Release Notes for v0.80.0

What's New

🔒 Security and Access Control

• Refused to pin an agent network gateway onto another account's host, adding cross-account validation for gateway assignments. #7519
• Validated proxy cluster on Agent Network bootstrap, preventing an agent network from bootstrapping onto another account's proxy cluster. #7402
• Refused HTTP redirects on IdP clients, preventing open redirect attacks against identity provider integrations. #7579
• Revoked local Dex session on embedded IdP password change, ensuring sessions are properly invalidated when credentials are updated. #7556
• Added upload URL signing and rate limiting for file upload endpoints. #7502

🖥️ Client Improvements

• Staged install script downloads in a private temp directory, preventing other processes from tampering with downloaded files before installation. #7534
• Enforced HTTPS on install script downloads, ensuring all client downloads use secure connections. #7545
• Fixed peers not being notified when the relay connection drops, which could leave stale peer state after a relay disconnect. #7490
• Fixed session deadline read under the status read lock, preventing a potential race condition. #7550
• Removed the empty GPO DNS policy store on Windows teardown, cleaning up leftover DNS policy entries when the client shuts down. #7563
• Resolved the shared socket source address through a connected UDP probe socket, fixing source address resolution for shared socket mode. #7633
• Validated saved service parameters and pinned the netsh lookup on Windows, hardening the service configuration path. #7584
• Used POSIX-style file read/write of JSON on Windows, improving cross-platform config file handling. #7631
• Raised the daemon IPC receive limit to 16 MB, matching gRPC's default and preventing truncation of large messages. #7676
• Skipped route firewall rule computation when no firewall is configured, avoiding unnecessary work. #7624
• Fixed device dump clearing all peer endpoints instead of just the target one, which could disrupt connections to other peers. #7632
• Fixed Windows IPC privilege check to only treat LocalSystem as a privileged identity by SID. Local Service and Network Service now go through the same checks as any other caller. #7889
• Bumped Wails to v3.0.0-beta.25 for the desktop UI. #7640

⚙️ Management Improvements

• Sped up test store setup and summarized unit test runs, improving CI performance. #7518
• Read X-Real-IP when extracting the peer connection IP, supporting deployments behind reverse proxies. #7561
• Handled empty trusted peer to avoid errors when no trusted peer is configured. #7589
• Named the account owner in the pending approval error, making it clear who to contact for account approval. #7533
• Fixed group resource validation for proper enforcement. #7608
• Added store support to filter by public ID. #7208
• Recorded proxy version on connect for tracking and debugging. #7630
• Split store by table for improved database performance and organization. #7646
• Prevented deleting custom domains used by services, protecting active proxy configurations from accidental removal. #7515
• Moved rate limiter to shared package for reuse across services. #7727
• Let usage_viewer read Agent Network access logs, so users reviewing cost can now see the requests behind usage metrics. #7750

🔀 Reverse Proxy

• Closed the client connection on private service denials instead of leaving it hanging. #7590
• Added proxy rate limiter to protect against abuse. #7568
• Added proxy credentials limiter on management to throttle authentication attempts. #7569
• Fixed upstream HTTP version applied before cloning transports. #7806
• Added release-wired UBI image variant for the proxy. #7464
• Fixed flow auth secret for external Relay migrations. #7731

🏗️ Infrastructure and CI

• Certified the rootless UBI client image on release for Red Hat ecosystem compliance. #7525
• Fixed RPM metadata for Red Hat software certification (two rounds of fixes). #7562, #7614
• Added proxy support to enterprise setup. #7651
• Built the upload server from source, nonroot on Chainguard for a hardened container image. #7663
• Built and linted mobile Go code in CI for Android. #7641
• Bumped workflow actions off the retired Node 20 runtime. #7644
• Added Pyroscope profiling to management, signal, and proxy services. #7536
• Pointed the agent-config e2e providers at the mock upstream. #7542
• Used the Silo image for the S3 upload test. #7619

📝 Misc

• Pointed bug reports at Discussions and added SUPPORT.md. #7647
• Added cloud API spec to the public OpenAPI definition with REST client. #7222
• Loaded AGENTS.md every session and refused attribution trailers. #7544

What's Changed

• [management] Speed up test store setup and summarize the unit test run by @mlsmaycon in #7518
• [management] Refuse to pin an agent network gateway onto another account's host by @mlsmaycon in #7519
• [management] Validate the proxy cluster an agent network bootstraps onto by @mlsmaycon in #7402
• [management] Point the agent-config e2e providers at the mock upstream by @mlsmaycon in #7542
• [client] Stage install script downloads in a private temp directory by @riccardomanfrin in #7534
• [client] Read the session deadline under the status read lock by @pappz in #7550
• [client] Enforce HTTPS on install script downloads by @riccardomanfrin in #7545
• [misc] Load AGENTS.md every session and refuse attribution trailers by @mlsmaycon in #7544
• [client] Fix - Add RPM metadata required for Red Hat software certification by @braginini in #7562
• [management] Read X-Real-IP when extracting the peer connection IP by @bcmmbaga in #7561
• [management] Handle empty trusted peer by @bcmmbaga in #7589
• [proxy] Close the client connection on private service denials by @mlsmaycon in #7590
• [management] Name the account owner in the pending approval error by @heisbrot in #7533
• [proxy] add proxy rate limiter by @pascal-fischer in #7568
• [management] Add proxy credentials limiter on management by @pascal-fischer in #7569
• [client] Fix peers not being notified when the relay connection drops by @pappz in #7490
• [management] fix group resource validation by @pascal-fischer in #7608
• [client] Remove the empty GPO DNS policy store on Windows teardown by @lixmal in #7563
• [management] add store support to filter by public id by @pascal-fischer in #7208
• [client,management] Skip route firewall rule computation when no firewall by @riccardomanfrin in #7624
• [management] record proxy version on connect by @pascal-fischer in #7630
• [management,signal,proxy] add pyroscope profiling by @pascal-fischer in #7536
• [client] Validate the saved service parameters and pin the netsh lookup by @riccardomanfrin in #7584
• [client] Use POSIX style file read/write of json for windows by @theodorsm in #7631
• [client] Fix RPM metadata for Red Hat certification by @braginini in #7614
• [misc] Bump workflow actions off the retired Node 20 runtime by @heisbrot in #7644
• [misc] Add upload URL signing and rate limiting by @bcmmbaga in #7502
• [misc] Use the Silo image for the S3 upload test by @Silex in #7619
• [management] split store by table by @pascal-fischer in #7646
• [management] Refuse HTTP redirects on IdP clients by @bcmmbaga in #7579
• [management] Revoke local Dex session on embedded IdP password change by @bcmmbaga in #7556
• [misc, android] Build and lint the mobile Go code in CI by @riccardomanfrin in #7641
• [client] Raise the daemon IPC receive limit gRPC's to 16 MB by @riccardomanfrin in #7676
• [misc] Build the upload server from source, nonroot on Chainguard by @bison in #7663
• [infrastructure] Certify the rootless UBI client image on release by @braginini in #7525
• [client] Resolve the shared socket source address through a connected UDP probe socket by @lixmal in #7633
• [proxy] Add a release-wired UBI image variant by @jnfrati in #7464
• [infrastructure] Add proxy support to enterprise setup by @bcmmbaga in #7651
• [doc] Point bug reports at Discussions and add SUPPORT.md by @thomashacker in #7647
• [management] Prevent deleting custom domains used by services by @mlsmaycon in #7515
• [management] move rate limiter to shared package by @pascal-fischer in #7727
• [client] Bump wails to v3.0.0-beta.25 by @pappz in #7640
• [client] Stop dumping the whole device to clear one peer endpoint by @lixmal in #7632
• [infrastructure] Fix flow auth secret for external Relay migrations by @braginini in #7731
• [proxy] Apply the upstream HTTP version before cloning transports by @mlsmaycon in #7806
• [management] Let usage_viewer read Agent Network access logs by @jnfrati in #7750
• [client] Only treat LocalSystem as a privileged identity by SID on Windows by @lixmal in #7889

New Contributors

• @thomashacker made their first contribution in #7647

Full Changelog: v0.79.0...v0.80.0

Changelog

• 7a53a7b [proxy] Apply the upstream HTTP version before cloning transports (#7806) (#7813)
• da483ab [client] Stop dumping the whole device to clear one peer endpoint (#7632) (#7741)
• 6441417 [infrastructure] Fix flow auth secret for external Relay migrations (#7731) (#7737)

What's Changed

• [management] Speed up test store setup and summarize the unit test run by @mlsmaycon in #7518
• [management] Refuse to pin an agent network gateway onto another account's host by @mlsmaycon in #7519
• [management] Validate the proxy cluster an agent network bootstraps onto by @mlsmaycon in #7402
• [management] Point the agent-config e2e providers at the mock upstream by @mlsmaycon in #7542
• [client] Stage install script downloads in a private temp directory by @riccardomanfrin in #7534
• [client] Read the session deadline under the status read lock by @pappz in #7550
• [client] Enforce HTTPS on install script downloads by @riccardomanfrin in #7545
• [misc] Load AGENTS.md every session and refuse attribution trailers by @mlsmaycon in #7544
• [client] Fix - Add RPM metadata required for Red Hat software certification by @braginini in #7562
• [management] Read X-Real-IP when extracting the peer connection IP by @bcmmbaga in #7561
• [management] Handle empty trusted peer by @bcmmbaga in #7589
• [proxy] Close the client connection on private service denials by @mlsmaycon in #7590
• [management] Name the account owner in the pending approval error by @heisbrot in #7533
• [proxy] add proxy rate limiter by @pascal-fischer in #7568
• [management] Add proxy credentials limiter on management by @pascal-fischer in #7569
• [client] Fix peers not being notified when the relay connection drops by @pappz in #7490
• [management] fix group resource validation by @pascal-fischer in #7608
• [client] Remove the empty GPO DNS policy store on Windows teardown by @lixmal in #7563
• [management] add store support to filter by public id by @pascal-fischer in #7208
• [client,management] Skip route firewall rule computation when no firewall by @riccardomanfrin in #7624
• [management] record proxy version on connect by @pascal-fischer in #7630
• [management,signal,proxy] add pyroscope profiling by @pascal-fischer in #7536
• [client] Validate the saved service parameters and pin the netsh lookup by @riccardomanfrin in #7584
• [client] Use POSIX style file read/write of json for windows by @theodorsm in #7631
• [client] Fix RPM metadata for Red Hat certification by @braginini in #7614
• [misc] Bump workflow actions off the retired Node 20 runtime by @heisbrot in #7644
• [misc] Add upload URL signing and rate limiting by @bcmmbaga in #7502
• [misc] Use the Silo image for the S3 upload test by @Silex in #7619
• [management] split store by table by @pascal-fischer in #7646
• [management] Refuse HTTP redirects on IdP clients by @bcmmbaga in #7579
• [management] Revoke local Dex session on embedded IdP password change by @bcmmbaga in #7556
• [misc, android] Build and lint the mobile Go code in CI by @riccardomanfrin in #7641
• [client] Raise the daemon IPC receive limit gRPC's to 16 MB by @riccardomanfrin in #7676
• [misc] Build the upload server from source, nonroot on Chainguard by @bison in #7663
• [infrastructure] Certify the rootless UBI client image on release by @braginini in #7525
• [client] Resolve the shared socket source address through a connected UDP probe socket by @lixmal in #7633
• [proxy] Add a release-wired UBI image variant by @jnfrati in #7464
• [infrastructure] Add proxy support to enterprise setup by @bcmmbaga in #7651
• [doc] Point bug reports at Discussions and add SUPPORT.md by @thomashacker in #7647
• [management] Prevent deleting custom domains used by services by @mlsmaycon in #7515
• [management] move rate limiter to shared package by @pascal-fischer in #7727
• [client] Bump wails to v3.0.0-beta.25 by @pappz in #7640

New Contributors

• @thomashacker made their first contribution in #7647

Full Changelog: v0.79.0-rc.1...v0.80.0-rc.1

Release Notes for v0.79.0

New Feature: Desktop Light Mode

The desktop app now gives you three appearance options: System, Light, and Dark. Follow your operating system's theme or choose the look you prefer. The new light theme covers the connection view, settings, profiles, and dialogs, with matching native window appearance on Windows, macOS, and Linux. #7344 by @TechHutTV

This release also brings shared MDM policy enforcement to the mobile SDKs, a rootless Red Hat UBI container image, and improvements to DNS, relay connections, and reverse proxy access controls.

What's Changed

Desktop Client Improvements

• Fixed a Windows tray deadlock that could freeze the app when a double-click opened a window while another window was still being created. #7449 by @pappz
• Fixed the MDM settings snapshot so the UI correctly reports when remote jobs are managed by policy. #7485 by @pappz

Client Improvements

• Added MDM policy bridges and shared enforcement for the iOS and Android SDKs, keeping managed settings and profile restrictions consistent with the desktop client. #6435 by @riccardomanfrin
• Accepted MDM boolean values delivered as JSON numbers, so policies using 0 and 1 are applied correctly. #7471 by @riccardomanfrin
• Compared MDM-managed URLs by their normalized endpoints, avoiding false conflicts between equivalent URLs. #7472 by @riccardomanfrin
• Refreshed system information on every management sync reconnect, keeping local network addresses and posture information current after network changes. #7409 by @pappz
• Used host prefixes for Android TUN addresses so local network protection does not classify the entire overlay as a local network. #7414 by @pappz
• Replaced the eBPF DNS forwarder with UDP and TCP DNAT rules when the resolver cannot listen on port 53, with rollback and cleanup for incomplete redirects. #7439 by @lixmal
• Fixed a relay address race that could advertise a URL and IP from different connections during a reconnect. #7498 by @pappz
• Returned the context cancellation or timeout error when an SSH handshake is interrupted. #7426 by @pappz
• Updated wireguard-go to 8bf8fa968f1a, fixing keepalive buffer-pool stalls, keeping timer paths non-blocking, and making netstack interface shutdown idempotent. #7532 by @pappz
• Allowed buffer-pool limits to be adjusted while a device is stalled, and bounded proxy-wide updates so one stuck client does not block the others. #7452 by @riccardomanfrin

Management Improvements

• Restored networks using individual peers as routers in the SQLite network map when peer_groups is empty or null. #7418 by @mlsmaycon
• Fixed SQLite network-map reads for users with null automatic groups and expanded coverage for empty and null router groups. #7425 by @dmitri-netbird
• Included offline peers when scheduling login expiration and ensured expired peers are disconnected, while protecting peers that have just logged in again. #7467 by @pascal-fischer
• Applied duplicate-key sync protection to user-owned peers as well as peers registered with setup keys. #7427 by @pascal-fischer
• Validated that a peer exists before adding it to a group. #7486 by @pascal-fischer
• Prevented other users from deleting the account owner. #7456 by @pascal-fischer
• Hardened OIDC issuer validation by requiring HTTPS, rejecting credentials, query strings, and fragments in issuer URLs, refusing discovery redirects, and limiting discovery response size. #7435 by @bcmmbaga
• Cleaned up resources when WebSocket-to-gRPC proxy connections close. #7484 by @dmitri-netbird

Agent Network

• Added managed proxy provisioning endpoints and response types to the API specification. #7433 by @bison
• Prevented deletion of groups referenced by Agent Network budget rules, preserving the rules' spending limits. #7450 by @Tyagiquamar

Reverse Proxy Improvements

• Added NB_PROXY_UPSTREAM_HTTP_VERSION with auto, 1.1, and 2 options. The default auto mode negotiates with HTTPS upstreams and falls back to HTTP/1.1 when an upstream's negotiated HTTP/2 connection fails at the protocol level. #7410 by @lixmal
• Enforced group access both when issuing session cookies and when accepting existing sessions. #7240 by @lixmal
• Required custom domain validation before creating a service or moving one to a different custom domain. #7341 by @mlsmaycon
• Added a 48-hour validation window for custom domain registrations. Existing pending registrations receive a fresh window on upgrade; expired registrations are removed unless they still have services attached. #7497 by @mlsmaycon
• Rejected unsupported direct-upstream IP addresses, including loopback, multicast, link-local, and IPv6 addresses with zone identifiers. #7400 by @dmitri-netbird
• Validated domain names before creating certificate lock files. #7501 by @pascal-fischer

Self-Hosting Improvements

• Added a rootless Red Hat UBI image for AMD64 and ARM64, published with the 0.79.0-rootless-ubi tag. #7469 by @jnfrati
• Supported arbitrary non-root UIDs without a passwd entry, as used by OpenShift. #7440 by @jnfrati
• Added RPM dependencies, license and documentation files, a generated changelog, and an example /etc/sysconfig/netbird to meet Red Hat software certification packaging requirements. #7562, #7573 by @mlsmaycon
• Kept deployments using the embedded identity provider on a single account, with stricter configuration checks and migration handling. #7380 by @bcmmbaga
• Passed the combined server's TLS configuration through to the management listener. #7499 by @pascal-fischer
• Updated peer connection-IP extraction to honor configured TrustedPeers, with X-Forwarded-For taking precedence over X-Real-IP. The final release preserves trust in all IPv4 and IPv6 sources when TrustedPeers is empty; configure your reverse proxy's address or network to restrict which sources can supply forwarded-IP headers. #7454, #7589 by @bcmmbaga; #7561, #7577 by @dmitri-netbird and @bcmmbaga

Internal, CI, and Docs

• Added atomic SetNX and GetDel cache operations. #7084 by @bcmmbaga
• Allowed binaries embedding management to extend its command tree. #7483 by @bison
• Extracted peer update handling and added test coverage. #7338 by @dmitri-netbird
• Replaced a hard-coded temporary directory in WebSocket adapter tests with the platform's temporary directory. #7503 by @dmitri-netbird
• Switched the MinIO test image to quay.io after it became unavailable on Docker Hub. #7516 by @Silex
• Preserved image variant suffixes in snapshot tags. #7511 by @jnfrati
• Skipped the protobuf breaking-change check on branch-creation pushes, which have no previous commit to compare against. #7411 by @bison

---

Full Changelog: v0.78.0...v0.79.0

Changelog

• a54d96c [proxy] Make the upstream HTTP version configurable (#7410)
• 2d28f90 [client] Fix the Windows tray deadlock on re-entrant window creation (#7449)
• 0f797f8 [client] Bump wireguard-go to 8bf8fa968f1a (#7532)
• 7914010 [management] Prevent deleting groups referenced by agent network budget rules (#7450)
• 973173b [misc] Pull the MinIO test image from quay.io (#7516)
• 82b1c7d [management] Harden OIDC issuer validation and discovery (#7435)
• b789ffb [management] Expire unvalidated custom domain registrations (#7497)
• ec0c36b [client] Add light mode with system, light, and dark theme options (#7344)
• f422c41 [management] extract peer update logic and wrap it in tests (#7338)
• 794956a [client] Fix relay instance address race (#7498)
• 58114f9 [management] Only trust forwarded-IP headers from configured trusted peers (#7454)
• b57f0e5 [infrastructure] Preserve snapshot image variant tags (#7511)
• ad3f570 [management] validate the domain for the flock in proxy (#7501)
• 1047df5 [management] pass tls config for combined server (#7499)
• add8a75 [management] validate peer existence when adding to group (#7486)
• a419e77 [client, proxy] Make the buffer-pool retune reachable while a device is stalled (#7452)
• 2f48dbe [client] Add a release-wired rootless UBI image variant (#7469)
• e704203 [management] do not hard-code tmp dir path in ws_conn_adapter_test (#7503)
• 0fac1ee [management] cleanup resources when ws-grpc proxy connection goes away (#7484)
• 9615d2a [client] Report the remote jobs key in the MDM UI snapshot (#7485)
• 15a6842 [client] Support arbitrary UIDs in rootless image (#7440)
• 21b4a83 [management] Refuse services on unvalidated custom domains (#7341)
• 27991aa [management] Let embedding binaries extend the command tree (#7483)
• 269cbad [management] expire and disconnect peers while including offline peers (#7467)
• d101f6c [client] Redirect DNS port 53 with UDP and TCP DNAT instead of the eBPF forwarder (#7439)
• d2e62e3 [client] Compare MDM-managed URLs as endpoints, not as strings (#7472)
• bb4de1d [client] Read MDM boolean keys delivered as JSON numbers (#7471)
• 7a62d63 [management] fix delete of owner user (#7456)
• e14006d [client] mobile MDM bridge — iOS + Android setMDMPolicyFetcher entrypoint (#6435)
• 15c0a29 [client] Return the context error when the SSH handshake fails with it (#7426)
• 76ea722 [management] Add Agent Network managed proxy to the API spec (#7433)
• 0000381 [management] update network_router_test to verify empty and nil peer_groups (#7425)
• 5cb6b0d [client] Assign the Android TUN address as a host prefix (#7414)
• 8253898 [client] Gather fresh system info on every management sync stream connect (#7409)
• 0bdfa42 [management] blocking sync requests for user peers sharing the same wireguard key (#7427)
• 066af82 [management] Keep embedded IdP deployments on a single account (#7380)
• 13ab50b [management] Add SetNX and GetDel cache store operations (#7084)
• c455a4a [management] disallow weird ip addresses for direct upstream hosts (#7400)
• 8dc4272 [management] Serve networks with peer-based routers from the SQLite network map (#7418)
• c2b5d21 [management] Enforce reverse proxy group access before minting and when honouring a session cookie (#7240)
• 798e4a0 [misc] Skip the protobuf breaking check on branch-creation pushes (#7411)

What's Changed

• [client] Fix the Windows tray deadlock on re-entrant window creation by @pappz in #7537
• [client] Bump wireguard-go to 8bf8fa968f1a by @pappz in #7538

Full Changelog: v0.78.1...v0.78.2

What's Changed

• [management] Serve networks with peer-based routers from the SQLite network map by @mlsmaycon in #7424

Full Changelog: v0.78.0...v0.78.1

Release Notes for v0.78.0

Highlights

• Rosenpass now works through the embedded reverse proxy (#6763). Until now the proxy ran no
  Rosenpass at all, so peers with Rosenpass enabled failed to establish through it on a PSK
  mismatch — an incompatibility that was never documented. The proxy now runs Rosenpass in
  permissive mode, so it connects both to Rosenpass-enabled peers and, exactly as before, to
  peers without it. NB_PROXY_ROSENPASS=false turns it off.
• Lazy connections reworked: per-peer lazy state, proxy peers lazy by default, and the lazy
  exclusion list removed (#6762, #6763).
• Agent Network / LLM gateway: agentgateway integration, access roles and self-service
  endpoints, Bedrock model discovery served from the control plane, guardrail allowlists for
  declared model ids, and the endpoint conformed to the LLM gateway protocol
  (#7274, #7221, #7250, #7239, #7154, #7389, #7246).
• DNS on Windows: a catch-all NRPT rule when NetBird is the primary resolver (#7071), closing
  the leak/poisoning window towards the system resolvers.
  Use netbird service reconfigure --service-env NB_USE_LEGACY_DNS_RESOLUTION=true to restore the old behavior.
• Local Prometheus metrics endpoint on the client (#6689).
• Go 1.26 and go-quic v0.62.0 across client, relay and management (#7359).
• Unified ACL filtering for peers and routes, with multi-source rules (#6322). An internal
  refactor: no change is expected for standard deployments.
• Ukrainian localization for the desktop client (#7035).

Behaviour changes

• Remote jobs (remote debug bundle and friends) are now behind an admin opt-in, with MDM
  support (#7153). Anyone using them without the opt-in has to enable it.
• Remote debug bundle jobs accept an anonymization level and an upload URL (#7147).
• The client stays connected during the login command (#7384).
• Logging out of the active profile is allowed even when profiles are disabled (#7360).
• Profiles resolve for the invoking sudo user rather than for root (#7238).
• NetBird traffic stays out of third-party fwmark rules (#7314).
• GUI windows are created on demand and destroyed on close (#7096).
• Android split tunnelling: the mode is typed rather than stored as a string, and settings are
  kept per profile (#7387, #7349).

Security / hardening

• The cached SSH JWT is bound to the local caller that obtained it (#7378).
• The WireGuard key is no longer logged on a parse failure (#7379).
• The client asks the OS for privileges when a guarded SSH setting is changed (#7066).
• The proxy validates header auth (#7263).
• Management checks a provider's URL and credential before saving them (#7301).
• Clarified that X-Peer-ID on metrics ingest is not a credential (#7363).
• The old math/rand library is gone from management (#6836).

Client — fixes

• Fixed the ICEBind races that wedge interface creation (#7377).
• agentConnecting is dropped whenever the ICE session state clears (#7327).
• A peer offer or answer arriving before the handshaker starts listening is held rather than lost
  (#7255).
• Connections are swept on network loss through a shared netevents manager (#7254).
• Route selection survives an invalid request and is applied on a partial one (#7292).
• The session-expiration dialog closes only on renewal (#7337).
• A still-locked updater binary is tolerated when cleaning up after an update (#7286).
• Fixed context cancellation during restart on iOS (#7329).
• iOS SSO logins reuse the profile's account (#7193).
• The iOS profile manager was migrated from Swift to Go (#6528).
• The PCP implementation moved to the go-nat fork (#7282).
• Reverted multi-buffer support declared for the loopback XDP program (#7303).
• The Android TUN is renewed only when the routes it carries actually change (#7396).
• Overlay listeners are rebuilt when the TUN is renewed (#7397).
• The remote jobs opt-in is exposed in the Android and iOS SDK preferences (#7406).

Management — fixes

• Fixed geolocation panics (#7382).
• Fixed private services calculation on the new db path (#7383).
• Fixed posture check evaluation for direct peers in policy definitions (#7348) and the affected
  peers calculation on a posture check flip (#7347).
• Handled the nil pointer in sendInitialSync() when the peer has been deleted (#7315).
• Network map from the nmap data type (#6919).

Self-hosted / infrastructure

• Better domain, Docker Compose and license validation in the self-hosted scripts (#7339).
• The dashboard wasm client bump is triggered by release tags (#7277).
• Protobuf breaking-change checks in CI (#7305).
• Pinned the toolchain gomobile init needs for gobind (#7291).
• Removed the mobile build validation workflow (#7302).

Upgrade notes

• Remote debug bundles now require an explicit opt-in (#7153). Bundles requested by the
  management server no longer run on a peer unless remote jobs are enabled there, with
  --allow-remote-jobs on the client or the allowRemoteJobs managed setting. Deployments
  relying on management-triggered debug bundles must opt in before they work again. The upload
  destination can now be pinned by the operator, with MDM taking precedence over the
  management-supplied value (#7147).
• The embedded proxy now runs Rosenpass in permissive mode (#6763). Peers with Rosenpass enabled
  can now use the reverse proxy, which previously failed on a PSK mismatch; peers without
  Rosenpass keep connecting exactly as before. NB_PROXY_ROSENPASS=false disables it.
• Proxy peers now default to lazy connections (#6762).

Nothing else requires action.

Full Changelog: v0.77.1...v0.78.0