Howdy!

One last stable update before the switch to the 25.1 series. Security-wise it has bee rather quiet over the past few weeks. A new kernel is included with a number of smaller reliability fixes and amendments.

The 25.1-RC1 images follow next week based on a full build using FreeBSD 14.2. Thanks all for testing the beta version so far! The release date for the final 25.1 version is January 29.

Here are the full patch notes:

- system: re-enable support for subjectAltName when creating CSRs
- system: remove spurious backup() during config revert
- reporting: add daemon -f parameter to close file descriptors for NetFlow local capture (contributed by Ben Smithurst)
- firmware: use output_cmd/output_txt helpers in remaining scripts
- ipsec: fix mobile clients reload missing system.inc
- isc-dhcp: IPv6 prefixes script can fail to restart (contributed by Ben Smithurst)
- kea-dhcp: align hostname validation with manual host entries
- mvc: add serialNumber and issuer in Store::parseX509()
- mvc: restore support for JSON input data without configd callout in JsonKeyValueStoreField
- ui: add classes to system history diff content so themes can override the defaults
- ui: load CSV as text to prevent encoding issues in SimpleFileUploadDlg()
- plugins: os-acme-client 4.7[1]
- plugins: os-caddy 1.8.0[2]
- plugins: os-freeradius 1.9.27[3]
- plugins: os-haproxy 4.4[4]
- plugins: os-mdns-repeater 1.2[5]
- plugins: os-squid 1.1[6]
- plugins: os-tailscale 1.1[7]
- plugins: os-theme-rebellion 1.9.2 (contributed by Team Rebellion)
- src: if_ovpn: improve reconnect handling
- src: iflib: set the NUMA domain in receive packet headers
- src: ip: defer checks for an unspecified dstaddr until after pfil hooks
- src: ice_ddp: update to 1.3.41.0
- ports: curl 8.11.1[8]
- ports: libpfctl 0.15
- ports: php 8.2.27[9]
- ports: python 3.11.11[10]

A hotfix release was issued as 24.7.12_2:

- plugins: turning binary data into JSON may fail globally
- unbound: fixup permission on copy
- ports: openvpn 2.6.13[11]

A hotfix release was issued as 24.7.12_4:

- firmware: add fingerprint and upgrade hint for 25.1
- firmware: disable duckdb migration for stable transition again

Stay safe,
Your OPNsense team