Paul Donald [Wed, 11 Mar 2026 17:59:38 +0000 (18:59 +0100)]
openvpn: handling for 'push' and other array options
remove duplicate 'push' entry from string types.
push and other array values shall be "double quoted".
we also must 'eval' so that the double-quoted array values
don't get split on spaces.
Also quote file paths in case they contain spaces.
Fabrice Fontaine [Fri, 13 Mar 2026 21:40:56 +0000 (22:40 +0100)]
net/nfs-kernel-server: fix PKG_CPE_ID
cpe:/a:linux-nfs:nfs-utils is the correct CPE ID for nfs-kernel-server:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:linux-nfs:nfs-utils
Fixes: ee3b06e42cb86756b0fed1dd4e03aee1b358f759 (nfs-kernel-server: provide a NFSv3 and NFSv4 daemon) Signed-off-by: Fabrice Fontaine <redacted>
Fabrice Fontaine [Sat, 14 Mar 2026 17:47:40 +0000 (18:47 +0100)]
utils/bubblewrap: assign PKG_CPE_ID
cpe:/a:projectatomic:bubblewrap is the correct CPE ID for bubblewrap:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:projectatomic:bubblewrap
When token_script fails, proto_setup_failed() notifies netifd that
setup has failed, but script execution continues regardless.
This commit adds exit 1 and sleep 5 (consistent with wireguard.sh
error handling) to abort setup on token_script failure. Also fix
typo in logger tag ("openconenct" -> "openconnect").
Thomas Winkler [Tue, 10 Mar 2026 12:56:11 +0000 (13:56 +0100)]
openconnect: implement --no-external-auth
The option prevents OpenConnect from advertising
to the server that it supports any kind of
authentication mode that requires an external
browser. Some servers will force the client to use such
an authentication mode if the client advertises it, but
fallback to a more "scriptable" authentication mode if
the client doesn’t appear to support it.
Lower the START value from 99 to 90. This allows other applications that
use pulseaudio to start after it with the pulse client socket being available.
Full release notes:
https://github.com/stub42/pytz/blob/master/src/CHANGES.rst
pytz 2026.1 requires setuptools as build backend but it was not
declared as a build dependency, causing the build to fail with
'setuptools.build_meta:__legacy__ is not available'.
vscode: update editor settings and commit constraints
Enable trailing whitespace trimming, insert final newline, and force LF.
Configure git input validation to warn if subject exceeds 60 characters
or if body lines exceed 75 characters.
Dropped patch: 0001-Make-GEMM3M-parameters-available-on-32bit-X86-GENERI.patch
Part of upstream: https://github.com/OpenMathLib/OpenBLAS/pull/5418
Changelog:
- Revert a 0.3.30 optimization that could cause race conditions
and invalid results in GEMM
- Fix thread lockup with Python 3.9 and NumPy
- Fix deadlock in multithreaded code after fork()
- Add bfloat16 extensions (BGEMM, BGEMV) and basic FP16 infrastructure
- Add batch GEMM operations with strided variants
- Add multithreaded LAPACK SLAED3/DLAED3 for improved eigensolvers
- Add Apple M4 and Intel Lunar Lake support
- Add initial POWER11 architecture support
- Improve GEMM performance on A64FX and ARM processors
Full release notes:
https://github.com/OpenMathLib/OpenBLAS/releases/tag/v0.3.31
Dirk Brenken [Thu, 12 Mar 2026 19:39:02 +0000 (20:39 +0100)]
adblock: update 4.5.2‑4
* optimized the awk for the Top10 statistics in the DNS Report,
removed the faulty caching (reported in the forum)
* minor improvement in the f_switch function
* readme update
python-evdev: add mandatory uinput.h header to builder
Starting from 1.9.2 python-evdev requires
include/uapi/linux/uinput.h headers for proper building.
Otherwise, it compiles but cannot be imported causing
KeyError: 'UI_FF'
Changes since 4.7.2:
- Fix potential corruption in Squashfs filesystems containing sparse files
- Fix pseudo file creation failures with large blocks of contiguous zeros
- Fix duplicate file detection for files exceeding available buffer space
- Add -numeric-owner option to mksquashfs/sqfstar
- Fix segfault when using pseudo file root definitions with only Xattr metadata
- Fix conflict between -offset and -stream options
- Fix directory modification timestamp issues in pseudo file hierarchy
- Fix -max-depth incorrectly marking empty directories as excluded
Full release notes:
https://github.com/plougher/squashfs-tools/releases/tag/4.7.5
Florian Eckert [Thu, 5 Mar 2026 12:31:17 +0000 (13:31 +0100)]
openvpn: use append for the remaining options
There is already the 'append' command, which assembles all parameters that
are called 'proto_run_command'. Let´s move also the last params to the
top. To ensure that the sequence is correct, the parameters must be added
at the beginning, so that user parameters can overwrite them.
Florian Eckert [Thu, 5 Mar 2026 12:28:11 +0000 (13:28 +0100)]
openvpn: use also append for dev_type and ovpnproto options
There is already the 'append' command, which assembles all parameters that
are called 'proto_run_command'. Let´s use that. To ensure that the
sequence is correct, the parameters must be added at the beginning, so that
user parameters can overwrite them.
Florian Eckert [Thu, 5 Mar 2026 08:08:34 +0000 (09:08 +0100)]
openvpn: fix auth_user_pass option
The variable 'auth_file' is not used in the following programm sequence.
It therefore only makes sense to add it as a call parameter via 'append'
when calling the the 'proto_run_commmand'.
Martin Schiller [Wed, 18 Feb 2026 06:51:33 +0000 (07:51 +0100)]
usbutils: use ALTERNATIVES
Use the ALTERNATIVES symlink handling to avoid conflicts with busybox
lsusb tool. Otherwise this package can not be installed if you also have
enabled lsusb from busybox.
Martin Schiller [Wed, 18 Feb 2026 06:49:01 +0000 (07:49 +0100)]
pciutils: use ALTERNATIVES
Use the ALTERNATIVES symlink handling to avoid conflicts with busybox
lspci tool. Otherwise this package can not be installed if you also have
enabled lspci from busybox.
Eric McDonald [Sat, 7 Mar 2026 22:29:16 +0000 (14:29 -0800)]
net-snmp: fix newline when RestrictOID is neither yes nor no
snmpd_access_default_add, snmpd_access_HostName_add, and
snmpd_access_HostIP_add check if RestrictOID is `yes` or `no`
but fail to write a newline for other values of RestrictOID
(e.g., `true`, `false`) or if unset, corrupting the generated config.
Fix by using config_get_bool and restructuring to write either
a complete line or nothing. Also require RestrictedOID to be
non-empty when RestrictOID is enabled.
This is a breaking change for configs where RestrictOID is set
to a value that the old code did not match as `yes` (e.g., `true`,
`1`, `on`, `enabled`) but config_get_bool evaluates as true. In
practice, this is unlikely to affect existing installs unless a
user is unknowingly relying on unintended behavior or is deliberately
relying on the old code's non-standard boolean evaluation; this
latter case is considered unlikely by this commit's author. Configs
where RestrictOID is enabled but RestrictedOID is empty are also
affected; previously a directive with a trailing space was written,
now no directive is written.
Eric McDonald [Sat, 7 Mar 2026 21:52:19 +0000 (13:52 -0800)]
net-snmp: add early return when IPMask is unset
snmpd_access_HostIP_add would write unintended output to the
config file if the IPMask option is not specified. Add an early
return to prevent writing in that case.
This is a breaking change for configs where IPMask is unset.
Previously, an empty IPMask option would result in a malformed
directive containing a trailing slash with no guaranteed newline,
the exact form of which depended on the values of other options.
Now, no directive is written.
Eric McDonald [Sat, 7 Mar 2026 21:51:25 +0000 (13:51 -0800)]
net-snmp: add early return when HostIP is unset
snmpd_access_HostIP_add would write unintended output to the
config file if the HostIP option is not specified. Add an early
return to prevent writing in that case.
This is a breaking change for configs where HostIP is unset.
Previously, an empty HostIP option would result in a malformed
directive containing a bare /mask with no guaranteed newline, the
exact form of which depended on the values of other options.
Now, no directive is written.
Eric McDonald [Sat, 7 Mar 2026 21:50:13 +0000 (13:50 -0800)]
net-snmp: add early return when HostName is unset
snmpd_access_HostName_add would write unintended output to the
config file if the HostName option is not specified. Add an early
return to prevent writing in that case.
This is a breaking change for configs where HostName is unset.
Previously, an empty HostName option would result in a malformed
directive with a trailing space and no guaranteed newline, the
exact form of which depended on the values of other options.
Now, no directive is written.
Eric McDonald [Sat, 7 Mar 2026 21:48:14 +0000 (13:48 -0800)]
net-snmp: add early return when CommunityName is unset
snmpd_access_default_add, snmpd_access_HostName_add, and
snmpd_access_HostIP_add would write unintended output to the
config file if the CommunityName option is not specified. Add an
early return to each function to prevent writing in that case.
This is a breaking change for configs where CommunityName is
unset. Previously, an empty CommunityName option would result in
a malformed directive with a double space and no guaranteed
newline, the exact form of which depended on the values of other
options. Now, no directive is written.
Eric McDonald [Sat, 7 Mar 2026 21:45:22 +0000 (13:45 -0800)]
net-snmp: add early return when Mode is unset
snmpd_access_default_add, snmpd_access_HostName_add, and
snmpd_access_HostIP_add would write unintended output to the
config file if the Mode option is not specified. Add an early
return to each function to prevent writing in that case.
This is a breaking change for configs where Mode is unset.
Previously, an empty Mode option would result in a malformed
directive with a leading space and no guaranteed newline, the
exact form of which depended on the values of other options.
Now, no directive is written.
NetBird `v0.66.x` adds support for exposing a local HTTP service
from the CLI with the `netbird expose`[1] command, but only for
self-hosted deployments. Cloud support is coming.
NetBird `v0.65.x` now includes a built-in reverse proxy[1], but only for
self-hosted deployments and is currently in beta. Cloud support is
coming soon.
Important: pre-shared keys or Rosenpass are currently incompatible with
the reverse proxy feature.
Building `netbird` with Go 1.26.x fails with errors:
```
[...]
/builder/dl/go-mod-cache/gvisor.dev/gvisor@v0.0.0-20251031020517-ecfcdd2f171c/pkg/sync/runtime_constants_go126.go:22:2: WaitReasonSelect redeclared in this block
/builder/dl/go-mod-cache/gvisor.dev/gvisor@v0.0.0-20251031020517-ecfcdd2f171c/pkg/sync/runtime_constants_go125.go:22:2: other declaration of WaitReasonSelect
/builder/dl/go-mod-cache/gvisor.dev/gvisor@v0.0.0-20251031020517-ecfcdd2f171c/pkg/sync/runtime_constants_go126.go:23:2: WaitReasonChanReceive redeclared in this block
/builder/dl/go-mod-cache/gvisor.dev/gvisor@v0.0.0-20251031020517-ecfcdd2f171c/pkg/sync/runtime_constants_go125.go:23:2: other declaration of WaitReasonChanReceive
/builder/dl/go-mod-cache/gvisor.dev/gvisor@v0.0.0-20251031020517-ecfcdd2f171c/pkg/sync/runtime_constants_go126.go:24:2: WaitReasonSemacquire redeclared in this block
/builder/dl/go-mod-cache/gvisor.dev/gvisor@v0.0.0-20251031020517-ecfcdd2f171c/pkg/sync/runtime_constants_go125.go:24:2: other declaration of WaitReasonSemacquire
[...]
```
The second release of `netbird` that introduces a breaking change[1].
A backport will be provided for OpenWrt 25.12 but not for OpenWrt 24.10,
since OpenWrt 25.12 has not been released yet.
Wesley Gimenes [Tue, 17 Feb 2026 07:04:06 +0000 (04:04 -0300)]
netbird: move state file to reduce storage wear
Add `NB_DNS_STATE_FILE="/var/lib/netbird/state.json"` to the init
environment. This moves the state from the directory
`/root/.config/netbird` to the file `/var/lib/netbird/state.json` to
avoid storage wear. Note: the file is not preserved across reboots.
The state file contains information such as locally disabled routes and
other data primarily useful for desktop clients. In OpenWrt setups,
these changes are normally handled by the NetBird `management` server.
This matches the behavior prior to `netbird` v0.52.x, I have not
received any reports that this file caused problems before, so it is
unlikely to cause issues now.
The previous state file `/root/.config/netbird/state.json` can be removed.
Dirk Brenken [Sun, 8 Mar 2026 17:50:46 +0000 (18:50 +0100)]
adblock: update 4.5.2‑3
* the suspend/resume function now uses the external
DNS bridge when this function is used
* refine the f_nftadd function
* more file debug logging
* LuCI: add unfiltered DNS-Server to the DNS bridge selection
* LuCI: minor fixes
Stan Grishin [Sun, 8 Mar 2026 01:13:52 +0000 (01:13 +0000)]
pbr: update to 1.2.2-r10
* add support for OpenVPN netifd detection (thanks @egc112)
* add support for disable LAN->WAN forwarding when `strict_enforcement` is
set on start and restart (thanks @egc112)
* fix: always create marking chains for interfaces
* fix: insert DSCP/ICMP-related nft rules after marking chains
* fix: shellcheck-related improvements
Stan Grishin [Sat, 7 Mar 2026 19:15:03 +0000 (19:15 +0000)]
adblock-fast: update to 1.2.2-r10
* bugfix: always print errors/warnings on non-quiet start
* bugfix: return proper enabled status in RPCD
* bugfix: return stupped status in RPCD when procd data is empty
* bugfix: correctly process verbosity=0
* delete LICENSE file and only keep it upstream
Tung-Yi Chen [Thu, 5 Mar 2026 18:24:22 +0000 (02:24 +0800)]
tailscale: fix fw_mode env by using append_param
The previous commit 09c14817 introduced TS_NO_LOGS_NO_SUPPORT but
used procd_set_param for a subsequent environment variable. This
overwrote the previous env setting, causing fw_mode to be missed.
Switch to procd_append_param to ensure all environment variables are
properly passed to the process.
Yanase Yuki [Wed, 14 Jan 2026 08:03:02 +0000 (17:03 +0900)]
bridge-utils: remove package
bridge-utils is obsolete software because ip command has
bridge functionality. And OpenWrt uses BusyBox's brctl
by default, so most users will not be affected by this change.
George Sapkin [Wed, 4 Mar 2026 15:11:53 +0000 (17:11 +0200)]
adguardhome: add GC and thread control variables
Add Go GC and threading control variables - GOGC, GOMEMLIMIT, and
GOMAXPROCS - to allow more granular control of the memory management on
lower memory devices.
Florian Eckert [Wed, 4 Mar 2026 10:08:46 +0000 (11:08 +0100)]
openvpn: refactoring INSTALL_DIR command call during install
Move the 'INSTALL_DIR' creation in the make install target to the location
where the files are also installed. This prevents directories that are no
longer needed from being forgotten during refactoring.
zabbix: add full variants and add-on support for other
Rather than having a database selection for SQLITE which prevents
the server or frontend from building, we add a 'basic'
variant for the proxy which uses sqlite3, and have the database
Kconfig affect only the server and frontend.
* There are now only three variants:
1. full, which is the default. It includes the full monitoring feature
set currently available on openwrt, including netsnmp, curl-based
checks, and ldap. In addition these features, plus the choice of
database and ssl provider (or no ssl) are configuration options for
this variant.
2. basic, which provides basic functions with openssl support
3. no-configure, for packages which are not part of the main Zabbix
compile process (including the WebUI which only requires copying
files for use by a web server with PHP CGI support).
* Full is the default variant for agentd and proxy, which are the only
packages with a choice between full and basic. All other packages only
are part of one variant.
* Full variants are the base version of the packages (that is
zabbix-agentd is the 'full' version while zabbix-agentd-basic is the
core version). The proxy version is named zabbix-proxy-basic-sqlite to
announce that it is using the sqlite3 database and not a database
server.
* get and sender only build if at least one of agentd, server, or proxy
are built. Therefore prevent selection get or sender when they would not
build.
* Zabbix's use of NetSNMP requires that Zabbix be build with OpenSSL
* While we are here, enable support for dates after 2038 (64-bit time_t)
* https://github.com/openwrt/packages/pull/28585#issuecomment-3984978895
* we updated the name to reflect that it is for basic functionality
that can standalone, rather then being a core the other packages
build on.
* basic has been used rather than tiny or small since the sentence
'Provides only tiny/small functionality with SSL/TLS' in the
description, sounds strange, but using basic this reads properly.
git.99rst.org / openwrt-packages.git / log