packages/net/unbound/patches, branch master

unbound: update to 1.25.2

2026-07-31T05:55:00Z

From upstream: 1.25.2 consolidates security fixes for issues reported over a period of time. There are fixes for CVE-2026-14586, CVE-2026-32665, CVE-2026-40691, CVE-2026-41637, CVE-2026-42955, CVE-2026-44621, CVE-2026-44687, CVE-2026-44690, CVE-2026-46582, CVE-2026-50045, CVE-2026-50046, CVE-2026-50243, CVE-2026-50248, CVE-2026-50251, CVE-2026-50252, CVE-2026-52863, CVE-2026-54478, CVE-2026-55708, CVE-2026-55717, CVE-2026-55973, CVE-2026-55990, CVE-2026-55991, CVE-2026-56416 and CVE-2026-56444. Full details at https://github.com/NLnetLabs/unbound/releases/tag/release-1.25.2 Signed-off-by: Tyrel M. McQueen

unbound: update to 1.25.1

2026-05-28T09:17:42Z

From upstream: 1.25.1 consolidates security fixes for issues reported over a period of time. There are fixes for CVE-2026-33278, CVE-2026-42944, CVE-2026-42959, CVE-2026-32792, CVE-2026-40622, CVE-2026-41292, CVE-2026-42534, CVE-2026-42923, CVE-2026-42960, CVE-2026-44390 and CVE-2026-44608. Full details at https://www.nlnetlabs.nl/news/2026/May/20/unbound-1.25.1-released/ and https://www.nlnetlabs.nl/news/2026/Apr/29/unbound-1.25.0-released/ Signed-off-by: Tyrel M. McQueen

unbound: update to 1.24.2

2025-12-10T17:38:27Z

Fixes: Possible Domain Hijacking via promiscuous NS Records (CVE-2025-11411) Changelog: https://www.nlnetlabs.nl/projects/unbound/download/#unbound-1-24-2 Upstream commit f6269baa605d31859f28770e01a24e3677e5f82c https://github.com/NLnetLabs/unbound/commit/f6269baa605d31859f28770e01a24e3677e5f82c Signed-off-by: Goetz Goerisch

unbound: update to 1.24.0

2025-09-29T08:43:10Z

latest upstream 09182024 Signed-off-by: Eric Luehrsen

unbound: update to 1.23.0

2025-05-09T18:52:16Z

Signed-off-by: Eric Luehrsen

unbound: update to 1.22.0

2024-11-10T19:24:52Z

Signed-off-by: Jan Klos [Solve PKG_RELEASE conflict]

unbound: update to 1.21.0

2024-08-28T20:10:42Z

Signed-off-by: Jan Klos

unbound: Update to 1.20.0

2024-06-16T23:44:45Z

Updated 010-configure-uname.patch as source changed. Removed 100-example-conf-in.patch as not needed any more. Release message: This release has a fix for the DNSBomb issue CVE-2024-33655. This has a low severity for Unbound, since it makes Unbound complicit in targeting others, but does not affect Unbound so much. To mitigate the issue new configuration options are introduced. The options discard-timeout: 1900, wait-limit: 1000 and wait-limit-cookie: 10000 are enabled by default. They limit the number of outstanding queries that a querier can have. This limits the reply pulse, and make Unbound less favorable for the issue. With the config wait-limit-netblock and wait-limit-cookie-netblock the parameters can be fine tuned for specific destinations. More information on the attack and Unbound's mitigations are presented further down. Other fixes in this release are that Unbound no longer follows symlinks when truncating the pidfile. Unbound also does not chown the pidfile, this is for safety reasons. There are also a number of fixes for RPZ, in handling CNAMEs. There is a memory leak fix for the edns client subnet cache. For DNSSEC validation a case is fixed when the query is of type DNAME. The unbound-anchor program is fixed to first write to a temporary file, before replacing the original. This handles disk full situations, and because of it unbound-anchor needs permission to create that file, in the same directory as the original file. There is also a fix for IP_DONTFRAG, to disable fragmentation instead of the opposite. The option cache-min-negative-ttl can be used to set the minimum TTL for negative responses in the cache. It complements existing options to set the maximum ttl for negative responses and to set the minimum and maximum ttl but not specifically for negative responses. The option cachedb-check-when-serve-expired option makes Unbound use cachedb to check for expired responses, when serve-expired is enabled, and cachedb is used. It is enabled by default. The -q option for unbound-checkconf can be added to silence it when there are no errors. Signed-off-by: Ryan Keane

unbound: update to 1.19.3

2024-03-18T20:26:51Z

Signed-off-by: Jan Klos

unbound: update to latest upstream release version 1.19.1

2024-02-18T18:30:22Z

Maintainer: @EricLuehrsen Fixes: CVE-2023-50387, CVE-2023-50868 Release notes: https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ Run tested: BPi-R3, mediatek/filogic, OpenWrt 23.05.2 Signed-off-by: S. Brusch