BetterDesk 3.3.0

[3.3.0] — 2026-06-12

Stable production release on main (merged from dev). Ships via Settings → Updates on the Stable channel, or betterdesk.sh / betterdesk.ps1 option 2 / docker compose pull for GHCR. Panel update creates a pre-update backup by default. No database migration or manual SQL step is required.

Added

• Organization shared address book (#190) — admins maintain a shared contact list per organization (Organizations → Address Book). Entries merge into each member's RustDesk address book on GET /api/ab when sharing is enabled; personal entries stay private.
• Organizations → Device Groups tab — readout of device groups and user groups linked to the organization (team_id), with shortcuts to Devices → Groups and one-click org-scoped group creation.
• Docker MACVLAN quick-start (#186) — docker-compose.quick.macvlan.yml plus upgrade notes in DOCKER_QUICKSTART.md. Uses service_started (not service_healthy) and 127.0.0.1 API/WS env when the console uses network_mode: service:server.
• betterdesk-show-admin-credentials helper (#195) — re-execs as betterdesk to read .admin_credentials on hardened images (cap_drop: ALL). Bundled in all Docker images; documented in README, install.sh, and Docker troubleshooting.

Fixed

• Stale update warning banner (#192) — Settings → Updates no longer keeps showing stale EACCES errors after a successful external update (betterdesk.sh, betterdesk.ps1, betterdesk-docker.sh, or GHCR docker compose pull). Non-critical root-owned file failures are filtered; the banner clears when the installed SHA matches the target. Native install/update now copies VERSION into the console directory (Settings reads semver from VERSION or package.json).
• CodeQL / security hardening — OIDC discovery blocks private/link-local DNS; branding SVG/CSS multi-pass sanitization; same-origin restrictions on desktop iframe routes and Utils.api(); confined filesystem helpers; upload rate limits; type-safe device file API parsing. CodeQL config documents intentional exclusions.
• Go server product version in Docker builds — BETTERDESK_PRODUCT_VERSION build arg embeds semver in the Go binary (Settings → Server Information matches panel version after image update).

Changed

• Alpha desktop clients (betterdesk-mgmt, betterdesk-agent-client) temporarily untracked from git to reduce Dependabot / CI noise.
• Version bump automation uses scripts/bump-version.js --list-paths (includes Go server VERSION files and MACVLAN compose).

Upgrade notes (operators)

Topic	Action
Native / panel update	Settings → Updates → Stable → Check for updates → Install. Allow Go server rebuild/restart when prompted.
Docker	docker compose pull && docker compose up -d after release; use betterdesk-show-admin-credentials instead of cat as root.
MACVLAN (#186)	Switch to docker-compose.quick.macvlan.yml or set depends_on: service_started, DB_PATH=/app/data/db_v2.sqlite3, 127.0.0.1 for API/WS.
Stale update banner (#192)	Update to 3.3.0+ or once: rm -f <console-path>/data/.last_update_result.json and restart console.

---

What's Changed

• Release 3.3.0 — stable production merge from dev by @UNITRONIX in #196

Full Changelog: v3.2.0...v3.3.0