Skip to content
← Back to release notes
v0.107.0 stable major release

Release v0.107.0

Aug 22, 2026

Invoices get a secure view-and-pay link — customers open it from the email or the PDF and pay by card with no portal sign-in. Accepting a proposal now lands the customer straight on that invoice, and declining one tells you why. Plus per-customer currency, work tickets from Outlook, tickets and devices on mobile, two security fixes worth your attention, and the release where bring-your-own Windows signing works end to end.

Billing & Invoicing

  • Every issued invoice now carries a secure view-and-pay link. Customers open it from the invoice email or the 'Pay online' line printed on the PDF and see the invoice, download it, and pay by card — no portal account, no sign-in. Deposits are handled: a deposit invoice charges the deposit, not the full amount.
  • The link is durable — the same invoice keeps the same link across re-sends, so an old email still works. It expires on its own (a year out, or 180 days past due, whichever is later), and you can revoke it from the invoice with Reset customer link; previous links stop working immediately and the PDF is regenerated with the new one.
  • Copy the customer link straight from the invoice to paste into a chat or ticket reply.
  • Re-send an issued invoice without rebuilding it. The new composer mirrors the quote one — To, CC, subject, a personal note, and whether to attach the PDF — with the billing contact pre-filled. Re-sending doesn't re-stamp the sent date or fire duplicate lifecycle events, and paid or voided invoices can't be emailed by mistake.
  • Prospects who land on the account-activation payment screen can now book a call instead of hitting a dead end when they aren't ready to enter a card.

Multi-Currency Billing

  • Each customer organization now has its own currency, chosen from a curated list of 34 supported currencies. Existing customers inherit your partner currency, so nothing changes until you set one.
  • Invoices, quotes, and contracts are stamped with the customer's currency when they're created, instead of quietly defaulting to US dollars. Documents keep the currency they were issued in for good.
  • Amounts round the way each currency actually works — yen and Chilean pesos have no decimal places, and Breeze no longer invents them. Totals, tax, and rounding all follow the document's own currency.
  • Got the currency wrong on a draft? Change it on the draft document rather than deleting and starting over.
  • Cloning a document into a different customer is blocked when the two currencies don't match, so you can't silently ship a euro quote priced in dollars.

Quotes & Proposals

  • When a customer accepts a proposal they land directly on the issued invoice's pay page — accept and pay in one sitting. A new partner setting, 'Email the invoice automatically when a quote is accepted' (on by default), sends the invoice with its pay link the moment the proposal is accepted.
  • Declining a proposal is a real outcome now. The customer can decline inline and say why; you get an email, the quote shows a 'Declined' banner with the reason, and a Duplicate & revise action starts the next version from the declined one.
  • A decline you record yourself from the quote is never attributed to the customer.

Tickets & Mobile

  • Outlook technician persona: work tickets without leaving your inbox. The add-in shows a context card for the email you're reading, links it to an existing ticket or creates a new one with an AI-drafted summary, and logs time against it.
  • The mobile app gets a Tickets tab — browse the queue, open a ticket, read and add comments, and change status from your phone.
  • A browsable Devices list on mobile with search and filtering by name, site, and status, paging through the whole fleet.
  • The mobile app refreshes its session in the background instead of signing you out, and the Systems screen no longer reports 'no issues' when active alerts are buried under resolved ones.
  • The iOS app lock can no longer be bypassed by force-closing and reopening the app.

Security

  • Fixed an issue where any enrolled agent could write to the shared patch catalog. Because that catalog is global, a compromised or misbehaving agent on one network could have altered entries other customers rely on and silently suppressed their patching. Agent-supplied catalog data is now validated and can no longer overwrite trusted entries. This is the only issue in this release that reached beyond a single partner's boundary — no customer data was readable through it.
  • Fixed an issue where a partner user whose access was limited to specific customer organizations could still issue partner-wide credentials or rotate another administrator's API key. Credential issuance now enforces the partner-wide capability and cannot exceed the issuing user's own access.
  • Additional hardening with no known exposure: authorization tightened on CIS benchmark scans, inbound email is matched to tickets more strictly, and the partner-wide alert-template filter no longer widens across customer organizations.
  • Bulk vulnerability actions — remediate, accept risk, mitigate — no longer fail outright on a large selection; big batches are processed in chunks automatically.

Devices & Agent

  • Fixed agent uninstall reporting success without actually removing anything, which left agents behind on machines you believed were clean.
  • Fixed EXE-based software deployments hanging until the 30-minute install timeout instead of finishing in seconds.
  • SNMP values that aren't plain text — MAC addresses, serial numbers, binary identifiers from switches and printers — now display correctly instead of arriving garbled or truncated.
  • Fixed a rare conflict when a device's network inventory arrived at the same moment the device was re-enrolling.

Visibility & Platform

  • Fixed single sign-on never completing in the web app — SSO users were returned from their identity provider and left on the login screen. If you have been unable to turn on enforced SSO, this is the release that unblocks it.
  • Checking a device's live session status no longer holds a database connection for the whole agent round-trip, which under load from several open dashboards could slow the whole platform.
  • Changing your display language no longer drops an active remote desktop session.
  • Customer organization cards show the real device count instead of a blank 'devices' label.
  • Notification channel tests now say in words whether the test passed or failed — a failed Slack or email test could previously be mistaken for a working one.

Self-Hosting

  • Windows agent packages in the public release are now shipped unsigned, and you sign them with your own code-signing certificate. This is the release where that works end to end: the server now accepts the unsigned self-host binaries, which previously failed to download on every platform. Step-by-step guide: https://docs.breezermm.com/deploy/sign-your-own-packages/
  • The Breeze Viewer and Helper installers are still signed by LanternOps, now with a certificate from a new certificate authority (SSL.com). Microsoft SmartScreen reputation resets with a new certificate, so you may briefly see a SmartScreen prompt the first time you run a newly signed installer until reputation rebuilds.
  • Request and agent-heartbeat metrics are now actually emitted to your metrics endpoint — they were silently missing in production builds, so Prometheus scraped nothing.
  • Fixed several first-boot failures on a fresh install — a stale default image version, a missing TURN secret check, a placeholder key that blocked startup, and a localhost database URL shipped in the example environment file.
  • Self-hosted mobile builds can register their own domain for passkey and password autofill.

Invoicing catches up with quoting this release. Every issued invoice now carries a secure view-and-pay link: it’s in the email, it’s printed on the PDF as “Pay online”, and when a customer opens it they see the invoice, can download it, and can pay by card right there — no portal account, no sign-in. The link is built to survive the real world: it stays the same across re-sends so an old email still works, it expires on its own well past the due date, and if you ever need to kill it, one click resets it and regenerates the PDF with a fresh one. The quote flow closes its loop at both ends too — accepting a proposal drops the customer on that invoice’s pay page (and can email it automatically), and declining one finally tells you it happened, and why.

Underneath that, billing starts speaking other currencies. Each customer organization can be set to one of 34 supported currencies, and invoices, quotes, and contracts are stamped with that customer’s currency instead of quietly defaulting to US dollars. Rounding follows the currency rather than assuming two decimal places, so yen and Chilean peso totals come out right. Elsewhere, technicians get two new places to work from: the Outlook add-in can now link or create a ticket from the email you’re reading and log time against it, and the mobile app picks up a Tickets tab and a browsable device list.

Two security fixes deserve a read. Any enrolled agent could previously write to the shared patch catalog — because that catalog is global, a compromised agent on one network could have altered entries other customers depend on and quietly suppressed their patching. And a partner user restricted to specific customer organizations could still issue partner-wide credentials or rotate another administrator’s API key. Both are fixed; the rest of this release’s security work is hardening with no known exposure. On the fixes side, single sign-on could never actually complete in the web app, agent uninstall reported success without removing anything, and EXE deployments hung for the full 30-minute timeout — all three are resolved.

Self-hosters, read this one. Windows agent packages in the public release now ship unsigned so you can sign them with your own code-signing certificate, and this is the release where that path works end to end: the server previously refused to serve those unsigned self-host binaries, so downloads failed on every platform. The signing guide walks through it. The Viewer and Helper installers are still signed by LanternOps, now under a new certificate authority — expect SmartScreen reputation to rebuild from scratch. Also fixed for self-hosters: request and agent-heartbeat metrics are finally emitted (Prometheus was scraping nothing), and a handful of first-boot failures on fresh installs are gone.