--- /dev/null
+<html><head><title>ChangeLog for asterisk-21.12.0-rc1</title></head><body>
+<h2>Change Log for Release asterisk-21.12.0-rc1</h2>
+<h3>Links:</h3>
+<ul>
+<li><a href="https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-21.12.0-rc1.html">Full ChangeLog</a> </li>
+<li><a href="https://github.com/asterisk/asterisk/compare/21.11.0...21.12.0-rc1">GitHub Diff</a> </li>
+<li><a href="https://downloads.asterisk.org/pub/telephony/asterisk/asterisk-21.12.0-rc1.tar.gz">Tarball</a> </li>
+<li><a href="https://downloads.asterisk.org/pub/telephony/asterisk">Downloads</a> </li>
+</ul>
+<h3>Summary:</h3>
+<ul>
+<li>Commits: 19</li>
+<li>Commit Authors: 10</li>
+<li>Issues Resolved: 12</li>
+<li>Security Advisories Resolved: 0</li>
+</ul>
+<h3>User Notes:</h3>
+<ul>
+<li>
+<h4>func_hangupcause.c: Add access to Reason headers via HANGUPCAUSE()</h4>
+<p>Added a new option to HANGUPCAUSE to access additional
+ information about hangup reason. Reason headers from pjsip
+ could be read using 'tech_extended' cause type.</p>
+</li>
+<li>
+<h4>chan_dahdi: Add DAHDI_CHANNEL function.</h4>
+<p>The DAHDI_CHANNEL function allows for getting/setting
+ certain properties about DAHDI channels from the dialplan.</p>
+</li>
+</ul>
+<h3>Upgrade Notes:</h3>
+<ul>
+<li>
+<h4>res_audiosocket: add message types for all slin sample rates</h4>
+ New audiosocket message types 0x11 - 0x18 has been added
+ for slin12, slin16, slin24, slin32, slin44, slin48, slin96, and
+ slin192 audio. External applications using audiosocket may need to be
+ updated to support these message types if the audiosocket channel is
+ created with one of these audio formats.</li>
+</ul>
+<h3>Developer Notes:</h3>
+<h3>Commit Authors:</h3>
+<ul>
+<li>Bastian Triller: (1)</li>
+<li>Ben Ford: (1)</li>
+<li>George Joseph: (3)</li>
+<li>Igor Goncharovsky: (1)</li>
+<li>Max Grobecker: (1)</li>
+<li>Nathan Monfils: (1)</li>
+<li>Naveen Albert: (4)</li>
+<li>Phoneben: (1)</li>
+<li>Sean Bright: (3)</li>
+<li>Sven Kube: (3)</li>
+</ul>
+<h2>Issue and Commit Detail:</h2>
+<h3>Closed Issues:</h3>
+<ul>
+<li>1340: [bug]: comfort noise packet corrupted</li>
+<li>1419: [bug]: static code analysis issues in app_adsiprog.c</li>
+<li>1422: [bug]: static code analysis issues in apps/app_externalivr.c</li>
+<li>1425: [bug]: static code analysis issues in apps/app_queue.c</li>
+<li>1434: [improvement]: pbx_variables: Create real channel for dialplan eval CLI command</li>
+<li>1436: [improvement]: res_cliexec: Avoid unnecessary cast to char*</li>
+<li>1455: [new-feature]: chan_dahdi: Add DAHDI_CHANNEL function</li>
+<li>1467: [bug]: Crash in res_pjsip_refer during REFER progress teardown with PJSIP_TRANSFER_HANDLING(ari-only)</li>
+<li>1491: [bug]: Segfault: <code>channelstorage_cpp</code> fast lookup without lock (<code>get_by_name_exact</code>/<code>get_by_uniqueid</code>) leads to UAF during hangup</li>
+<li>1525: [bug]: chan_websocket: fix use of raw payload variable for string comparison in process_text_message</li>
+<li>1539: [bug]: safe_asterisk without TTY doesn't log to file</li>
+<li>1554: [bug]: safe_asterisk recurses into subdirectories of startup.d after f97361</li>
+</ul>
+<h3>Commits By Author:</h3>
+<ul>
+<li>
+<h4>Bastian Triller (1):</h4>
+</li>
+<li>
+<p>Fix some doxygen, typos and whitespace</p>
+</li>
+<li>
+<h4>Ben Ford (1):</h4>
+</li>
+<li>
+<p>rtp_engine.c: Add exception for comfort noise payload.</p>
+</li>
+<li>
+<h4>George Joseph (3):</h4>
+</li>
+<li>channelstorage_cpp_map_name_id: Add read locking around retrievals.</li>
+<li>chan_websocket.c: Change payload references to command instead.</li>
+<li>
+<p>safe_asterisk: Fix logging and sorting issue.</p>
+</li>
+<li>
+<h4>Igor Goncharovsky (1):</h4>
+</li>
+<li>
+<p>func_hangupcause.c: Add access to Reason headers via HANGUPCAUSE()</p>
+</li>
+<li>
+<h4>Max Grobecker (1):</h4>
+</li>
+<li>
+<p>res_pjsip_geolocation: Add support for Geolocation loc-src parameter</p>
+</li>
+<li>
+<h4>Nathan Monfils (1):</h4>
+</li>
+<li>
+<p>manager.c: Fix presencestate object leak</p>
+</li>
+<li>
+<h4>Naveen Albert (4):</h4>
+</li>
+<li>pbx_variables.c: Create real channel for "dialplan eval function".</li>
+<li>res_cliexec: Remove unnecessary casts to char*.</li>
+<li>app_adsiprog: Fix possible NULL dereference.</li>
+<li>
+<p>chan_dahdi: Add DAHDI_CHANNEL function.</p>
+</li>
+<li>
+<h4>Sean Bright (3):</h4>
+</li>
+<li>audiohook.c: Ensure correct AO2 reference is dereffed.</li>
+<li>app_externalivr: Prevent out-of-bounds read during argument processing.</li>
+<li>
+<p>safe_asterisk: Resolve a POSIX sh problem and restore globbing behavior.</p>
+</li>
+<li>
+<h4>Sven Kube (3):</h4>
+</li>
+<li>stasis_channels.c: Add null check for referred_by in ast_ari_transfer_message_..</li>
+<li>stasis_channels.c: Make protocol_id optional to enable blind transfer via ari</li>
+<li>
+<p>res_audiosocket: add message types for all slin sample rates</p>
+</li>
+<li>
+<h4>phoneben (1):</h4>
+</li>
+<li>app_queue: Add NULL pointer checks in app_queue</li>
+</ul>
+<h3>Commit List:</h3>
+<ul>
+<li>safe_asterisk: Resolve a POSIX sh problem and restore globbing behavior.</li>
+<li>safe_asterisk: Fix logging and sorting issue.</li>
+<li>res_audiosocket: add message types for all slin sample rates</li>
+<li>chan_websocket.c: Change payload references to command instead.</li>
+<li>func_hangupcause.c: Add access to Reason headers via HANGUPCAUSE()</li>
+<li>channelstorage_cpp_map_name_id: Add read locking around retrievals.</li>
+<li>res_pjsip_geolocation: Add support for Geolocation loc-src parameter</li>
+<li>stasis_channels.c: Make protocol_id optional to enable blind transfer via ari</li>
+<li>Fix some doxygen, typos and whitespace</li>
+<li>app_queue: Add NULL pointer checks in app_queue</li>
+<li>app_externalivr: Prevent out-of-bounds read during argument processing.</li>
+<li>chan_dahdi: Add DAHDI_CHANNEL function.</li>
+<li>app_adsiprog: Fix possible NULL dereference.</li>
+<li>manager.c: Fix presencestate object leak</li>
+<li>audiohook.c: Ensure correct AO2 reference is dereffed.</li>
+<li>res_cliexec: Remove unnecessary casts to char*.</li>
+<li>rtp_engine.c: Add exception for comfort noise payload.</li>
+<li>pbx_variables.c: Create real channel for "dialplan eval function".</li>
+</ul>
+<h3>Commit Details:</h3>
+<h4>safe_asterisk: Resolve a POSIX sh problem and restore globbing behavior.</h4>
+<p>Author: Sean Bright
+ Date: 2025-10-22</p>
+<ul>
+<li>Using <code>==</code> with the POSIX sh <code>test</code> utility is UB.</li>
+<li>Switch back to using globs instead of using <code>$(find … | sort)</code>.</li>
+<li>Fix a missing redirect when checking for the OS type.</li>
+</ul>
+<p>Resolves: #1554</p>
+<h4>safe_asterisk: Fix logging and sorting issue.</h4>
+<p>Author: George Joseph
+ Date: 2025-10-17</p>
+<p>Re-enabled "TTY=9" which was erroneously disabled as part of a recent
+ security fix and removed another logging "fix" that was added.</p>
+<p>Also added a sort to the "find" that enumerates the scripts to be sourced so
+ they're sourced in the correct order.</p>
+<p>Resolves: #1539</p>
+<h4>res_audiosocket: add message types for all slin sample rates</h4>
+<p>Author: Sven Kube
+ Date: 2025-10-10</p>
+<p>Extend audiosocket messages with types 0x11 - 0x18 to create asterisk
+ frames in slin12, slin16, slin24, slin32, slin44, slin48, slin96, and
+ slin192 format, enabling the transmission of audio at a higher sample
+ rates. For audiosocket messages sent by Asterisk, the message kind is
+ determined by the format of the originating asterisk frame.</p>
+<p>UpgradeNote: New audiosocket message types 0x11 - 0x18 has been added
+ for slin12, slin16, slin24, slin32, slin44, slin48, slin96, and
+ slin192 audio. External applications using audiosocket may need to be
+ updated to support these message types if the audiosocket channel is
+ created with one of these audio formats.</p>
+<h4>chan_websocket.c: Change payload references to command instead.</h4>
+<p>Author: George Joseph
+ Date: 2025-10-08</p>
+<p>Some of the tests in process_text_message() were still comparing to the
+ websocket message payload instead of the "command" string.</p>
+<p>Resolves: #1525</p>
+<h4>func_hangupcause.c: Add access to Reason headers via HANGUPCAUSE()</h4>
+<p>Author: Igor Goncharovsky
+ Date: 2025-09-04</p>
+<p>As soon as SIP call may end with several Reason headers, we
+ want to make all of them available through the HAGUPCAUSE() function.
+ This implementation uses the same ao2 hash for cause codes storage
+ and adds a flag to make difference between last processed sip
+ message and content of reason headers.</p>
+<p>UserNote: Added a new option to HANGUPCAUSE to access additional
+ information about hangup reason. Reason headers from pjsip
+ could be read using 'tech_extended' cause type.</p>
+<h4>channelstorage_cpp_map_name_id: Add read locking around retrievals.</h4>
+<p>Author: George Joseph
+ Date: 2025-10-01</p>
+<p>When we retrieve a channel from a C++ map, we actually get back a wrapper
+ object that points to the channel then right after we retrieve it, we bump its
+ reference count. There's a tiny chance however that between those two
+ statements a delete and/or unref might happen which would cause the wrapper
+ object or the channel itself to become invalid resulting in a SEGV. To avoid
+ this we now perform a read lock on the driver around those statements.</p>
+<p>Resolves: #1491</p>
+<h4>res_pjsip_geolocation: Add support for Geolocation loc-src parameter</h4>
+<p>Author: Max Grobecker
+ Date: 2025-09-21</p>
+<p>This adds support for the Geolocation 'loc-src' parameter to res_pjsip_geolocation.
+ The already existing config option 'location_source` in res_geolocation is documented to add a 'loc-src' parameter containing a user-defined FQDN to the 'Geolocation:' header,
+ but that option had no effect as it was not implemented by res_pjsip_geolocation.</p>
+<p>If the <code>location_source</code> configuration option is not set or invalid, that parameter will not be added (this is already checked by res_geolocation).</p>
+<p>This commits adds already documented functionality.</p>
+<h4>stasis_channels.c: Make protocol_id optional to enable blind transfer via ari</h4>
+<p>Author: Sven Kube
+ Date: 2025-09-22</p>
+<p>When handling SIP transfers via ARI, there is no protocol_id in case of
+ a blind transfer.</p>
+<p>Resolves: #1467</p>
+<h4>Fix some doxygen, typos and whitespace</h4>
+<p>Author: Bastian Triller
+ Date: 2025-09-21</p>
+<h4>stasis_channels.c: Add null check for referred_by in ast_ari_transfer_message_..</h4>
+<p>Author: Sven Kube
+ Date: 2025-09-18</p>
+<p>When handling SIP transfers via ARI, the <code>referred_by</code> field in
+ <code>transfer_ari_state</code> may be null, since SIP REFER requests are not
+ required to include a <code>Referred-By</code> header. Without this check, a null
+ value caused the transfer to fail and triggered a NOTIFY with a 500
+ Internal Server Error.</p>
+<h4>app_queue: Add NULL pointer checks in app_queue</h4>
+<p>Author: phoneben
+ Date: 2025-09-11</p>
+<p>Add NULL check for word_list before calling word_in_list()
+ Add NULL checks for channel snapshots from ast_multi_channel_blob_get_channel()</p>
+<p>Resolves: #1425</p>
+<h4>app_externalivr: Prevent out-of-bounds read during argument processing.</h4>
+<p>Author: Sean Bright
+ Date: 2025-09-17</p>
+<p>Resolves: #1422</p>
+<h4>chan_dahdi: Add DAHDI_CHANNEL function.</h4>
+<p>Author: Naveen Albert
+ Date: 2025-09-11</p>
+<p>Add a dialplan function that can be used to get/set properties of
+ DAHDI channels (as opposed to Asterisk channels). This exposes
+ properties that were not previously available, allowing for certain
+ operations to now be performed in the dialplan.</p>
+<p>Resolves: #1455</p>
+<p>UserNote: The DAHDI_CHANNEL function allows for getting/setting
+ certain properties about DAHDI channels from the dialplan.</p>
+<h4>app_adsiprog: Fix possible NULL dereference.</h4>
+<p>Author: Naveen Albert
+ Date: 2025-09-10</p>
+<p>get_token can return NULL, but process_token uses this result without
+ checking for NULL; as elsewhere, check for a NULL result to avoid
+ possible NULL dereference.</p>
+<p>Resolves: #1419</p>
+<h4>manager.c: Fix presencestate object leak</h4>
+<p>Author: Nathan Monfils
+ Date: 2025-09-08</p>
+<p>ast_presence_state allocates subtype and message. We straightforwardly
+ need to clean those up.</p>
+<h4>audiohook.c: Ensure correct AO2 reference is dereffed.</h4>
+<p>Author: Sean Bright
+ Date: 2025-09-10</p>
+<p>Part of #1440.</p>
+<h4>res_cliexec: Remove unnecessary casts to char*.</h4>
+<p>Author: Naveen Albert
+ Date: 2025-09-09</p>
+<p>Resolves: #1436</p>
+<h4>rtp_engine.c: Add exception for comfort noise payload.</h4>
+<p>Author: Ben Ford
+ Date: 2025-09-09</p>
+<p>In a previous commit, a change was made to
+ ast_rtp_codecs_payload_code_tx_sample_rate to check for differing sample
+ rates. This ended up returning an invalid payload int for comfort noise.
+ A check has been added that returns early if the payload is in fact
+ supposed to be comfort noise.</p>
+<p>Fixes: #1340</p>
+<h4>pbx_variables.c: Create real channel for "dialplan eval function".</h4>
+<p>Author: Naveen Albert
+ Date: 2025-09-09</p>
+<p>"dialplan eval function" has been using a dummy channel for function
+ evaluation, much like many of the unit tests. However, sometimes, this
+ can cause issues for functions that are not expecting dummy channels.
+ As an example, ast_channel_tech(chan) is NULL on such channels, and
+ ast_channel_tech(chan)->type consequently results in a NULL dereference.
+ Normally, functions do not worry about this since channels executing
+ dialplan aren't dummy channels.</p>
+<p>While some functions are better about checking for these sorts of edge
+ cases, use a real channel with a dummy technology to make this CLI
+ command inherently safe for any dialplan function that could be evaluated
+ from the CLI.</p>
+<p>Resolves: #1434</p>
+</body></html>
--- /dev/null
+
+## Change Log for Release asterisk-21.12.0-rc1
+
+### Links:
+
+ - [Full ChangeLog](https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-21.12.0-rc1.html)
+ - [GitHub Diff](https://github.com/asterisk/asterisk/compare/21.11.0...21.12.0-rc1)
+ - [Tarball](https://downloads.asterisk.org/pub/telephony/asterisk/asterisk-21.12.0-rc1.tar.gz)
+ - [Downloads](https://downloads.asterisk.org/pub/telephony/asterisk)
+
+### Summary:
+
+- Commits: 19
+- Commit Authors: 10
+- Issues Resolved: 12
+- Security Advisories Resolved: 0
+
+### User Notes:
+
+- #### func_hangupcause.c: Add access to Reason headers via HANGUPCAUSE()
+ Added a new option to HANGUPCAUSE to access additional
+ information about hangup reason. Reason headers from pjsip
+ could be read using 'tech_extended' cause type.
+
+- #### chan_dahdi: Add DAHDI_CHANNEL function.
+ The DAHDI_CHANNEL function allows for getting/setting
+ certain properties about DAHDI channels from the dialplan.
+
+
+### Upgrade Notes:
+
+- #### res_audiosocket: add message types for all slin sample rates
+ New audiosocket message types 0x11 - 0x18 has been added
+ for slin12, slin16, slin24, slin32, slin44, slin48, slin96, and
+ slin192 audio. External applications using audiosocket may need to be
+ updated to support these message types if the audiosocket channel is
+ created with one of these audio formats.
+
+
+### Developer Notes:
+
+
+### Commit Authors:
+
+- Bastian Triller: (1)
+- Ben Ford: (1)
+- George Joseph: (3)
+- Igor Goncharovsky: (1)
+- Max Grobecker: (1)
+- Nathan Monfils: (1)
+- Naveen Albert: (4)
+- Phoneben: (1)
+- Sean Bright: (3)
+- Sven Kube: (3)
+
+## Issue and Commit Detail:
+
+### Closed Issues:
+
+ - 1340: [bug]: comfort noise packet corrupted
+ - 1419: [bug]: static code analysis issues in app_adsiprog.c
+ - 1422: [bug]: static code analysis issues in apps/app_externalivr.c
+ - 1425: [bug]: static code analysis issues in apps/app_queue.c
+ - 1434: [improvement]: pbx_variables: Create real channel for dialplan eval CLI command
+ - 1436: [improvement]: res_cliexec: Avoid unnecessary cast to char*
+ - 1455: [new-feature]: chan_dahdi: Add DAHDI_CHANNEL function
+ - 1467: [bug]: Crash in res_pjsip_refer during REFER progress teardown with PJSIP_TRANSFER_HANDLING(ari-only)
+ - 1491: [bug]: Segfault: `channelstorage_cpp` fast lookup without lock (`get_by_name_exact`/`get_by_uniqueid`) leads to UAF during hangup
+ - 1525: [bug]: chan_websocket: fix use of raw payload variable for string comparison in process_text_message
+ - 1539: [bug]: safe_asterisk without TTY doesn't log to file
+ - 1554: [bug]: safe_asterisk recurses into subdirectories of startup.d after f97361
+
+### Commits By Author:
+
+- #### Bastian Triller (1):
+ - Fix some doxygen, typos and whitespace
+
+- #### Ben Ford (1):
+ - rtp_engine.c: Add exception for comfort noise payload.
+
+- #### George Joseph (3):
+ - channelstorage_cpp_map_name_id: Add read locking around retrievals.
+ - chan_websocket.c: Change payload references to command instead.
+ - safe_asterisk: Fix logging and sorting issue.
+
+- #### Igor Goncharovsky (1):
+ - func_hangupcause.c: Add access to Reason headers via HANGUPCAUSE()
+
+- #### Max Grobecker (1):
+ - res_pjsip_geolocation: Add support for Geolocation loc-src parameter
+
+- #### Nathan Monfils (1):
+ - manager.c: Fix presencestate object leak
+
+- #### Naveen Albert (4):
+ - pbx_variables.c: Create real channel for "dialplan eval function".
+ - res_cliexec: Remove unnecessary casts to char*.
+ - app_adsiprog: Fix possible NULL dereference.
+ - chan_dahdi: Add DAHDI_CHANNEL function.
+
+- #### Sean Bright (3):
+ - audiohook.c: Ensure correct AO2 reference is dereffed.
+ - app_externalivr: Prevent out-of-bounds read during argument processing.
+ - safe_asterisk: Resolve a POSIX sh problem and restore globbing behavior.
+
+- #### Sven Kube (3):
+ - stasis_channels.c: Add null check for referred_by in ast_ari_transfer_message_..
+ - stasis_channels.c: Make protocol_id optional to enable blind transfer via ari
+ - res_audiosocket: add message types for all slin sample rates
+
+- #### phoneben (1):
+ - app_queue: Add NULL pointer checks in app_queue
+
+
+### Commit List:
+
+- safe_asterisk: Resolve a POSIX sh problem and restore globbing behavior.
+- safe_asterisk: Fix logging and sorting issue.
+- res_audiosocket: add message types for all slin sample rates
+- chan_websocket.c: Change payload references to command instead.
+- func_hangupcause.c: Add access to Reason headers via HANGUPCAUSE()
+- channelstorage_cpp_map_name_id: Add read locking around retrievals.
+- res_pjsip_geolocation: Add support for Geolocation loc-src parameter
+- stasis_channels.c: Make protocol_id optional to enable blind transfer via ari
+- Fix some doxygen, typos and whitespace
+- app_queue: Add NULL pointer checks in app_queue
+- app_externalivr: Prevent out-of-bounds read during argument processing.
+- chan_dahdi: Add DAHDI_CHANNEL function.
+- app_adsiprog: Fix possible NULL dereference.
+- manager.c: Fix presencestate object leak
+- audiohook.c: Ensure correct AO2 reference is dereffed.
+- res_cliexec: Remove unnecessary casts to char*.
+- rtp_engine.c: Add exception for comfort noise payload.
+- pbx_variables.c: Create real channel for "dialplan eval function".
+
+### Commit Details:
+
+#### safe_asterisk: Resolve a POSIX sh problem and restore globbing behavior.
+ Author: Sean Bright
+ Date: 2025-10-22
+
+ * Using `==` with the POSIX sh `test` utility is UB.
+ * Switch back to using globs instead of using `$(find … | sort)`.
+ * Fix a missing redirect when checking for the OS type.
+
+ Resolves: #1554
+
+#### safe_asterisk: Fix logging and sorting issue.
+ Author: George Joseph
+ Date: 2025-10-17
+
+ Re-enabled "TTY=9" which was erroneously disabled as part of a recent
+ security fix and removed another logging "fix" that was added.
+
+ Also added a sort to the "find" that enumerates the scripts to be sourced so
+ they're sourced in the correct order.
+
+ Resolves: #1539
+
+#### res_audiosocket: add message types for all slin sample rates
+ Author: Sven Kube
+ Date: 2025-10-10
+
+ Extend audiosocket messages with types 0x11 - 0x18 to create asterisk
+ frames in slin12, slin16, slin24, slin32, slin44, slin48, slin96, and
+ slin192 format, enabling the transmission of audio at a higher sample
+ rates. For audiosocket messages sent by Asterisk, the message kind is
+ determined by the format of the originating asterisk frame.
+
+ UpgradeNote: New audiosocket message types 0x11 - 0x18 has been added
+ for slin12, slin16, slin24, slin32, slin44, slin48, slin96, and
+ slin192 audio. External applications using audiosocket may need to be
+ updated to support these message types if the audiosocket channel is
+ created with one of these audio formats.
+
+#### chan_websocket.c: Change payload references to command instead.
+ Author: George Joseph
+ Date: 2025-10-08
+
+ Some of the tests in process_text_message() were still comparing to the
+ websocket message payload instead of the "command" string.
+
+ Resolves: #1525
+
+#### func_hangupcause.c: Add access to Reason headers via HANGUPCAUSE()
+ Author: Igor Goncharovsky
+ Date: 2025-09-04
+
+ As soon as SIP call may end with several Reason headers, we
+ want to make all of them available through the HAGUPCAUSE() function.
+ This implementation uses the same ao2 hash for cause codes storage
+ and adds a flag to make difference between last processed sip
+ message and content of reason headers.
+
+ UserNote: Added a new option to HANGUPCAUSE to access additional
+ information about hangup reason. Reason headers from pjsip
+ could be read using 'tech_extended' cause type.
+
+#### channelstorage_cpp_map_name_id: Add read locking around retrievals.
+ Author: George Joseph
+ Date: 2025-10-01
+
+ When we retrieve a channel from a C++ map, we actually get back a wrapper
+ object that points to the channel then right after we retrieve it, we bump its
+ reference count. There's a tiny chance however that between those two
+ statements a delete and/or unref might happen which would cause the wrapper
+ object or the channel itself to become invalid resulting in a SEGV. To avoid
+ this we now perform a read lock on the driver around those statements.
+
+ Resolves: #1491
+
+#### res_pjsip_geolocation: Add support for Geolocation loc-src parameter
+ Author: Max Grobecker
+ Date: 2025-09-21
+
+ This adds support for the Geolocation 'loc-src' parameter to res_pjsip_geolocation.
+ The already existing config option 'location_source` in res_geolocation is documented to add a 'loc-src' parameter containing a user-defined FQDN to the 'Geolocation:' header,
+ but that option had no effect as it was not implemented by res_pjsip_geolocation.
+
+ If the `location_source` configuration option is not set or invalid, that parameter will not be added (this is already checked by res_geolocation).
+
+ This commits adds already documented functionality.
+
+#### stasis_channels.c: Make protocol_id optional to enable blind transfer via ari
+ Author: Sven Kube
+ Date: 2025-09-22
+
+ When handling SIP transfers via ARI, there is no protocol_id in case of
+ a blind transfer.
+
+ Resolves: #1467
+
+#### Fix some doxygen, typos and whitespace
+ Author: Bastian Triller
+ Date: 2025-09-21
+
+
+#### stasis_channels.c: Add null check for referred_by in ast_ari_transfer_message_..
+ Author: Sven Kube
+ Date: 2025-09-18
+
+ When handling SIP transfers via ARI, the `referred_by` field in
+ `transfer_ari_state` may be null, since SIP REFER requests are not
+ required to include a `Referred-By` header. Without this check, a null
+ value caused the transfer to fail and triggered a NOTIFY with a 500
+ Internal Server Error.
+
+#### app_queue: Add NULL pointer checks in app_queue
+ Author: phoneben
+ Date: 2025-09-11
+
+ Add NULL check for word_list before calling word_in_list()
+ Add NULL checks for channel snapshots from ast_multi_channel_blob_get_channel()
+
+ Resolves: #1425
+
+#### app_externalivr: Prevent out-of-bounds read during argument processing.
+ Author: Sean Bright
+ Date: 2025-09-17
+
+ Resolves: #1422
+
+#### chan_dahdi: Add DAHDI_CHANNEL function.
+ Author: Naveen Albert
+ Date: 2025-09-11
+
+ Add a dialplan function that can be used to get/set properties of
+ DAHDI channels (as opposed to Asterisk channels). This exposes
+ properties that were not previously available, allowing for certain
+ operations to now be performed in the dialplan.
+
+ Resolves: #1455
+
+ UserNote: The DAHDI_CHANNEL function allows for getting/setting
+ certain properties about DAHDI channels from the dialplan.
+
+#### app_adsiprog: Fix possible NULL dereference.
+ Author: Naveen Albert
+ Date: 2025-09-10
+
+ get_token can return NULL, but process_token uses this result without
+ checking for NULL; as elsewhere, check for a NULL result to avoid
+ possible NULL dereference.
+
+ Resolves: #1419
+
+#### manager.c: Fix presencestate object leak
+ Author: Nathan Monfils
+ Date: 2025-09-08
+
+ ast_presence_state allocates subtype and message. We straightforwardly
+ need to clean those up.
+
+#### audiohook.c: Ensure correct AO2 reference is dereffed.
+ Author: Sean Bright
+ Date: 2025-09-10
+
+ Part of #1440.
+
+#### res_cliexec: Remove unnecessary casts to char*.
+ Author: Naveen Albert
+ Date: 2025-09-09
+
+ Resolves: #1436
+
+#### rtp_engine.c: Add exception for comfort noise payload.
+ Author: Ben Ford
+ Date: 2025-09-09
+
+ In a previous commit, a change was made to
+ ast_rtp_codecs_payload_code_tx_sample_rate to check for differing sample
+ rates. This ended up returning an invalid payload int for comfort noise.
+ A check has been added that returns early if the payload is in fact
+ supposed to be comfort noise.
+
+ Fixes: #1340
+
+#### pbx_variables.c: Create real channel for "dialplan eval function".
+ Author: Naveen Albert
+ Date: 2025-09-09
+
+ "dialplan eval function" has been using a dummy channel for function
+ evaluation, much like many of the unit tests. However, sometimes, this
+ can cause issues for functions that are not expecting dummy channels.
+ As an example, ast_channel_tech(chan) is NULL on such channels, and
+ ast_channel_tech(chan)->type consequently results in a NULL dereference.
+ Normally, functions do not worry about this since channels executing
+ dialplan aren't dummy channels.
+
+ While some functions are better about checking for these sorts of edge
+ cases, use a real channel with a dummy technology to make this CLI
+ command inherently safe for any dialplan function that could be evaluated
+ from the CLI.
+
+ Resolves: #1434
+