packages/net/bind/Makefile, branch master

bind: bump to 9.20.29

2026-09-18T15:46:40Z

Includes several security fixes: - CVE-2026-19668 Prevent excessive CPU use validating crafted DNSSEC responses. - CVE-2026-19033 Require a TSIG on every message of incoming zone transfers. - CVE-2026-77119 Prevent a DNSSEC downgrade of secure delegations via unrelated NSEC3. - CVE-2026-19941 Prevent forged DNSSEC-validated NXDOMAIN responses. - CVE-2026-19666 DNS64 with break-dnssec could cause an assertion failure. - CVE-2026-19667 Reject negative cache records that do not fit in a dns_rdata_t. - CVE-2026-19662 Prevent resolver crash with cached DNSSEC proofs. - CVE-2026-75029 Discard repeated SOA, CNAME, and DNAME records when parsing DNS messages. - CVE-2026-77692 Fix an unauthenticated crash on HTTPS using SIG(0) - CVE-2026-81736 Cached HTTPS/SVCB aliases could exhaust resolver CPU. - CVE-2026-76163 Prevent TKEY queries from terminating named without global options. - CVE-2026-78301 Out-of-zone records in a zone database could be served as authoritative. - CVE-2026-80274 Crash on wildcard answers carrying both NSEC and NSEC3 proofs. - CVE-2026-81563 Following HTTPS/SVCB aliases could leak resolver cache memory. Complete upstream changelog is available at https://ftp.isc.org/isc/bind9/9.20.29/doc/arm/html/changelog.html Signed-off-by: Noah Meyerhans

bind: use ATOMIC64_DEPENDS

2026-09-16T15:35:19Z

libatomic is only needed where the compiler does not inline 64-bit atomics, but the package depends on it on every target. ATOMIC64_DEPENDS restricts the dependency to those targets. Signed-off-by: Daniel Golle

bind: bump to 9.20.26

2026-07-24T08:50:58Z

Fixes several security issues: - CVE-2026-11331 Fix handling of rpz CNAME expansion that returns name too long. - CVE-2026-11721 Invalid signed wildcard records were being accepted. - CVE-2026-13321 Fix DNSSEC validation bypass via out-of-zone NSEC Next Field. - CVE-2026-10723 Correct verification of NSEC3 signer name. - CVE-2026-12617 Do no assert for some specifics CNAME and DNAME queries. - CVE-2026-10822 Malformed DNSKEY records could trigger an assertion. - CVE-2026-11605 Prevent excessive validation work from crafted negative responses. - CVE-2026-11622 Prevent cache exhaustion under sustained attack. Full release notes are available upstream at https://ftp.isc.org/isc/bind9/9.20.26/doc/arm/html/changelog.html Signed-off-by: Noah Meyerhans

bind: bump to 9.20.23

2026-05-29T13:25:01Z

Resolves several security issues: - CVE-2026-3592: Limit resolver server list size. - CVE-2026-3039: Fix GSS-API resource leak. - CVE-2026-5950: Avoid unbounded recursion loop. - CVE-2026-5947: Fix crash in resolver when SIG(0)-signed responses are received under load. - CVE-2026-3593: Add system test for HTTP/2 SETTINGS frame flood. - CVE-2026-5946: Disable recursion, UPDATE, and NOTIFY for non-IN views. Complete list of changes is available upstream at https://ftp.isc.org/isc/bind9/9.20.23/doc/arm/html/changelog.html Signed-off-by: Noah Meyerhans

bind: prevent mismatch of bind-libs version

2026-04-07T18:59:27Z

When upgrading specific packages manually, like: apk upgrade bind-dig the bind-libs package is not upgraded automatically, which results in problems when running the program, for example: root@OpenWrt:~# dig Error loading shared library libisc-9.20.10.so: No such file or directory (needed by /usr/bin/dig) Error loading shared library libdns-9.20.10.so: No such file or directory (needed by /usr/bin/dig) Error loading shared library libisccfg-9.20.10.so: No such file or directory (needed by /usr/bin/dig) Error relocating /usr/bin/dig: cfg_map_getname: symbol not found Error relocating /usr/bin/dig: irs_resconf_getndots: symbol not found Error relocating /usr/bin/dig: isc_managers_destroy: symbol not found Error relocating /usr/bin/dig: dns_fixedname_init: symbol not found Error relocating /usr/bin/dig: isc_nm_read: symbol not found Error relocating /usr/bin/dig: dns_rdata_init: symbol not found Error relocating /usr/bin/dig: isc_random_uniform: symbol not found [...] This has happened to me twice on OpenWRT 24.10. To fix this, enforce that the version of bind-libs matches the version of any dependent packages. Use the same approach as in net/knot/Makefile: make the dependency be present twice, once in the DEPENDS variable, the other one in the EXTRA_DEPENDS variable. Also, add an explicit EXTRA_DEPENDS variable to other internal dependencies. For example, versions of the bind-server-filter-aaaa and bind-server packages must match. Tested on snapshot, on x86/64. Signed-off-by: Mateusz Jończyk

bind: bump to 9.20.21

2026-03-31T11:42:09Z

Fixes several security issues: - CVE-2026-1519 Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations. - CVE-2026-3104 Fix memory leaks in code preparing DNSSEC proofs of non-existence. - CVE-2026-3119 Prevent a crash in code processing queries containing a TKEY record. - CVE-2026-3591 Fix a stack use-after-return flaw in SIG(0) handling code. Signed-off-by: Noah Meyerhans

bind: backport patch replace automatic empty zones

2026-02-01T14:01:50Z

The RFC-1918 zones are automatically synthesized locally by bind to avoid forwarding queries about them to root nameservers. As a result, we can't easily replace them with rndc addzone on the fly. We need this for DHCP integration. Signed-off-by: Philip Prindeville

bind: bump to 9.20.18

2026-01-24T08:05:56Z

Fixes security issues: - CVE-2025-13878: Malformed BRID and HHIT records could trigger an assertion failure. Signed-off-by: Noah Meyerhans

bind: manual fix for IPv6 server unreachable noise

2025-12-13T01:06:44Z

Until we have a failsafe way of detecting no IPv6 internet connectivity automatically, allow the users to set it manually for now. Signed-off-by: Philip Prindeville

bind: save out served domains on service stop

2025-12-06T21:05:05Z

If named gets stopped, then started again, but isc-dhcpd isn't also restarted, then we want named to at least have the existing content. Signed-off-by: Philip Prindeville