rust: introduce `RUST_{HOST,PKG}_LOCKED` flag

Introduce `RUST_{HOST,PKG}_LOCKED` flag (enabled by default) to respect
upstream lockfile. This can be disabled by setting it to 0 if you want
to have up-to-date dependencies.

This change also adds new `CARGO_{HOST,PKG}_ARGS` variable to pass extra
build arguments to cargo.

Signed-off-by: Tianling Shen <[email protected]>

pbr: 1.1.8-36 bugfixes

- drop load_environment_flag and always load environment on start, making
  restart command great again
- store/restore existing jshn namespace when using json()
- remove unneeded sleepCount in is_wan_up()
- move updated README inside files/

Signed-off-by: Stan Grishin <[email protected]>

aliyun-cli: update to 3.0.296

Changelog:
https://github.com/aliyun/aliyun-cli/releases/tag/v3.0.296

Signed-off-by: Bruce Chen <[email protected]>

qbee-agent: bump version to 2025.34

Signed-off-by: Jon Henrik Bjørnstad <[email protected]>
qbee-agent: bump version to 2025.34

lxc: update to 6.0.5

6.0.5 is a bug fix release, see:
https://discuss.linuxcontainers.org/t/lxc-6-0-5-lts-has-been-released/24438

Full changelog: https://github.com/lxc/lxc/compare/v6.0.4...v6.0.5

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc (Intel N150 based box)

Signed-off-by: John Audia <[email protected]>

abseil-cpp: Update to 20240722.1 LTS

- Update abseil-cpp minor rev. Fixes CVE-2025-0838

Signed-off-by: Austin Lane <[email protected]>

python-pyelftools: Update to v0.32

- Update pyelftools to version 0.32 (minor)

Signed-off-by: Austin Lane <[email protected]>

pdns-recursor: update to 5.2.5

includes fix for CVE-2025-30192 (which was in 5.2.4)

Signed-off-by: Peter van Dijk <[email protected]>

libpam: add upstream patch/fix build mold linker

Add backport fixing the build with mold linker and remove the no-mold flag.

See: https://github.com/linux-pam/linux-pam/issues/922 and
https://github.com/linux-pam/linux-pam/pull/928

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc (Intel N150 based box)

Signed-off-by: John Audia <[email protected]>

yt-dlp: bump to 2025.08.11

Changelog: https://github.com/yt-dlp/yt-dlp/releases/tag/2025.08.11
Signed-off-by: George Sapkin <[email protected]>

frp: bump to 0.64.0

Change log is available at https://github.com/fatedier/frp/compare/v0.51.3...v0.64.0

Signed-off-by: Roc Lai <[email protected]>

libprotobuf-c: Update to v1.5.2

Update libprotobuf-c to version 1.5.2.
Notably, adds support for protobuf >=26

Signed-off-by: Austin Lane <[email protected]>

lua-argparse: bump to luarocks' 0.7.1

Bump lua-argparse to the luarocks argparse 0.7.1 release.

Signed-off-by: Nathaniel Wesley Filardo <[email protected]>

lighttpd: update to lighttpd 1.4.81 release hash

https://www.lighttpd.net/2025/8/17/1.4.81/

Signed-off-by: Glenn Strauss <[email protected]>

sing-box: update to 1.12.1

changelog: https://github.com/SagerNet/sing-box/releases/tag/v1.12.1

Signed-off-by: Gregory Gullin <[email protected]>

sendmail: fix building as non-root user

Buildbot builds started failing with this:

[...]
install -c -o buildbot -g buildbot -m 644 ../../include/libmilter/mfapi.h /builder/shared-workdir/build/sdk/build_dir/target-x86_64_musl/sendmail-8.16.1/ipkg-install/usr/include/libmilter/mfapi.h
install: invalid user 'buildbot'

Extend 010-enable-nonroot-install.patch to remove "-o U -g G" from more
install targets.

Signed-off-by: W. Michael Petullo <[email protected]>

coova-chilli: fix compilation with GCC15

No idea how this even worked. cmdsock never got closed.

Signed-off-by: Rosen Penev <[email protected]>

krb5: update to 1.22

Upstream list of changes is available at
https://web.mit.edu/kerberos/krb5-1.22/krb5-1.22.html.

Of note is that this release fixes the build with GCC 15.1.  As with
other recent versions, GCC 15.1 transforms some warnings into errors,
and this release remediates those warnings, now errors.

Signed-off-by: W. Michael Petullo <[email protected]>

owut: update to 2025.08.15

Bug fixes:
    efahl/owut@c6e75716d1a3 init: fix typo in file name
    efahl/owut@7f97ab67c2f5 examples: improve docs for writing pre-install scripts
Enhancements:
    efahl/owut@93f2b06b8882 owut: utilize upstream limits instead of hardcoded values
    efahl/owut@7a45c412fc96 owut: improve usability of 'dump' option
    efahl/owut@35720e369ac0 owut: improve age reporting

Signed-off-by: Eric Fahlgren <[email protected]>

python-certifi: update to 2025.8.3

Fix CVE-2024-39689.

Signed-off-by: Wei-Ting Yang <[email protected]>

python-certifi: assign PKG_CPE_ID

https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:certifi:certifi

Signed-off-by: Wei-Ting Yang <[email protected]>

isc-dhcpd: quote filenames for safety

Per best practices, we should protect against wildcards in
variable expansions.

Signed-off-by: Philip Prindeville <[email protected]>

isc-dhcp: fix spacing on forced parameters

If there's a "forced_send" option, then put spaces between multiple
parameter codes.

Signed-off-by: Philip Prindeville <[email protected]>

isc-dhcp: distinguish between hexstrings and strings

It's a minor difference and they're handled the same, but that
might change as we move to Kea.

Signed-off-by: Philip Prindeville <[email protected]>

isc-dhcp: clean up 'if' formatting

We don't use a consistent format of bracket-semicolon, so fix it.

Signed-off-by: Philip Prindeville <[email protected]>

packages/net-snmp: fix typo

CONFILTS is changed to CONFLICTS to enable condition.

Signed-off-by: Christian Korber <[email protected]>

python-urllib3: update to 2.0.7

Fix CVE-2023-45803 and CVE-2023-43804.

Full changelogs:
- https://github.com/urllib3/urllib3/releases/tag/v2.0.5
- https://github.com/urllib3/urllib3/releases/tag/2.0.6
- https://github.com/urllib3/urllib3/releases/tag/2.0.7

Signed-off-by: Wei-Ting Yang <[email protected]>

python3: update to version 3.11.13

Release notes:
https://docs.python.org/release/3.11.13/whatsnew/changelog.html#python-3-11-13

Fixes CVEs:
CVE 2024-12718
CVE 2025-4138
CVE 2025-4330
CVE 2025-4517

Patch refreshed

Signed-off-by: Josef Schlehofer <[email protected]>

mstflint: update to 4.33.0

This commit updates the mstflint package to
the latest 4.33.0 release.

Obsolete patches have been removed,
as they are now included in this version.

Signed-off-by: Til Kaiser <[email protected]>

kea: fix kea.init error handling

kea.init returned 0 for invalid service names.
Print an error to stderr and return 1 to indicate failure.

Signed-off-by: Liu Yu <[email protected]>

kea: update to 2.6.4

Upstream changelog:
https://downloads.isc.org/isc/kea/2.6.4/Kea-2.6.4-ReleaseNotes.txt

Signed-off-by: Liu Yu <[email protected]>

cloudflared: Update to 2025.8.0

Release note: https://github.com/cloudflare/cloudflared/releases/tag/2025.8.0

Signed-off-by: Tianling Shen <[email protected]>

django: allow test.sh only for python3-django package

No idea how this worked before.
But the '/usr/bin/django-admin' is available only for python3-django

Signed-off-by: Alexandru Ardelean <[email protected]>

python-requests: bump to version 2.32.4

This change updates the Python requests package to version 2.32.4

Signed-off-by: Alexandru Ardelean <[email protected]>

numpy: bump to version 2.3.2

This change bumps numpy to 2.3.2

Signed-off-by: Alexandru Ardelean <[email protected]>

django-restframework: bump to version 3.16.1

This change updates django-restframework to 3.16.1

Signed-off-by: Alexandru Ardelean <[email protected]>

squashfs-tools: bump to version 4.7

This updates squashfs-tools to version 4.7

Tweaked build option flags.

Need to backport patch from upstream to fix compiler error for pid_t type.

Signed-off-by: Alexandru Ardelean <[email protected]>

dbus: fix ujail configuration

Running dbus as an unprivileged user fails for two reasons: Cannot write pid file
and cannot read the installed policies:

 Tue Aug  5 17:12:41 2025 daemon.info dbus-daemon[8568]: jail: exec-ing /usr/bin/dbus-daemon
 Tue Aug  5 17:12:41 2025 daemon.info dbus-daemon[8585]: Encountered error 'Failed to open "/etc/dbus-1/system.d/org.freedesktop.ModemManager1.conf": Permission denied' while parsing '/etc/dbus-1/system.d/org.freedesktop.ModemManager1.conf'
 Tue Aug  5 17:12:41 2025 daemon.err dbus-daemon[8568]: dbus-daemon[8585]: Encountered error 'Failed to open "/etc/dbus-1/system.d/org.freedesktop.ModemManager1.conf": Permission denied' while parsing '/etc/dbus-1/system.d/org.freedesktop.ModemManager1.conf'
 Tue Aug  5 17:12:41 2025 daemon.warn dbus-daemon[8585]: Failed to start message bus: Failed to open "/var/run/dbus.pid": Permission denied
 Tue Aug  5 17:12:41 2025 daemon.err dbus-daemon[8568]: dbus-daemon[8585]: Failed to start message bus: Failed to open "/var/run/dbus.pid": Permission denied
 Tue Aug  5 17:12:41 2025 daemon.info dbus-daemon[8568]: jail: jail (8585) exited with exit: 1

Fix by dropping the pid file when running unprivileged and changing the owner
of the installed policies.

Fixes: f238d6dd0996 ("dbus: run as regular user rather than as root")
Signed-off-by: Bjørn Mork <[email protected]>

gkrellmd: update to 2.4.0

Fixes compilation with GCC15.

Signed-off-by: Rosen Penev <[email protected]>

perl-file-rsyncp: update to 0.76

Fix compilation with GCC15.

Signed-off-by: Rosen Penev <[email protected]>

python-pycares: bump to 4.10.0

python-pycares: bump from version 4.8.0 to 4.10.0

Signed-off-by: Fabian Lipken <[email protected]>

lttng-tools: fix build with libxml 2.14

Backport a pending patch to fix build with libxml 2.14.

Signed-off-by: Tianling Shen <[email protected]>

openblas: bump to version 0.3.30

This change updates the version to 0.3.30
Added patch to fix x86 builds.

Also sent upstream:
   https://github.com/OpenMathLib/OpenBLAS/pull/5418

Signed-off-by: Alexandru Ardelean <[email protected]>

pbr: update to 1.1.8-34

* bugfix: json init was destroying procd_triggers and screwing boot up
  fixes https://github.com/openwrt/packages/issues/27194
* improvement: explicit printf calls in get_text

Signed-off-by: Stan Grishin <[email protected]>

sudo: bump to version 1.9.17p2

This change bumps sudo to version 1.9.17p2

Signed-off-by: Alexandru Ardelean <[email protected]>

tcpreplay: compile as gnu11

Fixes compilation under GCC15.

Signed-off-by: Rosen Penev <[email protected]>

isc-dhcp: fix build issues with stricter compilers

The new gcc in the toolchain is failing K&R style prototypes. There
are also some function pointers passed as parameters that didn't
have prototypes so were causing incompatible pointer clashes.

Signed-off-by: Philip Prindeville <[email protected]>

net-snmp: fix recursive dependency

Fixes recursive dependency during 'make menuconfig'

Signed-off-by: Florian Eckert <[email protected]>

krb5: build as C11

Fixes compilation with GCC 15.

The upstream patch fixing compilation is way too huge to backport.

Signed-off-by: Rosen Penev <[email protected]>

fx: update to 39.0.1

update fx from version 36.0.3 to 39.0.1

Signed-off-by: Fabian Lipken <[email protected]>

unixodbc: compile as gnu11

Fixes compilation with GCC15. Properly fixing this is too convoluted.

Signed-off-by: Rosen Penev <[email protected]>

libyaml-cpp: fix pkgconfig file

This avoids leaking OS paths.

Signed-off-by: Rosen Penev <[email protected]>

rsyslog: update to 8.2506.0

Fixes compilation with GCC15.

Signed-off-by: Rosen Penev <[email protected]>

make: fix compilation with GCC15

Extra define is neede.

Signed-off-by: Rosen Penev <[email protected]>

docker-compose: Update to version 2.39.2

Release notes:
https://github.com/docker/compose/releases/tag/v2.39.2

Signed-off-by: Javier Marcet <[email protected]>

net-snmp: bump PKG_RELEASE

Bump PKG_RELEASE by one.

Signed-off-by: Florian Eckert <[email protected]>

net-snmp: save pid to file

This commit saves the pid to a file in '/var/run'.

Signed-off-by: Christian Korber <[email protected]>

net-snmp: add logging to init script

To support logging in net-snmp this commit introduces this feature. There is
a new uci config section 'logging'.

The following new parameters are used:

config logging
option log_file '/var/log/snmpd.log'
option log_file_priority 'i'
option log_syslog '0'
option log_syslog_facility 'd'

Signed-off-by: Christian Korber <[email protected]>
Signed-off-by: Florian Eckert <[email protected]>

net-snmp: modify init script for SNMPv3

This commit adds function 'snmpd_snmpv3_add' to the init script
to support SNMPv3 config parsing.

The new uci config section has the following configuration parameters:

config v3
option username 'John'
option allow_write '0'
option auth_type 'SHA|MD5'
option auth_pass 'passphrase'
option privacy_type 'AES|DES'
option privacy_pass 'passphrase'
option RestrictOID 'yes|no'
option RestrictedOID '1.3.6.1.2.1.1.1'

This new section is only relevant if the snmp_version 'v1/v2c/v3' or 'v3'
is set in the uci section 'general'.

Signed-off-by: Christian Korber <[email protected]>
Signed-off-by: Florian Eckert <[email protected]>

net-snmp: add ssl build variant to support SNMPv3

Add build variant 'ssl' to support SNMPv3.

Signed-off-by: Florian Eckert <[email protected]>

net-snmp: rename package to 'nossl' to support SNMPv3 'ssl' variant

To use 'SNMPv3', the net-snmp package must be compiled with openssl support.
For this purpose, the current net-snmp is renamed into build 'nossl'.

This is a preparation commit to add the 'ssl' variant.

Signed-off-by: Christian Korber <[email protected]>

net-snmp: remove not needed snmpd-static build

The static build is not packaged and can therefore be removed as the build
artefact is not used.

Signed-off-by: Florian Eckert <[email protected]>

xinetd: fix compilation with GCC15

Cannot use C23 as it uses generic function pointers.

Signed-off-by: Rosen Penev <[email protected]>

ccrypt: fix compilation with gcc15

gcc15 is using iso9899:2024 by default.
ccrypt fails to compile with it.
--> use previous standard "-std=c17" instead.
Ref.: https://github.com/openwrt/packages/issues/27112

Signed-off-by: Ulrich Stark <[email protected]>

php8: link PCRE2 JIT usage to actual library configuration

libpcre2's JIT support is controlled with a compile-time flag.
When PHP is compiled against it (external libpcre2 - not PHP's bundled
version) as in our use-case, then it tries to auto-detect whether
JIT support is enalbed or not - but this is done based on a guess
when cross-compiling.

So instead of guessing, we need to tell the actual OpenWrt configuration
of libpcre2 to PHP.

Signed-off-by: Michael Heimpold <[email protected]>

gperftools:  bump to version 2.17

Changelog: https://github.com/gperftools/gperftools/releases/tag/gperftools-2.17

Add patch to fix build of some ARM toolchains

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc

Signed-off-by: John Audia <[email protected]>

git: update to 2.50.1

- Refresh and rebase patches

Signed-off-by: Richard Muzik <[email protected]>

python-twisted: Update to 25.5.0

This update fixes CVE-2024-41810 and CVE-2024-41671 [1]. For the full
changelog see NEWS [2].

Additionally changed the way the test files are omitted from patch file
to filespec in the Makefile.

[1] https://github.com/twisted/twisted/blob/twisted-25.5.0/NEWS.rst#twisted-2470-2024-08-08
[2] https://github.com/twisted/twisted/blob/twisted-25.5.0/NEWS.rst

Signed-off-by: Richard Muzik <[email protected]>

cloudreve: Update to 4.4.1

Release note: https://github.com/cloudreve/cloudreve/releases/tag/4.4.1

Signed-off-by: Tianling Shen <[email protected]>

uspot: update to Git HEAD (2025-08-07)

e2e3c649ab80 README update
18e6bcc14cc2 uspot/portal: urldecode FORM POST data
bf6051dba822 uspot/handler-uam: accept /login endpoint
32273591d8d5 uspotfilter: provide peer_lookup answers only for known clients
b0aeef9973a9 README: clarify uam vs radius mode features
b7b0d0efb0e2 uspot: improve config documentation
bce68a97fad8 captive: rename to 'uspot'
da6ca713e15d uspot: client_remove(): pass device to ratelimit client_delete()
3ebfe262bfb1 uspot: remove unused radius_call() args
691d73aa00dc uspot: let radius_init() set all required payload members
be50a66b777f uspot: allow setting global bandwidth limits
4851ada4b0c0 uspot: send Called-Station-Id in Acct-On/Off requests
0974fc8d47ac Implement uspot-bpf, an eBPF traffic counter
e99809f97e34 introduce uspotbpf.uc
7f6f43883568 uspotbpf: work around ucode-mod-bpf bug
319e0c285afb uspot: hook traffic accounting
ccf3fa9b8e83 uspot: client_interim(): remove dead code
0e92cc9f6e75 uspotbpf: fix priority conflict with ratelimit
55d40a8794b6 uspot: implement traffic limiting
b05257e862cb uspot: implement swapio
e83f95081c21 uspot: radius_acct(): don't needlessly call uspotfilter
442cff773220 uspotfilter: cleanup unused API
7878d512cd21 handler-api: include 'seconds-remaining' only if not captive
cca6d218a6a7 handler-api: implement 'bytes-remaining'
e8cf3d08ac64 uspot: start(): ratelimit clearing is independent from RADIUS accounting
6d12a2da5b20 README update
bf6364cb61ea config: clarify units for acct_interval
8133b8cd215e uspot: implement state_get()/state_set()
094825fdfe68 radius-client: lowercase non-attribute JSON members
de70c588c2e3 radius-client: add error reporting
ebe9eac34f5b radius: add option for udp or tcp connection
d6b338d5d194 uspot: support RadSec with PSK authentication
53de77512159 uspot: validate config
d0578f740111 uspot: don't store debug data through uspotfilter
fe4fa5e8a25f uspot.init: rename DAS instance
bd1fbe481da3 README update
76a03155db44 uspot: add support for secondary RADIUS servers
694ff75f4fcc uspot: remove 'final_redirect_url' config option
a347454db08c handler: redirect UAM connected clients to the 'res=already' UAM url
0ea8f9bec545 handlers: simplify auth check
f69e1df8db0f Improve RADIUS error handling and reporting
34216b56b9ed src/CMakeLists: disable -Werror
8599a968877b Makefile: sync with OpenWrt repo

Update Makefile to reflect addition of the eBPF module and other changes
in the package

Signed-off-by: Thibaut VARÈNE <[email protected]>

ulogd: bump to version 2.0.9

Bump ulogd to version 2.0.9

Signed-off-by: Ian Ladd <[email protected]>

perl-xml-parser: fix host expat paths

expat is installed in host, not hostpkg.

Signed-off-by: Rosen Penev <[email protected]>

syncthing: fix discovery and relay extra args

Update configuration option examples.

Fixes: #26952
Signed-off-by: George Sapkin <[email protected]>

sing-box: update to 1.12.0

changelog: https://github.com/SagerNet/sing-box/releases/tag/v1.12.0

Signed-off-by: Gregory Gullin <[email protected]>

aliyun-cli: update to 3.0.294

Changelog:
https://github.com/aliyun/aliyun-cli/releases/tag/v3.0.294

Signed-off-by: Bruce Chen <[email protected]>

adguardhome: run as an unprivileged user

Run AdGuard Home without superuser privileges, by granting the binary
capabilities through ujail.

AdGuard Home writes new config files, so it must have r/w access to the
directory where these files live. Which means existing configs must be
migrated to a new directory, /etc/adguardhome, by default.

CAP_NET_BIND_SERVICE and CAP_NET_RAW capabilities are based on the
official documentation linked below.

Link: https://github.com/AdguardTeam/AdGuardHome/wiki/Getting-Started#running-without-superuser-linux-only
Signed-off-by: George Sapkin <[email protected]>

kmod: fix build failure in install step over dirty build dir

When building kmod-32 package for the first time (clean build_dir), it
builds and installs fine. When building for 2nd time, sometimes
(probably some race condition?) it fails to build in install step with
following error:

  for tool in insmod lsmod rmmod depmod modprobe modinfo; do \
   ln -s kmod /tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/$tool; \
  done
  ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/insmod': File exists
  ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/lsmod': File exists
  ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/rmmod': File exists
  ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/depmod': File exists
  ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/modprobe': File exists
  ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/modinfo': File exists

Lets fix it by backporting upstream fix.

Fixes: #27171
Link: https://lore.kernel.org/r/[email protected]
Upstream-Status: Backport [https://github.com/kmod-project/kmod/commit/c5054b215089f9e3cdc9602232649c2b5b1de743]
Signed-off-by: Petr Štetiar <[email protected]>

cloudreve: Update to 4.4.0

Signed-off-by: Tianling Shen <[email protected]>

CONTRIBUTING.md: accept only real names in the SoB

Follow the rule from the Submission Guidelines:
https://openwrt.org/submitting-patches#submission_guidelines

And the shared formal check:
https://github.com/openwrt/actions-shared-workflows/blob/ba03db3b5ae747ed9f38df6c96eb4a37a9f7f7c5/.github/workflows/formal.yml#L37-L43

And this commit 07c12180097283a7a53d14d173d7a7e6a1c43be8

Signed-off-by: Wesley Gimenes <[email protected]>

crowdsec-firewall-bouncer: update to 0.0.34

Description:
updated to new upstream release version 0.0.34

Maintainer: Kerma Gérald <[email protected]>
Run tested: mediatek/filogic, BPI-R3, Openwrt 24.10.2

Signed-off-by: S. Brusch <[email protected]>

adblock-fast: bugfixes: status & TLD check with unbound

fixes: https://github.com/openwrt/packages/issues/27146
supercedes: https://github.com/openwrt/packages/pull/27159

Signed-off-by: Stan Grishin <[email protected]>

sqlite3: bump to 3.50.4

Changelog: https://sqlite.org/releaselog/3_49_2.html
Changelog: https://sqlite.org/releaselog/3_50_0.html
Changelog: https://sqlite.org/releaselog/3_50_1.html
Changelog: https://sqlite.org/releaselog/3_50_2.html
Changelog: https://sqlite.org/releaselog/3_50_3.html
Changelog: https://sqlite.org/releaselog/3_50_4.html
Signed-off-by: George Sapkin <[email protected]>

sqlite3: require matching lib version in shell

Shell expects a matching library version to be installed. Specify a
matching version using EXTRA_DEPENDS.

Signed-off-by: George Sapkin <[email protected]>

sqlite3: fix CI test

Fixes: b2d2ba8ae ("sqlite3: add CI version check")
Signed-off-by: George Sapkin <[email protected]>

aliyun-cli: update to 3.0.292

Changelog:
https://github.com/aliyun/aliyun-cli/releases/tag/v3.0.292

Signed-off-by: Bruce Chen <[email protected]>

openlist: Update to 4.1.0

Release note: https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.0

Signed-off-by: Tianling Shen <[email protected]>

xray-core: Update to 25.8.3

Release note: https://github.com/XTLS/Xray-core/releases/tag/v25.8.3

Signed-off-by: Tianling Shen <[email protected]>

ddns-scripts: fix getting IP address via web in get_current_ip()

Add back the regex searching for valid IP address when getting IP
address via web.

Fixes: 9cdd1a1660b6 ("ddns-scripts: refactor get_current_ip()")
Signed-off-by: Qian Suyao <[email protected]>

banIP: update 1.5.6-7

* skip rdap requests/replies with placeholders for all IPv4/IPv6 addresses
* sanitize possible bogus config values, e.g. '/dev/null' as a directory
* change URL for beycyber feed

Signed-off-by: Dirk Brenken <[email protected]>

knot: update to version 3.4.8

Release notes: https://www.knot-dns.cz/2025-07-29-version-348.html

Signed-off-by: Jan Hák <[email protected]>

mwan3: remove Aaron Goodman as PKG_MAINTAINER

I received an email from Aaron Goodman saying that he is no longer working
with mwan3 and asking me to remove him from the PKG_MAINTAINER list.

Signed-off-by: Florian Eckert <[email protected]>

knot-resolver: update DNSSEC root trust anchors

This is long overdue.  Honestly I dislike that packaging
is hardcoding it this way.  It's error-prone, as we can see.
Knot Resolver source does contain the up to date anchors,
and it also (optionally) installs them.  Still, I'm not up to
larger changes in OpenWrt packaging right now.

Signed-off-by: Vladimír Čunát <[email protected]>

knot-resolver: update to version 5.7.6

Knot Resolver 5.7.6 (2025-07-17)
================================

Security
--------
- DoS: fix a rare segfault in `resolve` function (!1720)
  Someone controlling the DNS traffic might be able
  to trigger this crash intentionally and too often.
- DoS: drop a wrong assertion/crash (!1721)
  Someone controlling the DNS traffic will most likely be able
  to trigger this crash intentionally and too often.

Knot Resolver 5.7.5 (2025-04-24)
================================

Security
--------
- DoS: fix unconfirmed crashes with the line below (!1683)
  [system] requirement "h && h->end > h->begin" failed in queue_pop_impl

Improvements
------------
- tests: disable problematic config.http test (#925, !1678)
- validator: accept a confusing NODATA proof with insecure delegation (!1678)

Bugfixes
--------
- daemon/http: DoH stream got stuck after returning an error code (!1652)
- stats: request latency was very incorrect in some cases (!1678)

Signed-off-by: Vladimír Čunát <[email protected]>

golang: disable build for powerpc64

e5500 is the only powerpc64 target we have in tree, but it's not
supported by golang[1]. Since it's hard to opt e5500 out from the
supported arch list, simply remove powerpc64 from it for now.

1. https://github.com/golang/go/issues/19074

Signed-off-by: Tianling Shen <[email protected]>

clixon: Update to 7.5.0

Several new features including NACM support for mountpoints.  See
CHANGELOG.md

Signed-off-by: Philip Prindeville <[email protected]>

cligen: Update to 7.5.0

"const" patches still haven't been upstreamed.

Signed-off-by: Philip Prindeville <[email protected]>

mwan3: handle missing interface gracefully

`ubus.call(sprintf('network.interface.%s', ifname), 'status', {})`
returns null if the interface `ifname` doesn't exists (yet).

For pppoe interfaces using `option ipv6 auto`, a virtual interface suffixed `_6`
is automatically created once the connection is established,
but until then it doesn't exists.

Fixes: 6423781254b9f3e52c6102fb2cbcd9f99f2445a3 ("mwan3: reimplement rpcd plugin using ucode")
Signed-off-by: Etienne Champetier <[email protected]>

mariadb: update to 11.4.7

Use upstream solutions to local patches.

Remove test.sh as it's broken.

Signed-off-by: Rosen Penev <[email protected]>

hev-socks5-tunnel: update to 2.13.0

Upstream changelog:
https://github.com/heiher/hev-socks5-tunnel/releases/tag/2.13.0

Signed-off-by: Ray Wang <[email protected]>

rpcsvc-proto: Update to 1.4.4

Remove unneeded autoreconf.

Signed-off-by: Tianling Shen <[email protected]>