TigerVNC full changelog

Xvnc now supports hardware accelerated OpenGL and Vulkan on drivers that supports GBM¹
The viewers and servers now follow the XDG Base Directory Specification, like "~/.config", for storing files in the home directory. Existing users will continue using the legacy "~/.vnc" directory, but new users will get the XDG directories.
The native viewer now supports Apple's Diffie-Hellman and UltraVNC's MSLogonII authentication methods
The Java viewer now supports RealVNC's RSA-AES authentication method
Ubuntu 24.04 packages have been added
Red Hat Enterprise Linux 7 and Ubuntu 18.04 packages have been removed as they are EOL
The native viewer has received a mild refresh of the UI appearance
Reverse connections can now be forced to be view-only
The special "%u" marker can be specified for "PlainUsers" to dynamically indicate the user running the server
vncserver can be run without forking for better compatibility with more system service managers
x0vncserver now supports systemd socket activation

A security issue has been fixed in how the viewers handle TLS certificate exceptions
vncserver has gotten a major redesign to be compatible with modern distributions
The native viewer now has touch gestures to handle certain mouse actions (e.g. scroll wheel)
Middle mouse button emulation in the native viewer, for devices with only two mouse buttons
The Java viewer now supports Java 9+, but also now requires Java 8+
Support for alpha cursors in the Java viewer (a feature already supported in the native viewer)
The password and username can now be specified via the environment for the native viewer
Support for building Xvnc/libvnc.so with Xorg 1.20.7+ and deprecate support for Xorg older than 1.16
The official builds have been fixed to work on the upcoming macOS 11
The Windows server (WinVNC) is now packaged separately as it is unmaintained and buggy

This is a security release to fix a number of issues that were found by Kaspersky Lab. These issues affect both the client and server and could theoretically allow an malicious peer to take control over the software on the other side.

The clipboard now supports full Unicode in the native viewer, WinVNC and Xvnc/libvnc.so
The native client will now respect the system trust store when verifying server certificates
Improved compatibility with VMware's VNC server
Improved compatibility with some input methods on macOS
Improvements to the automatic "repair" of JPEG artefacts
Better handling of the Alt keys in some corner cases
The Java web server has been removed as applets are no longer support by most browsers
x0vncserver can now be configured to only allow local connections
x0vncserver has received fixes for when only part of the display is shared
Polling is now default in WinVNC as that works better for most

Alternative, "raw" keyboard mode in the native client and all servers
CapsLock/NumLock/ScrollLock synchronisation in the native client and all servers
Automatic "repair" of JPEG artefacts on screen in all servers
Support for UNIX sockets in the native client and in the UNIX servers
Both clients now warn when sending the password over a possibly insecure channel
Performance improvements in the Java client
The Java client now requires Java 7
Improved high latency handling in all servers
Better keyboard handling in the native client on Windows
Slightly better keyboard handling in x0vncserver
x0vncserver now supports cursors and screen resize
Xorg 1.20 can now be used as a base for Xvnc/libvnc.so

The full release of TigerVNC 1.8.0 is now available. Lots of changes have been made since the last release.
Highlights:
Overhaul of the Java client to match the look and behaviour of the native client
Initial work for multi-threaded decoding in the Java client
vncconfig no longer needed for clipboard with Xvnc/libvnc.so
vncserver has system wide config support
Reduced CPU usage in the native viewer on macOS
macOS requirement raised to 10.6
Full support for alpha cursors in Xvnc/libvnc.so and both viewers

This is a security update for TigerVNC 1.7.0 which fixes a memory overflow issue via the RRE decoder. A malicious server could possibly use this issue to take control of the TigerVNC viewer.

Multi-head support in the Java viewer
Better certificate handling in the Java viewer, including host name verification