MikroTik Changelog Tracker

Search changelog entries

7.20.2 Stable 2025-Oct-21 (3 months ago)
Component Change
bridge fixed incorrectly blocked ports by STP (introduced in v7.20);
console fixed incorrect ids in /file/print relative mode (introduced in v7.20);
console improved stability when printing ids for a non-existent directory (introduced in v7.20)
dhcpv6-client improved system stability when DHCPv6 client uses "rapid-commit=no", "accept-prefix-without-address=no" and receives only prefix from the server;
dhcpv6-server do not force set "address-pool" on static bindings with unset pool option after system reboot;
evpn added basic logging support;
evpn fixed MAC mobility;
firewall reduce maximum connection tracking entry count;
iot fixed an issue preventing LoRa downlink packets from being broadcasted;
ip removed duplicate CLI parameters for socksify;
log cleaned up older config by removing leading slashes from "disk-file-name" values;
mpls fixed LDP label binding if nexthop is link-local address;
poe-out fixed RB5009 PoE-in indication on cold-boot with no other power source;
routing-filter change "^$" regexp to bgp-path-len=0 on upgrade from v6 to v7;
routing-filter use bgp-out-med for set bgp-med on upgrade from v6 to v7;
snmp fixed SNMP SET operation (introduced in v7.20);
snmp set maximum message size to 8 KB;
system fixed ".auto.rsc" file execution (introduced in v7.20);
system fixed package list fetch from local upgrade server;
system fixed Windows executable compatibility with Microsoft AppLocker;
winbox added IP/Socksify menu;
winbox added support for 200Gbps/400Gbps Rate fields;
winbox fixed Ethernet Tx Stats (introduced in v7.20);
7.20.1 Stable 2025-Oct-10 (3 months ago)
Component Change
bgp added output.network-blackhole setting;
bgp do not auto-generate blackhole routes by default (introduced in v7.20);
bgp fixed inactive flag in GUI after instance disable/enable;
console fixed ".id" printing when using "group-by" (introduced in v7.20);
console fixed relative path printing (introduced in v7.20);
ike1 fixed an issue where policies could be released too early before re-acquisition;
ipv6,ra fixed prefix unlinking from interface on configuration change and stop deprecating prefixes when the validity lifetime expires;
lte fixed issue with firmware update for FG621-EA modem;
ppp added support for KNOT BG77 modem firmware upgrade to version BG77LAR02A04_A0.301.A0.301;
qos-hw always use qos-hw-offloading=yes for CRS812 device;
quickset fixed issue where routes set by QuickSet did not appear in export;
route fixed missing connected routes on setups with large amount of interfaces (introduced in v7.20);
route improved stability;
routerboard fixed non-running interfaces for CRS310-8G+2S+IN after booting to SwOS ("/system routerboard upgrade" required) (introduced in v7.20);
sfp improved interface link speed configuration for CRS812;
snmp fixed SNMP trap messages being corrupted when sent to multiple targets;
switch fixed "failure: cpu flow control not supported" (introduced in v7.20);
system improved system stability when using hardware-offloaded encryption on RB3011 and hAP ac2 (introduced in v7.20);
webfig fixed form closing with saving when pressing Enter key (introduced in v7.20);
webfig fixed interface settings and graphs (introduced in v7.20);
webfig improved container form loading performance when router has a lot of files;
winbox fixed WinBox 3 application failure when opening IPv6/Firewall/Connection entry (introduced in v7.20);
www improved stability (CVE-2025-10948);
7.20 Stable 2025-Sep-29 (4 months ago)
Component Change
arm64/x86/chr added Aquantia network driver;
bgp added brief, unnumbered output for advertisements list;
bgp added initial EVPN support;
bgp added NLRI filter for more precise accept/discard of ipv4/6 prefixes;
bgp automatically create output.network blackhole routes;
bgp decode and log notifications;
bgp fixed nexthop force-self for IPv4 and IPv6;
bgp fixed selection of received BGP VPN routes;
bgp improved configuration upgrade from versions prior to 7.20;
bgp improved logging;
bgp introduced BGP instance configuration (note, downgrading to earlier versions without instance support may cause config issues);
bgp make "as" parameter optional in template configuration;
bgp print aigp attribute in advertisements;
bgp refresh WinBox when BGP session is created/deleted;
bgp resend routes after nexthop-choice update;
bgp support for Advertising IPv4 Network Layer Reachability Information (NLRI) with an IPv6 Next Hop;
bridge added dynamic tagged entry named "switch-cpu" in scenarios where the same VLAN spans multiple switch chips or is used on both HW and SW ports;
bridge added verbose STP debug logging (rx/tx BPDU, edge-port and port-role transitions, FDB flush);
bridge added warning log when all MACs cannot be displayed under the host table;
bridge disable/enable HW offload on bonding slave disable/enable (fixes potential MAC learning issue);
bridge fixed MVRP leave indication;
bridge fixed port-id when adding a new port in non-primary MLAG;
bridge improved stability when disabling bridge with dynamic VLANs in MSTI;
bridge refactored host learning logic in MLAG setups in order to make it more robust and predictable;
bth added extra file-share functionality for use with apps;
bth improved tunnel name in client config export;
bth,file added direct file sharing from the WinBox Files menu;
certificate added "Amazon Root CA 1" to built-in root certificate authorities store;
certificate fixed ACME certificate usage after renewal;
certificate improved stability after failed import;
certificate trust built-in root certificate authority store after configuration reset;
chr added Chelsio VF driver for PCIID 5803;
chr improved virtio_net performance;
cloud fixed restoring "BTH Files" service after a prolonged network outage;
cloud reduced "BTH Files" ping interval dynamically upon failure;
console added use-tz option to :timestamp command;
console fixed :convert to=num on MIPSBE;
console fixed incorrect multibyte to=num conversions;
console fixed issue where file completion sometimes shows duplicates;
console improved stability and visuals for /interface/wireless/snooper/snoop;
console improved visuals for brief print when displaying large tables;
console improved visuals for hexadecimal strings;
console improved visuals for hiding sensitive commands;
console include flags by default when printing to value;
console prioritize directory specific parameters and hide rarely used ones in print autocomplete;
console replace TAB characters with spaces when editing scripts and added tab-width user configuration in /console/settings;
console unified string representation of ID values;
console updated hints for some /file/print parameters;
console use file name completions (and basic validation) for file output related parameters for export and print commands;
console validate filenames upon addition (if enabled in /console/settings);
container added "device" option to pass a device from /system/hardware menu to a container;
container added /container/log menu, keep 100 messages per container;
container added default print brief mode;
container added initial support for container in container setups;
container added option to execute commands inside a container using "/container/shell cmd= user=";
container added per-container memory limiting and monitoring;
container added repull command;
container added SCTP support;
container added support for cpuset, cpu, memory, pids cgroups;
container allow picking passthrough devices by descriptive name;
container allow read-only mounts;
container allow to mount individual files, not just directories;
container allow to specify multiple envlists;
container allow to use multiple veths in a container, change the in container interface name to same as in RouterOS;
container can use KVM (x86 and arm64) in container QEMU for faster virtualization;
container display any error prominently in WinBox;
container do not allow multiple containers with same root directory;
container enable check-certificate by default for new remote imports;
container fixed containers that use inotify interface;
container fixed environment variables not being passed to "/container/shell" properly;
container fixed QEMU VM to host bridge;
container fixed shell exit causing freeze;
container improved compatibility when running containers with custom "cmd" and "entrypoint" commands;
container improved error and log messages;
container prevent user from setting "root-dir=/" for a container;
container show a more descriptive error when tar extraction fails, particularly "No space left on device";
container show config.json to user;
container show explicit stopped flag for container;
container stability improvements;
container support for direct access to hardware devices;
container terminate containers on shutdown, allow them to clean up properly;
dhcp show error only after interface status is synced with the system (instead of erroneously displaying it immediately);
dhcp-client show warning if DHCP client is configured on dot1x server port;
dhcp-server do not show "I" flag when server is disabled;
dhcp-server improved logging when dual-stack is enabled but fails to acquire client MAC from DUID;
dhcpv4-client allow specifying DSCP of outgoing packets;
dhcpv4-client allow specifying vlan-priority of outgoing packets (for VLAN interfaces only);
dhcpv4-client show "custom-hostname-suffix" and "custom-source-mac-address" properties if set;
dhcpv4-server added "add dns" step to setup wizard;
dhcpv4-server added "lease-agent-circuit-id" and "lease-agent-remote-id" variables to the lease script;
dhcpv4-server added "ntp-none" parameter;
dhcpv4-server changed the default value of address-pool to "static-only" in the option matcher, removed "none" option;
dhcpv4/v6-client properly resume client service after underlying interface status changes;
dhcpv4/v6-server added CoA support;
dhcpv6-client added "accept-prefix-without-address" allowing client to accept prefix when address is not available although requested;
dhcpv6-client update the routing table and address list on manual client configuration changes;
dhcpv6-server added "ignore-ia-na-bindings" setting that allows server to ignore address requests and work just with prefixes;
dhcpv6-server do not trim real client DUID when assigning it to the binding;
discovery disable discovery on loopback, LTE, ppp-out interfaces;
discovery improved LLDP Power via MDI TLV with 802.3bt specific field support;
discovery output LLDP fault message once per port poe-out status change;
discovery report router as "CAPsMAN" on MNDP under "running" parameter;
discovery set initial poe-out Tx power above 0dW;
disk allow to format multiple disks at once;
disk allow to remove Btrfs device by ID;
disk better manage disks disappearing from RAID;
disk cleanup mountpoint when setting mount-filesystem=no;
disk disallow adding SMB share or user with empty name;
disk do Btrfs remove-device asynchronously;
disk offer to blink only PCI slots in console;
disk rename raid-role=unspecified to spare;
disk reset RAID role of old disk after spare assumes a new role;
disk show error when file based block-device uses a mountpoint to be unmounted;
disk show total/free inode counts for fs's that support it;
dlna recognize flac extension;
dns fixed memory leak when static CNAME record was matched;
fetch display file sizes between 1-1023 bytes as 1KiB (instead of 0KiB);
fetch include RouterOS version in the "User-Agent" field;
file improved file handling performance in WinBox v4;
filesystem improved calculation of free space on NAND flash (fixes potential "disk is too small" issue);
firewall added "liberal-tcp-tracking" connection tracking setting;
firewall added connection tracking "total-ip4-entries" and "total-ip6-entries" counters;
firewall allow "dst-limit" matcher to work properly above value 10000;
firewall fixed IPv6 firewall interface matchers not matching VRF interfaces;
firewall improved IPv6 connection tracking lookup responsiveness;
firewall improved system stability when processing connections on multicore systems;
firewall reorganized firewall connection tracking table values and make them persistent between IPv4 and IPv6;
flashfig bind to local address (fixes issue when multiple interfaces are enabled);
iot added additional dongle firmwares to iot-bt-extra package;
iot added an option to increase the amount of LoRa's traffic entries displayed;
iot added support for MQTT last will message;
iot adjusted default LoRa antenna gain values for specific devices;
iot fixed an issue where channel #7 is ignored during LoRa LNS connection;
iot fixed logic for unknown NetIDs;
iot fixed support for LoRa Alliance NetID list;
iot improved LoRa stability and error recovery;
iot improvement to LoRa band verification logic;
iot iot-bt-extra package stability improvement and additional dongle support;
iot LoRa netid filters now can be configured as a "range";
iot LoRa server list is no longer generated if the LR card is not physically attached;
iot LR8G/9G firmware update;
iot removed lora-package, LoRa functionality was moved into iot-package;
iot removed non-existent GPIO pin functionality;
ip added socksify feature and new NAT action "socksify";
ip-service show service name "nfs" for port 2049;
ipsec fixed degraded IPsec performance for IPQ-6010 (introduced in v7.17);
ipsec move raw RSA keys to /ip/ipsec/key/rsa;
ipv6 added support for IPv6 ND proxying of individual addresses;
ipv6 do not allow removal of dynamic address on lo interface;
ipv6 fixed "auto-link-local" feature on WireGuard interface;
ipv6 make pref-src work and settable for static routes;
isis added passive parameter for interface templates;
log added command to clear memory action entries;
log improved the "transmit loop detected" warning log;
lte added "done" status for modem firmware-upgrade version check;
lte added "remove-sent-sms-after-send" option to automatically delete sent SMS messages;
lte added log entry if eSIM has no profiles on read;
lte added modem-init string response to system log;
lte added passthrough support for RG650E-EU modem;
lte added show-capabilities eSIM presence detection for MBIM modems;
lte allow only one IPv6 APN for AT modems;
lte display ICCID regardless of SIM PIN entry status;
lte do not reconfigure modem if deactive eSIM profile is deleted;
lte exempt eSIM provision from global CRL certificate settings;
lte exit LTE scan if modem reconfigured;
lte fallback to RA for global IPv6 if unattained via AT channel (resets on config change);
lte fixed inappropriate LTE interface inactive flag shown during modem initialization;
lte fixed modem recovery on unexpected modem reboot for Chateau 5G and Chateau 5G R16;
lte fixed progress message for R11e-LTE modem firmware-upgrade;
lte fixed rare case where AT dialer could stop;
lte improved EC200A-EU firmware-upgrade stability;
lte improved SMS sending stability over MBIM protocol;
lte refresh eSIM profile list after successful provision;
lte renamed "uicc" to "iccid" in LTE monitor and eSIM profile print;
lte show ip-type in /interface/lte/apn/print;
lte use modem-supplied IPv6 address over EUI-64 when available;
macvlan allow creating macvlan interfaces on all interfaces with a MAC address;
mpls fixed minimal dynamic-label-range setting;
net fixed possible slave flag issues after user configuration changes;
net improved system stability when processing TCP/UDP connections;
net prevent removal of lo interface via WinBox;
netinstall added after-install controls (reboot after installation, shutdown after installation, none);
netinstall alert on unreadable configuration scripts;
netinstall detect inactive install interface;
netinstall fixed install for PPC devices;
netinstall fixed mutually exclusive checkbox behavior;
netinstall show router and package architecture;
netinstall warn user if not enough space on device;
netinstall-cli added MAC filter option "--mac";
netinstall-cli added multiple install option "-m";
netinstall-cli improved client device architecture detection;
netwatch added "early-success-detection" and "early-failure-detection" properties for ICMP probe;
netwatch fixed date and time for stats;
ovpn added support for sha384 hmac;
ovpn improved tunnel setup speeds in configurations with large ammount of active OVPN clients;
partitions fixed failure to repartition correctly from 32MB partition size;
partitions hide partition menu on unsupported boards (without NAND);
partitions limit minimal partition size to 60MB;
poe-out added support for line-interactive and offline UPS on CRS320;
poe-out firmware update for 802.3at capable boards (the update will cause brief power interruption to poe-out interfaces);
poe-out firmware update for 802.3bt capable boards (the update will cause brief power interruption to poe-out interfaces);
poe-out improved dual-signature detection on CRS320;
poe-out improved short-circuit detection and reporting on CRS320;
poe-out increased maximum power margin for all classes on CRS320;
port added IPv6 support for "remote-access" tool;
port improved port status handling at unexpected device removal;
ppp added "dhcpv6-use-radius" PPP profile feature that enables "use-radius" option on dynamically created DHCPv6 servers;
ppp added "remote-ipv6-prefix-reuse" PPP profile feature that allows to advertise same prefix on multiple VPN clients at the same time;
ppp added DHCPv6 assigned prefix to address list when configured and received from RADIUS;
ppp added dhcpv6-lease-time profile configuration property;
ppp do not send initial echo request if keepalive-timeout=disabled;
ppp improved system stability when closing connections;
pppoe-server added accept-untagged=yes/no option to accept untagged traffic in combination with pppoe-over-vlan-rage property;
ptp added PTP support for RDS2216 device;
ptp removed delays between timestamping and packet transmission, improving PTP precision;
qos-hw added mirror-buffers property and monitoring values;
radius fixed issue with Session-Timeout attribute functionality;
romon changed default "disabled=yes" to "disabled=no" under /tool/romon/port;
romon improved error message;
route added missing and remove unnecessary parameters from /ipv6/route menu;
route afi naming consistency in logs;
route attempt to clean up stuck routes in the routing table;
route do not allow to modify dynamic routes;
route fixed incorrectly set nexthop interfaces for BGP VPN routes;
route fixed issue when route table is installed to kernel without fib setting;
route fixed skipping updated destinations;
route improved stability;
route removed fib-reinstall;
route update router ID when disabled address is removed;
routerboot fixed boot MAC for CRS212 switch ("/system routerboard upgrade" required);
routing-filter added filter-wizard (filter generator with v6-like syntax);
routing-filter added sync command;
routing-filter make "chain" and "list" parameters required when adding new item;
sfp fixed low power mode pins on CRS326-4C+20G+2Q+ for optical QSFP modules;
sfp fixed qsfp28 breakout disable;
sfp improved initialization and linking for sfp28 on CRS518;
sfp improved SFP handling for CRS418 device;
sfp improved system stability with some GPON modules for CCR2004 and CCR2116 devices;
smips reduced package size, removed hotspot feature and provide it as a separate package;
sniffer added CPU number and fast-path status in per-packet comment;
sniffer save packets in pcapng format, it now includes interface name the packet was sniffed on, packet direction and nanosecond timestamp resolution;
snmp added SNMP OIDs for firewall connection tracking "total-entries", "total-ip4-entries" and "total-ip6-entries";
snmp improved service stability when processing v3 requests;
snmp set maximum message size to 4 KB;
ssh improved stability on busy server;
ssh show user public key fingerprint under /user/ssh-keys;
ssh/sftp fixed session disconnects during file transfer;
ssl/tls fixed SSL looping behavior when multiple different TLS connections were used;
supout added certificate settings section;
supout added IP Service section;
supout added MPLS settings section;
supout added VXLAN VTEP section;
switch fixed bonding MAC flush in certain cases for 98DX224S, 98DX226S, 98DX2528, and 98DX3236 switch chips;
switch fixed egress-rate on QSFP ports;
switch fixed port blocking by MSTP for 88E6393X, 88E6191X and 88E6190 switches;
switch hide cpu-flow-control on irrelevant devices;
switch improved bond MAC flush for 88E6393X, 88E6191X and 88E6190 switches;
switch improved hash calculation for 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98CX8410 switches (affects load balancing for bonds, ECMP routes, and VXLAN source port);
switch improved ingress-rate limit precision for 88E6393X, 88E6191X and 88E6190 switches;
switch reset all Ethernet counters on reset-counters command on QoS Port menu;
switch rework ethernet counters for 98DXxxxx, 98PX1012 and CRS1xx/2xx switches (add tx-drop-queueX-byte/packet, tx-drop-byte/packet, tx-queueX-byte to /in/eth and updated GUI);
system added support for OpenFlow 1.3 (new package "openflow" available);
system do not automatically retry in case /system/package/update download fails;
system fixed bb-upgrade failure on RB5009;
system fixed certain notifications (e.g. kid-control activity, connection tracking table) (introduced in v7.17);
system fixed stuck TCP transmit on virtual interfaces, leading to retransmits;
system improved system configuration journaling procedure;
system improved system stability for hEX refresh and hEX S (2025);
system improved system stability when processing large amount of traffic;
system merge /system/resource/usb and /system/resource/pci into /system/resource/hardware and create a device tree;
usb improved system stability after unplugging USB device for RB5009;
user added tiny delay on any user login attempt to limit login attempts;
user change /user/active/request-logout to /user/active/remove;
veth added dhcp=yes/no property to be able to easily run a container in LAN, runs a special dynamic dhcp-client on interface and sets acquired address/gateway/dns to in-container interface;
veth added mac-address property;
veth make veth interface MAC address stable in both RouterOS and container (container-side MAC incremented by +1 from RouterOS-side interface);
vrrp added "connection-tracking-port" and "connection-tracking-mode" settings for "sync-connection-tracking";
vrrp added proxy-arp support;
vrrp fixed invalid TCP connection state after failover with enabled sync-connection-tracking;
vrrp fixed sync-connection-tracking issue when parent interface is disabled/enabled;
vrrp improved responsiveness when router has many IP addresses depending on VRRP state;
vrrp improved stability when removing VRRP interface with enabled sync-connection-tracking;
vrrp make MTU property read-only;
vxlan added checksum and learning properties;
vxlan fixed unset behavior for "local-address" and "bridge" properties;
vxlan prevent socket sharing (cannot create multiple VXLAN interfaces using the same UDP port with different checksum or vtep-vrf settings);
vxlan rename "vrf" setting to "vtep-vrf";
webfig added token authentication (no password prompt on reload or new window, logout button will log out all related sessions, removing a user will disconnect from active sessions);
webfig allow network map scrolling in Dude;
webfig basic mobile keyboard support for terminal;
webfig do not show Keepalive if not set in GRE Tunnel form;
webfig filter out unusable Bands and Channels for wifi interfaces;
webfig fixed an issue where dynamic dropdown lists were hidden despite having values;
webfig fixed container parameters;
webfig fixed hiding New button with skins;
webfig fixed issue where legacy WebFig login page was used;
webfig fixed skin limits for radio buttons;
webfig fixed Target field duplicate when disabling simple queue;
webfig improved stability when displaying read-only scripts;
webfig make columns a bit wider in tables;
webfig make the Close buttons actual buttons, not links;
webfig mask certain fields where values match default value;
webfig redesign logical "not" operator selector;
webfig remove duplicate flag labels in QuickSet tables;
webfig show system note on login;
webfig use lexicographical sort in dropdown lists;
webfig use time stamps for volatile graphs (improved graph visualization);
wifi added tr069 support for wifi interfaces;
wifi avoid picking 5GHz channels by default which are unlikely to be supported by clients, can be overridden with channel.deprioritize-unii-3-4;
wifi fixed inability to apply steering profile to device's native wifi interfaces;
wifi fixed issue where station mode looped connecting to the same BSSID, preventing switching to other APs;
wifi increased wifi scan list;
wifi restart CAPsMAN only on significant configuration changes;
wifi-qcom accept VLAN-tagged packets from clients with vlan-id;
wifi-qcom added country profile "UK 5.8 fixed" and "ETSI 5.5-5.7 Outdoor";
winbox added "Digest Algorithm" under "System/Certificates" menu;
winbox added "Note" field in LTE Firmware Upgrade;
winbox added "Reselect Time" for wifi;
winbox added Address List Extra Time under "IP/DNS" menu;
winbox added EAP identity under "WiFi/Registration" menu;
winbox added Heartbeat under "Bridge/MLAG" menu;
winbox added Installation under "WiFi" menu;
winbox added missing columns under "System/Users/SSH Keys" menu;
winbox added missing Comments under "User Manager" menus;
winbox added missing properties to "Container" menu and improved field ordering;
winbox added missing WPA2 PSK SHA2 option under "WiFi/Security" menu;
winbox added MPLS Mangle;
winbox added option to create new entries under "System/Users/SSH Keys" menu;
winbox allow to specify CAPsMAN Address as IPv6 LL;
winbox bump minimal WinBox version to 3.42;
winbox correctly unset Locked CAPsMAN field;
winbox differentiate PPP Profile Rx/Tx Queue settings;
winbox display errors from the "Files/Sync" menu;
winbox fixed "Rate" and "Full Duplex" monitor values after link down under "Interface/Ethernet" menu;
winbox fixed container RAM parameter type;
winbox fixed missing warning under "Routing/BGP/Instances" menu;
winbox fixed Record Type field under "Tools/Netwatch" menu;
winbox improved byte type field representation;
winbox improved Switch QoS layout;
winbox make IPv6 Immediate Gateway read-only;
winbox make log message field as multiline;
winbox move CAPsMAN settings button from Remote CAP to WiFi table;
winbox removed duplicate mounts option;
winbox rename Ping Timeout field to Interval;
winbox rename SMS Type field to Modem Type;
winbox rework LTE firmware upgrade buttons into one window;
winbox show "Switch" related menus only on boards that support such features;
winbox show all columns under "System/Users/SSH Keys" menu by default;
winbox use same WireGuard default values as in console;
wireguard fixed minor memory leak when IPv6 is disabled;
wireguard improved system stability on busy devices;
wireless changed CLI snooper column name "freq" to "channel";
7.19.6 Stable 2025-Sep-12 (4 months ago)
Component Change
bridge improved system stability with IGMP snooping;
ethernet improved performance for hEX Refresh and hEX S (2025);
ike2 improved system stability;
leds fixed signal strength LEDs for Cube 60G ac;
log added VRF support for remote logging;
log establish a new connection to the remote log server when action settings are edited (e.g. after changing the src-address property);
log fixed memory leak when a connection to remote TCP log server failed;
log fixed unsent message retransmit to correct endpoints (introduced in v7.18);
log randomize source port when using remote logging with src-address specified;
lte fixed wrong subnet mask set to Chateau 5G R17 ax LTE interface;
mac-server fixed interface-list change behavior;
poe-out added "poe-in" detection for 802.3at poe-out capable ports;
poe-out firmware update for 802.3at capable boards (the update will cause brief power interruption to poe-out interfaces);
poe-out fixed "low-voltage" LLDP deny for RB5009 and RB960 in specific voltage/power-source combinations;
poe-out fixed missing error status report in rare cases for 802.3at;
routerboot fixed load of other kernels (e.g. OpenWrt) on NAND-less boards with MT762x, IPQ40xx, QCA955x and QCA953x CPUs ("/system routerboard upgrade" required);
sfp fixed the I2C clock frequency for the hEX S (2025) to prevent EEPROM read issues with GPON modules;
switch fixed switch name for CRS418;
switch improved system stability after switch reset while bonding interfaces are active (introduced in v7.18);
traffic-flow added support for IPv6 packet sampling;
traffic-flow fixed flow reports when using IPv6 and packet sampling (introduced in v7.18);
w60g fixed disconnect issue (introduced in v7.19.4);
winbox allow selecting bonding interface under "Switch/Rule" menu;
winbox use "auto" as default value for VXLAN "Don't Fragment" property;
7.19.4 Stable 2025-Jul-28 (6 months ago)
Component Change
arm improved system stability when processing encrypted traffic;
arm64 increased maximum number of CPU cores to 128;
ethernet improved ethernet stability when handling invalid packets on Alpine CPUs;
iot fixed incorrectly set LoRa channel plan behavior;
ipv6 fixed policy routing;
leds fixed issues after changing "dark-mode" configuration (introduced in v7.19);
license updated URL for "libcroco" package in the license notice;
log output PoE-Out LLDP negotiation to poe,info topic;
net ensure packet sockets from containers do not disable RouterOS fastpath/fasttrack;
netinstall-cli recognize RouterOS v6 system package;
port give "gps" prefix for R11e-LR8G and R11e-LR9G GPS ports;
ptp allow priority1 value of 0 (improves stability when receiving announce messages with priority1 set to 0);
routing-filter fixed route origin matcher;
system improved system stability for CCR2216 device;
system improved system stability when using fasttrack;