Howdy,

This updates ships a few third party updates, assorted core fixes and improvements of which Kea DDNS and options support may be the most sought-after.

The captive portal IPv6 changes are ready for wider testing on the development version and over there the grids will now auto-resize as the limits of the Tabulator UI are pushed farther and further. ;)

Here are the full patch notes:

• system: cleanup and simplify certificate deployment and remove legacy config import
• system: validate monitor uniqueness based on the host route presence
• system: simplify user/group sync scripts using config_read_array()
• interfaces: clean up overview UI code and fix CARP badge alignment
• interfaces: fix static neighbor apply button (contributed by Konstantinos Spartalis)
• interfaces: simplify CARP scripts using config_read_array()
• interfaces: automatic dhclient recovery
• interfaces: settings page use cases for config_read_array()
• firewall: fix regression in alias summary not shown in new rules GUI
• firewall: invalidate database when last updated time is in the future
• firewall: add missing "static port" option in source NAT
• firewall: add semantic groups coloring option in dashboard widget (contributed by Gunnar Lieb)
• firewall: one-to-one NAT rendered rule missed "log" statement
• firewall: add missing alias rename rule targets
• firewall: add alias GeoIP database update button and move bogons one to the same tab
• firewall: fix port handling in registered NAT rule
• firewall: fix MVC code vs. legacy rules display issues
• firewall: outbound NAT page use case for config_read_array()
• captive portal: cleanup and simplify certificate deployment and remove legacy config import
• captive portal: enforce POST-only on logoffAction() (contributed by Oliver Jueguen)
• dnsmasq: add "no-ping" option (contributed by Konstantinos Spartalis)
• dnsmasq: remove a too-strict validation for suffix IPv6 addresses without constructor use
• dnsmasq: ensure the lease view handles client-id correctly
• ipsec: fix delete selected for SPD and SAD
• kea: add DDNS and DHCP option support
• network time: add pool property for time servers (contributed by Konstantinos Spartalis)
• network time: remove stale symlink when PPS is disabled
• unbound: only emit warning when "addptr" was requested
• unbound: use expand formatter for blocklist URLs and DNSBL types
• unbound: include blocklist length in state change logic
• backend: more fixes for re-bound SyntaxWarning throws in Python 3.13
• backend: use config_read_array() non-insert mode mode iteration of virtual IPs
• mvc: BaseListField: merge remaining use of shared implementation of static options
• mvc: File: add file_update_contents() helper
• mvc: Shell: rewrite exec_safe() to avoid vsprintf() complications
• rc: speed up maintenance file deletes
• ui: bootgrid: require selection to be enabled for delete-selected
• ui: bootgrid: introduce 'expand' formatter to cap lists of data
• plugins: os-frr 1.51[1]
• plugins: os-tayga 1.5[2]
• ports: openldap 2.6.13[3]
• ports: perl 5.42.1[4]
• ports: phpseclib 3.0.50[5]
• ports: py-duckdb 1.5.0[6]
• ports: suricata 8.0.4[7]

Stay safe,
Your OPNsense team