OPNSense/core 305741fcontrib/IXR IXR_Library.php, src/etc/inc XMLRPC_Client.inc

system: curl_close() is deprecated

This has been a no-op since 8.0.0, but deprecated since 8.5.0.
DeltaFile
+0-3src/etc/inc/XMLRPC_Client.inc
+0-1src/etc/inc/plugins.inc.d/opendns.inc
+0-1src/opnsense/mvc/app/controllers/OPNsense/Core/Api/DashboardController.php
+0-1src/www/crash_reporter.php
+0-1contrib/IXR/IXR_Library.php
+0-75 files

OPNSense/core bc1c93esrc/opnsense/www/js/widgets Services.js

system: tweak text color on previous
DeltaFile
+3-1src/opnsense/www/js/widgets/Services.js
+3-11 files

OPNSense/core df77158src/etc/inc/plugins.inc.d dpinger.inc core.inc, src/opnsense/www/js/widgets Services.js BaseWidget.js

system: change the services widget to a flat tile layout

Make the names of the services shown a bit shorter.  The colors
are debatable but they are matchin what alerts are using in
bootstrap.
DeltaFile
+11-36src/opnsense/www/js/widgets/Services.js
+2-3src/opnsense/www/js/widgets/Metadata/Core.xml
+2-2src/etc/inc/plugins.inc.d/dpinger.inc
+2-2src/etc/inc/plugins.inc.d/core.inc
+2-2src/opnsense/www/js/widgets/BaseWidget.js
+1-1src/etc/inc/plugins.inc.d/hostwatch.inc
+20-464 files not shown
+24-5010 files

OPNSense/core 4d9998csrc/etc/rc.subr.d recover, src/opnsense/service/templates/OPNsense/WebGui php.ini

system: deriving $_SERVER['argv'] from the query string is deprecated

Only used by Nginx plugin and probably able to simplify there.  It's
a bit strange in this case.  Allegedly the variable has no effect on
CLI applications.
DeltaFile
+1-1src/etc/rc.subr.d/recover
+1-1src/opnsense/service/templates/OPNsense/WebGui/php.ini
+2-22 files

OPNSense/core 8e2b3e7src/opnsense/mvc/app/controllers/OPNsense/Routing/Api SettingsController.php

routing: fix HTTP 500 when deleting a non-existent gateway (#10429)

delGatewayAction() dereferenced the result of getNodeByReference() without a null check, so an unknown uuid reached "(string)$gateway->name" on null and raised an error, which the API renders as HTTP 500 ("Unexpected error, check log for details").

Guard the lookup and return the already-initialised {"result":"failed"} instead, matching the inherited del* verbs and the adjacent toggleGatewayAction(), which already null-check getNodeByReference().
DeltaFile
+3-0src/opnsense/mvc/app/controllers/OPNsense/Routing/Api/SettingsController.php
+3-01 files

OPNSense/core 18b7cdbsrc/opnsense/scripts/interfaces traffic_stats.php

interfaces: missed in previous
DeltaFile
+1-1src/opnsense/scripts/interfaces/traffic_stats.php
+1-11 files

OPNSense/core 57940f5src/opnsense/mvc/app/library/OPNsense/Firewall Util.php

firewall: chr(): providing a value not in-between 0 and 255 is deprecated
DeltaFile
+1-1src/opnsense/mvc/app/library/OPNsense/Firewall/Util.php
+1-11 files

OPNSense/core b5c542csrc/opnsense/mvc/tests/app/library/OPNsense/Interface IdassocTest.php

tests: Method ReflectionMethod::setAccessible() is deprecated since 8.5
DeltaFile
+0-1src/opnsense/mvc/tests/app/library/OPNsense/Interface/IdassocTest.php
+0-11 files

OPNSense/core d3c654fsrc/opnsense/mvc/app/models/OPNsense/Base/FieldTypes DescriptionField.php

mvc: DescriptionField: disable special and newline characters

This is only cosmetic and since the description is only used as a
label and not a note block this is fine (and could be overwridden
by the model if needed).
DeltaFile
+10-0src/opnsense/mvc/app/models/OPNsense/Base/FieldTypes/DescriptionField.php
+10-01 files

OPNSense/core c556979src/opnsense/mvc/app/models/OPNsense/Interfaces/ACL ACL.xml

system: fix ACL pattern for carp_status action (#10428)
DeltaFile
+1-1src/opnsense/mvc/app/models/OPNsense/Interfaces/ACL/ACL.xml
+1-11 files

OPNSense/core 68d9da1src/opnsense/mvc/app/controllers/OPNsense/Diagnostics/Api InterfaceController.php

mvc: use camelCase for carp_status action related to #10428
DeltaFile
+2-2src/opnsense/mvc/app/controllers/OPNsense/Diagnostics/Api/InterfaceController.php
+2-21 files

OPNSense/core 28229edsrc/www interfaces.php

Interfaces/DHCP - Further tighten security for https://github.com/opnsense/core/security/advisories/GHSA-5rx3-w735-74wm

As advanced fields should always require high level access, we should prevent accidental mistakes from administrators allowing non-admins from changing these items.
In the long run, we likely want to drop these options, but that requires at least bringing back some common options which we are able to validate properly.
DeltaFile
+7-1src/www/interfaces.php
+7-11 files

OPNSense/core 8ec23b3src/opnsense/service/templates/OPNsense/WebGui php.ini

system: webgui templating more pretty
DeltaFile
+1-2src/opnsense/service/templates/OPNsense/WebGui/php.ini
+1-21 files

OPNSense/core c00711econtrib/IXR IXR_Library.php, src/opnsense/scripts/interfaces traffic_stats.php

src: non-canonical cast (double) is deprecated
DeltaFile
+2-2contrib/IXR/IXR_Library.php
+1-1src/opnsense/scripts/interfaces/traffic_stats.php
+3-32 files

OPNSense/core 50e99c6src/etc/inc util.inc

system: non-canonical cast (binary) is deprecated

May need to revisit this again, but for now PHP suggests that
(string) is equivalent to (binary) although the code reads
strange.
DeltaFile
+2-2src/etc/inc/util.inc
+2-21 files

OPNSense/core 1af182asrc/opnsense/mvc/app/library/OPNsense/Firewall Rule.php FilterRule.php

firewall: using null as an array offset is deprecated
DeltaFile
+10-7src/opnsense/mvc/app/library/OPNsense/Firewall/Rule.php
+1-1src/opnsense/mvc/app/library/OPNsense/Firewall/FilterRule.php
+11-82 files

OPNSense/core 041ab30contrib/parallel-lint/src Manager.php

contrib: another implicit null
DeltaFile
+1-1contrib/parallel-lint/src/Manager.php
+1-11 files

OPNSense/core 8441b9esrc/opnsense/mvc/app/library/OPNsense/Core File.php FileObject.php

src: implicitly marking parameter $chown as nullable is deprecated
DeltaFile
+2-2src/opnsense/mvc/app/library/OPNsense/Core/File.php
+1-1src/opnsense/mvc/app/library/OPNsense/Core/FileObject.php
+3-32 files

OPNSense/core b4fa4cdsrc/opnsense/mvc/app/controllers/OPNsense/Firewall/Api AliasController.php

Firewall: fix 500 (TypeError) on alias getItem with unknown UUID (#10417)
DeltaFile
+1-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/AliasController.php
+1-11 files

OPNSense/core 569b3a6src/etc/inc/plugins.inc.d ipsec.inc

ipsec: validate the use of refid in CA certificates

PR: GHSA-33q4-wcv7-r8fr
(cherry picked from commit 6bc0a1df6550c419f2a44461f6595cacf2080bfa)
DeltaFile
+6-5src/etc/inc/plugins.inc.d/ipsec.inc
+6-51 files

OPNSense/core fb4ee60src/www firewall_rules_edit.php

firewall: escape shaper targets in rule edit

PR: GHSA-m4m3-v627-wgc2
(cherry picked from commit 3de53a25fdd9b605acc82e4071e9920fa1c9b418)
DeltaFile
+1-0src/www/firewall_rules_edit.php
+1-01 files

OPNSense/core e2cd067src/opnsense/mvc/app/models/OPNsense/Trust Ca.xml Cert.xml, src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes CertificatesField.php CAsField.php

mvc: strict alphanumeric-only regex for certificate refid

CVE: CVE-2026-53582
PR: GHSA-xww7-76m6-mh2r
(cherry picked from commit fc2f0d745c17855d2027b192fd4e3fa913e26859)
DeltaFile
+14-11src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php
+6-1src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php
+4-1src/opnsense/mvc/app/models/OPNsense/Trust/Ca.xml
+4-1src/opnsense/mvc/app/models/OPNsense/Trust/Cert.xml
+28-144 files

OPNSense/core f390601. plist, src/opnsense/mvc/app/models/OPNsense/Base/FieldTypes TextField.php StrictTextField.php

mvc: add new validators to TextField: AllowSpaces, AllowNewlines, AllowSpecial and introduce new StrictTextField (#10398)

(cherry picked from commit c34b7786516afb6dff7a43af92c4328225b81e69)
(cherry picked from commit 9d0e4bf2bb4fdd20f872ff612c5135a7f9115101)
DeltaFile
+127-0src/opnsense/mvc/tests/app/models/OPNsense/Base/FieldTypes/StrictTextFieldTest.php
+81-0src/opnsense/mvc/tests/app/models/OPNsense/Base/FieldTypes/TextFieldTest.php
+61-2src/opnsense/mvc/app/models/OPNsense/Base/FieldTypes/TextField.php
+51-0src/opnsense/mvc/app/models/OPNsense/Base/FieldTypes/StrictTextField.php
+2-0plist
+322-25 files

OPNSense/core 94acb26src/opnsense/www/js/widgets/Metadata Core.xml

dnsmasq: change widget link from settings to leases page (#10420)

(cherry picked from commit 5e8f226d49196c55cd61ba1ee8e69fbbc194a835)
DeltaFile
+1-1src/opnsense/www/js/widgets/Metadata/Core.xml
+1-11 files

OPNSense/core 1ae1f62src/opnsense/mvc/app/models/OPNsense/TrafficShaper TrafficShaper.php

firewall: fix typo that prevented queues to be selectable in pf-based traffic shaping

(cherry picked from commit 558809488e9014f3452aa7cbcf1c5555a8697846)
DeltaFile
+10-3src/opnsense/mvc/app/models/OPNsense/TrafficShaper/TrafficShaper.php
+10-31 files

OPNSense/core aa27c06src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms dialogNptRule.xml, src/opnsense/mvc/app/models/OPNsense/Firewall Filter.php

firewall: allow WAN as "associated interface" for NPTv6 #10413
DeltaFile
+13-5src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.php
+1-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/dialogNptRule.xml
+14-62 files

OPNSense/core 3de53a2src/www firewall_rules_edit.php

firewall: escape shaper targets in rule edit

PR: GHSA-m4m3-v627-wgc2
DeltaFile
+1-0src/www/firewall_rules_edit.php
+1-01 files

OPNSense/core 5588094src/opnsense/mvc/app/models/OPNsense/TrafficShaper TrafficShaper.php

firewall: fix typo that prevented queues to be selectable in pf-based traffic shaping
DeltaFile
+10-3src/opnsense/mvc/app/models/OPNsense/TrafficShaper/TrafficShaper.php
+10-31 files

OPNSense/core 6bc0a1dsrc/etc/inc/plugins.inc.d ipsec.inc

ipsec: validate the use of refid in CA certificates

PR: GHSA-33q4-wcv7-r8fr
DeltaFile
+6-5src/etc/inc/plugins.inc.d/ipsec.inc
+6-51 files

OPNSense/core fc2f0d7src/opnsense/mvc/app/models/OPNsense/Trust Ca.xml Cert.xml, src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes CertificatesField.php CAsField.php

mvc: strict alphanumeric-only regex for certificate refid

CVE: CVE-2026-53582
PR: GHSA-xww7-76m6-mh2r
DeltaFile
+14-11src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php
+6-1src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php
+4-1src/opnsense/mvc/app/models/OPNsense/Trust/Ca.xml
+4-1src/opnsense/mvc/app/models/OPNsense/Trust/Cert.xml
+28-144 files