lua-eco: update to 3.12.0

A new module `shared` added since this version.

changelog: https://github.com/zhaojh329/lua-eco/releases/tag/v3.12.0

Signed-off-by: Jianhui Zhao <[email protected]>

nfs-kernel-server: update to v2.8.4

Update to v2.8.4

Shortlog:
Anna Schumaker (4):
      rpcctl: Add support for `rpcctl switch add-xprt`
      rpcctl: Display new rpc_clnt sysfs attributes
      rpcctl: Add support for the xprtsec sysfs attribute
      rpcctl: Rename {read,write}_addr_file()

Antonio Alvarez Feijoo (3):
      nfsroot-generator: do not fail if nfsroot is not configured
      systemd: Add a generator to mount /sysroot via NFSv4 in the initrd
      systemd: Allow nfs-idmapd.service to be started without the server

Scott Mayhew (3):
      rpc-statd.service: define dependency on both rpcbind.service and rpcbind.socket
      nfsdctl: fix lockd config during autostart
      nfsdctl: debug logging fixups

Steve Dickson (3):
      Release: 2.8.4
      configure.ac: AC_PROG_GCC_TRADITIONAL is obsolete.
      nfsdctl: Warning Clean Up

zhangyaqi (2):
      gssd:fix the possible buffer overflow in get_full_hostname
      nfsdcld:Fix a memory leak

Thiago Becker (1):
      nfsrahead: modify get_device_info logic

Yaakov Selkowitz (1):
      Fix build with glibc-2.42

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc

Signed-off-by: John Audia <[email protected]>

cjson: update to 1.7.19

This is a bugfix release
Full release notes available at:
https://github.com/DaveGamble/cJSON/releases/tag/v1.7.19

Signed-off-by: Chris Swan <[email protected]>

snapcast: fix PulseAudio

While testing my integration of Snapcast, I didn't test with CONFIG_ALL*
and CONFIG_BUILDBOT flags, but the buildbots did and failed with a lot
of undefined reference to PulseAudio.

Fix it with preventing PulseAudio detection.
While at it, prevent Avahi detection too to save more flash space.

These features will be available later, through flavours.

Fixes: https://github.com/openwrt/packages/pull/23956
Fixes: eeb8d131fc93 ("snapcast: add package snapserver and snapclient")
Signed-off-by: Szabolcs Hubai <[email protected]>

lighttpd: update to lighttpd 1.4.82 release hash

Ref: https://www.lighttpd.net/2025/9/12/1.4.82/

Signed-off-by: Glenn Strauss <[email protected]>

bind: fix build and bump PKG_RELEASE

bind9 builds for me on 24.10, but it doesn't build on master with or without my
patches.

The build already dies on the configure stage (without my patches applied),
because the autoconf magic manages to mix up the host gcc and the
cross-compiling gcc.

Removing PKG_FIXUP:=autoreconf from the Makefile fixes that, but compilation chokes later instead on libtool magic:

    make[7]: Entering directory '/home/build/openwrt/build_dir/target-arm_cortex-a9+vfpv3-d16_musl_eabi/bind-9.20.11/bin/rndc'
    ...
    /bin/bash ../../libtool  --tag=CC   --mode=link arm-openwrt-linux-muslgnueabi-gcc ...
    libtool: link: arm-openwrt-linux-muslgnueabi-gcc ...
    .../bin/ld.bfd: warning: libns-9.20.11.so, needed by ../../lib/isccfg/.libs/libisccfg.so, not found (try using -rpath or -rpath-link)
    ...
    collect2: error: ld returned 1 exit status

Which I did a (compile-tested only) quick and dirty fix for.

Also, BUILD_CC isn't defined anywhere in the current bind sources, so I removed
that as well.

Signed-off-by: David Härdeman <[email protected]>

isc-dhcp: create zones using rndc

This changes isc-dhcp's init script to create bind zones using the tools
bind provides for that scenario instead of crafting separate zone
configuration by hand.

At the same time, remove the use of /tmp/bind/named.conf.local and add
permissions for dynamic zone creation to bind.

Signed-off-by: David Härdeman <[email protected]>

bind: update conffiles list

The previous patches removed a number of conffiles that weren't necessary,
meaning we can now assume that any changes or additional files in /etc/bind
are things that the user wants to keep.

Since /var/lib/bind is the standard location for longer-lived zone data
(i.e. not zones that secondary servers have obtained via XFER), we symlink
it to /etc/bind/zones so that it survives a sysupgrade.

Temporary files (such as XFER:ed zones for secondaries) stay in
/var/cache/bind.

Signed-off-by: David Härdeman <[email protected]>

bind: update init script

Simplify the init script, removing some unnecessary subshells and make sure
that the end result is shellcheck clean.

Signed-off-by: David Härdeman <[email protected]>

bind: use default rndc control channel

The present logic recreates what is already the default in bind [1], and writes
the rndc key twice to two different files. In addition, the rndc key is
regenerated every time bind is restarted. Simplify this by relying on the
default behaviour instead.

[1] https://bind9.readthedocs.io/en/latest/reference.html#controls-block-definition-and-usage

Signed-off-by: David Härdeman <[email protected]>

bind: rename named.conf.example

The file actually gets installed as /etc/bind/named.conf, so rename the file to
clarify that.

Signed-off-by: David Härdeman <[email protected]>

bind: remove bind.keys

First, the file is out-of-date.

Second, and more importantly, bind9 includes a compiled-in version which is
up-to-date (see https://www.isc.org/bind-keys/).

Signed-off-by: David Härdeman <[email protected]>

bind: update db.root

The previous version was quite out of date.

Signed-off-by: David Härdeman <[email protected]>

bind: remove obsolete zone files

Bind9 has native support for these zones via the "empty-zones yes" directive,
which is enabled by default.

(cf. https://salsa.debian.org/dns-team/bind9/-/commit/bb1cda792b3ca03f61503be4f94c1f82d3392792)

Signed-off-by: David Härdeman <[email protected]>

bind: update wording in Config.in

And make it less imperative to match the tone of the rest of the configuration
directives. Also, fix a typo.

Signed-off-by: David Härdeman <[email protected]>

bind: update named.conf

First, change the "directory" to point to /var/cache/bind, which ensures that
e.g. simple file "something" statements for secondary servers will create files
there (the directory is created by the init script, so we're sure that it
exists). This behaviour matches e.g. what Debian does.

Second, remove the "auth-nxdomain" stanza which is the default in bind since
9.0 was released.

Third, change "master" to "primary" (the wording used in the bind reference
docs)

Signed-off-by: David Härdeman <[email protected]>

bind: bind-server depends on bind-rndc

rndc-confgen is used in /etc/init.d/named, so make sure that it is available.

Signed-off-by: David Härdeman <[email protected]>

arp-whisper: do not lock deps

The version specified in Cargo.lock is too old to build.

Trim whitespaces while at it.

Signed-off-by: Tianling Shen <[email protected]>

rust: add loongarch64 and powerpc to supported targets

Also removed i686 as OpenWrt replaces it with i386 in $(ARCH).

Signed-off-by: Tianling Shen <[email protected]>

erlang: update to 28.0.3

- Takeover maintainership
- Enable parallel build
- Depend from libstdcpp only on JIT-enabled platforms (x86_64 and aarch64)
- Add SCTP support (off by default)
- Remove OTP-internal versions and rely on package versions for sub-packages
- Remove obsolete configure vars
- Move out sasl from erlang package into separate erlang-sasl
- Add more sub-packages
    - erlang-diameter
    - erlang-eldap
    - erlang-ftp
    - erlang-odbc
    - erlang-parsetools
    - erlang-tftp
- Rename erlang-os_mon to erlang-os-mon
- Clean-up descriptions text
- Disable MIPS16 again to fix mips* targets

Signed-off-by: Aleksey Vasilenko <[email protected]>

ampr-ripd: script improvements and add QA script

Added test.sh
Predetermine count used by for loops in Makefile postrm
Implemented extra_command in initscript
Resolved shellcheck issues
Bump release

Signed-off-by: Dan Srebnick <[email protected]>

dockerd: remove cgroupfs-mount dependency

The package `cgroupfs-mount` has been removed.

Signed-off-by: Wesley Gimenes <[email protected]>

cgroupfs-mount: remove package

A user opened an issue[1] in the upstream repository to migrate
the package from GitHub to Debian Salsa, but the upstream response[2]
was as follows:

> If any work happens on this package, it should be to deprecate and remove
> it, not migrate it (that's a waste of effort).

[1] https://github.com/tianon/cgroupfs-mount/issues/24
[2] https://github.com/tianon/cgroupfs-mount/issues/24#issuecomment-2663677115

Signed-off-by: Wesley Gimenes <[email protected]>

netbird: switch to profile-based configuration

Add support for `netbird` profiles feature [1] (introduced in 0.52.2). Use
`NB_STATE_DIR="/root/.config/netbird"` in the init file instead of the
previous `NB_CONFIG="/etc/netbird/config.json"`, and update Makefile
configuration paths accordingly.

Rationale: `netbird` saves state/configuration under `/var` by default. On
OpenWrt, `/var` is a symlink to `/tmp` (a volatile location), which would
cause config loss after reboot or reflash. Using `/root/.config/netbird`
avoids this, it's a valid upstream directory not used by default.
`netbird` will migrate existing configurations.

This change will not be backported to preserve the current meaning of
"stable" in OpenWrt and to avoid (unlikely but possible) breakage of
existing installations.

[1]: https://docs.netbird.io/how-to/profiles

Signed-off-by: Wesley Gimenes <[email protected]>

netbird: update to 0.55.1

changelog: https://github.com/netbirdio/netbird/releases/tag/v0.55.1

Signed-off-by: Wesley Gimenes <[email protected]>

netbird: update to 0.53.0 with config fix

changelog: https://github.com/netbirdio/netbird/releases/tag/v0.53.0

Update init file to include `NB_CONFIG="/etc/netbird/config.json"`
variable, ensuring configuration compatibility as before (fixes issue
introduced by profiles feature in 0.52.2). Existing configurations remain
compatible.

Note: license for some components (`management`, `relay`, `signal`) changed
to **AGPLv3**. These components aren't packaged for OpenWrt, so there's no
immediate effect, but record the change for future reference.

Signed-off-by: Wesley Gimenes <[email protected]>

netbird: update to 0.52.2

changelog: https://github.com/netbirdio/netbird/releases/tag/v0.52.2

`netbird` now supports profiles [1]. The configuration file has been
moved from `/etc/netbird/config.json` to `/var/lib/netbird/`. The
migration is handled by `netbird` itself.

However, in OpenWrt, the `/var` directory is a symbolic link to
`/tmp`, which is a temporary directory. This can result in
configuration loss after rebooting or flashing a new image. This
issue will be fixed in the next release, 0.53.0.
**I reported this behavior upstream [2].**

[1]: https://docs.netbird.io/how-to/profiles
[2]: https://github.com/netbirdio/netbird/issues/4322

Signed-off-by: Wesley Gimenes <[email protected]>

netbird: cleanup init script

Remove parameters added in commit 7b3d033ab651dd11e0db5fb099d106c9e09a2dc6
that were intended to reestablish the `netbird` connection when the
`wan` state changes. This functionality is already handled by
`netbird`. If it fails, it should be reported as a bug upstream.

Signed-off-by: Wesley Gimenes <[email protected]>

snort3: replace complex sed calls with patch

Simplification of Makefile: replace complex sed calls with a patch to
improve readability. This commit also renames an existing patch.

Signed-off-by: John Audia <[email protected]>

snort3: clean-up Makefile

Simplification of Makefile: remove line splits to increase readability.

Signed-off-by: John Audia <[email protected]>

snort3: switch from git proto to tarballs

Use upstream tarballs for source rather than using git. If we ever need
to build from git we can cherry pick and make a patch. This gives a
cleaner Makefile and faster build.

Signed-off-by: John Audia <[email protected]>

pixman: update to version 0.46.4

See https://gitlab.freedesktop.org/pixman/pixman/-/commits/pixman-0.46.4
for changes since pixman-0.43.4.

Signed-off-by: Daniel Golle <[email protected]>

libxmlb: update to 0.3.23

- New CLI build option

Release notes: https://github.com/hughsie/libxmlb/releases/tag/0.3.23

Signed-off-by: Lukas Voegl <[email protected]>

libjcat: update to 0.2.3

- New CLI build option
- Enable ed25519 by default

Release notes: https://github.com/hughsie/libjcat/releases/tag/0.2.3

Signed-off-by: Lukas Voegl <[email protected]>

dufs: Update to 0.45.0

Removed upstreamed patches.

Release note: https://github.com/sigoden/dufs/releases/tag/v0.45.0

Signed-off-by: Tianling Shen <[email protected]>

snapcast: fix compilation with boost 1.89.0

Boost upgrade hit Snapcast again: badaix/snapcast#1413

This patch is based on commit badaix/snapcast@d2e1635ebd96 ("Fix
building with boost v1.89.0").

Refs: 965dc7088e6c ("boost: Updates package to version 1.89.0")

Signed-off-by: Szabolcs Hubai <[email protected]>

snapcast: fix compilation with boost 1.88.0

Boost upgrade hit Snapcast hard again: the process needs to be updated!

This patch is a patchset from badaix/snapcast@develop.
It is based on the following upstream commits:
badaix/snapcast@901b79a213b1 ("Build failure with boost 1.88.0 #1367")
badaix/snapcast@ffb086b4b331 ("Define BOOST_PROCESS_VERSION=1 globally")
badaix/snapcast@c37a76a4aba9 ("Add missing includes")
badaix/snapcast@571f6a8f6953 ("Include process v1 headers for Boost version >= v1.88.0")

Refs: 3585ddfc446c ("boost: Updates package to version 1.88.0")

Signed-off-by: Szabolcs Hubai <[email protected]>

snapcast: fix compilation with boost 1.87.0

After revisiting the PR, it didn't even compile because of commit
c50de920a225a ("boost: Updates package to version 1.87.0").

Signed-off-by: Szabolcs Hubai <[email protected]>

snapcast: add package snapserver and snapclient

Snapcast [1] is a multiroom client-server audio player, where all
clients are time synchronized with the server to play perfectly synced
audio.

It's not a standalone player, but an extension that turns your existing
audio player into a Sonos-like multiroom solution.
Audio is captured by the server and routed to the connected clients.
Several players can feed audio to the server in parallel and clients can
be grouped to play the same audio stream.
One of the most generic ways to use Snapcast is in conjunction with the
music player daemon (MPD) [2] or Mopidy [3].

The inclusion starts with version 0.28.0 because of OpenSSL dependency
issues of version 0.29.0. Newer versions (e.g. 0.32.3, see [4])
with optional OpenSSL support, will be incorporated with flavours,
like "-mini" and "-full" in the upcoming PRs.
More about this topic please check the inclusion PR at [5]!

[1]: https://github.com/badaix/snapcast
[2]: http://www.musicpd.org/
[3]: https://www.mopidy.com/
[4]: https://github.com/badaix/snapcast/blob/develop/changelog.md
[5]: https://github.com/openwrt/packages/pull/23956#discussion_r2330463363

Fixes: #23924
Suggested-by: Tianling Shen <[email protected]>
Suggested-by: George Sapkin <[email protected]>
Signed-off-by: Szabolcs Hubai <[email protected]>

snapcast: add Snapcast from badaix/snapos as is

Add Snapcast package files as is from
https://github.com/badaix/snapos/tree/29a5daebb0513faa825b12474125c0c2dd66c2ee/openwrt/snapcast

Co-authored-by: badaix <[email protected]>
Co-authored-by: David Andreoletti <[email protected]>
Co-authored-by: luciferin <[email protected]>
Signed-off-by: Szabolcs Hubai <[email protected]>

sumo: add missing fmt dependency

Apparently it's used by sumo.

Signed-off-by: Rosen Penev <[email protected]>

unzip: add valid patche headers and missing CVE informations

This commit adds a valid git patch header for each patch, so that
additional information can be stored. This is in this case and 'CVE:' tag.
This can be used by CVE scanner to find out if the patch fixes a CVE.

Signed-off-by: Florian Eckert <[email protected]>

atftp: bump PKG_RELEASE

Bump PKG_RELEASE by one.

Signed-off-by: Florian Eckert <[email protected]>

atftp: add patch to fix build error

This patch fixes the following compilation build error for gcc14:

tftpd_pcre.c:109:37: error: passing argument 1 of 'pcre2_substring_list_free_8' from incompatible p
  109 |           pcre2_substring_list_free((const PCRE2_UCHAR **)substrlist);
      |                                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      |                                     |
      |                                     const PCRE2_UCHAR8 ** {aka const unsigned char **}
In file included from tftpd_pcre.h:24,
                 from tftpd_pcre.c:35:

I have also submitted the change to the upstream project:
https://github.com/madmartin/atftp/pull/2

Signed-off-by: Florian Eckert <[email protected]>

atftp: add patch to fix build warning

This patch fixes the following compilation build warning:

logger.c:117:47: warning: format '%li' expects argument of type 'long int', but argument 7 has type
  117 |                fprintf(log_fp, "%s %s %s[%d.%li]: %s\n", time_buf, hostname,
      |                                             ~~^
      |                                               |
      |                                               long int
  118 |                        log_ident, getpid(), pthread_self(), message);
      |                                             ~~~~~~~~~~~~~~
      |                                             |
      |                                             pthread_t {aka struct __pthread *}
logger.c:124:47: warning: format '%li' expects argument of type 'long int', but argument 7 has type
  124 |                fprintf(stderr, "%s %s %s[%d.%li]: %s\n", time_buf, hostname,
      |                                             ~~^
      |                                               |
      |                                               long int
  125 |                        log_ident, getpid(), pthread_self(), message);
      |                                             ~~~~~~~~~~~~~~
      |                                             |
      |                                             pthread_t {aka struct __pthread *}

I have also submitted the change to the upstream project:
https://github.com/madmartin/atftp/pull/2

Signed-off-by: Florian Eckert <[email protected]>

snort3: update to 3.9.5.0

Changelog: https://github.com/snort3/snort3/releases/tag/3.9.5.0

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc

Signed-off-by: John Audia <[email protected]>

snort3: fix logic in gpertools-runtime depends

The logic in e57cc9898a362d81e8dec5dd779293e6ff3d4710 was flawed causing
gperftools-runtime to fail to get detected when building resulting in:
...
ninja: Entering directory `/scratch/union/build_dir/target-x86_64_glibc/snort3-3.9.1.0'
ninja: error: '/scratch/union/staging_dir/target-x86_64_glibc/usr/lib/libtcmalloc.so', needed by 'src/snort', missing and no known rule to make it
make[2]: *** [Makefile:161: /scratch/union/build_dir/target-x86_64_glibc/snort3-3.9.1.0/.built] Error 1

It was missed due testing in build root that already had gperftools-runtime
built only discovered when building from a clean build root.

This commit fixes this flaw.

Test:
cat <<EOF > .config
CONFIG_TARGET_x86=y
CONFIG_TARGET_x86_64=y
CONFIG_TARGET_x86_64_DEVICE_generic=y
CONFIG_PACKAGE_snort3=y
EOF

make defconfig
grep gperftools-run .config
CONFIG_PACKAGE_gperftools-runtime=y

cat <<EOF > .config
CONFIG_TARGET_qoriq=y
CONFIG_TARGET_qoriq_generic=y
CONFIG_TARGET_qoriq_generic_DEVICE_watchguard_firebox-m300=y
CONFIG_PACKAGE_snort3=y
EOF

make defconfig
grep gperftools-run .config

Signed-off-by: John Audia <[email protected]>

openlist: Update to 4.1.2

Release note: https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.2

Signed-off-by: Tianling Shen <[email protected]>

xray-core: Update to 25.9.5

Release note: https://github.com/XTLS/Xray-core/releases/tag/v25.9.5

Signed-off-by: Tianling Shen <[email protected]>

v2ray-core: Update to 5.38.0

Release note: https://github.com/v2fly/v2ray-core/releases/tag/v5.38.0

Signed-off-by: Tianling Shen <[email protected]>

v2raya: Update to 2.2.7.1

Release note: https://github.com/v2rayA/v2rayA/releases/tag/v2.2.7.1

Signed-off-by: Tianling Shen <[email protected]>

v2ray-geodata: Update to latest version

Update all geodata.

Signed-off-by: Tianling Shen <[email protected]>

libconfig: update to 1.8.1

Fixes compilation with GCC 15.

Signed-off-by: Rosen Penev <[email protected]>

v4l2loopback: update to version 0.15.1

update to v4l2loopback 0.15.1

Signed-off-by: Michel Promonet <[email protected]>

php8: update to 8.4.12

Upstream changelog:
https://www.php.net/ChangeLog-8.php#8.4.12

Signed-off-by: Michael Heimpold <[email protected]>

realtek-poe: increase version to 1.3

* Add support for RTL8238B

Signed-off-by: Carl-Daniel Hailfinger <[email protected]>

esp2net: bump to 2025-09-02

Signed-off-by: Nuno Gonçalves <[email protected]>

sing-box: Properly set only the full variant as default

Adjust the variant definition so that DEFAULT_VARIANT is only applied
to the full variant.
Set the title of the full variant to 'full' for menuconfig.

Signed-off-by: Hannu Nyman <[email protected]>

gihub: fix PR template broken URL

changes the relative URL in the PR template to an absolute URL
to resolve a "Not Found" error.

Signed-off-by: Wesley Gimenes <[email protected]>

modemmanager: bump PKG_RELEASE

Bump PKG_RELEASE number.

Signed-off-by: Florian Eckert <[email protected]>

modemmanager: always reset the init_eps if not configured

The initial EPS is stored on the modem side. When establishing a connection,
it must therefore be deleted if no EPS has been configured. This is because
the system does not know whether one was configured previously.

Signed-off-by: Florian Eckert <[email protected]>

modemmanager: add missing ppp ifname option value

The pppd supports the option to configure the name of the network interface
at startup using the ifname option.

The pppd can overwrite the name of the network interface at startup using
the 'ifname' configuration option. If this option is not specified, the new
network interface is created according to the following scheme:
ppp<number>, e.g. ppp0, ppp1 and so on. This can therefore change with
every start if the number has been already assigned to another ppp connection.

In order to always get the same interface name with the modemmanger proto via
ppp, it is created according to the new scheme by setting the 'ifname':
ppp-<uci network interface name>, e.g. ppp-wwan.

Signed-off-by: Florian Eckert <[email protected]>

keepalived: add enabled option

To prevent the keepalived service from starting if there is no valid
configuration yet, the new option enabled is added. This must be set to
true for keepalived to start.

Signed-off-by: Florian Eckert <[email protected]>

keepalived: only add content to config file if needed

Only add the first two pieces of information to the configuration file if
there is a valid '/etc/config/keepalived'.

Signed-off-by: Florian Eckert <[email protected]>

keepalived: enable reproducible-build

Before keepalived version '2.3.0' the compilation was not reproducable
because the compile date and other information has been added to the binary.

Starting with version '2.3.0', there is a new compilation option
'--enable-reproducible-build' that makes the binary reproducible.

The data that prevented this has been moved to a separate file,
'/etc/keepalived/keepalived.config-opts'.

This commit enables the reproducable build.

[1] https://github.com/acassen/keepalived/commit/30d2f759783e769c27974d22bab88f7e82dfcdf9

Signed-off-by: Florian Eckert <[email protected]>

stunnel: update version to 5.75

Bugfixes:
* Fixed infinite loop triggered by OCSP URL parsing errors (thx to Richard Könning for reporting).
* Fixed OPENSSL_NO_OCSP build issues (thx to Dmitry Mostovoy for reporting).
* Fixed default curve selection in FIPS mode with OpenSSL 3.4+.
* Fixed tests with modern Python versions.
* Fixed tests with multiple OpenSSL versions installed.

Features:
* Added provider URI support for "cert" and "key" options.
* Added new "CAstore" service-level option (OpenSSL 3.0+).
* Added "provider" (OpenSSL 3.0+), "providerParameter" (OpenSSL 3.5+), and "setEnv" global options.
* Key file/URI path added to passphrase prompt on Unix.
* PKCS#11 provider installed on Windows.

Signed-off-by: Florian Eckert <[email protected]>

stunnel: update version to 5.74

Bugfixes:
* Fixed a stapling cache deallocation crash.
* Fixed "redirect" with protocol negotiation.

Features:
* "protocolHost" support for "socks" protocol clients.
* More detailed logs in OpenSSL 3.0 or later.

Signed-off-by: Florian Eckert <[email protected]>

stunnel: update version to 5.73

Bugfixes
* Fixed a memory leak while reloading stunnel.conf sections with
  "client=yes" and "delay=no".
* Fixed TIMEOUTocsp with values greater than 4.
* Fix the IPv6 test on a non-IPv6 machine.

Features
* HELO replaced with EHLO in the post-STARTTLS SMTP protocol negotiation
* OCSP stapling fetches moved away from server threads.
* improved client-side session resumption.
* Added support for the mimalloc allocator.
* Check for protocolHost moved to configuration file processing for the
  client-side CONNECT protocol.
* Clarified some confusing OpenSSL's certificate verification error messages.

Signed-off-by: Florian Eckert <[email protected]>

acme-common: cleanup acme start crontab migration

The '/etc/init.d/acme start' crontab migration
should also delete the existing
'/etc/init.d/acme start' line.

Otherwise, on every sysupgrade that carries
forward existing configurations, a new
'0 0 * * * /etc/init.d/acme renew' line is
added to the crontab.

Furthermore, do not add an 'acme renew' crontab
line if it already exists.

Signed-off-by: Satadru Pramanik, DO, MPH, MEng <[email protected]>

owut: update to 2025.09.03

Bug fixes:
    efahl/owut@5743eea3bcda owut: suppress all but json output when using dump
    efahl/owut@efe39e2e3897 owut: handle sigint (ctrl-c) properly
Enhancements:
    efahl/owut@49e9bce7b8c3 owut: provide download progress for slow connections

Signed-off-by: Eric Fahlgren <[email protected]>

lksctp-tools: update to 1.0.21

update to 1.0.21

Signed-off-by: Aleksey Vasilenko <[email protected]>

gperftools: update to 2.17.2

Bump to latest release and removed upstreamed patch.

Resulting libs give a fully functional snort3 which was built against
this new version.

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc (Intel N150 based box)

Signed-off-by: John Audia <[email protected]>

chrony: update to 4.8

Update chrony to 4.8 and configure chronyc to drop root privileges by
default.

Release notes: https://chrony-project.org/news.html#_27_aug_2025_chrony_4_8_released

Signed-off-by: Miroslav Lichvar <[email protected]>

mwan3: bump PKG_RELEASE

- fix some problems with GNU sed/grep
- add IPv6-PD src_ip logic

Signed-off-by: Fabian Groffen <[email protected]>

mwan3: init.d/mwan3: fix GNU grep warning about stray \

GNU grep complains:
  grep: warning: stray \ before :

Drop the \, confirmed with busybox grep backslash is non-significant
(the output is the same).

Closes: https://github.com/openwrt/packages/issues/25198
Signed-off-by: Fabian Groffen <[email protected]>

mwan3: common.sh: fix src_ip detection for ipv6-PD

IPv6 via PPPoE often receives a prefix, not an address. In that case
mwan3_get_src_ip would not find an address and fall back to ::.  However
in case of multiple IPv6 upstreams, this no longer means a ping (such as
done by uptime check) succeeds, for there are multiple addresses.

With this, mwan3 can effectively load-balance/fail-over on a PPPoE IPv6
prefix and a secondary (LTE) acquired /64 without immediately disabling
the IPv6 prefix interface as soon as the secondary IPv6 interface comes
up.

I think this change is also a fix to #26690
but I'm not 100% sure of that.

Signed-off-by: Fabian Groffen <[email protected]>

mwan3: common.sh: fix sed syntax for GNU sed

`pq' yields with GNU sed:
  sed: -e expression #1, char 15: extra characters after command
so, make q a separate command instead.

busybox accepts this too, and still returns only the first match (q
quits processing)

Signed-off-by: Fabian Groffen <[email protected]>

sing-box: add variant tiny

The tiny version disables tailscale by default for small package size.
OpenWrt also has the tailscale package as an alternative. We prefer
to keep the base version has the same build tags with the upstream
releases for compatibility.

Signed-off-by: Van Waholtz <[email protected]>

sing-box: Update to 1.12.4

changelog: https://github.com/SagerNet/sing-box/releases/tag/v1.12.4

Signed-off-by: Anton P. <[email protected]>

ruby: update to 3.3.9

3.3.9 release includes the following security fix of default gems:

- CVE-2025-24294: Possible Denial of Service in resolv gem

And the following fixes for build issues:

- GCC 15.1
- Visual Studio 2022 Version 17.14

3.3.7 and 3.3.8 are routine update that includes minor bug fixes.

Signed-off-by: Luiz Angelo Daros de Luca <[email protected]>

libtorrent-rasterbar: update boost dependencies

libtorrent only links to boost headers since boost 1.69.
Remove boost-system from the dependencies and add boost as build
dependency.

Signed-off-by: Tianling Shen <[email protected]>

micro: add new package

Modern and intuitive terminal-based text editor

https://micro-editor.github.io

Co-authored-by: Wesley Gimenes <[email protected]>
Signed-off-by: Gregory Gullin <[email protected]>

squid: update to 7.1

- Use GitHub for sources URL
- Remove autoreconf fixup (it works out-of-the-box)
- Remove squid-mod-cachemgr package since cachemgr.cgi was removed upstream
- Rename ac_cv_epoll_works to squid_cv_epoll_works to follow upstream
- Don't customize target CFLAGS and LDFLAGS (they work as is)
- Remove nettle configure patch - upstream handles it correctly now
- Remove dummy comment in config menu

Signed-off-by: Aleksey Vasilenko <[email protected]>

bc: update to 1.08.2

- Remove autoreconf and GCC 15 workaround
- Remove 3 obsolete/upstreamed patches
- Manually rebase no-doc patch

Signed-off-by: Aleksey Vasilenko <[email protected]>

nginx: update CPE ID

Looking at the official CPE dictionary [1], `cpe:/a:nginx:nginx` was
only used until 1.21.4 inclusively. Later it was renamed to
`cpe:/a:f5:nginx`, and it showed up in a few more non-contiguous
versions numbers after 1.21.4.

In all nginx security advisories [2] starting from year 2024, the CPE
ID used is `cpe:/a:f5:nginx_open_source`. This includes versions 1.25.0
and newer.

Update the CPE ID to the newest known value of `cpe:/a:f5:nginx_open_source`
used in nginx's own security advirosies/CVEs.

[1]: https://nvd.nist.gov/products/cpe
[2]: https://nginx.org/en/security_advisories.html

Signed-off-by: Roman Azarenko <[email protected]>

ampr-ripd: Initial package release

This project can be used with the OpenWrt SDK to generate a package
for ampr-ripd.  It is intended for use only by licensed amateur radio
operators.  ampr-ripd is a modified RIPv2 listener that provides
route information for ARDC IPIP Mesh tunnels.

Signed-off-by: Dan Srebnick <[email protected]>

libtirpc: fix build for client packages

Version 1.3.7 introduced a feature which moved symbols into an optional
database section[1]. Add corresponding configure args to fix the build
with our packages. This commit adds the new option to ensure client
packages (snort, rpcbind, lsof, etc.) build without error.

Build system: x86/64 (using external toolchain from snapshot)
Build-tested: x86/64

Co-authored-by: Hannu Nyman <[email protected]>
Signed-off-by: John Audia <[email protected]>

rsync: update dependencies for rrsync

- update dependencies from perl to python
- support dropbear

Signed-off-by: Maxim Storchak <[email protected]>

lsof: fix compilation issue with "libtirpc"

adding --without-libtirpc to CONFIGURE_ARGS + version bump. Ref.: https://github.com/openwrt/packages/issues/27357

Signed-off-by: Ulrich Stark <[email protected]>

lf: update to r37

https://github.com/gokcehan/lf/releases/tag/r37

Signed-off-by: Nate Robinson <[email protected]>

django-restframework: assign PKG_CPE_ID

https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:django-rest-framework:django_rest_framework

Signed-off-by: Wei-Ting Yang <[email protected]>

yt-dlp: bump to 2025.08.22

Changelog: https://github.com/yt-dlp/yt-dlp/releases/tag/2025.08.22
Signed-off-by: George Sapkin <[email protected]>

telegraf: update to 1.35.4

- Update Telegraf to v1.35.4
- Adjust GO_PKG_LDFLAGS_X to reflect upstream changes in version metadata
- Add default configuration file (Telegraf no longer includes one)
- Drop deprecated tcp_listener and udp_listener plugins from telegraf-small
- Rework how plugins for small variant are specified to reflect upstream changes
- Add -static TARGET_LDFLAGS for MIPS target to avoid R_MIPS_26 relocation errors during build

Signed-off-by: Niklas Thorild <[email protected]>

adblock-fast: update to 1.1.4-r12

README:
* update header

Init-script:
* set an earlier start to get triggers to work
* better str_contains
* improve readability of json() by getting rid of cascading case statements
* add new errors/status messages to get_text()
* prepare get_text() for localization by switching to inline printf
* adjust shellcheck disable comments where needed
* parse unbound config for DNS hijack ports
* test if the archived cache exists on boot and proceed to use it if it does
* add trigger waiting status so that luci app can display correct status
* do not run adb_config_update on boot, speeding up trigger setup

Signed-off-by: Stan Grishin <[email protected]>

sing-box: Revert "sing-box: update to 1.12.3"

This reverts commit 002e0559a5f3339fd5232a6e63cc00ce6886b3ab.

sing-box 1.12.3 is apparently buggy and crashes.
Reference to #27346 and #27339
Let's revert the upgrade.

Signed-off-by: Hannu Nyman <[email protected]>

vips: update to 8.17.1

Upstream list of changes is available at
https://github.com/libvips/libvips/releases/tag/v8.17.1.

Signed-off-by: W. Michael Petullo <[email protected]>

krb5: update to 1.22.1

Upstream list of changes is available at
https://web.mit.edu/kerberos/krb5-1.22/krb5-1.22.1.html.

Of note is that this release fixes CVE-2025-57736.

Also removes "-std=gnu11" from build.

Signed-off-by: W. Michael Petullo <[email protected]>

adguardhome: bump to 0.107.65

Changelog: https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.65
Signed-off-by: George Sapkin <[email protected]>

transmission-web-control: fix mirror hash

Fix hash.

Signed-off-by: Hannu Nyman <[email protected]>

libtirpc: update to 1.3.7

Release notes: https://sourceforge.net/projects/libtirpc/files/libtirpc/1.3.7/Release-1-3-7.txt

Removed upstreamed patches.

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc (Intel N150 based box)

Signed-off-by: John Audia <[email protected]>