Version: 7.25
Stable288 changelog entries across 68 component(s)
2026-Oct-22 (1 week ago)
| Component | Change |
|---|---|
| app | add the networkRouterIP variable for container apps; |
| app | allow the privileged mode to be enabled per service in the container app YAML; |
| app | fix CHR apps getting stuck on "starting" on slower boards; |
| app | show an error when an app variable cannot be resolved; |
| app | update the environment variables of the docker-with-komodo app; |
| bgp | add the always-compare-med setting; |
| bgp | fix BGP unnumbered connections within a VRF; |
| bgp | include the VNI number in outgoing EVPN routes; |
| bgp | log failed BGP connection attempts; |
| bgp | show interface names and VRF names in BGP logs; |
| bridge | add dynamic ARP inspection; |
| bridge | add IP source guard; |
| bridge | add mlag-lacp-fallback and mlag-init-delay settings for MLAG; |
| bridge | fix a false "already added as bridge port" error; |
| bridge | fix an MLAG peer getting stuck in the disabled state after config changes; |
| bridge | fix bridge ports not forwarding; |
| bridge | fix fragmented IPv6 traffic being dropped by DHCPv6 snooping (introduced in v7.23); |
| bridge | fix VRRP MAC behavior in MLAG setups; |
| bridge | improve FDB synchronization between MLAG peers when VLANs are added; |
| bridge | make MVRP work with MLAG dual bonds; |
| bridge | make the DHCP snooping log messages clearer and informative; |
| bridge | rename the IGMP last-member-interval property to last-member-query-interval; |
| bridge | warn about VLAN entries when vlan-filtering is disabled; |
| bth | add default client DNS and allowed IPs settings; |
| bth | add resumable file uploads; |
| bth | check the available disk space before a file upload; |
| bth | fix file share issues when enabled through WinBox files menu; |
| bth | fix the file share getting stuck when disabling; |
| bth | return upload errors in JSON format; |
| capsman | add hw-protection-threshold; |
| capsman | fix the last-ip value being shown backwards; |
| certificate | fix ACME certificate issuance for wildcard domains; |
| certificate | refactor certificate internal processes; |
| console | allow the array access operator to accept arrays of indices or keys; |
| console | expose globals in the API; |
| console | fix background ":execute as-string" jobs not terminating on interrupt; |
| console | fix comment wrapping in the monitor command; |
| console | fix inconsistent /ip/firewall/filter print with src-address-list and dst-address-list; |
| console | fix the where filter ignoring flags set to false; |
| console | improve export order; |
| console | improve stability when running scripts from Dude; |
| console | prevent an out-of-memory condition when ":execute as-string" produces large output; |
| console | prevent duplicate entries in /port/remote-access; |
| container | add a Ctrl-] escape sequence to exit a stuck container shell; |
| container | fix container interface handling on CHR; |
| container | fix veth interface left running after restarting a stopped container; |
| container | require the container device-mode to enable swap; |
| crypto | fix a possible crash during IPsec processing on Qualcomm devices; |
| defconf | fix button script policies; |
| defconf | fix default configuration generation when CRS8xx series switch ports initialize late; |
| detnet | use a single random source port; |
| dhcpv4-client | ignore forcerenew packets that are not unicasted to client; |
| dhcpv4-server | add ipv6-only-preferred parameter to respect option 108; |
| dhcpv4-server | show DHCP option 82 parameters in ASCII in addition to hex; |
| dhcpv6-client | add option 39 with the client hostname; |
| dhcpv6-client | fix DHCPv6 client address handling after prefix-hint changes; |
| dhcpv6-client | remove a duplicate dhcp-options parameter; |
| dhcpv6-relay | use the packet's source MAC for option 79 if relay and client are on the same link layer; |
| dhcpv6-server | add option 39 (FQDN) support and add-dns-entries option; |
| dhcpv6-server | fix send-reconfigure for DHCPv6 clients behind a relay; |
| disk | fix all-zero NGUIDs on NVMe over TCP exported namespaces; |
| disk | improve RAID5/6 throughput; |
| dns | fix resolving domain names that end with a dot; |
| dot1x | rename the reauth-timeout to reauth-period; |
| dude | fix the server not starting at boot when data-directory is on a USB disk; |
| fix server certificate verification; | |
| show certificate related errors in the log; | |
| ethernet | add the arp-accept parameter for interfaces with MAC; |
| ethernet | fix a stability issue on RB1100AHx2 under heavy traffic; |
| ethernet | fix bogus fast-path Rx traffic reported on an unconnected ether8 port on RB5009; |
| ethernet | fix link flap and unexpected reboots on RB5009; |
| ethernet | fix occasional packet loss on hAP be3 Media; |
| ethernet | fix PPPoE link flapping on Intel X710; |
| ethernet | fix PPPoE over VLAN not working on Mellanox ConnectX-4; |
| ethernet | fix SFP compatibility on hAP ax S and hEX S (2025) devices; |
| ethernet | improve stability on x86 routers with Mellanox NICs; |
| evpn | publish MAC-IP routes (RT-2) for neighbors; |
| fetch | improve upload state reporting when using sftp; |
| fetch | never set a cookie jar for HTTP requests; |
| fetch | show a clearer error when keep-result and output are both used; |
| firewall | add NAT-related fields to CEF format logging; |
| hardware | show the device name and location in /system/resource/hardware menu; |
| igmp-proxy | improve stability when changing /routing/igmp-proxy parameters; |
| iot | add a GPIO menu in WinBox; |
| iot | add Bluetooth output power control; |
| iot | allow custom radio plan usage under regional lock; |
| iot | enforce the fixed antenna gain on boards with an embedded antenna; |
| iot | fix round-trip-time timing issues in LoRaWAN Basic Station; |
| ip-service | fix services becoming unreachable after their VRF is disabled and re-enabled; |
| ipsec | add XFRM interface support; |
| ipsec | fix IKEv1 tunnels failing to establish when the commit bit is set; |
| ipsec | fix IKEv2 EAP-TTLS client failing with invalid trust store (introduced in v7.21); |
| ipsec | fix IPsec tunnels failing after migration from the old QKD settings; |
| ipsec | fix policy and SA handling after moving it to netlink; |
| ipv6 | fix a failure when releasing DHCPv6 prefix delegation pools; |
| ipv6 | fix cases when address is lost after reboot if prefix was taken from pool; |
| ipv6 | fix missing IPv6 link-local addresses on some interfaces when the device is busy during boot; |
| ipv6 | fix the DNS timer in router advertisements; |
| ipv6 | ignore router advertisements received on interfaces not in the accepting list; |
| l3hw | fix IPv6 link-local traffic being routed incorrectly; |
| l3hw | improve stability of L3 hardware offload when using IPv4-mapped IPv6 addresses; |
| l3hw | optimize ECMP nexthop offloading; |
| lcd | improve stability when an SFP reports an unknown link speed; |
| leds | add dark-mode support for L41; |
| leds | fix missing LED triggers when an R11e card is installed; |
| lte | accept both y and yes for eSIM confirmation; |
| lte | add band display support for Huawei ME909s modems; |
| lte | add missing network error messages for MBIM modems; |
| lte | add the sms-protocol=qmi option for sending and reading SMS; |
| lte | do not force reconfiguration on roaming network when roaming is disabled; |
| lte | fix LTE interfaces disappearing after FOTA updates; |
| lte | fix missing MAC address on QMI LTE interfaces after the interface is recreated (introduced in v7.24.4); |
| lte | fix missing new firmware update notification on some modems; |
| lte | fix multi-APN connections not passing traffic on AT modems; |
| lte | fix the subscriber number not updating after switching SIM slots; |
| lte | improve system stability when using Quectel EP06-E MBIM modem; |
| lte | improve system stability with eSIM-capable MBIM modems; |
| lte | remove leftover APN slave interfaces when the master LTE interface is removed; |
| lte | use also the network reported ipv6 MTU on MBIM interfaces when "auto" mtu option used; |
| lte | use RA for IPv6 acquisition for FG621; |
| netinstall | add branding-and-custom-packages parameter for custom NPK packages; |
| netinstall | fix a duplicate device entry on RB2011 with SFP; |
| netinstall | fix adding and exporting server comments; |
| netinstall | fix multiple active interfaces inheriting the first interface's settings; |
| netinstall | fix Netinstall failing to reinstall RB850Gx2 devices; |
| netinstall | fix Netinstaller's memory check failing downloads to disk; |
| ospf | fix DR/BDR traffic not being received with multiple instances; |
| ospf | improve stability when a neighbor is lost; |
| ovpn | improve stability in UDP mode when the TX queue is full; |
| pim | add MLD support for PIM; |
| pim | fix duplicate PIM configuration parameters; |
| pim | fix PIM-SM issues with IPv6; |
| pim | fix wrong or missing PIM configuration by separating PIM and GMP per interface; |
| poe-out | add port-type field to poe monitor and print output; |
| poe-out | firmware update for 802.3at capable boards (the update will cause a brief power interruption to poe-out interfaces); |
| poe-out | firmware update for 802.3bt capable boards (the update will cause a brief power interruption to poe-out interfaces); |
| poe-out | fix PoE fault led behavior; |
| poe-out | fix PoE ports entering overload state when a PSU is fed from a UPS; |
| poe-out | remove the class limit for LLDP power requests on forced ports; |
| port | accumulate incoming data in log file even without TCP clients connected; |
| port | add an FTDI latency_timer option for low-latency serial applications; |
| ppp | add port interface info to PPP outbound channel defaults; |
| ppp | fix a packet leak during dial-on-demand connection of a ppp-out interface; |
| ppp | fix BG77 modem port name and channel count; |
| ppp | fix the offline firmware-update notification for BG77/BG770 modems; |
| ppp | fix the SINR value reported for BG77 and BG770 modems; |
| ptp | add support for fixed master and slave port roles; |
| ptp | add transparent clock mode; |
| ptp | fix dropped packets on bridges with IGMP snooping and add vlan-id port setting; |
| qos | fix PFC and lossless buffer issues (introduced in v7.23); |
| queue | fix a typo in the cake-overhead-scheme parameter value; |
| route | improve static route handling performance; |
| routing-filter | fix any-regexp community matcher matching an empty community attribute; |
| routing-filter | fix community delete, filter and modify with regexp-only community lists; |
| sfp | fix QSFP28 optical modules failing to establish a link on CCR2216 and CRS520; |
| sfp | improve QSFP-DD link establishing to NVIDIA DGX Spark and other devices; |
| sniffer | improve packet time resolution; |
| snmp | add an OID and logging for blacklisted program access; |
| snmp | add CAPsMAN radio data to SNMP; |
| snmp | add dynamic SNMP engine ID assignment; |
| snmp | add interface table with mtu and l2mtu OIDs; |
| snmp | add IP pool OIDs; |
| snmp | add IPv6 address and interface name to the MNDP neighbour table; |
| snmp | add OID blacklisting; |
| snmp | add OIDs for Netwatch probes; |
| snmp | add OSPF MIB tables; |
| snmp | add ospfAdminStat and ospfRouterId to the OSPF MIB; |
| snmp | add SHA-2 authentication for SNMPv3; |
| snmp | add transmit drop counters; |
| snmp | add VRRP status OIDs for monitoring; |
| snmp | fix the reported capability flags in LLDP-MIB; |
| snmp | fix the snmp tools timing out when authentication is used; |
| snmp | log a warning when the src-address family does not match the request; |
| snmp | remove an interface OID that should not be accessible; |
| ssh | add a connection id to SSH log entries; |
| ssh | add host key verification for the SSH client; |
| ssh | limit server output to the client's window size; |
| ssh | show router host key fingerprint; |
| ssh | switch the default host key type to Ed25519; |
| ssh | warn users when weak RSA key is being used; |
| ssl | enabled hardware accelerated GCM on Alpine CPUs; |
| ssl | improve logging; |
| switch | add packet and byte counters for ACL rules on Marvell Prestera switches; |
| switch | fix degraded slow-path throughput on CRS304 switch (introduced in v7.22); |
| switch | fix VLAN-tagged traffic being looped back in MLAG setups on CRS8xx series switches; |
| system | fix the frequency units from Mhz to MHz; |
| system | improve stability (includes CVE-2026-31431, CVE-2026-67280); |
| system | reboot automatically when the boot process fails to start; |
| system | reduce the fan control interval on multi-core boards; |
| system | remove the channel label from the RouterOS version; |
| system | show health settings and overtemp options based on device capabilities; |
| system | warn about a missing wifi driver package on BE boards; |
| tftp | add VRF support; |
| traffic-flow | fix a kernel failure when disabling traffic flow on a busy system; |
| user | fix removal of inactive REST API sessions (introduced in 7.21); |
| userman | improve stability when importing database files; |
| vlan | add a forced-mac-address option for VLAN interfaces; |
| vlan | warn when a VLAN interface is created on a slave interface; |
| webfig | add a generic table and union group support; |
| webfig | add column resizing to embedded tables; |
| webfig | hide the left menu only on QuickSet and Terminal pages; |
| webfig | improve comboboxes to select the first matching option while typing; |
| webfig | update style; |
| webfig | update the login page Help link; |
| wifi | fix station statistics not updating after switching MLD links; |
| wifi | fix the interworking network type; |
| wifi | fix the wrong band shown in the registration table; |
| wifi | fix traffic processing on CAPsMAN after an interface is disabled; |
| wifi | perform a channel switch instead of dropping clients on radar detection; |
| wifi | preserve dude package on cap when upgrading via capsman; |
| wifi | report channel in log messages; |
| wifi | report management frame protection (MFP) usage in registration-table; |
| wifi | reuse freed station association IDs; |
| wifi | show the EAP user identity in the registration table; |
| wifi | show the MLD links and SSID in MLO client log messages; |
| wifi | add a stream-port argument to configure the sniffer streaming server port; |
| wifi | add fast transition support for MLD devices; |
| wifi | add interworking, aaa and steering settings to the network configuration; |
| wifi | add more steering debug logs; |
| wifi | add network 'labels' parameter to WinBox and WebFig; |
| wifi | do not preserve branding package on cap when upgrading via capsman; |
| wifi | fix CAPsMAN failing when mangle marking is used with encrypted data channels; |
| wifi | fix channel reselect interval/time operation for wifi-qcom-be and wifi-mediatek interfaces; |
| wifi | fix incorrect scan results for 320 MHz access points; |
| wifi | fix MLD link type change and SA query in station mode; |
| wifi | fix per-link client statistics for MLO connections; |
| wifi | fix SAE authentication using a wrong cached PMK; |
| wifi-mediatek | fix 4.9 GHz band operation on the A42; |
| wifi-mediatek | fix roaming between APs belonging to the same MLO group; |
| wifi-mediatek | fix the 5 GHz access point failing to start after reconfiguration on the A42; |
| wifi-mediatek | improve MLO client reconnection; |
| wifi-qcom | fix disconnects during fast transition roaming; |
| wifi-qcom | fix station mode association failures; |
| wifi-qcom | improve IP multicast delivery to wireless clients; |
| wifi-qcom-ac | fix a regression in station MAC address handling; |
| wifi-qcom-ac | reduce package size; |
| wifi-qcom-be | add hw-protection-mode support; |
| wifi-qcom-be | add the distance setting for 802.11be devices; |
| wifi-qcom-be | fix the block ack request being declined after a channel switch; |
| wifi-qcom-be | fix Wi-Fi intermittently unavailable after reboot; |
| wifi-qcom-be | improve throughput in dense client environments; |
| winbox | add a filtered LLDP tab to neighbor discovery; |
| winbox | add a Security tab and reorganize bridge and port dialogs; |
| winbox | add a wifi radio regulatory info (reg-info) view; |
| winbox | add device-mode configuration; |
| winbox | add ISIS support; |
| winbox | add progress bar support to the GUI; |
| winbox | add the client MTU option for WireGuard peers; |
| winbox | add the container save option; |
| winbox | add wifi Spectral Scan support; |
| winbox | allow power-cycling multiple interfaces at once; |
| winbox | allow tuple fields with more than two values and multiple separators; |
| winbox | fix bridge filter window disabling valid fields for IPv6 rules; |
| winbox | fix SFP optical power values of 0.0 dBm not being shown; |
| winbox | fix the channel.reselect-interval range field in CAPsMAN; |
| winbox | fix the EC/IO signal quality graph; |
| winbox | fix the ISIS neighbor level type being empty for "l2"; |
| winbox | fix the Memory Limit field of fq_codel to use bytes; |
| winbox | fix the Min Prefix field in the routing rule dialog; |
| winbox | fix the MPLS TE tunnel path hops field; |
| winbox | fix the range field displayed in route filters; |
| winbox | fix the signal indication graphs for ppp-out interfaces; |
| winbox | fix the Skins menu for user groups opening a non-existent window; |
| winbox | fix the system note display on startup; |
| winbox | fix the wifi Authentication Types and Encryption fields; |
| winbox | fix wg-import creating a WireGuard interface without a config file; |
| winbox | improve status reporting under Tools/Email menu; |
| winbox | make the Power Cycle button act only on the selected interface; |
| winbox | open the Format Drive panel only for supported disks; |
| winbox | remove the redundant empty status field from the License window; |
| winbox | rename "send" to "transmit" in the Bandwidth Test window; |
| winbox | rework the switch QoS statistics table; |
| winbox | set minimal supported WinBox version to 4.3; |
| winbox | show warning messages under "System/Users/SSH Keys" and "System/Users/SSH Private Keys" menu; |
| winbox | show WireGuard peer information; |
| wireguard | add the client-mtu parameter; |
| wireguard | allow referencing a peer by its name; |
| wireguard | allow unsetting the client-listen-port; |
| wireguard | fix a peer that would not work after import when no endpoint address is set; |
| wireguard | improve error message reporting when adding a new peer; |
| wireguard | keep peer rx/tx counters when the peer is disabled and enabled; |
| wireguard | support comment lines in wg-import configuration files; |
| wireguard | treat empty private-key and preshared-key values as none; |
| wireguard | use the MTU value when importing a configuration; |
| wireguard | warn when an allowed-address overlaps another peer; |
| www | add the remote client IP and domain to HTTPS log messages; |
| www | fix a memory leak when parsing authentication headers; |
| www | improve URI parsing; |