github LanternOps/breeze v0.92.0
on GitHub

latest releases: v0.122.1, v0.122.0, v0.121.1-hotfix.2...
3 months ago

Breeze RMM v0.92.0 — a big quotes/deposits release: up-front deposit invoicing, a reworked quote editor, a fleet-wide vulnerability triage queue, permanent alert dismissal, and headless third-party (winget) patching.

Summary

  • Quotes — charge an up-front deposit at acceptance (a percentage, or the total of specific selected lines) and invoice the balance afterward, plus a substantial quote-editor UX overhaul with two-way markup pricing, line images, quote titles, and AI-styled catalog copy (#2245, #2227).
  • Vulnerabilities — the /vulnerabilities fleet page becomes a fix-first triage queue: findings grouped by remediation unit, clickable stat cards, and per-finding ticket linking (#2225).
  • Alerts — a new terminal dismissed status that makes an alert go away for good and is honored by the warranty-expiry evaluator, so the same condition is never re-alerted (#2226).
  • Patching — third-party (winget) patching now works on servers, logged-out, and headless machines via a SYSTEM-context machine-scope path, plus a wave of ring/scan/reboot correctness fixes (#2224, #2223, #2222, #2221, #2220).
  • MCP / AI — the Breeze MCP server is now self-describing (server instructions + five guided workflow prompts), and partner-owned ("all orgs") config policies are finally visible to AI/MCP tools (#2214, #2213).

Added

  • Quote deposits — charge a deposit up front at quote acceptance, computed as either a percentage of the quote or the total of specific selected lines, with the balance invoiced afterward (deposit-first invoicing). Percent deposits that round to zero cents are rejected; a per-category breakdown shows what the deposit covers (#2245)
  • Quote editor overhaul — two-way markup pricing on the add-line form (cost + markup → price, or price + cost → markup, whichever you typed last stays authoritative), visible labels on every field, auto-fill-from-web that also prices the line, line images, quote titles, moving lines between pricing panels, and AI-styled catalog copy per partner (#2227)
  • Vulnerabilities fleet triage UI — the read-only /vulnerabilities page becomes a work queue: findings grouped by remediation unit (one Chrome update is one row, not 30 identical CVE rows), four clickable stat cards (Critical open · KEV exposure · Patch ready · Accepted), fleet-level triage (previously per-device only), and linking a finding to a ticket (#2225)
  • Billing tab in org settings — the per-org tax identity + billing address page (previously reachable only by typing the URL) now has a proper Billing tab in the Organization settings nav (#2228)
  • MCP server instructions + guided prompts — the MCP server advertises instructions on initialize (tenant hierarchy, tool-selection strategy, safety guardrails) and a prompts capability with five argument-templated MSP workflows (fleet triage, etc.) so connecting clients (Claude, ChatGPT) are oriented automatically (#2214)

Improved

  • Permanent alert dismissal — a terminal dismissed status, distinct from resolved, valid from any status (including already-resolved). Dismissed alerts are hidden from list views by default and honored by the warranty-expiry evaluator, so a "make this go away for good" action actually sticks instead of the synthetic alert being re-created (#2226)
  • Compliance table reboot state — a stale "pending reboot" flag on an offline device is now qualified as stale instead of shown as an active pending-reboot (#2220)

Fixed

  • Headless third-party (winget) patching — third-party scanning and installs previously only worked when a user-helper session was connected, so servers, logged-out workstations, and headless boxes never scanned or patched. Winget now runs in SYSTEM context at machine scope with proper WindowsApps path resolution (#2224)
  • Patch-ring correctness — ring auto-approve now actually approves third-party patches (#2222); the ring patches endpoint reports correct per-source counts and derived OS (#2221); full-scan tombstoning is scoped to only the sources the scan actually covered, so a partial scan no longer tombstones patches from sources it didn't see (#2223)
  • Partner-owned config policies in AI/MCP tools — list_configuration_policies (and the other config-policy AI/MCP tools) filtered on the org axis only, so a partner-owned ("all orgs", org_id NULL) policy was invisible to a partner-scoped MCP caller. Now uses the shared dual-axis reader, matching the HTTP routes and web UI (#2213)
  • Passkey MFA metadata persistence — POST /auth/mfa/passkey/verify wrote the WebAuthn signature counter + last_used_at with a bare DB call that silently matched 0 rows under forced RLS (passkey MFA runs before the user is authenticated). "Last used" stayed "Never" and the signature counter never advanced; both now persist under a system DB context (#2211)

Security

  • Passkey signature counter — the WebAuthn authenticator signature counter now advances correctly (it was silently frozen), restoring clone/replay detection for passkey MFA (#2211).

Self-hosters are encouraged to upgrade.

Self-Hosting / Upgrade Notes

Upgrade. Bump BREEZE_VERSION to 0.92.0, then: 

docker compose pull api web && docker compose up -d

(If you build from source, run pnpm install first.)

Database — 7 migrations, idempotent, auto-apply on boot via autoMigrate (unless AUTO_MIGRATE=false). All are lightweight DDL — no table rewrites or large backfills, no long stall on boot:

  • Quote deposits: deposit_type/deposit_percent/deposit_amount on quotes, deposit_eligible/item_type on quote_lines, deposit_due on invoices, plus a follow-up CHECK-constraint migration (NOT NULL DEFAULT adds are metadata-only) (#2245),
  • Quote editor: nullable title on quotes, image_id FK + index on quote_lines, and catalog_ai_style on partners (#2227),
  • Vulnerabilities: nullable ticket_id + index on device_vulnerabilities (#2225),
  • Alerts: dismissed_at/dismissed_by columns on alerts plus a new dismissed enum value (added in its own transaction) (#2226).

No new required environment variables.

Behavior changes.

  • Alerts can now be permanently dismissed. Dismissed alerts are hidden from the default alert list and are no longer re-created by the warranty-expiry evaluator — this is the durable opt-out for recurring synthetic alerts. Nothing changes for existing alerts until a technician dismisses one (#2226).
  • Third-party (winget) patching now runs on headless/server/logged-out machines. Devices that previously never scanned for third-party patches (no user-helper session) will begin scanning and can be patched via the machine-scope SYSTEM path. If you rely on third-party patch approvals, expect these devices to start reporting findings after upgrade (#2224).

No breaking changes.

Full Changelog: v0.91.0...v0.92.0

What's Changed

Full Changelog: v0.91.0...v0.92.0

Check out latest releases or
releases around LanternOps/breeze v0.92.0

Don't miss a new breeze release

NewReleases is sending notifications on new releases.

Get notifications