UNITRONIX/BetterDesk v3.5.200

BetterDesk 3.5.200

on GitHub

BetterDesk 3.5.200 — Security Hardening Release

This stable release stays on the 3.5 product line and delivers the security audit fixes from #477.

Security fixes

• Fixed a high-impact device-scope authorization gap in agent proxy APIs. Scoped users can no longer query telemetry, clipboard, screenshots, files, or remote operations for devices outside their assigned groups.
• Restricted organization vault connect-password retrieval to users with device.connect; read-only viewers no longer receive unattended-access credentials.
• Enforced device.connect for authenticated panel sessions on /ws/relay, matching /ws/rendezvous authorization.
• Hardened the panel updater against untrusted GitHub redirects with HTTPS/host allowlisting and bounded redirect chains.
• Added regression coverage for device scope, vault RBAC, WebSocket RBAC, and updater redirects.

Dependency and supply-chain hardening

• Removed unused root Vitest tooling and its vulnerable tinypool/Vite dependency chain.
• Updated production console dependency floors, including qs and js-yaml; production npm audit is clean.
• Updated Go toolchain to 1.26.10 and golang.org/x/crypto to v0.55.0.
• Added root dependency auditing to CI and removed stale Dependabot paths for missing subprojects.
• Hardened Docker build/runtime layers, including verified build downloads and removal of unnecessary runtime npm tooling.

Verification

• Web Console CI: 134 test suites passed, 903 tests passed.
• Security suite: 47 tests passed.
• Go tests and govulncheck: passed.
• Docker/ZAP/Trivy audit completed; remaining Trivy findings are in the Alpine base image and are documented in the audit report.

Upgrade and rollback

This release is delivered through the normal BetterDesk update path. Before updating, keep the updater backup enabled. After update, verify:

1. Settings → Updates reports the stable main channel and version 3.5.200.
2. A viewer cannot retrieve a device connect password or open relay access.
3. A scoped operator receives 403 for devices outside their assigned groups.
4. The panel and Go server report the same version and remain healthy.

Related tracking issue: #477.