python-twisted: Update to 25.5.0

This update fixes CVE-2024-41810 and CVE-2024-41671 [1]. For the full
changelog see NEWS [2].

Additionally changed the way the test files are omitted from patch file
to filespec in the Makefile.

[1] https://github.com/twisted/twisted/blob/twisted-25.5.0/NEWS.rst#twisted-2470-2024-08-08
[2] https://github.com/twisted/twisted/blob/twisted-25.5.0/NEWS.rst

Signed-off-by: Richard Muzik <[email protected]>
(cherry picked from commit e09ffebce1b12fe883071e845ec1d618a15e00f3)

git: update to 2.50.1

- Refresh and rebase patches

Signed-off-by: Richard Muzik <[email protected]>
(cherry picked from commit a162c5dddc148f0ffe49add1afe1b59bcaf6d66d)

sudo: bump to version 1.9.17p2

This change bumps sudo to version 1.9.17p2

Signed-off-by: Alexandru Ardelean <[email protected]>
(cherry picked from commit 1e391d05205275c4f6304cf3c2595bf301726605)

lxc: update to 6.0.5

6.0.5 is a bug fix release, see:
https://discuss.linuxcontainers.org/t/lxc-6-0-5-lts-has-been-released/24438

Full changelog: https://github.com/lxc/lxc/compare/v6.0.4...v6.0.5

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc (Intel N150 based box)

Signed-off-by: John Audia <[email protected]>
(cherry picked from commit ab1f60b74d5614ed4a38627aaf467127ae96afd7)

lxc: update to 6.0.4

Added upstream patch to fix starting containers with complex hooks.
No existing patches needed to be rebased/simple version bump to 6.0.4.

Build system: x86/64
Build-tested: x86/64
Run-tested: x86/64

Signed-off-by: John Audia <[email protected]>
(cherry picked from commit 343f1151f9aa88a4798202a7d538c27ebcc00ac0)

lxc: add two files to default backup list

Users running unprivileged containers will need to create
/etc/subgid and /etc/subuid and want to have them preserved
across updates. This commit adds them to the default backup set.

Signed-off-by: John Audia <[email protected]>
Co-authored-by: Tianling Shen <[email protected]>
(cherry picked from commit 6fe80f5586bb8471d6e493a4e298e4b0da90a9bd)

lxc: lxc-checkconfig fix typo

Fix a typo introduced in https://github.com/openwrt/packages/pull/25719/commits/fd686a32209f74cd12ca434bc3245ef0f7589c46
which partially broke lxc-checkconfig

Build system: x86/64
Build-tested: bcm27xx/bcm2712
Run-tested: bcm27xx/bcm2712

Signed-off-by: John Audia <[email protected]>
(cherry picked from commit f32083fa27dddca5257af3549e070aab1c9c276e)

lxc: fix decompression of rootfs tarballs

Modified 025-remove-unsupported-option.patch to both remove
the bsdtar command as it ends in errors, see below, and to
circumvent an error when extracting to overlayfs[1].

Error when extracting rootfs tarball with bsdtar:
tar --absolute-names --numeric-owner '--xattrs-include=*' -xpJf /var/cache/lxc//download/archlinux/current/amd64//default/rootfs.tar.xz -C /mnt/data/lxc/test/rootfs
./usr/bin/newgidmap: Cannot restore extended attributes on this system: Illegal byte sequence
lxc-create: test: ../src/lxc/lxccontainer.c: create_run_template: 1589 Failed to create container from template
lxc-create: test: ../src/lxc/tools/lxc_create.c: lxc_create_main: 318 Failed to create container test

1. https://github.com/openwrt/openwrt/issues/15888

Signed-off-by: John Audia <[email protected]>
Build system: x86/64
Build-tested: x86/64/AMD Cezanne
Run-tested: x86/64/AMD Cezanne

Signed-off-by: John Audia <[email protected]>
(cherry picked from commit 96c96fe04115de8d46639aaeeb63b94ed5dcb325)

lxc: add gnu-tar as a depends to fix lxc-create

Add gnu-tar as a dependency for lxc-create which is needed to
properly extract the root file system tarball. Without it,
symlink target of /bin/tar is busybox and it lacks proper
support to extract with xattrs.  The default gnu-tar is actually
built without this support as well, but it is able to extract
the rootfs tarballs with a warning not an error which is not the
case with busybox which ends in an error.

Signed-off-by: John Audia <[email protected]>
Build system: x86/64
Build-tested: x86/64/AMD Cezanne
Run-tested: x86/64/AMD Cezanne

(cherry picked from commit b74dc8a119edd75454e03caa121ccb305fd29c3c)

lxc: add missing deps

Several deps are missing based the output of lxc-checkconfig shown below
before this commit is applied.

CONFIG_IP_NF_TARGET_MASQUERADE and CONFIG_IP6_NF_TARGET_MASQUERADE are
only needed for lxc-net which we do not package.

% lxc-checkconfig | grep missing
Cgroup device: missing
CONFIG_IP_NF_TARGET_MASQUERADE: missing
CONFIG_IP6_NF_TARGET_MASQUERADE: missing
CONFIG_NETFILTER_XT_TARGET_CHECKSUM: missing
FUSE (for use with lxcfs): missing
checkpoint restore: missing
CONFIG_UNIX_DIAG: missing
CONFIG_INET_DIAG: missing
CONFIG_PACKET_DIAG: missing
CONFIG_NETLINK_DIAG: missing

Additionally, two new patches have been added which remove checks for
options that OpenWrt currently does not package and can serve are
false positives for missing items from our kernel config, namely:
lxc-net and lxc-checkpoint

After applying this commit, below is the output showing that the kernel
config[1] should pass all tests for functionality:

% CONFIG=config ./lxc-checkconfig
LXC version 6.0.3

--- Namespaces ---
Namespaces: enabled
Utsname namespace: enabled
Ipc namespace: enabled
Pid namespace: enabled
User namespace: enabled
Network namespace: enabled
Namespace limits:
  cgroup: 383849
  ipc: 383849
  mnt: 383849
  net: 383849
  pid: 383849
  time: 383849
  user: 383849
  uts: 383849

--- Control groups ---
Cgroups: enabled
Cgroup namespace: enabled
Cgroup v1 mount points:
Cgroup v2 mount points:
 - /sys/fs/cgroup
Cgroup device: enabled
Cgroup sched: enabled
Cgroup cpu account: enabled
Cgroup memory controller: enabled
Cgroup cpuset: enabled

--- Misc ---
Veth pair device: enabled, loaded
Macvlan: enabled, not loaded
Vlan: enabled, not loaded
Bridges: enabled, loaded
Advanced netfilter: enabled, loaded
CONFIG_NETFILTER_XT_TARGET_CHECKSUM: enabled, not loaded
CONFIG_NETFILTER_XT_MATCH_COMMENT: enabled, loaded

--- Checkpoint/Restore ---
checkpoint restore: missing
CONFIG_FHANDLE: enabled
CONFIG_EVENTFD: enabled
CONFIG_EPOLL: enabled
CONFIG_UNIX_DIAG: enabled
CONFIG_INET_DIAG: enabled
CONFIG_PACKET_DIAG: enabled
CONFIG_NETLINK_DIAG: enabled
File capabilities: enabled

1. Generated on 23-Feb-2025 running bcm27xx/bcm2712 on r28869+1

Signed-off-by: John Audia <[email protected]>
(cherry picked from commit ba7e4dccec3508c72bae7939d649b17aa9d4faaf)

lxc: remove check for options we do not package

We do not package lxc-net or lxcfs so remove the lines within
lxc-checkconfig that looks forCONFIG_IP_NF_TARGET_MASQUERADE and
CONFIG_IP6_NF_TARGET_MASQUERADE which, as far as I know, is the only
part of lxc that needs them. Also remove the check for FUSE since we do
not pakcage lxcfs.

Without this commit, users will see these two as missing.

Signed-off-by: John Audia <[email protected]>
(cherry picked from commit 57434a290d1f29112e130620531286845476d63c)

lxc: update to 6.0.3

No patches needed to be rebased/simple version bump.

Build system: x86/64
Build-tested: x86/64
Run-tested: x86/64

Signed-off-by: John Audia <[email protected]>
(cherry picked from commit f8587b9ec49a77ea4f2663853e257fe61e2d052e)

subversion: update to 1.14.5

update to 1.14.5

Signed-off-by: Aleksey Vasilenko <[email protected]>
(cherry picked from commit 9443e91b6e817ec0eb53bb08d3bec13df2fee06b)

ffmpeg: update to 6.1.3

- Remove 2 upstreamed patches

Signed-off-by: Aleksey Vasilenko <[email protected]>
(cherry picked from commit 114f412408922f39e11b9f1365003f6a9ca563ec)

ffmpeg: add libatomic dependency

Some platforms lack builtin atomics and use libatomic. Add it.

Backport various patches to fix some warnings.

Signed-off-by: Rosen Penev <[email protected]>
(cherry picked from commit e64ca4a0dc53fb6496fbb4c7842d60303bd1d012)

ffmpeg: fix compilation with GCC14

Upstream backport.

Signed-off-by: Rosen Penev <[email protected]>
(cherry picked from commit ac258c05ecadc79de47e51e1df5ecdde75f0abea)

nut: switch to https:// download URL

Signed-off-by: Sebastian Hamann <[email protected]>
(cherry picked from commit f5371ab4347ea1104a0e3c4075fb071947075216)

ruby: update to 3.3.9

3.3.9 release includes the following security fix of default gems:

- CVE-2025-24294: Possible Denial of Service in resolv gem

And the following fixes for build issues:

- GCC 15.1
- Visual Studio 2022 Version 17.14

3.3.7 and 3.3.8 are routine update that includes minor bug fixes.

Signed-off-by: Luiz Angelo Daros de Luca <[email protected]>
(cherry picked from commit 59880e81a62446b44106d8d3455583e2d414c2c4)

ruby: update to 3.3.6

Ruby 3.3.6 is a routine update that includes minor bug fixes. It also
stops warning missing default gem dependencies that will be bundled gems
in Ruby 3.5.

Link: https://github.com/ruby/ruby/releases/tag/v3_3_6
Signed-off-by: Luiz Angelo Daros de Luca <[email protected]>
(cherry picked from commit 2b999558db0711124f7b5cf4afa201557352f694)

ruby: include JSON modules in host build

Ruby JSON modules are used to build WebKitGTK.
Include them in the host build.

Signed-off-by: Daniel Golle <[email protected]>
(cherry picked from commit c667ae2efb4ad66d80f2bbc1348eda53a7e2049d)

gihub: fix PR template broken URL

changes the relative URL in the PR template to an absolute URL
to resolve a "Not Found" error.

Signed-off-by: Wesley Gimenes <[email protected]>
(cherry picked from commit ae6fd69de587bb450ce868416be03fbc782c9e4e)

realtek-poe: increase version to 1.3

* Add support for RTL8238B

Signed-off-by: Carl-Daniel Hailfinger <[email protected]>
(cherry picked from commit a80cc41f202b1ce48cd017560eb413f995313b2d)

python3: update to version 3.11.13

Release notes:
https://docs.python.org/release/3.11.13/whatsnew/changelog.html#python-3-11-13

Fixes CVEs:
CVE 2024-12718
CVE 2025-4138
CVE 2025-4330
CVE 2025-4517

Patch refreshed

Signed-off-by: Josef Schlehofer <[email protected]>
(cherry picked from commit 3686cbe4177972f564380f9e691cd4530a9b88b9)

dufs: Update to 0.45.0

Removed upstreamed patches.

Release note: https://github.com/sigoden/dufs/releases/tag/v0.45.0

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit f7df64100dbff95a6bc715d3f5d2bb27d8644d3b)

dufs: backport upstream fixes

Including one security fix.

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit bc2d10333b54ab71b7163538bb1bcc69df034053)

dufs: Update to 0.44.0

Release note: https://github.com/sigoden/dufs/releases/tag/v0.44.0

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 0cb83250b3ec25b9fae92b2cf0fa272dc22cf93a)

openlist: Update to 4.1.2

Release note: https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.2

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 23475cb50ee281f1a753fd6b7c636475daf73b0c)

openlist: Update to 4.1.1

Release note: https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.1

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 713b37dd200c0c1e0899907535a5b3ca62c86d6d)

v2ray-geodata: Update to latest version

Update all geodata.

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 9690cb87d1e8ef455984dd657410942489c57b8d)

v2ray-geodata: Update to latest version

Update all geodata.

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 802e874d744e4575ccc40c1c15ead3327d7d715b)

sing-box: Properly set only the full variant as default

Adjust the variant definition so that DEFAULT_VARIANT is only applied
to the full variant.
Set the title of the full variant to 'full' for menuconfig.

Signed-off-by: Hannu Nyman <[email protected]>
(cherry picked from commit 2e2cc335a6968bad3b4ade69ca53831d91aa9c6f)

sing-box: add variant tiny

The tiny version disables tailscale by default for small package size.
OpenWrt also has the tailscale package as an alternative. We prefer
to keep the base version has the same build tags with the upstream
releases for compatibility.

Signed-off-by: Van Waholtz <[email protected]>
(cherry picked from commit 16ada8307b0170bb4343ae7e163bd3dc9aa98b49)

sing-box: Update to 1.12.4

changelog: https://github.com/SagerNet/sing-box/releases/tag/v1.12.4

Signed-off-by: Anton P. <[email protected]>
(cherry picked from commit 28ac7b8dc14bb46efd8f8ed8d7e4ca516674808c)

libtorrent-rasterbar: update boost dependencies

libtorrent only links to boost headers since boost 1.69.
Remove boost-system from the dependencies and add boost as build
dependency.

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 7be94fac3708ba2ae15abcb2a92435a57b05dd37)

owut: update to 2025.09.03

Bug fixes:
    efahl/owut@5743eea3bcda owut: suppress all but json output when using dump
    efahl/owut@efe39e2e3897 owut: handle sigint (ctrl-c) properly
Enhancements:
    efahl/owut@49e9bce7b8c3 owut: provide download progress for slow connections

Signed-off-by: Eric Fahlgren <[email protected]>
(cherry picked from commit 96ab3378d0d9ff90a5c9a5c676ada64501a8c501)

yt-dlp: bump to 2025.08.22

Changelog: https://github.com/yt-dlp/yt-dlp/releases/tag/2025.08.22
Signed-off-by: George Sapkin <[email protected]>
(cherry picked from commit e604458151433192273c0202185b33e97ce96b01)

adblock-fast: update to 1.1.4-r12

README:
* update header

Init-script:
* set an earlier start to get triggers to work
* better str_contains
* improve readability of json() by getting rid of cascading case statements
* add new errors/status messages to get_text()
* prepare get_text() for localization by switching to inline printf
* adjust shellcheck disable comments where needed
* parse unbound config for DNS hijack ports
* test if the archived cache exists on boot and proceed to use it if it does
* add trigger waiting status so that luci app can display correct status
* do not run adb_config_update on boot, speeding up trigger setup

Signed-off-by: Stan Grishin <[email protected]>
(cherry picked from commit ea6111a4a041694258d36eda1b3abd9847bb09c8)

libradcli: fix build options

The provided Config.in was never sourced from the Makefile, making it
impossible to toggle TLS support.

This commit adds the necessary Makefile glue to fix this.

Also default to TLS disabled, as was the de-facto case since Config.in
was never sourced (and thus the default 'y' never enabled).

Signed-off-by: Thibaut VARÈNE <[email protected]>
(cherry picked from commit 5ffca82f54e7bb611c04ddcc60ee3f81f36cf77e)

sing-box: Revert "sing-box: update to 1.12.3"

This reverts commit 6356527dd50cd86d8ad16af0ac552603b7b84957.

sing-box 1.12.3 is apparently buggy and crashes.
Reference to #27346 and #27339
Let's revert the upgrade.

Signed-off-by: Hannu Nyman <[email protected]>

yggdrasil: update to 0.5.12

Signed-off-by: Ivan Chashkin <[email protected]>

uradvd: provide warning upon disabled configuration

which grants clarity and better traceability.

Signed-off-by: Jan-Niklas Burfeind <[email protected]>
(cherry picked from commit e7a46671756d190309f7b6d03a129373d847306e)

uradvd: Update to 2025-08-16

Provide four new options:
--valid-lifetime
--preferred-lifetime
--max-router-adv-interval
--min-router-adv-interval

Signed-off-by: Jan-Niklas Burfeind <[email protected]>
(cherry picked from commit b2f14a5e8dc963a77d9292af7332af08973a9ba8)

lf: update to r36

https://github.com/gokcehan/lf/releases/tag/r36

Signed-off-by: Nate Robinson <[email protected]>
(cherry picked from commit 0715dff919ffba355d35c9f911c9c31111ae9c70)

lf: add new package

https://github.com/gokcehan/lf

Signed-off-by: Nate Robinson <[email protected]>
(cherry picked from commit 7e362a6e3581a0f0c6b12bc8f1f9e26d2ff7f78e)

sing-box: update to 1.12.3

changelog: https://github.com/SagerNet/sing-box/releases/tag/v1.12.3

Signed-off-by: Gregory Gullin <[email protected]>
(cherry picked from commit 002e0559a5f3339fd5232a6e63cc00ce6886b3ab)

nano: Update to 8.6

Update nano editor to version 8.6

Signed-off-by: Hannu Nyman <[email protected]>
(cherry picked from commit 61f29f743529bfca26fbc81eb7f927bf7f3b6712)

owut: update to 2025.08.15

Bug fixes:
    efahl/owut@c6e75716d1a3 init: fix typo in file name
    efahl/owut@7f97ab67c2f5 examples: improve docs for writing pre-install scripts
Enhancements:
    efahl/owut@93f2b06b8882 owut: utilize upstream limits instead of hardcoded values
    efahl/owut@7a45c412fc96 owut: improve usability of 'dump' option
    efahl/owut@35720e369ac0 owut: improve age reporting

Signed-off-by: Eric Fahlgren <[email protected]>
(cherry picked from commit c79bed5fd542550024931fb809c2699937eca19f)

python-urllib3: update to 2.0.7

Fix CVE-2023-45803 and CVE-2023-43804.

Full changelogs:
- https://github.com/urllib3/urllib3/releases/tag/v2.0.5
- https://github.com/urllib3/urllib3/releases/tag/2.0.6
- https://github.com/urllib3/urllib3/releases/tag/2.0.7

Signed-off-by: Wei-Ting Yang <[email protected]>
(cherry picked from commit 23646be59e7a3c15e60b1d210d975b647cd46dd9)

Revert "gping: lock cargo dependencies"

It's enabled by default now.
Make use of MAKE_PATH while at it.

This reverts commit 0118fb489659088565f948994d7c81d9f41a20a1.

Signed-off-by: Tianling Shen <[email protected]>

dufs: remove `--locked` flag

It's enabled by default now.

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit ee49f00287655b3512785c0b286cfaa185452dee)

rust: read build path from `{HOST_}MAKE_PATH`

Allow set build path by `{HOST_}MAKE_PATH`.

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 84cb850b7f967c2ed7ec4fdb55e8655a245f16dd)

rust: introduce `RUST_{HOST,PKG}_LOCKED` flag

Introduce `RUST_{HOST,PKG}_LOCKED` flag (enabled by default) to respect
upstream lockfile. This can be disabled by setting it to 0 if you want
to have up-to-date dependencies.

This change also adds new `CARGO_{HOST,PKG}_ARGS` variable to pass extra
build arguments to cargo.

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 1000e99185ec9faaa846aeef43ca3cf72f199d5d)

pbr: 1.1.8-36 bugfixes

- drop load_environment_flag and always load environment on start, making
  restart command great again
- store/restore existing jshn namespace when using json()
- remove unneeded sleepCount in is_wan_up()
- move updated README inside files/

Signed-off-by: Stan Grishin <[email protected]>
(cherry picked from commit 51686912e0f3552bacd8ef7cf980f270c2fa3ec4)

yt-dlp: bump to 2025.08.11

Changelog: https://github.com/yt-dlp/yt-dlp/releases/tag/2025.08.11
Signed-off-by: George Sapkin <[email protected]>
(cherry picked from commit 9318a5fefbec3cae39d328b02dc6a5ca1e1d3b7b)

golang: bump to 1.23.12

go1.23.12 (released 2025-08-06) includes security fixes to the
database/sql and os/exec packages, as well as bug fixes to the runtime.

Fixes: CVE-2025-47907
Link: https://github.com/golang/go/issues?q=milestone%3AGo1.23.12+label%3ACherryPickApproved
Signed-off-by: George Sapkin <[email protected]>

lttng-tools: fix build with libxml 2.14

Backport a pending patch to fix build with libxml 2.14.

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 0ec95bd1f4dc9b829081bfd7910220d530517591)

pbr: update to 1.1.8-34

* bugfix: json init was destroying procd_triggers and screwing boot up
  fixes https://github.com/openwrt/packages/issues/27194
* improvement: explicit printf calls in get_text

Signed-off-by: Stan Grishin <[email protected]>
(cherry picked from commit a49f1e26101805537aabed56cdafbe0331aadbc5)

gping: lock cargo dependencies

The new version of dns-lookup failed to build with musl:

error[E0308]: mismatched types
   --> gping/src/main.rs:331:19
    |
331 |         Ok(ip) => ip,
    |                   ^^ expected `Vec<IpAddr>`, found opaque type
    |
   ::: /builder/shared-workdir/build/sdk/dl/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/dns-lookup-2.1.0/src/lookup.rs:17:46
    |
17  | pub fn lookup_host(host: &str) -> io::Result<impl Iterator<Item = IpAddr> + use<>> {
    |                                              ------------------------------------ the found opaque type
    |
    = note:   expected struct `Vec<IpAddr>`

Signed-off-by: Tianling Shen <[email protected]>

gping: update to 1.18.0

Signed-off-by: Jonas Jelonek <[email protected]>
(cherry picked from commit c3dcb6c152ae60523d18e405a802a99d000b1344)

sing-box: update to 1.12.0

changelog: https://github.com/SagerNet/sing-box/releases/tag/v1.12.0

Signed-off-by: Gregory Gullin <[email protected]>
(cherry picked from commit 654fa2f5f3842b85672bb1d9a277a438672bb347)

mariadb: update to 11.4.7

Use upstream solutions to local patches.

Remove test.sh as it's broken.

Signed-off-by: Rosen Penev <[email protected]>
(cherry picked from commit cf6ef1ac5a706101739577a63fea07f9cea33072)

mariadb: fix liburing dependency

CMake is way too opertunistic. Avoid the dependency by manually handling
it.

Signed-off-by: Rosen Penev <[email protected]>
(cherry picked from commit 9d12a9618a09c2e614ec5b2220ad3c6127e643ef)

mariadb: update to 11.4.4

Remove upstreamed patch.

Signed-off-by: Rosen Penev <[email protected]>
(cherry picked from commit f640d92aa4327b6432ca4a67040c7f9fe3b468b4)

sqlite3: bump to 3.50.4

Changelog: https://sqlite.org/releaselog/3_49_2.html
Changelog: https://sqlite.org/releaselog/3_50_0.html
Changelog: https://sqlite.org/releaselog/3_50_1.html
Changelog: https://sqlite.org/releaselog/3_50_2.html
Changelog: https://sqlite.org/releaselog/3_50_3.html
Changelog: https://sqlite.org/releaselog/3_50_4.html
Signed-off-by: George Sapkin <[email protected]>
(cherry picked from commit 810341cf3303e2fdb3241e1aa20e4b213ff0f7d3)

sqlite3: require matching lib version in shell

Shell expects a matching library version to be installed. Specify a
matching version using EXTRA_DEPENDS.

Signed-off-by: George Sapkin <[email protected]>
(cherry picked from commit 5b8e0fd4646ff3d7964d5ddbc9cabe98d3d3e6ce)

uspot: update to Git HEAD (2025-08-07)

e2e3c649ab80 README update
18e6bcc14cc2 uspot/portal: urldecode FORM POST data
bf6051dba822 uspot/handler-uam: accept /login endpoint
32273591d8d5 uspotfilter: provide peer_lookup answers only for known clients
b0aeef9973a9 README: clarify uam vs radius mode features
b7b0d0efb0e2 uspot: improve config documentation
bce68a97fad8 captive: rename to 'uspot'
da6ca713e15d uspot: client_remove(): pass device to ratelimit client_delete()
3ebfe262bfb1 uspot: remove unused radius_call() args
691d73aa00dc uspot: let radius_init() set all required payload members
be50a66b777f uspot: allow setting global bandwidth limits
4851ada4b0c0 uspot: send Called-Station-Id in Acct-On/Off requests
0974fc8d47ac Implement uspot-bpf, an eBPF traffic counter
e99809f97e34 introduce uspotbpf.uc
7f6f43883568 uspotbpf: work around ucode-mod-bpf bug
319e0c285afb uspot: hook traffic accounting
ccf3fa9b8e83 uspot: client_interim(): remove dead code
0e92cc9f6e75 uspotbpf: fix priority conflict with ratelimit
55d40a8794b6 uspot: implement traffic limiting
b05257e862cb uspot: implement swapio
e83f95081c21 uspot: radius_acct(): don't needlessly call uspotfilter
442cff773220 uspotfilter: cleanup unused API
7878d512cd21 handler-api: include 'seconds-remaining' only if not captive
cca6d218a6a7 handler-api: implement 'bytes-remaining'
e8cf3d08ac64 uspot: start(): ratelimit clearing is independent from RADIUS accounting
6d12a2da5b20 README update
bf6364cb61ea config: clarify units for acct_interval
8133b8cd215e uspot: implement state_get()/state_set()
094825fdfe68 radius-client: lowercase non-attribute JSON members
de70c588c2e3 radius-client: add error reporting
ebe9eac34f5b radius: add option for udp or tcp connection
d6b338d5d194 uspot: support RadSec with PSK authentication
53de77512159 uspot: validate config
d0578f740111 uspot: don't store debug data through uspotfilter
fe4fa5e8a25f uspot.init: rename DAS instance
bd1fbe481da3 README update
76a03155db44 uspot: add support for secondary RADIUS servers
694ff75f4fcc uspot: remove 'final_redirect_url' config option
a347454db08c handler: redirect UAM connected clients to the 'res=already' UAM url
0ea8f9bec545 handlers: simplify auth check
f69e1df8db0f Improve RADIUS error handling and reporting
34216b56b9ed src/CMakeLists: disable -Werror
8599a968877b Makefile: sync with OpenWrt repo

Update Makefile to reflect addition of the eBPF module and other changes
in the package

Signed-off-by: Thibaut VARÈNE <[email protected]>
(cherry picked from commit 3d76208b4dc65c9fd45d51c58e09300c77c33906)

aliyun-cli: add new package

The Alibaba Cloud CLI is a tool to manage and
use Alibaba Cloud resources through a command line interface

Signed-off-by: Bruce Chen <[email protected]>
(cherry picked from commit f6e404e96d0a263e94f3183de0bb5139a3dc1099)

kmod: fix build failure in install step over dirty build dir

When building kmod-32 package for the first time (clean build_dir), it
builds and installs fine. When building for 2nd time, sometimes
(probably some race condition?) it fails to build in install step with
following error:

  for tool in insmod lsmod rmmod depmod modprobe modinfo; do \
   ln -s kmod /tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/$tool; \
  done
  ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/insmod': File exists
  ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/lsmod': File exists
  ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/rmmod': File exists
  ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/depmod': File exists
  ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/modprobe': File exists
  ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/modinfo': File exists

Lets fix it by backporting upstream fix.

Fixes: #27171
Link: https://lore.kernel.org/r/[email protected]
Upstream-Status: Backport [https://github.com/kmod-project/kmod/commit/c5054b215089f9e3cdc9602232649c2b5b1de743]
Signed-off-by: Petr Štetiar <[email protected]>
(cherry picked from commit 79f78c0e77e61a20063db53f6cf8a12768036cdf)

inih: Update to r61

Release note: https://github.com/benhoyt/inih/releases/tag/r61

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit f6f3f4c5fdfb6fccd1520f63f9d281b971cb78ad)

openlist: Update to 4.1.0

Release note: https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.0

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 1f4064269fbf673952a23eb97843f49ee6ee8263)

openlist: Update to 4.0.9

Release note: https://github.com/OpenListTeam/OpenList/releases/tag/v4.0.9

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit dd6e44068f872a636f9cca296d97c498681e5de4)

rclone: backport ftp insecure TLS ciphers fix

Added config field to allow insecure TLS ciphers that were disabled
in Go 1.22.

Fixes: #27039
Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 80e343dd434f53a4019f56920ac4a748e046fb9c)

golang: disable build for powerpc64

e5500 is the only powerpc64 target we have in tree, but it's not
supported by golang[1]. Since it's hard to opt e5500 out from the
supported arch list, simply remove powerpc64 from it for now.

1. https://github.com/golang/go/issues/19074

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit c8ad05854dd46baf19bdf2b8de86a31da5b9e046)

adblock-fast: update to 1.1.4-4

Makefile:
  - bugfix: change references to melmac.net to melmac.ca

README:
  - add basic README with the link to full documentation

Config:
  - add heartbeat_domain
  - add heartbeat_sleep_timeout
  - add sanity_check
  - add update_config_sizes

Init Script:
  - a lot of visual output improvements, especially with verbosity=2
  - better output separation for different verbosity levels
  - removed unneeded runningErrorFile
  - bugfix: updated runningConfigFile
  - updated runningStatusFile and added runningStatusFileLock
  - moved append_url() higher up for better visibility
  - refactor force-redownload/restart on some config changes functionality
  - improve count_blocked_domains
  - add internal debug_log() for debugging functions where output is captured
  - unified all json add/get calls in the same formatting
  - major rework on json() to allow storing of error/warning messages as json objects
  - added some error/warning messages
  - renamed `cache()` function to `adb_file()` to better reflect functionality
  - added functionality to test the dnsmasq config before restarting dnsmasq with ad-blocking
  - added functionality to throw warnings if TLDs or leading-dot domains are discovered
    in the final block-list file (can be disabled by `sanity_check` option)
  - added functionality to test DNS resolution after resolver restart with `heartbeat_domain`
    for `heartbeat_sleep_timeout` seconds
  - added functionality to revert the resolver's config/ad-blocking if heartbeat domain cannot
    be resolved after resolver restart
  - added `ALLOWED_TMP` variable/file for better processing of external allow-lists
  - added debug output to log with the elapsed time for each step of processing
  - drastically improved final block-list optimization with the new awk script
  - minor other performance improvements
  - added check_tld/check_leading_dot CLI commands to show domains breaking sanity checks
  - added validate functions to triggers

Bugfixes:
  - fixes: https://github.com/openwrt/packages/issues/27146
  - supercedes: https://github.com/openwrt/packages/pull/27159

Signed-off-by: Stan Grishin <[email protected]>
(cherry picked from commit af75ccbb4f2704a020bfc21ecf8e69172fb1e90c)

hev-socks5-tunnel: update to 2.13.0

Upstream changelog:
https://github.com/heiher/hev-socks5-tunnel/releases/tag/2.13.0

Signed-off-by: Ray Wang <[email protected]>
(cherry picked from commit 4c73e7f8bf9e80d556d456c0b95d29e61b766d4f)

pbr: update to 1.1.8-32

Makefile:
  - add SPDX-Identifier-License
  - update Copyright

README:
  - add basic README with the link to full documentation

Config:
  - add debug_dnsmasq
  - add procd_boot_trigger_delay

Init Script:
  - move extra_command calls high up for visibility
  - bump packageCompat to sync with luci app
  - implement support for debug_dnsmasq to dump dnsmasq debug into $packageDebugFile
  - create $runningStatusFile json-file allowing more verbose errors/warnings messages
  - replaced `state add` calls with json add calls to store errors/warnings messages
  - remove no longer needed errorSummary, warningSummary
  - ensure environment is only loaded once per run via $load_environment_flag
  - bugfix: update is_{host,hostname,domain,ipv4,mac_address} functions to properly sort policy entries
  - bugfix: change references to melmac.net to melmac.ca
  - add some new error/warning messages
  - add delay before service is started on boot via procd_boot_trigger_delay
  - bugfix: add logic to identify unknown policy entries instead of silently failing on them
  - store error/warning messages as json objects in ubus data for luci app
  - update load_validate_config with debug_dnsmasq and procd_boot_trigger_delay entries

Signed-off-by: Stan Grishin <[email protected]>
(cherry picked from commit 4b831c6dbf3b432dd44b4f07e06a379c679b6132)

banIP: update 1.5.6-7

* skip rdap requests/replies with placeholders for all IPv4/IPv6 addresses
* sanitize possible bogus config values, e.g. '/dev/null' as a directory
* change URL for beycyber feed

Signed-off-by: Dirk Brenken <[email protected]>
(cherry picked from commit ac1076ef9530138e7c84d2858d5cf2b5d8c74e02)

php8: update to 8.3.24

Upstream changelog:
https://www.php.net/ChangeLog-8.php#8.3.24

Signed-off-by: Michael Heimpold <[email protected]>

openlist: Remove dependency on fuse

Fixes https://github.com/openwrt/packages/issues/27011

Signed-off-by: Liangbin Lian <[email protected]>
(cherry picked from commit 68c60fdc5d8b42b3179fc341e6033288f1aaad06)

docker-compose: Update to version 2.39.1

Release notes:
https://github.com/docker/compose/releases/tag/v2.39.1

Signed-off-by: Javier Marcet <[email protected]>
(cherry picked from commit e3395ec43c4a51256a8e4c355e631b140ab86977)

docker-compose: Update to version 2.38.2

Release notes:
https://github.com/docker/compose/releases/tag/v2.38.2

Signed-off-by: Javier Marcet <[email protected]>
(cherry picked from commit 362b8cda741bf27008b67466c986c8f362ddd297)

docker-compose: Update to version 2.38.1

Release notes:
https://github.com/docker/compose/releases/tag/v2.38.1

Signed-off-by: Javier Marcet <[email protected]>
(cherry picked from commit 0ea85424be8c9f6f1a04a6e7e5ee388fb2a9e5bd)

docker-compose: Update to version 2.38.0

Release notes:
https://github.com/docker/compose/releases/tag/v2.38.0

Signed-off-by: Javier Marcet <[email protected]>
(cherry picked from commit ce5dfd527babf2ce0145e7fa754004bc6fb39fc5)

docker-compose: Update to version 2.37.3

Release notes:
https://github.com/docker/compose/releases/tag/v2.37.3

Signed-off-by: Javier Marcet <[email protected]>
(cherry picked from commit 04493a8a8f49a2e1f9a922fd70bec77eeffb896e)

docker-compose: Update to version 2.37.2

Release notes:
https://github.com/docker/compose/releases/tag/v2.37.2

Signed-off-by: Javier Marcet <[email protected]>
(cherry picked from commit 3b2a63dae229f40c4f15a28ab06da36a9c420cfe)

docker-compose: Update to version 2.37.1

Release notes:
https://github.com/docker/compose/releases/tag/v2.37.1

Signed-off-by: Javier Marcet <[email protected]>
(cherry picked from commit 18557c85477678a504564b56ce4d4759e5ba600f)

docker-compose: Update to version 2.37.0

Release notes:
https://github.com/docker/compose/releases/tag/v2.37.0

Signed-off-by: Javier Marcet <[email protected]>
(cherry picked from commit d1422dda41cee99f6ab9c0f302edbbdc95c247bc)

docker-compose: Update to version 2.36.2

Release notes:
https://github.com/docker/compose/releases/tag/v2.36.2

Signed-off-by: Javier Marcet <[email protected]>
(cherry picked from commit e344fcc369f131eeb36afff0e5373b25be05fb84)

docker-compose: Update to version 2.36.1

Release notes:
https://github.com/docker/compose/releases/tag/v2.36.1

Signed-off-by: Javier Marcet <[email protected]>
(cherry picked from commit 4ac47971db43117517bf86cbdcb8440a73e1f2dd)

docker-compose: Update to version 2.36.0

Release notes:
https://github.com/docker/compose/releases/tag/v2.36.0

Signed-off-by: Javier Marcet <[email protected]>
(cherry picked from commit 7f0b4e4bf5ca9d460eeba415945a5205c1afd8e4)

docker-compose: Update to version 2.35.1

Release notes:
https://github.com/docker/compose/releases/tag/v2.35.1

Signed-off-by: Javier Marcet <[email protected]>
(cherry picked from commit 5af23930d36d75f2caad295983eef8be27ab1274)

docker-compose: Update to version 2.35.0

Release notes:
https://github.com/docker/compose/releases/tag/v2.35.0

Signed-off-by: Javier Marcet <[email protected]>
(cherry picked from commit daa3161704782712a20dae2e3630fe6564cb06e7)

docker-compose: Update to version 2.34.0

Release notes:
https://github.com/docker/compose/releases/tag/v2.34.0

Signed-off-by: Javier Marcet <[email protected]>
(cherry picked from commit 0129618ea65f012c9a30e0ee19b990dcbb2aba7e)

docker-compose: Update to version 2.33.1

Release notes:
https://github.com/docker/compose/releases/tag/v2.33.1

Signed-off-by: Javier Marcet <[email protected]>
(cherry picked from commit 034505d9698f14eb98e9b7d09f1fdc64e8032aaa)

docker-compose: Update to version 2.33.0

Release notes:
https://github.com/docker/compose/releases/tag/v2.33.0

Signed-off-by: Javier Marcet <[email protected]>
(cherry picked from commit 0f9bcfa8d8f3117a2a4932e384791c0df343d790)

docker-compose: Update to version 2.32.4

Release notes:
https://github.com/docker/compose/releases/tag/v2.32.3
https://github.com/docker/compose/releases/tag/v2.32.4

Signed-off-by: Javier Marcet <[email protected]>
(cherry picked from commit 4055a2b0a5ac35c73f67b4e773b9d6748df5854d)

docker-compose: Update to version 2.32.2

Release notes:
https://github.com/docker/compose/releases/tag/v2.32.2

Signed-off-by: Javier Marcet <[email protected]>
(cherry picked from commit b7974fb6d2500075c84f51bebf01a79646990ae4)

docker-compose: Update to version 2.32.1

Release notes:
https://github.com/docker/compose/releases/tag/v2.32.1

Signed-off-by: Javier Marcet <[email protected]>
(cherry picked from commit de758f96decedca29cc3b8a0edf8e6aa287b81c8)

docker-compose: Update to version 2.32.0

Release notes:
https://github.com/docker/compose/releases/tag/v2.32.0

Signed-off-by: Javier Marcet <[email protected]>
(cherry picked from commit 95d201c2602fc94252794207bc6835d83006a871)

docker-compose: Update to version 2.31.0

Release notes:
https://github.com/docker/compose/releases/tag/v2.31.0

Signed-off-by: Javier Marcet <[email protected]>
(cherry picked from commit 278b9d1f63248b2673516b3e29442460ac8e2b4f)