adguardhome: bump to 0.107.60

Fixed:

- Filtering for DHCP clients.
- Incorrect label on login page.
- Validation process for the HTTPS port on the Encryption Settings page.

Changelog: https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.60
Signed-off-by: George Sapkin <[email protected]>

adguardhome: use committime instead of buildtime

buildtime has been replaced with committime upstream for better
reproducible builds.

Link: https://github.com/AdguardTeam/AdGuardHome/commit/d17c6c6bb3ae5b7c775c53ebb04b9b089dcf0490#diff-82ef468ec5547f1ed424776755a7f87dfec4eba9838d2c2ac02c9881bb67d737L68-R70
Signed-off-by: George Sapkin <[email protected]>

yt-dlp: run CI test for the main package only

Fixes: afe9935ff ("yt-dlp: add CI version check")
Signed-off-by: George Sapkin <[email protected]>

ttyd: update to 1.7.7

Breaking Changes

    The web terminal is readonly by default now, to make it writable,
    use -W option.

Changelog 1.7.7

    Bump to 1.7.7
    cmake: add static version back

Changelog 1.7.6

    workflow: update actions packages
    cmake: get version from git ref

Changelog 1.7.5

    html: allow overriding client options with URL query
    server: add --exit-no-conn option
    html: add safari mobile full screen support
    html: Add Unicode 11 xterm.js addon
    html: upgrade to xterm 5.4.0
    add trzszDragInitTimeout option

Changelog 1.7.4

    Leverage Docker Layer System
    html: update dependencies
    build(deps): update zlib version 1.2.13 to 1.3 in cross-build.sh
    server: print working directory on start
    server: replace --readonly with --writable
    server: fix -U option not work
    server: do not expose port to public by default
    Add -y flag for easier installation
    improve support for trzsz
    info.max_http_header_data = 65535;
    Add Docker pulls badge
    fix flow control
    Fix typo, OPTOINS -> OPTIONS
    Bump CMake version to 2.8.12

Signed-off-by: Paul Donald <[email protected]>

tailscale: update to 1.82.5

Signed-off-by: Sandro Jäckel <[email protected]>'

pdns-recursor: update to 5.2.2

includes fix for CVE-2025-30195 (which was in 5.2.1)

Signed-off-by: Peter van Dijk <[email protected]>

sqlite3: bump to 3.47.2

https://sqlite.org/changes.html

build: x86_64
run tested: x86_64

```
3.47.2 2024-12-07 20:39:59 2aabe05e2e8cae4847a802ee2daddc1d7413d8fc560254d93ee3e72c14685b6c (64-bit)
```

Signed-off-by: Paul Donald <[email protected]>

docker-compose: Update to version 2.35.1

Release notes:
https://github.com/docker/compose/releases/tag/v2.35.1

Signed-off-by: Javier Marcet <[email protected]>

netbird: update to 0.42.0

changelog: https://github.com/netbirdio/netbird/releases/tag/v0.42.0

Signed-off-by: Wesley Gimenes <[email protected]>

netbird: update to 0.41.3

changelog: https://github.com/netbirdio/netbird/releases/tag/v0.41.3

Signed-off-by: Wesley Gimenes <[email protected]>

haproxy: update to v3.0.10

- Update haproxy PKG_VERSION and PKG_HASH
- See changes: http://git.haproxy.org/?p=haproxy-3.0.git;a=shortlog

Signed-off-by: Christian Lachner <[email protected]>

jq: provide regex support in additional package jq-full

I modified the makefile, so that it will build two packages: jq and
jq-full. The former will remain unchanged and the latter will have a
dependency to the oniguruma library, so jq-full will have regex functions
enabled.

Signed-off-by: Maximilian Trüpschuch <[email protected]>

coremark: fix error when it was built in the second run

When there is an error building packages other than coremark
and re-run with make -j1 V=s, the coremark package will report error.
the root cause is the folder was already created in the first run,
and not removed before the second run.

To fix this, use 'mkdir -p' instead of 'mkdir'.

Co-authored-by: Jonas Gorski <[email protected]>
Signed-off-by: Rye Sears <[email protected]>

modemmanager: backport commit fixing crash with Fibocom mtk-7xx modems

Backport commit
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/commit/046b79a6766b6384db9cd56a9af5d148787bafe4

See also
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/issues/975

Signed-off-by: Daniel Golle <[email protected]>

adguardhome: Add George Sapkin as maintainer

Signed-off-by: Dobroslaw Kijowski <[email protected]>

net-snmp: fix PRIdPTR macro undefined error

This commit includes inttypes.h to prevent the following error:

```
mibgroup/ieee802dot11.c: In function 'displayWiExt':
mibgroup/ieee802dot11.c:4563:26: error: expected ')' before 'PRIdPTR'
 4563 |     printf ( "%s sens: %" PRIdPTR "\n", "SIOCGIWSENS", *(intptr_t *)&info.sens );
      |            ~             ^~~~~~~~
      |                          )
mibgroup/ieee802dot11.c:31:1: note: 'PRIdPTR' is defined in header '<inttypes.h>'; did you forget to '#include <inttypes.h>'?
   30 | #include "util_funcs/header_generic.h"
  +++ |+#include <inttypes.h>
   31 |
```

Signed-off-by: Wei-Ting Yang <[email protected]>

poemgr: update to latest HEAD

eaaf7ea contrib: update GPIO numbering
28774ac poemgr: add error logging

Signed-off-by: David Bauer <[email protected]>

transmission: add syscalls to seccomp filter

Add missing syscalls found with `/etc/init.d/transmission trace`.

fix crash on boot on x86_64 platform

Signed-off-by: Liangbin Lian <[email protected]>

ddns-script: Change CURL call and redirect output in update_porkbun_v3

This also fixes: https://github.com/openwrt/packages/issues/26181

CURL funciton change was patterned on other ddns update scripts
that uses also JSON request/response payloads similar to
update_digitalocean_v2.sh: https://github.com/openwrt/packages/blob/15014f93e15bcb29956bf79cd397fea580bf6ea6/net/ddns-scripts/files/usr/lib/ddns/update_digitalocean_com_v2.sh#L29
update_gcp_v1.sh: https://github.com/openwrt/packages/blob/15014f93e15bcb29956bf79cd397fea580bf6ea6/net/ddns-scripts/files/usr/lib/ddns/update_gcp_v1.sh#L212

rebased and bumbped ddns-script version

Signed-off-by: Rikki Vizcarra <[email protected]>

xtables-addons: bump to 3.27

Updated for compatibility with kernel 6.12.

Signed-off-by: Mieczyslaw Nalewaj <[email protected]>

realtek-poe: Build for all targets

* realtek-poe was only being built for realtek/rtl838x with mips-4kec
* needed by targets in realtek/rtl839x with mips-24kc

Signed-off-by: Stephen Howell <[email protected]>

adblock: update 4.4.1-1

* add an uci-defaults script for housekeeping and option migration from former versions
* update the readme

Signed-off-by: Dirk Brenken <[email protected]>

ddns-scripts: bump package release

Signed-off-by: Paul Donald <[email protected]>

ddns-scripts: fix daemon to reload instead of kill

Instead of just killing all the processes, let's actually reload them,
since that's what the user would expect when issuing a 'reload' command.

Move the killall portion to a kill function

Signed-off-by: Paul Donald <[email protected]>

ddns-scripts: fix daemon start - background the script

omitted the ampersand in the re-factor in commit
a36167288227c753b8a57ef875ff3eb8e6dd510a

Signed-off-by: Paul Donald <[email protected]>

modemmanager: bump to 1.24.0

100-ublox-remove-ID_MM_PROCESS-tags.patch has been removed as this change is now upstream.

Signed-off-by: Ryan Press <[email protected]>

libmbim: bump to 1.32.0

Signed-off-by: Ryan Press <[email protected]>

libqmi: bump to 1.36.0

Signed-off-by: Ryan Press <[email protected]>

owut: update to 2025.04.08

Bug fixes:
    efahl/owut@ef2bfb4d4cb5 owut: remove trailing commas in json dump
Enhancements:
    efahl/owut@2586b2cfd50c owut: minor name cleanup

Signed-off-by: Eric Fahlgren <[email protected]>

adblock: update 4.4.0-3

* checked and fixed the kresd and smartdns support
* fixed another ETAG issue
* changed the enabled feeds in default config to certpl, aguard and adguard_tracking
* various other small fixes
* update the readme

Signed-off-by: Dirk Brenken <[email protected]>

external-protocol: add missing ip dependency

external.sh requires ip with -json flag that is not supported by the
BusyBox ip.

Fixes: https://github.com/openwrt/packages/issues/26302
Signed-off-by: George Sapkin <[email protected]>

syncthing: bump to 1.29.5

Bugfixes:

- use separate lock file instead of locking the certificate

Changelog: https://github.com/syncthing/syncthing/releases/tag/v1.29.5
Signed-off-by: George Sapkin <[email protected]>

syncthing: bump to 1.29.4

Bugfixes:

- Tildes break directory autocomplete

Changelog: https://github.com/syncthing/syncthing/releases/tag/v1.29.4
Signed-off-by: George Sapkin <[email protected]>

syncthing: bump to 1.29.3

Bugfixes:

- Unintelligible error message "setting metadata: lookup failed"

Changelog: https://github.com/syncthing/syncthing/releases/tag/v1.29.3
Signed-off-by: George Sapkin <[email protected]>

lxc: update to 6.0.4

Added upstream patch to fix starting containers with complex hooks.
No existing patches needed to be rebased/simple version bump to 6.0.4.

Build system: x86/64
Build-tested: x86/64
Run-tested: x86/64

Signed-off-by: John Audia <[email protected]>

openssh: bump to 10.0p1

This update requires sshd-auth to be packaged due to the authentication
bin split introduced in this version.

Changelog: https://www.openssh.com/txt/release-10.0

Build system: x86/64
Build-tested: x86/64
Run-tested: x86/64

Signed-off-by: John Audia <[email protected]>

yt-dlp: bump to 2025.03.31

Core changes

- Add --compat-options 2024

Extractor changes

- francaisfacile: Add extractor
- generic: Validate response before checking m3u8 live status
- microsoftlearnepisode: Extract more formats
- mlbtv: Fix radio-only extraction
- on24: Support mainEvent URLs
- sbs: Fix subtitles extraction
- stvr: Rename extractor from RTVS to STVR
- twitch: clips: Extract portrait formats
- youtube
  - Add player_js_variant extractor-arg
  - tab: Fix playlist continuation extraction

Pick up the package as a maintainer as per previous maintainer's
request.

Changelog: https://github.com/yt-dlp/yt-dlp/releases/tag/2025.03.31
Signed-off-by: George Sapkin <[email protected]>

yt-dlp: assign PKG_CPE_ID

Link: https://nvd.nist.gov/products/cpe/detail/2739DE26-F16B-478E-A270-32C659C7F2C6?namingFormat=2.2&orderBy=CPEURI&keyword=yt-dlp&status=FINAL
Link: https://github.com/openwrt/packages/issues/8534
Signed-off-by: George Sapkin <[email protected]>

yt-dlp: add CI version check

Signed-off-by: George Sapkin <[email protected]>

librespeed-go: add missing conffiles

Add missing uci configuration to conffiles.

Signed-off-by: Tianling Shen <[email protected]>

adblock-fast: bugfixes: empty allow-lists, support for swap

* do not produce an error on empty allow-lists, fixes https://github.com/openwrt/packages/issues/26228
* do not produce an error when swap is available, fixes https://github.com/openwrt/packages/issues/26313

Signed-off-by: Stan Grishin <[email protected]>

netbird: update to 0.41.2

changelog: https://github.com/netbirdio/netbird/releases/tag/v0.41.2

Signed-off-by: Wesley Gimenes <[email protected]>

netbird: update to 0.41.1

changelog: https://github.com/netbirdio/netbird/releases/tag/v0.41.1

Signed-off-by: Wesley Gimenes <[email protected]>

cloudflared: Update to 2025.4.0

Signed-off-by: Tianling Shen <[email protected]>

v2ray-geodata: Update to latest version

Signed-off-by: Tianling Shen <[email protected]>

v2ray-core: Update to 5.29.3

Signed-off-by: Tianling Shen <[email protected]>

htop: update to 3.4.1

Changelog: https://github.com/htop-dev/htop/blob/main/ChangeLog#L1-L10

Build system: x86/64
Build-tested: x86/64
Run-tested: x86/64

Signed-off-by: John Audia <[email protected]>

libcbor: disable sanitize by default

musl libc does not support this feature, and for glibc, additional
library libasan is required. Disable it explicitly to avoid build issue
when CONFIG_DEBUG is selected.

Signed-off-by: Tianling Shen <[email protected]>

libarchive: bump to 3.7.9 fixing CVE-2025-25724, CVE-2025-1632, CVE-2024-57970

Libarchive 3.7.9 is a bugfix release, fixing a regression in libarchive
3.7.8 regarding GNU sparse entries was fixed.

Libarchive 3.7.8 is a bugfix and security release:

  Security fixes:

    * tar reader: Handle truncation in the middle of a GNU long linkname (CVE-2024-57970)
    * unzip: fix null pointer dereference (CVE-2025-1632)
    * tar reader: fix unchecked return value in list_item_verbose() (CVE-2025-25724)

  Important bugfixes:

    * 7zip reader: add SPARC and POWERPC filter support for non-LZMA compressors
    * tar reader: Ignore ustar size when pax size is present
    * tar writer: Fix bug when -s/a/b/ used more than once with b flag
    * cpio: Fix a Y2038 bug on Windows
    * libarchive: Handle ARCHIVE_FILTER_LZOP in archive_read_append_filter
    * libarchive: Adding missing seeker function to archive_read_open_FILE()

Full Changelog: https://github.com/libarchive/libarchive/compare/v3.7.7...v3.7.8

Signed-off-by: Petr Štetiar <[email protected]>

https-dns-proxy: update to 2025.03.13 upstream

* fixes https://github.com/openwrt/packages/issues/25522

Signed-off-by: Stan Grishin <[email protected]>

adblock: update 4.4.0-2

* minor ETAG fixes and improvements
* permanently set the addnmount option for dnsmasq
* cosmetics

Signed-off-by: Dirk Brenken <[email protected]>

openssh: add FIDO U2F and FIDO2 hardware token support

Add openssh-sk-helper package containing ssh-sk-helper.

The helper can be used by openssh-client, openssh-sftp-client,
and openssh-keygen to access `ecdsa_sk` and `ed25519_sk keys
provided by a FIDO U2F or FIDO2 hardware token connected over USB.

Close #24509

Signed-off-by: Mikael Magnusson <[email protected]>

Revert "openssh: Add FIDO2 hardware token support"

This reverts commit 855db864b0c4d2dcc5ed2f0182ea4a7942314086.

The reverted commit doesn't make sense since the component
(ssh-sk-helper) that uses libfido2, which is mentioned in
the commit message, isn't packaged.

Signed-off-by: Mikael Magnusson <[email protected]>

docker-compose: Update to version 2.35.0

Release notes:
https://github.com/docker/compose/releases/tag/v2.35.0

Signed-off-by: Javier Marcet <[email protected]>

libarchive: bump to 3.7.7 fixing a lot of security issues

libarchive fixed a lot of security issues in the last few releases, listing only
notable changes,

libarchive 3.7.5:

   * rar4: protect copy_from_lzss_window_to_unp()  CVE-2024-20696
   * rar4: fix CVE-2024-26256

libarchive 3.7.6:

   * this release fixes a tar regression introduced in libarchive 3.7.5

libarchive 3.7.7:

   * gzip: prevent a hang when processing a malformed gzip inside a gzip (OSS-Fuzz)
   * tar: don't crash on truncated tar archives (OSS-Fuzz)
   * tar: fix two leaks in tar header parsing

Link: https://github.com/libarchive/libarchive/releases
Signed-off-by: Matthias Franck <[email protected]>

netbird: update to 0.40.1

changelog: https://github.com/netbirdio/netbird/releases/tag/v0.40.1

Signed-off-by: Wesley Gimenes <[email protected]>

tgt: update to 1.0.96

Signed-off-by: Maxim Storchak <[email protected]>

banIP: release 1.5.6-1

* the ETAG function now supports country and asn feeds as well
* fixed becyber URL and other small fixes
* LuCI fixes and improvements (separate commit)

Signed-off-by: Dirk Brenken <[email protected]>

ddns-scripts: correct bump release

Signed-off-by: Paul Donald <[email protected]>

adblock: release 4.4.0-1

* added a 'DNS Shift' option, where the generated final DNS blocklist is moved to the backup directory and
   only a soft link to this file is set in memory. As long as your backup directory is located on an external drive,
   you should activate this option to save disk space
* added ETAG-Header support to make sure to download only feeds that has been changed,
   use backups otherwise (not supported by uclient-fetch)
* removed aria2 support
* added brave as a new safesearch provider
* removed the racist terminology from the local lists and renamed it to "allowlist" and "blocklist"
* removed the 'list' and 'timer' function from init, use the LuCI feed editor and the standard cron frontend instead
* various  code changes and improvements
* major LuCI frontend changes, incl. a custom feed editor (separate commit)
* partial readme update

Signed-off-by: Dirk Brenken <[email protected]>

knot: update to version 3.4.6

Signed-off-by: Jan Hák <[email protected]>

knot: fix patch for configuration sample

Fixes #26149

Signed-off-by: Jan Hák <[email protected]>

ddns-scripts: bump PKG_RELEASE

Signed-off-by: Paul Donald <[email protected]>

ddns-scripts: refactor get_uptime() and avoid cat in sub-shell

no sub-shell is spawned to get uptime.

Signed-off-by: Paul Donald <[email protected]>

ddns-scripts: refactor load_all_config_options()

Same functionality - code reads less 'shouty' and 'stabby'.

Signed-off-by: Paul Donald <[email protected]>

ddns-scripts: add stop action for individual sections

it is now possible to stop an individual instance, and not all of them.

Signed-off-by: Paul Donald <[email protected]>

ddns-scripts: refactor start_daemon_for_all_ddns_sections()

Removed redundant if else condition. updater is launched
with the same verbosity value anyway.

Signed-off-by: Paul Donald <[email protected]>

ddns-scripts: refactor stop_daemon_for_all_ddns_sections()

Same functionality - code reads less 'shouty' and 'stabby'.

Signed-off-by: Paul Donald <[email protected]>

ddns-scripts: refactor stop_section_processes()

Now a single xargs calls instead of grepping ps output (unreliable).

Signed-off-by: Paul Donald <[email protected]>

ddns-scripts: refactor update_url checks to avoid echo|grep sub-shells

Signed-off-by: Paul Donald <[email protected]>

ddns-scripts: variable quoting

in case spaces should creep into path names

Signed-off-by: Paul Donald <[email protected]>

modemmanager: add missing any option to allowedmode

The 'mmcli' also understands the option 'any'.

Signed-off-by: Florian Eckert <[email protected]>

php8: update to 8.4.5

This is a major upgrade to latest stable PHP version.

- IMAP extension was unbundled from PHP
- align patch filenames with latest ones from Debian
- removed obsolete patches
- adapted/refreshed patches
- added patch to remove call to httpd during configure
  Note: this assumes that 'prefork' mpm is used

Upstream changelog for this specific release:
https://www.php.net/ChangeLog-8.php#8.4.5

Signed-off-by: Michael Heimpold <[email protected]>

php8-pecl-imagick: update to 3.8.0RC2

For the moment, we have to finetune the package
versioning to make apk happy.

This update provides compatibility with PHP 8.4.x.

Signed-off-by: Michael Heimpold <[email protected]>

php8-pecl-mcrypt: drop package - unmaintained upstream

This PECL package seems to be not actively maintained
anymore by upstream and it does not work with PHP 8.4.x
so let's drop it.

Signed-off-by: Michael Heimpold <[email protected]>

utils: add new package enterprise-numbers

Signed-off-by: Oliver Sedlbauer <[email protected]>

ipmitool: disable download of PEN list in Makefile

This commit allows building the package without downloading enterprise
numbers from the IANA PEN registry. This enables offline builds and
reduces storage usage, especially on devices with limited space.

Signed-off-by: Oliver Sedlbauer <[email protected]>

ipmitool: add option to disable registry download

Upstream backport

Signed-off-by: Oliver Sedlbauer <[email protected]>

ipmitool: do not require IANA PEN registry

Upstream backport

Signed-off-by: Oliver Sedlbauer <[email protected]>

lua-eco: update to 3.8.0

Signed-off-by: Jianhui Zhao <[email protected]>

netbird: update to 0.40.0

changelog: https://github.com/netbirdio/netbird/releases/tag/v0.40.0

Signed-off-by: Wesley Gimenes <[email protected]>

v2raya: Update to 2.2.6.7

Signed-off-by: Tianling Shen <[email protected]>

alist: Update to 3.44.0

Signed-off-by: Tianling Shen <[email protected]>

inih: Update to r59

Signed-off-by: Tianling Shen <[email protected]>

strongswan: DHCP on lo fixes backport

Fixes #25801. Adds the following commits to fix DHCP behaviour on
Strongswan 5.9.14:

 - https://github.com/strongswan/strongswan/commit/abbf9d28b0032cf80b79bcacea3146a60800a6dd
 - https://github.com/strongswan/strongswan/commit/00d8c36d6fdf9e8ee99b9f92a64e7e81dbfa4432
 - https://github.com/strongswan/strongswan/commit/a50ed3006e8152eb2cf20e9f92f088ecc18081b0

Signed-off-by: Joel Low <[email protected]>

expat: bump to 2.7.1 to fix several CVEs

Addresses CVE-2024-8176 and CVE-2024-50602.

Full changelog linked below.

Changelog: https://github.com/libexpat/libexpat/blob/R_2_7_1/expat/Changes
Fixes: https://github.com/openwrt/packages/issues/26255
Fixes: https://github.com/advisories/GHSA-9hcv-xw76-m4h6
Fixes: https://github.com/advisories/GHSA-79wf-qgrg-2p6c
Signed-off-by: George Sapkin <[email protected]>

nano: Update to 8.4

Update nano edit to version 8.4.

Add configure flags to overcome upstream bug 66978, where the newly added
gnulib module for strcasecmp always fails in the configure step when
cross-compiling.
https://savannah.gnu.org/bugs/?66978
https://github.com/coreutils/gnulib/commit/b2927d1b1fa3fb09a2210a3df5691f7d48d6151b

The added flags disable the strcasecmp function from gnulib.
If upstream (gnulib?) fixes things later, the flags should be removed.

Signed-off-by: Hannu Nyman <[email protected]>

zerotier: add patch to support miniupnpc 2.2.8

Signed-off-by: Moritz Warning <[email protected]>

znc: update to use SOURCE_VERSION for submodule download

Commit 9fc79e2e2622 ("download: don't overwrite VERSION variable")
changed the variable for direct download call from VERSION to
SOURCE_VERSION.

This cause the dl_github_archive script to pass empty value for
--version arg making it always clone HEAD.

Correctly update the variable to SOURCE_VERSION to actually clone the
expected commit HASH.

Signed-off-by: Christian Marangi <[email protected]>

crun: update to use SOURCE_VERSION for submodule download

Commit 9fc79e2e2622 ("download: don't overwrite VERSION variable")
changed the variable for direct download call from VERSION to
SOURCE_VERSION.

This cause the dl_github_archive script to pass empty value for
--version arg making it always clone HEAD.

Correctly update the variable to SOURCE_VERSION to actually clone the
expected commit HASH.

Signed-off-by: Christian Marangi <[email protected]>

nvme-cli: update to 1.12

Bump to latest upstream release.

Removed upstreamed: 021-pligins-netapp-add-include-of-libgen.h-for-basename.patch
Manually rebased: 010-gcc14.patch

Build system: x86/64
Build-tested: x86/64
Run-tested: x86/64

Signed-off-by: John Audia <[email protected]>

libnvme: update to 1.12

New version requires liburing as a new dependency. To avoid a build error
where mock.c is using glibc's function sig, disabled build tests since
builds are done with musl libc.

Signed-off-by: John Audia <[email protected]>

gping: drop package

Reasons to drop:
- an unresolved issue which prevents updating gping to latest version.
  gping now relies on support for fractional timespan of 'sleep', which
  isn't enabled in main OpenWrt repository
- there are probably only few users of this package, if any, and I'm not
  a user anymore either
- there are other equal or better tools for the same purpose

Signed-off-by: Jonas Jelonek <[email protected]>

adguardhome: increase UDP send/receive buffers

Link: https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes
Signed-off-by: George Sapkin <[email protected]>

golang: bump to 1.24.2

go1.24.2 (released 2025-04-01) includes security fixes to the net/http
package, as well as bug fixes to the compiler, the runtime, the go
command, and the crypto/tls, go/types, net/http, and testing packages.

Link: https://github.com/golang/go/issues?q=milestone%3AGo1.24.2+label%3ACherryPickApproved
Signed-off-by: George Sapkin <[email protected]>

openvpn: update to 2.6.14

Security fixes:

​CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
 Security scope: OpenVPN servers between 2.6.1 and 2.6.13 using --tls-crypt-v2 can be made
 to abort with an ASSERT() message by sending a particular combination of authenticated and
 malformed packets. No crypto integrity is violated, no data is leaked, and no remote code
 execution is possible. This bug does not affect OpenVPN clients.

For details refer to https://github.com/OpenVPN/openvpn/blob/v2.6.14/Changes.rst

Signed-off-by: Ivan Pavlov <[email protected]>

lighttpd: update to lighttpd 1.4.79 release hash

Signed-off-by: Glenn Strauss <[email protected]>

lpac: Refresh 0001-driver-add-uqmi-backend.patch

Signed-off-by: Ryan Press <[email protected]>

lpac: Add support for MBIM backend

Signed-off-by: Ryan Press <[email protected]>

patch: update to v2.8

Delete patches already upstream.

Signed-off-by: Russell Senior <[email protected]>