Hi again,

This update ships a number of third party security updates, firewall live log improvements based on user feedback from 25.7.6, plus minor fixes and improvements like usual.

One focus at the moment is to get rid of the unsafe shell use in the backend which has been the source of multiple security issues in the project history. A few other things are coming to 25.7.x soon: a neighbor watch daemon, a new NDP proxy plugin and a community theme. Stay tuned. :)

Here are the full patch notes:

• system: simplify RRD backup code and remove exec() usage[1] (reported by Alex Williams from Pellera Technologies working with Trend Zero Day Initiative)
• system: move valid_from search criteria to log_matcher for faster end of search
• system: use file_safe() in gateway monitor watcher
• system: refactor factory reset page to MVC and add a reset per component operating on models
• interfaces: ifctl: always allow reads to internal state files
• firewall: automation: fix alias IP address search
• firewall: automation: allow interface parameter to contain a list of interfaces for API users
• firewall: aliases: replace invalid unicode chars (contributed by Marius Halden)
• firewall: live log: only execute redraw on visibility state transition
• firewall: live log: optimize viewbuffer rendering
• firewall: live log: prevent re-resolving in-flight requests and move host lookup to current filtered view
• firewall: live log: fix data ordering and add table/history limit options
• firewall: live log: use "badge" class like before
• firewall: states: fix delete_selected firewall states (contributed by Alexander Sulfrian)
• dnsmasq: add optgroup support to DHCP option fields and expose all DHCPv4 options
• ipsec: sessions: add datakey property for row mapping
• ipsec: status: search phase 2 triggered twice on click and cleanup tooltip event as well
• openvpn: use file_safe() to write CRL files
• mvc: OptionField: properly translate optgroup
• mvc: JsonKeyValueStoreField: fix race condition when using SourceField in the model
• mvc: persist models description in root attribute of its respective configuration
• rc: secure an exec() in the recovery script
• ui: improve grid responsiveness via minWidth()
• ui: remove this.dataIdentifier as datakey defines the key to be used when asking "row-id" or getSelectedRows
• ui: SimpleActionButton: add support for icons in action buttons
• ui: recompile default themes using dart sass (1.93.2) which changes color rendering
• ui: keyboard shortcuts for "a"dvanced and "h"elp in MVC pages (contributed by Konstantinos Spartalis)
• ui: bail out on dynamic grid resize if data is loading
• plugins: os-frr 1.48[2]
• plugins: os-tayga 1.3[3]
• ports: kea 3.0.2[4]
• ports: libxml 2.14.6[5]
• ports: php 8.3.27[6]
• ports: sqlite 3.50.4[7]
• ports: strongswan 6.0.3[8]
• ports: suricata 8.0.2[9]
• ports: unbound 1.24.1[10]

A hotfix release was issued as 25.7.7_2:

• system: fix a HA sync regression introduced in 25.7.6 that prevented a sync from succeeding in an edge case
• interfaces: fix overview details button not working

A hotfix release was issued as 25.7.7_4:

• ui: bootgrid: prevent full table redraw without onDataProcessed trigger
• ui: bootgrid: add missing datakeys to two pages

Stay safe,
Your OPNsense team