Dear BIRD users, we're, as promised, releasing patch versions for all the supported branches. Downloads are possible at <https://bird.nic.cz/get-bird/> and in our upstream repositories. There are some security-relevant fixes this time with a varying degree of relevance. We have fixed a lot of BGP in BIRD 3, most notably several nasty bugs in graceful restart behavior, labelled NLRI parsing and other MPLS stuff. (There are still more MPLS bugs pending in BIRD 3.) We have fixed several flowspec parser flaws in all versions, which were there for years. We have fixed the no-refeed bug of BMP in BIRD 3, and also a cornercase off-by-one in all versions. We have fixed a bunch of corner case OSPF bugs. We have fixed a bunch of race conditions in internal reading the routing tables. We have also fixed the infamous remote code execution bug happening when the path mask feature is used on a gargantuan AS Path (in all versions). There are some outstanding bugs (in all versions) reported, and we've prioritized expediting this release which is already quite beefy, over doing it all at once. If your bug report has been reported as fixed, we would love if you confirmed that from your side. If not, it will most probably get fixed in the next patch release. Officially supported versions are now: - 3.3.x and 2.19.x until 6 months after 3.4.0 and 2.20.0 get released - 3.2.x and 2.18.x until end of November 2026 - LTS 3.1.x and 2.17.x tracking Debian Trixie Also, on commercial note, we offer BIRD Support, so that you can get help with configuration, priority access to critical bug information and fixes, and better influence the overall development directions. It's the users paying for these services, who keep the development running. More on that at our website: <https://bird.nic.cz/commercial-services/> Happy routing! Maria and the BIRD Team -- Maria Matejka (she/her) | BIRD Team Leader | CZ.NIC, z.s.p.o.