Use allowlisted hostname literals with https.get options instead of a
full URL string so request-forgery analysis sees a fixed host.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow); muopc (@muopc)
Store OIDC discovery retry interval atomically and Close() background
goroutines so TestDiscoveryRetryAfterFailure is race-free. Bump toolchain
to go1.26.9 and golang.org/x/text to v0.41.0 (govulncheck clean). Confine
multer unlink paths; harden guest session ID entropy; stop interpolating
device IDs into console format strings; expand CodeQL query filters for
validated/admin-only paths.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow); muopc (@muopc)
Make guard-sqlite-auth-split self-contained via _guard_file_exists so
orphan auth.db detection works when the script is sourced alone (unit
tests) while still preferring file_exists_as_betterdesk under entrypoints.
Align bootstrap credential tests with #385 (generate/export shared
password; publish ADMIN_PASSWORD to .admin_credentials).
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow); muopc (@muopc)
Track protos-static.js and public/protos/bundle.json so fresh installs and
panel updates get BetterDeskProtos without a local pbjs build. Remove the
.gitignore exclusions added with Phase 0-3 remediation.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow); muopc (@muopc)
Move personal TOTP management into Authentication, fix locale metadata, and add validated scheduled full-instance backups with local and mounted network destinations.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow); muopc (@muopc)
Restore the original vertical Settings navigation bleed above the mobile-shell breakpoint and add a desktop contract regression check.\n\nRefs #396\n\nThanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow); muopc (@muopc)
Normalize empty Address Book responses for RustDesk 1.5.0, use the live WSS correlation address for relay advertisements, and add OIDC/proxy and login UI regression coverage.\n\nRefs #449, #415, #443, #396\n\nThanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow); muopc (@muopc)
Add configurable SSO-first login with local recovery paths and allow administrators to manage OIDC roles without losing manual overrides when no group mapping matches. Keep explicit OIDC group mappings authoritative and preserve LDAP provider-managed roles.
Refs #443
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Adds local verification and distribution of signed generic incoming-only agent releases, mobile-friendly QR activation, and the supporting generator interfaces. Includes the current staged console, documentation, localization, and builder changes.\n\nThanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Document the #437 startup regression fix and assert that all Docker entrypoints load shared helpers before path checks or the SQLite guard.
Refs #437
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Expose split-Docker mode before saving NTP settings so the console skips the native restart confirmation and reports hot-reload success. Preserve the native restart flow, add route/UI regression coverage, and localize the new success message across all console locales.
Refs #431
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Keep pending managed devices attached to their live signal transport while still blocking sessions until operator approval. Add signal readiness reporting, immediate device-list refresh, and regression coverage for issue #442.
Refs #442
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Add existing-tag shortcuts, custom tag creation, removal, and persistence to the Device Details modal. Keep the open detail panel synchronized after edits.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Bring the latest development version bump together with the local Linux package builder expansion.\n\nThanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Build local Linux clients once and package them as portable archives, Debian packages, RPMs, or Arch packages when the host toolchain supports the format. Keep artifact manifests and validation format-aware.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Delegate generation staging and promotion through the legacy database facade so embedded local builds can promote completed artifacts. Extend facade parity coverage to prevent the regression.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Resolve embedded artifacts from the validated manifest, expose only targets supported by the local toolchain, and keep per-target failures isolated. Update generator APIs, UI, documentation, and regression coverage.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Integrate the latest development version baseline before publishing the remote gateway changes.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
github-actions[bot]