Commit Graph
37637 Commits
Author SHA1 Message Date
Martin Kennedy cd3c451cda realtek-poe: increase version to v1.3.2
This picks up a memory leak fix, some ubus fixes, and a couple of
Zyxel device quirks.

Signed-off-by: Martin Kennedy <hurricos@gmail.com>
2026-10-06 20:17:21 +02:00
Hauke Mehrtens 670a7b3b0e strongswan: stage the migration in the LuCI session through ubus
When LuCI passes a session id, migrate-ipsec-to-swanctl moves its uci
delta into /tmp/run/rpcd/uci-<session id>, rpcd's private save directory
of that session. rpcd stops naming this directory after the session id,
as the id is a bearer credential that leaked through directory listings,
so the migrated configuration would no longer show up as pending changes
in LuCI.

Stage the migration through rpcd's uci ubus API instead: revert the
session's ipsec changes, delete all sections and add the sections of the
migrated configuration. Then revert the changes of the uci command line
tool, which the old code moved away. This works with old and new rpcd
versions. If staging fails, both are reverted and the script exits with
an error.

Fixes: d5f33e6410 ("strongswan: support optional UCI session staging in migrate-ipsec-to-swanctl")
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-10-06 09:53:01 +02:00
Mirko Vogt c9a8662432 tio: use Lua 5.4
tio embeds Lua for its scripting support, which is not optional. It
looks Lua up through pkg-config as lua-5.4, lua-5.3, lua-5.2, lua-5.1
and lua, in this order, with no option to select the version. The
package depends on lua (5.1), which tio has found as lua.pc so far.
Since lua5.4 stages lua-5.4.pc, tio finds Lua 5.4 first and links
liblua5.4 without depending on it.

Depend on liblua5.4, the version tio looks up first, instead of lua,
which is the documented preferred version anyway.
Only the library is needed; tio does not run the lua interpreter.

Signed-off-by: Mirko Vogt <mirko-openwrt@nanl.de>
2026-10-06 10:40:22 +03:00
Mirko Vogt fe3a534718 lua: install a pkg-config file for Lua 5.4
Lua stopped shipping a pkg-config file after 5.1; the 5.2, 5.3 and 5.4
release tarballs contain none. Distributions add one to their Lua
packages instead: Debian's liblua5.4-dev ships lua5.4.pc, lua-5.4.pc
and lua54.pc, Alpine's lua5.4-dev ships lua5.4.pc and lua-5.4.pc. Build
systems of Lua consumers look Lua 5.4 up under these names. The package
stages no pkg-config file so far, so such builds cannot find
liblua5.4; the only Lua pkg-config file in the staging directory is
lua.pc of the lua package (5.1.5).

Stage lua5.4.pc, generated from a template with the package version,
and lua-5.4.pc and lua54.pc as links to it. It points to the headers in
/usr/include/lua5.4 and to liblua5.4, and lists libm and libdl as
private libraries for static linking, as the upstream Makefile links
them on Linux.

Of the packages that look up one of these names through pkg-config,
libinput disables its Lua plugin support explicitly in the previous
commit. tio looks up lua-5.4 before lua but depends on lua (5.1), so it
links liblua5.4 without depending on it until the next commit moves it
to Lua 5.4. The others select their Lua version explicitly, look up lua
(5.1) first, build without the feature using Lua, or depend on lua5.4
already.

Assisted-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Mirko Vogt <mirko-openwrt@nanl.de>
2026-10-06 10:40:22 +03:00
Mirko Vogt 12723165f0 libinput: disable Lua plugin support explicitly
The lua-plugins option is left at its default, auto, so libinput builds
its Lua plugin support whenever pkg-config finds Lua 5.4 (lua-5.4,
lua5.4 or lua >= 5.4) in the staging directory. lua5.4 installs no
pkg-config file so far, so the package has been built without it. Once
lua5.4 stages lua5.4.pc, libinput links liblua5.4 without depending on
it, and packaging fails with "missing dependencies for the following
libraries: liblua5.4.so.*".

Set -Dlua-plugins=disabled, so the package is built as before.

Signed-off-by: Mirko Vogt <mirko-openwrt@nanl.de>
2026-10-06 10:40:22 +03:00
Alexandru Ardelean 5432f90a1f lua: drop the lua5.4 LUA_ROOT patch
luaconf.h builds the module search paths out of LUA_ROOT, which upstream
hardcodes to /usr/local, where nothing installs on OpenWrt. LUA_ROOT is
defined unconditionally, but the two macros it feeds, LUA_PATH_DEFAULT
and LUA_CPATH_DEFAULT, are both guarded with #if !defined and are the
only users of it, so set them in TARGET_CFLAGS and drop the patch.

The resulting paths are the ones the patch produced, so the interpreter
behaves exactly as before.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-10-06 10:40:22 +03:00
Alexandru Ardelean 6c5a3c4d78 lua: use LUA_INSTALL_DIR in cqueues, lua-ffi and luaossl
The three Lua variants of each package install the same files, differing
only in the destination directory, so define LUA_INSTALL_DIR next to the
other per-variant settings and share a single install recipe. Same idiom
as luafilesystem, luasec and luaexpat. No packaged path changes.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-10-06 10:40:22 +03:00
Josef Schlehofer 21b1fefb41 ripe-atlas: add get_key and probeid to init script
Previous package (atlas-sw-probe) printed the public key to register a
new probe with "/etc/init.d/atlas get_key" and the probe ID with
"/etc/init.d/atlas probeid", and the documentation [1] [2] tells users
to run get_key. Add both back as "/etc/init.d/ripe-atlas get_key" and
"/etc/init.d/ripe-atlas probeid". For a probe that has registered since
boot, get_key prints the probe ID instead of asking to register it.

[1] https://docs.turris.cz/basics/apps/atlas/
[2] https://github.com/openwrt/packages/blob/d2aeaf041bc0/net/atlas-sw-probe/files/atlas.readme

Fixes: b77264c922 ("ripe-atlas: add new package")
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2026-10-05 22:56:11 +02:00
Dirk Brenken cdcbc11db8 shunt: fix rpcd status call
* define tproxy_available() before render(): ucode resolves the name
  when render() is compiled, so the later definition left it null and
  every status call failed - LuCI showed "no answer from the backend"

Signed-off-by: Dirk Brenken <dev@brenken.org>
2026-10-05 21:19:59 +02:00
Dirk BrenkenandClaude fa45216764 shunt: update to 0.1.11
* add the per-policy action 'tproxy': hands the selected tcp/udp traffic
  to a transparent proxy on the router (option tproxy_port), delivered to
  127.0.0.1/::1 via a 'local default dev lo' policy table
* restore rules for tproxy flows carry the tproxy statement on every
  packet - a mark alone loses udp flows to the proxy's reply socket
* a proxied flow whose listener is gone is always dropped: its conntrack
  entry was never NATed and would leave with the client's own address;
  fallback 'main'/'block' decides about new flows only
* no tproxy rules in output (the kernel rejects the statement there), no
  keep_local rule for tproxy (main would forward socket-assigned packets)
* tproxy policies are skipped as an issue without kmod-nft-tproxy instead
  of failing the whole nft batch
* shunt check and the rpcd status report tproxy policies
* readme update

Co-authored-by: Claude <noreply@anthropic.com>
Signed-off-by: Dirk Brenken <dev@brenken.org>
2026-10-05 20:35:54 +02:00
Vladimir Ulrich 0448a82c2a zoneinfo: update to 2026e release
Package version and file hashes changed.

Signed-off-by: Vladimir Ulrich <admin@evl.su>
2026-10-05 20:40:11 +03:00
Keith T. GarnerandClaude Sonnet 5 6d81d44935 duperemove: add new package
duperemove is a simple tool for finding duplicated
extents and submitting them for deduplication. It
will de-dupe results on btrfs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Signed-off-by: Keith T. Garner <kgarner@kgarner.com>
2026-10-05 17:47:02 +03:00
Josef Schlehofer 5a5ec845cd weechat: add new package
WeeChat (Wee Enhanced Environment for Chat) is a fast, light and
extensible chat client with a modular architecture and relay support.

This package provides:
- weechat-minimal (default variant): headless daemon without ncurses,
  suited for routers and for use through relay web or mobile clients.
- weechat-full: the ncurses terminal client as well as the headless
  daemon.
- Config.in: menuconfig options for zstd, cJSON and the scripting
  plugins (Python, Lua, Ruby, Perl, Tcl).
- procd init script and UCI configuration. irc.conf, relay.conf and
  logger.conf are generated from UCI, and the values written to them
  are checked first. The relay refuses to start without a password and
  disk logging is off by default to protect flash storage. Passwords
  are stored as hex encoded WeeChat expressions, so characters like ';'
  or '${' can neither run commands nor get evaluated.
- The daemon runs as the weechat user. /etc/weechat, /etc/weechat/tls
  and /var/run/weechat belong to root. The init script only changes
  paths whose parent the daemon cannot modify, except for the generated
  files in the sticky config directory, which it renames into place
  without following symlinks. Of the log directories it only creates
  the default /var/log/weechat.
- test.sh: checks the binaries and plugins, the init script
  validation, the directory layout, the values WeeChat reads back from
  the generated files and that the relay listens.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2026-10-05 15:30:14 +02:00
Josef Schlehofer d884296e01 ripe-atlas: take over maintainership
Tiago Gaspar has not been active in this repository since May 2026 and
did not respond when Alexandru Ardelean offered to pick the package up
in https://github.com/openwrt/packages/pull/30030. Michel Stam, who
wrote RIPE's own OpenWrt packaging, has not taken part here, and since
5120 that packaging lists the RIPE Atlas Team instead of him. I run a
probe and test the package on Turris OS, so take it over.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2026-10-05 15:29:39 +02:00
Josef Schlehofer 5f90972a66 ripe-atlas: migrate from atlas-sw-probe
ripe-atlas-probe provides atlas-sw-probe, but carries nothing over, so
an upgraded probe would come up with a new key, which RIPE rejects
until its host enters it on atlas.ripe.net.

Take over the key and the settings of atlas-sw-probe in a uci-defaults
script of ripe-atlas-probe, and stop and disable atlas once the key is
in place. A failed run is retried on the next boot. Until it succeeds,
the init does not start the probe, so the key is never used twice and
no new key is created. Until the key is in place, the init logs that it
waits.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2026-10-05 15:29:39 +02:00
Josef Schlehofer 7fcbf9d549 ripe-atlas: clean up the Makefile
- Build the tree once, the variants only install different files. Both
  provide ripe-atlas, with the probe as the default variant, so that
  apk, whose packages carry no CONFLICTS, cannot install both.
- Select busybox tee, cmp and find with the options that the
  registration and the init use, and drop jsonfilter and the busybox ps,
  killall, tar, ntpd and bunzip2 selects, which nothing installed uses.
- Do not keep /etc/ripe-atlas/mode, the init rewrites it on every start.
- List all licenses: the measurement busybox is BusyBox (GPL-2.0-only)
  with libevent (BSD-3-Clause and ISC) linked in, and five of the shell
  libraries are LGPL-2.1-or-later.
- Link the measurement applets in one loop.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2026-10-05 15:29:39 +02:00
Josef Schlehofer 37b343293b ripe-atlas: restart the probe on config changes
Restart the probe when /etc/config/ripe-atlas changes. procd does not
restart an instance when any of these options changes, and up to OpenWrt
25.12, when it stops one, it signals only the main script, so the
measurement daemons, the ssh tunnel and telnetd would keep running. Stop
and start the whole service instead.

On stop, take the processes from the instance's cgroup, which holds
exactly those of the probe, and fall back to the ripe-atlas group only
when it holds none.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2026-10-05 15:29:39 +02:00
Josef Schlehofer 7ddb6d130c ripe-atlas: run the probe as root without ujail
procd hands capabilities to a service only through ujail, which is
optional. Without it the probe ran as ripe-atlas without CAP_NET_RAW,
and its ping and traceroute measurements failed.

Use ujail when it and the ripe-atlas user exist, and run the probe as
root otherwise, as atlas-sw-probe did, with a warning in the log. Keep
only CAP_NET_RAW, the probe never changes its user.

Fixes: b77264c922 ("ripe-atlas: add new package")
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2026-10-05 15:29:39 +02:00
Josef Schlehofer e610dc7556 ripe-atlas: fix the init script
The probe runs as ripe-atlas, but /etc/ripe-atlas is root's, so the
probe could neither create its key nor copy the registration servers
there, and it never registered. Let the init, which runs as root,
prepare both, as generic-ATLAS.sh would, and keep the directory root's,
so that the probe cannot swap in links for what root writes or chowns
there.

While at it:
- validate the booleans as bool, yes/on/true made the probe refuse to
  start;
- create the key also over an empty file, which ssh-keygen would not
  overwrite without asking;
- set up the spool directories, which the probe user owns, only until
  that worked once since boot, remove links put in their place, and
  refuse a /var/spool/ripe-atlas that root does not own, so that root's
  chown and chmod cannot be redirected;
- create its files and directories with umask 022, so that a caller's
  umask can neither hide them from the probe nor open them to others;
- wait for ripe-atlas-probe or -anchor, which apk installs only after
  ripe-atlas-common started the service, and restart the service from
  their post-install;
- install measurement.conf readable for the probe.

Fixes: b77264c922 ("ripe-atlas: add new package")
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2026-10-05 15:29:39 +02:00
Gleb Pesin f626f9c502 mwan3: strip dead flag from copied routes
The kernel marks routes using no-carrier devices as dead linkdown. mwan3
strips linkdown but passes dead to ip route, which rejects the copied route
and leaves policy tables incomplete.

Strip both flags, including at end of line, and add a runtime test.

Signed-off-by: Gleb Pesin <dormancygrace@gmail.com>
2026-10-05 11:19:19 +02:00
Michael Pfeifroth ab97fcad72 modemmanager: rework initial EPS bearer modes
Commit 246506690f ("modemmanager: always reset the init_eps if not
configured") changed the behaviour for an unset 'init_epsbearer' from
leaving the modem untouched to clearing the initial EPS bearer on every
setup. This is a regression for users upgrading from 24.10:

- Modems without support for setting the LTE attach configuration (e.g.
  Sierra Wireless EM7430) fail the setup with
  MM_INIT_EPS_BEARER_SET_FAILED and never come up.
- Attach settings preloaded by the carrier firmware are wiped.

The same commit also removed the explicit 'none' case, so 'none' now
silently skips the initial EPS bearer setup, while it cleared it in
24.10. Neither matches the documentation.

Make all modes explicit, each naming where the initial EPS bearer
settings come from:

- modem:      leave the settings stored on the modem unchanged (default)
- network:    set an empty initial EPS bearer, the network assigns the
              APN; replaces the implicit clear, e.g. after a SIM swap
- connection: use the connection options (apn, iptype, ...)
- custom:     use the init_* options

'none' and 'default' are kept as deprecated aliases for 'modem' and
'connection'. 'none' maps to 'modem' as documented in the README and as
it behaves since 246506690f, although an explicit 'none' cleared the
initial EPS bearer in 24.10; use 'network' for that. Unknown values fall
back to 'modem'. The README now documents the modes and how to clear
stale settings manually.

Fixes: https://github.com/openwrt/packages/issues/30299
Signed-off-by: Michael Pfeifroth <micpf@westermo.com>
2026-10-05 11:12:07 +02:00
Jianhui Zhao 3f87f7ae83 luaossl: fix Lua 5.4 module installation paths
Commit 3fe92e63f5 moved the default Lua 5.4 module search paths
from /usr/local to /usr. luaossl still staged and packaged its Lua 5.4
modules under /usr/local/lib/lua/5.4, outside the default search paths.

Set lua54path and lua54cpath to /usr/lib/lua/5.4 and update the package
install rules to match. Bump PKG_RELEASE to 3 so the corrected package
is offered as an upgrade. Keep Lua 5.1 and Lua 5.3 paths unchanged.

Fixes: 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of /usr/local")
Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
2026-10-05 12:01:29 +03:00
Jianhui Zhao 76ed3f94ad cqueues: fix Lua 5.4 module installation paths
Commit 3fe92e63f5 moved the default Lua 5.4 module search paths
from /usr/local to /usr. cqueues still staged and packaged its Lua 5.4
modules under /usr/local/lib/lua/5.4, outside the default search paths.

Set lua54path and lua54cpath to /usr/lib/lua/5.4 and update the package
install rules to match. Bump PKG_RELEASE to 3 so the corrected package
is offered as an upgrade. Keep Lua 5.1 and Lua 5.3 paths unchanged.

Fixes: 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of /usr/local")
Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
2026-10-05 12:01:29 +03:00
Jianhui Zhao 16757d0c2a lua-ffi: fix Lua 5.4 module installation path
Commit 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of
/usr/local") changed LUA_ROOT to /usr/, moving the default Lua 5.4
module search paths out of /usr/local. The Lua 5.4 variant of lua-ffi
still installed ffi.so under /usr/local/lib/lua/5.4, so require("ffi")
could no longer find it with the default search paths.

Install ffi.so under /usr/lib/lua/5.4 to match the new default search
path. Bump PKG_RELEASE to 2 so the corrected package is offered as an
upgrade. Keep the Lua 5.1 and Lua 5.3 installation paths unchanged.

Fixes: 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of /usr/local")
Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
2026-10-05 12:01:29 +03:00
Jianhui Zhao b5ec1052da lua-cjson: fix Lua 5.4 module installation path
Commit 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of
/usr/local") changed LUA_ROOT to /usr/, moving the default Lua 5.4
module search paths out of /usr/local. The Lua 5.4 variant of lua-cjson
still installed cjson.so under /usr/local/lib/lua/5.4, so require("cjson")
could no longer find it with the default search paths.

Install cjson.so under /usr/lib/lua/5.4 to match the new default search
path. Bump PKG_RELEASE to 6 so the corrected package is offered as an
upgrade. Keep the Lua 5.1 and Lua 5.3 installation paths unchanged.

Fixes: 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of /usr/local")
Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
2026-10-05 12:01:29 +03:00
Jianhui Zhao afb69d99c7 lua-eco: align module installation with Lua 5.4 search paths
Commit 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of
/usr/local") changed LUA_ROOT to /usr/, moving the default Lua 5.4
module search paths out of /usr/local. lua-eco still installed its Lua
and native modules under /usr/local/lib/lua/5.4, so require() could no
longer find them with the default search paths.

Install modules from the main package and all subpackages under
/usr/lib/lua/5.4, which is searched for both .lua and .so files.
Define LUA_INSTALL_DIR once and use it throughout the install rules so
future directory changes only need one update. Bump PKG_RELEASE to 2
so the corrected packages are offered as upgrades.

Fixes: 3fe92e63f5 ("lua: look for lua5.4 modules under /usr instead of /usr/local")
Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
2026-10-05 12:01:29 +03:00
Julius Bairaktaris 349c2ca5c8 xz: use --enable-small only on SMALL_FLASH targets
--enable-small builds only the resumable mode of the LZMA decoder and a
single-table CRC32/CRC64 without the architecture-specific CRC code.
Keep it for SMALL_FLASH targets and build the fast variants elsewhere.

xz -dc -T1 of a 32 MiB file (3.3 MiB .xz), median of 5: 966 -> 880 ms
on Cortex-A53, 813 -> 634 ms on Cortex-A72 in AArch32. liblzma grows by
11.5 KiB (aarch64) to 19.6 KiB (mips_24kc), compressed with xz.

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
2026-10-05 10:04:46 +03:00
Alexandru Ardelean ec41f810e0 python-vcs-versioning: update to 2.5.0
Refresh sha256 from the PyPI sdist.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-10-05 09:55:48 +03:00
Alexandru Ardelean eec0050c53 python-pyopenssl: bump to 26.4.0
Refresh sha256 from the PyPI sdist.

26.4.0 drops OpenSSL.crypto.X509Req and dump_certificate_request, so
test.sh can no longer import them; remove them and the CSR block. CSR
handling now lives in cryptography.x509, which is not this package.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-10-05 09:55:48 +03:00
Alexandru Ardelean 6d14d771a9 python-service-identity: bump to 26.1.0
Refresh sha256 from PyPI sdist.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-10-05 09:55:48 +03:00
Alexandru Ardelean ccf12c6e0c python-engineio: bump to 4.14.0
Refresh sha256 from the PyPI sdist.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-10-05 09:55:48 +03:00
Josef Schlehofer e3a761dd66 libtorrent-rasterbar: fix the python bindings
Building python3-libtorrent with CMake 4 and Python 3.14 fails in
several places, which the distutils error of 2.0.11 used to hide:

- On 32-bit targets FindPython rejects the 64-bit host interpreter.
  Pass the host python of OpenWrt as Python3_EXECUTABLE, which skips
  that check and keeps CMake on the python that gets setuptools.
- The egg_info step needs setuptools, which the host python no longer
  bundles since Python 3.12. Depend on python-setuptools/host when
  python3-libtorrent is selected.
- CMake names the module after the SOABI of the host interpreter, for
  example libtorrent.cpython-314-x86_64-linux-gnu.so, which the target
  python does not load. Rename it to libtorrent.so after installing.
- The wheel from Py3Build/Compile only held the example scripts as
  top-level modules and a second dist-info. The module always came
  from the CMake install, so drop the wheel steps.
- The module imports datetime when it loads, which python3-base does
  not ship. Depend on python3-light.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2026-10-05 08:37:01 +02:00
Josef Schlehofer a05f401f40 libtorrent-rasterbar: add test.sh
Check that the python bindings can be imported on the target and that
they report the package version.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2026-10-05 08:37:01 +02:00
Josef Schlehofer b13caa1227 libtorrent-rasterbar: update to 2.0.15
Since 2.0.12 the python bindings read the install paths from sysconfig
instead of distutils, which Python 3.12 removed. With 2.0.11 CMake
fails to configure the python bindings, so neither libtorrent-rasterbar
nor python3-libtorrent builds.

Release notes:
https://github.com/arvidn/libtorrent/blob/v2.0.15/ChangeLog

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2026-10-05 08:37:01 +02:00
Ludvig Liu Holtze 6c393a8732 transmission: grant r/w access to config dir
Solves issues with stats etc. not updating properly and reduces the
amount of leftover temporary files. Access to settings.json is kept
read-only to keep it in sync with UCI.

Signed-off-by: Ludvig Liu Holtze <ldw.liu.holtze@proton.me>
2026-10-04 20:58:27 +01:00
Josef Schlehofer dee4f5f48d nginx: update to 1.30.5
1.30.4:
- Heap buffer overflow with the map directive and regex matching
  (CVE-2026-42533).
- Uninitialized memory access with unnamed regex captures and the slice
  directive or background cache update (CVE-2026-60005).
- Use-after-free in ngx_http_ssi_filter_module with a crafted proxied
  backend response (CVE-2026-56434).

1.30.5:
- Heap buffer overflow with HTTP/3 and OpenSSL 3.5.0 and earlier
  (CVE-2026-90439).

All patches apply without changes.

Changelog: https://nginx.org/en/CHANGES-1.30
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2026-10-04 12:27:18 +02:00
Alexandru Ardelean 0774799a27 confuse: update to 3.4
Refresh PKG_HASH from the upstream GitHub release tarball.

Drop 010-CVE-2022-40320.patch. Upstream commit d73777c2c356, which the
patch carried, is part of 3.4: cfg_tilde_expand() now terminates the
username before handing it to getpwnam(). Keeping the patch would fail
to apply.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-10-03 09:27:29 +03:00
John Audia a36c2b8736 iperf3: update to 3.22
Update to latest upstream release.

Removed upstreamed patch.

Security fixes:
- CVE-2026-101283: remote use-after-free in iperf_server_api.c
- CVE-2026-101276: heap buffer overflow in iperf_auth.c
- CVE-2026-102253: denial of service via infinite loop
- CVE-2026-71217: issue with test parameters

Changelog: https://github.com/esnet/iperf/releases/tag/3.22

Signed-off-by: John Audia <therealgraysky@proton.me>
2026-10-03 09:27:06 +03:00
Alexandru Ardelean 493b2ae11c motion: update to 4.7.1
4.5.0 uses three interfaces FFmpeg 7 removed; upstream guards them since
4.6. Drop 010-no-po-man.patch and switch PKG_FIXUP to gettext-version,
which runs autopoint and so supplies the po/Makefile.in.in the patch was
working around. Drop --without-mmal, which 4.7.1 no longer has.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-10-02 20:30:36 +03:00
Lasse Hanschen aca660a950 ddns-scripts: add ionos.com dyndns provider
Adds ionos.com as predefined DDNS service. IONOS' dynamic DNS API
only supports domains hosted at IONOS and uses a single fixed
update URL with a generated token as password. Both ipv4 and ipv6
updates use the same endpoint, distinguished by explicitly passing
the detected address via the ipv4= or ipv6= query parameter as
documented by IONOS. Verified working separately for both A and
AAAA record updates against a live domain.

Signed-off-by: Lasse Hanschen <lh@databloat.ch>
2026-10-02 15:54:35 +02:00
Christian Lachner 2a70ef9489 haproxy: update to v3.4.6
- Updated haproxy PKG_VERSION and PKG_HASH
- See changes: http://git.haproxy.org/?p=haproxy-3.4.git;a=shortlog

Signed-off-by: Christian Lachner <gladiac@gmail.com>
2026-10-02 11:01:07 +02:00
Rob White 6fef7b9142 mesh11sd: update to version 7.3.0
Maintainer: Rob White rob@blue-wave.net

Compile tested: All

Run tested: OpenWrt 25.12 and master/snapshot.

Description: mesh11sd (7.3.0)

This version adds pinning of the mesh gateway ARP to the active portal for the peer,
thereby providing reliable ipv4 on multi-portal backhauls.
Additional detected, but non selected portals, cannot retarget the peer or its clients.

The patches of the previous version in this feed are no longer needed so have been removed.

The full changelog can be seen here:
https://github.com/openNDS/mesh11sd/blob/7.3.0/ChangeLog

Signed-off-by: Rob White <rob@blue-wave.net>
2026-10-02 10:01:01 +02:00
Daniel F. Dickinson 88019052fa watchcat: resolve interface resolution race
- Add interface trigger handling in watchcat.init
- Log when raw interface trigger is activated by any interface coming up
- Move helper functions to separate file
- Update Makefile to install new functions file

Closes: #30463

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
2026-10-02 07:56:11 +03:00
Daniel F. Dickinson e8f3c850a6 watchcat: silence shellcheck false positives
We use shellcheck even though it is pedantic to assist in reducing
errors. Therefore, we add shellcheck directives to silence false
positives. We keep changes minimal as some shellcheck suggestions
result in watchcat failing to function properly.

Also make formatting shmt clean (using -ln=bash due to ash constructs
that shfmt 3.8.0 does not accept for posix shells including busybox).

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
2026-10-02 07:56:11 +03:00
Marcin Maj c637ea92e3 minidlna: fix build with FFmpeg 7 and later
FFmpeg 7 removed AVCodecParameters.channels, causing MiniDLNA 1.3.3
to fail to compile when reading audio channel counts.

Add an OpenWrt package patch to use ch_layout.nb_channels with
libavcodec 61 and later. Retain the existing channels field access
for older versions.

Signed-off-by: Marcin Maj <marcinmajsc@gmail.com>
2026-10-01 19:44:58 +03:00
Alexandru Ardelean edf3fcab2c ocserv: disable TCP wrappers
libwrap is auto-detected from the sysroot and is not in DEPENDS. When
found, the link fails: ocserv assigns to allow_severity and
deny_severity without defining them. Fails on all 35 targets.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-10-01 19:19:51 +03:00
Alexandru Ardelean c101d7ae03 xfrpc: do not link wolfSSL
Upstream enables wolfSSL whenever it finds it in the sysroot, leaving
libwolfssl.so undeclared and packaging broken on all 35 targets. OpenSSL
is already pulled in via libevent2-openssl and upstream supports it, so
build against that alone.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
2026-10-01 16:59:09 +03:00
Luiz Angelo Daros de Luca a97c6d1bc1 libvpx: update to 1.17.0
- Multiple security fixes for heap buffer overflows, out-of-bounds
  writes, and integer overflows. No CVE mentioned.
- Enforces ISO C11 standard.
- Added new Arm Neon (DotProd) and x86 (AVX2/AVX512) paths.
- It is ABI compatible with 1.16.0.

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
2026-10-01 15:43:09 +03:00
Elly Sai 5ff92c77ad ddns-scripts: add alviy.com provider
Add Alviy DDNS provider (dyndns2 API), IPv4.

Howto:

    set [USERNAME] to the Alviy account e-mail
    set [PASSWORD] to the host DDNS token
    set [DOMAIN] to the hostname

https://www.alviy.com/en/docs/update-api
Signed-off-by: Elly Sai <alviy.dns@gmail.com>
2026-10-01 07:57:23 +02:00
Florian Eckert 95d73ebcc9 strongswan: bump PKG_RELEASE by one
Update 'PKG_RELEASE'.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2026-09-30 11:58:51 +02:00