Skip to content

Releases: shellhub-io/shellhub

v0.24.2

29 Apr 19:58

Choose a tag to compare

What's Changed

  • chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.41.0 to 1.43.0 in /tests by @dependabot[bot] in #6146
  • feat(ui-react): implement announcements admin panel by @luizhf42 in #6133
  • feat(ui-react): add admin sessions list and detail pages by @luannmoreira in #6107
  • ci: remove private registry dependency from CI workflows by @gustavosbarreto in #6150
  • fix(infra): ensure postgres container restarts after host reboot by @geovannewashington in #6152
  • refactor(ui-react): unify main and admin sidebar behavior by @luizhf42 in #6151
  • chore(deps): bump axios from 1.13.6 to 1.15.0 in /ui-react by @dependabot[bot] in #6157
  • ui: bump axios from 1.14.0 to 1.15.0 in /ui by @dependabot[bot] in #6156
  • fix(cli): ensure first user created via CLI is admin by @geovannewashington in #6155
  • fix(gateway): raise WebSocket timeouts and enable TCP keepalive by @gustavosbarreto in #6158
  • chore(ci): remove verify-fix workflow by @gustavosbarreto in #6161
  • feat(agent): default transport to yamux (v2) by @gustavosbarreto in #6163
  • fix(ui-react): fix sidebar behavior when terminal is open by @luizhf42 in #6166
  • refactor(ui-react): add reusable DataTable component by @luizhf42 in #6164
  • refactor(api): remove RSA signature gate from initial setup flow by @geovannewashington in #6162
  • fix(ui-react): fix License page upload input on Chromium by @luizhf42 in #6189
  • docker: api: bump golang from 1.25.8-alpine3.22 to 1.25.9-alpine3.22 in /api by @dependabot[bot] in #6186
  • docker: cli: bump golang from 1.25.8-alpine3.22 to 1.25.9-alpine3.22 in /cli by @dependabot[bot] in #6185
  • docker: agent: bump golang from 1.25.8-alpine3.22 to 1.25.9-alpine3.22 in /agent by @dependabot[bot] in #6184
  • docker: ssh: bump golang from 1.25.8-alpine3.22 to 1.25.9-alpine3.22 in /ssh by @dependabot[bot] in #6183
  • docker: gateway: bump golang from 1.25.8-alpine3.22 to 1.25.9-alpine3.22 in /gateway by @dependabot[bot] in #6182
  • docker: ui: bump nginx from 1.29.7-alpine to 1.29.8-alpine in /ui by @dependabot[bot] in #6181
  • ui: bump typescript-eslint from 8.58.0 to 8.58.2 in /ui by @dependabot[bot] in #6180
  • refactor(ui-react): split useCopy hook into its own file by @luizhf42 in #6167
  • chore: update gliderlabs/ssh fork to fix golang.org/x/crypto v0.50.0 compatibility by @gustavosbarreto in #6193
  • ui: bump eslint-plugin-jest from 29.15.1 to 29.15.2 in /ui by @dependabot[bot] in #6171
  • ssh: bump golang.org/x/net from 0.52.0 to 0.53.0 in /ssh by @dependabot[bot] in #6170
  • api: bump github.com/getkin/kin-openapi from 0.134.0 to 0.135.0 in /api by @dependabot[bot] in #6177
  • api: bump golang.org/x/crypto from 0.49.0 to 0.50.0 in /api by @dependabot[bot] in #6178
  • ui: bump follow-redirects from 1.15.11 to 1.16.0 in /ui by @dependabot[bot] in #6192
  • agent: bump github.com/mattn/go-shellwords from 1.0.12 to 1.0.13 in /agent by @dependabot[bot] in #6172
  • api: bump github.com/testcontainers/testcontainers-go/modules/postgres from 0.41.0 to 0.42.0 in /api by @dependabot[bot] in #6179
  • api: bump github.com/getsentry/sentry-go from 0.44.1 to 0.45.1 in /api by @dependabot[bot] in #6175
  • chore(deps): bump actions/github-script from 8 to 9 by @dependabot[bot] in #6188
  • chore(deps): bump softprops/action-gh-release from 2 to 3 by @dependabot[bot] in #6187
  • fix(ui-react): clear query cache on logout to drop stale user data by @luizhf42 in #6194
  • fix(ui-react): surface swallowed errors in ConfirmDialog delete flows by @luizhf42 in #6168
  • chore(deps): migrate dependabot from ui to ui-react by @luizhf42 in #6198
  • feat(cli): add type column to namespace list output by @geovannewashington in #6197
  • docker: ui-react: bump node from 24.13.0-alpine3.22 to 24.15.0-alpine3.22 in /ui-react by @dependabot[bot] in #6207
  • ui-react: bump @types/node from 25.5.0 to 25.6.0 in /ui-react by @dependabot[bot] in #6209
  • ui-react: bump @hey-api/openapi-ts from 0.94.3 to 0.94.5 in /ui-react by @dependabot[bot] in #6210
  • ui-react: bump typescript-eslint from 8.57.0 to 8.58.2 in /ui-react by @dependabot[bot] in #6211
  • ui-react: bump vitest from 4.1.0 to 4.1.4 in /ui-react by @dependabot[bot] in #6208
  • ssh: bump github.com/pires/go-proxyproto from 0.11.0 to 0.12.0 in /ssh by @dependabot[bot] in #6206
  • ui-react: bump @tiptap/markdown from 3.22.2 to 3.22.3 in /ui-react by @dependabot[bot] in #6205
  • api: bump github.com/testcontainers/testcontainers-go/modules/mongodb from 0.41.0 to 0.42.0 in /api by @dependabot[bot] in #6204
  • docker: ssh: bump alpine from 3.23.3 to 3.23.4 in /ssh by @dependabot[bot] in #6203
  • docker: gateway: bump alpine from 3.23.3 to 3.23.4 in /gateway by @dependabot[bot] in #6200
  • docker: api: bump alpine from 3.23.3 to 3.23.4 in /api by @dependabot[bot] in #6202
  • docker: ui-react: bump nginx from 1.29.4-alpine to 1.29.8-alpine in /ui-react by @dependabot[bot] in #6201
  • docker: cli: bump alpine from 3.23.3 to 3.23.4 in /cli by @dependabot[bot] in #6199
  • chore(ui-react): remove deprecated baseUrl from ui-react's tsconfig.json by @luizhf42 in #6212
  • refactor(ui-react): use @ import alias by @luizhf42 in #6213
  • fix(openapi): align tag name pattern with backend validation by @luizhf42 in #6216
  • ui-react: bump postcss from 8.5.8 to 8.5.10 in /ui-react by @dependabot[bot] in #6225
  • ui-react: bump axios from 1.15.0 to 1.15.1 in /ui-react by @dependabot[bot] in #6224
  • ui-react: bump @tiptap/react from 3.22.2 to 3.22.4 in /ui-react by @dependabot[bot] in #6221
  • ui-react: bump autoprefixer from 10.4.27 to 10.5.0 in /ui-react by @dependabot[bot] in #6223
  • chore(deps): bump actions/setup-node from 6.3.0 to 6.4.0 by @dependabot[bot] in #6220
  • api: bump github.com/labstack/gommon from 0.4.2 to 0.5.0 in /api by @dependabot[bot] in #6219
  • api: bump github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2 in /api by @dependabot[bot] in #6217
  • fix(api): expose internal namespace lookup for SSH service by @gustavosbarreto in #6228
  • fix(api): let admin panel through RequiresTenant guard by @gustavosbarreto in #6229
  • feat(ui-react): add Containers page and components by @luizhf42 in #6214
  • feat(ui-react): add team invitations feature by @luizhf42 in #6191
  • ui-react: bump typescript-eslint from 8.58.2 to 8.59.0 in /ui-react by @dependabot[bot] in #6222
  • fix(ui-react): fix lint error in ContainerTagsPopover test by @luizhf42 in #6231
  • api: bump github.com/moby/moby/api from 1.54.1 to 1.54.2 in /api by @dependabot[bot] in #6218
  • docs(api): remove status field from namespace member schema by @geovannewashington in #6230
  • feat(ui): add SAML SSO login and admin authentication settings by @luannmoreira in #6196
  • test: optimize healthchecks and force image rebuild by @gustavosbarreto in #6234
  • fix(ui-react): make sidebar p...
Read more

v0.21.7

23 Apr 02:43

Choose a tag to compare

Security

Fixes four cross-tenant and input-validation advisories:

  • GHSA-vwx9-7qcf-gg7f — cross-tenant IDOR on namespace endpoints reachable via API Key and JWT callers, allowing a caller to read, edit, delete or toggle session recording of a namespace they are not scoped to, and to enumerate namespaces across tenants on the list endpoint. (initially fixed in v0.21.6)
  • GHSA-j72x-xfwg-783fGET /api/devices/:uid returned the full device object for any authenticated caller, allowing cross-tenant disclosure of device metadata (hostname, MAC, OS, public key, remote address, last-seen).
  • GHSA-9w9c-9w8m-w89qGET /api/sessions/:uid returned the full session object for any authenticated caller, allowing cross-tenant disclosure of SSH session data (username, device UID, remote IP, authentication state, timestamps).
  • GHSA-47r2-v3x6-wff9 — filter and sort query parameters on the device list accepted attacker-controlled identifiers as BSON keys, enabling HTTP 500 crash-DoS and blind regex extraction via $regex values.

Full Changelog: v0.21.6...v0.21.7

v0.21.6

23 Apr 02:43

Choose a tag to compare

Security

Fixes GHSA-vwx9-7qcf-gg7f — cross-tenant IDOR on namespace endpoints reachable via API Key and JWT callers, allowing a caller to read, edit, delete or toggle session recording of a namespace they are not scoped to, and to enumerate namespaces across tenants on the list endpoint. Reported by @Edu0x01.

What's Changed

Full Changelog: v0.21.5...v0.21.6

v0.24.1

08 Apr 19:38

Choose a tag to compare

What's Changed

Full Changelog: v0.24.0...v0.24.1

v0.24.0

01 Apr 22:17

Choose a tag to compare

PostgreSQL as Default Database

PostgreSQL is now the default and only supported database backend. MongoDB is no longer required.

If upgrading from v0.22.x or earlier, upgrade to v0.23.0 first to run the automatic migration pipeline, then upgrade to v0.24.0. See the migration guide for details.

v0.23.0

01 Apr 19:50

Choose a tag to compare

Database Migration (MongoDB to PostgreSQL)

This release introduces the automatic migration pipeline from MongoDB to PostgreSQL. On startup, ShellHub reads all data from MongoDB, writes it to PostgreSQL, and runs a deep field-by-field validation to ensure data integrity.

Set SHELLHUB_DATABASE=migrate in your .env to enable the migration. The migration status is exposed via GET /api/migration/status and shown in the UI.

The next release (v0.24.0) will switch the default database to PostgreSQL, completing the transition.

New React UI

The new admin interface built with React is now available alongside the existing Vue UI:

  • Generated API SDK with TanStack Query, replacing the Axios/Zustand layer
  • Role-based permission system
  • Admin panel with dashboard and license management
  • Session recording playback
  • Password recovery, sign-up, and account confirmation flows
  • Two-factor authentication (TOTP)
  • Connect-via-terminal UX improvements

CLI

  • New user list command
  • TTY allocation is now disabled when stdout is not a terminal

Infrastructure

  • Go 1.25.8
  • golangci-lint v2.11.3
  • Decoupled enterprise entry point from community module
  • SAML types removed from core models

v0.22.0

10 Mar 00:36

Choose a tag to compare

ShellHub v0.22.0

The React Release

v0.22.0 is the biggest frontend change in ShellHub's history. The entire UI has been rebuilt from scratch in React with TypeScript, replacing the Vue-based frontend that served the project for years. This release also lays the groundwork for the upcoming PostgreSQL migration.

For the full story behind these changes, see Inside ShellHub #1.

ShellHub v0.22.0 React UI

New React UI

The new frontend ships as the default at /. The legacy Vue UI remains accessible at /v1 during the transition period.

Highlights compared to the previous frontend:

  • No more Vuetify lock-in. The new UI uses Tailwind CSS with a custom design system, giving full control over styling without fighting a component library.
  • Multi-session terminal. The old terminal opened one SSH session in a modal. The new one supports multiple concurrent sessions with a taskbar — minimize, restore, and fullscreen.
  • Secure Vault. Store encrypted SSH private keys in the browser for password-protected key authentication directly from the web terminal.
  • Welcome wizard. A guided onboarding flow for new users after account creation.
  • Better error handling. Connection failures, expired sessions, and network drops show inline banners with clear messages instead of silently failing.

Unified Open-Core Architecture

The Cloud/Enterprise layer has been merged into the API binary. Instead of running a separate service, enterprise features are now compiled into the same binary and activated by configuration. This simplifies deployment, eliminates inter-service calls, and makes transactions across community and enterprise code truly atomic.

Agent Improvements

  • Yamux multiplexing. The agent now uses multistream and yamux instead of an HTTP server for device communication, improving reliability and reducing overhead.
  • Native static binary. Replaced the standalone runc dependency with a native static binary, simplifying agent distribution.
  • PTY deadlock fix. Resolved a window-change deadlock that could freeze terminal sessions under load.
  • ARMv6 support fix. Corrected architecture targeting for ARMv6 devices.

Infrastructure

  • ACME-DNS support for web endpoint wildcard certificates — an alternative to DigitalOcean and Cloudflare DNS providers.
  • MongoDB → PostgreSQL migration tooling is included in this release as groundwork for the v0.23.0 transition. Not yet active by default.
  • Generic store test suite that validates both MongoDB and PostgreSQL implementations against the same test cases.

Bug Fixes

  • Fixed namespace device counter cache discrepancies
  • Fixed license device limit enforcement
  • Fixed recovery email conflict check against empty strings
  • Fixed trailing comma in agent config.json env array
  • Improved web terminal error handling and reconnection

Updated Stack

  • Go 1.24.13
  • Node.js 24 (LTS)
  • Alpine 3.22

New Contributors


Full Changelog: v0.21.5...v0.22.0

v0.21.5

07 Jan 18:15

Choose a tag to compare

What's Changed

Full Changelog: v0.21.4...v0.21.5

v0.21.4

02 Jan 19:50

Choose a tag to compare

What's Changed

  • ui: bump vuetify from 3.11.0 to 3.11.2 in /ui by @dependabot[bot] in #5602
  • ui: bump typescript-eslint from 8.48.0 to 8.48.1 in /ui by @dependabot[bot] in #5596
  • fix(ui): fix MemberInvite's email label spacing by @luizhf42 in #5608
  • chore(deps): bump actions/setup-node from 6.0.0 to 6.1.0 by @dependabot[bot] in #5607
  • cli: bump github.com/spf13/cobra from 1.10.1 to 1.10.2 in /cli by @dependabot[bot] in #5601
  • ui: bump express from 4.21.2 to 4.22.1 in /ui by @dependabot[bot] in #5599
  • agent: bump github.com/spf13/cobra from 1.10.1 to 1.10.2 in /agent by @dependabot[bot] in #5597
  • api: bump github.com/spf13/cobra from 1.10.1 to 1.10.2 in /api by @dependabot[bot] in #5598
  • docker: api: bump alpine from 3.22.2 to 3.23.0 in /api by @dependabot[bot] in #5606
  • docker: ssh: bump alpine from 3.22.2 to 3.23.0 in /ssh by @dependabot[bot] in #5605
  • docker: cli: bump alpine from 3.22.2 to 3.23.0 in /cli by @dependabot[bot] in #5604
  • docker: gateway: bump alpine from 3.22.2 to 3.23.0 in /gateway by @dependabot[bot] in #5603
  • feat(ui): show namespace type in SettingNamespace component by @luizhf42 in #5609
  • ui: bump vue-tsc from 3.1.5 to 3.1.7 in /ui by @dependabot[bot] in #5600
  • fix(ui): fix SettingTags behavior with no tags in list by @luizhf42 in #5610
  • fix(ui): correct admin table background and improve test selectors by @luannmoreira in #5586
  • fix(ui): items-per-page input handling only on blur DataTable by @luannmoreira in #5612
  • feat(agent): add support for optional environment variables in install.sh by @gustavosbarreto in #5613
  • feat(ui): add new Tags view separate from Settings by @luizhf42 in #5611
  • refactor(ui): improve terminal connection UI and add SSHID helper by @gustavosbarreto in #5614
  • fix(ui): enable TagSelector even when namespace has no tags by @luizhf42 in #5615
  • refactor(ui): add settings button to namespace switcher by @gustavosbarreto in #5617
  • refactor(ui): remove stats store usage from device UI components by @luannmoreira in #5590
  • fix(api): support X-Tenant-ID header in tag requests by @heiytor in #5618
  • refactor(ui): refactor Tags API wrapper and store by @luizhf42 in #5616
  • refactor(ui): simplify and validate items-per-page input handling by @luannmoreira in #5619
  • fix(ui): fix Connection Announcement edit dialog by @luizhf42 in #5621
  • fix(ui): fix SSHID Helper related issues by @luizhf42 in #5620
  • agent: bump golang.org/x/sys from 0.38.0 to 0.39.0 in /agent by @dependabot[bot] in #5627
  • ssh: bump github.com/labstack/echo/v4 from 4.13.4 to 4.14.0 in /ssh by @dependabot[bot] in #5631
  • ui: bump asciinema-player from 3.12.1 to 3.13.4 in /ui by @dependabot[bot] in #5635
  • ui: bump typescript-eslint from 8.48.1 to 8.49.0 in /ui by @dependabot[bot] in #5636
  • docker: ui: bump nginx from 1.29.3-alpine to 1.29.4-alpine in /ui by @dependabot[bot] in #5637
  • api: bump golang.org/x/crypto from 0.45.0 to 0.46.0 in /api by @dependabot[bot] in #5634
  • ui: bump eslint-plugin-jest from 29.2.1 to 29.5.0 in /ui by @dependabot[bot] in #5640
  • feat(ui): add "Add Private Key" button to TerminalLoginForm's select by @luizhf42 in #5622
  • test(ui): add API mocks to DevicesDropdown tests by @luizhf42 in #5624
  • refactor(ui): move hasNamespaces computed to namespaces store by @luizhf42 in #5623
  • ui: bump sass from 1.94.2 to 1.96.0 in /ui by @dependabot[bot] in #5639
  • ui: bump vuetify from 3.11.2 to 3.11.3 in /ui by @dependabot[bot] in #5638
  • bump(ui): revert Node.js LTS version bump by @luizhf42 in #5644
  • chore(deps): bump actions/upload-artifact from 5 to 6 by @dependabot[bot] in #5643
  • chore(deps): bump actions/cache from 3 to 5 by @dependabot[bot] in #5642
  • chore(deps): bump actions/download-artifact from 6 to 7 by @dependabot[bot] in #5641
  • agent: bump golang.org/x/crypto from 0.45.0 to 0.46.0 in /agent by @dependabot[bot] in #5630
  • agent: bump github.com/labstack/echo/v4 from 4.13.4 to 4.14.0 in /agent by @dependabot[bot] in #5628
  • api: bump github.com/labstack/echo/v4 from 4.13.4 to 4.14.0 in /api by @dependabot[bot] in #5632
  • refactor(api): migrate membership invitations to a dedicated collection by @heiytor in #5532
  • feat(ui): implement new invitations menu, view, dialogs and management system by @luizhf42 in #5585
  • feat(ui): add items per page persistence to DataTable by @luizhf42 in #5646
  • test(ui): update InvitationList snapshot by @luizhf42 in #5645
  • feat(ui): create PageHeader component and refactor views by @gustavosbarreto in #5647
  • fix(ui): suppress Sass legacy JS API deprecation warnings by @gustavosbarreto in #5648
  • feat(ui): add FormBricks survey to setup wizard flow by @gustavosbarreto in #5649
  • test(ui): add @pinia/testing and mount helper for tests by @luizhf42 in #5650
  • feat(ui): add Rename Device button to accepted devices list by @luizhf42 in #5651
  • feat(ui): use PageHeader in TeamInvitations view by @luizhf42 in #5652
  • fix(ui): replace text-white with theme-safe emphasis colors by @luannmoreira in #5653
  • fix(ui): standardize WebEndpoints search bar placement by @luannmoreira in #5654
  • feat(ui): add onboarding survey to setup wizard by @gustavosbarreto in #5656
  • test(ui): improve AppLayout tests by @luizhf42 in #5655
  • refactor(ui): replace page titles in admin with PageHeader component by @luannmoreira in #5658
  • docker: api: bump alpine from 3.23.0 to 3.23.2 in /api by @dependabot[bot] in #5668
  • docker: cli: bump alpine from 3.23.0 to 3.23.2 in /cli by @dependabot[bot] in #5667
  • ui: bump vue-tsc from 3.1.8 to 3.2.1 in /ui by @dependabot[bot] in #5665
  • docker: gateway: bump alpine from 3.23.0 to 3.23.2 in /gateway by @dependabot[bot] in #5664
  • ui: bump @vue/runtime-dom from 3.5.25 to 3.5.26 in /ui by @dependabot[bot] in #5663
  • ui: bump eslint from 9.39.1 to 9.39.2 in /ui by @dependabot[bot] in #5662
  • ui: bump vue-router from 4.6.3 to 4.6.4 in /ui by @dependabot[bot] in #5660
  • fix(api): preserve null values for unique indexed fields in UserUpdate by @heiytor in #5670
  • refactor(ui): improve session play button and active status display by @luannmoreira in #5659
  • fix(tests): support testcontainers in Docker-in-Docker environment by @gustavosbarreto in #5671
  • ui: bump typescript-eslint from 8.49.0 to 8.50.1 in /ui by @dependabot[bot] in #5676
  • ui: bump sass from 1.96.0 to 1.97.1 in /ui by @dependabot[bot] in #5675
  • ui: bump eslint-plugin-jest from 29.5.0 to 29.11.1 in /ui by @dependabot[bot] in #5674
  • ui: bump vuetify from 3.11.3 to 3.11.5 in /ui by @dependabot[bot] in #5673
  • ui: bump asciinema-player from 3.13.4 to 3.13.5 in /u...
Read more

v0.21.3

05 Dec 14:58

Choose a tag to compare

What's Changed

Full Changelog: v0.21.2...v0.21.3