Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2026-09-03 18:47:05 -04:00
Code Issues Packages Projects Releases Wiki Activity
5,067 Commits 14 Branches 85 Tags
f1d835aa5123055d830195d4ed0ebe059078ff9a
Commit Graph

5067 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Yong Tang
f1d835aa51 plugin/dns64: Fixes a nil pointer dereference panic in dns64 during response (#8511) 
This PR fixes a nil pointer dereference panic in dns64 during response,
when the internal A-record upstream re-lookup returns a nil response.

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
 2026-09-02 21:07:28 -07:00
Yong Tang
88ab058ba2 plugin/minimal: Fixes a nil pointer dereference panic in minimal prefetch response processing (#8506) 
* plugin/minimal: Fixes a nil pointer dereference panic in minimal prefetch response processing

This PR fixes a nil pointer dereference panic in minimal prefetch response processing

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

* Fix lint

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

---------

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
 2026-09-02 07:58:49 -07:00
dependabot[bot]
a87f9efcc5 build(deps): bump github.com/prometheus/exporter-toolkit (#8510) 
Bumps [github.com/prometheus/exporter-toolkit](https://github.com/prometheus/exporter-toolkit) from 0.18.0 to 0.19.0.
- [Release notes](https://github.com/prometheus/exporter-toolkit/releases)
- [Commits](https://github.com/prometheus/exporter-toolkit/compare/v0.18.0...v0.19.0)

---
updated-dependencies:
- dependency-name: github.com/prometheus/exporter-toolkit
  dependency-version: 0.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-02 07:04:25 -07:00
dependabot[bot]
b8060a1e80 build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 (#8509) 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.83.1 to 1.83.2.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.83.1...v1.83.2)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.83.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-02 07:04:09 -07:00
dependabot[bot]
947bc75578 build(deps): bump the aws group with 6 updates (#8508) 
Bumps the aws group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.43.7` | `1.43.8` |
| [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.32.38` | `1.32.39` |
| [github.com/aws/aws-sdk-go-v2/credentials](https://github.com/aws/aws-sdk-go-v2) | `1.19.37` | `1.19.38` |
| [github.com/aws/aws-sdk-go-v2/feature/ec2/imds](https://github.com/aws/aws-sdk-go-v2) | `1.18.38` | `1.18.39` |
| [github.com/aws/aws-sdk-go-v2/service/route53](https://github.com/aws/aws-sdk-go-v2) | `1.65.9` | `1.65.10` |
| [github.com/aws/aws-sdk-go-v2/service/secretsmanager](https://github.com/aws/aws-sdk-go-v2) | `1.44.7` | `1.44.8` |


Updates `github.com/aws/aws-sdk-go-v2` from 1.43.7 to 1.43.8
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/v1.43.7...v1.43.8)

Updates `github.com/aws/aws-sdk-go-v2/config` from 1.32.38 to 1.32.39
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/config/v1.32.38...config/v1.32.39)

Updates `github.com/aws/aws-sdk-go-v2/credentials` from 1.19.37 to 1.19.38
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/credentials/v1.19.37...credentials/v1.19.38)

Updates `github.com/aws/aws-sdk-go-v2/feature/ec2/imds` from 1.18.38 to 1.18.39
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/config/v1.18.38...config/v1.18.39)

Updates `github.com/aws/aws-sdk-go-v2/service/route53` from 1.65.9 to 1.65.10
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/fsx/v1.65.9...service/fsx/v1.65.10)

Updates `github.com/aws/aws-sdk-go-v2/service/secretsmanager` from 1.44.7 to 1.44.8
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/ssm/v1.44.7...service/efs/v1.44.8)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2
  dependency-version: 1.43.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: aws
- dependency-name: github.com/aws/aws-sdk-go-v2/config
  dependency-version: 1.32.39
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: aws
- dependency-name: github.com/aws/aws-sdk-go-v2/credentials
  dependency-version: 1.19.38
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: aws
- dependency-name: github.com/aws/aws-sdk-go-v2/feature/ec2/imds
  dependency-version: 1.18.39
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: aws
- dependency-name: github.com/aws/aws-sdk-go-v2/service/route53
  dependency-version: 1.65.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: aws
- dependency-name: github.com/aws/aws-sdk-go-v2/service/secretsmanager
  dependency-version: 1.44.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: aws
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-02 07:03:45 -07:00
dependabot[bot]
190dc81805 build(deps): bump the codeql group with 4 updates (#8507) 
Bumps the codeql group with 4 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.37.8 to 4.37.9
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](db488ddef3...cdf488f595)

Updates `github/codeql-action/autobuild` from 4.37.8 to 4.37.9
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](db488ddef3...cdf488f595)

Updates `github/codeql-action/analyze` from 4.37.8 to 4.37.9
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](db488ddef3...cdf488f595)

Updates `github/codeql-action/upload-sarif` from 4.37.8 to 4.37.9
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](db488ddef3...cdf488f595)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-02 07:03:32 -07:00
github-actions[bot]
2ad79f66fa auto make -f Makefile.doc (#8500) 2026-09-01 02:41:41 -07:00
Paco Cartones
85aa27cd9c plugin/hosts: don't drop entries after an over-long line (#8496) 
bufio.Scanner stops at the first line longer than its 64KiB default
buffer and reports bufio.ErrTooLong from Err(). parse() never checked
Err(), so that line and every entry after it were dropped silently: the
hosts file simply looked shorter than it is, with nothing in the log.

Raise the scanner's limit to 1MiB (the scanner still grows its buffer
lazily, so nothing is preallocated up front) and log an error if the
scan does stop early, so the truncation is at least visible.

Signed-off-by: Paco Cartones <pacocartones@users.noreply.github.com>
Co-authored-by: Paco Cartones <pacocartones@users.noreply.github.com>
 2026-09-01 00:01:04 -07:00
Ilya Kulakov
ac796cd723 test: fix flaky tests that don't check dns.Exchange response is non-nil (#8501) 
dns.Exchange may return nil on error.

Signed-off-by: Ilya Kulakov <kulakov.ilya@gmail.com>
 2026-08-31 22:55:17 -07:00
dependabot[bot]
c113fe4876 build(deps): bump the codeql group with 4 updates (#8493) 2026-08-29 02:59:23 -07:00
dependabot[bot]
db30320f75 build(deps): bump github.com/prometheus/exporter-toolkit (#8495) 2026-08-29 02:59:11 -07:00
dependabot[bot]
7b33507933 build(deps): bump the aws group with 6 updates (#8494) 2026-08-29 02:59:00 -07:00
Yong Tang
8a7312eb57 Group AWS SDK v2 modules so related updates land together in one PR. (#8489) 
* Group AWS SDK v2 modules so related updates land together in one PR.

This PR Group AWS SDK v2 modules so related updates land together in one PR.
Also rename the k8s/etcd group keys to valid Dependabot identifiers.

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

* Update

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

---------

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
 2026-08-27 19:06:55 -07:00
dependabot[bot]
78c7c61d3c build(deps): bump github.com/aws/aws-sdk-go-v2/config (#8483) 
Bumps [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) from 1.32.36 to 1.32.37.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/config/v1.32.36...config/v1.32.37)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/config
  dependency-version: 1.32.37
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-27 01:35:26 -07:00
dependabot[bot]
31643259cf build(deps): bump github.com/aws/aws-sdk-go-v2/credentials (#8486) 2026-08-26 23:36:01 -07:00
dependabot[bot]
4e2ac5e250 build(deps): bump golang.org/x/net from 0.57.0 to 0.58.0 (#8485) 2026-08-26 23:35:47 -07:00
dependabot[bot]
dcd09b70fb build(deps): bump github.com/aws/aws-sdk-go-v2/service/route53 (#8479) 2026-08-26 21:08:28 -07:00
dependabot[bot]
a15fc63b41 build(deps): bump github.com/aws/aws-sdk-go-v2/feature/ec2/imds (#8477) 
Bumps [github.com/aws/aws-sdk-go-v2/feature/ec2/imds](https://github.com/aws/aws-sdk-go-v2) from 1.18.36 to 1.18.37.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/config/v1.18.36...config/v1.18.37)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/feature/ec2/imds
  dependency-version: 1.18.37
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-26 15:34:28 -07:00
houyuwushang
789b8d1665 plugin/tsig: expose validated TSIG key identity (#8471) 
Store the normalized key name in the request context only after successful TSIG verification. This lets downstream plugins distinguish unsigned requests from authenticated requests and authorize by key without relying on the stripped TSIG RR or exposing secret material.

Signed-off-by: houyuwushang <liuluoqianqiu@outlook.com>
 2026-08-26 14:13:48 -07:00
dependabot[bot]
ff06b2a593 build(deps): bump github.com/aws/aws-sdk-go-v2/service/secretsmanager (#8487) 
Bumps [github.com/aws/aws-sdk-go-v2/service/secretsmanager](https://github.com/aws/aws-sdk-go-v2) from 1.44.5 to 1.44.6.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/mgn/v1.44.5...service/ssm/v1.44.6)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/service/secretsmanager
  dependency-version: 1.44.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-26 14:12:42 -07:00
dependabot[bot]
131bc60e0d build(deps): bump the codeql group with 4 updates (#8481) 
Bumps the codeql group with 4 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.37.6 to 4.37.7
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](5595ccaf91...ff2f1c621b)

Updates `github/codeql-action/autobuild` from 4.37.6 to 4.37.7
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](5595ccaf91...ff2f1c621b)

Updates `github/codeql-action/analyze` from 4.37.6 to 4.37.7
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](5595ccaf91...ff2f1c621b)

Updates `github/codeql-action/upload-sarif` from 4.37.6 to 4.37.7
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](5595ccaf91...ff2f1c621b)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.37.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-26 14:12:15 -07:00
dependabot[bot]
fe0d044bc0 build(deps): bump github.com/miekg/dns from 1.1.72 to 1.1.73 (#8480) 
Bumps [github.com/miekg/dns](https://github.com/miekg/dns) from 1.1.72 to 1.1.73.
- [Commits](https://github.com/miekg/dns/compare/v1.1.72...v1.1.73)

---
updated-dependencies:
- dependency-name: github.com/miekg/dns
  dependency-version: 1.1.73
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-26 14:11:58 -07:00
dependabot[bot]
a21b29694d build(deps): bump astral-sh/setup-uv from 10.0.0 to 10.0.1 (#8482) 
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 10.0.0 to 10.0.1.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](ae62891fec...20cfd1bf94)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-26 14:11:46 -07:00
dependabot[bot]
5526852c39 build(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.1 (#8484) 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.83.0 to 1.83.1.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.83.0...v1.83.1)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.83.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-26 14:11:34 -07:00
dependabot[bot]
9bb02c3d77 build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#8488) 
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.12.0 to 1.12.1.
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](https://github.com/stretchr/testify/compare/v1.12.0...v1.12.1)

---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-26 14:11:22 -07:00
houyuwushang
70b5d6b5be core/dnsserver: add opt-in opcode admission (#8469) 
Keep miekg/dns's default request policy unless a plugin explicitly registers an additional opcode. Aggregate the policy at the listener, then enforce it again after zone routing so mixed server blocks on one socket remain isolated.

Apply the same policy to UDP, TCP, and DNS-over-TLS while preserving TSIG verification and the one-question requirement.

Signed-off-by: houyuwushang <liuluoqianqiu@outlook.com>
 2026-08-26 01:41:28 -07:00
houyuwushang
b8720090b5 plugin/etcd: allow disabling legacy apex fallback (#8468) 
Signed-off-by: houyuwushang <liuluoqianqiu@outlook.com>
 2026-08-23 17:56:12 -07:00
Michée lengronne
3b9f85bb71 feat(siit): Initial version (#8188) 
* feat(siit): Initial version

Signed-off-by: Michée Lengronne <michee.lengronne@coppint.com>

* cleaner readme

Signed-off-by: Michée Lengronne <michee.lengronne@coppint.com>

* linting and generating

Signed-off-by: Michée Lengronne <michee.lengronne@coppint.com>

* improving README and removing a useless case

Signed-off-by: Michée Lengronne <michee.lengronne@coppint.com>

* improvements

Signed-off-by: Michée Lengronne <michee.lengronne@coppint.com>

* improvements

Signed-off-by: Michée Lengronne <michee.lengronne@coppint.com>

* linting

Signed-off-by: Michée Lengronne <michee.lengronne@coppint.com>

* New fixes

Signed-off-by: Michée Lengronne <michee.lengronne@coppint.com>

* improvements

Signed-off-by: Michée Lengronne <michee.lengronne@coppint.com>

* improvements

Signed-off-by: Michée Lengronne <michee.lengronne@coppint.com>

---------

Signed-off-by: Michée Lengronne <michee.lengronne@coppint.com>
 2026-08-23 17:55:27 -07:00
Baltasar Blanco
234f5fd378 plugin/cache: stop setting AA on answers served from cache (#8419) 
* plugin/cache: stop setting AA on answers served from cache

toMsg hardcoded m1.Authoritative = true, so a reply rebuilt from a cache entry claimed authority the answer that populated it never had.

The hardcoding was a workaround for legacy stub resolvers that dropped non-authoritative answers, but it only ever ran on the cache hit path: the same query still returned AA=0 on every miss and after every TTL expiry, so those clients were never actually protected.

Signed-off-by: baltasarblanco <baltablanco9008@gmail.com>

* plugin/cache: pin the AA=1 side of the cache round trip

Signed-off-by: baltasarblanco <baltablanco9008@gmail.com>

* plugin/cache: assert AA=0 on verified stale refresh and prove the cache hit

Signed-off-by: baltasarblanco <baltablanco9008@gmail.com>

* plugin/cache: count backend calls in TestCachePreservesAA

Signed-off-by: baltasarblanco <baltablanco9008@gmail.com>

---------

Signed-off-by: baltasarblanco <baltablanco9008@gmail.com>
 2026-08-23 17:54:41 -07:00
houyuwushang
4b26cced32 plugin/etcd: avoid apex fallback on backend errors (#8465) 
Signed-off-by: houyuwushang <liuluoqianqiu@outlook.com>
 2026-08-20 02:24:12 -07:00
Manuel Rüger
992d4c20db plugin/loadbalance: reduce roundRobin allocations for homogeneous address sets (#8375) 
* perf(loadbalance): fast-path zero-allocation roundRobin for homogeneous record sets

Signed-off-by: Manuel Rüger <manuel@rueg.eu>

* plugin/loadbalance: copy before shuffling in the fast path

The fast path shuffled the caller's slice in place, which is not safe.
roundRobin must not modify its input: a backend may hand back a slice it
owns rather than one built for the response. plugin/file does exactly that
- Lookup returns elem.Type(qtype), which is the zone tree's own []dns.RR -
so an in-place shuffle reorders the zone itself, visible to every other
query and racing with the ones running concurrently.

Copy the records into a fresh slice and shuffle that instead. This is still
a single allocation rather than the four slices the partitioning path builds,
so most of the gain is kept:

    name          old time/op    new time/op    delta
    RoundRobin      353 ns         244 ns       -31%

    name          old alloc/op   new alloc/op   delta
    RoundRobin      118 B           54 B        -54%

    name          old allocs/op  new allocs/op  delta
    RoundRobin        5              4          -20%

Also reorder the type check so a response led by a CNAME is rejected on the
first record instead of scanning the whole answer section first.

TestRoundRobinDoesNotMutateInput pins the contract; it fails against the
in-place version.

Signed-off-by: Manuel Rüger <manuel@rueg.eu>

---------

Signed-off-by: Manuel Rüger <manuel@rueg.eu>
 2026-08-19 20:27:35 -07:00
Manuel Rüger
50ffa1ecf9 plugin/rewrite: drop the per-record dot-prefixed temporary in remapStringRewriter (#8382) 
remapStringRewriter matches a record name against orig and its sub domains. The
sub domain check was strings.HasSuffix(src, "."+r.orig), which built the
dot-prefixed string on every call and threw it away. Match the label boundary by
index instead: src is a sub domain of orig when orig sits at the end of src with
a "." immediately before it, which is exactly what the HasSuffix call tested.

Go concatenates short strings into a 32-byte stack buffer, so "."+orig only
reached the heap once orig passed 31 bytes. Below that the temporary was free
and this saves a few ns per record. Above it, 48 B was allocated per record.
Kubernetes service names are past the threshold -
my-service.my-namespace.svc.cluster.local. is 42 bytes - and those are the names
an auto rule rewrites to when a Corefile maps an external name onto an
in-cluster one. orig is the name the question was rewritten to, so whether a
deployment sees the allocation is a property of its Corefile, not its queries.

Caching "."+orig on the rewriter instead does not work: responseRuleFor
constructs a new rewriter for every request an auto name rule rewrites, so the
concatenation would run once per request rather than once per rule, and escapes
to the heap from there. That buys per-record work with a per-request allocation
and regresses every response short enough not to amortize it.

Per record, one rewriteString call on an existing rewriter:

    name                                master          this PR
    RemapStringRewriter/short/match     186.6n 16 B/1   120.4n 16 B/1   -35%
    RemapStringRewriter/short/nomatch    61.5n  0 B/0    16.5n  0 B/0   -73%
    RemapStringRewriter/long/match      381.9n 72 B/2   165.3n 24 B/1   -57%
    RemapStringRewriter/long/nomatch    219.1n 48 B/1    18.7n  0 B/0   -91%

Per request - rewrite the question, build the response rules, apply them to the
answer:

    name                                  master           this PR
    AutoNameRuleResponse/exact             935n   96 B/4    945n   96 B/4    ~
    AutoNameRuleResponse/subdomain        1.248µ 112 B/5   1.242µ 112 B/5    ~
    AutoNameRuleResponse/nomatch          1.016µ  96 B/4    945n   96 B/4   -7%
    AutoNameRuleResponse/subdomain-8      3.376µ 224 B/12  2.891µ 224 B/12 -14%
    AutoNameRuleResponse/k8s/subdomain    1.611µ 176 B/6   1.380µ 128 B/5  -14%
    AutoNameRuleResponse/k8s/subdomain-8  5.144µ 672 B/20  3.305µ 288 B/12 -36%

benchstat over 8 runs, i7-1065G7. With short names this is flat at the request
level: one rewriteString call is small next to the four allocations that
building the rules costs. The saving is per record and per byte of name, so it
shows up where responses carry several records and the rewritten-to name is
long.

This applies to exact, prefix, substring and regex name rules with answer auto.
suffix rules build a suffixStringRewriter instead and are not affected.

TestRemapStringRewriter pins the label boundary semantics the index arithmetic
now carries, notably that notexample.com. is not a sub domain of example.com.
It passes against the previous implementation too.

Signed-off-by: Manuel Rüger <manuel@rueg.eu>
 2026-08-19 20:27:19 -07:00
Andri Yngvason
a1154dcee5 Templates with expr-lang (#8450) 
* plugin/template: Add expr-lang variables

Signed-off-by: Andri Yngvason <andri@yngvason.is>

* plugin/template: Add extra expressions that must match

Signed-off-by: Andri Yngvason <andri@yngvason.is>

* plugin/template: README: Add embedded device resolution example

Signed-off-by: Andri Yngvason <andri@yngvason.is>

---------

Signed-off-by: Andri Yngvason <andri@yngvason.is>
 2026-08-19 20:27:03 -07:00
dependabot[bot]
a53ecb7c2d build(deps): bump github.com/aws/aws-sdk-go-v2/service/secretsmanager (#8460) 
Bumps [github.com/aws/aws-sdk-go-v2/service/secretsmanager](https://github.com/aws/aws-sdk-go-v2) from 1.44.4 to 1.44.5.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/mgn/v1.44.4...service/mgn/v1.44.5)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/service/secretsmanager
  dependency-version: 1.44.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-19 19:16:36 -07:00
dependabot[bot]
f35b4625c4 build(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12 (#8453) 
Bumps google.golang.org/protobuf from 1.36.11 to 1.36.12.

---
updated-dependencies:
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.36.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-19 19:16:25 -07:00
dependabot[bot]
890cca90d1 build(deps): bump github.com/aws/aws-sdk-go-v2/config (#8458) 
Bumps [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) from 1.32.35 to 1.32.36.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/config/v1.32.35...config/v1.32.36)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/config
  dependency-version: 1.32.36
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-19 18:51:17 -07:00
dependabot[bot]
caf63738fc build(deps): bump google.golang.org/api from 0.292.0 to 0.293.0 (#8461) 
Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.292.0 to 0.293.0.
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.292.0...v0.293.0)

---
updated-dependencies:
- dependency-name: google.golang.org/api
  dependency-version: 0.293.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-19 18:51:04 -07:00
dependabot[bot]
6c4956d6d1 build(deps): bump github.com/aws/aws-sdk-go-v2/service/route53 (#8455) 
Bumps [github.com/aws/aws-sdk-go-v2/service/route53](https://github.com/aws/aws-sdk-go-v2) from 1.65.6 to 1.65.7.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/fsx/v1.65.6...service/fsx/v1.65.7)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/service/route53
  dependency-version: 1.65.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-19 18:50:37 -07:00
dependabot[bot]
c3c3a77ac3 build(deps): bump github.com/aws/aws-sdk-go-v2/credentials (#8457) 
Bumps [github.com/aws/aws-sdk-go-v2/credentials](https://github.com/aws/aws-sdk-go-v2) from 1.19.34 to 1.19.35.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/credentials/v1.19.34...credentials/v1.19.35)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/credentials
  dependency-version: 1.19.35
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-19 18:04:53 -07:00
dependabot[bot]
61dff43088 build(deps): bump github.com/oschwald/geoip2-golang/v2 (#8454) 2026-08-19 17:29:49 -07:00
dependabot[bot]
220a5721d4 build(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.0 (#8459) 2026-08-19 17:29:31 -07:00
dependabot[bot]
c11529844f build(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 (#8462) 2026-08-19 17:28:35 -07:00
dependabot[bot]
57ebac31d9 build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#8463) 2026-08-19 17:28:17 -07:00
dependabot[bot]
451f634fa3 build(deps): bump github.com/aws/aws-sdk-go-v2/feature/ec2/imds (#8464) 2026-08-19 17:28:10 -07:00
Yong Tang
427fc80ed9 Add release note 1.14.7 (#8449) 
This PR adds release note 1.14.7 for 8416

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
v1.14.7 		2026-08-18 17:39:13 -07:00
Sueun Cho
9a623cdeed plugin/rewrite: apply rcode rewrites to responses with no records (#8421) 
* plugin/rewrite: apply rcode rewrites to record-less responses

An rcode rewrite rewrites the message-level RCODE, but the reverter only ran
response rules from inside the per-record loops in WriteMsg. When a response
carries no answer, authority or additional records - for example a bare
SERVFAIL that a downstream plugin returns to a non-EDNS client - none of the
loops iterate, so the rcode rewrite was silently skipped and the client
received the original RCODE.

Apply message-level response rules once when the response has no records, using
a small marker interface that mirrors the existing requestExtraRevertRule
pattern. This fixes the plugin's documented SERVFAIL-to-NOERROR use case for
responses without records.

Signed-off-by: Sueun Cho <sueun.dev@gmail.com>

* plugin/rewrite: apply fallback rcode rewrites for continue

Signed-off-by: Sueun Cho <sueun.dev@gmail.com>

---------

Signed-off-by: Sueun Cho <sueun.dev@gmail.com>
 2026-08-18 11:12:32 +08:00
Pujitha Paladugu
897b4ce643 plugin/azure: don't hold zMu across zone Lookup (#8447) 2026-08-17 05:11:16 -07:00
Sueun Cho
29ef323f82 plugin/cache: preserve AD when storing cache entries (#8438) 2026-08-14 20:28:20 -07:00
dependabot[bot]
ab7a8880a4 build(deps): bump github.com/aws/aws-sdk-go-v2/service/secretsmanager (#8445) 2026-08-14 14:13:16 -07:00
dependabot[bot]
e9ca69aebc build(deps): bump the codeql group with 3 updates (#8446) 2026-08-14 14:12:01 -07:00