Changes.

Ze is being checked against the RFCs it implements, one MUST at a time, and that is where most of this week's work came from. BGP took the largest share. IS-IS learned to answer a purge of its own LSP, gNMI stopped serving unauthenticated writes, and web and DNS listeners can now carry an operator's own certificate.

IPsec was the centre of the week. Ze ran against strongSwan and twenty defects came out. EAP-TLS worked with another implementation for the first time. The BGP announce path went from two encoders to one. OSPF, BMP, MRT and the MCP server each took correctness work.

Ze has left Codeberg for GitHub. Beyond the move: protocol correctness, a security triage over the code-scanning backlog, and build-time feature gates that let a deployment ship only the code it runs.

A busy routing week brought VRRP, BGP multipath in the FIB, BMP Loc-RIB monitoring, tighter RPKI policy, and several management-plane security fixes.

A dense week across VPN, DNS, subscriber access, the VPP data plane, the web UI, and observability.

Work landed across DNS, traffic security, routing, and the CLI this week.

Shipped across security, the appliance, routing, and observability this week.

Focused on trimming attack surface and rounding out OSPF.

Native IS-IS landed, MPLS gained fast reroute, and firewall rules can now pull straight from the IRR.

A week of operator-facing polish: the Web Workbench UI, SR-Policy and IRR-based filtering in BGP, per-subscriber CoS, and a talk at LINX.

The CLI grammar rollout finished, MRT tooling arrived, and a handful of quiet-but-important reliability bugs got fixed.

MPLS grew a full label-switching stack, flow export and gNMI landed, and config commits became transactional.

A full native IPsec/IKEv2 VPN stack, a route server for IXPs, and a big allocation-hunting pass across the BGP hot path.

CPE features round out, interface config gets restructured, and RPKI gains ASPA path verification.

Two major subsystems landed this week: a fleet management tool for appliances, and a PPPoE access concentrator alongside VPP-backed NAT and ACLs.

Interface configuration now rolls back cleanly on failure, the web UI got a dedicated CLI page, and traffic-control state survives more edge cases.

Security hardening, a new diagnostics subsystem, and a redesigned operator web UI headline this week.

A complete L2TP/PPP access stack, TACACS+ and pluggable AAA, a VPP dataplane, and new nftables/tc firewall backends.

A full BFD engine, BGP route reflection and policy filters, a REST/gRPC config editor, WireGuard support, and a talk at Net Manchester.

A full interface management subsystem, offline DNS/RIR resolution tooling, config-driven plugin loading, BGP healthcheck and long-lived graceful restart support, and a Looking Glass overhaul.

A full web interface, fleet management, redistribution filtering, and a stack of routing-protocol correctness work all landed together.

RPKI route origin validation landed in full, alongside a wave of BGP RFC compliance work, CLI polish, and daemon security hardening.

A big week for access, config safety, and BGP session security.

Best-path selection landed, along with outbound route tracking and a round of CLI/editor polish.

A route-server-focused week: reliability fixes for BGP Route Server under load, a new external plugin protocol option, and systematic config validation.

A hard round of route reflector hardening, a live web dashboard for the chaos tool, and a batch of BGP protocol and config improvements.

A new chaos-testing tool, matured config reload, RFC 7606 enforcement, and a hot-path allocation cleanup.

Mostly spent on the config editor, a new capability, and a round of decode/RIB bug fixes.

Config work, the ExaBGP migration path, and correctness fixes across the wire.

A big architecture week: Ze split into a hub process and a BGP child process, gained live config reload, and got a documented plugin SDK.

A week focused on Graceful Restart, ExaBGP migration tooling, and logging.

This week rounded out route-refresh, ADD-PATH and VPN/labeled-unicast support in the plugin API, alongside a batch of BGP correctness fixes.

Route-family coverage rounded out (labeled-unicast, MPLS VPN, MUP, route reflection), a batch of protocol-correctness fixes, and a security-relevant change to how Ze listens for BGP sessions.

Work on the BGP engine itself: route encoding correctness, session robustness, and a first real API surface for driving peers programmatically.

The first tracked week of development on Ze. In seven days the BGP engine went from nothing to a config-driven daemon that speaks the wire protocol, holds a RIB, and tests itself against ExaBGP.