vyos-1x.git/data/config-mode-dependencies/vyos-1x.json, branch feature/T9082-codeql-cpp

firewall: T8761: re-introduce VRF interface names in generated firewall config

2026-07-01T19:51:21+00:00

This change re-implements the intended behaviour from T4180 aswell as from T4506, it ensures that both the vrf-member interface aswell as the vrf itself is added as an oifname -> meaning that traffic traversing and originating from withing VyOS is matches outbound. Changes done by c-po: * re-sort dependency list to keep diff low * vyos.configdict.is_vrf_changed() should return early and not carry over the to-be return value * keep common coding style (dict by . separation) in nftables-zone.j2 Co-authored-by: Christian Breunig

T6933: fix "system option performance" overwrites sysctl parameters from firewall (#5206)

2026-05-20T10:26:40+00:00

sysctl values written by firewall global-options are overwritten when using "system option performance" configuration on VyOS CLI. This is caused by a missing dependency fall from system_option.py to the firewall CLI helper script.

T7756: Fix rsyslog configuration generation

2026-02-10T03:59:37+00:00

1.) Fix both syslog and logrotate writing /etc/logrotate.d/vyos-rsyslog - system_syslog.py generates /etc/logrotate.d/vyos-rsyslog-user for user file logrotate - system_logs.py generates /etc/logrotate.d/vyos-rsyslog using configured rotation parameters 2.) Fix /run/rsyslog/rsyslog.conf ignoring configured size for /var/log/messages - system_syslog.py retrieves "system logs" config to set rotation limits - default rotation size is now based on configuration defaults 3.) prifilt strings for rsyslog are modified to use override syntax (e.g. ";facility.none") when all is combined with other facilities to honor per facility user intent Smoke test changes: Commonize configuration of syslog facilities Check that prifilt is sane based on configured facilities (i.e. overides only present when required) Test wildcard (all) only, specific facility only, and wildcard + specific facility

T8138: add nat66 as dependent of firewall groups

2026-01-01T21:08:54+00:00

Add nat66 as a dependency of firewall groups, because nat66 may reference firewall groups via source-destination-group-ipv6.xml.i. The dependency is necessary to ensure a fresh nft ruleset is built when dependent groups are updated, so that the changes actually take effect in nat66 on commit. Add a smoketest to cover nft rulesets failing to update as a result of changes to dependent firewall groups. Original commit adding support for groups in nat66 is commit f96733dd.

T7731: Static ARP entries are missing after an interface status change

2025-11-12T11:48:44+00:00

T7938: VPP: Rewrite sFlow implementation

2025-10-21T14:30:51+00:00

Execute commands for vpp sflow with API calls. Use values for polling interval and sampling rate from 'system sflow'. Add op-mode command

wlb: T114: Add firewall group support for WAN load balancer

2025-09-10T10:09:09+00:00

pki: T6013: add proper dependencies for SSH CA

2025-05-29T11:57:48+00:00

We need to establish proper dependencies on "system login" and "pki ca" for the SSH subsystem. If the CA is updated or user principal names are modified, we must also ensure that the SSH daemon is restarted accordingly.

wireguard: T7166: Call vxlan dependency if interface exist

2025-02-27T16:01:20+00:00

haproxy: T6745: Rename `reverse-proxy` to `haproxy`

2024-10-09T13:55:15+00:00