Search changelog entries
| Component | Change |
|---|---|
| console | updated copyright notice; |
| ethernet | improved system stability for RB912, RB911 devices; |
| mac-server | fixed configuration change for "interface-list" property; |
| routerboard | do not show "upgrade-firmware" if available installation is older than minimal supported one; |
| Component | Change |
|---|---|
| bridge | fixed forwarding through peer-port after disabling MLAG; |
| bridge | fixed stability issue when using DHCPv4 snooping; |
| bridge | improved STP, BPDU and topology change handling with MLAG, ensure dual-connected port STP state is in sync with MLAG peer; |
| console | added comparison operators for array type (additional fixes); |
| console | improved script handling and error logging when running scripts from external sources (e.g. DHCP, SNMP, Netwatch, etc.) (additional fixes); |
| dhcpv4-server | set "ciaddr" in forcerenew messages so a relay, if used, can unicast such messages; |
| discovery | added "dying-gasp" feature for LLDP, MNDP, CDP that sends packet with "TTL=0" before graceful reboot/shutdown/upgrade; |
| discovery | clear neighbor entry when receiving "dying-gasp" packet; |
| l3hw | added HW offloaded VRF support on 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98CX8410 switches (additional fixes); |
| l3hw | allow VLAN tagged traffic inside VXLAN tunnel; |
| l3hw | fixed VTEP offload on IPv4 /32 route changes; |
| lte | added force-confirmation parameter for eSIM provision command; |
| lte | do not query 5G neighbor cell info until RG650E-EU FW fixed; |
| lte | fixed cases where R11l-LTE7 modem would not display correct cell info after handover; |
| netinstall | added Netinstall package (additional fixes); |
| ospf | fixed stability issue during interface flaps; |
| ppp | added iccid field to ppp info command for BG77 and BG770 modems; |
| ppp | always show current FW version when running firmware-upgrade; |
| ppp | get IPv6 configuration via RA for modems using PPP emulation mode; |
| ppp | toggle radio state on interface disable/enable; |
| wifi-mediatek | improved stability during MLO channel switching; |
| winbox | do not pre-fill "Allowed Address" and "Client Allowed Address" with "::/0" when adding new WireGuard Peer; |
| Component | Change |
|---|---|
| app | added "HF_TOKEN" env to openwebui; |
| app | added "network-outgoing-access" parameter which does not allow app to make outgoing connections; |
| app | added hermes-agent; |
| app | allow "reset" even if disk not configured; |
| app | allow setting "working_dir" in app YAML; |
| app | fixed "reset" not working with certain apps; |
| app | fixed apps not updating firewall redirects when changed in YAML; |
| app | fixed apps sometimes getting stuck on "waiting for layer"; |
| app | only generate secrets for enabled apps; |
| app | removed healthcheck from opencloud-extended-collabora; |
| app | resolved issue where duplicate swaps are created; |
| app | show CHR's address instead of the container's; |
| bgp | improved stability when receiving malformed packets; |
| bridge | added scheduling point during VLAN processing to prevent soft lockups when flushing FDB over large VLAN ranges; |
| bridge | fixed local static host entries (additional fixes); |
| bridge | fixed MLAG MAC address handling issues related to aging, flushing and moving; |
| bridge | fixed stuck MLAG session when using mismatched L2MTU (introduced in v7.23); |
| bridge | temporarily reverted ARP inspection and IP source guard support (introduced in v7.24beta2); |
| certificate | use AES encryption when exporting certificates in PKCS#12 format; |
| console | added comparison operators for array type; |
| console | fixed issues with multi-argument properties (introduced in v7.24beta2); |
| console | renamed "reauth-timeout" to "reauth-period" in "/interface/dot1x/server" (backwards compatible via deprecation); |
| container | added "save" command to allow saving container images; |
| container | added "swap-current" usage; |
| container | added "swap-max" global and per-container limit; |
| container | added ability to run containers in privileged mode; |
| container | added initial support for RKE2; |
| container | fixed container "devices" override to appear under "/dev"; |
| container | improved layer size calculation to avoid potential loops; |
| discovery | added "last-breath" feature (additional fixes); |
| disk | resolved issue where storage device may change information upon reboot; |
| ethernet | fixed stability issue for Chateau PRO ax devices; |
| ethernet | fixed stability issue for devices with Alpine CPU; |
| ipsec | fixed policy move handling; |
| ipsec,ike1 | fixed negotiated PFS validation; |
| ipsec,ike2 | improved PPK handling by always using it when authorized, including additional Child SAs, and moved PPK processing to the Child SA task; |
| ipsec,qkd | moved QKD to "/system/keymat-provider" menu and made it a generic key material provider; |
| ipv6,ra | fixed prefix invalidation (additional fixes); |
| leds | added dark mode support for hAP ax2, hAP ax3, hEX refresh, hEX S (2025), hAP ax S and Chateau ax devices; |
| leds | fixed missing wireless LED configuration (introduced in v7.21); |
| lte | enabled AT registration unsolicited event reporting for EG25-G and EC25-EU boards; |
| lte | fixed cases where EC25-EU and EG25-G boards would receive packets with missing last 4 bytes; |
| lte | fixed IPv6 RA handling for multiapn non-primary interface; |
| lte | limit IPv6 prefix lifetime only when lifetime is advertised as infinity (additional fixes); |
| netwatch | fixed an issue with DNS probe "timeout" parameter; |
| netwatch | fixed HTTP GET probe over IPv6; |
| poe-out | firmware update for 802.3at capable boards (the update will cause a brief power interruption to poe-out interfaces); |
| poe-out | firmware update for 802.3bt capable boards (the update will cause a brief power interruption to poe-out interfaces); |
| ppp | fixed cases where BG77 or BG770 firmware upgrade was not available; |
| ppp | improved "info" command for BG77 and BG770 modems (additional fixes); |
| routerboard | renamed "ipq53xx" firmware type to "ipq5300"; |
| supout | added LTE eSIM section; |
| upgrade | prevent package scheduling from interfering with the upgrade feature; |
| wifi | updated radio regulatory information; |
| wifi-mediatek | improved channel switching; |
| wifi-qcom | fixed connectivity after interrupted DFS channel availability check (introduced in v7.24beta2); |
| Component | Change |
|---|---|
| app | allow HTTP for Gitea when "check-certificate=no"; |
| app | fixed home-assistant default config files; |
| app | fixed making empty directories when running configuration export; |
| app | make secrets sensitive to avoid polluting configuration export; |
| bgp | fixed advertisement print handling by "dst" when destination is in VRF; |
| bgp | fixed EVPN label corruption and correct EVPN type-5 output; |
| bgp | fixed IPv6 End-of-Route processing; |
| bgp | improved stability on MP (multiprotocol) parsing; |
| bgp | removed "save-to" from "resend" command; |
| bgp-vpn | fixed blackhole route export; |
| bridge | added ARP inspection and IP source guard support; |
| certificate | always use all trust stores for downloaded CRL validation; |
| certificate | general improvements in certificate handling; |
| console | fixed argument mappings in "do" block for monitor commands; |
| console | fixed missing comments in scripts (introduced in v7.24beta1); |
| console | fixed proplist order in monitor commands; |
| console | fixed quoted input issues for multi-argument properties; |
| console | fixed UTF-8 comparisons on some architectures; |
| console | improved "print detail" mode; |
| console | make execute non-blocking when file parameter is used (introduced in v7.24beta1); |
| container | fixed missing config.json issue when upgrading from version 7.20.8 or older; |
| defconf | set "configuration.dtim-period=3" for WiFi; |
| defconf | use "add-dns-entries=yes" on devices with DHCP server; |
| dhcp | fixed processing of DHCP options that are longer than 255 bytes; |
| discovery | added "discovery" logging topic (additional fixes); |
| discovery | added "last-breath" feature; |
| disk | added "last-seen" property that displays disk model and serial when removed; |
| disk | added error message when disk state transitions from good to bad; |
| disk | avoid reading SCSI stats all the time to allow disks to go to sleep; |
| disk | improved error message when a swap file is created without "file-size" specified; |
| ethernet | removed "1G-baseT-half" link mode on RTL8367 switch; |
| fetch | added option to force HTTP/2 only (only for ARM64 and x86/CHR devices); |
| interface | fixed duplicate MAC warning for wireless, wifi, macsec, w60g interfaces (introduced in v7.23); |
| ip-service | show service name for "l2tp"; |
| ipsec,ike2 | fixed active connection termination; |
| ipsec,ike2 | fixed SA payload validation; |
| ipsec,ike2 | improved pending child SA cleanup and removal of dangling SAs during Phase 2 deletion; |
| ipv6,ra | correctly process RAs advertising previously expired prefix; |
| ipv6,ra | fixed prefix invalidation; |
| isis | fixed missing "l2.lsp-refresh-interval" parameter; |
| l2tp | allow fragmentation of large IPv6 packets; |
| l3hw | added HW offloaded VRF support on 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98CX8410 switches (additional fixes); |
| leds | added dark mode support for L009; |
| lte | cap IPv6 prefix lifetime for ipv6-interface; |
| lte | do not add extra /128 IPv6 address for ipv6-interface; |
| lte | limit IPv6 prefix lifetime only when lifetime is advertised as infinity; |
| lte | make modem MAC persistent for R11e-LTE6 and R11l-LTE7 modems; |
| lte | remove site local DNS for ipv6-interface; |
| netwatch | fixed issue where ICMP probes did not accept TTL exceeded packets when "accept-icmp-time-exceeded" was enabled; |
| netwatch | increased maximum packet size to 65535; |
| ospf | added missing interface parameters (additional fixes); |
| ospf | allow comments on static interfaces; |
| ospf | fixed interface passive flag update in WinBox; |
| ospf | fixed unresolved route problem when "routing-table" setting is used; |
| pimsm | make "hash-mask-length" parameter naming consistent and fixed typos; |
| poe-out | firmware update for 802.3at capable boards (the update will cause a brief power interruption to poe-out interfaces); |
| poe-out | firmware update for 802.3bt capable boards (the update will cause a brief power interruption to poe-out interfaces); |
| ppp | disable/enable modem radio state depending on ppp interface state (additional fixes); |
| ppp | fixed ppp-out stability issue (additional fixes); |
| ppp | improved "info" command for BG77 and BG770 modems; |
| ppp | only show pin in export with "show-sensitive" flag; |
| route | allow to add route with link-local destination address; |
| route | fixed memory leak when flapping addresses or interfaces with routing protocols running; |
| route | fixed static route flag handling by WinBox on disable; |
| sftp | fixed branding package upload; |
| switch | increase "ingress-rate" and "egress-rate" maximum value to 400G; |
| traffic-generator | fixed injecting pcap/pcapng files on MIPSBE architecture; |
| tunnel | fixed stability issue caused by a misconfigured routing loop under bridge (introduced in v7.22); |
| vrrp | fixed stability issue when "sync-connection-tracking" is enabled; |
| wifi | improved roaming/steering behavior for WiFi 7 MLO (additional fixes); |
| wifi | upgraded wifi-qcom driver; |
| winbox | added "Network" configuration menu for WiFi; |
| winbox | added missing values to "AFI" setting under "Routing/BGP" menus; |
| winbox | fixed "Connection Bytes" field under "IP/Firewall" menu; |
| winbox | fixed "EC/IO" scaling for LTE interface; |
| winbox | fixed empty value in "Immediate Gateway" under "IP/Routes" menu; |
| winbox | fixed value unset under "MPLS/LDP Neighbor" menu; |
| winbox | fixed WinBox v3 stability issue when Netinstall package is enabled (introduced in v7.24beta1); |
| winbox | move "EAP" under "Security" tab for WiFi; |
| winbox | show priority bits in "VLAN ID" field under "Tools/Packet Sniffer" menu; |
| wireguard | fixed peer recreation on interface change; |
| x86 | fixed IRQ displaying per CPU on Intel 700 series NIC; |
| Component | Change |
|---|---|
| app | fixed bogus configuration export; |
| app | fixed making empty directories when running configuration export; |
| bgp | fixed memory leak; |
| bridge | fixed stability issue when using DHCPv4 snooping; |
| disk | avoid reading SCSI stats all the time to allow disks to go to sleep; |
| disk | improved error message when a swap file is created without "file-size" specified; |
| ethernet | fixed stability issue with TSO on Alpine CPUs; |
| firewall | improved system stability; |
| ipsec,ike2 | improved TSi validation to prevent modecfg address conflicts; |
| ipv6 | do not disable IPv6 FastPath when Traffic Flow is enabled; |
| ospf | added missing interface parameters; |
| ospf | fixed unresolved route problem when "routing-table" setting is used; |
| ptp | rename "smpte" to "smpte-2059"; |
| route | improved overall stability; |
| route | removed deprecated "/routing/route/rule" menu; |
| switch | fixed rare possibility of tx-timeout or simultaneous flap of all switch ports on devices with Alpine CPUs; |