AdGuard Home v0.108.0-b.59

Changes compared to the previous beta, v0.108.0-b.58. See CHANGELOG.md for all changes.

Acknowledgments

A special thanks to our open-source contributor @GnatorX, our community moderators team, as well as to everyone who filed and inspected issues, added translations, and helped us test this release!

Full changelog

Security

• AdGuard Home now properly sets permissions to its files and directories on Windows (#7314).

Changed

• Improved filtering performance (#6818).

Fixed

• Repetitive statistics log messages (#7338).
• Custom client cache (#7250).
• Missing runtime clients with information from the system hosts file on first AdGuard Home start (#7315).

AdGuard Home v0.107.53

It's been a while since we postponed the next AdGuard Home update for a few months. But of course, we had a good reason for it: with the help of community members (we are very thankful to you! 🙏), we discovered two vulnerabilities and have been working on patching them. Testing the solutions took a bit longer than expected, but in the end, we believe in quality over speed.

Luckily, it's not all patching vulnerabilities and fixing bugs; we've made some improvements, too. For example, we've added support for 64-bit RISC-V architecture and Ecosia search engine to Safe Search. Find the complete changelog below.

Acknowledgments

A special thanks to our open-source contributor, @javabean, to @itz-d0dgy and @go-compile for reporting the vulnerabilities, our community moderators team, as well as to everyone who filed and inspected issues, added translations, and helped us test this release!

Full changelog

Security

• Previous versions of AdGuard Home allowed users to add any system file it had access to as filters, exposing them to be world-readable. To prevent this, AdGuard Home now allows adding filtering-rule list files only from files matching the patterns enumerated in the filtering.safe_fs_patterns property in the configuration file.

  We thank @itz-d0dgy for reporting this vulnerability, designated CVE-2024-36814, to us.

• Additionally, AdGuard Home will now try to change the permissions of its files and directories to more restrictive ones to prevent similar vulnerabilities as well as limit the access to the configuration.

  We thank @go-compile for reporting this vulnerability, designated CVE-2024-36586, to us.

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.23.2.

Added

• Support for 64-bit RISC-V architecture (#5704).
• Ecosia search engine is now supported in safe search (#5009).

Changed

• Upstream server URL domain names requirements has been relaxed and now follow the same rules as their domain specifications.

Configuration changes

In this release, the schema version has changed from 28 to 29.

• The new array filtering.safe_fs_patterns contains glob patterns for paths of files that can be added as local filtering-rule lists. The migration should add list files that have already been added, as well as the default value, $DATA_DIR/userfilters/*.

Fixed

• Property clients.runtime_sources.dhcp in the configuration file not taking effect.
• Stale Google safe search domains list (#7155).
• Bing safe search from Edge sidebar (#7154).
• Text overflow on the query log page (#7119).

Known issues

• Due to the complexity of the Windows permissions architecture and poor support from the standard Go library, we have to postpone the proper automated Windows fix until the next release.

  Temporary workaround: Set the permissions of the AdGuardHome directory to more restrictive ones manually. To do that:

  1. Locate the AdGuardHome directory.
  2. Right-click on it and navigate to Properties → Security → Advanced.
  3. (You might need to disable permission inheritance to make them more restricted.)
  4. Adjust to give the Full control access to only the user which runs AdGuard Home. Typically, Administrator.

  An example of a what a properly restricted configuration could look like:

  

AdGuard Home v0.108.0-b.58

Changes compared to the previous beta, v0.108.0-b.57. See CHANGELOG.md for all changes.

Security

• Previous versions of AdGuard Home allowed users to add any system it had access to as filters, exposing them to be world-readable. To prevent this, AdGuard Home now allows adding filtering-rule list files only from files matching the patterns enumerated in the filtering.safe_fs_patterns property in the configuration file.

  We thank @itz-d0dgy for reporting this vulnerability, designated CVE-2024-36814, to us.

• Additionally, AdGuard Home will now try to change the permissions of its files and directories to more restrictive ones to prevent similar vulnerabilities as well as limit the access to the configuration.

  We thank @go-compile for reporting this vulnerability, designated CVE-2024-36586, to us.

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.23.2.

Added

• Support for 64-bit RISC-V architecture (#5704).
• Ecosia search engine is now supported in safe search (#5009).

Changed

• Upstream server URL domain names requirements has been relaxed and now follow the same rules as their domain specifications.

Configuration changes

In this release, the schema version has changed from 28 to 29.

• The new array filtering.safe_fs_patterns contains glob patterns for paths of files that can be added as local filtering-rule lists. The migration should add list files that have already been added, as well as the default value, $DATA_DIR/userfilters/*.

Fixed

• Property clients.runtime_sources.dhcp in the configuration file not taking effect.
• Update Google safe search domains list (#7155).
• Enforce Bing safe search from Edge sidebar (#7154).
• Text overflow on the query log page (#7119).

Known issues

• Due to the complexity of the Windows permissions architecture and poor support from the standard Go library, we have to postpone the proper automated Windows fix until the next release.

  Temporary workaround: Set the permissions of the AdGuardHome directory to more restrictive ones manually. To do that:

  1. Locate the AdGuardHome directory.
  2. Right-click on it and navigate to Properties → Security → Advanced.
  3. (You might need to disable permission inheritance to make them more restricted.)
  4. Adjust to give the Full control access to only the user which runs AdGuard Home. Typically, Administrator.

AdGuard Home v0.107.52

In this release we have fixed a number of bugs, migrated our front-end to TypeScript and updated our front-end libraries to improve the quality of development and your user experience.

Acknowledgements

A special thanks to our community moderation team, @AdguardTeam/community-moderators, as well as to everyone who filed and inspected issues, added translations, and helped us test this release!

Full changelog

See also the v0.107.52 GitHub milestone.

Security

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in Go 1.22.5.

Added

• The ability to disable logging using the new log.enabled configuration property (#7079).

Changed

• Frontend rewritten in TypeScript.

• The systemd-based service now uses journal for logging by default. It also doesn't create the /var/log/ directory anymore (#7053).

  NOTE: With an installed service for changes to take effect, you need to reinstall the service using -r flag of the install script or via the CLI (with root privileges):

  ./AdGuardHome -s uninstall
  ./AdGuardHome -s install

  Don't forget to backup your configuration file and other important data before reinstalling the service.

Deprecated

• Node 18 support, Node 20 will be required in future releases.

Fixed

• Panic caused by missing user-specific blocked services object in configuration file (#7069).

• Tracking /etc/hosts file changes causing panics within particular filesystems on start (#7076).

AdGuard Home v0.108.0-b.57

Changes compared to the previous beta, v0.108.0-b.56. See CHANGELOG.md for all changes.

Acknowledgements

A special thanks to our community moderation team, @AdguardTeam/community-moderators, as well as to everyone who filed and inspected issues, added translations, and helped us test this release!

Full changelog

Security

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in Go 1.22.5.

Added

• The ability to disable logging using the new log.enabled configuration property (#7079).

Changed

• Frontend rewritten in TypeScript.

• The systemd-based service now uses journal for logging by default. It also doesn't create the /var/log/ directory anymore (#7053).

  NOTE: With an installed service for changes to take effect, you need to reinstall the service using -r flag of the install script or via the CLI (with root privileges):

  ./AdGuardHome -s uninstall
  ./AdGuardHome -s install

  Don't forget to backup your configuration file and other important data before reinstalling the service.

• The HTTP server's write timeout has been increased from 1 minute to 5 minutes to match the one used by AdGuard Home's HTTP client to fetch filtering-list data (#7041).

Deprecated

• Node 18 support, Node 20 will be required in future releases.

Fixed

• Unnecessary validation call on the encryption page.
• Missing version in the footer.
• Panic caused by missing user-specific blocked services object in configuration file (#7069).
• Tracking /etc/hosts file changes causing panics within particular filesystems on start (#7076).

AdGuard Home v0.107.51

A small bugfix and security release. We are working on new features in future releases.

Full changelog

See also the v0.107.51 GitHub milestone.

Security

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in Go 1.22.4.

Changed

• The HTTP server's write timeout has been increased from 1 minute to 5 minutes to match the one used by AdGuard Home's HTTP client to fetch filtering-list data (#7041).

AdGuard Home v0.108.0-b.56

Changes compared to the previous beta, v0.108.0-b.55. See CHANGELOG.md for all changes.

Acknowledgements

A special thanks to our community moderation team, @AdguardTeam/community-moderators, as well as to everyone who filed and inspected issues, added translations, and helped us test this release!

Full changelog

Fixed

• Broken private reverse DNS upstream servers validation causing update failures (#7013).

AdGuard Home v0.107.50

They say, if it isn't broken — don't fix it. Unfortunately, this is not the case with the last AdGuard Home update 😓 A small portion of users haven't been able to start AdGuard Home at all, and so we are rolling out this hotfix.

Acknowledgements

A special thanks to our community moderation team, @AdguardTeam/community-moderators, as well as to everyone who filed and inspected issues, added translations, and helped us test this release!

Full changelog

See also the v0.107.50 GitHub milestone.

Fixed

• Broken private reverse DNS upstream servers validation causing update failures (#7013).

AdGuard Home v0.107.49

Fast approaching summer promises everyone its warmth, and all kinds of bugs are crawling from under the rocks and twigs to enjoy the sun 🌞. Here's a patch to make sure that they stay in the grass and nowhere near AdGuard Home.

Acknowledgements

A special thanks to our community moderation team, @AdguardTeam/community-moderators, contributor @looklose, as well as to everyone who filed and inspected issues, added translations, and helped us test this release!

Full changelog

Security

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in Go 1.22.3.

Added

• Support for comments in the ipset file (#5345).

Changed

• Private rDNS resolution now also affects SOA and NS requests (#6882).

• Rewrite rules mechanics were changed due to improved resolving in safe search.

Deprecated

• Currently, AdGuard Home skips persistent clients that have duplicate fields when reading them from the configuration file. This behaviour is deprecated and will cause errors on startup in a future release.

Fixed

• Acceptance of duplicate UIDs for persistent clients at startup. See also the section on client settings on the Wiki page.

• Domain specifications for top-level domains not considered for requests to unqualified domains (#6744).

• Support for link-local subnets, i.e. fe80::/16, as client identifiers (#6312).

• Issues with QUIC and HTTP/3 upstreams on older Linux kernel versions (#6422).

• YouTube restricted mode is not enforced by HTTPS queries on Firefox.

• Support for link-local subnets, i.e. fe80::/16, in the access settings (#6192).

• The ability to apply an invalid configuration for private RDNS, which led to server inoperability.

• Ignoring query log for clients with ClientID set (#5812).

• Subdomains of in-addr.arpa and ip6.arpa containing zero-length prefix incorrectly considered invalid when specified for private RDNS upstream servers (#6854).

• Unspecified IP addresses aren't checked when using "Fastest IP address" mode (#6875).

AdGuard Home v0.108.0-b.55

Changes compared to the previous beta, v0.108.0-b.54. See CHANGELOG.md for all changes.

Acknowledgements

A special thanks to our community moderation team, @AdguardTeam/community-moderators, contributor @looklose, as well as to everyone who filed and inspected issues, added translations, and helped us test this release!

Full changelog

Security

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in Go 1.22.3.

Added

• Support for comments in the ipset file (#5345).

Changed

• Private rDNS resolution now also affects SOA and NS requests (#6882).

• Rewrite rules mechanics was changed due to improve resolving in safe search.

Deprecated

• Currently, AdGuard Home skips persistent clients that have duplicate fields when reading them from the configuration file. This behaviour is deprecated and will cause errors on startup in a future release.

Fixed

• Acceptance of duplicate UIDs for persistent clients at startup. See also the section on client settings on the Wiki page.

• Domain specifications for top-level domains not considered for requests to unqualified domains (#6744).

• Support for link-local subnets, i.e. fe80::/16, as client identifiers (#6312).

• Issues with QUIC and HTTP/3 upstreams on older Linux kernel versions (#6422).

• YouTube restricted mode is not enforced by HTTPS queries on Firefox.

• Support for link-local subnets, i.e. fe80::/16, in the access settings (#6192).

• The ability to apply an invalid configuration for private rDNS, which led to server not starting.

• Ignoring query log for clients with ClientID set (#5812).

• Subdomains of in-addr.arpa and ip6.arpa containing zero-length prefix incorrectly considered invalid when specified for private rDNS upstream servers (#6854).

• Unspecified IP addresses aren't checked when using "Fastest IP address" mode (#6875).