cloudreve: Update to 4.4.1

Release note: https://github.com/cloudreve/cloudreve/releases/tag/4.4.1

Signed-off-by: Tianling Shen <[email protected]>

uspot: update to Git HEAD (2025-08-07)

e2e3c649ab80 README update
18e6bcc14cc2 uspot/portal: urldecode FORM POST data
bf6051dba822 uspot/handler-uam: accept /login endpoint
32273591d8d5 uspotfilter: provide peer_lookup answers only for known clients
b0aeef9973a9 README: clarify uam vs radius mode features
b7b0d0efb0e2 uspot: improve config documentation
bce68a97fad8 captive: rename to 'uspot'
da6ca713e15d uspot: client_remove(): pass device to ratelimit client_delete()
3ebfe262bfb1 uspot: remove unused radius_call() args
691d73aa00dc uspot: let radius_init() set all required payload members
be50a66b777f uspot: allow setting global bandwidth limits
4851ada4b0c0 uspot: send Called-Station-Id in Acct-On/Off requests
0974fc8d47ac Implement uspot-bpf, an eBPF traffic counter
e99809f97e34 introduce uspotbpf.uc
7f6f43883568 uspotbpf: work around ucode-mod-bpf bug
319e0c285afb uspot: hook traffic accounting
ccf3fa9b8e83 uspot: client_interim(): remove dead code
0e92cc9f6e75 uspotbpf: fix priority conflict with ratelimit
55d40a8794b6 uspot: implement traffic limiting
b05257e862cb uspot: implement swapio
e83f95081c21 uspot: radius_acct(): don't needlessly call uspotfilter
442cff773220 uspotfilter: cleanup unused API
7878d512cd21 handler-api: include 'seconds-remaining' only if not captive
cca6d218a6a7 handler-api: implement 'bytes-remaining'
e8cf3d08ac64 uspot: start(): ratelimit clearing is independent from RADIUS accounting
6d12a2da5b20 README update
bf6364cb61ea config: clarify units for acct_interval
8133b8cd215e uspot: implement state_get()/state_set()
094825fdfe68 radius-client: lowercase non-attribute JSON members
de70c588c2e3 radius-client: add error reporting
ebe9eac34f5b radius: add option for udp or tcp connection
d6b338d5d194 uspot: support RadSec with PSK authentication
53de77512159 uspot: validate config
d0578f740111 uspot: don't store debug data through uspotfilter
fe4fa5e8a25f uspot.init: rename DAS instance
bd1fbe481da3 README update
76a03155db44 uspot: add support for secondary RADIUS servers
694ff75f4fcc uspot: remove 'final_redirect_url' config option
a347454db08c handler: redirect UAM connected clients to the 'res=already' UAM url
0ea8f9bec545 handlers: simplify auth check
f69e1df8db0f Improve RADIUS error handling and reporting
34216b56b9ed src/CMakeLists: disable -Werror
8599a968877b Makefile: sync with OpenWrt repo

Update Makefile to reflect addition of the eBPF module and other changes
in the package

Signed-off-by: Thibaut VARÈNE <[email protected]>

ulogd: bump to version 2.0.9

Bump ulogd to version 2.0.9

Signed-off-by: Ian Ladd <[email protected]>

perl-xml-parser: fix host expat paths

expat is installed in host, not hostpkg.

Signed-off-by: Rosen Penev <[email protected]>

syncthing: fix discovery and relay extra args

Update configuration option examples.

Fixes: #26952
Signed-off-by: George Sapkin <[email protected]>

sing-box: update to 1.12.0

changelog: https://github.com/SagerNet/sing-box/releases/tag/v1.12.0

Signed-off-by: Gregory Gullin <[email protected]>

aliyun-cli: update to 3.0.294

Changelog:
https://github.com/aliyun/aliyun-cli/releases/tag/v3.0.294

Signed-off-by: Bruce Chen <[email protected]>

adguardhome: run as an unprivileged user

Run AdGuard Home without superuser privileges, by granting the binary
capabilities through ujail.

AdGuard Home writes new config files, so it must have r/w access to the
directory where these files live. Which means existing configs must be
migrated to a new directory, /etc/adguardhome, by default.

CAP_NET_BIND_SERVICE and CAP_NET_RAW capabilities are based on the
official documentation linked below.

Link: https://github.com/AdguardTeam/AdGuardHome/wiki/Getting-Started#running-without-superuser-linux-only
Signed-off-by: George Sapkin <[email protected]>

kmod: fix build failure in install step over dirty build dir

When building kmod-32 package for the first time (clean build_dir), it
builds and installs fine. When building for 2nd time, sometimes
(probably some race condition?) it fails to build in install step with
following error:

  for tool in insmod lsmod rmmod depmod modprobe modinfo; do \
   ln -s kmod /tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/$tool; \
  done
  ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/insmod': File exists
  ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/lsmod': File exists
  ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/rmmod': File exists
  ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/depmod': File exists
  ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/modprobe': File exists
  ln: failed to create symbolic link '/tmp/build_dir/target-aarch64_cortex-a73+neon-vfpv4_musl/kmod-32/ipkg-install/usr/bin/modinfo': File exists

Lets fix it by backporting upstream fix.

Fixes: #27171
Link: https://lore.kernel.org/r/[email protected]
Upstream-Status: Backport [https://github.com/kmod-project/kmod/commit/c5054b215089f9e3cdc9602232649c2b5b1de743]
Signed-off-by: Petr Štetiar <[email protected]>

cloudreve: Update to 4.4.0

Signed-off-by: Tianling Shen <[email protected]>

CONTRIBUTING.md: accept only real names in the SoB

Follow the rule from the Submission Guidelines:
https://openwrt.org/submitting-patches#submission_guidelines

And the shared formal check:
https://github.com/openwrt/actions-shared-workflows/blob/ba03db3b5ae747ed9f38df6c96eb4a37a9f7f7c5/.github/workflows/formal.yml#L37-L43

And this commit 07c12180097283a7a53d14d173d7a7e6a1c43be8

Signed-off-by: Wesley Gimenes <[email protected]>

crowdsec-firewall-bouncer: update to 0.0.34

Description:
updated to new upstream release version 0.0.34

Maintainer: Kerma Gérald <[email protected]>
Run tested: mediatek/filogic, BPI-R3, Openwrt 24.10.2

Signed-off-by: S. Brusch <[email protected]>

adblock-fast: bugfixes: status & TLD check with unbound

fixes: https://github.com/openwrt/packages/issues/27146
supercedes: https://github.com/openwrt/packages/pull/27159

Signed-off-by: Stan Grishin <[email protected]>

sqlite3: bump to 3.50.4

Changelog: https://sqlite.org/releaselog/3_49_2.html
Changelog: https://sqlite.org/releaselog/3_50_0.html
Changelog: https://sqlite.org/releaselog/3_50_1.html
Changelog: https://sqlite.org/releaselog/3_50_2.html
Changelog: https://sqlite.org/releaselog/3_50_3.html
Changelog: https://sqlite.org/releaselog/3_50_4.html
Signed-off-by: George Sapkin <[email protected]>

sqlite3: require matching lib version in shell

Shell expects a matching library version to be installed. Specify a
matching version using EXTRA_DEPENDS.

Signed-off-by: George Sapkin <[email protected]>

sqlite3: fix CI test

Fixes: b2d2ba8ae ("sqlite3: add CI version check")
Signed-off-by: George Sapkin <[email protected]>

aliyun-cli: update to 3.0.292

Changelog:
https://github.com/aliyun/aliyun-cli/releases/tag/v3.0.292

Signed-off-by: Bruce Chen <[email protected]>

openlist: Update to 4.1.0

Release note: https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.0

Signed-off-by: Tianling Shen <[email protected]>

xray-core: Update to 25.8.3

Release note: https://github.com/XTLS/Xray-core/releases/tag/v25.8.3

Signed-off-by: Tianling Shen <[email protected]>

ddns-scripts: fix getting IP address via web in get_current_ip()

Add back the regex searching for valid IP address when getting IP
address via web.

Fixes: 9cdd1a1660b6 ("ddns-scripts: refactor get_current_ip()")
Signed-off-by: Qian Suyao <[email protected]>

banIP: update 1.5.6-7

* skip rdap requests/replies with placeholders for all IPv4/IPv6 addresses
* sanitize possible bogus config values, e.g. '/dev/null' as a directory
* change URL for beycyber feed

Signed-off-by: Dirk Brenken <[email protected]>

knot: update to version 3.4.8

Release notes: https://www.knot-dns.cz/2025-07-29-version-348.html

Signed-off-by: Jan Hák <[email protected]>

mwan3: remove Aaron Goodman as PKG_MAINTAINER

I received an email from Aaron Goodman saying that he is no longer working
with mwan3 and asking me to remove him from the PKG_MAINTAINER list.

Signed-off-by: Florian Eckert <[email protected]>

knot-resolver: update DNSSEC root trust anchors

This is long overdue.  Honestly I dislike that packaging
is hardcoding it this way.  It's error-prone, as we can see.
Knot Resolver source does contain the up to date anchors,
and it also (optionally) installs them.  Still, I'm not up to
larger changes in OpenWrt packaging right now.

Signed-off-by: Vladimír Čunát <[email protected]>

knot-resolver: update to version 5.7.6

Knot Resolver 5.7.6 (2025-07-17)
================================

Security
--------
- DoS: fix a rare segfault in `resolve` function (!1720)
  Someone controlling the DNS traffic might be able
  to trigger this crash intentionally and too often.
- DoS: drop a wrong assertion/crash (!1721)
  Someone controlling the DNS traffic will most likely be able
  to trigger this crash intentionally and too often.

Knot Resolver 5.7.5 (2025-04-24)
================================

Security
--------
- DoS: fix unconfirmed crashes with the line below (!1683)
  [system] requirement "h && h->end > h->begin" failed in queue_pop_impl

Improvements
------------
- tests: disable problematic config.http test (#925, !1678)
- validator: accept a confusing NODATA proof with insecure delegation (!1678)

Bugfixes
--------
- daemon/http: DoH stream got stuck after returning an error code (!1652)
- stats: request latency was very incorrect in some cases (!1678)

Signed-off-by: Vladimír Čunát <[email protected]>

golang: disable build for powerpc64

e5500 is the only powerpc64 target we have in tree, but it's not
supported by golang[1]. Since it's hard to opt e5500 out from the
supported arch list, simply remove powerpc64 from it for now.

1. https://github.com/golang/go/issues/19074

Signed-off-by: Tianling Shen <[email protected]>

clixon: Update to 7.5.0

Several new features including NACM support for mountpoints.  See
CHANGELOG.md

Signed-off-by: Philip Prindeville <[email protected]>

cligen: Update to 7.5.0

"const" patches still haven't been upstreamed.

Signed-off-by: Philip Prindeville <[email protected]>

mwan3: handle missing interface gracefully

`ubus.call(sprintf('network.interface.%s', ifname), 'status', {})`
returns null if the interface `ifname` doesn't exists (yet).

For pppoe interfaces using `option ipv6 auto`, a virtual interface suffixed `_6`
is automatically created once the connection is established,
but until then it doesn't exists.

Fixes: 6423781254b9f3e52c6102fb2cbcd9f99f2445a3 ("mwan3: reimplement rpcd plugin using ucode")
Signed-off-by: Etienne Champetier <[email protected]>

mariadb: update to 11.4.7

Use upstream solutions to local patches.

Remove test.sh as it's broken.

Signed-off-by: Rosen Penev <[email protected]>

hev-socks5-tunnel: update to 2.13.0

Upstream changelog:
https://github.com/heiher/hev-socks5-tunnel/releases/tag/2.13.0

Signed-off-by: Ray Wang <[email protected]>

rpcsvc-proto: Update to 1.4.4

Remove unneeded autoreconf.

Signed-off-by: Tianling Shen <[email protected]>

modemmanager: change permissions on dbus file

/etc/dbus-1/system.d/org.freedesktop.ModemManager1.conf needs to be 644
so that it can be read to prevent the following since dbus runs as an
unprivileged user:

dbus-daemon[12465]: Encountered error 'Failed to open "/etc/dbus-1/system.d/org.freedesktop.ModemManager1.conf": Permission denied' while parsing '/etc/dbus-1/system.d/org.freedesktop.ModemManager1.conf

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc

Signed-off-by: John Audia <[email protected]>

screen: update to 5.0.1

Fixes compilation with GCC15.

Remove upstreamed patch.

Signed-off-by: Rosen Penev <[email protected]>

dbus: use pid file owned by dbus

Switching to the dbus user in edc5a534 also needed to redefine the
location of dbus.pid into the directory under its ownership. This
commit fixes that omission.

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc

Signed-off-by: John Audia <[email protected]>

adblock-fast: update to 1.1.4-4

Makefile:
  - bugfix: change references to melmac.net to melmac.ca

README:
  - add basic README with the link to full documentation

Config:
  - add heartbeat_domain
  - add heartbeat_sleep_timeout
  - add sanity_check
  - add update_config_sizes

Init Script:
  - a lot of visual output improvements, especially with verbosity=2
  - better output separation for different verbosity levels
  - removed unneeded runningErrorFile
  - bugfix: updated runningConfigFile
  - updated runningStatusFile and added runningStatusFileLock
  - moved append_url() higher up for better visibility
  - refactor force-redownload/restart on some config changes functionality
  - improve count_blocked_domains
  - add internal debug_log() for debugging functions where output is captured
  - unified all json add/get calls in the same formatting
  - major rework on json() to allow storing of error/warning messages as json objects
  - added some error/warning messages
  - renamed `cache()` function to `adb_file()` to better reflect functionality
  - added functionality to test the dnsmasq config before restarting dnsmasq with ad-blocking
  - added functionality to throw warnings if TLDs or leading-dot domains are discovered
    in the final block-list file (can be disabled by `sanity_check` option)
  - added functionality to test DNS resolution after resolver restart with `heartbeat_domain`
    for `heartbeat_sleep_timeout` seconds
  - added functionality to revert the resolver's config/ad-blocking if heartbeat domain cannot
    be resolved after resolver restart
  - added `ALLOWED_TMP` variable/file for better processing of external allow-lists
  - added debug output to log with the elapsed time for each step of processing
  - drastically improved final block-list optimization with the new awk script
  - minor other performance improvements
  - added check_tld/check_leading_dot CLI commands to show domains breaking sanity checks
  - added validate functions to triggers

Signed-off-by: Stan Grishin <[email protected]>

pbr: update to 1.1.8-32

Makefile:
  - add SPDX-Identifier-License
  - update Copyright

README:
  - add basic README with the link to full documentation

Config:
  - add debug_dnsmasq
  - add procd_boot_trigger_delay

Init Script:
  - move extra_command calls high up for visibility
  - bump packageCompat to sync with luci app
  - implement support for debug_dnsmasq to dump dnsmasq debug into $packageDebugFile
  - create $runningStatusFile json-file allowing more verbose errors/warnings messages
  - replaced `state add` calls with json add calls to store errors/warnings messages
  - remove no longer needed errorSummary, warningSummary
  - ensure environment is only loaded once per run via $load_environment_flag
  - bugfix: update is_{host,hostname,domain,ipv4,mac_address} functions to properly sort policy entries
  - bugfix: change references to melmac.net to melmac.ca
  - add some new error/warning messages
  - add delay before service is started on boot via procd_boot_trigger_delay
  - bugfix: add logic to identify unknown policy entries instead of silently failing on them
  - store error/warning messages as json objects in ubus data for luci app
  - update load_validate_config with debug_dnsmasq and procd_boot_trigger_delay entries

Signed-off-by: Stan Grishin <[email protected]>

mwan3: reimplement rpcd plugin using ucode

On my "test" router (5 wans, 2 tracking ips per wan), before any rework,
prometheus-node-exporter-lua mwan3 average scraping time was 1230ms
(scraping only the interfaces), after optimizing the shell version,
average time was down to 485ms, with ucode we are now at 41ms.

Signed-off-by: Etienne Champetier <[email protected]>

mwan3: remove call to network_is_up

It calls jsonfilter but can be avoided as we know
network is up if uptime is present.

Signed-off-by: Etienne Champetier <[email protected]>

mwan3: return via variable

Using $(...) to call an internal function causes a fork().
Pass the name of the return variable as first parameter,
and write to it using 'export -n'.

Signed-off-by: Etienne Champetier <[email protected]>

mwan3: replace $(cat ..) with readfile

Remove a fork+exec

Signed-off-by: Etienne Champetier <[email protected]>

mwan3: remove pgrep usage

pgrep is pretty slow as it needs to read all /proc/*/cmdline
or /proc/*/status, and it's called twice per wan.
Add STARTED and PID files to speedup mwan3_get_mwan3track_status().

Signed-off-by: Etienne Champetier <[email protected]>

mwan3: add new readfile function to speedup variable read from file

This is a preparation for adding an utility function readfile() to read
directly to a variable. Using '$(cat ...)' causes a fork/execve which is
extremely slow just to read '~2' chars.

(commit message from Florian Eckert)
Signed-off-by: Etienne Champetier <[email protected]>

mwan3: simplify how we kill subprocs

Just use 'job -p' to list the subprocesses currently running,
so we do not needed the global variables TRACK_PID and SLEEP_PID anymore

Signed-off-by: Etienne Champetier <[email protected]>

openlist: Remove dependency on fuse

Fixes https://github.com/openwrt/packages/issues/27011

Signed-off-by: Liangbin Lian <[email protected]>

nfs-kernel-server: fix build

Add nls.mk and patch to avoid the build ending in an error:
In function 'write_table',
    inlined from 'write_tables' at rpc_tblout.c:73:4,
    inlined from 't_output.constprop' at rpc_main.c:841:3:
rpc_tblout.c:91:26: error: '%s' directive writing likely 1 or more bytes into a region of size between 0 and 99 [-Werror=format-overflow=]
   91 |       s_print (progvers, "%s_%s",
      |                          ^
rpc_tblout.c:91:26: note: assuming directive output of 1 byte
In function 'sprintf',
    inlined from 'write_table' at rpc_tblout.c:91:7,
    inlined from 'write_tables' at rpc_tblout.c:73:4,
    inlined from 't_output.constprop' at rpc_main.c:841:3:
/scratch/union/staging_dir/toolchain-x86_64_gcc-15.1.0_glibc/include/bits/stdio2.h:30:10: note: '__builtin___sprintf_chk' output 2 or more bytes (assuming 102) into a destination of size 100
   30 |   return __builtin___sprintf_chk (__s, __USE_FORTIFY_LEVEL - 1,
      |          ^
lto1: some warnings being treated as errors
make[6]: *** [/scratch/union/tmp/ccHfYNRX.mk:2: /scratch/union/tmp/ccudJcWZ.ltrans0.ltrans.o] Error 1
lto-wrapper: fatal error: make returned 2 exit status
compilation terminated.
mold: fatal: lto-wrapper failed

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc

Co-developed-by: Rosen Penev <[email protected]>
Signed-off-by: John Audia <[email protected]>

idevicerestore: update to the latest git version

change log
https://github.com/libimobiledevice/idevicerestore/commits/master/

Signed-off-by: Georgi Valkov <[email protected]>

ideviceinstaller: update to the latest git version

change log
https://github.com/libimobiledevice/ideviceinstaller/commits/master/

Signed-off-by: Georgi Valkov <[email protected]>

ifuse: update to the latest git version

dependency changed from fuse-utils to fuse3-utils

change log
https://github.com/libimobiledevice/ifuse/commits/master/

Signed-off-by: Georgi Valkov <[email protected]>

libideviceactivation: update to the latest git version

change log
https://github.com/libimobiledevice/libideviceactivation/commits/master/

Signed-off-by: Georgi Valkov <[email protected]>

usbmuxd: update to the latest git version

change log
https://github.com/libimobiledevice/usbmuxd/commits/master/

Signed-off-by: Georgi Valkov <[email protected]>

libimobiledevice: update to the latest git version

Fix initial device enumeration

change log
https://github.com/libimobiledevice/libimobiledevice/commits/master/

Signed-off-by: Georgi Valkov <[email protected]>

libusbmuxd: update to 2.1.1

change log
https://github.com/libimobiledevice/libusbmuxd/releases/tag/2.1.1

Signed-off-by: Georgi Valkov <[email protected]>

libimobiledevice-glue: update to 1.3.2

change log
https://github.com/libimobiledevice/libimobiledevice-glue/releases/tag/1.3.2

Signed-off-by: Georgi Valkov <[email protected]>

libtatsu: update to 1.0.5

change log
https://github.com/libimobiledevice/libtatsu/releases/tag/1.0.5

Signed-off-by: Georgi Valkov <[email protected]>

libplist: update to 2.7.0

Fix segmentation fault when calling plist_sort() on an empty dictionary

change log
https://github.com/libimobiledevice/libplist/releases/tag/2.7.0

Signed-off-by: Georgi Valkov <[email protected]>

dbus: run as regular user rather than as root

Running as a dedicated dbus users is better from both a security and an
isolation perspective than running as root.

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc

Signed-off-by: John Audia <[email protected]>

tailscale: update to 1.86.2

Changelog: https://tailscale.com/changelog#2025-07-24
Changelog: https://tailscale.com/changelog#2025-07-29

Signed-off-by: Sandro Jäckel <[email protected]>

yq: Update to 4.47.1

Release note: https://github.com/mikefarah/yq/releases/tag/v4.47.1

Signed-off-by: Tianling Shen <[email protected]>

openlist: Update to 4.0.9

Release note: https://github.com/OpenListTeam/OpenList/releases/tag/v4.0.9

Signed-off-by: Tianling Shen <[email protected]>

fuse3: update to version 3.17.3

replace old patch with the one accepted upstream

change log
- more conn->want / conn->want_ext conversion fixes
- Fix feature detection for close_range
- Avoid possible double unmount on FUSE_DESTROY

Signed-off-by: Georgi Valkov <[email protected]>

dbus: update to 1.16.2

Update the 1.16.2 and adapt Makefile to meson build system.

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc

Signed-off-by: John Audia <[email protected]>

libsodium: update to 1.0.20

Change log
[1] https://github.com/jedisct1/libsodium/blob/master/ChangeLog

Signed-off-by: Georgi Valkov <[email protected]>

python: adjust with glibc and libcrypt-compat

Fix #27012

Signed-off-by: Vladimir Ermakov <[email protected]>

libsodium: fix building with GCC 15.1

Force the default C version to -std=gnu17,

to fix the following build error:

<command-line>: error: unknown type name 'thread_local'; did you mean 'pthread_rwlock_t'?
randombytes/internal/randombytes_internal_random.c:132:8: note: in expansion of macro 'TLS'
  132 | static TLS InternalRandom stream = {
      |        ^~~
randombytes/internal/randombytes_internal_random.c:132:27: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'stream'
  132 | static TLS InternalRandom stream = {
      |                           ^~~~~~

[1] https://github.com/openwrt/openwrt/pull/16522#issuecomment-3134756935
[2] https://github.com/openwrt/packages/issues/27122

Tested-by: Georgi Valkov <[email protected]>
Signed-off-by: Lovin Yarn <[email protected]>

mqttled: remove package

Development of this package is stalled [1],
it uses python3-netifaces [2], but that repository
was archived in 20211 [3], because there does not
seems to be replacement according to this issue:
https://github.com/trevortrevor/mqttled/issues/3

Let's remove it.

[1] https://github.com/trevortrevor/mqttled/
[2] https://github.com/trevortrevor/mqttled/issues/3
[3] https://github.com/al45tair/netifaces

Signed-off-by: Josef Schlehofer <[email protected]>

python-incremental: Update to 24.7.2

To see changes check NEWS [1].

[1] https://github.com/twisted/incremental/blob/incremental-24.7.2/NEWS.rst

Signed-off-by: Richard Muzik <[email protected]>

ufp: remove not needed bpf-headers in PKG_BUILD_DEPENDS

The package 'ufp' does not need bpf-headers.

Signed-off-by: Florian Eckert <[email protected]>

openappid: update to 20230609

Version bump to latest.

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc

Signed-off-by: John Audia <[email protected]>

iperf3: update to 3.19.1

Update to latest upstream release.

Changelog: https://github.com/esnet/iperf/releases/tag/3.19.1

Relevant security fixes: E-2025-54349, ESNET-SECADV-2025-0003, CVE-2025-54350,
ESNET-SECADV-2025-0002, VE-2025-54351, ESNET-SECADV-2025-0001

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc

Signed-off-by: John Audia <[email protected]>

rclone: backport ftp insecure TLS ciphers fix

Added config field to allow insecure TLS ciphers that were disabled
in Go 1.22.

Fixes: #27039
Signed-off-by: Tianling Shen <[email protected]>

crun: fix compilation with GCC 15

Need to fix function prototype

Signed-off-by: Rosen Penev <[email protected]>

aliyun-cli: add new package

The Alibaba Cloud CLI is a tool to manage and
use Alibaba Cloud resources through a command line interface

Signed-off-by: Bruce Chen <[email protected]>

yt-dlp: bump to 2025.07.21

Changelog: https://github.com/yt-dlp/yt-dlp/releases/tag/2025.07.21
Signed-off-by: George Sapkin <[email protected]>

nvme-cli: update to 2.15

Bump to latest upstream release.

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc

Signed-off-by: John Audia <[email protected]>

libmvme: bump to 1.15

Update to latest upstream release.

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc

Signed-off-by: John Audia <[email protected]>

inih: Update to r61

Release note: https://github.com/benhoyt/inih/releases/tag/r61

Signed-off-by: Tianling Shen <[email protected]>

adguardhome: bump to 0.107.64

Changelog: https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.64
Signed-off-by: George Sapkin <[email protected]>

sumo: update to 1.23.1

Remove no longer needed GCC14 patch.

Make python optional. It's not used anyway.

Signed-off-by: Rosen Penev <[email protected]>

softethervpn5: fix compilation without OS ncurses

For some reason, the ncurses.pc file for the host build gets installed
in host instead of hostpkg. Just override the whole thing. The tool
built doesn't even use ncurses.

Signed-off-by: Rosen Penev <[email protected]>

cyrus-sasl: fix build with GCC 15.1

Apply the patch Fedora uses, named cyrus-sasl-2.1.28-gcc15.patch there,
to fix building with GCC 15.1. As with other recent versions, GCC 15.1
transforms some warnings into errors, and this patch removes those
warnings, now errors. Upstream accepted a similar patch by the same
author at:

https://github.com/cyrusimap/cyrus-sasl/pull/869

The commit described here does not use the upstream patch because it
assumes the removal of CRAM-MD5 (lib/md5.c), but this has not happened
as of the packaged version, namely 2.1.28. A future release will clean
all of this up and remove the need for the patch this commit adds.

Signed-off-by: W. Michael Petullo <[email protected]>

mstflint: fix SECTION variable typo

Change SECTION variable value from `Utilities` to `utils`,
probably a confusion with the variable CATEGORY.

Signed-off-by: Wesley Gimenes <[email protected]>

bluez-tools: fix SECTION variable typo

Change SECTION variable value from `Utilities` to `utils`,
probably a confusion with the variable CATEGORY.

Signed-off-by: Wesley Gimenes <[email protected]>

xz: update to 5.8.1

Update xz to match the version in tools/

Also add a new GitHub package URL.

Signed-off-by: Fengyu Wu <[email protected]>

atop: update to 2.12.0

2.11.0 will not compile with GCC15, so update to 2.12.0.
It also fixes CVE-2025-31160.

Fixes: #27085
Signed-off-by: Robert Marko <[email protected]>

docker-compose: Update to version 2.39.1

Release notes:
https://github.com/docker/compose/releases/tag/v2.39.1

Signed-off-by: Javier Marcet <[email protected]>

hev-socks5-tunnel: update to 2.12.0

Upstream changelog:
https://github.com/heiher/hev-socks5-tunnel/releases/tag/2.12.0

Signed-off-by: Ray Wang <[email protected]>

hev-socks5-tproxy: update to 2.9.0

Upstream changelog:
https://github.com/heiher/hev-socks5-tproxy/releases/tag/2.9.0

Signed-off-by: Ray Wang <[email protected]>

hev-socks5-server: update to 2.9.0

Upstream changelog:
https://github.com/heiher/hev-socks5-server/releases/tag/2.9.0

Signed-off-by: Ray Wang <[email protected]>

xray-core: Update to 25.7.26

Release note: https://github.com/XTLS/Xray-core/releases/tag/v25.7.26

Signed-off-by: Tianling Shen <[email protected]>

CONTRIBUTING.md: fix commit subject example format

Update the commit subject example in CONTRIBUTING.md
to match the documented guidelines, ensuring it uses lowercase
after the package prefix.

Signed-off-by: Wesley Gimenes <[email protected]>

microsocks: Update to 1.0.5

Release note: https://github.com/rofl0r/microsocks/releases/tag/v1.0.5

Removed upstreamed patches.

Signed-off-by: Tianling Shen <[email protected]>

rngd-tools: run as unprivileged user

For better security and isolation, used the -D option to run as newly
created unprivileged user.

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc

Signed-off-by: John Audia <[email protected]>

lua-eco: update to 3.11.0

changelog: https://github.com/zhaojh329/lua-eco/releases/tag/v3.11.0

Signed-off-by: Jianhui Zhao <[email protected]>

ddns-scripts: add dondominio.com

Adds support for dondominio.com to the ddns-scripts package.
https://dondominio.dev/en/dondns/docs/api/#usage

Signed-off-by: Alejandro Ojeda Gutiérrez <[email protected]>

netbird: update to 0.51.2

changelog: https://github.com/netbirdio/netbird/releases/tag/v0.51.2

Signed-off-by: Wesley Gimenes <[email protected]>

kea: update to 2.6.3

Update Kea to the stable release 2.6.3.
This version brings various build and security improvements.
In particular, support for Boost 1.87 has been officially merged
upstream, so the previously required patch 020-boost-187.patch
has been removed.

Signed-off-by: Liu Yu <[email protected]>

rsync: run as regular user rather than as root

Rsyncd only needs a subset of all capabilities so create
a dedicated user with these capabilities. This is better from both a
security and an isolation perspective than running as root.

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc

Signed-off-by: John Audia <[email protected]>

linknx: bump to new upstream 0.0.1.39

Signed-off-by: Othmar Truniger <[email protected]>

natmap: update to 20250721

Upstream changelog:
https://github.com/heiher/natmap/releases/tag/20250721

Signed-off-by: Ray Wang <[email protected]>