unbound: update to version 1.17.1

- Refreshed one patch

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 97e69ec89c8bdb1c6d092eb5e8491467a06a9963)
[Use AUTORELEASE]

ffmpeg: update to version 4.3.5

Fixes: CVE-2020-21041
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

v2raya: Update to 2.0.4

- Added TproxyNotSkipBr flag for OpenWrt.
- Removed all upstreamed patches.
- Removed deprecated option.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 5062779dc79091d63929d44b6354e1cbefa2e8f5)
[removed nftables-related changes]
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

yq: Update to 4.32.2

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 65dc683efe329a13afdc632150f886b88d7f5edf)

Merge pull request #20671 from TDT-AG/pr/20220415-openwrt-21.2-strongswan-cves

strongswan: backport CVE fixes

strongswan: bump PKG_RELEASE because of CVEs backports

CVE-2022-40617 45774858e8c99d4486aae384d32fb41837618c73
CVE-2021-41990 05836ef6685fea058fa91b5c0fd17abb77b72469
CVE-2021-45079 e4d4e9dc4844e3f05858c7e2bf7ba0787587518c
CVE-2021-41991 d1bc776958b2d4297bbdf92531d092c3bb0f093f

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

strongswan: add fix for CVE-2022-40617

Full details of the CVE can be found at the following link:
https://www.strongswan.org/blog/2022/10/03/strongswan-vulnerability-(cve-2022-40617).html

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

strongswan: add fix for CVE-2021-41990

Full details of the CVE can be found at the following link:
https://www.strongswan.org/blog/2021/10/18/strongswan-vulnerability-(cve-2021-41990).html

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

strongswan: add fix for CVE-2021-45079

Full details of the CVE can be found at the following link:
https://www.strongswan.org/blog/2022/01/24/strongswan-vulnerability-(cve-2021-45079).html

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

strongswan: add fix for CVE-2021-41991

Full details of the CVE can be found at the following link:
https://www.strongswan.org/blog/2021/10/18/strongswan-vulnerability-(cve-2021-41991).html

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

Merge pull request #20667 from mhei/21.02-php8-update-to-8.0.28

[21.02] php8: update to 8.0.28

php8: update to 8.0.28

This fixes:
    - CVE-2023-0567
    - CVE-2023-0568
    - CVE-2023-0662

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

mv88e6xxx_dump: update to 2023.03.08

This fixes 2 issues where mv88e6xxx_dump was displaying
data incorrectly for --vtu and --global2

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit 2bf3832193fdfe86e948f35fcc08b3ea5a341562)

mv88e6xxx_dump: add new packages to debug switch issues

Reviewed-by: Chris Healy cphealy@gmail.com
Reviewed-by: Robert Marko <robimarko@gmail.com>
Reviewed-by: Andre Heider <a.heider@gmail.com>
Tested-by: Petr Štetiar <ynezz@true.cz>
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit 167c6234d01e72da447e47e2c1b3f7a3195aab83)

ci: update github actions to v3

Update checkout and upload-artifact action to v3 to mute nodejs
deprecation warning.

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 52570d4242822e3db678f5484c2ca3e72f485d52)

ci: Use openwrt/gh-action-sdk@v5

The previous build errors with v5 have been fixed. This version builds
packages as a normal user instead of as root.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 37f9b77b01fd148c946dc313869602fb8203eaea)

golang: Fix conditionals not stripped

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 86fd1ebbe44e5c0747b8429493257e9317eacb07)

haproxy: update to v2.2.29

- Update haproxy download URL and hash
- This release fixes a critial flaw known as CVE-2023-25725. See:
  http://git.haproxy.org/?p=haproxy-2.2.git;a=commit;h=4a4c90c2b04444d92c58873cfb19052f20280bc2

Signed-off-by: Christian Lachner <gladiac@gmail.com>

v2raya: drop wrong patches

These patches should not be backported to OpenWrt, otherwise tproxy
won't work for devices connected to br-lan (bypassed by the fw rules).

We have introduced a new compile-time flag for new version (which
is not released yet), but it's unnecessray to backport redudant
patches as here is still at the old version.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 40669c4135d829254ba66b0f1a6827f94d229c96)

yq: Update to 4.31.2

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 1343bb585607295d2e466dfed0dd596a14570c54)

yq: Update to 4.31.1

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit b76bd94605c9c53b64935c78bba6ff98e2847e16)

msgpack-c: Update to 5.0.0

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 5890d2f2d76c31de85ae54a586c445a936cc4c14)

sed: remove old libpcre dependency

Signed-off-by: Alan Swanson <reiver@improbability.net>
(cherry picked from commit 0a00f0f2a582bc11979ecef2c60a68584fe4e935)

xfrpc: update to version 2.1.606

Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>
(cherry picked from commit db243b31c81a817c565feba7553c3b02d460d959)

xfrpc: Update to 1.11.587

refactor tcp mux

Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>
(cherry picked from commit 419c4340026b585bfc558c3027d4308e862c795c)

xfrpc: allow server_addr ip and domain

Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>
(cherry picked from commit a7e3f28c3761de6e7eed5423fbd116eeeec38491)

xfrpc: Update to 1.07.582

Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>
(cherry picked from commit 9fbd26f1709d3fbabf043c110cb46922f2eb6750)

xfrpc: update to 1.06.579

Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>
(cherry picked from commit 5615ce33fa8c18944771c4aef0ce285bb3b60d47)

xfrpc: set xfrpc's disabled default value to 0

change this to satisfy luci-app-xfrpc's need

Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>
(cherry picked from commit 10a24d4cad196b790b322bb4132086b1e350fde8)

xfrpc: fix bug of xfrpc.init

replace xfrpc with xfrp

Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>
(cherry picked from commit b3bd24f1afde9c1071b253959061ce4adc259d41)

xfrpc: update to 1.05.561

support tcp mux and default to turn it on

Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>
(cherry picked from commit d4430d2e89cd289807b4a9e21583cae245c1e81c)

xfrpc: Update to 1.05.548

deprecated xfrps, compatible with frps

Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>
(cherry picked from commit 2cb01429b198702decc2744fc470270b3b328c63)

xfrpc: fast reverve proxy client in c language

Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>
(cherry picked from commit 9af01c87bfb3007e0a169b57bf9762c88098dff9)

git: update to 2.34.7

Fixes CVE-2023-22490, CVE-2023-23946

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit 06f466cc61ce5e5c98d1147c165d3e96c31e41cc)

CI: do not crash during PKG-INFO generation if there are no packages

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>
(cherry picked from commit b5132de5cf4f7d0562445cf3c65f9f1a4bcb1bbf)

CI: add PKG-INFO metadata file

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>
(cherry picked from commit a40c1b3e442eccbf0619f06b473705f4a4a0ac6d)

CI: use git commit sha in name

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>
(cherry picked from commit bbf983721cf41fd94388b16ce90f018d6c0496f5)

Merge pull request #20526 from nxhack/2102_node_14213

[21.02] node: bump to v14.21.3

Merge pull request #20518 from commodo/django-21.02

[21.02] django: bump to version 3.2.18

node: bump to v14.21.3

Thursday February 16 2023 Security Releases

Notable Changes
The following CVEs are fixed in this release:
* CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High)
* CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low)
More detailed information on each of the vulnerabilities can be found in February 2023 Security Releases blog post.

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

snowflake: update to v2.5.1

Changes in version v2.4.3 - 2023-01-16
- Fix version number in version.go

(Changes for v2.5.1 are missing)

Signed-off-by: Nick Hainke <vincent@systemli.org>
(cherry picked from commit ac9027aebb5b9ed01cf9db28abec6bb4d0025afe)

django: bump to version 3.2.18

Fixes:
  https://nvd.nist.gov/vuln/detail/CVE-2023-23969

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>

xray-core: Update to 1.7.5

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit b4c4b17308d8ca742c4522810b3a8134049f3810)
[Updated geodata to latest version, based on 669357351c1625]
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

bind: update to 9.18.11

Fixes CVEs:
      - CVE-2022-3924: Fix serve-stale crash when recursive clients
      soft quota is reached.
      - CVE-2022-3736: Handle RRSIG lookups when serve-stale is
      active.
      - CVE-2022-3094: An UPDATE message flood could cause named to
      exhaust all available memory. This flaw was addressed by adding
      a new "update-quota" statement that controls the number of
      simultaneous UPDATE messages that can be processed or
      forwarded. The default is 100. A stats counter has been added to
      record events when the update quota is exceeded, and the XML and
      JSON statistics version numbers have been updated.

Signed-off-by: Noah Meyerhans <frodo@morgul.net>
(cherry picked from commit 47fcec43abedab5c409259db1ac14c1ccc86bd02)

crun: update to 1.3

Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit 7034d3cbba813f8b19294667f058513e5745056e)

crun: update to version 1.2

release notes:

0.20.1
 - container: ignore error when resetting the SELinux label for the keyring.

0.21
 - when compiled with krun, automatically use it if the current executable file is called "krun"
 - cgroup: lookup pids controller as well when the memory controller is not available
 - status: add fields for owner and created timestamp
 - honor memory swappiness set to 0

1.0
 - Fix symlink target mangling for tmpcopyup targets.
 - Makefile.am: fix link error when using directly libcrun.
 - cgroup: add support for setting memory.use_hierarchy on cgroup v1.
 - linux: treat pidfd_open failures EINVAL as ESRCH.
 - cgroup: chown the current container cgroup to root in the container.

1.1
 - utils: retry openat2 on EAGAIN. If the openat2 syscall is interrupted, try again.
 - criu: fix save of external descriptors. Now restored containers attach correctly their standard streams.
 - criu: Add support for external PID namespace.
 - container: Set primary process to 1 via LISTEN_PID by default if user configuration is missing.
 - exec: refuse to exec in a paused container/cgroup.
 - cgroup: use cgroup.kill when available. It is faster to kill a container through its cgroup as there is no need to recurse over the cgroup pids and terminate each one of them.

1.2
 - criu: add support for external ipc, uts and time namespaces.
 - exec: fix regression in 1.1 where containers are being wrongly reported as paused.

Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit 3873a850a5219bfb3143594843964a15860f3235)

podman: update to v3.4.4

list of changes: https://github.com/containers/podman/releases

Added patch for compiling with musl. Patch can be removed on next
release as it is already merged to podman git but not on this release.
Patch moves definition in source so definition is available before it
is being used.

Patch source: https://github.com/containers/podman/pull/12564

Patch re-created with quilt.

Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit 5ff3b25509c9c1e5d1d43044fcc22dd19a10d779)

podman: update to 3.4.2

Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit b011f3faf8f84d398c197773d711ac0cdde31aa3)

nextdns: Update to version 1.39.4

Signed-off-by: Olivier Poitrey <rs@nextdns.io>

ksmbd: select ASN1 explicitly to reduce dependencies

ksmbd requires ASN.1 grammar compiler so it depends on CONFIG_ASN1. It
should select kmod-asn1-decoder for above reason.

Due to some problems with kmod-asn1-decoder in the past ksmbd was
selecting kmod-nf-nathelper-extra instead. That was affecting network
performance in kernel as each loaded conntrack module adds some overhead
to packets processing.

Fix this unwanted side effect by depending on kmod-asn1-decoder
directly.

Link: http://lists.openwrt.org/pipermail/openwrt-devel/2023-January/040298.html
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>

Merge pull request #20406 from realizelol/openwrt-21.02

[21.02] banip: renew tor urls

banip: renew tor urls as previous ones were death.

Signed-off-by: Chris Schulten <bsw.bsw@gmx.de>

knot: update to version 3.2.4

Signed-off-by: Jan Hák <jan.hak@nic.cz>
(cherry picked from commit c933a15cebe43e6d35d59281a5414438cd3c1455)

knot: update to version 3.2.3

Signed-off-by: Jan Hák <jan.hak@nic.cz>
(cherry picked from commit 4370e457c8eabc6c4c3decdb197fccc876f45a19)

knot: update to version 3.2.2

Signed-off-by: Jan Hák <jan.hak@nic.cz>
(cherry picked from commit a5913d51c7024b9f62e213541812a0bdd67e2984)

Merge pull request #20270 from mhei/21.02-php8-update-8.0.27

[21.02] php8: update to 8.0.27

Merge pull request #20358 from hnyman/rtty2102

Rtty2102

atlas-sw-probe: add more binaries

They were added in these commits [1] [2] and if they are not included,
the RIPE Atlas SW Probe does not work correctly.

This should also prevent this from happening in the future as it now. We include all
files with .sh extension file type.

[1] https://github.com/RIPE-NCC/ripe-atlas-software-probe/commit/70ced29fc3217dd8d61e2b78506b6103ded100aa
[2] https://github.com/RIPE-NCC/ripe-atlas-software-probe/commit/71a4ff0e68c55464f766ddb9f1dfe21b22e530db

Fixes: https://github.com/openwrt/packages/issues/20338
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 1a368a54095d67ea2efb25b7a205999650793bee)

Merge pull request #20357 from hnyman/wifidog2102

[21.02] wifidog: fix compilation with more recent wolfssl

Merge pull request #20356 from hnyman/libuhttpd2102

[21.02] fix libuhttpd

rtty: update to 8.0.1

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
(cherry picked from commit 0ea357c164d4d265d750459de2ad6a63149fe89e)
(cherry picked from commit 8377e516e90364e26a510dbc1140cc6a1907700b)

rtty: add compatibility for wolfssl >= 5.0

NTRU support has been removed in wolfssl 5.0 so it is required to
mask NTRU specific code if wolfssl >= 5.0

Signed-off-by: Sergey V. Lobanov <sergey@lobanov.in>
(cherry picked from commit 9913c0899a8fb6bfbda33e7a1fd84f2fa6c3ddda)

rtty: update to 8.0.0

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
(cherry picked from commit 12c5ed9a4c971a5cf314831a1a01d851be976120)

rtty: update to 7.4.1

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
(cherry picked from commit 110e24ad9c29f2bf7d200322c816a02028ccd6a3)

rtty: update to 7.4.0

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
(cherry picked from commit a9a1d8740b3cd9fdffd3ebf7f76dec8224611917)

wifidog: fix compilation with more recent wolfssl

Needs an extra header. pthread.h is also no longer implicitly included.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 4605f98b413b4b0433199e4fe6d3685344cbf933)

libuhttpd: add compatibility for wolfssl >= 5.0

NTRU support has been removed in wolfssl 5.0 so it is required to
mask NTRU specific code if wolfssl >= 5.0

Signed-off-by: Sergey V. Lobanov <sergey@lobanov.in>
(cherry picked from commit 9a9f26796bdf4bd6ebe5a9aee9dcb2feee54780f)

libuhttp: don't build examples

Speeds up compilation and potentially fixes it.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 21e5a1e7d3e55a0c49af9e5a6c8dee6c0255f507)

libuhttpd: Update to 3.12.1

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
(cherry picked from commit 4c163b0b123d26538710b78f1ef8f4f47bcdbc0b)

libuhttpd: Update to 3.12.0

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
(cherry picked from commit 756d9e906bfeb713e6b5e3e16939d8eed4f66b9f)

libuhttpd: Update to 3.11.0

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
(cherry picked from commit 3aa128f00745db22d1f2ed81d3bb3704d6c65780)

libuhttpd: Update to 3.10.1

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
(cherry picked from commit 20328691d3a254c598c9d49e55530190dd97fe16)

libuhttpd: Update to 3.10.0

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
(cherry picked from commit a5fbbb9970864934de080940d07d84bf4b0e00b4)

libuhttpd: Update to 3.9.0

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
(cherry picked from commit 696d5021da247bb31a2b0dfe0a3a53da9fdb9ab0)

nano: update to 7.2

Update nano editor to version 7.2.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 6a3d2386fa3060d47cc027767926ce26697949d3)

bash: update to 5.1.16

Signed-off-by: Huangbin Zhan <zhanhb88@gmail.com>
(cherry picked from commit 15c6fa3ddda45345948781d395d9ec9a757c7ccc)

bash: add /etc/profile.d/sys_bashrc.sh as conffile

Signed-off-by: Huangbin Zhan <zhanhb88@gmail.com>
(cherry picked from commit 2977360e46c124e4e429ea1da93494a85475bffe)

bash: update to 5.1.8

Switch to AUTORELEASE for simplicity.

Remove upstream backports.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 069f1a80b65ebde9d1df7f3a9a468660b1a451d7)

bash: fixing missing PARAMS() macro in strtod.c

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
(cherry picked from commit fd9012836aefc9abd6da8ee1c34119d193d3449d)

git: update to 2.34.6

Fixes CVE-2022-23521
Fixes CVE-2022-41903
Fixes CVE-2022-39260
Fixes CVE-2022-39253
Fixes CVE-2022-29187

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit 96e8ff604f5d980360e1ab9c0cdd22269888885c)

xray-core: Update to 1.7.2

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 65ccc4c913a2e737ce8bf37d2e0bcad95c221e61)

yq: Update to 4.30.8

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 99d6d25bb5ce31f0a12d230b91c56b0097a7bb58)

yq: Update to 4.30.7

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 3c34ef4c991f6257b55e57f8ea08357d0066117e)

snowflake: update to 2.4.2

Changes in version v2.4.2 - 2023-01-13
- Issue 40208: Enhance help info for capacity flag
- Issue 40232: Update README and fix help output
- Issue 40173: Increase clientIDAddrMapCapacity
- Issue 40177: Manually unlock mutex in ClientMap.SendQueue
- Issue 40177: Have SnowflakeClientConn implement io.WriterTo
- Issue 40179: Reduce turbotunnel queueSize from 2048 to 512
- Issue 40187/40199: Take ownership of buffer in QueuePacketConn QueueIncoming/WriteTo
- Add more tests for URL encoded IPs (safelog)
- Fix server flag name
- Issue 40200: Use multiple parallel KCP state machines in the server
- Add a num-turbotunnel server transport option
- Issue: 40241: Switch default proxy STUN server to stun.l.google.com

Signed-off-by: Nick Hainke <vincent@systemli.org>
(cherry picked from commit 5435ddb8f8f626997202b96d0cc1306c2da03a75)

miredo: add miredo.conf conffile

Keep miredo.conf modified configuration upon upgrades

Signed-off-by: ValdikSS ValdikSS <iam@valdikss.org.ru>
(cherry picked from commit 95acb627f4b6853cd8fa0329f127d52118013e65)

atlas-sw-probe: update to version 5080

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 12fd3cfe1e2d96f9e5d9c69260cf21e7f6bede45)

atlas-probe: update to 2.6.3

Switch to git tarballs.

Remove upstreamed patches and add OpenSSL patch.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 3eace67a3001b68052c81a18ee361dc7597cf71a)

golang: Update to 1.18.10

go1.18.10 (released 2023-01-10) includes fixes to cgo, the compiler,
the linker, and the crypto/x509, net/http, and syscall packages.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

php8: update to 8.0.27

This fixes:
    - CVE-2022-31631

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

libtorrent-rasterbar: Update to 2.0.8

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 991c2d452cd12bd49c65a945a966f09223542c4b)

bind: update to version 9.18.10

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
(cherry picked from commit 07f528b33121c5b26b868b6a72700e4029fe8f81)
Signed-off-by: Noah Meyerhans <frodo@morgul.net>

Merge pull request #20168 from 1715173329/my/2102-adg

[openwrt-21.02] adguardhome: update to v0.107.21

Merge pull request #20155 from paper42/libarchive-cve-21

[21.02] libarchive: update to 3.5.3, fix CVE-2022-36227

xray-core: Update to 1.7.0

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 9a7926339bba3e5d3830e2674021365f65bc83dd)
[Updated geodata to latest version, based on ea969a117a2a94]
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

rclone: Update to 1.61.1

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 822d44e8f8637c028b66cdf0ae84869699c24788)

xray-core: Update to 1.6.6-2

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 4afc17e6e0784bd507994c0e53e13a5aa21af2d6)

yq: Update to 4.30.6

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 071e97949f75de5a7dc1d19c48663e01f0c02a00)

node: bump to v14.21.2

Notable changes
* CVE-2022-43548: DNS rebinding in --inspect via invalid octal IP address (Medium)
* OpenSSL 1.1.1s
* Root certificates updated to NSS 3.85
* Time zone update to 2022f

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

AdGuardHome: update to v0.107.21

Signed-off-by: YiZhen Choo <yizhen.c02@gmail.com>
(cherry picked from commit 60ae1e56378e7e614918f6ecda52f92ab6e18c73)

adguardhome: bump to 0.107.18

* Full changelog available at:
  * https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.17
  * https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.18

Signed-off-by: Dobroslaw Kijowski <dobo90@gmail.com>
(cherry picked from commit e3dc7537812338a6200b16ba7b218ce5e6745cf4)