crowdsec-firewall-bouncer: update to 0.0.33

Description:
updated to new upstream release version 0.0.33

Maintainer: Kerma Gérald <[email protected]>
Run tested: mediatek/filogic, BPI-R3, Openwrt 24.10.1

Signed-off-by: S. Brusch <[email protected]>

adblock: update 4.4.2-1

* added a new "divested" feed, see https://divested.dev/pages/dnsbl
* added a new nsfw category of the hagezi feed
* added the missing custom feed file handling in the backend
* added a geoIP map with all blocked domains (plus the homeIP) in a
  modal popup window on the Reporting tab in LuCI
* fixed the fetchcmd autodetection
* small code fixes and improvements
* update the readme, added a new "Best practise" section
* update different LuCI components (separate commit)

Signed-off-by: Dirk Brenken <[email protected]>

poemgr: update to latest Git HEAD

Signed-off-by: Packet Please <[email protected]>

alist: Update to 3.45.0

Signed-off-by: Tianling Shen <[email protected]>

rclone: Update to 1.69.3

Signed-off-by: Tianling Shen <[email protected]>

v2ray-core: Update to 5.32.0

Signed-off-by: Tianling Shen <[email protected]>

v2ray-geodata: Update to latest version

Signed-off-by: Tianling Shen <[email protected]>

modemmanager: add sourcefilter option support
This make source based IPv6 routing option available for
modemmanager when using modem SLAAC.

Signed-off-by: Ryan Press <[email protected]>

named: /var/run/named isn't being created with correct permissions

It needs to be group writable or session.key can't be written once
named drops privileges.

Signed-off-by: Philip Prindeville <[email protected]>

perl-io-async: Perl Module IO::Async

Asynchronous event-driven programming in Perl

Signed-off-by: Jens Wagner <[email protected]>

perl-future-asyncawait: Perl Module Future::AsyncAwait

Povides a deferred subroutine syntax for futures in Perl

Signed-off-by: Jens Wagner <[email protected]>

perl-future: Perl Module Future

Perl Future objects represent an operation awaiting completion

Signed-off-by: Jens Wagner <[email protected]>

perl-io-socket-ssl: Perl Module IO::Socket::SSL

SSL sockets with IO::Socket interface in Perl

Signed-off-by: Jens Wagner <[email protected]>

perl-net-ssleay: Perl Module Net::SSLeay

Perl bindings for OpenSSL and LibreSSL

Signed-off-by: Jens Wagner <[email protected]>

perl-file-sharedir: Perl Module File::ShareDir

Perl module to locate per-dist and per-module shared files

Signed-off-by: Jens Wagner <[email protected]>

perl-class-inspector: Perl Module Class::Inspector

Get information about a Perl class and its structure

Signed-off-by: Jens Wagner <[email protected]>

perl-struct-dumb: Perl Module Struct::Dumb

Perl module to make simple lightweight record-like structures

Signed-off-by: Jens Wagner <[email protected]>

perl-xs-parse-sublike: Perl Module XS::Parse::Sublike

Perl XS functions to assist in parsing sub-like syntax

Signed-off-by: Jens Wagner <[email protected]>

perl-xs-parse-keyword: Perl Module XS::Parse::Keyword

Perl XS functions to assist in parsing keyword syntax

Signed-off-by: Jens Wagner <[email protected]>

ddns-scripts: fix parsing of parameters for cloudflare.com

There is an obvious bug here:
if we want to update example.com.example.com in zone example.com,
so `[email protected]`, after parsing,
the `__HOST` will be `example.com`, not expected `example.com.example.com`.

Signed-off-by: Liangbin Lian <[email protected]>

usb-serial-xr_usb_serial_common: remove package

Now that we have packaged the upstream driver[1] and only board[2] that
includes it by default has been switched to it, remove this out-of-tree
driver that is broken on 6.12 anyway.

[1] https://github.com/openwrt/openwrt/commit/d39d626b23756fe574ad46e093f5a796b1861b17
[2] https://github.com/openwrt/openwrt/commit/200a31b6f5ec7a46e5556b55d4e45a74fb5d6167

Signed-off-by: Robert Marko <[email protected]>

xtables-addons: update call BuildTemplate description

The BuildTemplate call has five arguments
(since openwrt/openwrt@f12f407),
so the description is corrected

Signed-off-by: Mieczyslaw Nalewaj <[email protected]>

xtables-addons: set ipp2p depends on kmod-lib-textsearch

For version 3.27 CONFIG_TEXTSEARCH_BM checks is enabled,
so ipp2p is set depends on kmod-lib-textsearch.

If ipp2p (and kmod-lib-textsearch) is disabled the error
"error CONFIG_TEXTSEARCH=y/m is required.." is displayed.
This is because all modules are always compiled.
So to make compilation possible with ipp2p disabled, the message
was disabled.

Signed-off-by: Mieczyslaw Nalewaj <[email protected]>

openthread-br: fix build on GCC 14

This patch is taken from openwrt/openwrt@a41747ac8e82 ("mbedtls: fix
 build on GCC 14").

Fixes: #26570
Signed-off-by: Tianling Shen <[email protected]>

fx: update to 36.0.3

This commit updates fx to version 36.0.3

For more details, please refer to release details:
https://github.com/antonmedv/fx/releases/tag/36.0.3

Signed-off-by: Fabian Lipken <[email protected]>

rtty: update to 8.1.5

changelog: https://github.com/zhaojh329/rtty/releases/tag/v8.1.5

Signed-off-by: Jianhui Zhao <[email protected]>

netbird: update to 0.45.1

changelog: https://github.com/netbirdio/netbird/releases/tag/v0.45.1

Signed-off-by: Wesley Gimenes <[email protected]>

perlbase-extutils: Adding required perlbase-version dependency

Attempting to use ExtUtils::MakeMaker from perlbase-extutils results in an
error of "Can't locate ExtUtils/MakeMaker/version/vpp.pm in @INC".
Installing perlbase-version fixes the error. Therefore we add
perlbase-version as a dependency of perlbase-extutils.

Signed-off-by: Timothy M. Ace <[email protected]>

CI: move script into separate directory

This change follows the structure of GitHub workflow
folders from the main OpenWrt repository, where scripts
are in separate folder.

Signed-off-by: Josef Schlehofer <[email protected]>

CI: formal check: use shared workflow in actions-shared-workflows

Lets switch to shared workflow in actions-shared-workflows instead of having
this separate file here. It will track and use the latest changes to avoid
being outdated.

Signed-off-by: Josef Schlehofer <[email protected]>

lua-eco: update to 3.10.0

* A new module `uci` added since this version.
* Fix an installation issue: Existing soft links should be preserved when installing libeco.

Signed-off-by: Jianhui Zhao <[email protected]>

docker-compose: Update to version 2.36.2

Release notes:
https://github.com/docker/compose/releases/tag/v2.36.2

Signed-off-by: Javier Marcet <[email protected]>

docker-compose: Update to version 2.36.1

Release notes:
https://github.com/docker/compose/releases/tag/v2.36.1

Signed-off-by: Javier Marcet <[email protected]>

cjson: update to 1.7.18

This is a bugfix release
Full release notes available at:
https://github.com/DaveGamble/cJSON/releases/tag/v1.7.18

Signed-off-by: Chris Swan <[email protected]>

cargo-c: update to 0.10.13

Signed-off-by: Luca Barbato <[email protected]>

rust: update to 1.87.0

Simplify the build invocation and reorder the target list to avoid
failures due the build process changes.

Signed-off-by: Luca Barbato <[email protected]>

pv: update to 1.9.31

* update to 1.9.31 from upstream: https://codeberg.org/ivarch/pv
* license changed to GPL-3.0-or-later and directory doc/COPYING -> docs/COPYING
* added test.sh file for ci testing

Signed-off-by: Nikolay Manev <[email protected]>

xtables-addons: fix build for kernel 6.12

    missing prototypes for three functions generated build errors.
error: no previous prototype for 'foo' [-Werror=missing-prototypes]

extensions/LUA/prot_buf_helpers.c: get_header_size
extensions/LUA/prot_buf_tftp.c: tftp_get_field_changes
extensions/LUA/prot_buf_dynamic.c: free_dynamic_prot_buf

Signed-off-by: Russell Senior <[email protected]>

tailscale: update to 1.84.0

Signed-off-by: Sandro Jäckel <[email protected]>

gammu: Fix misspelled licence variable

Signed-off-by: Jan Kardell <[email protected]>

luaexpat: Add license

Signed-off-by: Jan Kardell <[email protected]>

luasql: Fix license file

Signed-off-by: Jan Kardell <[email protected]>

freetype: Fix license file

Signed-off-by: Jan Kardell <[email protected]>

libudev-zero: Fix license

Signed-off-by: Jan Kardell <[email protected]>

tcp_wrappers: Fix license file

Signed-off-by: Jan Kardell <[email protected]>

canutils: Fix license file

Signed-off-by: Jan Kardell <[email protected]>

fuse3: Fix license file

Signed-off-by: Jan Kardell <[email protected]>

picocom: Fix license file

Signed-off-by: Jan Kardell <[email protected]>

wifi-presence: bump PKG_RELEASE

It is necessary to bump PKG_RELEASE, because existing installation of
wifi-presence wouldnt know about this fix, so this ensures versioning
and as well that existing installation will require update with
this fix.

Fixes: 87175e4ca365e1bf5ac71e3dfb5186eb4c41f689 ("wifi-presence: fix reading mqttID from config")
Signed-off-by: Josef Schlehofer <[email protected]>

python-netifaces: drop package

Upstream project archived [1].

[1] https://github.com/al45tair/netifaces

Signed-off-by: George Sapkin <[email protected]>

xtables-addons: nf_conntrack_rtsp: change strlcpy to strscpy

Change deprecated strlcpy to strscpy
for kernel 6.12 compatibility.

Signed-off-by: Mieczyslaw Nalewaj <[email protected]>

docker-compose: Update to version 2.36.0

Release notes:
https://github.com/docker/compose/releases/tag/v2.36.0

Signed-off-by: Javier Marcet <[email protected]>

lua-cjson: add build VARIANT for Lua5.4

Signed-off-by: Jianhui Zhao <[email protected]>

static-neighbor-reports: Update README.md

Define VAP on first use and fix some typos.

Maintainer: @blocktrron
Compile tested: n/a readme
Run tested: n/a readme

Description: Define VAP on first use and fix some typos.

Signed-off-by: Andy Jackson [email protected]
Signed-off-by: Andy Jackson <[email protected]>

bind: bump to 9.20.9

CVE-2025-40775: Prevent assertion when processing TSIG algorithm.  DNS messages
that included a Transaction Signature (TSIG) containing an invalid value in the
algorithm field caused named to crash with an assertion failure. This has been
fixed.

Signed-off-by: Noah Meyerhans <[email protected]>

emailrelay: Add support of build with MbedTLS

Signed-off-by: Sergey Ponomarev <[email protected]>

emailrelay: move config options to Config.in

Signed-off-by: Sergey Ponomarev <[email protected]>

emailrelay: update to v2.6

The emailrelay-filter-copy was removed and   --filter=copy: can be used instead.
Minor improvement of description.

Signed-off-by: Sergey Ponomarev <[email protected]>

emailrelay: fix reference link

Signed-off-by: Sergey Ponomarev <[email protected]>

emailrelay: more options

--as-client mode.
dnsbl: to reject bad IPs.
spool_dir and delivery_dir: to set storage on USB disk.
filter: for SpamAssassin.
POP3 options.
Specify interface.
Use --forward-to-some by default.

Signed-off-by: Sergey Ponomarev <[email protected]>

emailrelay: conf: TLS split cert and private key

Since v2.3.1 --server-tls-certificate and --client-tls-certificate may be comma separated list of privkey and fullchain so users don't need to merge the both files.
The privkey must be firts, the cert second.
Reflect this in config samples.

Alternatively instead of comma separated the emailrelay allows just pass two --server-tls-certificate options: one for a privkey and second time for a cert.

So the server_tls_certificate option may be a list. But instead to make it easier to configure from UCI let's add a separate option server-tls-key which is dedicated for a privkey.

Similarly, the client-tls-key is a private key part for the --client-tls-certificate

Signed-off-by: Sergey Ponomarev <[email protected]>

emailrelay: conf: TLS options

The server_tls/client_tls option also requires certs.

server_tls_required
server_tls_certificate
server_tls_verify
client_tls_required
client_tls_certificate
client_tls_verify

Signed-off-by: Sergey Ponomarev <[email protected]>

emailrelay: fix server_tls

The --server-tls is a boolean option and don't have an arg.

Signed-off-by: Sergey Ponomarev <[email protected]>

emailrelay: early return if not enabled

Signed-off-by: Sergey Ponomarev <[email protected]>

ovpn-dco: update to version 0.2.20241216

Added compatibility with 6.12 kernel

Signed-off-by: Ivan Pavlov <[email protected]>

dnsdist: update to 1.9.10

fixes CVE-2025-30193

Signed-off-by: Peter van Dijk <[email protected]>

tor-hs: bump version to 0.1.0

Add me as a second maintainer.
Remove outdated README.md but put a link to a Wiki instead.
Use Onion Service instead of Hidden Service.

Signed-off-by: Sergey Ponomarev <[email protected]>

tor-hs: keep /etc/tor config folder

Mark the /etc/tor folder to keep during sysupgrade.
The folder contains hidden_services folder with keys.

Signed-off-by: Sergey Ponomarev <[email protected]>

tor-hs: put torrc_generated into in-memory folder /var/run/

On each tor-hs service restart it generates a config file /etc/tor/torrc_generated.
The /etc/ is stored on a disk and kills it and slow.

Instead create a dedicated tor service Runtime Dir in the temp /var/run/.
It will be accessible only to the tor user.

Signed-off-by: Sergey Ponomarev <[email protected]>

tor-hs: create hs folder only if not exists

Previously the chown/chmod was performed each time even if the folder already existed.

Signed-off-by: Sergey Ponomarev <[email protected]>

tor-hs: add validation

Signed-off-by: Sergey Ponomarev <[email protected]>

tor-hs: Use config_get_bool for enable_hs

Signed-off-by: Sergey Ponomarev <[email protected]>

tor-hs: reformat and cleanup

Remove unused description.
Quote variables.
Use hostname_file variable.
Remove unnecessary quotes around "common".
Use echo -n to truncate a TORRC_FILE.

Signed-off-by: Sergey Ponomarev <[email protected]>

tor-hs: cleanup tor-hs.conf

Replace boolean "true"/"false" with more frequently used 1/0.
This may avoid configuration mistakes which is critical for Tor.
The Luci app anyway will set it as 1/0.

Make sections named. This is not required but again safes from mistakes when executing uci command.

Uncomment sections but disable them by default.
Then in a Luci app a user can quickly figure out what to change.
Ideally a user may just enable the config and start using it.

In the nextcloud config use a single 80 instead of 80;80.
This simpler configuration is now supported.

Instead of "Hidden service" the Tor team now uses "Onion service".

Signed-off-by: Sergey Ponomarev <[email protected]>

tor-hs: tor-hs.init skip onion service when Name empty

The Name is used as a HS folder name and can't be empty.

Signed-off-by: Sergey Ponomarev <[email protected]>

tor-hs: tor-hs.init remove unused clean_hs()

Signed-off-by: Sergey Ponomarev <[email protected]>

tor-hs: tor-hs.init handle_hs_ports_conf split ports

Using substring instead of awk.
It changes behaviour when only one port is specified.
Previously:
value="80" => public="80" local=""
Now:
value="80" => public="80" local="80"

It simplifies configuration of one-to-one ports.

Signed-off-by: Sergey Ponomarev <[email protected]>

tor-hs: tor-hs.init handle_hs_ports_conf: remove unused name var

Signed-off-by: Sergey Ponomarev <[email protected]>

admin/syslog-ng: fix PKG_CPE_ID

oneidentity:syslog-ng is a better CPE ID than balabit:syslog-ng as
this CPE ID has the latest CVEs (whereas balabit:syslog-ng only
has a CVE from 2000):
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:oneidentity:syslog-ng

Fixes: 5f07bb10948f6ebdf83470c3437c3072aab982e3 (syslog-ng: update to version 3.19.1)
Signed-off-by: Fabrice Fontaine <[email protected]>

fscrypt: add new package

Fscrypt is a high-level tool for the management of Linux native
filesystem encryption. fscrypt manages metadata, key generation, key
wrapping, PAM integration, and provides a uniform interface for creating
and modifying encrypted directories.

Upstream url: https://github.com/google/fscrypt/blob/master/README.md

Build system: x86/64
Build-tested: bcm27xx/bcm2712
Run-tested: bcm27xx/bcm2712

Signed-off-by: John Audia <[email protected]>

treewide: assign some PKG_CPE_IDs

Assign some PKG_CPE_IDs to enhance CVE coverage.

https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=aardvark-dns
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=alpine_project
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=boringssl
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=ecdsautils
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=file_project
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=knot_resolver
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=libwrap
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=lsof_project
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=nfdump
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=nlnetlabs%20name_server_daemon
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=rclone
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=setserial
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=tang_project
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=tesseract_project
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=tmate-ssh-server
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=ttyd
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=uw-imap
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=v2ray-core
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=zstandard

Signed-off-by: Wei-Ting Yang <[email protected]>

jool: update to 4.1.14

Changelog: https://github.com/NICMx/Jool/releases/tag/v4.1.14

Signed-off-by: Goetz Goerisch <[email protected]>

smartdns: Update to version 46.1

Change package source to github codeload.

Trim "Release" prefix from upstream versioning
to make it at least somewhat semantic compliant.

Add two additional folders and two default
config files based on upstream changes.

Signed-off-by: Jonathan Smith <[email protected]>

netbird: update to 0.44.0

changelog: https://github.com/netbirdio/netbird/releases/tag/v0.44.0

Signed-off-by: Wesley Gimenes <[email protected]>

semodule-utils: update to 3.8.1

Update to latest 3.8.1 version.

Signed-off-by: Robert Marko <[email protected]>

selinux-python: update to 3.8.1

Update to latest 3.8.1 version and drop upstreamed patch[1].

[1] https://github.com/SELinuxProject/selinux/commit/1a29c28afbb96b1e47001dc3dde38c4b6bd9da22

Signed-off-by: Robert Marko <[email protected]>

python-semanage: update to 3.8.1

Update to latest 3.8.1 version and backport a patch to fix compilation[1].

[1] https://github.com/SELinuxProject/selinux/commit/a339594da6f027aed5d66ec6798a3d732df235e4

Signed-off-by: Robert Marko <[email protected]>

python-selinux: update to 3.8.1

Bump to latest 3.8.1 version.
Import the required backported patches from libselinux.

Signed-off-by: Robert Marko <[email protected]>

lm-sensors: update to v3.6.2

Change source URL to reflect active mirror as old one has not been
updated in ~4 years and bump to latest upstream release.

% sensors --version
sensors version 3.6.2 with libsensors version 3.6.2

Build system: x86/64
Build-tested: x86/64
Run-tested: x86/64

Signed-off-by: John Audia <[email protected]>

iperf3: update to 3.19

Updates iperf3 to the latest upstream release, 3.19

Changelog: https://github.com/esnet/iperf/releases/tag/3.19

Signed-off-by: Dane Murphy <[email protected]>

fx: update to 36.0.2

Signed-off-by: Fabian Lipken <[email protected]>

alpine: fix compilation with GCC14

Wrong function prototypes.

Signed-off-by: Rosen Penev <[email protected]>

rtorrent: update to 0.15.3

Rebase patch.

Signed-off-by: Rosen Penev <[email protected]>

libtorrent: update to 0.15.3

Add patch to allow rtorrent to link statically.

Aligned is no longer needed with C++17.

Signed-off-by: Rosen Penev <[email protected]>

bind: bump to 9.20.8

Signed-off-by: Philip Prindeville <[email protected]>

lua-openssl: bump to 0.10.0-0

Update lua-openssl to 0.10.0-0 fix compilation.

Signed-off-by: Robert Marko <[email protected]>

strongswan: swanctl: Add support for send_certreq

Support the [send_certreq] connection configuration option to disable
offering trusted root CA certificates and reduce the size of the initial
IKE packets.

This work is based on a patch by @aleks-mariusz in
https://forum.openwrt.org/t/confusion-regarding-setting-up-ikev2-vpn-service-with-strongswan-using-ipsec-and-swanctl/169587/9

[send_certreq]: https://docs.strongswan.org/docs/latest/swanctl/swanctlConf.html#_connections

Signed-off-by: Kevin Locke <[email protected]>

zabbix: update to 7.0.12
also fix build error

Signed-off-by: Thlv Alivs <[email protected]>

strongswan: mark UCI plugin as broken

UCI plugin in strongswan has been broken for years, and now its causing
strongswan to fail compilation.

So, instead of the whole strongswan package to be failing and missing from
feeds simply make UCI plug depend on @BROKEN.

Signed-off-by: Robert Marko <[email protected]>

tcp_wrappers: update patches for gcc14

The portable way is to use `socklen_t`. This fixes both glibc and
musl based builds.

Signed-off-by: Matthew Cather <[email protected]>