Release notes from netbird

v0.71.4

2026-05-21T16:31:46Z

What's Changed

[client] Revert legacy registry cleanup on Windows install by @lixmal in #6232

Full Changelog: v0.71.3...v0.71.4

v0.71.3

2026-05-20T18:02:00Z

What's Changed

[management] fix: device redirect uri wasn't registered by @jnfrati in #6191
[management] Fence peer status updates with a session token by @mlsmaycon in #6193
[management] Add metrics for peer status updates and ephemeral cleanup by @mlsmaycon in #6196
[management] Ensure SessionStartedAt has a default value by @mlsmaycon in #6211
[proxy] clusters API surfaces type, online status, and capability flags by @mlsmaycon in #6148
[misc] Update contribution guidelines by @mlsmaycon in #6219
[client] Bump macOS sleep callback timeout to 20s by @lixmal in #6220
[doc] Clean up README by @lixmal in #6178
[proxy] concurrent proxy snapshot apply by @pascal-fischer in #6207
[management] scope network router update call by @pascal-fischer in #6222
[client] Fix nil channel panic in external chain monitor stop by @lixmal in #6224

Full Changelog: v0.71.2...v0.71.3

v0.71.2

2026-05-16T15:20:28Z

What's Changed

[management] Avoid peer IP reallocation when account settings update preserves the network range by @lixmal in #6173
[management] Avoid context cancellation in cancelPeerRoutines by @mlsmaycon in #6175
[client] Clean up legacy 32-bit and HKCU registry entries on Windows install by @lixmal in #6176

Full Changelog: v0.71.1...v0.71.2

v0.71.1

2026-05-16T07:46:27Z

What's Changed

[client] Mirror v4 exit selection onto v6 pair and honour SkipAutoApply per route by @lixmal in #6150
[client] Drop DNS probes for passive health projection by @lixmal in #5971
[proxy] auth token generation on mapping by @crn4 in #6157

Full Changelog: v0.71.0...v0.71.1

v0.71.0

2026-05-14T17:15:47Z

Release Notes for v0.71.0

What's New

IPv6 overlay addressing
NetBird's overlay is now dual-stack. Every account gets its own IPv6 prefix (default /64, configurable from /48 to /120), and peers can receive both an IPv4 and an IPv6 overlay address. DNS serves AAAA
and reverse PTR records alongside A records, ACLs apply to both families automatically, network routes accept IPv6 CIDRs (with masquerade), exit nodes that route 0.0.0.0/0 get a matching ::/0 route, and
domain routes resolve both A and AAAA.

Rollout is group-gated: new accounts enable IPv6 for the All group by default; existing accounts opt in under Settings > Network. Assignment is also gated on a per-peer capability, so older clients keep
working on IPv4 until they upgrade. Hosts can opt out individually with netbird up --disable-ipv6

Read more in the IPv6 Overlay Addressing announcement and the IPv6 documentation.
#5631 by @lixmal

MFA for local users
Local users (non-IdP) can now enable multi-factor authentication, closing a gap for deployments that don't federate auth through an external provider.
#5804 by @jnfrati

Bring your own proxy (backend ready)
Backend support for per-account reverse-proxy lifecycle has landed: proxy tokens, per-account cluster allow-lists, conflict detection, and one-proxy-per-account enforcement. Full rollout (dashboard, docs) comes
in a later release.
#5627 by @crn4

Client Improvements

Included MTU and SSH auth config in debug bundle by @lixmal.
#6071
Added public key to debug bundle config.txt by @lixmal.
#6092
iOS: structured ResolvedIPs collection for domain routes by @pappz.
#6090
Used unique temp file and clean up on failure when writing ssh config by @lixmal.
#6064
Hardened uspfilter conntrack and shared TCP relay by @lixmal.
#5936
Skipped DNS upstream failover on definitive EDE by @lixmal.
#6089
Fixed --config flag default to point at profile path by @lixmal.
#6122
Bracketed IPv6 in embed listeners, expanded debug bundle by @lixmal.
#6134
Added short flags for status command options by @mlsmaycon.
#6137

Management Improvements

Removed permissions from geolocations API by @pascal-fischer.
#6091
Added update reason to buffered calls by @pascal-fischer.
#6103
Allocated and preserved IPv6 overlay addresses for embedded proxy peers by @lixmal.
#6132
Fixed offline statuses for public proxy clusters by @crn4.
#6133
Bracketed IPv6 reverse-proxy target hosts when building URL Host field by @lixmal.
#6141

Relay Improvements

Preserved non-standard port in WS dialer URL prep by @lixmal.
#6061

Misc

Updated CONTRIBUTING.md by @mlsmaycon.
#6076

v0.70.5

2026-05-06T08:08:53Z

Release Notes for v0.70.5

What's New

Client Improvements

Added packet capture to debug bundle and CLI.
#5891
Advertised relay server IP via signal for foreign-relay fallback dial.
#6004
Released Status.mux before invoking notifier callbacks.
#6039
Used ctx.Err() instead of gRPC codes.Canceled to detect shutdown.
#6019
Used atomic write/rename pattern for SSH config.
#5867
Replaced WG interface polling with netlink subscription on Linux.
#5857
Displayed QR code for device auth login URL.
#5415
Bumped go-netroute to v0.4.0 and dropped fork.
#6062
Used fwmark-aware route lookup for raw socket UDP checksum source.
#6070

Management Improvements

Added monitoring for nmap update source.
#6036
Enabled PAT creation during setup.
#6003
Added public IPv4/IPv6 posture checks.
#6038
Tracked pending approval in peer event metadata.
#6040
Fixed proxy reconnect issues.
#6063
Mapped Entra OID claim as Dex user ID.
#6067
Fixed flaky invite token test.
#6077

Proxy Enhancements

Consolidated mapping updates.
#6072

Miscellaneous

Disabled govet inline analyzer.
#6066
Updated discussions and issues templates.
#6073

New Contributors

@lotheac made their first contribution in #5867
@alexsavio made their first contribution in #5857
@typhoon1217 made their first contribution in #5415

Full Changelog: v0.70.4...v0.70.5

v0.70.4

2026-04-29T22:53:28Z

What's Changed

[misc] fix MSI generation add installer tests by @mlsmaycon in #6031

Full Changelog: v0.70.3...v0.70.4

v0.70.3

2026-04-29T17:08:27Z

What's Changed

[client] Enable UI autostart for silent and MSI installs by @shuuri-labs in #6026
[management] Prevent JWT reuse during peer login by @bcmmbaga in #6002
[client] Use BindListener for all userspace bind in lazyconn activity by @lixmal in #6028
[client] Tolerate EEXIST when adding macOS scoped default routes by @lixmal in #6027
[client] Trigger mobile submodule bump PRs on release tags by @pappz in #6029

Full Changelog: v0.70.2...v0.70.3

v0.70.2

2026-04-29T10:12:18Z

What's Changed

[client] Move macOS sleep detection into the daemon (purego) by @lixmal in #5926
[client] Fix Windows installer upgrade detection for pre-0.70.1 installs by @lixmal in #6025
[misc] Add comment automation on release workflow for PRs by @jnfrati in #6016

Full Changelog: v0.70.1...v0.70.2

v0.70.1

2026-04-29T06:33:34Z

What's Changed

[management] removed legacy network map code by @crn4 in #5565
[management] Add Microsoft AD FS support for embedded Dex identity providers by @bcmmbaga in #6008
[management] Handle single-string JWT group claim from IdPs by @bcmmbaga in #6014
[client] Don't mark management disconnected on transient job stream errors by @pappz in #6005
[relay] evict foreign client cache on disconnect by @pappz in #6015
[self-hosted] fix(getting-started): Infinite healthcheck loop with existing traefik by @WalidDevIO in #5871
[management] Drop netmap calculation on peer read by @bcmmbaga in #6006
[client] Use WinRT COM for Windows toasts by @lixmal in #6013

New Contributors

@WalidDevIO made their first contribution in #5871

Full Changelog: v0.70.0...v0.70.1