**New features and improvements**
* T3971: Ability to build ISO images for XCP-NG hypervisor
* T3945: Add route-map for bgp aggregate-address
* T3942: Generate IPSec debug archive from op-mode
* T3859: Add "log-adjacency-changes" to ospfv3 process
* T3745: op-mode IPSec show vpn ipse sa sorting
* T2108: Use minisign/signify instead of GPG for release signing
* T1083: Implement persistent/random address and port mapping options for NAT rules
**Bug fixes**
* T4093: SNMPv3 snmpd.conf generation bug
* T4092: IKEv2 mobike commit failed with DMVPN nhrp
* T4087: IPsec IKE-group proposals limit of 10 pieces
* T3974: route-map commit fails if interface does not exist
* T3926: strip-private does not sanitize "cisco-authentication" from NHRP configuration
* T3858: Deleting OSPFv3 process yields: Unknown command: no router-id
* T3849: Update Linux Kernel to v4.19.212
* T3846: dmvpn configuration not reapllied after "restart vpn"
* T3808: ipsec is mistakenly restarted after delete
* T3796: Wireguard interfaces are not shown in op-mode
* T3786: GRE tunnel source address 0.0.0.0 error
* T3610: DHCP-Server creation for not primary IP address fails
**Other resolved issues**
* T3911: Expired LetsEncrypt CA leads to unbuildable images
* T3862: "reboot at" command together with date does not work / weird error message on wrong input
* T3761: Bump salt-minion to 3000
* T3689: static ipv6 route doesn't deleted in some cases
* T3674: Webproxy squid is stared by default without any configuration
* T3671: Webproxy not functional in 1.2.8 update
* T3626: Configuring and disabling DHCP Server
* T3467: cannot set vrrp virtual-address with /31 mask when router uses networkaddress.
* T3396: syslog can't be configured with an ipv6 literal destination in 1.2.x
* T3341: Wrong behavior of the "reset vpn ipsec-peer XXX tunnel XXX" command
* T3294: Images for Dell VEP platform use no default baud rate for this platform
* T1817: BGP next-hop-self not working.