owntone: update to 28.11

Since version 28.10, OwnTone uses libxml2 instead of mxml

Signed-off-by: Espen Jürgensen <espenjurgensen+openwrt@gmail.com>

squeezelite: update to 2.0.0.1518

Refresh sound/squeezelite/patches/010-select_broadcast_interface.patch

Signed-off-by: Kel Modderman <kelvmod@gmail.com>

libfmt: bump to new release 11.1.3

Signed-off-by: Othmar Truniger <github@truniger.ch>

vnstat2: update to version 2.13

Signed-off-by: Jan Hoffmann <jan@3e8.eu>

nextdns: Update to version 1.44.6

Signed-off-by: Olivier Poitrey <rs@nextdns.io>

curl: bump to 8.12.1

Signed-off-by: Rudy Andram <rmandrad@gmail.com>

adblock: update 4.2.4-2

* properly handle forced DNS ports <> 53,
  no longer make bogus local redirects, reject them instead (fixed #25897)
* support the jail mode for smartdns
* cosmetics

Signed-off-by: Dirk Brenken <dev@brenken.org>

banIP: release 1.5.1-1

* optimized the f_nftload function
* reduced the prerouting priority to -175
* optimized the output of the f_survey function
* removed a needless fw4 call/check
* no longer skips regular blocklist feeds in "allowlist only" mode
* optimized init checks
* turris feed: enable IPv6 parsing, too (prvided by @curbengh)
* update the readme

Signed-off-by: Dirk Brenken <dev@brenken.org>

keepalived: add new uci section config interface_up_down_delays

If an interface that is being used (or tracked) by a VRRP instance goes to
down state, the VRRP instance(s) will, by default, immediately transition to
FAULT state, and when all relevant interfaces are back up again the VRRP
instance(s) will immediately transition to BACKUP state.

This can cause problems if interfaces are bouncing, and so delays can be
specified between the interface state change and the transition to
FAULT/BACKUP state. If the interface returns to its original state before
the delay expires, no associated VRRP instance state transition will occur.

New uci section 'interface_up_down_delay':

config interface_up_down_delays
option device <device>
option down_delay <number in seconds>
option up_delay <number in seconds>

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

ddns-script: add retry_max_count's upgrade script

Signed-off-by: FriesI23 Qin <FriesI23@outlook.com>

ddns-script: fix retry_max_count for luadns-v1

Fix missed modification of ‘retry_count’ to ‘retry_max_count’
in commit ‘e3292e4c97’ (rename variable: s/retry_count/retry_max_count/).

Signed-off-by: FriesI23 Qin <FriesI23@outlook.com>

ddns-script: fix retry_max_count for godaddy-v1

Fix missed modification of ‘retry_count’ to ‘retry_max_count’
in commit ‘e3292e4c97’ (rename variable: s/retry_count/retry_max_count/).

Signed-off-by: FriesI23 Qin <FriesI23@outlook.com>

ddns-script: fix retry_max_count for dnspod

Fix missed modification of ‘retry_count’ to ‘retry_max_count’
in commit ‘e3292e4c97’ (rename variable: s/retry_count/retry_max_count/).

Signed-off-by: FriesI23 Qin <FriesI23@outlook.com>

ddns-script: fix retry_max_count for cloudflare-v4

Fix missed modification of ‘retry_count’ to ‘retry_max_count’
in commit ‘e3292e4c97’ (rename variable: s/retry_count/retry_max_count/).

Signed-off-by: FriesI23 Qin <FriesI23@outlook.com>

ddns-script: fix retry_max_count at sample config

Fix missed modification of ‘retry_count’ to ‘retry_max_count’
in commit ‘e3292e4c97’ (rename variable: s/retry_count/retry_max_count/).

Signed-off-by: FriesI23 Qin <FriesI23@outlook.com>

pbr: update to 1.1.8-10

* Improve verbose output on start
* Allow to not create ip rule for WG server
* Improve boot up start (take 2)
* Improve verbose output when setting triggers
* Override DNS hijack with DNS policies from pbr

Signed-off-by: Stan Grishin <stangri@melmac.ca>

https-dns-proxy: bugfix: start on boot

* bugfix: working start on boot when interfaces are up
  (thanks @tmcqueen-materials and @b1ackbeat)
* improvement: better output when setting triggers on start

Signed-off-by: Stan Grishin <stangri@melmac.ca>

modemmanager: do not disable modem on reconnect

If the modem loses the connection, an attempt is made to re-establish the
connection via the report-down script.

Until now, the modem was disabled when the modem processed the teardown of
the modemmanager protohandler. The immediate up events of netifd renables
the modem right away. This takes time, which is not necessary.

This commit changes the behavior so that the modem is not disabled when
the modemmanager is disconnected via the report-down script.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

libs/srt: bump to 1.5.4

- No API/ABI changes
- Changelog: https://github.com/Haivision/srt/releases/tag/v1.5.4

Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>

sing-box: Update to 1.11.3

Signed-off-by: Mosney Strange <Mosney@users.noreply.github.com>

haproxy: update to v3.0.8

- Update haproxy PKG_VERSION and PKG_HASH
- See changes: http://git.haproxy.org/?p=haproxy-3.0.git;a=shortlog

Signed-off-by: Christian Lachner <gladiac@gmail.com>

eza: update to 0.20.20

changelogs:
0.20.16: https://github.com/eza-community/eza/releases/tag/v0.20.16
0.20.17: https://github.com/eza-community/eza/releases/tag/v0.20.17
0.20.18: https://github.com/eza-community/eza/releases/tag/v0.20.18
0.20.19: https://github.com/eza-community/eza/releases/tag/v0.20.19
0.20.20: https://github.com/eza-community/eza/releases/tag/v0.20.20

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>

nextdns: Update to version 1.44.5

Signed-off-by: Olivier Poitrey <rs@nextdns.io>

antiblock: Update to 2.0.2

Fixed a bug using a non-thread-safe hashmap

Signed-off-by: Khachatryan Karen <karen0734@gmail.com>

lsd: update to latest stable/1.1.5

Signed-off-by: Keith T. Garner <kgarner@kgarner.com>

shairport-sync: update to 4.3.6

Drop patches/100-mbedtls3fix.patch: applied in upstream commit d73b585

Signed-off-by: Kel Modderman <kelvmod@gmail.com>

oci-runtime-tools: update to GIT HEAD of 2024-11-08

Bumps OCI runtime spec to version 1.1.0.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

gnunet-fuse: update to 0.23.0

Updates to GNUnet 0.23 API.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

gnunet: update to v0.23.1

v0.23.0 (tagged as v0.23.1)
  - Add GNUNET_CONFIGURATION_set_value_float
  - util: Float configuration values are no longer locale-dependent, but instead must always be in LC_NUMERIC=C format
  - GNUNET_DISK_internal_file_handle_ changed to always return int
  - Reworkd ProjectData handling; Now required as input for various API calls.

v0.22.2:
  - GNUNET_STRINGS_get_utf8_args removed.
  - Removed unsafe and unused functions for 2d/3d array allocation.

v0.22.1:
  - Update HELLO files for new bootstrap peer
  - Fix regression in DHT Bloom filter
  - Fix long-standing regression in HELLO URI expirations

v0.22.0:
  - New logging API to print/parse hex bytes
  - Added RFC9180 HPKE and associated KEMs
  - Replace oneshot PKE and KEM APIs with HPKE
  - New Elligator KEM
  - Namestore API allows multiple records to be inserted in a single transaction (if plugin supports this)
  - New ECDH API that uses KDFs instead of hash
  - Renamed GNUNET_CRYPTO_hkdf to GNUNET_CRYPTO_hkdf_gnunet
  - Added new standard SHA256-based HKDF APIs
  - New hostlist bootstrap domain https://bootstrap.gnunet.org

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

postgresql: update to version 17.2

Update PostgreSQL to new (major) version 17.2
See https://www.postgresql.org/docs/release/17.2/ for more details.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

ell: update to version 0.71

Upstream changes:
 f99041d Release 0.71
 19e448a test-rtnl: fix -std=c23 build failure
 22a4388 dbus: fix -std=c23 build failure
 65a5b0b cert: fix -std=c23 build failure
 91bc3da settings: fix -std=c23 build failure

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

dnsproxy: Update to 0.75.0

Fix passing value to hosts-file-enabled argument.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

snort3: update to 3.6.3.0

Changelog: https://github.com/snort3/snort3/releases/tag/3.6.3.0

Signed-off-by: John Audia <therealgraysky@proton.me>

antiblock: Update to 2.0.1

Updated hashmap version.
In the code, almost all the url words have been replaced with domain.
Fixed a bug in the service of getting gateway from VPN name.

Signed-off-by: Khachatryan Karen <karen0734@gmail.com>

golang: Update to 1.23.6

go1.23.5 (released 2025-01-16) includes security fixes to the
crypto/x509 and net/http packages, as well as bug fixes to the
compiler, the runtime, and the net package.

go1.23.6 (released 2025-02-04) includes security fixes to the
crypto/elliptic package, as well as bug fixes to the compiler
and the go command.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

prometheus-node-exporter-ucode: fix missing .so mounts in jail

Signed-off-by: Anirudh Srinivasan <anirudhsriniv@gmail.com>

pdns: update to 4.9.4

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>

netbird: update to 0.36.5

changelog: https://github.com/netbirdio/netbird/releases/tag/v0.36.5

Signed-off-by: Wesley Gimenes <wehagy@proton.me>

ddns-scripts: add ydns.io provider

keepalived: add support for directory sync

This commit adds support for folder synchronization.
An example is in the 810-files file where it is explained how to
synchronize all hotplug files of keepalived.

Signed-off-by: Francesco Benini <francy.benini@gmail.com>

sing-box: Update to 1.11.1

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

lua-cjson: add build VARIANT for Lua5.3

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>

ddns-scripts: add type field for digitalocean API

DigitalOcean API requires a "type" JSON field to update a DNS
record. This adds that while checking for IPv6 to change which
record type to use. Without it, the API call fails, making
the script unable to update the DNS records for DigitalOcean.

Signed-off-by: Adam Beck <subcursion@gmail.com>

keepalived: add ubus status

The hotplug scripts are called with every state change. When called, the
scripts are processed under '/etc/hotplug.d/keepalived'. This change adds
the functionality that the last state change of the keepalived can be
queried via the ubus.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

rclone: Update to 1.69.0

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

strongswan: fix compilation against wolfssl

Backports upstream patch fix compilation error against recent versions of wolfssl.

Closes https://github.com/openwrt/packages/issues/25877

Signed-off-by: Matt Eaton <git@divinehawk.com>

sing-box: Update to 1.11.0

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

alist: Update to 3.42.0

Fix the value of conf.WebVersion.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

cloudflared: Update to 2025.1.1

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

v2ray-geodata: Update to latest version

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

v2ray-core: Update to 5.26.0

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

xray-core: Update to 25.1.30

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

banIP: update 1.5.0-6

* fixed  the incomplete rule maintainance during banIP reloads
* fixed the Set query function (if the Set counters are disabled)

Signed-off-by: Dirk Brenken <dev@brenken.org>

netatalk: add uci support

Signed-off-by: Antonio Pastor <antonio.pastor@gmail.com>

netatalk: create small and full variants

Small version includes only AFP file sharing to minimize size.
Base version adds AppleTalk. This matches the contents of the
existing package.
Full version includes everything that OpenWrt can support and
configuration option for build system (menuconfig).

Signed-off-by: Antonio Pastor <antonio.pastor@gmail.com>

netatalk: update to 4.1.1

Signed-off-by: Antonio Pastor <antonio.pastor@gmail.com>

tailscale: update to 1.80.0

Signed-off-by: Sandro Jäckel <sandro.jaeckel@gmail.com>

cryptsetup: update to version 2.7.5

Enable building cryptsetup-reencrypt, integritysetup and veritysetup,
add new binary packages for integritysetup and veritysetup.

Changes since version 2.7.4
~~~~~~~~~~~~~~~~~~~~~~~~~~~
* Fix possible online reencryption data corruption (only in 2.7.x).

  In some situations (initializing a suspended device-mapper device),
  cryptsetup disabled direct-io device access. This caused unsafe
  online reencryption operations that could lead to data corruption.
  The code now adds strict checks (and aborts the operation) and
  changes direct-io detection code to prevent data corruption.

* Fix a clang compilation error in SSH token plugin.

  As clang linker treats missing symbols as errors, the linker phase
  for the SSH token failed as the optional cryptsetup_token_buffer_free
  was not defined.

* Fix crypto backend initialization in crypt_format_luks2_opal API call.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

frr: 10.2.1 fixes

add packing mgmtd, pim6d and update helper scripts

Signed-off-by: Lucian CRISTIAN <lucian.cristian@gmail.com>

bind: bump to 9.20.5

Fixes CVEs:
- CVE-2024-12705: DNS-over-HTTPS flooding
- CVE-2024-11187: Limit additional section processing for large RDATA sets

Signed-off-by: Noah Meyerhans <frodo@morgul.net>

knot: update to version 3.4.4

Signed-off-by: Jan Hák <jan.hak@nic.cz>

snort3: update to 3.6.2.0

Changelog: https://github.com/snort3/snort3/releases/tag/3.6.2.0

% snort --version

   ,,_     -*> Snort++ <*-
  o"  )~   Version 3.6.2.0
   ''''    By Martin Roesch & The Snort Team
           http://snort.org/contact#team
           Copyright (C) 2014-2024 Cisco and/or its affiliates. All rights reserved.
           Copyright (C) 1998-2013 Sourcefire, Inc., et al.
           Using DAQ version 3.0.18
           Using Hyperscan version 5.4.2 2025-01-28
           Using libpcap version 1.10.5 (with TPACKET_V3)
           Using LuaJIT version 2.1.0-beta3
           Using LZMA version 5.6.2
           Using OpenSSL 3.0.15 3 Sep 2024
           Using PCRE2 version 10.42 2022-12-11
           Using ZLIB version 1.3.1

Signed-off-by: John Audia <therealgraysky@proton.me>

libdaq3: update to 3.0.18

Update to latest version.

Changelog: https://github.com/snort3/libdaq/releases/tag/v3.0.18

Signed-off-by: John Audia <therealgraysky@proton.me>

owut: update to 2025.01.29

Bug fixes:
    efahl/owut@bced54a owut: prefer use of packages_changes when generating build request
    efahl/owut@b469547 owut: revert rootfs restrictions

Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>

https-dns-proxy: bugfixes and improvements

* improvement: Makefile: prepend `r` to PKG_RELEASE in binary and init script versions to match package version
* bugfix: init script: more reliable/robust start on boot
* improvement: init script: more compact output()
* improvement: init script: better DNS Hijack login
* improvement: init script: fold some dnsmasq-related functions into dhcp_backup()

Signed-off-by: Stan Grishin <stangri@melmac.ca>

adblock-fast: bugfixes: boot-up, StevenBlack list, new CERT.pl source

* bugfix: more robust boot-up start
* bugfix: processing of StevenBlack lists
* new remote block-list: CERT.pl

Signed-off-by: Stan Grishin <stangri@melmac.ca>

adblock: update 4.2.4-1

* support smartdns as dns backend
* support top level domains in local white- and blackklist,
  e.g. a 'de' in the blacklist blocks all domains with a german tld
  and the tld compression removes all subdomains from the final blocklist

Signed-off-by: Dirk Brenken <dev@brenken.org>

pbr: bugfixes: boot-up and negative dest_addr

* bugfix: more robust boot-up behaviour, obsoleting following config
  options: procd_boot_delay, procd_boot_timeout, procd_wan_ignore_status
* bugfix: fix typo in processing negations on dest_addr

Signed-off-by: Stan Grishin <stangri@melmac.ca>

banip: update 1.5.0-5

* fix a reporting issue with multiple ports/protocols

Signed-off-by: Dirk Brenken <dev@brenken.org>

fastd: update to v23

Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>

owut: update to 2025.01.25

Bug fixes:
    efahl/owut@2bf45d5 owut: exit immediately on ctrl-c
    efahl/owut@a95d383 owut: fix processing of device defaults
    efahl/owut@cd63564 owut: disallow --rootfs-size changes on some platforms
Enhancements:
    efahl/owut@eaca182 owut: minor code cleanup in sha256 calculator
    efahl/owut@2b65aa7 owut: improve messaging
    efahl/owut@d687824 git: define file attributes

Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>

openssh: fix recursive key file removal

The -r option is not required here but should also not hurt,
since it was already tested, that $key is a file.
However, to express the intent of the command more clearly,
let's drop it.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

v2ray-core: Update to 5.25.1

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

banip: Block UDP ports for HTTP/3

Block HTTP/3 by including UDP in the feeds that have the 80 443 ports in
their flag.

Signed-off-by: Juan Orti Alcaine <jorti@pm.me>

net-mtools: bump to release 3.2

Fix regression with detecting multicast ipv6 packet.

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>

yggdrasil: update to 0.5.12

Signed-off-by: Ivan Chashkin <mail@cupivan.ru>

openssh: Validate keys and regenerate if needed.

Imitate dropbear init.d-script and make sure we
don't end up with corrupt keys.

This can happen if we use a caching filesystem,
like 'ubifs', and the DUT is powered off during
boot-up.

Signed-off-by: Markus Gothe <markus.gothe@genexis.eu>

openssh: fix killing of active sessions on shutdown

Starting with OpenSSH 9.8 sessions are handled by a separate binary
called sshd-session

Signed-off-by: Erik Karlsson <erik.karlsson@iopsys.eu>

php8-pecl-dio: update to 0.3.0

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

php8-pecl-http: update to 4.2.6

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

php8-pecl-xdebug: update to 3.4.1

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

php8-pecl-redis: update to 6.1.0

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

php8-pecl-krb5: update to 1.2.2

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

coova-chilli: Fix WolfSSL support

Signed-off-by: Federico Capoano <f.capoano@openwisp.io>

nut: add --without-nut_monitor to configure args
nut_monitor is not used anyway and is needlessly built & does not work with python 3.13

Signed-off-by: Jan Klos <jan@klos.xyz>

ddns-scripts: get l3 device for bind network using curl

If pppoe is used for wan access. script set 'eth1' as interface for curl
call. The correct interface is however 'pppoe-wan'.

These scripts use 'network_get_physdev' function to get real device for
bind_network but this is wrong. We need instead the l3_device of the the
logical interface.

In case if we don't use pppoe connection - 'l3_device' is equal to real device.

Follow P/R:
 #14431

Signed-off-by: Coia Prant <coiaprant@gmail.com>

libfmt: bump to version 11.1.2

Signed-off-by: Othmar Truniger <github@truniger.ch>

frr: update to 10.2.1

update to current stable branch

Signed-off-by: Lucian CRISTIAN <lucian.cristian@gmail.com>

libyang: update to 2.1.128

this is a dependency for updated frr

Signed-off-by: Lucian CRISTIAN <lucian.cristian@gmail.com>

node: January 21, 2025 Security Releases

This is a security release.

Notable Changes

    CVE-2025-23083 - src,loader,permission: throw on InternalWorker use when permission model is enabled (High)
    CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
    CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)

Dependency update:

    CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

hev-socks5-server: update to 2.7.0

Signed-off-by: Ray Wang <r@hev.cc>

hev-socks5-tproxy: update to 2.6.0

Signed-off-by: Ray Wang <r@hev.cc>

uspot: update to Git HEAD (2025-01-20)

57b737a49497 uspot/uspotfilter: s/discon_since/lost_since/
1c2f58000519 uspot/uspotfilter: use native MAC case
70934203a0b7 captive: cleanup
7566c2716eb9 uspot: correctly handle "debug=0"
f5cc70459233 portal: remove unused bits
54cdcf463c36 uspot: remove unused ssid parameter
f13440bd80ff Update issue templates
644fd6f52a8e uspotfilter: apply disconnect delay to active clients only

Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>

banIP: update 1.5.0-3

* better logging of nft load errors
* update the readme

Signed-off-by: Dirk Brenken <dev@brenken.org>

ddns-scripts: Fixup dnspod.cn-v3

Migrate retry_count to retry_max_count in the script to fix infinite retry loop.

Signed-off-by: FriesI23 Qin <FriesI23@outlook.com>

ddns-scripts: Fixup dnspod.cn-v3

Fix signature expiration issue during retries.

Signed-off-by: FriesI23 Qin <FriesI23@outlook.com>

git: Set PKG_FORTIFY_SOURCE to 0 when lto enabled

If PKG_FORTIFY_SOURCE is not 0 and lto is enabled for package git, it
will fail to compile with the following example error:

/openwrt/staging_dir/toolchain-aarch64_generic_gcc-14.1.0_musl/include/stdio.h: In function 'process_curl_messages': /openwrt/staging_dir/toolchain-aarch64_generic_gcc-14.1.0_musl/include/stdio.h:90:8: error: inlining failed in call to 'always_inline' 'fwrite': function body can be overwritten at link time
   90 | size_t fwrite(const void *__restrict, size_t, size_t, FILE *__restrict);
      |        ^
http.c:355:33: note: called from here
  355 |                                 fprintf(stderr, "Received DONE message for unknown request!\n");
      |                                 ^

A related issue is #13016 .
This commit set PKG_FORTIFY_SOURCE to 0 if CONFIG_USE_LTO is y.

Close #24366

Link: https://lore.kernel.org/git/CAHfWF5mjquES-nocQaK+CAEsqWgdy-_OYdGtN82heYs0eJP3eQ@mail.gmail.com/T/#t
Link: https://github.com/openwrt/openwrt/issues/13016
Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110834
Signed-off-by: Ryan Keane <the.ra2.ifv@gmail.com>

zoneinfo: Updated to 2025a release.

Signed-off-by: Vladimir Ulrich <admin@evl.su>

mwan3: Add support for nslookup track method

Signed-off-by: Brian J. Murrell <brian@interlinx.bc.ca>

mwan3: Bug fixes with nping usage

The IP address family is a single dash option and one of 4 or 6, not tcp
or udp.

Signed-off-by: Brian J. Murrell <brian@interlinx.bc.ca>