RouterOS full changelog

app - added jupyter-notebook, livebook, myip, and rustfs apps (additional fixes);
app - added support for custom apps (additional fixes);
app - do not show duplicate entries of required-mounts;
app - fixed elasticsearch, element, pmacct-netflow apps failing to start (additional fixes);
bgp-vpn - allow modifying scopes with routing filters;
bgp-vpn - use target scope for imported route;
netinstall-cli - fixed empty configuration option (introduced in v7.22rc3);
ospf - fixed typos in log messages;
route - added SLAAC route redistribution for IPv6 capable routing protocols;
route - fixed /routing/settings not able to set configuration without specifying policy-rule parameter (introduced in v7.22rc3);
routing-filter - added possibility to match SLAAC and bgp-mpls-vpn route types;
switch - improved system stability when changing bridge multicast-router property on CRS1xx/2xx (introduced in v7.19);
system - added reset-configuration keep-apps=yes (additional fixes);
wifi - improved support for 802.11be access points (additional fixes);
winbox - fixed L3HW default value for VLAN interface (introduced in v7.21);
winbox - rearrange filter wizard parameters in tabs;

App - added "media-path" and "download-path" setting in /app/settings;
App - added shm_size parameter to apps that require it;
App - calibre-web app auto add db if none exists;
App - fixed Firefox and Webtop to work with https-proxy;
App - fixed fossil app login typo;
Bgp - implement revised input error handling per RFC 7606;
Container - added support for the shm_size setting;
Container - allow non-root user write to SMB share;
Container - changed default container registry to docker.io;
Container - do not mount tmpfs on /tmp and /run by default;
Container - do not start container if any volume is not mounted;
Container - fixed nftables/iptables not working with "Message too long" error;
Container - made container mounts writable by the user;
Defconf - added single port MGMT bridge on CCR/RDS for easier /app configuration;
Defconf - improved firewall rule for local traffic to the loopback interface;
Disk - fixed issue where mountpoint was not removed after removing the disk;
Dns - fixed domain resolution for the ":resolve" command "server" parameter;
Lte - fixed issue for Chateau 5G R17 ax (introduced in v7.21.1);
Poe-out - firmware update for 802.3at capable boards (the update will cause a brief power interruption to poe-out interfaces);
Poe-out - firmware update for 802.3bt capable boards (the update will cause a brief power interruption to poe-out interfaces);
Poe-out - fixed occasional firmware update failure on CRS354;
Poe-out - fixed PSU state recovery upon unplug/replug on CRS320;
Ppp - added initial support for BG770A-GL modem firmware update;
Ppp - fixed premature PPP client disconnect on BG77 modems during firmware update;
Route - prevent creating routing tables with the same name;
Routing-filter - fixed num-set matcher;
Sfp - fixed sfp-ignore-rx-loss parameter for RB760iGS;
Sfp - improved initialization and linking for some QSFP modules;
Snmp - fixed handling of the script "dont-require-permissions&qu

bridge - fixed dynamic switch-cpu VLAN creation (introduced in v7.21);
bridge - improved stability when using MVRP (introduced in v7.21);
certificate - fixed empty trust store handling in certain cases (introduced in v7.21);
container - changed app auto update to be off by default;
container - fixed issue where containers may not start with large mounts;
health - fixed fan and PSU state logging for MIPSBE devices;
leds - fixed power LED behavior for hAP ax S;
lte - fixed APN configuration for QMI modems in a 3G network when use-network-apn=yes is used;
switch - fixed switch type for hAP ax lite devices (introduced in v7.21);
system - fixed rare partial loss of RouterOS configuration;

bgp - changed multipath to number argument;
bgp - fixed BGP output sometimes not being cleaned after session restart;
bgp - fixed ignore-as-path-len not being used;
bgp - fixed update messages not being sent on default-prepend value change;
bgp - implemented add-path;
bridge - allow disabling MVRP through WinBox;
bridge - improved logic for interface remove;
bridge - improved stability when using MVRP (introduced in v7.21);
bridge - improved VRRP MAC address handling;
certificate - fixed empty trust store handling in certain cases (introduced in v7.21);
console - added left shift (<<) and right shift (>>) support for IPv6 addresses;
console - added on-event script runner support to print follow/follow-only;
console - added timestamp support to print follow/follow-only;
console - fixed time drift for interface last-link-down-time and last-link-up-time;
console - improved command decoding to drop extraneous commands (visible in history logging);
console - improved export command to avoid empty [find];
console - improved history logging when performing object rename with set/reset;
console - use the same flag output format for both print brief and detail;
container - changed app auto update to be off by default;
defconf - improved firewall rule for local traffic to the loopback interface;
detnet - added request-interval setting (additional fixes);
disk - added trim command which functions similarly to fstrim;
disk - fixed issue where iSCSI did not work with ESXi and XEN hypervisors;
disk - fixed issue with disks not mounting after swapping devices;
disk - fixed opening a drive in read-only mode if it became locked;
disk - improved BTRFS stability on TILE devices;
disk - renamed format file-system=trim and trim-secure to format file-system=discard and discard-secure;
gps - fixed GPS port disappearance after reboot for EC25-EU&KNe;
health - fixed fan and PSU state logging for MIPSBE devices;
ip - added reverse-proxy;
ipv6 - improved system stability when mani

bgp - fixed early-cut not working properly;
bgp - implement multipath (ability for BGP best path to select ECMP routes);
bgp - implement revised input error handling per RFC 7606;
bridge - added local and static MAC synchronization for MLAG;
bridge - added MLAG support per bridge interface (/interface/bridge/mlag menu is moved to /interface/bridge; configuration is automatically updated after upgrade; downgrading to an older version will result in MLAG configuration loss);
bridge - added MLAG-specific aged and aged-peer flags to host table;
bridge - added RA guard feature;
bridge - fixed MAC moving between regular ports and bonds for MLAG;
bridge - fixed MLAG state being permanently disabled when changing bridge interface settings;
bridge - improved MAC synchronization for MLAG;
certificate - improved certificate export process;
certificate - improved logging;
console - added :continue and :break commands for various loops;
console - added :exit command to terminate scripts;
console - added "comments" parameter to print command to control comment and error output;
console - added comparison operators for ID values;
console - added Ctrl+Left/Right word navigation;
console - added Ctrl+w word deletion;
console - added hint for dry-run import parameter;
console - allow undefined variables in dry-run import;
console - changed autocomplete expansion criteria;
console - disable follow command in /ip/firewall/connection menu;
console - fixed brief print for entries with multiple comments;
console - fixed setting of /interface/wireless/scan-list;
console - fixed value type names in comparison errors;
console - implement string casting in :tobool command;
console - improved error tracing when using find command;
console - improved set/remove command handling in /file menu;
console - look up variable in global scope if argument scope lookup failed;
console - parse width parameter for non-interactive SSH commands;
console - show smaller QR codes where possible;
conta

bridge - fixed issue where use-ip-firewall was enabled due to running container (introduced in v7.21beta8);
certificate - added certificate "trust-store" parameter (additional fixes);
console - fixed empty output in route menus when using "print where gateway";
console - improved service stability and memory allocation when using "regexp" operator;
console - improved service stability when executing commands that can timeout;
hotspot - prevent service from starting unnecessarily in the background on export/print commands;
lte - ask for user confirmation before installing eSIM profile (additional fixes);
ovpn - improved system stability when using cipher=blowfish128;
socksify - listen on all addresses for incoming connections;
ups - fixed board hibernation shutdown;
usb - fixed cases where USB bus order could change on D53 devices;

bgp - fixed BGP origin attribute initial value;
bgp - properly apply link.local connection setting when it is used as an interface;
bgp-vpn - fixed prefix matching for filters "dst" matcher;
ospf - fixed wrong LS Ack warning;
pimsm - added comment for static-rp;
route - fixed gateway print when gateway is equal to BGP peers address;
route - fixed some routes installed in main routing table instead of specified VRF;
route - make discourse work with destinations from VRF;
routing-filter - fixed inline filters that process BGP communities;
system - improved incoming TCP connection responsiveness;
user - improved login service stability on busy system;
webfig - fixed broken WebFig after going to Quick Set (introduced in v7.20.4);
wifi - improved regulatory compliance for Bangladesh country profile;
winbox - group L3 and L4 fields under switch rules menu;

bgp - improved instance upgrade from versions prior to v7.20;
console - fixed file id conversion operations;
pppoe-server - fixed client disconnects when multiple servers are active (introduced in v7.20);
rip - fixed RIP configuration conversion on upgrade from v6 to v7;
route - fixed gateway print when gateway is equal to BGP peers address;
routing-filter - check AFI when setting pref-src;
routing-filter - fixed default route destination matcher behavior for different AFIs;
webfig - fixed button handling in skin designer;
winbox - show "Bus" parameter for "USB Power Reset" on Chateau LTE6/LTE18 ax devices;
winbox - show "System/RouterBOARD/Mode Button" on devices that have such a button;

bridge - fixed incorrectly blocked ports by STP (introduced in v7.20);
console - fixed incorrect ids in /file/print relative mode (introduced in v7.20);
console - improved stability when printing ids for a non-existent directory (introduced in v7.20)
dhcpv6-client - improved system stability when DHCPv6 client uses "rapid-commit=no", "accept-prefix-without-address=no" and receives only prefix from the server;
dhcpv6-server - do not force set "address-pool" on static bindings with unset pool option after system reboot;
evpn - added basic logging support;
evpn - fixed MAC mobility;
firewall - reduce maximum connection tracking entry count;
iot - fixed an issue preventing LoRa downlink packets from being broadcasted;
ip - removed duplicate CLI parameters for socksify;
log - cleaned up older config by removing leading slashes from "disk-file-name" values;
mpls - fixed LDP label binding if nexthop is link-local address;
poe-out - fixed RB5009 PoE-in indication on cold-boot with no other power source;
routing-filter - change "^$" regexp to bgp-path-len=0 on upgrade from v6 to v7;
routing-filter - use bgp-out-med for set bgp-med on upgrade from v6 to v7;
snmp - fixed SNMP SET operation (introduced in v7.20);
snmp - set maximum message size to 8 KB;
system - fixed ".auto.rsc" file execution (introduced in v7.20);
system - fixed package list fetch from local upgrade server;
system - fixed Windows executable compatibility with Microsoft AppLocker;
winbox - added IP/Socksify menu;
winbox - added support for 200Gbps/400Gbps Rate fields;
winbox - fixed Ethernet Tx Stats (introduced in v7.20);

bgp - added output.network-blackhole setting;
bgp - do not auto-generate blackhole routes by default (introduced in v7.20);
bgp - fixed inactive flag in GUI after instance disable/enable;
console - fixed ".id" printing when using "group-by" (introduced in v7.20);
console - fixed relative path printing (introduced in v7.20);
ike1 - fixed an issue where policies could be released too early before re-acquisition;
ipsec - improved driver stability;
ipv6,ra - fixed prefix unlinking from interface on configuration change and stop deprecating prefixes when the validity lifetime expires;
lte - fixed issue with firmware update for FG621-EA modem;
ppp - added support for KNOT BG77 modem firmware upgrade to version BG77LAR02A04_A0.301.A0.301;
qos-hw - always use qos-hw-offloading=yes for CRS812 device;
quickset - fixed issue where routes set by QuickSet did not appear in export;
route - improved stability;
routerboard - fixed non-running interfaces for CRS310-8G+2S+IN after booting to SwOS ("/system routerboard upgrade" required) (introduced in v7.20);
sfp - improved interface link speed configuration for CRS812;
snmp - fixed SNMP trap messages being corrupted when sent to multiple targets;
switch - fixed "failure: cpu flow control not supported" (introduced in v7.20);
webfig - fixed form closing with saving when pressing Enter key (introduced in v7.20);
webfig - fixed interface settings and graphs (introduced in v7.20);
webfig - improved container form loading performance when router has a lot of files;
winbox - fixed WinBox 3 application failure when opening IPv6/Firewall/Connection entry (introduced in v7.20);
www - improved stability (CVE-2025-10948);