v1.13.36

v1.13.36 (2026-06-19)

Full Changelog

• Fix: Fixed an issue where the X-Prey-Status HTTP header could contain invalid characters (such as newlines) that violated RFC 7230, causing request failures when device status data included special characters. (SoraKenji)

• Fix: Fixed the hostname trigger incorrectly firing a device_renamed event when location data (a JSON object) was stored as the hostname value in the local database, causing spurious rename notifications to the control panel. (SoraKenji)

• Fix: Fixed edge cases in the Windows lock action where Task Manager windows opened during the lock session were not properly closed on unlock. (SoraKenji)

• Fix: Removed an empty registry key created during installation that caused errors with the unattended (silent) installer on Windows. (SoraKenji)

• Fix: Upgraded node-forge to 1.4.0 to address CVE-2026-33896 (BasicConstraints bypass vulnerability). (SoraKenji)

• Fix: Upgraded underscore to 1.13.8 to address a Denial of Service vulnerability in the flatten function. (SoraKenji)

• Fix: Upgraded minimatch to address a ReDoS (Regular Expression Denial of Service) vulnerability (GHSA-3ppc-4f35-3m26). (SoraKenji)

• Fix: Upgraded plist to 3.1.1 to address a CVE in the bundled @xmldom/xmldom dependency. (SoraKenji)

• Fix: New Windows Prey Lock guarding edge cases and solving focus on textbox issues. (SoraKenji)

• Chore: Updated bundled Windows executables: Fenix 1.0.8, WpxSvc 2.0.34, and Updater 1.0.8. (SoraKenji)

• Fix: Ensured the SQLite database connection is properly closed after every storage operation (set, del, update, all, query) and that initialization errors are propagated to callers, preventing connection leaks. (SoraKenji)

• Fix: Replaced the firewall npm dependency with direct Windows API calls via the new winsvc module for managing firewall rules, with multi-level fallback (winsvc HTTP → CLI → PowerShell). Registry set/del operations also now prefer the Windows API with reg.exe fallback. (SoraKenji)

• Fix: Registry keys are now cleaned up during full uninstallation (pre_uninstall), not only during dedicated cleanup tasks. (SoraKenji)

• Fix: Fixed the Windows anchor location storage to perform an upsert (update if already exists) instead of silently failing on duplicate entries. Invalid cached locations are now cleared on load. (SoraKenji)

• Fix: Fixed two connection leak edge cases in the storage layer: storage_fns.all and storage_fns.query were closing the SQLite connection on the success path but not on error paths. Also fixed a null dereference crash when the underlying dbComm.all callback returned (null, null), causing a TypeError reading err.code on a null value. (SoraKenji)

• Fix: Fixed a double-callback and uncaught exception risk in the Wi-Fi geo location strategy: when the server returned HTTP 429 (rate limit), execution fell through to a second checkResponse call after the cache-query block completed, and a catch block was using throw inside an async callback instead of calling back with the error. (SoraKenji)

• Fix: Fixed a double-callback during post_install on Windows where both setUpVersion and prey_user.create were invoked with the same ready callback, causing it to fire twice. (SoraKenji)

• Fix: Fixed the Windows service version cache permanently storing null on a failed first attempt, preventing retries when the service binary was not yet present on disk. (SoraKenji)

• Fix: Fixed command injection in the registry.js reg.exe fallback: path, key, and value parameters were unquoted in the shell exec string, allowing values with spaces or metacharacters to break the command or inject additional shell instructions. (SoraKenji)

• Fix: Added NaN guards before process.kill() calls in utilinformation.js, tasks/os/windows.js, and panel/index.js: a corrupt or empty pidfile returning NaN from parseInt was passed directly to process.kill, causing unpredictable behavior. (SoraKenji)

• Fix: Fixed force_new_config on Unix silently issuing kill -9 undefined when client_pid returned an error: a missing return caused execution to continue past the error log and schedule the kill command with an undefined PID. (SoraKenji)

• Fix: Converted edr_log.js to a no-op module, removing synchronous fs.appendFileSync disk writes from production code paths. (SoraKenji)

• Fix: Improved the hostname JSON guard to apply .trim() before checking the first character, preventing bypass when a stored hostname value has leading whitespace. (SoraKenji)

v1.13.35

v1.13.35 (2026-06-05)

Full Changelog

• Fix: Fixed a crash in the Wi-Fi location strategy where a server-side body error response was incorrectly propagated as a null callback argument, causing callers to receive an undefined result and crash on property access (lat, accuracy). (SoraKenji)

• Fix: Fixed coordinate validation in the location trigger to accept lat/lng values returned as strings by the geo provider, parsing and validating them against valid geographic ranges instead of rejecting them outright. (SoraKenji)

v1.13.34

v1.13.34 (2026-05-20)

Full Changelog

• Fix: Fixed a crash in hardware data collection where os.cpus() returning an empty array or undefined values in virtualized environments caused an unhandled TypeError. The agent now returns safe defaults instead. (SoraKenji)

• Fix: Fixed a crash on Windows where the Wi-Fi location strategy could return coordinates in a raw API format instead of the expected processed format, causing coords.lng.toString() to fail. Also fixed a related issue where lng=0 (prime meridian) was incorrectly treated as a missing value due to use of || instead of ??. (SoraKenji)

v1.13.33

v1.13.33 (2026-05-15)

Full Changelog

• Feat: Location methods (native, Wi-Fi, and IP-based) can now be individually disabled from the control panel. When a method is disabled, the agent automatically falls back to the next available source. (SoraKenji)

v1.13.32

v1.13.32 (2026-04-30)

Full Changelog

• Feat: New Windows location orchestration system that coordinates native and Wi-Fi location sources, with periodic validation and persistent recovery across restarts. (SoraKenji)

• Feat: Disk encryption data is now only collected and reported when the control panel explicitly requests it via backend configuration. (SoraKenji)

• Fix: Fixed a bug where a missing Wi-Fi location would cause the location strategy to fail entirely instead of falling back gracefully. (SoraKenji)

• Fix: New MacSVC 1.0.9 with a fix for screenshot capture on macOS. (SoraKenji)

• Fix: New WinSVC 2.0.33. (SoraKenji)

• Fix: On Windows, the native location source is now restricted to WinRT only, improving reliability by avoiding incompatible sources. (SoraKenji)

• Fix: Windows location orchestrator now uses a finer-grained change verification strategy instead of a broad jump-detection threshold, reducing false location updates. (SoraKenji)

• Fix: Increased the native location accuracy threshold from 100 to 200 meters for better location acceptance on Windows. (SoraKenji)

• Fix: The lock action on Windows now correctly restores the taskbar and re-applies the lock when a Fast User Switch occurs. (SoraKenji)

• Fix: The unlock password is now masked in WebSocket communication logs to avoid exposing it. (SoraKenji)

• Fix: WebSocket reconnection backoff maximum wait time was reduced to 2 minutes to recover faster after connectivity issues. (SoraKenji)

• Fix: Added timeouts to system calls (PowerShell/exec) to prevent the agent from blocking indefinitely when a command hangs. (SoraKenji)

• Fix: Prevents report gathering from stacking up when the agent is under degraded conditions (slow storage or hanging commands). (SoraKenji)

• Fix: Fixed a border case where multiple simultaneous timers could open more than one WebSocket connection for the same device. (SoraKenji)

• Fix: Fixed an error that caused the alarm action to fail silently when the device session was inactive. (SoraKenji)

v1.13.31

Merge branch 'fix/out-of-time-auto-update-macos' into 'develop'

Fix/out of time auto update macos

See merge request prey/js/prey-node-client!1391

v1.13.29

v1.13.29 (2026-04-02)

Full Changelog

• Fix: Remove undeclared variable from files in order to avoid errors in the future. (SoraKenji)

v1.13.28

v1.13.28 (2026-03-27)

Full Changelog

• Fix: Updated systeminformation library to 5.31.5 because of an error of undeclared variable. (SoraKenji)

v1.13.25

Merge branch 'develop' into 'master'

Develop

See merge request prey/js/prey-node-client!1318

v1.13.24

v1.13.24 (2026-01-09)

Full Changelog

• Fix: Fixes an issue where WebSocket connections failed to reconnect after the system woke from sleep mode. (SoraKenji)