v3.5.168

# BetterDesk 3.5.168 (stable)

Comprehensive stable update from **3.5.4** (~August 2026 → October 2026): **~380 commits** from the Development branch (`dev`), including security fixes, UX 3.5, Generator / Support Agent, Docker/installers, OIDC/TOTP, relay, and Web Remote.

Tag: `v3.5.168` · commit: `0b176a2f` · PR: [#454](https://github.com/UNITRONIX/BetterDesk/pull/454)

**Not included in this release:** Dependabot [#453](https://github.com/UNITRONIX/BetterDesk/pull/453) (Express 5 / bcrypt 6 / ejs 7 and other majors) — deferred to a dedicated migration; that PR’s CI fails (35 failed suites).

---

## Security

### CodeQL, paths, and SSRF
- **Multer:** upload cleanup only after reconstructing paths under `tmpdir` / `dataDir` (safe path segments) — closes path-injection alerts (#358/#361).
- **Generator:** local archive cleanup uses the same confined path.
- **Support Generator (SSRF):** GitHub fetches restricted to HTTPS and an allowlisted host set (`api.github.com`, `github.com`, `objects.githubusercontent.com`, `release-assets.githubusercontent.com`) via `https.get({ hostname, path })`.
- **Local Client Builder:** `spawn` limited to an allowlisted toolchain basename set (cargo, flutter, dpkg-deb, …).
- **Public generic-agent download:** rate-limited (`fileAccessLimiter`).
- **scheduledBackupService / updateService / generator.routes:** path-injection findings treated as false positives on admin-validated paths; filtered in CodeQL config and dismissed in the Security UI.
- After scan: **0 open CodeQL alerts** on the security tip.

### Auth / OIDC / JWT / CSP
- **OIDC discovery:** fixed data race (atomic retry interval + goroutine `Close()`) — green `go test -race`.
- **OIDC:** SSO-first login, role overrides, scoped private endpoints, discovery retry when the IdP comes up after API start.
- **JWT (Go):** requires `aud` / `iss` / `nbf` (`betterdesk-server` / `betterdesk-api`). **Re-login required after upgrade** (tokens without these claims are rejected).
- **CSP:** removed `script-src-attr 'unsafe-inline'` and default `unsafe-eval` on `/remote` (RdClient: static protobuf bundle); emergency rollback via `CSP_RELAX_REMOTE=true`.
- **SQL:** `assertSafeSqlIdent` for dynamic table names (stats / dump / restore).
- **TOTP:** management under Authentication settings; OTP verification on client paths.
- Security Test Suite **v1.2.0** (`npm run test:security` / `scripts/run-security-suite.*`).

### Dependencies (security — shipped)
- Node: `axios` ≥1.20, `multer` ≥2.4, overrides including `brace-expansion`, `proxy-addr`, `tar`, `path-to-regexp` (Express **4** line).
- Go: toolchain **1.26.9**, `golang.org/x/text` **v0.41.0** (govulncheck clean on called paths).
- Go pins in `betterdesk.sh` / `betterdesk.ps1` / `updateService.js` aligned with `go.mod`.

---

## UI and new features

### Console (UX 3.5)
- **UX 3.5 is the only supported console shell** (classic shell / beta switch removed).
- Light/dark topbar, sticky Settings tabs, denser mobile chrome, Material icon a11y.
- Self-hosted **Material Symbols** (no Google Fonts CDN on the critical path).
- **Help** panel with supporters / links instead of guided tours.
- Onboarding: generator → QR/config → registration.
- Device tag editing; background devices-table refresh; drag-and-drop with auto-scroll.
- Client Branding for desktop remotes; custom product label on the public download portal.
- Registration notifications (badge + center) in UX 3.5.

### Auth and accounts
- **TOTP** (2FA) for panel accounts.
- **OIDC SSO-first** login and role-mapping administration.
- Stock RustDesk outbound options: require initiator login, Admin/Operator-only, controller-only mode (opt-in under Settings → Connection).

### Generator / agents / remote
- **Generic agent releases** + QR activation.
- Local Linux package formats in the builder; Support Agent (Wails UI, multi-codec, HTTP/WS profiles).
- RdClient: static protobuf under CSP; PunchHole/OFFLINE/connection-policy parity; Web Remote ↔ WebSocket Mode (TCP↔WS bridge on the relay).
- Guest access: scoped lifecycle.
- Attestation: configurable server badge labels.
- Desktop connection mode (normal / incoming-only) queued per device.
- Org **credential vault** (AES-GCM) for the address book.
- FPS modes in web sessions; gated RDP/VNC dependency updates.

### Backup and operations
- **Scheduled full-instance backups** (retention, local / path / SMB, validation).
- Coordinated service restarts and login metadata in the console.
- Simplified appearance / branding; appearance profile duplication without overwriting the active profile.

### Docker and installers
- Admin bootstrap / shared SQLite DB fixes for split Compose (#385).
- PUID/PGID, harder startup on bind mounts, connection strategy in split Docker.
- GHCR `:dev` / `:latest` kept in sync with the version tip (#387, #401).
- Native install: Go download diagnostics, IPv6 handling, module deadlines (#371).
- Installers: preflight, verification protocol, safer agent uninstall.

---

## Bug fixes (selected, since 3.5.4)

**Connections / relay / enrollment**
- Shared-NAT / CGNAT punch and RelayResponse (#399); empty `socket_addr` → OFFLINE (#405).
- MASK/CIDR in LAN detection (#404); mixed TCP/WS transports.
- Enrollment: display name on approve; managed enrollment for viewer-only mobile (#375).
- Peer grants / strategy scope — grants persist and errors surface instead of silent no-ops (#380).
- Signal: peer-key hydration; transport retained after approve.

**Docker / credentials / Node**
- Admin password vs credentials-file mismatch; atomic bootstrap password.
- Stale `auth.db` after partial volume wipe.
- Console SIGABRT on Node 24 → production images pin Node **22.23.2** (#377).
- Missing Support Agent sources in generator images (#391).

**UI**
- Mobile: Devices taps (#410), sticky overlapping, Settings tabs (#396).
- Leftover `/d/:slug` pages hidden after generator migration (#412).
- Notification badge at zero; theme-toggle audit noise.

**Other**
- User save crash when assigning a strategy (#384).
- Config QR warnings for localhost / `.local` (#368).
- Registrations and badge in UX 3.5.

---

## Dependencies (notable, in this release)

| Area | Change |
|------|--------|
| Go toolchain | → **1.26.9** (installer + panel update pins) |
| `golang.org/x/text` | → **v0.41.0** |
| npm prod | `axios` 1.20, `multer` 2.4, hardening overrides |
| Express | **stays on 4.x** (no Express 5 migration) |

---

## Verify / update

- **Stable (`main`)** channel → Settings → Updates (or `betterdesk.sh` / `.ps1` / Docker update).
- After upgrading from JWTs issued before `aud`/`iss`/`nbf`: **sign out and sign in again**.
- Optional: `npm run test:security` / security suite on the console after deploy.

---

## Thanks

Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow); muopc (@muopc)