openstack/designate — Week of 2026-10-31

Security hardening. The bulk of the week was a security-fix push across the API and TSIG surfaces, with each fix landing on master plus two or three stable branches. TSIG key handling gained validation that key scope matches the referenced resource_id. The floating IP PTR API picked up a missing authorization check and a separate fix for a cross-tenant zone hijack. The Infoblox backend saw PQC compliance gaps closed alongside a TSIG warning cleanup.

Catalog zones and pools. Pool management got two notable corrections: nameserver updates now behave correctly when the pool has a catalog zone, and pool_move_zone now properly bumps catalog zone serials. Related zone-building work makes the lowest-priority ns_record the SOA MNAME and ensures Zone.refresh is populated when constructing from a dnspython zone.

API and storage fixes. Pagination on the service_statuses endpoint was repaired, a MySQL migration was tweaked for ProxySQL compatibility, and a client attribute is now initialized up front to prevent an AttributeError.

Tooling. DevStack dropped mod_wsgi deployment support and a redundant install_apache_uwsgi call, and the Xena upgrade script was removed.