Pangolin Release Notes

Read the Announcement

Read the full announcement with discussion of new features: Pangolin 1.24: Exit Nodes and Improved Clients

What's New

• Add exit node private resources
• Add HTTP method matching to resource rules
• Add Badger config overrides to config file
• Add on-demand activation for iOS and macOS clients
• Add always-on connections for Android clients
• Add connect-at-login for Windows clients
• Add response header customization
• Add subnet routing to Linux CLI client for site to site networking
• Significant UI improvements for all Pangolin clients (see release notes for each respective client for comprehensive list of changes)
• Update iPhone and Mac client identifiers
• Dependency security updates
• General UI improvements
• Various other bug fixes

New Contributors

• @Bolex80 made their first contribution in #3790
• @m1handr made their first contribution in #3616
• @kah-ja made their first contribution in #3750
• @Tyagiquamar made their first contribution in #3785
• @breken-ai made their first contribution in #3738
• @moyaqoob made their first contribution in #3585
• @Gulianrdgd made their first contribution in #3172
• @MauryaQbit made their first contribution in #3797
• @Fra146 made their first contribution in #3811

Full Changelog: 1.23.0...1.24.0

How to Update

Important

Private exit node resources require Pangolin CLI v0.18.0+ or Newt v1.18.0+. Upgrade your site connector before deploying.

Important

Private exit node resources are exclusively compatible with the latest versions of all Pangolin clients. Support for exit node functionality was implemented in all client releases issued after September 29th, 2026. If your client's most recent release predates this date, exit nodes are not yet available.

Important

Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.

View documentation

RC

A Release Candidate (RC) is a near-final software version, stable but undergoing last tests before official release. It has all features and no known bugs.

Users: Use cautiously due to potential undiscovered bugs. Not for critical systems unless prepared for issues. Report bugs.

Developers/Testers: Perform crucial final validation and thorough testing, especially of recent changes, to catch last-minute major issues.

Backup: Always back up data before installing an RC to allow rollback if problems arise.

Feedback: Provide feedback; it's vital for a robust final release.

Note

Keep a backup of the last stable database as you will be unable to update from a RC to the next stable version. Database migrations may change between release candidates and stable versions.

What's New

• Add exit node private resources
• Add HTTP method matching to resource rules
• Add Badger config overrides to config file
• Add on-demand activation for iOS and macOS clients
• Add always-on connections for Android clients
• Add connect-at-login for Windows clients
• Add response header customization
• Add subnet routing to Linux CLI client for site to site networking
• Significant UI improvements for all Pangolin clients (see release notes for each respective client for comprehensive list of changes)
• Update iPhone and Mac client identifiers
• Dependency security updates
• General UI improvements
• Various other bug fixes

New Contributors

• @Bolex80 made their first contribution in #3790
• @m1handr made their first contribution in #3616
• @kah-ja made their first contribution in #3750
• @Tyagiquamar made their first contribution in #3785
• @breken-ai made their first contribution in #3738
• @moyaqoob made their first contribution in #3585
• @Gulianrdgd made their first contribution in #3172
• @MauryaQbit made their first contribution in #3797
• @Fra146 made their first contribution in #3811

Full Changelog: 1.23.0...1.24.0-rc.0

How to Update

Important

Private exit node resources require Pangolin CLI v0.18.0+ or Newt v1.18.0+. Upgrade your site connector before deploying.

Important

Private exit node resources are exclusively compatible with the latest versions of all Pangolin clients. Support for exit node functionality was implemented in all client releases issued after September 29th, 2026. If your client's most recent release predates this date, exit nodes are not yet available.

Important

Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.

View documentation

Read the Announcement

Read the full announcement with discussion of new features: Pangolin 1.23: High Availability and Clustering

What's Changed

• Add support for self-service high availability in Enterprise Edition
• Add master list of all orgs to server admin panel
• Add support for more than one server admin user; promote and demote via users table in server admin panel
• Add sites widget to resource side panel in resource launcher
• Add SSH commands to SSH private resources in resource side panel in resource launcher
• Add Pangolin CLI commands to site install wizard as the preferred method and rename Newt to Pangolin Site
• Dependency security updates
• General UI improvements
• Various other bug fixes

Full Changelog: 1.22.2...1.23.0

How to Update

Important

Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.

View documentation

RC

A Release Candidate (RC) is a near-final software version, stable but undergoing last tests before official release. It has all features and no known bugs.

Users: Use cautiously due to potential undiscovered bugs. Not for critical systems unless prepared for issues. Report bugs.

Developers/Testers: Perform crucial final validation and thorough testing, especially of recent changes, to catch last-minute major issues.

Backup: Always back up data before installing an RC to allow rollback if problems arise.

Feedback: Provide feedback; it's vital for a robust final release.

Note

Keep a backup of the last stable database as you will be unable to update from a RC to the next stable version. Database migrations may change between release candidates and stable versions.

What's Changed

• Add support for self-service high availability in Enterprise Edition
• Add master list of all orgs to server admin panel
• Add support for more than one server admin user; promote and demote via users table in server admin panel
• Add sites widget to resource side panel in resource launcher
• Add SSH commands to SSH private resources in resource side panel in resource launcher
• Add Pangolin CLI commands to site install wizard as the preferred method and rename Newt to Pangolin Site
• Dependency security updates
• General UI improvements
• Various other bug fixes

Full Changelog: 1.22.2...1.23.0-rc.0

How to Update

Important

Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.

View documentation

Read the Announcement

Read the full announcement with discussion of new features: Pangolin 1.22: AI Gateway for Cloud and Self-Hosted Models

What's Changed

• Add configurable tab title to branding (EE) and disable flag for AI keys
• Fix js-yaml error in pangctl server commands
• Fix form submissions resetting values on some pages

Full Changelog: 1.22.1...1.22.2

How to Update

Important

AI gateway resources require the Badger Traefik plugin version v1.6.0 or greater. The migration will automatically do this if it can find the Traefik config in the standard location. Otherwise, please ensure your Badger is up to date.

Important

Private AI gateway resources require Gerbil to be on the latest version 1.5.0. The migration will NOT automatically attempt to update Gerbil. Therefore, you must manually increment your Gerbil container version.

Important

Private AI gateway resources are exclusively compatible with the latest versions of all Pangolin clients. Support for gateway functionality was implemented in all client releases issued after August 19th, 2026. If your client's most recent release predates this date, private gateway access is not yet available.

Important

Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.

View documentation

Read the Announcement

Read the full announcement with discussion of new features: Pangolin 1.22: AI Gateway for Cloud and Self-Hosted Models

What's Changed

• Add IP column filtering to tables by @Fredkiss3 in #3627
• Fix COUNTRY_IS_NOT rules to be created via Blueprints by @argueta-xyz in #3647
• Fix domain namespaces and country is not in blueprints
• Fix access token deletion for root API keys
• Fix: License.check can fail silently by @shleeable in #3597
• Fix harden initial server-admin setup against duplicate users and races
• Fix resolve security-key login only for a unique internal user
• Fix add validation for health check hostname
• Fix pull all matching users into blueprint instead of one
• Improvement show warning when changing idp identifier mapping
• Update dependencies

Full Changelog: 1.21.1...1.22.0

New Contributors

• @argueta-xyz made their first contribution in #3647
• @iMord0 made their first contribution in #3654
• @moverq1337 made their first contribution in #3655
• @aithal007 made their first contribution in #3628

How to Update

Important

AI gateway resources require the Badger Traefik plugin version v1.6.0 or greater. The migration will automatically do this if it can find the Traefik config in the standard location. Otherwise, please ensure your Badger is up to date.

Important

Private AI gateway resources require Gerbil to be on the latest version 1.5.0. The migration will NOT automatically attempt to update Gerbil. Therefore, you must manually increment your Gerbil container version.

Important

Private AI gateway resources are exclusively compatible with the latest versions of all Pangolin clients. Support for gateway functionality was implemented in all client releases issued after August 19th, 2026. If your client's most recent release predates this date, private gateway access is not yet available.

Important

Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.

View documentation

Read the Announcement

Read the full announcement with discussion of new features: Pangolin 1.22: AI Gateway for Cloud and Self-Hosted Models

What's Changed

• Add AI gateway public resources
• Add AI gateway private resources
• Add AI gateway providers for cloud and self-hosted models
• Add AI gateway session logging and cost, token, and usage analytics
• Add AI gateway identity-based and machine virtual API keys
• Add AI gateway cost and token budget enforcement on roles, providers, models, resources, and virtual API keys
• Add AI gateway coding agent client configuration wizard
• Add RDP, SSH, and VNC public resources to Community Edition
• Add SSH and HTTPS private resources to Community Edition
• Add certificate status tracking to Community Edition
• Add ability to mock test an alert action in alerts
• Add support for labels in blueprints
• Fix log retention access pulling from wrong org settings field
• Fix refresh buttons not always fetching new date on logs tables
• Dependency security updates
• General UI improvements
• Various other bug fixes

Full Changelog: 1.21.1...1.22.0

How to Update

Important

AI gateway resources require the Badger Traefik plugin version v1.6.0 or greater. The migration will automatically do this if it can find the Traefik config in the standard location. Otherwise, please ensure your Badger is up to date.

Important

Private AI gateway resources require Gerbil to be on the latest version 1.5.0. The migration will NOT automatically attempt to update Gerbil. Therefore, you must manually increment your Gerbil container version.

Important

Private AI gateway resources are exclusively compatible with the latest versions of all Pangolin clients. Support for gateway functionality was implemented in all client releases issued after August 19th, 2026. If your client's most recent release predates this date, private gateway access is not yet available.

Important

Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.

View documentation

RC

A Release Candidate (RC) is a near-final software version, stable but undergoing last tests before official release. It has all features and no known bugs.

Users: Use cautiously due to potential undiscovered bugs. Not for critical systems unless prepared for issues. Report bugs.

Developers/Testers: Perform crucial final validation and thorough testing, especially of recent changes, to catch last-minute major issues.

Backup: Always back up data before installing an RC to allow rollback if problems arise.

Feedback: Provide feedback; it's vital for a robust final release.

Note

Keep a backup of the last stable database as you will be unable to update from a RC to the next stable version. Database migrations may change between release candidates and stable versions.

What's Changed

• Add AI gateway public resources
• Add AI gateway private resources
• Add AI gateway providers for cloud and self-hosted models
• Add AI gateway session logging and cost, token, and usage analytics
• Add AI gateway identity-based and machine virtual API keys
• Add AI gateway cost and token budget enforcement on roles, providers, models, resources, and virtual API keys
• Add AI gateway coding agent client configuration wizard
• Add RDP, SSH, and VNC public resources to Community Edition
• Add SSH and HTTPS private resources to Community Edition
• Add certificate status tracking to Community Edition
• Add ability to mock test an alert action in alerts
• Add support for labels in blueprints
• Fix log retention access pulling from wrong org settings field
• Fix refresh buttons not always fetching new date on logs tables
• Dependency security updates
• General UI improvements
• Various other bug fixes

Full Changelog: 1.21.1...1.22.0-rc.0

How to Update

Important

Private AI gateway resources require Gerbil to be on the latest version 1.5.0. The migration will NOT automatically attempt to update Gerbil. Therefore, you must manually increment your Gerbil container version.

Important

AI gateway resources require the Badger Traefik plugin version v1.6.0 or greater. The migration will automatically do this if it can find the Traefik config in the standard location. Otherwise, please ensure your Badger is up to date.

Important

Private AI gateway resources are exclusively compatible with the latest versions of all Pangolin clients. Support for gateway functionality was implemented in all client releases issued after August 19th, 2026. If your client's most recent release predates this date, private gateway access is not yet available.

Important

Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.

View documentation

Read the 1.21 Announcement

Read the full announcement with discussion of new features: Pangolin 1.21: Same Network Detection

What's Changed

• Fix IdP org ownership on save policy (ref #3290)
• Fix newt command on credentials screen
• Fix labels dropdown flicker if no changes applied by @Fredkiss3 in #3468
• Fix redirect to /auth/initial-setup after hitting auth rate limit by @Adityakk9031 in #3410
• Fix Punycode domain validation by @shubhamsinnh in #3460
• Improve batch status histories by @Fredkiss3 in #3469

Security updates

New Contributors

• @shubhamsinnh made their first contribution in #3460

Full Changelog: 1.21.0...1.21.1

How to Update

Important

Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.

View documentation

Read the 1.21 Announcement

Read the full announcement with discussion of new features: Pangolin 1.21: Same Network Detection

What's Changed

• Add same network detection for clients and sites, so connection don’t relay when they are on the same network (requires updated clients and sites)
• Add option to associate an access token (share link) to a specific account user
• Add optional access token (share link) session persistence when access token is passed via a query parameter or a header, so they don't have to passed on every request
• Add remember last used IdP and mark as last used
• Add enabled toggle to private resources
• Add pending resource state to resources created on a pending site via a provisioning key and provisioning blueprint
• Add clean up pending resources if reject pending site
• Add site provisioning key routes to integration API
• Improve integration API for consistency in PUT/PATCH, route naming, and Swagger organization
• Fix improper query param encoding for email addresses preventing + characters in emails
• Dependency security updates
• General UI improvements
• Various other bug fixes

Full Changelog: 1.20.0...1.21.0

How to Update

Important

Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.

View documentation

RC

A Release Candidate (RC) is a near-final software version, stable but undergoing last tests before official release. It has all features and no known bugs.

Users: Use cautiously due to potential undiscovered bugs. Not for critical systems unless prepared for issues. Report bugs.

Developers/Testers: Perform crucial final validation and thorough testing, especially of recent changes, to catch last-minute major issues.

Backup: Always back up data before installing an RC to allow rollback if problems arise.

Feedback: Provide feedback; it's vital for a robust final release.

Note

Keep a backup of the last stable database as you will be unable to update from a RC to the next stable version. Database migrations may change between release candidates and stable versions.

What's Changed

• Add same network detection for clients and sites, so connection don’t relay when they are on the same network (requires updated clients and sites)
• Add option to associate an access token (share link) to a specific account user
• Add optional access token (share link) session persistence when access token is passed via a query parameter or a header, so they don't have to passed on every request
• Add remember last used IdP and mark as last used
• Add enabled toggle to private resources
• Add pending resource state to resources created on a pending site via a provisioning key and provisioning blueprint
• Add clean up pending resources if reject pending site
• Add site provisioning key routes to integration API
• Fix improper query param encoding for email addresses preventing + characters in emails
• Dependency security updates
• General UI improvements
• Various other bug fixes

Full Changelog: 1.20.0...1.21.0-rc.0

How to Update

Important

Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.

View documentation

Read the 1.20 Announcement

Read the full announcement with discussion of new features: Pangolin 1.20: Resource Launcher & Global Command Palette

What's Changed

• Add resource launcher page with configurable and savable views; available to non-admins and admins (CE)
• Add global command palette to navigate the dashboard and search for sites and resources (CE)
• Add Country Is Not matching type to resource geoblocking rules (CE)
• Add username field to VNC auth form; now works with macOS (CE)
• Improve private resource edit and create UI consistency to match dashboard UX patterns (migrate from dialog to dedicated pages)
• Release EE feature gate on labels feature
• Fix redirect back to resource after completing session expired checkpoint
• Dependency security updates
• General UI improvements
• Various other bug fixes

New Contributors

• @jaisinha77777 made their first contribution in #3369

Full Changelog: 1.19.4...1.20.0

How to Update

Important

Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.

View documentation

RC

A Release Candidate (RC) is a near-final software version, stable but undergoing last tests before official release. It has all features and no known bugs.

Users: Use cautiously due to potential undiscovered bugs. Not for critical systems unless prepared for issues. Report bugs.

Developers/Testers: Perform crucial final validation and thorough testing, especially of recent changes, to catch last-minute major issues.

Backup: Always back up data before installing an RC to allow rollback if problems arise.

Feedback: Provide feedback; it's vital for a robust final release.

Note

Keep a backup of the last stable database as you will be unable to update from a RC to the next stable version. Database migrations may change between release candidates and stable versions.

What's Changed

• Add resource launcher page with configurable and savable views; available to non-admins and admins
• Add global command palette to navigate the dashboard and search for sites and resources
• Add Country Is Not matching type to resource geoblocking rules
• Improve private resource edit and create UI consistency to match dashboard UX patterns (migrate from dialog to dedicated pages)
• Release EE feature gate on labels feature
• Fix redirect back to resource after completing session expired checkpoint
• Dependency security updates
• General UI improvements
• Various other bug fixes

New Contributors

• @jaisinha77777 made their first contribution in #3369

Full Changelog: 1.19.4...1.20.0-rc.0

How to Update

Important

Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.

View documentation

Read the 1.19 Announcement

Read the full announcement with discussion of new features: Pangolin 1.19: Browser Remote Access — SSH, RDP, VNC & More

What's Changed

Refer to the original 1.19 notes for a complete list of what changed since 1.18.

Fix newly created clients from logging in on a new device or adding a new user causing a No client found for provided orgId error

Note

If this effects you please update to this version then delete the user using the server admin panel, invite them back, and have them reauthenticate in their client.

Full Changelog: 1.19.3...1.19.4

How to Update

Warning

This version includes a new mode of private resource: SSH. If you had previously used host resources and configured the SSH access tab, you will now need to switch these to SSH resources in order to manage the SSH config. If you do not switch they will continue to function as before but you will be unable to adjust settings.

Important

1.19 browser-based SSH requires the Badger Traefik plugin to be on the latest version v1.4.1. The migration will automatically do this if it can find the Traefik config in the standard location BUT YOU WILL NEED TO RESTART TRAEFIK TO PULL THE NEW PLUGIN. Otherwise, please ensure your Badger is up to date.

Important

Browser-based RDP, SSH, and VNC as well as the new Pangolin SSH mode requires Newt version 1.13.0 or greater.

Important

Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.

View documentation

Read the 1.19 Announcement

Read the full announcement with discussion of new features: Pangolin 1.19: Browser Remote Access — SSH, RDP, VNC & More

What's Changed

Refer to the original 1.19 notes for a complete list of what changed since 1.18.

• Add update notifications for different client types
• Add delete resources associated with site
• Add country flags
• Add warning about not using .local aliases
• Fix no data in status history when last data was over 90 days ago
• Fix split by space causing issues with commands in role form
• Fix inconsitant query params for limit and page size by enforcing strict inputs
• Fix inconsistant API data in get vs update with policies
• Fix request logs not loading on initial page open in CE
• Fix remove NoNewPrivileges from default systemd install
• Fix ALL ASN not allowed as an input
• Fix add missing delete global idp route to integration api
• Fix unescaped regex chars in rules
• Fix supporter footer on resource login page to remove supporter
• Improve efficiency and concurrency when changing site resources
• Improve org policy error message responses

New Contributors

• @kshitijshresth made their first contribution in #3251
• @gmpinder made their first contribution in #3206
• @mr1beast made their first contribution in #3336

Full Changelog: 1.19.2...1.19.3

How to Update

Warning

This version includes a new mode of private resource: SSH. If you had previously used host resources and configured the SSH access tab, you will now need to switch these to SSH resources in order to manage the SSH config. If you do not switch they will continue to function as before but you will be unable to adjust settings.

Important

1.19 browser-based SSH requires the Badger Traefik plugin to be on the latest version v1.4.1. The migration will automatically do this if it can find the Traefik config in the standard location BUT YOU WILL NEED TO RESTART TRAEFIK TO PULL THE NEW PLUGIN. Otherwise, please ensure your Badger is up to date.

Important

Browser-based RDP, SSH, and VNC as well as the new Pangolin SSH mode requires Newt version 1.13.0 or greater.

Important

Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.

View documentation