---
title: "Depot 0.6.0"
description: "Distribution-aware vulnerability findings, script delivery evidence, terminal controls, policy previews, and Windows device management (preview)."
url: "https://support.outpostplatform.com/releases/depot/0.6.0/"
product: "depot"
type: "release-note"
status: "draft"
ai_summary: "Depot 0.6.0 adds distribution-aware vulnerability matching, separate unverified and no-fix counts, script delivery evidence, remote terminal policy, pre-enrollment policy previews, host firewall status, capability reporting, and retirement-aware alerts. Package identity and script delivery reporting require agent 0.3.0 or later."
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/releases/depot/0.6.0.md"
license: "CC BY 4.0"
---

# Depot 0.6.0

Depot 0.6.0 helps IT teams and MSPs prioritize vulnerabilities, verify script
policy delivery, and keep retired endpoints out of the active alert queue.
These improvements are based on evaluator feedback.

## Highlights {#highlights}

- **Vulnerability priorities.** Distribution security data recognizes
  backported fixes. Unverified matches and findings without a distribution
  fix have separate counts.
- **Policy evidence.** See whether an agent received its script settings,
  and preview a site's policy before enrolling an endpoint.
- **Alert ownership.** **Unresolved** includes open and acknowledged alerts.
  Retirement closes both with a reason that preserves their meaning.

## Added {#added}

### Policy and remote terminals

- **Preview policy for new endpoints** on site and enrollment pages shows
  what an endpoint of a chosen operating system would receive. The result is
  marked as a preview, with no endpoint evidence. See
  [Preview before enrollment](/automation/effective-configuration/#preview-before-enrollment).
- **Remote shell** policy controls interactive terminal access independently
  of scripts, including AI and MCP terminal access. See
  [Remote shell settings](/automation/policy-settings/#remote-shell).

### Windows device management (preview)

- Enroll PCs in bulk with a provisioning package, or from the Outpost agent
  already on a PC.
- Deliver security, management, kiosk and shared-PC settings, Wi-Fi and VPN
  profiles, device certificates, and ADMX-backed policies. Outpost reads each
  setting back to confirm it applied.
- Run Fresh Start, wipe, locate, and diagnostics actions. Fresh Start needs a
  second person's approval by default.
- Use Windows build and device health attestation results in compliance.

See [Windows](/mdm/windows/).

### Endpoint visibility

- Linux, macOS, and BSD security views show **Host firewall** with the
  detected firewall. **Not reported** means no firewall tooling answered.
  The disabled-firewall alert explicitly states that upstream protection is
  not assessed. See [Endpoint security](/endpoints/endpoint-details/#security).
- **Agent capabilities** on the endpoint overview lists supported,
  report-only, and unavailable capabilities, with reasons. Missing evidence
  is identified as not reported. See [Endpoint capabilities](/endpoints/#what-an-endpoint-can-do-depends-on-its-platform).

## Changed {#changed}

### Vulnerability assessment

- Linux packages use distribution security data from the Debian security
  tracker and OSV, with native package version comparisons. Feed families
  include Debian, Ubuntu, AlmaLinux, Rocky Linux, Red Hat, SUSE, and Alpine.
  Verification requires exact release coverage, including the exact product
  for Red Hat and SUSE.
- Findings show their source. **Upstream match, not distro-verified** and
  **No distro fix available** remain visible for awareness and are counted
  separately from critical and high findings.
- Distribution severity ratings take precedence when assigned; otherwise
  NVD supplies the severity. Outpost checks for newly reported distribution
  releases about every 15 minutes. Findings refresh on the next scan.

See [Vulnerabilities](/automation/vulnerabilities/) for source labels,
coverage, and how to review findings.

### Script settings

- **Effective config** identifies script delivery as **Agent (script
  environment)**, with **Applied**, **Pending**, or **Not reported** evidence.
- Profile edits, assignments, site moves, and server-role tag changes send
  updated settings to connected endpoints right away.

See [Script delivery](/automation/effective-configuration/#script-delivery).

### Alerts and retirement

- Retiring an endpoint resolves open and acknowledged alerts as **Endpoint
  retired** and stops pending escalations.
- Alert views default to current endpoints. **Include retired endpoints**
  includes their alert history.
- **Unresolved** totals include open and acknowledged alerts, because
  acknowledgment does not mean remediation.
- The queue warns when no notification rules are active.

See [Alerts](/service-desk/alerts/) and
[Retire an endpoint](/agent/retire-and-uninstall/).

### Console

Lists, page headers and dialogs name users, technicians, endpoints, clients,
profiles and other records instead of showing internal IDs. A record with no
name reads **Unknown**.

## Fixed {#fixed}

### Vulnerability matching

NVD matches respect applicability conditions. Add-ins and plug-ins are
assessed as separate products from their hosts.

## Security {#security}

The agent enforces script settings and refuses one-off, scheduled, library,
and AI or MCP script runs when scripts are off. Outpost and the agent also
enforce the separate interactive terminal setting.

## Upgrade notes {#upgrade-notes}

Outpost manages the hosted service update. Use agent 0.3.0 or later for
distribution package identity and script delivery reporting. Older agents'
Linux package findings remain not distro-verified.

After the agent updates, check **Effective config** for script delivery
evidence and review vulnerability findings after the next scan. See
[Agent 0.3.0](/releases/agent/0.3.0/) and [Agent updates](/agent/updates/).