vyos-1x.git/interface-definitions/include/version, branch rolling

bgp: T8865: Reject `vni` sub-block in VRF l2vpn-evpn when `advertise-all-vni` is globally active

2026-06-26T07:28:05+00:00

When `advertise-all-vni` is configured in the global/default BGP instance, VyOS generated a `vni ` sub-block under each VRF BGP `address-family l2vpn evpn` context. This conflicts with advertise-all-vni: FRR already owns all kernel VNIs and returns `% Failed to create VNI` when frr-reload.py attempts to apply the VRF-level vni sub-block. FRR then performs an early exit from config processing, silently dropping the entire l2vpn evpn address-family for all subsequent VRF BGP instances.

Merge pull request #5231 from natali-rs1985/T8223

2026-06-17T12:36:46+00:00

bgp: T8223: Prevent `advertise-all-vni` in multiple BGP VRF instances simultaneously

salt: T8973: remove feature

2026-06-09T19:44:03+00:00

As salt has been marked deprecated via T8056 and is thus deprecated in VyOS 1.5 and VyOS 1.4 it is time to remove it from the rolling release.

bgp: T8223: Prevent `advertise-all-vni` in multiple BGP VRF instances simultaneously

2026-06-09T15:41:56+00:00

FRR only allows one BGP instance to hold `advertise-all-vni` at a time (FRR issue #9405). When a default BGP instance is present it is always started before named VRF instances, so if a named VRF holds the flag FRR silently rejects it on every boot (regardless of default EVPN config), causing the running config to diverge from what is stored in VyOS. Enforce the following policy in verify(): - Default BGP instance may always hold `advertise-all-vni`. - A named VRF may hold it only when no default BGP instance exists. - Only one BGP instance (default or named VRF) may hold it at a time. The default BGP verify path additionally scans dependent VRFs so that adding or modifying the default BGP instance while a named VRF already holds the flag is caught even when the VRF node is not part of the current commit.

T8492: CRL generated by VyOS PKI lacks X.509 extensions required for strongSwan validation

2026-05-13T16:52:04+00:00

Previously generated CRLs were missing the Authority Key Identifier and CRL Number extensions required by strongSwan for certificate revocation validation. Without these extensions, strongSwan silently ignores the CRL, allowing revoked certificates to authenticate successfully. The migration regenerates existing CRLs for all CAs that have a private key available. CAs with passphrase-protected keys are skipped with a warning, as the passphrase cannot be provided non-interactively

serial: T8375: add CLI option to explicitly set kernel console

2026-04-09T18:54:06+00:00

Previously, VyOS hardcoded the kernel boot log console to either ttyS0 or tty0, with no post-install CLI method to change it (manual GRUB edits were required). This commit adds a new CLI node: system console device kernel When set, the selected serial console is used as the kernel boot console. When removed, the kernel boot console falls back to tty0.

vpp: T8318: Consolidate recent migrations into a single downgrade migration (target version 6)

2026-02-26T07:14:53+00:00

vpp: T8283: Move bonding interface from vpp secction to 'interfaces vpp bonding'

2026-02-25T17:25:31+00:00

vpp: T8255: Changed logging level variable name

2026-02-13T07:10:01+00:00

This commit changes logging settings naming: - before: `set vpp settings logging default-log-level ` - after: `set vpp settings logging default-level `

vpp: T8252: Change ACL node 'macip' to 'mac'

2026-02-11T10:37:12+00:00