Changelog
- a54d96c [proxy] Make the upstream HTTP version configurable (#7410)
- 2d28f90 [client] Fix the Windows tray deadlock on re-entrant window creation (#7449)
- 0f797f8 [client] Bump wireguard-go to 8bf8fa968f1a (#7532)
- 7914010 [management] Prevent deleting groups referenced by agent network budget rules (#7450)
- 973173b [misc] Pull the MinIO test image from quay.io (#7516)
- 82b1c7d [management] Harden OIDC issuer validation and discovery (#7435)
- b789ffb [management] Expire unvalidated custom domain registrations (#7497)
- ec0c36b [client] Add light mode with system, light, and dark theme options (#7344)
- f422c41 [management] extract peer update logic and wrap it in tests (#7338)
- 794956a [client] Fix relay instance address race (#7498)
- 58114f9 [management] Only trust forwarded-IP headers from configured trusted peers (#7454)
- b57f0e5 [infrastructure] Preserve snapshot image variant tags (#7511)
- ad3f570 [management] validate the domain for the flock in proxy (#7501)
- 1047df5 [management] pass tls config for combined server (#7499)
- add8a75 [management] validate peer existence when adding to group (#7486)
- a419e77 [client, proxy] Make the buffer-pool retune reachable while a device is stalled (#7452)
- 2f48dbe [client] Add a release-wired rootless UBI image variant (#7469)
- e704203 [management] do not hard-code tmp dir path in ws_conn_adapter_test (#7503)
- 0fac1ee [management] cleanup resources when ws-grpc proxy connection goes away (#7484)
- 9615d2a [client] Report the remote jobs key in the MDM UI snapshot (#7485)
- 15a6842 [client] Support arbitrary UIDs in rootless image (#7440)
- 21b4a83 [management] Refuse services on unvalidated custom domains (#7341)
- 27991aa [management] Let embedding binaries extend the command tree (#7483)
- 269cbad [management] expire and disconnect peers while including offline peers (#7467)
- d101f6c [client] Redirect DNS port 53 with UDP and TCP DNAT instead of the eBPF forwarder (#7439)
- d2e62e3 [client] Compare MDM-managed URLs as endpoints, not as strings (#7472)
- bb4de1d [client] Read MDM boolean keys delivered as JSON numbers (#7471)
- 7a62d63 [management] fix delete of owner user (#7456)
- e14006d [client] mobile MDM bridge — iOS + Android setMDMPolicyFetcher entrypoint (#6435)
- 15c0a29 [client] Return the context error when the SSH handshake fails with it (#7426)
- 76ea722 [management] Add Agent Network managed proxy to the API spec (#7433)
- 0000381 [management] update network_router_test to verify empty and nil peer_groups (#7425)
- 5cb6b0d [client] Assign the Android TUN address as a host prefix (#7414)
- 8253898 [client] Gather fresh system info on every management sync stream connect (#7409)
- 0bdfa42 [management] blocking sync requests for user peers sharing the same wireguard key (#7427)
- 066af82 [management] Keep embedded IdP deployments on a single account (#7380)
- 13ab50b [management] Add SetNX and GetDel cache store operations (#7084)
- c455a4a [management] disallow weird ip addresses for direct upstream hosts (#7400)
- 8dc4272 [management] Serve networks with peer-based routers from the SQLite network map (#7418)
- c2b5d21 [management] Enforce reverse proxy group access before minting and when honouring a session cookie (#7240)
- 798e4a0 [misc] Skip the protobuf breaking check on branch-creation pushes (#7411)