server: v0.12.0

0.12.0 (2026-10-22)

Features

• engine: a group fills itself from a rule, a provider, or its parent groups (0eb83d2)
• engine: a person turned away from an app asks for access and a manager or organization owner grants it (2e17ec5)
• engine: an account makes an app password for one app, which LDAP and forward auth accept in place of the second factor (5b729a1)
• engine: an opt-in daily check tells the overview when a new release is out (351b6a2), closes #181
• engine: each tenant sets its four link lifetimes from the console in place of environment variables (149d71b)
• engine: forward auth follows ordered rules on path, method, network, and group (edaac64)
• engine: the overview lists health checks that run every ten minutes and say what to do (1ccaaa4), closes #175
• server: the image runs masks with one command, with its own Postgres and the address it was set up at (2b6a729)

Refactoring

• server: the one-command image shares one roles decision, one loopback check, and one origin comparison (2ae9b2a)

Operator: a server whose MASKS_PUBLIC_ORIGIN_TEMPLATE names one host and that declares no tenant now serves one tenant called masks. Set MASKS_TENANT to the old tenant's name to keep it.

python: v0.3.3

0.3.3 (2026-10-22)

Fixes

• python: the client locks certifi 2026.10.19, past PYSEC-2026-4320 (649ea10)

Documentation

• the quickstart and self-hosting guide start from one docker run (e45c35f)

node: v0.3.3

0.3.3 (2026-10-22)

Documentation

• the quickstart and self-hosting guide start from one docker run (e45c35f)

masks-server: v0.12.0

0.12.0 (2026-10-22)

Features

• engine: a group fills itself from a rule, a provider, or its parent groups (0eb83d2)
• engine: a person turned away from an app asks for access and a manager or organization owner grants it (2e17ec5)
• engine: an account makes an app password for one app, which LDAP and forward auth accept in place of the second factor (5b729a1)
• engine: an opt-in daily check tells the overview when a new release is out (351b6a2), closes #181
• engine: each tenant sets its four link lifetimes from the console in place of environment variables (149d71b)
• engine: forward auth follows ordered rules on path, method, network, and group (edaac64)
• engine: the overview lists health checks that run every ten minutes and say what to do (1ccaaa4), closes #175
• server: the image runs masks with one command, with its own Postgres and the address it was set up at (2b6a729)

Fixes

• engine: a tenant set up before addresses were kept is refused until a template names its address (615b244)

Refactoring

• server: the one-command image shares one roles decision, one loopback check, and one origin comparison (2ae9b2a)

go: v0.3.2

0.3.2 (2026-10-22)

Fixes

• go: the Go client builds with go1.26.10, past the crypto/x509 advisory GO-2026-6809 (4685e84)

Documentation

• the quickstart and self-hosting guide start from one docker run (e45c35f)

server: v0.11.0

0.11.0 (2026-10-20)

Features

• server: an app's machines are listed on its page and revoked one at a time (97e0ad5)
• server: the job queue prunes finished jobs after a week and failed ones after a month, and a text that fails its last retry is recorded (7d2fafe)

Fixes

• engine: maintenance jobs carry on past a tenant that fails and record which one (1d30014), closes #194
• server: the health check notices a stopped worker and the image carries a HEALTHCHECK (a2a110c), closes #196

Performance

• engine: cleanup walks token families by id, and the columns cleanup and metrics read are indexed (efb05c9)

python: v0.3.2

0.3.2 (2026-10-20)

Fixes

• client: a sign-in older than the max_age the app asked for is refused (7116e24), closes #161
• client: the last good issuer and keys are served while masks is down (1423d1e), closes #162

node: v0.3.2

0.3.2 (2026-10-20)

Fixes

• client: a sign-in older than the max_age the app asked for is refused (7116e24), closes #161
• node: the Auth.js refresh tests sign in with a token that outlives the callback (e1cbc7e), closes #210

masks-server: v0.11.0

0.11.0 (2026-10-20)

Features

• engine: a tailnet discovers masks through WebFinger (e22ae37)
• engine: an app's enrollment tokens are rate limited per app and last up to a day (7cc6beb)
• engine: nine more known products are presets, Tailscale and Headscale among them (bb842da)
• server: an app's machines are listed on its page and revoked one at a time (97e0ad5)
• server: the job queue prunes finished jobs after a week and failed ones after a month, and a text that fails its last retry is recorded (7d2fafe)

Fixes

• engine: a member route takes only a whole number, so an id that starts with digits is not read as that membership (701ef5b)
• engine: boot tasks run once across replicas under a database lock (3bba611), closes #195
• engine: each language is measured for how much of it is translated, and seven strings that were still English are not (27c5410)
• engine: maintenance jobs carry on past a tenant that fails and record which one (1d30014), closes #194
• server: the health check notices a stopped worker and the image carries a HEALTHCHECK (a2a110c), closes #196

Performance

• engine: cleanup walks token families by id, and the columns cleanup and metrics read are indexed (efb05c9)

gem: v0.12.2

0.12.2 (2026-10-20)

Fixes

• client: a sign-in older than the max_age the app asked for is refused (7116e24), closes #161
• client: the last good issuer and keys are served while masks is down (1423d1e), closes #162