AdGuard Home v0.107.71

As it turns out, our changes to optimistic DNS cache in the previous update were a little too optimistic, and we’ve broken it a little bit in the process. This hotfix brings everything back to normal, and, as a bonus, we’re adding new settings for users to manually set the upper age limit and TTL for optimistic cache’s stale answers.

Acknowledgments

A special thanks to our community moderators team and to everyone who filed and inspected issues, added translations, and helped us test this release!

Full changelog

See also the v0.107.71 GitHub milestone.

Changed

• Stale records in optimistic DNS cache now have an upper age limit controlled by dns.cache_optimistic_max_age. The default value is 12 hours.

• TTL for stale answers from optimistic DNS cache is now controlled by dns.cache_optimistic_answer_ttl. The default value is 30 seconds.

Configuration changes

In this release, the schema version has changed from 31 to 32.

• Added a new string fields dns.cache_optimistic_answer_ttl and dns.cache_optimistic_max_age.

  # BEFORE:
  'dns':
    'cache_enabled': true
    'cache_optimistic': true
    # …
  
  # AFTER:
  'dns':
    'cache_enabled': true
    'cache_optimistic': true
    'cache_optimistic_answer_ttl': '30s'
    'cache_optimistic_max_age': '12h'
    # …

  To roll back this change, set the schema_version back to 31.

Fixed

• Optimistic DNS cache not working (#8148).

AdGuard Home v0.108.0-b.80

Changes compared to the previous beta, v0.108.0-b.79. See CHANGELOG.md for all changes.

Full changelog

Security

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.25.5.

Changed

• Stale records in optimistic DNS cache now have an upper age limit controlled by dns.cache_optimistic_max_age. The default value is 12 hours.

• TTL for stale answers from optimistic DNS cache is now controlled by dns.cache_optimistic_answer_ttl. The default value is 30 seconds.

Configuration changes

In this release, the schema version has changed from 31 to 32.

• Added a new string fields dns.cache_optimistic_answer_ttl and dns.cache_optimistic_max_age.

  # BEFORE:
  'dns':
    'cache_enabled': true
    'cache_optimistic': true
    # …
  
  # AFTER:
  'dns':
    'cache_enabled': true
    'cache_optimistic': true
    'cache_optimistic_answer_ttl': '30s'
    'cache_optimistic_max_age': '12h'
    # …

  To roll back this change, set the schema_version back to 31.

AdGuard Home v0.107.70

Even when the update we roll out is on the smaller side, we still aim for some diversity in the changelog. A little bit of vulnerability shore-ups, a smidge of bug fixes, a new thing or two, and a couple generic changes — a tried and tested recipe for a good, solid update 🧑‍🍳

Acknowledgments

A special thanks to our community moderators team and to everyone who filed and inspected issues, added translations, and helped us test this release!

Full changelog

See also the v0.107.70 GitHub milestone.

Security

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.25.5.

Added

• New field "start_time" in the GET /control/status response.

Changed

• Stale records in optimistic DNS cache now have an upper age limit of 12 hours.
• New blocked services UI.

Fixed

• Generated mobileconfig could not be installed on macOS 26.1.

AdGuard Home v0.108.0-b.79

Changes compared to the previous beta, v0.108.0-b.78. See CHANGELOG.md for all changes.

Full changelog

Security

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.25.4.

Added

• New field "start_time" in the GET /control/status response.

Changed

• New blocked services UI.

Fixed

• Generated mobileconfig could not be installed on macOS 26.1.

AdGuard Home v0.107.69

AdGuard Home v0.107.69 is here — just a quick pit stop to fix two pesky bugs that tried to sneak past us. No new features this time, but everything should now run a bit smoother (and those bugs have been shown the door).

Full changelog

See also the v0.107.69 GitHub milestone.

Changed

• Node.js 24 is now used to build the frontend.

Deprecated

• Node.js 20 and 22 support.

Fixed

• DHCP settings could not be saved (#8075).
• DNS Rewrite edit modal did not populate with the correct values (#8072).

Removed

• The outdated querylog anonymization script.

AdGuard Home v0.108.0-b.78

Changes compared to the previous beta, v0.108.0-b.77. See CHANGELOG.md for all changes.

Full changelog

Security

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.25.3.

Added

• New DNS rewrite settings endpoints GET /control/rewrite/settings and PUT /control/rewrite/settings/update (#1765). See openapi/openapi.yaml for details.

Changed

• Node.js 24 is now used to build the frontend.
• POST /control/rewrite/add and PUT /control/rewrite/update now accept the optional field "enabled" (#1765). See openapi/openapi.yaml for details.

Configuration changes

In this release, the schema version has changed from 30 to 31.

• Added a new boolean field filtering.rewrites_enabled to globally enable/disable DNS rewrites.

• Added a new boolean field enabled for each entry in filtering.rewrites to toggle individual rewrites.

  # BEFORE:
  'filtering':
    'rewrites':
      - 'domain': test.example
        'answer': 192.0.2.0
    # …
  
  # AFTER:
  'filtering':
    'rewrites_enabled': true
    'rewrites':
      - 'domain': test.example
        'answer': 192.0.2.0
        'enabled': true
    # …

  To roll back this change, set schema_version back to 30.

Deprecated

• Node.js 20 and 22 support.

Fixed

• DHCP settings could not be saved (#8075).
• DNS Rewrite edit modal did not populate with the correct values (#8072).

Removed

• The outdated querylog anonymization script.

AdGuard Home v0.107.68

Let's get “the usual” out of the way: we’ve made some security updates, as we always do, and even managed to make do without any bug fixes this time, for better or for worse. But let’s focus on the main course: new option to enable and disable DNS rewrite rules 🚦

This was one of the earlier feature requests, and we are happy to finally deliver. You can enable and disable DNS rewrite rules all at once or do so on an individual rewrite basis — both by editing YAML files or via UI.

Acknowledgments

A special thanks to our community moderators team and to everyone who filed and inspected issues, added translations, and helped us test this release!

Full changelog

See also the v0.107.68 GitHub milestone.

Security

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.25.3.

Added

• New DNS rewrite settings endpoints GET /control/rewrite/settings and PUT /control/rewrite/settings/update (#1765). See openapi/openapi.yaml for details.
• New fields "groups" and "group_id" added to the HTTP API (GET /control/blocked_services/all). See openapi/openapi.yaml for the full description.

Changed

• POST /control/rewrite/add and PUT /control/rewrite/update now accept the optional field "enabled" (#1765). See openapi/openapi.yaml for details.

Configuration changes

In this release, the schema version has changed from 30 to 31.

• Added a new boolean field filtering.rewrites_enabled to globally enable/disable DNS rewrites.

• Added a new boolean field enabled for each entry in filtering.rewrites to toggle individual rewrites.

  # BEFORE:
  'filtering':
    'rewrites':
      - 'domain': test.example
        'answer': 192.0.2.0
    # …
  
  # AFTER:
  'filtering':
    'rewrites_enabled': true
    'rewrites':
      - 'domain': test.example
        'answer': 192.0.2.0
        'enabled': true
    # …

  To roll back this change, set schema_version back to 30.

AdGuard Home v0.108.0-b.77

Changes compared to the previous beta, v0.108.0-b.76. See CHANGELOG.md for all changes.

Full changelog

Security

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.25.2.

Added

• New fields "groups" and "group_id" added to the HTTP API (GET /control/blocked_services/all). See openapi/openapi.yaml for the full description.
• The HaGeZi's DNS Rebind Protection filter for protecting against DNS rebinding attacks (#102).

Fixed

• Excessive configuration file overwrites when visiting the Web UI and a non-empty language is set.

AdGuard Home v0.107.67

Some would call this update small — we prefer the term compact. A new DNS filter, some bug fixing, some optimization — what more can a man ask for? Short and sweet 🍰

Acknowledgments

A special thanks to our community moderators team and to everyone who filed and inspected issues, added translations, and helped us test this release!

Full changelog

See also the v0.107.67 GitHub milestone.

Added

• The HaGeZi's DNS Rebind Protection filter for protecting against DNS rebinding attacks (#102).
• Support for configuring the suggested default HTTP port for the installation wizard via the ADGUARD_HOME_DEFAULT_WEB_PORT environment variable (useful for vendors).

Changed

• Optimized matching of filtering rules.

Fixed

• Excessive configuration file overwrites when visiting the Web UI and a non-empty language is set.
• Lowered the severity of log messages for failed deletion of old filter files (#7964).

AdGuard Home v0.108.0-b.76

Changes compared to the previous beta, v0.108.0-b.75. See CHANGELOG.md for all changes.

Full changelog

Added

• Support for configuring the suggested default HTTP port for the installation wizard via the ADGUARD_HOME_DEFAULT_WEB_PORT environment variable (useful for vendors).

Changed

• Optimized matching of filtering rules.

Fixed

• Lowered the severity of log messages for failed deletion of old filter files (#7964).