mullvadvpn-app

This release is for Android only.

Here is a list of changes:

Fixed

Android

• Fix top bar flickering in some scrollable views.
• Fix welcome screen sometimes showing on app restart after adding time.
• Fix inconsistencies with the account history in the login view.
• Fix OS crash when sharing long logs by instead sharing the log content as a file.
• Improve in-app purchase and verification flow in some circumstances.

NOTE: The attached binaries does not include support for Google Play in-app purchases.

This release is for desktop only.

Here is a list of all changes since 2023.5.

Added

• Add customizable relay lists to the CLI on desktop. Custom lists can be managed through
  mullvad custom-lists and can be selected through mullvad relay set and mullvad bridge set.
• Add custom lists to location selector in desktop app.
• Add custom API access methods to the CLI on desktop. Custom API access methods allow the user to
  proxy API traffic through a peer before connecting to a tunnel. They are managed through
  mullvad api-access, and the initially supported network protocols are Shadowsocks and
  SOCKS5.
• Add social media content blocker.
• Add ability to override server IPs to the CLI.

Changed

• Update Electron from 25.2.0 to 26.3.0.

Linux

• Don't block forwarding of traffic when the split tunnel mark (ct mark) is set.

Removed

Windows

• Remove wireguard-go (userspace WireGuard) support.

Fixed

• Show correct endpoint in CLI for custom relays.
• Lower risk of being rate limited.
• Fix error dialog when failing to write to console by handling the thrown error.
• Fix error dialog displayed when the daemon was killed.
• Fix desktop app freezing when navigations occur in very quick succession.

Windows

• Correctly detect whether OS is Windows Server (primarily for logging in daemon.log).

Security

Windows

• Fix possible privilege escalation by setting stricter permissions on mullvad directories such as
  the directory in ProgramData.

This release is for Android only.

Here is a list of changes:

Changed

Android

• Add Google Play in-app purchases to the build distributed via Google Play.
• Add social media content blocker.
• Add support for setting per-app language in system settings.
• Improve device and expiry information throughout the app.
• Migrate remaining views to Compose and MVVM (welcome, out-of-time, login, problem report, logs voucher dialog, in-app notifications).
• Add share button to the log view which can be used to copy or in other ways share the log text. This was partially added due to limitations in Compose which result in it not being possible to select and copy text in the log view.

NOTE: The attached binaries does not include support for Google Play in-app purchases.

This release is for Android only.

Here is a list of all changes since last stable release android/2023.6:

Changed

Android

• Minor addition to problem report logs to aid debugging of user issues.

This release is for desktop only.

Changes since 2023.5-beta2:

• Start signing the deb and rpm files (GPG)
• Fix connectivity issues when switching between networks or disconnecting on macOS.

Here is a list of all changes since last stable release 2023.4.

Added

• Add --help and --version options to the desktop GUI application.
• Add creation date below device name in the device list screen.
• Add account view button in main view in the desktop app.
• Add time left and device name in the header bar in the desktop app.

Linux

• Start signing the deb and rpm files (GPG)

Changed

• In the CLI, update the tunnel subcommand to resemble relay more. For example, by adding a
  unified mullvad tunnel get command and removing individual get subcommands like
  mullvad tunnel ipv6 get.
• Update the CLI multihop settings to make it possible to set the entry location without toggling
  multihop on or off.
• In the CLI, the mullvad account get command will now print the account number (if there is one)
  after the device has been revoked.
• Update the CLI relay, multihop & bridge selection interface to accept a hostname as sole argument,
  inheriting the behavior of mullvad relay set hostname. This is in addition to accepting a
  geographical location as basis for filtering relays.
• Silence OpenVPN "replay attack" warnings.
• Update Electron from 23.2.0 to 25.2.0.

Windows

• In the CLI, add a unified mullvad split-tunnel get command to replace the old commands
  mullvad split-tunnel pid list and mullvad split-tunnel get.

Fixed

• Update relay list after logging in. Previously, if the user wasn't logged in when the daemon
  started, the relay list would only be updated after attempting to connect to the VPN.

macOS

• Fix inability to sync iCloud and Safari bookmarks while connected to the VPN.
• Ensure that the default tunnel route is added back after waking from hibernation. Previously, the
  tunnel became unusable despite the app appearing to be connected.
• Work around issue where the default route was lost after disconnecting after switching between
  networks.
• Fix slow offline detection.
• Fix inability to switch from a network to a higher-priority network without the tunnel timing out.
• Fix connectivity issues when switching between networks or disconnecting.

Removed

• Remove the CLI subcommand mullvad relay set hostname.

This release is for Android only.

Here is a list of all changes since last stable release android/2023.5:

Added

Android

• Add quantum resistant tunneling.
• Add UDP-over-TCP WireGuard obfuscation.
• Improve how the Android firewall handles incoming connections on Android 11+ devices.
• Add search bar to the Select location view.
• Add settings entry to configure WireGuard port by either using a predefined or custom port.

Changed

Android

• Combine the "Preferences" and "Account" settings sub-menus into a single one called
  "VPN Settings".
• Make "Split tunneling" more accessible by placing it directly in the main settings menu.
• Migrate multiple views to Compose and MVVM (Settings, Account, Split tunneling, Select location).

Fixed

Android

• Reduce flickering in the main/connect view.
• Fix UI inconsistencies.
• Fix missing scrolling in the changes dialog.
• Fix unused bundled relay list.

This release is for desktop only.

Fixed

macOS

• Ensure that the default tunnel route is added back after waking from hibernation. Previously, the
  tunnel became unusable despite the app appearing to be connected.
• Work around issue where the default route was lost after disconnecting after switching between
  networks.
• Fix slow offline detection.
• Fix inability to switch from a network to a higher-priority network without the tunnel timing out.

Fixed

Android

• Fix tunnel state and connection details sometimes getting stuck showing the wrong information.
• Fix MTU dismiss behavior.
• Fix DNS input crash.
• Fix inconsistent dialog padding.

Added

Android

• Add quantum resistant tunneling.
• Add UDP-over-TCP WireGuard obfuscation.
• Improve how the Android firewall handles incoming connections on Android 11+ devices.
• Add search bar to the Select location view.
• Add settings entry to configure WireGuard port by either using a predefined or custom port.

Changed

Android

• Combine the "Preferences" and "Account" settings sub-menus into a single one called "VPN Settings".
• Make "Split tunneling" more accessible by placing it directly in the main settings menu.
• Migrate multiple views to Compose and MVVM (Settings, Account, Split tunneling, Select location).

Fixed

Android

• Reduce flickering in the main/connect view.

Changed

Android

• New fancy version number in order to try to resolve Google Play distribution issues. Otherwise
  same as android/2023.4.

Changed

Android

• Prevent opening download page in Google Play builds.

This release is for desktop only.

Added

• Add --help and --version options to the desktop GUI application.
• Add creation date below device name in the device list screen.
• Add account view button in main view in the desktop app.
• Add time left and device name in the header bar in the desktop app.

Changed

• In the CLI, update the tunnel subcommand to resemble relay more. For example, by adding a
  unified mullvad tunnel get command and removing individual get subcommands like
  mullvad tunnel ipv6 get.
• Update the CLI multihop settings to make it possible to set the entry location without toggling
  multihop on or off.
• In the CLI, the mullvad account get command will now print the account number (if there is one)
  after the device has been revoked.
• Update the CLI relay, multihop & bridge selection interface to accept a hostname as sole argument,
  inheriting the behavior of mullvad relay set hostname. This is in addition to accepting a
  geographical location as basis for filtering relays.
• Silence OpenVPN "replay attack" warnings.
• Update Electron from 23.2.0 to 25.2.0.

Windows

• In the CLI, add a unified mullvad split-tunnel get command to replace the old commands
  mullvad split-tunnel pid list and mullvad split-tunnel get.

Fixed

• Update relay list after logging in. Previously, if the user wasn't logged in when the daemon
  started, the relay list would only be updated after attempting to connect to the VPN.

macOS

• Fix inability to sync iCloud and Safari bookmarks while connected to the VPN.

Removed

• Remove the CLI subcommand mullvad relay set hostname.

This release is for desktop only.

Here is a list of all changes since last stable release 2023.3.

Added

• Log select settings on each connection attempt.

Changed

• Update Electron from 21.1.1 to 23.2.0.

macOS

• Change macOS app signing key and certificates. Replace those issued to Amagicom AB (the parent
  company of Mullvad VPN AB) with new certificates issued directly to Mullvad VPN AB.

Deprecated

Linux

• Deprecated support for Debian 10. This also means dropping support for glibc older
  than 2.31 and Linux kernels older than 5.10.

Fixed

• Fix location search in desktop app only searching for English location names.
• Fix automatic WireGuard key rotation not being initialized correctly when not running the GUI.
• Fix duplicated notifications in some situations.
• Fix notification setting being inverted. When non-important notifications were disabled it instead
  disabled important ones and showed non-important ones.
• Work around issues with PQ and multihop caused by fragmentation in the tunnel. The workaround
  doesn't fix fragmentation issues in general but prevents the PSK exchange packets from being
  fragmented by setting an explicit maximum segment size.
• Fix misaligned read in shadowsocks leading to a panic on some platforms.

macOS

• Fix tray window behaviour when opening mission control and switching between full-screen
  workspaces.
• Fix issue where app stopped responding on ARM Macs.

Linux

• Fix RPM package containing unecessary files causing conflicts with other electron-builder based
  packages.

Changed

Android

• Change so that all links and texts leading to the mullvad webpage display a modified version of
  the webpage that does not include links to the account page in order to comply with
  the Google Play payment policies. This doesn't apply to F-Droid builds.
• Hide the FAQs and Guides button for Google Play users.

Changed

Android

• Change so that all links and texts leading to the account web page (which also includes a payment
  flow) are either hidden or leads to the app itself (notification actions) in order to comply with
  the Google Play payment policies. This doesn't apply to F-Droid builds.

Here is a list of all changes since last stable release android/2022.3:

Added

Android

• Add themed icon.
• Add DNS content blockers.
• Add "Manage account" button to the account view.

Changed

Android

• Clarify some of the error messages throughout the app.
• Increase WireGuard key rotation interval to 14 days.
• Change the DNS/MTU input to rely on dialogs in order to improve the UX on some devices.
• Hide "Buy more credit" buttons in the default release build published to Google Play, our website
  and GitHub. The buttons are still visible for F-Droid builds.

Fixed

Android

• Fix adaptive app icon which previously had a displaced nose and some other oddities.
• Fix app version sometimes missing in the settings menu.
• Fix missing payment info in out-of-time view.

Added

Android

• Add "Manage account" button to the account view.

Fixed

Android

• Fix missing payment info in out-of-time view.

Added

Android

• Add themed icon.
• Add DNS content blockers.

Changed

Android

• Clarify some of the error messages throughout the app.
• Increase WireGuard key rotation interval to 14 days.
• Change the DNS/MTU input to rely on dialogs in order to improve the UX on some devices.
• Hide "Buy more credit" buttons in the default release build published to Google Play, our website
  and GitHub. The buttons are still visible for F-Droid builds.

Fixed

Android

• Fix adaptive app icon which previously had a displaced nose and some other oddities.
• Fix app version sometimes missing in the settings menu.

This release is for desktop only.

Added

• Log select settings on each connection attempt.

Changed

• Update Electron from 21.1.1 to 23.2.0.

macOS

• Change macOS app signing key and certificates. Replace those issued to Amagicom AB (the parent
  company of Mullvad VPN AB) with new certificates issued directly to Mullvad VPN AB.

Deprecated

Linux

• Deprecated support for Debian 10. This also means dropping support for glibc older
  than 2.31 and Linux kernels older than 5.10.

Fixed

• Fix location search in desktop app only searching for English location names.
• Fix automatic WireGuard key rotation not being initialized correctly when not running the GUI.
• Fix duplicated notifications in some situations.
• Fix notification setting being inverted. When non-important notifications were disabled it instead
  disabled important ones and showed non-important ones.
• Work around issues with PQ and multihop caused by fragmentation in the tunnel. The workaround
  doesn't fix fragmentation issues in general but prevents the PSK exchange packets from being
  fragmented by setting an explicit maximum segment size.

macOS

• Fix tray window behaviour when opening mission control and switching between full-screen
  workspaces.
• Fix issue where app stopped responding on ARM Macs.

Linux

• Fix RPM package containing unecessary files causing conflicts with other electron-builder based
  packages.

Added

• Add Kyber1024 KEM algorithm into the Post-Quantum secure key exchange algorithm. This means the
  Quantum-resistant-tunnels feature now mixes both Classic McEliece and Kyber for added protection.
• Add notification dot to tray icon and system notification throttling.
• Add troubleshooting information to some in-app notifications.
• Add setting for quantum resistant tunnels to the desktop GUI.
• Enable TCP_NODELAY for the socket used by WireGuard over TCP. Improves latency and performance.

Changed

• Update the Post-Quantum secure key exchange gRPC client to use the stabilized
  PskExchangeV1 endpoint
• Add "auto" setting for the quantum-resistant tunnel feature, and make it the default. If it was
  previously set to off, it will now be set to auto instead. That currently means the same thing as
  "off", but this might change in the future.
• Update OpenVPN to 2.6.0 from 2.5.3.
• Update OpenSSL to 1.1.1t from 1.1.1j.
• Post-Quantum secure tunnels and multihop can now be used at the same time.
• Change WireGuard key rotation interval to 14 days. It was 7 days.

Windows

• Remove automatic fallback to wireguard-go. This is done as a first step before fully
  deprecating it on Windows.

Removed

• Remove port 443 as valid port for WireGuard over TCP. Keep only port 80 and 5001. The reason is
  to free up port 443 for other TCP based obfuscation later.

Fixed

• Fix close to expiry notification not showing unless app is opened once within the last three days
  in the desktop app.
• Retry if PQ PSK negotiation fails for any reason.
• Fix accumulated tunnel state notifications sometimes displayed after suspend.