GitLab

                        a TCP socket. This prevents the source address being
                        set for TCP connections. [RT #15628]

                        xfrin.c:maybe_free() if named ran out of memory.
                        [RT #15568]

                        expired RRSIGs.  Default "dnssec-accept-expired no;".
                        Setting "dnssec-accept-expired yes;" leaves named
                        vulnerable to replay attacks.  [RT #14685]

                        when using forwarders. [RT #15549]

                        To generate a RSAMD5 key you must explictly request
                        RSAMD5. [RT #13780]

                        [RT #15522]

                        [RT #15647]

Don't close the file descriptor for fdwatch socket shutdowns.  Let the application do this, since it is passed in, and it may have other uses or shutdown to do on it first.

                        trusted-keys do not attempt to validate the DNSKEY
                        using the parents DS RRset. [RT #15649]

                        rdataset is passed to it. [RT #15642]

                        Coverity.