Changes compared to the previous beta, v0.108.0-b.71. See CHANGELOG.md for all changes.

Full changelog

Security

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.24.5.

Fixed

• TTL override calculation (#7903).

• Validation process for DNSCrypt settings (#7856).

It’s not always the big issues: sometimes what you need is a few fixes and tweaks to pump up the overall stability 🔩

Acknowledgments

A special thanks our community moderators team and to everyone who filed and inspected issues, added translations, and helped us test this release!

Full changelog

See also the v0.107.63 GitHub milestone.

Security

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.24.4.

Fixed

• The hostnames of DHCP clients with multiple labels not being recognized.

• Status reported by the systemd service implementation in cases of auto-restart after a failed start.

Changes compared to the previous beta, v0.108.0-b.70. See CHANGELOG.md for all changes.

Full changelog

Security

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.24.4.

Fixed

• The hostnames of DHCP clients with multiple labels not being recognized.

• Status reported by the systemd service implementation in cases of auto-restart after a failed start.

Many claim to be client-oriented; we're proud to say that AdGuard Home is $client-oriented, as in this update we've fixed (among others) the bug that prevented the rules containing the client modifier from working. 👥

We have also improved AdGuard Home's security by updating the Go version to shore up some vulnerabilities, as usual.

Full changelog

See also the v0.107.62 GitHub milestone.

Security

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.24.3.

Fixed

• Clients with CIDR identifiers showing zero requests on the Settings → Client settings page (#2945).

• Command line option --update when the dns.serve_plain_dns configuration property was disabled (#7801).

• DNS cache not working for custom upstream configurations.

• Validation process for the DNS-over-TLS, DNS-over-QUIC, and HTTPS ports on the Encryption Settings page.

• Searching for persistent clients using an exact match for CIDR in the POST /clients/search HTTP API.

Changes compared to the previous beta, v0.108.0-b.69. See CHANGELOG.md for all changes.

Full changelog

Security

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.24.3.

Fixed

• Clients with CIDR identifiers showing zero requests on the Settings → Client settings page (#2945).

• Command line option --update when the dns.serve_plain_dns configuration property was disabled (#7801).

Changes compared to the previous beta, v0.108.0-b.68. See CHANGELOG.md for all changes.

Full changelog

Fixed

• DNS cache not working for custom upstream configurations.

• Validation process for the DNS-over-TLS, DNS-over-QUIC, and HTTPS ports on the Encryption Settings page.

• Searching for persistent clients using an exact match for CIDR in the POST /clients/search HTTP API.

What's worse than food poisoning? Cache poisoning, of course! In this update, we have fixed the vulnerability that was making AdGuard Home susceptible to cache poisoning attacks.

Acknowledgements

A special thanks to Xiang Li for reporting the vulnerability, our community moderators team, as well as to everyone who filed and inspected issues, added translations, and helped us test this release!

Full changelog

See also the v0.107.61 GitHub milestone.

Security

• Any simultaneous requests that are considered duplicates will now only result in a single request to upstreams, reducing the chance of a cache poisoning attack succeeding. This is controlled by the new configuration object pending_requests, which has a single enabled property, set to true by default.

  NOTE: It's strongly recommended to leave it enabled, otherwise AdGuard Home will be vulnerable to untrusted clients.

Changes compared to the previous beta, v0.108.0-b.67. See CHANGELOG.md for all changes.

Full changelog

Fixed

• Unencrypted DNS-over-HTTPS does not work without a certificate (#7773).

Changes compared to the previous beta, v0.108.0-b.66. See CHANGELOG.md for all changes.

Acknowledgements

A special thanks to Xiang Li for reporting the vulnerability, our community moderators team, as well as to everyone who filed and inspected issues, added translations, and helped us test this release!

Full changelog

Security

• Any simultaneous requests that are considered duplicates will now only result in a single request to upstreams, reducing the chance of a cache poisoning attack succeeding. This is controlled by the new configuration object pending_requests, which has a single enabled property, set to true by default.

  NOTE: It's strongly recommended to leave it enabled, otherwise AdGuard Home will be vulnerable to untrusted clients.

Changed

• Alpine Linux version in Dockerfile has been updated to 3.21 (#7588).

Fixed

• Incorrect label on login page (#7729).

If you are reading through these release notes, you must be a true power user of AdGuard Home, as this update isn’t the flashiest one. There are no exciting new features, but there are patches to Go vulnerabilities, UI and docker updates, and a couple of bugfixes.

Full changelog

See also the v0.107.60 GitHub milestone.

Security

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.24.2.

Changed

• Alpine Linux version in Dockerfile has been updated to 3.21 (#7588).

Deprecated

• Node 20 support, Node 22 will be required in future releases.

  NOTE: npm may be replaced with a different tool, such as pnpm or yarn, in a future release.

Fixed

• Filtering for DHCP clients (#7734).

• Incorrect label on login page (#7729).

• Validation process for the HTTPS port on the Encryption Settings page.

Removed

• Node 18 support.