Devolutions/devolutions-gateway v2026.3.3 on GitHub

dgw: keep agent tunnel data in a shared gateway.db (#2039) (e8ac5ef235) (DGW-464)
Agent Tunnel data moves from agent_tunnel.db to gateway.db in the Gateway data directory.
Gateway creates gateway.db on every start, even when Agent Tunnel is disabled.
On the first start after upgrading, Gateway imports and removes an existing agent_tunnel.db, so enrolled agents keep working without enrolling again.
Downgrading afterwards means agents have to enroll again, because earlier versions only read agent_tunnel.db.
dgw: honor an explicit agent on KDC tokens (#2068) (458a0db6e4) (DGW-453)
KDC tokens can name an explicit agent with jet_agent_id, as association and JMUX tokens already do.
/jet/KdcProxy then sends every Kerberos message through that agent or fails, without falling back to a direct connection or another agent; tokens without the claim keep working as before.
Previously, the client's Kerberos traffic for an RDP session pinned to an agent could reach the KDC directly from Gateway or through a different agent.
Through an agent, the KDC must use tcp://: a udp:// KDC with an explicit agent is rejected.

dgw,agent: fix Windows service crash at startup (#2069) (20c0119493) (DGW-460)
The Gateway Windows service could crash at startup with an access violation in ntdll.dll and never start, as seen after updating to 2026.3.2 on Windows Server 2016.
The Agent Windows service could crash the same way and is fixed too.
When the service fails to start, for example because of an invalid configuration, Gateway and Agent now exit with a nonzero status, so service managers such as systemd can detect the failure and restart them.