BetterDesk 3.5.168 (stable)

Comprehensive stable update from 3.5.4 (~August 2026 → October 2026): ~380 commits from the Development branch (dev), including security fixes, UX 3.5, Generator / Support Agent, Docker/installers, OIDC/TOTP, relay, and Web Remote.

Tag: v3.5.168 · commit: 0b176a2f · PR: #454

Not included in this release: Dependabot #453 (Express 5 / bcrypt 6 / ejs 7 and other majors) — deferred to a dedicated migration; that PR’s CI fails (35 failed suites).

Security

CodeQL, paths, and SSRF

• Multer: upload cleanup only after reconstructing paths under tmpdir / dataDir (safe path segments) — closes path-injection alerts (#358/#361).
• Generator: local archive cleanup uses the same confined path.
• Support Generator (SSRF): GitHub fetches restricted to HTTPS and an allowlisted host set (api.github.com, github.com, objects.githubusercontent.com, release-assets.githubusercontent.com) via https.get({ hostname, path }).
• Local Client Builder: spawn limited to an allowlisted toolchain basename set (cargo, flutter, dpkg-deb, …).
• Public generic-agent download: rate-limited (fileAccessLimiter).
• scheduledBackupService / updateService / generator.routes: path-injection findings treated as false positives on admin-validated paths; filtered in CodeQL config and dismissed in the Security UI.
• After scan: 0 open CodeQL alerts on the security tip.

Auth / OIDC / JWT / CSP

• OIDC discovery: fixed data race (atomic retry interval + goroutine Close()) — green go test -race.
• OIDC: SSO-first login, role overrides, scoped private endpoints, discovery retry when the IdP comes up after API start.
• JWT (Go): requires aud / iss / nbf (betterdesk-server / betterdesk-api). Re-login required after upgrade (tokens without these claims are rejected).
• CSP: removed script-src-attr 'unsafe-inline' and default unsafe-eval on /remote (RdClient: static protobuf bundle); emergency rollback via CSP_RELAX_REMOTE=true.
• SQL: assertSafeSqlIdent for dynamic table names (stats / dump / restore).
• TOTP: management under Authentication settings; OTP verification on client paths.
• Security Test Suite v1.2.0 (npm run test:security / scripts/run-security-suite.*).

Dependencies (security — shipped)

• Node: axios ≥1.20, multer ≥2.4, overrides including brace-expansion, proxy-addr, tar, path-to-regexp (Express 4 line).
• Go: toolchain 1.26.9, golang.org/x/text v0.41.0 (govulncheck clean on called paths).
• Go pins in betterdesk.sh / betterdesk.ps1 / updateService.js aligned with go.mod.

UI and new features

Console (UX 3.5)

• UX 3.5 is the only supported console shell (classic shell / beta switch removed).
• Light/dark topbar, sticky Settings tabs, denser mobile chrome, Material icon a11y.
• Self-hosted Material Symbols (no Google Fonts CDN on the critical path).
• Help panel with supporters / links instead of guided tours.
• Onboarding: generator → QR/config → registration.
• Device tag editing; background devices-table refresh; drag-and-drop with auto-scroll.
• Client Branding for desktop remotes; custom product label on the public download portal.
• Registration notifications (badge + center) in UX 3.5.

Auth and accounts

• TOTP (2FA) for panel accounts.
• OIDC SSO-first login and role-mapping administration.
• Stock RustDesk outbound options: require initiator login, Admin/Operator-only, controller-only mode (opt-in under Settings → Connection).

Generator / agents / remote

• Generic agent releases + QR activation.
• Local Linux package formats in the builder; Support Agent (Wails UI, multi-codec, HTTP/WS profiles).
• RdClient: static protobuf under CSP; PunchHole/OFFLINE/connection-policy parity; Web Remote ↔ WebSocket Mode (TCP↔WS bridge on the relay).
• Guest access: scoped lifecycle.
• Attestation: configurable server badge labels.
• Desktop connection mode (normal / incoming-only) queued per device.
• Org credential vault (AES-GCM) for the address book.
• FPS modes in web sessions; gated RDP/VNC dependency updates.

Backup and operations

• Scheduled full-instance backups (retention, local / path / SMB, validation).
• Coordinated service restarts and login metadata in the console.
• Simplified appearance / branding; appearance profile duplication without overwriting the active profile.

Docker and installers

• Admin bootstrap / shared SQLite DB fixes for split Compose (#385).
• PUID/PGID, harder startup on bind mounts, connection strategy in split Docker.
• GHCR :dev / :latest kept in sync with the version tip (#387, #401).
• Native install: Go download diagnostics, IPv6 handling, module deadlines (#371).
• Installers: preflight, verification protocol, safer agent uninstall.

Bug fixes (selected, since 3.5.4)

Connections / relay / enrollment

• Shared-NAT / CGNAT punch and RelayResponse (#399); empty socket_addr → OFFLINE (#405).
• MASK/CIDR in LAN detection (#404); mixed TCP/WS transports.
• Enrollment: display name on approve; managed enrollment for viewer-only mobile (#375).
• Peer grants / strategy scope — grants persist and errors surface instead of silent no-ops (#380).
• Signal: peer-key hydration; transport retained after approve.

Docker / credentials / Node

• Admin password vs credentials-file mismatch; atomic bootstrap password.
• Stale auth.db after partial volume wipe.
• Console SIGABRT on Node 24 → production images pin Node 22.23.2 (#377).
• Missing Support Agent sources in generator images (#391).

UI

• Mobile: Devices taps (#410), sticky overlapping, Settings tabs (#396).
• Leftover /d/:slug pages hidden after generator migration (#412).
• Notification badge at zero; theme-toggle audit noise.

Other

• User save crash when assigning a strategy (#384).
• Config QR warnings for localhost / .local (#368).
• Registrations and badge in UX 3.5.

Dependencies (notable, in this release)

Verify / update

• Stable (main) channel → Settings → Updates (or betterdesk.sh / .ps1 / Docker update).
• After upgrading from JWTs issued before aud/iss/nbf: sign out and sign in again.
• Optional: npm run test:security / security suite on the console after deploy.

Thanks

Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow); muopc (@muopc)