My understanding is that there's no leak and hence, this issue is about code cleanup w/no functional change. Thus, I don't think a backport is necessary.Jeff Lucovsky
https://github.com/OISF/suricata/pull/16421 The "ether" object keeps describing the ethernet header as captured, so for a RARP frame on a VLAN, "ether.ether_type" is still 33024 (0x8100). What's new is a top-level "unknown_ether_typ...Jeff Lucovsky
https://github.com/OISF/suricata/pull/16421 Alerts for a packet with the decoder.ethernet.unknown_ethertype event now include the ethertype the decoder could not handle, in a top-level "unknown_ether_type" field. It is an integer, l...Jeff Lucovsky
A rule using @fileext@ or @file.name@ misses a file when an earlier file of the same transaction did not match, if the two files are inspected in different passes. With both files in one packet the same rule alerts. h3. Reproducer ...Jeff Lucovsky
A bidirectional (@=>@) rule can alert when only its toserver half matched. The toclient buffers are never inspected, so whatever the rule asks of the response is ignored. h3. Reproducer One plain HTTP/1.1 exchange, @GET /index.html...Jeff Lucovsky
A rule that ends a content match with @isdataat:!<var>,relative@ silently loses that check when the byte variable happens to have local id 1. The rule loads without a warning and then matches on something else than what was written. h...Jeff Lucovsky