coreutils: Upgrade to 9.6

Upgrade GNU coreutils to version 9.6
* refresh patch

Signed-off-by: Hannu Nyman <[email protected]>

adguardhome: bump to 0.107.57

Changelog: https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.57
Signed-off-by: George Sapkin <[email protected]>

adguardhome: remove unnecessary build options

Remove `node-yarn/host` because the upstream switched to npm
Remove `NODE_OPTIONS=--openssl-legacy-provider` because it's not necessary since Node.js 18.x

Link: https://github.com/AdguardTeam/AdGuardHome/commit/1afe226ce8f8af179e1eacccf4cdd63823f0c358#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5R210-L211
Link: https://github.com/AdguardTeam/AdGuardHome/commit/1afe226ce8f8af179e1eacccf4cdd63823f0c358#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5L223-L230
Signed-off-by: George Sapkin <[email protected]>

snort3: update to 3.7.0.0

Changelog: https://github.com/snort3/snort3/releases/tag/3.7.0.0

Signed-off-by: John Audia <[email protected]>

netbird: update to 0.38.0

changelog: https://github.com/netbirdio/netbird/releases/tag/v0.38.0

Signed-off-by: Wesley Gimenes <[email protected]>

mc: update project URLs

Upstream is preparing the migration to a new website. As part of this, they
will be dropping the `www` prefix. Also, the package source is updated to use
mc's official OSU OSL mirror over HTTPS.

Signed-off-by: Yury V. Zaytsev <[email protected]>

bcm27xx-eeprom: update to v2025-02-12-2712

bcm2711:
https://github.com/raspberrypi/rpi-eeprom/blob/v2025.02.12-2712/firmware-2711/release-notes.md#2024-12-07-enable-banklow-and-so-numa-by-default-latest
https://github.com/raspberrypi/rpi-eeprom/blob/v2025.02.12-2712/firmware-2711/release-notes.md#2024-12-07-enable-banklow-and-so-numa-by-default-latest
https://github.com/raspberrypi/rpi-eeprom/blob/v2025.02.12-2712/firmware-2711/release-notes.md#2025-02-11-recovery-walk-partitions-to-delete-recoverybin-latest

bcm2712:
https://github.com/raspberrypi/rpi-eeprom/blob/v2025.02.12-2712/firmware-2712/release-notes.md#2024-11-27-rp1fw-add-fifo_state--drain_tx-fix-can_add_program-default
https://github.com/raspberrypi/rpi-eeprom/blob/v2025.02.12-2712/firmware-2712/release-notes.md#2024-12-07-enable-banklow-and-so-numa-by-default-latest
https://github.com/raspberrypi/rpi-eeprom/blob/v2025.02.12-2712/firmware-2712/release-notes.md#2024-12-15-add-net-install-to-boot-menu-latest
https://github.com/raspberrypi/rpi-eeprom/blob/v2025.02.12-2712/firmware-2712/release-notes.md#2024-12-19-disable-fan-pwm-before-shutdown-latest
https://github.com/raspberrypi/rpi-eeprom/blob/v2025.02.12-2712/firmware-2712/release-notes.md#2025-01-06-stop-the-fan-after-after-fan-probe-latest
https://github.com/raspberrypi/rpi-eeprom/blob/v2025.02.12-2712/firmware-2712/release-notes.md#2025-01-07-fixup-m2-hat-detection-latest
https://github.com/raspberrypi/rpi-eeprom/blob/v2025.02.12-2712/firmware-2712/release-notes.md#2025-01-08-update-sdram-refresh-timings-for-bcm2712d0-products-latest
https://github.com/raspberrypi/rpi-eeprom/blob/v2025.02.12-2712/firmware-2712/release-notes.md#2025-01-13-improved-sdram-refresh-timings-for-pi5-16gb-latest
https://github.com/raspberrypi/rpi-eeprom/blob/v2025.02.12-2712/firmware-2712/release-notes.md#2025-01-14-add-set_reboot_order-api-latest
https://github.com/raspberrypi/rpi-eeprom/blob/v2025.02.12-2712/firmware-2712/release-notes.md#2025-01-22-add-dt-chosen-property-signed-boot-bootimg-hash-latest
https://github.com/raspberrypi/rpi-eeprom/blob/v2025.02.12-2712/firmware-2712/release-notes.md#2025-01-27-walk-the-partition-table-if-the-requested-partition-is-not-bootable-latest
https://github.com/raspberrypi/rpi-eeprom/blob/v2025.02.12-2712/firmware-2712/release-notes.md#2025-02-11-cm5-no-wifi-stability-improvements-latest
https://github.com/raspberrypi/rpi-eeprom/blob/v2025.02.12-2712/firmware-2712/release-notes.md#2025-02-12-fixup-change-to-disable-37v-pmic-output-on-cm5-no-wifi-latest

Full changelog: https://github.com/raspberrypi/rpi-eeprom/compare/v2024.11.12-2712...v2025.02.12-2712

Signed-off-by: Álvaro Fernández Rojas <[email protected]>

lxc: add two files to default backup list

Users running unprivileged containers will need to create
/etc/subgid and /etc/subuid and want to have them preserved
across updates. This commit adds them to the default backup set.

Signed-off-by: John Audia <[email protected]>
Co-authored-by: Tianling Shen <[email protected]>

lxc: lxc-checkconfig fix typo

Fix a typo introduced in https://github.com/openwrt/packages/pull/25719/commits/fd686a32209f74cd12ca434bc3245ef0f7589c46
which partially broke lxc-checkconfig

Build system: x86/64
Build-tested: bcm27xx/bcm2712
Run-tested: bcm27xx/bcm2712

Signed-off-by: John Audia <[email protected]>

owut: update to 2025.03.14

Bug fixes:
    efahl/owut@15d734237725 owut: fix incorrect log levels on list and blob commands
    efahl/owut@3867b98d0ea1 owut: fix parsing of certain APK versions

Enhancements:
    efahl/owut@52e7d44c99a3 owut: allow user to override 'package_changes'

Signed-off-by: Eric Fahlgren <[email protected]>

node: make hostpkg only

https://github.com/openwrt/packages/issues/26078
As a result of the discussion in this thread, the node.js package was changed to hostpkg only.
In addition, this fix uses the pre-built version distributed on nodejs.
The use of pre-build is based on the suggestion of @artynet.

The packages in the node module are successfully built, but the target node.js itself cannot be provided, so it cannot be used.

Yarn, which is used in packages for web front ends, etc., can be used without any problems.

Support for host builds other than linux x86_64.

Signed-off-by: Hirokazu MORIKAWA <[email protected]>

numpy: bump to version 2.2.3

Signed-off-by: Alexandru Ardelean <[email protected]>

pytz: bump to version 2025.1

Signed-off-by: Alexandru Ardelean <[email protected]>

python-evdev: bump to version 1.9.1

Signed-off-by: Alexandru Ardelean <[email protected]>

django: bump to version 5.1.7

Signed-off-by: Alexandru Ardelean <[email protected]>

ipmitool: disable FreeIPMI support

Now that we are building FreeIPMI library ipmitool will detect it
and since we are already passing --enable-intf-free it will build
support for FreeIPMI as well.

However, --enable-intf-free was previously no-op since it would just
fail to detect FreeIPMI and disable support for it but now it seems
that buildbots build FreeIPMI first and then ipmitool will fail with
missing dependency on FreeIPMI library.

Since FreeIPMI is quite big and previously ipmitool was built without
support for it anyway lets disable support for FreeIPMI in ipmitool and
if its required it can be made optional or as a package variant later.

This fixes building ipmitool via buildbots again.

Signed-off-by: Robert Marko <[email protected]>

dockerd: add docker-storage to init

Docker's backend storage driver can be configurable for certain
filesystems. The default is the overlay storage driver, but if you run
openwrt on a system with btrfs, this will allow you to override the
default configuration by settings the storage_driver in uci in dockerd's
global section. This value will be used in the created dockerd.json
file.

Signed-off-by: Keith T. Garner <[email protected]>

gst1-libav: bump to 1.24.12

Signed-off-by: Koen Vandeputte <[email protected]>

gst1-plugins-ugly: bump to 1.24.12

Signed-off-by: Koen Vandeputte <[email protected]>

gst1-plugins-bad: bump to 1.24.12

Signed-off-by: Koen Vandeputte <[email protected]>

gst1-plugins-base: bump to 1.24.12

Signed-off-by: Koen Vandeputte <[email protected]>

gst1-plugins-good: bump to 1.24.12

Signed-off-by: Koen Vandeputte <[email protected]>

gstreamer1: bump to 1.24.12

Signed-off-by: Koen Vandeputte <[email protected]>

nginx: update to 1.26.3

Signed-off-by: Jan Klos <[email protected]>

htop: update to 3.4.0

Changelog: https://github.com/htop-dev/htop/compare/3.3.0...3.4.0

Build system: x86/64
Build-tested: bcm27xx/bcm2712, x86/64
Run-tested: bcm27xx/bcm2712

Signed-off-by: John Audia <[email protected]>

xray-core: Update to 25.3.6

Signed-off-by: Tianling Shen <[email protected]>

cloudflared: Update to 2025.2.1

Signed-off-by: Tianling Shen <[email protected]>

banIP: update 1.5.3-3

* fix a race condition in the process scheduler
* sync the banIP country file with ipdeny feed
* refine etag handling with country/asn feeds
* refine logging with country/asn feeds
* refine the banIP status output (incl. LuCI changes)

Signed-off-by: Dirk Brenken <[email protected]>

adblock: update 4.2.7-2

* fix an out of bound error reported in the forum
* set always a default for "adb_dnsdir" to prevent cornercase issues

Signed-off-by: Dirk Brenken <[email protected]>

psqlodbc: update to 17.00.0004

Change source to Github since they dont distribute source tarballs anymore,
enable autoreconf in order to generate configure script.

This actually makes psqlodbc as its been broken for a while.

Signed-off-by: Robert Marko <[email protected]>

tailscale: Update to 1.80.3

Signed-off-by: Zephyr Lykos <[email protected]>

golang: Update to 1.24.1

go1.24.1 (released 2025-03-04) includes security fixes to the net/http
package, as well as bug fixes to cgo, the compiler, the go command,
and the reflect, runtime, and syscall packages.

Signed-off-by: Tianling Shen <[email protected]>

golang: Update to 1.24.0

Add libstdcpp and libtiff as dependencies, which are required by
debug/elf package.

Release note: https://go.dev/doc/go1.24

Signed-off-by: Tianling Shen <[email protected]>

tgt: update to 1.0.95

Signed-off-by: Maxim Storchak <[email protected]>

wget: update to 1.25.0

Fixes: CVE-2024-38428
Signed-off-by: Chad Monroe <[email protected]>

conserver: add runtime test

Simply test that both variants produce a binary for now

Signed-off-by: Bjørn Mork <[email protected]>

conserver: fix crash on early exit

Add pending patch, fixing a crash when conserver exits
without starting the server.

Link: https://github.com/bstansell/conserver/pull/97
Signed-off-by: Bjørn Mork <[email protected]>

conserver: update to version 8.2.7

version 8.2.7 (July 7, 2022):
        - configure.ac: autoconf-2.70 fix (Lars Wendler <[email protected]>)
        - Add high baud rates (Peter Chubb <[email protected]>)
        - Make compile --with-ipv6 & setproctitle (Bjoern A. Zeeb <[email protected]>)
        - conserver.cf: devicesubst add 'b' for baud rate (Bjoern A. Zeeb <[email protected]>)
        - Reflect that baud values have increased to 7 digits (Bjoern A. Zeeb <[email protected]>)
        - cirrus-ci: move to freebsd-13-0 (Bryan Stansell <[email protected]>)
        - configure.ac: support libgssapi_krb5 (Jiri Kastner <[email protected]>)

Drop upstreamed patch 000-100-backport-config-macro-fix.patch

Signed-off-by: Bjørn Mork <[email protected]>

conserver: add IPMI support

Linking conserver with FreeIPMI enables it to manage
serial-over-LAN (SOL) consoles in addition to the already
supported tty and tcp/telnet consoles.

The FreeIPMI library is huge. Adding a separate package
variant for this feature.

Signed-off-by: Bjørn Mork <[email protected]>

freeipmi: The GNU IPMI library

FreeIPMI provides in-band and out-of-band IPMI software based on the
IPMI v1.5/2.0 specification. The IPMI specification defines a set of
interfaces for platform management and is implemented by a number of
vendors for system management. The features of IPMI that most users
will be interested in are sensor monitoring, system event monitoring,
power control, and serial-over-LAN (SOL). The FreeIPMI tools and
libraries listed below should provide users with the ability to
access and utilize these and many other features. A number of useful
features for large HPC or cluster environments have also been
implemented into FreeIPMI.

Signed-off-by: Bjørn Mork <[email protected]>

liburcu: update to version 0.15.1

Signed-off-by: Jan Hák <[email protected]>

hev-socks5-tunnel: update to 2.9.1

Signed-off-by: Ray Wang <[email protected]>

hev-socks5-tproxy: update to 2.7.0

Signed-off-by: Ray Wang <[email protected]>

hev-socks5-server: update to 2.8.0

Signed-off-by: Ray Wang <[email protected]>

gateway-go: update to 0.3.16

Signed-off-by: Yu Fang <[email protected]>

luaposix: update to 36.3

Signed-off-by: Maxim Storchak <[email protected]>

node: mark BROKEN (to test impact on buildbot timeouts)

Mark node BROKEN to disable its build in buildbot in order
to test the impact on preventing frequent buildbot hangups.

It is suspected that node causes frequent build timeouts/hangups
on aarch/arm/i386/x86 builds: approx 1/3 of builds get timeouted.
Disable node for now to test the hypothesis.

Signed-off-by: Hannu Nyman <[email protected]>

Revert "nginx-mod-njs: fix endianess patch"

This reverts commit 7fdb92b59ac356f9a8c99ea49147ce0e66799a4b.

Now that the actual issue has been found and fixed, this is incorrect
so revert it.

Signed-off-by: Robert Marko <[email protected]>

nginx: actually download the specified git commit hash

Currently, we are using Download recipes to download the various modules,
however we are using then with PROTO:=git but SOURCE_VERSION is not set,
only VERSION variable so thus the dl_github_archive.py scripts gets called
with --version="" instead of being actually passed the desired commit hash
and thus actually the git head is fetched.

This explains why currently buildbots are failling with
nginx-mod-njs/104-endianness_fix.patch failling to apply since buildbots
are using prepackaged tarballs which are different than what we get when
manually building.

So, lets set SOURCE_VERSION to make sure we actually fetch the desired
git commit hash.

Signed-off-by: Robert Marko <[email protected]>

dawn: update to 2025-03-03

Add "option tcp_ip '0.0.0.0'" to config.

Changelog:
62688e4 tcpsocket: add option to bind to specific ip
be63ed4 ubus: actually deny association when no probe entry is found
6361df6 datastorage: fix debug message regarding client kick condition
af593cc ci: fix and improve ci

Signed-off-by: Nick Hainke <[email protected]>

ddns-scripts: Fixup huaweicloud

Script will exit when an error occurred.

Modify write_log 14 to write_log 4,
write_log 14 and write_log 4 can also print the same message,
but write_log 14 will exist script when printed.

Signed-off-by: Lehua Zhang <[email protected]>

adblock: release 4.2.7-1

* optimized uci config processing (list options)
* no longer set a hardcoded confdir in dhcp/dnsmasq config
* rework suspend/resume handling
* clean up download queue handling
* various small improvements & fixes

Signed-off-by: Dirk Brenken <[email protected]>

banIP: update 1.5.3-2

* fix uci config processing (ban_logterm)
* update the readme

Signed-off-by: Dirk Brenken <[email protected]>

lang/node-* : Disable parallel builds for node packages

Disable parallel builds for node downstream packages, as the
buildbot is showing frequent timeout problems
for aarch644, arm, i386 and x86, and node & node packages
are the primary suspect.

Based on discussion in
https://github.com/openwrt/packages/issues/26078

Signed-off-by: Hannu Nyman <[email protected]>

python3-host.mk: disable pip --no-binary on macOS

For some reason, pip builds a broken Cython, which segfaults on attempting
to install wheel. Work around this by allowing to use precompiled wheels.

Signed-off-by: Felix Fietkau <[email protected]>

speedtest-go: update to 1.7.10

Update speedtest-go version to 1.7.10

Signed-off-by: TeleostNaCl Dai <[email protected]>

adblock-fast: bugfix: detect_file_type()

* Properly detect domain lists, fixes https://github.com/openwrt/packages/issues/25973
  Thanks @timfeierabend
* Better output when setting triggers
* No wait for ubus network.interface on boot

Signed-off-by: Stan Grishin <[email protected]>

banIP: release 1.5.3-1

* optimized uci config processing (list options)
* optimized icmp rules in pre-routing (thanks @brada)
* set inbound marker in pre-routing only if inbound logging is enabled (fixes #26044)
* fix cornercase in Set removal function
* print chain-, set- and rules-counter in the banIP status
* clean up logging und download queue handling
* update the readme

Signed-off-by: Dirk Brenken <[email protected]>

gpsd: migrate option device to a list devices

More than one device can be added to the gpsd at startup. Currently the gpsd
service start script in OpenWrt treats this as an option with only one value.
To allow multiple devices to be specified, the uci 'option device' must be
removed and a new uci 'list devices' is added.

This change means that several devices can be specified at gpsd start with
the new uci 'list devices' configuration.

Running configurations in the field are migrated by a migration script.

Signed-off-by: Florian Eckert <[email protected]>

gpsd: add readonly option to uci

The 'readonly' option tells the GPSD that it is not allowed to write to the
GPS TTY, only reading the NMEA data stream is allowed. This option of the
GPSD must be set for my mobile radio device MV31, otherwise the GPSD can not
read the NMEA data stream on the GPS TTY because the GPSD blocks during
plugin probing.

gpsd:PROG: CORE: Probing "Garmin USB binary" driver...
gpsd:PROG: CORE: Probe not found "Garmin USB binary" driver...
gpsd:PROG: CORE: Probing "GeoStar" driver...
gpsd:PROG: Sent GeoStar packet id 0xc1

Signed-off-by: Florian Eckert <[email protected]>

gpsd: only add device to procd start call if device option is configured

Signed-off-by: Florian Eckert <[email protected]>

gpsd: add hotplug handling

The 'gpsd' offers the possibility to call the script '/etc/gpsd/device-hook'
when a GPS source was added or removed via gpsdctl.

In addition to the '/etc/gpsd/device-hook' call an event is now triggered
too after the 'gpsd' has started. This allows scripts to configurre 'gpsd'
receivers.

The following events are available for '/etc/hotplug.d/gpsd' scripts:

* ACTIVATE   via '/etc/gpsd/device-hook'
* DEACTIVATE via '/etc/gpsd/device-hook'
* STARTED    via '/etc/init.d/gpsd'

Signed-off-by: Florian Eckert <[email protected]>

gpsd: add the possibility to start the gpsd with a different log level

This simplifies the handling of log levels if we need more log information
during development.

Signed-off-by: Florian Eckert <[email protected]>

gpsd: add control socket '/var/run/gpsd.sock' on startup

This change makes it possible to add new gps device without restarting the
'gpsd' service by using the 'gpsdctl' command.

Signed-off-by: Florian Eckert <[email protected]>

netbird: update to 0.37.1

changelog: https://github.com/netbirdio/netbird/releases/tag/v0.37.1

Signed-off-by: Wesley Gimenes <[email protected]>

nginx-mod-njs: fix endianess patch

Currently, the 104-endianness_fix.patch does not apply, so lets manually
refresh it to apply and thus fix buildbot nginx builds.

Signed-off-by: Robert Marko <[email protected]>

modemmanager: add config optional netifd integration

This change introduces an optional configuration
of the  netifd integration in the ModemManager package.
When disabled, it removes the NETIFD dependency and
other unwanted components from the root filesystem
during the build phase.

Additionally, in the modemmanager.common the netifd-proto.sh
inclusion line can be savely removed as there is no usage
of it in its functions.

Signed-off-by: Gilles Lenaerts <[email protected]>

mxml: Remove

Version 3.3 isn't current any more, but current mxml v4 has breaking changes,
so if added should be a new package.

Not depended on by other packages.

Signed-off-by: Espen Jürgensen <[email protected]>

docker-compose: Update to version 2.33.1

Release notes:
https://github.com/docker/compose/releases/tag/v2.33.1

Signed-off-by: Javier Marcet <[email protected]>

rust: update to 1.85.0

Fixes podman build breakage which was caused by podman depending on
netavark, which in turn depends on rust-iptables.

rust-iptables requires rust 1.85.0 since commit 75825cd
https://github.com/yaa110/rust-iptables/commit/75825cd9c13db91f697461e6fa91f78c5e927008

Signed-off-by: Jonathan McCrohan <[email protected]>

lxc: fix decompression of rootfs tarballs

Modified 025-remove-unsupported-option.patch to both remove
the bsdtar command as it ends in errors, see below, and to
circumvent an error when extracting to overlayfs[1].

Error when extracting rootfs tarball with bsdtar:
tar --absolute-names --numeric-owner '--xattrs-include=*' -xpJf /var/cache/lxc//download/archlinux/current/amd64//default/rootfs.tar.xz -C /mnt/data/lxc/test/rootfs
./usr/bin/newgidmap: Cannot restore extended attributes on this system: Illegal byte sequence
lxc-create: test: ../src/lxc/lxccontainer.c: create_run_template: 1589 Failed to create container from template
lxc-create: test: ../src/lxc/tools/lxc_create.c: lxc_create_main: 318 Failed to create container test

1. https://github.com/openwrt/openwrt/issues/15888

Signed-off-by: John Audia <[email protected]>
Build system: x86/64
Build-tested: x86/64/AMD Cezanne
Run-tested: x86/64/AMD Cezanne

Signed-off-by: John Audia <[email protected]>

lxc: add gnu-tar as a depends to fix lxc-create

Add gnu-tar as a dependency for lxc-create which is needed to
properly extract the root file system tarball. Without it,
symlink target of /bin/tar is busybox and it lacks proper
support to extract with xattrs.  The default gnu-tar is actually
built without this support as well, but it is able to extract
the rootfs tarballs with a warning not an error which is not the
case with busybox which ends in an error.

Signed-off-by: John Audia <[email protected]>
Build system: x86/64
Build-tested: x86/64/AMD Cezanne
Run-tested: x86/64/AMD Cezanne

phytool: add phytool package

Add phytool, a very useful tool to access MDIO PHY registers.

Signed-off-by: Thomas Richard <[email protected]>

lxc: add missing deps

Several deps are missing based the output of lxc-checkconfig shown below
before this commit is applied.

CONFIG_IP_NF_TARGET_MASQUERADE and CONFIG_IP6_NF_TARGET_MASQUERADE are
only needed for lxc-net which we do not package.

% lxc-checkconfig | grep missing
Cgroup device: missing
CONFIG_IP_NF_TARGET_MASQUERADE: missing
CONFIG_IP6_NF_TARGET_MASQUERADE: missing
CONFIG_NETFILTER_XT_TARGET_CHECKSUM: missing
FUSE (for use with lxcfs): missing
checkpoint restore: missing
CONFIG_UNIX_DIAG: missing
CONFIG_INET_DIAG: missing
CONFIG_PACKET_DIAG: missing
CONFIG_NETLINK_DIAG: missing

Additionally, two new patches have been added which remove checks for
options that OpenWrt currently does not package and can serve are
false positives for missing items from our kernel config, namely:
lxc-net and lxc-checkpoint

After applying this commit, below is the output showing that the kernel
config[1] should pass all tests for functionality:

% CONFIG=config ./lxc-checkconfig
LXC version 6.0.3

--- Namespaces ---
Namespaces: enabled
Utsname namespace: enabled
Ipc namespace: enabled
Pid namespace: enabled
User namespace: enabled
Network namespace: enabled
Namespace limits:
  cgroup: 383849
  ipc: 383849
  mnt: 383849
  net: 383849
  pid: 383849
  time: 383849
  user: 383849
  uts: 383849

--- Control groups ---
Cgroups: enabled
Cgroup namespace: enabled
Cgroup v1 mount points:
Cgroup v2 mount points:
 - /sys/fs/cgroup
Cgroup device: enabled
Cgroup sched: enabled
Cgroup cpu account: enabled
Cgroup memory controller: enabled
Cgroup cpuset: enabled

--- Misc ---
Veth pair device: enabled, loaded
Macvlan: enabled, not loaded
Vlan: enabled, not loaded
Bridges: enabled, loaded
Advanced netfilter: enabled, loaded
CONFIG_NETFILTER_XT_TARGET_CHECKSUM: enabled, not loaded
CONFIG_NETFILTER_XT_MATCH_COMMENT: enabled, loaded

--- Checkpoint/Restore ---
checkpoint restore: missing
CONFIG_FHANDLE: enabled
CONFIG_EVENTFD: enabled
CONFIG_EPOLL: enabled
CONFIG_UNIX_DIAG: enabled
CONFIG_INET_DIAG: enabled
CONFIG_PACKET_DIAG: enabled
CONFIG_NETLINK_DIAG: enabled
File capabilities: enabled

1. Generated on 23-Feb-2025 running bcm27xx/bcm2712 on r28869+1

Signed-off-by: John Audia <[email protected]>

lxc: remove check for options we do not package

We do not package lxc-net or lxcfs so remove the lines within
lxc-checkconfig that looks forCONFIG_IP_NF_TARGET_MASQUERADE and
CONFIG_IP6_NF_TARGET_MASQUERADE which, as far as I know, is the only
part of lxc that needs them. Also remove the check for FUSE since we do
not pakcage lxcfs.

Without this commit, users will see these two as missing.

Signed-off-by: John Audia <[email protected]>

natmap: update to 20250221

Signed-off-by: Ray Wang <[email protected]>

netbird: update to 0.37.0

changelog: https://github.com/netbirdio/netbird/releases/tag/v0.37.0

Signed-off-by: Wesley Gimenes <[email protected]>

adblock: release 4.2.6-1

* removed needless 'adb_mailcnt' option
* fixed blocklist count formatting

Signed-off-by: Dirk Brenken <[email protected]>

banIP: release 1.5.2-1

* add memory measurements:
 - free memory in MB (MemAvailable from /proc/meminfo)
 - script run max. used RAM in MB (VmHWM from /proc/$$/status)
* removed the obsolete (domain) lookup command in init script
* update the readme

Signed-off-by: Dirk Brenken <[email protected]>

arp-scan-database: Relocate mac-vendor.txt to /etc/arp-scan

arp-scan v1.10.0 relocated mac-vendor.txt to $(sysconfdir)/$(PACKAGE)
which is /etc/arp-scan. This has been causing a file not found error.

Fixes: https://github.com/openwrt/packages/issues/26014
Signed-off-by: Chris Swan <[email protected]>

ddns-scripts: Add option 'myip=no' to Dynu IPv6 update URL

Prevents IPv6 updates to also update IPv4 (undesirable when behind a CGNAT)

Signed-off-by: Dimitri Souza <[email protected]>

libffi: drop autoreconf

Trying to compile libffi now that automake has been updated to 1.17 will
fail, however there is no reason for us to be calling autoreconf as libffi
release tarballs already contain the generated configure script.

So, drop the unnecessary autoreconf that seems to be leftover from the
previous 3.4.2 bump as we dont have any patches targeting configure.ac nor
libffi in general.

Fixes: openwrt/openwrt#18041
Signed-off-by: Robert Marko <[email protected]>

containerd: Added reverse dependency version check

Signed-off-by: Gerard Ryan <[email protected]>

runc: Added reverse dependency version check

Signed-off-by: Gerard Ryan <[email protected]>

tini: Added reverse dependency version check

Signed-off-by: Gerard Ryan <[email protected]>

docker: Added reverse dependency version check

Signed-off-by: Gerard Ryan <[email protected]>

dockerd: Improved error msg for rev ver dep check

Signed-off-by: Gerard Ryan <[email protected]>

mwan3: write `mwan3 use` error/debug messages to stderr instead of stdout

This redirects the debug output to stderr, allowing `mwan3 use` to be used in
scripts without polluting stdout.

Before:

mwan3 use wan curl -fsSL https://ifconfig.co/json | jq -er '.country_iso'
jq: parse error: Invalid numeric literal at line 1, column 8
curl: (23) Failure writing output to destination, passed 389 returned 0

After:

mwan3 use wan curl -fsSL https://ifconfig.co/json | jq -er '.country_iso'
Running 'curl -fsSL https://ifconfig.co/json' with DEVICE=eth2 SRCIP=192.168.0.1 FWMARK=0x3f00 FAMILY=ipv4
DE

Signed-off-by: Philipp Schmitt <[email protected]>

libffi: update to 3.4.7

  3.4.7 Feb-8-2024
        Add static trampoline support for Linux on s390x.
        Fix BTI support for ARM64.
        Support pointer authentication for ARM64.
        Fix ASAN compatibility.
        Fix x86-64 calls with 6 GP registers and some SSE registers.
        Miscellaneous fixes for ARC and Darwin ARM64.
        Fix OpenRISC or1k and Solaris 10 builds.
        Remove nios2 port.

Signed-off-by: John Audia <[email protected]>

tailscale: update to 1.80.2

Signed-off-by: Sandro Jäckel <[email protected]>

openssh: bump to 9.9p2

Updated and removed upstreamed patch.

Highlights relating to security:

* Fix CVE-2025-26465 - ssh(1) in OpenSSH versions 6.8p1 to 9.9p1
  (inclusive) contained a logic error that allowed an on-path
  attacker (a.k.a MITM) to impersonate any server when the
  VerifyHostKeyDNS option is enabled. This option is off by default.

* Fix CVE-2025-26466 - sshd(8) in OpenSSH versions 9.5p1 to 9.9p1
  (inclusive) is vulnerable to a memory/CPU denial-of-service related
  to the handling of SSH2_MSG_PING packets. This condition may be
  mitigated using the existing PerSourcePenalties feature.

Both vulnerabilities were discovered and demonstrated to be exploitable
by the Qualys Security Advisory team. We thank them for their detailed
review of OpenSSH.

Full release notes: https://www.openssh.com/txt/release-9.9p2

Signed-off-by: John Audia <[email protected]>

mwan3: propagate mwan3 use command exit code

This propagates the exit code of the command wrapped by `mwan3 use` and
allows for example to use `mwan3 use` in monitoring scripts.

Before change:
shell command:
  mwan3 use wan false >/dev/null && echo ok || echo fail
result:
  ok

After change:
shell command:
  mwan3 use wan false >/dev/null && echo ok || echo fail
result:
  fail

Signed-off-by: Philipp Schmitt <[email protected]>

ddns-scripts: Accept 'good|nochg' for IPv4/IPv6 in ydns.io.json

Signed-off-by: Bei Lin <[email protected]>

owut: update to 2025.02.18

Bug fixes:
    efahl/owut@17a884e owut: clean up some apk-based hackery
    efahl/owut@065ac05 owut: add warnings for missing defaults

Enhancements:
    efahl/owut@f9fae6b owut: allow user to ignore removed default packages
    efahl/owut@5aa75b6 owut: message cleanup
    efahl/owut@5823db3 owut: reduce default verbosity

Signed-off-by: Eric Fahlgren <[email protected]>

https-dns-proxy: bugfixes

* No more `/sbin/uci: Invalid argument output` when set to not update
  dnsmasq instances (thanks @tmcqueen-materials for investigation!)
* Do not wait for interface.up on boot, hopefully this resolves the
  boot-up start for everyone

Signed-off-by: Stan Grishin <[email protected]>

nextdns: Update to version 1.45.0

Signed-off-by: Olivier Poitrey <[email protected]>

v2raya: Update to 2.2.6.6

Remove unneeded reload_service func while at it.

Signed-off-by: Tianling Shen <[email protected]>

v2ray-core: Update to 5.28.0

Remove unneeded reload_service func while at it.

Signed-off-by: Tianling Shen <[email protected]>

rclone: Update to 1.69.1

Remove unneeded reload_service func while at it.

Signed-off-by: Tianling Shen <[email protected]>

cloudflared: Update to 2025.2.0

Remove unneeded reload_service func while at it.

Signed-off-by: Tianling Shen <[email protected]>