This PR fixes delays when IPv6 DNS lookups stall otherwise working IPv4 connections.
The earlier changes ([04c74877](04c74877c3) and [8a6f7784](8a6f778410)) added fallback across available IPv4 and IPv6 addresses, which this PR preserves.
Resolving both families upfront appears to have been an implementation choice, yet now IPv6 is resolved only when no IPv4 connection succeeds.
Unit tests and real socket compatibility tests passed on Alma 10 and Debian 13.
ⓘ Prevent certificate-chain errors from being overwritten while preserving password-login fallback for invalid optional certificates.
Reset verification state for every TLS handshake and add regression coverage.
This PR adds a "Binary Logging" page to configure log format, file size and retention, rotate or purge logs, and support restore sessions that do not write back to binary logs.
This PR adds DNF 4 and DNF 5 versionlock support to Package Updates, including listing, holding, unholding, and explicitly updating held packages.
DNF 4 requires the versionlock plugin to be installed, while DNF 5 supports versionlock natively.
Hold controls are shown only when the versionlock command is available.
It also previews DNF transactions before confirmation so users can see which packages will be installed or updated in the table, similar to APT.
- Add an APT-only “Held updates” view while keeping held packages excluded from normal and scheduled updates.
- Allow administrators to hold or unhold packages from package details.
- Allow explicitly selected held packages to be updated once, then restore all existing package holds.
- Preserve configured `aptitude` behavior for regular installs while using `apt-get` for the held-package override.
Fixes#2689
ⓘ Include partially installed dpkg packages in package listings and details while continuing to exclude removed and not-installed packages. Add regression coverage for all supported Debian package states.
277a919c27 (commitcomment-193125042)
ⓘ Follow up on #2794 by making `redirect_port` work even when `redirect_host` is not set. Keep existing host precedence and correctly handle proxy headers, IPv6 addresses, default ports, and invalid port values.
ⓘ Fix linked-server by keeping the child URL recognizable to the parent, then generating the final WebSocket URL on the same host and port the browser is using. This keeps the connection working with the current Webmin session.
ⓘ Extend HTTP and FTP download callbacks with destination validation while preserving legacy tracking callbacks and enforcing SSRF policy across redirects, proxies, caches, and direct/passive sockets.
https://github.com/webmin/webmin/pull/2789#discussion_r3567985773
Block non-public HTTP, HTTPS and FTP destinations by default in File Manager, Mailboxes and Upload and Download, with per-user IP/CIDR exceptions, redirect and proxy protection, cache isolation, and current-ACL enforcement for scheduled jobs.
ⓘ Normalize APT install-result names like `libtinfo6:amd64` to `libtinfo6` so scheduled updates can correctly detect dependency-updated packages and avoid false failure reports.
https://github.com/virtualmin/virtualmin-gpl/issues/1247
ⓘ Move miniserv helper functions into `miniserv-lib.pl`, remove the caller guard from `miniserv.pl`, and keep tests loading the helper library directly while preserving daemon startup behavior.
https://github.com/webmin/webmin/pull/2695
ⓘ Move XML-RPC marshalling helpers into `xmlrpc-lib.pl`, remove the caller guard from `xmlrpc.cgi`, and preserve coverage through direct library tests plus the CGI invocation regression.
https://github.com/webmin/webmin/pull/2763
ⓘ Prevent Webmin from swallowing Certbot's key-path output when extracting PEM paths, while preserving IPv6 cert-name support and adding regression coverage.
ⓘ Require websocket routes to opt in with allow_basic_ws before Basic auth is accepted in session mode. Mark linked ws-link routes and no-cookie backend-session routes as allowed, while leaving normal session-backed routes unmarked.
