https://cybertoolchain.io/tools/pomerium New releases and features in Pomerium, tracked by The Cyber Toolchain. en Mon, 12 Oct 2026 08:08:05 GMT https://www.pomerium.com/changelog https://www.pomerium.com/changelog Mon, 12 Oct 2026 08:08:05 GMT Pomerium adds MCP OAuth gateway, hosted IdP, SSH session recording, incremental config diffing, and Databroker query engine in v0.32.0⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `pomerium_additional_hosts` query parameter at the route level to declare cross-origin authentication dependencies, so Pomerium sets session cookies across up to five domains during a single OAuth flow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a new `GetOptions` API on the Databroker with field-level indexing, additional filter operators, and `order by` support, replacing full-record scans with targeted lookups. • Adds a hosted identity provider type so Pomerium can manage its own OIDC provider, removing the requirement to stand up an external IdP before getting started. • Improves MCP support by adding OAuth refresh token issuance and honoring for MCP sessions, keeping long-running agents connected without repeated interactive logins, and by adding dynamic client registration via client ID metadata documents so MCP clients can register with Pomerium automatically. • Adds a control-plane debug server with gRPC `channelz` support for inspecting live gRPC channels and connections. • Adds a Databroker browser debug view for browsing Databroker records directly to diagnose session, policy, or sync issues. • Adds streaming health updates over gRPC so dashboards and the Enterprise Console can reflect component health in real time. • Adds SSH session recording and playback for privileged SSH connections in Pomerium Enterprise, with full keystroke and terminal output capture reviewable from the Console. • Adds reverse tunneling, jump-host mode, an interactive routes portal, and per-key session revocation to Native SSH Access in v0.32.0. • Switches Native SSH Access from the Device Code flow to the standard OAuth Authorization Code flow. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/pomerium https://www.pomerium.com/changelog https://www.pomerium.com/changelog Tue, 06 Oct 2026 07:36:35 GMT Pomerium adds SSH session recording, MCP OAuth hardening, distroless images, and new Enterprise Console startup flags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `-directory-provider` and related startup flags to the Enterprise Console, enabling full directory sync configuration without the web UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `-url` startup flag to the Enterprise Console to auto-create the console's own Pomerium route on first boot. • Adds `base-nossl-debian12` distroless base image variant for published Pomerium container images, structurally removing `libssl3` from every deployment. • Adds `node_id` as an alternative stable primary key for GitHub directory provider users, preventing policy breakage on GitHub account renames. • Adds OAuth Client ID Metadata Document (CIMD) support for inbound MCP authorization, letting downstream clients (Claude Code, ChatGPT, MCP Inspector) identify via CIMD. • Adds configurable inbound Dynamic Client Registration in Pomerium Zero, off by default in Pomerium core and togglable per cluster in Zero cluster settings under the MCP section. • Adds RFC 8252 §7.3-compliant loopback redirect URI matching for MCP OAuth, allowing CLI clients to request a different loopback port than originally registered. • Relaxes `client_id` metadata URL validation to accept query strings, resolving rejections for ChatGPT's MCP connector. • Adds upstream OAuth support for MCP routes — Pomerium discovers upstream OAuth metadata, completes authorization flows, caches client and token state, and injects upstream access tokens into MCP traffic. • Adds Dynamic Client Registration fallback for upstream MCP OAuth flows. • Adds auto-discovery for MCP `connect`, `disconnect`, and `authorize` endpoints, reducing static upstream OAuth configuration. • Adds `pkg/mcp/configapi` library exposing Pomerium's `ConfigService` as MCP tools, with generated schemas, sensitive-field handling, and update-safety checks. • Adds MCP route indicators and connect/disconnect controls to the routes portal. • Adds SSH session recording and playback to Pomerium Enterprise, capturing every keystroke and terminal output for privileged SSH connections. • Supports local on-disk directory or any S3-compatible bucket as SSH session recording storage, configured per cluster. • Adds a blob-URI builder in the Enterprise Console for configuring SSH session recording storage without hand-writing connection strings. • Adds a Recordings UI in the Enterprise Console to browse, sort, and filter SSH session recordings by route, SSH user, target host, duration, and size. • Records SSH sessions in `.asciicast` (asciinema-style) format for portable storage and replay. • Adds 'Revoke and block future authentication' option to the session revocation dialog in the Enterprise Console. • Returns the cluster health panel to the Enterprise Console in a lighter-weight implementation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/pomerium https://www.pomerium.com/changelog/enterprise-console-updates https://www.pomerium.com/changelog/enterprise-console-updates Fri, 21 Aug 2026 00:00:00 GMT Pomerium Enterprise Console adds `-directory-provider` and `-url` startup flags, plus a restored cluster health view. • Adds `-directory-provider` and related startup flags so directory sync can be fully configured at launch without using the web UI. • Adds `-url` startup flag that lets the console automatically create its own Pomerium route on first boot, eliminating a manual setup step for new installs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/pomerium https://www.pomerium.com/changelog/mcp-oauth-compatibility-hardening https://www.pomerium.com/changelog/mcp-oauth-compatibility-hardening Fri, 21 Aug 2026 00:00:00 GMT Pomerium adds MCP OAuth server-side hardening: CIMD support, configurable inbound DCR, RFC 8252 loopback matching, and prefixed tokens. • Adds OAuth Client ID Metadata Document (CIMD) support for inbound MCP routes, letting downstream clients (Claude Code, ChatGPT, MCP Inspector) identify themselves via the lighter-weight CIMD registration path instead of full DCR. • Adds a runtime toggle in Pomerium Zero cluster settings to enable inbound Dynamic Client Registration (DCR) per cluster; the feature ships off by default instead of relying on a single global default. • MCP access and refresh tokens are now issued with prefixes `pom_mat_…` and `pom_mrt_…`, making Pomerium-issued credentials identifiable in logs and catchable by secret-scanning tools. • Loopback redirect URI matching is now RFC 8252 §7.3-compliant: port differences on localhost/loopback URIs are ignored, allowing CLI clients like Claude Code to use a different loopback port than the one originally registered. • Relaxes `client_id` metadata URL validation to accept URLs containing a query string, enabling compatibility with ChatGPT's MCP connector which was previously rejected with a 400. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/pomerium https://www.pomerium.com/changelog/platform-image-hardening https://www.pomerium.com/changelog/platform-image-hardening Fri, 21 Aug 2026 00:00:00 GMT Pomerium ships distroless images and stable GitHub user keying via `node_id` to harden deployments. • Pomerium container images now use the `base-nossl-debian12` distroless variant instead of `base-debian12`, structurally removing `libssl3` from every deployment. • The GitHub directory provider can now use GitHub's stable `node_id` as the primary key for directory users instead of the GitHub login (username), so policies survive account renames or username reuse. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/pomerium https://www.pomerium.com/changelog/configurable-dns-resolvers https://www.pomerium.com/changelog/configurable-dns-resolvers Thu, 23 Jul 2026 15:49:58 GMT Pomerium v0.32.0 adds configurable DNS resolvers with custom servers and tunable refresh rates for upstream hostname resolution. • Supports specifying custom DNS servers for resolving upstream routes, independent of the host system's resolver. • Enables tunable DNS refresh rates so Pomerium picks up record changes on a schedule matching your environment. • Delivers consistent, centrally configured name resolution across all Pomerium components for dynamic and clustered deployments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/pomerium https://www.pomerium.com/changelog/faster-config-updates-a-new-databroker-query-engine https://www.pomerium.com/changelog/faster-config-updates-a-new-databroker-query-engine Thu, 23 Jul 2026 15:49:58 GMT Pomerium v0.32.0 adds incremental route diffing, a new Databroker query/index engine, and Pebble-backed in-memory storage. • Adds incremental config diffing for routes — only changed routes are recomputed and applied, reducing churn on large route sets. • Introduces Databroker indexing and query support, including field-based record lookup, a new GetOptions API, additional filter operators, and order-by. • Replaces the in-memory store with Pebble, aligning it with the persistent backend and setting a default path for the file backend. • Sync gains a 'latest stream' option and safely aborts calls with invalid record versions, improving resilience for large deployments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/pomerium https://www.pomerium.com/changelog/hosted-identity-provider https://www.pomerium.com/changelog/hosted-identity-provider Thu, 23 Jul 2026 15:49:58 GMT Pomerium v0.32.0 adds a hosted identity provider so teams can authenticate without standing up their own OIDC server. • New hosted identity provider type lets Pomerium manage authentication without requiring teams to configure an external OIDC provider. • Built-in refresh handling authenticates session refresh requests and correctly hashes the derived IdP configuration for clean session renewal. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/pomerium https://www.pomerium.com/changelog/mcp-refresh-tokens-dynamic-client-registration-friendlier-errors https://www.pomerium.com/changelog/mcp-refresh-tokens-dynamic-client-registration-friendlier-errors Thu, 23 Jul 2026 15:49:58 GMT Pomerium MCP gateway gains OAuth refresh tokens, dynamic client registration, and customizable error pages. • Adds OAuth refresh token support for MCP sessions, keeping long-running AI agents and clients connected without repeated interactive logins. • Supports dynamic client registration via client ID metadata documents, letting MCP clients register with Pomerium automatically. • Enables customizable MCP 401 error pages with clearer messaging for unauthorized client domains. • Makes allowed client domains optional in MCP configuration, simplifying onboarding. • Sets a proper WWW-Authenticate header on unauthorized MCP responses. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/pomerium https://www.pomerium.com/changelog/mcp-upstream-oauth-dynamic-client-registration-route-discovery https://www.pomerium.com/changelog/mcp-upstream-oauth-dynamic-client-registration-route-discovery Thu, 23 Jul 2026 15:49:58 GMT Pomerium's MCP gateway gains upstream OAuth with token caching, Dynamic Client Registration, and route auto-discovery. • Adds upstream OAuth support for MCP routes: Pomerium discovers upstream OAuth metadata, completes authorization flows, caches client and token state, and injects upstream access tokens into MCP traffic. • Adds Dynamic Client Registration (DCR) as a fallback for upstream OAuth flows, enabling tools like MCP Inspector that lack Client ID Metadata Document support. • Includes the `iss` parameter in MCP authorization flows, returning Pomerium's host as the issuer to align with the upcoming 2026-07-28 MCP spec. • Enables auto-discovery for MCP connect, disconnect, and authorize endpoints, reducing static upstream OAuth configuration for compatible servers. • MCP metadata discovery now uses SSRF-safe HTTP fetching with stricter protected-resource metadata handling, including path-prefix validation. • MCP routes in the routes portal now display server indicators and connect/disconnect controls for easier identification and management. • Adds proactive upstream token refresh before forcing reauthentication, upstream auth recovery after late config delivery, and clearer errors when upstream tokens can't be resolved. • Introduces a new `pkg/mcp/configapi` library that exposes Pomerium's ConfigService as MCP tools, with generated schemas, sensitive-field handling, and update-safety checks. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/pomerium https://www.pomerium.com/changelog/native-ssh-authorization-code-flow-reverse-tunnels-jump-host-mode https://www.pomerium.com/changelog/native-ssh-authorization-code-flow-reverse-tunnels-jump-host-mode Thu, 23 Jul 2026 15:49:58 GMT Pomerium v0.32.0 adds OAuth Authorization Code flow, reverse tunnels, jump-host mode, and an interactive routes portal for native SSH. • Switches SSH authentication to the OAuth Authorization Code flow (replacing Device Code), delivering a faster browser login with full telemetry observability. • Adds reverse tunneling via `ssh_upstream_tunnel` flag, letting upstream SSH servers dial out to Pomerium — ideal for edge devices, NAT'd networks, and isolated environments. • Adds jump-host (ProxyJump) mode via `ssh_allow_direct_tcpip` flag, letting clients connect through Pomerium to upstreams without requiring the upstream to trust Pomerium's User CA. • Adds an interactive routes portal via `ssh_routes_portal` flag, presenting authorized destinations as a picker when a client SSHes to Pomerium without specifying a route. • Adds per-key session management and revocation in the Pomerium UI, binding each SSH key to an OAuth user with policy evaluated on every connection. • Adds Pomerium policy support for upstream SSH tunnels. Breaking changes: • SSH authentication now uses the Authorization Code grant; upstream IdPs must have the Authorization Code grant enabled (v0.31.x and earlier used Device Code, which is no longer used). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/pomerium https://www.pomerium.com/changelog/revoke-and-block-stronger-session-revocation-enterprise https://www.pomerium.com/changelog/revoke-and-block-stronger-session-revocation-enterprise Thu, 23 Jul 2026 15:49:58 GMT Pomerium Enterprise adds 'Revoke and block future authentication' to permanently lock out users during incident response. • Adds a 'Revoke and block future authentication' option to the session revocation dialog, preventing SSO re-authentication loops after revocation. • Enforces blocks via a deny/revocation list so blocked users are rejected on all subsequent requests, not just the current session. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/pomerium https://www.pomerium.com/changelog/ssh-session-recording-enterprise https://www.pomerium.com/changelog/ssh-session-recording-enterprise Thu, 23 Jul 2026 15:49:58 GMT Pomerium Enterprise adds SSH session recording with full keystroke capture, S3-compatible storage, and a Console playback UI. • Adds full SSH session capture and playback: every keystroke and terminal output for privileged SSH connections is recorded and replayable directly from the Enterprise Console. • Supports flexible recording storage: point recordings at a local on-disk directory or any S3-compatible bucket, configured per cluster. • Introduces a blob-URI builder in the Enterprise Console so admins can configure recording storage without hand-writing connection strings, with support for Go CDK driver options and advanced parameters. • New Recordings UI lets teams browse, sort, and filter SSH session recordings by route, SSH user, target host, duration, and size. • Recordings are stored in open, portable asciinema-style (.asciicast) format for easy archiving, parsing, and third-party replay. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/pomerium https://www.pomerium.com/changelog/ssh-session-recording-enterprise https://www.pomerium.com/changelog/ssh-session-recording-enterprise Thu, 23 Jul 2026 15:49:58 GMT Pomerium Enterprise adds SSH session recording with full keystroke capture, S3-compatible storage, and a Console playback UI. • Adds full SSH session capture and playback: every keystroke and terminal output for privileged SSH connections is recorded and replayable directly from the Enterprise Console. • Supports flexible recording storage: point recordings at a local on-disk directory or any S3-compatible bucket, configured per cluster. • Introduces a blob-URI builder in the Enterprise Console so admins can configure recording storage without hand-writing connection strings, with support for Go CDK driver options and advanced parameters. • New Recordings UI lets teams browse, sort, and filter SSH session recordings by route, SSH user, target host, duration, and size. • Recordings are stored in open, portable asciinema-style (.asciicast) format for easy archiving, parsing, and third-party replay. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/pomerium https://www.pomerium.com/changelog/native-ssh-authorization-code-flow-reverse-tunnels-jump-host-mode https://www.pomerium.com/changelog/native-ssh-authorization-code-flow-reverse-tunnels-jump-host-mode Thu, 23 Jul 2026 15:49:58 GMT Pomerium v0.32.0 adds OAuth Authorization Code flow, reverse tunnels, jump-host mode, and an interactive routes portal for native SSH. • Switches SSH authentication to the OAuth Authorization Code flow (replacing Device Code), delivering a faster browser login with full telemetry observability. • Adds reverse tunneling via `ssh_upstream_tunnel` flag, letting upstream SSH servers dial out to Pomerium — ideal for edge devices, NAT'd networks, and isolated environments. • Adds jump-host (ProxyJump) mode via `ssh_allow_direct_tcpip` flag, letting clients connect through Pomerium to upstreams without requiring the upstream to trust Pomerium's User CA. • Adds an interactive routes portal via `ssh_routes_portal` flag, presenting authorized destinations as a picker when a client SSHes to Pomerium without specifying a route. • Adds per-key session management and revocation in the Pomerium UI, binding each SSH key to an OAuth user with policy evaluated on every connection. • Adds Pomerium policy support for upstream SSH tunnels. Breaking changes: • SSH authentication now uses the Authorization Code grant; upstream IdPs must have the Authorization Code grant enabled (v0.31.x and earlier used Device Code, which is no longer used). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/pomerium https://www.pomerium.com/changelog/mcp-upstream-oauth-dynamic-client-registration-route-discovery https://www.pomerium.com/changelog/mcp-upstream-oauth-dynamic-client-registration-route-discovery Thu, 23 Jul 2026 15:49:58 GMT Pomerium's MCP gateway gains upstream OAuth with token caching, Dynamic Client Registration, and route auto-discovery. • Adds upstream OAuth support for MCP routes: Pomerium discovers upstream OAuth metadata, completes authorization flows, caches client and token state, and injects upstream access tokens into MCP traffic. • Adds Dynamic Client Registration (DCR) as a fallback for upstream OAuth flows, enabling tools like MCP Inspector that lack Client ID Metadata Document support. • Includes the `iss` parameter in MCP authorization flows, returning Pomerium's host as the issuer to align with the upcoming 2026-07-28 MCP spec. • Enables auto-discovery for MCP connect, disconnect, and authorize endpoints, reducing static upstream OAuth configuration for compatible servers. • MCP metadata discovery now uses SSRF-safe HTTP fetching with stricter protected-resource metadata handling, including path-prefix validation. • MCP routes in the routes portal now display server indicators and connect/disconnect controls for easier identification and management. • Adds proactive upstream token refresh before forcing reauthentication, upstream auth recovery after late config delivery, and clearer errors when upstream tokens can't be resolved. • Introduces a new `pkg/mcp/configapi` library that exposes Pomerium's ConfigService as MCP tools, with generated schemas, sensitive-field handling, and update-safety checks. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/pomerium https://www.pomerium.com/changelog/revoke-and-block-stronger-session-revocation-enterprise https://www.pomerium.com/changelog/revoke-and-block-stronger-session-revocation-enterprise Thu, 23 Jul 2026 15:49:58 GMT Pomerium Enterprise adds 'Revoke and block future authentication' to permanently lock out users during incident response. • Adds a 'Revoke and block future authentication' option to the session revocation dialog, preventing SSO re-authentication loops after revocation. • Enforces blocks via a deny/revocation list so blocked users are rejected on all subsequent requests, not just the current session. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/pomerium https://www.pomerium.com/changelog/mcp-refresh-tokens-dynamic-client-registration-friendlier-errors https://www.pomerium.com/changelog/mcp-refresh-tokens-dynamic-client-registration-friendlier-errors Thu, 23 Jul 2026 15:49:58 GMT Pomerium MCP gateway gains OAuth refresh tokens, dynamic client registration, and customizable error pages. • Adds OAuth refresh token support for MCP sessions, keeping long-running AI agents and clients connected without repeated interactive logins. • Supports dynamic client registration via client ID metadata documents, letting MCP clients register with Pomerium automatically. • Enables customizable MCP 401 error pages with clearer messaging for unauthorized client domains. • Makes allowed client domains optional in MCP configuration, simplifying onboarding. • Sets a proper WWW-Authenticate header on unauthorized MCP responses. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/pomerium https://www.pomerium.com/changelog/hosted-identity-provider https://www.pomerium.com/changelog/hosted-identity-provider Thu, 23 Jul 2026 15:49:58 GMT Pomerium v0.32.0 adds a hosted identity provider so teams can authenticate without standing up their own OIDC server. • New hosted identity provider type lets Pomerium manage authentication without requiring teams to configure an external OIDC provider. • Built-in refresh handling authenticates session refresh requests and correctly hashes the derived IdP configuration for clean session renewal. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/pomerium https://www.pomerium.com/changelog/faster-config-updates-a-new-databroker-query-engine https://www.pomerium.com/changelog/faster-config-updates-a-new-databroker-query-engine Thu, 23 Jul 2026 15:49:58 GMT Pomerium v0.32.0 adds incremental route diffing, a new Databroker query/index engine, and Pebble-backed in-memory storage. • Adds incremental config diffing for routes — only changed routes are recomputed and applied, reducing churn on large route sets. • Introduces Databroker indexing and query support, including field-based record lookup, a new GetOptions API, additional filter operators, and order-by. • Replaces the in-memory store with Pebble, aligning it with the persistent backend and setting a default path for the file backend. • Sync gains a 'latest stream' option and safely aborts calls with invalid record versions, improving resilience for large deployments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/pomerium https://www.pomerium.com/changelog/configurable-dns-resolvers https://www.pomerium.com/changelog/configurable-dns-resolvers Thu, 23 Jul 2026 15:49:58 GMT Pomerium v0.32.0 adds configurable DNS resolvers with custom servers and tunable refresh rates for upstream hostname resolution. • Supports specifying custom DNS servers for resolving upstream routes, independent of the host system's resolver. • Enables tunable DNS refresh rates so Pomerium picks up record changes on a schedule matching your environment. • Delivers consistent, centrally configured name resolution across all Pomerium components for dynamic and clustered deployments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/pomerium https://www.pomerium.com/changelog/ssh-session-recording-enterprise https://www.pomerium.com/changelog/ssh-session-recording-enterprise Fri, 19 Jun 2026 00:00:00 GMT Pomerium Enterprise adds SSH session recording and playback with Console UI and S3/local storage support • Adds a blob-URI builder in the Enterprise Console for configuring SSH recording storage via Go CDK driver options • Adds SSH session recording and playback UI in the Enterprise Console with filtering by route, user, host, duration, and size • Captures SSH sessions in `.asciicast` format for portable storage and replay Full history on Cyber Toolchain: https://cybertoolchain.io/tools/pomerium https://www.pomerium.com/changelog/revoke-and-block-stronger-session-revocation-enterprise https://www.pomerium.com/changelog/revoke-and-block-stronger-session-revocation-enterprise Wed, 08 Apr 2026 00:00:00 GMT Pomerium adds 'Revoke and block' option to prevent SSO re-auth loops in Enterprise Console • Adds a 'Revoke and block future authentication' checkbox to the session revocation dialog in the Enterprise Console Full history on Cyber Toolchain: https://cybertoolchain.io/tools/pomerium https://www.pomerium.com/changelog/configurable-dns-resolvers https://www.pomerium.com/changelog/configurable-dns-resolvers Tue, 20 Jan 2026 00:00:00 GMT Pomerium v0.32.0 introduces configurable DNS resolvers and tunable refresh rates via new configuration options. • Adds the ability to specify custom DNS servers for upstream hostname resolution, allowing Pomerium to bypass the host system's resolver • Adds tunable DNS record refresh intervals so administrators can control how frequently Pomerium updates cached address records Full history on Cyber Toolchain: https://cybertoolchain.io/tools/pomerium https://www.pomerium.com/changelog/native-ssh-authorization-code-flow-reverse-tunnels-jump-host-mode https://www.pomerium.com/changelog/native-ssh-authorization-code-flow-reverse-tunnels-jump-host-mode Tue, 20 Jan 2026 00:00:00 GMT Pomerium v0.32.0 adds SSH reverse tunnels, jump-host mode, OAuth auth code flow and interactive routes portal • SSH logins now use the standard `Authorization Code` grant instead of Device Code for faster browser login. • Adds support for reverse tunneling via the `ssh_upstream_tunnel` runtime flag to reach hosts behind NAT or edge devices. • Enables jump-host (ProxyJump) mode through the `ssh_allow_direct_tcpip` runtime flag, allowing policy enforcement without upstream trust of Pomerium's User CA. • Introduces an interactive routes portal enabled by the `ssh_routes_portal` runtime flag for selecting destinations from a picker. • Allows per-key session revocation listed in the Pomerium UI. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/pomerium