| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: netbird-bash-completion | Distribution: openSUSE Tumbleweed |
| Version: 0.74.7 | Vendor: openSUSE |
| Release: 1.2 | Build date: Fri Jul 17 18:31:16 2026 |
| Group: Unspecified | Build host: reproducible |
| Size: 16213 | Source RPM: netbird-0.74.7-1.2.src.rpm |
| Packager: http://bugs.opensuse.org | |
| Url: https://github.com/netbirdio/netbird | |
| Summary: Bash Completion for netbird | |
Bash command line completion support for netbird.
AGPL-3.0-only AND BSD-3-Clause
* Fri Jul 17 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.74.7
- [relay] Handle QUIC connections concurrently to prevent
handshake head-of-line blocking by @lixmal in #6784
- [client] Reject leading hyphen in getent input to prevent flag
injection by @lixmal in #6787
- [client] Sanitize peer FQDN/hostname in generated SSH config by
@riccardomanfrin in #6805
- [client] Disable gVisor TCP RACK loss detection on Windows by
@lixmal in #6808
- [client] Rename isValidAccessToken to reflect audience-only
check by @riccardomanfrin in #6806
- [client] Bind netstack SOCKS5 proxy to 127.0.0.1 by default by
@riccardomanfrin in #6812
- [client] Evaluate IP fragments against firewall ACLs by @lixmal
in #6781
* Thu Jul 16 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.74.6
- [client] ios: preserve WireGuard key on interactive re-login
(#6777)
* Tue Jul 14 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.74.5
- [proxy] enforce model allowlist for URL-routed providers
(Bedrock/Vertex) by @mlsmaycon in #6764
- [management] Remove proxy peer stale deduplication logic by
@mlsmaycon in #6768
* Sat Jul 11 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.74.4
- [management] fix: prevent reverse proxy domain from being
pushed as DNS search domain by @blaugrau90 in #6498
- [client] Recover from rosenpass key desync by @lixmal in #6714
- [client] Bump golang.org/x/crypto to v0.54.0 by @lixmal in
[#6709]
* Wed Jul 08 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.74.3
- [client] fix MDM managementURL conflict on default-port URL
echo by @riccardomanfrin in #6672
- [client] Update gopsutil to v4 by @mlsmaycon in #6688
- [client] Fix hanging status command during relay dial by
@theodorsm in #6694
* Fri Jul 03 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.74.2
- [management] Add vLLM e2e test by @braginini in #6649
- [misc] Fix GHCR image push after dockers_v2 migration by
@mlsmaycon in #6653
- [client] Increase management client gRPC receive limit default
to 16MB by @riccardomanfrin in #6641
- [client] Fix slow wg operations by @pappz in #6633
- [client] backport enforce a single selected exit node by @pappz
in #6640
- [client] Fix backoff.Ticker goroutine leak in reconnect guard
by @theodorsm in #6663
* Thu Jul 02 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.74.1
- [client] Make lazy connections opt-out via NB_LAZY_CONN by
@lixmal in #6617
- [client] Run privileged client tests natively with sudo on
Linux by @pappz in #6635
- [self-hosted] Remove image override logic in getting started by
@mlsmaycon in #6636
- [management] Add vLLM support for Agent Network by @braginini
in #6643
- [management] return nil when config is not set by @mlsmaycon in
[#6642]
* Wed Jul 01 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.74.0
New Feature: Agent Network
This release introduces Agent Network, a per-account LLM gateway
that gives people and agents keyless, identity-based access to
LLM APIs and internal resources over the tunnel. It is built on
top of the existing reverse proxy and private services, so the
transport is still NetBird's WireGuard overlay and the identity
model is still your IdP. Have a tunnel, get access; no tunnel, no
access.
Agents point at a tunnel-only endpoint instead of the provider's
URL. NetBird holds the upstream provider key server-side, injects
it per request, and ties every call to a real identity from your
IdP. Client-supplied auth headers are stripped before the request
is forwarded, so a hardcoded key never reaches the provider. The
whole thing is default deny: nothing reaches a provider until a
policy explicitly allows it.
Core capabilities:
- Keyless access to LLM APIs. No keys stored or shared on the
client. The tunnel is the credential.
- Provider catalog. First-party APIs (OpenAI, Anthropic, Azure
OpenAI, AWS Bedrock, Google Vertex AI, Mistral), AI gateways
(LiteLLM Proxy, Portkey, Bifrost, Cloudflare AI Gateway, Vercel
AI Gateway, OpenRouter), and any custom/self-hosted
OpenAI-compatible endpoint (Ollama, vLLM, local GPU hosts).
- Policies. A policy connects a Source Group (users or agent
devices from your IdP) to one or more providers.
- Limits. Token caps and budget (USD) caps per user and per
group, plus account-wide Global Limits that can only tighten a
policy, never loosen it.
- Guardrails. Model allowlist, optional prompt capture, and PII
redaction on captured logs.
- Usage and access logs. Per-request accounting (identity,
provider, model, tokens, cost) plus a full access log (method,
path, status, duration, and prompt/completion when capture is
on), with denied-request reasons, 7-90 day or indefinite
retention, and filtering by user or group.
- Agentic access to internal resources. Databases, internal APIs,
and self-hosted models reachable over peer-to-peer WireGuard,
no proxy in the path, governed by the same identities and
policies.
- Bring your own gateway. When forwarding to LiteLLM, NetBird
passes the calling identity along by writing IdP groups into
metadata.tags and the identity into the x-litellm-end-user-id
header.
- The dashboard ships copy-paste Agent Config for Claude Code,
Codex, the OpenAI SDK, and cURL, with the endpoint pre-filled
and no API key involved.
Overview: https://docs.netbird.io/agent-network
Quickstart: https://docs.netbird.io/agent-network/quickstart
How it works: https://docs.netbird.io/agent-network/how-it-works
Providers: https://docs.netbird.io/agent-network/providers
- Agent Network
- Added the per-account LLM gateway (Agent Network): store,
manager, policy engine, provider catalog, and management HTTP
+ proxy gRPC surfaces, with the reverse-proxy middleware
chain handling limit checks, cost metering, guardrails,
identity injection, and response parsing. #6555
- Added agent-network telemetry metrics. #6561
- Added management-controlled client metrics push. #5886
- Added per-provider skip_tls_verification for Agent Network.
[#6630]
- Added Agent Network preset for self-hosted deployments. #6569
- Added Agent Network documentation and banner updates. #6562
[#6564]
- Added Agent Network nightly/manual E2E workflows. #6629
- Client Improvements
- Added management-controlled client metrics push. #5886
- Eliminated packet loss during lazy connections. #6355
- Reinject captured first packet on lazy connection activation.
[#6572]
- Improved network address filtering. #6515
- Fixed empty profile handle regression in debug config. #6514
- Skip re-resolving cached management cache domains. #6518
- Suppress Quick Actions popup when DisableAutoConnect=true.
[#6542]
- Fix blocked status lock via relay manager path. #6547
- Lower ICE handshake offer/answer log level to debug. #6565
- Keep signal stream alive while receive loop is blocked on
worker handoff. #6530
- Wait for signal receive watchdog to stop before reconnect.
[#6574]
- Report management unhealthy while Sync stream is failing.
[#6575]
- Refresh receive liveness when worker handoff drains. #6594
- Raise duration validation limit to 24 hours. #6598
- Skip firewall ruleset rebuild when config is unchanged. #6508
- Bound system info and posture-check gathering with a timeout
to prevent sync-loop freeze. #6512
- Categorize privileged tests behind a build tag and run them
in Docker. #6425
- Forward non-address DNS record types through route
forwarders. #6455
- Add per-phase timing metrics for sync processing. #6533
- Use dedicated IsHealthy RPC for management health checks.
[#6421]
- Fix pointer comparisons in profile config apply. #6622
- Fix race between WG watcher initial handshake read and
endpoint creation. #6626
- Management Improvements
- Rescheduled inactivity expiration when a peer disconnects.
[#6523]
- Validate posture checks on metadata changes before updating
the account. #6527
- Relaxed metaHash validation when blocking peers. #6531
- Simplified affected peers processing by ignoring disabled
peers. #6540
- Optimized affected posture checks and added additional
logging. #6522
- Restored client version checks in the login filter hash.
[#6552]
- Added peer expiration reason to activity metadata. #6619
- Detached JWT group synchronization from request cancellation.
[#6621]
- Enabled Lazy Connections by default for new accounts. #6571
- Infrastructure & Miscellaneous
- Applied small GitHub workflow fixes. #6546
- Updated the careers page link. #6538
- Bumped GitHub Actions dependencies. #6550
- Updated the project to v0.74.0. #6563
- Required on-premise EULA acceptance in Enterprise
installation scripts. #6596
* Mon Jun 22 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.73.2
- [misc] Bump the actions group across 1 directory with 9 updates
by @dependabot[bot] in #6451
- [client] Surface DNS forwarder upstream failures via Extended
DNS Errors by @lixmal in #6441
- [misc] Add TARGETPLATFORM build argument to Docker build
commands by @mlsmaycon in #6499
- [client] Add Auth.Stop() to cancel an in-progress interactive
login by @pappz in #6486
- [client] Fix engine lifecyrcle race by @pappz in #6443
- [client] fix WaitStreamConnected test call after ctx signature
change by @pappz in #6503
- [misc] Add enterprise getting-started and migrate script by
@bcmmbaga in #6501
- [management] do not use meta diff for login by @pascal-fischer
in #6502
- [management] validate meta change against posture checks by
@pascal-fischer in #6510
- [management] empty file check in nmap on other posturechecks by
@pascal-fischer in #6511
* Fri Jun 19 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.73.1
- Client Improvements
- Fixed profile regressions affecting up --profile and status
commands. #6479
- Reduced false-positive DNS health warnings. #6453
- Fixed DNS custom zone teardown issues, including handler
leaks and external CNAME resolution. #6445
- Management Improvements
- Removed database calls from nested loops to improve
efficiency. #6470
- Fetched complete user data in ValidateTunnelPeer. #6457
- Reduced sync and login transaction overhead. #6472
- Added peer metadata diff logging. #6468
- Infrastructure & Tooling
- Removed the v prefix from Docker image tags. #6471
- Improved FreeBSD port scripts to correctly handle release
candidates when fetching tags. #6480
* Thu Jun 18 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.73.0
- Client Improvements
- Added MDM configuration profile support for Windows Registry
and macOS plist deployments. #6374
- Improved DNS handling by answering NODATA instead of SERVFAIL
when a host has no addresses of the requested family. #6418
- Added WASM WebSocket dialing support. #5980
- Added iOS debug bundle support in Go. #6270
- Added IsLoginRequiredCached support for iOS clients. #6447
- Improved exit-node handling by propagating deselect actions
to synthesized IPv6 routes. #6296
- Migrated profile identity from display name to ID and added
support for profile renaming. #6367
- Improved reliability by recovering from TUN device read/write
panics and automatically restarting the client. #6419
- Added detection and recovery for stalled signal receive
streams. #6459
- Fixed iOS route notification ordering. #6454
- Dropped the signaling-side ICE filter and improved overlay
STUN handling. #6142
- Exposed relay transport and connection errors in client
status output and metrics. #6342
- Management Improvements
- Skipped JWT group evaluation for embedded-IdP local users.
[#6422]
- Treated ci- builds as development builds for remote jobs.
[#6436]
- Optimized network map generation for affected peers. #6105
- Deleted targets automatically when deleting exposed services.
[#6442]
- Removed network map calculation from login flow. #6449
- Passed meta updates for browser clients. #6465
- Fixed flaky SaveAccount tests caused by random IP collisions.
[#6452]
- Synced OpenAPI specifications and added workflow validation.
[#6437]
- Proxy Enhancements
- Kept custom TCP listeners alive after mapping batches. #6415
- Fixed UDP relay context handling. #6444
- Signal Improvements
- Serialized concurrent sends to peer streams to improve
stability. #6463
- Infrastructure & Tooling
- Improved GoReleaser release candidate handling and updated
Docker build workflows. #6438
* Fri Jun 12 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.72.4
- [client] Index peer tunnel IPs for faster PeerStateByIP lookup
by @mlsmaycon in #6412
* Wed Jun 10 2026 Marcus Rueckert <mrueckert@suse.de>
- Netbird does not really comply to the format for /etc/sysconfig/
so using /etc/default/${servicename} is a better idea. For
backwards compatibility reasons we will still load the old path
but the new path is preferred to be used.
* Wed Jun 10 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.72.3
- Client Improvements
- Added commands to discover and write Kubernetes
configuration. experimental #6260
- Masked sensitive data during debug bundle creation. #6364
- Preserved user deselect-all route preferences across
management syncs. #6363
- Fixed state manager crashes caused by concurrent iptables map
access. #6345
- Added WebSocket relay fallback when QUIC datagrams exceed
transport limits. #6339
- Filtered DNS fallback upstreams matching NetBird server IPs
to prevent loops. #6183
- Preserved posture checks on configuration-only sync updates.
[#6373]
- Improved embedded client shutdown by canceling context before
stopping the engine. #6397
- Management Improvements
- Added IPv6 default permit rules for exit node routes. #6368
- Logged user agent information and returned request IDs. #6380
- Added version gating to stop sending deprecated RemotePeers
field. #6371
- Fixed L4 service updates when no custom port is configured.
[#6396]
- Proxy Enhancements
- Added non-blocking mapping updates. #6369
- Improved certificate handling by notifying readiness for
domains covered by static certificates. #6389
- Switched proxy ID generation to UUIDs. #6391
- Infrastructure & Tooling
- Improved support for atomic Linux distributions in install
scripts and fixed Docker-related issues in
getting-started.sh. #6139
- Updated the Go toolchain version in go.mod. #6377
* Sun Jun 07 2026 Holden Fried <holden@opensuse.org>
- Update to 0.72.2
- [management] resolve private services on custom domains in
synthesized DNS zones by @mlsmaycon in
https://github.com/netbirdio/netbird/pull/6348
* Sat Jun 06 2026 Marcus Rueckert <mrueckert@suse.de>
- Update service-install-cli-change.patch:
Add more guidance how to manage the drop in files
* Fri Jun 05 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.72.1
- [management] Copy private field on shallowCloneMapping by
@mlsmaycon in #6347
* Fri Jun 05 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.72.0
- Private Service Expose & Reverse Proxy
- Added support to expose NetBird-only services over tunnel
peers across management, client, and proxy. #6226
- Added follow-up fixes for private reverse-proxy services.
[#6268]
- Added private service expose support in the dashboard.
netbirdio/dashboard#646
- Updated reverse proxy modals in the dashboard.
netbirdio/dashboard#661
- Bound embed client WireGuard per-device memory across proxy
and client. #5962
- Client Improvements
- Filtered scoped/cloned default routes from BSD network
monitor. #6208
- Matched DNS wildcard handlers on label boundaries. #6255
- Refactored Linux system info to use syscalls. #6230
- Released WASM js.FuncOf callbacks in SSH and RDP paths. #5982
- Fixed possible deadlock in statemanager Stop. #6228
- Improved Rosenpass support. #6136
- Recognized NetBird DNS forwarder port in capture text format.
[#6177]
- Applied netroute default-gateway workaround on Android. #6192
- Captured injected ICMPv6 echo replies in debug capture. #6321
- Gated DNS forwarder on BlockInbound. #6257
- Persisted sync response via pluggable store, including disk
support on iOS. #6331
- Allowed WireGuard port to be zero in UI and showed the port
in status command. #6158
- Prevented corruption from competing log rotation and improved
debug bundle. #6214
- Management Improvements
- Fixed owner role update. #6264
- Refactored management server bootstrap. #6256
- Updated log levels. #6266
- Extended nmap monitoring. #6271
- Added SSO session extend flow. #6197
- Extended combined server initialization. #6156
- Enriched context in permissions manager. #6286
- Exported ResolveDomain. #6334
- Dashboard Improvements
- Added simplified dashboard layout. netbirdio/dashboard#649
- Fixed broken SSH and RDP in the dashboard.
netbirdio/dashboard#650
- Moved setup keys to Settings. netbirdio/dashboard#653
- Improved table filters layout. netbirdio/dashboard#654
- Grouped Networks and Routes under Network Routing.
netbirdio/dashboard#660
- Infrastructure & CI
- Pinned GitHub Actions with SHA and improved workflows. #6249
- Added Codecov integration and coverage reporting across
workflows. #6333
- Allowed Docker image overrides for getting started. #6335
- Exposed VCS revision in dev build version output across
client, management, and misc. #6263
* Thu May 21 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.71.4:
- [client] Revert legacy registry cleanup on Windows install by
@lixmal in #6232
* Wed May 20 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.71.3:
- [management] fix: device redirect uri wasn't registered by
@jnfrati in #6191
- [management] Fence peer status updates with a session token by
@mlsmaycon in #6193
- [management] Add metrics for peer status updates and ephemeral
cleanup by @mlsmaycon in #6196
- [management] Ensure SessionStartedAt has a default value by
@mlsmaycon in #6211
- [proxy] clusters API surfaces type, online status, and
capability flags by @mlsmaycon in #6148
- [misc] Update contribution guidelines by @mlsmaycon in #6219
- [client] Bump macOS sleep callback timeout to 20s by @lixmal in
[#6220]
- [doc] Clean up README by @lixmal in #6178
- [proxy] concurrent proxy snapshot apply by @pascal-fischer in
[#6207]
- [management] scope network router update call by
@pascal-fischer in #6222
- [client] Fix nil channel panic in external chain monitor stop
by @lixmal in #6224
* Sat May 16 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.71.2:
- [management] Avoid peer IP reallocation when account settings
update preserves the network range by @lixmal in #6173
- [management] Avoid context cancellation in cancelPeerRoutines
by @mlsmaycon in #6175
- [client] Clean up legacy 32-bit and HKCU registry entries on
Windows install by @lixmal in #6176
* Fri May 15 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.71.1:
- [client] Mirror v4 exit selection onto v6 pair and honour
SkipAutoApply per route by @lixmal in #6150
- [client] Drop DNS probes for passive health projection by
@lixmal in #5971
- [proxy] auth token generation on mapping by @crn4 in #6157
* Thu May 14 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.71.0:
- IPv6 overlay addressing
NetBird's overlay is now dual-stack. Every account gets its own
IPv6 prefix (default /64, configurable from /48 to /120), and
peers can receive both an IPv4 and an IPv6 overlay address. DNS
serves AAAA and reverse PTR records alongside A records, ACLs
apply to both families automatically, network routes accept
IPv6 CIDRs (with masquerade), exit nodes that route 0.0.0.0/0
get a matching ::/0 route, and domain routes resolve both A and
AAAA. Rollout is group-gated: new accounts enable IPv6 for the
All group by default; existing accounts opt in under Settings >
Network. Assignment is also gated on a per-peer capability, so
older clients keep working on IPv4 until they upgrade. Hosts
can opt out individually with netbird up --disable-ipv6 Read
more in the IPv6 Overlay Addressing announcement and the IPv6
documentation. #5631 by @lixmal
https://netbird.io/knowledge-hub/ipv6-overlay-addressing
https://docs.netbird.io/manage/settings/ipv6
- MFA for local users
- Local users (non-IdP) can now enable multi-factor
authentication, closing a gap for deployments that don't
federate auth through an external provider. #5804 by @jnfrati
- Bring your own proxy (backend ready)
- Backend support for per-account reverse-proxy lifecycle has
landed: proxy tokens, per-account cluster allow-lists,
conflict detection, and one-proxy-per-account enforcement.
Full rollout (dashboard, docs) comes in a later release.
[#5627] by @crn4
- Client Improvements
- Included MTU and SSH auth config in debug bundle by @lixmal.
[#6071]
- Added public key to debug bundle config.txt by @lixmal. #6092
- iOS: structured ResolvedIPs collection for domain routes by
@pappz. #6090
- Used unique temp file and clean up on failure when writing
ssh config by @lixmal. #6064
- Hardened uspfilter conntrack and shared TCP relay by @lixmal.
[#5936]
- Skipped DNS upstream failover on definitive EDE by @lixmal.
[#6089]
- Fixed --config flag default to point at profile path by
@lixmal. #6122
- Bracketed IPv6 in embed listeners, expanded debug bundle by
@lixmal. #6134
- Added short flags for status command options by @mlsmaycon.
[#6137]
- Management Improvements
- Removed permissions from geolocations API by @pascal-fischer.
[#6091]
- Added update reason to buffered calls by @pascal-fischer.
[#6103]
- Allocated and preserved IPv6 overlay addresses for embedded
proxy peers by @lixmal. #6132
- Fixed offline statuses for public proxy clusters by @crn4.
[#6133]
- Bracketed IPv6 reverse-proxy target hosts when building URL
Host field by @lixmal. #6141
- Relay Improvements
- Preserved non-standard port in WS dialer URL prep by @lixmal.
[#6061]
- Misc
- Updated CONTRIBUTING.md by @mlsmaycon. #6076
* Tue May 05 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.70.5:
- Client Improvements
- Added packet capture to debug bundle and CLI. #5891
- Advertised relay server IP via signal for foreign-relay
fallback dial. #6004
- Released Status.mux before invoking notifier callbacks. #6039
- Used ctx.Err() instead of gRPC codes.Canceled to detect
shutdown. #6019
- Used atomic write/rename pattern for SSH config. #5867
- Replaced WG interface polling with netlink subscription on
Linux. #5857
- Displayed QR code for device auth login URL. #5415
- Bumped go-netroute to v0.4.0 and dropped fork. #6062
- Used fwmark-aware route lookup for raw socket UDP checksum
source. #6070
- Management Improvements
- Added monitoring for nmap update source. #6036
- Enabled PAT creation during setup. #6003
- Added public IPv4/IPv6 posture checks. #6038
- Tracked pending approval in peer event metadata. #6040
- Fixed proxy reconnect issues. #6063
- Mapped Entra OID claim as Dex user ID. #6067
- Fixed flaky invite token test. #6077
- Proxy Enhancements
- Consolidated mapping updates. #6072
- Miscellaneous
- Disabled govet inline analyzer. #6066
- Updated discussions and issues templates. #6073
* Wed Apr 29 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.70.4:
- [misc] fix MSI generation add installer tests by @mlsmaycon in
[#6031]
* Wed Apr 29 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.70.3:
- [client] Enable UI autostart for silent and MSI installs by
@shuuri-labs in #6026
- [management] Prevent JWT reuse during peer login by @bcmmbaga
in #6002
- [client] Use BindListener for all userspace bind in lazyconn
activity by @lixmal in #6028
- [client] Tolerate EEXIST when adding macOS scoped default
routes by @lixmal in #6027
- [client] Trigger mobile submodule bump PRs on release tags by
@pappz in #6029
* Wed Apr 29 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.70.2:
- [client] Move macOS sleep detection into the daemon (purego) by
@lixmal in #5926
- [client] Fix Windows installer upgrade detection for pre-0.70.1
installs by @lixmal in #6025
- [misc] Add comment automation on release workflow for PRs by
@jnfrati in #6016
* Wed Apr 29 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.70.1:
- [management] removed legacy network map code by @crn4 in #5565
- [management] Add Microsoft AD FS support for embedded Dex
identity providers by @bcmmbaga in #6008
- [management] Handle single-string JWT group claim from IdPs by
@bcmmbaga in #6014
- [client] Don't mark management disconnected on transient job
stream errors by @pappz in #6005
- [relay] evict foreign client cache on disconnect by @pappz in
[#6015]
- [self-hosted] fix(getting-started): Infinite healthcheck loop
with existing traefik by @WalidDevIO in #5871
- [management] Drop netmap calculation on peer read by @bcmmbaga
in #6006
- [client] Use WinRT COM for Windows toasts by @lixmal in #6013
* Mon Apr 27 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.70.0:
- [self-hosted] add reverse proxy retention fields to combined
YAML by @braginini in #5930
- [management] replace mailru/easyjson with netbirdio/easyjson
fork by @braginini in #5938
- [client] Supress ICE signaling by @pappz in #5820
- [client] Prefer systemd-resolved stub over file mode regardless
of resolv.conf header by @lixmal in #5935
- [client] Trust wg interface in firewalld to bypass
owner-flagged chains by @lixmal in #5928
- [management] check policy for changes before actual db update
by @crn4 in #5405
- [client] allow UDP packet loss in
TestICEBind_HandlesConcurrentMixedTraffic by @pappz in #5953
- [client] fix goroutine leak in
TestReceive_ProtocolErrorStreamReconnect by @pappz in #5951
- [client] fix port collision in TestUpload by @pappz in #5950
- [management] Propagate context changes to upstream middleware
by @bcmmbaga in #5956
- [self-hosted] Use cscli lapi status for CrowdSec readiness
check in installer by @lixmal in #5949
- [client] Add TTL-based refresh to mgmt DNS cache via handler
chain by @lixmal in #5945
- [client] increase gRPC health check timeout to 5s by @pappz in
[#5961]
- [management] refactor: changeable pat rate limiting by @crn4 in
[#5946]
- [management] exclude peers for expiration job that have already
been marked expired by @pascal-fischer in #5970
- [proxy] set session cookie path to root by @alsruf36 in #5915
- [management] unify peer-update test timeout via constant by
@pappz in #5952
- [misc] Update sign pipeline version by @mlsmaycon in #5981
- [misc] Update release pipeline version by @mlsmaycon in #5995
* Mon Apr 20 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.69.0:
- Reverse Proxy IP Reputation Integration
- Now you can use CrowdSec to block malicious traffic based on
IP reputation on your exposed service in the reverse proxy.
This feature requires self-hosted installations to add
another container to their deployment. See instructions in
the reverse proxy migration documentation. Learn more about
here.
https://docs.netbird.io/selfhosted/migration/enable-reverse-proxy#step-7-optional-enable-crowd-sec-ip-reputation
- Client Improvements
- Added PCP support. This change adds support for the PCP
protocol to the client to improve the rate of P2P
connectivity. #5219
- Added --disable-networks flag to block network selection for
users. #5896
- Fixed clearing service env vars with --service-env "". #5893
- Guarded against container DNAT bypass of ACL rules in
iptables. #5697
- Populated NetworkAddresses on iOS for posture checks. #5900
- Reconnected conntrack netlink listener on error. #5885
- Replaced exclusion routes with scoped default + IP_BOUND_IF
on macOS. #5918
- Fixed incorrect SSH client config combining Host and Match
directives. #5903
- Fixed WGIface.Close deadlock when DNS filter hook re-enters
GetDevice. #5916
- Management Improvements
- Enforced peer or peer groups requirement for network routers.
[#5894]
- Reused single cache store across all management server
consumers. #5889
- Fixed lint error on Google Workspace integration. #5907
- Proxy Enhancements
- Added CrowdSec IP reputation integration for reverse proxy.
[#5722]
- Added direct redirect to SSO. #5874
- Infrastructure Improvements
- Updated sign pipeline version to v0.1.2. #5884
- Added CrowdSec LAPI container to self-hosted setup script.
[#5880]
* Tue Apr 14 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.68.3:
- [management] revert ctx dependency in get account with
backpressure by @crn4 in #5878
- [management] add context cancel monitoring by @pascal-fischer
in #5879
- [misc] Add CI check for proto version string changes by @lixmal
in #5854
* Mon Apr 13 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.68.2:
- [management] network map tests by @mlsmaycon in #5795
- [management] use sql null vars by @pascal-fischer in #5844
- [client] Use native firewall for peer ACLs in userspace
WireGuard mode by @lixmal in #5668
- [misc] update dashboards by @pascal-fischer in #5840
- [management] update account delete with proper proxy domain and
service cleanup by @pascal-fischer in #5817
- [management] allow local routing peer resource by
@pascal-fischer in #5814
- [management] Revert "[management] allow local routing peer
resource (#5814)" by @pascal-fischer in #5847
- [management] enable access log cleanup by default by
@pascal-fischer in #5842
- [client] Update RaceDial to accept context for improved
cancellation by @pappz in #5849
- [management] add domain and service cleanup migration by
@pascal-fischer in #5850
- [client] Fix Android internet blackhole caused by stale route
re-injection on TUN rebuild by @pappz in #5865
- [client] Fix/grpc retry by @pappz in #5750
- [client] Fix DNS resolution with userspace WireGuard and kernel
firewall by @lixmal in #5873
* Wed Apr 08 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.68.1:
- [client] Include service.json in debug bundle by @lixmal in
[#5825]
- [client] Fix FreeBSD not reporting network addresses by @lixmal
in #5827
- [client] Handle UPnP routers that only support permanent leases
by @lixmal in #5826
- [management] use NullBool for terminated flag by
@pascal-fischer in #5829
* Wed Apr 08 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.68.0:
- [proxy] Update package-lock.json by @heisbrot in #5661
- [client] Unexport GetServerPublicKey, add HealthCheck method by
@pappz in #5735
- [client] Fix mgmProber interface to match unexported
GetServerPublicKey by @pappz in #5815
- [management] validate permissions on groups read with name by
@pascal-fischer in #5749
- [management] Fix missing service columns in pgx account loader
by @lixmal in #5816
- [client] Error out on netbird expose when block inbound is
enabled by @lixmal in #5818
- [client] Skip down interfaces in network address collection for
posture checks by @lixmal in #5768
- [client] Fix SSH server Stop() deadlock with active sessions by
@lixmal in #5717
- [client] Add TCP DNS support for local listener by @lixmal in
[#5758]
- [client] Fix iOS DNS upstream routing for deselected exit nodes
by @mlsmaycon in #5803
- [client] Add NAT-PMP/UPnP support by @lixmal in #5202
- [relay] Replace net.Conn with context-aware Conn interface by
@pappz in #5770
- [client] Fix SSH proxy mangling shell quoting in forwarded
commands by @lixmal in #5669
- [client] Don't abort UI debug bundle when up/down fails by
@lixmal in #5780
* Sun Apr 05 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.67.4:
- [client] Fix flaky TestServiceLifecycle/Restart on FreeBSD by
@lixmal in #5786
- [client] Add GetSelectedClientRoutes to route manager and
update DNS route check by @mlsmaycon in #5802
* Thu Apr 02 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.67.3:
- [management] Allow updating embedded IdP user name and email by
@bcmmbaga in #5721
- [management] Fix L4 service creation deadlock on
single-connection databases by @lixmal in #5779
- [management,client] Revert gRPC client secret removal by
@bcmmbaga in #5781
* Wed Apr 01 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.67.2:
- Client Improvements
- Added Expose support to embed library. #5695
- Persisted service install parameters across reinstalls. #5732
- Fixed Exit Node submenu separator accumulation on Windows.
[#5691]
- Fixed Android DNS routes lost after TUN rebuild. #5739
- Fixed flaky TestUpdateOldManagementURL in CI. #5703
- Fixed path join issue in Windows tests. #5762
- Fixed IPv6 address handling in QUIC server. #5763
- Refactored Android PeerInfo to use ConnStatus enum. #5644
- Added support for embed.Client on Android with netstack mode.
[#5623]
- Management Improvements
- Added notification endpoints. #5590
- Added terminated field to services. #5700
- Extended blackbox tests. #5699
- Updated to latest gRPC version. #5716
- Prevented events for temporary peers. #5719
- Persisted proxy capabilities to database. #5720
- Added FleetDM API spec support. #5597
- Added target user account validation. #5741
- Improved permission validation for posture check delete.
[#5742]
- Removed client secret from gRPC auth flow. #5751
- Fixed panic on management reboot. #5759
- Added legacy to embedded IdP migration tool. #5586
- Fixed race condition in setup flow allowing multiple owners.
[#5754]
- Proxy Enhancements
- Added pprof support for proxy debugging. #5764
- Security & Stability
- Added path traversal and file size protections. #5755
- Self-Hosted Improvements
- Added self-hosted scaling note. #5769
- Miscellaneous
- Added missing OpenAPI definitions. #5690
- Updated Contributor License Agreement document. #5131
- Set permissions on env file for getting started scripts.
[#5761]
- refresh service-install-cli-change.patch
* Sun Mar 29 2026 Holden Fried <holden@opensuse.org>
- Update to 0.67.1:
- [client] Don't abort debug for command when up/down fails by
@lixmal in #5657
- [misc] Set signing env only if not fork and set license by
@mlsmaycon in #5659
- [management] Omit proxy_protocol from API response when false
by @lixmal in #5656
- [management] Replace JumpCloud SDK with direct HTTP calls by
@bcmmbaga in #5591
- [management] Allow multiple header auths with same header name
by @lixmal in #5678
- [management] Fix DNS label uniqueness check on peer rename by
@bcmmbaga in #5679
- [misc] Replace discontinued LocalStack with MinIO in S3 test by
@lixmal in #5680
- [client] Bump go-m1cpu to v0.2.1 to fix segfault on macOS 26 /
M5 chips by @lixmal in #5701
- [infrastructure] Enable RPM package gpgcheck in install script
by @lixmal in #5676
- [client] Replace iOS DNS IsPrivate heuristic with route checker
by @lixmal in #5694
* Mon Mar 23 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.67.0:
- Major Networking & Proxy Enhancements
- Introduced Layer 4 (L4) capabilities (TLS/TCP/UDP) across
client, management, and proxy. #5530
- Added header-based authentication, access restrictions, and
session idle timeout for proxy services. #5587
- Added support for wildcard certificates and improved
certificate handling (read from disk if available). #5583
[#5574]
- Added require_subdomain capability for proxy clusters. #5628
- Improved proxy reliability with domain switching fixes and
recovery after cleanup. #5585 #5617
- Dashboard support and documentation update are coming soon.
- Client Improvements
- Added client metrics support and enhanced observability.
[#5512]
- Added health check flag and daemon status output to netbird
status. #5650
- Restart engine automatically when peer IP changes. #5614
- Improved DNS handling, IPv6 formatting, and probe thread
safety. #5603 #5576
- Added MTU option and DNSLabels support to embedded client.
[#5550] #5493
- Refactored auto-update workflow and simplified container
entrypoint. #5448 #5652
- Fixed multiple issues including duplicate logs, firewall init
behavior, and container logging. #5609 #5621
- Management Improvements
- Added reverse proxy cluster APIs and domain-based targeting.
[#5611] #5612
- Improved concurrency handling and proxy exclusions from peer
approval. #5584 #5588
- Proxy Enhancements
- Added log-level flag and usage improvements. #5594
- Security & Packaging
- Added GPG signing key support for RPM packages. #5581
- Miscellaneous
- Added image build after merge to main workflow. #5605
- Added netbird-tui to community projects. #5568
* Sat Mar 14 2026 Holden Fried <holden@opensuse.org>
- Update to 0.66.4:
- Management Improvements
- Create a shallow copy of the account when buffering to
improve memory safety and performance. #5572
- Set network map components by default and optimize memory
usage. #5575
- Self-Hosted Improvements
- Removed extra proxy domain instructions from the getting
started guide to simplify setup. #5573
* Mon Mar 09 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.66.3:
- Client Improvements
- Fixed "reset connection" error after wake from sleep to
improve reconnection stability. #5522
- Fixed exit node menu not refreshing on Windows. #5553
- Management Improvements
- Added per-target options to the reverse proxy (management +
proxy). #5501
- Avoided breaking single account mode when switching domains.
[#5511]
- Added stable domain resolution for the combined server. #5515
- Fixed domain uniqueness validation. #5529
- Added activity events for domain operations. #5548
- Switched proxy registration to use real IP address. #5525
- Cached PKCE state to improve login flow reliability. #5516
- Count login request duration metrics only for successful
logins. #5545
- Aggregated gRPC metrics by account ID. #5486
- Proxy Improvements
- Refactored proxy metrics and added usage logs. #5533
- CI & Misc
- Added PR title validation workflow. #5503
* Wed Mar 04 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.66.2:
- [management] Store connected proxies in DB by @pascal-fischer
in #5472
- [management] Fix embedded IdP metrics to count local and
generic OIDC users by @braginini in #5498
- [client] Fix SSH JWT auth failure with Azure Entra ID iat
backdating by @hbzhost in #5471
- [misc] Add ISSUE_TEMPLATE configuration file by @mlsmaycon in
[#5500]
- [management] Replace in-memory expose tracker with SQL-backed
operations by @mlsmaycon in #5494
* Tue Mar 03 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.66.1:
- Client Improvements
- Fixed server mutex being held across waitForUp in Up(),
preventing potential blocking behavior. 5460
- Fixed close-of-closed-channel panic in ConnectClient retry
loop. 5470
- Fixed deadlock in route peer status watcher. 5489
- Fixed profile config directory permissions. 5457
- Lowered socket auto-discovery log level from Info to Debug.
5463
- Management Improvements
- Prevented deletion of groups linked to flow groups. 5439
- Fixed user update permission validation. 5441
- Added reverse proxy services REST client. 5454
- Added explicit target deletion on service removal. 5420
- Proxy Improvements
- Flushed buffer immediately to improve gRPC support. 5469
- Self-Hosted Enhancements
- Added support for Embedded IdP PostgreSQL database. 5443
- Allowed specifying SQL file locations for auth, activity, and
main stores. 5487
* Tue Feb 24 2026 Holden Fried <holden@opensuse.org>
- Explicitly set golang(API) = 1.25 until building with 1.26 is
fixed (see https://github.com/netbirdio/netbird/issues/5290)
* Tue Feb 24 2026 Holden Fried <holden@opensuse.org>
- Update to 0.66.0:
New Feature: netbird expose
* We're excited to introduce netbird expose --- a simple and
secure way to expose your local services through the NetBird
reverse proxy.
Expose a local HTTP server:
- `netbird expose 8080`
- This instantly publishes your local service via NetBird's
reverse proxy.
You can enhance the exposure with built-in protection and
customization:
With PIN protection (6 digits)
- `netbird expose 3000 --with-pin 123456`
With password protection and name prefix:
- `netbird expose 8080 --with-password my-secret
- -with-name-prefix my-app`
Restrict by SSO user groups:
- `netbird expose 8080 --with-user-groups engineering,devops`
Use a custom domain (pre-configured in your account):
- `netbird expose 8080 --with-custom-domain app.example.com`
Supported Flags:
- `--with-pin <string>` --- Protect the exposed service with a
6-digit PIN
- `--with-password <string>` --- Add password protection
- `--with-user-groups <strings>` --- Restrict access to specific
user groups
- `--with-custom-domain <string>` --- Specify a custom domain
- `--with-name-prefix <string>`--- Prefix the generated service
name
- `--protocol <string>` --- Protocol to use (http or https,
default http)
Client Improvements:
- Stopped upstream retry loop immediately on context
cancellation.
- Fixed busy-loop in network monitor routing socket on macOS/BSD.
- Fixed missed sleep/wakeup events on macOS.
- Removed connection semaphore to simplify connection handling.
- Skipped UAPI listener in netstack mode.
- Simplified DNS logging by removing domain list from log output.
- Excluded Flow domain from caching to prevent TLS failures.
- Added non-default socket file discovery support.
Client Service Expose:
- Introduced client service expose feature across client and
management.
- Refactored expose feature by moving business logic from gRPC
to manager layer.
Proxy Improvements:
- Added access log cleanup.
- Implemented access log sorting.
- Sent proxy updates on account deletion.
- Added pre-shared key (PSK) support to proxy.
Management Improvements:
- Refactored network map component assembly.
- Added custom domain counts and service metrics to self-hosted
metrics.
Self-Hosted Enhancements:
- Added support for activity store engine in the combined server.
- Added Embedded IdP metrics for improved observability.
* Thu Feb 19 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.65.3:
🛡️ Security Fix: Race Condition in Role Update Validation
What was affected
A race condition in the user role validation logic could allow
permission checks to succeed based on stale role data. Under very
specific timing conditions, concurrent requests during a role
change (e.g., while an admin was being demoted to user) could
bypass role validation when changing another users role.
Exploit Potential
If an administrator account was being demoted while
simultaneously performing acocunt ownership transfer actions, a
race window existed where the system could treat the user as
having elevated permissions to change owners.
In a coordinated scenario involving two administrator accounts,
this could potentially allow privilege escalation — for example,
promoting a user to Owner during the demotion window.
Conditions Required
Exploitation required:
- Two administrator accounts.
- One administrator being actively demoted.
- Concurrent ownership transfer requests executed precisely
during the demotion process.
- Precise timing to trigger the race condition.
- This issue required intentional coordination and timing, making
it unlikely to occur accidentally and will require access to
two admin accounts.
- Client & Mobile Improvements
- Batched macOS DNS domains to avoid truncation issues. #5368
- Ensured route settlement on iOS before handling DNS
responses. #5360
- Added logging of lock acquisition time in message handling
for improved observability. #5393
- Relay Improvements
- Reduced QUIC initial packet size to 1280 bytes (IPv6 minimum
MTU) for better compatibility. #5374
- Management Improvements
- Fixed possible race condition on user role change. #5395
- Added docker login step in management tests. #5323
- Self-Hosted Updates
- Added a migration script for upgrading from pre-v0.65.0 to
post-v0.65.0 combined setup. #5350
- Removed unused configuration example from self-hosted setup.
[#5383]
- Miscellaneous
- Updated timestamp format to include milliseconds. #5387
* Tue Feb 17 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.65.2:
- Client Improvements
- Optimized Windows DNS performance with domain batching and
batch mode. #5264
- Reset WireGuard endpoint on ICE session changes during relay
fallback. #5283
- Refactored WireGuard endpoint setup with role-based proxy
activation. #5277
- Exported lazy connection environment variables for mobile
clients. #5310
- Ignored false positive lint alert in client code. #5370
- Proxy & Reverse Proxy
- Added listener-side Proxy Protocol support and enabled it in
Traefik. #5332
- Added WebSocket support to the proxy. #5312
- Removed unused OIDC config flags from proxy configuration.
[#5369]
- Infrastructure updates for proxy components. #5365
- Management Improvements
- Fixed UTC difference issue in peer “last seen” status. #5348
- Ensured Management starts even if external IdP is down. #5367
- Added flag to disable the legacy gRPC endpoint. #5372
- Documentation & Misc
- Added additional proxy domain instructions. #5328
- Added an extra CNAME configuration example. #5341
* Sat Feb 14 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.65.1:
- [misc] Fix reverse proxy getting started messaging by
@braginini in #5317
- [management] Move service reload outside transaction in account
settings update by @bcmmbaga in #5325
* Fri Feb 13 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.65.0:
NetBird now includes a built-in reverse proxy in the management
server, enabling proxied access to backend services through your
NetBird network. Allowing you to expose your services to the
public with the option to secure them with SSO, PINs, or
passwords.
No VPN client required for end users. Just point a custom domain
at your NetBird server, configure the proxy in the dashboard, and
your internal services are securely accessible from any browser.
Think of it as a self-hosted alternative to Cloudflare Tunnels,
but without the MITM and fully under your control.
Key features:
- Custom domains - Map your own domains to internal services and
let NetBird handle TLS and routing via CNAME verification
- Built-in authentication - Protect exposed services with SSO
(via your configured IdP), PIN codes, passwords, or magic links
directly from the dashboard
- Multiple targets - Route traffic to one or more backend peers
or resources with optional path-based routing
- Access logs - Monitor who's accessing your proxied services
with built-in logging
- Proxy settings - Fine-tune behavior with options like host
header passthrough and redirect rewriting
🏗️ Self-Hosted Improvements
- Added combined NetBird server binary for simplified self-hosted
deployments, reducing the number of containers needed to run
NetBird. #5232
đź”’ Management Improvements
- Enforced access control on accessible peers, ensuring proper
authorization checks when querying the accessible peers
endpoint. #5301
- Added cloud API spec to the public OpenAPI definition with REST
client support. #5222
🖥️ Client Improvements
- Added early message buffer for the relay client, preventing
message loss during connection establishment. #5282
- Refactored relay connection container for improved reliability
and code maintainability. #5271
* Thu Feb 12 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.64.6:
🚨 Security Fix
Security: Fixed account impersonation validation in management
API
Fixed a vulnerability in the management server's authentication
middleware where the ?account= query parameter could be used to
impersonate arbitrary accounts without proper validation when
getting a list of accessible peers. It requires the attacker to
have prior knowledge of the target accounts' and peer IDs.
The fix adds explicit validation via IsValidChildAccount() before
allowing account switching. Account impersonation is now only
permitted when the target account is confirmed as a legitimate
child account of the requesting user's parent account.
Affected component: Management server HTTP middleware
(auth_middleware.go) and /api/peers/<peer_id>/accessible-peers
endpoint
Severity: High — an authenticated user could potentially access
or act on behalf of accounts they should not have access to by
passing an arbitrary account parameter and fetching the list of
accessible peers.
Recommendation: All self-hosted deployments should upgrade to
this version.
- Client Improvements
- Added missing BSD flags to the debug bundle. #5254
- Cached the result of wgInterface.ToInterface() using
sync.Once for better performance. #5256
- Fixed nil pointer panic in the ICE agent during sleep/wake
cycles. #5261
- Always log DNS forwarder responses for improved
troubleshooting. #5262
- Fixed netstack detection and added a WireGuard port option.
[#5251]
- Corrected wrong URL logging for DefaultAdminURL. #5252
- Added timing measurements to handleSync for better
observability. #5228
- Fixed duplicate firewall rules in USP filter. #5269
- Added environment variable to skip DNS probing when needed.
[#5270]
- Fixed race condition and ensured correct message ordering in
Relay. #5265
- Ensured login is checked in foreground mode when required.
[#5295]
- Fixed multiple panics in device and engine code. #5287
- Cleaned up stale nftables entries without handle. #5272
- Management Improvements
- Fixed incorrectly setting disconnected status for connected
peers. #5247
- Added gRPC debounce for message types to reduce noise. #5239
- Added validation of stream start time for connecting peers.
[#5267]
- Fixed ischild check logic. #5279
* Tue Feb 03 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.64.5:
- Add selfhosting video by @braginini in #5235
- [management] adding account id validation to accessible peers
handler by @pascal-fischer in #5246
* Sun Feb 01 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.64.4:
- [client] Add macOS default resolvers as fallback by @lixmal in
[#5201]
- [client] Add block inbound option to the embed client by
@lixmal in #5215
- [management] Disable local users for a smooth single-idp mode
by @braginini in #5226
https://docs.netbird.io/selfhosted/identity-providers/disable-local-authentication
- [management] disable sync lim by @crn4 in #5233
- [management] run cancelPeerRoutines in goroutine in sync by
@crn4 in #5234
* Thu Jan 29 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.64.3:
- [client] Remove redundant square bracket trimming in USP
endpoint parsing by @pappz in #5197
- [client] Refactor/optimise raw socket headers by @pappz in
[#5174]
- [management] fix ephemeral peers being not removed by @crn4 in
[#5203]
- [management] fix skip of ephemeral peers on deletion by @crn4
in #5206
- [client] Stop NetBird on firewall init failure by @lixmal in
[#5208]
- [management] Streamline domain validation by @lixmal in #5211
- [client] Fix WG watcher missing initial handshake by @pappz in
[#5213]
* Tue Jan 27 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.64.2:
- Client Improvements
- Consolidated authentication logic to improve maintainability
and consistency. #5010
- Added IPv6 support to the UDP WireGuard proxy. #5169
- Fixed a flaky JWT SSH test to improve CI stability. #5181
- Updated Fyne UI and added retry handling to the exit menu.
[#5187]
- Prevented eBPF traffic from being tracked in conntrack. #5166
- Added support for non-PTY, no-command interactive SSH
sessions. #5093
- Management & Identity
- Fixed validator warning messages to improve clarity. #5168
- Improved peer deletion error handling. #5188
- Included default groups claim in the CLI audience. #5186
- Added user invite link support for the embedded IdP. #5157
* Fri Jan 23 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.64.1:
- Fixed RFC 4592 wildcard matching for existing domain names.
[#5145]
- Extended the WireGuard watcher to also monitor ICE connections.
[#5133]
- Added IPv6 support to userspace bind. #5147
- Fixed IPv4-only limitation in the bind proxy. #5154
- Improved DNS reliability by trying the next upstream on
SERVFAIL / REFUSED responses. #5163
- Hid forwarding rules from status output when the count is zero.
[#5149]
- Added CPU profiling to the debug bundle. #4700
- Fixed health result reporting in the debug bundle. #5164
- Changed the default Rosenpass log level. #5137
- Fixed exit node menu behavior on reconnect and removed tooltips
in the GUI. #5167
- Management Enhancements
- Fixed activity event initiator reporting for user group
changes. #5152
- Ensured ephemeral peers are correctly added to the ephemeral
list on login. #5165
- Moved activity store encryption into the shared crypt package.
[#5111]
* Wed Jan 21 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.64.0:
- Debugging & Observability
- Added the ability to trigger debug bundle generation directly
from the API and Dashboard. #4832
- Client Improvements
- Improved error handling by adjusting notifyDisconnected
behavior on receiveJobRequest failures. #5138
- Added support for wildcard custom DNS records. #5125
- Fixed profile switching issues and repeated down / up command
failures. #5142
- Fixed Rosenpass connectivity issues for Android peers. #5044
- Management Enhancements
- Added support for local user password changes when using the
embedded IdP. #5132
- Included missing activity events in management API responses.
[#5140]
- Infrastructure
- Added embedded STUN support to the getting-started setup to
simplify initial deployments. #5141
* Fri Jan 16 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.63.0:
Custom DNS Zones
NetBird now supports private DNS zones, allowing you to host DNS
records directly within your network without external DNS
servers.
Create zones like internal.company.io, add A, AAAA, or CNAME
records, and distribute them to specific peer groups. Resolution
happens locally on peers, and records propagate automatically
when group membership changes. With search domain support
enabled, peers can query short names like api instead of the full
api.internal.company.io.
Custom zones take precedence over nameserver configurations,
giving you control over how specific domains resolve within your
network. This works well with routed networks—map friendly names
to private IPs behind routing peers, and NetBird handles both DNS
resolution and traffic routing. Your teams access
postgres.internal instead of remembering 192.168.0.68.
Zone distribution is group-based, so different teams can see
different records for the same zone, or have access to entirely
separate zones.
Use Cases
- Environment separation — Distinct zones for production,
staging, and development, distributed only to relevant teams
- Routed network resources — DNS names for services in data
centers or cloud VPCs accessed through routing peers
- Split-horizon DNS — Internal-only resolution for domains that
resolve differently outside your network
- DNS & Networking Improvements
- Ensured musl compatibility by chasing CNAMEs in the local
resolver. #5046
- Improved DNS resolution flow by falling through the DNS chain
for custom DNS zones. #5081
- Changed priority between local and DNS route handlers for
more predictable routing. #5106
- Fixed netstack upstream DNS handling and added WASM debug
methods. #4648
- Client Improvements
- Fixed WASM peer connections to lazy peers. #5097
- Added fallback handling for invalid loginuid in
ui-post-install.sh. #5099
- Removed duplicate audience checks in the client. #5117
- Management Enhancements
- Added Custom DNS zones support. #4849
- Added configuration compatibility checks during startup.
[#5087]
- Optimized external cache access by fetching all users in a
single request. #5104
- Adapted rate limiting behavior. #5080
- Fixed SSH server audience validation across management and
client. #5105
- Skipped email_verified validation when not present in IdP
responses. #5118
- Added IdP timeout configuration via environment variable.
[#4647]
- Infrastructure & Security
- Introduced embedded STUN support for relay and STUN
components. #5062
- Added a Quickstart reverse proxy assistant to simplify
initial setup. #5100
- Upgraded Alpine Linux from 3.22.2 to 3.23.2 for security
hardening. #5119
* Mon Jan 12 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.62.3:
- [management] Check config compatibility by @braginini in #5087
* Fri Jan 09 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.62.2:
- [relay] Update GO version and QUIC version (… by @pappz in
[#5071]
- [client] Add non-root ICMP support to userspace firewall
forwarder by @lixmal in #4792
- [client] Reorder userspace ACL checks to fail faster for better
performance by @lixmal in #4226
- [management] fix the issue with duplicated peers with the same
key by @crn4 in #5053
- [management] Feature/resolve local jwks keys by @braginini in
[#5073]
- [management] Validate OIDC issuer when creating or updating by
@braginini in #5074
* Thu Jan 08 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.62.1:
- [management] Fix role change in transaction and update readme
by @braginini in #5060
- [management] Fix race condition in experimental network map
when deleting account by @bcmmbaga in #5064
- [misc] add embedded provider support metrics by @mlsmaycon in
[#5065]
- [misc] add new getting started to release by @mlsmaycon in
[#5057]
- [infrastructure] fix: disable Caddy debug by @diegocn in #5067
* Wed Jan 07 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.62.0:
🔓 Simplified Identity Provider Management
Self-hosted NetBird no longer requires an external identity
provider by default. Local users now work out of the box without
any IdP dependency.
What's changed:
- No IdP required - Create and manage users directly from the
Dashboard
- Multiple IdP support - Configure Pocket ID, Auth0, Google,
Microsoft, Okta, or any OIDC provider directly from the
Dashboard
- New quickstart script - Simpler deployment with fewer
containers
- client enhancements
- Fixed an issue where the client could get stuck in connecting
state when api.netbird.io is unreachable. #5033
- Added port forwarding support to the SSH proxy. #5031
- Added support for disabling the eBPF WireGuard proxy via
environment variable. #5047
- Fixed SSH UI flickering test instability. #5036
- Management Improvements
- Refactored integrated peer validation and peer deletion logic
for better consistency. #5035, #5042
- Incremented network serial on peer updates to ensure correct
synchronization. #5051
- Fixed nil handling for extra settings in management. #5049
- Cached SSH authorized users in the network map for improved
performance. #5048
- Identity & Infrastructure
- Introduced Embedded IdP, simplifying identity provider
management across management, infrastructure, and IdP
components. #5008
- Shared & Tooling Improvements
- Added support for setting a custom User-Agent in the REST
client. #5037
- Fixed ui-post-install.sh to correctly use the full username.
[#4809]
- Improved Nmap concurrency handling. #5040
For all the details see:
https://github.com/netbirdio/netbird/releases/tag/v0.62.0
* Sat Jan 03 2026 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.61.1:
- [client] add reset for management backoff by @gamerslouis in
[#4935]
- [client] Filter out own peer from remote peers list during peer
updates. by @pappz in #4986
- [client] Fix Advanced Settings not opening on Windows with
Japanese locale (#4455) by @h6ah4i in #4637
- [management] apply login filter only for setup key peers by
@pascal-fischer in #4943
- fix(router): nft tables limit number of peers source by
@nhenneaux in #4852
- [management] filter own peer when having a group to peer policy
to themself by @pascal-fischer in #4956
- Add DEX IdP Support by @braginini in #4949
- Feat/add support for forcing device auth flow on ios by
@shuuri-labs in #4944
- [client] Fix UI stuck in "Connecting" state when daemon reports
"Connected" by @pappz in #5014
- [management] Fix/delete groups without lock by @pascal-fischer
in #5012
- [client] Fix semaphore slot leaks by @pappz in #5018
- [client] add verbose flag for free ad tests by @mlsmaycon in
[#5021]
* Fri Jan 02 2026 Marcus Rueckert <mrueckert@suse.de>
- Ignore TestJWTDetection to fix build on 15.6
* Wed Dec 31 2025 Holden Fried <holden@opensuse.org>
- Update to 0.61.0:
* [management] Fine-Grained SSH Access Control (Breaking Change):
NetBird introduces fine-grained SSH access control with
support for explicit local OS users on target machines.
* [management] Administrators can now define which NetBird users
or groups are allowed to connect as specific local system
users, enabling safer, more predictable SSH access without
relying on shared or implicit credentials.
* [management] Breaking change for self-hosted deployments:
Self-hosted installations must upgrade the Management server
before upgrading their clients and enabling or using the new
SSH access model. Failing to upgrade may result in SSH access
issues or unexpected behavior.
* [management] Auto-update available for windows and mac clients
* [management] Added fine-grained SSH access control across
client and management
* [client] Introduced auto-update support for the client to
simplify upgrades
* [client] Improved management domain lookup by adding an
additional timeout
* [client] Added Android profile switching for easier
multi-profile usage
* [client] Fixed Linux UI flickering during state updates
* [client] Applied DNS host configuration only on changes to
reduce unnecessary updates.
* Tue Dec 23 2025 Holden Fried <holden@opensuse.org>
- Update to 0.60.9:
* [client] lookup for management domains using an additional
timeout #4983
* Thu Dec 18 2025 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.60.8:
- [client] Use setsid to avoid the parent process from being
killed via HUP by login by @lixmal in #4900
- [client] Fix DNS forwarder returning broken records on 4 to 6
mapped IP addresses by @lixmal in #4887
- [management] cleanup logs by @pascal-fischer in #4933
- [management] monitoring updates by @pascal-fischer in #4937
- [management] Fix sync metrics by @pascal-fischer in #4939
- [management] remove context from store methods by
@pascal-fischer in #4940
- [management] Approve all pending peers when peer approval is
disabled by @bcmmbaga in #4806
- [iOS] Add force relay connection on iOS by @doromaraujo in
[#4928]
- [relay-server] Add health-check agent recognition to avoid
error logs by @pappz in #4917
- [ci] Add local lint setup with pre-push hook to catch issues
early by @pappz in #4925
- [management] use xid as request id for logging by
@pascal-fischer in #4955
- [client] Add stack trace for bundle by @pappz in #4957
- [client] Fix deadlock in delayed WG update function by @pappz
in #4953
* Thu Dec 04 2025 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.60.7:
- [client] Passthrough all non-NetBird chains to prevent them
from dropping NetBird traffic by @lixmal in #4899
- [client] Fix engine shutdown deadlock and sync-signal message
handling races by @pappz in #4891
- [client] Reorder subsystem shutdown so peer removal goes first
by @mlsmaycon in #4914
* Thu Dec 04 2025 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.60.6:
- [client,management] Remove OAuth select_account prompt by
@bcmmbaga in #4912
* Wed Dec 03 2025 Marcus Rueckert <mrueckert@suse.de>
- Update to 0.60.5:
- [client, management] Add OAuth select_account prompt support to
PKCE flow by @pappz in #4880
- [management] Feat/api enhancements by @fahrishih in #4831
- [management] Add user created activity event by @bcmmbaga in
[#4893]
- [management] Refactor network map controller by @pascal-fischer
in #4789
- [management] update management integrations by @pascal-fischer
in #4895
- [client] Add conditional peer removal logic during shutdown by
@mlsmaycon in #4897
- [management] record pat usage metrics by @pascal-fischer in
[#4888]
- [client] Add sleep state tracking to handle wakeup/sleep events
reliably by @mlsmaycon in #4894
- [management] Add support to disable geolocation service by
@bcmmbaga in #4901
- [relay] Use instanceURL instead of Exposed address. by @pappz
in #4905
* Tue Dec 02 2025 Holden Fried <holden@opensuse.org>
- Update to 0.60.4:
* [client] Sleep detection on macOS by @pappz in #4859
* [relay] use exposed address for healthcheck TLS validation
by @shuuri-labs in #4872
- Set golang(API) >= 1.25, since golang API doesn't account for
patch version, and setting >=1.24.10 already implies >=1.25
* Wed Nov 26 2025 Holden Fried <holden@opensuse.org>
- Bump golang API version to >=1.24.10 explicitly to align with
upstream and handle Leap/SLE build failures
* Wed Nov 26 2025 Holden Fried <holden@opensuse.org>
- Update to 0.60.3:
* [management] Remove TestBufferUpdateAccountPeers by @crn4 in
[#4839]
* [client, management, signal, relay] Update go.mod to use Go
1.24.10 and upgrade x/crypto dependencies by @mlsmaycon in
[#4828] (fixes CVE-2025-58181 / boo#1253927)
* [management] Fix SSH JWT issuer derivation for IDPs with path
components by @sgtaziz in #4844
* [management] Preserve validator settings on account settings
update by @bcmmbaga in #4862
* [client] Make mss clamping optional for nftables by @lixmal
in #4843
* [client] Allow selection/deselection of network resources on
Android by @doromaraujo in #4607
* [client] Support disable search domain for custom zones by
@mlsmaycon in #4826
* [client] feat: Add support for displaying device code
(UserCode) on Android TV by @shuuri-labs in #4800
* [client] Open browser for SSH automatically by @lixmal in #4838
* [client] Add excluded port range handling for PKCE flow by
@mlsmaycon in #4853
* Fri Nov 21 2025 Holden Fried <holden@opensuse.org>
- update to 0.60.2:
* [client] Increase ssh detection timeout by @lixmal in #4827
* Wed Nov 19 2025 Holden Fried <holden@opensuse.org>
- update to 0.60.1:
* [management] Fix direct peer networks route by @pascal-fischer
in #4802
* [management] pass config to controller by @pascal-fischer
in #4807
* [management] Add native ssh port rule on 22 by @mlsmaycon in
[#4810]
* Tue Nov 18 2025 Marcus Rueckert <mrueckert@suse.de>
- add ssh test cases which no longer work to the filterlist
* Tue Nov 18 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.60.0:
Native SSH Access & OpenSSH Integration
NetBird v0.60.0 ships a complete rewrite of SSH access. Every
peer can now run a built-in SSH server, giving you
identity-aware, private SSH access over your NetBird network —
using either the netbird ssh command or your existing OpenSSH
clients.
Highlights:
- Built-in SSH server on every peer - Enable with netbird up
- -allow-server-ssh and get a native SSH endpoint without
exposing port 22 to the internet.
- Identity-aware access with JWT - SSH sessions are authenticated
via your IdP (OIDC/JWT) by default, so you know which user
accessed which machine.
- Works with netbird ssh and OpenSSH - Use netbird ssh
user@<peer-ip> or standard ssh, sftp, and scp commands; NetBird
configures OpenSSH automatically via a drop-in 99-netbird.conf.
- Port 22, transparently secured - NetBird listens on TCP 22022
and redirects NetBird-network port 22 traffic to it, so
existing SSH workflows keep working without changing ports.
- Advanced features when you need them - Optional SFTP, local and
remote port forwarding, root login, and JWT token caching
(--ssh-jwt-cache-ttl) for fewer auth prompts.
- Machine identity mode (legacy behavior) - Prefer host-based
trust? Disable JWT auth with --disable-ssh-auth and rely purely
on network-level ACLs.
How it works
- Enable the SSH server on the target peer
netbird down # if already running
netbird up --allow-server-ssh
- Add optional flags for SFTP, port forwarding, or root login as
needed:
netbird up --allow-server-ssh \
- -enable-ssh-local-port-forwarding \
- -enable-ssh-remote-port-forwarding \
- -enable-ssh-sftp \
- -enable-ssh-root
- Create an ACL policy for SSH
Allow TCP port 22022 from your SSH client peers/groups to your
SSH server peers/groups in Access Control.
- Enable SSH in the Dashboard
Open the target peer → enable SSH Access.
Connect via CLI or OpenSSH
- NetBird CLI:
netbird ssh user@100.119.230.104
- OpenSSH:
ssh user@100.119.230.104
sftp user@100.119.230.104
scp file.txt user@100.119.230.104:/path
đź“– Read more in the SSH documentation:
https://docs.netbird.io/how-to/ssh
- Client Improvements
- Updated the client login success page with an improved user
experience. #4797
- Reverted deprecated gRPC client code migration to restore
expected behavior. #4805
- Management Improvements
- Fixed handling of port ranges in route firewall rules to
ensure accurate rule application. #4801
Upgrade & Compatibility Notes
- ⚠️ NetBird SSH in v0.60.0 is a breaking change:
- Server port changed from 44338 → 22022
- Authentication moved from machine public keys to JWT-based
user identity
- Implicit firewall rules were removed - you now need an
explicit ACL for port 22022
- ⚠️ Version compatibility: v0.60.0+ SSH is not backward
compatible with older peers. For self-hosted environments, we
recommend updating in this order:
- Management server
- Dashboard (for browser SSH, if used)
- SSH servers first (peers with --allow-server-ssh)
- SSH clients last (netbird ssh users)
- refresh service-install-cli-change.patch
* Sat Nov 15 2025 Holden Fried <holden@opensuse.org>
- update to 0.59.13:
- [management] activity events on group updates by
@pascal-fischer in #4750
- Bump github.com/containerd/containerd from 1.7.27 to 1.7.29 by
@dependabot[bot] in #4756
- [management] incremental network map builder by @crn4 in #4753
- [management] add pat rate limiting by @pascal-fischer in #4741
- [management] remove toAll firewall rule by @crn4 in #4725
- [management] remove GLOBAL when disabling foreign keys on mysql
by @pascal-fischer in #4615
- [management] remove timing logs by @pascal-fischer in #4761
- [client] Create networkd.conf.d if it doesn't exist by @lixmal
in #4764
- [management] fix pg db deadlock after app panic by @crn4 in
[#4772]
- [client] Fix agent reference by @pappz in #4776
- [management] move network map logic into new design by
@pascal-fischer in #4774
- [management] Removed policy posture checks on original peer by
@pascal-fischer in #4779
- [client] Fix shutdown blocking on stuck ICE agent close by
@lixmal in #4780
- [client] Add quick actions window by @doromaraujo in #4717
- [client] Use stdnet with a context to avoid DNS deadlocks by
@lixmal in #4781
- [client] Replace ipset lib by @lixmal in #4777
* Thu Nov 06 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.59.12:
- [client] Migrate deprecated grpc client code by @lixmal in
[#4687]
- [client] Fix netstack dns forwarder by @lixmal in #4727
- [client] Extend Darwin network monitoring with wakeup detection
(cleanup branch) by @pappz in #4723
- Bump github.com/quic-go/quic-go from 0.48.2 to 0.49.1 by
@dependabot[bot] in #4621
- [management] update db connection lifecycle configuration by
@pascal-fischer in #4740
- [client] Set up networkd to ignore ip rules by @lixmal in #4730
- [client] Clamp MSS on outbound traffic by @lixmal in #4735
- [client] Allow INPUT traffic on the compat iptables filter
table for nftables by @lixmal in #4742
- [client] Block on all subsystems on shutdown by @lixmal in
[#4709]
- [client] Add login_hint to oidc flows by @lixmal in #4724
- [client] Add dns config to debug bundle by @lixmal in #4704
- refresh service-install-cli-change.patch
* Wed Oct 29 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.59.11:
- [client] Fix UI panic when switching profiles by @lixmal in
[#4718]
* Wed Oct 29 2025 Marcus Rueckert <mrueckert@suse.de>
- Refresh service-install-cli-change.patch
* Tue Oct 28 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.59.10:
- [client] Fix Connect/Disconnect buttons being enabled or
disabled at the same time by @lixmal in #4711
- [client] Use management-provided dns forwarder port on the
client side by @lixmal in #4712
* Tue Oct 28 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.59.9:
- [management] Add peer disapproval reason by @bcmmbaga in #4468
- [client] Fix active profile name in debug bundle by @lixmal in
[#4689]
- [signal] Fix HTTP/WebSocket proxy not using custom certificates
by @bcmmbaga in #4644
- [client] Fix macOS state-based dns cleanup by @lixmal in #4701
- [client] Clean up bsd routes independently of the state file by
@lixmal in #4688
- Include expired and routing peers in DNS record filtering by
@bcmmbaga in #4708
- [management] rewire account manager to permissions manager by
@pascal-fischer in #4673
- [client] Redirect dns forwarder port 5353 to new listening port
22054 by @lixmal in #4707
- [client] The status cmd will not be blocked by the ICE probe by
@pappz in #4597
* Wed Oct 22 2025 Holden Fried <holden@opensuse.org>
- update to 0.59.8:
- [Snyk] Security upgrade alpine from 3.22.0 to 3.22.2 by
@mlsmaycon in #4618
- [management] Delete TURNConfig section from script by
@braginini in #4639
- [client] Clean up match domain reg entries between config
changes by @lixmal in #4676
- [misc] Update tag name extraction in install.sh by @mlsmaycon
in #4677
* Sat Oct 18 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.59.7:
- [management] feat: Basic PocketID IDP integration by @jfrconley
in #4529
- [client] Fix missing flag values in profiles by @lixmal in
[#4650]
- [client] Add bind activity listener to bypass udp sockets by
@lixmal in #4646
- [client] Set default wireguard port for new profiles by @lixmal
in #4651
- [client] Fix nil pointer when run debug bundle by @pappz in
[#4652]
- [client] Remove rule squashing by @lixmal in #4653
- [client] Support BROWSER env for login by @lixmal in #4654
- [client] Fix status showing P2P without connection by @lixmal
in #4661
* Tue Oct 14 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.59.6:
- [managament] sync all other peers on peer add/remove by
@hakansa in #4614
- [client] Explicitly disable DNSOverTLS for systemd-resolved by
@kleschenko in #4579
- [management] pass temporary flag to validator by
@pascal-fischer in #4599
- [misc] Add service definition for netbird-signal by @mlsmaycon
in #4620
- [client] Force TLS1.2 for RDP with Win11/Server2025 for CredSSP
compatibility by @lixmal in #4617
* Thu Oct 09 2025 Holden Fried <holden@opensuse.org>
- update to 0.59.5:
- [client] fix dns forwarder port update by @hakansa in #4613
* Wed Oct 08 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.59.4:
- [client] Remove endpoint address on peer disconnect, retain
status for activity recording by @pappz in #4228
- [client] Close Re-Auth Window If Client Is Already Connected by
@hakansa in #4525
- [client] Implement DNS query caching in DNSForwarder by
@hakansa in #4574
- [client] Recreate agent when receive new session id by @pappz
in #4564
- [client,gui] Update url_windows.go to offer arm64 executable
download by @webash in #4586
* Tue Oct 07 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.59.3:
- Adjust signal port for websocket connections by @mlsmaycon in
[#4594]
- [client,management,signal] Handle grpc from ws proxy internally
instead of via tcp by @lixmal in #4593
- [management,signal] Remove ws-proxy read deadline by @lixmal in
[#4598]
* Fri Oct 03 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.59.2:
- Add websocket paths including relay to nginx template by
@lixmal in #4573
* Thu Oct 02 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.59.1:
- [client] fix Windows NRPT Policy Path by @hakansa in #4572
* Thu Oct 02 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.59.0:
- Browser Client for Remote SSH & RDP Access
We’re excited to introduce the NetBird Browser Client – a
secure, zero-install way to access your peers directly from
your web browser.
- Highlights
- No installation required – connect from Chrome, Firefox,
Edge, or Safari.
- SSH & RDP support – access Linux and Windows machines with
full protocol support.
- Runs in your browser – a complete NetBird peer compiled to
WebAssembly.
- End-to-end encrypted – secured with WireGuard®.
- Temporary, secure access – short-lived peers and ACLs are
created automatically and cleaned up when the session ends.
- How it works
Open your NetBird dashboard → Peers view, choose a machine, and
click Launch Console (SSH) or Remote Desktop (RDP). Your
session runs securely in the browser with no software download
needed.
đź“– Read the full guide
https://docs.netbird.io/how-to/browser-client
⚠️Note for Self-Hosted Deployments
To use the browser client with self-hosted deployments, you need
to upgrade your Management, Signal, Dashboard, and Relay
containers.
Learn more here:
Self-Hosted Quickstart – Support Browser Clients
https://docs.netbird.io/selfhosted/selfhosted-quickstart#support-browser-clients
Self-Hosted Guide – Upgrade
http://localhost:3000/selfhosted/selfhosted-guide#upgrade
- Added browser client support across client, signal, and
management components. #4415
- Adjusted WebSocket proxy paths to ensure proper browser client
functionality. #4565
- Updated infrastructure scripts to include WebSocket proxy setup
for browser client deployments. #4566
- Other Client Enhancements
- Added Windows DNS policies to always use the GPO path. #4460
- Fixed packet loss issues. #3338
- Ordered ICE candidate lists for proper comparison and
reliability. #4561
- Made DNS ForwarderPort configurable and updated the default
well-known port. #4479
* Thu Sep 25 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.58.2:
- [management] Add logs for update channel by @pascal-fischer in
[#4527]
- [client] Add WireGuard interface lifecycle monitoring by
@hakansa in #4370
- [management] Fix/nmap dns filter by @crn4 in #4547
* Mon Sep 22 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.58.1:
- [client] Skip interface for route lookup if it doesn't exist by
@lixmal in #4524
* Sat Sep 20 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.58.0:
- [management] Add rule ID validation for policy updates by
@bcmmbaga in #4499
- [client] [UI] Down & Up NetBird Async When Settings Updated by
@hakansa in #4458
- [android] Add OnLoginSuccess callback to URLOpener interface by
@doromaraujo in #4492
- [management] Filter DNS records to include only peers to
connect by @bcmmbaga in #4517
- Add a new product demo video by @braginini in #4520
- [client] Use native windows sock opts to avoid routing loops by
@lixmal in #4314
- [client] Do not run up cmd if not needed by @pappz in #4508
- [misc] Update SIGN_PIPE_VER to version 0.0.23 by @mlsmaycon in
[#4521]
- [client] Check the client status in the earlier phase by @pappz
in #4509
* Mon Sep 15 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.57.1:
- [relay] Refactor healthcheck sender and receiver to use
configurable options by @pappz in #4433
- [client] Fix ICE latency handling by @pappz in #4501
* Thu Sep 11 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.57.0:
- [client] Implement environment variable handling for Android by
@pappz in #4440
- [client] Fix/v4 stun routing by @pappz in #4430
- [client] Fix client status check by @pappz in #4474
- [misc] Remove default zitadel admin user in deployment script
by @bcmmbaga in #4482
* Mon Sep 08 2025 Marcus Rueckert <mrueckert@suse.de>
- seems TestServer_Up now also fails on TW
msg="failed to dial with fwmark: d.Dialer.DialContext: dial udp
127.0.0.1:9: set SO_MARK: operation not permitted"
* Mon Sep 08 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.56.1:
- [management] Add peers manager to integrations by @bcmmbaga in
[#4405]
- [internal] Add missing assignment of iFaceDiscover when
netstack is disabled by @doromaraujo in #4444
- [client] Do not block Offer processing from relay worker by
@pappz in #4435
- [management] only allow user devices to be expired by
@pascal-fischer in #4445
- [client] Move some sys info to a static place by @pappz in
[#4446]
- [management] Extends integration and peers manager by @bcmmbaga
in #4450
- [client] Debug information for connection by @pappz in #4439
- [misc] Remove aur support and start service on ostree by
@mlsmaycon in #4461
* Tue Sep 02 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.56.0:
In this release, we are adding support for user approval. This
allows administrators to control whether users can join their
account and automatically be allowed to connect their peers to
their networks. Learn more at
https://docs.netbird.io/how-to/approve-users
- Client Enhancements
- Added netstack support for Android CLI. #4319
- Added MTU configuration flag. #4213
- Fixed Darwin DNS errors always being thrown. #4403
- Fixed shared socket buffer allocation. #4409
- Prevented upstream resolvers from deactivating on failure.
[#4128]
- Updated to the latest Pion ICE version. #4388
- Management Improvements
- Optimized proxy network map performance. #4324
- Removed redundant store locks for better concurrency. #4385,
[#4390]
- Changed network serial increment to occur at the end of
transactions. #4397
- Reported sync and login durations by account ID. #4406
- Split high latency gRPC metrics for more detailed monitoring.
[#4408]
- Continued user updates even after failures (removed locks).
[#4410]
- Fixed ephemeral flag handling in peer batch response. #4420
- Added login filter to prevent multiple peers from connecting
with the same public key. #3986
- Removed withContext from store methods. #4422
- Fixed duplicate group removals on peer deletion. #4421
- Added user approval feature for accounts. #4411
- Signal & Relay
- Fixed goroutine and memory leaks when forwarding messages
between peers. #3896
- Relay now accepts any origin. #4426
- Other Changes
- Bumped golang-jwt/jwt from 3.2.2 to 5.3.0. #4375
- Fixed Windows client and management benchmark tests. #4424
* Wed Aug 20 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.55.1:
- [management] Remove all store locks from grpc side by
@pascal-fischer in #4374
- [client] Avoid duplicated agent close by @pappz in #4383
* Wed Aug 20 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.55.0:
- Improve wording in the NetBird client app by @braginini in
[#4316]
- [server] Add MySQL initialization script and update Docker
configuration by @pappz in #4345
- [management] Use DI containers for server bootstrapping by
@pascal-fischer in #4343
- [management] fail on geo location init failure by
@pascal-fischer in #4362
- [client] Fix rule order for deny rules in peer ACLs by @lixmal
in #4147
- [management] Remove save account calls by @pascal-fischer in
[#4349]
- [client] Fix/ice handshake by @pappz in #4281
- Bump github.com/containerd/containerd from 1.7.16 to 1.7.27 by
@dependabot[bot] in #3527
- [management] add nil handling for route domains by
@pascal-fischer in #4366
- [management] Add CreatedAt field to Peer and model by @hakansa
in #4371
- Bump golang.org/x/oauth2 from 0.24.0 to 0.27.0 by
@dependabot[bot] in #4176
- [management,client] Feat/exit node auto apply by @hakansa in
[#4272]
- feat(doc): Fix confusing comment by @Sonlis in #4376
- refactor doc workflow by @hakansa in #4373
- refresh service-install-cli-change.patch
* Wed Aug 13 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.54.2:
- [management] Enable flow groups by @bcmmbaga in #4230
- [server] Add health check HTTP endpoint for Relay server by
@pappz in #4297
- [client] Fix Go tarball version in FreeBSD build configuration
by @pappz in #4339
- [client] Add --disable-update-settings flag to the service by
@hakansa in #4335
* Tue Aug 12 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.54.1:
- [client] Eliminate upstream server strings in dns code by
@lixmal in #4267
- [management] use readlock on add peer by @pascal-fischer in
[#4308]
- [server, relay] Add pprof support for Relay server by @pappz in
[#4203]
- [client] Create NRPT rules separately per domain by @lixmal in
[#4329]
- [client] Skip dns upstream servers pointing to our dns server
IP to prevent loops by @lixmal in #4330
- [client] Distinguish between NXDOMAIN and NODATA in the dns
forwarder by @lixmal in #4321
* Fri Aug 08 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.54.0:
- Client Enhancements
- Added Windows ARM64 build support. #4206
- Renamed logout command to deregister for clarity. #4307
- Increased deregister timeout for more reliable
deregistration. #4311
- Fixed SSH command handling for non-default profiles. #4298
- Fixed profile manager panic when reading incomplete
configurations. #4309
- Updated Windows installer description. #4306
- Management Improvements
- Reworked database locking for improved concurrency handling.
[#4291]
- Marked SaveAccount method as deprecated. #4300
- Improved JSON migration by filtering duplicates on conflict.
[#4303]
- Other Changes
- Standardized naming: Changed "Netbird" to "NetBird" in CMD
usage. #4296
- Added documentation acknowledgement check. #4310
- Automated forum post creation after releases. #4312
- refresh service-install-cli-change.patch
* Wed Aug 06 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.53.0:
Control plane licensing changes
Changed the license of management, relay, and signal components
to AGPLv3. #4285
Learn more at
https://netbird.io/knowledge-hub/netbird-agpl-announcement
- Client Enhancements
- Improved userspace filter logging performance. #4221
- Added logout feature for improved session management. #4268
- Increased IP rule priorities to avoid routing conflicts.
[#4273]
- Added config flag to override default profile path in the
client service. #4276
- Included full sync response in the debug bundle for
troubleshooting. #4287
- Management Improvements
- Migrated group peers into a separate table for better
performance and structure. #4096
- Implemented network range change API. #4177
- Optimized peer group retrieval by removing unnecessary locks.
[#4280]
- Implemented peer expiration for invalid peers. #4275
- Other Changes
- Moved shared components to a centralized shared directory.
[#4286]
- Separated shared code dependencies for better modularity.
[#4288]
* Thu Jul 31 2025 Marcus Rueckert <mrueckert@suse.de>
- disable TestServer_Up on code 15
* Wed Jul 30 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.52.2:
- [misc] Dockerfile: pin gopls to v0.18.1 (latest that supports
golang 1.23) by @Bilgeworth in #4240
- [management] add account deleted event by @crn4 in #4255
- [client] Fix dns ipv6 upstream by @lixmal in #4257
* Tue Jul 29 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.52.1:
- [client] Disable the dns host manager properly if disabled
through management by @lixmal in #4241
- [client] Fix error handling for set config request on CLI by
@hakansa in #4237
* Tue Jul 29 2025 Marcus Rueckert <mrueckert@suse.de>
- refresh service-install-cli-change.patch
* Tue Jul 29 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.52.0:
This release adds the profile feature, please refer to the
documentation
https://docs.netbird.io/how-to/profiles
- [misc] Docker compose improvements by @Silex in #4037
- [client] Fix race issues in lazy tests by @pappz in #4181
- [client] Temporarily disable race detection in Relay by @pappz
in #4210
- [client] Fix legacy routing exclusion routes in kernel mode by
@lixmal in #4167
- [client] Add env and status flags for netbird service command
by @lixmal in #3975
- [management] extra settings integrated validator by @pnmcosta
in #4136
- [management] scheduler cancel all jobs by @pnmcosta in #4158
- [management] Log UpdateAccountPeers caller by @pascal-fischer
in #4216
- [client] Remove custom method from generated proto and use
inline logic for connection type filtering by @aliamerj in
[#4214]
- [management] Log BufferUpdateAccountPeers caller by
@pascal-fischer in #4217
- [client] handle order of check when checking order of files in
isChecksEqual by @pascal-fischer in #4219
- [client] make ICE failed timeout configurable by @gamerslouis
in #4211
- [client] client: container: support CLI with entrypoint
addition by @nazarewk in #4126
- [client] Always register NetBird with plain Linux DNS and use
original servers as upstream by @lixmal in #3967
- [client] Fix UDP proxy to notify listener when remote conn
closed by @pappz in #4199
- [client] Remove and deprecate the admin url functionality by
@lixmal in #4218
- [client] Add detailed routes and resolved IPs to debug bundle
by @lixmal in #4141
- [client] Feat/multiple profile by @hakansa in #3980
- [client] remove config flag by @hakansa in #4224
- [client] Fix pre-shared key state in wg show by @pappz in #4222
- [client] Fix config directory path handling based on
NB_STATE_DIR by @hakansa in #4229
- [client] Add support for disabling profiles feature via command
line flag by @hakansa in #4235
* Mon Jul 21 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.51.2
- [client] fix test by @pnmcosta in #4156
- [misc] add forum post and update sign pipeline by @mlsmaycon in
[#4155]
- [management] fix index creation if exist on mysql by
@pascal-fischer in #4150
- [management] Add validate flow response by @mlsmaycon in #4172
- [client, relay] The openConn function no longer blocks the
relayAddress function call by @pappz in #4180
- [client] Add --filter-by-connection-type flag to status command
by @aliamerj in #4010
- [client] Fix bind exclusion routes by @lixmal in #4154
- [management] Fix group resource count mismatch in policy by
@bcmmbaga in #4182
- [server, relay] Fix/relay race disconnection by @pappz in #4174
* Wed Jul 16 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.51.1:
- [client] Fix/nil relayed address by @pappz in #4153
* Tue Jul 15 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.51.0:
- [client] avoid parsing NB_NETSTACK_SKIP_PROXY if empty by
@iisteev in #4145
- [client, relay-server] Feature/relay notification by @pappz in
[#4083]
* Sat Jul 12 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.50.3:
- always suffix ephemeral peer name by @pnmcosta in #4138
- [management] sync calls to UpdateAccountPeers from
BufferUpdateAccountPeers by @crn4 in #4137
- [client] Fix elapsed time calculation when machine is in sleep
mode by @pappz in #4140
* Fri Jul 11 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.50.2:
- [management] Add name/ip filters to peer management rest client
by @mohamed-essam in #4112
- [management] Remove deleted user peers from groups on user
deletion by @bcmmbaga in #4121
- Update image in README.md by @braginini in #4122
- [client] Disable pidfd check on Android 11 and below by @pappz
in #4127
- [client] Nil check in iface configurer by @pappz in #4132
- [client] Update cli description of lazy connection by @pappz in
[#4133]
- [management] added cleanupWindow for collecting several
ephemeral peers to delete by @crn4 in #4130
- [client] Add rotated logs flag for debug bundle generation by
@lixmal in #4100
* Sun Jul 06 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.50.1:
- [client] Fix nil pointer exception in lazy connection by @pappz
in #4109
* Sat Jul 05 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.50.0:
- Client Enhancements
- Supported random WireGuard ports to enhance NAT traversal.
[#4085]
- Implemented DNS routes for Android. #3989
- Enabled fullstatus output even without probes. #4052
- Improved route log messages. #4034
- Used unique sequence numbers for BSD routes. #4081
- Improved lazy connection detection logic. #4050
- Avoided logging setup keys in error messages. #3962
- Login popup now runs in a separate goroutine. #4080
- Management Improvements
- Added network map metric breakdown and reported durations in
ms. #4020, #4064
- Added onboarding logic for account creation. #4084
- Provided clear error messaging for mismatched logins. #4097
- Logged user ID on account mismatch. #4101
- Enabled uniqueness constraint for peer IPs and labels,
improving generation performance. #4042
- Added option to disable default all-to-all policy. #3970
- Added backward-compatible error handling for setup key
registration. #4094
- Fixed account peer store retrieval by adding locking. #4092
- Fixed network update test for delete policy. #4086
- Removed unused database transactions. #4053
- Installer & Miscellaneous
- Fixed wrong default for NETBIRD_AUTH_PKCE_LOGIN_FLAG for
self-hosting. #4055
- Fixed Arch Linux install.sh error with empty dependencies.
[#4070]
- Now starts the service automatically after installation on
Arch Linux. #4071
- Removed unnecessary port 8080 in
getting-started-with-zitadel.sh. #4075
- Updated sign pipeline version. #4082
- Added a link to the community forum in documentation. #4093
- refreshed service-install-cli-change.patch
* Tue Jun 24 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.49.0:
- [management] add transaction for integrated validator groups
update and prim acc by @pascal-fischer in #4014
- [client] Handle lazy routing peers that are part of HA groups
by @lixmal in #3943
- [client] Refactor showLoginURL to improve error handling and
connection status checks by @hakansa in #4026
- [client] close window when process needs to exit by @mlsmaycon
in #4027
- [misc] add additional metrics by @mlsmaycon in #4028
- [management] check and log on new management version by
@mlsmaycon in #4029
- [misc] Specify netbird binary location in Dockerfiles by
@lixmal in #4024
- [client] Don't open cmd.exe during MSI actions by @lixmal in
[#4041]
* Fri Jun 20 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.48.0:
What's New
This release brings port range support to NetBird. Now you can
add rules with ports formated as <range_start>-<range_end>, with
that, if you need to allow all TCP ports, you can configure it
with 1-65535, see dashboard example below:
- Client Enhancements
- Fixed Android route notification behavior. #3971
- Added more advanced settings for Android clients. #4001
- Fixed port range squashing to ensure correct firewall rule
behavior. #4007
- Management Improvements
- Refactored route handling to use store methods for
consistency and maintainability. #2928
- Added backward compatibility for clients without firewall
rules port range support. #4003
- Exported ephemeral peer flag via API for better visibility.
[#4004]
* Tue Jun 17 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.47.2:
- [client] Fix UI Download URL by @hakansa in #3990
- [client] Prioritze the local resolver in the dns handler chain
by @lixmal in #3965
- [client] Tighten allowed domains for dns forwarder by @lixmal
in #3978
- [client] Fix DNS Interceptor Build Error by @hakansa in #3993
- [management] Avoid recalculating next peer expiration by
@mlsmaycon in #3991
- [client] Fix logic in updateStatus to correctly handle
connection state by @hakansa in #3994
* Tue Jun 17 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.47.1:
- Client Enhancements
- [client] Fix status recorder panic by @lixmal in #3988
* Mon Jun 16 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.47.0:
- Client Enhancements
- Added lazy connections support for routed networks. #3908
- Added advanced settings to the UI for better configurability.
[#3941]
- Added missing client meta flags. #3898
- Improved Android client with preference handling and
propagation networks. #3957, #3966
- Displayed login popup on session expiration. #3955
- Fixed local DNS resolver errors for domains with other record
types. #3959
- Optimized process check timing. #3938
- Removed strings from allowed IPs. #3920
- Improved ICMP connection tracking logs. #3963
- Prevented unnecessary UI updates. #3785
- Included peer's actual state in notifications. #3929
- Refactored ConnMgr context management for clarity. #3951
- Included Support wildcard DNS on iOS #3979
- Management Improvements
- Added port range support in firewall rules. #3823
- Enabled unidirectional rules for all-port policies. #3826
- Added account ID index to activity events. #3946
- Ensured peer flags persist in meta updates. #3958
- Propagated user groups when re-enabling group propagation.
[#3912]
- Added event streaming metrics. #3814
- Used xID for setup keys to avoid collisions. #3977
- Signal Service
- Enabled setting signal flags via environment variables. #3972
* Thu Jun 05 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 0.46.0:
* Client Enhancements
- Added a "Deselect All" option to the Exit Node menu. #3877
- Introduced a block inbound flag to prevent all inbound
connections. #3897
- Routes now apply immediately, not only on peer connection.
[#3907]
- Used native route facilities on BSD and Windows. #3862
- Enabled userspace local forwarding to internal interfaces
upon request. #3884
- Added debug output similar to wg show. #3922
- Improved DNS match tracing logs. #3928
- Ran registerdns before flushing for consistency. #3926
- Included systemd logs in the debug bundle. #3917
- Increased STUN probe timeout for better status detection.
[#3930]
- Allowed the NetBird service to log to console. #3916
- Logged duplicate client UI PIDs. #3915
- Applied return traffic rules conditionally if firewall is
stateless. #3895
- Refactored peer state change subscription mechanism. #3910
* Management Improvements
- Supported account creation and retrieval using private
domains. #3825
- Enabled REST client impersonation for improved session
management. #3879
- Added PostgreSQL support for activity events store. #3890
* Other Changes
- Fixed Zitadel user console access. #3446
- Addressed traefik relay accessibility. #3696
- Removed DNF config-manager error. #3925
- Fixed relay exposed address test. #3931
- Updated linter workflows to fail on codespell errors. #3913
- rebase patch service-install-cli-change.patch
* Sun Jun 01 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 0.45.3:
* [client] Fix HA router switch by @pappz in #3889
* Sat May 31 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 0.45.2:
* [misc] Add CLA note by @mlsmaycon in #3859
* [misc] Fix CLA link in the PR template by @braginini in #3860
* [management] lazy connection account setting by @pnmcosta in
[#3855]
* [management] Update traffic events pagination filters by
@bcmmbaga in #3857
* [management] Extend nameserver match domain validation by
@bcmmbaga in #3864
* [client] avoid overwriting state manager on iOS by
@pascal-fischer in #3870
* [management] force account id on save groups update by
@pnmcosta in #3850
* [management/client/rest] Fix panic on unknown errors by
@mohamed-essam in #3865
* [management] Add correlated network traffic event schema by
@bcmmbaga in #3680
* [client, android] Fix/android enable server route by @pappz in
[#3806]
* [management] Reset test containers after cleanup by @bcmmbaga
in #3885
* [server-test] Install libs for i386 tests by @pappz in #3887
* [client, android] Fix/notifier threading by @pappz in #3807
* [management] Prevent deletion of peers linked to network
routers by @bcmmbaga in #3881
* [client] Refactor exclude list handling to use a map for
permanent connections by @hakansa in #3901
* [management] Fix user groups propagation by @bcmmbaga in #3902
* [client] Fix peer close deadlock by @pappz in #3904
* Wed May 21 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.45.1:
- [client] Add latest gzipped rotated log file to the debug
bundle by @hakansa in #3848
- [client] Do not reconnect to mgm server in case of handler
error by @pappz in #3856
* Wed May 21 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.45.0:
- Client Enhancements
- Introduced lazy connection support to optimize client startup
and resource usage. You can learn more about the feature
here. #3379
- Fixed UI notification for new client versions. #3845
- Resolved an issue with legacy route compatibility when
connecting to older management servers (pre-v0.30.0). #3854
- Management Enhancements
- Added a flag to disable auto-migration, offering more control
during deployments. #3840
- Locking strength clause is now optional, improving
compatibility and flexibility. #3844
- Migrated the events SQLite store to GORM for more consistent
database handling. #3837
- Other Changes
- Updated the issue template to streamline community feedback.
[#3842]
* Sat May 17 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 0.44.0:
* [signal] adjust log levels by @pascal-fischer in #3813
* [signal] adjust signal log levels 2 by @pascal-fischer in #3817
* [client, android] Do not propagate empty routes by @pappz in #3805
* [management] Add connection type filter to Network Traffic API by
@bcmmbaga in #3815
* [management,client] PKCE add query parameter flag prompt=login or
max… by @crn4 in #3824
* [management] fix bug missed extra dns labels for a new peer by
@crn4 in #3798
* [client] Add FreeBSD desktop client support to OAuth flow by
@hakansa in #3822
* [signal] remove stream receive server side by @pascal-fischer in
[#3820]
* [management] extend rest client lib by @pascal-fischer in #3830
* [client] Disable dnssec for systemd explicitly by @lixmal in #3831
* [management] Make startup period configurable by @pascal-fischer
in #3767
* [client] Offer to remove netbird data in windows uninstall by
@lixmal in #3766
* Fri May 09 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.43.3:
- [management] Delete service users with account manager by
@bcmmbaga in #3793
- [management] policy delete cleans policy rules by
@pascal-fischer in #3788
- [client] Return with the correct copied length by @pappz in
[#3804]
- [client] Ignore irrelevant route changes to tracked network
monitor routes by @lixmal in #3796
- [client] Add TCP support to DNS service listener by @hakansa in
[#3790]
* Mon May 05 2025 Richard Rahl <rrahl0@opensuse.org>
- update to 0.43.2:
- [management] limit peers based on module read permission by
@pnmcosta in #3757
- [client] Add debug upload option to netbird ui by @lixmal in
[#3768]
- [management] user info with role permissions by @pnmcosta in
[#3728]
- [client] Add debug for duration option to netbird ui by @lixmal
in #3772
- [management] Get account id with order by @mlsmaycon in #3773
- [management] Optimize load account by @mlsmaycon in #3774
- [management] add gorm tag for primary key for the networks
objects by @pascal-fischer in #3758
- [client] set TLS ServerName for hostname-based QUIC connections
by @alindt in #3673
- [client] Fix stale local records by @lixmal in #3776
- [client] Improve NetBird installation script to handle daemon
connection timeout by @hakansa in #3761
- [management] removal of foreign key constraint enforcement on
sqlite by @pascal-fischer in #3786
- [management/client/rest] fix panic when body is nil by
@mohamed-essam in #3714
* Wed Apr 30 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.43.1:
- [client] add byte counters & ruleID for routed traffic on
userspace by @hakansa in #3653
- [management] add missing network admin mapping by @pnmcosta in
[#3751]
- [misc] Exclude client benchmarks from CI by @lixmal in #3752
- [management] Skip IdP cache warm-up on Redis if data exists by
@bcmmbaga in #3733
- [client] Feature/upload bundle by @mlsmaycon in #3734
- [misc] Add macOS .pkg installer support to installation script
by @hakansa in #3755
- [management] Add network traffic events pagination by @bcmmbaga
in #3580
- [client] Revert mgm client error handling by @pappz in #3764
* Fri Apr 25 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.43.0:
- Client Improvements
- Fixed exit node deselection behavior. #3722
- Dynamic firewall rules now set up for DNS routes based on DNS
responses. #3702
- Userspace ACL received additional filter test cases to
improve robustness. #3730
- GRPC error handling improved to catch flow errors better.
[#3727]
- Ensured destination-type local marks can overwrite NAT marks.
[#3738]
- Fixed macOS privacy warnings when accessing static system
information. #3496
- These updates enhance reliability and system compatibility
across platforms.
- Management Improvements
- Introduced a new Auditor Role for account access. (API only,
dashboard support is coming soon) #3721
- Introduced a Network Admin Role for network-specific
administration. (API only, dashboard support is coming soon)
[#3720]
- Impersonation via PATs (Personal Access Tokens) is now
supported for streamlined troubleshooting. #3739
- Other Changes
- Improved static checks when running in foreground mode. #3742
- Ran container tests in a more generic way for broader
coverage. #3737
* Wed Apr 23 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.42.0:
- Enhanced Route Management and UI States
- Clients now retain selected routes unless all are explicitly
deselected. #3692
- Added a connecting state to the client UI for improved status
feedback. #3712
- Firewall routes now include a route ID and support for
missing route domains. #3700
- Account and Domain Enhancements
- Management now supports custom domains per account via API
(Dashboard coming soon). #3726
- Added account metadata capabilities to improve account-level
visibility. #3724
- Improvements
- Permissions Manager: Now uses standard CRUD operations. #3690
- Dashboard Fix: Corrected handling of lastLogin display on the
management dashboard. #3725
- Benchmarking:
- Pushed benchmark results to Grafana. #3701
- Benchmarks now use ref_name. #3704
- Fixed GitHub run ID issue. #3705
- Dependency Updates
- Bumped golang.org/x/net from 0.36.0 to 0.38.0. #3695
- Bumped github.com/redis/go-redis/v9 from 9.7.1 to 9.7.3.
[#3553]
- Documentation
- Fixed a broken link in the README. #3697
* Sun Apr 20 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.41.3:
- [client] Set up signal to generate debug bundles by @lixmal in
[#3683]
- [client] Keep selecting new networks after first deselection by
@lixmal in #3671
- [misc] update gpt file permissions in install.sh by @Lamera in
[#3663]
- [client] Fix Rosenpass permissive mode handling by @pappz in
[#3689]
* Wed Apr 16 2025 Richard Rahl <rrahl0@opensuse.org>
- update to 0.41.2:
* [client] Remove logrus writer assignment in pion logging
* Tue Apr 15 2025 Richard Rahl <rrahl0@opensuse.org>
- update to 0.41.1:
* [management] add permissions manager to geolocation handler
* [client] Refactor DNSForwarder to improve handle wildcard domain resource
id matching
* [client] Add heap profile to debug bundle
* [client] Add remaining debug profiles
* [management] get current user endpoint
* Mon Apr 14 2025 Holden Fried <holden@opensuse.org>
- update to 0.41.0:
* [ci] include stash in pr template
* [docs] Fix a few typos on table
* [management,client] Add support to configurable prompt login
* [management] remove unnecessary access control middleware
* [management] Buffer updateAccountPeers calls
* [management] Refactor/management/updchannel
* Thu Apr 10 2025 Richard Rahl <rrahl0@opensuse.org>
- update to 0.40.1:
* [client] Support IP fragmentation in userspace
* [client] Handle truncated upstream DNS responses
* [misc] add git town workflow config
* [client] Support CNAME in local resolver
* [management] use permission modules
* [client] Fix dns cleanup race condition
* Tue Apr 08 2025 Richard Rahl <rrahl0@opensuse.org>
- update to 0.40.0:
* [management] permission manager validate account access (#3444)
* Improve local ip lookup (#3551)
* [client] Force new user login on PKCE auth in CLI (#3604)
* [client] Fix dns forwarder handling of requested record types (#3615)
* [client] Use the netbird logger for ice and grpc (#3603)
* [client] Fix missing inbound flows in Linux userspace mode with native
router (#3624)
* [client] Improve TCP conn tracking (#3572)
* [client] Fix Status Recorder Route Removal Logic to Handle Dynamic Routes
Correctly
* [client] Add no-browser flag to login and up commands for SSO login control
(#3610)
* [client] Enhance DNS forwarder to track resolved IPs with resource IDs on
routing peers (#3620)
* [client] Mark netbird data plane traffic to identify interface traffic
correctly (#3623)
* [client] Automatically register match domains for DNS routes (#3614)
* Fri Mar 28 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.39.2:
- [management] Sync account peers on network router group changes
by @bcmmbaga in #3573
- [client] fix route handling for local peer state by @hakansa in
[#3586]
- [management] fix extend call and move config to types by
@mlsmaycon in #3575
- [client] Ensure status recorder is always initialized by
@lixmal in #3588
- [management] Fix extended config when nil by @mlsmaycon in
[#3593]
- [client] Disable systemd-resolved default route explicitly on
match domains only by @lixmal in #3584
- [client] Stop flow grpc receiver properly by @lixmal in #3596
- [client] Prevent calling the onDisconnected callback in
incorrect state by @pappz in #3582
- [client] Fix close WireGuard watcher by @pappz in #3598
* Mon Mar 24 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.39.1:
- [management] Fix invalid port range sync by @mlsmaycon in #3571
- changes from 0.39.0
What's New
This release includes support for traffic events captured between
peers and resources and other peers in the network. We are also
adding support to the Redis cache for IDP data. This allows a
more persistent cache across management restarts.
Traffic events support (Cloud-only)
We’ve made significant progress on network traffic observability
by adding Traffic events support and enhancing event metadata.
The updates include:
- Traffic events support on client. #3414 These changes help you
gain deeper visibility into traffic flows within your network.
Learn more at
https://docs.netbird.io/how-to/traffic-events-logging.
- Improvements to Flow Stability and Debugging
- Improved handling of embedded listeners and shutdowns in flow
GRPC. #3557, #3564
- Added profiling dumps to the debug package to assist with
deeper diagnostics. #3517
- REST Client Improvements
- Bearer token support has been added to the management REST
client for more secure integrations. #3534
- Improvements
- DNS Policies: Fixed DNS NRPT policies handling. #3459
- Flow Acknowledgement: Added initiator field to flow
acknowledgments. #3563
- Redis IDP Cache: Management now logs Redis cache usage. You
can export the variable
NB_IDP_CACHE_REDIS_ADDRESS=redis://<IP>:<PORT> to the
management server to use the new store. #3562
- Version Fixes: Connection issues resolved for -dev, -alpha,
and similar versions. #3511
- Docker Compose Cleanup: Removed duplicate labels in the relay
service. #3502
- Bug Fixes
- Fixed issue with the Advanced Settings UI on Windows 11 when
using a Chinese locale. #3483
- Resolved an issue with always enabling NetworkResource in
createResource(). #3532
- Documentation
- Updated examples in the events section and added tag to the
ingress port docs. #3552
- Updated CONTRIBUTOR_LICENSE_AGREEMENT.md. #3535
- Other Changes
- Removed "Admin Panel" item from the UI client. #3560
* Sun Mar 16 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.38.2:
- [misc] Update link to kubernetes operator by @braginini in
[#3489]
- [client] Nil check on route manager by @pappz in #3486
- [client] Fix anonymized addresses documentation by @lixmal in
[#3505]
- [client] Set info logs and add dump state by @pappz in #3504
- [client] Fix state dump panic by @lixmal in #3519
* Mon Mar 10 2025 Holden Fried <holdenrf2021@gmail.com>
- Disabled hanging tests:
* TestNetworkMonitor_Event
* TestNetworkMonitor_MultiEvent
- Update to 0.38.0:
This release fixes a few bugs with client startup where the
client could get blocked in case of settings changes in the GUI
and improves the Network monitor lifecycle trigger to avoid race
conditions. It also adds an initial client support for a new
feature called Ingress ports that should allow users to enable
port forwarding in the future and port-range access control
policies.
- New features
- [client, management] Add Ingress ports initial support #3275
- Enhancements
- [client] Enable windows stderr logs by default #3476
- [docs] Fix typo #3477
- [client] Prevent panic in case of double close call #3475
- [client] Prevent to block channel writing #3474
- [client] Add option to autostart netbird ui in the Windows
installer #3469
- [client] Fix engine restart race condition #3435
- [client] Ignore candidates that are part of the the wireguard
subnet #3472
- [client] Increase local daemon connection timeout to 50 sec
[#3481]
- [management] return empty array instead of null on networks
endpoints #3480
* Fri Mar 07 2025 Marcus Rueckert <mrueckert@suse.de>
- fix paths for GUI assets
* Fri Mar 07 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.37.2:
- [client] fix extra DNS labels parameter to Register method in
client by @hakansa in #3371
- [tests] Retry mysql store creation on reused containers by
@pascal-fischer in #3370
- [client] Replace string to netip.Prefix by @pappz in #3362
- [misc] Replace webinar link by @braginini in #3380
- [management] Handle transaction error on peer deletion by
@bcmmbaga in #3387
- [misc] Fix typo by @Silex in #3415
- [client] Add Netbird GitHub link to the client ui about sub
menu by @robertgro in #3372
- [client] Close userspace firewall properly by @lixmal in #3426
- [client] UI Refactor Icon Paths by @hakansa in #3420
- [client] Handle large DNS packets in dns route resolution by
@lixmal in #3441
- Update bug-issue-report.md template by @lixmal in #3449
- [client] Fix TURN-Relay switch by @pappz in #3456
- [client] Print out the goroutine id by @pappz in #3433
- [misc] Traefik config improvements by @Silex in #3346
- [misc] Grafana dashboards by @muzammil360 in #3458
* Mon Feb 24 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.37.1:
- [client] Restart netbird-ui post-install in linux deb&rpm by
@mohamed-essam in #2992
- [client] Update local interface addresses when gathering
candidates by @lixmal in #3324
- [management] faster server bootstrap by @pnmcosta in #3365
- [client] fix privacy warning on macOS by @hurricanehrndz in
[#3350]
- [client] Disable notifications by default by @lixmal in #3375
* Sat Feb 22 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.37.0:
- [client] Normalize DNS record names to lowercase in local
handler update by @hakansa in #3323
- [signal] add pprof and message size metrics by @pascal-fischer
in #3337
- [management] Refactor users to use store methods by @bcmmbaga
in #2917
- [management] Add batching support for SaveUsers and SaveGroups
by @bcmmbaga in #3341
- [client][ui] added accessible tray icons by @karsa-mistmere in
[#3335]
- [misc] Run management benchmark jobs on file changes by
@mlsmaycon in #3343
- [client] [ui] issue when changing setting in GUI while peer
session is expired by @hakansa in #3334
- [signal] Fix registry not found by @pascal-fischer in #3342
- [management] remove gorm preparestmt from all DB connections by
@pascal-fischer in #3292
- [client] Set up local dns policy additionally if a gpo policy
is detected by @lixmal in #3336
- [management] optimize test execution by @pascal-fischer in
[#3204]
- [client][ui] Use go build to embed less icons by
@hurricanehrndz in #3351
- [misc] improvement(template): add traefik labels to relay by
@cesargoncalves in #3333
- [client] Add UI client event notifications by @lixmal in #3207
- [client, management] Support DNS Labels for Peer Addressing by
@hakansa in #3252
- [client] Add embeddable library by @lixmal in #3239
- [client] Skip CLI session expired notifcation if notifications
are disabled by @lixmal in #3266
- [management] refactor auth by @pnmcosta in #3296
- [client] Interface code cleaning by @pappz in #3358
- [misc] Update README.md by @braginini in #3360
- [management,client,signal] Update google.golang.org/api to
latest by @paralin in #3288
- [misc][Snyk] Security upgrade alpine from 3.21.0 to 3.21.3 by
@mlsmaycon in #3359
- [client] Add reverse dns zone by @lixmal in #3217
- [management] fix grpc new account by @pnmcosta in #3361
- [client] Add netbird ui improvements by @lixmal in #3222
- [client] Fix udp forwarder deadline by @lixmal in #3364
- [misc] Rename client tests in CI by @lixmal in #3366
* Thu Feb 13 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.36.7:
- [client] Fix priority handling by @pappz in #3313
- [client] Use GPO DNS Policy Config to configure DNS if present
by @lixmal in #3319
* Wed Feb 12 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.36.6:
- Bump golang.org/x/net from 0.30.0 to 0.33.0 by @dependabot in
[#3218]
- [client, server] Cleanup magiconair usage from repo by @pappz
in #3276
- Management REST Client Code by @mohamed-essam in #3278
- [client] use embedded root CA if system certpool is empty by
@hakansa in #3272
- [misc] Replace Wiretrustee with Netbird by @lixmal in #3267
- [client] Fix acl empty port range detection by @lixmal in #3285
- [relay] Use new upstream for nhooyr.io/websocket package by
@paralin in #3287
- [client] Fix grouping of peer ACLs with different port ranges
by @lixmal in #3289
- [client] Fix nil pointer exception when load empty list and try
to cast it by @pappz in #3282
- [management] Check groups when counting peers on networks list
by @pascal-fischer in #3284
- [management] add logs for grpc API by @pascal-fischer in #3298
- [client] Add experimental support for userspace routing by
@lixmal in #3134
- [signal] Fix context propagation in signal server by @4thel00z
in #3251
- [client, relay] Fix/wg watch by @pappz in #3261
- [client] Support dns upstream failover for nameserver groups
with same match domain by @lixmal in #3178
- [client] Fix dns handler chain test by @lixmal in #3307
- [client] Check for fwmark support and use fallback routing if
not supported by @lixmal in #3220
- [client] Enable userspace forwarder conditionally by @lixmal in
[#3309]
- fix integration tests by @pnmcosta in #3311
* Wed Jan 29 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 0.36.5:
- [client] Replace engine probes with direct calls by @lixmal in
[#3195]
- Update sign pipeline version by @mlsmaycon in #3246
- [client] Add missing peer ACL flush by @lixmal in #3247
* Tue Jan 28 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.36.4:
- [client] Allow freebsd to build netbird-ui by @lixmal in #3212
- [management] Refactor peers to use store methods by @bcmmbaga
in #2893
- [misc] Fix: typo in test output by @JinxCappa in #3216
- [management] remove peer from group on delete by
@pascal-fischer in #3223
- [management] disable prepareStmt for sqlite by @pascal-fischer
in #3228
- [client] Fix freebsd default routes by @lixmal in #3230
- [client] Use correct stdout/stderr log paths for debug bundle
on macOS by @lixmal in #3231
- [client] Back up corrupted state files and present them in the
debug bundle by @lixmal in #3227
- [client] Match more specific dns handler first by @lixmal in
[#3226]
- [client] Mark redirected traffic early to match input filters
on pre-DNAT ports by @lixmal in #3205
- [management] use account request buffer on sync by
@pascal-fischer in #3229
- [management/signal/relay] add metrics descriptions by
@pascal-fischer in #3233
- [client] Support port ranges in peer ACLs by @lixmal in #3232
- [client] Use dynamic dns route resolution on iOS by @lixmal in
[#3243]
- [management] copy source and destination resource on policyRule
copy by @pascal-fischer in #3235
* Fri Jan 17 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.36.3:
- [client] Close ice agent only if not nil by @mlsmaycon in #3210
* Fri Jan 17 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.36.2:
- [relay] Don't start relay quic listener on invalid TLS config
by @lixmal in #3202
- [management] Fix network migration issue in Postgres by
@bcmmbaga in #3198
- [management] add duration logs to Sync by @pascal-fischer in
[#3203]
* Thu Jan 16 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.36.1:
What's Changed
- [client] Fix windows info out of bounds panic by @lixmal in
[#3196]
* Thu Jan 16 2025 Marcus Rueckert <mrueckert@suse.de>
- update to 0.36.0:
This release introduces initial support to QUIC as a protocol for
relay servers, MySQL support for store, and rootless container
support for the client running Netstack mode. We also added
support for disabling system flags in the client, and optional
ZITADEL PAT configuration in the management service among other
enhancements and bug fixes.
New features
QUIC Protocol Support
Added initial support for the QUIC protocol in the client and
relay server, improving connection reliability and performance.
For self-hosted admins that want to try this out, you should
ensure that the relay server has TLS certificates configured and
that the main listening port is available in both, TCP and UDP.
Rootless Container Support
Implemented rootless container support for the client running in
Netstack mode, enabling secure and compatible operation without
requiring privileged permissions or Linux capabilities.
You can use the images netbirdio/netbird:rootless-latest or
netbirdio/netbird:0.36.0-rootless for this mode.
Learn more about how to enable Netstack mode in the
documentation.
MySQL Support
Added MySQL support for the management service, allowing users to
store data in a MySQL database. This feature is particularly
useful for organizations that prefer MySQL as their database
backend.
If you want to start a new deployment with MySQL, you can use the
environment variable NETBIRD_STORE_CONFIG_ENGINE=mysql and
NETBIRD_STORE_ENGINE_MYSQL_DSN="<username>:<password>@tcp(127.0.0.1:3306)/<database>"
in the setup.env file.
We are counting on your feedback and community contributions to
improve documentation for this support.
Enhancements
New system flags to disable a few features on the client side We
are introducing a set of new flags that allow users to disable
specific features on the client side. This is particularly useful
for users who wants more control over their system
configurations.
The new flags are available with the netbird up command, see the
flags below:
- -disable-client-routes Disable client routes. If enabled,
the client won't process client routes received from the
management service.
- -disable-dns Disable DNS. If enabled, the client won't
configure DNS settings.
- -disable-firewall Disable firewall configuration. If
enabled, the client won't modify firewall rules.
- -disable-server-routes Disable server routes. If enabled,
the client won't act as a router for server routes
received from the management service.
Optional ZITADEL PAT Configuration Enabled optional configuration
of a Personal Access Token (PAT) for ZITADEL in the management
service, enhancing authentication options for users who want to
use ZITADEL as their identity provider.
To configure the ZITADEL PAT, you can use the environment
variable NETBIRD_IDP_MGMT_EXTRA_PAT=<secret> in the setup.env
file.
For all the details see:
https://github.com/netbirdio/netbird/releases/tag/v0.36.0
* Wed Jan 01 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 0.35.2:
* [management] Add missing group usage checks for network
resources and routes access control by @bcmmbaga in #3117
* [management] remove ids from policy creation api by
@pascal-fischer in #2997
* [management] Fix networks net map generation with posture
checks by @mlsmaycon in #3124
* [management] add selfhosted metrics for networks by
@pascal-fischer in #3118
* [client] Ignore case when matching domains in handler chain by
@lixmal in #3133
[client] Allow inbound rosenpass port by @lixmal in #3109
* [management] Preserve jwt groups when accessing API with PAT by
@bcmmbaga in #3128
* [management] remove sorting from network map generation by
@pascal-fischer in #3126
* [management] Fix policy tests by @mlsmaycon in #3135
* Fri Dec 27 2024 Holden Fried <holdenrf2021@gmail.com>
- update to 0.35.1:
* What's Changed:
- [client] Don't fail debug if log file is console by @lixmal in #3103
- [client] Fix inbound tracking in userspace firewall by @lixmal in #3111
* Mon Dec 23 2024 Holden Fried <holdenrf2021@gmail.com>
- update to 0.35.0:
* Release notes:
- With this release, we are introducing a new concept in NetBird called
Networks. This concept improves the administration of routed resources
and provides greater visibility into what is shared with peers. Networks
are configuration containers that map your on-premise or cloud networks
in a logical set of configurations, making it easier to manage and share
routes with your peers based on your infrastructure.
* What's changed:
- [client] Add support for state manager on iOS by @pascal-fischer in #2996
- [client] Add peer conn init limit by @mlsmaycon in #3001
- [management] Remove peer needs login log message by @bcmmbaga in #3005
- [management] restructure api files by @pascal-fischer in #3013
- [Snyk] Security upgrade alpine from 3.20 to 3.21.0 by @mlsmaycon in #3019
- [client] Fix race condition with systray ready by @mohamed-essam in #2993
- [misc] split tests with management and rest by @mlsmaycon in #3051
- [misc] Handle dnf version 5 in install script by @mohamed-essam in #3026
- [client] fix: reformat IPv6 ICE addresses when hole punching by @jclds139
in #3050
- [misc] Upgrade x/crypto package by @mlsmaycon in #3055
- fix client unsupported h2 protocol when only 443 activated by @V-E-O
in #3009
- [client] Avoid using iota on mixed const block by @mlsmaycon in #3057
- [client, management] Add new network concept by @lixmal in #3047
- [client] Do not start DNS forwarder on client side by @pappz in #3094
- [management] Fix duplicate resource routes when routing peer is part of
the source group by @bcmmbaga in #3095
- [client] Reduce DNS handler chain lock contention by @lixmal in #3099
- [management] Run test sequential by @pascal-fischer in #3101
- [client] Add firewall rules to the debug bundle by @lixmal in #3089
- [client] Add stateful userspace firewall and remove egress filters
by @lixmal in #3093
* Thu Dec 05 2024 Holden Fried <holdenrf2021@gmail.com>
- update to 0.34.1:
* [client] Cleanup status resources on engine stop by @mlsmaycon
in #2981
* [client] Don't return error in rule removal if protocol is not
supported by @lixmal in #2990
* [client] Init route selector early by @lixmal in #2989
* [client] Reduce max wait time to initialize peer connections
by @mlsmaycon in #2984
* [management] Update account peers on login on meta change by
@mohamed-essam in #2991
* [client] upgrade zcalusic/sysinfo to v1.1.3 (add serial support
for ARM arch) by @EdouardVanbelle in #2954
* Wed Dec 04 2024 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 0.34.0:
* Enhancements:
- Persistent network route selection
This feature is handy for users who want to maintain a
specific network route selection across client restarts. The
client will now remember the network routes selected before
the restart and apply them after the restart.
* Bug fixes:
- Account different policy rules for route firewall rules
The network access control policy rules now account for peers
in source groups. This fix ensures that the rules are
correctly applied to the network routes.
* What's Changed
- [misc] Update Caddyfile and Docker Compose to support HTTP3
[#2822]
- [client] Refactor initial Relay connection #2800
- [client] Don't return error in userspace mode without
firewall when setting legacy #2924
- [client] Test nftables for incompatible iptables rules #2948
- [client] Set up sysctl and routing table name only if routing
rules are available #2933
- [client] Allow routing to fallback to exclusion routes if
rules are not supported #2909
- [client] Code cleaning in net pkg #2932
- [client] Unspecified address: default
NetworkTypeUDP4+NetworkTypeUDP6 #2804
- [client] Add pprof build tag #2964
- [client] Persist route selection #2810
- [client] Add state file to debug bundle #2969
- [client] Fix debug bundle state anonymization test #2976
- [client] Pass IP instead of net to Rosenpass #2975
- [client] Get static system info once #2965
- [client] Add netbird.err and netbird.out to debug bundle
[#2971]
- [client] Add network map to debug bundle #2966
- [client] Don't choke on non-existent interface in route
updates #2922
- [client] Add state handling cmdline options #2821
- [management] Refactor posture check to use store methods
[#2874]
- [management] Refactor policy to use store methods #2878
- [management] Refactor DNS settings to use store methods #2883
- [management] Refactor nameserver groups to use store methods
[#2888]
- [management] refactor to use account object instead of
separate db calls for peer update #2957
- [management] Add performance test for login and sync calls
[#2960]
- [management] Add guide when signing key is not found #2942
- [management] Account different policy rules for route
firewall rules #2939
- [management] Add missing parentheses on iphone hostname
generation condition #2977
- [management] merge update account peers in sync call #2978
* Sat Nov 30 2024 Richard Rahl <rrahl0@opensuse.org>
- fix SLE_15_SP4 build by using go1.23
- remove %suse_update_desktop_file
- remove the go1.21 hack, as we enabled the :Update repos
- use pkgconfig for BuildRequires
* Fri Nov 22 2024 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 0.33.0:
* [misc] Introducing NetBird Guru on Gurubase.io by @kursataktas
in #2778
* [misc] use google domain for tests by @mlsmaycon in #2902
* [misc] Update signing pipeline version by @mlsmaycon in #2900
* [management] Add transaction metrics and exclude getAccount
time from peers update by @pascal-fischer in #2904
* [client] Add NB_SKIP_SOCKET_MARK & fix crash instead of
returing an error by @nazarewk in #2899
* [management] Fix process posture check evaluation on Sync by
@pascal-fischer in #2911
* [management] Add metric for peer meta update by @pascal-fischer
in #2913
* [management] Add activity events to group propagation flow by
@pascal-fischer in #2916
* [client] Fix allow netbird rule verdict by @lixmal in #2925
* [management] Fix getSetupKey call by @pascal-fischer in #2927
* Mon Nov 18 2024 Holden Fried <holdenrf2021@gmail.com>
- update to 0.32.0:
* [management] Refactor setup key to use store methods by
@bcmmbaga in #2861
* [management] Add more logs to the peer update processes
by @pascal-fischer in #2881
* [client] Improve state write timeout and abort work early
on timeout by @lixmal in #2882
* [relay-server] Always close ws conn when work thread exit
by @pappz in #2879
* [client] Update route calculation tests by @mlsmaycon in #2884
* [client] Handle panic on nil wg interface by @lixmal in #2891
* [management] Fix limited peer view groups by @pascal-fischer
in #2894
* [client/management] add peer lock to peer meta update and fix
isEqual func by @pascal-fischer in #2840
* [management] Limit the setup-key update operation by
@pascal-fischer in #2841
* [management] Refactor group to use store methods by @bcmmbaga
in #2867
* [management] Fix the Inactivity Expiration problem. by
@ismail0234 in #2865
* [client] Fix state manager race conditions by @lixmal in #2890
* [client] Move state updates outside the refcounter by @lixmal
in #2897
* [client] Fix error state race on mgmt connection error by
@lixmal in #2892
* Mon Nov 11 2024 Holden Fried <holdenrf2021@gmail.com>
- update to 0.31.1:
* [management] Fix add peer all group network map update
by @pascal-fischer in #2830
* [misc] Avoid failing all other matrix tests if one fails
by @mlsmaycon in #2839
* [client] Fix cached device flow oauth by @mlsmaycon in #2833
* [management] Fix network map update on peer validation by
@pascal-fischer in #2849
* [client] Use the prerouting chain to mark for masquerading to
support older systems by @lixmal in #2808
* [relay-server] Use X-Real-IP in case of reverse proxy by @pappz
in #2848
* [client] Exclude split default route ip addresses from anonymization
by @lixmal in #2853
* [management] Enforce max conn of 1 for sqlite setups by
@pascal-fischer in #2855
* [management] Fix potential panic on inactivity expiration log
message by @pascal-fischer in #2854
* [management] Add benchmark tests to get account with claims
by @mlsmaycon in #2761
* [client] Use offload in WireGuard bind receiver by @pappz in #2815
* [management] Remove context from database calls by @pascal-fischer
in #2863
* [management] Add peer lock to grpc server by @pascal-fischer in #2859
* [management] Fix api error message typo peers_group by @lixmal in #2862
* [client] Remove loop after route calculation by @pappz in #2856
* [client] fix/proxy close by @pappz in #2873
* [client] Fix race conditions by @lixmal in #2869
* Fri Nov 01 2024 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 0.31.0:
Because of a database migration where the setup-keys are being
hashed, a downgrade is no longer possible without restoring a
backup. So, testing and making sure a backup is done before
upgrading is highly recommended. See backup docs here:
https://docs.netbird.io/selfhosted/selfhosted-guide#backup
* [management] Setup key improvements #2775
- We added support to setup-key deletion, allowing account
cleanup of revoked or expired keys.
- The max expiration time was removed, allowing users to define
any date for key expiration.
- Setup-keys are now stored as hashs, improving security for
systems.
* Improvements
- [client] Make native firewall init fail firewall creation
[#2784]
- [misc] Update Zitadel from v2.54.10 to v2.64.1 #2793
- [client] allow relay leader on iOS #2795
- [management] remove network map diff calculations #2820
- [management] Add DB access duration to logs for context
cancel #2781
- [client] Log windows panics #2829
* Bug fixes
- [client] Ignore route rules with no sources instead of
erroring out #2786
- [client] Fix multiple peer name filtering in netbird status
command #2798
- [client] Fix the broken dependency gvisor.dev/gvisor #2789
- [management] Fix peer meta isEqual #2807
- [client] Nil check on ICE remote conn #2806
- [client] Allocate new buffer for every package #2823
- [client] Fix unused servers cleanup #2826
- [client] Remove legacy forwarding rules in userspace mode
[#2782]
* Thu Oct 24 2024 Holden Fried <holdenrf2021@gmail.com>
- update to 0.30.3:
* [management] Fix domain information is up to date check by
@mlsmaycon in #2754
* Fix decompress zip path by @mlsmaycon in #2755
* Update sign workflow version by @mlsmaycon in #2756
* Release global lock on early error by @mlsmaycon in #2760
* Replace suite tests with regular go tests by @mlsmaycon
in #2762
* [management] Fix context cancellation with JWT group sync
enabled by @bcmmbaga in #2767
* [client] Eliminate UDP proxy in user-space mode by @pappz
in #2712
* [management] Optimize network map updates by @bcmmbaga in #2718
* [management] Fix session inactivity response by @pascal-fischer
in #2770
* [relay-client] Log exposed address by @pappz in #2771
* [client] Cleanup dns and route states on startup by @lixmal
in #2757
* [client] Fix controller re-connection by @pappz in #2758
* [client] Cleanup firewall state on startup by @lixmal in #2768
* Wed Oct 16 2024 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 0.30.2:
* [relay, client] Relay/fix/wg roaming by @pappz in #2691
* [management] Refactor getAccountIDWithAuthorizationClaims by
@mlsmaycon in #2715
* [client] Add table filter rules using iptables by @lixmal in
[#2727]
* [relay-server] Move the handshake logic to a separated struct
by @pappz in #2648
* [management] Add session expire functionality based on
inactivity by @ctrl-zzz in #2326
* [client] Add universal bin build and update sign workflow
version by @mlsmaycon in #2738
* [client] Exclude loopback from NAT by @lixmal in #2747
* [misc] Update Zitadel version on quickstart script by @eoksum
in #2744
* [management] Fix JSON function compatibility for SQLite and
PostgreSQL by @bcmmbaga in #2746
* Fri Oct 11 2024 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 0.30.1:
* [management] Remove admin check on getAccountByID by
@pascal-fischer in #2699
* [management] Validate peer ownership during login by @bcmmbaga
in #2704
* [client] Limit P2P attempts and restart on specific events by
@lixmal in #2657
* [management] Propagate error in store errors by @pascal-fischer
in #2709
* [misc] Add Link to the Lawrence Systems video by @braginini in
[#2711]
* [management] Make max open db conns configurable by
@pascal-fischer in #2713
* [management] Add support to envsub go management configurations
by @mlsmaycon in #2708
* [management] Move testdata to sql files by @pascal-fischer in
[#2693]
* [client] Improve route acl by @lixmal in #2705
* [signal] new signal dispatcher version by @pascal-fischer in
[#2722]
* Sun Oct 06 2024 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- convert to using obs_scm
- update to 0.30.0:
* What's New
- Access Control for Network Routes
Starting with version 0.30.0, users can assign access control
groups to network routes, offering improved security and
traffic restrictions. Route access is now unidirectional,
ensuring traffic complies with the specified policies before
authorization. This feature enhances the flexibility of
network management.
To configure this, follow the documentation: Configuring
routes with access control.
https://docs.netbird.io/how-to/configuring-routes-with-access-control
* Improvements
- Add Access Control for Network Routes: [management, client]
Add access control support to network routes #2100
- Remove Redundant Account Token Calls: [management] Remove
redundant get account calls in GetAccountFromToken #2615
- Refactor User JWT Group Synchronization: [management]
Refactor User JWT group sync #2690
* Bug Fixes
- Anonymize Relay Address in Peers View: [client] Anonymize
relay address in status peers view #2640
- Check WireGuard Interface Instead of Engine Context: [client]
Check wginterface instead of engine ctx #2676
- Close Remote Connection in Proxy: [client] Close the remote
conn in proxy #2626
- Fix eBPF Close Function: [client] Fix ebpf close function
[#2672]
- Fix Relay Disconnection Handling: [client] Fix Relay
disconnection handling #2680
- Restrict Peer Access for Non-Admins: [management] Restrict
accessible peers to user-owned peers for non-admins #2618
* Other Changes
- Adjust Relay Worker Log Levels: [client] Adjust relay worker
log level and message #2683
- Improve Error Count Formatting: [client] Fix error count
formatting #2641
- Refactor Interface Package: [client] Refactor/iface pkg #2646
- Remove Custom Localhost Dialer: [client] Remove usage of
custom dialer for localhost #2639
- Add Account Existence Check to AccountManager: [management]
Add AccountExists to AccountManager #2694
- Add DB Retrieval Method: [management] Add get DB method to
store #2650
- Fix Account Manager Mock Implementation: [management] Fix
account manager mock #2695
- Propagate Management Metrics: [management] Propagate metrics
[#2667]
- Remove File Store in Management: [management] Remove file
store #2689
- Update Management Docker Image: [management] Update
management base docker image #2687
- Improve ZITADEL IDP Error Handling: [management] improve
zitadel idp error response detail #2634
- Add Log Setting to Caddy Container: [misc] Add log setting to
Caddy container #2684
- Fix IP Range Posture Check Example: [misc] Fix ip range
posture check example in API doc #2628
- Update to Goreleaser Version 2: [misc] Specify goreleaser
version and update to 2 #2673
- Use Packages to Fetch Latest Version: [misc] Use the pkgs to
get the latest version #2682
- Move Signal Message Handling into Dispatcher: [signal] Move
dummy signal message handling into dispatcher #2686
- Propagate Signal Metrics: [signal] Propagate metrics #2668
- Add Context to Signal Dispatcher: [signal] add context to
signal-dispatcher #2662
* Sat Sep 21 2024 Holden Fried <holdenrf2021@gmail.com>
- Update to 0.29.4
- Selected notes from https://github.com/netbird/releases/tag/v0.29.4:
* Do not block the msg receiving if the wg proxy does not operate by @pappz in #2617
* Exit from processConnResults after all tries by @pappz in #2621
* Wed Sep 18 2024 Holden Fried <holdenrf2021@gmail.com>
- Update to version 0.29.3
- Selected notes from https://github.com/netbird/releases/tag/v0.29.3:
* [client] Ensure engine is stopped before starting it back by @hurricanehrndz in #2565
* [relay] Change heartbeat timeout by @pappz in #2598
* [client] Fix blocked net.Conn Close call by @pappz in #2600
* [management] Add command flag to set metrics port for signal and relay service, and
update management port by @benniekiss in #2599
* [client] Fix get management and signal state race condition by @mlsmaycon in #2570
* [management] fix legacy decrypting of empty values by @bcmmbaga in #2595
* [signal] Fix signal active peers metrics by @pascal-fischer in #2591
* [management] Add transaction to addPeer by @pascal-fischer in #2469
* [client] Fix leaked server connections by @pappz in #2596
* [relay] Add health check attempt threshold by @mlsmaycon in #2609
* [client] Fix race condition while read/write conn status in peer conn by @pappz in #2607
* [client] Cancel the context of wg watcher when the go routine exit by @pappz in #2612
- Packaging changes:
* Fixed leap 15.6 and SLE builds, cleaned up some redundancy from specfile
* Sat Sep 14 2024 Holden Fried <holdenrf2021@gmail.com>
- Update to version 0.29.2
- Selected notes from https://github.com/netbird/releases/tag/v0.29.2:
* [management] Add GCM encryption and migrate legacy encrypted events by @bcmmbaga in #2569
* [management] Add accessible peers endpoint by @bcmmbaga in #2579
* [client] fix: install.sh: avoid call of netbird executable after rpm-ostree installation by @M0Rf30 in #2589
* [client] Fix wg handshake checking by @pappz in #2590
* [misc] Support configurable max log size with var NB_LOG_MAX_SIZE_MB by @mlsmaycon in #2592
- Update to version 0.29.1
- Selected release notes from https://github.com/netbird/releases/tag/v0.29.1:
* [client] Don't overwrite allowed IPs when updating the wg peer's endpoint address by @lixmal in #2578
* [relay] Improve relay messages by @lixmal in #2574
* [relay] change log levels by @pappz in #2580
* Remove pre-release step from workflow by @mlsmaycon in #2583
- Packaging changes:
* Fixed blank desktop icon for netbird-applet
* Added package for new experimental relay feature
* Removed stripping flags to allow debug builds to be generated
* Better organization of specfile
* Wed Sep 11 2024 Holden Fried <holdenrf2021@gmail.com>
- Update to version 0.29.0
- Selected release notes from https://github.com/netbirdio/netbird/releases/tag/v0.29.0:
* New relay implementation utilizing WebSockets available for testing in self-hosted server
* Signal Dispatcher: Introduced signal dispatcher for better signaling. #2373
* Support for ECDSA Public Keys: Added support for ECDSA public keys in management. #2461
* Fix Deadlock on Auto Connect: Avoided deadlock in client auto-connect with early exit handling. #2528
* Destroy WG Interface on Timeout: Addressed issue where WireGuard interface wasn't destroyed on down timeout. #2435
* Fix Service Down: Corrected the service-down issue in the client. #2519
* Prevent Client Panic: Fixed client panic when there was no connection. #2541
* Error Handling in OpenConnVia: Improved error handling in the openConnVia function. #2560
* Fix Lock on Down: Fixed a lock issue when the service was brought down. #2546
* Sun Aug 25 2024 Holden Fried <holdenrf2021@gmail.com>
- Update to version 0.28.9
- Release notes from https://github.com/netbirdio/netbird/releases/tag/v0.28.9:
* [management] Rename request buffer and update default interval by @pascal-fischer in #2459
* [client] Add test for SetFlagsFromEnvVars by @mlsmaycon in #2460
* [client] Refactor free port function by @mlsmaycon in #2455
* [misc] Bump github.com/docker/docker from 26.1.4+incompatible to 26.1.5+incompatible by @dependabot in #2426
* [misc] Add support for NETBIRD_STORE_ENGINE_POSTGRES_DSN environment variable in setup.env by @arosberg in #2462
* [management] Refactor HTTP metrics by @bcmmbaga in #2476
- Update to version 0.28.8
- Selected release notes from https://github.com/netbirdio/netbird/releases/tag/v0.28.8:
* [misc] Use docker compose command by @mlsmaycon in #2382
* [management] Skip network map check if not regular user by @mlsmaycon in #2402
* [management] Improve mgmt sync performance by @lixmal in #2363
* [client] Update dependencies and switch systray library by @bcmmbaga in #2309
* [management] Add batch delete for groups and users by @bcmmbaga in #2370
* [client] Allow setup keys to be provided in a file by @moosetheory in #2337
* [misc] Update bug-issue-report.md to include netbird debug cmd by @lixmal in #2413
* [client] Parse data from setup key by @mlsmaycon in #2411
* [misc] Update bug-issue-report.md to include anon flag by @lixmal in #2412
* [management] Prevent removal of All group from peers during user groups propagation by @bcmmbaga in #2410
* [client] Upgrade fyne version to fix freezing routes window by @mlsmaycon in #2417
* [client] Mtls support by @Foosec in #2188
* [client] Update PNG systray disconnected icon by @lixmal in #2428
* [misc] Fix linting Issues by @bcmmbaga in #2427
* [management] Split DB calls in peer login by @pascal-fischer in #2439
* [misc] Loading tun module for synology in install.sh by @pascal-fischer in #2423
* [misc] Use clearer wording on issue template by @lixmal in #2443
* [management] Fix logging out peers on deletion by @lixmal in #2453
* [management] Add buffering for getAccount requests during login by @pascal-fischer in #2449
* Sat Aug 03 2024 Holden Fried <holdenrf2021@gmail.com>
- Update to version 0.28.7
- Release notes from https://github.com/netbirdio/netbird/releases/tag/v0.28.7:
* Fix error handling by @pappz in #2316
* add save peer status test for connected peers by @mlsmaycon in #2321
* Add SavePeer method to prevent a possible account inconsistency by @mlsmaycon in #2296
* Fix race in set listener by @pappz in #2332
* Save daemon address on service install by @mlsmaycon in #2328
* Remove redundant check for empty JWT groups by @bcmmbaga in #2323
* Refactor login with store.SavePeer by @mlsmaycon in #2334
* fix(tests): freebsd should be red on error by @skillcoder in #2346
* Add write lock for peer when saving its connection status by @mlsmaycon in #2359
* Save account on saving users and groups by @bcmmbaga in #2362
* Move write peer lock by @mlsmaycon in #2364
* Freebsd test all root component by @skillcoder in #2361
* Use accountID retrieved from the sync call to acquire read lock sooner by @mlsmaycon in #2369
* Handling invalid UTF-8 character in sys info by @pappz in #2360
* When creating new setup key, "revoked" field doesn't do anything by @pappz in #2357
* Bump github.com/docker/docker from 26.1.3+incompatible to 26.1.4+incompatible by @dependabot in #2356
* fix(util): syslog output contains duplicated timestamp by @mrl5 in #2292
* Allow route updates even if some domains failed resolution by @lixmal in #2368
* Adding geolocation download log message. by @keac in #2085
* Add extra auth audience field on HttpConfig for automation user to authorize via zitadel by @dfry in #2350
* Extend client debug bundle by @lixmal in #2341
* Move Bundle to before netbird down by @mlsmaycon in #2377
* Fix Windows file version by @mlsmaycon in #2380
* Remove Codacy badge as it is broken by @braginini in #2379
* Fix DNS resolution for routes on iOS by @pascal-fischer in #2378
* Add sonar badge by @pascal-fischer in #2381
- Fix patch to handle changes in client/cmd/service_installer.go
- Change _service to use ref tag instead of parent tag (thanks to rrahl0 for recommendation)
* Fri Jul 26 2024 Holden Fried <holdenrf2021@gmail.com>
- Update to version 0.28.6
- Release notes from https://github.com/netbirdio/netbird/releases/tag/v0.28.6:
* Minor fix local dns search domain by @hurricanehrndz in #2287
* Remove default allow for UDP on unmatched packet by @mlsmaycon in #2300
* Retry management connection only on context canceled by @mlsmaycon in #2301
* Ignore network monitor checks for software interfaces by @mlsmaycon in #2302
* Sat Jul 20 2024 Holden Fried <holdenrf2021@gmail.com>
- Update to version 0.28.5
- Release notes from https://github.com/netbirdio/netbird/releases/tag/v0.28.5:
* Sort routes by ID and remove DNS routes from overlapping list by @mlsmaycon in #2234
* Fix issue with canceled context before pushing metrics and decreasing pushing interval by @mlsmaycon in #2235
* Avoid empty domain overwrite by @pascal-fischer in #2252
* Add release version to windows binaries and update sign pipeline version by @mlsmaycon in #2256
* Get client ui locale on windows natively by @lixmal in #2251
* Bump google.golang.org/grpc from 1.64.0 to 1.64.1 by @dependabot in #2248
* Fix parameter limit issue for Postgres store by @mlsmaycon in #2261
* Support DNS routes on iOS by @pascal-fischer in #2254
* fix 2260: fallback serial to Board by @EdouardVanbelle in #2263
* Add logging option for WG device by @pappz in #2271
* Limit GUI process execution to one per UID by @mlsmaycon in #2267
* Add batch save/update for groups and users by @bcmmbaga in #2245
* fix forwarded metrics by @mlsmaycon in #2273
* Ignore non unique route updates by @hurricanehrndz in #2266
* feat(client): send logs to syslog by @mrl5 in #2259
* refactor(util): fix sonarcube issues by @mrl5 in #2276
* Add get_registration_delay_milliseconds metric by @mlsmaycon in #2275
* Fix metric label typo by @mlsmaycon in #2278
* fix: save peer status correctly in sqlstore by @ctrl-zzz in #2262
* Support custom SSL certificates for the signal service by @benniekiss in #2257
* Wait on daemon down by @pascal-fischer in #2279
* Don't add exclusion routes for IPs that are part of connected networks by @lixmal in #2258
* Add faster availability DNS probe and update test domain to .com by @mlsmaycon in #2280
* Check if route interface is a Microsoft ISATAP device by @mlsmaycon in #2282
* Remove copy functions from signal by @mlsmaycon in #2285
* Refactor macOS system DNS configuration by @hurricanehrndz in #2284
* Fix macOS DNS unclean shutdown restore call on startup by @mlsmaycon in #2286
* Tue Jul 09 2024 Holden Fried <holdenrf2021@gmail.com>
- Improved formatting in error message when attempting to use patched out
netbird service commands
* Mon Jul 08 2024 Holden Fried <holdenrf2021@gmail.com>
- Modified service-install-cli-change.patch to remove CLI service
install/uninstall functionality
* Sun Jul 07 2024 Holden Fried <holdenrf2021@gmail.com>
- Added patch service-install-cli-change.patch
to make error messages align with best practices (#boo:1181400)
* Sat Jul 06 2024 Joshua Smith <smolsheep@opensuse.org>
- Enable tests
* Tue Jul 02 2024 Holden Fried <holdenrf2021@gmail.com>
- Initial packaging of netbird 0.28.4
/usr/share/bash-completion/completions/netbird
Generated by rpm2html 1.8.1
Fabrice Bellet, Sun Aug 2 03:14:27 2026