Pull request 2643: AGDNS-3952-udp-id

Squashed commit of the following:

commit c5c1303
Merge: 2e44536 95b2421
Author: Ainar Garipov <a.garipov@adguard.com>
Date:   Mon May 4 18:00:18 2026 +0300

    Merge branch 'master' into AGDNS-3952-udp-id

commit 2e44536
Author: Ainar Garipov <a.garipov@adguard.com>
Date:   Mon May 4 17:49:01 2026 +0300

    all: upd tag

commit 2c685dd
Author: Ainar Garipov <a.garipov@adguard.com>
Date:   Thu Apr 30 14:31:39 2026 +0300

    all: upd chlog

commit 1fe4ac4
Author: Ainar Garipov <a.garipov@adguard.com>
Date:   Tue Apr 28 21:36:12 2026 +0300

    all: upd dnsproxy

Author: ainar-g

CHANGELOG.md

@@ -18,6 +18,12 @@ See also the [v0.107.75 GitHub milestone][ms-v0.107.75].
 NOTE: Add new changes BELOW THIS COMMENT.
 -->
 
+### Security
+
+- IDs of requests received over DoH and DoQ and forwarded to plain-DNS upstreams are now set to non-zero values to improve security.
+
+    This is GHSA-xgx4-4h9w-53pv.  We thank @N0zoM1z0 for reporting this security issue.
+
 ### Changed
 
 - Frontend API requests no longer depend on axios.

go.mod

@@ -3,8 +3,8 @@ module github.com/AdguardTeam/AdGuardHome
 go 1.26.2
 
 require (
-	github.com/AdguardTeam/dnsproxy v0.81.2
-	github.com/AdguardTeam/golibs v0.35.11
+	github.com/AdguardTeam/dnsproxy v0.81.3
+	github.com/AdguardTeam/golibs v0.35.12
 	github.com/AdguardTeam/urlfilter v0.23.2
 	github.com/NYTimes/gziphandler v1.1.1
 	github.com/ameshkov/dnscrypt/v2 v2.4.0

go.sum

@@ -4,10 +4,10 @@ cloud.google.com/go/auth v0.20.0 h1:kXTssoVb4azsVDoUiF8KvxAqrsQcQtB53DcSgta74CA=
 cloud.google.com/go/auth v0.20.0/go.mod h1:942/yi/itH1SsmpyrbnTMDgGfdy2BUqIKyd0cyYLc5Q=
 cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
 cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
-github.com/AdguardTeam/dnsproxy v0.81.2 h1:j1p74pbzyrrE21OL1lmNEWxuhHXNykk+NDH4hgDD9Eg=
-github.com/AdguardTeam/dnsproxy v0.81.2/go.mod h1:5lTCQqVQ8Kt4KnTOmdV0Ab3k58KZFOazupVfXJezwq8=
-github.com/AdguardTeam/golibs v0.35.11 h1:LooiyPNtsfv32reFz4qD8KpWQm9jIFuPwHxHyVgtaRg=
-github.com/AdguardTeam/golibs v0.35.11/go.mod h1:wBe9Vgrcn6M4T7p7z/vnRZANLzVO72myRggnCKBx+sQ=
+github.com/AdguardTeam/dnsproxy v0.81.3 h1:WT2ylABCqTDs0vCg6Ik5K6pOfn7Zxnonfk2MpLGvNY4=
+github.com/AdguardTeam/dnsproxy v0.81.3/go.mod h1:jcrlawxdZ+jh0TpCfPhT63LmVFuZETH495Sn9bAvQ8s=
+github.com/AdguardTeam/golibs v0.35.12 h1:ONAzF/3JG2xp5Xq2G9EChbJiXjkouGjTGLzM8bSEYQQ=
+github.com/AdguardTeam/golibs v0.35.12/go.mod h1:8EEGG4auTDd8HV3tBETXLkuxDH9lk9vvFbJn+wbmypg=
 github.com/AdguardTeam/urlfilter v0.23.2 h1:EiS/PQZO/X2S6cduFW6BBoRLyjd6SqZj1ZiFbU1KaFE=
 github.com/AdguardTeam/urlfilter v0.23.2/go.mod h1:JteAKoeka1Yr2oZ3P94dqYBfPOHWyFaOcu3uZa9Yl+I=
 github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
@@ -268,8 +268,8 @@ google.golang.org/genai v1.54.0 h1:ZQCa70WMTJDI11FdqWCzGvZ5PanpcpfoO6jl/lrSnGU=
 google.golang.org/genai v1.54.0/go.mod h1:A3kkl0nyBjyFlNjgxIwKq70julKbIxpSxqKO5gw/gmk=
 google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 h1:XzmzkmB14QhVhgnawEVsOn6OFsnpyxNPRY9QV01dNB0=
 google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:L43LFes82YgSonw6iTXTxXUX1OlULt4AQtkik4ULL/I=
-google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7 h1:41r6JMbpzBMen0R/4TZeeAmGXSJC7DftGINUodzTkPI=
-google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:EIQZ5bFCfRQDV4MhRle7+OgjNtZ6P1PiZBgAKuxXu/Y=
+google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 h1:yQugLulqltosq0B/f8l4w9VryjV+N/5gcW0jQ3N8Qec=
+google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478/go.mod h1:C6ADNqOxbgdUUeRTU+LCHDPB9ttAMCTff6auwCVa4uc=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=