github LanternOps/breeze v0.126.0
on GitHub

3 hours ago

Breeze RMM v0.126.0 — alerts that reach your PSA, device groups across every organization, and Jobs moving to Flows. Also in this release: Microsoft 365 and Google Workspace backups from NinjaOne SaaS Backup (Dropsuite) with organization-level alerts, and Breeze AI that deploys software, runs contract billing and places Pax8 orders with a second person's approval.

⚠️ Behaviour change: Flows is on by default. FLOWS_ENABLED now defaults to true. With Flows on, New job opens Flows, the Jobs page offers Move to Flows, and POST /api/v1/automations answers 410 automations_moved_to_flows. Existing Jobs keep running and stay editable until you switch them. Whether your install actually turns Flows on depends on your Compose file and .env; see Behaviour changes and feature flags. To keep Flows off, set FLOWS_ENABLED=false (#10700).

⚠️ Behaviour change: DNS Security stops storing allowed queries by default. Every existing integration stores blocked and redirected queries only after the upgrade, unless you turn on Store allowed traffic for it. Allowed rows already stored are kept until retention removes them (#10707).

Summary

  • Alerts reach your PSA and your webhooks (#10528: #10576, #10594, #10596, #10670, #10673, #10783, #10830, #10861, #10938).
    • Partner administrators can create All organizations webhooks that receive events from every organization they manage.
    • New webhooks get alert payload v2 (status, hostname, site, organization, alert link, external ticket references). Existing webhooks stay on v1 byte for byte.
    • Failed deliveries retry for about 21 hours (1 min, 5 min, 30 min, 2 h, 6 h, 12 h), with the retry state kept in Postgres.
    • The Partner API gains an opt-in alerts:write scope to acknowledge and resolve alerts and to attach external ticket references. Ticket create accepts alertId.
    • ConnectWise Manage alert tickets, opt-in per connection: Breeze opens, updates and closes a ticket for each qualifying alert, and alert pages show the linked ticket. You can create one by hand, see per-state counts and re-drive failures. This has not yet been verified against a live ConnectWise Manage tenant.
  • Device groups that span every organization (#10521: #10603, #10639, #10672, #10690, #10706; plus #10704, #10780, #10800, #10805).
    • Partner administrators with access to all organizations can create dynamic All organizations groups and assign them from partner configuration policies. Organization users see the group's name and their own devices, read-only.
    • Dynamic group rules can match a software version (below, at least, equal) and a software vendor.
    • The Devices list gains Export CSV (every matching device, visible columns), a Warranty Ends column with a Warranty Status filter, and bulk Add to group… / Remove from group… for static groups.
  • SaaS backup and alerts that are not about a device (#10598: #10703, #10708, #10721; #10725: #10733, #10835, #10836, #10837, #10856).
    • Microsoft 365 and Google Workspace backups from NinjaOne SaaS Backup (Dropsuite) appear next to Cove in backup health, the portal and reports. The connection is read-only status.
    • SaaS backup failures, including Cove Microsoft 365 workloads, raise organization-level alerts that flow through notifications and automations. Device-only automations skip them.
    • A topology alert keeps its history and PSA ticket links when the device that raised it is deleted.
  • Jobs move to Flows (#5215: #10313, #10344, #10685, #10700).
    • Move to Flows on the Jobs page shows how each Job would convert (Exact, Needs review or Can't move yet, with the reason). It runs the draft flow in shadow next to the Job and switches over only when you say so. Each trigger occurrence is run by the Job or by the flow, never both.
    • A switched Job's webhook URL keeps working and forwards to the flow. Revert turns the Job back on at once.
    • Flows gain a webhook tab, visible run limits and Settings → Flow limits (partner default, organization override that can only lower it).
  • Breeze AI covers software, billing and Pax8 (#6754: #10319, #10343, #10352, #10373, #10709, #10827, #10832).
    • New tools for the software catalog and deployments, device inventory and operations, live event-log browsing, tenant variables and Quick Support sessions.
    • Contract billing: preview and generate an invoice, and push invoices to QuickBooks or Xero. Generating and pushing need a second person's approval.
    • Pax8: integration status, product search with live pricing, subscription drift and order drafts. Submitting an order needs two-person approval of the estimated cost.

Added

  • PAM: an elevation the end user declined on the device (Deny, timeout or dialog error) can no longer be approved and launched afterwards. Requests show a Withdrawn status and filter (#10374, #10420, #10689). Standard users who send a request to IT on Windows are told whether it was approved, denied or expired, with the technician's reason (#10395, #10786).
  • On-device dialogs (#10190, opt-in, nothing enabled by default): branded notice cards, restart prompts, remote-consent cards, a clickable remote-session pill and elevation request cards drawn by Breeze Assist. They are switched on per kind with PROMPT_HOST_ENABLED_KINDS (#10310, #10314, #10339, #10340, #10341, #10347, #10348, #10349, #10350, #10351, #10691, #10693, #10694). A new remote access policy toggle, Let the user end the session (default on), applies once the remote-session kind is enabled (#10354, #10355).
  • Alert webhook events: alert.suppressed now fires from every suppress path, alert.escalated is published once per escalation step, and the event picker offers Ticket Merged (#10788, #10793).
  • Event logs: an Event Logs configuration policy can add up to 20 Application providers whose Warning and Information events are collected (#10720). APC PowerChute (APCPBEAgent) Warning and Information events are collected by default (#10566). The Windows Security category now collects audit events such as failed logons and lockouts (#10702).
  • EDR: a read-only Emsisoft cloud management console adapter (endpoints and detections, no actions) (#10159).
  • Update rings: Linux package block and pin rules (#10821).
  • Public proposal link: Download PDF for clients without a portal account (#10787). A reopened agreement link that signed the agreement offers the certified signed copy (#10798).
  • Contracts created by an accepted quote link back to it, and the contracts list marks them From Q-… · ready to activate (#10790).
  • Portal: physical placement on network assets behind the enablePhysicalPlacement setting, and WAN/circuit details on asset detail (#10176, #10763, #10333).
  • Ticket import brings attachments (#10064). A moved external reference records its origin ticket on merge (#10287).
  • Partner settings: inheritance drill-down per setting and a partner Known Guests tab (#10363). The AI tool get_partner_settings_inheritance answers which organizations override a partner setting (#10820).
  • Breeze AI: per-device history in get_script_execution_history (#10817); ticket, quote, invoice, contract, organization and site pages tell the chat what you are looking at (#10449); ticket merge and system_cleanup cancel work from chat (#10813).
  • Wisp (Breeze Cloud only, BREEZE_WISP_ENABLED): a per-thread working set with pins and automatic links, Talk to Wisp about this, a model menu on the home thread and a fresh session at the turn limit (#10434, #10834, #10833, #10419).
  • Groundwork for network isolation. It is not available yet and is switched off; see Behaviour changes and feature flags (#10088).

Improved

  • Alerts: acknowledged or suppressed alerts now resolve on their own when the condition clears, and event-log alerts re-open only on new events (#10769). Warranty-expiry alerts are graded as lifecycle notices instead of critical (#10447).
  • Remote desktop: the idle timeout default is 30 minutes instead of 5 (#10797). The viewer says why a session ended (#10637).
  • The legacy Windows restart box defaults to Postpone, so Enter no longer restarts the machine (#10350).
  • DNS Security: the Events tab loads in bounded pages with Load more (#10469, #10940).
  • Reports: Excel export is a real .xlsx (#10568).
  • Branding: the organization's primary colour reaches quotes and invoices (#10543). Partner Custom CSS applies to every child organization's portal (#10441). The portal landing and sign-in pages show the organization's welcome message (#10439).
  • Quotes: the editor edits Valid until and intro notes (#10458).
  • Software version manager: adding a version takes install scripts and zip packages, as Add Package does (#10812). A failed install shows the vendor's reason (#10631).
  • Reliability: Crashes, Application hangs and Hardware errors link to their own event-log sources (#10816).
  • Organization defaults save only changed fields and can be reset to their default (#10582).
  • IOC sweeps: Rules changed since this sweep started appears only when a scan failed for that reason (#10811). Progress names cancelled and failed devices (#10610). Scan now goes through the dispatch caps and can be cancelled (#10714).
  • Breeze AI: device and alert lists name each row's organization for multi-organization callers (#10784). manage_groups add and remove ask for approval and refuse the whole call instead of skipping devices (#10822). search_documentation returns the matching section text (#10451).
  • Command palette quick actions are searchable (#10480). The AI and Help side panels dock below the header (#10483). Device overview layout pass (#10317).
  • API load: the alert worker's database pool use is bounded and spread across each minute, bulk ingest inserts are chunked, and agent connection inventories keep the 2,000 most useful rows per device (#10864). Metric rollup compaction no longer waits on locks (#10855).

Fixed

  • Alerts and monitors:
    • a partial PATCH /monitor-definitions/:id, including the list's enable toggle and the AI enable/disable, no longer resets omitted settings to their defaults (#10939);
    • {{description}} and {{conditionsMet}} are filled on new monitor alerts, and event-log alerts fill {{count}}, {{category}} and {{windowMinutes}} (#10743, #10940);
    • the legacy [monitor] prefix is stripped from network check alerts (#10640);
    • correlation groups show Open instead of a raw key (#10940);
    • the alert worker warns about a backlog only when jobs are really waiting (#10940).
  • PSA: /integrations/psa no longer crashes once an alert ticket exists (#10938).
  • Devices: the CSV export fills the Warranty Ends column, and the warranty card no longer shows a date one day early west of UTC (#10940). Dynamic groups re-evaluate on warranty changes and on software inventory changes, and leave decommissioned devices out (#10877, #10569, #10609).
  • DNS Security: Last 90 days on the Events tab loads instead of failing (#10940).
  • Agent (macOS): YARA engine signing (#10881); the helper reloads after an update instead of staying unloaded (#10873); per-user state directory and OpenH264 (#10872); a TCC grant that preflight still denies is explained (#10875); a locked Mac's display stays awake for remote sessions (#10876); VideoToolbox warm-up (#10882).
  • Agent (Windows): BitLocker probes run only where BitLocker is available (#10906); disk inventory survives slow reliability counters (#10776); password policy read through secedit (#10473); winget error 0x8A15002B retried unscoped (#10465); per-user winget patches dispatched (#10464); the UAC prompt closes after an approve or deny (#10369, #10825); Windows event logs are no longer skipped (#10702).
  • Agent (all): repeated Linux and macOS events from one process are kept (#10779); the helper no longer drops its connection when a read times out mid-message (#10775); a crash-looping Breeze Assist is now reported (#10806, the v0.125.0 known issue #10302); upgrades back off after a verification failure (#10687), and local-mode servers withhold upgrades they cannot serve (#10686); the sensitive-data scan covers user profiles (#10461).
  • Event-log uploads are validated per row, so one bad event no longer drops the whole batch (#10698).
  • Discovery auto-links an asset to a device by MAC only (#10323).
  • Patching: deleting or disabling a ring cancels its undispatched work (#10710), deleting a ring asks for its name (#10683), and the device install poll stops on an outcome (#10471).
  • Compliance: one failing device no longer freezes the whole scan (#10648).
  • Billing, quotes and agreements: Checkout idempotency is tied to the invoice (#10778); time held by a block is not invoiced (#10684); a quote with no lines cannot be sent or accepted (#10467); the agreement certificate wording is versioned (#10711); customers see the template name, not the internal label (#10654); an accepted public quote keeps its payment step (#10688).
  • Sign-in and profile: delete a lost passkey with a recovery code (#10671); the MFA method is cleared when MFA is disabled (#10436); avatar refresh and logout identity (#10252).
  • Integrations: UniFi Site Manager lists every page of hosts and sites and stops filing one customer's devices under another (#10570); the Microsoft 365 mailbox poll is time-bounded (#9445).
  • Topology: no more false stale supplies or fractional page counts (#10324).
  • A large batch of web fixes from the October demo-video audit: toasts, labels, filters, locale strings and read-only merged tickets.

Security

This release includes security hardening across:

  • MCP: an OAuth intent is refused at release once the requester's authentication epoch has moved (#10819);
  • Huntress webhooks, now verified as Standard Webhooks, with the Webhook-Signature header redacted from Caddy access logs (#10590, #10602);
  • step-up resource digests, which canonicalise UUID ids (#10342), and invites, which refuse scope restrictions the scope cannot honour (#10628);
  • FORCE_HTTPS, which now lets in-cluster server-side rendering through by socket peer instead of the Host header (#10681);
  • reserved brand names ("Microsoft", "Windows Security", "Apple Help Desk" and similar) refused as partner or organization names; device prompts fall back to "Your IT support team" (#10818);
  • development Compose stacks bound to loopback, and a password on the legacy Redis (#10346);
  • dependency advisories: node-forge 1.4.2 for GHSA-86w9-cpqp-85rv (#10770), and pypdf 6.21.4 in the AI workspace image for seven high-severity denial-of-service CVEs, CVE-2026-119203 to CVE-2026-119209 (#10920).

Self-hosters are encouraged to upgrade.

Self-Hosting / Upgrade Notes

Upgrade command. Check how your install pins its images: grep '^BREEZE_API_IMAGE_REF=' .env.

  • Digest-pinned (the value ends in @sha256:…; every guided-setup.sh install from v0.112.0): fetch the current guided-setup.sh from main, then run bash guided-setup.sh --upgrade 0.126.0. It verifies the signed image inventory and updates BREEZE_VERSION and all four image digests together. Then it pulls and restarts.
  • Tag-form (the value ends in :${BREEZE_VERSION}): bump BREEZE_VERSION=0.126.0, then run docker compose pull api web portal && docker compose up -d (and pnpm install if you build from source). If you run the optional worker container, pull and restart it too.
  • Do not edit only BREEZE_VERSION on a digest-pinned install. That re-pulls the images you already run.
  • Replace every API and worker instance in the same deploy. Webhook retry state moves from Redis to Postgres in this release, so do not leave a v0.125.0 instance running next to it.
  • --upgrade does not change your docker-compose.yml. To pick up this release's new Compose mappings (listed under Environment variables) and the new FLOWS_ENABLED default, take the v0.126.0 docker-compose.yml / deploy/docker-compose.prod.yml, or add the lines to the api service's environment: block yourself. A value only in .env does not reach the container.
  • See the Upgrade Guide.

No breaking changes for an install on default settings. If you integrate with the API, check these before you upgrade:

  • POST /api/v1/automations answers 410 automations_moved_to_flows while Flows is on. Create flows instead, or set FLOWS_ENABLED=false. Editing and running existing Jobs is unchanged until they are switched (#10700).
  • GET /orgs/organizations/:id/effective-settings lists a partner field in locked only when the partner value wins. Partner defaults an organization may override move to a new partnerDefaults list (#10814).
  • Partner and organization names that are only a reserved brand now return 400 on create and update (#10818).
  • AI manage_groups add_devices / remove_devices now need approval and return alreadyMembers / notMembers instead of skipped (#10822). query_devices and manage_alerts list return 20 and 12 rows by default (were 25 and 15) (#10784).

Database.

  • 56 migrations. They are idempotent and apply automatically on boot via autoMigrate unless AUTO_MIGRATE=false. Expect [auto-migrate] Applied 56 migration(s) from v0.125.0. No shipped migration was modified, renamed or removed. All 56 passed an upgrade test from a v0.125.0 schema as a non-superuser role, including a re-run and a variant without BYPASSRLS.
  • Large installs: plan a quiet window for alerts, webhook_deliveries and incidents. On a small install these files take seconds. On a large one, check sizes first, for example SELECT pg_size_pretty(pg_total_relation_size('alerts')), and repeat for webhook_deliveries and incidents. The migrations were not timed against production-size data.
    • alerts is locked for the whole of the owner-kind migrations (2027-01-18-100000-alerts-owner-kind.sql, 2027-01-18-130000-alerts-owner-kind-device-topology-chk.sql, #10733, #10835). In one transaction they make device_id nullable, backfill topology alerts, validate a new CHECK with a full scan and build a unique partial index without CONCURRENTLY. The second file updates stragglers and validates the CHECK again. Alert reads and writes wait until each file finishes.
    • webhook_deliveries gains an org_id column with a foreign key validated by a table scan (2027-01-13-100000-webhooks-partner-ownership.sql). It is then backfilled in 10,000-row batches inside one transaction, so locks are held until the whole backfill commits (2027-01-13-100100-webhook-deliveries-org-id-backfill.sql, #10670). If you keep a long delivery history, consider pruning it before the upgrade.
    • incidents and incident_actions each gain a unique (id, org_id) constraint built without CONCURRENTLY (2027-01-17-200000-device-network-isolations.sql).
    • The other hot-table changes use the safe patterns: devices columns with constant defaults (metadata only); concurrent index builds on alerts, webhook_deliveries, ticket_attachments and dns_security_events; alerts foreign keys added NOT VALID then validated without blocking writes; ai_invocations CHECK added NOT VALID then validated.
  • Smaller backfills: contracts.source_quote_id from executed agreements and Pax8 orders (#10790); contract document template names; network monitors (legacy [monitor] prefix), PSA mappings (duplicate rows removed), Wisp tables, and ai_model_assignments rows for the retired patch_test surface (deleted). Each file that writes rows elects system scope first.
  • New tables flow_automation_conversions, automation_occurrence_claims, alert_external_refs, device_network_isolations and ai_operator_account_reservations enable and force row-level security in the file that creates them. device_groups.org_id becomes nullable for partner-owned groups.
  • One-way enum additions: elevation_status and elevation_audit_event_type + withdrawn; webhook_delivery_status + scheduled; ai_tool_status + refused; config_feature_type + containment.
  • Privileged DDL. There is no CREATE ROLE, OWNER TO, CREATE EXTENSION or schema-level grant. Twenty SECURITY DEFINER functions (flow conversions, partner device groups, partner webhooks, network isolation, metric rollup compaction) all pin search_path. 2027-01-18-188000-contract-documents-template-name-snapshot.sql disables and re-enables a trigger around its update, which needs table ownership; the migration role owns the table on a standard install.
  • Rollback. Take a backup, or note a PITR point, before you upgrade. A rollback to v0.125.0 keeps the new schema, including the enum values above, and was not tested.

Environment variables.

  • Required: none. No new required environment variables.
  • New, optional (api service), mapped in both shipped Compose files:
    • INTERNAL_SERVICE_CIDRS (Compose default: your BREEZE_DOCKER_SUBNET) and INTERNAL_API_HOSTS (api:3001). With FORCE_HTTPS=true, portal and web server-side rendering calls to the API no longer get 400 FORCE_HTTPS_NON_CANONICAL_HOST. Leave them unset on the bundled Compose. Every entry must lie wholly inside a private range, or the API refuses to boot; an empty INTERNAL_SERVICE_CIDRS turns the exemption off. Custom Compose or Kubernetes installs set it to their pod or service network (#10681).
    • NETWORK_ISOLATION_ENABLED (false) and NETWORK_ISOLATION_ENABLED_PARTNER_IDS (empty). Leave both unset. Network isolation is not available yet (#10088).
    • TICKET_IMPORT_MAX_BYTES_PER_HOUR (2147483648, that is 2 GiB, never below 10 MiB): attachment bytes one ticket-import window may download per hour. A value that is not a plain positive integer logs a boot warning and the default applies (#10064).
  • New, optional (api service), not in Compose (add them to the api service's environment: block if you need to change one) (#10864):
    • ALERT_WORKER_CONCURRENCY (a quarter of DB_POOL_MAX, or half with BREEZE_ROLE=worker; it was a fixed 10). Raise it if the API logs that alert jobs are still pending.
    • ALERT_WORKER_STAGGER_WINDOW_MS (50000, clamped to 0–59000). How far each minute's device evaluations are spread; 0 restores the old enqueue-all-at-once behaviour.
    • AGENT_CONNECTIONS_MAX_PER_DEVICE (2000, up to 10000). Network connections stored per device report; 10000 stores everything, as before.
  • Newly mapped in Compose: the IOC sweep limits SECURITY_SWEEP_MAX_DEVICES, SECURITY_SWEEP_MAX_ACTIVE_PER_ORG, SECURITY_SWEEP_PUMP_INTERVAL_MS, SECURITY_SWEEP_PUMP_BATCH, SECURITY_SWEEP_PARTNER_RUNNING_CAP, SECURITY_SWEEP_TTL_HOURS_DEFAULT, SECURITY_SWEEP_MFA_DEVICE_THRESHOLD, SECURITY_SWEEP_RUNNING_GRACE_MINUTES and IOC_HUNT_FOUR_EYES_DEVICE_THRESHOLD. Defaults are unchanged and listed in .env.example (#10795).
  • Changed default: FLOWS_ENABLED (true, was false). See below.

Behaviour changes and feature flags.

  • Flows on by default (#10700).
    • Flows turns on after the upgrade if FLOWS_ENABLED reaches the API unset: that is, you take the v0.126.0 Compose file (which passes ${FLOWS_ENABLED:-true}) or run a Compose file from before v0.125.0, and your .env has no FLOWS_ENABLED line.
    • Flows stays off if your .env has FLOWS_ENABLED=false (the v0.125.0 .env.example line), or if you keep the v0.125.0 Compose file, which passes false when the variable is unset.
    • With Flows on: New job opens Flows, POST /api/v1/automations answers 410, and the Jobs page shows Move to Flows. Nothing is switched automatically. Managed Jobs (AI triage, monitor compile, policy workflows) are unaffected.
    • With FLOWS_ENABLED=false: every flow route answers 404, Jobs stay fully writable, and Move to Flows does not appear.
    • Event-triggered Jobs can be moved only with durable event dispatch: EVENT_DISPATCH_MODE=enforce and flow-event-trigger among EVENT_DISPATCH_QUEUE_SUBSCRIBERS (keep the subscribers you already list). Otherwise they show Can't move yet.
    • A Job's webhook URL keeps working after the switch. The flow accepts JSON-object bodies only, and senders using the plain-secret header must move to X-Breeze-Webhook-Token.
  • DNS Security stores blocked and redirected queries only (#10707). This applies to every existing integration. Turn on DNS Security → Integrations → Stored data → Store allowed traffic to keep allowed queries. Overview and GET /dns-security/stats say Not stored (allowedTraffic: "none") instead of showing zero. Cisco Umbrella integrations also stop downloading allowed records.
  • Webhook retries (#10594). Failed deliveries retry for about 21 hours, then end failed. The Redis dead-letter queue and per-webhook retry_policy are retired; pending entries are re-driven at upgrade. A webhook's connection-health incident now opens when a delivery fails for good, about 21 hours after the first failure for a dead endpoint, rather than within minutes. Editing or disabling a webhook stops its scheduled retries.
  • New webhooks default to alert payload v2, including those created through the API without payloadVersion. Existing webhooks stay on v1 (#10576).
  • Discovery links by MAC only (#10323). An IP-only match no longer links a discovered asset to a device. Existing automatic links whose MAC is not on the linked device are dropped on the asset's next scan, and a device role that link set is reset so the agent's heartbeat restores it. Manual links are untouched.
  • Alerts auto-resolve when acknowledged or suppressed and their condition clears (#10769). Alerts that require a person never do. Closed alerts do not re-open on events they already alerted on.
  • Remote desktop idle timeout is 30 minutes (was 5) on devices with no Remote Access policy and under policies that do not set one. A timeout a policy sets explicitly, including a stored 5, is unchanged (#10797).
  • Alert worker concurrency now follows DB_POOL_MAX instead of a fixed 10, and device evaluations are spread across each minute (#10864).
  • Agent connection inventory keeps up to 2,000 connections per device report (#10864).
  • On-device dialogs are opt-in (#10190). PROMPT_HOST_ENABLED_KINDS (already mapped in Compose) enables nothing when unset. The kinds are notice.info, restart.prompt, restart.final, remote.consent, remote.session and elevation.request. Enable a kind only after this release's Breeze Assist build is published; the remote kinds need Breeze Assist 0.1.3 and elevation.request needs 0.1.4.
  • Network isolation is not available yet (#10088). Its migrations run, but nothing activates on upgrade: NETWORK_ISOLATION_ENABLED defaults to false, the agent version gate is the 999.0.0 placeholder, and the Windows agent pieces ship switched off. The device page's start action stays disabled.
  • Wisp stays Breeze Cloud only (BREEZE_WISP_ENABLED, default false).
  • Event-log collection (Windows): the first pass after the agent upgrade starts 15 minutes before the agent started; older events are not back-filled. Linux and macOS events collected around the agent upgrade can appear twice, once with the old id and once with the new one (#10702, #10779).

Agents. Agents, Breeze Assist and Breeze Viewer update to 0.126.0 through your normal update channel.

Agent-side changes in 0.126.0:

  • Windows event-log bookmarks, Security audit events, PowerChute and policy-listed providers (#10702, #10566, #10720);
  • unique Linux and macOS event ids (#10779);
  • PAM: declined elevations never applied, outcome notices, UAC prompt dismissal (#10420, #10395, #10786, #10369, #10825);
  • BitLocker probe gating, physical-disk health split, secedit password policy, winget retry (#10906, #10776, #10473, #10465);
  • macOS helper reload after update, YARA engine signing, locked-display wake, VideoToolbox warm-up, per-user state directory (#10873, #10881, #10876, #10882, #10872);
  • helper IPC resume, Assist crash-loop reporting, upgrade back-off (#10775, #10806, #10687);
  • sensitive-data scans of user profiles (#10461) and a backup S3 key prefix (#10815);
  • the on-device dialog cards, dormant until their kinds are enabled (#10190), and the legacy Windows restart box defaulting to Postpone (#10350);
  • network isolation components, built switched off (#10916, #10858, #10826).

Known gaps in this release

  • Live-agent checks not run before this release (the lab hardware was offline). These changes passed unit and build tests only:
    • the BitLocker probe gate on a real Windows host (#10906);
    • the sensitive-data scan of user profiles (#10461);
    • PAM outcome notices and declined-elevation handling on Windows (#10395, #10420);
    • IOC scan command timeouts and sweep scan results (#10517, #10435).
  • macOS upgrade in place: verified on Intel (macOS 15.8.1). The agent auto-updated from 0.125.0 with no permission prompt, the desktop helper came back within seconds, the existing Screen Recording grant was kept, and a YARA scan ran on the signed build (#10881, #10375). A remote session showed video, pointer and typed keys correctly. Not verified on Apple Silicon: the lab MacBook Air runs the hosted agent, which cannot be pointed at a test server.
  • ConnectWise Manage alert tickets were tested against a stub, not a live ConnectWise Manage tenant (#10830, #10861).
  • Vendor integrations without a live account in testing: NinjaOne SaaS Backup (Dropsuite), Pax8 orders, Emsisoft, UniFi Site Manager and the Microsoft 365 mailbox poll.

Known issues

  • Cmd can stay held on a Mac after a shortcut in a remote session (#9595). After the Viewer sends a shortcut such as Cmd+S, the Mac can keep Cmd pressed until the next key is typed, so a click acts as a Cmd-click. Press and release Cmd in the session to clear it. This is not new in this release; a fix is in review.
  • Some alert notifications can be skipped (#10926). In-app notifications, channel sends and escalations for rule-based, monitor and some job-generated alerts may not be sent. This predates this release (it is also in v0.125.0), and a fix is in progress.

What's Changed

New Contributors

Full Changelog: v0.125.0...v0.126.0

Check out latest releases or
releases around LanternOps/breeze v0.126.0

Don't miss a new breeze release

NewReleases is sending notifications on new releases.

Get notifications