A patch release. It clears the upgrade crash loop some installs hit on the way to v2.1.0, makes failed sign-ins visible in the log, stops antivirus quietly breaking Windows agent installs, and gives internal mail relays that offer no TLS a working configuration.
Upgrading
docker compose pull
docker compose up -dNothing in your docker-compose.yml changes and there are no new settings.
Two exceptions, both below: a stuck migration 42, and single sign-on with Authentik or Microsoft Entra ID. If neither applies, the two commands above are all there is to do.
If your server has been crash-looping since v2.1.0
You will see cannot set path in scalar (22023) and migration 42 marked dirty. It affects installs whose host_down alert config stored its metadata as the JSON value null. Nothing was left half applied.
Recovery, in this order:
1. Upgrade to v2.1.1 first. The fix has to be in place, or migration 42 fails again on the next boot.
2. Rewind the marker. The server will still be crash-looping, which is fine, the database container is up:
docker compose exec database psql -U patchmon_user -d patchmon_dbUPDATE schema_migrations SET version = 41, dirty = false;Then docker compose restart server. Adjust the service name and credentials if you changed them from the stock compose file.
Full recovery guide: Server Troubleshooting.
If you use single sign-on
This one arrived in v2.1.0, not v2.1.1, It can stop SSO login working entirely, so it is worth reading before you upgrade from v2.0.x.
When PatchMon has to identify you by email address rather than by an identity it has already stored, it now requires your provider to confirm that the address is verified. Otherwise anyone who can set their own email address at your provider could sign in as an existing PatchMon user. It applies when linking to an existing account and when creating one on first login, and stops applying once an account is linked.
If your provider does not send that confirmation you get "Unable to sign in with this account", and the server log shows oidc login rejected: unverified email claim.
| Provider | Affected |
|---|---|
| Authentik | Yes. Its default email scope mapping always reports the address as unverified. Replace the mapping |
| Microsoft Entra ID | Yes. It does not send the claim at all |
| Keycloak, Okta, Google Workspace | No, no change needed |
Step-by-step instructions for both providers: The verified email requirement.
Thanks to the people on #1048 who worked out the Authentik fix and posted it before we had documented any of it.
What else changed
Sign-in
- Failed sign-ins are now logged. Previously a stock install recorded nothing at all when a login was rejected, so you could not tell a wrong password from a mistyped username, or see that anyone was trying.
- Guessing a username that does not exist now counts toward the account lockout. Previously only a real username could reach a
429, and that difference confirmed which accounts existed.
Windows agent
- Installs no longer die with
Access is deniedwhen antivirus holds the freshly downloaded binary. The installer waits for the scan, clears the download marker, and if it still fails it prints how to fix it instead of a stack trace. Troubleshooting on Windows
- Relays that require authentication but offer no TLS now have a working configuration, as an explicit per-destination opt-in. It sends your credentials in the clear, so only enable it on a network you control. Enabling STARTTLS on the relay, even with your own internal CA, remains the better answer. Notification Destinations
Under the hood
- A dirty migration now prints the exact recovery SQL instead of leaving you to work it out.
- Built with Go 1.26.6, closing seven Go standard library vulnerabilities.
Documentation
- A complete plain-manifest Kubernetes deployment path alongside the Helm chart, for Argo CD, Flux and k3s. Includes the PostgreSQL volume mistake that silently empties your database on every redeploy. Installing PatchMon on Kubernetes
- Windows troubleshooting for the access-denied install failure.
- A "Failed Login Attempts in the Log" section, and a rewritten Account Lockout section.
- Removed an instruction to run migrations with
docker compose run --rm --entrypoint migrate server up. Nomigratebinary exists in the image, so that could never have worked.
Every change in this release
Changes since v2.1.0.
| Issue | PR | Change |
|---|---|---|
| #1042 | #1045 | Migration 42 aborted on installs storing host_down alert metadata as JSON null, wedging the upgrade to v2.1.0. The down migration had the same fault
|
| #1042 | #1045 | A dirty migration now names the database and prints the exact recovery SQL, with a separate variant for version 1 |
| #1043 | #1051 | Failed sign-ins were not logged at all. Each rejection now writes one warn line with the reason, client IP, user agent, and username where known |
| #1043 | #1051 | Unknown usernames, disabled accounts and SSO-only accounts now all consume a lockout attempt and lock on the same one, so the responses no longer differ |
| #1043 | #1051 | The lockout counter treated admin and Admin as separate accounts while the user lookup did not, granting a fresh allowance of guesses per spelling
|
| #1043 | #1051 | A lookup failing because the database is unreachable is now logged at error and does not consume a lockout attempt |
| #1043 | #1051 | An oversized username is rejected before the lookup, and the lockout key no longer embeds the submitted username |
| #1049 | #1051 | The Windows installer died with Access is denied and a stack trace when antivirus held the new binary, leaving a half-installed machine and no explanation
|
| #817 | #1047 | Relays requiring SMTP AUTH with no TLS had no working configuration. A per-destination opt-in now permits it, off by default and inert in the TLS modes |
| #1048 | #1052 | Documented the verified email requirement for SSO, with provider-specific fixes for Authentik and Entra ID |
| - | #1051 | Built with Go 1.26.6 instead of 1.26.5, closing seven Go standard library vulnerabilities |
| - | #1051 | Plain-manifest Kubernetes deployment path added to the operator guide |
| - | #1051 | Unreleased migrations 000041 to 000046 renamed from v2-0-3 to v2-1-0. Renames only, no change to sequence numbers, SQL or applied state
|
What is coming next
Bug fixes are tracked in GitHub milestones. Each milestone lists the issues targeted at that release, so you can follow anything you have reported through to the version it lands in.
Feature requests live on feedback.patchmon.net, where you can propose an idea, vote on existing ones, and see what has been accepted onto the roadmap.
Questions about this release
This release has its own discussion thread, filed under New Release Discussions. If something is unclear or an upgrade step has not gone to plan, check there first. Open a new issue for a reproducible bug not already covered.