Run dependabot every Saturday and label PRs with GitHub/CI and
dependencies labels.
Signed-off-by: George Sapkin <george@sapk.in>
(cherry picked from commit b19c784ca4)
Add dependabot config to automatically check for action updates once a
week and open PRs if any are found.
Signed-off-by: George Sapkin <george@sapk.in>
(cherry picked from commit c1f0e9ce19)
Add 'Add package' label when a new Makefile is added or 'Drop package'
when a Makefile is deleted.
Label PRs to OpenWrt 25.12 branch.
Label CI-related PRs.
Signed-off-by: George Sapkin <george@sapk.in>
(cherry picked from commit c7ccba0cf2)
- Fix technically undefined behavior when comparing return value from
realloc to the original pointer
- Update mapfile patch 11, removing stray line and improving the
efficiency of the original fix
- Fix read builtin to avoid cases where -1 is used as an index into the
input buffer
Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
(cherry picked from commit bdd34b5a27)
- fixed log monitor source-IP spoofing (GHSA-r6hx-4f83-vp8m)
Fix: per-ban_logterm source anchoring — the real source (last IP in the line)
is used by default; opt-in 'first:' prefix for source-first formats (web-server access logs).
- add f_mem() helper to read MemAvailable from /proc/meminfo
- cap the auto-detected CPU core count by available memory in f_system:
ban_cores is limited to MemAvailable / 48 (MiB per job), floored to at least 1 core;
this bounds the number of feeds processed in parallel on constrained devices,
a user-set ban_cores is still honored as a ceiling (the cap only ever lowers it).
- derive the GNU sort buffer size from available memory, applied only when
coreutils sort is present; busybox sort is a no-op
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit b4616e8060)
f5be8d0ee836 radius-client: fix printf format warning for uint64_t
815a28c49293 CMakeLists: set minimum required version to 3.10 for cmake 4.x
913980c0249f uspotfilter: switch to an RTNL active poll system
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
(cherry picked from commit 1d7afc40f3)
Describe the configuration files for bsbf-bonding and bsbf-mptcp so that
they are automatically included when taking a system backup.
Signed-off-by: Chester A. Unal <chester.a.unal@arinc9.com>
(cherry picked from commit de9e76d391)
(cherry picked from commit 974c2be6b8)
ovpn-dco is currently incompatible with the SafeXcel EIP-197
cryptographic engine. Disable async until this is fixed.
run and compile tested on X86
Signed-off-by: Qingfang Deng <dqfext@gmail.com>
Signed-off-by: Erik Conijn <egc112@msn.com>
(cherry picked from commit c53d53ff93)
Maintainer: Alexandru Ardelean ardeleanalex@gmail.com
ping @feckert @commodo
A dependency of kmod-ovpn-backports seems missing this patch adds that dependency.
Backport from: c53d53f
I have compile and run tested it on X86-25.12
Please have a look and consider implementing.
Thanks
Signed-off-by: Andy Chiang <AndyChiang_git@outlook.com>
Signed-off-by: Erik Conijn <egc112@msn.com>
Changelog since 0.9.6.1:
- add product version number to the PRODID tag in iCalendar output
- add support for GEO tags in vCards
- various bugfixes and compatibility improvements
Also need to update setup.cfg at build time to insert the version
to allow the package to build.
Otherwise we get
```
2026-04-21T08:17:17.9341927Z File "/builder/staging_dir/hostpkg/lib/python3.14/site-packages/setuptools/config/setupcfg.py", line 296, in __setitem__
2026-04-21T08:17:17.9342520Z parsed = self.parsers.get(option_name, lambda x: x)(value)
2026-04-21T08:17:17.9343117Z File "/builder/staging_dir/hostpkg/lib/python3.14/site-packages/setuptools/config/setupcfg.py", line 602, in _parse_version
2026-04-21T08:17:17.9343777Z return expand.version(self._parse_attr(value, self.package_dir, self.root_dir))
2026-04-21T08:17:17.9344201Z ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
2026-04-21T08:17:17.9344938Z File "/builder/staging_dir/hostpkg/lib/python3.14/site-packages/setuptools/config/setupcfg.py", line 421, in _parse_attr
2026-04-21T08:17:17.9345544Z return expand.read_attr(attr_desc, package_dir, root_dir)
2026-04-21T08:17:17.9345876Z ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
2026-04-21T08:17:17.9346409Z File "/builder/staging_dir/hostpkg/lib/python3.14/site-packages/setuptools/config/expand.py", line 191, in read_attr
2026-04-21T08:17:17.9346947Z return getattr(module, attr_name)
2026-04-21T08:17:17.9347261Z AttributeError: module 'vobject' has no attribute 'VERSION'
2026-04-21T08:17:17.9598878Z
```
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 970bbeb3b5)
Bump to latest release (3.7.2) and adjust dependencies accordingly.
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
(cherry picked from commit 4a85cc3317)
Remove unwanted cspell hints from Makefile and initscript.
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
(cherry picked from commit d0a7d402f9)
Updated from 4.04.856 to 5.06.909.
Changes:
- Switch from git clone to tarball download
- Add start_time/end_time scheduling support for tcp/http/https/socks5
- Add service_type validation for tcp (ssh/mstsc/rdp/vnc/telnet)
- Add iod proxy type support
- Add WAN up auto-restart trigger
- Add -s startup parameter
Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>
(cherry picked from commit a1103ac37e)
Update to version 1.9.24. (Mostly security fixes)
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 28e1008974)
[backport also license info change and https change]
- add f_mem() helper to read MemAvailable from /proc/meminfo,
replacing three duplicated inline reads in f_load, f_dns and f_jsnup
- cap the auto-detected CPU core count by available memory in f_load:
adb_cores is limited to MemAvailable / 48 (MiB per job), floored to at least 1 core;
this bounds the number of feeds processed in parallel on constrained devices,
a user-set adb_cores is still honored as a ceiling (the cap only ever lowers it).
- derive the GNU sort buffer size from available memory
- readme update:
- added a "low memory systems" recommendation to use
the zram-swap package (compressed swap) with a swappiness hint,
plus a sizing rule of thumb — this works for all DNS backends OOTB
- significantly expanded the custom-feeds section (all JSON fields, rule parameters, etc.)
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit c2a00f2db0)
Don't override the upstream build ID logic to hopefully improve
reproducibility.
Signed-off-by: George Sapkin <george@sapk.in>
(cherry picked from commit 6149f90711)
default feed updates:
- urlhaus, urlvir, webclient: switched from in to out
and added a tcp udp 80 443 port limit (destination feeds for LAN-initiated traffic)
- feodo, spamhaus, threat, threatview, proxy, tor, vpn, vpndc: switched from in to inout
- threatview: added url_6, as the source ships IPv4 and IPv6 in a single file
- country / asn: intentionally left on in; documented how to switch them to outbound/both
for the recurring "block connections to country X" case
- readme update:
- corrected the feed table to match the above,
- removed the stale drop row (replaced by spamhaus),
- and reworked the chain explanation to clarify the inbound-vs-outbound (source-IP vs destination-IP) model
- significantly expanded the custom-feeds section (all JSON fields, rule parameters, etc.
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit f5160c8aa1)
The exit command was running unconditionally which broke the system
configuration. Fix that and simplify the wan interface check.
Run network.wan deletion quietly in case it doesn't exist.
Signed-off-by: Chester A. Unal <chester.a.unal@arinc9.com>
(cherry picked from commit 8262543989)
Firewall will be reloaded when there's ifup so don't reload it.
Signed-off-by: Chester A. Unal <chester.a.unal@arinc9.com>
(cherry picked from commit 8522406a1c)
Update bsbf-resources to the GIT HEAD of 2026-06-19.
- files/etc/uci-defaults/99-bsbf-bonding:
- Simplify the script and make sure multiple wan interfaces are processed
properly.
- Use routing table 1 instead of 100.
- Make it able to install the bsbf-bonding package without needing
bsbf-client-openwrt-installer.
- files/usr/sbin/bsbf-bonding:
- Move uninstall functionality to makefile.
Signed-off-by: Chester A. Unal <chester.a.unal@arinc9.com>
(cherry picked from commit 70e1b46a22)
harden captive portal auto-login script handling:
* enforce the login-script allowlist in the backend instead of the
LuCI frontend only: canonicalize the configured path via 'readlink -f'
(defeats ../ traversal and symlink-to-interpreter tricks) and require a
regular, executable /etc/travelmate/*.login file before running it
* run the script in a noglob subshell ('set -f') so attacker-influenceable
script_args can no longer expand globs into the trusted script; field
splitting (multiple args) is preserved
* writing into /etc/travelmate/ is not covered by the luci-app-travelmate
ACL, so this limits the root-executed script to admin-placed login scripts
and closes a delegated-ACL to root command execution path.
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 0627b412ee)
- fix uplink teardown for bssid-pinned stations
the new implementaion reads the sta object once and parses fields by name via jshn
(isolated namespace, single fork). Bug finder: @adam8833 (#29768)
- add a fork-free f_normbssid() helper and normalize all config-side bssids
to upper case before comparison (in f_getcfg(), covering all callers, and
on the direct scan comparisons in f_main()).
- LuCI: adds a normBssid() helper function as well
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 71d92bcc9e)
Maintainer: me
Compile tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Run tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Description:
Update to 1.2.4
- Update PKG_VERSION to 1.2.4 and PKG_RELEASE to 2.
- Update documentation URL from melmac.ca to mossdef.org.
README.md:
- Update documentation URL from melmac.ca to mossdef.org.
files/etc/config/adblock-fast:
- Add default option `download_connect_timeout '10'`.
- Add default option `download_allow_insecure '1'`.
- Set default `parallel_downloads` to `8`.
- Remove commented `download_max_time` line.
files/etc/init.d/adblock-fast:
- Increment `initCompat` to 17.
- Add `download_connect_timeout`, `download_max_time`,
`download_allow_insecure` to config validation schema.
files/etc/uci-defaults/90-adblock-fast:
- Use `initCompat` from init script to stamp `config_compat`.
- Migrate `parallel_downloads` from boolean to numeric cap for compat < 15.
- Seed new `download_connect_timeout` from old `download_timeout`
for compat < 16.
- Add new `config_compat` and `config_version` stamping.
files/lib/adblock-fast/adblock-fast.uc:
- Increment package `compat` to 17.
- Introduce `task_slot_ram` for per-downloader memory budgeting.
- Add `download_connect_timeout`, `download_max_time`,
`download_allow_insecure` to `reload` triggers.
- Store `downloader` kind and track `_last_dl_timeout` status.
- Refine downloader detection: prefer curl, then uclient-fetch, then
GNU wget, finally generic wget.
- Update `curl` command flags for `--insecure`, `--connect-timeout`,
`--speed-limit`/`--speed-time`, `--max-time`.
- Update `uclient-fetch` flags for `--no-check-certificate`.
- Update `wget` flags for `--no-check-certificate`,
`--connect-timeout`, `--read-timeout`.
- Improve SSL support detection for uclient-fetch.
- Capture `curl` exit code 28 as a distinct timeout failure.
- Expand `get_text` cases for `errorDetectingFileType`,
`warningMissingRecommendedPackages` (args), `warningParallelDownloadsThrottled`,
`warningDownloadTimeout`.
- Allow `download_allow_insecure` for `get_url_filesize` calls.
- Set `download_allow_insecure` default to true in `config_schema`.
- Change `parallel_downloads` from boolean to integer `8` default in
`config_schema`.
- Add `download_connect_timeout` and `download_max_time` to `config_schema`.
- Read up to 4KB for `detect_file_type`.
- Improve `warningMissingRecommendedPackages` output: list missing
packages and use `apk` or `opkg` install command.
- Split `process_file_url` into parallelizable `prepare_file_url`
and serial `apply_result`, plus `emit_dl_line`.
- Implement memory-aware throttling for `parallel_downloads`.
- Revert to single `process_file_url` for serial uses and test runner.
- Correct `get_mem_available` to return current free memory only.
- Rename `get_mem_total` to `get_mem_available`.
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 57bc3f85ae)
Signed-off-by: Stan Grishin <stangri@melmac.ca>
Dependencies for plugin authn_gssapi, authn_ldap, authn_pam, authn_dbi
and authn_sasl are not correctly written.
This cause lighttpd package to always compile krb5-libs, libopenldap and
libpam, even if not selected
Before the fix:
grep -e libpam -e krb5-libs -e libopenldap .config
\# CONFIG_PACKAGE_libpam is not set
\# CONFIG_PACKAGE_libopenldap is not set
\# CONFIG_PACKAGE_krb5-libs is not set
make | grep -e libpam -e krb5 -e ldap
make[3] -C feeds/packages/net/krb5 compile
make[3] -C feeds/packages/libs/libpam compile
make[3] -C feeds/packages/libs/openldap compile
With the fix:
make | grep -e libpam -e krb5 -e ldap
"nothing compiled"
Check that fix works when mod-authn tokens are
selected (select lighttpd-mod-authn_xxx):
grep lighttpd-mod-authn .config
CONFIG_PACKAGE_lighttpd-mod-authn_file=y
CONFIG_PACKAGE_lighttpd-mod-authn_gssapi=m
CONFIG_PACKAGE_lighttpd-mod-authn_ldap=m
CONFIG_PACKAGE_lighttpd-mod-authn_pam=y
make | grep -e libpam -e krb5 -e ldap
make[3] -C feeds/packages/net/krb5 compile
make[3] -C feeds/packages/libs/libpam compile
make[3] -C feeds/packages/libs/openldap compile
x-ref:
"lighttpd: Malformed dependencies cause unselected packages to be compiled"
https://github.com/openwrt/packages/pull/28157
github: closes#28157
Signed-off-by: Alarcon Laurent <laurent.alarcon@sagemcom.com>
Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
(cherry picked from commit ee21a8b227)
Add a patch fixing a possible crash, when a non-responding host is
tried to be pinged and retry attempts are limited by MaxMissed option.
> daemon.err: collectd[14133]: ping plugin: host 192.168.1.99 has not answered 3 PING requests, triggering resolve
> daemon.info: procd: Instance collectd::instance1 s in a crash loop 7 crashes, 3 seconds since last crash
Fixes: #29649
* upstream bug created: https://github.com/collectd/collectd/issues/4406
* older upstream bug: https://github.com/collectd/collectd/issues/3079
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit eb21982576)
The link flag makes the main program depend on liblua in official
package feeds, even if collectd-mod-lua is not installed.
The plugin is already linked against liblua.so, so this can be removed.
Signed-off-by: Qingfang Deng <dqfext@gmail.com>
[added PKG_RELEASE bump]
(cherry picked from commit aa0a14e2dd)
The lxc-unprivileged package depends on both newgidmap and newuidmap
if users are installing and setting it up for the first time. dc52894
dropped both of the applets.
This change builds libusbid as a shared lib which builds a versioned
symbol which OpenWrt does not stage so build with --disable-shared
and --enable-static to avoid a failure.
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 5883c07493)
George Sapkin
dependabot[bot]
Wei-Ting Yang
Hauke Mehrtens
Rui Salvaterra
Thibaut VARÈNE
Chester A. Unal
Erik Conijn
Qingfang Deng
Andy Chiang
Alexandru Ardelean
Daniel F. Dickinson
Hirokazu MORIKAWA
Glenn Strauss
Dengfeng Liu
Hannu Nyman
Dirk Brenken
Daniel Golle
Stan Grishin
Alarcon Laurent
Antonio Pastor
John Audia
Jan Havelka