unbound: update to 1.24.2

Fixes: Possible Domain Hijacking via promiscuous NS Records (CVE-2025-11411)
Changelog: https://www.nlnetlabs.nl/projects/unbound/download/#unbound-1-24-2
Upstream commit f6269baa605d31859f28770e01a24e3677e5f82c
https://github.com/NLnetLabs/unbound/commit/f6269baa605d31859f28770e01a24e3677e5f82c

Signed-off-by: Goetz Goerisch <[email protected]>

unbound: minimal fix for odhcpd lease file parsing

Current odhcpd in master writes MAC addresses with colons in his lease file,
this new odhcpd format leads to a crash loop in unbound (if DHCPv4 to SLAAC is selected).

Just remove the colons, before the processing in slaac_eui64 begins, fixes #28032

Signed-off-by: Dirk Brenken <[email protected]>

treewide: remove python3-distutils dependency

As the python3-distutils was dropped while bumping the version
to 3.13.9 via 97a92f2e7a77c39d087892f5c9a7350c31f3d65b, remove the
python3-distutils from all packages that are currently using it.

OpenWrt already uses recent enough releases of these packages
that have adapted to work without distutils, so the dependency
can be safely removed.

Signed-off-by: Til Kaiser <[email protected]>

ptunnel-ng: remove package

It seems upstream author does not have
time to maintain this software anymore.
Please see v1.43 release note.

Signed-off-by: Yanase Yuki <[email protected]>

qbee-agent: bump version to 2025.49

Bump version to 2025.49

Signed-off-by: Jon Henrik Bjørnstad <[email protected]>

qbee-agent: bump version to 2025.49

Bump version to 2025.49

Signed-off-by: Jon Henrik Bjørnstad <[email protected]>

telegraf: set home variable in uci-defaults script

avoid a non-critical error caused by getent not being installed

Signed-off-by: Niklas Thorild <[email protected]>

telegraf: update to 1.37.0

- Update Telegraf to v1.37.0

Signed-off-by: Niklas Thorild <[email protected]>

modemmanager: allow empty initial EPS bearer APN

This commit removes the non-empty APN requirement for initial EPS
bearer. An empty APN value is valid and means that the modem will use a
network provided APN offered by the operator.

Signed-off-by: Simonas Tamošaitis <[email protected]>

watchcat: set default value for mmifacename to prevent argument shift

Set mmifacename default to "null" instead of an empty string to avoid
argument displacement when the value is not defined. Also remove leftover
debug comments from previous commit.

Signed-off-by: Ivan Diaz <[email protected]>

watchcat: fix argument handling and allow multiple ping hosts

The backend now correctly supports multiple IP addresses and avoids
argument shifting when mmifacename is empty.

Signed-off-by: Ivan Diaz <[email protected]>

openconnect: fix off-by-one while condition

resolveip returns 0 on success. This means that the while loop
will just run until all tries are exhausted. But this was not
the intended behaviour.

Fixes: 20ea72607bbf ("openconnect: make host dependency more resilient")
Signed-off-by: Christian Lamparter <[email protected]>

pbr: update to 1.2.1-r35

pbr 1.2.1-r35

Makefile:
* split uci-defaults into different purpose files
* add handling of netifd integration

Config:
* update with default values for all options (thanks @betonmischer86)

Init-script:
* add netifd integration handling
* add ip() function to emulate ip rule replace
* add netbird intrfaces support (thanks @egc112)
* reorganize loading/handling of options in load_package_config()
* improve display of interface triggers in service_triggers()
* remove chains cleanup from stop_service() due to exclusive use of fw4 nft files
* improve status_service() output
* drop input and postrouting as valid options for policy chain

Uci-defaults files:
* 91-pbr-nft: cosmetic improvements

Default nft files:
* drop use of input and postrouting chanins

Custom User files:
* dns-prefetch: functional improvements (thanks @betonmischer86)

Signed-off-by: Stan Grishin <[email protected]>

prometheus-node-exporter-lua: remove zero values

depending on the configuration there may be multiple
interfaces creating multiple time series always
reporting 0 value. omiting them from the export saves
resources. most notably cpu. this is limited to
counter types

Signed-off-by: Markus Hube <[email protected]>

snapcast: update to v0.34.0

A straightforward update from 0.28.0 (2024-03-19, [1])
to 0.34.0 (2025-10-12, [2]) with almost 400 commits. [3]

Notable change is the configurable OpenSSL support (BUILD_WITH_SSL)
for both snapserver and snapclient.
They will be enabled once I introduce the flavours.

In the mean time upsteam moved to it's own organization. [4]

Upstream changelog:
https://github.com/snapcast/snapcast/blob/v0.34.0/changelog.md

[1]: https://github.com/snapcast/snapcast/releases/tag/v0.28.0
[2]: https://github.com/snapcast/snapcast/releases/tag/v0.34.0
[3]: https://github.com/snapcast/snapcast/compare/v0.28.0...v0.34.0
[4]: https://github.com/snapcast

Signed-off-by: Szabolcs Hubai <[email protected]>

snapcast: define ALSA support explicitly

As Hannu Nyman pointed out, in some cases the build of the package is
able to fail:

Package snapserver is missing dependencies for the following libraries:
libasound.so.2

He said: on some build runs, alsa is built (as required by other
packages), and if it is built before snapcast, it may be detected,
if the feature is not explicitly disabled in CMakeLists.txt.

Also: "I think that you could drop that AUDIO_SUPPORT conditional.
AUDIO_SUPPORT is selected e.g. if USB_SUPPORT is selected,
so it is not that big restriction."

Suggested-by: Hannu Nyman <[email protected]>
Signed-off-by: Szabolcs Hubai <[email protected]>

snapcast: sort and reformat CMAKE_OPTIONS

Sort CMAKE_OPTIONS by alphabet and save a few bytes with tab character,
instead of repeating "CMAKE_OPTIONS +="

Signed-off-by: Szabolcs Hubai <[email protected]>

vim: disable wayland to fix missing dependency

vim autodetects wayland if it's installed, but there's no dependency on
it which results in:

Package vim-full is missing dependencies for the following libraries:
libwayland-client.so.0

Fixes: 4406b79 ("vim: bump to 9.1.1918")
Signed-off-by: George Sapkin <[email protected]>

yt-dlp: bump to 2025.12.08

Changelog: https://github.com/yt-dlp/yt-dlp/releases/tag/2025.12.08
Signed-off-by: George Sapkin <[email protected]>

udpspeeder: disable color in logging to prevent side effects in syslog

Fixes #26872 by passing --disable-color in init script

Signed-off-by: David Connolly <[email protected]>

vim: bump to 9.1.1918

Switch source to GitHub for the most recent releases.

Changes: https://github.com/vim/vim/compare/v9.1.0...v9.1.1918
Signed-off-by: George Sapkin <[email protected]>

vim: add actual xxd version

Use the actual xxd version instead of the vim one for packaging.

Add matching CI test.

Signed-off-by: George Sapkin <[email protected]>

lf: update to r39

https://github.com/gokcehan/lf/releases/tag/r39

Signed-off-by: Nate Robinson <[email protected]>

radicale: remove obsolete package

In this repository, we do have radicale2, so OpenWrt
community should switch to use that version.

This version (= 1.x.x) is really old, no longer developed
and there are newer versions, which can be used e.g.
version 2.x.x, in this repo as radicale2 or there is
also version 3.x.x, which is not packaged for OpenWrt so far.

Signed-off-by: Josef Schlehofer <[email protected]>

adguardhome: bump to 0.107.70

Changelog: https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.70
Signed-off-by: George Sapkin <[email protected]>

adguardhome: add SPDX license identifiers

Add GPL 2.0 only SPDX license identifiers to Makefile and all scripts.

Signed-off-by: George Sapkin <[email protected]>

bind: save out served domains on service stop

If named gets stopped, then started again, but isc-dhcpd isn't also
restarted, then we want named to at least have the existing content.

Signed-off-by: Philip Prindeville <[email protected]>

tmux: update to 3.6a

changes: https://raw.githubusercontent.com/tmux/tmux/3.6a/CHANGES

Signed-off-by: Maxim Storchak <[email protected]>

php8: update to 8.4.15

Upstream changelog:
https://www.php.net/ChangeLog-8.php#8.4.15

Signed-off-by: Michael Heimpold <[email protected]>

django: bump to version 5.2.9

Fixed CVE-2025-13372 and CVE-2025-64460.

Full release notes:
- https://docs.djangoproject.com/en/dev/releases/5.2.9/

Signed-off-by: Wei-Ting Yang <[email protected]>

ksmbd-tools: bump to 3.5.6

Major changes are:

- Increase max ip connections(8->32) and max connections(128->256).

- Unset "guest_ok = yes" for ipc share by default.

- add new UCI option "allow_guest_ipc" to section (default disabled)

Signed-off-by: Andrea Pesaresi <[email protected]>

rtty: update to 9.0.4

changelog: https://github.com/zhaojh329/rtty/releases/tag/v9.0.4

Signed-off-by: Jianhui Zhao <[email protected]>

sqlite3: bump to 3.51.1

Changelog: https://sqlite.org/releaselog/3_51_1.html
Signed-off-by: George Sapkin <[email protected]>

adblock: update 4.4.4-3

* fixed a typo in the allowlist/blocklist regex
* limit the f_switch function to only the suspend/resume actions

Signed-off-by: Dirk Brenken <[email protected]>

python-unidecode: drop unmaintained package

It looks like based on opened PRs [1],
there is no official support for Python 3.12+.

Unfortunately, this project is still using setup.py,
which is deprecated and no longer supported.
These days project metadata are stored in pyproject.toml
according to PEP 621.

Also, this project does not follow PEP625 as their
wheel name is in uppercase and it should be in lowercase.

[1] https://github.com/avian2/unidecode/pulls
[2] https://peps.python.org/pep-0621/

Signed-off-by: Josef Schlehofer <[email protected]>

banip: release 1.6.0-1

* split block/logging rules (fixed #27990)
* adapt reload functions to support the new split logic
* the banIP status now includes the backend- and the frontend version information
* fixed a config parsing error with non existing dirs (reported in the forum)
* fixed a small reporting issue (reported in the forum)
* added a new public dns feed (by default restricted to outbound, ports 53 and 853)
* added a new gawk dependency due to significant performance gains
* LuCI: no longer call the logread binary, use rpc / the ubus log object instead
* LuCI: various code cleanups
* LuCI: various small usability improvements
* readme update

Signed-off-by: Dirk Brenken <[email protected]>

qemu: update to 10.1.2

- Update version
- No patch changed

Signed-off-by: Vladimir Ermakov <[email protected]>

gummiboot: add patch fixing compilation error

Add patch fixing compilation error for implicit declaration of
'basename' and also add a patch to use toolchain version of nm and
objcopy tool.

Signed-off-by: Christian Marangi <[email protected]>

golang: bump to 1.25.5

Fixes: CVE-2025-61727
Fixes: CVE-2025-61729
Link: https://github.com/golang/go/issues?q=milestone%3AGo1.25.5+label%3ACherryPickApproved
Signed-off-by: George Sapkin <[email protected]>

chrony: Makefile amendments

Update URL to current distro source
drop provides:=nts since it is unused anywhere

Signed-off-by: Paul Donald <[email protected]>

chrony: add provides logic to Makefile

This satisfies other packages which might depend on either chrony variant.

Should another package dependency request 'chrony', the default will be non-NTS
chrony via DEFAULT_VARIANT:=1 (mlichvar comment:  to avoid pulling its large
dependencies).

Signed-off-by: Paul Donald <[email protected]>

ci: set explicit workflow permissions

Add explicit permissions for modifying pull requests to labeler and
multi-arch-test-build.

Signed-off-by: George Sapkin <[email protected]>

rclone: Update to 1.72.0

Release note: https://github.com/rclone/rclone/releases/tag/v1.72.0

Signed-off-by: Tianling Shen <[email protected]>

xray-core: Update to 25.12.2

Release note: https://github.com/XTLS/Xray-core/releases/tag/v25.12.2

Signed-off-by: Tianling Shen <[email protected]>

dnsproxy: Update to 0.78.1

Release note:
- https://github.com/AdguardTeam/dnsproxy/releases/tag/v0.78.0
- https://github.com/AdguardTeam/dnsproxy/releases/tag/v0.78.1

Signed-off-by: Tianling Shen <[email protected]>

yq: Update to 4.49.2

Release note:
- https://github.com/mikefarah/yq/releases/tag/v4.49.1
- https://github.com/mikefarah/yq/releases/tag/v4.49.2

Signed-off-by: Tianling Shen <[email protected]>

multi-arch-test-build: post formal summaries to PR

Post formality check summaries to a PR.

Signed-off-by: George Sapkin <[email protected]>

python-parsley: drop package

This looks like it is not maintained anymore.
The last commit in the repository [1] is from 2017,
and the last tarball uploaded on PyPI is from 2015.

That tarball does not follow PEP625, because the
wheel and tarball begins with uppercase, it should be
in lowercase and as well it is still using setup.py.

Python these days is using pyproject.toml.

[1] https://github.com/washort/parsley

Signed-off-by: Josef Schlehofer <[email protected]>

python-pysocks: remove outdated and not maintained package

The latest commit in https://github.com/Anorov/PySocks
is from 2019, it looks outdated and not maintained.

It does not follow PEP 625.

Signed-off-by: Josef Schlehofer <[email protected]>

trafficshaper: remove test codes

Remove requirement test code as it is already supplied by package
dependencies
Depend on ip6tables to satisfy description claim

Signed-off-by: Andris PE <[email protected]>

ykclient: remove package

Upstream stopped ykclient developments.
https://github.com/Yubico/yubico-c-client

Signed-off-by: Yanase Yuki <[email protected]>

triggerhappy: remove package

The latest upstream commit is 9 years ago.
It seems this package is no longer maintained.
No packages depends on this.

Signed-off-by: Yanase Yuki <[email protected]>

ci: label formality failures

Add or remove 'not following guidelines' label based on formality check
status.

Signed-off-by: George Sapkin <[email protected]>

ci: add PR labeler workflow

Label based on target release branch. Labels must be manually defined to
avoid giving the action unnecessary permissions. Release labels must be
defined in the config after each release is forked.

Signed-off-by: George Sapkin <[email protected]>

netstinky: remove package

It seems this package is no longer maintained.
- The latest upstream commit is 4 years ago.
- Official website and IoC update servers
  are unreachable.
  https://crt.sh/?q=netstinky-api.wand.net.nz

No packages depend on this.

Signed-off-by: Yanase Yuki <[email protected]>

webui-aria2: remove package

It seems this software is no longer maintained.
- The latest upstream commit is 4 years ago.
- Author didn't respond security issue report. (CVE-2023-39141)

No packages depend on this.

Signed-off-by: Yanase Yuki <[email protected]>

syncthing: bump to 2.0.12

Changelog: https://github.com/syncthing/syncthing/releases/tag/v2.0.12
Signed-off-by: George Sapkin <[email protected]>

knot: update to version 3.5.2

Release notes: https://www.knot-dns.cz/2025-11-28-version-352.html

Signed-off-by: Jan Hák <[email protected]>

isc-dhcp: use modzone not addzone so in-addr.arpa works

Updates to in-addr.arpa are being rejected with:

update failed: REFUSED

because we create an empty zone, and then try to add it again
when it already exists.  So use modzone instead to update it.

Signed-off-by: Philip Prindeville <[email protected]>

cyrus-sasl: fix build with glibc

Add missing dependency +USE_GLIBC:libcrypt-compat to express dependency
on libcrypto.so.1 when building with GNU glibc.

Signed-off-by: Daniel Golle <[email protected]>

clixon: backport upstream patch fixing support for 32 bit

Backport upstream patch for clixon fixing support for 32 bit.

Signed-off-by: Christian Marangi <[email protected]>

exim: update to version 4.99

See https://code.exim.org/exim/exim/releases/tag/exim-4.99

Signed-off-by: Daniel Golle <[email protected]>

pv: explicitly enable ncursesw, add dependency

Explicitly enable ncurses usage and add dependency for it.

(Feature was added 1.9.24, and buildbot has occasionally failed due
to the missing dependency if ncurses has been already built.)

Signed-off-by: Hannu Nyman <[email protected]>

pv: remove inactive maintainer

Remove the maintainer info, as jow has not committed to the package
since 2016.

Signed-off-by: Hannu Nyman <[email protected]>

freeradius3: drop yubikey support

FreeRADIUS yubikey plugin depends on obsolete libyubikey.
libyubikey has been removed from repo
due to upstream EoL. (9ea17111f05e1bc3)
This commit will fix libyubikey dependency problem.

Signed-off-by: Yanase Yuki <[email protected]>

tdb: update for compatibility, remove absent maintainer

Update to 1.4.14 for compatibility with the current packages infra
(python etc.)

* Refresh patches. Remove old upstream patch
* Remove absent maintainer

Signed-off-by: Hannu Nyman <[email protected]>

lm-sensors: pass TARGET_LDFLAGS to fix linking

Explicitly pass $(TARGET_LDFLAGS) to the build system
to resolve MIPS linker errors related to missing -fPIC.

Signed-off-by: Anari Jalakas <[email protected]>

leptonica: adjust for tesseract expectations

Adjust include path and cmake file path so that tesseract, the only user
of the library, finds the items in place. Should unbreak the tesseract
build.

Signed-off-by: Hannu Nyman <[email protected]>

python-setuptools: fix PKG_CPE_ID

Should be PKG_CPE_ID, not CPE_ID.

Signed-off-by: Wei-Ting Yang <[email protected]>

shine: fix compile bug in l3mdct

- Project has different function declaration in header and source.
- Reformat patches for `git am`

Fixes: https://github.com/openwrt/packages/issues/27957
Signed-off-by: Vladimir Ermakov <[email protected]>

tailscale: update to 1.90.9

Changelog: https://tailscale.com/changelog#2025-11-19
Changelog: https://tailscale.com/changelog#2025-11-25

Signed-off-by: Sandro Jäckel <[email protected]>

snort3: update to 3.10.0.0

Changelog: https://github.com/snort3/snort3/releases/tag/3.10.0.0

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc (Intel N150)

Signed-off-by: John Audia <[email protected]>

libdaq3: update to 3.0.23

Changelog: https://github.com/snort3/libdaq/releases/tag/v3.0.23

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc (Intel N150)

Signed-off-by: John Audia <[email protected]>

tor: update to 0.4.8.21 stable

Minor release, see the changelog [1] for what's new.

[1] https://gitlab.torproject.org/tpo/core/tor/-/blob/tor-0.4.8.21/ChangeLog

Signed-off-by: Rui Salvaterra <[email protected]>

esniper: remove package

esniper's development has been stopped in 2020.
https://esniper.sourceforge.net/
No packages depend on this.

Signed-off-by: Yanase Yuki <[email protected]>

python-pypubsub: switch to PyPi sdist

- PyPi sdist was recently added for this package. Switch to using it.

Signed-off-by: Austin Lane <[email protected]>

python-chardet: fix build (depend on setuptools)

- Properly depend on python-setuptools to fix build failures.

Signed-off-by: Austin Lane <[email protected]>

python-certifi: fix build (depend on setuptools)

- Setuptools has been required since certifi 2025.06.15
  https://github.com/certifi/python-certifi/pull/350

Signed-off-by: Austin Lane <[email protected]>

python-curl: bump to version 7.45.7

Change bumps version to 7.45.7
Adding python-setuptools/host as PKG_BUILD_DEPENDS.

Package is no longer needed.

Fixes:
 https://github.com/openwrt/packages/issues/27915

Signed-off-by: Alexandru Ardelean <[email protected]>

python-idna: bump to version 3.11

bump to version 3.11

Signed-off-by: Ioan Bobar <[email protected]>

Revert "tar: fix EXTRA_DEPENDS"

This reverts commit 593267af241de9cc1e425036305988ccbc396862.

Signed-off-by: George Sapkin <[email protected]>

ola: fix compilation with newer liblo

Upstream backport.

Signed-off-by: Rosen Penev <[email protected]>

liblo: fix pkgconf file

OS paths are wrongly being passed.

Signed-off-by: Rosen Penev <[email protected]>

python-urllib3: fix builds with setuptools-scm 9.x

- Fix builds for python-urllib3 with setuptools-scm
- Patch sourced from upstream (un-released/main branch)

Signed-off-by: Austin Lane <[email protected]>

perl-www-curl: fix compilation error with new cURL version

Add patch removing internal macro CURL_HAS_DECLSPEC_ATTRIBUTE.

This fix a compilation error for the package.

Also improve the old 7.88 patch with wrong whitespace.

Signed-off-by: Christian Marangi <[email protected]>

netopeer2: fix install path for netopeer2-server

New version of netopeer2 moved the install location of netopeer2-server
from /usr/bin to /usr/sbin.

Update the install location to reflect this change.

Signed-off-by: Christian Marangi <[email protected]>

sysrepo: correctly install .yang file with revision

With new sysrepo version, the .yang file are shipped with revision.
Update the package install to align to the new names.

The change of name doesn't cause regression as the revision is optional
on loading .yang files.

Signed-off-by: Christian Marangi <[email protected]>

libnetconf2: add pending patch to disable PAM support

Add pending patch to disable PAM support to limit need to add extra
dependency.

This is needed if libpam is selected as the package will detect the
library and enable support for it by default.

Signed-off-by: Christian Marangi <[email protected]>

libradiotap: backport upstream patch for CMake >= 4.0 support

Backport upstream patch for libradiotap for CMake >= 4.0 support.

Signed-off-by: Christian Marangi <[email protected]>

openthread-br: bump to 2025-06-12 and add patch for CMake >= 4.0 support

Bump to version 2025-06-12 and add pending patch for openthread-br for
CMake >= 4.0 support.

The package use an old cJSON version that cause compilation problem with
CMake >= 4.0 support. To handle this, add a pending patch to use an
external version of cJSON.

We already ship this package so it's trivial to use that instead of the
one in the openthread-br repository.

Signed-off-by: Christian Marangi <[email protected]>

taskwarrior: bump to 2.6.2 and backport patch for CMake >= 4.0 support

Bump taskwarrior to 2.6.2 release and backport upstream patch for
CMake >= 4.0 support.

Minor modification were done to the backport patch to adapt to release
2.6.2.

Signed-off-by: Christian Marangi <[email protected]>

rtty: backport upstream patch for CMake >= 4.0 support

Backport upstream patch for rtty for CMake >= 4.0 support.

Signed-off-by: Christian Marangi <[email protected]>

tar: fix EXTRA_DEPENDS

EXTRA_DEPENDS should be used for version constraints. Change to DEPENDS.

Fixes: 488be84 ("utils/tar: Make compression, acl, and xattr support configuration options")
Signed-off-by: George Sapkin <[email protected]>

ubnt-manager: fix EXTRA_DEPENDS

EXTRA_DEPENDS should be used for version constraints. Change to DEPENDS.

Fixes: e4a8d3f ("ubnt-manager: add ubnt-manager")
Signed-off-by: George Sapkin <[email protected]>

airos-dfs-reset: fix EXTRA_DEPENDS

EXTRA_DEPENDS should be used for version constraints. Change to DEPENDS.

Fixes: e36e8a6 ("airos-dfs-reset: add airos-dfs-reset")
Signed-off-by: George Sapkin <[email protected]>

rtpmidid: bump to version 24.12

Bump rtpmidid to version 24.12. The new release fix support for CMake >=
4.0 version and permit to drop all patch (everything is upstream)

Signed-off-by: Christian Marangi <[email protected]>

python-pycparser: update to version 2.23

Refresh patch

Release notes:
https://github.com/eliben/pycparser/releases/tag/release_v2.22
https://github.com/eliben/pycparser/releases/tag/release_v2.23

Signed-off-by: Josef Schlehofer <[email protected]>

python-setuptools-rust: update to version 1.12.0

Release notes:
https://github.com/PyO3/setuptools-rust/blob/main/CHANGELOG.md

Signed-off-by: Josef Schlehofer <[email protected]>

python-maturin: update to version 1.9.6

Release notes:
https://github.com/PyO3/maturin/releases/tag/v1.9.6

Signed-off-by: Josef Schlehofer <[email protected]>

python-zope-interface: update to 8.0.1

Release notes:
https://github.com/zopefoundation/zope.interface/blob/8.0.1/CHANGES.rst

Signed-off-by: Josef Schlehofer <[email protected]>