dnsdist: Do not create `dnsdist.yml` in RPM system configuration directory

DNSdist now looks for a `dnsdist.yml` file first, which means that any
existing `dnsdist.conf` would no longer be taken into account if we create
a default `dnsdist.yml`. Let's install a sample YAML configuration file
in `dnsdist.yml-dist` instead.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16782 from rgacogne/ddist-210-a1

dnsdist: Update security polling zone and ChangeLog for 2.1.0-alpha1

dnsdist: Fix missing tag in 2.1.0-alpha1 changelog

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Fix release date in 2.1.0-alpha1 changelog

Co-authored-by: Miod Vallat <miod.vallat@powerdns.com>
Signed-off-by: Remi Gacogne <github@coredump.fr>
Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Fix yet another spelling issue

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Fix spelling issues

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Update security polling zone and ChangeLog for 2.1.0-alpha1

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16790 from miodvallat/nopei-key

auth, rec: No longer allow passing the api-key as a query argument

No longer allow passing the api-key as a query argument.

This feature had never been documented anyway and is considered bad security
practice nowadays.

Fixes: #16785
Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #16779 from rgacogne/ddist-remove-debian-fixperms-override

dnsdist: Stop overriding `dh_fixperms` in Deb packages

dnsdist: Stop overriding `dh_fixperms` in Deb packages

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16784 from omoerbeek/rec-coverity-20260127

rec: Coverity 1644498 Variable copied when it could be moved

rec: Coverity 1644498 Variable copied when it could be moved

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16775 from omoerbeek/rec-prep-5.4.0-beta1

rec: prep for rec-5.4.0-beta1

Merge pull request #16777 from rgacogne/ddist-mention-lua-yaml-file-in-upgrade-nots

dnsdist: Mention that Lua files might get loaded in the upgrade notes

Merge pull request #16776 from pieterlexis/dnsdist-reformat

chore(dnsdist): Format all dnsdist files

dnsdist: Mention that Lua files might get loaded in the upgrade notes

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

chore(dnsdist): Format all dnsdist files

Merge pull request #16768 from rgacogne/and-in-the-darkness-bind-them

dnsdist: Implement sampling in our in-memory ring buffers

Prep for rec-5.4.0-beta1

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

dnsdist: Move sampling-related Ring methods to header

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16770 from PowerDNS/dependabot/pip/modules/remotebackend/wheel-0.46.2

build(deps): bump wheel from 0.45.1 to 0.46.2 in /modules/remotebackend

build(deps): bump wheel from 0.45.1 to 0.46.2 in /modules/remotebackend

Bumps [wheel](https://github.com/pypa/wheel) from 0.45.1 to 0.46.2.
- [Release notes](https://github.com/pypa/wheel/releases)
- [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst)
- [Commits](https://github.com/pypa/wheel/compare/0.45.1...0.46.2)

---
updated-dependencies:
- dependency-name: wheel
  dependency-version: 0.46.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #16774 from PowerDNS/dependabot/pip/pdns/wheel-0.46.2

build(deps): bump wheel from 0.45.1 to 0.46.2 in /pdns

Merge pull request #16769 from rgacogne/ddist-lock-ot-data

dnsdist: Protect more OT Tracer data behind the lock

build(deps): bump wheel from 0.45.1 to 0.46.2 in /pdns

Bumps [wheel](https://github.com/pypa/wheel) from 0.45.1 to 0.46.2.
- [Release notes](https://github.com/pypa/wheel/releases)
- [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst)
- [Commits](https://github.com/pypa/wheel/compare/0.45.1...0.46.2)

---
updated-dependencies:
- dependency-name: wheel
  dependency-version: 0.46.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #16767 from jsoref/dependabot-matchers

Add dependabot problem matchers

Merge pull request #16771 from rgacogne/ddist-update-quiche-0.24.8

dnsdist: Update Quiche to 0.24.8

Merge pull request #16765 from rgacogne/ddist-sl-fixes

dnsdist: Structured logging fixes

Merge pull request #16709 from omoerbeek/rec-lua-yaml-conf

rec: handle applicable dynamic parts of YAML only config when reloading Lua config

Merge pull request #16710 from pieterlexis/rec-ywh-PGM6095-53-SVCB-Params

Fix: harden SVCB record parsing

Merge pull request #16773 from omoerbeek/rec-docs-nits

rec docs: two nits

rec docs: two nits

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Apply suggestions from code review

Co-authored-by: Remi Gacogne <github@coredump.fr>
Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

dnsdist: Update Quiche to 0.24.8

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: "Fix" formatting

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Protect more OT Tracer data behind the lock

I was investigating a crash that occurred on our CI:

```
2026-01-23T14:33:07.1755774Z === configs/dnsdist_TestOpenTelemetryTracingStripIncomingTraceParent.log ===
2026-01-23T14:33:07.1757303Z msg="dnsdist 0.0.0-git1 comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it according to the terms of the GPL version 2" subsystem="setup" level="0" prio="Info" ts="1769178505.183"
2026-01-23T14:33:07.1758153Z msg="Raised send buffer size" subsystem="setup" level="0" prio="Info" ts="1769178505.203" frontend.address="127.0.0.1:14303" network.send_buffer_size="212992"
2026-01-23T14:33:07.1758909Z msg="Raised receive buffer size" subsystem="setup" level="0" prio="Info" ts="1769178505.203" buffer_size="1048576" frontend.address="127.0.0.1:14303"
2026-01-23T14:33:07.1759563Z msg="Listening on Do53 frontend" subsystem="setup" level="0" prio="Info" ts="1769178505.203" frontend.address="127.0.0.1:14303"
2026-01-23T14:33:07.1760608Z msg="Allowing queries from" subsystem="setup" level="0" prio="Info" ts="1769178505.204" acl="10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16, ::1/128, fc00::/7, fe80::/10"
2026-01-23T14:33:07.1761243Z msg="Allowing console connections from" subsystem="setup" level="0" prio="Info" ts="1769178505.204" acl="127.0.0.0/8, ::1/128"
2026-01-23T14:33:07.1762396Z msg="Setting initial status for backend" subsystem="backend" level="0" prio="Info" ts="1769178505.209" backend.address="127.0.0.1:14002" backend.health_check.status="up" backend.name="" backend.protocol="DoUDP"
2026-01-23T14:33:07.1763777Z dnsdist: ../../../../../../tmp/dnsdist-meson-dist-build/meson-dist/dnsdist-0.0.0-git1/dnsdist-opentelemetry.cc:168: void pdns::trace::dnsdist::Tracer::closeSpan(const SpanID &): Assertion `d_spanIDStack.back() == spanID' failed.
```

While trying to work out how this condition could fail, I quickly realized
it was hard for me to follow which fields were protected behind a lock and
which weren't, and in some cases it looked like there could be a race.
Since performance is not critical in this code, and I would rather trade
correctness for performance whenever possible anyway, this commit is
moving all the related fields behind the lock.
It might or might not fix the issue, as I haven't been able to reproduce it
yet, but in any case I believe it will make it easier to reason about it.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Fix indentation

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16757 from PowerDNS/dependabot/pip/regression-tests.ixfrdist/wheel-0.46.2

build(deps): bump wheel from 0.45.1 to 0.46.2 in /regression-tests.ixfrdist

Merge pull request #16758 from PowerDNS/dependabot/pip/regression-tests.dnsdist/wheel-0.46.2

build(deps): bump wheel from 0.45.1 to 0.46.2 in /regression-tests.dnsdist

Merge pull request #16759 from PowerDNS/dependabot/pip/regression-tests.api/wheel-0.46.2

build(deps): bump wheel from 0.45.1 to 0.46.2 in /regression-tests.api

Merge pull request #16760 from PowerDNS/dependabot/pip/regression-tests.auth-py/wheel-0.46.2

build(deps): bump wheel from 0.45.1 to 0.46.2 in /regression-tests.auth-py

Merge pull request #16761 from PowerDNS/dependabot/pip/pdns/recursordist/docs/wheel-0.46.2

build(deps): bump wheel from 0.45.1 to 0.46.2 in /pdns/recursordist/docs

Merge pull request #16762 from PowerDNS/dependabot/pip/pdns/dnsdistdist/docs/wheel-0.46.2

build(deps): bump wheel from 0.45.1 to 0.46.2 in /pdns/dnsdistdist/docs

dnsdist: Use separate sampling counters for queries and responses

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Add a regression test for dynamic blocks with sampling enabled

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Add a dynamic block unit test with sampling enabled

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Add a unit test for ring buffers sampling

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Reduce contention around the sampling counter in the rings

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Clean up the types used by the Dynamic Block code

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Adjust for sampling rate in rings' consumers

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Add dependabot problem matchers

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

dnsdist: Add response code to TCP responses in structured logging

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Fix XSK flag being reversed in structured logging

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Fix possible use-after-free in structured logging

SL keeps a reference to objects passed to it until it decides to
actually generate the log content, so we should not pass temporaries to
it.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Naive sampling in the ring buffers

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16763 from rgacogne/ddist-yml-example-packages

dnsdist: Handle the new YAML example configuration file in our packages

build(deps): bump wheel from 0.45.1 to 0.46.2 in /pdns/recursordist/docs

Bumps [wheel](https://github.com/pypa/wheel) from 0.45.1 to 0.46.2.
- [Release notes](https://github.com/pypa/wheel/releases)
- [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst)
- [Commits](https://github.com/pypa/wheel/compare/0.45.1...0.46.2)

---
updated-dependencies:
- dependency-name: wheel
  dependency-version: 0.46.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump wheel from 0.45.1 to 0.46.2 in /pdns/dnsdistdist/docs

Bumps [wheel](https://github.com/pypa/wheel) from 0.45.1 to 0.46.2.
- [Release notes](https://github.com/pypa/wheel/releases)
- [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst)
- [Commits](https://github.com/pypa/wheel/compare/0.45.1...0.46.2)

---
updated-dependencies:
- dependency-name: wheel
  dependency-version: 0.46.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump wheel in /regression-tests.dnsdist

Bumps [wheel](https://github.com/pypa/wheel) from 0.45.1 to 0.46.2.
- [Release notes](https://github.com/pypa/wheel/releases)
- [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst)
- [Commits](https://github.com/pypa/wheel/compare/0.45.1...0.46.2)

---
updated-dependencies:
- dependency-name: wheel
  dependency-version: 0.46.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump wheel in /regression-tests.auth-py

Bumps [wheel](https://github.com/pypa/wheel) from 0.45.1 to 0.46.2.
- [Release notes](https://github.com/pypa/wheel/releases)
- [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst)
- [Commits](https://github.com/pypa/wheel/compare/0.45.1...0.46.2)

---
updated-dependencies:
- dependency-name: wheel
  dependency-version: 0.46.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump wheel from 0.45.1 to 0.46.2 in /regression-tests.api

Bumps [wheel](https://github.com/pypa/wheel) from 0.45.1 to 0.46.2.
- [Release notes](https://github.com/pypa/wheel/releases)
- [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst)
- [Commits](https://github.com/pypa/wheel/compare/0.45.1...0.46.2)

---
updated-dependencies:
- dependency-name: wheel
  dependency-version: 0.46.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump wheel in /regression-tests.ixfrdist

Bumps [wheel](https://github.com/pypa/wheel) from 0.45.1 to 0.46.2.
- [Release notes](https://github.com/pypa/wheel/releases)
- [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst)
- [Commits](https://github.com/pypa/wheel/compare/0.45.1...0.46.2)

---
updated-dependencies:
- dependency-name: wheel
  dependency-version: 0.46.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #16764 from romeroalx/fix-py-pacakging-version

requirements.txt: update package dependencies

requirements.txt: update package dependencies

dnsdist: Handle the new YAML example configuration file in our packages

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Fix rebase conflict and a case where we don't have a Lua config at all

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Test with reloading forward and TLS config

Also add verify failed test

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Refactor tests to use available recControl() method

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Refactor common part

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

rec: handle applicable dynamic parts of YAML only config when reloading Lua config

Fixes #16673

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16753 from miodvallat/ecl

auth: stricter TTL enforcement for RRset updates

Merge pull request #16754 from omoerbeek/rec-api-test-meson

rec: api tests: change default location of rec to be in the default meson build dir

Merge pull request #16727 from omoerbeek/rec-ottrace-rest

rec: add REST interface for manipulating Open Telemetry Trace Conditions

rec: api tests: change default location of rec to be in the default meson build dir

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Better words on docs

Co-authored-by: Miod Vallat <miod.vallat@powerdns.com>
Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Revert default location of recursur, will move to a separate PR

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Apply suggestions from code review

Co-authored-by: Miod Vallat <miod.vallat@powerdns.com>
Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16752 from romeroalx/add-step-build-deps-dnsdist

GH actions - build-and-test-all.yml - build dnsdist: add back install-build-deps step

Merge pull request #16744 from rgacogne/ddist-default-to-yml

dnsdist: Look for a `.yml` configuration file first

Add a test for EXTEND adding a record with mismatching TTL.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

For EXTEND operations, perform the RRSet check once computed.

The check was performed only on the record to add, and checkRRSet can't do
anything when passed a single record...

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Implement an optional RRSet TTL check.

Perform such checks in pdnsutil and the HTTP API when performing RRSet
modifications.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Replace the bool argument of checkRRSet with an enum, to allow future growth.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

build-and-test-all.yml - build dnsdist: add back install-build-deps step

Merge pull request #16751 from miodvallat/unknown_tongue

auth pdnsutil: Fix command synopsis of "view list".

Fix command synopsis of "view list".

Fixes #16747

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #16748 from romeroalx/fix-el10-builds

build-packages: fix el-10 builds. Make macro systemd_requires optional

Merge pull request #16746 from rgacogne/ddist-coverity-20260120

dnsdist: Fix small issues reported by Coverity

build-packages: fix el-10 builds

Merge pull request #16714 from romeroalx/use-debian13-ci-builds

GH actions - build-and-test-all.yml: use Debian Trixie for the runner container

dnsdist: Fix a typo spotted by Pieter in the YAML example

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Prevent copies while logging

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Prevent a copy while parsing YAML configuration

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16742 from rgacogne/ddist-update-quiche

dnsdist: Update Quiche to 0.24.7 in our packages

Merge pull request #16738 from rgacogne/ddist-update-js-libraries

dnsdist: Update JavaScript libraries used by the internal Web dashboard

dnsdist: Do not log from the TCP connection `dtor`

It is not really useful and could throw.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Be explicit about not caring when `setsockopt` fails

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Fix possible move after use reported by Coverity (CID 501255)

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16708 from PowerDNS/dependabot/pip/regression-tests.auth-py/urllib3-2.6.3

build(deps): bump urllib3 from 2.6.2 to 2.6.3 in /regression-tests.auth-py