• Major bug fixes
  [XrdCl] Revert fix for #2578 which caused deadlocks in XCache (#2629, #2633)
  [XrdEc] Fix stack smashing detected by ASAN
  [XrdSecsss] Fix buffer overrun when decoding bad sss keys

• Minor bug fixes
  [XrdCl] Avoid possibly losing error message during copy (#2615)
  [XrdCl] Fix concurrency bug causing AtLeast policy to miss errors
  [XrdMacaroons] Ensure that subdirectory creation permission is implied (#2611, #2638)
  [XrdMacaroons] Match by subdirectory instead of substring for permission verification
  [XrdOuc] Correct is_subdirectory() check for directories ending with a trailing / (#2639)
  [XrdPfc] Add missing includes and put C++ headers before C headers
  [XrdThrottle] Fix ignored configuration variable (#2616)
  [XrdXrootd] Fix readv requests of exactly 2GB max allowed limit (#2614)

• Miscellaneous
  [CI] Add ABI compatibility check to GitHub Actions
  [CI] Move coverage build to latest Ubuntu in GitHub Actions
  [CI] Update macOS runner images after deprecation of macOS 13
  [Misc] Fix -Wmaybe-uninitialized compiler warnings
  [Misc] Fix spelling errors found by lintian (#2617)
  [RPM] Revert back to sysusers.d config file, needed in Fedora 43 (#2433)
  [Systemd] Restart services on abnormal exit (#2641)
  [XrdHttp] Further improvements to WebDAV error message handling (#2261, #2598)
  [XrdThrottle] Update README to Markdown and cover existing config

• Full Changelog
• Issues and Pull Requests
• ABI Reports

• New Features
  [Server] Implement udprefresh option for the xrd.network directive (#1873)
  [Server] New redirect intercept plugin for SENSE
  [XrdCors] Add CORS plugin to XrdHttp (#2541, #2552)
  [XrdHttp] Make HTTP's maximum open delay configurable via http.maxdelay option (#2532)
  [XrdNet] XRootD monitoring information now follows DNS changes (#1873)
  [XrdPfc] Implement URL CGI parameters for setting block-size and max number of blocks for prefetching on per file basis (#2606)
  [XrdTls] Allow disabling of X.509 client auth (#2269)

• Major bug fixes
  [XrdCl] Avoid poller callbacks blocking each other (#2578, #2582)
  [XrdCl] Fix URL object lifetime issue causing XCache crash (#2587, #2599)
  [XrdSsi] Fix XrdSsi server crash due to use after free (#2479, #2481, #2523)
  [XrdSys] Fix a race condition in IOEvents that might cause segfault
  [XrdCl] Fix xrdcp crash when running with record plugin enabled (#2579)
  [XrdPfc] Fix deadlock when opening/closing many files concurrently (#2561, #2563)

• Minor bug fixes
  [Server] Make sure tread create counter increases monotonically (#2597)
  [XrdCl] PollerBuiltIn, protection against adding socket during shutdown
  [XrdHttp] Do a clean TLS shutdown for HTTPS (#2565)
  [XrdHttp] Fix file renaming with token authentication after redirection (#2550, #2570)
  [XrdHttpTpc] Improve mapping of error codes to HTTP status in TPC transfers (#2591)
  [XrdOssCsi] Handle pathnames not starting with slash and allow access to FD (#2581, #2594)
  [XrdOss] Workaround Mac OS X pecularity with RLIMIT_NOFILE (#2577)
  [XrdOuc] Fix memory leak in XrdOucGatherConf (#2583)
  [XrdPfc] Return error code for set cache evict if the file does not exist (#2608)
  [XrdPosix] Add a missed file object unlock
  [XrdPosix] Set errno for errors from pgRead and pgWrite
  [XrdXrootd] Fix multi-stream copy with xrdcp through XCache (#2592, #2593)

• Miscellaneous
  [CMake] Downgrade -Werror=null-dereference back to just a warning (#2571)
  [Tests] Add an xcache test, using OssCsi to flag corruption
  [Tests] Extend test suite with more tests with token based authentication
  [XrdHttp] Set the sequential I/O flag for simple HTTP requests
  [XrdOssStats] Add documentation for the OSS statistics plugin
  [XrdPfc] Cleanup processing and storage of pfc.dirstats configuration parameters
  [XrdPfc] Pass full environment into the OSS library loader
  [XrdThrottle] Modify XrdThrottle to be an OSS plugin (#2521)
  [XrdThrottle] Re-engineered concurrency limits (#2521)

• Full Changelog
• Issues and Pull Requests

• Major bug fixes
  [XrdPfc] Fix XCache crash caused by use-after-free (#2533)
  [XrdSecsss] Fix null pointer dereference in XrdSecsssKT::getKey()
  [XrdXrootd] Fix server segfaults while computing checksums (#2534)

• Minor bug fixes
  [CMake] Remove -D from ${XRootD_DEFINITIONS} in XRootDConfig.cmake (#2543)
  [Server] Improve rename error message when it fails due to overwrite
  [Tests] Fix memory leak in scitokens test reported by adress sanitizer (#2554)
  [XrdApps] Fix memory leak reported by adress sanitizer (#2553)
  [XrdCl] Add missing CpRetryPolicy to defaults
  [XrdCl] Avoid losing error response during retry at different server (#2537)
  [XrdCl] Do not apply timeout of Channel to its redirect-collapsed replacement (#2549)
  [XrdCl] Fix recursive copies with TLS enabled (#2490)
  [XrdCl] Request for hostname in replies to locate requests (#2540, #2551)
  [XrdOuc] Fix strncpy parameter overlap reported by address sanitizer
  [XrdOssCsi] Do not write sparse tag files when using nofill option (#2557)
  [XrdPosix] Fix one-definition-rule (ODR) violations in 32bit systems (#2032)
  [XrdPosix] Match function prototypes with respective syscalls (#2032)
  [XrdSecsss] Avoid potential use of uninitialized memory in XrdSecsssKT::ktDecode0()

• Miscellaneous
  [CI] Add GCC/Clang compiler problem matcher to GitHub Actions
  [CMake] Add option to enable sanitizers in test.cmake
  [CMake] Display C/C++ compile flags in configuration summary
  [Misc] Add GitHub issue templates
  [XrdCl] Add missing CpRetryPolicy to list of defaults
  [XrdOssCsi] Use std::less to compare pointers (#2557)
  [Tests] Add simple integration tests for XrdPosix and XrdDig
  [Tests] Add test of connection failure or hostname failure after redirect (#2537)

• Full Changelog
• Issues and Pull Requests

• Major bug fixes
  [XrdCl] Fix occasionally missed reply messages from the server (#2516)
  [XrdHttp] Fix crash due to thread-safety issue in bridge redrive (#2503)
  [XrdPfc] Fix deadlock at startup (#2505, #2507)
  [Server] Fix crash caused by race condition in XrdPosix callback handler (#2517)

• Minor bug fixes
  [XrdHttp] Fix HTTP protocol errors when using X-Transfer-Status (#2443)
  [XrdOss] Fix file access mode detection (#2510)
  [XrdPfc] Fix file access mode detection (#2508)
  [XrdPosix] Correct file open mode conversion (#2510)
  [XrdCl] Create directory target by default with recursive copies (#2501)

• Miscellaneous
  [CMake] Add Xrd/XrdSendQ.hh to list of installed private headers (#2497)
  [XrdHttp] Add unit tests for read failures during transfers (#2443)
  [Python] Replace license classifier with SPDX license expression (#2502)
  [XrdHttp] Add initial webdav error codes for file path and permission errors (#2261)

• Full Changelog
• Issues and Pull Requests

• Minor bug fixes
  [Server] Correct handling of wait during redrive (#2480)
  [Server] Enforce reasonable default thread limit of 8192 (#2468)
  [XrdHttp] Add missing default HTTP status messages (#2486)
  [XrdHttp] Handle = sign correctly in URL encoding/decoding (#2491)
  [XrdOuc] Redact URL-encoded tokens with % character (#2500)
  [XrdPosix] Map operation timeouts to ETIME (#2482)
  [XrdPss] Implement the auto-stat protocol for XrdPss (#2454)
  [XrdSecsss] Fix issues reported by clang-tidy static analysis
  [XrdSecsss] Protect against buffer overflow due to large key name

• Miscellaneous
  [CMake] General modernization of the build system (#2453)
  [CMake] Set stricter baseline compiler warning level
  [Misc] Fix compiler warnings with C++20/23, GCC 15 and Clang 20
  [RPM] Revert move to sysusers.d config file for user/group creation
  [Tests] Set a discovery timeout for gtest_discover_tests (#2485)

• Full Changelog
• Issues and Pull Requests

• New Features
  [XrdPss] Enable crc32c as a valid checksum for XrdPss (#2457)

• Major bug fixes
  [PMark] Fix null pointer dereference when initializing packet marking handle
  [XrdSsi] Fix null pointer dereference in XrdSsiFileReq::Finalize() (#2469)

• Minor bug fixes
  [CMake] Fix install rule for XrdPfc headers (#2478)
  [RPM] Workaround for %pre being evaluated before sources are unpacked (#2460)
  [XrdHttp] Do not use base64 encoding with crc32c checksums (#2456)
  [XrdPfc] Add XrdPfcPurgeQuota plugin to install targets
  [XrdThrottle] Fix Features() function implementation (#2483)
  [XrdTpc] Fix third-party copy transfers of small files with curl 8.x (#2470, #2475)

• Miscellaneous
  [CI] Move Fedora builds to Fedora 42
  [Misc] Fix GCC 15 compiler warnings
  [Tests] Add new tests for third-party copy transfers with tokens (#2441)
  [Tests] Add simple integration test for XCache (#2477)
  [XrdCl] Implement description for kXR_fattr requests
  [XrdCl] Update description of kXR_open requests with remaining flags
  [XrdOuc] Use correct format for pthread_t on GNU/Hurd (#2465)
  [XrdPss] Include environment CGI info when proxying checksum
  [XrdThrottle] Ensure all virtuals are overrides (#2483)
  [XrdTls] Fix deprecation warnings with OpenSSL 3.4 and later

• Full Changelog
• Issues and Pull Requests

• New Features
  [CMake] XRootDConfig.cmake now defines XRootD_BIN_DIR variable (#2432)
  [CMake] XRootDConfig.cmake now defines XRootD_DEFINITIONS variable (#2369)
  [CMake] XRootDConfig.cmake now exports library targets (#2415)
  [Server] Add generic interface to report summary values for monitoring (XrdMonitor)
  [Server] Add stat flag to indicate a cached stat response (#2435)
  [Server] Allow bypass of mtime check to declare a checksum as stale (#2338)
  [XrdCeph] Merge back features and bug fixes developed at RAL (#2342)
  [XrdCl] Add support for IPv4 mapped IPv6 addresses (#2422)
  [XrdCl] Improve client performance when using multiple streams (#1938)
  [XrdHttp] Add new http.staticheader directive to configure static HTTP headers (#2389)
  [XrdHttp] Send Age header for cached files in GET and HEAD requests (#2349, #2437)
  [XrdOssStats] New OSS statistics/monitoring plugin (#2279)
  [XrdPfc] New ResourceMonitor and PurgePlugin for XCache (#2436, slides)
  [XrdTpcTPC] Indicate to the oss layer which kind of HTTP TPC operation is performed (open) (#2427, #2429)

• Major bug fixes
  [XrdPfc] Fix segmentation fault under load (#2420, #2421)

• Minor bug fixes
  [Server] XRootD drops poller events on macOS (#2212)
  [XrdCl/Server] Replace mistakenly used kXR_mkdir with kXR_mkpath (#2393)
  [XrdCl] Fix URL parsing to not accept invalid parameters (#1960)
  [XrdHttp] Quote the resource when handling a redirect (#2430)
  [XrdNet] Fix name resolution for long hostnames seen in Kubernetes (#2307)
  [XrdNet] Fix xrootd.pmark defsfile directive (#2449)
  [XrdPfc] Fix usage of saveptr in strtok_r used by PathTokenizer (#2455)
  [XrdPosix] Fix XrdPosix headers when called in C context (#2424)
  [XrdPosix] Fixes for XrdPosix on macOS (#2434)
  [XrdPosix] Return entry type DT_UNKNOWN in XrdPosixDir::nextEntry() (#2347)
  [XrdScheduler] Add control of NPROC limit reset (#2396, #2407)
  [xrdfs] Disallow renaming a directory into a subdirectory of itself (#2250)

• Miscellaneous
  [CI] Add Ubuntu builds on ARM 64bit to GitHub Actions
  [CMake] Remove builtin isa-l library from repository
  [RPM] Drop support for CentOS 7 in xrootd.spec
  [RPM] Use sysusers.d config file for creating the xrootd system user (#2433)
  [Tests] Add new concurrent upload stress test for HTTP protocol (#2408)
  [XrdHttp] Add trailing slash to directories in listing (#2428)
  [XrdTpcTPC] Adapt packet marking to fit the new specifications (#2322, #2359)

• Full Changelog
• Issues and Pull Requests

• Major bug fixes
  [Seckrb5] Avoid null pointer dereference (#2385)
  [XrdPfc] Fix file descriptor leak when reading file size from cinfo file (#2392)

• Minor bug fixes
  [Protocol] do_WriteSpan() - Add written bytes in file statistics (#2368)
  [XrdHttp] Correct response code for PUT (from 200 to 201) (#2382)
  [XrdHttp] Set oss.asize if object size is known (#2378)
  [XrdOfs] Correct forward declaration of XrdSfsFSctl (#2405)

• Miscellaneous
  [CI] Drop CentOS 7 builds from GitHub and GitLab CI
  [CI] Move macOS GitHub Actions workflow to macOS 15
  [Docker] Add Dockerfile for Alpine Linux
  [Docker] Remove Dockerfile to build on CentOS 7
  [Docker] Update docker/ subdirectory setup and xrd-docker script
  [Misc] Fix compilation with GCC 15 (#2411)
  [Tests] Fix check for running process to prevent setup failures
  [XrdCl] Improve checking of logging format strings (#2380)
  [XrdSciTokens] Add tests for token-based authorization (#2381)

• Full Changelog
• Issues and Pull Requests

• Performance Improvements
  [XrdHttp] Avoid calling stat on HTTP GET (#2299, #2300)
  [XrdPfc] Fix behavior and improve performance of stat calls (#2349)

• Major bug fixes
  [XrdOuc] Migrate away from std::regex to avoid stack overflow bug in C++ standard library
  [XrdHttp] Client plugin returning XrdCl::errSocketTimeout triggers near-infinite loop in XrdHttp (#2357)
  [XrdHttp] Invalid chunk framing for HTTP (#2351)

• Minor bug fixes
  [Misc] Fix various issues reported by code scanning tool CodeQL
  [Python] Do not build in parallel by default to avoid using too many threads (#2356)
  [Python] Fix RPATH setting for Python bindings on macOS (#2350)
  [Python] Make environment take precedence over default arguments of add_job (#1657)
  [XCache] Add number of bytes prefetched and written to disk to the gstream record (#2366)
  [XCache] Fix errors that happen under high load (#2360)
  [XCache] Reduce verbosity of error messages (#2288, #2327, #2370)
  [XrdCl] xrdfs ls on a directory on a server runs locate (#2120)
  [XrdHttpTPC] Race condition during HTTP TPC request may cause file deletion (#2354)
  [XrdHttp] Redact tokens from additional places to prevent them leaking into logs (#2343, #2371)
  [XrdSut] Fix narrowing conversion on 32-bit systems (#2272)
  [XrdSys] Protect against array index out of bounds (#2329)

• Miscellaneous
  [CI] Update GitHub Actions and GitLab CI, add Alma 10 beta builds
  [CMake] Support building with Nvidia HPC Toolkit compilers (#2361)
  [Doxygen] Make documentation builds reproducible (#2337)
  [Tests] Avoid test failures when $RANDOM returns a multiple of 1024 (#2344)
  [Tests] Increase default timeouts in client/server tests
  [Tests] More HTTP tests added to the test suite (#2375)
  [XrdCl] Downgrade force disconnect error message to debug level (#2370)
  [XrdCl] Handle kXR_attrCache attribute in protocol response
  [XrdCms] Improve DFS error message to be less confusing (#2345)

• Full Changelog
• Issues and Pull Requests

• New Features
  [Apps] Allow cconfig to write out combined config file (issue #1894)
  [Pss] Allow for API endpoints for fixed remote origins (issue #2068)
  [Server] Allow server to assume an arbitrary network identity (issue #1855)
  [cmsd] Allow a redirector to be configured read/only (issue #1764)

• Major bug fixes
  [POSIX] Do not leak file pointer on open error (issue #2302)
  [Python] Fix memory leaks when creating Python objects (#2324)
  [Secgsi] Ensure correct certificate is used when passed via cgi with xrd.gsiusrproxy=... (issue #2292)
  [XrdCl] Fix too few arguments to formatting function

• Minor bug fixes
  [POSIX] Suppress error message when tearing down client connections (issue #2288)
  [Secgsi] Fix code to follow documentation (issue #1817)
  [Seckrb5] Improve error messages and use const where needed (issue #1948)
  [Server] Allow more flexibility in adminpath permissions (issue #2276)
  [XrdCl] Fix hidden overloaded virtual compilation error (#2291)
  [XrdCl] Redact tokens in client logs (issue #2296)
  [XrdCl] xrdfs: Fix typos in command line help string (issue #2323)
  [XrdHttp] Fix CodeQL warning for overrunning write
  [XrdNet] Avoid network identity failures (issue #1772, #2159)
  [XrdPfc] Make sure direct vread requests conform to protocol limits (issue #2308)
  [XrdSecgsi] Fix potential double free in GetSrvCertEnt()
  [XrdSecztn] Fix potential use after free

• Miscellaneous
  [CMake] Update CMake minimum requirement and supported versions
  [CMake] Update test.cmake options for coverage builds
  [Misc] Add SECURITY.md file describing XRootD security policy
  [Protocol] Allow kXR_query to return proxy origin value, for proxy servers
  [Protocol] Define readv limits
  [Protocol] Indicate whether or not server has a cache in kXR_Protocol response
  [Pss] Export the final origin url for subprocess use
  [Tests] Add new XRootD client/server test configurations
  [XrdApps] Replace pragma once with header guards
  [XrdClHttp] Conditionally load Davix grid module
  [XrdCl] Add flag to optionally suppress force disconnect error messages
  [XrdHttp] Apply keepalive when redirecting HTTP clients (#2290)
  [XrdNet] Make sure domain value is defined
  [XrdNet] Use lower case version of host names
  [XrdSys] Determine IOV_MAX at runtime
  [XrdSys] Dump coverage information on SIGTERM
  [XrdTpc] Replace pragma once with header guards
  [docker] Update CentOS 7 Dockerfile to use CentOS 7 Vault
  [systemd] Harden systemd service units for better security

ChangeLog, Issues and Pull requests