Merge tag 'v9.18.25' into bind-9.18

diff --cc CHANGES
index 9173f7c9a65da4b7ef1fe161d709fb349d9122f2,4ef20e9e330b6aaf71c85875e585d4fcee2f8bce..106c29de6b2154da5b95f0c637cf752cb120e9ed
--- 1/CHANGES
--- 2/CHANGES
+++ b/CHANGES
@@@ -1,74 -1,20 +1,78 @@@
- 6356. [bug]           Attach the loop also in the dns_cache_flush(), so
-                       the cache pruning still works after the flush.
-                       [GL #4621]
- 
- 6353. [bug]           Improve the TTL-based cleaning by removing the expired
-                       headers from the heap, so they don't block the next
-                       cleaning round and clean more than a single item for
-                       each new addition to the RBTDB. [GL #4591]
- 
- 6352. [bug]           Revert change 6319 and decrease lock contention during
-                       RBTDB tree pruning by not cleaning up nodes recursively
-                       within a single prune_tree() call. [GL #4596]
- 
 +6363. [bug]           dig/mdig +ednsflags=<non-zero-value> did not re-enable
 +                      EDNS if it had been disabled. [GL #4641]
 +
 +6361. [bug]           Some invalid ISO 8601 durations were accepted
 +                      erroneously. [GL #4624]
 +
 +6360. [bug]           Don't return static-stub synthesised NS RRset.
 +                      [GL #4608]
 +
 +6359. [bug]           Fix bug in Depends (keymgr_dep) function. [GL #4552]
 +
 +6351. [protocol]      Support for the RESINFO record type has been added.
 +                      [GL #4413]
 +
 +6346. [bug]           Cleaned up several minor bugs in the RBTDB dbiterator
 +                      implementation. [GL !8741]
 +
 +6345. [bug]           Added missing dns_rdataset_disassociate calls in
 +                      validator.c:findnsec3proofs. [GL #4571]
 +
 +6340. [test]          Fix incorrectly reported errors when running tests
 +                      with `make test` on platforms with older pytest.
 +                      [GL #4560]
 +
 +6338. [func]          Optimize slabheader placement, so the infrastructure
 +                      records are put in the beginning of the slabheader
 +                      linked list. [GL !8675]
 +
 +6334. [doc]           Improve ARM parental-agents definition. [GL #4531]
 +
 +6333. [bug]           Fix the DNS_GETDB_STALEFIRST flag, which was defined
 +                      incorrectly in lib/ns/query.c. [GL !8683]
 +
 +6330. [doc]           Update ZSK minimum lifetime documentation in ARM, also
 +                      depends on signing delay. [GL #4510]
 +
 +6328. [func]          Add workaround to enforce dynamic linker to pull
 +                      jemalloc earlier than libc to ensure all memory
 +                      allocations are done via jemalloc. [GL #4404]
 +
 +6326. [bug]           Changes to "listen-on" statements were ignored on
 +                      reconfiguration unless the port or interface address was
 +                      changed, making it impossible to change a related
 +                      listener transport type. Thanks to Thomas Amgarten.
 +                      [GL #4518] [GL #4528]
 +
 +6325. [func]          Expose the TCP client count in statistics channel.
 +                      [GL #4425]
 +
 +6324. [bug]           Fix a possible crash in 'dig +nssearch +nofail' and
 +                      'host -C' commands when one of the name servers returns
 +                      SERVFAIL. [GL #4508]
 +
 +6313. [bug]           When dnssec-policy is in effect the DNSKEY's TTLs in
 +                      the zone where not being updated to match the policy.
 +                      This lead to failures when DNSKEYs where updated as the
 +                      TTLs mismatched. [GL #4466]
 +
+       --- 9.18.25 released ---
+ 
+ 6356. [bug]           Create the pruning task in the dns_cache_flush(), so
+                       the cache pruning still works after the flush.
+                       [GL #4621]
+ 
+ 6353. [bug]           Improve the TTL-based cleaning by removing the expired
+                       headers from the heap, so they don't block the next
+                       cleaning round and clean more than a single item for
+                       each new addition to the RBTDB. [GL #4591]
+ 
+ 6352. [bug]           Revert change 6319 and decrease lock contention during
+                       RBTDB tree pruning by not cleaning up nodes recursively
+                       within a single prune_tree() call. [GL #4596]
+ 
+ 6350. [bug]           Address use after free in expire_lru_headers. [GL #4495]
+ 
        --- 9.18.24 released ---
  
  6343. [bug]           Fix case insensitive setting for isc_ht hashtable.

diff --cc doc/arm/notes.rst
index 578a5aada5ee0fc16b85932edd2276e2cf38841e,48921f9588febf0930fdd3f13d21c3cb9b718944..da9e4d337e5d3bfbc051317901ade36a9d12ecff
--- 1/doc/arm/notes.rst
--- 2/doc/arm/notes.rst
+++ b/doc/arm/notes.rst
@@@ -35,7 -35,7 +35,8 @@@ information about each release, and sou
  
  .. include:: ../notes/notes-known-issues.rst
  
 +.. include:: ../notes/notes-current.rst
+ .. include:: ../notes/notes-9.18.25.rst
  .. include:: ../notes/notes-9.18.24.rst
  .. include:: ../notes/notes-9.18.23.rst
  .. include:: ../notes/notes-9.18.22.rst

diff --cc lib/dns/rbtdb.c
Simple merge