docs(release): v3.17.0 release notes and changelog entry (#2390)

Release notes for v3.17.0: `docs/release-notes/v3.17.0.md` (used as the GitHub release body by `deploy.yml`) and the `CHANGELOG.md` entry. 24 commits since v3.16.0, counted with #2389, which is merged before this PR. Issues closed come from each PR's `closingIssuesReferences`. Docs only. After merge: tag `v3.17.0` on the merge commit once master CI is green and the `:edge` image carries that commit.
2026-11-11 11:57:57 +00:00 · 2026-11-11 00:26:33 +01:00
1 parent 873e8b0e16
commit 6dd62711bc
@@ -2,6 +2,19 @@

 ## [Unreleased]

+## [3.17.0] - 2026-11-11
+
+See [docs/release-notes/v3.17.0.md](docs/release-notes/v3.17.0.md) for the full notes. 24 commits since v3.16.0: 11 fix, 5 docs, 4 feat, 2 test, 1 ui, 1 chore.
+
+### Highlights
+- **Neighbour reports hide blacklisted and hidden nodes** (#2357) - the only change visible without configuring anything; reported totals and stored reports are unchanged.
+- **Map markers after a saved position past 180 degrees** (#2378) and **native arm64 image builds** (#2359) - fixes for problems operators reported on v3.16.0.
+- **A UI on another origin** (#2362) - `corsAllowedOrigins` wildcards for preview deployments, case-insensitive matching, exposed `Retry-After` and `X-CoreScope-Load-Status`. Opt-in.
+- **Map**: historical foreign-advert flag (#2371) and deep links to a chosen path view (#2376); node pages link to the map and packets (#2295).
+- **CoreDrive RX QR code on the Coverage page** (#2389) with `clientRxCoverage.appUrl`. Opt-in.
+
+No manual migration step.
+
 ## [3.16.0] - 2026-10-29

 See [docs/release-notes/v3.16.0.md](docs/release-notes/v3.16.0.md) for the full notes. 47 commits since v3.15.0: 23 fix, 9 feat, 6 docs, 2 test, 2 perf, 2 ci, 1 ui, 1 deps, 1 chore.
@@ -0,0 +1,113 @@
+# v3.17.0
+
+24 commits since v3.16.0: 11 fix, 5 docs, 4 feat, 2 test, 1 ui, 1 chore. Four feats, so
+minor not patch.
+
+A smaller release, mostly fixes for things operators reported on v3.16.0: map markers
+that disappeared after a saved map position, an arm64 Docker build that failed, and a
+Channels header that covered the list on phones. The new features are optional: a UI on
+another origin can talk to the server, the map shows the historical foreign-advert flag,
+map links can open a chosen path view, and the Coverage page can point visitors at your
+CoreDrive RX deployment.
+
+## Read this before upgrading
+
+Nothing to configure and no migration: the databases are not touched. One change is
+visible without being asked:
+
+### Neighbour reports hide the nodes you hide everywhere else
+
+An observer's neighbour report on its detail page listed every neighbour by name, also
+nodes that `nodeBlacklist` or `hiddenNamePrefixes` hide on every other page (#2357,
+closes #2356). It now applies the same rules, so a hidden node is left out of the list.
+The reported totals and the stored reports are unchanged.
+
+## Fixes you may have run into
+
+- **Map shows no markers after a saved position** (#2378). A map position saved with a
+  longitude past ±180° (after panning around the world) put every marker one world-width
+  off-screen while the tiles looked fine. Saved positions are now wrapped, and an
+  invalid one falls back to your configured default. Reported in #2375.
+- **Building the image on arm64 failed** (#2359). On a Raspberry Pi 4 or 5 or Apple
+  silicon, `docker build` stopped at the first step with `exec format error`, because
+  the Dockerfile forced the amd64 build image. The workaround
+  `--build-arg BUILDPLATFORM=linux/arm64` is no longer needed. Published images were
+  not affected.
+- **Channels on a phone** (#2382, closes #2381). The header with the region pills
+  overflowed onto the channel list and covered its first rows. Title and Add are now on
+  one row and the region pills scroll sideways on a second.
+- **Live node panel** (#2283, closes #2233). The status and Last Activity in a node's
+  panel on the Live page now use its newest certain activity, as the Nodes page does,
+  instead of only its last advert.
+- **Tablet slide-overs** (#2304, closes #2302). The navigation bar covered the close
+  button of the slide-over panels on tablets.
+- **Observer detail on a narrow screen** (#2344, closes #2341). Chart cards no longer
+  overflow the page.
+- **Type names** (#2374, closes #2373). Node analytics, observer detail, compare, nodes
+  and map now share one list of payload type names, so GRP_DATA no longer shows as
+  "Type 6".
+- **Timestamps** (#2377, #2387). Last Contact in node analytics shows the full
+  timestamp on hover, and a timestamp in the future (a node with a wrong clock) gets the
+  same warning icon on the Nodes, Packets and node analytics pages.
+- **Packets page** (#2370). A note under the title says the counts come from the
+  observer reports this instance received, not from the whole network.
+
+## Features
+
+- **A UI on another origin** (#2362). For operators who serve the CoreScope UI from a
+  different site (a CDN, Cloudflare Pages) against their own server:
+  `corsAllowedOrigins` (or `CORS_ALLOWED_ORIGINS`) accepts a wildcard such as `https://*.myproject.pages.dev`
+  for preview deployments, matches exact entries case-insensitively, and exposes the
+  `Retry-After` and `X-CoreScope-Load-Status` headers the UI reads. Nothing changes
+  unless you set it. Use a wildcard only over a domain you control.
+- **Historical foreign-advert flag on the map** (#2371). Nodes whose advert was once
+  flagged as outside your configured area get a marker and an explanation in their
+  popup. It says the flag was set at ingestion, not that the node is there now.
+- **Map links that open a path view** (#2376). `#/map?packet=<hash>&paths=all` opens
+  the path picker on All, and `&observer=<pubkey or 8+ hex prefix>` opens it on that
+  observer's path, so a shared link shows what the sender saw.
+- **Map and packet shortcuts on node details** (#2295, closes #2290). The node page,
+  side preview and tablet slide-over have Open in Map and View packets.
+- **CoreDrive RX link on the Coverage page** (#2389). With `clientRxCoverage.enabled`,
+  set `clientRxCoverage.appUrl` to the https address of your CoreDrive RX deployment and
+  the Coverage page shows a QR code and link to it. Without it nothing changes; an
+  invalid value is ignored with one log line at startup.
+
+## Documentation
+
+Readiness responses and ingestor liveness in the API docs (#2358), portable and bounded
+scheduled-backup examples (#2353, closes #2352), the Docker minimum split into running
+and building the image (#2361), route type values in `decoded.proto` (#2367, closes
+#2363), and approved channels being backfilled (#2385).
+
+## Tests and CI
+
+A flaky observer-comparison E2E wait (#2343, closes #2342), partial chart construction
+failures (#2354), and local worktree folders ignored by git (#2388).
+
+## Issues closed
+
+- #2233 Live node detail ignores recent relay and heard activity
+- #2290 Map and packet shortcuts in node details
+- #2302 Navigation covers tablet slide-over close controls
+- #2341 Chart cards overflow narrow observer detail pages
+- #2342 Wait for route focus before observer disposal snapshot (test)
+- #2352 Make scheduled backup examples safe and portable
+- #2356 Neighbour reports expose filtered node identities
+- #2363 `decoded.proto` route_type comment does not match the decoder
+- #2373 Payload label drift: GRP_DATA shows as "Type 6"
+- #2381 Channels (mobile): sidebar header covers the first channel rows
+
+## Contributors
+
+Pull requests: n30nex (15), efiten (3, maintainer), ppicazo, CoderNemesis26, MarekWo,
+SaarMesh-Bot, jade-on-mesh and DSMoyle (1 each).
+
+Issues: n30nex (7), DSMoyle, MarekWo and Nursedude (1 each), and hb9tvw for the map
+report in #2375.
+
+## Upgrade notes
+
+- Created automatically: nothing new.
+- Opt-in: `corsAllowedOrigins` wildcards, `clientRxCoverage.appUrl`.
+- Action needed: none.