Update ghcr.io/patchmon/patchmon-server Docker tag to v2.1.4
No problems upgrading the Docker container with a Docker compose yaml file by means of Watchtower DevOps resp. GitOps with dependency update facilitated by Mend's Renovate Bot.
This MR contains the following updates:
| Package | Update | Change |
|---|---|---|
| ghcr.io/patchmon/patchmon-server | patch | 2.1.3 → 2.1.4 |
Release Notes
PatchMon/PatchMon (ghcr.io/patchmon/patchmon-server)
v2.1.4: Version 2.1.4
Windows, Alpine Linux and openSUSE patching, Univention Corporate Server support, security fixes from an internal audit, working in-browser RDP, and many bug fixes.
Security
These issues were found in an internal security audit. Upgrading fixes them.
- Script injection through an SVG logo, present in released versions. An uploaded logo could run script when opened. Logos, including existing ones, are now sanitised and served sandboxed.
- Privilege escalation through roles and SSO settings. Editors could grant more access than they hold. They now cannot, and SSO provider settings need Manage Superusers.
- Sign-in hardening. Sign-in no longer reveals which accounts exist, two-factor codes are single-use, "Disable local auth" is enforced by the server, and SSO accounts are bound to their identity provider.
Behaviour changes
- Admins can no longer change another admin's role. Only a superadmin or a strictly higher role can. Only a superadmin can assign admin or use the Admin preset, and custom roles are compared by their permissions.
- Passwords ignore leading and trailing spaces everywhere, and changing a password to the same value is refused.
- Custom role names containing spaces are corrected on upgrade, signing their users out once.
- Patch selected is refused on Arch Linux. Use Patch all.
- The RDP keyboard layout defaults from the browser language.
Upgrading
docker compose pull
docker compose up -d
Database migrations run on start. Then update your agents to 2.1.4.
If you use in-browser RDP on Docker, update your docker-compose.yml before restarting. docker compose pull does not change your compose file, and the old guacd service cannot open RDP sessions. The guacd service now shares the server's network and listens on loopback only, and the server reaches it at 127.0.0.1:4822. Either replace your compose file with the new docker-compose.yml (keeping your own changes), or follow the step-by-step edit in Upgrading to 2.1.4. Then run docker compose up -d. Installs that don't use RDP need no change.
New
Patching on Windows, Alpine Linux and openSUSE, each with a dry run first. Alpine support builds on tekook's work in #863.
Univention Corporate Server (UCS), contributed by furch-services in #869. UCS hosts show their release and errata level, and Patch all installs every errata for the installed release without upgrading to a new UCS release.
Account recovery for admins. Reset a user's two-factor authentication, unlink their SSO identity, and allow superadmin password sign-in while the identity provider is down.
Worth knowing
- Upgrade the server before the agents. A 2.1.4 agent cannot send Docker data to an older server.
- Windows patch runs queued before the upgrade fail. Start new ones on the 2.1.4 agent.
- Agents now contact image registries and, on Alpine,
secdb.alpinelinux.org. Both can be turned off inconfig.yml. - Check agent auto-update on hosts added since 2.0.0. They were created with it off.
- Compliance already enabled? Click Install Scanner once, and raise your reverse proxy's body size to 40m.
- Threshold alerts no longer repeat. Set a Reminder interval under Alerts settings if you relied on that.
Every change in this release
| Issue | MR | Change |
|---|---|---|
| #1123 | #1127 | Remediation scripts lost their line breaks during XML text normalisation, collapsing multi-line fixes onto a single line |
| #1091 | #1127 | Remediation scripts could emit consecutive commands with no separator between them, so the script failed to parse |
| #1074 | #1127 | Remediation scripts left SCAP profile variables unresolved, producing invalid directives such as an empty remember=. Scripts now carry the scanned profile's values, and an unresolved variable is marked visibly rather than left blank |
| #1089 | #1127 | Profiles discovered on a host failed to resolve when a scan was requested against them |
| #1097 | #1127 | Ubuntu derivatives with their own VERSION_ID, such as Zorin OS, were scanned against content that did not apply to them, with no warning. They now use their base release's content |
| #1093 | #1127 | Scanner installation failed on Debian because apt output was read in the operator's locale. It is now queried in the C locale |
| #788 | #1127 | Cancelling a scan left the dashboard showing it as running. Cancel now marks the scan cancelled immediately, reaches a scan that has not started, uploads nothing, and warns when the agent could not be reached |
| #891 | #1127 | A host with warnings but no failed rules was counted Critical, so the overview figures did not match the findings behind them |
| #841 | #1127 | The agent's startup sync flattened on-demand compliance mode to scheduled, so hosts ran daily scans nobody had asked for |
| #1127 | A scan or scanner install aimed at an offline agent was lost. Both now retry while the agent reconnects, run as soon as it does with the chosen profile, and report a clear failure if it never arrives | |
| #1127 | Enabling compliance with OpenSCAP on a host queues the scanner install again. Hosts whose package manager cannot install it, meaning Windows, FreeBSD, Alpine and Arch, are skipped rather than queued to fail | |
| #1127 | A second scan or scanner install on a busy host is refused with a clear message instead of colliding with the one already running, and cancelling an install no longer blocks a reinstall | |
| #1127 | Paging through scan results repeated some rules and skipped others | |
| #1127 | A host's status icon, its Passed, Failed and Skipped counts and the Scan Results tab could each describe a different scan. They now agree, and the counts link through to the results already filtered | |
| #1127 | A scan that failed permanently blocked the host's next scans, and install progress from an earlier run could be credited to a newer job | |
| #1095 | Ubuntu 26.04 hosts had no OpenSCAP content to scan against, because the SSG release the image was built from predated it. The content set moves to SSG 0.1.82, which carries ssg-ubuntu2604-ds.xml |
|
| #686 | #1077 | Compliance scan results over 5MB were rejected, so scans completed on the host and never appeared. A dedicated COMPLIANCE_BODY_LIMIT now applies, defaulting to 20MB |
| #686 | #1077 | A body limit set on one endpoint could only lower the general API limit, never raise it, so raising AGENT_UPDATE_BODY_LIMIT above 5MB silently did nothing |
| #686 | #1077 | An oversized body was reported as Invalid JSON body or Invalid request body. Both endpoints now return 413 naming the limit and the setting that changes it |
| #686 | #1077 | AGENT_PING_BODY_LIMIT can now be changed from the database and the Settings page. It was previously env-only |
| #686 | #1077 | Settings showed the AGENT_UPDATE_BODY_LIMIT default as 2mb when it has been 5mb since 2.0.2 |
| #686 | #1077 | A body limit large enough to overflow removed the limit entirely instead of raising it. All four limits are now bounded at 32MB, and a larger value is reduced rather than ignored |
| #686 | #1077 | Compliance ingest rejects payloads carrying an implausible number of results, and now sits behind the agent rate limiter like every other agent endpoint |
| #686 | #1077 | The operator guide gave client_max_body_size as 16m, 20m and 25m in three places, all below what a real compliance scan needs. It now says 40m throughout |
| #1079 | #1124 | Periodic check-in failed with Invalid request body on hosts with many disk mounts, such as Kubernetes nodes, and the host silently left inventory. The AGENT_PING_BODY_LIMIT default rises from 8KB to 64KB |
| #1124 | A gb value set in the environment was ignored for AGENT_PING_BODY_LIMIT and fell back to the default, while the same value set in Settings was reduced to the 32MB ceiling. Both now reduce to the ceiling, as the operator guide says |
|
| #1124 | Server and agent move to Go 1.26.9 and current golang.org/x/net, x/text and x/crypto, clearing 15 reachable advisories in the server and 11 in the agent |
|
| #1124 | The frontend moves to axios 1.20.0, clearing 12 advisories, and to react-router-dom 6.30.6 | |
| #1124 | Removed an unused express static server left over from the two-container architecture, along with the express, express-rate-limit, http-proxy-middleware and cors dependencies it was the only consumer of | |
| #1079 | #1124, #1126 | An oversized check-in returned a bare Invalid request body with nothing identifying the cause, and the server logged nothing. It now returns 413 naming the limit and the setting that changes it, and all three agent endpoints log the rejection |
| #1079 | #1126 | The agent reported each Kubernetes CSI volume twice, once per mount, so half of its disk reporting was redundant. It now reports one entry per volume |
| #1075 | Agents on high-latency links failed self-update with context deadline exceeded at exactly 30 seconds. The download is now bounded by progress, so a slow but healthy link finishes |
|
| #1075 | Agent binaries are served compressed, taking the transfer from roughly 12MB to 5MB. Agents on 2.1.0 and later benefit as soon as the server is upgraded | |
| #1075 | Two agent self-updates could run at once and overwrite the same binary. A second update is now refused while one is running | |
| #1075 | A stalled download now reports how far it got, distinguishing a dead link from a slow one | |
| #1071, #759 | #1075 | Windows Server 2016 and 2019 LTSC reported osVersion=Unknown. The agent now falls back to ReleaseId and then the build string |
| #1067 | #1075 | The operator guide documents the manual replacement that recovers Windows agents stranded on 2.0.2, which cannot self-update |
| #1111 | #1117 | The agent installer failed silently at "Downloading PatchMon agent binary" on hosts without /usr/local/bin. It now creates the directory first |
| #1107 | #1120 | The operator guide's Compose example lacked the database, Redis and guacd healthchecks the server waits on, so the server never started. They now match the shipped docker-compose.yml |
| #1128 | The agent installer could leave a broken binary when the download failed after the old one had been moved aside, because an HTTP error body was written as the executable. The download is now verified before it replaces anything, and the previous binary is restored on failure | |
| #1128 | The agent remove script left FreeBSD hosts with the rc.d service, the patchmon_agent_enable line and the pidfile in place. It now removes all of them, and it no longer kills unrelated processes such as journalctl -u patchmon-agent whose command line mentions the agent |
|
| #1128 | Proxmox LXC auto-enrolment stopped at the first container the server rejected, with no summary. It now continues, prints enrolled, skipped and failed counts, exits non-zero when anything failed, and the dpkg recovery prompt works when the script is piped through bash |
|
| #1128 | Re-enrolling a host whose machine ID and name are already known created a duplicate host. The server now answers 409 (cloned containers that share a machine ID but carry different names still enrol separately) and both enrolment scripts skip it with a message saying the host must be removed in PatchMon first. Both auto-enrolment endpoints are now rate limited like the other agent endpoints, and hosts.machine_id gains an index (migration 000049) |
|
| #1128 | Direct-host auto-enrolment broke on host names containing quotes or backslashes and did not always send the machine ID. The payload is now escaped correctly and the machine ID is always sent | |
| #1128 | The Windows installer exchanged the one-time bootstrap token before checking for Administrator, so a non-admin run burned the token. The check now runs first. The install command shown in the UI sets a process-scoped execution policy bypass before running the script, so it works under the default Restricted policy on Windows clients | |
| #1128 | Re-running the Docker installer on an existing install replaced .env and regenerated every secret, so the server could no longer reach its own database. An existing .env is now kept and only missing keys are added. The installer's prompts now work when piped through sudo bash, --update restarts only when the pulled image differs from the running one, and Fedora 41 and later (dnf5) can add Docker's repository |
|
| #1128 | The 1.4.2 to 2.0.0 migration script only worked from the compose directory, could stop the stack before its downloads had succeeded, overwrote its own backups on a rerun and dropped a custom Compose project name. All four are fixed | |
| #1128 | CI: a manual image build with the push box ticked never pushed, and publishing a release candidate failed the changelog job. Both fixed | |
| #1128 | Removed tools/diagnostics.sh. It only recognised the retired native Node install, so on every supported deployment it reported that no PatchMon installation was found |
|
| #1096 | #1136 | A second patch run on a host with one already queued or running failed on the package manager lock. It is now refused with a clear message, and 12 simultaneous starts give exactly one run |
| #1096 | #1136 | Runs waiting for a policy maintenance window have a new Scheduled status and no longer block the host. If the host is busy when the window opens, the run is skipped with the reason recorded |
| #1096 | #1136 | A queued or validating run that never reached the agent stayed queued forever. It is now timed out 24 hours after it falls due, on upgrade and by the regular cleanup |
| #1137 | "Run immediately" on a host with a maintenance window reported the window's time as the start time. It now reports the actual start | |
| #1083 | #1136, #1137 | A delayed "host down" notification was still sent when the host came back within the delay, unless "host recovered" was enabled and routed. It is now cancelled however the recovery is seen, and a new outage after a recovery still alerts |
| #1137 | A host that stayed down sent "host down" again every two minutes, and a host inside the reconnect grace window could flip between down and recovered. Each outage now sends one notification | |
| #1137 | Saving one alert setting through the API reset the settings left out of the request. Omitted settings now keep their values | |
| #757, #1122 | #1139 | Security and pending updates threshold alerts were sent on every check while a host stayed over the threshold, unless Internal Alerts was routed. Each exceedance now notifies once until the host drops back under |
| #757 | #1139 | Changing a threshold alert's frequency needed a server restart, both types ran at the shorter of the two, and 90 minutes ran hourly. Each type now runs on its own interval, any number of minutes, applied straight away |
| #757 | #1139 | Threshold alerts gain an optional reminder interval in hours (0, the default, means no reminders). Silencing an alert holds its reminders until it is unsilenced |
| #1116, #1072 | #1136 | Raspberry Pi hosts always showed "reboot required", because the agent treated the v6, v7, v7l and v8 kernel builds as one and saw the installed v8 build as newer. Fixed in the agent |
| #1084, #639 | #1070 | Containers, volumes and networks removed from a host stayed listed in PatchMon. They are now removed on the next report, and a failed Docker call never removes anything. Removing a host's last container needs the 2.1.4 agent |
| #1082 | #1130 | Security updates were never flagged on Fedora 41 and later (dnf5) or on Amazon Linux 2. They are now detected |
| #1081 | #1092 | Security updates were missed on dnf and yum hosts using a non-English language. dnf and yum output is now read in English |
| #1131 | A security advisory for one package with a dash and digit in its name, such as java-17-openjdk, could mark an unrelated package as a security update. Names are now matched in full |
|
| #1105 | #1106 | IPv6-only hosts reported no IP address. They now report their global IPv6 address, the host IP field accepts IPv6, and SSH to an IPv6 host works |
| #1098 | #1099 | Scheduled reports scoped to host groups included every group's hosts. Every section now respects the scope, and a report whose group is empty or deleted shows no host data |
| #1078 | #1110 | The patch wizard opened behind the pinned sidebar |
| #1138 | #1140 | The AI terminal assistant only offered retired Anthropic models, so every request failed with 404. It now offers Claude Sonnet 5.5, Opus 5.5 and Haiku 5.5, and a saved retired model moves to the default automatically. Retired OpenRouter and Gemini models are replaced too |
| #1138 | #1141 | AI command completion through the API returned explanations and broken spacing. It now returns only the text to append |
| #723 | #1140 | Hosts added since 2.0.0 were created with agent auto-update switched off, so their agents never auto-updated. New hosts now default to on, so the server-wide setting decides |
| #747 | #1140 | The 1.4.2 to 2.0.0 migration script lost secrets written directly in the old compose file, such as the Redis password and JWT secret, so the upgraded stack would not start. They are now carried over, a missing .env is created, and secrets are hidden in its output |
| #1073 | #1140 | The operator guide gains a "Migrating from 1.4.2 to 2.0.0" section |
| #667 | #1140 | The sidebar did not highlight Patching, Compliance, Reporting or Docker sub-items. These pages now keep their tab in the URL and the sidebar follows it |
| #624 | #1140 | The host page lost its selected tab on reload. The tab is now kept in the URL |
| #775 | #1140, #1144 | An OIDC issuer URL ending in /.well-known/openid-configuration failed discovery. It is now accepted, and the operator guide explains how to trust an internal certificate authority without replacing the public certificate bundle |
| #1144 | With automatic user creation on, every new user's first single sign-on login was rejected with "Unable to sign in with this account", and only the second attempt worked. The first login now succeeds | |
| #1145 | #1150 | Accounts created automatically on first single sign-on login ignored the identity provider's preferred_username and took the part of the email before the @. They now use preferred_username, falling back to the email when the provider does not send one |
| #1149 | #1152 | Windows: Microsoft framework packages such as VCLibs and Windows App Runtime showed an old version with an update available, because the agent saw a leftover copy rather than the one installed. The agent now reports the installed version |
| #1156 | Windows: on hosts without the Visual C++ runtime, such as a clean Windows 11 install or Windows Server 2025, the agent reported no apps from winget and no app updates. winget now works on these hosts, so their app updates are reported | |
| #1157 | The Packages list filtered to one host could show "Update Available" for a package that host had already updated, because the status came from all hosts. It now shows that host's own status | |
| #1159 | Windows hosts can be patched: Windows Updates through the Windows Update Agent and apps through winget by Id, from Host Detail, the Packages page and the Patch wizard, with dry runs, per-item results and restart tracking. A failed Windows Update search no longer empties the host's update list | |
| #1149 | #1159 | Windows: Store apps were reported at the version the Store had staged rather than the one users have, and apps no user had installed appeared in the inventory. The agent now reports the installed version and leaves out staged-only copies |
| #774 | #1140 | With logging disabled, the server could exit at startup without printing why. Fatal startup errors now always print |
| #820 | #1140 | The server now logs the Redis address it connects to at startup |
| #839, #713 | #1140 | The docs said the Windows agent used Chocolatey and that patch policies create recurring runs. Neither is true, and both are corrected |
| #668 | #1142 | The Hosts page lost its search, filters and sort on reload. They are now kept in the URL, so reload, back and shared links restore the view |
| #693 | #1142 | Settings set in .env could be edited under Settings then Environment, appeared to save, and reverted. They now show "Set in .env", and saving tells you whether a restart is needed |
| #1108 | #1143 | On Windows, SQL Server showed version "Unknown" and was flagged for an update. Its real version is now reported, and an app whose version is unknown is never flagged |
| #760 | #1143 | On Windows, Visual C++ redistributables and other apps could show the wrong available version, miss a real update, or be flagged when the available version was older. Each app is now matched to the right entry and versions are compared properly |
| #1101, #727 | #1143 | A RHEL or CentOS host with an apt binary installed (EPEL ships one) was treated as Debian-based and reported no packages, failing with "Packages array is required". The agent now chooses the package manager from the operating system |
| #1146 | The Automation and Environment settings tables were wider than the page, hiding columns such as Status and Action. They now fit, with descriptions behind an (i) icon, and the Environment page has a mobile layout | |
| #1146 | Tooltips, including the host status pills, did not open when tapped on a phone. They now do | |
| #1147 | An invalid body limit saved through the API was stored and silently ignored. It is now rejected with a message explaining the accepted format | |
| #1147 | Body limits were shown rounded down (1500kb as 1mb), so saving the field unchanged in Settings could lower the limit. They now show exactly | |
| #1147 | A check-in rejected for being too large now appears in the host's activity log | |
| #237 | #1151 | Docker image update detection was missing from the current server, yet every image and container showed "Up to date". The agent now checks each image's tag against its registry (digest only, no pull) every six hours and on request, and flags containers running an image their tag no longer points at. The badge says Up to date only after a check |
| #1151 | Docker container changes, and the container stopped and started alerts, could reach PatchMon up to a day late. They are now sent within seconds | |
| #1151 | Images in use never showed their digest, size or created date, and some appeared twice or under a hash name. Fixed, along with wrong fields on the image, volume, network and host Docker pages | |
| #412 | #1155 | Re-running auto-enrolment on a host whose agent had broken, or whose install had failed, created a second host. The enrol scripts now repair the agent with its existing credentials, or re-issue credentials for a host that never reported, and the duplicate check no longer misses hosts after their first report |
| #1155 | Each agent now keeps its host's PatchMon ID and a config version in config.yml. The UI shows the config version beside the agent version, flags a mismatch, and warns when two machines appear to share one host's identity (for example a cloned VM or container) |
|
| #1155 | FORCE_NEW_HOST now splits a cloned host into its own entry even when its agent still works. On Proxmox it accepts container IDs |
|
| #863 | #1161 | Alpine Linux hosts can be patched: Patch all and Patch selected on Alpine 3.21 and later (apk-tools 2 and 3), with a dry run first. Runs refuse downgrades, replacements and removal of packages listed in /etc/apk/world, skip held packages, and list packages apk removes because nothing needs them. Builds on tekook's #863 |
| #1161 | Alpine security updates are flagged from Alpine's security database (secdb), and Patch selected also upgrades packages built from the same source, such as libcrypto3 with libssl3 |
|
| #1161 | Alpine and Arch hosts showed their OS version as Unknown. Alpine now shows its release, such as 3.21.0, and Arch shows rolling | |
| #1161 | Reboot required now works on Alpine, comparing the running kernel with the installed one. It is never set inside containers | |
| #1161 | The agent reads every apk repositories file, including apk-tools 3's format and repositories.d, so Alpine repositories are listed correctly |
|
| #1161 | Packages changed by an apk patch run are recorded correctly for apk-tools 3 output, and package names containing dots, such as lua5.4-libs, are no longer cut short |
|
| #1158 | Signing in twice within the same second, for example straight after first-run setup or from parallel scripts, failed with "Failed to create token". Every sign-in now gets its own token | |
| #1166 | Security: an uploaded SVG logo could run script when its URL was opened. Present in released versions. Logos are now parsed and rebuilt from an allow-list, malformed SVG is rejected, and logos are served with a sandboxing policy, which also covers logos stored before the upgrade | |
| #1166 | Security: a role could be created, edited or assigned with permissions its editor did not hold. Anyone other than a superadmin may now only work with roles whose permissions they all hold | |
| #1166 | Security: the default role for new users and SSO group role mappings could be set to admin or superadmin by a settings manager. They now follow the same rule as assigning a role, and a role must exist to be granted | |
| #1166 | Security: changing the SSO provider, client, redirect URI, unverified email trust, role mapping, enabling SSO, disabling local login or auto-creating users now needs Manage Superusers. Settings managers can still change the button text and scopes | |
| #1166 | Security: SSO accounts are matched on the identity provider as well as the user ID. Moving to a new provider refuses users linked through the old one until an admin unlinks them | |
| #1166 | Security: an OIDC UserInfo response without a subject is refused, and provider responses are capped in size | |
| #1166 | Security: "Disable local auth" only hid the password form. Password sign-in, two-factor sign-in, signup and Discord sign-in are now refused by the server while it is on | |
| #1166 | Security: sign-in no longer reveals which accounts exist through response time or messages. A wrong password on a disabled account says "Invalid credentials". When the server is saturated, every sign-in gets the same "Too many sign-in attempts, try again shortly" | |
| #1166 | Security: two-factor codes are single-use, and one backup code can no longer be used twice at once | |
| #1166 | Security: X-Forwarded-For is read only from a trusted proxy, and every header line is read |
|
| #1166 | Security: the login lockout counter could lose its expiry and never reset | |
| #1166 | Security: the users list showed each user's two-factor status to anyone who could view users. It is now shown only to user managers | |
| #1166 | Security: an SSH terminal whose browser disappeared kept its shell open on the target host. Idle dead sessions are now closed | |
| #1166 | Admins can reset another user's two-factor authentication, confirming with their own password and code. The user must enrol again before using the app, and the admin can set a temporary password that must be changed first | |
| #1166 | Admins can unlink a user's SSO identity, so a user whose identity provider account was re-created (for example in PocketID) can sign in again | |
| #1166 | "Superadmin password login if SSO is down": while local login is disabled and the identity provider is unreachable, superadmins with two-factor authentication can sign in by password. Every such sign-in raises a notification | |
| #1166 | Changing a user's role needs a role strictly above their current one. Admins can no longer change another admin's role, and only a superadmin can assign admin or use the Admin preset. Custom roles are compared by permissions | |
| #1166 | Custom roles named with spaces or punctuation were stored encoded, such as Ops%20Team%20(EU). New roles are stored correctly, existing ones are renamed on upgrade, and their users are signed out once |
|
| #1166 | Leading and trailing spaces in passwords are now ignored everywhere a password is set, as sign-in already did, so such a password can be used. Changing a password to the same value is refused | |
| #1166 | Patch selected is refused on Arch Linux, because a partial upgrade could leave pacman unable to start. Queued Arch selected runs from before the upgrade fail without running | |
| #1166 | SMTP relays offering only AUTH LOGIN, such as Microsoft 365, rejected every email. LOGIN is now used when PLAIN is not offered | |
| #1166 | A patch run whose agent stayed offline could stay queued forever and block the host. It is now retried until the agent returns | |
| #1166 | Clicking a Windows update in a patch run opened an error page. Package names link correctly, and a removed package shows "Package not found" | |
| #1166 | The SSH terminal in direct mode kept wrapping at its starting size when the panel grew | |
| #1166 | Windows hosts: the terminal defaults to the Administrator user and explains that OpenSSH Server must be enabled, and the Linux agent install shortcut is hidden | |
| #1166 | Patch validation can be closed while it runs, survives agent reconnects, no longer reports slow Windows hosts as offline, counts only hosts that validated, and is reused only for the selection it validated | |
| #1167 | The patch wizard's validation and packages-to-patch lists hid packages, including winget apps. Every package is now shown | |
| #1167 | In-browser RDP did not work on the stock Docker install. It works after updating the compose file, sessions end cleanly, tickets are single-use and rate limited, and errors are clearer | |
| #1167 | RDP gains clipboard paste (including Ctrl+V on macOS), a screen that follows the panel size, and a keyboard layout chosen per host that defaults from the browser language | |
| #1167 | The RDP and Terminal tabs are hidden from users without remote access permission | |
| #1167 | RDP session log lines changed: a closing line now records the reason, user, host and duration, and the opening line no longer repeats the port field. Check any log filters built on them |
|
| #1168 | openSUSE and SLES hosts can be patched through zypper, tested on Leap 15.6, Leap 16.0 and Tumbleweed. Transactional hosts are inventory only | |
| #1169 | On phones, the host page's Integrations card showed only Docker and its "Manage in Integrations tab" link did nothing. Every integration now shows, and the link works | |
| #1170 | Docker is labelled "New" instead of "Beta" in the side menu | |
| #869 | Univention Corporate Server (UCS) support: hosts show as UCS with release, patch level and errata level instead of Debian. Patch all installs all errata for the installed release, never a release upgrade or App Center update. Compliance scanning works on UCS 5.2. Needs agent 2.1.4 | |
| #1171 | Windows and FreeBSD hosts no longer show an SELinux status row |
What is coming next
Bug fixes are tracked in GitHub milestones. Feature requests live on feedback.patchmon.net, where you can propose an idea, vote on existing ones, and see what has been accepted onto the roadmap.
Questions about this release
This release has its own thread under New Release Discussions. Open a new issue for a reproducible bug not already covered.
