tunneldigger: add broker_selection option to expose load balancing capabilities

Using the broker_selection param makes it possible to decide by use (default),
always use the first available broker to connect or select a random broker

See also: https://github.com/wlanslovenija/tunneldigger/blob/51a5e46ad143c92d2867835a563146ec4fbc6211/client/l2tp_client.c#L1331-L1333

Signed-off-by: Florian Maurer <[email protected]>

zerotier: update to 1.16.0

Authored-by: Óscar García Amor <[email protected]>
Signed-off-by: Moritz Warning <[email protected]>

btop: Update to 1.4.5

Release note: https://github.com/aristocratos/btop/releases/tag/v1.4.5

Signed-off-by: Tianling Shen <[email protected]>

cloudflared: Update to 2025.9.0

Release note: https://github.com/cloudflare/cloudflared/releases/tag/2025.9.0

Signed-off-by: Tianling Shen <[email protected]>

openlist: Update to 4.1.3

Release note: https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.3

Signed-off-by: Tianling Shen <[email protected]>

syncthing: bump to 2.0.9

Major version change that switches DB backend from
LevelDB to SQLite. Requires golang 1.24+.

- improve syncthing argument parsing to be more
  robust
- remove unused and add updated config options

Changelog: https://github.com/syncthing/syncthing/releases/tag/v2.0.0
Changelog: https://github.com/syncthing/syncthing/releases/tag/v2.0.1
Changelog: https://github.com/syncthing/syncthing/releases/tag/v2.0.2
Changelog: https://github.com/syncthing/syncthing/releases/tag/v2.0.3
Changelog: https://github.com/syncthing/syncthing/releases/tag/v2.0.4
Changelog: https://github.com/syncthing/syncthing/releases/tag/v2.0.5
Changelog: https://github.com/syncthing/syncthing/releases/tag/v2.0.6
Changelog: https://github.com/syncthing/syncthing/releases/tag/v2.0.7
Changelog: https://github.com/syncthing/syncthing/releases/tag/v2.0.8
Changelog: https://github.com/syncthing/syncthing/releases/tag/v2.0.9
Signed-off-by: George Sapkin <[email protected]>
wip

Signed-off-by: George Sapkin <[email protected]>

lf: update to r38

https://github.com/gokcehan/lf/releases/tag/r38

Signed-off-by: Nate Robinson <[email protected]>

unbound: update README

* add adblock-fast to the Ad Blocking segment
* fix grammar (Its -> It's)
* modify last paragraph of the instructions as they are specific to adblock

Signed-off-by: Stan Grishin <[email protected]>

sane-backends: update to 1.4.0

Changelog: https://gitlab.com/sane-project/backends/-/releases/1.4.0
Signed-off-by: Luiz Angelo Daros de Luca <[email protected]>

gphoto2: update to 2.5.32

Fixes compilation with GCC15.

Signed-off-by: Rosen Penev <[email protected]>

libgphoto2: update to 2.5.32

Fixes compilation with GCC15.

Signed-off-by: Rosen Penev <[email protected]>

net/iputils: fix PKG_CPE_ID

iputils_project:iputils has been deprecated in favour of iputils:iputils

Signed-off-by: Fabrice Fontaine <[email protected]>

cjson: fix PKG_CPE_ID

cjson_project:cjson has been deprecated in favour of davegamble:cjson:
https://nvd.nist.gov/products/cpe/detail/70BC45DA-D915-4A1D-96AF-84A6CECEE148

Signed-off-by: Fabrice Fontaine <[email protected]>

python-cryptography: fix PKG_CPE_ID

cryptography_project:cryptography has been deprecated in favour of
cryptography.io:cryptography:
https://nvd.nist.gov/products/cpe/detail/2EBA50FC-F3F9-40D5-82BD-EFB67F761153

Signed-off-by: Fabrice Fontaine <[email protected]>

gnuplot: fix PKG_CPE_ID

gnuplot_project:gnuplot has been deprecated in favour of
gnuplot:gnuplot:
https://nvd.nist.gov/products/cpe/detail/DB68C9F5-3330-4749-A6F5-61FF041037CC

Signed-off-by: Fabrice Fontaine <[email protected]>

boinc: fix PKG_CPE_ID

rom_walton:boinc has been deprecated in favour of
universityofcalifornia:boinc_client:
https://nvd.nist.gov/products/cpe/detail/DAC161C5-2154-44BF-916A-EACB524E8B8F

Signed-off-by: Fabrice Fontaine <[email protected]>

sendmail: update to 8.18.1

- Fix GCC 15 build with 2 patches from Gentoo [1][2]
- Refresh existing patch
- Extend 010-enable-nonroot-install.patch to remove "-o U -g G" from
  more install targets (fixes 'invalid user buildbot' in CI)

[1]: https://github.com/gentoo/gentoo/blob/master/mail-mta/sendmail/files/sendmail-8.18.1-c23-sm_strtoll.patch
[2]: https://github.com/gentoo/gentoo/blob/master/mail-mta/sendmail/files/sendmail-8.18.1-c23-ctime.patch

Co-authored-by: W. Michael Petullo <[email protected]>
Signed-off-by: Aleksey Vasilenko <[email protected]>

snort3: add patch to unambiguously show vectorscan

When snort is run with the --version option, it advertises components'
versions in the output. Add a patch to modify the output to clearly
show vectorscan is in use.

Signed-off-by: John Audia <[email protected]>

snort3: replace hyperscan with vectorscan in deps

* Replacement of hyperscan-runtime reference with vectorscan-runtime
* Added support for all aarch64 targets which I believe is exhaustive

For x86 and x86/64, I found that vectorscan is truly a drop-in
replacement for hyperscan as assessed by speedtests with snort3 running
on my Intel N150 PC. CPU load during the test with each condition was
nearly saturating on a single core for both cases on a symmetrical
Gbps line.

Using: https://www.waveform.com/tools/bufferbloat in IPS mode:
  Download speed w/ hyperscan: 950-960 Mbit/s (n=2)
  Download speed w/ vectorscan: 942-960 Mbit/s (n=2)

Using: https://www.speedtest.net in IPS mode:
  Download speed w/ hyperscan: 996-1002 Mbit/s (n=2)
  Download speed w/ vectorscan: 993-988 Mbit/s (n=2)

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc (Intel N150 based box running snort3)

Signed-off-by: John Audia <[email protected]>

hyperscan: remove package

Remove hyperscan since Intel announced a proprietary/closed source
license beginning with hyperscan 5.5[1,2] and a general lock of support
for the 5.4.x branch which has not seen a commit since 19-Apr-2023[3].

1. https://networkbuilders.intel.com/docs/networkbuilders/accelerate-snort-performance-with-hyperscan-and-intel-xeon-processors-on-public-clouds-1680176363.pdf
2. https://www.phoronix.com/news/Intel-Hyperscan-Now-Proprietary (and references therein)
3. intel/hyperscan@bc3b191

Signed-off-by: John Audia <[email protected]>

snort3: remove hyperscan specific patch

Drop 100-remove-HAVE_HS_COMPILE_LIT-to-work-around-upstream-b.patch as
it was only needed to fix the build against hyperscan. Vectorscan
builds fine without it.

Signed-off-by: John Audia <[email protected]>

vectorscan: new package for speeding up regex ops

Vectorscan is fork of Hyperscan, a high-performance multiple regex
matching library. It follows the regular expression syntax of the
commonly-used libpcre library, but is a standalone library with
its own C API.

Currently ARM NEON/ASIMD and Power VSX are 100% functional. ARM
SVE2 support is in ongoing with access to hardware now. More
platforms will follow in the future.

The performance difference of snort3 compiled against this is
sizable for aarch64 confirmed on two different SoCs:

Test SoC #1 flogic/glinet_gl-mt6000
IDS mode:
Download speed wo/ vectorscan: 91.2 ±0.21 Mbit/s (n=3)
Download speed using vectorscan: 331.0 ±27.34 Mbit/s (n=3)
Gain of 3.6x

IPS mode:
Download speed wo/ vectorscan: 30.0 ±0.06 Mbit/s (n=3)
Download speed using vectorscan: 52.9 ±0.78 Mbit/s (n=3)
Gain of 1.8x

Notes:
* Data generated on snapshot build on 12-Apr-2024 using kernel
  6.6.26, snort 3.1.84.0, vectorscan 5.4.11.
* Speedtest script hitting the same server.
* Snort rules file of was 37,917 lines/22 MB.
* In all cases, single core CPU saturation occurred which
  speaks to the efficiency gains supplied by vectorscan.

Test Soc #2 bcm2712/RPi5B

IPS mode:
Download speed wo/ vectorscan: 164.3 ±0.64 Mbit/s (n=3)
Download speed using vectorscan: 232.8 ±0.26 Mbit/s (n=3)
Gain of 1.4x

Notes:
* Data generated on snapshot build on 13-Apr-2024 using kernel
  6.1.86, snort 3.1.84.0, vectorscan 5.4.11.
* Google fiber speedtest (https://fiber.google.com/speedtest/)
  hitting the same server.
* Snort rules contained 39,801 rules/22 MB.
* In all cases, single core CPU saturation occurred which
  speaks to the efficiency gains supplied by vectorscan.

Build system: x86/64
Build-tested: flogic/glinet_gl-mt6000, bcm2712/RPi5B, x86/64-glibc
Run-tested: flogic/glinet_gl-mt6000, bcm2712/RPi5B, x86/64-glibc (Intel N150 based box)

Co-authored-by: Tianling Shen <[email protected]>
Co-authored-by: Jeffery To <[email protected]>
Signed-off-by: John Audia <[email protected]>

bind: don't break IPv6 support

What started in #20183 as a attempt to clean up noise in the logfiles,
turned out to be causing denial-of-service for dual-stack and especially
IPv6-only environments.

Breaking core network functionality cannot possibly be less important
than cosmetic issues, and those affected by log spam can avoid it via
other means (e.g. "query-source-v6 none;" in named.conf).

There's no reliable heuristic for determining whether there's IPv6
connectivity at the time bind is started which will catch any and all
corner cases, as discussed in #26327.

So, remove this logic for now. If a suitable heuristic can be devised,
it can always be added in a subsequent patch, but I have my doubts.

(Also, quote one variable to make shellcheck happy)

Closes: #26327
Closes: #20468
Signed-off-by: David Härdeman <[email protected]>

rust: Update to 1.90.0

Release note: https://blog.rust-lang.org/2025/09/18/Rust-1.90.0/

Signed-off-by: Tianling Shen <[email protected]>

fluent-bit: update to 4.0.9

- Remove obsolete patch
- Add patch replace NPN with ALPN for client connections \
because the default OpenSSL library does not enable NPN.
- Add newly libstdcpp dependency

Build system: aarch64
Build-tested: mediatek/filogic
Run-tested: mediatek/filogic

Signed-off-by: Biao Zhu <[email protected]>

ruby: update to 3.4.5

Ruby 3.4.0 is a major release that introduces several changes:
- Adds `it` block parameter reference
- Switches default parser to Prism
- Implements Happy Eyeballs Version 2 in the socket library
- Improves YJIT
- Adds Modular GC
- And more (see changelog for full details)

Subsequent minor releases include:
- 3.4.1: fixes version description
- 3.4.2: routine bugfix release
- 3.4.3: routine bugfix release
- 3.4.4: routine bugfix release (Linux-specific)
- 3.4.5: routine bugfix release, adds GCC 15 support

Packaging changes:
- (NEW) ruby-repl_type_completor (packaging the repl_type_completor gem)
- Refreshed package dependencies
- Updated `ruby_missingfiles` (detects unpacked files) to use `apk`
- Refactored `ruby_find_pkgsdeps` (detects inter-package dependencies)
  to use the Ruby parser (Prism) instead of heuristic string matching

Changelog: https://www.ruby-lang.org/en/news/2024/12/25/ruby-3-4-0-released/
Signed-off-by: Luiz Angelo Daros de Luca <[email protected]>

netbird: update to 0.57.1

changelog: https://github.com/netbirdio/netbird/releases/tag/v0.57.1

Signed-off-by: Wesley Gimenes <[email protected]>

dnscrypt-proxy2: update to version 2.1.14

- update dnscrypt-proxy2 to version 2.1.14
- add GO_PKG_INSTALL_EXTRA:= dnscrypt-proxy/static/ to fix build error

Contributed-by: @ScoutJamboree
Signed-off-by: Niklas Thorild <[email protected]>

adguardhome: bump to 0.107.66

Changelog: https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.66
Signed-off-by: George Sapkin <[email protected]>

yt-dlp: bump to 2025.09.05

Changelog: https://github.com/yt-dlp/yt-dlp/releases/tag/2025.08.27
Changelog: https://github.com/yt-dlp/yt-dlp/releases/tag/2025.09.05
Signed-off-by: George Sapkin <[email protected]>

hev-socks5-server: update to 2.10.0

Upstream changelog:
https://github.com/heiher/hev-socks5-server/releases/tag/2.10.0

Signed-off-by: Ray Wang <[email protected]>

adblock-fast: bugfix: dl command

* only test gzip existence and reset action/param on boot

Signed-off-by: Stan Grishin <[email protected]>

cmdpad: Remove from packages and move to packages-abondoned

Signed-off-by: Ted Hess <[email protected]>

cmdpad: fix compilation with GCC 15

There's no parameter to this function.

Signed-off-by: Rosen Penev <[email protected]>

tailscale: update to 1.88.1

Signed-off-by: Sandro Jäckel <[email protected]>

xray-core: Update to 25.9.11

Release note: https://github.com/XTLS/Xray-core/releases/tag/v25.9.11

Signed-off-by: Tianling Shen <[email protected]>

yq: Update to 4.47.2

Release note: https://github.com/mikefarah/yq/releases/tag/v4.47.2

Signed-off-by: Tianling Shen <[email protected]>

telegraf: update to 1.36.1

- Update Telegraf to v1.36.1
- Adjust "telegraf.conf" to new defaults
- Set HOME environment variable in service file
- Change maintainer

Signed-off-by: Niklas Thorild <[email protected]>

cloudreve: Update to 4.8.0

Release note:
- https://github.com/cloudreve/cloudreve/releases/tag/4.7.0
- https://github.com/cloudreve/cloudreve/releases/tag/4.8.0

Signed-off-by: Tianling Shen <[email protected]>

inih: Update to r62

Release note: https://github.com/benhoyt/inih/releases/tag/r62

Signed-off-by: Tianling Shen <[email protected]>

travelmate: release 2.1.4

- fixed  telekom login script (#27072)
- fixed the connection tracking/f_net function,
  to stabilize (vpn) connections (#27235)
- removed needless log message

Signed-off-by: Dirk Brenken <[email protected]>

golang: update to 1.25.1

Fixes: CVE-2025-47910
Link: https://github.com/golang/go/issues?q=milestone%3AGo1.25.1%20label%3ACherryPickApproved
Signed-off-by: Sandro Jäckel <[email protected]>

docker-compose: Update to version 2.39.3

Release notes:
https://github.com/docker/compose/releases/tag/v2.39.3

Signed-off-by: Javier Marcet <[email protected]>

port-mirroring: remove package

- The project was archived on Mar 22, 2024.
- The maintainer of the package and the upstream maintainer are the
  same person, who has expressed their intention not to maintain the
  package/project. See the quote[1] below:

  > I haven't been maintaining this and I don't plan to spend any more
  > time on it. Happy to hand it off, if someone is willing to take it on.

- The latest significant commit for the package (no treewide changes)
  is commit 2c71d5bcd4e09b926d63d0fbba39534fd2c587f7 from Mar 29, 2020.
- The latest upstream commit[2] is from Mar 22, 2024, but it is a
  documentation or cosmetic change. After this, the latest commits[3]
  are from Apr 6, 2019.

[1]: https://github.com/openwrt/packages/pull/27398#issuecomment-3250671659
[2]: https://github.com/mmaraya/port-mirroring/commit/776fe2bb48333a0414fde609b1c63b11d298246b
[3]: https://github.com/mmaraya/port-mirroring/commit/dcce6aeb0a977090ebd4a3c80a33df7715241f21

Closes: https://github.com/openwrt/packages/issues/27394
Signed-off-by: Wesley Gimenes <[email protected]>

csshnpd: bump to c1.0.16 release

Upstream release aligned to cJSON 1.7.19

Signed-off-by: Chris Swan <[email protected]>

sing-box: update to 1.12.8

changelog: https://github.com/SagerNet/sing-box/releases/tag/v1.12.8

Signed-off-by: xiao bo <[email protected]>

rp-pppoe: delete the file /etc/ppp/options

/etc/ppp/options is the configuration file for the ppp package.
rp-pppoe depends on the ppp package.

Signed-off-by: Findlay Feng <[email protected]>

lua-eco: update to 3.12.0

A new module `shared` added since this version.

changelog: https://github.com/zhaojh329/lua-eco/releases/tag/v3.12.0

Signed-off-by: Jianhui Zhao <[email protected]>

nfs-kernel-server: update to v2.8.4

Update to v2.8.4

Shortlog:
Anna Schumaker (4):
      rpcctl: Add support for `rpcctl switch add-xprt`
      rpcctl: Display new rpc_clnt sysfs attributes
      rpcctl: Add support for the xprtsec sysfs attribute
      rpcctl: Rename {read,write}_addr_file()

Antonio Alvarez Feijoo (3):
      nfsroot-generator: do not fail if nfsroot is not configured
      systemd: Add a generator to mount /sysroot via NFSv4 in the initrd
      systemd: Allow nfs-idmapd.service to be started without the server

Scott Mayhew (3):
      rpc-statd.service: define dependency on both rpcbind.service and rpcbind.socket
      nfsdctl: fix lockd config during autostart
      nfsdctl: debug logging fixups

Steve Dickson (3):
      Release: 2.8.4
      configure.ac: AC_PROG_GCC_TRADITIONAL is obsolete.
      nfsdctl: Warning Clean Up

zhangyaqi (2):
      gssd:fix the possible buffer overflow in get_full_hostname
      nfsdcld:Fix a memory leak

Thiago Becker (1):
      nfsrahead: modify get_device_info logic

Yaakov Selkowitz (1):
      Fix build with glibc-2.42

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc

Signed-off-by: John Audia <[email protected]>

cjson: update to 1.7.19

This is a bugfix release
Full release notes available at:
https://github.com/DaveGamble/cJSON/releases/tag/v1.7.19

Signed-off-by: Chris Swan <[email protected]>

snapcast: fix PulseAudio

While testing my integration of Snapcast, I didn't test with CONFIG_ALL*
and CONFIG_BUILDBOT flags, but the buildbots did and failed with a lot
of undefined reference to PulseAudio.

Fix it with preventing PulseAudio detection.
While at it, prevent Avahi detection too to save more flash space.

These features will be available later, through flavours.

Fixes: https://github.com/openwrt/packages/pull/23956
Fixes: eeb8d131fc93 ("snapcast: add package snapserver and snapclient")
Signed-off-by: Szabolcs Hubai <[email protected]>

lighttpd: update to lighttpd 1.4.82 release hash

Ref: https://www.lighttpd.net/2025/9/12/1.4.82/

Signed-off-by: Glenn Strauss <[email protected]>

bind: fix build and bump PKG_RELEASE

bind9 builds for me on 24.10, but it doesn't build on master with or without my
patches.

The build already dies on the configure stage (without my patches applied),
because the autoconf magic manages to mix up the host gcc and the
cross-compiling gcc.

Removing PKG_FIXUP:=autoreconf from the Makefile fixes that, but compilation chokes later instead on libtool magic:

    make[7]: Entering directory '/home/build/openwrt/build_dir/target-arm_cortex-a9+vfpv3-d16_musl_eabi/bind-9.20.11/bin/rndc'
    ...
    /bin/bash ../../libtool  --tag=CC   --mode=link arm-openwrt-linux-muslgnueabi-gcc ...
    libtool: link: arm-openwrt-linux-muslgnueabi-gcc ...
    .../bin/ld.bfd: warning: libns-9.20.11.so, needed by ../../lib/isccfg/.libs/libisccfg.so, not found (try using -rpath or -rpath-link)
    ...
    collect2: error: ld returned 1 exit status

Which I did a (compile-tested only) quick and dirty fix for.

Also, BUILD_CC isn't defined anywhere in the current bind sources, so I removed
that as well.

Signed-off-by: David Härdeman <[email protected]>

isc-dhcp: create zones using rndc

This changes isc-dhcp's init script to create bind zones using the tools
bind provides for that scenario instead of crafting separate zone
configuration by hand.

At the same time, remove the use of /tmp/bind/named.conf.local and add
permissions for dynamic zone creation to bind.

Signed-off-by: David Härdeman <[email protected]>

bind: update conffiles list

The previous patches removed a number of conffiles that weren't necessary,
meaning we can now assume that any changes or additional files in /etc/bind
are things that the user wants to keep.

Since /var/lib/bind is the standard location for longer-lived zone data
(i.e. not zones that secondary servers have obtained via XFER), we symlink
it to /etc/bind/zones so that it survives a sysupgrade.

Temporary files (such as XFER:ed zones for secondaries) stay in
/var/cache/bind.

Signed-off-by: David Härdeman <[email protected]>

bind: update init script

Simplify the init script, removing some unnecessary subshells and make sure
that the end result is shellcheck clean.

Signed-off-by: David Härdeman <[email protected]>

bind: use default rndc control channel

The present logic recreates what is already the default in bind [1], and writes
the rndc key twice to two different files. In addition, the rndc key is
regenerated every time bind is restarted. Simplify this by relying on the
default behaviour instead.

[1] https://bind9.readthedocs.io/en/latest/reference.html#controls-block-definition-and-usage

Signed-off-by: David Härdeman <[email protected]>

bind: rename named.conf.example

The file actually gets installed as /etc/bind/named.conf, so rename the file to
clarify that.

Signed-off-by: David Härdeman <[email protected]>

bind: remove bind.keys

First, the file is out-of-date.

Second, and more importantly, bind9 includes a compiled-in version which is
up-to-date (see https://www.isc.org/bind-keys/).

Signed-off-by: David Härdeman <[email protected]>

bind: update db.root

The previous version was quite out of date.

Signed-off-by: David Härdeman <[email protected]>

bind: remove obsolete zone files

Bind9 has native support for these zones via the "empty-zones yes" directive,
which is enabled by default.

(cf. https://salsa.debian.org/dns-team/bind9/-/commit/bb1cda792b3ca03f61503be4f94c1f82d3392792)

Signed-off-by: David Härdeman <[email protected]>

bind: update wording in Config.in

And make it less imperative to match the tone of the rest of the configuration
directives. Also, fix a typo.

Signed-off-by: David Härdeman <[email protected]>

bind: update named.conf

First, change the "directory" to point to /var/cache/bind, which ensures that
e.g. simple file "something" statements for secondary servers will create files
there (the directory is created by the init script, so we're sure that it
exists). This behaviour matches e.g. what Debian does.

Second, remove the "auth-nxdomain" stanza which is the default in bind since
9.0 was released.

Third, change "master" to "primary" (the wording used in the bind reference
docs)

Signed-off-by: David Härdeman <[email protected]>

bind: bind-server depends on bind-rndc

rndc-confgen is used in /etc/init.d/named, so make sure that it is available.

Signed-off-by: David Härdeman <[email protected]>

arp-whisper: do not lock deps

The version specified in Cargo.lock is too old to build.

Trim whitespaces while at it.

Signed-off-by: Tianling Shen <[email protected]>

rust: add loongarch64 and powerpc to supported targets

Also removed i686 as OpenWrt replaces it with i386 in $(ARCH).

Signed-off-by: Tianling Shen <[email protected]>

erlang: update to 28.0.3

- Takeover maintainership
- Enable parallel build
- Depend from libstdcpp only on JIT-enabled platforms (x86_64 and aarch64)
- Add SCTP support (off by default)
- Remove OTP-internal versions and rely on package versions for sub-packages
- Remove obsolete configure vars
- Move out sasl from erlang package into separate erlang-sasl
- Add more sub-packages
    - erlang-diameter
    - erlang-eldap
    - erlang-ftp
    - erlang-odbc
    - erlang-parsetools
    - erlang-tftp
- Rename erlang-os_mon to erlang-os-mon
- Clean-up descriptions text
- Disable MIPS16 again to fix mips* targets

Signed-off-by: Aleksey Vasilenko <[email protected]>

ampr-ripd: script improvements and add QA script

Added test.sh
Predetermine count used by for loops in Makefile postrm
Implemented extra_command in initscript
Resolved shellcheck issues
Bump release

Signed-off-by: Dan Srebnick <[email protected]>

dockerd: remove cgroupfs-mount dependency

The package `cgroupfs-mount` has been removed.

Signed-off-by: Wesley Gimenes <[email protected]>

cgroupfs-mount: remove package

A user opened an issue[1] in the upstream repository to migrate
the package from GitHub to Debian Salsa, but the upstream response[2]
was as follows:

> If any work happens on this package, it should be to deprecate and remove
> it, not migrate it (that's a waste of effort).

[1] https://github.com/tianon/cgroupfs-mount/issues/24
[2] https://github.com/tianon/cgroupfs-mount/issues/24#issuecomment-2663677115

Signed-off-by: Wesley Gimenes <[email protected]>

netbird: switch to profile-based configuration

Add support for `netbird` profiles feature [1] (introduced in 0.52.2). Use
`NB_STATE_DIR="/root/.config/netbird"` in the init file instead of the
previous `NB_CONFIG="/etc/netbird/config.json"`, and update Makefile
configuration paths accordingly.

Rationale: `netbird` saves state/configuration under `/var` by default. On
OpenWrt, `/var` is a symlink to `/tmp` (a volatile location), which would
cause config loss after reboot or reflash. Using `/root/.config/netbird`
avoids this, it's a valid upstream directory not used by default.
`netbird` will migrate existing configurations.

This change will not be backported to preserve the current meaning of
"stable" in OpenWrt and to avoid (unlikely but possible) breakage of
existing installations.

[1]: https://docs.netbird.io/how-to/profiles

Signed-off-by: Wesley Gimenes <[email protected]>

netbird: update to 0.55.1

changelog: https://github.com/netbirdio/netbird/releases/tag/v0.55.1

Signed-off-by: Wesley Gimenes <[email protected]>

netbird: update to 0.53.0 with config fix

changelog: https://github.com/netbirdio/netbird/releases/tag/v0.53.0

Update init file to include `NB_CONFIG="/etc/netbird/config.json"`
variable, ensuring configuration compatibility as before (fixes issue
introduced by profiles feature in 0.52.2). Existing configurations remain
compatible.

Note: license for some components (`management`, `relay`, `signal`) changed
to **AGPLv3**. These components aren't packaged for OpenWrt, so there's no
immediate effect, but record the change for future reference.

Signed-off-by: Wesley Gimenes <[email protected]>

netbird: update to 0.52.2

changelog: https://github.com/netbirdio/netbird/releases/tag/v0.52.2

`netbird` now supports profiles [1]. The configuration file has been
moved from `/etc/netbird/config.json` to `/var/lib/netbird/`. The
migration is handled by `netbird` itself.

However, in OpenWrt, the `/var` directory is a symbolic link to
`/tmp`, which is a temporary directory. This can result in
configuration loss after rebooting or flashing a new image. This
issue will be fixed in the next release, 0.53.0.
**I reported this behavior upstream [2].**

[1]: https://docs.netbird.io/how-to/profiles
[2]: https://github.com/netbirdio/netbird/issues/4322

Signed-off-by: Wesley Gimenes <[email protected]>

netbird: cleanup init script

Remove parameters added in commit 7b3d033ab651dd11e0db5fb099d106c9e09a2dc6
that were intended to reestablish the `netbird` connection when the
`wan` state changes. This functionality is already handled by
`netbird`. If it fails, it should be reported as a bug upstream.

Signed-off-by: Wesley Gimenes <[email protected]>

snort3: replace complex sed calls with patch

Simplification of Makefile: replace complex sed calls with a patch to
improve readability. This commit also renames an existing patch.

Signed-off-by: John Audia <[email protected]>

snort3: clean-up Makefile

Simplification of Makefile: remove line splits to increase readability.

Signed-off-by: John Audia <[email protected]>

snort3: switch from git proto to tarballs

Use upstream tarballs for source rather than using git. If we ever need
to build from git we can cherry pick and make a patch. This gives a
cleaner Makefile and faster build.

Signed-off-by: John Audia <[email protected]>

pixman: update to version 0.46.4

See https://gitlab.freedesktop.org/pixman/pixman/-/commits/pixman-0.46.4
for changes since pixman-0.43.4.

Signed-off-by: Daniel Golle <[email protected]>

libxmlb: update to 0.3.23

- New CLI build option

Release notes: https://github.com/hughsie/libxmlb/releases/tag/0.3.23

Signed-off-by: Lukas Voegl <[email protected]>

libjcat: update to 0.2.3

- New CLI build option
- Enable ed25519 by default

Release notes: https://github.com/hughsie/libjcat/releases/tag/0.2.3

Signed-off-by: Lukas Voegl <[email protected]>

dufs: Update to 0.45.0

Removed upstreamed patches.

Release note: https://github.com/sigoden/dufs/releases/tag/v0.45.0

Signed-off-by: Tianling Shen <[email protected]>

snapcast: fix compilation with boost 1.89.0

Boost upgrade hit Snapcast again: badaix/snapcast#1413

This patch is based on commit badaix/snapcast@d2e1635ebd96 ("Fix
building with boost v1.89.0").

Refs: 965dc7088e6c ("boost: Updates package to version 1.89.0")

Signed-off-by: Szabolcs Hubai <[email protected]>

snapcast: fix compilation with boost 1.88.0

Boost upgrade hit Snapcast hard again: the process needs to be updated!

This patch is a patchset from badaix/snapcast@develop.
It is based on the following upstream commits:
badaix/snapcast@901b79a213b1 ("Build failure with boost 1.88.0 #1367")
badaix/snapcast@ffb086b4b331 ("Define BOOST_PROCESS_VERSION=1 globally")
badaix/snapcast@c37a76a4aba9 ("Add missing includes")
badaix/snapcast@571f6a8f6953 ("Include process v1 headers for Boost version >= v1.88.0")

Refs: 3585ddfc446c ("boost: Updates package to version 1.88.0")

Signed-off-by: Szabolcs Hubai <[email protected]>

snapcast: fix compilation with boost 1.87.0

After revisiting the PR, it didn't even compile because of commit
c50de920a225a ("boost: Updates package to version 1.87.0").

Signed-off-by: Szabolcs Hubai <[email protected]>

snapcast: add package snapserver and snapclient

Snapcast [1] is a multiroom client-server audio player, where all
clients are time synchronized with the server to play perfectly synced
audio.

It's not a standalone player, but an extension that turns your existing
audio player into a Sonos-like multiroom solution.
Audio is captured by the server and routed to the connected clients.
Several players can feed audio to the server in parallel and clients can
be grouped to play the same audio stream.
One of the most generic ways to use Snapcast is in conjunction with the
music player daemon (MPD) [2] or Mopidy [3].

The inclusion starts with version 0.28.0 because of OpenSSL dependency
issues of version 0.29.0. Newer versions (e.g. 0.32.3, see [4])
with optional OpenSSL support, will be incorporated with flavours,
like "-mini" and "-full" in the upcoming PRs.
More about this topic please check the inclusion PR at [5]!

[1]: https://github.com/badaix/snapcast
[2]: http://www.musicpd.org/
[3]: https://www.mopidy.com/
[4]: https://github.com/badaix/snapcast/blob/develop/changelog.md
[5]: https://github.com/openwrt/packages/pull/23956#discussion_r2330463363

Fixes: #23924
Suggested-by: Tianling Shen <[email protected]>
Suggested-by: George Sapkin <[email protected]>
Signed-off-by: Szabolcs Hubai <[email protected]>

snapcast: add Snapcast from badaix/snapos as is

Add Snapcast package files as is from
https://github.com/badaix/snapos/tree/29a5daebb0513faa825b12474125c0c2dd66c2ee/openwrt/snapcast

Co-authored-by: badaix <[email protected]>
Co-authored-by: David Andreoletti <[email protected]>
Co-authored-by: luciferin <[email protected]>
Signed-off-by: Szabolcs Hubai <[email protected]>

sumo: add missing fmt dependency

Apparently it's used by sumo.

Signed-off-by: Rosen Penev <[email protected]>

unzip: add valid patche headers and missing CVE informations

This commit adds a valid git patch header for each patch, so that
additional information can be stored. This is in this case and 'CVE:' tag.
This can be used by CVE scanner to find out if the patch fixes a CVE.

Signed-off-by: Florian Eckert <[email protected]>

atftp: bump PKG_RELEASE

Bump PKG_RELEASE by one.

Signed-off-by: Florian Eckert <[email protected]>

atftp: add patch to fix build error

This patch fixes the following compilation build error for gcc14:

tftpd_pcre.c:109:37: error: passing argument 1 of 'pcre2_substring_list_free_8' from incompatible p
  109 |           pcre2_substring_list_free((const PCRE2_UCHAR **)substrlist);
      |                                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      |                                     |
      |                                     const PCRE2_UCHAR8 ** {aka const unsigned char **}
In file included from tftpd_pcre.h:24,
                 from tftpd_pcre.c:35:

I have also submitted the change to the upstream project:
https://github.com/madmartin/atftp/pull/2

Signed-off-by: Florian Eckert <[email protected]>

atftp: add patch to fix build warning

This patch fixes the following compilation build warning:

logger.c:117:47: warning: format '%li' expects argument of type 'long int', but argument 7 has type
  117 |                fprintf(log_fp, "%s %s %s[%d.%li]: %s\n", time_buf, hostname,
      |                                             ~~^
      |                                               |
      |                                               long int
  118 |                        log_ident, getpid(), pthread_self(), message);
      |                                             ~~~~~~~~~~~~~~
      |                                             |
      |                                             pthread_t {aka struct __pthread *}
logger.c:124:47: warning: format '%li' expects argument of type 'long int', but argument 7 has type
  124 |                fprintf(stderr, "%s %s %s[%d.%li]: %s\n", time_buf, hostname,
      |                                             ~~^
      |                                               |
      |                                               long int
  125 |                        log_ident, getpid(), pthread_self(), message);
      |                                             ~~~~~~~~~~~~~~
      |                                             |
      |                                             pthread_t {aka struct __pthread *}

I have also submitted the change to the upstream project:
https://github.com/madmartin/atftp/pull/2

Signed-off-by: Florian Eckert <[email protected]>

snort3: update to 3.9.5.0

Changelog: https://github.com/snort3/snort3/releases/tag/3.9.5.0

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc

Signed-off-by: John Audia <[email protected]>

snort3: fix logic in gpertools-runtime depends

The logic in e57cc9898a362d81e8dec5dd779293e6ff3d4710 was flawed causing
gperftools-runtime to fail to get detected when building resulting in:
...
ninja: Entering directory `/scratch/union/build_dir/target-x86_64_glibc/snort3-3.9.1.0'
ninja: error: '/scratch/union/staging_dir/target-x86_64_glibc/usr/lib/libtcmalloc.so', needed by 'src/snort', missing and no known rule to make it
make[2]: *** [Makefile:161: /scratch/union/build_dir/target-x86_64_glibc/snort3-3.9.1.0/.built] Error 1

It was missed due testing in build root that already had gperftools-runtime
built only discovered when building from a clean build root.

This commit fixes this flaw.

Test:
cat <<EOF > .config
CONFIG_TARGET_x86=y
CONFIG_TARGET_x86_64=y
CONFIG_TARGET_x86_64_DEVICE_generic=y
CONFIG_PACKAGE_snort3=y
EOF

make defconfig
grep gperftools-run .config
CONFIG_PACKAGE_gperftools-runtime=y

cat <<EOF > .config
CONFIG_TARGET_qoriq=y
CONFIG_TARGET_qoriq_generic=y
CONFIG_TARGET_qoriq_generic_DEVICE_watchguard_firebox-m300=y
CONFIG_PACKAGE_snort3=y
EOF

make defconfig
grep gperftools-run .config

Signed-off-by: John Audia <[email protected]>

openlist: Update to 4.1.2

Release note: https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.2

Signed-off-by: Tianling Shen <[email protected]>

xray-core: Update to 25.9.5

Release note: https://github.com/XTLS/Xray-core/releases/tag/v25.9.5

Signed-off-by: Tianling Shen <[email protected]>

v2ray-core: Update to 5.38.0

Release note: https://github.com/v2fly/v2ray-core/releases/tag/v5.38.0

Signed-off-by: Tianling Shen <[email protected]>

v2raya: Update to 2.2.7.1

Release note: https://github.com/v2rayA/v2rayA/releases/tag/v2.2.7.1

Signed-off-by: Tianling Shen <[email protected]>

v2ray-geodata: Update to latest version

Update all geodata.

Signed-off-by: Tianling Shen <[email protected]>

libconfig: update to 1.8.1

Fixes compilation with GCC 15.

Signed-off-by: Rosen Penev <[email protected]>