Restrict GET /api/ab peers/tags to device-group scope and migrate upgraded
SQLite users tables off the pre-Phase-52 role CHECK so console sync works.
Refs #342.
Move Docker/CI/installers to Node 24 and Go 1.26 images, bump Alpine server runtime, apply safe npm/Go patch updates, migrate SNMP to pysnmp, and document deferred majors.
Replace the hardcoded 40-char MeshID placeholder with a persisted per-group SHA-384 id so MeshAgent no longer fails with bad size on panel-downloaded .msh files.
Bring stable signal outbound gate hardening (initiator_pending_enrollment),
Web Remote SignedId verify, and open-issue hotfixes onto dev while keeping
the 3.4.13 development version baseline.
MeshAgent behind TLS-terminating proxies was rejected with bad web cert hash when Go hashed TLS_CERT incorrectly (raw PEM) or used an internal cert instead of the public LE cert agents see.
- Transitioned to solid surfaces in UX 3.5, disabling glass/blur effects for improved performance.
- Enhanced sidebar resizing with pointer capture and requestAnimationFrame for smoother interactions.
- Fixed sidebar font jumping in Settings/Updates and reduced theme toggle lag for immediate application.
- Updated documentation to reflect changes in UX 3.5 behavior and styling adjustments.
- Implemented pointer capture and requestAnimationFrame for smoother sidebar resizing.
- Disabled glass blur during drag-resize to enhance performance.
- Updated sidebar and drawer overlay styles for better visibility and interaction.
- Improved documentation to reflect changes in sidebar behavior and performance optimizations.
Accept PunchHole/RequestRelay from PANEL_SIGNAL_PROXY_CIDRS (default loopback) so panel-proxied Web Remote works again without weakening #302. Also default Docker AIO NTP/billing env vars (#299).
Refs #302
- Default console shell is now the classic icon rail + flyout, with UX 3.5 available via navbar switch.
- Fixed visibility issues in UX 3.5, ensuring main content is displayed correctly under branding wallpaper.
- Updated documentation to reflect changes in UI shell options and theme management.
- Enhanced language support for new UI shell switch options across multiple languages.
This update improves user experience by providing a choice between classic and modern UI shells.
- Adjusted z-index properties for the console shell and main content to ensure visibility over the branding wallpaper.
- Updated CSS to maintain proper stacking context, preventing text from being obscured by the wallpaper.
- Enhanced documentation to clarify changes related to stacking and branding wallpaper behavior.
This update addresses user feedback regarding visibility issues in the UX 3.5 interface.
- Fixed light theme to correctly apply the blue topbar and ensure text colors are consistent with the selected theme.
- Updated theme management to persist the selected theme and its corresponding palette across sessions.
- Enhanced documentation to clarify theme color mappings and behavior.
- Introduced built-in theme palettes for light and dark modes to streamline theme application.
- Improved CSS variable handling for better theme integration in the UI.
This update addresses user feedback regarding theme inconsistencies and improves overall theme functionality.
- Added UX 3.5 as the default console shell, featuring a full-list sidebar, topbar, and customizable themes (Dark/Light/Custom).
- Updated documentation to reflect the new UX 3.5 shell.
- Removed legacy Desktop Mode and Beta 3.1 styles, ensuring a streamlined user experience.
- Enhanced language support for new theme options across multiple languages.
- Fixed OIDC client login issues by proxying callback URLs to the Go API.
This update improves the overall user interface and experience, aligning with modern design standards.
Panel Redirect URLs on :5000/:5443 used to 404, so auth-query never completed. Proxy the callback to Go, validate the path in Settings, and document the fix.
Sync install.sh image pin with VERSION, fix split DB_PATH/SQLITE_READONLY, resolve AIO container for password reset, and write bootstrap files as betterdesk under cap_drop.
Require a live registered initiator on PunchHole/RequestRelay, and an approved DB peer in managed/locked modes, so pending enrollment cannot bypass quarantine. Refs #302
Require TRUSTED_PROXIES before honoring X-Forwarded headers, and deliver async PunchHole/RelayResponse via ip:port wsPunchConns so shared-NAT peers do not get the wrong signed PK.
Store PUBLIC_* on the console-data volume so panel settings survive compose recreate; keep Compose env override and .env mirror for IaC and bare-metal.
Copy panel password hashes into missing Go users on SQLite dual-DB so RustDesk client login matches the console; clarify LDAP sub-tab discoverability and provider-bound hints.
Ephemeral WebSocket RequestRelay sessions were getting an immediate empty binary frame after HTTP 101, which desktop clients parse as RendezvousMessage{union:None} and disconnect before RelayResponse.
Temporary opaque links give guests a minimal Web Remote UI for selected devices only, without Console inventory or add-any-ID paths. Also fix mesh_share desktop tunnel auth for unauthenticated guests.
Default C:\BetterDeskConsole installs no longer treat C:\ as the project root, so installer file writes and SHA tracking succeed; NSSM Access Denied on server restart is non-critical.
After Keycloak/IdP callback on the Go API port, the browser now lands on the
Node panel session endpoint instead of hitting Go auth middleware. Adds Panel
URL setting, return-url preservation, login error UX, and docs.
Node no longer pre-emptively falls back to :5443 when systemd grants bind capability. Repair HTTPS/TLS syncs PORT=80 with HTTPS_PORT=443; installer health checks and post-toggle tests surface fallback-port mismatches.
Revert [Unreleased] release draft and LDAP-AD wording that implied a committed
stable 3.4 timeline. LDAP desktop login remains on the development channel only
until the operator schedules a main release.
Refs #260
- Updated .gitignore to include new binary paths and retain .gitkeep.
- Modified Gitleaks configuration to ignore additional directories.
- Adjusted CI workflows to prevent execution on version bump pushes and improved version bump handling in scripts.
- Bumped BetterDesk Console Manager version to 3.3.136 in betterdesk.sh and related scripts.
- Removed outdated binary files for Windows and Linux from the binaries directory.
- Added a new documentation file for GitHub Actions CI troubleshooting, outlining common failures and local commands to mirror branch protection checks.
Commit web-nodejs lockfile with tar override; CI uses npm ci and moderate npm audit.
Add LOG_LEVEL filtering and log redaction in Node console and Go server.
Validate WS tokens on bd-signal; require single-use token for remote-agent relay.
Limit active relay sessions per IP and block open enrollment without TLS.
Maintain user-facing wiki pages in docs/wiki/ with updated BetterDesk URLs,
AGPL licensing, RBAC/org coverage, and eight new operator guides. Add sync
scripts and point docker helper TLS docs to the BetterDesk wiki.
Help operators reach the panel at https://domain without :5443 via installer prompts, docs, and cleaner HTTP redirects, and align fresh-install self-signed cert permissions with the #219 deploy flow.
- Updated `SERVER_MIGRATION.md` with detailed steps for operators performing manual or out-of-order migrations, including verification of server keys, database migration checks, and client configuration refresh.
- Added a new section in `CHANGELOG.md` to document this update.
- Conducted an audit against upstream RustDesk tag 1.4.8, confirming no breaking changes to the wire format.
- Implemented various fixes including client version string, supported encoding handshake, and multi-session handling.
- Updated language files for Arabic, Czech, Danish, German, English, and Spanish to reflect new UI elements and messages.
- Enhanced clipboard and file transfer functionalities to match upstream behavior.
- Added support for an official all-in-one Docker image (`ghcr.io/unitronix/betterdesk`) as the default installation method.
- Updated installation scripts and documentation to reflect the new single container layout.
- Retained legacy two-container layout option for backward compatibility.
- Adjusted API port from `21114` to `21121` for the new layout.
- Enhanced Docker-related scripts and configuration files to support the new structure.
- Updated various language files to ensure consistency in messaging regarding Docker deployment.
Add folder/direct-device/strategy assignment from User Management, clearer Pro vs Remote Operator labeling, optional restricted device scope mode, and Go/Node scope parity.
Send modifiers and nav keys as Map scancodes (not mixed Legacy controlKey),
restore Auto/Windows hybrid for symbols, and add protobuf regression tests.
UNITRONIX