Lataa Netbird 0.80.0

Release Notes for v0.80.0
What's New
🔒 Security and Access Control
- Refused to pin an agent network gateway onto another account's host, adding cross-account validation for gateway assignments. #7519
- Validated proxy cluster on Agent Network bootstrap, preventing an agent network from bootstrapping onto another account's proxy cluster. #7402
- Refused HTTP redirects on IdP clients, preventing open redirect attacks against identity provider integrations. #7579
- Revoked local Dex session on embedded IdP password change, ensuring sessions are properly invalidated when credentials are updated. #7556
- Added upload URL signing and rate limiting for file upload endpoints. #7502
🖥️ Client Improvements
- Staged install script downloads in a private temp directory, preventing other processes from tampering with downloaded files before installation. #7534
- Enforced HTTPS on install script downloads, ensuring all client downloads use secure connections. #7545
- Fixed peers not being notified when the relay connection drops, which could leave stale peer state after a relay disconnect. #7490
- Fixed session deadline read under the status read lock, preventing a potential race condition. #7550
- Removed the empty GPO DNS policy store on Windows teardown, cleaning up leftover DNS policy entries when the client shuts down. #7563
- Resolved the shared socket source address through a connected UDP probe socket, fixing source address resolution for shared socket mode. #7633
- Validated saved service parameters and pinned the netsh lookup on Windows, hardening the service configuration path. #7584
- Used POSIX-style file read/write of JSON on Windows, improving cross-platform config file handling. #7631
- Raised the daemon IPC receive limit to 16 MB, matching gRPC's default and preventing truncation of large messages. #7676
- Skipped route firewall rule computation when no firewall is configured, avoiding unnecessary work. #7624
- Fixed device dump clearing all peer endpoints instead of just the target one, which could disrupt connections to other peers. #7632
- Fixed Windows IPC privilege check to only treat LocalSystem as a privileged identity by SID. Local Service and Network Service now go through the same checks as any other caller. #7889
- Bumped Wails to v3.0.0-beta.25 for the desktop UI. #7640
⚙️ Management Improvements
- Sped up test store setup and summarized unit test runs, improving CI performance. #7518
- Read X-Real-IP when extracting the peer connection IP, supporting deployments behind reverse proxies. #7561
- Handled empty trusted peer to avoid errors when no trusted peer is configured. #7589
- Named the account owner in the pending approval error, making it clear who to contact for account approval. #7533
- Fixed group resource validation for proper enforcement. #7608
- Added store support to filter by public ID. #7208
- Recorded proxy version on connect for tracking and debugging. #7630
- Split store by table for improved database performance and organization. #7646
- Prevented deleting custom domains used by services, protecting active proxy configurations from accidental removal. #7515
- Moved rate limiter to shared package for reuse across services. #7727
- Let usage_viewer read Agent Network access logs, so users reviewing cost can now see the requests behind usage metrics. #7750
🔀 Reverse Proxy
- Closed the client connection on private service denials instead of leaving it hanging. #7590
- Added proxy rate limiter to protect against abuse. #7568
- Added proxy credentials limiter on management to throttle authentication attempts. #7569
- Fixed upstream HTTP version applied before cloning transports. #7806
- Added release-wired UBI image variant for the proxy. #7464
- Fixed flow auth secret for external Relay migrations. #7731
🏗️ Infrastructure and CI
- Certified the rootless UBI client image on release for Red Hat ecosystem compliance. #7525
- Fixed RPM metadata for Red Hat software certification (two rounds of fixes). #7562, #7614
- Added proxy support to enterprise setup. #7651
- Built the upload server from source, nonroot on Chainguard for a hardened container image. #7663
- Built and linted mobile Go code in CI for Android. #7641
- Bumped workflow actions off the retired Node 20 runtime. #7644
- Added Pyroscope profiling to management, signal, and proxy services. #7536
- Pointed the agent-config e2e providers at the mock upstream. #7542
- Used the Silo image for the S3 upload test. #7619
📝 Misc
- Pointed bug reports at Discussions and added SUPPORT.md. #7647
- Added cloud API spec to the public OpenAPI definition with REST client. #7222
- Loaded AGENTS.md every session and refused attribution trailers. #7544
What's Changed
- [management] Speed up test store setup and summarize the unit test run by @mlsmaycon in #7518
- [management] Refuse to pin an agent network gateway onto another account's host by @mlsmaycon in #7519
- [management] Validate the proxy cluster an agent network bootstraps onto by @mlsmaycon in #7402
- [management] Point the agent-config e2e providers at the mock upstream by @mlsmaycon in #7542
- [client] Stage install script downloads in a private temp directory by @riccardomanfrin in #7534
- [client] Read the session deadline under the status read lock by @pappz in #7550
- [client] Enforce HTTPS on install script downloads by @riccardomanfrin in #7545
- [misc] Load AGENTS.md every session and refuse attribution trailers by @mlsmaycon in #7544
- [client] Fix - Add RPM metadata required for Red Hat software certification by @braginini in #7562
- [management] Read X-Real-IP when extracting the peer connection IP by @bcmmbaga in #7561
- [management] Handle empty trusted peer by @bcmmbaga in #7589
- [proxy] Close the client connection on private service denials by @mlsmaycon in #7590
- [management] Name the account owner in the pending approval error by @heisbrot in #7533
- [proxy] add proxy rate limiter by @pascal-fischer in #7568
- [management] Add proxy credentials limiter on management by @pascal-fischer in #7569
- [client] Fix peers not being notified when the relay connection drops by @pappz in #7490
- [management] fix group resource validation by @pascal-fischer in #7608
- [client] Remove the empty GPO DNS policy store on Windows teardown by @lixmal in #7563
- [management] add store support to filter by public id by @pascal-fischer in #7208
- [client,management] Skip route firewall rule computation when no firewall by @riccardomanfrin in #7624
- [management] record proxy version on connect by @pascal-fischer in #7630
- [management,signal,proxy] add pyroscope profiling by @pascal-fischer in #7536
- [client] Validate the saved service parameters and pin the netsh lookup by @riccardomanfrin in #7584
- [client] Use POSIX style file read/write of json for windows by @theodorsm in #7631
- [client] Fix RPM metadata for Red Hat certification by @braginini in #7614
- [misc] Bump workflow actions off the retired Node 20 runtime by @heisbrot in #7644
- [misc] Add upload URL signing and rate limiting by @bcmmbaga in #7502
- [misc] Use the Silo image for the S3 upload test by @Silex in #7619
- [management] split store by table by @pascal-fischer in #7646
- [management] Refuse HTTP redirects on IdP clients by @bcmmbaga in #7579
- [management] Revoke local Dex session on embedded IdP password change by @bcmmbaga in #7556
- [misc, android] Build and lint the mobile Go code in CI by @riccardomanfrin in #7641
- [client] Raise the daemon IPC receive limit gRPC's to 16 MB by @riccardomanfrin in #7676
- [misc] Build the upload server from source, nonroot on Chainguard by @bison in #7663
- [infrastructure] Certify the rootless UBI client image on release by @braginini in #7525
- [client] Resolve the shared socket source address through a connected UDP probe socket by @lixmal in #7633
- [proxy] Add a release-wired UBI image variant by @jnfrati in #7464
- [infrastructure] Add proxy support to enterprise setup by @bcmmbaga in #7651
- [doc] Point bug reports at Discussions and add SUPPORT.md by @thomashacker in #7647
- [management] Prevent deleting custom domains used by services by @mlsmaycon in #7515
- [management] move rate limiter to shared package by @pascal-fischer in #7727
- [client] Bump wails to v3.0.0-beta.25 by @pappz in #7640
- [client] Stop dumping the whole device to clear one peer endpoint by @lixmal in #7632
- [infrastructure] Fix flow auth secret for external Relay migrations by @braginini in #7731
- [proxy] Apply the upstream HTTP version before cloning transports by @mlsmaycon in #7806
- [management] Let usage_viewer read Agent Network access logs by @jnfrati in #7750
- [client] Only treat LocalSystem as a privileged identity by SID on Windows by @lixmal in #7889
New Contributors
- @thomashacker made their first contribution in #7647
Full Changelog: v0.79.0...v0.80.0