NetBird Release Notes

What's Changed

• [client] Stop dumping the whole device to clear one peer endpoint by @riccardomanfrin in https://github.com/netbirdio/netbird/pull/7632
• [infrastructure] Fix flow auth secret for external Relay migrations by @bcmmbaga in https://github.com/netbirdio/netbird/pull/7731
• [management] extract shared db conn + data repository by @pascal-fischer in https://github.com/netbirdio/netbird/pull/7649
• [management] Add a revocation guard hook to the proxy token API by @bison in https://github.com/netbirdio/netbird/pull/7732
• [management, proxy] Enforce strict base64url decoding for JWT validation by @bcmmbaga in https://github.com/netbirdio/netbird/pull/7554
• [management] Refactor PKCE verifier store into a reusable single-use store by @bcmmbaga in https://github.com/netbirdio/netbird/pull/7634
• [management] fix login filter by @pascal-fischer in https://github.com/netbirdio/netbird/pull/7739
• [management] Add a disabled state to the managed Agent Network proxy API by @bison in https://github.com/netbirdio/netbird/pull/7744
• [client] Keep the delete-profile dialog open until the delete finishes by @heisbrot in https://github.com/netbirdio/netbird/pull/7752
• [management,proxy] Use single-use codes for OIDC session handoff by @bcmmbaga in https://github.com/netbirdio/netbird/pull/7635
• [client] Replace the eBPF WireGuard proxy with loopback endpoint addressing by @lixmal in https://github.com/netbirdio/netbird/pull/7316 …

Changelog

• 88d8baac3f4b135502aa3dba86e15a4b95f32a76 Time the lost-collection wait from the oldest collection still running
• 2f66426f9f45651b5067504dc031d35a0516eeb7 Merge branch 'certificate-posture-client' into rm_certs_posture_chk
• ab75020c695207b12046519610856a8bcefc6f67 Fix the pending checks comments
• 6f0dcfed9d65a6979942027b3cc60c8b5558d889 Accept only whole-second challenge windows of at least 30 seconds
• a99026664912c438bdd53e1e3ec6c50a6f95ab73 Start the certificate challenge refresher only once the account manager is built
• e02c3828c63a084303e7ac67d0e5192d27a66c1e Keep an account tracked for certificate challenges when it is tracked again during its refresh
• d9f1a94d9f341d1fa61de9783840acac1a7d77be Let a lost proof collection go after ten deadlines, sharing the slots across engine restarts
• 23a78098359b9e60025037b48633eb44310a14ed Merge certificate-posture-client into rm_certs_posture_chk
• 3d629c565d49f24a7b2628f631ddf3aa07818806 Close a PKCS#11 module that loads but cannot be used
• f603251d8796bc508a807c34aacc74f677b75042 Share the proof collection single-flight across engine restarts
• d70249adbcbd59f1f2814612b3fcbf55981b5c9c Report no lost certificate when the engine stops during a proof collection
• 4ad5c16cd47f66198bb5b6a8369f41a91b8c28f0 Keep the newest posture checks pending whatever made their meta sync fail
• 0dab17141ffc4180bdc5d10954bfb0c76ba7922d [management] Keep the certificate challenge comments to what the history does not say …

Release Notes for v0.80.0

What's New

🔒 Security and Access Control

• Refused to pin an agent network gateway onto another account's host, adding cross-account validation for gateway assignments. #7519
• Validated proxy cluster on Agent Network bootstrap, preventing an agent network from bootstrapping onto another account's proxy cluster. #7402
• Refused HTTP redirects on IdP clients, preventing open redirect attacks against identity provider integrations. #7579
• Revoked local Dex session on embedded IdP password change, ensuring sessions are properly invalidated when credentials are updated. #7556
• Added upload URL signing and rate limiting for file upload endpoints. #7502

🖥️ Client Improvements

• Staged install script downloads in a private temp directory, preventing other processes from tampering with downloaded files before installation. #7534
• Enforced HTTPS on install script downloads, ensuring all client downloads use secure connections. #7545 …

What's Changed

• [management] Speed up test store setup and summarize the unit test run by @mlsmaycon in https://github.com/netbirdio/netbird/pull/7518
• [management] Refuse to pin an agent network gateway onto another account's host by @mlsmaycon in https://github.com/netbirdio/netbird/pull/7519
• [management] Validate the proxy cluster an agent network bootstraps onto by @mlsmaycon in https://github.com/netbirdio/netbird/pull/7402
• [management] Point the agent-config e2e providers at the mock upstream by @mlsmaycon in https://github.com/netbirdio/netbird/pull/7542
• [client] Stage install script downloads in a private temp directory by @riccardomanfrin in https://github.com/netbirdio/netbird/pull/7534
• [client] Read the session deadline under the status read lock by @pappz in https://github.com/netbirdio/netbird/pull/7550
• [client] Enforce HTTPS on install script downloads by @riccardomanfrin in https://github.com/netbirdio/netbird/pull/7545
• [misc] Load AGENTS.md every session and refuse attribution trailers by @mlsmaycon in https://github.com/netbirdio/netbird/pull/7544
• [client] Fix - Add RPM metadata required for Red Hat software certification by @braginini in https://github.com/netbirdio/netbird/pull/7562
• [management] Read X-Real-IP when extracting the peer connection IP by @bcmmbaga in https://github.com/netbirdio/netbird/pull/7561
• [management] Handle empty trusted peer by @bcmmbaga in https://github.com/netbirdio/netbird/pull/7589 …

What's Changed

• [management] Speed up test store setup and summarize the unit test run by @mlsmaycon in https://github.com/netbirdio/netbird/pull/7518
• [management] Refuse to pin an agent network gateway onto another account's host by @mlsmaycon in https://github.com/netbirdio/netbird/pull/7519
• [management] Validate the proxy cluster an agent network bootstraps onto by @mlsmaycon in https://github.com/netbirdio/netbird/pull/7402
• [management] Point the agent-config e2e providers at the mock upstream by @mlsmaycon in https://github.com/netbirdio/netbird/pull/7542
• [client] Stage install script downloads in a private temp directory by @riccardomanfrin in https://github.com/netbirdio/netbird/pull/7534
• [client] Read the session deadline under the status read lock by @pappz in https://github.com/netbirdio/netbird/pull/7550
• [client] Enforce HTTPS on install script downloads by @riccardomanfrin in https://github.com/netbirdio/netbird/pull/7545
• [misc] Load AGENTS.md every session and refuse attribution trailers by @mlsmaycon in https://github.com/netbirdio/netbird/pull/7544
• [client] Fix - Add RPM metadata required for Red Hat software certification by @braginini in https://github.com/netbirdio/netbird/pull/7562
• [management] Read X-Real-IP when extracting the peer connection IP by @bcmmbaga in https://github.com/netbirdio/netbird/pull/7561
• [management] Handle empty trusted peer by @bcmmbaga in https://github.com/netbirdio/netbird/pull/7589 …

Release Notes for v0.79.0

New Feature: Desktop Light Mode

The desktop app now gives you three appearance options: System, Light, and Dark. Follow your operating system's theme or choose the look you prefer. The new light theme covers the connection view, settings, profiles, and dialogs, with matching native window appearance on Windows, macOS, and Linux. #7344 by @TechHutTV

<img width="2022" height="1542" alt="image" src="https://github.com/user-attachments/assets/2081f103-f766-4f2d-92df-b304eaaa5acb" />

This release also brings shared MDM policy enforcement to the mobile SDKs, a rootless Red Hat UBI container image, and improvements to DNS, relay connections, and reverse proxy access controls.

What's Changed

Desktop Client Improvements

• Fixed a Windows tray deadlock that could freeze the app when a double-click opened a window while another window was still being created. #7449 by @pappz
• Fixed the MDM settings snapshot so the UI correctly reports when remote jobs are managed by policy. #7485 by @pappz

Client Improvements

• Added MDM policy bridges and shared enforcement for the iOS and Android SDKs, keeping managed settings and profile restrictions consistent with the desktop client. #6435 by @riccardomanfrin …

Changelog

• a54d96cd72b453f15807b665ceed83ddbd1c2b0e [proxy] Make the upstream HTTP version configurable (#7410)
• 2d28f9002a7a43f6a3da322b643efb6ab5242fe5 [client] Fix the Windows tray deadlock on re-entrant window creation (#7449)
• 0f797f89c1d6c36d201a81b5610e7850fda82bc8 [client] Bump wireguard-go to 8bf8fa968f1a (#7532)
• 791401060d2b95e5f51e3439c0649729132f571e [management] Prevent deleting groups referenced by agent network budget rules (#7450)
• 973173be9ca68abcf32b4a59aa5b6dfe6351c984 [misc] Pull the MinIO test image from quay.io (#7516)
• 82b1c7da222382a5f1013a3fabc0965a703109f4 [management] Harden OIDC issuer validation and discovery (#7435)
• b789ffbb9fc77e4ef9575023a6603bbdc7105f86 [management] Expire unvalidated custom domain registrations (#7497)
• ec0c36b0e7b34fd17948ff3fcd7c77d50104750e [client] Add light mode with system, light, and dark theme options (#7344)
• f422c4165437679a1470893e7917a8ef597a2277 [management] extract peer update logic and wrap it in tests (#7338)
• 794956a7a313c8919fd92123fb06ff30b7b0032a [client] Fix relay instance address race (#7498)
• 58114f98fb253ea3e4abf6eefe07d3d57b43e5d5 [management] Only trust forwarded-IP headers from configured trusted peers (#7454)
• b57f0e56085bb57d05611b2c378913a2b9098c43 [infrastructure] Preserve snapshot image variant tags (#7511)
• ad3f570e324c1098d4f035466e77730e7df1b214 [management] validate the domain for the flock in proxy (#7501) …

Canary release

Only testable code based on ongoing development.

What's Changed

• [misc] Skip the protobuf breaking check on branch-creation pushes by @bison in https://github.com/netbirdio/netbird/pull/7411
• [management, proxy] Enforce reverse proxy group access for OIDC sessions by @lixmal in https://github.com/netbirdio/netbird/pull/7240
• [management] Serve networks with peer-based routers from the SQLite network map by @mlsmaycon in https://github.com/netbirdio/netbird/pull/7418
• [management] disallow weird ip addresses for direct upstream hosts by @dmitri-netbird in https://github.com/netbirdio/netbird/pull/7400
• [management] Add SetNX and GetDel cache store operations by @bcmmbaga in https://github.com/netbirdio/netbird/pull/7084
• [management] Keep embedded IdP deployments on a single account by @bcmmbaga in https://github.com/netbirdio/netbird/pull/7380
• [management] blocking sync requests for user peers sharing the same wireguard key by @pascal-fischer in https://github.com/netbirdio/netbird/pull/7427
• [client] Gather fresh system info on every management sync stream connect by @pappz in https://github.com/netbirdio/netbird/pull/7409
• [client] Assign the Android TUN address as a host prefix by @pappz in https://github.com/netbirdio/netbird/pull/7414
• [management] update network_router_test to verify empty and nil peer_groups by @dmitri-netbird in https://github.com/netbirdio/netbird/pull/7425 …

Release Notes for v0.78.0

Highlights

• Rosenpass now works through the embedded reverse proxy (#6763). Until now the proxy ran no Rosenpass at all, so peers with Rosenpass enabled failed to establish through it on a PSK mismatch — an incompatibility that was never documented. The proxy now runs Rosenpass in permissive mode, so it connects both to Rosenpass-enabled peers and, exactly as before, to peers without it. NB_PROXY_ROSENPASS=false turns it off.
• Lazy connections reworked: per-peer lazy state, proxy peers lazy by default, and the lazy exclusion list removed (#6762, #6763).
• Agent Network / LLM gateway: agentgateway integration, access roles and self-service endpoints, Bedrock model discovery served from the control plane, guardrail allowlists for declared model ids, and the endpoint conformed to the LLM gateway protocol (#7274, #7221, #7250, #7239, #7154, #7389, #7246).
• DNS on Windows: a catch-all NRPT rule when NetBird is the primary resolver (#7071), closing the leak/poisoning window towards the system resolvers. Use netbird service reconfigure --service-env NB_USE_LEGACY_DNS_RESOLUTION=true to restore the old behavior.
• Local Prometheus metrics endpoint on the client (#6689).
• Go 1.26 and go-quic v0.62.0 across client, relay and management (#7359).
• Unified ACL filtering for peers and routes, with multi-source rules (#6322). An internal …

Release Notes for v0.77.1

What's New

Client Improvements

• Fixed session extension and SSH authentication always using the device code flow on Linux. https://github.com/netbirdio/netbird/pull/7187

• Added Windows DNS configuration to the debug bundle. https://github.com/netbirdio/netbird/pull/7196

• Added a CI check for translation key parity. https://github.com/netbirdio/netbird/pull/6852

• Preserved the account email on Android logout while removing it when a profile is deleted. https://github.com/netbirdio/netbird/pull/7200

• Ranked Windows route candidates using combined route and interface metrics. https://github.com/netbirdio/netbird/pull/7210

• Skipped IPv6 route tests when the default next hop is unusable. https://github.com/netbirdio/netbird/pull/7212

• Passed the stored email as a login hint from the UI and preserved it on logout. https://github.com/netbirdio/netbird/pull/7199

• Fixed inconsistencies in the CI gomobile init process. https://github.com/netbirdio/netbird/pull/7229

• Deleted Windows NRPT rules by enumerating the registry instead of relying on a rule count. https://github.com/netbirdio/netbird/pull/7195

• Declared multi-buffer support for the loopback XDP program. https://github.com/netbirdio/netbird/pull/7230

• Exposed SSH functionality on Android. https://github.com/netbirdio/netbird/pull/7156

• Handled Android network changes without restarting the engine. …

Release Notes for v0.77.0

What's New

Agent Network

• Reworked Agent Network endpoint identity and settings bootstrap. https://github.com/netbirdio/netbird/pull/7085

• Added a proxy-connect authorizer seam for Agent Network. https://github.com/netbirdio/netbird/pull/7136

• Added reverse proxy usage accounting for activity tracking. https://github.com/netbirdio/netbird/pull/7116

Client Improvements

• Added strict anonymization level and MAC address anonymization to debug bundles. https://github.com/netbirdio/netbird/pull/7102

• Declared the xdg-utils dependency for NetBird UI packages. https://github.com/netbirdio/netbird/pull/7126

• Fixed credentials used for GTK3 package uploads. https://github.com/netbirdio/netbird/pull/7125

• Prevented WireGuard packets from being misrouted to the STUN handler. https://github.com/netbirdio/netbird/pull/7059

• Updated the NetBird Wails fork to remove the native WebView2 dependency. https://github.com/netbirdio/netbird/pull/7128

• Migrated the relay QUIC tracer to qlog and upgraded quic-go to v0.59.1. https://github.com/netbirdio/netbird/pull/7124

• Derived Windows SSH privilege checks from the user token and group membership. https://github.com/netbirdio/netbird/pull/6966

• Adjusted the GTK3 release job. https://github.com/netbirdio/netbird/pull/7163

• Fixed a macOS DNS panic caused by malformed scutil output. …

What's Changed

• [management] prewarm a posture check cache on network map generation by @pascal-fischer in https://github.com/netbirdio/netbird/pull/7093
• [client] peer: re-arm the WireGuard watcher after a lazy wake by @riccardomanfrin in https://github.com/netbirdio/netbird/pull/7091
• [infrastructure] Detect community GHCR images during enterprise migration by @jnfrati in https://github.com/netbirdio/netbird/pull/7101
• [client] disambiguate the connection_type metric tag by @riccardomanfrin in https://github.com/netbirdio/netbird/pull/7043
• [management] Affected peers for user updates by @pascal-fischer in https://github.com/netbirdio/netbird/pull/7099
• [infrastructure] add grafana dashboard for licensed management by @mlsmaycon in https://github.com/netbirdio/netbird/pull/7095
• [management] Deny reverse proxy access to pending and blocked users by @mlsmaycon in https://github.com/netbirdio/netbird/pull/7105

Full Changelog: https://github.com/netbirdio/netbird/compare/v0.76.2...v0.76.3

What's Changed

• [misc] add AGENTS.md file by @mlsmaycon in https://github.com/netbirdio/netbird/pull/7014
• [client] Handle interface lookup errors in iOS DNS index helper by @Optic00 in https://github.com/netbirdio/netbird/pull/6999
• [client] iOS - Remove duplicate Login RPCs from the iOS SDK by @evgeniyChepelev in https://github.com/netbirdio/netbird/pull/6931
• [client] Declare GTK4/WebKitGTK runtime deps for the Linux UI packages by @pappz in https://github.com/netbirdio/netbird/pull/6893
• [management] Generic gRPC extension seam for external modules by @bison in https://github.com/netbirdio/netbird/pull/6894
• [management] Resolve agent network permissions per submodule by @mlsmaycon in https://github.com/netbirdio/netbird/pull/7030
• [management] fix handling of empty network map during decode and encode by @pascal-fischer in https://github.com/netbirdio/netbird/pull/6987
• [client] Keep the account email backing the SSO login hint correct by @pappz in https://github.com/netbirdio/netbird/pull/6986
• [client] Android - Create the Android fake IP manager lazily on DNS flag enable by @pappz in https://github.com/netbirdio/netbird/pull/6989
• [client] Android - Serialize Android tunnel reconfiguration callbacks by @pappz in https://github.com/netbirdio/netbird/pull/6990
• [client] Keep the UI running when the notification service fails to start by @lixmal in https://github.com/netbirdio/netbird/pull/6959 …

What's Changed

• [client] Support Android session expiry handling by @pappz in https://github.com/netbirdio/netbird/pull/6945
• [client] Stop and remove the daemon on netbird-ui cask uninstall by @lixmal in https://github.com/netbirdio/netbird/pull/6977
• [misc] Update SECURITY.md by @mlsmaycon in https://github.com/netbirdio/netbird/pull/6981
• [misc] group x package updates and run weekly by @mlsmaycon in https://github.com/netbirdio/netbird/pull/7000
• [client] Fix daemon lock order inversion between SetConfig and login by @lixmal in https://github.com/netbirdio/netbird/pull/6978
• [client] Fix expression order in legacy nftables route rules by @Optic00 in https://github.com/netbirdio/netbird/pull/7011
• [proxy] remove cluster tag from proxy metrics by @pascal-fischer in https://github.com/netbirdio/netbird/pull/6985
• [misc] update contributing guide by @mlsmaycon in https://github.com/netbirdio/netbird/pull/7009
• [client] Restrict debug bundle log path and upload destinations by @lixmal in https://github.com/netbirdio/netbird/pull/6975
• [management, proxy] Management-owned LLM pricing: file-backed defaults + by @braginini in https://github.com/netbirdio/netbird/pull/6965

Agent Network

• The merged PR https://github.com/netbirdio/netbird/pull/6965 requires an upgrade of both Management and Proxy containers. New proxy under old management silently disables cost metering.

New Contributors …

Security

Fixes a local privilege escalation in the client daemon (https://github.com/netbirdio/netbird/security/advisories/GHSA-qcpp-8vwj-hhwr). The daemon's local control interface accepted any local caller without authentication, so an unprivileged user on the same machine could enable the embedded SSH server, turn on SSH root login and disable SSH authentication, and then open a root shell. Every version from 0.5.0 to 0.75.1 is affected: on Linux, macOS and FreeBSD through the world-writable Unix socket, and on Windows through the loopback TCP listener, which carried no caller identity at all. Reported by @neewek.

The daemon now derives each local caller's identity from the kernel and requires root, or an administrator on Windows, to enable the SSH server, enable SSH root login, disable SSH authentication, or to change the management URL or deregister the peer while that profile has the SSH server enabled. On Windows it serves a named pipe instead of loopback TCP, and existing installations are migrated automatically.

Upgrade note: if you enable any of those settings from a script or an unprivileged session, run the command with sudo, or from an elevated prompt on Windows. Turning them off is unchanged, and so is everything else on the socket.

Learn more here

What's Changed …

Release Notes for v0.75.1

What's New

Agent Network

• Added prompt cache token and cost accounting to Agent Network usage. https://github.com/netbirdio/netbird/pull/6900

• Added support for Claude Opus 5. https://github.com/netbirdio/netbird/pull/6895

• Scoped Agent Network model allowlists per policy, group, and provider. https://github.com/netbirdio/netbird/pull/6905

Client Improvements

• Reconcile routed AllowedIPs when a lazy connection becomes idle. https://github.com/netbirdio/netbird/pull/6863

• Fetch FreeBSD port files from the GitHub mirror instead of cgit. https://github.com/netbirdio/netbird/pull/6880

• Restored the missing backup.Reset behavior. https://github.com/netbirdio/netbird/pull/6883

• Made Test_ConnectPeers deterministic under Docker/eBPF kernel and Darwin CI. https://github.com/netbirdio/netbird/pull/6884

• Export agent version information for iOS. https://github.com/netbirdio/netbird/pull/6918

• Use platform-specific installer URLs for manual update downloads. https://github.com/netbirdio/netbird/pull/6922

• Exit the GUI immediately when the Windows session ends. https://github.com/netbirdio/netbird/pull/6878

• Fixed stale routing peers after removing overlapping-prefix networks. https://github.com/netbirdio/netbird/pull/6799

• Added ReapplyMatching support to the dedicated AllowedIPsRefCounter. https://github.com/netbirdio/netbird/pull/6935 …