tailscale: Update to 1.68.0

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

ruby: update to 3.3.3

Ruby 3.3 adds a new parser named Prism, uses Lrama as a parser
generator, adds a new pure-Ruby JIT compiler named RJIT, and many
performance improvements especially YJIT.

See: https://www.ruby-lang.org/en/news/2023/12/25/ruby-3-3-0-released/

The 3.3.1 release includes security fixes.

- CVE-2024-27282: Arbitrary memory address read vulnerability with Regex search
- CVE-2024-27281: RCE vulnerability with .rdoc_options in RDoc
- CVE-2024-27280: Buffer overread vulnerability in StringIO

See: https://www.ruby-lang.org/en/news/2024/04/23/ruby-3-3-1-released/

The 3.3.2 release includes many bug-fixes.

See: https://www.ruby-lang.org/en/news/2024/05/30/ruby-3-3-2-released/

Packaging changes since 3.2.2:
- New packages: ruby-prism and ruby-rjit
- Added /usr/bin/rdbg to ruby-debug
- Added /usr/bin/syntax_suggest to ruby-syntax_suggest

The 3.3.3 release includes:

- RubyGems 3.5.11
- Bundler 2.5.11
- REXML 3.2.8
- strscan 3.0.9
- --dump=prism_parsetree is replaced by --parser=prism --dump=parsetree
- Invalid encoding symbols raise SyntaxError instead of EncodingError
- Memory leak fix in Ripper parsing
- Bugfixes for YJIT, **{}, Ripper.tokenize,
- RubyVM::InstructionSequence#to_binary, --with-gmp, and some build
  environments

See: https://www.ruby-lang.org/en/news/2024/06/12/ruby-3-3-3-released/

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

haproxy: update to v3.0.2

- Update haproxy PKG_VERSION and PKG_HASH
- See changes: http://git.haproxy.org/?p=haproxy-3.0.git;a=shortlog

Signed-off-by: Christian Lachner <gladiac@gmail.com>

unbound: Update to 1.20.0

Updated 010-configure-uname.patch as source changed.
Removed 100-example-conf-in.patch as not needed any more.

Release message:

This release has a fix for the DNSBomb issue CVE-2024-33655. This has a
low severity for Unbound, since it makes Unbound complicit in targeting
others, but does not affect Unbound so much.

To mitigate the issue new configuration options are introduced.
The options discard-timeout: 1900, wait-limit: 1000
and wait-limit-cookie: 10000 are enabled by default. They limit the
number of outstanding queries that a querier can have. This limits
the reply pulse, and make Unbound less favorable for the issue.
With the config wait-limit-netblock and wait-limit-cookie-netblock
the parameters can be fine tuned for specific destinations.
More information on the attack and Unbound's mitigations are
presented further down.

Other fixes in this release are that Unbound no longer follows symlinks
when truncating the pidfile. Unbound also does not chown the pidfile,
this is for safety reasons. There are also a number of fixes for RPZ, in
handling CNAMEs. There is a memory leak fix for the edns client subnet
cache. For DNSSEC validation a case is fixed when the query is of type
DNAME. The unbound-anchor program is fixed to first write to a temporary
file, before replacing the original. This handles disk full situations,
and because of it unbound-anchor needs permission to create that file,
in the same directory as the original file. There is also a fix for
IP_DONTFRAG, to disable fragmentation instead of the opposite.

The option cache-min-negative-ttl can be used to set the minimum TTL
for negative responses in the cache. It complements existing options to
set the maximum ttl for negative responses and to set the minimum and
maximum ttl but not specifically for negative responses.

The option cachedb-check-when-serve-expired option makes Unbound use
cachedb to check for expired responses, when serve-expired is enabled,
and cachedb is used. It is enabled by default.

The -q option for unbound-checkconf can be added to silence it when
there are no errors.

Signed-off-by: Ryan Keane <the.ra2.ifv@gmail.com>

powertop: update to 2.15

Release mainly focuses on bug fixes and patching compatibility issues.
Also, adds support to multiple platforms.
Removed obsolete patch as upstream has fixed.

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

hplip: update to 3.23.12

See: https://developers.hp.com/hp-linux-imaging-and-printing/release_notes

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

libvpx: update to 1.14.1

This release includes enhancements and bug fixes.
This release is ABI compatible with the previous release.

See: https://github.com/webmproject/libvpx/releases/tag/v1.14.1

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

squid: update to 6.10

Remove one patch - instead of messing with BUILDCXXFLAGS there we
properly define it via CONFIGURE_ARGS inside Makefile of the package.

Refresh remaining patch.

Signed-off-by: Aleksey Vasilenko <aleksey.vasilenko@gmail.com>

banip: update 1.0.0-2

* fixed a possible "Argument list too long" error in the f_log function
* fixed multiple, incomplete digit character classes
* fixed/optimized split file handling
* cosmetics

Signed-off-by: Dirk Brenken <dev@brenken.org>

sqm-scripts-extra: remove the ancient package

Remove the ancient package with experimental cake options,
from time when cake was not yet officially here.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

prometheus-node-exporter-lua: Add optional mwan3 collector

Supports interface metrics exposed by mwan3. The performance is a
little slow compared to other collectors (~300ms) as the ubus call is
where most of the time is spent. Any future speedups are likely better
put into mwan3's rpcd binary.

Signed-off-by: Ryan Doyle <ryan@doylenet.net>
[rename metrics,bump version]
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>

prometheus-node-exporter-lua: Add "node_textfile_mtime_seconds" metric

…for textfile collector, to make it more consistent with the upstream
Prometheus node-exporter

Signed-off-by: Rob Hoelz <rob@hoelz.ro>
[bump version]
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>

haproxy: update to v3.0.1

- Update haproxy PKG_VERSION and PKG_HASH
- See changes: http://git.haproxy.org/?p=haproxy-3.0.git;a=shortlog

Signed-off-by: Christian Lachner <gladiac@gmail.com>

croc: update to 10.0.8

release notes:
10.0.6: https://github.com/schollz/croc/releases/tag/v10.0.6
10.0.7: https://github.com/schollz/croc/releases/tag/v10.0.7
10.0.8: https://github.com/schollz/croc/releases/tag/v10.0.8

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>

eza: update to 0.18.18

release notes:
0.18.16: https://github.com/eza-community/eza/releases/tag/v0.18.16
0.18.17: https://github.com/eza-community/eza/releases/tag/v0.18.17
0.18.18: https://github.com/eza-community/eza/releases/tag/v0.18.18

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>

lua-eco: update to 3.5.2

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>

prometheus-node-exporter-lua: remove duplicated nat samples

Merge duplicate src/dest samples by suming their value (bytes count)

Fixes #24166

Signed-off-by: Antoine C <hi@acolombier.dev>
[bump version number]
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>

apfree-wifidog: update to 7.06.2008

Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>

apfree-wifidog: support rule group and websocket&dns proxy flag

Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>

btrfs-progs: update to 6.9

GCC14 is now supported in this release.
Release notes: https://github.com/kdave/btrfs-progs/releases/tag/v6.9

Signed-off-by: Ryan Keane <the.ra2.ifv@gmail.com>

Merge pull request #24370 from osedlbauer/pr/20240611-modemmanager-force-connection

modemmanager: improve reconnect handling

Merge pull request #24367 from mhei/php8-update-to-8.3.8-with-libgd-fixup

php8: workaround libgd capability detection (refs #23846)

tor: update to 0.4.8.12 stable

Minor release, see the changelog [1] for what's new.

[1] https://gitlab.torproject.org/tpo/core/tor/-/blob/tor-0.4.8.12/ChangeLog

Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>

modemmanager: remove status message from errors

The message 'MM_CONNECT_IN_PROGRESS' is a status message, not an error
message. To avoid confusion, the message has been removed.

Signed-off-by: Oliver Sedlbauer <osedlbauer@tdt.de>

modemmanager: add option to force connection

This commit improves the automatic reconnect logic. If the modem cannot
establish a connection, for example due to poor reception, the
proto_block_restart prevents the interface from trying to reconnect.
To enforce the connection, this commit adds a new option that allows the
system to attempt to establish a connection indefinitely.

Signed-off-by: Oliver Sedlbauer <osedlbauer@tdt.de>

adguardhome: Update to 0.107.51

View the release notes for more information:
https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.51

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

collectd: fix compilation with GCC14

Upstream backport.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

softethervpn5: update to 5.02.5184

Fixes compilation with GCC14.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

lzmq: fix compilation with GCC14

Missing header.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

fio: update to 3.37

Signed-off-by: Rosen Penev <rosenp@gmail.com>

ifstat: fix compilation with GCC14

Need explicit int.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

snowflake: update to 2.9.2

ChangeLog:
https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/blob/main/ChangeLog

Signed-off-by: Nick Hainke <vincent@systemli.org>

Merge pull request #24339 from mhei/php8-update-to-8.3.8

php8: update to 8.3.8

libdaq3: update to 3.0.15

Update to latest version.

Changelog: https://github.com/snort3/libdaq/releases/tag/v3.0.15

   ,,_     -*> Snort++ <*-
  o"  )~   Version 3.1.84.0
   ''''    By Martin Roesch & The Snort Team
           http://snort.org/contact#team
           Copyright (C) 2014-2024 Cisco and/or its affiliates. All rights reserved.
           Copyright (C) 1998-2013 Sourcefire, Inc., et al.
           Using DAQ version 3.0.15
           Using LuaJIT version 2.1.0-beta3
           Using OpenSSL 3.0.13 30 Jan 2024
           Using libpcap version 1.10.4 (with TPACKET_V3)
           Using PCRE version 10.42 2022-12-11
           Using ZLIB version 1.3.1
           Using Hyperscan version 5.4.2 2024-05-26
           Using LZMA version 5.4.6

Build system: x86/64
Build-tested: x86/64/AMD Cezanne
Run-tested: x86/64/AMD Cezanne

Signed-off-by: John Audia <therealgraysky@proton.me>

gnuplot: update to 6.0.1

Signed-off-by: Aleksey Vasilenko <aleksey.vasilenko@gmail.com>

logrotate: update to 3.22.0

Signed-off-by: Aleksey Vasilenko <aleksey.vasilenko@gmail.com>

sing-box: update to 1.9.3

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

golang: Update to 1.22.4

go1.22.4 (released 2024-06-04) includes
security fixes to the archive/zip and net/netip packages,
as well as bug fixes to the compiler,
the go command, the linker,
the runtime, and the os package.

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

nvme-cli: update to 2.9.1

- Add patch to compile on musl

Signed-off-by: Aleksey Vasilenko <aleksey.vasilenko@gmail.com>

libnvme: update to 1.9

- Don't set default Meson option

Signed-off-by: Aleksey Vasilenko <aleksey.vasilenko@gmail.com>

Merge pull request #24314 from commodo/python-updates1

django,python-{requests,evdev,lxml}: bump versions

erlang: fix mis-detection of transparent hugepages

Latest Erlang update incorrectly detects THP as always enabled,
which leads to segmentation fault on systems without transparent hugepages.
Here we manually override configure flag by checking actual option of target kernel.

Signed-off-by: Aleksey Vasilenko <aleksey.vasilenko@gmail.com>

perl: fix compilation with GCC14

Need the header for fegetround.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

sing-box: update to 1.9.2

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

git: update to 2.45.2

- Replace one patch with configure vars override
- Refresh other patches

Signed-off-by: Aleksey Vasilenko <aleksey.vasilenko@gmail.com>

libtirpc: update to 1.3.4

Signed-off-by: Rosen Penev <rosenp@gmail.com>

zsh: fix compilation with GCC14

Upstream backport and local patch.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

stress-ng: bump to version 0.17.08

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>

utils/findutils: update to 4.10.0

* utils/findutils/Makefile (PKG_VERSION): Update to latest.
(PKG_HASH): Update.

Signed-off-by: Bernhard Voelker <mail@bernhard-voelker.de>

iperf3: fix usage with big endian

Upstream submissions.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

sing-box: update to 1.9.1

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

banip: release 1.0

* made sure, that the domain lookup always add the found IPs to the underlying allow-/blocklist-Set
* major readme update

Signed-off-by: Dirk Brenken <dev@brenken.org>

php8: workaround libgd capability detection (refs #23846)

This is an alternative approach to #24209. Instead of switching
to bundled/internal libgd, workaround the capability detection
by giving the information to the build system directly.

PHP's original approach does not work when cross-compiling,
but since it is known which features are enabled in OpenWrt's
build, we can directly enable these features here, too.

This is not that future prove, but should do the job for the
moment until a proper solution was discussed with upstream.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

php8: update to 8.3.8

This fixes:
    - CVE-2024-4577
    - CVE-2024-5458
    - CVE-2024-5585

Changelog: https://www.php.net/ChangeLog-8.php#8.3.8

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

nghttp2: update 1.62.1

- Switch source back to .xz according to CONTRIBUTING.md

Signed-off-by: Aleksey Vasilenko <aleksey.vasilenko@gmail.com>

devel: gcc: update to 13.3

Update GCC13 to 13.3, like in the root repo.

It fixes buildbot error:
make[3]: *** [Makefile:257: /builder/shared-workdir/build/sdk/dl/gcc-13.3.0.tar.xz] Error 255

Signed-off-by: Robert Marko <robimarko@gmail.com>

python-networkx: update to 3.3

Signed-off-by: W. Michael Petullo <mike@flyn.org>

pdns-recursor: update to 5.0.6

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>

curl: update to 8.8.0

- Switch source to .xz according to CONTRIBUTING.md
- Switch project URL to  HTTPS
- Drop upstreamed patch
- Refresh remaining patch
- Adopt the package

Signed-off-by: krant <aleksey.vasilenko@gmail.com>

ngtcp2: update to 1.5.0

- Switch source to .xz according to CONTRIBUTING.md
- Adopt the package

Signed-off-by: krant <aleksey.vasilenko@gmail.com>

nghttp3: update to 1.3.0

- Switch source to .xz according to CONTRIBUTING.md
- Adopt the package

Signed-off-by: krant <aleksey.vasilenko@gmail.com>

frr: fix compilation with GCC14

Fixes:
zebra/zebra_netns_notify.c: In function 'zebra_ns_ready_read':
zebra/zebra_netns_notify.c:265:40: error: implicit declaration of function 'basename' [-Wimplicit-function-declaration]
  265 |         if (strmatch(VRF_DEFAULT_NAME, basename(netnspath))) {
      |                                        ^~~~~~~~

Fixed by including libgen.h, then since basename may modify its
parameter, allocate a copy on the stack, using strdupa, and pass the
temporary string to basename.

According to the man page for basename:
With glibc, one gets the POSIX version of basename() when
<libgen.h> is included, and the GNU version otherwise.

The POSIX version of basename may modify the contents of path,
so we should to pass a copy when calling this function.

[1] https://man7.org/linux/man-pages/man3/basename.3.html

Signed-off-by: Georgi Valkov <gvalkov@gmail.com>

Revert "ci: no longer require real name"

It was decided that we should require to use real name once again.
There was discussion about it on the mailing list [1], which
was based on the commit in different OpenWrt repo [2]

This reverts commit 7e6cd98ad481184b1a620a9862aa3713d1ab85cc.

[1] https://lists.openwrt.org/pipermail/openwrt-devel/2024-April/042711.html
[2] https://github.com/openwrt/actions-shared-workflows/commit/12d9551f2d07ec34ac813da8612c8014fb393af6

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

natmap: update to 20240603

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

prometheus-node-exporter-lua: fix netclass duplicate TYPE lines

Fixes a315c40b7232bbc83582685c98e41466d84d7a35

[initial fix]
Signed-off-by: René Treffer <treffer@measite.de>
[fixup René version]
Signed-off-by: PichetGoulu <pichet@nosuid.be>
[actual commit]
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>

Merge pull request #24037 from TDT-AG/pr/20240429-keepalived

keepalived: remove not supported notify script handling

mdnsreponder: update to 2200.100.94.0.2

The IETF fork is unmaintained. In addition, the versioning is incompatible with apk.

010-uclibc.patch is pointless as uclibc is no longer used by OpenWrt.

020-fix-core-dump-while-parsing-interface-list.patch was an upstream
backport. No longer needed.

Added tls=no to avoid mbedtls dependency.

mDNSIdentify is gone.

Added back patches from version 878.200.35. They required manual
refreshing. 120-reproducible-builds.patch is probably needed. Not sure
about 100-linux_fixes.patch.

Add OpenEmbedded patches. Some crash fixes. mdnsd is less noisy with
them.

Log stderr to the log. Otherwise there's no output.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

sane-backends: fix compilation with GCC14

Upstream backport.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

gdbm: update to 1.23

Just make the library instead of everthing.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

ostiary: fix compilation with GCC14

Wrong pointer type.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

libv4l: fix compilation without utils

Upstream backport.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

v4l2camera: update to 0.2.0

fix compilation when ALSA is found

Need to link against libasound.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

libgpiod: update to 2.1.2

Signed-off-by: Russell Senior <russell@personaltelco.net>

Merge pull request #24183 from TDT-AG/pr/20240517-ddns

ddns-scripts: do not verify DNS server on start

frr: add support for BGP MD5 authentication

You have to enable the CONFIG_TCP_MD5SIG kernel config option to be able
to use the BGP MD5 authentication.

Signed-off-by: Martin Schiller <ms@dev.tdt.de>

node: bump to v20.14.0

Notable Changes
* src,permission: throw async errors on async APIs (Rafael Gonzaga)
* (SEMVER-MINOR) test_runner: support forced exit (Colin Ihrig)

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

hev-socks5-server: update to 2.6.6

Signed-off-by: Ray Wang <r@hev.cc>

acme-common: export main_domain

To avoid confusion, first create the main_domain var and only then export it.

Signed-off-by: Sergey Ponomarev <stokito@gmail.com>

acme-common: migrate deprecated options

Add to uci-defaults script a migration from old deprecated options to new:
  use_staging to staging
  keylength to key_type
  remove standalone
  add missing validation_method

We still support the old options in the acme.init if old config was copied after installing of the newer version of the acme-common.

Signed-off-by: Sergey Ponomarev <stokito@gmail.com>

django: bump to version 5.0.6

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>

python-requests: bump to version 2.32.3

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>

python-lxml: bump to version 5.2.2

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>

python-evdev: bump to version 1.7.1

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>

at: update to 3.2.5

- Use upstream tarball
- Update project URL
- Drop obsolete patches

Signed-off-by: krant <aleksey.vasilenko@gmail.com>

ffmpeg: fix compilation with gcc14

Requires disabling a warning as there's an incompatibility between musl
ioctl and v4l2_ioctl.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

apache: update to 2.4.59

- Remove obsolete OpenSSL patch - upstream handles it by itself now
- Refresh another patch
- Remaining patches are unaffected

Signed-off-by: krant <aleksey.vasilenko@gmail.com>

c-ares: update to 1.29.0

Signed-off-by: krant <aleksey.vasilenko@gmail.com>

zstd: update to 1.5.6

- Adopt the package

Signed-off-by: krant <aleksey.vasilenko@gmail.com>

fping: update to 5.2

Signed-off-by: krant <aleksey.vasilenko@gmail.com>

gst1-libav: update to 1.24.4

Signed-off-by: W. Michael Petullo <mike@flyn.org>

gst1-plugins-ugly: update to 1.24.4

Signed-off-by: W. Michael Petullo <mike@flyn.org>

gst1-plugins-bad: update to 1.24.4

Signed-off-by: W. Michael Petullo <mike@flyn.org>

gst1-plugins-good: update to 1.24.4

Signed-off-by: W. Michael Petullo <mike@flyn.org>

gst1-plugins-base: update to 1.24.4

Signed-off-by: W. Michael Petullo <mike@flyn.org>

gstreamer1: update to 1.24.4

Signed-off-by: W. Michael Petullo <mike@flyn.org>

prometheus-node-exporter-lua-hostapd_stations: fix not reporting metrics

- fix incorrect interface name mapping in hostapd_stations exporter

Signed-off-by: Balázs Urbán <szalab9@gmail.com>
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>

prometheus-node-exporter-lua: add missing libubus-lua dependency

Fixes a315c40b7232bbc83582685c98e41466d84d7a35

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>

whois: update to 5.5.23

- Switch to local tarball

Signed-off-by: krant <aleksey.vasilenko@gmail.com>

wsdd2: fix compilation with GCC14 and 64-bit

struct msghdr under musl uses padding ints for 64-bit, which means we
can't direct initialize like this. Switch to initializing each member
explicitly.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

libarchive: update to 3.7.4

Signed-off-by: krant <aleksey.vasilenko@gmail.com>