v0.80.0

# Release Notes for v0.80.0

## What's New

### 🔒 Security and Access Control

* **Refused to pin an agent network gateway onto another account's host**, adding cross-account validation for gateway assignments. [#7519](https://github.com/netbirdio/netbird/pull/7519)
* **Validated proxy cluster on Agent Network bootstrap**, preventing an agent network from bootstrapping onto another account's proxy cluster. [#7402](https://github.com/netbirdio/netbird/pull/7402)
* **Refused HTTP redirects on IdP clients**, preventing open redirect attacks against identity provider integrations. [#7579](https://github.com/netbirdio/netbird/pull/7579)
* **Revoked local Dex session on embedded IdP password change**, ensuring sessions are properly invalidated when credentials are updated. [#7556](https://github.com/netbirdio/netbird/pull/7556)
* Added **upload URL signing and rate limiting** for file upload endpoints. [#7502](https://github.com/netbirdio/netbird/pull/7502)

### 🖥️ Client Improvements

* **Staged install script downloads in a private temp directory**, preventing other processes from tampering with downloaded files before installation. [#7534](https://github.com/netbirdio/netbird/pull/7534)
* **Enforced HTTPS on install script downloads**, ensuring all client downloads use secure connections. [#7545](https://github.com/netbirdio/netbird/pull/7545)
* Fixed **peers not being notified when the relay connection drops**, which could leave stale peer state after a relay disconnect. [#7490](https://github.com/netbirdio/netbird/pull/7490)
* Fixed **session deadline read under the status read lock**, preventing a potential race condition. [#7550](https://github.com/netbirdio/netbird/pull/7550)
* **Removed the empty GPO DNS policy store on Windows teardown**, cleaning up leftover DNS policy entries when the client shuts down. [#7563](https://github.com/netbirdio/netbird/pull/7563)
* **Resolved the shared socket source address through a connected UDP probe socket**, fixing source address resolution for shared socket mode. [#7633](https://github.com/netbirdio/netbird/pull/7633)
* **Validated saved service parameters and pinned the netsh lookup** on Windows, hardening the service configuration path. [#7584](https://github.com/netbirdio/netbird/pull/7584)
* **Used POSIX-style file read/write of JSON on Windows**, improving cross-platform config file handling. [#7631](https://github.com/netbirdio/netbird/pull/7631)
* **Raised the daemon IPC receive limit to 16 MB**, matching gRPC's default and preventing truncation of large messages. [#7676](https://github.com/netbirdio/netbird/pull/7676)
* **Skipped route firewall rule computation when no firewall** is configured, avoiding unnecessary work. [#7624](https://github.com/netbirdio/netbird/pull/7624)
* Fixed **device dump clearing all peer endpoints** instead of just the target one, which could disrupt connections to other peers. [#7632](https://github.com/netbirdio/netbird/pull/7632)
* Fixed **Windows IPC privilege check** to only treat LocalSystem as a privileged identity by SID. Local Service and Network Service now go through the same checks as any other caller. [#7889](https://github.com/netbirdio/netbird/pull/7889)
* **Bumped Wails to v3.0.0-beta.25** for the desktop UI. [#7640](https://github.com/netbirdio/netbird/pull/7640)

### ⚙️ Management Improvements

* **Sped up test store setup and summarized unit test runs**, improving CI performance. [#7518](https://github.com/netbirdio/netbird/pull/7518)
* **Read X-Real-IP when extracting the peer connection IP**, supporting deployments behind reverse proxies. [#7561](https://github.com/netbirdio/netbird/pull/7561)
* **Handled empty trusted peer** to avoid errors when no trusted peer is configured. [#7589](https://github.com/netbirdio/netbird/pull/7589)
* **Named the account owner in the pending approval error**, making it clear who to contact for account approval. [#7533](https://github.com/netbirdio/netbird/pull/7533)
* Fixed **group resource validation** for proper enforcement. [#7608](https://github.com/netbirdio/netbird/pull/7608)
* Added **store support to filter by public ID**. [#7208](https://github.com/netbirdio/netbird/pull/7208)
* **Recorded proxy version on connect** for tracking and debugging. [#7630](https://github.com/netbirdio/netbird/pull/7630)
* **Split store by table** for improved database performance and organization. [#7646](https://github.com/netbirdio/netbird/pull/7646)
* **Prevented deleting custom domains used by services**, protecting active proxy configurations from accidental removal. [#7515](https://github.com/netbirdio/netbird/pull/7515)
* **Moved rate limiter to shared package** for reuse across services. [#7727](https://github.com/netbirdio/netbird/pull/7727)
* **Let usage_viewer read Agent Network access logs**, so users reviewing cost can now see the requests behind usage metrics. [#7750](https://github.com/netbirdio/netbird/pull/7750)

### 🔀 Reverse Proxy

* **Closed the client connection on private service denials** instead of leaving it hanging. [#7590](https://github.com/netbirdio/netbird/pull/7590)
* Added **proxy rate limiter** to protect against abuse. [#7568](https://github.com/netbirdio/netbird/pull/7568)
* Added **proxy credentials limiter on management** to throttle authentication attempts. [#7569](https://github.com/netbirdio/netbird/pull/7569)
* Fixed **upstream HTTP version applied before cloning transports**. [#7806](https://github.com/netbirdio/netbird/pull/7806)
* Added **release-wired UBI image variant** for the proxy. [#7464](https://github.com/netbirdio/netbird/pull/7464)
* Fixed **flow auth secret for external Relay migrations**. [#7731](https://github.com/netbirdio/netbird/pull/7731)

### 🏗️ Infrastructure and CI

* **Certified the rootless UBI client image on release** for Red Hat ecosystem compliance. [#7525](https://github.com/netbirdio/netbird/pull/7525)
* Fixed **RPM metadata for Red Hat software certification** (two rounds of fixes). [#7562](https://github.com/netbirdio/netbird/pull/7562), [#7614](https://github.com/netbirdio/netbird/pull/7614)
* Added **proxy support to enterprise setup**. [#7651](https://github.com/netbirdio/netbird/pull/7651)
* **Built the upload server from source, nonroot on Chainguard** for a hardened container image. [#7663](https://github.com/netbirdio/netbird/pull/7663)
* **Built and linted mobile Go code in CI** for Android. [#7641](https://github.com/netbirdio/netbird/pull/7641)
* **Bumped workflow actions off the retired Node 20 runtime**. [#7644](https://github.com/netbirdio/netbird/pull/7644)
* Added **Pyroscope profiling** to management, signal, and proxy services. [#7536](https://github.com/netbirdio/netbird/pull/7536)
* **Pointed the agent-config e2e providers at the mock upstream**. [#7542](https://github.com/netbirdio/netbird/pull/7542)
* **Used the Silo image for the S3 upload test**. [#7619](https://github.com/netbirdio/netbird/pull/7619)

### 📝 Misc

* **Pointed bug reports at Discussions and added SUPPORT.md**. [#7647](https://github.com/netbirdio/netbird/pull/7647)
* Added **cloud API spec to the public OpenAPI** definition with REST client. [#7222](https://github.com/netbirdio/netbird/pull/7222)
* **Loaded AGENTS.md every session and refused attribution trailers**. [#7544](https://github.com/netbirdio/netbird/pull/7544)

## What's Changed

* [management] Speed up test store setup and summarize the unit test run by @mlsmaycon in [#7518](https://github.com/netbirdio/netbird/pull/7518)
* [management] Refuse to pin an agent network gateway onto another account's host by @mlsmaycon in [#7519](https://github.com/netbirdio/netbird/pull/7519)
* [management] Validate the proxy cluster an agent network bootstraps onto by @mlsmaycon in [#7402](https://github.com/netbirdio/netbird/pull/7402)
* [management] Point the agent-config e2e providers at the mock upstream by @mlsmaycon in [#7542](https://github.com/netbirdio/netbird/pull/7542)
* [client] Stage install script downloads in a private temp directory by @riccardomanfrin in [#7534](https://github.com/netbirdio/netbird/pull/7534)
* [client] Read the session deadline under the status read lock by @pappz in [#7550](https://github.com/netbirdio/netbird/pull/7550)
* [client] Enforce HTTPS on install script downloads by @riccardomanfrin in [#7545](https://github.com/netbirdio/netbird/pull/7545)
* [misc] Load AGENTS.md every session and refuse attribution trailers by @mlsmaycon in [#7544](https://github.com/netbirdio/netbird/pull/7544)
* [client] Fix - Add RPM metadata required for Red Hat software certification by @braginini in [#7562](https://github.com/netbirdio/netbird/pull/7562)
* [management] Read X-Real-IP when extracting the peer connection IP by @bcmmbaga in [#7561](https://github.com/netbirdio/netbird/pull/7561)
* [management] Handle empty trusted peer by @bcmmbaga in [#7589](https://github.com/netbirdio/netbird/pull/7589)
* [proxy] Close the client connection on private service denials by @mlsmaycon in [#7590](https://github.com/netbirdio/netbird/pull/7590)
* [management] Name the account owner in the pending approval error by @heisbrot in [#7533](https://github.com/netbirdio/netbird/pull/7533)
* [proxy] add proxy rate limiter by @pascal-fischer in [#7568](https://github.com/netbirdio/netbird/pull/7568)
* [management] Add proxy credentials limiter on management by @pascal-fischer in [#7569](https://github.com/netbirdio/netbird/pull/7569)
* [client] Fix peers not being notified when the relay connection drops by @pappz in [#7490](https://github.com/netbirdio/netbird/pull/7490)
* [management] fix group resource validation by @pascal-fischer in [#7608](https://github.com/netbirdio/netbird/pull/7608)
* [client] Remove the empty GPO DNS policy store on Windows teardown by @lixmal in [#7563](https://github.com/netbirdio/netbird/pull/7563)
* [management] add store support to filter by public id by @pascal-fischer in [#7208](https://github.com/netbirdio/netbird/pull/7208)
* [client,management] Skip route firewall rule computation when no firewall by @riccardomanfrin in [#7624](https://github.com/netbirdio/netbird/pull/7624)
* [management] record proxy version on connect by @pascal-fischer in [#7630](https://github.com/netbirdio/netbird/pull/7630)
* [management,signal,proxy] add pyroscope profiling by @pascal-fischer in [#7536](https://github.com/netbirdio/netbird/pull/7536)
* [client] Validate the saved service parameters and pin the netsh lookup by @riccardomanfrin in [#7584](https://github.com/netbirdio/netbird/pull/7584)
* [client] Use POSIX style file read/write of json for windows by @theodorsm in [#7631](https://github.com/netbirdio/netbird/pull/7631)
* [client] Fix RPM metadata for Red Hat certification by @braginini in [#7614](https://github.com/netbirdio/netbird/pull/7614)
* [misc] Bump workflow actions off the retired Node 20 runtime by @heisbrot in [#7644](https://github.com/netbirdio/netbird/pull/7644)
* [misc] Add upload URL signing and rate limiting by @bcmmbaga in [#7502](https://github.com/netbirdio/netbird/pull/7502)
* [misc] Use the Silo image for the S3 upload test by @Silex in [#7619](https://github.com/netbirdio/netbird/pull/7619)
* [management] split store by table by @pascal-fischer in [#7646](https://github.com/netbirdio/netbird/pull/7646)
* [management] Refuse HTTP redirects on IdP clients by @bcmmbaga in [#7579](https://github.com/netbirdio/netbird/pull/7579)
* [management] Revoke local Dex session on embedded IdP password change by @bcmmbaga in [#7556](https://github.com/netbirdio/netbird/pull/7556)
* [misc, android] Build and lint the mobile Go code in CI by @riccardomanfrin in [#7641](https://github.com/netbirdio/netbird/pull/7641)
* [client] Raise the daemon IPC receive limit gRPC's to 16 MB by @riccardomanfrin in [#7676](https://github.com/netbirdio/netbird/pull/7676)
* [misc] Build the upload server from source, nonroot on Chainguard by @bison in [#7663](https://github.com/netbirdio/netbird/pull/7663)
* [infrastructure] Certify the rootless UBI client image on release by @braginini in [#7525](https://github.com/netbirdio/netbird/pull/7525)
* [client] Resolve the shared socket source address through a connected UDP probe socket by @lixmal in [#7633](https://github.com/netbirdio/netbird/pull/7633)
* [proxy] Add a release-wired UBI image variant by @jnfrati in [#7464](https://github.com/netbirdio/netbird/pull/7464)
* [infrastructure] Add proxy support to enterprise setup by @bcmmbaga in [#7651](https://github.com/netbirdio/netbird/pull/7651)
* [doc] Point bug reports at Discussions and add SUPPORT.md by @thomashacker in [#7647](https://github.com/netbirdio/netbird/pull/7647)
* [management] Prevent deleting custom domains used by services by @mlsmaycon in [#7515](https://github.com/netbirdio/netbird/pull/7515)
* [management] move rate limiter to shared package by @pascal-fischer in [#7727](https://github.com/netbirdio/netbird/pull/7727)
* [client] Bump wails to v3.0.0-beta.25 by @pappz in [#7640](https://github.com/netbirdio/netbird/pull/7640)
* [client] Stop dumping the whole device to clear one peer endpoint by @lixmal in [#7632](https://github.com/netbirdio/netbird/pull/7632)
* [infrastructure] Fix flow auth secret for external Relay migrations by @braginini in [#7731](https://github.com/netbirdio/netbird/pull/7731)
* [proxy] Apply the upstream HTTP version before cloning transports by @mlsmaycon in [#7806](https://github.com/netbirdio/netbird/pull/7806)
* [management] Let usage_viewer read Agent Network access logs by @jnfrati in [#7750](https://github.com/netbirdio/netbird/pull/7750)
* [client] Only treat LocalSystem as a privileged identity by SID on Windows by @lixmal in [#7889](https://github.com/netbirdio/netbird/pull/7889)

## New Contributors
* @thomashacker made their first contribution in [#7647](https://github.com/netbirdio/netbird/pull/7647)

**Full Changelog**: [v0.79.0...v0.80.0](https://github.com/netbirdio/netbird/compare/v0.79.0...v0.80.0)