New

• ASPA support is now always compiled in and available if enable-aspa is set. The aspa Cargo feature has been removed. (#990)
• If merging mutliple ASPA objects for a single customer ASN results in more than 16,380 provider ASNs, the ASPA is dropped. (Note that ASPA objects with more than 16,380 provider ASNs are already rejected during parsing.) (#996)
• New archive-stats command that shows some statistics of an RRDP archive. (#982)
• Re-enabled the use of GZIP compression in HTTP request sent by the RRDP collector. Measures to deal with exploding data have been implemented in rpki-rs#319. (#997)

Bug fixes

• Fixed an issue with checking the file names in manifests that let to a crash when non-ASCII characters are used. (rpki-rs#320, reported by Haya Schulmann and Niklas Vogel of Goethe University Frankfurt/ATHENE Center and assigned CVE-2025-0638)
• The validation HTTP endpoints now accept prefixes with non-zero host bits. (#987)
• Removed duplicate rtr_client_reset_queries in HTTP metrics. (#992 by @sleinen)
• Improved disk space consumption of the new RRDP archives by re-using empty space when updating an object and padding all objects to a multiple of 256 bytes. (#982)