OPNSense/core 8ec23b3src/opnsense/service/templates/OPNsense/WebGui php.ini

system: webgui templating more pretty
DeltaFile
+1-2src/opnsense/service/templates/OPNsense/WebGui/php.ini
+1-21 files

OPNSense/core c00711econtrib/IXR IXR_Library.php, src/opnsense/scripts/interfaces traffic_stats.php

src: non-canonical cast (double) is deprecated
DeltaFile
+2-2contrib/IXR/IXR_Library.php
+1-1src/opnsense/scripts/interfaces/traffic_stats.php
+3-32 files

OPNSense/core 50e99c6src/etc/inc util.inc

system: non-canonical cast (binary) is deprecated

May need to revisit this again, but for now PHP suggests that
(string) is equivalent to (binary) although the code reads
strange.
DeltaFile
+2-2src/etc/inc/util.inc
+2-21 files

OPNSense/core 1af182asrc/opnsense/mvc/app/library/OPNsense/Firewall Rule.php FilterRule.php

firewall: using null as an array offset is deprecated
DeltaFile
+10-7src/opnsense/mvc/app/library/OPNsense/Firewall/Rule.php
+1-1src/opnsense/mvc/app/library/OPNsense/Firewall/FilterRule.php
+11-82 files

OPNSense/core 041ab30contrib/parallel-lint/src Manager.php

contrib: another implicit null
DeltaFile
+1-1contrib/parallel-lint/src/Manager.php
+1-11 files

OPNSense/core 8441b9esrc/opnsense/mvc/app/library/OPNsense/Core File.php FileObject.php

src: implicitly marking parameter $chown as nullable is deprecated
DeltaFile
+2-2src/opnsense/mvc/app/library/OPNsense/Core/File.php
+1-1src/opnsense/mvc/app/library/OPNsense/Core/FileObject.php
+3-32 files

OPNSense/tools a32628cconfig/26.7 base.obsolete.amd64

config: rebase 26.7 while dropping obsolete files no longer present

This requires the following sequence:

1. Use the previous' major plist file and remove obsolete.
2. make base
3. make rebase

It would be nice to have this as an optional scripted target,
but documenting the procedure is good enough for now.

This was important because:

a) there is a lot of cruft in obsolete
b) ipfw15/dnctl15 were issued in 26.1.10 but not obsoleted with 26.7
DeltaFile
+3-2,794config/26.7/base.obsolete.amd64
+3-2,7941 files

OPNSense/tools ae859efbuild plugins.sh

build/plugins: handle vendor plugins due to PLUGIN_ABI ambiguity

They use the ABI in the package repository configuration and thus
they need to be rebuilt for business versions.
DeltaFile
+12-2build/plugins.sh
+12-21 files

OPNSense/core b4fa4cdsrc/opnsense/mvc/app/controllers/OPNsense/Firewall/Api AliasController.php

Firewall: fix 500 (TypeError) on alias getItem with unknown UUID (#10417)
DeltaFile
+1-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/AliasController.php
+1-11 files

OPNSense/plugins d82e74cnet/frr Makefile, net/frr/src/opnsense/service/templates/OPNsense/Quagga bgpd.conf

net/frr: sync with master
DeltaFile
+1-1net/frr/src/opnsense/service/templates/OPNsense/Quagga/bgpd.conf
+1-0net/frr/Makefile
+2-12 files

OPNSense/plugins e43f979net/frr Makefile

net/frr: bump for hotfix
DeltaFile
+1-0net/frr/Makefile
+1-01 files

OPNSense/plugins 2eb45b4net/frr/src/opnsense/service/templates/OPNsense/Quagga bgpd.conf

net/frr: Fix jinja whitespace control for bfd strict mode
DeltaFile
+1-1net/frr/src/opnsense/service/templates/OPNsense/Quagga/bgpd.conf
+1-11 files

OPNSense/plugins 23ecd4fdns/rfc2136 pkg-descr Makefile, dns/rfc2136/src/etc/inc/plugins.inc.d rfc2136.inc

dns/rfc2136: sync with master
DeltaFile
+10-0dns/rfc2136/pkg-descr
+7-3dns/rfc2136/src/www/services_rfc2136_edit.php
+4-1dns/rfc2136/src/etc/inc/plugins.inc.d/rfc2136.inc
+1-2dns/rfc2136/Makefile
+22-64 files

OPNSense/plugins 3ab2cd1security/stunnel Makefile, security/stunnel/src/opnsense/mvc/app/controllers/OPNsense/Stunnel ServicesController.php

security/stunnel: sync with master
DeltaFile
+20-20security/stunnel/src/opnsense/scripts/stunnel/generate_certs.php
+5-12security/stunnel/src/opnsense/mvc/app/models/OPNsense/Stunnel/Stunnel.xml
+1-1security/stunnel/src/opnsense/mvc/app/controllers/OPNsense/Stunnel/ServicesController.php
+1-1security/stunnel/Makefile
+27-344 files

OPNSense/plugins 73ff960www/cache Makefile

www/cache: chicken and egg dependency test
DeltaFile
+1-3www/cache/Makefile
+1-31 files

OPNSense/plugins def849awww/cache Makefile

www/cache: fix this
DeltaFile
+1-1www/cache/Makefile
+1-11 files

OPNSense/plugins 1286db0security/netbird Makefile pkg-descr, security/netbird/src/opnsense/mvc/app/views/OPNsense/Netbird status.volt

security/netbird: sync with master
DeltaFile
+5-10security/netbird/src/opnsense/mvc/app/views/OPNsense/Netbird/status.volt
+1-1security/netbird/Makefile
+1-1security/netbird/pkg-descr
+7-123 files

OPNSense/plugins e75db60security/netbird pkg-descr

security/netbird: changelog
DeltaFile
+1-1security/netbird/pkg-descr
+1-11 files

OPNSense/core 569b3a6src/etc/inc/plugins.inc.d ipsec.inc

ipsec: validate the use of refid in CA certificates

PR: GHSA-33q4-wcv7-r8fr
(cherry picked from commit 6bc0a1df6550c419f2a44461f6595cacf2080bfa)
DeltaFile
+6-5src/etc/inc/plugins.inc.d/ipsec.inc
+6-51 files

OPNSense/core fb4ee60src/www firewall_rules_edit.php

firewall: escape shaper targets in rule edit

PR: GHSA-m4m3-v627-wgc2
(cherry picked from commit 3de53a25fdd9b605acc82e4071e9920fa1c9b418)
DeltaFile
+1-0src/www/firewall_rules_edit.php
+1-01 files

OPNSense/core e2cd067src/opnsense/mvc/app/models/OPNsense/Trust Cert.xml Ca.xml, src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes CertificatesField.php CAsField.php

mvc: strict alphanumeric-only regex for certificate refid

CVE: CVE-2026-53582
PR: GHSA-xww7-76m6-mh2r
(cherry picked from commit fc2f0d745c17855d2027b192fd4e3fa913e26859)
DeltaFile
+14-11src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php
+6-1src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php
+4-1src/opnsense/mvc/app/models/OPNsense/Trust/Cert.xml
+4-1src/opnsense/mvc/app/models/OPNsense/Trust/Ca.xml
+28-144 files

OPNSense/core f390601. plist, src/opnsense/mvc/app/models/OPNsense/Base/FieldTypes TextField.php StrictTextField.php

mvc: add new validators to TextField: AllowSpaces, AllowNewlines, AllowSpecial and introduce new StrictTextField (#10398)

(cherry picked from commit c34b7786516afb6dff7a43af92c4328225b81e69)
(cherry picked from commit 9d0e4bf2bb4fdd20f872ff612c5135a7f9115101)
DeltaFile
+127-0src/opnsense/mvc/tests/app/models/OPNsense/Base/FieldTypes/StrictTextFieldTest.php
+81-0src/opnsense/mvc/tests/app/models/OPNsense/Base/FieldTypes/TextFieldTest.php
+61-2src/opnsense/mvc/app/models/OPNsense/Base/FieldTypes/TextField.php
+51-0src/opnsense/mvc/app/models/OPNsense/Base/FieldTypes/StrictTextField.php
+2-0plist
+322-25 files

OPNSense/core 94acb26src/opnsense/www/js/widgets/Metadata Core.xml

dnsmasq: change widget link from settings to leases page (#10420)

(cherry picked from commit 5e8f226d49196c55cd61ba1ee8e69fbbc194a835)
DeltaFile
+1-1src/opnsense/www/js/widgets/Metadata/Core.xml
+1-11 files

OPNSense/core 1ae1f62src/opnsense/mvc/app/models/OPNsense/TrafficShaper TrafficShaper.php

firewall: fix typo that prevented queues to be selectable in pf-based traffic shaping

(cherry picked from commit 558809488e9014f3452aa7cbcf1c5555a8697846)
DeltaFile
+10-3src/opnsense/mvc/app/models/OPNsense/TrafficShaper/TrafficShaper.php
+10-31 files

OPNSense/core aa27c06src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms dialogNptRule.xml, src/opnsense/mvc/app/models/OPNsense/Firewall Filter.php

firewall: allow WAN as "associated interface" for NPTv6 #10413
DeltaFile
+13-5src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.php
+1-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/dialogNptRule.xml
+14-62 files

OPNSense/core 3de53a2src/www firewall_rules_edit.php

firewall: escape shaper targets in rule edit

PR: GHSA-m4m3-v627-wgc2
DeltaFile
+1-0src/www/firewall_rules_edit.php
+1-01 files

OPNSense/core 5588094src/opnsense/mvc/app/models/OPNsense/TrafficShaper TrafficShaper.php

firewall: fix typo that prevented queues to be selectable in pf-based traffic shaping
DeltaFile
+10-3src/opnsense/mvc/app/models/OPNsense/TrafficShaper/TrafficShaper.php
+10-31 files

OPNSense/core 6bc0a1dsrc/etc/inc/plugins.inc.d ipsec.inc

ipsec: validate the use of refid in CA certificates

PR: GHSA-33q4-wcv7-r8fr
DeltaFile
+6-5src/etc/inc/plugins.inc.d/ipsec.inc
+6-51 files

OPNSense/core fc2f0d7src/opnsense/mvc/app/models/OPNsense/Trust Ca.xml Cert.xml, src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes CertificatesField.php CAsField.php

mvc: strict alphanumeric-only regex for certificate refid

CVE: CVE-2026-53582
PR: GHSA-xww7-76m6-mh2r
DeltaFile
+14-11src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php
+6-1src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php
+4-1src/opnsense/mvc/app/models/OPNsense/Trust/Ca.xml
+4-1src/opnsense/mvc/app/models/OPNsense/Trust/Cert.xml
+28-144 files

OPNSense/plugins 062918cnet-mgmt/telegraf pkg-descr Makefile, net-mgmt/telegraf/src/opnsense/mvc/app/controllers/OPNsense/Telegraf/forms output.xml

net-mgmt/telegraf: sync with master
DeltaFile
+13-1net-mgmt/telegraf/src/opnsense/mvc/app/controllers/OPNsense/Telegraf/forms/output.xml
+5-1net-mgmt/telegraf/src/opnsense/service/templates/OPNsense/Telegraf/telegraf.conf
+5-0net-mgmt/telegraf/pkg-descr
+1-1net-mgmt/telegraf/Makefile
+2-0net-mgmt/telegraf/src/opnsense/mvc/app/models/OPNsense/Telegraf/Output.xml
+26-35 files