# Stork 2.5.1 Release Notes, August 12, 2026 Welcome to Stork 2.5.1, a development release in the 2.5 series. The changes introduced in this version are: 1. **BIND 9 zone-transfer monitoring.** Stork can now receive zone transfer events from monitored BIND 9 servers, store them in the Stork database, and display them in a new user interface view. The transfer list supports filtering and sorting. Transfer tracking recognizes started, completed, up-to-date, and failed transfers and collects the associated transfer statistics. It also marks transfers with unclear status with the keyword "message", directing the user to the log message panel for details about the transfer state [#2394, #2395, #2396, #2398, #2557, #2579]. 2. **Kea Configuration Backend subnet management.** Stork can now create, modify, and delete subnets stored in the Kea Configuration Backend when the `cb_cmds` and `subnet_cmds` hook libraries are loaded. Daemons using the same Configuration Backend database and server tag are grouped in the subnet form to prevent inconsistent individual configuration. The help text now explains whether an operation changes the JSON configuration or the Configuration Backend database. [#2474, #2475, #2476, #2527, #2552] 3. **Lease tracking and display improvements.** The lease list now collects and displays all columns from the lease memfile instead of showing only a basic subset. Lease tracking can now be activated for Kea versions older than 3.1.0 when an absolute memfile path is configured. Lease updates are no longer discarded when they contain leases previously received by Stork. Lease fetching is skipped for inactive or unmonitored daemons, and a crash caused by closing a monitored daemon's gRPC connection was fixed. [#2447, #2498, #2523] 4. **Improved agent certificate security.** The Stork server no longer generates certificates based on IP addresses and DNS names supplied in the Subject Alternative Name fields of an agent's Certificate Signing Request. These values are now assigned by the server based on the agent's address, preventing an attacker from requesting a certificate for arbitrary addresses or DNS names while registering as a legitimate agent. [#2564] 5. **OpenID Connect and external user management.** OpenID Connect configuration now supports a unique provider identifier, and manually configured provider endpoints for services that do not implement OIDC Discovery. Stork also prevents local group assignment for external users when group membership is managed by the external authentication service. All system groups associated with a user are now displayed. [#1957, #2339, #2536, #2538] 6. **Additional Prometheus metrics.** The Prometheus Kea Exporter now provides lease-allocation and lease-allocation-failure statistics. Both global and per-subnet metrics are available. [#2551] 7. **Improved Kea configuration visibility.** Stork now displays all configured Kea control sockets. The Data Storage view also includes database usernames and ports and indicates whether TLS client certificates are configured for individual database backends. [#2273, #2418] 8. **Build, dependency, and packaging updates.** The build system now uses the Go and Node.js versions installed in the operating system instead of downloading fixed compiler versions. In our pre-compiled packages, Stork now uses Angular 21, PrimeNG 21, Go 1.26.5, and many newer frontend, backend, Python, and Ruby dependencies. System tests were moved to the separate `stork-tests` repository. Package uninstallation was also improved: the Alpine package can preserve externally managed users, and the Stork server package now correctly removes its directories. [#1910, #2470, #2484, #2486, #2488, #2495, #2525, #2543, #2554, #2567, #2581, #2595, #2600, #2609, #2614] 9. **Other fixes and documentation updates.** This release fixes a server crash when an empty subnet definition is submitted through the API and prevents out-of-range subnet utilization values from interrupting statistics collection. The documentation for subnet and host-reservation filtering was also updated. [#2362, #2363, #2425, #2580] Please see this link for known issues: https://gitlab.isc.org/isc-projects/stork/-/wikis/Known-issues. ## Incompatible Changes There are no known incompatible changes in this release. ## Release Model Stork has bi-monthly development releases. We encourage users to test the development releases and report back their findings on the stork-users mailing list, available at https://lists.isc.org/mailman/listinfo/stork-users, or report bugs at https://gitlab.isc.org/isc-projects/stork/-/issues/. This text references issue numbers. For more details, visit the Stork GitLab page at https://gitlab.isc.org/isc-projects/stork/-/issues. ## License Stork is released under the Mozilla Public License, version 2.0. https://www.mozilla.org/en-US/MPL/2.0 ## Download The easiest way to install the software is to use native Alpine, deb, or RPM packages. They can be downloaded from: https://cloudsmith.io/~isc/repos/stork/ The Stork source and PGP signature for this release may be downloaded from: https://downloads.isc.org/isc/stork The signature was generated with the ISC code-signing key, which is available at: https://www.isc.org/pgpkey ISC provides documentation in the Stork Administrator Reference Manual (ARM). It is available on ReadTheDocs.io at https://stork.readthedocs.io/en/latest/, and in source form in [the doc/ directory](https://gitlab.isc.org/isc-projects/stork/-/tree/master/doc). We ask users of this software to please let us know how it worked for you and what operating system you tested on. Feel free to share your feedback on the stork-users mailing list (https://lists.isc.org/mailman/listinfo/stork-users). We would also like to hear whether the documentation is adequate and accurate. Please open tickets in the Stork GitLab project for bugs, documentation omissions and errors, and enhancement requests. We want to hear from you even if everything worked. ## Support Free best-effort support is provided by our user community via a mailing list. Information on all public email lists is available at https://www.isc.org/mailinglists/. If you have any comments or questions about working with Stork, please share them to the stork-users list (https://lists.isc.org/mailman/listinfo/stork-users). Bugs and feature requests may be submitted via GitLab at https://gitlab.isc.org/isc-projects/stork/issues. ## Changes The following summarizes changes and important upgrades since the previous Stork release. * 683 [ui] william Collect and show all lease memfile columns, not just a basic subset. (Gitlab #2447) * 682 [build] rootwyrm, slawek The Stork Alpine package can now preserve externally managed users during uninstall. (Gitlab #2486) * 681 [sec] slawek Improved the security of the agent's GRPC certificate generation. The server now ignores IP addresses and DNS names provided in the Subject Alternative Name (SAN) fields of the Certificate Signing Request (CSR). Instead, they are assigned on the server side based on the agent's address. It blocks the attacker from requesting a certificate for any IP address or DNS names under the guise of registering a legitimate agent. (Gitlab #2564) * 680 [build] slawek Fixing the removal of directories when the Stork server package is uninstalled. (Gitlab #2484) * 679 [doc] slawek Updated ARM section of subnet filtering. (Gitlab #2362) * 678 [bug] slawek Fixed a server crash when a subnet was created via API without any specific parameters. (Gitlab #2580) * 677 [doc] slawek Updated ARM sections of host reservation filtering descriptions. (Gitlab #2363) * 676 [build] tomek, piotrek Updated to Angular 21, PrimeNG 21 and several dependencies. (Gitlab #2488) * 675 [build] andrei, piotrek, slawek, william Updated Go to 1.26.5 and dependencies for frontend, backend, Python, Ruby. (Gitlab #2495, #2525, #2543, #2554, #2567, #2581, #2595, #2609, #2614) * 674 [bug] slawek Fixed a crash that happened when the gRPC connection to a daemon was closed while it was still monitored. Skip lease fetching for inactive and not monitored daemons. (Gitlab #2447) * 673 [func] marcin Improved tracking zone transfers in the BIND 9 logs. Two new transfer states are determined: up-to-date and failed. The former marks the zone transfers for which the secondary found that it already has a current copy of the zone. The latter marks the transfers for which the status was neither success nor up to date. In both cases, the tracker also captures subsequent log messages containing the transfer statistics, so they can be displayed in the UI. (Gitlab #2579) * 672 [ui] marcin Added a new view listing the DNS zone transfers. It contains controls for filtering and sorting the zone transfers. (Gitlab #2557) * 671 [func] slawek The subnet form groups the daemons that share the same Config Backend database and server tag, preventing them from being configured individually. (Gitlab #2552) * 670 [func] tomek, slawek The build system no longer downloads specific NodeJS and Go compiler and uses the version available in the OS instead. This makes it possible to build Stork with different NodeJS and Go versions. Also, the compilation should be a bit faster and smaller as there is a couple less items to download. (Gitlab #2470, #2600) * 669 [func] marcin Created REST API call returning the list of DNS zone transfers. (Gitlab #2398) * 668 [func] sebastien.degroof The Prometheus Kea Exporter now collects Kea's lease allocation and lease allocation failure statistics, consistent with how address statistics are exposed. Both global and per-subnet samples are supported. (Gitlab #2551) * 667 [bug] william Correct a bug which prevented the Leases List from updating. Due to improper error handling, the entire leasefile update from the agent would be ignored if any lease in the update had been seen before. (Gitlab #2523) * 666 [func] marcin Stork server connects to the monitored BIND 9 instances and receives zone transfer events over the streaming connection. The zone transfer events are stored in the Stork server's database. (Gitlab #2396) * 665 [bug] william Correct an oversight which prevented Stork from activating Lease Tracking when used with Kea versions older than 3.1.0, even when Kea is configured with an absolute lease memfile path. (Gitlab #2498) * 664 [func] piotrek Improved displaying system groups that Stork user belongs to. In case user belongs to more than one group, all group names will be displayed. (Gitlab #1957) * 663 [func] piotrek Added new settings to configure OpenID Connect authentication. Now it is possible to set a unique OpenID Provider identifier. It is also possible to manually set OpenID Provider endpoints if the Provider doesn't support OIDC Discovery. (Gitlab #2538, #2536) * 662 [doc] slawek Extended the subnet help tips to explain whether the JSON configuration or the Config Backend database is altered when the subnet is updated from the Stork UI. (Gitlab #2476) * 661 [func] piotrek Improved the User account edit form. Group assignment is no longer possible for external users when the external authentication service is managing the group assignment. (Gitlab #2339) * 660 [func] slawek Allow creating, editing, and deleting subnets from the Config Backend database for Kea with both cb_cmds and subnet_cmds hooks loaded. (Gitlab #2527) * 659 [func] marcin Stork agent exposes API to establish the streaming connection to receive zone transfer events over gRPC. (Gitlab #2395) * 658 [build] tsawka Move system tests to stork-tests repository (Gitlab #1910) * 657 [func] slawek Support for deleting subnets in the Config Backend database. (Gitlab #2475) * 656 [func] slawek Support for modifying subnets in the Config Backend database. (Gitlab #2474) * 655 [func] marcin Stork server gathers network interfaces and IP addresses assigned to the interfaces on the monitored machines, and stores them in the database. The IP addresses are not displayed anywhere yet. It is a building block of the DNS zone transfer monitoring to be implemented in the future GL issues. (Gitlab #2394) * 654 [bug] slawek Added clipping the utilization value when it exceeds the smallint (2 bytes) range to avoid interrupting statistics fetching. Such a value indicates duplication daemons in the Stork database or overlapping subnet pools for Kea daemons that are not combined into an HA pair. (Gitlab #2425) * 653 [ui] slawek Extended the Kea daemon Data Storage view to display database user and port details, and indicate whether TLS client certificates are configured for each database backend entry. (Gitlab #2418) * 652 [func] slawek Display all Kea control sockets in UI. (Gitlab #2273) Thank you again to everyone who assisted us in making this release possible. We look forward to receiving your feedback.