OPNSense/core 5de581csrc/opnsense/scripts/firmware config.sh read.sh

firmware: stop buffering in sed

Since cmd_output was made the generic filter for subscriptions
the update log showed signs of excessive buffering.  This brings
it back to where it was and also improves the old read case.
DeltaFile
+1-1src/opnsense/scripts/firmware/config.sh
+1-1src/opnsense/scripts/firmware/read.sh
+2-22 files

OPNSense/core 16ed473src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api SourceNatController.php

Condition should be OR for the ACL check
DeltaFile
+1-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/SourceNatController.php
+1-11 files

OPNSense/core 0bd0defsrc/opnsense/mvc/app/library/OPNsense/System/Status HostDiscoveryStatus.php, src/opnsense/mvc/app/views/OPNsense/Hostdiscovery settings.volt

hostwatch: pin warning banner to enabled flag (#10368)

Closes https://github.com/opnsense/core/issues/10196
DeltaFile
+53-0src/opnsense/mvc/app/library/OPNsense/System/Status/HostDiscoveryStatus.php
+0-13src/opnsense/mvc/app/views/OPNsense/Hostdiscovery/settings.volt
+2-0src/opnsense/scripts/interfaces/list_hosts.py
+55-133 files

OPNSense/core 303f5b4src/opnsense/www/js/widgets Wireguard.js Cpu.js

ui: style fixes
DeltaFile
+3-3src/opnsense/www/js/widgets/Wireguard.js
+2-2src/opnsense/www/js/widgets/Cpu.js
+2-2src/opnsense/www/js/widgets/DnsmasqLeases.js
+1-1src/opnsense/www/js/widgets/Monit.js
+1-1src/opnsense/www/js/widgets/Services.js
+1-1src/opnsense/www/js/widgets/Traffic.js
+10-103 files not shown
+13-139 files

OPNSense/core b11d6b3src/www firewall_rules.php

Firewall: Rules: LAN - fix for missing HTML escape

PR: CVE-2026-49131
(cherry picked from commit 37cc231a6844f343723be6ae1a84d73941a1b408)
DeltaFile
+1-1src/www/firewall_rules.php
+1-11 files

OPNSense/core 12b021fsrc/opnsense/www/js/widgets Certificates.js

dashboard / certificates - remove unused data-tooltip that is not properly escaped

PR: CVE-2026-49132
(cherry picked from commit 2e2a782102d4d2973580317545acf307d0a7e423)
DeltaFile
+1-1src/opnsense/www/js/widgets/Certificates.js
+1-11 files

OPNSense/core acbc3f6src/etc/inc/plugins.inc.d ntpd.inc

network time: cleanse port option before use

This is also a continuation of 770480715b15.  Moving the validation
inside the respective function makes sense.  Also checking if the
name and expected file type is present before continuing.

Also bring in the PPS unlink() fix into GPS and always use the default
init string if nothing else given -- may be wrong but at least this
was the code intention only obscured by the wrong logic expression.

PR: GHSA-872g-g543-j37m
(cherry picked from commit 3183b3ed1fc0f66234b61143304e7ac0c57ba6f6)
DeltaFile
+25-32src/etc/inc/plugins.inc.d/ntpd.inc
+25-321 files

OPNSense/core 3183b3esrc/etc/inc/plugins.inc.d ntpd.inc

network time: cleanse port option before use

This is also a continuation of 770480715b15.  Moving the validation
inside the respective function makes sense.  Also checking if the
name and expected file type is present before continuing.

Also bring in the PPS unlink() fix into GPS and always use the default
init string if nothing else given -- may be wrong but at least this
was the code intention only obscured by the wrong logic expression.

PR: GHSA-872g-g543-j37m
DeltaFile
+25-32src/etc/inc/plugins.inc.d/ntpd.inc
+25-321 files

OPNSense/core 2e2a782src/opnsense/www/js/widgets Certificates.js

dashboard / certificates - remove unused data-tooltip that is not properly escaped

PR: CVE-2026-49132
DeltaFile
+1-1src/opnsense/www/js/widgets/Certificates.js
+1-11 files

OPNSense/core 37cc231src/www firewall_rules.php

Firewall: Rules: LAN - fix for missing HTML escape

PR: CVE-2026-49131
DeltaFile
+1-1src/www/firewall_rules.php
+1-11 files

OPNSense/core bd4f4c5src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms dialogSNatMode.xml

make sweep
DeltaFile
+1-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/dialogSNatMode.xml
+1-11 files

OPNSense/core 75d6784src/opnsense/mvc/app/views/OPNsense/Firewall nat_rule.volt

Firewall: NAT: Set source NAT specific form and API call behind volt templating conditions
DeltaFile
+5-2src/opnsense/mvc/app/views/OPNsense/Firewall/nat_rule.volt
+5-21 files

OPNSense/core a29c789src/etc/inc/plugins.inc.d ntpd.inc

network time: small cleanups in ntpd_configure_gps()

(cherry picked from commit 95bedd865b0451128c1d4163010bf30682ab0293)
DeltaFile
+25-25src/etc/inc/plugins.inc.d/ntpd.inc
+25-251 files

OPNSense/core fef0783src/opnsense/mvc/app/controllers/OPNsense/Base ControllerBase.php

mvc: do not translate empty strings

PR: https://github.com/opnsense/core/issues/10369
(cherry picked from commit 92bdd548deaca699fc14651b1f20861f231d0968)
DeltaFile
+4-1src/opnsense/mvc/app/controllers/OPNsense/Base/ControllerBase.php
+4-11 files

OPNSense/core 4c5c335src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api SourceNatController.php, src/opnsense/mvc/app/models/OPNsense/Firewall/FieldTypes SNatModeField.php

Firewall: NAT: Add setMode endpoint for saving the snat_mode via the reconfigureAct
DeltaFile
+21-0src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/SourceNatController.php
+17-1src/opnsense/mvc/app/views/OPNsense/Firewall/nat_rule.volt
+0-1src/opnsense/mvc/app/models/OPNsense/Firewall/FieldTypes/SNatModeField.php
+38-23 files

OPNSense/core ca9cf84src/opnsense/mvc/app/models/OPNsense/Core/ACL ACL.xml

system: sync ACL name

PR: https://github.com/opnsense/core/issues/9471
(cherry picked from commit 524440c0c66347bb50edbf691bb1633b7a350ead)
DeltaFile
+1-1src/opnsense/mvc/app/models/OPNsense/Core/ACL/ACL.xml
+1-11 files

OPNSense/core 3c1c5afsrc/opnsense/mvc/app/models/OPNsense/Firewall Alias.xml

mvc: OptionField: allow empty values in options

This falls back to the key which isn't going to be translated
since it's likely a technical term or keyword.

Also translate the $subvalue which appears to have been missed
before.

(cherry picked from commit b187227683de93cb705d6290090aaa708354edf1)
DeltaFile
+5-5src/opnsense/mvc/app/models/OPNsense/Firewall/Alias.xml
+5-51 files

OPNSense/core 2bb603bsrc/opnsense/mvc/app/models/OPNsense/Kea KeaDhcpv6.php

kea: style sweep

(cherry picked from commit 7d52ccfe73e717fbce01819f395a6664d3bc2da0)
DeltaFile
+4-2src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv6.php
+4-21 files

OPNSense/core dbe6f57src/opnsense/mvc/app/views/layouts default.volt

ui: override selectpicker defaults for translations (#10370)

(cherry picked from commit 7a82bb8ac39f57144df7223ee43be859aa68e05a)
DeltaFile
+3-0src/opnsense/mvc/app/views/layouts/default.volt
+3-01 files

OPNSense/core 1e8150dsrc/opnsense/mvc/script run_migrations.php

mvc: unify migration message returns a bit

Mostly noticed due to "check log for details" which now in
most cases is not relevant since we use the verbose flag.

(cherry picked from commit cd2e12ed9f8255b9a022d208d2e9a72efe51a824)
DeltaFile
+4-8src/opnsense/mvc/script/run_migrations.php
+4-81 files

OPNSense/core fae370esrc/opnsense/service/templates/OPNsense/Cron user.cron

System: Settings: Cron - disable mailto

PR: https://github.com/opnsense/core/issues/10246

(cherry picked from commit 1c5f6b9fcb72322f7983be066812b4b34121f39c)
(cherry picked from commit 8978c5fe69dd61ea8c7013975cae5be75f579946)
DeltaFile
+2-0src/opnsense/service/templates/OPNsense/Cron/user.cron
+2-01 files

OPNSense/core 16b6173src/opnsense/mvc/app/controllers/OPNsense/Cron/Api SettingsController.php, src/opnsense/service/conf/actions.d actions_configd.conf

cron: allow unregistered actions to be deleted

Also add a user exception so the users knows what's going on
when not being able to delete.

(cherry picked from commit ae08b03b53c8d24358bd7ecbfb6f8e349ac8ba8e)
DeltaFile
+14-3src/opnsense/mvc/app/controllers/OPNsense/Cron/Api/SettingsController.php
+8-0src/opnsense/service/modules/actions/inline.py
+6-0src/opnsense/service/conf/actions.d/actions_configd.conf
+28-33 files

OPNSense/core 273c68dsrc/etc/inc/plugins.inc.d kea.inc, src/opnsense/mvc/app/controllers/OPNsense/Kea/forms dialogSubnet6.xml

Services: Kea DHCPv6: Dynamic prefix delegation (#10252)

(cherry picked from commit 5b7c8e6a2f7e87c28b249b794429f31330017f9a)
(cherry picked from commit 5c51ecdee11648b0274395c8c8e847f510e8b57b)
DeltaFile
+227-15src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv6.php
+183-0src/opnsense/mvc/app/library/OPNsense/Interface/Idassoc.php
+54-17src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogSubnet6.xml
+70-0src/opnsense/scripts/kea/kea_prefix_renew.py
+59-9src/opnsense/mvc/app/views/OPNsense/Kea/dhcpv6.volt
+31-5src/etc/inc/plugins.inc.d/kea.inc
+624-464 files not shown
+683-5210 files

OPNSense/core d2cab09src/etc/inc interfaces.inc, src/www interfaces.php

interfaces: IAID selection and prefix range reservation #7647

(cherry picked from commit 91093f3344a09112347dc27cda33f14feb68b4aa)
DeltaFile
+103-6src/www/interfaces.php
+14-13src/etc/inc/interfaces.inc
+117-192 files

OPNSense/core 14b3267. plist, src/opnsense/mvc/app/controllers/OPNsense/Firewall SourceNatController.php

Firewall: NAT: Reflect Outbound NAT mode into a volatile snat_mode field and show it in the new SNAT view
DeltaFile
+49-0src/opnsense/mvc/app/models/OPNsense/Firewall/FieldTypes/SNatModeField.php
+12-0src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.xml
+7-1src/opnsense/mvc/app/views/OPNsense/Firewall/nat_rule.volt
+8-0src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/dialogSNatMode.xml
+2-0plist
+1-0src/opnsense/mvc/app/controllers/OPNsense/Firewall/SourceNatController.php
+79-16 files

OPNSense/core 2680128src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api FilterBaseController.php FilterController.php, src/opnsense/mvc/app/views/OPNsense/Firewall nat_rule.volt

Firewall: NAT: download/upload rules as csv (#10371)

* Firewall: Turn downloadRules and uploadRules into a protected function inside FilterBaseController, implement it in Firewall rules and NAT pages
DeltaFile
+106-0src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/FilterBaseController.php
+3-64src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/FilterController.php
+27-0src/opnsense/mvc/app/views/OPNsense/Firewall/nat_rule.volt
+10-0src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/DNatController.php
+10-0src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/NptController.php
+10-0src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/OneToOneController.php
+166-641 files not shown
+176-647 files

OPNSense/core 1d75667src/opnsense/mvc/app/views/OPNsense/Firewall filter_rule.volt, src/opnsense/www/js opnsense_bootgrid.js

Firewall: Rules: improved tree grouping logic
DeltaFile
+54-28src/opnsense/mvc/app/views/OPNsense/Firewall/filter_rule.volt
+4-2src/opnsense/www/js/opnsense_bootgrid.js
+58-302 files

OPNSense/core f27e8b5src/opnsense/www/themes/opnsense-auto/build/js theme.js

theme/opnsense-auto: remove flashing (#10367)
DeltaFile
+25-10src/opnsense/www/themes/opnsense-auto/build/js/theme.js
+25-101 files

OPNSense/core 2216d6bsrc/opnsense/mvc/app/controllers/OPNsense/Firewall/Api FilterBaseController.php

Add a generic helper for key/value map
DeltaFile
+27-14src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/FilterBaseController.php
+27-141 files

OPNSense/core 7a82bb8src/opnsense/mvc/app/views/layouts default.volt

ui: override selectpicker defaults for translations (#10370)
DeltaFile
+3-0src/opnsense/mvc/app/views/layouts/default.volt
+3-01 files