware-* ]]; then
+if [[ "$FILENAME" != firmware-* ]]; then
   echo "Filename must be a firmware-* file."
   exit 1
 fi
 
 # Check if FILENAME contains "-tft-" and prevent web/mui comingling.
-if [[ ${FILENAME//-tft-/} != "$FILENAME" ]]; then
+if [[ "${FILENAME//-tft-/}" != "$FILENAME" ]]; then
     TFT_BUILD=true
     if [[ $WEB_APP == true ]] && [[ $TFT_BUILD == true ]]; then
         echo "Cannot enable WebUI (--web) and MUI."
@@ -197,15 +197,15 @@ if [ -f "${FILENAME}" ] && [ -n "${FILENAME##*"update"*}" ]; then
         SPIFFSFILE=littlefs-${BASENAME}
     fi
 
-	if [[ ! -f $FILENAME ]]; then
+    if [[ ! -f "$FILENAME" ]]; then
         echo "Error: file ${FILENAME} wasn't found. Terminating."
         exit 1
     fi
-	if [[ ! -f $OTAFILE ]]; then
+    if [[ ! -f "$OTAFILE" ]]; then
         echo "Error: file ${OTAFILE} wasn't found. Terminating."
         exit 1
     fi
-	if [[ ! -f $SPIFFSFILE ]]; then
+    if [[ ! -f "$SPIFFSFILE" ]]; then
         echo "Error: file ${SPIFFSFILE} wasn't found. Terminating."
         exit 1
     fi

bin/device-update.sh

@@ -18,8 +18,8 @@ fi
 # Usage info
 show_help() {
 cat << EOF
-Usage: $(basename $0) [-h] [-p ESPTOOL_PORT] [-P PYTHON] [-f FILENAME|FILENAME] [--change-mode]
+Usage: $(basename "$0") [-h] [-p ESPTOOL_PORT] [-P PYTHON] [-f FILENAME|FILENAME] [--change-mode]
-Flash image file to device, leave existing system intact.
+Flash image file to device, leave existing system intact."
 
     -h               Display this help and exit
     -p ESPTOOL_PORT  Set the environment variable for ESPTOOL_PORT.  If not set, ESPTOOL iterates all ports (Dangerous).
@@ -60,14 +60,14 @@ if [[ $CHANGE_MODE == true ]]; then
     exit 0
 fi
 
-[ -z "$FILENAME" -a -n "$1" ] && {
+[ -z "$FILENAME" ]  && [ -n "$1" ] && {
-    FILENAME=$1
+    FILENAME="$1"
     shift
 }
 
 if [ -f "${FILENAME}" ] && [ -z "${FILENAME##*"update"*}" ]; then
-	printf "Trying to flash update ${FILENAME}"
+    echo "Trying to flash update ${FILENAME}"
-	$ESPTOOL_CMD --baud 115200 write_flash 0x10000 ${FILENAME}
+    $ESPTOOL_CMD --baud 115200 write_flash 0x10000 "${FILENAME}"
 else
     show_help
     echo "Invalid file: ${FILENAME}"

src/mesh/NodeDB.cpp

@@ -499,9 +499,25 @@ void NodeDB::installDefaultConfig(bool preserveKey = false)
         true; // FIXME: maybe false in the future, and setting region to enable it. (unset region forces it off)
     config.lora.override_duty_cycle = false;
     config.lora.config_ok_to_mqtt = false;
+
 #if HAS_TFT // For the devices that support MUI, default to that
     config.display.displaymode = meshtastic_Config_DisplayConfig_DisplayMode_COLOR;
 #endif
+
+#ifdef USERPREFS_CONFIG_DEVICE_ROLE
+    // Restrict ROUTER*, LOST AND FOUND, and REPEATER roles for security reasons
+    if (IS_ONE_OF(USERPREFS_CONFIG_DEVICE_ROLE, meshtastic_Config_DeviceConfig_Role_ROUTER,
+                  meshtastic_Config_DeviceConfig_Role_ROUTER_LATE, meshtastic_Config_DeviceConfig_Role_REPEATER,
+                  meshtastic_Config_DeviceConfig_Role_LOST_AND_FOUND)) {
+        LOG_WARN("ROUTER roles are restricted, falling back to CLIENT role");
+        config.device.role = meshtastic_Config_DeviceConfig_Role_CLIENT;
+    } else {
+        config.device.role = USERPREFS_CONFIG_DEVICE_ROLE;
+    }
+#else
+    config.device.role = meshtastic_Config_DeviceConfig_Role_CLIENT; // Default to client.
+#endif
+
 #ifdef USERPREFS_CONFIG_LORA_REGION
     config.lora.region = USERPREFS_CONFIG_LORA_REGION;
 #else
@@ -674,6 +690,11 @@ void NodeDB::installDefaultConfig(bool preserveKey = false)
     }
 #endif
 
+#ifdef USERPREFS_CONFIG_DEVICE_ROLE
+    // Apply role-specific defaults when role is set via user preferences
+    installRoleDefaults(config.device.role);
+#endif
+
     initConfigIntervals();
 }