# NetBird v0.78.0

- Product: NetBird (https://whatsnew.fyi/product/netbird)
- Vendor: NetBird
- Date: 2026-09-03
- Version: v0.78.0
- Original notes: https://github.com/netbirdio/netbird/releases/tag/v0.78.0
- Permalink: https://whatsnew.fyi/product/netbird/releases/v0.78.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Rosenpass now works through the embedded reverse proxy in permissive mode
- **added** — Lazy connections reworked with per-peer lazy state and proxy peers lazy by default
- **added** — Agent Network / LLM gateway integration with access roles, self-service endpoints, and Bedrock model discovery
- **added** — DNS on Windows with catch-all NRPT rule when NetBird is the primary resolver
- **added** — Local Prometheus metrics endpoint on the client
- **added** — Ukrainian localization for the desktop client
- **changed** — Remote jobs are now behind an admin opt-in with MDM support
- **changed** — Remote debug bundle jobs accept an anonymization level and an upload URL
- **changed** — Client stays connected during the login command
- **changed** — Logging out of the active profile is allowed even when profiles are disabled
- **changed** — Profiles resolve for the invoking sudo user rather than for root
- **changed** — NetBird traffic stays out of third-party fwmark rules
- **changed** — GUI windows are created on demand and destroyed on close
- **changed** — Android split tunnelling mode is typed rather than stored as a string and settings are kept per profile
- **changed** — Upgraded to Go 1.26 and go-quic v0.62.0
- **changed** — Unified ACL filtering for peers and routes with multi-source rules
- **security** — Cached SSH JWT is bound to the local caller that obtained it
- **security** — WireGuard key is no longer logged on a parse failure
- **security** — Client asks the OS for privileges when a guarded SSH setting is changed
- **security** — Proxy validates header auth
- **fixed** — Fixed ICEBind races that wedge interface creation
- **fixed** — Peer offer or answer arriving before the handshaker starts listening is held rather than lost
- **fixed** — Connections are swept on network loss through a shared netevents manager
- **fixed** — Route selection survives an invalid request and is applied on a partial one
- **fixed** — Session-expiration dialog closes only on renewal
- **fixed** — Still-locked updater binary is tolerated when cleaning up after an update
- **fixed** — Fixed context cancellation during restart on iOS
- **fixed** — Android TUN is renewed only when the routes it carries actually change
- **fixed** — Overlay listeners are rebuilt when the TUN is renewed
- **fixed** — Fixed geolocation panics
- **fixed** — Fixed private services calculation on the new db path
- **fixed** — Fixed posture check evaluation for direct peers in policy definitions
- **removed** — Lazy exclusion list removed

##### Release Notes for v0.78.0

##### Highlights

- **Rosenpass now works through the embedded reverse proxy** (#6763). Until now the proxy ran no
  Rosenpass at all, so peers with Rosenpass enabled failed to establish through it on a PSK
  mismatch — an incompatibility that was never documented. The proxy now runs Rosenpass in
  **permissive** mode, so it connects both to Rosenpass-enabled peers and, exactly as before, to
  peers without it. `NB_PROXY_ROSENPASS=false` turns it off.
- **Lazy connections reworked**: per-peer lazy state, proxy peers lazy by default, and the lazy
  exclusion list removed (#6762, #6763).
- **Agent Network / LLM gateway**: agentgateway integration, access roles and self-service
  endpoints, Bedrock model discovery served from the control plane, guardrail allowlists for
  declared model ids, and the endpoint conformed to the LLM gateway protocol
  (#7274, #7221, #7250, #7239, #7154, #7389, #7246).
- **DNS on Windows**: a catch-all NRPT rule when NetBird is the primary resolver (#7071), closing
  the leak/poisoning window towards the system resolvers.
  Use `netbird service reconfigure --service-env NB_USE_LEGACY_DNS_RESOLUTION=true` to restore the old behavior.
- **Local Prometheus metrics endpoint** on the client (#6689).
- **Go 1.26** and `go-quic` v0.62.0 across client, relay and management (#7359).
- **Unified ACL filtering** for peers and routes, with multi-source rules (#6322). An internal
  refactor: no change is expected for standard deployments.
- **Ukrainian localization** for the desktop client (#7035).

##### Behaviour changes

- Remote jobs (remote debug bundle and friends) are now **behind an admin opt-in**, with MDM
  support (#7153). Anyone using them without the opt-in has to enable it.
- Remote debug bundle jobs accept an anonymization level and an upload URL (#7147).
- The client stays connected during the `login` command (#7384).
- Logging out of the active profile is allowed even when profiles are disabled (#7360).
- Profiles resolve for the invoking `sudo` user rather than for `root` (#7238).
- NetBird traffic stays out of third-party fwmark rules (#7314).
- GUI windows are created on demand and destroyed on close (#7096).
- Android split tunnelling: the mode is typed rather than stored as a string, and settings are
  kept per profile (#7387, #7349).

##### Security / hardening

- The cached SSH JWT is bound to the local caller that obtained it (#7378).
- The WireGuard key is no longer logged on a parse failure (#7379).
- The client asks the OS for privileges when a guarded SSH setting is changed (#7066).
- The proxy validates header auth (#7263).
- Management checks a provider's URL and credential before saving them (#7301).
- Clarified that `X-Peer-ID` on metrics ingest is not a credential (#7363).
- The old `math/rand` library is gone from management (#6836).

##### Client — fixes

- Fixed the ICEBind races that wedge interface creation (#7377).
- `agentConnecting` is dropped whenever the ICE session state clears (#7327).
- A peer offer or answer arriving before the handshaker starts listening is held rather than lost
  (#7255).
- Connections are swept on network loss through a shared netevents manager (#7254).
- Route selection survives an invalid request and is applied on a partial one (#7292).
- The session-expiration dialog closes only on renewal (#7337).
- A still-locked updater binary is tolerated when cleaning up after an update (#7286).
- Fixed context cancellation during restart on iOS (#7329).
- iOS SSO logins reuse the profile's account (#7193).
- The iOS profile manager was migrated from Swift to Go (#6528).
- The PCP implementation moved to the go-nat fork (#7282).
- Reverted multi-buffer support declared for the loopback XDP program (#7303).
- The Android TUN is renewed only when the routes it carries actually change (#7396).
- Overlay listeners are rebuilt when the TUN is renewed (#7397).
- The r

_[Truncated at 4000 characters — full notes: https://github.com/netbirdio/netbird/releases/tag/v0.78.0]_