Skip to content
← Back to release notes
v0.125.0 stable major release

Release v0.125.0

Oct 27, 2026

Agreements your clients sign without a quote; ticket merge, business-hours SLAs and routing rules; update rings that decide Windows feature updates; install scripts and built-in Control D and NextDNS packages; YARA detection rules with fleet-wide IOC sweeps; AI conversations that move between the side panel and the full-page chat; dashboard numbers you can click; and a more dependable Breeze Assist.

Agreements & Signing

  • Send any agreement for signature without building a quote first. Send for signature sits on Agreements → Signed agreements, on an organization's Billing tab and on a contract. Pick the template, recipients and expiry, and preview exactly what the client will see.
  • Clients sign on a public page with no account and no price shown, or from the customer portal's new Agreements page. A typed-name signature, or a decline with a reason, is recorded.
  • The signer and every recipient get the signed copy by email. Downloads default to a certified copy with a signature certificate page showing who signed, when, from where and how, plus a fingerprint of the original file. The original file is still one click away.
  • Remind a signer with one click, let unsigned links expire on their own, and set partner defaults for link expiry and automatic reminders (reminders start off) under Settings → Billing → Agreements.
  • Signed agreements are write-protected once they are signed.
  • A new permission covers sending, copying links, voiding and recording signed agreements. The upgrade grants it to every role that can already edit agreements, so nobody loses access.

Ticketing

  • Merge duplicate tickets with Merge into…: comments, time, parts, checklists and links move to the ticket you keep. The merged ticket stays as a read-only record, and replies sent to it by email land on the surviving ticket. Customers see a banner on the merged ticket in the portal.
  • Business-hours calendars with holidays under Ticketing → Priorities & SLAs, as a partner default with an organization override. Each ticket keeps the calendar it was created under, and nothing changes until you mark a calendar as the default.
  • Routing rules under Settings → Ticketing → Routing set the category, priority, status or assignee on new tickets, for one organization or partner-wide. The first matching rule wins, and only fields the person creating the ticket left empty are filled.
  • The AI assistant can list business calendars and list, test and manage routing rules.

Patching & Software

  • Update rings now decide Windows feature updates. Each ring can Block feature releases (the default, and the behaviour you have today), Allow the newest release, or Pin devices to one, such as Windows 11 25H2. A pin also sets the Windows Update for Business target release on each device, and switching back removes only what Breeze wrote. A blocked release shows as Excluded by policy on the device's Patches tab. Needs this release's agent.
  • Software versions can carry pre- and post-install scripts, and a new zip package type sits alongside installers. Needs this release's agent; older agents are told to update instead of being sent the job.
  • Partner admins can add Breeze-maintained Control D and NextDNS packages for Windows from Software → Catalog → Built-in packages.
  • Software policies can require a service to be running: a stopped service shows as a violation, and an enforcing policy restarts it.
  • Windows updates that Microsoft didn't rate get a severity derived from their classification and title, labelled Derived rating, so they sort and filter with everything else.

Security & Detection

  • A new Detection Rules page under Security manages YARA rule sets, with compile errors shown inline, a paste-in importer for indicators of compromise and a panel to test a rule against a file.
  • Pick rule sets from a configuration policy's Security tab, and see the rule that matched on each threat.
  • Sweep now runs published rule sets across many devices at once, from a preview you approve. Sweeps only detect; they never start a Defender scan.
  • The AI assistant can hunt for indicators across your fleet. Sweeps and imports need approval, and a sweep over 25 devices needs a second approver.

Breeze AI

  • A conversation moves between the side panel and the full-page chat (Open in AI Assistant / Continue in side panel) with its history, device, model and unsent text. A reply that is still coming in keeps streaming.
  • Both surfaces share one history list, tagged with the organization and device each conversation was about.
  • The chat is called Breeze AI everywhere, and the full-page chat has a new address; old links redirect.
  • Approvals read Approve / Deny, AI spend shows in dollars, and the four guardrail levels have plain names. The AI section of the sidebar is shorter, and AI settings are gathered on a new Settings → AI page.
  • Many more actions are available to Breeze AI in chat and in AI agents: PSA and billing, backup and disaster recovery, security and incident response, alert correlation, network topology, SNMP monitoring and security policies. Every action carries a guardrail level, so risky ones still wait for approval.

Dashboard & Everyday Work

  • Dashboard device, alert, vulnerability, security and patch figures open the filtered list they count.
  • Sites is back under Fleet Management as one list across organizations, and Move to site works on many devices at once.
  • Patch compliance now shows the percentage of fully patched devices everywhere, matching the Patches page. Your dashboard number may change after the upgrade.
  • Three new business reports: Client profitability, Quote win rate, and MRR & renewals.
  • Quotes and invoices look the same in the preview, the detail page, the portal and the PDF, and staff get a Customer view to see the portal exactly as their client does.
  • Partner settings save with one Save button for every tab, with a status line that names unsaved or failed sections. Caller verification and Known guests get their own tabs.
  • A Physical placement card (room, rack, rack unit and height) on device and discovered-asset pages.
  • Restoring a backup selectively now accepts whole folders, with a confirmation above 1,000 files.

Agent & Remote Support

  • Breeze Assist on Windows no longer tries to start on a WebView2 runtime too old for it. The device reports Assist unavailable with the reason instead of failing silently, and the device page gets a Breeze Assist row.
  • The agent removes only a copy of Breeze Assist it installed itself. A copy deployed by Intune or installed by hand is left alone.
  • The remote-support consent prompt on the device now defaults to Deny, so pressing Enter or letting it time out declines the session.
  • Force reboot now on the device Power menu restarts a stuck device immediately, closing running apps, after you type the hostname and pass an MFA check. Older agents refuse it visibly rather than silently.
  • Restart agent from the device page restarts an unresponsive agent through its watchdog, under its own permission that the upgrade grants to the built-in technician and admin roles.
  • Agents reconnect more gently after a server restart, spreading their reconnects and deferring routine uploads when the server asks them to wait. A device can show offline up to about 30 seconds longer after a restart.
  • Privileged access: a device that can't act on an elevation request now says so, and the request closes as expired instead of waiting. Approvals reach the device immediately.

Security & Platform

  • Security hardening across response headers, the Office add-ins (assistant replies can no longer load remote content that could carry document or mail text out), file transfer (upload, copy and move now need the same permission as running a script), UAC approvals (now also need device execute rights, with the same MFA gate everywhere), and dependency advisories. Self-hosters are encouraged to upgrade.
  • DNS Security keeps 90 days of history by default, adjustable per integration, and deleting an integration now runs in the background.
  • The Integrations page leads with health, with status and scope labels on each entry.
  • The default device group is now a real group that new devices join at enrollment.

Agreements no longer need a quote to get signed. Send an MSA or a project sign-off straight from the organization or contract, let the client sign from a link or the customer portal, and file a certified copy with a signature certificate attached. Reminders and expiry run on their own, so a forgotten agreement doesn’t sit in limbo.

The service desk gets the three things busy queues ask for most: merging duplicate tickets without losing a comment or a minute of time, SLAs that respect business hours and holidays, and routing rules that put a new ticket in the right place before anyone touches it. Patching gains control over Windows feature updates per update ring, so you decide when a fleet moves to the next Windows release, or keep it pinned where it is. On the security side, YARA detection rules get a real editor, and Sweep now hunts for indicators across many devices at once, with approvals built in.

A few things behave differently after the upgrade. Every update ring starts on Block, so no feature release is offered until you choose Allow or Pin. DNS Security now keeps 90 days of history by default, and older history is removed on the first nightly run; raise the window on an integration before upgrading if you need more. The remote-support consent prompt on devices defaults to Deny. Several of these changes need agent 0.125.0, which rolls out through your normal update channel. Self-hosters will find the migrations and settings in the GitHub release notes.