Release Notes for v0.78.0

Highlights

Rosenpass now works through the embedded reverse proxy (#6763). Until now the proxy ran no Rosenpass at all, so peers with Rosenpass enabled failed to establish through it on a PSK mismatch — an incompatibility that was never documented. The proxy now runs Rosenpass in permissive mode, so it connects both to Rosenpass-enabled peers and, exactly as before, to peers without it. NB_PROXY_ROSENPASS=false turns it off.

Lazy connections reworked: per-peer lazy state, proxy peers lazy by default, and the lazy exclusion list removed (#6762, #6763).

Agent Network / LLM gateway: agentgateway integration, access roles and self-service endpoints, Bedrock model discovery served from the control plane, guardrail allowlists for declared model ids, and the endpoint conformed to the LLM gateway protocol (#7274, #7221, #7250, #7239, #7154, #7389, #7246).

DNS on Windows: a catch-all NRPT rule when NetBird is the primary resolver (#7071), closing the leak/poisoning window towards the system resolvers.

Use netbird service reconfigure --service-env NB_USE_LEGACY_DNS_RESOLUTION=true to restore the old behavior.

Local Prometheus metrics endpoint on the client (#6689).

Go 1.26 and go-quic v0.62.0 across client, relay and management (#7359).

Unified ACL filtering for peers and routes, with multi-source rules (#6322). An internal refactor: no change is expected for standard deployments.

Ukrainian localization for the desktop client (#7035).

Behaviour changes

Remote jobs (remote debug bundle and friends) are now behind an admin opt-in, with MDM support (#7153). Anyone using them without the opt-in has to enable it.

Remote debug bundle jobs accept an anonymization level and an upload URL (#7147).

The client stays connected during the login command (#7384).

Logging out of the active profile is allowed even when profiles are disabled (#7360).

Profiles resolve for the invoking sudo user rather than for root (#7238).

NetBird traffic stays out of third-party fwmark rules (#7314).

GUI windows are created on demand and destroyed on close (#7096).

Android split tunnelling: the mode is typed rather than stored as a string, and settings are kept per profile (#7387, #7349).

Security / hardening

The cached SSH JWT is bound to the local caller that obtained it (#7378).

The WireGuard key is no longer logged on a parse failure (#7379).

The client asks the OS for privileges when a guarded SSH setting is changed (#7066).

The proxy validates header auth (#7263).

Management checks a provider's URL and credential before saving them (#7301).

Clarified that X-Peer-ID on metrics ingest is not a credential (#7363).

The old math/rand library is gone from management (#6836).

Client — fixes

Fixed the ICEBind races that wedge interface creation (#7377).

agentConnecting is dropped whenever the ICE session state clears (#7327).

A peer offer or answer arriving before the handshaker starts listening is held rather than lost (#7255).

Connections are swept on network loss through a shared netevents manager (#7254).

Route selection survives an invalid request and is applied on a partial one (#7292).

The session-expiration dialog closes only on renewal (#7337).

A still-locked updater binary is tolerated when cleaning up after an update (#7286).

Fixed context cancellation during restart on iOS (#7329).

iOS SSO logins reuse the profile's account (#7193).

The iOS profile manager was migrated from Swift to Go (#6528).

The PCP implementation moved to the go-nat fork (#7282).

Reverted multi-buffer support declared for the loopback XDP program (#7303).

The Android TUN is renewed only when the routes it carries actually change (#7396).

Overlay listeners are rebuilt when the TUN is renewed (#7397).

The remote jobs opt-in is exposed in the Android and iOS SDK preferences (#7406).

Management — fixes

Fixed geolocation panics (#7382).

Fixed private services calculation on the new db path (#7383).

Fixed posture check evaluation for direct peers in policy definitions (#7348) and the affected peers calculation on a posture check flip (#7347).

Handled the nil pointer in sendInitialSync() when the peer has been deleted (#7315).

Network map from the nmap data type (#6919).

Self-hosted / infrastructure

Better domain, Docker Compose and license validation in the self-hosted scripts (#7339).

The dashboard wasm client bump is triggered by release tags (#7277).

Protobuf breaking-change checks in CI (#7305).

Pinned the toolchain gomobile init needs for gobind (#7291).

Removed the mobile build validation workflow (#7302).

Upgrade notes

Remote debug bundles now require an explicit opt-in (#7153). Bundles requested by the management server no longer run on a peer unless remote jobs are enabled there, with --allow-remote-jobs on the client or the allowRemoteJobs managed setting. Deployments relying on management-triggered debug bundles must opt in before they work again. The upload destination can now be pinned by the operator, with MDM taking precedence over the management-supplied value (#7147).

The embedded proxy now runs Rosenpass in permissive mode (#6763). Peers with Rosenpass enabled can now use the reverse proxy, which previously failed on a PSK mismatch; peers without Rosenpass keep connecting exactly as before. NB_PROXY_ROSENPASS=false disables it.

Proxy peers now default to lazy connections (#6762).

Nothing else requires action.

Full Changelog: v0.77.1...v0.78.0

Original source

Release Notes for v0.77.1

What's New

Client Improvements

Fixed session extension and SSH authentication always using the device code flow on Linux.

#7187

Added Windows DNS configuration to the debug bundle.

#7196

Added a CI check for translation key parity.

#6852

Preserved the account email on Android logout while removing it when a profile is deleted.

#7200

Ranked Windows route candidates using combined route and interface metrics.

#7210

Skipped IPv6 route tests when the default next hop is unusable.

#7212

Passed the stored email as a login hint from the UI and preserved it on logout.

#7199

Fixed inconsistencies in the CI gomobile init process.

#7229

Deleted Windows NRPT rules by enumerating the registry instead of relying on a rule count.

#7195

Declared multi-buffer support for the loopback XDP program.

#7230

Exposed SSH functionality on Android.

#7156

Handled Android network changes without restarting the engine.

#7144

Cleared stale installer results before starting updates.

#7204

Stopped the UI before silent Windows updates and suppressed installer reboots.

#7209

Reported network addresses on Android for posture checks.

#7235

Restarted the UI using the user's environment block after updates.

#7245

Switched client tests to go.uber.org/mock.

#7253

Renamed TURN-specific WireGuard proxy terminology to relayed connections.

#7231

Fixed staticcheck findings after upgrading golangci-lint.

#7266

Added missing anonymization and SSH privilege translations.

#7269

Added a lazy connection override and device name reporting to the WASM client.

#7276

Management Improvements

Documented the mutual exclusivity of ports and port_ranges in policy rules.

#7158

Refused usage limits that one-off setup keys cannot honor.

#7220

Switched management tests to go.uber.org/mock.

#7253

Suppressed staticcheck warnings for deprecated protobuf fields.

#7261

Infrastructure & Miscellaneous

Added support for non-interactive, environment-driven installations in getting-started.sh.

#7168

Updated the Agent Network documentation.

#7020

Prevented overriding the dashboard image in Enterprise migrations.

#7206

Skipped store migrations for PostgreSQL deployments.

#7207

New Contributors

@SunsetDrifter made their first contribution in #7158

@znel2002 made their first contribution in #7168

Full Changelog: v0.77.0...v0.77.1

Original source

What's New

Agent Network

Reworked Agent Network endpoint identity and settings bootstrap.
#7085

Added a proxy-connect authorizer seam for Agent Network.
#7136

Added reverse proxy usage accounting for activity tracking.
#7116

Client Improvements

Added strict anonymization level and MAC address anonymization to debug bundles.
#7102

Declared the xdg-utils dependency for NetBird UI packages.
#7126

Fixed credentials used for GTK3 package uploads.
#7125

Prevented WireGuard packets from being misrouted to the STUN handler.
#7059

Updated the NetBird Wails fork to remove the native WebView2 dependency.
#7128

Migrated the relay QUIC tracer to qlog and upgraded quic-go to v0.59.1.
#7124

Derived Windows SSH privilege checks from the user token and group membership.
#6966

Adjusted the GTK3 release job.
#7163

Fixed a macOS DNS panic caused by malformed scutil output.
#7180

Added a fallback to per-IP ACL rules when ipset is unavailable.
#6332

Gated IPv6 forwarding on overlay IPv6 while preserving host Router Advertisement acceptance.
#6221

Removed installer registry handlers for Windows autostart Run keys.
#7183

Infrastructure & Documentation

Added Crowdin configuration for UI translation synchronization.
#7155

Fixed Crowdin export paths and export options.
#7162

Updated the documentation to direct translation contributions to Crowdin.
#7161

Allowed external test suites to reuse the NetBird end-to-end test harness.
#7176

Improved the release pipeline to build release branches and delay marking releases as "latest" until signing is complete.
#7171

Full Changelog: v0.76.3...v0.77.0

Original source

What's Changed

• [management] prewarm a posture check cache on network map generation by @pascal-fischer in #7093
• [client] peer: re-arm the WireGuard watcher after a lazy wake by @riccardomanfrin in #7091
• [infrastructure] Detect community GHCR images during enterprise migration by @jnfrati in #7101
• [client] disambiguate the connection_type metric tag by @riccardomanfrin in #7043
• [management] Affected peers for user updates by @pascal-fischer in #7099
• [infrastructure] add grafana dashboard for licensed management by @mlsmaycon in #7095
• [management] Deny reverse proxy access to pending and blocked users by @mlsmaycon in #7105

Full Changelog: v0.76.2...v0.76.3

Original source

What's Changed

• [misc] add AGENTS.md file by @mlsmaycon in #7014
• [client] Handle interface lookup errors in iOS DNS index helper by @Optic00 in #6999
• [client] iOS - Remove duplicate Login RPCs from the iOS SDK by @evgeniyChepelev in #6931
• [client] Declare GTK4/WebKitGTK runtime deps for the Linux UI packages by @pappz in #6893
• [management] Generic gRPC extension seam for external modules by @bison in #6894
• [management] Resolve agent network permissions per submodule by @mlsmaycon in #7030
• [management] fix handling of empty network map during decode and encode by @pascal-fischer in #6987
• [client] Keep the account email backing the SSO login hint correct by @pappz in #6986
• [client] Android - Create the Android fake IP manager lazily on DNS flag enable by @pappz in #6989
• [client] Android - Serialize Android tunnel reconfiguration callbacks by @pappz in #6990
• [client] Keep the UI running when the notification service fails to start by @lixmal in #6959
• [client] launch macOS GUI as the logged-in user after install/update by @riccardomanfrin in #6962
• [client] Don't ask for an SSO login when the login never reached management by @lixmal in #6983
• [misc] Add android and ios tags to PR title check by @pappz in #7037
• [client, android] Pull fresh TUN settings on Android rebuild by @pappz in #6991
• [client, android] Reuse the persisted configuration when enrolling by @camiloariza in #7022
• [client, android] Reuse the profile's account for Android SSO logins by @pappz in #6988
• [client] Update wails to v3.0.0-beta.3 by @pappz in #7038
• [management] Align agent-network API contracts for API clients by @mlsmaycon in #7026
• [client] Probe the daemon login with IsLoginRequired by @pappz in #7052
• [client, android] Fix profile account path test on Windows by @pappz in #7057
• [client] Fix session expired relogin by @pappz in #7055
• [client] Fix Linux tray right-click opening the main window by @pappz in #7039
• [management] prevent dangling group refs in agent-network ACLs. by @braginini in #7060
• [management] Prevent deleting groups referenced by reverse proxy services by @mlsmaycon in #7062
• [relay] randomize the relay reconnect backoff by @riccardomanfrin in #7067
• [misc] Move enterprise setup to Traefik and harden migration by @bcmmbaga in #7042
• [misc] Expand agent guidelines with security, type-safety and lifecycle conventions by @lixmal in #7076
• [client] Ship a legacy GTK3 UI package for distros without WebKitGTK 6.0 by @pappz in #7040
• [client] Add a UI setting to stay connected after quitting by @pappz in #7078
• [infrastructure] Generate a session cookie encryption key on fresh self-hosted installs by @Optic00 in #7056
• [client] Stop the macOS UI on pkg upgrade by @lixmal in #7079
• [client] Reword the firewalld package comment by @lixmal in #7081
• [client] Update the wails fork reference to the integration branch head by @pappz in #7087

New Contributors

• @camiloariza made their first contribution in #7022

Full Changelog: v0.76.1...v0.76.2

Original source

What's Changed

• [client] Support Andorid session expiry handling by @pappz in #6945
• [client] Stop and remove the daemon on netbird-ui cask uninstall by @lixmal in #6977
• [misc] Update SECURITY.md by @mlsmaycon in #6981
• [misc] group x package updates and run weekly by @mlsmaycon in #7000
• [client] Fix daemon lock order inversion between SetConfig and login by @lixmal in #6978
• [client] Fix expression order in legacy nftables route rules by @Optic00 in #7011
• [proxy] remove cluster tag from proxy metrics by @pascal-fischer in #6985
• [misc] update contributing guide by @mlsmaycon in #7009
• [client] Restrict debug bundle log path and upload destinations by @lixmal in #6975
• [management, proxy] Management-owned LLM pricing: file-backed defaults + by @braginini in #6965

Agent Network

The merged PR #6965 requires an upgrade of both Management and Proxy containers.

New proxy under old management silently disables cost metering.

New Contributors

@Optic00 made their first contribution in #7011

Full Changelog: v0.76.0...v0.76.1

Original source

Security

Fixes a local privilege escalation in the client daemon (GHSA-qcpp-8vwj-hhwr). The daemon's local control interface accepted any local caller without authentication, so an unprivileged user on the same machine could enable the embedded SSH server, turn on SSH root login and disable SSH authentication, and then open a root shell. Every version from 0.5.0 to 0.75.1 is affected: on Linux, macOS and FreeBSD through the world-writable Unix socket, and on Windows through the loopback TCP listener, which carried no caller identity at all. Reported by @neewek.

The daemon now derives each local caller's identity from the kernel and requires root, or an administrator on Windows, to enable the SSH server, enable SSH root login, disable SSH authentication, or to change the management URL or deregister the peer while that profile has the SSH server enabled. On Windows it serves a named pipe instead of loopback TCP, and existing installations are migrated automatically.

Upgrade note: if you enable any of those settings from a script or an unprivileged session, run the command with sudo, or from an elevated prompt on Windows. Turning them off is unchanged, and so is everything else on the socket.

Learn more here

What's Changed

• [management] Force routing-peer DNS resolution for reverse-proxy domain targets by @lixmal in #6872
• [management] Read reverse-proxy service and target columns in Postgres path by @lixmal in #6886
• [client] Expose RenameProfile in the Android profile manager binding by @pappz in #6926
• [client] Build UI release binaries with the production tag by @pappz in #6898
• [client] Escape dots in interface names for sysctl configuration by @stefan-fast in #6930
• [client] Serialize iOS tunnel reconfiguration callbacks by @pappz in #6870
• [client] Unify route selection in the route manager by @pappz in #6928
• [client] parse NB_LAZY_CONN_INACTIVITY_THRESHOLD as a Go duration by @riccardomanfrin in #6947
• [client] Export peer details for Android by @pappz in #6925
• [management] explicit accountID check when deleting a user by @pascal-fischer in #6944
• [infrastructure] Deprecate legacy Dex and Zitadel getting-started scripts by @TechHutTV in #6952
• [client] Fix UI crash on Windows builds without dark-mode support by @lixmal in #6958
• [signal] make pprof configurable by @pascal-fischer in #6963
• [client] Authorize daemon IPC callers by their local identity by @lixmal in #6967

New Contributors

• @stefan-fast made their first contribution in #6930
• @TechHutTV made their first contribution in #6952

Full Changelog: v0.75.1...v0.76.0

Original source

Release Notes for v0.75.1

What's New

Agent Network

Added prompt cache token and cost accounting to Agent Network usage.

#6900

Added support for Claude Opus 5.

#6895

Scoped Agent Network model allowlists per policy, group, and provider.

#6905

Client Improvements

Reconcile routed AllowedIPs when a lazy connection becomes idle.

#6863

Fetch FreeBSD port files from the GitHub mirror instead of cgit.

#6880

Restored the missing backup.Reset behavior.

#6883

Made Test_ConnectPeers deterministic under Docker/eBPF kernel and Darwin CI.

#6884

Export agent version information for iOS.

#6918

Use platform-specific installer URLs for manual update downloads.

#6922

Exit the GUI immediately when the Windows session ends.

#6878

Fixed stale routing peers after removing overlapping-prefix networks.

#6799

Added ReapplyMatching support to the dedicated AllowedIPsRefCounter.

#6935

Infrastructure & Miscellaneous

Restored the rootless-latest Docker image tag.

#6914

Full Changelog: v0.75.0...v0.75.1

Original source

Release Notes for v0.75.0

New Feature: Redesigned Desktop Client

This release ships a complete rewrite of the desktop client. We went ahead and replaced the old Fyne-based tray application with a new Wails v3 app backed by a React and TypeScript frontend, and it is a massive upgrade. You get a proper main connection view, an exit-node switcher, a networks and peers browser with detail panels, profile management, full settings, debug-bundle creation, and a first-run welcome flow, all in one place instead of buried in a tray menu. #6473 by @pappz and @heisbrot

The new UI is also translated into 10 languages now, and session handling got a lot smarter, so you actually know when your session is about to expire instead of finding out the hard way. Do note that launch-on-login is now enabled by default on fresh GUI installs, so if you manage devices through MDM, the disableAutostart setting is enforced on every launch to keep that under your control.

Rebuilt the desktop client as a Wails v3 application with a React + TypeScript frontend, replacing the Fyne UI. #6473

Added internationalization with 10 locales (English, German, Spanish, French, Hungarian, Italian, Japanese, Portuguese, Russian, and Simplified Chinese), shared between the tray and the frontend. #6473, #6790 by @s-shimizu-clpl

Added a new system tray with per-platform theme-aware icons, including a native XEmbed host and theme watcher on Linux. #6473

Improved session handling with an auth session watcher, pending login flow, session-expiration dialog and tray notifications, and netbird login improvements. #6473

Extended the daemon API with status stream subscription, an event stream, networks and exit-node selection endpoints, and richer full status, with probe throttling to protect the daemon from UI-driven request storms. #6473

Enabled launch-on-login by default on fresh GUI installs, managed through the daemon as the single source of truth (HKCU on Windows). #6738 by @mlsmaycon

Enforced MDM disableAutostart on every GUI launch, not just fresh installs. #6782 by @riccardomanfrin

Learn more:

Desktop app overview: https://docs.netbird.io/client/desktop-app

Profiles: https://docs.netbird.io/client/profiles

Deep dive on the new app: https://netbird.io/knowledge-hub/netbird-v0-75-new-desktop-app

What's Changed

Desktop Client Improvements

Made the client connect immediately on profile selection, except while managing profiles. #6838 by @pappz

Brought the connection up in Go after SSO login for a faster, more reliable post-login connect. #6744 by @mlsmaycon

Kept the session deadline visible across reconnects. #6847 by @pappz

Fixed the browser dialog not closing during the renew-session flow. #6745 by @heisbrot

Disconnected the daemon on GUI quit via an async Down call. #6796 by @pappz

Restored residual state in foreground mode before login. #6707 by @dfry

Clarified the outdated client overlay wording. #6718 by @heisbrot

Used menu-bar wording on the macOS welcome screen. #6810 by @heisbrot

Added SSO login flow timing instrumentation. #6717 by @mlsmaycon

Updated Wails to v3.0.0-alpha2.117. #6837 by @pappz

Client Improvements

Added a JSON gateway for the NetBird daemon, exposing the daemon API over HTTP/JSON. #6272 by @jnfrati

Introduced client-side event aggregation. #6627 by @dmitri-netbird

Offloaded client config generation to the client, reducing work on the management server. #6711 by @dmitri-netbird

Warmed lazy connections from the DNS resolver so lazily-connected peers come up faster. #6854 by @mlsmaycon

Fixed forwarder peers never being excluded from lazy connections. #6674 by @riccardomanfrin

Fixed WGWatcher silently failing to restart on fast disconnect/reconnect. #6664 by @riccardomanfrin

Cleared stale UDP checksums in the eBPF XDP proxy after port rewrite. #6861 by @lixmal

Raised the relay early-message buffer cap to 10,000 to avoid dropping relayed handshakes. #6752 by @riccardomanfrin

Fixed a nil-context panic in the iOS dynamic route resolver. #6848 by @pappz

Fixed a DNS probe listener panic on unparseable local addresses. #6797 by @pappz

Fixed the browser (WASM) relay WebSocket close and raised the RDP dial timeout. #6684 by @lixmal

Included system events in status conversion. #6746 by @lixmal

Refreshed WireGuard stats in mobile debug bundles. #6814 by @pappz

Distinguished empty vs. corrupt state in debug diagnostics. #6816 by @pappz

Management Improvements

Added the dashboard_features account setting #6742 and the agent_network_only account setting #6736, with agent_network_only requiring dashboard_features.agent_network to be enabled #6750 — all by @mlsmaycon

Added traffic filters for source and destination ID. #6697 by @pascal-fischer

Allowed disabling the device code flow when using Dex. #6809 by @pascal-fischer

Propagated auth grant types for the combined server. #6817 by @pascal-fischer

Built routes for the peer cache on network map components #6780 and added component types #6866 — both by @pascal-fischer

Fixed fetching of missing settings in the GetAccount call. #6800 by @dmitri-netbird

Fixed a duplicate operationId in the OpenAPI spec. #6734 by @CoderSufiyan

Enabled pprof via an environment variable. #6778 by @pascal-fischer

Added logging to ephemeral peer deletion. #6747 by @pascal-fischer

Agent Network

Added Kimi (Moonshot AI) to the provider catalog. #6853 by @mlsmaycon

Added Bedrock cost-allocation metadata plus a per-provider metadata_disabled option. #6791 by @mlsmaycon

Matched Bedrock provider models against the normalized request model. #6773 by @mlsmaycon

Probed the agent-network endpoint with a GET instead of getent. #6867 by @mlsmaycon

Fixed the proxy multi-stage Docker build. #6864 by @mlsmaycon

Relay Improvements

Trusted X-Real-Ip headers only from configured trusted proxies. #6833 by @pappz

Removed the deprecated Hello handshake and gob token decode. #6783 by @lixmal

Self-Hosting Improvements

Added a unified admin CLI for self-hosted helpers. #6507 by @jnfrati

Simplified the enterprise bootstrap. #6869 by @bcmmbaga

Internal, CI, and Docs

Copied the trustedproxy package into the Docker build context. #6851 by @pappz

Ran pnpm install with --ignore-scripts in frontend CI. #6859 by @pappz

Re-generated gateway proto files. #6696 by @jnfrati

Fixed flaky tests in account settings and event aggregation #6811, #6710 by @dmitri-netbird, and in the peer-connect handshake wait #6871 by @riccardomanfrin

Updated the Agent Network readme. #6699 by @braginini

New Contributors

@CoderSufiyan made their first contribution in #6734

@s-shimizu-clpl made their first contribution in #6790

Full Changelog: v0.74.7...v0.75.0

Original source

What's Changed

• [relay] Handle QUIC connections concurrently to prevent handshake head-of-line blocking by @lixmal in #6784
• [client] Reject leading hyphen in getent input to prevent flag injection by @lixmal in #6787
• [client] Sanitize peer FQDN/hostname in generated SSH config by @riccardomanfrin in #6805
• [client] Disable gVisor TCP RACK loss detection on Windows by @lixmal in #6808
• [client] Rename isValidAccessToken to reflect audience-only check by @riccardomanfrin in #6806
• [client] Bind netstack SOCKS5 proxy to 127.0.0.1 by default by @riccardomanfrin in #6812
• [client] Evaluate IP fragments against firewall ACLs by @lixmal in #6781

Full Changelog: v0.74.6...v0.74.7

Original source

What's Changed

• [client] fix MDM managementURL conflict on default-port URL echo by @riccardomanfrin in #6672
• [management,client] 0.75.0 release by @mlsmaycon in #6473
• [client] introduce client-side event aggregation by @dmitri-netbird in #6627
• [client] add json gateway for netbird daemon by @jnfrati in #6272
• [client] fix: re-generate gateway proto files by @jnfrati in #6696
• [client] Merge v0.74.x branch by @theodorsm in #6700
• [doc] Update Agent Network Readme by @braginini in #6699
• [client] Fix browser relay WebSocket close and raise RDP dial timeout by @lixmal in #6684
• [management] add traffic filters for source and dest id by @pascal-fischer in #6697
• [client] fix flaky test around event aggregation by @dmitri-netbird in #6710
• [client] Add SSO login flow timing instrumentation by @mlsmaycon in #6717
• [client,management] sync 0.74.4 changes by @mlsmaycon in #6727
• [management] fix duplicate operationId in OpenAPI spec by @CoderSufiyan in #6734
• [management] Add agent_network_only account setting by @mlsmaycon in #6736
• [management] Add dashboard_features account setting by @mlsmaycon in #6742
• [client] Bring the connection up in Go after SSO login by @mlsmaycon in #6744
• [client] Enable launch-on-login by default on fresh GUI installs by @mlsmaycon in #6738
• [management] require dashboard_features.agent_network when enabling agent_network_only by @mlsmaycon in #6750
• [proxy, client] Include system events in status conversion by @lixmal in #6746
• [management] add logs to ephemeral delete by @pascal-fischer in #6747

New Contributors

• @CoderSufiyan made their first contribution in #6734

Full Changelog: v0.74.2...v0.75.0-rc.6

Original source