v3.4.2 v3.4.3
TimoBolkart/TF_FLAMEJul 28, 2026 → Jul 30, 20262 days between releases
What's New
Security hardening masks client config public keys by default, alongside OIDC login and viewer-only outbound fixes.
Improvements
- Client configuration public keys are now masked by default to reduce accidental exposure.
- Enrollment pending_device handling was hardened against malformed or unexpected state.
- Docker update channel guidance clarified: GHCR images follow BETTERDESK_IMAGE_TAG rather than the panel channel switch.
- Documentation added for Caddy WSS/308 setups and Docker channel versus image tag behavior.
- Several previously unreleased fixes (SignedId, admin delete, native TLS, enrollment UI, MeshAgent web cert, Unban kebab, light theme) are bundled into this release.
Bug Fixes
- OIDC client login no longer hangs on 'Waiting' after correcting user.info in the auth-query payload.
- Viewer-only outbound connections no longer report 'ID not found' when the service is stopped, via TCP RegisterPk IP bind and client login token handling.
- Enrollment pending_device edge cases were addressed to prevent stuck or inconsistent enrollment states.
Upgrade Notes
Deploy through the panel's Settings → Updates flow and restart if prompted. Docker/GHCR users should pin BETTERDESK_IMAGE_TAG rather than relying on the panel channel switch. After upgrading, re-test OIDC logins, viewer-only outbound connections with the service stopped, and any enrollment flows tied to pending_device.
The Two Releases
BetterDesk 3.4.2
Jul 28, 2026· 3 months ago
Hotfix release that restores Web Remote functionality following a previous outbound gate change and patches an npm security vulnerability.
Full release notesBetterDesk 3.4.3
Jul 30, 2026· 3 months ago
Hotfix release focusing on security hardening and bug fixes related to authentication and device enrollment.
Full release notes