boring v0.16.2 - Daemon Concurrency Fix

boring v0.16.2 shipped on October 4, 2026. It is a patch release with one functional change: a fix for a minor bug in daemon concurrency, plus a bump in test coverage around that area. If you run the boring daemon in a long lived session, this is the tag to pick up.

The full release notes and downloads are on the GitHub release page.

boring is a small SSH connection manager. Its value for platform work comes from the daemon mode: tunnels stay up in the background, and reconnects happen without a human in the loop. Any bug that shows up under concurrent access to that daemon is the kind that surfaces as a flaky tunnel right when a batch job or an ad hoc port forward needs it.

The release notes describe the bug as minor and do not include a traceback, a reproduction case, or a linked PR. That is honest but thin. The only safe statement is the one the notes make: something in the daemon’s concurrency handling misbehaved, and v0.16.2 fixes it. Operators who have seen odd behavior with multiple simultaneous client invocations against the daemon should treat this as the likely fix and test on this tag.

The project did the right companion work. The same release increases test coverage, and the notes place that increase in the same area as the fix. That pattern usually means the bug was reproduced in a test first and the patch landed against it, which lowers the odds of a silent regression in a later release. Small patch releases with a test attached are more trustworthy than the alternative, where a fix ships untested and waits for the next bug report to confirm it.

Everything else about this release is notable by its absence. No new CLI flags, no config schema changes, no key handling changes, no dependency churn listed. That is the correct shape for a patch. The blast radius is small: if your config file works on the previous tag, it works here.

The tradeoff is that the release notes give no guidance on what triggered the concurrency bug or which version range before 0.16.2 is affected. If you are pinning tunnel tooling in a container image or an install script, you cannot do a targeted risk analysis from these notes. You either upgrade or you do not.

This is a stable release, not a beta or release candidate. It is safe to pin directly in automation, subject to the caveats above about the thin notes.