vyos-1x.git/interface-definitions/include/version, branch fix/T8955-http-api-verify-tls

openvpn: T8264: migrate away DCO the Kernel module cannot serve

2026-09-13T19:06:12+00:00

"offload dco" was accepted next to tap, static keys, compression, CBC ciphers and raw options OpenVPN refuses to offload, because 2.6 ignored the module altogether. Those combinations now fail verify(), which would break config load on upgrade, so drop the request instead. The migration has to mirror verify_dco() exactly: anything it keeps that verify() turns away leaves a router unable to commit its own configuration.

Merge pull request #5123 from indrajitr/ddclient-v4

2026-08-14T13:00:14+00:00

ddclient: T6981: Upgrade ddclient to v4.0.0

T8598: Accel-PPP: Add upgrade-safe migration support for calling-sid peer IID secret enforcement across PPPoE, L2TP, PPTP, and SSTP (BP 2188)

2026-08-12T21:50:20+00:00

(cherry picked from commit c9314daa78418751edaab9b4da8c2e33fb1a64ed)

ddclient: T6981: Remove defunct googledomains

2026-07-24T17:12:18+00:00

Since googledomains (domains.google.com) has been shut down, we need to remove any configuration path that refers to googledomains. 1. Remove 'googledomains' as the default web resolver in ddclient.conf.j2 2. Apply migration to remove googledomains from dynamic DNS service configurations. The migration is also necessary to undo a previous migration where we added 'googledomains' as default web resolver to work around lack of tls (ssl) support with default web resolver 'dyndns' (checkip.dyndns.org) in ddclient v3.x.

bgp: T8865: Reject `vni` sub-block in VRF l2vpn-evpn when `advertise-all-vni` is globally active

2026-06-26T07:28:05+00:00

When `advertise-all-vni` is configured in the global/default BGP instance, VyOS generated a `vni ` sub-block under each VRF BGP `address-family l2vpn evpn` context. This conflicts with advertise-all-vni: FRR already owns all kernel VNIs and returns `% Failed to create VNI` when frr-reload.py attempts to apply the VRF-level vni sub-block. FRR then performs an early exit from config processing, silently dropping the entire l2vpn evpn address-family for all subsequent VRF BGP instances.

Merge pull request #5231 from natali-rs1985/T8223

2026-06-17T12:36:46+00:00

bgp: T8223: Prevent `advertise-all-vni` in multiple BGP VRF instances simultaneously

salt: T8973: remove feature

2026-06-09T19:44:03+00:00

As salt has been marked deprecated via T8056 and is thus deprecated in VyOS 1.5 and VyOS 1.4 it is time to remove it from the rolling release.

bgp: T8223: Prevent `advertise-all-vni` in multiple BGP VRF instances simultaneously

2026-06-09T15:41:56+00:00

FRR only allows one BGP instance to hold `advertise-all-vni` at a time (FRR issue #9405). When a default BGP instance is present it is always started before named VRF instances, so if a named VRF holds the flag FRR silently rejects it on every boot (regardless of default EVPN config), causing the running config to diverge from what is stored in VyOS. Enforce the following policy in verify(): - Default BGP instance may always hold `advertise-all-vni`. - A named VRF may hold it only when no default BGP instance exists. - Only one BGP instance (default or named VRF) may hold it at a time. The default BGP verify path additionally scans dependent VRFs so that adding or modifying the default BGP instance while a named VRF already holds the flag is caught even when the VRF node is not part of the current commit.

T8492: CRL generated by VyOS PKI lacks X.509 extensions required for strongSwan validation

2026-05-13T16:52:04+00:00

Previously generated CRLs were missing the Authority Key Identifier and CRL Number extensions required by strongSwan for certificate revocation validation. Without these extensions, strongSwan silently ignores the CRL, allowing revoked certificates to authenticate successfully. The migration regenerates existing CRLs for all CAs that have a private key available. CAs with passphrase-protected keys are skipped with a warning, as the passphrase cannot be provided non-interactively

serial: T8375: add CLI option to explicitly set kernel console

2026-04-09T18:54:06+00:00

Previously, VyOS hardcoded the kernel boot log console to either ttyS0 or tty0, with no post-install CLI method to change it (manual GRUB edits were required). This commit adds a new CLI node: system console device kernel When set, the selected serial console is used as the kernel boot console. When removed, the kernel boot console falls back to tty0.