One of the largest releases to date. Three new product areas land — a native help desk (ticketing with SLAs, time tracking and billing), Privileged Access Management (just-in-time admin elevation + Windows UAC approval), and a Google Workspace / Microsoft 365 identity console — alongside a broad multi-tenant security pass, patch-management workflow changes, and agent reliability fixes.
Heads-up for self-hosters (no action required, but be aware)
- Not a breaking release, and no new required env vars. The new integration flags (
GOOGLE_WORKSPACE_ENABLED,M365_ENABLED,CF_ACCESS_TRUST_ENABLED,CF_ACCESS_TEAM_DOMAIN,CF_ACCESS_AUD,CF_ACCESS_TRUSTS_MFA) all default to off — set them only if you use those features. NODE_ENVis now canonicalized once at boot (#1164). Non-canonical values likeProduction,prod, orPRODpreviously failed the exact=== 'production'checks and silently ran with several production gates disabled (insecure-Redis warning suppressed, metrics scrape token off, API docs UI exposed, portal Redis backend off). They now correctly resolve toproduction. Confirm your deploy sets a cleanNODE_ENV=production— a previously-misconfigured instance will start enforcing production gates after upgrade.- Large schema migration set (auto-applied, idempotent): new tables for ticketing, PAM elevation/approval, passkeys, and
m365_connections/ Google Workspace identity. Standard upgrade applies them on boot. - OpenSSL CVE-2026-45447 is patched in the api/web container images (libcrypto3/libssl3 → 3.5.7-r0); rebuild/pull images to pick it up (#1237).
Added
- Native ticketing — full help desk. Core backend and technician UI (#1196, #1223), v1 closeout with PATCH audit trail, queue filters and bulk actions (#1227), customer portal settings + alert→ticket conversion + category reorder (#1251), and integrity hardening with site-axis scoping (#1238).
- Ticketing SLA engine (Phase 2). Response/resolution targets by priority, automatic pause-on-hold, breach monitoring, notifications, and time-remaining in the queue/detail views (#1250).
- Ticketing time tracking & billing (Phase 3). Timers and manual time logging against tickets, parts with cost/margin, weekly timesheet with approvals, and billable CSV export (#1276, #1285).
- Ticketing configuration. Custom statuses, per-priority SLA defaults, per-organization overrides and default hourly rates — backend and UI (#1287, #1291).
- Privileged Access Management. Backend control plane with admin REST API, decisioning, lifecycle jobs and elevation events (#1183); just-in-time dormant
~breeze_elevadmin-account lifecycle (#1248); Helper privileged-action governance (#1226); Windows UAC interception with approval routed to web/Helper/mobile (#1249, #1252, #1286); PAM admin UI with overview/requests/rules/audit tabs (#1229) and approver/denier display names + live audit refresh (#1236); AI "PAM Brain" elevation tools — request/revoke/history (#1246). - Identity console. Google Workspace + Microsoft 365 identity providers surfaced in Breeze, with Claude-assisted device-task dispatch (#1053).
- Passkey MFA. WebAuthn passkey registration/sign-in as a second factor, with Redis-backed challenge service (#1265).
- Cloudflare Access SSO. JWT trust + SSO redirect login (#1058).
- Vendor-neutral event-log forwarding. Ship event logs to your own logging endpoint via raw
_bulkfetch, no vendor lock-in (#1239). - EDR security events in the automation builder (#1270).
- Patch workflow. Approved-vs-pending-approval separation in compliance (#1266), policy-level auto-approve with per-app block/pin rules (#1275), and functional third-party patch source management (#1269).
- Devices & interface. Power-actions menu (reboot / safe-mode reboot / shut down / wake) (#1294); pending-reboot indicator (#1273) and real user-idle time (#1272); custom branded 404/500 pages (#1288); chip-bar device filter UI (#1013); app-wide display density (Comfortable/Compact/Dense) (#1060, #1295); 500-device page size (#1063).
- Users. Avatar upload stored as bytea in the DB (#1059, #1268); CLI onboarding token can enroll a batch with honest expiry (#1114).
- Partner-level admin IP allowlist (#1092).
Improved
- Process Manager CPU% now reports instantaneous usage via interval sampling instead of a lifetime average, so idle machines no longer look busy (#1289).
- Uncapped advanced-filter resolution, with the grid view now honoring active filters (#1195), and the global org-scope toggle honored on pages that previously ignored it (#1064).
- Software tab gates the Update action on real available updates (#1256).
- Default new sites to the partner's timezone; opaque modal headers (#1255).
- Refresh-token rotation leeway so a hard refresh no longer logs users out (#1113).
Fixed
- Remote desktop on macOS self-heals hardware video encoding after a software demotion stall instead of staying on the slower path (#1293).
- Linux remote terminal/scripts run with the access they need (systemd sandbox relaxed to root-SSH parity) (#1197); bash/python scripts get CRLF/CR normalized to LF before execution (#1185).
- Watchdog executes commands delivered in the initial failover heartbeat (#1192); Helper IPC roles bind to the active console session (#1242); Helper downgrade fails closed when the version is unreadable (#1224).
- SNMP discovery target selection and Network Discovery run feedback corrected (#1262, #1263); Huntress integration setup/sync fixed and made partner-scoped (#1264).
- Partner-scoped custom fields no longer fail RLS / 500 on "add custom field" (#1257).
- Sentry is actually initialized at startup — error tracking was previously dark (#1090).
- Org-scoped users no longer locked out by the IP-allowlist guard (#1144); proxy allowlist resolves org from
?orgId=for partner users (#1259). - Scripts soft-delete so deletion works once a script has run (#1235); Monaco editor self-hosted and kept styled across View-Transition nav (#1143, #1233); brand font self-hosted to survive CSP (#1234).
Security
- Multi-tenant isolation & authz review sweep — closed tenant-isolation, RBAC and audit gaps across the platform (#1290, #1278); site-scope enforced on automations (#1204),
PATCH /devices/:id(#1200), and AI enumeration tools (#1199). - Tamper-evident audit trail — deferred commit-time chain sealing stops concurrent-write forks without the prior deadlock (#1247); connection-level privilege separation for audit retention (#1241).
- Sign-in hardening — SSO login bound to the initiating browser (login-CSRF) (#1205); CF Access logout revocation + refresh-family binding (#1193); provisioning credentials delivered via short-lived one-time-fetch URL (#1244); unsuspend only restores suspension-disabled users (#1182).
- Breeze Helper installer verified against a signed manifest before install; device-scope + approval hardening (#1198, #1214).
- IPv6 trusted-proxy CIDR matching + partner settings allowlist hardening (#1194); allowlist-first launcher scheme guard (#1162).
NODE_ENVcanonicalized at boot so production gates aren't silently downgraded by a non-canonical value (#1164).- OpenSSL CVE-2026-45447 — libcrypto3/libssl3 patched to 3.5.7-r0 in api/web images (#1237).
Full Changelog: v0.69.0...v0.70.0