This release fixes a crash when the file names listed in a manifest contain illegal characters. We recommend all users to upgrade to this version.
New
- ASPA support is now always compiled in and available if
enable-aspais set. TheaspaCargo feature has been removed. (#990) - If merging mutliple ASPA objects for a single customer ASN results in more than 16,380 provider ASNs, the ASPA is dropped. (Note that ASPA objects with more than 16,380 provider ASNs are already rejected during parsing.) (#996)
- New
archive-statscommand that shows some statistics of an RRDP archive. (#982) - Re-enabled the use of GZIP compression in HTTP request sent by the RRDP collector. Measures to deal with exploding data have been implemented in rpki-rs#319. (#997)
Bug fixes
- Fixed an issue with checking the file names in manifests that let to a crash when non-ASCII characters are used. (rpki-rs#320, reported by Haya Schulmann and Niklas Vogel of Goethe University Frankfurt/ATHENE Center and assigned CVE-2025-0638)
- The validation HTTP endpoints now accept prefixes with non-zero host bits. (#987)
- Removed duplicate
rtr_client_reset_queriesin HTTP metrics. (#992 by @sleinen) - Improved disk space consumption of the new RRDP archives by re-using empty space when updating an object and padding all objects to a multiple of 256 bytes. (#982)
Other changes