Release notes from netbird

v0.80.0

2026-10-01T18:25:35Z

Release Notes for v0.80.0

What's New

🔒 Security and Access Control

Refused to pin an agent network gateway onto another account's host, adding cross-account validation for gateway assignments. #7519
Validated proxy cluster on Agent Network bootstrap, preventing an agent network from bootstrapping onto another account's proxy cluster. #7402
Refused HTTP redirects on IdP clients, preventing open redirect attacks against identity provider integrations. #7579
Revoked local Dex session on embedded IdP password change, ensuring sessions are properly invalidated when credentials are updated. #7556
Added upload URL signing and rate limiting for file upload endpoints. #7502

🖥️ Client Improvements

Staged install script downloads in a private temp directory, preventing other processes from tampering with downloaded files before installation. #7534
Enforced HTTPS on install script downloads, ensuring all client downloads use secure connections. #7545
Fixed peers not being notified when the relay connection drops, which could leave stale peer state after a relay disconnect. #7490
Fixed session deadline read under the status read lock, preventing a potential race condition. #7550
Removed the empty GPO DNS policy store on Windows teardown, cleaning up leftover DNS policy entries when the client shuts down. #7563
Resolved the shared socket source address through a connected UDP probe socket, fixing source address resolution for shared socket mode. #7633
Validated saved service parameters and pinned the netsh lookup on Windows, hardening the service configuration path. #7584
Used POSIX-style file read/write of JSON on Windows, improving cross-platform config file handling. #7631
Raised the daemon IPC receive limit to 16 MB, matching gRPC's default and preventing truncation of large messages. #7676
Skipped route firewall rule computation when no firewall is configured, avoiding unnecessary work. #7624
Fixed device dump clearing all peer endpoints instead of just the target one, which could disrupt connections to other peers. #7632
Fixed Windows IPC privilege check to only treat LocalSystem as a privileged identity by SID. Local Service and Network Service now go through the same checks as any other caller. #7889
Bumped Wails to v3.0.0-beta.25 for the desktop UI. #7640

⚙️ Management Improvements

Sped up test store setup and summarized unit test runs, improving CI performance. #7518
Read X-Real-IP when extracting the peer connection IP, supporting deployments behind reverse proxies. #7561
Handled empty trusted peer to avoid errors when no trusted peer is configured. #7589
Named the account owner in the pending approval error, making it clear who to contact for account approval. #7533
Fixed group resource validation for proper enforcement. #7608
Added store support to filter by public ID. #7208
Recorded proxy version on connect for tracking and debugging. #7630
Split store by table for improved database performance and organization. #7646
Prevented deleting custom domains used by services, protecting active proxy configurations from accidental removal. #7515
Moved rate limiter to shared package for reuse across services. #7727
Let usage_viewer read Agent Network access logs, so users reviewing cost can now see the requests behind usage metrics. #7750

🔀 Reverse Proxy

Closed the client connection on private service denials instead of leaving it hanging. #7590
Added proxy rate limiter to protect against abuse. #7568
Added proxy credentials limiter on management to throttle authentication attempts. #7569
Fixed upstream HTTP version applied before cloning transports. #7806
Added release-wired UBI image variant for the proxy. #7464
Fixed flow auth secret for external Relay migrations. #7731

🏗️ Infrastructure and CI

Certified the rootless UBI client image on release for Red Hat ecosystem compliance. #7525
Fixed RPM metadata for Red Hat software certification (two rounds of fixes). #7562, #7614
Added proxy support to enterprise setup. #7651
Built the upload server from source, nonroot on Chainguard for a hardened container image. #7663
Built and linted mobile Go code in CI for Android. #7641
Bumped workflow actions off the retired Node 20 runtime. #7644
Added Pyroscope profiling to management, signal, and proxy services. #7536
Pointed the agent-config e2e providers at the mock upstream. #7542
Used the Silo image for the S3 upload test. #7619

📝 Misc

Pointed bug reports at Discussions and added SUPPORT.md. #7647
Added cloud API spec to the public OpenAPI definition with REST client. #7222
Loaded AGENTS.md every session and refused attribution trailers. #7544

What's Changed

[management] Speed up test store setup and summarize the unit test run by @mlsmaycon in #7518
[management] Refuse to pin an agent network gateway onto another account's host by @mlsmaycon in #7519
[management] Validate the proxy cluster an agent network bootstraps onto by @mlsmaycon in #7402
[management] Point the agent-config e2e providers at the mock upstream by @mlsmaycon in #7542
[client] Stage install script downloads in a private temp directory by @riccardomanfrin in #7534
[client] Read the session deadline under the status read lock by @pappz in #7550
[client] Enforce HTTPS on install script downloads by @riccardomanfrin in #7545
[misc] Load AGENTS.md every session and refuse attribution trailers by @mlsmaycon in #7544
[client] Fix - Add RPM metadata required for Red Hat software certification by @braginini in #7562
[management] Read X-Real-IP when extracting the peer connection IP by @bcmmbaga in #7561
[management] Handle empty trusted peer by @bcmmbaga in #7589
[proxy] Close the client connection on private service denials by @mlsmaycon in #7590
[management] Name the account owner in the pending approval error by @heisbrot in #7533
[proxy] add proxy rate limiter by @pascal-fischer in #7568
[management] Add proxy credentials limiter on management by @pascal-fischer in #7569
[client] Fix peers not being notified when the relay connection drops by @pappz in #7490
[management] fix group resource validation by @pascal-fischer in #7608
[client] Remove the empty GPO DNS policy store on Windows teardown by @lixmal in #7563
[management] add store support to filter by public id by @pascal-fischer in #7208
[client,management] Skip route firewall rule computation when no firewall by @riccardomanfrin in #7624
[management] record proxy version on connect by @pascal-fischer in #7630
[management,signal,proxy] add pyroscope profiling by @pascal-fischer in #7536
[client] Validate the saved service parameters and pin the netsh lookup by @riccardomanfrin in #7584
[client] Use POSIX style file read/write of json for windows by @theodorsm in #7631
[client] Fix RPM metadata for Red Hat certification by @braginini in #7614
[misc] Bump workflow actions off the retired Node 20 runtime by @heisbrot in #7644
[misc] Add upload URL signing and rate limiting by @bcmmbaga in #7502
[misc] Use the Silo image for the S3 upload test by @Silex in #7619
[management] split store by table by @pascal-fischer in #7646
[management] Refuse HTTP redirects on IdP clients by @bcmmbaga in #7579
[management] Revoke local Dex session on embedded IdP password change by @bcmmbaga in #7556
[misc, android] Build and lint the mobile Go code in CI by @riccardomanfrin in #7641
[client] Raise the daemon IPC receive limit gRPC's to 16 MB by @riccardomanfrin in #7676
[misc] Build the upload server from source, nonroot on Chainguard by @bison in #7663
[infrastructure] Certify the rootless UBI client image on release by @braginini in #7525
[client] Resolve the shared socket source address through a connected UDP probe socket by @lixmal in #7633
[proxy] Add a release-wired UBI image variant by @jnfrati in #7464
[infrastructure] Add proxy support to enterprise setup by @bcmmbaga in #7651
[doc] Point bug reports at Discussions and add SUPPORT.md by @thomashacker in #7647
[management] Prevent deleting custom domains used by services by @mlsmaycon in #7515
[management] move rate limiter to shared package by @pascal-fischer in #7727
[client] Bump wails to v3.0.0-beta.25 by @pappz in #7640
[client] Stop dumping the whole device to clear one peer endpoint by @lixmal in #7632
[infrastructure] Fix flow auth secret for external Relay migrations by @braginini in #7731
[proxy] Apply the upstream HTTP version before cloning transports by @mlsmaycon in #7806
[management] Let usage_viewer read Agent Network access logs by @jnfrati in #7750
[client] Only treat LocalSystem as a privileged identity by SID on Windows by @lixmal in #7889

New Contributors

@thomashacker made their first contribution in #7647

Full Changelog: v0.79.0...v0.80.0

v0.80.0-rc.2

2026-09-30T13:01:52Z

Changelog

7a53a7b [proxy] Apply the upstream HTTP version before cloning transports (#7806) (#7813)
da483ab [client] Stop dumping the whole device to clear one peer endpoint (#7632) (#7741)
6441417 [infrastructure] Fix flow auth secret for external Relay migrations (#7731) (#7737)

v0.80.0-rc.1

2026-09-29T15:31:18Z

What's Changed

[management] Speed up test store setup and summarize the unit test run by @mlsmaycon in #7518
[management] Refuse to pin an agent network gateway onto another account's host by @mlsmaycon in #7519
[management] Validate the proxy cluster an agent network bootstraps onto by @mlsmaycon in #7402
[management] Point the agent-config e2e providers at the mock upstream by @mlsmaycon in #7542
[client] Stage install script downloads in a private temp directory by @riccardomanfrin in #7534
[client] Read the session deadline under the status read lock by @pappz in #7550
[client] Enforce HTTPS on install script downloads by @riccardomanfrin in #7545
[misc] Load AGENTS.md every session and refuse attribution trailers by @mlsmaycon in #7544
[client] Fix - Add RPM metadata required for Red Hat software certification by @braginini in #7562
[management] Read X-Real-IP when extracting the peer connection IP by @bcmmbaga in #7561
[management] Handle empty trusted peer by @bcmmbaga in #7589
[proxy] Close the client connection on private service denials by @mlsmaycon in #7590
[management] Name the account owner in the pending approval error by @heisbrot in #7533
[proxy] add proxy rate limiter by @pascal-fischer in #7568
[management] Add proxy credentials limiter on management by @pascal-fischer in #7569
[client] Fix peers not being notified when the relay connection drops by @pappz in #7490
[management] fix group resource validation by @pascal-fischer in #7608
[client] Remove the empty GPO DNS policy store on Windows teardown by @lixmal in #7563
[management] add store support to filter by public id by @pascal-fischer in #7208
[client,management] Skip route firewall rule computation when no firewall by @riccardomanfrin in #7624
[management] record proxy version on connect by @pascal-fischer in #7630
[management,signal,proxy] add pyroscope profiling by @pascal-fischer in #7536
[client] Validate the saved service parameters and pin the netsh lookup by @riccardomanfrin in #7584
[client] Use POSIX style file read/write of json for windows by @theodorsm in #7631
[client] Fix RPM metadata for Red Hat certification by @braginini in #7614
[misc] Bump workflow actions off the retired Node 20 runtime by @heisbrot in #7644
[misc] Add upload URL signing and rate limiting by @bcmmbaga in #7502
[misc] Use the Silo image for the S3 upload test by @Silex in #7619
[management] split store by table by @pascal-fischer in #7646
[management] Refuse HTTP redirects on IdP clients by @bcmmbaga in #7579
[management] Revoke local Dex session on embedded IdP password change by @bcmmbaga in #7556
[misc, android] Build and lint the mobile Go code in CI by @riccardomanfrin in #7641
[client] Raise the daemon IPC receive limit gRPC's to 16 MB by @riccardomanfrin in #7676
[misc] Build the upload server from source, nonroot on Chainguard by @bison in #7663
[infrastructure] Certify the rootless UBI client image on release by @braginini in #7525
[client] Resolve the shared socket source address through a connected UDP probe socket by @lixmal in #7633
[proxy] Add a release-wired UBI image variant by @jnfrati in #7464
[infrastructure] Add proxy support to enterprise setup by @bcmmbaga in #7651
[doc] Point bug reports at Discussions and add SUPPORT.md by @thomashacker in #7647
[management] Prevent deleting custom domains used by services by @mlsmaycon in #7515
[management] move rate limiter to shared package by @pascal-fischer in #7727
[client] Bump wails to v3.0.0-beta.25 by @pappz in #7640

New Contributors

@thomashacker made their first contribution in #7647

Full Changelog: v0.79.0-rc.1...v0.80.0-rc.1

v0.81.0-canary.pr-7662.1

2026-09-26T16:16:35Z

What's Changed

[management] Speed up test store setup and summarize the unit test run by @mlsmaycon in #7518
[management] Refuse to pin an agent network gateway onto another account's host by @mlsmaycon in #7519
[management] Validate the proxy cluster an agent network bootstraps onto by @mlsmaycon in #7402
[management] Point the agent-config e2e providers at the mock upstream by @mlsmaycon in #7542
[client] Stage install script downloads in a private temp directory by @riccardomanfrin in #7534
[client] Read the session deadline under the status read lock by @pappz in #7550
[client] Enforce HTTPS on install script downloads by @riccardomanfrin in #7545
[misc] Load AGENTS.md every session and refuse attribution trailers by @mlsmaycon in #7544
[client] Fix - Add RPM metadata required for Red Hat software certification by @braginini in #7562
[management] Read X-Real-IP when extracting the peer connection IP by @bcmmbaga in #7561
[management] Handle empty trusted peer by @bcmmbaga in #7589
[proxy] Close the client connection on private service denials by @mlsmaycon in #7590
[management] Name the account owner in the pending approval error by @heisbrot in #7533
[proxy] add proxy rate limiter by @pascal-fischer in #7568
[management] Add proxy credentials limiter on management by @pascal-fischer in #7569
[client] Fix peers not being notified when the relay connection drops by @pappz in #7490
[management] fix group resource validation by @pascal-fischer in #7608
[client] Remove the empty GPO DNS policy store on Windows teardown by @lixmal in #7563
[management] add store support to filter by public id by @pascal-fischer in #7208
[client,management] Skip route firewall rule computation when no firewall by @riccardomanfrin in #7624
[management] record proxy version on connect by @pascal-fischer in #7630
[management,signal,proxy] add pyroscope profiling by @pascal-fischer in #7536

Full Changelog: v0.79.0-rc.1...v0.81.0-canary.pr-7662.1

v0.79.0

2026-09-18T17:32:27Z

Release Notes for v0.79.0

New Feature: Desktop Light Mode

The desktop app now gives you three appearance options: System, Light, and Dark. Follow your operating system's theme or choose the look you prefer. The new light theme covers the connection view, settings, profiles, and dialogs, with matching native window appearance on Windows, macOS, and Linux. #7344 by @TechHutTV

This release also brings shared MDM policy enforcement to the mobile SDKs, a rootless Red Hat UBI container image, and improvements to DNS, relay connections, and reverse proxy access controls.

What's Changed

Desktop Client Improvements

Fixed a Windows tray deadlock that could freeze the app when a double-click opened a window while another window was still being created. #7449 by @pappz
Fixed the MDM settings snapshot so the UI correctly reports when remote jobs are managed by policy. #7485 by @pappz

Client Improvements

Added MDM policy bridges and shared enforcement for the iOS and Android SDKs, keeping managed settings and profile restrictions consistent with the desktop client. #6435 by @riccardomanfrin
Accepted MDM boolean values delivered as JSON numbers, so policies using 0 and 1 are applied correctly. #7471 by @riccardomanfrin
Compared MDM-managed URLs by their normalized endpoints, avoiding false conflicts between equivalent URLs. #7472 by @riccardomanfrin
Refreshed system information on every management sync reconnect, keeping local network addresses and posture information current after network changes. #7409 by @pappz
Used host prefixes for Android TUN addresses so local network protection does not classify the entire overlay as a local network. #7414 by @pappz
Replaced the eBPF DNS forwarder with UDP and TCP DNAT rules when the resolver cannot listen on port 53, with rollback and cleanup for incomplete redirects. #7439 by @lixmal
Fixed a relay address race that could advertise a URL and IP from different connections during a reconnect. #7498 by @pappz
Returned the context cancellation or timeout error when an SSH handshake is interrupted. #7426 by @pappz
Updated wireguard-go to 8bf8fa968f1a, fixing keepalive buffer-pool stalls, keeping timer paths non-blocking, and making netstack interface shutdown idempotent. #7532 by @pappz
Allowed buffer-pool limits to be adjusted while a device is stalled, and bounded proxy-wide updates so one stuck client does not block the others. #7452 by @riccardomanfrin

Management Improvements

Restored networks using individual peers as routers in the SQLite network map when peer_groups is empty or null. #7418 by @mlsmaycon
Fixed SQLite network-map reads for users with null automatic groups and expanded coverage for empty and null router groups. #7425 by @dmitri-netbird
Included offline peers when scheduling login expiration and ensured expired peers are disconnected, while protecting peers that have just logged in again. #7467 by @pascal-fischer
Applied duplicate-key sync protection to user-owned peers as well as peers registered with setup keys. #7427 by @pascal-fischer
Validated that a peer exists before adding it to a group. #7486 by @pascal-fischer
Prevented other users from deleting the account owner. #7456 by @pascal-fischer
Hardened OIDC issuer validation by requiring HTTPS, rejecting credentials, query strings, and fragments in issuer URLs, refusing discovery redirects, and limiting discovery response size. #7435 by @bcmmbaga
Cleaned up resources when WebSocket-to-gRPC proxy connections close. #7484 by @dmitri-netbird

Agent Network

Added managed proxy provisioning endpoints and response types to the API specification. #7433 by @bison
Prevented deletion of groups referenced by Agent Network budget rules, preserving the rules' spending limits. #7450 by @Tyagiquamar

Reverse Proxy Improvements

Added NB_PROXY_UPSTREAM_HTTP_VERSION with auto, 1.1, and 2 options. The default auto mode negotiates with HTTPS upstreams and falls back to HTTP/1.1 when an upstream's negotiated HTTP/2 connection fails at the protocol level. #7410 by @lixmal
Enforced group access both when issuing session cookies and when accepting existing sessions. #7240 by @lixmal
Required custom domain validation before creating a service or moving one to a different custom domain. #7341 by @mlsmaycon
Added a 48-hour validation window for custom domain registrations. Existing pending registrations receive a fresh window on upgrade; expired registrations are removed unless they still have services attached. #7497 by @mlsmaycon
Rejected unsupported direct-upstream IP addresses, including loopback, multicast, link-local, and IPv6 addresses with zone identifiers. #7400 by @dmitri-netbird
Validated domain names before creating certificate lock files. #7501 by @pascal-fischer

Self-Hosting Improvements

Added a rootless Red Hat UBI image for AMD64 and ARM64, published with the 0.79.0-rootless-ubi tag. #7469 by @jnfrati
Supported arbitrary non-root UIDs without a passwd entry, as used by OpenShift. #7440 by @jnfrati
Added RPM dependencies, license and documentation files, a generated changelog, and an example /etc/sysconfig/netbird to meet Red Hat software certification packaging requirements. #7562, #7573 by @mlsmaycon
Kept deployments using the embedded identity provider on a single account, with stricter configuration checks and migration handling. #7380 by @bcmmbaga
Passed the combined server's TLS configuration through to the management listener. #7499 by @pascal-fischer
Updated peer connection-IP extraction to honor configured TrustedPeers, with X-Forwarded-For taking precedence over X-Real-IP. The final release preserves trust in all IPv4 and IPv6 sources when TrustedPeers is empty; configure your reverse proxy's address or network to restrict which sources can supply forwarded-IP headers. #7454, #7589 by @bcmmbaga; #7561, #7577 by @dmitri-netbird and @bcmmbaga

Internal, CI, and Docs

Added atomic SetNX and GetDel cache operations. #7084 by @bcmmbaga
Allowed binaries embedding management to extend its command tree. #7483 by @bison
Extracted peer update handling and added test coverage. #7338 by @dmitri-netbird
Replaced a hard-coded temporary directory in WebSocket adapter tests with the platform's temporary directory. #7503 by @dmitri-netbird
Switched the MinIO test image to quay.io after it became unavailable on Docker Hub. #7516 by @Silex
Preserved image variant suffixes in snapshot tags. #7511 by @jnfrati
Skipped the protobuf breaking-change check on branch-creation pushes, which have no previous commit to compare against. #7411 by @bison

Full Changelog: v0.78.0...v0.79.0

v0.79.0-rc.1

2026-09-15T12:18:25Z

Changelog

a54d96c [proxy] Make the upstream HTTP version configurable (#7410)
2d28f90 [client] Fix the Windows tray deadlock on re-entrant window creation (#7449)
0f797f8 [client] Bump wireguard-go to 8bf8fa968f1a (#7532)
7914010 [management] Prevent deleting groups referenced by agent network budget rules (#7450)
973173b [misc] Pull the MinIO test image from quay.io (#7516)
82b1c7d [management] Harden OIDC issuer validation and discovery (#7435)
b789ffb [management] Expire unvalidated custom domain registrations (#7497)
ec0c36b [client] Add light mode with system, light, and dark theme options (#7344)
f422c41 [management] extract peer update logic and wrap it in tests (#7338)
794956a [client] Fix relay instance address race (#7498)
58114f9 [management] Only trust forwarded-IP headers from configured trusted peers (#7454)
b57f0e5 [infrastructure] Preserve snapshot image variant tags (#7511)
ad3f570 [management] validate the domain for the flock in proxy (#7501)
1047df5 [management] pass tls config for combined server (#7499)
add8a75 [management] validate peer existence when adding to group (#7486)
a419e77 [client, proxy] Make the buffer-pool retune reachable while a device is stalled (#7452)
2f48dbe [client] Add a release-wired rootless UBI image variant (#7469)
e704203 [management] do not hard-code tmp dir path in ws_conn_adapter_test (#7503)
0fac1ee [management] cleanup resources when ws-grpc proxy connection goes away (#7484)
9615d2a [client] Report the remote jobs key in the MDM UI snapshot (#7485)
15a6842 [client] Support arbitrary UIDs in rootless image (#7440)
21b4a83 [management] Refuse services on unvalidated custom domains (#7341)
27991aa [management] Let embedding binaries extend the command tree (#7483)
269cbad [management] expire and disconnect peers while including offline peers (#7467)
d101f6c [client] Redirect DNS port 53 with UDP and TCP DNAT instead of the eBPF forwarder (#7439)
d2e62e3 [client] Compare MDM-managed URLs as endpoints, not as strings (#7472)
bb4de1d [client] Read MDM boolean keys delivered as JSON numbers (#7471)
7a62d63 [management] fix delete of owner user (#7456)
e14006d [client] mobile MDM bridge — iOS + Android setMDMPolicyFetcher entrypoint (#6435)
15c0a29 [client] Return the context error when the SSH handshake fails with it (#7426)
76ea722 [management] Add Agent Network managed proxy to the API spec (#7433)
0000381 [management] update network_router_test to verify empty and nil peer_groups (#7425)
5cb6b0d [client] Assign the Android TUN address as a host prefix (#7414)
8253898 [client] Gather fresh system info on every management sync stream connect (#7409)
0bdfa42 [management] blocking sync requests for user peers sharing the same wireguard key (#7427)
066af82 [management] Keep embedded IdP deployments on a single account (#7380)
13ab50b [management] Add SetNX and GetDel cache store operations (#7084)
c455a4a [management] disallow weird ip addresses for direct upstream hosts (#7400)
8dc4272 [management] Serve networks with peer-based routers from the SQLite network map (#7418)
c2b5d21 [management] Enforce reverse proxy group access before minting and when honouring a session cookie (#7240)
798e4a0 [misc] Skip the protobuf breaking check on branch-creation pushes (#7411)

v0.80.0-canary.pr-7535.1

2026-09-15T11:37:59Z

Canary release

Only testable code based on ongoing development.

What's Changed

[misc] Skip the protobuf breaking check on branch-creation pushes by @bison in #7411
[management, proxy] Enforce reverse proxy group access for OIDC sessions by @lixmal in #7240
[management] Serve networks with peer-based routers from the SQLite network map by @mlsmaycon in #7418
[management] disallow weird ip addresses for direct upstream hosts by @dmitri-netbird in #7400
[management] Add SetNX and GetDel cache store operations by @bcmmbaga in #7084
[management] Keep embedded IdP deployments on a single account by @bcmmbaga in #7380
[management] blocking sync requests for user peers sharing the same wireguard key by @pascal-fischer in #7427
[client] Gather fresh system info on every management sync stream connect by @pappz in #7409
[client] Assign the Android TUN address as a host prefix by @pappz in #7414
[management] update network_router_test to verify empty and nil peer_groups by @dmitri-netbird in #7425
[management] Add Agent Network managed proxy to the API spec by @bison in #7433
[client] Return the context error when the SSH handshake fails with it by @pappz in #7426
[client] mobile MDM bridge — iOS + Android setMDMPolicyFetcher entrypoint by @riccardomanfrin in #6435
[management] fix delete of owner user by @pascal-fischer in #7456
[client] Read MDM boolean keys delivered as JSON numbers by @riccardomanfrin in #7471
[client] Compare MDM-managed URLs as endpoints, not as strings by @riccardomanfrin in #7472
[client] Redirect DNS port 53 with UDP and TCP DNAT instead of the eBPF forwarder by @lixmal in #7439
[management] expire and disconnect peers while including offline peers by @pascal-fischer in #7467
[management] Let embedding binaries extend the command tree by @bison in #7483
[management] Refuse services on unvalidated custom domains by @mlsmaycon in #7341
[client] Support arbitrary UIDs in rootless image by @jnfrati in #7440
[client] Report the remote jobs key in the MDM UI snapshot by @pappz in #7485
[management] cleanup resources when ws-grpc proxy connection goes away by @dmitri-netbird in #7484
[management] do not hard-code tmp dir path in ws_conn_adapter_test by @dmitri-netbird in #7503
[client] Add a release-wired rootless UBI image variant by @jnfrati in #7469
[client, proxy] Make the buffer-pool retune reachable while a device is stalled by @riccardomanfrin in #7452
[management] validate peer existence when adding to group by @pascal-fischer in #7486
[management] pass tls config for combined server by @pascal-fischer in #7499
[management] validate the domain for the flock in proxy by @pascal-fischer in #7501
[infrastructure] Preserve snapshot image variant tags by @jnfrati in #7511
[management] Only trust forwarded-IP headers from configured trusted peers by @bcmmbaga in #7454
[client] Fix relay instance address race by @pappz in #7498
[management] extract peer update logic and wrap it in tests by @dmitri-netbird in #7338
[client] Add light mode with system, light, and dark theme options by @TechHutTV in #7344
[management] Expire unvalidated custom domain registrations by @mlsmaycon in #7497
[management] Harden OIDC issuer validation and discovery by @bcmmbaga in #7435
[misc] Pull the MinIO test image from quay.io by @Silex in #7516
[management] Prevent deleting groups referenced by agent network budget rules by @Tyagiquamar in #7450
[client] Bump wireguard-go to 8bf8fa968f1a by @pappz in #7532
[client] Fix the Windows tray deadlock on re-entrant window creation by @pappz in #7449

New Contributors

@Tyagiquamar made their first contribution in #7450

Full Changelog: v0.78.0...v0.80.0-canary.pr-7535.1

v0.78.2

2026-09-14T17:47:15Z

What's Changed

[client] Fix the Windows tray deadlock on re-entrant window creation by @pappz in #7537
[client] Bump wireguard-go to 8bf8fa968f1a by @pappz in #7538

Full Changelog: v0.78.1...v0.78.2

v0.78.1

2026-09-04T06:48:26Z

What's Changed

[management] Serve networks with peer-based routers from the SQLite network map by @mlsmaycon in #7424

Full Changelog: v0.78.0...v0.78.1

v0.78.0

2026-09-04T09:32:39Z

Release Notes for v0.78.0

Highlights

Rosenpass now works through the embedded reverse proxy (#6763). Until now the proxy ran no
Rosenpass at all, so peers with Rosenpass enabled failed to establish through it on a PSK
mismatch — an incompatibility that was never documented. The proxy now runs Rosenpass in
permissive mode, so it connects both to Rosenpass-enabled peers and, exactly as before, to
peers without it. NB_PROXY_ROSENPASS=false turns it off.
Lazy connections reworked: per-peer lazy state, proxy peers lazy by default, and the lazy
exclusion list removed (#6762, #6763).
Agent Network / LLM gateway: agentgateway integration, access roles and self-service
endpoints, Bedrock model discovery served from the control plane, guardrail allowlists for
declared model ids, and the endpoint conformed to the LLM gateway protocol
(#7274, #7221, #7250, #7239, #7154, #7389, #7246).
DNS on Windows: a catch-all NRPT rule when NetBird is the primary resolver (#7071), closing
the leak/poisoning window towards the system resolvers.
Use netbird service reconfigure --service-env NB_USE_LEGACY_DNS_RESOLUTION=true to restore the old behavior.
Local Prometheus metrics endpoint on the client (#6689).
Go 1.26 and go-quic v0.62.0 across client, relay and management (#7359).
Unified ACL filtering for peers and routes, with multi-source rules (#6322). An internal
refactor: no change is expected for standard deployments.
Ukrainian localization for the desktop client (#7035).

Behaviour changes

Remote jobs (remote debug bundle and friends) are now behind an admin opt-in, with MDM
support (#7153). Anyone using them without the opt-in has to enable it.
Remote debug bundle jobs accept an anonymization level and an upload URL (#7147).
The client stays connected during the login command (#7384).
Logging out of the active profile is allowed even when profiles are disabled (#7360).
Profiles resolve for the invoking sudo user rather than for root (#7238).
NetBird traffic stays out of third-party fwmark rules (#7314).
GUI windows are created on demand and destroyed on close (#7096).
Android split tunnelling: the mode is typed rather than stored as a string, and settings are
kept per profile (#7387, #7349).

Security / hardening

The cached SSH JWT is bound to the local caller that obtained it (#7378).
The WireGuard key is no longer logged on a parse failure (#7379).
The client asks the OS for privileges when a guarded SSH setting is changed (#7066).
The proxy validates header auth (#7263).
Management checks a provider's URL and credential before saving them (#7301).
Clarified that X-Peer-ID on metrics ingest is not a credential (#7363).
The old math/rand library is gone from management (#6836).

Client — fixes

Fixed the ICEBind races that wedge interface creation (#7377).
agentConnecting is dropped whenever the ICE session state clears (#7327).
A peer offer or answer arriving before the handshaker starts listening is held rather than lost
(#7255).
Connections are swept on network loss through a shared netevents manager (#7254).
Route selection survives an invalid request and is applied on a partial one (#7292).
The session-expiration dialog closes only on renewal (#7337).
A still-locked updater binary is tolerated when cleaning up after an update (#7286).
Fixed context cancellation during restart on iOS (#7329).
iOS SSO logins reuse the profile's account (#7193).
The iOS profile manager was migrated from Swift to Go (#6528).
The PCP implementation moved to the go-nat fork (#7282).
Reverted multi-buffer support declared for the loopback XDP program (#7303).
The Android TUN is renewed only when the routes it carries actually change (#7396).
Overlay listeners are rebuilt when the TUN is renewed (#7397).
The remote jobs opt-in is exposed in the Android and iOS SDK preferences (#7406).

Management — fixes

Fixed geolocation panics (#7382).
Fixed private services calculation on the new db path (#7383).
Fixed posture check evaluation for direct peers in policy definitions (#7348) and the affected
peers calculation on a posture check flip (#7347).
Handled the nil pointer in sendInitialSync() when the peer has been deleted (#7315).
Network map from the nmap data type (#6919).

Self-hosted / infrastructure

Better domain, Docker Compose and license validation in the self-hosted scripts (#7339).
The dashboard wasm client bump is triggered by release tags (#7277).
Protobuf breaking-change checks in CI (#7305).
Pinned the toolchain gomobile init needs for gobind (#7291).
Removed the mobile build validation workflow (#7302).

Upgrade notes

Remote debug bundles now require an explicit opt-in (#7153). Bundles requested by the
management server no longer run on a peer unless remote jobs are enabled there, with
--allow-remote-jobs on the client or the allowRemoteJobs managed setting. Deployments
relying on management-triggered debug bundles must opt in before they work again. The upload
destination can now be pinned by the operator, with MDM taking precedence over the
management-supplied value (#7147).
The embedded proxy now runs Rosenpass in permissive mode (#6763). Peers with Rosenpass enabled
can now use the reverse proxy, which previously failed on a PSK mismatch; peers without
Rosenpass keep connecting exactly as before. NB_PROXY_ROSENPASS=false disables it.
Proxy peers now default to lazy connections (#6762).

Nothing else requires action.

Full Changelog: v0.77.1...v0.78.0