Devolutions/devolutions-gateway v2026.3.0

on GitHub

Security

• agent: harden package broker file and executable validation (#1869) (5b0844d816) (DGW-419) (#1870) (d1bcc02e80) (#1872) (27f7fc9377) (#1889) (4e10a490f6) (#1906) (88799db384)

  The Agent now validates package policy files, broker executables, signatures, ownership, and permissions before trusting them for elevated operations.

• agent: harden package broker client and execution isolation (#1871) (48f9b0c4b7) (#1873) (0e2f9a485c) (#1892) (1fe893d2b1) (#1902) (23a97845f8) (#1903) (4c4cd8792f)

  The Agent now verifies the requesting Windows user, restricts temporary scripts and operation hooks, and protects the broker from connection floods.

• agent: restrict Agent Tunnel private key permissions on Windows (#1931) (f87b5d7a74)

  New Agent Tunnel private keys are accessible only to SYSTEM and Administrators.

Features

• agent: add Chocolatey, Scoop, vcpkg, .NET, pip, Cargo, npm, and Bun package broker support (#1874) (8e66d24fe9) (#1876) (5e480c9804) (#1881) (235e3a29b5) (#1880) (d1c276bc57) (#1878) (911a658eed) (#1877) (3881db378e) (#1882) (f348786471) (#1879) (771cd11aae)

• agent: bundle multi-pwsh with the Windows installer (#1904) (d204d8e42b)

  The Agent installer now includes the multi-pwsh executable required for PowerShell Universal integration.

• agent: publish a multi-architecture Docker container (#1912) (ec6951bcfb)

  The Agent container enables PowerShell Universal by default and includes multi-pwsh support.

• agent: support package operation cancellation (#1913) (db23a516eb) (DGW-437)

  Clients can cancel package operations through an asynchronous, idempotent endpoint.

• agent: stream package operation output and status updates (#1914) (f413772c4f) (DGW-438)

  Clients receive live standard output, standard error, and status notifications through a dedicated channel for each operation.

• agent: [breaking] expose the active package policy (#1937) (ab34966851)

  Authenticated clients can retrieve the validated active package policy through GET /v1/policy.
  Package policy files must now use JSON; YAML policy files are rejected.

• dgw: download multi-clip recordings as ZIP archives (#1923) (e34e0a4b05)

  GET /jet/jrec/pull/{id} streams recording.json and every clip in the session manifest as one archive.

• dgw: support VMConnect through RDCleanPath (#1372) (1c06391a0c) (Devolutions/IronRDP#1505)

• dgw: enable target-side Kerberos credential injection without debug flags (#1895) (0e91bbf503) (#1953) (f0828c91c2) (DVLS-14697)

  Existing debug configuration keys still parse so deployments can upgrade without configuration errors.

• dgw: stabilize Agent Tunnel and persist authorization (#1958) (0086a50237) (#1947) (16a9cf7da4)

  Agent Tunnel is now a stable, opt-in feature.
  Accepted Agent identities and authorized keys persist across Gateway restarts; Agents enrolled before stabilization must be enrolled again.

• installer: configure Agent Tunnel during setup (#1969) (1b709918fe)

  Administrators can enable Agent Tunnel and change its default UDP listening port of 4433.

• webapp: add ARD input-only encryption (#1965) (1eb4d47625)

• dgw,agent: route JMUX channels through connected agents (#1974) (fde0daff75)

  Matching Agent Tunnel routes carry JMUX channels without falling back to direct TCP when the selected Agent route fails.

Bug Fixes

• agent: report and establish PowerShell DVC availability reliably (#1867) (27ffa7906e) (4528d093e8)

  The Agent no longer advertises unavailable PowerShell execution, and transient DVC opens can retry until the negotiation deadline.

• dgw,agent: make Agent Tunnel DNS route matching explicit (#1884) (29ec5ea5a2) (#1886) (0ec200ad5d)

  Plain domains match only themselves, while wildcard domains match subdomains; mixed old and new routing semantics now fail clearly.

• dgw: keep both credential-injection CredSSP legs on the same protocol (#1862) (6ccf248c58) (DVLS-14697)

  Both connections now use one Kerberos-or-NTLM decision, preventing handshake failures when their authentication protocols disagree.

• dgw: request credential-injection Kerberos tickets for the Gateway hostname (#1856) (8e5dc9142b)

• agent: report only available package managers as capabilities (#1901) (d71feadfca)

• agent: support app execution aliases for elevated package operations (#1907) (d45b176d89)

• webapp: recover shadow playback after recording gaps (#1916) (ed74e60bb1)

  Playback resumes from the latest available video when screen updates continue after a recording gap.

• webapp: restore hostname suggestion contrast (#1929) (1dd9b44f99) (DGW-337)

  Hostname suggestions remain readable in light and dark themes.

• dgw: reuse credential injection across reconnects (#1900) (316a53c5fe) (DVLS-14697)

  Native RDP reconnects can reuse provisioned credentials for the association token lifetime.

• webapp: fix the VNC form in non-secure browser contexts (#1964) (bd620363c2)

• dgw,jetsocat: flush JMUX messages promptly (#1939)

  Round-trip-dependent traffic such as HTTP/2 uploads no longer accumulates the JMUX flush delay on every flow-control update.