Log message:
knot: Update to 3.5.8

Knot DNS 3.5.8 (2026-09-04)

Improvements:
knotc: better compatibility with SmartOS #979
knotd: added a check for possible errors while reading a backup label file
knotd: more robust parsing of data stored in LMDB (Thanks to Jim Alves-Foss)

Bugfixes:
knotd: unauthenticated TSIG chosen-prefix signing that enables DDNS forgery \ 
(Thanks to Gia Bui)
knotd: server crash due to a missing check for malformed TCP packet in XDP mode \ 
(Thanks to Kushal Das)
kzonecheck: defective zone origin detection if the file name is too short \ 
(Thanks to Kushal Das)

Log message:
knot: Fix patch path typo

Log message:
knot: Fix from upstream to properly compile on SunOS

Log message:
knot: Update to 3.5.7

Knot DNS 3.5.7 (2026-08-18)

Improvements:
knotd: new debug logging for DDNS prerequisite errors
knotd: support for SO_BINDTODEVICE for remotes/via #977 (closed) (Thanks to Tore \ 
Anderson)
keymgr: 'keystore-bench' is slow with many threads and a high-latency HSM connection
keymgr: 'keystore-bench' command accepts a filter by signing algorithm
libs: upgraded embedded libngtcp2 to 1.25.0
doc: various improvements

Bugfixes:
knotd: server crash due to a missing check for malformed TCP packet in XDP mode \ 
(Thanks to Arthur Chan)
knotd: server crash when processing XFR or NOTIFY with non-IN records (Thanks to \ 
Qifan Zhang)
knotd: server crash when processing an outbound reply with non-IN records \ 
(Thanks to Qifan Zhang)
knotd: server crash on zone with NSEC3PARAM but without NSEC3 records (Thanks to \ 
Qifan Zhang)
knotd: incorrect ACL address range evaluation (Thanks to Qifan Zhang)
knotd: assertion failure if zone expire is set to maximum (Thanks to Qifan Zhang)
knotd: server crash if SOA serial is not increased during IXFR from AXFR \ 
processing (Thanks to Qifan Zhang)
knotd: default 'policy.rrsig-refresh' value not considered for DNSSEC validation
knotd: missing '0.1 * policy.rrsig_lifetime' part in 'rrsig-refresh' default if \ 
'policy.zone-max-ttl' is set #978 (closed)
libknot: defective QUIC stateless-reset handler vulnerable to a crash (Thanks to \ 
Arthur Chan and Kushal Das)
libknot: insufficient check for oversized ECS EDNS option (Thanks to Qifan Zhang)
libknot: TSIG truncation check not implemented (Thanks to Qifan Zhang)
libs: inappropriate realloc failure handlings in heap structure
mod-authsignal: server crash if insertion to packet fails (Thanks to Qifan Zhang)
mod-authsignal: server crash if zone name contains _dsboot prefix (Thanks to \ 
Qifan Zhang)
mod-dnsproxy: outbound packet insertion error not propagated to client (Thanks \ 
to Qifan Zhang)
mod-onlinesign: server responds with SERVFAIL instead of NOERROR if reply is \ 
truncated
man: incorrect default paths for files, databases and sockets #976 (closed)

Log message:
knot: Update to 3.5.6

Release notes
Knot DNS 3.5.6 (2026-07-20)

Improvements:
knotd: new log message when accepting a control client fails
knotd: new log message when UDP or TCP worker initialization fails
knotd: improved log message when loading an expired zone
knotd: more verbose log messages for DDNS forwarding
knotd: disabled 0-RTT when forwarding DDNS updates over QUIC
utils: configuration detection considers an empty database directory as unused
libknot: added support for EDE code 33 (Negative Trust Anchor) (Thanks to Babak \ 
Farrokhi)
libs: upgraded embedded libngtcp2 to 1.24.0
doc: various improvements

Bugfixes:
knotd: server crashes when evaluating an ACL rule with 'cert-hostname' set
knotd: failed to start with 'listen-tls' and 'tcp-reuseport' enabled
knotd: missing proper mutex (de)initialization for controlling access to some \ 
zone properties
knotd: server crashes when it fails to load a QUIC/TLS key
knotd: zone control unset does not respect the TTL value of the removed record
knotd: incomplete configuration check for conflicting ACL settings
libknot: XDP frame limit does not correctly consider the MTU limit
libknot: QUIC connection not closed on handshake failure (Thanks to Vendemiat) \ 
!1886 (closed)
knot-exporter: uncaught exception when connecting to knotd that is not running \ 
#974 (closed)

Log message:
knot: pkg/58647 (Add buildlink3.mk to net/knot)

Log message:
net/knot: Update to 3.5.5

Knot DNS 3.5.5 (2026-06-12)
Features:

knotd: support for binding wildcard addresses to a specific network interface
mod-alias: ALIAS record synthesis from locally served targets (Thanks to Bron \ 
Gondwana) !1867 (merged)

Improvements:

knotd: zone XFR freeze state is persistent across restarts by storing it in timers
knotd: optimized rescheduled DNSSEC validation
knotd: hardened manually triggered DNSSEC validation
utils: configuration detection fails if the database is empty or inaccessible
utils: LMDB reader lock table is purged even for read-only access
utils: errors when writing to stdout are reported
libs: upgraded embedded libngtcp2 to 1.23.0
doc: various improvements

Bugfixes:

knotd: missing mutex lock in server startup check
knotd: server crashes if the QUIC client limit is lower than the number of UDP \ 
workers
knotd: misleading error log for DS check #969 (closed)
knotd: empty catalog database is created when purging orphans
knotd: false error report when there is no journal during purging orphans
knotd: the '--' specification doesn't work with 'zone-serial-set' and \ 
'zone-key-rollover'
knotd: zone backup prevents timer dumping, resulting in inconsistent timers
knotd: zone reload causes timer dumping to be skipped
knotd: segfault on SIGTERM if periodic statistics dumping is enabled #972 (closed)
knotd: redundant RRSIGs are removed during DNSSEC validation
knotd: missing AA flag in AXFR and IXFR responses
libknot: unnecessary increase in library size
libdnssec: memory leak when PEM key generation fails
libknot: undefined behavior in QUIC data stream processing
libknot: assertion failure in QUIC connection handling under high load
mod-geoip: inconsistent behavior for specific records and ANY queries #971 (closed)
redis: incorrect filter parameter parsing in KNOT.UPD.LOAD commands
redis: database crashes if it's built with jemalloc
kdig: undefined behavior if both +https and +quic are specified
kxdpgun: crash when reusing a swept-out QUIC connection

Log message:
*: Recursive revbump from security/nettle-4.0