Kea 3.2.0 (stable) released on June 24, 2026

2497.	[build]		andrei
	The library version numbers have been bumped up for the Kea 3.2.0
	stable release.
	(Gitlab #4601)

2496.	[doc]		andrei
	All the configuration examples from doc/examples are now included
	in the ARM.
	(Gitlab #3232)

2495.	[bug]		fdupont
	Limited recursive unpacking of DHCPv6 options.
	Thank you to Qifan Zhang from Palo Alto Networks for
	reporting the issue.
	(Gitlab #4565)

2494.	[bug]		andrei
	Errors about failed attempts to connect to the database are no
	longer shadowed by kea-admin trying to initialize the schema.
	Some log messages were added.
	(Gitlab #4111, #4500)

2493.	[bug]		tmark
	kea-dhcp4 and kea-dhcp6 now catch negative values of
	lease lifetime parameters: min-valid-lifetime,
	valid-lifetime, max-valid-lifetime, min-preferred-lifetime,
	preferred-lifetime, max-preferred-lifetime.
	(Gitlab #4498)

2492.	[func]		fdupont
	Reconfigure commands that trigger fatal a error that leads
	to server shutdown now return an error response. Changed
	socket open failure log messages from INFO to either ERROR
	or FATAL as appropriate. Applies to kea-dhcp4 and kea-dhcp6.
	(Gitlab #4507)

2491.	[func]		fdupont
	Added a new special client class "REJECT" which makes
	incoming requests in this class to skip the resource
	allocation part in processing and return DHCPNAK on
	DHCPREQUEST by the DHCPv4 server, or put status code
	NoAddrsAvail in all IA_NA options by the DHCPv6 server.
	Proposed by Philip Prindeville.
	(Gitlab #4110)

2490.	[perf]		fdupont
	Improved efficiency and correctness of the existence check
	done before adding a new lease in the memory database.
	Thank you to Qifan Zhang from Palo Alto Networks for
	reporting the issue.
	(Gitlab #4551)

2489.	[bug]		tmark
	Treat allocator initialization failures caused
	by database connectivity issues as a recoverable
	condition. Prior to this the server would exit
	with a fatal error even when configured to retry.
	Applies to both kea-dhcp4 and kea-dhcp6 when
	using either the FLQ or SLFQ allocators.
	(Gitlab #4508)

2488.	[bug]		fdupont
	Extended DHCPv6 relayed query processing to consider
	the 'interface-id' option (18) in subnet selection
	even when no relay sets its link-address to a global
	unicast address, e.g. is a layer-2 relay.
	(Gitlab #4358)

2487.	[func]		fdupont
	Extended lenient parsing of v4 "fqdn" and v6 "client-fqdn"
	options to fix options with bad flags.
	(Gitlab #4443)

2486.	[func]		razvan
	Updated yang modules: added 'ssl-mode' to database connection
	parameters, added 'adaptive-lease-time-threshold', removed
	'consistency', 'serial-consistency', 'request-timeout',
	'tcp-keepalive', 'tcp-nodelay' from to database connection
	parameters, added 'allow-address-registration' to the
	kea-dhcp6 model.
	(Gitlab #4461)

2485.	[doc]		sanua356, razvan
	Added documentation about internal type of option 121
	(classless-static-route). Thank you sanua356 (GitHub nickname)
	for reporting this issue and providing a patch.
	(Gitlab #4149)

2484.	[bug]		razvan
	Do not allow invalid prefix/prefix-length pair for IPv6 PD
	leases. Thank you to Qifan Zhang from Palo Alto Networks for
	reporting the issue.
	(Gitlab #4518)

2483.	[bug]		razvan
	Fixed a bug which was causing the dhcpv4 server to crash when
	reusing expired reservations and hook libraries set the SKIP
	flag to deny address allocation. Thank you to Qifan Zhang from
	Palo Alto Networks for reporting the issue.
	(Gitlab #4512)

2482.	[bug]		razvan
	Fixed a bug related to dhcpv6 Lease Query which was causing a
	crash of the server if the retrieved lease is still present in
	the lease storage but the associated subnet has been deleted.
	Thank you to Qifan Zhang from Palo Alto Networks for reporting
	the issue.
	(Gitlab #4530)

2481.	[bug]		razvan
	Fixed an undefined behavior when processing empty options in
	dhcp4over6 packets. Thank you to Qifan Zhang from Palo Alto
	Networks for reporting the issue.
	(Gitlab #4576)

2480.	[bug]		razvan
	Fixed ARM documentation examples related to "hostname-char-set"
	and "hostname-char-replacement".
	(Gitlab #4486)

2479.	[bug]		razvan
	Fixed a crash on server exit when database and interface
	reconnect mechanism is enabled and neither the database nor the
	interface can be recovered. Also added DHCP_IFACE_OPEN_SOCKET
	debug message which logs the interface name, address and port
	opened.
	(Gitlab #4527)

2478.	[bug]		razvan
	Fixed an issue that caused kea-dhcp6 to incorrectly emit a
	DDNS_TUNING6_PROCESS_ERROR when subnet selection has failed.
	(Gitlab #4499)

Kea 3.1.9 (development) released on May 27, 2026

2477.	[build]		andrei
	The library version numbers have been bumped up for the Kea 3.1.9
	development release.
	(Gitlab #4542)

2476.	[func]		fdupont
	Added the "ignore-bad-direction" workaround flag to
	the GSS-TSIG hook library to accept DNS update responses
	with the request signature sent by bogus servers.
	(Gitlab #4326)

2475.	[func]*		fdupont
	Disallowed leading zeros in JSON floating point values.
	Now incorrect number values in Kea config files are
	still accepted but raise warnings. Also fixed the bug
	which made leading plus '+' not be always rejected.
	(Gitlab #4495)

2474.	[func]		fdupont
	Removed the 'socket-name' vs 'socket-address' exclusivity
	check when parsing config files. Note that configuring
	both for the same control socket is still rejected but
	because 'socket-name' makes sense only for the 'unix' type,
	and 'socket-address' for the 'http' and 'https' types.
	(Gitlab #3971)

2473.	[func]		tmark
	IA_TA lease6 lease type has been removed from the
	MySQL and PostgreSQL schemas.
	(Gitlab #4490)

2472.	[bug]		fdupont
	Corrected an issue that prevented using pools of
	only one element (e.g. address or prefix) with
	either the Random or FLQ allocators.
	(Gitlab #4444)

2471.	[bug]		tmark
	Corrected an issue in PostgreSQL SFLQ allocation that
	was generating one too many free leases. SFLQ pool creation
	automatically rebuilds pools whose delegated length has
	changed (MySQL and PostgreSQL). These changes required a
	schema update.
	(Gitlab #4491)

2470.	[func]		tmark
	Added API commands for managing SFLQ Allocator
	pools to lease-cmds hook library.
	(Gitlab #4492)

2469.	[build]		fdupont
	Kea can now be cross-compiled using Meson.
	(Gitlab #3982)

2468.	[func]*		fdupont
	Added support for the last DHCP RFC 9915 including
	the deprecation of the unicast option.
	(Gitlab #4368)

2467.	[bug]		fdupont
	The from JSON double value to string no longer produces
	an incorrect output when there is only an exponent part.
	(Gitlab #4493)

2466.	[doc]		tmark
	Added documentation for the Shared FLQ Allocator
	to the ARM.
	(Gitlab #4489)

2465.	[func]*		fdupont
	Disallowed leading zeros in JSON integer values as
	required by the standard to become compatible with
	some other JSON tools e.g. the go implementation used
	by Stork. Now incorrect integer values in Kea config
	files are still accepted but raise warnings.
	(Gitlab #4438)

2464.	[func]		fdupont
	Extended the parser to accepted an empty "client-classes" list
	in Kea server configuration files.
	(Gitlab #4453)

2463.	[bug]		razvan
	Fixed kea-netconf communication over HTTP sockets with the kea
	dhcp demons. The control socket type is now mandatory for each
	server in the "managed-servers" configuration map.
	(Gitlab #4460)

2462.	[func]		razvan
	Added 'interface-add', 'interface-list' and 'interface-redetect'
	which can be used to add interfaces, list currently detected
	interfaces and issue a re-detect procedure which updates the
	interface configuration respectively. The re-detect procedure
	only adds newly discovered interfaces and addresses, without
	removing any previously detected interfaces or addresses.
	(Gitlab #3144)

Kea 3.1.8 (development) released on April 29, 2026

2461.	[bug]		fdupont
	Fixed spurious warnings emitted when attempting to close
	already closed HTTP sockets.
	(Gitlab #4344)

2460.	[func]		fdupont
	More bad Unix control socket configuration parameters are now
	rejected, before they were silently ignored. For instance
	it is now forbidden to configure HTTP or TLS parameters on
	not HTTP nor HTTPS control sockets.
	(Gitlab #3970)

2459.	[func]		tmark
	Added an experimental allocator type, 'shared-flq'.
	It implements a free lease queue mechanism for
	MySQL and Postgresql lease back ends. It is
	intended for use in configurations that share
	lease data between multiple servers (i.e. shared
	lease backends).
	(Gitlab #4336, #4373, #4405, #4417, #4425, #4441, #4447)

2458.	[func]*		fdupont
	The deprecated control agent has been removed.
	(Gitlab #3448)

2457.	[bug]		mgodzina
	Corrected "Lease Length" label in logged
	DHCPSRV_DHCP_DDNS_NCR_SENT to "TTL".
	(Gitlab #4376)

2456.	[func]		tmark
	Auto detection of JSON support in MySQL
	and PostgreSQL databases has been removed.
	All database versions with active support
	should now include JSON support.
	(Gitlab #4342)

2455.	[build]		razvan
	The library version numbers have been bumped up for the Kea 3.1.8
	development release.
	(Gitlab #4472)

2454.	[bug]		razvan
	Properly handle high availability listener shutdown on hook
	unload under heavy load.
	(Gitlab #4448)

2453.	[bug]		razvan
	Properly handle lease allocation if client reserved lease is not
	available because the hook has decided to skip the lease.
	(Gitlab #4434)

Kea 3.1.7 (development) released on March 25, 2026

2452.	[build]		andrei
	The library version numbers have been bumped up for the Kea 3.1.7
	development release.
	(Gitlab #4419)

2451.	[func]		razvan
	The kea servers return a new status ("result" with value 5) for
	commands which have failed and have partially altered the running
	configuration. The rollback mechanism was not able to restore
	the previous configuration.
	(Gitlab #4389)

2450.	[bug]		fdupont
	Kea DHCPv6 servers can now receive packets sent to the
	All_DHCP_Servers (ff05::1:3) site multicast address as
	required by the standard.
	(Gitlab #3574)

2449.	[sec]		razvan
	Fix a null dereference when configuring the control agent with a
	control socket that lacks a socket-name entry.
	(Gitlab #4365)

2448.	[func]		razvan
	When using raw sockets, Kea now properly handles VLAN
	interfaces and VLAN tagged packets.
	(Gitlab #1117, #1738, #3792)

Kea 3.1.6 (development) released on February 25, 2026

2447.	[sec]*		fdupont
	Added the 'use-message-authenticator' parameter to the RADIUS
	hook library. When true (the default when the transport
	protocol is not TLS) a Message-Authenticator is added to
	messages sent by Kea, and required in received messages.
	(Gitlab #4333)

2446.	[doc]		fdupont
	Added supported RADIUS standards to the RADIUS hook library
	documentation in the ARM.
	(Gitlab #4285)

2445.	[func]		fdupont
	Implemented RADIUS/TLS in the RADIUS hook library.
	(Gitlab #4274)

2444.	[bug]		tmark
	Fixed an issue in kea-dhcp6 that caused the server to
	not use a reserved host name or recognize a change to
	the selected subnet for subnet-level reservations
	within a shared-network when a lease exists for the
	reservation but is in either the RELEASED or
	EXPIRED-RECLAIMED states.
	(Gitlab #4262)

2443.	[func]		razvan
	Removed "Lease Expires On" information from the kea-dhcp-ddns
	log messages.
	(Gitlab #4280)

2442.	[func]		tmark
	Template classes template-test expressions may
	now test for membership in 'KNOWN'/'UNKNOWN'.
	(Gitlab #4256)

2441.	[build]		razvan
	The library version numbers have been bumped up for the Kea 3.1.6
	development release.
	(Gitlab #4354)

2440.	[bug]		razvan
	Fixed a bug which was causing kea-dhcp servers to bind on other
	interfaces while retrying to open sockets on configured
	interfaces.
	(Gitlab #3062, #3134)

2439.	[bug]		razvan
	The "config-test" and "config-set" commands can now properly use
	newly detected interfaces for testing or applying a new
	configuration.
	(Gitlab #3370)

2438.	[bug]		razvan
	Removed a log that incorrectly stated that the v6 socket was
	using raw format.
	(Gitlab #4199)

Kea 3.1.5 (development) released on January 28, 2026

2437.	[build]		razvan
	The library version numbers have been bumped up for the Kea 3.1.5
	development release.
	(Gitlab #4306)

2436.	[sec]		razvan
	Restrict number of recursive calls when parsing config.
	CVE:2026-3608
	(Gitlab #4288)

2435.	[build]		fdupont
	Fixed Kea build with Boost 1.90: BOOST_STATIC_ASSERT was
	replaced by C++ static_assert, and deadline_timer by
	system_timer. This change was included in the 3.1.5 release,
	but its changelog entry was not.
	(Gitlab #4264, #4266)

2434.	[build]		andrei
	Hammer was extended to prepare additional systems: Alpine 3.23,
	Fedora 43, FreeBSD 15. "-w sanitizers" can now be passed to
	install LLVM sanitizer libraries. Valgrind is also installed when
	"-w unittest" is passed. To address version mismatch errors in
	FreeBSD, package installation is now retried with repo updates
	enabled if it first fails without repo updates. This change was
	included in the 3.1.5 release, but its changelog entry was not.
	(Gitlab #4245)

2433.	[build]		andrei
	Fixed errors about missing includes appearing on BSD clang v19
	and above when compiling under C++23 standard or higher. This
	change was included in the 3.1.5 release, but its changelog entry
	was not.
	(Gitlab #4246)

2432.	[sec]		fdupont
	Added to the RADIUS hooks library and security
	documentation a warning about the Blast-RADIUS
	vulnerability which affects the RADIUS protocol.
	(Gitlab #4254)

2431.	[build]		fdupont
	Set debug to true and optimization to 2 by default
	in meson project default so the same as the
	'debugoptimized' buildtype.
	(Gitlab #4296)

2430.	[func]		fdupont
	The RADIUS hook library no longer accepts the 'realm'`
	config parameter which was never implemented i.e. it was
	silently ignored.
	(Gitlab #3103)

2429.	[func]		fdupont
	Create UNIX sockets as group writable so a tool
	is allowed to connect to them as soon as it is
	run by a member of the group (vs. requiring to be
	run by the owner).
	Note to disallow this the group execute permission
	can be removed from the socket parent directory.
	(Gitlab #4260)

2428.	[func]		fdupont
	Added to the RADIUS hooks library a new per service
	"idle-timer-interval" parameter which makes a
	"Status-Server" message to be periodically sent.
	The value 0 (default) disables this.
	(Gitlab #4283)

2427.	[doc]		fdupont
	Added a section in the ARM explaining how to generate
	core dump files.
	(Gitlab #4147)

2426.	[bug]		fdupont
	The "exchange-timeout" parameter of GSS-TSIG hook library
	configuration is no longer ignored.
	(Gitlab #4265)

2425.	[bug]		fdupont
	Added check for prefix length in ipv6-prefix option
	data type.
	(Gitlab #4295)

2424.	[bug]		tmark
	API commands provided by the lease-cmds hook
	library now update in-memory statistics.
	(Gitlab #4176)

2423.	[func]		fdupont
	Documented received and sent statistics of the lease query
	hook library. Also moved initialization to the server so
	they are no longer deleted when the hook library is unloaded.
	(Gitlab #4186)

2422.	[func]		fdupont
	Added 'pkt4-duplicate' and 'pkt6-duplicate' statistics to
	count incoming packets that are dropped because they are
	duplicates of packets currently being processed.
	Previously such packets were counted as queue full.
	(Gitlab #4187)

2421.	[func]		fdupont
	HA now increments drop statistics such as 'pkt4-not-for-us'
	and 'pkt6-not-for-us' when inbound packets are deemed to be
	out of scope.
	(Gitlab #4184)

2420.	[func]		tmark
	Memfile lease back end now supports the ``on-fail``
	parameter though without retry.  When set to either
	``stop-retry-exit`` or ``serve-retry-exit`` the
	server will exit on unrecoverable write errors. If
	set to ``serve-retry-continue`` the server will
	continue to run but write errors will continue until
	corrective action is taken. Applies to both
	kea-dhcp4 and kea-dhcp6.
	(Gitlab #4220)

2419.	[func]		fdupont
	Added 'lease4-get-by-state' and 'lease6-get-by-state'
	commands to retrieve leases by state and optionally subnet.
	(Gitlab #4230)

Kea 3.1.4 (development) released on November 26, 2025

2418.	[bug]		fdupont, tmark
	Fixed a bug which made the lfc running check in
	config set and reload command to use the wrong file.
	(Gitlab #4198)

2417.	[bug]		tmark
	Corrected an issue in the ping-check hook library that
	could result in the ICMP socket stuck in the read ready
	state.
	(Gitlab #4221)

2416.	[func]		tmark
	Added a global parameter, "allow-address-registration",
	to kea-dhcp6. It enables or disables client address
	registration (see RFC 9686). It also corrects an
	issue in which the server was not correctly enforcing
	a peer address match when ADDR-REG-INFORMs are
	received via relay.
	(Gitlab #4161)

2415.	[func]		tmark
	The lease query hooks configuration parameter, 'requesters',
	now also accepts address ranges expressed in CIDR format. Prior
	to this it was restricted to one or more IP addresses.
	(Gitlab #4190)

2414.	[func]		fdupont
	Added "pkt4-queue-full" and "pkt6-queue-full"
	statistics which are increased when an incoming packet
	was dropped because it was queued and the queue is full.

	Added "pkt4-rfc-violation" and "pkt6-rfc-violation"
	statistics which are increased when an incoming packet
	has to be dropped according to protocol specifications.

	Added "pkt4-admin-filtered" and "pkt6-admin-filtered"
	statistics which are increased when an incoming packet
	was dropped because the server was configured to do so,
	e.g. by classifying the query into the DROP class.

	Added "pkt4-not-for-us" and "pkt6-not-for-us"
	statistics which are increased when an incoming packet
	was dropped because it has to be handled by another server.

	Added "pkt4-processing-failed" and "pkt6-processing-failed"
	statistics which are increased when an incoming packet
	was dropped because an unexpected error occurred during
	processing.

	Added "pkt4-limit-exceeded" and "pkt6-limit-exceeded"
	statistics which are increased when an incoming packet
	was dropped by the limits hook library.
	(Gitlab #3140, #4157, #4146, #4127, #4126, #4133, #4134)

2413.	[sec]*		andrei
	Restrict the path of the UNIX socket to which kea-netconf
	connects the same way the path is restricted for other servers
	on creation of UNIX sockets.
	(Gitlab #3969)

Kea 3.1.3 (development) released on October 29, 2025

2412.	[build]		andrei
	The library version numbers have been bumped up for the Kea 3.1.3
	development release.
	(Gitlab #4175)

2411.	[sec]		tmark
	When a hostname or FQDN received from a client is
	reduced to an empty string by hostname sanitizing,
	kea-dhcp4 and kea-dhcp6 will now drop the option.
	CVE:2025-11232
	(Gitlab #4142)

2410.	[build]		andrei
	-Wshadow was added to the compiler flags and its warnings
	addressed.
	(Gitlab #3451)

2409.	[build]		andrei
	Kea now builds with Clang 21. Thanks to Khem Raj for reporting
	the problem and suggesting a fix.
	(Gitlab #4100)

2408.	[bug]		andrei
	Fixed a bug introduced in flex-id in 3.1.2 which caused the
	expression to always be empty even when a value was configured
	under "identifier-expression".
	(Gitlab #4181)

2407.	[bug]		tmark
	Corrected an issue that was causing an
	HA peer to not restart its dedicated listener
	after handling a config-test command.
	Applies to both kea-dhcp4 and kea-dhcp6.
	(Gitlab #4145)

2406.	[bug]		razvan
	Removed logging an error in ping check hook library if
	using lease cache threshold.
	(Gitlab #4129)

2405.	[bug]		razvan, liyunqing_kylin
	Fixed a data race in ping-check hooks library. Thanks to
	liyunqing_kylin for reporting and testing the fix for this
	issue.
	(Gitlab #4164)

2404.	[bug]		razvan, liyunqing_kylin
	Fixed deadlock in ping-check hooks library. Thanks to
	liyunqing_kylin for reporting and providing a patch.
	(Gitlab #4140)

Kea 3.1.2 (development) released on September 24, 2025

2403.	[func]		fdupont
	Added "pkt4-service-disabled" and "pkt6-service-disabled"
	statistics which are increased when an incoming packet
	was dropped because the DHCP service is disabled.
	(Gitlab #4096)

2402.	[func]		fdupont
	When Kea is configured to use the memfile lease backend,
	the "status-get" command returns the location of the
	CVS backup file in the "csv-lease-file" entry.
	(Gitlab #2305)

2401.	[sec]		tmark
	Removed logging of database password as clear
	text when kea-dhcp4 or kea-dhcp6 initializes
	the schema.
	(Gitlab #4086)

2400.	[bug]		fdupont
	Fixed a race condition in pid file handling (used by
	servers, agents and lease file cleanup).
	(Gitlab #4107)

2399.	[func]		fdupont
	Added support of RADIUS dictionary includes, vendor
	attributes and integer translations to the RADIUS hook
	library for compatibility with previous versions using
	the FreeRADIUS client library.
	(Gitlab #3860)

2398.	[sec]		fdupont
	Added the "basic-auth-user-file" parameter to the HA
	hook library. This allows the basic HTTP auth user
	ID to be read from a file rather than specified as
	clear text in the configuration.
	(Gitlab #4070)

2397.	[func]		tmark
	Additional packet details are now emitted in
	debug level logs by kea-dhcp4 for both inbound
	and outbound packets.
	(Gitlab #3531)

2396.	[func]		tmark
	The flex-id hook library parameter, ``identifier-expression``,
	is now optional. Prior to this, it was mandatory.
	(Gitlab #4011)

2395.	[build]		razvan
	The library version numbers have been bumped up for the Kea 3.1.2
	development release.
	(Gitlab #4120)

2394.	[func]		razvan
	Added new 'statistic-global-get-all' command for kea-dhcp4
	and kea-dhcp6 servers, which returns all statistics except
	subnet counters.
	(Gitlab #3213)

2393.	[func]		razvan
	Added global counters for 'assigned-addresses',
	'assigned-nas' and 'assigned-pds'. The 'stat-lease4-get'
	and 'stat-lease6-get' now properly return
	'assigned-addresses' and 'assigned-nas' containing also
	the 'declined-addresses' address count.
	(Gitlab #3239, #3925)

2392.	[func]		razvan
	Reject 'config-set' and 'config-reload' commands when lease
	file cleanup process is running.
	(Gitlab #3986)

Kea 3.1.1 (development) released on August 27, 2025

2391.	[bug]		fdupont
	When reusing an expired lease, kea-dhcp6 now correctly saves
	the client hardware address in the lease.
	(Gitlab #4058)

2390.	[func]		fdupont
	Added the new "adaptive-lease-time-threshold" parameter
	for the FLQ (Free Lease Queue) allocator which reduces
	the lifetime of leases when pools of a subnet have an
	occupancy rate above a configured threshold (new feature
	from ISC DHCP).
	(Gitlab #226)

2389.	[bug]		tmark
	Corrected an issue in kea-dhcp4 which caused
	broadcasted client queries to fail to match subnets
	restricted to classes assigned during early global
	host lookups.
	(Gitlab #4047)

2388.	[bug]		tmark
	Fixed an issue in kea-dhcp-ddns which was
	causing GSS-TSIG key exchanges to timeout when
	NCR traffic is intermittent.
	(Gitlab #4049)

2387.	[func]*		andrei, razvan
	Updated kea-netconf to libyang and sysrepo version 3.
	(Gitlab #3931)

2386.	[sec]		tmark
	Corrected an issue in kea-dhcp4 that caused the server
	to abort if a client sent a unicast request with a particular
	options, and Kea failed to find an appropriate subnet
	for that client.
	CVE:2025-40779
	(Gitlab #4048)

2385.	[bug]		tmark
	Avoid adding the qualifying-suffix to fully qualified
	host names specified in host reservations.
	(Gitlab #3949)

2384.	[bug]		tmark
	kea-dhcp6 now correctly supports option class-tags
	(i.e."client-classes") in host and config back ends
	for both MySQL and PosgreSQL.
	(Gitlab #4014)

2383.	[func]		razvan
	The kea-dhcp4 server now supports configuring vivso options with
	suboptions.
	(Gitlab #3861)

2382.	[func]		razvan
	Implemented the 'lease6-get-by-hw-address' command used to query
	IPv6 leases by HW Address.
	(Gitlab #3826)

Kea 3.1.0 (development) released on July 30, 2025

2381.	[build]		razvan
	The library version numbers have been bumped up for the Kea 3.1.0
	development release.
	(Gitlab #4030)

2380.	[build]*	fdupont
	Moved Botan crypto backend support to version 3.
	(Gitlab #3553)

2379.	[bug]		tmark
	kea-dhcp4 now correctly supports option class-tags
	(i.e."client-classes") in host and config back ends
	for both MySQL and PosgreSQL.
	(Gitlab #3770)

2378.	[func]		razvan
	Added SSL/TLS support for PostgreSQL database connection in
	the Kea configuration. Available parameters are:
	"trust-anchor", "cert-file", "key-file", and "ssl-mode".
	(Gitlab #3927)

2377.	[sec]*		tmark
	Additional runtime security checks were added
	to kea-dhcp4, kea-dhcp6, kea-dhcp-ddns, and
	kea-ctrl-agent
	(Gitlab #3848)

2376.	[func]		razvan
	Added support for global list parameters (containing only scalar
	elements) in CB. The "host-reservation-identifiers" is now
	supported in CB.
	(Gitlab #3944)

Kea 3.0.0 (stable) released on June 25, 2025

2375.	[build]		wlodek
	The library version numbers have been bumped up for the Kea 3.0.0
	stable release.
	(Gitlab #3968)

2374.	[doc]		bscott
	Clarified applicability of Kea Configuration Backend in
	the ARM.
	(Gitlab #3881)

2373.	[doc]		marcin
	Added example subnet selectors to default DHCP configs.
	(Gitlab #3628)

2372.	[build]		andrei
	Kea now generates and installs a pkg-config .pc file.
	(Gitlab #3680)

2371.	[func]		piotrek
	Added a new argument, '--auth-password-file', which provides
	a secure method for supplying a password for basic HTTP
	authentication in kea-shell.
	(Gitlab #3940)

2370.	[build]		andrei
	Unit tests that require root privileges are now run automatically
	on "meson test" by having privileges elevated via sudo.
	(Gitlab #3493)

2369.	[doc]		tmark
	Updated list of elements supporting user-context in ARM.
	(Gitlab #3855)

2368.	[build]		fdupont
	Added the 'runstatedir' configuration option so by
	giving '-D runstatedir=run' one can override the 'var/run'
	default. This variable and its usage are described in
	GNU Coding Standards or autoconf doc since version 2.70.
	Note this variable is not in meson built-in options.
	(Gitlab #3624)

2367.	[func]*		fdupont
	Changed the default value of the High Availability listener
	'restrict-commands' configuration flag to true so commands
	which are not used by the High Availability hook are rejected.
	(Gitlab #3639)

2366.	[doc]		slawek
	Described a new shared network name parameter of the subnetX-list
	commands in ARM.
	(Gitlab #3926)

2365.	[bug]		fdupont
	Removed all references to the build directory from
	scripts when tests configuration option is not enabled.
	(Gitlab #3007)

2364.	[bug]		tmark
	Ping check hook library was corrected to skip
	ping checks when the lease is active or reserved.
	(Gitlab #3858, #3932)

2363.	[bug]		tmark
	Corrected an issue which caused config-get to return
	the full hook library pathname instead of the
	original configuration value of the `library`
	parameter.
	(Gitlab #3937)

2362.	[bug]		tmark
	Ping check hook library will now route
	pings across routers. Prior to this it
	only sent pings to directly connected
	networks.
	(Gitlab #3827)

2361.	[bug]		tmark
	Corrected an issue in logging configuration when
	parsing "syslog:<facility name>".
	(Gitlab #3921)

2360.	[func]*		tmark
	Lease caching is now enabled by default.  The default
	value for ``cache-threshold`` is 0.25,``cache-max-age``
	is left unspecified. It may be disabled at the desired
	scope either by setting ``cache-threshold`` to 0.0 or
	setting ``cache-max-age`` to 0.
	(Gitlab #3659)

2359.	[build]		andrei
	The Autootols build system has been removed and superseded by
	Meson.
	(Gitlab #3734)

2358.	[bug]		tmark
	Fixed an issue in path validation where
	the opening slash in a root-file path such
	as "/myfile.log" is discarded causing the server
	to prepend the supported path to the file name
	rather than reject the entry.
	(Gitlab #3906)

2357.	[func]		tmark
	Security restrictions may now be disabled by adding
	command line option -X to Kea server invocations.
	Supported by kea-dhcp4, kea-dhcp6, kea-dhcp-ddns, and
	kea-ctrl-agent.
	(Gitlab #3902)

2356.	[func]		razvan
	Updated YANG modules by adding only-in-additional-list,
	evaluate-additional-classes, client-classes list, ddns-ttl,
	ddns-ttl-min, ddns-ttl-max, ddns-generated-prefix,
	ddns-override-client-update, ddns-override-no-update,
	ddns-qualifying-suffix, ddns-replace-client-name,
	ddns-send-updates, ddns-update-on-renew,
	ddns-conflict-resolution-mode, hostname-char-replacement and
	hostname-char-set at pool and pd-pool level, added
	excluded-prefixes at pd-pool level. Added trust-anchor,
	cert-file, key-file, cert-required authentication and
	http-headers parameters to control sockets.
	(Gitlab #3907)

2355.	[func]		razvan
	Implemented lease4-wipe and lease6-wipe for database backends.
	The commands are no longer deprecated.
	(Gitlab #3814)

2354.	[doc]		razvan
	The DHCPv4-over-DHCPv6 implementation, perfmon hook library and
	sysrepo features are no longer considered experimental.
	(Gitlab #3920)

2353.	[func]		razvan
	Restricted location of configured scripts in loaded hook
	libraries.
	(Gitlab #3849)

2352.	[bug]		razvan
	Fix error handling when detecting a global reservation for the
	client and global reservations are explicitly disabled in the
	configuration.
	(Gitlab #3911)

2351.	[doc]		razvan
	Updated documentation and examples related to 4over6 port.
	(Gitlab #3851)

2350.	[doc]		razvan
	Updated documentation and examples related to HTTP/HTTPS socket
	ports used by kea-ctrl-agent, kea-dhcp4, kea-dhcp6, kea-dhcp-ddns
	and High Availability hook library in order to avoid possible
	conflicts.
	(Gitlab #3541)

2349.	[func]		razvan
	The kea-ctrl-agent has been deprecated and it issues a warning
	log message on startup. As of Kea 2.7.2 the Kea servers:
	kea-dhcp4, kea-dhcp6, and kea-dhcp-ddns directly support command
	API connections over HTTPS/HTTP.
	(Gitlab #3916)

2348.	[bug]		razvan, Darwin4053
	Fix arguments order in flex option hook library debug messages.
	(Gitlab #3875)

Kea 2.7.9 (development) released on May 28, 2025

2347.	[build]		andrei
	The library version numbers have been bumped up for the Kea 2.7.9
	development release.
	(Gitlab #3892)

2346.	[sec]*		tmark, fdupont, razvan
	All files and sockets created by Kea servers have been
	restricted to default paths determined at compile time
	which may be overridden by environment variables. This
	includes lease files, log files, forensic log files, control
	channel sockets, and the output from commands such as
	cache-write, lease4-write, and lease6-write. The output
	of config-write is restricted to the directory from which the
	configuration file was read. Use of unsupported paths will
	result in servers emitting errors and refusing to start
	or rejecting commands.  The specifics including the supported
	paths and environment variable names are in the relevant
	ARM sections.
	CVE:2025-32801
	(Gitlab #3831)

2345.	[sec]*		fdupont
	Change the umask to no group write and no other access
	at the entry of Kea server/agent binaries.
	CVE:2025-32803
	(Gitlab #3832)

2344.	[sec]*		tmark
	kea-dhcp4, kea-dhcp6, kea-dhcp-ddns, and kea-ctrl-agent will
	now only load hook libraries from the default installation
	directory.  If a path other than this is specified Kea will
	not load the hook library.  For ease of use, the path may be
	omitted.
	CVE:2025-32801
	(Gitlab #3830)

Kea 2.7.8 (development) released on April 30, 2025

2343.	[build]		wlodek
	The library version numbers have been bumped up for the Kea 2.7.8
	development release.
	(Gitlab #3863)

