github LanternOps/breeze v0.125.0
on GitHub

6 hours ago

Breeze RMM v0.125.0 — agreements your clients sign without a quote, ticket merge with business-hours SLAs and routing rules, and update rings that decide Windows feature updates. Also in this release: install scripts and built-in Control D / NextDNS packages, YARA detection rules with fleet-wide IOC sweeps, AI conversations that move between the side panel and the full-page chat, and a more dependable Breeze Assist.

⚠️ Behaviour change: the agent no longer hides Windows feature releases on its own. The agent's local patch_exclude_feature_updates now defaults to false (was true). Each update ring decides instead, and every ring starts on Block, the previous behaviour. Nothing is offered until you set a ring to Allow or Pin (#10203). Details under Behaviour changes and feature flags.

⚠️ Behaviour change: DNS Security history older than 90 days is deleted on the first nightly run. A new retention job prunes DNS Security events and aggregations past each integration's retention window, 90 days by default. Before this release, integrations with no retention setting kept everything. Set a longer window per integration before upgrading if you need the history (#10042).

Summary

  • Send agreements for signature without a quote (#10127, #10162, #10167, #10202, #10191, #10233, #10235, #10226).
    • Send for signature is on Agreements → Signed agreements, on an organization's Billing tab and on a contract header. You pick the template, recipients and expiry, and preview exactly what the client sees.
    • Clients sign on a public page with no account and no price shown, or in the customer portal's new Agreements page. A typed-name signature or a decline with a reason is recorded.
    • The signer and every recipient get the signed copy by email. Downloads default to a certified copy with a signature-certificate page (who, when, from where, how, SHA-256 of the original). Original file still downloads the stored bytes.
    • Remind, automatic expiry, and partner defaults for link expiry and automatic reminders (off by default) under Settings → Billing → Agreements.
    • Signed agreements are write-protected in the database.
    • A new agreements:send permission covers sending, copying links, voiding and Record signed agreement. The upgrade grants it to every role that has agreements:write, so nobody loses access.
  • Ticketing: merge, business-hours SLAs and routing rules (#9901, #9997, #9897, #9811, #10001, #9846).
    • Merge into… moves comments, time, parts, checklists and links to the surviving ticket. The merged ticket stays as a read-only record, and inbound mail follows the merge.
    • Business-hours calendars with holidays under Ticketing → Priorities & SLAs: a partner default with an organization override. Each ticket keeps the calendar revision it was created under. Nothing changes until a partner marks a calendar as default.
    • Routing rules under Settings → Ticketing → Routing: set the category, priority, status or assignee on new tickets, for one organization or partner-wide, first match wins. Only fields the creator did not set are filled.
  • Update rings decide Windows feature updates (#10203). Each ring can Block Windows feature releases (the default), Allow the newest release, or Pin to one, such as Windows 11 25H2. A pin also writes the Windows Update for Business target-release policy on each device, and switching back removes only the values Breeze wrote. A blocked release shows as Excluded by policy on the device's Patches tab. Needs agent 0.125.0.
  • Install scripts, zip packages and built-in DNS filtering packages (#9745, #9882, #9983, #10035, #10022).
    • Software versions can carry pre- and post-install scripts that run as SYSTEM or root, and can use the new zip package type.
    • Partner admins can add Breeze-pinned Control D and NextDNS CLI packages for Windows from Software → Catalog → Built-in packages.
    • Software policies can require a service to be running: a stopped service is a violation, and an armed policy restarts it.
    • Needs agent 0.125.0. Older agents fail the device with agent_update_required, and nothing is sent to them.
  • YARA detection rules and fleet-wide IOC sweeps (#9759, #9888, #10028, #10048, #10055, #9474).
    • A new Detection Rules page under Security: rule sets with inline compile errors, an IOC paste importer and a test-a-file panel.
    • A rule-set picker on the configuration policy Security tab, and a Rule panel on each threat.
    • Sweep now runs published rule sets across many devices at once, from a preview you approve. Sweeps detect only and never start a Defender scan.
    • The AI assistant gets an ioc_hunt tool. Sweeps and imports need approval, and a sweep over 25 devices needs a second approver.
  • One Breeze AI, and conversations that move (#9852, #9996, #10029, #10044, #10056, #10153, #10155, #10157, #10165, #10171, #10148).
    • A conversation moves between the side panel and the full-page chat (Open in AI Assistant / Continue in side panel) with its history, device, model and unsent text. A reply that is still streaming keeps streaming.
    • Both surfaces share one history list, with organization and device chips.
    • The chat is called Breeze AI everywhere. The full-page chat moves to /ai/chat, and old links redirect.
    • Approvals say Approve / Deny, AI spend shows in dollars, and the four guardrail tiers have plain names.
    • The AI sidebar section is shorter, and AI settings are gathered on a new Settings → AI page.
  • Dashboard numbers you can click, and Sites in Fleet Management (#9808, #9887, #9982, #9995, #9998, #10052).
    • Dashboard device, alert, vulnerability, security and patch figures open the filtered list they count.
    • Sites is back under Fleet Management as a list across organizations.
    • Move to site works on many devices at once.
    • Patch compliance now shows the percentage of fully patched devices everywhere, so the dashboard number may change after the upgrade.
  • A more dependable Breeze Assist (#10228, #10230, #10239, #10208).
    • On Windows the agent no longer starts Breeze Assist on a WebView2 Runtime too old for it. The device reports Assist unavailable with the reason instead of crash-looping silently.
    • The agent removes only an Assist it installed itself. A copy installed by Intune or by hand is left alone.
    • The device page gets a Breeze Assist row.
    • The native remote-support consent dialog now defaults to Deny.
    • Needs agent 0.125.0.

Added

  • Agreements (#9075):
    • lifecycle API under /api/v1/contracts/agreement-requests: create, preview, send, link, remind, void (#10127, #10191);
    • unauthenticated signing routes under /api/v1/agreements/public/:token, rate limited to 60 a minute per IP plus a per-link limit (#10162);
    • portal routes GET /api/v1/portal/agreements and /signed-agreements (#10202);
    • the agreementRequestExpiryReaper (every 15 minutes) and agreementRequestAutoReminder (hourly) jobs;
    • agreement.* lifecycle events on a new agreement-events queue, with nothing consuming it yet;
    • a partner-editable Agreement request email template (#10162).
  • Ticketing: the list_business_calendars, list_ticket_routing_rules, test_ticket_routing_rule and manage_ticket_routing_rules AI tools, and a portal banner on a merged ticket (#9897, #10001, #9997).
  • Force reboot now on the device Power menu. You type the hostname and pass an MFA step-up, and it runs shutdown /r /f /t 0 on Windows. It is a new command type, so an older agent refuses it visibly (#9380, #10173).
  • Restart agent from the device page, carried out by the watchdog. It needs the new devices:recover_agent permission, which the upgrade grants to the built-in roles that hold devices:execute (#9413).
  • Business reports: Client profitability, Quote win rate, and MRR & renewals (#9899, #9898, #9885).
  • AI tools in chat and agents (#6754):
    • PSA and billing writes (#9767);
    • backup, DR and virtualization (#10117);
    • security, incident and device operations (#10130);
    • PSA configuration and ticket operations (#10160);
    • alert correlation and signal triage (#10169);
    • network topology (#10204);
    • SNMP and network monitoring (#10241);
    • AI-agent reads (#10273);
    • security policies (#10286).
    • Every action carries a guardrail tier. manage_catalog is renamed manage_billing_catalog, and the old name still dispatches over MCP for one release (#9767).
  • Physical placement card (room, rack, rack unit, height) on device and discovered-asset pages (#10247, #9333), and a WAN role and circuits API for topology interfaces (#8774).
  • Security Agents tab: Control D and NextDNS are listed as Coming soon, and the tab explains what arming them needs. They cannot be switched on in this release (#10124).
  • Backup: selective restore accepts folders, which are expanded to the files indexed beneath them, with a confirm above 1,000 files (#9884).
  • Patches: Windows updates with no MSRC rating get a severity derived from their classification and title, labelled Derived rating (#9425, #9399).
  • Diagnostics: the TURN preflight warns when the relay accepts an unauthenticated Allocate (#9506).
  • Behind a flag, off by default (details under Behaviour changes):
    • Flows in the Tool Catalog: flow documents, runner, triggers including webhooks, approval pause and resume, a runs timeline, notify / http_request / ai steps, and flows exposed as AI tools (#9411, #9432, #10168, #10175, #10270, #10284, #10285, #10283);
    • MCP modernization: stateless protocol 2026-07-28, Client ID Metadata Documents for OAuth, Tier-3 MCP calls routed to an approval instead of refused, URL-mode elicitation, an MCP Apps fleet-health view and the MCP Tasks extension (#9409, #9437, #9752, #9756, #9984, #10023);
    • AI task recipes for identity offboarding and onboarding (#9754, #9974, #9993, #10058, #10118, #10128).
  • Breeze Cloud only: Wisp, a continuous triage companion with its own home, threads, memory, nudges and specialists (#9924, #9971, #10000, #10007–#10013, #10033, #10045, #10063, #10066, #10070, #10238, #10240, #10243). On a self-hosted server Wisp shows a lock, and you have nothing to set.
  • Groundwork, not yet usable:

Improved

  • One document renderer for quotes and invoices. Preview, detail, portal and PDF draw from the same composition, and staff get a Customer view of the portal (#9434, #9438, #9479, #9448, #9518, #9446, #9490, #9536, #9527, #9732, #9733).
  • Partner settings: one header Save for every tab, with a status line naming unsaved or failed sections. The rail is regrouped, and Caller verification and Known guests get their own tabs (#9805, #9990, #9821).
  • Agent connections after an API restart. After a stable connection drops, agents redial after a random 1–30 s (was 1–5 s). A 503/429 with Retry-After on a periodic upload defers that upload. Startup uploads are spread out (#9444).
  • Admission control rises only under sustained pressure, with higher level-1 thresholds and a shorter level-1 hold (#9512).
  • Backup destinations with a Path Prefix write new snapshots under <prefix>/snapshots/. The destination form validates the prefix as you type (#9443).
  • PAM:
    • an agent that cannot act on an elevation reports it, and the request closes as expired instead of waiting (#9559, #9813);
    • on-demand helper mode keeps a SYSTEM helper per session for UAC interception (#9514);
    • the user-role helper writes a readable log (#9516);
    • the intercepted UAC prompt is dismissed once an approved elevation launches (#9515);
    • approvals deliver immediately (#8677).
  • Agent efficiency on Windows: link speed and security probes are read in process, with no per-adapter PowerShell spawn (#9477).
  • Integrations page leads with health, with per-entry status and scope labels (#9442).
  • Reliability score factors link to the event log for the scoring window (#10052).
  • Default device group is a real static group that is applied at enrollment. Two settings that did nothing (default alert threshold, send welcome notification) are removed (#9738).
  • Enrollment keys: Create Key honours partner and org enrollment defaults (#9876).
  • Sentry: repeat-error storms are throttled per signature, and topology workers back off a failing site (#9870).
  • AI billing: compute and unreserved token debits are keyed and durably retried, and platform admins can re-drive failed debits (#9491).
  • Demo-QA papercuts across security, CIS hardening, encryption, alerts, analytics, audit, peripherals, backup, devices, webhooks, discovery, approvals and settings (#9875, #9877, #9878, #9880, #9881, #9883, #9873, #9809, #9810, #9807, #9743, #9766, #9771, #9825, #9871, #9872, and others).

Fixed

  • Patching:
    • an explicit decline is final, so ring auto-approval no longer re-approves a declined patch (#9475);
    • manual installs honour a ring-level decline (#9505);
    • overlapping patch policies use the closest level (#9690);
    • partner-wide approvals count in ring views (#9769);
    • decommissioned devices are left out of compliance (#9702).
  • Breeze AI:
    • a conversation moved to the full-page chat during its first reply keeps the reply and any approval card (#10312);
    • signing out resets the side panel, so the next sign-in on the same browser starts with an empty panel instead of the previous conversation (#10320).
  • Agents:
    • rollback keeps executable file modes (#10061);
    • cancelling a command that is just starting kills its whole process tree (#9824);
    • cancel_reboot with nothing scheduled succeeds, and restart-prompt replies are no longer dropped (#10209);
    • an unapplied CIS remediation is recorded as failed (#9701);
    • YARA scans start under a Windows service (#9474), which was a known gap in v0.124.0;
    • GDM's Xorg is found on Linux (#9598);
    • CylancePROTECT / Aurora is recognised as antivirus (#9389, #9504).
  • AI:
    • a call that is always blocked no longer asks a human first (#9892);
    • a file_operations delete reports a move to trash honestly, and permanent delete is an explicit, approved option (#9893);
    • out of credits returns 402 with a Buy credits offer (#9486);
    • a sidebar session follows the header-selected organization (#9541);
    • approval cards use human labels (#9717).
  • Alerts: reboot-pending alerts resolve once the device restarts (#9599). Alert page copy, refresh and ticket links are corrected (#9880, #9704, #9685).
  • Billing and contracts:
    • auto-renew extends the term before the final invoice (#9503);
    • resumeContract never lands on a period that is already billed (#9731);
    • invoices fall back to partner branding (#9727);
    • contract invoice lines carry a name (#9744);
    • Generate now reports skipped outcomes (#9746).
  • Deliverables and contracts: move, bulk reschedule, signed-agreement evidence, and pause on draft contracts (#9359, #9355, #9363, #9362, and others).
  • M365: sign-in event sync no longer uses a beta-only filter (#9398), and consent and enablement errors say what is wrong (#9335, #9354).
  • DNS Security:
    • deleting an integration runs in the background and no longer fails on aggregations (#10042);
    • Umbrella sync records a partial status and keeps advancing (#10041).
  • Webhooks:
    • bearer-token auth is saved as an encrypted header (#9698);
    • "Alert Created" subscribes to the right event (#9691);
    • the edit form keeps events it has no checkbox for (#9768).
  • Events: device.enrolled is published when enrollment completes (#9748).
  • Auth: MFA factor state stays in sync after TOTP enrolment or removal, and a passkey can be deleted when TOTP is off (#10237). SSO audit rows carry the partner (#9502, #9478).
  • Install script (install.sh): it creates the Linux data directory and group, and refuses an agent older than 0.118.0 with a clear message (#9571).
  • Agreements: the uploaded PDF shows on the public signing page and in a public quote's contract block (#10226).
  • From the pre-release sweeps (#9967, #10109, #10201, #10296):
    • the Wisp morning brief shows spend in dollars;
    • the ring feature-update badge names the Windows version ("Windows 10 22H2");
    • the portal dashboard counts agreements waiting to be signed;
    • the flow runs tab says "No runs match this filter";
    • the Breeze Assist Deploy toggle is a named switch that reports its state.
  • Smaller fixes: i18n gaps closed across locales (#9554), event log messages show in full (#9551), and help tooltips stay on screen (#9552).

Security

This release includes security hardening across:

  • response headers: per-request connect-src with no plaintext ws: in production, Cache-Control: no-store on HTML, plus Permissions-Policy, Cross-Origin-Resource-Policy: same-site and de-duplicated HSTS and nosniff in docker/Caddyfile.prod (#9235);
  • the Office add-ins. Assistant Markdown could load remote images and other resources automatically, which could carry document or mail content out. Images are now click-through links, and resource-loading markup is stripped (#10060);
  • system-tools file upload, copy and move, which now also need scripts:execute, the same permission as running a script. The AI file_operations write and rename follow the same rule (#10059);
  • PAM UAC approvals, which now need devices:execute as well as pam:approve, with the same MFA gate on the inbox and mobile paths (#8673);
  • the force-reboot step-up grant, now bound to the canonical device id (#10173);
  • AI Operator effects that carry secrets, which now appear in the AI risk audit feed (#10150);
  • stale-caller hardening for reinstalled devices, with an audited cross-tenant probe (#9896, #10116);
  • Helper branding text, which rejects invisible Unicode (#9407);
  • the read ceiling on flow webhook delivery bodies (#10283);
  • dependency advisories: zod GHSA-mrhx-c7xc-m3w5 (#9925), tokio RUSTSEC-2026-0386 (#9970), ctutils RUSTSEC-2026-0385 (#9890), rustls-webpki RUSTSEC-2026-0381/0382 (#9430), the October 2026 Node.js security release (#9851), Go 1.26.10 for a crypto/x509 fix (#9471), dompurify (#9694), follow-redirects, markdown-it and vite (#9424), certifi and pillow in the AI workspace image (#9498), and 16 moderate or low Dependabot alerts (#9986).

Self-hosters are encouraged to upgrade.

Self-Hosting / Upgrade Notes

Upgrade command. Check how your install pins its images: grep '^BREEZE_API_IMAGE_REF=' .env.

  • Digest-pinned (the value ends in @sha256:…; every guided-setup.sh install from v0.112.0): fetch the current guided-setup.sh from main, then run bash guided-setup.sh --upgrade 0.125.0. It verifies the signed image inventory and updates BREEZE_VERSION and all four image digests together. Then it pulls and restarts.
  • Tag-form (the value ends in :${BREEZE_VERSION}): bump BREEZE_VERSION=0.125.0, then run docker compose pull api web portal && docker compose up -d (and pnpm install if you build from source). If you run the optional worker container, pull and restart it too.
  • Do not edit only BREEZE_VERSION on a digest-pinned install. That re-pulls the images you already run.
  • Replace every API and worker instance in the same deploy. Do not run an instance older than v0.124.0 next to this release. Once this release writes a prefixed backup snapshot, an older instance cannot read it, so rollback below v0.124.0 is off the table (#9443).
  • --upgrade does not change your docker-compose.yml. To set any of this release's new optional variables, add their lines to the right service's environment: block, or take the v0.125.0 docker-compose.yml / deploy/docker-compose.prod.yml, which already map most of them. A value only in .env does not reach the container.
  • Maintaining your own docker/Caddyfile.prod? Carry over the new Permissions-Policy and Cross-Origin-Resource-Policy defaults and the > replace on HSTS and nosniff (#9235).
  • See the Upgrade Guide.

No breaking changes for an install on default settings. Check these stricter rules before you upgrade a customised install:

  • AGENT_ENROLL_RATE_WINDOW_SECONDS above 230 now refuses to boot. The default is 60. The limit keeps every agent-facing Retry-After under the agent's 300-second ceiling (#9480).
  • File upload, copy and move need scripts:execute (#10059). UAC approvals need devices:execute (#8673). Custom roles that relied on devices:execute or pam:approve alone get a 403.
  • Backup destinations with an invalid stored Path Prefix stop backing up. That means an empty segment, . or .., characters outside A–Z a–z 0–9 ! _ . * ' ( ) -, a snapshots segment, or more than 256 characters. Those backups fail with invalid_destination_prefix, and Test connection now fails too. Fix the prefix in the destination form (#9443).
  • MCP clients calling manage_catalog should switch to manage_billing_catalog. The old name works for this release only (#9767).

Database.

  • 64 migrations. They are idempotent and apply automatically on boot via autoMigrate unless AUTO_MIGRATE=false. Expect [auto-migrate] Applied 64 migration(s) from v0.124.0. No shipped migration was modified, renamed or removed. Two files (2026-12-18-110000-*, 2026-12-18-120000-*) sort before v0.124.0's newest migration. autoMigrate applies them anyway, because pending files are applied whatever their position. They only add partners columns.

  • No table rewrite, and no table or column is dropped. Every new NOT NULL column carries a constant default (metadata only). That includes devices.install_incarnation (#9385) and partners.billing_enabled after its backfill (#10172). The hot tables use the safe patterns:

    • devices: NOT VALID then VALIDATE, with a 5 s lock timeout;
    • device_commands and script_executions: concurrent index builds;
    • tickets: no-transaction files with concurrent indexes;
    • the DNS Security tables: foreign keys swapped NOT VALID, with a lock timeout.

  • Brief table scans under an exclusive lock. Each of these files holds an exclusive lock on the named table while one scan or index build runs. Reads and writes of that table wait for it. On a small install this takes well under a second. On a large one, check sizes first, for example SELECT pg_size_pretty(pg_relation_size('device_patches')), and plan a quiet window if any is large for your storage.

    • device_patches: a new CHECK on reported_severity_source is validated in the same statement (2027-01-02-160000-device-patch-reported-severity-source.sql, #9425).
    • elevation_requests: a new CHECK on the device_unable_* columns is validated in the same statement (2027-01-02-180000-elevation-device-unable.sql, #9559). It covers every UAC request, technician JIT grant and governed AI action.
    • ai_invocations and action_intents: a new column, then non-concurrent index builds and CHECK re-validation (2027-01-06-130000-flow-runs.sql, 2027-01-07-140000-flow-webhooks-tools-budgets.sql, #10168, #10270). This applies even though Flows is off.
    • security_scans: three nullable columns plus a partial index built without CONCURRENTLY (2027-01-04-140000-security-scan-sweeps.sql, #10028).
    • ai_agent_runs, ai_operator_tasks and ai_sessions: validated CHECKs, foreign keys and indexes in the Wisp schema files (2027-01-04-100100, -110200, -110300, -110350, 2027-01-05-100400). They run on every install, with or without Wisp.

  • Backfills over existing rows (each elects system scope first):

    • Ticket SLA deadlines (2027-01-02-190200-ticket-sla-deadlines-backfill.sql, #9811). It writes the stored due and warn times for every ticket with an SLA target or pause history. It runs in batches of 5,000 with a commit per batch, so it does not hold the tickets table. The values reproduce today's wall-clock rule exactly. Partner API tickets-feed consumers receive each backfilled ticket once more, now carrying the four new deadline fields.
    • Business-hours calendars are imported from the existing partner business-hours settings (2027-01-03-160000, #9897). No ticket uses a calendar until a partner marks one as default.
    • Contract notes (#9364, 2027-01-02-100900, 2027-01-02-100300). Notes are now internal only, and invoices print only the Invoice note. The migration copies each contract's notes into its invoice terms and clears the auto-generated ones. An old API or worker instance left running prints them twice until it is replaced.
    • partners.billing_enabled is set per partner from live billing activity, then made NOT NULL DEFAULT true (2027-01-05-120000, #10172). Nothing reads it yet.
    • Permissions: agreements:send goes to every role, built-in or custom, that holds agreements:write, *:write or *:*. The same file re-runs the idempotent signed-agreement evidence back-fill from v0.124.0 (2027-01-05-110000-agreements-send-permission.sql, #10127). devices:recover_agent goes to built-in roles that hold devices:execute (#9413).
    • Smaller ones: the existing webhook alert.created subscriptions move to alert.triggered (#9691); one-time deliverable template items become not visible in the portal (#9357); user_notifications rows are copied into the new Wisp thread timeline (2027-01-06-140000-wisp-thread-posts.sql, two scans of user_notifications).

  • Forced row-level security on software_compliance_status (2027-01-04-120500, #10022), on databases created from the baseline. A direct-SQL report that reads it without a tenant context now sees no rows.

  • One-way enum additions:

    • elevation_audit_event_type + device_unable;
    • security_provider + cylance;
    • report_type + mrr_renewals, quote_win_rate, client_profitability;
    • ai_initiator_kind + flow;
    • deliverable_evidence_kind + contract_document.

  • Privileged DDL. There is no CREATE ROLE, OWNER TO, CREATE EXTENSION or schema-level grant.

    • Eight SECURITY DEFINER functions (command incarnation stamping, Wisp and flow guards).
    • 2027-01-06-170000-contract-documents-append-only.sql revokes UPDATE/DELETE/TRUNCATE on contract_documents from breeze_app, grants back a column-level UPDATE, and routes erasure through breeze_audit_admin. This follows the shipped pattern of earlier audit-role migrations.
    • All 34 new tables enable and force row-level security in the file that creates them.

  • Rollback. Take a backup, or note a PITR point, before you upgrade. A rollback to v0.124.0 keeps the new schema:

    • the enum values above stay;
    • contract_documents stays write-protected, because the revoke is not undone by an older image;
    • prefixed backup snapshots written by this release cannot be read by v0.124.0.

    Going below v0.124.0 needs a database restore.

Environment variables.

  • Required: none. No new required environment variables.
  • New, optional (api service). Each is mapped in both shipped Compose files unless noted.
    • AI_TOOL_INDEX (lazy). full restores the previous AI system prompt that lists every tool. A conversation picks up a change when its AI session next starts (#10087).
    • PROMPT_HOST_ENABLED_KINDS (unset = the code default, which is empty in this release; an explicit empty value is the kill switch). It lists the on-device prompt kinds the server enables. Nothing uses it yet (#10280).
    • BREEZE_ADMISSION_RISE_TICKS (3) and BREEZE_ADMISSION_LEVEL1_HOLD_MS (5000) (#9512).
    • DNS_SECURITY_RETENTION_DAYS_DEFAULT (90, 1–365), DNS_SECURITY_RETENTION_BATCH_SIZE (5000) and DNS_SECURITY_RETENTION_MAX_BATCHES (400) (#10042).
    • Flows (all inert while FLOWS_ENABLED=false): FLOWS_ENABLED (false), FLOW_APPROVAL_TTL_HOURS (24), FLOW_MAX_RUNNING_PER_OWNER (20), FLOW_RUN_RETENTION_DAYS (90), FLOW_WEBHOOK_RATE_PER_MINUTE (120), FLOW_WEBHOOK_DELIVERY_RETENTION_DAYS (30) and FLOW_FOREACH_MAX_PARALLEL (5) (#9411, #10168, #10270).
    • MCP (all off or inert by default; a non-boolean value refuses boot):
      • MCP_STATELESS_ENABLED (false) and MCP_HEADER_MISMATCH_ALERT_THRESHOLD (50) (#9409);
      • MCP_TIER3_INTENTS_ENABLED (false), MCP_INTENT_MAX_LIVE_PER_PRINCIPAL (20), MCP_INTENT_CREATES_PER_HOUR (60) and MCP_INTENT_CREATES_PER_USER_PER_HOUR (60) (#9752);
      • MCP_APPROVAL_WAIT_MS (20000) and MCP_APPROVAL_WAITS_PER_PRINCIPAL (2) (#9756);
      • MCP_APPS_ENABLED (false) (#9984);
      • MCP_TASKS_ENABLED (false; it also needs MCP_STATELESS_ENABLED), MCP_TASK_PENDING_POLL_INTERVAL_MS (30000), MCP_TASK_POLL_INTERVAL_MS (5000) and MCP_TASK_TTL_GRACE_MS (3600000) (#10023).
    • OAUTH_CIMD_ENABLED (false) and OAUTH_CIMD_ALLOWED_HOSTS (empty = any host that passes the SSRF checks) (#9437).
    • AI_OPERATOR_RECIPE_IDENTITY_OFFBOARDING_ENABLED and AI_OPERATOR_RECIPE_IDENTITY_ONBOARDING_ENABLED (both false). Each also needs AI_OPERATOR_TASKS_ENABLED (#9974, #10118).
    • BREEZE_WISP_ENABLED (false). Breeze Cloud only. A production API refuses to boot with it on unless IS_HOSTED=true and ENABLE_2FA is on. Self-hosters leave it unset.
    • BREEZE_WISP_CONNECTOR_ENABLED (false) is an alias of BREEZE_WORKSPACE_ENABLED, the file and email knowledge connector (needs pgvector). It is not the Wisp engine flag (#10063).
    • IOC sweeps (not in Compose; add them to api yourself if you need to change one): SECURITY_SWEEP_MAX_DEVICES (10000), SECURITY_SWEEP_MAX_ACTIVE_PER_ORG (5), SECURITY_SWEEP_PUMP_INTERVAL_MS (30000), SECURITY_SWEEP_PUMP_BATCH (100), SECURITY_SWEEP_PARTNER_RUNNING_CAP (200), SECURITY_SWEEP_TTL_HOURS_DEFAULT (24), SECURITY_SWEEP_MFA_DEVICE_THRESHOLD (50), SECURITY_SWEEP_RUNNING_GRACE_MINUTES (65) and IOC_HUNT_FOUR_EYES_DEVICE_THRESHOLD (25) (#10028, #10048).
    • Compose now also maps PAM_OWNERSHIP_EPOCH_TRANSFER and BREEZE_YARA_BUILTIN_PACK_DISABLED, both from v0.124.0.
  • New, optional (agent agent.yaml): ws_first_reconnect_window_seconds (default 30, 0–300; 0–5 restores the old 1–5 s spread) and loop_retry_after (default true) (#9444).
  • .env.example now documents the Microsoft 365 Graph-read, Graph-actions and comms variables in one place, and the comms signing key is shown as M365_COMMS_EXECUTOR_SIGNING_PRIVATE_JWK_SOURCE_FILE (a host path mounted into the container). Existing values keep working.

Behaviour changes and feature flags.

  • Windows feature updates are decided by the update ring (#10203).
    • What changed: the agent's patch_exclude_feature_updates now defaults to false and acts only as a kill switch. The ring's Windows feature updates setting decides, and it defaults to Block, so nothing changes until a ring is set to Allow or Pin.
    • Pin writes TargetReleaseVersion, TargetReleaseVersionInfo and ProductVersion under HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, with a Breeze ownership marker. A target-release policy that another GPO already set is left as found.
    • Unless the patch policy's exclusive-Windows-Update setting is on, Windows may install a pinned release on its own schedule.
    • Installed feature releases now appear in the installed inventory.
    • Older agents keep excluding feature releases locally.
    • Agent log lines: applied Windows feature-update policy, ignoring feature_update_settings.
  • DNS Security retention (#10042).
    • A nightly job (22:18 UTC) deletes events and aggregations older than each integration's window. That is retentionDays on the integration (now editable from the integrations tab, or PATCH /dns-security/integrations/:id), else DNS_SECURITY_RETENTION_DAYS_DEFAULT (90).
    • Integrations that previously kept everything lose history past that window on the first run.
    • DELETE /dns-security/integrations/:id now returns 202 and deletes in the background. The row shows Deleting… until the delete finishes.
  • Agent reconnect pacing (#9444).
    • After an API restart, a device can show offline up to about 30 s longer.
    • The first dial after an agent starts waits 0–10 s. The startup inventory, hardware and patch uploads each wait 0–120 s.
    • A 503/429 with Retry-After defers that periodic upload for up to 300 s. Heartbeats and command results are never deferred.
    • Agents honour a drain frame, which the API does not send yet.
    • New agent log lines: initial connect delayed, drain hint received, route deferred by server Retry-After, command result held for reconnect; persisting to the outbox, startup task delayed, monitoring first run delayed.
  • Admission thresholds (#9512). Level 1 now needs lag of 200 ms or DB wait of 150 ms (was 100 / 75) for three consecutive ticks, and holds for 5 s (was 15 s). The commented defaults in .env.example changed to match. The emergency threshold is unchanged and immediate.
  • Breeze Assist (#10228, #10239, #10208).
    • New Breeze Assist policy links start with Deploy Breeze Assist to devices on. An API request that creates the helper feature link without enabled now stores enabled: true. Existing policies, and devices with no Assist policy, are unchanged.
    • The agent removes only an Assist it installed. It records its own installs in assist-ownership.json, and a copy installed by other means is reported as unmanaged_install. With deploy on, the first heartbeat after the upgrade adopts an Assist it finds.
    • Below the WebView2 Runtime version Assist needs (92.0.902.49 for current builds, shipped as assist-requirements.json), the agent does not start Assist, logs one warning and reports webview2_outdated.
    • After six failed starts the agent reports crash_loop and retries after 6 hours. See the known issue #10302.
    • The native remote-support consent dialog now defaults to Deny. Pressing Enter, or letting the dialog time out, declines the session.
    • Older servers show the new issue codes as an unknown reason.
  • Patch compliance percentage on the dashboard is now the share of fully patched devices, matching the Patches page. It was the share of individual patches installed, so the number may change (#9982). GET /patches/compliance adds devicePercent, failedDevices, deviceCounts, outstandingTotals and a paginated devices list, and changes no existing field.
  • AI chat system prompt lists tools by domain (about 4.4 KB smaller), and every tool stays available. If tool choice gets worse for you, set AI_TOOL_INDEX=full (#10087).
  • AI chat addresses: the full-page chat is at /ai/chat. /workspace and /wisp/chat redirect permanently, and #session=<id> links still open their tab. GET /api/v1/ai/sessions and /search return only chat conversations and add orgId, type and deviceId. The mobile app's history no longer lists script-authoring and MCP sessions (#9852, #10044, #10171).
  • Agreements (#10127, #10235, #10233).
    • The agreements:send permission is granted by migration to every role with agreements:write. Remove it afterwards from roles that should edit templates but not send.
    • Automatic reminders are off by default, and the default link expiry is 30 days.
    • Customer mail uses the partner's sending identity.
    • Signed agreements can no longer be changed in the database, except their contract link and, during an organization merge, their organization.
  • devices:recover_agent is granted by migration to the built-in roles that hold devices:execute (Org Admin, Org Technician, Partner Technician). Custom roles need it added to use Restart agent (#9413).
  • IOC scans gain the states cancelled and expired, so API consumers filtering GET /security/scans/:deviceId by status will see them (#10028).
  • Flows (FLOWS_ENABLED, default false). With it off, every flow route answers 404. With it on:
    • flows get webhook triggers (POST /api/v1/webhooks/flows/:flowId, signed or token mode, JSON bodies up to 256 KB) and monthly run caps (10,000 per flow, 100,000 per owner);
    • built-in steps include http_request, which refuses private and metadata addresses unless TOOL_SOURCES_ALLOW_PRIVATE_EGRESS is set;
    • enabled manual flows appear to the AI as flow__<slug> tools.
    • Tier-3 flows are never listed over MCP.
  • MCP (#6154). Everything is off by default, and with the flags off MCP behaves as in v0.124.0. The one exception is that tools/list gains get_action_status and cancel_action. With MCP_TIER3_INTENTS_ENABLED=true, a Tier-3 tools/call returns pending_approval with an actionId instead of an MCP_APPROVAL_REQUIRED error, so callers must poll get_action_status. The legacy HTTP+SSE transport now sends Deprecation and Sunset headers.
  • AI task recipes for identity offboarding and onboarding stay off unless both AI_OPERATOR_TASKS_ENABLED and the recipe flag are true.
  • Wisp is Breeze Cloud only (BREEZE_WISP_ENABLED, default false, plus a per-partner entitlement). On a self-hosted server, /wisp shows a locked page and no Wisp route, job or UI is active.
  • Security Agents: Control D and NextDNS stay Coming soon in this release, with no switch (#10124).
  • Endpoint messaging and live chat stay dark. Their agent version gates are still at the 999.0.0 placeholder.
  • Install scripts on software versions (#10035). Scripts stored on a software version before this release stay inactive until the version is re-created, and the version manager shows a notice. Creating a version with a script needs devices.execute.
  • New boot task: the API moves provisioned built-in DNS packages to the version pinned in code. Log line: [startup] pinned built-in package refresh: refreshed N, failed M (#9983).
  • PAM: devices report elevations they cannot act on (#9559). New agent route POST /api/v1/agents/:id/pam/elevation-unable. The API publishes elevation.expired with cause: device_unable. Older agents keep the previous behaviour.
  • Organization defaults: the default device group is applied to newly enrolled devices. The partner-level device group, alert threshold and welcome-notification defaults are ignored (#9738).

Agents. Agents, Breeze Assist and Breeze Viewer update to 0.125.0 through your normal update channel.

Agent-side changes in 0.125.0:

  • feature-update policy and the Windows Update for Business pin (#10203);
  • reconnect jitter, drain and loop-level Retry-After (#9444);
  • zip packages, install scripts and service_running detection (#9882);
  • Breeze Assist WebView2 gate, crash-loop reporting and install ownership (#10228);
  • native consent defaults to Deny (#10208);
  • the force_reboot command (#9380);
  • cancel_reboot and restart-prompt reply fixes (#10209);
  • derived Windows update severity (#9425);
  • in-process link speed and batched security probes (#9477);
  • YARA under a Windows service (#9474);
  • PAM on-demand hold, helper log, unable report and UAC dismiss (#9514, #9516, #9559, #9813, #9515);
  • rollback keeps executable modes (#10061);
  • process-tree cancel (#9824);
  • CIS remediation failure recording (#9701);
  • GDM Xorg discovery (#9598);
  • Cylance / Aurora detection (#9504);
  • UniFi Wi-Fi collection (#10166);
  • the dormant prompt host (#10277, #10279).

Known gaps in this release

  • macOS lab legs are deferred to the next release.
    • The Remote Desktop stuck-modifier fix (#9687) is not in this release.
    • Control D on macOS (DNS lab leg L2) was not run. macOS Control D is not offered.
    • Upgrade-in-place on macOS was not re-verified for this release.
  • Windows feature releases under Allow or Pin (#10203). The lab confirmed Block, Allow and Pin on the device (policy applied, registry pinned and reverted, admin GPO left as found) and the server's Excluded by policy badge. It did not observe Windows Update offering a feature release under Allow or Pin, because the only lab VM runs a Windows 11 build that is out of servicing. Report on #10203 if a supported build does not pick up an allowed or pinned release.
  • Dismissing the UAC prompt after an approved elevation (#9515) has no clean lab pass. It was blocked by #10178: a technician's approval does not close the user's Elevation Request dialog, which then times out and is logged as a deny.
  • Not run on real hardware (no rig):
    • UniFi Wi-Fi collection (#10166);
    • GDM Xorg discovery (#9598);
    • Cylance / Aurora detection (#9504);
    • the PAM unable report at shutdown (#9813);
    • the agent drain frame (no sender yet).

Known issues

  • Breeze Assist crash-loop detection does not fire (#10302). A crash-looping Assist keeps restarting and is not reported as crash_loop.
  • PAM UAC interception can stay disabled when the server does not know a device's PAM history, for example after a hard device delete and reinstall (#10303). The agent logs refusing to enable UAC interception before PAM reconciliation is verified.
  • Portal agreement detail page shows a blank PDF (#10290). Use the Signed copy / Original downloads.

What's Changed

New Contributors

Full Changelog: v0.124.0...v0.125.0

Check out latest releases or
releases around LanternOps/breeze v0.125.0

Don't miss a new breeze release

NewReleases is sending notifications on new releases.

Get notifications