@alteriom/painlessmesh 2.1.0 → 2.1.1

package/CHANGELOG.md

@@ -7,6 +7,73 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.1.1] - 2026-09-21
+
+Two crashes the rig and a user found in 2.1.0, and the rig itself wired
+in. A node could crash at start-up on an uninitialised listener pointer
+(#466, reported by a user before the rig saw it), and an ESP8266 serving as
+a shared gateway could run out of memory answering its own
+`sendToInternet()` (#469, found by the rig the day the fix for #466 landed).
+Both are fixed, CI now refuses the class of defect behind #466, and every
+merge to `main` is flashed onto the rig from here on. **Upgrade if you run
+2.1.0**: the #466 crash is at boot, on every node.
+
+### Added
+
+- **Every merge to `main` runs on the hardware rig.**
+  `.github/workflows/farm-hil.yml` dispatches the Alteriom farm's HIL suite
+  once the CI/CD Pipeline has passed on `main`, and for a pull request a
+  maintainer labels `run-hil` -- a promise CONTRIBUTING.md had made that
+  nothing kept. The rig had been a manual gate, so #466 reached a user
+  before it reached a board. Needs the `FARM_DISPATCH_TOKEN` secret; without
+  it the job says so and passes. Release builds stay a person's decision on
+  the farm side.
+
+- **`mesh.tcpListening()`** -- whether this node's TCP listener exists and
+  is in LISTEN, the state peers depend on and nothing else reported. A node
+  whose listener was never created (#466) or was re-created not listening
+  (#435) is reachable only through connections it made outbound, and nothing
+  can join through it; a health report can now say so on the node itself.
+  `PAINLESSMESH_HAS_TCP_LISTENING` is defined alongside it for code that
+  builds against older releases too.
+
+### Fixed
+
+- **An ESP8266 shared gateway could run out of memory answering its own
+  `sendToInternet()`** (#469, found by the rig: both ESP8266 boards died of
+  `Unhandled C++ exception: OOM` in the `gateway.shared.internet` row, on a
+  76-byte allocation). For a request that originated on the gateway itself,
+  the reply travelled to the application as five copies of the ack --
+  copied into the deferred task's closure, copied again inside it,
+  serialised to JSON by the `Variant` and parsed back into a third package
+  by the handler -- then the pending request and the result were copied
+  once more on delivery, all on a heap the HTTP client had already spent.
+  The ack is now moved into one heap block and handed straight to the
+  handler, and the request and result are moved on delivery. What the
+  application receives is unchanged.
+- **A node could crash before serving its first connection: `_tcpListener`
+  was never initialised** (#466). 2.1.0 taught `tcpServerInit()` to keep a
+  listener that already exists instead of re-binding the port, so it now
+  reads the pointer before anything has assigned it. On a stack that held
+  garbage there the null check passed and the `delete` that followed
+  crashed the node at start-up. The pointer defaults to `nullptr`.
+- **The same gap closed everywhere it existed.** Twenty more pointer and
+  arithmetic members had no default and no constructor setting them: the
+  AP settings a node reports before `init()`; `from`/`dest` on a package
+  built by its type constructor and sent before the application filled
+  them; the fields of `SendStats`, `ConnectionInfo`, `BridgeCandidate`,
+  `MeshChannelCandidate` and `BridgeCoordinationState`; and the
+  book-keeping members of `RTCManager`, `MessageQueue`, `LogClass`,
+  `metrics::Timer` and the desktop `AsyncServer`. Each now has a default
+  member initializer, which holds under every constructor the class has or
+  gains later.
+- **CI refuses the next one.** `test/ci/check_member_init.py` walks every
+  header under `src/` and fails on any pointer or arithmetic data member
+  declared without a default member initializer, whatever the class's
+  constructors do; `test/ci/test_check_member_init.sh` plants the #466
+  case and proves the checker catches it and passes clean code. Both run
+  in the Code Quality job.
+
 ## [2.1.0] - 2026-09-15
 
 `sendToInternet()` you can build a notifier on (#463). One user's WhatsApp

package/CONTRIBUTING.md

@@ -94,9 +94,14 @@ Multi-node behaviour is tested with the external
 [painlessMesh-simulator](https://github.com/Alteriom/painlessMesh-simulator);
 scenarios for an example live under `examples/<example>/test/simulator/`
 (see `examples/basic/test/simulator/`). Radio, routing, gateway, failover
-and OTA behaviour is validated on the Alteriom hardware-in-the-loop farm; a
-maintainer runs it on a pull request by adding the `run-hil` label, and the
-release gate is three consecutive clean runs of the whole suite.
+and OTA behaviour is validated on the Alteriom hardware-in-the-loop farm.
+`.github/workflows/farm-hil.yml` sends the farm a run for **every merge to
+`main` whose CI passed**, and for a pull request when a maintainer adds the
+`run-hil` label; either needs the `FARM_DISPATCH_TOKEN` secret, and without
+it the job says so and passes rather than pretending. A rig run is never a
+release build from here -- one that may spend a real provider message is
+started by a person from the farm's own workflow -- and the release gate is
+three consecutive clean runs of the whole suite.
 
 ### The HTTP test point
 

package/examples/alteriom/platformio.ini

@@ -17,7 +17,10 @@ lib_deps =
     esp32async/ESPAsyncTCP@^2.0.0  ; Only for ESP8266
 
 [env:esp32]
-platform = espressif32
+; Pinned to the ESP32 Arduino 2.x core, which compiles as gnu++11: a struct
+; with default member initializers is not an aggregate there, and this is the
+; one CI build that proves the library still builds on it (#466 review).
+platform = espressif32@7.1.3
 board = esp32dev
 framework = arduino
 lib_extra_dirs = ../../  ; Load the local copy of painlessmesh. For your own example add painlessmesh to the lib_deps

package/examples/basic/platformio.ini

@@ -17,7 +17,10 @@ lib_deps =
     esp32async/ESPAsyncTCP@^2.0.0  ; Only for ESP8266
 
 [env:esp32]
-platform = espressif32
+; Pinned to the ESP32 Arduino 2.x core, which compiles as gnu++11: a struct
+; with default member initializers is not an aggregate there, and this is the
+; one CI build that proves the library still builds on it (#466 review).
+platform = espressif32@7.1.3
 board = esp32dev
 framework = arduino
 lib_extra_dirs = ../../

package/keywords.txt

@@ -55,6 +55,7 @@ getPrimaryBridge	KEYWORD2
 getPrimaryGateway	KEYWORD2
 enableSendToInternet	KEYWORD2
 sendToInternet	KEYWORD2
+tcpListening	KEYWORD2
 enableMessageQueue	KEYWORD2
 queueMessage	KEYWORD2
 flushMessageQueue	KEYWORD2

package/library.json

@@ -6,7 +6,7 @@
     "type": "git",
     "url": "https://github.com/Alteriom/painlessMesh"
   },
-  "version": "2.1.0",
+  "version": "2.1.1",
   "frameworks": [
     "arduino"
   ],

package/library.properties

@@ -1,5 +1,5 @@
 name=Alteriom PainlessMesh
-version=2.1.0
+version=2.1.1
 author=Coopdis,Scotty Franzyshen,Edwin van Leeuwen,Germán Martín,Maximilian Schwarz,Doanh Doanh,Alteriom
 maintainer=Alteriom
 sentence=A painless way to setup a mesh with ESP8266 and ESP32 devices with Alteriom extensions

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alteriom/painlessmesh",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "painlessMesh is a user-friendly library for creating mesh networks with ESP8266 and ESP32 devices. This Alteriom fork includes additional packages for sensor data (SensorPackage), device commands (CommandPackage), and status monitoring (StatusPackage). It handles routing and network management automatically, so you can focus on your application. The library uses JSON-based messaging and syncs time across all nodes, making it ideal for coordinated behaviour like synchronized light displays or sensor networks reporting to a central node.",
   "keywords": [
     "arduino",

package/src/AlteriomPainlessMesh.h

@@ -29,10 +29,10 @@
 /**
  * @brief AlteriomPainlessMesh library version information
  */
-#define ALTERIOM_PAINLESS_MESH_VERSION "2.1.0"
+#define ALTERIOM_PAINLESS_MESH_VERSION "2.1.1"
 #define ALTERIOM_PAINLESS_MESH_VERSION_MAJOR 2
 #define ALTERIOM_PAINLESS_MESH_VERSION_MINOR 1
-#define ALTERIOM_PAINLESS_MESH_VERSION_PATCH 0
+#define ALTERIOM_PAINLESS_MESH_VERSION_PATCH 1
 
 /**
  * @brief Library description and usage information

package/src/arduino/wifi.hpp

@@ -23,6 +23,14 @@
 
 extern painlessmesh::logger::LogClass Log;
 
+/**
+ * Defined when Mesh::tcpListening() exists, so a node can be asked whether
+ * its TCP listener is in LISTEN rather than having that inferred from a
+ * peer eventually connecting. Code that must build against older releases
+ * too can test for it with #ifdef.
+ */
+#define PAINLESSMESH_HAS_TCP_LISTENING 1
+
 namespace painlessmesh {
 namespace wifi {
 class Mesh : public painlessmesh::Mesh<Connection> {
@@ -883,7 +891,7 @@ class Mesh : public painlessmesh::Mesh<Connection> {
     // then had a bridge's listener. AsyncTCP keeps its pcb private, so
     // SO_REUSEADDR cannot be set from here; not re-binding is the fix.
     if (_tcpListener != nullptr) {
-      if (_tcpListener->status() == 1) {
+      if (_tcpListener->status() == TCP_STATE_LISTEN) {
         Log(CONNECTION,
             "tcpServerInit(): listener on port %d already listening, kept\n",
             _meshPort);
@@ -905,6 +913,28 @@ class Mesh : public painlessmesh::Mesh<Connection> {
     return;
   }
 
+  /**
+   * Whether this node's TCP listener exists and is in LISTEN.
+   *
+   * The state peers depend on and nothing else reports: a node whose
+   * listener was never created (#466 crashed before it could be) or was
+   * re-created not listening (#435's promoted bridge served nothing for two
+   * minutes) is reachable only through connections it made outbound, and
+   * nothing can join through it. Cheap enough to put in a health report.
+   */
+  bool tcpListening() {
+    return _tcpListener != nullptr && _tcpListener->status() == TCP_STATE_LISTEN;
+  }
+
+  /**
+   * lwIP's `LISTEN`, which AsyncServer::status() returns as the pcb's state
+   * on both cores (ESPAsyncTCP and ESP32Async/AsyncTCP alike). Named rather
+   * than written as 1 because status() also answers 0 -- lwIP's CLOSED --
+   * when the server holds no pcb at all, so the literal read as if it
+   * conflated the two. It does not: a listener is listening, or it is not.
+   */
+  static constexpr uint8_t TCP_STATE_LISTEN = 1;
+
   /**
    * Establish TCP connection to mesh network
    *
@@ -1521,12 +1551,15 @@ class Mesh : public painlessmesh::Mesh<Connection> {
 
  protected:
   friend class ::StationScan;
+  // init() sets all of these; the defaults are init()'s own, so a node
+  // that is asked about its AP before init() answers something true
+  // rather than whatever the stack held.
   TSTRING _meshSSID;
   TSTRING _meshPassword;
-  uint8_t _meshChannel;
-  uint8_t _meshHidden;
-  uint8_t _meshMaxConn;
-  uint16_t _meshPort;
+  uint8_t _meshChannel = 1;
+  uint8_t _meshHidden = 0;
+  uint8_t _meshMaxConn = MAX_CONN;
+  uint16_t _meshPort = 5555;
 
   IPAddress _apIp;
   StationScan stationScan;
@@ -2467,7 +2500,7 @@ class Mesh : public painlessmesh::Mesh<Connection> {
     // stop/re-init, was not listening, and nothing looked. This task runs
     // every thirty seconds on a bridge: if the listener is not in LISTEN
     // (1 on both cores) it is re-created, and the log says so.
-    if (_tcpListener != nullptr && _tcpListener->status() != 1) {
+    if (_tcpListener != nullptr && _tcpListener->status() != TCP_STATE_LISTEN) {
       Log(ERROR,
           "sendBridgeStatus(): TCP listener on port %d is in state %u, not "
           "LISTEN; re-creating it\n",
@@ -3236,16 +3269,25 @@ class Mesh : public painlessmesh::Mesh<Connection> {
   }
 
 #ifdef ESP32
-  WiFiEventId_t eventScanDoneHandler;
-  WiFiEventId_t eventSTAStartHandler;
-  WiFiEventId_t eventSTADisconnectedHandler;
-  WiFiEventId_t eventSTAGotIPHandler;
+  // Event ids the core hands back from onEvent(); stop() removes all four.
+  // 0 is never issued (the core's ids start at 1 and 0 means "no
+  // callback"), so removeEvent(0) is a no-op on a node stopped before
+  // init() rather than a walk of the core's callback list for garbage.
+  WiFiEventId_t eventScanDoneHandler = 0;
+  WiFiEventId_t eventSTAStartHandler = 0;
+  WiFiEventId_t eventSTADisconnectedHandler = 0;
+  WiFiEventId_t eventSTAGotIPHandler = 0;
 #elif defined(ESP8266)
   WiFiEventHandler eventSTAConnectedHandler;
   WiFiEventHandler eventSTADisconnectedHandler;
   WiFiEventHandler eventSTAGotIPHandler;
 #endif  // ESP8266
-  AsyncServer* _tcpListener;
+  // Null until tcpServerInit() creates it. Every reader checks for null
+  // first, and one of them (tcpServerInit() itself, since 2.1.0) runs before
+  // anything has assigned it -- on an uninitialised pointer that check
+  // passed on garbage and the delete that followed crashed the node before
+  // it served a single connection (#466).
+  AsyncServer* _tcpListener = nullptr;
   std::shared_ptr<Task> bridgeStatusTask;
   // millis() of the last status broadcast, periodic or brought forward by a
   // topology change; the latter is held to one every five seconds.
@@ -3258,11 +3300,11 @@ class Mesh : public painlessmesh::Mesh<Connection> {
   enum ElectionState { ELECTION_IDLE, ELECTION_SCANNING, ELECTION_COLLECTING };
 
   struct BridgeCandidate {
-    uint32_t nodeId;
-    int8_t routerRSSI;
-    uint8_t routerChannel;
-    uint32_t uptime;
-    uint32_t freeMemory;
+    uint32_t nodeId = 0;
+    int8_t routerRSSI = 0;
+    uint8_t routerChannel = 0;
+    uint32_t uptime = 0;
+    uint32_t freeMemory = 0;
   };
 
   bool bridgeFailoverEnabled = true;
@@ -3317,11 +3359,19 @@ class Mesh : public painlessmesh::Mesh<Connection> {
   size_t lastSelectedBridgeIndex = 0;   // For round-robin selection
 
   // Bridge coordination monitoring callbacks and state
+  // Constructed by name, not as an aggregate: with default member
+  // initializers this is not an aggregate under gnu++11, which the ESP32
+  // Arduino 2.x core still builds with, and `= {priority, role, load,
+  // millis()}` below needs a constructor to land on there.
   struct BridgeCoordinationState {
-    uint8_t priority;
+    uint8_t priority = 0;
     TSTRING role;
-    uint8_t load;
-    uint32_t lastSeen;
+    uint8_t load = 0;
+    uint32_t lastSeen = 0;
+    BridgeCoordinationState() {}
+    BridgeCoordinationState(uint8_t priority_, const TSTRING& role_,
+                            uint8_t load_, uint32_t lastSeen_)
+        : priority(priority_), role(role_), load(load_), lastSeen(lastSeen_) {}
   };
   std::map<uint32_t, BridgeCoordinationState> lastBridgeCoordinationState;
   std::function<void(const plugin::BridgeCoordinationPackage&, uint32_t)> bridgeCoordinationCallback;

package/src/boost/asynctcp.hpp

@@ -258,7 +258,7 @@ class AsyncServer {
 
  protected:
   boost::asio::io_context& _io_service;
-  uint16_t _port;
+  uint16_t _port = 0;
   tcp::acceptor mAcceptor;
   AcConnectHandler _connect_cb = 0;
   void* _connect_cb_arg = 0;

package/src/painlessMeshSTA.h

@@ -125,10 +125,11 @@ class StationScan {
  protected:
   TSTRING ssid;
   TSTRING password;
-  painlessMesh *mesh;
-  uint16_t port;
-  uint8_t channel;
-  bool hidden;
+  // init() sets these; until then the scan belongs to no mesh and no port.
+  painlessMesh *mesh = nullptr;
+  uint16_t port = 0;
+  uint8_t channel = 0;
+  bool hidden = false;
   std::list<WiFi_AP_Record_t> aps;
 
   void requestIP(WiFi_AP_Record_t &ap);

package/src/painlessmesh/buffer.hpp

@@ -124,7 +124,7 @@ inline void ReceiveBuffer<std::string>::stringAppend(std::string &buffer,
 template <class T>
 struct PrioritizedMessage {
   T message;
-  uint8_t priority;  // 0=CRITICAL, 1=HIGH, 2=NORMAL, 3=LOW
+  uint8_t priority = 2;  // 0=CRITICAL, 1=HIGH, 2=NORMAL, 3=LOW
   
   PrioritizedMessage(const T& msg, uint8_t prio = 2) : message(msg), priority(prio) {}
 };
@@ -318,18 +318,18 @@ class SentBuffer {
    * Get statistics about queued and sent messages
    */
   struct SendStats {
-    uint32_t totalQueued;
-    uint32_t criticalQueued;
-    uint32_t highQueued;
-    uint32_t normalQueued;
-    uint32_t lowQueued;
-    uint32_t criticalSent;
-    uint32_t highSent;
-    uint32_t normalSent;
-    uint32_t lowSent;
+    uint32_t totalQueued = 0;
+    uint32_t criticalQueued = 0;
+    uint32_t highQueued = 0;
+    uint32_t normalQueued = 0;
+    uint32_t lowQueued = 0;
+    uint32_t criticalSent = 0;
+    uint32_t highSent = 0;
+    uint32_t normalSent = 0;
+    uint32_t lowSent = 0;
     // Messages lost to the PAINLESSMESH_MAX_SENT_BUFFER_MESSAGES cap:
     // evicted from the buffer or rejected on push (issue #388)
-    uint32_t dropped;
+    uint32_t dropped = 0;
   };
 
   SendStats getStats() const {

package/src/painlessmesh/gateway.hpp

@@ -67,8 +67,13 @@ constexpr bool shouldFollowBridgeChannel(uint32_t localNodeId,
  * @brief One occurrence of the mesh SSID seen by an all-channel scan.
  */
 struct MeshChannelCandidate {
-  uint8_t channel;
-  int32_t rssi;
+  uint8_t channel = 0;
+  int32_t rssi = 0;
+  // `push_back({channel, rssi})` needs a constructor under gnu++11 (the
+  // ESP32 Arduino 2.x core), where a struct with default member
+  // initializers is not an aggregate.
+  MeshChannelCandidate() {}
+  MeshChannelCandidate(uint8_t channel_, int32_t rssi_) : channel(channel_), rssi(rssi_) {}
 };
 
 /**

package/src/painlessmesh/logger.hpp

@@ -183,7 +183,7 @@ class LogClass {
   Sink sink = nullptr;
   char str[200];
   std::list<std::pair<uint32_t, TSTRING>> remote_queue;
-  uint32_t remote_uuid;
+  uint32_t remote_uuid = 0;
 };
 
 }  // namespace logger

package/src/painlessmesh/mesh.hpp

@@ -2162,11 +2162,21 @@ class Mesh : public ntp::MeshTime, public plugin::PackageHandler<T> {
       // application's callback runs on what is left: on the HIL rig an
       // ESP8266 shared gateway with ~11 KB free delivered its own result
       // into a callback that could no longer allocate the event it built.
-      this->addTask([this, ack]() {
-        gateway::GatewayAckPackage local = ack;
-        protocol::Variant variant(&local);
-        this->callbackList.execute(protocol::GATEWAY_ACK, variant, nullptr, 0);
-      });
+      //
+      // The ack is moved into one heap block and handed to the handler as
+      // it is. It used to be copied into the task's closure, copied again
+      // inside it, serialised into a JSON document by the Variant and
+      // parsed back into a third package by the handler -- the reply
+      // excerpt and the error text five times over on the heap the
+      // handler had already spent -- and on the rig the closure's own
+      // 76-byte allocation was the one that failed (#469). Nothing but
+      // handleGatewayAck() listens for GATEWAY_ACK, and a request that
+      // originated here exists only if enableSendToInternet() registered
+      // it, so the round trip through the callback list bought nothing.
+      // A shared_ptr rather than a C++14 init-capture: the ESP32 Arduino
+      // 2.x core still builds as gnu++11.
+      auto held = std::make_shared<gateway::GatewayAckPackage>(std::move(ack));
+      this->addTask([this, held]() { this->handleGatewayAck(*held); });
       Log(COMMUNICATION,
           "Completing local GATEWAY_ACK from the scheduler (success=%d, http=%d)\n",
           success, httpStatus);
@@ -2214,9 +2224,13 @@ class Mesh : public ntp::MeshTime, public plugin::PackageHandler<T> {
 
     // Check if this is a success response
     if (ack.success) {
-      const PendingInternetRequest done = request;
+      // Taken out of the map, not copied out of it, and the result handed
+      // on rather than copied: on an ESP8266 shared gateway every extra
+      // copy of the destination, the payload and the reply excerpt lands
+      // on a heap the request itself has nearly spent (#469).
+      PendingInternetRequest done = std::move(request);
       pendingInternetRequests.erase(it);
-      deliverInternetResult(done, result);
+      deliverInternetResult(done, std::move(result));
       return;
     }
 
@@ -2305,9 +2319,9 @@ class Mesh : public ntp::MeshTime, public plugin::PackageHandler<T> {
         Log(COMMUNICATION, "handleGatewayAck(): Final failure for msgId=%u (HTTP %u)\n",
             ack.messageId, ack.httpStatus);
       }
-      const PendingInternetRequest done = request;
+      PendingInternetRequest done = std::move(request);
       pendingInternetRequests.erase(it);
-      deliverInternetResult(done, result);
+      deliverInternetResult(done, std::move(result));
     }
   }
 
@@ -3092,15 +3106,15 @@ class Mesh : public ntp::MeshTime, public plugin::PackageHandler<T> {
    * Structure to hold detailed connection information
    */
   struct ConnectionInfo {
-    uint32_t nodeId;           // Connected node ID
-    uint32_t lastSeen;         // Timestamp of last message (ms)
-    int rssi;                  // Signal strength (dBm)
-    int avgLatency;            // Average round-trip time (ms)
-    int hopCount;              // Hops from current node
-    int quality;               // Connection quality (0-100)
-    uint32_t messagesRx;       // Messages received
-    uint32_t messagesTx;       // Messages sent
-    uint32_t messagesDropped;  // Failed transmissions
+    uint32_t nodeId = 0;           // Connected node ID
+    uint32_t lastSeen = 0;         // Timestamp of last message (ms)
+    int rssi = 0;                  // Signal strength (dBm)
+    int avgLatency = 0;            // Average round-trip time (ms)
+    int hopCount = 0;              // Hops from current node
+    int quality = 0;               // Connection quality (0-100)
+    uint32_t messagesRx = 0;       // Messages received
+    uint32_t messagesTx = 0;       // Messages sent
+    uint32_t messagesDropped = 0;  // Failed transmissions
   };
 
   /**
@@ -4098,7 +4112,8 @@ class Mesh : public ntp::MeshTime, public plugin::PackageHandler<T> {
   /// Is the node a root node
   bool shouldContainRoot = false;
 
-  Scheduler *mScheduler;
+  // init() either creates one or takes the caller's; null until then.
+  Scheduler *mScheduler = nullptr;
 
  public:  // Windows MSVC: lambdas in friend functions need public access
 

package/src/painlessmesh/message_queue.hpp

@@ -37,10 +37,10 @@ enum QueueState {
  * Contains all metadata needed for reliable message delivery
  */
 struct QueuedMessage {
-  uint32_t id;              // Unique message ID
-  MessagePriority priority; // Message priority level
-  uint32_t timestamp;       // When message was queued (millis)
-  uint32_t attempts;        // Number of send attempts
+  uint32_t id = 0;          // Unique message ID
+  MessagePriority priority = PRIORITY_NORMAL; // Message priority level
+  uint32_t timestamp = 0;   // When message was queued (millis)
+  uint32_t attempts = 0;    // Number of send attempts
   TSTRING payload;          // Message content
   TSTRING destination;      // Cloud endpoint/topic (optional metadata)
   
@@ -298,8 +298,8 @@ public:
 
 private:
   std::vector<QueuedMessage> messages;
-  uint32_t maxQueueSize;
-  uint32_t nextMessageId;
+  uint32_t maxQueueSize = 1000;
+  uint32_t nextMessageId = 1;
   QueueStats stats;
   QueueState currentState = QUEUE_EMPTY;
   queueStateChangedCallback_t stateChangedCallback;

package/src/painlessmesh/metrics.hpp

@@ -51,7 +51,7 @@ class Timer {
 #endif
   }
 
-  uint32_t start_time_;
+  uint32_t start_time_ = 0;
 #ifdef ESP32
   int64_t start_time_us_ = esp_timer_get_time();
 #endif

package/src/painlessmesh/ota.hpp

@@ -112,7 +112,7 @@ class Announce : public BroadcastPackage {
    */
   bool compressed = false;
 
-  size_t noPart;
+  size_t noPart = 0;
 
   Announce() : BroadcastPackage(10) {}
 

package/src/painlessmesh/plugin.hpp

@@ -39,10 +39,13 @@ namespace plugin {
 
 class SinglePackage : public protocol::PackageInterface {
  public:
-  uint32_t from;
-  uint32_t dest;
-  router::Type routing;
-  int type;
+  // `from` and `dest` are the application's to fill; a package built by
+  // the type constructor and sent before they are set addresses node 0,
+  // not whatever the stack held.
+  uint32_t from = 0;
+  uint32_t dest = 0;
+  router::Type routing = router::SINGLE;
+  int type = 0;
   int noJsonFields = 4;
 
   SinglePackage(int type) : routing(router::SINGLE), type(type) {}
@@ -65,9 +68,9 @@ class SinglePackage : public protocol::PackageInterface {
 
 class BroadcastPackage : public protocol::PackageInterface {
  public:
-  uint32_t from;
-  router::Type routing;
-  int type;
+  uint32_t from = 0;
+  router::Type routing = router::BROADCAST;
+  int type = 0;
   int noJsonFields = 3;
 
   BroadcastPackage(int type) : routing(router::BROADCAST), type(type) {}

package/src/painlessmesh/protocol.hpp

@@ -75,6 +75,10 @@ constexpr uint8_t PRIORITY_LOW = 3;
 
 class PackageInterface {
  public:
+  // A base with virtual functions destroyed through a derived pointer needs
+  // this, and a package held in a shared_ptr is exactly that case (#469);
+  // clang refuses the build without it under -Werror.
+  virtual ~PackageInterface() = default;
   virtual JsonObject addTo(JsonObject&& jsonObj) const = 0;
 #if ARDUINOJSON_VERSION_MAJOR < 7
   virtual size_t jsonObjectSize() const = 0;
@@ -89,8 +93,8 @@ class PackageInterface {
 class Single : public PackageInterface {
  public:
   int type = SINGLE;
-  uint32_t from;
-  uint32_t dest;
+  uint32_t from = 0;
+  uint32_t dest = 0;
   TSTRING msg = "";
   // Non-zero when the sender requested a delivery acknowledgment. Only
   // serialized when set, so plain sends carry zero overhead.
@@ -273,8 +277,8 @@ class NodeTree : public PackageInterface {
 class NodeSyncRequest : public NodeTree {
  public:
   int type = NODE_SYNC_REQUEST;
-  uint32_t from;
-  uint32_t dest;
+  uint32_t from = 0;
+  uint32_t dest = 0;
 
   NodeSyncRequest() {}
   NodeSyncRequest(uint32_t fromID, uint32_t destID, std::list<NodeTree> subTree,
@@ -351,8 +355,8 @@ struct time_sync_msg_t {
 class TimeSync : public PackageInterface {
  public:
   int type = TIME_SYNC;
-  uint32_t dest;
-  uint32_t from;
+  uint32_t dest = 0;
+  uint32_t from = 0;
   time_sync_msg_t msg;
 
   TimeSync() {}

package/src/painlessmesh/rtc.hpp

@@ -192,9 +192,9 @@ class RTCManager {
   }
   
  private:
-  RTCInterface* rtcInterface;
-  bool rtcEnabled;
-  uint32_t lastSyncTime;
+  RTCInterface* rtcInterface = nullptr;
+  bool rtcEnabled = false;
+  uint32_t lastSyncTime = 0;
 };
 
 }  // namespace rtc

package/src/plugin/performance.hpp

@@ -53,10 +53,10 @@ class Stats {
 
 class PerformancePackage : public plugin::BroadcastPackage {
  public:
-  int id = 0;      // Can see if we missed values
-  int time;        // Get an idea of the delay, by comparing it with nodetime
-  int stability;   // stability of the sending node
-  int freeMemory;  // memory of the sending node
+  int id = 0;          // Can see if we missed values
+  int time = 0;        // Get an idea of the delay, by comparing it with nodetime
+  int stability = 0;   // stability of the sending node
+  int freeMemory = 0;  // memory of the sending node
 #ifdef ESP32
   TSTRING hardware = "ESP32";
 #else
@@ -93,7 +93,7 @@ class PerformancePackage : public plugin::BroadcastPackage {
 /// Numbers to track for each node we receive PerformancePackages from
 class Track {
  public:
-  uint32_t nodeId;
+  uint32_t nodeId = 0;
   TSTRING hardware;
   uint32_t hits = 0;
   uint32_t misses = 0;