Hello again,

Here is your biweekly dose of bugfixes and quality of life improvements! This update offers several new features: VLANs on bridges, "received-on" firewall rule support, persistent rule label tracking, repeatable WireGuard QR codes, menu favourites and full screen grid support. On top of that it bundles the recent FreeBSD 15.1-RELEASE-p3, fixes and cleanups as well as third party updates such as OpenSSL 3.5.8 and OpenSSH 10.5p1. Enjoy. :)

Meanwhile, development is busy with adding interface settings to the new MVC assignments page, which includes building wireless MVC/API support. That is all for now. Need to get back to work.

Here are the full patch notes:

- system: offer post-quantum mldsa44-ed25519 OpenSSH server host key
- system: do not regenerate all OpenSSH key files when adding new key types
- system: truncate long names in services dashboard widget (contributed by circa1665)
- system: use created user name for change event (contributed by Julian Pawlowski)
- system: handle missing objects during deletion in API (contributed by Julian Pawlowski)
- system: multiple PHP warning fixes (contributed by Julian Pawlowski)
- system: avoid filter_configure() calls to make existing backend call less obscure
- system: add favorites section to menu (contributed by Greelan)
- system: approximate user being expired for the grid view icon
- system: replace cron restart in static PHP pages
- system: fix server certificate purpose detection for EC
- interfaces: permit a VLAN device as bridge member
- interfaces: resolve VLAN devices indirectly via interfaces_configure()
- interfaces: handle missing GRE and GIF during deletion in API (contributed by Julian Pawlowski)
- interfaces: multiple PHP warning fixes (contributed by Julian Pawlowski)
- interfaces: emit discovered hosts sorted by last_seen via hostwatch
- captive portal: exclude IPv4 from roaming logic[1]
- dhcrelay: add options for circuit_id and remote_id (contributed by Thomas Cheyney)
- dnsmasq: remove count badge from GroupBy with static configuration elements
- dnsmasq: add "expand-hosts" option (contributed by Konstantinos Spartalis)
- firewall: remove 2a10::/12 from bogonsv6.sample (contributed by Belgarion)
- firewall: deprecate old rule register function names due to functional overlaps
- firewall: add missing TLS ports to well-known ports (contributed by Self-Hosting-Group)
- firewall: use new "rlabel" from pfctl for persistent rule identification across reloads
- firewall: emit gateway debug message in block rules only when gateway is not empty
- firewall: aliases: use same dynamic label as in KEA DHCPv6 for a unified look
- firewall: aliases: fix spinner on alias dialog save button
- firewall: destination NAT: make local-port numeric before applying range in registered firewall rule (contributed by Thomas Cheyney)
- firewall: rules: add "received-on" interface keyword as interface origin option
- firewall: rules: promote "statetype" from advanced to common option for "received-on" usage
- firmware: revoke 26.1 fingerprint
- kea: remove count badge from GroupBy with static configuration elements
- kea: use DOM construction for the "dynamic" label
- network time: strict security GUI support
- unbound: update Hagezi blocklists to use new mirror URL
- wireguard: FreeBSD 15 no longer allows addresses without netmasks
- wireguard: cleaner QR codes (contributed by Roy Orbitson)
- wireguard: preserve peer generator state for existing peers
- mvc: BaseField: add getInitialValue()
- mvc: OptionField: fix simplified option group definition
- mvc: fix typo in base_form.volt advanced/help toggle IDs
- mvc: fix assorted stale imports in the code base
- ui: tabulator: add _showMaximized() modal that can show a grid close to full screen
- ui: add keyboard shortcut "f" to maximize a currently visible grid
- ui: scope "all help" and "advanced mode" toggle to closest relevant form
- ui: trigger "h" and "a" keyboard shortcuts on all relevant matches
- plugins: os-caddy 2.2.1[2]
- plugins: os-frr 1.55[3]
- plugins: os-theme-rebellion 1.9.7 (contributed by Team Rebellion)
- src: posixshm: fix a TOCTOU race in the FIOSSHMLPGCNF handler[4]
- src: tty: revalidate after dropping the tty lock in ioctl handlers[5]
- src: ppp: fix multiple vulnerabilities[6]
- src: openssl: fix multiple vulnerabilities[7]
- src: cred: fix group_is_primary()[8]
- src: dsp: fix a potential use-after-free in dsp_oss_syncstart()[9]
- src: unix: fix some bugs in the SOCK_STREAM receive path[10]
- src: hwpmc: fix the execve handler[11]
- src: ucode: fix validation on Intel platforms[12]
- src: netmap: fix driver name handling
- src: netmap: fix a race in kqueue registration
- src: e1000: assorted upstream patches from stable/15
- src: iflib: support recoverable initialization failure
- src: route: add an eventhandler for rt_numfibs changes
- src: rawip: fix handling of checksums in rip6_input()
- src: pf: attempt to handle overlapping group and interface names
- src: pf: check if a group has a kif before dereferencing it
- src: pf: fix fallout from the STATE_LOOKUP macro removal
- src: pf: re-optimize state key handling
- src: pf: rule label patch was merged from a wrong version
- src: pfsync: handle large MTU pfsync interfaces
- src: ktls: propagate EPG_FLAG_ANON to mapped mbufs
- src: netipsec: fix sockaddr type set in ipcomp6_nonexp_encapcheck()
- src: src: PF_KEY socket: limit the length of copied socket address
- src: ure: add USB device IDs for additional RTL8152/RTL8153 adapters
- src: ure: fix spurious link flaps from MII
- ports: ca_root_nss / nss 3.127[13]
- ports: expat 2.8.3[14]
- ports: kea 3.0.4[15]
- ports: monit 6.0.0[16]
- ports: openssh 10.5p1[17]
- ports: openssl 3.5.8[18]
- ports: perl 5.42.3[19]
- ports: phalcon 5.20.3[20]
- ports: php 8.5.9[21]
- ports: rrdtool 1.11.0[22]
- ports: sqlite 3.53.4[23]

A hotfix release was issued as 26.7.3_2:

- interfaces: add missing PPP support to interface_parent_devices()
- firewall: source NAT: fix faulty import removal

Stay safe,
Your OPNsense team