v2.0.2

This is a patch for the major 2.0 release. It contains small UI and packaging fixes.

The 2.0 was a significant step up from version 1.x, featuring:

🎨 a completely redesigned UI,
📦 a new and easy deployment approach (and component communication security),
🛠️ and some other major architectural changes.

More details with videos in this blogpost.

⬆︎ If you will be upgrading from 1.x - here you can find relevant documentation about the upgrade.
🚅 If you would like to test Defguard - we offer a quick and easy One-line install script.

⚠️ Business features require free registration.
Previously, these features were available without registration (within certain limits).
Starting from 2.0, a free Business license registration is required to use them.
👉 https://defguard.net/get-free-business/
Once registered, simply apply your license to your instance and enjoy access to Business functionality.

We want to get as much feedback as possible, so we encourage you to:
💬 open a GitHub discussion
🪲 report any missing features or bugs as issues

Other Changes

• Display OIDC error message (#315) by @j-chmielewski in #316
• Fix config in FreeBSD package by @moubctez in #318

Full Changelog: v2.0.1...v2.0.2

v2.0.1

This is a patch for the major 2.0 release. It includes fixes for issues reported by early adopters.

The 2.0 was a significant step up from version 1.x, featuring:

🎨 a completely redesigned UI,
📦 a new and easy deployment approach (and component communication security),
🛠️ and some other major architectural changes.

More details with videos in this blogpost.

⬆︎ If you will be upgrading from 1.x - here you can find relevant documentation about the upgrade.
🚅 If you would like to test Defguard - we offer a quick and easy One-line install script.

⚠️ Business features require free registration.
Previously, these features were available without registration (within certain limits).
Starting from 2.0, a free Business license registration is required to use them.
👉 https://defguard.net/get-free-business/
Once registered, simply apply your license to your instance and enjoy access to Business functionality.

We want to get as much feedback as possible, so we encourage you to:
💬 open a GitHub discussion
🪲 report any missing features or bugs as issues

What's Changed

• chore: prepare 2.0.1 release by @wojcik91 in #296
• fix pnpm lockfile format by @wojcik91 in #297
• update openssl crate by @wojcik91 in #302
• fix proxy warning page (#301) by @wojcik91 in #304

Full Changelog: v2.0.0...v2.0.1

v2.0.0

🎉 Welcome to Defguard 2.0 🎉

It’s a significant step up from version 1.x, featuring:

🎨 a completely redesigned UI,
📦 a new and easy deployment approach (and component communication security),
🛠️ and some other major architectural changes.

More details with videos in this blogpost.

⬆︎ If you will be upgrading from 1.x - here you can find relevant documentation about the upgrade.
🚅 If you would like to test Defguard - we offer a quick and easy One-line install script.

⚠️ Business features require free registration.
Previously, these features were available without registration (within certain limits).
Starting from 2.0, a free Business license registration is required to use them.
👉 https://defguard.net/get-free-business/
Once registered, simply apply your license to your instance and enjoy access to Business functionality.

We want to get as much feedback as possible, so we encourage you to:
💬 open a GitHub discussion
🪲 report any missing features or bugs as issues

What's Changed

• Disable latest Docker tag in release workflow by @wojcik91 in #221
• Disable APT repository signing/upload by @jakub-tldr in #225
• Core certificate authority, part 1: Proxy by @t-aleksander in #223
• Multiproxy private cookies by @j-chmielewski in #229
• http healthcheck endpoints always respond by @j-chmielewski in #234
• Cookie key proto by @j-chmielewski in #235
• Implement proxy wizard by @t-aleksander in #233
• Implement remote MFA with new, separate RPC message by @j-chmielewski in #238
• Fix proxy healthceck endpoint availability when waiting for setup by @t-aleksander in #239
• include lsb_release in Docker image by @wojcik91 in #240
• bump version 2.0.0 by @wojcik91 in #248
• Crl by @j-chmielewski in #250
• Open desktop app page by @moubctez in #254
• More user friendly certificate permission denied errors by @t-aleksander in #256
• deprecate callback/redirect URL settings by @wojcik91 in #255
• Use proper file permission for certificates by @moubctez in #257
• Unadopted UI by @j-chmielewski in #259
• Prepare Alpha Two by @moubctez in #260
• Show link-invalid when using disabled user token by @jakub-tldr in #261
• Provision HTTPS certificates for Core and Proxy by @t-aleksander in #263
• Faster cargo deny and update dependencies by @moubctez in #264
• Handle ClearHttpsCerts message by @j-chmielewski in #265
• support protobuf versioning by @wojcik91 in #262
• update minimum core version to 2.0.0 by @wojcik91 in #266
• add workflow to tag latest image on release by @wojcik91 in #267
• copy APT repo update workflow from main by @wojcik91 in #268
• Get rid of cross-rs by @moubctez in #270
• Fix FreeBSD package name by @moubctez in #272
• Auto adoption time limit by @jakub-tldr in #274
• Preserve old package versions on APT repository by @jakub-tldr in #276
• Ensure acme server is stopped when challenge fails by @j-chmielewski in #275
• add core client cert validation by @wojcik91 in #273
• Add defaults when parsing toml by @t-aleksander in #279
• Build packages with custom user by @moubctez in #278
• Use CAP_NET_BIND_SERVICE by @moubctez in #281
• Save certificates before completing setup, test write access by @t-aleksander in #280
• Fine tune packages by @moubctez in #283
• improve baseline HTTP security for no-reverse proxy deployment scenarios by @wojcik91 in #282
• adjust rate limiter config by @wojcik91 in #284
• use Docker registry as build cache by @wojcik91 in #286
• make rate limiter opt-in by @wojcik91 in #287
• Fix minor 2.0 bugs by @t-aleksander in #289
• Inform user about common causes of invalid let's encrypt order status by @t-aleksander in #290
• update core deps in preparation for 2.0 release by @wojcik91 in #291

Full Changelog: v1.6.0...v2.0.0

v2.0.0-beta2

🎉 Welcome to Defguard 2.0 Beta 2 🎉

This is the final beta before the stable release. Our primary focus has been on stabilising the platform and ensuring everything is ready for a smooth, production-grade launch.

📖 A comprehensive list of the changes implemented since Alpha 2 is documented in detail here: https://defguard.net/blog/defguard-2-0-release-beta-1/.

🛠️ We highly recommend previewing it yourself. We prepared a guide explaining how to run the alpha2 before. To run the beta2 just use 2.0.0-beta2 image tags instead of 2.0.0-alpha2.

⚠️ Important notice for beta1 early adopters: beta2 introduces a breaking change that requires removing and re-adding the Edge and Gateway components.

We want to get as much feedback as possible, so we encourage you to:
💬 open a GitHub discussion
🪲 report any missing features or bugs as issues

What's Changed

• copy APT repo update workflow from main by @wojcik91 in #268
• Get rid of cross-rs by @moubctez in #270
• Fix FreeBSD package name by @moubctez in #272
• Auto adoption time limit by @jakub-tldr in #274
• Preserve old package versions on APT repository by @jakub-tldr in #276
• Ensure acme server is stopped when challenge fails by @j-chmielewski in #275
• add core client cert validation by @wojcik91 in #273
• Add defaults when parsing toml by @t-aleksander in #279
• Build packages with custom user by @moubctez in #278
• Use CAP_NET_BIND_SERVICE by @moubctez in #281
• Save certificates before completing setup, test write access by @t-aleksander in #280
• Fine tune packages by @moubctez in #283
• improve baseline HTTP security for no-reverse proxy deployment scenarios by @wojcik91 in #282
• adjust rate limiter config by @wojcik91 in #284
• use Docker registry as build cache by @wojcik91 in #286
• make rate limiter opt-in by @wojcik91 in #287

Full Changelog: v2.0.0-beta1...v2.0.0-beta2

v2.0.0-beta1

🎉 Welcome to Defguard 2.0 Beta 1 🎉

📖 A comprehensive list of the changes implemented since Alpha 2 is documented in detail here: https://defguard.net/blog/defguard-2-0-release-beta-1/

🛠️ We highly recommend previewing it yourself. We prepared a guide explaining how to run the alpha2 before. To run the beta1 just use 2.0.0-beta1 image tags instead of 2.0.0-alpha2.

We want to get as much feedback as possible, so we encourage you to:
💬 open a GitHub discussion
🪲 report any missing features or bugs as issues

What's Changed

• Show link-invalid when using disabled user token by @jakub-tldr in #261
• Provision HTTPS certificates for Core and Proxy by @t-aleksander in #263
• Faster cargo deny and update dependencies by @moubctez in #264
• Handle ClearHttpsCerts message by @j-chmielewski in #265
• support protobuf versioning by @wojcik91 in #262
• update minimum core version to 2.0.0 by @wojcik91 in #266
• add workflow to tag latest image on release by @wojcik91 in #267

Full Changelog: v2.0.0-alpha2...v2.0.0-beta1

v2.0.0-alpha2

🎉 Welcome to Defguard 2.0 Alpha 2 🎉

📖 A comprehensive list of the changes implemented since Alpha 1 is documented in detail here: https://defguard.net/blog/defguard-2-0-release-alpha-2/

🛠️ We also highly recommend reviewing our detailed technical overview of all changes and the comprehensive showcase of all features in this article.

We want to get as much feedback as possible, so we encourage you to:
💬 open a GitHub discussion
🪲 report any missing features or bugs as issues

Detailed Changes

• Disable latest Docker tag in release workflow by @wojcik91 in #221
• Disable APT repository signing/upload by @jakub-tldr in #225
• Core certificate authority, part 1: Proxy by @t-aleksander in #223
• Multiproxy private cookies by @j-chmielewski in #229
• http healthcheck endpoints always respond by @j-chmielewski in #234
• Cookie key proto by @j-chmielewski in #235
• Implement proxy wizard by @t-aleksander in #233
• Implement remote MFA with new, separate RPC message by @j-chmielewski in #238
• Fix proxy healthceck endpoint availability when waiting for setup by @t-aleksander in #239
• include lsb_release in Docker image by @wojcik91 in #240
• bump version 2.0.0 by @wojcik91 in #248
• Crl by @j-chmielewski in #250
• Open desktop app page by @moubctez in #254
• More user friendly certificate permission denied errors by @t-aleksander in #256
• deprecate callback/redirect URL settings by @wojcik91 in #255
• Use proper file permission for certificates by @moubctez in #257
• Unadopted UI by @j-chmielewski in #259
• Prepare Alpha Two by @moubctez in #260

Full Changelog: v1.6.0...v2.0.0-alpha2

v1.6.3

This is a patch for the major 1.6 release.
It includes dependency updates to resolve the following CVEs:

• CVE-2026-25541
• CVE-2026-25727
• CVE-2026-25639
• CVE-2026-2391

What's Changed

Other Changes

• update dependencies & prepare 1.6.3 release by @wojcik91 in #252

Full Changelog: v1.6.2...v1.6.3

v2.0.0-alpha1

🎉 Welcome to Defguard 2.0 Alpha 1 🎉

First of all, this is an actual alpha, not meant for production, but a technology preview of what’s to come, hopefully in a month, when the stable release should be ready.

2.0 is a major overhaul, featuring a completely redesigned UI/UX, secure reverse Core-to-Gateway communication with a built-in SSL certificate authority, automated deployment and session management, and initial high-availability support, laying a solid foundation for easier, safer, and more manageable on-premise deployments.

🛠️ We highly recommend that you get familiar with a detailed technical overview of all changes and a comprehensive showcase of all features in this blog post.

🚀Here you can find a quick tutorial on how to quickly launch 2.0α with Docker Compose.

We want to get as much feedback as possible, so we encourage you to:
💬 open a GitHub discussion
🪲 report any missing features or bugs as issues

What's Changed

• Disable latest Docker tag in release workflow by @wojcik91 in #221
• Disable APT repository signing/upload by @jakub-tldr in #225
• Core certificate authority, part 1: Proxy by @t-aleksander in #223
• Multiproxy private cookies by @j-chmielewski in #229
• http healthcheck endpoints always respond by @j-chmielewski in #234
• Cookie key proto by @j-chmielewski in #235
• Implement proxy wizard by @t-aleksander in #233
• Implement remote MFA with new, separate RPC message by @j-chmielewski in #238
• Fix proxy healthceck endpoint availability when waiting for setup by @t-aleksander in #239
• include lsb_release in Docker image by @wojcik91 in #240
• bump version 2.0.0 by @wojcik91 in #248
• binary build fix by @wojcik91 in #249

Full Changelog: v1.6.0...v2.0.0-alpha1

v1.6.2

This is a patch for the major 1.6 release.

What's Changed

Other Changes

• Update APT repository on full release/pre-release by @jakub-tldr in #228
• add gh cli dependency by @jakub-tldr in #230
• add missing character by @jakub-tldr in #232
• update dependencies to resolve outstanding CVEs by @wojcik91 in #241

Full Changelog: v1.6.1...v1.6.2

v1.6.1

This is a patch for the major 1.6 release.

What's Changed

Other Changes

• update dependencies & prepare 1.6.1 release by @wojcik91 in #226
• Disable APT repository signing/uploads by @jakub-tldr in #224

Full Changelog: v1.6.0...v1.6.1