This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+10 more
Affected surfaces
ReleasePort's take
Moderate signalRelease 1.19.0 adds a native Pangolin SSH mode for both private and public resources, eliminating the need for OpenSSH/PAM; this requires newt >1.13.0.
Why it matters: Affects SSH resource configuration; migration is required if you use existing host resources and must upgrade newt beyond version 1.13.0.
Summary
AI summaryNew SSH resource mode requires migration for previously configured host resources.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Medium |
Fix enforce absolute paths in sudo commands Fix enforce absolute paths in sudo commands Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Feature | Low |
Add resource policies for public resources Add resource policies for public resources Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Add browser based RDP access via public resources (requires newt >1.13.0) Add browser based RDP access via public resources (requires newt >1.13.0) Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Add browser based VNC access via public resources (requires newt >1.13.0) Add browser based VNC access via public resources (requires newt >1.13.0) Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Add browser based SSH access via public resources (requires newt >1.13.0) Add browser based SSH access via public resources (requires newt >1.13.0) Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Add native Pangolin SSH mode for private and public resources without OpenSSH/PAM (requires newt >1.13.0) Add native Pangolin SSH mode for private and public resources without OpenSSH/PAM (requires newt >1.13.0) Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Add auto update Newt option for all sites or specific sites (requires newt >1.13.0) Add auto update Newt option for all sites or specific sites (requires newt >1.13.0) Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Add searchable and filterable custom labels on sites and resources Add searchable and filterable custom labels on sites and resources Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Add share link post‑authentication redirect path Add share link post‑authentication redirect path Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Add pangctl command to make more than one user server admin Add pangctl command to make more than one user server admin Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Add PostgreSQL and Redis install options in the installer Add PostgreSQL and Redis install options in the installer Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Improve clients get error when holepunching fails instead of getting stuck registering Improve clients get error when holepunching fails instead of getting stuck registering Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Feature | Low |
Improve add loading icons on all logs tables Improve add loading icons on all logs tables Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Performance | Low |
Improve performance in certain hot paths Improve performance in certain hot paths Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Performance | Low |
Improve speed of API endpoints with thousands of sites and users Improve speed of API endpoints with thousands of sites and users Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Performance | Low |
Improve sort resource filter options in audit logs Improve sort resource filter options in audit logs Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Bugfix | Medium |
Fix public resource showing as degraded when WireGuard targets were added alongside healthy Newt targets Fix public resource showing as degraded when WireGuard targets were added alongside healthy Newt targets Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Bugfix | Medium |
Fix restarting container on RC version causing migration errors Fix restarting container on RC version causing migration errors Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Bugfix | Medium |
Fix cross site target assignment Fix cross site target assignment Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Bugfix | Low |
Fix custom branding logo URL not accepting links Fix custom branding logo URL not accepting links Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Bugfix | Low |
Fix pasting the device code not accepting paste Fix pasting the device code not accepting paste Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Bugfix | Low |
Fix refresh end time on logs tables Fix refresh end time on logs tables Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Bugfix | Low |
Fix accept partially valid Docker labels instead of rejecting all Fix accept partially valid Docker labels instead of rejecting all Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Refactor | Low |
Improve OpenAPI response payloads Improve OpenAPI response payloads Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Refactor | Low |
Improve auto create roles added in Blueprints Improve auto create roles added in Blueprints Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
Full changelog
Read the 1.19 Announcement
Read the full announcement with discussion of new features: Pangolin 1.19: Browser Remote Access — SSH, RDP, VNC & More
What's Changed
- Add resource policies for public resources
- Add browser based RDP access via public resources (requires newt >1.13.0)
- Add browser based VNC access via public resources (requires newt >1.13.0)
- Add browser based SSH access via public resources (requires newt >1.13.0)
- Add native Pangolin SSH mode (for private and public resources) that does not require configuring OpenSSH server and PAM (requires newt >1.13.0)
- Add auto update Newt option for all sites in the org or specific sites (requires newt >1.13.0)
- Add searchable and filterable custom labels on sites and resources
- Add share link post authentication redirect path
- Add pangctl command to make more than one user server admin
- Add PostgreSQL and Redis install options in the installer
- Fix public resource showing as degraded when WireGuard targets were added alongside healthy Newt targets
- Fix custom branding logo URL not accepting links
- Fix pasting the device code not accepting paste
- Fix enforce absolute paths in sudo commands
- Fix refresh end time on logs tables
- Fix accept partially valid Docker labels instead of rejecting all
- Fix restarting container on RC version causing migration errors
- Fix cross site target assignment
- Improve OpenAPI response payloads
- Improve SSH configuration on private resources
- Improve sort resource filter options in audit logs
- Improve performance in certain hot paths
- Improve clients get error when holepunching fails instead of getting stuck registering
- Improve speed of API endpoints with thousands of sites and users
- Improve add loading icons on all logs tables
- Improve auto create roles added in Blueprints
- Dependency security updates
- General UI improvements
- Various other bug fixes
How to Update
[!WARNING]
This version includes a new mode of private resource: SSH. If you had previously used host resources and configured the SSH access tab, you will now need to switch these to SSH resources in order to manage the SSH config. If you do not switch they will continue to function as before but you will be unable to adjust settings.
[!IMPORTANT]
1.19.0 browser-based SSH requires the Badger Traefik plugin to be on the latest versionv1.4.1. The migration will automatically do this if it can find the Traefik config in the standard location. Otherwise, please ensure your Badger is up to date.
[!IMPORTANT]
Browser-based RDP, SSH, and VNC as well as the new Pangolin SSH mode requires Newt version1.13.0or greater.
[!IMPORTANT]
Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.
Breaking Changes
- Private resources previously using host resources with configured SSH must be switched to the new SSH resource type; otherwise settings become unmanageable.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Beta — feedback welcome: [email protected]