github LanternOps/breeze v0.127.0
on GitHub

one hour ago

Breeze RMM v0.127.0: restore browsing for backup snapshots of any size, live backup progress with plain failure reasons, a new SLA performance report, partner-wide alert lifecycle defaults, and Breeze AI that runs patch plans, checks backups and manages organization settings with approvals. This release also fixes a bug that silently dropped most alert notifications, so read the first Summary bullet before you upgrade.

Summary

  • ⚠️ Alert notifications now go out for every alert. Monitor and system alerts that only appeared on the Alerts page will start sending in-app, email, SMS, webhook and escalation notifications after the upgrade. Review your routing first. See Fixed (#10944).
  • Restore browsing works on every backup snapshot on S3-compatible storage (#11156: #11175, #11216, #11239).
    • The Snapshot Browser and the selective-restore tree now work for snapshots of any size, including ones taken before this release. This was tested with snapshots of over a million files. Previously a snapshot with more than about 10,000 files showed an empty or partial file list.
    • New: search by name or path fragment. Restoring a folder now restores everything under its path, instead of expanding it to at most 10,000 files.
    • Breeze builds the file list from the snapshot the first time you browse it. While it works the page shows Preparing this snapshot's file list, and Try again appears if the build fails (needs backup:write). The misleading "per-file restore browsing is unavailable" job warning is gone.
  • See what your backups are doing (#11161: #11202, #11173, #11217; plus #11036).
    • The device page shows running and waiting backups with phase, progress, speed and time left, and a Backup running badge in the device header.
    • Failed, partial and cancelled jobs show a plain reason such as Device offline, Storage problem or Agent problem, with a hint and a link to the troubleshooting guide.
    • Each run shows how much it uploaded and how much it reused from earlier backups. A run that uploaded everything is marked Full, with the reason (first backup, changed destination or prefix, expired previous backup).
    • A scheduled backup on a device that is off at its scheduled time now waits for the device to come back, for up to 20 hours or until the next scheduled run, whichever comes first. It no longer fails with Agent not connected. If the device stays off, the job fails with Missed: device was offline for the whole catch-up window. Manual backups still fail immediately.
  • SLA performance report (#11165: #11176, #11218). It shows response and resolution times against SLA for one organization, by priority, with the breaches listed. You can schedule it, email it and export it. Ticket subjects are left out by default. A service plan can deliver it as evidence each period, and customers see it in the portal once you deliver that period. Excel download of a stored run is incomplete; see Known issues (#11277).
  • Set alert lifecycle defaults once (#10765: #10989, #10982, #11120).
    • Alerts → Monitors → Lifecycle defaults sets cooldown, auto-resolve and re-arm as a partner default with per-organization overrides. Any monitor can still override them. Re-arm is either on new evidence, or after N minutes once an alert has closed.
    • An open alert keeps the lifecycle it was raised with, even if you change the defaults later.
    • Event-log monitors can name the event that clears an alert, for example a UPS's "Power Restored" (Clears when).
  • Breeze AI can do more, with approvals (#6754: #11177, #11208, #11091, #11089, #11128; plus #11223, #11228).
    • Run an organization's patch plan, or start an AI task that gets a stopped service running again. Starting either takes one approval, and every install or change the run proposes needs its own approval.
    • Schedule AI agent runs, and run, preview, apply, undo and file Fleet Designs. Deleting a schedule, applying a design and undoing one each need a second approver. The assistant cannot turn on act mode.
    • Backup verification, VSS writer status, bare-metal recovery history, cloud-to-cloud backup configurations and backup health in chat, agents and MCP.
    • Read access to an organization's summary, account readiness, audit-log retention, portal logins, and Breeze users and roles. User and role changes stay in Settings.
    • Change an organization's customer portal settings and a scheduled report's email recipients. Turning on sensitive portal data (per-device patch and vulnerability detail, rack placement, the hours balance) needs two approvers.
    • When a partner technician asks the AI assistant to change a different organization from the one their session is open on, the approval request now goes to that organization's approvers.

Added

  • Axcient x360Recover joins Cove and Dropsuite as a backup provider: device status including paused, the last verified-bootable check, and per-provider connection forms. Device status is read-only, and nothing changes until a partner adds an Axcient connection (#11289, #11290).
  • Wake-on-LAN outcomes (#11048). Waking a device that is already online now returns TARGET_ONLINE and sends nothing, and a bulk wake reports how many devices it sent to and how many it skipped. Each wake is recorded and resolved within about 12 minutes as came_online, timed_out, send_failed or unknown. Wakes also target dock MAC addresses the device reported in the last 30 days.
  • Product number (HP product number, Lenovo and Dell machine codes) beside the serial number in Device Details, as an optional Devices column (also in the CSV export) and as a report field. Needs the 0.127.0 agent (#11041).
  • New folder in the device file browser (#11188).
  • Monitor this on Remote Tools → Services and Processes starts a service or process monitor pre-filled with that name (#11253).
  • tickets:email_review permission, so a custom role or service account can triage the inbound email Review queue without full admin rights. Existing admin roles are unaffected (#11254).
  • Microsoft 365 email-to-ticket now verifies external senders from Exchange Online's own DMARC result. It also accepts a trusted mail gateway's ARC seal when you list the gateway on the mailbox card. Previously all external mail was quarantined (#11000).
  • UniFi Wi-Fi telemetry on the Deep telemetry card: per access point online state and uptime, wireless clients, per-radio band, channel, width and retries, CPU and memory, uplink rates (#10269).
  • API groundwork, no UI yet: partner-level Service Catalog management routes (/service-catalog, #10942), and the ticket import framework (/ticket-imports routes and worker, #10890). No import source module ships yet, so there is nothing to run.
  • Wisp (Breeze Cloud only, BREEZE_WISP_ENABLED): check-ins Wisp schedules for itself, and a device-troubleshooting specialist with step-by-step approvals on its run card. Also a per-grant Unattended reads switch (off by default), an "I couldn't look yet" post with live first-look progress, and a plain Breeze AI chat beside an active Wisp grant (#10999, #11064, #11096, #11105, #11093, #11115, #11117, #11221, #11174, #11140, #11138, #11141, #11142, #11257).
  • Vendor updates (Dell, Surface, HP, Lenovo): groundwork, switched off. Server, scheduler and agent pieces for running the hardware vendor's own update tool. Every lane's gates are closed in code, and BREEZE_OEM_UPDATES_ENABLED defaults to false. See Behaviour changes and feature flags (#11065: #11090, #11126, #11127, #11171, #11183, #11185, #11186, #11200, #11227, #11240, #11241, #11256, #11273).
  • Network isolation and EDR: groundwork, dormant. Linux (nftables) and macOS (pf) isolation are built into the agent but inactive (#10987, #10990), along with Windows recovery trust (#11049, #11050). On the server: a configuration policy Containment tab for extra destinations an isolated device may reach (#11097, #11098, #11152) and a four-eyes AI release_containment tool (#10984). Bitdefender GravityZone is added as an EDR vendor and shows as Coming soon (#11112, #11125, #11095).

Improved

  • Rate limits: each signed-in user now has their own budget of 600 requests per minute (USER_RATE_LIMIT_PER_MINUTE), so technicians behind one office IP no longer throttle each other. The shared per-IP limit for everything else rises from 300 to 600 per minute. A page that is still rate-limited waits, retries once and says Please wait, instead of showing a permanent "Failed to load" (#11196, #10963, #11252).
  • Add Device shows the CLI token and installer link you generated earlier for a site while they are still valid, and drops a token that has been used up (#11114, #11151).
  • Organization branding: the logo and secondary colour set in Settings → Branding now appear in that customer's portal, quotes, invoices and report PDFs. Portals fall back to your partner logo and colours. The unused theme and portal-subdomain fields are gone (#11009).
  • Partner AI switch: Partner Settings → AI Budgets now has AI for all organizations (Not set / On / Off) in place of "Enable AI budget enforcement", and Off asks for confirmation. Before, clearing that checkbox turned AI off for every client. If AI is refused across your organizations, check this setting (#11006).
  • AI chat: on self-hosted OpenAI-compatible endpoints, Breeze shrinks the requested output to fit the model's context window, and gives a specific error when the prompt alone is too large (#11107). Loading tool definitions no longer counts against a conversation's turn limit (#11033).
  • AI script review: long reviewer summaries no longer fail the review, and an unreadable verdict is retried once. A person can run or save a proposal whose AI review failed; the override is audited (#10985, #10976).
  • PSA: re-driven alert tickets and Create anyway start right away instead of waiting for the next reconciler sweep (#11102).
  • Metric history maintenance retries a month it could not lock instead of giving up until the next night. A new MetricRollupCompactionStalled alert fires if a month falls a week behind (#11037).
  • MCP: tools/list no longer offers API-key connections the partner-wide tools they can never call (#11103). When the token issuer's key endpoint is down, MCP answers 503 instead of 401, so clients keep valid tokens (#11002).
  • Profile picture selection and saving are simpler and save with the rest of the profile (#10334).

Fixed

  • Alert notifications now go out for every alert (#10926, #10944). A timing bug since the alert pipeline rewrite meant most monitor and system alerts were created but their in-app, email/webhook and escalation notifications were silently dropped. After upgrading you will receive notifications for alerts you previously only saw on the Alerts page — review your notification channels and escalation steps if the volume is unexpected.
    • This covers rule, monitor and sourced alerts: patch jobs, maintenance reboots, policy and configuration compliance, backup, EDR, warranty, network monitors, script exit codes and others. Every channel type is affected: in-app, email, SMS, Slack, Teams, PagerDuty, Pushover, webhooks, and escalations.
    • SMS costs money, and on-call staff will be paged for alerts that were quiet before. Review notification routing, monitor delivery settings and escalation policies before or right after you upgrade.
    • There is no backlog burst. Only alerts raised after the upgrade send notifications.
  • Scheduled security scans run on schedule (#10474). Scheduled IOC (YARA) scans checked their schedule against the time the worker started, so in practice they did not run (since v0.116.0). Sensitive-data scan policies on an interval ran once per restart. Both now run at their configured times.
  • Backup agent: long resumes report progress and are no longer cancelled as stale (#11040). Resume checks carry over between jobs, so large resumes reach the upload (#11109). A torn last journal line no longer discards resume state (#11139), and a failed journal restart drops the journal cleanly (#11150). System-state collection has deadlines (#11205), and a queued job keeps its upload session past a lapsed lease (#11016).
  • Remote desktop: a viewer that loses its connection reconnects to the same session instead of retrying into "session ended" (#11110). A reconnecting session is no longer ended as stale (#11189). Reconnecting no longer restarts the session's maximum duration (#11147).
  • PAM: elevation requests now reach technicians' mobile approvals (#11230).
  • Errors: requests that meant to return a conflict or validation error (duplicate asset, install method, custom field, tenant mapping) no longer answer 500. The backup dashboard shows a degraded panel instead of failing. Agents no longer get a 500 when a best-effort write fails on heartbeat, event log, elevation or socket paths (#11224, #11230).
  • Wrong data from some list queries (#11054). The network device list shows real monitoring status, AI catalog search returns prices, backup auto-linking no longer stalls, and partner-wide ticket forms honour their organization allowlist.
  • DNS Security shows only the selected organization's events, integrations, policies and stats (#10981).
  • Devices: patch history is scoped to the device's current organization (#11088). The Devices list Serial column shows serials for agent devices (#10945). The breadcrumb always returns to the Devices list (#11001).
  • Partner dashboard shows real open-alert counts and compliance per customer instead of 0 alerts and 100 % (#11132).
  • Microsoft 365 mailbox: connecting a support mailbox no longer turns its existing mail into tickets. Only mail received after you connect does, and the card shows how many existing messages were left alone (#10983).
  • Portal: users of an inactive organization see "This portal is no longer active" at sign-in instead of being silently returned to the login page (#11032).
  • AI: patch-plan and fleet-design Run now return an error instead of reporting success when the run could not be queued (#11220). A cross-organization propose_script call explains that it must be split per organization (#11255).
  • Tool sources: a partial update no longer resets the rate limit to 120 (#10956).
  • Web: Performance Trend day labels west of UTC (#11003); the software policy tab stays open after create (#10966); paper cuts from the pre-release sweep (#11286).
  • Agent (Windows):
    • Breeze Assist waits for a signed-in user and never runs as SYSTEM, so machines with nobody signed in stop reporting a false crash loop (#11118). Assist no longer opens its window by itself at sign-in when its version cannot be read (#11029).
    • The local admin audit now recognises the built-in Administrator and Guest accounts, and whether they are enabled (#11055, #11100).
    • The Security Center query is skipped on Windows Server (#10969), Defender status uses a cached availability check (#10970), and seven periodic probes stop retrying tools that are not there (#10997).
    • A self-update that did not take effect is reported once with its reason and retried with back-off (#11047).
    • Physical-keys mode types punctuation correctly on AZERTY and other non-US layouts (#10905).
  • Agent (macOS): a user with no crontab is read as empty instead of an error (#10968).
  • Agent (Linux): firewall inventory reads the nftables or iptables ruleset when ufw and firewalld cannot answer (#11046).

Security

This release includes security hardening across:

  • AI approvals: an approval-class AI action is filed in the organization it changes, and a request naming an organization or record the technician cannot reach is refused (#11223, #11228);
  • network isolation, which is still inactive: remote desktop stays relay-only through every unresolved isolation state, isolation commands are delivered only when issued by the isolation service, and the upgrade floor during isolation checks the agent binary itself (#11008);
  • Breeze Assist per-session files: the agent refuses anything that is not a regular file (#11007), and the agent now writes each session's configuration through an exclusive temporary file and an atomic rename instead of writing in place (#11301);
  • permanent device deletion, which now needs a confirmed agent uninstall or an explicit override, so a device record is not removed by accident while its agent keeps running unseen (#11172);
  • DNS Security reads, scoped to the selected organization (#10981);
  • dependency advisories: klauspost/compress 1.20.2 in the agent for GO-2026-6865 (#11244), and the unmaintained pin-utils removed from the desktop app lockfiles (#11198).

Self-hosters are encouraged to upgrade.

Self-Hosting / Upgrade Notes

Upgrade command. Check how your install pins its images: grep '^BREEZE_API_IMAGE_REF=' .env.

  • Digest-pinned (the value ends in @sha256:…, which is every guided-setup.sh install from v0.112.0): fetch the current guided-setup.sh from main, then run bash guided-setup.sh --upgrade 0.127.0. It verifies the signed image inventory and updates BREEZE_VERSION and all four image digests together, then pulls and restarts.
  • Tag-form (the value ends in :${BREEZE_VERSION}): set BREEZE_VERSION=0.127.0, then run docker compose pull api web portal && docker compose up -d (and pnpm install if you build from source). If you run the optional worker container, pull and restart it too.
  • Do not edit only BREEZE_VERSION on a digest-pinned install. That re-pulls the images you already run.
  • If you roll services one at a time, update the API before the web container. A new web against the old API cannot create Wisp grants, gets no first-look state, and its New folder button returns 404 (#11142, #11221, #11188).
  • --upgrade does not change your docker-compose.yml. To pick up this release's new Compose mappings (listed under Environment variables), take the v0.127.0 docker-compose.yml / deploy/docker-compose.prod.yml, or add the lines to the api service's environment: block yourself. A value that is only in .env does not reach the container.
  • See the Upgrade Guide.

No breaking changes for an install on default settings. If you integrate with the API, check these before you upgrade:

  • DELETE /devices/:id/permanent on a device whose agent never confirmed the uninstall (failed, expired, cancelled or none queued) returns 409 UNINSTALL_NOT_CONFIRMED. Send { "force": true } to delete anyway. Bulk delete and the retention purge skip such devices and report them (#11172).
  • Invoice and autopay operations answer 404 BILLING_DISABLED for partners whose billing_enabled is false. Reads, PDFs, public pay links and recording a payment keep working. See Behaviour changes (#10282).
  • DELETE /c2c/configs/:id on a configuration with jobs or items returns 409 CONFIG_HAS_HISTORY instead of a 500 (#11091).
  • Monitor autoResolveConditions that could never resolve an alert, including a group with no logic, are refused (#11120).
  • POST /ai/patch-plan/runs and POST /ai/fleet-design/runs return 503 enqueue_failed instead of 202 when the run could not be queued (#11220).
  • Wake commands to an online device return TARGET_ONLINE (#11048). AI-initiated folder creation needs scripts:execute, matching the file browser (#11188).

Database.

  • 31 migrations. They are idempotent and apply automatically on first API boot via autoMigrate, unless AUTO_MIGRATE=false. Expect [auto-migrate] Applied 31 migration(s) from v0.126.0. None needs elevated privileges, and none drops or renames anything. No shipped migration was modified, renamed or removed.
  • Three migrations briefly lock a busy table. Each holds its lock for the length of one file. On installs with tables in the low tens of thousands of rows that is seconds, so expect a short stall of remote-session, backup-job and patch-inventory writes during the upgrade. If device_patches or remote_sessions has hundreds of thousands of rows, check sizes first (for example SELECT count(*) FROM device_patches;) and restart in a quiet hour.
    • 2027-01-22-200100-remote-sessions-last-start-attempt.sql (#11189) adds a column to remote_sessions, backfills every row and sets it NOT NULL, all under one table lock.
    • 2027-01-20-200000-backup-jobs-catch-up-until.sql (#11036) adds columns and builds a partial index on backup_jobs without CONCURRENTLY.
    • 2027-01-22-200300-device-patches-reported-update-type.sql (#11240) adds two nullable columns (metadata only) and validates two CHECK constraints with a full scan of device_patches.
  • Concurrent index builds: 2027-01-20-170100 and 2027-01-20-170200 build (org_id, lower(mac_address)) indexes on device_network and device_ip_history with CREATE INDEX CONCURRENTLY, outside a transaction (#11048). After the upgrade you can confirm both are valid: SELECT indexrelid::regclass, indisvalid FROM pg_index WHERE indexrelid::regclass::text IN ('device_network_org_mac_idx','device_ip_history_org_mac_idx');.
  • Backfills: existing monitors whose cooldown and auto-resolve were still at the old defaults (5 minutes, off) are switched to "inherit". The new partner defaults equal those old values, so alerting behaves the same until you change a default (#10989). Wisp thread summaries move into a new column (#11141). The tickets:email_review permission row is inserted, and no role gains it (#11254). Every file that writes rows elects system scope first.
  • New tables enable and force row-level security in the file that creates them: device_wake_status, device_wake_attempts, device_oem_update_status, wisp_check_ins and six ticket_import_* tables.
  • One-way enum additions: config_feature_type gains oem_updates, report_type gains ticket_sla_performance and external_backup_status gains paused. The two Axcient migrations (2027-01-22-205900, 2027-01-22-210000) are additive: one enum value and three nullable columns on backup_provider_devices, with no backfill.
  • Ownership. ALTER TYPE … ADD VALUE and the CREATE OR REPLACE of the wisp_grants update-guard trigger function need the migration role to own those objects. It does on a standard install.
  • Rollback. Take a backup, or note a PITR point, before you upgrade. Rolling back to v0.126.0 keeps the new schema, including the enum values and the monitor "inherit" backfill above. Rollback was not tested.

Environment variables.

  • Required: none. No new required environment variables.
  • New, optional (api service), mapped in both shipped Compose files:
    • USER_RATE_LIMIT_PER_MINUTE (600): per-user budget for signed-in dashboard traffic. The per-IP ceiling for valid sessions is ten times this value (#11196).
    • WAKE_ATTEMPT_RETENTION_DAYS (90), WAKE_ATTEMPT_RETENTION_BATCH_SIZE (1000), WAKE_ATTEMPT_RETENTION_MAX_BATCHES (100): nightly pruning of closed wake attempts (#11048).
    • TICKET_IMPORT_WORKER_CONCURRENCY, _GLOBAL_CONCURRENCY, _LEASE_MS, _SLICE_MS, _SOURCE_CONCURRENCY, _SOURCE_TIMEOUT_MS, _MAX_CLOCK_SKEW_MS, _MAX_ISSUES_PER_RUN, _MAX_TICKET_BYTES: ticket import worker tuning. Defaults are in .env.example. Nothing uses them until an import module ships (#10890).
    • BREEZE_OEM_UPDATES_ENABLED (false), BREEZE_OEM_UPDATES_PARTNER_ALLOWLIST (empty means all partners), BREEZE_OEM_UPDATES_DISABLED_LANES (kill switch: dell,surface,hp,lenovo; an unknown lane fails boot), OEM_UPDATES_MAX_DISPATCH_PER_TICK (200). Leave them unset. Vendor updates is not available yet (#11126, #11227, #11241).
    • BREEZE_OEM_UPDATES_LAB_DEVICE_IDS is lab-only and appears only in docker-compose.yml. The API refuses to boot with it set under NODE_ENV=production.
  • Newly mapped in Compose: ALERT_WORKER_CONCURRENCY, ALERT_WORKER_STAGGER_WINDOW_MS and AGENT_CONNECTIONS_MAX_PER_DEVICE. They were introduced in v0.126.0 but were not passed through Compose, so a value in .env had no effect. Empty keeps the built-in defaults (a quarter of DB_POOL_MAX; 50000 ms; 2000) (#10864, #11274).
  • Worker split only: the optional worker container now runs with a 1 GB Node heap (--max-old-space-size=1024). Override it with WORKER_NODE_OPTIONS, for example WORKER_NODE_OPTIONS=--max-old-space-size=2048. The api container is unchanged, including on the default BREEZE_ROLE=all install where it also runs the workers (#11250).
  • Redis 8 is the reference version (REDIS_IMAGE_REF=redis:8-alpine in .env.example; Redis 7 is no longer tested) (#11193). Your install keeps the Redis image it has until you change REDIS_IMAGE_REF. To switch: back up the Redis volume, let the job queues drain, set REDIS_IMAGE_REF to a reviewed Redis 8.x digest, then run docker compose up -d redis. This is one-way: Redis 7 may not read files written by Redis 8, so a rollback means restoring the volume backup.
  • Unchanged, worth checking: REDIS_MAXMEMORY (default 256mb, with noeviction). If Redis fills up, queue writes fail and API requests can be refused. Larger installs should raise it, for example to 1gb.

Behaviour changes and feature flags.

  • Alert notifications start sending (#10944). See Fixed. No migration and no new environment variable. A notification job that reads an alert row too early now logs PROCESS_ALERT_ROW_NOT_FOUND instead of returning silently.
  • Scheduled IOC and sensitive-data scans start running at their configured times (#10474). If you have scan policies with schedules, expect the scans and their agent load after the upgrade.
  • Billing is gated on partners.billing_enabled (#10282). An earlier migration set it to false for partners that neither use native service management nor have live billing (an active contract, an open invoice or an autopay enrolment). For those partners, creating, editing, issuing or sending invoices and setting up autopay now answer BILLING_DISABLED. Contract invoice generation retries without moving money. There is no settings toggle yet. Check with SELECT name, billing_enabled FROM partners;, and set it to true as the database owner for a partner that bills in Breeze.
  • Permanent delete asks for confirmation when the agent did not confirm its uninstall. Bulk and retention purges skip those devices (#11172).
  • Rate limits (#11196, #10963): the shared per-IP default rises to 600 per minute. Signed-in users get their own 600 per minute and a per-IP session ceiling of 6000. Agent WebSocket traffic gets its own per-IP bucket.
  • Missed scheduled backups catch up when the device reconnects (#11036). This is on by default and can be turned off per backup schedule (runMissedBackupsOnConnect).
  • Restore browsing memory and disk (#11175, #11216). Large snapshots (over 250,000 entries) get their file list built on first browse, not at backup time. The snapshot manifest is spooled to a manifest-spool folder beside PATCH_REPORT_STORAGE_PATH. Building the list for a very large snapshot raised process memory by about 110 MB under a 1 GB heap limit and about 410 MB at Node's default limit, in a 1.1-million-entry test. Storage cleanup and the reconcile job still skip manifests over 200 MiB. Snapshots on device-local destinations are unchanged, and whole-snapshot restore never depended on the file list.
  • Wake-on-LAN (#11048): a one-minute wake-attempt-sweep job resolves wake attempts, and a nightly job prunes closed ones after WAKE_ATTEMPT_RETENTION_DAYS.
  • Microsoft 365 mailboxes connected after the upgrade import only new mail. Microsoft's syncStateNotFound response now re-reads the mailbox instead of stopping it (#10983).
  • Windows admin audit: devices with the built-in Administrator or Guest account enabled will now raise a default_account finding once they run the 0.127.0 agent (#11055, #11100).
  • SLA performance in the portal (#11218). Existing organizations get the SLA performance portal definition when you apply a service plan template that uses it. To provision it for every organization at once, run pnpm --filter @breeze/api reports:reprovision-portal-definitions (dry run, then -- --apply) from a v0.127.0 source checkout against your database.
  • New metric and alert: breeze_metric_rollup_compaction_stalled_months and MetricRollupCompactionStalled (#11037).
  • Vendor updates is not available yet (#11065). BREEZE_OEM_UPDATES_ENABLED defaults to false, and every lane's gates stay closed in code even with the flag on. With the flag off, the Patches page hides the Vendor updates tab (#11273). The configuration policy editor still lists a Vendor updates feature tab, which has no effect.
  • Network isolation is still not available (#11008, #10987). NETWORK_ISOLATION_ENABLED stays false, and the Linux, macOS and Windows agent pieces ship switched off. The configuration policy Containment tab and the Bitdefender GravityZone Coming soon entry are visible but do nothing yet. New Linux installs get Delegate=yes on the agent's systemd unit. Existing Linux installs keep their unit until they are reinstalled, which is harmless while isolation is off (#10987).
  • Wisp stays Breeze Cloud only (BREEZE_WISP_ENABLED, default false).

Agents. Agents, Breeze Assist and Breeze Viewer update to 0.127.0 through your normal update channel.

Agent-side changes in 0.127.0:

  • backup resume and journal fixes, and system-state deadlines (#11040, #11109, #11139, #11150, #11205);
  • Breeze Assist launch waits for a signed-in user and never runs as SYSTEM; Assist stays hidden when its version cannot be read; per-session branding is persisted; non-regular session files are refused (#11118, #11029, #10792, #11007);
  • Windows built-in Administrator and Guest detection, Security Center skipped on Server, Defender and periodic probe gating (#11055, #11100, #10969, #10970, #10997);
  • self-update latch with back-off and a reason (#11047);
  • system product number (#11041);
  • Physical-keys typing by scancode (#10905);
  • remote session maximum duration measured from first connect (#11147);
  • Linux nftables/iptables firewall fallback (#11046) and macOS no-crontab handling (#10968);
  • klauspost/compress 1.20.2 (#11244);
  • vendor update lanes (Dell Command Update, Surface, HP) and network isolation (Linux, macOS, Windows recovery), all built switched off (#11090, #11127, #11185, #11186, #11200, #10987, #10990, #11049, #11050).

Tested on real hosts before the tag

We ran the signed v0.127.0 release candidate on lab machines.

  • Windows (Windows Server 2022): the agent updated itself from 0.126.0 on its own heartbeat about 70 seconds after the new version was promoted, and the agent, watchdog, user helper and backup helper were all replaced cleanly. Also verified there: a self-update that did not take effect is reported once with its reason (#11047); built-in Administrator and Guest detection, including the net localgroup fallback (#11055, #11100); the Security Center query is skipped on Server (#10969); Breeze Assist waits for a signed-in user and never runs as SYSTEM (#11118); a missed scheduled backup runs when the device comes back (#11036); New folder and Monitor this (#11188, #11253).
  • macOS upgrade in place, Intel (macOS 15.8.1) and Apple Silicon (macOS 15.7.7): both agents updated themselves from 0.126.0 with no new permission prompt. The existing Screen Recording and Accessibility grants were kept unchanged, the installer reloaded the desktop helper within seconds with no manual step, the helper reported screen capture as granted, remote desktop sessions connected, the wallpaper came back after each session, and YARA scans ran on the signed build. After the late helper change (#11301) both macOS checks were run a second time on the final signed candidate, from a fresh 0.126.0 install, with the same result; the new session-configuration write path was observed on both machines. Also verified on macOS: a user with no crontab (#10968), the application firewall state (#10997), a reconnect keeps the session's maximum duration (#11147), and the viewer reconnects to the same session after a dropped connection (#11110; tested Mac viewer to Mac agent).
  • Linux (Ubuntu 24.04): firewall inventory reads the nftables ruleset when ufw and firewalld cannot answer (#11046), and the periodic probes fall back when a tool is missing (#10997).
  • Checked only in part: a host without Defender (#10970), a system-state step that runs past its deadline (#11205), a failed journal restart (#11150), Breeze Assist with an unreadable version (#11029), a real Wake-on-LAN send (#11048), and product number on physical hardware (#11041). Breeze Assist branding is not sent by the server yet (#10792). The network isolation pieces report "not activated" on Windows, Linux and macOS, as intended.

Known gaps in this release

  • Apple Silicon was verified on a virtual machine only. The macOS upgrade-in-place check ran on a macOS 15.7.7 VM with SIP disabled; no physical Apple Silicon Mac and no second macOS version were tested.
  • Vendor updates on real OEM hardware: not verified. We had no hardware for these rows, and the feature is switched off by default: Dell Command Update (#11185, #11127, #11090), HP Image Assistant (#11200), and Surface with BitLocker (#11186). Do not turn on BREEZE_OEM_UPDATES_ENABLED.
  • AI behaviour against a live model. Everything up to the model call was verified. Wisp check-ins and specialist prompts, turn-budget accounting and the OpenAI-compatible context fit were not run against a live model (#11140, #11138, #11105, #11096, #11257, #11033, #10976, #11107, #11220).
  • Backup resume on S3 storage was not run on a device. Resume checks carried across jobs (#11109), resume checks reported as progress (#11040), a queued job keeping its upload session (#11016) and resuming past a torn journal line (#11139) need an HTTPS S3-compatible test endpoint we did not have. Their unit tests pass.
  • AZERTY Physical-keys typing in the viewer (#10905) was not re-run on the release candidate. Its PR records a lab pass on a French (AZERTY) Windows console.
  • Vendor integrations without a live account in testing: Axcient x360Recover (#11289, #11290), Bitdefender GravityZone (dormant), PSA alert-ticket wakes, Microsoft 365 ARC verification and backlog skip, UniFi Wi-Fi telemetry, and the Stripe side of the billing gate.

Known issues

  • SLA performance report: downloading a stored run as Excel gives a workbook without the breaches sheet, while the on-screen report and the PDF are complete; the fix lands in v0.127.1 (#11277).
  • Report PDFs: server-generated report PDFs (portal downloads and the PDFs attached to scheduled report deliveries) can fail with a server error on the packaged API image, which is also the case in v0.126.0; the fix lands in v0.127.1 (#11191).
  • Backup tab retention: saving a schedule on the configuration policy Backup tab can replace a custom retention that matches no preset in the UI (one set through the API or the AI tools) with the Standard preset, so check retention after you edit the schedule (#11278).
  • Self-hosted, BINARY_SOURCE=local only: when the official release manifest is staged, the backup component is re-signed with your deployment key, so agents enrolled before the server switched to local mode stop upgrading; the default GitHub binary source is unaffected, and the fix lands in v0.127.1 (#11297).
  • Self-hosted, BINARY_SOURCE=local only: with the signed release manifest in the binaries volume, Breeze Assist updates are refused with release_manifest_asset_lookup_failed while the agent, watchdog and user helper update normally; Breeze Cloud is unaffected, and the fix lands in v0.127.1 (#11298).
  • Mac remote sessions: after the first Shift press in a remote session on a Mac, Shift can stay held for the rest of the session until you end it; this is not new in this release, and a fix is in review (#9595).

Full Changelog: v0.126.0...v0.127.0

What's Changed

Full Changelog: v0.126.0...v0.127.0

Check out latest releases or
releases around LanternOps/breeze v0.127.0

Don't miss a new breeze release

NewReleases is sending notifications on new releases.

Get notifications