Update upstream source from tag 'upstream/1.58.0'

Update to upstream version '1.58.0'
with Debian dir f280698ee19dd2290c93272edd38632c0b951c5f

2 files changed, 90 insertions, 68 deletions

diff --git a/NEWS b/NEWS
index 21451a5e..06438daa 100644
--- a/NEWS
+++ b/NEWS
@@ -3,15 +3,16 @@ NetworkManager-1.58
 Overview of changes since NetworkManager-1.56
 =============================================
 
-This is a snapshot of NetworkManager development. The API is
-subject to change and not guaranteed to be compatible with
-the later release.
-USE AT YOUR OWN RISK.  NOT RECOMMENDED FOR PRODUCTION USE!
+General:
 
 * Unify the versioning to use everywhere the scheme with the -rcX or -dev
   suffixes when appropriate. This affects, for example, the URL and filename
   of the release tarball and the version reported by nmcli and the daemon.
   As an exception, the C API will continue to use the 90+ scheme for RC versions.
+* Install the systemd units in the initramfs using a systemd generator.
+
+Core:
+
 * Connection profiles with manual IP addressing and with gateways that are not
   directly reachable will generate a warning on activation and when they are
   added/modified via nmcli and nmtui. NetworkManager currently adds on-link
@@ -20,97 +21,118 @@ USE AT YOUR OWN RISK.  NOT RECOMMENDED FOR PRODUCTION USE!
   gateways. A gateway (either the default gateway or the next-hop of a route) is
   considered directly reachable if it falls within the subnet of a direct route
   (a route without a next hop) or of a prefix route from a static address.
-* Restrict the connectivity check to use the DNS servers defined on the
-  same link. If the link has no DNS servers, the connectivity check will
-  use any servers available in the system.
-* Install the systemd units in the initramfs using a systemd generator.
-* A new "check-connectivity" configuration option is available to disable the
-  connectivity check for selected interfaces.
-* Remove the modify_system build option that allowed setting up the
-  polkit permissions to allow non-admin users to create system-wide
-  connection. That configuration is discouraged because it can be used
-  to bypass filesystem permissions.
-* For private connections (the ones that specify a user in the
-  "connection.permissions" property), verify that the user can access
-  the 802.1X certificates and keys set in the connection.
-* Introduce a libnm function that can be used by VPN plugins to check
-  user permissions on certificate and keys.
-* The support for Wireless Extensions is deprecated and will be
-  removed in a future release. Wireless Extensions are now disabled by
-  default.
 * Use an internal implementation of the ping functionality when the
   "connection.gateway-ping-timeout" or "connection.ip-ping-addresses"
   properties are set, instead of relying on the "ping" tool.
-* The powersave property now functions with the iwd backend.
-* The "band" property of Wi-fi connections now accepts the "6GHz"
-  value.
-* Show the Wi-Fi band of APs in the scan results from nmcli.
-* New <Select...> button in nmtui that allows users to chose from list of
-  available devices when creating connection profiles for physical interfaces
-  (Ethernet, Wi-Fi, etc.).
-* Add support for CLAT (464XLAT) using a BPF program.
+* Add support for CLAT (464XLAT) using a BPF program, controlled by the
+  "ipv4.clat" property. CLAT is still disabled by default for now.
 * Change the default value of the ipv4.dhcp-ipv6-only-preferred property
   to a new value "auto" which automatically enables the option when CLAT
   is enabled ("yes" or "auto") in the connection profile.
-* WIFI connections using wpa-psk respect the setting connection.auth-retry
-  and only prompt for new secrets during the last authentication attempt before
-  failing.
 * Add support for GENEVE interface.
-* The DHCPv4 internal client now ignores option 3 (Router) if the lease
-  contains option 121 (Classless Static Route), as recommended by RFC 3442.
-* Allow persisting the managed state across reboots from nmcli and the D-Bus API.
+* Allow persisting the managed state across reboots from the D-Bus API and nmcli.
 * Allow changing the device's administrative state in the kernel at the same
-  time as a change to the managed state from nmcli and the D-Bus API.
-* Allow configuring all bond options in nmtui by introducing a
-  "other options" field, which covers options not already covered by a
-  dedicated input field.
+  time as a change to the managed state from the D-Bus API and nmcli.
 * IPv6 interfaces that receive PD via DHCPv6 are considered healthy without a
   non-temporary address. The delegated prefix can be used via an interface
   configured with "ipv6.method: shared"
-* nmtui now offers a "Show password" checkbox in the dialog that prompts for
-  secrets when activating a connection, matching the connection editor.
+* Fix reapply not honoring the ipv6.ignore-auto-dns, ipv6.ignore-auto-routes
+  and ipv6.never-default properties when DHCPv6 was not restarted (for example
+  when the IPv6 DNS came from a DHCPv6 lease), so that DHCPv6-provided DNS and
+  routes are now correctly suppressed on reapply without a connection restart.
+
+Connectivity:
+
+* A new "check-connectivity" configuration option is available to disable the
+  connectivity check for selected interfaces.
+* Restrict the connectivity check to use the DNS servers defined on the
+  same link. If the link has no DNS servers, the connectivity check will
+  use any servers available in the system.
+* Fix stale global connectivity state with connectivity checking enabled:
+  NetworkManager could report limited connectivity while another device had full
+  connectivity, or keep reporting limited after a device regained internet
+  access.
+
+DHCP:
+
+* The internal DHCPv4 client now ignores option 3 (Router) if the lease
+  contains option 121 (Classless Static Route), as recommended by RFC 3442.
 * Fix an out-of-bounds read in the internal DHCPv4 client that an on-link
   attacker could trigger with a malformed UDP packet, crashing NetworkManager.
-* The nmtui connection lists ("nmtui connect" and "nmtui edit") support a
-  vim-style "/" search that filters the list to matching entries as you type.
-* nmtui now redraws its forms when the terminal is resized, instead of leaving
-  them off-center or clipped until the form is reopened.
-* The "Activate a connection" screen in nmtui now has a "Rescan Wi-Fi" button
-  that scans for nearby Wi-Fi networks on demand.
 * Validate hostnames and MUD URLs before pasting them into the dhclient
   configuration file, rejecting characters that could alter the config
   syntax (CVE-2026-10805).
-* Fix reapply not honoring the ipv6.ignore-auto-dns, ipv6.ignore-auto-routes
-  and ipv6.never-default properties when DHCPv6 was not restarted (for example
-  when the IPv6 DNS came from a DHCPv6 lease), so that DHCPv6-provided DNS and
-  routes are now correctly suppressed on reapply without a connection restart.
+
+Wi-Fi:
+
+* The "band" property of Wi-fi connections now accepts the "6GHz"
+  value.
+* The powersave property now functions with the iwd backend.
+* WIFI connections using wpa-psk respect the setting connection.auth-retry
+  and only prompt for new secrets during the last authentication attempt before
+  failing.
 * Accept 64 hex-character PSK in WPS credentials which are returned by some
   access points.
-* Drop support for dhclient as a DHCP backend, which has been deprecated
-  since NetworkManager-1.50.
+* When wpa_supplicant reports a WPA3-SAE password mismatch, prompt the
+  user for the password again instead of failing, matching the WPA-PSK
+  behavior.
+
+nmtui / nmcli:
+
+* Show the Wi-Fi band of APs in the scan results from nmcli.
+* New <Select...> button in nmtui that allows users to chose from list of
+  available devices when creating connection profiles for physical interfaces
+  (Ethernet, Wi-Fi, etc.).
+* Allow configuring all bond options in nmtui by introducing a
+  "other options" field, which covers options not already covered by a
+  dedicated input field.
+* nmtui now offers a "Show password" checkbox in the dialog that prompts for
+  secrets when activating a connection, matching the connection editor.
+* The nmtui connection lists ("nmtui connect" and "nmtui edit") support a
+  vim-style "/" search that filters the list to matching entries as you type.
+* The "Activate a connection" screen in nmtui now has a "Rescan Wi-Fi" button
+  that scans for nearby Wi-Fi networks on demand.
 * nmtui can now share a Wi-Fi connection as a QR code via the "Share QR..."
   button in the "Edit a connection" view, mirroring "nmcli device wifi
   show-password".
-* nmcli "device wifi show-password" no longer prints a QR code when the
-  Wi-Fi password cannot be read due to insufficient privileges; it prints a
-  warning instead.
-* Fix stale global connectivity state with connectivity checking enabled:
-  NetworkManager could report limited connectivity while another device had full
-  connectivity, or keep reporting limited after a device regained internet
-  access.
 * nmcli "connection show" now labels the ports column "PORT" instead of
   "SLAVE" (the "SLAVE" field name is still accepted as an alias), and adds
   the BRIDGE.PORTS, TEAM.PORTS and GENERAL.CONTROLLER-PATH fields.
+* nmtui now redraws its forms when the terminal is resized, instead of leaving
+  them off-center or clipped until the form is reopened.
+* nmcli "device wifi show-password" no longer prints a QR code when the
+  Wi-Fi password cannot be read due to insufficient privileges; it prints a
+  warning instead.
+
+VPN:
+
+* Introduce a libnm function that can be used by VPN plugins to check
+  user permissions on certificate and keys.
+* Fix VPN connections with "ipv4.dns-search" or "ipv6.dns-search" set
+  ignoring the search domains pushed by the VPN; the manually configured
+  and VPN-provided search domains are now merged.
+
+Security:
+
+* For private connections (the ones that specify a user in the
+  "connection.permissions" property), verify that the user can access
+  the 802.1X certificates and keys set in the connection.
 * Add a "polkit_noauth_group" build option to install a polkit rule that
   lets admin users in the given group (typically "sudo" or "wheel") make
   system-wide connection changes from a local console without entering a
   password. It is empty (disabled) by default and is discouraged.
-* When wpa_supplicant reports a WPA3-SAE password mismatch, prompt the
-  user for the password again instead of failing, matching the WPA-PSK
-  behavior.
-* Fix VPN connections with "ipv4.dns-search" or "ipv6.dns-search" set
-  ignoring the search domains pushed by the VPN; the manually configured
-  and VPN-provided search domains are now merged.
+
+Deprecations and removals:
+
+* The support for Wireless Extensions is deprecated and will be
+  removed in a future release. Wireless Extensions are now disabled by
+  default.
+* Remove the modify_system build option that allowed setting up the
+  polkit permissions to allow non-admin users to create system-wide
+  connection. That configuration is discouraged because it can be used
+  to bypass filesystem permissions.
+* Drop support for dhclient as a DHCP backend, which has been deprecated
+  since NetworkManager-1.50.
 
 =============================================
 NetworkManager-1.56
diff --git a/meson.build b/meson.build
index 5383cb07..4638c50a 100644
--- a/meson.build
+++ b/meson.build
@@ -5,7 +5,7 @@ project(
 # NOTE: When incrementing version also add corresponding
 #       NM_VERSION_x_y_z macros in
 #       "src/libnm-core-public/nm-version-macros.h.in"
-  version: '1.58-rc1',
+  version: '1.58.0',
   license: 'GPL2+',
   default_options: [
     'buildtype=debugoptimized',