nghttp2: update to 1.66.0

- Update package description

Signed-off-by: Aleksey Vasilenko <redacted>

nghttp3: update to 1.11.0

- Update package description
- Use CP instead of INSTALL_DATA to copy symlinks properly

Signed-off-by: Aleksey Vasilenko <redacted>

ngtcp2: update to 1.15.0

- Remove superficial libnghttp3 dependency
- Add libopenssl dependency
- Update package description
- Fix leaking lib and includes in libngtcp2_crypto_ossl.pc
- Use CP instead of INSTALL_DATA to copy symlinks properly

Signed-off-by: Aleksey Vasilenko <redacted>

curl: update to 8.15.0

- Merge LIBCURL_NGTCP2 and LIBCURL_NGHTTP3 into single LIBCURL_HTTP3 config option
- Rename LIBCURL_NGHTTP2 to LIBCURL_HTTP2 config option
- Disable IPFS support which is enabled by default
- Refresh a patch

Signed-off-by: Aleksey Vasilenko <redacted>

golang: bump to 1.25.0

Fixes: CVE-2025-47907
Link: https://go.dev/doc/go1.25
Signed-off-by: George Sapkin <redacted>

libzip: update to 1.11.4

update to 1.11.4

Signed-off-by: Aleksey Vasilenko <redacted>

coova-chilli: update to 1.7

Swith to local tarballs for smaller size.

Some patches were merged upstream.

Switch to static instead of attribute constructor. Simpler.

Signed-off-by: Rosen Penev <redacted>

uradvd: provide warning upon disabled configuration

which grants clarity and better traceability.

Signed-off-by: Jan-Niklas Burfeind <redacted>

uradvd: Update to 2025-08-16

Provide four new options:
--valid-lifetime
--preferred-lifetime
--max-router-adv-interval
--min-router-adv-interval

Signed-off-by: Jan-Niklas Burfeind <redacted>

apr: update to 1.7.6

update to 1.7.6

Signed-off-by: Aleksey Vasilenko <redacted>

boost: Updates package to version 1.89.0
This commit updates boost to version 1.89.0

New libraries in this release:
* Bloom [2]: filters, from Joaquín M López Muñoz.

Other Notes:
* Boost.System is now a header-only library [3]

More info about Boost 1.89.0 can be found at the usual place [1].

[1]: https://www.boost.org/users/history/version_1_89_0.html
[2]: https://www.boost.org/libs/bloom/
[3]; https://github.com/boostorg/system/commit/7a495bb46d7ccd808e4be2a6589260839b0fd3a3

Signed-off-by: Carlos Miguel Ferreira <redacted>

libcbor: adjust for cmake 4.x

Cmake 4.x requires 'cmake_minimum_required' to be at least 3.5.
Use 3.30 as the value (current cmake in OpenWrt 24.10).

Signed-off-by: Hannu Nyman <redacted>

treewide: adjust local CMakeLists.txt min version to cmake 4.x

cmake 4.x will require 'cmake_minimum_required' defined in cmake
projects to be at least 3.5. Adjust those local sources where that
variable is currently defined with value below 3.5.

Use 3.30 as the value, as 3.30 is currently used in 24.10, the oldest
still supported OpenWrt release branch.

Signed-off-by: Hannu Nyman <redacted>

libulfius: Update to v2.7.15

This library is tightly coupled with liborcania and libyder, they must be updated together.

* Update libulfius to v2.7.15

* Patch libulfius to fix FTBFS on 32-bit architectures with 64-bit time_t
  - Backported from upstream commit: 9457809a5321ca4a87f19fdc3f7f4af68e72afa8

* Remove obsolete CMAKE options for libulfius

Signed-off-by: Austin Lane <redacted>

libyder: Update to v1.4.20
This library is tightly coupled with liborcania and libulfius, they must be updated together.

* Update libyder to v1.4.20

Signed-off-by: Austin Lane <redacted>

liborcania: Update to v2.3.3

This library is tightly coupled with libulfius and libyder, they must be updated together.

* Update liborcania to v2.3.3

Signed-off-by: Austin Lane <redacted>

haproxy: update to v3.2.4

- Major version bump to the latest HAProxy v3.2 LTS release.
- Updated haproxy PKG_VERSION and PKG_HASH
- Updated build-parameters:
  - Removed USE_QUIC_OPENSSL_COMPAT as OpenSSL v3.5.1+ ships with
    good enough Quic support. HAProxy does not need the compat code
    with these newer versions of OpenSSL anymore.
  - Removed obsolete build parameters.
- Updated example configuration so it works with the new version.
- See changes: http://git.haproxy.org/?p=haproxy-3.2.git;a=shortlog

Signed-off-by: Christian Lachner <redacted>

nano: set nano as default EDITOR for nano-plus/full

Set nano as the default EDITOR via /etc/profile.d for those apps
that respect the variable. Only for nano-plus and nano-full variants.

Suggested-by: Anthony Sepa <redacted>
Signed-off-by: Hannu Nyman <redacted>

frp: Remove myself as maintainer

Signed-off-by: Richard Yu <redacted>

fish: update to 4.0.2

Update fish to 4.0.2

Signed-off-by: Shin Rag <redacted>

libpng: update to 1.6.50

- refresh a patch

Signed-off-by: Aleksey Vasilenko <redacted>

imagemagick: update to 7.1.2.1

- Update project URL
- Add newly added type-urw-base35-type1.xml to conffiles
- Sort configure args

Signed-off-by: Aleksey Vasilenko <redacted>

subversion: update to 1.14.5

update to 1.14.5

Signed-off-by: Aleksey Vasilenko <redacted>

bottom: update to 0.11.1

update to 0.11.1

Signed-off-by: Aleksey Vasilenko <redacted>

rust: update to 1.89.0

- switch source archive to tar.xz to save space and bandwidth
- refresh a patch

Signed-off-by: Aleksey Vasilenko <redacted>

nano: Update to 8.6

Update nano editor to version 8.6

Signed-off-by: Hannu Nyman <redacted>

protobuf-c: fix host usage

Dependant packages mostly depend on a proto-c binary instead of
proto-gen-c. Add a symlink for it.

Remove no longer needed HOST options.

Signed-off-by: Rosen Penev <redacted>

whois: update to 5.6.4

- takeover maintainership

Signed-off-by: Aleksey Vasilenko <redacted>

php8: update to 8.4.11

Upstream changelog:
https://www.php.net/ChangeLog-8.php#8.4.11

Signed-off-by: Michael Heimpold <redacted>

libpfring: backport patches fixing compilation warning on 6.12+

Backport patches fixing compilation warning on 6.12+ kernel version.

  CC [M]  /home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.o
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:284:1: error: 'static' is not at beginning of declaration [-Werror=old-style-declaration]
  284 | const static ip_addr ip_zero = { IN6ADDR_ANY_INIT };
      | ^~~~~
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:467:7: error: no previous prototype for 'get_num_rx_queues' [-Werror=missing-prototypes]
  467 | u_int get_num_rx_queues(struct net_device *dev)
      |       ^~~~~~~~~~~~~~~~~
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:485:7: error: no previous prototype for 'lock_rss_queues' [-Werror=missing-prototypes]
  485 | u_int lock_rss_queues(struct net_device *dev)
      |       ^~~~~~~~~~~~~~~
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:744:14: error: no previous prototype for 'netns_lookup' [-Werror=missing-prototypes]
  744 | pf_ring_net *netns_lookup(struct net *net) {
      |              ^~~~~~~~~~~~
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:762:14: error: no previous prototype for 'netns_add' [-Werror=missing-prototypes]
  762 | pf_ring_net *netns_add(struct net *net) {
      |              ^~~~~~~~~
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:1017:17: error: no previous prototype for 'pf_ring_device_ifindex_lookup' [-Werror=missing-prototypes]
 1017 | pf_ring_device *pf_ring_device_ifindex_lookup(struct net *net, int ifindex) {
      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:1031:17: error: no previous prototype for 'pf_ring_device_name_lookup' [-Werror=missing-prototypes]
 1031 | pf_ring_device *pf_ring_device_name_lookup(struct net *net /* namespace */, char *name) {
      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:3467:5: error: no previous prototype for 'check_perfect_rules' [-Werror=missing-prototypes]
 3467 | int check_perfect_rules(struct sk_buff *skb,
      |     ^~~~~~~~~~~~~~~~~~~
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:3541:5: error: no previous prototype for 'check_wildcard_rules' [-Werror=missing-prototypes]
 3541 | int check_wildcard_rules(struct sk_buff *skb,
      |     ^~~~~~~~~~~~~~~~~~~~
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:3657:5: error: no previous prototype for 'bpf_filter_skb' [-Werror=missing-prototypes]
 3657 | int bpf_filter_skb(struct sk_buff *skb,
      |     ^~~~~~~~~~~~~~
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:3711:5: error: no previous prototype for 'sample_packet' [-Werror=missing-prototypes]
 3711 | int sample_packet(struct pf_ring_socket *pfr) {
      |     ^~~~~~~~~~~~~
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:3731:11: error: no previous prototype for 'default_rehash_rss_func' [-Werror=missing-prototypes]
 3731 | u_int32_t default_rehash_rss_func(struct sk_buff *skb, struct pfring_pkthdr *hdr)
      |           ^~~~~~~~~~~~~~~~~~~~~~~
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:4477:6: error: no previous prototype for 'register_device_handler' [-Werror=missing-prototypes]
 4477 | void register_device_handler(void)
      |      ^~~~~~~~~~~~~~~~~~~~~~~
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:4486:6: error: no previous prototype for 'unregister_device_handler' [-Werror=missing-prototypes]
 4486 | void unregister_device_handler(void)
      |      ^~~~~~~~~~~~~~~~~~~~~~~~~
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:4724:6: error: no previous prototype for 'reserve_memory' [-Werror=missing-prototypes]
 4724 | void reserve_memory(unsigned long base, unsigned long mem_len)
      |      ^~~~~~~~~~~~~~
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:4733:6: error: no previous prototype for 'unreserve_memory' [-Werror=missing-prototypes]
 4733 | void unreserve_memory(unsigned long base, unsigned long mem_len)
      |      ^~~~~~~~~~~~~~~~
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:6038:14: error: no previous prototype for 'ring_poll' [-Werror=missing-prototypes]
 6038 | unsigned int ring_poll(struct file *file,
      |              ^~~~~~~~~
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:6130:23: error: no previous prototype for 'cluster_lookup' [-Werror=missing-prototypes]
 6130 | ring_cluster_element *cluster_lookup(u_int32_t cluster_id) {
      |                       ^~~~~~~~~~~~~~
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:6149:5: error: no previous prototype for 'get_first_available_cluster_queue' [-Werror=missing-prototypes]
 6149 | int get_first_available_cluster_queue(ring_cluster_element *el)
      |     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:6162:24: error: no previous prototype for 'get_first_cluster_consumer' [-Werror=missing-prototypes]
 6162 | struct pf_ring_socket *get_first_cluster_consumer(ring_cluster_element *el)
      |                        ^~~~~~~~~~~~~~~~~~~~~~~~~~
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:6179:5: error: no previous prototype for 'add_sock_to_cluster_list' [-Werror=missing-prototypes]
 6179 | int add_sock_to_cluster_list(ring_cluster_element *el, struct sock *sk, u_int16_t consumer_id)
      |     ^~~~~~~~~~~~~~~~~~~~~~~~
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:6231:5: error: no previous prototype for 'remove_from_cluster_list' [-Werror=missing-prototypes]
 6231 | int remove_from_cluster_list(struct ring_cluster *cluster_ptr, struct sock *sock)
      |     ^~~~~~~~~~~~~~~~~~~~~~~~
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:6840:5: error: no previous prototype for 'setSocketStats' [-Werror=missing-prototypes]
 6840 | int setSocketStats(struct pf_ring_socket *pfr)
      |     ^~~~~~~~~~~~~~
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:8266:6: error: no previous prototype for 'pf_ring_zc_dev_register' [-Werror=missing-prototypes]
 8266 | void pf_ring_zc_dev_register(zc_dev_callbacks *callbacks,
      |      ^~~~~~~~~~~~~~~~~~~~~~~
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:8351:6: error: no previous prototype for 'pf_ring_zc_dev_unregister' [-Werror=missing-prototypes]
 8351 | void pf_ring_zc_dev_unregister(struct net_device *dev, u_int channel_id)
      |      ^~~~~~~~~~~~~~~~~~~~~~~~~
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:8505:6: error: no previous prototype for 'remove_device_from_proc' [-Werror=missing-prototypes]
 8505 | void remove_device_from_proc(pf_ring_net *netns, pf_ring_device *dev_ptr) {
      |      ^~~~~~~~~~~~~~~~~~~~~~~
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:8540:6: error: no previous prototype for 'remove_device_from_ring_list' [-Werror=missing-prototypes]
 8540 | void remove_device_from_ring_list(struct net_device *dev)
      |      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:8607:6: error: no previous prototype for 'add_device_to_proc' [-Werror=missing-prototypes]
 8607 | void add_device_to_proc(pf_ring_net *netns, pf_ring_device *dev_ptr) {
      |      ^~~~~~~~~~~~~~~~~~
/home/runner/work/openwrt-rebuilder/openwrt-rebuilder/original/build/SNAPSHOT/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7621/libpfring-8.6.1/kernel/pf_ring.c:8637:5: error: no previous prototype for 'add_device_to_ring_list' [-Werror=missing-prototypes]
 8637 | int add_device_to_ring_list(struct net_device *dev, int32_t dev_index)
      |     ^~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors

While at it also refresh all the previous patch.

Signed-off-by: Christian Marangi <redacted>

rtty: update to 9.0.2

changelog: https://github.com/zhaojh329/rtty/releases/tag/v9.0.2

Signed-off-by: Jianhui Zhao <redacted>

parted: fix compilation with GCC15

Backport upstream patch.

Signed-off-by: Rosen Penev <redacted>

iperf: update to 2.2.1

Changelog: https://sourceforge.net/projects/iperf2/files/

Note: 001-checksums.c-needs-to-define-_GNU_SOURCE.patch is added to
fix a build error with musl libc, where struct udphdr members are not
available unless _GNU_SOURCE is defined.

Signed-off-by: Wei-Ting Yang <redacted>

cloudreve: Update to 4.6.0

Changelogs:
  - https://github.com/cloudreve/cloudreve/releases/tag/4.5.0
  - https://github.com/cloudreve/cloudreve/releases/tag/4.6.0

Signed-off-by: Tianling Shen <redacted>

dufs: Update to 0.44.0

Release note: https://github.com/sigoden/dufs/releases/tag/v0.44.0

Signed-off-by: Tianling Shen <redacted>

cloudflared: Update to 2025.8.1

Release note: https://github.com/cloudflare/cloudflared/releases/tag/2025.8.1

Signed-off-by: Tianling Shen <redacted>

snort3: update to 3.9.3.0

Changelog: https://github.com/snort3/snort3/releases/tag/3.9.3.0

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc (Intel N150 based box)

Signed-off-by: John Audia <redacted>

libdaq3: update to 3.0.21

Update to latest version.

Changelog: https://github.com/snort3/libdaq/releases/tag/v3.0.21

Signed-off-by: John Audia <redacted>

sing-box: update to 1.12.3

changelog: https://github.com/SagerNet/sing-box/releases/tag/v1.12.3

Signed-off-by: Gregory Gullin <redacted>

dufs: remove `--locked` flag

It's enabled by default now.

Signed-off-by: Tianling Shen <redacted>

rust: read build path from `{HOST_}MAKE_PATH`

Allow set build path by `{HOST_}MAKE_PATH`.

Signed-off-by: Tianling Shen <redacted>

rust: introduce `RUST_{HOST,PKG}_LOCKED` flag

Introduce `RUST_{HOST,PKG}_LOCKED` flag (enabled by default) to respect
upstream lockfile. This can be disabled by setting it to 0 if you want
to have up-to-date dependencies.

This change also adds new `CARGO_{HOST,PKG}_ARGS` variable to pass extra
build arguments to cargo.

Signed-off-by: Tianling Shen <redacted>

pbr: 1.1.8-36 bugfixes

- drop load_environment_flag and always load environment on start, making
  restart command great again
- store/restore existing jshn namespace when using json()
- remove unneeded sleepCount in is_wan_up()
- move updated README inside files/

Signed-off-by: Stan Grishin <redacted>

aliyun-cli: update to 3.0.296

Changelog:
https://github.com/aliyun/aliyun-cli/releases/tag/v3.0.296

Signed-off-by: Bruce Chen <redacted>

qbee-agent: bump version to 2025.34

Signed-off-by: Jon Henrik Bjørnstad <redacted>
qbee-agent: bump version to 2025.34

lxc: update to 6.0.5

6.0.5 is a bug fix release, see:
https://discuss.linuxcontainers.org/t/lxc-6-0-5-lts-has-been-released/24438

Full changelog: https://github.com/lxc/lxc/compare/v6.0.4...v6.0.5

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc (Intel N150 based box)

Signed-off-by: John Audia <redacted>

abseil-cpp: Update to 20240722.1 LTS

- Update abseil-cpp minor rev. Fixes CVE-2025-0838

Signed-off-by: Austin Lane <redacted>

python-pyelftools: Update to v0.32

- Update pyelftools to version 0.32 (minor)

Signed-off-by: Austin Lane <redacted>

pdns-recursor: update to 5.2.5

includes fix for CVE-2025-30192 (which was in 5.2.4)

Signed-off-by: Peter van Dijk <redacted>

libpam: add upstream patch/fix build mold linker

Add backport fixing the build with mold linker and remove the no-mold flag.

See: https://github.com/linux-pam/linux-pam/issues/922 and
https://github.com/linux-pam/linux-pam/pull/928

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc (Intel N150 based box)

Signed-off-by: John Audia <redacted>

yt-dlp: bump to 2025.08.11

Changelog: https://github.com/yt-dlp/yt-dlp/releases/tag/2025.08.11
Signed-off-by: George Sapkin <redacted>

frp: bump to 0.64.0

Change log is available at https://github.com/fatedier/frp/compare/v0.51.3...v0.64.0

Signed-off-by: Roc Lai <redacted>

libprotobuf-c: Update to v1.5.2

Update libprotobuf-c to version 1.5.2.
Notably, adds support for protobuf >=26

Signed-off-by: Austin Lane <redacted>

lua-argparse: bump to luarocks' 0.7.1

Bump lua-argparse to the luarocks argparse 0.7.1 release.

Signed-off-by: Nathaniel Wesley Filardo <redacted>

lighttpd: update to lighttpd 1.4.81 release hash

https://www.lighttpd.net/2025/8/17/1.4.81/

Signed-off-by: Glenn Strauss <redacted>

sing-box: update to 1.12.1

changelog: https://github.com/SagerNet/sing-box/releases/tag/v1.12.1

Signed-off-by: Gregory Gullin <redacted>

sendmail: fix building as non-root user

Buildbot builds started failing with this:

[...]
install -c -o buildbot -g buildbot -m 644 ../../include/libmilter/mfapi.h /builder/shared-workdir/build/sdk/build_dir/target-x86_64_musl/sendmail-8.16.1/ipkg-install/usr/include/libmilter/mfapi.h
install: invalid user 'buildbot'

Extend 010-enable-nonroot-install.patch to remove "-o U -g G" from more
install targets.

Signed-off-by: W. Michael Petullo <redacted>

coova-chilli: fix compilation with GCC15

No idea how this even worked. cmdsock never got closed.

Signed-off-by: Rosen Penev <redacted>

krb5: update to 1.22

Upstream list of changes is available at
https://web.mit.edu/kerberos/krb5-1.22/krb5-1.22.html.

Of note is that this release fixes the build with GCC 15.1.  As with
other recent versions, GCC 15.1 transforms some warnings into errors,
and this release remediates those warnings, now errors.

Signed-off-by: W. Michael Petullo <redacted>

owut: update to 2025.08.15

Bug fixes:
    efahl/owut@c6e75716d1a3 init: fix typo in file name
    efahl/owut@7f97ab67c2f5 examples: improve docs for writing pre-install scripts
Enhancements:
    efahl/owut@93f2b06b8882 owut: utilize upstream limits instead of hardcoded values
    efahl/owut@7a45c412fc96 owut: improve usability of 'dump' option
    efahl/owut@35720e369ac0 owut: improve age reporting

Signed-off-by: Eric Fahlgren <redacted>

python-certifi: update to 2025.8.3

Fix CVE-2024-39689.

Signed-off-by: Wei-Ting Yang <redacted>

python-certifi: assign PKG_CPE_ID

https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:certifi:certifi

Signed-off-by: Wei-Ting Yang <redacted>

isc-dhcpd: quote filenames for safety

Per best practices, we should protect against wildcards in
variable expansions.

Signed-off-by: Philip Prindeville <redacted>

isc-dhcp: fix spacing on forced parameters

If there's a "forced_send" option, then put spaces between multiple
parameter codes.

Signed-off-by: Philip Prindeville <redacted>

isc-dhcp: distinguish between hexstrings and strings

It's a minor difference and they're handled the same, but that
might change as we move to Kea.

Signed-off-by: Philip Prindeville <redacted>

isc-dhcp: clean up 'if' formatting

We don't use a consistent format of bracket-semicolon, so fix it.

Signed-off-by: Philip Prindeville <redacted>

packages/net-snmp: fix typo

CONFILTS is changed to CONFLICTS to enable condition.

Signed-off-by: Christian Korber <redacted>

python-urllib3: update to 2.0.7

Fix CVE-2023-45803 and CVE-2023-43804.

Full changelogs:
- https://github.com/urllib3/urllib3/releases/tag/v2.0.5
- https://github.com/urllib3/urllib3/releases/tag/2.0.6
- https://github.com/urllib3/urllib3/releases/tag/2.0.7

Signed-off-by: Wei-Ting Yang <redacted>

python3: update to version 3.11.13

Release notes:
https://docs.python.org/release/3.11.13/whatsnew/changelog.html#python-3-11-13

Fixes CVEs:
CVE 2024-12718
CVE 2025-4138
CVE 2025-4330
CVE 2025-4517

Patch refreshed

Signed-off-by: Josef Schlehofer <redacted>

mstflint: update to 4.33.0

This commit updates the mstflint package to
the latest 4.33.0 release.

Obsolete patches have been removed,
as they are now included in this version.

Signed-off-by: Til Kaiser <redacted>

kea: fix kea.init error handling

kea.init returned 0 for invalid service names.
Print an error to stderr and return 1 to indicate failure.

Signed-off-by: Liu Yu <redacted>

kea: update to 2.6.4

Upstream changelog:
https://downloads.isc.org/isc/kea/2.6.4/Kea-2.6.4-ReleaseNotes.txt

Signed-off-by: Liu Yu <redacted>

cloudflared: Update to 2025.8.0

Release note: https://github.com/cloudflare/cloudflared/releases/tag/2025.8.0

Signed-off-by: Tianling Shen <redacted>

django: allow test.sh only for python3-django package

No idea how this worked before.
But the '/usr/bin/django-admin' is available only for python3-django

Signed-off-by: Alexandru Ardelean <redacted>

python-requests: bump to version 2.32.4

This change updates the Python requests package to version 2.32.4

Signed-off-by: Alexandru Ardelean <redacted>

numpy: bump to version 2.3.2

This change bumps numpy to 2.3.2

Signed-off-by: Alexandru Ardelean <redacted>

django-restframework: bump to version 3.16.1

This change updates django-restframework to 3.16.1

Signed-off-by: Alexandru Ardelean <redacted>

squashfs-tools: bump to version 4.7

This updates squashfs-tools to version 4.7

Tweaked build option flags.

Need to backport patch from upstream to fix compiler error for pid_t type.

Signed-off-by: Alexandru Ardelean <redacted>

dbus: fix ujail configuration

Running dbus as an unprivileged user fails for two reasons: Cannot write pid file
and cannot read the installed policies:

 Tue Aug  5 17:12:41 2025 daemon.info dbus-daemon[8568]: jail: exec-ing /usr/bin/dbus-daemon
 Tue Aug  5 17:12:41 2025 daemon.info dbus-daemon[8585]: Encountered error 'Failed to open "/etc/dbus-1/system.d/org.freedesktop.ModemManager1.conf": Permission denied' while parsing '/etc/dbus-1/system.d/org.freedesktop.ModemManager1.conf'
 Tue Aug  5 17:12:41 2025 daemon.err dbus-daemon[8568]: dbus-daemon[8585]: Encountered error 'Failed to open "/etc/dbus-1/system.d/org.freedesktop.ModemManager1.conf": Permission denied' while parsing '/etc/dbus-1/system.d/org.freedesktop.ModemManager1.conf'
 Tue Aug  5 17:12:41 2025 daemon.warn dbus-daemon[8585]: Failed to start message bus: Failed to open "/var/run/dbus.pid": Permission denied
 Tue Aug  5 17:12:41 2025 daemon.err dbus-daemon[8568]: dbus-daemon[8585]: Failed to start message bus: Failed to open "/var/run/dbus.pid": Permission denied
 Tue Aug  5 17:12:41 2025 daemon.info dbus-daemon[8568]: jail: jail (8585) exited with exit: 1

Fix by dropping the pid file when running unprivileged and changing the owner
of the installed policies.

Fixes: f238d6dd0996 ("dbus: run as regular user rather than as root")
Signed-off-by: Bjørn Mork <redacted>

gkrellmd: update to 2.4.0

Fixes compilation with GCC15.

Signed-off-by: Rosen Penev <redacted>

perl-file-rsyncp: update to 0.76

Fix compilation with GCC15.

Signed-off-by: Rosen Penev <redacted>

python-pycares: bump to 4.10.0

python-pycares: bump from version 4.8.0 to 4.10.0

Signed-off-by: Fabian Lipken <redacted>

lttng-tools: fix build with libxml 2.14

Backport a pending patch to fix build with libxml 2.14.

Signed-off-by: Tianling Shen <redacted>

openblas: bump to version 0.3.30

This change updates the version to 0.3.30
Added patch to fix x86 builds.

Also sent upstream:
   https://github.com/OpenMathLib/OpenBLAS/pull/5418

Signed-off-by: Alexandru Ardelean <redacted>

pbr: update to 1.1.8-34

* bugfix: json init was destroying procd_triggers and screwing boot up
  fixes https://github.com/openwrt/packages/issues/27194
* improvement: explicit printf calls in get_text

Signed-off-by: Stan Grishin <redacted>

sudo: bump to version 1.9.17p2

This change bumps sudo to version 1.9.17p2

Signed-off-by: Alexandru Ardelean <redacted>

tcpreplay: compile as gnu11

Fixes compilation under GCC15.

Signed-off-by: Rosen Penev <redacted>

isc-dhcp: fix build issues with stricter compilers

The new gcc in the toolchain is failing K&R style prototypes. There
are also some function pointers passed as parameters that didn't
have prototypes so were causing incompatible pointer clashes.

Signed-off-by: Philip Prindeville <redacted>

net-snmp: fix recursive dependency

Fixes recursive dependency during 'make menuconfig'

Signed-off-by: Florian Eckert <redacted>

krb5: build as C11

Fixes compilation with GCC 15.

The upstream patch fixing compilation is way too huge to backport.

Signed-off-by: Rosen Penev <redacted>

fx: update to 39.0.1

update fx from version 36.0.3 to 39.0.1

Signed-off-by: Fabian Lipken <redacted>

unixodbc: compile as gnu11

Fixes compilation with GCC15. Properly fixing this is too convoluted.

Signed-off-by: Rosen Penev <redacted>

libyaml-cpp: fix pkgconfig file

This avoids leaking OS paths.

Signed-off-by: Rosen Penev <redacted>

rsyslog: update to 8.2506.0

Fixes compilation with GCC15.

Signed-off-by: Rosen Penev <redacted>

make: fix compilation with GCC15

Extra define is neede.

Signed-off-by: Rosen Penev <redacted>

docker-compose: Update to version 2.39.2

Release notes:
https://github.com/docker/compose/releases/tag/v2.39.2

Signed-off-by: Javier Marcet <redacted>

net-snmp: bump PKG_RELEASE

Bump PKG_RELEASE by one.

Signed-off-by: Florian Eckert <redacted>

net-snmp: save pid to file

This commit saves the pid to a file in '/var/run'.

Signed-off-by: Christian Korber <redacted>

net-snmp: add logging to init script

To support logging in net-snmp this commit introduces this feature. There is
a new uci config section 'logging'.

The following new parameters are used:

config logging
option log_file '/var/log/snmpd.log'
option log_file_priority 'i'
option log_syslog '0'
option log_syslog_facility 'd'

Signed-off-by: Christian Korber <redacted>
Signed-off-by: Florian Eckert <redacted>

net-snmp: modify init script for SNMPv3

This commit adds function 'snmpd_snmpv3_add' to the init script
to support SNMPv3 config parsing.

The new uci config section has the following configuration parameters:

config v3
option username 'John'
option allow_write '0'
option auth_type 'SHA|MD5'
option auth_pass 'passphrase'
option privacy_type 'AES|DES'
option privacy_pass 'passphrase'
option RestrictOID 'yes|no'
option RestrictedOID '1.3.6.1.2.1.1.1'

This new section is only relevant if the snmp_version 'v1/v2c/v3' or 'v3'
is set in the uci section 'general'.

Signed-off-by: Christian Korber <redacted>
Signed-off-by: Florian Eckert <redacted>