Menu
FR

Home Release - Versions AdGuard

AdGuard Home 0.107.8
Date de lancement : 19 juillet 2022
Just like a sudden burst of rain during an otherwise hot and sunny summer day, mistakes happen. But unlike rain, we can fix them! Which is exactly what we did in this bugfix release.

Full Changelog

Security

Go version was updated to prevent the possibility of exploiting the CVE-2022-1705, CVE-2022-32148, CVE-2022-30631, and other Go vulnerabilities fixed in Go 1.17.12.

Fixed

DHCP lease validation incorrectly letting users assign the IP address of the gateway as the address of the lease #4698.
Updater no longer expects a hardcoded name for AdGuardHome executable #4219.
Inconsistent names of runtime clients from hosts files #4683.
PTR requests for addresses leased by DHCP will now be resolved into hostnames under dhcp.local_domain_name #4699.
Broken service installation on OpenWrt #4677.
AdGuard Home 0.107.7
Date de lancement : 19 juillet 2022
Voici l’été qui est arrivé avec une nouvelle version de AdGuard Home !

DNS-over-QUIC: RFC 9250

Le protocole DNS-over-QUIC tant attendu est devenu une norme, RFC 9250. Dans cette version, nous ajoutons la prise en charge de la version finale de la norme de manière rétrocompatible.

Plus de contrôle sur les serveurs en amont

Vous pouvez désormais spécifier un amont pour tous les sous-domaines d'un domaine tout en excluant le domaine lui-même. Par exemple, si vous souhaitez résoudre les requêtes vers server-1.example.com par aide du serveur DNS 1.1.1.1, mais lassez example.com à être résolu par votre amont par défaut (dans cet exemple c’est, 94.140.14.14), utilisez :
94.140.14.14
[/*.example.com/]1.1.1.1
En parlant de upstreams. Désormais, vous n'avez plus à vous souvenir des adresses IP précises des amonts DNS simples. Tant que vos serveurs d'amorçage peuvent les résoudre, vous pouvez utiliser le nouveau schéma des adresses en amont udp:// pour résoudre les adresses en amont automatiquement :
udp://one.one.one.one # Same as 1.1.1.1.

Autres changements importants

Les utilisateurs ont désormais plus de contrôle sur la manière dont les informations sur le client sont recueillies, y compris la possibilité de désactiver complètement cette fonction.
Les informations relatives au sous-réseau du client EDNS provenant des demandes des clients sont désormais affichées sur la page Journal des requêtes.
Comme d'habitude, nous faisons tout pour maintenir nos outils à jour afin que nos utilisateurs ne soient pas victimes de vulnérabilités.
Il y a beaucoup d'autres petits changements et corrections ; regardez le journal complet des modifications ci-dessous !

Remerciements

Un grand merci à notre contributeur open-source, @Lanius-collaris, ainsi qu'à tous ceux qui ont déposé et inspecté des problèmes, ajouté des traductions et aidé à tester cette version !

Journal des modifications complet

Sécurité

La version Go a été mise à jour pour empêcher la possibilité d'exploiter les vilnérabilités CVE-2022-29526, CVE-2022-30634, CVE-2022-30629, CVE-2022-30580 et CVE-2022-29804.
Politique de renforcement des mots de passe #3503.

Ajouté

Prise en charge de la norme DNS-over-QUIC finale, (RFC 9250) #4592.
Prise en charge des flux en amont pour les sous-domaines d'un domaine uniquement #4503.
La possibilité de contrôler séparément chaque source de clients d'exécution via l'objet de configuration clients.runtime_sources #3020.
La possibilité de personnaliser l'ensemble des réseaux qui sont considérés privés grâce à la nouvelle caractéristique dns.private_networks dans le fichier de configuration #3142.
Informations sur le sous-réseau du client EDNS dans la section des détails de la demande d'un enregistrement du journal des requêtes #3978.
Prise en charge des noms d'hôtes pour les serveurs amont UDP simples utilisant le schéma udp:// #4166.
Les journaux sont désormais collectés par défaut sur FreeBSD et OpenBSD lorsque AdGuard Home est installé en tant que service #4213.

Changements

Sous OpenBSD, le script daemon utilise maintenant l'interpréteur de commandes recommandé /bin/ksh au lieu de /bin/sh #4533. Pour appliquer ce changement, sauvegardez vos données et exécutez AdGuardHome -s uninstall && AdGuardHome -s install.
Le numéro de port DNS-over-QUIC par défaut est maintenant 853 au lieu de 754 en accord avec (RFC 9250) #4276.
Le DNS inverse a maintenant une plus grande priorité comme source d'information des clients d'exécution que le voisinage ARP.
Amélioration de la détection des clients d'exécution grâce à un traitement ARP plus résistant #3597.
Le TTL des réponses servies par le cache optimiste est maintenant abaissé à 10 secondes.
Les serveurs amont de DNS inverse privés spécifiques à un domaine sont désormais validés pour n'autoriser que les domaines *.in-addr.arpa et *.ip6.arpa pointant vers des réseaux desservis localement #3381. Attention : Si vous avez déjà des entrées invalides dans votre configuration, envisagez de les supprimer manuellement, car elles n'ont essentiellement aucun effet.
Le filtrage des réponses s'effectue désormais en fonction des types d'enregistrement de la section des réponses des messages, et non plus en fonction du type de la question #4238.
IAu lieu d'ajouter l'information sur l'heure de construction, les scripts de construction utilisent maintenant la variable d'environnement standardisée [SOURCE_DATE_EPOCH][repr] pour ajouter la date du commit à partir duquel le binaire a été construit #4221. Ceci devrait simplifier les constructions reproductibles pour les mainteneurs de paquets et ceux qui compilent leur propre maison AdGuard.
La propriété local_domain_name est maintenant dans l'objet dhcp dans le fichier de configuration pour éviter la confusion #3367.
La propriété dns.bogus_nxdomain du fichier de configuration supporte maintenant la notation CIDR à côté des adresses IP. #1730.

Les changements de Configuration

Dans cette version, la version du schéma est passée de 12 à 14.
L'objet clients, qui dans les versions 13 et antérieures du schéma était un tableau de clients persistants réels, est maintenant constitué des propriétés persistent et runtime_sources :
# BEFORE:
'clients':
- name: client-name
  # …

# AFTER:
'clients':
  'persistent':
    - name: client-name
      # …
  'runtime_sources':
    whois: true
    arp: true
    rdns: true
    dhcp: true
    hosts: true
The value for clients.runtime_sources.rdns field is taken from dns.resolve_clients property. To rollback this change, remove the runtime_sources property, move the contents of persistent into the clients itself, the value of clients.runtime_sources.rdns into the dns.resolve_clients, and change the schema_version back to 13.
Property local_domain_name, which in schema versions 12 and earlier used to be a part of the dns object, is now a part of the dhcp object:
# BEFORE:
'dns':
  # …
  'local_domain_name': 'lan'

# AFTER:
'dhcp':
  # …
  'local_domain_name': 'lan'
Pour annuler ce changement, replacez la propriété dans l'objet dns et remettez la schema_version à 12.

Obsolète

L'option --no-etc-hosts. Sa fonctionnalité est maintenant contrôlée par la propriété de configuration clients.runtime_sources.hosts. La v0.109.0 supprimera complètement l'option.

Corrigé

Le journal des requêtes entre parfois dans une boucle infinie #4591.
Démarrage du service au lancement sur les systèmes utilisant SysV-init #4480.
Détection de l'état des services arrêtés sur macOS et Linux #4273.
ClientID sensible à la casse #4542.
Des requêtes de mise à jour de version lentes rendant d'autres API HTTP non réactives #4499.
Le processus de rafraîchissement des tables ARP provoque des demandes PTR excessives #3157.
AdGuard Home 0.107.6
Date de lancement : 14 avril 2022
This is a small security-oriented update. This AdGuard Home version requires Go v1.17 and later to build, because older Go versions receive no further support, including security patches.
Aside from that, we've slightly updated $dnsrewrite modifier to support the user-defined Discovery of Designated Resolvers (DDR). We are planning on continuing to make more improvements to it in the future updates, see #4463.
The rest are minor changes and ever-present bugfixes.

Full Changelog


Security

User-Agent HTTP header removed from outgoing DNS-over-HTTPS requests.

Go version was updated to prevent the possibility of exploiting the CVE-2022-24675, CVE-2022-27536, and CVE-2022-28327 vulnerabilities.

Added

Support for SVCB/HTTPS parameter dohpath in filtering rules with the dnsrewrite modifier according to the RFC draft #4463.

Changed

Filtering rules with the dnsrewrite modifier that create SVCB or HTTPS responses should use ech instead of echconfig to conform with the latest drafts.

Deprecated

SVCB/HTTPS parameter name echconfig in filtering rules with the dnsrewrite modifier. Use ech instead. v0.109.0 will remove support for the outdated name echconfig.

Obsolete --no-mem-optimization option #4437. v0.109.0 will remove the flag completely.

Fixed

I/O timeout errors when checking for the presence of another DHCP server.
Network interfaces being incorrectly labeled as down during installation.

Rules for blocking the QQ service #3717.

Removed

Go 1.16 support, since that branch of the Go compiler has reached end of life and doesn't receive security updates anymore.
AdGuard Home 0.107.5
Date de lancement : 14 avril 2022
This is a security release. There are no new changes besides the update of the Go programming language version.
More substantial changes are to come in the subsequent updates.

Full Changelog


Security

Go version was updated to prevent the possibility of exploiting the CVE-2022-24921 vulnerability. As the CVE page is still showing “reserved” at the time of publishing, see also golang/go#51112.
AdGuard Home 0.107.4
Date de lancement : 14 avril 2022
A small update to fix a couple bugs and shore up some Go vulnerabilities.
More substantial changes are to come in the subsequent updates.

Full Changelog


Security

Go version was updated to prevent the possibility of exploiting the CVE-2022-23806, CVE-2022-23772, and CVE-2022-23773 vulnerabilities.

Changed

Minor UI improvements.

Fixed

Optimistic cache now responds with expired items even if those can't be resolved again #4254.
Unnecessarily complex hosts-related logic leading to infinite recursion in some cases #4216.
AdGuard Home 0.107.3
Date de lancement : 3 février 2022
This version contains bug fixes and cleanups 🧹. Also, there is a new minor feature: now you can rewrite responses for domains using the response code NOERROR. Similar rules will allow to get a successful response without records, e.g.:
|example.com^$dnsrewrite=NOERROR

Full Changelog

Added

Support for a $dnsrewrite modifier with an empty NOERROR response #4133.

Fixed

Wrong set of ports checked for duplicates during the initial setup #4095.
Incorrectly invalidated service domains #4120.
Poor testing of domain-specific upstream servers #4074.
Omitted aliases of hosts specified by another line within the OS's hosts file #4079.
AdGuard Home 0.107.2
Date de lancement : 12 janvier 2022
You know, it is very hard to break your bad habits. We're still struggling with one, the overwhelming need to roll out hotfixes to AdGuard Home releases 😢
Now this one is a hotfix release for a really critical CPU overconsumption bug in v0.107.1.
Please update asap and with this, we wish you happy holidays!🎄

Full Changelog

Fixed

Infinite loops when TCP connections time out (#4042).
AdGuard Home 0.107.1
Date de lancement : 12 janvier 2022
In a not-futile-at-all-we-swear 😅 attempt to fix all bugs before the New Year we're rolling out a hotfix to the recent v0.107.0. Hopefully, this time we got it all right. And if not, there are still a couple of sheets left on the calendar 📆 and the mug is still half-full with lukewarm coffee ☕

Acknowledgements

A special thanks to our open-source contributors: @Aikatsui and @mdawsonuk, as well as to everyone who filed and inspected issues, added translations, and helped us test this release!

Full Changelog

Changed

The validation error message for duplicated allow- and blocklists in DNS settings now shows the duplicated elements (#3975).

Fixed

ipset initialization bugs (#4027).
Legacy DNS rewrites from a wildcard pattern to a subdomain (#4016).
Service not being stopped before running the uninstall service action (#3868).
Broken reload service action on FreeBSD.
Legacy DNS rewrites responding from upstream when a request other than A or AAAA is received (#4008).
Panic on port availability check during installation (#3987).
Incorrect application of rules from the OS's hosts files (#3998).
AdGuard Home 0.107.0
Date de lancement : 12 janvier 2022
We've had some big AdGuard Home updates in the past, but this one is to top them all. It's been brewing for almost eight months! 🙀 So no wonder there's heaps upon heaps of new features, improvements, bugfixes, and other changes. We'd better start listing them ASAP, or else we'll be risking missing the New Year's fireworks 🎆 🥂

Native Apple Silicon support

There's no shortage of killer features in this changelog, but this one takes the cake as the biggest of them all, without any doubt. You won't have to resort to Rosetta or any such solutions anymore if you want to configure AdGuard Home on a Mac with a Silicon chip.

RFC 9000 support In DNS-over-QUIC

It's not quite over nine thousand, but it'll do. The IETF has formalized QUIC this year with RFC 9000, and DNS-over-QUIC protocol finally supports it. If you haven't tried DoQ yet, consider this a sign.

$dnsrewrite rules and other DNS rewrites will now be applied even when protection is disabled (#1558)

Another popular demand. This change only makes sense, as DNS rewrites often carry a different purpose than simply blocking ads or trackers. You still can disable them by opening the admin panel, going to Settings → General settings, and removing the check mark from the Block domains using filters and hosts files box.
Note: rules contained in system hosts files (e.g. /etc/hosts) now have higher priority. This may result in more rewrites appearing in your Query log. If some of these rewrites are invalid, remove the corresponding lines from your hosts files or comment them out.

DNS-over-HTTPS queries now use the real IP address of the client instead of the address of the proxy (#2799)

Note that this change concerns only those proxies that you've added to the list of "Trusted proxies", otherwise it would be a major security risk. We wouldn't want anything of that sort to happen to you! 🙅‍♀️ Right now trusted_proxies can only be configured in AdGuardHome.yaml, but that might change in the future.

Optimistic DNS cache (#2145)

To reduce latency you may make AdGuard Home respond from the cache even when the stored entry is expired, while trying to refresh them at the same time🔄 This checkbox is located in Settings → DNS settings → DNS cache configuration and it's not ticked by default. Responses made from DNS cache are marked with a special label in the Query log.

Query log search now supports internationalized domains (#3012)

Internationalized domain names (IDNAs) are domain names that contain symbols in non-Latin script/alphabet, such as яндекс.рф or ουτοπία.δπθ.gr, for example. Previously, they were being converted to Unicode in AG Home Query log (xn--d1abqjx3f.xn--p1ai and xn--kxae4bafwg.xn--pxaix.gr in our examples), which is a detriment in most cases. Now IDNAs are displayed as is, and you can search for them without resorting to Unicode.

Acknowledgements

A special thanks to our open-source contributors: @Aikatsui, @anbraten, @bruvv, @DandelionSprout, @fvdm, @hnefatl, @markhicken, @p27877, and @systemcrash, as well as to everyone who filed and inspected issues, added translations, and helped us test this release! 🙏

Full Changelog

Added

Upstream server information for responses from cache (#3772). Note that old log entries concerning cached responses won't include that information.
Finnish and Ukrainian translations.
Setting the timeout for IP address pinging in the "Fastest IP address" mode through the new fastest_timeout field in the configuration file (#1992).
Static IP address detection on FreeBSD (#3289).
Optimistic cache (#2145).
New possible value of 6h for querylog_interval setting (#2504).
Blocking access using client IDs (#2624, #3162).
source directives support in /etc/network/interfaces on Linux (#3257).
RFC 9000 support in DNS-over-QUIC.
Completely disabling statistics by setting the statistics interval to zero (#2141).
The ability to completely purge DHCP leases (#1691).
Settable timeouts for querying the upstream servers (#2280).
Configuration file parameters to change group and user ID on startup on Unix (#2763).
Experimental OpenBSD support for AMD64 and 64-bit ARM CPUs (#2439, #3225, #3226).
Support for custom port in DNS-over-HTTPS profiles for Apple's devices (#3172).
darwin/arm64 support (#2443).
freebsd/arm64 support (#2441).
Output of the default addresses of the upstreams used for resolving PTRs for private addresses (#3136).
Detection and handling of recurrent PTR requests for locally-served addresses (#3185).
The ability to completely disable reverse DNS resolving of IPs from locally-served networks (#3184).
New flag --local-frontend to serve dynamically changeable frontend files from disk as opposed to the ones that were compiled into the binary.

Changed

Port bindings are now checked for uniqueness (#3835).
The DNSSEC check now simply checks against the AD flag in the response (#3904).
Client objects in the configuration file are now sorted (#3933).
Responses from cache are now labeled (#3772).
Better error message for ED25519 private keys, which are not widely supported (#3737).
Cache now follows RFC more closely for negative answers (#3707).
$dnsrewrite rules and other DNS rewrites will now be applied even when the protection is disabled (#1558).
DHCP gateway address, subnet mask, IP address range, and leases validations (#3529).
The systemd service script will now create the /var/log directory when it doesn't exist (#3579).
Items in allowed clients, disallowed clients, and blocked hosts lists are now required to be unique (#3419).
The TLS private key previously saved as a string isn't shown in API responses anymore (#1898).
Better OpenWrt detection (#3435).
DNS-over-HTTPS queries that come from HTTP proxies in the trusted_proxies list now use the real IP address of the client instead of the address of the proxy (#2799).
Clients who are blocked by access settings now receive a REFUSED response when a protocol other than DNS-over-UDP and DNSCrypt is used.
querylog_interval setting is now formatted in hours.
Query log search now supports internationalized domains (#3012).
Internationalized domains are now shown decoded in the query log with the original encoded version shown in request details (#3013).
When /etc/hosts-type rules have several IPs for one host, all IPs are now returned instead of only the first one (#1381).
The setting rlimit_nofile is now in the os block of the configuration file, together with the new group and user settings (#2763).
Permissions on filter files are now 0o644 instead of 0o600 (#3198).

Configuration Changes

In this release, the schema version has changed from 10 to 12.
Parameter dns.querylog_interval, which in schema versions 11 and earlier used to be an integer number of days, is now a string with a human-readable duration:
# BEFORE:
'dns':
  # …
  'querylog_interval': 90

# AFTER:
'dns':
  # …
  'querylog_interval': '2160h'
To rollback this change, convert the parameter back into days and change the schema_version back to 11.
Parameter rlimit_nofile, which in schema versions 10 and earlier used to be on the top level, is now moved to the new os object:
# BEFORE:
'rlimit_nofile': 42

# AFTER:
'os':
  'group': ''
  'rlimit_nofile': 42
  'user': ''
To rollback this change, move the parameter on the top level and change the schema_version back to 10.

Deprecated

Go 1.16 support. v0.108.0 will require at least Go 1.17 to build.

Fixed

EDNS0 TCP keepalive option handling (#3778).
Rules with the $denyallow modifier applying to IP addresses when they shouldn't (#3175).
The length of the EDNS0 client subnet option appearing too long for some upstream servers (#3887).
Invalid redirection to the HTTPS web interface after saving enabled encryption settings (#3558).
Incomplete propagation of the client's IP anonymization setting to the statistics (#3890).
Incorrect $dnsrewrite results for entries from the operating system's hosts file (#3815).
Matching against rules with | at the end of the domain name (#3371).
Incorrect assignment of explicitly configured DHCP options (#3744).
Occasional panic during shutdown (#3655).
Addition of IPs into only one as opposed to all matching ipsets on Linux (#3638).
Removal of temporary filter files (#3567).
Panic when an upstream server responds with an empty question section (#3551).
9GAG blocking (#3564).
DHCP now follows RFCs more closely when it comes to response sending and option selection (#3443, #3538).
Occasional panics when reading old statistics databases (#3506).
reload service action on macOS and FreeBSD (#3457).
Inaccurate using of service actions in the installation script (#3450).
Client ID checking (#3437).
Discovering other DHCP servers on darwin and freebsd (#3417).
Switching listening address to unspecified one when bound to a single specified IPv4 address on Darwin (macOS) (#2807).
Incomplete HTTP response for static IP address.
DNSCrypt queries weren't appearing in query log (#3372).
Wrong IP address for proxied DNS-over-HTTPS queries (#2799).
Domain name letter case mismatches in DNS rewrites (#3351).
Conflicts between IPv4 and IPv6 DNS rewrites (#3343).
Letter case mismatches in CNAME filtering (#3335).
Occasional breakages on network errors with DNS-over-HTTP upstreams (#3217).
Errors when setting static IP on Linux (#3257).
Treatment of domain names and FQDNs in custom rules with $dnsrewrite that use the PTR type (#3256).
Redundant hostname generating while loading static leases with empty hostname (#3166).
Domain name case in responses (#3194).
Custom upstreams selection for clients with client IDs in DNS-over-TLS and DNS-over-HTTP (#3186).
Incorrect client-based filtering applying logic (#2875).

Removed

Go 1.15 support.
AdGuard Home 0.106.3
Date de lancement : 19 mai 2021
More! More bugfixes! 🧟‍♀️
But this time, for a change, there's a couple of new minor features to go with them. Hope you don't mind 🤷‍♂️
A special thanks to our open-source contributor, @ashishwt, as well as to everyone who filed and inspected issues, added translations, and helped us to test this release!

Added

Support for reinstall (-r) and uninstall (-u) flags in the installation script #2462.
Support for DHCP DECLINE and RELEASE message types #3053.

Changed

Add microseconds to log output.

Fixed

Intermittent "Warning: ID mismatch" errors #3087.
Error when using installation script on some ARMv7 devices #2542.
DHCP leases validation #3107, #3127.
Local PTR request recursion in Docker containers #3064.
Ignoring client-specific filtering settings when filtering is disabled in general settings #2875.
Disallowed domains are now case-insensitive #3115.
Other minor fixes and improvements.
AdGuard Home 0.106.2
Date de lancement : 19 mai 2021
It's not Friday? Not a problem! We defy the tradition of Friday hotfixes by rushing another one out a day earlier 🙌
A special thanks to our open-source contributor, @jankais3r, as well as to everyone who filed issues, added translations, and helped us to test this release!

Fixed

Uniqueness validation for dynamic DHCP leases #3056.
Various other issues #3075, #3077.
AdGuard Home 0.106.1
Date de lancement : 19 mai 2021
We had a release a couple days ago. You all knew it would come to this. 🦸
It's Friday.
It's hotfix time! 🔥
Nothing serious though, we didn't even break anything. Just cleaning up some minor bugs. 🧹

Fixed

Local domain name handling when the DHCP server is disabled #3028.
Normalization of perviously-saved invalid static DHCP leases #3027.
Validation of IPv6 addresses with zones in system resolvers #3022.
AdGuard Home 0.106.0
Date de lancement : 19 mai 2021
Quite a lot of changes this time around, even if there aren't as many standouts as in some of the previous updates. We're sure that you'll be able to find a line or two in the changelog that speaks to you!
And one of the reasons for that is the constant support from the community. 👥👥 Special thanks to our open-source contributors: @jvoisin and @Paraphraser, as well as to everyone who filed issues, added translations, and helped us to test this release! 🙇

The ability to set up custom upstreams to resolve PTR queries for local addresses and to disable the automatic resolving of clients' addresses #2704

This option will improve your DNS privacy when it comes to addressing local resources. Give it a go unless you want to share your private data with googles of the world.

Search by clients' names in the query log #1273

There's not much that can be said about this feature, it's quite self-explanatory: now you can search up queries by specific clients. 🤷‍♀️
However, we wanted to highlight it anyway since so many of you have asked for it for quite a while. Hopefully, we delivered! 😅

Added

The ability to block user for login after configurable number of unsuccessful attempts for configurable time #2826.
$denyallow modifier for filters #2923.
Hostname uniqueness validation in the DHCP server #2952.
Hostname generating for DHCP clients which don't provide their own #2723.
New flag --no-etc-hosts to disable client domain name lookups in the operating system's /etc/hosts files #1947.
Logging of the client's IP address after failed login attempts #2824.
Verbose version output with -v --version #2416.
The ability to set a custom TLD or domain name for known hosts in the local network #2393, #2961.
The ability to serve DNS queries on multiple hosts and interfaces #1401.
ips and text DHCP server options #2385.
SRV records support in $dnsrewrite filters #2533.

Changed

Our DoQ implementation is now updated to conform to the latest standard draft #2843.
Quality of logging #2954.
Normalization of hostnames sent by DHCP clients #2945, #2952.
The access to the private hosts is now forbidden for users from external networks #2889.
The reverse lookup for local addresses is now performed via local resolvers #2704.
Stricter validation of the IP addresses of static leases in the DHCP server with regards to the netmask #2838.
Stricter validation of $dnsrewrite filter modifier parameters #2498.
New, more correct versioning scheme #2412.

Deprecated

Go 1.15 support. v0.107.0 will require at least Go 1.16 to build.

Fixed

Multiple answers for $dnsrewrite rule matching requests with repeating patterns in it #2981.
Root server resolving when custom upstreams for hosts are specified #2994.
Inconsistent resolving of DHCP clients when the DHCP server is disabled #2934.
Comment handling in clients' custom upstreams #2947.
Overwriting of DHCPv4 options when using the HTTP API #2927.
Assumption that MAC addresses always have the length of 6 octets #2828.
Support for more than one /24 subnet in DHCP #2541.
Invalid filenames in the mobileconfig API responses #2835.

Removed

Go 1.14 support.
AdGuard Home 0.105.2
Date de lancement : 15 mars 2021
There are big flashy updates, and there are seemingly unassuming ones, which constitute, however, the backbone of any successful project. This is the latter, as you may have guessed. You'll find here a heap of bugfixes and a security update for CVE-2021-27935.

Security

Session token doesn't contain user's information anymore (#2470).

Fixed

Incomplete hostnames with trailing zero-bytes handling (#2582).
Wrong DNS-over-TLS ALPN configuration (#2681).
Inconsistent responses for messages with EDNS0 and AD when DNS caching is enabled (#2600).
Incomplete OpenWrt detection (#2757).
DHCP lease's expired field incorrect time format (#2692).
Incomplete DNS upstreams validation (#2674).
Wrong parsing of DHCP options of the ip type (#2688).
AdGuard Home v0.105.1
Date de lancement : 16 février 2021
Have you ever thought about why traditions are so important?🧙‍♂️ Traditions help us remember that we are part of a history that defines our past, shapes who we are today, and who we are likely to become. This is why we at AdGuard respect our traditions, and the most important one is pushing the inevitable hotfix right after every major update.🔥🔧
Jokes aside, here's the list of things fixed and improved in this hotfix.

Changed

Increased HTTP API timeouts (#2671, #2682).
"Permission denied" errors when checking if the machine has a static IP no longer prevent the DHCP server from starting (#2667).
The server name sent by clients of TLS APIs is not only checked when strict_sni_check is enabled (#2664).
HTTP API request body size limit for the POST /control/access/set and POST /control/filtering/set_rules HTTP APIs is increased (#2666, #2675).

Fixed

Error when enabling the DHCP server when AdGuard Home couldn't determine if the machine has a static IP.
Optical issue on custom rules (#2641).
Occasional crashes during startup.
The field "range_start" in the GET /control/dhcp/status HTTP API response is now correctly named again (#2678).
DHCPv6 server's ra_slaac_only and ra_allow_slaac settings aren't reset to false on update any more (#2653).
The Vary header is now added along with Access-Control-Allow-Origin to prevent cache-related and other issues in browsers (#2658).
The request body size limit is now set for HTTPS requests as well.
Incorrect version tag in the Docker release (#2663).
DNSCrypt queries weren't marked as such in logs (#2662).
AdGuard Home 0.105.0
Date de lancement : 12 février 2021
We took our sweet time with this update, but you'll most certainly find it to be worth the wait. The changelog contains three absolute 💥bangers and a laundry list of lesser changes.

🕵️‍♂️ Client ID support for DNS-over-HTTPS, DNS-over-QUIC, and DNS-over-TLS #1387

This feature would be really useful to those of you who run an encrypted DNS resolver on a public server. In short, you can now identify your devices not just by their IP address (which is, frankly, not too useful in a public server scenario 🤷‍♀️), but by using a special "Client ID".
Here's how it works:
First, you add a client and specify an arbitrary string as its "Identifier", for instance, my-iphone.
On the client device you can now configure:
DNS-over-HTTPS: https://example.org/dns-query/my-iphone
DNS-over-TLS: tls://my-iphone.example.org (requires a Wildcard certificate)
DNS-over-QUIC: quic://my-iphone.example.org (requires a Wildcard certificate)
Queries and stats are now properly attributed to your device.

🔐 AdGuard as a DNSCrypt-resolver #1361

DNSCrypt was the very first DNS encryption protocol that got some traction. It may not be as popular as DoH/DoT/DoQ now, but it is still viable. Moreover, performance-wise DNSCrypt is better than any of them. And now that v0.105.0 is out, AdGuard Home can be configured to work as a DNSCrypt resolver!
However, here goes the tricky part. We haven't yet exposed these settings to the Web admin panel so if you want to have DNSCrypt, you'll need to follow this instruction and do it via editing the configuration file (AdGuardHome.yaml). Not that it would scare you off, would it? 🤓
Regarding DNSCrypt clients - AdGuard for Android, Windows and iOS support it, Mac will get its support pretty soon. Besides that, here is a long list of client software that supports it as well.

🆎 $dnsrewrite and $dnstype modifiers #2102 #2337

AdGuard Home now supports two more powerful rule modifiers that will help blocklists' maintainers.
$dnstype lets you narrow down the rule scope and apply it only to queries of a specific type(s). For instance, Apple devices now support HTTPS DNS query type. While being generally a good thing, this new type may sometimes be harmful😲. By using $dnstype you can block it completely using a simple rule like this: $dnstype=HTTPS
$dnsrewrite is another powerful modifier that allows you to modify DNS responses. Note that this modifier is much more powerful compared to something like a hosts file.
Here are some examples:
||example.org^$dnsrewrite=SERVFAIL;; - return SERVFAIL for example.org and all it's subdomains
|test.example.org^$dnsrewrite=NOERROR;TXT;hello_world - add a TXT record for test.example.org
|example.org^$dnsrewrite=example.com - redirect example.org to example.com
|example.org^$dnsrewrite=1.1.1.1 - redirect example.org to example.com
You can find more examples in the documentation.

Added

Added more services to the "Blocked services" list #2224, #2401
ipset subdomain matching, just like dnsmasq does #2179
The host checking API and the query logs API can now return multiple matched rules #2102
Detecting of network interface configured to have static IP address via /etc/network/interfaces #2302
A 5 second wait period until a DHCP server's network interface gets an IP address #2304
HTTP API request body size limit #2305

Changed

Access-Control-Allow-Origin is now only set to the same origin as the domain, but with an HTTP scheme as opposed to * #2484
workDir now supports symlinks.
Stopped mounting together the directories /opt/adguardhome/conf and /opt/adguardhome/work in our Docker images #2589
When dns.bogus_nxdomain option is used, the server will now transform responses if there is at least one bogus address instead of all of them #2394. The new behavior is the same as in dnsmasq.
Post-updating relaunch possibility is now determined OS-dependently #2231, #2391
Made the mobileconfig HTTP API more robust and predictable, add parameters and improve error response #2358
Improved HTTP requests handling and timeouts #2343
Our snap package now uses the core20 image as its base #2306
New build system and various internal improvements #2271, #2276, #2297, #2509, #2552, #2639, #2646

Deprecated

Go 1.14 support. v0.106.0 will require at least Go 1.15 to build.
The darwin/386 port. It will be removed in v0.106.0.
The "rule" and "filter_id" fields in GET /filtering/check_host and GET /querylog responses. They will be removed in v0.106.0 #2102

Fixed

Autoupdate bug in the Darwin (macOS) version #2630
Unnecessary conversions from string to net.IP, and vice versa #2508
Inability to set DNS cache TTL limits #2459
Possible freezes on slower machines #2225
A mitigation against records being shown in the wrong order on the query log page #2293
A JSON parsing error in query log #2345
Incorrect detection of the IPv6 address of an interface as well as another infinite loop in the /dhcp/find_active_dhcp HTTP API #2355

Removed

The undocumented ability to use hostnames as any of bind_host values in the configuration. Documentation requires them to be valid IP addresses, and now the implementation makes sure that that is the case #2508
Dockerfile #2276. Replaced with the script scripts/make/build-docker.sh which uses scripts/make/Dockerfile.
Support for pre-v0.99.3 format of query logs #2102
AdGuard Home 0.104.3
Date de lancement : 12 février 2021
Bugfixes... 😌 There's something about them that we just can't resist. We always want more! 🧟
When there's nothing more to fix, we just roll out a new major update, introduce some fresh bugs and start all over. It's a circle of life ☯️
Luckily, there are still some to prey upon in v0.104. Have a look at what we've fixed this time:

Fixed

Don't expose the profiler HTTP API #2336
Load query logs from files after loading the ones buffered in memory #2325
Don't show Unnecessary errors in logs when switching between query log files #2324
Don't show 404 Not Found errors on the DHCP settings page on Windows. Show that DHCP is not currently available on that OS instead #2295
Fix an infinite loop in the /dhcp/find_active_dhcp HTTP API method #2301
Various internal improvements
AdGuard Home 0.104.1
Date de lancement : 12 février 2021
Those who pay close attention to AdGuard Home releases know that we keep hotfixes close to our hearts 🔥♥️ This time we held for as long as we could, but ultimately gave in to the urge 😔
Here's a patch to v0.104 with some fixes and minor improvements.

Fixed

Solve the permission denied error when launching a DHCP server on Linux using Snap #2228. Users experiencing this issue should refresh their snap and call:
snap connect adguard-home:network-control
This won't be required in the future versions.
Use matching fonts in the Custom Filters textarea #2254
Show the correct query type for DNS-over-QUIC queries in query log #2241
Increase the default number of simultaneous requests to improve performance #2257
Always set a secondary DNS in DHCP #1708
Improve stability on DNS proxy restart #2242
Improve logging on DNS proxy restart #2252
Don't show a “Loading” message and don't rerequest logs once we've reached the end of logs on the query log page #2229
Various internal improvements.
AdGuard Home 0.104.0
Date de lancement : 12 février 2021
We have something special for y'all today. Not just an implementation of a new feature but the first ever implementation of a new feature! 😮 This is about DNS-over-QUIC, a new DNS encryption protocol — read on to learn more.
Ah, yes, there's also a bunch of other good stuff, too: DHCP-related changes, a .mobileconfig generator for iOS and macOS, and a handful of other enhancements and bugfixes.

DNS-over-QUIC support #2049

AdGuard Home now natively supports a new DNS encryption protocol called DNS-over-QUIC. DoQ standard is currently in the draft state, and AdGuard Home (and dnsproxy) is it's first open-source implementation.🥇
So what's good about it? 🤔 Unlike DoH and DoT, it uses QUIC as a transport protocol and finally brings DNS back to its roots — working over UDP. It brings all the good things that QUIC has to offer — out-of-the-box encryption, reduced connection times, better performance when data packets are lost. Also, QUIC is supposed to be a transport-level protocol and there are no risks of metadata leaks that could happen with DoH. 🔒
At this moment, the only major public DNS resolver that provides DNS-over-QUIC is AdGuard DNS. 😎 Use quic://dns-unfiltered.adguard.com in the upstreams settings to start using AdGuard DNS "Non-Filtering".

DHCP rework: DHCP6 support, custom DHCP options

We did a huge rework of our DHCP server implementation. Thanks to it, AdGuard Home now supports DHCP6 and allows setting custom DHCP options.
Please note that in order to set DHCP options, you'll need to edit the configuration file.
Add support for DHCPv6: #779
DHCPv6 RA+SLAAC: #2076
DHCP: automatic hostnames: #1956
Add DHCP Options: #1585

iOS and MacOS .mobileconfig generator: #2110

iOS 14 and macOS Big Sur natively support DNS-over-HTTPS and DNS-over-TLS. However, it's not that simple to configure them — you need to install a special "configuration profile" for that. 🤯 In order to make things easier, AdGuard Home can generate these configuration profiles for you. Just head to "Setup Guide" -> "DNS Privacy" and scroll to iOS.

Binary transparency

AdGuard Home binaries are now signed with our GPG key and you can now easily verify that they really come from us: https://github.com/AdguardTeam/AdGuardHome/wiki/Verify-Releases

Other improvements

Allow entering comments to the Upstreams box: #2083
Load upstreams list from a file: #1680
Add ARMv8 to future releases, potentially append a v8 binary to the most recent non-beta release: #2125
Redesign query logs block/unblock buttons: #2050
Treat entries starting with "/" as "://" under specific circumstances: #1950
Use "Null IP" instead of NXDOMAIN by default: #1914
Bootstrap with TCP upstreams: #1843
Add block and unblock buttons to 'check the filtering' result: #1734
ipset feature support: #1191
Add Belarusian and Chinese Traditional HK languages: #2106
Add new language: en-silk: #1796
Use DOH or DOT as bootstrap: #960

Fixed

Reverse lookups return empty answers for hosts from /etc/hosts: #2085
Static lease hostnames are overridden by client-identifier: #2040
Query log doesn't display name for blocked services: #2038
Custom filter editor works with delay: #1657
Incorrect link address: #2209
Smartphone compatible design for user interface: #2152
Misleading information during service installation: #2128
Remove the limit on cache-min-ttl, 3600: #2094
Cannot change minimum TTL override in UI: #2091
Optical Issue on mobile phone: #2090
Setting a large DNS Cache Size in the Web GUI will exceed the unit32 range.: #2056
Clients requests aren't counted properly: #2037
Publish privacy policy on front page (README.md): #1960
Sorting various IP Address Columns in the UI (eg in dhcp static leases) does not sort correctly. They are treated as strings instead of numeric.: #1877
Requests count for clients with CIDR IP addresses: #1824
Téléchargement de AdGuard Pour installer AdGuard, cliquez le fichier indiqué par la flèche Sélectionnez « Ouvrir » et cliquez sur « OK », puis attendez que le fichier soit téléchargé. Dans la fenêtre ouverte, faites glisser l'icône AdGuard dans le dossier « Applications ». Merci d'avoir choisi AdGuard! Sélectionnez « Ouvrir » et cliquez sur « OK », puis attendez que le fichier soit téléchargé. Dans la fenêtre ouverte, cliquez sur « Installer ». Merci d'avoir choisi AdGuard!
Installer AdGuard sur votre appareil mobile