Actuel
- Service - Restore compatibility with version 1 update manifests so update checks work correctly with newer agents
Notes de publication
- Installer - Add certificate checks during installation so invalid certificate setups are caught earlier
- Service - Add experimental Kerberos-based credential injection support (behind unstable option)
- Service - Add experimental transparent routing through the Agent Tunnel
- Service - Improve network scanning with better targeting and more consistent scan results
- Service - Reject recording uploads when recording storage is full to prevent incomplete recordings
- Service - The Gateway and Agent now support automated and scheduled Agent self-updates. Administrators can query update status and configure update schedules via new API endpoints
- Service - Fixed a startup failure on Windows Server 2016 caused by a missing Windows Error Reporting API; the service now starts correctly on all supported Windows versions
- Service - Fixed missing disk space metrics in the heartbeat response when the recording directory has not yet been created
- Service - Fixed silent shadow recording failures (close code 4002) that produced no log output; warning logs are now emitted on all internal error paths
- Service - Fixed systemd startup failures on RHEL/Rocky Linux and improved RPM/DEB package lifecycle handling (correct enable/restart/disable behaviour on install, upgrade, and removal)
- Installer - Added German language support
- Installer - Certificates that fail validation are now shown with a warning icon instead of being silently hidden from the list
- Service - Credentials stored in memory are now encrypted at rest, protecting against exposure in memory dumps
- Service - Reduced log noise: a missing recording storage disk is now only reported once at warning level instead of repeatedly
- Service - Session recordings now use periodic keyframes for improved seek performance during playback
- Installer - Fixed an issue where semi-colons in certain configuration values could cause installation failures
- Service - Fixed an issue where certain service subcommands were not recognized correctly
- Service - Fixed recording storage space reporting for network drives and UNC paths on Windows
- Service - Fixed recording storage space reporting for network filesystems (NFS, Samba) on Linux and macOS
- Service - Fixed RPM package installing web application files under incorrect directory names
- Service - Fixed session recording playback failing with a "media could not be loaded" error
- Service - Fixed the Debian package incorrectly declaring a minimum system library version, preventing installation on some Linux distributions
- Service - Fixed video playback freezing during live session shadowing after brief recording pauses
- Service - Added options to use a dedicated certificate for CredSSP credential injection
- Service - Gateway now auto-generates a self-signed certificate for CredSSP when no TLS certificate is configured
- Service - Improved real-time performance of session shadowing
- Installer - Allow downloading keys even when the certificate isn't trusted (useful in restricted/air-gapped environments)
- Service - Add credential injection support for RDCleanPath
- Service - Add outbound HTTP/HTTPS/SOCKS4/SOCKS5 proxy configuration support
- Service - Add ARM64 Docker image support (run natively on ARM hosts)
- Service - Reduce noisy logs: benign client disconnects are now logged as DEBUG instead of ERROR
- Installer - Fix handling of certificate passwords containing single quotes
- Service - Fix certificate store resolution error logging to include clearer failure details
- Service - Fix Docker image build to correctly generate a self-signed TLS certificate
- Service - Fix Linux container startup to honor the TCP_PORT environment variable
- Installer - CLI Generation Support: Supports command-line generation on release builds for automation scenarios
- Installer - DVLS Public Key Download: Automatically downloads public keys from Devolutions Server
- Service - AI Gateway (Experimental): Provides unified access to multiple AI providers (Mistral AI, OpenAI, Anthropic Claude, OpenRouter, Azure OpenAI, Ollama, and LM Studio) through a single endpoint with centralized API key management
- Service - Hub Service Auto-Updater: Supports automatic updates through the Hub Service
- Service - TLS Thumbprint Anchoring: Allows TLS connections when the client provides a matching certificate thumbprint, even without traditional certificate validation
- Standalone - VNC and RDP Client Updates: Updated clients with improved pixel format handling, fixed clipboard timing issues, better error messages, and updated security libraries
- Installer - Enhanced Reliability: Improved debouncer reliability and clearer port check result display
- Installer - Updated Translations: Includes updated localizations
- Service - Better Error Diagnostics: Displays full error traces for forwarding errors to aid troubleshooting
- Service - Traffic Audit ID Format (Breaking): Traffic audit IDs now use ULID format instead of integers to prevent overflow issues with large datasets
- Installer - Debug Error Removal: Removed an annoying null reference exception that appeared in debug mode
- Installer - High DPI Display: Fixed UI display issues at high scaling factors
- Installer - Hyperlink Corrections: Corrected broken hyperlinks in the installer interface
- Installer - Public Key Action: Fixed the public key action to properly use the downloaded file
- Installer - Server Core Compatibility: Fixed crashes when running on Windows Server Core
- Installer - UI Visual Fixes: Fixed visual issues caused by tab stop configuration
- Service - RDP Proxy Compatibility: Fixed an issue that prevented Microsoft Remote Desktop Connection (mstsc) from working with the RDP proxy (for proxy-based credentials injection)
- Service - Systemd Integration: Improved systemd unit file installation on Linux distributions, particularly fixing issues on RHEL-based systems
- Standalone - Configuration Error Handling: Fixed TypeScript errors that occurred with invalid configuration
- Service - Better support for recordings when using RDP built-in seamless reconnection feature
- Service - Configuration warnings now distinguish between missing and explicitly disabled TlsVerifyStrict
- Service - Listener binding now auto-retries on transient errors (e.g., "address already in use") to reduce startup failures
- Service - Startup logs for listener initialization are clearer
- Standalone - Fixed VNC connections to servers using "None" authentication
- Service - Devolutions Gateway now records and expose traffic transferred over JMUX tunnels for auditing and usage insights
- Standalone - Added an MVP for self-contained session URLs so sessions can be launched or shared via a single link
- Standalone - SSH and Telnet web clients now support clipboard copy/paste
- Optimized binary size to reduce download and footprint
- Service - WebM video player now autoplays for smoother playback
- Standalone - Added a color format selector for VNC sessions to balance bandwidth and image quality
- Standalone - Clipboard features are disabled in non-secure contexts to protect data
- Standalone - Improved error handling across remote desktop clients for clearer, more actionable messages
- Standalone - Introduced manual clipboard mode for RDP, VNC, and ARD with Send Clipboard and Save Clipboard buttons; auto mode is toggleable and supported only on Blink-based browsers (e.g., Chrome)
- Standalone - Replaced TightLow/High with a granular JPEG Quality control for finer tuning of performance vs. clarity
- Standalone - The web app shows a fallback screen with guidance when an unsupported browser is detected
- Standalone - Fixed user domain parsing for UPN-formatted usernames during sign-in
- Service - Introduce TlsVerifyStrict option for enhanced TLS certificate validation, now enabled by default in new installs
- Service - Write startup errors to a boot.stacktrace file to simplify troubleshooting during initialization
- Service - Automatically detect proxy settings from environment variables for HTTP requests
- Service - Default TlsVerifyStrict to false when the key is missing, preserving compatibility with legacy certificates
- Service - Display the full path to the configuration file during initialization for easier debugging
- Standalone - Avoid errors when writing to the clipboard without window focus
- Standalone - Fix display scaling after server-initiated resize in VNC client
- Standalone - Fix fullscreen handling issues in the ARD client during and after session start
- Standalone - Prevent clipboard sync loop when receiving updates from the remote server
- Standalone - Reduce excessive scroll speed during remote sessions in VNC client
- Standalone - Support dynamic resizing for RDP and VNC sessions (UltraVNC)
- Service - Fail-fast on improper certificate for TLS (make sure the auth extended key usage and the subject alternative name are set)
- Service - Improvements for network interface scanning by DVLS in the future
- Standalone - Hide slider in fullscreen mode
- Standalone - Incorrect desktop size when a predefined resolution is selected
- Standalone - Prevent undesirable scrolling when the web client is focused
- Service - Fix a crash when using default port for HTTP (80) or HTTPS (443) listener (internal URL)
- Standalone - Fix a bug in VNC client where ZLIB encoding was not disabled even when unchecked from the list
- Standalone - Fix keyboard input for Firefox in VNC and RDP web clients
- Standalone - When in fullscreen mode, the session toolbar was not appearing when the cursor was moved to the top of the screen
- Service - Optional support for session tokens to be reused in a limited way (useful for RDP built-in auto-reconnect)
- Service - Support port wildcards for JMUX sessions
- Standalone - The wheel speed factor can now be adjusted during the VNC and ARD sessions
- Service - Fix terminal recording player CSS issue causing the recording to not show up
- Service - Support for proxy-based credentials injection for RDP (PAM module integration is incoming)
- Standalone - Fix a typo in ARD connection form
- Standalone - Wheel speed factor setting for VNC and ARD clients
- Minor update
- Standalone - New settings for ARD: Resolution Quality, Quality Mode
- Standalone - New settings for RDP: Unicode mode, dynamic display (Display Control)
- Standalone - New Settings for VNC: Codec selection, Enable/disable cursor pseudo-encoding (control whether the server will blend the cursor or not)
- Service - Caching of system store certificates for better performance
- Service - Cross-file seeking for recording player
- Service - Extend net scanner capabilities
- Service - Improve system store certificate selection
- Service - properly order system certificates
- Service - Add --config-path command-line option to specify a custom configuration path without relying on environment variables
- Service - Improve debug logs for recording path canonicalization
- Service - Reopen the system certificate store for each HTTPS request, eliminating the need to restart the service when renewing the certificate
- Installer (Windows) - Ensure NetworkService has proper file permissions
- Service (Linux) - Extended support to Ubuntu 18.04 and RHEL 8 (previously Ubuntu 20.04 and RHEL 9)
- Service - Fix a bug where the shadowing player was sometimes failing because of high frame rate
- Service - Fix WebSocket connection hanging at the end of communication
- Addressed a problem where recordings would end, but the associated streaming task would continue running
- Changed the service name back to "devolutions-gateway" on Linux for consistency with previous releases
- Fixed an issue that would display an "Unknown error" message at the end of recording playback
- Support for session shadowing
- Add a replay button when recording playback is terminated
- Implement WebSocket keep-alive logic
- Mute recording player by default to allow autoplay in web browsers
- RPM package for RHEL/Rocky Linux
- Service - Crash resistance has been enhanced using a persistent job queue stored in a SQLite database file
- Service - Support for recording mass deletions
- Service - Disallow SCOPE tokens missing the jti claim (effectively dropping support for DVLS v2022.1.9 and prior)
- Service - Various log records were improved to help with diagnosing issues
- Service - Improved support for .cast files containing two slices with the same timestamp
- Service - Proper detection of remaining disk space for custom recording paths on Windows
- Service - The recording policy was not properly set for RDP via the web
- Service - In the recording player, start the recording immediately when the tab is opened
- Service - Prevent recording files from being deleted or modified while the recording is running
- Service - Add backpressure to the Devolutions Gateway Tunnels, ensuring there is no unbounded memory consumption
- Service - Accept with a warning subject name for system-provided certificates even if it does not match the configured hostname
- Service - Print more details in the error when the requested KDC domain does not match the authorized domain
- Service - Signficant enhancement in throughput for Devolutions Gateway Tunnel (requires updated RDM version for optimal performance)
- Service - Remux WebM files when video recording ends. This fixes video playback stopping a few seconds before the actual end of the recording
- Standalone Web Application - Add tooltip ellipsis for long netscan service names
- Service - Fix a bug preventing a session from running when the recording enforcing option is set. This option is not enabled by Devolutions Server for previous versions of Devolutions Gateway, so the bug does not actually manifest, but the recording policy is not enforced up until this version
- Service - Fix a recording loading bug in recording player page
- Service - Support for .cast terminal recording files
- Service - Support for enforcing recording policy by automatically killing non-recorded sessions
- Service - Preserve Devolutions Gateway access URI base in recording player
- Service - Properly scale recording player with the size of the window
- Service - Recording web player
- Installer - Improved configuration checks at installation in order to help troubleshooting common problems immediately
- Service - Automatically disable IP restriction rules for ngrok TCP listeners when the subscription plan does not support them
- Installer - use Win32 to set file permissions
- Standalone Web Application - support for ssh encrypted keys
- Service - consolidate JRL file update by writing new JRL into a temporary file, and swap on success
- Service - do not show error traces caused by browser behavior
- Service - keep HTTP connections open for 10 minutes to improve performance of the web application
- Standalone Web Application - add tooltip to menu warning icon when session is closed
- PowerShell - fix reading .pem files from PowerShell runspace
- Standalone Web Application - connect session button stays grayed out intermittently
- Standalone Web Application - fix force network rescan button
- Standalone Web Application - fix misaligned "Fill form" buttons when the hostname is too long
- Standalone Web Application - fix netscan result duplicates
- Standalone Web Application - format the error backtrace to show line breaks
- Standalone Web Application - menu icon does not update on error for RDP, ARD, VNC
- Standalone Web Application - tooltip for the selected protocol is always set to RDP
- Analytics to better understand how the Standalone Web Application is used (only applies to the Web Application)
- Network scanning in Standalone Web Application
- Recording management and diagnostics API (used via DVLS or Hub)
- Support for SSH key authentication in Standalone Web Application
- WebM player for remote desktop recordings
- Greatly improve performance for ARD protocol in Standalone Web Application
- Gracefully return an error status when the service fails on startup
- Install the Devolutions Gateway service as NetworkService (breaking)
- Prevent possible prompt for firewall access in Windows installer
- Check if a new version is available in the standalone web application
- Support for client-side rendered hardware-accelerated cursors in VNC web client
- Improve the error catching for VNC and ARD web clients
- Show error backtrace for VNC, ARD and RDP web clients
- Version number at the bottom of the standalone web application menu
- Fix connection not shut down properly in VNC web client
- Properly write ARP InstallLocation on fresh installs
- Network scanning capabilities
- Standalone mode with web application
- Better support for ngrok free plan
- Improve logs (better status code for unreachable KDC server, upgrade Windows store resolve error log, etc)
- New Windows installer with more configuration options (ngrok, etc)
- Support for non-PEM, binary certificate and key files
- Spurious warning when using a wildcard certificate
- Support for PFX files natively (as opposed to extracting the certificate chain and private key using the PowerShell module)
- Support for Windows Certificate Store
- Add (Get|Set|Reset)-DGatewayConfigPath cmdlets in PowerShell module
- Support for configuring ngrok tunnel configuration in PowerShell module
- Support for configuring verbosity profile in PowerShell module
-
New
VerbosityProfileoption to control log verbosity
- Add support for more X.509 cert PEM labels ("X509 CERTIFICATE" and "TRUSTED CERTIFICATE")
- Improve logs quality
- Proper timeout for HTTP listeners
- Shutdown streams gracefully at the end of the forwarding
-
RecordingPathandNgrokoptions are now stable and officially supported
- Returning error 500 when listing recordings but recording folder is missing
- TLS forward route (notably required for LDAPS)
- Minor adjustments in built-in ngrok agent configuration. Notably, durations in configuration file are now specified in seconds using a JSON integer instead of a string in the humanized duration format. This only affect ngrok configuration (still in preview)
- Fixes occasional payload truncation. In some cases, the payload sent by the client is truncated. This can cause the target server to reset the connection due to a protocol error. This bug is known to be triggered by the RDM built-in SSH client
- Properly ignore case for hostnames and schemes (e.g.: DEVOLUTIONS.LOC and devolutions.loc are considered the same for all intents and purpose)
- Properly use token from request path when authenticating KDC proxy requests
- Built-in Ngrok tunnelling (preview)
- Recording capablities
- Support for "Devolutions Gateway Tunnel" sessions
- Support for LDAP / LDAPS sessions
- Support for load balancing via DVLS (heartbeat route)
- Support for sessions via Remote PowerShell Web Client
- Gracefully handle service shutdown
- WebSocket to TCP endpoint
- WebSocket to TLS endpoint
- Log rotation is now size-based
- When setting up a TLS-enabled listener, certification chain is sorted from leaf to root regardless of the actual order in the provided file
- When Windows installer fails, rollback config folder to its initial state
- Better TLS leaf certificate public key extracting
- Support for clean path PDU extension for RDP. Required in order to use RDP web client
- Show *.cer files when browsing for certificate files in installer
- Telnet protocol default port detection
- Ensure default config on install before applying "Configure now"
- Properly display password placeholder characters in install summary
- Properly set access URI host when using "Configure now" option
- Better defaults on fresh installation (TCP port to 8181, file extensions…)
-
Fix
/jet/healthroute when poking from a web browser - Start the Gateway service at install time if the service startup type is "Automatic"
- Enable configuration of Devolutions Gateway via installer UI on Windows
- Install service as "Local Service" again (fewer permissions)
- Listen for IPv6 requests by default
- Support for full TLS certificate chain
- Subscriber API
- Support for configuration pushing using a new HTTP endpoint
- Support for forced session termination using a new HTTP endpoint
- Support for KDC proxy
- Support for maximum session lifetime enforcing
- Tighter token restrictions (improved security)
- Revert MSI service installation as "Local Service" introduced in v2022.1.1.0
- Official support for ARD, VNC, SCP, SFTP, PowerShell via WinRM, PowerShell via SSH
- Health route logs have been downgraded to debug level
- Log files are now rotated on a daily basis
- Initial KDC proxy implementation
- Diagnostics/configuration endpoint now also returns Gateway's version
- New diagnostics/clock endpoint to troubleshoot clock drift
- Windows installer (MSI) now installs Gateway service as "Local Service" (fewer permissions)