The Dude full changelog

winbox - fixed switch QoS monitor for mirror properties;
winbox - hide certificate "Issuer" field for certificate template;
winbox - hide IPv6 addresses for IP neighbors that no longer have them;
winbox - make multiple address fields required;
winbox - make separate inputs for WiFi Interworking "Authentication Types" and "Connection Capabilities" fields;
winbox - make VETH gateway fields not required;
winbox - move VRF from Ethernet to generic Interface table;
winbox - removed "Add" for dynamic DNS servers;
winbox - reorder BGP and OSPF tabs in logical order;
winbox - restore route max object 10000 limit;
winbox - show "Trusted" field for certificate template;
winbox - show warnings in "Routing/BGP" menus;
winbox - show warnings in Disk menu;
winbox - updated and shortened window titles (e.g. Address List -> Addresses);
wireguard - added VRF option (CLI only);
wireguard - allow to add AllowedIPs configuration for client configuration template;
wireless - added last-ip parameter for the CAPSMAN registration-table tab;
wireless - improved system stability when stopping scan process;
www - added option to disable individual web services in /ip/service/webserver and IP>Services>Web Server;
www - handle escaped characters in resource IDs and names for REST API requests;
www - process REST API requests only after user authentication is completed;
www - removed ability to publish directories via "/files" www service;

Bgp - fixed l2vpn-cisco decoding (introduced in v7.20);
Bgp - fixed occasional corruption of MPLS labels in BGP VPN update messages;
Bridge - fixed dynamic switch-cpu VLAN creation (introduced in v7.20);
Bridge - improved system stability when forwarding traffic with fast-path and bridged interface gets removed or disabled (introduced in v7.20);
Bth - make user private-key sensitive;
Console - fixed empty output in route menus when using "print where gateway";
Console - updated copyright notice;
Firewall - clear relevant masqueraded connection tracking entries on IP address change;
Ipv6 - initialize RA receiving when enabled and without any other IPv6 configuration;
Log - fixed memory leak;
Lte - fixed LTE interface IPv6 address generation to use EUI-64 (introduced in v7.20);
Lte - fixed no re-connection after cellular network requested APN deactivation on Chateau 5G ax R17;
Ovpn - fixed OVPN server handling on reboot (introduced in v7.20);
Ovpn - improved system stability when using cipher=blowfish128;
Sfp - fixed "sfp-tx-fault" state indication for CRS520-4XS-16XQ;
Sfp - fixed missing link up/down notifies;
Switch - fixed non-IP multicast packet receive on 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98CX8410 switches;
System - detect policy mismatch sooner if script is executed internally by some other service;
Ups - fixed board hibernation shutdown;
Wifi-mediatek - added Superchannel regulatory profile;

bridge - expose more DHCP snooping warning logs;
bridge - fixed possible DHCP packet drop caused by the add-dhcp-option82;
firewall - clear relevant masqueraded connection tracking entries on IP address change;
log - fixed memory leak;
tr069-client - expose 5G NR signal metrics for the Chateau R17 ax;
w60g - fixed possible memory leak when an interface is disabled;
winbox - fixed Preshared Key "auto" and "none" options for WireGuard Peer;

bridge - fixed issue where use-ip-firewall was enabled due to running container (introduced in v7.21beta8);
certificate - added certificate "trust-store" parameter (additional fixes);
console - fixed empty output in route menus when using "print where gateway";
console - improved service stability and memory allocation when using "regexp" operator;
console - improved service stability when executing commands that can timeout;
hotspot - prevent service from starting unnecessarily in the background on export/print commands;
lte - ask for user confirmation before installing eSIM profile (additional fixes);
ovpn - improved system stability when using cipher=blowfish128;
socksify - listen on all addresses for incoming connections;
ups - fixed board hibernation shutdown;
usb - fixed cases where USB bus order could change on D53 devices;

bgp - fixed BGP origin attribute initial value;
bgp - properly apply link.local connection setting when it is used as an interface;
bgp-vpn - fixed prefix matching for filters "dst" matcher;
ospf - fixed wrong LS Ack warning;
pimsm - added comment for static-rp;
route - fixed gateway print when gateway is equal to BGP peers address;
route - fixed some routes installed in main routing table instead of specified VRF;
route - make discourse work with destinations from VRF;
routing-filter - fixed inline filters that process BGP communities;
system - improved incoming TCP connection responsiveness;
user - improved login service stability on busy system;
webfig - fixed broken WebFig after going to Quick Set (introduced in v7.20.4);
wifi - improved regulatory compliance for Bangladesh country profile;
winbox - group L3 and L4 fields under switch rules menu;

bgp - improved instance upgrade from versions prior to v7.20;
console - fixed file id conversion operations;
pppoe-server - fixed client disconnects when multiple servers are active (introduced in v7.20);
rip - fixed RIP configuration conversion on upgrade from v6 to v7;
route - fixed gateway print when gateway is equal to BGP peers address;
routing-filter - check AFI when setting pref-src;
routing-filter - fixed default route destination matcher behavior for different AFIs;
webfig - fixed button handling in skin designer;
winbox - show "Bus" parameter for "USB Power Reset" on Chateau LTE6/LTE18 ax devices;
winbox - show "System/RouterBOARD/Mode Button" on devices that have such a button;

bridge - fixed incorrectly blocked ports by STP (introduced in v7.20);
console - fixed incorrect ids in /file/print relative mode (introduced in v7.20);
console - improved stability when printing ids for a non-existent directory (introduced in v7.20)
dhcpv6-client - improved system stability when DHCPv6 client uses "rapid-commit=no", "accept-prefix-without-address=no" and receives only prefix from the server;
dhcpv6-server - do not force set "address-pool" on static bindings with unset pool option after system reboot;
evpn - added basic logging support;
evpn - fixed MAC mobility;
firewall - reduce maximum connection tracking entry count;
iot - fixed an issue preventing LoRa downlink packets from being broadcasted;
ip - removed duplicate CLI parameters for socksify;
log - cleaned up older config by removing leading slashes from "disk-file-name" values;
mpls - fixed LDP label binding if nexthop is link-local address;
poe-out - fixed RB5009 PoE-in indication on cold-boot with no other power source;
routing-filter - change "^$" regexp to bgp-path-len=0 on upgrade from v6 to v7;
routing-filter - use bgp-out-med for set bgp-med on upgrade from v6 to v7;
snmp - fixed SNMP SET operation (introduced in v7.20);
snmp - set maximum message size to 8 KB;
system - fixed ".auto.rsc" file execution (introduced in v7.20);
system - fixed package list fetch from local upgrade server;
system - fixed Windows executable compatibility with Microsoft AppLocker;
winbox - added IP/Socksify menu;
winbox - added support for 200Gbps/400Gbps Rate fields;
winbox - fixed Ethernet Tx Stats (introduced in v7.20);

bgp - added output.network-blackhole setting;
bgp - do not auto-generate blackhole routes by default (introduced in v7.20);
bgp - fixed inactive flag in GUI after instance disable/enable;
console - fixed ".id" printing when using "group-by" (introduced in v7.20);
console - fixed relative path printing (introduced in v7.20);
ike1 - fixed an issue where policies could be released too early before re-acquisition;
ipsec - improved driver stability;
ipv6,ra - fixed prefix unlinking from interface on configuration change and stop deprecating prefixes when the validity lifetime expires;
lte - fixed issue with firmware update for FG621-EA modem;
ppp - added support for KNOT BG77 modem firmware upgrade to version BG77LAR02A04_A0.301.A0.301;
qos-hw - always use qos-hw-offloading=yes for CRS812 device;
quickset - fixed issue where routes set by QuickSet did not appear in export;
route - improved stability;
routerboard - fixed non-running interfaces for CRS310-8G+2S+IN after booting to SwOS ("/system routerboard upgrade" required) (introduced in v7.20);
sfp - improved interface link speed configuration for CRS812;
snmp - fixed SNMP trap messages being corrupted when sent to multiple targets;
switch - fixed "failure: cpu flow control not supported" (introduced in v7.20);
webfig - fixed form closing with saving when pressing Enter key (introduced in v7.20);
webfig - fixed interface settings and graphs (introduced in v7.20);
webfig - improved container form loading performance when router has a lot of files;
winbox - fixed WinBox 3 application failure when opening IPv6/Firewall/Connection entry (introduced in v7.20);
www - improved stability (CVE-2025-10948);

arm64 - allow enabling receive packet steering on /system/resource/irq/rps menu in order to overcome unbalanced CPU load;
bgp - added output.network-blackhole setting;
bgp - allow duplicate router-ids for eBGP sessions (RFC-6286 ;
bgp - always advertise extended nexthop cap for all supported address families;
bgp - do not allow iBGP with non-equal ASNs;
bgp - do not auto-generate blackhole routes by default (introduced in v7.20 ;
bgp - fixed inactive flag in GUI after instance disable/enable;
bgp - fixed route refresh subcode 0 warning;
bgp - fixed selection of received BGP VPN routes;
bgp - implement RFC 9234 route leak prevention and detection using roles;
bonding - added lacp-system-id and lacp-system-priority settings;
bonding - fixed lacp-mode=passive;
bonding - improved stability for 802.3ad LACP;
bridge - fixed filter and NAT matching with "mac-protocol=length";
bridge - fixed missing local MAC after changing protocol-mode setting;
bridge - fixed static host and MDB entry updates on VLAN add/remove;
bridge - improved DHCP Option 82 values (circuit-id:"interface-name:vid", remote-id:"bridge MAC address" ;
bridge - improved stability after failed protocol-mode=mstp change;
bth - added file-share link preview;
bth - fixed big file upload;
bth - fixed file-share expire after reboot;
certificate - added SHA384, SHA512 support for SCEP;
certificate - allow ca-crl-host parameter for issued certificates;
certificate - improved Let's Encrypt logging;
certificate - on certificate import, added the "issued" flag if the certificate store contains the imported certificate's CA and its private key;
certificate - refactored Certificate internal processes;
chr - fixed guest OS type "Other Linux (64-bit ";
console - added "mvrp" to mac-protocol setting;
console - added changelog to /system/package/update/check-for-updates;
console - added delimiter parameter to :toarray command;
console - added reset command to setti

arm64/x86/chr - added Aquantia network driver;
bgp - fixed nexthop force-self for IPv4 and IPv6;
bgp - fixed withdraw (introduced in v7.20beta2);
bgp - improved configuration upgrade from versions prior to 7.20;
bgp - make "as" parameter optional in template configuration;
console - fixed incorrect multibyte to=num conversions;
console - fixed issue where file completion sometimes shows duplicates;
dns - improved DNS service stability when using static CNAME records (introduced in v7.20beta4);
file - improved file handling performance in WinBox v4 (additional fixes);
firewall - added "liberal-tcp-tracking" connection tracking setting;
iot - added additional dongle firmwares to iot-bt-extra package;
iot - improvement to LoRa band verification logic;
license - updated URL for "libcroco" package in the license notice;
log - establish a new connection to the remote log server when action settings are edited (e.g. after changing the src-address property);
log - fixed memory leak when a connection to remote TCP log server failed;
netinstall-cli - recognize RouterOS v6 system package;
poe-out - upgraded firmware for 802.3at/bt controlled boards (the update will cause brief power interruption to PoE-out interfaces);
routing-filter - fixed route origin matcher;
sfp - added sfp-power-class and sfp-max-power monitor values for QSFP (additional fixes);
ssl/tls - fixed SSL looping behavior when multiple different TLS connections were used;
supout - added IP Service section;
supout - added VXLAN VTEP section;
system - fixed internal service communication procedure when exchanging data about existing objects (introduced in v7.20beta2);
vrrp - fixed invalid TCP connection state after failover with enabled sync-connection-tracking;
vrrp - improved stability when removing VRRP interface with enabled sync-connection-tracking;
vxlan - added checksum and learning properties (additional fixes);
vxlan - fixed unset behavior for "local-address" and &