# Stork 2.6.0 Release Notes, October 14, 2026

Welcome to Stork 2.6.0, a stable release. The changes and features
introduced since Stork stable release 2.4.0 are:

1. **Lease tracking**: A new mechanism that enables inspection of leases
is available. If enabled, the agents glean lease information from the
lease files of any detected Kea instances and stream that information
to the server. The server then provides a searchable database of all
the leases of all monitored servers. Leases can be sorted, filtered,
and searched. Lease tracking currently supports the memfile backend
only; this is the first stable release of a complex feature. Feedback
is appreciated. The lease list now collects and displays all columns
from the lease memfile instead of showing only a basic subset. Lease
tracking can now be activated for Kea versions older than 3.1.0 when
an absolute memfile path is configured.  Lease updates are no longer
discarded when they contain leases previously received by Stork. Lease
fetching is skipped for inactive or unmonitored daemons, and a crash
caused by closing a monitored daemon's gRPC connection was fixed. Added
support for decoding of relay agent info sub-options in the lease user
context. Fixed a bug where sorting the Lease List table by lease state
would seemingly shuffle the rows randomly. Fixed a bug which caused
the Stork server to ignore certain fields when fetching leases from the
agents. Filtering the Lease List by 'Valid' now only shows valid leases,
instead of incorrectly showing all leases [#2058, #2059, #2447, #2498,
#2523, #2529, #2589, #2641, #2646].

2. **OpenID Connect and external user management**: A new authentication
mechanism is available. If configured, the server, as a Relying
Party, can use external OpenID providers to offload authentication
duties. This allows easy integration with various Single Sign-On
(SSO) solutions. Another major benefit is that external OIDC can be
configured to require multi-factor authentication. This is another
complex feature with many external variables, so feedback and deployment
reports are appreciated. The OIDC support was documented and the login
page was tweaked. The last-used sign-in method is now remembered.
Internal authentication method labels were unified with other methods.
OpenID Connect configuration now supports a unique provider identifier,
and manually configured provider endpoints for services that do not
implement OIDC Discovery. Stork also prevents local group assignment
for external users when group membership is managed by the external
authentication service. All system groups associated with a user are now
displayed. Added links to the OIDC specifications in the OIDC settings
description. Fixed the user filter on the Events page, which showed an
empty entry for users authenticated via OIDC. Displayed authentication
method is now consistent across Stork UI [#2437, #2455, #2457, #2463,
#2465, #2473, #2480, #2485, #2336, #2335, #1957, #2339, #2536, #2538,
#2570, #2628].

3. **Kea Configuration Backend**: As part of a larger initiative to
extend Stork to support the Kea Configuration Backend (CB) mechanism,
Stork was extended in various ways. This release introduces several
framework changes and the ability to add a subnet to CB, if the hook is
loaded. The CB hook was added to the demo and to system tests. The Stork
server now shows the Kea server tag, if it was set. This is useful for
distinguishing between servers if multiple instances share the same CB
database. The CB is complex and it will take several Stork releases to
implement complete CB support. Stork can now create, modify, and delete
subnets stored in the Kea Configuration Backend when the `cb_cmds`
and `subnet_cmds` hook libraries are loaded. Daemons using the same
Configuration Backend database and server tag are grouped in the subnet
form to prevent inconsistent individual configuration. The help text
now explains whether an operation changes the JSON configuration or
the Configuration Backend database. Added some Kea DHCPv6 daemons with
the Config Backend hook loaded to the demo [#2419, #2424, #2416, #2417,
#2474, #2475, #2476, #2527, #2552, #2597].

4. **BIND 9 and zone-transfer monitoring**: This stable release of Stork
introduces Zone Transfer Monitoring. The Stork agent can now retrieve
information about started, completed and failed zone transfers from
multiple BIND9 instances, correlate them and present a unified list of
transfers across all monitored servers. The information can be gleaned
from various sources, such as plain log files, systemd logs, or syslog
logs.  The Stork agent is able to parse BIND 9 logs using different
technologies (systemd log reader, text log file reader ), depending
on the BIND 9 configuration. It detects and collects information
about zone-transfer starts and completions. The Stork agent is able
to understand the directory option in a BIND 9 config file to resolve
relative paths. The XFR monitor was implemented. Stork is now able to
detect BIND 9 zone-transfer logging destinations. Object and parameter
passing is now more flexible. The log tracker is now instantiated
for detected BIND 9 instances. The log tracker for zone transfers
was implemented. We fixed a bug where the Stork agent was failing to
parse the CLI flags when the path to the binary contained the name of
the binary, e.g. /var/lib/named/sbin/named. Stork can now receive zone
transfer events from monitored BIND 9 servers, store them in the Stork
database, and display them in a new user interface view. The transfer
list supports filtering and sorting. Transfer tracking recognizes
started, completed, up-to-date, and failed transfers and collects the
associated transfer statistics. It also marks transfers with unclear
status with the keyword "message", directing the user to the log message
panel for details about the transfer state. Zone transfer timestamps
are now displayed with milliseconds precision in the UI. Zone transfer
monitoring is documented in the Stork ARM. The stork-agent user is
added to the systemd-journal group, so it can read zone transfer logs
in the systemd journal. Fixed two bugs in the BIND 9 configuration
parsing. The first bug precluded the use of address match lists with
a negated embedded match list (ACL). The second bug precluded the use
of wildcard imports.  Both can now be used in BIND 9 configuration and
Stork agent will handle them properly. Fixed displaying uptime for DNS
daemons in dashboard.  Fixed DNS zone transfers tracking using systemd
logs. The Stork agent enforces the use of RFC3339-compliant timestamp
format in the journalctl output that allows for correctly parsing the
timestamps pertaining to the zone transfers. Regular pruning old zone
transfers according to the maximum age configured in the UI. Fixed DNS
Zone Transfers tab links [#2389, #2388, #2460, #2393, #2444, #2387,
#2392, #2391, #2374, #2394, #2395, #2396, #2398, #2557, #2579, #2662,
#2400, #2322, #2626, #2661, #2540, #2627].

5. **Security**: To better cope with the recent increased number of
vulnerabilities being reported, the Stork team is experimenting with
weekly dependency updates. The audit target in Rake was expanded to
also check for vulnerabilities in the LDAP hook and optionally omit
developer-only dependencies. We implemented enhanced protection against
a Path Traversal attack in the REST API. The previously unconditional
requirement to exclusively use TLS version 1.3 when connecting to the
Stork server database can now be relaxed. The `--db-tls-1-2-enabled`
flag and its corresponding `STORK_DATABASE_TLS_1_2_ENABLED` environment
variable allow the Stork server to also negotiate TLS 1.2 database
connections. The Stork server no longer generates certificates based
on IP addresses and DNS names supplied in the Subject Alternative Name
fields of an agent's Certificate Signing Request. These values are
now assigned by the server based on the agent's address, preventing an
attacker from requesting a certificate for arbitrary addresses or DNS
names while registering as a legitimate agent. Added CSRF protection
mechanism in Stork server. Improved the security of the session cookies.
When the Stork server has TLS enabled, the cookies now have the Secure
attribute set. Improved the security of machines REST API endpoints.
Machine's Agent Token is now sent and displayed only for super-admin
roles [#2469, #2445, #2454, #2428, #2309, #2319, #2564, #2651, #2561,
#2077].

6. **UI changes**: The Zone RR viewer now has more compact and
improved filtering. The shared network columns no longer overlap on the
dashboard. Added an indicator of applied filters to the tables, which is
visible even when the filters toolbar is hidden. The `control-sockets`
Kea parameter is not shown on the list of global parameters until the
support for displaying arrays of maps is implemented. Previously this
parameter was shown but its contents were unreadable. Link from the
zones list now directs to a selected daemon instead of filtering the
zones by daemon. Migrated from PrimeNG to OptimusUI [#2282, #2385,
#2358, #2415, #2518, #2611].

7. **Prometheus metrics**: The Prometheus Kea Exporter now provides
`lease-allocation` and `lease-allocation-failure` statistics. Both
global and per-subnet metrics are available [#2551].

8. **Kea configuration visibility**: Stork now displays all configured
Kea control sockets. The Data Storage view also includes database
usernames and ports and indicates whether TLS client certificates are
configured for individual database backends [#2273, #2418].

9. **LDAP**: Added a new utility to Stork Tool to migrate the external
IDs of the existing LDAP system users to new unique identifier [#2434].

10. **Kea Compatibility**: Added support for DHCP option class tagging
including the configuration of the never-send parameter. Added buttons
directing to zones from the daemons pages [#1941, #2344].

11. **Configuration validation**: Stork now verifies the environment
variables provided and prints descriptive feedback if a variable is
not recognized or deprecated. All three components (`stork-server`,
`stork-agent`, `stork-tool`) use the same framework to handle
command-line options and environment variables [#1587].

12. **Bug fixes**: We fixed a problem where the Stork agent created
duplicate Unix socket access points for Kea 3.x. We fixed a panic
in the LDAP code, when a user who logged in previously had their DN
name changed. The Stork agent can now properly detect `kea-dhcp-ddns`
daemons. We fixed a problem where Kea's configuration file was missing
the control-socket structure. Stork no longer drops unknown parameters
from the Kea configuration. The Stork agent can now detect Kea daemons
started with a relative executable path. We decreased the logging level
for messages when the server is unable to find a subnet reported in a
Kea statistics response. We fixed a bug where the Stork agent could
sometimes kick off multiple state pullers, resulting in duplicate
daemons. We fixed a problem with database migration if the schema had
applications without any daemons. This release fixes a server crash when
an empty subnet definition is submitted through the API and prevents
out-of-range subnet utilization values from interrupting statistics
collection. The documentation for subnet and host-reservation filtering
was also updated. Fixed the agent installation script returned in the
"Installing Stork Server on a New Machine" view. This script could
fail to download the Stork agent package bundled in the server, due
to an invalid Stork server URL. The URL in the script is now properly
sanitized. The script was also updated to correctly handle registering
and starting the agent on Alpine Linux. Fixed the fuzz:backend rake
task which executes the fuzzing tests for the specified package. Fixed
a bug where a DHCP option defined as a "record" with the array flag set
(e.g.  slp-directory-agent, a mandatory flag followed by one or more
IPv4 addresses) misidentified any CSV value beyond the record's fixed
fields as belonging to the record's first field type again, instead of
repeating the record's last field type. This caused the entire subnet
containing such an option to be silently dropped during a periodic Kea
configuration pull. Fixed a bug causing Kea to reject updated subnet
configuration sent by Stork when option value was specified as numeric
1 or 0 in Kea, and the definition was unspecified for that option. In
that case, Stork converted these values to "true" or "false". Kea
rejected these values because it could not determine whether they were
appropriate given that original values were numeric. If Stork does not
know the option definition, it treats 1 and 0 as numeric values and does
not convert them to boolean. Conversion to boolean only performed for
known option formats containing explicit boolean types. Fixed support
for generating UUID for UI served over HTTP. Resolving includes in the
Kea configuration file now handles commented lines [#2318, #2303, #2433,
#2403, #2328, #2289, #2382, #583, #2317, #2362, #2363, #2425, #2580,
#2591, #2608, #2644, #2652, #2593, #2573].

13. **Demo**: Fixed initialization of the example DHCP options for the
host reservations defined in the demo's database [#2351].

14. **Build, dependency, and packaging updates**: Stork has been
historically developed with the monorepo philosophy: the production
source code of Stork itself, as well as all related files, such
as tests, packages, demo files, and others were kept in the same
repository. This was adequate when Stork was small, but with the
project growing in size and scope that is no longer maintainable. Two
major pain points were the build system complexity and dependencies
that were increasingly hard to manage. As such, we are in the process
of separating some files into different repositories. The first step
was to move the system tests to a new repository. The new repository
is available at https://gitlab.isc.org/isc-projects/stork-tests. The
build system now uses the Go and Node.js versions installed in the
operating system instead of downloading fixed compiler versions. We
removed an obsolete version parameter from Docker-compose files. We
fixed the authentication-methods directory permissions in packaging
scripts. The check against Java runtime version is now more explicit
(11 or later required) and documented. We bumped the go-swagger version
to 0.33.2, which fixed build problems on OpenBSD 7.8, among other
things. The default hook directory path is now relative to the binary
location rather than an absolute path. Some dependencies were updated;
in particular, Angular was updated to 21. Stork now uses Angular 21,
Optimus-UI 1.0.2, Go 1.26.9, and many newer frontend, backend, Python,
and Ruby dependencies.  Package uninstallation was also improved: the
Alpine package can preserve externally managed users, and the Stork
server package now correctly removes its directories [#2429, #1621,
#1300, #2111, #1699, #2297, #1910, #2470, #2484, #2486, #2488, #2495,
#2525, #2543, #2554, #2567, #2581, #2595, #2600, #2609, #2614, #2632,
#2659, #2666, #2700].

15. **Testing**: A problem with environment variables was fixed in
several unit-tests, when running in a containerized environment. We
added `pytest-playwright` to pytest dependencies. We tweaked the test
timeouts, so that fast developer machines get deadlock reports promptly,
while the CI jobs have a little bit more time to complete slow tests.
It's now easier to get code coverage information when running only some
of the tests. The default Storybook plugins were re-enabled. CI caching
is now implemented. The build system is now more lenient if it was
unable to install Chrome using Playwright [#2482, #2438, #2430, #2478,
#2432, #1292, #1694, #2168, #2277, #2248].

## Incompatible Changes

There are no backward-incompatible changes in this release.

## Known Issues

* When Stork is tracking Kea leases in the memfile and
comes across a lease assigned to an unknown subnet (i.e.,
the subnet that no longer exists in the Kea configuration),
the list of leases in the WebUI will stop updating. See
https://gitlab.isc.org/isc-projects/stork/-/wikis/Known-issues#stork-260
for details.

Please see this link for all the known issues:
https://gitlab.isc.org/isc-projects/stork/-/wikis/Known-issues.

## Release Model

Stork has stable (even-numbered minor version, e.g. 2.0.1)
and development (odd-numbered minor version, e.g. 2.1.2)
releases; development releases are issued bi-monthly with some
exceptions. New stable releases are expected roughly every
six months. For ISC's detailed software support policy, see
https://kb.isc.org/docs/aa-00896#stork.

We recommend using stable versions in production if possible. We
encourage users to test development releases and report back
their findings on the stork-users mailing list (available at
https://lists.isc.org/mailman/listinfo/stork-users) or open GitLab
issues. ISC professional support customers may also report issues via
our support portal.

This text references issue numbers. For more details, visit the Stork
GitLab page at https://gitlab.isc.org/isc-projects/stork/issues.

## License

Stork is released under the Mozilla Public License, version 2.0.

   https://www.mozilla.org/en-US/MPL/2.0

## Download

The easiest way to install the software is to use native deb or RPM
packages. They can be downloaded from:

   https://cloudsmith.io/~isc/repos/stork/

The Stork source and PGP signature for this release may be downloaded
from:

   https://downloads.isc.org/isc/stork

The signature was generated with the ISC code-signing key, which is
available at:

   https://www.isc.org/pgpkey

ISC provides documentation in the Stork Administrator
Reference Manual (ARM). It is available on ReadTheDocs.io at
https://stork.readthedocs.io/en/latest/, and in source form in [the doc/
directory](https://gitlab.isc.org/isc-projects/stork/-/tree/master/doc).

We ask users of this software to please let us know how it
worked for you and what operating system you tested on. Feel
free to share your feedback on the stork-users mailing list
(https://lists.isc.org/mailman/listinfo/stork-users). We would also like
to hear whether the documentation is adequate and accurate. Please open
tickets in the Stork GitLab project for bugs, documentation omissions
and errors, and enhancement requests. We want to hear from you even if
everything worked.

## Support

Professional support for Stork is available from ISC. We encourage all
professional users to consider this option; Stork and Kea maintenance is
funded with support subscriptions. For more information on ISC's Kea and
Stork software support, see https://www.isc.org/support/.

Free best-effort support is provided by our user community via a
mailing list. Information on all public email lists is available
at https://www.isc.org/mailinglists/. If you have any comments or
questions about working with Stork, please share them to the stork-users
list (https://lists.isc.org/mailman/listinfo/stork-users). Bugs
and feature requests may be submitted via GitLab at
https://gitlab.isc.org/isc-projects/stork/issues.

## Changes

The following summarizes changes and important upgrades since the
previous Stork stable release versioned 2.4.0.

Stork 2.6.0 released on 2026-10-14.

* 715 [ui] piotrek

    Added an indicator of applied filters to the tables, which is
    visible even when the filters toolbar is hidden.
    (Gitlab #2358)

* 714 [doc] piotrek

    Added links to the OIDC specifications in the OIDC settings
    description.
    (Gitlab #2570)

* 713 [build] piotrek, marcin

    Updated Go to 1.26.9 and dependencies for frontend, backend, Python,
    Ruby.
    (Gitlab #2632, #2659, #2666, #2700)

* 712 [func] slawek

    Added a new utility to Stork Tool to migrate the external IDs of
    the existing LDAP system users to new unique identifier.
    (Gitlab #2434)

* 711 [bug] marcin

    Fixed the agent installation script returned in the
    "Installing Stork Server on a New Machine" view. This
    script could fail to download the Stork agent package
    bundled in the server, due to an invalid Stork server URL.
    The URL in the script is now properly sanitized. The
    script was also updated to correctly handle registering
    and starting the agent on Alpine Linux.
    (Gitlab #2591)

* 710 [func] jrickett, slawek

    Added support for decoding of relay agent info sub-options in the
    lease user context.
    (Gitlab #2529)

* 709 [func] slawek

    Added support for DHCP option class tagging including the
    configuration of the never-send parameter.
    (Gitlab #1941)

* 708 [sec] piotrek

    Added CSRF protection mechanism in Stork server.
    (Gitlab #2651)

* 707 [ui] marcin

    The `control-sockets` Kea parameter is not shown on the list
    of global parameters until the support for displaying arrays
    of maps is implemented. Previously this parameter was shown
    but its contents were unreadable.
    (Gitlab #2415)

* 706 [bug] marcin

    Fixed the fuzz:backend rake task which executes the fuzzing tests
    for the specified package.
    (Gitlab #2608)

* 705 [sec] piotrek

    Improved the security of the session cookies. When the Stork server
    has TLS enabled, the cookies now have the Secure attribute set.
    (Gitlab #2561)

* 704 [bug] william

    Fix a bug where sorting the Lease List table by lease state would
    seemingly shuffle the rows randomly.
    (Gitlab #2589)

* 703 [bug] william

    Fixed a bug which caused the Stork server to ignore certain fields
    when fetching leases from the agents.
    (Gitlab #2641)

* 702 [ui] marcin

    Link from the zones list now directs to a selected daemon
    instead of filtering the zones by daemon.
    (Gitlab #2518)

* 701 [bug] marcin

    Zone transfer timestamps are now displayed with milliseconds
    precision in the UI.
    (Gitlab #2662)

* 700 [ui] william

    Filtering the Lease List by 'Valid' now only shows valid leases,
    instead of incorrectly showing all leases.
    (Gitlab #2646)

* 699 [doc] marcin

    Documented zone transfer monitoring in the Stork ARM.
    The stork-agent user is added to the systemd-journal
    group, so it can read track zone transfers in the
    systemd journal.
    (Gitlab #2400)

* 698 [func] marcin

    Added buttons directing to zones from the daemons pages.
    (Gitlab #2344)

* 697 [bug] wlipinski

    Fixed a bug where a DHCP option defined as a "record" with the
    array flag set (e.g. slp-directory-agent, a mandatory flag
    followed by one or more IPv4 addresses) misidentified any CSV
    value beyond the record's fixed fields as belonging to the
    record's first field type again, instead of repeating the
    record's last field type. This caused the whole subnet
    containing such an option to be silently dropped during a
    periodic Kea configuration pull.
    (Gitlab #2644)

* 696 [bug] piotrek

    Fixed the user filter on the Events page, which showed an empty
    entry for users authenticated via OIDC. Displayed authentication
    method is now consistent across Stork UI.
    (Gitlab #2628)

* 695 [bug] wlipinski

    Fixed a bug causing Kea to reject updated subnet configuration sent
    by Stork when option value was specified as numeric 1 or 0 in Kea,
    and the definition was unspecified for that option. In that case,
    Stork converted these values to "true" or "false". Kea rejected
    these values because it could not determine whether they were
    appropriate given that original values were numeric. If Stork does
    not know option definition, it treats 1 and 0 as numeric values
    and does not convert them to boolean. Conversion to boolean only
    performed for known option formats containing explicit boolean
    types.
    (Gitlab #2652)

* 694 [bug] slawek

    Fixed support for generating UUID for UI served over HTTP.
    (Gitlab #2593)

* 693 [sec] piotrek

    Improved the security of machines REST API endpoints. Machine's
    Agent Token is now sent and displayed only for super-admin roles.
    (Gitlab #2077)

* 692 [bug] marcin

    Fixed two bugs in the BIND 9 configuration parsing. The first bug
    precluded the use of address match lists with negated embedded match
    list or ACL. The second bug precluded the use of wildcard imports.
    Both can now be used in BIND 9 configuration and Stork agent will
    handle them properly.
    (Gitlab #2322)

* 691 [bug] slawek

    Fixed displaying uptime for DNS daemons in dashboard.
    (Gitlab #2626)

* 690 [bug] marcin

    Fixed DNS zone transfers tracking using systemd logs. Stork agent
    enforces the use of RFC3339-compliant timestamp format in the
    journalctl output that allows for correctly parsing the timestamps
    pertaining to the zone transfers.
    (Gitlab #2661)

* 689 [func] marcin

    Regular pruning old zone transfers according to the maximum age
    configured in the UI.
    (Gitlab #2540)

* 688 [bug] slawek

    Fixed initialization of the example DHCP options for the host
    reservations defined in the demo's database.
    (Gitlab #2351)

* 687 [func] slawek

    Added some Kea DHCPv6 daemons with the Config Backend hook loaded
    to the demo.
    (Gitlab #2597)

* 686 [ui] slawek

    Fixed DNS Zone Transfers tab links.
    (Gitlab #2627)

* 685 [ui] slawek

    Migrated from PrimeNG to OptimusUI.
    (Gitlab #2611)

* 684 [bug] slawek

    Resolving includes in the Kea configuration file now handles
    commented lines.
    (Gitlab #2573)

Stork 2.5.1 released on 2026-08-12.

* 683 [ui] william

    Collect and show all lease memfile columns, not just a basic subset.
    (Gitlab #2447)

* 682 [build] rootwyrm, slawek

    The Stork Alpine package can now preserve externally managed users
    during uninstall.
    (Gitlab #2486)

* 681 [sec] slawek

    Improved the security of the agent's GRPC certificate generation.
    The server now ignores IP addresses and DNS names provided in the
    Subject Alternative Name (SAN) fields of the Certificate Signing
    Request (CSR). Instead, they are assigned on the server side
    based on the agent's address. It blocks the attacker from requesting
    a certificate for any IP address or DNS names under the guise of
    registering a legitimate agent.
    (Gitlab #2564)

* 680 [build] slawek

    Fixing the removal of directories when the Stork server package is
    uninstalled.
    (Gitlab #2484)

* 679 [doc] slawek

    Updated ARM section of subnet filtering.
    (Gitlab #2362)

* 678 [bug] slawek

    Fixed a server crash when a subnet was created via API without any
    specific parameters.
    (Gitlab #2580)

* 677 [doc] slawek

    Updated ARM sections of host reservation filtering descriptions.
    (Gitlab #2363)

* 676 [build] tomek, piotrek

    Updated to Angular 21, PrimeNG 21 and several dependencies.
    (Gitlab #2488)

* 675 [build] andrei, piotrek, slawek, william

    Updated Go to 1.26.5 and dependencies for frontend, backend,
    Python, Ruby.
    (Gitlab #2495, #2525, #2543, #2554, #2567, #2581, #2595, #2609,
    #2614)

* 674 [bug] slawek

    Fixed a crash that happened when the gRPC connection to a daemon was
    closed while it was still monitored. Skip lease fetching for
    inactive and not monitored daemons.
    (Gitlab #2447)

* 673 [func] marcin

    Improved tracking zone transfers in the BIND 9 logs. Two new
    transfer states are determined: up-to-date and failed. The former
    marks the zone transfers for which the secondary found that it
    already has a current copy of the zone. The latter marks the
    transfers for which the status was neither success nor up to date.
    In both cases, the tracker also captures subsequent log messages
    containing the transfer statistics, so they can be displayed in
    the UI.
    (Gitlab #2579)

* 672 [ui] marcin

    Added a new view listing the DNS zone transfers. It contains
    controls for filtering and sorting the zone transfers.
    (Gitlab #2557)

* 671 [func] slawek

    The subnet form groups the daemons that share the same Config
    Backend database and server tag, preventing them from being
    configured individually.
    (Gitlab #2552)

* 670 [func] tomek, slawek

    The build system no longer downloads specific NodeJS and Go compiler
    and uses the version available in the OS instead. This makes it
    possible to build Stork with different NodeJS and Go versions. Also,
    the compilation should be a bit faster and smaller as there is a
    couple less items to download.
    (Gitlab #2470, #2600)

* 669 [func] marcin

    Created REST API call returning the list of DNS zone transfers.
    (Gitlab #2398)

* 668 [func] sebastien.degroof

    The Prometheus Kea Exporter now collects Kea's lease allocation
    and lease allocation failure statistics, consistent with how
    address statistics are exposed. Both global and per-subnet samples
    are supported.
    (Gitlab #2551)

* 667 [bug] william

    Correct a bug which prevented the Leases List from updating. Due
    to improper error handling, the entire leasefile update from the
    agent would be ignored if any lease in the update had been seen
    before.
    (Gitlab #2523)

* 666 [func] marcin

    Stork server connects to the monitored BIND 9 instances and
    receives zone transfer events over the streaming connection.
    The zone transfer events are stored in the Stork server's
    database.
    (Gitlab #2396)

* 665 [bug] william

    Correct an oversight which prevented Stork from activating Lease
    Tracking when used with Kea versions older than 3.1.0, even when
    Kea is configured with an absolute lease memfile path.
    (Gitlab #2498)

* 664 [func] piotrek

    Improved displaying system groups that Stork user belongs to.
    In case user belongs to more than one group, all group names will
    be displayed.
    (Gitlab #1957)

* 663 [func] piotrek

    Added new settings to configure OpenID Connect authentication.
    Now it is possible to set a unique OpenID Provider identifier. It is
    also possible to manually set OpenID Provider endpoints if the
    Provider doesn't support OIDC Discovery.
    (Gitlab #2538, #2536)

* 662 [doc] slawek

    Extended the subnet help tips to explain whether the JSON
    configuration or the Config Backend database is altered
    when the subnet is updated from the Stork UI.
    (Gitlab #2476)

* 661 [func] piotrek

    Improved the User account edit form. Group assignment is no longer
    possible for external users when the external authentication
    service is managing the group assignment.
    (Gitlab #2339)

* 660 [func] slawek

    Allow creating, editing, and deleting subnets from the Config
    Backend database for Kea with both cb_cmds and subnet_cmds hooks
    loaded.
    (Gitlab #2527)

* 659 [func] marcin

    Stork agent exposes API to establish the streaming connection to
    receive zone transfer events over gRPC.
    (Gitlab #2395)

* 658 [build] tsawka

    Move system tests to stork-tests repository
    (Gitlab #1910)

* 657 [func] slawek

    Support for deleting subnets in the Config Backend database.
    (Gitlab #2475)

* 656 [func] slawek

    Support for modifying subnets in the Config Backend database.
    (Gitlab #2474)

* 655 [func] marcin

    Stork server gathers network interfaces and IP addresses assigned
    to the interfaces on the monitored machines, and stores them in
    the database. The IP addresses are not displayed anywhere yet.
    It is a building block of the DNS zone transfer monitoring to be
    implemented in the future GL issues.
    (Gitlab #2394)

* 654 [bug] slawek

    Added clipping the utilization value when it exceeds the smallint
    (2 bytes) range to avoid interrupting statistics fetching. Such a
    value indicates duplication daemons in the Stork database or
    overlapping subnet pools for Kea daemons that are not combined into
    an HA pair.
    (Gitlab #2425)

* 653 [ui] slawek

    Extended the Kea daemon Data Storage view to display database user
    and port details, and indicate whether TLS client certificates are
    configured for each database backend entry.
    (Gitlab #2418)

* 652 [func] slawek

    Display all Kea control sockets in UI.
    (Gitlab #2273)

Stork 2.5.0 released on 2026-06-03.

* 651 [doc] piotrek

    Added a brief documentation section in ARM for OpenID Connect
    authentication in Stork.
    (Gitlab #2485)

* 650 [bug] slawek

    Fixed a bug that could cause the server to panic during user
    authentication via LDAP. Authentication could be rejected if the
    user's Distinguished Name differed from the value known to the Stork
    server.
    (Gitlab #2303)

* 649 [func] william

    The Stork server now has a user interface for displaying leases
    which it collected from Kea.  See DHCP > Leases List.
    (Gitlab #2059)

* 648 [func] piotrek

    Added support for OpenID Connect external authentication to Stork
    server.
    (Gitlab #2455, #2457, #2463, #2465, #2473, #2480)

* 647 [build] marcin

    Updated backend, UI, python and ruby dependencies.
    (Gitlab #2469)

* 646 [func] marcin

    Stork agent uses the BIND 9 directory option to determine
    absolute paths to the log files where DNS zone transfers
    are logged.
    (Gitlab #2460)

* 645 [func] slawek

    Support for creating subnets in the Config Backend database.
    (Gitlab #2424)

* 644 [func] marcin

    Implemented zone transfers monitoring in the agent. The agent
    now collects the information about ongoing and completed zone
    transfers, and holds it in memory. Since there is no gRPC API
    to retrieve the zone transfer information from the agent, the
    information is not yet available to the server. The API and the
    necessary Stork server updates will be implemented in the future
    GL issues.
    (Gitlab #2393)

* 643 [build] piotrek

    Updated dependencies including Go 1.25.10, and several
    JavaScript and Python packages.
    (Gitlab #2454)

* 642 [bug] slawek

    Fixed the authentication-methods directory permissions in
    packaging scripts. The stork-server process could not write
    LDAP hook icons because the directory was owned by root after
    package installation. Added mkdir and chown in all post-install
    scripts and os.MkdirAll in Go code as defense-in-depth.
    (Gitlab #1621)

* 641 [func] marcin

    Stork agent parses BIND 9 logging configuration to determine
    the log files where zone transfer events are logged. The zone
    transfers are tracked in these files when zone transfer tracking
    is enabled using the --enable-xfr-tracking parameter. Still, it
    is possible to specify alternate file locations by explicitly
    setting the --xfr-in-tracking-path and --xfr-out-tracking-path
    command line arguments of the Stork agent.
    (Gitlab #2444)

* 640 [func] slawek

    Added verification of the environment variables provided by a shell
    and in the environment file to print a descriptive feedback in case
    of a typo or using a deprecated variable.
    (Gitlab #1587)

* 639 [ui] slawek

    Display the Kea daemon's server tag on the daemon page.
    (Gitlab #2420)

* 638 [func] marcin

    Added new parameters to the Stork agent enabling zone transfer
    monitoring in the explicitly specified files or systemd logs.
    The captured logs are not yet interpreted.
    (Gitlab #2392)

* 637 [func] slawek

    Added a new container to the demo that runs Kea DHCPv4 server
    with the Config Backend (cb_cmds) hook.
    (Gitlab #2416)

* 636 [func] marcin

    Implemented log tracker in the Stork agent. It will be used to
    monitor BIND 9 logs to capture the zone transfer events. However,
    as a generic solution, it can be used in the future for tracking
    any kind of events logged in the files or systemd logs.
    (Gitlab #2391)

* 635 [func] slawek

    The Stork server now extracts the server tag from the Kea
    DHCP daemon configuration and stores it in the database. It is the
    backbone of the Kea Config Backend support.
    (Gitlab #2419)

* 634 [build] piotrek

    Updated dependencies including Go 1.25.9, and several
    JavaScript, Python, Ruby and Go packages.
    (Gitlab #2445)

* 633 [bug] marcin

    Fixed detection and monitoring of the kea-dhcp-ddns process.
    (Gitlab #2433)

* 632 [func] william

    The Stork server now collects leases from the agents and stores them
    in the Stork server database. They will be displayed by UI added in
    a later change.
    (Gitlab #2058)

* 631 [build] andrei

    Go Swagger version was bumped up to v0.33.2.
    (Gitlab #2111)

* 630 [func] piotrek

    Zone RRs viewer filtering panel was changed to compact style to
    match other filtering panels in Stork UI.
    (Gitlab #2282)

* 629 [ui] slawek

    Fixed long shared network names overlapping adjacent columns
    on the Dashboard. Names are now truncated with an ellipsis and
    expand to the full text on hover.
    (Gitlab #2385)

* 628 [sec] slawek

    Enhanced protection against Path Traversal attack in RestAPI.
    (Gitlab #2309)

* 627 [bug] slawek

    Fixed the Stork server crash when the monitored daemon had no
    control sockets specified.
    (Gitlab #2403)

* 626 [bug] marcin

    Stork no longer erases Kea configuration parameters it does not
    recognize when it updates Kea configuration. This is important
    when Stork version is behind Kea version, and new parameters
    were introduced to Kea.
    (Gitlab #2328)

* 625 [func] marcin

    Implemented systemd logs reader and watcher using journalctl.
    It will be used to monitor BIND9 logs to capture zone transfer
    events.
    (Gitlab #2389)

* 624 [bug] slawek

    Fixed Kea, BIND 9, and PowerDNS detection failing to parse the CLI
    flags when the path to the binary contained a directory named same
    as the binary (e.g., /var/lib/named/sbin/named).
    (Gitlab #2374)

* 623 [bug] andrei

    The agent can now detect Kea daemons started with a relative
    executable path; previously, it tried to guess that the
    executable would be located in the current working directory
    from which the process was started.
    (Gitlab #2289)

* 622 [func] ! slawek

    The default hook directory path is now relative to the binary
    location rather than an absolute path. The hook directory is created
    during the package installation if it doesn't exist.
    (Gitlab #1699)

* 621 [func] marcin

    Implemented log file reader and watcher, working similar to the
    tail -f. It will be used to monitor BIND9 log files to capture
    zone transfer events.
    (Gitlab #2388)

* 620 [bug] slawek

    Decreased the logging level for a message produced when it is unable
    to find a subnet reported in the Kea statistics response to prevent
    bloating the logs if the stale subnets are included.
    (Gitlab #2382)

* 619 [func] slawek

    Added the --db-tls-1-2-enabled flag (STORK_DATABASE_TLS_1_2_ENABLED
    environment variable) to allow lowering the minimum TLS version for
    database connections from 1.3 to 1.2.
    (Gitlab #2319)

* 618 [bug] slawek

    Fixed a hole that allowed pulling the same agent state many times
    concurrently, which could result in duplicating daemons.
    (Gitlab #583)

* 617 [build] piotrek

    Updated frontend dependencies including Angular 20 and PrimeNG 20.
    Development dependency Storybook was updated to version 10.2.
    (Gitlab #2297)

* 616 [bug] slawek

    Fixed a database migration failure for the application with no
    daemons.
    (Gitlab #2317)

Stork 2.4.0 released on 2026-02-25.

Thank you again to everyone who assisted us in making this release
possible.

We look forward to receiving your feedback.