VPN and Zero Trust Release Notes

Latest VPN and Zero Trust Updates

• Nov 10, 2026

  • Date parsed from source:
    Nov 10, 2026
  • First seen by Releasebot:
    Nov 11, 2026
  

  NetBird

  v0.82.1

  NetBird releases an update focused on safer, more reliable SSH access, with improved authorization and connection handling, plus fixes to network traffic filtering, peer cleanup, proxy account validation, and ACME certificate renewal.

  What's Changed

  • [misc] Don't move latest for a patch on an older release line (backport #8215, #8466 to 0.82) by @bison in #8467
  • [client] Refuse SSH JWT auth when the client changes the user name between auth requests on one connection (#8389) by @lixmal in #8482
  • [client] Start ConPty SSH shells with bInheritHandles=FALSE so they no longer inherit the daemon's os/exec pipes of other users' sessions (#8391) by @lixmal in #8483
  • [client] Close SSH connections still in the handshake on Stop and reject ones accepted by a stopped server (#8392) by @lixmal in #8484
  • [client] Treat 0.0.0.0 and :: as local in the userspace firewall (#8432) by @lixmal in #8485
  • [client] Close established SSH connections whose JWT user is no longer authorized when UpdateSSHAuth applies a new authorization list (#8393) by @lixmal in #8486
  • [client] Start the SSH server's SFTP subprocess through su like session commands, so nologin and expired accounts are refused (#8394) by @lixmal in #8487
  • [client] Remove a peer from the interface when it leaves the network map while its lazy connection is idle (#8449) by @lixmal in #8488
  • [client] Default the SSH server to off for stored configs without a peer key (#8448) by @lixmal in #8489
  • [client] Drop forwarded traffic that would leave through the interface it arrived on (#8440) by @lixmal in #8490
  • [client] Match peer rule protocols behind IPv6 extension headers in nftables (#8451) by @lixmal in #8491
  • [management] Enforce account id on proxy update (#8419), backport to 0.82 by @dmitri-netbird in #8519
  • [proxy] Renew cached ACME certificates and report expiry (#8524) by @jnfrati in #8531
  • [client] Use a destination Windows refuses in the UDP dial error test (#8480) by @lixmal in #8494

  Full Changelog: v0.82.0...v0.82.1

  Original source

  Show more
• Nov 10, 2026

  • Date parsed from source:
    Nov 10, 2026
  • First seen by Releasebot:
    Nov 11, 2026
  

  Cloudflare One by Cloudflare

  Cloudflare One Client - Cloudflare One Client for Windows (version 2026.9.2663.1)

  Cloudflare One releases a new Windows client beta with automatic Global Acceleration endpoint selection, stronger uninstall protection, and a unified diagnostics page. It also improves tunnel connectivity, network troubleshooting, performance, and reliability while fixing numerous installer, UI, and security issues.

  A new Beta release for the Windows Cloudflare One Client is now available on the beta releases downloads page.

  This release includes the following highlights:

  • Added automatic endpoint selection for Global Acceleration. When Global Acceleration is enabled for an organization, the client connects to the Global Acceleration endpoints while the device is in the acceleration region and to the standard anycast endpoints otherwise, and reconnects when a network change moves the device between them without requiring action from the user. The Connectivity page shows which tunnel and API endpoints are in use, and users who are allowed to override the selection can choose endpoints in Settings.
  • Added protection against unauthorized modification or uninstallation of the Cloudflare One Client. When enabled, the user will be asked to provide an administrator-generated code when trying to uninstall the client, which will otherwise be blocked. Users, including administrators, also can no longer stop the client service, and attempts to authorize an uninstall with a code or token, whether accepted or rejected, are reported to Cloudflare.
  • Added a Diagnostics page to the client that shows the connection status and health, live tunnel and device metrics, network details and the results of DEX tests in one place. Users can run a speed test from the page that compares performance inside and outside the tunnel while the client is connected. The Troubleshooting tools button collects a full warp-diag bundle, or runs a captive portal test that briefly reconnects Wi-Fi, and saves the result to the Desktop, so users no longer need to run warp-diag from a terminal.
  • The client now shows a banner when the network limits the tunnel MTU to a degraded or critically low value. The banner clears when the MTU recovers or the client disconnects.

  Additional changes and improvements

  • The client now applies tunnel MTUs between 1147 and 1199 bytes measured by Path MTU Discovery. Previously the client ignored these values and kept a larger MTU, which could drop larger packets on networks such as mobile hotspots while the client showed as connected.
  • When Path MTU Discovery is enabled, the client now accepts larger packets from Cloudflare instead of limiting them to the size it uses for its own outbound packets.
  • When Path MTU Discovery measures an IPv6 path MTU below 1280 bytes, the client now reconnects over IPv4 and keeps preferring IPv4 until the network changes. Previously the client could stay on a smaller tunnel MTU over IPv6 on networks where IPv4 supports larger packets.
  • Access reauthentication requests now trust certificates in the operating system's certificate store, so reauthentication works on networks that perform TLS inspection.
  • For Zero Trust deployments, the client now records a traceroute of the network path outside the tunnel when the tunnel degrades or fails to connect. warp-diag includes the same trace.
  • warp-diag now includes redacted copies of the deployed MDM files and the names, but not the values, of stored registration secrets. It reports a QUIC path MTU only when one was measured.
  • Added the MDM parameters mdm_file_debounce_secs (1–60) and mdm_file_unavailable_debounce_secs (0–300), which set how long the client waits before applying a changed MDM file and before acting on a missing or unreadable one.
  • Added the MDM parameters managed_network_probe_interval_secs (30–300, default 30) and managed_network_probe_count (0 disables probing, 1–10, or -1 to keep probing until a managed network is found; default 1). After a registration or network change finds no managed network, the client now rechecks, so a device doesn't stay on the default profile because of a transient connection failure. Set the count to 0 to keep the previous behavior.
  • Added the multicast network policy and MDM setting (allow or drop, default drop). When set to allow, the client sends traffic for multicast addresses through the tunnel instead of dropping it, for networks that use multicast ranges for other traffic.
  • In proxy mode for Zero Trust, the client now sends hostnames from HTTP/HTTPS and SOCKS5 requests to Cloudflare for resolution instead of resolving them on the device.
  • The Connectivity page now shows the IPv4 and IPv6 addresses assigned to the tunnel while the client is connected.
  • When the app cannot reach the client service, the home screen now says why (service not running, not accepting connections, not responding, or connection dropped and reconnecting). It shows an error code and a Learn more link instead of "IPC error".
  • The client now shows a notification when an administrator removes the user's selected virtual network, and shows a specific message when the user selects a virtual network that is no longer available.
  • The consumer client home screen now shows when the connection is post-quantum encrypted.
  • warp-cli target list now accepts --hostname to filter targets by one or more comma-separated hostnames.
  • DEX HTTP tests now send a default User-Agent that identifies the Cloudflare One Client when the test does not configure one.
  • Reduced CPU usage by the Windows Capability Access Manager service (camsvc) caused by the client's Wi-Fi queries.
  • Reduced the client UI's memory usage.
  • The client UI no longer starts WMIC or PowerShell processes to collect memory information for crash reports.
  • Fixed installs failing with error 1603 on devices with Windows App Control (WDAC) policies, because some files inside the installer's custom actions were not signed. All components of the installer are now signed.
  • Fixed the installer asking the user to close running applications during an upgrade, downgrade or uninstall because other programs loaded the client's Visual C++ runtime libraries through the system PATH. The client now loads these libraries from a private folder so that closing other applications is unnecessary.
  • Fixed reinstalling the same version of the client from its MSI removing the updater service, which stopped the client from updating.
  • Fixed the client window appearing blank or white after an upgrade, at sign-in, after waking from sleep, or after a display change.
  • Fixed the client UI freezing and no longer showing status updates after the device woke from sleep.
  • Fixed the client UI looking for one of its libraries in a directory that standard users can create before looking in the installation directory.
  • Fixed a local user being able to crash the client service by sending a crafted query to the local DNS resolver.
  • Fixed the client service restarting when a firewall update for captive portal detection stalled while the device was asleep.
  • Fixed the client service leaking handles to processes after they exited, which could leave those processes listed as running.
  • Fixed the client getting stuck in a disconnected state on Windows on Arm devices because leftover tunnel adapters were not removed.
  • Fixed Windows resetting the Wi-Fi adapter after sign-in or a Wi-Fi restart when the client's firewall rules in Exclude split tunnel mode blocked Windows network connectivity checks. The client now allows those checks.
  • Fixed the client missing some network configuration changes after the first change was detected.
  • Fixed the client being unable to connect after an upgrade, downgrade, and upgrade that switched between consumer and Zero Trust registrations. The client now clears the mismatched registration so the user can register again.
  • Fixed the client continuing to use the previous tunnel protocol after a key rotation for a protocol change failed. The client now retries the rotation the next time it connects.
  • Fixed service token enrollment failing when it ran shortly after the service token was created. The client now retries while the new token becomes available.
  • Fixed the client reconnecting repeatedly when Global Acceleration automatic endpoint selection was enabled on devices in the acceleration region, and fixed the client keeping its previous data center after the selected endpoints changed.
  • Fixed a hostname-based split tunnel entry not taking effect until the next reconnect after its firewall rule failed to apply.
  • Fixed the client service failing to start when a split tunnel address in mdm.xml had no prefix length. A bare IP address is now treated as a single host.
  • Fixed a single malformed element in mdm.xml causing the client to ignore the whole file. warp-diag now includes the file as written.
  • Fixed warp-cli dns fallback add accepting an empty domain, which sent all DNS queries to the local resolver instead of Gateway. Fallback domain and split tunnel entries are now normalized, so removing an entry matches regardless of case or a trailing dot.
  • Fixed the DNS proxy caching answers for longer than the TTL of a CNAME record in the chain.
  • Fixed warp-cli registration license reporting an error on slow networks even though the license was applied, which left the client registered to a WARP+ account it did not recognize.
  • Fixed warp-cli debug network showing an all-zero interface GUID.
  • Fixed Digital Experience Monitoring (DEX) results being reported with timestamps offset from the actual time after the system clock was corrected.

  Known issues

  • A Windows DNS client regression may cause connectivity check failures on systems containing large hosts files. While our client includes a mitigation for this issue, users may still experience reduced DNS performance and connectivity check failures.
  • After an administrator removes a virtual network from a device profile or changes its default network, the virtual network list in the client may continue to show the previous networks until the client is restarted. This is a display issue only: the device connects to the networks its profile allows, and selecting a removed network is rejected without changing the connection. The warp-cli vnet command shows the current list. This will be addressed prior to the next GA release.

  Original source

  Show more
• All of your release notes in one feed

  Join Releasebot and get updates from NetBird and hundreds of other software products.

  Create account

  Get updates with: RSS Email CLI MCP API Slack n8n
• Nov 10, 2026

  • Date parsed from source:
    Nov 10, 2026
  • First seen by Releasebot:
    Nov 11, 2026
  

  Cloudflare One by Cloudflare

  Cloudflare One Client - Cloudflare One Client for macOS (version 2026.9.2663.1)

  Cloudflare One releases a macOS client beta with automatic Global Acceleration endpoint selection, a unified diagnostics page, and improved network and tunnel reliability. The update also adds troubleshooting tools and clearer connection status while expanding configuration options for managed deployments.

  A new Beta release for the macOS Cloudflare One Client is now available on the beta releases downloads page.

  This release includes the following highlights:

  • macOS 15.0 is now the minimum supported version. This release does not run on macOS 14.
  • Added automatic endpoint selection for Global Acceleration. When Global Acceleration is enabled for an organization, the client connects to the Global Acceleration endpoints while the device is in the acceleration region and to the standard anycast endpoints otherwise, and reconnects when a network change moves the device between them without requiring action from the user. The Connectivity page shows which tunnel and API endpoints are in use, and users who are allowed to override the selection can choose endpoints in Settings.
  • Added a Diagnostics page to the client that shows the connection status and health, live tunnel and device metrics, network details and the results of DEX tests in one place. Users can run a speed test from the page that compares performance inside and outside the tunnel while the client is connected. The Troubleshooting tools button collects a full warp-diag bundle, or runs a captive portal test that briefly reconnects Wi-Fi, and saves the result to the Desktop, so users no longer need to run warp-diag from a terminal.
  • The client now shows a banner when the network limits the tunnel MTU to a degraded or critically low value. The banner clears when the MTU recovers or the client disconnects.

  Additional changes and improvements

  • The client now applies tunnel MTUs between 1147 and 1199 bytes measured by Path MTU Discovery. Previously the client ignored these values and kept a larger MTU, which could drop larger packets on networks such as mobile hotspots while the client showed as connected.
  • When Path MTU Discovery is enabled, the client now accepts larger packets from Cloudflare instead of limiting them to the size it uses for its own outbound packets.
  • When Path MTU Discovery measures an IPv6 path MTU below 1280 bytes, the client now reconnects over IPv4 and keeps preferring IPv4 until the network changes. Previously the client could stay on a smaller tunnel MTU over IPv6 on networks where IPv4 supports larger packets.
  • Access reauthentication requests now trust certificates in the operating system's certificate store, so reauthentication works on networks that perform TLS inspection.
  • For Zero Trust deployments, the client now records a traceroute of the network path outside the tunnel when the tunnel degrades or fails to connect. warp-diag includes the same trace.
  • warp-diag now includes redacted copies of the deployed MDM files and reports a QUIC path MTU only when one was measured.
  • Added the MDM parameters managed_network_probe_interval_secs (30–300, default 30) and managed_network_probe_count (0 disables probing, 1–10, or -1 to keep probing until a managed network is found; default 1). After a registration or network change finds no managed network, the client now rechecks, so a device doesn't stay on the default profile because of a transient connection failure. Set the count to 0 to keep the previous behavior.
  • Added the multicast network policy and MDM setting (allow or drop, default drop). When set to allow, the client sends traffic for multicast addresses through the tunnel instead of dropping it, for networks that use multicast ranges for other traffic.
  • In proxy mode for Zero Trust, the client now sends hostnames from HTTP/HTTPS and SOCKS5 requests to Cloudflare for resolution, instead of resolving them on the device.
  • The Connectivity page now shows the IPv4 and IPv6 addresses assigned to the tunnel while the client is connected.
  • When the app cannot reach the client service, the home screen now says why (service not running, not accepting connections, not responding, or connection dropped and reconnecting). It shows an error code and a Learn more link instead of "IPC error".
  • The client now shows a notification when an administrator removes the user's selected virtual network, and shows a specific message when the user selects a virtual network that is no longer available.
  • The consumer client home screen now shows when the connection is post-quantum encrypted.
  • warp-cli target list now accepts --hostname to filter targets by one or more comma-separated hostnames.
  • DEX HTTP tests now send a default User-Agent that identifies the Cloudflare One Client when the test does not configure one.
  • The client's background services now start only when their binaries are signed by Cloudflare, so replacing the application bundle cannot run other code with the services' privileges.
  • Reduced the client UI's memory usage on the home screen.
  • Fixed a managed registration being removed when the MDM configuration file was briefly missing or unreadable. The client now keeps the last applied policy for 20 seconds after the file becomes unavailable. The new MDM parameters mdm_file_debounce_secs (1–60) and mdm_file_unavailable_debounce_secs (0–300) change how long the client waits before applying a changed file and before acting on a missing one.
  • Fixed an upgrade sometimes leaving the client without a running service when the previous service was slow to stop. The installer now waits up to 10 seconds for the old service to be removed before starting the new one.
  • Fixed the client UI not showing onboarding on first launch while a notification permission request was pending.
  • Fixed the client UI crashing when the Mac woke from sleep or a display configuration changed.
  • Fixed the client UI freezing and no longer showing status updates after the Mac woke from sleep.
  • Fixed DNS queries failing for a short time after the Mac woke from sleep. The client now replaces stale connections to the DNS resolver during its wake connectivity check.
  • Fixed the client continuing to use the previous tunnel protocol after a key rotation for a protocol change failed. The client now retries the rotation the next time it connects.
  • Fixed service token enrollment failing when it ran shortly after the service token was created. The client now retries while the new token becomes available.
  • Fixed the client reconnecting repeatedly when Global Acceleration automatic endpoint selection was enabled on devices in the acceleration region, and fixed the client keeping its previous data center after the selected endpoints changed.
  • Fixed a hostname-based split tunnel entry not taking effect until the next reconnect after its firewall rule failed to apply.
  • Fixed split tunnel updates for hostname-based entries failing when the client tried to remove a route that macOS had not installed.
  • Fixed warp-cli dns fallback add accepting an empty domain, which sent all DNS queries to the local resolver instead of Gateway. Fallback domain and split tunnel entries are now normalized, so removing an entry matches regardless of case or a trailing dot.
  • Fixed the DNS proxy caching answers for longer than the TTL of a CNAME record in the chain.
  • Fixed warp-cli registration license reporting an error on slow networks even though the license was applied, which left the client registered to a WARP+ account it did not recognize.
  • Fixed Digital Experience Monitoring (DEX) results being reported with timestamps offset from the actual time after the system clock was corrected.
  • Fixed the OS version detail stored for a device keeping an outdated value, including the text "Usage: sw_vers…" reported by client versions 2023.5.587.1 through 2024.12.760.0. The client now clears the value the next time it connects.

  Known issues

  • After an administrator removes a virtual network from a device profile or changes its default network, the virtual network list in the client may continue to show the previous networks until the client is restarted. This is a display issue only: the device connects to the networks its profile allows, and selecting a removed network is rejected without changing the connection. The warp-cli vnet command shows the current list. This will be addressed prior to the next GA release.

  Original source

  Show more
• Nov 10, 2026

  • Date parsed from source:
    Nov 10, 2026
  • First seen by Releasebot:
    Nov 11, 2026
  

  Tailscale

  Tailscale v1.104.6

  Tailscale fixes dormant connection and Windows standby issues, improves macOS network extension handling, and resolves DNS problems during network transitions.

  All Platforms

  Fixed: A rare connectivity issue that affected dormant connections has been resolved.

  Windows

  Fixed: A connectivity issue that occurred when resuming from Modern Standby on devices without Always On or Unattended mode enabled is resolved.

  macOS

  Fixed: Error handling has been improved when multiple network extensions are present.

  Fixed: An issue where MagicDNS could select a suffix-scoped DNS resolver during network transitions has been resolved.

  Fixed: A DNS configuration race condition that could occur during network transitions has been resolved.

  Original source

  Show more
• Nov 10, 2026

  • Date parsed from source:
    Nov 10, 2026
  • First seen by Releasebot:
    Nov 11, 2026
  

  Tailscale

  Share skills across users, teams, and agents with Aperture

  Tailscale updates Aperture with shared skill creation, importing, and organization-wide distribution over MCP, helping teams keep AI workflows aligned across users and agents.

  Giving an AI agent skills is a great way to take token-hungry, non-deterministic workflows and turn them into faster, cheaper, reproducible tasks. However, these skills are typically attached to individual users and specific agents. This isolation makes it difficult for co-workers and companies to quickly and safely share AI best practices and align on process improvements. Without a way to easily share skills, valuable knowledge ends up fragmented, out of date, or lost.

  This is why we’re updating Aperture to serve as a single place to create, organize, and share skills across your team or organization. Today, keeping skills synchronized across different people or agents involves a lot of copying and pasting. It’s the AI equivalent of pinning down that Q4REPORT_FINAL_V2_NEW_20261110.XLSX spreadsheet buried in a 100-message thread. With the speed at which AI moves, it’s not tenable to keep in sync this way.

  Importing and creating skills in Aperture

  Aperture serves as both a repository for individual user skills to use across agents, and for organization-level skills to share across teams. Whether you’re a user or admin, if you have existing skills to bring into Aperture, you can import them in four ways.

  • Upload your skills — The most straightforward way of adding existing skills to Aperture: upload the SKILL.md, .zip file, or paste the Markdown.
  • Sync a GitHub repo — If you already have a bundle of skills in a public repository, paste the link and Aperture will import them.
  • Use a URL — If you’d like to bring in skills from a third party (like stripe.com) and they support the .well-known skill discovery specification, give Aperture the URL and it presents you with a list of skills to import.
  • Ask your agent — If you add Aperture as an MCP server to your agent, you can ask your agent to add any existing skills to Aperture through MCP.

  You can also create skills in Aperture itself: select Add from the Skills menu, or use the pre-built Skill Creator skill inside Aperture. The Skill Creator skill uses new MCP tools added to the Aperture MCP gateway, so you can ask any agent connected to Aperture’s MCP endpoint (or Aperture Chat) to create, update, and delete your skills.

  Aperture exposes MCP endpoints that list and read all of your LLM sessions, no matter which agent created them. That means you can improve a skill across all of your agents. Use a skill, have another agent review your sessions with that skill, then ask for improvements — with all the progress retained across all your agents, through Aperture.

  Distributing skills over MCP

  To make distributing your constantly evolving skills easier, we’ve implemented the brand-new Skills over MCP spec in Aperture. Aperture delivers identity-based access to LLMs, MCP servers, and skills across your organization’s AI deployments.

  Using Skills over MCP with Aperture, two things are now possible:

  • An individual can distribute skills across their agents or computers.
  • Aperture admins can decide which skills are shared with individuals or teams based on their identity.

  Not every agent supports the Skills extension yet. As agents add support, Aperture works with them automatically.

  Building toward safe, collaborative AI

  In many ways, learning and working with AI is often an individual (or even lonely) experience. It’s time we made it easier to share what we learn with others (humans, specifically). A seamless skill-sharing experience is one small step in that direction. We intend to take many more.

  If you’re exploring what simple, secure, collaborative AI enablement looks like at your organization, we’d love for you to give Aperture a try and reach out with any feedback.

  Original source

  Show more
• Nov 9, 2026

  • Date parsed from source:
    Nov 9, 2026
  • First seen by Releasebot:
    Nov 11, 2026
  

  Proton VPN for Android by Proton

  Version 5.21.57.0: November 9, 2026

  Proton VPN for Android improves sign-in security against tapjacking and adds QR code purchasing for Android TVs without Google Play.

  • Improved security on the sign-in on another device screen to prevent tapjacking attacks (new window)
  • Introduced a QR code option for purchasing Proton VPN on Android TVs without Google Play support

  Original source
• Nov 9, 2026

  • Date parsed from source:
    Nov 9, 2026
  • First seen by Releasebot:
    Nov 11, 2026
  

  Tailscale

  Grok Bot has a Tailscale integration—and now you can, too

  Tailscale releases OAuth apps for general availability, letting AI agents securely connect to private tailnet resources without exposing them to the public internet. Agents act under the authorizing user’s identity, with access governed by tailnet policies and optional device posture controls.

  Your AI agent can help you get work done, but some of the most useful tools and data it could work with are locked away on your private network, for good reason. You shouldn’t have to expose your internal infrastructure to the public internet just to make it accessible to an AI agent.

  Tailscale OAuth apps, now generally available, provide that connection between a user’s Tailscale network (tailnet) and agents through a standard OAuth 2.0 authorization flow. Unlike Tailscale’s existing OAuth clients, which create tag-owned devices under a shared service identity, OAuth apps act on behalf of the user who authorizes them. Devices provisioned this way carry the user’s identity, so tailnet access policies, audit logs, and device quotas all still apply, just like for any other device you own.

  This flow is already in production: Grok Bot can use OAuth apps to connect to private Model Context Protocol servers on your tailnet, without exposing them to the public internet. You stay in control of what it can access, and you’re not pasting keys or secrets anywhere.

  Give your agent access, without giving it access to everything

  When you connect Grok Bot to Tailscale, it joins your tailnet as a device associated with your user identity. Like any other device on your tailnet, Grook Bot follows your tailnet policy controls.

  You might want Grok Bot to access an internal MCP server, but not everything else your laptop can reach. With Tailscale’s device posture checks, you can do exactly that.

  When you add Grok Bot to a tailnet on our Premium or Enterprise plan, it will have a custom posture attribute that you can use in your tailnet policy to control which resources it can access, separately from your other devices. On other plans, you can achieve similar control by assigning a tag to Grok Bot’s device after authentication and using tag-based access rules instead of combining user identity with device posture.

  For example, this policy lets members of your engineering team access production databases from their regular devices, while Grok Bots associated with those engineers’ identities can access only designated MCP servers:

  {
    "postures": {
      "posture:grokbot": ["custom:grokbot == true"],
      "posture:human": ["custom:grokbot NOT SET"]
    },
  
    // All access rules require posture:human unless otherwise specified
    "defaultSrcPosture": ["posture:human"],
  
    "grants": [
      {
        // Engineers can access production databases. The defaultSrcPosture applies here.
        "src": ["group:engineering"],
        "dst": ["tag:production-db"],
        "ip": ["tcp:5432"]
      },
      {
        // Grok Bots owned by engineers can access MCP servers.
        "src": ["group:engineering"],
        "srcPosture": ["posture:grokbot"],
        "dst": ["tag:mcp-servers"],
        "ip": ["tcp:443"]
      }
    ]
  }
  

  The defaultSrcPosture ensures that existing access rules don’t apply to Grok Bot devices. The explicit srcPosture on the second grant makes an exception, allowing Grok Bot to reach MCP servers without inheriting the user’s broader network access.

  Custom posture attributes are available on Tailscale Premium and Enterprise plans.

  Get started

  Connect Grok Bot to your tailnet using the Tailscale plugin in the Grok Bot desktop app.

  Interested in building your own integration? Start with the OAuth Apps documentation and device provisioning guide.

  Original source

  Show more
• Nov 9, 2026

  • Date parsed from source:
    Nov 9, 2026
  • First seen by Releasebot:
    Nov 10, 2026
  

  NetBird

  v0.83.0-rc.1

  NetBird ships a broad update with an MCP server and OAuth 2.1 broker, improved iOS networking and WireGuard stats, and fixes across SSH security, proxy behavior, and self-hosted configuration. The release also strengthens management reliability and account-level controls.

  Changelog

  • e4fd231 [management,proxy] Attribute agent network errors in access logs (#8460)
  • 5a4bfab [self-hosted,misc] Add Viper-backed config loader for the combined server (#8108)
  • 2d3c816 [client] Add profile ownership and IPC authz (#7407)
  • 0270bfa [doc] Expand repository contribution guidance (#7946)
  • fc37116 [proxy] Renew cached ACME certificates and report expiry (#8524)
  • 8dc1e2a [management] Stop peer expiration jobs when expiration is disabled for the account (#8521)
  • 76797c8 [management] limit resource policy store call (#8522)
  • 772d0b8 [client, ios] Add RefreshWireGuardStats to the iOS SDK (#8509)
  • 91f4ad0 [management] Restyle the MCP consent page and leave write unticked (#8502)
  • 14911a2 [management] Catch drift between the MCP catalog and the OpenAPI spec (#8498)
  • 6a6d217 [management] Record MCP sign-ins in the activity log (#8499)
  • d77bd23 [client, ios] Do not wait for the utun to be removed on engine stop (#8471)
  • 4e266e3 [client,ios] Preserve credentials when login checks cannot reach management (#8202)
  • 7949132 [management] Serve the REST API as an MCP server (#8335)
  • 3160255 [management] Add an OAuth 2.1 broker for MCP clients (#8334)
  • d3d872e [management] Scope group resource references to the owning account (#8474)
  • 145bfca [proxy] Report LLM token usage as metrics (#8481)
  • 313f71f [misc] Make the skip-latest tests independent of their environment (#8468)
  • 2f5b9ca [client] Use a destination Windows refuses in the UDP dial error test (#8480)
  • 3c996c9 [management] extract peer connection to separate tables (#8426)
  • ad8c1cc [client] Match peer rule protocols behind IPv6 extension headers in nftables (#8451)
  • 45a3bcb [client] Drop forwarded traffic that would leave through the interface it arrived on (#8440)
  • 4db6fb7 [client] Default the SSH server to off for stored configs without a peer key (#8448)
  • e2af490 [client] Remove a peer from the interface when it leaves the network map while its lazy connection is idle (#8449)
  • b839159 [client] Start the SSH server's SFTP subprocess through su like session commands, so nologin and expired accounts are refused (#8394)
  • caf50c8 [misc] Bump the signing pipeline to v0.1.9 (#8466)
  • f790834 [misc] Don't move latest for a patch on an older release line (#8215)
  • 2160682 [management] Enforce account id on proxy update (#8419)
  • ef987dc [management] Add a hard deadline to update debouncer to signal pending updates (#8437)
  • 65f833f [misc] Stop dispatching the mobile client submodule bumps on release tags (#8347)
  • 99cc59d [infrastructure] Fix Enterprise migration with env-provided secret (#8436)
  • 801ca16 [management] Ensure configure.sh does not clear the DataStoreEncryptionKey value (#5258)
  • 7d0f159 [client,ios] Report network loss through the existing recovery callback (#7716)
  • 5b55b83 [management] Skip writes and network map updates for unchanged objects (#8404)
  • 44ad4ee [infrastructure] Offer CrowdSec AppSec during self-hosted install (#8341)
  • 798b4ad [client] Close established SSH connections whose JWT user is no longer authorized when UpdateSSHAuth applies a new authorization list (#8393)
  • d23f631 [client] Let Signal register behind proxies that hold headers until the first message (#8380)
  • 50a9b14 [infrastructure] Build releases from the pushed tag, not GoReleaser's guess (#8427)
  • 627876c [client] Treat 0.0.0.0 and :: as local in the userspace firewall (#8432)
  • de7fd30 [client] Start ConPty SSH shells with bInheritHandles=FALSE so they no longer inherit the daemon's os/exec pipes of other users' sessions (#8391)
  • cf673a9 [client] Close SSH connections still in the handshake on Stop and reject ones accepted by a stopped server (#8392)
  • c72c42c [client] Start the update manager when management forces an update (#8232)
  • 274788b [client] Refuse SSH JWT auth when the client changes the user name between auth requests on one connection (#8389)
  • 6f73711 [self-hosted] Override relay auth secret and store encryption key from the environment (#8405)
  • dea73ff [management] use peer.Status.LastSeen field to detect stale peer.Status.Connected values (#7268)
  • 4ff3267 [management] Match account ids from the request and service config (#8386)
  • 4241844 [client] Refuse path-bearing locale, TERM and TZ values from SSH clients (#8388)
  • e2ee1dd Apply the SSH root-login setting to uid 0, not only to the account named root (#8390)
  • 1acdebf [management] Add configurable statement timeout to postgres store (#8381)
  • c9936ba [client] Bump wails fork to v3.0.0 (#8370)
  • 678aff0 [client] Send the relay hostname as Host when dialing a relay by IP (#8359)
  • 09f1de1 [management] batch disconnect and lock free reconnect (#8373)
  • 3633999 [client] Mark Rosenpass as deprecated (#8372)

  Original source

  Show more
• Nov 9, 2026

  • Date parsed from source:
    Nov 9, 2026
  • First seen by Releasebot:
    Nov 10, 2026
  

  Cloudflare One by Cloudflare

  Email security, Cloudflare One - Improved investigation search for Email security

  Cloudflare One adds a unified email security search bar with autocomplete, flexible filters, and date ranges for easier investigations.

  Email security now has a unified search bar for investigations. It replaces the Email Screener side modal and makes searches easier to refine.

  Search with keywords or field:value filters. Autocomplete suggests filters and values as you type. Add terms and press Enter to refine results, or select From, To, Disposition, Status, or Threat type values in results. Narrow results with a date preset or custom range.

  This feature is available to all Email security customers.

  Original source
• Nov 6, 2026

  • Date parsed from source:
    Nov 6, 2026
  • First seen by Releasebot:
    Nov 7, 2026
  

  Cloudflare One by Cloudflare

  Access, Cloudflare One - Sign in to Cloudflare Access with passkeys

  Cloudflare One adds passkey sign-in for protected apps and the App Launcher, with administrator controls for enrollment and access.

  Cloudflare Access supports passkeys as a login method for protected applications and the App Launcher. Users can sign in with a passkey saved on their device, security key, or password manager instead of entering a one-time PIN or configuring an identity provider.

  Users verify their identity with an existing login method once before enrolling a passkey. Administrators choose which applications accept passkeys and can remove a user's registered passkeys. Access policies still determine whether a user can access an application.

  For setup and enrollment instructions, refer to Passkeys.

  Original source

  Show more