Merge branch 'master' into sasl

Conflicts: include/znc/Client.h src/Client.cpp src/Modules.cpp test/integration/tests/modules.cpp
2026-08-01 22:43:05 +02:00 · 2025-02-13 20:37:32 +00:00
parent 1dd995ef77 44e4b95a20
commit 41a0030fdb
381 changed files with 12248 additions and 4121 deletions
@@ -7,7 +7,7 @@ clone_depth: 10
 install:
    - ps: Invoke-WebRequest https://cygwin.com/setup-x86_64.exe -OutFile c:\cygwin-setup.exe
      # libcrypt-devel is needed only on x86_64 and only for modperl... probably some dependency problem.
-    - c:\cygwin-setup.exe --quiet-mode --no-shortcuts --no-startmenu --no-desktop --upgrade-also --only-site --site http://cygwin.mirror.constant.com/ --root c:\cygwin-root --local-package-dir c:\cygwin-setup-cache --packages gcc-g++,make,pkg-config,wget,libssl-devel,libicu-devel,zlib-devel,libcrypt-devel,perl,python3-devel,swig,libsasl2-devel,libQt5Core-devel,cmake,libboost-devel,gettext-devel
+    - c:\cygwin-setup.exe --quiet-mode --no-shortcuts --no-startmenu --no-desktop --upgrade-also --only-site --site http://cygwin.mirror.constant.com/ --root c:\cygwin-root --local-package-dir c:\cygwin-setup-cache --packages gcc-g++,make,pkg-config,wget,libssl-devel,libicu-devel,zlib-devel,libcrypt-devel,perl,python3-devel,swig,libsasl2-devel,libQt5Core-devel,cmake,libboost-devel,gettext-devel,libargon2-devel
    - c:\cygwin-root\bin\sh -lc "echo Hi"
    - c:\cygwin-root\bin\sh -lc "uname -a"
    - c:\cygwin-root\bin\sh -lc "cat /proc/cpuinfo"
@@ -18,7 +18,7 @@ install:
 build_script:
    - git submodule update --init
    - mkdir build
-    - c:\cygwin-root\bin\sh -lc "cd $APPVEYOR_BUILD_FOLDER/build; ../configure --enable-charset --enable-zlib --enable-openssl --enable-perl --enable-python --enable-cyrus < /dev/null; result=$?; cmake --system-information > config.log; appveyor PushArtifact config.log; exit $result"
+    - c:\cygwin-root\bin\sh -lc "cd $APPVEYOR_BUILD_FOLDER/build; env ZNC_QT_VER=5 ../configure --enable-charset --enable-zlib --enable-openssl --enable-perl --enable-python --enable-cyrus --enable-argon < /dev/null; result=$?; cmake --system-information > config.log; appveyor PushArtifact config.log; exit $result"
    - c:\cygwin-root\bin\sh -lc "cd $APPVEYOR_BUILD_FOLDER/build; make VERBOSE=1 -j2 < /dev/null"
    - c:\cygwin-root\bin\sh -lc "cd $APPVEYOR_BUILD_FOLDER/build; make install < /dev/null"
    - c:\cygwin-root\bin\sh -lc "znc --version"
@@ -27,4 +27,4 @@ build_script:
    - c:\cygwin-root\bin\sh -lc "rebase -s -v $(cat /tmp/files-to-rebase)"
 test_script:
    - c:\cygwin-root\bin\sh -lc "cd $APPVEYOR_BUILD_FOLDER/build; make VERBOSE=1 unittest < /dev/null"
-    - c:\cygwin-root\bin\sh -lc "cd $APPVEYOR_BUILD_FOLDER/build; make VERBOSE=1 inttest < /dev/null"
+    - c:\cygwin-root\bin\sh -lc "cd $APPVEYOR_BUILD_FOLDER/build; env ZNC_QT_VER=5 make VERBOSE=1 inttest < /dev/null"
@@ -11,7 +11,7 @@ def upstream_user = 'znc'
 def upstream_repo = 'znc'
 def my_user = 'znc-jenkins'
 def my_repo = 'znc'
-def branches = ['master', '1.8.x']
+def branches = ['master', '1.9.x']

 def pr_mode = false

@@ -6,7 +6,7 @@ ls -la
 cpanm --local-lib=~/perl5 local::lib
 eval $(perl -I ~/perl5/lib/perl5/ -Mlocal::lib)
 cpanm --notest Devel::Cover::Report::Clover
-pip3 install --user coverage
+pip3 install --user --break-system-packages coverage
 export ZNC_MODPERL_COVERAGE=1
 #export ZNC_MODPYTHON_COVERAGE=1

@@ -23,7 +23,7 @@ esac

 mkdir build
 cd build
-../configure --enable-debug --enable-perl --enable-python --enable-tcl --enable-cyrus --enable-charset $CFGFLAGS
+../configure --enable-debug --enable-perl --enable-python --enable-tcl --enable-cyrus --enable-charset --enable-argon $CFGFLAGS
 cmake --system-information

 make -j2 VERBOSE=1
@@ -39,10 +39,13 @@ ls -lRa

 case "${CC:-gcc}" in
 	gcc)
-		lcov --directory . --capture --output-file lcov-coverage.txt
+		lcov --directory . --capture --output-file lcov-coverage.txt --ignore-errors mismatch
 		lcov --list lcov-coverage.txt
 		;;
 	clang)
+		if [[ x$(uname) == xDarwin ]]; then
+			export PATH=$PATH:/Library/Developer/CommandLineTools/usr/bin
+		fi
 		llvm-profdata merge unittest.profraw -o unittest.profdata
 		llvm-profdata merge inttest.profraw -o inttest.profdata
 		llvm-cov show -show-line-counts-or-regions -instr-profile=unittest.profdata test/unittest_bin > unittest-cmake-coverage.txt
@@ -1,4 +1,4 @@
 sudo apt-get update
-sudo apt-get install -y tcl-dev libsasl2-dev libicu-dev swig qtbase5-dev libboost-locale-dev libperl-dev cpanminus gettext clang llvm lcov
+sudo apt-get install -y tcl-dev libsasl2-dev libicu-dev swig qt6-base-dev libboost-locale-dev libperl-dev libargon2-dev cpanminus gettext clang llvm lcov
 sudo apt-get upgrade -y

@@ -6,56 +6,62 @@ on:
 jobs:
  gcc:
    name: GCC
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
        with:
          submodules: true
      - run: source .github/ubuntu_deps.sh
      - run: source .github/build.sh
-      - uses: codecov/codecov-action@v3
+      - uses: codecov/codecov-action@v4
        with:
          name: ${{ github.job }}
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
        with:
          name: codecov debug results ${{ github.job }}
          path: "/tmp/codecov.*.gz"

  tarball:
    name: Tarball
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
        with:
          submodules: true
      - run: source .github/ubuntu_deps.sh
      - run: |
-          ./make-tarball.sh --nightly znc-git-2015-01-16 /tmp/znc-tarball.tar.gz
-          tar xvf /tmp/znc-tarball.tar.gz
-          cd znc-git-2015-01-16
+          date=$(date +%Y-%m-%d)
+          ./make-tarball.sh --nightly znc-git-$date /tmp/znc-git-$date.tar.gz
+          tar xvf /tmp/znc-git-$date.tar.gz
+          cd znc-git-$date
          export CFGFLAGS="--with-gtest=$GITHUB_WORKSPACE/third_party/googletest/googletest --with-gmock=$GITHUB_WORKSPACE/third_party/googletest/googlemock --disable-swig"
          source $GITHUB_WORKSPACE/.github/build.sh
-      - uses: codecov/codecov-action@v3
+      - uses: actions/upload-artifact@v4
+        with:
+          name: znc-tarball
+          path: /tmp/znc-git*.tar.gz
+          if-no-files-found: error
+      - uses: codecov/codecov-action@v4
        with:
          name: ${{ github.job }}

  # can be removed when asan below is fixed
  clang:
    name: Clang
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
    env:
      CXX: clang++
      CC: clang
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
        with:
          submodules: true
      - run: source .github/ubuntu_deps.sh
      - run: source .github/build.sh
-      - uses: codecov/codecov-action@v3
+      - uses: codecov/codecov-action@v4
        with:
          name: ${{ github.job }}
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
        with:
          name: codecov debug results ${{ github.job }}
          path: "/tmp/codecov.*.gz"
@@ -63,35 +69,35 @@ jobs:
 
  #clang_asan:
    #name: Clang ASAN
-    #runs-on: ubuntu-20.04
+    #runs-on: ubuntu-24.04
    #env:
      #CXX: clang++
      #CC: clang
      #CXXFLAGS: "-fsanitize=address -O1 -fno-omit-frame-pointer -fno-optimize-sibling-calls -fPIE"
      #LDFLAGS: "-fsanitize=address -pie"
    #steps:
-      #- uses: actions/checkout@v3
+      #- uses: actions/checkout@v4
        #with:
          #submodules: true
      #- run: source .github/ubuntu_deps.sh
      #- run: source .github/build.sh
-      #- uses: codecov/codecov-action@v3
+      #- uses: codecov/codecov-action@v4

  #clang_tsan:
    #name: Clang TSAN
-    #runs-on: ubuntu-20.04
+    #runs-on: ubuntu-24.04
    #env:
      #CXX: clang++
      #CC: clang
      #CXXFLAGS: "-fsanitize=thread -O1 -fPIE"
      #LDFLAGS: "-fsanitize=thread"
    #steps:
-      #- uses: actions/checkout@v3
+      #- uses: actions/checkout@v4
        #with:
          #submodules: true
      #- run: source .github/ubuntu_deps.sh
      #- run: source .github/build.sh
-      #- uses: codecov/codecov-action@v3
+      #- uses: codecov/codecov-action@v4

      # TODO: enable
      #CXXFLAGS: "-fsanitize=memory -O1 -fno-omit-frame-pointer -fno-optimize-sibling-calls -fsanitize-memory-track-origins"
@@ -100,18 +106,22 @@ jobs:
      #CXXFLAGS: "-fsanitize=undefined -O1 -fPIE -fno-sanitize-recover"
      #LDFLAGS: "-fsanitize=undefined -pie -fno-sanitize-recover"

-  #macos:
-    #name: macOS
-    #runs-on: macos-latest
-    #steps:
-      #- uses: actions/checkout@v3
-        #with:
-          #submodules: true
-      #- run: |
-          #brew update
-          #brew install icu4c qt5 gettext pkg-config cpanminus boost
-      #- run: source .github/build.sh
-      #- uses: codecov/codecov-action@v3
+  macos:
+    name: macOS
+    runs-on: macos-latest
+    env:
+      # This doesn't make big difference, since it's the same compiler, but we also use this variable to select lcov vs llvm-cov
+      CXX: clang++
+      CC: clang
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+      - run: |
+          brew update
+          brew install icu4c qt6 gettext pkg-config cpanminus boost argon2 swig
+      - run: source .github/build.sh
+      - uses: codecov/codecov-action@v4

  docker:
    name: Docker push
@@ -121,7 +131,7 @@ jobs:
      - tarball
      - clang
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
        with:
          submodules: true
      - id: tagger
@@ -131,7 +141,7 @@ jobs:
          if [[ "$GITHUB_REF" == refs/heads/master ]]; then
            echo "::set-output name=latest::type=raw,latest"
          fi
-      - uses: docker/metadata-action@v4
+      - uses: docker/metadata-action@v5
        id: meta
        with:
          images: zncbouncer/znc-git
@@ -141,12 +151,12 @@ jobs:
            ${{steps.tagger.outputs.latest}}
      - run: echo "${GITHUB_REF#refs/heads/}-${{steps.tagger.outputs.describe}}" > .nightly
      - run: cat .nightly
-      - uses: docker/login-action@v2
+      - uses: docker/login-action@v3
        if: ${{ github.repository == 'znc/znc' && github.event_name == 'push' }}
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
-      - uses: docker/build-push-action@v3
+      - uses: docker/build-push-action@v6
        with:
          context: .
          push: ${{ github.repository == 'znc/znc' && github.event_name == 'push' }}
@@ -160,7 +170,7 @@ jobs:
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
        with:
          submodules: true
      - run: sudo apt-get update
@@ -20,7 +20,7 @@ jobs:
        dry-run: false
        language: c++
    - name: Upload Crash
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
      if: failure() && steps.build.outcome == 'success'
      with:
        name: artifacts
@@ -2,7 +2,7 @@ name: "CodeQL"

 on:
  push:
-    branches: [ 'master', '1.6.x' ]
+    branches: [ 'master', '1.9.x' ]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ 'master' ]
@@ -12,7 +12,7 @@ on:
 jobs:
  analyze:
    name: Analyze
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
    permissions:
      actions: read
      contents: read
@@ -25,19 +25,24 @@ jobs:

    steps:
    - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
      with:
        submodules: true
-    - run: source .github/ubuntu_deps.sh
+    - run: |
+        source .github/ubuntu_deps.sh
+        sudo apt-get remove -y qt6-base-dev
+        sudo apt-get install -y qtbase5-dev
      
    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
      with:
        languages: ${{ matrix.language }}

    - run: source .github/build.sh
+      env:
+        ZNC_QT_VER: "5"

    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3
      with:
        category: "/language:${{matrix.language}}"
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+# Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -14,9 +14,9 @@
 # limitations under the License.
 #

-cmake_minimum_required(VERSION 3.1)
-project(ZNC VERSION 1.9.0 LANGUAGES CXX)
-set(ZNC_VERSION 1.9.x)
+cmake_minimum_required(VERSION 3.13)
+project(ZNC VERSION 1.10.0 LANGUAGES CXX)
+set(ZNC_VERSION 1.10.x)
 set(append_git_version true)
 set(alpha_version "") # e.g. "-rc1"
 set(VERSION_EXTRA "" CACHE STRING
@@ -41,12 +41,10 @@ endfunction()

 list(APPEND CMAKE_MODULE_PATH "${PROJECT_SOURCE_DIR}/cmake")

-include(TestCXX11)
-set(CMAKE_CXX_STANDARD 11)
-set(CMAKE_CXX_STANDARD_REQUIRED true)
+include(TestCXX17)
 if(NOT CYGWIN)
-	# We don't want to use -std=gnu++11 instead of -std=c++11, but among other
-	# things, -std=c++11 on cygwin defines __STRICT_ANSI__ which makes cygwin
+	# We don't want to use -std=gnu++17 instead of -std=c++17, but among other
+	# things, -std=c++17 on cygwin defines __STRICT_ANSI__ which makes cygwin
 	# not to compile: undefined references to strerror_r, to fdopen, to
 	# strcasecmp, etc (their declarations in system headers are between ifdef)
 	set(CMAKE_CXX_EXTENSIONS false)
@@ -79,6 +77,9 @@ macro(tristate_option opt help)
 	endif()
 endmacro()

+set(ZNC_CMAKE_FIND_DEPS "")
+set(zncpubdeps)
+
 tristate_option(OPENSSL "Support SSL")
 if(WANT_OPENSSL)
 	find_package(OpenSSL ${TRISTATE_OPENSSL_REQUIRED})
@@ -95,6 +96,9 @@ if(WANT_OPENSSL)
 				HAVE_SSL_SESSION_get0_cipher)
 		endfunction()
 		check_SSL_SESSION_get0_cipher()
+		set(ZNC_CMAKE_FIND_DEPS
+			"${ZNC_CMAKE_FIND_DEPS}\nfind_dependency(OpenSSL)")
+		list(APPEND zncpubdeps OpenSSL::SSL)
 	endif()
 endif()
 set(HAVE_LIBSSL "${OPENSSL_FOUND}")
@@ -110,7 +114,7 @@ set(HAVE_ZLIB "${ZLIB_FOUND}")

 tristate_option(CYRUS "Support authentication with Cyrus")
 if(WANT_CYRUS)
-	pkg_check_modules(CYRUS libsasl2)
+	pkg_check_modules(CYRUS IMPORTED_TARGET libsasl2)
 	if(NOT CYRUS_FOUND)
 		# libsasl2.pc is missing on 2.1.25 which is on ubuntu 14.04
 		# next ubuntu version has 2.1.26 which has libsasl2.pc
@@ -126,7 +130,9 @@ if(WANT_CYRUS)
 			CYRUS_HARDCODED)
 		set(CMAKE_REQUIRED_LIBRARIES "${_old_cmake_required_libraries}")
 		if(CYRUS_HARDCODED)
-			set(CYRUS_LDFLAGS -lsasl2)
+			add_library(HardcodedCyrusDep INTERFACE)
+			add_library(PkgConfig::CYRUS ALIAS HardcodedCyrusDep)
+			target_link_libraries(HardcodedCyrusDep INTERFACE sasl2)
 			set(CYRUS_FOUND true)
 		endif()
 	endif()
@@ -135,11 +141,21 @@ if(WANT_CYRUS)
 	endif()
 endif()

+tristate_option(ARGON "Store password hashes using Argon2id instead of SHA-256")
+if(WANT_ARGON)
+	pkg_check_modules(ARGON ${TRISTATE_ARGON_REQUIRED} IMPORTED_TARGET libargon2)
+endif()
+set(ZNC_HAVE_ARGON "${ARGON_FOUND}")
+
 tristate_option(ICU "Support character encodings")
 if(WANT_ICU)
-	pkg_check_modules(ICU ${TRISTATE_ICU_REQUIRED} icu-uc)
+	pkg_check_modules(ICU ${TRISTATE_ICU_REQUIRED} IMPORTED_TARGET icu-uc)
 endif()
 set(HAVE_ICU "${ICU_FOUND}")
+if(ICU_FOUND)
+	set(ZNC_CMAKE_FIND_DEPS "${ZNC_CMAKE_FIND_DEPS}\nfind_dependency_pc(ICU icu-uc)")
+	list(APPEND zncpubdeps PkgConfig::ICU)
+endif()

 set(WANT_PERL false CACHE BOOL "Support Perl modules")
 set(WANT_PYTHON false CACHE BOOL "Support Python modules")
@@ -291,6 +307,10 @@ else()
 	add_library(cctz::cctz ALIAS cctz)
 	target_include_directories(cctz INTERFACE
 		$<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/third_party/cctz/include>)
+	if (APPLE)
+		find_library(CoreFoundation CoreFoundation REQUIRED)
+		target_link_libraries(cctz INTERFACE ${CoreFoundation})
+	endif()
 endif()

 check_cxx_symbol_exists(getopt_long "getopt.h" HAVE_GETOPT_LONG)
@@ -391,6 +411,8 @@ else()
 endif()

 configure_file("include/znc/zncconfig.h.cmake.in" "include/znc/zncconfig.h")
+configure_file("test/integration/znctestconfig.h.cmake.in"
+	"test/integration/znctestconfig.h")
 add_subdirectory(include)
 add_subdirectory(src)
 add_subdirectory(modules)
@@ -415,6 +437,8 @@ include(CMakePackageConfigHelpers)
 write_basic_package_version_file("ZNCConfigVersion.cmake"
 	COMPATIBILITY AnyNewerVersion)
 install(FILES
+	"${PROJECT_SOURCE_DIR}/cmake/CMakeFindDependencyMacroPC.cmake"
+	"${PROJECT_SOURCE_DIR}/cmake/use_homebrew.cmake"
 	"${PROJECT_BINARY_DIR}/ZNCConfig.cmake"
 	"${PROJECT_BINARY_DIR}/ZNCConfigVersion.cmake"
 	DESTINATION "${CMAKE_INSTALL_DATADIR}/znc/cmake")
@@ -447,6 +471,7 @@ summary_line("Cyrus    " "${CYRUS_FOUND}")
 summary_line("Charset  " "${ICU_FOUND}")
 summary_line("Zlib     " "${ZLIB_FOUND}")
 summary_line("i18n     " "${HAVE_I18N}")
+summary_line("Argon2   " "${ZNC_HAVE_ARGON}")

 include(render_framed_multiline)
 render_framed_multiline("${summary_lines}")
@@ -1,3 +1,82 @@
+# ZNC 1.9.1 (2024-07-03)
+
+* This is a security release to fix CVE-2024-39844: remote code execution vulnerability in modtcl.
+    * To mitigate this for existing installations, simply unload the modtcl module for every user, if it's loaded. Note that only users with admin rights can load modtcl at all.
+    * Thanks to Johannes Kuhn (DasBrain) for reporting, to glguy for the patch, and to multiple IRC network operators for help with mitigating this on server side before disclosure.
+* Improve tooltips in webadmin.
+
+
+# ZNC 1.9.0 (2024-02-22)
+
+## New
+* Support for capability negotiation 302 and `cap-notify`. ZNC now has API `AddServerDependentCapability()`, using which modules can easily implement new capabilities: if server supports a cap, it will automatically be offered to clients which support `cap-notify` and ZNC will notify the module when the capability is enabled or disabled for server and for each client.
+    * Several capabilities (`away-notify`, `account-notify`, `extended-join`) were moved from the core to a new module: corecaps.
+    * The corecaps module is loaded automatically when upgrading from old config and when creating new config, but it's possible to unload it.
+        * Note: users who were using pre-release versions of 1.9.x (from git or from nightly tarballs) won't have it loaded automatically, because the existing config states `Version = 1.9`. In such case you can load it manually. This is to honor choice of users who decide to unload it, since we don't know whether the module is missing intentionally.
+    * Added support for `account-tag` capability, also in corecaps module.
+* Updated password hashing algorithm from SHA-256 to Argon2id (if libargon2 is installed). Existing passwords are transparently upgraded upon login.
+* Allow ordering of channels: via `ListChans`, `MoveChan` and `SwapChans` commands, and via webadmin.
+* New user options: `DenySetIdent`, `DenySetNetwork`, `DenySetRealName`, `DenySetQuitMsg`, `DenySetCTCPReplies`.
+* Switched `--makeconf` wizard default network from freenode to Libera.
+* Added Portuguese and Turkish translations.
+* znc-buildmod: output where the module was written to
+
+## Fixes
+* Fixed crash when receiving SASL lines from server without having negotiated SASL via CAP.
+* Fixed build with SWIG 4.2.0.
+* Fixed build with LibreSSL.
+* Fixed handling of timezones when parsing server-time tags received from server.
+* Use module names as the module ident, otherwise some clients were merging conversations with different modules together.
+* Stopped sending invalid 333 (`RPL_TOPICWHOTIME`) to client if topic owner is unknown.
+* Fixed an ODR violation.
+* Better hide password in PASS debug lines, sometimes it was not hidden.
+* CAP REQ sent by client without CAP LS now suspends the registration as the spec requires.
+
+## Modules
+* autoop: In some cases settings were parsed incorrectly, resulting in failure to do the autoop, now it's fixed.
+* clientnotify: Added options to reduce amount of notifications depending on the IP and the client ID of the connecting client.
+* controlpanel: Fixed help output.
+* log: Log nickserv account in the joins lines.
+* modperl: Allow overriding label for timers, which means now there can be more than 1 timer per module.
+* modpython:
+    * Rewrote internals of how modpython loads modules.
+    * Main motivation for the switch from using `imp` to using `importlib` was to support Python 3.12+.
+        * As an additional benefit, now it's possible to structure the module as a python package (a subdirectory with `__init__.py` and other .py files).
+        * All the old python modules should load as they were before.
+        * ZNC no longer supports loading a C python extension directly through modpython (though I doubt there were any users of that obscure feature): if you want to some parts of the module to be compiled, you can always import that from `__init__.py`.
+    * Implemented `Module.AddCommand()`
+* route_replies:
+    * Added Solanum-specific 337 (`RPL_WHOISTEXT`) to possible replies of `/whois`.
+    * Route replies to `/topic`.
+* sasl: Don't forward 908 (`RPL_SASLMECHS`) to clients.
+* webadmin: Fixed order of breadcrumbs in network page.
+* watch: Allow new entries to use spaces.
+
+## Notes for package maintainers
+* Require C++17 compiler. That is, GCC 8+ or Clang 5+.
+* Removed autoconf, leaving only CMake as the build system. The `configure` script is now merely a wrapper for CMake, and accepts mostly the same parameters as the old `configure`. You can use either `configure` as before, or CMake directly. Minimum supported CMake version is 3.13.
+* If cctz library is available on the system, it will be used, otherwise the bundled copy will be used.
+* libargon2 is new optional dependency.
+* Dropped support for Python < 3.4
+* Dropped support for SWIG < 4.0.1
+* The systemd unit now passes `--datadir=/var/lib/znc`.
+
+## Internal
+* Switched to steady clock for cache map and for sockets to fix certain issues with leap seconds and DST.
+* Made `CUser::Put...()` send to all clients instead of only networkless clients. Deprecate `CUser::PutAllUser()`.
+* Setup Github Actions to replace old Travis CI setup.
+* Added CIFuzz.
+* Added CodeQL.
+* List of translators is now automatically generated from Crowdin.
+* Modernized the way how CMake is used.
+* Updated default SSL settings from Mozilla recommendations.
+* Rewrote message parsing using `std::string_view`, improving the performance of the parser.
+* Web: removed legacy xhtml syntax.
+* Documented more functions.
+* Made some integration tests run faster by changing ServerThrottle value in the test.
+
+
+
 # ZNC 1.8.2 (2020-07-07)

 ## New
@@ -1,8 +1,8 @@
-FROM alpine:3.17
+FROM alpine:3.19

 ARG VERSION_EXTRA=""

-ARG CMAKEFLAGS="-DVERSION_EXTRA=${VERSION_EXTRA} -DCMAKE_INSTALL_PREFIX=/opt/znc -DWANT_CYRUS=YES -DWANT_PERL=YES -DWANT_PYTHON=YES"
+ARG CMAKEFLAGS="-DVERSION_EXTRA=${VERSION_EXTRA} -DCMAKE_INSTALL_PREFIX=/opt/znc -DWANT_CYRUS=YES -DWANT_PERL=YES -DWANT_PYTHON=YES -DWANT_ARGON=YES"
 ARG MAKEFLAGS=""

 LABEL org.label-schema.schema-version="1.0"
@@ -15,6 +15,7 @@ RUN set -x \
    && adduser -S znc \
    && addgroup -S znc
 RUN apk add --no-cache \
+        argon2-libs \
        boost \
        build-base \
        ca-certificates \
@@ -30,6 +31,7 @@ RUN apk add --no-cache \
        tini \
        tzdata
 RUN apk add --no-cache --virtual build-dependencies \
+        argon2-dev \
        boost-dev \
        cyrus-sasl-dev \
        perl-dev \
@@ -44,7 +46,7 @@ RUN apk add --no-cache --virtual build-dependencies \
    && cd / && rm -rf /znc-src

 COPY docker/slim/entrypoint.sh /
-COPY docker/*/??-*.sh /startup-sequence/
+COPY docker/*/??-*.sh docker/*/startup-sequence/??-*.sh /startup-sequence/

 VOLUME /znc-data

@@ -2,7 +2,8 @@

 timestamps {
  node('freebsd') {
-    // freebsd 13.1 + pkg install git openjdk17 cmake icu pkgconf swig python3 boost-libs gettext-tools qt5-buildtools qt5-network qt5-qmake
+    // AWS EC2 AMI: FreeBSD 14.1-STABLE-amd64-20241003 UEFI-PREFERRED base UFS
+    // pkg install git openjdk22 cmake icu pkgconf swig python3 boost-libs gettext-tools qt6-base libargon2
    // Then fill known_hosts with https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/githubs-ssh-key-fingerprints
    // (needed for crowdin cron job in jenkins)
    timeout(time: 30, unit: 'MINUTES') {
@@ -14,7 +15,7 @@ timestamps {
      }
      dir("$wsdir/build") {
        stage('Build') {
-          sh "cmake $wsdir -DWANT_PERL=ON -DWANT_PYTHON=ON -DCMAKE_INSTALL_PREFIX=$wsdir/build/install-prefix"
+          sh "cmake $wsdir -DWANT_PERL=ON -DWANT_PYTHON=ON -DWANT_ARGON=ON -DCMAKE_INSTALL_PREFIX=$wsdir/build/install-prefix"
          sh 'make VERBOSE=1 all'
        }
        stage('Unit test') {
@@ -16,7 +16,6 @@ ZNC includes code from jQuery UI (http://jqueryui.com/), licensed under the MIT
 ZNC includes code from Selectize (http://brianreavis.github.io/selectize.js/), licensed under the Apache License 2.0.
 ZNC includes modified code from CMakeFindFrameworks.cmake by Kitware, Inc., licensed under BSD License.
 ZNC includes modified code from TestLargeFiles.cmake, licensed under Boost Software License, Version 1.0.
-ZNC includes code from BackportCpp (https://github.com/bitwizeshift/string_view-standalone), licensed under the MIT license.
 ZNC includes code from cctz (https://github.com/google/cctz), licensed under the Apache License 2.0.

 ZNC is developed by these people:
@@ -1,4 +1,4 @@
-# [![ZNC](https://wiki.znc.in/resources/assets/wiki.png)](https://znc.in) - An advanced IRC bouncer
+# [![ZNC](logo.png)](https://znc.in) - An advanced IRC bouncer

 [![GitHub Workflow Status](https://img.shields.io/github/actions/workflow/status/znc/znc/build.yml?branch=master&label=linux)](https://github.com/znc/znc/actions/workflows/build.yml)
 [![Jenkins Build Status](https://img.shields.io/jenkins/s/https/jenkins.znc.in/job/znc/job/znc/job/master.svg?label=freebsd)](https://jenkins.znc.in/job/znc/job/znc/job/master/)
@@ -24,8 +24,8 @@ Core:

 * GNU make
 * pkg-config
-* GCC 4.8 or clang 3.2
-* CMake
+* GCC 8 or clang 5
+* CMake 3.13

 ## Optional Requirements

@@ -50,10 +50,13 @@ cyrusauth:
 Character Encodings:
 * To get proper character encoding and charsets install ICU (`libicu4-dev`)

-I18N (UI translation)
+I18N (UI translation):
 * Boost.Locale
 * gettext is a build dependency

+Argon2 password hash:
+* libargon2
+
 ## Installing ZNC

 Installation from source code is performed using the CMake toolchain.
@@ -135,7 +138,7 @@ These directories are also in there:
 - moddata - Global modules save their settings here.
  (e.g. webadmin saves the current skin name in here)
 - users   - This is per-user data and mainly contains just a moddata
-  directory.
+  directory and a directory for each network configured.

 ## ZNC's config file

@@ -2,7 +2,9 @@ These people helped translating ZNC to various languages:

 * Alcahest ([X] Alcahest)
 * Altay
+* aycanuAydemir
 * bashgeek (Daniel)
+* CaPaCuL
 * casmo (Casper)
 * ChaosEngine (Andrzej Pauli)
 * cirinho (Ciro Moniz)
@@ -21,6 +23,7 @@ These people helped translating ZNC to various languages:
 * leon-th (Leon T.)
 * LiteHell
 * lorenzosu
+* M0onshadow (Maelan)
 * MikkelDK
 * mkgeeky (mkgeeky)
 * moonlightzzz (moonlightz)
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+# Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -14,6 +14,11 @@
 # limitations under the License.
 #

+include(CMakeFindDependencyMacro)
+include("${CMAKE_CURRENT_LIST_DIR}/CMakeFindDependencyMacroPC.cmake")
+include("${CMAKE_CURRENT_LIST_DIR}/use_homebrew.cmake")
+@ZNC_CMAKE_FIND_DEPS@
+
 include("${CMAKE_CURRENT_LIST_DIR}/znc_internal.cmake")
 include("${CMAKE_CURRENT_LIST_DIR}/znc_public.cmake")
 include(CMakeParseArguments)
@@ -0,0 +1,101 @@
+# This is directly based on CMake's CMakeFindDependencyMacro from 3.26.5, the only change is that it uses pkg_check_modules instead of find_package
+
+# Distributed under the OSI-approved BSD 3-Clause License.  See accompanying
+# file Copyright.txt or https://cmake.org/licensing for details.
+
+#[=======================================================================[.rst:
+CMakeFindDependencyMacro
+------------------------
+
+.. command:: find_dependency
+
+  The ``find_dependency()`` macro wraps a :command:`find_package` call for
+  a package dependency::
+
+    find_dependency(<dep> [...])
+
+  It is designed to be used in a
+  :ref:`Package Configuration File <Config File Packages>`
+  (``<PackageName>Config.cmake``).  ``find_dependency`` forwards the correct
+  parameters for ``QUIET`` and ``REQUIRED`` which were passed to
+  the original :command:`find_package` call.  Any additional arguments
+  specified are forwarded to :command:`find_package`.
+
+  If the dependency could not be found it sets an informative diagnostic
+  message and calls :command:`return` to end processing of the calling
+  package configuration file and return to the :command:`find_package`
+  command that loaded it.
+
+  .. note::
+
+    The call to :command:`return` makes this macro unsuitable to call
+    from :ref:`Find Modules`.
+
+Package Dependency Search Optimizations
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+If ``find_dependency`` is called with arguments identical to a previous
+call in the same directory, perhaps due to diamond-shaped package
+dependencies, the underlying call to :command:`find_package` is optimized
+out.  This optimization is important to support large package dependency
+graphs while avoiding a combinatorial explosion of repeated searches.
+However, the heuristic cannot account for ambient variables that
+affect package behavior, such as ``<PackageName>_USE_STATIC_LIBS``,
+offered by some packages.  Therefore package configuration files should
+avoid setting such variables before their calls to ``find_dependency``.
+
+.. versionchanged:: 3.15
+  Previously, the underlying call to :command:`find_package` was always
+  optimized out if the package had already been found.  CMake 3.15
+  removed the optimization to support cases in which ``find_dependency``
+  call arguments request different components.
+
+.. versionchanged:: 3.26
+  The pre-3.15 optimization was restored, but with the above-described
+  heuristic to account for varying ``find_dependency`` call arguments.
+
+#]=======================================================================]
+
+macro(find_dependency_pc dep)
+find_dependency(PkgConfig)
+  string(SHA256 cmake_fd_call_hash "${dep};${ARGN};${${CMAKE_FIND_PACKAGE_NAME}_FIND_REQUIRED}")
+  if(_CMAKE_${dep}_${cmake_fd_call_hash}_FOUND)
+    unset(cmake_fd_call_hash)
+  else()
+    list(APPEND _CMAKE_${dep}_HASH_STACK ${cmake_fd_call_hash})
+    set(cmake_fd_quiet_arg)
+    if(${CMAKE_FIND_PACKAGE_NAME}_FIND_QUIETLY)
+      set(cmake_fd_quiet_arg QUIET)
+    endif()
+    set(cmake_fd_required_arg)
+    if(${CMAKE_FIND_PACKAGE_NAME}_FIND_REQUIRED)
+      set(cmake_fd_required_arg REQUIRED)
+    endif()
+
+    get_property(cmake_fd_alreadyTransitive GLOBAL PROPERTY
+      _CMAKE_${dep}_TRANSITIVE_DEPENDENCY
+      )
+
+    pkg_check_modules(${dep}
+      ${cmake_fd_quiet_arg}
+      ${cmake_fd_required_arg}
+      IMPORTED_TARGET ${ARGN}
+      )
+    list(POP_BACK _CMAKE_${dep}_HASH_STACK cmake_fd_call_hash)
+    set("_CMAKE_${dep}_${cmake_fd_call_hash}_FOUND" "${${dep}_FOUND}")
+
+    if(NOT DEFINED cmake_fd_alreadyTransitive OR cmake_fd_alreadyTransitive)
+      set_property(GLOBAL PROPERTY _CMAKE_${dep}_TRANSITIVE_DEPENDENCY TRUE)
+    endif()
+
+    unset(cmake_fd_alreadyTransitive)
+    unset(cmake_fd_call_hash)
+    unset(cmake_fd_quiet_arg)
+    unset(cmake_fd_required_arg)
+    if (NOT ${dep}_FOUND)
+      set(${CMAKE_FIND_PACKAGE_NAME}_NOT_FOUND_MESSAGE "${CMAKE_FIND_PACKAGE_NAME} could not be found because dependency ${dep} could not be found.")
+      set(${CMAKE_FIND_PACKAGE_NAME}_FOUND False)
+      return()
+    endif()
+  endif()
+endmacro()
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+# Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+# Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -14,26 +14,26 @@
 # limitations under the License.
 #

-if(NOT DEFINED cxx11check)
-	message(STATUS "Checking for C++11 support")
-	get_filename_component(_CXX11Check_dir "${CMAKE_CURRENT_LIST_FILE}"
+if(NOT DEFINED cxx17check)
+	message(STATUS "Checking for C++17 support")
+	get_filename_component(_CXX17Check_dir "${CMAKE_CURRENT_LIST_FILE}"
 		DIRECTORY)
-	try_compile(cxx11_supported
-		"${CMAKE_CURRENT_BINARY_DIR}${CMAKE_FILES_DIRECTORY}/cxx11check"
-		"${_CXX11Check_dir}/cxx11check" cxx11check
-		OUTPUT_VARIABLE _CXX11Check_tryout)
-	if(cxx11_supported)
-		message(STATUS "Checking for C++11 support - supported")
-		SET(cxx11check 1 CACHE INTERNAL "C++11 support")
+	try_compile(cxx17_supported
+		"${CMAKE_CURRENT_BINARY_DIR}${CMAKE_FILES_DIRECTORY}/cxx17check"
+		"${_CXX17Check_dir}/cxx17check" cxx17check
+		OUTPUT_VARIABLE _CXX17Check_tryout)
+	if(cxx17_supported)
+		message(STATUS "Checking for C++17 support - supported")
+		SET(cxx17check 1 CACHE INTERNAL "C++17 support")
 		file(APPEND
 			"${CMAKE_BINARY_DIR}${CMAKE_FILES_DIRECTORY}/CMakeOutput.log"
-			"Output of C++11 check:\n${_CXX11Check_tryout}\n")
+			"Output of C++17 check:\n${_CXX17Check_tryout}\n")
 	else()
 		file(APPEND
 			"${CMAKE_BINARY_DIR}${CMAKE_FILES_DIRECTORY}/CMakeError.log"
-			"Error in C++11 check:\n${_CXX11Check_tryout}\n")
-		message(STATUS "Checking for C++11 support - not supported")
+			"Error in C++17 check:\n${_CXX17Check_tryout}\n")
+		message(STATUS "Checking for C++17 support - not supported")
 		message(FATAL_ERROR " Upgrade your compiler.\n"
-			" GCC 4.8+ and Clang 3.2+ are known to work.")
+			" GCC 8+ and Clang 5+ should work.")
 	endif()
 endif()
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+# Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+# Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+# Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -14,10 +14,10 @@
 # limitations under the License.
 #

-cmake_minimum_required(VERSION 3.0)
+cmake_minimum_required(VERSION 3.13)
 project(cxx11check LANGUAGES CXX)
 set(CMAKE_VERBOSE_MAKEFILE true)

-set(CMAKE_CXX_STANDARD 11)
+set(CMAKE_CXX_STANDARD 17)
 set(CMAKE_CXX_STANDARD_REQUIRED true)
 add_executable(main main.cpp)
@@ -11,6 +11,7 @@
 // warranty.

 #include <map>
+#include <string_view>

 template <typename T>
 struct check {
@@ -59,5 +60,6 @@ void test() { func<foo>(0); }
 int main() {
    std::map<int, int> m;
    m.emplace(2, 4);
+    auto [x, y] = *m.begin();
    return 0;
 }
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+# Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+# Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -14,7 +14,7 @@
 # limitations under the License.
 #

-cmake_minimum_required(VERSION 3.0)
+cmake_minimum_required(VERSION 3.13)
 project(perl_check LANGUAGES CXX)
 set(CMAKE_VERBOSE_MAKEFILE true)

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+# Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+# Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+# Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+# Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -54,12 +54,17 @@ if(brew_python_f EQUAL 0)
 		"${brew_python}/Frameworks/Python.framework")
 endif()

-execute_process(COMMAND "${brew}" --prefix qt5
-	RESULT_VARIABLE brew_qt5_f
-	OUTPUT_VARIABLE brew_qt5 OUTPUT_STRIP_TRAILING_WHITESPACE ERROR_QUIET)
-if(brew_qt5_f EQUAL 0)
-	find_package_message(brew_qt5 "Qt5 via Homebrew: ${brew_qt5}"
-		"${brew_qt5}")
+if(DEFINED ENV{ZNC_QT_VER})
+	set(ZNC_QT_VER $ENV{ZNC_QT_VER})
+else()
+	set(ZNC_QT_VER 6)
+endif()
+execute_process(COMMAND "${brew}" --prefix qt${ZNC_QT_VER}
+	RESULT_VARIABLE brew_qt_f
+	OUTPUT_VARIABLE brew_qt OUTPUT_STRIP_TRAILING_WHITESPACE ERROR_QUIET)
+if(brew_qt_f EQUAL 0)
+	find_package_message(brew_qt "Qt via Homebrew: ${brew_qt}"
+		"${brew_qt}")
 endif()

 execute_process(COMMAND "${brew}" --prefix gettext
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+# Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -27,6 +27,7 @@ exec echo "Either install python, or use cmake directly"

 import argparse
 import os
+import shutil
 import subprocess
 import sys
 import re
@@ -83,6 +84,7 @@ tristate('cyrus')
 tristate('charset', 'ICU')
 tristate('tcl')
 tristate('i18n')
+tristate('argon')

 class HandlePython(argparse.Action):
    def __call__(self, parser, namespace, values, option_string=None):
@@ -116,6 +118,11 @@ parser.add_argument('env', nargs='*', type=env_type, metavar='ENV_VAR=VALUE')

 args = parser.parse_args()

+if not shutil.which('cmake'):
+    print('CMake is required to proceed. Please install it via package manager,\n'
+          'or download the binary from https://cmake.org/')
+    sys.exit(1)
+
 cm_args = args.cm_args or []

 for env_key, env_value in args.env:
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+# Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+# Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -98,83 +98,7 @@ class CClientAuth : public CAuthBase {

 class CClient : public CIRCSocket {
  public:
-    CClient()
-        : CIRCSocket(),
-          m_bGotPass(false),
-          m_bGotNick(false),
-          m_bGotUser(false),
-          m_bInCap(false),
-          m_bCapNotify(false),
-          m_bAwayNotify(false),
-          m_bAccountNotify(false),
-          m_bAccountTag(false),
-          m_bExtendedJoin(false),
-          m_bNamesx(false),
-          m_bUHNames(false),
-          m_bAway(false),
-          m_bServerTime(false),
-          m_bBatch(false),
-          m_bEchoMessage(false),
-          m_bSelfMessage(false),
-          m_bSASL(false),
-          m_bSASLAuthenticating(false),
-          m_bPlaybackActive(false),
-          m_pUser(nullptr),
-          m_pNetwork(nullptr),
-          m_sNick("unknown-nick"),
-          m_sPass(""),
-          m_sUser(""),
-          m_sNetwork(""),
-          m_sIdentifier(""),
-          m_sSASLBuffer(""),
-          m_sSASLMechanism(""),
-          m_sSASLUser(""),
-          m_spAuth(),
-          m_ssAcceptedCaps(),
-          m_ssSupportedTags(),
-          m_mCoreCaps({
-              {"multi-prefix",
-               {false, [this](bool bVal) { m_bNamesx = bVal; }}},
-              {"userhost-in-names",
-               {false, [this](bool bVal) { m_bUHNames = bVal; }}},
-              {"echo-message",
-               {false, [this](bool bVal) { m_bEchoMessage = bVal; }}},
-              {"server-time",
-               {false, [this](bool bVal) {
-                m_bServerTime = bVal;
-                SetTagSupport("time", bVal);
-               }}},
-              {"batch", {false, [this](bool bVal) {
-                m_bBatch = bVal;
-                SetTagSupport("batch", bVal);
-              }}},
-              {"cap-notify",
-               {false, [this](bool bVal) { m_bCapNotify = bVal; }}},
-              {"away-notify",
-               {true, [this](bool bVal) { m_bAwayNotify = bVal; }}},
-              {"account-notify",
-               {true, [this](bool bVal) { m_bAccountNotify = bVal; }}},
-              {"account-tag",
-               {true, [this](bool bVal) {
-                m_bAccountTag = bVal;
-                SetTagSupport("account", bVal);
-               }}},
-              {"extended-join",
-               {true, [this](bool bVal) { m_bExtendedJoin = bVal; }}},
-              {"sasl", {false, [this](bool bVal) { m_bSASL = bVal; m_bSASLAuthenticating = bVal; }}},
-          }) {
-        EnableReadLine();
-        // RFC says a line can have 512 chars max, but we are
-        // a little more gentle ;)
-        SetMaxBufferThreshold(1024);
-
-        // For compatibility with older clients
-        m_mCoreCaps["znc.in/server-time-iso"] = m_mCoreCaps["server-time"];
-        m_mCoreCaps["znc.in/batch"] = m_mCoreCaps["batch"];
-        m_mCoreCaps["znc.in/self-message"] = {
-            false, [this](bool bVal) { m_bSelfMessage = bVal; }};
-    }
-
+    CClient();
    virtual ~CClient();

    CClient(const CClient&) = delete;
@@ -187,13 +111,15 @@ class CClient : public CIRCSocket {
    CString GetNick(bool bAllowIRCNick = true) const;
    CString GetNickMask() const;
    CString GetIdentifier() const { return m_sIdentifier; }
+    unsigned short int CapVersion() const { return m_uCapVersion; }
+    bool HasCap302() const { return CapVersion() >= 302; }
    bool HasCapNotify() const { return m_bCapNotify; }
    bool HasAwayNotify() const { return m_bAwayNotify; }
    bool HasAccountNotify() const { return m_bAccountNotify; }
-    bool HasAccountTag() const { return m_bAccountTag; }
    bool HasExtendedJoin() const { return m_bExtendedJoin; }
    bool HasNamesx() const { return m_bNamesx; }
    bool HasUHNames() const { return m_bUHNames; }
+    bool HasChgHost() const { return m_bChgHost; }
    bool IsAway() const { return m_bAway; }
    bool HasServerTime() const { return m_bServerTime; }
    bool HasBatch() const { return m_bBatch; }
@@ -299,8 +225,9 @@ class CClient : public CIRCSocket {
     */
    void SetTagSupport(const CString& sTag, bool bState);

-    void NotifyServerDependentCaps(const SCString& ssCaps);
-    void ClearServerDependentCaps();
+    /** Notifies client about one specific cap which server has just notified us about.
+     */
+    void NotifyServerDependentCap(const CString& sCap, bool bValue, const CString& sValue);

    void ReadLine(const CString& sData) override;
    bool SendMotd();
@@ -364,14 +291,15 @@ class CClient : public CIRCSocket {
    bool m_bGotPass;
    bool m_bGotNick;
    bool m_bGotUser;
+    unsigned short int m_uCapVersion;
    bool m_bInCap;
    bool m_bCapNotify;
    bool m_bAwayNotify;
    bool m_bAccountNotify;
-    bool m_bAccountTag;
    bool m_bExtendedJoin;
    bool m_bNamesx;
    bool m_bUHNames;
+    bool m_bChgHost;
    bool m_bAway;
    bool m_bServerTime;
    bool m_bBatch;
@@ -393,16 +321,14 @@ class CClient : public CIRCSocket {
    std::shared_ptr<CAuthBase> m_spAuth;
    SCString m_ssAcceptedCaps;
    SCString m_ssSupportedTags;
-    // The capabilities supported by the ZNC core - capability names mapped
-    // to a pair which contains a bool describing whether the capability is
-    // server-dependent, and a capability value change handler.
-    std::map<CString, std::pair<bool, std::function<void(bool bVal)>>>
-        m_mCoreCaps;
-    // A subset of CIRCSock::GetAcceptedCaps(), the caps that can be listed
-    // in CAP LS and may be notified to the client with CAP NEW (cap-notify).
-    SCString m_ssServerDependentCaps;
+    // The capabilities supported by the ZNC core - capability names mapped to
+    // change handler. Note: this lists caps which don't require support on IRC
+    // server.
+    static const std::map<CString, std::function<void(CClient*, bool bVal)>>&
+    CoreCaps();

    friend class ClientTest;
+    friend class CCoreCaps;
 };

 #endif  // !ZNC_CLIENT_H
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -156,6 +156,8 @@ class CIRCNetwork : private CCoreTranslationMixin {
    void IRCConnected();
    void IRCDisconnected();
    void CheckIRCConnect();
+    void NotifyClientsAboutServerDependentCap(const CString& sCap, bool bValue);
+    bool IsServerCapAccepted(const CString& sCap) const;

    bool PutIRC(const CString& sLine);
    bool PutIRC(const CMessage& Message);
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -131,6 +131,7 @@ class CIRCSock : public CIRCSocket {
    unsigned int GetMaxNickLen() const { return m_uMaxNickLen; }
    EChanModeArgs GetModeType(char cMode) const;
    char GetPermFromMode(char cMode) const;
+    char GetModeFromPerm(char cPerm) const;
    const std::map<char, EChanModeArgs>& GetChanModes() const {
        return m_mceChanModes;
    }
@@ -150,7 +151,6 @@ class CIRCSock : public CIRCSocket {
    bool HasUHNames() const { return m_bUHNames; }
    bool HasAwayNotify() const { return m_bAwayNotify; }
    bool HasAccountNotify() const { return m_bAccountNotify; }
-    bool HasAccountTag() const { return m_bAccountTag; }
    bool HasExtendedJoin() const { return m_bExtendedJoin; }
    bool HasServerTime() const { return m_bServerTime; }
    const std::set<char>& GetUserModes() const {
@@ -162,6 +162,8 @@ class CIRCSock : public CIRCSocket {
    bool IsCapAccepted(const CString& sCap) {
        return 1 == m_ssAcceptedCaps.count(sCap);
    }
+    CString GetCapLsValue(const CString& sKey,
+                          const CString& sDefault = "") const;
    const MCString& GetISupport() const { return m_mISupport; }
    CString GetISupport(const CString& sKey,
                        const CString& sDefault = "") const;
@@ -176,6 +178,7 @@ class CIRCSock : public CIRCSocket {
    bool OnActionMessage(CActionMessage& Message);
    bool OnAwayMessage(CMessage& Message);
    bool OnCapabilityMessage(CMessage& Message);
+    bool OnChgHostMessage(CChgHostMessage& Message);
    bool OnCTCPMessage(CCTCPMessage& Message);
    bool OnErrorMessage(CMessage& Message);
    bool OnInviteMessage(CMessage& Message);
@@ -192,7 +195,7 @@ class CIRCSock : public CIRCSocket {
    bool OnTextMessage(CTextMessage& Message);
    bool OnTopicMessage(CTopicMessage& Message);
    bool OnWallopsMessage(CMessage& Message);
-    bool OnServerCapAvailable(const CString& sCap);
+    bool OnServerCapAvailable(const CString& sCap, const CString& sValue);
    // !Message Handlers

    void SetNick(const CString& sNick);
@@ -208,7 +211,6 @@ class CIRCSock : public CIRCSocket {
    bool m_bUHNames;
    bool m_bAwayNotify;
    bool m_bAccountNotify;
-    bool m_bAccountTag;
    bool m_bExtendedJoin;
    bool m_bServerTime;
    CString m_sPerms;
@@ -223,6 +225,7 @@ class CIRCSock : public CIRCSocket {
    unsigned int m_uCapPaused;
    SCString m_ssAcceptedCaps;
    SCString m_ssPendingCaps;
+    MCString m_msCapLsValues;
    time_t m_lastCTCP;
    unsigned int m_uNumCTCP;
    static const time_t m_uCTCPFloodTime;
@@ -237,6 +240,7 @@ class CIRCSock : public CIRCSocket {
    VCString m_vsSSLError;

    friend class CIRCFloodTimer;
+    friend class CCoreCaps;
 };

 #endif  // !ZNC_IRCSOCK_H
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -17,19 +17,6 @@
 #ifndef ZNC_MESSAGE_H
 #define ZNC_MESSAGE_H

-// Remove this after Feb 2016 when Debian 7 is EOL
-#if __cpp_ref_qualifiers >= 200710
-#define ZNC_LVREFQUAL &
-#elif defined(__clang__)
-#define ZNC_LVREFQUAL &
-#elif __GNUC__ > 4 ||                       \
-    __GNUC__ == 4 && (__GNUC_MINOR__ > 8 || \
-                      __GNUC_MINOR__ == 8 && __GNUC_PATCHLEVEL__ >= 1)
-#define ZNC_LVREFQUAL &
-#else
-#define ZNC_LVREFQUAL
-#endif
-
 #ifdef SWIG
 #define ZNC_MSG_DEPRECATED(msg)
 #else
@@ -81,6 +68,7 @@ class CMessage {
        Authenticate,
        Away,
        Capability,
+        ChgHost,
        CTCP,
        Error,
        Invite,
@@ -135,6 +123,7 @@ class CMessage {
     */
    VCString GetParamsSplit(unsigned int uIdx, unsigned int uLen = -1) const;
    void SetParams(const VCString& vsParams);
+    void SetParams(VCString&& vsParams);

    /// @deprecated use GetParamsColon() instead.
    CString GetParams(unsigned int uIdx, unsigned int uLen = -1) const
@@ -167,7 +156,7 @@ class CMessage {
 // Implicit and explicit conversion to a subclass reference.
 #ifndef SWIG
    template <typename M>
-    M& As() ZNC_LVREFQUAL {
+    M& As() & {
        static_assert(std::is_base_of<CMessage, M>{},
                      "Must be subclass of CMessage");
        static_assert(sizeof(M) == sizeof(CMessage),
@@ -176,7 +165,7 @@ class CMessage {
    }

    template <typename M>
-    const M& As() const ZNC_LVREFQUAL {
+    const M& As() const& {
        static_assert(std::is_base_of<CMessage, M>{},
                      "Must be subclass of CMessage");
        static_assert(sizeof(M) == sizeof(CMessage),
@@ -186,12 +175,12 @@ class CMessage {

    template <typename M, typename = typename std::enable_if<
                              std::is_base_of<CMessage, M>{}>::type>
-    operator M&() ZNC_LVREFQUAL {
+    operator M&() & {
        return As<M>();
    }
    template <typename M, typename = typename std::enable_if<
                              std::is_base_of<CMessage, M>{}>::type>
-    operator const M&() const ZNC_LVREFQUAL {
+    operator const M&() const& {
        return As<M>();
    }
 // REGISTER_ZNC_MESSAGE allows SWIG to instantiate correct .As<> calls.
@@ -354,4 +343,13 @@ class CTopicMessage : public CTargetMessage {
 };
 REGISTER_ZNC_MESSAGE(CTopicMessage);

+class CChgHostMessage : public CMessage {
+  public:
+    CString GetNewIdent() const { return GetParam(0); }
+    void SetNewIdent(const CString& sIdent) { SetParam(0, sIdent); }
+    CString GetNewHost() const { return GetParam(1); }
+    void SetNewHost(const CString& sHost) { SetParam(1, sHost); }
+};
+REGISTER_ZNC_MESSAGE(CChgHostMessage);
+
 #endif  // !ZNC_MESSAGE_H
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -25,6 +25,7 @@
 #include <znc/main.h>
 #include <znc/Translation.h>
 #include <functional>
+#include <memory>
 #include <set>
 #include <queue>
 #include <sys/time.h>
@@ -166,6 +167,19 @@ class CFPTimer;
 class CSockManager;
 // !Forward Declarations

+class CCapability {
+  public:
+    virtual ~CCapability() = default;
+    virtual void OnServerChangedSupport(CIRCNetwork* pNetwork, bool bState) {}
+    virtual void OnClientChangedSupport(CClient* pClient, bool bState) {}
+
+    CModule* GetModule() { return m_pModule; }
+    void SetModule(CModule* p) { m_pModule = p; }
+
+  protected:
+    CModule* m_pModule = nullptr;
+};
+
 class CTimer : public CCron {
  public:
    CTimer(CModule* pModule, unsigned int uInterval, unsigned int uCycles,
@@ -998,13 +1012,28 @@ class CModule {
    virtual EModRet OnTopic(CNick& Nick, CChan& Channel, CString& sTopic);

    /** Called for every CAP received via CAP LS from server.
+     *  If you need to also advertise the cap to clients, use
+     *  AddServerDependentCapability() instead.
     *  @param sCap capability supported by server.
     *  @return true if your module supports this CAP and
     *          needs to turn it on with CAP REQ.
     */
    virtual bool OnServerCapAvailable(const CString& sCap);
+    /** Called for every CAP received via CAP LS from server.
+     *  By default just calls OnServerCapAvailable() without sValue, so
+     *  overriding one of the two is enough.
+     *  If you need to also advertise the cap to clients, use
+     *  AddServerDependentCapability() instead.
+     *  @param sCap capability name supported by server.
+     *  @param sValue value.
+     *  @return true if your module supports this CAP and
+     *          needs to turn it on with CAP REQ.
+     */
+    virtual bool OnServerCap302Available(const CString& sCap, const CString& sValue);
    /** Called for every CAP accepted or rejected by server
     *  (with CAP ACK or CAP NAK after our CAP REQ).
+     *  If you need to also advertise the cap to clients, use
+     *  AddServerDependentCapability() instead.
     *  @param sCap capability accepted/rejected by server.
     *  @param bSuccess true if capability was accepted, false if rejected.
     */
@@ -1283,8 +1312,32 @@ class CModule {
    virtual EModRet OnUnknownUserRaw(CClient* pClient, CString& sLine);
    virtual EModRet OnUnknownUserRawMessage(CMessage& Message);

+    /** Called after login, and also during JumpNetwork. */
+    virtual void OnClientAttached();
+    /** Called upon disconnect, and also during JumpNetwork. */
+    virtual void OnClientDetached();
+
+#ifndef SWIG
+    /** Simple API to support client capabilities which depend on server to support that capability.
+     *  It is built on top of other CAP related API, but removes boilerplate,
+     *  and handles some tricky cases related to cap-notify and JumpNetwork. To
+     *  use, create a subclass of CCapability, and pass to this function; it
+     *  will automatically set the module pointer, then call the callbacks to
+     *  notify you when server and client accepted support of the capability, or
+     *  stopped supporting it. Note that it's not a strict toggle: e.g.
+     *  sometimes client will disable the cap even when it was already disabled
+     *  for that client.
+     *  For perl and python modules, this function accepts 3 parameters:
+     *  name, server callback, client callback; signatures of the callbacks are
+     *  the same as of the virtual functions you'd implement in C++.
+     */
+    void AddServerDependentCapability(const CString& sName, std::unique_ptr<CCapability> pCap);
+#endif
+
    /** Called when a client told us CAP LS. Use ssCaps.insert("cap-name")
     *  for announcing capabilities which your module supports.
+     *  If you need to adverite the cap to clients only when it's also supported
+     *  by the server, use AddServerDependentCapability() instead.
     *  @param pClient The client which requested the list.
     *  @param ssCaps set of caps which will be sent to client.
     */
@@ -1298,6 +1351,8 @@ class CModule {
    virtual bool IsClientCapSupported(CClient* pClient, const CString& sCap,
                                      bool bState);
    /** Called when we actually need to turn a capability on or off for a client.
+     *  If you need to adverite the cap to clients only when it's also supported
+     *  by the server, use AddServerDependentCapability() instead.
     *  If implementing a custom capability, make sure to call
     *  pClient->SetTagSupport("tag-name", bState) for each tag that the
     *  capability provides.
@@ -1388,6 +1443,26 @@ class CModule {
                            const CString& sContext = "") const;
 #endif

+    // Default implementations of several callbacks to make
+    // AddServerDependentCapability work in modpython/modperl.
+    // Don't worry about existence of these functions.
+    bool InternalServerDependentCapsOnServerCap302Available(
+        const CString& sCap, const CString& sValue);
+    void InternalServerDependentCapsOnServerCapResult(const CString& sCap,
+                                                      bool bSuccess);
+    void InternalServerDependentCapsOnClientCapLs(CClient* pClient,
+                                                  SCString& ssCaps);
+    bool InternalServerDependentCapsIsClientCapSupported(CClient* pClient,
+                                                         const CString& sCap,
+                                                         bool bState);
+    void InternalServerDependentCapsOnClientCapRequest(CClient* pClient,
+                                                       const CString& sCap,
+                                                       bool bState);
+    void InternalServerDependentCapsOnClientAttached();
+    void InternalServerDependentCapsOnClientDetached();
+    void InternalServerDependentCapsOnIRCConnected();
+    void InternalServerDependentCapsOnIRCDisconnected();
+
  protected:
    CModInfo::EModuleType m_eType;
    CString m_sDescription;
@@ -1407,6 +1482,7 @@ class CModule {
    CString m_sArgs;
    CString m_sModPath;
    CTranslationDomainRefHolder m_Translation;
+    std::map<CString, std::unique_ptr<CCapability>> m_mServerDependentCaps;

  private:
    MCString
@@ -1570,8 +1646,10 @@ class CModules : public std::vector<CModule*>, private CCoreTranslationMixin {
    bool OnSendToClientMessage(CMessage& Message);
    bool OnSendToIRC(CString& sLine);
    bool OnSendToIRCMessage(CMessage& Message);
+    bool OnClientAttached();
+    bool OnClientDetached();

-    bool OnServerCapAvailable(const CString& sCap);
+    bool OnServerCapAvailable(const CString& sCap, const CString& sValue);
    bool OnServerCapResult(const CString& sCap, bool bSuccess);

    CModule* FindModule(const CString& sModule) const;
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -19,6 +19,7 @@

 #include <znc/ZNCString.h>
 #include <unordered_map>
+#include <variant>

 struct CTranslationInfo {
    static std::map<CString, CTranslationInfo> GetTranslations();
@@ -83,20 +84,18 @@ class CDelayedTranslation {

 class COptionalTranslation {
  public:
-    COptionalTranslation(const CString& sText)
-        : m_bTranslating(false), m_sText(sText) {}
+    COptionalTranslation(const CString& sText) : m_text(sText) {}
    COptionalTranslation(const char* s) : COptionalTranslation(CString(s)) {}
-    COptionalTranslation(const CDelayedTranslation& dTranslation)
-        : m_bTranslating(true), m_dTranslation(dTranslation) {}
+    COptionalTranslation(const CDelayedTranslation& dTranslation) : m_text(dTranslation) {}
    CString Resolve() const {
-        return m_bTranslating ? m_dTranslation.Resolve() : m_sText;
+        if (m_text.index() == 0) {
+            return std::get<0>(m_text);
+        }
+        return std::get<1>(m_text).Resolve();
    }

  private:
-    bool m_bTranslating;
-    // TODO switch to std::variant<CString, CDelayedTranslation> after C++17
-    CString m_sText;
-    CDelayedTranslation m_dTranslation;
+    std::variant<CString, CDelayedTranslation> m_text;
 };

 // Used by everything except modules.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -45,24 +45,27 @@ class CUser : private CCoreTranslationMixin {

    bool ParseConfig(CConfig* Config, CString& sError);

-    // TODO refactor this
    enum eHashType {
        HASH_NONE,
        HASH_MD5,
        HASH_SHA256,
+        HASH_ARGON2ID,

-        HASH_DEFAULT = HASH_SHA256
+        // This should be kept in sync with CUtils::SaltedHash
+#if ZNC_HAVE_ARGON
+        HASH_DEFAULT = HASH_ARGON2ID,
+#else
+        HASH_DEFAULT = HASH_SHA256,
+#endif
    };

-    // If you change the default hash here and in HASH_DEFAULT,
-    // don't forget CUtils::sDefaultHash!
-    // TODO refactor this
    static CString SaltedHash(const CString& sPass, const CString& sSalt) {
-        return CUtils::SaltedSHA256Hash(sPass, sSalt);
+        return CUtils::SaltedHash(sPass, sSalt);
    }

    CConfig ToConfig() const;
-    bool CheckPass(const CString& sPass) const;
+    /** Checks password, may upgrade the hash method. */
+    bool CheckPass(const CString& sPass);
    bool AddAllowedHost(const CString& sHostMask);
    bool RemAllowedHost(const CString& sHostMask);
    void ClearAllowedHosts();
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -51,15 +51,16 @@ class CUtils {
    static void PrintAction(const CString& sMessage);
    static void PrintStatus(bool bSuccess, const CString& sMessage = "");

-#ifndef SWIGPERL
-    // TODO refactor this
-    static const CString sDefaultHash;
-#endif
+	/** Asks password from stdin, with confirmation.
+	 *
+	 * @returns Piece of znc.conf with <Pass> block
+	 * */
+    static CString AskSaltedHashPassForConfig();

-    static CString GetSaltedHashPass(CString& sSalt);
    static CString GetSalt();
    static CString SaltedMD5Hash(const CString& sPass, const CString& sSalt);
    static CString SaltedSHA256Hash(const CString& sPass, const CString& sSalt);
+    static CString SaltedHash(const CString& sPass, const CString& sSalt);
    static CString GetPass(const CString& sPrompt);
    static bool GetInput(const CString& sPrompt, CString& sRet,
                         const CString& sDefault = "",
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
-Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -57,9 +57,16 @@ extern const char* ZNC_VERSION_EXTRA;
 #define ZNC_VERSION_TEXT_I18N "no"
 #endif

+// This is only here because HASH_DEFAULT has different value
+#ifdef ZNC_HAVE_ARGON
+#define ZNC_VERSION_TEXT_ARGON "yes"
+#else
+#define ZNC_VERSION_TEXT_ARGON "no"
+#endif
+
 #define ZNC_COMPILE_OPTIONS_STRING                                    \
    "IPv6: " ZNC_VERSION_TEXT_IPV6 ", SSL: " ZNC_VERSION_TEXT_SSL     \
    ", DNS: " ZNC_VERSION_TEXT_DNS ", charset: " ZNC_VERSION_TEXT_ICU \
-    ", i18n: " ZNC_VERSION_TEXT_I18N
+    ", i18n: " ZNC_VERSION_TEXT_I18N ", Argon2: " ZNC_VERSION_TEXT_ARGON

 #endif  // !ZNC_VERSION_H
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -35,6 +35,7 @@
 #cmakedefine HAVE_IPV6 1
 #cmakedefine HAVE_ZLIB 1
 #cmakedefine HAVE_I18N 1
+#cmakedefine ZNC_HAVE_ARGON 1
 #cmakedefine CSOCK_USE_POLL 1

 #cmakedefine HAVE_GETOPT_LONG 1
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+# Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -37,11 +37,7 @@ function(add_cxx_module mod modpath)
 	if(moddepend_${mod})
 		add_dependencies("module_${mod}" ${moddepend_${mod}})
 	endif()
-	# ${znclib_LIB_DEPENDS} is to overcome OSX's need for -undefined suppress
-	# when accessing symbols exported by dependencies of znclib (e.g.
-	# openssl), but not used in znclib itself
-	target_link_libraries("module_${mod}" PRIVATE ZNC ${modlink_${mod}}
-		${znclib_LIB_DEPENDS})
+	target_link_libraries("module_${mod}" PRIVATE ZNC ${modlink_${mod}})
 	set_target_properties("module_${mod}" PROPERTIES "" "" ${modprop_${mod}})
 	install(TARGETS "module_${mod}"
 		LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}/znc")
@@ -54,8 +50,7 @@ function(add_python_module mod modpath)
 endfunction()

 if(CYRUS_FOUND)
-	set(modcompile_cyrusauth PRIVATE ${CYRUS_CFLAGS})
-	set(modlink_cyrusauth ${CYRUS_LDFLAGS})
+	set(modlink_cyrusauth PkgConfig::CYRUS)
 else()
 	set(moddisable_cyrusauth true)
 endif()
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 * Copyright (C) 2008 Michael "Svedrin" Ziegler diese-addy@funzt-halt.net
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 * Author: imaginos <imaginos@imaginos.net>
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 * Copyright (C) 2008 by Stefan Rado
 * based on admin.cpp by Sebastian Ramacher
 * based on admin.cpp in crox branch
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <znc/Client.h>
+#include <znc/IRCNetwork.h>
+#include <znc/IRCSock.h>
+#include <znc/Modules.h>
+
+#include <memory>
+
+class CCoreCaps : public CModule {
+    // Note: for historical reasons CClient and CIRCSock have such fields, but
+    // really they should not.
+    // TODO: move these fields and their handling from core to this module.
+    class AwayNotify : public CCapability {
+        void OnServerChangedSupport(CIRCNetwork* pNetwork,
+                                    bool bState) override {
+            pNetwork->GetIRCSock()->m_bAwayNotify = bState;
+        }
+        void OnClientChangedSupport(CClient* pClient, bool bState) override {
+            pClient->m_bAwayNotify = bState;
+        }
+    };
+
+    class AccountNotify : public CCapability {
+        void OnServerChangedSupport(CIRCNetwork* pNetwork,
+                                    bool bState) override {
+            pNetwork->GetIRCSock()->m_bAccountNotify = bState;
+        }
+        void OnClientChangedSupport(CClient* pClient, bool bState) override {
+            pClient->m_bAccountNotify = bState;
+        }
+    };
+
+    class AccountTag : public CCapability {
+        void OnClientChangedSupport(CClient* pClient, bool bState) override {
+            pClient->SetTagSupport("account", bState);
+        }
+    };
+
+    class ExtendedJoin : public CCapability {
+        void OnServerChangedSupport(CIRCNetwork* pNetwork,
+                                    bool bState) override {
+            pNetwork->GetIRCSock()->m_bExtendedJoin = bState;
+        }
+        void OnClientChangedSupport(CClient* pClient, bool bState) override {
+            pClient->m_bExtendedJoin = bState;
+        }
+    };
+
+  public:
+    MODCONSTRUCTOR(CCoreCaps) {
+        AddServerDependentCapability("away-notify", std::make_unique<AwayNotify>());
+        AddServerDependentCapability("account-notify", std::make_unique<AccountNotify>());
+        AddServerDependentCapability("account-tag", std::make_unique<AccountTag>());
+        AddServerDependentCapability("extended-join", std::make_unique<ExtendedJoin>());
+    }
+};
+
+GLOBALMODULEDEFS(
+    CCoreCaps,
+    t_s("Adds support for several IRC capabilities, extracted from ZNC core."))
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 * Copyright (C) 2008 Heiko Hund <heiko@ist.eigentlich.net>
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
@@ -27,13 +27,13 @@
 				</div>

 				<div class="subsection">
-					<div class="inputlabel"><label for="buffersize"><? FORMAT "Buffer Size:" ?></label></div>
+					<div class="inputlabel"><label for="buffersize"><? FORMAT "Buffer size:" ?></label></div>
 					<input id="buffersize" type="number" name="buffersize" value="<? VAR BufferSize ?>" size="10" min="0"
 						   title="<? FORMAT "The buffer count." ?>"/>
 				</div>

 				<div class="subsection">
-					<div class="inputlabel"><label for="defmodes"><? FORMAT "Default Modes:" ?></label></div>
+					<div class="inputlabel"><label for="defmodes"><? FORMAT "Default modes:" ?></label></div>
 					<input id="defmodes" type="text" name="defmodes" value="<? VAR DefModes ?>" size="10"
 						   title="<? FORMAT "The default modes of the channel." ?>"/>
 				</div>
@@ -66,7 +66,7 @@
 				<? ENDIF ?>

 				<div class="subsection">
-					<div class="inputlabel"><label for="quitmsg"><? FORMAT "Quit Message:" ?></label></div>
+					<div class="inputlabel"><label for="quitmsg"><? FORMAT "Quit message:" ?></label></div>
 					<input id="quitmsg" type="text" name="quitmsg" value="<? VAR QuitMsg ?>" class="full" maxlength="256"
 						   title="<? FORMAT "You may define a Message shown, when you quit IRC." ?>"
 						   <? IF !QuitMsgEdit ?>disabled<? ENDIF ?> />
@@ -45,7 +45,7 @@
 						   title="<? FORMAT "Please re-type the above password." ?>"/>
 				</div>
 				<div class="subsection">
-					<div class="inputlabel"><label for="authonlyviamodule"><? FORMAT "Auth Only Via Module:" ?></label></div>
+					<div class="inputlabel"><label for="authonlyviamodule"><? FORMAT "Auth only via module:" ?></label></div>
 					<input id="authonlyviamodule" type="checkbox" name="authonlyviamodule"
 						    title="<? FORMAT "Allow user authentication by external modules only, disabling built-in password authentication." ?>"
 						    <? IF AuthOnlyViaModule ?>checked="checked" <? ENDIF ?><? IF !ImAdmin ?>disabled="disabled" <? ENDIF ?>/>
@@ -87,7 +87,7 @@
 						   <? IF !IdentEdit ?>disabled<? ENDIF ?> />
 				</div>
 				<div class="subsection">
-					<div class="inputlabel"><label for="statusprefix"><? FORMAT "Status Prefix:" ?></label></div>
+					<div class="inputlabel"><label for="statusprefix"><? FORMAT "Status prefix:" ?></label></div>
 					<input id="statusprefix" type="text" name="statusprefix" value="<? VAR StatusPrefix ?>" class="half" maxlength="5"
 						   title="<? FORMAT "The prefix for the status and module queries." ?>"/>
 				</div>
@@ -114,7 +114,7 @@
 				<? ENDIF ?>

 				<div class="subsection">
-					<div class="inputlabel"><label for="quitmsg"><? FORMAT "Quit Message:" ?></label></div>
+					<div class="inputlabel"><label for="quitmsg"><? FORMAT "Quit message:" ?></label></div>
 					<input type="text" name="quitmsg" value="<? VAR QuitMsg ?>" class="full" maxlength="256"
 						   title="<? FORMAT "You may define a Message shown, when you quit IRC." ?>"
 						   <? IF !QuitMsgEdit ?>disabled<? ENDIF ?> />
@@ -249,13 +249,13 @@
 		<div class="sectionbg">
 			<div class="sectionbody">
 				<div class="subsection third">
-					<div class="inputlabel"><label for="chanmodes"><? FORMAT "Default Modes:" ?></label></div>
+					<div class="inputlabel"><label for="chanmodes"><? FORMAT "Default modes:" ?></label></div>
 					<input id="chanmodes" type="text" name="chanmodes" value="<? VAR DefaultChanModes ?>" maxlength="32"
 						   title="<? FORMAT "These are the default modes ZNC will set when you join an empty channel." ?>"/>
 					<br /><span class="info"><? FORMAT "Empty = use standard value" ?></span>
 				</div>
 				<div class="subsection third">
-					<div class="inputlabel"><label for="chanbufsize"><? FORMAT "Buffer Size:" ?></label></div>
+					<div class="inputlabel"><label for="chanbufsize"><? FORMAT "Buffer size:" ?></label></div>
 					<input id="chanbufsize" type="number" name="chanbufsize" value="<? VAR ChanBufferSize ?>" min="0"
 						   title="<? FORMAT "This is the amount of lines that the playback buffer will store for channels before dropping off the oldest line. The buffers are stored in the memory by default." ?>"/>
 					<br /><span class="info"><? FORMAT "Empty = use standard value" ?></span>
@@ -269,12 +269,12 @@
 		<div class="sectionbg">
 			<div class="sectionbody">
 				<div class="subsection third">
-					<div class="inputlabel"><label for="maxquerybuffers"><? FORMAT "Max Buffers:" ?></label></div>
+					<div class="inputlabel"><label for="maxquerybuffers"><? FORMAT "Max buffers:" ?></label></div>
 					<input id="maxquerybuffers" type="number" name="maxquerybuffers" value="<? VAR MaxQueryBuffers ?>" class="third" min="0"
 						   title="<? FORMAT "Maximum number of query buffers. 0 is unlimited." ?>"/>
 				</div>
 				<div class="subsection third">
-					<div class="inputlabel"><label for="querybufsize"><? FORMAT "Buffer Size:" ?></label></div>
+					<div class="inputlabel"><label for="querybufsize"><? FORMAT "Buffer size:" ?></label></div>
 					<input id="querybufsize" type="number" name="querybufsize" value="<? VAR QueryBufferSize ?>" min="0"
 						   title="<? FORMAT "This is the amount of lines that the playback buffer will store for queries before dropping off the oldest line. The buffers are stored in the memory by default." ?>"/>
 					<br /><span class="info"><? FORMAT "Empty = use standard value" ?></span>
@@ -304,7 +304,7 @@
 		<div class="sectionbg">
 			<div class="sectionbody">
 				<div class="subsection">
-					<div class="inputlabel"><label for="timestampformat"><? FORMAT "Timestamp Format:" ?></label></div>
+					<div class="inputlabel"><label for="timestampformat"><? FORMAT "Timestamp format:" ?></label></div>
 					<input id="timestampformat" type="text" name="timestampformat" value="<? VAR TimestampFormat ?>" class="full"
 						   title="<? FORMAT "The format for the timestamps used in buffers, for example [%H:%M:%S]. This setting is ignored in new IRC clients, which use server-time. If your client supports server-time, change timestamp format in client settings instead." ?>"/>
 				</div>
@@ -326,7 +326,7 @@
 				</div>
 				<div style="clear:both;"></div>
 				<div class="subsection">
-					<div class="inputlabel"><label for="jointries"><? FORMAT "Join Tries:" ?></label></div>
+					<div class="inputlabel"><label for="jointries"><? FORMAT "Join tries:" ?></label></div>
 					<input id="jointries" type="number" name="jointries" value="<? VAR JoinTries ?>" class="third" min="0"
 						   title="<? FORMAT "This defines how many times ZNC tries to join a channel, if the first join failed, e.g. due to channel mode +i/+k or if you are banned." ?>"/>
 				</div>
@@ -341,14 +341,14 @@
 					       title="<? FORMAT "How much time ZNC waits (in seconds) until it receives something from network or declares the connection timeout. This happens after attempts to ping the peer." ?>"/>
 				</div>
 				<div class="subsection">
-					<div class="inputlabel"><label for="maxnetworks"><? FORMAT "Max IRC Networks Number:" ?></label></div>
+					<div class="inputlabel"><label for="maxnetworks"><? FORMAT "Max IRC networks number:" ?></label></div>
 					<input type="number" name="maxnetworks" value="<? VAR MaxNetworks ?>" class="third" min="0"
 					       title="<? FORMAT "Maximum number of IRC networks allowed for this user." ?>" <? IF !ImAdmin ?>disabled="disabled"<? ENDIF ?> />
 				</div>

 				<? SETBLOCK Substitutions_Link ?><a href="https://wiki.znc.in/ExpandString" target="_blank" class="external"><? FORMAT "Substitutions" ?></a><? ENDSETBLOCK ?>
 				<div class="subsection half" id="ctcpreplies_plain">
-					<div class="inputlabel"><label for="ctcpreplies_text"><? FORMAT "CTCP Replies:" ?></label></div>
+					<div class="inputlabel"><label for="ctcpreplies_text"><? FORMAT "CTCP replies:" ?></label></div>
 					<div><textarea name="ctcpreplies" cols="70" rows="3" id="ctcpreplies_text" <? IF !CTCPEdit ?>disabled<? ENDIF ?>><? LOOP CTCPLoop ?><? VAR CTCP ?>
 <? ENDLOOP ?>
 </textarea></div>
@@ -356,7 +356,7 @@
 					<br /><span class="info"><? FORMAT "{1} are available" "Substitutions_Link ESC=" ?></span>
 				</div>
 				<div class="subsection" id="ctcpreplies_js" style="display:none" data-placeholder="<? FORMAT "Empty value means this CTCP request will be ignored" ?>">
-					<div class="inputlabel"><? FORMAT "CTCP Replies:" ?></div>
+					<div class="inputlabel"><? FORMAT "CTCP replies:" ?></div>
 					<div>
 						<table style="width:100%">
 							<thead>
@@ -99,7 +99,7 @@


 				<div class="subsection third">
-					<div class="inputlabel"><label for="statusprefix"><? FORMAT "Status Prefix:" ?></label></div>
+					<div class="inputlabel"><label for="statusprefix"><? FORMAT "Status prefix:" ?></label></div>
 					<input id="statusprefix" type="text" name="statusprefix" value="<? VAR StatusPrefix ?>"
 						   title="<? FORMAT "The prefix for the status and module queries." ?>"/>
 					<br /><span class="info"><? FORMAT "Default for new users only." ?></span>
@@ -107,48 +107,48 @@


 				<div class="subsection half">
-					<div class="inputlabel"><label for="maxbufsize"><? FORMAT "Maximum Buffer Size:" ?></label></div>
+					<div class="inputlabel"><label for="maxbufsize"><? FORMAT "Maximum buffer size:" ?></label></div>
 					<input id="maxbufsize" type="number" name="maxbufsize" value="<? VAR MaxBufferSize ?>"
 						   title="<? FORMAT "Sets the global Max Buffer Size a user can have." ?>"/>
 				</div>


 				<div class="subsection half">
-					<div class="inputlabel"><label for="connectdelay"><? FORMAT "Connect Delay:" ?></label></div>
+					<div class="inputlabel"><label for="connectdelay"><? FORMAT "Connect delay:" ?></label></div>
 					<input id="connectdelay" type="number" name="connectdelay" value="<? VAR ConnectDelay ?>"
 						   title="<? FORMAT "The time between connection attempts to IRC servers, in seconds. This affects the connection between ZNC and the IRC server; not the connection between your IRC client and ZNC." ?>"/>
 				</div>


 				<div class="subsection half">
-					<div class="inputlabel"><label for="serverthrottle"><? FORMAT "Server Throttle:" ?></label></div>
+					<div class="inputlabel"><label for="serverthrottle"><? FORMAT "Server throttle:" ?></label></div>
 					<input id="serverthrottle" type="number" name="serverthrottle" value="<? VAR ServerThrottle ?>"
 						   title="<? FORMAT "The minimal time between two connect attempts to the same hostname, in seconds. Some servers refuse your connection if you reconnect too fast." ?>"/>
 				</div>


 				<div class="subsection half">
-					<div class="inputlabel"><label for="anoniplimit"><? FORMAT "Anonymous Connection Limit per IP:" ?></label></div>
+					<div class="inputlabel"><label for="anoniplimit"><? FORMAT "Anonymous connection limit per IP:" ?></label></div>
 					<input id="anoniplimit" type="number" name="anoniplimit" value="<? VAR AnonIPLimit ?>"
 						   title="<? FORMAT "Limits the number of unidentified connections per IP." ?>"/>
 				</div>


 				<div class="subsection">
-					<div class="inputlabel"><? FORMAT "Protect Web Sessions:" ?></div>
+					<div class="inputlabel"><? FORMAT "Protect web sessions:" ?></div>
 					<div class="checkbox"><input type="checkbox" name="protectwebsessions" id="protectwebsessions_checkbox"<? IF ProtectWebSessions ?> checked="checked"<? ENDIF ?> />
 						<label for="protectwebsessions_checkbox"><? FORMAT "Disallow IP changing during each web session" ?></label></div>
 				</div>


 				<div class="subsection">
-					<div class="inputlabel"><? FORMAT "Hide ZNC Version:" ?></div>
+					<div class="inputlabel"><? FORMAT "Hide ZNC version:" ?></div>
 					<div class="checkbox"><input type="checkbox" name="hideversion" id="hideversion_checkbox"<? IF HideVersion ?> checked="checked"<? ENDIF ?> />
 						<label for="hideversion_checkbox"><? FORMAT "Hide version number from non-ZNC users" ?></label></div>
 				</div>

 				<div class="subsection">
-					<div class="inputlabel"><? FORMAT "Auth Only Via Module:" ?></div>
+					<div class="inputlabel"><? FORMAT "Auth only via module:" ?></div>
 					<div class="checkbox"><input type="checkbox" name="authonlyviamodule" id="authonlyviamodule_checkbox"<? IF AuthOnlyViaModule ?> checked="checked"<? ENDIF ?> />
 						<label for="authonlyviamodule_checkbox"><? FORMAT "Allow user authentication by external modules only" ?></label></div>
 				</div>
@@ -15,23 +15,23 @@
 					</tr>
 				<? IF IsAdmin ?>
 					<tr class="evenrow">
-						<th><? FORMAT "Total Users" ?></th>
+						<th><? FORMAT "Total users" ?></th>
 						<td><? VAR TotalUsers ?></td>
 					</tr>
                    <tr class="oddrow">
-						<th><? FORMAT "Total Networks" ?></th>
+						<th><? FORMAT "Total networks" ?></th>
 						<td><? VAR TotalNetworks ?></td>
 					</tr>
 					<tr class="evenrow">
-						<th><? FORMAT "Attached Networks" ?></th>
+						<th><? FORMAT "Attached networks" ?></th>
 						<td><? VAR AttachedNetworks ?></td>
 					</tr>
 					<tr class="oddrow">
-						<th><? FORMAT "Total Client Connections" ?></th>
+						<th><? FORMAT "Total client connections" ?></th>
 						<td><? VAR TotalCConnections ?></td>
 					</tr>
 					<tr class="evenrow">
-						<th><? FORMAT "Total IRC Connections" ?></th>
+						<th><? FORMAT "Total IRC connections" ?></th>
 						<td><? VAR TotalIRCConnections ?></td>
 					</tr>
 				<? ELSE ?>
@@ -40,7 +40,7 @@
 						<td><? VAR TotalNetworks ?></td>
 					</tr>
 					<tr class="oddrow">
-						<th><? FORMAT "Attached Networks" ?></th>
+						<th><? FORMAT "Attached networks" ?></th>
 						<td><? VAR AttachedNetworks ?></td>
 					</tr>
 					<tr class="evenrow">
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2023 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
--- a/Show More
+++ b/Show More