[renovate]

This PR contains the following updates:

Package	Update	Change
adguard/adguardhome (source)	patch	v0.107.71 → v0.107.80

---

Release Notes

AdguardTeam/AdGuardHome (adguard/adguardhome)

v0.107.80

Compare Source

See also the v0.107.80 GitHub milestone.

NOTE: Add new changes BELOW THIS COMMENT.
-->

Changed

• Client settings in the new web interface: Use global settings now applies to Protection only, blocked services have a separate Use global blocked services switch, and upstream DNS servers and the DNS cache are always editable.

Fixed

• Invalid SVCB record from DDR when DoH routes are empty.

• Schedule shift on clock change cases (#​8670).

• Incorrect behaviour on the first launch with the --check-config flag.

• Reading partially received TCP prefix.

• A panic when updating AdGuard Home binary via the command line with use_private_ptr_resolvers set to true (#​8613).

• log.enabled set to false leaving the legacy logger enabled (#​8565).

• DHCP server persisting uncommitted leases with zero expiry after DHCPDISCOVER messages (#​8572).

• DHCPv4 settings not being saved when an IPv6-capable interface is selected and DHCPv6 is not configured (#​8608).

• DHCP not being enabled when only the DHCPv6 section is configured.

• DHCP IPv4 range subnet validation not working (#​8609).

• Client ID validation rejecting valid IPv6 CIDRs with an embedded dotted-decimal IPv4 address (#​8610).

• Client ID validation accepting IPv4 addresses with leading-zero octets (192.168.01.1), malformed MAC addresses, and ClientIDs with leading or trailing hyphens.

• IP addresses being sorted lexicographically instead of numerically in the web interface (#​8636).

• Invalid secondary bootstrap resolver IPv4 address (#​8637).

• The Server addresses dialog overflowing horizontally when a long value is entered. Long unbreakable values in the settings rows overflowing the page.

• Encrypted DNS server addresses not appearing in the Setup Guide until the page was reloaded after enabling encryption.

• Passwords containing emoji being rejected by the first-run setup wizard in the new web interface.

• Cache size and TTL override rows being locked while the DNS cache was disabled in the new web interface (#​8644).

• Tables staying on an empty page after the last row of that page was deleted in the new web interface (#​8644).

• The Log out button opening the login page in a new tab in the new web interface (#​8661).

• Per-client blocked services schedules being reset when a client was saved in the new web interface (#​8638).

• Client sub-pages of the new web interface showing the default values instead of the client's settings when opened directly or reloaded.

v0.107.79

Compare Source

See also the v0.107.79 GitHub milestone.

Security

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.26.6.

• AdGuard Home is now more resistant to resource exhaustion attacks when using DNS-over-QUIC.

  This is GHSA-w6v6-f44j-3rj2. We thank @​ATinyShoe for reporting this security issue.

Added

• Bootstrap servers configuration now supports comments.

• New property "language" in POST /control/install/check_config and POST /control/install/configure HTTP APIs.

• The user is able to remove the static lease's hostname via the HTTP API.

Changed

• The edge channel has been switched to the new UI and versioning scheme.

Deprecated

• strict_sni_check is now deprecated.

Fixed

• DNS64 treating unresolved CNAME/DNAME answers as the end of resolution chain (#​7514).

• Blocked requests without an EDNS(0) OPT record (#​8183).

v0.107.78

Compare Source

See also the v0.107.78 GitHub milestone.

Security

• AdGuard Home is now more resistant to JIGGLE attacks.

  This is GHSA-p5f5-3p5g-rfjw. We thank @​Nora-Qiu for reporting this security issue.

• AdGuard Home now validates responses from DoH upstreams more strictly.

  This is GHSA-4qjf-2hgm-92q6. We thank @​wallace0409 for reporting this security issue.

• QUIC connections are now protected from unbounded reads.

  This is GHSA-qr92-rwvw-mhgh and GHSA-cccx-2r6r-m9r4. We thank @​wallace0409 for reporting this security issue.

• AdGuard Home now validates responses from DNSCrypt upstreams more strictly.

• The H2C connection establishment via HTTP/1.1 request upgrade is no longer supported. See RFC 9113.

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.26.5.

• The size of rulelists is limited. This is necessary to prevent a user's machine from becoming overloaded if the filter source misbehaves.

  We thank Damir (@​Evelynkaz) for reporting this security issue.

Added

• Improved updater logging to give users more insight into the problem with version updating (#​8410).

Changed

• The interval of filter updates can now be set to any number of hours between 0 and 8760 (365 days) in the configuration file.

Configuration changes

• The filtering object of the YAML configuration now includes a new property, max_http_size, which defines the maximum size of the HTTP request for rulelists. To disable the limitation, set a large size, such as 1 TB.

• Invalid AA flag in DNS responses (#​7955).

• The parsing of the ech parameter in DNS rewrite rules for the HTTPS record type (#​8276).

• Validation of the answer field in DNS rewrite rules in case it is represented as CNAME.

• Blocked services check on the Custom filtering rules page does not work properly without specifying of a client.

v0.107.77

Compare Source

See also the v0.107.77 GitHub milestone.

Security

• Authorization in GLiNET mode is no longer vulnerable to path traversal attacks.

  NOTE: This is CVE-2026-41448. We thank @​djnnvx for reporting this security issue.

Added

• New reason query parameter in GET /control/querylog. See openapi/openapi.yaml for the full description.

Deprecated

• Query parameter response_status in GET /control/querylog is now deprecated. Use new reason query parameter instead.

v0.107.76

Compare Source

See also the v0.107.76 GitHub milestone.

Security

• QUIC connections now observe timeouts more strictly.

  This is GHSA-73vv-3434-p64c. We thank @​N0zoM1z0 for reporting this security issue.

Changed

• Duration values in YAML configuration file now support d (days) units and has been updated.

  NOTE: Any rollback to version below the v0.107.76 should convert the values back to hours.

Fixed

• DNS caching with disabled DNSSEC (#​8384).

v0.107.75

Compare Source

See also the v0.107.75 GitHub milestone.

Security

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.26.3.

• IDs of requests received over DoH and DoQ and forwarded to plain-DNS upstreams are now set to non-zero values to improve security.

  This is GHSA-xgx4-4h9w-53pv. We thank @​N0zoM1z0 for reporting this security issue.

Changed

• Frontend API requests no longer depend on axios.

• Dashboard charts use Recharts instead of Nivo.

• enable_dnssec in dns configuration now defines whether the proxy should set the DO flag in the upstream requests, the default is true (#​7046).

Fixed

• Statistics database deadlock (#​8359).

• Translated labels on the DNS settings pages not updating after changing the UI language.

• Dashboard charts now correctly display lower query counts (#​6823).

• Redundant validation warnings about DHCP when it's disabled (#​8348).

• Safe Browsing and Parental Control labels on the General Settings page not updating after changing the UI language.

v0.107.74

Compare Source

See also the v0.107.74 GitHub milestone.

Security

• Frontend libraries has been updated to prevent the possibility of exploiting the vulnerability described in CVE-2026-40175.

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.26.2.

Changed

Configuration changes

In this release, the schema version has changed from 33 to 34.

• Added a new field doh in http configuration.

  # BEFORE:
  'http':
    # …
  'tls':
    # …
    'allow_unencrypted_doh': false
  
  # AFTER:
  'http':
    # …
    'doh':
      'insecure_enabled': false
      'routes':
        - 'GET /dns-query'
        - 'POST /dns-query'
        - 'GET /dns-query/{ClientID}'
        - 'POST /dns-query/{ClientID}'
  'tls':
    # …

  To roll back this change, set the schema_version back to 33.

Fixed

• Incorrect forwarding of root domain requests when domain-specific upstreams are configured (#​7058).

• The strict SNI check setting is not persisted when the TLS configuration is changed (#​8327).

• Status reported by the launchd service implementation in cases of scheduled service restart.

• Fixed clients block/unblock when moving clients between allowed and disallowed lists.

v0.107.73

Compare Source

See also the v0.107.73 GitHub milestone.

Security

• Authentication is now applied to requests that have been upgraded from HTTP/2 Cleartext (H2C) requests to public resources.

  NOTE: We thank @​mandreko for reporting this security issue.

v0.107.72

Compare Source

See also the v0.107.72 GitHub milestone.

Security

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.25.7.

Added

• AdGuard Home now tracks the TLS certificate and key files for updates and reloads them after any updates are detected (#​3962).

• New query parameter recent in GET /control/stats/ defines statistics lookback period in milliseconds. See openapi/openapi.yaml for details.

• New field "ignored_enabled" in GetStatsConfigResponse or GetQueryLogConfigResponse. See openapi/openapi.yaml for details.

Changed

• In addition to modifying the contents of a hosts file, deleting or renaming the file now also updates runtime clients and DNS filtering results.

Configuration changes

In this release, the schema version has changed from 32 to 33.

• Added a new boolean field ignored_enabled in querylog and statistics config.

  # BEFORE:
  'querylog':
    # …
    'ignored':
    - '|.^'
  'statistics':
    # …
    'ignored':
    - '|.^'
  
  # AFTER:
  'querylog':
    # …
    'ignored':
    - '|.^'
    'ignored_enabled': true
  'statistics':
    # …
    'ignored':
    - '|.^'
    'ignored_enabled': true
    ```
  
  To roll back this change, set the `schema_version` back to `32`.

Fixed

• Executable permissions in some Docker installations (#​8237).

• Unknown blocked services from both global and client configuration now logged instead of causing server crash.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.