Commit Graph
36926 Commits
Author SHA1 Message Date
Fabrice Fontaine 48e49aca11 utils/hplip: fix CPE ID
hp:linux_imaging_and_printing is a better CPE ID than
hp:linux_imaging_and_printing_project as this CPE ID has the latest CVE
(whereas hp:linux_imaging_and_printing_project only has CVEs up to
2013):
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:hp:linux_imaging_and_printing

Fixes: 5afe5c9031 (treewide: assign PKG_CPE_ID)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
2026-07-14 15:48:20 +02:00
Michael Heimpold c0d279e175 php8: update to 8.4.23
This fixes:
    - CVE-2025-14179
    - CVE-2026-6104
    - CVE-2026-6722
    - CVE-2026-6735
    - CVE-2026-7258
    - CVE-2026-7262
    - CVE-2026-7568
    - CVE-2026-12184
    - CVE-2026-14355

Full upstream changelogs:
https://www.php.net/ChangeLog-8.php#8.4.17
https://www.php.net/ChangeLog-8.php#8.4.18
https://www.php.net/ChangeLog-8.php#8.4.19
https://www.php.net/ChangeLog-8.php#8.4.20
https://www.php.net/ChangeLog-8.php#8.4.21
https://www.php.net/ChangeLog-8.php#8.4.22
https://www.php.net/ChangeLog-8.php#8.4.23

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
2026-07-13 21:54:20 +02:00
Daniel Golle 627044ab21 fwupd: allow enabling the devlink plugin
The devlink plugin allows updating firmware of network devices
implementing the kernel devlink interface. It is gated on libmnl,
which was hard-disabled so far. Wire the libmnl meson option to a
new FWUPD_PLUGIN_DEVLINK config symbol, enabled by default, and add
the corresponding libmnl runtime dependency to fwupd-libs.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-07-13 15:12:20 +02:00
Alexandru Ardelean 15af025b7f stress-ng: add config menu to select external libraries
Backport upstream e0c4d324a, which lets a LIB_* variable be emptied to skip
that library's check. Drop 001-disable-extra-stressors.patch, which hardcoded
the same choice, and drive it from a Config.in menu instead. Defaults keep the
previously built set of stressors: only crypt, aio, bsd, jpeg, kmod, sctp and
zlib are probed. apparmor, EGL, GBM, GLES2, IPSec_MB and Judy have no OpenWrt
package, so they are never probed. Drop the backport once it is in a release.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-07-13 14:24:42 +03:00
Alexandru Ardelean 199435708a stress-ng: link libatomic instead of disabling atomics
Drop 002-disable-atomics-mips-and-ppc.patch. It papered over link errors for
64-bit atomics on MIPS and PPC, which happen because stress-ng strips -latomic
whenever $(CC) matches "musl-gcc" -- as our cross toolchains do. Pass
LIB_ATOMIC=-latomic instead; libatomic is already in DEPENDS. Its stress-fractal
hunk was in any case dead since upstream 24c30b7fa narrowed the row counter back
to int32_t, which MIPS32 and PPC32 increment atomically inline.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-07-13 14:24:42 +03:00
Daniel F. Dickinson 6f30dc2b4a radicale3: bump version to 3.7.6
Bump to latest upstream (3.7.6)

https://github.com/Kozea/Radicale/releases/tag/v3.7.6
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
2026-07-13 12:24:33 +02:00
Daniel F. Dickinson 370659af19 apache: add version overrides
Many of the binaries in the apache source package do not have a
version output, so we need to add a version override so that CI
can pass.

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
2026-07-13 09:46:55 +02:00
Lukas Voegl 4c6d85bce6 libjcat: remove package
libjcat is now part of fwupd.
https://github.com/fwupd/fwupd/commit/ce55a6b616b7af8937cd97faa84752eb33e26203

Signed-off-by: Lukas Voegl <lvoegl@tdt.de>
2026-07-13 08:40:23 +02:00
Lukas Voegl 84bdd709ef fwupd: update to 2.1.6
Release notes: https://github.com/fwupd/fwupd/releases/tag/2.1.6

Signed-off-by: Lukas Voegl <lvoegl@tdt.de>
2026-07-13 08:40:23 +02:00
Philip A. Prindeville 5544edf33a python-pexpect: add package
Useful for provisioning devices like modems that present themselves
via a serial device.

Signed-off-by: Philip A. Prindeville <philipp@redfish-solutions.com>
2026-07-12 19:03:48 -06:00
Philip A. Prindeville 592a4ac758 python-ptyprocess: add package
Requirement for python-pexpect.

Signed-off-by: Philip A. Prindeville <philipp@redfish-solutions.com>
2026-07-12 19:03:48 -06:00
Andy Chiang 66febba4e1 golang: bump 1.26 to 1.26.5
Fixes: CVE-2026-39822
Fixes: CVE-2026-42505
Changes: https://github.com/golang/go/issues?q=milestone%3AGo1.26.5+label%3ACherryPickApproved

Signed-off-by: Andy Chiang <AndyChiang_git@outlook.com>
2026-07-12 20:58:26 +02:00
Vladimir Ulrich c7eaa8c93f zoneinfo: updated to 2026c release
Updated package version and file hashes.

Signed-off-by: Vladimir Ulrich <admin@evl.su>
2026-07-11 18:54:23 +02:00
Jianhui Zhao e1ec189d45 lua-eco: add CONFIG_ prefix to PKG_CONFIG_DEPENDS options
Options listed in PKG_CONFIG_DEPENDS must start with
CONFIG_ prefix.

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
2026-07-11 23:07:44 +08:00
Eric Fahlgren 918fd9285b owut: update to 2026.07.08
Bug fixes:
    efahl/owut@3979710893 owut: handle mid-release errors more gracefully
Enhancements:
    efahl/owut@db17536ec5 treewide: remove stray spaces and tabs
    efahl/owut@a0bb39262d owut: allow removal of non-installed packages

Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>
2026-07-11 23:04:15 +08:00
Dharmik Parmar 527c1f1183 libreswan: fix default subnet matching
Match only explicit default-route subnet tokens when normalizing leftsubnets and rightsubnets.

The previous regex treated dots as wildcards.

Values such as 10.250.0.0/16 and 10.0.0.0/8 were rewritten to 0.0.0.0/0.

Fixes: https://github.com/openwrt/openwrt/issues/23795
Signed-off-by: Dharmik Parmar <dharmikparmar2004@yahoo.com>
2026-07-10 20:59:58 +02:00
nantayo dev e698f817af podman: update to 5.8.4
- fix PKG_SOURCE_URL
Podman repository has been transferred from containers to podman-container-tools
- update package version
changelog see: https://github.com/podman-container-tools/podman/releases/tag/v5.8.4

Signed-off-by: nantayo dev <sora1924@outlook.com>
2026-07-10 20:57:53 +02:00
Daniel F. Dickinson 9ec085718d zabbix: add version check override
Allow CI to pass the version check for packages with executables
with not version output.

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
2026-07-10 20:56:10 +02:00
Daniel F. Dickinson d5eb49a42d zabbix: remove dependency on symbol ZABBIX_ENABLE_ZABBIX
It results a failure to build due to
https://github.com/openwrt/gh-action-sdk/issues/70. This means there will be some
ZABBIX symbols in .config eveen when ZABBIX is not selected, but this is a
necessary tradeoff. See
https://github.com/openwrt/packages/pull/29803#issuecomment-4882201182.

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
2026-07-10 20:56:10 +02:00
Daniel F. Dickinson 13ee37072d zabbix: bump to 7.0.27 and fix Makefile
* Update version to latest upstream LTS version.

* The Makefile was using an overly clever means to be compact that the
  CI webhook, and possibly the CI test container, didn't understand. We
  unroll that logic, and have more usual install and conffiles sections.
  In the process we fix a missing conffile install for zbbix-proxy*
	packages.

* Whitespace fixups

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
2026-07-10 20:56:10 +02:00
Aditya Nugraha c3cc59102c libucontext: bump to 1.5.1 & glibc support
Changelog:
Changes from 1.5 to 1.5.1
-------------------------
* Rename public register definitions on x86 and x86_64 to avoid clashing
  with glibc definitions when built in freestanding mode.
  Patch contributed by Daan De Meyer.

Changes from 1.4 to 1.5
-----------------------

* Workaround various header compatibility issues in glibc and bionic.

* Allow ppc64 target to be built in freestanding mode.

Changes from 1.3.3 to 1.4
-------------------------

* Add hard-float support to most architectures where relevant.
  Some patches contributed by Richard Campbell.

Changes from 1.3.2 to 1.3.3
---------------------------

* Use `bl` instruction instead of explicit GOT lookup for `exit`
  in 64-bit PowerPC assembly.

* Fix installation path for standalone libucontext headers.
  Patch contributed by Marian Buschsieweke.

* Fix missing includes for freestanding builds.
  Patch contributed by David Leeds.

Makefile:
  Disabled documents.
  Added glibc supports, and remove hardcoded musl dependency.
  Put test_libucontext_posix only available in musl runtime.

Build system: x86/64
Build-tested: x86/64-glibc
Build-tested: x86/64-musl
Run-tested: x86/64-glibc

Signed-off-by: Aditya Nugraha <vortexilation@gmail.com>
2026-07-10 20:52:18 +02:00
Glenn Strauss 143195230b lighttpd: update to lighttpd 1.4.85 release hash
Ref: https://www.lighttpd.net/2026/07/08/1.4.85/
Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
2026-07-10 16:35:02 +02:00
John Audia bc78197403 openssh: update to 10.4_p1
Changelog: https://www.openssh.com/txt/release-10.4

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc

Signed-off-by: John Audia <therealgraysky@proton.me>
2026-07-10 13:13:46 +02:00
Joshua Covington 30b18d15cb bcm27xx-eeprom: update to Git HEAD (2026-05-27)
Update to the latest Git HEAD (2026-05-27)

Signed-off-by: Joshua Covington <joshuacov@gmail.com>
2026-07-10 12:50:25 +02:00
David Andreoletti a3a5d87229 qemu: enable qemu package support in .config for Rockchip devices
OpenWrt's .config support declaring qemu-* packages as part of the
Rockchip devices OpenWrt images.

Maintainer: @yousong
Compile tested: snapshot
Run tested: NanoPi R4S

Signed-off-by: David Andreoletti <david.andreoletti.dev@gmail.com>
2026-07-10 10:36:02 +02:00
Alexandru Ardelean 248e91d878 stress-ng: update to 0.21.03
Both patches still apply unchanged and remain necessary: upstream's library
list is unchanged, and stress-misaligned.c still only disables atomics on PPC
for gcc < 5.0 while stress-fractal.c has no arch guard at all.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-07-10 09:13:56 +03:00
Alexandru Ardelean 7b5d7e39fb fluent-bit: update to 5.0.8, adopt maintainer, fix musl startup segfault
Update 4.2.0 -> 5.0.8 and adopt maintainership. fluent-bit segfaulted at
startup on every musl target: under GCC 14 the upstream C-TLS probe no longer
compiles (undeclared __tls_get_addr), so the pthread_key fallback calls
pthread_getspecific() before pthread_key_create() and derefs a NULL tsd array
on musl (glibc is unaffected). Force -DFLB_HAVE_C_TLS=Yes for __thread TLS.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-07-09 20:41:02 +03:00
Wei-Ting Yang 4af6cb6efd django: bump to version 6.0.7
Fix CVE-2026-48588, CVE-2026-53877, and CVE-2026-53878.

Full release notes:
https://docs.djangoproject.com/en/6.0/releases/6.0.7/

Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
2026-07-09 17:50:31 +03:00
Fabian Lipken bb07b4e715 fx: update to 39.2.0
* Update to 39.2.0
* Remove myself as maintainer

Signed-off-by: Fabian Lipken <dynasticorpheus@gmail.com>
2026-07-09 16:52:14 +03:00
Florian Eckert 1302d3e88a strongswan: bump PKG_RELEASE
Update PKG_RELEASE.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2026-07-09 10:51:13 +02:00
Florian Eckert e77b22fb2a strongswan: add one default named ipsec uci section 'globals'
The UCI section 'ipsec' should only be available once, as these are
general settings for 'strongswan.conf'. It makes no sense to configure them
more than once. To ensure that the general settings can also be configured
via LuCI, this section must be present at least once.

For configurations already in the field, a uci-default script is added
that assigns the name 'globals' to the last ipsec section type.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2026-07-09 10:51:13 +02:00
Florian Eckert 4f4522702d strongswan: use procd running check
Instead of using the standard procd check, the function is overridden, and
the check to see if the service is running is performed using the command
'swanctl --stats > /dev/null 2>&1'. The problem with this is, that this
call is blocking if the strongswan charon socket is not available. The call
does not  return until the timeout has expired.

This block does not occur if we use the standard behavior of procd, which
checks whether the service it started is actually running. This change
therefore uses the standard call via procd, which returns the value without
blocking.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2026-07-09 10:51:13 +02:00
Javier Marcet f19137076a docker-compose: update to version 5.3.1
Release notes:
https://github.com/docker/compose/releases/tag/v5.3.1

Signed-off-by: Javier Marcet <javier@marcet.info>
2026-07-09 08:55:33 +02:00
Tianling Shen 41282daa59 rclone: Update to 1.74.4
Release note: https://github.com/rclone/rclone/releases/tag/v1.74.4

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2026-07-09 14:35:58 +08:00
Tianling Shen bfe22b5859 dnsproxy: Update to 0.83.0
Release note: https://github.com/AdguardTeam/dnsproxy/releases/tag/v0.83.0

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2026-07-09 14:23:54 +08:00
Dharmik Parmar 1b740c366e watchcat: update package maintainers
List Daniel F. Dickinson and Dharmik Parmar as watchcat maintainers.

This gives future package issues and reviews active contacts.

Signed-off-by: Dharmik Parmar <dharmikparmar2004@yahoo.com>
2026-07-09 08:12:14 +02:00
Dharmik Parmar dd826b7de6 watchcat: resolve logical interface names
Allow logical interface references in watchcat interface options.

Resolve those names to real netifd devices for ping -I.

Keep logical names for ifup and real-device find_config behavior.

Use separate helpers for ping and restart values to avoid eval.

Treat ModemManager mm_iface_name=null as empty, not a modem name.

Signed-off-by: Dharmik Parmar <dharmikparmar2004@yahoo.com>
2026-07-09 08:12:14 +02:00
Josef Schlehofer 3dc3c3d9e0 ci: add nightly LLM review workflow
Implement a nightly LLM review workflow that triggers
 a reusable digest workflow from openwrt/actions-shared-workflows.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2026-07-09 07:17:31 +02:00
Alexandru Ardelean 82ab16b882 libdrm: skip the generic version check for the whole package
libdrm-tests ships DRM tools (modetest, proptest, ...) with no --version flag,
so the generic probe aborts with "No executables in the package provided
version" and fails CI. test-version.sh is shared by every subpackage built from
this directory and a non-zero exit fails it, so it must accept the whole family
(the libraries ship no executables either) -- hence libdrm*, not just libdrm-tests.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-07-08 18:18:48 +03:00
Maxim Storchak f31a9bf838 lsof: update to 4.99.7
- convert the patch to a make option
- Add -J/-j options for JSON and JSON Lines output format.
- lsof_free_result(): handle result == NULL
- Fix missing parenthesis in lstat error message format
- Fix use-after-free in lsof_select_process_regex
- Fix truncated fd numbers in -F field output
- Display connection state for UDP sockets with -T option

Signed-off-by: Maxim Storchak <m.storchak@gmail.com>
2026-07-07 20:29:49 +02:00
Hauke Mehrtens 4d88f35c8d gcc: synchronize with toolchain
This fixes the build of the gcc package.

Add the toolchain changes from these commits:
https://github.com/openwrt/openwrt/commit/f93228427aa98324b97bac1defd9a8a39e47c29a
https://github.com/openwrt/openwrt/commit/97424f9c860593ad524aff84a2f982b97abfed5f
https://github.com/openwrt/openwrt/commit/ab40696d6134c842a93112a7a0325a148b3b1a2b

Fixes: https://github.com/openwrt/openwrt/issues/24084
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-07-07 12:09:29 +02:00
Florian Eckert 213d90b417 mwan3: bump PKG_VERSION to 2.12.2
Update version.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2026-07-07 08:03:02 +02:00
Florian Eckert cdb882a27f mwan3: sourcing the mwan3 init is not needed anymore
Source the 'mwan3' init service does printing the following log message:

/usr/sbin/mwan3: /etc/init.d/mwan3: line 116: extra_command: not found

However, there is no need to source this file, as the required functions are
already loaded in the file '/usr/lib/mwan3.sh'.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2026-07-07 08:03:02 +02:00
Florian Eckert 583036ad17 mwan3: add log message if l3 interface is not up
Add log message.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2026-07-07 08:03:02 +02:00
Jiang Tengfei 774c01bcba ddns-scripts: update to 2.8.4
Bump PKG_VERSION for the ddns-scripts changes and reset PKG_RELEASE to
1 as requested.

Signed-off-by: Jiang Tengfei <admin@shaoxia.xyz>
2026-07-07 08:02:21 +02:00
Jiang Tengfei 3aca374056 ddns-scripts: fix one.com prerm test syntax
Add the missing spaces around the test bracket in the one.com
pre-removal script and escape IPKG_INSTROOT consistently with the other
subpackages.

Signed-off-by: Jiang Tengfei <admin@shaoxia.xyz>
2026-07-07 08:02:21 +02:00
Jiang Tengfei 37c99fc548 ddns-scripts: support version output in frontend
The /usr/bin/ddns frontend did not support a version option, so
generic package tests treated it as an executable that could not report
the package version.

Read the installed version file and support -V/--version, matching the
version output style used by dynamic_dns_updater.sh.

Signed-off-by: Jiang Tengfei <admin@shaoxia.xyz>
2026-07-07 08:02:21 +02:00
Jiang Tengfei 9a5e6063f1 ddns-scripts: add curl source IP bind fallback
Keep the existing cURL bind_network behavior of binding to the
logical device first. This preserves the behavior introduced for
PPPoE and multi-WAN setups where the selected network must also be
used for the DDNS update request.

Some setups can still fail when libcurl binds directly to the logical
PPP device. In that case the transfer may time out even though binding
to the source address of the same network succeeds. This can make DDNS
updates fail repeatedly on affected systems.

Retry cURL transfers once with the network source IP when the
device-bound transfer fails. This leaves the normal path unchanged,
keeps the update request on the same network, and matches the existing
GNU Wget behavior which already binds to the network IP address.

Also document the implicit bind_network default and the cURL fallback
in the sample configuration.

Signed-off-by: Jiang Tengfei <admin@shaoxia.xyz>
2026-07-07 08:02:21 +02:00
Philip Prindeville 4b136c0bcb clixon: update to 7.8.0
Features optimized datastore YANG validation including incremental
validation, a reduced XML config footprint, configurable datastore
cache, many bugfixes and a prototype gRPC/gNMI implementation.

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
2026-07-06 20:25:02 -06:00
Philip Prindeville 3c7195f507 cligen: update to 7.8.0
Check before update in case of "when" statement.

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
2026-07-06 20:25:02 -06:00