Changelog¶

WAPT-2.7 Serie¶

WAPT-2.7.0.19665 (2026-10-26)¶

hash: b0b66d95

This is a COTS security release and a bugfix release. It is highly recommended to upgrade due to potential MiTM attacks due to the eMudhra Certificate Authority compromise.

[SEC] waptcore: update COTS Python 3.11.17 -> 3.11.18. python-certifi to 2026.10.19 for leaked emudhra certificate issue. 7zip dll 26.04 -> 26.05. Sqlite3 dll 3.53.4 -> 3.54.1.
[FIX] waptcore: fix potential CLDAP error (domain / domain controller not found in djoin). TPyLdapClient.Init: make only one CldapGetDomainInfo query to get ldap controller given the domain_name
[FIX] waptagent: fix wapt-get edit --skip_package_check option not handled
[IMP] waptagent: add a wapt-get build-waptagent --config-name option to specify json dynamic config to embed
[FIX] waptagent: wapt-get build-waptagent fix scan local repo
[FIX] waptconsole: add mac as macOS alias in package filters
[FIX] waptself: fix waptserver-ldap auth regression
[UPD] waptself: restore last package sort (newest date by default)
[FIX] waptself: fix package caption and button for HighDPI display, fix focused color on package cards
[FIX] waptself: fix potential exception at startup due to size = 0

WAPT-2.7.0.19633 (2026-10-22)¶

hash: 3f0a1072

This is a bugfix release and COTS update

[UPD] waptconsole: in self service group don’t show target_os by default
[IMP] waptconsole: when editing a waptselfservice configuration, don’t filter packages on target_os in selfservice group
[FIX] waptconsole: don’t assume domain controllers are in OU=Domain Controllers (yes it is a bad practice, but some people don’t follow Microsoft recommandation…)
[IMP] waptconsole: python engine on windows: don’t throw an error dialog when python engine fails to start
[IMP] waptconsole: in window menu show caption with only caption form (not with form name anymore)
[NEW] waptselfservice: default theme files for light/dark
[NEW] waptselfservice: load dark theme if available
[NEW] waptselfservice: on macOS, fix blank install button
[FIX] waptselfservice: service group, if login is kerberos (waptserver-ldap) remove domain in username (upn problem) but force domain in bind. Due to samAccountName@KERBEROS.REALM is a valid auth UPN, but cannot be used in LDAP search on userPrincipalName field). Add short group and group with domain name in result
[FIX] waptcore: improve openid suppport: trap http exception when getting issuer cert key to validate token.
- add [openid] issuer_cert_path option to specify a local file for issuer cert (offline validation)
- make code_verifier arg required for exchange_code_for_token
- check token audience match client_id
- use id_token instead of access_token
- validate id_token against Idp certificate
[IMP] waptcore: add the windows 26h2 build info
[IMP] waptcore: upgrade COTS to python 3.11.17
[IMP] waptagent: wapt-get: when used in scripted unattented command line, processes didn’t abort, waiting for user interaction.
[FIX] waptagent: wapt-get: return proper exitcode=0 when python.exe –version is run
[IMP] waptagent: improve openid support: wapt auth: add PKCE oauth2 code flow. Add support of oauth2 PKCE for local waptservice auth (wapt-get and wapt-self). Define
```
[global]
service_auth_type=oauth_pkce
```

[IMP] waptagent: add section in wapt-get.ini without client_secret like

[openid]
issuer=https://srvkeycloak.mydomain.lan/realms/MyDomain
redirect_uri=http://localhost:8095/callback
client_id=waptpkce
verify_cert=1

[FIX] waptagent: add wapt-get openid-auth command line
[FIX] waptagent: wapt-get <python script> non 0 exitcode propagation in case of exception in python script
[IMP] waptagent: in Wapt.write_audit_data_if_changed, Wapt.write_audit_data add is_raw_json arg to avoid double json encoding
[NEW] waptagent: simplify AppImage icon lookup
[NEW] waptagent: check uninstall keys at install, audit and remove. The uninstallkey of setup.py is now checked on Linux like on macOS:
- after install, the keys must be found by installed_softwares
- at audit, a missing key gives an ERROR status
- after the uninstall script, a key still present raises an error
[IMP] waptagent: on Linux, list AppImages in installed_softwares Find the AppImages from the /usr/share/applications links to their .desktop launchers. Add a version parameter to install_appimage, stored as X-WAPT-Version in the .desktop
[FIX] waptagent: on Linux / macOS, upgrade python-pam module for missing six module error (due to python-pam packaging error https://forum.tranquil.it/viewtopic.php?p=17977)
[IMP] waptagent: on Linux, add install_appimage and uninstall_appimage functions. install an AppImage in a directory and add its .desktop launchers to /usr/share/applications, with an optional /usr/bin symlink
[NEW] setuphelpers: add systemd_is_running_service and launchd_is_running_service functions Also implement service_list on macOS
[NEW] setuphelpers: on Linux add keywords filter on snaps in installed_softwares
[FIX] waptserver: fix potential db storage error when having a datetime object with tz info. Due to peewee DateTimeField DB fields handling of tz data.
[FIX] waptserver: during db structure upgrade: prepopulate HostAuditData.replaced_by to avoir updates storm. On first hosts update_status. Fix delete trigger to include host_id in where
[FIX] waptserver: for write_audit_data_if_changed add min_count argument to be sure to keep at least one audit value. Be sure to have iso str datetime in expiration_date
[FIX] waptserver: fix waptlicences.compute_negotiate_server_authenticate_header for Windows. This should allow for Kerberos authentication on Windows server in the future

WAPT-2.7.0.19598 (2026-10-02)¶

hash: b35845cd

This is a bugfix and COTS release.

[SEC] waptcore: update to Python 3.11.16, OpenSSL 3.5.9 and other COTS updates
[FIX] waptserver: when running wapt-scanpackages.py, fix regression « database not opened » error message
[FIX] waptself: fix login with userPrincipalName (UPN)
[NEW] setuphelpers: get_deb_version function allowing to read the version of a .deb file from its control file without dpkg

WAPT-2.7.0.19593 (2026-09-30)¶

Avertissement

Known issue:

Self-Service fails when a UPN is used in a domain environment. This issue is fixed in WAPT-2.7.0.19598.
the wapt-scanpackage command may fail on server with a « database not opened » error message. This issue is fixed in WAPT-2.7.0.19598.

hash: 10b94c8e

This is the first release of WAPT 2.7. As this is this a major version, it introduces some minor breaking changes. Please be sure to read thoroughly the breaking change list to prepare the upgrade.

Main highlights:

Redesign of WaptConsole and WaptSelfService
Performance improvement in console for large install base
Performance improvement on server with uWSGI enabled by default on Linux installation
Performance and stability gain on remote repositories using the new Wapt ProxyCache technology
Caching of Linux client updates using ProxyCache technology
Support for OpenID / Oauth2 / EntraID authentication
Kerberos auth handling directly in WAPT, no need of nginx SPNego module anymore
Improve ACL handling with role support and delegated admin role for user management
Upgrade from Python 3.10 to Python 3.11, all COTS upgraded
Support for ArcDataShield Digital Air Gap (DAG) product for isolated network
WAPT Discovery License has been re-written to explicitly exclude the use case where one install multiple WAPT servers to circumvent 300 desktops limit. WAPT Discovery was released for smaller organisations as a goto solution to keep their network uptodate and secure. It was not designed to help multi-million revenue corporations to improve their bottom line.

Breaking changes:

[IMP] waptserver: user accounts and roles are now fully qualified (myuser@mydomain.lan) if they are linked to a domain. A fallback to the user account exists for the transition period using the parameter user_acls_fallback_without_domain = True (default value False) WaptUsers: added roles. WaptUserAcls: added managed_by , is_role, and description attributes.
[NEW] wads: login_on_wads enabled by default.
[IMP] waptagent: the ad_groups_use_nested_group parameter has been renamed to use_ad_nested_groups.
[IMP] waptagent: dynamic configurations: maturities are additive. If several configuration packages specify the maturities parameter, the resulting value is the union of all values. Previously, the last configuration overwrote all the others.
[IMP] waptagent: <pf86>\wapt\bin is now in the Windows PATH instead of <pf86>\wapt. So only wapt-get.exe binary is still one the %PATH%
[IMP] waptagent: installation and audit logs are limited to 100 KB by default to avoid potential network and db overload
[IMP] waptserver: for audit data on server, to avoid ever growing table and database size, an expiry date default_host_audit_data_expiration_date (default 90 days) has been set by default.

Avertissement

There are a few beaking changes, please be sure to review them before upgrading, see above

Known issues:

If kerberos is enabled on waptserver, if you connect to Wapt webserver welcome page using Google Chrome WITHOUT a proper client Kerberos configuration, the login prompt will be shown twice. This is due to a Google Chrome bug (https://issues.chromium.org/issues/40739141). You can switch to Firefox to have a proper Kerberos Negotiate handshake support.

Detailed changes:

[IMP] waptcore: updated COTS, Python 3.11.16, OpenSSL 3.5.8
[IMP] waptcore: in waptdeploy.exe add a manifest to avoid being run with UAC elevation
[IMP] waptagent: <pf86>\wapt\bin is now in the Windows PATH instead of <pf86>\wapt. This prevents WAPT’s Python from potentially being used for other purposes, such as on development workstations. wapt-get.exe remains available in the PATH.
[IMP] waptagent: installation and audit logs are limited to 100 KB by default to avoid potential network and db overload This can be modified on the agent using the max_package_log_size parameter.
[IMP] waptagent: the ad_groups_use_nested_group parameter has been renamed to use_ad_nested_groups.
[IMP] waptagent: dynamic configurations: maturities are additive. If several configuration packages specify the maturities parameter, the resulting value is the union of all values. Previously, the last configuration overwrote all the others.
[IMP] waptagent: target verification for the installation of host, unit, and profile packages: If the packages are not intended for the machine, they cannot be installed. Previously, they could still be installed, notably through a force install using the console.
[NEW] waptagent: improve mustache templates with new built-in functions. Can be used in wapt-get outputs, in the WAPT console HTML viewers, and to format console plugin command lines: DateTimeToText, DateToText, DateFmt, TimeLogToText JsonQuote JsonQuoteUri, ToJson, MarkdownToHtml, SimpleToHtml, WikiToHtml, BlobToBase64, EnumTrim, EnumTrimRight, PowerOfTwo, Equals If, NewGuid ExtractFileName, HumanBytes, Sub', :code:`Values, Keys, Match MatchI, Glob GlobI Lower Upper, CamelCase, UnCamelCase, SnakeCase, KebabCase, DotCase, tojson2 httpget, httpgetsafe, httppost, httppostsafe join, joinvalues, get, count pad padleft, localdatetime localdate, localtime, first, last, slice, b64encode, b64decode, sha256, sha1, md5, chr, csv, items iif, uncamelcase, unsnakecase, evaluate, calctotp
[NEW] waptagent: added integrated HTML viewer helper for update package html_view(title:str, html: str, autoclose:int=None, borderless:bool=False)->Dict
[NEW] waptagent: wapt-get command line, added the --login_method= option (auto, password, sessionkerberos, kerberos, oauth2, token, x509) to specify the authentication mode on the server.
[NEW] waptagent: added wapt-get command line option for package management for the WAPT server repository: search-package, download-package, show-package, edit-package. Filtering with --this, --locale, --maturity, --target_os, --architecture, and keywords or {package_uuid}. The --this option filters search results based on the machine’s capabilities.
[NEW] waptagent: added wapt-get command line option show-cert, sign-json, check-json, check-file-hash, open-config, .ini, wgets
[NEW] waptagent: added wapt-get command line option list-hosts Options: --reachable, --has_errors, --need_upgrade, --order_by=, --limit=, --query_id=<int>, --uuid={uuid}, or --search=<keywords> or -q, --columns=<csv>, --try_kerberos=0/1
[NEW] waptagent: added wapt-get command line option trigger-action <action> args --options Args are provided either as a simple single-quoted JSON object or as a list of arg=value pairs: {'package':'package','force':true} or package=package force=true Example: wapt-get trigger-action trigger_host_audit force=true --login_method=openid -c waptconsole --reachable
[NEW] waptagent: remote repositories: use of new ProxyCache technology instead of full synchronization.
[IMP] waptagent: wapt-get uninstall <dir> can now only be used on a directory for package developement as it has no use in production
[IMP] waptagent: improve local cache management, remove packages and updates that are needed anymore in a more deterministic fashion
[NEW] waptagent: in remoterepo ProxyCache, add a head_timeout option for HEAD requests (default value 1000ms)
[IMP] waptagent: during install, better handling of locked files to avoid blocking the upgrade. WaptSetup closes wapt binaries, pyscripter, vscode.
[IMP] waptagent: on Windows, set default wapt_temp_dir to <wapt>\private\install to try to workaround potential « heuristic » false positive from EDR
[IMP] waptagent: don’t add wapt_base_dir to %PATH% to avoid wapt DLLs to be in the default search PATH
[IMP] waptagent: set default max_audit_data_size = 1M to avoid having too large audit sent to the server.
[IMP] waptagent: in waptdeploy, use %WINDIR%\SYSTEMTEMP if it exists and user is SYSTEM account, else use %WINDIR%\TEMP to avoid lock stated due to EDR
[IMP] waptagent: on linux, remove dependency on kinit (krb5-user / krb5 package)
[IMP] waptconsole: global graphical redesign. Merged the package status and package summary tabs. Improved some progress indicators. Explicit choice of authentication mode in the login dialog.
[IMP] waptconsole: improve responsiveness : most server requests are now asynchronous to avoid graphical freezes. Limitation of the amount of queried data: only displayed columns are queried. Optimized the data transfer format: the mORMot compact format is faster to encode/decode and more compact (attribute name are not repeated on each json line of a same array)
[NEW] waptconsole: support for importing packages via a network partitioning security device such as DAG from ArcDataShield, and for file: type URLs.
[IMP] waptconsole: better display of stdout / stderr log from package installations.
[IMP] waptconsole: in remote repo, add check on remote repo availability and sanity-check.
[IMP] waptconsole: add app icons support in grids
[IMP] waptconsole: better text display widget with coloration, zoom, etc.
[IMP] waptconsole: add zoom on html viewer
[IMP] waptserver: enabled uWSGI mode by default on Linux. Allows long console requests to be processed using multithreading.
[NEW] waptserver: added OpenID / OAuth2 authentication.
[NEW] waptserver: added the concept of « roles » to define ACLs for a user account. Mapping to AD groups if the WAPT server is linked to an AD. Explicit roles can be added to an account. AD groups are mapped to roles with the same qualified name (mygroup@mydomain.lan).
[NEW] waptserver: Added the account management ACL to allow account creation to be delegated to administrators without granting the full « admin » ACL. Accounts created by a delegated administrator have ACLs limited to those of the account administrator.
[NEW] waptserver: Kerberos authentication is now handled by the waptserver service and no longer at the nginx level. The libnginx-mod-http-auth-spnego module is no longer required.
[IMP] waptserver: user accounts and roles are now fully qualified (myuser@mydomain.lan) if they are linked to a domain. A fallback to the user account exists for the transition period using the parameter user_acls_fallback_without_domain = True (default value False) WaptUsers: added roles. WaptUserAcls: added managed_by , is_role, and description attributes.
[NEW] waptserver: added configuration parameters admin_subnets to limits access to administration endpoints to an IP range.
[NEW] waptserver: added default_host_audit_data_expiration_days parameter. If no expiration date is set on audit data, the expiration is calculated by adding this value, in days, to the data creation date (created_on).
[NEW] waptserver: expired audit data is deleted asynchronously by the wapttasks service. HostAuditData: added replaced_by, populated by a trigger when one data item replaces another with the same host, section, key, and a newer date.
[NEW] waptserver: data model changes: Hosts: added asset_type to add non waptagent inventory line in wapt inventory
[IMP] waptserver: for Linux, proxycache can now be used as a caching mechanism for Linux client update (deb or rpm repositories).
[IMP] waptserver: add log cleaning tasks. By default logsapi_keep_days = 365
[IMP] waptserver: on windows, add a UseDemoDHParam option to speed up windows server install for demonstrations on virtual machines
[IMP] waptserver: force readonly connexion on wapt db connexion if writing is not necessary in the api call.
[NEW] wads: Improved wads.exe command line with parameters wads_matching_mode: 'uuid', 'serial_number', or 'mac_address'
[NEW] wads: login_on_wads enabled by default.
[NEW] wads: new waptserver config parameter ipxe_urls, which is properly taken care during nginx postconf. Allows to use multiple custom reverse proxies to the /api/v3/baseipxe endpoint.
[IMP] wads: deployement of Linux with encrypted filesystem using LUKS is now supported (template available)
[IMP] wads: deployment using secure boot through iPXE is now supported for Windows and Linux
[IMP] wads: in waptconsole inventory view, add option to add a machine to OS deploy to prepare re-imaging
[IMP] wads: during WADS deploymenent process, restart deployment automatically once machine has been properly registered in waptconsole
[IMP] waptwua: set status to PENDING_REBOOT if a reboot is pending (to avoid unneeded NEED_SCAN status)
[IMP] waptselfservice: improve support for accessibility on Windows with NVDA for visual impaired users
[IMP] waptselfservice: graphical redesign. Icons are now loaded on demand for better user experience and better performance
[IMP] waptselfservice: users and groups are fully qualified names for authentication and self-service ACLs (no fallback on short name)
[IMP] setuphelpers: when developing update_package function, add setupdevhelpers imports too
[IMP] setuphelpers: added get_computer_domain, get_hostname_and_domain, and get_netfirewallrule. Use of Kerberos Keytab and CCache under Unix.
[IMP] setuphelpers: improvements to install_apt and install_deb. Add yaml_loads / yaml_dumps yaml parser helper. Add sevenzip_extract_all helper to uncompress all format supported by 7zip Add get_dmg_version for macOS extract_tar helpers

WAPT-2.6 Serie¶

Please refer to WAPT 2.6 documentation