Dear all.

NSD 4.15.4 is available:

https://nlnetlabs.nl/downloads/nsd/nsd-4.15.4.tar.gz

sha256 74a095fdb774a157c8aec9009e440fc3d2ba94c4372ae9ed86588c1719d1df2f
pgp https://nlnetlabs.nl/downloads/nsd/nsd-4.15.4.tar.gz.asc

This release has many bugfixes, updated support for RR types and a few new features.

The release is signed with the OpenPGP software signing key that is in use since Jan 1st 2026:

User ID: NLnet Labs releases signing key G2 <releases@nlnetlabs.nl>
Key ID: A144 323D EAAC DF45
Fingerprint: 2310 1869 0C4D 903E F419  146A A144 323D EAAC DF45

The key is available from https://nlnetlabs.nl/signing-keys

4.15.4

FEATURES:

• A report-channel config option to return a Report-Channel EDNS option in responses
• A catalog-group-pattern option to limit the patterns from which catalog consumer member zones may be configured by using the group property.
  Thanks to Qifan Zhang, Palo Alto Networks, for the suggestion.
• Merge #515: The UNECE and ISO RR types

BUG FIXES:

• Fix makedist.sh to omit .cirrus.yml ci integration.
• Fix handling malformed SOA records with a short rdata content with incremental transfers. Thanks to Tristan Madani for the report.
• Fix #510: Missing NSEC3 records for next-closer in case of ENT, NSEC3 and opt-out.
• Merge #511: Fix to retry a catalog consumer zone over AXFR if IXFR failed to apply
• Fix to not wrap the rdlength variable for SVCB RRs with an rdlength larger than 65528 (and a short TargetName rdata field, like .).
  Thanks to Zanya tea915656@gmail.com for the report.
• Fix to not crash when more than one group property is parsed from a consumer catalog member zone, with only one of them valid.
  Thanks to Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan from Tsinghua University, for the report and suggested fix.
• Fix that when printing rdata, fixed sized writes will not overflow the buffer.
  Thanks to Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan from Tsinghua University, for the report and suggested fix.
• Fix to compare the dname variant of an AMTRELAY relay and IPSECKEY gateway RDATA field case insensitively when they are removed by way of IXFR.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
• Fix to deny CAA RRs from primaries with an empty tag.
  Thanks Qifan Zhang, Palo Alto Networks, for the report.
• Fix #523: systemd support is incomplete. Implements Type=notify-reload with systemctl reload nsd support.
• Fix #526 from jpmens: Fix typo in nsd.conf.5.in
• Merge #527: Eliminate excess error message in XoT transfer
  Thanks Ferran Tufan

simdzone 0.2.8

FEATURES:

• The UNECE and ISO RR types

BUG FIXES:

• Fix the calculation of the rdata needed for rdata in RFC 3597 Unknown Type format.
  Thanks to Zanya tea915656@gmail.com for the report.
• Fix preventing size_t length to wrap below 0 when scanning an end-of-string backslash character, resulting in out-of-bounds read.
  Thanks to Zanya tea915656@gmail.com for the report.
• Fix to determine the correct rdata length for WKS RRs without bitmap.
  Thanks to Alwaleed Ashi (LXR) waleed.9998@hotmail.com for the report.
• Fix to build simdzone also with NDEBUG by default, like NSD and only disable it when --enable-check ing is given to configure.
  Thanks to Alwaleed Ashi (LXR) waleed.9998@hotmail.com for the report.
• Fix to let configure detect ar as it needs to match the --host arch
  Thanks Haelwenn (lanodan) Monnier
• Fix asm usage in strict ISO C builds
  Thanks Jared Mauch