bluez: update to 5.86

Refreshed patches.

Signed-off-by: Rosen Penev <redacted>

sqm-scripts: bump to v1.7.0

- Add nat to the default [IN|E]GRESS_CAKE_OPTS in defaults.sh
- Add support for cake_mq

Signed-off-by: Rany Hany <redacted>

zabbix: fix unnecessary virtual provides

We aren't using packages with the same name as the provides, so don't
use an virtual (@) provides for providing zabbix-get

Signed-off-by: Daniel F. Dickinson <redacted>

zabbix: set PKGARCH all for non-binary packages

For non-compiled package that are architecture independant, set
PKGARCH:=all.

Signed-off-by: Daniel F. Dickinson <redacted>

rtpmidid: update to 26.01

See release notes at
https://github.com/davidmoreno/rtpmidid/releases/tag/v26.01

Signed-off-by: Daniel Golle <redacted>

isc-dhcp: don't die when a network restart happens

Our triggering code was using the logical network name and
not the ifname as required.

Signed-off-by: Philip Prindeville <redacted>

golang: replace 1.25 with to 1.26.0

Replace golang1.25 with golang1.26 with version 1.26.0.

Update OS/arch combinations.

Bump bootstrap to 1.24.13.

Link: https://go.dev/doc/go1.26
Link: https://github.com/openwrt/packages/pull/28552
Signed-off-by: George Sapkin <redacted>

modemmanager: fix netifd proto sim path

Use specific SIM path instead of 'any' when unlocking with PIN
code. This fixes PIN unlock issues on devices with multiple modems
where 'any' could select the wrong modem.

Bump modemmanager PKG_RELEASE

Signed-off-by: micpf <redacted>

ddns-script: update namesilo.com

switch xml parser to xmllint because xmlstarlet is not available

Signed-off-by: Lin Fan <redacted>

lf: update to r41

https://github.com/gokcehan/lf/releases/tag/r41

Signed-off-by: Nate Robinson <redacted>

conserver: update to version 8.3.0

version 8.3.0 (February 2, 2026):
        - Don't use `true` variable (Stanisław Pitucha <redacted>)
        - Add VPATH to Makefile.in (saproj <redacted>)
        - FileUnopen: always return a valid file descriptor (Jeff Moyer <redacted>)
        - fix SEGFAULT on early exit with IPv6 enabled (Bjørn Mork <redacted>)
        - In AddrsMatch, keep copies of addrinfos to free. (Darren Tucker <redacted>)
        - Increase buffer size for GSSAPI exchanges (Alexander Bokovoy <redacted>)
        - Show "(inactive)" rather than an invalid pty device name for ondemand consoles that
          are closed. Show "(inactive)" rather than "(null)" for ondemand consoles that have
          never been opened. (Greg Becker <redacted>)
        - Prevent spy-mode clients from being promoted to the attached/writable state. (Greg Becker <redacted>)
        - autoconf upgrade (Jörg Sommer <redacted>)
        - reinitcheck allows time units (Jacek Tomasiak <redacted>)
        - reduce level of string alloc management debug messages (Greg A. Woods <redacted>)
        - fix bug with parser and "#" lines, fix debug output in ParseFile()
        - Fix clobbering of breaklist and replstring (Anton Lundin <redacted>)
        - Use strcmp() rather than strcasecmp() to compare console names when reading the config
          file and creating the list of consoles. (Greg Becker <redacted>)
        - Added passwordfile config option (Jason Ni <redacted>)

Drop upstreamed patches:
  002-addrsmatch-freeaddrinfo.patch
  002-fix-SEGFAULT-on-early-exit-with-IPv6-enabled.patch

Signed-off-by: Bjørn Mork <redacted>

mjpg-streamer: drop package

Based on the discussion in the previous PR, drop the package. Main source
has not been updated in 8 years and the fork in 5.

Link: https://github.com/openwrt/packages/pull/27878
Signed-off-by: George Sapkin <redacted>

kea: make building with Openssl deprecated APIs off

Some of the X.509 API got retired in 3.0.0 so we should check
against the backward compatibility not being enabled.

Signed-off-by: Philip Prindeville <redacted>

rp-pppoe: fix pppoe-server init script

There were 2 missing "$" when options "maxsessions" and "optionsfile"
are checked for some content.

Also the local declaration of "optionsfile" was incorrect.

Signed-off-by: Martin Schiller <redacted>

ddns-scripts: remove postinst and prerm script call

For reasons that have not been investigated in detail, the package blocks
during 'postinst' with the new 'apk' backend when the package is installed
on the target.

After much back and forth, it turned out that the '/etc/init.d/ddns start'
command is responsible for this. The call is blocking.

The command '/etc/init.d/ddns enabled' in the 'postinst' also makes no sense
here, as it only checks whether the ddns service is enabled. The return value
is not checked at all. And the 'prerm' script is also not needed, as the
calls made there are implicitly called during package deinstallation.

Therefore, this commit removes the entire and not needed 'postinst' and
'prerm' script call.

Signed-off-by: Florian Eckert <redacted>

wget: use explicit API version levels

Per Doug Freed's review comments.

Signed-off-by: Philip Prindeville <redacted>

owut: activate by default in buildbot

This will activate owut in buildbot builds for targets with large flash
by default. This will integrate it into most images by default.

The buildbots already build LuCI with luci-app-attendedsysupgrade. This
adds ucode-mod-uclient and owut to the image.

These are the package sizes for mips_24kc:
29270 bin/packages/mips_24kc/packages/owut-2026.01.13~2526d84b-r1.apk
 5449 bin/packages/mips_24kc/base/ucode-mod-uclient-2026.01.31~931bbfeb-r1.apk

Signed-off-by: Hauke Mehrtens <redacted>

nano: update to 8.7.1

Update nano editor to version 8.7.1.

Signed-off-by: Hannu Nyman <redacted>

wget: build against Openssl w/o deprecated API

If you're building against 3.0.0 or later and you've defined
OPENSSL_NO_DEPRECATED, this breaks.

Signed-off-by: Philip Prindeville <redacted>

wget: don't build http-ntml as it's deprecated

NTML uses DES and MD4, both of which are retired.

Signed-off-by: Philip Prindeville <redacted>

adblock: update 4.5.1-2

* make sure to only return exactly one MAC address in the cgi

Signed-off-by: Dirk Brenken <redacted>

adblock: release 4.5.1

* Remote DNS Allow: this additional firewall feature lets selected client devices
   temporarily bypass local DNS blocking and use an external, unfiltered DNS resolver.
* LuCI: new Firewall options for remote Access
* readme update

Signed-off-by: Dirk Brenken <redacted>

v2raya: Update to 2.2.7.5

Release note: https://github.com/v2rayA/v2rayA/releases/tag/v2.2.7.5

Signed-off-by: Tianling Shen <redacted>

openlist: Update to 4.1.10

Release note: https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.10

Signed-off-by: Tianling Shen <redacted>

cloudflared: Update to 2026.1.2

Release note: https://github.com/cloudflare/cloudflared/releases/tag/2026.1.2

Signed-off-by: Tianling Shen <redacted>

yq: Update to 4.52.2

Release note: https://github.com/mikefarah/yq/releases/tag/v4.52.2

Signed-off-by: Tianling Shen <redacted>

rclone: Update to 1.73.0

Release note: https://github.com/rclone/rclone/releases/tag/v1.73.0

Signed-off-by: Tianling Shen <redacted>

xray-core: Update to 26.2.4

Release note: https://github.com/XTLS/Xray-core/releases/tag/v26.2.4

Signed-off-by: Tianling Shen <redacted>

v2ray-geodata: Update to latest version

Update all geodata.

Signed-off-by: Tianling Shen <redacted>

dos2unix: Update to 7.5.4

2026-01-30: Version 7.5.4
  * Don't return an error code if a binary file is skipped.
    Reverting change in 7.5.3.
  * Refactored code.

Signed-off-by: Tianling Shen <redacted>

ustreamer: update to 6.52

fix a build error when compiled with WITH_SETPROCTITLE=1
undefined reference to setproctitle_init

[1] https://github.com/openwrt/packages/pull/28472#issuecomment-3863583824

Signed-off-by: Georgi Valkov <redacted>

transmission: update to 4.1.0

See release notes for more info on this new major release

https://github.com/transmission/transmission/releases/tag/4.1.0

Signed-off-by: Daniel Golle <redacted>

libutp: update to 2024-11-16

 transmission/libutp@490874c Merge pull request #17 from tearfur/malformed-logs
 transmission/libutp@2d29ce9 Merge pull request #18 from tearfur/ftbfs-log
 transmission/libutp@6c7ee3f Merge pull request #16 from brad0/openbsd_monotonic
 transmission/libutp@1e7e6c6 fix: FTBFS when `UTP_DEBUG_LOGGING` is defined
 transmission/libutp@eedd8b9 fix: malformed logs produced by `struct_utp_context::log()`
 transmission/libutp@14d6f57 Use monotonic clock on OpenBSD
 transmission/libutp@52645d6 chore: remove invalid assertion
 transmission/libutp@4ed4d43 refactor: use std::unordered_map instead of bespoke utpHashTable
 transmission/libutp@13545a9 fixup! chore: savepoint
 transmission/libutp@d0f70e6 chore: add code comments for new code that needs it
 transmission/libutp@b109597 chore: remove extra include string.h
 transmission/libutp@13b5cb4 chore: remove unnecessary #include utp_hash.h
 transmission/libutp@958758b copyediting: tab damage, constify
 transmission/libutp@165a316 refactor: replace UTPSocketHT method with one more narrowly-scoped
 transmission/libutp@9bbf6b3 perf: do not rebuild UTPSocketKey in LookupAdjacent
 transmission/libutp@a271636 chore: savepoint
 transmission/libutp@d339167 feat: make UTPSocketKey std::hash-friendly
 transmission/libutp@1354618 refactor: use std::min(), std::max() instead of bespoke
 transmission/libutp@7480820 chore: remove redundant explicit types when invoking std::min, std::max
 transmission/libutp@3189aba chore: restore undefs
 transmission/libutp@1849bd1 chore: make vsc happy
 transmission/libutp@24c967b refactor: make explicit type for std::min, std::max
 transmission/libutp@1862df0 refactor: make explicit type for std::min, std::max
 transmission/libutp@8080115 refactor: use std::min(), std::max() instead of bespoke
 transmission/libutp@2589200 refactor: use std::vector instead of bespoke Array class
 transmission/libutp@09ef1be Fix build on *BSD (#10)
 transmission/libutp@4d4a3ce fixup! refactor: use std::vector instead of bespoke Array class
 transmission/libutp@1320d78 Merge branch 'post-3.4-transmission' into refactor/replace-bespoke-to-std-pt-1
 transmission/libutp@8bdf5e8 Try to reduce the number of CI builds
 transmission/libutp@4ec3c96 Merge branch 'post-3.4-transmission' into refactor/replace-bespoke-to-std-pt-1
 transmission/libutp@5820d8e Bump minimum CMake version to 3.12 to match Transmission (#9)
 transmission/libutp@d9d3754 refactor: use std::vector instead of bespoke Array class
 transmission/libutp@9cb9f9c build: Require C11 (#5)

Signed-off-by: Daniel Golle <redacted>

libdht: update to 2023-03-18

 jech/dht@0bbb8f4 Full declaration of dht_uninit

Signed-off-by: Daniel Golle <redacted>

libdeflate: update to 1.25

 ebiggers/libdeflate@c8c56a2 (tag: v1.25) v1.25
 ebiggers/libdeflate@095bcab cmake: make installed package relocatable
 ebiggers/libdeflate@7b9232c ci.yml: Use windows-latest for windows-visualstudio-build-and-test
 ebiggers/libdeflate@d65d5db Add link to SwiftDeflate wrapper
 ebiggers/libdeflate@6bb4936 lib/x86: drop any mention of `evex512`
 ebiggers/libdeflate@2a3762c lib/x86/cpu_features.h: drop evex512 on gcc-16

Signed-off-by: Daniel Golle <redacted>

nfs-kernel-server: update to 2.8.5

Changelog: https://www.kernel.org/pub/linux/utils/nfs-utils/2.8.5/2.8.5-Changelog

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc

Signed-off-by: John Audia <redacted>

expat: update to 2.7.4

Changelog:
https://github.com/libexpat/libexpat/blob/R_2_7_4/expat/Changes

Fixes: CVE-2026-24515 CVE-2026-25210
Signed-off-by: Nick Hainke <redacted>

ustreamer: add package 6.51

With mjpg-streamer pending removal [1], it would be nice if we add
a compatible replacement which is under active development.

ustreamer offers a better performance, especially when the
camera supports MJPEG encoding in hardware.

The package already includes OpenWRT support files ./pkg/openwrt
but they needed heavy editing, so it is more efficient to copy
the scripts and configuration, instead of using patches.

Notable changes:
While the init.d script can run in the background when no camera is
connected, it is more efficient to indicate no active instances.
A hotplug script is introduced to start and stop the service when
cameras are added or removed.

If the configured format or encoding are unsupported, a compatible
alternative is automatically selected, so I changed the default
configuration to use MJPEG encoding in hardware for better performance.

HACKS:
MAKE_FLAGS += WITH_SETPROCTITLE=0
is added to workaround the following linker error:
undefined reference to setproctitle_init

This symbol is defined in libbsd, however adding the build dependency
does not resolve the error, because -lbsd is added conditionally, only
when uname -s contains linux. This is unreliable and fails when
cross-compiling on a macOS host. An upstream fix is needed.

An alternative is to use
PKG_UNPACK=$(HOST_TAR) -C $(PKG_BUILD_DIR) --strip=2 -xf $(DL_DIR)/$(PKG_SOURCE)
however this modifies the directory structure, so patches would need
path editing to maintain upstream compatibility.

TODO:
luci-app-mjpg-streamer which is also pending removal [2] is able to
open the HTTP stream from ustreamer. It would be nice to create
luci-app-ustreamer based on that.

[1] https://github.com/openwrt/packages/pull/28344
[2] https://github.com/openwrt/luci/pull/8221

Signed-off-by: Georgi Valkov <redacted>

zabbix: fix no-configure build variant

When selecting only a package of "no-configure" build variant, e.g.
CONFIG_PACKAGE_zabbix-frontend-server=y
but not any other zabbix package, then the build fails.
The sources are not extracted and the install fails finally with:

make[4]: Entering directory '/srv/openwrt/openwrt-2.git/build_dir/target-arm_arm926ej-s_musl_eabi/zabbix-no-configure/zabbix-7.0.22'
make[4]: *** No rule to make target 'install'.  Stop.
make[4]: Leaving directory '/srv/openwrt.git/build_dir/target-arm_arm926ej-s_musl_eabi/zabbix-no-configure/zabbix-7.0.22'
make[3]: *** [Makefile:522: /srv/openwrt.git/build_dir/target-arm_arm926ej-s_musl_eabi/zabbix-no-configure/zabbix-7.0.22/.built] Error 2

This PR fixes this by always running the standard Prepare stage,
but skip the Install one when nothing needs to be compiled.

Signed-off-by: Michael Heimpold <redacted>

django: bump to version 6.0.2

Release notes:
https://docs.djangoproject.com/en/dev/releases/6.0/
https://docs.djangoproject.com/en/dev/releases/6.0.1/
https://docs.djangoproject.com/en/dev/releases/6.0.2/

Signed-off-by: Wei-Ting Yang <redacted>

sing-box: update to 1.12.20

changelog: https://github.com/SagerNet/sing-box/releases/tag/v1.12.20

Signed-off-by: xiao bo <redacted>

ddns-scripts: Fix hetzner install target file name

This was overlooked. Therefore, the package could not be built.

Fixes: e9fe0249f605 ("ddns-scripts: Fix Hetzner Cloud naming")
Signed-off-by: Florian Eckert <redacted>

aliyun-cli: update to 3.2.9

Changelog:
https://github.com/aliyun/aliyun-cli/releases/tag/v3.2.9

Signed-off-by: Bruce Chen <redacted>

pbr: update to 1.2.1-r87

Makefile:
* Remove installation of /usr/share/nftables.d/* files as they are no
  longer needed

Init script:
* bugfixes/more mature netifd extensions support
* refactor of the nft_file function and global variables it uses
* the "main" atomic nft file now includes creation of pbr chains and jumps
  from relevant fw4 chains to pbr chains
* more consistent use of "uplink" wording in the output and variable names
* implement resolver 'wait' call and use it before trying to resolve any
  policy entries
* major overhaul of the split uplink case (IPv4-only wan and IPv6-only
  wan6), should now create/use a single pbr_wan table for both legacy and
  IPv6 routing and the same marking chain
* updates to IDs and text of some error messages (needs luci app update)
* major speed improvements for service stop
* unify the cleanup_* functions into a single cleanup function
* reject creating/additions to nft sets for src_address entries as dnsmasq
  doesn't populate sets with local addresses
* minor bugfixes/code cleanups
* refactor processing of WG servers due to split uplink support (thanks
  @egc112!)
* clearer (hopefully) argument names for process_interface calls
* small improvements to status_service

Signed-off-by: Stan Grishin <redacted>

syncthing: bump to 2.0.14

Changelog: https://github.com/syncthing/syncthing/releases/tag/v2.0.14
Signed-off-by: George Sapkin <redacted>

golang: bump 1.25 to 1.25.7

Fixes: CVE-2025-61732
Fixes: CVE-2025-68121
Changes: https://github.com/golang/go/issues?q=milestone%3AGo1.25.7+label%3ACherryPickApproved
Signed-off-by: George Sapkin <redacted>

golang: add support for release candidates

Support building release candidates by setting GO_VERSION_RC to the
release candidate number, e.g. GO_VERSION_RC:=2, and unsetting
GO_VERSION_PATCH.

Signed-off-by: George Sapkin <redacted>

golang: add missing 386 and arm64 suffixes

Add missing 386 and arm64 suffixes to -installsuffix so as not to
accidentally mix incompatible binaries.

Signed-off-by: George Sapkin <redacted>

golang: use upstream OS/arch format

Use OS/arch format used by Go and reported by go tool dist list.

Update OS/arch combinations.

Signed-off-by: George Sapkin <redacted>

yt-dlp: bump to 2026.02.04

Changelog: https://github.com/yt-dlp/yt-dlp/releases/tag/2026.02.04
Signed-off-by: George Sapkin <redacted>

adblock: update 4.5.0-5

* add 'blocklist-referral' to the hagezi selection
* add minor report/map tweaks

Signed-off-by: Dirk Brenken <redacted>

adblock-fast: update to 1.2.1-r7

* switch from nslookup to resolveip and add dependencey
* fix/use new OutputFormatFilter names for all resolvers

Signed-off-by: Stan Grishin <redacted>

zabbix: fix recursive depedency warning on build

The error in the #24828 patch series left Kconfig recursive depedency
error on zabbix-frontend-server. We fix this by update the database
depedencies on zabbix-frontend-server. Now, you must select the PHP8
database module you want _before_ zabbix-frontend-server will be
visible in menuconfig.

This is not a big problem, because zabbix-frontend-server already
depends on having php8 slected before the frontend can be built.

Closes: #28458
Signed-off-by: Daniel F. Dickinson <redacted>

zabbix: fix package rename missed database config

Due to package renaming the selection of database for the server and
proxy was missing from the Kconfig menu. This caused build failures for
proxy and server.

We now fix that.

Signed-off-by: Daniel F. Dickinson <redacted>

zabbix: fix compile skipped due to line continuation

Using line continuation (\\) in GNU Make \$(foreach ...) and
\$(call ...) resulted in the install section for many of the packages
not being defined. This resulted in 'skipping [package-name] no install
section' messages and no new package being generated.

We remove the line continuation from the parts foreach and call, in
ordeer to restore compilation and creation of packages.

Signed-off-by: Daniel F. Dickinson <redacted>

golang: add option to skip building bootstrap

Introduce a new configuration option - GOLANG_BUILD_BOOTSTRAP - that
defaults to enabled:

- When enabled, build the local bootstrap instead of using an external
  one for host Go. If GOLANG_EXTERNAL_BOOTSTRAP_ROOT is set, skip the
  initial 1.4 step.

- When disabled, let Go auto-detect the toolchain or use the toolchain
  specified in GOLANG_EXTERNAL_BOOTSTRAP_ROOT to skip building the
  bootstrap and build host Go using that toolchain directly. Configured
  toolchain must be compatible with the current version of Go.

HOST_BUILD_DEPENDS cannot be conditional, so some Makefile juggling is
needed.

Put menu config under bootstrap only.

Remove unnecessary package-related flags from host-only bootstrap.

Signed-off-by: George Sapkin <redacted>

liburcu: update to verion 0.15.6

changelog: https://git.lttng.org/?p=userspace-rcu.git;a=blob;f=ChangeLog;h=44d0d303b649682d05b3be85fa702eb919343807;hb=d8bd37fb288a2da7238103f9b24bf25e190902be
Signed-off-by: Jan Hák <redacted>

jq: add host build

* luci-app-advanced-reboot requires jq on host, this adds host build of jq
* remove maintainer

Signed-off-by: Stan Grishin <redacted>

mailsend: fix ssl variant to use opensssl

As described in #28261 Not compiled with OpenSSL, the SSL variant of
the mailsend package is not actually being compiled with OpenSSL.

This is due to an upstream configure check borrowed from an ancient
version of BIND, which no longer works.

As a workaround we add `-DHAVE_OPENSSL=1` to the `TARGET_CFLAGS` when
building the SSL variant.

This results in a complaint about COPTS not being honoured correctly,
but results in `mailsend` compiled with OpenSSL (i.e. works).

Signed-off-by: Daniel F. Dickinson <redacted>

ddns-scripts: Fix Hetzner Cloud naming

In the original commit I used the wrong name for the package in the
Makefile and various other files which caused the package to not build.

Unify the naming to "cloud" to fix the package build.

Fixes: 5ee205bd31b7 ("ddns-scripts: add Hetzner Cloud support")
Signed-off-by: Christopher Obbard <redacted>

procps-ng: add myself as maintainer

I am fine to take over maintenance on this package.

Signed-off-by: John Audia <redacted>

procps-ng: update to 4.0.6

Update to 4.0.6

Changelog: https://gitlab.com/procps-ng/procps/-/releases/v4.0.6

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc

Signed-off-by: John Audia <redacted>

tree: update to 2.3.1

Changelog: https://github.com/Old-Man-Programmer/tree/blob/master/CHANGES

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc

Signed-off-by: John Audia <redacted>

ddns-scripts: add Hetzner Cloud support

Add a new Hetzner DDNS provider using the Hetzner Cloud API
(api.hetzner.cloud) with Bearer token authentication.

Configuration guide:
* set [domain] to domain
* set [username] to subdomain (without domain)
* set [password] to Bearer API key

Signed-off-by: Christopher Obbard <redacted>

isc-dhcp: replacing automatic empty needs addzone

Since the RFC-1918 in-addr.arpa empty zones are automatically created,
they will exist, but we can't use modzone on them because that's not
how things work.

Signed-off-by: Philip Prindeville <redacted>

ffmpeg: update to 6.1.4

Remove warning disable. The issue was fixed in 7.1 and backported to
6.1.3

Remove atrac3 from patented list. It's no longer true and is already in
the non patented list.

Add missing upstream patch in 6.1.4 to fix x86 build.

Signed-off-by: Rosen Penev <redacted>

golang: split src into separate packages

Split misc sources and test data into separate packages. Reduces target
src package size by a third.

Move architecture-dependent generated source from src to the main
package.

Mark doc, misc, src and tests packages with PKGARCH:=all as they don't
have any architecture-specific files.

Fix stripping and strip compiler only.

Fixes: c137c382 ("golang: new packages")
Link: https://github.com/openwrt/packages/pull/28445
Suggested-by: Jeffery To <redacted>
Signed-off-by: George Sapkin <redacted>

golang: install into lib instead of share

Installing into share and symlinking to lib breaks tests:

--- FAIL: TestAllDependencies (0.01s)

    moddeps_test.go:49: findGorootModules didn't find the well-known module "std"

--- FAIL: TestDependencyVersionsConsistent (0.00s)

    moddeps_test.go:356: findGorootModules didn't find the well-known module "std"

Install into lib directly instead.

Fixes: c137c382 ("golang: new packages")
Link: https://github.com/openwrt/packages/pull/28445
Signed-off-by: George Sapkin <redacted>

golang: fix missing dependency check

Add libraries used in test data to extra_provides to pass dependency
checks in package-pack.

Remove unnecessary dependencies.

Fixes: https://github.com/openwrt/packages/issues/27633
Fixes: b2119465 ("golang: Update to 1.24.0")
Link: https://github.com/openwrt/packages/pull/28445
Signed-off-by: George Sapkin <redacted>

golang: fix generating zbootstrap

Fix setting architecture-specific defaults in zbootstrap.go.

Fixes: b2119465 ("golang: Update to 1.24.0")
Link: https://github.com/golang/go/commit/cce90c1eebb315da7611bb79a7bf807df5a1abd9
Link: https://github.com/openwrt/packages/pull/28445
Suggested-by: Jeffery To <redacted>
Signed-off-by: George Sapkin <redacted>

golang: don't set GO_LDSO

Don't set GO_LDSO as it's determined automatically at link time.

Link: https://github.com/golang/go/issues/54197
Link: https://github.com/openwrt/packages/pull/28445
Suggested-by: Jeffery To <redacted>
Signed-off-by: George Sapkin <redacted>

golang: avoid expanding Makefile variables

Replace Makefile variables in comments to avoid expanding them
unnecessarily.

Link: https://github.com/openwrt/packages/pull/28445
Signed-off-by: George Sapkin <redacted>

yt-dlp: bump to 2026.01.31

Update license files.

Changelog: https://github.com/yt-dlp/yt-dlp/releases/tag/2026.01.31
Signed-off-by: George Sapkin <redacted>

zabbix: deduplicate and reorganize package defines

In preparation for further changes, deduplicate package definitions,
and reorganize them. At the same time make use of provides to ensure
both existing names are preserved, and that it is possible to be
specific about the variant of the package one wants.

Also, condense the package conffiles, install, postinst, etc handling.
This is more maintainable (less copy and paste and less to modify).

Signed-off-by: Daniel F. Dickinson <redacted>

zabbix: drop unwanted file and wrong BUILD_VARIANT

cspell.json was accidentally include in a previous commit, so remove it.

VARIANT is to be used in package definitions, and BUILD_VARIANT
for checking which VARIANT is currently being built. BUILD_VARIANT was
incorrectly used in a package definition, so we fix that.

Signed-off-by: Daniel F. Dickinson <redacted>

yt-dlp: bump to 2026.01.29

Changelog: https://github.com/yt-dlp/yt-dlp/releases/tag/2026.01.29
Signed-off-by: George Sapkin <redacted>

bind: backport patch replace automatic empty zones

The RFC-1918 zones are automatically synthesized locally by bind
to avoid forwarding queries about them to root nameservers.  As
a result, we can't easily replace them with rndc addzone on the
fly.  We need this for DHCP integration.

Signed-off-by: Philip Prindeville <redacted>

tailscale: disable logging

Set TS_NO_LOGS_NO_SUPPORT=true as documented here:

https://tailscale.com/kb/1011/log-mesh-traffic?tab=linux#opt-out-of-client-logging

Signed-off-by: Nate Robinson <redacted>

xz: update to 5.8.2

Update xz to version 5.8.2 to match version in build tools.

Signed-off-by: Hannu Nyman <redacted>

sing-box: update to 1.12.18

changelog: https://github.com/SagerNet/sing-box/releases/tag/v1.12.18

Signed-off-by: xiao bo <redacted>

tailscale: update to 1.94.1

Changelog: https://tailscale.com/changelog#2026-01-26
Signed-off-by: Sandro Jäckel <redacted>

faad2: update to 2.11.2

Remove no longer used CONFIGURE_ARGS since the conversion to CMake.

Remove patented stuff. Red Hat Legal seems to have approved its
inclusion into Fedora without any flags disabling SBR. If it's good
enough for Red Hat it's good enough for OpenWrt.

Signed-off-by: Rosen Penev <redacted>

mstflint: update to 4.34.1-3

This commit updates the mstflint package
to the latest 4.34.1-3 release.

Release notes:
https://github.com/Mellanox/mstflint/releases/tag/v4.34.1-3

Signed-off-by: Til Kaiser <redacted>

ci: bump HyperStickler to v1-rc.1

Update HyperStickler and disable branch check.

Changes: https://github.com/GeorgeSapkin/hyperstickler/releases/tag/v1-rc.1
Signed-off-by: George Sapkin <redacted>

ci: add day of the week and labels to dependabot

Run dependabot every Saturday and label PRs with GitHub/CI and
dependencies labels.

Signed-off-by: George Sapkin <redacted>

adblock-fast: update to 1.2.1-3

* add an option dnsmasq_validity_check to enable removal of invalid
  domains from the final dnsmasq files
* renamed option sanity_check to dnsmasq_sanity_check
* better names for Format Filters and Parse Filters variables

Signed-off-by: Stan Grishin <redacted>

docker-compose: Update to version 5.0.2

Release notes:
https://github.com/docker/compose/releases/tag/v5.0.2

Signed-off-by: Javier Marcet <redacted>

libimobiledevice: fix dependency on libtatsu

libtatsu is a dependency only for libimobiledevice-utils
the library itself does not use it during build, and is a
core component for iPhone tethering, while the utils are optional

move the dependency to the utils, to reduce the build size:
libtatsu depends on libcurl, which is compiled with a TLS library,
so users of prebuilt packages are forced to install both
OpenSSL and mbed TLS. This patch removes the unnecessary dependency.

Fixes: https://github.com/openwrt/packages/issues/28427
Signed-off-by: Georgi Valkov <redacted>

ddns-scripts: add namesilo.com

new service provider namesilo.com

config guide:
* set [domain] to apex domain
* set [username] to subdomain (without apex domain)
* set [password] to api key

Signed-off-by: Lin Fan <redacted>

adblock: update 4.5.0-4

* add interface information to the dns report
* support multiple tcpdump interfaces ('any') in the dns report properly

Signed-off-by: Dirk Brenken <redacted>

ci: bump actions/checkout from 5 to 6

Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <redacted>

samba4: fix compiling bundled Kerberos

Fix compiling bundled Kerberos library on several 32-bit architectures
by linking with libatomic.

Disable kernel keyring being picked up from a dirty buildbot
environment.

Signed-off-by: George Sapkin <redacted>

samba4: remove pthread dependency

Remove libpthread dependency since it's integrated into libc.

Signed-off-by: George Sapkin <redacted>

samba4: sort arguments and dependencies

Lexicographically sort configuration arguments and dependencies.

Signed-off-by: George Sapkin <redacted>

ci: add dependabot

Add dependabot config to automatically check for action updates once a
week and open PRs if any are found.

Signed-off-by: George Sapkin <redacted>

liboil: remove package

This software seems no longer maintained by upstream.
The latest upstream release is 16 years ago,
and no package depends on this.

Signed-off-by: Yanase Yuki <redacted>

ostiary: remove package

This software seems no longer maintained by upstream.
Both PKG_SOURCE_URL and URL are dead, and
no package depends on this.

Signed-off-by: Yanase Yuki <redacted>

python3: error on host python path too long

Error if shebang to host python interpreter would exceed 127 characters
(124 characters plus shebang and newline). This is used to alert user
when python-installer would fail to correctly set a Python program's
shebang line.

Closes: https://github.com/openwrt/packages/issues/28310
Signed-off-by: Daniel F. Dickinson <redacted>

crowdsec: remove go version tag

Let crowdsec build system set go version itself.

Link: https://github.com/openwrt/packages/pull/28309
Signed-off-by: George Sapkin <redacted>

golang: add generic package definition

Move version definition to a helper file so multiple versions can be
easily defined using it.

Variables HOST_GO_VARS, PKG_GO_ASMFLAGS, PKG_GO_GCFLAGS,
PKG_GO_INSTALL_ARGS, PKG_GO_LDFLAGS, PKG_GO_VARS, and
PKG_GO_ZBOOTSTRAP_MODS are defined using conditional variable
assignment and can be overridden for each go version.

Link: https://github.com/openwrt/packages/pull/28309
Signed-off-by: George Sapkin <redacted>