Version 7

Version 7.3.0 (2025-12-03)

• Built with Go 1.25.5
• Fix potential transfer problems of transferring agents between organizations when running routers in grace mode.
• Provide internal metrics under new endpoint /api/v1/internal-metrics.
• Keep ownership when transferring an agent or router to another organization.
• Statistics can now be pruned with vcli stats prune ... command and via the API with a DELETE /api/v1/stats.
• In DNS traffic routing, reply with a NOERROR instead of a SERVFAIL if we do not have any records to respond in the DNS traffic router.
• When filtering vcli results, the new accept-empty flag allows empty results without giving an error.
• ACME certificate acquisition timeout is configurable with acme-timeout parameter.
• Retry failed ACME certificate acquisitions after five minutes.
• ACME CAA checks got more resilient regarding NXDOMAIN DNS responses.
• Extended ACME related log messages.
• The ACME DNS endpoint can now be looked up though vcli acme lookup-dns ... and via the API with a POST /api/v1/acme/dns-record.
• Allow for schema-less base urls.
• vcli can now read the password from the environment variable VARNISH_CONTROLLER_CLI_PASSWORD.
• UI: Added support for ACME upstream validations (DNS only).
• UI: Fixed a status alert bug related to the controller license.
• UI: Fixed a bug related to disappearing routing rules in VCL Groups.
• UI: Improved scaling of pop-ups on the CDN map when zooming.
• UI: Improved the informational message for cluster.vcl in the editor.
• UI: Added the ability to see which VCLGroups are attached to a domain in the UI. Previously, only certificates were shown, now the domain detail page includes a filtered list of connected VCLGroups.
• UI: Added new feature in VCLgroups (Rollback) to display file names, versions, and descriptions for better visibility.

Version 7.2.1 (2025-10-01)

• UI and cli: Fix problem that upstream validation FQDN values can be accidentally deleted.

Version 7.2.0 (2025-10-01)

• ACME certificates with DNS validation can now fetch external validations for supporting multiple certificates.
• Handle failing ACME ARI with sane defaults and retry.
• Statistics cleanup cannot be blocked by statistics aggregation any longer.
• Fix database update when doing IDP organization updates.
• Updated unclear log messages for better readability.
• UI: Fixed a bug where a VCLGroup deployed with a gitconfig would not show the deployed files when the main VCL was located in a subdirectory from the root.
• UI: Now displaying attached external routes in a routing rule (if any), even when externalroute is not an active lookuporder.

Version 7.1.5 (2025-09-11)

• Built with Go 1.25
• NATS-Server version 2.11.8
• Support for 0.0.0.0/0 and ::/0 in CIDR routing decision.
• Failing ACME renewals are now retried for an extended period of time. The interval is incremented up to 24 hours between retries.
• Domain-maps and CIDR rule CSV files now supports variable number of fields. This makes it possible to have a variable number of fields in the CSV files for domain to CIDR maps.
• Invalidations that has no domain and is not root deployed will now fail on create.
• Extended debug information for ACME HTTP challenges.
• Configurable timeout for ACME HTTP requests (configured in brainz).
• Log warning instead of error when an invalidation has already been removed during monitoring.
• Fix built-in root VCL to allow delivering ACME validation solutions for both routed requests and agents base-URLs.
• Minor API documentation fixes for deployment states.
• UI: Updated API documentation för deployment states.
• UI: Added inline validation errors in ACME cert creating.
• UI: Updated the editors VCL autocompletion.
• UI: Added organization name in header.
• UI: Fixed filter bug for deployed / not deployed VCL groups.
• UI: Fixed bug where static router tags did not appear as locked.

Version 7.1.4 (2025-08-12)

• Built with Go 1.24.6
• NATS-Server version 2.11.7
• Improved transfer of agents and routers to avoid a race condition where agents/routers registered as new ones during transfer.
• Fix eDNS subnet scopes for IPv6/IPv4, where the minimum mask was not applied correctly.
• ACME contact can now be updated with empty contact information
• Adds extra database debug information for system-debug
  • Database version was missing from version 7, now added back.
  • Database connections information added.
• Adds extra debug information for communication with ACME certificate authorities
• Expire for vcli when creating a custom token/session now supports dates as well as duration.

  vcli sess create --label MyLongLivedtoken -e '2025-08-05T15:04:05Z'
  vcli sess create --label MyLongLivedtoken -e '2025-11-26 19:11:20'
  vcli sess create --label MyLongLivedtoken -e 60h
  

Version 7.1.3 (2025-07-07)

• Deploylogs are now correctly removed when deleting a VCLGroup. This made is impossible to remove files that where part of deploylogs for removed VCLGroups. This is now fixed and a migration will handle previous dangling deploylogs.
• Tags are now included correctly for agents that are passed to gRPC plugins in the Traffic Router.
• Improved root.vcl skipping toLower for domain matching (improves performance when many domains are deployed). This is now done in the agent instead of the VCL.

Version 7.1.2 (2025-06-25)

• Fixed a bug where the configured NICs were not returned from the API.
• Fixed a bug where the graphs in the UI dashboard stayed empty.
• Fixed a bug for loading TLS 1.3 certificates into Varnish.
• Fixed a bug where invalidations did not load domains correctly as an organization user.

Version 7.1.1 (2025-06-05)

• Fixes a bug where certificates were not loaded correctly into Varnish during renewal.

Version 7.1.0 (2025-06-04)

• Support for revocation of ACME TLS Certificates.
• Make it possible to remove deploylogs for undeployed VCLGroups.
• Hide NATS password in configs
• Agent root.vcl is now using none case-sensitive domain matching.
• Domain validation is now more strict and follows RFC 1035.
• Superfluous error message in the agent has been suppressed into a debug log message, that previously logged error if no BaseURL had been configured in the agent.
• Normalization of NIC names in the agent.
• Fixes a bug where negative values for Longitude/Latitude was not saved correctly.
• Support for Domain Maps for CIDR:Tag routing.
• Swagger documentation has been improved.
• Support for eDNS subnet scopes.
  • New configuration options for Routing Rules (ipv4MinMask and ipv6MinMask) to set the minimum mask for IPv4 and IPv6 addresses for router DNS responses.
• Fixes a duplicate entry error for routing plugins.
• Fixes an error that was triggered for static tags insert.
• UI: Fixes a bug where contact information was not persisted for ACME accounts.
• UI: Fixes a bug where unsaved changes in a file was overwritten when changing tabs.
• UI: Add an option to trigger a deployment on a single VCLGroup from the VCLGroup index page.

Version 7.0.1 (2025-04-24)

• Allow to stop aggregation queries from running when using the -keep-stats-* configurations.
• Add support to export routing healths in prometheus for monitoring purposes.
• Fixed duplicate labels on Prometheus output.
• Fixed cleaning counter names for S3 and UDO statistics from IP addresses.
• Upgrade dependencies to resolve CVEs.
• UI server: Assume TLS as default.
• UI: Add option for loadAllSans in certificates.
• UI: Various bug fixes.
• API documentation has been updated with fixes.
  • POST|PUT has now required fields added and now reflect what should actually be part of the request body.
  • gitRepos endpoint now lowercased.
  • Swagger.json now contains extension x-nullable for string pointers.
  • Descriptions for several endpoints has been improved.
  • Required fields are now marked as required in swagger docs.

Version 7.0.0 (2025-03-27)

• All components has been built with latest Go 1.24.
• Support for Long Lived Tokens.
• Support for file versioning.
• Support for Git managed deployments.
• New deployment procedure:
  • Deployments has been removed and replaced with TagSets directly on VCLGroups.
  • VCLGroups are no longer connected via files, they are deployed individually.
  • Deploying files can be verified on a given set of matching agents, all matching agents or a random matching agent.
  • Deploy logs for rollback of previously deployed files.
  • Keep on failure always on.
  • Deploy VCLGroup from git repository.
• Support for ACME (Let’s Encrypt).
  • Creation of accounts and certificates.
  • Automatic renewal of certificates.
• New database layer for performance improvements and stability.
• Brainz now requires git as a dependency when installing the brainz package.
• The default minimum TLS version for new certificates created in the Controller has been changed from TLSv1.3 to TLSv1.2.
• Certificates now have an allSans option to load all SAN entries into Varnish, including wildcards.
• Support to append a single domain ID to a VCLGroup.
• Dropping support for a couple of old distributions that has reached End Of Life:
  • Ubuntu Xenial
  • Ubuntu Bionic
  • Ubuntu Focal
  • Debian Stretch
  • Debian Buster
  • Centos 7