`pkg/request/ssrftest` is used for tests only and does not contain
real package, exclude it from build list.
Fixes: 7f5a269cf3 ("cloudreve: Update to 4.16.1")
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 68031eafe4)
The map array anchor and the f_fetch call were placed inside the uplink branch, so a WAN
interface without a resolvable address left adb_map.jsn empty. That skipped the blocked domain
lookup as well and dropped the entire map, not just the local marker.
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 0bcf4cab80)
- better extract Uplink addresses
- the map array anchor was written inside the runtime file branch,
so a missing runtime file dropped the entire map instead of just the local marker
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit e74adcb2af)
- pass the station details to the "rev" call so the uplink section
stays resolved, fixes#30099
- the same empty trm_uplinkcfg also silently skipped disabling the uplink
after trm_maxretry was reached - fixed that too with this oneliner
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit b036203cbc)
Fixes several security issues:
- CVE-2026-11331 Fix handling of rpz CNAME expansion that returns name too long.
- CVE-2026-11721 Invalid signed wildcard records were being accepted.
- CVE-2026-13321 Fix DNSSEC validation bypass via out-of-zone NSEC Next Field.
- CVE-2026-10723 Correct verification of NSEC3 signer name.
- CVE-2026-12617 Do no assert for some specifics CNAME and DNAME queries.
- CVE-2026-10822 Malformed DNSKEY records could trigger an assertion.
- CVE-2026-11605 Prevent excessive validation work from crafted negative responses.
- CVE-2026-11622 Prevent cache exhaustion under sustained attack.
Full release notes are available upstream at
https://ftp.isc.org/isc/bind9/9.20.26/doc/arm/html/changelog.html
Signed-off-by: Noah Meyerhans <frodo@morgul.net>
(cherry picked from commit 81d81033e6)
31cb3c89f02d main, util: fix use-after-free on malformed POST field decoding
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 50dec501ab)
List Daniel F. Dickinson and Dharmik Parmar as watchcat maintainers.
This gives future package issues and reviews active contacts.
Signed-off-by: Dharmik Parmar <dharmikparmar2004@yahoo.com>
(cherry picked from commit 1b740c366e)
Allow logical interface references in watchcat interface options.
Resolve those names to real netifd devices for ping -I.
Keep logical names for ifup and real-device find_config behavior.
Use separate helpers for ping and restart values to avoid eval.
Treat ModemManager mm_iface_name=null as empty, not a modem name.
Signed-off-by: Dharmik Parmar <dharmikparmar2004@yahoo.com>
(cherry picked from commit dd826b7de6)
Keep the default restart timing based on the moment the recovery action
is triggered.
The optional reset_failure_timer path still starts a fresh failure window
after the recovery action finishes. This makes the two timing modes
explicit.
Signed-off-by: Dharmik Parmar <dharmikparmar2004@yahoo.com>
(cherry picked from commit 785f816efc)
Add an opt-in reset_failure_timer option for restart_iface and
run_script modes.
When enabled, watchcat starts a fresh failure window after the
recovery action finishes before allowing another recovery action.
The existing behavior remains the default.
Document the intended default and reset_failure_timer timing
behavior in TIMINGS.md and use a safer string comparison for the
reset_failure_timer check.
Signed-off-by: Dharmik Parmar <dharmikparmar2004@yahoo.com>
(cherry picked from commit 9450293220)
Clarify the restart_iface logging so the message reflects that the
configured action happens only after the failure period is reached.
Signed-off-by: Dharmik Parmar <dharmikparmar2004@yahoo.com>
(cherry picked from commit 624ac97d94)
Implement a nightly LLM review workflow that triggers
a reusable digest workflow from openwrt/actions-shared-workflows.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 3dc3c3d9e0)
While at it, we synchronized .github/formalities.json with the current
default settings of the webhook bot.
Since the bot is shared across all OpenWrt repositories, the stale PR
cleanup is disabled by default at the repository level. Because this
repository wants to use stale triage, we explicitly enable it here.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit f8b5d93366)
Maintainer: me
Compile tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Run tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Description:
Update to version 1.2.2-20
- Bump PKG_RELEASE to 20.
- Add Erik Conijn as a co-maintainer.
files/etc/init.d/pbr:
- Update packageCompat to 27.
- Standardize gateway warning messages.
- Add ubus_get_data helper for improved error/warning handling.
- Preserve JSON namespace in json() for better error handling.
- Refine device retrieval logic for OpenVPN interfaces.
- Improve display of IPv4/IPv6 gateways for consistency.
- Adjust service start trigger to only block on errors, not warnings.
- Ensure 'error' field is populated in ubus status when no gateways
are available.
files/etc/uci-defaults/90-pbr:
- Remove sed rule for '/etc/pbr/' to '/usr/share/pbr/' path
update.
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 6148708cb1)
Signed-off-by: Stan Grishin <stangri@melmac.ca>
Maintainer: me
Compile tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Run tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Description:
Update to PKG_RELEASE 4
- Bump PKG_RELEASE from 2 to 4.
- Add PKG_CPE_ID.
files/lib/adblock-fast/adblock-fast.uc:
- Adjust logic for determining the gzip cache path to align with
the new 'compressed_cache' option.
- Remove dependency on 'compressed_cache_dir' for gzip path
construction.
- Update gzip path calculation in 'get_init_status' to use the new
'compressed_cache' option.
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit bde6e9a5a0)
Signed-off-by: Stan Grishin <stangri@melmac.ca>
Maintainer: me
Compile tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Run tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Description:
Update to 2026.05.06 and add IP family option
- Update PKG_VERSION to 2026.05.06
- Update PKG_RELEASE to 1
- Add PKG_CPE_ID for CVE tracking
- Update PKG_MIRROR_HASH and PKG_SOURCE_VERSION
files/etc/config/https-dns-proxy:
- Add comments for default options
- Add new 'force_ip_family' option to control IP family for resolvers
- Update default 'bootstrap_dns' to include IPv6 addresses
files/etc/init.d/https-dns-proxy:
- Add DEFAULT_BOOTSTRAP4 and DEFAULT_BOOTSTRAP6 for family fallbacks
- Change 'global_force_ipv6' to 'global_force_ip_family' for new option
- Modify append_boot to filter bootstrap DNS by 'force_ip_family'
- Implement fallback bootstrap DNS for forced IP families with no
compatible configured servers
- Change 'start_instance' to use 'force_ip_family' instead of
'force_ipv6'
- Ensure 'service_started' and 'service_stopped' always return 0 to
prevent incorrect failure reports for `start`/`reload`/`restart`
commands
files/etc/uci-defaults/50-https-dns-proxy-migrate-options.sh:
- Migrate 'force_ipv6_resolvers' option to 'force_ip_family' option
- Remove old 'force_ipv6_resolvers' option after migration
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 0833198eef)
Signed-off-by: Stan Grishin <stangri@melmac.ca>
apk uses whatever /usr/bin/wget resolves to for HTTPS index downloads.
wget-nossl's alternative was ranked 300, above the HTTPS-capable
uclient-fetch (200), so pulling it in transitively silently broke
apk update. Lower it to 100 so uclient-fetch keeps the default while
wget-nossl stays selectable. wget-ssl is unchanged.
Fixes: https://github.com/openwrt/openwrt/issues/24270
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit cb3421cd327ff7fbcf107bfcc50a6ba259502970)
The nftables rule in acme-common partially works, but it races against the
acme.sh and uacme client. While the client is performing the renew the rule
is being deleted because the client is run in the background. This change
moves the rule management to the hook instead. While duplicate rules could
be created, the benefits outway the potential costs. It is unknown how many
installations issue/renew multiple certificates.
Signed-off-by: Michael A Cassaniti <michael@cassaniti.id.au>
(cherry picked from commit ba08c8cb51)
Add PYPI_SOURCE_NAME:=drf_nested_routers as the 0.95.0 sdist
uses underscores in the filename.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 0f833b1b9c)
Update package to 3.17.1.
Bug fix:
- HTMLFormRenderer crashed with empty datetime field values
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit b5a553b457)
Major changes since 3.10.0:
4.0:
- add CORS_ALLOW_PRIVATE_NETWORK setting for Local Network Access spec support
- add async middleware support, reducing overhead on async views
- remove deprecated CORS_REPLACE_HTTPS_REFERER and CorsPostCsrfMiddleware
- remove three header names from default allowed list (accept-encoding, dnt, origin)
4.3:
- fix access-control-allow-credentials header not being omitted on
non-allowed responses
4.6:
- drop support for Django 3.2 through 4.1
4.9:
- add Django 6.0 support
- tighten validation of sequence-type settings (e.g. CORS_ALLOW_METHODS)
Add PYPI_SOURCE_NAME:=django_cors_headers as the 4.x sdist uses
underscores in the filename.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit ccd69a148f)
Update package to 6.0.4.
Security fixes:
- CVE-2026-33033: DoS fix in MultiPartParser -- base64-encoded multipart
uploads with excessive whitespace could cause repeated memory copying
- CVE-2026-3902: ASGI header spoofing fixed -- headers containing underscores
are now ignored by ASGIRequest to prevent hyphen/underscore conflation
attacks
- CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin -- add permissions
on inline model instances were not validated against forged POST data
- CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable -- changelist
forms incorrectly allowed new instances to be created via forged POST data
- CVE-2026-33034: DoS via ASGI memory upload limit bypass -- missing or
understated Content-Length could bypass DATA_UPLOAD_MAX_MEMORY_SIZE
Bug fixes:
- alogin/alogout regression where request.user was not set/cleared if already
materialized by sync middleware
- RelatedFieldWidgetWrapper regression incorrectly wrapping all widgets in a
fieldset in admin forms
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 06eb22a606)
Changes since 0.4.4:
- v0.5.0: Improved handling of CTEs and window functions
- v0.5.0: Better token classification for SQL dialects
- v0.5.x: Various bug fixes for edge cases in formatting
and statement splitting
Also add test.sh to verify formatting, splitting, and parsing.
Link: https://github.com/andialbrecht/sqlparse/blob/master/CHANGELOG
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 2eef8732a3)
Josef Schlehofer
Andy Chiang
Tianling Shen
kouhei-ioroi
Dirk Brenken
Noah Meyerhans
Dennis Camera
Hauke Mehrtens
Niklas Thorild
Dharmik Parmar
dependabot[bot]
Stan Grishin
Alexandru Ardelean
Ismail Kundakci
Daniel F. Dickinson
Michael A Cassaniti
Wei-Ting Yang