• security: create ~/.config/firejail to prevent sandbox escape (#7154)
• security: fix use of dangling pointer for netns argument (#7246)
• feature: allow subpaths in xdg macros (#2359 #7151)
• feature: add ${PROJECTS} macro (#7157)
• feature: add ${PUBLICSHARE} and ${TEMPLATES} macros (#7164)
• feature: profstats: add --include command line option (#7265)
• feature: implement syscall:log in seccomp lists (#7289)
• modif: create a new syscall group: @program-keep (9d90daf)
• modif: stop following symlinks to /dev/null on disable (#5803 #7129)
• modif: add backtick in reject_meta_chars() (#7183)
• modif: add more metachars in reject_meta_chars() (#7186)
• modif: fbwrap: improve log messages (#7227)
• modif: add fchroot syscall (928e6ff 541dd07)
• modif: move hardcoded blacklist ~/.config/firejail into disable-common
  (#7132 #7282)
• modif/removal: X11 code restructuring:
  --x11=xpra support was removed.
  --x11=xorg support (Xorg security extension) was disabled in the default
  software configuration, the user will need to add --enable-x11-legacy flag
  for ./configure (./configure --enable-x11-legacy)
  --x11=xvfb support (xvfb display server) is disabled in the default software
  configuration, the user will need to add --enable-x11-legacy flag for
  ./configure (./configure --enable-x11-legacy)
  --x11=xephyr command is removed, however, Xephyr display server is used by
  default by --x11 command.
• removal: temporarily disabled --ip=dhcp. ISC-DHCP is no longer supported
  in Debian. We will bring back this option in release 0.9.84 using
  a different DHCP client
  (https://tracker.debian.org/news/1782808/removed-443-p1-8-from-unstable/)
• removal: --bandwidth= command (#7197)
• removal: --tracelog/blacklist-nolog commands (#7198)
• removal: ./configure --enable-busybox-workaround option (#7199)
• removal: --private-home command (#7200)
• removal: ./configure --disable-sandbox-check option (#7201)
• removal: --x11=xpra option (#7207)
• removal: firecfg --guide; the pertinent information was moved in
  man firejail (#7260)
• removal: private-lib (#7261)
• removal: ssh restricted shell feature (#7262)
• bugfix: disable /run/systemd/resolve with net=none - fixes potential DNS
  leaks when using systemd-resolved (#7209 #7216)
• bugfix: fbwrap: wait for target and propagate exit code (#7081 #7224)
• bugfix: mountinfo: handle lines longer than 4096 bytes (#6450 #7225)
• bugfix: fix string lifetimes in profile.c (#7267)
• bugfix: fix ignored negation for syscalls number 0 (#7255 #7280)
• bugfix: fix non-standard /etc/hosts lines (#6210 #7281)
• docs: man: fix typo in example (#7106)
• docs: recommend .deb or building from source on debian/ubuntu (#7110)
• docs: note how to use net=none for appimages (#7257)
• docs: firecfg: note to not enable devtools (#7276)
• build: fix empty lists in syscall.c breaking compilation (#7108 #7109)
• build: remove unused install.sh (#7124)
• build: merge fnettrace headers into fnettrace_common.h (#7127)
• build: remove unused remove_cnt variable in src/fsec-optimize/optimizer.c
  (156593d)
• build: gen-syscalls.sh: remove trailing spaces in new_syscalls.txt
  (4a5ed83)
• build: deb: add conflict with firejail-profiles (#7141)
• build: netfilter.c: replace system() with execv() (#7159)
• build: remove etc-fixes directory (#7148)
• build: fix scan-build warnings (#7205)
• build: disable --chroot= by default (#7202)
• build: simplify and improve test-compile (#7206)
• build: test: fix cleaning of some temporary files (#7222)
• build: test: format/improve targets (#7223)
• build: test: sync DISTFILES_TEST with TESTS (#7238)
• build: disable --x11=(xorg|xvfb) options by default (#7263)
• build: disable --ip=dhcp by default (#7264)
• test: fix unescaped newlines in error messages (#7146)
• test/fs: improve tests related to macros (#7147)
• test/fs: deduplicate xdg dirs in macro tests (#7163)
• test/fs: support and use XDG user dir env vars (#7167)
• test/apps: full rewrite; currently make test-apps command test runs tests
  on about 70 common Linux applications; the test is targeted to Arch
  and/or Fedora platforms.
• ci: make all main make steps parallel and sync output (#7162)
• ci: dependabot: split and group codeql actions to fix checks (#7192)
• ci: update clang-14 to clang-18 (#7203)
• ci: build: replace ubuntu-22.04 with ubuntu-latest (#7210)
• profiles: disable-programs: add lact paths (#7083)
• profiles: disable-exec: add mount paths (#7112)
• profiles: mumble: include whitelist-runuser-common (#7084)
• profiles: disable-common: add xfce clipman path (#7120)
• profiles: steam: allow ~/.cache/nvidia to improve game performance (#7114)
• profiles: firefox-common: allow auto light/dark theme switching (#7103)
• profiles: steam: allow more 3d cache paths (#7149)
• profiles: torbrowser-launcher: add no3d (#7143)
• profiles: add llm-agent-common.profile (#7158)
• profiles: use xdg macros with subpaths (#7160)
• profiles: man: add terminfo (#7130 #7131)
• profiles: lutris: fix proton compatibility (#7181)
• profiles: add allow-bwrap to profile.template (3725c08 1cd47bf)
• profiles: templates: improve formatting & clarify rules (#7172)
• profiles: disable-common: allow ${PATH}/dpkg (6c0ec7c e694324)
• profiles: firefox-common: add seccomp.block-secondary (#7204)
• profiles: llm-agent-common: disable private-cache (#7212)
• profiles: librewolf: add ~/.config/librewolf (#7233)
• profiles: keepassxc: add ~/.local/state/keepassxc (#7235)
• profiles: mpv: allow dbus mpris (#7134 #7237)
• profiles: browsers: add private-cache to firefox-common and chromium-common
  browsers (d3bf6ac, 70107ef)
• profiles: keepassxc & thunderbird: allow librewolf paths (#7272)
• profiles: keepassxc-proxy: fix typo (#7278)
• profiles: evince: add deterministic-shutdown (#7269 #7277)
• profiles: blink-common-hardened: drop netlink & add mdwe comment (#7165)
• profiles: torbrowser-launcher: add getconf to private-bin (#7152)
• profiles: firefox-common: allow ioprio_set syscall (#7284)
• profiles: steam: allow mount_setattr syscall (#7268 #7287)
• new profile: gemini (#6936)
• new profile: opencode (#7135)
• new profile: pi (#7136)
• new profile: ephoto (#7153)
• new profile: tldr (#7166)
• new profile: claude (#7169)
• new profile: tasks-org (#7273)
• new profile: ChiPass (#7271)
• new profile: maki (#7285)