Version 2.0.1

• Orchestrator firmware upgrades, including scheduling and cancelling a scheduled upgrade, are now recorded in the audit log

• Removed the distrusted emSign ECC Root CA - G3 and Comodo AAA Services root certificates from the firmware and iOS app trust stores
• Fixed installing or upgrading the Windows client or agent on Windows Server, which failed and could leave no version of the client or agent installed
• Fixed Windows client and agent upgrades that could leave the BlastShield service uninstalled when another program, such as an EDR or monitoring agent, held a handle to it
• Fixed the title bar of the macOS client on Intel Macs hiding the logo, the menu and the Disconnect button
• Fixed device enrollments timing out and creating duplicate devices when many clients enroll at once, such as after upgrading to 2.0
• Clients no longer list endpoints behind gateways that have never registered in the Resources view, and show HA gateway groups by name instead of by ID
• Fixed adding and removing agents through the group users API used by earlier versions

Version 2.0.0

• Users can now have multiple devices. Each device enrolls separately and can be approved, rejected or disconnected by an administrator from the new device list.
• Added device security postures that policies can be restricted to, based on device attributes such as OS version, secure boot and key storage. Devices can also be pinned to specific postures.
• Added a post-quantum (ML-KEM-768) hybrid key exchange for all tunnels. Administrators can require it for the whole network in the Network Settings, which disconnects nodes running a release older than 2.0.
• Added a self-isolation mode for Linux and Windows agents that blocks all inbound connections except those arriving through BlastShield
• The desktop, Android and iOS clients now show the resources the user's policies give access to
• BlastAccess: chat between the user at the remote computer and the connected BlastAccess users, controlled by a new chat permission
• BlastAccess: the remote desktop now switches between video and bitmap updates as needed, with hardware video encoding where available, giving smoother motion and sharper still images
• BlastAccess: remote desktop sessions are usable on phones and tablets, with touch gestures and a soft keyboard. Sessions launched from the Android and iOS apps open inside the app.
• BlastAccess: remote desktop sessions are now supported in Safari 26 and later
• BlastAccess: added a zoom/1:1 display mode in fullscreen sessions and a redesigned session view
• Added the reset-user-authentication command to the orchestrator CLI
• The endpoint import now accepts multiple DNS names per endpoint
• Removed the proxy feature

• Fixed gateway modems failing with a missing SIM card when the card is in another SIM slot

Version 1.14.4

• Support for shadowing the uplink default route address with the endpoint interface address
• Support for FIDO2 SmartCards in the Windows and macOS clients

• Fixed various memory leaks in bs-orchestratord

Version 1.14.3

• Fixed a packet buffer leak on gateways that could occur under high traffic load while hair-pinning packets.
• Fixed premature packet drops on gateways under heavy bi-directional traffic.
• Fixed an issue on container gateways where large TCP transfers could be truncated when the sender closed the connection immediately after its final write.
• Fixed an issue where the orchestrator could stop propagating peer updates to connected nodes, requiring a restart of bs-orchestratord to recover.

Version 1.14.2

• Fixed Linux kernel panic bug triggered on gateways with multiple endpoint interfaces.
• Fixed an issue where the firmware upgrade progress bar could fail to reset after a Gateway firmware upgrade.

Version 1.14.1

• Optimized orchestrator web app for mobile/tablet devices
• You can now connect to a remote desktop without controls (view-only) and set your preferred default connect mode.

• Connecting to a remote desktop running a 1.13.x blastaccess agent didn't work when the "Printer" permission was issued.
• On some devices the Windows desktop client would shut down if the main window was closed.

Version 1.14.0

• Added session recording for BlastAccess remote desktop sessions, with a playback UI, per-user permissions and storage on an external storage backend.
• Added local printer redirection for BlastAccess remote desktop sessions, allowing documents to be printed from the remote desktop to the user's local printer.
• Added external storage (S3 and SSH) support to the orchestrator, for storing session recordings and connection log files.
• Added support for persisting connection logs to external storage as compact CBOR-sequence files with zstd compression. The data is exposed through two new public API endpoints for listing and fetching files.
• Added support for scheduling firmware upgrades of orchestrators, gateways and agents from the orchestrator UI.
• Added support for configuring multiple syslog receivers.
• Added a configurable session authentication grace period that allows skipping FIDO/authenticator re-authentication within a window after the last successful authentication.
• Added a user-selectable timezone display mode (Local/UTC) for timestamps shown in the orchestrator UI.
• Added a new filter bar to the endpoint, node, group, policy, service, egress policy and proxy list views in the orchestrator UI.
• Updated all BlastShield user interfaces — platform clients and SSO sign-in page — with a refreshed, unified visual design.

• BlastAccess: assorted hardening, stability and usability improvements to the agent and remote desktop experience.
• Fixed a resize loop in the gateway console terminal component in the orchestrator UI.