OPNsense Release Notes

This release is mainly for the brave Hyper-V users who fought kernel panics since 26.7, which got fixed in 26.7.6 only to cause segmentation faults for others. Thanks all for testing and correcting the problem in FreeBSD!

The other reason are fixes in the new interfaces settings API so that it more closely matches the behaviour of the legacy page.

Both the iPerf and the FRR plugin have been reworked substantially. In case of FRR please read the migration notes linked below before updating.

Here are the full patch notes:

• interfaces: add missing validation for “configurable” and “spoofmac” in new settings API
• interfaces: only store “dhcp6_norequest_dns” in DHCPv6 mode in new settings API
• interfaces: only store “track6-interface” in ID association / Track interface modes in new settings API
• interfaces: do not render “none” to configuration in new settings API
• interfaces: move promiscuous mode to advanced in new settings API
• interfaces: fix index into $todo for proper flag check during apply in new settings API
• interfaces: provide better option group labels to DeviceField
• interfaces: add proper local/remote IP support to PPPoE IPCP
• interfaces: move legacy apply cache to /var/lib/php/tmp
• firewall: destination NAT: fix typo in parseRdrRules() causing faulty rules not being disabled
• firewall: aliases: validate that port aliases always have content
• firewall: revert a clone rule change so that cloned rules to appear adjacent to the original rule again
• mvc: UidField: add isolated updateValue() for installer user
• ui: bootgrid: sync columnselect-input state with (un)setColumns
• ui: sync expanded state for selected submenus
• ui: close mobile menu when a menu entry opens another tab of the current page (contributed by Greelan)
• plugins: os-ddclient 1.33
• plugins: os-frr 2.0
• plugins: os-iperf 2.0
• src: pf: send syncookies from the receiving thread
• src: hyperv: fix two regressions in previous upstream patch
• src: pcib: only apply ARI translation to the own secondary bus of a bridge
• src: ktls CBC decrypt: avoid creating zero length iovec entries
• src: route/fib_algo: respect immediate_sync in fd_ref_nhop
• src: route/fib_algo: fix FIB_ALGO without ROUTE_MPATH option
• src: sysctl: retire SYSCTL_NODE_CHILDREN()

A hotfix release was issued as 21.4.3_8:

• system: prevent expired or intermediate CA certificates from being added to trust store by default
• system: fix unescaped source field used for password in backup plugins
• firewall: fix long comment preventing IPFW reload (contributed by Robin Schneider)
• firmware: enable upgrade path to 21.10
• firmware: undo masking vulnerability URLs in FreeBSD due to UUID use
• firmware: correctly announce major upgrade reboot in status return
• firmware: do not fetch GeoIP database from business mirrors without a subscription
• backend: catch broken pipe on event handler (contributed by kulikov-a)

This update finally brings interface settings to MVC/API! It also brings a number of fixes and improvements from FreeBSD stable/15 including a fix for previous Hyper-V boot issues and hopefully also fixes ice driver DDP issues with newer firmware versions.

For the interface settings MVC/API there a few things to keep in mind:

• You can find them on the assignments page integrated into the existing grid.
• Commonly required DHCP advanced options not in basic mode have been made available.
• Advanced/file based modes for DHCP are gone and will reset on save.
• Saving settings queues them for reconfiguration and storage.
• A reboot without apply will discard the previously saved changes.
• Apply works similar to the old interfaces.php page but uses a rewritten backend sequence.
• The old interfaces.php page is still available retaining the old style settings.
• The old interfaces.php page will likely move to a plugin for 27.1.

We are looking for your feedback on this historic milestone!

Here are the full patch notes:

• system: use correct type for IP when killing active states in “lockout_handler” (reported by Omar Habra of Apex Security Research)
• system: reject a null gateway in getGatewayAction()
• system: add “latency_avg” as sanity check for running dpinger
• system: missing chown in backup call for proper non-root web GUI access
• system: do not allow system scope users to be renamed
• reporting: unbound: add DNSSEC status column in details grid
• interfaces: add interface configuration settings in new assignments page
• interfaces: prevent interface_configure() from reloading non-interface hooks when in batch mode
• interfaces: improve queue build sequence in interfaces_dependencies()
• interfaces: remove stale VIP address after update (contributed by ExpRam)
• interfaces: be more conservative with -no_dad
• interfaces: add a new ‘updateip’ hook
• firewall: aliases: reject reversed port ranges
• firewall: destination NAT: fix destination for no-rdr rules (reported by fa1k3)
• firewall: destination NAT: add safety guards for calculated port ranges
• ipsec: add “replay_window” option to children
• monit: log from the first line and reconfigure through the base class (contributed by IvanTheGeek)
• openvpn: default keepalive to “10 60” in server mode and improve validation
• bootgrid: upgrade Tabulator to version 6.5.3
• mvc: disable Nginx reverse proxy buffering on configd streams
• mvc: dispatch failed message during reconfiguredAction()
• mvc: PortField: keep the first well-known service in the option list (contributed by fa1k3)
• mvc: PortField: always return a string for normalizedPort()
• mvc: UidField: allow an arbitrarily specified UID for system scope users upon creation
• ui: do not add the spinner again when it fails
• plugins: add error returns to plugins_configure()
• plugins: os-ndp-proxy-go 1.5
• src: sysvsem: heap out-of-bounds access in semop(2)
• src: ktls: remote DoS via receive-side kernel TLS
• src: udp: IPv6 UDP sendto(2) bypasses jail loopback restriction
• src: vfs: multiple jail filesystem root escapes
• src: openssl: out-of-bounds read in OpenSSL DTLS retransmission
• src: kqueue: memory safety bugs in kqueue copy-on-fork implementation
• src: syslogd: fix leaking child processes when logging to a pipe
• src: iflib: do not hold the ifnet lock across registration
• src: ixgbe: correct Wake-on-LAN configuration
• src: dummynet: do not overflow the points[ED_MAX_SAMPLES_NO] array
• src: pf: mark non-port packets to require IP checksumming
• src: pf: set the correct type for rule timeouts
• src: loopback: improve checksum offloading
• src: vlan: use the exclusive lock everywhere
• src: routing: initialize V_rt_numfibs earlier during boot
• src: raw ip: clear sin_port on bind(2)
• src: nd6: fix regeneration of temp addresses in detached state
• src: hyperv: fix single page invalidation path
• src: route/fib_algo: fix nexthop index collision across families
• src: ice: do not leave device non-functional if Tx scheduler config fails
• src: netipsec: fix V_spd_size updates
• src: bnxt: assorted updates from stable/15
• src: ixl: assorted updates from stable/15
• src: linxkpi: assorted updates from stable/15
• src: net80211: assorted updates from stable/15
• src: pci: assorted updates from stable/15
• ports: ca_root_nss / nss 3.130
• ports: expat 2.8.5
• ports: pcre2 10.49
• ports: phalcon 5.22.1
• ports: php 8.5.11
• ports: py-duckdb 1.5.6

This update fixes a few security related things and updates to OpenSSL 3.5.9. We are also updating the package manager to version 2.8.4 to sync up with the current version being used in FreeBSD.

The default password hash changes from bcrypt to argon2id. If you wish to benefit from this change your hashed passwords need to be changed. Note that this step is optional. All bcrypt-hashed passwords will continue to work.

The firewall outbound NAT page moves to the legacy plugin. Note that you can still migrate your rules without the plugin installed via the migration assistant and the outbound rules will continue to work even when the legacy plugin is not installed.

Since work on the interface settings API is progressing nicely, there is also work being done on the backend which is already featured in this release. It is now possible to debug the interface ordering sequence at boot, which will also help bring in more optimizations in the near future.

Here are the full patch notes:

• system: clear password change session flag only after password was changed (reported by Wu Wenhao)
• system: change diag.disk to return total bytes as well as formatted bytes
• system: fix HA service restart with “id” parameter set
• system: add webgui PAM config to test with opnsense-login
• system: switch password hashing from bcrypt to argon2id
• interfaces: refactor interfaces_loopback_configure() and add ::1/128 sync
• interfaces: fix PHP warnings in interfaces.php and do not write unset options
• interfaces: fix linter complaints in WLAN model, 11a typo and wpa_pairwise labels
• interfaces: dhclient handles keywords case-insensitive so properly match all “media” invokes (reported by Alice-Sabrina-Ivy)
• interfaces: refactor interfaces_ppps_hardware() and avoid emitting serial device nodes
• interfaces: allow to push $all_plugins in interface_configure()
• interfaces: retire problematic validations in interface settings pertaining to legacy ISC-DHCP plugin
• interfaces: stricter archive command in backend for packet capture download
• interfaces: split out interfaces_dependencies() and make it digestible via pluginctl -Q
• firewall: outbound NAT moves to legacy plugin
• firewall: remove handling loopback addresses as “private”
• firewall: fix expiry cron job default when alias TTL is smaller than 1 hour
• firewall: use font-awesome elements for data tree controls to align with themes
• firmware: opnsense-patch: added -R mode and updated -N mode
• firmware: opnsense-prefetch: get remote size and print mismatches
• firmware: opnsense-prefetch: curl use is now optional
• firmware: add simple prompt to console changelog viewer
• kea: add ping check settings for subnet configuration (contributed by laozhoubuluo)
• monit: change “logfile” to “log” to fix syntax on newer daemon
• acl: fix patterns for gateway groups (contributed by Andrew Ferk)
• acl: merge the Dhcrelay log file pattern into the main ACL
• bootgrid: exclude header cells from status color rendering
• mvc: guard direct config saves against user-config-readonly (contributed by Andrew Ferk)
• ui: remove defunct content-box-main usage
• ui: make settings-changed trigger overridable
• ui: fix blank bottom UI space (contributed by Konstantinos Spartalis)
• plugins: os-ddclient 1.32
• plugins: os-firewall-legacy 1.1
• plugins: os-net-snmp 1.7
• plugins: os-puppet-agent 2.0
• plugins: os-sftp-backup 1.2 verify backups after put
• plugins: os-theme-cicada 1.42 (contributed by Greelan)
• plugins: os-theme-tukan 1.32 (contributed by Team Rebellion)
• plugins: os-theme-vicuna 1.52 (contributed by Team Rebellion)
• ports: openssl 3.5.9
• ports: phalcon 5.22.0
• ports: pkg 2.8.4

Today we are rolling out the wireless device MVC/API rework and a final push for better source NAT replacement over outbound NAT.

StrongSwan was updated to 6.1.0 and the GUI now offers a small recommended set of post-quantum key exchanges.

You may also find the GUI tweaks for advanced option marker and a dialog search field helpful.

There is a lot more going on as you can see from this changelog, but more on this and future plans later!

Here are the full patch notes:

• system: audit log injection via login username in auth_log()
• system: add pfsync version 1500 to HA settings (contributed by Bjoern Jakobsen)
• system: add hidden services so they can be operated by pluginctl -s
• system: privlege separated reload in static PHP pages
• system: lower priority of automatic wg/ipsec gateways
• system: fix disk widget loading issue (contributed by Konstantinos Spartalis)
• system: add back the service widget link
• system: make compare operator in authTOTP() more strict
• interfaces: migrate wireless configuration to MVC/API
• interfaces: return an empty string which cannot be an interface in convert_real_interface_to_friendly_interface_name()
• interfaces: ppp-ipv6.php may be executed before later stages of interface_configure()
• interfaces: provide “uuid” in legacy_config_get_interfaces()
• interfaces: split media and mediaopt with tabs instead of spaces
• interfaces: a few config_read_array() replacements
• interfaces: refactor device matching around interface_parent_devices()
• interfaces: remove cua matching from PPP device pattern
• firewall: source NAT: add pool options and source hash key
• firewall: source NAT: fix port alias and well known port usage in target_port
• firewall: make source and destination NAT automatic rules visible in GUI
• firewall: implement JsonAuditField in all MVC components
• firewall: update the internally reserved pf keywords for FreeBSD 15
• firewall: add source NAT migration banner to outbound NAT
• firewall: add private network exclusions to default IPv6 bogons (contributed by Maurice Walker)
• dnsmasq: leases sorting fixes (contributed by Greelan)
• firmware: opnsense-bootstrap: fix bootstrap on FreeBSD 15 with pkgbase
• firmware: opnsense-prefetch: new tool for sets prefetching
• firmware: opnsense-sign: shell compatibility update
• firmware: adjust the incompatible pkg test
• firmware: disable FreeBSD-base repository and remove old definitions
• intrusion detection: fix displaying URL in descriptions (contributed by Konstantinos Spartalis)
• ipsec: add some hybrid post-quantum variants as additional key exchange
• kea: fix leases sorting (contributed by Greelan)
• openvpn: moved legacy CARP hook to os-openvpn-legacy plugin
• acl: fix API patters for GIF/GRE device settings
• acl: add missing and fix some issues (contributed by Konstantinos Spartalis)
• backend: add CLOEXEC to a few file descriptor opens to avoid lock inheritance
• mvc: advanced marker for form/dialog fields
• mvc: fix stale imports for Message classes
• mvc: JsonAduditField: shared implementation for configuration revision tracking
• rc: add watchdog to shutdown, reboot and reload_all cases
• ui: fix widget bottom gap in standard theme files (contributed by Konstantinos Spartalis)
• ui: sidebar fixes and rework (contributed by Team Rebellion)
• ui: remove spurious _formDialog portion of dialog IDs
• ui: implement dialog search field
• ui: ensure a minimum amount of rows to render in grids
• plugins: os-acme-client 4.17
• plugins: os-theme-rebellion 1.9.8 (contributed by Team Rebellion)
• plugins: os-turnserver 1.4
• src: ciss: revert patch that added max physical target
• src: pf: do not set a null rule pointer during test
• src: pf: fix securelevel off-by-one
• src: pfctl: fix printing of wildcard anchors
• src: e1000: more assorted upstream patches from stable/15
• src: ixgbe: assorted upstream patches from stable/15
• src: virtio_p9fs: disallow detach if a session is in progress
• src: route/fib_algo: free leaked radix_masks in radix_lockless
• src: netipsec: implement pr_disconnect for PF_KEY sockets
• src: iflib: assorted upstream patches from stable/15
• src: net: add ifmedia support for 10GBase-BX BiDi
• src: bnxt: report initialization failures to iflib
• src: bnxt: add led(4) identification support
• src: ice: add led(4) identification support
• src: ice: report initialization failures to iflib
• src: ice: add support for E835 CNSA 2.0 adapters
• src: ice: add two more 4-part IDs for E835 adapters
• src: if_vxlan: fix panic by validating unused drvspec values
• src: qat: driver updates to enhance qat infrastructure
• src: ath10k: remove some early FreeBSD-specific debugging
• src: ip(6)_mroute: assorted upstream patches from stable/15
• src: in_mcast: fix uninitialized variable usage in inm_merge()
• src: bind: lookup local address in current FIB if ‘*.bind_all_fibs’ is active
• src: net: add fib-aware ifa_ifwithaddr()
• ports: ca_root_nss / nss 3.129
• ports: curl 8.22.0
• ports: dhcp6c fix for truncated env vars in dhcp6c-script (contributed by Michael Zimmermann)
• ports: expat 2.8.4
• ports: filterlog 0.9 support for pflog actions on FreeBSD 15
• ports: libxml 2.15.4
• ports: openldap 2.6.15
• ports: pcre2 10.48
• ports: php 8.5.10
• ports: phpseclib 3.0.57
• ports: strongswan 6.1.0

A hotfix release was issued as 26.7.4_1:

• ui: only schedule grid dimension changes after data processing, window resizing and table visibility changes
• ports: suricata 8.0.7
• ports: unbound 1.26.1

Here is your biweekly dose of bugfixes and quality of life improvements! This update offers several new features: VLANs on bridges, “received-on” firewall rule support, persistent rule label tracking, repeatable WireGuard QR codes, menu favourites and full screen grid support. On top of that it bundles the recent FreeBSD 15.1-RELEASE-p3, fixes and cleanups as well as third party updates such as OpenSSL 3.5.8 and OpenSSH 10.5p1. Enjoy. :)

Meanwhile, development is busy with adding interface settings to the new MVC assignments page, which includes building wireless MVC/API support. That is all for now. Need to get back to work.

Here are the full patch notes:

system

• offer post-quantum mldsa44-ed25519 OpenSSH server host key
• do not regenerate all OpenSSH key files when adding new key types
• truncate long names in services dashboard widget (contributed by circa1665)
• use created user name for change event (contributed by Julian Pawlowski)
• handle missing objects during deletion in API (contributed by Julian Pawlowski)
• multiple PHP warning fixes (contributed by Julian Pawlowski)
• avoid filter_configure() calls to make existing backend call less obscure
• add favorites section to menu (contributed by Greelan)
• approximate user being expired for the grid view icon
• replace cron restart in static PHP pages
• fix server certificate purpose detection for EC

interfaces

• permit a VLAN device as bridge member
• resolve VLAN devices indirectly via interfaces_configure()
• handle missing GRE and GIF during deletion in API (contributed by Julian Pawlowski)
• multiple PHP warning fixes (contributed by Julian Pawlowski)
• emit discovered hosts sorted by last_seen via hostwatch

captive portal

• exclude IPv4 from roaming logic

dhcrelay

• add options for circuit_id and remote_id (contributed by Thomas Cheyney)

dnsmasq

• remove count badge from GroupBy with static configuration elements
• add “expand-hosts” option (contributed by Konstantinos Spartalis)

firewall

• remove 2a10::/12 from bogonsv6.sample (contributed by Belgarion)
• deprecate old rule register function names due to functional overlaps
• add missing TLS ports to well-known ports (contributed by Self-Hosting-Group)
• use new “rlabel” from pfctl for persistent rule identification across reloads
• emit gateway debug message in block rules only when gateway is not empty
• aliases: use same dynamic label as in KEA DHCPv6 for a unified look
• aliases: fix spinner on alias dialog save button
• destination NAT: make local-port numeric before applying range in registered firewall rule (contributed by Thomas Cheyney)
• rules: add “received-on” interface keyword as interface origin option
• rules: promote “statetype” from advanced to common option for “received-on” usage

firmware

• revoke 26.1 fingerprint

kea

• remove count badge from GroupBy with static configuration elements
• use DOM construction for the “dynamic” label

network time

• strict security GUI support

unbound

• update Hagezi blocklists to use new mirror URL

wireguard

• FreeBSD 15 no longer allows addresses without netmasks
• cleaner QR codes (contributed by Roy Orbitson)
• preserve peer generator state for existing peers

mvc

• BaseField: add getInitialValue()
• OptionField: fix simplified option group definition
• fix typo in base_form.volt advanced/help toggle IDs
• fix assorted stale imports in the code base

ui

• tabulator: add _showMaximized() modal that can show a grid close to full screen
• add keyboard shortcut “f” to maximize a currently visible grid
• scope “all help” and “advanced mode” toggle to closest relevant form
• trigger “h” and “a” keyboard shortcuts on all relevant matches

plugins

• os-caddy 2.2.1
• os-frr 1.55
• os-theme-rebellion 1.9.7 (contributed by Team Rebellion)

src

• posixshm: fix a TOCTOU race in the FIOSSHMLPGCNF handler
• tty: revalidate after dropping the tty lock in ioctl handlers
• ppp: fix multiple vulnerabilities
• openssl: fix multiple vulnerabilities
• cred: fix group_is_primary()
• dsp: fix a potential use-after-free in dsp_oss_syncstart()
• unix: fix some bugs in the SOCK_STREAM receive path
• hwpmc: fix the execve handler
• ucode: fix validation on Intel platforms
• netmap: fix driver name handling
• netmap: fix a race in kqueue registration
• e1000: assorted upstream patches from stable/15
• route: add an eventhandler for rt_numfibs changes
• rawip: fix handling of checksums in rip6_input()
• pf: attempt to handle overlapping group and interface names
• pf: check if a group has a kif before dereferencing it
• pf: fix fallout from the STATE_LOOKUP macro removal
• pf: re-optimize state key handling
• pf: rule label patch was merged from a wrong version
• pfsync: handle large MTU pfsync interfaces
• ktls: propagate EPG_FLAG_ANON to mapped mbufs
• netipsec: fix sockaddr type set in ipcomp6_nonexp_encapcheck()
• src: PF_KEY socket: limit the length of copied socket address
• ure: add USB device IDs for additional RTL8152/RTL8153 adapters
• ure: fix spurious link flaps from MII

ports

• ca_root_nss / nss 3.127
• expat 2.8.3
• kea 3.0.4
• monit 6.0.0
• openssh 10.5p1
• openssl 3.5.8
• perl 5.42.3
• phalcon 5.20.3
• php 8.5.9
• rrdtool 1.11.0
• sqlite 3.53.4

hotfix release 26.7.3_2

• interfaces: add missing PPP support to interface_parent_devices()
• firewall: source NAT: fix faulty import removal

hotfix release 26.7.3_8

• system: normalize output of get_nameservers()
• interfaces: prevent inline reloads of VLANs via rc.linkup
• interfaces: batch VIP post-reload for proxyarp/pfsync
• monit: use LIBXML_NOCDATA on XML fetch
• ui: improve form matching for help/advanced
• ui: fix _showMaximized() height calculation when mobile navigation triggers below 768px width

hotfix release 26.7.3_11

• system: flush volt template cache in shared action
• interfaces: exclude VLAN devices from virtual queue
• ui: attach selectors piped through replaceInputWithSelector to body
• ports: openvpn 2.7.7

A hotfix release was issued as 25.10.2_3:

• captive portal: fix hard-timeout calculation
• firmware: avoid update-hook background cleanups
• mvc: fix CSRF vulnerability in multiple API endpoints by enforcing POST-only requests (contributed by Oliver Jueguen)
• src: file: qualify pointers to capsicum rights as const
• src: file: add a fd flag with O_RESOLVE_BENEATH semantics
• src: file: Fix the !CAPABILITIES build
• src: unix: Set O_RESOLVE_BENEATH on fds transferred between jails
• src: rtsock: Fix stack overflow

This business release is based on the OPNsense 26.1.11 community version with additional reliability improvements.

Please note that this release offers source NAT as a tentative replacement for outbound NAT. Feature parity is a work in progress for the 26.10 series. For now, please be aware that source NAT continues to work as before, but the GUI will not allow you to edit the source NAT rules unless you choose hybrid or manual mode in the settings. This aligns with how the outbound NAT page is working. Starting with 26.10, the hybrid or manual mode will be required to render source NAT rules into the firewall.

Full patch notes for the initial release

• system: improve the log_archive script to also work on log subdirectories
• system: routing: changed “disable” option to “enable”
• system: add “local_uri” type in SanitizeFilter() and use it to avoid hardcoding
• system: several compatible adjustments for upcoming PHP 8.5
• system: enhance live log widget (contributed by Greelan)
• system: support 7680 bit RSA type for certificates and authorities
• reporting: improve parsing in NetFlow for overlapping flow timestamps and use UTC for cleanups
• reporting: stop NetFlow service before reloading configuration
• interfaces: properly format API times to ISO format and convert timezone for display in automatic discovery
• interfaces: fix typos in GIF reconfiguration script
• interfaces: improve VIP page save when no subnet was posted
• firewall: use htmlSafe() on action search value in live log (reported by call-AX)
• firewall: always show automatic and legacy rules in new rules GUI
• firewall: add the same new rules GUI design to the MVC NAT pages
• firewall: add CSV download/upload to MVC NAT pages
• firewall: add migration for outbound NAT into source NAT page
• firewall: destination NAT: display effective port when local-port is omitted
• firewall: source NAT: allow empty target which means the interface address
• firewall: source NAT: skip rendering rules when mode is not advanced/manual or hybrid
• firewall: improve performance on MVC pages using virtualDOM
• firewall: allow WAN as “associated interface” for NPTv6 when prefix ID is set
• firewall: fix TypeError on alias getItem() with unknown UUID (contributed by haxorton)
• firewall: show rule counts that can be exported and hide tab if no rules exist
• firewall: improve interface filter logic to include floating rules with multiple interfaces when they overlap with at least one interface in the interface filter request
• firewall: add validations for “No RDR” option to prevent target and local-port being set
• firewall: fix some small issues in menu registration for legacy pages
• firewall: constraint source NAT getAction() to only general page and align setAction() accordingly
• firewall: scope get action to general settings in source NAT
• kea: prevent converting the decimal prefix_id using hexdec() for dynamic PD
• kea: add widget to show DHCP leases
• kea: simplify model option values
• kea: improve prefix watcher accuracy via both interface and MAC address key
• kea: store subnet IDs inside the model so they cannot shift during config regeneration
• kea: change dynamic pool range from prefix to range 1000-2000
• kea: switch custom DHCP option config generation to libdhcp_flex_option library
• openvpn: add some input validation for control characters in connection status (reported by lujiefsi)
• openvpn: simplify model option values
• unbound: switch AAAA-only mode from respip to block_a_wdata (contributed by Maurice Walker)
• unbound: update Hagezi blocklists to use new mirror URL
• mvc: add some missing htmlSafe() calls for generated HTML (reported by lujiefsi)
• mvc: guard BaseField::setNodes() against a list given for a scalar leaf (contributed by haxorton)
• mvc: DescriptionField: disable special and newline characters
• mvc: FileObject: fix exception bug (contributed by Greelan)
• mvc: give throwReadOnly() a sibling named throwNotFullAdmin()
• mvc: use camelCase for carp_status action
• mvc: translate backend system status messages
• mvc: translate grid view labels
• ui: add some more legacy_html_escape_form_data() safeguards (reported by Arpit Jain)
• ui: bootgrid: minor optimizations
• plugins: os-OPNDNS 1.0 is an authoritative nameserver with RFC2136 support using PowerDNS
• plugins: os-OPNWAF 2.3
• plugins: os-cloudflared 1.1
• plugins: os-freeradius 1.10.2
• plugins: os-vnstat 1.4
• src: igc: disable PCIe ASPM to improve stability
• src: ena: update driver version to v2.8.3
• src: coredump: do not assume that the number of ELF segments is consistent
• src: sysvsem: fix a TOCTOU race in semctl()
• src: wg: check for crypto operation errors
• src: tzdata: import 2026c
• ports: curl 8.21.0
• ports: lighttpd 1.4.84
• ports: openssh 10.4p1
• ports: openvpn 2.7.6
• ports: phalcon 5.16.0
• ports: py-duckdb 1.5.4
• ports: python 3.13.15
• ports: syslog-ng 4.12.0
• ports: unbound 1.26.0

Full patch notes for patch release 1

• system: audit log injection via login username in auth_log()
• system: offer post-quantum mldsa44-ed25519 OpenSSH server host key
• system: do not regenerate all OpenSSH key files when adding new key types
• system: use created user name for change event (contributed by Julian Pawlowski)
• system: fix server certificate purpose detection for EC
• system: approximate user being expired for the grid view icon
• firewall: remove 2a10::/12 from bogonsv6.sample (contributed by Belgarion)
• captive portal: exclude IPv4 from roaming logic
• plugins: os-OPNWAF 2.4
• src: posixshm: fix a TOCTOU race in the FIOSSHMLPGCNF handler
• src: tty: revalidate after dropping the tty lock in ioctl handlers
• src: ppp: fix multiple vulnerabilities
• src: openssl: fix more vulnerabilities
• src: dsp: fix a potential use-after-free in dsp_oss_syncstart()
• src: hwpmc: fix the execve handler
• src: ucode: fix validation on Intel platforms
• ports: openssh 10.5p1
• ports: openssl 3.0.22
• ports: openvpn 2.7.7

Full patch notes for patch release 2

• system: make compare operator in authTOTP() more strict
• interfaces: ppp-ipv6.php may be executed before later stages of interface_configure()
• ipsec: add some hybrid post-quantum variants as additional key exchange
• acl: fix API patters for GIF/GRE device settings
• acl: add missing and fix some issues (contributed by Konstantinos Spartalis)
• rc: add watchdog to shutdown, reboot and reload_all cases
• ports: strongswan 6.1.0
• ports: suricata 8.0.7
• ports: unbound 1.26.1

Full patch notes for patch release 3

• system: clear password change session flag only after password was changed (reported by Wu Wenhao)
• system: use correct type for IP when killing active states in “lockout_handler” (reported by Omar Habra of Apex Security Research)
• system: fix HA service restart with “id” parameter set
• interfaces: dhclient handles keywords case-insensitive so properly match all “media” invokes (reported by Alice-Sabrina-Ivy)
• interfaces: stricter archive command in backend for packet capture download
• firewall: fix expiry cron job default when alias TTL is smaller than 1 hour
• plugins: os-OPNBEcore 1.9
• plugins: os-OPNWAF 2.5
• src: sysvsem: heap out-of-bounds access in semop(2)
• src: ktls: remote DoS via receive-side kernel TLS
• src: udp: IPv6 UDP sendto(2) bypasses jail loopback restriction
• src: vfs: multiple jail filesystem root escapes
• src: openssl: out-of-bounds read in OpenSSL DTLS retransmission
• ports: expat 2.8.5