update netbird

[fosskar]

netbird-client: 0.77.1 -> 0.78.0

Diff: netbirdio/netbird@v0.77.1...v0.78.0

netbird-dashboard: 2.91.1 -> 2.92.0

Diff: netbirdio/dashboard@v2.91.1...v2.92.0

netbird-proxy: 0.77.1 -> 0.78.0

Diff: netbirdio/netbird@v0.77.1...v0.78.0

netbird-server: 0.77.1 -> 0.78.0

Diff: netbirdio/netbird@v0.77.1...v0.78.0

netbird v0.78.0 release notes

Release Notes for v0.78.0

Highlights

• Rosenpass now works through the embedded reverse proxy (#6763). Until now the proxy ran no
  Rosenpass at all, so peers with Rosenpass enabled failed to establish through it on a PSK
  mismatch — an incompatibility that was never documented. The proxy now runs Rosenpass in
  permissive mode, so it connects both to Rosenpass-enabled peers and, exactly as before, to
  peers without it. NB_PROXY_ROSENPASS=false turns it off.
• Lazy connections reworked: per-peer lazy state, proxy peers lazy by default, and the lazy
  exclusion list removed (#6762, #6763).
• Agent Network / LLM gateway: agentgateway integration, access roles and self-service
  endpoints, Bedrock model discovery served from the control plane, guardrail allowlists for
  declared model ids, and the endpoint conformed to the LLM gateway protocol
  (#7274, #7221, #7250, #7239, #7154, #7389, #7246).
• DNS on Windows: a catch-all NRPT rule when NetBird is the primary resolver (#7071), closing
  the leak/poisoning window towards the system resolvers.
• Local Prometheus metrics endpoint on the client (#6689).
• Go 1.26 and go-quic v0.62.0 across client, relay and management (#7359).
• Unified ACL filtering for peers and routes, with multi-source rules (#6322). An internal
  refactor: no change is expected for standard deployments.
• Ukrainian localization for the desktop client (#7035).

Behaviour changes

• Remote jobs (remote debug bundle and friends) are now behind an admin opt-in, with MDM
  support (#7153). Anyone using them without the opt-in has to enable it.
• Remote debug bundle jobs accept an anonymization level and an upload URL (#7147).
• The client stays connected during the login command (#7384).
• Logging out of the active profile is allowed even when profiles are disabled (#7360).
• Profiles resolve for the invoking sudo user rather than for root (#7238).
• NetBird traffic stays out of third-party fwmark rules (#7314).
• GUI windows are created on demand and destroyed on close (#7096).
• Android split tunnelling: the mode is typed rather than stored as a string, and settings are
  kept per profile (#7387, #7349).

Security / hardening

• The cached SSH JWT is bound to the local caller that obtained it (#7378).
• The WireGuard key is no longer logged on a parse failure (#7379).
• The client asks the OS for privileges when a guarded SSH setting is changed (#7066).
• The proxy validates header auth (#7263).
• Management checks a provider's URL and credential before saving them (#7301).
• Clarified that X-Peer-ID on metrics ingest is not a credential (#7363).
• The old math/rand library is gone from management (#6836).

Client — fixes

• Fixed the ICEBind races that wedge interface creation (#7377).
• agentConnecting is dropped whenever the ICE session state clears (#7327).
• A peer offer or answer arriving before the handshaker starts listening is held rather than lost

… (truncated)

dashboard v2.92.0 release notes

What's Changed

• fix(agent-network): show real provider name in access log by @braginini in fix(agent-network): show real provider name in access log netbirdio/dashboard#758
• Show SSH enable commands with the privileges the daemon requires by @lixmal in Show SSH enable commands with the privileges the daemon requires netbirdio/dashboard#737
• fix(setup): match the v0.75 client UI in the management URL step by @braginini in fix(setup): match the v0.75 client UI in the management URL step netbirdio/dashboard#765
• feat: add required Country field to Agent Network signup form by @SunsetDrifter in feat: add required Country field to Agent Network signup form netbirdio/dashboard#766
• Load a provider's models from the vendor in the provider modal by @mlsmaycon in Load a provider's models from the vendor in the provider modal netbirdio/dashboard#767
• Keep the prices discovery returns for a loaded model by @mlsmaycon in Keep the prices discovery returns for a loaded model netbirdio/dashboard#773
• Add a workflow bumping the WASM client on netbird releases by @lixmal in Add a workflow bumping the WASM client on netbird releases netbirdio/dashboard#770
• ci: skip Docker publishing for community PRs by @jnfrati in ci: skip Docker publishing for community PRs netbirdio/dashboard#775
• Fix typo in PeerExpirationToggle component by @bomkz in Fix typo in PeerExpirationToggle component netbirdio/dashboard#665
• fix: use --restart=unless-stopped instead of --rm in Docker install command by @shaban00 in fix: use --restart=unless-stopped instead of --rm in Docker install command netbirdio/dashboard#760
• Add control center draft mode by @heisbrot in Add control center draft mode netbirdio/dashboard#744
• Detect Entra connection from auth service SSO connections by @heisbrot in Detect Entra connection from auth service SSO connections netbirdio/dashboard#776
• Add bulk deletion for Access Control groups by @TechHutTV in Add bulk deletion for Access Control groups netbirdio/dashboard#752
• Add Agent Network Admin and Usage Viewer roles, gate Agent Network per submodule by @mlsmaycon in Add Agent Network Admin and Usage Viewer roles, gate Agent Network per submodule netbirdio/dashboard#764
• feat(agent-network): add agentgateway provider support by @danehans in feat(agent-network): add agentgateway provider support netbirdio/dashboard#774
• fix(e2e): stabilize agentgateway provider test by @jnfrati in fix(e2e): stabilize agentgateway provider test netbirdio/dashboard#782
• Keep a refused provider save on screen, and its discovered prices by @mlsmaycon in Keep a refused provider save on screen, and its discovered prices netbirdio/dashboard#772
• Show peer-sourced policies in the Control Center peer view by @heisbrot in Show peer-sourced policies in the Control Center peer view netbirdio/dashboard#786
• Pin the group view's group, and give agentgateway a reachable upstream by @mlsmaycon in Pin the group view's group, and give agentgateway a reachable upstream netbirdio/dashboard#788
• Add anonymization level and upload URL to the debug bundle modal by @mlsmaycon in Add anonymization level and upload URL to the debug bundle modal netbirdio/dashboard#753

New Contributors

• @bomkz made their first contribution in Fix typo in PeerExpirationToggle component netbirdio/dashboard#665
• @shaban00 made their first contribution in fix: use --restart=unless-stopped instead of --rm in Docker install command netbirdio/dashboard#760
• @danehans made their first contribution in feat(agent-network): add agentgateway provider support netbirdio/dashboard#774

Full Changelog: netbirdio/dashboard@v2.91.1...v2.92.0