utils/acpid: fix PKG_CPE_ID

cpe:/a:tedfelix:acpid2 is the correct CPE ID for acpid:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:tedfelix:acpid2

Fixes: 299e5b0a9bce19d6e96cb9ff217028b36ee2dd36 (treewide: add PKG_CPE_ID for better cvescanner coverage)
Signed-off-by: Fabrice Fontaine <redacted>

net/ngircd: fix PKG_CPE_ID

cpe:/a:barton:ngircd is the correct CPE ID for ngircd:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:barton:ngircd

Fixes: 299e5b0a9bce19d6e96cb9ff217028b36ee2dd36 (treewide: add PKG_CPE_ID for better cvescanner coverage)
Signed-off-by: Fabrice Fontaine <redacted>

net/frr: fix PKG_CPE_ID

cpe:/a:frrouting:frrouting is the correct CPE ID for frr:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:frrouting:frrouting

Fixes: 5afe5c9031190844f267357c68efe3c9c3cbe51d (treewide: assign PKG_CPE_ID)
Signed-off-by: Fabrice Fontaine <redacted>

net/dhcpcd: fix PKG_CPE_ID

cpe:/a:dhcpcd_project:dhcpcd is the correct CPE ID for dhcpcd:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:dhcpcd_project:dhcpcd

Fixes: 299e5b0a9bce19d6e96cb9ff217028b36ee2dd36 (treewide: add PKG_CPE_ID for better cvescanner coverage)
Signed-off-by: Fabrice Fontaine <redacted>

libs/libexif: fix PKG_CPE_ID

cpe:/a:libexif_project:libexif is the correct CPE ID for libexif:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:libexif_project:libexif

Fixes: 299e5b0a9bce19d6e96cb9ff217028b36ee2dd36 (treewide: add PKG_CPE_ID for better cvescanner coverage)
Signed-off-by: Fabrice Fontaine <redacted>

utils/minicom: fix PKG_CPE_ID

cpe:/a:minicom_project:minicom is the correct CPE ID for minicom:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:minicom_project:minicom

Fixes: 299e5b0a9bce19d6e96cb9ff217028b36ee2dd36 (treewide: add PKG_CPE_ID for better cvescanner coverage)
Signed-off-by: Fabrice Fontaine <redacted>

libs/iniparser: fix PKG_CPE_ID

cpe:/a:ndevilla:iniparser is not a correct CPE ID for iniparser:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:ndevilla:iniparser

Fixes: 456d8ff5d58edd84ab361cc8c289d1d6c7507acc (iniparser: library for parsing of ini files in C)
Signed-off-by: Fabrice Fontaine <redacted>

net/rsync: fix PKG_CPE_ID

cpe:/a:samba:rsync is the correct CPE ID for rsync:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:samba:rsync

Fixes: 299e5b0a9bce19d6e96cb9ff217028b36ee2dd36 (treewide: add PKG_CPE_ID for better cvescanner coverage)
Signed-off-by: Fabrice Fontaine <redacted>

net/memcached: fix PKG_CPE_ID

cpe:/a:memcached:memcached is the correct CPE ID for memcached:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:memcached:memcached

Fixes: 299e5b0a9bce19d6e96cb9ff217028b36ee2dd36 (treewide: add PKG_CPE_ID for better cvescanner coverage)
Signed-off-by: Fabrice Fontaine <redacted>

lang/rust: assign PKG_CPE_ID

cpe:/a:rust-lang:rust is the correct CPE ID for rust:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:rust-lang:rust

Signed-off-by: Fabrice Fontaine <redacted>

python-mako: bump to 1.3.5

Changelog since 1.3.0:
- Fix escaped percent signs (%%) not rendering correctly when not at
  line beginnings (1.3.1/1.3.2)
- Add 'pass' statements to empty control blocks to prevent errors (1.3.3)
- Fix strict_undefined mode conflicts with comprehensions inside
  function definitions (1.3.3)
- Revert dictionary literal parsing changes that caused bracketed
  expression regressions (1.3.5)

Full changelog:
https://docs.makotemplates.org/en/latest/changelog.html

Signed-off-by: Alexandru Ardelean <redacted>

openvpn: change tmp-dir to /tmp

This allows openvpn to create any temp files after
user or group change at exec time.

Signed-off-by: Paul Donald <redacted>

openvpn: change file/path types

move file and path type values to FILE type params
so they are better handled with quoting, in case
paths contain spaces.

Remove duplicate 'extra_certs'.

Signed-off-by: Paul Donald <redacted>

openvpn: proto handler; write params to config file

writing the command line to a config file avoids
formatting pitfalls for the command line.

Signed-off-by: Paul Donald <redacted>

openvpn: proto handler; trim white-space from append

'append' inserts white-space by default (3rd parameter)

Signed-off-by: Paul Donald <redacted>

openvpn: shell proto script improvements

add mode server hook scripts hotplug handling

Signed-off-by: Paul Donald <redacted>

openvpn: ucode hotplug script improvements

add mode server hook scripts hotplug handling

Signed-off-by: Paul Donald <redacted>

openvpn: hotplug script improvements

add mode server hook scripts hotplug handling

Signed-off-by: Paul Donald <redacted>

openvpn: ucode proto script improvements

fix the pop() bug
write options to a config file in case argv length > 63

netifd has a hard limit of 64 argv entries for its ucode
proto.run_command whereby '--param' is one, and its
'option string' is two.

follow-up to affa96dc816653475bebef94d21443434cb1532c

Signed-off-by: Paul Donald <redacted>

openvpn: sync with proto shell-script

add hotplug script handlers to ucode version

follow-up to 647b67e18b6bf857e60e4e2e1874fd04d4138586

Signed-off-by: Paul Donald <redacted>

openvpn: proto handler; handle user config file

Handle a user provided config file.

Signed-off-by: Paul Donald <redacted>

openvpn: shellcheck fixes

correct spacing for [] if blocks and var quoting.
use json_get_vars to get user-defined scripts so the
setenv parameters are appended to the command line.

handle ovpnproto as a PROTO_STRING so it is monitored
and loaded.

follow-up to 337a449c03c597b49f2e18a7fd241d8945288e80
and 647b67e18b6bf857e60e4e2e1874fd04d4138586

Signed-off-by: Paul Donald <redacted>

openvpn: handling for 'push' and other array options

remove duplicate 'push' entry from string types.
push and other array values shall be "double quoted".
we also must 'eval' so that the double-quoted array values
don't get split on spaces.
Also quote file paths in case they contain spaces.

Signed-off-by: Paul Donald <redacted>

net/cloudreve: assign PKG_CPE_ID

cpe:/a:cloudreve:cloudreve is the correct CPE ID for cloudreve:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:cloudreve:cloudreve

Signed-off-by: Fabrice Fontaine <redacted>

adguardhome: validate config

Validate UCI config.

Switch instance name to adguardhome.

Link: https://github.com/openwrt/packages/pull/28781
Signed-off-by: George Sapkin <redacted>

admin/iotop: drop PKG_CPE_ID

cpe:/a:iotop:iotop is not a correct CPE ID for iotop:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:iotop:iotop

Fixes: aca8d8d088d41baa724d635d5965af4ea62a8f35 (iotop: add new package)
Signed-off-by: Fabrice Fontaine <redacted>

net/nfs-kernel-server: fix PKG_CPE_ID

cpe:/a:linux-nfs:nfs-utils is the correct CPE ID for nfs-kernel-server:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:linux-nfs:nfs-utils

Fixes: ee3b06e42cb86756b0fed1dd4e03aee1b358f759 (nfs-kernel-server: provide a NFSv3 and NFSv4 daemon)
Signed-off-by: Fabrice Fontaine <redacted>

libs/libextractor: assign PKG_CPE_ID

cpe:/a:gnu:libextractor is the correct CPE ID for libextractor:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:gnu:libextractor

Signed-off-by: Fabrice Fontaine <redacted>

utils/bubblewrap: assign PKG_CPE_ID

cpe:/a:projectatomic:bubblewrap is the correct CPE ID for bubblewrap:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:projectatomic:bubblewrap

Signed-off-by: Fabrice Fontaine <redacted>

treewide: add Alexandru Ardelean as co-maintainer

Add 'Alexandru Ardelean <redacted>' as co-maintainer
alongside Jan Pavlinec <redacted> for all packages
where Jan Pavlinec is listed as maintainer.

Signed-off-by: Alexandru Ardelean <redacted>

python-chardet: bump to 7.0.1

Full release notes:
https://github.com/chardet/chardet/releases/tag/7.0.1

Add 'python3-codecs' as dependency. No idea when (or if) this was
ever needed, but it became obvious after test.sh was added.

Signed-off-by: Alexandru Ardelean <redacted>

nano: improve uci coloring of unterminated strings

Improve the uci file coloring with nano-full.
Show unterminated strings more clearly (lightmagenta vs. white)

Signed-off-by: Hannu Nyman <redacted>

openconnect: fix token_script error handling/logging

When token_script fails, proto_setup_failed() notifies netifd that
setup has failed, but script execution continues regardless.
This commit adds exit 1 and sleep 5 (consistent with wireguard.sh
error handling) to abort setup on token_script failure. Also fix
typo in logger tag ("openconenct" -> "openconnect").

Signed-off-by: Thomas Winkler <redacted>

openconnect: implement --no-external-auth

The option prevents OpenConnect from advertising
to the server that it supports any kind of
authentication mode that requires an external
browser. Some servers will force the client to use such
an authentication mode if the client advertises it, but
fallback to a more "scriptable" authentication mode if
the client doesn’t appear to support it.

Signed-off-by: Thomas Winkler <redacted>

pulseaudio: lower START= value in init script

Lower the START value from 99 to 90. This allows other applications that
use pulseaudio to start after it with the pulse client socket being available.

Signed-off-by: Daniel Danzberger <redacted>

python-pytz: bump to 2026.1

Updated timezone data to 2026.1 release.

Full release notes:
https://github.com/stub42/pytz/blob/master/src/CHANGES.rst

pytz 2026.1 requires setuptools as build backend but it was not
declared as a build dependency, causing the build to fail with
'setuptools.build_meta:__legacy__ is not available'.

Signed-off-by: Alexandru Ardelean <redacted>

curl: update to 8.19.0

changelog: https://curl.se/ch/8.19.0.html

Signed-off-by: Ivan Pavlov <redacted>

luajit2: update to v2.1-20260227

For changes, see tagged commit:
https://github.com/openresty/luajit2/releases/tag/v2.1-20260227

Signed-off-by: Javier Marcet <redacted>

vscode: update editor settings and commit constraints

Enable trailing whitespace trimming, insert final newline, and force LF.
Configure git input validation to warn if subject exceeds 60 characters
or if body lines exceed 75 characters.

Signed-off-by: Josef Schlehofer <redacted>

treewide: remove myself as maintainer

slide-switch is my software, I choose to continue to be sole maintainer.
(This was also the case in #28429.)

Signed-off-by: Jeffery To <redacted>

python-pyodbc: update to 5.3.0

Fixes compilation with newer Python/

Signed-off-by: Rosen Penev <redacted>

treewide: add me as co-maintainer to Jeffery's packages

Add 'Alexandru Ardelean <redacted>' as co-maintainer
alongside Jeffery To <redacted> for all packages where
Jeffery To is listed as maintainer.

Supersedes PR: https://github.com/openwrt/packages/pull/28429

We can have another PR where Jeffery removes himself later.

Signed-off-by: Alexandru Ardelean <redacted>

openblas: bump to 0.3.31

Dropped patch: 0001-Make-GEMM3M-parameters-available-on-32bit-X86-GENERI.patch
Part of upstream: https://github.com/OpenMathLib/OpenBLAS/pull/5418

Changelog:
- Revert a 0.3.30 optimization that could cause race conditions
  and invalid results in GEMM
- Fix thread lockup with Python 3.9 and NumPy
- Fix deadlock in multithreaded code after fork()
- Add bfloat16 extensions (BGEMM, BGEMV) and basic FP16 infrastructure
- Add batch GEMM operations with strided variants
- Add multithreaded LAPACK SLAED3/DLAED3 for improved eigensolvers
- Add Apple M4 and Intel Lunar Lake support
- Add initial POWER11 architecture support
- Improve GEMM performance on A64FX and ARM processors

Full release notes:
https://github.com/OpenMathLib/OpenBLAS/releases/tag/v0.3.31

Signed-off-by: Alexandru Ardelean <redacted>

numpy: bump to 2.4.2

Changelog:
- Fix memory leaks
- Fix validation of contraction axes in tensordot
- Fix free-threaded PyObject layout bugs
- Fix thread safety in array_getbuffer
- Fix quantile promotion logic
- Fix compatibility with latest Cython version
- Update OpenBLAS to fix hanging issues

Full release notes:
https://github.com/numpy/numpy/releases/tag/v2.4.2

Signed-off-by: Alexandru Ardelean <redacted>

bsbf-openwrt-resources: add BSBF URL to packages

Add the BondingShouldBeFree URL to the bsbf-openwrt-resources packages.

Signed-off-by: Chester A. Unal <redacted>

bsbf-resources: add BSBF URL to packages

Add the BondingShouldBeFree URL to the bsbf-resources packages.

Signed-off-by: Chester A. Unal <redacted>

bsbf-plpmtu: add

Update bsbf-resources to the GIT HEAD of 2026-03-12. Add bsbf-plpmtu and
make bsbf-bonding depend on bsbf-plpmtu.

Signed-off-by: Chester A. Unal <redacted>

plp-mtu-discovery: add

Perform Path MTU Discovery without relying on ICMP errors, which are often
not delivered.

Signed-off-by: Chester A. Unal <redacted>

sqlite3: bump to 3.52.0

Changes: https://sqlite.org/releaselog/3_52_0.html
Signed-off-by: George Sapkin <redacted>

adblock: update 4.5.2‑4

* optimized the awk for the Top10 statistics in the DNS Report,
  removed the faulty caching (reported in the forum)
* minor improvement in the f_switch function
* readme update

Signed-off-by: Dirk Brenken <redacted>

adguardhome: add config reload trigger

Restart the service when config is changed from the app.

Signed-off-by: George Sapkin <redacted>

python-evdev: bump version to 1.9.3

Fix several memory leaks in input.c

Signed-off-by: Ivan Belokobylskiy <redacted>

python-evdev: add mandatory uinput.h header to builder

Starting from 1.9.2 python-evdev requires
include/uapi/linux/uinput.h headers for proper building.
Otherwise, it compiles but cannot be imported causing
KeyError: 'UI_FF'

Add uinput.h to LINUX_EVDEV_HEADERS

Signed-off-by: Ivan Belokobylskiy <redacted>

squashfs-tools: bump to 4.7.5

Changes since 4.7.2:
- Fix potential corruption in Squashfs filesystems containing sparse files
- Fix pseudo file creation failures with large blocks of contiguous zeros
- Fix duplicate file detection for files exceeding available buffer space
- Add -numeric-owner option to mksquashfs/sqfstar
- Fix segfault when using pseudo file root definitions with only Xattr metadata
- Fix conflict between -offset and -stream options
- Fix directory modification timestamp issues in pseudo file hierarchy
- Fix -max-depth incorrectly marking empty directories as excluded

Full release notes:
https://github.com/plougher/squashfs-tools/releases/tag/4.7.5

Signed-off-by: Alexandru Ardelean <redacted>

adguardhome: bump to 0.107.73

Changes: https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.73
Signed-off-by: George Sapkin <redacted>

snort3: update to v3.11.1.0

Changelog: https://github.com/snort3/snort3/releases/tag/3.11.1.0

Signed-off-by: John Audia <redacted>

libdaq3: update to 3.0.25

Release notes: https://github.com/snort3/libdaq/releases/tag/v3.0.25

Signed-off-by: John Audia <redacted>

python-psycopg2: update to 2.9.11

Newer Python compatibility.

Signed-off-by: Rosen Penev <redacted>

rust: Update to 1.94.0

Changelog:
- https://github.com/rust-lang/rust/releases/tag/1.91.1
- https://github.com/rust-lang/rust/releases/tag/1.92.0
- https://github.com/rust-lang/rust/releases/tag/1.93.0
- https://github.com/rust-lang/rust/releases/tag/1.93.1
- https://github.com/rust-lang/rust/releases/tag/1.94.0

Signed-off-by: Tianling Shen <redacted>

nfs-kernel-server: update to 2.8.6

Changelog: https://www.kernel.org/pub/linux/utils/nfs-utils/2.8.6/2.8.6-Changelog

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc

Signed-off-by: John Audia <redacted>

mwan3: bump PKG_VERSION to 2.12.1

Signed-off-by: Harin Lee <redacted>

mwan3: fix typos in warning messages

Signed-off-by: Harin Lee <redacted>

mwan3: fix IPv6 support for httping command

This passes the '-6' option to httping if the address family is IPv6.

Signed-off-by: Harin Lee <redacted>

mwan3: warn about unsupported IPv6 in arping track method

ARP and arping do not support IPv6.

Signed-off-by: Harin Lee <redacted>

openvpn: increment PKG_RELEASE by one

Increment PKG_RELEASE by one.

Signed-off-by: Florian Eckert <redacted>

openvpn: add hotplug handling back in

This commit adds hotplug handling back in.

Fixes: 2607b761 ("openvpn: introduce proto handler")
Signed-off-by: Florian Eckert <redacted>

openvpn: use append for the remaining options

There is already the 'append' command, which assembles all parameters that
are called 'proto_run_command'. Let´s move also the last params to the
top. To ensure that the sequence is correct, the parameters must be added
at the beginning, so that user parameters can overwrite them.

Signed-off-by: Florian Eckert <redacted>

openvpn: use also append for dev_type and ovpnproto options

There is already the 'append' command, which assembles all parameters that
are called 'proto_run_command'. Let´s use that. To ensure that the
sequence is correct, the parameters must be added at the beginning, so that
user parameters can overwrite them.

Signed-off-by: Florian Eckert <redacted>

openvpn: use common pattern for global variable

The common pattern for global variable is, to write the variable name in
capital letters. This improves maintainability in shell scripts.

Signed-off-by: Florian Eckert <redacted>

openvpn: fix auth_user_pass option

The variable 'auth_file' is not used in the following programm sequence.
It therefore only makes sense to add it as a call parameter via 'append'
when calling the the 'proto_run_commmand'.

Signed-off-by: Florian Eckert <redacted>

openvpn: rename openvpn proto option to ovpnproto option

This was forgotten during renameing of this option.

Fixes: e026ce0f ("openvpn: handle ovpnproto exclusively")
Signed-off-by: Florian Eckert <redacted>

openvpn: remove net needed blank lines

There is always only one blank line between the sections.

Signed-off-by: Florian Eckert <redacted>

django: bump to version 6.0.3

Fix CVE-2026-25674.

Full release notes:
https://docs.djangoproject.com/en/6.0/releases/6.0.3/

Signed-off-by: Wei-Ting Yang <redacted>

django: clean up Makefile

- Add AUTHORS into PKG_LICENSE_FILES.
- Drop no longer required python3-pytz dependency.
- Remove obsolete CONFLICTS field.

Signed-off-by: Wei-Ting Yang <redacted>

usbutils: use ALTERNATIVES

Use the ALTERNATIVES symlink handling to avoid conflicts with busybox
lsusb tool. Otherwise this package can not be installed if you also have
enabled lsusb from busybox.

Signed-off-by: Martin Schiller <redacted>

pciutils: use ALTERNATIVES

Use the ALTERNATIVES symlink handling to avoid conflicts with busybox
lspci tool. Otherwise this package can not be installed if you also have
enabled lspci from busybox.

Signed-off-by: Martin Schiller <redacted>

net-snmp: bump PKG_RELEASE

Bump PKG_RELEASE to reflect fixes to UCI init script config
generation for missing/unset options and RestrictOID handling.

Signed-off-by: Eric McDonald <redacted>

net-snmp: fix newline when RestrictOID is neither yes nor no

snmpd_access_default_add, snmpd_access_HostName_add, and
snmpd_access_HostIP_add check if RestrictOID is `yes` or `no`
but fail to write a newline for other values of RestrictOID
(e.g., `true`, `false`) or if unset, corrupting the generated config.

Fix by using config_get_bool and restructuring to write either
a complete line or nothing. Also require RestrictedOID to be
non-empty when RestrictOID is enabled.

This is a breaking change for configs where RestrictOID is set
to a value that the old code did not match as `yes` (e.g., `true`,
`1`, `on`, `enabled`) but config_get_bool evaluates as true. In
practice, this is unlikely to affect existing installs unless a
user is unknowingly relying on unintended behavior or is deliberately
relying on the old code's non-standard boolean evaluation; this
latter case is considered unlikely by this commit's author. Configs
where RestrictOID is enabled but RestrictedOID is empty are also
affected; previously a directive with a trailing space was written,
now no directive is written.

Signed-off-by: Eric McDonald <redacted>

net-snmp: add early return when IPMask is unset

snmpd_access_HostIP_add would write unintended output to the
config file if the IPMask option is not specified. Add an early
return to prevent writing in that case.

This is a breaking change for configs where IPMask is unset.
Previously, an empty IPMask option would result in a malformed
directive containing a trailing slash with no guaranteed newline,
the exact form of which depended on the values of other options.
Now, no directive is written.

Signed-off-by: Eric McDonald <redacted>

net-snmp: add early return when HostIP is unset

snmpd_access_HostIP_add would write unintended output to the
config file if the HostIP option is not specified. Add an early
return to prevent writing in that case.

This is a breaking change for configs where HostIP is unset.
Previously, an empty HostIP option would result in a malformed
directive containing a bare /mask with no guaranteed newline, the
exact form of which depended on the values of other options.
Now, no directive is written.

Signed-off-by: Eric McDonald <redacted>

net-snmp: add early return when HostName is unset

snmpd_access_HostName_add would write unintended output to the
config file if the HostName option is not specified. Add an early
return to prevent writing in that case.

This is a breaking change for configs where HostName is unset.
Previously, an empty HostName option would result in a malformed
directive with a trailing space and no guaranteed newline, the
exact form of which depended on the values of other options.
Now, no directive is written.

Signed-off-by: Eric McDonald <redacted>

net-snmp: add early return when CommunityName is unset

snmpd_access_default_add, snmpd_access_HostName_add, and
snmpd_access_HostIP_add would write unintended output to the
config file if the CommunityName option is not specified. Add an
early return to each function to prevent writing in that case.

This is a breaking change for configs where CommunityName is
unset. Previously, an empty CommunityName option would result in
a malformed directive with a double space and no guaranteed
newline, the exact form of which depended on the values of other
options. Now, no directive is written.

Signed-off-by: Eric McDonald <redacted>

net-snmp: add early return when Mode is unset

snmpd_access_default_add, snmpd_access_HostName_add, and
snmpd_access_HostIP_add would write unintended output to the
config file if the Mode option is not specified. Add an early
return to each function to prevent writing in that case.

This is a breaking change for configs where Mode is unset.
Previously, an empty Mode option would result in a malformed
directive with a leading space and no guaranteed newline, the
exact form of which depended on the values of other options.
Now, no directive is written.

Signed-off-by: Eric McDonald <redacted>

telegraf: update to 1.38.0
- Update Telegraf to v1.38.0

Signed-off-by: Niklas Thorild <redacted>

adguardhome: add jail_mount_rw config option

Add jail_mount_rw config option to add directories with read-write
access.

Fixes: https://forum.openwrt.org/t/247253
Signed-off-by: Afiq Nazrie <redacted>

bsbf-resources: update to GIT HEAD of 2026-03-09

Update bsbf-resources to the GIT HEAD of 2026-03-09.

Signed-off-by: Chester A. Unal <redacted>

zoneinfo: updated to 2026a release

Updated package version and file hashes.

Signed-off-by: Vladimir Ulrich <redacted>

lcd4linux: prevent concurrent layout switches

Add patch to prevent concurrent layout switches.

Signed-off-by: Oliver Sedlbauer <redacted>

netbird: update to 0.66.2, patch for Go 1.26 build

Changelog: https://github.com/netbirdio/netbird/releases/tag/v0.66.2

NetBird `v0.66.x` adds support for exposing a local HTTP service
from the CLI with the `netbird expose`[1] command, but only for
self-hosted deployments. Cloud support is coming.

[1]: https://docs.netbird.io/manage/reverse-proxy/expose-from-cli

---

`0.65.x` highlights

Changelog: https://github.com/netbirdio/netbird/releases/tag/v0.65.3

NetBird `v0.65.x` now includes a built-in reverse proxy[1], but only for
self-hosted deployments and is currently in beta. Cloud support is
coming soon.

Important: pre-shared keys or Rosenpass are currently incompatible with
the reverse proxy feature.

[1]: https://docs.netbird.io/manage/reverse-proxy

---

`v0.63.x` highlights

Changelog: https://github.com/netbirdio/netbird/releases/tag/v0.63.0

NetBird now supports private DNS zones[1].

[1]: https://docs.netbird.io/manage/dns/custom-zones

---

`v0.62.x` highlights

Changelog: https://github.com/netbirdio/netbird/releases/tag/v0.62.3

Upstream minimum Go requirement raised from `v1.24.x` to `v1.25.x`,
see the go.mod[1].

[1]: https://github.com/netbirdio/netbird/blob/v0.62.3/go.mod#L3-L5

---

Building `netbird` with Go 1.26.x fails with errors:

```
[...]
/builder/dl/go-mod-cache/gvisor.dev/gvisor@v0.0.0-20251031020517-ecfcdd2f171c/pkg/sync/runtime_constants_go126.go:22:2: WaitReasonSelect redeclared in this block
/builder/dl/go-mod-cache/gvisor.dev/gvisor@v0.0.0-20251031020517-ecfcdd2f171c/pkg/sync/runtime_constants_go125.go:22:2: other declaration of WaitReasonSelect
/builder/dl/go-mod-cache/gvisor.dev/gvisor@v0.0.0-20251031020517-ecfcdd2f171c/pkg/sync/runtime_constants_go126.go:23:2: WaitReasonChanReceive redeclared in this block
/builder/dl/go-mod-cache/gvisor.dev/gvisor@v0.0.0-20251031020517-ecfcdd2f171c/pkg/sync/runtime_constants_go125.go:23:2: other declaration of WaitReasonChanReceive
/builder/dl/go-mod-cache/gvisor.dev/gvisor@v0.0.0-20251031020517-ecfcdd2f171c/pkg/sync/runtime_constants_go126.go:24:2: WaitReasonSemacquire redeclared in this block
/builder/dl/go-mod-cache/gvisor.dev/gvisor@v0.0.0-20251031020517-ecfcdd2f171c/pkg/sync/runtime_constants_go125.go:24:2: other declaration of WaitReasonSemacquire
[...]
```

Upstream Issue: https://github.com/netbirdio/netbird/issues/5290
Upstream PR: https://github.com/netbirdio/netbird/pull/5447

Signed-off-by: Wesley Gimenes <redacted>

netbird: update to 0.61.2 (breaking change)

Changelog: https://github.com/netbirdio/netbird/releases/tag/v0.61.2

The second release of `netbird` that introduces a breaking change[1].
A backport will be provided for OpenWrt 25.12 but not for OpenWrt 24.10,
since OpenWrt 25.12 has not been released yet.

NetBird adds **fine-grained SSH access control**[2].

Self-hosters must update both the `management` and `dashboard`[3].

[1]: https://forum.netbird.io/t/upcoming-breaking-changes-to-netbird-ssh/401
[2]: https://docs.netbird.io/manage/peers/ssh#fine-grained-access-control
[3]: https://docs.netbird.io/manage/peers/ssh#v0-61-0

Signed-off-by: Wesley Gimenes <redacted>

netbird: move state file to reduce storage wear

Add `NB_DNS_STATE_FILE="/var/lib/netbird/state.json"` to the init
environment. This moves the state from the directory
`/root/.config/netbird` to the file `/var/lib/netbird/state.json` to
avoid storage wear. Note: the file is not preserved across reboots.

The state file contains information such as locally disabled routes and
other data primarily useful for desktop clients. In OpenWrt setups,
these changes are normally handled by the NetBird `management` server.
This matches the behavior prior to `netbird` v0.52.x, I have not
received any reports that this file caused problems before, so it is
unlikely to cause issues now.

The previous state file `/root/.config/netbird/state.json` can be removed.

Signed-off-by: Wesley Gimenes <redacted>

adblock: update 4.5.2‑3

* the suspend/resume function now uses the external
   DNS bridge when this function is used
* refine the f_nftadd function
* more file debug logging
* LuCI: add unfiltered DNS-Server to the DNS bridge selection
* LuCI: minor fixes

Signed-off-by: Dirk Brenken <redacted>

pbr: update to 1.2.2-r10

* add support for OpenVPN netifd detection (thanks @egc112)
* add support for disable LAN->WAN forwarding when `strict_enforcement` is
  set on start and restart (thanks @egc112)
* fix: always create marking chains for interfaces
* fix: insert DSCP/ICMP-related nft rules after marking chains
* fix: shellcheck-related improvements

Signed-off-by: Stan Grishin <redacted>

adblock-fast: update to 1.2.2-r10

* bugfix: always print errors/warnings on non-quiet start
* bugfix: return proper enabled status in RPCD
* bugfix: return stupped status in RPCD when procd data is empty
* bugfix: correctly process verbosity=0
* delete LICENSE file and only keep it upstream

Signed-off-by: Stan Grishin <redacted>

bsbf-autoconf-dhcp: switch to wan_$DEVICENAME naming scheme

Use wan_$DEVICENAME naming scheme instead of using consecutive numbering
for the network name.

This makes it easier to match the network interface to the corresponding
network.

Signed-off-by: Chester A. Unal <redacted>

bsbf-autoconf-cellular: set device option for network

Set the device option for the network. This is solely for the ease of
matching the network to the corresponding network interface.

Signed-off-by: Chester A. Unal <redacted>

golang: bump 1.26 to 1.26.1

Fixes: CVE-2026-25679
Fixes: CVE-2026-27137
Fixes: CVE-2026-27138
Fixes: CVE-2026-27139
Fixes: CVE-2026-27142
Changes: https://github.com/golang/go/issues?q=milestone%3AGo1.26.1+label%3ACherryPickApproved
Signed-off-by: George Sapkin <redacted>

golang: remove broken mirror

Remove dl.google.com mirror because it's not responding.

Signed-off-by: George Sapkin <redacted>

tailscale: fix fw_mode env by using append_param

The previous commit 09c14817 introduced TS_NO_LOGS_NO_SUPPORT but
used procd_set_param for a subsequent environment variable. This
overwrote the previous env setting, causing fw_mode to be missed.

Switch to procd_append_param to ensure all environment variables are
properly passed to the process.

Signed-off-by: Tung-Yi Chen <redacted>

bridge-utils: remove package

bridge-utils is obsolete software because ip command has
bridge functionality. And OpenWrt uses BusyBox's brctl
by default, so most users will not be affected by this change.

Signed-off-by: Yanase Yuki <redacted>