PatchMon Files

A bug-fix and security release: RDP survives a host reboot, Patch selected works for packages with spaces in their names, enrolment reruns stop creating duplicate hosts, compliance scanner installs no longer stall or show as failed, and the server and agent are built with Go 1.26.10.

Upgrading

:::bash
docker compose pull
docker compose up -d

No compose changes. A migration adds two job history indexes at startup. Agents update through auto-update. If you set JWT_EXPIRES_IN, see Worth knowing.

Fixes

RDP stopped working after a host reboot, with guacd shown as Exited. The server now waits for the database and Redis at startup instead of exiting. On older versions, docker compose up -d brings guacd back.

Patch selected said "No hosts have a pending update for these packages". This happened for package names containing a space or +, such as Windows cumulative updates. The hosts that need the update are now listed.

Rerunning an enrolment script in a container created a second host. Hosts without /etc/machine-id now keep a stable ID, so reruns are recognised as the same host.

Security: Go 1.26.10. Fixes GO-2026-6809, where certificate verification trusted a set of compromised intermediate certificates. Upgrading is all that is needed.

Compliance scanner installs that never ran, or showed as failed while running. Pressing Apply on a host whose compliance flags were already on now installs the missing scanner. Hosts in Enabled mode that have no scanner get one automatic install when the agent starts. While an install runs, the host shows Installing rather than Installation Failed. Installs behind a reverse proxy that sets X-Forwarded-Host no longer time out after five minutes.

A compliance scan with no rules was recorded as a clean pass. A scan that evaluated no rules is now stored as failed with "No rules available for this OS", and the host's Compliance tab says so.

Worth knowing

• Check JWT_EXPIRES_IN if you set it: only a number followed by m, h or d is accepted. Anything else now means 1 hour instead of 30 days.
• Duplicate compliance profiles already stored stay listed: new scans no longer create them.
• Ubuntu 26.04 cannot be compliance-scanned yet: the scanner installs, but the upstream ComplianceAsCode content for 26.04 publishes no CIS profile, so scans report "No rules available for this OS" until upstream ships one.
• One alert per failed scan: when every scan in a submission fails, the "scan completed" notification is no longer sent alongside the failure.

Every change in this release

What is coming next

Bug fixes are tracked in GitHub milestones. Feature requests live on feedback.patchmon.net, where you can propose an idea, vote on existing ones, and see what has been accepted onto the roadmap.

Questions about this release

This release has its own thread under New Release Discussions. Open a new issue for a reproducible bug not already covered.