Pangolin Release Notes

RC

A Release Candidate (RC) is a near-final software version, stable but undergoing last tests before official release. It has all features and no known bugs.

Users: Use cautiously due to potential undiscovered bugs. Not for critical systems unless prepared for issues. Report bugs.

Developers/Testers: Perform crucial final validation and thorough testing, especially of recent changes, to catch last-minute major issues.

Backup: Always back up data before installing an RC to allow rollback if problems arise.

Feedback: Provide feedback; it's vital for a robust final release.

Note

Keep a backup of the last stable database as you will be unable to update from a RC to the next stable version. Database migrations may change between release candidates and stable versions.

Warning

Badger v1.6.0 and v1.6.1 currently do not work when installed from Traefik’s plugin catalog due to an ongoing upstream integrity-check issue. Until this is resolved, do not rely on the catalog download for these versions. Instead, load Badger in Local Mode so Traefik uses a local copy of the plugin. See Local Mode at the bottom of Traefik’s plugin install docs for setup steps.

For updates, follow the thread on the fosrl/badger repo.

What's Changed

• Add AI gateway public resources
• Add AI gateway private resources
• Add AI gateway providers for cloud and self-hosted models
• Add AI gateway session logging and cost, token, and usage analytics
• Add AI gateway identity-based and machine virtual API keys
• Add AI gateway cost and token budget enforcement on roles, providers, models, resources, and virtual API keys
• Add AI gateway coding agent client configuration wizard
• Add RDP, SSH, and VNC resources to Community Edition
• Add certificate status tracking to Community Edition
• Add ability to mock test an alert action in alerts
• Add support for labels in blueprints
• Fix log retention access pulling from wrong org settings field
• Fix refresh buttons not always fetching new date on logs tables
• Dependency security updates
• General UI improvements
• Various other bug fixes

Full Changelog: 1.21.1...1.22.0-rc.0

How to Update

Important

AI gateway resources require the Badger Traefik plugin to be on the latest version v1.6.1. The migration will automatically do this if it can find the Traefik config in the standard location. Otherwise, please ensure your Badger is up to date.

Important

Private AI gateway resources require Gerbil to be on the latest version 1.5.0. The migration will NOT automatically attempt to update Gerbil. Therefore, you must manually increment your Gerbil container version.

Important

Private AI gateway resources are exclusively compatible with the latest versions of all Pangolin clients. Support for gateway functionality was implemented in all client releases issued after August 19th, 2026. If your client's most recent release predates this date, private gateway access is not yet available.

Important

Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.

View documentation

Read the 1.21 Announcement

Read the full announcement with discussion of new features: Pangolin 1.21: Same Network Detection

What's Changed

• Fix IdP org ownership on save policy (ref #3290)
• Fix newt command on credentials screen
• Fix labels dropdown flicker if no changes applied by @Fredkiss3 in #3468
• Fix redirect to /auth/initial-setup after hitting auth rate limit by @Adityakk9031 in #3410
• Fix Punycode domain validation by @shubhamsinnh in #3460
• Improve batch status histories by @Fredkiss3 in #3469

Security updates

New Contributors

• @shubhamsinnh made their first contribution in #3460

Full Changelog: 1.21.0...1.21.1

How to Update

Important

Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.

View documentation

Read the 1.21 Announcement

Read the full announcement with discussion of new features: Pangolin 1.21: Same Network Detection

What's Changed

• Add same network detection for clients and sites, so connection don’t relay when they are on the same network (requires updated clients and sites)
• Add option to associate an access token (share link) to a specific account user
• Add optional access token (share link) session persistence when access token is passed via a query parameter or a header, so they don't have to passed on every request
• Add remember last used IdP and mark as last used
• Add enabled toggle to private resources
• Add pending resource state to resources created on a pending site via a provisioning key and provisioning blueprint
• Add clean up pending resources if reject pending site
• Add site provisioning key routes to integration API
• Improve integration API for consistency in PUT/PATCH, route naming, and Swagger organization
• Fix improper query param encoding for email addresses preventing + characters in emails
• Dependency security updates
• General UI improvements
• Various other bug fixes

Full Changelog: 1.20.0...1.21.0

How to Update

Important

Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.

View documentation

RC

A Release Candidate (RC) is a near-final software version, stable but undergoing last tests before official release. It has all features and no known bugs.

Users: Use cautiously due to potential undiscovered bugs. Not for critical systems unless prepared for issues. Report bugs.

Developers/Testers: Perform crucial final validation and thorough testing, especially of recent changes, to catch last-minute major issues.

Backup: Always back up data before installing an RC to allow rollback if problems arise.

Feedback: Provide feedback; it's vital for a robust final release.

Note

Keep a backup of the last stable database as you will be unable to update from a RC to the next stable version. Database migrations may change between release candidates and stable versions.

What's Changed

• Add same network detection for clients and sites, so connection don’t relay when they are on the same network (requires updated clients and sites)
• Add option to associate an access token (share link) to a specific account user
• Add optional access token (share link) session persistence when access token is passed via a query parameter or a header, so they don't have to passed on every request
• Add remember last used IdP and mark as last used
• Add enabled toggle to private resources
• Add pending resource state to resources created on a pending site via a provisioning key and provisioning blueprint
• Add clean up pending resources if reject pending site
• Add site provisioning key routes to integration API
• Fix improper query param encoding for email addresses preventing + characters in emails
• Dependency security updates
• General UI improvements
• Various other bug fixes

Full Changelog: 1.20.0...1.21.0-rc.0

How to Update

Important

Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.

View documentation

Read the 1.20 Announcement

Read the full announcement with discussion of new features: Pangolin 1.20: Resource Launcher & Global Command Palette

What's Changed

• Add resource launcher page with configurable and savable views; available to non-admins and admins (CE)
• Add global command palette to navigate the dashboard and search for sites and resources (CE)
• Add Country Is Not matching type to resource geoblocking rules (CE)
• Add username field to VNC auth form; now works with macOS (CE)
• Improve private resource edit and create UI consistency to match dashboard UX patterns (migrate from dialog to dedicated pages)
• Release EE feature gate on labels feature
• Fix redirect back to resource after completing session expired checkpoint
• Dependency security updates
• General UI improvements
• Various other bug fixes

New Contributors

• @jaisinha77777 made their first contribution in #3369

Full Changelog: 1.19.4...1.20.0

How to Update

Important

Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.

View documentation

RC

A Release Candidate (RC) is a near-final software version, stable but undergoing last tests before official release. It has all features and no known bugs.

Users: Use cautiously due to potential undiscovered bugs. Not for critical systems unless prepared for issues. Report bugs.

Developers/Testers: Perform crucial final validation and thorough testing, especially of recent changes, to catch last-minute major issues.

Backup: Always back up data before installing an RC to allow rollback if problems arise.

Feedback: Provide feedback; it's vital for a robust final release.

Note

Keep a backup of the last stable database as you will be unable to update from a RC to the next stable version. Database migrations may change between release candidates and stable versions.

What's Changed

• Add resource launcher page with configurable and savable views; available to non-admins and admins
• Add global command palette to navigate the dashboard and search for sites and resources
• Add Country Is Not matching type to resource geoblocking rules
• Improve private resource edit and create UI consistency to match dashboard UX patterns (migrate from dialog to dedicated pages)
• Release EE feature gate on labels feature
• Fix redirect back to resource after completing session expired checkpoint
• Dependency security updates
• General UI improvements
• Various other bug fixes

New Contributors

• @jaisinha77777 made their first contribution in #3369

Full Changelog: 1.19.4...1.20.0-rc.0

How to Update

Important

Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.

View documentation

Read the 1.19 Announcement

Read the full announcement with discussion of new features: Pangolin 1.19: Browser Remote Access — SSH, RDP, VNC & More

What's Changed

Refer to the original 1.19 notes for a complete list of what changed since 1.18.

Fix newly created clients from logging in on a new device or adding a new user causing a No client found for provided orgId error

Note

If this effects you please update to this version then delete the user using the server admin panel, invite them back, and have them reauthenticate in their client.

Full Changelog: 1.19.3...1.19.4

How to Update

Warning

This version includes a new mode of private resource: SSH. If you had previously used host resources and configured the SSH access tab, you will now need to switch these to SSH resources in order to manage the SSH config. If you do not switch they will continue to function as before but you will be unable to adjust settings.

Important

1.19 browser-based SSH requires the Badger Traefik plugin to be on the latest version v1.4.1. The migration will automatically do this if it can find the Traefik config in the standard location BUT YOU WILL NEED TO RESTART TRAEFIK TO PULL THE NEW PLUGIN. Otherwise, please ensure your Badger is up to date.

Important

Browser-based RDP, SSH, and VNC as well as the new Pangolin SSH mode requires Newt version 1.13.0 or greater.

Important

Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.

View documentation

Read the 1.19 Announcement

Read the full announcement with discussion of new features: Pangolin 1.19: Browser Remote Access — SSH, RDP, VNC & More

What's Changed

Refer to the original 1.19 notes for a complete list of what changed since 1.18.

• Add update notifications for different client types
• Add delete resources associated with site
• Add country flags
• Add warning about not using .local aliases
• Fix no data in status history when last data was over 90 days ago
• Fix split by space causing issues with commands in role form
• Fix inconsitant query params for limit and page size by enforcing strict inputs
• Fix inconsistant API data in get vs update with policies
• Fix request logs not loading on initial page open in CE
• Fix remove NoNewPrivileges from default systemd install
• Fix ALL ASN not allowed as an input
• Fix add missing delete global idp route to integration api
• Fix unescaped regex chars in rules
• Fix supporter footer on resource login page to remove supporter
• Improve efficiency and concurrency when changing site resources
• Improve org policy error message responses

New Contributors

• @kshitijshresth made their first contribution in #3251
• @gmpinder made their first contribution in #3206
• @mr1beast made their first contribution in #3336

Full Changelog: 1.19.2...1.19.3

How to Update

Warning

This version includes a new mode of private resource: SSH. If you had previously used host resources and configured the SSH access tab, you will now need to switch these to SSH resources in order to manage the SSH config. If you do not switch they will continue to function as before but you will be unable to adjust settings.

Important

1.19 browser-based SSH requires the Badger Traefik plugin to be on the latest version v1.4.1. The migration will automatically do this if it can find the Traefik config in the standard location BUT YOU WILL NEED TO RESTART TRAEFIK TO PULL THE NEW PLUGIN. Otherwise, please ensure your Badger is up to date.

Important

Browser-based RDP, SSH, and VNC as well as the new Pangolin SSH mode requires Newt version 1.13.0 or greater.

Important

Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.

View documentation

Read the 1.19 Announcement

Read the full announcement with discussion of new features: Pangolin 1.19: Browser Remote Access — SSH, RDP, VNC & More

What's Changed

Refer to the original 1.19 notes for a complete list of what changed since 1.18.

• Fix mode missing in possible migration edge case
• Fix SSH public resource not working with roles other than admin
• Fix SSH public resource not respecting ssh action restriction on roles
• Fix missing translations
• Fix private SSH resource edge case with missing host
• Fix blueprint server side error with bad containers

How to Update

Warning

This version includes a new mode of private resource: SSH. If you had previously used host resources and configured the SSH access tab, you will now need to switch these to SSH resources in order to manage the SSH config. If you do not switch they will continue to function as before but you will be unable to adjust settings.

Important

1.19 browser-based SSH requires the Badger Traefik plugin to be on the latest version v1.4.1. The migration will automatically do this if it can find the Traefik config in the standard location BUT YOU WILL NEED TO RESTART TRAEFIK TO PULL THE NEW PLUGIN. Otherwise, please ensure your Badger is up to date.

Important

Browser-based RDP, SSH, and VNC as well as the new Pangolin SSH mode requires Newt version 1.13.0 or greater.

Important

Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.

View documentation

Read the 1.19 Announcement

Read the full announcement with discussion of new features: Pangolin 1.19: Browser Remote Access — SSH, RDP, VNC & More

What's Changed

• Add resource policies for public resources
• Add browser based RDP access via public resources (requires newt >1.13.0)
• Add browser based VNC access via public resources (requires newt >1.13.0)
• Add browser based SSH access via public resources (requires newt >1.13.0)
• Add native Pangolin SSH mode (for private and public resources) that does not require configuring OpenSSH server and PAM (requires newt >1.13.0)
• Add auto update Newt option for all sites in the org or specific sites (requires newt >1.13.0)
• Add searchable and filterable custom labels on sites and resources
• Add share link post authentication redirect path
• Add pangctl command to make more than one user server admin
• Add PostgreSQL and Redis install options in the installer
• Fix public resource showing as degraded when WireGuard targets were added alongside healthy Newt targets
• Fix custom branding logo URL not accepting links
• Fix pasting the device code not accepting paste
• Fix enforce absolute paths in sudo commands
• Fix refresh end time on logs tables
• Fix accept partially valid Docker labels instead of rejecting all
• Fix restarting container on RC version causing migration errors
• Fix cross site target assignment
• Improve OpenAPI response payloads
• Improve SSH configuration on private resources
• Improve sort resource filter options in audit logs
• Improve performance in certain hot paths
• Improve clients get error when holepunching fails instead of getting stuck registering
• Improve speed of API endpoints with thousands of sites and users
• Improve add loading icons on all logs tables
• Improve auto create roles added in Blueprints
• Dependency security updates
• General UI improvements
• Various other bug fixes

How to Update

Warning

This version includes a new mode of private resource: SSH. If you had previously used host resources and configured the SSH access tab, you will now need to switch these to SSH resources in order to manage the SSH config. If you do not switch they will continue to function as before but you will be unable to adjust settings.

Important

1.19 browser-based SSH requires the Badger Traefik plugin to be on the latest version v1.4.1. The migration will automatically do this if it can find the Traefik config in the standard location BUT YOU WILL NEED TO RESTART TRAEFIK TO PULL THE NEW PLUGIN. Otherwise, please ensure your Badger is up to date.

Important

Browser-based RDP, SSH, and VNC as well as the new Pangolin SSH mode requires Newt version 1.13.0 or greater.

Important

Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.

View documentation

RC

A Release Candidate (RC) is a near-final software version, stable but undergoing last tests before official release. It has all features and no known bugs.

Users: Use cautiously due to potential undiscovered bugs. Not for critical systems unless prepared for issues. Report bugs.

Developers/Testers: Perform crucial final validation and thorough testing, especially of recent changes, to catch last-minute major issues.

Backup: Always back up data before installing an RC to allow rollback if problems arise.

Feedback: Provide feedback; it's vital for a robust final release. Use the dicsussion to report issues.

NOTE: Keep a backup of the last stable database as you will be unable to update from a RC to the next stable version. Database migrations may change between release candidates and stable versions.

What's Changed

Fix 404 on http public resources

How to Update

Important

1.19.0 SSH requires the Badger Traefik plugin to be on the latest version v1.4.1. The migration will automatically do this if it can find the Traefik config in the standard location. Otherwise, please ensure your Badger is up to date.

Important

Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.

View documentation

RC

A Release Candidate (RC) is a near-final software version, stable but undergoing last tests before official release. It has all features and no known bugs.

Users: Use cautiously due to potential undiscovered bugs. Not for critical systems unless prepared for issues. Report bugs.

Developers/Testers: Perform crucial final validation and thorough testing, especially of recent changes, to catch last-minute major issues.

Backup: Always back up data before installing an RC to allow rollback if problems arise.

Feedback: Provide feedback; it's vital for a robust final release. Use the dicsussion to report issues.

NOTE: Keep a backup of the last stable database as you will be unable to update from a RC to the next stable version. Database migrations may change between release candidates and stable versions.

What's Changed

• Add resource policies for public resources
• Add browser based RDP access via public resources (requires newt >1.13.0-rc.0)
• Add browser based VNC access via public resources (requires newt >1.13.0-rc.0)
• Add browser based SSH access via public resources (requires newt >1.13.0-rc.0)
• Add native Pangolin SSH mode (for private and public resources) that does not require configuring OpenSSH server and PAM (requires newt >1.13.0-rc.0)
• Add auto update Newt option for all sites in the org or specific sites (requires newt >1.13.0-rc.0)
• Add searchable and filterable custom labels on sites and resources
• Add share link post authentication redirect path
• Add pangctl command to make more than one user server admin
• Add PostgreSQL and Redis install options in the installer
• Fix public resource showing as degraded when WireGuard targets were added alongside healthy Newt targets
• Fix custom branding logo URL not accepting links
• Fix pasting the device code not accepting paste
• Fix enforce absolute paths in sudo commands
• Fix refresh end time on logs tables
• Fix accept partially valid Docker labels instead of rejecting all
• Fix restarting container on RC version causing migration errors
• Fix cross site target assignment
• Improve OpenAPI response payloads
• Improve SSH configuration on private resources
• Improve sort resource filter options in audit logs
• Improve performance in certain hot paths
• Improve clients get error when holepunching fails instead of getting stuck registering
• Improve speed of API endpoints with thousands of sites and users
• Improve add loading icons on all logs tables
• Improve auto create roles added in Blueprints
• Dependency security updates
• General UI improvements
• Various other bug fixes

How to Update

Important

1.19.0 SSH requires the Badger Traefik plugin to be on the latest version v1.4.1. The migration will automatically do this if it can find the Traefik config in the standard location. Otherwise, please ensure your Badger is up to date.

Important

Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.

View documentation