MarkupSafe: update to version 2.0.1

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit c30b80484238cd2d255fa75f856e470f2bd6161b)

click: update to version 8.0.1

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 01620b9cfb4a86c959c826edc22bf6626af9c684)

itsdangerous: update to version 2.0.1

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 6ab3b605cf91387cb69075f2c39cfd9e91ce28d3)

Merge pull request #16195 from miska/snort3-21.02

net/snort3: Include default configs and snort2lua

knot-resolver: update to version 5.4.0

* refresh patches
* disable kres_gen_test to fix cross

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit e7127d468490baeaa863b4ab817ac05ec74186fa)

knot: update to version 3.1.0

* refresh patches

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit 81e0fcb76fd886dd0188d5da341e6fb7c38677c5)

Merge pull request #16309 from jefferyto/golang-1.16.7-openwrt-21.02

[openwrt-21.02] golang: Update to 1.16.7

Merge pull request #16307 from jefferyto/python-twisted-21.7.0-openwrt-21.02

[openwrt-21.02] python-twisted: Update to 21.7.0, refresh patches

golang: Update to 1.16.7

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 4d7a71a7cbb144c098526282aee81a748259bd83)

python-twisted: Update to 21.7.0, refresh patches

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 4fa4cd832208e59ada0cb8cba9c99afe9467231a)

Merge pull request #16288 from Linaro1985/openwrt-21.02_fix_libxslt

[21.02] libxslt: fix compilation because of wrong libxml2 check in configure script

libxslt: fix compilation because of wrong libxml2 check in configure script

More details: https://github.com/GNOME/libxslt/commit/90c34c8bb90e095a8a8fe8b2ce368bd9ff1837cc

Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
(cherry picked from commit b5ac497d66e53dfe0e3408c57ff34a02e52c26e5)

Merge pull request #16258 from stangri/21.02-curl

[21.02] curl: enable HTTP/2 support by default

Merge pull request #16275 from stangri/21.02-simple-adblock

[21.02] simple-adblock: update to 1.8.7-6

simple-adblock: update to 1.8.7-6

* supports newer shellcheck
* restore EXTRA_COMMANDS compatibility with 19.07
* move status display from various functions to status_service
* bugfix: status_service line break after output
* minor arythmetic fix in status_service

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #16253 from stangri/21.02-https-dns-proxy

[21.02] https-dns-proxy: update to 2021-07-29-1

Merge pull request #16266 from nxhack/2102_node_14174

[21.02] node: bump to 14.17.4

Merge pull request #16264 from mhei/21.02-php8-update

[21.02] php8 update to 8.0.9

Merge pull request #16267 from mhei/21.02-php7-update

[21.02] php7: update to 7.4.22

Merge pull request #16265 from mhei/libxml2-update

[21.02] libxml2: update to 2.9.12

php7: update to 7.4.22

This fixes:
    - CVE-2021-21704
    - CVE-2021-21705

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commits
  - 555d0c9a291cb9ffaefaa22da36095613857e10f
  - f15aba89f725f31d03edd95e03547670ca994e47
  - 741d6d6768e4d3d9a85d83fb7a6dce422cefde5a)

libxml2: update to 2.9.12

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 6b932d3ff77c63fe01080139c147c86da12f0c88)

php8: add CI runtime test

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 2dad6524460a62f879e0df2786090d99e6c837fa)

php8: update to 8.0.9

Also update opcache makefile patch.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commits
 - 5e82e6be718186aab63b71f9396732cd341f924c
 - 0154157b6c6ef5f2907dca0aa3c14588cfc196d2
 - 961b7c5a25be907d9b89d3b18cd83618d8e38453
 - 7ddd5280d48609cad139e80774a57cc6c51921ee
 - 9080dce60f8c3013747058971b9af38867ba1073)

node: bump to 14.17.4

July 2021 Security Releases:

Use after free on close http2 on stream canceling (High) (CVE-2021-22930)
Node.js is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22930

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

curl: enable HTTP/2 support by default

Description: Lack of support of HTTP/2 by default starts to hurt,
for example with https-dns-proxy package, some DoH resolvers (like mullvad)
no longer support HTTP/1 and are not usable.

This enables HTTP/2 support by default (which would bring ~68Kb libnghttp).

Signed-off-by: Stan Grishin <stangri@melmac.net>

https-dns-proxy: update to 2021-07-29-01

* update binary to the latest commit (2021-07-29) to fix #16222 and #16239
* add hotplug.d/iface file and update Makefile to install it
* use Cloudflare's and Google's bootstrap DNS if bootstrap DNS is missing
* minor improvements in append_bool function
* add append_counter function for verbosity setting
* add append_bootstrap function (and supporting functions) to parse/sanitize bootstrap setting
* move firewall array from 'main' instance to the first proxy instance
* delete useless 'main' instace

Signed-off-by: Stan Grishin <stangri@melmac.net>

nextdns: Update to version 1.35.0

Signed-off-by: Olivier Poitrey <rs@nextdns.io>

dawn: update to 2021-07-27

276ca16 msghandler: fix rrm array parsing
1e4871d datastorage: debug rrm capabilities

Signed-off-by: Nick Hainke <vincent@systemli.org>
(cherry picked from commit 6582979678714d4c71276adf4caa6e09f8f3c76b)

travelmate: update to 2.0.4

* code cleanup
* add auto login script for Julianahoeve beach resort (NL)
* add auto login script for Vodafone hotspots (DE)
* add auto login script for telekom hotspots (DE)
* enhance captive portal detection to support html redirects as well
* change default captive portal detection url to
  'detectportal.firefox.com'

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 380a5110b4d8df56c2a66c78657ee84bbcd611d3)

Merge pull request #16145 from stangri/21.02-vpn-policy-routing

[21.02] vpn-policy-routing: update to 0.3.5-1

adblock: bugfix 4.1.3-3

* fix regex to prepare google safesearch domains

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 69a2a68c31b2abf93786c337db55088115c3aa42)

librouteros: don't build docs

Fixes compilation without host pod2man.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit e41fd1794be2e8cc78c3df4bc4f4e05100eda959)

Merge pull request #16213 from 1715173329/yq-2102

[openwrt-21.02] yq: Update to 4.11.2

yq: Update to 4.11.2

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit d8fcfb062814fb6b5cee97f35373f864cf4dd00d)

net/snort3: Include default configs and snort2lua

Include default configuration files to have something to start from.
Also include snort2lua to help convert snort2 rules to snort3 to also
help with bootstrapping the configuration.

Signed-off-by: Michal Hrusecky <michal.hrusecky@turris.com>

syslog-ng: update to version 3.33.2

Changelog:
https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-3.33.2

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 4b06f9ff4c3c5abe54ccd9248de9cf52f198d63d)

ddns-scripts: use https for google ipv6 ddns url

This matches an ipv4 change in 21f5cdd2fa and has the same rationale.
Google requires https for both ipv6 and ipv6.

Signed-off-by: Scott Lamb <slamb@slamb.org>
(cherry picked from commit e5f45b94c0ecfd9548d2efa7bba04e014dc66bf3)

erlang: disable PIE

Fails to compile with it on.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 5685d9226860a2a008bbcf8d8cf9aae212afa904)

yggdrasil: bump to 0.4.0

- Bump yggdrasil-go version to v0.4.0
- Update ygguci tool for compatibility with the new yggdrasil-go version
- Yggdrasil's config file is now generated in a separate command before running the daemon

Signed-off-by: George Iv <zhoreeq@users.noreply.github.com>
(cherry picked from commit e135c4c86764f84339bba44d87153ed7db14d396)

Merge pull request #16165 from stangri/21.02-vpnbypass

[21.02] vpnbypass: update to 1.3.2-1

vpnbypass: updates to 1.3.2-1

bugfix: domain names bypass
rename config file
update Makefile
updated README link
updated shellcheck compatibility
support for 21.02.0-rc2 and later
updated code for interface triggers
add newline to test.sh

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #16154 from nwidger/niels/delve-1.7.0-openwrt-21.02

[openwrt-21.02] delve: Update to 1.7.0

Merge pull request #16156 from 1715173329/yq-2102

[openwrt-21.02] yq: Update to 4.11.0

Revert "net/miniupnpd: ext_ip_reserved_ignore support"

This patch is causing several issues [1], which then were reported to
upstream [2] and it was not accepted by upstream [3]. This results that
nobody maintain this custom patch and it is not useful as it is changing
addr_is_reserved behavior.

[1] https://github.com/openwrt/packages/issues/15258
[2] https://github.com/miniupnp/miniupnp/issues/542
[3] https://github.com/miniupnp/miniupnp/pull/511

This reverts commit b76aa9919489f49b472a8f939f6d46ca33d05f64.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 107f3376b5114cd17c115e25026b031bd439e9be)

knot: update to version 3.0.8

Signed-off-by: Jan Hak <jan.hak@nic.cz>
(cherry picked from commit 5f374929cfdf59fd1b2ec558cd024f5b301d3169)

knot: update to version 3.0.7

Signed-off-by: Jan Hak <jan.hak@nic.cz>
(cherry picked from commit 8d66f49baef164e6c7a621dd7e72328f62f242f4)

yq: Update to 4.11.0

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit a5f657ecf791faca53ab85393a8fc0ddc4de8683)

delve: Update to 1.7.0

See
https://github.com/go-delve/delve/blob/master/CHANGELOG.md#170-2021-07-19
for changes.

Signed-off-by: Niels Widger <niels@qacafe.com>
(cherry picked from 098d61ca1)

Merge pull request #16150 from jefferyto/golang-1.16.6-openwrt-21.02

[openwrt-21.02] golang: Update to 1.16.6

golang: Update to 1.16.6

Includes fix for CVE-2021-34558 (crypto/tls: clients can panic when
provided a certificate of the wrong type for the negotiated parameters).

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit c0c62227bd23e0ad9b3a0db1a907bc5bf18579c8)

Merge pull request #16147 from luizluca/21.02/sane-fix_backport

[21.02] sane-backends fix usbid generation (backport)

sane-backends: use macros (properly), remove chmod

- use $(INSTALL_DIR) instead of mkdir
- using $(INSTALL_CONF) and then running chmod is pointless, use
  $(INSTALL_DATA) directly
- /etc/xinetd.d/sane-port doesn't need read protection from non-root
  users, use $(INSTALL_DATA) as well

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
(cherry picked from commit f37006c2e641882dde01512f8a035bf42c6f46b8)

sane-backends: fix usbid file generation

On some build systems (build bots, Debian Buster for example) the
current mechanism in the Build/Install define doesn't run. Replace it
with shell fu that works.

Issue was reported, see [1].

[1] https://github.com/openwrt/packages/issues/16085

Fixes #16085

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
(cherry picked from commit 977109e28613820ff451908289ff6e4cc671ec32)

vpn-policy-routing: update to 0.3.5-1

support for 21.02.0-rc2 and up
support for reloading a single interface on ifup/ifupdate
rename config file
updated shellcheck compatibility
remove obsolete create/remove_lock
interface processing optimizations to speed up reloads
drop dependency on curl in user scripts
uniform styling of functions

Signed-off-by: Stan Grishin <stangri@melmac.net>

stress-ng: bump to version 0.12.10

Patch `010-soft-float.patch` can be dropped.
It was upstreamed via https://github.com/ColinIanKing/stress-ng/pull/126

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
(cherry picked from commit 6f48074e79fd5185798d2bf60583313d93cfde6c)

stress-ng: bump to version 0.12.07

Refreshed patch.

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
(cherry picked from commit 96692fa6c181db11bc4b72e073c52b025cbd4c98)

stress-ng: bump to version 0.12.06

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
(cherry picked from commit 940492c577b9f6c36e3f4f4b9ed8c75586871348)

stress-ng: bump to version 0.12.04

Refreshed patch.

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
(cherry picked from commit 987c82cc73c3dca39658b36dc3a791aae4cb4d54)

ruby: update to 3.0.2

This release fixes some bugs and these vulnerabilities:

* CVE-2021-31810: Trusting FTP PASV responses vulnerability in Net::FTP
* CVE-2021-32066: A StartTLS stripping vulnerability in Net::IMAP
* CVE-2021-31799: A command injection vulnerability in RDoc

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
(cherry picked from commit 1b41e8f641b612e3738ba391cf3ee97d0b8ff288)

Merge pull request #16119 from commodo/python-updates1-21.02

[21.02] python-{simplejson,cffi}: bump versions

Merge pull request #16125 from jefferyto/addrwatch-fixes-openwrt-21.02

[openwrt-21.02] addrwatch: Various fixes

Merge pull request #16128 from 1715173329/yq-2102

[openwrt-21.02] yq: Update to 4.9.8

dawn: update to 2021-07-11

ec9a3a9 fix GCC11 compilation

Thanks to neheb and cotequeiroz.

Signed-off-by: Nick Hainke <vincent@systemli.org>
(cherry picked from commit ee4616fb43b489003cab957e3a2d6f5f14c6fb97)

dawn: update to 2021-07-08

555268b ubus: filter neighbors by SSID when preparing nr
3db9607 data storage: match SSID when searching ap entry
a22f5a7 storage: ensure SSID strings are NULL-terminated

Signed-off-by: Nick Hainke <vincent@systemli.org>
(cherry picked from commit 163ccbf0236824b29fd2158d3a287dda5e427b00)

yq: Update to 4.9.8

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 855e5b6eb5f84fe8463623cde279d561f5b00264)

addrwatch: Various fixes

Makefile changes include:

* Remove USE_UCLIBC, as uclibc is no longer supported

* Package output modules

* Move main binary (back) to /usr/sbin, as it is system administration
  related and requires superuser privileges

New patches:

* 003-add-space-for-null-byte.patch - from
  https://github.com/fln/addrwatch/commit/374cfd2cabe4db9882d8a210adff430cc579f859

* 004-more-specific-library-linking.patch - from
  https://github.com/fln/addrwatch/commit/27b57d9da322fc16c6904d8e35aae4557a3e517b

* 005-use-c99-format-macro-constants.patch - from
  https://github.com/fln/addrwatch/pull/28

Init script changes include:

* Change from explicit disable to explicit enable, so that the service
  is disabled by default and on first install

* Set config option default values to default values of the main binary

* Fix command-line option names and format (from
  https://forum.openwrt.org/t/cant-start-addrwatch-service/60499/3)

* Always use the --quiet command-line option, as the procd instance is
  not configured to capture stdout/stderr

* Change the syslog config option to start the syslog output module

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 31ae85bca963ce240c9e1b8df55294587b079161)

yggdrasil: allow HTTPS connections

Signed-off-by: James Vorderbruggen <jamesvorder@gmail.com>
(cherry picked from commit ffff3473966c42133b8faed7d8a120739c5451d4)

yggdrasil: bump to 0.3.16

Signed-off-by: George Iv <zhoreeq@users.noreply.github.com>
(cherry picked from commit 76b642b50ff8a606780c43eef2bb030a60dcdb17)

python-cffi: bump to version 1.14.6

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
(cherry picked from commit e08b94b7538474812c18fc109f0372bbb2710d1f)

python-simplejson: bump to version 3.17.3

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
(cherry picked from commit 3f2d7052743500e993a5f4a39cef0dc0eaac4d60)

openvpn: enable LZO support by default for OpenSSL variant

User that don't control both OpenVPN client and server
might still need LZO support, so keep it enable by default for at least
OpenSSL variant.

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit 03c3c924965a74b650a45394cc424b4d02f333f1)

syslog-ng: disable mqtt

For now, disable mqtt as it was automatically enabled as the build
system finds compiled libpaho-mqtt-c and requires dependency.

---
Here is the output:
Package syslog-ng is missing dependencies for the following libraries:
libpaho-mqtt3c.so.1
---

This is a new feature since syslog-ng 3.33.1 and if anyone is interested
in it, it can be enabled.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit e319e89fde0f3c6b3c8ecfffe9bd759c9a44ac15)

mwan3: bump PKG_VERSION to 2.10.11

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 44d79147ea9d75bb4a5488bf2f600d9c76561e60)

mwan3: add troublshoot command from LuCI

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 619b721c2f9b0b1c88f9fde7da75c9e37a060a47)

mwan3: cleanup help output

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit a9dac71e3d7f2d46f7d051cb8ffe235c49177848)

syslog-ng: update to version 3.33.1

- Release notes:
https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-3.33.1

- Bump version in config
It fixes:
WARNING: Configuration file format is too old, syslog-ng is running in compatibility mode. Please update it to use the syslog-ng 3.33 format at your time of convenience. To upgrade the configuration, please review the warnings about incompatible changes printed by syslog-ng, and once completed change the @version header at the top of the configuration file; config-version='3.31'

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 2b4be08a8c4fbe3d6dec90b91726375e9b38db61)

Merge pull request #16088 from turris-cz/21.02/lxc-change-gpgkeyserver

lxc: add patch to switch GPG server

apache: update to 2.4.48

Refreshed patch.

Fixes:

CVE-2019-17567
CVE-2020-13938
CVE-2020-13950
CVE-2020-35452
CVE-2021-26690
CVE-2021-26691
CVE-2021-30641
CVE-2021-31618

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 6dfd07097de4e737444cf70c62d34453bbf84f7a)

Merge pull request #16093 from Andy2244/samba-4.14.5_(21)

[21.02] samba4: update to 4.14.5

Merge pull request #16092 from Andy2244/libtirpc-1.3.2_-21]

[21.02] libtirpc: update to 1.3.2

Merge pull request #16091 from Andy2244/rpcbind-1.2.6_-21]

[21.02] rpcbind: update to 1.2.6

Merge pull request #16090 from Andy2244/softethervpn-5.02.5180_(21)

[21.02] softethervpn5: update to 5.02.5180

Merge pull request #16094 from Andy2244/wsdd2-git-2021-06-28_(21)

[21.02] wsdd2: update to git 2021-06-28

transmission: add new syscalls to seccomp filter

Testing showed that additional syscalls are needed on ARMv7.
Add "getegid32", "geteuid32", "getgid32" and "getrandom" as they are
all innocent.
Bump PKG_RELEASE.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 1141ee1e5163d0882c0c8ab00c200b797b1ac85f
and commit a78e527012dd0b772bcfbda980b17575410edffd)

netdata: update to version 1.30.1

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 1d532fa545eef1ebd3ebef6ab41dfd709ad991e1)

wsdd2: update to git 2021-06-28

* update to git 2021-06-28
* add extra startup delay

Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>

samba4: update to 4.14.5

* update to 4.14.5
* refresh patches

Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>

softethervpn5: update to 5.02.5180

* update to 5.02.5180
* add dep: libsodium

Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>

rpcbind: update to 1.2.6

* update to 1.2.6
* remove upstream merged patch

Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>

libtirpc: update to 1.3.2

* update to 1.3.2

Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>

lxc: add patch to switch GPG server

By default, there was used sks-keyservers.net pool, which has invalid
SSL certificate and they also announced that their service is deprecate
and no longer maintained.

Use the same GPG server as LXC is using by default in the newer
releases.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #16065 from 1715173329/yq-2102

[openwrt-21.02] yq: Update to 4.9.7

yq: Update to 4.9.7

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit faf915e97d070d05c5a27654ebb07389123f26e7)

Merge pull request #16050 from nxhack/2102_libuv_CVE-2021-22918

[21.02] libuv: fix CVE-2021-22918

python3: do a simple ls on pip & setuptools if not selected for build

I seem to forget to check/select setuptools and pip (that come bundled with
Python).
This change will do a simple 'ls' on the 2 wheel files, so that the build
fails even if just building Python.

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>

python3: update to version 3.9.6

Refreshed patches.
Bumped pip to 21.1.3.

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
(cherry picked from commit 44e009364f5a115172f5825fbfd8c0b3730021a5)

mwan3: use default routes from additional tables

Until now the additional tables listed in gobal 'rt_table_lookup' were
not considered for interfaces.
In order to be able to also use interface-defined routes from tables
other than main, consider also tables listed in 'rt_table_lookup'.
Update version to 2.10.10 as requested by maintainer.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit cb02b42007878147b514b1cb86246bfa09615d35)

libuv: fix CVE-2021-22918

idna: fix OOB read in punycode decoder

libuv was vulnerable to out-of-bounds reads in the uv__idna_toascii()
function which is used to convert strings to ASCII. This is called by
the DNS resolution function and can lead to information disclosures or
crashes.

https://github.com/libuv/libuv/commit/b7466e31e4bee160d82a68fca11b1f61d46debae
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=990561
https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

Merge pull request #16015 from DeathCamel58/openconnect-backport-iconv/intl-fixes

openconnect: backport iconv/intl fix