Changelog

1.24.2

• Security. The bundled .NET runtime and PowerShell engine are updated to their current security releases, fixing denial-of-service vulnerabilities in certificate and XML signature handling.
• Fixed. If a program file is in use during an upgrade, Setup now stops with the installed version still running, instead of leaving the service unable to start.
• Fixed. Silent uninstalls no longer wait on a hidden prompt. Settings and data are kept.
• Improved. The components that read vendor repository indexes and winget app manifests are updated.

1.24.0

• Improved. PatchWalker now runs on .NET 10 and PowerShell 7.6, the current long-term support releases. Both are bundled, so there is nothing extra to install.
• Improved. Upgrades remove files left by earlier versions before installing the new ones.

1.23.1

• Security. The bundled .NET runtime, SQLite database engine, PowerShell engine and Microsoft sign-in library are updated to their current security releases. No feature changes.

1.23.0

• Improved. OS Updates is merged into Machines: a Needs attention view, Choose Updates and an Activity panel. Old links open Machines.
• New. Choose individual updates across many machines, including one KB on every machine, then install with confirmation.
• New. A Needs attention tile on the Dashboard.
• Fixed. Actions and More row buttons on Machines are aligned.

1.22.0

• New. Vendor repository mirrors: a catalogue covering Docker CE, GitLab CE, PostgreSQL, NodeSource, Microsoft, HashiCorp, Grafana, Kubernetes and EPEL, plus custom repositories with optional sign-in. Mirror in full or on demand, with size estimates, quotas, pruning and nightly sync.
• New. A Repositories section on the machine page and bulk Configure Repositories on Machines and Groups.
• New. Controller-side signature checking with key pinning.
• New. Mirror health alerts for repeated failures, quota, key and signature problems, stale upstreams and low disk.
• Improved. Consistent metadata snapshots prevent “Hash Sum mismatch” errors. They are always on for vendor repositories and optional for built-in ones.
• Improved. arm64 Ubuntu is now served under /ubuntu-ports/.
• Improved. Downloads are resumable (HEAD and Range requests).
• Improved. A new upstream proxy setting.
• Fixed. Clear Unserved could delete cached data for repositories with matching suite names.
• Fixed. A one-time clean-up of cached file names containing encoded characters.
• Security. The SSH library used to manage Linux machines is updated to address two published advisories. PatchWalker did not use the affected file-copy feature.
• Fixed. “Reboot required” no longer disappears before the machine has restarted. The machine page’s available-updates list is no longer empty. Installed updates no longer reappear as pending. Failed installs no longer show a machine as offline. Leaving a machine page no longer cancels queued work. Reboot Now on the Machines list is now confirmed.
• Bulk reboot. Reboot Machines and Reboot Machines Needing Reboot are available on Machines, Groups and OS Updates, with confirmation and a list of skipped machines.
• One status badge. Every page shows the same status — Not checked, Queued, Checking, Installing, Rebooting, updates pending or Up to date — with Reboot required and Install failed shown alongside.
• Live pages. The machine page and the Dashboard update on their own, and the Dashboard gains a Needs reboot tile and filter.
• Reachability tracking. Each machine shows whether it is reachable, unreachable or failing to sign in.
• Batch outcome panel. A finished batch is summarised as succeeded, nothing to do, failed or needs reboot.
• Duplicate-job protection. A check or install on a machine that is already busy is skipped, with a reason. Updates that are already installed now finish as “Nothing to do”.
• Separate reboot queue. Reboots no longer tie up the job slots. Concurrent Jobs and Concurrent Reboots can be set under Settings.
• Changed. Check and Install now need Updates Manage everywhere; Reboot needs Machines Manage or Updates Manage.
• Changed. Groups bulk install now asks for the reboot policy and confirmation.
• Changed. Windows reboot detection no longer treats pending file-rename operations as a reboot requirement.
• Changed. The Offline tile is now Unreachable.

1.20.7

• Clearer update checks. A check in progress is now shown across the console — a machine reads “Checking” while it runs, on its own page, in the machine list and in its group. Checks keep running on the Controller if you move to another page, and the result appears against the machine when you return.
• Groups stay live. Machine status on the Groups page updates on its own after a check or install, with no reload.
• More resilient status. A machine's known state is preserved if a check is interrupted, so a scan that is cut short never leaves the machine showing the wrong status.
• Interface refinements. Machine names display consistently in upper case, the update worklist keeps its context when you return to it and several small display issues have been corrected.

1.20.5

• Update approvals. Decline or defer specific updates across the whole fleet by KB number or title — the lever to hold a bad patch back everywhere at once.
• Repair Windows Update. Reset a machine's update components remotely, straight from its page in the console, to clear a corrupt update store.
• Chat notifications. Send alerts to Microsoft Teams, Slack or a custom endpoint alongside email.
• Reboot with notice. A new install option gives signed-in users a grace-period warning before a restart.
• Clearer updates. Each update shows its classification (security, critical, feature or driver), and common update and installer errors now come with a plain-English explanation.
• New reporting. A report lists machines not checked in for a set number of days, and activity history can be pruned on a schedule.
• Wider Linux support including openSUSE (zypper); selective Linux installs now apply exactly the packages you choose.
• Enrolment fix. Machines with a name longer than 15 characters now enrol with their full hostname, resolving a connection failure on those hosts.
• Accessibility improvements to the console, more reliable scheduled checks, and a security and correctness hardening pass across the codebase.

1.20.2

• Important fix for Domain / gMSA Controllers. An earlier installer could damage the machine key-store permissions during an upgrade, which on some machines broke the host's Remote Desktop. This release corrects the permission grant and ships a repair tool for any affected machine. Standalone installs were not affected.

1.20

• Idle session timeout. After a configurable quiet period the console shows a 60-second countdown, then signs the user out; the sign-in cookie's lifetime is tightened to match, while active operators stay signed in automatically.
• The Controller identifies itself with an automatic badge, and patching it — reboot included — is safe end to end: outcomes are recorded before the shutdown, interrupted reboot commands are never re-sent, and the console reconnects once the Controller is back.
• Upgrades refresh cleanly — stylesheets are version-stamped so the console never renders with a stale cached stylesheet after an upgrade.
• The Updates activity log persists across navigation while work is running.

1.18

• Job-completion notifications. Installs, reboots and connection tests report their outcome wherever you are in the console, with batch installs summarised in one notification; messages now say exactly what they acted on.
• Verified reboots. A reboot job confirms the machine actually went down and came back before reporting success, and a blocked shutdown fails with the reason.
• Self-healing re-enrolment. Re-running the enrolment script on a known machine updates its record automatically after the Controller verifies the new certificate against the live machine.
• Editable roles with a cleaner permissions dialog, plus reliability fixes across the dashboard, update worklist and connection tests.

1.17

• Simpler Controller addressing. The Controller’s address is now resolved automatically from its fully-qualified name; the manual hostname field is gone. Application and software deployment work out of the box without configuring a mirror.
• In-app update check. The Controller can check GitHub for a newer release, download the installer and verify its SHA-256, with an optional daily check and an “update available” badge. Updates are always applied manually on the Controller.
• Clearer update progress in the worklist, with checks and installs that continue while you navigate elsewhere, and a dashboard that reflects only currently outstanding updates.

1.15 — initial public release

The first publicly available build. Highlights of what PatchWalker does at launch:

• Agentless management of Windows (WinRM over HTTPS) and Linux (SSH) from one Controller.
• OS, application and software updates, with per-machine and bulk install.
• Install schedules targeting OS updates, software updates, or both, with maintenance windows and reboot policy.
• Dashboard, reporting and exports, plus scheduled compliance emails.
• Air-gapped Ubuntu Pro / ESM via a built-in package mirror and contracts proxy.
• Role-based access, Microsoft Entra SSO and a break-glass administrator.
• Encrypted, scheduled backups to a local or network folder.