New features

• feat(phoenix-channel): remove concept of "inbound requests" @thomaseizinger (#3831)
• feat(phoenix-channel): support the wire log target @thomaseizinger (#3832)
• feat(phoenix-channel): log host as part of connection @thomaseizinger (#3836)
• feat(website): March Product Update @jamilbk (#3886)
• feat(snownet): set wireguard keep-alive @thomaseizinger (#3829)
• feat(website): add product download links to footer @jamilbk (#3820)
• refactor(docs): Clarify initial docs sync @jamilbk (#3819)
• feat(snownet): print some basic stats for STUN overhead @thomaseizinger (#3806)
• feat(gui-client): make all modules Linux-friendly @ReactorScram (#3737)

🐛 Bug Fixes

• fix(ci): Fix Android dependabot groups @jamilbk (#3869)
• fix(phoenix-channel): don't double join room @thomaseizinger (#3833)
• fix(docs): Add DNS docs for Linux @jamilbk (#3810)
• fix(portal): Fix IdP syncs @AndrewDryga (#3816)
• fix(portal): Use local image for logo path @jamilbk (#3814)
• fix(dependencies): Catch groups that dependabot missed @jamilbk (#3883)
• fix(website): Manually fix issues with new NodeJS libs @jamilbk (#3885)
• fix(phoenix-channel): retain order of messages to be sent to the portal @thomaseizinger (#3834)
• fix(ci): Publish images even for hotfixes @jamilbk (#3897)
• fix(website): Fix typos, clarify connection benefits mar 2024 blogpost @jamilbk (#3894)
• fix(tauri clients): apply auth base URL and API URL settings without app restart @ReactorScram (#3868)

🧰 Maintenance

• refactor: Reduce log levels for production releases to avoid filling customer's… @jamilbk (#3899)
• chore: Revert "fix(ci): Publish images even for hotfixes" @jamilbk (#3898)
• build(deps-dev): Bump floki from 0.35.3 to 0.35.4 in /elixir @dependabot (#3842)
• build(deps): Bump tempfile from 3.10.0 to 3.10.1 in /rust @dependabot (#3878)
• build(deps): Bump tauri from 1.6.0 to 1.6.1 in /rust @dependabot (#3881)
• build(deps): Bump walkdir from 2.4.0 to 2.5.0 in /rust @dependabot (#3882)
• refactor(linux): make a place for reverting /etc/resolv.conf @ReactorScram (#3822)
• build(deps): Bump next-hubspot from 1.2.0 to 1.3.0 in /website @dependabot (#3875)
• build(deps): Bump fast-xml-parser from 4.3.3 to 4.3.5 in /website @dependabot (#3876)
• build(deps): Bump @types/node from 20.11.0 to 20.11.24 in /website @dependabot (#3877)
• build(deps): Bump lycheeverse/lychee-action from 1.9.0 to 1.9.3 @dependabot (#3850)
• build(deps): Bump asciinema-player from 3.6.3 to 3.7.0 in /website @dependabot (#3852)
• build(deps): Bump flowbite from 2.2.1 to 2.3.0 in /website @dependabot (#3854)
• build(deps): Bump flowbite from 2.2.1 to 2.3.0 in /elixir/apps/web/assets @dependabot (#3846)
• build(deps): Bump release-drafter/release-drafter from 5 to 6 @dependabot (#3849)
• build(deps): Bump @types/react from 18.2.51 to 18.2.61 in /website @dependabot (#3851)
• build(deps): Bump postcss from 8.4.33 to 8.4.35 in /website @dependabot (#3853)
• build(deps): Bump the com-android group in /kotlin/android with 1 update @dependabot (#3856)
• build(deps): Bump androidx.security:security-crypto from 1.1.0-alpha05 to 1.1.0-alpha06 in /kotlin/android @dependabot (#3857)
• build(deps): Bump androidx.hilt:hilt-compiler from 1.0.0 to 1.2.0 in /kotlin/android @dependabot (#3858)
• build(deps): Bump com.google.firebase:firebase-bom from 32.7.1 to 32.7.3 in /kotlin/android @dependabot (#3859)
• build(deps): Bump com.google.gms.google-services from 4.4.0 to 4.4.1 in /kotlin/android @dependabot (#3860)
• test(windows client): Add stack trace printing to smoke test @ReactorScram (#3813)
• chore(asdf-vm): add shellcheck version @ReactorScram (#3823)
• refactor(docs): Update SECURITY.md to mention opening GitHub security advisories @jamilbk (#3787)
• refactor(portal): unify format of error payloads in websocket connection @AndrewDryga (#3697)
• build(connlib): suppress clippy::unnecessary_cast lint on aarch64 Linux @ReactorScram (#3824)
• deps: point to correct hash of str0m fork @thomaseizinger (#3827)

Changelog

• fix(portal|website): Fix static paths for website and elixir @jamilbk (#3802)
• fix(connlib): update resource list on resource removal @conectado (#3796)
• Handle disconnect messages in LV @AndrewDryga (#3795)
• feat(snownet): only keep the best possible candidate pair alive @thomaseizinger (#3792)
• refactor(connlib): replace intent timer with explicit throttling @thomaseizinger (#3778)
• feat(snownet): reduce connection setup latency @thomaseizinger (#3772)
• chore: add nix scripts @thomaseizinger (#3771)
• chore(connlib): Tune log filters to enable debug in dev and info for gateway deployments @jamilbk (#3788)
• chore(snownet): reduce log levels @thomaseizinger (#3777)
• fix(portal|website): Fix favicons for dark mode @jamilbk (#3785)
• chore(repo): Move other dotfiles to reduce directory size of root @jamilbk (#3780)
• feat(android): add settings button to the session view @jasonboukheir (#3755)
• feat(connlib): support resource updates from the portal @conectado (#3754)
• chore: move markdown files into docs/ directory @thomaseizinger (#3773)
• refactor(connlib): unify handling of IP packets @thomaseizinger (#3762)
• chore: remove markdownlint config files @thomaseizinger (#3774)
• fix(gui-client): fix some papercuts @ReactorScram (#3769)
• feat(android): use Android ShareSheet for sharing logs @jasonboukheir (#3756)
• fix(android): delete log zip on finish and on create @jasonboukheir (#3757)
• refactor(connlib): unify peer storage @conectado (#3738)
• fix(connlib): correctly handle GRO @thomaseizinger (#3732)
• refactor(snownet): be more explicit about dispatching messages @thomaseizinger (#3741)
• build: enable Tauri dep for Linux and alphabetize deps @ReactorScram (#3742)
• fix(ci): phoenix channel tests not running @conectado (#3749)
• fix(gui-client): remove duplicated script @ReactorScram (#3745)
• fix(ci): run relay tests @conectado (#3747)
• fix(relay): update tests for current values @conectado (#3746)
• ci: change cargo chef call so it will ignore the GUI client @ReactorScram (#3740)
• connlib: remove tun mutex @conectado (#3743)
• feat(ci): Test that relay restarts don't break existing connected entities @jamilbk (#3671)
• feat(dev): add dev yml for rust development @conectado (#3670)
• chore: make rtnetlink versions explicit @ReactorScram (#3736)
• chore(snownet): reuse RingBuffer @thomaseizinger (#3725)
• refactor: rename windows-client to gui-client @ReactorScram (#3721)
• fix(ci): Fix flaky iperf3 "Bad file descriptor" @jamilbk (#3731)
• Remove assertions in sign-in success acceptance tests @bmanifold (#3733)
• refactor(portal): Remove assertions in sign-in success acceptance tests @bmanifold (#3730)
• fix(snownet): don't log addresses twice @thomaseizinger (#3711)
• feat(relay): increase number of allowed requests per nonce @thomaseizinger (#3726)
• refactor(portal): Add website_link component @jamilbk (#3715)
• fix(gateway): expire resources @conectado (#3722)
• feat(snownet): optimise which channels we bind @thomaseizinger (#3709)
• Disable sign up in staging @bmanifold (#3723)
• Add sign-in success page for clients @bmanifold (#3714)
• fix(connlib): set the real packet length before putting it into the device @conectado (#3718)
• fix(ci): Use default NDK on GH runners @jamilbk (#3716)
• fix(ci): Use workflow id to fetch perf results @jamilbk (#3710)
• fix(snownet): make TURN channel bindings more reliable @thomaseizinger (#3708)
• feat(connlib): filter out relays based on our locally created sockets @thomaseizinger (#3705)
• refactor(connlib): simplify resource ordering by implementing Ord trait @conectado (#3696)
• refactor(ci): Merge perf results into one comment @jamilbk (#3707)
• feat!(portal): return relays as plain socket addresses @thomaseizinger (#3665)
• chore(ci): enforce shellscript formatting and style @jamilbk (#3679)
• fix(ci): Fix js typo @jamilbk (#3704)
• fix(connlib): set socket to IPv6 only before binding address @thomaseizinger (#3701)
• fix(ci): Fix typo preventing perf-results from being calculated @jamilbk (#3703)
• fix(ci): Fix result overwrite @jamilbk (#3700)
• fix(ci): Run each perf test in its own matrix job @jamilbk (#3695)
• feat(portal): Billing system @AndrewDryga (#3642)
• refactor(connlib): replace webrtc-rs with snownet @conectado (#3391)
• fix(snownet): don't trigger busy loop upon refreshing allocation @conectado (#3693)
• chore(repo): Update issue template with support links @jamilbk (#3678)
• Revert "feat(portal): Add sign-in success page for clients" @jamilbk (#3692)
• feat(portal): Add sign-in success page for clients @bmanifold (#3659)
• fix(ci): Ensure integration-tests allow for at least 30 seconds to establish a connection @jamilbk (#3676)
• Revert "fix(gateway): Remove /dev/net/tun requirement and clean up upgrade script @AndrewDryga (#3691)
• fix(android): move log zip file outside of log folder @jasonboukheir (#3677)
• chore(portal): Add okta as IdP in dev @jamilbk (#3675)
• feat(android): Add support for per-app VPN configurable through MDM @jamilbk (#3657)
• fix(ci): Be explicit about service start order @jamilbk (#3673)
• refactor(ci): Use curl for connectivity tests in CI @jamilbk (#3674)
• chore(snownet): expose Server and Client @thomaseizinger (#3664)
• feat(snownet): instrument public API using tracing @thomaseizinger (#3663)
• feat(linux): Control DNS with systemd-resolved @ReactorScram (#3643)
• ci: upgrade iperf @thomaseizinger (#3662)
• fix(snownet): generate candidates only after we accept the ICE answer @conectado (#3658)
• refactor(connlib): move DNS resolution into tunnel @thomaseizinger (#3652)
• refactor(ci): simplify dns resources in ci @jamilbk (#3653)
• fix(gateway): re-implement resource address resolution in eventloop @conectado (#3656)
• feat(linux): Notify systemd when we've started @ReactorScram (#3628)
• feat(android): add Reset to Defaults button and add space to settings activity @jasonboukheir (#3651)
• feat(snownet): timeout connections without a handshake after 20 seconds @thomaseizinger (#3633)
• ci: don't ping gateway before running perf @thomaseizinger (#3649)
• feat(snownet): attempt to make new allocation when refresh fails @thomaseizinger (#3631)
• refactor(gateway): perform DNS resolution of resources in eventloop @thomaseizinger (#3622)
• feat(snownet): invalidate candidates @thomaseizinger (#3604)
• chore(snownet): better logging @thomaseizinger (#3646)
• Update Okta IDP adapter in portal @bmanifold (#3647)
• ci: move tests to bash scripts @thomaseizinger (#3648)
• refactor(android): Clean up tunnel fd establishment @jamilbk (#3645)
• fix(android): prevent null pointer segfault on 32-bit platforms @jamilbk (#3619)
• ci(linux): add CI setup script for NetworkManager @ReactorScram (#3641)
• feat(linux): Add FIREZONE_DNS_CONTROL env var to choose which DNS control method to use @ReactorScram (#3629)
• fix(snownet): remove debug_assert! for timed-out connections @thomaseizinger (#3635)
• feat(snownet): only emit ConnectionEstablished upon the first connection @thomaseizinger (#3634)
• feat(snownet): remove wireguard keep-alives @thomaseizinger (#3630)
• chore(connlib): Make request ioctl mutable @jamilbk (#3644)
• refactor(android): Simplify tunnel implementation and fix tunnel lifecycle @jamilbk (#3583)
• chore(website): Update team @jamilbk (#3638)
• ci(windows): test crash handling as part of smoke test @ReactorScram (#3624)
• chore: bump Rust version to 1.76 @thomaseizinger (#3632)
• Add Okta directory sync @bmanifold (#3614)
• Add dynamic/managed groups and default Everyone one @AndrewDryga (#3346)
• chore(ci): update Node to 20 in the Windows CI jobs @ReactorScram (#3611)
• ci(windows): add 'firezone' to the MSI names @ReactorScram (#3610)
• feat(portal): Broadcast resource sites @AndrewDryga (#3466)
• chore(ci): Fix CI deprecation and workflow warnings @jamilbk (#3612)
• ci(windows): fix warning about CONNLIB_LOG_UPLOAD_INTERVAL_SECS @ReactorScram (#3606)
• chore(apple): Add logs about accessing firezone-id in disk @roop (#3607)
• feat(connlib): remove duplication from logs @thomaseizinger (#3596)
• feat(snownet): refresh allocation upon each new connection @thomaseizinger (#3591)
• fix(snownet): replace Allocation if credentials to relay change @thomaseizinger (#3590)
• refactor(snownet): introduce CandidateEvent @thomaseizinger (#3592)
• feat(snownet): instrument the handle_input function with tracing @thomaseizinger (#3594)
• refactor(connlib): remove unnecessary Serialize derive @thomaseizinger (#3595)
• fix(snownet): don't try to re-authorize forever @thomaseizinger (#3589)
• feat(windows): split up signing-in state, closes #3597 @ReactorScram (#3599)
• chore(snownet): remove obsolete TODO @thomaseizinger (#3593)
• fix(snownet): don't mangle source IP to determine use of relay @thomaseizinger (#3556)
• fix(snownet): properly cleanup connections before adding a new one @conectado (#3587)
• fix(windows): Ensure crashes, errors, and panics are all logged to file @ReactorScram (#3572)
• fix(ci): wait for Vault to load sign in form before filling it out @jamilbk (#3585)
• Revert "chore(android): Remove i686 android target" @jamilbk (#3586)
• feat(devops): Add Trisha to staging GCP @jamilbk (#3584)
• refactor(portal): log in -> sign in @jamilbk (#3577)
• fix(snownet): don't attempt to bind a channel if we don't have a matching allocation @thomaseizinger (#3575)
• fix: don't initialize relay with non-existent interface @thomaseizinger (#3582)
• fix(snownet): always clear state of failed connections @thomaseizinger (#3581)
• feat(snownet): retry TURN allocations using exponential backoffs @thomaseizinger (#3530)
• chore(portal): Enable Microsoft Entra by default in all envs @jamilbk (#3576)
• ci(windows): run the Windows smoke test in CI @ReactorScram (#3542)
• fix(android): Use persistent device ID @jamilbk (#3566)
• chore(portal): Misc sign in UX fixes @jamilbk (#3564)
• fix(connlib): Enable ansi colors for the windows client debug console @conectado (#3552)
• fix(windows): save actor name to disk and reload it on startup @ReactorScram (#3546)
• feat(windows): add smoke test subcommand @ReactorScram (#3541)
• chore(infra): Limit relays to used regions and expected load @jamilbk (#3540)
• feat(portal): Add Microsoft Entra IDP sync to portal @bmanifold (#3433)
• feat(snownet): return MutableIpPacket from decapsulate @thomaseizinger (#3555)
• chore(snownet): fix bad caching base after rename @thomaseizinger (#3557)
• feat(snownet): retry STUN bindings using exponential backoff @thomaseizinger (#3529)
• deps: update to latest upstream version of str0m @thomaseizinger (#3554)
• feat(snownet): automatically discover host candidates @thomaseizinger (#3528)
• feat(windows): check Github for updates on startup @ReactorScram (#3527)
• fix(windows): show user-friendly error if a 2nd instance tries to start @ReactorScram (#3548)
• chore(android): Remove i686 android target @jamilbk (#3547)
• fix(firezone-tunnel(windows)): don't panic if the sending ring buffer is full @ReactorScram (#3544)
• feat(windows): log have_internet changes and API base URL at INFO level @ReactorScram (#3543)
• fix(android): Load library before starting tunnel only @jamilbk (#3539)
• chore(portal): Add helptext explaning auth identities/tokens @jamilbk (#3515)
• fix(windows): fix counting / exporting / clearing log files @ReactorScram (#3535)
• feat(windows): add CLI flag to test a clickable update notification @ReactorScram (#3526)
• refactor(windows): simplify how CLI args are passed to the GUI @ReactorScram (#3525)
• fix(android): Allow bypassing AlwaysOn VPN @jamilbk (#3522)
• feat(portal): Sync transitive memberships for Google Workspace @AndrewDryga (#3524)
• Fix bug with restoring deleted identities and actors @AndrewDryga (#3523)
• refactor(windows): Add context to errors, add SAFETY comments, update TODOs @ReactorScram (#3517)
• fix(windows): install and load wintun.dll from a well-known path instead of setting the current directory @ReactorScram (#3430)
• Reactorscram/fix webview2 crash @ReactorScram (#3464)
• fix(docs): Fix Docsearch recordExtractors, sitemap, and cookie banner script load @jamilbk (#3512)
• feat(portal): Broadcast state changes to connected clients and gateways @AndrewDryga (#2240)
• fix(android): Fix typo from refactor @jamilbk (#3511)
• chore(ci): Update dependabot android groups @jamilbk (#3501)
• refactor(website): Add punchier website headline @jamilbk (#3473)
• fix(snownet): don't try to allocate a new channel if we already have one @thomaseizinger (#3476)
• fix(snownet): don't use unbound channels for relaying @thomaseizinger (#3474)
• fix(relay): correctly separate channel state for different peers @thomaseizinger (#3472)
• refactor(windows): change some anyhow errors into thiserror errors @ReactorScram (#3461)
• ci(windows): hide bare Windows exe from releases page @ReactorScram (#3471)
• ci(windows): Upload Windows debug symbols @ReactorScram (#3467)
• feat(firezone-tunnel): sort resources alphabetically @ReactorScram (#3465)
• chore(ci): Bump sccache; remove IPC debug build @jamilbk (#3468)
• refactor(windows): remove IPC code which is now unused @ReactorScram (#3469)
• refactor: Remove user-facing parts of STUN-only feature @jamilbk (#3453)
• fix(windows): don't crash if the saved log filter is invalid @ReactorScram (#3460)
• feat(android): Add Android Headless Operation @jasonboukheir (#3438)
• feat(ci): Standardize matrix job names to prevent dupes, move jobs to macos-14 @jamilbk (#3447)
• fix(windows): CSS nit @ReactorScram (#3463)
• fix(windows): Take the default button shade darker a notch @jamilbk (#3462)
• Apple: Add 'debug' to network extension name in debug configuration @roop (#3459)
• fix(ci): Fix perf test names @jamilbk (#3454)
• fix(connlib): handle null-termination of TUN device path string correctly @jamilbk (#3449)
• fix(connection): only emit Transmit.src that correspond to local sockets @thomaseizinger (#3411)
• feat(relay): allow channel bindings to IPv6 addresses @thomaseizinger (#3434)
• feat(connection): rebrand to snownet @thomaseizinger (#3435)
• feat(docs): Add docs overview content @jamilbk (#3440)
• docs(windows): Update docs for Windows VM testing / resetting files Firezone creates @ReactorScram (#3448)
• fix(windows): use a well-known path for the crash handler socket @ReactorScram (#3444)
• feat(windows): enable crash handling on release builds @ReactorScram (#3441)
• refactor(windows): handle tray menu events in the main loop @ReactorScram (#3446)
• fix(windows): Ensure production exes / MSIs don't show "-modified" Git versions @ReactorScram (#3432)
• refactor(windows): use 'use' statements better in crash handling @ReactorScram (#3442)
• feat(connection): allocate IPv6 address @thomaseizinger (#3436)
• chore(relay): update docs in regards to spec-compliance @thomaseizinger (#3437)
• feat(apple): Write app and tunnel log to disk @roop (#3322)
• Add SSH public key to AWS Terraform @bmanifold (#3439)
• refactor(windows): set absolute paths for logs and wintun.dll @ReactorScram (#3428)
• feat(phoenix-channel): reconnect on missed heartbeat from portal @thomaseizinger (#3410)
• fix(windows): Show "Signing in..." menu during auto-sign-in @ReactorScram (#3431)
• fix(windows): move crash dumps into logs dir so they get exported in the zip, closes #3263 @ReactorScram (#3426)
• feat(relay): print stats every 10s @thomaseizinger (#3408)
• fix(ci): Increase test nonce length to reduce collisions @jamilbk (#3373)
• feat(ops): Add support provisioning helper @jamilbk (#3422)
• feat(windows): UI notification for reauth (#3329) @ReactorScram (#3416)
• fix(ci): Setup pnpm before use @jamilbk (#3423)
• fix(gateway): Remove /dev/net/tun requirement and clean up upgrade script @jamilbk (#3392)
• refactor(infra): Make relay and gateway logs sane on prod @jamilbk (#3400)
• fix(portal): fix otlp exporter initialization @Intuinewin (#3375)
• fix(connection): buffer channel bindings until we have an allocation @thomaseizinger (#3417)
• feat(relay): print a log for error responses we send to the client @thomaseizinger (#3413)
• chore(relay): change run_smoke_test.sh to use /usr/bin/env @thomaseizinger (#3409)
• feat(connection): introduce keep-alive and expose last_seen @thomaseizinger (#3388)
• fix(connection): accept relay traffic from non-listening interface @thomaseizinger (#3412)
• feat(connection): add a very basic connection timeout @thomaseizinger (#3397)
• feat(relay): improve logging and error handling @thomaseizinger (#3399)
• feat(gateway): don't print stacktrace upon exit @thomaseizinger (#3404)
• chore: update str0m dependency @thomaseizinger (#3402)
• fix(connection-tests): avoid rare flakiness of relay test @thomaseizinger (#3394)
• feat: automatically rejoin channel on portal after reconnect @thomaseizinger (#3393)
• fix(gateway): tokio feature dependencies @conectado (#3396)
• fix(ci): Update codespell ignorelist and fix typos @jamilbk (#3398)
• fix(windows): allow user to cancel sign-in flow @ReactorScram (#3385)
• feat(ci): Test client gracefully handles portal and relay disconnects @jamilbk (#3376)
• refactor(gateway): Update gateway logs level @conectado (#3387)
• docs(gateway): Document egress connectivity requirements for Gateways @jamilbk (#3312)
• refactor(android): Move log controls to Logs section of Settings @jasonboukheir (#3315)
• feat(connection): generate TURN candidates from provided relays @thomaseizinger (#3297)
• fix(gateway): Use new prod Docker registry for upgrades @jamilbk (#3386)
• ci(windows): call pnpm so the frontend gets built, closes #3381 @ReactorScram (#3382)
• fix(devops): Fix typo in AWS bastion host TF @bmanifold (#3380)
• refactor(windows): Add logo and version to About window @jamilbk (#3378)
• feat(phoenix-channel): automatically reconnect based on provided ExponentialBackoff @thomaseizinger (#3364)
• fix(windows): prevent a security issue @ReactorScram (#3326)
• fix(devops): Update AWS gateway TF @bmanifold (#3374)

✨ Features

• feat(linux): If FIREZONE_DNS_CONTROL is etc-resolv-conf, modify '/etc/resolv.conf' @ReactorScram (#3639)
• test(linux): Low-risk changes to prepare for Linux DNS support @ReactorScram (#3625)

🐛 Bug Fixes

• revert: 3622 to fix failing DNS CI test @ReactorScram (#3654)
• fix(windows): improve logging around smoke test / log export @ReactorScram (#3600)
• fix(windows): Wrap deep link URLs in SecureUrl, don't log them @ReactorScram (#3574)
• fix(windows): vt100 seems to panic in CI, just print a warning instead @ReactorScram (#3573)

🧰 Maintenance

• fix: Slow DNS lookups on (at least) Windows by updating to main of Hickory @ReactorScram (#3799)
• build(deps): Bump socket2 from 0.5.5 to 0.5.6 in /rust @dependabot (#3766)
• build(deps): Bump anyhow from 1.0.79 to 1.0.80 in /rust @dependabot (#3765)
• build(deps): Bump minidumper from 0.8.1 to 0.8.2 in /rust @dependabot (#3764)
• build(deps): Bump tauri-utils from 1.5.2 to 1.5.3 in /rust @dependabot (#3767)
• refactor(ci): enable Linux do-nothing GUI builds (but not tests) in CI/CD, extract scripts for that @ReactorScram (#3735)
• refactor(GUI clients): extract known_dirs module @ReactorScram (#3734)
• test(windows): make sure files are written to the right paths during smoke tests @ReactorScram (#3727)
• refactor(ci): extract scripts for GUI client smoke tests @ReactorScram (#3724)
• test: add mock token storage for CI tests on Ubuntu @ReactorScram (#3720)
• refactor(ci): extract setup-tauri action and generalize Windows builds @ReactorScram (#3702)
• refactor: move BUNDLE_ID since it won't be Windows-specific @ReactorScram (#3706)
• build(deps): Bump arboard from 3.3.0 to 3.3.1 in /rust @dependabot (#3687)
• build(deps): Bump ring from 0.17.7 to 0.17.8 in /rust @dependabot (#3686)
• build(deps): Bump semver from 1.0.21 to 1.0.22 in /rust @dependabot (#3685)
• build(deps): Bump tokio from 1.35.1 to 1.36.0 in /rust @dependabot (#3561)
• build(deps): Bump crash-handler from 0.6.0 to 0.6.1 in /rust @dependabot (#3623)
• build(deps): Bump time from 0.3.32 to 0.3.34 in /rust @dependabot (#3559)
• fix(windows): keep the main loop running even if a request has an error @ReactorScram (#3569)
• build(deps): Bump minidumper from 0.8.0 to 0.8.1 in /rust @dependabot (#3560)
• build(deps): Bump hashicorp/tfc-workflows-github from 1.1.1 to 1.2.0 @dependabot (#3477)
• build(deps): Bump itertools from 0.12.0 to 0.12.1 in /rust @dependabot (#3507)
• build(deps): Bump libc from 0.2.152 to 0.2.153 in /rust @dependabot (#3508)
• build(deps): Bump time from 0.3.31 to 0.3.32 in /rust @dependabot (#3509)
• build(deps): Bump @types/mdx from 2.0.10 to 2.0.11 in /website @dependabot (#3489)
• build(deps-dev): Bump @types/node from 18.19.8 to 20.11.15 in /rust/windows-client @dependabot (#3502)
• build(deps): Bump @types/react from 18.2.47 to 18.2.51 in /website @dependabot (#3505)
• build(deps): Bump marocchino/tool-versions-action from 1.1.1 to 1.2.0 @dependabot (#3478)
• build(deps): Bump @next/mdx from 14.0.4 to 14.1.0 in /website @dependabot (#3503)
• build(deps): Bump com.google.android.material:material from 1.8.0 to 1.11.0 in /kotlin/android @dependabot (#3483)
• build(deps): Bump com.squareup.moshi:moshi from 1.15.0 to 1.15.1 in /kotlin/android @dependabot (#3481)
• build(deps): Bump androidx.browser:browser from 1.5.0 to 1.7.0 in /kotlin/android @dependabot (#3482)
• build(deps): Bump gradle/wrapper-validation-action from 1 to 2 @dependabot (#3479)
• build(deps): Bump navVersion from 2.7.4 to 2.7.6 in /kotlin/android @dependabot (#3484)
• build(deps): Bump androidx.lifecycle:lifecycle-runtime-ktx from 2.6.1 to 2.7.0 in /kotlin/android @dependabot (#3485)
• build(deps-dev): Bump hastscript from 8.0.0 to 9.0.0 in /website @dependabot (#3487)
• build(deps): Bump react-fast-marquee from 1.6.2 to 1.6.3 in /website @dependabot (#3488)
• build(deps): Bump the google group in /terraform/environments/production with 2 updates @dependabot (#3504)
• build(deps): Bump the google group in /terraform/environments/staging with 2 updates @dependabot (#3510)
• build(deps): Bump tailwindcss from 3.4.0 to 3.4.1 in /website @dependabot (#3490)
• build(deps): Bump gradle/gradle-build-action from 2 to 3 @dependabot (#3480)
• build(deps): Bump serde from 1.0.195 to 1.0.196 in /rust @dependabot (#3421)
• build(deps): Bump keyring from 2.3.1 to 2.3.2 in /rust @dependabot (#3419)
• build(deps): Bump actions/cache from 3 to 4 @dependabot (#3356)
• build(deps): Bump telemetry_metrics from 0.6.1 to 0.6.2 in /elixir @dependabot (#3362)
• build(deps): Bump winreg from 0.51.0 to 0.52.0 in /rust @dependabot (#3420)
• build(deps): Bump plug_cowboy from 2.6.1 to 2.6.2 in /elixir @dependabot (#3358)
• build(deps): Bump env_logger from 0.10.1 to 0.10.2 in /rust @dependabot (#3359)
• build(deps): Bump ex_cldr_numbers from 2.32.3 to 2.32.4 in /elixir @dependabot (#3360)

📝 Documentation

• ci: document and fix a couple things for local Docker testing @ReactorScram (#3672)
• docs(linux): document default DNS setup on Debian 12 and Ubuntu 20.04 @ReactorScram (#3668)
• docs(linux): document test setups for exercising all the Linux code @ReactorScram (#3660)

• fix(windows): work around possible keyring multi-threading bug for now @ReactorScram (#3363)
• fix(gateway): make dns request in a new task without blocking peers @conectado (#3370)
• deps: use usptream str0m @thomaseizinger (#3365)
• Add explicit sysctl flags for AWS gateway command @bmanifold (#3366)
• fix(apple): Enforce types when encoding getSystemDefaultResolvers to prevent tunnel crash @jamilbk (#3367)

🧰 Maintenance

• build(deps): Bump clap from 4.4.17 to 4.4.18 in /rust @dependabot (#3357)
• build(deps): Bump chrono from 0.4.31 to 0.4.32 in /rust @dependabot (#3361)

🐛 Bug fixes

• feat(devops): Add CoreDNS to AWS TF @bmanifold (#3351)
• refactor(windows): Windows UI polish @jamilbk (#3338)
• fix(connlib): Increase max partition time to handle client network partitions more gracefully @jamilbk (#3335)
• test(windows): make Windows kill child processes when the parent exits @ReactorScram (#3311)
• test(windows): multi-process test for IPC @ReactorScram (#3310)
• feat(windows): detect network changes and log when connlib should stop / start / restart @ReactorScram (#3262)
• feat(windows): prototype module for IPC @ReactorScram (#3304)
• refactor(windows): move debug subcommands closer to their code and further from production subcommands @ReactorScram (#3307)
• Use INFO for phoenix-channel portal connection @jamilbk (#3328)
• connlib: Fix SplitDNS for some resources in web browsers @conectado (#3324)
• fix(windows): #3211, start logs earlier, before Tauri starts @ReactorScram (#3296)
• feat(windows): update network_changes module @ReactorScram (#3291)
• Connlib multiple dns @conectado (#3317)
• refactor(windows): clean up and simplify subcommands @ReactorScram (#3306)
• refactor(windows): make load_advanced_settings sync so it doesn't need Tokio @ReactorScram (#3295)
• Fix radio button toggle on Sites edit page @bmanifold (#3318)
• feat(connection): use STUN to generate server-reflexive candidate @thomaseizinger (#3268)
• refactor(windows): move CLI things inside client.rs @ReactorScram (#3305)
• fix(portal): Allow users to manually provision OIDC users @AndrewDryga (#3325)

🧰 Maintenance

• build(deps): Bump uuid from 1.6.1 to 1.7.0 in /rust @dependabot (#3339)
• build(deps): Bump async-compression from 0.4.5 to 0.4.6 in /rust @dependabot (#3340)
• build(deps): Bump shlex from 1.2.0 to 1.3.0 in /rust @dependabot (#3345)
• build(deps): Bump wintun from 0.3.2 to 0.4.0 in /rust @dependabot (#3341)
• build(deps): Bump h2 from 0.3.23 to 0.3.24 in /rust @dependabot (#3319)

• feat(devops): Add AWS terraform @bmanifold (#3298)
• fix(ci): Restart iperf3 in between bandwidth tests @jamilbk (#3303)
• fix(connlib): handle expiration messages correctly @conectado (#3292)
• fix(portal): Remove leftovers of client name unique constraint @AndrewDryga (#3282)
• feat(windows): crash handler that writes minidumps to ... @ReactorScram (#3200)
• Fix dns bad nxdomain @conectado (#3299)
• refactor(windows): rename TAURI_ID to BUNDLE_ID (copied from #3200) @ReactorScram (#3294)
• docs(windows): document processes involved in the Windows client @ReactorScram (#3293)
• fix(ci): Fix publish step to publish multi-arch images for public use @jamilbk (#3287)
• fix(ci): Disable IPv6 in Docker-based integration tests due to flakiness @jamilbk (#3277)
• refactor(windows): give name to worker thread @ReactorScram (#3289)
• feat: dynamically configure network & redis for LAN integration test @thomaseizinger (#3286)
• chore: update logger config for firezone-connection-tests @thomaseizinger (#3285)
• fix: complain about correct env var @thomaseizinger (#3284)
• refactor(windows): designate a place for cleanup before the process crashes @ReactorScram (#3290)
• fix: only log about migration if address differs @thomaseizinger (#3283)
• gateway(fix): accept nil expiration times @conectado (#3288)

• revert(devops): Revert healthcommands @jamilbk (#3280)
• revert(ci): Revert Dockerfile to use alpine&musl @jamilbk (#3279)
• fix(ci): Revert runtime to musl @jamilbk (#3278)
• Do not refresh access token when refresh token is invalid @AndrewDryga (#3275)
• fix(ci): Be explicit about which Docker platforms to pull and push for @jamilbk (#3276)
• chore(portal): Fix resources UX @AndrewDryga (#3267)
• fix(apple): Reset cached system resolvers while tunnel is reasserting @jamilbk (#3274)
• fix(rust): Use -n for POSIX shells to handle building for different TARGETs @jamilbk (#3270)
• fix(portal): Fix auth redirect and test client auth using acceptance tests @AndrewDryga (#3269)
• feat(connection-tests): dynamically discover network interfaces @thomaseizinger (#3241)
• fix(gateway): Fix gateway systemd command for non-bash shells @jamilbk (#3264)
• fix(windows): when the token expires, change the GUI to signed-out state @ReactorScram (#3142)
• refactor(portal): Implement rest of TODOs after token refactoring @AndrewDryga (#3160)
• fix(devops): Use webpki roots instead of OS cert store @jamilbk (#3266)
• fix(devops): Fix shellcheck errors for docker-init.sh script @jamilbk (#3265)
• fix(ci): shell is dash on debian slim @jamilbk (#3261)
• fix(portal): dump smtp tls_options correctly @Intuinewin (#3214)
• feat(Windows): #2998, add 'signing in' state to system tray menu @ReactorScram (#3157)
• fix(ci): Use a new branch name to merge (GitHub merge bug?) @jamilbk (#3255)
• fix(ci): Fix target another time @jamilbk (#3254)
• fix(ci): Target specifier @jamilbk (#3253)
• fix(ci): Target specifier @jamilbk (#3252)
• fix(rust): Check /proc for health checks @jamilbk (#3250)
• Revert "build(deps): Bump tokio-tungstenite from 0.20.1 to 0.21.0 in /rust" @jamilbk (#3248)
• fix(rust): Fix continuous deployments targets to use gnu target @jamilbk (#3247)
• fix(apple): Persist Firezone ID to disk instead of using hardware tracking methods @jamilbk (#3244)
• feat(ci): Add e2e test bed @jamilbk (#3135)
• fix(connlib): Use debian:12-slim for Rust base image @jamilbk (#3243)
• fix(connection): set a Connections remote-socket from WG activity @thomaseizinger (#3245)
• fix(connlib): Fix getSystemDefaultResolvers while tunnel session is active @jamilbk (#3236)
• feat(windows): implement Clear Logs, closes #3224 @ReactorScram (#3237)
• docs(website): Document session lifetimes @jamilbk (#3197)
• feat(portal): add Kubernetes cluster strategy support @Intuinewin (#3212)
• fix(portal): Honour "as" option when fetching subject @AndrewDryga (#3234)
• chore(windows): Use version from Cargo toml to support automatic versioning @jamilbk (#3231)
• feat(windows): Add Windows iconset @jamilbk (#3225)
• chore(connlib): fix clippy warning @thomaseizinger (#3227)
• fix(windows): Remove exec perms on Windows files @jamilbk (#3223)
• fix(website): Improve text legibility @jamilbk (#3222)
• chore(deps): Bump terraform google dependencies as a group @jamilbk (#3202)
• ci(windows): add SHA256 hashes for artifacts @ReactorScram (#3201)
• chore(deps): Bump com.android libs and set dependabot group @jamilbk (#3199)
• fix(android): Don't minify release build @jamilbk (#3218)
• feat(devops): Add AWS VPC terraform @bmanifold (#3216)
• fix(android): Simplify connlib gradle build configuration to ensure libconnlib.so is packaged @jamilbk (#3207)
• fix(connlib): Differentiate between 4xx and other portal errors in log message @jamilbk (#3203)
• fix(android): Assemble release before bundling @jamilbk (#3206)
• chore(android): Remove outdated appDistribution group @jamilbk (#3204)
• fix(gateway): Use sudo tee instead of sudo cat to write files as root @jamilbk (#3177)
• connlib: only get system dns servers on session connect @conectado (#3198)
• feat(windows): use ProgramData to store device ID instead of per-user… @ReactorScram (#3172)
• chore(deps): Group netlink dependabot updates @jamilbk (#3169)
• fix(portal): Allow IdP setting errors to be shown in portal @bmanifold (#3165)
• feat(windows): When the tunnel is ready, show a notification @ReactorScram (#3166)
• docs(website): Publish January 2024 product newsletter @jamilbk (#3171)
• fix(portal): Increase receive timeout to alleviate test flakiness @jamilbk (#3168)
• refactor(connlib): Remove unused on_error callback @jamilbk (#3162)
• fix(portal): Add page_title to all portal pages @bmanifold (#3154)
• feat(windows): switch to the new auth flow per #2823 @ReactorScram (#3147)
• Redirect to deep link when user is already signed in @AndrewDryga (#3156)
• fix(portal): Remove token provider and implement separate flow for service accounts @AndrewDryga (#3146)
• fix(gateway): Fix masquerading iptables command @jamilbk (#3151)
• fix(android): handle_sign_in_callback is the host part of the URI @jamilbk (#3149)
• connlib: fix wildcard checking in gateways @conectado (#3148)
• feat(windows): log Git version used to build the client @ReactorScram (#3144)
• swift: fix typo in url scheme @conectado (#3145)
• fix(connlib): mangle packet for upstream dns as resource @conectado (#3134)
• feat(windows): new module to listen for network changes @ReactorScram (#3137)
• fix(gateway): Use sudo to write files @jamilbk (#3143)
• security(portal): Rework auth tokens @AndrewDryga (#2696)
• refactor(android): Remove AppLink in favor of nonce+state @jamilbk (#2826)
• fix(ci): overcommit_memory=1 for redis tests @jamilbk (#3139)
• refactor(apple): Use nonce+state when authenticating @roop (#2896)
• fix(ci): Use pre-releases when calculating changelog @jamilbk (#3138)
• wip(windows): make sure app panics show up in the logs @ReactorScram (#3085)
• fix(gateway): Fix systemd gateways on SELinux-enabled distros and improve systemd gateway UX @jamilbk (#3127)
• fix(portal): Update portal font to source sans 3 @bmanifold (#3106)
• fix(portal): Add help text for DNS resources @jamilbk (#3130)
• fix(portal): Add plan badge to edit Site @jamilbk (#3129)
• fix(Apple): Attempt to fix window selectedness of the authentication webview @roop (#3126)
• fix(windows): add routes faster @ReactorScram (#3118)
• fix(windows): set the tunnel's IPv6 address correctly with netsh so IPv6 tunnelling works @ReactorScram (#3120)
• fix(windows): set MTU for IPv6 too @ReactorScram (#3121)
• feat(windows): implement export logs as zip @ReactorScram (#3009)
• refactor(portal): Use ghcr.io for public pulls of prod images @jamilbk (#3105)
• fix(staging): Update demo access @jamilbk (#3116)
• feat(connlib): wildcard matching dns @conectado (#3109)
• fix(portal): Fix lost client auth state for OIDC redirects @AndrewDryga (#3273)
• fix(portal): Stop storing client tokens in sessions @AndrewDryga (#3272)

🧰 Maintenance

• build(deps): Bump redis from 0.23.3 to 0.24.0 in /rust @dependabot (#2864)
• build(deps): Bump phoenix_html from 3.3.3 to 4.0.0 in /elixir @dependabot (#3219)
• build(deps): Bump tokio-tungstenite from 0.20.1 to 0.21.0 in /rust @dependabot (#3191)
• chore(deps): bump base64 from 0.21.6 to 0.21.7 in /rust @dependabot (#3228)
• chore(deps): bump axum from 0.6.20 to 0.7.3 in /rust @dependabot (#3068)
• build(deps): Bump phoenix_swoosh from 1.2.0 to 1.2.1 in /elixir @dependabot (#3193)
• build(deps): Bump phoenix_live_view from 0.20.2 to 0.20.3 in /elixir @dependabot (#3194)
• build(deps-dev): Bump credo from 1.7.2 to 1.7.3 in /elixir @dependabot (#3195)
• build(deps-dev): Bump mix_audit from 2.1.1 to 2.1.2 in /elixir @dependabot (#3196)
• build(deps): Bump @types/react from 18.2.46 to 18.2.47 in /website @dependabot (#3183)
• build(deps): Bump postcss from 8.4.32 to 8.4.33 in /website @dependabot (#3187)
• build(deps): Bump @types/node from 20.10.6 to 20.11.0 in /website @dependabot (#3185)
• build(deps): Bump fast-xml-parser from 4.3.2 to 4.3.3 in /website @dependabot (#3189)
• build(deps): Bump react-icons from 4.12.0 to 5.0.1 in /website @dependabot (#3192)
• build(deps): Bump clap from 4.4.11 to 4.4.13 in /rust @dependabot (#3136)
• build(deps): Bump itertools from 0.11.0 to 0.12.0 in /rust @dependabot (#2679)

• fix(windows): set MTU on tunnel interface @ReactorScram (#2990)
• fix(ci): Fix artifact name typo @jamilbk (#3108)
• fix(ci): Merge digests for same image name and different archs only @jamilbk (#3107)
• refactor(connlib): Rename ip var name to proxy_ip @conectado (#3104)
• fix(ios/android): Pass device name and os version as overrides over connect @jamilbk (#3036)
• fix(ci): Use path subdirs for artifacts @jamilbk (#3103)
• chore(docs): Remove outdated rust/connlib/README.md info @jamilbk (#3099)
• fix(connlib): never delete allowed ips for a peer given dns @conectado (#3096)
• fix(ci): Add merge_multiple to fix artifact naming. @jamilbk (#3100)
• fix(apple): In case tunnel crashes, try to reconnect @roop (#3097)
• fix(apple): Fix potential race condition when updating login status @roop (#3098)
• fix(ci): Use pattern key @jamilbk (#3095)
• chore(website): remove PostHog in favor of Mixpanel @jamilbk (#3033)
• chore(deps): Bump website deps @jamilbk (#3092)
• fix(ci): Fix upload-artifact workflow artifact name @jamilbk (#3093)
• wip(windows): impl get_host_name @ReactorScram (#3089)
• fix(ci): Use unique name for artifacts @jamilbk (#3091)
• feat(windows): show whether files are still being counted @ReactorScram (#3007)
• Add more in-portal documentation and empty table state context @jamilbk (#2984)
• fix(portal): Improve OIDC usability and fix unexpected Mint.TransportError causing crash @jamilbk (#3049)
• fix(gateway): Fallback to get_hostname() for systemd deployments @jamilbk (#3029)
• chore(deps): Bump hilt and fix groups @jamilbk (#3081)
• chore(ci): clean up workflows @jamilbk (#3039)
• feat(ci): Architect e2e test suite @jamilbk (#3043)
• refactor(apple): guard packetTunnelProvider in one place @jamilbk (#3013)
• chore(ci): Lint Android readme @jamilbk (#3038)
• include detail about toolchain in README.md @jasonboukheir (#3020)
• Use linux-* for public binary asset names @jamilbk (#3032)
• Log a better error on flow auth function clause error @AndrewDryga (#3031)
• chore(ci): Rename client to linux-client on releases @jamilbk (#3019)
• Revert "fix(ci): Inherit secrets from calling workflow to allow contributors' PRs to run" @jamilbk (#3030)
• fix(ci): Inherit secrets from calling workflow to allow contributors' PRs to run @jamilbk (#3028)
• Update email provider settings in TF to use Mailgun @bmanifold (#2978)
• feat(website): Add FAQ @jamilbk (#3021)
• chore(website): Update team @jamilbk (#3018)
• chore(docs): bump deps, minor grammar fixes @jamilbk (#3011)
• fix(apple): Temporarily set matchDomains when tunnel is reasserting @jamilbk (#3012)
• docs(windows): Update windows client README with more developer setup instructions @jamilbk (#2993)
• feat: introduce firezone-connection with basic test suite @thomaseizinger (#2965)
• fix(windows): app title in Task Manager @ReactorScram (#3003)
• refactor(windows): remove ResourceDisplay @ReactorScram (#3002)
• fix(connlib): move .log to the end of log filenames @ReactorScram (#3008)
• refactor(windows): break apart 'run_controller' into smaller handlers… @ReactorScram (#2988)
• fix(apple): Get DNS working reliably when no upstream is configured @jamilbk (#3001)
• refactor(connlib): refresh dns addresses @conectado (#2994)
• security(connlib): Dont allow acces to non-subdomains for a given resource @conectado (#2996)
• fix(rust): Incorrect perms on rust/ files @jamilbk (#2991)
• connlib: add arch and kernel version to user agent @conectado (#2987)
• feat(windows): add DLL for aarch64 but don't run it in CI/CD @ReactorScram (#2989)
• refactor(windows): don't block connlib callbacks @ReactorScram (#2960)
• Fix/lost connection request @conectado (#2976)
• connlib: tune disconnect parameters @conectado (#2977)
• Add ability to email new user after creation @bmanifold (#2957)
• security(gateway): Don't run systemd gateways as root @jamilbk (#2943)
• Rename Authorizations -> Activity @jamilbk (#2979)
• Remove client names unique constraint @AndrewDryga (#2982)
• Add link to status on website @jamilbk (#2974)
• fix(windows): give the encrypted credential a unique name @ReactorScram (#2972)
• feat(windows): count log files @ReactorScram (#2964)
• ci(windows): fix build-push-windows-release-artifacts @ReactorScram (#2973)
• fix(windows): make sure the worker thread for wintun shuts down cleanly @ReactorScram (#2971)
• feat(windows): Handle routes and DNS @ReactorScram (#2889)
• docs(website): Clarify note on legacy support @jamilbk (#2968)
• Apple: UI asking user to grant VPN permissions @roop (#2959)
• refactor(windows): extract modules from gui module @ReactorScram (#2961)
• fix(windows): copy default debug and release settings from Android @ReactorScram (#2963)
• refactor(windows): fix up MSI installer package and try to build it in CI @ReactorScram (#2938)
• fix(windows): disconnect tunnel on sign-out @ReactorScram (#2932)
• connlib: dont fail on ipv6 add route failure @conectado (#2962)
• connlib: prevent resource leak for non-handled record types @conectado (#2955)
• refactor(connlib): log more details about failed queries @conectado (#2934)
• Fix/firezone id handling @conectado (#2958)
• Fix java method signature bug @jamilbk (#2950)
• chore(ci): Use 1.0.0 as version base @jamilbk (#2949)
• feat(windows): Elevate with UAC automatically on startup @ReactorScram (#2913)
• refactor(windows): remove unused code, redundant platform checks @ReactorScram (#2937)
• Fix user-reported errors @AndrewDryga (#2954)
• fix(windows): put the bundle version back in tauri.conf.json to fix CI @ReactorScram (#2952)
• ci(windows): remove hello-world and permissions-test projects @ReactorScram (#2926)
• fix(windows): #2927 - Use Cargo.toml version instead of tauri.conf.json @ReactorScram (#2936)

🧰 Maintenance

• chore(deps): bump @types/react-dom from 18.2.14 to 18.2.18 in /website @dependabot (#3087)
• chore(deps): bump postcss from 8.4.31 to 8.4.32 in /website @dependabot (#3086)
• chore(deps): bump phoenix_live_view from 0.20.1 to 0.20.2 in /elixir @dependabot (#3088)
• chore(deps): bump hashicorp/google from 5.9.0 to 5.10.0 in /terraform/environments/production @dependabot (#3051)
• chore(deps): bump hashicorp/google-beta from 5.9.0 to 5.10.0 in /terraform/environments/production @dependabot (#3052)
• chore(deps): bump @types/react from 18.2.30 to 18.2.46 in /website @dependabot (#3066)
• chore(deps): bump hashicorp/google from 5.9.0 to 5.10.0 in /terraform/environments/staging @dependabot (#3057)
• chore(deps): bump hashicorp/google-beta from 5.9.0 to 5.10.0 in /terraform/environments/staging @dependabot (#3058)
• chore(deps): bump org.jetbrains.kotlin:kotlin-stdlib from 1.9.21 to 1.9.22 in /rust/connlib/clients/android/connlib @dependabot (#3056)
• chore(deps): bump github/codeql-action from 2 to 3 @dependabot (#3059)
• chore(deps): bump actions/upload-artifact from 3 to 4 @dependabot (#3060)
• chore(deps): bump actions/download-artifact from 3 to 4 @dependabot (#3061)
• chore(deps): bump actions/setup-python from 4 to 5 @dependabot (#3062)
• chore(deps-dev): bump typescript from 5.2.2 to 5.3.3 in /website @dependabot (#3063)
• chore(deps): bump tailwindcss from 3.3.5 to 3.4.0 in /website @dependabot (#3064)
• chore(deps): bump @mdx-js/react from 2.3.0 to 3.0.0 in /website @dependabot (#3065)
• chore(deps): bump @types/node from 20.10.1 to 20.10.6 in /website @dependabot (#3067)
• chore(deps): bump com.diffplug.spotless from 6.23.2 to 6.23.3 in /kotlin/android @dependabot (#3071)
• chore(deps): bump androidx.navigation:navigation-safe-args-gradle-plugin from 2.7.5 to 2.7.6 in /kotlin/android @dependabot (#3073)
• chore(deps): bump gettext from 0.23.1 to 0.24.0 in /elixir @dependabot (#3076)
• chore(deps): bump ecto_sql from 3.11.0 to 3.11.1 in /elixir @dependabot (#3078)
• chore(deps): bump pre-commit from 3.5.0 to 3.6.0 @dependabot (#3077)
• chore(deps-dev): bump credo from 1.7.1 to 1.7.2 in /elixir @dependabot (#3075)
• chore(deps): bump flowbite from 2.2.0 to 2.2.1 in /elixir/apps/web/assets @dependabot (#3074)
• chore(deps-dev): bump dialyxir from 1.4.2 to 1.4.3 in /elixir @dependabot (#3079)
• chore(deps): bump nimble_options from 1.0.2 to 1.1.0 in /elixir @dependabot (#3080)

• security(connlib): Dont allow acces to non-subdomains for a given resource @conectado (#2996)
• fix(rust): Incorrect perms on rust/ files @jamilbk (#2991)
• connlib: add arch and kernel version to user agent @conectado (#2987)
• feat(windows): add DLL for aarch64 but don't run it in CI/CD @ReactorScram (#2989)
• refactor(windows): don't block connlib callbacks @ReactorScram (#2960)
• Fix/lost connection request @conectado (#2976)
• connlib: tune disconnect parameters @conectado (#2977)
• Add ability to email new user after creation @bmanifold (#2957)
• security(gateway): Don't run systemd gateways as root @jamilbk (#2943)
• Rename Authorizations -> Activity @jamilbk (#2979)
• Remove client names unique constraint @AndrewDryga (#2982)
• Add link to status on website @jamilbk (#2974)
• fix(windows): give the encrypted credential a unique name @ReactorScram (#2972)
• feat(windows): count log files @ReactorScram (#2964)
• ci(windows): fix build-push-windows-release-artifacts @ReactorScram (#2973)
• fix(windows): make sure the worker thread for wintun shuts down cleanly @ReactorScram (#2971)
• feat(windows): Handle routes and DNS @ReactorScram (#2889)
• docs(website): Clarify note on legacy support @jamilbk (#2968)
• Apple: UI asking user to grant VPN permissions @roop (#2959)
• refactor(windows): extract modules from gui module @ReactorScram (#2961)
• fix(windows): copy default debug and release settings from Android @ReactorScram (#2963)
• refactor(windows): fix up MSI installer package and try to build it in CI @ReactorScram (#2938)
• fix(windows): disconnect tunnel on sign-out @ReactorScram (#2932)
• connlib: dont fail on ipv6 add route failure @conectado (#2962)
• connlib: prevent resource leak for non-handled record types @conectado (#2955)
• refactor(connlib): log more details about failed queries @conectado (#2934)
• Fix/firezone id handling @conectado (#2958)
• Fix java method signature bug @jamilbk (#2950)
• chore(ci): Use 1.0.0 as version base @jamilbk (#2949)
• feat(windows): Elevate with UAC automatically on startup @ReactorScram (#2913)
• refactor(windows): remove unused code, redundant platform checks @ReactorScram (#2937)
• Fix user-reported errors @AndrewDryga (#2954)
• fix(windows): put the bundle version back in tauri.conf.json to fix CI @ReactorScram (#2952)
• ci(windows): remove hello-world and permissions-test projects @ReactorScram (#2926)
• fix(windows): #2927 - Use Cargo.toml version instead of tauri.conf.json @ReactorScram (#2936)

• Run publish workflow on release publish @jamilbk (#2912)
• Apple: Handle comma in resource names @roop (#2918)
• Prevent DNS sentinel from being used as a fallback resolver @jamilbk (#2922)
• Remove SMBios @jamilbk (#2921)
• Set hasUnappliedChanges = true when setting Resources @jamilbk (#2935)
• windows: fix deep links @ReactorScram (#2903)
• connlib: decouple data and control plane and fix backoff reset @conectado (#2906)
• Add Mailgun DNS records for domain verification @bmanifold (#2908)
• Update styling for Sign In/Up emails @bmanifold (#2907)
• Fix upgrade script link @jamilbk (#2923)

• Gateway upgrade docs @jamilbk (#2914)
• Reduce webrtc log level to error @jamilbk (#2911)
• Use more informative log filepath @jamilbk (#2910)
• Don't automatically delete log files after successful upload @jamilbk (#2904)
• Use correct type for ioctl codes @jamilbk (#2905)
• windows: use settings log_filter instead of env var @ReactorScram (#2888)
• windows: Integrate wintun, run the VPN @ReactorScram (#2883)
• Connlib: reduce failover timeout @conectado (#2897)
• Remove Apple SplitDNS in favor of unified split DNS approach @jamilbk (#2894)
• Set the MTU to 1280 on Apple to avoid connectivity issues @jamilbk (#2901)
• Fix service account tokens and unifile deployment scripts @AndrewDryga (#2900)
• connlib: try to reuse old ips even with new peers @conectado (#2891)
• Add a log tab in settings @roop (#2895)
• connlib: disconnect on token expiration @conectado (#2890)
• Add a detailed Google Workspace setup guide and other docs @jamilbk (#2876)
• connlib: set DNS response type for answers @conectado (#2892)
• refactor(connlib): remove async from the Device API @thomaseizinger (#2815)
• windows: tell Windows that our release builds should always run as admin @ReactorScram (#2838)
• feat(windows): generate device ID and persist it on disk @ReactorScram (#2840)
• fix(connlib): attempt to join topic upon unmatched topic error @conectado (#2874)
• Fix Sendgrid records for sending emails for firezone.dev @jamilbk (#2877)
• windows: add module to install the wintun.dll by embedding it in the client's exe and then copying it out at runtime @ReactorScram (#2843)