github LanternOps/breeze v0.118.0
on GitHub

4 hours ago

Breeze RMM v0.118.0: legacy alerting retires and network checks move to Monitors, backups and restores get sturdier, and a broad hardening pass covers the server, the agent and Breeze Helper.

⚠️ Behaviour changes that need attention before upgrading:

  • Legacy alerting is retired in this release. Run Convert everything on v0.117.0 and review every refusal before you upgrade. Legacy alert-rule, alert-template and network-check write endpoints now return 410 Gone.
  • Some dynamic groups no longer act as execution targets. This applies to groups whose rules match on device-reported fields: hostname, display name, tags, device role, last user, agent or Helper version, installed software, or custom fields. Scripts, automations, software policies, update rings and several policy features skip them.
  • DR plan steps that stored a recovery token or storage credential fail when they run until they are re-saved without it.

See Self-Hosting / Upgrade Notes for the full list.

Security — action required

  • 0.118.0 contains security fixes for the server and the agent; self-hosted operators should upgrade the server and agents promptly. Advisories will be published once hosted rollout completes. Several fixes take effect on a device only after its agent and Breeze Helper are on 0.118.0, so check that the agent rollout has completed across your fleet. To be notified, watch the repository and select Custom → Security alerts.

Summary

This release finishes the alerting consolidation. The legacy alert-rule and service/process-monitoring paths are retired (#6904, #6917). The API converts any remaining legacy sources on first boot and lists anything it could not convert in a review banner. Network checks become network_check monitors authored under Alerts → Monitors (#7107, #7115, #7116). Maintenance windows now suppress monitor alerts again.

Backup and restore get a round of reliability work:

  • A run that misses files is now completed_with_errors instead of a green completed (#7063).
  • The stall reaper can fire (#7102), and large single files report byte progress (#7097).
  • Bare-metal rebuilds use a stall watchdog instead of a fixed 4-hour cap (#7089).
  • Hyper-V gets a free-space preflight (#7094).
  • The 0.118 hardening bundle changes how backup commands carry storage access and makes Hyper-V restore, restore-as-VM and instant boot report failures clearly (#7199).

New visibility features:

  • Per-slot memory module inventory (#7145, #7146).
  • Server-side detection of stuck agent self-updates (#7068).
  • "Breeze Assist enabled but not installed" on the device page (#7023).
  • Failed patch installs with their reason, where the list used to say "Pending approval" (#7088).
  • A paged PAM elevation-audit export (#7019, #7194).

The hardening bundle (#7199) makes permission, site/org scope and MFA requirements match across the REST API, AI tools and background jobs. It also puts budgets on agent traffic and tightens the installers, Windows local file handling and remote sessions. Every agent and Helper should update to 0.118.0.

Added

  • Network checks as monitors (#7107, #7115, #7116). Author network_check monitors under Alerts → Monitors with an asset picker. Network keeps Assets, SNMP Templates and a read-only Results view with links to owning monitors. From the Results banner, you can preview and convert a check with a single offline or consecutive-failure rule into a monitor. The monitor lands in a per-organization Network checks — policy, with probe history and open-alert status preserved. Existing unconverted checks keep polling and alerting.
  • Memory module inventory (#7145, #7146). The device Hardware tab shows every memory slot, populated or empty, with a summary of slot count, maximum capacity and soldered memory. The same data is in GET /devices/:id/hardware, the partner inventory API and the get_device_details AI tool. Needs the 0.118 agent; older agents show "Not reported yet — needs agent update".
  • PAM elevation-audit export (#7019, #7194). New endpoint: GET /pam/elevation-audit/export, paged CSV or JSONL, one organization per request. It exports each event with its request context (site, device, subject, target and decision). Page with X-Next-Cursor while X-Has-More is true.
  • completed_with_errors backup run state (#7063). A run that produced a snapshot but failed to read or upload some files (up to 10%) is shown in amber as completed_with_errors. backup_continuity monitors gain a matching check you can alert on.
  • Stuck agent self-update detection (#7068). The server records each self-update attempt. A device that keeps retrying the same target shows a notice on its Info tab and an Update stuck badge in the device list. No agent change is needed.
  • Breeze Assist install issues on the device page and list (#7023). The page shows when a device has Assist enabled but has no offered version, or has given up after repeated install failures.
  • Per-version success exit codes for Software Library installs (#7061). You can declare extra vendor success codes, such as Veeam's 1000 and 1101. They add to the built-in defaults, and detection rules still run afterwards.
  • Remediate preview and confirmation for software policies (#7101). Remediate on the Compliance Dashboard now shows the exact devices and uninstalls it will queue, and asks for confirmation.
  • Failed patch installs are shown with their reason (#7088). On the org Patches list and the device Patches tab, these patches used to show as "Pending approval".
  • Customer portal: per-asset network table (#7026).
  • CVE view "By software" rollup (#7072, #7084). One outdated application is one row, with device and CVE counts aggregated in SQL. Batch Remediate queues one install per device and patch, and reuses an install that is already in flight.

Improved

  • Hardware health is now a regular filter field (Add filter → Hardware Health). It works in saved filters and dynamic groups and replaces the separate Hardware dropdown (#7137).
  • Integrations: the Identity tab is now Cloud tenants, and disabled Graph onboarding cards collapse. Old #identity links still work (#7164).
  • On a device page, an AI chat write with no orgId now lands in that device's organization instead of being refused. Reads keep their full scope (#7027).
  • The remote viewer waits for the end user to answer a consent prompt (up to 77 seconds) and shows why a consent was refused (#7086). The remote-session notice goes to the user-session helper, with a dialog fallback (#7092).
  • Windows MSI upgrades no longer flash a console window (#7108).
  • The watchdog no longer restarts agents whose credentials the server rejected, and it backs off its failover polling (#7098).
  • Bare-metal rebuilds stop when they stop making progress, not at a fixed 4 hours (#7089). Hyper-V backups check free space first and honour backup_staging_dir (#7094).
  • Backup uploads report byte progress within a single large file (#7097). Job liveness is tracked separately from progress, so stalled jobs are reaped (#7102).
  • macOS screen capture falls back to CoreGraphics when ScreenCaptureKit fails (#7046).
  • Windows uninstall falls back to the registered uninstaller when winget fails (#7053).
  • The agent refreshes its helper hash allowlist after Breeze Helper installs or updates, so a freshly installed Assist connects without an agent restart (#7193).
  • A stalled manifest download is detected one window after its last byte instead of two (#6971).
  • Device-page graphs cancel their requests when you navigate away, and raw metrics are bucketed in SQL (#7083). list_monitors pages in SQL (#7017).
  • Agent telemetry writes an audit row only on failure or a real change (#7059, #7048).
  • Guided setup now generates APP_ENCRYPTION_KEY_ID alongside APP_ENCRYPTION_KEY. An existing id is never changed (#7010).
  • Accounting groundwork for a second provider (#7182, #7192, #7197):
    • Each partner has exactly one accounting connection.
    • When QuickBooks throttles Breeze, the job is re-queued without using up an attempt. Routes answer 429 with Retry-After.
    • QuickBooks behaviour is otherwise unchanged.

Fixed

  • Maintenance windows suppress monitor alerts again. On v0.117.0, Suppress alerts did not stop alerts from monitors, including rules converted to monitors. The monitor evaluator now checks the window, so expect fewer alerts during maintenance than on v0.117.0 (#6904, #6917).
  • Extended monitor conditions evaluate correctly (#7099):
    • Bandwidth thresholds were compared about 8× too high. They now use the Mbps you configured.
    • Disk I/O reports MB/s.
    • Network errors count the increase over the window, not since boot.
    • Patch compliance ignores stale or placeholder scores.
  • Automations: a worker takeover of a stalled job no longer runs actions twice or creates a second run (#7186). execute_command output now shows in run history (#7100).
  • Committing before sending. Script, automation, backup and AI dispatch rows now commit before their command is sent or queued, so a fast agent reply no longer finds a missing row (#7064, #7104, #7110, #7114, #7133).
  • Backup and restore:
    • Snapshots on a destination with a prefix can be recovered, object-locked and deleted again (#7080).
    • Files whose names differ only by case get separate objects (#7093).
    • Token-mode recovery of .gz objects from the local provider works (#7184).
    • Windows keeps Hidden/System on non-empty directories (#7078).
    • System-state backups keep partial registry hives and name the ones that failed (#7021, #7000).
    • The Storage by Provider view shows its rows (#7112), and the Restore Wizard no longer shows a made-up "Ready" status (#7091).
  • Agent:
    • Helpers stop holding the executable before a rollback, and start failures are counted (#7111).
    • An MSI reinstall is forced when Breeze Assist is already registered at the target (#7045).
    • A check pass still running after Stop no longer re-creates cleared watch states (#7159).
  • AI:
    • Approving a plan fails if the plan write fails (#7082), and aborting a plan settles its pending approval (#7090).
    • A chat's auto-title can no longer roll back the user's message (#7076).
    • Chat settle waits no longer hold a pooled database connection (#7070).
    • Fix suggestions skip scripts that don't fit the device's OS and agent-lifecycle scripts (#7124).
    • An AI Operator task keeps the agent it was admitted with (#7022).
  • Accounting and billing:
    • QuickBooks: missing SyncTokens are repaired, quote-issued invoices are pushed automatically (#7136), and hidden invoice lines push at zero with reconciled totals (#7165).
    • A reauth_required state is saved instead of rolled back (#7191).
    • Stripe settle and reconcile no longer hold a database transaction open across a Stripe call, and follow-up work after a capture can no longer fail the settle (#7066, #7073).
  • Quotes: send terms are frozen through the partner, brand and quote footer chain (#6989), and agreements appear after the price in the portal, Preview and PDF (#7042).
  • Admin:
    • A discovery profile can be deleted after it has found assets (#7056).
    • Admins can change a partner user's organization access after the invite (#7057).
    • The CLI enrollment key is created when you click, bound to the chosen site (#7058).
    • Device-group bulk Run script uses the standard execute route (#7054).
    • An edition auto-migrate hold-back now tells you what to do (#7055).
  • Web and mobile:
    • Notes and terms you type while a save is in flight are no longer overwritten (#7079).
    • The M365 consent banner survives a cold load (#6962).
    • The BMR public rate limit no longer puts every client with an unresolved IP into one bucket (#7009).
    • Mobile keeps held alert acknowledges in a durable outbox (#7106).

Security — hardening

Changes that alter behaviour are listed in Self-Hosting / Upgrade Notes below. In summary (#7199 unless noted):

  • Consistent authorization. AI tools require the same permission and site/org scope as the matching REST route. AI device commands follow the per-device remote-tools policy on every path. Queued script commands re-check the requester's role and reach before delivery. More write actions require a freshly satisfied MFA step.
  • Account changes reach delegated access. A password change or reset, or an MFA factor reset, ends the user's live remote sessions and invalidates API keys that user created before the change. A role change revokes the user's refresh tokens. Role, MFA-reset and member actions require the caller to hold every permission of the target's role.
  • Backup storage access. Commands no longer carry the storage destination; it is resolved at delivery. With the 0.118 agent, restores use a short-lived, read-only storage session bound to the command and device. DR plan steps no longer accept credentials. A bucket or path already used by another partner's organization is refused.
  • Agent and installers.
    • Enrollment keys and secrets are no longer passed on installer command lines.
    • Windows staging directories, ProgramData directories and the OpenH264 codec location are checked for owner and links.
    • Windows IPC clients check that the pipe belongs to the installed agent.
    • PAM elevations of a specific file carry its hash, which the agent re-verifies before launch.
    • On macOS, binaries move to /Library/Breeze/bin.
  • Remote sessions.
    • Consent and notice policy is enforced on the WebSocket-fallback desktop path.
    • TURN credentials are limited per caller and cannot be issued for ended sessions.
    • The shipped coturn configuration relays only to public addresses.
  • AI.
    • AI elevation requests always wait for a human approver.
    • AI ticket comments are private unless approved.
    • Newly discovered MCP tools must be reviewed before they are enabled.
    • Text from devices and tickets is neutralised before it reaches the model.
    • Model-written images are shown as links.
  • Budgets and limits. New limits cover public downloads, password-reset emails, agent WebSocket messages, daily agent log and event-log ingest, Helper screenshots and log-forwarding jobs.
  • Stored credentials stay tied to their destination. Moving an integration to a new origin requires re-entering its credential.
  • Recovery media. Recovery bundles check their helper's signature with minisign before running it.
  • Notification channels (#6993). Channel configuration (webhook URLs, bot tokens, routing keys) moves to its own table, which only the channel's owner can read. The old column stays for rollback and is dropped in the next release.

Self-Hosting / Upgrade Notes

Upgrade: first, on v0.117.0, run Convert everything (Alerts → Monitors → Needs conversion) and review every refusal. Take a database backup. Then bump BREEZE_VERSION in .env and run docker compose pull api web portal && docker compose up -d (or pnpm install when running from source). Then let every agent and Helper update to 0.118.0.

Agent release: every agent and Helper should update to 0.118.0. Many of this release's changes take effect on a device only once it runs the 0.118 agent and Breeze Helper. Until then, affected devices keep their previous behaviour. These include:

  • installer secret handling;
  • Windows local file and pipe checks;
  • PAM hash pinning;
  • brokered restores;
  • the Hyper-V, restore-as-VM and instant-boot fixes;
  • consent-prompt reporting;
  • memory module inventory;
  • the macOS binary move.

Some paths refuse older agents instead of falling back: consent-required WebSocket-fallback desktop sessions, and brokered restores on older backup helpers (these keep the previous path). Rebuild recovery media after upgrading. The mobile chat image and link change needs a new mobile build.

Database / migrations: 26 new migration files (15 from main since v0.117.0, 11 2026-11-05-* from #7199). All are idempotent and apply automatically on boot through autoMigrate (unless AUTO_MIGRATE=false). Migrations that write rows report their counts in the API log. There is no blocking rewrite of a large table, but read these first:

  • 2026-11-05-100300-backup-snapshots-storage-identity-snapshot-id-uq.sql
    • Builds a unique index on backup_snapshots (storage_identity, snapshot_id) CONCURRENTLY.
    • If duplicate groups exist, it logs a warning with the count and skips creating the index. It retries on every start until the duplicates are resolved by hand.
    • If an interrupted build left an invalid index, it raises an error. Run DROP INDEX CONCURRENTLY backup_snapshots_storage_identity_snapshot_id_uq and restart.
  • 2026-11-02-110000-accounting-connections-one-per-partner.sql stops the API from starting if any partner has more than one accounting connection row. Disconnect the extra provider first.
  • 2026-11-02-111000-elevation-audit-org-created-idx.sql builds an index CONCURRENTLY and raises if an interrupted build left it invalid. Recovery: DROP INDEX CONCURRENTLY public.elevation_audit_org_created_id_idx and restart.
  • 2026-11-05-100500-backup-command-stored-destination-cleanup.sql
    • Removes stored storage destinations from finished device_commands rows, and credential keys from DR plan steps.
    • It walks device_commands by primary key in bounded ranges, inside one transaction. On an install with a long command history, the first boot takes longer.
    • Pending rows are left alone and cleared when they finish.
  • 2026-10-31-120000-patch-job-results-device-patch-idx.sql builds an index on patch_job_results CONCURRENTLY. It does not block writes, but can take a while on a large table.
  • 2026-10-31-120000-network-checks-as-monitors.sql
    • Adds retirement metadata and an asset/org foreign key and CHECK on network_monitors.
    • It converts and retires nothing.
    • Rows that already break the asset/org pairing would stop the migration.
  • 2026-10-31-110000-legacy-alerting-retirement-sweep.sql moves each policy's check interval onto its monitors feature link and logs warning counts of remaining unretired sources. It deletes no data.
  • 2026-11-02-100600-notification-channel-configs.sql copies each channel's config into a new table and drops NOT NULL from the legacy column. The legacy column is kept for rollback.
  • The rest add tables, nullable columns, a function or metadata-only defaults: memory modules, helper install issue, update attempt, backup keepalive, success exit codes, completed_with_errors, automation replay keys, backup storage sessions, consent protocol version, API key creator epochs, enrollment link lineage, sending-domain ownership token, per-device patch severity, command requester resolver, discovery history FK SET NULL, and function-assessment and custom-field trigger fixes. The API key epoch migration backfills active keys and revokes none.

No new required environment variables. New optional variables, all with defaults:

  • BREEZE_LEGACY_ALERTING_SWEEP — set to false to skip the boot-time legacy conversion. The unretired-row count check still runs.
  • TURN_CREDENTIAL_MINT_LIMIT_PER_WINDOW (default 30; 0 disables), TURN_CREDENTIAL_MINT_WINDOW_SECONDS (default 600)
  • Agent WebSocket message budgets:
    • AGENT_WS_MESSAGE_BUDGET_CAPACITY, AGENT_WS_MESSAGE_BUDGET_REFILL_PER_SECOND, AGENT_WS_MESSAGE_BUDGET_CLOSE_THRESHOLD
    • AGENT_WS_COMMAND_RESULT_MESSAGE_BUDGET_CAPACITY, AGENT_WS_COMMAND_RESULT_MESSAGE_BUDGET_REFILL_PER_SECOND
    • AGENT_WS_UPDATE_STATUS_MESSAGE_BUDGET_CAPACITY, AGENT_WS_UPDATE_STATUS_MESSAGE_BUDGET_REFILL_PER_SECOND
  • Daily ingest budgets: AGENT_{LOG,EVENTLOG,CHANGES}_MAX_{ROWS,BYTES}_PER_{DEVICE,ORG}_PER_DAY
  • HELPER_SCREENSHOT_RATE_LIMIT, HELPER_SCREENSHOT_RATE_WINDOW_SECONDS, SCREENSHOT_MAX_BYTES, SCREENSHOT_MAX_BYTES_PER_DEVICE, SCREENSHOT_MAX_PER_DEVICE
  • LOG_FORWARDING_MAX_JOB_BYTES, LOG_FORWARDING_MAX_PENDING_PER_ORG, LOG_FORWARDING_MAX_WAITING_GLOBAL
  • TENANT_TOOL_MAX_IN_FLIGHT_PER_ORG (default 8)
  • PUBLIC_DOWNLOAD_KEY_MAX_TTL_MINUTES (download child-key TTL ceiling; 24 h by default)
  • AGENT_ROLLBACK_DENYLISTED_VERSIONS, AGENT_ROLLBACK_MIN_VERSION (unset by default, meaning no restriction)
  • EMAIL_DOMAINS_ADOPT_EXISTING_ALLOWLIST (comma-separated). Only needed to adopt a sending domain that already exists at the provider without the DNS TXT record.

Removed: the four OFFLINE_DETECTOR_REEVAL_* variables no longer do anything. Their only reader was the retired policy re-evaluation job.

Config changes:

  • coturn.
    • docker/turnserver.conf, docker-compose.yml and deploy/docker-compose.prod.yml add public-only denied-peer-ip rules and no-tcp-relay, and turn off verbose.
    • If you maintain your own coturn configuration, apply the same rules, but never deny the relay's own public IP: relay-to-relay traffic targets it.
    • The IPv4-mapped and NAT64 lines ship commented out. Enable them after checking relay-to-relay on your deployment.
  • API stop grace. The api service in both Compose files has stop_grace_period: 90s, so background work can finish during a restart. Copy it into your own compose file if you maintain one.
  • Redis. Public download routes, including install.sh and uninstall.sh, return 503 when Redis is unavailable.
  • Helper installer (BINARY_SOURCE=local). The Helper download is checked against the signed release manifest and returns 503 on a mismatch. Keep the manifest files next to the Helper binaries (HELPER_BINARY_DIR is respected).
  • Recovery bundles. Bundles need recovery signing (RECOVERY_SIGNING_*) configured when they are built, and minisign (plus curl on Linux and macOS) where they run. Rebuild recovery media after upgrading.

Behaviour changes:

Alerting and network checks

  • Legacy alerting retirement.
    • The policy Alerts and Service & Process Monitoring tabs are removed, and /alerts/rules redirects to Alerts → Monitors.
    • Writes under /alerts/rules* and /alert-templates*, and the retired alert_rule and monitoring feature types, return 410 Gone. Reads remain for history.
    • On first boot, the API converts remaining legacy sources per partner and retires the ones it cannot convert, with reasons. A dismissible banner under Alerts → Monitors lists them; recreate what you need as monitors before dismissing it.
    • Open alerts from retired sources stay open until someone resolves them.
    • Every boot logs, at error level, any config_policy_alert_rules or config_policy_monitoring_watches rows left unretired.
    • Undo for removed legacy runtimes ends at this upgrade.
  • Alert delivery. Queued legacy alerts and unconverted standalone rules no longer use their old per-rule delivery overrides. Delivery follows monitor settings, routing rows and the explicit Everything else row. Without a matching destination, no notification is sent, so review routing before upgrading.
  • Network checks.
    • Check create and update, and network alert-rule writes, return 410 network_check_authoring_retired. Unmanaged check deletion also returns 410.
    • DELETE /monitoring/assets/:id returns 409 network_checks_active while checks are active.
    • Assets with retained checks cannot be deleted (409 asset_has_retained_network_checks).
    • The boot sweep never converts or retires network checks.
  • Monitor thresholds. Bandwidth, disk I/O, network-error and patch-compliance monitors now evaluate in the units they display. A bandwidth threshold that never fired before may fire now.
  • Backup status. A run with some unread files is completed_with_errors, no longer completed. API consumers see the new status value.

Targets, commands and backups

  • Dynamic group targets.
    • Dynamic groups whose rules match on hostname, display name, tags, device role, last user, agent or Helper version, installed software or custom fields no longer act as targets for scripts, automations, software policies and update rings.
    • They are also skipped by the automation, software, remote-access, PAM, maintenance, OneDrive and Assist policy features.
    • Patch and backup assignments still resolve through them.
    • Each skipped group is recorded in the audit log. Rebuild these targets on server-set fields (site, OS, hardware) or use static groups.
  • DR plans. Steps that stored a recovery token or storage credentials fail when they run. The upgrade removes those keys, and plan saves reject them. Re-save the step without credentials.
  • Commands queued during an org merge or device move. Backup, restore and verify commands still queued when their device changes organization, including during an org merge, are refused and must be re-run.
  • Older backup helpers. Restores on devices whose backup helper predates 0.118 keep using the previous path until the agent updates.
  • Restore as VM and instant boot.
    • A restore as VM that cannot place every file fails before any VM is created, instead of reporting completed.
    • Instant boot runs its background sync inside the command. An incomplete sync reports the VM as degraded.
    • Hyper-V restore refuses a VM name that already exists.
  • Legal hold. Organization erasure is refused while a snapshot is under legal hold (409). Device purge is refused under legal hold or inside a snapshot's immutability window.
  • Backup storage. A bucket, endpoint or path already used by another partner's organization is refused. Sibling organizations under one partner can still share one.
  • Cove. Customers matched only by name are no longer mapped to organizations automatically.

Agent (0.118 agent)

  • Windows ProgramData links.
    • A junction or symbolic link at C:\ProgramData\Breeze\data or logs is replaced by a real restricted directory, both during install and at agent startup.
    • Files in the former link target are not moved or copied.
    • While such a link cannot be removed, the agent refuses to start and writes the reason to logs\agent-start-failed.txt.
  • macOS. The agent and watchdog binaries move from /usr/local/bin to /Library/Breeze/bin on first start of the 0.118 agent. Update local scripts that call the old path.
  • Helper token. On Linux and macOS, the Helper token moves to helper_token.yaml.

Access, MFA and limits

  • Account changes. A password change or reset, or an MFA factor reset, ends that user's live remote sessions and invalidates API keys they created before it. Service-principal keys are unaffected, and the upgrade itself revokes nothing.
  • New fresh-MFA requirements:
    • disk-encryption key reveal;
    • report email recipients;
    • partner billing profiles and work types;
    • org billing-profile assignment and org billing settings;
    • the backup-provider device link;
    • topology template library writes;
    • software-policy executable rules (these also need pam.manage_policy);
    • AI script policy writes;
    • policy deactivation.
  • Permissions.
    • System Tools file content and registry reads need devices:execute, and so do sensitive event-log channels (Security, PowerShell, Sysmon).
    • The agent's config directory and the SAM/SECURITY registry hives are always refused.
    • Enrollment short codes are shown only to users who can create or rotate keys.
  • PAM and AI approvals.
    • Approvals for a specific executable without its hash are denied with a reason.
    • AI elevation requests always wait for a human approver, and requesters cannot approve their own elevation.
    • AI ticket comments are private unless approved as customer-visible.
    • Newly discovered MCP tools need review before they are enabled.
  • Enrollment and installers.
    • Rotating an enrollment link issues a new short code, so the old /s/ and /i/ links return 404.
    • A custom-field value used in installer arguments must not contain spaces, quotes or backslashes. Otherwise that device's install fails as an unresolved field.
  • Stored credentials. Changing a tool source, backup S3 endpoint, log-forwarding URL or monitoring integration URL to a new origin requires re-entering its credential. Changing an SNMP discovery profile's subnets, exclusions or site requires re-entering or clearing its SNMP secrets.
  • Remote sessions. Where remote-access policy requires consent or an on-screen notice, WebSocket-fallback desktop sessions to agents older than 0.118 are refused until the agent updates. The recovery console no longer relaxes its HTTPS requirement for breeze.insecure=1 in interactive mode.
  • New limits:
    • public downloads: 600 requests per 5 minutes per route per IP;
    • TURN credentials: 30 per 10 minutes per caller;
    • password-reset emails: one per account per 5 minutes;
    • agent WebSocket message budgets and daily log, event-log and change-log ingest budgets (429 when exceeded);
    • Helper screenshot quotas;
    • pending log-forwarding jobs per org;
    • the partner organization limit on org creation.

Other

  • Public invoice and quote links stop working while the owning partner is not active.
  • Adopting a sending domain that already exists at the email provider needs a DNS TXT record at _breeze-verify.<domain> or the operator allowlist. Otherwise provisioning ends as provider_conflict.
  • Workspace owner-username routes reject names that contain /, \, % or control characters, or are longer than 100 characters (400).
  • Org-scoped users cannot set audit-log retention below 90 days.
  • Revoking a topology template is final.
  • Inviting an address that already belongs to another tenant returns the normal success response.
  • Patch severity and category show each device's own reported value when the shared catalog has none.
  • /pam/elevation-audit/export requires orgId for partner and system callers.

Known gaps:

  • The macOS binary move on upgrade is not lab-verified. It is covered by unit tests only. Check one macOS device after it updates: /Library/Breeze/bin/breeze-agent should exist and the service should be running.
  • Hyper-V instant boot must finish its background sync within the command's run budget. A sync that does not finish in time leaves the VM running, reports it as degraded and removes the partial staging directory.
  • Notification channel configuration is split across two places for one release. The legacy column is dropped in the next release.

⚠️ Breaking changes: the legacy alerting write endpoints (410 Gone), dynamic-group targeting, DR plan steps with stored credentials, and consent-required WebSocket-fallback sessions to pre-0.118 agents, all described above. Take a database backup before upgrading.

Full Changelog: v0.117.0...v0.118.0

What's Changed

Full Changelog: v0.117.0...v0.118.0

Check out latest releases or
releases around LanternOps/breeze v0.118.0

Don't miss a new breeze release

NewReleases is sending notifications on new releases.

Get notifications