v0.20.2

Fixes

• #1678 downgrade Linux build image for older glibc compatibility
• Fixed LDAP query compatibility with lldap

v0.20.0

Changes

• feat(ssh): add configurable client authentication methods by @liebermantodd in #1637
• Improve logging/messaging around SSH target authentication failure by @LarsSven in #1677
• feat(cli): add support for setting config path through env by @justinforlenza in #1650

Fixes

• fix: modify GEX parameters in SSH key exchange configuration so that it uses 2048 bits by @joseluisgonzalezca in #1659
• fix: generate SSO login return URL based on request host by @joseluisgonzalezca in #1661
• fixed LDAP server attribute saving by @Eugeny in #1662
• Correctly naturally sort all relevant lists in the UI by @LarsSven in #1656
• Correct PostreSQL connection string & Allow targets to customize default database name in connection examples by @SteezyCougar in #1577

New Contributors

• @justinforlenza made their first contribution in #1650
• @liebermantodd made their first contribution in #1637

Full Changelog: v0.19.1...v0.20.0

v0.19.1

Fixes

• Undo API-incompatible TlsMode change by @LarsSven in #1648
• fixed #1647 - SSH keys admin UI page not working

Full Changelog: v0.19.0...v0.19.1

v0.19.0

Changes

• Experimental LDAP user sync by @Eugeny in #1603
• Create the admin user by default even if unattended-setup not called by @MohammedNoureldin in #1620
• Add SCP example command to SSH targets by @LarsSven in #1612
• Add JSON log output format for easier log processing by @mrmm in #1609
• fixed #974 - make securing files optional by @Eugeny in #1636

Fixes

• remove dependency on the deprecated rustls-pemfile by @Eugeny in #1615
• fixed #1456 - added a clickable button to submit the OTP by @Eugeny in #1614
• Fix cross-domain cookie handling and domain rebinding by @SteezyCougar in #1553
• fixed #1632 - natural sort for targets by @Eugeny in #1645

New Contributors

• @MohammedNoureldin made their first contribution in #1620
• @mrmm made their first contribution in #1609

Full Changelog: v0.18.0...v0.19.0

v0.18.0

Changes

• Add target groups by @alairock in #1518
• Add create-user CLI command by @LarsSven in #1549
• Add configurable idle timeout for PostgreSQL targets by @SteezyCougar in #1565

Fixes

• Use warpgate.yaml for Container Healthcheck by @micha-k in #1539
• Clean up ssh key generation and loading by @LarsSven in #1544

New Contributors

• @micha-k made their first contribution in #1539
• @alairock made their first contribution in #1518

Full Changelog: v0.17.0...v0.18.0

v0.17.0

Important changes

• Warpgate now automatically falls back to email if preferred_username is not available from an SSO provider when auto-creating new users - by @SteezyCougar in #1475

Features

• Added a Helm chart (beta) - by @alice-dops in #1502
• Added ML-KEM post-quantum key exchange by @kruton in #1527

Fixes

• SSH server doesnt offer ed25519 hostkey by @fpfeifferik in #1473
• Added diffie-hellman-group-exchange-sha256 to SSH key exchange list by @joseluisgonzalezca in #1493
• Canonicalize Oauth Redirect with cross domain session cookie by @SteezyCougar in #1476
• Spawn task immediately when accepting connection by @kruton in #1521
• Fixed --debug CLI option by @kruton in #1526

Docs

• Correct dependency install command by @LarsSven in #1506

New Contributors

• @fpfeifferik made their first contribution in #1473
• @SteezyCougar made their first contribution in #1475
• @LarsSven made their first contribution in #1506
• @step-security-bot made their first contribution in #1508
• @kruton made their first contribution in #1521

Full Changelog: v0.16.0...v0.17.0

v0.16.0

Security fixes

• 3c003fc - fixed CVE-2025-54804
  • This vulnerability has allowed a malicious authenticated client or target server to trigger a Rust panic in Warpgate and potentially cause a service restart

Major changes

• Docker image : add healthcheck, linting and run as regular user by @hugosxm in #1433
  • The Docker image now runs under UID 1000 instead of 0. Depending on your setup, this might cause permission errors when trying to access the Warpgate data files, you might have to chmod them. Run Docker with --uid 0 to revert to the old, less safe behaviour.
• Added bandwidth limiting support in #1443
  • You can set bandwidth limits globally, per user and per target - works for SSH, MySQL and Postgres targets.

Changes

• Warpgate now sets TCP_NODELAY for better performance - in #1447 and by @tom-90 in #1449

Fixes

• fd6607b - fix channels losing unflushed data when closing
• 4d5ebe4 - fix SCP hangups
• 05235d9 - fixed incorrect relative path resolution in setup
• 5a4b295 - fixed #1424 - OOB UI fails with repeating characters
• version attribute is obsolete by @ulab in #1435
• 8ad6972 - fixed #1442 - unnecessary get_info auth restrictions

New Contributors

• @hugosxm made their first contribution in #1433
• @ulab made their first contribution in #1435
• @tom-90 made their first contribution in #1449

Full Changelog: v0.15.0...v0.16.0

v0.15.0

Features

• fixed #1104 - SNI support in #1402 - see https://warpgate.null.page/sni/
• fixed #1220 - direct-streamlocal (local UNIX socket forwarding) support in 103a480
• fixed #1368 - correctly generate version number in docker in #1372
• fixed #954 - enable gzip support for http targets in 9e144f8
• fixed #1367 - replace Swagger with Stoplight Elements in the API playground and add a note about token header in 1df9b45

Fixes

• fixed #1381 - skip password auth in postgres if not required in #1383
• fix(panel): fix user profile link by @joseluisgonzalezca in #1384
• feat(http): support for insecured websocket connections if TLS Verifyflag is disabled by @joseluisgonzalezca in #1385
• fix(logs): normalize logs timestamp format with fixed sub-second digits by @joseluisgonzalezca in #1387
• fix(auth): skip web approval auth method only if there are other authentication methods available by @joseluisgonzalezca in #1390
• fixed #1396 - fixed API token auth for getAllTargets API in #1397
• fixed #1395 - preselect current user in access instructions modal by @Eugeny in #1405
• fixed #1404 - SSO user autocreation not working with Entra ID by @Eugeny in #1406
• fixed #1411 - duplicate Host header sent to HTTP/2 targets by @Eugeny in #1412

New Contributors

• @joseluisgonzalezca made their first contribution in #1384

Full Changelog: v0.14.1...v0.15.0

v0.15.0-beta.2

Fixes

• fixed #1395 - preselect current user in access instructions modal by @Eugeny in #1405
• fixed #1404 - SSO user autocreation not working with Entra ID by @Eugeny in #1406

Full Changelog: v0.15.0-beta.1...v0.15.0-beta.2

v0.15.0-beta.1

Features

• fixed #1104 - SNI support in #1402 - see https://warpgate.null.page/sni/
• fixed #1220 - direct-streamlocal (local UNIX socket forwarding) support in 103a480
• fixed #1368 - correctly generate version number in docker in #1372
• fixed #954 - enable gzip support for http targets in 9e144f8
• fixed #1367 - replace Swagger with Stoplight Elements in the API playground and add a note about token header in 1df9b45

Fixes

• fixed #1381 - skip password auth in postgres if not required in #1383
• fix(panel): fix user profile link by @joseluisgonzalezca in #1384
• feat(http): support for insecured websocket connections if TLS Verifyflag is disabled by @joseluisgonzalezca in #1385
• fix(logs): normalize logs timestamp format with fixed sub-second digits by @joseluisgonzalezca in #1387
• fix(auth): skip web approval auth method only if there are other authentication methods available by @joseluisgonzalezca in #1390
• fixed #1396 - fixed API token auth for getAllTargets API in #1397

New Contributors

• @joseluisgonzalezca made their first contribution in #1384

Full Changelog: v0.14.1...v0.15.0-beta.1