Netbird: baixar versions anteriors

What's Changed
- [client] Drop SSH privileges through libc in PKCS#11 package builds (https://github.com/netbirdio/netbird/pull/8323) (https://github.com/netbirdio/netbird/pull/8331)
- [client,proxy,management,signal,relay] Distrust compromised eMudhra CA keys (#8326) by @mlsmaycon in https://github.com/netbirdio/netbird/pull/8328
- [client] Drop SSH privileges through libc in PKCS#11 package builds (#8323) by @lixmal in https://github.com/netbirdio/netbird/pull/8331
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.81.3...v0.81.4

What's Changed
- [client] Bound the Signal stream registration wait and track its state based on stream health (#8175) by @riccardomanfrin in https://github.com/netbirdio/netbird/pull/8254
- [client,relay] Bump quic-go to v0.64.0 (#8249) by @riccardomanfrin in https://github.com/netbirdio/netbird/pull/8253
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.81.2...v0.81.3

What's Changed
- [client] Keep interface discovery out of the bind open path (#8226) by @mlsmaycon in https://github.com/netbirdio/netbird/pull/8227
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.81.0...v0.81.2

What's Changed
[client] Keep interface discovery out of the bind open path (https://github.com/netbirdio/netbird/pull/8226) (https://github.com/netbirdio/netbird/pull/8227)
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.81.0...v0.81.1

Release Notes for v0.80.0
What's New
🔒 Security and Access Control
- Refused to pin an agent network gateway onto another account's host, adding cross-account validation for gateway assignments. #7519
- Validated proxy cluster on Agent Network bootstrap, preventing an agent network from bootstrapping onto another account's proxy cluster. #7402
- Refused HTTP redirects on IdP clients, preventing open redirect attacks against identity provider integrations. #7579
- Revoked local Dex session on embedded IdP password change, ensuring sessions are properly invalidated when credentials are updated. #7556
- Added upload URL signing and rate limiting for file upload endpoints. #7502
🖥️ Client Improvements
- Staged install script downloads in a private temp directory, preventing other processes from tampering with downloaded files before installation. #7534
- Enforced HTTPS on install script downloads, ensuring all client downloads use secure connections. #7545
- Fixed peers not being notified when the relay connection drops, which could leave stale peer state after a relay disconnect. #7490
- Fixed session deadline read under the status read lock, preventing a potential race condition. #7550
- Removed the empty GPO DNS policy store on Windows teardown, cleaning up leftover DNS policy entries when the client shuts down. #7563
- Resolved the shared socket source address through a connected UDP probe socket, fixing source address resolution for shared socket mode. #7633
- Validated saved service parameters and pinned the netsh lookup on Windows, hardening the service configuration path. #7584
- Used POSIX-style file read/write of JSON on Windows, improving cross-platform config file handling. #7631
- Raised the daemon IPC receive limit to 16 MB, matching gRPC's default and preventing truncation of large messages. #7676
- Skipped route firewall rule computation when no firewall is configured, avoiding unnecessary work. #7624
- Fixed device dump clearing all peer endpoints instead of just the target one, which could disrupt connections to other peers. #7632
- Fixed Windows IPC privilege check to only treat LocalSystem as a privileged identity by SID. Local Service and Network Service now go through the same checks as any other caller. #7889
- Bumped Wails to v3.0.0-beta.25 for the desktop UI. #7640
⚙️ Management Improvements
- Sped up test store setup and summarized unit test runs, improving CI performance. #7518
- Read X-Real-IP when extracting the peer connection IP, supporting deployments behind reverse proxies. #7561
- Handled empty trusted peer to avoid errors when no trusted peer is configured. #7589
- Named the account owner in the pending approval error, making it clear who to contact for account approval. #7533
- Fixed group resource validation for proper enforcement. #7608
- Added store support to filter by public ID. #7208
- Recorded proxy version on connect for tracking and debugging. #7630
- Split store by table for improved database performance and organization. #7646
- Prevented deleting custom domains used by services, protecting active proxy configurations from accidental removal. #7515
- Moved rate limiter to shared package for reuse across services. #7727
- Let usage_viewer read Agent Network access logs, so users reviewing cost can now see the requests behind usage metrics. #7750
🔀 Reverse Proxy
- Closed the client connection on private service denials instead of leaving it hanging. #7590
- Added proxy rate limiter to protect against abuse. #7568
- Added proxy credentials limiter on management to throttle authentication attempts. #7569
- Fixed upstream HTTP version applied before cloning transports. #7806
- Added release-wired UBI image variant for the proxy. #7464
- Fixed flow auth secret for external Relay migrations. #7731
🏗️ Infrastructure and CI
- Certified the rootless UBI client image on release for Red Hat ecosystem compliance. #7525
- Fixed RPM metadata for Red Hat software certification (two rounds of fixe

New Feature: Desktop Light Mode
The desktop app now gives you three appearance options: System, Light, and Dark. Follow your operating system's theme or choose the look you prefer. The new light theme covers the connection view, settings, profiles, and dialogs, with matching native window appearance on Windows, macOS, and Linux. #7344 by @TechHutTV
This release also brings shared MDM policy enforcement to the mobile SDKs, a rootless Red Hat UBI container image, and improvements to DNS, relay connections, and reverse proxy access controls.
What's Changed
Desktop Client Improvements
- Fixed a Windows tray deadlock that could freeze the app when a double-click opened a window while another window was still being created. #7449 by @pappz
- Fixed the MDM settings snapshot so the UI correctly reports when remote jobs are managed by policy. #7485 by @pappz
Client Improvements
- Added MDM policy bridges and shared enforcement for the iOS and Android SDKs, keeping managed settings and profile restrictions consistent with the desktop client. #6435 by @riccardomanfrin
- Accepted MDM boolean values delivered as JSON numbers, so policies using 0 and 1 are applied correctly. #7471 by @riccardomanfrin
- Compared MDM-managed URLs by their normalized endpoints, avoiding false conflicts between equivalent URLs. #7472 by @riccardomanfrin
- Refreshed system information on every management sync reconnect, keeping local network addresses and posture information current after network changes. #7409 by @pappz
- Used host prefixes for Android TUN addresses so local network protection does not classify the entire overlay as a local network. #7414 by @pappz
- Replaced the eBPF DNS forwarder with UDP and TCP DNAT rules when the resolver cannot listen on port 53, with rollback and cleanup for incomplete redirects. #7439 by @lixmal
- Fixed a relay address race that could advertise a URL and IP from different connections during a reconnect. #7498 by @pappz
- Returned the context cancellation or timeout error when an SSH handshake is interrupted. #7426 by @pappz
- Updated wireguard-go to 8bf8fa968f1a, fixing keepalive buffer-pool stalls, keeping timer paths non-blocking, and making netstack interface shutdown idempotent. #7532 by @pappz
- Allowed buffer-pool limits to be adjusted while a device is stalled, and bounded proxy-wide updates so one stuck client does not block the others. #7452 by @riccardomanfrin
Management Improvements
- Restored networks using individual peers as routers in the SQLite network map when peer_groups is empty or null. #7418 by @mlsmaycon
- Fixed SQLite network-map reads for users with null automatic groups and expanded coverage for empty and null router groups. #7425 by @dmitri-netbird
- Included offline peers when scheduling login expiration and ensured expired peers are disconnected, while protecting peers that have just logged in again. #7467 by @pascal-fischer
- Applied duplicate-key sync protection to user-owned peers as well as peers registered with setup keys. #7427 by @pascal-fischer
- Validated that a peer exists before adding it to a group. #7486 by @pascal-fischer
- Prevented other users from deleting the account owner. #7456 by @pascal-fischer
- Hardened OIDC issuer validation by requiring HTTPS, rejecting credentials, query strings, and fragments in issuer URLs, refusing discovery redirects, and limiting discovery response size. #7435 by @bcmmbaga
- Cleaned up resources when WebSocket-to-gRPC proxy connections close. #7484 by @dmitri-netbird
Agent Network
- Added managed proxy provisioning endpoints and response types to the API specification. #7433 by @bison
- Prevented deletion of groups referenced by Agent Network budget rules, preserving the rules' spending limits. #7450 by @Tyagiquamar
Reverse Proxy Improvements
- Added NB_PROXY_UPSTREAM_HTTP_VERSION with auto, 1.1, and 2 options. The default auto mode negotiates with HTTPS upstreams and falls back to HTTP/1.1 when an upstream's negotiated HTTP/2 connection fails 

What's Changed
- [client] Fix the Windows tray deadlock on re-entrant window creation by @pappz in https://github.com/netbirdio/netbird/pull/7537
- [client] Bump wireguard-go to 8bf8fa968f1a by @pappz in https://github.com/netbirdio/netbird/pull/7538
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.78.1...v0.78.2

What's Changed
- [management] Serve networks with peer-based routers from the SQLite network map by @mlsmaycon in https://github.com/netbirdio/netbird/pull/7424
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.78.0...v0.78.1

Highlights
- Rosenpass now works through the embedded reverse proxy (#6763). Until now the proxy ran no
Rosenpass at all, so peers with Rosenpass enabled failed to establish through it on a PSK
mismatch — an incompatibility that was never documented. The proxy now runs Rosenpass in
permissive mode, so it connects both to Rosenpass-enabled peers and, exactly as before, to
peers without it. NB_PROXY_ROSENPASS=false turns it off.
- Lazy connections reworked: per-peer lazy state, proxy peers lazy by default, and the lazy
exclusion list removed (#6762, #6763).
- Agent Network / LLM gateway: agentgateway integration, access roles and self-service
endpoints, Bedrock model discovery served from the control plane, guardrail allowlists for
declared model ids, and the endpoint conformed to the LLM gateway protocol
(#7274, #7221, #7250, #7239, #7154, #7389, #7246).
- DNS on Windows: a catch-all NRPT rule when NetBird is the primary resolver (#7071), closing
the leak/poisoning window towards the system resolvers.
- Local Prometheus metrics endpoint on the client (#6689).
- Go 1.26 and go-quic v0.62.0 across client, relay and management (#7359).
- Unified ACL filtering for peers and routes, with multi-source rules (#6322). An internal
refactor: no change is expected for standard deployments.
- Ukrainian localization for the desktop client (#7035).
Behaviour changes
- Remote jobs (remote debug bundle and friends) are now behind an admin opt-in, with MDM
support (#7153). Anyone using them without the opt-in has to enable it.
- Remote debug bundle jobs accept an anonymization level and an upload URL (#7147).
- The client stays connected during the login command (#7384).
- Logging out of the active profile is allowed even when profiles are disabled (#7360).
- Profiles resolve for the invoking sudo user rather than for root (#7238).
- NetBird traffic stays out of third-party fwmark rules (#7314).
- GUI windows are created on demand and destroyed on close (#7096).
- Android split tunnelling: the mode is typed rather than stored as a string, and settings are
kept per profile (#7387, #7349).
Security / hardening
- The cached SSH JWT is bound to the local caller that obtained it (#7378).
- The WireGuard key is no longer logged on a parse failure (#7379).
- The client asks the OS for privileges when a guarded SSH setting is changed (#7066).
- The proxy validates header auth (#7263).
- Management checks a provider's URL and credential before saving them (#7301).
- Clarified that X-Peer-ID on metrics ingest is not a credential (#7363).
- The old math/rand library is gone from management (#6836).
Client — fixes
- Fixed the ICEBind races that wedge interface creation (#7377).
- agentConnecting is dropped whenever the ICE session state clears (#7327).
- A peer offer or answer arriving before the handshaker starts listening is held rather than lost
(#7255).
- Connections are swept on network loss through a shared netevents manager (#7254).
- Route selection survives an invalid request and is applied on a partial one (#7292).
- The session-expiration dialog closes only on renewal (#7337).
- A still-locked updater binary is tolerated when cleaning up after an update (#7286).
- Fixed context cancellation during restart on iOS (#7329).
- iOS SSO logins reuse the profile's account (#7193).
- The iOS profile manager was migrated from Swift to Go (#6528).
- The PCP implementation moved to the go-nat fork (#7282).
- Reverted multi-buffer support declared for the loopback XDP program (#7303).
- The Android TUN is renewed only when the routes it carries actually change (#7396).
- Overlay listeners are rebuilt when the TUN is renewed (#7397).
- The remote jobs opt-in is exposed in the Android and iOS SDK preferences (#7406).
Management — fixes
- Fixed geolocation panics (#7382).
- Fixed private services calculation on the new db path (#7383).
- Fixed posture check evaluation for direct peers in policy definitions (#7348) and the affected
peers calculation on a postur

What's New
Client Improvements
- Fixed session extension and SSH authentication always using the device code flow on Linux.
https://github.com/netbirdio/netbird/pull/7187
- Added Windows DNS configuration to the debug bundle.
https://github.com/netbirdio/netbird/pull/7196
- Added a CI check for translation key parity.
https://github.com/netbirdio/netbird/pull/6852
- Preserved the account email on Android logout while removing it when a profile is deleted.
https://github.com/netbirdio/netbird/pull/7200
- Ranked Windows route candidates using combined route and interface metrics.
https://github.com/netbirdio/netbird/pull/7210
- Skipped IPv6 route tests when the default next hop is unusable.
https://github.com/netbirdio/netbird/pull/7212
- Passed the stored email as a login hint from the UI and preserved it on logout.
https://github.com/netbirdio/netbird/pull/7199
- Fixed inconsistencies in the CI gomobile init process.
https://github.com/netbirdio/netbird/pull/7229
- Deleted Windows NRPT rules by enumerating the registry instead of relying on a rule count.
https://github.com/netbirdio/netbird/pull/7195
- Declared multi-buffer support for the loopback XDP program.
https://github.com/netbirdio/netbird/pull/7230
- Exposed SSH functionality on Android.
https://github.com/netbirdio/netbird/pull/7156
- Handled Android network changes without restarting the engine.
https://github.com/netbirdio/netbird/pull/7144
- Cleared stale installer results before starting updates.
https://github.com/netbirdio/netbird/pull/7204
- Stopped the UI before silent Windows updates and suppressed installer reboots.
https://github.com/netbirdio/netbird/pull/7209
- Reported network addresses on Android for posture checks.
https://github.com/netbirdio/netbird/pull/7235
- Restarted the UI using the user's environment block after updates.
https://github.com/netbirdio/netbird/pull/7245
- Switched client tests to go.uber.org/mock.
https://github.com/netbirdio/netbird/pull/7253
- Renamed TURN-specific WireGuard proxy terminology to relayed connections.
https://github.com/netbirdio/netbird/pull/7231
- Fixed staticcheck findings after upgrading golangci-lint.
https://github.com/netbirdio/netbird/pull/7266
- Added missing anonymization and SSH privilege translations.
https://github.com/netbirdio/netbird/pull/7269
- Added a lazy connection override and device name reporting to the WASM client.
https://github.com/netbirdio/netbird/pull/7276
Management Improvements
- Documented the mutual exclusivity of ports and port_ranges in policy rules.
https://github.com/netbirdio/netbird/pull/7158
- Refused usage limits that one-off setup keys cannot honor.
https://github.com/netbirdio/netbird/pull/7220
- Switched management tests to go.uber.org/mock.
https://github.com/netbirdio/netbird/pull/7253
- Suppressed staticcheck warnings for deprecated protobuf fields.
https://github.com/netbirdio/netbird/pull/7261
Infrastructure & Miscellaneous
- Added support for non-interactive, environment-driven installations in getting-started.sh.
https://github.com/netbirdio/netbird/pull/7168
- Updated the Agent Network documentation.
https://github.com/netbirdio/netbird/pull/7020
- Prevented overriding the dashboard image in Enterprise migrations.
https://github.com/netbirdio/netbird/pull/7206
- Skipped store migrations for PostgreSQL deployments.
https://github.com/netbirdio/netbird/pull/7207
New Contributors
- @SunsetDrifter made their first contribution in https://github.com/netbirdio/netbird/pull/7158
- @znel2002 made their first contribution in https://github.com/netbirdio/netbird/pull/7168
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.77.0...v0.77.1

What's Changed
- [management] prewarm a posture check cache on network map generation by @pascal-fischer in https://github.com/netbirdio/netbird/pull/7093
- [client] peer: re-arm the WireGuard watcher after a lazy wake by @riccardomanfrin in https://github.com/netbirdio/netbird/pull/7091
- [infrastructure] Detect community GHCR images during enterprise migration by @jnfrati in https://github.com/netbirdio/netbird/pull/7101
- [client] disambiguate the connection_type metric tag by @riccardomanfrin in https://github.com/netbirdio/netbird/pull/7043
- [management] Affected peers for user updates by @pascal-fischer in https://github.com/netbirdio/netbird/pull/7099
- [infrastructure] add grafana dashboard for licensed management by @mlsmaycon in https://github.com/netbirdio/netbird/pull/7095
- [management] Deny reverse proxy access to pending and blocked users by @mlsmaycon in https://github.com/netbirdio/netbird/pull/7105
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.76.2...v0.76.3

What's Changed
- [misc] add AGENTS.md file by @mlsmaycon in https://github.com/netbirdio/netbird/pull/7014
- [client] Handle interface lookup errors in iOS DNS index helper by @Optic00 in https://github.com/netbirdio/netbird/pull/6999
- [client] iOS - Remove duplicate Login RPCs from the iOS SDK by @evgeniyChepelev in https://github.com/netbirdio/netbird/pull/6931
- [client] Declare GTK4/WebKitGTK runtime deps for the Linux UI packages by @pappz in https://github.com/netbirdio/netbird/pull/6893
- [management] Generic gRPC extension seam for external modules by @bison in https://github.com/netbirdio/netbird/pull/6894
- [management] Resolve agent network permissions per submodule by @mlsmaycon in https://github.com/netbirdio/netbird/pull/7030
- [management] fix handling of empty network map during decode and encode by @pascal-fischer in https://github.com/netbirdio/netbird/pull/6987
- [client] Keep the account email backing the SSO login hint correct by @pappz in https://github.com/netbirdio/netbird/pull/6986
- [client] Android - Create the Android fake IP manager lazily on DNS flag enable by @pappz in https://github.com/netbirdio/netbird/pull/6989
- [client] Android - Serialize Android tunnel reconfiguration callbacks by @pappz in https://github.com/netbirdio/netbird/pull/6990
- [client] Keep the UI running when the notification service fails to start by @lixmal in https://github.com/netbirdio/netbird/pull/6959
- [client] launch macOS GUI as the logged-in user after install/update by @riccardomanfrin in https://github.com/netbirdio/netbird/pull/6962
- [client] Don't ask for an SSO login when the login never reached management by @lixmal in https://github.com/netbirdio/netbird/pull/6983
- [misc] Add android and ios tags to PR title check by @pappz in https://github.com/netbirdio/netbird/pull/7037
- [client, android] Pull fresh TUN settings on Android rebuild by @pappz in https://github.com/netbirdio/netbird/pull/6991
- [client, android] Reuse the persisted configuration when enrolling by @camiloariza in https://github.com/netbirdio/netbird/pull/7022
- [client, android] Reuse the profile's account for Android SSO logins by @pappz in https://github.com/netbirdio/netbird/pull/6988
- [client] Update wails to v3.0.0-beta.3 by @pappz in https://github.com/netbirdio/netbird/pull/7038
- [management] Align agent-network API contracts for API clients by @mlsmaycon in https://github.com/netbirdio/netbird/pull/7026
- [client] Probe the daemon login with IsLoginRequired by @pappz in https://github.com/netbirdio/netbird/pull/7052
- [client, android] Fix profile account path test on Windows by @pappz in https://github.com/netbirdio/netbird/pull/7057
- [client] Fix session expired relogin by @pappz in https://github.com/netbirdio/netbird/pull/7055
- [client] Fix Linux tray right-click opening the main window by @pappz in https://github.com/netbirdio/netbird/pull/7039
- [management] prevent dangling group refs in agent-network ACLs. by @braginini in https://github.com/netbirdio/netbird/pull/7060
- [management] Prevent deleting groups referenced by reverse proxy services by @mlsmaycon in https://github.com/netbirdio/netbird/pull/7062
- [relay] randomize the relay reconnect backoff by @riccardomanfrin in https://github.com/netbirdio/netbird/pull/7067
- [misc] Move enterprise setup to Traefik and harden migration by @bcmmbaga in https://github.com/netbirdio/netbird/pull/7042
- [misc] Expand agent guidelines with security, type-safety and lifecycle conventions by @lixmal in https://github.com/netbirdio/netbird/pull/7076
- [client] Ship a legacy GTK3 UI package for distros without WebKitGTK 6.0 by @pappz in https://github.com/netbirdio/netbird/pull/7040
- [client] Add a UI setting to stay connected after quitting by @pappz in https://github.com/netbirdio/netbird/pull/7078
- [infrastructure] Generate a session cookie encryption key on fresh self-hosted installs by @Optic00 in https://github.com/netbirdio/netbird/pull/7056
- [client] Stop the macOS UI 

What's Changed
- [client] Support Andorid session expiry handling by @pappz in https://github.com/netbirdio/netbird/pull/6945
- [client] Stop and remove the daemon on netbird-ui cask uninstall by @lixmal in https://github.com/netbirdio/netbird/pull/6977
- [misc] Update SECURITY.md by @mlsmaycon in https://github.com/netbirdio/netbird/pull/6981
- [misc] group x package updates and run weekly by @mlsmaycon in https://github.com/netbirdio/netbird/pull/7000
- [client] Fix daemon lock order inversion between SetConfig and login by @lixmal in https://github.com/netbirdio/netbird/pull/6978
- [client] Fix expression order in legacy nftables route rules by @Optic00 in https://github.com/netbirdio/netbird/pull/7011
- [proxy] remove cluster tag from proxy metrics by @pascal-fischer in https://github.com/netbirdio/netbird/pull/6985
- [misc] update contributing guide by @mlsmaycon in https://github.com/netbirdio/netbird/pull/7009
- [client] Restrict debug bundle log path and upload destinations by @lixmal in https://github.com/netbirdio/netbird/pull/6975
- [management, proxy] Management-owned LLM pricing: file-backed defaults + by @braginini in https://github.com/netbirdio/netbird/pull/6965
Agent Network
- The merged PR https://github.com/netbirdio/netbird/pull/6965 requires an upgrade of both Management and Proxy containers.
New proxy under old management silently disables cost metering.
New Contributors
- @Optic00 made their first contribution in https://github.com/netbirdio/netbird/pull/7011
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.76.0...v0.76.1

What's Changed
- [management] Force routing-peer DNS resolution for reverse-proxy domain targets by @lixmal in https://github.com/netbirdio/netbird/pull/6872
- [management] Read reverse-proxy service and target columns in Postgres path by @lixmal in https://github.com/netbirdio/netbird/pull/6886
- [client] Expose RenameProfile in the Android profile manager binding by @pappz in https://github.com/netbirdio/netbird/pull/6926
- [client] Build UI release binaries with the production tag by @pappz in https://github.com/netbirdio/netbird/pull/6898
- [client] Escape dots in interface names for sysctl configuration by @stefan-fast in https://github.com/netbirdio/netbird/pull/6930
- [client] Serialize iOS tunnel reconfiguration callbacks by @pappz in https://github.com/netbirdio/netbird/pull/6870
- [client] Unify route selection in the route manager by @pappz in https://github.com/netbirdio/netbird/pull/6928
- [client] parse NB_LAZY_CONN_INACTIVITY_THRESHOLD as a Go duration by @riccardomanfrin in https://github.com/netbirdio/netbird/pull/6947
- [client] Export peer details for Android by @pappz in https://github.com/netbirdio/netbird/pull/6925
- [management] explicit accountID check when deleting a user by @pascal-fischer in https://github.com/netbirdio/netbird/pull/6944
- [infrastructure] Deprecate legacy Dex and Zitadel getting-started scripts by @TechHutTV in https://github.com/netbirdio/netbird/pull/6952
- [client] Fix UI crash on Windows builds without dark-mode support by @lixmal in https://github.com/netbirdio/netbird/pull/6958
- [signal] make pprof configurable by @pascal-fischer in https://github.com/netbirdio/netbird/pull/6963
- [client] Authorize daemon IPC callers by their local identity by @lixmal in https://github.com/netbirdio/netbird/pull/6967
New Contributors
- @stefan-fast made their first contribution in https://github.com/netbirdio/netbird/pull/6930
- @TechHutTV made their first contribution in https://github.com/netbirdio/netbird/pull/6952
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.75.1...v0.76.0

What's New
Agent Network
- Added prompt cache token and cost accounting to Agent Network usage.
https://github.com/netbirdio/netbird/pull/6900
- Added support for Claude Opus 5.
https://github.com/netbirdio/netbird/pull/6895
- Scoped Agent Network model allowlists per policy, group, and provider.
https://github.com/netbirdio/netbird/pull/6905
Client Improvements
- Reconcile routed AllowedIPs when a lazy connection becomes idle.
https://github.com/netbirdio/netbird/pull/6863
- Fetch FreeBSD port files from the GitHub mirror instead of cgit.
https://github.com/netbirdio/netbird/pull/6880
- Restored the missing backup.Reset behavior.
https://github.com/netbirdio/netbird/pull/6883
- Made Test_ConnectPeers deterministic under Docker/eBPF kernel and Darwin CI.
https://github.com/netbirdio/netbird/pull/6884
- Export agent version information for iOS.
https://github.com/netbirdio/netbird/pull/6918
- Use platform-specific installer URLs for manual update downloads.
https://github.com/netbirdio/netbird/pull/6922
- Exit the GUI immediately when the Windows session ends.
https://github.com/netbirdio/netbird/pull/6878
- Fixed stale routing peers after removing overlapping-prefix networks.
https://github.com/netbirdio/netbird/pull/6799
- Added ReapplyMatching support to the dedicated AllowedIPsRefCounter.
https://github.com/netbirdio/netbird/pull/6935
Infrastructure & Miscellaneous
- Restored the rootless-latest Docker image tag.
https://github.com/netbirdio/netbird/pull/6914
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.75.0...v0.75.1

What's Changed
- [client] Don't abort debug for command when up/down fails by @lixmal in https://github.com/netbirdio/netbird/pull/5657
- [misc] Set signing env only if not fork and set license by @mlsmaycon in https://github.com/netbirdio/netbird/pull/5659
- [management] Omit proxy_protocol from API response when false by @lixmal in https://github.com/netbirdio/netbird/pull/5656
- [management] Replace JumpCloud SDK with direct HTTP calls by @bcmmbaga in https://github.com/netbirdio/netbird/pull/5591
- [management] Allow multiple header auths with same header name by @lixmal in https://github.com/netbirdio/netbird/pull/5678
- [management] Fix DNS label uniqueness check on peer rename by @bcmmbaga in https://github.com/netbirdio/netbird/pull/5679
- [misc] Replace discontinued LocalStack with MinIO in S3 test by @lixmal in https://github.com/netbirdio/netbird/pull/5680
- [client] Bump go-m1cpu to v0.2.1 to fix segfault on macOS 26 / M5 chips by @lixmal in https://github.com/netbirdio/netbird/pull/5701
- [infrastructure] Enable RPM package gpgcheck in install script by @lixmal in https://github.com/netbirdio/netbird/pull/5676
- [client] Replace iOS DNS IsPrivate heuristic with route checker by @lixmal in https://github.com/netbirdio/netbird/pull/5694
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.67.0...v0.67.1

What's New
Major Networking & Proxy Enhancements
- Introduced Layer 4 (L4) capabilities (TLS/TCP/UDP) across client, management, and proxy.
https://github.com/netbirdio/netbird/pull/5530
- Added header-based authentication, access restrictions, and session idle timeout for proxy services.
https://github.com/netbirdio/netbird/pull/5587
- Added support for wildcard certificates and improved certificate handling (read from disk if available).
https://github.com/netbirdio/netbird/pull/5583
https://github.com/netbirdio/netbird/pull/5574
- Added require_subdomain capability for proxy clusters.
https://github.com/netbirdio/netbird/pull/5628
- Improved proxy reliability with domain switching fixes and recovery after cleanup.
https://github.com/netbirdio/netbird/pull/5585
https://github.com/netbirdio/netbird/pull/5617
Dashboard support and documentation update are coming soon.
Client Improvements
- Added client metrics support and enhanced observability.
https://github.com/netbirdio/netbird/pull/5512
- Added health check flag and daemon status output to netbird status.
https://github.com/netbirdio/netbird/pull/5650
- Restart engine automatically when peer IP changes.
https://github.com/netbirdio/netbird/pull/5614
- Improved DNS handling, IPv6 formatting, and probe thread safety.
https://github.com/netbirdio/netbird/pull/5603
https://github.com/netbirdio/netbird/pull/5576
- Added MTU option and DNSLabels support to embedded client.
https://github.com/netbirdio/netbird/pull/5550
https://github.com/netbirdio/netbird/pull/5493
- Refactored auto-update workflow and simplified container entrypoint.
https://github.com/netbirdio/netbird/pull/5448
https://github.com/netbirdio/netbird/pull/5652
- Fixed multiple issues including duplicate logs, firewall init behavior, and container logging.
https://github.com/netbirdio/netbird/pull/5609
https://github.com/netbirdio/netbird/pull/5621
Management Improvements
- Added reverse proxy cluster APIs and domain-based targeting.
https://github.com/netbirdio/netbird/pull/5611
https://github.com/netbirdio/netbird/pull/5612
- Improved concurrency handling and proxy exclusions from peer approval.
https://github.com/netbirdio/netbird/pull/5584
https://github.com/netbirdio/netbird/pull/5588
Proxy Enhancements
- Added log-level flag and usage improvements.
https://github.com/netbirdio/netbird/pull/5594
Security & Packaging
- Added GPG signing key support for RPM packages.
https://github.com/netbirdio/netbird/pull/5581
Miscellaneous
- Added image build after merge to main workflow.
https://github.com/netbirdio/netbird/pull/5605
- Added netbird-tui to community projects.
https://github.com/netbirdio/netbird/pull/5568
New Contributors
- @n0pashkov made their first contribution in https://github.com/netbirdio/netbird/pull/5568
- @tham-le made their first contribution in https://github.com/netbirdio/netbird/pull/5550
- @wehagy made their first contribution in https://github.com/netbirdio/netbird/pull/5447
- @mango766 made their first contribution in https://github.com/netbirdio/netbird/pull/5603
- @Wouter0100 made their first contribution in https://github.com/netbirdio/netbird/pull/5493
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.66.4...v0.67.0

What's New
Management Improvements
- Create a shallow copy of the account when buffering to improve memory safety and performance.
https://github.com/netbirdio/netbird/pull/5572
- Set network map components by default and optimize memory usage.
https://github.com/netbirdio/netbird/pull/5575
Self-Hosted Improvements
- Removed extra proxy domain instructions from the getting started guide to simplify setup.
https://github.com/netbirdio/netbird/pull/5573
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.66.3...v0.66.4

What's New
Client Improvements
- Fixed "reset connection" error after wake from sleep to improve reconnection stability.
https://github.com/netbirdio/netbird/pull/5522
- Fixed exit node menu not refreshing on Windows.
https://github.com/netbirdio/netbird/pull/5553
Management Improvements
- Added per-target options to the reverse proxy (management + proxy).
https://github.com/netbirdio/netbird/pull/5501
- Avoided breaking single account mode when switching domains.
https://github.com/netbirdio/netbird/pull/5511
- Added stable domain resolution for the combined server.
https://github.com/netbirdio/netbird/pull/5515
- Fixed domain uniqueness validation.
https://github.com/netbirdio/netbird/pull/5529
- Added activity events for domain operations.
https://github.com/netbirdio/netbird/pull/5548
- Switched proxy registration to use real IP address.
https://github.com/netbirdio/netbird/pull/5525
- Cached PKCE state to improve login flow reliability.
https://github.com/netbirdio/netbird/pull/5516
- Count login request duration metrics only for successful logins.
https://github.com/netbirdio/netbird/pull/5545
- Aggregated gRPC metrics by account ID.
https://github.com/netbirdio/netbird/pull/5486
Proxy Improvements
- Refactored proxy metrics and added usage logs.
https://github.com/netbirdio/netbird/pull/5533
CI & Misc
- Added PR title validation workflow.
https://github.com/netbirdio/netbird/pull/5503
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.66.2...v0.66.3

What's Changed
- [management] Store connected proxies in DB by @pascal-fischer in https://github.com/netbirdio/netbird/pull/5472
- [management] Fix embedded IdP metrics to count local and generic OIDC users by @braginini in https://github.com/netbirdio/netbird/pull/5498
- [client] Fix SSH JWT auth failure with Azure Entra ID iat backdating by @hbzhost in https://github.com/netbirdio/netbird/pull/5471
- [misc] Add ISSUE_TEMPLATE configuration file by @mlsmaycon in https://github.com/netbirdio/netbird/pull/5500
- [management] Replace in-memory expose tracker with SQL-backed operations by @mlsmaycon in https://github.com/netbirdio/netbird/pull/5494
New Contributors
- @hbzhost made their first contribution in https://github.com/netbirdio/netbird/pull/5471
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.66.1...v0.66.2

What's New
Client Improvements
- Fixed server mutex being held across waitForUp in Up(), preventing potential blocking behavior.
#5460
- Fixed close-of-closed-channel panic in ConnectClient retry loop.
#5470
- Fixed deadlock in route peer status watcher.
#5489
- Fixed profile config directory permissions.
#5457
- Lowered socket auto-discovery log level from Info to Debug.
#5463
Management Improvements
- Prevented deletion of groups linked to flow groups.
#5439
- Fixed user update permission validation.
#5441
- Added reverse proxy services REST client.
#5454
- Added explicit target deletion on service removal.
#5420
Proxy Improvements
- Flushed buffer immediately to improve gRPC support.
#5469
Self-Hosted Enhancements
- Added support for Embedded IdP PostgreSQL database.
#5443
- Allowed specifying SQL file locations for auth, activity, and main stores.
#5487
Security
- Upgraded Alpine Linux from 3.23.2 to 3.23.3.
#5217
New Contributors
- @artivis made their first contribution in #5457
Full Changelog: v0.66.0...v0.66.1

🚀 New Feature: netbird expose
We're excited to introduce netbird expose --- a simple and secure way to expose your local services through the NetBird reverse proxy.
⚡ Expose Local Services with Protection
Expose a local HTTP server:
netbird expose 8080
This instantly publishes your local service via NetBird's reverse proxy.
You can enhance the exposure with built-in protection and customization:
🔐 With PIN protection (6 digits)
netbird expose 3000 --with-pin 123456
🔑 With password protection and name prefix
netbird expose 8080 --with-password my-secret --with-name-prefix my-app
👥 Restrict by SSO user groups
netbird expose 8080 --with-user-groups engineering,devops
🌐 Use a custom domain (pre-configured in your account)
netbird expose 8080 --with-custom-domain app.example.com
Supported Flags
- --with-pin string --- Protect the exposed service with a 6-digit
PIN\
- --with-password string --- Add password protection\
- --with-user-groups strings --- Restrict access to specific user
groups\
- --with-custom-domain string --- Specify a custom domain\
- --with-name-prefix string --- Prefix the generated service name\
- --protocol string --- Protocol to use (http or https, default
http)
⚠️ NetBird Cloud support is coming soon with hosted proxy nodes. ⚠️
Learn more at: https://docs.netbird.io/manage/reverse-proxy/expose-from-cli
Or watch the video below:
Client Improvements
- Stopped upstream retry loop immediately on context cancellation.
#5403
- Fixed busy-loop in network monitor routing socket on macOS/BSD.
#5424
- Fixed missed sleep/wakeup events on macOS.
#5418
- Removed connection semaphore to simplify connection handling.
#5419
- Skipped UAPI listener in netstack mode.
#5397
- Simplified DNS logging by removing domain list from log output.
#5396
- Excluded Flow domain from caching to prevent TLS failures.
#5433
- Added non-default socket file discovery support.
#5425
Client Service Expose
- Introduced client service expose feature across client and management.
#5411
- Refactored expose feature by moving business logic from gRPC to manager layer.
#5435
Proxy Improvements
- Added access log cleanup.
#5376
- Implemented access log sorting.
#5378
- Sent proxy updates on account deletion.
#5375
- Added pre-shared key (PSK) support to proxy.
#5377
Management Improvements
- Refactored network map component assembly.
#5193
- Added custom domain counts and service metrics to self-hosted metrics.
#5414
Self-Hosted Enhancements
- Added support for activity store engine in the combined server.
#5406
- Added Embedded IdP metrics for improved observability.
#5407
Full Changelog: v0.65.3...v0.66.0

🛡️ Security Fix: Race Condition in Role Update Validation
What was affected
A race condition in the user role validation logic could allow permission checks to succeed based on stale role data. Under very specific timing conditions, concurrent requests during a role change (e.g., while an admin was being demoted to user) could bypass role validation when changing another users role.
Exploit Potential
If an administrator account was being demoted while simultaneously performing acocunt ownership transfer actions, a race window existed where the system could treat the user as having elevated permissions to change owners.
In a coordinated scenario involving two administrator accounts, this could potentially allow privilege escalation — for example, promoting a user to Owner during the demotion window.
Conditions Required
Exploitation required:
- Two administrator accounts.
- One administrator being actively demoted.
- Concurrent ownership transfer requests executed precisely during the demotion process.
- Precise timing to trigger the race condition.
This issue required intentional coordination and timing, making it unlikely to occur accidentally and will require access to two admin accounts.
What's New
Client & Mobile Improvements
- Batched macOS DNS domains to avoid truncation issues.
#5368
- Ensured route settlement on iOS before handling DNS responses.
#5360
- Added logging of lock acquisition time in message handling for improved observability.
#5393
Relay Improvements
- Reduced QUIC initial packet size to 1280 bytes (IPv6 minimum MTU) for better compatibility.
#5374
Management Improvements
- Fixed possible race condition on user role change.
#5395
- Added docker login step in management tests.
#5323
Self-Hosted Updates
- Added a migration script for upgrading from pre-v0.65.0 to post-v0.65.0 combined setup.
#5350
- Removed unused configuration example from self-hosted setup.
#5383
Miscellaneous
- Updated timestamp format to include milliseconds.
#5387
Full Changelog: v0.65.2...v0.65.3

What's New
Client Improvements
- Optimized Windows DNS performance with domain batching and batch mode.
#5264
- Reset WireGuard endpoint on ICE session changes during relay fallback.
#5283
- Refactored WireGuard endpoint setup with role-based proxy activation.
#5277
- Exported lazy connection environment variables for mobile clients.
#5310
- Ignored false positive lint alert in client code.
#5370
Proxy & Reverse Proxy
- Added listener-side Proxy Protocol support and enabled it in Traefik.
#5332
- Added WebSocket support to the proxy.
#5312
- Removed unused OIDC config flags from proxy configuration.
#5369
- Infrastructure updates for proxy components.
#5365
Management Improvements
- Fixed UTC difference issue in peer “last seen” status.
#5348
- Ensured Management starts even if external IdP is down.
#5367
- Added flag to disable the legacy gRPC endpoint.
#5372
Documentation & Misc
- Added additional proxy domain instructions.
#5328
- Added an extra CNAME configuration example.
#5341
Full Changelog: v0.65.1...v0.65.2

What's Changed
- [misc] Fix reverse proxy getting started messaging by @braginini in https://github.com/netbirdio/netbird/pull/5317
- [management] Move service reload outside transaction in account settings update by @bcmmbaga in https://github.com/netbirdio/netbird/pull/5325
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.65.0...v0.65.1

Release Notes for v0.65.0
What's New
🔀 Reverse Proxy
NetBird now includes a built-in reverse proxy in the management server, enabling proxied access to backend services through your NetBird network. Allowing you to expose your services to the public with the option to secure them with SSO, PINs, or passwords.
No VPN client required for end users. Just point a custom domain at your NetBird server, configure the proxy in the dashboard, and your internal services are securely accessible from any browser. Think of it as a self-hosted alternative to Cloudflare Tunnels, but without the MITM and fully under your control.
Key features:
- Custom domains - Map your own domains to internal services and let NetBird handle TLS and routing via CNAME verification
- Built-in authentication - Protect exposed services with SSO (via your configured IdP), PIN codes, passwords, or magic links directly from the dashboard
- Multiple targets - Route traffic to one or more backend peers or resources with optional path-based routing
- Access logs - Monitor who's accessing your proxied services with built-in logging
- Proxy settings - Fine-tune behavior with options like host header passthrough and redirect rewriting
Add a Service
Expose any internal service by selecting a subdomain and adding one or more backend targets. Each target points to a peer or resource on your network.
Custom Domains
Bring your own domain by adding a CNAME record pointing to your NetBird proxy cluster. NetBird handles TLS certificate provisioning automatically.
Authentication
Secure your exposed services with multiple authentication methods. Enable one or combine several for layered protection.
Settings
Fine-tune proxy behavior with options like passing the original Host header to your backend or rewriting redirect URLs to use the public domain.
Learn more:
- Reverse Proxy Overview
- Custom Domains
- Authentication
NetBird cloud support is coming soon, with hosted reverse proxy nodes.
🏗️ Self-Hosted Improvements
- Added combined NetBird server binary for simplified self-hosted deployments, reducing the number of containers needed to run NetBird.
#5232
🔒 Management Improvements
- Enforced access control on accessible peers, ensuring proper authorization checks when querying the accessible peers endpoint.
#5301
- Added cloud API spec to the public OpenAPI definition with REST client support.
#5222
🖥️ Client Improvements
- Added early message buffer for the relay client, preventing message loss during connection establishment.
#5282
- Refactored relay connection container for improved reliability and code maintainability.
#5271
What's Changed
- [misc] Update sign pipeline version by @mlsmaycon in #5296
- [self-hosted] add netbird server by @braginini in #5232
- [management] Enforce access control on accessible peers by @bcmmbaga in #5301
- [misc] Add cloud api spec to public open api with rest client by @bcmmbaga in #5222
- [client] Add early message buffer for relay client by @pappz in #5282
- [client] Refactor/relay conn container by @pappz in #5271
- [management, reverse proxy] Add reverse proxy feature by @pascal-fischer in #5291
Full Changelog: v0.64.6...v0.65.0

What's New
🚨 Security Fix
Security: Fixed account impersonation validation in management API
Fixed a vulnerability in the management server's authentication middleware where the ?account= query parameter could be used to impersonate arbitrary accounts without proper validation when getting a list of accessible peers. It requires the attacker to have prior knowledge of the target accounts' and peer IDs.
The fix adds explicit validation via IsValidChildAccount() before allowing account switching. Account impersonation is now only permitted when the target account is confirmed as a legitimate child account of the
requesting user's parent account.
Affected component: Management server HTTP middleware (auth_middleware.go) and /api/peers/<peer_id>/accessible-peers endpoint
Severity: High — an authenticated user could potentially access or act on behalf of accounts they should not have access to by passing an arbitrary account parameter and fetching the list of accessible peers.
Recommendation: All self-hosted deployments should upgrade to this version.
Client Improvements
- Added missing BSD flags to the debug bundle.
#5254
- Cached the result of wgInterface.ToInterface() using sync.Once for better performance.
#5256
- Fixed nil pointer panic in the ICE agent during sleep/wake cycles.
#5261
- Always log DNS forwarder responses for improved troubleshooting.
#5262
- Fixed netstack detection and added a WireGuard port option.
#5251
- Corrected wrong URL logging for DefaultAdminURL.
#5252
- Added timing measurements to handleSync for better observability.
#5228
- Fixed duplicate firewall rules in USP filter.
#5269
- Added environment variable to skip DNS probing when needed.
#5270
- Fixed race condition and ensured correct message ordering in Relay.
#5265
- Ensured login is checked in foreground mode when required.
#5295
- Fixed multiple panics in device and engine code.
#5287
- Cleaned up stale nftables entries without handle.
#5272
Management Improvements
- Fixed incorrectly setting disconnected status for connected peers.
#5247
- Added gRPC debounce for message types to reduce noise.
#5239
- Added validation of stream start time for connecting peers.
#5267
- Fixed ischild check logic.
#5279
New Contributors
- @eyJhb made their first contribution in #5252
Full Changelog: v0.64.5...v0.64.6

What's Changed
- Add selfhosting video by @braginini in https://github.com/netbirdio/netbird/pull/5235
- [management] adding account id validation to accessible peers handler by @pascal-fischer in https://github.com/netbirdio/netbird/pull/5246
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.64.4...v0.64.5

What's Changed
- [client] Add macOS default resolvers as fallback by @lixmal in https://github.com/netbirdio/netbird/pull/5201
- [client] Add block inbound option to the embed client by @lixmal in https://github.com/netbirdio/netbird/pull/5215
- [management] Disable local users for a smooth single-idp mode by @braginini in https://github.com/netbirdio/netbird/pull/5226
- [management] disable sync lim by @crn4 in https://github.com/netbirdio/netbird/pull/5233
- [management] run cancelPeerRoutines in goroutine in sync by @crn4 in https://github.com/netbirdio/netbird/pull/5234
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.64.3...v0.64.4

What's Changed
- [client] Remove redundant square bracket trimming in USP endpoint parsing by @pappz in https://github.com/netbirdio/netbird/pull/5197
- [client] Refactor/optimise raw socket headers by @pappz in https://github.com/netbirdio/netbird/pull/5174
- [management] fix ephemeral peers being not removed by @crn4 in https://github.com/netbirdio/netbird/pull/5203
- [management] fix skip of ephemeral peers on deletion by @crn4 in https://github.com/netbirdio/netbird/pull/5206
- [client] Stop NetBird on firewall init failure by @lixmal in https://github.com/netbirdio/netbird/pull/5208
- [management] Streamline domain validation by @lixmal in https://github.com/netbirdio/netbird/pull/5211
- [client] Fix WG watcher missing initial handshake by @pappz in https://github.com/netbirdio/netbird/pull/5213
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.64.2...v0.64.3

What's New
Client Improvements
- Consolidated authentication logic to improve maintainability and consistency.
#5010
- Added IPv6 support to the UDP WireGuard proxy.
#5169
- Fixed a flaky JWT SSH test to improve CI stability.
#5181
- Updated Fyne UI and added retry handling to the exit menu.
#5187
- Prevented eBPF traffic from being tracked in conntrack.
#5166
- Added support for non-PTY, no-command interactive SSH sessions.
#5093
Management & Identity
- Fixed validator warning messages to improve clarity.
#5168
- Improved peer deletion error handling.
#5188
- Included default groups claim in the CLI audience.
#5186
- Added user invite link support for the embedded IdP.
#5157
Full Changelog: v0.64.1...v0.64.2

What's New
Client Improvements
- Fixed RFC 4592 wildcard matching for existing domain names.
#5145
- Extended the WireGuard watcher to also monitor ICE connections.
#5133
- Added IPv6 support to userspace bind.
#5147
- Fixed IPv4-only limitation in the bind proxy.
#5154
- Improved DNS reliability by trying the next upstream on SERVFAIL / REFUSED responses.
#5163
- Hid forwarding rules from status output when the count is zero.
#5149
- Added CPU profiling to the debug bundle.
#4700
- Fixed health result reporting in the debug bundle.
#5164
- Changed the default Rosenpass log level.
#5137
- Fixed exit node menu behavior on reconnect and removed tooltips in the GUI.
#5167
Management Enhancements
- Fixed activity event initiator reporting for user group changes.
#5152
- Ensured ephemeral peers are correctly added to the ephemeral list on login.
#5165
- Moved activity store encryption into the shared crypt package.
#5111
Full Changelog: v0.64.0...v0.64.1

What's New
Debugging & Observability
- Added the ability to trigger debug bundle generation directly from the API and Dashboard.
#4832
Client Improvements
- Improved error handling by adjusting notifyDisconnected behavior on receiveJobRequest failures.
#5138
- Added support for wildcard custom DNS records.
#5125
- Fixed profile switching issues and repeated down / up command failures.
#5142
- Fixed Rosenpass connectivity issues for Android peers.
#5044
Management Enhancements
- Added support for local user password changes when using the embedded IdP.
#5132
- Included missing activity events in management API responses.
#5140
Infrastructure
- Added embedded STUN support to the getting-started setup to simplify initial deployments.
#5141
Full Changelog: v0.63.0...v0.64.0

What's New
Custom DNS Zones
NetBird now supports private DNS zones, allowing you to host DNS records directly within your network without external DNS servers.
Create zones like internal.company.io, add A, AAAA, or CNAME records, and distribute them to specific peer groups. Resolution happens locally on peers, and records propagate automatically when group membership
changes. With search domain support enabled, peers can query short names like api instead of the full api.internal.company.io.
Custom zones take precedence over nameserver configurations, giving you control over how specific domains resolve within your network. This works well with routed networks—map friendly names to private IPs behind
routing peers, and NetBird handles both DNS resolution and traffic routing. Your teams access postgres.internal instead of remembering 192.168.0.68.
Zone distribution is group-based, so different teams can see different records for the same zone, or have access to entirely separate zones.
Use Cases
- Environment separation — Distinct zones for production, staging, and development, distributed only to relevant teams
- Routed network resources — DNS names for services in data centers or cloud VPCs accessed through routing peers
- Split-horizon DNS — Internal-only resolution for domains that resolve differently outside your network
Screenshots
Create a new Zone:
Create a new record:
View all records:
Learn more at:
Custom Zones
Custom zone records for routed resources
DNS & Networking Improvements
- Ensured musl compatibility by chasing CNAMEs in the local resolver.
#5046
- Improved DNS resolution flow by falling through the DNS chain for custom DNS zones.
#5081
- Changed priority between local and DNS route handlers for more predictable routing.
#5106
- Fixed netstack upstream DNS handling and added WASM debug methods.
#4648
Client Improvements
- Fixed WASM peer connections to lazy peers.
#5097
- Added fallback handling for invalid loginuid in ui-post-install.sh.
#5099
- Removed duplicate audience checks in the client.
#5117
Management Enhancements
- Added Custom DNS zones support.
#4849
- Added configuration compatibility checks during startup.
#5087
- Optimized external cache access by fetching all users in a single request.
#5104
- Adapted rate limiting behavior.
#5080
- Fixed SSH server audience validation across management and client.
#5105
- Skipped email_verified validation when not present in IdP responses.
#5118
- Added IdP timeout configuration via environment variable.
#4647
Infrastructure & Security
- Introduced embedded STUN support for relay and STUN components.
#5062
- Added a Quickstart reverse proxy assistant to simplify initial setup.
#5100
- Upgraded Alpine Linux from 3.22.2 to 3.23.2 for security hardening.
#5119
Other Changes
- Added a hiring announcement with a link to careers.netbird.io.
#5095
New Contributors
- @nsadeghi97 made their first contribution in #5095
- @ressys1978 made their first contribution in #4647
Full Changelog: v0.62.2...v0.63.0

What's Changed
- [management] Check config compatibility by @braginini in https://github.com/netbirdio/netbird/pull/5087
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.62.2...v0.62.3

What's Changed
- [relay] Update GO version and QUIC version (… by @pappz in https://github.com/netbirdio/netbird/pull/5071
- [client] Add non-root ICMP support to userspace firewall forwarder by @lixmal in https://github.com/netbirdio/netbird/pull/4792
- [client] Reorder userspace ACL checks to fail faster for better performance by @lixmal in https://github.com/netbirdio/netbird/pull/4226
- [management] fix the issue with duplicated peers with the same key by @crn4 in https://github.com/netbirdio/netbird/pull/5053
- [management] Feature/resolve local jwks keys by @braginini in https://github.com/netbirdio/netbird/pull/5073
- [management] Validate OIDC issuer when creating or updating by @braginini in https://github.com/netbirdio/netbird/pull/5074
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.62.1...v0.62.2

What's Changed
- [management] Fix role change in transaction and update readme by @braginini in https://github.com/netbirdio/netbird/pull/5060
- [management] Fix race condition in experimental network map when deleting account by @bcmmbaga in https://github.com/netbirdio/netbird/pull/5064
- [misc] add embedded provider support metrics by @mlsmaycon in https://github.com/netbirdio/netbird/pull/5065
- [misc] add new getting started to release by @mlsmaycon in https://github.com/netbirdio/netbird/pull/5057
- [infrastructure] fix: disable Caddy debug by @diegocn in https://github.com/netbirdio/netbird/pull/5067
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.62.0...v0.62.1

What's New
🔓 Simplified Identity Provider Management
Self-hosted NetBird no longer requires an external identity provider by default. Local users now work out of the box without any IdP dependency.
What's changed:
- No IdP required - Create and manage users directly from the Dashboard
- Multiple IdP support - Configure Pocket ID, Auth0, Google, Microsoft, Okta, or any OIDC provider directly from the Dashboard
- New quickstart script - Simpler deployment with fewer containers
export NETBIRD_DOMAIN=netbird.example.com
curl -fsSL https://github.com/netbirdio/netbird/releases/latest/download/getting-started.sh | bash
This is available for new installations and is fully backward-compatible—existing setups will continue to work without changes. The previous Zitadel quickstart script remains available.
Learn more:
- Quickstart Guide
- Identity Providers & Local User Management
Dashboard Enhancements
- Added instance setup wizard for first-time user creation on new installations
- Added user creation flow with password generation and copy functionality
- Added Identity Providers settings tab for configuring external IdPs directly from the UI

- Added IdP badges in user list showing each user's authentication source
Related PRs
- Added embedded identity provider for self-hosted deployments netbird#5008
- Configure Identity Providers in the UI dashboard#523
Client Enhancements
- Fixed an issue where the client could get stuck in connecting state when api.netbird.io is unreachable.
#5033
- Added port forwarding support to the SSH proxy.
#5031
- Added support for disabling the eBPF WireGuard proxy via environment variable.
#5047
- Fixed SSH UI flickering test instability.
#5036
Management Improvements
- Refactored integrated peer validation and peer deletion logic for better consistency.
#5035, #5042
- Incremented network serial on peer updates to ensure correct synchronization.
#5051
- Fixed nil handling for extra settings in management.
#5049
- Cached SSH authorized users in the network map for improved performance.
#5048
Identity & Infrastructure
- Introduced Embedded IdP, simplifying identity provider management across management, infrastructure, and IdP components.
#5008
Shared & Tooling Improvements
- Added support for setting a custom User-Agent in the REST client.
#5037
- Fixed ui-post-install.sh to correctly use the full username.
#4809
- Improved Nmap concurrency handling.
#5040
New Contributors
- @devurandom made their first contribution in #4809
Full Changelog: v0.61.2...v0.62.0

What's Changed
- [client] Fix update download URL by @pappz in https://github.com/netbirdio/netbird/pull/5023
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.61.1...v0.61.2

What's Changed
- [client] add reset for management backoff by @gamerslouis in https://github.com/netbirdio/netbird/pull/4935
- [client] Filter out own peer from remote peers list during peer updates. by @pappz in https://github.com/netbirdio/netbird/pull/4986
- [client] Fix Advanced Settings not opening on Windows with Japanese locale (#4455) by @h6ah4i in https://github.com/netbirdio/netbird/pull/4637
- [management] apply login filter only for setup key peers by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4943
- fix(router): nft tables limit number of peers source by @nhenneaux in https://github.com/netbirdio/netbird/pull/4852
- [management] filter own peer when having a group to peer policy to themself by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4956
- Add DEX IdP Support by @braginini in https://github.com/netbirdio/netbird/pull/4949
- Feat/add support for forcing device auth flow on ios by @shuuri-labs in https://github.com/netbirdio/netbird/pull/4944
- [client] Fix UI stuck in "Connecting" state when daemon reports "Connected" by @pappz in https://github.com/netbirdio/netbird/pull/5014
- [management] Fix/delete groups without lock by @pascal-fischer in https://github.com/netbirdio/netbird/pull/5012
- [client] Fix semaphore slot leaks by @pappz in https://github.com/netbirdio/netbird/pull/5018
- [client] add verbose flag for free ad tests by @mlsmaycon in https://github.com/netbirdio/netbird/pull/5021
New Contributors
- @h6ah4i made their first contribution in https://github.com/netbirdio/netbird/pull/4637
- @nhenneaux made their first contribution in https://github.com/netbirdio/netbird/pull/4852
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.61.0...v0.61.1

What's New
🔐 Fine-Grained SSH Access Control (Breaking Change)
NetBird introduces fine-grained SSH access control with support for explicit local OS users on target machines.
Administrators can now define which NetBird users or groups are allowed to connect as specific local system users, enabling safer, more predictable SSH access without relying on shared or implicit credentials.
⚠️ Breaking change for self-hosted deployments
Self-hosted installations must upgrade the Management server before upgrading their clients and enabling or using the new SSH access model.
Failing to upgrade may result in SSH access issues or unexpected behavior.
Learn more at: https://docs.netbird.io/manage/peers/ssh#fine-grained-access-control
🔄 Automatic Client Updates (Windows & macOS) - Beta
NetBird adds automatic client update support for Windows and macOS, helping users stay up to date with the latest fixes and features while maintaining full control over update behavior. This feature is currently in beta and administrators will be able to enable, disable, and configure a custom max version.
A few notes on the behavior:
- Update check will happen on connection
- Supported on Windows and macOS only
- Disabled by default
- Can be enabled via Settings → Client in the NetBird application. See image below:
Learn more at: https://docs.netbird.io/manage/peers/auto-update
Management Enhancements
- Added fine-grained SSH access control across client and management.
#4969
Client Enhancements
- Introduced auto-update support for the client to simplify upgrades.
#4732
- Improved management domain lookup by adding an additional timeout.
#4983
- Added Android profile switching for easier multi-profile usage.
#4884
- Fixed Linux UI flickering during state updates.
#4886
- Applied DNS host configuration only on changes to reduce unnecessary updates.
#4695
MISC
- Added FreeBSD port release job to GitHub Actions.
#4916
- Added conditional checks for FreeBSD diff file generation in CI.
#5001
- Updated to new signing pipelines v0.1.0.
#4993
- Fixed a broken image link in the README.
#4876
- Preset signal port on templates #5004
New Contributors
- @hey-august made their first contribution in #4876
Full Changelog: v0.60.8...v0.61.0

What's Changed
- [client] lookup for management domains using an additional timeout #4983
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.60.8...v0.60.9

What's Changed
- [client] Use setsid to avoid the parent process from being killed via HUP by login by @lixmal in https://github.com/netbirdio/netbird/pull/4900
- [client] Fix DNS forwarder returning broken records on 4 to 6 mapped IP addresses by @lixmal in https://github.com/netbirdio/netbird/pull/4887
- [management] cleanup logs by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4933
- [management] monitoring updates by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4937
- [management] Fix sync metrics by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4939
- [management] remove context from store methods by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4940
- [management] Approve all pending peers when peer approval is disabled by @bcmmbaga in https://github.com/netbirdio/netbird/pull/4806
- [iOS] Add force relay connection on iOS by @doromaraujo in https://github.com/netbirdio/netbird/pull/4928
- [relay-server] Add health-check agent recognition to avoid error logs by @pappz in https://github.com/netbirdio/netbird/pull/4917
- [ci] Add local lint setup with pre-push hook to catch issues early by @pappz in https://github.com/netbirdio/netbird/pull/4925
- [management] use xid as request id for logging by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4955
- [client] Add stack trace for bundle by @pappz in https://github.com/netbirdio/netbird/pull/4957
- [client] Fix deadlock in delayed WG update function by @pappz in https://github.com/netbirdio/netbird/pull/4953
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.60.7...v0.60.8

What's Changed
- [client] Passthrough all non-NetBird chains to prevent them from dropping NetBird traffic by @lixmal in https://github.com/netbirdio/netbird/pull/4899
- [client] Fix engine shutdown deadlock and sync-signal message handling races by @pappz in https://github.com/netbirdio/netbird/pull/4891
- [client] Reorder subsystem shutdown so peer removal goes first by @mlsmaycon in https://github.com/netbirdio/netbird/pull/4914
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.60.6...v0.60.7

What's Changed
- [client,management] Remove OAuth select_account prompt by @bcmmbaga in https://github.com/netbirdio/netbird/pull/4912
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.60.5...v0.60.6

What's Changed
- [client] Fix UI already running check by @pappz in https://github.com/netbirdio/netbird/pull/4858
- [client, management] Add OAuth select_account prompt support to PKCE flow by @pappz in https://github.com/netbirdio/netbird/pull/4880
- [management] Feat/api enhancements by @fahrishih in https://github.com/netbirdio/netbird/pull/4831
- [management] Add user created activity event by @bcmmbaga in https://github.com/netbirdio/netbird/pull/4893
- [management] Refactor network map controller by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4789
- [management] update management integrations by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4895
- [client] Add conditional peer removal logic during shutdown by @mlsmaycon in https://github.com/netbirdio/netbird/pull/4897
- [management] record pat usage metrics by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4888
- [client] Add sleep state tracking to handle wakeup/sleep events reliably by @mlsmaycon in https://github.com/netbirdio/netbird/pull/4894
- [management] Add support to disable geolocation service by @bcmmbaga in https://github.com/netbirdio/netbird/pull/4901
- [relay] Use instanceURL instead of Exposed address. by @pappz in https://github.com/netbirdio/netbird/pull/4905
New Contributors
- @fahrishih made their first contribution in https://github.com/netbirdio/netbird/pull/4831
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.60.4...v0.60.5

What's Changed
- [client] Sleep detection on macOS by @pappz in https://github.com/netbirdio/netbird/pull/4859
- [relay] use exposed address for healthcheck TLS validation by @shuuri-labs in https://github.com/netbirdio/netbird/pull/4872
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.60.3...v0.60.4

What's Changed
- [management] Remove TestBufferUpdateAccountPeers by @crn4 in https://github.com/netbirdio/netbird/pull/4839
- [client, management, signal, relay] Update go.mod to use Go 1.24.10 and upgrade x/crypto dependencies by @mlsmaycon in https://github.com/netbirdio/netbird/pull/4828
- [management] Fix SSH JWT issuer derivation for IDPs with path components by @sgtaziz in https://github.com/netbirdio/netbird/pull/4844
- [management] Preserve validator settings on account settings update by @bcmmbaga in https://github.com/netbirdio/netbird/pull/4862
- [client] Make mss clamping optional for nftables by @lixmal in https://github.com/netbirdio/netbird/pull/4843
- [client] Allow selection/deselection of network resources on Android by @doromaraujo in https://github.com/netbirdio/netbird/pull/4607
- [client] Support disable search domain for custom zones by @mlsmaycon in https://github.com/netbirdio/netbird/pull/4826
- [client] feat: Add support for displaying device code (UserCode) on Android TV by @shuuri-labs in https://github.com/netbirdio/netbird/pull/4800
- [client] Open browser for SSH automatically by @lixmal in https://github.com/netbirdio/netbird/pull/4838
- [client] Add excluded port range handling for PKCE flow by @mlsmaycon in https://github.com/netbirdio/netbird/pull/4853
New Contributors
- @sgtaziz made their first contribution in https://github.com/netbirdio/netbird/pull/4844
- @shuuri-labs made their first contribution in https://github.com/netbirdio/netbird/pull/4800
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.60.2...v0.60.3

What's Changed
- [client] Increase ssh detection timeout by @lixmal in https://github.com/netbirdio/netbird/pull/4827
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.60.1...v0.60.2

What's Changed
- [management] Fix direct peer networks route by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4802
- [management] pass config to controller by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4807
- [management] Add native ssh port rule on 22 by @mlsmaycon in https://github.com/netbirdio/netbird/pull/4810
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.60.0...v0.60.1

What's New
Native SSH Access & OpenSSH Integration
NetBird v0.60.0 ships a complete rewrite of SSH access. Every peer can now run a built-in SSH server, giving you identity-aware, private SSH access over your NetBird network — using either the netbird ssh command or your existing OpenSSH clients.
Highlights
- Built-in SSH server on every peer - Enable with netbird up --allow-server-ssh and get a native SSH endpoint without exposing port 22 to the internet.
- Identity-aware access with JWT - SSH sessions are authenticated via your IdP (OIDC/JWT) by default, so you know which user accessed which machine.
- Works with netbird ssh and OpenSSH - Use netbird ssh user@<peer-ip> or standard ssh, sftp, and scp commands; NetBird configures OpenSSH automatically via a drop-in 99-netbird.conf.
- Port 22, transparently secured - NetBird listens on TCP 22022 and redirects NetBird-network port 22 traffic to it, so existing SSH workflows keep working without changing ports.
- Advanced features when you need them - Optional SFTP, local and remote port forwarding, root login, and JWT token caching (--ssh-jwt-cache-ttl) for fewer auth prompts.
- Machine identity mode (legacy behavior) - Prefer host-based trust? Disable JWT auth with --disable-ssh-auth and rely purely on network-level ACLs.
How it works
1. Enable the SSH server on the target peer
netbird down # if already running
netbird up --allow-server-ssh
Add optional flags for SFTP, port forwarding, or root login as needed:
netbird up --allow-server-ssh \
--enable-ssh-local-port-forwarding \
--enable-ssh-remote-port-forwarding \
--enable-ssh-sftp \
--enable-ssh-root
2. Create an ACL policy for SSH
Allow TCP port 22022 from your SSH client peers/groups to your SSH server peers/groups in Access Control.
3. Enable SSH in the Dashboard
Open the target peer → enable SSH Access.
4. Connect via CLI or OpenSSH
- NetBird CLI:
netbird ssh user@100.119.230.104
- OpenSSH:
ssh user@100.119.230.104
sftp user@100.119.230.104
scp file.txt user@100.119.230.104:/path
📖 Read more in the SSH documentation: https://docs.netbird.io/how-to/ssh

Client Improvements
- Updated the client login success page with an improved user experience.
#4797
- Reverted deprecated gRPC client code migration to restore expected behavior.
#4805

Management Improvements
- Fixed handling of port ranges in route firewall rules to ensure accurate rule application.
#4801

Upgrade & Compatibility Notes
- ⚠️ NetBird SSH in v0.60.0 is a breaking change:
- Server port changed from 44338 → 22022
- Authentication moved from machine public keys to JWT-based user identity
- Implicit firewall rules were removed - you now need an explicit ACL for port 22022
- ⚠️ Version compatibility: v0.60.0+ SSH is not backward compatible with older peers.
For self-hosted environments, we recommend updating in this order:
1. Management server
2. Dashboard (for browser SSH, if used)
3. SSH servers first (peers with --allow-server-ssh)
4. SSH clients last (netbird ssh users)
Full Changelog: v0.59.13...v0.60.0

What's Changed
- [management] activity events on group updates by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4750
- Bump github.com/containerd/containerd from 1.7.27 to 1.7.29 by @dependabot[bot] in https://github.com/netbirdio/netbird/pull/4756
- [management] incremental network map builder by @crn4 in https://github.com/netbirdio/netbird/pull/4753
- [management] add pat rate limiting by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4741
- [management] remove toAll firewall rule by @crn4 in https://github.com/netbirdio/netbird/pull/4725
- [management] remove GLOBAL when disabling foreign keys on mysql by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4615
- [management ] remove timing logs by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4761
- [client] Create networkd.conf.d if it doesn't exist by @lixmal in https://github.com/netbirdio/netbird/pull/4764
- [management] fix pg db deadlock after app panic by @crn4 in https://github.com/netbirdio/netbird/pull/4772
- [client] Fix agent reference by @pappz in https://github.com/netbirdio/netbird/pull/4776
- [management] move network map logic into new design by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4774
- [management] Removed policy posture checks on original peer by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4779
- [client] Fix shutdown blocking on stuck ICE agent close by @lixmal in https://github.com/netbirdio/netbird/pull/4780
- [client] Add quick actions window by @doromaraujo in https://github.com/netbirdio/netbird/pull/4717
- [client] Use stdnet with a context to avoid DNS deadlocks by @lixmal in https://github.com/netbirdio/netbird/pull/4781
- [client] Replace ipset lib by @lixmal in https://github.com/netbirdio/netbird/pull/4777
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.59.12...v0.59.13

What's Changed
- [client] Migrate deprecated grpc client code by @lixmal in https://github.com/netbirdio/netbird/pull/4687
- [client] Fix netstack dns forwarder by @lixmal in https://github.com/netbirdio/netbird/pull/4727
- [client] Extend Darwin network monitoring with wakeup detection (cleanup branch) by @pappz in https://github.com/netbirdio/netbird/pull/4723
- Bump github.com/quic-go/quic-go from 0.48.2 to 0.49.1 by @dependabot[bot] in https://github.com/netbirdio/netbird/pull/4621
- [management] update db connection lifecycle configuration by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4740
- [client] Set up networkd to ignore ip rules by @lixmal in https://github.com/netbirdio/netbird/pull/4730
- [client] Clamp MSS on outbound traffic by @lixmal in https://github.com/netbirdio/netbird/pull/4735
- [client] Allow INPUT traffic on the compat iptables filter table for nftables by @lixmal in https://github.com/netbirdio/netbird/pull/4742
- [client] Block on all subsystems on shutdown by @lixmal in https://github.com/netbirdio/netbird/pull/4709
- [client] Add login_hint to oidc flows by @lixmal in https://github.com/netbirdio/netbird/pull/4724
- [client] Add dns config to debug bundle by @lixmal in https://github.com/netbirdio/netbird/pull/4704
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.59.11...v0.59.12

What's Changed
- [client] Fix UI panic when switching profiles by @lixmal in https://github.com/netbirdio/netbird/pull/4718
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.59.10...v0.59.11

What's Changed
- [client] Fix Connect/Disconnect buttons being enabled or disabled at the same time by @lixmal in https://github.com/netbirdio/netbird/pull/4711
- [client] Use management-provided dns forwarder port on the client side by @lixmal in https://github.com/netbirdio/netbird/pull/4712
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.59.9...v0.59.10

What's Changed
- [management] Add peer disapproval reason by @bcmmbaga in https://github.com/netbirdio/netbird/pull/4468
- [client] Fix active profile name in debug bundle by @lixmal in https://github.com/netbirdio/netbird/pull/4689
- [signal] Fix HTTP/WebSocket proxy not using custom certificates by @bcmmbaga in https://github.com/netbirdio/netbird/pull/4644
- [client] Fix macOS state-based dns cleanup by @lixmal in https://github.com/netbirdio/netbird/pull/4701
- [client] Clean up bsd routes independently of the state file by @lixmal in https://github.com/netbirdio/netbird/pull/4688
- Include expired and routing peers in DNS record filtering by @bcmmbaga in https://github.com/netbirdio/netbird/pull/4708
- [management] rewire account manager to permissions manager by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4673
- [client] Redirect dns forwarder port 5353 to new listening port 22054 by @lixmal in https://github.com/netbirdio/netbird/pull/4707
- [client] The status cmd will not be blocked by the ICE probe by @pappz in https://github.com/netbirdio/netbird/pull/4597
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.59.8...v0.59.9

What's Changed
- [Snyk] Security upgrade alpine from 3.22.0 to 3.22.2 by @mlsmaycon in https://github.com/netbirdio/netbird/pull/4618
- [management] Delete TURNConfig section from script by @braginini in https://github.com/netbirdio/netbird/pull/4639
- [client] Clean up match domain reg entries between config changes by @lixmal in https://github.com/netbirdio/netbird/pull/4676
- [misc] Update tag name extraction in install.sh by @mlsmaycon in https://github.com/netbirdio/netbird/pull/4677
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.59.7...v0.59.8

What's Changed
- [management] feat: Basic PocketID IDP integration by @jfrconley in https://github.com/netbirdio/netbird/pull/4529
- [client] Fix missing flag values in profiles by @lixmal in https://github.com/netbirdio/netbird/pull/4650
- [client] Add bind activity listener to bypass udp sockets by @lixmal in https://github.com/netbirdio/netbird/pull/4646
- [client] Set default wireguard port for new profiles by @lixmal in https://github.com/netbirdio/netbird/pull/4651
- [client] Fix nil pointer when run debug bundle by @pappz in https://github.com/netbirdio/netbird/pull/4652
- [client] Remove rule squashing by @lixmal in https://github.com/netbirdio/netbird/pull/4653
- [client] Support BROWSER env for login by @lixmal in https://github.com/netbirdio/netbird/pull/4654
- [client] Fix status showing P2P without connection by @lixmal in https://github.com/netbirdio/netbird/pull/4661
New Contributors
- @jfrconley made their first contribution in https://github.com/netbirdio/netbird/pull/4529
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.59.6...v0.59.7

What's Changed
- [managament] sync all other peers on peer add/remove by @hakansa in https://github.com/netbirdio/netbird/pull/4614
- [client] Explicitly disable DNSOverTLS for systemd-resolved by @kleschenko in https://github.com/netbirdio/netbird/pull/4579
- [management] pass temporary flag to validator by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4599
- [misc] Add service definition for netbird-signal by @mlsmaycon in https://github.com/netbirdio/netbird/pull/4620
- [client] Force TLS1.2 for RDP with Win11/Server2025 for CredSSP compatibility by @lixmal in https://github.com/netbirdio/netbird/pull/4617
New Contributors
- @kleschenko made their first contribution in https://github.com/netbirdio/netbird/pull/4579
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.59.5...v0.59.6

What's Changed
- [client] fix dns forwarder port update by @hakansa in https://github.com/netbirdio/netbird/pull/4613
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.59.4...v0.59.5

What's Changed
- [client] Remove endpoint address on peer disconnect, retain status for activity recording by @pappz in https://github.com/netbirdio/netbird/pull/4228
- [client] Close Re-Auth Window If Client Is Already Connected by @hakansa in https://github.com/netbirdio/netbird/pull/4525
- [client] Implement DNS query caching in DNSForwarder by @hakansa in https://github.com/netbirdio/netbird/pull/4574
- [client] Recreate agent when receive new session id by @pappz in https://github.com/netbirdio/netbird/pull/4564
- [client,gui] Update url_windows.go to offer arm64 executable download by @webash in https://github.com/netbirdio/netbird/pull/4586
New Contributors
- @webash made their first contribution in https://github.com/netbirdio/netbird/pull/4586
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.59.3...v0.59.4

What's Changed
- Adjust signal port for websocket connections by @mlsmaycon in https://github.com/netbirdio/netbird/pull/4594
- [client,management,signal] Handle grpc from ws proxy internally instead of via tcp by @lixmal in https://github.com/netbirdio/netbird/pull/4593
- [management,signal] Remove ws-proxy read deadline by @lixmal in https://github.com/netbirdio/netbird/pull/4598
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.59.2...v0.59.3

What's Changed
- Add websocket paths including relay to nginx template by @lixmal in https://github.com/netbirdio/netbird/pull/4573
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.59.1...v0.59.2

What's Changed
- [client] fix Windows NRPT Policy Path by @hakansa in https://github.com/netbirdio/netbird/pull/4572
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.59.0...v0.59.1

What's New
Browser Client for Remote SSH & RDP Access
We’re excited to introduce the NetBird Browser Client – a secure, zero-install way to access your peers directly from your web browser.
Highlights
- No installation required – connect from Chrome, Firefox, Edge, or Safari.
- SSH & RDP support – access Linux and Windows machines with full protocol support.
- Runs in your browser – a complete NetBird peer compiled to WebAssembly.
- End-to-end encrypted – secured with WireGuard®.
- Temporary, secure access – short-lived peers and ACLs are created automatically and cleaned up when the session ends.
How it works
Open your NetBird dashboard → Peers view, choose a machine, and click Launch Console (SSH) or Remote Desktop (RDP).
Your session runs securely in the browser with no software download needed.
📖 Read the full guide
⚠️Note for Self-Hosted Deployments
To use the browser client with self-hosted deployments, you need to upgrade your Management, Signal, Dashboard, and Relay containers.
Learn more here:
- Self-Hosted Quickstart – Support Browser Clients
- Self-Hosted Guide – Upgrade
PRs:
- Added browser client support across client, signal, and management components. #4415
- Adjusted WebSocket proxy paths to ensure proper browser client functionality. #4565
- Updated infrastructure scripts to include WebSocket proxy setup for browser client deployments. #4566
Other Client Enhancements
- Added Windows DNS policies to always use the GPO path. #4460
- Fixed packet loss issues. #3338
- Ordered ICE candidate lists for proper comparison and reliability. #4561
- Made DNS ForwarderPort configurable and updated the default well-known port. #4479
Full Changelog: v0.58.2...v0.59.0

What's Changed
- [management] Add logs for update channel by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4527
- [client] Add WireGuard interface lifecycle monitoring by @hakansa in https://github.com/netbirdio/netbird/pull/4370
- [management] Fix/nmap dns filter by @crn4 in https://github.com/netbirdio/netbird/pull/4547
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.58.1...v0.58.2

What's Changed
- [client] Skip interface for route lookup if it doesn't exist by @lixmal in https://github.com/netbirdio/netbird/pull/4524
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.58.0...v0.58.1

What's Changed
- [management] Add rule ID validation for policy updates by @bcmmbaga in https://github.com/netbirdio/netbird/pull/4499
- [client] [UI] Down & Up NetBird Async When Settings Updated by @hakansa in https://github.com/netbirdio/netbird/pull/4458
- [android] Add OnLoginSuccess callback to URLOpener interface by @doromaraujo in https://github.com/netbirdio/netbird/pull/4492
- [management] Filter DNS records to include only peers to connect by @bcmmbaga in https://github.com/netbirdio/netbird/pull/4517
- Add a new product demo video by @braginini in https://github.com/netbirdio/netbird/pull/4520
- [client] Use native windows sock opts to avoid routing loops by @lixmal in https://github.com/netbirdio/netbird/pull/4314
- [client] Do not run up cmd if not needed by @pappz in https://github.com/netbirdio/netbird/pull/4508
- [misc] Update SIGN_PIPE_VER to version 0.0.23 by @mlsmaycon in https://github.com/netbirdio/netbird/pull/4521
- [client] Check the client status in the earlier phase by @pappz in https://github.com/netbirdio/netbird/pull/4509
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.57.1...v0.58.0

What's Changed
- [relay] Refactor healthcheck sender and receiver to use configurable options by @pappz in https://github.com/netbirdio/netbird/pull/4433
- [client] Fix ICE latency handling by @pappz in https://github.com/netbirdio/netbird/pull/4501
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.57.0...v0.57.1

What's Changed
- [client] Implement environment variable handling for Android by @pappz in https://github.com/netbirdio/netbird/pull/4440
- [client] Fix/v4 stun routing by @pappz in https://github.com/netbirdio/netbird/pull/4430
- [client] Fix client status check by @pappz in https://github.com/netbirdio/netbird/pull/4474
- [misc] Remove default zitadel admin user in deployment script by @bcmmbaga in https://github.com/netbirdio/netbird/pull/4482
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.56.1...v0.57.0

This release brings an improvement for Windows clients' startup with caching of metadata information that in some systems could take up to 10s to retrieve.
What's Changed
- [management] Add peers manager to integrations by @bcmmbaga in https://github.com/netbirdio/netbird/pull/4405
- [internal] Add missing assignment of iFaceDiscover when netstack is disabled by @doromaraujo in https://github.com/netbirdio/netbird/pull/4444
- [client] Do not block Offer processing from relay worker by @pappz in https://github.com/netbirdio/netbird/pull/4435
- [management] only allow user devices to be expired by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4445
- [client] Move some sys info to a static place by @pappz in https://github.com/netbirdio/netbird/pull/4446
- [management] Extends integration and peers manager by @bcmmbaga in https://github.com/netbirdio/netbird/pull/4450
- [client] Debug information for connection by @pappz in https://github.com/netbirdio/netbird/pull/4439
- [misc] Remove aur support and start service on ostree by @mlsmaycon in https://github.com/netbirdio/netbird/pull/4461
New Contributors
- @doromaraujo made their first contribution in https://github.com/netbirdio/netbird/pull/4444
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.56.0...v0.56.1

What's New
In this release, we are adding support for user approval. This allows administrators to control whether users can join their account and automatically be allowed to connect their peers to their networks. Learn more at https://docs.netbird.io/how-to/approve-users
Client Enhancements
- Added netstack support for Android CLI. #4319
- Added MTU configuration flag. #4213
- Fixed Darwin DNS errors always being thrown. #4403
- Fixed shared socket buffer allocation. #4409
- Prevented upstream resolvers from deactivating on failure. #4128
- Updated to the latest Pion ICE version. #4388
Management Improvements
- Optimized proxy network map performance. #4324
- Removed redundant store locks for better concurrency. #4385, #4390
- Changed network serial increment to occur at the end of transactions. #4397
- Reported sync and login durations by account ID. #4406
- Split high latency gRPC metrics for more detailed monitoring. #4408
- Continued user updates even after failures (removed locks). #4410
- Fixed ephemeral flag handling in peer batch response. #4420
- Added login filter to prevent multiple peers from connecting with the same public key. #3986
- Removed withContext from store methods. #4422
- Fixed duplicate group removals on peer deletion. #4421
- Added user approval feature for accounts. #4411
Signal & Relay
- Fixed goroutine and memory leaks when forwarding messages between peers. #3896
- Relay now accepts any origin. #4426
Other Changes
- Bumped golang-jwt/jwt from 3.2.2 to 5.3.0. #4375
- Fixed Windows client and management benchmark tests. #4424
New Contributors
- @plusls made their first contribution in #4319
Full Changelog: v0.55.1...v0.56.0

What's Changed
- [management] Remove all store locks from grpc side by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4374
- [client] Avoid duplicated agent close by @pappz in https://github.com/netbirdio/netbird/pull/4383
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.55.0...v0.55.1

What's Changed
- Improve wording in the NetBird client app by @braginini in https://github.com/netbirdio/netbird/pull/4316
- [server] Add MySQL initialization script and update Docker configuration by @pappz in https://github.com/netbirdio/netbird/pull/4345
- [management] Use DI containers for server bootstrapping by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4343
- [management] fail on geo location init failure by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4362
- [client] Fix rule order for deny rules in peer ACLs by @lixmal in https://github.com/netbirdio/netbird/pull/4147
- [management] Remove save account calls by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4349
- [client] Fix/ice handshake by @pappz in https://github.com/netbirdio/netbird/pull/4281
- Bump github.com/containerd/containerd from 1.7.16 to 1.7.27 by @dependabot[bot] in https://github.com/netbirdio/netbird/pull/3527
- [management] add nil handling for route domains by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4366
- [management] Add CreatedAt field to Peer and model by @hakansa in https://github.com/netbirdio/netbird/pull/4371
- Bump golang.org/x/oauth2 from 0.24.0 to 0.27.0 by @dependabot[bot] in https://github.com/netbirdio/netbird/pull/4176
- [management,client] Feat/exit node auto apply by @hakansa in https://github.com/netbirdio/netbird/pull/4272
- feat(doc): Fix confusing comment by @Sonlis in https://github.com/netbirdio/netbird/pull/4376
- refactor doc workflow by @hakansa in https://github.com/netbirdio/netbird/pull/4373
New Contributors
- @Sonlis made their first contribution in https://github.com/netbirdio/netbird/pull/4376
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.54.2...v0.55.0

What's Changed
- [management] Enable flow groups by @bcmmbaga in https://github.com/netbirdio/netbird/pull/4230
- [server] Add health check HTTP endpoint for Relay server by @pappz in https://github.com/netbirdio/netbird/pull/4297
- [client] Fix Go tarball version in FreeBSD build configuration by @pappz in https://github.com/netbirdio/netbird/pull/4339
- [client] Add --disable-update-settings flag to the service by @hakansa in https://github.com/netbirdio/netbird/pull/4335
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.54.1...v0.54.2

Release Notes for v0.54.0
What's New
Client Enhancements
- Added Windows ARM64 build support. #4206
- Renamed logout command to deregister for clarity. #4307
- Increased deregister timeout for more reliable deregistration. #4311
- Fixed SSH command handling for non-default profiles. #4298
- Fixed profile manager panic when reading incomplete configurations. #4309
- Updated Windows installer description. #4306
Management Improvements
- Reworked database locking for improved concurrency handling. #4291
- Marked SaveAccount method as deprecated. #4300
- Improved JSON migration by filtering duplicates on conflict. #4303
Other Changes
- Standardized naming: Changed "Netbird" to "NetBird" in CMD usage. #4296
- Added documentation acknowledgement check. #4310
- Automated forum post creation after releases. #4312
Full Changelog: v0.53.0...v0.54.0

What's New
Control plane licensing changes
- Changed the license of management, relay, and signal components to AGPLv3. #4285
Learn more at https://netbird.io/knowledge-hub/netbird-agpl-announcement
Client Enhancements
- Improved userspace filter logging performance. #4221
- Added logout feature for improved session management. #4268
- Increased IP rule priorities to avoid routing conflicts. #4273
- Added config flag to override default profile path in the client service. #4276
- Included full sync response in the debug bundle for troubleshooting. #4287
Management Improvements
- Migrated group peers into a separate table for better performance and structure. #4096
- Implemented network range change API. #4177
- Optimized peer group retrieval by removing unnecessary locks. #4280
- Implemented peer expiration for invalid peers. #4275
Other Changes
- Moved shared components to a centralized shared directory. #4286
- Separated shared code dependencies for better modularity. #4288
Full Changelog: v0.52.2...v0.53.0

What's Changed
- [misc] Dockerfile: pin gopls to v0.18.1 (latest that supports golang 1.23) by @Bilgeworth in https://github.com/netbirdio/netbird/pull/4240
- [management] add account deleted event by @crn4 in https://github.com/netbirdio/netbird/pull/4255
- [client] Fix dns ipv6 upstream by @lixmal in https://github.com/netbirdio/netbird/pull/4257
New Contributors
- @Bilgeworth made their first contribution in https://github.com/netbirdio/netbird/pull/4240
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.52.1...v0.52.2

What's Changed
- [client] Disable the dns host manager properly if disabled through management by @lixmal in https://github.com/netbirdio/netbird/pull/4241
- [client] Fix error handling for set config request on CLI by @hakansa in https://github.com/netbirdio/netbird/pull/4237
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.52.0...v0.52.1

This release adds the profile feature, please refer to the documentation
What's Changed
- [misc] Docker compose improvements by @Silex in https://github.com/netbirdio/netbird/pull/4037
- [client] Fix race issues in lazy tests by @pappz in https://github.com/netbirdio/netbird/pull/4181
- [client] Temporarily disable race detection in Relay by @pappz in https://github.com/netbirdio/netbird/pull/4210
- [client] Fix legacy routing exclusion routes in kernel mode by @lixmal in https://github.com/netbirdio/netbird/pull/4167
- [client] Add env and status flags for netbird service command by @lixmal in https://github.com/netbirdio/netbird/pull/3975
- [management] extra settings integrated validator by @pnmcosta in https://github.com/netbirdio/netbird/pull/4136
- [management] scheduler cancel all jobs by @pnmcosta in https://github.com/netbirdio/netbird/pull/4158
- [management] Log UpdateAccountPeers caller by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4216
- [client] Remove custom method from generated proto and use inline logic for connection type filtering by @aliamerj in https://github.com/netbirdio/netbird/pull/4214
- [management] Log BufferUpdateAccountPeers caller by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4217
- [client] handle order of check when checking order of files in isChecksEqual by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4219
- [client] make ICE failed timeout configurable by @gamerslouis in https://github.com/netbirdio/netbird/pull/4211
- [client] client: container: support CLI with entrypoint addition by @nazarewk in https://github.com/netbirdio/netbird/pull/4126
- [client] Always register NetBird with plain Linux DNS and use original servers as upstream by @lixmal in https://github.com/netbirdio/netbird/pull/3967
- [client] Fix UDP proxy to notify listener when remote conn closed by @pappz in https://github.com/netbirdio/netbird/pull/4199
- [client] Remove and deprecate the admin url functionality by @lixmal in https://github.com/netbirdio/netbird/pull/4218
- [client] Add detailed routes and resolved IPs to debug bundle by @lixmal in https://github.com/netbirdio/netbird/pull/4141
- [client] Feat/multiple profile by @hakansa in https://github.com/netbirdio/netbird/pull/3980
- [client] remove config flag by @hakansa in https://github.com/netbirdio/netbird/pull/4224
- [client] Fix pre-shared key state in wg show by @pappz in https://github.com/netbirdio/netbird/pull/4222
- [client] Fix config directory path handling based on NB_STATE_DIR by @hakansa in https://github.com/netbirdio/netbird/pull/4229
- [client] Add support for disabling profiles feature via command line flag by @hakansa in https://github.com/netbirdio/netbird/pull/4235
New Contributors
- @gamerslouis made their first contribution in https://github.com/netbirdio/netbird/pull/4211
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.51.2...v0.52.0

What's Changed
- [client] fix test by @pnmcosta in https://github.com/netbirdio/netbird/pull/4156
- [misc] add forum post and update sign pipeline by @mlsmaycon in https://github.com/netbirdio/netbird/pull/4155
- [management] fix index creation if exist on mysql by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4150
- [management] Add validate flow response by @mlsmaycon in https://github.com/netbirdio/netbird/pull/4172
- [client, relay] The openConn function no longer blocks the relayAddress function call by @pappz in https://github.com/netbirdio/netbird/pull/4180
- [client] Add --filter-by-connection-type flag to status command by @aliamerj in https://github.com/netbirdio/netbird/pull/4010
- [client] Fix bind exclusion routes by @lixmal in https://github.com/netbirdio/netbird/pull/4154
- [management] Fix group resource count mismatch in policy by @bcmmbaga in https://github.com/netbirdio/netbird/pull/4182
- [server, relay] Fix/relay race disconnection by @pappz in https://github.com/netbirdio/netbird/pull/4174
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.51.1...v0.51.2

What's Changed
- [client] Fix/nil relayed address by @pappz in https://github.com/netbirdio/netbird/pull/4153
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.51.0...v0.51.1

What's Changed
- [client] avoid parsing NB_NETSTACK_SKIP_PROXY if empty by @iisteev in https://github.com/netbirdio/netbird/pull/4145
- [client, relay-server] Feature/relay notification by @pappz in https://github.com/netbirdio/netbird/pull/4083
New Contributors
- @iisteev made their first contribution in https://github.com/netbirdio/netbird/pull/4145
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.50.3...v0.51.0

What's Changed
- always suffix ephemeral peer name by @pnmcosta in https://github.com/netbirdio/netbird/pull/4138
- [management] sync calls to UpdateAccountPeers from BufferUpdateAccountPeers by @crn4 in https://github.com/netbirdio/netbird/pull/4137
- [client] Fix elapsed time calculation when machine is in sleep mode by @pappz in https://github.com/netbirdio/netbird/pull/4140
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.50.2...v0.50.3

What's Changed
- [management] Add name/ip filters to peer management rest client by @mohamed-essam in https://github.com/netbirdio/netbird/pull/4112
- [management] Remove deleted user peers from groups on user deletion by @bcmmbaga in https://github.com/netbirdio/netbird/pull/4121
- Update image in README.md by @braginini in https://github.com/netbirdio/netbird/pull/4122
- [client] Disable pidfd check on Android 11 and below by @pappz in https://github.com/netbirdio/netbird/pull/4127
- [client] Nil check in iface configurer by @pappz in https://github.com/netbirdio/netbird/pull/4132
- [client] Update cli description of lazy connection by @pappz in https://github.com/netbirdio/netbird/pull/4133
- [management] added cleanupWindow for collecting several ephemeral peers to delete by @crn4 in https://github.com/netbirdio/netbird/pull/4130
- [client] Add rotated logs flag for debug bundle generation by @lixmal in https://github.com/netbirdio/netbird/pull/4100
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.50.1...v0.50.2

What's Changed
- [client] Fix nil pointer exception in lazy connection by @pappz in https://github.com/netbirdio/netbird/pull/4109
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.50.0...v0.50.1

What's New
Client Enhancements
- Supported random WireGuard ports to enhance NAT traversal. #4085
- Implemented DNS routes for Android. #3989
- Enabled fullstatus output even without probes. #4052
- Improved route log messages. #4034
- Used unique sequence numbers for BSD routes. #4081
- Improved lazy connection detection logic. #4050
- Avoided logging setup keys in error messages. #3962
- Login popup now runs in a separate goroutine. #4080
Management Improvements
- Added network map metric breakdown and reported durations in ms. #4020, #4064
- Added onboarding logic for account creation. #4084
- Provided clear error messaging for mismatched logins. #4097
- Logged user ID on account mismatch. #4101
- Enabled uniqueness constraint for peer IPs and labels, improving generation performance. #4042
- Added option to disable default all-to-all policy. #3970
- Added backward-compatible error handling for setup key registration. #4094
- Fixed account peer store retrieval by adding locking. #4092
- Fixed network update test for delete policy. #4086
- Removed unused database transactions. #4053
Installer & Miscellaneous
- Fixed wrong default for NETBIRD_AUTH_PKCE_LOGIN_FLAG for self-hosting. #4055
- Fixed Arch Linux install.sh error with empty dependencies. #4070
- Now starts the service automatically after installation on Arch Linux. #4071
- Removed unnecessary port 8080 in getting-started-with-zitadel.sh. #4075
- Updated sign pipeline version. #4082
- Added a link to the community forum in documentation. #4093
New Contributors
- @aliamerj made their first contribution in #3970
Full Changelog: v0.49.0...v0.50.0

What's Changed
- [management] add transaction for integrated validator groups update and prim acc by @pascal-fischer in https://github.com/netbirdio/netbird/pull/4014
- [client] Handle lazy routing peers that are part of HA groups by @lixmal in https://github.com/netbirdio/netbird/pull/3943
- [client] Refactor showLoginURL to improve error handling and connection status checks by @hakansa in https://github.com/netbirdio/netbird/pull/4026
- [client] close window when process needs to exit by @mlsmaycon in https://github.com/netbirdio/netbird/pull/4027
- [misc] add additional metrics by @mlsmaycon in https://github.com/netbirdio/netbird/pull/4028
- [management] check and log on new management version by @mlsmaycon in https://github.com/netbirdio/netbird/pull/4029
- [misc] Specify netbird binary location in Dockerfiles by @lixmal in https://github.com/netbirdio/netbird/pull/4024
- [client] Don't open cmd.exe during MSI actions by @lixmal in https://github.com/netbirdio/netbird/pull/4041
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.48.0...v0.49.0

What's New
Client Enhancements
- Fixed Android route notification behavior. #3971
- Added more advanced settings for Android clients. #4001
- Fixed port range squashing to ensure correct firewall rule behavior. #4007
Management Improvements
- Refactored route handling to use store methods for consistency and maintainability. #2928
- Added backward compatibility for clients without firewall rules port range support. #4003
- Exported ephemeral peer flag via API for better visibility. #4004
Full Changelog: v0.47.2...v0.48.0

What's Changed
- [client] Fix UI Download URL by @hakansa in https://github.com/netbirdio/netbird/pull/3990
- [client] Prioritze the local resolver in the dns handler chain by @lixmal in https://github.com/netbirdio/netbird/pull/3965
- [client] Tighten allowed domains for dns forwarder by @lixmal in https://github.com/netbirdio/netbird/pull/3978
- [client] Fix DNS Interceptor Build Error by @hakansa in https://github.com/netbirdio/netbird/pull/3993
- [management] Avoid recalculating next peer expiration by @mlsmaycon in https://github.com/netbirdio/netbird/pull/3991
- [client] Fix logic in updateStatus to correctly handle connection state by @hakansa in https://github.com/netbirdio/netbird/pull/3994
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.47.1...v0.47.2

What's Changed
- [client] Fix status recorder panic by @lixmal in https://github.com/netbirdio/netbird/pull/3988
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.47.0...v0.47.1

What's New
Client Enhancements
- Added lazy connections support for routed networks. #3908
- Added advanced settings to the UI for better configurability. #3941
- Added missing client meta flags. #3898
- Improved Android client with preference handling and propagation networks. #3957, #3966
- Displayed login popup on session expiration. #3955
- Fixed local DNS resolver errors for domains with other record types. #3959
- Optimized process check timing. #3938
- Removed strings from allowed IPs. #3920
- Improved ICMP connection tracking logs. #3963
- Prevented unnecessary UI updates. #3785
- Included peer's actual state in notifications. #3929
- Refactored ConnMgr context management for clarity. #3951
- Included Support wildcard DNS on iOS #3979
Management Improvements
- Added port range support in firewall rules. #3823
- Enabled unidirectional rules for all-port policies. #3826
- Added account ID index to activity events. #3946
- Ensured peer flags persist in meta updates. #3958
- Propagated user groups when re-enabling group propagation. #3912
- Added event streaming metrics. #3814
- Used xID for setup keys to avoid collisions. #3977
Signal Service
- Enabled setting signal flags via environment variables. #3972
Other Changes
- All Docker images are now pushed to GHCR as additional registry during release. #3954
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.46.0...v0.47.0

What's New
Client Enhancements
- Added a "Deselect All" option to the Exit Node menu. #3877
- Introduced a block inbound flag to prevent all inbound connections. #3897
- Routes now apply immediately, not only on peer connection. #3907
- Used native route facilities on BSD and Windows. #3862
- Enabled userspace local forwarding to internal interfaces upon request. #3884
- Added debug output similar to wg show. #3922
- Improved DNS match tracing logs. #3928
- Ran registerdns before flushing for consistency. #3926
- Included systemd logs in the debug bundle. #3917
- Increased STUN probe timeout for better status detection. #3930
- Allowed the NetBird service to log to console. #3916
- Logged duplicate client UI PIDs. #3915
- Applied return traffic rules conditionally if firewall is stateless. #3895
- Refactored peer state change subscription mechanism. #3910
Management Improvements
- Supported account creation and retrieval using private domains. #3825
- Enabled REST client impersonation for improved session management. #3879
- Added PostgreSQL support for activity events store. #3890
Other Changes
- Fixed Zitadel user console access. #3446
- Addressed traefik relay accessibility. #3696
- Removed DNF config-manager error. #3925
- Fixed relay exposed address test. #3931
- Updated linter workflows to fail on codespell errors. #3913
New Contributors
- @ghazyami made their first contribution in #3696
- @orchard0 made their first contribution in #3925
Full Changelog: v0.45.3...v0.46.0

What's Changed
- [client] Fix HA router switch by @pappz in https://github.com/netbirdio/netbird/pull/3889
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.45.2...v0.45.3

What's Changed
- [misc] Add CLA note by @mlsmaycon in https://github.com/netbirdio/netbird/pull/3859
- [misc] Fix CLA link in the PR template by @braginini in https://github.com/netbirdio/netbird/pull/3860
- [management] lazy connection account setting by @pnmcosta in https://github.com/netbirdio/netbird/pull/3855
- [management] Update traffic events pagination filters by @bcmmbaga in https://github.com/netbirdio/netbird/pull/3857
- [management] Extend nameserver match domain validation by @bcmmbaga in https://github.com/netbirdio/netbird/pull/3864
- [client] avoid overwriting state manager on iOS by @pascal-fischer in https://github.com/netbirdio/netbird/pull/3870
- [management] force account id on save groups update by @pnmcosta in https://github.com/netbirdio/netbird/pull/3850
- [management/client/rest] Fix panic on unknown errors by @mohamed-essam in https://github.com/netbirdio/netbird/pull/3865
- [management] Add correlated network traffic event schema by @bcmmbaga in https://github.com/netbirdio/netbird/pull/3680
- [client, android] Fix/android enable server route by @pappz in https://github.com/netbirdio/netbird/pull/3806
- [management] Reset test containers after cleanup by @bcmmbaga in https://github.com/netbirdio/netbird/pull/3885
- [server-test] Install libs for i386 tests by @pappz in https://github.com/netbirdio/netbird/pull/3887
- [client, android] Fix/notifier threading by @pappz in https://github.com/netbirdio/netbird/pull/3807
- [management] Prevent deletion of peers linked to network routers by @bcmmbaga in https://github.com/netbirdio/netbird/pull/3881
- [client] Refactor exclude list handling to use a map for permanent connections by @hakansa in https://github.com/netbirdio/netbird/pull/3901
- [management] Fix user groups propagation by @bcmmbaga in https://github.com/netbirdio/netbird/pull/3902
- [client] Fix peer close deadlock by @pappz in https://github.com/netbirdio/netbird/pull/3904
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.45.1...v0.45.2

This release fixes an issue with traffic flow that caused endless reconnections for some peers.
What's Changed
- [client] Add latest gzipped rotated log file to the debug bundle by @hakansa in https://github.com/netbirdio/netbird/pull/3848
- [client] Do not reconnect to mgm server in case of handler error by @pappz in https://github.com/netbirdio/netbird/pull/3856
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.45.0...v0.45.1

What's New
Client Enhancements
- Introduced lazy connection support to optimize client startup and resource usage. You can learn more about the feature here. #3379
- Fixed UI notification for new client versions. #3845
- Resolved an issue with legacy route compatibility when connecting to older management servers (pre-v0.30.0). #3854
Management Enhancements
- Added a flag to disable auto-migration, offering more control during deployments. #3840
- Locking strength clause is now optional, improving compatibility and flexibility. #3844
- Migrated the events SQLite store to GORM for more consistent database handling. #3837
Other Changes
- Updated the issue template to streamline community feedback. #3842
Full Changelog: v0.44.0...v0.45.0

What's Changed
- [signal] adjust log levels by @pascal-fischer in https://github.com/netbirdio/netbird/pull/3813
- [signal] adjust signal log levels 2 by @pascal-fischer in https://github.com/netbirdio/netbird/pull/3817
- [client, android] Do not propagate empty routes by @pappz in https://github.com/netbirdio/netbird/pull/3805
- [management] Add connection type filter to Network Traffic API by @bcmmbaga in https://github.com/netbirdio/netbird/pull/3815
- [management,client] PKCE add query parameter flag prompt=login or max… by @crn4 in https://github.com/netbirdio/netbird/pull/3824
- [management] fix bug missed extra dns labels for a new peer by @crn4 in https://github.com/netbirdio/netbird/pull/3798
- [client] Add FreeBSD desktop client support to OAuth flow by @hakansa in https://github.com/netbirdio/netbird/pull/3822
- [signal] remove stream receive server side by @pascal-fischer in https://github.com/netbirdio/netbird/pull/3820
- [management] extend rest client lib by @pascal-fischer in https://github.com/netbirdio/netbird/pull/3830
- [client] Disable dnssec for systemd explicitly by @lixmal in https://github.com/netbirdio/netbird/pull/3831
- [management] Make startup period configurable by @pascal-fischer in https://github.com/netbirdio/netbird/pull/3767
- [client] Offer to remove netbird data in windows uninstall by @lixmal in https://github.com/netbirdio/netbird/pull/3766
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.43.3...v0.44.0

What's Changed
- [management] Delete service users with account manager by @bcmmbaga in https://github.com/netbirdio/netbird/pull/3793
- [management] policy delete cleans policy rules by @pascal-fischer in https://github.com/netbirdio/netbird/pull/3788
- [client] Return with the correct copied length by @pappz in https://github.com/netbirdio/netbird/pull/3804
- [client] Ignore irrelevant route changes to tracked network monitor routes by @lixmal in https://github.com/netbirdio/netbird/pull/3796
- [client] Add TCP support to DNS service listener by @hakansa in https://github.com/netbirdio/netbird/pull/3790
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.43.2...v0.43.3

What's Changed
- [management] limit peers based on module read permission by @pnmcosta in https://github.com/netbirdio/netbird/pull/3757
- [client] Add debug upload option to netbird ui by @lixmal in https://github.com/netbirdio/netbird/pull/3768
- [management] user info with role permissions by @pnmcosta in https://github.com/netbirdio/netbird/pull/3728
- [client] Add debug for duration option to netbird ui by @lixmal in https://github.com/netbirdio/netbird/pull/3772
- [management] Get account id with order by @mlsmaycon in https://github.com/netbirdio/netbird/pull/3773
- [management] Optimize load account by @mlsmaycon in https://github.com/netbirdio/netbird/pull/3774
- [management] add gorm tag for primary key for the networks objects by @pascal-fischer in https://github.com/netbirdio/netbird/pull/3758
- [client] set TLS ServerName for hostname-based QUIC connections by @alindt in https://github.com/netbirdio/netbird/pull/3673
- [client] Fix stale local records by @lixmal in https://github.com/netbirdio/netbird/pull/3776
- [client] Improve NetBird installation script to handle daemon connection timeout by @hakansa in https://github.com/netbirdio/netbird/pull/3761
- [management] removal of foreign key constraint enforcement on sqlite by @pascal-fischer in https://github.com/netbirdio/netbird/pull/3786
- [management/client/rest] fix panic when body is nil by @mohamed-essam in https://github.com/netbirdio/netbird/pull/3714
New Contributors
- @alindt made their first contribution in https://github.com/netbirdio/netbird/pull/3673
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.43.1...v0.43.2

What's Changed
- [client] add byte counters & ruleID for routed traffic on userspace by @hakansa in https://github.com/netbirdio/netbird/pull/3653
- [management] add missing network admin mapping by @pnmcosta in https://github.com/netbirdio/netbird/pull/3751
- [misc] Exclude client benchmarks from CI by @lixmal in https://github.com/netbirdio/netbird/pull/3752
- [management] Skip IdP cache warm-up on Redis if data exists by @bcmmbaga in https://github.com/netbirdio/netbird/pull/3733
- [client] Feature/upload bundle by @mlsmaycon in https://github.com/netbirdio/netbird/pull/3734
- [misc] Add macOS .pkg installer support to installation script by @hakansa in https://github.com/netbirdio/netbird/pull/3755
- [management] Add network traffic events pagination by @bcmmbaga in https://github.com/netbirdio/netbird/pull/3580
- [client] Revert mgm client error handling by @pappz in https://github.com/netbirdio/netbird/pull/3764
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.43.0...v0.43.1

What's New
Client Improvements
- Fixed exit node deselection behavior. #3722
- Dynamic firewall rules now set up for DNS routes based on DNS responses. #3702
- Userspace ACL received additional filter test cases to improve robustness. #3730
- GRPC error handling improved to catch flow errors better. #3727
- Ensured destination-type local marks can overwrite NAT marks. #3738
- Fixed macOS privacy warnings when accessing static system information. #3496
These updates enhance reliability and system compatibility across platforms.
Management Improvements
- Introduced a new Auditor Role for account access. (API only, dashboard support is coming soon) #3721
- Introduced a Network Admin Role for network-specific administration. (API only, dashboard support is coming soon) #3720
- Impersonation via PATs (Personal Access Tokens) is now supported for streamlined troubleshooting. #3739
Other Changes
- Improved static checks when running in foreground mode. #3742
- Ran container tests in a more generic way for broader coverage. #3737
Full Changelog: v0.42.0...v0.43.0

What's New
Enhanced Route Management and UI States
- Clients now retain selected routes unless all are explicitly deselected. #3692
- Added a connecting state to the client UI for improved status feedback. #3712
- Firewall routes now include a route ID and support for missing route domains. #3700
Account and Domain Enhancements
- Management now supports custom domains per account via API (Dashboard coming soon). #3726
- Added account metadata capabilities to improve account-level visibility. #3724
Improvements
- Permissions Manager: Now uses standard CRUD operations. #3690
- Dashboard Fix: Corrected handling of lastLogin display on the management dashboard. #3725
- Benchmarking:
- Pushed benchmark results to Grafana. #3701
- Benchmarks now use ref_name. #3704
- Fixed GitHub run ID issue. #3705
Dependency Updates
- Bumped golang.org/x/net from 0.36.0 to 0.38.0. #3695
- Bumped github.com/redis/go-redis/v9 from 9.7.1 to 9.7.3. #3553
Documentation
- Fixed a broken link in the README. #3697
Other Changes
- Changed GitHub runner used for Docker tests. #3707
New Contributors
- @saule1508 made their first contribution in #3697
Full Changelog: v0.41.3...v0.41.4

What's Changed
- [client] Set up signal to generate debug bundles by @lixmal in https://github.com/netbirdio/netbird/pull/3683
- [client] Keep selecting new networks after first deselection by @lixmal in https://github.com/netbirdio/netbird/pull/3671
- [misc] update gpt file permissions in install.sh by @Lamera in https://github.com/netbirdio/netbird/pull/3663
- [client] Fix Rosenpass permissive mode handling by @pappz in https://github.com/netbirdio/netbird/pull/3689
New Contributors
- @Lamera made their first contribution in https://github.com/netbirdio/netbird/pull/3663
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.41.2...v0.41.3

This version addresses a potential memory leak caused by our P2P negotiation library.
What's Changed
- [client] Remove logrus writer assignment in pion logging by @hakansa in https://github.com/netbirdio/netbird/pull/3684
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.41.1...v0.41.2

What's Changed
- [management] add permissions manager to geolocation handler by @pnmcosta in https://github.com/netbirdio/netbird/pull/3665
- [client] Refactor DNSForwarder to improve handle wildcard domain resource id matching by @hakansa in https://github.com/netbirdio/netbird/pull/3651
- [client] Add heap profile to debug bundle by @lixmal in https://github.com/netbirdio/netbird/pull/3679
- [client] Add remaining debug profiles by @lixmal in https://github.com/netbirdio/netbird/pull/3681
- [management] get current user endpoint by @pnmcosta in https://github.com/netbirdio/netbird/pull/3666
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.41.0...v0.41.1

What's Changed
- [ci] include stash in pr template by @pnmcosta in https://github.com/netbirdio/netbird/pull/3657
- [docs] Fix a few typos on table by @mlsmaycon in https://github.com/netbirdio/netbird/pull/3658
- [management,client] Add support to configurable prompt login by @mlsmaycon in https://github.com/netbirdio/netbird/pull/3660
- [management] remove unnecessary access control middleware by @pnmcosta in https://github.com/netbirdio/netbird/pull/3650
- [management] Buffer updateAccountPeers calls by @pascal-fischer in https://github.com/netbirdio/netbird/pull/3644
- [management] Refactor/management/updchannel by @crn4 in https://github.com/netbirdio/netbird/pull/3645
New Contributors
- @crn4 made their first contribution in https://github.com/netbirdio/netbird/pull/3645
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.40.1...v0.41.0

What's Changed
- [client] Support IP fragmentation in userspace by @lixmal in https://github.com/netbirdio/netbird/pull/3639
- [client] Handle truncated upstream DNS responses by @lixmal in https://github.com/netbirdio/netbird/pull/3632
- [misc] add git town workflow config by @pnmcosta in https://github.com/netbirdio/netbird/pull/3555
- [client] Support CNAME in local resolver by @lixmal in https://github.com/netbirdio/netbird/pull/3646
- [management] use permission modules by @pascal-fischer in https://github.com/netbirdio/netbird/pull/3622
- [client] Fix dns cleanup race condition by @lixmal in https://github.com/netbirdio/netbird/pull/3652
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.40.0...v0.40.1

What's New
Behavior change
- CLI Auth Behavior: Forced login for new users using PKCE flow in CLI. #3604
With this change, all users will be required to log in once their client session has expired, even when they have a Dashboard session active.
Improved Routing and DNS Behavior
Several enhancements were made to routing logic and DNS behavior, including:
- Automatically registering match domains for DNS routes. #3614
- Enhancing the DNS forwarder to track resolved IPs with resource IDs. #3620
- Fixing DNS forwarder handling of requested record types. #3615
Traffic Visibility and Interface Marking
- NetBird data plane traffic is now marked for improved interface traffic identification. #3623
These changes improve observability and routing accuracy for DNS and network flows.
Improvements
- Route Removal Logic: Updated route removal to correctly handle dynamic routes. #3625
- Linux Userspace Mode: Fixed missing inbound flows in userspace mode with native router. #3624
- TCP Connection Tracking: Improved TCP connection tracking. #3572
- Backend Router: Removed remaining Linux router limitations. #3589
- No-Browser Login: Added --no-browser flag for CLI login and up commands for better SSO control. #3610
- IP Lookup: Improved local IP lookup logic. #3551
- Logging: NetBird logger now handles ICE and gRPC logs. #3603
Bug Fixes
- Access Validation: Permission manager now validates account access correctly. #3444
Other Changes
- FreeBSD CI: Updated FreeBSD workflow for better test coverage. #3638
Full Changelog: v0.39.2...v0.40.0

What's Changed
- [management] Sync account peers on network router group changes by @bcmmbaga in https://github.com/netbirdio/netbird/pull/3573
- [client] fix route handling for local peer state by @hakansa in https://github.com/netbirdio/netbird/pull/3586
- [management] fix extend call and move config to types by @mlsmaycon in https://github.com/netbirdio/netbird/pull/3575
- [client] Ensure status recorder is always initialized by @lixmal in https://github.com/netbirdio/netbird/pull/3588
- [management] Fix extended config when nil by @mlsmaycon in https://github.com/netbirdio/netbird/pull/3593
- [client] Disable systemd-resolved default route explicitly on match domains only by @lixmal in https://github.com/netbirdio/netbird/pull/3584
- [client] Stop flow grpc receiver properly by @lixmal in https://github.com/netbirdio/netbird/pull/3596
- [client] Prevent calling the onDisconnected callback in incorrect state by @pappz in https://github.com/netbirdio/netbird/pull/3582
- [client] Fix close WireGuard watcher by @pappz in https://github.com/netbirdio/netbird/pull/3598
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.39.1...v0.39.2

What's Changed
- [management] Fix invalid port range sync by @mlsmaycon in https://github.com/netbirdio/netbird/pull/3571
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.39.0...v0.39.1

What's New
This release includes support for traffic events captured between peers and resources and other peers in the network. We are also adding support to the Redis cache for IDP data. This allows a more persistent cache across management restarts.
Traffic events support (Cloud-only)
We’ve made significant progress on network traffic observability by adding Traffic events support and enhancing event metadata. The updates include:

- Traffic events support on client. #3414
These changes help you gain deeper visibility into traffic flows within your network.
Learn more at https://docs.netbird.io/how-to/traffic-events-logging.
Improvements to Flow Stability and Debugging
- Improved handling of embedded listeners and shutdowns in flow GRPC. #3557, #3564
- Added profiling dumps to the debug package to assist with deeper diagnostics. #3517
REST Client Improvements
- Bearer token support has been added to the management REST client for more secure integrations. #3534
Improvements
- DNS Policies: Fixed DNS NRPT policies handling. #3459
- Flow Acknowledgement: Added initiator field to flow acknowledgments. #3563
- Redis IDP Cache: Management now logs Redis cache usage. You can export the variable NB_IDP_CACHE_REDIS_ADDRESS=redis://<IP>:<PORT> to the management server to use the new store. #3562
- Version Fixes: Connection issues resolved for -dev, -alpha, and similar versions. #3511
- Docker Compose Cleanup: Removed duplicate labels in the relay service. #3502
Bug Fixes
- Fixed issue with the Advanced Settings UI on Windows 11 when using a Chinese locale. #3483
- Resolved an issue with always enabling NetworkResource in createResource(). #3532
Documentation
- Updated examples in the events section and added tag to the ingress port docs. #3552
- Updated CONTRIBUTOR_LICENSE_AGREEMENT.md. #3535
Other Changes
- Removed "Admin Panel" item from the UI client. #3560
New Contributors
- @levindecaro made their first contribution in #3483
- @ValarMarkhulis made their first contribution in #3532
- @webalexeu made their first contribution in #3459
- @TheDoDoo made their first contribution in #3511
- @galiev made their first contribution in #3502
Full Changelog: v0.38.2...v0.39.0

What's Changed
- [client] Fix state dump panic by @lixmal in https://github.com/netbirdio/netbird/pull/3519
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.38.1...v0.38.2

What's Changed
- [misc] Update link to kubernetes operator by @braginini in https://github.com/netbirdio/netbird/pull/3489
- [client] Nil check on route manager by @pappz in https://github.com/netbirdio/netbird/pull/3486
- [client] Fix anonymized addresses documentation by @lixmal in https://github.com/netbirdio/netbird/pull/3505
- [client] Set info logs and add dump state by @pappz in https://github.com/netbirdio/netbird/pull/3504
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.38.0...v0.38.1

Release notes
This release fixes a few bugs with client startup where the client could get blocked in case of settings changes in the GUI and improves the Network monitor lifecycle trigger to avoid race conditions. It also adds an initial client support for a new feature called Ingress ports that should allow users to enable port forwarding in the future and port-range access control policies.
New features
- [client, management] Add Ingress ports initial support #3275
Enhancements
- [client] Enable windows stderr logs by default #3476
- [docs] Fix typo #3477
- [client] Prevent panic in case of double close call #3475
- [client] Prevent to block channel writing #3474
- [client] Add option to autostart netbird ui in the Windows installer #3469
- [client] Fix engine restart race condition #3435
- [client] Ignore candidates that are part of the the wireguard subnet #3472
- [client] Increase local daemon connection timeout to 50 sec #3481
- [management] return empty array instead of null on networks endpoints #3480
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.35.2...v0.36.0

What's Changed
- [client] fix extra DNS labels parameter to Register method in client by @hakansa in https://github.com/netbirdio/netbird/pull/3371
- [tests] Retry mysql store creation on reused containers by @pascal-fischer in https://github.com/netbirdio/netbird/pull/3370
- [client] Replace string to netip.Prefix by @pappz in https://github.com/netbirdio/netbird/pull/3362
- [misc] Replace webinar link by @braginini in https://github.com/netbirdio/netbird/pull/3380
- [management] Handle transaction error on peer deletion by @bcmmbaga in https://github.com/netbirdio/netbird/pull/3387
- [misc] Fix typo by @Silex in https://github.com/netbirdio/netbird/pull/3415
- [client] Add Netbird GitHub link to the client ui about sub menu by @robertgro in https://github.com/netbirdio/netbird/pull/3372
- [client] Close userspace firewall properly by @lixmal in https://github.com/netbirdio/netbird/pull/3426
- [client] UI Refactor Icon Paths by @hakansa in https://github.com/netbirdio/netbird/pull/3420
- [client] Handle large DNS packets in dns route resolution by @lixmal in https://github.com/netbirdio/netbird/pull/3441
- Update bug-issue-report.md template by @lixmal in https://github.com/netbirdio/netbird/pull/3449
- [client] Fix TURN-Relay switch by @pappz in https://github.com/netbirdio/netbird/pull/3456
- [client] Print out the goroutine id by @pappz in https://github.com/netbirdio/netbird/pull/3433
- [misc] Traefik config improvements by @Silex in https://github.com/netbirdio/netbird/pull/3346
- [misc] Grafana dashboards by @muzammil360 in https://github.com/netbirdio/netbird/pull/3458
New Contributors
- @Silex made their first contribution in https://github.com/netbirdio/netbird/pull/3415
- @robertgro made their first contribution in https://github.com/netbirdio/netbird/pull/3372
- @muzammil360 made their first contribution in https://github.com/netbirdio/netbird/pull/3458
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.37.1...v0.37.2

What's Changed
- [client] Restart netbird-ui post-install in linux deb&rpm by @mohamed-essam in https://github.com/netbirdio/netbird/pull/2992
- [client] Update local interface addresses when gathering candidates by @lixmal in https://github.com/netbirdio/netbird/pull/3324
- [management] faster server bootstrap by @pnmcosta in https://github.com/netbirdio/netbird/pull/3365
- [client] fix privacy warning on macOS by @hurricanehrndz in https://github.com/netbirdio/netbird/pull/3350
- [client] Disable notifications by default by @lixmal in https://github.com/netbirdio/netbird/pull/3375
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.37.0...v0.37.1

What's Changed
- [client] Normalize DNS record names to lowercase in local handler update by @hakansa in https://github.com/netbirdio/netbird/pull/3323
- [signal] add pprof and message size metrics by @pascal-fischer in https://github.com/netbirdio/netbird/pull/3337
- [management] Refactor users to use store methods by @bcmmbaga in https://github.com/netbirdio/netbird/pull/2917
- [management] Add batching support for SaveUsers and SaveGroups by @bcmmbaga in https://github.com/netbirdio/netbird/pull/3341
- [client][ui] added accessible tray icons by @karsa-mistmere in https://github.com/netbirdio/netbird/pull/3335
- [misc] Run management benchmark jobs on file changes by @mlsmaycon in https://github.com/netbirdio/netbird/pull/3343
- [client] [ui] issue when changing setting in GUI while peer session is expired by @hakansa in https://github.com/netbirdio/netbird/pull/3334
- [signal] Fix registry not found by @pascal-fischer in https://github.com/netbirdio/netbird/pull/3342
- [management] remove gorm preparestmt from all DB connections by @pascal-fischer in https://github.com/netbirdio/netbird/pull/3292
- [client] Set up local dns policy additionally if a gpo policy is detected by @lixmal in https://github.com/netbirdio/netbird/pull/3336
- [management] optimize test execution by @pascal-fischer in https://github.com/netbirdio/netbird/pull/3204
- Use go build to embed less icons by @hurricanehrndz in https://github.com/netbirdio/netbird/pull/3351
- improvement(template): add traefik labels to relay by @cesargoncalves in https://github.com/netbirdio/netbird/pull/3333
- [client] Add UI client event notifications by @lixmal in https://github.com/netbirdio/netbird/pull/3207
- [client, management] Support DNS Labels for Peer Addressing by @hakansa in https://github.com/netbirdio/netbird/pull/3252
- [client] Add embeddable library by @lixmal in https://github.com/netbirdio/netbird/pull/3239
- [client] Skip CLI session expired notifcation if notifications are disabled by @lixmal in https://github.com/netbirdio/netbird/pull/3266
- [management] refactor auth by @pnmcosta in https://github.com/netbirdio/netbird/pull/3296
- Interface code cleaning by @pappz in https://github.com/netbirdio/netbird/pull/3358
- Update README.md by @braginini in https://github.com/netbirdio/netbird/pull/3360
- Update google.golang.org/api to latest by @paralin in https://github.com/netbirdio/netbird/pull/3288
- [Snyk] Security upgrade alpine from 3.21.0 to 3.21.3 by @mlsmaycon in https://github.com/netbirdio/netbird/pull/3359
- [client] Add reverse dns zone by @lixmal in https://github.com/netbirdio/netbird/pull/3217
- [management] fix grpc new account by @pnmcosta in https://github.com/netbirdio/netbird/pull/3361
- [client] Add netbird ui improvements by @lixmal in https://github.com/netbirdio/netbird/pull/3222
- [client] Fix udp forwarder deadline by @lixmal in https://github.com/netbirdio/netbird/pull/3364
- [misc] Rename client tests in CI by @lixmal in https://github.com/netbirdio/netbird/pull/3366
New Contributors
- @karsa-mistmere made their first contribution in https://github.com/netbirdio/netbird/pull/3335
- @cesargoncalves made their first contribution in https://github.com/netbirdio/netbird/pull/3333
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.36.7...v0.37.0

What's Changed
- [client] Fix priority handling by @pappz in https://github.com/netbirdio/netbird/pull/3313
- [client] Use GPO DNS Policy Config to configure DNS if present by @lixmal in https://github.com/netbirdio/netbird/pull/3319
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.36.6...v0.36.7

What's Changed
- Bump golang.org/x/net from 0.30.0 to 0.33.0 by @dependabot in https://github.com/netbirdio/netbird/pull/3218
- [client, server] Cleanup magiconair usage from repo by @pappz in https://github.com/netbirdio/netbird/pull/3276
- Management REST Client Code by @mohamed-essam in https://github.com/netbirdio/netbird/pull/3278
- [client] use embedded root CA if system certpool is empty by @hakansa in https://github.com/netbirdio/netbird/pull/3272
- [misc] Replace Wiretrustee with Netbird by @lixmal in https://github.com/netbirdio/netbird/pull/3267
- [client] Fix acl empty port range detection by @lixmal in https://github.com/netbirdio/netbird/pull/3285
- [relay] Use new upstream for nhooyr.io/websocket package by @paralin in https://github.com/netbirdio/netbird/pull/3287
- [client] Fix grouping of peer ACLs with different port ranges by @lixmal in https://github.com/netbirdio/netbird/pull/3289
- [client] Fix nil pointer exception when load empty list and try to cast it by @pappz in https://github.com/netbirdio/netbird/pull/3282
- [management] Check groups when counting peers on networks list by @pascal-fischer in https://github.com/netbirdio/netbird/pull/3284
- [management] add logs for grpc API by @pascal-fischer in https://github.com/netbirdio/netbird/pull/3298
- [client] Add experimental support for userspace routing by @lixmal in https://github.com/netbirdio/netbird/pull/3134
- [signal] Fix context propagation in signal server by @4thel00z in https://github.com/netbirdio/netbird/pull/3251
- [client, relay] Fix/wg watch by @pappz in https://github.com/netbirdio/netbird/pull/3261
- [client] Support dns upstream failover for nameserver groups with same match domain by @lixmal in https://github.com/netbirdio/netbird/pull/3178
- [client] Fix dns handler chain test by @lixmal in https://github.com/netbirdio/netbird/pull/3307
- [client] Check for fwmark support and use fallback routing if not supported by @lixmal in https://github.com/netbirdio/netbird/pull/3220
- [client] Enable userspace forwarder conditionally by @lixmal in https://github.com/netbirdio/netbird/pull/3309
- fix integration tests by @pnmcosta in https://github.com/netbirdio/netbird/pull/3311
New Contributors
- @hakansa made their first contribution in https://github.com/netbirdio/netbird/pull/3272
- @paralin made their first contribution in https://github.com/netbirdio/netbird/pull/3287
- @4thel00z made their first contribution in https://github.com/netbirdio/netbird/pull/3251
- @pnmcosta made their first contribution in https://github.com/netbirdio/netbird/pull/3311
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.36.5...v0.36.6

What's Changed
- [client] Replace engine probes with direct calls by @lixmal in https://github.com/netbirdio/netbird/pull/3195
- Update sign pipeline version by @mlsmaycon in https://github.com/netbirdio/netbird/pull/3246
- [client] Add missing peer ACL flush by @lixmal in https://github.com/netbirdio/netbird/pull/3247
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.36.4...v0.36.5

What's Changed
- [client] Allow freebsd to build netbird-ui by @lixmal in https://github.com/netbirdio/netbird/pull/3212
- [management] Refactor peers to use store methods by @bcmmbaga in https://github.com/netbirdio/netbird/pull/2893
- [misc] Fix: typo in test output by @JinxCappa in https://github.com/netbirdio/netbird/pull/3216
- [management] remove peer from group on delete by @pascal-fischer in https://github.com/netbirdio/netbird/pull/3223
- [management] disable prepareStmt for sqlite by @pascal-fischer in https://github.com/netbirdio/netbird/pull/3228
- [client] Fix freebsd default routes by @lixmal in https://github.com/netbirdio/netbird/pull/3230
- [client] Use correct stdout/stderr log paths for debug bundle on macOS by @lixmal in https://github.com/netbirdio/netbird/pull/3231
- [client] Back up corrupted state files and present them in the debug bundle by @lixmal in https://github.com/netbirdio/netbird/pull/3227
- [client] Match more specific dns handler first by @lixmal in https://github.com/netbirdio/netbird/pull/3226
- [client] Mark redirected traffic early to match input filters on pre-DNAT ports by @lixmal in https://github.com/netbirdio/netbird/pull/3205
- [management] use account request buffer on sync by @pascal-fischer in https://github.com/netbirdio/netbird/pull/3229
- [management/signal/relay] add metrics descriptions by @pascal-fischer in https://github.com/netbirdio/netbird/pull/3233
- [client] Support port ranges in peer ACLs by @lixmal in https://github.com/netbirdio/netbird/pull/3232
- [client] Use dynamic dns route resolution on iOS by @lixmal in https://github.com/netbirdio/netbird/pull/3243
- [management] copy source and destination resource on policyRule copy by @pascal-fischer in https://github.com/netbirdio/netbird/pull/3235
New Contributors
- @JinxCappa made their first contribution in https://github.com/netbirdio/netbird/pull/3216
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.36.3...v0.36.4

What's Changed
- [client] Close ice agent only if not nil by @mlsmaycon in https://github.com/netbirdio/netbird/pull/3210
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.36.2...v0.36.3

What's Changed
- [relay] Don't start relay quic listener on invalid TLS config by @lixmal in https://github.com/netbirdio/netbird/pull/3202
- [management] Fix network migration issue in Postgres by @bcmmbaga in https://github.com/netbirdio/netbird/pull/3198
- [management] add duration logs to Sync by @pascal-fischer in https://github.com/netbirdio/netbird/pull/3203
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.36.1...v0.36.2

What's Changed
- [client] Fix windows info out of bounds panic by @lixmal in https://github.com/netbirdio/netbird/pull/3196
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.36.0...v0.36.1

Release notes
This release introduces initial support to QUIC as a protocol for relay servers, MySQL support for store, and rootless container support for the client running Netstack mode. We also added support for disabling system flags in the client, and optional ZITADEL PAT configuration in the management service among other enhancements and bug fixes.
New features
QUIC Protocol Support
Added initial support for the QUIC protocol in the client and relay server, improving connection reliability and performance. For self-hosted admins that want to try this out, you should ensure that the relay server has TLS certificates configured and that the main listening port is available in both, TCP and UDP.
Rootless Container Support
Implemented rootless container support for the client running in Netstack mode, enabling secure and compatible operation without requiring privileged permissions or Linux capabilities.
You can use the images netbirdio/netbird:rootless-latest or netbirdio/netbird:0.36.0-rootless for this mode.
Learn more about how to enable Netstack mode in the documentation.
MySQL Support
Added MySQL support for the management service, allowing users to store data in a MySQL database. This feature is particularly useful for organizations that prefer MySQL as their database backend.
If you want to start a new deployment with MySQL, you can use the environment variable NETBIRD_STORE_CONFIG_ENGINE=mysql and NETBIRD_STORE_ENGINE_MYSQL_DSN="<username>:<password>@tcp(127.0.0.1:3306)/<database>" in the setup.env file.
We are counting on your feedback and community contributions to improve documentation for this support.
Enhancements
New system flags to disable a few features on the client side
We are introducing a set of new flags that allow users to disable specific features on the client side. This is particularly useful for users who wants more control over their system configurations.
The new flags are available with the netbird up command, see the flags below:
--disable-client-routes Disable client routes. If enabled, the client won't process client routes received from the management service.
--disable-dns Disable DNS. If enabled, the client won't configure DNS settings.
--disable-firewall Disable firewall configuration. If enabled, the client won't modify firewall rules.
--disable-server-routes Disable server routes. If enabled, the client won't act as a router for server routes received from the management service.
Optional ZITADEL PAT Configuration
Enabled optional configuration of a Personal Access Token (PAT) for ZITADEL in the management service, enhancing authentication options for users who want to use ZITADEL as their identity provider.
To configure the ZITADEL PAT, you can use the environment variable NETBIRD_IDP_MGMT_EXTRA_PAT=<secret> in the setup.env file.
What's Changed
- [misc] separate integration and benchmark test workflows #3147
- [misc] remove outdated readme header #3151
- [misc] upgrade go to 1.23 in devcontainer #3160
- [misc] add missing relay to docker-compose.yml.tmpl.traefik #3163
- [misc] Skip docker step when fork PR #3175
- [misc] Fix gvisor.dev/gvisor commit #3179
- [relay] Handle IPv6 addresses in X-Real-IP header on relay service #3085
- [relay] Code cleaning in message marshalling #3074
- [relay] Set InitialPacketSize to the maximum allowable value #3188
- [client] Enable network map persistence by default #3152
- [client] Add rootless container and fix client routes in netstack mode #3150
- [client] Add disable system flags #3153
- [client] Prevent local routes in status from being overridden by updates #3166
- [client] Don't fail on v6 ops when disabled via kernel params #3165
- [client] Update fyne to v2.5.3 #3155
- [client] client: make /var/lib/netbird paths configurable #3084
- [client] Support non-openresolv for DNS on Linux #3176
- [client] Allow ssh server on freebsd #3170
- [client] Disable DNS host manager for netstack mode #3183
- [client] Fix a panic on shutdown if dns host ma

What's Changed
- [management] Add missing group usage checks for network resources and routes access control by @bcmmbaga in https://github.com/netbirdio/netbird/pull/3117
- [management] remove ids from policy creation api by @pascal-fischer in https://github.com/netbirdio/netbird/pull/2997
- [management] Fix networks net map generation with posture checks by @mlsmaycon in https://github.com/netbirdio/netbird/pull/3124
- [management] add selfhosted metrics for networks by @pascal-fischer in https://github.com/netbirdio/netbird/pull/3118
- [client] Ignore case when matching domains in handler chain by @lixmal in https://github.com/netbirdio/netbird/pull/3133
- [client] Allow inbound rosenpass port by @lixmal in https://github.com/netbirdio/netbird/pull/3109
- [management] Preserve jwt groups when accessing API with PAT by @bcmmbaga in https://github.com/netbirdio/netbird/pull/3128
- [management] remove sorting from network map generation by @pascal-fischer in https://github.com/netbirdio/netbird/pull/3126
- [management] Fix policy tests by @mlsmaycon in https://github.com/netbirdio/netbird/pull/3135
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.35.1...v0.35.2

What's Changed
- [client] Don't fail debug if log file is console by @lixmal in https://github.com/netbirdio/netbird/pull/3103
- [client] Fix inbound tracking in userspace firewall by @lixmal in https://github.com/netbirdio/netbird/pull/3111
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.35.0...v0.35.1

Release notes
With this release, we are introducing a new concept in NetBird called Networks. This concept improves the administration of routed resources and provides greater visibility into what is shared with peers. Networks are configuration containers that map your on-premise or cloud networks in a logical set of configurations, making it easier to manage and share routes with your peers based on your infrastructure.
Support for Networks will be available for our cloud-hosted systems in the next few days.
You can find out more information about Networks here: Concept Routing traffic to multiple IP resources Accessing restricted website domain resources Accessing entire domains within networks
Some screenshots: Unified view of your network resources:
Multiple resource types and new support for wildcard domains:
What's Changed
- [client] Add support for state manager on iOS by @pascal-fischer in https://github.com/netbirdio/netbird/pull/2996
- [client] Add peer conn init limit by @mlsmaycon in https://github.com/netbirdio/netbird/pull/3001
- [management] Remove peer needs login log message by @bcmmbaga in https://github.com/netbirdio/netbird/pull/3005
- [management] restructure api files by @pascal-fischer in https://github.com/netbirdio/netbird/pull/3013
- [Snyk] Security upgrade alpine from 3.20 to 3.21.0 by @mlsmaycon in https://github.com/netbirdio/netbird/pull/3019
- [client] Fix race condition with systray ready by @mohamed-essam in https://github.com/netbirdio/netbird/pull/2993
- [misc] split tests with management and rest by @mlsmaycon in https://github.com/netbirdio/netbird/pull/3051
- [misc] Handle dnf version 5 in install script by @mohamed-essam in https://github.com/netbirdio/netbird/pull/3026
- [client] fix: reformat IPv6 ICE addresses when hole punching by @jclds139 in https://github.com/netbirdio/netbird/pull/3050
- [misc] Upgrade x/crypto package by @mlsmaycon in https://github.com/netbirdio/netbird/pull/3055
- fix client unsupported h2 protocol when only 443 activated by @V-E-O in https://github.com/netbirdio/netbird/pull/3009
- [client] Avoid using iota on mixed const block by @mlsmaycon in https://github.com/netbirdio/netbird/pull/3057
- [client, management] Add new network concept by @lixmal in https://github.com/netbirdio/netbird/pull/3047
- [client] Do not start DNS forwarder on client side by @pappz in https://github.com/netbirdio/netbird/pull/3094
- [management] Fix duplicate resource routes when routing peer is part of the source group by @bcmmbaga in https://github.com/netbirdio/netbird/pull/3095
- [client] Reduce DNS handler chain lock contention by @lixmal in https://github.com/netbirdio/netbird/pull/3099
- [management] Run test sequential by @pascal-fischer in https://github.com/netbirdio/netbird/pull/3101
- [client] Add firewall rules to the debug bundle by @lixmal in https://github.com/netbirdio/netbird/pull/3089
- [client] Add stateful userspace firewall and remove egress filters by @lixmal in https://github.com/netbirdio/netbird/pull/3093
New Contributors
- @jclds139 made their first contribution in https://github.com/netbirdio/netbird/pull/3050
- @V-E-O made their first contribution in https://github.com/netbirdio/netbird/pull/3009
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.34.1...v0.35.0

What's Changed
- [client] Cleanup status resources on engine stop by @mlsmaycon in https://github.com/netbirdio/netbird/pull/2981
- [client] Don't return error in rule removal if protocol is not supported by @lixmal in https://github.com/netbirdio/netbird/pull/2990
- [client] Init route selector early by @lixmal in https://github.com/netbirdio/netbird/pull/2989
- [client] Reduce max wait time to initialize peer connections by @mlsmaycon in https://github.com/netbirdio/netbird/pull/2984
- [management] Update account peers on login on meta change by @mohamed-essam in https://github.com/netbirdio/netbird/pull/2991
- [client] upgrade zcalusic/sysinfo to v1.1.3 (add serial support for ARM arch) by @EdouardVanbelle in https://github.com/netbirdio/netbird/pull/2954
New Contributors
- @mohamed-essam made their first contribution in https://github.com/netbirdio/netbird/pull/2991
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.34.0...v0.34.1

What's Changed
- [relay] Refactor initial Relay connection by @pappz in https://github.com/netbirdio/netbird/pull/2800
- [misc] Renew slack link by @mlsmaycon in https://github.com/netbirdio/netbird/pull/2938
- Import time package by @mlsmaycon in https://github.com/netbirdio/netbird/pull/2940
- [client] Don't return error in userspace mode without firewall when setting legacy by @lixmal in https://github.com/netbirdio/netbird/pull/2924
- [client] Test nftables for incompatible iptables rules by @lixmal in https://github.com/netbirdio/netbird/pull/2948
- [client] Set up sysctl and routing table name only if routing rules are available by @lixmal in https://github.com/netbirdio/netbird/pull/2933
- [client] Allow routing to fallback to exclusion routes if rules are not supported by @lixmal in https://github.com/netbirdio/netbird/pull/2909
- [management] Refactor posture check to use store methods by @bcmmbaga in https://github.com/netbirdio/netbird/pull/2874
- [management] Refactor policy to use store methods by @bcmmbaga in https://github.com/netbirdio/netbird/pull/2878
- [management] Refactor DNS settings to use store methods by @bcmmbaga in https://github.com/netbirdio/netbird/pull/2883
- [management] Refactor nameserver groups to use store methods by @bcmmbaga in https://github.com/netbirdio/netbird/pull/2888
- [client] Code cleaning in net pkg by @pappz in https://github.com/netbirdio/netbird/pull/2932
- [management] refactor to use account object instead of separate db calls for peer update by @pascal-fischer in https://github.com/netbirdio/netbird/pull/2957
- [management] Add performance test for login and sync calls by @pascal-fischer in https://github.com/netbirdio/netbird/pull/2960
- [tests] Enable benchmark tests on github actions by @pascal-fischer in https://github.com/netbirdio/netbird/pull/2961
- Add guide when signing key is not found by @mlsmaycon in https://github.com/netbirdio/netbird/pull/2942
- [client] Account different policiy rules for routes firewall rules by @mlsmaycon in https://github.com/netbirdio/netbird/pull/2939
- Update Caddyfile and Docker Compose to support HTTP3 by @v1rusnl in https://github.com/netbirdio/netbird/pull/2822
- Unspecified address: default NetworkTypeUDP4+NetworkTypeUDP6 by @victorserbu2709 in https://github.com/netbirdio/netbird/pull/2804
- [client] Add pprof build tag by @pappz in https://github.com/netbirdio/netbird/pull/2964
- [client] Persist route selection by @lixmal in https://github.com/netbirdio/netbird/pull/2810
- [client] Add state file to debug bundle by @lixmal in https://github.com/netbirdio/netbird/pull/2969
- [client] Fix debug bundle state anonymization test by @lixmal in https://github.com/netbirdio/netbird/pull/2976
- [client] Pass IP instead of net to Rosenpass by @pappz in https://github.com/netbirdio/netbird/pull/2975
- [client] Get static system info once by @mlsmaycon in https://github.com/netbirdio/netbird/pull/2965
- [client] Add netbird.err and netbird.out to debug bundle by @lixmal in https://github.com/netbirdio/netbird/pull/2971
- Add missing parentheses on iphone hostname generation condition by @jnohlgard in https://github.com/netbirdio/netbird/pull/2977
- [client] Add network map to debug bundle by @lixmal in https://github.com/netbirdio/netbird/pull/2966
- [client] Don't choke on non-existent interface in route updates by @lixmal in https://github.com/netbirdio/netbird/pull/2922
- [client] Add state handling cmdline options by @lixmal in https://github.com/netbirdio/netbird/pull/2821
- [management] merge update account peers in sync call by @pascal-fischer in https://github.com/netbirdio/netbird/pull/2978
New Contributors
- @v1rusnl made their first contribution in https://github.com/netbirdio/netbird/pull/2822
- @victorserbu2709 made their first contribution in https://github.com/netbirdio/netbird/pull/2804
- @jnohlgard made their first contribution in https://github.com/netbirdio/netbird/pull/2977
Full Changelog: https://github.com/netbirdio/n

What's Changed
- [misc] Introducing NetBird Guru on Gurubase.io by @kursataktas in https://github.com/netbirdio/netbird/pull/2778
- [misc] use google domain for tests by @mlsmaycon in https://github.com/netbirdio/netbird/pull/2902
- [misc] Update signing pipeline version by @mlsmaycon in https://github.com/netbirdio/netbird/pull/2900
- [management] Add transaction metrics and exclude getAccount time from peers update by @pascal-fischer in https://github.com/netbirdio/netbird/pull/2904
- [client] Add NB_SKIP_SOCKET_MARK & fix crash instead of returing an error by @nazarewk in https://github.com/netbirdio/netbird/pull/2899
- [management] Fix process posture check evaluation on Sync by @pascal-fischer in https://github.com/netbirdio/netbird/pull/2911
- [management] Add metric for peer meta update by @pascal-fischer in https://github.com/netbirdio/netbird/pull/2913
- [management] Add activity events to group propagation flow by @pascal-fischer in https://github.com/netbirdio/netbird/pull/2916
- [client] Fix allow netbird rule verdict by @lixmal in https://github.com/netbirdio/netbird/pull/2925
- [management] Fix getSetupKey call by @pascal-fischer in https://github.com/netbirdio/netbird/pull/2927
New Contributors
- @kursataktas made their first contribution in https://github.com/netbirdio/netbird/pull/2778
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.32.0...v0.33.0

What's Changed
- [management] Refactor setup key to use store methods by @bcmmbaga in https://github.com/netbirdio/netbird/pull/2861
- [management] Add more logs to the peer update processes by @pascal-fischer in https://github.com/netbirdio/netbird/pull/2881
- [client] Improve state write timeout and abort work early on timeout by @lixmal in https://github.com/netbirdio/netbird/pull/2882
- [relay-server] Always close ws conn when work thread exit by @pappz in https://github.com/netbirdio/netbird/pull/2879
- [client] Update route calculation tests by @mlsmaycon in https://github.com/netbirdio/netbird/pull/2884
- [client] Handle panic on nil wg interface by @lixmal in https://github.com/netbirdio/netbird/pull/2891
- [management] Fix limited peer view groups by @pascal-fischer in https://github.com/netbirdio/netbird/pull/2894
- [client/management] add peer lock to peer meta update and fix isEqual func by @pascal-fischer in https://github.com/netbirdio/netbird/pull/2840
- [management] Limit the setup-key update operation by @pascal-fischer in https://github.com/netbirdio/netbird/pull/2841
- [management] Refactor group to use store methods by @bcmmbaga in https://github.com/netbirdio/netbird/pull/2867
- [management] Fix the Inactivity Expiration problem. by @ismail0234 in https://github.com/netbirdio/netbird/pull/2865
- [client] Fix state manager race conditions by @lixmal in https://github.com/netbirdio/netbird/pull/2890
- [client] Move state updates outside the refcounter by @lixmal in https://github.com/netbirdio/netbird/pull/2897
- [client] Fix error state race on mgmt connection error by @lixmal in https://github.com/netbirdio/netbird/pull/2892
New Contributors
- @ismail0234 made their first contribution in https://github.com/netbirdio/netbird/pull/2865
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.31.1...v0.32.0

What's Changed
- [management] Fix add peer all group network map update by @pascal-fischer in https://github.com/netbirdio/netbird/pull/2830
- [misc] Avoid failing all other matrix tests if one fails by @mlsmaycon in https://github.com/netbirdio/netbird/pull/2839
- [client] Fix cached device flow oauth by @mlsmaycon in https://github.com/netbirdio/netbird/pull/2833
- [management] Fix network map update on peer validation by @pascal-fischer in https://github.com/netbirdio/netbird/pull/2849
- [client] Use the prerouting chain to mark for masquerading to support older systems by @lixmal in https://github.com/netbirdio/netbird/pull/2808
- [relay-server] Use X-Real-IP in case of reverse proxy by @pappz in https://github.com/netbirdio/netbird/pull/2848
- [client] Exclude split default route ip addresses from anonymization by @lixmal in https://github.com/netbirdio/netbird/pull/2853
- [management] Enforce max conn of 1 for sqlite setups by @pascal-fischer in https://github.com/netbirdio/netbird/pull/2855
- [management] Fix potential panic on inactivity expiration log message by @pascal-fischer in https://github.com/netbirdio/netbird/pull/2854
- [management] Add benchmark tests to get account with claims by @mlsmaycon in https://github.com/netbirdio/netbird/pull/2761
- [client] Use offload in WireGuard bind receiver by @pappz in https://github.com/netbirdio/netbird/pull/2815
- [management] Remove context from database calls by @pascal-fischer in https://github.com/netbirdio/netbird/pull/2863
- [management] Add peer lock to grpc server by @pascal-fischer in https://github.com/netbirdio/netbird/pull/2859
- [management] Fix api error message typo peers_group by @lixmal in https://github.com/netbirdio/netbird/pull/2862
- [client] Remove loop after route calculation by @pappz in https://github.com/netbirdio/netbird/pull/2856
- [client] fix/proxy close by @pappz in https://github.com/netbirdio/netbird/pull/2873
- [client] Fix race conditions by @lixmal in https://github.com/netbirdio/netbird/pull/2869
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.31.0...v0.31.1

Highlights
[management] Setup key improvements #2775
- We added support to setup-key deletion, allowing account cleanup of revoked or expired keys.
- The max expiration time was removed, allowing users to define any date for key expiration.
- Setup-keys are now stored as hashs, improving security for systems.
Because of a database migration where the setup-keys are being hashed, a downgrade is no longer possible without restoring a backup. So, testing and making sure a backup is done before upgrading is highly recommended. See backup docs here: https://docs.netbird.io/selfhosted/selfhosted-guide#backup
Improvements
- [client] Make native firewall init fail firewall creation #2784
- [misc] Update Zitadel from v2.54.10 to v2.64.1 #2793
- [client] allow relay leader on iOS #2795
- [management] remove network map diff calculations #2820
- [management] Add DB access duration to logs for context cancel #2781
- [client] Log windows panics #2829
Bug fixes
- [client] Ignore route rules with no sources instead of erroring out #2786
- [client] Fix multiple peer name filtering in netbird status command #2798
- [client] Fix the broken dependency gvisor.dev/gvisor #2789
- [management] Fix peer meta isEqual #2807
- [client] Nil check on ICE remote conn #2806
- [client] Allocate new buffer for every package #2823
- [client] Fix unused servers cleanup #2826
- [client] Remove legacy forwarding rules in userspace mode #2782
New Contributors
- @Codixer made their first contribution in #2793
- @mgarces made their first contribution in #2798
- @milantracy made their first contribution in #2789
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.30.3...v0.31.0

What's Changed
[management] Remove admin check on getAccountByID by @pascal-fischer in #2699
[management] Validate peer ownership during login by @bcmmbaga in #2704
[client] Limit P2P attempts and restart on specific events by @lixmal in #2657
[management] Propagate error in store errors by @pascal-fischer in #2709
[misc] Add Link to the Lawrence Systems video by @braginini in #2711
[management] Make max open db conns configurable by @pascal-fischer in #2713
[management] Add support to envsub go management configurations by @mlsmaycon in #2708
[management] Move testdata to sql files by @pascal-fischer in #2693
[client] Improve route acl by @lixmal in #2705
[signal] new signal dispatcher version by @pascal-fischer in #2722

Access Control for Network Routes
Starting with version 0.30.0, users can assign access control groups to network routes, offering improved security and traffic restrictions. Route access is now unidirectional, ensuring traffic complies with the specified policies before authorization. This feature enhances the flexibility of network management.

To configure this, follow the documentation: Configuring routes with access control.

Improvements
Add Access Control for Network Routes: [management, client] Add access control support to network routes #2100
Remove Redundant Account Token Calls: [management] Remove redundant get account calls in GetAccountFromToken #2615
Refactor User JWT Group Synchronization: [management] Refactor User JWT group sync #2690
Bug Fixes
Anonymize Relay Address in Peers View: [client] Anonymize relay address in status peers view #2640
Check WireGuard Interface Instead of Engine Context: [client] Check wginterface instead of engine ctx #2676
Close Remote Connection in Proxy: [client] Close the remote conn in proxy #2626
Fix eBPF Close Function: [client] Fix ebpf close function #2672
Fix Relay Disconnection Handling: [client] Fix Relay disconnection handling #2680
Restrict Peer Access for Non-Admins: [management] Restrict accessible peers to user-owned peers for non-admins #2618
Other Changes
Adjust Relay Worker Log Levels: [client] Adjust relay worker log level and message #2683
Improve Error Count Formatting: [client] Fix error count formatting #2641
Refactor Interface Package: [client] Refactor/iface pkg #2646
Remove Custom Localhost Dialer: [client] Remove usage of custom dialer for localhost #2639
Add Account Existence Check to AccountManager: [management] Add AccountExists to AccountManager #2694
Add DB Retrieval Method: [management] Add get DB method to store #2650
Fix Account Manager Mock Implementation: [management] Fix account manager mock #2695
Propagate Management Metrics: [management] Propagate metrics #2667
Remove File Store in Management: [management] Remove file store #2689
Update Management Docker Image: [management] Update management base docker image #2687
Improve ZITADEL IDP Error Handling: [management] improve zitadel idp error response detail #2634
Add Log Setting to Caddy Container: [misc] Add log setting to Caddy container #2684
Fix IP Range Posture Check Example: [misc] Fix ip range posture check example in API doc #2628
Update to Goreleaser Version 2: [misc] Specify goreleaser version and update to 2 #2673
Use Packages to Fetch Latest Version: [misc] Use the pkgs to get the latest version #2682
Move Signal Message Handling into Dispatcher: [signal] Move dummy signal message handling into dispatcher #2686
Propagate Signal Metrics: [signal] Propagate metrics #2668
Add Context to Signal Dispatcher: [signal] add context to signal-dispatcher #2662

What's Changed
Do not block the msg receiving if the wg proxy does not operate by @pappz in #2617
Exit from processConnResults after all tries by @pappz in #2621

What's Changed
[client] Ensure engine is stopped before starting it back by @hurricanehrndz in #2565
[relay] Change heartbeat timeout by @pappz in #2598
[client] Fix blocked net.Conn Close call by @pappz in #2600
[management] Add command flag to set metrics port for signal and relay service, and update management port by @benniekiss in #2599
[client] Fix get management and signal state race condition by @mlsmaycon in #2570
[management] fix legacy decrypting of empty values by @bcmmbaga in #2595
[signal] Fix signal active peers metrics by @pascal-fischer in #2591
[management] Add transaction to addPeer by @pascal-fischer in #2469
[client] Fix leaked server connections by @pappz in #2596
[client] Enforce permissions on Win by @pappz in #2568
[relay] Add health check attempt threshold by @mlsmaycon in #2609
[client] Fix race condition while read/write conn status in peer conn by @pappz in #2607
[client] Cancel the context of wg watcher when the go routine exit by @pappz in #2612

What's Changed
[management] Add GCM encryption and migrate legacy encrypted events by @bcmmbaga in #2569
[misc] Update core github actions by @mlsmaycon in #2584
Update Go version to 1.23 by @mlsmaycon in #2588
[management] Add accessible peers endpoint by @bcmmbaga in #2579
[client] fix: install.sh: avoid call of netbird executable after rpm-ostree installation by @M0Rf30 in #2589
[client] Fix wg handshake checking by @pappz in #2590
[misc] Support configurable max log size with var NB_LOG_MAX_SIZE_MB by @mlsmaycon in #2592

What's Changed
[client] Don't overwrite allowed IPs when updating the wg peer's endpoint address by @lixmal in #2578
[relay] Improve relay messages by @lixmal in #2574
[relay] change log levels by @pappz in #2580
Remove pre-release step from workflow by @mlsmaycon in #2583
[client] Update service package version by @mlsmaycon in #2582

Improvements
Auto Update Geolite: Added automatic updates for Geolite data. #2297
@benniekiss made this amazing contribution that allows the management service to update the geolocation databases when starting up.
In case you are running NetBird management in restricted locations like China, you can use add the flag --disable-geolite-update to the management command flags to disable the update.

Support for ECDSA Public Keys: Added support for ECDSA public keys in management. #2461
@HarryKodden made their first contribution in this change to support ECDSA public keys.

RPM-Ostree Support: Added installation script support for rpm-ostree-based distros. #2508
@M0Rf30 made their first contribution in this change to support installations for rpm-ostree-based distros.

Signal Dispatcher: Introduced signal dispatcher for better signaling. #2373

PostgreSQL Store Test: Improved test infrastructure for files generation using PostgreSQL store. #2478

X-Frame-Options Header: Updated dashboard to use X-Frame-Options with the sameorigin header. #2547

Retry on TUN Creation for Darwin: Improved client handling by retrying TUN creation for Darwin systems. #2564

Security Upgrade: Upgraded Alpine version from 3.19 to 3.20 to address security concerns. #2548

Bug Fixes
Fix Deadlock on Auto Connect: Avoided deadlock in client auto-connect with early exit handling. #2528
Destroy WG Interface on Timeout: Addressed issue where WireGuard interface wasn't destroyed on down timeout. #2435
Fix Service Down: Corrected the service-down issue in the client. #2519
Prevent Client Panic: Fixed client panic when there was no connection. #2541
Error Handling in OpenConnVia: Improved error handling in the openConnVia function. #2560
Fix Lock on Down: Fixed a lock issue when the service was brought down. #2546
Documentation
Route API Docs: Updated route API documentation with a new maximum domain number. #2516
Other Changes
Test Log Reduction: Reduced test log verbosity. #2550
Update Slack URL: Updated Slack URL in documentation. #2544
TestRecreation Test: Added TestRecreation unit test in the client. #2558

What's Changed
- [management] Rename request buffer and update default interval by @pascal-fischer in #2459
- [client] Add test for SetFlagsFromEnvVars by @mlsmaycon in #2460
- [client] Refactor free port function by @mlsmaycon in #2455
- [misc] Bump github.com/docker/docker from 26.1.4+incompatible to 26.1.5+incompatible by @dependabot in #2426
- [misc] Add support for NETBIRD_STORE_ENGINE_POSTGRES_DSN environment variable in setup.env by @arosberg in #2462
- [management] Refactor HTTP metrics by @bcmmbaga in #2476
New Contributors
- @arosberg made their first contribution in #2462
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.28.8...v0.28.9

What's Changed
- Fix windows network monitor next hop ip log by @lixmal in #2168
- Automatically migrate older management store engine to SQLite by @bcmmbaga in #2170
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.28.1...v0.28.2

What's Changed
- Fix windows route zones by @lixmal in #2164
- Fix dns route retrieval condition by @lixmal in #2165
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.28.0...v0.28.1

Release notes
This release brings support to new and exiting features like DNS routes, enhancements that simplify site-2-site configurations, bug fixes and a deprecation notice.We are deprecating FileStore engine support and users should update their backup scripts as this new version will automatically migrate the data to the new SQLite engine.
New features
DNS routes
This new functionality enables NetBird users to configure routes using domain names instead of IP ranges. This enhancement is particularly beneficial for routing traffic to load balancers, managed databases, and maintaining security for restricted sites behind CDNs with ease and precision.Learn more at DNS routesProcess posture check
Process posture check is a new feature that allows users to define a set of processes that must be running on a device before connecting to the network. This feature is useful when you want to control access based on the processes running on a device. For example, you can disable a connection to a routing peer when a specific process is not running.Learn more at Process checkInitial support of FreeBSD
We are happy to present an experimental support release for the FreeBSD operating system. This feature, made possible by a valuable community contribution from member @skillcoder, aims to introduce early functionality for FreeBSD. Please note that this version is still in its initial stages and may contain bugs or incomplete elements.Official builded binaries are coming in the next releases.
Enhancements:
Network monitor is enable by default for new Windows and macOS clients
The network monitor watches for changes on the peers' network interfaces and restarts the connection when necessary. This is useful when roaming between networks where your default gateway changes frequently. Existing Windows, macOS and Linux users can enable this feature by adding the -N flag to the netbird up command:

netbird down
netbird up -N

Use 0.0.0.0/0 as source for network routes firewall rules
Previously routing peers would add the NetBird address as source in the network routes firewall rules, making site-2-site configurations more complex since administrators would need to add new firewall rules to connect their internal networks via a pair of routing peers. With this enhancement, the routing peers will use 0.0.0.0/0 as source in the network routes firewall rules, simplifying the configuration process by leaving only internal routers to be configured.Add GUI client configuration options
We have added new configuration options to the client UI to allow users to configure the client without the need to edit the configuration file or CLI commands. This enhancement is particularly useful for users who prefer to use the client UI to configure the client.Systray:

Advanced settings window:
Deprecations:
FileStore engine support removed
The FileStore engine support has been deprecated in this release. When upgrading to 0.28.0, the service will automatically migrate the data to the new SQLite engine.
Users that backup the store.json file directly should update their scripts to use the new SQLite store file store.db.If you prefer to evaluate performance prior upgrading to 0.28.0, please review the manual migrations steps from the Management SQLite store page.What's Changed
- Add FindExistingPostureCheck (#2075)
- Fix PKCE auth html (#2079)
- Improve login performance (#2061)
- Fill the UI version info in system meta on Android (#2077)
- Prevent using expired ctx when sending metrics (#2088)
- Ignore candidates whose IP falls into a routed network (#2084)
- Add missing openid scope when requesting JWT token in Zitadel (#2089)
- Remove unused variables from peer conn (#2074)
- Respect env for debug and routes sub commands (#2026)
- Do not use SO_MARK in case of netstack mode. (#2104)
- Use forked go-netroute (#2115)
- Add basic signal metrics (#2107)
- Optimize JWT Group Sync (#2108)
- Prevent building test code for client (#2125)
- Deprecate FileStore engine su

What's Changed
- Use info log-level for firewall manager discover by @mlsmaycon in #2045
- Restore netbird state and log level after debug by @lixmal in #2047
- Extend integrated validator with error handling by @pappz in #2044
- Remove extra error mapping by @mlsmaycon in #2050
- fix a typo in CODE_OF_CONDUCT.md by @mlsmaycon in #2048
- Refactor firewall manager check by @mlsmaycon in #2054
- Upgrade gRPC and OpenTelemetry packages for compatibility by @bcmmbaga in #2003
- Don't allow delete group from peer groups by @mlsmaycon in #2055
- Add extra logs for account not found, peer login and getAccount by @mlsmaycon in #2053
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.27.9...v0.27.10

What's Changed
- Revert "Accept any XDG_ environment variable to determine desktop" by @mlsmaycon in #2042
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.27.8...v0.27.9

What's Changed
- CentOS installations might have "apt" as "annotation processing tool"… by @thorleifjacobsen in #1955
- Add installer support for Synology by @bcmmbaga in #1984
- Implement PostgreSQL store support by @bcmmbaga in #1939
- Refactor network monitor to wait for stop by @lixmal in #1992
- Enable nameserver deactivation if unresponsive on iOS by @pascal-fischer in #1982
- Increase garbage collection on ios by @pascal-fischer in #1981
- Update the GUI status when the daemon is unavailable by @mlsmaycon in #2012
- Gracefully conn worker shutdown by @pappz in #2022
- Store location information in peer event meta by @mlsmaycon in #1994
- Add dummy ipv6 to macos interface by @lixmal in #2025
- use the next available port for Wireguard by @mattkasun in #2024
- Increase the status checks timeout by @mlsmaycon in #2033
- Accept any XDG_ environment variable to determine desktop by @mlsmaycon in #2037
- Fix the initial daemon retry interval by @mlsmaycon in #2036
- Return the proper error when a peer is deleted by @mlsmaycon in #2035
- Enhance firewall manager checks to detect unsupported iptables by @mlsmaycon in #2038
- Log global lock acquisition per user by @mlsmaycon in #2039
New Contributors
- @thorleifjacobsen made their first contribution in #1955
- @mattkasun made their first contribution in #2024
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.27.7...v0.27.8

Fixes an issue with Linux nodes that had to use relay with eBPF for connectivity where reconnections caused the proxy to stop forwarding packets.What's Changed
- Don't cancel proxy context on conn close by @lixmal in #1986
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.27.6...v0.27.7

What's Changed
- Fix typo in systemd .service files by @ishanarora in #1972
- Fix lost root zone handler by @mlsmaycon in #1975
New Contributors
- @ishanarora made their first contribution in #1972
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.27.5...v0.27.6

What's Changed
- Update the check interval for new geo db and change log level by @mlsmaycon in #1908
- Fix best route selection by @pascal-fischer in #1903
- Ignore cloned routes on bsd by @lixmal in #1915
- Refactor Route IDs by @lixmal in #1891
- Return system serial on a peer HTTP API call by @braginini in #1929
- Fix removeAllowedIP by @hurricanehrndz in #1913
- Fix resolv.conf repairer logic by @pappz in #1931
- Remove comments from iptables commands by @pappz in #1928
- Fix a panic when management is behind an invalid proxy by @mlsmaycon in #1930
- Retry reading routing table (bsd) by @hurricanehrndz in #1914
- Feature/exit node Android by @pappz in #1916
- Migrate blob net ip fields to json serializer by @bcmmbaga in #1906
- Improve Sync performance by @pascal-fischer in #1901
- Monitor network changes by @lixmal in #1904
- unify Config generation, loading and updating by @nazarewk in #1586
- Fix windows route exec path by @bcmmbaga in #1946
- Add route selection to iOS by @pascal-fischer in #1944
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.27.4...v0.27.5

What's Changed
- Pass integrated validator for API by @pappz in #1814
- Use fixed activity codes by @lixmal in #1846
- Fix ICE endpoint remote port in status by @lixmal in #1851
- Migrate serializer:gob fields to serializer:json by @lixmal in #1855
- Use a better way to insert data in batches by @braginini in #1874
- Copy client binary to a directory in path by @mlsmaycon in #1842
- Update README.md by @braginini in #1821
- Redeem invite only when incoming user was invited by @mlsmaycon in #1861
- Add support for GUI app to display error by @mlsmaycon in #1844
- Fix DNS not found query response by @mlsmaycon in #1877
- Bump golang.org/x/net from 0.20.0 to 0.23.0 by @dependabot in #1867
- Feature/route selection by @lixmal in #1865
- Add account locks to getAccountWithAuthorizationClaims method by @pascal-fischer in #1847
- Support exit nodes on iOS by @pascal-fischer in #1878
- Add retry to IdP cache lookup by @pascal-fischer in #1882
- Support rosenpass on iOS by @pascal-fischer in #1879
- Fix incorrect response content-type header by @bcmmbaga in #1887
- Replace powershell with route command by @lixmal in #1880
- Add client debug features by @lixmal in #1884
- Check if channel exist before sending network map by @mlsmaycon in #1894
- Fix route selection IDs by @lixmal in #1890
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.27.3...v0.27.4

What's Changed
- Allow owners that did not create the account to delete it by @mlsmaycon in #1825
- Rename variable by @pappz in #1829
- Don't use the custom dialer as non-root by @lixmal in #1823
- Routes is a map, employing safe read/writes ops by @hurricanehrndz in #1760
- Use route active store by @lixmal in #1834
- Use fixed prefs by @lixmal in #1836
- Allow disabling custom routing by @lixmal in #1840
- Add sysctl opts to prevent reverse path filtering from dropping fwmark packets by @lixmal in #1839
New Contributors
- @hurricanehrndz made their first contribution in #1760
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.27.2...v0.27.3

Changelog
- 3ed2f08f Add latency based routing (#1732)
- 4c83408f Add log-level to the management's docker service command (#1820)
- 90bd39c7 Log panics (#1818)
- dd0cf411 Auto restart Windows agent daemon service (#1819)
- 22b2caff Remove dns based cloud detection (#1812)
- c1f66d13 Retry macOS route command (#1817)
- ac0fe602 Fix routing issues with MacOS (#1815)
- c2865771 Fix function names in comments (#1816)
- 1d1d057e Change the dashboard image pull from wiretrustee to netbirdio (#1804)

What's Changed
- Expect correct conn type by @lixmal in #1801
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.27.0...v0.27.1

Changelog
- 3d2a2377 Don't return errors on disallowed routes (#1792)
- 25f5f265 Timeout rule removing loop and catch IPv6 unsupported error in loop (#1791)
- bb0d5c5b Linux legacy routing (#1774)
- 79382951 Feature/exit nodes - Windows and macOS support (#1726)
- 9af532fe Get scope from endpoint url instead of hardcoding (#1770)
- 23a14737 Fix grammar in readme (#1778)

What's Changed
- Eval/higher timeouts by @braginini in #1776
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.26.6...v0.26.7

What's Changed
- Ignore "Address family not supported by protocol" errors by @lixmal in #1766
- Don't block on failed routing setup by @lixmal in #1768
- Update network security image by @braginini in #1765
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.26.5...v0.26.6

What's Changed
- Feature/peer validator by @pappz in #1553
- support to configure extra blacklist of iface in "up" command by @hoozecn in #1734
- Fix invalid token on peer login due to the cache race by @braginini in #1763
New Contributors
- @hoozecn made their first contribution in #1734
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.26.4...v0.26.5

What's Changed
- Update account attributes only when there is a domain by @mlsmaycon in #1701
- Remove deprecated Rules API endpoints by @surik in #1523
- Add support for inviting/deleting users via Zitadel by @synfinatic in #1572
- Disable force jsonfile variable by @mlsmaycon in #1611
- Unblock ACL apply filtering because of dns probes by @mlsmaycon in #1711
- Avoid creating duplicate groups with the same name by @braginini in #1579
- Validate authentik issuer url by @mlsmaycon in #1723
- Add missing dns domain to tests to avoid verbose test logs by @mlsmaycon in #1724
- Remove context niling by @lixmal in #1729
- Add latency checks to peer connection and status output by @pascal-fischer in #1725
- Feature/exit nodes - Linux support by @lixmal in #1667
- Change log level for JWT override message of single account mode by @pascal-fischer in #1747
- In meta info collect chassis serial by @pappz in #1748
- Add limited dashboard view by @pascal-fischer in #1738
New Contributors
- @synfinatic made their first contribution in #1572
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.26.3...v0.26.4

Release notes
New features
Peer session expiration notification
The NetBird client will notify users when they peer session expires.For systems running the GUI client it will send a system notification similar to the example below:
And when there is no CLI running, the daemon service will notify all active terminal sessions as the example below:
imageEnhancements:
NetBird status command reports DNS server addresses and routes
The netbird status command now reports the DNS server addresses and routes for the peer. This information helps troubleshoot network connectivity issues and verify the network configuration. In the case of a routing client, it will link the active routes to the selected routing peers. See outputs below:

Daemon version: development
CLI version: development
Management: Connected
Signal: Connected
Relays: 2/2 Available
Nameservers: 2/3 Available
FQDN: vik-x1-7.netbird.stage
NetBird IP: 100.119.244.41/16
Interface type: Kernel
Quantum resistance: false
Routes: 20.0.0.0/8, 30.0.0.0/8
Peers count: 0/22 Connected

Peers detail:
ubuntu.netbird.stage:
NetBird IP: 100.119.181.187
Public key: +BRlYReQ5wtzZ/nFSwpc3/S+wyfonEtGo3Qr9KT4wTs=
Status: Connected
-- detail --
Connection type: P2P
Direct: true
ICE candidate (Local/Remote): host/srflx
ICE candidate endpoints (Local/Remote): 192.168.100.1:51820/1.2.3.4:51820
Last connection update: 2024-03-08 16:52:17
Last WireGuard handshake: 2024-03-08 16:52:17
Transfer status (received/sent) 316 B/292 B
Quantum resistance: false
Routes: 10.0.0.0/8

Daemon version: development
CLI version: development
Management: Connected to https://stageapi.wiretrustee.com:443
Signal: Connected to https://signal.stage.netbird.io:443
Relays:
[stun:api.netbird.io:3478] is Available
[turn:api.netbird.io:3478?transport=udp] is Available
Nameservers:
[8.8.8.8:53, 8.8.4.4:53] for [.] is Available
[10.72.0.10:53] for [svc.cluster.local] is Unavailable, reason: 1 error occurred:
* read udp 192.168.178.38:50445->10.72.0.10:53: i/o timeout
FQDN: vik-x1-7.netbird.stage
NetBird IP: 100.119.244.41/16
Interface type: Kernel
Quantum resistance: false
Routes: -
Peers count: 1/1 Connected

Custom service name in the NetBird service commands
In this version, we received a community contribution that allows custom service names to be configured when installing and managing daemon services. See examples below:

netbird service install --service netbird-custom
netbird service start --service netbird-custom
netbird service stop --service netbird-custom

Big thanks to @nazarewk for this contribution and all the work he is doing in maintaining the NetBird Nix packages up to date.An additional connection retry mechanism
We have added an additional connection retry mechanism to the client, where even after the client exits its normal connectivity flow, it will try a new connection attempt every hour for 14 days. This is useful for clients that restart right at the moment of a Management service outage and for incorrect management responses that cause the client to exit its other layers of connectivity retries.What's Changed
- Add reverse proxy settings to management.json template (#1639)
- Update bug-issue-report.md label (#1640)
- Add quotes to timestamp examples in openapi spec (#1642)
- Add open-source network security image (#1643)
- Enable review linter with exported docs check (#1647)
- Log version when starting management and signal (#1649)
- Fix cloud information not stored (#1651)
- Enhance DNS failover reliability (#1637)
- Send UI notification on peer session expiry (#1646)
- Register creation time for peer, user and account (#1654)
- Handle canceling schedule and avoid recursive call (#1636)
- Do not fail on virtualized windows systems (#1669)
- Return 1s when next expiration is too low (#1672)
- add ansible collections contributions (#1675)
- Send terminal notification on peer session expiry (#1660)
- Check for record not found when searching the store (#1686)
- Add fallback retry to daemon (#1690)
- a

Release notes
Enhancements:
New posture check: Peer network ranges
We have added a new posture check that allows you to define a set of IP ranges a device must be in before connecting to the network. This check is useful when you want to control access based on a network a peer is located. e.g., you can disable a connection to a routing peer when the peer is connecting from your office network range:
https://docs.netbird.io/how-to/manage-posture-checks#peer-network-range-checkSee example below:
Add support for downloading geolocation databases to the management service
Now, the management service will download the geolocation databases automatically. This feature is useful for self-hosted users using the geolocation posture check. Learn more at https://docs.netbird.io/selfhosted/geo-supportUpdated GUI icons to reflect the connection status
We have updated the tray icon to reflect the connection status and update availability. Now you can see if the client is connected or disconnected you will see the NetBird icon alternating colors, proving a more clear view of the connection status.Connected:

Disconnected:

What's Changed
- Add account usage logic (#1567)
- Use SQLite store as default when running tests when env is not set (#1612)
- Add private network posture check (#1606)
- Make SQLite default in configuration generation script (#1610)
- Check git status after go mod tidy on CI (#1614)
- Add quantum resistance status output (#1608)
- Update download-geolite2.sh to use packages URLs (#1624)
- Add support for device flow on getting started with zitadel (#1616)
- Extend bypass middleware with support of wildcard paths (#1628)
- Add support for downloading Geo databases to the management service (#1626)
- Combine update-available and connected/disconnected tray icon states (#1615)
- Rename PrivateNetworkCheck to PeerNetworkRangeCheck (#1629)
- FIx order when validating account settings (#1632)
- Fix invalid cross-device link when moving geolocation databases (#1638)
Big thanks to our community contributors
- @ph1ll made their first contribution in (#1610)
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.26.0...v0.26.1

What's Changed
- Add account usage logic by @lixmal in #1567
- Use SQLite store as default when running tests when env is not set by @surik in #1612
- Add peer network posture check by @bcmmbaga in #1606
- Make SQLite default in configuration generation script by @ph1ll in #1610
- Check git status after go mod tidy on CI by @surik in #1614
- Add quantum resistance status output by @braginini in #1608
- Update download-geolite2.sh to use packages URLs by @mlsmaycon in #1624
- Add support for device flow on getting started with zitadel by @mlsmaycon in #1616
- Extend bypass middleware with support of wildcard paths by @surik in #1628
- Add support for downloading Geo databases to the management service by @bcmmbaga in #1626
- Combine update-available and connected/disconnected tray icon states by @lixmal in #1615
- Rename PrivateNetworkCheck to PeerNetworkRangeCheck by @bcmmbaga in #1629
- FIx order when validating account settings by @pascal-fischer in #1632
New Contributors
- @ph1ll made their first contribution in #1610
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.26.0...v0.26.1

Release notes
These release notes summarize what happened in the previous 0.25 release and what happened with the 0.26 release. There are cool new features and long-awaited enhancements that we want to share.New features
Dashboard V2 is here
Our redesigned management dashboard is here. It's faster, more responsive, and has a new look. It's also more intuitive and easier to use. The new dashboard is available to all cloud users and new self-hosted deployments; for existing self-hosted deployments, you can switch between the old and new dashboards at any time by updating the docker image from wiretrustee/dashboard to netbirdio/dashboard:latest.Checkout these screenshots:
Peer's view
Access control
DNS Nameservers
Posture checks
We are introducing a new feature called posture checks. This feature allows you to define a set of conditions a device must meet before connecting to the network. For example, you can require that a device has a specific version of a NetBird or Operating system. In this release, we are introducing the first version of this feature, and we are looking forward to your feedback.It includes 3 types of checks:
OS version

NetBird version

Geo Location
For self-hosted users: The geo-location check won't work without the databases, and we are working on automated download support for it, which will be released very soon.
Check out more at: https://docs.netbird.io/how-to/manage-posture-checksNetStack mode
We are introducing a new running mode called NetStack. In this mode, NetBird enables secure connectivity and access from serverless functions like AWS lambda and Azure Functions to cloud or on-premises servers, containers, databases, and other internal resources. See more at https://docs.netbird.io/how-to/netbird-on-faasRosenpass integration
We are introducing an experimental integration with Rosenpass, which provides a quantum-resistant pre-shared key rotation mechanism. Learn more at: https://docs.netbird.io/how-to/enable-post-quantum-cryptographyBehavioral changes:
Deprecation of JSON store engine
With this release, we are marking the JSON file store engine as deprecated. New installations will be using SQLite store by default. This change will allow us to support robust relational engines like Postgres.We plan to keep support for JSON file store engine until v0.28.0, and we will update the community if the plan changes.To migrate from JSON to SQLite, please follow the guide here: https://docs.netbird.io/selfhosted/sqlite-store#migrating-from-json-store-to-sq-lite-storeSSH server disabled by default on new installations
We have disabled the SSH server on the client side by default for new installations. You can enable it by adding the flag --allow-server-ssh to the NetBird client. Existing installations are unaffected by this change and require you to disable SSH if you don't need it.To enable SSH:

netbird down
netbird up --allow-server-ssh

To disable SSH

netbird down
netbird up --allow-server-ssh=false

Shout-out to @charnesp for this contribution.GUI client support is coming soon.
Upgrade step for management version < 0.15.3
As part of our deprecation of Rules in favor of Policies, the users with management on version < v0.15.3
should first upgrade their systems to v0.25.9,
run management to properly migrate rules to policies and upgrade to 0.26.0+.Enhancements:
JWT group-based access control (self-hosted only)
We have added support for group-based access control in the JWT token. Now, you can define a group in the JWT token and use it to control access to the network. Cloud users have a similar feature available with IDP sync.Access NetBird settings in Windows RDP connections
In 0.25.3, we fixed an issue that prevented users from updating the NetBird settings in Windows RDP connections. Now, you can update the settings in the RDP connection settings.Control client auto-connection when starting
The ability to control whether the client should automatically connect when the daemon is starting, after an op

What's Changed
- Make sure the iOS dialer does not get overwritten by @lixmal in #1585
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.25.8...v0.25.9

What's Changed
- Expose trusted proxy list and counter configuration for realip middleware by @surik in #1535
- Add an extra server reflexive candidate with WG port by @mlsmaycon in #1549
- Properly handle cache error and return userdata by @mlsmaycon in #1571
- Return error when peer is not valid by @mlsmaycon in #1573
- Fix/prevent returning error from external cache by @mlsmaycon in #1576
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.25.7...v0.25.8

What's Changed
- Get cache from external cache when refresh fails by @mlsmaycon in #1537
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.25.6...v0.25.7

What's Changed
- Update bug-issue-report and feature request templates by @mlsmaycon in #1499
- Fix data dir creation permissions by @lixmal in #1503
- Fix iOS DNS timeout by @lixmal in #1504
- Restore dns on unclean shutdown by @lixmal in #1494
- getFirstListenerAvailable(): adjust logging levels and add success message by @nazarewk in #1513
- Extract peer real IP from Load Balancer when possible by @surik in #1510
- Export info log level setter for Android by @pappz in #1518
- Update port, ip choice logic in DNS service by @pappz in #1514
- Fix/resolv parser by @pappz in #1520
- Remove query parameter from policy endpoints by @surik in #1527
- Update grpc-middleware to bring changes related to realip by @surik in #1526
- Use dashboard v2 for getting started scripts by @mlsmaycon in #1530
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.25.5...v0.25.6

What's Changed
- Fix musl build by @xcf13363175 in #1480
- Bump golang.org/x/crypto from 0.14.0 to 0.17.0 by @dependabot in #1401
- Add iOS build test by @pappz in #1412
- Upgrade integrations versions to 8a7c87accb22 by @mlsmaycon in #1482
- Fix preshared key not persisted in config by @pascal-fischer in #1474
- Add getGroupByName method by @pascal-fischer in #1481
- Fix race condition with JWT group sync by @mlsmaycon in #1486
- Extend netbird status command to include health information by @lixmal in #1471
- Tidy up mods by @lixmal in #1492
- Validate upstream reachability on first DNS configuration by @lixmal in #1489
- Support disabled resolved stub server mode by @pappz in #1493
- Allow service users with user role read-only access to all resources by @pascal-fischer in #1484
New Contributors
- @xcf13363175 made their first contribution in #1480
- @lixmal made their first contribution in #1471
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.25.4...v0.25.5

What's Changed
- Update user's last login when authenticating a peer by @mlsmaycon in #1437
- Update setup.env.example by @wisetux in #1433
- Integrate Rosenpass by @pascal-fischer in #1153
- Remove duplicated chain add by @pappz in #1444
- Update contribution and readme file by @pascal-fischer in #1447
- Use cached wintun zip package in github workflows by @pappz in #1448
- Allow iOS to connect to old management versions by @pascal-fischer in #1440
- Add external-ip support for coturn by @mlsmaycon in #1439
- Soft deprecate Rules API by @surik in #1454
- Fix allow netbird traffic for nftables and userspace by @pappz in #1446
- Fix client SSH server error log by @braginini in #1455
- Fix typo in iface/tun_usp_linux.go by @surik in #1457
- Update Android build env by @pappz in #1456
- Add support for setting interface name and wireguard port by @mlsmaycon in #1467
- Remove debug lines by @pappz in #1468
- Enable group propagation by default by @mlsmaycon in #1469
New Contributors
- @wisetux made their first contribution in #1433
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.25.3...v0.25.4

What's Changed
- Fix quickstart script incompatibility with latest Zitadel version by @bcmmbaga in #1400
- Update cloud management URL to https://api.netbird.io:443 by @mlsmaycon in #1402
- Use integrated activity store by @mlsmaycon in #1421
- Remove the user from the cache without refreshing it by @mlsmaycon in #1422
- Update management-integrations/additions by @mlsmaycon in #1425
- Fix Windows name on WMI error by @mlsmaycon in #1426
- Fix Windows settings popup with mesa 3d openGL emulator by @mlsmaycon in #1428
- Add iOS support to README by @braginini in #1430
- Fix route change notifier by @pappz in #1431
- Netstack by @pappz in #1403
- Cancel peer expiration scheduled job when deleting account by @mlsmaycon in #1434
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.25.2...v0.25.3

What's Changed
- Update pion v3 by @pappz in #1398
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.25.1...v0.25.2

What's Changed
- Change docker base image by @pascal-fischer in #1405
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.25.0...v0.25.1

What's Changed
- Specify ref for sync tag workflow by @surik in #1365
- Fix ListUsers method in MockAccountManager by @surik in #1367
- Enable JWT group-based user authorization by @bcmmbaga in #1368
- Fix SaveOrAddUser and GetPeers methods in MockAccountManager by @surik in #1374
- Fix jwks validation and flag/config overriding by @mlsmaycon in #1380
- Fix nil pointer handling in get peers from group by @pascal-fischer in #1381
- Add JWT group-based access control for adding new peers by @bcmmbaga in #1383
- Support status filter by names by @mlsmaycon in #1387
- Allow removal of preshared keys by @pascal-fischer in #1385
- feat: organizing infrastructure_files folder and adds new envs by @diegocn in #1235
- Update .gitignore to exclude all generated files by @mlsmaycon in #1394
- Feature/add iOS support by @pascal-fischer in #1244
- Improve release workflows speed by @mlsmaycon in #1397
New Contributors
- @diegocn made their first contribution in #1235
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.24.4...v0.24.5

What's Changed
- Update signing pipelines to version 0.0.10 by @mlsmaycon in #1329
- Add Windows version to correct system info field by @mlsmaycon in #1330
- Prepare regexps on compile time by @surik in #1327
- Add gocritic linter by @surik in #1324
- Fix panic on empty username for invites by @mlsmaycon in #1334
- Add account deletion endpoint by @mlsmaycon in #1331
- Fix group membership for peers API response by @mlsmaycon in #1337
- Fix the inability to set hostname with the flag in daemon mode by @bcmmbaga in #1339
- Fix IPv6 format for DNS address received from android by @mlsmaycon in #1350
- add owner role support by @mlsmaycon in #1340
- Add gosec linter by @surik in #1342
- Extend add peer event meta with setup key name by @pascal-fischer in #1353
- Add peer and settings validation by @pascal-fischer in #1341
- Chore: clean gomod reference by @pascal-fischer in #1355
- Implement lightweight method to check is peer has update channel by @surik in #1351
- Fix tests after peer validation by @pascal-fischer in #1358
- Add sync-main.yml GitHub workflow by @surik in #1359
- Fix/acl for forward by @pappz in #1305
- Add sync-tag.yml GitHub workflow by @surik in #1362
- Update API descriptions and examples by @mlsmaycon in #1364
- Add Dev Container Support section in contributing guideline by @surik in #1363
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.24.3...v0.24.4

Release notes
New features
Client update notification
Now, GUI clients will notify users of the new version available to download:
imageThe client will redirect Linux and homebrew users to the installation doc.
Enhancements
Network routes default gateway handling
Network routes now handle ranges that contain the IP address of the local system's default gateway. Instead of not configuring the route, the client checks if the range is smaller than the existing one and adds a backup route to the default gateway using the local range.What's Changed
- Log auth0 batch length by @mlsmaycon in (#1255)
- Fix Windows firewall message check by @mlsmaycon in (#1254)
- Pass JWT Claims Extractor to Integrations by @surik in (#1258)
- Fix network route adding rule to filter table by @mlsmaycon in (#1266)
- Feature/update check by @pappz in (#1232)
- Extends management user and group structure by @bcmmbaga in (#1268)
- Remove logging of User names on Debug level by @surik in (#1275)
- fix some typo spotted with codespell by @Fantu in (#1278)
- Add integration reference field to group by @bcmmbaga in (#1283)
- Feature/search domain for android by @pappz in (#1256)
- Fix black icon background on Win by @pappz in (#1269)
- Parse original resolv.conf by @pappz in (#1270)
- Bump golang.org/x/image from 0.5.0 to 0.10.0 by @dependabot in (#1285)
- Bump google.golang.org/grpc from 1.55.0 to 1.56.3 by @dependabot in (#1252)
- Add basic support of devcontainer by @surik in (#1280)
- Extend devcontainer with dind and go features by @surik in (#1292)
- Add integration activity events by @bcmmbaga in (#1293)
- Add codespell job by @mlsmaycon in (#1281)
- Extend API with accessible peers by @pappz in (#1284)
- Enable deletion of integration resources by @bcmmbaga in (#1294)
- Export account manager events store by @bcmmbaga in (#1295)
- Log access control error by @mlsmaycon in (#1299)
- Extend linter rules by @surik in (#1300)
- Extend AccountManager with external cache and group/user management methods by @surik in (#1289)
- Allow to update IntegrationReference for user by @surik in (#1308)
- Fix PAT copy for GetUserByTokenID in SQLite store by @surik in (#1312)
- Add non-deletable service user by @bcmmbaga in (#1311)
- Use email address for iphone name generation by @pascal-fischer in (#1315)
- Add metrics for PeersUpdateManager by @surik in (#1310)
- Fix duplicated Activity events shown by @pascal-fischer in (#1309)
- Improve Account cache reload condition by @surik in (#1319)
- Optimize IdP user deletion by @bcmmbaga in (#1320)
- Fix lookupCache to work when idp has more users by @surik in (#1321)
- Add tenv linter by @surik in (#1322)
- Add client UI shortcut links for standard users in Windows by @bcmmbaga in (#1323)
- Fix windows os info by @pascal-fischer in (#1326)
- systemd units for the client, management & signal services by @hg in (#1318)
- Remove the gateway check for routes by @mlsmaycon in (#1317)
Big thanks to our new contributors
- @nazarewk made their first contribution in (#612)

Release notes
These release notes summarize what happened in the previous, 0.23, and now with the 0.24 release. There are cool new features and long-awaited enhancements that we want to share.New features
Mark match domains as search domains
We added support to mark a match domain as a search domain in your peers' systems. See the configuration option below:The client support was added as part of the release v0.24.0.
This option makes ping or accessing internal nodes easier by simply using their hostname. See example below:

ping -c 4 server

PING server.corporate.internal (10.75.251.48): 56 data bytes
64 bytes from 10.75.251.48: icmp_seq=0 ttl=64 time=239.124 ms
64 bytes from 10.75.251.48: icmp_seq=1 ttl=64 time=240.239 ms
64 bytes from 10.75.251.48: icmp_seq=2 ttl=64 time=238.940 ms
64 bytes from 10.75.251.48: icmp_seq=3 ttl=64 time=235.171 ms

--- server.corporate.internal ping statistics ---
4 packets transmitted, 4 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 235.171/238.368/240.239/1.912 ms

Ephemeral peers
When creating a setup key, you can enable an option to make all peers activated by the setup key ephemeral peer. See the option below:Ephemeral peers will be deleted from the management system after 10 minutes of disconnection. This feature allows for use cases like running agents on containers, auto-scaling groups, and even CI/CD; checkout this great contribution from @Alemiz112: Routing groups
We have added support to routing group in the network routes feature; it allows administrators to configure groups, combined with setup keys auto-groups to automatically assign new peers as routers for a specific network range. Combine this with ephemeral peers to have stateless routers:SQLite store
We added experimental support to SQLite for the Management service store. See docs at https://docs.netbird.io/selfhosted/sqlite-storeThis store is note recommended for production
JWT group sync
For self-hosted deployments, we made available an option to synchronize user groups from their JWT tokens. See image below:Each IDP has its way of configuring JWT claims, but the only requirement from our side is to send the list of groups in a single claim. We are looking for contributions to update our documentation for the various IDPs that can be integrated with NetBird.Talking about that, we added support to JumpCloud IDP; see docs here: https://docs.netbird.io/selfhosted/identity-providers#jump-cloudEnhancements:
Refresh button
Now you can refresh the list of resources in your account by using a refresh button:
User deletion
Account administrators can now delete users. See example below:Be aware that the peers that belong to the deleted user will be removed from the account.User group propagation
We now support group propagation from users to the peers they own:What's Changed
- Implement SQLite Store using gorm and relational approach by @surik in (#1065)
- Move StoreKind under own StoreConfig configuration and rename to Engine by @surik in (#1219)
- chore: pkg import only once by @testwill in (#1222)
- Update contribution guide with go version and Windows driver by @mlsmaycon in (#1226)
- Use account creator as inviter as a fallback by @mlsmaycon in (#1225)
- Add management-integrations by @surik in (#1227)
- Make possible set IdpSignKeyRefreshEnabled from setup.env by @Fantu in (#1230)
- Contribution guide - Explicitly disable CGO for client by @mlsmaycon in (#1228)
- Update grpc clients' keepalive interval by @mlsmaycon in (#1231)
- Fix update script's failure to update netbird-ui in binary installation by @bcmmbaga in (#1218)
- Add search domains support by @mlsmaycon in (#1224)
- Update management.json template with all existing configuration parameters by @pascal-fischer in (#1182)
- Log store engine type by @mlsmaycon in (#1234)
- Fix SaveUserLastLogin in SQLite store by @surik in #1241
- Fix GetAccountByPrivateDomain for SQLite by @surik in #1242
- Support pinning version during binary install by @glemsom 

What's Changed
- Fix SaveUserLastLogin in SQLite store by @surik in #1241
- Fix GetAccountByPrivateDomain for SQLite by @surik in #1242
- Support pinning version during binary install by @glemsom in #1237
- Bump golang.org/x/net from 0.10.0 to 0.17.0 by @dependabot in #1214
- Log client version on startup by @mlsmaycon in #1240
New Contributors
- @glemsom made their first contribution in #1237
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.24.0...v0.24.1

What's Changed
- Implement SQLite Store using gorm and relational approach by @surik in #1065
- Move StoreKind under own StoreConfig configuration and rename to Engine by @surik in #1219
- chore: pkg import only once by @testwill in #1222
- Update contribution guide with go version and Windows driver by @mlsmaycon in #1226
- Use account creator as inviter as a fallback by @mlsmaycon in #1225
- Add management-integrations by @surik in #1227
- Make possible set IdpSignKeyRefreshEnabled from setup.env by @Fantu in #1230
- Contribution guide - Explicitly disable CGO for client by @mlsmaycon in #1228
- Update grpc clients' keepalive interval by @mlsmaycon in #1231
- Fix update script's failure to update netbird-ui in binary installation by @bcmmbaga in #1218
- Add search domains support by @mlsmaycon in #1224
- Update management.json template with all existing configuration parameters by @pascal-fischer in #1182
- Log store engine type by @mlsmaycon in #1234
New Contributors
- @testwill made their first contribution in #1222
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.23.9...v0.24.0

What's Changed
- Add Pagination for IdP Users Fetch by @bcmmbaga in #1210
- Rework peer connection status based on the update channel existence by @surik in #1213
- Fix nil pointer exception in group delete by @pappz in #1211
- Fix/key backup in config script by @pappz in #1206
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.23.8...v0.23.9

What's Changed
- Improve updateAccountPeers by bypassing AM and using account directly by @surik in #1193
- Account Manager code cleanup by @surik in #1192
- Add infrastructure docker build tests for management and signal by @bcmmbaga in #1180
- Use the PCKE flow in the UI by @braginini in #1196
- Always call Login from UI with the desktop flag by @braginini in #1200
- Run linter action on MacOS and Windows by @surik in #1198
- Fix routing groups expand and filtering by @mlsmaycon in #1203
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.23.7...v0.23.8

What's Changed
- Delete user peers when deleting a user by @braginini in #1186
- Add routing groups metrics by @mlsmaycon in #1187
- Prevent return extra userData by @mlsmaycon in #1190
- Optimize Cache and IDP Management by @bcmmbaga in #1147
- Reorder peer deletion when deleteing a user by @braginini in #1191
- Add jumpcloud IdP by @bcmmbaga in #1124
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.23.6...v0.23.7

What's Changed
- Add peer groups support for network routes by @surik in #1150
- Update the description for the delete method for user API by @mlsmaycon in #1160
- Reimplement isValidAccessToken without reflect package by @surik in #1183
- Enhance compatibility of install.sh for systems without sudo by @bcmmbaga in #1176
- Fix peer login expiration event duplication by @braginini in #1185
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.23.5...v0.23.6

What's Changed
- Add management_grpc_updatechannel_queue_bucket histogram by @surik in #1158
- Fix Update Failure in Netbird Installer Script by @bcmmbaga in #1169
- Remove comments from iptables by @pappz in #1165
- fix: missing NETBIRD_TOKEN_SOURCE by @trungle-ds in #1174
- Avoid writing config if datastore key exists by @pascal-fischer in #1177
- install.sh: Sync Debian keys and repo source file location with docs by @shvchk in #1172
- Remove unnecessary global lock by @surik in #1178
- Expose store metrics with milliseconds bucketing by @surik in #1179
- Resolve client authentication issue in daemon mode by @bcmmbaga in #1181
New Contributors
- @trungle-ds made their first contribution in #1174
- @shvchk made their first contribution in #1172
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.23.4...v0.23.5

What's Changed
- Revert zitadel update parameters endpoint by @mlsmaycon in #1163
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.23.3...v0.23.4

What's Changed
- Add direct write file to avoid moving docker mounted files by @mlsmaycon in #1155
- Fix/user deletion by @pappz in #1157
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.23.2...v0.23.3

What's Changed
- Fix Android build by @pappz in #1142
- Add Android test build by @pappz in #1144
- fix NETBIRD_SIGNAL_PORT not working with custom port by @Fantu in #1145
- Add signal port tests to CI workflow by @mlsmaycon in #1148
- Remove unused methods from AccountManager interface by @surik in #1149
- Fix sso check by @pappz in #1152
- Improve Client Authentication by @bcmmbaga in #1135
- Handle user delete by @gigovich in #1113
New Contributors
- @Fantu made their first contribution in #1145
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.23.1...v0.23.2

What's Changed
- Set not found ebpf log to Info by @mlsmaycon in #1134
- Fix: docker test for infrastructure files by @mlsmaycon in #1136
- Update Linux Desktop Detection Check by @bcmmbaga in #1137
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.23.0...v0.23.1

What's Changed
- Add auto-update feature in netbird script for binary installation by @bcmmbaga in #1106
- Close PKCE Listening Port After Authorization by @bcmmbaga in #1110
- Fix log formatter initialization in mgm cmd by @pappz in #1112
- Add sharedsock example by @braginini in #1116
- Fix API auth using PATs with different userIDClaims by @pascal-fischer in #1120
- Add Wix file for MSI builds by @mlsmaycon in #1099
- Feature/ephemeral peers by @pappz in #1100
- Add safe security headers to improve the security by @luzfcb in #1121
- Update GitHub Actions and Enhance golangci-lint by @surik in #1075
- Use github token to read api by @mlsmaycon in #1125
- Ignore empty fields in the app metadata when storing on IDP by @braginini in #1122
- Allow netbird traffic by @gigovich in #1056
- DNS forwarder and common ebpf loader by @pappz in #1083
- Account ephemeral setup keys metrics by @mlsmaycon in #1128
- Update ephemeral field on the API response by @mlsmaycon in #1129
New Contributors
- @luzfcb made their first contribution in #1121
Full Changelog: https://github.com/netbirdio/netbird/compare/v0.22.7...v0.23.0