Openvpn: add missing script-security

Maintainer:  @neheb

Compile tested: armv7, cortexA15, OpenWRT 23.05
Run tested: Linksys EA8500

Compile tested: armv8, cortexA53, OpenWRT main
Run tested: Dynalink DL-WRX36

Description:
Script-security is always 2 and cannot be changed from the openvpn config file due to a missing rule in openvpn.init.

This is discussed in issue #23014

This patch adds the missing rule in openvpn.init to parse script-security from the openvpn config file.

Signed-off-by: Erik Conijn <egc112@msn.com>
(cherry picked from commit 7b40d179bcd04a1f3b5b794fd952ef431c833cad)

cloudflared: refine config.yml

The config.yml is an example of a tunnel local configuration.
But the cloudlfared treat it as a real config and fails to start.
So to avoid problems let's comment all the statements.

The `url: http://localhost:8000` is not a valid config option.

Additionally add a smale of configuring ingres rules.

The cloudflared.config has missing option token.

Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
(cherry picked from commit b3580a76d8a4bc0bfa075ba3da945bfe92526871)

dnsproxy: Update to 0.64.1

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit f6714eb01e60d56113b67831bfcd9fc83ea07ef7)

inih: Update to r58

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 2c6453adb68a63aaa7a79d079038b08c288a0da6)

rclone: Update to 1.65.2

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 4437234dc43095212299417ee25aa43266374f50)

cloudflared: Update to 2024.1.5

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 17dfbd861360cae1a787c4618a0fe859d10e92da)

dos2unix: Update to 7.5.2

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 38fc2d2e9f7dfa8ea50ddb89fd9ea76d0609d439)

Merge pull request #23253 from stangri/openwrt-23.05-curl

[23.05] curl: update to 8.6.0

Merge remote-tracking branch 'yggdrasil-openwrt/yggdrasil-for-23.05' into openwrt-23.05

[23.05] yggdrasil: overhaul package with netifd support

Compile tested: none, see below
Run tested: all package compiling and qa testing done in snapshots
Description: we must backport v0.5 into 23.05 because the breaking protocol situation with v.0.4. the counterpart package, luci-proto-yggdrasil is already in 23.05 feeds.

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>

curl: update to 8.6.0

* https://curl.se/changes.html#8_6_0

Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
(cherry picked from commit 0f2c98d53f1aec96c21a707fc0e1a01b5a53a840)

Merge pull request #23227 from stangri/openwrt-23.05-nebula

[23.05] nebula: update to 1.8.2-2

nebula: update to 1.8.2-2

The following fixes have been applied to Makefile:
* fix the nebula license type
* add PKG_CPE_ID
* remove unneeded call to Build/Compile
* add leading spaces to descriptions
* add Package/nebula/conffiles definition
* remove unneeded /lib/upgrade/keep.d files
* no longer install actual license file
* add the README file

Kudos to @BKPepe and @1715173329 for feedback which lead to these fixes

Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit ae22bea8ddda7dd4409ea436e34c39073c954d8d)

Merge pull request #23201 from mhei/23.05-php8-update-to-8.2.15

[23.05] php8: update to 8.2.15

xz: Update to 5.4.6

Update xz to the version 5.4.6

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit a297c70c16e2828406628da1e0d485d16d006476)

php8: update to 8.2.15

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

python-dbus-fast: update version 2.21.0

Signed-off-by: Andy Syam <privasisource@gmail.com>
(cherry picked from commit 81a5b89c96bab4e312c5e54debede14aaee22ba1)
Signed-off-by: Quintin Hill <stuff@quintin.me.uk>

python3-bleak: add missing python3-typing-extensions dependency

Dependency introduced by https://github.com/hbldh/bleak/commit/21094e67cf5d238b911352ba8c45a33d72f47d80
and
https://github.com/hbldh/bleak/commit/3c1fac9773e13acf52cebfe4e9df5c60bffaf76b

(And only for python versions below 3.12.)

Fixes: 64fa106 (python3-bleak: bump version to 0.21.1)
Signed-off-by: Quintin Hill <stuff@quintin.me.uk>
(cherry picked from commit fcb02c264b935cfb620d37c2f7eb98a042dd2e6a)

natmap: update to 20240126

Signed-off-by: Ray Wang <r@hev.cc>
(cherry picked from commit 42c6e10ada066e54071026930460e91ba14dfb4b)

sing-box: update to 1.8.4

Signed-off-by: Van Waholtz <brvphoenix@gmail.com>
(cherry picked from commit 49ab3e0018948ebcbad676f5640c3ca7e3984db5)

 banip: update 0.9.3-5

* fix the nft Set survey function

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 79ae76806bbf118612b4036ee984e832aceba5f5)

v2ray-geodata: Update to latest version

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 1aaa5c045dd835331d6c5bb70636e9d34d6bb530)

v2raya: do not allow changing config/log directory

We need stable path to persist configurations and read log from LuCI.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 272cff0d1c6265fe374aeed582423858beedf6bc)

dnsproxy: Update to 0.63.1

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 3711f7f6d2b44e85bd149f54038a3361726fce72)

rclone: Update to 1.65.1

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 05b61b3b6d8c3e2ab8f20e8b08932adfd25fbc3a)

xray-core: Update to 1.8.7

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit ea4bbc46e19de971e72b44126bb429ecf158c2de)

cloudflared: Update to 2024.1.4

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 48b55bde67715de3b7f01cb099e552abbf86a12e)

cloudflared: Update to 2024.1.2

Finally fixed build with Go 1.21.

Fixes: #22383
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit d16377d23fd08e8c5583bba6d93afd89ad3144eb)

Merge pull request #23137 from nmav/tmp-new-ocserv-23.05

23.05: update ocserv to 1.2.4

gnutls: updated to 3.8.3

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

ocserv: updated to 1.2.4

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

Openvpn: add missing script event options

Maintainer: @mkrkn  @neheb
Compile tested: aarch64, cortex-a53, OpenWRT Master
Run tested: Dynalink DL-WRX36

Description:
[A previous commit](https://github.com/openwrt/packages/commit/f8a8b71e26b9bdbf86fbb7d4d1482637af7f3ba4) has added more script event options.
However it looked like that commit was not complete as it stops the use of the script events route-up, route-pre-down, and ipchange when those are placed in the openvpn config file.

This PR fixes a regression that makes it problematic to specify certain event options in the OpenVPN configuration file.

Discussion in [this thread](https://forum.openwrt.org/t/openvpn-custom-route-up-script-in-23-05-rc2/167105/13) and [here](https://forum.openwrt.org/t/openvpn-route-up-and-route-pre-down-broken-in-23-05/176568)

Please have a look and consider implementing or make it possible to use all script event options in the openvpn config file in another way.

Pull request has been discussed and improved with the help of @AuthorReflex, see: https://github.com/openwrt/packages/pull/21732

Signed-off-by: Erik Conijn <egc112@msn.com>
(cherry picked from commit 7735cdfe6046a4f8690c8cf7e4a05a8cff5622dd)

htop: update to 3.3.0

Changelog: https://github.com/htop-dev/htop/compare/3.2.2...3.3.0

Build system: x86/64
Build-tested: x86/64/AMD Cezanne
Run-tested: x86/64/AMD Cezanne

Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 3ee7b46610e9dbd8fd2bba87bd06024cd0d9c08f)

Merge pull request #23127 from stangri/openwrt-23.05-adblock-fast

[23.05] adblock-fast: update to 1.1.1-3

adblock-fast: update to 1.1.1-3

* allow top-level domains in the blocked-domains options fixes
  https://github.com/openwrt/packages/issues/23125

Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 0f059b6523f3720441cf608cbd9769265d859de6)

Merge pull request #23117 from stangri/openwrt-23.05-adblock-fast

[23.05] adblock-fast: sync with main branch

adblock-fast: sync with main branch

* somehow parts of the code of the init script got different between the
  main branch and release branch, this PR fixes that.

Signed-off-by: Stan Grishin <stangri@melmac.ca>

Merge pull request #23101 from stangri/openwrt-23.05-nebula

[23.05] nebula: update to 1.8.2

nebula: update to 1.8.2

* update to 1.8.2: https://github.com/slackhq/nebula/releases/tag/v1.8.2

Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 91afa9f641382c459a19321127bac04cf296efaa)

Merge pull request #23085 from muink/openwrt-23.05

[23.05] sing-box: Update to 1.8.0

sing-box: update to 1.8.0

New features for v1.8.0:
1. Migrate cache file from Clash API to independent options
2. Introducing Rule Set
3. Add `sing-box geoip`, `sing-box geosite` and `sing-box rule-set` commands
4. Allow nested logical rules
5. Independent `source_ip_is_private` and `ip_is_private` rules
6. Add context to JSON decode error message
7. Reject internal fake-ip queries
8. Add GSO support for TUN and WireGuard system interface
9. The legacy LWIP stack has been deprecated and removed
10. Add `idle_timeout` for URLTest outbound
11. Added some new uTLS fingerprints
...
Release notes: https://github.com/SagerNet/sing-box/releases/tag/v1.8.0

The new version has some breaking changes and may stop working after upgrading if use the original config.
Please see the migration manual to migrate the config: https://sing-box.sagernet.org/migration/

Signed-off-by: Anya Lin <hukk1996@gmail.com>
(cherry picked from commit 8fe2f6848511c3edd2feb46c04c1f8b6ffd1b99e)

rust: Update to 1.75.0

Changelog: https://blog.rust-lang.org/2023/12/28/Rust-1.75.0.html

Refreshed patches.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 546e6eba4fd14607e8068787cea8e3d7f9f49e42)

rust: unexport host sccache env variable

Users might configure their own env variables on the host, and sometimes
it can lead build failure or unexpected behavior.

Fixes: #22889
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 9f01010958b9f57ef51903f69c7223eaefabf139)

dnsproxy: Update to 0.61.1

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 37a77ffaf5105c31ee35b009691fa0b8a1c6a64a)

v2ray-geodata: Update to latest versin

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 6316772b3d317a3420cfd5fc586da9f2b7e7af80)

v2raya: Update to 2.2.4.6

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit ce684797e67d79fcef93ca0ecec58a757e51e94a)

btop: Update to 1.3.0

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 37ce0e6803f1d3f116bbd59ff7f14e160c99aa47)

btop: opt out of lto usage

Signed-off-by: Javier Marcet <javier@marcet.info>
(cherry picked from commit 107312a73f29a6a99df5b0dca3aec99986358512)

uspot: update to Git HEAD (2024-01-09)

0cffba9458d3 treewide: add support for RADIUS Reply-Message
c9fb744fdee8 treewide: add support for 'lang=' & ChilliSpot-Lang
584a162cb19a handler-uam: ensure that 'seconds_remaining' is always set
bd1f7c5de1ae Makefile: align with packages feed one
0ea6ad3c4e54 Makefile: mark uspot-www and uspotfilter "PKGARCH:=all"
e6a286ccfdbf uspot/uspotfilter: use 'logger -t'
427ed16cfde5 uspot: expose ratelimits in client data
4ba1dd9c5135 uspot: don't send NAS-Port-Type
78a37ef49b85 templates: add id="replymsg" to reply msg header
e3f4e179fd17 templates: show remaining time in "connected"
398762dff711 radius-client: correctly use str_to_hex()
730ef800d9da templates: simplify HTML
6bb39282fd8f Documentation update
b6c802adac19 portal: handle_request() logic refactoring
1aa1a5eb28d7 uspotfilter: implement peer_lookup()
ba5547ec61f1 portal: speedup peer lookup by leveraging spotfilter
d551376c29bb templates: added html5 time tag to timeleft output
154c98e0b77b uspotfilter: mark client as active when set()
8dcb03a37a77 uspotfilter: rework neigh management
cfb2ce7909da uspotfilter: use client_remove() where applicable
8411314dbf90 Documentation update
8dacf3df9935 uspot: use a single operation for client removal
297b7857c1e0 uspotfilter: fix DELNEIGH processing
76003917c205 uspotfilter: client_set() only clear idle when allowing
f46a855c5085 uspotfilter: remove botched IPv6 "support"
4ff31cbf0e2b uspot: client_remove(): stay in sync with spotfilter
edc9ad7e60a3 uspot/uspotfilter: use ucode-mod-log for logging
52e24aecf2db uspotfilter: use ucode '??=' syntax
c4b6f2f0bb1e Update README

Update the package Makefile to reflect the changes from the following
above-listed commits:

0ea6ad3c4e54 Makefile: mark uspot-www and uspotfilter "PKGARCH:=all"
edc9ad7e60a3 uspot/uspotfilter: use ucode-mod-log for logging

Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
(cherry picked from commit ab20c1bd90df66c8351a063a7a3318100f5c22af)

travelmate: update 2.1.2-2

* fix a possible re-connection issue/cornercase seen on single radio units

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 4518ecf60bb271fb510192661df7ea85b67a51d8)

Merge pull request #23077 from stangri/openwrt-23.05-adblock-fast

[23.05] adblock-fast: bugfix: pause command

adblock-fast: bugfix: pause command

* the pause command used to incorrectly cause block-lists reload, this
  has been fixed in this version

Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit dfeeabbebf7fa337f02fa24d40a488e2acfccbbb)

banip: update 0.9.3-4

* made the default mail template "responsive" to get a better view esp. on mobile devices

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 6c9cd775962a3165b70ab7722ba1c6a98b3b5f15)

travelmate: release 2.1.2-1

* fix a station scanning issue on single radio units (mainly a LuCI/JS issue) reported in the forum by multiple users

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit ce20f8d88be4fefaae15b06d18eef1639e992cd8)

travelmate: Added H-Rewards hotel login
Signed-off-by: Marc Ole Bulling <Marc-Ole@gmx.de>
(cherry picked from commit f12c63b9b988b2046fb2059fd9ce7b2fd2efd4b4)

yggdrasil: bump to 0.5.4

Signed-off-by: William Fleurant <meshnet@protonmail.com>
(cherry picked from commit 6820b2b318aaa42225b4a1dc5bb01a1f58fcfdd8)

yggdrasil: bump to 0.5.3

Signed-off-by: William Fleurant <meshnet@protonmail.com>
(cherry picked from commit 1b4455cbe1dd114592ab6cda386f9d699e6ae55b)

yggdrasil: support public key in config generation

Signed-off-by: William Fleurant <meshnet@protonmail.com>
(cherry picked from commit f0c4517d2e048fb5568dfa88d703d1a7310c52bc)

yggdrasil: overhaul package with netifd support
- package is bumped to 0.5.2
- new protocol changes prevent peering with 0.4.x peers
- @turretkeeper revamps package with netifd support
- do not use with luci-app-yggdrasil please install luci-proto-yggdrasil

Signed-off-by: William Fleurant <meshnet@protonmail.com>
(cherry picked from commit 99c7c36ce16de656ed730b7a04fd55afceabb6dd)

Merge pull request #22986 from stangri/openwrt-23.05-nebula

[23.05] nebula: update to 1.8.1

strongswan: trigger reload when interfaces are specified

Fixes #20848

Add interface triggers if interfaces to listen to are specified in
`/etc/config/ipsec`. This fixes the "running with no instances" scenario
after rebooting a router.

Signed-off-by: Joel Low <joel@joelsplace.sg>
(cherry picked from commit f2d209e4fff3048883ee5953c3a312d9f5aaab1b)

sing-box: Update to 1.7.7

Signed-off-by: Anya Lin <hukk1996@gmail.com>
(cherry picked from commit 2cf219c8379e178622b5e302754b4b87b581bc56)

Merge pull request #23000 from mhei/23.05-php8-update-to-8.2.14

[23.05] php8: update to 8.2.14

django: bump to version 4.2.8

To address
   https://nvd.nist.gov/vuln/detail/CVE-2023-43665

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>

 banip: update 0.9.3-3

* more init fixes

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 8c8a335eaf240802334c58fc5a076c33e8215056)

 banip: update 0.9.3-2

* rework the device/interface auto-detection (only layer-3 network devices will be detetcted correctly), disable the auto-detection e.g. for special tunnel interfaces
* supports now full gawk (preferred, if installed) and busybox awk
* raise the default boot timeout to 20 seconds (if 'ban_triggerdelay' is not set)
* various small fixes and improvements
* readme update

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 5af101564a9f889807e0e2762934e03cb0259eb1)

banip: bump to release 0.9.3-1

* provides an option to transfer log events on remote servers via cgi interface (disabled by default), see readme for details
* refine the allowlist check to support IP intervals as well before adding an IP to the blocklist

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit df81585cea0c0b35f01f978e7dc245ad9de32a07)

php8: update to 8.2.14

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

dnsproxy: Update to 0.61.0

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit df24c8d097c1ef945a0adaa2c5b51b089293a015)

yq: Update to 4.40.5

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 708b69f86f755c2cb13b019c54f5c3296590be41)

v2ray-geodata: Update to latest version

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 7114155a9194e9ffd21dfcba82e72cb4995b5009)

v2ray-core: Update to 5.13.0

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 5ca3b2ed4461ff8ed82ce78981f440da045fa33d)

dnsproxy: Update to 0.60.1

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 3900f2aab4f5994cbbdd84a0da0e2a343533af95)

tailscale: Update to 1.56.1

Signed-off-by: Shi JiaYang <shi05275@163.com>
(cherry picked from commit a2b72f13fff065aff3e3803e823b3764d037dd90)

wsdd2: update to 2023-12-21

Signed-off-by: Alan Luck <luckyhome2008@gmail.com>
(cherry picked from commit 25ded48f9f3c36cbbe954dffdd80b2dc0edd0854)

mosquitto: update to 2.0.18

Switch to CMake. Allows faster compilation.

Small Makefile cleanups.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit aa89f847c673343af0cde4dbd9535a63272f7f14)

nebula: update to 1.8.1

* https://github.com/slackhq/nebula/releases/tag/v1.8.1

Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 731d594ee31df8c0fadf980f29939461d13bc395)

libxcrypt: update to 4.4.36

Upstream bump required to fix build issues reported here:
https://forum.openwrt.org/t/i-cannot-build-my-image-due-to-failure-in-libxcrypt/168114

Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit b1d28936cbfe9739f9480fefb34fa4ab8ff15bd8)

libtorrent-rasterbar: Update to 2.0.9

Switch to use release tarball to avoid try_signal hack.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 9b0608547b1b3965fc0ccfb2e9e14a31fa5ca71d)

snowflake: update to 2.8.0

Release Notes:
https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/blob/v2.8.0/ChangeLog

Signed-off-by: Nick Hainke <vincent@systemli.org>
(cherry picked from commit 12defee0ce84910ac627031f5434aca7a0c8b578)

Merge pull request #22906 from mhei/23.05-php8-update-to-8.2.13

[23.05] php8: update to 8.2.13

wifidog: make it compile again with recent version of WolfSSL

Recent version of WolfSSL dropped CyaSSL shims and made the package not
compilable. Converting it to the WolfSSL library is simple enough as the
API used are very basic and can be converted directly. Add patch that
fully convert the package to WolfSSL and doesn't use the compat shim
anymore.

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit b38e3cd257b3db79897d7ae7c9976af1d57f29b3)

php8: update to 8.2.13

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

tang: silence errors on first installation

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

haproxy: update to v2.8.5

- Update haproxy PKG_VERSION and PKG_HASH
- See changes: http://git.haproxy.org/?p=haproxy-2.8.git;a=shortlog

Signed-off-by: Christian Lachner <gladiac@gmail.com>

Merge pull request #22888 from jefferyto/python-3.11.7-openwrt-23.05

[openwrt-23.05] python3: Update to 3.11.7, refresh patches

Merge pull request #22880 from QuintinHill/ble2mqtt-0.2.1-for-23.05

[23.05] Python3-Ble2mqtt: update to 0.2.1 and bump dependencies

Merge pull request #22897 from stangri/openwrt-23.05-adblock-fast

[23.05] adblock-fast: update to 1.1.1-1

adblock-fast: update to 1.1.1-1

* move reload/restart logic from json() to config_cache()
* improve fw4 restart decision logic
* no longer store reload/restart info in ubus/status json file
* rename variables pointing to run-time information
* create dns_set_output_values to reuse code in principal all and luci app
* improve append_url to store collected URLs in an alternative variable

Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit bab17f480c638350aa3734d7757bbae353c1c740)

Merge pull request #22859 from stangri/openwrt-23.05-nebula

[23.05] nebula: update to 1.8.0

Merge pull request #22857 from stangri/openwrt-23.05-curl

[23.05] curl: update to 8.5.0

python3: Update to 3.11.7, refresh patches

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit d4f5759190ce7bbebbeaa4161333c91d0d7a4da1)

unbound: fix `create_host_record_from_host` error when `dns` is not set

The function `create_host_record_from_host` fails if the `dns` option
is not set in the host entry.
This sets a default to the `dns` variable in order to fix this error.

Fixes: #22691
Signed-off-by: Julien Cassette <julien.cassette@gmail.com>
(cherry picked from commit 8d60419251b2c94f87425f41ce49214771d2bf6a)

unbound: create extra host records from DHCP static leases

The "Extra DNS" option allows to create records from the DHCP
"Hostnames" configuration entries.
This allows to create such records from the DHCP "Static leases"
configuration entries too.

Fixes: #22593
Signed-off-by: Julien Cassette <julien.cassette@gmail.com>
(cherry picked from commit b4a31f92deb8de923d6bc6fb12506e24f4475581)

golang: Update to 1.21.5

Includes fix for CVE-2023-39326 (net/http: limit chunked data overhead).

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit b8254cdac4aa62e19598c281109c17f77339d982)

Merge pull request #22878 from efahl/openwrt-23.05

[23.05] syncthing: fix duplicate command line parameters on service

python3-ble2mqtt: bump version to 0.2.1

Signed-off-by: Quintin Hill <stuff@quintin.me.uk>
(cherry picked from commit 0937af539d2d13f5c2bc94701972e4067b24380f)

python3-bleak: bump version to 0.21.1

Signed-off-by: Quintin Hill <stuff@quintin.me.uk>
(cherry picked from commit 64fa106b0711a28732495b9cd334cfd6dfad9683)

python3-dbus-fast: bump version to 2.20.0

Signed-off-by: Quintin Hill <stuff@quintin.me.uk>
(cherry picked from commit ca2171c00584bdf7448b2a754ba5b5a4431de0f2)

Merge pull request #22875 from stangri/openwrt-23.05-https-dns-proxy

[23.05] https-dns-proxy: only restart firewall when needed

syncthing: fix duplicate command line parameters on service

  - This patch fixes 9d17ba1 and #22760

Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>
(cherry picked from commit 6849a9df90d8c9c99dd50356b8f969d64026c16d)