Hi all,

This is a small stable release addressing some of the upgrade related issues that were reported last week as well as 4 new security advisories for the core code.

Here are the full patch notes:

- system: add correct release name to boot splash screen for 26.7
- system: disable web GUI KTLS use for the time being
- system: do not let the components selectpicker grow indefinitely in defaults page
- system: DTLSv1.1 is forcefully rejected by OpenSSL 3.5, migrate to DTLSv1.2
- system: use Bootstrap "btn" styles in services widget
- system: use serialNumberHex for CRL so high-bit serials are not dropped (contributed by chrstnth)
- system: lower max-request-size to roughly max post size in lighttpd configs[1] (reported by lujiefsi)
- system: fixed several PHP 8.5 warnings
- firewall: use "urgent" as empty default for firewall debug messages
- firewall: skip message banner if searchPhrase set
- firewall: fix PHP warning when scrub yields no interfaces
- captive portal: automatic block rule should be evaluated after the anti-lockout rule
- openvpn: client export can export private keys for unlisted certificate references[2] (reported by iys8 and lujiefsi)
- backend: remove cache file on execution error in script_output
- mvc: fix tab/subtab form generation for plugins
- mvc: fix default labels in selectpickers
- mvc: form labels can be empty so make sure to add them to avoid warnings in forms
- mvc: safeguard some write operations with missing throwReadOnly() actions for custom action[3] (reported by lujiefsi)
- ui: fix multiple stored XSS[4] (reported by lujiefsi)
- plugins: os-theme-rebellion 1.9.5 (contributed by Team Rebellion)
- ports: ca_root_nss / nss 3.125[5]

A hotfix release was issued as 26.7.1_1:

- system: fix default gateway switch alarm trigger being overwritten by gateway group check
- ports: pecl-mcrypt 1.0.9

Stay safe,
Your OPNsense team