Installer - Added German language support

Installer - Certificates that fail validation are now shown with a warning icon instead of being silently hidden from the list

Service - Credentials stored in memory are now encrypted at rest, protecting against exposure in memory dumps

Service - Reduced log noise: a missing recording storage disk is now only reported once at warning level instead of repeatedly

Service - Session recordings now use periodic keyframes for improved seek performance during playback

Installer - Fixed an issue where semi-colons in certain configuration values could cause installation failures

Service - Fixed an issue where certain service subcommands were not recognized correctly

Service - Fixed recording storage space reporting for network drives and UNC paths on Windows

Service - Fixed recording storage space reporting for network filesystems (NFS, Samba) on Linux and macOS

Service - Fixed RPM package installing web application files under incorrect directory names

Service - Fixed session recording playback failing with a "media could not be loaded" error

Service - Fixed the Debian package incorrectly declaring a minimum system library version, preventing installation on some Linux distributions

Service - Fixed video playback freezing during live session shadowing after brief recording pauses

Service - Added options to use a dedicated certificate for CredSSP credential injection

Service - Gateway now auto-generates a self-signed certificate for CredSSP when no TLS certificate is configured

Service - Improved real-time performance of session shadowing

Installer - Allow downloading keys even when the certificate isn't trusted (useful in restricted/air-gapped environments)

Service - Add credential injection support for RDCleanPath

Service - Add outbound HTTP/HTTPS/SOCKS4/SOCKS5 proxy configuration support

Service - Add ARM64 Docker image support (run natively on ARM hosts)

Service - Reduce noisy logs: benign client disconnects are now logged as DEBUG instead of ERROR

Installer - Fix handling of certificate passwords containing single quotes

Service - Fix certificate store resolution error logging to include clearer failure details

Service - Fix Docker image build to correctly generate a self-signed TLS certificate

Service - Fix Linux container startup to honor the TCP_PORT environment variable

Installer - CLI Generation Support: Supports command-line generation on release builds for automation scenarios

Installer - DVLS Public Key Download: Automatically downloads public keys from Devolutions Server

Service - AI Gateway (Experimental): Provides unified access to multiple AI providers (Mistral AI, OpenAI, Anthropic Claude, OpenRouter, Azure OpenAI, Ollama, and LM Studio) through a single endpoint with centralized API key management

Service - Hub Service Auto-Updater: Supports automatic updates through the Hub Service

Service - TLS Thumbprint Anchoring: Allows TLS connections when the client provides a matching certificate thumbprint, even without traditional certificate validation

Standalone - VNC and RDP Client Updates: Updated clients with improved pixel format handling, fixed clipboard timing issues, better error messages, and updated security libraries

Installer - Enhanced Reliability: Improved debouncer reliability and clearer port check result display

Installer - Updated Translations: Includes updated localizations

Service - Better Error Diagnostics: Displays full error traces for forwarding errors to aid troubleshooting

Service - Traffic Audit ID Format (Breaking): Traffic audit IDs now use ULID format instead of integers to prevent overflow issues with large datasets

Installer - Debug Error Removal: Removed an annoying null reference exception that appeared in debug mode

Installer - High DPI Display: Fixed UI display issues at high scaling factors

Installer - Hyperlink Corrections: Corrected broken hyperlinks in the installer interface

Installer - Public Key Action: Fixed the public key action to properly use the downloaded file

Installer - Server Core Compatibility: Fixed crashes when running on Windows Server Core

Installer - UI Visual Fixes: Fixed visual issues caused by tab stop configuration

Service - RDP Proxy Compatibility: Fixed an issue that prevented Microsoft Remote Desktop Connection (mstsc) from working with the RDP proxy (for proxy-based credentials injection)

Service - Systemd Integration: Improved systemd unit file installation on Linux distributions, particularly fixing issues on RHEL-based systems

Standalone - Configuration Error Handling: Fixed TypeScript errors that occurred with invalid configuration

Service - Better support for recordings when using RDP built-in seamless reconnection feature

Service - Configuration warnings now distinguish between missing and explicitly disabled TlsVerifyStrict

Service - Listener binding now auto-retries on transient errors (e.g., "address already in use") to reduce startup failures

Service - Startup logs for listener initialization are clearer

Standalone - Fixed VNC connections to servers using "None" authentication

Service - Devolutions Gateway now records and expose traffic transferred over JMUX tunnels for auditing and usage insights

Standalone - Added an MVP for self-contained session URLs so sessions can be launched or shared via a single link

Standalone - SSH and Telnet web clients now support clipboard copy/paste

Optimized binary size to reduce download and footprint

Service - WebM video player now autoplays for smoother playback

Standalone - Added a color format selector for VNC sessions to balance bandwidth and image quality

Standalone - Clipboard features are disabled in non-secure contexts to protect data

Standalone - Improved error handling across remote desktop clients for clearer, more actionable messages

Standalone - Introduced manual clipboard mode for RDP, VNC, and ARD with Send Clipboard and Save Clipboard buttons; auto mode is toggleable and supported only on Blink-based browsers (e.g., Chrome)

Standalone - Replaced TightLow/High with a granular JPEG Quality control for finer tuning of performance vs. clarity

Standalone - The web app shows a fallback screen with guidance when an unsupported browser is detected

Standalone - Fixed user domain parsing for UPN-formatted usernames during sign-in

Service - Introduce TlsVerifyStrict option for enhanced TLS certificate validation, now enabled by default in new installs

Service - Write startup errors to a boot.stacktrace file to simplify troubleshooting during initialization

Service - Automatically detect proxy settings from environment variables for HTTP requests

Service - Default TlsVerifyStrict to false when the key is missing, preserving compatibility with legacy certificates

Service - Display the full path to the configuration file during initialization for easier debugging

Standalone - Avoid errors when writing to the clipboard without window focus

Standalone - Fix display scaling after server-initiated resize in VNC client

Standalone - Fix fullscreen handling issues in the ARD client during and after session start

Standalone - Prevent clipboard sync loop when receiving updates from the remote server

Standalone - Reduce excessive scroll speed during remote sessions in VNC client

Standalone - Support dynamic resizing for RDP and VNC sessions (UltraVNC)

Service - Fail-fast on improper certificate for TLS (make sure the auth extended key usage and the subject alternative name are set)

Service - Improvements for network interface scanning by DVLS in the future

Standalone - Hide slider in fullscreen mode

Standalone - Incorrect desktop size when a predefined resolution is selected

Standalone - Prevent undesirable scrolling when the web client is focused

Service - Fix a crash when using default port for HTTP (80) or HTTPS (443) listener (internal URL)

Standalone - Fix a bug in VNC client where ZLIB encoding was not disabled even when unchecked from the list

Standalone - Fix keyboard input for Firefox in VNC and RDP web clients

Standalone - When in fullscreen mode, the session toolbar was not appearing when the cursor was moved to the top of the screen

Service - Optional support for session tokens to be reused in a limited way (useful for RDP built-in auto-reconnect)

Service - Support port wildcards for JMUX sessions

Standalone - The wheel speed factor can now be adjusted during the VNC and ARD sessions

Service - Fix terminal recording player CSS issue causing the recording to not show up

Service - Support for proxy-based credentials injection for RDP (PAM module integration is incoming)

Standalone - Fix a typo in ARD connection form

Standalone - Wheel speed factor setting for VNC and ARD clients

Minor update

Standalone - New settings for ARD: Resolution Quality, Quality Mode

Standalone - New settings for RDP: Unicode mode, dynamic display (Display Control)

Standalone - New Settings for VNC: Codec selection, Enable/disable cursor pseudo-encoding (control whether the server will blend the cursor or not)

Service - Caching of system store certificates for better performance

Service - Cross-file seeking for recording player

Service - Extend net scanner capabilities

Service - Improve system store certificate selection

Service - properly order system certificates

Service - Add --config-path command-line option to specify a custom configuration path without relying on environment variables

Service - Improve debug logs for recording path canonicalization

Service - Reopen the system certificate store for each HTTPS request, eliminating the need to restart the service when renewing the certificate

Installer (Windows) - Ensure NetworkService has proper file permissions

Service (Linux) - Extended support to Ubuntu 18.04 and RHEL 8 (previously Ubuntu 20.04 and RHEL 9)

Service - Fix a bug where the shadowing player was sometimes failing because of high frame rate

Service - Fix WebSocket connection hanging at the end of communication

Addressed a problem where recordings would end, but the associated streaming task would continue running

Changed the service name back to "devolutions-gateway" on Linux for consistency with previous releases

Fixed an issue that would display an "Unknown error" message at the end of recording playback

Support for session shadowing

Add a replay button when recording playback is terminated

Implement WebSocket keep-alive logic

Mute recording player by default to allow autoplay in web browsers

RPM package for RHEL/Rocky Linux

Service - Crash resistance has been enhanced using a persistent job queue stored in a SQLite database file

Service - Support for recording mass deletions

Service - Disallow SCOPE tokens missing the jti claim (effectively dropping support for DVLS v2022.1.9 and prior)

Service - Various log records were improved to help with diagnosing issues

Service - Improved support for .cast files containing two slices with the same timestamp

Service - Proper detection of remaining disk space for custom recording paths on Windows

Service - The recording policy was not properly set for RDP via the web

Service - In the recording player, start the recording immediately when the tab is opened

Service - Prevent recording files from being deleted or modified while the recording is running

Service - Add backpressure to the Devolutions Gateway Tunnels, ensuring there is no unbounded memory consumption

Service - Accept with a warning subject name for system-provided certificates even if it does not match the configured hostname

Service - Print more details in the error when the requested KDC domain does not match the authorized domain

Service - Signficant enhancement in throughput for Devolutions Gateway Tunnel (requires updated RDM version for optimal performance)

Service - Remux WebM files when video recording ends. This fixes video playback stopping a few seconds before the actual end of the recording

Standalone Web Application - Add tooltip ellipsis for long netscan service names

Service - Fix a bug preventing a session from running when the recording enforcing option is set. This option is not enabled by Devolutions Server for previous versions of Devolutions Gateway, so the bug does not actually manifest, but the recording policy is not enforced up until this version

Service - Fix a recording loading bug in recording player page

Service - Support for .cast terminal recording files

Service - Support for enforcing recording policy by automatically killing non-recorded sessions

Service - Preserve Devolutions Gateway access URI base in recording player

Service - Properly scale recording player with the size of the window

Service - Recording web player

Installer - Improved configuration checks at installation in order to help troubleshooting common problems immediately

Service - Automatically disable IP restriction rules for ngrok TCP listeners when the subscription plan does not support them

Installer - use Win32 to set file permissions

Standalone Web Application - support for ssh encrypted keys

Service - consolidate JRL file update by writing new JRL into a temporary file, and swap on success

Service - do not show error traces caused by browser behavior

Service - keep HTTP connections open for 10 minutes to improve performance of the web application

Standalone Web Application - add tooltip to menu warning icon when session is closed

PowerShell - fix reading .pem files from PowerShell runspace

Standalone Web Application - connect session button stays grayed out intermittently

Standalone Web Application - fix force network rescan button

Standalone Web Application - fix misaligned "Fill form" buttons when the hostname is too long

Standalone Web Application - fix netscan result duplicates

Standalone Web Application - format the error backtrace to show line breaks

Standalone Web Application - menu icon does not update on error for RDP, ARD, VNC

Standalone Web Application - tooltip for the selected protocol is always set to RDP

Analytics to better understand how the Standalone Web Application is used (only applies to the Web Application)

Network scanning in Standalone Web Application

Recording management and diagnostics API (used via DVLS or Hub)

Support for SSH key authentication in Standalone Web Application

WebM player for remote desktop recordings

Greatly improve performance for ARD protocol in Standalone Web Application

Gracefully return an error status when the service fails on startup

Install the Devolutions Gateway service as NetworkService (breaking)

Prevent possible prompt for firewall access in Windows installer

Check if a new version is available in the standalone web application

Support for client-side rendered hardware-accelerated cursors in VNC web client

Improve the error catching for VNC and ARD web clients

Show error backtrace for VNC, ARD and RDP web clients

Version number at the bottom of the standalone web application menu

Fix connection not shut down properly in VNC web client

Properly write ARP InstallLocation on fresh installs

Network scanning capabilities

Standalone mode with web application

Better support for ngrok free plan

Improve logs (better status code for unreachable KDC server, upgrade Windows store resolve error log, etc)

New Windows installer with more configuration options (ngrok, etc)

Support for non-PEM, binary certificate and key files

Spurious warning when using a wildcard certificate

Support for PFX files natively (as opposed to extracting the certificate chain and private key using the PowerShell module)

Support for Windows Certificate Store

Add (Get|Set|Reset)-DGatewayConfigPath cmdlets in PowerShell module

Support for configuring ngrok tunnel configuration in PowerShell module

Support for configuring verbosity profile in PowerShell module

New VerbosityProfile option to control log verbosity

Add support for more X.509 cert PEM labels ("X509 CERTIFICATE" and "TRUSTED CERTIFICATE")

Improve logs quality

Proper timeout for HTTP listeners

Shutdown streams gracefully at the end of the forwarding

RecordingPath and Ngrok options are now stable and officially supported

Returning error 500 when listing recordings but recording folder is missing

TLS forward route (notably required for LDAPS)

Minor adjustments in built-in ngrok agent configuration. Notably, durations in configuration file are now specified in seconds using a JSON integer instead of a string in the humanized duration format. This only affect ngrok configuration (still in preview)

Fixes occasional payload truncation. In some cases, the payload sent by the client is truncated. This can cause the target server to reset the connection due to a protocol error. This bug is known to be triggered by the RDM built-in SSH client

Properly ignore case for hostnames and schemes (e.g.: DEVOLUTIONS.LOC and devolutions.loc are considered the same for all intents and purpose)

Properly use token from request path when authenticating KDC proxy requests

Built-in Ngrok tunnelling (preview)

Recording capablities

Support for "Devolutions Gateway Tunnel" sessions

Support for LDAP / LDAPS sessions

Support for load balancing via DVLS (heartbeat route)

Support for sessions via Remote PowerShell Web Client

Gracefully handle service shutdown

WebSocket to TCP endpoint

WebSocket to TLS endpoint

Log rotation is now size-based

When setting up a TLS-enabled listener, certification chain is sorted from leaf to root regardless of the actual order in the provided file

When Windows installer fails, rollback config folder to its initial state

Better TLS leaf certificate public key extracting

Support for clean path PDU extension for RDP. Required in order to use RDP web client

Show *.cer files when browsing for certificate files in installer

Telnet protocol default port detection

Ensure default config on install before applying "Configure now"

Properly display password placeholder characters in install summary

Properly set access URI host when using "Configure now" option

Better defaults on fresh installation (TCP port to 8181, file extensions…)

Fix /jet/health route when poking from a web browser

Start the Gateway service at install time if the service startup type is "Automatic"

Enable configuration of Devolutions Gateway via installer UI on Windows

Install service as "Local Service" again (fewer permissions)

Listen for IPv6 requests by default

Support for full TLS certificate chain

Subscriber API

Support for configuration pushing using a new HTTP endpoint

Support for forced session termination using a new HTTP endpoint

Support for KDC proxy

Support for maximum session lifetime enforcing

Tighter token restrictions (improved security)

Revert MSI service installation as "Local Service" introduced in v2022.1.1.0

Official support for ARD, VNC, SCP, SFTP, PowerShell via WinRM, PowerShell via SSH

Health route logs have been downgraded to debug level

Log files are now rotated on a daily basis

Initial KDC proxy implementation

Diagnostics/configuration endpoint now also returns Gateway's version

New diagnostics/clock endpoint to troubleshoot clock drift

Windows installer (MSI) now installs Gateway service as "Local Service" (fewer permissions)