LuLu changelog
Back to LuLu22 releases since February 2025 · GitHub releases, checked Oct 26, 2026
4.5.3Latest
🆕 You can now sponsor LuLu/Objective-See Foundation:
[](https://github.com/sponsors/objective-see)
☑️ Connections to 0.0.0.0 / :: are now treated as localhost macOS rewrites these to the loopback address, so such traffic never leaves the machine. With "Allow Localhost Traffic" enabled, these connections are now allowed instead of triggering alerts (or in some cases, failing).
🔐 Disk Image Hash (SHA256): LuLu_4.5.3.dmg: E50625191B5F9FEDD56C545F2D630993470DBBA0BC12D85B737372C79CC91AFF
4.5.2
🆕 You can now sponsor LuLu/Objective-See Foundation:
[](https://github.com/sponsors/objective-see)
☑️ Native Liquid Glass UI (macOS 26+) Connection alerts, dialogs, and the startup/update/about windows now use native glass (thanks @32r7ue, #934).
☑️ Improved extension memory growth Alerts that could never be answered (e.g. the app went away mid-delivery) left flows paused and held forever; these are now cleaned up.
☑️ Improved handling of delegated flows Flows created on behalf of an app by a system process (e.g. mDNSResponder) are now evaluated as that app, instead of being denied once the app exits.
☑️ No more duplicate rules Answering two alerts for the same item no longer creates two identical rules.
☑️ "Move to /Applications" on launch If launched from elsewhere (e.g. ~/Downloads), LuLu now offers to move itself to /Applications and relaunch.
☑️ Greek localization Thanks @Camthalion77.
🔐 Disk Image Hash (SHA256): LuLu_4.5.2.dmg: 9C6D2F8B24E75424F8B3A595C0166C59B40660B6DF1B2FB5C101FBA5F86B5D69
4.5.1
🆕 You can now sponsor LuLu/Objective-See Foundation:
[](https://github.com/sponsors/objective-see)
☑️ Improved 'Add Rules' window logic Better handing of deleted/invalid rules.
☑️ Improved startup New checkin logic to handle upgrade cases better.
🔐 Disk Image Hash (SHA256): LuLu_4.5.1.dmg: 98F4D3427F4C6FCCF9680FED22879BE90A5AE81E80EB8616C1D758755B6BB624
4.5.0
🆕 You can now sponsor LuLu/Objective-See Foundation:
[](https://github.com/sponsors/objective-see)
☑️ New: Rule option for "Process + Kids" If selected a rule will be created that will subsequently apply to the process, and any children of it.
☑️ Improved handling of "No client" Now, when no user client is present, new rules are created, but will show up in "Passively created rules" in UI.
☑️ Rule matching order improved (e.g. DNS for Apple Programs)
☑️ Alert now remember previous choices ☑️ UI improvements (Rules window live refresh, etc.) ☑️ Alert now more likely to show domain (macOS 11, via flow.remoteHostname)
☑️ Improved localizations ☑️ Improved logic around importing rules ☑️ Improved handling of Simulator apps ☑️ Improved handling of glob and CIDR rules ☑️ Improved handling of Regex rules (are now anchored).
🔐 Disk Image Hash (SHA256): LuLu_4.5.0.dmg: 33B624CCF3640D2708993885E2AE7A266C3EC4EE0C3784DC9036E95368664CB1
4.4.3
☑️ Fix for #904 (LuLu Extension Not Starting) Part of the rules format changed, so decoder was updated.
🔐 Disk Image Hash (SHA256): LuLu_4.4.3.dmg: 5C271AE161EC84ABAB9B430B647D20FA7DB09D9EF9113528788D8C33AB5475C0
4.4.2
🆕 You can now sponsor LuLu/Objective-See Foundation:
[](https://github.com/sponsors/objective-see)
☑️ Fix for #904
🔐 Disk Image Hash (SHA256): LuLu_4.4.2.dmg: 93665CE8494524D4CF7312C3504A78C800CBA20D3998E2AEC1AA9E544A20238C
4.4.1
🆕 You can now sponsor LuLu/Objective-See Foundation:
[](https://github.com/sponsors/objective-see)
☑️ Resume flows on disable ☑️ Improved block/allow list loading ☑️ Improved handling of "temporarily allowed" rules
🔐 Disk Image Hash (SHA256): LuLu_4.4.1.dmg: EE9C561705F646BB0F2CF2BA02484AFFAB6F18ADA44E09E4F0B426153FB59891
4.4.0
🆕 You can now sponsor LuLu/Objective-See Foundation:
[](https://github.com/sponsors/objective-see)
☑️ Approved compatibility with Apple's code signing changes in macOS 26.6 / Golden Gate
☑️ Support for rules with glob (*), range (-), or CIDR (/) notation ☑️ UI rendering improvements (aimed at addressing #884) ☑️ Improved handling of related / shown alerts (aimed at addressing #873) ☑️ Refactoring of upgrade logic, to avoid having to re-approve (new) system extension ☑️ UI fixed for profile creation ☑️ "Once" option in alert
🔐 Disk Image Hash (SHA256): LuLu_4.4.0.dmg: C9F8C669A7B4E3FF33BD1DF224A65451989142E678D4A3CFF3DB8C3DEB62BCA9
4.3.2
🆕 You can now sponsor LuLu/Objective-See Foundation:
[](https://github.com/sponsors/objective-see)
☑️ Improved localizations ☑️ Improved memory usage ☑️ Fixed UI issue preventing profile creation
🔐 Disk Image Hash (SHA256): LuLu_4.3.2.dmg: 651D85539CB7008B33B8571215A8B8040F4F26D77306675E9C8972294A80F541
4.3.1
🆕 You can now sponsor LuLu/Objective-See Foundation:
[](https://github.com/sponsors/objective-see)
☑️ Fixed issue process related flows ☑️ Double click on Rule's row now brings up 'Edit Rule' window (#843 #827)
🔐 Disk Image Hash (SHA256): LuLu_4.3.1.dmg: CC0366527F1F4123295FD13329A08031A660AFD256076DDAB03E6074365CEF93
4.3.0
🆕 You can now sponsor LuLu/Objective-See Foundation:
[](https://github.com/sponsors/objective-see)
☑️ Improved handling of related flows (#816/#616) Mahalo @jhult 🙏🏽
☑️ Localhost filtering (#809, #430, #371 #55) By default, LuLu allows all localhost traffic. A new setting allows this behavior to be disabled, enabling rules for applications communicating with local services (e.g., a proxy).
🔐 Disk Image Hash (SHA256): LuLu_4.3.0.dmg: F123F9B8D126FDFAFE17297040F54377AAD402CA5BD848D8080F33C436995BFD
4.2.1
🆕 You can now sponsor LuLu/Objective-See Foundation:
[](https://github.com/sponsors/objective-see)
☑️ UI Improvements #812, etc.
☑️ Rule duration, now relative (rather than a fixed end time) #811, #813
☑️ Rules subset (user-created rules) can now be exported/imported #814
☑️ Flows associated with processes that have exited, now denied (mahalo Igor)
🔐 Disk Image Hash (SHA256): LuLu_4.2.1.dmg: ED580410F38E8CC8F17CD4724182F9B7A6BBB1524797FF8E8019428A285244A0
4.2.0
🆕 You can now sponsor LuLu/Objective-See Foundation:
[](https://github.com/sponsors/objective-see)
☑️ Fixed UI issues that could prevent profile creation
☑️ LuLu can now be installed within subfolders of /Applications
☑️ For bundled helper apps without an icon, the parent's icon is now shown
☑️ Rules can now be created with 0.0.0.0/ (IPv4) and ::/0 (IPv6)
🔐 Disk Image Hash (SHA256): LuLu_4.2.0.dmg: 92516F945F681B37600D2649E5296BC48E2BABB8ADF3B8CC6274E95B382C87FA
4.1.0
🆕 You can now sponsor LuLu/Objective-See Foundation:
[](https://github.com/sponsors/objective-see)
☑️ General UI improvements
☑️ Improved Turkish localization
☑️ Improved rule importing and cleanup
☑️ Improved handling bundles when hashing binary
☑️ Added support for 0.0.0.0/0 and ::/0 in allow/block list
🔐 Disk Image Hash (SHA256): LuLu_4.1.0.dmg: A79AA1F793088FAFE1957461702456843D7BA75BBCC472476DF21E9F1D1D3791
4.0.1
🆕 You can now sponsor LuLu/Objective-See Foundation:
[](https://github.com/sponsors/objective-see)
🔎 Improved Logging Per request, added a dedicated debug log msg that shows: Process → Endpoint → Rule → Decision.
To filter on, from Terminal, run:
log stream --level debug --predicate 'subsystem == "com.objective-see.lulu" && composedMessage BEGINSWITH "[LULU]"'
🚮 Rules UI Reverted logic that would hide HTTP/S ports for endpoint rules, as it was a bit confusing to determine whether rule was then for all ports, or just the HTTP/S ones.
🔐 Disk Image Hash (SHA256): LuLu_4.0.1.dmg: BBA85CF9AA333CE2659AFAD8CC58F71B92CA082AC22FAB79DEB6D9B19E6CB16B
4.0.0Big update
🆕 You can now sponsor LuLu/Objective-See Foundation:
[](https://github.com/sponsors/objective-see)
👥 New Feature: Profiles
A profile defines a set of rules and settings. Once activated, the profile's settings apply LuLu-wide and can be modified via LuLu's Settings panes. Any changes to settings or rules (as well as any new rules) will apply only to that profile.
⏸️ New Feature: Disable Rules Either individual rules, or all rules for an entire process can now be disabled
\ ✅ macOS 26 Compatibility Improvements
🪟 Rule's Window Improvements 'Hamburger' menu added contain rule options, such as disable, delete, view paths, etc. Hitting delete on your keyboard, on a selected rule, will also delete the rule. Also, default ports (80/443) are hidden in rules to make the UI cleaner.
🚮 Rule Cleanup Expired and temporary rules now automatically cleaned up / removed
🇮🇹 Additional Localization(s) Italian
✍🏼 Improved Passive Rule Creation Passive mode rule creation now prioritizes domain names over IP addresses. Now, when passive mode creates rules automatically, they will show meaningful names like github.com instead of 140.82.112.3:443.
🔗 Changes to VirusTotal Integration Due to an API key being deprecated, VirusTotal button now open's VirusTotal's report in default browser
🔐 Disk Image Hash (SHA256): LuLu_4.0.0.dmg: DD55AE20D509BEAFDB6E8D82ACBF508608F56C05975DBA35AF303DF6F5FCBA18
🙏🏽 Note, to facilitate with testing/bug reports, you can stream debug log messages via:
log stream --level debug --predicate="subsystem='com.objective-see.lulu'"
(Note: Server-side JSON file will be updated in a few days, so that the update message from within LuLu is displayed. For now, you can manually update by downloading the attached disk image LuLu_4.0.0.dmg)
3.1.5
🌍 Additional Localizations #749, #753 Added Simplified Chinese (zh-Hans). Mahalo @d86e
⚙️ UI Fixes and Improvements: #754 Name added to CFBundleDisplayName #752 Clicking on the 'Rules' menu no longer dismisses the whole menu #743 Improvement for Rules window
Disk Image Hash (SHA1) LuLu_3.1.5.dmg: 518F9008FA529F00C2885FD0075FF98107CB6837
3.1.4
🇫🇷 Improved French localizations Thank you @benjaminach!
☑️ Improving rules view UI scrolling ☑️ Improved handling of "Cancel" buttons in various dialogues ☑️ Fixed bug that could prevent block lists from be correctly initialized
Disk Image Hash (SHA1) LuLu_3.1.4.dmg:70294494FFC72540FB46C219FF093F49FAE54729
3.1.3
🇺🇦 Ukrainian Localization Added Ukrainian localization Thank you MacPaw / Oleksandr!
🇹🇼 Traditional Chinese (Taiwan) Localization Added Chinese (Taiwan) localization Thank you Ice1187!
☑️ Improved Block/Allow List Matching Block/allow lists are now loaded into a sets (faster lookup) and all matching is done on lowercase strings. Moreover, the based domain is also checked (e.g. www.google.com -> google.com)
🌍 Improved (existing) Localizations
Disk Image Hash (SHA1) LuLu_3.1.3.dmg: 2422B0A2255DB17E6D181A8C975550EC95859849
3.1.2
🇰🇷 Korean Added (South) Korean localization
🌍 Improved Localization Translations corrections and UI improvements (to avoid clipping of longer translations) (#710, #714, #719, etc.)
💾 Made user selections in alert persistence For example, if user expands alert to view details, this "preference" will be now be persisted across reboots
Disk Image Hash (SHA1): LuLu_3.1.2.dmg: 1ff00d934b365fe14e89b7ae9cedb0e8755a5f19
Show 2 older releases
3.1.1
👨🏻🔧 Improved Classification of Apple App Store Apps Updated team ids that Apple (now) uses for its App Store applications
👨🏻🔧 Improved Handling of Processes that (quickly) Exit Such processes are now better detected and ignored (related to #711?)
🌍 Improved Localizations Translations corrections and UI improvements (to avoid clipping of longer translations)
⚠️ Added warning, noting that it is recommended that one upgrade to macOS 15.3+, as Apple (finally) fixed several issues that addressed incompatibilities between macOS and 3rd-party network extensions (such as LuLu).
3.1.0
🆕 New Preference: Disable VirusTotal (VT) integration
👨🏻🔧 Improved "Allow Pre-Installed" items preference Items on external volumes, such as disk images, are now ignored
👨🏻🔧 Improved "Cleanup Rules" logic Now, expired rules and process-level (whose process has terminated) are also removed
🌍 Additional Localizations Includes: German, French, Polish, Turkish, Portuguese, etc.
⚠️ It is recommended you upgrade to macOS 15, as Apple (finally) fixed several issues that addressed incompatibilities between macOS and 3rd-party network extensions (such as LuLu).