## Description * Improved the performance of certain predicate expressions used to select SSH servers. [#66769](https://github.com/gravitational/teleport/pull/66769) * Fixes an issue preventing joins using the azure join method in regions where the trust chain has been updated with an additional intermediate. [#66764](https://github.com/gravitational/teleport/pull/66764) * Fix Teleport Connect's VNet failing to start on Linux when an older `tsh` is present at `/usr/local/bin/tsh`. [#66757](https://github.com/gravitational/teleport/pull/66757) * The MFA prompt now includes the name of a leaf cluster if the resource belongs to one. [#66741](https://github.com/gravitational/teleport/pull/66741) * When attempting to access a web app protected by Device Trust from an untrusted device, browsers now see a simple HTML page instead of a plain text response. [#66717](https://github.com/gravitational/teleport/pull/66717) * Improved the error message on login in tsh and Teleport Connect when `/webapi/ping` returns a non-200 response. [#66712](https://github.com/gravitational/teleport/pull/66712) * The kubernetes join method now supports allow rules targeting specific service account names and namespaces and supports wildcards when the new fields are used. [#66700](https://github.com/gravitational/teleport/pull/66700) * Raise the app access upstream response-header cap from 5 minutes to 1 hour so long-running HTTP requests complete. [#66687](https://github.com/gravitational/teleport/pull/66687) * Fixed an issue preventing host sudoers entries from being written on newer Linux distributions (i.e. Ubuntu 25.10) using sudo-rs. [#66433](https://github.com/gravitational/teleport/pull/66433) Enterprise: * Internal performance optimizations to the SCIM PATCH flow when multiple parallel PATCH requests target the same SCIM groups. * Fixed an issue with sessions failing to be summarized when using non-alternate buffer TUI applications. * Commands in the session summary timeline now show detected MITRE attack IDs and suspicious flags. * Fixed Web UI to no longer show audit review prompts or 0001-01-01 dates for static Access Lists. ## Download Download the current and previous releases of Teleport at https://goteleport.com/download. ## Plugins Download the current release of Teleport plugins from the links below. * Slack [Linux amd64](https://cdn.teleport.dev/teleport-access-slack-v18.8.1-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-slack-v18.8.1-linux-arm64-bin.tar.gz) * Mattermost [Linux amd64](https://cdn.teleport.dev/teleport-access-mattermost-v18.8.1-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-mattermost-v18.8.1-linux-arm64-bin.tar.gz) * Discord [Linux amd64](https://cdn.teleport.dev/teleport-access-discord-v18.8.1-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-discord-v18.8.1-linux-arm64-bin.tar.gz) * Terraform Provider [Linux amd64](https://cdn.teleport.dev/terraform-provider-teleport-v18.8.1-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/terraform-provider-teleport-v18.8.1-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/terraform-provider-teleport-v18.8.1-darwin-amd64-bin.tar.gz) | [macOS arm64](https://cdn.teleport.dev/terraform-provider-teleport-v18.8.1-darwin-arm64-bin.tar.gz) | [macOS universal](https://cdn.teleport.dev/terraform-provider-teleport-v18.8.1-darwin-universal-bin.tar.gz) * Event Handler [Linux amd64](https://cdn.teleport.dev/teleport-event-handler-v18.8.1-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-event-handler-v18.8.1-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/teleport-event-handler-v18.8.1-darwin-amd64-bin.tar.gz) * PagerDuty [Linux amd64](https://cdn.teleport.dev/teleport-access-pagerduty-v18.8.1-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-pagerduty-v18.8.1-linux-arm64-bin.tar.gz) * Jira [Linux amd64](https://cdn.teleport.dev/teleport-access-jira-v18.8.1-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-jira-v18.8.1-linux-arm64-bin.tar.gz) * Email [Linux amd64](https://cdn.teleport.dev/teleport-access-email-v18.8.1-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-email-v18.8.1-linux-arm64-bin.tar.gz) * Microsoft Teams [Linux amd64](https://cdn.teleport.dev/teleport-access-msteams-v18.8.1-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-msteams-v18.8.1-linux-arm64-bin.tar.gz)

## Description * Fix a bug where audit events could be created forever for an expired access request. [#64355](https://github.com/gravitational/teleport/pull/64355) * Fixed an issue where the UI would display a white screen and no error when an error occurred. [#64245](https://github.com/gravitational/teleport/pull/64245) * Fixed a bug that could cause desktop connection errors during proxy upgrades for some cluster configurations. [#64224](https://github.com/gravitational/teleport/pull/64224) * Improve the layout of the web UI's message of the day. [#64212](https://github.com/gravitational/teleport/pull/64212) * Fixed an issue where VNet on Windows could fail to start after an update with the error: `The specified service does not exist as an installed service.`. [#64207](https://github.com/gravitational/teleport/pull/64207) * Fixed db session page refresh redirecting to empty page. [#63988](https://github.com/gravitational/teleport/pull/63988) * Fixed out of sequent audit logs rendering in ui for same timestamp logs. [#63819](https://github.com/gravitational/teleport/pull/63819) * Fixed `tsh kubectl` failing when kubectl flags appear before positional arguments (e.g., `tsh kubectl -n default get pod`). [#63808](https://github.com/gravitational/teleport/pull/63808) * Added `tctl recordings download` command to download session recordings to local files without requiring direct access to the storage backend. [#63727](https://github.com/gravitational/teleport/pull/63727) * Fixed a bug that could cause Windows desktops discovered via LDAP to be removed in error. [#62472](https://github.com/gravitational/teleport/pull/62472) Enterprise: * Fix an error log and a memory leak when manually deleting an okta_assignment resource. * Fix a potential panic in Auth service when getting a non-existing plugin without list permissions. ## Download Download the current and previous releases of Teleport at https://goteleport.com/download. ## Plugins Download the current release of Teleport plugins from the links below. * Slack [Linux amd64](https://cdn.teleport.dev/teleport-access-slack-v17.7.20-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-slack-v17.7.20-linux-arm64-bin.tar.gz) * Mattermost [Linux amd64](https://cdn.teleport.dev/teleport-access-mattermost-v17.7.20-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-mattermost-v17.7.20-linux-arm64-bin.tar.gz) * Discord [Linux amd64](https://cdn.teleport.dev/teleport-access-discord-v17.7.20-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-discord-v17.7.20-linux-arm64-bin.tar.gz) * Terraform Provider [Linux amd64](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.20-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.20-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.20-darwin-amd64-bin.tar.gz) | [macOS arm64](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.20-darwin-arm64-bin.tar.gz) | [macOS universal](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.20-darwin-universal-bin.tar.gz) * Event Handler [Linux amd64](https://cdn.teleport.dev/teleport-event-handler-v17.7.20-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-event-handler-v17.7.20-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/teleport-event-handler-v17.7.20-darwin-amd64-bin.tar.gz) * PagerDuty [Linux amd64](https://cdn.teleport.dev/teleport-access-pagerduty-v17.7.20-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-pagerduty-v17.7.20-linux-arm64-bin.tar.gz) * Jira [Linux amd64](https://cdn.teleport.dev/teleport-access-jira-v17.7.20-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-jira-v17.7.20-linux-arm64-bin.tar.gz) * Email [Linux amd64](https://cdn.teleport.dev/teleport-access-email-v17.7.20-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-email-v17.7.20-linux-arm64-bin.tar.gz) * Microsoft Teams [Linux amd64](https://cdn.teleport.dev/teleport-access-msteams-v17.7.20-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-msteams-v17.7.20-linux-arm64-bin.tar.gz)

## Description * Added `TeleportAccessMonitoringRuleV1` support to the Teleport Kubernetes operator. [#64368](https://github.com/gravitational/teleport/pull/64368) * Added update scoped token support to tctl and update upsert scoped token rpc to not require status. [#64345](https://github.com/gravitational/teleport/pull/64345) * Improved performance and reduced resource usage of the database proxy for clusters with large numbers of registered databases. [#64311](https://github.com/gravitational/teleport/pull/64311) * Added more helpful messages to `ssm.run` events when there's a failure in discovering EC2 instances. [#64273](https://github.com/gravitational/teleport/pull/64273) * Fixed a bug that could cause desktop connection errors during proxy upgrades for some cluster configurations. [#64258](https://github.com/gravitational/teleport/pull/64258) * Fixed an issue where the UI would display a white screen and no error when an error occurred. [#64246](https://github.com/gravitational/teleport/pull/64246) * Improve the layout of the web UI's message of the day. [#64213](https://github.com/gravitational/teleport/pull/64213) * Fixed an issue where VNet on Windows could fail to start after an update with the error: `The specified service does not exist as an installed service.`. [#64206](https://github.com/gravitational/teleport/pull/64206) * Fixed a bug where audit events could be created forever for an expired access request. [#64180](https://github.com/gravitational/teleport/pull/64180) * Add scoped tokens to tctl resource commands. [#64040](https://github.com/gravitational/teleport/pull/64040) * Fixed correct reporting of server discovery enrollment failures when the Proxy is not accessible from the target server. [#64007](https://github.com/gravitational/teleport/pull/64007) * Fixed an issue that caused Discovery Service to stop working for Discovery Configs, also affecting AWS OIDC resource enrollments created from the UI. [#63970](https://github.com/gravitational/teleport/pull/63970) * Added support for session summarizer resources to the Kubernetes operator. [#63884](https://github.com/gravitational/teleport/pull/63884) Enterprise: * Fixed an error log and a memory leak when manually deleting an okta_assignment resource. * Fixed a potential panic in Auth service when getting a non-existing plugin without list permissions. * Prevented membership modifications for Access Lists synchronized from Entra ID. ## Download Download the current and previous releases of Teleport at https://goteleport.com/download. ## Plugins Download the current release of Teleport plugins from the links below. * Slack [Linux amd64](https://cdn.teleport.dev/teleport-access-slack-v18.7.2-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-slack-v18.7.2-linux-arm64-bin.tar.gz) * Mattermost [Linux amd64](https://cdn.teleport.dev/teleport-access-mattermost-v18.7.2-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-mattermost-v18.7.2-linux-arm64-bin.tar.gz) * Discord [Linux amd64](https://cdn.teleport.dev/teleport-access-discord-v18.7.2-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-discord-v18.7.2-linux-arm64-bin.tar.gz) * Terraform Provider [Linux amd64](https://cdn.teleport.dev/terraform-provider-teleport-v18.7.2-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/terraform-provider-teleport-v18.7.2-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/terraform-provider-teleport-v18.7.2-darwin-amd64-bin.tar.gz) | [macOS arm64](https://cdn.teleport.dev/terraform-provider-teleport-v18.7.2-darwin-arm64-bin.tar.gz) | [macOS universal](https://cdn.teleport.dev/terraform-provider-teleport-v18.7.2-darwin-universal-bin.tar.gz) * Event Handler [Linux amd64](https://cdn.teleport.dev/teleport-event-handler-v18.7.2-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-event-handler-v18.7.2-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/teleport-event-handler-v18.7.2-darwin-amd64-bin.tar.gz) * PagerDuty [Linux amd64](https://cdn.teleport.dev/teleport-access-pagerduty-v18.7.2-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-pagerduty-v18.7.2-linux-arm64-bin.tar.gz) * Jira [Linux amd64](https://cdn.teleport.dev/teleport-access-jira-v18.7.2-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-jira-v18.7.2-linux-arm64-bin.tar.gz) * Email [Linux amd64](https://cdn.teleport.dev/teleport-access-email-v18.7.2-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-email-v18.7.2-linux-arm64-bin.tar.gz) * Microsoft Teams [Linux amd64](https://cdn.teleport.dev/teleport-access-msteams-v18.7.2-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-msteams-v18.7.2-linux-arm64-bin.tar.gz)

## Description Skipped 17.7.17 due to a build pipeline issue. * Revised help messages for event handler CLI commands. [#63642](https://github.com/gravitational/teleport/pull/63642) * Fixed `tsh ssh user@foo=bar uptime` from running serially if users did not have `role:read` permissions. [#63611](https://github.com/gravitational/teleport/pull/63611) * The minimum version of macOS required to run Teleport or associated client tools is now macOS 12 (Monterey). [#63588](https://github.com/gravitational/teleport/pull/63588) * The minimal macOS version required by Teleport Connect is now macOS 12. [#63570](https://github.com/gravitational/teleport/pull/63570) * Fixed bug where event handler would get stuck on DynamoDB backend when handling large events. [#63562](https://github.com/gravitational/teleport/pull/63562) * Updated Go to 1.25.7. [#63561](https://github.com/gravitational/teleport/pull/63561) * Fixed bug where event handler would throw an error on Athena backend when handling large events. [#63551](https://github.com/gravitational/teleport/pull/63551) * Fixed an issue where a role requiring a trusted device could incorrectly block access to all applications. [#63528](https://github.com/gravitational/teleport/pull/63528) * Updated tsh/Linux to correctly capture the OS login user for device trust. [#63453](https://github.com/gravitational/teleport/pull/63453) * Fixed a server error when rejecting a headless authentication request in the Web UI. [#63432](https://github.com/gravitational/teleport/pull/63432) * Fixed tsh/Linux sending a too-large username for device trust. [#63388](https://github.com/gravitational/teleport/pull/63388) * Fixed teleport join openssh on recent versions of Ubuntu. [#63042](https://github.com/gravitational/teleport/pull/63042) * Fix an issue in the Teleport SSH Service where interactive PAM Auth modules always fail when trying to run exec sessions with tty allocated. e.g. `tsh ssh --tty <node> ls`. [#62065](https://github.com/gravitational/teleport/pull/62065) Enterprise: * Extend Access Monitoring feature to Teleport Cloud customers using External Audit Storage. * Added recording and validation for the fixed OS login user values from tsh. ## Download Download the current and previous releases of Teleport at https://goteleport.com/download. ## Plugins Download the current release of Teleport plugins from the links below. * Slack [Linux amd64](https://cdn.teleport.dev/teleport-access-slack-v17.7.18-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-slack-v17.7.18-linux-arm64-bin.tar.gz) * Mattermost [Linux amd64](https://cdn.teleport.dev/teleport-access-mattermost-v17.7.18-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-mattermost-v17.7.18-linux-arm64-bin.tar.gz) * Discord [Linux amd64](https://cdn.teleport.dev/teleport-access-discord-v17.7.18-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-discord-v17.7.18-linux-arm64-bin.tar.gz) * Terraform Provider [Linux amd64](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.18-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.18-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.18-darwin-amd64-bin.tar.gz) | [macOS arm64](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.18-darwin-arm64-bin.tar.gz) | [macOS universal](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.18-darwin-universal-bin.tar.gz) * Event Handler [Linux amd64](https://cdn.teleport.dev/teleport-event-handler-v17.7.18-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-event-handler-v17.7.18-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/teleport-event-handler-v17.7.18-darwin-amd64-bin.tar.gz) * PagerDuty [Linux amd64](https://cdn.teleport.dev/teleport-access-pagerduty-v17.7.18-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-pagerduty-v17.7.18-linux-arm64-bin.tar.gz) * Jira [Linux amd64](https://cdn.teleport.dev/teleport-access-jira-v17.7.18-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-jira-v17.7.18-linux-arm64-bin.tar.gz) * Email [Linux amd64](https://cdn.teleport.dev/teleport-access-email-v17.7.18-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-email-v17.7.18-linux-arm64-bin.tar.gz) * Microsoft Teams [Linux amd64](https://cdn.teleport.dev/teleport-access-msteams-v17.7.18-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-msteams-v17.7.18-linux-arm64-bin.tar.gz)

## Description * Revised help messages for event handler CLI commands. [#63620](https://github.com/gravitational/teleport/pull/63620) * Fixed `tsh ssh user@foo=bar uptime` from running serially if users did not have `role:read` permissions. [#63612](https://github.com/gravitational/teleport/pull/63612) * The minimum version of macOS required to run Teleport or associated client tools is now macOS 12 (Monterey). [#63587](https://github.com/gravitational/teleport/pull/63587) * The minimal macOS version required by Teleport Connect is now macOS 12. [#63569](https://github.com/gravitational/teleport/pull/63569) * Fixed bug where event handler would throw an error on Athena backend when handling large events. [#63550](https://github.com/gravitational/teleport/pull/63550) * Updated Go to 1.25.7. [#63539](https://github.com/gravitational/teleport/pull/63539) * Fixed an issue where a role requiring a trusted device could incorrectly block access to all applications. [#63527](https://github.com/gravitational/teleport/pull/63527) * Fixed bug where event handler would get stuck on DynamoDB backend when handling large events. [#63526](https://github.com/gravitational/teleport/pull/63526) * Updated tsh/Linux to correctly capture the OS login user for device trust. [#63452](https://github.com/gravitational/teleport/pull/63452) * Fixed a server error when rejecting a headless authentication request in the Web UI. [#63431](https://github.com/gravitational/teleport/pull/63431) * Added opt-in support to use `cert-manager` certificates for `teleport-plugin-event-handler` helm chart. [#63420](https://github.com/gravitational/teleport/pull/63420) * Modified `tbot` helm chart with default `token` value to simplify deployment. [#63360](https://github.com/gravitational/teleport/pull/63360) * Improved GitHub + Kubernetes guide experience. [#63185](https://github.com/gravitational/teleport/pull/63185) * Fixed `teleport join openssh` on recent versions of Ubuntu. [#63040](https://github.com/gravitational/teleport/pull/63040) Enterprise: * Extend Access Monitoring feature to Teleport Cloud customers using External Audit Storage. * Added recording and validation for the fixed OS login user values from tsh. * Mitigated a race in the Slack token refresh logic. ## Download Download the current and previous releases of Teleport at https://goteleport.com/download. ## Plugins Download the current release of Teleport plugins from the links below. * Slack [Linux amd64](https://cdn.teleport.dev/teleport-access-slack-v18.6.7-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-slack-v18.6.7-linux-arm64-bin.tar.gz) * Mattermost [Linux amd64](https://cdn.teleport.dev/teleport-access-mattermost-v18.6.7-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-mattermost-v18.6.7-linux-arm64-bin.tar.gz) * Discord [Linux amd64](https://cdn.teleport.dev/teleport-access-discord-v18.6.7-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-discord-v18.6.7-linux-arm64-bin.tar.gz) * Terraform Provider [Linux amd64](https://cdn.teleport.dev/terraform-provider-teleport-v18.6.7-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/terraform-provider-teleport-v18.6.7-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/terraform-provider-teleport-v18.6.7-darwin-amd64-bin.tar.gz) | [macOS arm64](https://cdn.teleport.dev/terraform-provider-teleport-v18.6.7-darwin-arm64-bin.tar.gz) | [macOS universal](https://cdn.teleport.dev/terraform-provider-teleport-v18.6.7-darwin-universal-bin.tar.gz) * Event Handler [Linux amd64](https://cdn.teleport.dev/teleport-event-handler-v18.6.7-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-event-handler-v18.6.7-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/teleport-event-handler-v18.6.7-darwin-amd64-bin.tar.gz) * PagerDuty [Linux amd64](https://cdn.teleport.dev/teleport-access-pagerduty-v18.6.7-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-pagerduty-v18.6.7-linux-arm64-bin.tar.gz) * Jira [Linux amd64](https://cdn.teleport.dev/teleport-access-jira-v18.6.7-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-jira-v18.6.7-linux-arm64-bin.tar.gz) * Email [Linux amd64](https://cdn.teleport.dev/teleport-access-email-v18.6.7-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-email-v18.6.7-linux-arm64-bin.tar.gz) * Microsoft Teams [Linux amd64](https://cdn.teleport.dev/teleport-access-msteams-v18.6.7-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-msteams-v18.6.7-linux-arm64-bin.tar.gz)

## Description * Improved robustness of the Slack hosted plugin to reduce the likeliness of failed token refresh when experiencing external disruption. [#63347](https://github.com/gravitational/teleport/pull/63347) * Ensure application session rejections for untrusted devices are consistently audited as AppSessionStart failures after MFA. [#63260](https://github.com/gravitational/teleport/pull/63260) * Fixed a `CredentialContainer` error when attempting to log in to the Web UI with a hardware key using Firefox >=147.0.2. [#63246](https://github.com/gravitational/teleport/pull/63246) * Updated OpenSSL to 3.0.19. [#63203](https://github.com/gravitational/teleport/pull/63203) Enterprise: * Mitigated a race in the Slack token refresh logic. * Fixe the issue where Okta integration may not remove previously synced apps after plugin restart. * Added support for multi-arch lock file population for the terraform provider. ## Download Download the current and previous releases of Teleport at https://goteleport.com/download. ## Plugins Download the current release of Teleport plugins from the links below. * Slack [Linux amd64](https://cdn.teleport.dev/teleport-access-slack-v17.7.16-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-slack-v17.7.16-linux-arm64-bin.tar.gz) * Mattermost [Linux amd64](https://cdn.teleport.dev/teleport-access-mattermost-v17.7.16-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-mattermost-v17.7.16-linux-arm64-bin.tar.gz) * Discord [Linux amd64](https://cdn.teleport.dev/teleport-access-discord-v17.7.16-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-discord-v17.7.16-linux-arm64-bin.tar.gz) * Terraform Provider [Linux amd64](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.16-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.16-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.16-darwin-amd64-bin.tar.gz) | [macOS arm64](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.16-darwin-arm64-bin.tar.gz) | [macOS universal](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.16-darwin-universal-bin.tar.gz) * Event Handler [Linux amd64](https://cdn.teleport.dev/teleport-event-handler-v17.7.16-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-event-handler-v17.7.16-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/teleport-event-handler-v17.7.16-darwin-amd64-bin.tar.gz) * PagerDuty [Linux amd64](https://cdn.teleport.dev/teleport-access-pagerduty-v17.7.16-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-pagerduty-v17.7.16-linux-arm64-bin.tar.gz) * Jira [Linux amd64](https://cdn.teleport.dev/teleport-access-jira-v17.7.16-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-jira-v17.7.16-linux-arm64-bin.tar.gz) * Email [Linux amd64](https://cdn.teleport.dev/teleport-access-email-v17.7.16-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-email-v17.7.16-linux-arm64-bin.tar.gz) * Microsoft Teams [Linux amd64](https://cdn.teleport.dev/teleport-access-msteams-v17.7.16-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-msteams-v17.7.16-linux-arm64-bin.tar.gz)

## Description * Updated indirect dependency go-chi/chi/v5 (addresses GO-2026-4316). [#63093](https://github.com/gravitational/teleport/pull/63093) * The `tbot systemd install` command now supports a `--pid-file` flag for setting the path to the PID file. [#63038](https://github.com/gravitational/teleport/pull/63038) * Fixed GCS session recording backend not respecting rate limits. [#62987](https://github.com/gravitational/teleport/pull/62987) * Made the teleport-cluster Helm chart job resources configurable again via the `jobResources` value. [#62924](https://github.com/gravitational/teleport/pull/62924) * Reverted a disruptive change from v17.7.11: `teleport-cluster` Helm chart uses `resources` for Jobs again. If set `jobResources` takes precedence. This will change in v18, only `jobResources` will be used. [#62924](https://github.com/gravitational/teleport/pull/62924) ## Download Download the current and previous releases of Teleport at https://goteleport.com/download. ## Plugins Download the current release of Teleport plugins from the links below. * Slack [Linux amd64](https://cdn.teleport.dev/teleport-access-slack-v17.7.15-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-slack-v17.7.15-linux-arm64-bin.tar.gz) * Mattermost [Linux amd64](https://cdn.teleport.dev/teleport-access-mattermost-v17.7.15-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-mattermost-v17.7.15-linux-arm64-bin.tar.gz) * Discord [Linux amd64](https://cdn.teleport.dev/teleport-access-discord-v17.7.15-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-discord-v17.7.15-linux-arm64-bin.tar.gz) * Terraform Provider [Linux amd64](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.15-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.15-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.15-darwin-amd64-bin.tar.gz) | [macOS arm64](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.15-darwin-arm64-bin.tar.gz) | [macOS universal](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.15-darwin-universal-bin.tar.gz) * Event Handler [Linux amd64](https://cdn.teleport.dev/teleport-event-handler-v17.7.15-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-event-handler-v17.7.15-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/teleport-event-handler-v17.7.15-darwin-amd64-bin.tar.gz) * PagerDuty [Linux amd64](https://cdn.teleport.dev/teleport-access-pagerduty-v17.7.15-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-pagerduty-v17.7.15-linux-arm64-bin.tar.gz) * Jira [Linux amd64](https://cdn.teleport.dev/teleport-access-jira-v17.7.15-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-jira-v17.7.15-linux-arm64-bin.tar.gz) * Email [Linux amd64](https://cdn.teleport.dev/teleport-access-email-v17.7.15-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-email-v17.7.15-linux-arm64-bin.tar.gz) * Microsoft Teams [Linux amd64](https://cdn.teleport.dev/teleport-access-msteams-v17.7.15-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-msteams-v17.7.15-linux-arm64-bin.tar.gz)

## Description * Fixed GCS session recording backend not respecting rate limits. [#62986](https://github.com/gravitational/teleport/pull/62986) * Fixed a bug where members of a former owner Access List retain the owner permissions grants of the former owned Access List. It also fixes the issue with not being able to delete a former owner Access List. Please note: this could only happen if the owner Access List ownership was removed via the web UI. [#62979](https://github.com/gravitational/teleport/pull/62979) * Tctl commands executed from Teleport Connect now target the current root cluster with the `TELEPORT_AUTH_SERVER` env var, similar to how it works for tsh; this behavior can be turned off in the config file. [#62923](https://github.com/gravitational/teleport/pull/62923) * Made the `teleport-cluster` Helm chart job resources configurable again via the `jobResources` value. [#62922](https://github.com/gravitational/teleport/pull/62922) * Updated Go to 1.24.12. [#62885](https://github.com/gravitational/teleport/pull/62885) * Fixed launching AWS Identity Center from Teleport Connect. [#62840](https://github.com/gravitational/teleport/pull/62840) * Removed erroneous `pair-wise` subject type from Teleport's OpenID configuration. [#62835](https://github.com/gravitational/teleport/pull/62835) * Fixed renewed X509-SVIDs not being proactively sent to Envoy instances. [#62830](https://github.com/gravitational/teleport/pull/62830) * Fix an issue `MCP Session Listen` events may spam audit log with app service error `malformed line in SSE stream: ""`. [#62811](https://github.com/gravitational/teleport/pull/62811) * Added automatic client certificate reloading option for postgres backends. [#62747](https://github.com/gravitational/teleport/pull/62747) * Fixed an issue that would prevent tsh from working when the 1password SSH agent is running. [#62736](https://github.com/gravitational/teleport/pull/62736) * Add `tbot wait` API and helper to let scripts wait for bots to become ready. [#62719](https://github.com/gravitational/teleport/pull/62719) * MWI: Add support for templating secret annotations in the tbot's `kubernetes/argo-cd` service. [#62709](https://github.com/gravitational/teleport/pull/62709) * Add `quicksight.aws.amazon.com` as valid URL for AWS Console access. [#62700](https://github.com/gravitational/teleport/pull/62700) * Fixed potential delay in updating User Task status for Discovery resources. [#62699](https://github.com/gravitational/teleport/pull/62699) * Fixed an issue where logging in to the Web UI with Device Trust would lose query params of the redirect URL. [#62677](https://github.com/gravitational/teleport/pull/62677) * Fixed an issue where Teleport Connect could generate a flurry of notifications about not being able to connect to a resource. [#62671](https://github.com/gravitational/teleport/pull/62671) * Fixed issuance of wildcard DNS SANs with Workload Identity. [#62667](https://github.com/gravitational/teleport/pull/62667) * Fixed a memory leak in access list reminder notifications affecting clusters with more than 1000 pending Access List reviews. [#62663](https://github.com/gravitational/teleport/pull/62663) * Added support for health checks to monitor cert authority availability and affect Teleport Auth readiness. [#62637](https://github.com/gravitational/teleport/pull/62637) * Added IAM joining support from new AWS regions in asia. [#62627](https://github.com/gravitational/teleport/pull/62627) * Added VNet config Create/Update/Delete audit events. [#62618](https://github.com/gravitational/teleport/pull/62618) * Added cleanup of access entries for EKS auto-discovered clusters when they no longer match the filtering criteria and are removed. [#62598](https://github.com/gravitational/teleport/pull/62598) * Added `teleport debug metrics` command. [#62586](https://github.com/gravitational/teleport/pull/62586) * Fixed missing initialization of Azure IMDS clients, which could cause operational failures in some Teleport configurations deployed to Azure, in particular when accessing Azure SQL Server. [#62579](https://github.com/gravitational/teleport/pull/62579) * Fixed some auto update audit events showing up as unknown in the web UI. [#62547](https://github.com/gravitational/teleport/pull/62547) * The join tokens UI now indicates which tokens are managed by the Teleport Cloud platform. [#62544](https://github.com/gravitational/teleport/pull/62544) * The tctl tokens add command now includes the CA pins in JSON and YAML output. [#62536](https://github.com/gravitational/teleport/pull/62536) * Added `teleport debug readyz` command. [#62532](https://github.com/gravitational/teleport/pull/62532) * Audit log and session uploader now respect region field of external_audit_storage resource when present. [#62520](https://github.com/gravitational/teleport/pull/62520) * Added default routes to the web UI left nav top-level category buttons. [#62502](https://github.com/gravitational/teleport/pull/62502) * Fixed an issue that prevented searching for users by role in the web UI. [#62474](https://github.com/gravitational/teleport/pull/62474) * Fixed tilde expansion for moderated SFTP. [#62453](https://github.com/gravitational/teleport/pull/62453) * Added support for standard TLS secret key names for helm charts: `teleport-plugin-event-handler`, `teleport-cluster`, `teleport-operator`, `teleport-kube-agent`. [#62451](https://github.com/gravitational/teleport/pull/62451) * Added a plan modifier to recompute kubernetes_resources defaults during role version upgrades, fixing Terraform role upgrade issues. [#62417](https://github.com/gravitational/teleport/pull/62417) * Fix an issue in the Teleport SSH Service where interactive PAM Auth modules always fail when trying to run exec sessions with tty allocated. e.g. `tsh ssh --tty <node> ls`. [#62064](https://github.com/gravitational/teleport/pull/62064) Enterprise: * Fixed an issue in the Entra ID integration where a user account with an unsupported username character `/` could prevent other valid users and groups to be synced to Teleport. Such user accounts are now filtered. * Cockroachdb: add automatic client certificate reloading option. * Enabled UI editing of Access List descriptions. * Added protections against replay attacks when IdP-initiated SAML is enabled. * Added Access Automations Terraform dialog. ## Download Download the current and previous releases of Teleport at https://goteleport.com/download. ## Plugins Download the current release of Teleport plugins from the links below. * Slack [Linux amd64](https://cdn.teleport.dev/teleport-access-slack-v18.6.4-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-slack-v18.6.4-linux-arm64-bin.tar.gz) * Mattermost [Linux amd64](https://cdn.teleport.dev/teleport-access-mattermost-v18.6.4-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-mattermost-v18.6.4-linux-arm64-bin.tar.gz) * Discord [Linux amd64](https://cdn.teleport.dev/teleport-access-discord-v18.6.4-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-discord-v18.6.4-linux-arm64-bin.tar.gz) * Terraform Provider [Linux amd64](https://cdn.teleport.dev/terraform-provider-teleport-v18.6.4-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/terraform-provider-teleport-v18.6.4-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/terraform-provider-teleport-v18.6.4-darwin-amd64-bin.tar.gz) | [macOS arm64](https://cdn.teleport.dev/terraform-provider-teleport-v18.6.4-darwin-arm64-bin.tar.gz) | [macOS universal](https://cdn.teleport.dev/terraform-provider-teleport-v18.6.4-darwin-universal-bin.tar.gz) * Event Handler [Linux amd64](https://cdn.teleport.dev/teleport-event-handler-v18.6.4-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-event-handler-v18.6.4-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/teleport-event-handler-v18.6.4-darwin-amd64-bin.tar.gz) * PagerDuty [Linux amd64](https://cdn.teleport.dev/teleport-access-pagerduty-v18.6.4-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-pagerduty-v18.6.4-linux-arm64-bin.tar.gz) * Jira [Linux amd64](https://cdn.teleport.dev/teleport-access-jira-v18.6.4-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-jira-v18.6.4-linux-arm64-bin.tar.gz) * Email [Linux amd64](https://cdn.teleport.dev/teleport-access-email-v18.6.4-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-email-v18.6.4-linux-arm64-bin.tar.gz) * Microsoft Teams [Linux amd64](https://cdn.teleport.dev/teleport-access-msteams-v18.6.4-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-msteams-v18.6.4-linux-arm64-bin.tar.gz)