This release includes 2 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+10 more
Affected surfaces
ReleasePort's take
Light signalVersion 1.19.1 adds browser‑based SSH, RDP, and VNC access for public resources, all requiring Newt > 1.13.0.
Why it matters: Enables remote console access directly from the UI when Newt is upgraded past v1.13.0; operators must meet this version threshold to use the new capabilities.
Summary
AI summaryAdd browser‑based SSH, RDP and VNC access via public resources requiring Newt >1.13.0.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
Add resource policies for public resources Add resource policies for public resources Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Add browser based RDP access via public resources (requires newt >1.13.0) Add browser based RDP access via public resources (requires newt >1.13.0) Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Add browser based VNC access via public resources (requires newt >1.13.0) Add browser based VNC access via public resources (requires newt >1.13.0) Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Add browser based SSH access via public resources (requires newt >1.13.0) Add browser based SSH access via public resources (requires newt >1.13.0) Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Add native Pangolin SSH mode for private and public resources (requires newt >1.13.0) Add native Pangolin SSH mode for private and public resources (requires newt >1.13.0) Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Add auto update Newt option for all sites or specific sites (requires newt >1.13.0) Add auto update Newt option for all sites or specific sites (requires newt >1.13.0) Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Add searchable and filterable custom labels on sites and resources Add searchable and filterable custom labels on sites and resources Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Add share link post‑authentication redirect path Add share link post‑authentication redirect path Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Add pangctl command to make more than one user server admin Add pangctl command to make more than one user server admin Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Add PostgreSQL and Redis install options in the installer Add PostgreSQL and Redis install options in the installer Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Improve add loading icons on all logs tables Improve add loading icons on all logs tables Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Dependency | Medium |
Dependency security updates Dependency security updates Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Performance | Medium |
Improve clients get error when holepunching fails instead of getting stuck registering Improve clients get error when holepunching fails instead of getting stuck registering Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Performance | Low |
Improve performance in certain hot paths Improve performance in certain hot paths Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Performance | Low |
Improve speed of API endpoints with thousands of sites and users Improve speed of API endpoints with thousands of sites and users Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Bugfix | Medium |
Fix public resource showing as degraded when WireGuard targets were added alongside healthy Newt targets Fix public resource showing as degraded when WireGuard targets were added alongside healthy Newt targets Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Bugfix | Medium |
Fix enforce absolute paths in sudo commands Fix enforce absolute paths in sudo commands Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Bugfix | Medium |
Fix restarting container on RC version causing migration errors Fix restarting container on RC version causing migration errors Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Bugfix | Medium |
Fix cross site target assignment Fix cross site target assignment Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Bugfix | Low |
Fix custom branding logo URL not accepting links Fix custom branding logo URL not accepting links Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Bugfix | Low |
Fix pasting the device code not accepting paste Fix pasting the device code not accepting paste Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Bugfix | Low |
Fix refresh end time on logs tables Fix refresh end time on logs tables Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Bugfix | Low |
Fix accept partially valid Docker labels instead of rejecting all Fix accept partially valid Docker labels instead of rejecting all Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Refactor | Low |
Improve OpenAPI response payloads Improve OpenAPI response payloads Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
| Refactor | Low |
Improve auto create roles added in Blueprints Improve auto create roles added in Blueprints Source: granite4.1:30b@2026-06-12-audit Confidence: low |
— |
Full changelog
Read the 1.19 Announcement
Read the full announcement with discussion of new features: Pangolin 1.19: Browser Remote Access — SSH, RDP, VNC & More
What's Changed
- Add resource policies for public resources
- Add browser based RDP access via public resources (requires newt >1.13.0)
- Add browser based VNC access via public resources (requires newt >1.13.0)
- Add browser based SSH access via public resources (requires newt >1.13.0)
- Add native Pangolin SSH mode (for private and public resources) that does not require configuring OpenSSH server and PAM (requires newt >1.13.0)
- Add auto update Newt option for all sites in the org or specific sites (requires newt >1.13.0)
- Add searchable and filterable custom labels on sites and resources
- Add share link post authentication redirect path
- Add pangctl command to make more than one user server admin
- Add PostgreSQL and Redis install options in the installer
- Fix public resource showing as degraded when WireGuard targets were added alongside healthy Newt targets
- Fix custom branding logo URL not accepting links
- Fix pasting the device code not accepting paste
- Fix enforce absolute paths in sudo commands
- Fix refresh end time on logs tables
- Fix accept partially valid Docker labels instead of rejecting all
- Fix restarting container on RC version causing migration errors
- Fix cross site target assignment
- Improve OpenAPI response payloads
- Improve SSH configuration on private resources
- Improve sort resource filter options in audit logs
- Improve performance in certain hot paths
- Improve clients get error when holepunching fails instead of getting stuck registering
- Improve speed of API endpoints with thousands of sites and users
- Improve add loading icons on all logs tables
- Improve auto create roles added in Blueprints
- Dependency security updates
- General UI improvements
- Various other bug fixes
How to Update
[!WARNING]
This version includes a new mode of private resource: SSH. If you had previously used host resources and configured the SSH access tab, you will now need to switch these to SSH resources in order to manage the SSH config. If you do not switch they will continue to function as before but you will be unable to adjust settings.
[!IMPORTANT]
1.19 browser-based SSH requires the Badger Traefik plugin to be on the latest versionv1.4.1. The migration will automatically do this if it can find the Traefik config in the standard location. Otherwise, please ensure your Badger is up to date.
[!IMPORTANT]
Browser-based RDP, SSH, and VNC as well as the new Pangolin SSH mode requires Newt version1.13.0or greater.
[!IMPORTANT]
Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.
Breaking Changes
- Private resources previously configured with an SSH access tab must be switched to the new "SSH" resource type; otherwise settings cannot be adjusted.
- Browser‑based RDP, VNC and native Pangolin SSH require Newt version 1.13.0 or greater.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Beta — feedback welcome: [email protected]