ubus: update to Git HEAD (2026-09-25)

cd51fc0031ff libubus: refuse to send a message the peer must reject
9ba1ab795b2f libubus: drop the connection when a message cannot be read
ce54d7a956a5 ubusd_main: free partially received message on client disconnect
6b5c6f166db4 ubusd_main: free queued lookup commands on client disconnect
b012bc067515 ubusd_acl: use SO_PEERGROUPS instead of parsing /proc for peer gids
955ff3f7030c ubusd: fix use-after-free when resuming a queued object lookup
fb1dd8e0d7c8 ubusd: document the bound on the pending-message body read
3a39a800f162 libubus-req: fix double close of the fd in ubus_complete_deferred_request
4d60031579d2 libubus: fix msgbuf leak on ubus_channel_connect error path
91b0dadfd1ed libubus-req: fix error check on the __ubus_notify_async result
82416940eae8 libubus-io: do not resend the fd on partial writes in writev_retry
618f3cf75ae3 libubus-obj: fix fd leaks on object message error paths
2f52ae367c93 ubusd_main: flush the tx queue after freeing the client's objects
cdb648c3283a ubusd_obj: propagate subscription allocation failure to the client
7c5c06825daf ubusd_proto: fix double close of forwarded invoke fd
d8fec00656a6 ubusd: keep the fd alive while a message waits in the tx queue
bde609c2400e ubusd_acl: copy the filename used as the ACL file vlist key
008655958eb4 ubusd_acl: do not treat unresolvable ACL user/group names as id 0
5331c00f37f7 ubusd_event: document reserved event namespace forgery check
ef37ed207183 ubusd_event: use an unsigned type for the event dedup sequence
e12ad4bd667f ubusd: flag event messages as not expecting a reply
9d709c536cd6 ubusd_event: report allocation failure as out of memory
5170a5818b54 ubusd: use canonical SCM_RIGHTS extraction on the receive path
8dfee69c250c ubusd_main: do not abort startup when the default socket dir fails
17f78610d771 ubusd: disconnect the client when a partially sent message is dropped
f5e5836704c8 cli: parse monitored payloads with the untrusted blob parser
11e411e36f08 libubus: close the passed fd when the request exceeds the size limit
cbc27b66d813 ubusd: stop writing to a client already flagged for disconnect
2ec13d49ba37 libubus: do not restart the ACL query while one is in flight
297baef62eee libubus: free queued pending messages on shutdown
17525550a36b ubus/lua: fix Lua stack imbalance on policy allocation failure
fdd9ff1fe0fc ubus/lua: copy the Lua strings stored in registered objects
eb5a8284d176 ubusd: close the forwarded fd when the invoke reply cannot be built
3930745d8593 tests/fuzz: fix out-of-bounds read in header validation harness
b27014cf7978 tests/fuzz: use size of blob_attr, not of a pointer, in length guard
414c60a2e29e ubus/lua: store event handler ref without polluting the callback table

Signed-off-by: Felix Fietkau <nbd@nbd.name>

package/system/ubus/Makefile

@@ -5,9 +5,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/ubus.git
-PKG_SOURCE_DATE:=2026-06-28
-PKG_SOURCE_VERSION:=24864e7840b3a02a9ef76284a373f6b2f00b8a9b
-PKG_MIRROR_HASH:=33072c12e6d9a1fd59e3774f029575df61393b5a465486726609ff59314b8a84
+PKG_SOURCE_DATE:=2026-09-25
+PKG_SOURCE_VERSION:=414c60a2e29e72c2c4f573bc50ad54aef076d169
+PKG_MIRROR_HASH:=45685cbfd496bb5c72e05244ec7de470d5dfcf0a244aa7052ef2a6c627f309c3
 PKG_ABI_VERSION:=$(call abi_version_str,$(PKG_SOURCE_DATE))
 CMAKE_INSTALL:=1