python-hatchling: update to version 1.27.0

Release notes:
https://github.com/pypa/hatch/releases/tag/hatchling-v1.27.0

Signed-off-by: Josef Schlehofer <[email protected]>
(cherry picked from commit 4d521dfbeb99cd3800791eabc71248422ca6de06)

python-packaging: update to 25.0

Changelogs can be found in https://github.com/pypa/packaging/releases.

Signed-off-by: Wei-Ting Yang <[email protected]>
(cherry picked from commit 7289cb01199ab254ad1bc8f1526e242380ee4db7)

ksmbd-tools: update to 3.5.5

Major change is:
 - set server signing to auto by default.

In recent versions of Windows 11, server signing is required.
However, server signing is disabled by default in ksmbd server.
So It is recommended to set server signing = auto as default,
so that it is used whenever it is required.

Signed-off-by: Andrea Pesaresi <[email protected]>
(cherry picked from commit a7d51c511cfc4fcfcecbd95b9b5dd02fe8c9439d)

ksmbd-tools: bump to 3.5.4

The major changes are:
 - Add max ip connections parameter. (ready for future upstream fix) at the moment is reverted by: https://github.com/openwrt/openwrt/commit/18bdeda0113d28170a20e550f45641450089a070
 - unlock follow symlinks parameter to support symlink.
 - send bind_interfaces_only parameter to ksmbd.

Signed-off-by: Andrea Pesaresi <[email protected]>
(cherry picked from commit 47f1bfa717eb28c038cabc6155ffa3a03b8b9c5c)

ksmbd-tools: adjust smb2 max read/write/trans and cache

Now for all devices with every size of RAM it is set to:
`smb2 max read = 64K`
`smb2 max write = 64K`
`smb2 max trans = 64K`

Instead of fixed value to 64K is better to check RAM size and adjust to:

32 ~ 64MB RAM, set the value to 64K
64 ~ 128MB, set it to 128KB
128 ~ 256MB, set it to 1MB
More than 256MB leave default size to 4MB

With 64MB and 128MB is better also to disable the read/write cache
`cache read buffers = no`
`cache write buffers = no`

Signed-off-by: Andrea Pesaresi <[email protected]>
(cherry picked from commit 0ca4794564eb7294832636cf46ade680372edebf)

travelmate: update 2.2.1-2

- fix a logical glitch in opensta-handling
- add a list option  'trm_ssidfilter' to maintain a list of SSID patterns
   for filtering/skipping specific open uplinks, e.g. 'Chromecast*' (fix #26406)

Signed-off-by: Dirk Brenken <[email protected]>
(cherry picked from commit 65b935cb5861c5a725c480fdd374f2e2d59ef848)

znc: do not watch znc.conf for changes

ZNC can modify its own config file (znc.conf) during runtime, for
example using controlpanel or webadmin modules. Manually editing the
znc.conf file while znc is running is strongly discouraged.

Thus prodc should not watch this file, it would just lead to znc being
restarted unnecessarily.

As it happens, no restarts were done, because the watched path was
specified incorrectly. It used ZNC_CONFIG instead of ZNC_CONFIG_DIR,
and so it watched /tmp/etc/znc/configs/znc.conf/configs/znc.conf which
does not exist.

Remove the watch of znc.conf as it is not needed.

Signed-off-by: Ralph Siemsen <[email protected]>
(cherry picked from commit 00feb12444c846f1655a3c550c9f751ae552b24b)
Signed-off-by: Jonas Gorski <[email protected]>

travelmate: release 2.2.1

- add a new lan/wan subnet check, to to show conflicts with router LAN network
- clean up bogus debug log outputs
- minor code clean ups
- readme update

Signed-off-by: Dirk Brenken <[email protected]>
(cherry picked from commit a38196f1516fd9d1b5a072bf799dab8b3f5fa2af)

travelmate: release 2.2.0

- drop iwinfo, use iw/ip instead
- support passive wlan scanning (active scanning is still the default)
- drop qrencode, use the LuCI internal qrcode js library instead
- more vpn fixes
- various LuCI changes/enhancements
- fix #27599
- disable proactive scanning in the default config

Signed-off-by: Dirk Brenken <[email protected]>
(cherry picked from commit a46dd4cf3c71514cc1ea3d45b5b3dc9d2c31560e)

openlist: Update to 4.1.4

Release note: https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.4

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit adbfae95f8f5dc945d32bf97d5f4ed7626368b3f)

openlist: Update to 4.1.3

Release note: https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.3

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 07ca6a83aaa9942e731b8c8c41f4fc5d627e71b7)

v2rayA: Update to 2.2.7.3

Release note:
- https://github.com/v2rayA/v2rayA/releases/tag/v2.2.7.2
- https://github.com/v2rayA/v2rayA/releases/tag/v2.2.7.3

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 5dbb37873634a478dd0c9ab1772e6c1a85c5b196)

v2ray-geodata: Update to latest version

Update all geodata.

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 2ebf07e4d29ea3a13c95f94e406b69c281d799a2)

samba4: update to version 4.18.11

For details see upstream release notes:

https://www.samba.org/samba/history/samba-4.18.9.html
https://www.samba.org/samba/history/samba-4.18.10.html
https://www.samba.org/samba/history/samba-4.18.11.html

Signed-off-by: Michal Hrusecky <[email protected]>

adblock-fast: bugfixes

* bugfix: remove IPKG_INSTROOT check
* bugfix: do not attempt to download config update if package is disabled

Signed-off-by: Stan Grishin <[email protected]>
(cherry picked from commit a7f831b84698474ec0c84863e223126b6ba72dae)
Signed-off-by: Stan Grishin <[email protected]>

https-dns-proxy: bugfix: remove IPKG_INSTROOT check

Signed-off-by: Stan Grishin <[email protected]>
(cherry picked from commit 8301996f679075660faa30e5ae1ef46fd67220cd)
Signed-off-by: Stan Grishin <[email protected]>

pbr: update to 1.2.0-r2

Makefile:
* stop shipping/dealing with the firewall hotplug (obsolete)
* install a third user-script (dnsprefetch) by @betonmischer

Config:
* remove obsolete options
* include the new user script

Init-script:
* start much earlier so that on boot, the procd_add_raw_trigger works on all systems
* create a ubus() helper function so that service delete does not produce "Command not found"
* rename options to better reflect their function:
  * procd_lan_device to lan_device
  * procd_wan_interface to uplink_interface
  * procd_wan6_interface to uplink_interface6
  * procd_wan6_metric to uplink_interface6_metric
  * wan_ip_rules_priority to uplink_ip_rules_priority
  * wan_mark to uplink_mark
* visually separate run-time variables from variables loaded from config options
* use ${IPKG_INSTROOT} when sourcing files
* fix typo in str_to_dnsmasq_nftset()
* use pidof to kill dnsmasq in dnsmasq_kill()
* add helper function uci_add_list_if_new()
* add helper function uci_changes()
* add helper function ubus() so that service delete does not produce "Command not found"
* implement the dnsmasq features check similar to dnsmasq init script
* add get_url() function similar to luci package
* add/modify error and warning messages
* change how mktemp is used for more reliable file creation
* unset non-true boolean package config options on load for easier checks later
* improve handling of nft/nft set options
* fewer calls to resolver() and resolver() optimization to speed up the service
* use softlinks instead of duplicating dnsmasq nftset files into each instance
* prevent duplication of dnsmasq nftset elements
* option to target a specific dest dns port in DNS policies
* bugfix: more reliable interface reloads
* display README links to errors/warnings sections if any errors/warnings discovered

Uci-defaults:
* transition from old options to new ones

Signed-off-by: Stan Grishin <[email protected]>
(cherry picked from commit f0f8dc0fced0c02e83d6e0a2ceb5754266abe3f0)
Signed-off-by: Stan Grishin <[email protected]>

netatalk: fix config/uci files handling in all variants

Config/uci files were not being included in -full variant.
Config files were also being lost in firmware upgrades for all variants.
Both issues fixed, including correct file permissions for config files.

Signed-off-by: Antonio Pastor <[email protected]>
(cherry picked from commit 0d939af403b2e3b37f29c1e70850cc1ba4fe56dc)

snort3: depend on libtirpc only for musl builds

The libtirpc package is only needed when building with musl, as glibc
includes the required RPC functionality. This change makes libtirpc a
conditional dependency and adjusts the build flags accordingly.

Building with x86_64-glibc:
...
Feature options:
    DAQ Modules:    Dynamic
    libatomic:      User-specified
    Hyperscan:      ON
    ICONV:          ON
    Libunwind:      OFF
    LZMA:           ON
    RPC DB:         Built-in
    SafeC:          OFF
    TCMalloc:       ON
    JEMalloc:       OFF
    UUID:           ON
    NUMA:           OFF
    LibML:          OFF
...

Building with aarch64_cortex-a76_musl:
...
Feature options:
    DAQ Modules:    Dynamic
    libatomic:      User-specified
    Hyperscan:      ON
    ICONV:          ON
    Libunwind:      OFF
    LZMA:           ON
    RPC DB:         TIRPC
    SafeC:          OFF
    TCMalloc:       ON
    JEMalloc:       OFF
    UUID:           ON
    NUMA:           OFF
    LibML:          OFF
...

Build system: x86/64
Build-tested: x86/64-glibc, bcm27flogic/xiaomi_redmi-router-ax6000-ubootmod (for musl)
Run-tested: x86/64-glibc

Signed-off-by: John Audia <[email protected]>
(cherry picked from commit e4bdefe1c298b0dc3508d788a9a42eb2346f819e)

gperftools: include headers in the staging_dir

This fixes version detection issues when other packages (like snort3)
try to find the tcmalloc library using CMake's find_package(). Without
the headers in the staging directory, CMake cannot read the version
information from tcmalloc.h, resulting in empty version strings.

Fixes:
Found TCMalloc: /builder/staging_dir/target-x86_64_musl/usr/lib/libtcmalloc.so (found version "")

Signed-off-by: Josef Schlehofer <[email protected]>
(cherry picked from commit e52a809371cbb055b1cc831f4e5aac152d1fb2b9)

snort3: enable/disable options based on package availability

This simplifies checks enabling/disabling features, if packages are present
instead of having checks for specific architectures.

TCMALLOC_LIBRARIES is removed as it's auto-detected, unlike vectorscan
which requires explicit HS_INCLUDE_DIRS.

Fixes: 126364e105fbcfde0617f58c39048c7d56c17a06 ("snort3: refactor architecture-specific dependencies and CMake options")
Signed-off-by: Josef Schlehofer <[email protected]>
(cherry picked from commit 02f78bc30acceab54c97165c09dbdab4297539bd)

https-dns-proxy: update to 2025.10.07-r1

Makefile:
* update to latest upstream: https://github.com/aarond10/https_dns_proxy/commit/7b27ecd5598d03bbe79651cc80efca886d433cd9
* update version, release
* drop CONFIGURE_ARGS as the build is curl-independent
* update the link to the documentation

README:
* add small README with the link to documentation

Config:
* rename procd_fw_src_interfaces to force_dns_src_interface to better reflect meaning
* add heartbeat_domain, heartbeat_sleep_timeout, heartbeat_wait_timeout options
* add default user, group and listen_addr options to the main config
* drop the user, group and listen_addr options from the instance configs

Init-script:
* start much earlier so that on boot, the procd_add_raw_trigger works on all systems
* create a ubus() helper function so that service delete does not produce "Command not found"
* new options handling where the global config options can be used for instance options
* some renaming of global/instance variables due to abovementioned redesign
* new open port detection, no longer relying on netstat
* new uci_changes() logic where it returns 0 or 1 instead of text
* new append_parm logic for not adding default value options to CLI
* new boolean options handling logic
* move config loading to load_package_config() function
* new logic for calling procd_set_config_changed firewall based solely on "$force_dns"
* source network.sh based on "${IPKG_INSTROOT}" path
* rename procd_fw_src_interfaces to force_dns_src_interface to better reflect meaning
* rename use_http1 to force_http1
* rename use_ipv6_resolvers_only to force_ipv6_resolvers

Uci-defaults:
* migrate to new option names

Signed-off-by: Stan Grishin <[email protected]>
(cherry picked from commit e1cf4ac52e609da463eeec123fdb0afa0888ff4e)
Signed-off-by: Stan Grishin <[email protected]>

snort3: refactor architecture-specific dependencies and CMake options

1. Enabled hyperscan/vectorscan together with adding dependency only for x86_64 and aarch64.
2. Disabled tmalloc (from gperftools package) for powerpc and mips.

By doing this refactor, snort3 is going to be available for more OpenWrt devices
(as it was in the past) as currently it was compiled only for x86_x64 and aarch64 by mistake.

Fixes: 257e2fc38aa694604e7be9e70e58082037133434 ("snort3: fix logic in gpertools-runtime depends")
Signed-off-by: Josef Schlehofer <[email protected]>
(cherry picked from commit 126364e105fbcfde0617f58c39048c7d56c17a06)
[For OpenWrt 24.10: There is hyperscan instead of vectorscan]

adblock-fast: update to 1.2.0-r20

Config file:
* add debug_init_script and debug_performance options
* remove led (default should be empty) option
* remove procd_boot_delay (obsolete) option

Init Script:
* reinstate IPKG_INSTROOT check
* change capitalization in status messages
* unset default value for led option on load_package_config
* bugfix: unset bool options which are later checked for non-empty
* bugfix: create compressed cache only if block-file exists
* adjust errors output/storing errors for later display in multuple cases
* produce information about cache/compressed cache files in service
  status output when service is stopped
* attempt to create compressed cache in service_started only if block-
  file exists
* bugfix: run service_started from the dl command (to create compressed
  cache file)
* rename StripToDomains variables for readability
* improve open port detection

Uci-Defaults:
* improve readability of debug options migration

Signed-off-by: Stan Grishin <[email protected]>
(cherry picked from commit ff2a55441d1ce54c0a726359475f0e0dfaa374e6)

libdaq3: update to 3.0.21

Update to latest version.

Changelog: https://github.com/snort3/libdaq/releases/tag/v3.0.21

Signed-off-by: John Audia <[email protected]>
(cherry picked from commit 64b8872cf4f506960ee733e30079feb22d11fd38)

mariadb: add unconditional dependency on libaio

MariaDB now depends on libaio even when uring is enabled.

Signed-off-by: Michal Hrusecky <[email protected]>
(cherry picked from commit d50b5e583c96bf0e925fc85a2413e3ac924c5eb2)

snort3: clean-up Makefile

Simplification of Makefile: remove line splits to increase readability.

Signed-off-by: John Audia <[email protected]>
(cherry picked from commit 87d0da8aa27146a6548936c12b417ca455d6e3ae)

snort3: switch from git proto to tarballs

Use upstream tarballs for source rather than using git. If we ever need
to build from git we can cherry pick and make a patch. This gives a
cleaner Makefile and faster build.

Signed-off-by: John Audia <[email protected]>
(cherry picked from commit 8914929466f3fdab06c68a83aa416007e11388f1)

snort3: update to 3.9.5.0

Changelog: https://github.com/snort3/snort3/releases/tag/3.9.5.0

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc

Signed-off-by: John Audia <[email protected]>
(cherry picked from commit a75e0a6db93b143d00df82581216d5901d13fc0e)

microsocks: run as unprivileged user

Run the daemon as unprivileged user for better security.

Trim whitespaces while at it.

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 182db0ac04364f685acc1e57284bf624b474edfd)

openvpn: bump `PKG_RELEASE`

Although recent updates were made, the `PKG_RELEASE` bump was missed.

Signed-off-by: Wesley Gimenes <[email protected]>
(cherry picked from commit 7c88f998e5e70712fef50d9ae511b776871cc492)
Signed-off-by: Sander van Deijck <[email protected]>

openvpn: remove kmod-ovpn-dco-v2 dependency

OpenVPN does work without the kernel module, it just won't be able to use DCO.
To make life easier for OpenVPN users on very space-constrained devices make it
an optional dependency.

Signed-off-by: Dennis Camera <[email protected]>
(cherry picked from commit 01fafd69ef276cd3ae80e9a633391d5f7a8d7dfe)
Signed-off-by: Sander van Deijck <[email protected]>

openvpn: enable DCO by default

Enable the DCO option by default in the openvpn package to allow for
better performance and have a use case for kmod-ovpn-dco-v2 :-)

Signed-off-by: Dennis Camera <[email protected]>
(cherry picked from commit 11e17a3ed625c34501568669303e3f447fe4f693)
Signed-off-by: Sander van Deijck <[email protected]>

python-pyelftools: Update to v0.32

- Update pyelftools to version 0.32 (minor)

Signed-off-by: Austin Lane <[email protected]>
(cherry picked from commit f2d141912f28638bfaa26ebb33634700a847ec4b)

python-pyelftools: add package / hostbuild

Signed-off-by: Austin Lane <[email protected]>
(cherry picked from commit dc79b54b571da4247b3289f9239b96435f660835)

tunneldigger: add broker_selection option to expose load balancing capabilities

Using the broker_selection param makes it possible to decide by use (default),
always use the first available broker to connect or select a random broker

See also: https://github.com/wlanslovenija/tunneldigger/blob/51a5e46ad143c92d2867835a563146ec4fbc6211/client/l2tp_client.c#L1331-L1333

Signed-off-by: Florian Maurer <[email protected]>
(cherry picked from commit 296c15c1f222b0c29de27f6f393c550275c79878)

php8: update to 8.3.26

Upstream changelog:
https://www.php.net/ChangeLog-8.php#8.3.26

Signed-off-by: Michael Heimpold <[email protected]>

apache: update to version 2.4.65

Fixes CVEs:
- CVE-2025-54090
- CVE-2025-53020
- CVE-2025-49812
- CVE-2025-49630
- CVE-2025-23048
- CVE-2024-47252
- CVE-2024-43394
- CVE-2024-43204
- CVE-2024-42516

More details can be found in
https://downloads.apache.org/httpd/CHANGES_2.4

Signed-off-by: Josef Schlehofer <[email protected]>
(cherry picked from commit 28adfd3d1e3550f1dd0c9a978f41748cd70cab5b)

syslog-ng: update to version 4.10.1

Release notes:
https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.10.1

Signed-off-by: Josef Schlehofer <[email protected]>
(cherry picked from commit 2ba11a2da59cc2f3cad64f261681500f0b703ea9)

umurmur: update to version 0.3.1

Makefile changes
----------------

1. The location of uMurmur binary was changed to /sbin
in release 0.3.1. See release notes [1]

2. I need to specify location of the library file instead of
the directory.

Fixes:
CMake Warning at src/CMakeLists.txt:44 (target_link_libraries):
  Target "umurmurd" requests linking to directory
  "/build/staging_dir/target-powerpc_8548_musl/usr/lib".
  Targets may link only to libraries.  CMake is dropping the item.

CMake Warning at src/CMakeLists.txt:44 (target_link_libraries):
  Target "umurmurd" requests linking to directory
  "/build/staging_dir/target-powerpc_8548_musl/usr/lib".
  Targets may link only to libraries.  CMake is dropping the item.

Because of these two warnings, the build fails with
undefined references to
protobuf-c symbols (e.g. protobuf_c_message_get_packed_size).

Patches
-------

Removed all of them, because they are included in
the upstream source code.

[1] https://github.com/umurmur/umurmur/releases/tag/v0.3.1

Signed-off-by: Josef Schlehofer <[email protected]>
(cherry picked from commit c4a23ca99662e67c8b6f5b8bad76d93fc2381ea0)

msmtp: update to version 1.8.31

Release notes:
https://marlam.de/msmtp/news/

Signed-off-by: Josef Schlehofer <[email protected]>
(cherry picked from commit c488e1297f240a9ff1c8e22dcc49822027a229ee)

mariadb: update to version 11.4.8

Release notes:
https://mariadb.com/docs/release-notes/community-server/mariadb-11-4-series/mariadb-11.4.8-release-notes

Refreshed patch

Signed-off-by: Josef Schlehofer <[email protected]>
(cherry picked from commit 9d141eb9d5c0af93ccd5592543b2cad005742d00)

gperftools: make libunwind dependency conditional

Make libunwind support optional depending on package availability.

Previously, gperftools unconditionally enabled libunwind as
mandatory dependency, which led to build failures on architectures where
libunwind is not provided.

Signed-off-by: Josef Schlehofer <[email protected]>
(cherry picked from commit 69bf2443d9a87b663cef3dd19804c665e8acf4a4)

gperftools: enable it for mips*

It should be working for mips*,
so enable it and let's see. :-)

In the past, there were some issues related to mips,
when the package was added, but these days, it appears
that these issues are gone. More details
about those issues could be found in the GitHub pull request
when gperftools was added. Reference is in the Fixes tag.

Fixes: c1b4e80825d6855d66899dc32490b0ce9537aff5 ("gperftools: add new package")
Signed-off-by: Josef Schlehofer <[email protected]>
(cherry picked from commit 4dc36ae9fd1e36054541eb94bf25d6767eff7f03)

fail2ban: bump to 1.1.0

fail2ban changes:
- nftables support (iptables dependency removed)
- python3 support (old package patches removed)
- Upstream patches backports:
  - filter.d/dropbear.conf: failregex extended to match different format of "Exit before auth" message
  - cherry-pick from debian: debian default banactions are nftables, systemd backend for sshd
- Removed unresponsive/unreachable maintainer.

Fixes: https://github.com/openwrt/packages/issues/23015 ("fail2ban: very old version")
Signed-off-by: Andrey Zotikov <[email protected]>
(cherry picked from commit 2a202b2091336cd04d58d797021e278ba9d3f5ae)

unbound: update to 1.24.0

latest upstream 09182024

Signed-off-by: Eric Luehrsen <[email protected]>
(cherry picked from commit 7b6300227383d08301bb7407d53834a202e13d69)

tor: update to 0.4.8.17 stable

Minor release, see the changelog [1] for what's new.

[1] https://gitlab.torproject.org/tpo/core/tor/-/blob/tor-0.4.8.17/ChangeLog

Signed-off-by: Rui Salvaterra <[email protected]>
(cherry picked from commit f2c93e0e25af7488918bc522bd3c53e346a46a4d)

tor: add /etc/torrc.d/ to conffiles

The /etc/tor/torrc may contain the line:

    %include /etc/torrc.d/*.conf

So users may put their own config files there.
We should preserve the files during an upgrade.

Signed-off-by: Sergey Ponomarev <[email protected]>
[Added PKG_RELEASE bump]
(cherry picked from commit 83737ed9ea188b6191d849e216af2d2d44548ecf)

tor: update to 0.4.8.16 stable

Minor release, see the changelog [1] for what's new.

[1] https://gitlab.torproject.org/tpo/core/tor/-/blob/tor-0.4.8.16/ChangeLog

Signed-off-by: Rui Salvaterra <[email protected]>
(cherry picked from commit 60908b5b9b58dcfdde9bf4d6c76adf7cdf07bf40)

owut: update to 2025.09.27

Bug fixes:
    efahl/owut@f049043ed721 owut: use installed SSL certs instead of default

Signed-off-by: Eric Fahlgren <[email protected]>
(cherry picked from commit 29e614fa861f7228d420d81021d7e9522d7fc680)

natmap: update to 20250924

Upstream changelog:
https://github.com/heiher/natmap/releases/tag/20250924

Signed-off-by: Ray Wang <[email protected]>
(cherry picked from commit c16fdd7e2b51ef41372368d83a98e62e40b2d2da)

adblock-fast: update to 1.2.0

Makefile:
* update version/release
Init Script:
* boot up reliability improvements:
  - change START from 50 to 20 to ensure procd_add_raw_trigger works on boot
  - better logic of checking/using the cache/compressed cache on boot
* new dnsmasq handling/integration logic:
  - new logic for checking dnsmasq functionality (similar to dnsmasq init script)
  - instead of copying/duplicating adblock-fast files per specified dnsmasq instance, create one file
    and add softlinks to it for specified dnsmasq instances and make sure it's in the instance's addnmounts
  - update dnsmasqConfFile, dnsmasqIpsetFile and dnsmasqNftsetFile to point to the same filename as the
    logic for integrating with dnsmasq is the same for those options
  - get the confdir for specified dnsmasq instances via ubus info/config file since the config_get is broken
    between releases by https://github.com/openwrt/openwrt/pull/14975
  - update clean-up procedures for other dns backend settings to properly clean up when switching away from
    dnsmasq.conf, dnsmasq.ipset, dnsmasq.nftset where the new logic is used
  - remove obsolete outputDnsmasqFileList variable and logic of building and using it
  - only create compressed cache in service_started after successful resolver restart with the block-file
* new package config / environment loading logic
  - switch away from using `load_validate_config` to start functions to loading package config "manually"
  - unset boolean variables which are non-true on package config load
  - switch checking values of such variables from `-eq 0` to empty/non-empty
* debugging improvements:
  - rename debug option to debug_init_script and proc_debug to debug_performance
  - output performance debug info to log only when debug_performance is set
* miscellaneous changes:
  - move best dl tool detection into its own function for reuse in adb_config_update
  - change uci_changes function to return 0/1 instead of the text of changes
  - improve mktemp calls reliability by creating the file and not using `-u` anymore
  - add remove_cache/remove_gzip calls to adb_file function
  - better readability of the start_serice logic determining the action
  - change flock value from 207 to 209 to avoid collisions with pbr
  - temporarily switch namespaces when using jshn functions to avoid collisions with PROCD
  - move from using spaces to tabs in indentation in code
  - prevent Command Not Found message on uninstall
  - remove unneeded IPKG_INSTROOT check in the init script
  - update all sourcing instructions to include IPKG_INSTROOT in the path
Uci-defaults script:
* transition old debug and proc_debug options to debug_init_script/debug_performance

Signed-off-by: Stan Grishin <[email protected]>
(cherry picked from commit 3c3d9d2b868d38ae4a0eea6589183d7a5b23b315)

netatalk: update to 4.3.2

Netatalk 4.3.x adds the option to use sqlite as a CNID DB. This
is now a config option for the full package.
(mysql is also an option but this has not been included here yet).

As CNID DB backends are now managed by the netatalk meta-daemon
the init script has been updated to use it instead of starting
afpd & dbd manually.

Cleaned up tab/space issues here and there.

Signed-off-by: Antonio Pastor <[email protected]>
(cherry picked from commit 2a8fdf37dc6c53929c831e0f24917fb9fd48a959)

jq: bump to v1.8.1

Simple bump to new release

Build system: x86/64
Build-tested: x86/64
Run-tested: x86/64

Signed-off-by: John Audia <[email protected]>
(cherry picked from commit 383fba198e4359344ba2d0a6efcd750ba6f486e1)

jq: bump to v1.8.0

In addition to shipping the latest upstream version, package shared objects.
It is worth noting that this release is required when building with GCC 15.1.

Signed-off-by: John Audia <[email protected]>
(cherry picked from commit 0f281ad57be8ea3247e4b02c6471c01cf891c07c)

jq: provide regex support in additional package jq-full

I modified the makefile, so that it will build two packages: jq and
jq-full. The former will remain unchanged and the latter will have a
dependency to the oniguruma library, so jq-full will have regex functions
enabled.

Signed-off-by: Maximilian Trüpschuch <[email protected]>
(cherry picked from commit 711a19c4b23f3517ece5296d323c8f0220a0ff4e)

knot: backport patch to fix linking with libhiredis

It was discovered that even while using ``--enable-redis=no``
and ``--disable-redis`` that it was still linking with libhiredis.

This avoids to picking up libhiredis as dependency:

```
Package knot is missing dependencies for the following libraries:
libhiredis.so.1.1.0
```

Fixes: cbbd2b5b3bd6df7e550b114cf1c9f8e0f5bc8616 ("knot: disable redis as it was enabled since 3.5.0 by default")
Signed-off-by: Jan Hák <[email protected]>
(cherry picked from commit 598504d89592cf588d7051dd941a47379104a936)

knot: disable redis as it was enabled since 3.5.0 by default

By disabling redis, it is not possible to use redis database as zone storage

Signed-off-by: Jan Hák <[email protected]>
(cherry picked from commit cbbd2b5b3bd6df7e550b114cf1c9f8e0f5bc8616)

treewide: drop anything related to uClibc

uClibc-ng was removed in 2020 from OpenWrt main repo [1].
These things are leftovers.

[1] https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=63fb175203bbf3b336804587c2f5b3a2d8132ec1

Signed-off-by: Josef Schlehofer <[email protected]>
(cherry picked from commit 3aab1ef31378219eb369147b2cc99b8c1be47dc1)

syslog-ng: update to version 4.10.0

Release notes:
https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.10.0

Makefile changes
----------------

1. Disable experimental feature: stackdump
due to issues, which were reported to upstream

2. Disabled example modules to avoid adding libstdc++.so.6 dependency
Fixes:
Package syslog-ng is missing dependencies for the following libraries:
libstdc++.so.6

Other changes
-------------

In syslog-ng 4.8.0, there was added possibility to use value "current"
as version in the config file, so use it, which confirm to use
the latest version instead of bumping the version in the file
manually.

Signed-off-by: Josef Schlehofer <[email protected]>
(cherry picked from commit b1cfb71f7bdf475c72f8a9f3be38b381108b0ac1)

syslog-ng: add runtime test

It adds a runtime test to verify that the compiled binary in
CI/CD runs without segfault and prints the version.

Signed-off-by: Josef Schlehofer <[email protected]>
(cherry picked from commit 971a2164f598cb6976846ac9f932283cd636e387)

knot: update to version 3.5.0

Release notes: https://www.knot-dns.cz/2025-09-18-version-350.html
Patch from commit https://gitlab.nic.cz/knot/knot-dns/-/commit/1297a6cc0fef21f35cfa517b5b55d94cd9cea41d

Signed-off-by: Jan Hák <[email protected]>
(cherry picked from commit bddd5e9cb639bcad72518efd956955ac6d8ea352)

knot: update to version 3.4.8

Release notes: https://www.knot-dns.cz/2025-07-29-version-348.html

Signed-off-by: Jan Hák <[email protected]>
(cherry picked from commit 08e4df89b0c244b000ca0fcfd03655bf2d17f8fe)

unbound: bring back the service to the startup menu

* trivial fix for #25963 to workaround the current "10 line parsing limit"

Signed-off-by: Dirk Brenken <[email protected]>
(cherry picked from commit 732a8405efd9c89609cb1849f1e6ed9c00c07a87)

unbound: update to 1.23.0

Signed-off-by: Eric Luehrsen <[email protected]>
(cherry picked from commit a0df926a01e98ad778d5db15f27e942425269306)

Unbound: Fixed: local-data except IPv6 GA addresses with odhcpd

issue #25954

Signed-off-by: hingbong lo <[email protected]>
(cherry picked from commit da4d3e9ab1732fd5f7b68695447ad8cc92cfb4af)

unbound: update to 1.22.0

Signed-off-by: Jan Klos <[email protected]>
[Solve PKG_RELEASE conflict]
(cherry picked from commit 6b989e0ad520e0a71bc18d9e84a0b7b4e4e54c07)

Unbound: fix file lock race in odhcpd.sh

Signed-off-by: Ted Hess <[email protected]>
(cherry picked from commit 4d8c6d18690fe264890dfef013853dba49036c12)

golang: Fix host build compatibility with GCC 15

Fixes https://github.com/openwrt/packages/issues/26446.

Signed-off-by: Jeffery To <[email protected]>
(cherry picked from commit f7d2ebfe3784ab793c1db0d7bb6bbf98b7dbc064)

bash: fix build failed with GCC 15 #26784

by applying this patch, build successfully

Signed-off-by: hingbong lo <[email protected]>
(cherry picked from commit 9672ccaf5bcbd5460aeb6ef0f344fbc5e5f3e86c)

bash: add CFLAGS_FOR_BUILD="-std=gnu17" flag

Fix #26469
add CFLAGS_FOR_BUILD="-std=gnu17" flag

Signed-off-by: Ariel Xiong <[email protected]>
(cherry picked from commit dab90ec210a772251266607c750d07117a000846)

bash: bump to 5.2.37

fix autoconf test for broken strtold
fix for parsing compound assignment while expanding alias
fix compilation on systems that provide select or pselect but not both
fix for reading partial invalid multibyte characters
fix issue where comparing quoted and unquoted words to be completed results in readline not displaying possible matches

Signed-off-by: Ariel Xiong <[email protected]>
(cherry picked from commit ca2b5ea51f8cf7354df28a566eec77dc548da670)

gperftools: update to 2.17.2

Bump to latest release and removed upstreamed patch.

Resulting libs give a fully functional snort3 which was built against
this new version.

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc (Intel N150 based box)

Signed-off-by: John Audia <[email protected]>
(cherry picked from commit 465eddb46db3e735c74c5cbedc12e74d87c0f663)

gperftools:  bump to version 2.17

Changelog: https://github.com/gperftools/gperftools/releases/tag/gperftools-2.17

Add patch to fix build of some ARM toolchains

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc

Signed-off-by: John Audia <[email protected]>
(cherry picked from commit 0a0f2e884c120dfe146697280127cefcd23cd680)

bottom: update to 0.11.1

update to 0.11.1

Signed-off-by: Aleksey Vasilenko <[email protected]>
(cherry picked from commit 072b5c6f48a43b695537c42a6817bb0fa5d0e788)

yt-dlp: bump to 2025.09.05

Changelog: https://github.com/yt-dlp/yt-dlp/releases/tag/2025.08.27
Changelog: https://github.com/yt-dlp/yt-dlp/releases/tag/2025.09.05
Signed-off-by: George Sapkin <[email protected]>

dnscrypt-proxy2: update to version 2.1.14

- update dnscrypt-proxy2 to version 2.1.14
- add GO_PKG_INSTALL_EXTRA:= dnscrypt-proxy/static/ to fix build error

Contributed-by: @ScoutJamboree
Signed-off-by: Niklas Thorild <[email protected]>

python-certifi: update to 2025.8.3

Fix CVE-2024-39689.

Signed-off-by: Wei-Ting Yang <[email protected]>
(cherry picked from commit 6d9d0d2bf8c3d62069fc2431dcd803cafd294ffe)

python-certifi: assign PKG_CPE_ID

https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:certifi:certifi

Signed-off-by: Wei-Ting Yang <[email protected]>
(cherry picked from commit dc6724fca5b5741e842cc71656c7af21fe2f2cba)

hev-socks5-server: update to 2.10.0

Upstream changelog:
https://github.com/heiher/hev-socks5-server/releases/tag/2.10.0

Signed-off-by: Ray Wang <[email protected]>
(cherry picked from commit 2391212aa4802c734c89d343ce2f0ab09dbb4508)

rust: update to 1.89.0

- switch source archive to tar.xz to save space and bandwidth
- refresh a patch

Signed-off-by: Aleksey Vasilenko <[email protected]>
(cherry picked from commit 10862df850ae012b34ec9c57a9005b1f7e1e2aca)

travelmate: release 2.1.4

- fixed  telekom login script (#27072)
- fixed the connection tracking/f_net function,
  to stabilize (vpn) connections (#27235)
- removed needless log message

Signed-off-by: Dirk Brenken <[email protected]>
(cherry picked from commit ac175d902e19b6492667573fae7551eb1a67d039)

syncthing: improve relay argument parsing

Fixes: 47644ba46 ("syncthing: fix discovery and relay extra args")
Signed-off-by: George Sapkin <[email protected]>
(cherry picked from commit d75075ce8e329d59f74b4475f6635fc1536911a4)

syncthing: improve discovery argument parsing

Fixes: 47644ba46 ("syncthing: fix discovery and relay extra args")
Signed-off-by: George Sapkin <[email protected]>
(cherry picked from commit 6ccb3b6174d319666bcdd1319b2be4fa7cbd9b30)

syncthing: fix discovery and relay extra args

Update configuration option examples.

Fixes: #26952
Signed-off-by: George Sapkin <[email protected]>
(cherry picked from commit 47644ba468fd03f805bf1afa97df589e1f4160b5)

adblock-fast: bugfix: dl command

* only test gzip existence and reset action/param on boot

Signed-off-by: Stan Grishin <[email protected]>
(cherry picked from commit de3deab1a6c3bb7126df41758585f67c22f17230)

php8: update to 8.3.25

Upstream changelog:
https://www.php.net/ChangeLog-8.php#8.3.25

Signed-off-by: Michael Heimpold <[email protected]>

lf: update to r37

https://github.com/gokcehan/lf/releases/tag/r37

Signed-off-by: Nate Robinson <[email protected]>
(cherry picked from commit 87054232019314c7858da0f2ff46070afa545d93)

arp-whisper: do not lock deps

The version specified in Cargo.lock is too old to build.

Trim whitespaces while at it.

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 6f6ad3fe1c96db67a267c65f1e5521919e778899)

v2raya: Update to 2.2.7.1

Release note: https://github.com/v2rayA/v2rayA/releases/tag/v2.2.7.1

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 3eb22bc1f8a13e341b05c454ed96ad254d6072b5)

v2raya: Update to 2.2.7

Release note: https://github.com/v2rayA/v2rayA/releases/tag/v2.2.7

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 5d2c9239760c8d55001b839504f7564303e631d7)

nnn: update to version 5.1

Release notes: https://github.com/jarun/nnn/compare/v4.9...v5.1

Signed-off-by: Gregory Gullin <[email protected]>
(cherry picked from commit ebb0d87450c9bbf1008990ddc2c68d3cfdae5f5a)

lighttpd: update to lighttpd 1.4.82 release hash

Ref: https://www.lighttpd.net/2025/9/12/1.4.82/

Signed-off-by: Glenn Strauss <[email protected]>
(cherry picked from commit c8e1b9af9985384fe356a3af29019ac204438393)

lighttpd: update to lighttpd 1.4.81 release hash

https://www.lighttpd.net/2025/8/17/1.4.81/

Signed-off-by: Glenn Strauss <[email protected]>
(cherry picked from commit 62dbf8c87f1648696b7ee53acc8c15fcc84776ff)

snort3: fix logic in gpertools-runtime depends

The logic in e57cc9898a362d81e8dec5dd779293e6ff3d4710 was flawed causing
gperftools-runtime to fail to get detected when building resulting in:
...
ninja: Entering directory `/scratch/union/build_dir/target-x86_64_glibc/snort3-3.9.1.0'
ninja: error: '/scratch/union/staging_dir/target-x86_64_glibc/usr/lib/libtcmalloc.so', needed by 'src/snort', missing and no known rule to make it
make[2]: *** [Makefile:161: /scratch/union/build_dir/target-x86_64_glibc/snort3-3.9.1.0/.built] Error 1

It was missed due testing in build root that already had gperftools-runtime
built only discovered when building from a clean build root.

This commit fixes this flaw.

Test:
cat <<EOF > .config
CONFIG_TARGET_x86=y
CONFIG_TARGET_x86_64=y
CONFIG_TARGET_x86_64_DEVICE_generic=y
CONFIG_PACKAGE_snort3=y
EOF

make defconfig
grep gperftools-run .config
CONFIG_PACKAGE_gperftools-runtime=y

cat <<EOF > .config
CONFIG_TARGET_qoriq=y
CONFIG_TARGET_qoriq_generic=y
CONFIG_TARGET_qoriq_generic_DEVICE_watchguard_firebox-m300=y
CONFIG_PACKAGE_snort3=y
EOF

make defconfig
grep gperftools-run .config

Signed-off-by: John Audia <[email protected]>
(cherry picked from commit 257e2fc38aa694604e7be9e70e58082037133434)

snort3: update to 3.9.3.0

Changelog: https://github.com/snort3/snort3/releases/tag/3.9.3.0

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc (Intel N150 based box)

Signed-off-by: John Audia <[email protected]>
(cherry picked from commit f8ace6e398a161ef661c51483b0ecdea19201d4a)

ampr-ripd: script improvements and add QA script

Added test.sh
Predetermine count used by for loops in Makefile postrm
Implemented extra_command in initscript
Resolved shellcheck issues
Bump release

Signed-off-by: Dan Srebnick <[email protected]>
(cherry picked from commit 551ef4a7c1abe3be192d7eba9f7a193e54e92dd0)

ampr-ripd: Initial package release

This project can be used with the OpenWrt SDK to generate a package
for ampr-ripd.  It is intended for use only by licensed amateur radio
operators.  ampr-ripd is a modified RIPv2 listener that provides
route information for ARDC IPIP Mesh tunnels.

Signed-off-by: Dan Srebnick <[email protected]>
(cherry picked from commit 19249742cda92b6895ba236ca6fb3acac5abeacc)

treewide: include `nls.mk` when depending on glib2

When compiling glib2 with NLS, it automatically sets linker flags to `-lglib-2.0 -lintl` in pkg-config (.pc) files.

Signed-off-by: Lukas Voegl <[email protected]>
(cherry picked from commit 7ee547b4402b85ff3ede78cdcd997484fc620fa4)

fluidsynth: update to version 2.4.5

fluidsynth 2.4.5

    Prebuilt Windows Binaries were missing SDL3.dll
    (FluidSynth/fluidsynth#1510)

    Fix SDL3 intercepting signals, causing CTRL+C to not quit fluidsynth
    (FluidSynth/fluidsynth#1509)

    Fix a few flaws in the AWE32 NRPN implementation
    (FluidSynth/fluidsynth#1452, FluidSynth/fluidsynth#1473)

    A regression introduced in 2.4.4 broke drum preset selection for XG
    MIDIs (FluidSynth/fluidsynth#1508)

    Fix for OpenMP thread affinity crashes on Android devices
    (FluidSynth/fluidsynth#1521, thanks to @looechao)

    Fix fluidsynth's systemd user daemon being unable to create lock
    file on some distros (FluidSynth/fluidsynth#1527, thanks to
    @andrew-sayers)

    Fix fluidsynth ignoring initialFilterFc generator limits
    (FluidSynth/fluidsynth#1502)

    A regression introduced in 2.3.6 prevented SF2 NRPN messages from
    being processed correctly (FluidSynth/fluidsynth#1536)

fluidsynth 2.4.4

    Support for SDL3 has been added, support for SDL2 has been
    deprecated (FluidSynth/fluidsynth#1485, FluidSynth/fluidsynth#1478,
    thanks to @andyvand)

    Soundfonts that are not respecting the 46 zero-sample padding-space
    previously sounded incorrect when

    synth.dynamic-sample-loading was active (FluidSynth/fluidsynth#1484)

    Allow drum channels to profit from Soundfont Bank Offsets by no
    longer ignoring MSB Bank changes (FluidSynth/fluidsynth#1475)

    Revise the preset fallback logic for drum channels
    (FluidSynth/fluidsynth#1486)

    A regression introduced in 2.4.1 may have caused interrupted
    real-time playback when voices were using the lowpass filter
    (FluidSynth/fluidsynth#1481)

    Improve multi-user experience when running fluidsynth as systemd
    service (FluidSynth/fluidsynth#1491, thanks to @andrew-sayers)

    Fix ordering and dependencies of fluidsynth's systemd service
    (FluidSynth/fluidsynth#1500, thanks to @fabiangreffrath)

    Revise fluidsynth's man page (FluidSynth/fluidsynth#1499, thanks to
    @fabiangreffrath)

fluidsynth 2.4.3

    It was discovered, that exclusive class note terminations were too
    slow (FluidSynth/fluidsynth#1467, thanks to @mrbumpy409)

    Fix a regression introduced in 2.4.0 that allowed the amplitude of a
    voice playing in delay phase to rise infinitely
    (FluidSynth/fluidsynth#1451)

    MSGS drum-style note-cut has been converted to an opt-in setting
    synth.note-cut (FluidSynth/fluidsynth#1466)

    Support for SDL2 has been disabled by default*
    (FluidSynth/fluidsynth#1472)

    Fix a regression introduced in 2.4.1 that could have caused infinite
    audio gain output for some MIDI files under certain configurations
    (FluidSynth/fluidsynth#1464)

    Silence a warning issued by Systemd v254+
    (FluidSynth/fluidsynth#1474, thanks to @andrew-sayers)

fluidsynth 2.4.2

    Fix audible clicks when turning off voices while using a high filter
    resonance (FluidSynth/fluidsynth#1427)

    Fix a build failure with MSYS2 and MinGW when processing
    VersionResource.rc (FluidSynth/fluidsynth#1448, thanks to @pedrolcl)

    Fix a crash on startup when there are no MIDI devices available on
    Windows (FluidSynth/fluidsynth#1446, thanks to @pedrolcl)

    Restore discovery of libsndfile (FluidSynth/fluidsynth#1445)

    Fix a race condition when loading SF3 files containing multiple
    uncompressed samples (FluidSynth/fluidsynth#1457)

fluidsynth 2.4.1

    Enable libsndfile to use filename with non-ASCII characters on
    Windows (FluidSynth/fluidsynth#1416, thanks to @pedrolcl and
    @stardusteyes)

    Fix a few commandline encoding related issues on Windows
    (FluidSynth/fluidsynth#1388, FluidSynth/fluidsynth#1421, thanks to
    @pedrolcl)

    Fix build errors on Windows (FluidSynth/fluidsynth#1419,
    FluidSynth/fluidsynth#1422, thanks to @carlo-bramini)

    Fix clicks and pops caused when changing parameters of the lowpass
    filter (FluidSynth/fluidsynth#1415, FluidSynth/fluidsynth#1417,
    FluidSynth/fluidsynth#1424)

    Minor adjustment to AWE32 NRPN behavior (FluidSynth/fluidsynth#1430)

Signed-off-by: Daniel Golle <[email protected]>
(cherry picked from commit dd8780e253934ad57afde016679c1f7e498e2be0)