github LanternOps/breeze v0.100.0
on GitHub

latest releases: v0.125.0, v0.124.0, v0.123.0...
3 months ago

Breeze RMM v0.100.0 — vulnerability Remediate that finally schedules patches, MSI upgrades that don't hang, the #1105 connection-hold cluster closed, two new locales, and a batch of production error fixes.

Summary

  • Vulnerability Remediate now actually schedules patches — both third-party (winget) and Windows OS findings used to report "Nothing scheduled: N no available patch" even when the fixing update was pending on the device. Two new fallback matchers (product-identity and cumulative-update) close that gap (#2731, #2734).
  • MSI upgrades stop hanging — installing a new agent over an existing one could stall as the old service got resurrected by SCM recovery actions and re-locked the install directory. Fresh installs were never affected (#2747).
  • #1105 connection-hold cluster closed — five Sentry issues where slow work (a Redis enqueue or a multi-second outbound send) ran inside a held Postgres transaction, pinning a pooled connection idle-in-transaction and, under load, exhausting the pool (#2751).
  • Two new locales — Italian (it-IT) and Canadian French (fr-CA), each a complete catalog across all 21 namespaces (#2746, #2745).
  • Windows agents stop restart-storming — a chronic state-file sharing-violation race could push healthy Windows agents into "Agent Silent" (watchdog-in-failover) state; the agent/watchdog file handoff is now contention-safe (#2732).

Added

  • Italian locale (#2746) — Italiano (Italia), full console translation across all 21 namespaces. Browser variants like it-CH resolve to it-IT.
  • Canadian French locale (#2745) — Français (Canada), full console translation. Browser matching keeps fr-CA distinct from fr-FR.

Improved

  • Filesystem / Disk Space Analyzer performance (#2729, #2730) — trimmed the BE-1 ingest and serve hot paths, and fixed a baseline-completion bug where max-depth truncation was mistaken for a resumable partial scan, defeating incremental scanning and causing write amplification on deep trees.
  • AI manage_patches tool contract (#2743) — per-action required fields (install needs patchIds+deviceIds, scan needs deviceIds, etc.) are now expressed in the tool's input schema, so the model's first call no longer fails with an opaque doubled-colon Invalid input: : error.
  • Disk Cleanup preview UX (#2724) — the preview now scrolls into view when opened, and dropped filesystem snapshots are logged instead of silently discarded.
  • Patch & config-policy form accessibility (#2749) — form labels are now associated with their inputs, so clicking a label focuses the field and screen readers announce it correctly.

Fixed

  • Third-party vulnerability Remediate (#2731) — matched patches only by cveIds, which winget rows never carry, so clicking Remediate reported "66 no available patch" even with the fixing upgrade pending on the device. A product-identity fallback now schedules those pending patches.
  • Windows OS vulnerability Remediate (#2734) — OS findings always skipped Remediate as no_available_patch because WUA scans report no CVE data and OS findings carry no software-inventory id. A cumulative-update heuristic now schedules the applicable update.
  • MSI upgrade hang (#2747) — a previous install's SCM failure-action recovery treated the upgrade's taskkill /F as a crash and restarted the old agent/watchdog mid-copy, re-locking C:\Program Files\Breeze. Upgrades no longer stall; fresh installs were never affected.
  • #1105 connection-hold cluster (#2751) — five issues (BREEZE-M/W/Q/A/9) where a Redis enqueue or outbound send ran inside a held Postgres transaction. Each now runs the slow work with no open transaction, so pooled connections aren't pinned idle-in-transaction.
  • Windows agents going "Agent Silent" (#2732) — a state-file sharing-violation race between the agent's per-heartbeat agent.state rewrite and the watchdog's read could stop the main service and leave the watchdog heartbeating in failover. Surfaced on three devices after the 0.99.0 fleet promote; the file handoff is now contention-safe.
  • Five production Sentry issues (#2750) — BREEZE-3/5/C/T/R, including device_network.mac_address inserts failing with 22001 value too long for Teredo/ISATAP/InfiniBand pseudo-interfaces (which silently blocked those devices' network inventory).
  • Pending third-party patches erased on inventory submit (#2725, #2735) — the installed-inventory PUT immediately after a pending scan destroyed freshly-reported winget pending rows (fleet-wide: 1,880 installed vs 9 pending). The follow-up (#2735) also fixes an installed-ingest 500 from binding a JS Date inside a raw SQL fragment.
  • Event-log details forwarded to SIEM (#2748) — the forward payload read event.rawData, a field Zod stripped as unknown, so it was always undefined. SIEM forwarding now carries the real event details.
  • Platform-admin bootstrap (#2744) — uses inArray instead of = ANY(::text[]), fixing the tuple-expansion error path (#2655).

Security / Dependencies

  • Dependency maintenance — routine bumps to the Rust/Tauri helper & viewer crates (serde, serde_json, libc, futures-util) and CI actions (setup-go 6→7, setup-node 6→7). No known-exploited advisories in this set; no app runtime dependency changes.

Self-Hosting / Upgrade Notes

No breaking changes.

Upgrade. Bump BREEZE_VERSION to 0.100.0, then: 

docker compose pull api web portal && docker compose up -d

(If you build from source, run pnpm install first. Remember portal is a separate container — pull it too.)

Database — 1 migration, applied automatically. 2026-08-04-widen-device-mac-address-columns.sql widens device_network.mac_address and device_ip_history.mac_address from varchar(17) to varchar(64). Widening a varchar length is a metadata-only change in PostgreSQL — no table rewrite, no index rebuild — safe on hot tables, and the migration is idempotent (guarded on current column width). It auto-applies on API boot via autoMigrate (unless AUTO_MIGRATE=false). Expect a fast boot.

No new required environment variables. Nothing here will refuse to boot, and there are no compose or .env changes required.

Behavior notes.

  • After upgrade, Remediate on the vulnerabilities dashboard will start scheduling patches it previously reported as "no available patch" for third-party and Windows OS findings — expect more remediation jobs to actually fire (this is the fix working, not a regression).
  • Windows devices with Teredo/ISATAP/InfiniBand interfaces that were failing network-inventory updates (22001) will resume reporting network data once on the new schema.

Full Changelog: v0.99.0...v0.100.0

What's Changed

  • docs: v0.99.0 sweep (dashboard, quotes portal gating, MFA reset, approver grants, AI tiers, env parity) by @ToddHebebrand in #2723
  • fix(patches): stop installed inventory from erasing pending third-party patches by @ToddHebebrand in #2725
  • chore(deps): bump futures-util from 0.3.32 to 0.3.33 in /apps/helper/src-tauri by @dependabot[bot] in #2742
  • chore(deps): bump serde_json from 1.0.150 to 1.0.151 in /apps/viewer/src-tauri by @dependabot[bot] in #2739
  • chore(deps): bump actions/setup-node from 6 to 7 by @dependabot[bot] in #2721
  • fix(web): scroll Disk Cleanup preview into view + log dropped fs snapshots by @ToddHebebrand in #2724
  • fix(web): associate patch/config-policy form labels with their inputs (#2609) by @ToddHebebrand in #2749
  • fix(api): close five production Sentry issues (BREEZE-3/5/C/T/R) by @ToddHebebrand in #2750
  • fix(api): forward event-log details to SIEM instead of stripped rawData (#2643) by @ToddHebebrand in #2748
  • fix(patches): installed ingest 500s on Date bound in raw sql fragment (#2725 follow-up) by @ToddHebebrand in #2735
  • chore(deps): bump actions/setup-go from 6 to 7 by @dependabot[bot] in #2720
  • fix(ai): manage_patches per-action required fields + doubled-colon error (#2604) by @ToddHebebrand in #2743
  • chore(deps): bump serde_json from 1.0.150 to 1.0.151 in /apps/helper/src-tauri by @dependabot[bot] in #2740
  • perf(agent): optimize filesystem scanner hot path (BE-1) by @ToddHebebrand in #2729
  • fix(api): platform-admin bootstrap uses inArray, not = ANY(::text[]) (#2655) by @ToddHebebrand in #2744
  • chore(deps): bump serde from 1.0.228 to 1.0.229 in /apps/viewer/src-tauri by @dependabot[bot] in #2737
  • perf(filesystem): fix baseline-completion bug + trim ingest/serve overhead (BE-1) by @ToddHebebrand in #2730
  • chore(deps): bump libc from 0.2.186 to 0.2.189 in /apps/helper/src-tauri by @dependabot[bot] in #2741
  • chore(deps): bump serde from 1.0.228 to 1.0.229 in /apps/helper/src-tauri by @dependabot[bot] in #2738
  • feat(i18n): add Canadian French locale by @ToddHebebrand in #2745
  • feat(i18n): add Italian locale by @ToddHebebrand in #2746
  • fix(installer): stop MSI upgrades hanging when a previous version is installed by @ToddHebebrand in #2747
  • fix(vulnerabilities): remediate third-party findings via product-identity fallback by @ToddHebebrand in #2731
  • fix(api): #1105 connection-hold cluster — BREEZE-M/W/Q/A/9 by @ToddHebebrand in #2751
  • fix(agent): stop Windows state-file sharing violations from restart-storming healthy agents by @ToddHebebrand in #2732
  • fix(vulnerabilities): remediate Windows OS findings via cumulative-update fallback by @ToddHebebrand in #2734

Full Changelog: v0.99.0...v0.100.0

Check out latest releases or
releases around LanternOps/breeze v0.100.0

Don't miss a new breeze release

NewReleases is sending notifications on new releases.

Get notifications