luajit2: update to v2.1-20240314

Signed-off-by: Javier Marcet <redacted>

xray-core: Update to 1.8.10

Signed-off-by: Tianling Shen <redacted>

yq: Update to 4.43.1

Signed-off-by: Tianling Shen <redacted>

alist: Update to 3.33.0

Signed-off-by: Tianling Shen <redacted>

lua-eco: update to 3.3.0

Signed-off-by: Jianhui Zhao <redacted>

Merge pull request #23789 from rsalvaterra/tor-bump

tor: update to 0.4.8.10 stable

tor: update to 0.4.8.10 stable

Bugfix release, see the changelog [1] for what's new.

[1] https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.8.10/ChangeLog

Signed-off-by: Rui Salvaterra <redacted>

Merge pull request #23704 from graysky2/htop

htop: build with CONFIG_HTOP_LMSENSORS=y

htop: build with CONFIG_HTOP_LMSENSORS=y

Default CONFIG_HTOP_LMSENSORS to y so users just need to install
libsensors, no need to build your own, but no need to pay the
size price when you don't use it.  Closes #23700.

Signed-off-by: John Audia <redacted>

Merge pull request #23777 from jmarcet/docker-compose

docker-compose: Update to version 2.26.1

docker-compose: add PKG_NAME to PKG_SOURCE

Before this change, the tarball was downloaded as vVERSION.tar.gz.
For example, it was v2.26.1.tar.gz and that file was put into the dl folder
within the OpenWrt build system.

After this change, the tarball is properly downloaded as NAME-vVERSION.tar.gz.
In this case, it will look like this: docker-compose-v.2.26.1.tar.gz

The advantages of using this:
- Users, developers will know that what they downloaded (it has name and version)
- The tarball will not be overwritten by another package with the same version.

Signed-off-by: Javier Marcet <redacted>
Signed-off-by: Josef Schlehofer <redacted>
[added commit message]

docker-compose: Update to version 2.26.1

Release notes:
https://github.com/docker/compose/releases/tag/v2.26.1

Signed-off-by: Javier Marcet <redacted>

kmsbd-tools: switch to use tagged release

Instead of checking Git sources, we will use now tagged releases.

This solve the strange version 0~3.5.1-r1, now will be 3.5.2-r2

Signed-off-by: Andrea Pesaresi <redacted>

netbird: update to 0.26.6

Signed-off-by: jiangslee <redacted>

tailscale: Update to 1.62.1

https://github.com/tailscale/tailscale/releases/tag/v1.62.1

Signed-off-by: Zephyr Lykos <redacted>

Merge pull request #23743 from stangri/master-nghttp3

nghttp3: update to 1.2.0

Merge pull request #23744 from stangri/master-ngtcp2

ngtcp2: update to 1.4.0

Revert "tools/xz: update to 5.6.1" (CVE-2024-3094)

This reverts commit 714c91d1a63f29650abaa9cf69ffa47cf2c70297 as probably
the upstream xz repository and the xz tarballs have been backdoored.

References: https://www.openwall.com/lists/oss-security/2024/03/29/4
Signed-off-by: Petr Štetiar <redacted>

perl-text-csv_xs: Update to 1.53

Signed-off-by: Philip Prindeville <redacted>

eza: update to 0.18.9

Release notes:
0.18.8 - https://github.com/eza-community/eza/releases/tag/v0.18.8
0.18.9 - https://github.com/eza-community/eza/releases/tag/v0.18.9

Signed-off-by: Jonas Jelonek <redacted>

strongswan: drop unneeded sleep patch

Signed-off-by: Philip Prindeville <redacted>

strongswan: backport upstream MUSL fix for farp_spoofer.c

Signed-off-by: Philip Prindeville <redacted>

strongswan: backport upstream MUSL fix for pf_handler.c

Signed-off-by: Philip Prindeville <redacted>

strongswan: simplify MUSL patch

Signed-off-by: Philip Prindeville <redacted>

strongswan: Update to 5.9.14

Signed-off-by: Philip Prindeville <redacted>

uspot: update to Git HEAD (2024-03-25)

56eebdad085e uspot: wrap spotfilter device under tip_mode
1a96d57e5fe0 uspot: client_enable() wrap spotfilter data in tip_mode
fe12f9a7abde uspot: clear ratelimit state on startup/shutdown
976badc4d0b6 update README
53b8cb88a94a Makefile: require minimum ucode version
ff6163190d5a uspot/portal: report client_enable() failure
8601d9199233 include sample radcli dictionaries
c670f6c4b48f update README
094f0df88150 uspot: work around ucode#191 missing in 23.05

Update the package Makefile to reflect the changes from the following
above-listed commit:

53b8cb88a94a Makefile: require minimum ucode version

Fixes: https://github.com/f00b4r0/uspot/issues/4
Signed-off-by: Thibaut VARÈNE <redacted>

nginx: update to 1.25.4

Signed-off-by: Jan Klos <redacted>

rust: update to 1.77.0

- Restore patch hunk mis-deleted in dccb910
- Refresh patches
- Remove --enable-missing-tools configure option deleted in the upstream

Signed-off-by: krant <redacted>

p910nd: fix running multiple instances

Compile tested: (ramips, rb760igs, 23.05 snapshot)
Run tested: (ramips, rb760igs, 23.05 snapshot, tests done)

Description:
In case we have multiple device defined in /etc/config/p910nd then init script will try to start multiple instance with same instance name
drop instance name as resolution

tested on 23.05 snapshot with 2 USB printers

Signed-off-by: Peca Nesovanovic <redacted>

clixon: Update to 7.0.0

Signed-off-by: Philip Prindeville <redacted>

sing-box: update to 1.8.10

Signed-off-by: brvphoenix <redacted>

sing-box: restart if the specified interfaces start up

Signed-off-by: brvphoenix <redacted>

podman: update to v5.0.0

Major version update to podman

 - Obsolete patch removed
 - patch 010-do-not-build-docs.patch refreshed

Changelog: https://github.com/containers/podman/releases/tag/v5.0.0

Signed-off-by: Oskari Rauta <redacted>

lsd: update to v1.1.1

Changes:
 - hex color parser for themes
 - adds truncate option
 - adds --literal flag
 - adds disable option for permission
 - upgrades many included sub modules/crates
 - Fixes literal flags not regocnized
 - adds and improves icons

Full changelogs:
 - v1.1.0: https://github.com/lsd-rs/lsd/releases/tag/v1.1.0
 - v1.1.1: https://github.com/lsd-rs/lsd/releases/tag/v1.1.1

Signed-off-by: Oskari Rauta <redacted>

cligen: Update to 7.0.0

Signed-off-by: Philip Prindeville <redacted>

perl-cgi: Update to 4.64

Signed-off-by: Philip Prindeville <redacted>

psmisc: update to version 23.7

Release notes:
https://gitlab.com/psmisc/psmisc/-/compare/v23.4...v23.7?from_project_id=334185&straight=false

Signed-off-by: Josef Schlehofer <redacted>

ngtcp2: update to 1.4.0

* update PKG_RELEASE to be apk-compatible
* update PKG_SOURCE/PKG_SOURCE_URL so that it builds
* drop dependency on libopenssl as other SSL libs start to support HTTP/3

Signed-off-by: Stan Grishin <redacted>

nghttp3: update to 1.2.0

* update PKG_RELEASE to be apk-compatible
* update PKG_SOURCE/PKG_SOURCE_URL so that it builds

Signed-off-by: Stan Grishin <redacted>

opus: revert to autotools

Latest update in 6c3db5d has switched build system to Meson,
which is broken on several non-SIMD platforms. Turns out,
Meson support is not yet stable enough in the upstream,
so we revert to autotools and drop meson-related patch.

Signed-off-by: krant <redacted>

irqbalance: update to version 1.9.4

Update irqbalance to version 1.9.4.

* refresh version in meson patch
* remove EINVAL handling patch as upstream seems to have silenced
  the log spam for unmanageable IRQs

Signed-off-by: Hannu Nyman <redacted>

Merge pull request #23681 from jummo/add_ddns_servercow

ddns-scripts: Add servercow.de as DDNS provider

Merge pull request #23716 from stangri/master-https-dns-proxy

https-dns-proxy: prepare migration to APK

Merge pull request #23717 from stangri/master-adblock-fast

adblock-fast: prepare migration to APK

Merge pull request #23715 from stangri/master-nebula

nebula: prepare migration to APK

Merge pull request #23714 from stangri/master-pbr

pbr: prepare migration to APK

https-dns-proxy: prepare migration to APK

Signed-off-by: Stan Grishin <redacted>

nnn: update to version 4.9

- Release notes:
https://github.com/jarun/nnn/compare/v4.4...v4.9

- Refresh patch to fix offset

Signed-off-by: Josef Schlehofer <redacted>

knot-resolver: Update to version 5.7.1

- Fixes CVE-2023-50868 and CVE-2023-50387
- Also, the resolver has not been called 'Knot DNS Resolver' for quite
some time, so fix that, too.

Signed-off-by: Michal Hrusecky <redacted>

knot-resolver: enable dnstap module build by default

'dnstap' module will be built but not loaded by default at runtime
(configuration must be provided for it to be loaded). It is still possible to
disable dnstap build manually using menuconfig.

"The dnstap module supports logging DNS requests and responses to a unix socket
in dnstap format using fstrm framing library. This logging is useful if you need
effectively log all DNS traffic."[^1]

Adds dependency on 'protobuf', 'protobuf-c', 'libfstrm'. Listed packages are
available from OpenWrt packages, have uncomplicated manifests and
while 'protobuf-c' doesn't have a maintainer since spring 2020, all the
packages (including 'protobuf-c') seem to be maintained - the last
updates of all of them in autumn 2021.

As stated by Vladimír Čunát from Knot Resolver team they build dnstap
while packaging for majority of standard Linux distributions.
Therefore this change brings us closer to expected default.

[^1]: https://knot-resolver.readthedocs.io/en/stable/modules-dnstap.html

Signed-off-by: Šimon Bořek <redacted>

knot-resolver: do not overwrite -Ddnstap=enabled configuration

It was possible to enable dnstap in menuconfig, but the configuration
only added dependencies while leaving dnstap module build disabled.

Signed-off-by: Šimon Bořek <redacted>

snort3: Fix compilation with GCC 13

This fixes a compile problem with GCC 13.

Signed-off-by: Hauke Mehrtens <redacted>

gost_engine: Update to version 3.0.3

This version contains minor bugfixes.
It fixes a compile problem with GCC 13.

Changes: https://github.com/gost-engine/engine/compare/v3.0.1...v3.0.3

Signed-off-by: Hauke Mehrtens <redacted>

imagemagick: update to 7.1.1.29

- Don't ignore version suffix (upstream 7.1.1-29 becomes 7.1.1.29)
- Avoid superfluous libstdcpp dependency

Signed-off-by: krant <redacted>

giflib: update to 5.2.2

Drop upstreamed CVE patches.

Signed-off-by: krant <redacted>

openvpn: update to 2.6.10

This is a bugfix release containing several security fixes specific to the Windows platform.

Bug fixes
---------
- Windows: if the win-dco driver is used (default) and the GUI requests
  use of a proxy server, the connection would fail.  Disable DCO in
  this case.

- Compression: minor bugfix in checking option consistency vs. compiled-in
  algorithm support

- systemd unit files: remove obsolete syslog.target

Security fixes
--------------
- CVE-2024-27459: Windows: fix a possible stack overflow in the
  interactive service component which might lead to a local privilege
  escalation.

- CVE-2024-24974: Windows: disallow access to the interactive service
  pipe from remote computers.

- CVE-2024-27903: Windows: disallow loading of plugins from untrusted
  installation paths, which could be used to attack openvpn.exe via
  a malicious plugin.

For details refer to https://github.com/OpenVPN/openvpn/blob/v2.6.10/Changes.rst

Signed-off-by: Ivan Pavlov <redacted>

docker-compose: Update to version 2.26.0

Signed-off-by: Javier Marcet <redacted>

netbird: update to 0.26.3

Signed-off-by: jiangslee <redacted>

tailscale: Update to 1.62.0

https://github.com/tailscale/tailscale/releases/tag/v1.62.0

Signed-off-by: Zephyr Lykos <redacted>

pbr: prepare migration to APK

* remove dependencies/references to opkg
* simplify wan/wan6 discovery

Signed-off-by: Stan Grishin <redacted>

Merge pull request #23684 from stangri/master-pbr

pbr: update to 1.1.4-5

nebula: prepare migration to APK

Signed-off-by: Stan Grishin <redacted>

adblock-fast: prepare migration to APK

Signed-off-by: Stan Grishin <redacted>

opus: update to 1.5.1

- Switch to Meson build system
- Update patch with Meson build fixes

Signed-off-by: krant <redacted>

tgt: update to 1.0.91

Signed-off-by: Maxim Storchak <redacted>

libstrophe: update to 0.13.1

Signed-off-by: krant <redacted>

minisatip: update to 1.3.4

- Configure option 'dvbaes' renamed to 'dvbca'

Signed-off-by: krant <redacted>

minizip: update to 4.0.5

Signed-off-by: krant <redacted>

squid: update to 6.8

Signed-off-by: krant <redacted>

libdeflate: update to 1.19

  - Use proper tarball URL.

Signed-off-by: krant <redacted>

hwdata: update to 0.380

Signed-off-by: krant <redacted>

mpg123: update to 1.32.5

Signed-off-by: krant <redacted>

unrar: update to 7.0.7

Signed-off-by: krant <redacted>

git-lfs: update to 3.5.1

Signed-off-by: krant <redacted>

git: update to 2.44.0

Signed-off-by: krant <redacted>

erlang: update to 26.2.3

Signed-off-by: krant <redacted>

expat: update to 2.6.2

Signed-off-by: krant <redacted>

pulseaudio: update to 17.0

changes:
  remove meson_gio patch, already applied upstream
  move pulseaudio-system.conf following upsteam change in e96d278bfc5:
    "daemon/meson.build: Install dbus policy in /usr, not /etc"

Signed-off-by: Russell Senior <redacted>

Merge pull request #23693 from TDT-AG/pr/20240319-rrdtool1

rrdtool1: add license information

rrdtool1: change download URL to https

Signed-off-by: Florian Eckert <redacted>

rrdtool1: add license information

See the license information on the rrdtool homepage.
https://oss.oetiker.ch/rrdtool/license.en.html

Signed-off-by: Florian Eckert <redacted>

dnsproxy: Update to 0.66.0

Signed-off-by: Tianling Shen <redacted>

cloudflared: Update to 2024.3.0

Signed-off-by: Tianling Shen <redacted>

v2ray-geodata: Update to latest version

Signed-off-by: Tianling Shen <redacted>

v2ray-core: Update to 5.15.1

Signed-off-by: Tianling Shen <redacted>

xray-core: Update to 1.8.9

Signed-off-by: Tianling Shen <redacted>

microsocks: update to 1.0.4

Signed-off-by: Ozan Göktan <redacted>

Merge pull request #23695 from mhei/php8-update-to-8.3.4

php8: update to 8.3.4

dnsdist: update to 1.9.1 and add maintainer

Signed-off-by: Peter van Dijk <redacted>

pdns: update to 4.9.0 and add maintainer

Signed-off-by: Peter van Dijk <redacted>

telldus-mqtt: bump to 0.3

Signed-off-by: Peter Liedholm <redacted>

lualanes: update to version 3.16.3 and use tarball

1. Update it to version 3.16.3
Release notes: https://github.com/LuaLanes/lanes/releases/tag/v3.16.3

2. Change to download tarball instead of checking out Git sources
In the previous commit (in the Fixes tag), it was changed to Git sources without any reason. Let's revert it back. Let's use again tagged release.

Fixes: b93e5b45b1daac827d429b51d8763226268f2b9a ("lualanes: Version bump to v3.16.2")
Signed-off-by: Josef Schlehofer <redacted>

xz: update to 5.6.1

- Change source URL to the up-to-date one

Signed-off-by: krant <redacted>

Merge pull request #23475 from mcha-forks/go-1.22

golang: update to 1.22.1

pbr: update to 1.1.4-5

This update includes the following changes:
1. Makefile
  * update copyright
  * attempt to implement the proper variants to avoid luci-app dependency on both variants
  * quietly stop service on uninstall

2. Config-file
  * add the list of dnsmasq instances to target in supported dnsmasq modes
  * for default pbr variant, set the `resolver_set` to `dnsmasq.nftset`
  * for iptables pbr variant, set the `resolver_set` to `dnsmasq.ipset`
  * add the `nft_file_support` (disabled by default)
  * introduce `procd_boot_delay` to delay service start on boot
  * introduce the following nft set creation options:
    * nft_set_auto_merge
    * nft_set_counter
    * nft_set_flags_interval
    * nft_set_flags_timeout
    * nft_set_gc_interval
    * nft_set_policy
    * nft_set_timeout
  * add the pbr.user.wg_server_and_client custom user script to allow running wg server and
    client at the same time
  * add the "Ignore Local Requests" sample policy

3. Hotplug firewall/interface scripts
  * better logged messages

4. The pbr and pbr-iptables uci defaults script
  * use functions from the init script
  * improve vpn-policy-routing migration

5. The pbr-netifd uci defaults script
  * use functions from the init script
  * improve uci operations

6. Introduce the firewall.include file

7. Improve pbr.user.aws custom user script

8. Improve pbr.user.netflix custom user script

9. Introduce pbr.user.wg_server_and_client custom user script

10. Update the init file:
  * refactor some code to allow the init script file to be sourced by the uci defaults scripts
    and the luci rpcd script for shared functions
  * add support for `nft_file_mode` in which service prepares the fw4-compatible atomic nft/include
    file for faster operations on service reload
  * improve Tor support (nft mode only)
  * implement support for nft set options
  * update validation functions for new options/parameters

Signed-off-by: Stan Grishin <redacted>

nginx: Fix compilation with LTO

When CONFIG_USE_LTO=y, the int-size detection script will fail because a
variable gets optimised out. Mark it as volatile to fix the issue.

Signed-off-by: Andreas Gnau <redacted>

net/acme-common: Fix example config

Make sure we quote all strings, and add missing "option" in second example.

Signed-off-by: Toke Høiland-Jørgensen <redacted>

golang: Update to 1.22.1

Go 1.22.1 contains the following security fixes:

- CVE-2024-24783:
  crypto/x509: Verify panics on certificates with an unknown public key
  algorithm
- CVE-2023-45290
  net/http: memory exhaustion in Request.ParseMultipartForm
- CVE-2023-45289
  net/http, net/http/cookiejar: incorrect forwarding of sensitive headers
  and cookies on HTTP redirect
- CVE-2024-24785
  html/template: errors returned from MarshalJSON methods may break
  template escaping
- CVE-2024-24784
  net/mail: comments in display names are incorrectly handled

https://go.dev/doc/devel/release#go1.22.1
https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg

Signed-off-by: Zephyr Lykos <redacted>

golang: Update to 1.22.0

Added a third bootstrap stage since go1.22 (and onwards) requires
at least go1.20.14 to build.[1]

[1]: https://go.dev/doc/go1.22#bootstrap

Signed-off-by: Zephyr Lykos <redacted>

mmc-utils: update to upstream's e1281d4de916 commit

Included upstream changes:
e1281d4de916 mmc-utils: mmc_cmds: fix type-punned warning on &ext_csd[] casting
b5ca140312d2 mmc-utils: lsmmc: Fix emmc capacity calculation
d1d8a05eeb4b mmc-utils: lsmmc: Disintegrade print_mmc_csd
3b055a2129bf mmc-utils: lsmmc: Simplify interface processing functions
e82719f1d29c mmc-utils: lsmmc: Simplify prinitng manufacturer name

Signed-off-by: Michael Heimpold <redacted>