Repository navigation
Releases
1.26.0
Read the Announcement
Read the full announcement with discussion of new features: Pangolin 1.26: Session Management, SSH Logs, and Auto Windows Updates
What’s Changed
- Add option to add additional DNS records on delegated domains with Pangolin DNS (EE)
- Add optional match on base wildcard domains
- Add continuous session revalidation for OIDC IdPs using refresh tokens (EE)
- Add SSH session logging when using Pangolin SSH (EE)
- Add resource session management with ability to see and revoke active sessions (EE)
- Add custom domain for org auth pages to self-hosted (EE)
- Add opt-in CrowdSec bot detection
- Fix failing Safari passkey registration
- Fix the enabled/disabled filter on the private resources table
- Fix IdP auto-provision not toggleable on a per org basis when using org-scoped IdP mode
- Fix order same-second status events in status history
- Fix duplicate header auth from blueprints
- Fix Swagger API docs missing from container build
- Fix missing API key permissions for integration API routes
- Fix Bedrock cache token calculation
- Dependency security updates
- General UI improvements
- Various other bug fixes
New Contributors
- @jnko266 made their first contribution in #3938
- @ASPCODES made their first contribution in #3988
- @samirasidd made their first contribution in #3971
- @RishavTiwari25 made their first contribution in #3999
- @S-NoF3aR made their first contribution in #4027
Full Changelog: 1.25.3...1.26.0
How to Update
Important
As of November 3, the Traefik team has fixed the bug that prevented Badger v1.8.0 from being pulled. You can now safely upgrade to Badger v1.8.0 to enable permanent redirects, introduced in Pangolin v1.25. The v1.26 migration will attempt to update Badger for you automatically. If it cannot find your Traefik config in the standard location, manually update Badger.
Important
SSH session logs with Pangolin SSH mode require an updated site agent. Upgrade to Pangolin CLI v0.2.0+ or Newt v1.20.0+ before enabling SSH logging.
Important
Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.
Contributors
Assets 4
1.26.0-rc.0
RC
A Release Candidate (RC) is a near-final software version, stable but undergoing last tests before official release. It has all features and no known bugs.
- Users: Use cautiously due to potential undiscovered bugs. Not for critical systems unless prepared for issues. Report bugs.
- Developers/Testers: Perform crucial final validation and thorough testing, especially of recent changes, to catch last-minute major issues.
- Backup: Always back up data before installing an RC to allow rollback if problems arise.
- Feedback: Provide feedback; it's vital for a robust final release.
Note
Keep a backup of the last stable database as you will be unable to update from a RC to the next stable version. Database migrations may change between release candidates and stable versions.
What’s Changed
- Add option to add additional DNS records on delegated domains with Pangolin DNS (EE)
- Add optional match on base wildcard domains
- Add continuous session revalidation for OIDC IdPs using refresh tokens (EE)
- Add SSH session logging when using Pangolin SSH (EE)
- Add resource session management with ability to see and revoke active sessions (EE)
- Add custom domain for org auth pages to self-hosted (EE)
- Add opt-in CrowdSec bot detection
- Fix failing Safari passkey registration
- Fix the enabled/disabled filter on the private resources table
- Fix IdP auto-provision not toggleable on a per org basis when using org-scoped IdP mode
- Fix order same-second status events in status history
- Fix duplicate header auth from blueprints
- Fix Swagger API docs missing from container build
- Fix missing API key permissions for integration API routes
- Fix Bedrock cache token calculation
- Dependency security updates
- General UI improvements
- Various other bug fixes
New Contributors
- @jnko266 made their first contribution in #3938
- @ASPCODES made their first contribution in #3988
- @samirasidd made their first contribution in #3971
- @RishavTiwari25 made their first contribution in #3999
- @S-NoF3aR made their first contribution in #4027
Full Changelog: 1.25.3...1.26.0-rc.0
How to Update
Important
As of November 3, the Traefik team has fixed the bug that prevented Badger v1.8.0 from being pulled. You can now safely upgrade to Badger v1.8.0 to enable permanent redirects, introduced in Pangolin v1.25. The v1.26 migration will attempt to update Badger for you automatically. If it cannot find your Traefik config in the standard location, manually update Badger.
Important
SSH session logs with Pangolin SSH mode require an updated site agent. Upgrade to Pangolin CLI v0.2.0+ or Newt v1.20.0+ before enabling SSH logging.
Important
Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.
Contributors
Assets 4
1.25.3
Read the Announcement
Read the full announcement with discussion of new features: Pangolin 1.25: Redirects, mTLS, and Machine Roles
What's Changed
- Update node to resolve Node2Shell CVE-2026-111497
- Improve client connection speed with many sites
- Fix agent and olm version separate in the database
Full Changelog: 1.25.2...1.25.3
How to Update
Important
For all load balancing options to work, Treafik version 3.6 or greater must be used in your stack. Update accordingly.
Important
Redirects will work on older versions of Badger. In order to enable permanent redirects, update Badger to v1.8.0 or greater. The migration will automatically do this if it can find the Traefik config in the standard location. Otherwise, please ensure your Badger is up to date manually.
Important
Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.
1.25.2
Read the Announcement
Read the full announcement with discussion of new features: Pangolin 1.25: Redirects, mTLS, and Machine Roles
What's Changed
- Fix include optional name in blueprint health check
- Fix mTLS hidden by enterprise feature flag on CE
Full Changelog: 1.25.1...1.25.2
How to Update
Important
For all load balancing options to work, Treafik version 3.6 or greater must be used in your stack. Update accordingly.
Important
Redirects will work on older versions of Badger. In order to enable permanent redirects, update Badger to v1.8.0 or greater. The migration will automatically do this if it can find the Traefik config in the standard location. Otherwise, please ensure your Badger is up to date manually.
Important
Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.
1.25.1
Read the Announcement
Read the full announcement with discussion of new features: Pangolin 1.25: Redirects, mTLS, and Machine Roles
What's Changed
- Fix updated clients failing to relay
- Fix credential generation not showing with EE features disabled
Full Changelog: 1.25.0...1.25.1
How to Update
Important
For all load balancing options to work, Treafik version 3.6 or greater must be used in your stack. Update accordingly.
Important
Redirects will work on older versions of Badger. In order to enable permanent redirects, update Badger to v1.8.0 or greater. The migration will automatically do this if it can find the Traefik config in the standard location. Otherwise, please ensure your Badger is up to date manually.
Important
Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.
1.25.0
Read the Announcement
Read the full announcement with discussion of new features: Pangolin 1.25: Redirects, mTLS, and Machine Roles
What’s Changed
- Add redirects
- Add mTLS authentication method for public resources
- Add support for assigning roles to machine clients (EE)
- Add export resource to blueprint
- Add support for configuring load balancing strategy
- Add labels to the integration API
- Add client identities for
Remote-*headers on private HTTP - Add offline checking intervals configuration
- Add site, machine client, and remote node credential regeneration to CE
- Improve image size by pruning
- Fix cluster license registration
- Fix integration API organization delete
- Fix allow underscores in health check hostnames
- Fix pass relay port to Gerbil
- Fix avoid exponential backtracking in
isPathAllowed - Fix ensure more than one parts exists in signup page
- Fix send missing error when clients registering
- Fix clean up every site when deleting an org
- Fix prevent overlapping exit node address selections
- UI improvements
Full Changelog: 1.24.0...1.25.0
New Contributors
- @kdcokenny made their first contribution in #3838
- @mr-pmillz made their first contribution in #3830
- @TiltedTeapot made their first contribution in #3870
- @choksi2212 made their first contribution in #3895
How to Update
Important
For all load balancing options to work, Treafik version 3.6 or greater must be used in your stack. Update accordingly.
Important
Redirects will work on older versions of Badger. In order to enable permanent redirects, update Badger to v1.8.0 or greater. The migration will automatically do this if it can find the Traefik config in the standard location. Otherwise, please ensure your Badger is up to date manually.
Important
Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.
Contributors
Assets 4
1.25.0-rc.0
RC
A Release Candidate (RC) is a near-final software version, stable but undergoing last tests before official release. It has all features and no known bugs.
- Users: Use cautiously due to potential undiscovered bugs. Not for critical systems unless prepared for issues. Report bugs.
- Developers/Testers: Perform crucial final validation and thorough testing, especially of recent changes, to catch last-minute major issues.
- Backup: Always back up data before installing an RC to allow rollback if problems arise.
- Feedback: Provide feedback; it's vital for a robust final release.
Note
Keep a backup of the last stable database as you will be unable to update from a RC to the next stable version. Database migrations may change between release candidates and stable versions.
What’s Changed
- Add redirects
- Add mTLS support for public resources
- Add support for assigning roles to machines (EE)
- Add export blueprint functionality for all resources
- Add labels to the integration API
- Add support for configuring load balancing strategy
- Add client identities to Pangolin Sites for Remote- headers on private HTTP
- Add offline checking intervals configuration
- Add site, machine client, and remote node credential regeneration to CE
- Improve container image size by pruning packages
- Fix cluster license registration
- Fix Integration API organization delete
- Fix allow underscores in health check hostnames
- Fix pass relay port to Gerbil
- Fix avoid exponential backtracking in isPathAllowed
- Fix ensure more than 1 parts exists in signup page
- Fix send missing error when clients registering
- Fix clean up every site when deleting an org
- Fix prevent overlapping exit node address selections
- UI improvements
Full Changelog: 1.24.0...1.25.0-rc.0
New Contributors
- @kdcokenny made their first contribution in #3838
- @mr-pmillz made their first contribution in #3830
- @TiltedTeapot made their first contribution in #3870
- @choksi2212 made their first contribution in #3895
How to Update
Important
For all load balancing options to work, Treafik version 3.6 or greater must be used in your stack. Update accordingly.
Important
Redirects will work on older versions of Badger. In order to enable permanent redirects, update Badger to v1.8.0 or greater. The migration will automatically do this if it can find the Traefik config in the standard location. Otherwise, please ensure your Badger is up to date manually.
Important
Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.
Contributors
Assets 4
1.24.0
Read the Announcement
Read the full announcement with discussion of new features: Pangolin 1.24: Exit Nodes and Improved Clients
What's New
- Add exit node private resources
- Add HTTP method matching to resource rules
- Add Badger config overrides to config file
- Add on-demand activation for iOS and macOS clients
- Add always-on connections for Android clients
- Add connect-at-login for Windows clients
- Add response header customization
- Add subnet routing to Linux CLI client for site to site networking
- Significant UI improvements for all Pangolin clients (see release notes for each respective client for comprehensive list of changes)
- Update iPhone and Mac client identifiers
- Dependency security updates
- General UI improvements
- Various other bug fixes
New Contributors
- @Bolex80 made their first contribution in #3790
- @m1handr made their first contribution in #3616
- @kah-ja made their first contribution in #3750
- @Tyagiquamar made their first contribution in #3785
- @breken-ai made their first contribution in #3738
- @moyaqoob made their first contribution in #3585
- @Gulianrdgd made their first contribution in #3172
- @MauryaQbit made their first contribution in #3797
- @Fra146 made their first contribution in #3811
Full Changelog: 1.23.0...1.24.0
How to Update
Important
Private exit node resources require Pangolin CLI v0.18.0+ or Newt v1.18.0+. Upgrade your site connector before deploying.
Important
Private exit node resources are exclusively compatible with the latest versions of all Pangolin clients. Support for exit node functionality was implemented in all client releases issued after September 29th, 2026. If your client's most recent release predates this date, exit nodes are not yet available.
Important
Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.
Contributors
Assets 4
1.24.0-rc.0
RC
A Release Candidate (RC) is a near-final software version, stable but undergoing last tests before official release. It has all features and no known bugs.
- Users: Use cautiously due to potential undiscovered bugs. Not for critical systems unless prepared for issues. Report bugs.
- Developers/Testers: Perform crucial final validation and thorough testing, especially of recent changes, to catch last-minute major issues.
- Backup: Always back up data before installing an RC to allow rollback if problems arise.
- Feedback: Provide feedback; it's vital for a robust final release.
Note
Keep a backup of the last stable database as you will be unable to update from a RC to the next stable version. Database migrations may change between release candidates and stable versions.
What's New
- Add exit node private resources
- Add HTTP method matching to resource rules
- Add Badger config overrides to config file
- Add on-demand activation for iOS and macOS clients
- Add always-on connections for Android clients
- Add connect-at-login for Windows clients
- Add response header customization
- Add subnet routing to Linux CLI client for site to site networking
- Significant UI improvements for all Pangolin clients (see release notes for each respective client for comprehensive list of changes)
- Update iPhone and Mac client identifiers
- Dependency security updates
- General UI improvements
- Various other bug fixes
New Contributors
- @Bolex80 made their first contribution in #3790
- @m1handr made their first contribution in #3616
- @kah-ja made their first contribution in #3750
- @Tyagiquamar made their first contribution in #3785
- @breken-ai made their first contribution in #3738
- @moyaqoob made their first contribution in #3585
- @Gulianrdgd made their first contribution in #3172
- @MauryaQbit made their first contribution in #3797
- @Fra146 made their first contribution in #3811
Full Changelog: 1.23.0...1.24.0-rc.0
How to Update
Important
Private exit node resources require Pangolin CLI v0.18.0+ or Newt v1.18.0+. Upgrade your site connector before deploying.
Important
Private exit node resources are exclusively compatible with the latest versions of all Pangolin clients. Support for exit node functionality was implemented in all client releases issued after September 29th, 2026. If your client's most recent release predates this date, exit nodes are not yet available.
Important
Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.
Contributors
Assets 4
1.23.0
Read the Announcement
Read the full announcement with discussion of new features: Pangolin 1.23: High Availability and Clustering
What's Changed
- Add support for self-service high availability in Enterprise Edition
- Add master list of all orgs to server admin panel
- Add support for more than one server admin user; promote and demote via users table in server admin panel
- Add sites widget to resource side panel in resource launcher
- Add SSH commands to SSH private resources in resource side panel in resource launcher
- Add Pangolin CLI commands to site install wizard as the preferred method and rename Newt to Pangolin Site
- Dependency security updates
- General UI improvements
- Various other bug fixes
Full Changelog: 1.22.2...1.23.0
How to Update
Important
Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.