Skip to content
← Back to release notes
v0.123.0 stable major release

Release v0.123.0

Oct 16, 2026

Agents that connect through ISP security filters such as Comcast xFi Advanced Security and Spectrum Security Shield, ticket types and related tickets, customer approval of over-budget or after-hours work in the portal, and the first release of Trust Center, a public security-posture page for each customer. Also: remote viewer keyboard modes, EDR detections in your incident feed, workload host inventory, dynamic groups that stay current, and invoice labor detail. Upgrade recommended.

Agents & Connectivity

  • Agents behind ISP security filters now connect. Some home and small-office internet gateways, including Comcast xFi Advanced Security and Spectrum Security Shield, block connections by the server name they can see in the connection handshake. When an agent detects that filter, it retries with the server name encrypted (Encrypted Client Hello) and gets through, while devices on normal networks keep connecting exactly as before.
  • New installs, enrollments and Quick Support sessions use the same fallback, so you can deploy to a device that sits behind one of these filters. The device's health panel tells you when a filter was detected.
  • Agents whose watchdog service couldn't be installed now retry the install on their own, and the device page shows a banner if it ultimately gives up.
  • A log-shipping status line on the device page and a fleet filter for devices whose logs have stopped arriving.
  • The macOS installer package enrolls and updates with the agent it installs, Breeze Assist on macOS lives in the menu bar only, and a Windows agent recovers when it can't rename its state file.

Service Desk

  • Ticket types: every ticket is an Incident, Service Request, Problem or Change, and each type has its own entry in the Service Desk menu. Planned work defaults to Service Request.
  • Related tickets: link tickets to each other, for example the incidents caused by one underlying problem, from a Related tickets panel on the ticket. The AI ticket tool can set the type and manage links.
  • Customers see the ticket type in the portal as a label; they can't change it.
  • Responsible contacts appear on site and device pages, so a technician on the device knows who to call.

Customer Work Approval

  • Optional and off by default: set a budget on a ticket or mark work types as after-hours, and time beyond the budget or outside hours is held until the customer approves it.
  • Billing contacts approve or decline in a new portal Approvals page with a pending-count badge, and get an email for each request from templates you can edit. A technician can also record a decision made by phone.
  • Held time is never invoiced, drawn from a block of hours or reported as billed until it is approved. The Outlook add-in, mobile app and AI assistant all respect the hold.

Remote Support

  • Choose a keyboard mode in the remote viewer: Type what I see (the default) sends the characters you type, so it works across keyboard layouts, including IME and dead-key input; Physical keys sends the exact keys you press for numpad and left/right modifier differences.
  • View-only sessions, blocking the user's local input, screenshot copy and save, Fit or 100% scaling, a connection stats overlay, and per-device preferences that the viewer remembers.
  • In fullscreen, keyboard shortcuts go to the remote machine. On macOS, Cmd+H, Cmd+M and Cmd+W reach the remote, and Cmd+Q asks before closing open sessions.
  • More reliable keyboard and mouse input on the agent side, with wider key coverage including back and forward buttons, horizontal scrolling and Caps/Num Lock sync.
  • Fixed remote desktop sessions occasionally getting stuck on Connecting.

Security & EDR

  • Trust Center, first release: publish a public, customer-authorized security-posture page for each organization, built from the telemetry Breeze already has and refreshed hourly, with supporting documents and an embeddable badge for the customer's site. Publishing requires MFA. Declared controls, gated documents and framework views come in later releases.
  • EDR detections from connected security consoles appear in your incidents feed, on the Security page and on the device page, with Promote to incident. Coverage reporting means a partial sync never reads as "no threats".
  • A new EDR providers tab under Integrations → Security manages connections, client mapping and endpoints that haven't been matched to a device yet. Customers can optionally see EDR status in the portal.
  • Isolate, release and scan actions for Bitdefender GravityZone endpoints, available to approval-gated AI and the API, and off for every connection until a partner admin turns them on.
  • Security hardening across log redaction, Windows installer verification, remote tunnel sessions, script and automation targeting, privileged access elevation and sign-in. Upgrade recommended.

Visibility & Inventory

  • Workload host inventory: with the policy turned on, agents report Docker, Podman, Hyper-V and Proxmox workloads on a new Workloads tab, with fleet filters for workload hosts and runtimes.
  • Image currency: Breeze checks running container images against their public registry every 30 minutes. An out-of-date image counts toward patch compliance and can trigger a new built-in monitor.
  • The network map tells a device's assigned site apart from the network it is actually seen on, shows visitors from other sites, and suggests a site move when a device lives somewhere else. Breeze never moves a device on its own.
  • Dynamic groups now update as soon as a device's tags or custom fields change, instead of waiting for someone to re-save the group, and the rule builder can filter on custom fields.

Billing

  • Invoice labor detail: show labor per entry or per day, with work date, notes and time worked. Set it once for your company and override it on any draft invoice.
  • Refresh from time entries updates a draft invoice with the latest time, without overwriting descriptions you edited by hand.
  • Block hours: sell prepaid hours on a contract, track the live balance and period history, and optionally show customers a Support hours card in the portal.
  • Catalog items can be recurring, so quotes price monthly services correctly.

Policies & Automation

  • Windows System Restore policy: a new System Protection policy tab sets when Breeze asks for a restore point, and patch history, scripts and software deployments show the outcome. This release adds the policy and reporting; devices start creating restore points with a later agent release.
  • Run Script on device groups, from the Run Script dialog, from automations and from the AI assistant. Group membership is resolved before approval, so you see exactly which devices will run it.
  • Per-app patch approval rules now live on the Update Ring, and each patch policy can set its own restart prompt title, message and button label.
  • Acknowledge, resolve or suppress alerts straight from a device's alert history, and see each script's latest result on the device Scripts tab.

If you have clients working from home on Comcast or Spectrum, you may have seen agents that simply never check in. Some ISP gateway security filters, including Comcast xFi Advanced Security and Spectrum Security Shield, block connections to Breeze by reading the server name in the connection handshake. With this release’s agent, a device that runs into one of those filters retries with that name encrypted and connects. Everyone else keeps connecting as they always have.

The service desk grows up too. Tickets now have types (Incident, Service Request, Problem, Change) and can be linked to each other, so you can tie a run of incidents to the problem behind them. Customer work approval lets you hold over-budget or after-hours time until the client says yes in the portal, so nothing lands on an invoice they didn’t agree to. Invoices can itemize labor by entry or by day.

There’s plenty more: a remote viewer keyboard mode that types what you see on any layout, EDR detections in your incidents feed, inventory of Docker, Hyper-V and Proxmox workloads with checks for out-of-date container images, dynamic groups that stay current as tags and custom fields change, and a Windows System Restore policy that devices pick up with a later agent release.

Self-hosters: there are no new required settings, but read the GitHub release notes before upgrading. This release moves per-app patch rules onto Update Rings during the upgrade, Compose now passes more of your .env to the API, and the agent encryption fallback should only be switched off (AGENT_ECH_ENABLED=false) as a last resort, since devices that depend on it go offline.