From upstream: This release consolidates security fixes for issues reported over
a period of time. There are fixes for CVE-2026-77860, CVE-2026-77955,
CVE-2026-78227, CVE-2026-80225, CVE-2026-81634, CVE-2026-81642,
CVE-2026-82717, CVE-2026-82720, and CVE-2026-85501.
Full details at
https://github.com/NLnetLabs/unbound/releases/tag/release-1.26.1
Signed-off-by: Tyrel M. McQueen <tmcqueen.materials@gmail.com>
(cherry picked from commit 5174da3aa3)
Corrects the transfer accounting, the redirect and TLS handling, the
command line and the reports, sanitizes text a server supplies, and
holds the output to the Go client's with differential tests.
The upstream repository moved to the librespeed organisation, and the
version banner follows it, so the test greps for the new address.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 018c3f3886)
Travis CI was removed years ago, clean up leftovers.
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit 99063ca66e)
Removed upstreamed patches:
- 001-50658-test-Enable-to-switch-between-C-UTF-8-locales-.patch
- 002-51723-migrate-pcre-module-to-pcre2.patch
- 005-51877-do-not-build-pcre-module-if-pcre2-config-is-no.patch
- 006-52383-Avoid-incompatible-pointer-types-in-terminfo-g.patch
Remaining patches automatically rebased and filenames renumbered.
Changelog:
Incompatibilities
- PCRE support is now PCRE2.
Changes
- POSIX real-time signals (SIGRTMIN etc) are now supported by the kill and trap builtins, TRAP* functions, and the signals parameter, where available.
- The kill builtin learnt a new option -q to send the signal via sigqueue(3) along with an arbitrary integer value, where available.
- The kill builtin also learnt a new -L option to print a list of all known signal numbers and their names.
-The new completion helper _as_if can be used to complete one command as if it were another command with particular arguments.
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 438ab953d0)
Currently our zsh package does not source /etc/profile which is the
expected behavior to setup environment configs.
Build system: x86/64
Build-tested: x86/64
Run-tested: x86/64
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 82be093872)
LDLAGS -> LDFLAGS, fixes linker flags not being passed correctly.
Fixes: 94e7fbdda ("tar: import from oldpackages and upgrade to 1.28")
Signed-off-by: Qin Guang <topeqin@gmail.com>
(cherry picked from commit 11412702c9)
Commit 07b6eec21f doesn't work at least
now, because package.mk initializes the variables to the default
values. You have to modify the variable after including package.mk.
Signed-off-by: Kazuhiro Ito <kzhr@d1.dion.ne.jp>
(cherry picked from commit b635f8ab9a)
Changes from 5.3.1 to 5.3.2
---------------------------
1. The pretty printer now produces fewer spurious newlines; at the
outermost level it now adds newlines between block comments and
the block or function that follows them. The extra final newline
is no longer produced.
2. OpenVMS 9.2-2 x86_64 is now supported.
3. On Linux and macos systems, the -no-pie linker flag is no longer required.
PMA now works on macos systems with Apple silicon, and not just
Intel systems.
4. Still more subtle issues related to uninitialized array elements have
been fixed.
5. Associative arrays should now not grow quite as fast as they used to.
6. The code and documentation are now consistent with each other with
respect to path searching and adding .awk to the filename. Both
are always done, even with --posix and --traditional.
7. As usual, there have been several minor code cleanups and bug fixes.
See the ChangeLog for details.
Changes from 5.3.0 to 5.3.1
---------------------------
1. More subtle issues related to uninitialized array elements have
been fixed.
2. A number of bugs in the debugger related to handling of arrays
have been fixed.
3. Some subtle bugs in the API have been fixed.
4. Use of MPFR is now possible again on 32-bit Power PC Mac systems.
5. Race conditions around broken pipes for system() and read and write
pipes should now be closed off.
6. Support for OSF/1 has been removed.
7. The never-documented --nostalgia option has been removed. It was
causing bug reports.
8. The implementation of printf/sprintf has been thoroughly reworked
in order to make the code more maintainable and to fix a goodly
number of corner cases.
9. As usual, there have been several minor code cleanups and bug fixes.
See the ChangeLog for details.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit cd87977984)
The RRL module's kru.inc.c has a `static_assert(ATOMIC_CHAR16_T_LOCK_FREE
== 2, ...)` that breaks the build on any target whose toolchain does
not advertise lock-free 16-bit atomics (e.g. ARMv5 arm926ej-s).
Upstream considers the assertion non-essential and plans to drop it;
they recommended a patch over a Makefile-level RRL disable. Bump
PKG_RELEASE for the patch swap.
Suggested-by: Daniel Salzman <daniel.salzman@nic.cz>
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 106acb9774)
Changed source URL to github (faster/geo-redundancy).
build: x86_64
run tested: x86_64
```
# radiusd -v
radiusd: FreeRADIUS Version 3.2.7, for host x86_64-openwrt-linux-gnu, built on Apr 18 2025 at 00:10:48
FreeRADIUS Version 3.2.7
```
Signed-off-by: Paul Donald <newtwen+github@gmail.com>
(cherry picked from commit 8102674b6d)
Includes several security fixes:
- CVE-2026-19668 Prevent excessive CPU use validating crafted DNSSEC
responses.
- CVE-2026-19033 Require a TSIG on every message of incoming zone
transfers.
- CVE-2026-77119 Prevent a DNSSEC downgrade of secure delegations via
unrelated NSEC3.
- CVE-2026-19941 Prevent forged DNSSEC-validated NXDOMAIN responses.
- CVE-2026-19666 DNS64 with break-dnssec could cause an assertion failure.
- CVE-2026-19667 Reject negative cache records that do not fit in a
dns_rdata_t.
- CVE-2026-19662 Prevent resolver crash with cached DNSSEC proofs.
- CVE-2026-75029 Discard repeated SOA, CNAME, and DNAME records when
parsing DNS messages.
- CVE-2026-77692 Fix an unauthenticated crash on HTTPS using SIG(0)
- CVE-2026-81736 Cached HTTPS/SVCB aliases could exhaust resolver CPU.
- CVE-2026-76163 Prevent TKEY queries from terminating named without global
options.
- CVE-2026-78301 Out-of-zone records in a zone database could be served as
authoritative.
- CVE-2026-80274 Crash on wildcard answers carrying both NSEC and NSEC3
proofs.
- CVE-2026-81563 Following HTTPS/SVCB aliases could leak resolver cache
memory.
Complete upstream changelog is available at
https://ftp.isc.org/isc/bind9/9.20.29/doc/arm/html/changelog.html
Signed-off-by: Noah Meyerhans <frodo@morgul.net>
(cherry picked from commit 7992657437)
Add patch removing internal macro CURL_HAS_DECLSPEC_ATTRIBUTE.
This fix a compilation error for the package.
Also improve the old 7.88 patch with wrong whitespace.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit d0f1c668c2)
ifstat fails to build with GCC 15 due to an incorrect detection of the
signal handler return type.
The configure script shipped with ifstat uses an obsolete K&R-style
declaration:
void (*signal())();
With GCC 15 this causes the signal() return type check to incorrectly
assume 'int' instead of 'void'. As a result, the generated code defines
signal handlers returning int, which conflicts with struct sigaction
expecting a void (*)(int) handler and leads to a build failure:
assignment to 'void (*)(int)' from incompatible pointer type
'int (*)(int)'
Enable autoreconf during the build to regenerate the configure
script, which correctly detects the signal handler type and fixes
the compilation error.
Signed-off-by: Til Kaiser <mail@tk154.de>
(cherry picked from commit 6a51c41680)
Switch source fetch from git clone to the upstream release tarball
published for every tag, as recommended by the feed guidelines.
This replaces PKG_MIRROR_HASH with a plain PKG_HASH of the
codeload tarball.
Co-authored-by: Federico Capoano <f.capoano@openwisp.io>
Signed-off-by: Gagan Deep <pandafy.dev@gmail.com>
(cherry picked from commit bc29809524)
Add support for running multiple service instances.
- switch UCI config from a single named section to "instance" sections
- update the procd init script to start multiple instances
- migrate existing single-instance configurations during package upgrade (uci-defaults script)
- bump PKG_RELEASE
Signed-off-by: Sergei S. <it4notice@proton.me>
(cherry picked from commit d04b36bbba)
/etc/syslog-ng.conf is installed with INSTALL_DATA, so it ends up
world readable at 0644. The file holds the credentials of every
destination that needs them, so install it with INSTALL_CONF and
0600 instead, as the rest of the tree does for configuration under
/etc.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 397c29176b)
The script creates and updates the private Python virtualenv that the
Python module runs from, but the package is built with --disable-python,
so there is nothing for it to do. It cannot even parse its arguments on
a stock image:
/usr/bin/syslog-ng-update-virtualenv: line 30: getopt: not found
Error parsing arguments
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 7105157393)
The handwritten debian/changelog is only used to override the version
reported by support/version, but it is unnecessary and causes a version
mismatch:
- Build/Prepare feeds the raw git hash into debian/changelog, so the
binary reports ddb984f4c17f4a26fd34f3e1b24e3323f9641b75~openwrt1
instead of the package version 2026.08.17~ddb984f4.
- The CI package test then fails because it cannot find the package
version in the output of any installed executable.
- Without .git, debian/changelog or rpm/version, support/version falls
back to the source directory name.
- OpenWrt already names the source directory tvheadend-$(PKG_VERSION),
so the binary correctly reports 2026.08.17~ddb984f4 without any
override.
Alpine uses rpm/version in the same way and does not encode its own
package release into the version either.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit ef7283f311)
tvheadend has no transliteration of its own. It asks iconv for
"<charset>//TRANSLIT//IGNORE", a GNU extension that musl does not
implement. Converting "ŽluťoučkýKůň" to ASCII on mpc85xx/p2020
(Turris 1.x), musl 1.2.6:
charset musl GNU libiconv
ASCII//TRANSLIT//IGNORE EINVAL "Zlutouck'yKun"
ASCII//TRANSLIT EINVAL "Zlutouck'yKun"
ASCII "*lu*ou*k*K**" EILSEQ
050-iconv-test-continue.patch removed the abort() from the startup
self-test that reports this, so the package could be built against
musl's iconv. That silenced the check without fixing anything:
intlconv_utf8() still returns -EIO, so cleanup_filename() in
src/dvr/dvr_rec.c cannot build a recording file name and
pvr_generate_filename() fails. The charset cannot be avoided either,
because intlconv_filesystem_charset() returns "ASCII" unless $LANG
names a UTF-8 locale, which OpenWrt does not set by default.
Depend on libiconv-full instead of $(ICONV_DEPENDS), which pulls it in
only when BUILD_NLS is set, and point the compiler at its staging prefix
when nls.mk has not already done so. The binary then links against
libiconv.so.2, the self-test passes and the patch can be dropped.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit f2c8300e25)
Update to git master ddb984f4, 124 commits on from the previously
packaged 395afb85. Most of that is web UI work and translation updates,
with smaller fixes in the build system, mpegts and dvr code.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 4f1c6984a2)
The upload body goes through an io.TeeReader, so Go frames the request as
chunked. Against a backend that answers before the client has finished
sending, the queued payload was counted anyway and both the reported rate
and bytes_sent came out several times too large.
Backport the two upstream commits that fix it, released in v1.0.14. A
version bump would need its own go.mod downgrade instead: 1.0.14 moved
the go directive to 1.25 and raised five dependencies past Go 1.23.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
This allows to save some bytes, while preserving the scripts's
copyright and license information.
In owut at current ref db17536ec5cbcc6a76a51e65f3d192b6a2184abb
the reduction in the size applied to the source code is (e.g. without
the computed "s/%%VERSION%%/$(PKG_VERSION)-r$(PKG_RELEASE)/"):
from:
74330 /usr/bin/owut
10541 /usr/share/ucode/utils/argparse.uc
to:
58640 /usr/bin/owut
8630 /usr/share/ucode/utils/argparse.uc
Signed-off-by: Samuele Longhi <agave@dracaena.it>
Co-authored-by: Eric Fahlgren <ericfahlgren@gmail.com>
(cherry picked from commit 1c2ce769a8)
Changelog:
Changes from 1.5 to 1.5.1
-------------------------
* Rename public register definitions on x86 and x86_64 to avoid clashing
with glibc definitions when built in freestanding mode.
Patch contributed by Daan De Meyer.
Changes from 1.4 to 1.5
-----------------------
* Workaround various header compatibility issues in glibc and bionic.
* Allow ppc64 target to be built in freestanding mode.
Changes from 1.3.3 to 1.4
-------------------------
* Add hard-float support to most architectures where relevant.
Some patches contributed by Richard Campbell.
Changes from 1.3.2 to 1.3.3
---------------------------
* Use `bl` instruction instead of explicit GOT lookup for `exit`
in 64-bit PowerPC assembly.
* Fix installation path for standalone libucontext headers.
Patch contributed by Marian Buschsieweke.
* Fix missing includes for freestanding builds.
Patch contributed by David Leeds.
Makefile:
Disabled documents.
Added glibc supports, and remove hardcoded musl dependency.
Put test_libucontext_posix only available in musl runtime.
Build system: x86/64
Build-tested: x86/64-glibc
Build-tested: x86/64-musl
Run-tested: x86/64-glibc
Signed-off-by: Aditya Nugraha <vortexilation@gmail.com>
(cherry picked from commit c3cc59102c)
Skip version checks as none of the executables seem to report their
versions.
Signed-off-by: George Sapkin <george@sapk.in>
(cherry picked from commit f596c12885)
LLVM places the release fence of a cmpxchg between the load-linked and the
store-conditional. On e500v2 that clears the reservation, so the
store-conditional always fails. The strong form retries and re-reserves; the
weak form has no retry and can never succeed.
fetch_update in core is a weak retry loop, so it spins forever and anything
using it hangs. A tokio reactor livelocks on its first I/O event, burning
CPU without issuing a syscall, which makes async Rust unusable on the
subtarget.
Carry the fix as a patch until it reaches a rustc release. It adds a
TargetLowering hook, defaulting to false, so only PowerPC changes.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
RUSTC_TARGET_ARCH comes from the GNU triple, so every 32-bit PowerPC
subtarget gets powerpc-unknown-linux-musl. That triple is hard-float and
mpc85xx is not: its e500v2 has no floating-point unit, and the toolchain
reports _SOFT_FLOAT and calls __divdf3 for a division.
So rustc emits lfd, stfd and fdiv for a core with no floating-point
registers, and passes doubles in a way nothing else in the image does. It
does not fail outright — a speed test reported negative throughput, and
formatting one of those values tripped an assertion inside core.
Pass -Ctarget-feature=-hard-float where CONFIG_SOFT_FLOAT says so. The same
flag has to reach the std that rust/host builds, or std and the packages
linked against it disagree about how a double is passed.
Signed-off-by: Josef Schlehofer <pepe@bloodkings.eu>
(cherry picked from commit 388c3b6ad4)
Also refresh 020-riscv64-support.patch from the current state of
openresty/luajit2#236. The previous snapshot defined
asm_tail_prep(ASMState *as), but since openresty/luajit2 commit
68354f44 the callers pass a second TraceNo argument, so the riscv64
build failed with:
lj_asm.c:2559:5: error: too many arguments to function 'asm_tail_prep'
The refreshed patch carries the upstream adaptation and restores the
build. The other four patches apply unchanged.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 578758e1f6)
luajit2 currently fails to link for powerpc: lj_vm.o emits PLT calls
that force BSS-PLT, which the inline-PLT relocations emitted by GCC 12
and newer do not support. Add the same GOT-based fix that
lang/lua/luajit has carried as 060-ppc-musl.patch since 2019.
With that in place the package builds, but ipairs() and pairs() turn
out to be broken on 32-bit big-endian soft-float targets. Both are
regressions in luajit2's PPC64 patch and do not affect upstream
LuaJIT. To be submitted to openresty/luajit2 as well.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit a6b248d6b8)
old just disabled version test, but as LuaJIt 2.1. part is stable.
So we can use that for test if luajit2 itself able to run.
Fixes: c7ca6d46f7 luajit2: ("add test-version.sh")
Suggested-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Signed-off-by: Seo Suchan <tjtncks@gmail.com>
(cherry picked from commit 5504291b81)
Brings the client in line with the fixes merged into the Go client: --json and
--csv end with a newline, --debug names the address each ICMP ping reached and
the spread of the samples, and the User-Agent carries the operating system and
architecture. Also tolerates a backend that answers getIP.php with an empty
rawIspInfo, which previously discarded the whole response.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 95875218de)
Tyrel M. McQueen
Josef Schlehofer
Etienne Champetier
John Audia
Qin Guang
Wei-Ting Yang
Kazuhiro Ito
Daniel Golle
Jan Hák
Alexandru Ardelean
Paul Donald
Noah Meyerhans
Christian Marangi
Til Kaiser
Gagan Deep
Sergei S.
Peter Polonec
Rui Salvaterra
Ray Wang
Samuele Longhi
Jeffery To
Aditya Nugraha
George Sapkin
Josef Schlehofer
Seo Suchan
Javier Marcet