chore(deps): update netbird

[renovate]

This PR contains the following updates:

Package	Update	Change
docker.io/netbirdio/dashboard	minor	v2.20.1 -> v2.22.2
docker.io/netbirdio/management	minor	0.59.8 -> 0.60.4
docker.io/netbirdio/netbird	minor	0.59.8 -> 0.60.4
docker.io/netbirdio/relay	minor	0.59.8 -> 0.60.4
docker.io/netbirdio/signal	minor	0.59.8 -> 0.60.4

---

Release Notes

netbirdio/dashboard (docker.io/netbirdio/dashboard)

v2.22.2

Compare Source

What's Changed

• Increase ssh detection timeout by @​heisbrot in #​512

Full Changelog: netbirdio/dashboard@v2.22.1...v2.22.2

v2.22.1

Compare Source

What's Changed

• Add ssh policy info for peers by @​heisbrot in #​511

Full Changelog: netbirdio/dashboard@v2.22.0...v2.22.1

v2.22.0

Compare Source

What's Changed

• Remove dns0eu by @​heisbrot in #​508
• Bump browser ssh versions for ssh rewrite by @​heisbrot in #​510

Full Changelog: netbirdio/dashboard@v2.21.0...v2.22.0

v2.21.0

Compare Source

What's Changed

• Add multi-group support for JWT allow groups with tag system by @​Yanis64 in #​500
• Feature/groups page by @​heisbrot in #​498
• Add wasm client version by @​heisbrot in #​503
• Fix native ssh detection by @​heisbrot in #​505
• Add group update activity event by @​heisbrot in #​504

New Contributors

• @​Yanis64 made their first contribution in #​500

Full Changelog: netbirdio/dashboard@v2.20.2...v2.21.0

v2.20.2

Compare Source

What's Changed

• Fix active toggle for p2p policies by @​heisbrot in #​501
• Add universal macOS install by @​heisbrot in #​501
• Fix RDP scrollbar by @​heisbrot in #​501

Full Changelog: netbirdio/dashboard@v2.20.1...v2.20.2

netbirdio/netbird (docker.io/netbirdio/management)

v0.60.4

Compare Source

What's Changed

• [client] Sleep detection on macOS by @​pappz in #​4859
• [relay] use exposed address for healthcheck TLS validation by @​shuuri-labs in #​4872

Full Changelog: netbirdio/netbird@v0.60.3...v0.60.4

v0.60.3

Compare Source

What's Changed

• [management] Remove TestBufferUpdateAccountPeers by @​crn4 in #​4839
• [client, management, signal, relay] Update go.mod to use Go 1.24.10 and upgrade x/crypto dependencies by @​mlsmaycon in #​4828
• [management] Fix SSH JWT issuer derivation for IDPs with path components by @​sgtaziz in #​4844
• [management] Preserve validator settings on account settings update by @​bcmmbaga in #​4862
• [client] Make mss clamping optional for nftables by @​lixmal in #​4843
• [client] Allow selection/deselection of network resources on Android by @​doromaraujo in #​4607
• [client] Support disable search domain for custom zones by @​mlsmaycon in #​4826
• [client] feat: Add support for displaying device code (UserCode) on Android TV by @​shuuri-labs in #​4800
• [client] Open browser for SSH automatically by @​lixmal in #​4838
• [client] Add excluded port range handling for PKCE flow by @​mlsmaycon in #​4853

New Contributors

• @​sgtaziz made their first contribution in #​4844
• @​shuuri-labs made their first contribution in #​4800

Full Changelog: netbirdio/netbird@v0.60.2...v0.60.3

v0.60.2

Compare Source

What's Changed

• [client] Increase ssh detection timeout by @​lixmal in #​4827

Full Changelog: netbirdio/netbird@v0.60.1...v0.60.2

v0.60.1

Compare Source

What's Changed

• [management] Fix direct peer networks route by @​pascal-fischer in #​4802
• [management] pass config to controller by @​pascal-fischer in #​4807
• [management] Add native ssh port rule on 22 by @​mlsmaycon in #​4810

Full Changelog: netbirdio/netbird@v0.60.0...v0.60.1

v0.60.0

Compare Source

What's New

Native SSH Access & OpenSSH Integration

NetBird v0.60.0 ships a complete rewrite of SSH access. Every peer can now run a built-in SSH server, giving you identity-aware, private SSH access over your NetBird network — using either the netbird ssh command or your existing OpenSSH clients.

Highlights

• Built-in SSH server on every peer - Enable with netbird up --allow-server-ssh and get a native SSH endpoint without exposing port 22 to the internet.

• Identity-aware access with JWT - SSH sessions are authenticated via your IdP (OIDC/JWT) by default, so you know which user accessed which machine.

• Works with netbird ssh and OpenSSH - Use netbird ssh user@<peer-ip> or standard ssh, sftp, and scp commands; NetBird configures OpenSSH automatically via a drop-in 99-netbird.conf.

• Port 22, transparently secured - NetBird listens on TCP 22022 and redirects NetBird-network port 22 traffic to it, so existing SSH workflows keep working without changing ports.

• Advanced features when you need them - Optional SFTP, local and remote port forwarding, root login, and JWT token caching (--ssh-jwt-cache-ttl) for fewer auth prompts.

• Machine identity mode (legacy behavior) - Prefer host-based trust? Disable JWT auth with --disable-ssh-auth and rely purely on network-level ACLs.

How it works

1. Enable the SSH server on the target peer

netbird down  # if already running
netbird up --allow-server-ssh

Add optional flags for SFTP, port forwarding, or root login as needed:

netbird up --allow-server-ssh \
  --enable-ssh-local-port-forwarding \
  --enable-ssh-remote-port-forwarding \
  --enable-ssh-sftp \
  --enable-ssh-root

2. Create an ACL policy for SSH
   Allow TCP port 22022 from your SSH client peers/groups to your SSH server peers/groups in Access Control.

3. Enable SSH in the Dashboard
   Open the target peer → enable SSH Access.

4. Connect via CLI or OpenSSH

• NetBird CLI:

netbird ssh [email protected]

• OpenSSH:

ssh [email protected]
sftp [email protected]
scp file.txt [email protected]:/path

📖 Read more in the SSH documentation: https://docs.netbird.io/how-to/ssh

---

Client Improvements

• Updated the client login success page with an improved user experience.
    #​4797
• Reverted deprecated gRPC client code migration to restore expected behavior.
    #​4805

---

Management Improvements

• Fixed handling of port ranges in route firewall rules to ensure accurate rule application.
    #​4801

---

Upgrade & Compatibility Notes

• ⚠️ NetBird SSH in v0.60.0 is a breaking change:

  • Server port changed from 44338 → 22022
  • Authentication moved from machine public keys to JWT-based user identity
  • Implicit firewall rules were removed - you now need an explicit ACL for port 22022

• ⚠️ Version compatibility: v0.60.0+ SSH is not backward compatible with older peers.
  For self-hosted environments, we recommend updating in this order:

  1. Management server
  2. Dashboard (for browser SSH, if used)
  3. SSH servers first (peers with --allow-server-ssh)
  4. SSH clients last (netbird ssh users)

Full Changelog: v0.59.13...v0.60.0

v0.59.13

Compare Source

What's Changed

• [management] activity events on group updates by @​pascal-fischer in #​4750
• Bump github.com/containerd/containerd from 1.7.27 to 1.7.29 by @​dependabot[bot] in #​4756
• [management] incremental network map builder by @​crn4 in #​4753
• [management] add pat rate limiting by @​pascal-fischer in #​4741
• [management] remove toAll firewall rule by @​crn4 in #​4725
• [management] remove GLOBAL when disabling foreign keys on mysql by @​pascal-fischer in #​4615
• [management ] remove timing logs by @​pascal-fischer in #​4761
• [client] Create networkd.conf.d if it doesn't exist by @​lixmal in #​4764
• [management] fix pg db deadlock after app panic by @​crn4 in #​4772
• [client] Fix agent reference by @​pappz in #​4776
• [management] move network map logic into new design by @​pascal-fischer in #​4774
• [management] Removed policy posture checks on original peer by @​pascal-fischer in #​4779
• [client] Fix shutdown blocking on stuck ICE agent close by @​lixmal in #​4780
• [client] Add quick actions window by @​doromaraujo in #​4717
• [client] Use stdnet with a context to avoid DNS deadlocks by @​lixmal in #​4781
• [client] Replace ipset lib by @​lixmal in #​4777

Full Changelog: netbirdio/netbird@v0.59.12...v0.59.13

v0.59.12

Compare Source

What's Changed

• [client] Migrate deprecated grpc client code by @​lixmal in #​4687
• [client] Fix netstack dns forwarder by @​lixmal in #​4727
• [client] Extend Darwin network monitoring with wakeup detection (cleanup branch) by @​pappz in #​4723
• Bump github.com/quic-go/quic-go from 0.48.2 to 0.49.1 by @​dependabot[bot] in #​4621
• [management] update db connection lifecycle configuration by @​pascal-fischer in #​4740
• [client] Set up networkd to ignore ip rules by @​lixmal in #​4730
• [client] Clamp MSS on outbound traffic by @​lixmal in #​4735
• [client] Allow INPUT traffic on the compat iptables filter table for nftables by @​lixmal in #​4742
• [client] Block on all subsystems on shutdown by @​lixmal in #​4709
• [client] Add login_hint to oidc flows by @​lixmal in #​4724
• [client] Add dns config to debug bundle by @​lixmal in #​4704

Full Changelog: netbirdio/netbird@v0.59.11...v0.59.12

v0.59.11

Compare Source

What's Changed

• [client] Fix UI panic when switching profiles by @​lixmal in #​4718

Full Changelog: netbirdio/netbird@v0.59.10...v0.59.11

v0.59.10

Compare Source

What's Changed

• [client] Fix Connect/Disconnect buttons being enabled or disabled at the same time by @​lixmal in #​4711
• [client] Use management-provided dns forwarder port on the client side by @​lixmal in #​4712

Full Changelog: netbirdio/netbird@v0.59.9...v0.59.10

v0.59.9

Compare Source

What's Changed

• [management] Add peer disapproval reason by @​bcmmbaga in #​4468
• [client] Fix active profile name in debug bundle by @​lixmal in #​4689
• [signal] Fix HTTP/WebSocket proxy not using custom certificates by @​bcmmbaga in #​4644
• [client] Fix macOS state-based dns cleanup by @​lixmal in #​4701
• [client] Clean up bsd routes independently of the state file by @​lixmal in #​4688
• Include expired and routing peers in DNS record filtering by @​bcmmbaga in #​4708
• [management] rewire account manager to permissions manager by @​pascal-fischer in #​4673
• [client] Redirect dns forwarder port 5353 to new listening port 22054 by @​lixmal in #​4707
• [client] The status cmd will not be blocked by the ICE probe by @​pappz in #​4597

Full Changelog: netbirdio/netbird@v0.59.8...v0.59.9

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.