Both patches still apply unchanged and remain necessary: upstream's library
list is unchanged, and stress-misaligned.c still only disables atomics on PPC
for gcc < 5.0 while stress-fractal.c has no arch guard at all.
fluent-bit: update to 5.0.8, adopt maintainer, fix musl startup segfault
Update 4.2.0 -> 5.0.8 and adopt maintainership. fluent-bit segfaulted at
startup on every musl target: under GCC 14 the upstream C-TLS probe no longer
compiles (undeclared __tls_get_addr), so the pthread_key fallback calls
pthread_getspecific() before pthread_key_create() and derefs a NULL tsd array
on musl (glibc is unaffected). Force -DFLB_HAVE_C_TLS=Yes for __thread TLS.
strongswan: add one default named ipsec uci section 'globals'
The UCI section 'ipsec' should only be available once, as these are
general settings for 'strongswan.conf'. It makes no sense to configure them
more than once. To ensure that the general settings can also be configured
via LuCI, this section must be present at least once.
For configurations already in the field, a uci-default script is added
that assigns the name 'globals' to the last ipsec section type.
Florian Eckert [Thu, 25 Jun 2026 11:13:27 +0000 (13:13 +0200)]
strongswan: use procd running check
Instead of using the standard procd check, the function is overridden, and
the check to see if the service is running is performed using the command
'swanctl --stats > /dev/null 2>&1'. The problem with this is, that this
call is blocking if the strongswan charon socket is not available. The call
does not return until the timeout has expired.
This block does not occur if we use the standard behavior of procd, which
checks whether the service it started is actually running. This change
therefore uses the standard call via procd, which returns the value without
blocking.
libdrm: skip the generic version check for the whole package
libdrm-tests ships DRM tools (modetest, proptest, ...) with no --version flag,
so the generic probe aborts with "No executables in the package provided
version" and fails CI. test-version.sh is shared by every subpackage built from
this directory and a non-zero exit fails it, so it must accept the whole family
(the libraries ship no executables either) -- hence libdrm*, not just libdrm-tests.
- convert the patch to a make option
- Add -J/-j options for JSON and JSON Lines output format.
- lsof_free_result(): handle result == NULL
- Fix missing parenthesis in lstat error message format
- Fix use-after-free in lsof_select_process_regex
- Fix truncated fd numbers in -F field output
- Display connection state for UDP sockets with -T option
Jiang Tengfei [Fri, 26 Jun 2026 14:33:29 +0000 (22:33 +0800)]
ddns-scripts: support version output in frontend
The /usr/bin/ddns frontend did not support a version option, so
generic package tests treated it as an executable that could not report
the package version.
Read the installed version file and support -V/--version, matching the
version output style used by dynamic_dns_updater.sh.
Jiang Tengfei [Fri, 26 Jun 2026 14:33:11 +0000 (22:33 +0800)]
ddns-scripts: add curl source IP bind fallback
Keep the existing cURL bind_network behavior of binding to the
logical device first. This preserves the behavior introduced for
PPPoE and multi-WAN setups where the selected network must also be
used for the DDNS update request.
Some setups can still fail when libcurl binds directly to the logical
PPP device. In that case the transfer may time out even though binding
to the source address of the same network succeeds. This can make DDNS
updates fail repeatedly on affected systems.
Retry cURL transfers once with the network source IP when the
device-bound transfer fails. This leaves the normal path unchanged,
keeps the update request on the same network, and matches the existing
GNU Wget behavior which already binds to the network IP address.
Also document the implicit bind_network default and the cURL fallback
in the sample configuration.
Features optimized datastore YANG validation including incremental
validation, a reduced XML config footprint, configurable datastore
cache, many bugfixes and a prototype gRPC/gNMI implementation.
Jan Klos [Wed, 1 Jul 2026 09:49:54 +0000 (11:49 +0200)]
nginx: update to 1.30.3
Fixes buffer overflow vulnerability in ngx_http_proxy_v2_module & ngx_http_grpc_module
(CVE-2026-42055) and buffer overread vulnerability in ngx_http_charset_module (CVE-2026-48142).
treewide: homogenize references to libfts for MUSL
The way we use -lfts isn't particularly consistent. There's no reason
it shouldn't be. glibc users shouldn't have to deal with someone else's
lack of rigor.
avahi: define missing DEFAULT_VARIANT and add conflicts
- Add DEFAULT_VARIANT to "avahi-daemon" and "libavahi" virtual packages;
set to "dbus" variant because it is more compatible.
When some package depends on one of these virtual packages an arbitrarily
variant it is selected. This avoids that.
- Add conflicts in order to avoid mixing packages with different variants
(when defining a DEFAULT_VARIANT the conflicts definition should be on
that side of the dependency to avoid recursive dependencies).
- Avoid building unused "dbus" dependency.
Fixes: ASU sysupgrade problem with avahi packages https://forum.openwrt.org/t/luci-attended-sysupgrade-support-thread/230552/137 Fixes: https://github.com/openwrt/packages/commit/9bc03b9d9971c2f1e146f7c2d287d1fc16e776f0 Signed-off-by: Mario Andrés Pérez <redacted>
Bump from the 0.9-rc4 pre-release to 0.9-rc5. Update PKG_VERSION,
PKG_SOURCE, PKG_SOURCE_URL, PKG_BUILD_DIR and PKG_HASH accordingly.
The two carried patches (010-pkgconfig, 020-no-po-subdir) still apply
unchanged, and test-version.sh already normalises the underscore in the
apk version (0.9_rc5) back to the upstream 0.9-rc5 string.
The nftables rule in acme-common partially works, but it races against the
acme.sh and uacme client. While the client is performing the renew the rule
is being deleted because the client is run in the background. This change
moves the rule management to the hook instead. While duplicate rules could
be created, the benefits outway the potential costs. It is unknown how many
installations issue/renew multiple certificates.
While at it, we synchronized .github/formalities.json with the current
default settings of the webhook bot.
Since the bot is shared across all OpenWrt repositories, the stale PR
cleanup is disabled by default at the repository level. Because this
repository wants to use stale triage, we explicitly enable it here.
- feeds: fixed the games_tracking feed URL
- f_etag: added housekeeping of the etag file
- f_etag: added 'last-modified' header as fallback for change detection
- small fixes & optimizations
Josef Schlehofer [Tue, 30 Jun 2026 06:15:38 +0000 (08:15 +0200)]
contributing: update CI section with current test infrastructure
Update the Continuous Integration section to reflect the current state:
- Update the list of runtime-tested architectures (add i386_pentium-mmx
and mips_24kc, remove outdated i386_pentium4)
- Document the generic test suite (executable, version, hardcoded path,
strip, linked library, and SONAME checks)
- Add documentation for test-version.sh (version check override) and
pre-test.sh (pre-test setup) scripts alongside the existing test.sh
- Document available environment variables (PKG_NAME, PKG_VERSION,
CI_HELPERS) for test scripts
dockerd: update configuration to select TFTP modules
PR https://github.com/openwrt/openwrt/pull/23690 introduces
the ability to add PACKAGE_kmod-nf-nathelper-tftp instead of
PACKAGE_kmod-nf-nathelper-extra to reduce space usage.
The scripts were a mess. Attempting even a simple update caused many
Copilot complaints. So we rewrite the scripts to be cleaner and
resolve the issues found by automated code review (such as Copilot).
Made extensive use of Qwen3.6-27B, LATE, and llama.ccp for local AI
code reviews during development.
In the process we deduplicate the nut-server and nut-monitor
initscripts and split them into several files, for easier automatic
and human review.
Incorporates and supersedes: #28308
Should supersede #21014
Closes: #28298 Signed-off-by: Daniel F. Dickinson <redacted>
Stan Grishin [Wed, 1 Jul 2026 18:13:57 +0000 (18:13 +0000)]
pbr: update to 1.2.2-18
Maintainer: me
Compile tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Run tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Description:
Update to version 1.2.2-18
- Update PKG_RELEASE to 18.
files/etc/init.d/pbr:
- Update package compatibility level to 26.
- Improve IPv4 gateway detection for various scenarios (e.g., netifd,
point-to-point links).
- Add pbr_get_ipaddr4 function to retrieve an interface's IPv4 address.
- Improve IPv6 gateway detection, including link-local router discovery
and point-to-point link handling.
- Add pbr_get_ipaddr6 function to retrieve an interface's IPv6 address.
- Introduce `is_punycode` helper for domain validation, recognizing
internationalized domain names.
- Expand `is_domain` to include `is_punycode` for comprehensive domain
matching.
- Add `warningInterfaceRoutingUnknownGateway` text for improved error
messages.
- Enhance `nftset` dnsmasq element addition logic to properly handle
existing entries and append new specifications for dual-stack.
- Flush IPv4 and IPv6 routes from custom tables during cleanup to ensure
proper state reset.
- Optimize `dns_policy_process` to only record the first IPv4 and IPv6
DNS servers to avoid issues with multi-value `src_addr` in family
mismatch checks.
- Refine IPv4 routing (`interface_routing`) for strict enforcement and
point-to-point links.
- Refine IPv6 routing (`interface_routing`) for strict enforcement and
point-to-point links.
- Adjust display of gateway information (`dispGw4`, `dispGw6`) to show
IP address if no gateway is found.
- Ensure `json_add_gateway` uses `dispGw4` and `dispGw6` for consistent
output.
- Move `process_interface` calls for `reset_globals` and
`enumerate_interface` earlier in `start_service` for consistent
trigger registration.
- Add logic to skip IPv6 interface reload if the gateway is unchanged to
prevent unnecessary restarts.
- Standardize `service_triggers` to always register all triggers,
ensuring robust recovery from WAN-down states.
Dharmik Parmar [Wed, 24 Jun 2026 17:07:18 +0000 (22:37 +0530)]
watchcat: clarify recovery timer baseline
Keep the default restart timing based on the moment the recovery action
is triggered.
The optional reset_failure_timer path still starts a fresh failure window
after the recovery action finishes. This makes the two timing modes
explicit.
Josef Schlehofer [Tue, 30 Jun 2026 13:32:58 +0000 (15:32 +0200)]
giflib: add version check override
The giflib-utils executables (gif2rgb, gifbuild, gifclrmp, giffix,
giftext, giftool) do not report the package version when run, which
causes the generic version probe to fail.
Add a test-version.sh to skip the version check for the giflib and
giflib-utils packages.
Josef Schlehofer [Tue, 30 Jun 2026 12:36:24 +0000 (14:36 +0200)]
uspot: add version check override
None of the uspot executables (radius-client, uspot, uspot-das) expose
the package version via --version or --help flags. This causes the
generic CI tests to fail with "No executables in the package provided
version".
Add a test-version.sh to skip the version probe for the uspot,
uspotfilter and uspot-www subpackages.
Josef Schlehofer [Mon, 29 Jun 2026 10:54:31 +0000 (12:54 +0200)]
ci: trigger build on pull_request and wait for FormalityCheck
- Change trigger back to pull_request to ensure it runs correctly on fork PRs
- Add a wait-for-formalities job that polls the GITHUB_TOKEN for FormalityCheck status
- Execute the feeds package test build only when the formalities check succeeds
- New major LTS version. See
https://www.haproxy.com/blog/announcing-haproxy-3-4
- Updated haproxy PKG_VERSION and PKG_HASH
- Added patch to insert version information into halog. This is to make the
ci/cd happy.
- See changes: http://git.haproxy.org/?p=haproxy-3.4.git;a=shortlog
Hauke Mehrtens [Sat, 27 Jun 2026 23:02:21 +0000 (01:02 +0200)]
banip: release 1.8.10-1
- fixed log monitor source-IP spoofing (GHSA-r6hx-4f83-vp8m)
Fix: per-ban_logterm source anchoring — the real source (last IP in the line)
is used by default; opt-in 'first:' prefix for source-first formats (web-server access logs).
- add f_mem() helper to read MemAvailable from /proc/meminfo
- cap the auto-detected CPU core count by available memory in f_system:
ban_cores is limited to MemAvailable / 48 (MiB per job), floored to at least 1 core;
this bounds the number of feeds processed in parallel on constrained devices,
a user-set ban_cores is still honored as a ceiling (the cap only ever lowers it).
- derive the GNU sort buffer size from available memory, applied only when
coreutils sort is present; busybox sort is a no-op
Yaroslav Petrov [Sat, 27 Jun 2026 15:45:34 +0000 (17:45 +0200)]
monit: update to 6.0.0
* New release, see the changelog [1] for what's new.
* Switch the download source from Bitbucket to the official release page (https://mmonit.com/monit/dist/). The source code archives on Bitbucket no longer use clear naming conventions like "monit-x.y.z". The Monit team has confirmed that downloading directly from their official distribution site is the recommended approach going forward.
Jan Froch [Sun, 21 Jun 2026 19:12:18 +0000 (21:12 +0200)]
usteer: update to Git HEAD (2026-05-19)
7532e12 ubus: added reassoc_delay and reason code 7b1379a policy: add dynamic signal threshold to band-steering 094c469 ubus: DEAUTH reason more accurate 49ba5f1 policy: optimized steering with different levels of aggressiveness 0beb2c9 local_node: handle NULL sta_addr by freeing query memory 1a2f171 policy: fix logic in load comparison for node selection
Rosen Penev [Sat, 27 Jun 2026 00:36:49 +0000 (17:36 -0700)]
strongswan: remove implicit kmod dependencies
kmod-ipsec has all of these already included, including the deflate
stuff as part of kmod-crypto-deflate and kmod-crypto-aead as part of
kmod-crypto-echaniv.
git.99rst.org / openwrt-packages.git / log