PR https://github.com/vyos/vyos-build/pull/1275

PR https://github.com/vyos/vyos-1x/pull/5415

PR https://github.com/vyos/vyos-1x/pull/5414

@ebowsky would you like to claim the task and add a PR?

PR https://github.com/vyos/vyos-build/pull/1274

I second that it should be at least well documented that setting this sysctl is required to allow non local binds. I had to introduce a check for it being active in my PR solving a regression with HAProxy (and other services relying on the same code path) here: https://github.com/vyos/vyos-1x/pull/5266

PR: https://github.com/accel-ppp/accel-ppp-ng/pull/36

@jestabro can we close it?

Implemented in https://github.com/vyos/vyos-build/pull/1222

https://github.com/vyos/vyos-1x/pull/5413

vyos-1x PR https://github.com/vyos/vyos-1x/pull/5412

https://github.com/vyos/vyos-build/pull/1271

I can still reproduce the AES-GCM issue on a newer build.

https://github.com/vyos/vyos-1x/pull/5411

• https://github.com/vyos/vyos-build/pull/1270
• https://github.com/vyos/vyos-1x/pull/5410

See https://github.com/vyos/vyos-1x/pull/5409

See https://github.com/vyos/vyos-1x/pull/5408

I stumbled across the same issue and as far as i could debug it, its due to usb/hid devices being outosuspended by the current vyos kernel/config.

Thanks for catching this, a.kudientsov — and sorry for the regression. The mistake was narrowing the bare except: in fqdn_resolve() to except gaierror: based on the assumption that getaddrinfo() only ever raises gaierror, without checking that other OSErrors (e.g. transient network failures) can hit the same call and need to keep being
swallowed here too. c-po's fix in #5406 (back to except OSError:, since gaierror is a subclass) looks correct to me.

https://github.com/vyos/vyos-1x/pull/5406

Subject fix causes firewall fqdn/domain-group regression. It narrowed fqdn_resolve() exception handling in from a bare except: statement to except gaierror:, claiming "no behavior change." That let non-gaierror OSErrors (e.g. transient network errors right after commit) escape uncaught, crashing the unguarded main loop of the vyos-domain-resolver daemon, the process that fills in D_* (domain-group) nftables sets.

Thanks for looking into this and merging the patch.

https://github.com/vyos/vyos-build/pull/1269

https://github.com/vyos/vyos-build/pull/1268
https://github.com/vyos/vyos-1x/pull/5405

Revert PR https://github.com/vyos/vyos-1x/pull/5402

We cannot remove images after this merge

Installed images: 2026.08.14-0025-rolling
2026.08.13-0024-rolling
Cannot prompt "Do you really want to delete the image 2026.08.13-0024-rolling?" ([Y/n] default=False): stdin is not a TTY. Pass an explicit non-interactive option (e.g. no_prompt/-y) instead of relying on ask_yes_no().
Error: Process completed with exit code 1.

Reopened

PR: https://github.com/vyos/vyos-1x/pull/5401

PR https://github.com/vyos/vyos-1x/pull/5397

We have upgraded the Strongswan to 6.x
Open a new bug report if you have similar/any issues

PR https://github.com/vyos/vyos-build/pull/1267

PR: https://github.com/vyos/vyos-1x/pull/5400

It is already done as part of another change.

PR: https://github.com/vyos/vyos-1x/pull/5398