deps: bump rns from 1.3.5 to 1.3.9 in /tools

[dependabot]

Bumps rns from 1.3.5 to 1.3.9.

Release notes

Sourced from rns's releases.

RNS 1.3.9

Critical Security Update: This release fixes a severe security flaw in rnsh. Due to the nature of the issue, I will not disclose any further details for the time being. Once operators have had time to update, I will provide a full report for transparency. If you use rnsh, update right now.

Important: The new version of rnsh changes default identity file locations, and these will now be sourced from ~/.rnsh/identity (initiator) and ~/.rnsh/identity.default (listener). Make sure you copy your old files to this directory, or specify a custom identity path using the command line arguments. The --config argument has also been renamed to --rnsconfig, and the --config argument will now specify the rnsh configuration directory instead of the RNS configuration directory, bringing the behavior into alignment with other RNS utilities.

Additionally, this release includes automated blocking of fast-flapping clients on BackboneInterface listeners (see the Interfaces chapter of the manual for details), and a number of improvements to resource handling. The logging system has also been improved, and path and destination information moved to a new LOG_PATHING loglevel, to decrease log noise.

Changes

• Fixed a critical security issue in rnsh
• Added automated blocking of fast-flapping clients to BackboneInterface
• Added new LOG_PATHING loglevel, improved logging
• Added ability to make internal-mode interfaces discoverable
• Added ability to get discoverable interface location from external script
• Added RESOURCE_RCL signal on resource receiver cancel
• Improved resource handling and reliability
• Updated rnsh config args to work similarly to other RNS utilities

Verified Retrieval You can retrieve and verify this release over Reticulum using the built-in rngit release utility. To retrieve only the installation .whl package, and the release manifest for future updates, you can use:

rngit release rns://7649a50d84610232d1416b41d2896aff/reticulum/reticulum fetch "latest:rns-*.whl" --signer bc7291552be7a58f361522990465165c

To download all artifacts, including the documentation and source archive, you can use the following command:

rngit release rns://7649a50d84610232d1416b41d2896aff/reticulum/reticulum fetch latest:all --signer bc7291552be7a58f361522990465165c

Release Signatures Release artifacts include a signed rsm release manifest and rsg signature files that can be validated against the RNS release signing identity <bc7291552be7a58f361522990465165c> using rngit or rnid. To perform an offline verification of all release artifacts using a manifest:

rngit release rns_*.rsm verify --signer bc7291552be7a58f361522990465165c

To verify release artifacts using individual rsg files, while also verifying the manifest itself, download the rsm and rsg signatures, make sure they are in the same folder as the release artifact, and run rnid signature verification with the release identity as the required signer:

rnid -i bc7291552be7a58f361522990465165c -V rns_*.rsm *.rsg

The rnid utility will then verify the signatures, and display whether they are valid. If the signature cannot be verified, the release has been tampered with and should be discarded.

RNS 1.3.8

Changes

• Added internal interface mode
• Added recursive_prs interface option
• Added announces_from_internal interface option

... (truncated)

Changelog

Sourced from rns's changelog.

2026-07-19: RNS 1.3.9

Critical Security Update: This release fixes a severe security flaw in rnsh. Due to the nature of the issue, I will not disclose any further details for the time being. Once operators have had time to update, I will provide a full report for transparency. If you use rnsh, update right now.

Important: The new version of rnsh changes default identity file locations, and these will now be sourced from ~/.rnsh/identity (initiator) and ~/.rnsh/identity.default (listener). Make sure you copy your old files to this directory, or specify a custom identity path using the command line arguments. The --config argument has also been renamed to --rnsconfig, and the --config argument will now specify the rnsh configuration directory instead of the RNS configuration directory, bringing the behavior into alignment with other RNS utilities.

Additionally, this release includes automated blocking of fast-flapping clients on BackboneInterface listeners (see the Interfaces chapter of the manual for details), and a number of improvements to resource handling. The logging system has also been improved, and path and destination information moved to a new LOG_PATHING loglevel, to decrease log noise.

Changes

• Fixed a critical security issue in rnsh
• Added automated blocking of fast-flapping clients to BackboneInterface
• Added new LOG_PATHING loglevel, improved logging
• Added ability to make internal-mode interfaces discoverable
• Added ability to get discoverable interface location from external script
• Added RESOURCE_RCL signal on resource receiver cancel
• Improved resource handling and reliability
• Updated rnsh config args to work similarly to other RNS utilities

Verified Retrieval You can retrieve and verify this release over Reticulum using the built-in rngit release utility. To retrieve only the installation .whl package, and the release manifest for future updates, you can use:

rngit release rns://7649a50d84610232d1416b41d2896aff/reticulum/reticulum fetch "latest:rns-*.whl" --signer bc7291552be7a58f361522990465165c

To download all artifacts, including the documentation and source archive, you can use the following command:

rngit release rns://7649a50d84610232d1416b41d2896aff/reticulum/reticulum fetch latest:all --signer bc7291552be7a58f361522990465165c

Release Signatures Release artifacts include a signed rsm release manifest and rsg signature files that can be validated against the RNS release signing identity <bc7291552be7a58f361522990465165c> using rngit or rnid. To perform an offline verification of all release artifacts using a manifest:

rngit release rns_*.rsm verify --signer bc7291552be7a58f361522990465165c

To verify release artifacts using individual rsg files, while also verifying the manifest itself, download the rsm and rsg signatures, make sure they are in the same folder as the release artifact, and run rnid signature verification with the release identity as the required signer:

rnid -i bc7291552be7a58f361522990465165c -V rns_*.rsm *.rsg

The rnid utility will then verify the signatures, and display whether they are valid. If the signature cannot be verified, the release has been tampered with and should be discarded.

2026-07-10: RNS 1.3.8

This release fixes various inconsistencies in link and hop-count related APIs.

... (truncated)

Commits

• bfade97 Prepare release
• 3c4ef62 Updated changelog
• 3898d63 Block fast flapping configuration
• ec8d43a Updated rnsh config args to work similarly to other RNS utils
• 5081255 Updated logging
• 13a5381 Cleanup
• a5ed0a4 Improved HDLC handling
• d93f979 Cleanup
• 88833f1 Updated documentation
• cd6911e Implemented automated fast-flapping client blocking on BackboneInterface
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: upstream-sync. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Superseded by #23.