RouterOS full changelog

bgp - fixed BGP origin attribute initial value;
bgp - properly apply link.local connection setting when it is used as an interface;
bgp-vpn - fixed prefix matching for filters "dst" matcher;
ospf - fixed wrong LS Ack warning;
pimsm - added comment for static-rp;
route - fixed gateway print when gateway is equal to BGP peers address;
route - fixed some routes installed in main routing table instead of specified VRF;
route - make discourse work with destinations from VRF;
routing-filter - fixed inline filters that process BGP communities;
system - improved incoming TCP connection responsiveness;
user - improved login service stability on busy system;
webfig - fixed broken WebFig after going to Quick Set (introduced in v7.20.4);
wifi - improved regulatory compliance for Bangladesh country profile;
winbox - group L3 and L4 fields under switch rules menu;

bgp - improved instance upgrade from versions prior to v7.20;
console - fixed file id conversion operations;
pppoe-server - fixed client disconnects when multiple servers are active (introduced in v7.20);
rip - fixed RIP configuration conversion on upgrade from v6 to v7;
route - fixed gateway print when gateway is equal to BGP peers address;
routing-filter - check AFI when setting pref-src;
routing-filter - fixed default route destination matcher behavior for different AFIs;
webfig - fixed button handling in skin designer;
winbox - show "Bus" parameter for "USB Power Reset" on Chateau LTE6/LTE18 ax devices;
winbox - show "System/RouterBOARD/Mode Button" on devices that have such a button;

bridge - fixed incorrectly blocked ports by STP (introduced in v7.20);
console - fixed incorrect ids in /file/print relative mode (introduced in v7.20);
console - improved stability when printing ids for a non-existent directory (introduced in v7.20)
dhcpv6-client - improved system stability when DHCPv6 client uses "rapid-commit=no", "accept-prefix-without-address=no" and receives only prefix from the server;
dhcpv6-server - do not force set "address-pool" on static bindings with unset pool option after system reboot;
evpn - added basic logging support;
evpn - fixed MAC mobility;
firewall - reduce maximum connection tracking entry count;
iot - fixed an issue preventing LoRa downlink packets from being broadcasted;
ip - removed duplicate CLI parameters for socksify;
log - cleaned up older config by removing leading slashes from "disk-file-name" values;
mpls - fixed LDP label binding if nexthop is link-local address;
poe-out - fixed RB5009 PoE-in indication on cold-boot with no other power source;
routing-filter - change "^$" regexp to bgp-path-len=0 on upgrade from v6 to v7;
routing-filter - use bgp-out-med for set bgp-med on upgrade from v6 to v7;
snmp - fixed SNMP SET operation (introduced in v7.20);
snmp - set maximum message size to 8 KB;
system - fixed ".auto.rsc" file execution (introduced in v7.20);
system - fixed package list fetch from local upgrade server;
system - fixed Windows executable compatibility with Microsoft AppLocker;
winbox - added IP/Socksify menu;
winbox - added support for 200Gbps/400Gbps Rate fields;
winbox - fixed Ethernet Tx Stats (introduced in v7.20);

bgp - added output.network-blackhole setting;
bgp - do not auto-generate blackhole routes by default (introduced in v7.20);
bgp - fixed inactive flag in GUI after instance disable/enable;
console - fixed ".id" printing when using "group-by" (introduced in v7.20);
console - fixed relative path printing (introduced in v7.20);
ike1 - fixed an issue where policies could be released too early before re-acquisition;
ipsec - improved driver stability;
ipv6,ra - fixed prefix unlinking from interface on configuration change and stop deprecating prefixes when the validity lifetime expires;
lte - fixed issue with firmware update for FG621-EA modem;
ppp - added support for KNOT BG77 modem firmware upgrade to version BG77LAR02A04_A0.301.A0.301;
qos-hw - always use qos-hw-offloading=yes for CRS812 device;
quickset - fixed issue where routes set by QuickSet did not appear in export;
route - improved stability;
routerboard - fixed non-running interfaces for CRS310-8G+2S+IN after booting to SwOS ("/system routerboard upgrade" required) (introduced in v7.20);
sfp - improved interface link speed configuration for CRS812;
snmp - fixed SNMP trap messages being corrupted when sent to multiple targets;
switch - fixed "failure: cpu flow control not supported" (introduced in v7.20);
webfig - fixed form closing with saving when pressing Enter key (introduced in v7.20);
webfig - fixed interface settings and graphs (introduced in v7.20);
webfig - improved container form loading performance when router has a lot of files;
winbox - fixed WinBox 3 application failure when opening IPv6/Firewall/Connection entry (introduced in v7.20);
www - improved stability (CVE-2025-10948);

arm64 - allow enabling receive packet steering on /system/resource/irq/rps menu in order to overcome unbalanced CPU load;
bgp - added output.network-blackhole setting;
bgp - allow duplicate router-ids for eBGP sessions (RFC-6286 ;
bgp - always advertise extended nexthop cap for all supported address families;
bgp - do not allow iBGP with non-equal ASNs;
bgp - do not auto-generate blackhole routes by default (introduced in v7.20 ;
bgp - fixed inactive flag in GUI after instance disable/enable;
bgp - fixed route refresh subcode 0 warning;
bgp - fixed selection of received BGP VPN routes;
bgp - implement RFC 9234 route leak prevention and detection using roles;
bonding - added lacp-system-id and lacp-system-priority settings;
bonding - fixed lacp-mode=passive;
bonding - improved stability for 802.3ad LACP;
bridge - fixed filter and NAT matching with "mac-protocol=length";
bridge - fixed missing local MAC after changing protocol-mode setting;
bridge - fixed static host and MDB entry updates on VLAN add/remove;
bridge - improved DHCP Option 82 values (circuit-id:"interface-name:vid", remote-id:"bridge MAC address" ;
bridge - improved stability after failed protocol-mode=mstp change;
bth - added file-share link preview;
bth - fixed big file upload;
bth - fixed file-share expire after reboot;
certificate - added SHA384, SHA512 support for SCEP;
certificate - allow ca-crl-host parameter for issued certificates;
certificate - improved Let's Encrypt logging;
certificate - on certificate import, added the "issued" flag if the certificate store contains the imported certificate's CA and its private key;
certificate - refactored Certificate internal processes;
chr - fixed guest OS type "Other Linux (64-bit ";
console - added "mvrp" to mac-protocol setting;
console - added changelog to /system/package/update/check-for-updates;
console - added delimiter parameter to :toarray command;
console - added reset command to setti

Bfd - fixed socket leak;
Bgp - fixed withdraw when input.accept-nlri is non-existent;
Btest - properly close unsuccessful TCP test sockets;
Console - added prompt to /disk/format command;
Disk - do not allow to start Btrfs replace command when a Btrfs replace process is already running;
Disk - improve disk file system detection;
Hotspot - allow only "http:" and "https:" schemas in dst field;
Iot - added LoRa interface recovery mechanism;
Iot - LoRa stability improvement;
Iot - LR8G/9G firmware update;
Ip-service - fixed "print count-only interval" when dynamic entries are added (introduced in v7.19);
Ip-service - fixed setting services by name (introduced in v7.19);
Ipsec - fixed responder on key exchange compute failure (introduced in v7.19);
Pv6 - do not show IPv6 FastPath as active when connection tracking or IPsec is used;
L2tp-ether - fixed interface creation/removal process;
Lte - added support for R11e-LTE6 v039 firmware release;
Lte - do not dial further if modem detects eSIM without profiles;
Lte - fixed eSIM management function for mmips and mipsbe architecture CPUs;
Lte - fixed eSIM provisioning for servers that do not send content-length in the HTTP response;
Route - fixed destination ordering for SNMP;
Route - fixed SNMP probing of IPv6 routes;
Route - make routing table print faster with hw-offload, gateway and blackhole queries;
Switch - fixed ACL rules when ports are not specified (fixes dynamic rules for RoMON);
Switch - fixed advertise and speed settings for ether1 on RB5009 (introduced in v7.19.1);
Webfig - improved screen reader support for WiFi fields in Quickset;
Webfig - make combobox accessible to screen readers;
Webfig - more space to branding logo;
Wifi-qcom - fixed beacon loss issues and improved stability for IPQ-6018;
Wifi-qcom - improved regulatory compliance;
Winbox - fixed "Last Topology Change" for bridge port monitor;

Bfd - fixed socket leak;
Bgp - fixed withdraw when input.accept-nlri is non-existent;
Btest - properly close unsuccessful TCP test sockets;
Console - added prompt to /disk/format command;
Disk - do not allow to start Btrfs replace command when a Btrfs replace process is already running;
Disk - improve disk file system detection;
Hotspot - allow only "http:" and "https:" schemas in dst field;
Iot - added LoRa interface recovery mechanism;
Iot - LoRa stability improvement;
Iot - LR8G/9G firmware update;
Ip-service - fixed "print count-only interval" when dynamic entries are added (introduced in v7.19);
Ip-service - fixed setting services by name (introduced in v7.19);
Ipsec - fixed responder on key exchange compute failure (introduced in v7.19);
Pv6 - do not show IPv6 FastPath as active when connection tracking or IPsec is used;
L2tp-ether - fixed interface creation/removal process;
Lte - added support for R11e-LTE6 v039 firmware release;
Lte - do not dial further if modem detects eSIM without profiles;
Lte - fixed eSIM management function for mmips and mipsbe architecture CPUs;
Lte - fixed eSIM provisioning for servers that do not send content-length in the HTTP response;
Route - fixed destination ordering for SNMP;
Route - fixed SNMP probing of IPv6 routes;
Route - make routing table print faster with hw-offload, gateway and blackhole queries;
Switch - fixed ACL rules when ports are not specified (fixes dynamic rules for RoMON);
Switch - fixed advertise and speed settings for ether1 on RB5009 (introduced in v7.19.1);
Webfig - improved screen reader support for WiFi fields in Quickset;
Webfig - make combobox accessible to screen readers;
Webfig - more space to branding logo;
Wifi-qcom - fixed beacon loss issues and improved stability for IPQ-6018;
Wifi-qcom - improved regulatory compliance;
Winbox - fixed "Last Topology Change" for bridge port monitor;

certificate – fixed support for certificates imported or added in RouterOS v7.4 or earlier (introduced in v7.19);
console - improved stability when a running script is removed;
container - stability improvements;
disk - fixed RAID component size to match the value in the superblock;
disk - improved handling of RAID spare disks;
disk - improved stability when using RAID;
ethernet - fixed flow-control for RB5009;
iot - fixed incorrectly shown LoRa payload RSSI values;
poe-out - fixed PoE-out reset when inserting specific SFP modules on RB5009;
poe-out - upgraded firmware for 802.3at PSE controlled boards (the update will cause brief power interruption to PoE-out interfaces);
routing-filter - use zero as default as-path length (allows matching empty as path);
sfp - correctly classify 100Mbps modules as "100M-baseFX";

console - fixed issue with file-name completion (introduced in v7.18);
container - fixed repository name handling to prevent redirect issues when basic authentication is used;
lte - additional fixes for eSIM management support;
lte - AT modems, improved redialing when modem lost connectivity without notifying host about APN status change;
netinstall - fixed socket reset (introduced in v7.18);
queue - fixed system failure when CAKE kind queue was configured but queue type definition does not exist anymore (introduced in v7.18);
wifi - improved stability for wifi interfaces;
winbox - improve graphing efficiency when communicating with WinBox;

bridge - improved stability in case of configuration error (introduced in v7.15;
bridge - show warning instead of causing error when using multicast MAC as admin-mac (introduced in v7.17;
cloud - fixed issues when BTH is toggled fast between enable/disable;
cloud - improved "BTH Files" web page design;
console - fixed issue with files when using scripts (introduced in v7.18;
console - improved file add/remove process stability;
dhcpv6-relay - clear saved routes on DHCP release;
dhcpv6-relay - show client address;
disk - add "sector-size" property in print detail;
disk - improved stability when formatting crypted partitions;
l3hw - remove VLAN tag before VXLAN encapsulation (fixes pvid behavior for bridged VXLAN;
lte - fixed modem recovery after firmware upgrade for R11e-LTE modem;
lte - fixed Router Advertisement processing issue for AT modems when an APN with "ip-type=ipv6" was configured;
ovpn - disable hardware accelerator for GCM on MMIPS CPUs (introduced in v7.18;
poe-out - fixed health showing 0V voltage when using PoE-in for RB960;
poe-out - upgraded firmware for 802.3at/bt PSE controlled boards (the update will cause brief power interruption to PoE-out interfaces;
route - show BGP session name instead of cache-id;
switch - improved stability when enabling IGMP snooping with VXLAN (introduced in v7.18;
system - improved internal "flash/" prefix handling for different file path related settings;
winbox - fixed missing SMB client on non-ROSE devices;