Merge pull request #16514 from jefferyto/python-cryptography-3.4.8-openwrt-21.02

[openwrt-21.02] python-cryptography: Update to 3.4.8

python-cryptography: Update to 3.4.8

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 69ae9c29a206856af5e737737fcb691c8bce7f08)

tailscale: update to version 1.12.3

Signed-off-by: Jan Pavlinec <jan.pavlinec1@gmail.com>
(cherry picked from commit 23d90cabd2b7fcb8a2d75a96a00b4653988f8af6)

tailscale: update to version 1.12.1

Signed-off-by: Jan Pavlinec <jan.pavlinec1@gmail.com>
(cherry picked from commit bb419b3227a7ac191fe2403899aacd71b791e7c0)

tailscale: update to version 1.8.7

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit fabaf9f184ee90eacec9515dd9fd61ecdaaf9c22)

tailscale: update to version 1.8.1

Add readme with simple tailscale howto.

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit 791de7b5d07e54556888f3c6689b8bf6d29c184d)

Merge pull request #16512 from paper42/libssh-21

[21.02] libssh: update to 0.9.6

libssh: update to 0.9.6

* fixes CVE-2021-3634

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>

htop: Add HTOP_LMSENSORS config option

Enabled by default for x86, this enables lm-sensors support in htop.
Also add --enable-linux-affinity to avoid autodetecting it

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit 37ca4e923d2efe21a4c6c8d8d9ab8b6720a4cd3a)

banip: update 0.7.10

* switch to unencrypted http downloads for ipdeny.com due to persistant certificate issues
* compact json generator code (tested with report files > 2MB)
* various code cleanups and optimizations

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 8ac0103cbdb74e2ec9ea2986c4b80bf83ba00211)
Signed-off-by: Dirk Brenken <dev@brenken.org>

Merge pull request #16494 from 1715173329/xray-2102

[openwrt-21.02] xray-core: fix build under go 1.17

xray-core: fix build under go 1.17

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit dcd3f288e441dac264f4c34e19270e75d38933eb)

golang: Update to 1.17

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit d0aab6b8bc1a687f0c7b62ac2c92be36e2bdd8bd)

gpsd: bump to 3.23

Contains fix for time jumping back 1024 weeks after 23-October-2021.

Changes:

- Between current version and 3.23 the ABI version changed from 27 to
  29. Add ABI_VERSION variable to package as the jumps occur often.
- 0001-no-distutils-import.patch: removed because current patch doesn't
  work with new release and host python3-distutils is a build
  requirement anyway.
- 0002-ncurses6_detection.patch: fixed the patch. Currently the first
  "elif" checks for "ncurses6-config". But this is only provided by
  ncurses/host package, so the CFLAGS then contain includes that point
  into $(STAGING_DIR_HOSTPKG). The ncurses target package only installs
  "ncursesw6-config" into the staging area. So this is the only tool of
  interest. Also, the hunk moved from SConstruct to SConscript.

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>

Merge pull request #16478 from 1715173329/yq-2102

[openwrt-21.02] yq: Update to 4.12.1

yq: Update to 4.12.1

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 8dfc2e06c6b89fe5783fc67c4091a2171c8ed1af)

auc: update to version 0.2.4

 * Brings support for future connexion based API.
 * read `detail` not `message` from server
 * use regular verrevcmp for branch names, fixes update indication
 * break out usage() from main() function
 * require '-f' in case installed package is missing in remote lists
 * don't use ENETUNREACH for unlrelated error
 * Fix check for mandatory fields (stray parenthesis)
 * Don't even fetch package lists if checking only for release.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 8486f64fea140dddb7ca92333ed956f2966e444a)
(cherry picked from commit 23ce5b0e6feb141b272d277a0b72a12add67d9b6)
(cherry picked from commit 2edbc4c805d61d859f5e2af84293cdfb051f7f56)
(cherry picked from commit bd4ad7b0baa3c95c5c8ee88c1aa372030fc6a47a)

yq: Update to 4.12.0

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit c881b29cfdfd274b721775d1d0de71eb02a27201)

apr: patch CVE-2021-35940

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit 0777e40b7472a0b0b77531b6797448f8c15bd586)

Merge pull request #16456 from rs/nextdns-1.36.0-openwrt-21.02

[21.02] nextdns: Update to version 1.36.0

nextdns: Update to version 1.36.0

Signed-off-by: Olivier Poitrey <rs@nextdns.io>

mosquitto: allow auth options with per listener settings

Some settings can be either global or per listener, and we need to
support both forms in UCI.

Signed-off-by: Karl Palsson <karlp@etactica.com>

mosquitto: init: support more UCI options

Recent versions of mosquitto have added a lot more fine grained control
of various options.  Add UCI support for all of them, and fix a couple
of things that were configured as per listener, that are actually global
settings.

Signed-off-by: Karl Palsson <karlp@etactica.com>

airos-dfs-reset: add airos-dfs-reset

Ubiquitis airmax based gear does not fallback to original port after DFS
event is over. This tool triggers the fallback automatically by soft-restarting
unconditionally, whenever the configured freq differs from the running.

Signed-off-by: Simon Polack <spolack+git@mailbox.org>
(cherry picked from commit e36e8a6a3ba5b5fe103b19f6aab9dc1af9a224fa)

Merge pull request #16443 from nwidger/delve-1.7.1-openwrt-21.02

[openwrt-21.02] delve: Update to 1.7.1

[openwrt-21.02] delve: Update to 1.7.1

See
https://github.com/go-delve/delve/blob/master/CHANGELOG.md#171-2021-08-18
for changes.

Signed-off-by: Niels Widger <niels@qacafe.com>
(cherry picked from 3583fd1c2)

phantap: update to latest commit

26bd876 Switch from ifname to device
d8d3d5f Fix blog post link

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit ac2b796704e02a1332c468c9dd9354426142ab7d)

travelmate: update to 2.0.6

* replaced pipe input for a while/read-loop with a here document/variable as input
  (fix various subshell related bugs and oddities)
* further improve abort and re-connection handling
* prevent alleged detected connection failures (false positives) with an additional gw check,
  to stabilize VPN connections in particular

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 1c0fcbd28b01c0af2013fb4ef4ec5e0ad1c881fd)

travelmate: update to 2.0.5-3

* simplify the scan logic, to get rid of nifty IFS tricks
* limit the nearby scan results to process only the strongest uplinks, set 'trm_maxscan' accordingly (default '10')
* update the readme

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 58a3cf1f01f7d29a69f5e3aa82fe5aa060470c47)

https-dns-proxy: patch CMakeList.txt to use OpenWrt CFLAGS

This fixes compilation issues with ASLR PIE enabled

We were compiling with '-g -DDEBUG'

https-dns-proxy_2021-07-29-*_arm_cortex-a9_vfpv3-d16.ipk
shrink from 19514 to 19095

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit 374e1dd56e1742273b261f25a69fd3d46741e357)

dnscrypt-proxy2: Upgrade to 2.1.0

Adjust build opts to force GOPATH mode by setting GO111MODULE off.
Ref: https://go.dev/blog/go116-module-changes

Signed-off-by: Ted Hess <thess@kitschensync.net>
(cherry picked from commit 6981009f4847b1f46ef69ae813f7154b7946e47e)

c-ares: update to version 1.17.2

Missing input validation of host names returned by Domain Name Servers
in the c-ares library can lead to output of wrong hostnames (leading to
Domain Hijacking).

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2021-3672 to this issue.

References: https://c-ares.haxx.se/adv_20210810.html
Signed-off-by: Petr Štetiar <ynezz@true.cz>

mc: add a missing Syntax file

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit 312caff03b17241d2e383eb254b41d35e9225294)
Signed-off-by: Dirk Brenken <dev@brenken.org>

mblaze: new package

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit 80f7a8ec8b5bb208503b89f19e689e372d2c7b5b)

hwdata: update to version 0.350

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 3d5bed38e8e554b39081496d44eed8befb9f1f5f)

tvheadend: update to v4.2.8, remove static ffmpeg

 - refresh patches
 - add missing dependency: libffi

Signed-off-by: Marius Dinu <m95d+git@psihoexpert.ro>
[edited commit message and the maintainer line]

(cherry picked from commit 326da3dbbc57b6c44bc0d0401529531c7d5dfb89)

tvheadend: fix compilation with GCC 9 and 10

Without this, compilation fails because of a fortify-source header.
There's something defining and undefining _GNU_SOURCE somewhere.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 57c6c5e73fd9a3e367364466ea1b7ec1ed8e69c4)

python3-setuptools: add _distutils_hack

I tried to install matplotlib by using pip and it failed with the following output:

2021-08-18T11:52:26,171 Collecting matplotlib
2021-08-18T11:52:26,173   Created temporary directory: /tmp/pip-unpack-wuth2u0e
2021-08-18T11:52:26,565   Using cached matplotlib-3.4.3.tar.gz (37.9 MB)
2021-08-18T11:52:38,659   Added matplotlib from https://files.pythonhosted.org/packages/21/37/           197e68df384ff694f78d687a49ad39f96c67b8d75718bc61503e1676b617/matplotlib-3.4.3.tar.                       gz#sha256=fc4f526dfdb31c9bd6b8ca06bf9fab663ca12f3ec9cdf4496fb44bc680140318 to build tracker '/tmp/pip-   req-tracker-u30x8pht'
2021-08-18T11:52:38,660     Running setup.py (path:/tmp/pip-install-afiyiers/                            matplotlib_8e717e38862f4976a3d6cb1832ba3261/setup.py) egg_info for package matplotlib
2021-08-18T11:52:38,661     Created temporary directory: /tmp/pip-pip-egg-info-kbtiezxq
2021-08-18T11:52:38,662     Running command python setup.py egg_info
2021-08-18T11:52:38,831     Traceback (most recent call last):
2021-08-18T11:52:38,832       File "<string>", line 1, in <module>
2021-08-18T11:52:38,832       File "/usr/lib/python3.9/site-packages/setuptools/__init__.py", line 8, in <module>
2021-08-18T11:52:38,833     ModuleNotFoundError: No module named '_distutils_hack'

More details about it:
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=968410

Once I applied the patch from the bug tracker, I got further to install
it.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit feaaacc10fff283505ff261ed6886a4936fbe7f5)

zabbix: Call killall with the -s

Some versions of killall do support the `killall -SIGNAL` syntax and
have only `-s SIGNAL` which should be supported everywhere.

I see the problem with *killall (PSmisc) 23.3* on latest TurrisOS 5.2

Signed-off-by: Jan Baier <jan.baier@amagical.net>
(cherry picked from commit 641f75d98ac77139d44056d260395efea169abf7)

git: update to 2.33.0

* refresh patches

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit e684672916f3a8ca54ddd66ec09c2e87b32726d9)

Merge pull request #16397 from paper42/mc-21.02

[21.02] mc: update to 2.8.27

mc: update to 2.8.27

* fixes CVE-2021-36370
* refresh patches

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>

Merge pull request #16358 from jamesmacwhite/21.02-stubby-0.4.0

[21.02] stubby: version 0.4.0

Merge pull request #16384 from stangri/openwrt-21.02

[21.02] curl: update to 7.78.0

curl: update to 7.78.0

* update to 7.78.0
* change maintainer
* remove obsolete mirror (curl.mirror.anstey.ca)
* update main curl URLs

Signed-off-by: Stan Grishin <stangri@melmac.net>
(cherry picked from commit 243c86ffc8fc77aa40237c037538a830cb307f8e)

auc: update to version 0.2.0

Cherry-picked from
9c491c6cb auc: update to version 0.1.9
4d789eac3 auc: handle root filesystem type
545c93d45 auc: improve branch selection logic
6c784dff2 auc: move function to right place
b1d38e7ab auc: update to version 0.2.0

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

unixodbc: use 'install' when copying host binaries

'cp' fails with a text file busy error if it tries to overwrite an
executable file that is running.  'install' unlinks the file first, so
it will not cause the problem.

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 47f98d7030f1023e7b2ed118c7774c6100fc979b)

perl: perlmod.mk: use 'install' for host binaries

When installing a host perl module, the host perl binary in the staging
dir is replaced by using 'cp'.  However, if the binary is running in a
parallel job, cp will fail with a text file busy error.  Use
$(INSTALL_BIN), which unliks the file first to avoid the error.

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 19c7496648cb25500ca7007a7c1578a426c23a09)

stubby: Add multi WAN support for procd trigger

Signed-off-by: James White <james@jmwhite.co.uk>
(cherry picked from commit 1ad5e3f88ccfed8979c95b461a3ba566270a49f8)

stubby: remove maintainer

Signed-off-by: Jonathan G. Underwood <jonathan.underwood@gmail.com>
(cherry picked from commit 791a8fb2bcfeabb238b4b1068ea48f18548e2c34)

stubby: remove libidn2 and libunwind dependencies

There's no good way to get rid of these, so just delete the cmake files.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 4ebc8798555eb5c4628956ffec49dfc64453e898)

stubby: bump to 0.4.0

Remove obsolete patch.

Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
(cherry picked from commit a01696890c80eb2add7eba6c9bd0f0edc8db1137)

Merge pull request #16355 from commodo/django-bump-21.02

[21.02] django: bump to version 3.2.6

sqm-scripts: bump to v1.5.1

Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>

travelmate: update to 2.0.5-2

* scan for open uplinks even if no other station has been added/configured

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit e6e3c9481d6b297127f491854739a37a5f399af8)

travelmate: update to 2.0.5

* support the new travelmate option 'macaddr' to use a pre-defined MAC address (per uplink)
* vpn connections are now handled separately for each uplink
* The autoadd-feature for adding open uplinks will now be limited by the 'trm_maxautoadd' option. The default is '5', '0' disables this limitation.
* more code cleanups und optimizations to reduce the repetitive connection handling workload
* bugfixes regarding multiple radio support
* refine cp detection (no longer write and parse an error file)

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit c6328bad6c6e9f0f2747eebb1389c679bccc86ab)

django: bump to version 3.2.6

And switch to AUTORELEASE for PKG_RELEASE.

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>

Merge pull request #16338 from G-M0N3Y-2503/docker-20.10.8-backport

Docker 20.10.8 backport

dockerd: Updated to 20.10.8

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

docker: Updated to 20.10.8

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

containerd: Updated to 1.4.9 for docker 20.10.8

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

runc: Updated to 1.0.1 for docker 20.10.8

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

whois: update to 5.5.9

* Updated the .ga TLD server.
* Removed the .cd and cf TLD servers.
* Removed 72 new gTLDs which are no longer active.

Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit d424d19b5a46c2a77b20d936880144e1cdeca5ba)

whois: update to 5.5.8

Switch to AUTORELEASE for simplicity.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit a5278062111351c2e6d1ebf7ac24f94722bf2e8e)

gitlab-runner: update to 14.0.1

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit dd51f58b14fa50fb3a879d012da4e7f4c02ffbe4)

clamav: update to 0.103.3

Switch to AUTORELEASE for simplicity.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 2a685d665cd581405274d2b404f785dcf2508716)

irssi: add test.sh

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 21992344b54144dae1b73ad7145540328e7ed0bb)

irssi: update to 1.2.3

Switch to AUTORELEASE for simplicity.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 752656c6be242d266d689078cc3ed1d76cb0143f)

atlas-sw-probe: fix copypaste error and clean tmp dir on exit

- Fix copypaste error for PUB_KEY link creation
- Clean tmp dir on exit to clear any remaining data

Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
(cherry picked from commit 842a9d399f1e3eb96290f3f0df72e70a5cd4d5b7)

Flash: update to version 2.0.1

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 2abbf288ed5cabd024706ec8dad2dfb74ca4e620)

Jinja2: update to version 3.0.1

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 7b5b9b9d11ff222d45b11de3db92b91314cdacf2)

Werkzeug: update to version 2.0.1

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 65c12b3c2f40b1e2eb555d7e2d835912097a67c4)

MarkupSafe: update to version 2.0.1

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit c30b80484238cd2d255fa75f856e470f2bd6161b)

click: update to version 8.0.1

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 01620b9cfb4a86c959c826edc22bf6626af9c684)

itsdangerous: update to version 2.0.1

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 6ab3b605cf91387cb69075f2c39cfd9e91ce28d3)

Merge pull request #16195 from miska/snort3-21.02

net/snort3: Include default configs and snort2lua

knot-resolver: update to version 5.4.0

* refresh patches
* disable kres_gen_test to fix cross

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit e7127d468490baeaa863b4ab817ac05ec74186fa)

knot: update to version 3.1.0

* refresh patches

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit 81e0fcb76fd886dd0188d5da341e6fb7c38677c5)

Merge pull request #16309 from jefferyto/golang-1.16.7-openwrt-21.02

[openwrt-21.02] golang: Update to 1.16.7

Merge pull request #16307 from jefferyto/python-twisted-21.7.0-openwrt-21.02

[openwrt-21.02] python-twisted: Update to 21.7.0, refresh patches

golang: Update to 1.16.7

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 4d7a71a7cbb144c098526282aee81a748259bd83)

python-twisted: Update to 21.7.0, refresh patches

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 4fa4cd832208e59ada0cb8cba9c99afe9467231a)

Merge pull request #16288 from Linaro1985/openwrt-21.02_fix_libxslt

[21.02] libxslt: fix compilation because of wrong libxml2 check in configure script

libxslt: fix compilation because of wrong libxml2 check in configure script

More details: https://github.com/GNOME/libxslt/commit/90c34c8bb90e095a8a8fe8b2ce368bd9ff1837cc

Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
(cherry picked from commit b5ac497d66e53dfe0e3408c57ff34a02e52c26e5)

Merge pull request #16258 from stangri/21.02-curl

[21.02] curl: enable HTTP/2 support by default

Merge pull request #16275 from stangri/21.02-simple-adblock

[21.02] simple-adblock: update to 1.8.7-6

simple-adblock: update to 1.8.7-6

* supports newer shellcheck
* restore EXTRA_COMMANDS compatibility with 19.07
* move status display from various functions to status_service
* bugfix: status_service line break after output
* minor arythmetic fix in status_service

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #16253 from stangri/21.02-https-dns-proxy

[21.02] https-dns-proxy: update to 2021-07-29-1

Merge pull request #16266 from nxhack/2102_node_14174

[21.02] node: bump to 14.17.4

Merge pull request #16264 from mhei/21.02-php8-update

[21.02] php8 update to 8.0.9

Merge pull request #16267 from mhei/21.02-php7-update

[21.02] php7: update to 7.4.22

Merge pull request #16265 from mhei/libxml2-update

[21.02] libxml2: update to 2.9.12

php7: update to 7.4.22

This fixes:
    - CVE-2021-21704
    - CVE-2021-21705

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commits
  - 555d0c9a291cb9ffaefaa22da36095613857e10f
  - f15aba89f725f31d03edd95e03547670ca994e47
  - 741d6d6768e4d3d9a85d83fb7a6dce422cefde5a)

libxml2: update to 2.9.12

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 6b932d3ff77c63fe01080139c147c86da12f0c88)

php8: add CI runtime test

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 2dad6524460a62f879e0df2786090d99e6c837fa)

php8: update to 8.0.9

Also update opcache makefile patch.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commits
 - 5e82e6be718186aab63b71f9396732cd341f924c
 - 0154157b6c6ef5f2907dca0aa3c14588cfc196d2
 - 961b7c5a25be907d9b89d3b18cd83618d8e38453
 - 7ddd5280d48609cad139e80774a57cc6c51921ee
 - 9080dce60f8c3013747058971b9af38867ba1073)

node: bump to 14.17.4

July 2021 Security Releases:

Use after free on close http2 on stream canceling (High) (CVE-2021-22930)
Node.js is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22930

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

curl: enable HTTP/2 support by default

Description: Lack of support of HTTP/2 by default starts to hurt,
for example with https-dns-proxy package, some DoH resolvers (like mullvad)
no longer support HTTP/1 and are not usable.

This enables HTTP/2 support by default (which would bring ~68Kb libnghttp).

Signed-off-by: Stan Grishin <stangri@melmac.net>

https-dns-proxy: update to 2021-07-29-01

* update binary to the latest commit (2021-07-29) to fix #16222 and #16239
* add hotplug.d/iface file and update Makefile to install it
* use Cloudflare's and Google's bootstrap DNS if bootstrap DNS is missing
* minor improvements in append_bool function
* add append_counter function for verbosity setting
* add append_bootstrap function (and supporting functions) to parse/sanitize bootstrap setting
* move firewall array from 'main' instance to the first proxy instance
* delete useless 'main' instace

Signed-off-by: Stan Grishin <stangri@melmac.net>

nextdns: Update to version 1.35.0

Signed-off-by: Olivier Poitrey <rs@nextdns.io>