openssh: Validate keys and regenerate if needed.

Imitate dropbear init.d-script and make sure we
don't end up with corrupt keys.

This can happen if we use a caching filesystem,
like 'ubifs', and the DUT is powered off during
boot-up.

Signed-off-by: Markus Gothe <markus.gothe@genexis.eu>

openssh: fix killing of active sessions on shutdown

Starting with OpenSSH 9.8 sessions are handled by a separate binary
called sshd-session

Signed-off-by: Erik Karlsson <erik.karlsson@iopsys.eu>

php8-pecl-dio: update to 0.3.0

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

php8-pecl-http: update to 4.2.6

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

php8-pecl-xdebug: update to 3.4.1

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

php8-pecl-redis: update to 6.1.0

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

php8-pecl-krb5: update to 1.2.2

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

coova-chilli: Fix WolfSSL support

Signed-off-by: Federico Capoano <f.capoano@openwisp.io>

nut: add --without-nut_monitor to configure args
nut_monitor is not used anyway and is needlessly built & does not work with python 3.13

Signed-off-by: Jan Klos <jan@klos.xyz>

ddns-scripts: get l3 device for bind network using curl

If pppoe is used for wan access. script set 'eth1' as interface for curl
call. The correct interface is however 'pppoe-wan'.

These scripts use 'network_get_physdev' function to get real device for
bind_network but this is wrong. We need instead the l3_device of the the
logical interface.

In case if we don't use pppoe connection - 'l3_device' is equal to real device.

Follow P/R:
 #14431

Signed-off-by: Coia Prant <coiaprant@gmail.com>

libfmt: bump to version 11.1.2

Signed-off-by: Othmar Truniger <github@truniger.ch>

frr: update to 10.2.1

update to current stable branch

Signed-off-by: Lucian CRISTIAN <lucian.cristian@gmail.com>

libyang: update to 2.1.128

this is a dependency for updated frr

Signed-off-by: Lucian CRISTIAN <lucian.cristian@gmail.com>

node: January 21, 2025 Security Releases

This is a security release.

Notable Changes

    CVE-2025-23083 - src,loader,permission: throw on InternalWorker use when permission model is enabled (High)
    CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
    CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)

Dependency update:

    CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

hev-socks5-server: update to 2.7.0

Signed-off-by: Ray Wang <r@hev.cc>

hev-socks5-tproxy: update to 2.6.0

Signed-off-by: Ray Wang <r@hev.cc>

uspot: update to Git HEAD (2025-01-20)

57b737a49497 uspot/uspotfilter: s/discon_since/lost_since/
1c2f58000519 uspot/uspotfilter: use native MAC case
70934203a0b7 captive: cleanup
7566c2716eb9 uspot: correctly handle "debug=0"
f5cc70459233 portal: remove unused bits
54cdcf463c36 uspot: remove unused ssid parameter
f13440bd80ff Update issue templates
644fd6f52a8e uspotfilter: apply disconnect delay to active clients only

Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>

banIP: update 1.5.0-3

* better logging of nft load errors
* update the readme

Signed-off-by: Dirk Brenken <dev@brenken.org>

ddns-scripts: Fixup dnspod.cn-v3

Migrate retry_count to retry_max_count in the script to fix infinite retry loop.

Signed-off-by: FriesI23 Qin <FriesI23@outlook.com>

ddns-scripts: Fixup dnspod.cn-v3

Fix signature expiration issue during retries.

Signed-off-by: FriesI23 Qin <FriesI23@outlook.com>

git: Set PKG_FORTIFY_SOURCE to 0 when lto enabled

If PKG_FORTIFY_SOURCE is not 0 and lto is enabled for package git, it
will fail to compile with the following example error:

/openwrt/staging_dir/toolchain-aarch64_generic_gcc-14.1.0_musl/include/stdio.h: In function 'process_curl_messages': /openwrt/staging_dir/toolchain-aarch64_generic_gcc-14.1.0_musl/include/stdio.h:90:8: error: inlining failed in call to 'always_inline' 'fwrite': function body can be overwritten at link time
   90 | size_t fwrite(const void *__restrict, size_t, size_t, FILE *__restrict);
      |        ^
http.c:355:33: note: called from here
  355 |                                 fprintf(stderr, "Received DONE message for unknown request!\n");
      |                                 ^

A related issue is #13016 .
This commit set PKG_FORTIFY_SOURCE to 0 if CONFIG_USE_LTO is y.

Close #24366

Link: https://lore.kernel.org/git/CAHfWF5mjquES-nocQaK+CAEsqWgdy-_OYdGtN82heYs0eJP3eQ@mail.gmail.com/T/#t
Link: https://github.com/openwrt/openwrt/issues/13016
Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110834
Signed-off-by: Ryan Keane <the.ra2.ifv@gmail.com>

zoneinfo: Updated to 2025a release.

Signed-off-by: Vladimir Ulrich <admin@evl.su>

mwan3: Add support for nslookup track method

Signed-off-by: Brian J. Murrell <brian@interlinx.bc.ca>

mwan3: Bug fixes with nping usage

The IP address family is a single dash option and one of 4 or 6, not tcp
or udp.

Signed-off-by: Brian J. Murrell <brian@interlinx.bc.ca>

vsftpd: fix bug related to option conf_file

* I had wrongly used config_get_bool for the option, so fixed it
* this also fixes the issue of /etc/init.d/vsftpd stop not working

Signed-off-by: Mohd Husaam Mehdi <husaam.mehdi@iopsys.eu>

syncthing: Update to 1.29.2 and Change logfile path

Update to 1.29.2 and Change logfile path from /etc/syncthing/syncthing
log to /var/log/syncthing.log.
This utilizes tmpfs (memory-based storage) to prevent disk usage growth
caused by log file accumulation during extended operation.

Benefits:
- Avoids storage saturation from excessive log growth.
- Aligns with best practices for temporary log management.
- For systems using flash storage (e.g., SSDs or eMMC), storing logs in
  tmpfs avoids flash memory wear caused by frequent writes to
  /etc/syncthing.

Signed-off-by: Yun Wang <maoerpet@foxmail.com>

pdns-recursor: update to 5.2.0

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>

banIP: update 1.5.0-2

* fix typo in the log_outbound target
* update the readme

Signed-off-by: Dirk Brenken <dev@brenken.org>

lpac: update to 2.2.1, add support for custom ISD-R AID

Updated lpac to 2.2.1 and added support for custom ISD-R AIDs.
This allows for a broader range of esim cards with non standard AIDs to be supported.
See https://github.com/estkme-group/lpac/pull/181 for additional info.

Signed-off-by: Dominik Borghorst <git@borghorst.net>

netbird: update to 0.36.3

changelog: https://github.com/netbirdio/netbird/releases/tag/v0.36.3

Signed-off-by: Wesley Gimenes <wehagy@proton.me>

docker-compose: Update to version 2.32.4

Release notes:
https://github.com/docker/compose/releases/tag/v2.32.3
https://github.com/docker/compose/releases/tag/v2.32.4

Signed-off-by: Javier Marcet <javier@marcet.info>

adblock: update 4.2.3-3

Summary of three PRs regarding new adblock sources with minor changes/additions:

- add new source reg_lithuania, PR provided by @Myginas
- add new source certpl, PR provided by @jkostorz
- add new source oisd_nsfw_small, PR provided by @Turjoy9

Signed-off-by: Dirk Brenken <dev@brenken.org>

antiblock: Add AntiBlock package

AntiBlock program proxies DNS requests.
The IP addresses of the specified domains are added to
the routing table for routing through the specified interface.

Signed-off-by: Khachatryan Karen <karen0734@gmail.com>

banIP: release 1.5.0-1

* change the chain structure: only two regular chains contain the generated banIP sets.
  “_inbound” covers the base chains WAN-Input and WAN-Forward, ‘_outbound’ covers the base chain LAN-Forward.
* pre-configure the default chains for every feed in the banip.feeds json file, no longer blocks
  selected feeds in all chains by default
* it's now possible to split country and asn Sets by country or asn (disabled by default)
* support Set counters to report easily suspicious IPs per Set (disabled by default)
* make it possible, to opt out certain chains from the deduplication process
* the element search now returns all matches (and not only the first one)
* the report engine now includes statistics about the Inbound & Outbound chains and the Set counters (optional)
* save the temp. files of possible nft loading errors in "/tmp/banIP-errors" by default for easier debugging
* various code improvements
* remove ssbl feed (deprecated)
* add two new vpn feeds
* update the readme

Signed-off-by: Dirk Brenken <dev@brenken.org>

openvpn: update to 2.6.13

Feature changes:
 - on non-windows clients (MacOS, Linux, Unix) send "release" string from uname() call as IV_PLAT_VER to server
 - Windows: protect cached username, password and token in client memory
 - Windows: use new API to get dco-win driver version from driver
 - Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default timeout of 90 seconds

Security fixes:
 - improve server-side handling of clients sending usernames or passwords longer than USER_PASS_LEN

Notable bug fixes:
 - FreeBSD DCO: fix memory leaks in nvlist handling
 - purge proxy authentication credentials from memory after use

For details refer to https://github.com/OpenVPN/openvpn/blob/v2.6.13/Changes.rst

Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>

rsync: update to 3.4.1

Changelog: https://download.samba.org/pub/rsync/NEWS#3.4.1

Signed-off-by: John Audia <therealgraysky@proton.me>

sing-box: Update to 1.10.7

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

nextdns: Update to version 1.44.4

Signed-off-by: Olivier Poitrey <rs@nextdns.io>

lua-ffi: update to 1.1.0

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>

tree: bump to 2.2.1

Changelog: https://github.com/Old-Man-Programmer/tree/blob/master/CHANGES

Signed-off-by: John Audia <therealgraysky@proton.me>

rsync: update to 3.4.0

Changelog: https://download.samba.org/pub/rsync/NEWS#3.4.0

Signed-off-by: John Audia <therealgraysky@proton.me>

trojan-go: drop package

Upstream is dead.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

ddns-scripts: correct name for ipv64.net

Correct the name in ipv64.net.json

Signed-off-by: Gedalya Nie <gedalya@gedalya.net>

ddns-scripts: cloudflare: use PATCH method, minimize changes

Using the PUT method recreates the DNS record with and only with
the newly provided data. This seems unnecessary. In particular,
we don't need to hardcode a TTL of 120. Any existing comment
would be lost too.

The only detail we need to change is the IP address. Leave everything
else as it was.

Signed-off-by: Gedalya Nie <gedalya@gedalya.net>

yq: Update to 4.45.1

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

v2ray-core: Update to 5.24.0

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

cloudflared: Update to 2025.1.0

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

transmissision: remove build dependency on nodejs

Have no idea why such dependency was added.
No documentation from transmission that they need
such dependency on build time. On the other hand
saves vast of time during build

Signed-off-by: Serhii Ivanov <icegood1980@gmail.com>

iperf: package update to v3.18

Signed-off-by: Sander <schutten@hotmail.com>

libedit: update to version 20250104-3.1

Signed-off-by: Jan Hák <jan.hak@nic.cz>

liburcu: update to version 0.15.0

Signed-off-by: Jan Hák <jan.hak@nic.cz>

acme-acmesh: Bump to v3.1.0

New upstream release with mostly minor fixes.

Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>

mariadb: update to 11.4.4

Remove upstreamed patch.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

lighttpd: update to lighttpd 1.4.77 release hash

Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>

lighttpd: lighttpd.init add trigger on acme.renew

github: closes #24217
Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>

cargo-c: Version bump

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

rust: update to 1.84.0

Signed-off-by: hingbong lo <hingbonglo@gmail.com>

vsftpd: handle migration and fix secure_chroot_dir error

* update UCI to use the traditional vsftpd.conf so
  that people migrating from non-uci version do not face problems
* if secure_chroot_dir is not provided specifically, then create
  an empty directory where vsftpd usually expects it

Signed-off-by: Mohd Husaam Mehdi <husaam.mehdi@iopsys.eu>

ddns-scripts: Add dnspod.cn-v3

Signed-off-by: FriesI23 Qin <FriesI23@outlook.com>

ddns-scripts: add support for ipv64.net

Adds ipv64.net service as DDNS provider

Docs: https://ipv64.net/dyndns_updater_api
Signed-off-by: Hui Zhui <barsikus07@gmail.com>

muninlite: add some patches to address old issues

As muninlite doesn't appear to have had a release in a few years and activity
on the git repo appears to have stalled, we add some patches on our end for now.

Patches:

- 001->004 are upstream fixes from master.
- 100 is a submitted PR: https://github.com/munin-monitoring/muninlite/pull/19
  to fix https://github.com/munin-monitoring/muninlite/issues/14.
- 200->204 is a submitted PR to allow customizing the monitored network interfaces:
  https://github.com/munin-monitoring/muninlite/pull/18. Despite the large
  number of patches it is actually a trivial change.

Signed-off-by: Rany Hany <rany_hany@riseup.net>

muninlite: add /etc/munin to conffiles and install muninlite.conf

The entire /etc/munin should be backed up as it includes
user configuration for custom plugins and the muninlite.conf
config file which is useful to override the default NTP server.

Also we install muninlite.conf to /etc/munin/.

Signed-off-by: Rany Hany <rany_hany@riseup.net>

docker-compose: Update to version 2.32.2

Release notes:
https://github.com/docker/compose/releases/tag/v2.32.2

Signed-off-by: Javier Marcet <javier@marcet.info>

bind: bump to 9.20.4

Signed-off-by: Noah Meyerhans <frodo@morgul.net>

vsftpd: update init script to process UCI

* update init script to validate and process UCI
* the option conf_file can be used to pass a conf file
  instead of using UCI

Signed-off-by: Mohd Husaam Mehdi <husaam.mehdi@iopsys.eu>

vsftpd: update init script to use procd

update init script to use procd

Signed-off-by: Mohd Husaam Mehdi <husaam.mehdi@iopsys.eu>

ddns-scripts: support IPv6 for joker.com

The existing endpoint can handle IPv6 addresses as well.

v2ray-geodata: Update to latest version

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

i2pd: update to 2.55.0

Fixes compilation with Boost 1.87.

Move away from codeload.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

open-iscsi: update to 2.1.10

Use meson. Upstream prefers it.

Remove upstreamed patches.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

fsh: add new package

Fsh helps you access local shell and TCP services behind a NAT or firewall.

More details: https://github.com/heiher/hev-fsh

Signed-off-by: Ray Wang <r@hev.cc>

curl: add LIBCURL_WEBSOCKETS flag

Signed-off-by: Peter van Dijk <peter@7bits.nl>

cpupower: fix category 'utils' -> 'utilities'

The initial idea was to have the new package in the existing category,
not to create a new one.
Thanks @anomeome for spotting this.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

eza: update to 0.20.15

Release notes:
0.20.11: https://github.com/eza-community/eza/releases/tag/v0.20.11
0.20.12: https://github.com/eza-community/eza/releases/tag/v0.20.12
0.20.13: https://github.com/eza-community/eza/releases/tag/v0.20.13
0.20.14: https://github.com/eza-community/eza/releases/tag/v0.20.14
0.20.15: https://github.com/eza-community/eza/releases/tag/v0.20.15

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>

croc: update to 10.2.1

Release notes:
10.1.2: https://github.com/schollz/croc/releases/tag/v10.1.2
10.1.3: https://github.com/schollz/croc/releases/tag/v10.1.3
10.2.0: https://github.com/schollz/croc/releases/tag/v10.2.0
10.2.1: https://github.com/schollz/croc/releases/tag/v10.2.1

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>

qemu: update to 9.1.2

- Update to 9.1.2
- Refresh the patches

Signed-off-by: Vladimir Ermakov <vooon341@gmail.com>

libtorrent-rasterbar: Update to 2.0.10

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

owut: update to 2025.01.06

Bug fixes:
    efahl/owut@9f63203 owut: fix missing SSL library message

Enhancements:
    efahl/owut@e623a90 owut: cosmetic: include kernel version in build results
    efahl/owut@05f3bbe owut: allow alternate delimiters between added/removed packages
    efahl/owut@31b0478 owut: list server in 'versions' output
    efahl/owut@ec97414 readme: general updates

Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>

kadnode: update to version 2.4.1

* add new additional peer
* add more configuration comments
* expose dht_isolation_prefix setting

Signed-off-by: Moritz Warning <moritzwarning@web.de>

tmate: fix compilation with GCC14

Need a define for strcasestr

Signed-off-by: Rosen Penev <rosenp@gmail.com>

opendkim: fix compilation with GCC14

Missing header.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

mpd: update to 0.23.16

Add patch to fix compilation with fmt 11.1.

Remove upstreamed patch.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

uanytun: fix compilation with GCC14

Wrong cast type.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

dante: update to 1.4.4

Refreshed patches.

Use libtirpc to fix missing bindresvport. It's not actually used.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

natmap: update to 20250101

Signed-off-by: Ray Wang <r@hev.cc>

gst1-libav: update to 1.24.10

Signed-off-by: W. Michael Petullo <mike@flyn.org>

gst1-plugins-ugly: update to 1.24.10

Signed-off-by: W. Michael Petullo <mike@flyn.org>

gst1-plugins-bad: update to 1.24.10

Signed-off-by: W. Michael Petullo <mike@flyn.org>

gst1-plugins-good: update to 1.24.10

Signed-off-by: W. Michael Petullo <mike@flyn.org>

gst1-plugins-base: update to 1.24.10

Signed-off-by: W. Michael Petullo <mike@flyn.org>

gstreamer1: update to 1.24.10

Signed-off-by: W. Michael Petullo <mike@flyn.org>

cpupower: add new package

Linux kernel userspace tool to examine and to tune power
saving related features of the processor

Build system: x86/64
Build-tested: x86/64/AMD Cezanne
Run-tested: x86/64/AMD Cezanne

Signed-off-by: John Audia <therealgraysky@proton.me>
Small fixes to allow building with SDK (buildbots)
Comile-tested: mxs

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

netbird: update to 0.35.2

changelog: https://github.com/netbirdio/netbird/releases/tag/v0.35.2

Signed-off-by: Wesley Gimenes <wehagy@proton.me>

go2rtc: update to 1.9.8

- Update version to 1.9.8

Signed-off-by: Vladimir Ermakov <vooon341@gmail.com>

pbr: Makefile bugfixes

* remove indentation in postinst/prerm/postrm scripts to fix issues with APK

Signed-off-by: Stan Grishin <stangri@melmac.ca>

adblock-fast: Makefile bugfixes and hijack rework

* remove indentation in postinst/prerm/postrm scripts to fix issues with APK
* rework hijack logic to redirect port 53 to the port of active/selected dnsmasq instances

Signed-off-by: Stan Grishin <stangri@melmac.ca>

xray-core: Update to 24.12.31

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

boost: Updates package to version 1.87.0

This commit updates boost to version 1.87.0

New libraries in this release:
* Boost.Parser [2]: Framework for building parsers, from Zach Laine.

More info about Boost 1.87.0 can be found at the usual place [1].

[1]: https://www.boost.org/users/history/version_1_87_0.html
[2]: https://www.boost.org/libs/parser/

Signed-off-by: Carlos Miguel Ferreira <carlosmf.pt@gmail.com>

lsof: update to 4.99.4

Signed-off-by: Maxim Storchak <m.storchak@gmail.com>

libsoup3: update to 3.6.1

Signed-off-by: W. Michael Petullo <mike@flyn.org>