Starstruk Logo MarkStarstruk

v3.5.0 v3.5.4

medium risk

BITyia/DroneSplatJul 31, 2026 → Aug 1, 20261 day between releases

What's New

v3.5.4 is a security hotfix closing an Address Book ACL bypass, repairing legacy SQLite role checks, and fixing MeshAgent downloads.

New Features

  • Address Book endpoints now honor device-group and folder ACLs, including personal address books and tags.
  • Legacy SQLite user tables are rebuilt during migration so super_admin, global_admin, server_admin, and pro roles sync correctly.
  • MeshAgent .msh downloads now carry a stable per-group 96-hex SHA-384 MeshID instead of a static placeholder.

Improvements

  • Unscoped GET /api/peers requests from non-admin roles now pass through the same ACL as the paginated peer list.
  • Installer and documentation templates no longer introduce the outdated role CHECK constraint on new databases.
  • Repository housekeeping: post-release main-to-dev sync and updated sponsors list.

Bug Fixes

  • Restricted users could see out-of-scope machines and fleet tags through the shared address book merge; this is now filtered.
  • Upgraded databases with the old role CHECK constraint blocked Phase 52 role sync; the table is now rebuilt automatically.
  • MeshAgent .msh downloads failed with 'bad size' because of the embedded static MeshID placeholder.

Upgrade Notes

Apply via Settings → Updates, then restart the Go server so Migrate() can rebuild any legacy users table — back up the SQLite database first since the table is recreated. After upgrading, re-verify MeshAgent downloads and address-book visibility for restricted roles, as both behaviors changed. No config edits are required.

The Two Releases

v3.5.0

BetterDesk 3.5.0

Jul 31, 2026· 3 months ago

Introduces a new Beta UX 3.5 console shell and adds community support for FreeBSD, while maintaining the Classic icon rail as the default production UI.

Full release notes
v3.5.4

BetterDesk 3.5.4

Aug 1, 2026· 3 months ago

Hotfix release addressing security vulnerabilities in the Address Book ACL, fixing legacy SQLite role checks, and stabilizing MeshAgent file downloads.

Full release notes