btop: Update to 1.4.3

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 5082f947910d28c2e306b5330a7d4c4fc86a391d)

yq: Update to 4.45.1

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 35eb372aa5fa1968c4458e727ebbf5d7795e455e)

yq: Update to 4.44.6

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 649ff95b1ede862be4ce19d34916ce2b66a162e4)

yq: Update to 4.44.5

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 6945c7bb65d8f9e9eb42f53c3cd390c6cffc0aa5)

dnsdist: update to 1.9.9

fixes CVE-2025-30194

Signed-off-by: Peter van Dijk <[email protected]>

perl-ack: Update to 3.8.2

ack would always set a return code of 1 if -c was used. Now it properly
returns 1 if no files match, and 0 if any files match.

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit b6b9cd38fa4b28a3d0ddf5f2ca72c77deb712c98)

ack: Update to 3.8.0

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 0c0d897b47ef98781277305d09eadf79b6bb6fe0)

btop: Update to 1.4.2

Update alias command.

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 8df8700a135751d4b9365cd70e645b18b47b45a7)

btop: Update to 1.4.1

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 0e5cc7de578e72d45bd62237519b334cec26ba03)

v2raya: Update to 2.2.6.7

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit aad793b6f46e5d4d6ec2177fec7f38b1e575fe99)

librespeed-go: add missing conffiles

Add missing uci configuration to conffiles.

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit df9ba185789ada48f536c3c62a816fd0bbb58505)

v2ray-geodata: Update to latest version

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 1d73b25ed8b14ebf63a44542bb562449922a0dcb)

expat: update to 2.6.3

- This release contains fixes for CVE-2024-45490,
CVE-2024-45491, CVE-2024-45492.
- Since official place for expat development moved from SourceForge
to GitHub, SourceForge was removed from PKG_SOURCE_URL.
- Use gzip archive to avoid xz usage.
- Remove DOCBOOK_TO_MAN=OFF from CMAKE_OPTIONS because
we already have EXPAT_BUILD_DOCS=OFF, which has same effect.

Signed-off-by: Yanase Yuki <[email protected]>
(cherry picked from commit b0b5b8bf67c577d13b365d61825b856885f8185c)

expat: update to 2.6.2

Signed-off-by: krant <[email protected]>
(cherry picked from commit 8db49729c373fde0298ffa5708c8bbcebacf4513)

expat: update to 2.6.0

- Don't set default CMake options

Signed-off-by: krant <[email protected]>
(cherry picked from commit c40da57d7b99b9e7daf89db63e996e3fdd8ad25b)

lighttpd: backport revert changed TLS defaults

Signed-off-by: Glenn Strauss <[email protected]>

lighttpd: update to lighttpd 1.4.79 release hash

Signed-off-by: Glenn Strauss <[email protected]>
(cherry picked from commit e800fc7e8cadcd28b92429eb6ff9e677f4c50d46)

nano: Update to 8.4

Update nano edit to version 8.4.

Add configure flags to overcome upstream bug 66978, where the newly added
gnulib module for strcasecmp always fails in the configure step when
cross-compiling.
https://savannah.gnu.org/bugs/?66978
https://github.com/coreutils/gnulib/commit/b2927d1b1fa3fb09a2210a3df5691f7d48d6151b

The added flags disable the strcasecmp function from gnulib.
If upstream (gnulib?) fixes things later, the flags should be removed.

Signed-off-by: Hannu Nyman <[email protected]>
(cherry picked from commit 3d055f8dfb13ded552fa62e1aa2b008512d70a32)

libxslt: fix build breakage after libxml2 CVE fix updates

libxml2 was updated in OpenWrt Git tree with commit dec59db8fb1f
("libxml2: update to 2.13.6"), which fixed several CVEs.

Unfortunately this version bump included removal of some features, which
leads to build issues of libxslt:

  libxslt-1.1.37/xsltproc/xsltproc.c:733:39: error: assignment of read-only variable 'xmlParserMaxDepth'
   733 |                     xmlParserMaxDepth = value;

So lets fix it by backporting an upstream "fix", which removes that
deprecated functionality.

Fixes: dec59db8fb1f ("libxml2: update to 2.13.6")
References: https://github.com/openwrt/openwrt/pull/18280
Signed-off-by: Petr Štetiar <[email protected]>

zoneinfo: Updated to 2025b release.

Signed-off-by: Vladimir Ulrich <[email protected]>
(cherry picked from commit df9015f9daa8adc34be9a1866f15e9d417524cf5)

zoneinfo: Updated to 2025a release.

Signed-off-by: Vladimir Ulrich <[email protected]>
(cherry picked from commit 59db1470314a4a3f5c78ad805fa8381de0231936)

zoneinfo: Updated to 2024b release.

Signed-off-by: Vladimir Ulrich <[email protected]>
(cherry picked from commit 54162a8254bd4828ddf134abc11be724102b1e40)

zoneinfo: Updated to 2024a release

Signed-off-by: Vladimir Ulrich <[email protected]>
(cherry picked from commit 5a06f6339076aecb9a9cdce6867e4b7307f929c5)

zoneinfo: Updated to the latest (2023d) release.

Signed-off-by: Vladimir Ulrich <[email protected]>
(cherry picked from commit 69953f9fd39bdeef779ad5a5f9f8d982d4f47e64)

netavark: lock cargo dependencies

rust-iptables 0.5.3+ requires rust 1.85.0 to build, use the version
defined in Cargo.toml instead.

Signed-off-by: Tianling Shen <[email protected]>

pptpd: Fix secrets update

Clear pptp-server existing logins from CHAP_SECRETS file before adding new login data.

Signed-off-by: Thiago Pereira Ricciardi <[email protected]>

rust: disable download ci llvm

Upstream removed CI builds for this (outdated) version.

Signed-off-by: Tianling Shen <[email protected]>

rsync: backport bug fixes

Including CVE fixes for:
CVE-2024-12084
CVE-2024-12085
CVE-2024-12086
CVE-2024-12087
CVE-2024-12088
CVE-2024-12747

The patch list is based on rsync_3.2.7-1+deb12u2 from Debian.

Signed-off-by: Tianling Shen <[email protected]>

natmap: update to 20250221

Signed-off-by: Ray Wang <[email protected]>
(cherry picked from commit 2db5fca2d8b3310de2812972af13f91e55a52217)

v2raya: Update to 2.2.6.6

Remove unneeded reload_service func while at it.

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 39c5d7f8514cfcf8694f6ef22523454403d8a425)

v2raya: Update to 2.2.6.3

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit a5a9140870331503f51acebc7f5deb9417fef05c)

v2raya: Update to 2.2.6.2

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit a08614a0475f964b674f136e642fa800dd00488e)

v2raya: Update to 2.2.6

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit fd5546fc1f4686bb2b595b14b4c3c91a939b2dc3)

rclone: Update to 1.69.1

Remove unneeded reload_service func while at it.

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 944d48241c1408a5b75efa2d6d5e77f0ee500d80)

nextdns: Update to version 1.45.0

Signed-off-by: Olivier Poitrey <[email protected]>

nextdns: Update to version 1.44.6

Signed-off-by: Olivier Poitrey <[email protected]>

sing-box: Update to 1.11.1

Signed-off-by: Milinda Brantini <[email protected]>
(cherry picked from commit 8eecd2e5a08e40fcc28486c2d6125ddec99226c4)

sing-box: Update to 1.11.0

Signed-off-by: Milinda Brantini <[email protected]>
(cherry picked from commit 2c7b8ef5a2deb42089674dba2177e4bc8ccb88d6)

Revert "xray-core: Update to 25.1.30"

xray-core v24.12.31 is the last version that supports Go 1.21.

This reverts commit 0eb71539900d1e9fe0ff9e3ae6b258e4ba1099e0.

Signed-off-by: Tianling Shen <[email protected]>

rclone: Update to 1.69.0

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 35b614c43758cfcac53f54a392e841aff30c4f1b)

rclone: fix configuration saving

The following error occurs when creating storage configuration in WEBUI:
```
Failed to save config after 10 tries: failed to create temp file for new config: open /etc/rclone/rclone.conf4258227003: permission denied
```

we should set the owner of the parent directory of the configuration
file to rclone.

Signed-off-by: Liangbin Lian <[email protected]>
[split chown command, wrap commit message]
Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit bcd87dd8b607a1888fe5ceb521a619d068a28bbe)

rclone: Bump to 1.68.2

Release notes in links below.

Link: https://rclone.org/changelog/#v1-68-2-2024-11-15
Signed-off-by: Ryan Keane <[email protected]>
(cherry picked from commit c342279eb6386f707e6982fec95a31c51e74cb98)

v2ray-geodata: Update to latest version

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit cec4103bbcdddd63930613b4d8c81973caa712fe)

v2ray-geodata: Update to latest version

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit d750bb3182729619144735d0aacab258769377d6)

xray-core: Update to 25.1.30

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit e9a86e1809dc4b76ab2eb3980fc179567cfc2ccf)

xray-core: Update to 24.12.31

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 1166a2531161851d3f3d9ec6f990dab255025364)

frr: 10.2.1 fixes

add mgmtd and pim6d

Signed-off-by: Lucian CRISTIAN <[email protected]>

bind: bump to 9.18.33

Fixes CVEs:
- CVE-2024-12705: DNS-over-HTTPS flooding
- CVE-2024-11187: Limit additional section processing for large RDATA sets

Signed-off-by: Noah Meyerhans <[email protected]>

fastd: update to v23

Signed-off-by: Matthias Schiffer <[email protected]>
(cherry picked from commit 24348066216aa27e49e18e6f78c719509fc8f450)

coova-chilli: Fix WolfSSL support

Signed-off-by: Federico Capoano <[email protected]>
(cherry picked from commit bf3333594a8add333e3d7192107aa7be8bc39a33)

# Conflicts:
# net/coova-chilli/Makefile

frr: update to 10.2.1

Signed-off-by: Lucian CRISTIAN <[email protected]>

libyang: update to 2.1.128

needed for frr update to 10+

Signed-off-by: Lucian CRISTIAN <[email protected]>

hev-socks5-server: update to 2.7.0

Signed-off-by: Ray Wang <[email protected]>
(cherry picked from commit d0d67ded93936657b232dae93eaf25924a7431fd)

hev-socks5-server: update to 2.6.9

Signed-off-by: Ray Wang <[email protected]>
(cherry picked from commit 30db86cc9c0e5e0a9ec7b651f22515bf2c5e765d)

uspot: update to Git HEAD (2025-01-20)

57b737a49497 uspot/uspotfilter: s/discon_since/lost_since/
1c2f58000519 uspot/uspotfilter: use native MAC case
70934203a0b7 captive: cleanup
7566c2716eb9 uspot: correctly handle "debug=0"
f5cc70459233 portal: remove unused bits
54cdcf463c36 uspot: remove unused ssid parameter
f13440bd80ff Update issue templates
644fd6f52a8e uspotfilter: apply disconnect delay to active clients only

(cherry picked from commit 2466aaccc1b358c6fbcc17aeb6628d974870911b)
Signed-off-by: Thibaut VARÈNE <[email protected]>

node: January 21, 2025 Security Releases

Notable Changes

    CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
    CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)

Dependency update:

    CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)

Signed-off-by: Hirokazu MORIKAWA <[email protected]>

net/acme-common: Bump package release

Commit 66894032d482 ("acme: standardize key_type") failed to bump the
package release, so the update won't be automatically installed. Bump
PKG_RELEASE to make sure users get the updated version.

Opt for adding a PKG_RELEASE instead of bumping the version to avoid
having different packages (from different branches) with the same
PKG_VERSION.

Signed-off-by: Toke Høiland-Jørgensen <[email protected]>

nextdns: Update to version 1.44.4

Signed-off-by: Olivier Poitrey <[email protected]>

sing-box: Update to 1.10.7

Signed-off-by: Milinda Brantini <[email protected]>
(cherry picked from commit 996c1819e3c68e27783bc7ac081cfcd3dc75ea3b)

adblock: update 4.2.3-3

Summary of three PRs regarding new adblock sources with minor changes/additions:

- add new source reg_lithuania, PR provided by @Myginas
- add new source certpl, PR provided by @jkostorz
- add new source oisd_nsfw_small, PR provided by @Turjoy9

Signed-off-by: Dirk Brenken <[email protected]>
(cherry picked from commit cd89956c13bf7def493effaf8de1b568a379ebf9)

bind: bump to 9.18.32

Signed-off-by: Noah Meyerhans <[email protected]>

natmap: update to 20250101

Signed-off-by: Ray Wang <[email protected]>
(cherry picked from commit 806b524a287a03391a79a08d62a5e07c4d12350b)

adblock-fast: Makefile bugfixes and hijack rework

* remove indentation in postinst/prerm/postrm scripts to fix issues with APK
* rework hijack logic to redirect port 53 to the port of active/selected dnsmasq instances

Signed-off-by: Stan Grishin <[email protected]>

nextdns: Update to version 1.44.3

Signed-off-by: Olivier Poitrey <[email protected]>

delve: update to 1.24.0

Signed-off-by: Aleksey Kolosov <[email protected]>
(cherry picked from commit db853b5d58765d2bfa26439340b1d4a4e1fa5698)

xray-core: Update to 24.12.18

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit bd0fb6d3edbe183132efa9349f9ec5b5ad78b16b)

xray-core: Update to 24.11.30

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 9e7026dedb8905cd37f89f293b594d62094e43ac)

v2ray-geodata: Update to latest version

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 0c97b1a427a98a21fa7d2305c9341f0f2af19239)

nano: Update to 8.3

Update nano editor to version 8.3.

Signed-off-by: Hannu Nyman <[email protected]>
(cherry picked from commit b6176b6687cbddc380b8b3e6ccf2d50112a6d2db)

nextdns: Update to version 1.44.0

Signed-off-by: Olivier Poitrey <[email protected]>

lrzsz: fix random build failures by really disabling autofoo

Currently we're seeing random build failures, caused by autofoo being
called on very ancient bundled autofoo:

  cd . && aclocal
  aclocal.real: warning: autoconf input should be named 'configure.ac', not 'configure.in'
  acinclude.m4:2: warning: underquoted definition of AC_REPLACE_GNU_GETOPT
  acinclude.m4:2:   run info Automake 'Extending aclocal'
  acinclude.m4:2:   or see https://www.gnu.org/software/automake/manual/automake.html#Extending-aclocal
  configure.in:106: error: automatic de-ANSI-fication support has been removed

For some reason that `touch` based neutralization introduced in commit
6d6c4b21b5e2 ("lrzsz: update to v0.12.21rc and fix a CVE") doesn't
always work.

So lets fix it by removing the autofoo bits from the bundled Makefile.in
and while at it remove processing of man and testsuite subdirs to save
some computing cycles.

Fixes: #25543
Fixes: 6d6c4b21b5e2 ("lrzsz: update to v0.12.21rc and fix a CVE")
Signed-off-by: Petr Štetiar <[email protected]>
(cherry picked from commit 3e612586041d40ebfafadb65eaa6fc34b2061ee8)

travelmate: update to 2.1.3-3

* properly escape double quotes in travelmate option values
* minor procd tweaks

Signed-off-by: Dirk Brenken <[email protected]>
(cherry picked from commit 128875aa67c378dd065582220980df9cfd4576a7)

netatalk: Update to 4.0.7

Maintainer: Antonio Pastor / @APCCV
Compile tested: ipq806x (24.10-rc2, snapshot)
Run tested: ipq806x - C2600 (snapshot): install apk, start/stop sfpd service & review logs

Description:
Bump to version 4.0.7

Signed-off-by: Antonio Pastor <[email protected]>

netatalk: Remove apfstats feature to solve dependency issues

afpstats requires several libraries that would increase significantly final install size.

Signed-off-by: Antonio Pastor <[email protected]>

netatalk: Enable AppleTalk feature

Starting v4.0.0, netatalk brings back AppleTalk features lost in v3.
Updated description.

Signed-off-by: Antonio Pastor <[email protected]>

netatalk: Clean up Makefile

Updated title.
Updated description.
Reordered to match most common layout

Signed-off-by: Antonio Pastor <[email protected]>

netatalk: Update to 4.0.4

Maintainer: Antonio Pastor / @APCCV
Compile tested: ipq806x (23.05.3, snapshot)
Run tested: ipq806x - C2600: start server, connect from MacOS, read/write files to home share, create/update TimeMachine backups

Description:
No changes to package other than using latest available upstream code base. Starting Netatalk 4.x build uses meson instead of autotools.

Signed-off-by: Antonio Pastor <[email protected]>

netatalk: Update to 3.2.5
Compile tested/run: ipq806x

No changes to package other than using latest available codebase.

Signed-off-by: Antonio Pastor <[email protected]>

netatalk: update to 3.2.0.

Commit restores package after it was removed from OpenWrt 21.02.
Signed-off-by: Antonio Pastor <[email protected]>

yajl: backport CVE-2023-33460 fix

Removed old uclibc patches. Not relevant with modern musl or glibc.

Signed-off-by: Rosen Penev <[email protected]>
(cherry picked from commit c9ff829fdb046a774c25cf3ce3382979b795edfd)

v2ray-geodata: Update to latest version

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit d76d51a4b826588e09404515fbaf19f3f4442a62)

v2ray-geodata: Update to latest version

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 5fb541f00f0ef9dd10793c40d0418809647105ba)

xray-core: Update to 24.11.21

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 3d05b2c1a9f3f631670e292f494c3525eba0c61a)

xray-core: Update to 24.11.11

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 41457908b83d32c4b1037ab99a82f59456fc0e22)

microsocks: backport upstream fixes

Fix segmentation fault with newer musl and improve throughput.

Signed-off-by: Tianling Shen <[email protected]>
(cherry picked from commit 77a7324de54e175029fa7ad051a3a17d1806e03e)

microsocks: update to 1.0.4

Signed-off-by: Ozan Göktan <[email protected]>
(cherry picked from commit 544e4a90619bc6bf39a6845d8e5b7b3c0b2e160a)

ksmbd-tools: update to version 3.5.3

- manually refresh patch 030-glib.patch

Major changes are:
    fix adduser / addshare prompting on musl libc
    fix use of veto files as global share parameter
    lookup primary group and don't recurse in ksmbd.conf @group handling
    fix a leak and an intermittent auth failure in Kerberos 5
    add global parameter kerberos support

detailed changelog here: https://github.com/cifsd-team/ksmbd-tools/releases/tag/3.5.3

Signed-off-by: Andrea Pesaresi <[email protected]>
(cherry picked from commit 5b058c9949b3e3adcbc35347aa1acc40c3442e2c)

ksmbd-tools: update to version 3.5.2

Major changes are:
 - Add durable handles parameter to ksmbd.conf.
 - Add payload_sz in ksmbd_share_config_response to validate ipc
   response.
 - Fix UAF and cleanups.

Signed-off-by: Andrea Pesaresi <[email protected]>
(cherry picked from commit 9cf0eae9bca7447354bcb96759f213ae407c9532)

libdeflate: update to 1.22

Release note:
https://github.com/ebiggers/libdeflate/blob/master/NEWS.md#version-122

Signed-off-by: Gábor Deé <[email protected]>

zerotier: update to 1.14.1

Signed-off-by: Moritz Warning <[email protected]>
(cherry picked from commit 660b10f0dc9ca81ec2f7b9f7d30ba1a745925d77)

zerotier: split configuration

Split configuration in global and per-network sections.
This change breaks existing configurations.

The following per-network settings are available:

* allow_managed
* allow_global
* allow_default
* allow_dns

See  https://docs.zerotier.com/config/#network-specific-configuration

Signed-off-by: Óscar García Amor <[email protected]>
Reviewed-by: Moritz Warning <[email protected]>
(cherry picked from commit 5af81638787a1dd1f057bc238bc243225110607f)

zerotier: update to 1.14.0

Includes refreshed patches.

Signed-off-by: Moritz Warning <[email protected]>
(cherry picked from commit cf6fef36b44de2c9d1b7910f6afd43e0c6ee946c)

adblock-fast: bugfix: dnsmasq instances confdir hack

* temporary hack until https://github.com/openwrt/openwrt/pull/16806 is merged

Signed-off-by: Stan Grishin <[email protected]>

iperf3: fix crashing with musl

Upstream backport.

Signed-off-by: Rosen Penev <[email protected]>
(cherry picked from commit 9c9f4dd08875c77e145e834b939d0c40c043db60)

iperf3: explicitly disable SCTP

Since https://github.com/openwrt/openwrt/commit/3fa5ee0b28b736c5d06af34ed5c3e80f78235fe8
OpenWrt no longer disables SCTP support by default.
It caused the leak of libsctp dependency to iperf3.
Here we disable it explicitly to fix the build.

Signed-off-by: Aleksey Vasilenko <[email protected]>
(cherry picked from commit 6c1ce8ccc78f1b34ade513aa134962eb143826f9)

ruby: update to 3.2.6

Ruby 3.2.6 is a minor bug fix release.

Link: https://github.com/ruby/ruby/releases/tag/v3_2_6
Signed-off-by: Luiz Angelo Daros de Luca <[email protected]>

php8: update to 8.2.26

This fixes:
    - CVE-2024-8929
    - CVE-2024-8932
    - CVE-2024-11233
    - CVE-2024-11234
    - CVE-2024-11236

Upstream changelog:
https://www.php.net/ChangeLog-8.php#8.2.26

Signed-off-by: Michael Heimpold <[email protected]>

yggdrasil: bump to 0.5.10

Signed-off-by: George Iv <[email protected]>
(cherry picked from commit 4ee4b22e431ca3c27c1ab26dc0daba5ca6198443)

adblock: update 4.2.3-2

* correctly parse json objects with hyphens in the autodetection functions

Signed-off-by: Dirk Brenken <[email protected]>
(cherry picked from commit 823633c0e60ad9efb3afe9c4e63b34c93fa55f7c)

adblock: release 4.2.3-1

* optimized procd settings for better performance
* reworked autodetection functions (still broken in master due to apk migration)
* made the tld function optional, set 'adb_tld' accordingly (enabled by default)
* reworked count function
* various code improvements

Signed-off-by: Dirk Brenken <[email protected]>
(cherry picked from commit 8afc26fafbd913d829734ab22fc09abaf8874ae8)