Update from 4.0.1 to 4.10.1. Notable changes across releases:
- 4.10.1: switch to cProfile (profile module deprecated in Python 3.15);
fix Literal membership tests and sequence type handling
- 4.10.0: fix MSVC initialization delays in GitHub Actions; fix variant
directory components in CompilationDatabase; improve Ninja quoting
- 4.9.0: drop Python 3.6 support; add comprehensive type hints for Node
classes; add clang/clang++ to default tool search order; support binary
and octal integer constants in C preprocessor
- 4.8.0: replace black/flake8 with ruff; add MSVC_TOOLSET_VERSION,
MSVC_SDK_VERSION, MSVC_SPECTRE_LIBS construction variables
- 4.7.0: make NewParallel scheduler the default; CacheDir writes execute
in parallel outside taskmaster critical section; add Python 3.13 support
- 4.6.0: add Visual Studio 2026 and ARM64 host configuration support;
enhanced type hints throughout Environment and Node classes
- 4.5.0: add ValidateOptions(); refactor Taskmaster into a package;
migrate to Python's logging module; extend ninja tool with daemon support
- 4.4.0: add MSVC_USE_SETTINGS and multiple MSVC configuration variables;
implement global policy settings for MSVC version handling
- 4.3.0: add SConsEnvironmentError exception; improved MSVC detection;
Python 3.12 compatibility fixes
- 4.2.0: Performance improvements in Node processing; improved MSVC
support for VS 2022; better parallel build handling
Update from 17.00.0004 (2024-12-09) to 18.00.0001 (2026-03-23).
This is a major version bump to the 18.x series, aligning with
PostgreSQL 18 support. Switch from a fixed git commit to the
18.00.0001 tagged release.
Add test.sh to verify the psqlodbca and psqlodbcw shared libraries
are present after installation.
- 6.19.0: fix log sunit automatic configuration in mkfs; fix data
corruption bug in libxfs_file_write; fix various memory leaks; improve
realtime subvolume info in xfs_io statfs
- 6.18.0: adjust nr_zones for zoned filesystems on conventional devices
in mkfs; fix xfs_logprint pointer bugs; fix mdrestore superblock length
check; add 2025 LTS config
- 6.16.0: atomic write enhancements for maximum atomic write limits at
mount time; refactor log recovery infrastructure; remove experimental
warnings from xfs_scrub
- 6.13.0: comprehensive metadata directory support in xfs_repair, xfs_db,
and mkfs; realtime group support with new RT group structures; quota
inodes use metadata directory infrastructure; realtime space quotas
- 6.12.0: realtime device support in xfs_db; file range commit ioctls
with atomic write statx fields; modernize perag lookup to xarray;
require -std=gnu11 for compilation
Add test.sh to verify xfs-mkfs and xfs-fsck report the correct version
and xfs-admin/xfs-growfs produce expected help output.
Update from 6.11 to 7.5. Notable changes across releases:
- 7.5: fix cifscreds command-line option parsing and ambiguous command
matching; documentation updates for echo_interval parameter
- 7.4: retry logic for -EINPROGRESS errors during mount operations;
improved handling for multiple IP address resolution scenarios
- 7.3: fix guest mount option handling; prevent empty password
parameters from being passed to the SMB client
- 7.2: improve return code checking in getcifsacl; better handling of
permission-related errors across different kernel versions
- 7.1: add upcall_target mount option for namespace resolution; enable
credential lookups in host or application namespace (e.g., Kubernetes)
- 7.0: migrate files to /usr per DEP17 M2 standard
- 6.15: fix CVE-2022-27239 (stack buffer overflow in ip= argument
parsing) and CVE-2022-29869 (info leak in verbose logging)
Add libtalloc dependency to cifsmount
Add test.sh to verify mount.cifs and smbinfo report the correct version.
Paul Donald [Tue, 21 Apr 2026 14:10:02 +0000 (16:10 +0200)]
ocserv: bump to v1.4.1
* Version 1.4.1 (released 2026-02-28)
- [SECURITY] Fixed authentication bypass (medium severity) when using
certificate authentication with cert-user-oid set to SAN(rfc822name):
a client presenting a valid CA-signed certificate without the expected
RFC822 SAN field could authenticate using password credentials alone,
bypassing the intended certificate-to-username binding. Requires the
attacker to possess both a valid CA-signed certificate and valid user
credentials (694)
- The bundled inih was updated to r62.
- The bundled protobuf-c was updated to 1.5.2.
- Fixed a bug where session timeout could be bypassed by reconnecting
(e.g., closing/opening laptop lid) (599)
- occtl: 'show user' command now includes a 'Session started at:' field,
indicating when the VPN session was established
- occtl: Fix column misalignment in ban command outputs
- occtl: Fix 'show ip bans' may produce invalid JSON (683)
- Handle dotted client hostnames (e.g., .local) by stripping the domain suffix
- Renamed `min-reauth-time` configuration option to `ban-time` to better reflect
its purpose (676). This option defines the duration (in seconds) for which
an IP address is banned after exceeding the maximum allowed `max-ban-score`.
Default is 300 seconds (5 minutes).
- Fixed ocserv-worker process title
- Fixed ignored udp-port in vhost (612)
* Version 1.4.0 (released 2026-01-04)
- The bundled llhtp was updated to 9.3.0.
- The bundled protobuf-c was updated to 1.5.1.
- Fixed issues with PAM authentication when combined with pam_sssd (618)
- Enhanced the seccomp filters to address issue in testing (627)
- Fixed "unexpected URL" errors for Cisco AnyConnect clients
- Fixed the 'ping-leases' option, which was broken since version 1.1.1
- Fixed maximum MTU tracking in server statistics
- Fixed 'iroute' option processing to handle multiple routes (625)
- Fixed session accounting for roaming users (674)
- occtl: fix invalid JSON output in `occtl -j show iroutes` (661)
- occtl: fix regression with trailing commas in `occtl -j show sessions` (669)
- occtl: fix missing column headers in 'show ip bans' output (677)
- occtl: 'show ip bans' no longer shows expired bans (675)
- Fixed DTLS not working with systemd socket activation (647)
- Fixed a bug in the ban timer logic that could prevent IP addresses
from being banned or cause premature unbans (678)
- Session statistics are now reported at consistent intervals
for RADIUS compatibility (630)
- Single form to enter username and password (551)
afalg_engine AFAIK is a faster version of what OpenSSL provides last
time I used it. Although I don't think it was useful for long. OpenSSH's
sandbox conflicts with AF_ALG.
prosody: fix build, bump to to 0.12.6 and add test.sh
mod_s2s was refactored into a single mod_s2s.lua in the flat modules
directory in 0.12.x; remove the obsolete subdirectory install rule that
caused the package build to fail.
Also add util/human/ and util/prosodyctl/ which are new subdirectories
in 0.12.x not covered by the previous install rules.
Force libidn instead of ICU for stringprep
prosody's configure script auto-detects stringprep backends and prefers
ICU when available, generating -DUSE_STRINGPREP_ICU and including
<unicode/usprep.h>. The OpenWrt SDK staging directory does not provide
ICU development headers, so the build fails with:
encodings.c:271:10: fatal error: unicode/usprep.h: No such file or directory
The Makefile DEPENDS already declares +libidn. Pass --with-idn=idn to
explicitly select the libidn backend, which is available in the staging
directory.
Also, pass TARGET="../util/" to MAKE_FLAGS. OpenWrt has it's own TARGET
env var which clobbers the 'TARGET' var from prosody's build (specified
as 'TARGET?=../util/')
Adding a test.sh to check for the correct version (since prosody mostly
has lua scripts).
Security release addressing multiple vulnerabilities. 0.12.6 is
likely the last release of the 0.12.x series (EOL June 2026).
Update avahi from 0.8 to 0.9-rc4. The 0.9 development line accumulates
four years of bug and security fixes since the 0.8 release (2020-02-18).
Notable improvements in 0.9-rc4 over 0.8:
Security (all CVEs previously backported as patches, now removed):
- CVE-2023-38469: reject TXT records whose total rdata exceeds
AVAHI_DNS_RDATA_MAX, preventing heap-buffer reads under crafted mDNS
- CVE-2023-38470: ensure each DNS label is at least one byte, preventing
an infinite loop on malformed packets
- CVE-2023-38471: extract host name via avahi_unescape_label() before
generating an alternative to avoid operating on a raw escaped string
- CVE-2023-38472: check that rdata pointer is non-NULL before passing to
avahi_rdata_parse() from dbus-entry-group
- CVE-2023-38473: derive alternative host name from its unescaped form,
fixing incorrect hostname collision resolution with escaped labels
Bug fixes (previously backported):
- Fix NULL-pointer crashes in avahi_s_*_browser_new() (#175)
- Avoid infinite loop in avahi-daemon simple-protocol by handling
AVAHI_WATCH_HUP event in client_work
- Fix potential undefined behaviour in avahi_dns_packet_consume_uint32:
cast uint8_t operands to uint32_t before shifting
- Fix memory/CPU leak in the simple event loop: cleanup_watches() was
zeroing timeout_req_cleanup instead of watch_req_cleanup, so completed
watches were never removed from the linked list
- Emit D-Bus error reply when avahi-daemon cannot resolve a hostname or
service, rather than crashing with a NULL dereference
- Increase ini-file-parser line buffer from 256 to 1024 bytes to handle
longer configuration values without silent truncation
Other changes:
- P2P tunnel support: IFF_MULTICAST is no longer required for
point-to-point interfaces when allow-point-to-point=yes
- Runtime directory: configure.ac now derives the socket path from
${runstatedir} (defaults to ${localstatedir}/run), so the
explicit patch reverting the /run hardcoding is no longer needed
- Patch 010-pkgconfig.patch (pkgconfig prefix alignment) is retained
as it has not been merged upstream
Disable libsystemd (not available on OpenWrt)
avahi 0.9-rc4 added --enable-libsystemd which defaults to enabled and
fails configure when libsystemd is not found via pkg-config. OpenWrt
does not provide libsystemd; disable it explicitly.
Also pass --with-systemdsystemunitdir=no to suppress the pkg-config
lookup for the systemd unit directory.
Drop po/ subdir from build
The 0.9-rc4 tarball is a raw git archive; po/Makefile.in.in is not
pre-generated as it was in the 0.8 release tarball. autopoint (from
gettext) is needed to install it, but is not available in the OpenWrt
SDK. Since OpenWrt does not use NLS translations, remove po/ from
SUBDIRS in Makefile.am to avoid the missing po/Makefile.in.in error
during configure.
In 0.9-rc4 the D-Bus system.d directory changed from
$(sysconfdir)/dbus-1/system.d to $(datadir)/dbus-1/system.d,
so avahi-dbus.conf is now installed under usr/share/dbus-1/system.d.
Update the install rule source path accordingly; keep the on-device
destination at /etc/dbus-1/system.d for compatibility.
On master, updater help and missing-option text still refer to '-N'.
Use '-S' instead so the messages match accepted script options.
Also clarify that SECTION is the UCI section name/id to start.
This is a text-only change; runtime behavior is unchanged.
Changelog:
- Add UCM profiles for DualSense PS5 controller and multiple Qualcomm
platforms
- Improve USB audio device handling and HDA initialization patterns
- Enhance phantom jack detection and optional headphone output handling
- Add support for Steinberg audio devices and new MediaTek SoC configs
Changelog:
- Update to Unicode 15.1.0 standard with U+19DA marked DISALLOWED
- Switch from gnulib submodule to GNULIB_REVISION for build management
- Fix uninitialized memory and compiler warnings
- Improve reproducibility and cross-platform build compatibility
Changelog:
- Fix uninitialized value bug in idna_to_unicode_4z4z on malloc failure
- Restore Unicode table generation scripts for modern Perl compatibility
- Fix Windows/musl compatibility for version checking
- Achieve reproducible builds across tested platforms
Dirk Brenken [Mon, 4 May 2026 17:42:14 +0000 (19:42 +0200)]
banip: update 1.8.8-2
- optimized pidfile handling in the init file
- small cornercase fixes & improvements
- drop deprecated 'drop' feed (replaced by 'spamhaus' json feed with the same content)
- LuCI: expose the new JSON Lines Format in the feed editor
- readme update
FindLuaJIT.cmake uses NO_DEFAULT_PATH and only searches hardcoded
luajit-specific paths, so it never finds regular Lua. However if
LUAJIT_INCLUDE_DIRS and LUAJIT_LIBRARY are pre-set in the CMake
cache, find_path/find_library skip their searches, the module sets
LUAJIT_FOUND=ON and also sets LUA_INCLUDE_DIR/LUA_LIBRARIES from
those values, and the if(NOT LUAJIT_FOUND) guard skips the broken
find_package(Lua REQUIRED) call that fails under CMake 4.3.
George Sapkin [Mon, 10 Nov 2025 16:14:03 +0000 (18:14 +0200)]
ci: mark and close PRs with formality issues
Add a recurring workflow that runs every day at 5:30 and marks all PRs
that have formality check failures (i.e. marked as 'not following
guidelines') that have not been active in the past 14 days as stale.
Close stale PRs after 14 more days.
libquadmath is only packaged for x86 and powerpc targets in OpenWrt.
Declaring it as an unconditional runtime dependency of boost-charconv
causes apk installation failure on all other architectures (e.g.
i386, arm, mips) with "libquadmath (no such package)".
Guard the dependency with an ARCH filter so it is only pulled in on
platforms where the package actually exists.
Signed-off-by: Alexandru Ardelean <redacted>
boost: add x86 to libquadmath arch conditional in boost-charconv
libquadmath is available on x86 (i386) in addition to x86_64 and
powerpc variants. Include it in the filter so boost-charconv gets
the correct dependency on 32-bit x86 targets.
boost::asio::post() without an explicit executor fails to compile with
Boost >= 1.82 due to changes in the executor model: bare lambdas no
longer have an implicit system executor that satisfies the
blocking.never requirement.
Pass io_context_ explicitly as the first argument so the handler is
dispatched on the correct io_context thread, which is the original
intent of the call (making stop() safe to call from any thread).
Add test.sh
domoticz is a daemon requiring a database and network port; it does not
implement a --version flag. Verify the binary is present and executable.
Disable LTO to fix link failure on i386 with musl fortify
Suggested via https://github.com/openwrt/packages/pull/29239
Also tested.
Bump to latest upstream snapshot (2025-11-05). re2 uses date-based
versioning from git. This brings roughly two years of upstream
improvements including performance optimisations, bug fixes, and
C++17/20 compatibility improvements.
This commit was merged into the master branch by accident
and should be undone. Adding ujail as a hardcoded dependency
is incorrect, as ujail is meant to be an optional dependency.
A better approach is to implement ujail support within
the init script, which was discussed in the pull request
(https://github.com/openwrt/packages/pull/29277),
consistent with how other packages in the repository handle this.
Ernestas Kulik [Fri, 1 May 2026 08:59:47 +0000 (11:59 +0300)]
libgpiod: add python-setuptools host build dep
If python3-gpiod is enabled and the python-setuptools host package is
missing, the setuptools.build_meta import will cause a build failure.
Fix this by adding a conditional build dependency.
The python3-light dependency gets lugged even with the package disabled,
so this commit makes python3-light a conditional dependency, similar to
gensio in 0c245fda70d580737ee30cc39d42bcca6ddd7f3e.
Russell Senior [Mon, 27 Apr 2026 09:13:52 +0000 (02:13 -0700)]
sed: update to v4.10
update to version v4.10, disable building gnulib-tests to avoid
compilation errors.
Add --disable-xattr to CONFIGURE_ARGS to avoid linking an unneeded
dependency.
Changes in sed since v4.9, from NEWS:
** Bug fixes
sed 's/a/b/g' (and other global substitutions) now works on input
lines longer than 2GB. Previously, matches beyond the 2^31 byte offset
would evoke a "panic" (exit 4).
[bug present since the beginning]
'sed --follow-symlinks -i' no longer has a TOCTOU race that could let
an attacker swap a symlink between resolution and open, causing sed to
read attacker-chosen content and write it to the original target.
[bug introduced in sed 4.1e]
sed no longer falsely matches when back-references are combined with
optional groups (.?) and the $ anchor. For example, this no longer
falsely matches the empty string at beginning of line:
$ echo ab | sed -E 's/^(.?)(.?).?\2\1$/X/'
Xab
[bug present since "the beginning"]
In --posix mode, sed no longer mishandles backslash escapes (\n,
\t, \a, etc.) after a named character class like [[:alpha:]].
For example, 's/^A\n[[:alpha:]]\n*/XXX/' would fail to match the
trailing newline, treating \n as a literal backslash and an 'n'
rather than a newline. This happened when an earlier backslash
escape in the same regex had already been converted, shifting the
in-place normalization buffer.
[bug introduced in sed 4.9]
sed --debug no longer crashes when a label (":") command is compiled
before the --debug option is processed, e.g., sed -f<(...) --debug.
[bug introduced in sed 4.7 with --debug]
sed no longer rejects the documented GNU extension 'a**' (equivalent
to 'a*') in Basic Regular Expression (BRE) mode. Previously, this
worked only with -E (ERE mode), even though grep has always accepted
it in BRE mode.
[bug present since "the beginning"]
sed no longer rejects "\c[" in regular expressions
[bug present since the beginning]
'sed --follow-symlinks -i' no longer mishandles an operand that is a
short symbolic link to a long symbolic link to a file.
[bug introduced in sed 4.9]
Fix some some longstanding but unlikely integer overflows.
Internally, 'sed' now more often prefers signed integer arithmetic,
which can be checked automatically via 'gcc -fsanitize=undefined'.
** Changes in behavior
In the default C locale, diagnostics now quote 'like this' (with
apostrophes) instead of `like this' (with a grave accent and an
apostrophe). This tracks the GNU coding standards.
'sed --posix' now warns about uses of backslashes in the 's' command
that are handled by GNU sed but are not portable to other
implementations.
** Build-related
builds no longer fail on platforms without the <getopt.h> header or
getopt_long function.
[bug introduced in sed 4.9]
libfastjson: add missing runtime dependency on libm
libfastjson uses modf() from libm but does not declare the dependency.
With BIND_NOW (CONFIG_PKG_RELRO_FULL), this can cause the dynamic linker
to process libfastjson's relocations before libm's GOT is set up,
triggering a crash in libm's IFUNC resolver on PowerPC.
files/etc/init.d/https-dns-proxy:
- Wrap the notrack chain in its own `inet https_dns_proxy_notrack`
table. A top-level `chain` outside any table is invalid nftables
syntax and is rejected on kernel 6.18+, breaking firewall load.
Fixes mossdef-org/https-dns-proxy#7.
- Syntax-check the generated snippet with `nft -c -f` after write
and report OK/FAIL on the start path.
- On remove, explicitly `nft delete table` in addition to removing
the snippet file, so the live ruleset is cleaned up immediately
rather than waiting for the next fw4 reload.
Alexander Krause [Wed, 29 Apr 2026 19:34:57 +0000 (21:34 +0200)]
adguardhome: added ujail dependency
In order to create a proper jail, we net the procd-ujail package.
Otherwise, AdGuardHome will run as unprivileged process,
and will not be able to listen on ports below 1024.
zstd: add test.sh for script wrappers without --version
zstdgrep and zstdless are shell script wrappers that do not output a
version string, so the generic CI version check fails for them. Add a
test.sh case that verifies they are present and executable instead.
dbus-utils utilities do not implement --version so the generic CI
version check fails for them. Add a test.sh case that verifies the
binaries are present and executable instead.
dbus-utils: dbus-monitor, dbus-send, dbus-test-tool Signed-off-by: Alexandru Ardelean <redacted>
Several bluez utilities do not implement --version so the generic CI
version check fails for them. Add test.sh cases that verify the
binaries are present and executable instead.
Changes in 3.10:
- general bug fixes from libsepol (bounds statements in optional
blocks, type attribute handling in role-types rule, NULL dereference
and use-after-free fixes)
- treewide: add .clang-format configuration file
Changes in 3.10:
- python/sepolicy: add support for DNF5
- sandbox/seunshare: replace system() with execv() to prevent shell
injection vulnerability
- seunshare: always use translations when printing
- setfiles: add -A option to disable SELINUX_RESTORECON_ADD_ASSOC
Changes in 3.10:
- improve semanage man pages: add examples for -r RANGE flag usage
- semanage: reset active value when deleting boolean customizations
- various libsemanage/libsepol bug fixes and security hardening
Existing package contains five libraries, some of which are > 1MB. Allow
packages which depend on only some of them to only pull in the ones they
need by splitting this package into finer-grained packages. Transition
can be done piecemeal as depending on glib2 will still pull in all the
libraries.
The original split commit (6bb0d6bd2) had a typo: the glib2 meta-package
used 'DEPENDS:+glib2-gthread +glib2-gio' (missing '='), which caused
the meta-package to have no effective dependencies. This meant packages
declaring '+glib2' did not get the sub-packages installed, causing APK
dependency checks to fail for all glib2 libraries across ~60 packages.
This re-applies the split with 'DEPENDS:=+glib2-gthread +glib2-gio'
(correct assignment syntax), so the meta-package properly pulls in all
sub-packages for consumers that still declare '+glib2'.
Signed-off-by: Alexandru Ardelean <redacted> Signed-off-by: Alexandru Ardelean <redacted>
The generic CI test fails for /usr/bin/attr because that binary does
not implement --version. getfattr and setfattr do, so test those for
the version string and only verify attr is present and executable.
The CMakeLists.txt first tries FindLuaJIT.cmake which uses
NO_DEFAULT_PATH with hardcoded host paths, so it always fails in
cross-compilation. The fallback find_package(Lua REQUIRED) may also
fail to find a flat sysroot layout where lua.h lives at
/usr/include/lua.h rather than a versioned subdirectory.
Explicitly pass LUA_INCLUDE_DIR and LUA_LIBRARY to CMake to bypass
both finders, and depend on +liblua (the library package) instead of
+lua to ensure Build/InstallDev runs and Lua headers are present in
the staging directory before this package builds.
- introduced a shared named nft limit (loglimit) referenced by
all log rules instead of per-rule limits, aligning with kernel printk rate limits
- added new 'ban_logratelimit' and 'ban_logburstlimit' UCI options for tuning
the shared log limit; setting ban_logratelimit=0 disables nft-side rate limiting
entirely (useful for ulogd or other userspace log handlers that bypass printk)
- LuCI: made the new UCI option available (Log Settings)
- readme update
wgsd (WireGuard Service Discovery plugin) pulls in
golang.zx2c4.com/wireguard/wgctrl -> mdlayher/genetlink v1.2.0 ->
mdlayher/netlink v1.6.2. This version of netlink calls
mdlayher/socket's Sendmsg/Recvmsg with the old API signatures
(pre-context.Context, single-return-value Sendmsg), but coredns
itself requires mdlayher/socket v0.5.1 which changed these
signatures to include context.Context and return (int, error).
Add a go get step that upgrades netlink to v1.7.2 after the wgsd
plugin dependencies are pulled in, ensuring the build uses a
netlink version compatible with socket v0.5.x.
Should fix:
https://downloads.openwrt.org/snapshots/faillogs/i386_pentium-mmx/packages/coredns/compile.txt
```
../../../../../dl/go-mod-cache/github.com/mdlayher/netlink@v1.6.2/conn_linux.go:105:9: too many return values
have (int, error)
want (error)
../../../../../dl/go-mod-cache/github.com/mdlayher/netlink@v1.6.2/conn_linux.go:105:35: not enough arguments in call to c.s.Sendmsg
have ([]byte, nil, *"golang.org/x/sys/unix".SockaddrNetlink, number)
want (context.Context, []byte, []byte, "golang.org/x/sys/unix".Sockaddr, int)
../../../../../dl/go-mod-cache/github.com/mdlayher/netlink@v1.6.2/conn_linux.go:116:9: too many return values
have (int, error)
want (error)
../../../../../dl/go-mod-cache/github.com/mdlayher/netlink@v1.6.2/conn_linux.go:116:33: not enough arguments in call to c.s.Sendmsg
have ([]byte, nil, *"golang.org/x/sys/unix".SockaddrNetlink, number)
want (context.Context, []byte, []byte, "golang.org/x/sys/unix".Sockaddr, int)
../../../../../dl/go-mod-cache/github.com/mdlayher/netlink@v1.6.2/conn_linux.go:127:42: not enough arguments in call to c.s.Recvmsg
have ([]byte, nil, number)
want (context.Context, []byte, []byte, int)
../../../../../dl/go-mod-cache/github.com/mdlayher/netlink@v1.6.2/conn_linux.go:142:41: not enough arguments in call to c.s.Recvmsg
have ([]byte, nil, number)
want (context.Context, []byte, []byte, int)
github.com/aws/aws-sdk-go-v2/aws/protocol/query
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding
github.com/aws/smithy-go/private/requestcompression
```
The prosody.im upstream updated the 0.12.4 tarball in-place, changing
its content without bumping the version. Update PKG_HASH to match the
currently published tarball.
Fixes: f4d305b73 ("prosody: update to 0.12.4") Signed-off-by: Alexandru Ardelean <redacted>
- fix log rate limit and drop throttling (#29255, #27990)
- serialize dedup writes via flock in f_down
- tighten RDAP CIDR validation and lock handling in f_monitor
- fix IPv6 prefix regex in f_search, simplify sed pattern in f_report
- readme update
Update config for vrrp_script in keepalived.config.
Add option name, direction and timeout in config.
Add some docs for option weight and option direction.
keepalived: use section vrrp_script for option track_script
`track_script` and `vrrp_script` are both sections that run custom scripts
which handle priority of a vrrp_instance.
`track_script` is not supported by this uci implementation
`vrrp_instance` was still trying to fetch config for track_script from section
'track_script'.
After the changes, when listing track_script in vrrp_instance,
it tries to fetch config from section `vrrp_script` which is supported.
Add logic to parse track_script section for vrrp_sync_group.
Keepalived supports script tracking in vrrp_sync_group but this was not
implemented by the uci implementation.
Note that if a vrrp_script is added to a sync group, you cannot use
priority/weight for that script as a vrrp_sync_group does not have a
priority/weight attached to it. It will do up/down as whole.
This option is optional and wouldn't affect any older configurations
during upgrade.
Removed unnecessary option value. This was not needed as option name is
already being used. Also removed a condition where the section was not
parsed if option value was not given. Value was being used to name the
script. Now the option name is used as the name when the script is called
in track_script.
Also added a condition where the section is not parsed if
option name is not given. This is because the script cannot be called if
it does not have a name.
No upgrade script is required.
The removed `value` option in `vrrp_script` was previously used to
identify scripts referenced by `track_script`. However, this mechanism
was non-functional:
- `track_script` attempted to reference a `track_script` section, which
is not implemented in the UCI configuration.
- As a result, script references were not resolved correctly even if
`value` was defined.
With this change, `track_script` now correctly references the
`vrrp_script` section, and the `name` option is used as the identifier.
Since the previous behavior was not working as intended, removing the
`value` option does not break any valid existing configurations.
keepalived: add indent param in config_section_open/close
Add a parameter for indent in config_section_open and
config_section_close. Previously you had to separately add indents
while parsing if a section was inside another section.
Now this is supported by these two functions.
You can specify how much indent you need to add before opening or closing
a section.
Tim Flubshi [Sun, 26 Apr 2026 16:00:44 +0000 (18:00 +0200)]
ddns-scripts: netcup.com adjust update error path
Adjust the update error handling path to avoid hard failures on
recoverable errors. This allows ddns to retry updates after the
configured retry interval and improves reliability.
Tim Flubshi [Sun, 26 Apr 2026 15:52:27 +0000 (17:52 +0200)]
ddns-scripts: netcup.com use json_load_file
Replace manual file loading via cat with json_load_file for parsing
JSON data. This uses the intended helper function and improves
code clarity and robustness.
Tim Flubshi [Sun, 26 Apr 2026 15:47:02 +0000 (17:47 +0200)]
ddns-scripts: fix netcup.com readonly variable
The netcup ddns update script fails on subsequent runs because a
readonly variable is assigned again. Fix this by removing the readonly
declaration to allow repeated execution.
Prompted by
https://github.com/openwrt/luci/pull/8420#issuecomment-4071252681
we update upsmon configs to ensure they are correct according to
upstream. We reorder the options so that they match upstream
documentation at
<https://networkupstools.org/docs/man/upsmon.conf.html> to be sure
we have not missed any items.
While at it, we add configuration options from the upstream
documentation that are not currently present in the UCI configs.
Some years ago upstream changed the names the primary/secondary
UPS system/monitor from master/slave to primary/secondary. It
is uncertain how much longer these deprecated names will be
accepted by NUT.
Therefore update naming to match upstream documentation and
configuration. See
<https://networkupstools.org/docs/man/upsmon.html>,
<https://networkupstools.org/docs/man/upsmon.conf.html>, and
<https://networkupstools.org/docs/man/upsd.users.html>.
At the same time, prompted by
https://github.com/openwrt/packages/pull/28875#issuecomment-4079307540
we simplify the configuration and add checks to avoid bad configs
due to misspellings/typos of configuation options by users.
config notifications 'ONLINE'
option message "UPS %s is on line power"
option flag "SYSLOG"
config notifications 'ONBATT'
option message "UPS %s is on battery power"
option flag "SYSLOG+EXEC"
In order to iterate through the notifications, we use named
'notifications' sections and compare the section name to list of
notification events defined by NUT. If they don't match, warn
during initscript startup.
Josef Schlehofer [Mon, 27 Apr 2026 07:24:45 +0000 (09:24 +0200)]
Revert "gkrellmd: use finer-grained dependencies on glib2"
This is a follow-up revert. Since the underlying commit was reverted,
this one must be reverted too to avoid breakage. See commit e46654db2 for context.
python-zope-event: fix build with setuptools >= 81
The pyproject.toml for zope.event 6.1 specifies a strict build
dependency of setuptools>=78.1.1,<81. We currently package
setuptools>=81, causing pip to report a missing dependency and
fail the build.
Add patch 001-relax-setuptools-version.patch to drop the <81 upper
bound, allowing the package to build with any recent setuptools.
Add test.sh to verify the installed version and exercise the core
event API (subscribers list, notify(), event dispatch).
Peter Denison [Tue, 31 Oct 2023 17:58:08 +0000 (17:58 +0000)]
gkrellmd: use finer-grained dependencies on glib2
Following the split of glib2, depend on the more fine-grained packages
to reduce the installed size. Gkrellmd only needs to depend on the core glib2
library, gmodule and gthread, and not on gobject or gio.
Peter Denison [Sun, 29 Oct 2023 17:49:58 +0000 (17:49 +0000)]
glib2: split package into separate libraries
Existing package contains five libraries, some of which are > 1MB. Allow
packages which depend on only some of them to only pull in the ones they
need by splitting this package into finer-grained packages. Transition
can be done piecemeal as depending on glib2 will still pull in all the
libraries.
John Audia [Thu, 25 Dec 2025 18:22:13 +0000 (13:22 -0500)]
xtables-addons: bump 3.30 and fix LUA build on 6.18
This upstream release allows clean builds against linux 6.18. Fix LUA
PacketScript build on 6.18 by switching to ccflags-y and restoring the
required -isystem include path. Remove compat_xtables since the module
no longer exists in 3.30 and drop all dependent kmod references.
Fix CI build failure with backport:
600-xt_pknock-fox-do_div-signness-mismatch.patch
Note that upstream tarball changed from xz to zst.
Stan Grishin [Fri, 24 Apr 2026 18:28:04 +0000 (18:28 +0000)]
https-dns-proxy: update to 2025.12.29-5
Maintainer: me
Compile tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.1
Run tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.1
Description:Add nftables notrack for localhost traffic
- Removed. License is now included in the main project.
net/https-dns-proxy/Makefile:
- Bumped PKG_RELEASE to 5.
net/https-dns-proxy/files/etc/config/https-dns-proxy:
- Added 'option notrack_dns '1'' to the default configuration.
net/https-dns-proxy/files/etc/init.d/https-dns-proxy:
- Defined NOTRACK_NFT_FILE constant.
- Added 'notrack_dns' and 'notrack_ports' variables.
- Implemented 'notrack_nft' function to manage nftables rules for notracking local DNS traffic.
- Enabled loading of 'notrack_dns' boolean from configuration.
- Modified start_instance to collect listen_port into notrack_ports if notrack_dns is enabled.
- Modified start_service to call notrack_nft update/remove based on notrack_dns and collected ports.
- Modified stop_service to call notrack_nft remove.
- Updated service_started and service_stopped to trigger firewall config changes when notrack_dns is enabled.
git.99rst.org / openwrt-packages.git / log