What gravitl/netmaker shipped
Written by FoxPlug from the repository's own releases; not affiliated with Netmaker. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/gravitl/netmaker; Netmaker did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 26, 2026
What shipped
- Reject host-password JWTs for user-owned devices; AuthorizeHost now accepts a user session plus X-Host-ID instead. Pull request #4212
- Pre-release fixes for v1.8.0. Pull request #4210
- Enrich topology and connections with location,
is_gw, and egresses. Pull request #4211 - Auto relay CPU usage improvements. Pull request #4201
- Add an API to list auto relayed peers for a node. Pull request #4208
Why it matters
This week brings security and performance updates for Netmaker: host authentication now rejects host-password JWTs for user-owned devices, and auto relay CPU usage is improved. Topology and connection data is enriched with location, gateway status, and egress information, and a new API lists auto relayed peers for a node. These changes help developers secure device access, reduce CPU load from auto relay, and gain more detailed network visibility.
Changelog entry
- Reject host-password JWTs for user-owned devices; AuthorizeHost now accepts a user session plus X-Host-ID. Pull request #4212
- Pre-release fixes for v1.8.0. Pull request #4210
- Enrich topology and connections with location,
is_gw, and egresses. Pull request #4211 - Auto relay CPU usage improvements. Pull request #4201
- Add API to list auto relayed peers for a node. Pull request #4208
This week: host auth now rejects host-password JWTs for user-owned devices, topology and connections include location, is_gw, and egresses, auto relay CPU usage is improved, and a new API lists auto relayed peers for a node. Pre-release fixes for v1.8.0 also landed.
This week in Netmaker: - Host authentication now rejects host-password JWTs for user-owned devices; AuthorizeHost accepts a user session plus X-Host-ID instead. - Topology and connections are enriched with location, is_gw, and egresses. - Auto relay CPU usage is improved. - A new API lists auto relayed peers for a node. - Pre-release fixes for v1.8.0 are included. These updates improve security, performance, and visibility for developers using Netmaker.
Week of October 19, 2026
What shipped
- Release v1.7.0 was prepared for the project. Pull request #4190
- User groups are now loaded via membership when expanding ACLs, so user-group ACL policies can match instead of seeing an empty group map. Pull request #4206
- Selecting an exit node now replaces an existing relay instead of being rejected when the device was already relayed by another gateway. Pull request #4195
- Disabling or deleting user accounts now sends a force logout and cleans up the user's devices. Pull request #4199
- AllowAll is kept when both default ACL policies are open. Pull request #4200
- A username filter was added to the nodes API. Pull request #4198
- Email usernames are now stored in lower case. Pull request #4194
- Email addresses are lower-cased when checking invites. Pull request #4191
- The AES key is now derived using ECDH. Pull request #4192
- Auto select gateway was fixed. Pull request #4176
Why it matters
This week brought the v1.7.0 release plus fixes that affect access control and device behavior. Users with user-group ACL policies should see those policies actually apply, and changes to exit node selection, forced logout on disabled or deleted accounts, and lower-cased email handling make day-to-day administration more predictable.
Changelog entry
- Release v1.7.0. Pull request #4190
- Load user groups via membership for ACL expansion so user-group ACL policies match. Pull request #4206
- Allow exit-node selection to replace an existing relay. Pull request #4195
- Send force logout on disabling or deleting user accounts and clean up user devices. Pull request #4199
- Keep AllowAll when both default ACL policies are open. Pull request #4200
- Add username filter to nodes API. Pull request #4198
- Ensure email usernames are lower-case. Pull request #4194
- Lower-case emails when checking invites. Pull request #4191
- Derive AES key using ECDH. Pull request #4192
- Fix auto select gateway. Pull request #4176
- Pre-release v1.8.0 fixes. Pull request #4197
- Merge v1.7.0 develop. Pull request #4193
Netmaker v1.7.0 is out. This week also fixed user-group ACL expansion so those policies match, let exit node selection replace an existing relay, and added force logout with device cleanup when accounts are disabled or deleted. Nodes API gained a username filter.
Netmaker v1.7.0 has been released. Alongside it, this week's changes include a fix to ACL expansion so user-group ACL policies match: user groups are now loaded via membership rather than an empty group map. Selecting an exit node now replaces an existing relay instead of being rejected when the device was already relayed by another gateway. Disabling or deleting a user account now sends a force logout and cleans up that user's devices. The nodes API also gained a username filter, and email usernames and invite checks now use lower case.
Week of October 12, 2026
What shipped
- IP Address Management was added via NM-360. Pull request #4159
- Exit node device APIs were added under NM-356. Pull request #4145
- Graph APIs were added. Pull request #4179
- A bulk API for extclients was added and extclient creation was optimized. Pull request #4184
- NM-383 added extclient schema migration and listing of network nodes with host. Pull request #4160
- Key scoping was removed as part of NM-383. Pull request #4161
- NM-362 added fallback matching of Wazuh agents by agent name (host UUID, then hostname with endpoint IP) instead of board serial. Pull request #4116
- Security bug fixes landed in NM-378. Pull request #4114
- Organization IDP integration was added. Pull request #4154
- Retrieving an external client now uses the network parameter, fixing issue 3875. Pull request #4153
Why it matters
This week adds several APIs developers can build against, covering exit node devices, graphs and bulk extclient creation, alongside IP address management. It also removes key scoping and brings extclient schema migration, so client and key handling change for existing setups. Security fixes, an organization IDP integration and a fix for retrieving external clients by network make the release relevant to anyone running networks with external clients.
Changelog entry
- Add IP Address Management (NM-360). Pull request #4159
- Add exit node device APIs (NM-356). Pull request #4145
- Add graph APIs. Pull request #4179
- Add bulk API for extclients and optimize extclient creation. Pull request #4184
- Add extclient schema migration and network nodes listing with host (NM-383). Pull request #4160
- Remove key scoping (NM-383). Pull request #4161
- Match Wazuh agents by host UUID then hostname with endpoint IP instead of board serial (NM-362). Pull request #4116
- Apply security bug fixes (NM-378). Pull request #4114
- Add organization IDP integration. Pull request #4154
- Use the network parameter when retrieving an external client, fixing issue 3875. Pull request #4153
- Add graceful shutdown handling and panic recovery for the database. Pull request #4173
- Replace goto with a loop for HTTP 401 retries. Pull request #4157
This week in Netmaker: IP address management, exit node device APIs, graph APIs, a bulk extclient API, extclient schema migration, removal of key scoping, Wazuh agent fallback matching and security bug fixes.
This week in Netmaker: IP address management was added, along with APIs for exit node devices, graphs and bulk extclient creation. Extclients get a schema migration and faster creation, and key scoping was removed. Wazuh agents can now be matched by agent name using host UUID, then hostname with endpoint IP, instead of board serial. Security bug fixes, organization IDP integration and a fix to use the network parameter when retrieving external clients are also included.
More from gravitl/netmaker on GitHub
Merged pull requests
- Master (#4156, merged September 23, 2026 by abhishek9686) (source)
- Release v1.7.0 (#4155, merged September 23, 2026 by abhishek9686) (source)
- Patch: License Validation and Management (#4152, merged September 23, 2026 by VishalDalwadi) (source)
- Master (#4150, merged September 17, 2026 by abhishek9686) (source)
- Release v1.7.0 (#4149, merged September 17, 2026 by abhishek9686) (source)
- NM-386: allow Windows internet egress and reject virtual NAT on Windows (#4142, merged September 17, 2026 by abhishek9686) (source)
- Security Fixes (#4147, merged September 15, 2026 by VishalDalwadi) (source)
- v1.7.0: fix: do not auto-assign exit node from ACL access (#4146, merged September 9, 2026 by abhishek9686) (source)
- Master (#4144, merged September 9, 2026 by abhishek9686) (source)
- Release v1.7.0 (#4140, merged September 9, 2026 by abhishek9686) (source)
- v1.7.0: speed up /api/nodes on SQLite and harden DB under load (#4139, merged September 8, 2026 by abhishek9686) (source)
- Fixes release v1.7.0 (#4138, merged September 4, 2026 by VishalDalwadi) (source)
- NM-356: mark extclients offline when their ingress gateway is unreachable (#4213, merged November 6, 2026 by abhishek9686) (source)
- Pre-Release Fixes v1.8.0 (#4217, merged November 5, 2026 by VishalDalwadi) (source)
- Pre-Release Fixes v1.8.0 (#4216, merged November 3, 2026 by VishalDalwadi) (source)
- NM-356: network-role API access and user-device host auth , Reject host-password JWTs for user-owned devices; AuthorizeHost accepts a user session plus X-Host-ID instead. (#4212, merged October 30, 2026 by abhishek9686) (source)
- Pre-Release Fixes v1.8.0 (#4210, merged October 30, 2026 by VishalDalwadi) (source)
- NM-356: enrich topology and connections with location,
is_gw, and egresses (#4211, merged October 30, 2026 by abhishek9686) (source) - Auto Relay CPU Usage Improvements (#4201, merged October 30, 2026 by VishalDalwadi) (source)
- List Auto Relayed Peers for a Node API (#4208, merged October 29, 2026 by VishalDalwadi) (source)
- v1.7.0: fix: load user groups via membership for ACL expansion (#4206, merged October 25, 2026 by abhishek9686) (source)
- NM-356: keep AllowAll when both default ACL policies are open (#4200, merged October 25, 2026 by abhishek9686) (source)
- Fixes: Pre-Release v1.8.0 (#4197, merged October 23, 2026 by VishalDalwadi) (source)
- NM-356: send force logout on disabling/deleting user accounts and cleanup user devices (#4199, merged October 22, 2026 by abhishek9686) (source)