rlwrap is a 'readline wrapper', a small utility that uses the GNU
Readline library to allow the editing of keyboard input for any
command.
The input history is preserved even across different invocations,
history search and completion are supported
Co-authored-by: George Sapkin <redacted> Signed-off-by: Jeronimo Pellegrini <redacted>
Wesley Gimenes [Sun, 21 Dec 2025 00:35:54 +0000 (21:35 -0300)]
2to3: remove package
This package is only used by `fail2ban`. After updating `fail2ban` to
`1.1.0` (2a202b2091336cd04d58d797021e278ba9d3f5ae), the `2to3` package
is no longer needed. If required, anyone can reintroduce the package.
This is the first `netbird` release that introduces a breaking change[1].
Therefore, versions after the `0.60.x` will not be backported to
OpenWrt 24.10. They will be backported to OpenWrt 25.12, because that
release has not been officially launched yet.
By default netbird now creates/updates[2]
`/etc/ssh/ssh_config.d/99-netbird.conf` for use with `openssh-client`.
OpenWrt uses `dropbear`, and this behavior may cause storage wear.
This behavior has been disabled with `NB_DISABLE_SSH_CONFIG="1"`[3] in the
init file.
Updates Zabbix to 7.0.21-r1 (latest 7.0 LTS version)
Note that for the frontend, clearing browser cache, cookies and other
site data for the zabbix frontend server may be necessary.
Security fixes compared to 7.0.12 (most are frontend only):
* CVE-2025-27238: API hostprototype.get lists data to users with
insufficient authorization https://support.zabbix.com/browse/ZBX-26988
* CVE-2025-27236: User information disclosure via api_jsonrpc.php on
method user.get with param search:
https://support.zabbix.com/browse/ZBX-27060
* CVE-2025-27231: LDAP 'Bind password' field value can be leaked by a
Zabbix Super Admin: https://support.zabbix.com/browse/ZBX-27062
* CVE-2025-49641: Insufficient permission check for the
problem.view.refresh action:
https://support.zabbix.com/browse/ZBX-27063
* CVE-2025-49643: Frontend DoS vulnerability due to asymmetric
resource consumption: https://support.zabbix.com/browse/ZBX-27284
George Sapkin [Sat, 13 Dec 2025 16:19:44 +0000 (18:19 +0200)]
vim: fix config and runtime
- Install shared runtime for both full and fuller.
- Switch big to huge as big is just an alias to normal.
- Fix default config path for tiny variant.
- Use upstream default config for both full and fuller.
- Don't mark default config files for backup.
- Don't mix variant files.
- Mark fuller variant config files for backup.
- Update configure arguments and remove deprecated ones.
- Remove deprecated configuration variables.
- Improve descriptions.
- Fix the following error by installing the missing runtime files for
full and correctly installing the default config for tiny:
E1187: Failed to source defaults.vim
- Fix the following fuller error by installing the missing directory in
runtime:
Error detected while processing /usr/share/vim/vim91/plugin/netrwPlugin.vim:
line 7:
E919: Directory not found in 'packpath': "pack/*/opt/netrw"
Fixes: https://github.com/openwrt/packages/issues/20203 Fixes: https://github.com/openwrt/packages/issues/28104 Signed-off-by: George Sapkin <redacted>
Christian Beier [Fri, 28 Nov 2025 19:28:53 +0000 (20:28 +0100)]
shairport-sync: enable Airplay 2 for -openssl only
https://github.com/mikebrady/shairport-sync/blob/master/
CONFIGURATION%20FLAGS.md#cryptography states that only the OpenSSL
cryptography backend is suitable for Airplay 2.
Further investigation revealed that the pair_ap module within
shairport-sync, which is needed for Airplay 2, does not have an Mbed TLS
backend.
Accordingly, this commit enables Airplay 2 only for the OpenSSL build.
This has the nice side effect that for Airplay 1 the -mini or -mbedtls
versions can be used without pulling in 6 MB of ffmepg libs.
Security:
* CVE-2025-31498. A use-after-free bug has been uncovered in read_answers() that was introduced in v1.32.3. Please see GHSA-6hxc-62jh-p29v
* CVE-2025-62408. A use-after-free bug has been uncovered in read_answers() that was introduced in v1.32.3. Please see GHSA-jq53-42q6-pqr5
Thomas Winkler [Mon, 15 Dec 2025 05:39:41 +0000 (06:39 +0100)]
tang: make sure output and errors are logged to system log
Currently, there is no logging at all, causing difficulties with
troubleshooting. Edit originally proposed by @q-b #26076
(comment) and implemented by @rugk #27401
As with gettext modules described in #28078 and #28075, xml and dom
related module selection affects the dependencies of other packages.
Therefore, we invert the dependency logic:
PHP8_LIBXML and PHP8_DOM are are enabled by default and packages
which depend on libxml2 and --enable-dom=shared are not shown (and
the related configure args are disabled) if the config options are
not enabled.
Fixes: php8: global package dependency changes based on module
selection
Fixes: #28078
As described in #28078 and #28075,
Some binaries gain a dependency on libstdcpp when mod-gettext is included
in the build, however this was not explicitly declared, so packaging
fails with (e.g.):
Package php8-cgi is missing dependencies for the following libraries:
libstdc++.so.6
In contrast to #28075, this commit takes the approach:
* Make use of --with-gettext depend on a configure flag (enabled by
default, since that matches current full build behaviour)
* Make sub-packages which require --with-gettext depend on the
configure flag
This means that e.g. php-cgi would not have gettext support if the
configure flag was disabled, and e.g. php-mod-gettext and php-mod-intl
would not be selectable.
Mai Thanh Minh [Sun, 14 Dec 2025 20:25:10 +0000 (03:25 +0700)]
zerotier: apply upstream license change to `MPL-2.0`
Upstream changed license to `MPL-2.0` for all except `nonfree/`. Building with `ZT_NONFREE=1` excludes these non-free code, make the result effectively under `MPL-2.0`. Read more at https://github.com/zerotier/ZeroTierOne/blob/1.16.0/RELEASE-NOTES.md#2025-08-21----version-1160
Eric McDonald [Thu, 4 Dec 2025 17:48:16 +0000 (09:48 -0800)]
net-snmp: fix literal string test in snmpd_sink_add
The function snmpd_sink_add() has a guard clause that tests the literal
string "section", not the variable value "$section".
The test `[ -n "section" ]` always evaluates to true because the string
literal "section" is non-empty, making the check useless.
This function is only called internally with hardcoded arguments, so the
bug has no actual impact currently. For the same reason, this change
should not break existing configurations. However, I think it should be
fixed so future callers do not have a false sense of security.
Hannu Nyman [Sun, 14 Dec 2025 17:43:03 +0000 (19:43 +0200)]
irqbalance: update to 1.9.5
Update irqbalance to version 1.9.5
* drop the original local meson patch, as meson is now properly adopted
by upstream. But patch meson.build to keep glib2 library statically
linked in order to avoid a dependency and indirect size increase.
* disable unnecessary functions via meson features settings
(capng, numa, systemd, thermal, ui)
Fixes pgsql-server: the setup fails for any folder
Fixes #27228
Sets postgresql-specific configure flags that configure cannot run-test
to determine their value. This fixes improperly linked files that
prevent database initialization (at least) from working on the device.
Dirk Brenken [Sun, 14 Dec 2025 06:06:52 +0000 (07:06 +0100)]
adblock: release 4.4.5-1
* hardened the uci config parsing
* added a fast, flexible & secure domain validator function, it eliminates > 99 % of garbage inputs
- Please note: the "rule" in the feed file now only includes parameters for the domain validator,
see readme for details. Please nuke a custom feed file from former versions - they are no longer
compatible
* readme update
* LuCI: fixed a minor issue in the logread template
* LuCI: adapted the rule select options in the custom feed editor to use the new domain validator
isc-dhcp: fix startup issues with RFC-1918 PTR RRs
If isc-dhcp gets restarted, it might have to deal with RFC-1918 zones
being previously populated by an earlier instance. In that case, we
need to know if we're modified versus initially adding the zones.
The special handling of RFC-1918 zones in Bind is quirky, and there
should be a patch soon to make it more friendly, but in the meantime
you might have to use:
disable-empty-zone 168.192.in-addr.arpa;
Or similar depending on which address block you poach.
watchcat: passing the interface in the ping_reboot
Although the watchcat_ping function also checked the iface variable, that
variable was never populated. As a result we could not check if there was
connectivity via a specific interface.
David Woodhouse [Mon, 17 Nov 2025 13:41:06 +0000 (13:41 +0000)]
domoticz: improve config, don't require telldus
Add support for configuring the -vhostname, as it helps to get the right
issuer into OAuth2 tokens. Also disable the mdns responder by default;
when we're running on OpenWrt we have better options that that. Clean
up the logging options, and also make it export $TZ to work around our
musl hack which otherwise opens and reads /etc/TZ thousands of times
a minute.
Also drop the telldus dependency. Domoticz will dlopen that at runtime
without having to have it present at build time at all, so it should
still work for users who install it.
David Woodhouse [Mon, 17 Nov 2025 13:41:47 +0000 (13:41 +0000)]
openzwave: update to 1.6.1965, disable downloads
The project is abandoned but until we get the ZWave-JS-UI node.js
montrosity running in OpenWrt, we need to keep using it. Update to
the last available version.
Dirk Brenken [Thu, 11 Dec 2025 21:43:31 +0000 (22:43 +0100)]
travelmate: release 2.3.0-1
* split travelmate.s in a new central travelmate function library (usr/lib/travelmate-functions.sh) plus
a smal service script (/usr/bin/travelmate-service.sh)
* the vpn-, mail- and login scripts are now using the central function library
* rework the ntp hotplug script
* harden the config parsing
* support the curl interface option to specify which network pathway is used for outgoing requests
* the travelmate status now includes the backend- and frontend version information
* LuCI: use a special travelmate interface, e.g. trm_wwan or use an existing wwan interface
* LuCI: no longer call the logread binary, use rpc / the ubus log object instead
* LuCI: various code cleanups
* LuCI: various small usability improvements
* readme update
Dirk Brenken [Mon, 8 Dec 2025 17:42:20 +0000 (18:42 +0100)]
unbound: minimal fix for odhcpd lease file parsing
Current odhcpd in master writes MAC addresses with colons in his lease file,
this new odhcpd format leads to a crash loop in unbound (if DHCPv4 to SLAAC is selected).
Just remove the colons, before the processing in slaac_eui64 begins, fixes #28032
Til Kaiser [Mon, 8 Dec 2025 18:13:46 +0000 (19:13 +0100)]
treewide: remove python3-distutils dependency
As the python3-distutils was dropped while bumping the version
to 3.13.9 via 97a92f2e7a77c39d087892f5c9a7350c31f3d65b, remove the
python3-distutils from all packages that are currently using it.
OpenWrt already uses recent enough releases of these packages
that have adapted to work without distutils, so the dependency
can be safely removed.
This commit removes the non-empty APN requirement for initial EPS
bearer. An empty APN value is valid and means that the modem will use a
network provided APN offered by the operator.
Ivan Diaz [Fri, 21 Nov 2025 22:13:40 +0000 (17:13 -0500)]
watchcat: set default value for mmifacename to prevent argument shift
Set mmifacename default to "null" instead of an empty string to avoid
argument displacement when the value is not defined. Also remove leftover
debug comments from previous commit.
Stan Grishin [Mon, 8 Dec 2025 19:51:30 +0000 (19:51 +0000)]
pbr: update to 1.2.1-r35
pbr 1.2.1-r35
Makefile:
* split uci-defaults into different purpose files
* add handling of netifd integration
Config:
* update with default values for all options (thanks @betonmischer86)
Init-script:
* add netifd integration handling
* add ip() function to emulate ip rule replace
* add netbird intrfaces support (thanks @egc112)
* reorganize loading/handling of options in load_package_config()
* improve display of interface triggers in service_triggers()
* remove chains cleanup from stop_service() due to exclusive use of fw4 nft files
* improve status_service() output
* drop input and postrouting as valid options for policy chain
Markus Hube [Sat, 22 Nov 2025 09:47:35 +0000 (10:47 +0100)]
prometheus-node-exporter-lua: remove zero values
depending on the configuration there may be multiple
interfaces creating multiple time series always
reporting 0 value. omiting them from the export saves
resources. most notably cpu. this is limited to
counter types
Szabolcs Hubai [Thu, 30 Oct 2025 08:58:26 +0000 (09:58 +0100)]
snapcast: update to v0.34.0
A straightforward update from 0.28.0 (2024-03-19, [1])
to 0.34.0 (2025-10-12, [2]) with almost 400 commits. [3]
Notable change is the configurable OpenSSL support (BUILD_WITH_SSL)
for both snapserver and snapclient.
They will be enabled once I introduce the flavours.
In the mean time upsteam moved to it's own organization. [4]
Szabolcs Hubai [Sun, 7 Dec 2025 20:04:13 +0000 (21:04 +0100)]
snapcast: define ALSA support explicitly
As Hannu Nyman pointed out, in some cases the build of the package is
able to fail:
Package snapserver is missing dependencies for the following libraries:
libasound.so.2
He said: on some build runs, alsa is built (as required by other
packages), and if it is built before snapcast, it may be detected,
if the feature is not explicitly disabled in CMakeLists.txt.
Also: "I think that you could drop that AUDIO_SUPPORT conditional.
AUDIO_SUPPORT is selected e.g. if USB_SUPPORT is selected,
so it is not that big restriction."
Suggested-by: Hannu Nyman <redacted> Signed-off-by: Szabolcs Hubai <redacted>
In this repository, we do have radicale2, so OpenWrt
community should switch to use that version.
This version (= 1.x.x) is really old, no longer developed
and there are newer versions, which can be used e.g.
version 2.x.x, in this repo as radicale2 or there is
also version 3.x.x, which is not packaged for OpenWrt so far.
It looks like based on opened PRs [1],
there is no official support for Python 3.12+.
Unfortunately, this project is still using setup.py,
which is deprecated and no longer supported.
These days project metadata are stored in pyproject.toml
according to PEP 621.
Also, this project does not follow PEP625 as their
wheel name is in uppercase and it should be in lowercase.
Dirk Brenken [Thu, 4 Dec 2025 19:25:29 +0000 (20:25 +0100)]
banip: release 1.6.0-1
* split block/logging rules (fixed #27990)
* adapt reload functions to support the new split logic
* the banIP status now includes the backend- and the frontend version information
* fixed a config parsing error with non existing dirs (reported in the forum)
* fixed a small reporting issue (reported in the forum)
* added a new public dns feed (by default restricted to outbound, ports 53 and 853)
* added a new gawk dependency due to significant performance gains
* LuCI: no longer call the logread binary, use rpc / the ubus log object instead
* LuCI: various code cleanups
* LuCI: various small usability improvements
* readme update
git.99rst.org / openwrt-packages.git / log