)]}' { "log": [ { "commit": "fd72d6e7ff9196b95e22c1bf4f17129ae0f5951e", "tree": "d1b078d6a2761fddcef42811081466d65b95c26b", "parents": [ "4c4371fdbfaaf1d29113ff79d2fe51d9d5a3e728" ], "author": { "name": "prabhukr", "email": "prabhukr@google.com", "time": "Fri Sep 18 20:18:22 2026 +0000" }, "committer": { "name": "Prabhu Karthikeyan Rajasekaran", "email": "prabhukr@google.com", "time": "Sun Sep 20 16:04:03 2026 -0700" }, "message": "[tcplp] Suppress -Wcall-graph-section-no-prototype\n\nSuppress -Wcall-graph-section-no-prototype in tcplp warnings_fix_config\nwhen building with -fexperimental-call-graph-section.\n\nBug: 536931943\nChange-Id: Ib86464d3ea988bfc14fa10c4e4ef861021b761e9\nReviewed-on: https://fuchsia-review.googlesource.com/c/third_party/openthread/+/1835289\nReviewed-by: Yakun Xu \u003cxyk@google.com\u003e\nReviewed-by: Xiao Ma \u003cxiaom@google.com\u003e\n" }, { "commit": "4c4371fdbfaaf1d29113ff79d2fe51d9d5a3e728", "tree": "77a610d43f83c3f5a172284e7f2b36b936e6ff7c", "parents": [ "436aa6980d5ac1f484f091aa956a9d30ec97ffc1", "d11cc040fdbc241a633cb23da1f3b17084cf42fb" ], "author": { "name": "Jiaming (Charlie) Wang", "email": "jiamingw@google.com", "time": "Wed Jul 08 16:30:54 2026 -0700" }, "committer": { "name": "Jiaming (Charlie) Wang", "email": "jiamingw@google.com", "time": "Thu Jul 09 15:24:10 2026 -0700" }, "message": "[openthread] Update OpenThread\n\nUpdate to July 8, 2026 version.\nCommit: d11cc040fdbc241a633cb23da1f3b17084cf42fb\n\nBug: 532696747\nChange-Id: I0ecf8672cc03db94c9ee7adc3c048d53398cb026\nReviewed-on: https://fuchsia-review.googlesource.com/c/third_party/openthread/+/1698754\nReviewed-by: Xiao Ma \u003cxiaom@google.com\u003e\n" }, { "commit": "d11cc040fdbc241a633cb23da1f3b17084cf42fb", "tree": "0561dd0b592fd935ec5a75236113228af475205d", "parents": [ "5f03f0e14b510e1ca201f50021367975d44b76b8" ], "author": { "name": "0xDragon", "email": "huynhchitrungcip@gmail.com", "time": "Thu Jul 09 01:33:14 2026 +0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 08 11:33:14 2026 -0700" }, "message": "[spinel] validate DNSSD host address count (#13283)\n\nHandle empty DNS-SD host address lists and consume all encoded IPv6\naddresses when the address count is greater than one. Add unit\ncoverage for empty lists, multiple addresses, and malformed counts.\n\nCo-authored-by: huynhtrungcip \u003chuynhtrungcip@users.noreply.github.com\u003e" }, { "commit": "5f03f0e14b510e1ca201f50021367975d44b76b8", "tree": "95041fd73177007a84c2ecba99e1b9a2abbefc42", "parents": [ "63e9900a0a416a2598629ec88d41126f62708053" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Tue Jul 07 18:51:13 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jul 07 18:51:13 2026 -0700" }, "message": "[radio] introduce `SyncedRadioLocalTime` helper class (#13278)\n\nThis commit introduces `SyncedRadioLocalTime` to encapsulate paired\nradio time and local `TimeMicro` values, and refactors `SubMac`\nto use it for tracking CSL and WED sample timing." }, { "commit": "63e9900a0a416a2598629ec88d41126f62708053", "tree": "c18aa3584980258af8abd06579f0c7b0098a9f79", "parents": [ "3c03385bef4c4e12f84cc3a585ec06f1b311578c" ], "author": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Tue Jul 07 14:30:54 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jul 07 14:30:54 2026 -0700" }, "message": "github-actions: bump github/codeql-action/analyze from 4.35.4 to 4.36.3 (#13313)\n\nBumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.35.4 to 4.36.3.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/68bde559dea0fdcac2102bfdf6230c5f70eb485e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a)\n\n---\nupdated-dependencies:\n- dependency-name: github/codeql-action/analyze\n dependency-version: 4.36.2\n dependency-type: direct:production\n update-type: version-update:semver-minor\n..." }, { "commit": "3c03385bef4c4e12f84cc3a585ec06f1b311578c", "tree": "8a23a1d898e439c2cdf50660aae2593c6e3be649", "parents": [ "8bb5b30b2bd7c3e17101cfe9837d4ddf486502c3" ], "author": { "name": "silabs-PiyushY", "email": "piyadav@silabs.com", "time": "Tue Jul 07 23:54:13 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jul 07 11:24:13 2026 -0700" }, "message": "[build] fix LLVM compilation issues (#13058)\n\n- Fix Clang -Wshorten-64-to-32 in mac_frame.cpp and cli_ping.cpp" }, { "commit": "8bb5b30b2bd7c3e17101cfe9837d4ddf486502c3", "tree": "20e4b41a07162b3d87046b0213de94146540c25d", "parents": [ "6cc9359ceef2dc9b65b1227d6fb8827764b12eb9" ], "author": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Mon Jul 06 15:16:17 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jul 06 15:16:17 2026 -0700" }, "message": "[tests] remove border router MATN tests (#13306)\n\nRemove MATN border router certification tests as they have been\nreplaced by equivalent tests in the ot-br-posix repository under:\nhttps://github.com/openthread/ot-br-posix/tree/main/tests/scripts/expect\n\nThe new tests run using the docker-in-docker framework.\n\nDeleted tests:\n- MATN_02_MLRFirstUse.py\n- MATN_03_InvalidCommissionerDeregistration.py\n- MATN_04_MulticastListenerTimeout.py\n- MATN_05_ReregistrationToSameMulticastGroup.py\n- MATN_09_DefaultBRMulticastForwarding.py\n- MATN_12_HopLimitProcessing.py\n- MATN_15_ChangeOfPrimaryBBRTriggersRegistration.py\n- MATN_16_LargeNumberOfMulticastGroupSubscriptionsToBBR.py" }, { "commit": "6cc9359ceef2dc9b65b1227d6fb8827764b12eb9", "tree": "ac2d597f171070cd39ee3be8396747312d13fbd2", "parents": [ "1aeafa6b99745da809451155e9f3009c231fa9ff" ], "author": { "name": "Yakun Xu", "email": "xyk@google.com", "time": "Tue Jul 07 05:09:54 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jul 06 14:09:54 2026 -0700" }, "message": "[sub-mac] new frame counter for retransmissions having header IEs (#13304)\n\nSince the core is not sure whether the frame counter is used by the\nplatform or not, this commit modifies the sub-mac to always use a new\nframe counter to secure retransmissions having header IEs." }, { "commit": "1aeafa6b99745da809451155e9f3009c231fa9ff", "tree": "f5e9631c9dcc9498dcd1d8a80c1a13731b861456", "parents": [ "815264e8495571214c1f06ad6911b587f304ca98" ], "author": { "name": "Thomas", "email": "thomas@tc2.be", "time": "Mon Jul 06 22:48:26 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jul 06 13:48:26 2026 -0700" }, "message": "[aes-ccm] only allow nonces in the length range [7, 13] in AesCcm (#13265)\n\nAesCcm does not allow nonces with lengths outside the range [7, 13].\nThis commit rejects too short or too long nonces." }, { "commit": "815264e8495571214c1f06ad6911b587f304ca98", "tree": "76da05306bfd8aafce5b51518d34ef9e3edeb1ca", "parents": [ "8ad056634c2ca7f060b83ca317fe9c546d44ec08" ], "author": { "name": "Maciej Grela", "email": "enki@fsck.pl", "time": "Mon Jul 06 19:45:25 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jul 06 10:45:25 2026 -0700" }, "message": "[bootstrap] pipe wget into tar instead of using temporary files (#12833)\n\nUsing `/tmp` to store large download files will fail when the system\nis under memory pressure. `/tmp` is backed by `tmpfs` in many Linux\ndistributions." }, { "commit": "8ad056634c2ca7f060b83ca317fe9c546d44ec08", "tree": "5b36a4b6c5f66624d30d62fcef227c5f6d22618c", "parents": [ "b678a4f63b6f9397d1a0fa8f31e5b8e0271a4d00" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Mon Jul 06 10:10:35 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jul 06 10:10:35 2026 -0700" }, "message": "[bit-utils] add `MaskForBitSize()` helper function (#13295)\n\nThis commit adds `MaskForBitSize\u003cUintType\u003e(uint8_t aBitSize)` as a\n`constexpr inline` template helper function in `bit_utils.hpp`. It\ngenerates an unsigned integer bit-mask with the specified number of\nlowest bits set to 1.\n\nKey changes:\n- Adds `MaskForBitSize\u003cUintType\u003e(aBitSize)` in `bit_utils.hpp`.\n- Adds runtime (`VerifyOrQuit`) and compile-time (`static_assert`)\n unit tests in `test_bit_utils.cpp`." }, { "commit": "b678a4f63b6f9397d1a0fa8f31e5b8e0271a4d00", "tree": "67c47eb0b687174bacc95729c8ad4568bf396404", "parents": [ "3481946bfa0f0b039ff4ea3b69f94f5c3af56225" ], "author": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Fri Jul 03 22:49:06 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 03 22:49:06 2026 -0700" }, "message": "[lowpan] check datagramSize in Decompress and DecompressUdpHeader (#13276)\n\nThis commit adds robust bounds validation checks inside the lowpan\ndecompression routines to prevent potential integer underflows.\n\nSpecifically:\n- In Lowpan::Decompress, we ensure that the declared datagramSize is\n large enough to contain the IPv6 header being decompressed at the\n current offset. This prevents underflow during recursive calls\n (e.g., for tunneled packets) when the datagram size is smaller\n than the combined headers.\n- In Lowpan::DecompressUdpHeader, we verify that the remaining\n datagram length is sufficient to fit a UDP header, preventing\n underflow when calculating the UDP length from the offset." }, { "commit": "3481946bfa0f0b039ff4ea3b69f94f5c3af56225", "tree": "2f55837f764f260549725ceb9460c115edad078a", "parents": [ "471460c6101f06231b4f00e2b4dc727ca4013ffd" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Fri Jul 03 21:16:45 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 03 21:16:45 2026 -0700" }, "message": "[mac-frame] simplify FCF flag changes using `UpdateFcfFlag` (#13282)\n\nThis commit introduces a private helper method `UpdateFcfFlag()` in\n`Mac::Frame` to consolidate repetitive Frame Control Field (FCF)\nflag modification logic across MAC frame setters." }, { "commit": "471460c6101f06231b4f00e2b4dc727ca4013ffd", "tree": "63bdd137dc719dd5dcd88f12de5d6b47c49ce1f1", "parents": [ "a4bf4f9899119ac98aa6244fe558f6c50f48c365" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Fri Jul 03 21:06:16 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 03 21:06:16 2026 -0700" }, "message": "[radio] define `OT_CONFIG_RADIO_TIME_ENABLE` derived configuration (#13280)\n\nThis commit defines `OT_CONFIG_RADIO_TIME_ENABLE` as a derived internal\nconfiguration macro in `radio.hpp`. It consolidates conditional checks\nfor features that depend on radio clock time (CSL receiver/transmitter,\nwakeup, and time synchronization)." }, { "commit": "a4bf4f9899119ac98aa6244fe558f6c50f48c365", "tree": "f366adba6ea850e247c6e9218af74907d4e81846", "parents": [ "ef9c8de3cd6ca3d81ef43d2db49f804236dc3d0f" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Fri Jul 03 21:03:22 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 03 21:03:22 2026 -0700" }, "message": "[mac] add dynamic `HeaderIe` building with `StartIe()` and `EndIe()` (#13291)\n\nThis commit introduces dynamic Header IE generation in `HeaderIe`\nusing `StartIe()`, `EndIe()`, and `Bookmark`. It allows appending\nvariable-length Header IEs directly into a `FrameBuilder` without\npre-computing the IE length.\n\nIt also adds unit test case `TestMacHeaderIeStartEnd()` in\n`test_mac_frame.cpp` covering normal usage, empty IEs, max length\n(127 bytes), and error cases for the new methods." }, { "commit": "ef9c8de3cd6ca3d81ef43d2db49f804236dc3d0f", "tree": "b02504874744de5b58336bba415242da4641fc7b", "parents": [ "e4930db19d3efb0617a33c1bc43510e6e5f29835" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Fri Jul 03 21:00:06 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 03 21:00:06 2026 -0700" }, "message": "[bit-utils] un-inline `CountBitsInMask` helper method (#13286)\n\nThis commit replaces the template function `CountBitsInMask\u003cUintType\u003e`\nwith a non-template function `CountBitsInMask(uint32_t)` in `bit_utils.hpp`\nand moves its implementation to `bit_utils.cpp`.\n\nUn-inlining this helper function avoids template instantiation overhead\nand reduces binary size across translation units. Small integer arguments\n(`uint8_t`, `uint16_t`) automatically promote to `uint32_t`, preserving\nexisting functionality." }, { "commit": "e4930db19d3efb0617a33c1bc43510e6e5f29835", "tree": "eec12702397e3515cda1c8d46adf9e06d9833475", "parents": [ "63f325229b6ccc93d5b223eccc2865783af7027c" ], "author": { "name": "Chenfan Zhang", "email": "zcfqq2@163.com", "time": "Sat Jul 04 07:05:21 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 03 16:05:21 2026 -0700" }, "message": "[dns] fix otDnsEncodeTxtData parameter type mismatch (#13288)\n\nThis commit fixes a parameter type mismatch between declaration and\nimplementation of function `otDnsEncodeTxtData()`.\n\n`include/openthread/dns.h` provides an API `otDnsEncodeTxtData()` for\nencoding TXT record entries list into TXT data, which is implemented\nin `src/core/api/dns_api.cpp`. The problem is, `otDnsEncodeTxtData()`\nis declared with `uint16_t aNumTxtEntries` in the public header, but\ndefined with `uint8_t aNumTxtEntries` in the implementation. This\nmismatch can lead to symbol/ABI inconsistency for C callers and causes\nlink failure in downstream integrations.\n\nThis commit changes the type of parameter `aNumTxtEntries` in cpp\nimplementation from `uint8_t` to `uint16_t`, to follow up type\ndefinitions in the declaration and later called\n`Dns::TxtEntry::AppendEntries()`. So that downstream integrations will\nnot run into link failure when using `otDnsEncodeTxtData()`." }, { "commit": "63f325229b6ccc93d5b223eccc2865783af7027c", "tree": "133bfa51c38036d46a4eaabbad947b306834cc34", "parents": [ "adac57a6e82ab7a9d043ee96302eea3ab73e73f6" ], "author": { "name": "Suvesh Pratapa", "email": "66088488+suveshpratapa@users.noreply.github.com", "time": "Fri Jul 03 19:02:01 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 03 16:02:01 2026 -0700" }, "message": "[crypto] add platform AES-CCM* one-shot hook (#13190)\n\nWhen OPENTHREAD_CONFIG_CRYPTO_PLATFORM_CCM_ONE_SHOT_ENABLE is set,\nAesCcm::Engine::ProcessOneShot() calls the new weak platform hook:\n\n otPlatCryptoAesCcmProcessOneShot()\n\nThe hook operates in-place on a contiguous [payload|tag] buffer,\nmapping to a one-shot PSA AEAD call or a packet-oriented hardware engine.\n\nDefault weak implementations:\n- PSA path: psa_aead_encrypt / psa_aead_decrypt (one-shot).\n- mbedTLS path: mbedtls_ccm_encrypt_and_tag / mbedtls_ccm_auth_decrypt,\n both support in-place (input \u003d\u003d output)." }, { "commit": "adac57a6e82ab7a9d043ee96302eea3ab73e73f6", "tree": "a65fb7c97e7eb19ed7a73b341f7835578c9f3ca4", "parents": [ "e299ad29e4995fd2a7b2e304c9be77f49a31fcbd" ], "author": { "name": "xusiyu", "email": "xusiyu@espressif.com", "time": "Sat Jul 04 04:33:54 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 03 13:33:54 2026 -0700" }, "message": "[crypto] align LinkRaw MAC key exportability with KeyManager (#13277)\n\nThis change completes a previously unfinished part of the \"MAC keys\nmust be exportable\" fix. `KeyManager` already applies an explicit\nexportable policy (`kExportableMacKeys`) when updating MAC keys, but\n`LinkRaw::SetMacKey()` still relied on `SetFrom(...,\naIsExportable\u003dfalse)` by default, which made key import permissions\ninconsistent across code paths.\n\nOn RCP paths with `OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE`,\nMAC key bytes from host spinel are re-imported on RCP as key\nreferences before being passed to the platform radio. If those key\nreferences are not created with export permission as required by\n`OPENTHREAD_CONFIG_PLATFORM_MAC_KEYS_EXPORTABLE_ENABLE`, the platform\ncan fail to retrieve key material when setting MAC keys, which can\nbreak subsequent 802.15.4 security processing.\n\nThis patch introduces a shared `Mac::kDefaultMacKeysExportable` policy\n(derived from `OPENTHREAD_CONFIG_PLATFORM_MAC_KEYS_EXPORTABLE_ENABLE`)\nand uses it in both `KeyManager` and `LinkRaw`, so MAC key import\nbehavior stays consistent whenever\n`OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE` is enabled." }, { "commit": "e299ad29e4995fd2a7b2e304c9be77f49a31fcbd", "tree": "8f5cf56a3ead4d63e056228b2566930b54b4f903", "parents": [ "1d4900609d1f9b16186d96f558388cc003b1673f" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Fri Jul 03 13:17:47 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 03 13:17:47 2026 -0700" }, "message": "[mac] rename `TxFrame::Info` to `TxFrame::BuildInfo` (#13289)\n\nThis commit renames `TxFrame::Info` to `TxFrame::BuildInfo` across the\nMAC module, message framer, and related tests.\n\nRenaming this structure to `BuildInfo` explicitly conveys its purpose\nas the specification used to construct/build headers for transmission,\ndistinguishing it from parsed frame header metadata." }, { "commit": "1d4900609d1f9b16186d96f558388cc003b1673f", "tree": "645d7c808f8ef4386bf4e1cfd6c0c54384aa9465", "parents": [ "a56a79bcb73413324e877dbe02829d52263aaf5e" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Fri Jul 03 13:13:42 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 03 13:13:42 2026 -0700" }, "message": "[bit-utils] add `DetermineMinBitSizeFor` helper method (#13287)\n\nThis commit adds `DetermineMinBitSizeFor(uint32_t)` to calculate and\nreturn the minimum number of bits required to represent a given\n32-bit unsigned integer value.\n\nIt also adds unit tests for this in `test_bit_utils.cpp`." }, { "commit": "a56a79bcb73413324e877dbe02829d52263aaf5e", "tree": "5be55d6243bc3519b39f4c6f861eb0bb1c14e929", "parents": [ "4c44ff1edb4e2b77623b99f8a5e062741dd5f114" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Fri Jul 03 12:53:32 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 03 12:53:32 2026 -0700" }, "message": "[mac-frame] remove Multipurpose frame format support (#13281)\n\nThis commit removes the Multipurpose (MP) frame format support\n(`OPENTHREAD_CONFIG_MAC_MULTIPURPOSE_FRAME`) and associated\nwake-up frame handling.\n\nMultipurpose frame support was originally added as a provisional and\nexperimental solution for the Wakeup Coordinator / Wake-up End Device\n(WED) wake mechanism. However, updated Thread specification designs\ndecided against using the Multipurpose frame format for wake frames.\nRemoving this now obsolete MP frame logic cleans up and simplifies\nMAC frame parsing and generation ahead of implementing the updated\nwake mechanism.\n\nKey changes:\n- Removes `OPENTHREAD_CONFIG_MAC_MULTIPURPOSE_FRAME` from `mac.h` and\n adds an `#error` check in `openthread-core-config-check.h`.\n- Simplifies `Mac::Frame` control field (FCF) parsing and helper methods\n by removing MP-specific frame handling and template helpers.\n- Replaces legacy MP wake-up frame helpers in `mac_frame.cpp` with\n temporary placeholder stubs.\n- Cleans up unit tests in `test_mac_frame.cpp` related to MP frame\n format.\n- Removes the now obsolete `v1_5-cli-p2p-link.exp` test." }, { "commit": "4c44ff1edb4e2b77623b99f8a5e062741dd5f114", "tree": "a43bced39f70be2ba9020dcafa8aa6385092bb06", "parents": [ "593fc53fcfa006d853eddea9cc310f9857ef1510" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Fri Jul 03 12:32:11 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 03 12:32:11 2026 -0700" }, "message": "[radio] introduce dedicated RadioTime types to clarify clock domain (#13268)\n\nThis commit introduces dedicated type definitions `otRadioTime64`\n(`RadioTime64`) and `otRadioTime32` (`RadioTime32`) to represent radio\nhardware microsecond timestamps.\n\nKey benefits and changes:\n- Self-Documenting Clock Domain: Transceiver hardware clocks operate in a\n distinct clock domain (`otPlatRadioGetNow()`) from core system timers\n (`TimerMilli::GetNow()`, `TimerMicro::GetNow()`). Using dedicated\n types prevents developers from accidentally passing core system time\n into radio scheduling APIs.\n- Explicit Rollover Handling: Introduced `IsRadioTimeStrictlyBefore()` to\n compare 32-bit radio timestamps using modulo serial arithmetic, cleanly\n accounting for `uint32_t` microsecond counter wrap-around.\n- Core Module Adoption: Updated `otRadioFrame::mTxInfo` / `mRxInfo`,\n `otPlatRadioGetNow()`, `otPlatRadioReceiveAt()`, `SubMac`, and\n `CslTxScheduler` to adopt the new radio time types." }, { "commit": "593fc53fcfa006d853eddea9cc310f9857ef1510", "tree": "ca564685ee9342bebc9049607bb263ba1bf53230", "parents": [ "c34311ff50ecf9f53c386fcbc5fd961777f50a63" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Wed Jun 24 23:17:59 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jun 24 23:17:59 2026 -0700" }, "message": "[netdiag] add support for Vendor OUI TLV (#13260)\n\nThis commit introduces the Vendor OUI Network Diagnostic TLV (type 44),\nenabling devices to query and report their Vendor Organizationally Unique\nIdentifier (OUI).\n\nSpecifically, this commit implements TLV generation and parsing in the\nNetwork Diagnostics `Client` and `Server` modules, exposing the parsed\nOUI through public client APIs. It also updates the `networkdiagnostic`\nCLI commands to support querying and outputting Vendor OUI information.\n\nIt also extends the existing toranj tests to cover the new TLV\n(`test-020-net-diag-vendor-info.py`)." }, { "commit": "c34311ff50ecf9f53c386fcbc5fd961777f50a63", "tree": "7bbcdbcf9fd8ee779813be39d72111a289327b4e", "parents": [ "ac689dd9a4f659f04e8e4404f798e0b529f14c30" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Tue Jun 23 11:59:38 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jun 23 11:59:38 2026 -0700" }, "message": "[vendor-info] generalize vendor OUI to support variable lengths (#13258)\n\nThis commit generalizes the Vendor OUI (Organizationally Unique\nIdentifier) handling to support IEEE MAC Address Block Large\n(MA-L, 24-bit), Medium(MA-M, 28-bit), and Small (MA-S, 36-bit)\nassignments.\n\nKey enhancements:\n\n- Backward-Compatible Config Parsing: The\n `OPENTHREAD_CONFIG_NET_DIAG_VENDOR_OUI` configuration remains fully\n backward compatible. If the macro is set to a traditional 24-bit\n integer (e.g., `0x641666`), it is implicitly parsed as a 24-bit\n OUI.\n\n For larger or variable-length OUIs, a new explicit 48-bit format is\n supported: `0x[BitLengthInHex][5 OUI Bytes]` (e.g. `0x1c001a2b3000ULL`\n for 28-bit, and `0x24001a2b3c40ULL` for 36-bit). This format\n encodes both prefix length and value into a single integer, making\n it trivial to pass through command-line flags (e.g. `-D...`).\n\n- Compile-Time Validation: Introduced `VendorInfo::OuiParser` template\n class to parse and validate the configured OUI at compile-time\n (`static_assert`). It ensures invalid lengths, out-of-range\n configurations, or non-zero trailing bits fail the build\n immediately.\n\n- New APIs: Replaced legacy `uint32_t` representations with the\n `otThreadVendorOui` containing `mBitLength` and a 5-byte buffer\n `mBytes`. Added new public APIs `otThreadGetVendorOuiInfo()` and\n `otThreadSetVendorOuiInfo()`, while deprecating the older 24-bit OUI\n getters and setters.\n\n- Border Agent \u0026 CLI Updates:\n - Updated Border Agent TXT data generation (`vo` key) and parsing\n to correctly handling of new OUI lengths.\n - Updated CLI command utilities to output variable-length OUI bytes\n formatted correctly.\n - Added new `test_vendor_oui.cpp` unit tests to thoroughly validate\n compile-time parsing and runtime class logic." }, { "commit": "ac689dd9a4f659f04e8e4404f798e0b529f14c30", "tree": "4004de2ac2f6441674efa991c7cadb40dca0e2a2", "parents": [ "9b8d5b747194f8210df7e08fc404785c3f8bbd71" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Tue Jun 23 11:05:15 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jun 23 11:05:15 2026 -0700" }, "message": "[mac] redesign Information Element (IE) processing and generation (#13263)\n\nThis commit redesigns IEEE 802.15.4 Information Element (IE) handling by\nintroducing dedicated subclass definitions (`CslIe`, `TimeIe`,\n`ConnectionIe`, `RendezvousTimeIe`, `LinkMetricsProbingIe`, etc.) inheriting\nfrom `HeaderIe` or `VendorIe`.\n\nIn addition, `Mac::Frame` is updated with generic template methods:\n- `Has\u003cIeType\u003e()`: Checks if the frame contains a well-formed instance of\n the specified IE subclass.\n- `Find\u003cIeType\u003e()`: Finds, validates and returns a type-safe pointer to the\n IE.\n\nKey benefits of this redesign:\n\n- Streamlined IE Generation: Constructing and populating IEs is significantly\n simplified. Each subclass exposes a unified `Init()` method that cleanly\n computes the exact IE content length, sets the Element ID and known content\n (e.g. vendor OUI) in a single step.\n\n- True Encapsulation: Each IE subclass serves as the single source of truth\n for its Element ID (`kId`), content layout, and structural validation logic\n (`IsValid()`). Callers no longer pass magic ID constants or perform\n error-prone pointer arithmetic.\n\n- By implementing `HeaderIe::ValidateAs\u003cIeType\u003e()` as a static polymorphic\n matcher passed to `FindHeaderIe()`, the compiler devirtualizes\n and inlines ID match and content verifications directly into MAC frame\n parsing loops.\n\n- Scalable Integration: Adding new Information Elements is trivial. Defining\n a new subclass automatically equips MAC frame handling with type-safe\n search without bloating `Mac::Frame` with ad-hoc getter methods." }, { "commit": "9b8d5b747194f8210df7e08fc404785c3f8bbd71", "tree": "7eaf1500ac6d4277bb2545819698cae71798e88b", "parents": [ "7874555efb1772bad66049ab06a78a2ce0c925f3" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Tue Jun 23 10:22:30 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jun 23 10:22:30 2026 -0700" }, "message": "[cli] add CLI commands for testing `otPlatTcp` APIs (#13204)\n\nThis commit introduces a new `plattcp` CLI command designed primarily\nfor testing and evaluating `otPlatTcp` platform implementations.\n\nThe new CLI provides commands to manually drive the platform TCP API.\n\nThese commands act as a thin wrapper around the `Ip6::PlatTcp`\nclasses, allowing to manually invoke and observe connection events,\nstates, and data reception from a console. The feature is guarded by\n`OPENTHREAD_CONFIG_CLI_PLAT_TCP_ENABLE`." }, { "commit": "7874555efb1772bad66049ab06a78a2ce0c925f3", "tree": "a4d4bf0f131117aac847525d1776b1e94d21d400", "parents": [ "6e8570e233c18adfafe8db08b3aa142339799cb5" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Mon Jun 22 17:32:35 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 22 17:32:35 2026 -0700" }, "message": "[mle] separate router and leader upgrade thresholds (#13227)\n\nThis commit separates the single `ROUTER_UPGRADE_THRESHOLD` into two\ndistinct concepts: a local threshold for role transitions (used by a\nREED deciding when to upgrade) and a leader threshold (used by the\nLeader deciding whether to accept a router upgrade request).\n\nThis prepares for adding support for a new Router Config feature,\nwhere the local threshold can be changed while the threshold used\nwhen the device acts as a leader must remain the spec-defined value.\n\nTo preserve backward compatibility with existing tests and tools,\n`otThreadSetRouterUpgradeThreshold` continues to set both thresholds\nsimultaneously.\n\nSeveral Nexus test scenarios have been updated to explicitly set\nthe new leader threshold alongside the local router threshold." }, { "commit": "6e8570e233c18adfafe8db08b3aa142339799cb5", "tree": "4a41808ca00ae7c97d80b6dc10a9ddb4825f9c8e", "parents": [ "ff121bfce3ce0fab05fa1188ca89cab83c9b3e0c" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Mon Jun 22 15:10:22 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 22 15:10:22 2026 -0700" }, "message": "[mac] enforce single initialization lifecycle for `TxFrames` (#13264)\n\nThis commit refactors `Mac::Links` and `Mac` frame preparation to ensure\n`TxFrames` buffers are initialized (`Clear()`) exactly once per TX cycle.\n\nSpecifically, this commit:\n- Replaces `Links::GetTxFrames()` with `Links::InitTxFrames()`, which\n encapsulates calling `Clear()` on `mTxFrames` prior to returning its\n reference. This prevents callers from retrieving uninitialized or dirty\n transmission buffers from a previous radio cycle.\n- Updates `PrepareBeaconRequest()` and `PrepareBeacon()` to accept the\n initialized `TxFrames \u0026` reference directly as a parameter, making the\n data flow explicit.\n- Replaces non-const `GetTxFrames()` calls in `HandleTransmitDone()` with\n `GetTxFramesRequiredRadioTypes()`, enforcing const-correctness during\n TX completion handling." }, { "commit": "ff121bfce3ce0fab05fa1188ca89cab83c9b3e0c", "tree": "c03301602c4ee1a1e2efe1ea21bb7a51a7460655", "parents": [ "4394c0944b9b96f449cd2556ea5b2c1be002ed93" ], "author": { "name": "Zhangwx", "email": "zhangwenxu@espressif.com", "time": "Tue Jun 23 05:59:38 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 22 14:59:38 2026 -0700" }, "message": "[spinel] fix out-of-bounds read in GetNextSavedFrame when RCP recover (#13189)" }, { "commit": "4394c0944b9b96f449cd2556ea5b2c1be002ed93", "tree": "05cc5e674053ace7f1b334c9bdfffeebf815cc45", "parents": [ "5f9fe671e92b57af4754a7a005a335bf1b0b7592" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Mon Jun 22 13:46:52 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 22 13:46:52 2026 -0700" }, "message": "[mac] simplify and enhance Header IE processing (#13261)\n\nThis commit refactors `Mac::HeaderIe` generation and parsing to\nimprove code readability, type safety, and bounds checking.\n\nKey changes include:\n- Adds `HeaderIe::GetSize()` and `HeaderIe::GetContent()` to\n encapsulate pointer arithmetic inside the class and eliminate ad-hoc\n pointer offset math across `Mac` modules.\n- Updates `Frame::FindPayloadIndex()`, `Frame::GetHeaderIe()`,\n `Frame::GetThreadIe()`, and `Frame::GetTimeIe()` to utilize the\n new helper methods, simplifying boundary checks.\n- Simplifies `HeaderIe::Init()` by replacing the union with a clearer\n `mLenIdType` field and updating the internal bitwise operations\n to use `bit_utils.hpp` helper methods." }, { "commit": "5f9fe671e92b57af4754a7a005a335bf1b0b7592", "tree": "218358c742683eb2d273e2c1e2bf1a8729272296", "parents": [ "879b54bc2929da221253b12e52b3149602db48e2" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Mon Jun 22 10:28:27 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 22 10:28:27 2026 -0700" }, "message": "[mesh-diag] support requesting extra TLVs during topology discovery (#13257)\n\nThis commit enhances the Mesh Diag topology discovery process\n(`otMeshDiagDiscoverTopology()`) by allowing users to request an array\nof extra Network Diagnostic TLVs from each discovered router.\n\nKey changes:\n- Extended `otMeshDiagDiscoverConfig` to include an `mExtraTlvTypes`\n array and `mExtraTlvTypesLength`.\n- Added the `otMeshDiagTlvIterator` opaque type and\n `otMeshDiagGetNextTlvInfo()` API to iterate over the parsed extra\n TLVs retrieved from each router.\n- Exposed the new `TlvIterator` via `otMeshDiagRouterInfo` in the\n `otMeshDiagDiscoverCallback`.\n- Updated `MeshDiag::DiscoverTopology()` to dynamically include the\n extra TLVs in the CoAP diagnostic request, along with robust\n validation ensuring standard TLVs are not requested twice.\n- Introduced `test_mesh_diag.cpp` under Nexus to validate base\n discovery, IPv6 and Child Table discovery, extra TLV retrieval,\n and API argument validation." }, { "commit": "879b54bc2929da221253b12e52b3149602db48e2", "tree": "45a89363317f1122b11a00a15ac091808de984ec", "parents": [ "9cc2cb3e96b8282fdc31725bcb397eceb7f4a53a" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Jun 22 09:38:22 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 22 09:38:22 2026 -0700" }, "message": "github-actions: bump umbrelladocs/action-linkspector from 1.5.1 to 1.5.4 (#13267)\n\nBumps [umbrelladocs/action-linkspector](https://github.com/umbrelladocs/action-linkspector) from 1.5.1 to 1.5.4.\n- [Release notes](https://github.com/umbrelladocs/action-linkspector/releases)\n- [Commits](https://github.com/umbrelladocs/action-linkspector/compare/963b6264d7de32c904942a70b488d3407453049e...6c637d70424624231467a4ca918be54fa3b792d0)\n\n---\nupdated-dependencies:\n- dependency-name: umbrelladocs/action-linkspector\n dependency-version: 1.5.4\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "9cc2cb3e96b8282fdc31725bcb397eceb7f4a53a", "tree": "ed4b2348b163f1b57b2d6778dd73f1b1be7ea1a5", "parents": [ "54323a2953773edc1d18e90c44fb4f19b7f82ee4" ], "author": { "name": "Tongze Wang", "email": "tongze@google.com", "time": "Thu Jun 18 23:31:40 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jun 18 10:31:40 2026 -0500" }, "message": "[spinel] improve RCP crash dump request logic (#13150)\n\nThis commit updates the RCP crash dump request logic to provide better\ndebug information while ensuring the recovery process is not interrupted:\n- `RadioSpinel::HandleRcpUnexpectedReset` now explicitly clears\n `mWaitingTid` and requests a crash dump if RCP restoration is disabled\n before proceeding with the abort / exit logic. If RCP restoration is\n enabled, request for crash dump will be deferred to `RecoverFromRcpFailure`,\n before resetting the coprocessor.\n- Updates crash dump requests to use `IgnoreReturnValue` instead.\n Failing to retrieve a crash dump is not a fatal error and should not\n halt the initialization or recovery process." }, { "commit": "54323a2953773edc1d18e90c44fb4f19b7f82ee4", "tree": "ffe9c1151afbae6848faf759ad1046212e1cd14c", "parents": [ "da08ac73fd31b2bc725093cf88eb614dc12b478a" ], "author": { "name": "Luc1fer", "email": "b.purewsuren123@gmail.com", "time": "Thu Jun 18 23:25:50 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jun 18 10:25:50 2026 -0500" }, "message": "[mle] reject malformed Network Data in Child ID Response (#13213)\n\nThis change makes MLE Child ID Response handling fail safely when the\nNetwork Data TLV is present but cannot be parsed or applied.\n\nThe attach path requires Network Data in a Child ID Response. This\npatch checks the result of applying the Network Data TLV and avoids\ncompleting attach if the required Network Data cannot be applied.\n\nSigned-off-by: OneThing4101 \u003cb.purewsuren123@gmail.com\u003e" }, { "commit": "da08ac73fd31b2bc725093cf88eb614dc12b478a", "tree": "319037c2f07400da6aa33416b23660e4780ff187", "parents": [ "9c8374a44c9cc08c76273aca96442c796ff3f916" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Tue Jun 16 06:52:59 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jun 16 08:52:59 2026 -0500" }, "message": "[netdiag] refactor network diagnostics TLV parsing (#13247)\n\nThis commit refactors the TLV parsing logic within the Network\nDiagnostics `Client`.\n\nThe monolithic `GetNextDiagTlv` method has been refactored. The large\nswitch statement that parsed individual TLV payloads was extracted\ninto a dedicated `ParseDiagTlv` helper method. This separation of\nconcerns cleans up the `while` loop that iterates over TLVs,\nimproving readability and making future TLV parsing updates easier.\nThe new `ParseDiagTlv()` method can also be used in the future by\nother modules such as `MeshDiag`.\n\nAdditionally, `ParseEnhancedRoute()` was refactored and simplified\nto be a member method instead of a static standalone function,\nutilizing the newly introduced `EnhRoute` typedef." }, { "commit": "9c8374a44c9cc08c76273aca96442c796ff3f916", "tree": "b0b4fbcf52761c68d80828dbcc9107e44722ff20", "parents": [ "0a6d0e793fd4e83c1cfc3fff7c199d40ac9d101c" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Tue Jun 16 06:39:05 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jun 16 08:39:05 2026 -0500" }, "message": "[netdiag] extract answer sending logic into `AnswerSender` (#13242)\n\nThis commit introduces the `NetDiag::AnswerSender` class to manage the\ntransmission of multipart CoAP answer messages for Network Diagnostics\nand History Tracker queries.\n\nPreviously, both `NetDiag::Server` and `HistoryTracker::Server`\ncontained duplicated logic to queue allocated answer messages, track\nresponses, and send subsequent messages one by one using an internal\nCoAP message queue.\n\nBy extracting this into the new `AnswerSender` class, it eliminates the\nredundancy in message queue management, freeing of related answers, and\nCoAP response handling across both modules. The `AnswerSender` takes\nownership of the messages generated by an `AnswerBuilder` and manages\nthe asynchronous transmission lifecycle." }, { "commit": "0a6d0e793fd4e83c1cfc3fff7c199d40ac9d101c", "tree": "48dc9d38dddd2c2073ac781744bc5dde12935fe4", "parents": [ "a411e563d6276f4ddbd50b6091f24f161dc5d5ff" ], "author": { "name": "Yakun Xu", "email": "xyk@google.com", "time": "Mon Jun 15 22:38:43 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 15 09:38:43 2026 -0500" }, "message": "[radio] remove unused mCslPresent (#13232)\n\nThis commit removes RadioContext.mCslPresent. Instead we directly\ncheck whether the CSL is in the frame data, so there is not risk of\nmismatch." }, { "commit": "a411e563d6276f4ddbd50b6091f24f161dc5d5ff", "tree": "1db83c4d70ce5e82bbe48a98bd96630067ebce5c", "parents": [ "f83394276982777eb0aa3f530fb4511cf1f6989e" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Mon Jun 15 07:31:47 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 15 09:31:47 2026 -0500" }, "message": "[mle] remove unused router threshold variables (#13239)\n\nThis commit removes `mRouterUpgradeThreshold` and\n`mRouterDowngradeThreshold` from the `Mle` class. These variables\nwere previously moved into the `RoleTransitioner` class, but their\ndeclarations in `Mle` were left behind. Removing them cleans up the\nclass definition and eliminates unused state." }, { "commit": "f83394276982777eb0aa3f530fb4511cf1f6989e", "tree": "aed1c79a967c882e1235f3ffe7bba4edc05978c7", "parents": [ "bf9d441ebd7468987391bd29f7c1ba8edecc9e46" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Mon Jun 15 07:30:22 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 15 09:30:22 2026 -0500" }, "message": "[netdiag] extend `AnswerBuilder` to support `HistoryTracker` (#13235)\n\nThis commit extends the `NetDiag::AnswerBuilder` class to support\ngenerating and managing answer messages for the `HistoryTracker` module.\n\nThis refactor eliminates redundant implementation in\n`HistoryTracker::Server`, removing its internal `AnswerInfo` struct\nand related message allocation and length checking methods, replacing\nthem with the unified `NetDiag::AnswerBuilder` workflow." }, { "commit": "bf9d441ebd7468987391bd29f7c1ba8edecc9e46", "tree": "f58bc8c35e27dff450d5298b893340157a759fb0", "parents": [ "252918bf10cf3ef8abdb1904178d543f6dc1e150" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Jun 15 09:24:53 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 15 09:24:53 2026 -0500" }, "message": "github-actions: bump step-security/harden-runner from 2.14.2 to 2.19.4 (#13246)\n\nBumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.14.2 to 2.19.4.\n- [Release notes](https://github.com/step-security/harden-runner/releases)\n- [Commits](https://github.com/step-security/harden-runner/compare/5ef0c079ce82195b2a36a210272d6b661572d83e...9af89fc71515a100421586dfdb3dc9c984fbf411)\n\n---\nupdated-dependencies:\n- dependency-name: step-security/harden-runner\n dependency-version: 2.19.4\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "252918bf10cf3ef8abdb1904178d543f6dc1e150", "tree": "0428f880f7fdf416279b126b3ba95ffe1b49d4f2", "parents": [ "b1d41504264e179a34dd7bc2b5c6490cd26b7f9a" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Fri Jun 12 10:47:40 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jun 12 10:47:40 2026 -0700" }, "message": "[tmf] introduce `SendResponseWithStateTlv()` helper (#13238)\n\nThis commit adds `SendResponseWithStateTlv()` to `Tmf::Agent` to\nstreamline sending TMF responses that consist solely of a `StateTlv`.\n\nBy encapsulating message allocation, TLV appending, and message\ntransmission into a single method, this reduces duplicate boilerplate\ncode across `DatasetManager`, `Leader`, and `NetworkData::Leader`." }, { "commit": "b1d41504264e179a34dd7bc2b5c6490cd26b7f9a", "tree": "b3570c10d88b4496170a8f91acc61d797d51aa23", "parents": [ "fcf7b4cef5b18118e66203f9639b9f0edec16897" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Thu Jun 11 20:22:29 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jun 11 20:22:29 2026 -0700" }, "message": "[posix] implement `otPlatTcp` platform abstraction (#13193)\n\nThis commit provides a complete POSIX implementation of the new\n`otPlatTcp` platform abstraction APIs. It leverages the existing\nOpenThread `Mainloop` polling mechanism to build a fully event-driven,\nnon-blocking TCP socket implementation without requiring extra threads.\n\nKey features and implementation details:\n- Uses `Mainloop` read/write/error sets to monitor socket states.\n- Implements `otPlatTcpEnableListener` and `otPlatTcpAccept` to handle\n incoming connection requests over IPv6.\n- Implements `otPlatTcpConnect` for asynchronous non-blocking outgoing\n TCP connections, monitoring `SO_ERROR` to detect handshake completion.\n- Handles data transmission utilizing `otPlatTcpIsTxPending` to\n monitor the write descriptor and correctly signal `HandleTxReady`.\n- Implements `otPlatTcpSend` and `otPlatTcpReceive` ensuring proper\n buffering, suppressing `SIGPIPE` safely using `SO_NOSIGPIPE` and\n `MSG_NOSIGNAL`.\n- Encodes socket file descriptors directly within the platform data\n `mData.mDescriptor` union, avoiding dynamic memory allocation." }, { "commit": "fcf7b4cef5b18118e66203f9639b9f0edec16897", "tree": "5443bae40e87b7f592b5a8c48d69d5d694276ade", "parents": [ "11acd4a26eca9898debdcd145579d42fd45d74e3" ], "author": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Thu Jun 11 18:00:57 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jun 11 18:00:57 2026 -0700" }, "message": "[spi-hdlc-adapter] define explicit worst-case HDLC frame size macro (#13237)\n\nThis commit replaces the implicit sizing of `escaped_frame_buffer`\nwith an explicit macro `HDLC_MAX_FRAME_SIZE` in the standalone\n`spi-hdlc-adapter` tool.\n\nPreviously, `escaped_frame_buffer` was sized statically to\n`MAX_FRAME_SIZE * 2` (4096 bytes). While this size is mathematically\nsufficient to hold a worst-case escaped payload (4091 bytes for a\n2043-byte max payload, 4 escaped CRC bytes, and 1 flag byte), it was\nnot self-documenting and relied on implicit math.\n\nThis commit defines `HDLC_MAX_FRAME_SIZE` explicitly as:\n`((MAX_FRAME_SIZE - HEADER_LEN) * 2 + 5)`\nmaking the worst-case framing overhead bounds clear and robust to\nany future changes to the constants." }, { "commit": "11acd4a26eca9898debdcd145579d42fd45d74e3", "tree": "044f786c5233635fac57ddc51b801f214aaedd6d", "parents": [ "1f8d9224652a872bb83b945612a5683afdad1fa4" ], "author": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Thu Jun 11 18:00:38 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jun 11 18:00:38 2026 -0700" }, "message": "[posix] fix SPI platform driver sanity check boundaries (#13236)\n\nThis commit corrects the SPI frame sanity checks in the POSIX platform\ndriver (`spi_interface.cpp`).\n\nPreviously, the sanity checks compared `mSpiSlaveDataLen` and\n`slaveAcceptLen` against `kMaxFrameSize` (8192). However,\n`mSpiSlaveDataLen` is the payload size, which excludes the 5-byte SPI\nframe header. If the slave advertised a data length of exactly\n`kMaxFrameSize` (8192), it would pass the sanity check, but the\nsubsequent `DoSpiTransfer` would request a transfer length of\n`kMaxFrameSize + kSpiFrameHeaderSize + alignment` (e.g. 8213 bytes).\nThis would cause an out-of-bounds read on `mSpiTxFrameBuffer` which is\nsized `kMaxFrameSize + kSpiAlignAllowanceMax` (8208 bytes).\n\nThis commit updates the sanity checks to use\n`kMaxFrameSize - kSpiFrameHeaderSize` as the maximum allowed payload\nlength, ensuring that worst-case transfers always fit within the\ntx buffer allocation." }, { "commit": "1f8d9224652a872bb83b945612a5683afdad1fa4", "tree": "c8cbf87b5414a450b3f59a7d11fedb0dcec223f2", "parents": [ "5e68d008b5ffa3d3a62fd720e8ee205a2f60de5d" ], "author": { "name": "evilgensec", "email": "evil.gen.sec@gmail.com", "time": "Fri Jun 12 05:03:19 2026 +0545" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jun 11 16:18:19 2026 -0700" }, "message": "[spi-hdlc-adapter] validate RCP frame lengths against the MTU (#13206)\n\nThe slave (RCP) controls the `data_len` and `accept_len` fields of the SPI\nheader. Both carry a payload length that excludes the 5-byte header, as\nshown by `sMTU \u003d MAX_FRAME_SIZE - HEADER_LEN`, so the largest valid value\nis the MTU, `MAX_FRAME_SIZE - HEADER_LEN`.\n\nThe two sanity checks in `push_pull_spi()` only rejected values greater\nthan `MAX_FRAME_SIZE`, allowing an RCP to advertise a length in the range\n(MAX_FRAME_SIZE - HEADER_LEN, MAX_FRAME_SIZE]. That value flows into\n`spi_xfer_bytes`, and `do_spi_xfer()` then transfers\n`spi_xfer_bytes + HEADER_LEN + sSpiRxAlignAllowance` bytes into\n`sSpiRxFrameBuffer` / `sSpiTxFrameBuffer`. Those buffers are sized\n`MAX_FRAME_SIZE + SPI_RX_ALIGN_ALLOWANCE_MAX`, so the extra HEADER_LEN\nadded by the transfer can write up to 5 bytes past the end of both.\n\nClamp both checks to `MAX_FRAME_SIZE - HEADER_LEN` so the advertised\npayload plus the header always fits within the existing buffers." }, { "commit": "5e68d008b5ffa3d3a62fd720e8ee205a2f60de5d", "tree": "92cffede69f1f7f45bbbf1a656bab683a8ab49d3", "parents": [ "0fbee98fd50386fa836e5faa8ee25ac99449f007" ], "author": { "name": "Jake Swensen", "email": "jake.swensen@smartthings.com", "time": "Thu Jun 11 13:50:41 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jun 11 11:50:41 2026 -0700" }, "message": "[posix] add build time config of netinf loss (#13192)\n\nAllow build time configuration of `OPENTHREAD_POSIX_CONFIG_EXIT_ON_INFRA_NETIF_LOST_ENABLE`" }, { "commit": "0fbee98fd50386fa836e5faa8ee25ac99449f007", "tree": "71a6efce3e243b157207c1a0f06e609a7c5e502d", "parents": [ "a055c4b9b8e3d57ff42138b8c62cd850574a079b" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Wed Jun 10 10:24:34 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jun 10 10:24:34 2026 -0700" }, "message": "[crypto] simplify `AesCcm` public APIs and introduce internal `Engine` (#13215)\n\nThis commit refactors the `AesCcm` class to simplify its public interface,\ndecoupling the high-level API from the underlying cryptographic execution.\n\nKey improvements:\n- Redesigned the API from a series of procedural method calls\n (`Init()`, `Header()`, `Payload()`, `Finalize()`) into a unified,\n stateful model. Callers now pre-configure the operation parameters using\n dedicated setters (`SetKey()`, `SetNonce()`, `SetAuthData()`,\n `SetTagLength()`) and execute the entire cryptographic operation in a\n single step via unified `Process()` methods.\n- Introduced a nested `Engine` class to encapsulate the low-level AES-CCM\n mathematical and cryptographic state. The `Engine` provides clean internal\n interfaces for both optimized one-shot (single-part) and multi-part\n operations.\n- This architectural separation allows the outer `AesCcm` class to focus on\n parameter validation, high-level buffer management, and complex `Message`\n chunk iterations, while the `Engine` remains focused purely on the\n cryptographic core. This also provides a clean extension point to easily\n route one-shot operations to platform-specific hardware acceleration APIs\n in the future.\n- Updated `Mac` and `Mle` modules to use the simplified APIs, reducing\n boilerplate code.\n- Retained a static `Perform()` wrapper to support the legacy public\n `otCrypto` API.\n- Updated unit tests to validate the new stateful interfaces, including\n robust in-place message chunk processing and separate-buffer\n validations." }, { "commit": "a055c4b9b8e3d57ff42138b8c62cd850574a079b", "tree": "87411492ad68966c7828e41d8be1a4d7a1154505", "parents": [ "1b805618025e406f85227187e3f2bc0b73fa17bd" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Wed Jun 10 10:23:06 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jun 10 10:23:06 2026 -0700" }, "message": "[platform] define `otPlatTcp` platform abstraction APIs (#13175)\n\nThis commit introduces a new platform abstraction layer for TCP\nconnections and listeners, enabling OpenThread to leverage platform-\nprovided TCP stacks. The API is designed for asynchronous, event-driven\nenvironments and can easily support POSIX as well as various embedded\nnetwork stacks.\n\nIn the core, `Ip6::PlatTcp` and its nested `Connection` and `Listener`\nclasses are introduced to manage these platform interactions, providing\na clean C++ interface for the OpenThread core. The `PlatTcp` manager\nis integrated into the `Instance` class and utilizes `Tasklet` for\nasynchronous resource cleanup.\n\nAdditionally, this commit adds a comprehensive unit test to verify the\nTCP platform abstraction and `Ip6::PlatTcp` implementation. The tests\ncover listener and connection lifecycles, data flow, flow control,\nincoming connection acceptance, and active object iteration." }, { "commit": "1b805618025e406f85227187e3f2bc0b73fa17bd", "tree": "d7bc3d867cb1e51d364fb0caf63fd0c813905e78", "parents": [ "a49c1f5c9811ec6bd8df1991839fd70e54a0f8e6" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Tue Jun 09 08:40:38 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jun 09 08:40:38 2026 -0700" }, "message": "[mle] introduce `AesCcmAuthData` for message security processing (#13210)\n\nThis commit refactors `Mle::ProcessMessageSecurity()` to use a new packed\nstructure, `AesCcmAuthData`, to represent the authenticated data used during\nAES-CCM security processing.\n\nThe `AesCcmAuthData` structure encapsulates the sender and receiver IPv6\naddresses along with the Auxiliary Security Header. By packing these fields\ntogether, we can pass them as a single contiguous buffer to `AesCcm::Header()`.\nThis eliminates the need for multiple separate calls to `AesCcm::Header()`\nand allows the removal of the generic template-based `Header\u003cObjectType\u003e()`\nmethod in the `AesCcm` class.\n\nCallers to `ProcessMessageSecurity()` have been updated to populate the\n`AesCcmAuthData` structure before passing it for processing." }, { "commit": "a49c1f5c9811ec6bd8df1991839fd70e54a0f8e6", "tree": "dfb7c5df295e7c2359990c48e9669d7bbf30fd7d", "parents": [ "c238bd9a625c2394ccb592a1aa5a8afab6762207" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Mon Jun 08 20:44:46 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 08 20:44:46 2026 -0700" }, "message": "[mle] introduce `ComposeMeshLocalAddress()` helper method (#13225)\n\nThis commit introduces a new `ComposeMeshLocalAddress()` helper method\nin the `Mle` class. This method constructs a full IPv6 Address by\ncombining the Mesh-Local Prefix with a provided Interface Identifier (IID).\n\nBy using this helper, we eliminate the repetitive two-step process of\ncalling `SetPrefix()` followed by `SetIid()` previously scattered across\n`Commissioner`, `AddressResolver`, `Child`, and unit tests. This\nimproves code readability and correctly encapsulates address composition\nlogic within the `Mle` module." }, { "commit": "c238bd9a625c2394ccb592a1aa5a8afab6762207", "tree": "1b18afc7c04b994ce266dc5706722b0a9cef53b0", "parents": [ "8abf9667c3dbc782c9436b27b91e91ce38f2f15d" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Mon Jun 08 19:43:31 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 08 19:43:31 2026 -0700" }, "message": "[ip6] remove `InitAsRoutingLocator` and `InitAsAnycastLocator` (#13222)\n\nThis commit replaces `Ip6::Address::InitAsRoutingLocator()` and\nthe now unused `Ip6::Address::InitAsAnycastLocator()` with the\nsingle unified method `Ip6::Address::InitAsLocator()`.\n\nCallers in `Mle` have been updated to use the unified method." }, { "commit": "8abf9667c3dbc782c9436b27b91e91ce38f2f15d", "tree": "a43a80b8e86a7f5e192f7d8b67fe3cd5a2db39fe", "parents": [ "87b971ef96bbaac26ae82d2a2364508754994acb" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Mon Jun 08 19:34:19 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 08 19:34:19 2026 -0700" }, "message": "[common] refactor `FrameBuilder` and `FrameData` to use templated API (#13216)\n\nThis commit refactors the `FrameBuilder` and `FrameData` modules,\nreplacing multiple distinct endian-specific methods with a unified,\ntype-safe templated API.\n\nKey changes:\n- Introduced `enum Encoding` (`kBigEndian`, `kLittleEndian`) and a\n templated `HostSwap\u003cEncoding, UintType\u003e` helper in `encoding.hpp` to\n centralize byte-swapping logic.\n- Replaced `AppendBigEndianUint16()`, `AppendLittleEndianUint32()`,\n and other variations in `FrameBuilder` with a single templated\n method: `AppendUint\u003cEncoding, UintType\u003e()`.\n- Replaced `ReadBigEndianUint16()`, `ReadLittleEndianUint32()`,\n and other variations in `FrameData` with a single templated\n method: `ReadUint\u003cEncoding, UintType\u003e()`.\n- Updated all callers in `Lowpan` and `Mac` modules to use the new\n templated encoding APIs.\n- Updated `test_frame_builder.cpp` to validate the new syntax." }, { "commit": "87b971ef96bbaac26ae82d2a2364508754994acb", "tree": "810c452eb7c335890c2385f713f88da6d593df33", "parents": [ "44f5382330a0480ef7b5f2b99bbcda937b471dd9" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Mon Jun 08 19:33:49 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 08 19:33:49 2026 -0700" }, "message": "[child-table] use `Array` to manage `mChildren` (#13217)\n\nThis commit replaces the raw array `mChildren` in `ChildTable` with\nthe `Array` class from the common utilities.\n\nBy switching to `Array`, we can leverage its built-in array management,\nbounds checking, and iterator support. This removes boilerplate code\nassociated with keeping track of `mMaxChildrenAllowed` and simplifies\nmethods like `GetChildAtIndex`, `FindChild`, `HasChildren`, and\n`GetNumChildren` by using `Array` methods.\n\nAdditionally, the commit renames `Neighbor::MatchesFilter()` to simply\n`Neighbor::Matches()`, which aligns with the expected indicator matching\nAPI used by `Array` and `LinkedList`." }, { "commit": "44f5382330a0480ef7b5f2b99bbcda937b471dd9", "tree": "73153975ba35fce3b4a77fb8f4aa4d2f1ea98675", "parents": [ "2d602dcd9c4da062b2035dc4e61d166f459d9c08" ], "author": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Mon Jun 08 19:33:10 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 08 19:33:10 2026 -0700" }, "message": "[mac] update HasCslIe and refactor GetTimeIe for robust IE parsing (#13224)\n\nThis commit introduces two robustness improvements to Header Information\nElement (IE) parsing in Frame:\n\n1. Aligned HasCslIe() with GetCslIe():\nPreviously, HasCslIe() returned true if a Header IE matching the CSL ID\nwas present, regardless of whether its declared content length was valid\n(\u003e\u003d 4 bytes). Updating HasCslIe() to check GetCslIe() !\u003d nullptr ensures\nthat presence checks enforce the same length validation as retrieval,\npreventing callers from assuming a malformed CSL IE is valid.\n\n2. Robust Multi-Vendor IE Iteration in GetTimeIe():\nGetTimeIe() previously retrieved the Vendor IE by matching ID 0x00\nusing GetHeaderIe(), which returns only the first matching element. If\na frame contained multiple Vendor IEs (e.g., a standard Thread Vendor IE\nfollowed by a Nest Time Vendor IE), GetTimeIe() inspected only the\nfirst element, failed the OUI check, and returned nullptr. GetTimeIe()\nis refactored to iterate through all Header IEs until a matching Nest\nOUI and Time SubType are found, ensuring correct discovery across\nmulti-vendor frames." }, { "commit": "2d602dcd9c4da062b2035dc4e61d166f459d9c08", "tree": "597a076c35cfe4a302560a4f3b1818bfa768d42c", "parents": [ "baaf93a74f52bc9f229e81be5812b1fcc8820571" ], "author": { "name": "Esko Dijk", "email": "esko.dijk@iotconsultancy.nl", "time": "Fri May 22 11:17:16 2026 +0200" }, "committer": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Mon Jun 08 14:47:21 2026 -0700" }, "message": "[ble] update BLE API docs to make platform\u0027s BLE advertising explicit (#12913)\n\nAlso, changes term \u0027method\u0027 to correct term \u0027function\u0027.\n" }, { "commit": "baaf93a74f52bc9f229e81be5812b1fcc8820571", "tree": "f97271c64ede4ad55202bd97e4bf31624ecc00e9", "parents": [ "926dc828d276f4290c9baee08f7934bbfe161d3f" ], "author": { "name": "Esko Dijk", "email": "esko.dijk@iotconsultancy.nl", "time": "Mon May 18 14:53:28 2026 +0200" }, "committer": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Mon Jun 08 14:47:21 2026 -0700" }, "message": "[tcat][ble] update BLE API with missing error status values and aInterval details (#12913)\n\nBoth otPlatBleGapAdvSetData() and otPlatBleGapAdvUpdateData() now have the same set of retvals.\nThe aInterval parameter is explained better: it\u0027s a request/hint to the BLE platform for the\nadvertising interval, but not a requirement.\n" }, { "commit": "926dc828d276f4290c9baee08f7934bbfe161d3f", "tree": "759ddcc7917701c7e02b8b38b343b4ace85c73ab", "parents": [ "ec498f0c0e80da56d999f4c8263893bff79d8d8a" ], "author": { "name": "Esko Dijk", "email": "esko.dijk@iotconsultancy.nl", "time": "Mon May 18 14:50:30 2026 +0200" }, "committer": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Mon Jun 08 14:47:21 2026 -0700" }, "message": "[tcat][ble] improve internal state management of ble simulation platform (#12913)\n\nThis adds sIsEnabled for more realistic BLE simulation platform behavior. Also\nimproves internal disconnection state management, per review comments.\n\nAdds asynchronous calling of otPlatBleGapOnDisconnected() to avoid doing the\n\u0027disconnected\u0027 callback twice, per review comments. A unit test is extended to\nverify that the callback happens once.\n\nFor test_platform.cpp 2 instances of \u0027#ifdef\u0027 are fixed to \u0027#if\u0027.\n" }, { "commit": "ec498f0c0e80da56d999f4c8263893bff79d8d8a", "tree": "f250df72be54407c70212590488f3f36911bc751", "parents": [ "9403edeaafdd0e6da3579e29bc733474d6d3f84b" ], "author": { "name": "Esko Dijk", "email": "esko.dijk@iotconsultancy.nl", "time": "Mon May 04 15:47:05 2026 +0200" }, "committer": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Mon Jun 08 14:47:21 2026 -0700" }, "message": "[tcat][ble] introduce notifier events to update TCAT advertisement data / use bool for advertising state (#12913)\n\nTo get an update of TCAT advertisement data when the active dataset changes, notifier events are\nintroduced. This also refactors the existing adv update on MLE role change to use a notifier event.\n\nThis update now covers all cases where an application/CLI/user changes the active dataset, which should\nbe then reflected in TCAT advertisement flag values.\n\nThe \u0027requested advertising state\u0027 is refactored from a BleState to a bool, to make the code more\nreadable and avoid subtle errors.\n" }, { "commit": "9403edeaafdd0e6da3579e29bc733474d6d3f84b", "tree": "6068d1e53b310b90cf7e7d26cfc56a002e10262d", "parents": [ "fee7292f1518a2203ac1f4d1fb09c876dcbbb97b" ], "author": { "name": "Esko Dijk", "email": "esko.dijk@iotconsultancy.nl", "time": "Mon May 04 11:52:58 2026 +0200" }, "committer": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Mon Jun 08 14:47:21 2026 -0700" }, "message": "[tcat][ble] Fix BLE advertisement contents after Commissioner disconnect (#12913)\n\nThis fixes the issue observed in tests, that the BLE advertisement contents (flags) were not updated\nafter a TCAT Commissioner disconnects. A unit test is added for BLE advertisement contents to\nvalidate the advertisement data changes.\n\nIt also adds an explicit \u0027disconnect\u0027 CLI command to the TCAT expect tests, which wasn\u0027t tested\nbefore.\n" }, { "commit": "fee7292f1518a2203ac1f4d1fb09c876dcbbb97b", "tree": "8d96fd3089bf15a685d502746e25516513756670", "parents": [ "c801d291b37419180f1952c7231217313ee8410a" ], "author": { "name": "Esko Dijk", "email": "esko.dijk@iotconsultancy.nl", "time": "Fri Apr 17 11:48:46 2026 +0200" }, "committer": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Mon Jun 08 14:47:21 2026 -0700" }, "message": "[tcat][ble] update BLE API and related TCAT agent change to re-enable advertising after disconnect (#12913)\n\nThis fixes some ble.h issues and makes explicit that BLE advertising will stop once a client connects.\nThe TCAT agent is updated to re-enable advertising after a client disconnects (in the default case).\nThis fixes an issue observed in cert tests. For easier testing in the future, debug log messages are\nadded for the simulation BLE platform.\n\nThe simulation platform (ble.c) is improved to act more like a real BLE platform, by now supporting\nclient connection state and calling of otPlatBleGapOnConnected() and otPlatBleGapOnDisconnected().\nThis is required to manually test the TCAT Commissioner/Device flow in Posix simulation.\n" }, { "commit": "c801d291b37419180f1952c7231217313ee8410a", "tree": "e9958e0d48fe74ec95e385848650bd682c3d797e", "parents": [ "9b180d4c09ffb50ff14e52db51a76290d70ee6f9" ], "author": { "name": "Adil Burak Şen", "email": "56400880+adilburaksen@users.noreply.github.com", "time": "Tue Jun 09 00:30:09 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 08 14:30:09 2026 -0700" }, "message": "[mac] validate Header IE content length before reading IE structs (#13184)\n\nGetThreadIe(), GetCslIe(), and GetTimeIe() read a fixed content struct\n(VendorIeHeader / CslIe / TimeIe) at `ie + sizeof(HeaderIe)` after\nmatching the IE id, without first checking that the IE\u0027s Length field\ncovers that struct. FindPayloadIndex() only guarantees the IE header\nplus its declared Length fit within the frame, so a matching IE whose\nLength is shorter than the content struct (e.g. a zero-length vendor IE\nplaced at the end of the header-IE region) causes a read past the IE\ncontent, and past the PSDU buffer when the IE ends at the frame\nboundary.\n\nGate each content read on the IE Length being at least the\ncorresponding kIeContentSize before dereferencing the struct." }, { "commit": "9b180d4c09ffb50ff14e52db51a76290d70ee6f9", "tree": "baae2493e8f43a328cf1457027d2ee5b7f40739d", "parents": [ "260f44f2d355acf9fa8228086a051f430654246b" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Mon Jun 08 14:21:27 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 08 14:21:27 2026 -0700" }, "message": "[crypto] introduce `AesCcm::Nonce` for IEEE 802.15.4 nonce (#13208)\n\nThis commit introduces the `AesCcm::Nonce` class to represent the IEEE\n802.15.4 nonce byte sequence, replacing the previous `GenerateNonce()`\nmethod which operated on a raw byte array.\n\nReplacing `uint8_t *` buffers and `kNonceSize` with a dedicated, packed\n`Nonce` class makes the code cleaner and prevents potential buffer size\nmismatches at call sites. The new class provides an `InitFrom()` method\nto safely initialize the nonce from an extended address, frame counter,\nand security level.\n\nAll callers in `Mac` (frame transmission and reception) and `Mle`\n(message security) have been updated to use the new `Nonce` class." }, { "commit": "260f44f2d355acf9fa8228086a051f430654246b", "tree": "4eb14a80691e6c48c24f16648dff4122d7951d8d", "parents": [ "709a1b00a3441f895e694969dbc451bbf6d3bed3" ], "author": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Mon Jun 08 13:00:02 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 08 13:00:02 2026 -0700" }, "message": "[mesh-forwarder] evict insecure reassembly messages first (#13211)\n\nEnhance `MeshForwarder::EvictMessage` to prioritize evicting messages\nfrom `mReassemblyList` that were received without link security when\nreclaiming message buffers (reason `kEvictReasonNoMessageBuffer`).\n\nThis helps protect secure messages in the send queue from being\nevicted due to buffer exhaustion, by prioritizing the dropping of\ninsecure, potentially incomplete, reassembled fragments.\n\nBoth FTD and MTD implementations of `EvictMessage` are updated." }, { "commit": "709a1b00a3441f895e694969dbc451bbf6d3bed3", "tree": "01388210b30806215083d159a40df93d76d56d3f", "parents": [ "21c983f0fb16486f84882037faf5ca528987d009" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Jun 08 12:49:39 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 08 12:49:39 2026 -0700" }, "message": "github-actions: bump docker/setup-buildx-action from 3.11.1 to 4.1.0 (#13220)\n\nBumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.11.1 to 4.1.0.\n- [Release notes](https://github.com/docker/setup-buildx-action/releases)\n- [Commits](https://github.com/docker/setup-buildx-action/compare/e468171a9de216ec08956ac3ada2f0791b6bd435...d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5)\n\n---\nupdated-dependencies:\n- dependency-name: docker/setup-buildx-action\n dependency-version: 4.1.0\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "21c983f0fb16486f84882037faf5ca528987d009", "tree": "528b8c5e987bd40c7aad7a9e299db3dcb858a62e", "parents": [ "1316bcebc8a620372c769248f2d557e49f0ad768" ], "author": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Mon Jun 08 11:06:07 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 08 11:06:07 2026 -0700" }, "message": "[github-actions] update codecov-action pin to fb8b358 (v7.0.0) (#13221)\n\nThis commit updates the commit hash pin for codecov/codecov-action\nfrom 671740a (v5.5.2) to fb8b358 (v7.0.0) across all CI workflows.\n\nWorkflows updated:\n- otbr.yml\n- posix.yml\n- simulation.yml\n- toranj.yml\n- unit.yml" }, { "commit": "1316bcebc8a620372c769248f2d557e49f0ad768", "tree": "7632633c1e494b20ad5f554935ad1619fb27e038", "parents": [ "318b4b077176cf259ae838ac0632c395b4a19357" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Mon Jun 08 09:12:47 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 08 09:12:47 2026 -0700" }, "message": "[mle] introduce `ComposeRloc()` and `ComposeAloc()` (#13199)\n\nThis commit introduces `ComposeRloc()` and `ComposeAloc()` in the `Mle`\nmodule and updates the codebase to use them.\n\nThese methods streamline the construction of Routing Locators and\nAnycast Locators by automatically combining the Mesh-Local Prefix with\nthe provided RLOC16 or ALOC16. This centralizes address composition\nlogic within `Mle` instead of relying on manually formatting\n`Ip6::Address` instances across various modules." }, { "commit": "318b4b077176cf259ae838ac0632c395b4a19357", "tree": "e5151d5f10dbdfd41ec69995557db98b71ae56af", "parents": [ "c4a85578f5d779abc252fd27108d82bc2ecc011b" ], "author": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Thu Jun 04 19:36:33 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jun 04 19:36:33 2026 -0700" }, "message": "[bbr] remove domain prefix support from stack and harness (#13203)\n\nThis commit removes all Domain Prefix configuration and management logic\nfrom the OpenThread stack, CLI commands, unit tests, and GRL harness\nTHCI wrapper.\n\n- Removed public Backbone Router Domain Prefix APIs.\n- Removed Domain Prefix flag (\u0027mDp\u0027) and \u0027D\u0027 flag parser/formatter\n from core network data types, Spinel, and CLI.\n- Cleaned up local Backbone Router and Leader logic to exclude Domain\n Prefix configuration, tracking, and events.\n- Updated RoutingManager prefix advertisement (RIO) to exclude\n special handling for Domain Prefix.\n- Updated CLI documentation to remove Domain Prefix references.\n- Removed domain prefix helper methods from python test certification\n scripts.\n- Removed auto-addition of default domain prefix and D flag support\n from GRL harness OpenThread.py." }, { "commit": "c4a85578f5d779abc252fd27108d82bc2ecc011b", "tree": "0bdb1d7bda172fe9757e006d64d6e5bc7e247296", "parents": [ "b72d7144ee40e0550d6f507dff4be7a6b79c6100" ], "author": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Thu Jun 04 13:33:07 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jun 04 13:33:07 2026 -0700" }, "message": "[mle] validate peer extended address in Link Accept (#13207)\n\nThis commit ensures that the peer\u0027s extended address matches the stored\nextended address when receiving a Link Accept for an already valid link,\npreventing unintended frame counter resets and neighbor table updates.\n\nTo achieve this:\n- We validate that the peer\u0027s extended address (extracted from the\n IPv6 peer address IID) matches the router\u0027s stored extended address\n when processing Link Accepts for a neighbor that is already in the\n kStateValid state. If there is a mismatch, the packet is rejected\n with kErrorSecurity.\n- We gate InitNeighbor() and the resetting of MLE frame counters\n so they only execute if the neighbor is not already kStateValid.\n For valid neighbors, we only update link statistics (RSS, last\n heard, link quality, key sequence) and clear the Link Accept\n timeout without modifying the frame counters or average RSS history." }, { "commit": "b72d7144ee40e0550d6f507dff4be7a6b79c6100", "tree": "77a54f8e6593bbd78f3359353f8316e73dde766b", "parents": [ "b2093f4f9ec0cbd925eeffcc177b0f3669ec46e2" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Wed Jun 03 19:19:25 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jun 03 19:19:25 2026 -0700" }, "message": "[cli] refactor IPv6 address parsing and synthesis helper (#13205)\n\nThis commit renames the static helper `Utils::ParseToIp6Address()` to\n`Utils::ParseOrSynthesizeIp6Address()` to better reflect its behavior\nof parsing an IPv6 address or synthesizing one from an IPv4 address\nvia NAT64.\n\nAdditionally, the method is refactored into a non-static member of the\n`Utils` class. This eliminates the need to manually pass the `otInstance`\npointer, as the `Utils` class already maintains it. The internal\nimplementation is also simplified to reduce nesting by exiting early\nupon successful IPv6 address parsing.\n\nAll callers in the CLI module (TCP, UDP, Ping, DNS) have been updated\nto use the new member method." }, { "commit": "b2093f4f9ec0cbd925eeffcc177b0f3669ec46e2", "tree": "a59a43c16bd98c342f3973f3ea30186a75f887b3", "parents": [ "15e1c233bf639f70e74370cc025e9fad6e26f06a" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Wed Jun 03 14:55:20 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jun 03 14:55:20 2026 -0700" }, "message": "[dns] check for null character in read label (#13187)\n\nThis commit updates `Name::LabelIterator::ReadLabel()` to explicitly\ncheck that the read label from the message does not contain any embedded\n`kNullChar` (`\\0`) characters. It uses `StringLength()` to verify that\nthe length of the string matches the expected label length. If a null\ncharacter is found before the end of the label, `kErrorParse` is\nreturned to prevent potential string truncation issues or\nmisinterpretation of the label name.\n\nThis broader check replaces a recent fix in `PtrRecord::ReadPtrName()`\nfrom #13183 which only verified that the first label was not empty\nor malformed by checking for a single-character label with a null\nbyte. By enforcing this validation centrally at the `ReadLabel()`\nlevel, we now ensure that labels of any length are properly\nprotected against embedded null characters across all DNS record\ntypes." }, { "commit": "15e1c233bf639f70e74370cc025e9fad6e26f06a", "tree": "d7960d2335515b0e52e4ffad2b83325bff42e883", "parents": [ "3d7b9fb6861ca442c66808f22d79035df6308a41" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Wed Jun 03 14:45:42 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jun 03 14:45:42 2026 -0700" }, "message": "[tests] simplify RLOC address creation using `GetMeshLocalRloc()` (#13198)\n\nThis commit refactors several Nexus diagnostic test cases to use the\nexisting `Mle::GetMeshLocalRloc()` method instead of manually assembling\nthe RLOC by combining the mesh-local prefix and the node\u0027s RLOC16. This\nimproves code readability and adheres to the standard pattern for\nretrieving a node\u0027s Routing Locator." }, { "commit": "3d7b9fb6861ca442c66808f22d79035df6308a41", "tree": "fcae7f7cc5837330249364efd1fa98a0952f893c", "parents": [ "ab3c6600a01db0c8434a618821de039034d66eb5" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Wed Jun 03 14:42:43 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jun 03 14:42:43 2026 -0700" }, "message": "[mle] rename `Get{Addr}()` to `Compose{Addr}()` (#13197)\n\nThis commit renames several methods in the `Mle` class that construct\nan IPv6 address from the mesh-local prefix and an RLOC16/ALOC16 from\n`Get...()` to `Compose...()` to better reflect their behavior.\n\nThe affected methods are:\n- `GetLeaderRloc()` -\u003e `ComposeLeaderRloc()`\n- `GetLeaderAloc()` -\u003e `ComposeLeaderAloc()`\n- `GetCommissionerAloc()` -\u003e `ComposeCommissionerAloc()`\n- `GetServiceAloc()` -\u003e `ComposeServiceAloc()`" }, { "commit": "ab3c6600a01db0c8434a618821de039034d66eb5", "tree": "8c2d8130ce8adb62f4deb3601b28141d50a2f56a", "parents": [ "ecd4c9246503d84d4b79ec05eacf424941d83c30" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Wed Jun 03 14:39:21 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jun 03 14:39:21 2026 -0700" }, "message": "[icmp6] use `Icmp6Header` instead of `Icmp::Header` (#13194)\n\nThis commit updates the codebase to use the `Icmp6Header` type\ndirectly, replacing the nested `Ip6::Icmp::Header` definition.\nThis change aligns the ICMPv6 header type definition with the\nconventions used for other network protocol headers and simplifies\ntype references across the network, border router, and utility\nmodules." }, { "commit": "ecd4c9246503d84d4b79ec05eacf424941d83c30", "tree": "dda053fbe76da82120eb0098a2773bae37ca2cf4", "parents": [ "b69c9057633aa62a7837c6a12017d327553f06e7" ], "author": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Wed Jun 03 12:29:18 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jun 03 12:29:18 2026 -0700" }, "message": "[dua] completely remove DUA features and configurations (#13191)\n\nThis commit removes the OPENTHREAD_CONFIG_TMF_PROXY_DUA_ENABLE feature\nand all associated code, tests, CLI commands, and harness references.\n\nChanges:\n- Removed OPENTHREAD_CONFIG_TMF_PROXY_DUA_ENABLE definition and all\n assert/preprocessor checks.\n- Completely deleted dua_manager.cpp and dua_manager.hpp.\n- Removed DUA registration notifying and request URI paths.\n- Cleaned up all references to Domain Unicast Address (DUA) across\n child management, notifier, time ticker, and MLE.\n- Removed DUA commands and logic from the CLI and Python cert tests\n (including packet verifier).\n- Verified that the entire codebase compiles clean and all tests\n successfully pass using the Nexus test suite." }, { "commit": "b69c9057633aa62a7837c6a12017d327553f06e7", "tree": "d045ecc36f24f6a259449bb397dbb3f719728bf9", "parents": [ "c4107334900b3e5197a8394b45838ccabeee4841" ], "author": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Wed Jun 03 10:55:54 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jun 03 10:55:54 2026 -0700" }, "message": "[nexus] fix and update 1_3_SRP_TC_1 integration test (#13200)\n\nThis commit updates the SRP registration and verification logic to pass\nthe 1_3_SRP_TC_1 test case in the Nexus simulator:\n\n1. In test_1_3_SRP_TC_1.cpp, temporarily disable/enable the eth1 DNS-SD\n agent during SRV, AAAA, and browser resolver queries to force a\n clear of the local cache. This ensures the queries are sent over the\n wire to the Border Router (DUT) instead of being answered from the\n resolver\u0027s cache.\n2. In verify_1_3_SRP_TC_1.py, add checks for mDNS query and response\n packets for Steps 9b, 9c, 15b, and 15c. Relax the Step 15c check to\n not require the ML-EID in the mDNS response, as advertising\n Mesh-Local addresses on the infrastructure link is optional and not\n done by the OpenThread SRP advertising proxy." }, { "commit": "c4107334900b3e5197a8394b45838ccabeee4841", "tree": "f2ce96f723b53ac50fbdf19b0db36b4106ff0233", "parents": [ "1b238bffc020e945dc57ea4cb5825bd9000f5db1" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Wed Jun 03 08:29:35 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jun 03 08:29:35 2026 -0700" }, "message": "[tcp] add `OPENTHREAD_CONFIG_TCP_ENABLE` guards to headers (#13195)\n\nThis commit wraps the contents of `tcp6.hpp` and `tcp6_ext.hpp` with\n`#if OPENTHREAD_CONFIG_TCP_ENABLE` feature guards to ensure that TCP\ndefinitions and types are cleanly excluded when TCP support is disabled\nin the build configuration. Additionally, it explicitly disables the\n`OPENTHREAD_CONFIG_TCP_ENABLE` feature flag in the Toranj test\nconfiguration to validate building without TCP support." }, { "commit": "1b238bffc020e945dc57ea4cb5825bd9000f5db1", "tree": "2a68a9489e5153ca808a71d1e0db820115dfd25d", "parents": [ "c01cad7ba2ea40381e9385131551db7bb33144d1" ], "author": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Wed Jun 03 08:06:30 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jun 03 08:06:30 2026 -0700" }, "message": "[tests] remove test_trel_connectivity.py (#13196)\n\nThis commit removes the deprecated `test_trel_connectivity.py`\nintegration test. The TREL connectivity test functionality is\nalready fully covered by the Nexus simulation test suite, which\nprovides faster and more reliable testing." }, { "commit": "c01cad7ba2ea40381e9385131551db7bb33144d1", "tree": "59a3558686ebffd630c5df27f3faec6256f787a4", "parents": [ "7ad13c8adb0d0d7e35071a2198bace75e7cf3740" ], "author": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Tue Jun 02 07:46:15 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jun 02 07:46:15 2026 -0700" }, "message": "[nexus] migrate publish meshcop service cert test to nexus (#13186)\n\nThis commit migrates the legacy Thread certification test\n\u0027test_publish_meshcop_service.py\u0027 to the C++ simulation test suite\nin the Nexus platform.\n\nTo avoid redundancy and keep the test suite clean, the coverage\nis consolidated directly within \u0027tests/nexus/test_border_agent.cpp\u0027\ninstead of introducing a new redundant test file.\n\nConsolidated coverage and changes:\n- Extended the state bitmap parser and \u0027ValidateMeshCoPTxtData\u0027 in\n \u0027test_border_agent.cpp\u0027 to verify Backbone Router (BBR) active\n and primary flags (kFlagBbrIsActive, kFlagBbrIsPrimary) when\n OPENTHREAD_CONFIG_BACKBONE_ROUTER_ENABLE is enabled.\n- Added a new test block in \u0027TestBorderAgentServiceRegistration\u0027 to\n enable Backbone Router on node0, verify that BBR active and primary\n flags are dynamically advertised in the MeshCoP TXT record over\n mDNS, and verify that disabling BBR correctly updates the TXT\n record state bitmap.\n- Fully deleted the legacy Python certification script\n \u0027test_publish_meshcop_service.py\u0027 from \u0027thread-cert\u0027." }, { "commit": "7ad13c8adb0d0d7e35071a2198bace75e7cf3740", "tree": "78066657bfaff46fad2dfcc8748721a5ee0d4083", "parents": [ "f6598900cf531badcf8f6af729b70d56960c86ad" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Tue Jun 02 07:45:50 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jun 02 07:45:50 2026 -0700" }, "message": "[ip4] use `Icmp4Header` directly for ICMPv4 (#13180)\n\nThis commit updates the codebase to use the `Icmp4Header` type directly,\nreplacing the nested `Ip4::Icmp::Header` type. The empty `Ip4::Icmp`\nwrapper class is removed to simplify the header definition. This change\naligns the ICMPv4 header structure with the flat naming conventions used\nfor other IP headers (e.g., `Ip6::Icmp6Header`, `Ip6::UpdHeader`)." }, { "commit": "f6598900cf531badcf8f6af729b70d56960c86ad", "tree": "b675c34d267c030015ef64fdd6caa682c3062784", "parents": [ "136bdb6e2a61b1545a47ac85d0ccdaf7a6f69a6e" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Jun 02 07:33:12 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jun 02 07:33:12 2026 -0700" }, "message": "github-actions: bump docker/build-push-action from 7.1.0 to 7.2.0 (#13188)\n\nBumps [docker/build-push-action](https://github.com/docker/build-push-action) from 7.1.0 to 7.2.0.\n- [Release notes](https://github.com/docker/build-push-action/releases)\n- [Commits](https://github.com/docker/build-push-action/compare/bcafcacb16a39f128d818304e6c9c0c18556b85f...f9f3042f7e2789586610d6e8b85c8f03e5195baf)\n\n---\nupdated-dependencies:\n- dependency-name: docker/build-push-action\n dependency-version: 7.2.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "136bdb6e2a61b1545a47ac85d0ccdaf7a6f69a6e", "tree": "46f9a6515773b3641a3888b27cb409dc9c39b552", "parents": [ "675162556b43356d4f4e677f726d8dcb360bb4b1" ], "author": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Mon Jun 01 15:16:19 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 01 15:16:19 2026 -0700" }, "message": "[dua] remove OPENTHREAD_CONFIG_DUA_ENABLE build feature (#13165)\n\nThis commit completely removes the local Domain Unicast Address (DUA)\nregistration feature flag (OPENTHREAD_CONFIG_DUA_ENABLE) and all of\nits associated implementation, public APIs, CLI commands, Spinel\nproperty handlers, and certification tests.\n\nThread 1.2 FTD Border Router/Router DUA proxying features for MTD\nchildren (OPENTHREAD_CONFIG_TMF_PROXY_DUA_ENABLE) are preserved and\nupdated to only compile/instantiate components when proxy DUA\nfeatures are active.\n\nDetailed Changes:\n- Remove default definition of OPENTHREAD_CONFIG_DUA_ENABLE from\n misc.h.\n- Remove OT_DUA and openthread_config_dua_enable from CMake/GN\n configs.\n- Remove otThreadSetFixedDuaInterfaceIdentifier and\n otThreadGetFixedDuaInterfaceIdentifier from\n include/openthread/thread.h\n and implementation src/core/api/thread_api.cpp.\n- Remove CLI DUA interpreter from src/cli/cli.cpp.\n- Remove SPINEL_CAP_DUA capability and SPINEL_PROP_THREAD_DUA_ID\n Spinel property handlers and dispatchers from NCP.\n- Strip local DUA management features (conflict checking, SLAAC DUA\n interface identifiers, and dad info settings) from DuaManager, MLE,\n Address Resolver, and settings.\n- Clean up Notifier, TimeTicker, and TMF dispatcher guards.\n- Clean up -DOT_DUA\u003dON compilation flags across build/test scripts.\n- Delete obsolete DUA certification tests:\n - v1_2_test_domain_unicast_address\n - v1_2_test_domain_unicast_address_registration\n - v1_2_test_dua_handle_address_error" }, { "commit": "675162556b43356d4f4e677f726d8dcb360bb4b1", "tree": "31d8391c2d032a09d97ba2b694081b7c0d3e0460", "parents": [ "32b96a0d986e8c7a71bdeb76ae065b8a0abe3681" ], "author": { "name": "mohammadmseet-hue", "email": "mohammadmseet@gmail.com", "time": "Mon Jun 01 23:19:16 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 01 13:19:16 2026 -0700" }, "message": "[mdns] reject empty PTR target label on receive (#13183)\n\n`PtrRecord::ReadPtrName()` reads a PTR target\u0027s first label with\n`Name::ReadLabel()`, which performs no emptiness check. A response whose\nfirst label is a single NUL byte (wire `01 00`) is stored as an empty\nC-string and cached by the browse cache as a service instance. When the\ncache later builds a known-answer question, it calls\n`Name::AppendLabel(\"\")`, which returns `kErrorInvalidArgs`; the\nsurrounding `SuccessOrAssert()` turns that into an abort. A single\nunauthenticated link-local mDNS response thus crashes any node with an\nactive browser.\n\nReject an empty first label in `ReadPtrName()` so the record is dropped\non receive and never cached. This matches the `Name::ValidateLabel`\nchecks already applied on the registration and resolver paths, and makes\nthe \"ReadPtrName() validates that PTR record is well-formed\" comment at\nthe call site accurate.\n\nAdd a regression test that delivers a PTR response with a single\nNUL-byte instance label and verifies no result is reported and the\nbrowser keeps querying without the malformed entry." }, { "commit": "32b96a0d986e8c7a71bdeb76ae065b8a0abe3681", "tree": "e485fca3fc9c0bfa7405da73ae503269d6d46852", "parents": [ "831f2d38680d6ea81993d704d26d54c1856d3f27" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Mon Jun 01 13:13:33 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 01 13:13:33 2026 -0700" }, "message": "[docs] add missing TCP and UDP Doxygen groups (#13178)\n\nThis commit adds the missing Doxygen groups for TCP (`core-tcp`),\nTCP Extensions (`core-tcp-ext`), and UDP (`core-udp`). These groups\nare used in the code but were not previously defined." }, { "commit": "831f2d38680d6ea81993d704d26d54c1856d3f27", "tree": "9e511e6ac95583e4dd9db5d78f2f76cccf0ad939", "parents": [ "55b3adbf81324f620ccef923a4c606db5a7035dd" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Fri May 29 18:25:36 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri May 29 18:25:36 2026 -0700" }, "message": "[net] use `TcpHeader` and `UdpHeader` directly (#13179)\n\nThis commit updates the codebase to use `TcpHeader` and `UdpHeader` types\ndirectly, instead of the nested `Tcp::Header` and `Udp::Header` types.\nThe `TcpHeader` and `UdpHeader` classes are already defined in\n`ip6_headers.hpp`. This change reduces dependencies on the `Tcp` and\n`Udp` class definitions, which is particularly useful when TCP\nis disabled in the build configuration, avoiding the need to include\ntheir respective class headers just for the header definitions." }, { "commit": "55b3adbf81324f620ccef923a4c606db5a7035dd", "tree": "da4a95f41db99cf049bd75c73a8b3ddef04bf91b", "parents": [ "e4df5ddac2ff8042277d2662ce3b020fbefa589f" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Fri May 29 17:34:54 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri May 29 17:34:54 2026 -0700" }, "message": "[docs] fix double \u0027the\u0027 typos across the codebase (#13176)\n\nThis commit fixes instances of \"the the\" typos found in various\nfiles across the codebase, including documentation, headers, source\nfiles, and test scripts." }, { "commit": "e4df5ddac2ff8042277d2662ce3b020fbefa589f", "tree": "d58e2c8c97a3a82da32dc328e5f7f337744c4edb", "parents": [ "fa3213ec85d4d56ead87c54ca003b22f936d3cce" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Fri May 29 14:30:14 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri May 29 14:30:14 2026 -0700" }, "message": "[github] set puppeteer executable path for `linkspector` (#13181)\n\nThis commit updates the `markdown-lint-check` job to explicitly set\nthe `PUPPETEER_EXECUTABLE_PATH` environment variable to use the\nsystem-installed Google Chrome (`/usr/bin/google-chrome`) for the\n`linkspector` action. This resolves issues where the action fails\nto find a browser environment to execute properly." }, { "commit": "fa3213ec85d4d56ead87c54ca003b22f936d3cce", "tree": "ae1f0b2c01c233ff25b8b99a0d4306fc4f4ec824", "parents": [ "2a2d4be953fc2f52970b406fdb8a2fc7346240e5" ], "author": { "name": "arnulfrupp", "email": "51497546+arnulfrupp@users.noreply.github.com", "time": "Fri May 29 07:02:29 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu May 28 22:02:29 2026 -0700" }, "message": "[tcat] implement vendor policy for TLV support and automatic advertisement activation/deactivation (#13038)\n\nThis commit implements additional vendor application or ecosystem\npolicy settings for TCAT including:\n\n1) Automatic deactivation of the TCAT agent / TCAT advertisement after\n the thread network has been started over TCAT\n2) Automatic activation of the TCAT agent / TCAT advertisement after\n the thread network has been stopped over TCAT\n3) Automatic activation of the TCAT agent / TCAT advertisement after\n decommissioning over TCAT\n4) Blocking support of certain TCAT TLVs by the application /\n ecosystem\n\nThe commit also fixes an issue with certificate storage after\ndecommissioning." }, { "commit": "2a2d4be953fc2f52970b406fdb8a2fc7346240e5", "tree": "5d2339b193c836a3bafe779647b1acbfc9f8caf2", "parents": [ "e1b34bc5bc2897fbe8a89123b7ec6bb3ae96ac92" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Thu May 28 20:52:05 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu May 28 20:52:05 2026 -0700" }, "message": "[ip6] rename methods fully initializing an `Ip6::Address/Prefix` (#13169)\n\nThis commit renames several methods in `Ip6::Address`,\n`Ip6::InterfaceIdentifier`, `Ip6::Prefix`, and `Ip4::Address` that\nfully initialize the object from `Set...()` to `Init...()`.\n\nThis creates a clear semantic distinction in the API:\n- `Init...()`: Fully (re-)initializing the object.\n- `Set...()`: Modifies a specific property or a sub-component of\n the object (e.g., `SetPrefix()`, `SetLocator()`,\n `SetSubnetId()`).\n\nSome examples of renames include:\n- `SetFromExtAddress()` -\u003e `InitFromExtAddress()`\n- `SetToLocator()` -\u003e `InitAsLocator()`\n- `SetToLinkLocalAddress()` -\u003e `InitAsLinkLocalAddress()`\n- `SetToRoutingLocator()` -\u003e `InitAsRoutingLocator()`\n- `SetToAnycastLocator()` -\u003e `InitAsAnycastLocator()`\n- `SetToIp4Mapped()` -\u003e `InitAsIp4Mapped()`\n\nAll calls to these methods across the codebase have been updated\nto reflect the new names." }, { "commit": "e1b34bc5bc2897fbe8a89123b7ec6bb3ae96ac92", "tree": "fdb8120cf65e410e86e63865dc7a55dda48e74c5", "parents": [ "fa374236a5019830e44741f0488fcf50228b0966" ], "author": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Thu May 28 16:52:16 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu May 28 16:52:16 2026 -0700" }, "message": "[simulation] increase socket receive buffer size to 2MB (#13173)\n\nThis commit sets the SO_RCVBUF socket option to 2MB on the\nmulticast receiving sockets in the simulation platform.\n\nUnder heavy simulation load (such as expect tests with 15 nodes\nall sending MLE advertisements and discovery packets), the default\nOS UDP receive socket buffer can overflow, leading to silent\npacket drops. This occasionally caused expect tests like\ncli-big-table.exp to fail with \"Join failed [NotFound]\" because\nNode 4\u0027s discovery requests or response beacons were dropped.\n\nIncreasing the receive buffer size to 2MB prevents packet loss\nduring dense simulation runs, resolving intermittent CI test\nfailures." }, { "commit": "fa374236a5019830e44741f0488fcf50228b0966", "tree": "8c4cd764b49abdbea0e3323d4a658c406047cd53", "parents": [ "73b6b136782a950ffe15b97380cfa88e769f14eb" ], "author": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Thu May 28 15:07:05 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu May 28 15:07:05 2026 -0700" }, "message": "[tests] fix flake in trickle timer unit test (#13172)\n\nThis commit fixes a frequent unit test flake in ot-test-trickle_timer\nunder the TestTrickleTimerMinMaxIntervalChange test case.\n\nThe test case starts the trickle timer with Imin \u003d 2000 and\nImax \u003d 2000. The random time t (mTimeInInterval) is chosen in\n[1000, 2000), so t can range up to 1999.\n\nWhen t randomly evaluates to 1999, t + 1 becomes 2000. Calling\ntimer.SetIntervalMax(2000) triggers an early-exit optimization\nin TrickleTimer::SetIntervalMax because mIntervalMax is already 2000,\nleaving the scheduled timer\u0027s fire time unchanged. The test then\ncrashes on the assertion expecting the fire time to have changed.\n\nThis is resolved by setting the new interval max to\nMin(t + 1, interval - 1). This ensures that the requested value is\nstrictly less than 2000 even when t \u003d 1999, successfully triggering\nthe interval shortening and rescheduling logic tested by this case." }, { "commit": "73b6b136782a950ffe15b97380cfa88e769f14eb", "tree": "38bb51777b8eebc6d47982fd1ba83d226b1351db", "parents": [ "5bc532472f1240d38cb30b6319290ef0673a34d8" ], "author": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Thu May 28 13:50:31 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu May 28 13:50:31 2026 -0700" }, "message": "[tests] add startup delay to prevent expect desync (#13174)\n\nThis commit adds a brief 0.1-second sleep delay immediately after\nspawning node processes (rcp, cli, and mtd types) in the expect test\nharness.\n\nUnder high CPU load on GitHub Actions runner VMs, the PTY file\ndescriptors can take a fraction of a second to fully initialize. If\ncommands are sent immediately after spawn without delay, the initial\nexpect match can fail with an instant timeout. This triggers duplicate\nretransmissions in wait_for, leaving extra \"Done\" strings in expect\u0027s\nPTY read buffer. The leftover \"Done\" strings desynchronize subsequent\nassertions, causing tests to match cached output instead of waiting\nfor actual command execution (e.g., sending \"diag stats\" during an\nactive \"diag send\" command, which fails).\n\nAdding a 100ms delay gives the PTY and child process enough time to\nfully initialize and stabilize, avoiding instant timeouts and\nsubsequent test harness desynchronization." }, { "commit": "5bc532472f1240d38cb30b6319290ef0673a34d8", "tree": "a64fc4ca3631d6791fe884baf310db17d8656665", "parents": [ "9bd35de29a10f7724f744ee36e4cb9824bd708e0" ], "author": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Thu May 28 13:49:38 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu May 28 13:49:38 2026 -0700" }, "message": "[github-actions] add gcc-15 to arm-gcc build matrix (#13171)\n\nThis commit adds GCC 15 (version 15.2.rel1) to the `arm-gcc` job\nmatrix in the OpenThread build (`build.yml`) workflow.\n\nIncluding GCC 15 in the builds helps ensure that OpenThread compiles\nsuccessfully and is free from warnings or errors with the latest GCC\n15.2.rel1 release." }, { "commit": "9bd35de29a10f7724f744ee36e4cb9824bd708e0", "tree": "d1494206c95233d810e0c07c8c1fb5eba22762f2", "parents": [ "eac46963bb66bc46542a6776ae3c0dd2134eb8e5" ], "author": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Thu May 28 13:46:28 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu May 28 13:46:28 2026 -0700" }, "message": "[tests] fix flakiness in publish meshcop service test (#13170)\n\nIncrease wait delay after starting the OTBR service in the\ntest_publish_meshcop_service.py script.\n\nStarting otbr-agent requires the node to re-attach to the simulated\nThread network and transition to the leader role. In virtualized CI\nenvironments, this role transition can take up to 14.5 seconds. Using\na hardcoded 10-second delay results in a race condition where the\nservice is published very late, causing the subsequent browse query to\nmiss the service and fail with AssertionError.\n\nSubstituting the delay with BORDER_ROUTER_STARTUP_DELAY (20s) ensures\nthe node has sufficient time to attach, become leader, start the border\nagent, and fully register the mDNS service before browsing." }, { "commit": "eac46963bb66bc46542a6776ae3c0dd2134eb8e5", "tree": "1f67106531ba6abb60887f34c1fcc02466554461", "parents": [ "290919b178f0dd2014a79250285f1c347d477b17" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Thu May 28 07:25:40 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu May 28 07:25:40 2026 -0700" }, "message": "[mlr] simplify MLR state tracking on `Child` (#13166)\n\nThis commit simplifies MLR state tracking for child devices. Previously,\n`Child::Ip6AddrEntry` inherited from `Ip6::Address` to encapsulate the\nMLR registration check using the `Child` reference. This introduced\ntight coupling between `Child` and `Ip6AddrEntry`.\n\nThe logic is refactored by removing `Ip6AddrEntry`. Instead, `Child`\nnow directly manages a `Child::Ip6AddressArray` and encapsulates the\nMLR state querying/updating through new methods:\n - `SetAddressMlrRegistrationState()`\n - `GetAllMlrRegisteredAddresses()`\n - `ClearAllAddressesMlrRegistrationState()`\n\nIn `Mlr::Manager`, the redundant `ChildAddressArray` typedef and\n`kMaxChildAddresses` constant are removed, reusing the\n`Child::Ip6AddressArray`. The method `UpdateProxiedSubscriptions()`\nis renamed to the more intuitive `UpdateChildRegistrations()`, and\noverloaded to allow calling it without an old address list during\ninitial child registration." }, { "commit": "290919b178f0dd2014a79250285f1c347d477b17", "tree": "8b7598328accdfa30127f561a24a37e731d80d9f", "parents": [ "61be1c0e458f263467ed683b502c28c250b203dc" ], "author": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Wed May 27 19:09:34 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed May 27 19:09:34 2026 -0700" }, "message": "[tests] fix uninitialized memory in nexus test 1_3_DBR_TC_7A (#13168)\n\nThe test `test_1_3_DBR_TC_7A` was failing occasionally due to\nuninitialized stack memory in `NetworkData::OnMeshPrefixConfig config`.\n\nBecause `OnMeshPrefixConfig` inherits from `otBorderRouterConfig`\nand does not automatically initialize its fields in its default\nconstructor, declaring `NetworkData::OnMeshPrefixConfig config;`\non the stack left its members (including `mDp` and `mNdDns` flags)\nwith arbitrary stack garbage. If `mDp` (Domain Prefix flag)\nevaluated to true, it caused the registered `PRE_1` prefix to be\nerroneously processed as a Domain Prefix. Consequently, the border\nrouter did not include `PRE_1` as a Route Information Option (RIO)\nin its emitted Router Advertisements, causing packet verification\nto fail in Step 4.\n\nThis commit fixes the issue by explicitly initializing the\n`config` struct using `config.Clear()` right after declaration." }, { "commit": "61be1c0e458f263467ed683b502c28c250b203dc", "tree": "3db883321651a5dba6dba0bdf6c9e480f258dd63", "parents": [ "eb671b2a6d884e6b2ee84c5b528277d494fbc144" ], "author": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Wed May 27 15:20:38 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed May 27 15:20:38 2026 -0700" }, "message": "[nexus] isolate both leaders during Step 2 in announce flap test (#13167)\n\nFixes an intermittent failure in the\n`nexus_announce_no_flap_on_unmergeable_partitions` test.\n\nPreviously, only LEADER_NEW was isolated (by enabling allowlist\nmode with an empty address list) in Step 2. Because LEADER_OLD\nstill had allowlist mode disabled, it could receive advertisements\nfrom LEADER_NEW. If LEADER_NEW\u0027s randomly allocated partition ID\nhappened to be larger than LEADER_OLD\u0027s, LEADER_OLD would see it\nas a \"better partition\" and initiate a transition to child to\nattach to LEADER_NEW.\n\nAlthough this attempt would initially fail in Step 2 (since\nLEADER_NEW dropped all RX), it kept retrying. In Step 3, when the\nallowlist was opened on both sides, the queued/retried attach\nattempt from LEADER_OLD succeeded, making it a child and causing\nthe Leader assertion to fail.\n\nIsolating both nodes during Step 2 ensures that LEADER_OLD never\nhears LEADER_NEW\u0027s initial good-link advertisements. When Step 3\nbegins, it only hears LEADER_NEW through the weak link and\ncorrectly rejects the advertisements, keeping both nodes stable\nleaders of separate partitions." }, { "commit": "eb671b2a6d884e6b2ee84c5b528277d494fbc144", "tree": "61c063cec7e1944f73a332ea26df0180bf6eacbd", "parents": [ "3243bc35292c7351a59d866bef3e9900ce66b0f2" ], "author": { "name": "Jonathan Hui", "email": "jonhui@google.com", "time": "Wed May 27 13:24:56 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed May 27 13:24:56 2026 -0700" }, "message": "[bit-set] cast bitwise NOT in FlipBits to uint8_t (#13164)\n\nExplicitly cast the result of the bitwise NOT operator ~ to uint8_t in\nBitSetUtils::FlipBits to resolve a build error under AppleClang.\n\nIn C++, using the bitwise NOT operator on a uint8_t value promotes it to\nan int. Assigning the promoted int back to uint8_t triggers an implicit\nconversion warning/error (-Wimplicit-int-conversion) under newer\ncompiler versions, which fails the build when compiled with -Werror." }, { "commit": "3243bc35292c7351a59d866bef3e9900ce66b0f2", "tree": "967460b26bf58b09f81aea66e30789967b5552ad", "parents": [ "597ca442613c05c74521f54d97f4a5d3b9e7e1e1" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Wed May 27 12:48:31 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed May 27 12:48:31 2026 -0700" }, "message": "[dataset] introduce `AffectsConnectivity()` and public API (#13134)\n\nThis commit introduces helper methods to `MeshCoP::Dataset` to determine\nif a given Dataset affects network connectivity or the Network Key.\nIt also adds a corresponding public API `otDatasetAffectsConnectivity()`.\n\nA Dataset is considered to affect connectivity if it contains a\ndifferent Channel, PAN ID, Mesh Local Prefix, or Network Key than\nthe current values in use." }, { "commit": "597ca442613c05c74521f54d97f4a5d3b9e7e1e1", "tree": "4f9c727efa7ac00f4ad419616680cf54589fb74f", "parents": [ "96c85c24e7322e14a1e68ff906e5353c0cbadbe0" ], "author": { "name": "Abtin Keshavarzian", "email": "abtink@google.com", "time": "Wed May 27 12:46:37 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed May 27 12:46:37 2026 -0700" }, "message": "[instance] fix typo in `mIsLogLevelOverridden` member variable (#13160)\n\nThis commit fixes a spelling error in `Instance` class where\n`mIsLogLevelOverriden` was misspelled. It has been corrected to\n`mIsLogLevelOverridden`." } ], "next": "96c85c24e7322e14a1e68ff906e5353c0cbadbe0" }