2021.4-beta1

This release is for desktop only.

Added

• When MULLVAD_MANAGEMENT_SOCKET_GROUP is set, only allow the specified group to access the
  management interface UDS socket. This means that only users in that group can use the CLI and GUI.
• Support WireGuard over TCP for custom VPN relays in the CLI. (Our relays don't support this yet).
• Make app native on Apple Silicon.
• Support WireGuard multihop using an entry endpoint constraint in the CLI.
• Add Ad and tracker blocking to the desktop app. Implemented via DNS on the relays.

Windows

• Add split tunneling as a beta feature. Allows excluding some applications from the VPN tunnel.

Android

• Added support of adaptive icons (available only from Android 8).

Changed

• Upgrade OpenVPN from 2.5.0 to 2.5.1.
• Replace CLI command mullvad custom-dns with the new command mullvad dns.
• Upgrade wireguard-go to 20210521230051 (Windows: v0.3.14)

Linux

• Only allow packets with the mark set to 0x6d6f6c65 to communicate with the relay server.
  Previously, bridges were expected to run as root instead.
• Use an ICMP socket instead of relying on a ping binary in $PATH to establish if a tunnel is
  working.

Android

• Improve stability by running the UI and the tunnel management logic in separate processes.
• Remove dialog warning that only custom local DNS servers are supported, since public custom DNS
  servers are now supported.

macOS

• Update shape of macOS icon to be in line with Apple's guidelines.

Fixed

• Fix relay selection failing to pick a WireGuard relay when no tunnel protocol is specified.
• Fix time left not always being translated in desktop app settings.
• Fix API address cache to use the supplied ports instead of always using port 443.
• Do not try to parse an empty account history.

Windows

• Prevent tray icons from being extracted to %TEMP% directory.
• Fix failure to create Wintun adapter due to a residual network interface by upgrading Wintun to
  0.10.4.
• Wait indefinitely for IP interfaces to attach to the tunnel device to prevent early timeouts,
  and errors setting interface metrics.
• Prevent Microsoft Store from dropping packets in WireGuard tunnels.

Linux

• Fix find mullvad-vpn.desktop in XDG_DATA_DIRS instead of using hardcoded path.

MacOS

• Set correct permissions for daemon's launch file in installer.
• Fix downgrades on macOS silently keeping previous version.
• Fix other menubar context menus not always closing when opening app on macOS 11.

Android

• Fix UI sometimes not updating correctly while no split screen or after having a dialog from
  another app appear on top.
• Fix request to connect from notification or quick-settings tile not connecting if VPN permission
  isn't granted to the app. The app will now show the UI to ask for the permission and correctly
  connect after it is granted.
• Fix quick-settings tile sometimes showing the wrong tunnel state.
• Fix TV-only apps not appearing in the Split Tunneling screen.

Security

Linux

• Drop packets being forwarded unless they are approved by the same rules as incoming or outgoing
  traffic.

android/2021.1

This release is for Android only.

This release is identical to 2021.1-beta1.

2021.3

This release is for desktop only.

This release is identical to 2021.3-beta2.

2021.3-beta2

This release is for Windows only.

This release has no functional changes compared to 2021.3-beta1. The only
difference is that the installer and the binaries are signed with our
new code signing certificate. The old one is expiring.

The new certificate is brand new and Windows does not really trust it yet.
So there might be warnings when installing this for a while.

2021.3-beta1

This release is for desktop only.

Added

• Preserve log of old daemon instance when upgrading on Desktop.

Linux

• Always enable src_valid_mark config option when connecting to allow policty based routing.

Changed

• Allow whitespace in account token in CLI.
• Read account token from standard input unless given as an argument in CLI.
• Make WireGuard automatic key rotation interval mandatory and between 1 and 7 days.
• Show default, minimum, and maximum key rotation intervals in CLI.
• Attempt to send problem reports using other endpoints if using the primary one fails.

Fixed

• Fix GUI not showing correct view if disconnected from the daemon during app startup.
• Fix incorrectly displayed "inconsistent version" text in settings if disconnected from daemon on
  startup.

Linux

• Further improve offline monitor to properly receive ENETUNREACH.

Android

• Fix status bar having the wrong color after logging out.

Security

• Always reconnect appropriately after an upgrade. Previously, installing the app twice in
  succession, with auto-connect disabled, would cause it to re-launch in the disconnected state.

android/2021.1-beta1

This release is for Android only. From now on, Android releases will have this new header format
that is the same as the git tag they receive: android/<version>.

Added

• Enable isolation of the Electron renderer process to protect against potentially malicious third
  party dependencies.
• Add 51820 to list of WireGuard ports in app settings.
• Add option to connect to WireGuard relays over IPv6.
• Add Burmese translations.

Android

• Allow reaching the API server when connecting, disconnecting or in a blocked state.
• Add FAQs & Guides menu entry to the Settings screen.
• Add TV banner for better user experience and requirements.
• Style StatusBar and NavigationBar to make our app a bit more beautiful.

Changed

• Update Electron from 11.0.2 to 11.2.1 which includes a newer Chromium version and
  security patches.
• Allow provider constraint to specify multiple hosting providers.
• Only download a new relay list if it has been modified.
• Connect to the API only via TLS 1.3
• Shrink account history capactity from 3 account entries to 1.

Android

• WireGuard key is now rotated sooner: every four days instead of seven.

Windows

• Upgrade Wintun from 0.9.2 to 0.10.1.

Fixed

• Fix delay in showing/hiding update notification when toggling beta program.
• Improve responsiveness when reconnecting after some failed connection attempts.

Windows

• Fix "cannot find the file" error while creating a Wintun adapter by upgrading Wintun.
• Retry when creating a WireGuard tunnel fails due to no default routes being found.

Linux

• Stop using NM for managing DNS if it's newer than 1.26.

Linux

• Fix DNS issues where NM would overwrite Mullvad tunnel's DNS config in systemd-resolved.
• Fix issues with hosts where the firewall is doing reverse path filtering.

Android

• Fix input area sometimes disappearing when returning to the Login screen.

2021.2

This release is for desktop only.

This release is identical to 2021.2-beta1, see that change log for all changes since last stable release.

2021.2-beta1

Fixed

Linux

• Fix crash when trying to apply IPv6 routes for OpenVPN when IPv6 is disabled.
• Ignore failure to add IPv6 split-tunneling routing rules when they fail due to IPv6 being
  unavailable.

Windows

• Fix failure when Wintun adapter name conflicts with that of a non-Wintun adapter.
• Fix detection of SetupAPI patch when not installed by KB2921916.

2021.1

Fixed

• Fix crash on desktop when entering problem report view when using an outdated app version.

The rest is identical to 2021.1-beta2, see that change log and previous betas for all changes since last stable release.

2021.1-beta2

Fixed

• Make it impossible to apply an empty list of custom DNS server IPs.
  Stops the daemon from getting stuck in the offline state on macOS.

Windows

• Only load and unload the Wintun driver once instead of on every connection.
  Will hopefully fix an issue where it gave an error