Release v0.103.0
Jul 30, 2026
A major security release closing six waves of hardening, plus a new Deployments tab for software rollouts, partner-wide alert rules, per-session helpers for multi-user Windows hosts, and Microsoft 365 delegated communications. Self-hosters: this upgrade needs a few minutes of planning — see the notes.
Security & Compliance
- Reports now carry the site restrictions of whoever created them. A technician limited to certain sites can no longer reach data outside those sites through a report or a scheduled run.
- Permission and access changes take effect immediately. Removing someone's access or revoking a token no longer waits for their session to expire on its own.
- Remote sessions now have a single, tracked owner. Two technicians can no longer end up driving the same machine, and sessions clean up properly when they end.
- Agents prove their identity with a certificate tied to the specific device, with proper renewal and revocation history.
- Agent updates verify their signing key, and agents check where they are being asked to download software from.
- Tenant exports carry only the fields they need, and every export and administrative action is recorded in a complete audit trail.
Remote Management
- Remote terminal sessions no longer disconnect after 60 seconds — a cleanup routine was ending healthy sessions by mistake, and the interface would freeze without explaining why.
- Running several terminal commands at once no longer causes them to interfere with each other.
- On Windows servers with multiple signed-in users, each session now gets its own helper with its own consent prompt, instead of sessions competing over a single shared one.
Visibility & Monitoring
- A new Deployments tab shows what software actually reached which devices, with accurate status as a rollout progresses.
- Selecting devices in bulk now carries that selection into the deployment wizard instead of losing it.
- Alert rules moved under the Alerts configuration policy, so you can define a rule once at the partner level and apply it across every organization you manage.
Platform & Infrastructure
- Raw device metrics are now cleaned up on a schedule instead of growing without limit. Your history charts are unaffected.
- Microsoft 365 delegated communications: consent, onboarding, and a mail-scoped action catalog for customer Graph actions.
Version 0.103.0 is the largest security release Breeze has shipped. It closes six waves of a full security review, and alongside that brings a genuinely useful set of day-to-day improvements — most notably a Deployments tab for software rollouts and partner-wide alert rules.
On the security side, the theme is that access decisions now hold immediately and everywhere. Reports carry the site restrictions of the person who created them, so a technician scoped to two sites cannot reach a third through a scheduled report. Revoking someone’s access takes effect right away rather than waiting for their session to lapse. Remote sessions have exactly one tracked owner, so two technicians can’t end up on the same machine. Agents prove their identity with a device-bound certificate, verify the signing key on their own updates, and check where they’re being told to download software from. None of this changes how the product feels to use — it changes what happens when someone shouldn’t have access.
The most visible day-to-day change is the Deployments tab. Pushing software used to mean starting a rollout and then guessing at its progress; now there’s a real view of what reached which devices, with status that stays accurate as the rollout proceeds — and selecting devices in bulk finally carries that selection into the wizard instead of dropping it. Alert rules also moved under the Alerts configuration policy, which means you can define a rule once at the partner level and have it apply across every organization you manage, rather than recreating it per customer.
Two long-standing remote-access annoyances are gone: terminal sessions no longer die after about a minute (a cleanup routine was ending healthy sessions by mistake, and the UI froze without saying so), and on Windows servers with several signed-in users, each session now gets its own helper and its own consent prompt instead of fighting over a shared one.
Self-hosting note: this upgrade needs a little planning — please read the GitHub release notes before you pull. There are four new required settings (the stack will stop with an error naming them if they’re missing), remote access needs a short maintenance window rather than a rolling restart, and raw device metrics older than 30 days are cleaned up on first start — your history charts are unaffected, but set the retention value beforehand if you need to keep more. Redis must be a single primary instance; clustered or automatic-failover Redis will deliberately pause remote access. Eighteen database migrations apply automatically on startup. There’s a new documentation page covering every rollout setting and why it exists.