* [git.ipfire.org] IPFire 2.x development tree branch, next, updated. 068360263531050f2727b970fdbb50f3add2c505
@ 2026-08-08 16:44 Michael Tremer
0 siblings, 0 replies; only message in thread
From: Michael Tremer @ 2026-08-08 16:44 UTC (permalink / raw)
To: ipfire-scm
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 219385 bytes --]
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, next has been updated
via 068360263531050f2727b970fdbb50f3add2c505 (commit)
via aeafe92d608aa5dfa71620d9243c2433ca6f9e79 (commit)
via 8774f333815c0adf2a26d2b67ebe185836f3b1c0 (commit)
via 2da301e6a7836875f204c66680d821f66d98684e (commit)
via 0dc1965e500bc46915962a300c935ff29757debd (commit)
via d692769d94c752225a7cc48b378be8c389939b56 (commit)
via e1f5b0c63e6cb6c0c82980d3068612adb5c98ec4 (commit)
via 6bfebc4000db303515821b3a6b7ae3873041ec34 (commit)
via c3683dff25fa535af812fb91163dfb820048672d (commit)
via 8be727e203c726186dd5649d433982d361bc0aa7 (commit)
via de065a0192e7969152ea27a1a18290ccdc270fe9 (commit)
via 0cbb458549f2924f43c4c1d47f25d92fffc48b65 (commit)
via 0f49c2d75a2da499c4ce3430a740fa7b5a857485 (commit)
via 809752ad05d48e74fb530df2671bc9e061561a60 (commit)
via e8b349a18216085ef8c09e7c4bb1feef0f08dfaf (commit)
via 4e6180f5abe6625afadd32748c3bc80cfb06e269 (commit)
via 2751eebc46614315a87dc4a3247efd4fdbb0bdb0 (commit)
via 5dc07fb29509b6509d91cb8f873ea4c1dd6860d6 (commit)
via 3d084985cd6ce8359f760cc920ba545a0c2839de (commit)
via 22d60f68d39c1e214511e08a1af980b62cc8222d (commit)
via 3f2ad2ac3801c35d2f2a0389092d727092086b5d (commit)
via 9d6bbad2f620d3058a16e58de8c1cef75bd410f7 (commit)
via b6143f8c1065a54e850c140aad73b1062439ec05 (commit)
via 403a7f9c8c6b05c9369568d8f79da9ddb20ba059 (commit)
via 9839fb681b1434fd8ac22921984d3474eb07f106 (commit)
via 53d845d812ab3f43c3ff5f3705acdced9d001e44 (commit)
via 53ff7d74e65c376468e6b03d8792668568c6e997 (commit)
via 8de1a761474d750ad638a13bd8db9519f63cabd4 (commit)
via 699e136a59202d58714226749d7c8528826a744e (commit)
via 025d72134b6d74e99833699728e52f2ea1ace3f7 (commit)
via 835758bf4fc3488831cd3db396e69c76a9c5f97d (commit)
via 8bc513e1cd04019ca67ff495105b0c2c3ce4ee68 (commit)
via cae2012285d39e45e05049d9df7e51c10212e9eb (commit)
via 9b09332d370de83d949b1ecaaaa4e6360f5c17c4 (commit)
via 9019d363927f58ffddbff64e9e6ce4dfb68331e7 (commit)
via 4e71436cf0bef562517b69174ecbeef7d9e30766 (commit)
from eed04bbef5fff399a3acb63030b972b4fb5044aa (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 068360263531050f2727b970fdbb50f3add2c505
Author: Michael Tremer <michael.tremer@ipfire.org>
Date: Sat Aug 8 16:42:51 2026 +0000
core205: Ship rrdtool
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit aeafe92d608aa5dfa71620d9243c2433ca6f9e79
Author: Matthias Fischer <matthias.fischer@ipfire.org>
Date: Sat Aug 8 17:57:13 2026 +0200
rrdtools: Update to 1.11.0
For details see:
https://github.com/oetiker/rrdtool-1.x/releases/tag/v1.11.0
"Bugfixes
hardening: size the rrd_diff scratch buffer for its largest input @somethingwithproof
rrdtool dump now uses a numeric UTC offset (%z, e.g. +0900) instead
of the locale timezone name (%Z) in XML comments. Locale timezone names
can be encoded in a non-UTF-8 encoding (e.g. CJK locales), which breaks
the XML declaration and causes rrdtool restore to fail with
"Input is not proper UTF-8". The numeric offset is always ASCII.
Note: existing dump files already containing locale timezone names remain
valid XML as long as their encoding matches; newly created dumps will
always contain pure ASCII in these comments. Issue #1173
reported by @k79e, fix by @oetiker.
Fix segfault when --x-grid is given without a trailing date-format
field. The %n conversion in sscanf() is not counted in its return
value, so stroff remained uninitialized when the input ended before
the final : separator; the subsequent stroff != 0 guard read
garbage and could branch into strdup() with a bogus offset. Fixed by
initialising stroff = 0 so a partial match safely falls through to
the existing "invalid x-grid format" error path. Issue #1291
reported by @anvilvapre, fixed by @oetiker
libdbi /derive now returns 0 instead of NaN when the underlying
counter is constant (zero delta). Previously the strict d_value > 0
guard skipped zero deltas the same way it skips negative ones (counter
resets). Changed to d_value >= 0. Issue #550 reported by
@bitionaire, fix by @oetiker.
Fix a 1-byte heap buffer overflow in checkUnusedValues() that
triggered *** buffer overflow detected *** SIGABRT under glibc
fortified strcat() when reporting unused graph arguments. The
function under-allocated by one byte and silently relied on that
overflow to make its trailing : strip land on the right index.
Refactored to size buffers correctly and prepend the separator
rather than build-then-strip, so the two no longer have to agree.
Reported and original fix attempt in PR #1329 by @ppisar,
refactored fix by @oetiker
Pad the Perl $RRDs::VERSION / $RRDp::VERSION numeric encoding so
two-digit minor releases compare monotonically. The numeric version
now uses three-digit zero-padded minor and patch fields, e.g.
1.10.3 -> 1.010003 (previously 1.10003, which was numerically less
than 1.9.0 -> 1.9000). The same encoding is now used by NUMVERS
in configure.ac and win32/rrd_config.h. Note: consumers that
previously tested $RRDs::VERSION >= 1.2 need to update their
checks (use >= 1.002 or compare against the X.Y.Z string via the
version pragma) -- this is unavoidable given the existing format
could not represent two-digit minors monotonically. Issue #1330
reported by @ppisar, fixed by @oetiker
Y-axis labels keep enough fractional precision when the gridstep is
fractional after SI scaling (e.g. values around 10G+), avoiding
duplicate labels on tall graphs. Issue #1326 reported by @muusik,
fixed by @oetiker
Detect nroff support for -Wbreak at configure time, so building the
text documentation works on systems with BSD-derived nroff (e.g.
macOS /usr/bin/nroff). Issue #1323 reported by @gigaimage, fixed by
@oetiker
Fix SIGFPE divide-by-zero crash in rrdtool dump when processing
fuzz-crafted RRD files that contain an RRA with pdp_cnt or
pdp_step equal to zero. The modulo operation at the heart of the
timestamp calculation is now guarded: such files are rejected with
a descriptive error message instead of crashing.
Issue #783 reported by @rwhitworth, fix by @oetiker.
Features
rrdgraph: new --vertical-label-angle and --right-axis-label-angle options
to rotate the two y axis legends independently at run time. The compile
time RRDGRAPH_YLEGEND_ANGLE remains the default for both, so existing
graphs are unchanged. Use --right-axis-label-angle 270 to have the right
hand legend read from the top down. Suggested by @blappm in #1377,
implemented by @oetiker
rrdgraph: new --right-axis-range min:max option to suppress right axis
labels outside the given range, so a bounded right axis is no longer
labelled with values it cannot reach when the left axis range does not
line up. Either end may be left empty for unbounded. Suggested by @blappm
in #1377, implemented by @oetiker"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 8774f333815c0adf2a26d2b67ebe185836f3b1c0
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Sat Aug 8 17:18:06 2026 +0200
tcpdump: Update to version 4.99.6
- Update from version 4.99.5 to 4.99.6
- No change in the rootfile
- Changelog
Remove protocol decoding for:
OTV (draft-hasmit-otv-04, this Internet-Draft is no longer active).
Refine protocol decoding for:
DNS: Use ND_TCHECK_LEN() instead of a custom bounds check.
IPv6: Add a missing comma and remove a colon in the output.
TCP: Note if the Urgent Pointer is non-zero while URG flag not set,
if the verbose level is > 1 (option -vv and more).
TCP: Note if the Acknowledgment Number is non-zero while ACK flag not set,
if the verbose level is > 1 (option -vv and more).
TCP: Fix Reset segment processing.
IP, IPv6: Fix setting the snapshot length for the payload.
IP: Use ND_TTEST_LEN() instead of a custom bounds check.
frag6: Add a bounds check in non-verbose mode.
PTP: Remove spaces before colons in output.
PTP: Fix management packet fields.
ISO: Avoid undefined behavior and integer overflow in the Fletcher
checksum calculation.
NFS: Delete dead code.
BOOTP: Use an uint16_t variable to get the result of a GET_BE_U_2().
ZEP: use the existing NTP time formatting code.
NTP: Fix p_ntp_time_fmt() using epoch 1/epoch 2 convention (RFC 4330).
NTP: Update a field name with the RFC 5905 name (Origin Timestamp).
IPv6 mobility: Modernize packet parsing and make fixes.
IP6OPTS: Modernize packet parsing and make fixes.
VXLAN: Add UDP port 8472 used by Linux as the default port.
EGP: Replace custom code with tok2str(); Modernize packet parsing and
fix printing with -v option.
User interface:
Add optional unit suffix on -C file size.
Improve the handling of size suffixes for -C.
Print errors for options -A, -x[x] and -X[X] (mutually exclusive).
Print errors about -C, -G and -z options usage.
For PCAP_ERROR_CAPTURE_NOTSUP, show the error message provided
by libpcap for that error if it's non-empty.
Update the -z option processing. Print "invalid option -- z" when it is.
Add the -g option, causing IPv4 output in verbose mode to be on one line.
Other:
Avoid race condition when receiving signal during shutdown.
Always show the interface name in error messages when the
interface can't be opened.
Clean up the message shown if a -i flag is specified with an
interface index that's too large.
Source code:
Fix '-tt' option printing when time > 2106-02-07T06:28:15Z.
Add sub-second packet timestamp checks for invalid micro/nano.
Remove unused missing/snprintf.c.
Fix incompatible pointer types with time functions calls on Windows.
Use C99 macros to define 64-bit constants and maximum 64-bit values.
Windows:
Fixed to find wpcap.dll if WinPcap isn't installed and Npcap was
installed without the WinPcap API compatibility option. (GitHub
issue #1226).
Building and testing:
Makefile.in: Use a local libpcap in the releasecheck target.
CMake: Fix build with CMake 3.31.
autotools, CMake: don't separately test whether snprintf(3) is
available and whether it's suitable - the test for whether it's
suitable also fails if it's unavailable.
CMake: Skip snprintf(3) tests when cross-compiling.
autotools, CMake: fix issues with snprintf test and sanitizers.
CMake: check whether check_c_source_runs() works, treat the build
as a cross-compile if it doesn't work.
Autoconf: Use AC_SYS_YEAR2038_RECOMMENDED when possible if the
environment variable BUILD_YEAR2038 = yes (via autogen.sh).
Autoconf: Avoid incorrectly include the libpcap's config.h.
Autoconf: Refine reporting of os-proto.h.
Require config.h to be from the tcpdump build.
AppVeyor: Update Npcap SDK to 1.15.
autogen.sh: Allow to configure Autoconf warnings.
autogen.sh: Delete all trailing blank lines at end of configure.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 2da301e6a7836875f204c66680d821f66d98684e
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Sat Aug 8 15:07:05 2026 +0200
haproxy: Update to version 3.4.3
- Update from version 3.4.2 to 3.4.3
- No change in rootfile
- Changelog
3.4.3
This release contains one important fix and a handful of security hardening
fixes reported by Red Hat/AISLE Research and others, on top of the usual set
of bug fixes.
* ssl/ocsp: An issue about missing lock was fixed.
The OCSP stapling callback read the cached OCSP response buffer without
any lock, while the buffer can be freed and replaced at any moment by a
"set ssl ocsp-response" CLI command, the ocsp-update task, or a reload. A
concurrent update could either crash the worker (use-after-free) or leak
freed/reused heap contents to a remote client requesting the stapled
response. The reads are now protected by the existing OCSP tree lock. This
was reported and fixes by Matt Suiche from Tolmo Inc.
* QUIC/H3 : Three bugs were fixed around QUIC/H3 stream shutdown and error
handling.
A parser desync could occur when an H3 error was detected in the middle of
a multi-frame buffer, causing the caller to remove only part of the data
and restart parsing at a wrong offset, which usually produced a new,
unrelated error or an unwarranted full connection closure. A QCS instance
could also be wrongly freed if a STOP_SENDING was still scheduled for it,
most impactful on the backend side where a server could keep emitting data
on a stream haproxy already considered closed. Finally, shutting down a
stream's read side (e.g. an aborted request) did not always send a
STOP_SENDING to the peer, so a server backend could keep sending data for
a request haproxy no longer cared about.
* fd: A deadlock when closing file descriptors of other thread groups was
fixed.
Destroying a listener while holding the listener lock could deadlock when
it needed to close an fd belonging to another thread group and another
thread was waiting on the same listener lock. This was easier to reproduce
with a suspend/resume loop on ABNS sockets. The fd is now closed using a
reference-counting scheme instead of thread isolation, avoiding the
deadlock.
* tcpcheck: The internal proxy used to parse "healthcheck" sections was not
added to the proxies list, so its initialization was not fully finalized;
this notably broke some arguments such as regular expressions and could
lead to crashes because of a NULL pointer dereference at runtime.
* applet: An issue leading to a stale task expiration date was fixed.
When an applet was waiting for a connection (e.g. the Lua Socket applet)
and reads were re-enabled once the connection became available, this was
usually done from the connection's context, so the applet's task
expiration date was not refreshed. With small timeouts this could cause
the task to appear scheduled in the past, triggering a BUG_ON() in
sc_notify(). This was fixed by moving the changes in the applet's context.
Related to this issue, a bug about lua cosockets was fixed. the Lua
cosocket timeout being applied on the wrong side. It was applied to both
the client and server sides, while it must only apply to the server side.
* stats: Two issues about the stats page, reported by Red Hat/AISLE
Research, were fixed.
Proxies updated through the stats page while in "stats admin" mode were
not subject to the "stats scope" filtering, meaning a scope meant to
restrict which proxies are visible/actionable could be silently bypassed
on POST requests.
Separately, POST requests to the stats interface did not validate that the
Origin (or Referer) header matched the Host, which is now checked to
mitigate CSRF attacks.
* cache: A leak preventing the cache from reserving rows under "Vary" was
fixed.
When a secondary cache entry matching a request with a "Vary" header was
still incomplete (being written by another stream), the request was
forwarded without reattaching its row to the available list, leaking
it. Over a Vary-heavy workload this eventually exhausted the cache and
prevented any further row reservation.
* ssl-gencert: A memory leak on every certificate generation was fixed.
Two temporary buffers were not freed after generating a certificate on the
fly, leaking memory each time a new SNI triggered certificate
generation. This issue was reported by Red Hat/AISLE Research.
* sample/protobuf/net-helper: buffer overflows after pointer-shift
converters, reported by Red Hat/AISLE Research and Charles Vosburgh, were
fixed.
Several converters (protobuf/ungrpc field extraction, eth.data, eth.src,
ip.data, bytes(), ltrim()) move the sample's data pointer forward on
success but did not shrink the sample's recorded buffer capacity
accordingly. A converter chained afterwards that relies on that capacity
(e.g. padding via memset()) could then write past the end of the buffer,
leading to heap corruption or a worker crash. All the affected converters
now adjust the capacity together with the pointer.
* protobuf: A nested-path validation bypass reported by Red Hat/AISLE
Research was fixed.
The protobuf field lookup used for the protobuf()/ungrpc() converters did
not strictly enforce hierarchical boundaries, so a flat sibling field
could incorrectly satisfy a nested-path lookup (e.g. matching a root-level
field as if it were nested under a parent). The lookup was rewritten as a
strict, non-recursive path walker that correctly bounds each nesting
level.
Separately, a crash because of deprecated protobuf group wire types was
fixed. These wire types are now explicitly rejected.
* proxy/server: Some CLI commands dumping info were not protected against
concurrent proxy/server/backend deletion.
"show servers conn/state", "show backend" and "show errors" all loop over
lists of proxies or servers and may yield in case of a large output; if
the entry the dump was paused on got deleted (e.g. via dynamic
backend/server removal) in the meantime, the worker could crash on
restart. These commands now rely on the existing watcher mechanism,
already used by "show stat", to survive concurrent deletion.
Separately, the check refusing to delete a server still attached to
streams was not exhaustive: two paths (a failed connection attempt still
referencing the server, and cookie persistence set very early) were not
covered by the existing counters, allowing a server to be deleted while
still referenced. A new per-thread-group stream counter now tracks this
reliably.
* ssl: A kTLS splicing regression and a wrongly typo'd macro were fixed.
A wrong macro name (USE_VANILLA_OPENSSL instead of HAVE_VANILLA_OPENSSL)
could let kTLS start splicing while data was still pending in OpenSSL's
internal buffers, causing data not to be properly read.
Separately, when kTLS splicing received a non-application-data record
(e.g. a TLSv1.3 KeyUpdate), splicing failed outright instead of falling
back to a regular recvmsg() long enough to consume the record and resume
splicing afterwards.
* mux-h1: The case of header names were not being adjusted on some outgoing
messages.
When a map was configured to adjust the case of some header names for
legacy applications, it was not applied to the low-level error messages
generated during th request parsing. And for all other messages,
"Sec-Websocket-Key" and "Sec-Websocket-Accept" headers, inserted by the H1
multiplexer, were also concerned.
* http-fetch: Two crashes reachable from health-check configurations were
fixed.
"res.body"/"res.hdr"/... and similar response fetches assumed the
health-check receive buffer always held an HTX message, which is only true
for actual HTTP checks; on a plain TCP check, a hostile/misbehaving server
could craft the first bytes of its reply to be misinterpreted as HTX
internal fields, causing a wild read and worker crash (or leaking
arbitrary process memory).
Separately, "capture.req.hdr"/"capture.res.hdr" only validated the upper
bound of their index argument, so a negative capture id was accepted at
boot and dereferenced an out-of-bounds array entry at runtime, crashing
the worker on the very first request.
* tools: Converter to encode URLs was fixed to avoid silent truncation.
encode_chunk(), used among others by the url_enc converter and OCSP
encoding, used to silently truncate its output when the destination was
too small, which could produce a partially-encoded URL. It can now fail
explicitly instead; the url_enc converter and OCSP code were updated
accordingly.
* slz: Several issues were fixed in the SLZ library.
A stream alternating many literals in the 144-255 range with cheap
back-references could keep inflating indefinitely instead of falling
back to a stored block, exceeding the library's documented worst-case
output size by several percent. A new accounting mechanism now bounds
this overhead. Practical impact on haproxy requires tune.bufsize above
~43 kB with the default reserve.
Five small correctness fixes inherited from upstream libslz were also
backported: Avoid reading up to a few bytes past the end of very short
inputs on architectures without fast unaligned access; stop appending an
extra, misplaced block to an already-finished deflate/gzip/zlib stream
(which could corrupt the trailing checksum in ~2% of fuzzed streams); fix
the Adler32 checksum accumulator sign handling on 32-bit systems
(affecting the zlib format only); avoid an undefined-behaviour signed left
shift when assembling input words byte by byte; and use the exact bit cost
when deciding whether to emit the last literals of a block as a stored
block, avoiding compressed output slightly larger than the documented
worst case.
* peers: A heap overflow when replicating large stick-table dictionary
entries was fixed.
peer_prepare_updatemsg() never verified that a stick-table entry's
dictionary value (e.g. server_key, up to ~16 kB) actually fit in the
update message being built. Since the peers protocol is plain-text and
unauthenticated, a rogue or compromised peer could plant an oversized
entry that overflows the 16 kB trash buffer as soon as the victim
replicates ("teaches") it, confirmed as a heap-buffer-overflow write. The
function now checks the available room before encoding and fails clea nly
if it doesn't fit. This was reported and fixes by Matt Suiche from Tolmo
Inc.
* chunk: The code was reviewed to avoid retrieving a large trash buffer by
mistake.
All call sites of the trash-chunk allocation helpers were reviewed to make
sure a large buffer is only handed out when the caller's own buffer is
already large and genuinely needs it, preventing unexpected extra memory
usage. Several call sites were switched to the new
get_best_trash_chunk()/alloc_best_trash_chunk() helpers.
* resolvers: Possible conflicts between the internal backend used for the
"default" resolvers sections and regular backends with the same name were
fixed.
Since a "default" resolvers section is now created automatically, a
same-named internal TCP backend proxy also appeared, and a config using
"default_backend default" could either fail with a confusing "mode"
error or silently route real traffic to the internal resolvers backend.
Resolvers no longer need to be looked up by name in the proxies index,
so they are no longer indexed there. Fixes GitHub issue #3445.
* server-template: Duplicated entries created from a "server-template" line
did not properly inherit several settings that are only initialized once
for the base line by srv_settings_init().
The <alt_proto> field, used to select an alternative protocol such as
MPTCP, was not copied to server-template duplicates, resulting in the
wrong protocol being selected on connect. The "check-reuse-pool" flag,
forcefully enabled for rHTTP servers, was not propagated either, causing
health checks to always fail on rHTTP server-template entries. And the
QUIC transport was never set up for these duplicates at all, since it was
only performed in _srv_parse_init(), preventing any QUIC communication on
server-template entries with a quic4/6 address. All three settings are now
properly duplicated/initialized in srv_settings_cpy(), or moved to a
callback that also runs for duplicates. A related improvement makes
parsing error messages usable for server-template lines, which used to
show "server-template be/(null)" instead of the template's name.
* cebtree: A bug in the duplicate-key detection of the lookup shortcut was
fixed.
It could make a lookup return the wrong entry among a list of duplicates,
or make the walk to the previous/next duplicate fail to find it, as soon
as the tree was deep enough to enter the shortcut path. This affects the
cebis_tree used since 3.3 to index server names (conf.name), where it
could sometimes let a duplicate server name go undetected.
And, as usual, the bunch of minor fixes here and there, mainly raised during
AI-assisted code reviews. Most were never noticed:
* HTX API: Some bugs about how the HTX API was used were fixed here and
there.
* http-act: Double-frees and a couple of state bugs on parsing errors were
fixed.
* http-fetch/http/http-ana/http-htx: Few out-of-bounds reads and a missing
NULL/allocation check were fixed.
* h1: The right error offset is now reported for an authority/Host mismatch
when "accept-unsafe-violations-in-http-request" option is enabled
* http-conv: The last input character could be lost when calling url-dec
converter, when the input buffer was full. This was fixed by failing the
converter in that case.
* http-rules: A crash on error path when parsing "set-cookie-fmt" redirect
rule was fixed.
* mux-h1: An extra 200ms delay was observed on some H2-to-H1 messages
because the end of the message was not always properly detected. This case
is now properly handled.
* sample: Two edge cases in be2hex() and bytes() were fixed.
* shctx: An issue in the shctx was fixed. This notably broke revalidation of
cached responses whose ETag was stored beyond the first block, causing a
full 200 response to be served instead of a 304.
* ssl: "show ssl sni -f <frontend>" command was silently falling back to the
first proxy when the given frontend did not exist. An error is now
reported.
* stream: Custom per-request timeouts/retries set on listeners via
"set-timeout" and "set-retries" action are now preserved, except when the
stream is routed to a diffent backend. The configuration manual was
updated to document this case.
Otherwise, two changes were backported:
* htx: To avoid trouble with large buffers, it is no longer possible to
handle HTTP headers exceeding the size of a regular buffer. It is
mandatory to avoid interoperability issues with H2 and H3.
* ssl: tune.ssl.keyupdate-rate-limit global directive was added to mitigate
costly TLSv1.3 KeyUpdate floods.
Processing a TLSv1.3 KeyUpdate is CPU-expensive and there is normally
little reason to receive many of them. This new tunable caps the number
of KeyUpdates accepted per second (default 100, 0 disables the limit).
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 0dc1965e500bc46915962a300c935ff29757debd
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Sat Aug 8 15:07:04 2026 +0200
frr: Update to version 10.7.0
- Update from version 10.6.0 to 10.7.0
- Update of rootfile
- Changelog
10.7.0
New Features Highlight
BFD authentication with keychain support
BFD sessions can now use the FRR keychain framework for authentication.
Supported algorithms include cleartext, SHA-1, and the meticulous variant required by operators running strict authentication policies.
Keychains integrate with BFD profiles and northbound configuration for single-hop, multi-hop, and SBFD sessions.
BGP-LS SRv6 extensions
BGP Link-State now advertises and processes SRv6 topology information, including:
SRv6 Capabilities TLV
SRv6 Locator TLV
SRv6 SID NLRI (including End, End.X, and LAN End.X forms)
SRv6 Endpoint Behavior TLV
SRv6 SID Structure TLV
Static SRv6 SIDs configured in zebra can be exported into BGP-LS, enabling SRv6-aware TE controllers to consume locator and SID information from FRR.
BGP route-map based allowas-in
allowas-in can be applied selectively through route-maps instead of only as a blanket peer or address-family knob.
This allows finer control over which received routes may contain the local AS in the AS_PATH, improving policy flexibility in complex multihomed and hub-and-spoke designs.
OSPFv2 RFC 4222 control-plane DSCP marking
OSPFv2 can classify control packets into high- and low-priority queues per RFC 4222 recommendation 1.
Recommendation 2 extends the neighbor inactivity timer behavior for low-priority control traffic.
Operators can mark OSPF control traffic with DSCP values to protect routing protocol stability under congestion.
OSPF BFD quick neighbor
When BFD is enabled on OSPF interfaces, a quick-neighbor mode reduces the time needed to bring up OSPF adjacencies over BFD-monitored links.
This is useful on fabrics where fast reconvergence after link-up is required.
PIM IGMP proxy route-map filtering
IGMP proxy joins and prunes can be filtered with ip igmp proxy route-map.
A new route-map match condition, match multicast-source-interface, allows policy based on the interface where a join was learned.
This helps deployments that proxy IGMP between access and core segments while restricting which groups or sources are forwarded.
PIM dense-mode Assert on multi-access LAN
Dense-mode wrong-interface traffic on shared LANs now runs the RFC 3973 Assert procedure instead of immediately pruning all neighbors.
On point-to-point links the previous immediate-prune behavior is preserved.
This elects a single forwarder on multi-access segments and avoids pruning active branches when duplicate (S,G) packets arrive on a non-RPF interface.
PIM Auto-RP allow-rp support
A new allow-rp configuration accepts Auto-RP groups even when the embedded RP address does not match the local RP configuration.
IPv4 and IPv6 Auto-RP are supported through northbound/YANG modeling.
This helps mixed-vendor or transitional Auto-RP deployments where strict RP identity checking would otherwise drop valid control traffic.
Static route per-route metric and nexthop ECMP weight
Static routes now support a per-route metric as a non-key attribute, independent of the existing administrative-distance key.
Static ECMP nexthops can carry weights for unequal-cost multi-path forwarding.
Together these align static routing policy more closely with zebra’s nexthop-group handling used by other protocols.
What's Changed
EVPN RMAC management fixes and test coverage by @soumyar-roy in #20588
ospfd: Display message when clearing interface without OSPF by @soumyar-roy in #20267
zebra: FRR restart leads to zebra mlag core by @soumyar-roy in #20225
zebra: limit RTADV socket rcvbuf to 20MB by @hengwu0 in #20654
Evpn test abstraction by @donaldsharp in #20637
pimd,pim6d: fix last-member-query-count and add robustness value by @rzalamena in #20613
bgpd: Changes to include new fields in "show bgp router" command by @soumyar-roy in #20631
bgpd: Fix double-free crash in peer_delete() during doppelganger peer… by @routingrocks in #20661
staticd: Fix SRv6 SID use-after-free on locator deletion by @cscarpitta in #20660
yang: Correct pyang errors in frr-nexthop.yang by @y-bharath14 in #20694
bgpd: Replace 3 with BGP_ALLOWAS_IN_DEFAULT constant by @ton31337 in #20698
Fixes for op-state change notifications being sent to backend clients (daemons) by @choppsv1 in #20647
bgpd: Missing large community value in commAttriSentToNbr JSON by @soumyar-roy in #20608
lib,bgpd: Adding JSON str for time in dd:hh:mm:ss format by @soumyar-roy in #20632
bgpd: use BGP_PATH_INFO_NUM_LABELS macro in bgp_evpn_path_info_get_l3vni by @nick-bouliane in #20679
Add new show command to display only failed routes by @deepak-singhal0408 in #20343
bfdd: early return on socket allocation failure by @ethanmilon-6wind in #20700
zebra: add state column to 'show evpn es' command output by @shashanka-ks in #20711
zebra: add 'no encapsulation' command under segment-routing/srv6 by @hedrok in #20716
tests: Check PIM Register/-Stop handling in pim_igmp_vrf topotest by @gromit1811 in #18329
ospf6d: Fix stack buffer overflow in link LSA by @rminnikanti in #20695
bgpd: fix md5 password unset on dynamic nbr by @chiragshah6 in #20740
bgpd,zebra: EVPNv6 addressing coverity warnings by @Manpreet-k0 in #20680
bgpd: Fix suppress-fib-pending config race condition on startup by @krishna-samy in #20622
bgpd: fix batch clearing resume to use correct lookup APIs by @miteshkanjariya in #20738
bgpd: add a counter for received duplicate updates by @enkechen-panw in #20553
bgpd: Fix AS path exclude not working during VRF route re-import by @soumyar-roy in #20556
Nexthop weight support for static routes (ECMP/UCMP) by @iurmanj6WIND in #20559
Add memberCount into peer-grp json AND GR fields in fields in show bgp vrfs json by @raja-rajasekar in #20578
zebra: uninstall remote neigh even when ifp is down by @raja-rajasekar in #20587
vtysh: Add JSON output support for show memory by @ton31337 in #20605
bgpd: Ignore transitiveness flag when checking type for link bandwidth by @ton31337 in #20607
bgpd: Show all advertised paths including non-best paths only if addpath is enabled by @ton31337 in #20618
bgpd: implement new redistribute json command by @soumyar-roy in #20630
ospf6d: Fix FULL adjacency persisting despite MTU mismatch by @rminnikanti in #20681
doc: Fix VRF-related and PIM docs by @gromit1811 in #20717
zebra: rename BondState to State in 'show evpn es' output by @shashanka-ks in #20721
lib: use MTYPEs for northbound in several places by @mjstapp in #20733
Non route replace semantics by @donaldsharp in #20725
yang: Fix pyang errors in frr-bgp-filter.yang by @y-bharath14 in #20746
zebra: shorten label for RNH mem type by @mjstapp in #20749
*: Fixed coverity warnings in multiple areas by @Manpreet-k0 in #20610
bgpd: EVPN MH fix unimport ES route on vtep change by @Manpreet-k0 in #20730
Zebra fixup nhg handling from kernel by @donaldsharp in #20732
zebra: Updation of ifp->flags by @hnattamaisub in #20769
fix spell checks round 4 by @chiragshah6 in #20771
tests: Deleted duplicate imported modules by @y-bharath14 in #20779
Sharp send tableid for route by @donaldsharp in #20634
bgpd: unref routes when yielding during clearing iteration by @mjstapp in #20789
bgpd: fix premature deletion of already-stale routes during GR clearing by @miteshkanjariya in #20768
bgpd: validate incoming NOTIFICATION messages by @mjstapp in #20796
tests: Add a default route test to rip by @donaldsharp in #20799
yang: Fix pyang errors in frr-bgp-types.yang by @y-bharath14 in #20797
Multiple local fix by @donaldsharp in #20798
bgpd: improve flowspec NLRI validation by @mjstapp in #20814
bgpd: Reorder some struct attr members by @ton31337 in #20822
tests: Add additional wait tim to test_bgp_gr_functionality_topo2-3.py by @donaldsharp in #20788
Separate sg rpt sg ifchannels and add ability to set a override-interval and a test. by @donaldsharp in #20552
zebra: EVPN fix access BD deref of mbr intf by @chiragshah6 in #20791
tests: EVPN add dynamic nbr with ext router by @chiragshah6 in #20737
zebra: Allow redistribution events to pass reserved ranges by @donaldsharp in #20599
Fix ospf checksum #20706 by @Ko496-glitch in #20729
Kernel skip some route updates by @donaldsharp in #20666
bgpd: Force sending conditional updates by ignoring MRAI timer by @ton31337 in #20668
tests: Don't try to use identical rmacs in rare situation by @donaldsharp in #20844
tests: Fix rip_default_route_handling to be more consistent by @donaldsharp in #20838
pimd,ospfd: Passing local source address as part of BFD session creation by @usrivastava-nvidia in #20739
tests: Remove SRv6 SID check duplication by @cscarpitta in #20843
babeld: fix NULL pointer dereference in babel_clean_routing_process by @LyZephyr in #20727
vtysh: add additional options to ping command by @kaffarell in #20283
ospfd: prefer existing default route over generating by @rzalamena in #20699
tests: Do not fail zebra_nhg_check if skipped is not 0 on initial by @donaldsharp in #20855
Bgp peer sendq timing by @donaldsharp in #20839
tests: Unnecessary pass statement in test_bgp_lu.py by @y-bharath14 in #20860
Add info_count to route_table for accurate RIB entry reporting by @mike-dubrovsky in #20206
various spell check round 5 by @chiragshah6 in #20866
staticd: in route config, reject keywords as ifname by @mjstapp in #20311
debian: prefer libyang3 over libyang2 when building deb packages by @Jafaral in #20871
yang: Revision statements are not given in reverse chronological order by @y-bharath14 in #20870
tools: Add ldp commands to support bundle generation by @donaldsharp in #20863
lib: minor RCU/atomics improvements by @eqvinox in #20864
ldpd: Reuse port for ldpd sockets that set local ports by @donaldsharp in #20858
tests: Fix grpc-query.py to find micronet by @donaldsharp in #20880
pimd: When address change ensure DR changes too. by @donaldsharp in #20881
A few small Coverity fixes by @mbaldessari in #20888
lib/typesafe: guard skiplist level generation against ctz(0) UB by @florath in #20899
ospf6d: recalculate AS-external routes on non-external RIB updates by @donaldsharp in #20882
tests: fix some python and test syntax by @mjstapp in #20905
Always compare med fix by @donaldsharp in #20909
bgpd: fix memory leak in cluster_intern() by @enkechen-panw in #20913
bgpd: clear several parameters in subgroup_announce_check() by @enkechen-panw in #20884
isisd: fix memory-related issues and RFC-violations by @SpadeMomo in #20333
lib, bgpd: add "unique mode" for route tables, supporting direct lookup only by @mjstapp in #20589
bfdd: BFD Admin-Down State Management Improvements by @sougatahitcs in #20151
zebra: add 'show evpn es-peer' command for EVPN-MH peer VTEP list by @shashanka-ks in #20868
tests: Allow for different bestpaths to be generated. by @donaldsharp in #20889
yang: Revision statements are not given in reverse chronological order at frr-staticd.yang by @y-bharath14 in #20921
bgpd: fix the local-preference setting for EBGP-OAD by @enkechen-panw in #20898
zebra: Modify rib_process_dplane_results to limmit work done by @donaldsharp in #20902
doc: add some text regarding libyang versions by @choppsv1 in #20862
bgpd: correct the display header by @anlancs in #20927
bgpd: commits for the listening port by @anlancs in #20929
bgpd: Support for new "show bgp bestpath [json]" show command by @soumyar-roy in #20616
Zebra neighbor changes by @donaldsharp in #20912
Add support for libyang5 by @choppsv1 in #20895
eigrpd: handle the gr neighbor list safely in update_receive by @mjstapp in #20933
nhrpd: fix packet and buffer handling errors by @mjstapp in #20932
tests: fix a regex in all_protos topotest by @mjstapp in #20911
lib, tests: add a srcdest get_next api by @mjstapp in #20906
zebra: bump dplane minor version for 10.7 by @mjstapp in #20943
doc: add multicast testing guide for topotests by @Jafaral in #20945
lib: display End.DX2 route with appropriate oif attribute by @pguibert6WIND in #20954
bgpd: Fix test for OPEN message with remote-as auto by @ton31337 in #20963
bgpd: Add missing PEER_FLAG_SEND_NHC_ATTRIBUTE for update group flags by @ton31337 in #20956
bgpd: Reuse prep_for_rmap_apply() before route_map_apply() by @ton31337 in #20957
pimd: fix msdp mesh group SA crash by @lpchambers in #20900
isisd: Fix remaining buffer size calculation in lsp_bits2string by @rbgarga in #20984
vrrpd: Notification from zebra is not sent to vrrp by @hnattamaisub in #20270
bgpd: make code more robust in bgp_advertise_attr_unintern() by @enkechen-panw in #20989
babeld: fix RFC violations in babel message parser by @SpadeMomo in #20339
pathd: add 'no traffic-eng' command, add test, don't output 'segment-routing/traffic-eng' in configuration always by @hedrok in #20638
bgpd: Fix condition when evaluating paths by @ton31337 in #20975
bgpd: Fix routes to be removed from rib when suppress fib pending is configed by @nishant111 in #20917
bgpd, isisd, ospfd: coverity fixes by @ashred-lnx in #20948
bgpd: Fix nht to properly notice a change by @donaldsharp in #20986
Zebra MetaQ and dplane provider fixes by @donaldsharp in #20944
bgpd: Fix EVPN-MH route cleanup race condition during interfaces flap by @krishna-samy in #20710
pcep: fix heap buffer overflow by @iurmanj6WIND in #20994
tests: bgp_nhc add test to expose NHC update race on peer changes by @donaldsharp in #20949
bgpd: update on l2attr ecommunity by @lsang6WIND in #20980
ospfd: harden TE/SR TLV iteration against malformed lengths by @Jafaral in #21002
GitHub ci improvements by @Jafaral in #21003
bfdd: Fix wrong memory free when using ttable code by @donaldsharp in #21020
More Neighbor Fixes by @donaldsharp in #20934
yang: Correct pyang errors in frr-pim-candidate.yang by @y-bharath14 in #21030
zebra: fix stale remote vtep entries by @Manpreet-k0 in #20977
Bfd QoL improvements by @donaldsharp in #21004
ospf6d: clear local ifp per ECMP path rebuild by @florath in #21037
lib: add rbtree pop_final api by @mjstapp in #21034
doc: bgp: add entry for neighbor PEER soft-reconfiguration inbound by @kaffarell in #21009
Fix docker (Alpine) compilation by @ton31337 in #21042
tests: Fix wrong filename and description in test_srv6_locator.py by @cscarpitta in #21044
bgpd: Fix SRv6 SID/locator memory leak in SID notify handler by @cscarpitta in #21049
zebra: Add no prefix command for SRv6 locators by @cscarpitta in #21048
Some Yang work by @donaldsharp in #21027
bgpd: fix off-by-one error in FlowSpec operator array bounds check by @Jafaral in #21054
bgpd: Support brief option for show bgp neighbors command by @hnattamaisub in #20914
Docs: Document import vrf route-map NAME, several EVPN improvements by @robinchrist in #20714
bgpd: avoid premature memory allocation in subgroup_announce_check() by @enkechen-panw in #21005
bgpd: Add support for BGP-LS (RFC 9552) by @cscarpitta in #20470
bgpd: Fix BGP best path reasoning when using ECMPs with router-id by @ton31337 in #21052
tests: Convert lots of places to use run_and_expect by @donaldsharp in #20893
*: fix spell checks round 6 by @chiragshah6 in #21057
yang: Fix pyang errors in frr-ospf6-route-map.yang by @y-bharath14 in #20991
lib: fix zclient crash when many peers reconnect after FRR restart by @nick-bouliane in #21056
zebra: Remove neighbor table read on rule addition by @donaldsharp in #21053
bgpd: Fix integer truncation of SRLG count when parsing SRLG TLV by @cscarpitta in #21077
bgpd: Check if the NHC length is enough to fill TLV value + TLV header by @ton31337 in #21074
lib: fix vty_is_closed() falsely reporting VTY_SHELL as closed by @Manpreet-k0 in #21082
lib: use const in vty-is-shell apis by @mjstapp in #21094
bgpd: Fix integer truncation of count when parsing Route Tag TLV by @cscarpitta in #21078
ospfd: fix sequence number check, avoid truncation ambiguity by @Jafaral in #21096
bgpd: Fix late reverse-edge destination linkage in BGP-LS code by @cscarpitta in #21109
nhrpd: Correct addrlen check in os_recvmsg() by @csiltala in #21100
ldpd: improve tlv validation in several places by @mjstapp in #21118
PIM message-handling code fixes by @donaldsharp in #21093
bgpd: Fix issues in BGP-LS node/link/prefix origination by @cscarpitta in #21108
bgpd: fix errors in several paths by @mjstapp in #21101
bgpd: fix I/O thread spinning when peer input queue is full by @kzhang-amzn in #21028
tests: Ensure upstream IIF is in correct state after interface events by @donaldsharp in #21114
lib: fix crash in thread_process_io_inner_loop on stale epoll event by @Manpreet-k0 in #21124
tests: Slow down test_config.py to allow for processing time to happen by @donaldsharp in #21127
isisd: fix edge condition in max_lsp_count computation by @mjstapp in #21159
bgpd: Return 0 if AS4 capability is malformed by @ton31337 in #21112
bgpd: Prevent heap use-after-free for tunnel encapsulation attribute by @ton31337 in #21176
CI: fix node js deprecation warning, limit mergify backports github ci runs by @Jafaral in #21175
tests: fix grpc_basic xdist collection mismatch by @Jafaral in #21158
bfdd: harden packet validation and reflector handling by @Jafaral in #21105
isisd: fix memory leak in remove_excess_adjs() by @quentinbaradat in #21183
bgpd: include length in cluster_hash_cmp() by @enkechen-panw in #20988
bgpd: add config "nexthop prefer-global" for ipv6 address family by @enkechen-panw in #21099
isisd: Fix missing neighbor address Sub-TLVs after link-params change by @cscarpitta in #21204
bgpd: Free hostname for FQDN capability if the parsing goes wrong by @ton31337 in #21043
bgpd: Do not process route-refresh for AFI/SAFI if it's not negotiated by @ton31337 in #21210
bgpd: fix NHT for explicit link-local BGP peers by @soumyar-roy in #21188
zebra: fix missing vlan change by @anlancs in #20350
bgpd: Validate MP_REACH_NLRI attribute against incorrect next-hop by @ton31337 in #21075
bgpd: harden attribute parsing and packet handling in a few places by @ton31337 in #21095
nhrpd: harden against malformed packets by @Jafaral in #21097
bgpd: Return original as-path when reconciling AS versus AS4 by @ton31337 in #21113
tests: add EVPN VTEP cleanup and recovery test on uplink flap by @Manpreet-k0 in #21126
bgpd: improve packet parsing for EVPN and ENCAP/VNC by @mjstapp in #21098
bgpd: fix BGP_ATTR_NEXT_HOP flag handling in bgp_attr_default_set() by @enkechen-panw in #21166
[WIP] nhrpd: guard AFI/table lookups in route resolution by @Jafaral in #21187
bgpd: Fix route-map cleanup ordering in SRv6 unicast SID export by @cscarpitta in #21191
tests: bgp_suppress_duplicates: simplify and split into four tests by @enkechen-panw in #21203
ripd: fix data-handling in several places by @mjstapp in #21215
ripd: fix ip rip send/receive version command by @Shbinging in #18217
bgpd: Fix coverity defects in BGP-LS code by @cscarpitta in #21102
ripngd: fix data handling in several places by @mjstapp in #21217
bfdd: moving bfd socket allocation from static to dynamic by @sougatahitcs in #20854
bgpd: Check if we are not overusing error_data buffer when unknown cap received by @ton31337 in #21211
bgpd: backpressure generic framework by @chiragshah6 in #21192
vrrrpd: improve error handling in several paths by @mjstapp in #21251
bgpd: fix BNC cleanup for explicit link-local peers by @soumyar-roy in #21264
zebra: add debug in route install around nhg not ready by @chiragshah6 in #21265
zebra: Move allow-external-route-update to mgmt frontend side by @donaldsharp in #21276
Enable RFC8342 YANG NMDA functionality and add router-id oper-state that uses it. by @choppsv1 in #21065
zebra: lib: use old compatible value for lyd_new_term by @choppsv1 in #21281
bgpd: BGP-LS: add Prefix SID (TLV 1158) by @hedrok in #21076
tests: Fix wrong expectations in bgp_srv6_unicast topotest by @cscarpitta in #21284
bgpd: Fix SRv6 SID export route-map update not taking effect by @cscarpitta in #21283
bgpd: Fix incorrect comparisons in BGP-LS *_cmp() functions by @cscarpitta in #21285
pimd: In sparse-dense mode, treat a group as sparse if an RP is configured by @Jafaral in #21216
tests: Give more time for interface information to show up by @donaldsharp in #21278
bgpd: call init, term, copy LS attr admin_group by @mjstapp in #21289
zebra: fix spurious tag mismatch in rib_route_match_ctx() by @enkechen-panw in #21293
bgpd: add brief JSON for ipv4/ipv6 unicast loc-rib by @hnattamaisub in #21050
bgpd: brief JSON for L2VPN EVPN loc-rib by @hnattamaisub in #21019
ospfd, ospf6d: do not install routes for directly attached networks by @rzalamena in #20720
bgpd: Add SRv6 uDT46 SID support for GRT by @cscarpitta in #21041
Move import table around by @donaldsharp in #21068
bgpd: Fix a couple of issues in BGP-LS NLRI encoding/decoding by @cscarpitta in #21092
pceplib, pathd: improve pcep parsing and error-handling by @mjstapp in #21208
lib: fix swapped values, bad setsockopt, and intermittent test failure by @choppsv1 in #21214
bgpd: fix suppress-fib-pending blocking EVPN GR by @Manpreet-k0 in #21231
lib: also compare rmap source address when comparing nexthop source a… by @ak503 in #21233
bgpd: Fix BGP-LS initial TED sync and cleanup on peer deactivation by @cscarpitta in #21286
doc: Update json handling specification in workflow.rst by @donaldsharp in #21244
bgpd: flowspec foobar hardening by @ton31337 in #21308
Soumya/pim allowrp by @soumyar-roy in #20326
pceplib: validate during of_list TLV decoding by @mjstapp in #21310
bgpd: Revalidate locally originated routes against RPKI changes by @ton31337 in #21302
ospf6d: improve/harden packet processing by @mjstapp in #21277
Rpki fix and test improvements by @donaldsharp in #21315
pimd: fix crash due to double free by @Jafaral in #21354
eigrpd: improve validation and error-handling in tlv parsing by @mjstapp in #21316
bgpd: Verify if we correctly parsed BGP-LS attribute by @ton31337 in #21344
bgpd: More validations for labeled unicast and ENCAP attribute by @ton31337 in #21343
bgpd: Reset the stream to attr_start + attribute_len when WITHDRAWN by @ton31337 in #21351
ci: Adjust github workflows (actions) by @ton31337 in #21353
doc: document common daemon options and link -w references by @kaffarell in #21342
bgpd: A couple fixes for NLRI label parsing and flowspec decoding overflow by @ton31337 in #21340
doc: fix indentation error in pim doc by @mjstapp in #21373
bgpd: fix "use-after-free" for updgrp by @anlancs in #21081
bgpd: remove dest list from batch-clearing code by @mjstapp in #21382
bgpd: EVPN json brief optimization by @hnattamaisub in #21352
bgpd: Fix srv6 type parsing and EVPN type-5 NLRI prefix lengh parsing for IPv4 by @ton31337 in #21345
bgpd: Check if Local-Node and Remote-Node TLVs length is within boundaries by @ton31337 in #21349
bgpd: add additional attributes for evpn detail/ipv4/ipv6 detail json by @hnattamaisub in #21035
bgpd: display aggregate->count in show bgp detail for aggregate route by @enkechen-panw in #21309
isisd: improve validation of flex-algo decoder by @mjstapp in #21314
bgpd: Return an error for unknown flowspec component type by @ton31337 in #21350
bgpd: Modify early route processing to include send to zebra by @donaldsharp in #21357
pceplib: add validation to PCEP PST TLV decode by @mjstapp in #21372
bgpd: Fix memory leak for nhc attribute if ipv6 is link-local address by @ton31337 in #21377
tests: Fix time re in all_protocol_startup/test_all_protocol_startup by @hedrok in #21378
doc: fix BGP interface neighbor IPv4, IPv6, and v6only documentation by @nick-bouliane in #21383
zebra: EVPN prevent stale mbr_zifs entries from early return by @chiragshah6 in #21391
staticd: fix static_disable_vrf() to always send a route DELETE by @enkechen-panw in #21392
bgpd: Do not allocate stream if route-refresh capability is not received by @ton31337 in #21394
bgpd: Check dynamic capability action before validating ENHE capability by @ton31337 in #21395
bgpd: fix wrong overwritten for evpn by @anlancs in #21398
bgpd: Do not allow triggering route-refresh path with a malformed ORF length by @ton31337 in #21399
tools: Upgrade configuration to current format for Mergify by @ton31337 in #21409
topotests: split bgp_evpn_mh_v4_v6_num v4/v6 layout by @ashred-lnx in #21389
doc: fix SRv6 route commands by @iurmanj6WIND in #21416
pimd: guard channel OIL detach against stale pointers by @Jafaral in #21431
yang: Correct pyang errors in frr-pim-route-map.yang by @y-bharath14 in #21433
doc: fix SRv6 route commands (bis) by @iurmanj6WIND in #21432
bgpd: Fix copy-paste error in SRv6 DT46 SID duplicate install check (CID 1670455) by @cscarpitta in #21443
bgpd,lib,zebra: use explicit casts in tracepoint definitions by @mjstapp in #21438
bgpd: Skip oversized BGP-LS Node and Link Name TLVs by @cscarpitta in #21455
pimd: pim_inet4_dump -> %pI4s by @eqvinox in #21458
bgpd: Use %pI4/%pI6 formatters in BGP-LS NLRI display by @cscarpitta in #21456
bgpd: Fix wrong union member access in bgp_ls_nlri_display() by @cscarpitta in #21453
bgpd: Allow overriding "remote-as" per-neighbor by @ton31337 in #21450
zebra: remove kernel route on last address deletion by @hedrok in #19564
bfdd: avoid prefix-list memory allocation in bfd to solve oom issue by @sougatahitcs in #21073
watchfrr,tools: add --collect-core to core dump unresponsive daemon by @nishant111 in #21051
bgpd: remove unreachable json_paths free in evpn_show_all_routes() by @Jafaral in #21461
bfdd: bfd tx timeout topotest cleanup by @sougatahitcs in #21026
ripd,yang: log neighbor events by @rzalamena in #21442
ci: gate github-ci Build/Test jobs on non-doc paths; add HTML doc job by @Jafaral in #21475
Mgmt frontend problems in zebra by @donaldsharp in #21252
ospf6d: Remove ospf6 route when connected wins by @donaldsharp in #21476
pceplib: obj is already de-refed, no need to check for NULL by @donaldsharp in #21462
zebra: support brief json for show ip route command by @hnattamaisub in #20950
mgmtd: align commit config request argument order by @Babaijan in #21483
pceplib: ignore NULL obj in free_obj api by @mjstapp in #21487
staticd: fix static_cleanup_vrf() nexthop-VRF removal ordering by @enkechen-panw in #21413
bgpd: fix last Reset timer losing day part after 24 hours by @soumyar-roy in #21489
ospfd: add validation in several places before accessing message bodies by @mjstapp in #21303
pimd: fix NOCACHE MFC resync detection log, add vrf name too by @Jafaral in #21481
doc: refresh README with project links, badges, and contributor notes by @Jafaral in #21499
bgpd: Avoid unnecessary code path for brief command flow by @hnattamaisub in #21412
fix unnecessary BGP peer re-establishment in confederation by @wangdan1323 in #21439
Watchfrr phased restart by @donaldsharp in #21460
lib: mgmt: expose short-circuit bool as is_mgmtd by @choppsv1 in #21508
bgpd: Support established and failed options for show bgp neighbor co… by @hnattamaisub in #21066
zebra: add numMacs and numArpNd to L3 VNI detail output by @sougatahitcs in #21263
pimd: improve logging in a few places by @Jafaral in #21356
tests: clean up a build warning in a unit-test by @mjstapp in #21509
zebra: convert EVPN neigh hashes to typesafe (+.h cleanups) by @eqvinox in #21388
tests: Use abs_srcdir for tests. by @jkroonza in #21390
bgpd: add configurable advertisement delay for suppress-fib-pending by @deepak-singhal0408 in #21384
zebra: fix wrong hash count function call by @rzalamena in #21512
bgpd: Fix mixed remote-as for peer-groups when using auto by @ton31337 in #21406
bgpd: Don't mark nexthop as changed if a set next-hop unchanged is applied by @ton31337 in #21445
tests: update .gitignore for isis test by @mjstapp in #21530
tests: Check if IPv6 MTU change is triggering BGP updates correctly by @ton31337 in #21500
bgpd: PMSI tunnel attribute compatibility by @mjstapp in #21507
ospfd: add LSA validation in the apiserver path by @mjstapp in #21536
eigrpd: reject invalid prefix mask len by @mjstapp in #21539
eigrpd: enforce minimum TLV length in Hello handler by @TristanInSec in #21543
isisd: use correct min size values for srv6 subtlvs by @mjstapp in #21540
bgp_evpn: fix memleak when configuring rd by @lsang6WIND in #21566
bgpd: fix neighbor IP comparison for IPv6 memcmp return values by @hnattamaisub in #21559
bgpd: Replace the actual local-as when using replace-as with the confederation by @ton31337 in #21551
lib: northbound: distinguish unknown schema node from key mismatch by @reinaldosaraiva in #21534
bfdd: Move bfdproflist declaration to header by @pguibert6WIND in #21518
ospfd,tests: fix OSPF connected overlapping prefix bug by @rzalamena in #21510
bgpd: Print neighbor link type correctly according to local-as by @ton31337 in #21486
ospf6d: update auth sequence number after validating digest by @mjstapp in #21588
isisd: Preserve flags when copying SRv6 End SID sub-TLV by @cscarpitta in #21584
eigrpd: fix byte order in Hello authentication decode by @TristanInSec in #21545
lib: Report IPv6 MTU and not IPv4 for if_update_state_mtu6 by @ton31337 in #21501
bgpd: Prevent out-of-bound reading handling soft version dynamic capability by @ton31337 in #21602
bgpd: fix valgrind memory leaks on daemon shutdown by @soumyar-roy in #21511
isisd: continue hardening SRV6 tlv parsing by @mjstapp in #21585
Add new BGP SRv6L3VPN sid configuration test / Add associate test by @pguibert6WIND in #21386
bgpd: Dynamic capability parsing fixes by @ton31337 in #21603
nhrpd: stop debugging auth credentials by @mjstapp in #21615
bgpd: Consolidate redundant stream bounds checks in bgp_ls_decode_nlri by @cscarpitta in #21607
bgpd: Harden SRv6 Service Data parser for SID Structure length by @cscarpitta in #21612
bgpd: Clearly check for AS4 against 0 value by @ton31337 in #21610
isisd: consume leftover bytes after FAD sub-sub-TLV loop by @TristanInSec in #21544
bgpd: Prevent zero-length BGP-LS MT-ID TLV by @cscarpitta in #21600
bgpd: Reject BGP-LS Link NLRIs without Link Descriptor by @cscarpitta in #21609
tests: Remove show running bgpd from the topotests by @donaldsharp in #21629
Coverity cleanup some more items found by @donaldsharp in #21627
isisd: correct SRv6 End.X SID minimum size constants by @TristanInSec in #21541
bgpd: honor 'no activate' for dynamic neighbors in peer-group by @enissim in #21658
lib: mgmt: use SOMAXCONN for mgmtd socket listen backlog by @reinaldosaraiva in #21514
bgpd: Simplify BGP-LS NLRI TLV encoding by inlining helper functions by @cscarpitta in #21657
bgpd: migrate timers during peer_xfer_conn to fix stale route cleanup by @shashanka-ks in #21558
bgpd: Validate if NHC BGPID TLV value is non-zero by @ton31337 in #21611
isisd: Reject SRv6 Locator TLV with Loc-Size of zero by @cscarpitta in #21641
tests: bgp_suppress_fib was not stable before testing by @donaldsharp in #21649
bgpd: Do not allocate NHC TLV with an extra trailer by @ton31337 in #21606
bgpd: Avoid having a dangling pointer after we free NHC attribute by @ton31337 in #21605
bgpd: v4/v6 neigh advertised & received routes brief json by @hnattamaisub in #21411
tests: Update pytestmark value in scripts by @donaldsharp in #21684
static route bfd admin down state handling improvements by @sougatahitcs in #21400
bgpd: add advertisement-delay to hold route advertisements after startup by @karthikeyav in #21430
bgpd: Add support for BGP-LS for BGP fabric by @cscarpitta in #20726
tests: fix uptime check in test_bgp_default_originate_2links.py by @enkechen-panw in #21480
bgpd: Do not reject the route if confederation AS matches peer AS by @ton31337 in #21532
isisd: Use LAN End.X context for SRv6 sub-sub-TLV parsing by @cscarpitta in #21589
bgpd: Add BGP_AIGP_TLV_MIN_LEN constant to easily read what it is by @ton31337 in #21608
isisd: validate ASLA sub-sub-TLV length before consuming bytes by @TristanInSec in #21542
pimd: reject truncated IP datagrams before IGMP/mtrace handling by @Jafaral in #21705
lib: fix mgmt_msg recv to deal with mis-alignment by @choppsv1 in #21651
isisd: Reject duplicate SRv6 SID Structure Sub-Sub-TLV by @cscarpitta in #21656
Pim fixes in test by @donaldsharp in #21691
ospfd: Fix setting of type by @donaldsharp in #21712
pimd: cap PIM Hello secondary address list parsing by @Jafaral in #21707
tests: Ensure test_bgp_vpnv4_per_nexthop_label.py actually has a chance by @donaldsharp in #21699
zebra: fix EVPN MACIP DEL flag mixup in neighbor delete path by @nick-bouliane in #21733
bgpd: move auto config flag from bgp to srv6 unicast policy by @lsang6WIND in #21735
bgpd: Fixed crash in bgp received-routes detail json and code cleanup by @sougatahitcs in #20930
bgpd: Use BGP_LS_TLV_SET macro to set present_tlvs bits by @cscarpitta in #21604
BFD miscellaneous fixes by @pguibert6WIND in #21613
bgpd: Replace BGP_LS_TLV_* macros with standard FRR FLAG macros by @cscarpitta in #21755
nhrpd: improve validation in packet parsing by @mjstapp in #21686
pimd: harden BSM group/RP parsing paths by @Jafaral in #21734
pimd: fix crash in JP agg list due to stale upstream entry by @soumyar-roy in #21704
pimd: Provide better ordering for calling pim_upstream_use_rpt by @donaldsharp in #21764
bgpd: fix NHT for link-local nexthops from global-address peers by @soumyar-roy in #21687
bgpd: dynamic neighbors not up with md5 in non default vrf by @hnattamaisub in #21467
zebra: Fix incorrect update of 'nhe_received' in route_entry_update_nhe() by @GaladrielZhao in #21104
ospf6d: reinstall routes after zebra reconnect by @florath in #21011
Gre fixes by @pguibert6WIND in #21300
bgpd: Add json support for show bgp vrfs cmd by @sougatahitcs in #21485
bgpd: Add some defences for AS4/ENCAP handling by @ton31337 in #21777
add successful commit info msg by @choppsv1 in #21711
bgpd: fix aggregate->count undercount when dampening is cleared by @enkechen-panw in #21786
Bgp crashes by @donaldsharp in #21778
lib, isisd, bgpd: BGP-LS add several tlvs by @hedrok in #21376
tests: Remove invalid link-params command from BGP-LS topotest configs by @cscarpitta in #21793
*: consolidate sockopt_ apis in sockopt.c module by @mjstapp in #21746
tests: Add evpn pytestmark to tests that are missing by @donaldsharp in #21782
bgpd: fix shutdown crash by restricting evpn cleanup to owner instance by @soumyar-roy in #21698
ospf6d: packet- and auth-handling improvements by @mjstapp in #21783
pathd: add optional params to no cmd versions for frr-reload by @hedrok in #21710
tests: Fix zebra_vrf_netns topotest by @donaldsharp in #21741
*: Support gcc 15 by @mjstapp in #21812
zebra: fix memleak in ip import-table rmap by @chiragshah6 in #21811
Some more bgp connection rework by @donaldsharp in #21810
tests: Catch core dumps after teardown has completed by @donaldsharp in #21697
bgpd: fix aggregate->count not decremented when route is dampened by @enkechen-panw in #21787
zebra: Allow quick flaps of interfaces to be handled properly in next… by @donaldsharp in #21769
mgmtd: add periodic notify mode with mode/mode_data and FE test support by @ashred-lnx in #21253
bgpd: Treat malformed BGP-LS TLV as NLRI discard per RFC 9552 by @cscarpitta in #21827
tests: Fix invalid escape warning in BGP-LS test by @cscarpitta in #21829
tests: Fix invalid ISIS max-lsp-lifetime in BGP-LS configs by @cscarpitta in #21828
bgpd: Reject BGP-LS node/link names containing non-printable characters by @cscarpitta in #21825
tests: bgp_community_change_update: use receivedPrefixDup counter by @enkechen-panw in #21816
bgpd: fix aggregate->count errors in ZAPI route notifications by @enkechen-panw in #21789
bgpd: fix EVPN VRF auto RT deletion collision by @kaffarell in #21808
bgpd: set mp_nexthop_len consistently in subgroup_default_originate() by @enkechen-panw in #21840
staticd: nexthop identity as path-list key, and per-route metric by @enkechen-panw in #21296
bgpd: EVPN rd all or specific rd options based route table by @chiragshah6 in #21843
Startup after crash issues by @donaldsharp in #21550
bfdd: avoid close(-1) in bfd_dplane_finish_late by @sougatahitcs in #21841
Sockunion cmp wrong by @donaldsharp in #21833
bgpd: fix F-bit incorrectly set after port flap by @shashanka-ks in #21839
bgpd: enforce guards consistently at aggregate count entry points by @enkechen-panw in #21837
bgpd: send dynamic ENHE capability to peer-group members by @hnattamaisub in #21817
zebra: add json support for svd vxlan type by @sougatahitcs in #20886
bgpd: add detail json fields for v4/v6 neigh adver & recev routes by @sougatahitcs in #20951
docs: evpn: Add new Linux VXLAN Dataplane section by @robinchrist in #21664
zebra: align ctx nh cursor with RIB when skipping DUPLICATE nexthops by @hnattamaisub in #21709
pimd: validate PIM LAN sources and cap neighbors by @Jafaral in #21747
zebra: tear down old L3VNI before adding new one on VNI value change by @enissim in #21757
lib: bound masklen values, don't assert by @mjstapp in #21628
ospfd: add instance shutdown command by @rzalamena in #21759
bgpd: use bgp_node_match() instead of bgp_node_get() in aggregate count by @enkechen-panw in #21862
bgpd: Add BGP-LS Extensions for SRv6 (RFC 9514) by @cscarpitta in #21830
bgpd: warmboot failure when wfi enabled by @Manpreet-k0 in #21818
bgpd: Allow no network .... form for safi = EVPN or MPLS_VPN by @donaldsharp in #21860
bgpd: Skip route clearing for peers that were never established by @krishna-samy in #21867
bgpd: A couple link-state nits by @ton31337 in #21842
zebra: route EVPN FDB/neighbor reads through dplane by @rjarry in #21206
bgpd: add EVPN local RT-2 MAC+IP leaking to unicast by @louis-6wind in #20005
yang: allow match-metric value of zero by @mjstapp in #21888
*: don't use static char buffer in srv6 zapi code by @mjstapp in #21884
ospf6d: Fix command output for default route by @hedrok in #21886
bgpd: Remove redundant BGP-LS NLRI forward declarations by @cscarpitta in #21895
Memory leak problems. by @donaldsharp in #21844
debian: add pkg.frr.tcmalloc build profile for tcmalloc support by @rminnikanti in #21866
doc: fix spell check in developer and user rst guide by @chiragshah6 in #21901
bgpd: Reject malformed SRv6 End.X sub-TLV payloads with leftover bytes by @cscarpitta in #21904
zebra: Fix docstr mismatches in show ip route by @mhrn83 in #21865
Log file cleanup by @donaldsharp in #21907
bgpd: only use srv6_l3service attr if it's present by @mjstapp in #21916
bgpd: fix aggregate route not removed on de-configuration by @enkechen-panw in #21025
bgpd: Use ST token for BGP-LS STATIC protocol in NLRI output by @cscarpitta in #21909
bgpd: Fix incorrect BGP_PATH_MULTIPATH flag when route becomes invalid by @yuxuehong in #21106
tools: Add bfd commands to support bundle generation by @donaldsharp in #21914
pimd: Auto-RP hardening for discovery and announcements by @Jafaral in #21745
bgpd: Fix missing Multi-Topology ID in BGP-LS NLRIs by @cscarpitta in #21910
ospfd: Implement rfc4222 Recommendation 1 and 2 by @dfedyk in #20936
pimd: MLAG: skip pim_register_join on non-DR by @hnattamaisub in #21920
bgpd: validate SRV6 service sid transposition values by @mjstapp in #21903
bgpd: delete GR stale routes when nexthop becomes unreachable by @karthikeyav in #21742
bgpd: Initialize BGP-LS Node MSD only after parsing it by @cscarpitta in #21929
bgpd: Harden BGP-LS Node NLRI descriptor length validation by @cscarpitta in #21938
lib: add missing hook_unregister_arg in mgmt_be_client_destroy by @routingrocks in #21940
zebra: show nexthop-group rib brief json by @hnattamaisub in #20953
bgpd: support brief json for bgp v4 and v6 neighbors route by @hnattamaisub in #21414
lib,pceplib: fix DNS resolver and PCEP memory leaks by @jaredmauch in #20034
Tc dplane conversion by @donaldsharp in #21883
Fix event bugs in ldpd/lib and fix bgp_bmp misshandling of memory that leads to a crash by @donaldsharp in #21952
bgpd: Add route-map based allowas-in for flexible route filtering by @karthikeyav in #20659
pimd: Fix crash when up->channel_oil is NULL by @usrivastava-nvidia in #21961
zebra: Get link from the correct netns for vxlan by @leonshaw in #8895
ospfd: eliminate direct origination of Type-5 LSAs on NSSA routers by @rzalamena in #20894
zebra: fix EVPN zero-RMAC in some situations by @chdxD1 in #21448
bgpd: Move some optional feature-specific attributes from struct attr to struct attr_extra by @ton31337 in #21859
ospf6d: fix missing updating the global table by @anlancs in #21960
bgpd: cancel LLGR stale timer on peer AF delete by @Z-Yivon in #21947
topotests: Add a topotest for the no bgp client-to-client reflection command by @PierreNeltner6WIND in #21754
bgpd: limit GR-stale NHT-unreach delete to GR helper context by @karthikeyav in #21942
bgpd: cancel BFD strict hold timer on peer delete by @Z-Yivon in #21926
bgpd: skip stalepath-timer clear for LLGR-negotiated AFI/SAFIs by @hnattamaisub in #21932
*: small fixes roll-up pile by @eqvinox in #21957
lib: remove netns_other.c (unused) by @eqvinox in #21973
tests: Add VRF support for check_ping command by @ton31337 in #21753
bgpd: Fix missing SRv6 advertisement with distribute bgp-fabric-link-state by @cscarpitta in #21912
bgpd: Format IGP Router-ID in BGP-LS NLRI based on protocol by @cscarpitta in #21908
bgpd: Fix BGP-LS Attribute Node Name TLV by @cscarpitta in #21951
*: GCC 16 warnings by @eqvinox in #21985
bgpd: BGPd crash due to multiple bnc entry linked to same peer. by @usrivastava-nvidia in #21962
bgpd: preserve IPv6 nexthops when importing EVPN IPv4 routes by @kaffarell in #21958
ospfd: remove unnecessary space by @anlancs in #21979
bgpd: initialise nh_flag attribute by @fdumontet6WIND in #21498
bgpd: Check boundaries when parsing NHC and Prefix SID attributes by @ton31337 in #21981
bgpd: Fix GR helper retaining stale routes after Hard Reset by @selva-nexthop in #21823
tools: Revert 'no interface' when no configuration for interface left by @hedrok in #20378
ospfd: quick neighbor feature with BFD by @nabahr in #21784
ospf6d: only allow positive time strings by @jeremie6wind in #21928
bgpd: validate rfapi subtlv before accessing data octets by @mjstapp in #21974
zebra: clean up VRF handling by using dataplane provided vrf_id by @maxime-leroy in #20318
lib, zebra: bound SRv6 locator name length in ZAPI by @jamestiotio in #21868
bgpd: random format string fixes by @eqvinox in #21999
bgpd: fix AS-path routemap corruption and stale multipath on bestpath, fix tests by @donaldsharp in #21982
bgpd: Fix missing SRv6 unicast SID cleanup on locator delete by @cscarpitta in #21948
BFD authentication support by @pguibert6WIND in #21678
topotests: fix parallel run hangs (mutini teardown, ExaBGP FIFO, Docker hosts) by @Jafaral in https://github.com/FRRouting/frr/pull/22007
ci: fail topotest step when parallel run lacks JUnit failures by @Jafaral in https://github.com/FRRouting/frr/pull/22011
tests: Use show module to get bgp's pid by @donaldsharp in https://github.com/FRRouting/frr/pull/22023
lib: warn once when process fd limit is very large by @Jafaral in https://github.com/FRRouting/frr/pull/22031
pimd: fix shared-LAN (S,G) MFC loop and expand ssm topotest by @Jafaral in https://github.com/FRRouting/frr/pull/21998
ospfd: prevent stale LSA from corrupting local OSPF DB after reboot by @Jafaral in https://github.com/FRRouting/frr/pull/20601
pimd: add IGMP/MLD proxy route-map filtering by @Jafaral in https://github.com/FRRouting/frr/pull/21906
Fix keychain acceptance in BFD authentication by @donaldsharp in https://github.com/FRRouting/frr/pull/22028
bgpd: fix attr comparison when using attr_intern_reuse cache by @mjstapp in https://github.com/FRRouting/frr/pull/22008
bgpd: Fix stack overflow when debug printing label information & BMP code by @ton31337 in https://github.com/FRRouting/frr/pull/22056
bgpd: Move OTC and IPv6 extended community attributes to attr_extra by @ton31337 in https://github.com/FRRouting/frr/pull/22021
staticd: add 'show static routes' command by @kaffarell in https://github.com/FRRouting/frr/pull/21232
ripd: add full RTE bounds check to response/request processing loops by @DeadPackets in https://github.com/FRRouting/frr/pull/21889
pceplib: Validate lengths during object decoding by @mjstapp in https://github.com/FRRouting/frr/pull/22032
tests: fix flaky IGMP source baseline in pim_boundary_acl by @Jafaral in https://github.com/FRRouting/frr/pull/22055
pimd: move dense (S,G) to sparse mode when an RP is added by @Jafaral in https://github.com/FRRouting/frr/pull/20003
tests: harden bgp_conditional_advertisement_track_peer convergence waits by @Jafaral in https://github.com/FRRouting/frr/pull/22057
pimd: fix AutoRP stale RPs and selective multicast joins, add missing docs by @Jafaral in https://github.com/FRRouting/frr/pull/22039
bgpd: bmp: don't prepend local-AS to AS_PATH in BMP updates by @kalash-nexthop in https://github.com/FRRouting/frr/pull/21815
pimd,tests: refactor PIM join prune packet generation by @rzalamena in https://github.com/FRRouting/frr/pull/21795
zebra: fix neighbor entries ns_id by @louis-6wind in https://github.com/FRRouting/frr/pull/22034
Cleanup of memory allocation and usage of events by @donaldsharp in https://github.com/FRRouting/frr/pull/21943
zebra: fix DVNI route encap type for IPv6 VTEPs by @Manpreet-k0 in https://github.com/FRRouting/frr/pull/21911
No kernel nhg original by @donaldsharp in https://github.com/FRRouting/frr/pull/21893
bgpd: Fix use-after-free for ORF case by @ton31337 in https://github.com/FRRouting/frr/pull/22080
zebra: Track netlink carrier changes value by @donaldsharp in https://github.com/FRRouting/frr/pull/22084
In a removal operation do not allow a creation of the route_node in bgp by @donaldsharp in https://github.com/FRRouting/frr/pull/21878
bgpd: Move srte_color from attr struct to bgp_path_info_extra by @ton31337 in https://github.com/FRRouting/frr/pull/22059
Revert "bgpd: do not flag old best as multipath when it is also the n… by @donaldsharp in https://github.com/FRRouting/frr/pull/22095
bgpd: Move link_bw from attr_extra to bgp_path_info_extra by @ton31337 in https://github.com/FRRouting/frr/pull/22093
bgpd: Skip route-map LPM optimisation for AF_FLOWSPEC by @ton31337 in https://github.com/FRRouting/frr/pull/22083
bgpd: Fix infinite loop in MRT route dump for oversized paths by @ton31337 in https://github.com/FRRouting/frr/pull/22082
tests: reap mutini zombies and skip post-teardown support bundles by @Jafaral in https://github.com/FRRouting/frr/pull/22096
build, lib, zebra: OpenBSD fixes by @eqvinox in https://github.com/FRRouting/frr/pull/22009
tests: add multi-edit test with commit for mgmtd by @choppsv1 in https://github.com/FRRouting/frr/pull/22010
zebra: fix missing cleaning vni entry by @anlancs in https://github.com/FRRouting/frr/pull/22079
tests: fix grpc topotest xdist collection mismatch in CI by @Jafaral in https://github.com/FRRouting/frr/pull/22048
tests: harden topotest gcov coverage setup and reporting by @Jafaral in https://github.com/FRRouting/frr/pull/22104
Fix some topotest skipping problems by @donaldsharp in https://github.com/FRRouting/frr/pull/22113
pimd: fix AutoRP holdtime parsing and minor cleanup by @Jafaral in https://github.com/FRRouting/frr/pull/22120
docker: Add snmptrapd to list of thingies to install by @donaldsharp in https://github.com/FRRouting/frr/pull/22125
bgpd: Cleanup debug memory on shutdown by @donaldsharp in https://github.com/FRRouting/frr/pull/22123
tests: Remove unknown pytest.mark.tools by @donaldsharp in https://github.com/FRRouting/frr/pull/22114
bgpd: Add vrf name to more bestpath debugs by @donaldsharp in https://github.com/FRRouting/frr/pull/22124
tests: fix bgp_soo topotest by separating IPv4/IPv6 address families by @enkechen-panw in https://github.com/FRRouting/frr/pull/22128
yang: use relative path for remaining route-map when clauses by @enkechen-panw in https://github.com/FRRouting/frr/pull/22127
bgpd: refactor bgp_aggregate_{increment,decrement} by @enkechen-panw in https://github.com/FRRouting/frr/pull/22126
pimd: guard NULL RP lookups in BSM and RP deletion paths by @Jafaral in https://github.com/FRRouting/frr/pull/22131
pimd: fix mapping agent AutoRP discovery packet size by @Jafaral in https://github.com/FRRouting/frr/pull/22121
mgmtd: fix link order for libmgmt_be_nb by @enkechen-panw in https://github.com/FRRouting/frr/pull/22119
ospf6d: bypass MinLSArrival for self-originated MaxAge LSAs by @hnattamaisub in https://github.com/FRRouting/frr/pull/22103
lib: test the right bytes in flowspec prefixes by @mjstapp in https://github.com/FRRouting/frr/pull/22138
bgpd: remove unneeded sort of communities in rmap delete by @mjstapp in https://github.com/FRRouting/frr/pull/22151
pimd: fix BSR failover RP not setting i_am_rp locally by @Jafaral in https://github.com/FRRouting/frr/pull/22157
bgpd: reorder parameters in bgp_remove_route_from_aggregate() by @enkechen-panw in https://github.com/FRRouting/frr/pull/22136
zebra: fix wrong comparision for nexthop by @anlancs in https://github.com/FRRouting/frr/pull/21503
bgpd: Set extended flag for NHC attribute when re-encoding by @ton31337 in https://github.com/FRRouting/frr/pull/22159
pimd: dense mode fixes and topotest coverage by @Jafaral in https://github.com/FRRouting/frr/pull/22115
pimd: BSR/C-RP fixes with expanded topotest coverage by @Jafaral in https://github.com/FRRouting/frr/pull/22117
bgpd: Avoid cluster list attribute truncation by @ton31337 in https://github.com/FRRouting/frr/pull/22081
pimd: fix multicast boundary list lifetime and ACL evaluation by @Jafaral in https://github.com/FRRouting/frr/pull/22122
bgpd: Fixes in comm/lcomm/ecomm str functions by @mjstapp in https://github.com/FRRouting/frr/pull/22176
bgpd: comment style modifications for verify source test by @PierreNeltner6WIND in https://github.com/FRRouting/frr/pull/22112
yang: Prefix mismatch in frr-zebra.yang by @y-bharath14 in https://github.com/FRRouting/frr/pull/22189
bgpd: Fix stale EVPN type-5 route for suppressed prefix during L3VNI bounce by @raja-rajasekar in https://github.com/FRRouting/frr/pull/21992
pimd: defer static mroute install until interfaces are ready by @Jafaral in https://github.com/FRRouting/frr/pull/22156
pimd: fix dense mode State Refresh relay forwarding by @Jafaral in https://github.com/FRRouting/frr/pull/22177
ospf: fix the return value for the invalid VRF name by @SindhuParvathi-Gopi in https://github.com/FRRouting/frr/pull/22161
bgpd: free srv6_l3service object in failed parse path by @mjstapp in https://github.com/FRRouting/frr/pull/22198
zebra: EVPN clean up stale L2 NH/NHG from kernel at startup by @Manpreet-k0 in https://github.com/FRRouting/frr/pull/22002
ospfd: validate extended prefix TLV before accessing prefix SID by @mjstapp in https://github.com/FRRouting/frr/pull/22215
bgpd: Limit as-path segments up to 255 by @ton31337 in https://github.com/FRRouting/frr/pull/22212
bgpd: Clearly put 4-bytes when encoding SAFI_FLOWSPEC MP_REACH msg by @ton31337 in https://github.com/FRRouting/frr/pull/22213
pimd: fix heap OOB write in BSM fragmenter by @Jafaral in https://github.com/FRRouting/frr/pull/22222
lib: use XSTRDUP/XFREE for yang_data value field by @enkechen-panw in https://github.com/FRRouting/frr/pull/22196
staticd: avoid XPath set_sort in ecmp_path_list_validate by @enkechen-panw in https://github.com/FRRouting/frr/pull/22118
zebra: Allow rnh evaluation for a queued and !installed rn by @donaldsharp in https://github.com/FRRouting/frr/pull/22221
ospfd: Validate PREFIX_SID subtlv len before accessing by @mjstapp in https://github.com/FRRouting/frr/pull/22218
bfdd: fix show bfd peers brief json output identical to show bfd peers by @JackeySparrow in https://github.com/FRRouting/frr/pull/22064
bgpd: Fix community string truncation for big community sets by @ton31337 in https://github.com/FRRouting/frr/pull/22160
zebra: remove unused struct buf_req by @iurmanj6WIND in https://github.com/FRRouting/frr/pull/22242
pimd: fix wrong endian convertion by @anlancs in https://github.com/FRRouting/frr/pull/22244
yang: inet type mismatch in frr-bfdd.yang by @y-bharath14 in https://github.com/FRRouting/frr/pull/22241
lib: Some smaller code fixes for typesafe hash _member function by @robinchrist in https://github.com/FRRouting/frr/pull/22233
bgpd: fix local rt2 mac+ip leak race conditions by @louis-6wind in https://github.com/FRRouting/frr/pull/21967
zebra: add dplane helpers to provide interface speed by @maxime-leroy in https://github.com/FRRouting/frr/pull/19412
bgpd: add LLGR to capability length validation switch by @guoguojia2021 in https://github.com/FRRouting/frr/pull/22249
bgpd: fixes for NH and aggregator attribute parsing by @mjstapp in https://github.com/FRRouting/frr/pull/22200
bgpd: remove duplicate snprintf in FlowSpec redirect VRF display by @guoguojia2021 in https://github.com/FRRouting/frr/pull/22272
bgpd: fix return NULL in bool function ecommunity_node_target_match by @guoguojia2021 in https://github.com/FRRouting/frr/pull/22273
eigrpd: fix out-of-bounds reads in SHA256 digest computation by @arshsmith in https://github.com/FRRouting/frr/pull/22271
bgpd: fix holdtime_ptr unsafe pointer aliasing in OPEN receive path by @guoguojia2021 in https://github.com/FRRouting/frr/pull/22270
Network Byte Order Fixes for Little Endian Machines by @donaldsharp in https://github.com/FRRouting/frr/pull/22251
bgpd: skip peers not activated for AFI/SAFI in bgp_gr_check_all_eors() (backport #22295) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22302
bgpd: Fix extended optional parameters handling in OPEN message (backport #22308) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22321
pceplib: slightly relax a pcep object validation (backport #22298) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22309
tools: Use the topotest log directory instead of /tmp (backport #22315) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22326
pceplib: add length validation for pcep obj decoders (backport #22318) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22335
zebra: bump dplane major version for 10.7 by @mjstapp in https://github.com/FRRouting/frr/pull/22337
Also build for linux/riscv64 on release (backport #22256) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22341
tools: Normalize aggregate-address command when doing frr-reload (backport #22284) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22344
bgpd,tests: improve validation of incoming oid arrays (backport #22116) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22379
tests, tools: Shutdown daemons in tests same order in systemd (backport #22314) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22382
tools: Fix frr-reload.py crashes with UnboundLocalError (backport #22378) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22386
pimd: use RFC 3973 dm graft retry period for retransmission (backport #22376) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22389
tests: Fix bgp conditional advertisement test to ensure route is received (backport #22327) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22384
bgpd: don't advertise LLGR stale routes to non-LLGR peers (backport #22297) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22400
tests: load frr.conf by default (backport #22398) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22415
bgpd: reduce ibuf_scratch size to match ibuf_work (backport #22347) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22393
pimd: run Assert for dense mode wrong-interface handling (backport #22377) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22424
pimd: compensate for missing WRVIFWHOLE upcall on old kernels (backport #22240) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22395
bgpd: fix strlcat/strlcpy size parameter in NOTIFICATION send path (backport #22279) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22431
Add restart_frr, document topotest router and daemon restart helpers (backport #22399) by @Jafaral in https://github.com/FRRouting/frr/pull/22435
yang: Swapped RPF lookup mode descriptions (backport #22375) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22437
doc, tests: require frr.conf and load_frr_config() in new topotests (backport #22420) by @Jafaral in https://github.com/FRRouting/frr/pull/22436
debian, redhat: 10.7.0 release preparation by @Jafaral in https://github.com/FRRouting/frr/pull/22438
bgpd: Ignore parsing ORF route-refresh messages (backport #22429) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22455
ospf6d: log KillNbr adjacency changes on interface down (backport #22459) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22462
pimd: fix BSR_PENDING timer being overwritten by BS liveness timer (backport #22460) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22463
Revert #20005 for stable/10.7 only by @ton31337 in https://github.com/FRRouting/frr/pull/22471
pimd: fix NOCACHE forwarding for non-connected sources and static mroute upcalls (backport #22466) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22487
pimd: fix elected BSR not updating when priority changes (backport #22465) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22477
bgpd: fix bmp connect deletion with source-interface (backport #22469) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22508
bgpd: Do not accept AIGP for OAD peers if not enabled (backport #22519) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22525
Merge pull request #22423 from rdemsystems/fix/bgp-extended-message-r… by @rdemsystems in https://github.com/FRRouting/frr/pull/22545
ospf6d: check length before accessing grace LSA TLVs (backport #22539) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22556
ldpd: check fec elem length before accessing (backport #22537) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22559
pimd: fix C-RP processing crash during BSR_PENDING state (backport #22467) by @Jafaral in https://github.com/FRRouting/frr/pull/22566
pimd: MLAG: gate FHR flag on DR check in wrvifwhole/wholepkt upcalls (backport #22529) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22572
*: fix overflow in comparator functions used by sorted containers (backport #22498) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22574
pimd: fix stack overflow and IGMPv3 fragmentation in group_retransmit_sources (backport #21047) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22604
pimd: clean stale upstream NHT tracking on RP delete (backport #22505) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22605
pimd: prefer kernel ingress on WRONGVIF when MFC iif is stale (backport #22607) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22624
lib: Print multicast-source-interface rmap match (backport #22612) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22618
pimd: allow WRONGVIF prefer-ingress with (*,G)-only ifchannel (backport #22626) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22641
bgpd: anchor parsed attr in bgp_nlri_parse_vpn to preserve srv6_l3service (backport #22492) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22620
Missing show run output (backport #22619) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22644
bgpd: fix const-qualifier build error with strrchr (backport #22642) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22647
pimd: do not proxy IGMP leave while other downstream receivers remain (backport #22622) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22658
pimd: defer join-group socket joins until the interface exists (backport #22634) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22668
bgpd: Validate NEXT_HOP attribute if we have NLRIs and MP_REACH_ATTR (backport #22637) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22660
pimd: avoid stale RPF ifp during vrf/interface events (backport #22650) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22669
bgpd: don't emit "no neighbor X capability link-local" for unnumbered… (backport #22540) by @mergify[bot] in https://github.com/FRRouting/frr/pull/22664
10.6.1
What's Changed
doc: fix indentation error in pim doc (backport #21373)
Fix/bgp hardening backports 10.6
isisd: improve validation of flex-algo decoder (backport #21314)
bgpd: Do not allocate stream if route-refresh capability is not received (backport #21394)
bgpd: Check dynamic capability action before validating ENHE capability (backport #21395)
bgpd: Do not allow triggering route-refresh path with a malformed ORF length (backport #21399)
pimd: guard channel OIL detach against stale pointers (backport #21431)
ospfd: add validation in several places before accessing message bodies (backport #21303)
pimd: fix NOCACHE MFC resync detection log, add vrf name too (backport #21481)
bgpd: Fix mixed remote-as for peer-groups when using auto (backport #21406)
bgpd: Don't mark nexthop as changed if a set next-hop unchanged is applied (backport #21445)
ospfd: add LSA validation in the apiserver path (backport #21536)
eigrpd: reject invalid prefix mask len (backport #21539)
eigrpd: enforce minimum TLV length in Hello handler (backport #21543)
isisd: use correct min size values for srv6 subtlvs (backport #21540)
bgpd: fix neighbor IP comparison for IPv6 memcmp return values (backport #21559)
bgp_evpn: fix memleak when configuring rd (backport #21566)
eigrpd: fix byte order in Hello authentication decode (backport #21545)
lib: Report IPv6 MTU and not IPv4 for if_update_state_mtu6 (backport #21501)
bgpd: Prevent out-of-bound reading handling soft version dynamic capability (backport #21602)
isisd: continue hardening SRV6 tlv parsing (backport #21585)
bgpd: Dynamic capability parsing fixes (backport #21603)
isisd: consume leftover bytes after FAD sub-sub-TLV loop (backport #21544)
bgpd: Harden SRv6 Service Data parser for SID Structure length (backport #21612)
nhrpd: stop debugging auth credentials (backport #21615)
bgpd: honor 'no activate' for dynamic neighbors in peer-group (backport #21658)
bgpd: migrate timers during peer_xfer_conn to fix stale route cleanup (backport #21558)
isisd: correct SRv6 End.X SID minimum size constants (backport #21541)
isisd: Reject SRv6 Locator TLV with Loc-Size of zero (backport #21641)
bgpd: Validate if NHC BGPID TLV value is non-zero (backport #21611)
bgpd: Check if BGPID NHC TLV exists when IPv6 next-hop is link-local (backport #21377, #21605, #21611)
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit d692769d94c752225a7cc48b378be8c389939b56
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Sat Aug 8 15:07:03 2026 +0200
fort-validator: Update to version 1.6.8
- Update from version 1.6.7 to 1.6.8
- No change in rootfile
- 1 GHSA fix
- Changelog
1.6.8
GHSA-qfm3-577x-rh54: Prevent RRDP cache poisoning
#112: Refuse cross-origin RRDP
#175: Skip hidden files and directories when synchronizing via Rsync
016f399: Reject negative certificate serial numbers
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit e1f5b0c63e6cb6c0c82980d3068612adb5c98ec4
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Sat Aug 8 12:34:14 2026 +0200
dnsdist: Update to version 2.1.1
- Update from version 2.1.0 to 2.1.1
- No change in rootfile
- Changelog
2.1.1
Bug Fixes
Account for the existing content when parsing labels
References: #17790, #17797, pull request 17858
Do not index past the address for byte-aligned prefixes
References: #17835, pull request 17860
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 6bfebc4000db303515821b3a6b7ae3873041ec34
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Sat Aug 8 12:34:13 2026 +0200
core205: Ship shadow
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit c3683dff25fa535af812fb91163dfb820048672d
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Sat Aug 8 12:34:15 2026 +0200
shadow: Update to version 4.20.0
- Update from version 4.18.0 to 4.20.0
- Update of rootfile
- Addition of patch to fix a build error. This patch will be integrated into the next
tarball release.
- Checked the sobump but no dependencies found.
- Changelog
4.20.0
Removals:
The following programs and features were deprecated in 4.19 (Herve)
or earlier, and have been removed in 4.20.
expiry(1) (deprecated in 4.19)
See #1481
and #1432.
login.defs(5): ENCRYPT_METHOD: DES (deprecated in 4.19)
See #1456.
login.defs(5): ENCRYPT_METHOD: MD5 (deprecated in 4.19)
See #1457.
login.defs(5): MD5_CRPYT_ENAB (deprecated since the dinosaurs were around)
See #1455.
shadow(5): .sp_min (deprecated in 4.19)
See #1482.
This also includes the following removals:
chage(1): -m,--mindays (also the interactive version)
passwd(1): -n,--mindays
login.defs(5): PASS_MIN_DAYS
This feature is considered a vulnerability, and was removed
without replacement.
Programs will now fail when any of those flags or variable are
specified. This is intentional, and should help identify any
scripts that rely on these.
groupmems(8) (deprecated in 4.19)
See #1343
and #1601.
Use usermod(8) instead.
logoutd(8) (deprecated in 4.19)
See #999
and #1344.
Defaults:
The following default values were changed.
login.defs(5): Remove defaults for password expiration
(PASS_MAX_DAYS, PASS_WARN_AGE)
See #1428.
login.defs(5): ENCRYPT_METHOD: Default to SHA512 (previously, it was DES)
See #1278
and #1454.
Users should still explicitly specify it, since other programs that read
login.defs(5) may still default to DES.
Features
The following features that were optional in 4.19 are now
unconditionally supported in 4.20.
SHA256, SHA512
See #1278
and #1452.
Regressions
Some regressions have been introduced (as side effects of bug fixes) and they're
here to stay. Users must adapt.
#1704
su(1) as root can be dangerous because of an ioctl (TIOCSTI), and if
that ioctl is not disabled, su(1) will now fail and report an error.
#1706
usermod(8) doesn't produce any effects if it fails to unlock a
password because there was no password. Previously, this was just a
warning, and thus produced effects.
Dependencies:
We've removed an unused dependency (libattr).
See #1473.
Deprecations
No new deprecations since 4.19. However, we maintain the
deprecations from then. Here's a reminder of deprecated features
that have not been removed yet (they will eventually be removed):
Password aging:
chage(1):
-I,--inactive (also the interactive version)
-M,--maxdays (also the interactive version)
-W,--warndays (also the interactive version)
passwd(1):
-k,--keep-tokens
-x,--maxdays
-i,--inactive
-w,--warndays
useradd(8):
-f,--inactive
usermod(8):
-f,--inactive
login.defs(5):
PASS_MAX_DAYS
PASS_WARN_AGE
/etc/default/useradd:
INACTIVE
shadow(5):
.sp_lstchg: Restrict to just the values 0 and empty.
.sp_max
.sp_warn
.sp_inact
4.19.4
Regression fixes:
- Build with GCC 10 and older.
4.19.3
Regression fixes:
- chpasswd(8):
- Don't reject hashes containing backslashes or 'n' characters
(affected SHA-256, SHA-512, MD5).
4.19.2
Regression fixes:
- usermod(8):
- Revert an incorrect commit.
See <https://github.com/shadow-maint/shadow/issues/1509>
and <https://github.com/shadow-maint/shadow/pull/1510>.
4.19.1
Regression fixes:
- chpasswd(8):
- Don't reject leading '!' in password hashes or a hash consisting
of "*". These were accidentally rejected in 4.19.0.
See <https://github.com/shadow-maint/shadow/issues/1483>
and <https://github.com/shadow-maint/shadow/pull/1486>.
- Accept a passwordless account ("" or "!").
See <https://github.com/shadow-maint/shadow/issues/1483#issuecomment-3757398138>
and <https://github.com/shadow-maint/shadow/pull/1505>.
4.19.0
Breaking changes:
Remove support for escaped newlines in configuration files.
It never worked correctly.
b0a7ce5 (2025-12-05; "lib/, po/: Remove fgetsx() and fputsx()")
Some user names and group names are too dangerous and are rejected,
even with --badname.
25aea74 (2025-12-25; "lib/chkname.c, src/: Strictly disallow really bad names")
Future breaking changes:
SHA512 and SHA256 will be supported unconditionally in the next
release. The build-time flag '--with-sha-crypt' will be removed.
See #1452.
Support:
Several years ago, there were talks about deprecating su(1) and
login(1), back when this project was maintained as part of Debian.
However, nothing was clearly stated, and there were doubts about the
status of these programs. Let's clarify them now.
Our implementations of su(1) and login(1) are fully supported, and we
don't have any plans to remove them. They are NOT deprecated.
See #464.
Deprecations:
groupmems(8)
The program will be removed in a future release.
See #1343.
logoutd(8)
The program will be removed in the next release.
See #999,
and #1344.
DES
This hashing algorithm has been deprecated for a long time,
and support for it will be removed in a future release.
See #1456
MD5
This hashing algorithm has been deprecated for a long time,
and support for it will be removed in a future release.
See #1457
login.defs(5): MD_CRYPT_ENAB
This feature had been deprecated for decades. It will be
removed in a future release.
The command-line equivalents (-m, --md5) of this feature in
chpasswd(8) and chgpasswd(8) will also be removed in a future
release.
See #1455.
login.defs(5): PASS_MAX_LEN
This feature is ignored except for DES. Once DES is removed,
it makes no sense keeping it. It may be removed in a future
release.
Password aging
Scientific research shows that periodic password expiration
leads to predictable password patterns, and that even in a
theoretical scenario where that wouldn't happen the gains in
security are mathematically negligible.
https://people.scs.carleton.ca/~paulv/papers/expiration-authorcopy.pdf
Modern security standards, such as NIST SP 800-63B-4 in the USA,
prohibit periodic password expiration.
https://pages.nist.gov/800-63-4/sp800-63b.html#passwordver
https://pages.nist.gov/800-63-FAQ/#q-b05
https://www.ncsc.gov.uk/collection/passwords/updating-your-approach#PasswordGuidance:UpdatingYourApproach-Don'tenforceregularpasswordexpiry
To align with these, we're deprecating the ability to
periodically expire passwords. The specifics and long-term
roadmap are currently being discussed, and we invite feedback
from users, particularly from those in regulated environments.
See #1432.
This deprecation includes the following programs and features:
expiry(1)
chage(1):
-I,--inactive (also the interactive version)
-m,--mindays (also the interactive version)
-M,--maxdays (also the interactive version)
-W,--warndays (also the interactive version)
passwd(1):
-k,--keep-tokens
-n,--mindays
-x,--maxdays
-i,--inactive
-w,--warndays
useradd(8):
-f,--inactive
usermod(8):
-f,--inactive
login.defs(5):
PASS_MIN_DAYS
PASS_MAX_DAYS
PASS_WARN_AGE
/etc/default/useradd:
INACTIVE
shadow(5):
sp_lstchg: Restrict to just the values 0 and empty.
sp_min
sp_max
sp_warn
sp_inact
We recognize that many users operate in environments with
regulatory or contractual requirements that still mandate
password aging. To minimize disruption, these features will
remain functional for a significant period. However, we
encourage administrators to review their internal policies,
talk to their regulators if appropriate, and participate in the
roadmap discussion linked above.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 8be727e203c726186dd5649d433982d361bc0aa7
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Sat Aug 8 12:34:12 2026 +0200
clamav: Update to version 1.5.4
- Update from version 1.5.3 to 1.5.4
- Update of rootfile
- 8 CVE Fixes plus a fix for a rust advisory
- Changelog
1.5.4
- [CVE-2026-20337](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20337):
Fixed ZIP catalogue capacity tracking that could write beyond a heap
allocation while indexing local file headers.
This issue affects ClamAV 1.5.0 through 1.5.3.
The fix is included in 1.5.4.
Thank you to Kevin Stubbings of the GitHub Security Lab team for identifying
this issue.
- [CVE-2026-20345](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20345):
Fixed an indexing error while converting GPT partition names that could
read or write beyond a stack-allocated partition entry.
This issue affects ClamAV 0.98.2 through 1.5.3.
The fix is included in 1.4.6 and 1.5.4.
Thank you to Atuin - Automated Vulnerability Discovery Engine, Tianchu Chen
of Tencent Xuanwu Lab for identifying this issue.
- [CVE-2026-20339](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20339):
Fixed an integer overflow in the PESpin unpacker that could allocate an
undersized buffer and then write beyond it while rebuilding a PE file.
This issue affects ClamAV 0.90 through 1.5.3.
The fix is included in 1.4.6 and 1.5.4.
Thank you to Feng Xue and, independently, Yazdan Soltani for identifying
this issue.
- [CVE-2026-20338](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20338):
Fixed ownership handling while merging ZIP catalogue records that could
cause an invalid free while scanning a malformed archive.
This issue affects ClamAV 1.5.0 through 1.5.3.
The fix is included in 1.5.4.
Thank you to Daggolu Rakesh and, independently, Yazdan Soltani for
identifying this issue.
- [CVE-2026-20346](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20346):
Fixed an integer underflow in the PDF parser that could cause a crash while
reading a malformed hex string.
This issue affects ClamAV 1.4.5 and earlier, and ClamAV 1.5.0 through
1.5.3.
The fix is included in 1.4.6 and 1.5.4.
Thank you to Tristan (@TristanInSec) for identifying this issue.
- [CVE-2026-20347](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20347):
Fixed undefined behavior and integer overflow in the Mach-O parser that
could cause a crash while scanning a malformed Mach-O file.
This issue affects ClamAV 1.4.5 and earlier, and ClamAV 1.5.0 through
1.5.3.
The fix is included in 1.4.6 and 1.5.4.
Thank you to Tristan (@TristanInSec) for identifying this issue.
- [CVE-2026-20348](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20348):
Fixed XAR parser size handling that could request an excessive allocation
or exceed scan limits while decompressing a malformed table of contents.
This issue affects ClamAV 0.98.1 through 1.5.3.
The fix is included in 1.4.6 and 1.5.4.
Thank you to leduckhuong for identifying this issue.
- [CVE-2025-8088](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8088):
Adopted the upstream UnRAR project fix in ClamAV's bundled UnRAR library.
The fix rejects path separators in NTFS alternate data stream names to
prevent extraction outside ClamAV's temporary scan directory on Windows.
This issue affects ClamAV 0.101.0 through 1.5.3.
The fix is included in 1.4.6 and 1.5.4.
Thank you to Yazdan Soltani for identifying that this issue affects ClamAV.
- Fixed thread-safety issues in the `clamd` STATS command that could disclose
process memory or crash the daemon while scans and STATS requests run
concurrently. Also fixed partial socket-write handling used for large STATS
responses.
This issue affects ClamAV 0.95 through 1.5.3.
The fix is included in 1.4.6 and 1.5.4.
- FreeBSD: Restored support for safe quarantine move and remove actions while
preserving protection against source-path replacement races.
This issue affects ClamAV 1.4.5 and 1.5.3.
The fix is included in 1.4.6 and 1.5.4.
- Fixed an OpenSSL library-context leak in legacy hashing helpers when a
requested message digest cannot be fetched, such as when the default
provider is unavailable in a FIPS-enabled environment.
This issue affects ClamAV 1.5.0 through 1.5.3.
The fix is included in 1.5.4.
- Upgraded the Rust `crossbeam-epoch` dependency to resolve the
RUSTSEC-2026-0204 advisory.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit de065a0192e7969152ea27a1a18290ccdc270fe9
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Aug 7 22:33:57 2026 +0200
core205: Ship xfsprogs
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 0cbb458549f2924f43c4c1d47f25d92fffc48b65
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Aug 7 22:34:10 2026 +0200
xfsprogs: Update to version 7.1.1
- Update from version 7.0.1 to 7.1.1
- No change in rootfile
- Changelog
7.1.1
xfsprogs: healer: install targets one at a time (Allen Hewes)
fiemap: add a nosync option (Pankaj Raghav)
xfs_scrub: fix spacemap scan for data volume (Darrick J. Wong)
mdrestore: fix extent length overflow in v2 restore path (Manognya Singuru)
7.1.0
fsr: preserve xfrog_bulkstat error codes (liuh)
xfs_scrub: fix spacemap scan for internal rt devices (Darrick J. Wong)
mkfs: PQUOTA shouldn't conflict with GQNOENFORCE (Darrick J. Wong)
mkfs: fix hardlink detection in directory import code (Darrick J. Wong)
xfs_protofile: make nondirectory arguments actually work (Darrick J. Wong)
mkfs: fix symlink target length check in create_nondir_inode (Darrick J. Wong)
mkfs: don't redefine DIRT for protofiles (Darrick J. Wong)
xfs_healer: fix getmntent race in weakhandle (Darrick J. Wong)
xfs_db: dump zoned filesystem superblock fields (Darrick J. Wong)
xfs_db: fix type conversions (Darrick J. Wong)
xfs_scrub: fix estimate of work items for phase 4 (Darrick J. Wong)
xfs_scrub: always finish cleanup, even if reporting healthy state fails
(Darrick J. Wong)
xfs_scrub: fix phase 8 debug reporting (Darrick J. Wong)
xfs_scrub: don't leak phase 5 scan items after a failed workqueue_add
(Darrick J. Wong)
xfs_scrub: warn about difficult rtgroup repairs (Darrick J. Wong)
xfs_scrub: don't leak the autofsck fsproperty handle (Darrick J. Wong)
xfs_scrub: account for reflinked realtime file data (Darrick J. Wong)
xfs_scrub: account only data extent tail after an overlap (Darrick J. Wong)
xfs_scrub: report external log space usage in phase 7 (Darrick J. Wong)
xfs_scrub: warn about incomplete repairs if we never get to them (Darrick J.
Wong)
xfs_scrub: handle media scans of internal rt devices correctly (Darrick J. Wong)
xfs_scrub: report bad file ranges correctly (Darrick J. Wong)
xfs_scrub: handle missing media verify ioctl failure return codes (Darrick J.
Wong)
mkfs: fix filesystem and log size units (Manognya Singuru)
xfs_healer: don't put the slice file in LDIRT (Darrick J. Wong)
xfs_healer: allow AF_UNIX socket access for xfs_healer instances (Darrick J.
Wong)
xfs_healer_start: fix static checking (Darrick J. Wong)
xfs_healer_start: check listmount when doing a --check (Darrick J. Wong)
xfs_scrub: read verification isn't ok if it hit runtime errors (Darrick J. Wong)
xfs_scrub: don't obscure repair failures in repair_list_schedule (Darrick J.
Wong)
xfs_scrub: don't crash trying to complain about clean health (Darrick J. Wong)
xfs_scrub: don't continue with phase1 if autofsck=none (Darrick J. Wong)
xfs_scrub: don't allow NAN as fstrim percentage (Darrick J. Wong)
xfs_scrub: fix nonsense advice after a scrub finds errors (Darrick J. Wong)
xfs_scrub: return SCRUB_RET_OPERROR if unicode collision detection fails to
initialize (Darrick J. Wong)
xfs_scrub: don't report media errors in specially-owned areas as file data
(Darrick J. Wong)
xfs_scrub: fix work estimation for rtgroups filesystems (Darrick J. Wong)
xfs_scrub: don't count internal log space in the data device used count
(Darrick J. Wong)
xfs_scrub: fix integer overflows (Darrick J. Wong)
xfs_scrub_fail: send content headers for xfs_scrub_all failures (Darrick J. Wong)
xfs_scrub_all_fail: reduce security lockdowns to avoid postfix problems
(Darrick J. Wong)
xfs_scrub_all: fix broken command line string array construction (Darrick J.
Wong)
xfs_scrub_media_fail: reduce security lockdowns to avoid postfix problems
(Darrick J. Wong)
xfsprogs: include/buildrules: fix ltdep (Romain Naour)
xfs_healer: coordinate access to weakhandle::mntpoint correctly (Darrick J. Wong)
xfs_healer: don't leak wh->mntpoint if fd_to_handle fails (Darrick J. Wong)
xfs_healer: fix Makefile errors (Darrick J. Wong)
xfs_healer: run a full xfs_scrub repair if we don't know how to do a spot
repair (Darrick J. Wong)
xfs_healer: recommend offline fsck for XCORRUPT repairs (Darrick J. Wong)
xfs_healer: fix error reporting (Darrick J. Wong)
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 0f49c2d75a2da499c4ce3430a740fa7b5a857485
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Aug 7 22:33:56 2026 +0200
core205: Ship systemd
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 809752ad05d48e74fb530df2671bc9e061561a60
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Aug 7 22:34:09 2026 +0200
systemd: Update to version 261.2
- Update from version 261.1 to 261.2
- No change in rootfile
- Changelog
261.2
https://github.com/systemd/systemd/compare/v261.1...v261.2
5 udev specific commits
16 commits that reference udev in some way
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit e8b349a18216085ef8c09e7c4bb1feef0f08dfaf
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Aug 7 22:33:55 2026 +0200
core205: Ship sqlite
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 4e6180f5abe6625afadd32748c3bc80cfb06e269
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Aug 7 22:34:08 2026 +0200
sqlite: Update to version 3530400
- Update from version 3530300 to 3530400
- Update of rootfile
- Changelog
3530400
Fixes for problems in 3.53.0 (and 3.53.1, 3.53.2, and 3.53.3) mostly coming
from AIs. See the check-in timeline for details.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 2751eebc46614315a87dc4a3247efd4fdbb0bdb0
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Aug 7 22:34:07 2026 +0200
samba: Update to version 4.24.5
- Update from version 4.24.2 to 4.24.5
- No change to the rootfiles
- 6 CVE Fixes in 4.24.5 & 6 in 4.24.3
- Changelog
4.24.5
This is a security release in order to address the following defects:
o CVE-2026-6949: TSIG packet with name compression can crash DNS
Incorrect size calculations when a TSIG record contains
compressed names can lead to a large out-of-bounds write
causing the server to crash.
https://www.samba.org/samba/security/CVE-2026-6949.html
o CVE-2026-58216: An authenticated user could possibly crash a KDC process
A kpasswd packet that contains malformed ASN.1 might cause
the server to access 6 bytes of unallocated memory. This
memory is not exposed to the user, but in some
circumstances the server could crash.
https://www.samba.org/samba/security/CVE-2026-58216.html
o CVE-2026-58218: DNS signing DoS via TKEY name cache exhaustion
An unauthenticated user can repeatedly register names TKEY
names, which floods a cache causing legitimate TKEYs to be
expunged. This can practically block the use DNS TSIG
signing.
https://www.samba.org/samba/security/CVE-2026-58218.html
o CVE-2026-58221: Samba AD authenticated LDAP access domain takeover
Samba AD low-privilege authenticated LDAP access allows
modifications to internal LDB special DNs, which permits a
domain takeover.
https://www.samba.org/samba/security/CVE-2026-58221.html
o CVE-2026-58222: Samba AD LDAP Compare filter injection and trusted-request
confusion disclose protected attributes
An ordinary authenticated domain user can bypass access
checks and query confidential Active Directory attributes
(such as KDS root keys) via LDAP Compare requests. Due to a
filter injection flaw and trusted execution context, the
LDAP Compare operation can be turned into a
protected-attribute disclosure oracle.
https://www.samba.org/samba/security/CVE-2026-58222.html
o CVE-2026-58224 The CTDB protocol has bounds checking issues
CTDB fails to do integrity checking of received packets.
This includes failure to check field lengths against packet
lengths when unmarshalling packets.
https://www.samba.org/samba/security/CVE-2026-58224.html
4.24.4
* BUG 16095: Use-after-free in handling acls with claims and conditions
* BUG 16092: Compilers may ignore overflow checks - Fix tautological-compare
warnings
* BUG 14638: restrict anonymous = 2 breaks RODC functionality
* BUG 16006: warning: assignment discards 'const' qualifier from pointer
target type [-Wdiscarded-qualifiers]
* BUG 16067: Require NTLMv2 session security on Windows makes trusts to Samba
unusable
* BUG 16092: Compilers may ignore overflow checks - Fix tautological-compare
warnings
* BUG 16151: winbindd stuck in init_dc_connection_rpc() returning
NT_STATUS_TRUSTED_DOMAIN_FAILURE
* BUG 16006: warning: assignment discards 'const' qualifier from pointer
target type [-Wdiscarded-qualifiers]
* BUG 16149: domain\user not split when provided as username in
smbc_set_credentials_with_fallback()
4.24.3
This is a security release in order to address the following defects:
o CVE-2026-1933: Missing access checks on reparse point operations
On a share marked "read only = yes" and
on file handles opened R/O users can set
or delete the reparse point xattrs on files
that the user has write-access in the file
system for.
https://www.samba.org/samba/security/CVE-2026-1933.html
o CVE-2026-2340: WORM vfs module does not block overwrites
The WORM (Write-Once, Read Many) vfs module
is supposed to lock write access to shared
files, so they cannot be altered after initial
writes. It was allowing files to be overwritten
by renaming a newly created file over a protected
file.
https://www.samba.org/samba/security/CVE-2026-2340.html
o CVE-2026-3012: auto-enrolment GPO installing CA certificate over http
without verification
To bootstrap a certificate chain a domain member must
fetch a certificate without TLS. It was trusting HTTP
for this when a more secure encrypted LDAP channel
was also available.
https://www.samba.org/samba/security/CVE-2026-3012.html
o CVE-2026-3238: Denial of service against AD DC WINS server
The WINS server component of the Active
Directory Domain controller code in Samba
is vulnerable to a NULL pointer dereference
and crash caused by a unauthenticated UDP
packet.
https://www.samba.org/samba/security/CVE-2026-3238.html
o CVE-2026-4408: Unauthenticated Remote Code Execution in Samba DCE/RPC SAMR
server
Samba file servers and classic (non-AD) domain controllers
with samba-dcerpcd started as a system service and with a
"check password script" that has the %u substitution
character are vulnerable to a remote code execution.
https://www.samba.org/samba/security/CVE-2026-4408.html
o CVE-2026-4480: Unauthenticated Remote Code Execution in Samba printing
subsystem
Samba print servers with a "print command"
that has the %J substitution character
are vulnerable to a Remote Code Execution.
https://www.samba.org/samba/security/CVE-2026-4480.html
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 5dc07fb29509b6509d91cb8f873ea4c1dd6860d6
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Aug 7 22:34:06 2026 +0200
postfix: Update to version 3.11.5
- Update from version 3.11.4 to 3.11.5
- No change in rootfile
- Changelog
3.11.5
Major changes - database
[Incompat 20260220] The alias_maps and alias_database parameter
default values have changed from hash:/path/to/aliases (or
dbm:/path/to/aliases) to $default_database_type:/path/to/aliases.
This simplifies the migration away from Berkeley DB.
[Infrastructure 20260219] Support to migrate a Postfix configuration
that uses Berkeley DB hash: or btree: tables, to a configuration
that uses lmdb: or a combination of cdb: and lmdb:. This is needed
for (Linux) OS distributions that have removed Berkeley DB support.
See NON_BERKELEYDB_README for manual and automatic migration support.
Postfix already supports CDB and LMDB for more than 10 years. It
may be a good idea to do the migration before you need to upgrade
to an OS distribution that no longer supports Berkeley DB.
[Infrastructure 20251226] Tooling to help with the migration away
from Berkeley DB.
The new parameter default_cache_db_type controls the default database
type for address_verify_map, postscreen_cache_map, and
smtp_sasl_auth_cache_name, previously hard-coded as 'btree'.
[Feature 20250321] Safety: the SQLite client now logs a warning
when a query uses double quotes instead of the Postfix-recommended
single quotes. Only the recommended form is protected against SQL
injection.
[Feature 20250509] Support to run all memcache lookup keys through
an OpenSSL digest function. This prevents a database access error
when lookup keys may exceed the memcache server's key length limit
(usually, 250 bytes).
[Feature 20250624] Support for a new "debug:" pseudo lookup table.
Specify debug:maptype:mapname to encapsulate a maptype:mapname
lookup table and log all access. This builds on existing but unused
code to log table access. Contributed by Richard Hansen.
[Infrastructure 20250626] Overhauled in-memory lookup table life-cycle
management; overhauled sharing/isolation for proxied lookup tables.
Major changes - deprecation
[Feature 20250609] smtp_tls_enforce_peername and lmtp_tls_enforce_peername
are now officially deprecated. Postfix will log a warning until the
features are deleted. See DEPRECATION_README for a summary of
deprecated and deleted features.
[Feature 20251027] This adds 12 more deprecation warnings for
parameters that have been renamed in the past, and that still provide
a backwards-compatible default value for their replacement. The
parameters deprecated by this change are: authorized_verp_clients,
fallback_relay, lmtp_per_record_deadline, postscreen_blacklist_action,
postscreen_dnsbl_ttl, postscreen_dnsbl_whitelist_threshold,
postscreen_whitelist_interfaces, smtpd_client_connection_limit_exceptions,
smtp_per_record_deadline, tlsproxy_client_level, tlsproxy_client_policy,
virtual_maps.
[Feature 20251028] Deprecate the smtp_cname_overrides_servername
and lmtp_cname_overrides_servername parameters, and delete documentation
that has been obsolete since Postfix 2.11.
Major changes - logging
[Feature 20250910] TLS feature policy status summary in delivery
status logging. This shows the desired and actual TLS security level
enforcement status and, if a message requests REQUIRETLS, the
REQUIRETLS policy enforcement status. For a list of examples see
https://www.postfix.org/postconf.5.html#smtp_log_tls_feature_status
[Feature 20251216] After a delivery failure, the bounce daemon
logged "<old-queue-id>: sender non-delivery notification: <new-queue-id>"
only if the notification was queued successfully. The bounce daemon
now always logs this, making Postfix behavior easier to understand.
Visible changes for logfile analyzers:
- The bounce daemon now logs "<old-queue-id>: sender non-delivery
notification: <new-queue-id>" BEFORE the cleanup daemon logs activity
with "<new-queue-id>". Previously, the bounce daemon logged the
old<=>new queue ID connection later, which made logfile analysis
more difficult.
- The bounce daemon now logs a logfile record "<old-queue-id>:
sender notification failed to <address>: <reason>" when the
notification was not queued. In some cases it will log "<old-queue-id>:
sender notification failed to <address>" (without the reason). In
those cases the failure reason was already logged by lower-level
code, but without the queue ID.
Major changes - management tool integration
[Feature 20251124] Basic JSON output support with "postconf
-j|-jM|-jF|-jP", "postalias -jq|-js", "postmap -jq|-js", and
"postmulti -jl". No support is planned for JSON input support.
Major changes - milter support
[Feature 20251208] Improved Milter error handling for messages that
arrive over a long-lived SMTP connection, by changing the default
milter_default_action from "tempfail" to the new "shutdown" action
(i.e. disconnect the remote SMTP client).
This avoids a worst-case scenario where after a single Milter error,
Postfix would tempfail all messages that the client sends over a
long-lived connection, even if the Milter error was only temporary.
Major changes - mime support
[Feature 20251104] New non_empty_end_of_header_action parameter
with the cleanup(8) server action when a primary message header is
terminated with a non-empty line:
1) fix_quietly: Insert an empty line before the offending text (the
backwards-compatible default),
2) add_header: Insert a MIME-Error: header before inserting an empty
line, or
3) reject: Log a "mime-error" and reject the message.
Note that the 'empty line' separator is not used for DKIM signature
checks. Therefore, adding a missing separator does not break DKIM.
Major changes - mta-sts
[Feature 20250906] Workaround for an interface mis-match between
the Postfix SMTP client and MTA-STS policy plugins. This introduces
a new parameter "smtp_tls_enforce_sts_mx_patterns" (default: "yes").
The MTA-STS plugin configuration needs to enable TLSRPT support,
so that it forwards STS policy attributes to Postfix. This works
even if Postfix TLSRPT support is disabled at build time or at
runtime.
With the above two configurations, the Postfix SMTP client will
connect to an MX host only if its name matches any STS policy MX
host pattern, and will match a server certificate against the MX
hostname. Otherwise, the old behavior stays in effect: connect to
any MX host listed in DNS, and match a server certificate against
any STS policy MX host pattern.
This code was published first in Postfix 3.11, and later back-ported
to Postfix 3.10.5.
Major changes - portability
[Feature 20241201] Support for the C23 built-in bool type. Older
Postfix releases have been updated with a makedefs script that
disables C23 built-in bool support.
Major changes - postqueue
[Feature 20251218] the postqueue (and mailq) command now also lists
recipients in bounce logfiles (in JSON output, this uses a new
object member 'bounce_reason' instead of the existing 'delay_reason').
Such recipients have already been deleted from the message queue
file, but they are still pending the creation of a non-delivery
status notification message that will be returned to the sender.
Major changes - relocated_maps
[Feature 20250608] Specify "relocated_prefix_enable = no" to disable
the hard-coded prefix "5.1.6 User has moved to " that is by default
prepended to all relocated_maps lookup results. This setting requires
that the table contains responses with both custom enhanced status
code (X.Y.Z) and text. For details, see "man 5 relocated" or
https://www.postfix.org/relocated.5.html .
Major changes - requiretls
[Feature 20241111] Support for the REQUIRETLS verb in SMTP. This,
and everything that was added later through 2025, is described in
REQUIRETLS_README.
[Feature 20250120] After a certificate check fails, or a remote
SMTP server does not announce REQUIRETLS support, the Postfix SMTP
client will override the RFC 8689 5.x.x. status and treat it as a
soft error, until there are no more alternate MX servers to try.
[Feature 20250827] New parameter requiretls_redact_dsn (default:
yes) to redact bounce messages as described in RFC 8689 section 5,
so that they don't need REQUIRETLS support on every hop in the
return path.
[Feature 20250827] smtp_requiretls_policy and lmtp_requiretls_policy
for responsible REQUIRETLS policy enforcement. REQUIRETLS must be
enforced with care, because at this time most domains do not publish
DANE or MTA-STS policies, and most MTAs and content filters do not
support REQUIRETLS.
[Feature 20250916] support for a "Require-TLS-ESMTP: yes" header
to propagate an ESMTP REQUIRETLS request through a FILTER_README
or SMTPD_PROXY_README style content filter. This header is detected
or added by the cleanup daemon and by the before-proxy-filter Postfix
SMTP server. This feature is enabled by default with
"requiretls_esmtp_header = yes". The Require-TLS-ESMTP header will
be visible to local and remote recipients. This feature can safely
be disabled when a configuration does not use REQUIRETLS, or does
not use FILTER_README or SMTPD_PROXY_README style content filters.
Major changes - smtp server
[Feature 20250801] smtpd_reject_filter_maps support to selectively
replace a reject response from the Postfix SMTP server, or from a
program that replies through the Postfix SMTP server.
Major changes - smtputf8
[Feature 20250122] New Postfix sendmail command option "-O smtputf8"
to request that deliveries over SMTP use the SMTPUTF8 extension.
This reuses logic that was introduced for REQUIRETLS.
[Feature 20250824] When a message needs to be delivered with SMTPUTF8,
but a remote server does not support it, the Postfix SMTP client
may now try alternate servers instead of returning the message
immediately. This reuses code that was implemented for REQUIRETLS.
Major changes - tls support
[Feature 20250623] This changes the Postfix SMTP client
smtp_tls_security_level default value to "may" if Postfix was built
with TLS support, and the compatibility_level is 3.11 or higher.
There is no change to the default lmtp_tls_security_level value.
It remains empty, because there is no default TLS security level
that makes sense for connections over UNIX-domain and loopback TCP
and non-loopback TCP sockets.
There also is no equivalent change for Postfix SMTP server TLS
security levels, because changing smtpd_tls_security_level is not
sufficient. Server-side TLS requires that at least one private key
and corresponding public-key certificate chain are configured.
[Feature 20251029] Debugging: depending on OpenSSL build options,
"posttls-finger -L ssl-debug" will decode TLS handshake messages.
[Feature 20251102] Post-quantum cryptography support: with OpenSSL
3.5 and later, change the tls_eecdh_auto_curves default value to
avoid problems with network infrastructure that mis-handles TLS
hello messages larger than one (Ethernet) TCP segment. This problem
is more generally known as "protocol ossification".
Major changes - tlsrpt
[Incompat 20250601] the default smtp_tlsrpt_skip_reused_handshakes
setting was changed from "yes" to "no". The new default is enabled
with compatibility level >= 3.11.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 3d084985cd6ce8359f760cc920ba545a0c2839de
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Aug 7 22:33:54 2026 +0200
core205: Ship pango
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 22d60f68d39c1e214511e08a1af980b62cc8222d
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Aug 7 22:34:05 2026 +0200
pango: Update to version 1.58.2
- Update from version 1.58.0 to 1.58.2
- Update of rootfile
- Changelog
1.58.2
* No changes
1.58.1
* Require harfbuzz 11
* Require glib 2.88
* CoreText: Support variations
* CoreText: Support font features from descriptions
* Renderer: Keep over/under/through lines in sync
* Fixes for undefined behavior
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 3f2ad2ac3801c35d2f2a0389092d727092086b5d
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Aug 7 22:34:04 2026 +0200
nut: Ship nut to pickup updated libusb from CU203
- In CU203 libusb was updated but nut was not shipped so for core updates it has stayed
looking for libusb-1.0.so.0.5.0 but it should be looking for libusb-1.0.so.0.6.0
- This patch is intended to be merged into CU204 to bring existing nut installations
up to date.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 9d6bbad2f620d3058a16e58de8c1cef75bd410f7
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Aug 7 22:34:03 2026 +0200
nfs: Update to version 2.9.2
- Update from version 2.9.1 to 2.9.2
- No change in rootfile
- Changelog is just a list of the commits. The details can be found in the changelog at
2.9.2
https://sourceforge.net/projects/nfs/files/nfs-utils/2.9.2/
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit b6143f8c1065a54e850c140aad73b1062439ec05
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Aug 7 22:34:02 2026 +0200
libtalloc: Update to version 2.5.0
- Update from version 2.4.4 to 2.5.0
- Update of rootfile
- The last changelog recorded in the sourcde tarball is from 2007. The only place I
have found anything is by filtering the samba gitlab mirror to show the commits
related to talloc.
17 CVE fixes in the commits for 2.5.0
https://gitlab.com/samba-team/samba/-/commits/talloc-2.5.0?ref_type=tags
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 403a7f9c8c6b05c9369568d8f79da9ddb20ba059
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Aug 7 22:33:53 2026 +0200
core205: Ship libarchive
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 9839fb681b1434fd8ac22921984d3474eb07f106
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Aug 7 22:34:01 2026 +0200
libarchive: Update to version 3.8.9
- Update from version 3.8.8 to 3.8.9
- Update of rootfile
- Changelog
3.8.9
There is no changelog. Changes are the individual commits between 3.8.8 and 3.8.9
https://github.com/libarchive/libarchive/compare/v3.8.8...v3.8.9
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 53d845d812ab3f43c3ff5f3705acdced9d001e44
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Aug 7 22:33:52 2026 +0200
core205: Ship hwdata
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 53ff7d74e65c376468e6b03d8792668568c6e997
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Aug 7 22:34:00 2026 +0200
hwdata: Update to version 0.410
- Update from version 0.409 to 0.410
- No change to rootfile
- Changelog
0.410
Update usb and vendor ids
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 8de1a761474d750ad638a13bd8db9519f63cabd4
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Aug 7 22:33:51 2026 +0200
core205: Ship harfbuzz
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 699e136a59202d58714226749d7c8528826a744e
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Aug 7 22:33:59 2026 +0200
harfbuzz: Update to version 14.3.0
- Update from version 14.2.1 to 14.3.0
- Update of rootfile
- Changelog
14.3.0
- Changes affecting shaping output:
* Lookup order is now respected for mark positioning in the cross-direction
(y in horizontal text, x in vertical text): marks no longer follow a
cross-direction shift that a later lookup applies to the base. This
improves compatibility with DirectWrite and Core Text.
* Fix mark attachment to ligatures formed from decomposed glyphs.
* The `calt` feature in Hangul text is now disabled only for the Jamos,
not the whole buffer.
- Support for partially instancing version of `avar` table, as well as `CFF2`
table.
- New fill-glyph paint operation and APIs for the common case of filling a
glyph with a solid color.
- New API to fetch assorted raw values from the `OS/2`, `head`, and `post`
tables.
- New experimental API to extract a font’s glyph dependency graph, that
applications can use to compute glyph closures themselves without running the
subsetter.
- New subset flag to convert the charset of a subsetted CID-keyed `CFF` fonts
into identity charset, and a matching `hb-subset` option. Useful for
embedding fonts in PDF.
- Command-line utilities now handle non-ASCII arguments correctly on Windows.
- Various instancing and subsetting fixes.
- Various fixes to the experimental `harfbuzz-vector`, `harfbuzz-raster` and
`harfbuzz-gpu` libraries.
- Various improvements to the HarfRust integration shaper.
- Various build, CI, portability, and fuzzing fixes.
- New API:
* OpenType:
+HB_OT_BITS_TAG_FS_TYPE
+HB_OT_BITS_TAG_FS_SELECTION
+HB_OT_BITS_TAG_MAC_STYLE
+HB_OT_BITS_TAG_IS_FIXED_PITCH
+HB_OT_BITS_TAG_UNICODE_RANGE_1
+HB_OT_BITS_TAG_UNICODE_RANGE_2
+HB_OT_BITS_TAG_UNICODE_RANGE_3
+HB_OT_BITS_TAG_UNICODE_RANGE_4
+HB_OT_BITS_TAG_CODE_PAGE_RANGE_1
+HB_OT_BITS_TAG_CODE_PAGE_RANGE_2
+HB_OT_NUMBER_TAG_FONT_X_MIN
+HB_OT_NUMBER_TAG_FONT_Y_MIN
+HB_OT_NUMBER_TAG_FONT_X_MAX
+HB_OT_NUMBER_TAG_FONT_Y_MAX
+hb_ot_bits_tag_t
+hb_ot_fetch_bits()
+hb_ot_number_tag_t
+hb_ot_fetch_number()
* Paint:
+hb_paint_fill_glyph_func_t
+hb_paint_fill_glyph()
+hb_paint_funcs_set_fill_glyph_func()
* Subset library:
+HB_SUBSET_FLAGS_CFF_IDENTITY_CHARSET
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 025d72134b6d74e99833699728e52f2ea1ace3f7
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Aug 7 22:33:50 2026 +0200
core205: Ship glib
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 835758bf4fc3488831cd3db396e69c76a9c5f97d
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri Aug 7 22:33:58 2026 +0200
glib: Update to version 2.89.3
- Update from version 2.88.2 to 2.89.3
- Update of rootfile
- Changelog
2.89.3
Support systemd-style UAPI file masking and drop-ins for GKeyFile (#3622 (closed),
work by Stefan Schubert)
Add some string and date convenience API, g_string_free_deep() and
g_set_date_time() (!4919 (merged), !5193 (merged), work by Peter Eisenmann)
Add some convenience API to GUnixFDList (!5233 (merged), work by Sebastian Wick)
Bugs fixed:
#3622 (closed) Support UAPI file masking and drop-ins in GKeyFile
#3994 (closed) gio/tests: iptosmessage does not compile on Solaris
#3999 (closed) fd leak in g_file_set_contents_full() on error? (Kondor Dániel)
#4007 (closed) gio-tool: crash (assertion failed) when running 'gio help help'
(Jose Carlos Leiva)
!4919 (merged) Add g_string_free_deep
!5193 (merged) datetime: Add g_set_date_time
!5230 (merged) giostream: Clarify is_closed() method docs for streams
!5233 (merged) gunixfdlist: Add g_unix_fd_list_append_take, g_unix_fd_list_peek,
g_unix_fd_list_lookup, g_unix_fd_list_lookup_peek
!5246 (merged) gtestutils: Fix a minor typo in a documentation comment
!5248 (merged) tests: Minor compiler warning fixes for GCC16
!5249 (merged) build: Fix a deprecation warning from Meson 1.12
!5251 (merged) docs: Use dedicated docblocks for new enum members
!5252 (merged) docs: Annotate callbacks rather than user_data
!5254 (merged) Add finer accuracy g_timeout APIs
!5255 (merged) gdbusnameowning: Don't print any logs when connection is closed
!5257 (merged) Avoid reserved identifiers in public macros
2.89.2
Fix potential miscompilation with GCC 17 with G_GNUC_CONST on get_type()
functions (#3984 (closed), work by Sam James)
Update toolchain requirement to C11; previously this was just strongly
recommended (!3574 (merged), work by Emmanuele Bassi)
Bugs fixed:
#2931 (closed) GMemoryMonitor should have a backend for systemd
MEMORY_PRESSURE_WATCH API (Kate Hsuan)
#3719 (closed) gspawn-win32-helper-console.exe fails on Windows with UNC path
(Andrew Ziem)
#3984 (closed) G_GNUC_CONST vs get_type comes home to roost (Sam James)
#3985 (closed) Security report: GDBusServer pre-authentication DoS via
unbounded SASL line buffering (Philip Withnall)
#3986 (closed) GDBusActionGroupClass failure (Philip Withnall)
!3574 (merged) Update toolchain requirement to C11
!5222 (merged) GNetworkMonitor: Stop pulling route table on sd-networkd hosts
!5224 (merged) gquark: Fix an incorrect G_GNUC_CONST annotation on
g_quark_to_string()
!5226 (merged) fuzzing: Skip build if oss-fuzz and tests are both omitted
!5232 (merged) gnetworkmonitornetlink: Performance improvements by following
iproute2 behavior
!5234 (merged) gmain: fix poll.h include order on AIX
!5235 (merged) tests: Fix gi-inspect-typelib.py on Visual Studio
!5236 (merged) gio/tests: skip unsupported IP TOS tests on AIX
!5237 (merged) gdbus-serialization.c: Avoid g_autofree
!5238 (merged) gpoll: Correctly zero-out heap-allocated fd_sets on macOS
!5244 (merged) Update Romanian translation
!5245 (merged) Update Slovenian translation
!5247 (merged) gdbusnameowning: Downgrade ReleaseName warning on closed
connection to debug
Translation updates:
Romanian (Antonio Marin)
Slovenian (Martin)
2.89.1
Bugs fixed:
#3972 (closed) g_thread_yield() may not yield control to another thread as expected
on Linux.
!5086 (merged) gio: gmemorymonitordbus: Fix fallback backends can't be properly
loaded when...
!5184 (merged) gregex: Remove "array length" annotations
!5190 (merged) win32-build.md: Update Visual Studio build info
!5191 (merged) Don't use slow content type for icons when only fast content is
queried
!5192 (merged) Update Romanian translation
!5195 (merged) Update Slovenian translation
!5196 (merged) Performance improvements to GVariant/GDBusMessage
!5197 (merged) docs: fix wrong reference to gint16 for gint32 types in
glib/types.md
!5198 (merged) Add missing finish-func annotations
!5199 (merged) gregex: g_match_info_fetch_pos() and g_match_info_fetch_all()
will now work after partial matches as well
!5200 (merged) gdatetime: Clarify docs around comparisons across time zones
!5201 (merged) docs: GI annotation fixes for GCancellable
!5202 (merged) Update Slovenian translation
!5205 (merged) tests: Fix various leaks spotted by ASAN
!5206 (merged) docs + tests: fix docs and add unit test about g_try_new with
zero n_structs
!5207 (merged) Update Romanian translation
!5209 (merged) CI: Set msys2-clang64 as default job for merges
!5210 (merged) docs: add missing reference to g_rc_box_new0 and
g_atomic_rc_box_new0 and others in Reference Counting page
!5211 (merged) gutf8: Eliminate redundant double-traversal in g_utf8_substring
!5213 (merged) gsocket: Improve docs for g_socket_get_fd()
!5214 (merged) gerror: Add missing introspection annotations
!5216 (merged) Use dlopen to access environ on FreeBSD
!5218 (merged) gvariant: Check for overflow in g_variant_new_fixed_array()
!5221 (merged) meson: Override girepository-2.0 when glib is used as subproject
Translation updates:
Romanian (Antonio Marin)
Slovenian (Martin)
2.89.0
Fix miscompilation with GCC 16 due to GLib’s use of the wrong function attribute
(!5145 (merged), work by Sam James)
Integrate better with the System Trash on macOS (#1161 (closed), work by Byoungchan Lee)
Add g_set_strv(), g_set_strv_take() and g_set_str_take() convenience functions (#3907
(closed), !5118 (merged), work by Christian Hergert and Philip Withnall)
Fix flag confusion security issue when using GRegex with G_REGEX_RAW which can result
in unbounded out-of-bounds heap reads off the start of a regex input string
(#3919 (closed), work by linhlhq)
Fix various minor (low severity) security issues, typically one-to-five-byte
out-of-bounds reads (#3915 (closed), #3916 (closed), #3917 (closed), #3918
(closed), #3930 (closed)) or ones relying on very specific (and unlikely) API
calls (#3925 (closed)) or ones relying on discouraged P2P D-Bus
configurations (#3931 (closed), #3933 (closed)) (work by linhlhq)
Add support for GTypeInstance-derived types in generic marshaller (#3954 (closed),
work by Christian Hergert)
Change g_get_num_processors() to report number of performance cores, rather than
number of performance+low-power cores on macOS (!5153 (merged), work by John
Cupitt)
Add support for XDG_PROJECTS_DIR special directory (!5141 (merged), work by Emmanuele
Bassi and Jakub Steiner)
Bugs fixed:
1161 (closed) g_file_trash() Files not moved to System Trash on Mac OSX
1853 (closed) DBus activated GApplications and G_APPLICATION_HANDLES_OPEN (Guido
Günther)
2173 (closed) g_ascii_strtod() spec doesn't match C99/C11 standard for underflow
behavior (depuc8)
3069 (closed) gio/trash test fails on macOS
3791 (closed) g_error causes -Wanalyzer-infinite-loop warnings in downstream code
(correctmost)
3854 (closed) GRegex uses int for string length (Philip Withnall)
3907 (closed) Add g_set_strv() helper similar to g_set_str() (Christian Hergert)
3911 (closed) GMarkup chokes on BOM
3915 (closed) (#YWH-PGM9867-190) Buffer Over-read on GLib through glib/gvariant-
serialiser.c:1253 via gvs_tuple_is_normal() (Philip Withnall)
3916 (closed) (#YWH-PGM9867-187) OOB Read on GLib through
glib/gmarkup.c:g_markup_escape_text() via
glib/gmarkup.c:append_escaped_text() (Philip Withnall)
3917 (closed) (#YWH-PGM9867-191) OOB Read on GLib through
glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime
(Philip Withnall)
3918 (closed) (#YWH-PGM9867-193) Buffer Over-read on GLib's g_regex_replace()
through glib/gregex.c:string_append() via g_utf8_next_char()
(Philip Withnall)
3919 (closed) (#YWH-PGM9867-194) Buffer Over-read on GLib through
glib/gregex.c:g_regex_split_full() via
glib/gutf8.c:g_utf8_prev_char() (Philip Withnall)
3925 (closed) (#YWH-PGM9867-199) Buffer Over-read on GLib through
glib/giochannel.c via "g_io_channel_read_line_backend" (Philip
Withnall)
3930 (closed) (#YWH-PGM9867-200) Off-by-one Error on GLib through glib/gkeyfile.c
via "g_key_file_get_locale_string_list" (Philip Withnall)
3931 (closed) (#YWH-PGM9867-203) Path Traversal on GLib DBus through
glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry,
mechanism_client_data_receive (COOKIE_SHA1 Client
Authentication) leads to Arbitrary File Read (Philip Withnall)
3932 (closed) (#YWH-PGM9867-204) Integer Underflow (CWE-191) on GLib through
gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"
(Philip Withnall)
3933 (closed) Integer overflow in g_dbus_message_bytes_needed() bypasses 128 MiB
size check (pre-auth DoS on P2P connections) (Philip Withnall)
3954 (closed) Generic marshaller lacks support for GTypeInstance derived types
(Christian Hergert)
3958 (closed) FTBFS for vs2019-arm64 in libcharset due to undefined _CountOneBits64
!4990 (merged) gdbusauthmechanismsha1: Ignore G_DBUS_COOKIE_SHA1_KEYRING_DIR when
suid
!5094 (merged) gtestdbus: Keep config file around until bus daemon exits
!5099 (merged) liststore: Micro-optimize no-op bulk operations
!5101 (merged) Update Serbian translation
!5102 (merged) g_base64_decode_step: fix documented type of in
!5103 (merged) gdbusmessage: Documentation improvements
!5105 (merged) docs: Expand docs for GLIB_VERSION_MAX_ALLOWED
!5106 (merged) gmarkup: Add api to get attribute locations
!5107 (merged) gmessages: Remove incorrect callback annotations
!5110 (merged) gmarkup: fix type of length parameter of text_validate()
!5111 (merged) Update Russian translation
!5112 (merged) docs: Clarify default/user signal handlers
!5113 (merged) Update Polish translation
!5114 (merged) docs: Remove myself from CODEOWNERS
!5115 (merged) build: Post-release version bump
!5116 (merged) Update Slovenian translation
!5117 (merged) fuzzing: Add a fuzz test for g_markup_escape_text()
!5118 (merged) gstrfuncs: Add g_set_str_take() helper function
!5119 (merged) tests: Check that g_markup_escape_text() returns something parseable
!5120 (merged) Update Chinese (China) translation
!5121 (merged) gio: Apply property accessor annotations to GDBus types
!5123 (merged) Update Romanian translation
!5124 (merged) gvariant: Tweak GVariantIter heap allocation casting
!5125 (merged) gregex: Fix some missing Markdown formatting in docs
!5126 (merged) Add missing annotations
!5127 (merged) libffi: don't build testsuite when building as subproject
!5128 (merged) gmarkup: Swap the argument order for g_realloc_n()
!5136 (merged) docs: Clarify UTF-8 validity for functions which accept a length
!5138 (merged) Update Slovenian translation
!5140 (merged) Update Romanian translation
!5141 (merged) Support XDG_PROJECTS_DIR
!5142 (merged) gsocketconnection: Fix annotations for get_socket()
!5145 (merged) gvarianttype: use pure attribute, not inappropriate const
!5146 (merged) gmessages: Add missing stdlib.h include for abort()
!5148 (merged) registrysettingsbackend: Chain up vfuncs
!5149 (merged) gtype: Improve G_DEFINE and G_DECLARE docs
!5153 (merged) g_get_num_processors(): on macOS, report n_pcore
!5155 (merged) Update German translation
!5157 (merged) Update Dutch translation
!5158 (merged) gsocket: Fix g_socket_new_from_fd() on unbound sockets on windows
!5159 (merged) gvariant: Tweak GVariantIter heap allocation size
!5161 (merged) [docs] Gio.MenuModel: Fix bulleted list
!5162 (merged) gvariant: Match allocation size of g_slice_new to g_slice_free
!5163 (merged) gvariant test: Fix a leak
!5164 (merged) tests: Avoid undefined signed left-shift in bitlock test
!5167 (merged) docs: Add docs for G_GNUC_FLAG_ENUM
!5176 (merged) gnulib: Fix unused flags variable warning
!5177 (merged) gio/tests/pollable.c: Fix test on FreeBSD
!5180 (merged) meson: Add valgrind suppression file to VALGRIND_OPTS in devenv
!5182 (merged) Meson: Don't hardcode FFI_STATIC_BUILD / G_INTL_STATIC_COMPILATION
!5183 (merged) gio/tests/pollable.c: Conditionalize on FreeBSD version in the
/dev/null test case
!5185 (merged) gio/gdesktopappinfo: Add precondition assertions
!5187 (merged) Add safety documentation regarding use of g_shell_quote()
!5188 (merged) Improve performance of g_array_maybe_expand()
Translation updates:
Chinese (China) (luming zh)
Dutch (Nathan Follens)
German (Christian Kirbach)
Polish (Victoria Niedzielska)
Romanian (Antonio Marin)
Russian (Artur S0)
Serbian (Марко Костић)
Slovenian (Martin)
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 8bc513e1cd04019ca67ff495105b0c2c3ce4ee68
Author: Matthias Fischer <matthias.fischer@ipfire.org>
Date: Fri Aug 7 11:47:14 2026 +0200
boost: Update rootfile for x64_86
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit cae2012285d39e45e05049d9df7e51c10212e9eb
Author: Matthias Fischer <matthias.fischer@ipfire.org>
Date: Fri Aug 7 11:45:18 2026 +0200
attr 2.6.0: Fix for rootfile
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 9b09332d370de83d949b1ecaaaa4e6360f5c17c4
Author: Michael Tremer <michael.tremer@ipfire.org>
Date: Sat Aug 8 16:37:44 2026 +0000
core205: Ship dhcpcd
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 9019d363927f58ffddbff64e9e6ce4dfb68331e7
Author: Matthias Fischer <matthias.fischer@ipfire.org>
Date: Fri Aug 7 11:43:18 2026 +0200
dhcpcd: Update to 10.5.0
For details see:
https://github.com/NetworkConfiguration/dhcpcd/releases/tag/v10.5.0
"What's Changed
Add missing SPDX-License tags by @ColinMcInnes in #591
Format code with clang-format v19 by @rsmarples in #601
privsep: Change IPC to use SOCK_STREAM by @rsmarples in #604
BPF: Split OS specific code out into own files and add libpcap support by @rsmarples in #607
hooks: Escape interface names and use printf by @rsmarples in #610
Delete DHCPv6 IA FD from the loop before closing it by @rsmarples in #611
eloop: Use kqueue or epoll to wait for a fd to become ready by @rsmarples in #612
Darwin: Add initial support for macOS by @rsmarples in #613
Import latest pidfile from NetBSD by @rsmarples in #618
BPF: Improve headers by @rsmarples in #619
compat: Add support for getprogname(3) by @rsmarples in #620
route: Rework rt structure so sockaddrs are pointers by @rsmarples in #621
dhcp-common: Escape ifname for lease file by @rsmarples in #622
privsep: smaller buffer size without INET6 by @rsmarples in #623
script: add ifxname as the escaped string by @rsmarples in #624
time.h always pulls in struct timespec by @rsmarples in #625
route: Use HAVE_RT_MISSFILTER rather than a generic BSD define by @rsmarples in #626
privsep: Test defines for all ioctls by @rsmarples in #627
if: if_init inits the interface from the kernel by @rsmarples in #628
privsep: Add ps_root_gethostname by @rsmarples in #630
DHCP: Don't really expire the lease when testing by @rsmarples in #631
DHCP: Don't add a trailing : on vendor if no machine arch by @rsmarples in #633
privsep: guard setproctitle and only use compat on linux by @rsmarples in #634
options: Remove some const to fix compile warnings by @rsmarples in #635
privsep: Don't open PF_INET socket for each ioctl by @rsmarples in #640
sun: Enable building for privsep by @rsmarples in #639
script: Use correct buffer length variable by @craciunoiuc in #641
privsep: Remove PS_BUFLEN by @rsmarples in #642
privsep: Simplify readerror by @rsmarples in #643
timezone: disallow directory traversal by @rsmarples in #644
privsep: ps_root_readfile should return the real file size by @rsmarples in #645
linux: Ensure NLA data boundaries are valid by @rsmarples in #646
options: Fix userclass boundary by @rsmarples in #647
ND6: fix OOB reject mask for an undefined option. by @rsmarples in #648
DHCP6: Ensure IA_PD Prefix Lenth is valid by @rsmarples in #649
ND: Enforce require and reject policy by @rsmarples in #650
ARP: check we have enough to read the frame header by @rsmarples in #651
hooks: Quote assignment of compat vars correctly by @rsmarples in #652
udev: Ensure we have a subsystem, action and ifname by @rsmarples in #653
Fix CI build by @rsmarples in #654
DHCP: Santize messages from servers for output by @rsmarples in #655
ARP: Iterate over states safely as the cb could remove ours by @rsmarples in #656
privsep: Check data is terminated when a string by @rsmarples in #657
auth: clear keys with memset_explicit by @rsmarples in #658
auth: Ensure remaining dlen matches hash digest length by @rsmarples in #659
hooks: don't read past truncated ip6 address starting fe by @rsmarples in #660
ipv6: Only regen temp addrs with sufficent pltime by @rsmarples in #661
eloop: Improve timespecdiff by @rsmarples in #662
eloop: Fix compile warning where UTIME_MAX is a calculation by @rsmarples in #663
vsio: Allow zero length options by @rsmarples in #664
DHCP6: Fix configuring the suffix to delegated prefixes by @rsmarples in #665
IPv6: Fix numerous issues extending temporary address times by @rsmarples in #666
capsicum: Avoid some overflow issues in privsep sysctl by @rsmarples in #667
script: Fix buffer over and under flows in script_buftoenv by @rsmarples in #668
control: Avoid hangup in the recvdata path by @rsmarples in #669
IPv6ND: Free routeinfo when it expires by @rsmarples in #670
DHCPv6: Prefix exclude option can be 17 octets by @rsmarples in #671
DHCPv6: When deprecating addresses, restart on prefix deletions by @rsmarples in #672
IPv4: uset old_ia when adding an address causes early removal by @rsmarples in #673
dhcp: add configurable backoff parameters for DHCPv4 by @cjp256 in #593
options: Introdce policy groups by @rsmarples in #678
Build all the targets on macos by @rsmarples in #679
control: remove unprivileged socket by @rsmarples in #680
DHCP: deconfigure even when state is NULL or NONE by @rsmarples in #687"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 4e71436cf0bef562517b69174ecbeef7d9e30766
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Thu Aug 6 11:26:45 2026 +0200
perl: Update rootfile
- The rootfile had Getopt/Long/Parser.pm commented out. A forum user tried the Testing
branch already and found a message in the logs that was looking for that perl file
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
-----------------------------------------------------------------------
Summary of changes:
config/rootfiles/common/attr | 1 +
config/rootfiles/common/glib | 16 +-
config/rootfiles/common/harfbuzz | 16 +-
config/rootfiles/common/libarchive | 2 +-
config/rootfiles/common/pango | 6 +-
config/rootfiles/common/perl | 2 +-
config/rootfiles/common/rrdtool | 202 ++++++++++-----------
config/rootfiles/common/shadow | 7 +-
config/rootfiles/common/sqlite | 2 +-
config/rootfiles/common/x86_64/boost | 18 ++
.../{oldcore/125 => core/205}/filelists/dhcpcd | 0
.../{oldcore/118 => core/205}/filelists/glib | 0
.../{oldcore/163 => core/205}/filelists/harfbuzz | 0
.../{oldcore/132 => core/205}/filelists/hwdata | 0
.../{oldcore/104 => core/205}/filelists/libarchive | 0
.../{oldcore/163 => core/205}/filelists/pango | 0
.../{oldcore/111 => core/205}/filelists/rrdtool | 0
.../{oldcore/104 => core/205}/filelists/shadow | 0
.../{oldcore/125 => core/205}/filelists/sqlite | 0
.../{oldcore/199 => core/205}/filelists/systemd | 0
.../{oldcore/125 => core/205}/filelists/xfsprogs | 0
config/rootfiles/packages/clamav | 2 +-
config/rootfiles/packages/frr | 3 +
config/rootfiles/packages/libtalloc | 2 +-
lfs/clamav | 6 +-
lfs/dhcpcd | 6 +-
lfs/dnsdist | 25 ++-
lfs/fort-validator | 8 +-
lfs/frr | 6 +-
lfs/glib | 4 +-
lfs/haproxy | 8 +-
lfs/harfbuzz | 4 +-
lfs/hwdata | 4 +-
lfs/libarchive | 4 +-
lfs/libtalloc | 6 +-
lfs/nfs | 6 +-
lfs/nut | 2 +-
lfs/pango | 4 +-
lfs/postfix | 6 +-
lfs/rrdtool | 4 +-
lfs/samba | 6 +-
lfs/shadow | 10 +-
lfs/sqlite | 4 +-
lfs/systemd | 4 +-
lfs/tcpdump | 8 +-
lfs/xfsprogs | 4 +-
.../shadow-4.20.0_Add_stdint.h_for_uintmax_t.patch | 22 +++
47 files changed, 242 insertions(+), 198 deletions(-)
copy config/rootfiles/{oldcore/125 => core/205}/filelists/dhcpcd (100%)
copy config/rootfiles/{oldcore/118 => core/205}/filelists/glib (100%)
copy config/rootfiles/{oldcore/163 => core/205}/filelists/harfbuzz (100%)
copy config/rootfiles/{oldcore/132 => core/205}/filelists/hwdata (100%)
copy config/rootfiles/{oldcore/104 => core/205}/filelists/libarchive (100%)
copy config/rootfiles/{oldcore/163 => core/205}/filelists/pango (100%)
copy config/rootfiles/{oldcore/111 => core/205}/filelists/rrdtool (100%)
copy config/rootfiles/{oldcore/104 => core/205}/filelists/shadow (100%)
copy config/rootfiles/{oldcore/125 => core/205}/filelists/sqlite (100%)
copy config/rootfiles/{oldcore/199 => core/205}/filelists/systemd (100%)
copy config/rootfiles/{oldcore/125 => core/205}/filelists/xfsprogs (100%)
create mode 100644 src/patches/shadow-4.20.0_Add_stdint.h_for_uintmax_t.patch
Difference in files:
diff --git a/config/rootfiles/common/attr b/config/rootfiles/common/attr
index 4307e1dd0..41a92d4a7 100644
--- a/config/rootfiles/common/attr
+++ b/config/rootfiles/common/attr
@@ -1,6 +1,7 @@
usr/bin/attr
usr/bin/getfattr
usr/bin/setfattr
+#usr/etc
#usr/etc/xattr.conf
#usr/include/attr
#usr/include/attr/attributes.h
diff --git a/config/rootfiles/common/glib b/config/rootfiles/common/glib
index fd92e25ff..8e76bdc60 100644
--- a/config/rootfiles/common/glib
+++ b/config/rootfiles/common/glib
@@ -339,22 +339,22 @@ usr/include/glib-2.0/gio/gdebugcontroller.h
#usr/lib/glib-2.0/include/glibconfig.h
#usr/lib/libgio-2.0.so
usr/lib/libgio-2.0.so.0
-usr/lib/libgio-2.0.so.0.8800.2
+usr/lib/libgio-2.0.so.0.8903.0
#usr/lib/libgirepository-2.0.so
usr/lib/libgirepository-2.0.so.0
-usr/lib/libgirepository-2.0.so.0.8800.2
+usr/lib/libgirepository-2.0.so.0.8903.0
#usr/lib/libglib-2.0.so
usr/lib/libglib-2.0.so.0
-usr/lib/libglib-2.0.so.0.8800.2
+usr/lib/libglib-2.0.so.0.8903.0
#usr/lib/libgmodule-2.0.so
usr/lib/libgmodule-2.0.so.0
-usr/lib/libgmodule-2.0.so.0.8800.2
+usr/lib/libgmodule-2.0.so.0.8903.0
#usr/lib/libgobject-2.0.so
usr/lib/libgobject-2.0.so.0
-usr/lib/libgobject-2.0.so.0.8800.2
+usr/lib/libgobject-2.0.so.0.8903.0
#usr/lib/libgthread-2.0.so
usr/lib/libgthread-2.0.so.0
-usr/lib/libgthread-2.0.so.0.8800.2
+usr/lib/libgthread-2.0.so.0.8903.0
#usr/lib/pkgconfig/gio-2.0.pc
#usr/lib/pkgconfig/gio-unix-2.0.pc
#usr/lib/pkgconfig/girepository-2.0.pc
@@ -377,8 +377,8 @@ usr/lib/libgthread-2.0.so.0.8800.2
#usr/share/gdb/auto-load
#usr/share/gdb/auto-load/usr
#usr/share/gdb/auto-load/usr/lib
-#usr/share/gdb/auto-load/usr/lib/libglib-2.0.so.0.8800.2-gdb.py
-#usr/share/gdb/auto-load/usr/lib/libgobject-2.0.so.0.8800.2-gdb.py
+#usr/share/gdb/auto-load/usr/lib/libglib-2.0.so.0.8903.0-gdb.py
+#usr/share/gdb/auto-load/usr/lib/libgobject-2.0.so.0.8903.0-gdb.py
#usr/share/gettext/its
#usr/share/gettext/its/gschema.its
#usr/share/gettext/its/gschema.loc
diff --git a/config/rootfiles/common/harfbuzz b/config/rootfiles/common/harfbuzz
index 2dd6c0134..abba2c36d 100644
--- a/config/rootfiles/common/harfbuzz
+++ b/config/rootfiles/common/harfbuzz
@@ -26,6 +26,7 @@
#usr/include/harfbuzz/hb-map.h
#usr/include/harfbuzz/hb-ot-color.h
#usr/include/harfbuzz/hb-ot-deprecated.h
+#usr/include/harfbuzz/hb-ot-fetch.h
#usr/include/harfbuzz/hb-ot-font.h
#usr/include/harfbuzz/hb-ot-layout.h
#usr/include/harfbuzz/hb-ot-math.h
@@ -42,6 +43,7 @@ usr/include/harfbuzz/hb-script-list.h
#usr/include/harfbuzz/hb-shape-plan.h
#usr/include/harfbuzz/hb-shape.h
#usr/include/harfbuzz/hb-style.h
+#usr/include/harfbuzz/hb-subset-depend.h
#usr/include/harfbuzz/hb-subset-serialize.h
#usr/include/harfbuzz/hb-subset.h
#usr/include/harfbuzz/hb-unicode.h
@@ -52,25 +54,25 @@ usr/include/harfbuzz/hb-script-list.h
#usr/lib/cmake/harfbuzz/harfbuzz-config.cmake
#usr/lib/libharfbuzz-cairo.so
usr/lib/libharfbuzz-cairo.so.0
-usr/lib/libharfbuzz-cairo.so.0.61421.0
+usr/lib/libharfbuzz-cairo.so.0.61430.0
#usr/lib/libharfbuzz-gobject.so
usr/lib/libharfbuzz-gobject.so.0
-usr/lib/libharfbuzz-gobject.so.0.61421.0
+usr/lib/libharfbuzz-gobject.so.0.61430.0
#usr/lib/libharfbuzz-gpu.so
usr/lib/libharfbuzz-gpu.so.0
-usr/lib/libharfbuzz-gpu.so.0.61421.0
+usr/lib/libharfbuzz-gpu.so.0.61430.0
#usr/lib/libharfbuzz-raster.so
usr/lib/libharfbuzz-raster.so.0
-usr/lib/libharfbuzz-raster.so.0.61421.0
+usr/lib/libharfbuzz-raster.so.0.61430.0
#usr/lib/libharfbuzz-subset.so
usr/lib/libharfbuzz-subset.so.0
-usr/lib/libharfbuzz-subset.so.0.61421.0
+usr/lib/libharfbuzz-subset.so.0.61430.0
#usr/lib/libharfbuzz-vector.so
usr/lib/libharfbuzz-vector.so.0
-usr/lib/libharfbuzz-vector.so.0.61421.0
+usr/lib/libharfbuzz-vector.so.0.61430.0
#usr/lib/libharfbuzz.so
usr/lib/libharfbuzz.so.0
-usr/lib/libharfbuzz.so.0.61421.0
+usr/lib/libharfbuzz.so.0.61430.0
#usr/lib/pkgconfig/harfbuzz-cairo.pc
#usr/lib/pkgconfig/harfbuzz-gobject.pc
#usr/lib/pkgconfig/harfbuzz-gpu.pc
diff --git a/config/rootfiles/common/libarchive b/config/rootfiles/common/libarchive
index 0b636a186..f7dc116f0 100644
--- a/config/rootfiles/common/libarchive
+++ b/config/rootfiles/common/libarchive
@@ -7,7 +7,7 @@
#usr/lib/libarchive.la
#usr/lib/libarchive.so
usr/lib/libarchive.so.13
-usr/lib/libarchive.so.13.8.8
+usr/lib/libarchive.so.13.8.9
#usr/lib/pkgconfig/libarchive.pc
#usr/share/man/man1/bsdcat.1
#usr/share/man/man1/bsdcpio.1
diff --git a/config/rootfiles/common/pango b/config/rootfiles/common/pango
index 53f3d6b9d..66a7f3394 100644
--- a/config/rootfiles/common/pango
+++ b/config/rootfiles/common/pango
@@ -41,13 +41,13 @@ usr/bin/pango-view
#usr/include/pango-1.0/pango/pangoft2.h
#usr/lib/libpango-1.0.so
usr/lib/libpango-1.0.so.0
-usr/lib/libpango-1.0.so.0.5800.0
+usr/lib/libpango-1.0.so.0.5800.2
#usr/lib/libpangocairo-1.0.so
usr/lib/libpangocairo-1.0.so.0
-usr/lib/libpangocairo-1.0.so.0.5800.0
+usr/lib/libpangocairo-1.0.so.0.5800.2
#usr/lib/libpangoft2-1.0.so
usr/lib/libpangoft2-1.0.so.0
-usr/lib/libpangoft2-1.0.so.0.5800.0
+usr/lib/libpangoft2-1.0.so.0.5800.2
#usr/lib/pkgconfig/pango.pc
#usr/lib/pkgconfig/pangocairo.pc
#usr/lib/pkgconfig/pangofc.pc
diff --git a/config/rootfiles/common/perl b/config/rootfiles/common/perl
index 61a0a2ddc..1e617269e 100644
--- a/config/rootfiles/common/perl
+++ b/config/rootfiles/common/perl
@@ -264,7 +264,7 @@ usr/lib/perl5/5.42.2/FindBin.pm
#usr/lib/perl5/5.42.2/Getopt
#usr/lib/perl5/5.42.2/Getopt/Long
usr/lib/perl5/5.42.2/Getopt/Long.pm
-#usr/lib/perl5/5.42.2/Getopt/Long/Parser.pm
+usr/lib/perl5/5.42.2/Getopt/Long/Parser.pm
usr/lib/perl5/5.42.2/Getopt/Std.pm
#usr/lib/perl5/5.42.2/HTTP
usr/lib/perl5/5.42.2/HTTP/Tiny.pm
diff --git a/config/rootfiles/common/rrdtool b/config/rootfiles/common/rrdtool
index 628e3a777..140fb9899 100644
--- a/config/rootfiles/common/rrdtool
+++ b/config/rootfiles/common/rrdtool
@@ -33,107 +33,107 @@ usr/lib/perl5/site_perl/5.42.2/xxxMACHINExxx-linux-thread-multi/auto/RRDs/RRDs.s
#usr/lib/python3/site-packages/rrdtool-0.1.10.dist-info/licenses/COPYING
#usr/lib/python3/site-packages/rrdtool-0.1.10.dist-info/top_level.txt
#usr/lib/python3/site-packages/rrdtool.cpython-310-xxxMACHINExxx-linux-gnu.so
-#usr/share/doc/rrdtool-1.10.3
-#usr/share/doc/rrdtool-1.10.3/html
-#usr/share/doc/rrdtool-1.10.3/html/RRDp.html
-#usr/share/doc/rrdtool-1.10.3/html/RRDs.html
-#usr/share/doc/rrdtool-1.10.3/html/bin_dec_hex.html
-#usr/share/doc/rrdtool-1.10.3/html/cdeftutorial.html
-#usr/share/doc/rrdtool-1.10.3/html/index.html
-#usr/share/doc/rrdtool-1.10.3/html/librrd.html
-#usr/share/doc/rrdtool-1.10.3/html/rpntutorial.html
-#usr/share/doc/rrdtool-1.10.3/html/rrd-beginners.html
-#usr/share/doc/rrdtool-1.10.3/html/rrd_pdpcalc.html
-#usr/share/doc/rrdtool-1.10.3/html/rrdbuild.html
-#usr/share/doc/rrdtool-1.10.3/html/rrdcached.html
-#usr/share/doc/rrdtool-1.10.3/html/rrdcgi.html
-#usr/share/doc/rrdtool-1.10.3/html/rrdcreate.html
-#usr/share/doc/rrdtool-1.10.3/html/rrddump.html
-#usr/share/doc/rrdtool-1.10.3/html/rrdfetch.html
-#usr/share/doc/rrdtool-1.10.3/html/rrdfirst.html
-#usr/share/doc/rrdtool-1.10.3/html/rrdflushcached.html
-#usr/share/doc/rrdtool-1.10.3/html/rrdgraph.html
-#usr/share/doc/rrdtool-1.10.3/html/rrdgraph_data.html
-#usr/share/doc/rrdtool-1.10.3/html/rrdgraph_examples.html
-#usr/share/doc/rrdtool-1.10.3/html/rrdgraph_graph.html
-#usr/share/doc/rrdtool-1.10.3/html/rrdgraph_rpn.html
-#usr/share/doc/rrdtool-1.10.3/html/rrdinfo.html
-#usr/share/doc/rrdtool-1.10.3/html/rrdlast.html
-#usr/share/doc/rrdtool-1.10.3/html/rrdlastupdate.html
-#usr/share/doc/rrdtool-1.10.3/html/rrdlist.html
-#usr/share/doc/rrdtool-1.10.3/html/rrdpython.html
-#usr/share/doc/rrdtool-1.10.3/html/rrdresize.html
-#usr/share/doc/rrdtool-1.10.3/html/rrdrestore.html
-#usr/share/doc/rrdtool-1.10.3/html/rrdthreads.html
-#usr/share/doc/rrdtool-1.10.3/html/rrdtool.html
-#usr/share/doc/rrdtool-1.10.3/html/rrdtune.html
-#usr/share/doc/rrdtool-1.10.3/html/rrdtutorial.html
-#usr/share/doc/rrdtool-1.10.3/html/rrdupdate.html
-#usr/share/doc/rrdtool-1.10.3/html/rrdxport.html
-#usr/share/doc/rrdtool-1.10.3/txt
-#usr/share/doc/rrdtool-1.10.3/txt/bin_dec_hex.pod
-#usr/share/doc/rrdtool-1.10.3/txt/bin_dec_hex.txt
-#usr/share/doc/rrdtool-1.10.3/txt/cdeftutorial.pod
-#usr/share/doc/rrdtool-1.10.3/txt/cdeftutorial.txt
-#usr/share/doc/rrdtool-1.10.3/txt/librrd.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rpntutorial.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rpntutorial.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rrd-beginners.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rrd-beginners.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rrd_pdpcalc.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rrd_pdpcalc.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rrdbuild.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rrdbuild.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rrdcached.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rrdcached.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rrdcgi.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rrdcgi.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rrdcreate.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rrdcreate.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rrddump.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rrddump.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rrdfetch.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rrdfetch.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rrdfirst.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rrdfirst.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rrdflushcached.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rrdflushcached.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rrdgraph.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rrdgraph.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rrdgraph_data.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rrdgraph_data.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rrdgraph_examples.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rrdgraph_examples.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rrdgraph_graph.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rrdgraph_graph.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rrdgraph_rpn.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rrdgraph_rpn.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rrdinfo.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rrdinfo.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rrdlast.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rrdlast.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rrdlastupdate.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rrdlastupdate.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rrdlist.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rrdlist.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rrdpython.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rrdpython.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rrdresize.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rrdresize.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rrdrestore.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rrdrestore.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rrdthreads.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rrdthreads.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rrdtool.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rrdtool.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rrdtune.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rrdtune.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rrdtutorial.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rrdtutorial.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rrdupdate.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rrdupdate.txt
-#usr/share/doc/rrdtool-1.10.3/txt/rrdxport.pod
-#usr/share/doc/rrdtool-1.10.3/txt/rrdxport.txt
+#usr/share/doc/rrdtool-1.11.0
+#usr/share/doc/rrdtool-1.11.0/html
+#usr/share/doc/rrdtool-1.11.0/html/RRDp.html
+#usr/share/doc/rrdtool-1.11.0/html/RRDs.html
+#usr/share/doc/rrdtool-1.11.0/html/bin_dec_hex.html
+#usr/share/doc/rrdtool-1.11.0/html/cdeftutorial.html
+#usr/share/doc/rrdtool-1.11.0/html/index.html
+#usr/share/doc/rrdtool-1.11.0/html/librrd.html
+#usr/share/doc/rrdtool-1.11.0/html/rpntutorial.html
+#usr/share/doc/rrdtool-1.11.0/html/rrd-beginners.html
+#usr/share/doc/rrdtool-1.11.0/html/rrd_pdpcalc.html
+#usr/share/doc/rrdtool-1.11.0/html/rrdbuild.html
+#usr/share/doc/rrdtool-1.11.0/html/rrdcached.html
+#usr/share/doc/rrdtool-1.11.0/html/rrdcgi.html
+#usr/share/doc/rrdtool-1.11.0/html/rrdcreate.html
+#usr/share/doc/rrdtool-1.11.0/html/rrddump.html
+#usr/share/doc/rrdtool-1.11.0/html/rrdfetch.html
+#usr/share/doc/rrdtool-1.11.0/html/rrdfirst.html
+#usr/share/doc/rrdtool-1.11.0/html/rrdflushcached.html
+#usr/share/doc/rrdtool-1.11.0/html/rrdgraph.html
+#usr/share/doc/rrdtool-1.11.0/html/rrdgraph_data.html
+#usr/share/doc/rrdtool-1.11.0/html/rrdgraph_examples.html
+#usr/share/doc/rrdtool-1.11.0/html/rrdgraph_graph.html
+#usr/share/doc/rrdtool-1.11.0/html/rrdgraph_rpn.html
+#usr/share/doc/rrdtool-1.11.0/html/rrdinfo.html
+#usr/share/doc/rrdtool-1.11.0/html/rrdlast.html
+#usr/share/doc/rrdtool-1.11.0/html/rrdlastupdate.html
+#usr/share/doc/rrdtool-1.11.0/html/rrdlist.html
+#usr/share/doc/rrdtool-1.11.0/html/rrdpython.html
+#usr/share/doc/rrdtool-1.11.0/html/rrdresize.html
+#usr/share/doc/rrdtool-1.11.0/html/rrdrestore.html
+#usr/share/doc/rrdtool-1.11.0/html/rrdthreads.html
+#usr/share/doc/rrdtool-1.11.0/html/rrdtool.html
+#usr/share/doc/rrdtool-1.11.0/html/rrdtune.html
+#usr/share/doc/rrdtool-1.11.0/html/rrdtutorial.html
+#usr/share/doc/rrdtool-1.11.0/html/rrdupdate.html
+#usr/share/doc/rrdtool-1.11.0/html/rrdxport.html
+#usr/share/doc/rrdtool-1.11.0/txt
+#usr/share/doc/rrdtool-1.11.0/txt/bin_dec_hex.pod
+#usr/share/doc/rrdtool-1.11.0/txt/bin_dec_hex.txt
+#usr/share/doc/rrdtool-1.11.0/txt/cdeftutorial.pod
+#usr/share/doc/rrdtool-1.11.0/txt/cdeftutorial.txt
+#usr/share/doc/rrdtool-1.11.0/txt/librrd.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rpntutorial.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rpntutorial.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rrd-beginners.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rrd-beginners.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rrd_pdpcalc.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rrd_pdpcalc.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rrdbuild.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rrdbuild.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rrdcached.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rrdcached.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rrdcgi.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rrdcgi.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rrdcreate.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rrdcreate.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rrddump.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rrddump.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rrdfetch.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rrdfetch.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rrdfirst.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rrdfirst.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rrdflushcached.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rrdflushcached.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rrdgraph.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rrdgraph.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rrdgraph_data.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rrdgraph_data.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rrdgraph_examples.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rrdgraph_examples.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rrdgraph_graph.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rrdgraph_graph.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rrdgraph_rpn.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rrdgraph_rpn.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rrdinfo.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rrdinfo.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rrdlast.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rrdlast.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rrdlastupdate.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rrdlastupdate.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rrdlist.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rrdlist.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rrdpython.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rrdpython.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rrdresize.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rrdresize.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rrdrestore.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rrdrestore.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rrdthreads.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rrdthreads.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rrdtool.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rrdtool.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rrdtune.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rrdtune.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rrdtutorial.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rrdtutorial.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rrdupdate.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rrdupdate.txt
+#usr/share/doc/rrdtool-1.11.0/txt/rrdxport.pod
+#usr/share/doc/rrdtool-1.11.0/txt/rrdxport.txt
#usr/share/locale/fr/LC_MESSAGES/rrdtool.mo
#usr/share/locale/hu/LC_MESSAGES/rrdtool.mo
#usr/share/locale/ka/LC_MESSAGES/rrdtool.mo
diff --git a/config/rootfiles/common/shadow b/config/rootfiles/common/shadow
index d25da8957..170568306 100644
--- a/config/rootfiles/common/shadow
+++ b/config/rootfiles/common/shadow
@@ -11,13 +11,12 @@ etc/shadow
#etc/shadow-
#lib/libsubid.la
#lib/libsubid.so
-lib/libsubid.so.5
-lib/libsubid.so.5.0.0
+lib/libsubid.so.6
+lib/libsubid.so.6.0.0
sbin/nologin
#usr/bin/chage
#usr/bin/chfn
#usr/bin/chsh
-#usr/bin/expiry
#usr/bin/faillog
#usr/bin/gpasswd
#usr/bin/newgidmap
@@ -31,12 +30,10 @@ sbin/nologin
usr/sbin/chpasswd
usr/sbin/groupadd
usr/sbin/groupdel
-usr/sbin/groupmems
usr/sbin/groupmod
#usr/sbin/grpck
usr/sbin/grpconv
#usr/sbin/grpunconv
-#usr/sbin/logoutd
#usr/sbin/newusers
#usr/sbin/pwck
usr/sbin/pwconv
diff --git a/config/rootfiles/common/sqlite b/config/rootfiles/common/sqlite
index f12ed80ea..3b430d178 100644
--- a/config/rootfiles/common/sqlite
+++ b/config/rootfiles/common/sqlite
@@ -3,6 +3,6 @@ usr/bin/sqlite3
#usr/include/sqlite3ext.h
usr/lib/libsqlite3.so
usr/lib/libsqlite3.so.0
-usr/lib/libsqlite3.so.3.53.3
+usr/lib/libsqlite3.so.3.53.4
#usr/lib/pkgconfig/sqlite3.pc
#usr/share/man/man1/sqlite3.1
diff --git a/config/rootfiles/common/x86_64/boost b/config/rootfiles/common/x86_64/boost
index a10c5380d..6342c206a 100644
--- a/config/rootfiles/common/x86_64/boost
+++ b/config/rootfiles/common/x86_64/boost
@@ -17320,6 +17320,18 @@
#usr/lib/cmake/boost_chrono-1.90.0/boost_chrono-config-version.cmake
#usr/lib/cmake/boost_chrono-1.90.0/boost_chrono-config.cmake
#usr/lib/cmake/boost_chrono-1.90.0/libboost_chrono-variant-shared.cmake
+#usr/lib/cmake/boost_cobalt-1.90.0
+#usr/lib/cmake/boost_cobalt-1.90.0/boost_cobalt-config-version.cmake
+#usr/lib/cmake/boost_cobalt-1.90.0/boost_cobalt-config.cmake
+#usr/lib/cmake/boost_cobalt-1.90.0/libboost_cobalt-variant-shared.cmake
+#usr/lib/cmake/boost_cobalt_io-1.90.0
+#usr/lib/cmake/boost_cobalt_io-1.90.0/boost_cobalt_io-config-version.cmake
+#usr/lib/cmake/boost_cobalt_io-1.90.0/boost_cobalt_io-config.cmake
+#usr/lib/cmake/boost_cobalt_io-1.90.0/libboost_cobalt_io-variant-shared.cmake
+#usr/lib/cmake/boost_cobalt_io_ssl-1.90.0
+#usr/lib/cmake/boost_cobalt_io_ssl-1.90.0/boost_cobalt_io_ssl-config-version.cmake
+#usr/lib/cmake/boost_cobalt_io_ssl-1.90.0/boost_cobalt_io_ssl-config.cmake
+#usr/lib/cmake/boost_cobalt_io_ssl-1.90.0/libboost_cobalt_io_ssl-variant-shared.cmake
#usr/lib/cmake/boost_container-1.90.0
#usr/lib/cmake/boost_container-1.90.0/boost_container-config-version.cmake
#usr/lib/cmake/boost_container-1.90.0/boost_container-config.cmake
@@ -17482,6 +17494,12 @@ usr/lib/libboost_atomic.so.1.90.0
usr/lib/libboost_charconv.so.1.90.0
#usr/lib/libboost_chrono.so
usr/lib/libboost_chrono.so.1.90.0
+#usr/lib/libboost_cobalt.so
+usr/lib/libboost_cobalt.so.1.90.0
+#usr/lib/libboost_cobalt_io.so
+usr/lib/libboost_cobalt_io.so.1.90.0
+#usr/lib/libboost_cobalt_io_ssl.so
+usr/lib/libboost_cobalt_io_ssl.so.1.90.0
#usr/lib/libboost_container.so
usr/lib/libboost_container.so.1.90.0
#usr/lib/libboost_context.so
diff --git a/config/rootfiles/core/205/filelists/dhcpcd b/config/rootfiles/core/205/filelists/dhcpcd
new file mode 120000
index 000000000..1e799dabb
--- /dev/null
+++ b/config/rootfiles/core/205/filelists/dhcpcd
@@ -0,0 +1 @@
+../../../common/dhcpcd
\ No newline at end of file
diff --git a/config/rootfiles/core/205/filelists/glib b/config/rootfiles/core/205/filelists/glib
new file mode 120000
index 000000000..44665746a
--- /dev/null
+++ b/config/rootfiles/core/205/filelists/glib
@@ -0,0 +1 @@
+../../../common/glib
\ No newline at end of file
diff --git a/config/rootfiles/core/205/filelists/harfbuzz b/config/rootfiles/core/205/filelists/harfbuzz
new file mode 120000
index 000000000..ffe1e0d0b
--- /dev/null
+++ b/config/rootfiles/core/205/filelists/harfbuzz
@@ -0,0 +1 @@
+../../../common/harfbuzz
\ No newline at end of file
diff --git a/config/rootfiles/core/205/filelists/hwdata b/config/rootfiles/core/205/filelists/hwdata
new file mode 120000
index 000000000..ced911666
--- /dev/null
+++ b/config/rootfiles/core/205/filelists/hwdata
@@ -0,0 +1 @@
+../../../common/hwdata
\ No newline at end of file
diff --git a/config/rootfiles/core/205/filelists/libarchive b/config/rootfiles/core/205/filelists/libarchive
new file mode 120000
index 000000000..551f1f743
--- /dev/null
+++ b/config/rootfiles/core/205/filelists/libarchive
@@ -0,0 +1 @@
+../../../common/libarchive
\ No newline at end of file
diff --git a/config/rootfiles/core/205/filelists/pango b/config/rootfiles/core/205/filelists/pango
new file mode 120000
index 000000000..6c37231c7
--- /dev/null
+++ b/config/rootfiles/core/205/filelists/pango
@@ -0,0 +1 @@
+../../../common/pango
\ No newline at end of file
diff --git a/config/rootfiles/core/205/filelists/rrdtool b/config/rootfiles/core/205/filelists/rrdtool
new file mode 120000
index 000000000..7a82e414b
--- /dev/null
+++ b/config/rootfiles/core/205/filelists/rrdtool
@@ -0,0 +1 @@
+../../../common/rrdtool
\ No newline at end of file
diff --git a/config/rootfiles/core/205/filelists/shadow b/config/rootfiles/core/205/filelists/shadow
new file mode 120000
index 000000000..c0824b7b9
--- /dev/null
+++ b/config/rootfiles/core/205/filelists/shadow
@@ -0,0 +1 @@
+../../../common/shadow
\ No newline at end of file
diff --git a/config/rootfiles/core/205/filelists/sqlite b/config/rootfiles/core/205/filelists/sqlite
new file mode 120000
index 000000000..4ea569766
--- /dev/null
+++ b/config/rootfiles/core/205/filelists/sqlite
@@ -0,0 +1 @@
+../../../common/sqlite
\ No newline at end of file
diff --git a/config/rootfiles/core/205/filelists/systemd b/config/rootfiles/core/205/filelists/systemd
new file mode 120000
index 000000000..f5616415e
--- /dev/null
+++ b/config/rootfiles/core/205/filelists/systemd
@@ -0,0 +1 @@
+../../../common/systemd
\ No newline at end of file
diff --git a/config/rootfiles/core/205/filelists/xfsprogs b/config/rootfiles/core/205/filelists/xfsprogs
new file mode 120000
index 000000000..91032964d
--- /dev/null
+++ b/config/rootfiles/core/205/filelists/xfsprogs
@@ -0,0 +1 @@
+../../../common/xfsprogs
\ No newline at end of file
diff --git a/config/rootfiles/packages/clamav b/config/rootfiles/packages/clamav
index f17380c98..088ab0172 100644
--- a/config/rootfiles/packages/clamav
+++ b/config/rootfiles/packages/clamav
@@ -162,7 +162,7 @@ usr/sbin/clamd
#usr/share/doc/ClamAV/html/mode-rust-2c9d5c9a.js
#usr/share/doc/ClamAV/html/print.html
#usr/share/doc/ClamAV/html/searcher-09f2665d.js
-#usr/share/doc/ClamAV/html/searchindex-d348bbbb.js
+#usr/share/doc/ClamAV/html/searchindex-f120d447.js
#usr/share/doc/ClamAV/html/sitemap.xml
#usr/share/doc/ClamAV/html/theme-dawn-4493f9c8.js
#usr/share/doc/ClamAV/html/theme-tomorrow_night-9dbe62a9.js
diff --git a/config/rootfiles/packages/frr b/config/rootfiles/packages/frr
index 84a3753e6..cce3d9983 100644
--- a/config/rootfiles/packages/frr
+++ b/config/rootfiles/packages/frr
@@ -15,6 +15,7 @@ usr/bin/vtysh
#usr/include/frr/lib/assert
#usr/include/frr/lib/assert/assert.h
#usr/include/frr/lib/atomlist.h
+#usr/include/frr/lib/atomptr.h
#usr/include/frr/lib/base64.h
#usr/include/frr/lib/bfd.h
#usr/include/frr/lib/bitfield.h
@@ -184,6 +185,7 @@ usr/bin/vtysh
#usr/include/frr/zebra/zebra_dplane.h
#usr/include/frr/zebra/zebra_errors.h
#usr/include/frr/zebra/zebra_evpn.h
+#usr/include/frr/zebra/zebra_evpn_base.h
#usr/include/frr/zebra/zebra_evpn_mac.h
#usr/include/frr/zebra/zebra_evpn_mh.h
#usr/include/frr/zebra/zebra_evpn_neigh.h
@@ -303,6 +305,7 @@ usr/sbin/zebra
#usr/share/yang/frr-route-types.yang
#usr/share/yang/frr-routing.yang
#usr/share/yang/frr-staticd.yang
+#usr/share/yang/frr-test-config.yang
#usr/share/yang/frr-test-module.yang
#usr/share/yang/frr-vrf.yang
#usr/share/yang/frr-vrrpd.yang
diff --git a/config/rootfiles/packages/libtalloc b/config/rootfiles/packages/libtalloc
index 97963ad2c..a5ffbb3ce 100644
--- a/config/rootfiles/packages/libtalloc
+++ b/config/rootfiles/packages/libtalloc
@@ -1,5 +1,5 @@
#usr/include/talloc.h
#usr/lib/libtalloc.so
usr/lib/libtalloc.so.2
-usr/lib/libtalloc.so.2.4.4
+usr/lib/libtalloc.so.2.5.0
#usr/lib/pkgconfig/talloc.pc
diff --git a/lfs/clamav b/lfs/clamav
index 5320f6986..4f12ab4f6 100644
--- a/lfs/clamav
+++ b/lfs/clamav
@@ -26,7 +26,7 @@ include Config
SUMMARY = Antivirus Toolkit
-VER = 1.5.3
+VER = 1.5.4
THISAPP = clamav-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = clamav
-PAK_VER = 84
+PAK_VER = 85
DEPS =
@@ -50,7 +50,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 1b2d42bc8c4fed29b71e10be9823da17f861a11e6a818654ae51b2b1fbd16619494572f9aa5e8712433bd65443c33f3e250baa99bb1fea031aa47c6bf6b81c21
+$(DL_FILE)_BLAKE2 = 9cd52cb4b885aae7b26477ed45efdd8cd12b5adae030a17db31cb0aa4489b004977b592e00c6d3121aae4367db842cf03c83f84eda06031537ed09051321be6e
install : $(TARGET)
diff --git a/lfs/dhcpcd b/lfs/dhcpcd
index 6d15caad2..d4cade029 100644
--- a/lfs/dhcpcd
+++ b/lfs/dhcpcd
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2025 IPFire Team <info@ipfire.org> #
+# Copyright (C) 2007-2026 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -24,7 +24,7 @@
include Config
-VER = 10.2.4
+VER = 10.5.0
THISAPP = dhcpcd-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = cdc5c345c58f24852ecf7e6655446f9385c860d9095cca8fa40eaae27a1d05dfad667e1e39af6ace2bd73acaa799210d6345462c90a88f89839912416263fdef
+$(DL_FILE)_BLAKE2 = 0b685acc78243b94f045fad33f10142e65c7883010e61a0f62f19c6ba080418dbf3ea939d7a22dd432ae6e9af8da90bd70da89d5e802ca481c797b03e1f41417
install : $(TARGET)
diff --git a/lfs/dnsdist b/lfs/dnsdist
index a65772a4a..ed1fb7430 100644
--- a/lfs/dnsdist
+++ b/lfs/dnsdist
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2025 IPFire Team <info@ipfire.org> #
+# Copyright (C) 2007-2026 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -26,7 +26,7 @@ include Config
SUMMARY = A highly DNS-, DoS- and abuse-aware loadbalancer
-VER = 2.1.0
+VER = 2.1.1
THISAPP = dnsdist-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = dnsdist
-PAK_VER = 36
+PAK_VER = 37
DEPS =
@@ -50,7 +50,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = ae4abaea64f4ae0eb2615e649dd7f39997483d2376d063451d13c4089f6218b6d66dc206a5fae7a2245c6cddf392961047386b54bdbcaf90dd922a8c330e1034
+$(DL_FILE)_BLAKE2 = 88607ab943a22131b9e9f7321a5576ccda2d773637176cf72e04b0007dd4f812a806d6369bdcaf3f2f74e89c05988e7cf5b98886742fb927cd1b877243cc258b
install : $(TARGET)
@@ -84,15 +84,14 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
@$(PREBUILD)
@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
cd $(DIR_APP) && ./configure \
- --prefix=/usr \
- --sysconfdir=/etc \
- --with-libssl \
- --without-gnutls \
- --enable-dns-over-tls \
- --with-lua \
- --without-net-snmp \
- --disable-systemd
-
+ --prefix=/usr \
+ --sysconfdir=/etc \
+ --with-libssl \
+ --without-gnutls \
+ --enable-dns-over-tls \
+ --with-lua \
+ --without-net-snmp \
+ --disable-systemd
cd $(DIR_APP) && make $(MAKETUNING)
cd $(DIR_APP) && make install
diff --git a/lfs/fort-validator b/lfs/fort-validator
index b314fa34f..bbcf0153d 100644
--- a/lfs/fort-validator
+++ b/lfs/fort-validator
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2025 IPFire Team <info@ipfire.org> #
+# Copyright (C) 2007-2026 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -26,7 +26,7 @@ include Config
SUMMARY = Fort RPKI validator
-VER = 1.6.7
+VER = 1.6.8
THISAPP = fort-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = fort-validator
-PAK_VER = 2
+PAK_VER = 3
DEPS = rsync
@@ -48,7 +48,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 95273f7fb8a7f57eee28e1dd2cef558f9bbae96106394651a1d092fa64c8953f55797c91a23c0c108133114699cb04fca2ae137795a3378ec03a2fc627e2efde
+$(DL_FILE)_BLAKE2 = b40b300bd79cc9f481b55306e1e81f883814f992c0bc7334b8108a00b2b9141a1e6919f342e3945d809e32c912ec2e69b63acbfaa184b10d44ce7880139492dd
install : $(TARGET)
diff --git a/lfs/frr b/lfs/frr
index 4757a8544..0188d5e8f 100644
--- a/lfs/frr
+++ b/lfs/frr
@@ -26,7 +26,7 @@ include Config
SUMMARY = FRRouting Routing daemon
-VER = 10.6.0
+VER = 10.7.0
THISAPP = frr-frr-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = frr
-PAK_VER = 17
+PAK_VER = 18
DEPS =
@@ -50,7 +50,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = ed90d54b832cb041cbc0e5bf833472ab2434b0b5fa0dfa89e56da6d6fae6cca272d6419b8004b1861469c4d2aeaee7d2858cfc148ec1d1313f5d41172fe46ead
+$(DL_FILE)_BLAKE2 = 4adc266bb68788d084986ec5ada3aff2f8cee29203556340932930f8232b217ca649d126b982e03f8c7f82144ef6efed29eea2055d32d08cde242c52c6acca89
install : $(TARGET)
diff --git a/lfs/glib b/lfs/glib
index 20f79571e..0d814e654 100644
--- a/lfs/glib
+++ b/lfs/glib
@@ -24,7 +24,7 @@
include Config
-VER = 2.88.2
+VER = 2.89.3
# https://download.gnome.org/sources/glib/
THISAPP = glib-$(VER)
@@ -41,7 +41,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = fecce4ad82e62e429d30f4e9050a83b53715644fc8c7c89d767ecdaefa603530e81e024dd3450ce25bcd93b00fa6aeb8551b6240d3a04862dadeb895b0177e10
+$(DL_FILE)_BLAKE2 = 2a22ac4187a3a9d6955e38ec72fec00af2c4bf6d3cfcf74ec25e292f2f112da6065a8af6d4b538477fbcffb7d0bbb41272a8296922f99f7c2a61be9c4b9fe024
install : $(TARGET)
diff --git a/lfs/haproxy b/lfs/haproxy
index 8004ef479..030219275 100644
--- a/lfs/haproxy
+++ b/lfs/haproxy
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2025 IPFire Team <info@ipfire.org> #
+# Copyright (C) 2007-2026 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -26,7 +26,7 @@ include Config
SUMMARY = The Reliable, High Performance TCP/HTTP Load Balancer
-VER = 3.4.2
+VER = 3.4.3
# From: https://www.haproxy.org/download/
@@ -36,7 +36,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = haproxy
-PAK_VER = 35
+PAK_VER = 36
DEPS =
@@ -54,7 +54,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = a6f5c1d84d2c0082fd40792edbf97477499703c062b58de794db874bcab9f62b2df792c3fbde88196f8c7412d0d5b8cbbe0e38197caa817cac071cad3bab1e9a
+$(DL_FILE)_BLAKE2 = 75e8edf463e1e9a53a17aee51ef5995c800fe8e1bc043bb08aee55eb528b937f382f2488a8c7e155bbe5fad979c268cbc427d9317ef2bc9ac117940e7ac5bdd0
install : $(TARGET)
diff --git a/lfs/harfbuzz b/lfs/harfbuzz
index 1c4055a9b..e2de3e475 100644
--- a/lfs/harfbuzz
+++ b/lfs/harfbuzz
@@ -24,7 +24,7 @@
include Config
-VER = 14.2.1
+VER = 14.3.0
THISAPP = harfbuzz-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 7dab5e69ea502a8b65e1a84c84796ce1afa5e369f3d705af3bbb884a116bf283a170a613831a5af2d28d5eea87360909335590c1a5f9d914088317041b5c01b4
+$(DL_FILE)_BLAKE2 = e4cce203054d98bae061f7baeee2a13f0e71138601f355d8e149296df6ac04f02edfa3bdf14daee2c5a723024caac28c677c09089061f9bb7dc3d179ca8a3e38
install : $(TARGET)
diff --git a/lfs/hwdata b/lfs/hwdata
index bf8447f9a..3e050e2c3 100644
--- a/lfs/hwdata
+++ b/lfs/hwdata
@@ -24,7 +24,7 @@
include Config
-VER = 0.409
+VER = 0.410
THISAPP = hwdata-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -42,7 +42,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 49f9d31b7c0d16466e85b5af03d6457a4fd0d79769018d5440801efadb8fb55aa0dc978401141adafadc082b795f6da0f791e9b64c2766439b90e799b3ee7c10
+$(DL_FILE)_BLAKE2 = 5e02947999341b2e249097f76cf318a2aaca64aeca7620f3e510021c204d489f68f64c8dcefd830f4be9ad96fc3b602b78c76443396bbf53770d5315e89a5c5c
install : $(TARGET)
diff --git a/lfs/libarchive b/lfs/libarchive
index 08c1ce689..e807477a5 100644
--- a/lfs/libarchive
+++ b/lfs/libarchive
@@ -24,7 +24,7 @@
include Config
-VER = 3.8.8
+VER = 3.8.9
THISAPP = libarchive-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -41,7 +41,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = dc210097fbd6bf2db240699dc2ad9fc6030b4179ffc02fa1de96537eb59897d964470fb1a675c76bc0691aa2f138f5cb2479495ea904124c80297c7bd84effc6
+$(DL_FILE)_BLAKE2 = 4f3df81fa32231471b866a443d77069e74d25c5b806bccf9358b5e7df25e6626c882aafffbd22ff8fa6b78a009efd58827a75ce0169b0ed4a780f65968a799c7
install : $(TARGET)
diff --git a/lfs/libtalloc b/lfs/libtalloc
index b078acdee..b39856e9c 100644
--- a/lfs/libtalloc
+++ b/lfs/libtalloc
@@ -26,7 +26,7 @@ include Config
SUMMARY = Samba talloc Library
-VER = 2.4.4
+VER = 2.5.0
THISAPP = talloc-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = libtalloc
-PAK_VER = 6
+PAK_VER = 7
DEPS =
@@ -48,7 +48,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 6d30a6d81e516a3361a9bb7bd9d0a039b65dc774828a836fda0a9a2f9efa2006a136a8ccff0103b28c12daa9cf75bd4d8ee8b065f9559a93dd1d3cb1132f716a
+$(DL_FILE)_BLAKE2 = 3f1af126fe16f129e061f825db43f60aa963073a1aaf31e0da946367a1accecf68fc33127484335ecea5ac8a2ebbedec172fee46bb2ad50da301924c5eb0bfd1
install : $(TARGET)
diff --git a/lfs/nfs b/lfs/nfs
index d0da3266b..06b91de29 100644
--- a/lfs/nfs
+++ b/lfs/nfs
@@ -26,7 +26,7 @@ include Config
SUMMARY = Support Utilities for Kernel nfsd
-VER = 2.9.1
+VER = 2.9.2
THISAPP = nfs-utils-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = nfs
-PAK_VER = 30
+PAK_VER = 31
DEPS = rpcbind
@@ -48,7 +48,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 029cc11c1d72c880aa22c90d841c7c9427e2acb2a39d46df07aac5714db62fad0dd78b82779fa325399cb03f4df918f0570bf17006b05efa3a9318f61000daab
+$(DL_FILE)_BLAKE2 = ef6b726bdeda695047af9359316f4519e674b855b064feca409be97acc9e6f78585e4e064646f437b229fb5261b48618db33a458eb315228141b2e9693efd81b
install : $(TARGET)
diff --git a/lfs/nut b/lfs/nut
index a86b1694f..a76fe147e 100644
--- a/lfs/nut
+++ b/lfs/nut
@@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = nut
-PAK_VER = 15
+PAK_VER = 16
DEPS =
diff --git a/lfs/pango b/lfs/pango
index df7a1277e..ebf0294a3 100644
--- a/lfs/pango
+++ b/lfs/pango
@@ -24,7 +24,7 @@
include Config
-VER = 1.58.0
+VER = 1.58.2
# https://download.gnome.org/sources/pango/
THISAPP = pango-$(VER)
@@ -41,7 +41,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = f8adae8198ac56d791ac9f5b95741f78826ff9cee3f67f831b838e5a6a3218f7fd9419a91c564eee7625ddbc1ec6ba0139e8870f3487c38aaa7123e155abcefd
+$(DL_FILE)_BLAKE2 = 234ec97322322326c0e2cd134b35bc7c99bb6bc5f80500f864dc2047c6256f323f0d9cfe379915b31d4befb9419b98dbf7c54ddbf92407ca4c4a446673969616
install : $(TARGET)
diff --git a/lfs/postfix b/lfs/postfix
index 771588125..9584412ad 100644
--- a/lfs/postfix
+++ b/lfs/postfix
@@ -26,7 +26,7 @@ include Config
SUMMARY = A fast, secure, and flexible mailer
-VER = 3.11.4
+VER = 3.11.5
THISAPP = postfix-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = postfix
-PAK_VER = 54
+PAK_VER = 55
DEPS =
@@ -72,7 +72,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 7c41d43987949076d45507372cce748b6bd1a8a1407fa032ecaf91ab1ad086068e7920d43df0c8b8c47f415c8ccbeaeb7862470aa322f51176e197fbe941ca4f
+$(DL_FILE)_BLAKE2 = c677014019ce0851e45b103e5d6a88972a10cd3685d4c68b47f6b94ee318b9e81fb017f5b15f4307f3b8c6719afcbba33f4fc1c31a4fb65fe040522d6af38704
install : $(TARGET)
diff --git a/lfs/rrdtool b/lfs/rrdtool
index c9c70c0cc..27db7b00b 100644
--- a/lfs/rrdtool
+++ b/lfs/rrdtool
@@ -24,7 +24,7 @@
include Config
-VER = 1.10.3
+VER = 1.11.0
THISAPP = rrdtool-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 5ceacdeb3c653db27516f65ea1748bc1e50c1b4a44ec2bdfe4375e34807654eff29d0c14e350a2b95b1b59da61e159d5cbadfb5bedcd44ab0ce79ee250e41733
+$(DL_FILE)_BLAKE2 = 3c02df300dcd096aeccecf24b8331df5227d1ec5c24dfe3382357e8c1dc5ec66620e276b8834894c17200063788a6825c37936a716f7220bdc9169965519c964
install : $(TARGET)
diff --git a/lfs/samba b/lfs/samba
index 545faac50..c21e8bbc0 100644
--- a/lfs/samba
+++ b/lfs/samba
@@ -24,7 +24,7 @@
include Config
-VER = 4.24.2
+VER = 4.24.5
SUMMARY = A SMB/CIFS File, Print, and Authentication Server
THISAPP = samba-$(VER)
@@ -33,7 +33,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = samba
-PAK_VER = 122
+PAK_VER = 123
DEPS = avahi libtalloc perl-Parse-Yapp wsdd
@@ -47,7 +47,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 464b9324b1c4d9e50d70c0d921c65b775f49db9e9b82314cc072ad03087f2d2f3ca4c9cf2925a3628c07c2f4664f58f9a36528078a14666d1fcb20ddb7949b44
+$(DL_FILE)_BLAKE2 = 4796e3ae5e70c1d11d9326566677f0909423c5aad140309bfd9b3f8a3dedefe49660d0a0d502a681726ed7a961779587c33c9da29ecf69664b00a2ca958e64af
install : $(TARGET)
diff --git a/lfs/shadow b/lfs/shadow
index f0e23408a..f1a021910 100644
--- a/lfs/shadow
+++ b/lfs/shadow
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2025 IPFire Team <info@ipfire.org> #
+# Copyright (C) 2007-2026 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -24,7 +24,7 @@
include Config
-VER = 4.18.0
+VER = 4.20.0
THISAPP = shadow-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = f165f8cdf017ed5875fbea3ece01d44f988bc85ee039186b5cd8d5cb07d666d501065ad9746abf80c2d31661b0cc687a2bc375e286a5805fa168f6826724e82e
+$(DL_FILE)_BLAKE2 = 8224edc692d6016da26e54aa43405029b4bebcbc7a73a9a56f1ee3bdcf7c7a3af6b90d8fc134182fc26c6b7b8f2afc4f54c2f6e6748760b8928284aa77374a15
install : $(TARGET)
@@ -70,6 +70,7 @@ $(subst %,%_BLAKE2,$(objects)) :
$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
@$(PREBUILD)
@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/shadow-4.20.0_Add_stdint.h_for_uintmax_t.patch
cd $(DIR_APP) && find man -name Makefile.in -exec sed -i 's/getspnam\.3 / /' {} \;
cd $(DIR_APP) && find man -name Makefile.in -exec sed -i 's/passwd\.5 / /' {} \;
$(UPDATE_AUTOMAKE)
@@ -84,7 +85,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
--with-group-name-max-length=32 \
--without-libbsd \
--without-bcrypt \
- --without-nscd
+ --without-nscd \
+ --disable-logind
cd $(DIR_APP) && make $(MAKETUNING)
cd $(DIR_APP) && make install
diff --git a/lfs/sqlite b/lfs/sqlite
index 50e6e6525..6498e84be 100644
--- a/lfs/sqlite
+++ b/lfs/sqlite
@@ -24,7 +24,7 @@
include Config
-VER = 3530300
+VER = 3530400
THISAPP = sqlite-autoconf-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 61ee1a88258fdfed02c51c9b0302a0eb27e58b90b5285be6e89753293f1662caa0a7d6de586bdfd72ddeffe166a0704702bed99040d2998674b22289718f3935
+$(DL_FILE)_BLAKE2 = 92fa9cf76fa8bba391e75ef2f0599f9730e945dfdff1e2b8031ea90a3e20853230c2981743b12676f21bb30b0b3e629748eef35af2a688ae1073b927b080f40b
install : $(TARGET)
diff --git a/lfs/systemd b/lfs/systemd
index 446e397df..cba1b7620 100644
--- a/lfs/systemd
+++ b/lfs/systemd
@@ -24,7 +24,7 @@
include Config
-VER = 261.1
+VER = 261.2
THISAPP = systemd-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -50,7 +50,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = ab345d6ae27d361aa56d3b021263e2b2e3af76cdc37ee9015932557f1b904f2e5e5a6d5911b4a442057d12d5eedf8a702a30aa13f9b68294ccc14833f397a0ea
+$(DL_FILE)_BLAKE2 = f8f57c5e78ff31727ecfd18b61d3a3a95b764e5a049c0cc974be567273db2f771ab2f50df1ebf06b0c3a659c7e02db309dee4844217e3a91ae1169877971a34e
install : $(TARGET)
diff --git a/lfs/tcpdump b/lfs/tcpdump
index 2ac5b19de..bff7d864a 100644
--- a/lfs/tcpdump
+++ b/lfs/tcpdump
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2025 IPFire Team <info@ipfire.org> #
+# Copyright (C) 2007-2026 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -26,7 +26,7 @@ include Config
SUMMARY = A Packet Sniffer
-VER = 4.99.5
+VER = 4.99.6
THISAPP = tcpdump-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = tcpdump
-PAK_VER = 17
+PAK_VER = 18
DEPS =
@@ -48,7 +48,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 30b8e81e29f37f220ab9301185301190c5abb6ee8a8105c899e53e96b93265d3d408a181b75ee18bd70f96494c5dcf12374aedddd1db6fd7ab41e5c5ba35c7e5
+$(DL_FILE)_BLAKE2 = 2594accf903843641afe568e4563d94f649bcd23bcee3782024107d1868a9b7978a7130fd85a8846c7562472f10e3b0e5011067dc10e4c58dfcad96e7a353547
install : $(TARGET)
diff --git a/lfs/xfsprogs b/lfs/xfsprogs
index 0b30980dd..8d6653380 100644
--- a/lfs/xfsprogs
+++ b/lfs/xfsprogs
@@ -24,7 +24,7 @@
include Config
-VER = 7.0.1
+VER = 7.1.1
# https://www.kernel.org/pub/linux/utils/fs/xfs/xfsprogs/
THISAPP = xfsprogs-$(VER)
@@ -47,7 +47,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 0834beee30b6f4d6cf16c4e34d2daff0720d1f620d75f1794eb8c8f8d822768f48e8d6d51e51ec8c1eeb73a0e3123a8baa6647cf3215f9d25254cc13d6cf02ba
+$(DL_FILE)_BLAKE2 = 7c3f6f4802cb32bb88cf9f439f73aeff4ebf495ff6928c0fe6da977c96256b7fa84e1f71c370ef3e1532a8534709acfc0d3c8e1d404543c6bb0f5c9a9235ba5a
install : $(TARGET)
diff --git a/src/patches/shadow-4.20.0_Add_stdint.h_for_uintmax_t.patch b/src/patches/shadow-4.20.0_Add_stdint.h_for_uintmax_t.patch
new file mode 100644
index 000000000..e07e7db74
--- /dev/null
+++ b/src/patches/shadow-4.20.0_Add_stdint.h_for_uintmax_t.patch
@@ -0,0 +1,22 @@
+diff -Naur shadow-4.20.0.orig/lib/find_new_sub_gids.c shadow-4.20.0/lib/find_new_sub_gids.c
+--- shadow-4.20.0.orig/lib/find_new_sub_gids.c 2026-08-07 18:55:36.246967805 +0200
++++ shadow-4.20.0/lib/find_new_sub_gids.c 2026-08-07 22:41:35.771731696 +0200
+@@ -8,6 +8,7 @@
+
+ #ifdef ENABLE_SUBIDS
+
++#include <stdint.h>
+ #include <stdio.h>
+ #include <errno.h>
+
+diff -Naur shadow-4.20.0.orig/lib/find_new_sub_uids.c shadow-4.20.0/lib/find_new_sub_uids.c
+--- shadow-4.20.0.orig/lib/find_new_sub_uids.c 2026-08-07 18:56:37.619956630 +0200
++++ shadow-4.20.0/lib/find_new_sub_uids.c 2026-08-07 22:41:52.640184987 +0200
+@@ -8,6 +8,7 @@
+
+ #ifdef ENABLE_SUBIDS
+
++#include <stdint.h>
+ #include <stdio.h>
+ #include <errno.h>
+
hooks/post-receive
--
IPFire 2.x development tree
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-08-08 16:44 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-08-08 16:44 [git.ipfire.org] IPFire 2.x development tree branch, next, updated. 068360263531050f2727b970fdbb50f3add2c505 Michael Tremer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox