Icinga/icinga2

📋 Changes

• Revert adding `PerfdataWriterConnection`: #10851
• Docs: Note OTLP metrics package limitation on Debian 11 and Ubuntu 22.04 and Amazon Linux 2: #10837

🗑️ Deprecations

• Features newly deprecated in this version:
• `ElasticsearchWriter` (please use the new `OTLPMetricsWriter` instead)
• User declared namespace objects (i.e. `namespace foo {}`)
• We've scheduled these features for removal in v2.18 (#10734).
• These features have already been deprecated and will also be removed in v2.18:
• `IdoMySqlConnection`
• `IdoPgsqlConnection`
• `CompatLogger`
• + 4 more

📦 Enhancements

• OTLPMetricsWriter: A new perfdata writer for the OpenTelemetry protocol: #10685, #10789, and #10800
• HTTP API-handlers now stream results via chunked encoding where possible: #10554, #10692, #10516, and #10414
• Rework docker images build: #10505, #10666, and #10738
• Better debug log messages for dependencies with non-existing parents or children: #10737
• No longer require the unused `queue` parameter for `v1/events`: #10495
• Allow UID/GID values in `ICINGA2_USER` and `ICINGA2_GROUP` environment variables: #10538
• Add `messages_received_per_type` attribute to endpoints: #10387
• Better error messages on Redis® connection errors: #10727
• + 3 more

🐛 Bugfixes

• Fix a race condition in the `v1/console` handler: #10681 and #10675
• InfluxDBWriter: Print full HTTP error body when request fails: #10560
• Fix a crash when querying objects that are simultaneously deleted: #10698
• Fix a race condition leading to double notifications: #10628
• Improve BSD support: #10641, #10640, #10638, and #10635
• TimePeriod: Properly validate `ranges` field: #10633
• Fix recovery notifications outside time period being lost: #10613
• Prevent worst-case exponential complexity in dependency evaluation: #10523
• + 5 more

📦 ITL

• Support for the `check_smart` plugin: #8041
• Add `ssl_cert_long_output` option to `check_ssl_cert` plugin: #10526
• Enhanced SMART attributes monitoring plugin check configuration with more parameters: #10564
• Add plain fping CheckCommand to ITL: #10494
• Remove clear variable from disk CheckCommand: #10531
• Add a check command for NETGEAR monitoring: #10753

📦 Optimizations

• Several performance optimizations for the Redis® connection: #10391, #10732, and #10744
• IcingaDB: Better config and state update queueing: #10619
• Freeze registries after startup: #10388
• Small code and performance optimizations in `Log` class: #10504
• Improved efficiency of the `CpuBoundWork` implementation: #9990 and #10795

📦 Miscellaneous

• Documentation Improvements: #10481, #10493, #10501, #10513, #10514, #10683, #10686, #10702, and #10745
• Code Quality Improvements: #9411, #10609, #9728, #9729, #9730, #10499, #10552, #10693, #10715, #10716, and #10756
• Unit-Test Improvements: #10350, #10528, #10561, #10749, #10550, #10767, and #10776

📦 Windows

• OpenSSL shipped on Windows updated to 3.5.6: #10786
• Boost version shipped on Windows updated to 1.90: #10669

📋 Changes

• Bump OpenSSL shipped for Windows to v3.0.20: #10793
• Fixed a race condition in the `v1/console` handler: #10755, and #10740
• Fix double-free error in `posix_error::what()`: #10742
• InfluxDBWriter: print full HTTP error body when request fails: #10739

🔒 Security

• [CVE-2026-24413](https://github.com/Icinga/icinga2/security/advisories/GHSA-vfjg-6fpv-4mmr): Fix permissions of `%ProgramData%\icinga2\var` on Windows.
• SELinux: Fix policy to allow `logrotate` to execute the `icinga2` binary in order to send `SIGUSR1` for log rotation. #10643
• SELinux: Fix policy to allow `icinga2` to send `SIGTERM` to nagios plugins processes on timeout. #10694

📋 Other Changes

• doc: Update Windows development docs to use Visual Studio 2022 instead of 2019. #10695
• Windows: Update to OpenSSL 3.0.19. #10706

🔒 Security

• [CVE-2026-24413](https://github.com/Icinga/icinga2/security/advisories/GHSA-vfjg-6fpv-4mmr): Fix permissions of `%ProgramData%\icinga2\var` on Windows.

📋 Other Changes

• Windows: Update to OpenSSL 3.0.19. #10705
• Bump Boost shipped for Windows to v1.87. #10651
• Allow building with CMake 4. #10624

🔒 Security

• [CVE-2026-24413](https://github.com/Icinga/icinga2/security/advisories/GHSA-vfjg-6fpv-4mmr): Fix permissions of `%ProgramData%\icinga2\var` on Windows.

📋 Other Changes

• Windows: Update to OpenSSL 3.0.19. #10704
• Allow building with CMake 4. #10625

🔒 Security

• [CVE-2025-61907](https://github.com/Icinga/icinga2/security/advisories/GHSA-gg32-w9rm-vp2v): Prevent API users from accessing variables and objects they don't have access to within filter expressions. This allowed authenticated API users to learn information they aren't allowed to access directly.
• [CVE-2025-61908](https://github.com/Icinga/icinga2/security/advisories/GHSA-v9jg-xqhj-f43g): Add a missing null pointer check while evaluating expressions. This allowed authenticated API users to crash the Icinga 2 daemon by supplying a crafted filter expression.
• [CVE-2025-61909](https://github.com/Icinga/icinga2/security/advisories/GHSA-pg6g-g99v-mw46): Don't send signals as root in safe-reload script and logrotate config. This allowed a limited privilege escalation from the Icinga 2 service user to root. The scope is limited to sending SIGHUP or SIGUSR1 to an arbitrary process. #10590
• Windows: Update to OpenSSL 3.0.18. #10591

🐛 Bugfixes

• When a reload triggered from Icinga Director (or the /v1/config API) fails, the corresponding state is cleared, allowing to deploy a new config without having to restart Icinga 2 manually first. #10584

📦 Enhancements

• Add JSON-RPC utilization metrics and troubleshooting docs. #10586
• When sending cluster messages to other zones, prefer endpoints in the order as specified in the zone configuration. #10587
• Track the number of JSON-RPC messages received for each message type per endpoint. #10585
• Add support for building with Boost v1.89 and use it on Windows. #10578

📋 Changes

• [CVE-2025-61907](https://github.com/Icinga/icinga2/security/advisories/GHSA-gg32-w9rm-vp2v): Prevent API users from accessing variables and objects they don't have access to within filter expressions. This allowed authenticated API users to learn information they aren't allowed to access directly.
• [CVE-2025-61908](https://github.com/Icinga/icinga2/security/advisories/GHSA-v9jg-xqhj-f43g): Add a missing null pointer check while evaluating expressions. This allowed authenticated API users to crash the Icinga 2 daemon by supplying a crafted filter expression.
• [CVE-2025-61909](https://github.com/Icinga/icinga2/security/advisories/GHSA-pg6g-g99v-mw46): Don't send signals as root in safe-reload script and logrotate config. This allowed a limited privilege escalation from the Icinga 2 service user to root. The scope is limited to sending SIGHUP or SIGUSR1 to an arbitrary process. #10597
• Windows: Update to OpenSSL 3.0.18. #10595
• Windows: upgrade build toolchain to Visual Studio 2022. #10594

📋 Changes

• [CVE-2025-61907](https://github.com/Icinga/icinga2/security/advisories/GHSA-gg32-w9rm-vp2v): Prevent API users from accessing variables and objects they don't have access to within filter expressions. This allowed authenticated API users to learn information they aren't allowed to access directly. In this version this also applies to the TicketSalt variable which was previously accessible through the /v1/variables API in this version.
• [CVE-2025-61908](https://github.com/Icinga/icinga2/security/advisories/GHSA-v9jg-xqhj-f43g): Add a missing null pointer check while evaluating expressions. This allowed authenticated API users to crash the Icinga 2 daemon by supplying a crafted filter expression.
• [CVE-2025-61909](https://github.com/Icinga/icinga2/security/advisories/GHSA-pg6g-g99v-mw46): Don't send signals as root in safe-reload script and logrotate config. This allowed a limited privilege escalation from the Icinga 2 service user to root. The scope is limited to sending SIGHUP or SIGUSR1 to an arbitrary process. #10601
• Windows: Update to OpenSSL 3.0.18. #10602
• Windows: upgrade build toolchain to Visual Studio 2022. #10598

💥 Breaking Changes

• API: Fix `/v1/objects/*` queries with `attrs` set to `[]` to return empty attributes instead of all of them. #8169
• Drop the undocumented `Checkable#process_check_result` and broken `System#track_parents` DSL functions. #10457

📦 Enhancements

• Gracefully disconnect all clients on shutdown and prevent from accepting new connections. #10460
• Icinga DB: Send data to Redis® exactly as they're stored in the database to avoid extra value-mapping routines by the Go daemon. #10452
• Add support for Icinga 2 dependencies in Icinga DB. #10290
• Take host/service reachability into account when computing its severity. #10399
• Rework the dependency cycle detection to efficiently handle large configs and provide better error messages. #10360
• Don't log next check timestamp in scientific notation. #10352
• Automatically remove child downtimes when removing parent downtime. #10345
• Ensure compatibility with Boost version up to v1.88. #10278 #10419
• + 6 more

🐛 Bugfixes

• Core
• Use `Checkable#check_timeout` also for rescheduling remote checks. #10443
• Log: Don't unnecessarily buffer log messages that are going to be dropped anyway. #10177
• Don't loose perfdata counter (`c`) unit when normalizing performance data for Icinga DB. #10432
• Fix broken SELinux policy on Fedora ≥ 41 due to the new `/usr/sbin` to `/usr/bin` equivalence. #10429
• Don't load `Notification` objects before `User` and `UserGroup` objects to allow them to be referenced in notifications. #10427
• Ensure consistent DST handling across different platforms. #10422
• Fix Icinga 2 doesn't generate a core dump when it crashes with SIGABRT. #10416
• + 28 more

📦 ITL

• Add `--maintenance_mode_state` (`$vmware_maintenance_mode_state`) argument to `vmware-esx-command` check command. #10435
• Add `-n` (`$load_procs_to_show$`) argument to `load` check command. #10426
• Add `--inode-perfdata` (`$disk_np_inode_perfdata$`) argument to `disk` check command. #10395
• Add `-r` (`$ssh_remote_version$`) and `-P` (`$ssh_remote_protocol$`) arguments to `ssh` check command. #10283
• Add `--unplugged_nics_state` (`$vmware_unplugged_nics_state$`) argument to `vmware-esx-soap-host-net` and `vmware-esx-soap-host-net-nic` check commands. #10261
• Add `-X` (`$proc_exclude_process$`) argument to `procs` check command. #10232
• Add `--dane` (`$ssl_cert_dane$`) argument to `ssl_cert` check command. #10196
• Fix `check_ssl_cert` deprecation warnings. #9758
• + 9 more

📝 Documentation

• Don't use `dnf config-manager` to configure Fedora repository and mention `icingadb-redis-selinux` package. #10479
• Update the outdated cold startup duration documentation to reflect the current behavior. #10446
• Indent second-level unordered lists with four spaces to correctly render them in the HTML documentation. #10441
• Add a reference to the check result state documentation from within the Advanced Topics section. #10421
• Improve the documentation of how to generate Icinga 2 core dumps. #10418
• Update Icinga 2 CLI output examples to match the current output. #10323
• Fix incorrect `ping_timeout` value in the `hostalive` check command documentation. #10069

📦 Code Quality

• Simplify deferred SSL shutdown in `ApiListener#NewClientHandlerInternal()`. #10301
• Don't unnecessarily shuffle configuration items during config load. #10008
• Sort config types by their load dependencies at namespace initialization time to save some round trips during config load. #10148
• Fix `livestatus` build error on macOS without unity builds. #10176
• Remove unused methods in `SharedObject` class. #10456
• Remove unused `ProcessingResult#NoCheckResult` enum value. #10444
• CMake: Drop all third-party cmake modules and use the ones shipped with CMake v3.8+. #10403
• CMake: Raise the minimum required policy to `3.8`. #10402 #10478
• + 16 more

📋 Changes

• CVE-2025-48057: Prevent invalid certificates from being renewed with OpenSSL older than v1.1.0.
• Fix use-after-free in VerifyCertificate(): Additionally, a use-after-free was found in the same
• Windows: Update OpenSSL shipped on Windows to v3.0.16.
• Fix a failing test case on systems `time_t` is only 32 bits #10344.

📋 Changes

• CVE-2025-48057: Prevent invalid certificates from being renewed with OpenSSL older than v1.1.0.
• Fix use-after-free in VerifyCertificate(): Additionally, a use-after-free was found in the same
• Windows: Update OpenSSL shipped on Windows to v3.0.16. #10455
• Windows: Fix unknown ctest(1) `--log_level` argument. #10453
• Don't require to build .msi as admin. #10454

📋 Changes

• CVE-2025-48057: Prevent invalid certificates from being renewed with OpenSSL older than v1.1.0.
• Fix use-after-free in VerifyCertificate(): Additionally, a use-after-free was found in the same
• Windows: Update OpenSSL shipped on Windows to v3.0.16.

🐛 Bug Fixes

• Don't close anonymous connections before sending the response for a certificate request #10337
• Performance data: Don't discard min/max values even if crit/warn thresholds aren’t given #10339
• Fix a failing test case on systems `time_t` is only 32 bits #10343

📝 Documentation

• Document the -X option for the mail-host-notification and mail-service-notification commands #10335
• Include Nagios in the migration docs #10324
• Remove RHEL 7 from installation instructions #10334
• Add instructions for installing build dependencies on Windows Server #10336

🐛 Crash Fixes

• Invalid `DateTime#format()` arguments in config and console on Windows Server 2016 and older. #10112
• Downtime scheduling at runtime with non-existent trigger. #10049
• Object creation at runtime during Icinga DB initialization. #10151
• Comment on a service of a non-existent host. #9861

🐛 Miscellaneous Bugfixes

• Lost notifications after recovery outside the notification time period. #10187
• TimePeriod/ScheduledDowntime exceeding specified date range. #9983 #10107
• Clean up failure for obsolete Downtimes. #10062
• ifw-api check command: use correct process-finished handler. #10140
• Email notification scripts: strip 0x0D (CR) for a proper Content-Type. #10061
• Several fixes and improvements of the code quality. #10066 #10214 #10254 #10263 #10264

📦 Cluster and API

• Sync runtime objects in topological order to honor their dependencies. #10000
• Make parallel config syncs more robust. #10013
• After object creation via API fails, clean up properly for the next try. #10111
• Close HTTPS connections properly to prevent leaks. #10005 #10006
• Reduce the number of cluster messages in memory at the same time. #9991 #9999 #10210
• Once a cluster connection shall be closed, stop communicating. #10213 #10221
• Remove unnecessary blocking of semaphores. #9992 #9994
• Reduce unnecessary cluster messages setting the next check time. #10011

📦 Icinga DB and IDO

• IDO: fix object relations after aborted synchronization. #10065
• Icinga DB, IDO: limit all timestamps to four year digits. #10058 #10059
• Icinga DB: limit execution\_time and latency (milliseconds) to database schema. #10060

📦 Troubleshooting

• Add `/v1/debug/malloc_info` which calls `malloc_info(3)` if available. #10015
• Add log messages about own network I/O. #9993 #10141 #10207
• Several fixes and improvements of log messages. #9997 #10021 #10209

📦 Windows

• Update OpenSSL shipped on Windows to v3.0.15. #10170
• Update Boost shipped on Windows to v1.86. #10114
• Support CMake v3.29. #10037
• Don't require to build .msi as admin. #10137
• Build configuration scripts: allow custom `$CMAKE_ARGS`. #10312

📝 Documentation

• Distributed Monitoring: add section "External CA/PKI". #9825
• Explain how to enable/disable debug logging on the fly. #9981
• Update supported OS versions and repository configuration. #10064 #10090 #10120 #10135 #10136 #10205
• Several fixes and improvements. #9960 #10050 #10071 #10156 #10194
• Replace broken links. #10115 #10118 #10282
• Fix typographical and similarly trivial errors. #9953 #9967 #10056 #10116 #10152 #10153 #10204

🐛 Crash Fixes

• Invalid `DateTime#format()` arguments in config and console on Windows Server 2016 and older. #10165
• Downtime scheduling at runtime with non-existent trigger. #10127
• Object creation at runtime during Icinga DB initialization. #10164
• Icinga DB: several numbers out of database schema range. #10244

🐛 Miscellaneous Bugfixes

• Lost notifications after recovery outside the notification time period. #10241
• TimePeriod/ScheduledDowntime exceeding specified date range. #10128 #10133
• Make parallel config syncs more robust. #10126
• Reduce unnecessary cluster messages setting the next check time. #10168

📦 Windows

• Update OpenSSL shipped on Windows to v3.0.15. #10175
• Update Boost shipped on Windows to v1.86. #10134
• Support CMake v3.29. #10087
• Don't require to build .msi as admin. #10305
• Build configuration scripts: allow custom `$CMAKE_ARGS`. #10315

📋 Changes

• Security: fix TLS certificate validation bypass. CVE-2024-49369
• Security: update OpenSSL shipped on Windows to v3.0.15.
• Windows: sign MSI packages with a certificate the OS trusts by default.

📋 Changes

• Security: fix TLS certificate validation bypass. CVE-2024-49369
• Security: update OpenSSL shipped on Windows to v3.0.15.
• Windows: sign MSI packages with a certificate the OS trusts by default.

📋 Changes

• Security: fix TLS certificate validation bypass. CVE-2024-49369
• Security: update OpenSSL shipped on Windows to v3.0.15.
• Windows: sign MSI packages with a certificate the OS trusts by default.

📋 Changes

• Security: fix TLS certificate validation bypass. CVE-2024-49369
• Security: update OpenSSL shipped on Windows to v3.0.15.
• Windows: sign MSI packages with a certificate the OS trusts by default.

📋 Changes

• InfluxDB: truncate timestamps to whole seconds to save disk space. #9969
• HttpServerConnection: log request processing time as well. #9970
• Update Boost shipped on Windows to v1.84. #9970

🔒 Security

• Automatically renew own root CA and distribute it to all nodes. #9933
• Update OpenSSL shipped on Windows to v3.0.12. #9946
• Disable TLS renegotiation (handshake on existing connection). #9946

🐛 Bugfixes

• Icinga DB feature: fix crash due to missing NULL pointer check. #9946
• Icinga DB feature: fix data written into Redis crashing the Go daemon. #9946
• GelfWriter: fix deadlock on stop/reload caused by busy queue. #9947
• Don't lose notifications due to too long output, truncate it. #9947

📦 Enhancements

• Discard duplicate problem notifications due to state filtering. #9932
• Speed up API filters targeting specific hosts/services to O(1). #9944
• POST /v1/console/\*: return HTTP 503 while Icinga is reloading. #9947
• Update Boost shipped on Windows to v1.83. #9946
• Documentation: several fixes and improvements. #9921

🔒 Security

• Automatically renew own root CA and distribute it to all nodes. #9934
• Update OpenSSL shipped on Windows to v3.0.12. #9945
• Disable TLS renegotiation (handshake on existing connection). #9945

🐛 Bugfixes

• Icinga DB feature: fix crash due to missing NULL pointer check. #9945
• Icinga DB feature: fix data written into Redis crashing the Go daemon. #9945

📦 Updates

• Update Boost shipped on Windows to v1.83. #9945

📦 Notes

• Upgrading docs: https://icinga.com/docs/icinga2/snapshot/doc/16-upgrading-icinga-2/#upgrading-to-2-14

💥 Breaking Changes

• Remove CheckResultReader (which has been deprecated since v2.9). #9714
• Remove StatusDataWriter (which has been deprecated since v2.9). #9715
• ElasticsearchWriter: drop support for Elasticsearch < v7. #9812
• Consider a checkable unreachable once one Dependency fails.
• Previously all of them had to fail. (Consult the upgrading docs.) #8218
• API: reject config modifications during reload with HTTP status 503. #9445
• `icinga2 daemon`: to reduce config load time, write file needed by
• `icinga2 object list` only if `--dump-objects` is given. #9586 #9591
• + 23 more

📦 Enhancements

• Significantly reduce config load time of large setups.
• Allow to connect dependencies via redundancy groups. Only parents within
• one group are assumed to provide redundancy for each other. #8218
• Built-in check command ifw-api, communicates directly with the Icinga for
• Windows REST API. (Doesn't spawn a PowerShell process for that.) #9062
• JournaldLogger which logs to systemd journal. #9000
• API: POST /v1/objects: allow to discard some previously modified attributes,
• i.e. to restore the config files' values. #9783
• + 7 more

🐛 Bugfixes

• Icinga DB feature: normalize several Redis data not to crash the Go daemon.
• Fix parsing of perfdata across multiple lines in plugin output. #8969
• icinga check: fix last reload failure time. #8429 #9827
• Resolve macros inside custom vars of IcingaApplication. #9779
• SELinux: allow Icinga and its plugins to write to syslog. #9688
• ElasticsearchWriter: fix data buffer flush race condition during stop. #9810
• Trigger flexible downtimes not in the past if checkable is already down. #9726
• Send downtime expiration notifications immediately, not after up to a minute. #9726
• + 13 more

📦 ITL

• Add `linux_netdev` check command. #9045
• `disk`: don't pass -m (`disk_megabytes`) by default. #9642
• `disk`: pass -X fuse.portal (`disk_exclude_type`) by default. #9459
• `http`: support multiple -k (`http_header`) as array. #8574
• `icmp`: double defaults for -w (`icmp_wpl`) and -c (`icmp_cpl`). #9041
• `logfiles`: pass --winwarncrit (`logfiles_winwarncrit`) without argument. #9056
• `nwc_health`: pass SNMPv3-only args only when using SNMPv3. #9095
• `vmware-esx-dc-runtime-tools` and `vmware-esx-soap-vm-runtime-tools`:
• + 32 more

📦 Miscellaneous

• Require GCC 7+ for building to enable C++17. #9133 #9485 #9489
• Require CMake v2.8.12+ for building.
• (Compatibility with older ones will be removed from a future CMake version.) #9706
• Repair config reload on OpenBSD by using waitpid(2), not a SIGCHLD handler. #9518
• Ignore SIGHUP in main process to allow `/etc/rc.d/icinga2 reload`
• sending it to all Icinga 2 processes on OpenBSD. #9622
• Fix crash in debug build on macOS when API and debug log are enabled. #9497
• Update Boost shipped on Windows to v1.82. #9761
• + 5 more

🐛 Bugfixes

• Icinga DB feature: normalize several Redis data not to crash the Go daemon. #9814
• Don't hang in timed out connection attempt. #9815
• Trigger flexible downtimes not in the past if checkable is already down. #9817
• ElasticsearchWriter: fix data buffer flush race condition during stop. #9818
• SELinux: allow Icinga and its plugins to write to syslog. #9819
• Fix lost acknowledgements after re-connect. #9820
• Fix parsing of perfdata across multiple lines in plugin output. #9821
• cluster-zone check: don't complain about not connected
• + 1 more

📦 Updates

• Update Boost shipped on Windows to v1.82. #9816
• Update OpenSSL shipped on Windows to v3.0.9. #9816
• Update vendored https://github.com/nlohmann/json to v3.9.1. #9816
• Update vendored https://github.com/nemtrif/utfcpp to v3.2.3. #9816

🔒 Security

• Windows: update bundled OpenSSL to v1.1.1t. #9672

🐛 Bugfixes

• SELinux: fix user and domain creation by explicitly setting the role. #9690
• Signal handlers: don't interrupt and break plugins spawning. #9682
• Icinga DB: take check\_period into account during overdue calculation. #9679
• Avoid corrupted files: use fsync(2)/FlushFileBuffers() everywhere. #9681
• Solaris: fix compile error. #9680

📦 Enhancements

• Windows: update bundled Boost to v1.81. #9678
• Documentation: several fixes and improvements. #9671

🔒 Security

• Windows: update bundled OpenSSL to v1.1.1t. #9686

🐛 Bugfixes

• SELinux: fix user and domain creation by explicitly setting the role. #9689

📦 Enhancements

• Windows: update bundled Boost to v1.81. #9686

🐛 Bugfixes

• Improve the throughput of the Icinga DB feature. #9550
• Multiple changes to speed up evaluation of apply rules. #9559 #9565 #9558
• Fix a possible crash on config loading related to `ignore_on_error`. #9560
• Check API user permission on objects returned by joins. #9561
• Windows: update bundled Boost and OpenSSL versions. #9562 #9567

🐛 Bugfixes

• Ensure not to write an incomplete (i.e. corrupt) state file. #9467
• ITL: Render vars.apt\_upgrade=true as --upgrade, not --upgrade=true. #9458
• Icinga DB: Add missing Redis SELinux policy. #9473
• Windows: Don't spam the event log with non-error startup messages. #9457
• Windows: Update bundled version of OpenSSL. #9460
• Docs: Update RHEL 8 installation instructions. #9482
• Docs: Add RHEL 9 installation instructions. #9482

🐛 Bugfixes

• Fix a race-condition involving object attribute updates that could result in a crash. #9395
• After a host recovered, only send problem notifications for services after they have been rechecked afterwards to avoid false notifications. #9348
• Speed up config validation by avoiding redundant serialization of objects. #9400
• Add a `separator` attribute to allow using arguments like `--key=value` as required by some check plugins. This fixes the `--upgrade` and `--dist-upgrade` arguments of `check_apt`. #9397
• Windows: Update bundled versions of Boost and OpenSSL. #9360 #9415

📦 Icinga DB

• Add an `icingadb` CheckCommand to allow checking if Icinga DB is healthy. #9417
• Update documentation related to Icinga DB. #9423
• Fix a bug where history events could miss the environment ID. #9396
• Properly serialize attributes of command arguments when explicitly set to `null`. #9398
• Rename some attributes to make the database schema more consistent. #9399 #9419 #9421
• Make the error message more helpful if the API isn't set up #9418