v0.4.10 v3.5.168

Name: ralphex
Author: umputun

high risk

umputun/ralphexOct 17, 2026 → Oct 17, 20260 days between releases

What's New

Major update adds OIDC/TOTP auth, UX 3.5 console, and security hardening.

Breaking Changes

JWT tokens without aud/iss/nbf claims are rejected, requiring a re-login.
CSP removed unsafe-inline/eval on /remote (rollback via environment variable).
UX 3.5 console is the only supported shell.

New Features

OIDC SSO-first login with role mapping.
TOTP 2FA for panel accounts.
UX 3.5 console interface with Material Symbols.
Generic agent releases with QR activation.
Scheduled full-instance backups with retention policies.

Improvements

SSRF security fixes restricting GitHub fetch to allowlisted hosts.
Path injection hardening via Multer path reconstruction.
Docker admin bootstrap and shared SQLite DB fixes.
Rate limiting on generic agent downloads.
CodeQL path-injection findings treated as false positives.

Upgrade Notes

JWT tokens without aud/iss/nbf claims are now rejected, requiring a re-login. The CSP policy on /remote has changed; use an environment variable to rollback if necessary. Ensure your agents support the new generic agent release format.

The Two Releases

v0.4.10

Oct 17, 2026· 5 days ago

Minimal release notes: "**Full Changelog**: https://github.com/NandhaKishorM/laya/compare/v0.4.9...v0.4.10"

Full release notes

v3.5.168

BetterDesk 3.5.168

Oct 17, 2026· 4 days ago

A comprehensive stable update featuring security fixes, UX 3.5 console improvements, OIDC/TOTP authentication, Docker enhancements, and remote connection features.

Full release notes