v0.19.0

Breaking changes

• BgpValidationWarning is now #[non_exhaustive]: Exhaustive match on this enum must add a _ arm. This allows new warning variants to be added in future minor releases without breaking downstream matches.

Added

• Extended element filtering: Added Filter variants for nine previously unfilterable BgpElem fields: only_to_customer (otc), next_hop, origin, local_pref, med, atomic, aggr_asn, aggr_ip, and peer_bgp_id. Each optional field also supports presence filtering via the * wildcard — e.g. otc=* matches elements that carry an OTC value, otc=!* matches elements without one. (#306)
• RFC 7606 non-fatal NLRI parsing: Malformed NLRI fields (withdrawn or announced) no longer cause the entire BGP UPDATE message to be discarded. Instead, the parser returns the UPDATE with partial prefix data and records a BgpValidationWarning::MalformedNlri warning containing the raw NLRI bytes, enabling callers to emulate RFC 7606 treat-as-withdrawal semantics. Attribute framing errors (truncated length fields, inconsistent data) remain fatal. (#303)
• Treat-as-withdrawal example: Added examples/treat_as_withdrawal.rs demonstrating how to scan MRT files for RFC 7606 validation issues, classify them by error-handling category (attribute discard vs. treat-as-withdrawal), and extract raw malformed NLRI bytes.
• MRT attribute code counter example: Added examples/count_attributes.rs, which reports every parsed BGP path-attribute wire code in a local or remote MRT file, including raw-retained unsupported, deprecated, and unassigned attributes.
• RTR PDU fuzzer: Added fuzz_rtr fuzz target for RPKI RTR PDU parsing. (#308)

Fixed

• Raw bytes preserved on MRT body-parse failures: parse_mrt_record now attaches the original MRT record bytes to ParserErrorWithBytes.bytes when the message body fails to parse, enabling forensic analysis and record export. Previously bytes was always None for body-level failures. (#303)
• FlowSpec prefix parsing OOB: Reject FlowSpec prefix lengths > 128 before copying address bytes, preventing an out-of-bounds panic on the fixed 16-byte IPv6 buffer. (#308)
• RTR Error Report oversized text panic: Validate the declared error_text_len fits within the PDU before slicing, preventing an out-of-bounds panic from a crafted length field. The encap_pdu_len check was also switched to subtraction to avoid usize overflow on 32-bit targets. (#308)
• RTR PDU memory-exhaustion DoS: Cap RTR PDU allocations at RTR_MAX_ERROR_REPORT_LEN (~128 KiB) before allocating, so a crafted length header cannot drive a multi-gigabyte allocation. (#308)
• BGP4MP Link-State AFI rejection: Reject Afi::LinkState in BGP4MP envelopes (Message, StateChange, route parsing), which previously fell through to an incorrect IPv4-format assumption. (#308)
• BGP4MP payload length underflow: Switched bgp4mp_message_payload_len to saturating subtraction and made it fallible, preventing underflow on truncated/inconsistent records. (#308)
• OpenBMP admin-id clamp: Removed the 255-byte clamp on admin_id length in OpenBMP header parsing; the declared length is now consumed in full to avoid misparsing subsequent fields. (#308)
• AS path allocation overflow guard: Validate ASN byte count via checked_mul before allocating in read_asns, preventing overflow-driven pre-allocation on 32-bit targets from a crafted count. (#308)

Changed

• NLRI parse errors are now non-fatal: parse_bgp_update_message previously returned Err on any malformed NLRI byte, discarding all attributes and partially-parsed prefixes. It now returns Ok with partial data and a BgpValidationWarning::MalformedNlri. This is the correct RFC 7606 behavior — callers should check attributes.validation_warnings() if they need to distinguish clean updates from partially-recovered ones.
• Examples documentation: Expanded examples/README.md to index all maintained Rust, standalone, and WebAssembly examples. Refreshed standalone example instructions, corrected the RIB entry age study path, and made selected archive examples accept input sources or archive months.
• Dependency: oneio updated from 0.23 to 0.24: Brings S3 multipart upload retry with exponential backoff, ONEIO_S3_MAX_RETRIES / ONEIO_S3_RETRY_BACKOFF_MS env vars, per-request upload timeout, and zstd compression support (.zst suffix). (#305)