Security
-
Installations upgraded from an early version could still be signing logins with a publicly known key. Versions before 1.16.4 shipped a placeholder signing key that anyone can read in the source, and it was meant to be replaced by setting
JWT_SECRET. Installations that never did kept using the placeholder, and knowing it is enough to enter the manager as an administrator without a password, without a valid account and without passing two-factor. A real random key is now generated for those installations on the next start. Everyone will have to log in again once after this update — that is expected, and it is the whole point: any session or token created under the old key stops working. Nothing else changes, and stored device passwords are untouched. If you setJWT_SECRETyourself, or your installation was created on 1.16.4 or later, you were never affected and nothing changes for you. -
"Refresh All" on the Dashboard contacted every device in the installation, not just yours. For a user restricted to specific sites, the button reached out to devices at sites they have no access to — it did not show anything about them, but it did open connections to them and put load on them. It now refreshes only the devices you may see. Unrestricted users keep the fleet-wide behaviour they have today. This affects only installations that use per-site restrictions.