What's Changed

🚀 Features

• [ci] make release creation idempotent in monthly release workflow by @jwhui in #3568
• [build] enable OT_POSIX_INSTALL_EXTERNAL_ROUTES for reference devices by @jwhui in #3569
• [mdns] fix the mDNSResponder build on Apple platforms by @clara-mostly-human in #3575
• [script] enable IP forwarding on macOS in _ipforward by @clara-mostly-human in #3576
• [github-actions] build the mDNSResponder configuration on macOS by @clara-mostly-human in #3577
• [firewall] add an opt-in in-process pf backend for macOS by @clara-mostly-human in #3578
• [rest] register the pending dataset via MGMT_PENDING_SET by @agners in #3582
• [host] stub MulticastRoutingManager on non-Linux so a Backbone Router build links by @clara-mostly-human in #3591
• [firewall] remove the unused single-element ingress set operations by @LorbusChris in #3606
• [firewall] reinstall the table when something else deletes it by @LorbusChris in #3619
• [firewall] drop the nat_forward chain by @LorbusChris in #3621
• [agent] follow the NAT64 translator with the NAT44 masquerade by @LorbusChris in #3622

🐛 Bug Fixes

• [ci] remove concurrency from monthly release workflow by @jwhui in #3567
• [ncp] fix TID exhaustion and NcpSpinel bugs causing test stalls by @jwhui in #3571
• [tests] support container in dbus_join and wait_for_device_role by @jwhui in #3570
• [misc] fix cmake install manifest spelling by @dsr-vafokhon-safokhujaev in #3564
• [script] detect Raspberry Pi OS via /etc/rpi-issue (#3579) by @jwhui in #3584
• [mdns] treat mDNSResponder timeout as terminal error by @jwhui in #3588
• [dbus] handle failing and uncompiled properties in GetAll (#2754) by @jwhui in #3589
• [netif] verify unicast netlink ACKs and gate cache updates by @jwhui in #3594
• [agent][logging] fix logging to use stderr when syslog disabled by @EskoDijk in #3603
• [firewall] leave IPv4 out of the nftables ingress filter by @LorbusChris in #3604
• [firewall] name the nftables table after the Thread interface by @LorbusChris in #3617
• [firewall] accept overlapping prefixes in the nftables ingress sets by @LorbusChris in #3605
• [agent] install the NAT44 masquerade only with NAT64 by @LorbusChris in #3618
• [script] let with() see the scripts' own defaults by @LorbusChris in #3620

New Contributors

• @clara-mostly-human made their first contribution in #3575
• @dsr-vafokhon-safokhujaev made their first contribution in #3564

Full Changelog: v2026.09.0...v2026.10.0

What's Changed

🚀 Features

• [ci] package and upload source tarball in monthly release by @jwhui in #3497
• [web] support HTTPS reverse proxy for API calls by @LJspice in #3432
• [web] generate QR codes on webUI client instead of remote API by @LJspice in #3449
• [rest] add endpoints for Border Agent ephemeral key (ePSKc) by @lboue in #3480
• [docker] add stable tag to border-router Docker image by @drudchenko in #3523
• [web] add ePSKc (Thread 1.4 Credentials Sharing) support to the web GUI by @lboue in #3479
• [ncp] support the pending dataset under NCP mode by @LorbusChris in #3514
• [rest] bump REST API version to 0.5.0 for ePSKc endpoints by @lboue in #3534
• [agent] add generic readiness notification fd support by @agners in #3478
• [rest] update OpenAPI specification with corrections and enhancements by @martinzi in #3519
• [mdns] disable OT_MDNS explicitly when using platform mDNS by @martinzi in #3230
• [tests] add coverage for /.well-known/thread/br-rest discovery endpoint by @lboue in #3538
• [agent] use #if instead of #ifdef for OTBR_ENABLE_PLATFORM_ANDROID by @jwhui in #3554
• [agent] use sigaction for signal handlers at start of Application::Run by @jwhui in #3555
• [agent] add option to exit on platform reset by @agners in #3537
• [rest] add per-route method registry to fix 404/405/OPTIONS handling by @3oris in #3546
• [rest] honor If-None-Match on the dataset PUT endpoints by @LorbusChris in #3552
• [misc] replace instances of duplicated "the the" with "the" by @jwhui in #3559
• [firewall] opt-in in-process nftables backend via libnftnl/libmnl by @LorbusChris in #3325

🐛 Bug Fixes

• [tests] increase timeout in ncp_version.exp to prevent CI flakiness by @jwhui in #3493
• [tests] fix flaky timeout in RcpHostApi.StateChangesCorrectlyAfterJoin by @lboue in #3508
• [ubus] fix two memory-safety issues by @LorbusChris in #3487
• [script] use / instead of . in sysctl.conf to avoid issues when the infra if name contains . by @erjiaqing in #2125
• [web] prevent OT CLI command injection via newline characters by @alimezar in #3288
• [docker] make IPv4 firewall rules idempotent and remove them on exit by @skirmess in #3517
• [tests] fix provisioning URL mismatch in dbus test-client by @jwhui in #3531
• [tests] fix epskc_test() port assertion against a real ephemeral port by @lboue in #3526
• [docker] accept IPv6 traffic leaving the Thread network by @skirmess in #3521
• [tests] fix flaky ncp DeviceRole checks by polling instead of fixed sleep by @lboue in #3511
• [rest] fix PUT errors masked as 405 by RoutingErrorHandler by @lboue in #3524
• [cmake] reorder static libraries in otbr-agent link list to resolve unresolved symbols by @backtomoon in #3545
• [host] fix Leave and migration handling on the RCP path by @LorbusChris in #3489
• [mdns] fix service loss on mDNSResponder daemon restart by @yangsong-cnyn in #3394
• [tests] give NCP dbus-send Join calls a generous expect timeout by @lboue in #3549
• [tests] pin schemathesis to ~=4.25.0 to avoid 4.24.x crash by @lboue in #3543
• [rest] fix active dataset request body content type in OpenAPI spec by @jwhui in #3560
• [ci] fix source tarball creation in monthly release workflow by @jwhui in #3563
• [ci] allow uploads endpoint for monthly release workflow by @jwhui in #3566

New Contributors

• @LJspice made their first contribution in #3432
• @lboue made their first contribution in #3480
• @LorbusChris made their first contribution in #3487
• @alimezar made their first contribution in #3288
• @skirmess made their first contribution in #3517
• @drudchenko made their first contribution in #3523
• @backtomoon made their first contribution in #3545
• @3oris made their first contribution in #3546

Full Changelog: v2026.08.0...v2026.09.0

What's Changed

🚀 Features

• [tests] implement (10.4) IPv4 built-in NAT64 connectivity test by @jwhui in #3445
• [tests] increase ping count in TREL_TC_4 expect script by @jwhui in #3455
• [rest] add REST API version in /.well-known/thread for API discovery by @martinzi in #3330
• [doc] rename GEMINI.md to AGENTS.md by @jwhui in #3459
• [github-actions] remove MATN test jobs from workflow by @jwhui in #3454
• [dnssd] deduplicate service instance updates by @jwhui in #3461
• [posix] retry InitMulticastRouterSock on error by @jwhui in #3467
• [rest] avoid variable-length array in Bytes2HexJson by @jwhui in #3474
• [utils] add nullptr guards to Bytes2Hex overloads by @jwhui in #3476
• [ci] fix issues found by zizmor by @bukepo in #3483

🐛 Bug Fixes

• [docker] add die function in setup-host by @lindhe in #3472
• [tests] fix ED_1 state after reset in dind_srp_tc_11 script by @jwhui in #3486
• [tests] fix expect matching order in dind_trel_tc_5.exp by @jwhui in #3490
• [docker] declare secrets in workflow_call trigger by @jwhui in #3492

New Contributors

• @lindhe made their first contribution in #3472

Full Changelog: v2026.07.0...v2026.08.0

What's Changed

🚀 Features

• [tests] add docker-in-docker NAT64 integration test by @jwhui in #3387
• [ncp] add IgnoreError for SendDnssdBrowseResult function call by @yangsong-cnyn in #3357
• [tests] add dind srp 1_3_SRP_TC_1 integration test by @jwhui in #3395
• [tests] add DinD integration test for SRP name conflicts by @jwhui in #3398
• [tests] add SRP service lease integration test (1_3_SRP_TC_3) by @jwhui in #3404
• [tests] implement SRP Key Lease (1_3_SRP_TC_4) DinD integration test by @jwhui in #3407
• [tests] add SRP KEY record inclusion/omission test (1_3_SRP_TC_5) by @jwhui in #3410
• [tests] implement DinD test for SRP TC 2.6 Name Compression by @jwhui in #3411
• [tests] implement DinD test for SRP TC 2.8 Removing Services by @jwhui in #3412
• [cmake] enable OT core advertising proxy by default for all mdns by @jwhui in #3416
• [host] improvements on ThreadHelper::AttachAllNodesTo by @wtongze in #3337
• [tests] implement DinD test for SRP TC 2.11 Recovery after reboot by @jwhui in #3413
• [tests] implement DinD test for SRP TC 2.13 Device Address Update by @jwhui in #3415
• [tests] add integration test for SRP subtype validation (TC 15) by @jwhui in #3418
• [tests] implement 1.3 Discovery Proxy test case (DPR_TC_1) by @jwhui in #3419
• [tests] add dind integration test for 1_3_DPR_TC_2 by @jwhui in #3423
• [tests] add dind integration test for TREL attach and connectivity by @jwhui in #3425
• [tests] implement Thread 1.4 TREL TC 8.2 test by @jwhui in #3426
• [tests] fix MAC isolation timing in TREL integration test by @jwhui in #3434
• [tests] implement Thread 1.4 TREL TC 8.3 test case by @jwhui in #3428
• [tests] fix mDNS resolution race condition in DinD tests by @jwhui in #3439
• [tests] implement Thread 1.4 TREL TC 8.4 (Receive Discovery) by @jwhui in #3435
• [tests] add TREL discover scan over multi-radio integration test by @jwhui in #3437
• [docker] support reusable workflow for CalVer releases by @jwhui in #3436
• [tests] add integration test for TREL mDNS Discovery (1_4_TREL_TC_6) by @jwhui in #3438
• [tests] fix race condition in SRP recovery reboot test by @jwhui in #3444
• [tests] implement 1.4.1 (10.1) DHCPv6-PD OMR integration test by @jwhui in #3440
• [tests] implement 1.4.3 (10.3) default route advertisement test by @jwhui in #3443

🐛 Bug Fixes

• [host] fix D-Bus method hangs on Spinel set-property failures by @jwhui in #3388

Full Changelog: v2026.06.0...v2026.07.0

What's Changed

🚀 Features

• [ci] add raspbian build check for bookworm version by @Irving-cl in #2895
• [build] provides an option to enable ot-br-posix-user-config.h header file by @superwhd in #2911
• [bootstrap] improve robustness of mDNSResponder download and extraction by @yangsong-cnyn in #2877
• [format] upgrade clang-format to 16 by @Irving-cl in #2936
• [border-agent] add "vendor TXT Data changed" callback by @abtink in #2941
• [dnssd] remove unnecessary OTBR_UNUSED_VARIABLE by @Irving-cl in #2955
• [cmake] rename the library otbr-ncp to otbr-host by @Irving-cl in #2976
• [dns] move dns_utils from common to utils by @Irving-cl in #2972
• [utils] move telemetry retriever code from utils to host directory by @Irving-cl in #2975
• [format] upgrade clang-format to 19 by @Irving-cl in #2990
• [tests] fix flaky test in test_netif.cpp by @Irving-cl in #3000
• [dnssd] implement Dnssd Browser/Resolver APIs by @Irving-cl in #2962
• [style] standardize llvm version to 19.1.7 by @Irving-cl in #3009
• [tests] enhance flaky WpanIfHasCorrectMulticastAddresses_AfterUpdatingMulticastAddresses by @Irving-cl in #3020
• [telemetry] refactor telemetry code by @Irving-cl in #3006
• [build] remove unnecessary link to otbr-proto by @Irving-cl in #3005
• [log] set the default log tag to OTBR by @zhanglongxia in #3044
• [host] unify the namespace to otbr::Host by @Irving-cl in #3040
• [main] move all methods in themain.cpp file to the realmain.cpp file by @zhanglongxia in #3042
• [ncp] add local port to udp forward callback by @Irving-cl in #3069
• [ncp] enhance ncp spinel log by @Irving-cl in #3085
• [script] enable log for NCP simulation node by @Irving-cl in #3087
• [utils] add csprng and update ephemeral key generation by @Irving-cl in #3096
• [dbus] unregister the dbus object from the dbus library by @zhanglongxia in #3170
• [otbr] add OTBR_ENABLE_PLATFORM_RESET_EXIT to reset gtbr by calling exit method by @zhanglongxia in #3171
• [host] handle joining to the same Thread network in AttachAllNodesTo() by @zhanglongxia in #3273
• [dbus] run LeaveNetwork command with pseudo reset by @zhanglongxia in #3276
• [dbus] de-initialize the dbus server by @zhanglongxia in #3290
• [host] set OpenThread log level after otInstance initialization by @abtink in #3304
• [dbus] return BUSY when the ePSKC has already activated by @zhanglongxia in #3314
• [dua] remove DUA routing feature by @jwhui in #3360
• [mdns] remove avahi publisher option and dependencies by @jwhui in #3359
• [rest] set SO_REUSEADDR socket option for REST HTTP server by @puddly in #3361
• [tests] align expect scripts failsafe cleanup and docker tracking by @jwhui in #3383

🐛 Bug Fixes

• [disc-proxy] fix subscription count check in unsubscribe by @abtink in #2924
• [mdns] handle retryable mDNSResponder errors by @superwhd in #2971
• [mDNS] fix avahi issue by @Irving-cl in #2998
• [script] add dbus reload in ncp_mode script setup by @Irving-cl in #3014
• [trel] fix the macro of TrelDnssd module by @Irving-cl in #3083
• [posix] add posix platform entropy and add entropy source for mbedtls by @Irving-cl in #3158
• [ncp] add handling for NCP reset by @Irving-cl in #3187
• [dbus] clear the pointer mDetachGracefullyHandler after it was called by @zhanglongxia in #3253
• [border-agent] validate MeshCop TXT entry length in D-Bus handler by @jwhui in #3366
• [discovery-proxy] restart query iteration to prevent heap UAF by @jwhui in #3367
• [dns-utils] replace service/hostname sanity asserts by @jwhui in #3371
• [rest] fix out-of-bounds map write in diagnostic handler by @jwhui in #3365
• [rest] prevent division-by-zero in energy scan callback by @jwhui in #3373
• [rest] fix getNetworkDiagnosticTask off-by-one crash by @jwhui in #3375
• [rcp-host] fix UAF in ThreadDetachGracefullyCallback by @jwhui in #3370
• [rest] wrap RemoveJoiner handler in main-loop task by @jwhui in #3374

New Contributors

• @mtilchen made their first contribution in #3003
• @THETCR made their first contribution in #3054
• @EskoDijk made their first contribution in #3077
• @aashu216 made their first contribution in #3078
• @Ansuel made their first contribution in #3145
• @wtongze made their first contribution in #3152
• @stintel made their first contribution in #3178
• @silabs-thanhN made their first contribution in #3112

Full Changelog: thread-reference-20250612...v2026.06.0

OpenThread Border Router (2025-06-12) included with Thread Test Harness V63.0.

OpenThread Border Router (2023-07-10) included with Thread Test Harness V59.0 (V58.5 internal).

OpenThread Border Router (2023-01-19) included with Thread Test Harness V58.0 (V57.3+ internal).

OpenThread Border Router (2022-10-27) included with Thread Test Harness V58.0 (V57.3+ internal).