What's Changed
🚀 Features
- [ci] make release creation idempotent in monthly release workflow by @jwhui in #3568
- [build] enable OT_POSIX_INSTALL_EXTERNAL_ROUTES for reference devices by @jwhui in #3569
- [mdns] fix the mDNSResponder build on Apple platforms by @clara-mostly-human in #3575
- [script] enable IP forwarding on macOS in _ipforward by @clara-mostly-human in #3576
- [github-actions] build the mDNSResponder configuration on macOS by @clara-mostly-human in #3577
- [firewall] add an opt-in in-process pf backend for macOS by @clara-mostly-human in #3578
- [rest] register the pending dataset via MGMT_PENDING_SET by @agners in #3582
- [host] stub MulticastRoutingManager on non-Linux so a Backbone Router build links by @clara-mostly-human in #3591
- [firewall] remove the unused single-element ingress set operations by @LorbusChris in #3606
- [firewall] reinstall the table when something else deletes it by @LorbusChris in #3619
- [firewall] drop the nat_forward chain by @LorbusChris in #3621
- [agent] follow the NAT64 translator with the NAT44 masquerade by @LorbusChris in #3622
🐛 Bug Fixes
- [ci] remove concurrency from monthly release workflow by @jwhui in #3567
- [ncp] fix TID exhaustion and NcpSpinel bugs causing test stalls by @jwhui in #3571
- [tests] support container in dbus_join and wait_for_device_role by @jwhui in #3570
- [misc] fix cmake install manifest spelling by @dsr-vafokhon-safokhujaev in #3564
- [script] detect Raspberry Pi OS via
/etc/rpi-issue(#3579) by @jwhui in #3584 - [mdns] treat mDNSResponder timeout as terminal error by @jwhui in #3588
- [dbus] handle failing and uncompiled properties in GetAll (#2754) by @jwhui in #3589
- [netif] verify unicast netlink ACKs and gate cache updates by @jwhui in #3594
- [agent][logging] fix logging to use stderr when syslog disabled by @EskoDijk in #3603
- [firewall] leave IPv4 out of the nftables ingress filter by @LorbusChris in #3604
- [firewall] name the nftables table after the Thread interface by @LorbusChris in #3617
- [firewall] accept overlapping prefixes in the nftables ingress sets by @LorbusChris in #3605
- [agent] install the NAT44 masquerade only with NAT64 by @LorbusChris in #3618
- [script] let with() see the scripts' own defaults by @LorbusChris in #3620
New Contributors
- @clara-mostly-human made their first contribution in #3575
- @dsr-vafokhon-safokhujaev made their first contribution in #3564
Full Changelog: v2026.09.0...v2026.10.0