Strongly suggest storing variants in the same backend as their regular zone.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #16810 from miodvallat/discount

auth: correctly compute DNSSEC public key exponent lengths when larger than 255

Merge pull request #16802 from rgacogne/ddist-quiche-congestion-bbr

dnsdist: Work around Quiche not dealing well with removed congestion algorithms

Merge pull request #16805 from rgacogne/ddist-nicer-b64-error

dnsdist: Better handling of invalid Base64 content

Merge pull request #16808 from PowerDNS/dependabot/cargo/pdns/recursordist/rec-rust-lib/rust/bytes-1.11.1

build(deps): bump bytes from 1.11.0 to 1.11.1 in /pdns/recursordist/rec-rust-lib/rust

Correctly compute public key exponent length when larger than 255.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

build(deps): bump bytes in /pdns/recursordist/rec-rust-lib/rust

Bumps [bytes](https://github.com/tokio-rs/bytes) from 1.11.0 to 1.11.1.
- [Release notes](https://github.com/tokio-rs/bytes/releases)
- [Changelog](https://github.com/tokio-rs/bytes/blob/master/CHANGELOG.md)
- [Commits](https://github.com/tokio-rs/bytes/compare/v1.11.0...v1.11.1)

---
updated-dependencies:
- dependency-name: bytes
  dependency-version: 1.11.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

Add a unit test for invalid Base64 content

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Cleanup of base64-related header and unit tests

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Better handling of invalid Base64 content

The existing code would throw an exception instead of returning
an error for some invalid content, which was harder to diagnose.

Reported by Surya Narayan Kushwaha (aka Cavid), thanks!

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16799 from rgacogne/update-ipcrypt2

dnsdist: Update ipcrypt2 to 1.1.10 + 1 commit

dnsdist: Add a regression test for the `bbr` congestion algo removed by Quiche

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Switch to cubic as default congestion algo for QUIC

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Work around Quiche not dealing well with removed congestion algorithms

See https://github.com/cloudflare/quiche/issues/2342

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16801 from sskender/master

docs: Fix grammar in running description

docs: Fix grammar in running description

Merge pull request #16800 from zeha/dnsdistspoof

dnsdist: SpoofAction: clarify what gets spoofed

dnsdist: SpoofAction: clarify what gets spoofed

Signed-off-by: Chris Hofstaedtler <chris.hofstaedtler@deduktiva.com>

ext/ipcrypt2: Add missing softaes/untrinsics.h header

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

ext/ipcrypt2: Update to `70a4daf` (1.1.10 plus 1 commit)

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16798 from hhoffstaette/no-yml-plz

dnsdist: Only install dnsdist.yml-dist if yaml support was enabled

dnsdist: Only install dnsdist.yml-dist if yaml support was enabled

Signed-off-by: Holger Hoffstätte <holger@applied-asynchrony.com>

Merge pull request #16793 from rgacogne/ddist-do-not-install-dnsdist-yml

dnsdist: Do not create `dnsdist.yml` in RPM system configuration directory

dnsdist: Do not create `dnsdist.yml` in RPM system configuration directory

DNSdist now looks for a `dnsdist.yml` file first, which means that any
existing `dnsdist.conf` would no longer be taken into account if we create
a default `dnsdist.yml`. Let's install a sample YAML configuration file
in `dnsdist.yml-dist` instead.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16782 from rgacogne/ddist-210-a1

dnsdist: Update security polling zone and ChangeLog for 2.1.0-alpha1

dnsdist: Fix missing tag in 2.1.0-alpha1 changelog

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Fix release date in 2.1.0-alpha1 changelog

Co-authored-by: Miod Vallat <miod.vallat@powerdns.com>
Signed-off-by: Remi Gacogne <github@coredump.fr>
Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Fix yet another spelling issue

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Fix spelling issues

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Update security polling zone and ChangeLog for 2.1.0-alpha1

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16790 from miodvallat/nopei-key

auth, rec: No longer allow passing the api-key as a query argument

No longer allow passing the api-key as a query argument.

This feature had never been documented anyway and is considered bad security
practice nowadays.

Fixes: #16785
Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>

Merge pull request #16779 from rgacogne/ddist-remove-debian-fixperms-override

dnsdist: Stop overriding `dh_fixperms` in Deb packages

dnsdist: Stop overriding `dh_fixperms` in Deb packages

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16784 from omoerbeek/rec-coverity-20260127

rec: Coverity 1644498 Variable copied when it could be moved

rec: Coverity 1644498 Variable copied when it could be moved

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16775 from omoerbeek/rec-prep-5.4.0-beta1

rec: prep for rec-5.4.0-beta1

Merge pull request #16777 from rgacogne/ddist-mention-lua-yaml-file-in-upgrade-nots

dnsdist: Mention that Lua files might get loaded in the upgrade notes

Merge pull request #16776 from pieterlexis/dnsdist-reformat

chore(dnsdist): Format all dnsdist files

dnsdist: Mention that Lua files might get loaded in the upgrade notes

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

chore(dnsdist): Format all dnsdist files

Merge pull request #16768 from rgacogne/and-in-the-darkness-bind-them

dnsdist: Implement sampling in our in-memory ring buffers

Prep for rec-5.4.0-beta1

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

dnsdist: Move sampling-related Ring methods to header

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16770 from PowerDNS/dependabot/pip/modules/remotebackend/wheel-0.46.2

build(deps): bump wheel from 0.45.1 to 0.46.2 in /modules/remotebackend

build(deps): bump wheel from 0.45.1 to 0.46.2 in /modules/remotebackend

Bumps [wheel](https://github.com/pypa/wheel) from 0.45.1 to 0.46.2.
- [Release notes](https://github.com/pypa/wheel/releases)
- [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst)
- [Commits](https://github.com/pypa/wheel/compare/0.45.1...0.46.2)

---
updated-dependencies:
- dependency-name: wheel
  dependency-version: 0.46.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #16774 from PowerDNS/dependabot/pip/pdns/wheel-0.46.2

build(deps): bump wheel from 0.45.1 to 0.46.2 in /pdns

Merge pull request #16769 from rgacogne/ddist-lock-ot-data

dnsdist: Protect more OT Tracer data behind the lock

build(deps): bump wheel from 0.45.1 to 0.46.2 in /pdns

Bumps [wheel](https://github.com/pypa/wheel) from 0.45.1 to 0.46.2.
- [Release notes](https://github.com/pypa/wheel/releases)
- [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst)
- [Commits](https://github.com/pypa/wheel/compare/0.45.1...0.46.2)

---
updated-dependencies:
- dependency-name: wheel
  dependency-version: 0.46.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #16767 from jsoref/dependabot-matchers

Add dependabot problem matchers

Merge pull request #16771 from rgacogne/ddist-update-quiche-0.24.8

dnsdist: Update Quiche to 0.24.8

Merge pull request #16765 from rgacogne/ddist-sl-fixes

dnsdist: Structured logging fixes

Merge pull request #16709 from omoerbeek/rec-lua-yaml-conf

rec: handle applicable dynamic parts of YAML only config when reloading Lua config

Merge pull request #16710 from pieterlexis/rec-ywh-PGM6095-53-SVCB-Params

Fix: harden SVCB record parsing

Merge pull request #16773 from omoerbeek/rec-docs-nits

rec docs: two nits

rec docs: two nits

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Apply suggestions from code review

Co-authored-by: Remi Gacogne <github@coredump.fr>
Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

dnsdist: Update Quiche to 0.24.8

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: "Fix" formatting

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Protect more OT Tracer data behind the lock

I was investigating a crash that occurred on our CI:

```
2026-01-23T14:33:07.1755774Z === configs/dnsdist_TestOpenTelemetryTracingStripIncomingTraceParent.log ===
2026-01-23T14:33:07.1757303Z msg="dnsdist 0.0.0-git1 comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it according to the terms of the GPL version 2" subsystem="setup" level="0" prio="Info" ts="1769178505.183"
2026-01-23T14:33:07.1758153Z msg="Raised send buffer size" subsystem="setup" level="0" prio="Info" ts="1769178505.203" frontend.address="127.0.0.1:14303" network.send_buffer_size="212992"
2026-01-23T14:33:07.1758909Z msg="Raised receive buffer size" subsystem="setup" level="0" prio="Info" ts="1769178505.203" buffer_size="1048576" frontend.address="127.0.0.1:14303"
2026-01-23T14:33:07.1759563Z msg="Listening on Do53 frontend" subsystem="setup" level="0" prio="Info" ts="1769178505.203" frontend.address="127.0.0.1:14303"
2026-01-23T14:33:07.1760608Z msg="Allowing queries from" subsystem="setup" level="0" prio="Info" ts="1769178505.204" acl="10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16, ::1/128, fc00::/7, fe80::/10"
2026-01-23T14:33:07.1761243Z msg="Allowing console connections from" subsystem="setup" level="0" prio="Info" ts="1769178505.204" acl="127.0.0.0/8, ::1/128"
2026-01-23T14:33:07.1762396Z msg="Setting initial status for backend" subsystem="backend" level="0" prio="Info" ts="1769178505.209" backend.address="127.0.0.1:14002" backend.health_check.status="up" backend.name="" backend.protocol="DoUDP"
2026-01-23T14:33:07.1763777Z dnsdist: ../../../../../../tmp/dnsdist-meson-dist-build/meson-dist/dnsdist-0.0.0-git1/dnsdist-opentelemetry.cc:168: void pdns::trace::dnsdist::Tracer::closeSpan(const SpanID &): Assertion `d_spanIDStack.back() == spanID' failed.
```

While trying to work out how this condition could fail, I quickly realized
it was hard for me to follow which fields were protected behind a lock and
which weren't, and in some cases it looked like there could be a race.
Since performance is not critical in this code, and I would rather trade
correctness for performance whenever possible anyway, this commit is
moving all the related fields behind the lock.
It might or might not fix the issue, as I haven't been able to reproduce it
yet, but in any case I believe it will make it easier to reason about it.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Fix indentation

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16757 from PowerDNS/dependabot/pip/regression-tests.ixfrdist/wheel-0.46.2

build(deps): bump wheel from 0.45.1 to 0.46.2 in /regression-tests.ixfrdist

Merge pull request #16758 from PowerDNS/dependabot/pip/regression-tests.dnsdist/wheel-0.46.2

build(deps): bump wheel from 0.45.1 to 0.46.2 in /regression-tests.dnsdist

Merge pull request #16759 from PowerDNS/dependabot/pip/regression-tests.api/wheel-0.46.2

build(deps): bump wheel from 0.45.1 to 0.46.2 in /regression-tests.api

Merge pull request #16760 from PowerDNS/dependabot/pip/regression-tests.auth-py/wheel-0.46.2

build(deps): bump wheel from 0.45.1 to 0.46.2 in /regression-tests.auth-py

Merge pull request #16761 from PowerDNS/dependabot/pip/pdns/recursordist/docs/wheel-0.46.2

build(deps): bump wheel from 0.45.1 to 0.46.2 in /pdns/recursordist/docs

Merge pull request #16762 from PowerDNS/dependabot/pip/pdns/dnsdistdist/docs/wheel-0.46.2

build(deps): bump wheel from 0.45.1 to 0.46.2 in /pdns/dnsdistdist/docs

dnsdist: Use separate sampling counters for queries and responses

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Add a regression test for dynamic blocks with sampling enabled

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Add a dynamic block unit test with sampling enabled

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Add a unit test for ring buffers sampling

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Reduce contention around the sampling counter in the rings

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Clean up the types used by the Dynamic Block code

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Adjust for sampling rate in rings' consumers

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Add dependabot problem matchers

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

dnsdist: Add response code to TCP responses in structured logging

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Fix XSK flag being reversed in structured logging

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Fix possible use-after-free in structured logging

SL keeps a reference to objects passed to it until it decides to
actually generate the log content, so we should not pass temporaries to
it.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Naive sampling in the ring buffers

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Merge pull request #16763 from rgacogne/ddist-yml-example-packages

dnsdist: Handle the new YAML example configuration file in our packages

build(deps): bump wheel from 0.45.1 to 0.46.2 in /pdns/recursordist/docs

Bumps [wheel](https://github.com/pypa/wheel) from 0.45.1 to 0.46.2.
- [Release notes](https://github.com/pypa/wheel/releases)
- [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst)
- [Commits](https://github.com/pypa/wheel/compare/0.45.1...0.46.2)

---
updated-dependencies:
- dependency-name: wheel
  dependency-version: 0.46.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump wheel from 0.45.1 to 0.46.2 in /pdns/dnsdistdist/docs

Bumps [wheel](https://github.com/pypa/wheel) from 0.45.1 to 0.46.2.
- [Release notes](https://github.com/pypa/wheel/releases)
- [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst)
- [Commits](https://github.com/pypa/wheel/compare/0.45.1...0.46.2)

---
updated-dependencies:
- dependency-name: wheel
  dependency-version: 0.46.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump wheel in /regression-tests.dnsdist

Bumps [wheel](https://github.com/pypa/wheel) from 0.45.1 to 0.46.2.
- [Release notes](https://github.com/pypa/wheel/releases)
- [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst)
- [Commits](https://github.com/pypa/wheel/compare/0.45.1...0.46.2)

---
updated-dependencies:
- dependency-name: wheel
  dependency-version: 0.46.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump wheel in /regression-tests.auth-py

Bumps [wheel](https://github.com/pypa/wheel) from 0.45.1 to 0.46.2.
- [Release notes](https://github.com/pypa/wheel/releases)
- [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst)
- [Commits](https://github.com/pypa/wheel/compare/0.45.1...0.46.2)

---
updated-dependencies:
- dependency-name: wheel
  dependency-version: 0.46.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump wheel from 0.45.1 to 0.46.2 in /regression-tests.api

Bumps [wheel](https://github.com/pypa/wheel) from 0.45.1 to 0.46.2.
- [Release notes](https://github.com/pypa/wheel/releases)
- [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst)
- [Commits](https://github.com/pypa/wheel/compare/0.45.1...0.46.2)

---
updated-dependencies:
- dependency-name: wheel
  dependency-version: 0.46.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump wheel in /regression-tests.ixfrdist

Bumps [wheel](https://github.com/pypa/wheel) from 0.45.1 to 0.46.2.
- [Release notes](https://github.com/pypa/wheel/releases)
- [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst)
- [Commits](https://github.com/pypa/wheel/compare/0.45.1...0.46.2)

---
updated-dependencies:
- dependency-name: wheel
  dependency-version: 0.46.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #16764 from romeroalx/fix-py-pacakging-version

requirements.txt: update package dependencies

requirements.txt: update package dependencies

dnsdist: Handle the new YAML example configuration file in our packages

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

Fix rebase conflict and a case where we don't have a Lua config at all

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Test with reloading forward and TLS config

Also add verify failed test

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Refactor tests to use available recControl() method

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Refactor common part

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

rec: handle applicable dynamic parts of YAML only config when reloading Lua config

Fixes #16673

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Merge pull request #16753 from miodvallat/ecl

auth: stricter TTL enforcement for RRset updates

Merge pull request #16754 from omoerbeek/rec-api-test-meson

rec: api tests: change default location of rec to be in the default meson build dir

Merge pull request #16727 from omoerbeek/rec-ottrace-rest

rec: add REST interface for manipulating Open Telemetry Trace Conditions

rec: api tests: change default location of rec to be in the default meson build dir

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Better words on docs

Co-authored-by: Miod Vallat <miod.vallat@powerdns.com>
Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

Revert default location of recursur, will move to a separate PR

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>