RIOT 2026.10 Released with New CoAP Stack and RISCV64 Support

RIOT 2026.10 "GameOverBugs" shipped on 2 November after a 70-day cycle, merging 411 pull requests and 792 commits across 3,025 files with 107,371 insertions and 38,492 deletions. You get a new CoAP stack named unicoap with client and server functionality, alongside the libCoAP package and picohttpparser. The release drops unsafe nanocoap APIs, updates gcoap, and adds three new boards: the STM32 Nucleo-G491RE, Seeed Studio Xiao ESP32C6, and the ZedBoard, which serves as the first RISCV64 board.

The 802.15.4 Radio HAL and (Sub)MAC layer received reworks adding frame retention and a peek function, while dropping NETOPT_CHANNEL_PAGE. Jelly arrives as a new shell interface featuring autocompletion and reduced binary sizes. TelosB and Zolertia Z1 face deprecation with removal warnings set for 2027.04, while the Docker image moved to Ubuntu 26.04 "Resolute Raccoon."

Security-relevant fixes patch an out-of-bounds read in 6LoWPAN fragmentation, a buffer overflow in mtd_flashpage, malformed input handling in DHCPv6 and URI parsers, and a zero MinHopRankIncrease in RPL. Known issues include 177 total items, featuring an out-of-bounds write in gcoap DNS Block2 handling on 32-bit targets. Contribution rules now require an AI declaration in pull request descriptions.