Download Latest Version
patchmon-agent-windows-amd64.exe (12.2 MB)
Get an email when there's a new version of PatchMon
| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| sbom-source.cdx.json | 2026-08-15 | 574.2 kB | |
| SHA256SUMS | 2026-08-15 | 1.3 kB | |
| patchmon-server-linux-arm64 | 2026-08-15 | 44.2 MB | |
| patchmon-server-linux-386 | 2026-08-15 | 44.5 MB | |
| patchmon-server-linux-arm | 2026-08-15 | 44.4 MB | |
| patchmon-server-linux-amd64 | 2026-08-15 | 46.9 MB | |
| patchmon-agent-linux-arm64 | 2026-08-15 | 11.1 MB | |
| patchmon-agent-windows-amd64.exe | 2026-08-15 | 12.2 MB | |
| patchmon-agent-freebsd-386 | 2026-08-15 | 11.2 MB | |
| patchmon-agent-freebsd-arm | 2026-08-15 | 11.3 MB | |
| patchmon-agent-freebsd-arm64 | 2026-08-15 | 10.9 MB | |
| patchmon-agent-freebsd-amd64 | 2026-08-15 | 11.8 MB | |
| patchmon-agent-linux-amd64 | 2026-08-15 | 12.0 MB | |
| patchmon-agent-linux-386 | 2026-08-15 | 11.5 MB | |
| patchmon-agent-linux-arm | 2026-08-15 | 11.5 MB | |
| patchmon-agent-windows-arm64.exe | 2026-08-15 | 11.1 MB | |
| README.md | 2026-08-15 | 5.2 kB | |
| Version 2.1.3 source code.tar.gz | 2026-08-15 | 5.1 MB | |
| Version 2.1.3 source code.zip | 2026-08-15 | 5.6 MB | |
| Totals: 19 Items | 305.9 MB | 0 | |
A bug-fix release: single sign-on with ADFS, Mattermost and Rocket.Chat webhooks, compliance content on installs outside the official Docker image, and laptops that showed as stale after waking.
Upgrading
:::bash
docker compose pull
docker compose up -d
No compose changes, no new settings, no database changes. Nothing to do on your agents.
Fixes
Single sign-on failing with no email in UserInfo or id_token. Two causes, both fixed: ADFS sends single-valued claims as JSON arrays, which were not read, and an empty email in a provider's UserInfo response hid a valid one in the signed ID token. If you still see this on 2.1.3, there is a troubleshooting entry in Setting up OIDC SSO.
Mattermost and Rocket.Chat webhook destinations failed every delivery with HTTP 400. Both are now detected from their /hooks/<token> URL and sent a compatible payload. Existing destinations start working on upgrade, with nothing to configure.
Compliance content was not being served on installs outside the official Docker image, the Proxmox LXC script in particular. Agents asking for a datastream got a 503 while Compliance Settings reported the directory as empty, so this was broken rather than mislabelled. The release is now read from the datastreams themselves. If you saw that message and moved on, check your fleet's compliance versions after upgrading.
Laptops and other machines that suspend showed as stale for days after waking. The server now asks for a report when an agent reconnects past its update interval. If you shortened your update interval to work around this, you can put it back.
Worth knowing
- Generic webhook destinations: the JSON body has gained a top-level
textkey so any Slack-compatible receiver works without configuration. Existing fields are unchanged, but a receiver that rejects unknown keys will start returning 400. - A single host reporting a malformed compliance version could stop SSG update checks for every host on that server, with only a logged warning. This is not new in 2.1.3.
- Downloads carry
SHA256SUMS, an SBOM and a provenance attestation again. A packaging fault meant v2.1.0, v2.1.1 and v2.1.2 shipped without them.
Every change in this release
| Issue | PR | Change |
|---|---|---|
| #805 | #1061 | ADFS logins failed because single-valued claims arrive as JSON arrays and only plain strings were accepted. Array-encoded string and boolean claims are now read |
| #805 | #1061 | An empty email in a provider's UserInfo response hid the address in the signed ID token and failed the login. Empty and whitespace-only values now count as absent |
| #805 | #1061 | Verified-email claims are now read from whichever source supplied the email, so an unverified assertion cannot override a signed one |
| #851 | #1061 | Mattermost and Rocket.Chat webhook destinations failed every delivery with HTTP 400. Both are now detected by their /hooks/<token> path and sent a compatible payload |
| #851 | #1061 | The generic webhook body gained a top-level text key, so any Slack-compatible receiver on a non-standard path works without configuration. Existing fields are unchanged |
| #1060 | #1061 | Servers whose SSG content lacked the .ssg-version marker could not distribute compliance content at all, and reported the directory as empty. The release is now read from the datastreams |
| #1060 | #1061 | One host reporting a malformed SSG version stopped compliance update checks for every host on the server |
| #351 | #1061 | Hosts that suspend showed as stale long after waking. The server now requests a report when an agent reconnects past its update interval |
What is coming next
Bug fixes are tracked in GitHub milestones. Feature requests live on feedback.patchmon.net, where you can propose an idea, vote on existing ones, and see what has been accepted onto the roadmap.
Questions about this release
This release has its own thread under New Release Discussions. Open a new issue for a reproducible bug not already covered.