v0.67.2

## Release Notes for v0.67.2

## Legacy to Embedded IdP Migration Tool

We're introducing `netbird-idp-migrate`, a standalone CLI tool that enables self-hosted NetBird operators to migrate from an external identity provider (Auth0, Zitadel, Okta, Azure AD, Google, etc.) to NetBird's built-in embedded IdP, introduced in v0.62.0.

### What it does

The migration tool handles the full transition in a single run:

1. **Preserves user identity** — Connects to your existing external IdP, fetches email and display name for every user, and backfills any missing contact information before the migration makes original IdP user IDs inaccessible.

2. **Re-keys user IDs** — Atomically re-encodes every user ID from the external IdP format to the new internal format, updating all foreign key references (peers, personal access tokens, groups, policies, activity events, etc.) in a single transaction per user.

3. **Generates new configuration** — Transforms your existing `management.json` by removing the now-unnecessary `IdpManagerConfig`, `PKCEAuthorizationFlow`, and `DeviceAuthorizationFlow` sections, and adds a minimal `EmbeddedIdP` block with your connector, issuer, and redirect URIs pre-configured.

### What it enables

- **Simplified self-hosted deployments** — Eliminates the need to provision and maintain a separate identity provider. NetBird manages authentication natively via the embedded IdP.
- **Zero-downtime preparation** — The tool runs independently of the management server, so operators can migrate their database offline and switch to the embedded IdP on the next server restart.
- **Safe and resumable** — Supports `--dry-run` to preview all changes without writing, creates a `management.json.bak` backup before modifying config, and automatically detects and skips already-migrated users — meaning a partial failure can be safely re-run.
- **Unlock the combined server** — Migrating to the embedded IdP enables you to run NetBird's combined server — a single binary that bundles the management server, signal server, and identity provider into one process, with fewer containers and a single configuration to manage. Learn more [here](https://docs.netbird.io/selfhosted/migration/combined-container).

### Requirements

- NetBird management server **v0.66.4+** must have been started at least once so that automatic database migrations create the required schema.
- The external IdP must still be reachable during migration (for the user info population phase). Use `--skip-populate-user-info` if user email/name data is already complete in the database.

Pre-built binaries are included in this release for Linux (amd64, arm64, arm).

Learn more at:

[Migrating from External to Embedded IdP](https://docs.netbird.io/selfhosted/migration/external-to-embedded-idp)


### What's New

#### Client Improvements
- Added **Expose support to embed library**.  
  https://github.com/netbirdio/netbird/pull/5695
- Persisted **service install parameters across reinstalls**.  
  https://github.com/netbirdio/netbird/pull/5732
- Fixed **Exit Node submenu separator accumulation on Windows**.  
  https://github.com/netbirdio/netbird/pull/5691
- Fixed **Android DNS routes lost after TUN rebuild**.  
  https://github.com/netbirdio/netbird/pull/5739
- Fixed **flaky TestUpdateOldManagementURL in CI**.  
  https://github.com/netbirdio/netbird/pull/5703
- Fixed **path join issue in Windows tests**.  
  https://github.com/netbirdio/netbird/pull/5762
- Fixed **IPv6 address handling in QUIC server**.  
  https://github.com/netbirdio/netbird/pull/5763
- Refactored **Android PeerInfo to use ConnStatus enum**.  
  https://github.com/netbirdio/netbird/pull/5644
- Added support for **embed.Client on Android with netstack mode**.  
  https://github.com/netbirdio/netbird/pull/5623

#### Management Improvements
- Added **notification endpoints**.  
  https://github.com/netbirdio/netbird/pull/5590
- Added **terminated field to services**.  
  https://github.com/netbirdio/netbird/pull/5700
- Extended **blackbox tests**.  
  https://github.com/netbirdio/netbird/pull/5699
- Updated to latest **gRPC version**.  
  https://github.com/netbirdio/netbird/pull/5716
- Prevented **events for temporary peers**.  
  https://github.com/netbirdio/netbird/pull/5719
- Persisted **proxy capabilities to database**.  
  https://github.com/netbirdio/netbird/pull/5720
- Added **FleetDM API spec support**.  
  https://github.com/netbirdio/netbird/pull/5597
- Added **target user account validation**.  
  https://github.com/netbirdio/netbird/pull/5741
- Improved **permission validation for posture check delete**.  
  https://github.com/netbirdio/netbird/pull/5742
- Removed **client secret from gRPC auth flow**.  
  https://github.com/netbirdio/netbird/pull/5751
- Fixed **panic on management reboot**.  
  https://github.com/netbirdio/netbird/pull/5759
- Added **legacy to embedded IdP migration tool**.  
  https://github.com/netbirdio/netbird/pull/5586
- Fixed **race condition in setup flow allowing multiple owners**.  
  https://github.com/netbirdio/netbird/pull/5754

#### Proxy Enhancements
- Added **pprof support** for proxy debugging.  
  https://github.com/netbirdio/netbird/pull/5764

#### Security & Stability
- Added **path traversal and file size protections**.  
  https://github.com/netbirdio/netbird/pull/5755

#### Self-Hosted Improvements
- Added **self-hosted scaling note**.  
  https://github.com/netbirdio/netbird/pull/5769

#### Miscellaneous
- Added **missing OpenAPI definitions**.  
  https://github.com/netbirdio/netbird/pull/5690
- Updated **Contributor License Agreement document**.  
  https://github.com/netbirdio/netbird/pull/5131
- Set **permissions on env file for getting started scripts**.  
  https://github.com/netbirdio/netbird/pull/5761

### New Contributors
- @tobsec made their first contribution in https://github.com/netbirdio/netbird/pull/5691
- @iakshayubale made their first contribution in https://github.com/netbirdio/netbird/pull/5644

**Full Changelog**: https://github.com/netbirdio/netbird/compare/v0.67.1...v0.67.2