LanternOps/breeze v0.93.0 on GitHub

Breeze RMM v0.93.0 — encryption key escrow, a rebuilt vulnerabilities view, richer quoting, and one-step software packaging.

Summary

Security — Built-in BitLocker / FileVault recovery-key escrow: agents report disk-encryption recovery keys, encrypted at rest and access-audited (#2021).
Vulnerabilities — The device Vulnerabilities tab is rebuilt around a posture header and a software-grouped remediation list (#2272).
Software — One-step package creation, deploy-time installer-URL variables, and ready-to-deploy built-in EDR listings (#2260).
Quotes — Add a quote image straight from a URL, and a friendlier, non-blocking Polish-with-AI (#2264, #2265).
Reliability & agent — Event-loop hardening plus native remote-session consent and several agent fixes (#2266, #2254, #2263, #2273).

Added

BitLocker / FileVault recovery-key escrow — the agent reports disk-encryption recovery keys; they're stored encrypted at rest and viewable per-device on the Encryption page and the device Security tab. The encryption list gains a Key escrowed / Key missing filter and a Recovery Key column, plus Collect now / Rotate key actions. Key access is written to an audit trail (recovery_key_access_events). (#2021)
Quote image from a URL — paste an image link in a quote's Add-image panel and the server copies the bytes in (SSRF-guarded, magic-byte validated, 5 MB cap). It's a server-side copy, not a hotlink — the customer document never points at the third-party URL. (#2264)
One-step software packaging — create a package and its first deployable version in a single modal. Installer download URLs and silent-install args support deploy-time variables ({{org.name}}, {{site.name}}, {{device.hostname}}, and org/partner custom fields), resolved per organization at deploy time. Built-in EDR listings (Huntress / SentinelOne) now render as first-class products with a readiness panel and guided, preselected deploy. (#2260)

Improved

Device Vulnerabilities tab, rebuilt — instead of a flat, risk-sorted wall of near-identical CVE rows, the tab now leads with a posture header (open total, severity spread incl. unscored, KEV, patch-ready) and a software-grouped remediation list (one row per product/OS with a worst-severity badge and "Remediate all"), with the full CVE list available as a per-group drill-down. No finding data is lost — the CVE view is now an expand. (#2272)
Polish-with-AI is now advisory, not blocking — when the AI polish preview may have changed a number, unit, or code (e.g. a distributor part number), it shows an amber "double-check the details" banner and still lets you apply, instead of failing the request. Includes quote-editor polish. (#2265)
Native remote-session consent — the on-device consent prompt and in-session banner now render through the native helper without requiring the separate Assist app. (#2254)

Fixed

Decommissioned devices no longer resurrect through a live agent WebSocket connection. (#2230)
Reliability scoring event-loop hardening — projected-history reads, on-demand recompute throttling, and #1105-safe ingest DB context. (#2266)
UniFi collector now uses the correct /api/v1 prefix, so deep network telemetry no longer gets stuck on "pending". (#2263)
Agent IPC writes are bounded and the macOS user-helper is guarded against App Nap, preventing the "Connect Desktop greyed out" keepalive-eviction wedge. (#2273)
Software "Insert variable" picker now loads org/partner custom fields (previously 400'd on an out-of-range limit). (#2276)

Security

Recovery-key escrow stores BitLocker/FileVault keys encrypted at rest with an access audit trail (#2021).
Quote image-from-URL is fully SSRF-guarded — private/loopback/link-local/cloud-metadata ranges blocked, DNS-rebinding pinned, no redirects, content decided by magic bytes not the source's Content-Type (#2264).
Fixed a device-lifecycle isolation gap where a decommissioned device could be revived via a live agent socket (#2230).

Self-hosters are encouraged to upgrade.

Self-Hosting / Upgrade Notes

No breaking changes.

Upgrade command — bump BREEZE_VERSION to 0.93.0 in /opt/breeze/.env, then:
```
docker compose pull api web && docker compose up -d
```
(Add pnpm install if you build from source.)
Database — 1 migration (2026-07-06-device-recovery-keys.sql). It creates two new tables (device_recovery_keys, recovery_key_access_events) with indexes + RLS — no backfill, no large-table rewrite — and applies in milliseconds. It's idempotent and auto-applies on API boot via autoMigrate (unless you set AUTO_MIGRATE=false).
New required environment variables — none. Nothing new is required to boot.
Behavior changes & feature flags — no defaults changed. Built-in EDR listings render only under the existing build-time web flag PUBLIC_ENABLE_EDR_INTEGRATIONS (default off) — no change if you don't already use it. Recovery-key escrow surfaces automatically once agents begin reporting keys; nothing to enable.

Full Changelog: v0.92.0...v0.93.0

What's Changed

fix(api): stop decommissioned devices resurrecting via live agent WebSocket (#2230) by @ToddHebebrand in #2249
fix(agent): UniFi collector missing /api/v1 prefix leaves deep telemetry stuck on pending by @ToddHebebrand in #2263
chore(deps): bump google.golang.org/api from 0.286.0 to 0.287.0 in /agent by @dependabot[bot] in #2269
chore(deps): bump the aws-sdk group in /agent with 5 updates by @dependabot[bot] in #2267
chore(deps): bump the react-native-animation group with 2 updates by @dependabot[bot] in #2236
fix(deps): dedup broken pnpm-lock (hono duplicated by #2236 merge) by @ToddHebebrand in #2271
chore(deps): bump golang.org/x/text from 0.38.0 to 0.39.0 in /agent by @dependabot[bot] in #2268
chore(deps): bump @tailwindcss/vite from 4.3.1 to 4.3.2 in the tailwind group across 1 directory by @dependabot[bot] in #2239
feat: built-in BitLocker / FileVault recovery-key escrow (#2021) by @ToddHebebrand in #2258
chore(deps): bump the testing group across 1 directory with 2 updates by @dependabot[bot] in #2241
chore(deps): bump ioredis from 5.10.1 to 5.11.1 by @dependabot[bot] in #2243
chore(deps): bump the astro group across 1 directory with 4 updates by @dependabot[bot] in #2238
chore(deps): bump vitest from 4.1.9 to 4.1.10 in /e2e-tests by @dependabot[bot] in #2232
chore(deps): bump @react-navigation/native from 7.2.2 to 7.3.8 by @dependabot[bot] in #2244
docs: sync technical docs for v0.92.0 by @ToddHebebrand in #2259
fix(reliability): event-loop hardening — projected history read, on-demand recompute throttle, #1105 ingest context by @ToddHebebrand in #2266
feat(agent): native remote-session consent + banner without the Assist app (#2229) by @ToddHebebrand in #2254
feat(software): single-step package creation, installer URL variables, and ready-to-deploy EDR listings by @ToddHebebrand in #2260
feat(quotes): add a quote image from a URL (server-side copy, not hotlink) by @ToddHebebrand in #2264
fix(quotes): Polish-with-AI advisory fact-guard + editor polish by @ToddHebebrand in #2265
feat(vuln): device Vulnerabilities tab — posture header + software groups by @ToddHebebrand in #2272
fix(agent): bound ipc write + guard macOS helper from App Nap (#2273) by @ToddHebebrand in #2274
fix(software): custom-field variables never load — clamp picker fetch to limit=100 (#2276) by @ToddHebebrand in #2277

Full Changelog: v0.92.0...v0.93.0