Block upgrades to Beezkeeper version 20 and above unless DISABLE_NEXTGEN_UPDATES is explicitly set to false.

Patch CVE-2026-98432 (Linux kernel IPv4 TCP use-after-free) by updating the host OS through the Ubuntu update scripts.

Direct authentication reconnects are handled cleanly.

Scan results now include security, protocols per BSSID, channel utilization, and channel width. macOS scans also include PMF, using authorized data from the desktop app.

Supplicant log rotation and its Bookworm install are fixed.

The daemon runs background scan sweeps.

IEEE reason codes 2 and 3 are reported separately.

networkd agents report the live wlan0 gateway, and a global IPv6 address is preferred over link-local.

Wired Path Analysis on wireless agents runs in the interface namespace.

The fast.com speed test reports upload, latency, and client metadata.

The TCP decoder is bounded, and namespace routing is repaired when the host table is flushed or wired IPv4 returns.

dig 9.18 no longer deadlocks when the test interface has no source IP, or on IPv6.

fping children are reaped before the backoff sleep, and a failed fping start is reported to the dashboard.

Upgrades sync before the root filesystem is remounted read-only.

A merge race, a websocket bind failure, and a registration timeout are fixed, along with leaked resources and reused descriptors closed too early.

execCmdAsUser output parsing and address-list walks are hardened.

WLAN query allocations are freed, and disabled location services are reported.

Kernel modules and namespace downloads are protected during an OS upgrade.

The legacy wlan0 supplicant is stopped during the move to networkd.

Listener hardening and the Bookworm 6.12.115 kernel are included.

A legacy-fleet upgrade bundle was prepared at 20.0.5.