openstack/designate — Week of 2026-10-24

Floating IP PTR security. Two authz holes in the floating IP PTR API were closed: a missing authorization check and a cross-tenant zone hijack. Both landed on master without visible backports in this window.

Catalog zone handling. Pool management grew more robust around catalog zones, with a ~210-line fix for nameserver updates when a pool hosts a catalog zone (1010386) and a companion fix for pool deletion in the same situation. The delete fix was fanned out as four parallel backports across stable branches.

Record and resolver correctness. The CAA record flags field was widened to cover the full RFC 6844 range, shipped once on master and backported to four stable branches. Separately, zone deletion no longer fails when BIND has recursion enabled.

Stability. The coordination driver now stops safely when it was never initialized, with the fix mirrored to four stable branches.

Activity this week was entirely bugfix and backport work from a single contributor, with roughly two-thirds of the churn concentrated in the catalog-zone and CAA fixes and their stable-branch propagation.