cgi-io: update to Git 658b14bda (2025-12-11)

658b14b main: Add `stderr` option for cgi-exec to redirect stderr to stdout

Signed-off-by: Paul Donald <redacted>

xl2tp: add PPP unnumbered support to proto handler

Adds the PPP unnumbered support from openwrt commit 48a95ef ("ppp :
Unnumbered support") to the xl2tp proto handler.

https://github.com/openwrt/openwrt/commit/48a95eff38ceaa13d497617ebd5e2201dd16ee77

Signed-off-by: Martin Schiller <redacted>

python-urllib3: update to 2.6.1

Fix CVE-2025-66418 and CVE-2025-66471.

Full release notes:
https://github.com/urllib3/urllib3/releases/tag/2.6.0
https://github.com/urllib3/urllib3/releases/tag/2.6.1

Drop 001-setuptools-scm-upper-limit.patch as upstream now supports
setuptools-scm v9.x.

Signed-off-by: Wei-Ting Yang <redacted>

domoticz: improve config, don't require telldus

Add support for configuring the -vhostname, as it helps to get the right
issuer into OAuth2 tokens. Also disable the mdns responder by default;
when we're running on OpenWrt we have better options that that. Clean
up the logging options, and also make it export $TZ to work around our
musl hack which otherwise opens and reads /etc/TZ thousands of times
a minute.

Also drop the telldus dependency. Domoticz will dlopen that at runtime
without having to have it present at build time at all, so it should
still work for users who install it.

Signed-off-by: David Woodhouse <redacted>

openzwave: update to 1.6.1965, disable downloads

The project is abandoned but until we get the ZWave-JS-UI node.js
montrosity running in OpenWrt, we need to keep using it. Update to
the last available version.

Signed-off-by: David Woodhouse <redacted>

owut: update to 2025.12.01

Bug fixes:
    efahl/owut@4482dd097f48 owut: handle changes in a package's version number format

Signed-off-by: Eric Fahlgren <redacted>

travelmate: release 2.3.0-1

* split travelmate.s in a new central travelmate function library (usr/lib/travelmate-functions.sh) plus
  a smal service script (/usr/bin/travelmate-service.sh)
* the vpn-, mail- and login scripts are now using the central function library
* rework the ntp hotplug script
* harden the config parsing
* support the curl interface option to specify which network pathway is used for outgoing requests
* the travelmate status now includes the backend- and frontend version information
* LuCI: use a special travelmate interface, e.g. trm_wwan or use an existing wwan interface
* LuCI: no longer call the logread binary, use rpc / the ubus log object instead
* LuCI: various code cleanups
* LuCI: various small usability improvements
* readme update

Signed-off-by: Dirk Brenken <redacted>

adguardhome: bump to 0.107.71

Changelog: https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.71
Signed-off-by: George Sapkin <redacted>

dnscrypt-proxy2: update to version 2.1.15

- update dnscrypt-proxy2 to version 2.1.15

Signed-off-by: Niklas Thorild <redacted>

multi-arch-test-build: disable comments and labels

Disable posting formality check status comments and adding related
labels while the security token is being figured out.

Link: https://github.com/openwrt/packages/pull/28011
Fixes: 2c558a8 ("ci: label formality failures")
Fixes: 7658669 ("multi-arch-test-build: post formal summaries to PR")
Signed-off-by: George Sapkin <redacted>

unbound: update to 1.24.2

Fixes: Possible Domain Hijacking via promiscuous NS Records (CVE-2025-11411)
Changelog: https://www.nlnetlabs.nl/projects/unbound/download/#unbound-1-24-2
Upstream commit f6269baa605d31859f28770e01a24e3677e5f82c
https://github.com/NLnetLabs/unbound/commit/f6269baa605d31859f28770e01a24e3677e5f82c

Signed-off-by: Goetz Goerisch <redacted>

unbound: minimal fix for odhcpd lease file parsing

Current odhcpd in master writes MAC addresses with colons in his lease file,
this new odhcpd format leads to a crash loop in unbound (if DHCPv4 to SLAAC is selected).

Just remove the colons, before the processing in slaac_eui64 begins, fixes #28032

Signed-off-by: Dirk Brenken <redacted>

treewide: remove python3-distutils dependency

As the python3-distutils was dropped while bumping the version
to 3.13.9 via 97a92f2e7a77c39d087892f5c9a7350c31f3d65b, remove the
python3-distutils from all packages that are currently using it.

OpenWrt already uses recent enough releases of these packages
that have adapted to work without distutils, so the dependency
can be safely removed.

Signed-off-by: Til Kaiser <redacted>

ptunnel-ng: remove package

It seems upstream author does not have
time to maintain this software anymore.
Please see v1.43 release note.

Signed-off-by: Yanase Yuki <redacted>

qbee-agent: bump version to 2025.49

Bump version to 2025.49

Signed-off-by: Jon Henrik Bjørnstad <redacted>

qbee-agent: bump version to 2025.49

Bump version to 2025.49

Signed-off-by: Jon Henrik Bjørnstad <redacted>

telegraf: set home variable in uci-defaults script

avoid a non-critical error caused by getent not being installed

Signed-off-by: Niklas Thorild <redacted>

telegraf: update to 1.37.0

- Update Telegraf to v1.37.0

Signed-off-by: Niklas Thorild <redacted>

modemmanager: allow empty initial EPS bearer APN

This commit removes the non-empty APN requirement for initial EPS
bearer. An empty APN value is valid and means that the modem will use a
network provided APN offered by the operator.

Signed-off-by: Simonas Tamošaitis <redacted>

watchcat: set default value for mmifacename to prevent argument shift

Set mmifacename default to "null" instead of an empty string to avoid
argument displacement when the value is not defined. Also remove leftover
debug comments from previous commit.

Signed-off-by: Ivan Diaz <redacted>

watchcat: fix argument handling and allow multiple ping hosts

The backend now correctly supports multiple IP addresses and avoids
argument shifting when mmifacename is empty.

Signed-off-by: Ivan Diaz <redacted>

openconnect: fix off-by-one while condition

resolveip returns 0 on success. This means that the while loop
will just run until all tries are exhausted. But this was not
the intended behaviour.

Fixes: 20ea72607bbf ("openconnect: make host dependency more resilient")
Signed-off-by: Christian Lamparter <redacted>

pbr: update to 1.2.1-r35

pbr 1.2.1-r35

Makefile:
* split uci-defaults into different purpose files
* add handling of netifd integration

Config:
* update with default values for all options (thanks @betonmischer86)

Init-script:
* add netifd integration handling
* add ip() function to emulate ip rule replace
* add netbird intrfaces support (thanks @egc112)
* reorganize loading/handling of options in load_package_config()
* improve display of interface triggers in service_triggers()
* remove chains cleanup from stop_service() due to exclusive use of fw4 nft files
* improve status_service() output
* drop input and postrouting as valid options for policy chain

Uci-defaults files:
* 91-pbr-nft: cosmetic improvements

Default nft files:
* drop use of input and postrouting chanins

Custom User files:
* dns-prefetch: functional improvements (thanks @betonmischer86)

Signed-off-by: Stan Grishin <redacted>

prometheus-node-exporter-lua: remove zero values

depending on the configuration there may be multiple
interfaces creating multiple time series always
reporting 0 value. omiting them from the export saves
resources. most notably cpu. this is limited to
counter types

Signed-off-by: Markus Hube <redacted>

snapcast: update to v0.34.0

A straightforward update from 0.28.0 (2024-03-19, [1])
to 0.34.0 (2025-10-12, [2]) with almost 400 commits. [3]

Notable change is the configurable OpenSSL support (BUILD_WITH_SSL)
for both snapserver and snapclient.
They will be enabled once I introduce the flavours.

In the mean time upsteam moved to it's own organization. [4]

Upstream changelog:
https://github.com/snapcast/snapcast/blob/v0.34.0/changelog.md

[1]: https://github.com/snapcast/snapcast/releases/tag/v0.28.0
[2]: https://github.com/snapcast/snapcast/releases/tag/v0.34.0
[3]: https://github.com/snapcast/snapcast/compare/v0.28.0...v0.34.0
[4]: https://github.com/snapcast

Signed-off-by: Szabolcs Hubai <redacted>

snapcast: define ALSA support explicitly

As Hannu Nyman pointed out, in some cases the build of the package is
able to fail:

Package snapserver is missing dependencies for the following libraries:
libasound.so.2

He said: on some build runs, alsa is built (as required by other
packages), and if it is built before snapcast, it may be detected,
if the feature is not explicitly disabled in CMakeLists.txt.

Also: "I think that you could drop that AUDIO_SUPPORT conditional.
AUDIO_SUPPORT is selected e.g. if USB_SUPPORT is selected,
so it is not that big restriction."

Suggested-by: Hannu Nyman <redacted>
Signed-off-by: Szabolcs Hubai <redacted>

snapcast: sort and reformat CMAKE_OPTIONS

Sort CMAKE_OPTIONS by alphabet and save a few bytes with tab character,
instead of repeating "CMAKE_OPTIONS +="

Signed-off-by: Szabolcs Hubai <redacted>

vim: disable wayland to fix missing dependency

vim autodetects wayland if it's installed, but there's no dependency on
it which results in:

Package vim-full is missing dependencies for the following libraries:
libwayland-client.so.0

Fixes: 4406b79 ("vim: bump to 9.1.1918")
Signed-off-by: George Sapkin <redacted>

yt-dlp: bump to 2025.12.08

Changelog: https://github.com/yt-dlp/yt-dlp/releases/tag/2025.12.08
Signed-off-by: George Sapkin <redacted>

udpspeeder: disable color in logging to prevent side effects in syslog

Fixes #26872 by passing --disable-color in init script

Signed-off-by: David Connolly <redacted>

vim: bump to 9.1.1918

Switch source to GitHub for the most recent releases.

Changes: https://github.com/vim/vim/compare/v9.1.0...v9.1.1918
Signed-off-by: George Sapkin <redacted>

vim: add actual xxd version

Use the actual xxd version instead of the vim one for packaging.

Add matching CI test.

Signed-off-by: George Sapkin <redacted>

lf: update to r39

https://github.com/gokcehan/lf/releases/tag/r39

Signed-off-by: Nate Robinson <redacted>

radicale: remove obsolete package

In this repository, we do have radicale2, so OpenWrt
community should switch to use that version.

This version (= 1.x.x) is really old, no longer developed
and there are newer versions, which can be used e.g.
version 2.x.x, in this repo as radicale2 or there is
also version 3.x.x, which is not packaged for OpenWrt so far.

Signed-off-by: Josef Schlehofer <redacted>

adguardhome: bump to 0.107.70

Changelog: https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.70
Signed-off-by: George Sapkin <redacted>

adguardhome: add SPDX license identifiers

Add GPL 2.0 only SPDX license identifiers to Makefile and all scripts.

Signed-off-by: George Sapkin <redacted>

bind: save out served domains on service stop

If named gets stopped, then started again, but isc-dhcpd isn't also
restarted, then we want named to at least have the existing content.

Signed-off-by: Philip Prindeville <redacted>

tmux: update to 3.6a

changes: https://raw.githubusercontent.com/tmux/tmux/3.6a/CHANGES

Signed-off-by: Maxim Storchak <redacted>

php8: update to 8.4.15

Upstream changelog:
https://www.php.net/ChangeLog-8.php#8.4.15

Signed-off-by: Michael Heimpold <redacted>

django: bump to version 5.2.9

Fixed CVE-2025-13372 and CVE-2025-64460.

Full release notes:
- https://docs.djangoproject.com/en/dev/releases/5.2.9/

Signed-off-by: Wei-Ting Yang <redacted>

ksmbd-tools: bump to 3.5.6

Major changes are:

- Increase max ip connections(8->32) and max connections(128->256).

- Unset "guest_ok = yes" for ipc share by default.

- add new UCI option "allow_guest_ipc" to section (default disabled)

Signed-off-by: Andrea Pesaresi <redacted>

rtty: update to 9.0.4

changelog: https://github.com/zhaojh329/rtty/releases/tag/v9.0.4

Signed-off-by: Jianhui Zhao <redacted>

sqlite3: bump to 3.51.1

Changelog: https://sqlite.org/releaselog/3_51_1.html
Signed-off-by: George Sapkin <redacted>

adblock: update 4.4.4-3

* fixed a typo in the allowlist/blocklist regex
* limit the f_switch function to only the suspend/resume actions

Signed-off-by: Dirk Brenken <redacted>

python-unidecode: drop unmaintained package

It looks like based on opened PRs [1],
there is no official support for Python 3.12+.

Unfortunately, this project is still using setup.py,
which is deprecated and no longer supported.
These days project metadata are stored in pyproject.toml
according to PEP 621.

Also, this project does not follow PEP625 as their
wheel name is in uppercase and it should be in lowercase.

[1] https://github.com/avian2/unidecode/pulls
[2] https://peps.python.org/pep-0621/

Signed-off-by: Josef Schlehofer <redacted>

banip: release 1.6.0-1

* split block/logging rules (fixed #27990)
* adapt reload functions to support the new split logic
* the banIP status now includes the backend- and the frontend version information
* fixed a config parsing error with non existing dirs (reported in the forum)
* fixed a small reporting issue (reported in the forum)
* added a new public dns feed (by default restricted to outbound, ports 53 and 853)
* added a new gawk dependency due to significant performance gains
* LuCI: no longer call the logread binary, use rpc / the ubus log object instead
* LuCI: various code cleanups
* LuCI: various small usability improvements
* readme update

Signed-off-by: Dirk Brenken <redacted>

qemu: update to 10.1.2

- Update version
- No patch changed

Signed-off-by: Vladimir Ermakov <redacted>

gummiboot: add patch fixing compilation error

Add patch fixing compilation error for implicit declaration of
'basename' and also add a patch to use toolchain version of nm and
objcopy tool.

Signed-off-by: Christian Marangi <redacted>

golang: bump to 1.25.5

Fixes: CVE-2025-61727
Fixes: CVE-2025-61729
Link: https://github.com/golang/go/issues?q=milestone%3AGo1.25.5+label%3ACherryPickApproved
Signed-off-by: George Sapkin <redacted>

chrony: Makefile amendments

Update URL to current distro source
drop provides:=nts since it is unused anywhere

Signed-off-by: Paul Donald <redacted>

chrony: add provides logic to Makefile

This satisfies other packages which might depend on either chrony variant.

Should another package dependency request 'chrony', the default will be non-NTS
chrony via DEFAULT_VARIANT:=1 (mlichvar comment:  to avoid pulling its large
dependencies).

Signed-off-by: Paul Donald <redacted>

ci: set explicit workflow permissions

Add explicit permissions for modifying pull requests to labeler and
multi-arch-test-build.

Signed-off-by: George Sapkin <redacted>

rclone: Update to 1.72.0

Release note: https://github.com/rclone/rclone/releases/tag/v1.72.0

Signed-off-by: Tianling Shen <redacted>

xray-core: Update to 25.12.2

Release note: https://github.com/XTLS/Xray-core/releases/tag/v25.12.2

Signed-off-by: Tianling Shen <redacted>

dnsproxy: Update to 0.78.1

Release note:
- https://github.com/AdguardTeam/dnsproxy/releases/tag/v0.78.0
- https://github.com/AdguardTeam/dnsproxy/releases/tag/v0.78.1

Signed-off-by: Tianling Shen <redacted>

yq: Update to 4.49.2

Release note:
- https://github.com/mikefarah/yq/releases/tag/v4.49.1
- https://github.com/mikefarah/yq/releases/tag/v4.49.2

Signed-off-by: Tianling Shen <redacted>

multi-arch-test-build: post formal summaries to PR

Post formality check summaries to a PR.

Signed-off-by: George Sapkin <redacted>

python-parsley: drop package

This looks like it is not maintained anymore.
The last commit in the repository [1] is from 2017,
and the last tarball uploaded on PyPI is from 2015.

That tarball does not follow PEP625, because the
wheel and tarball begins with uppercase, it should be
in lowercase and as well it is still using setup.py.

Python these days is using pyproject.toml.

[1] https://github.com/washort/parsley

Signed-off-by: Josef Schlehofer <redacted>

python-pysocks: remove outdated and not maintained package

The latest commit in https://github.com/Anorov/PySocks
is from 2019, it looks outdated and not maintained.

It does not follow PEP 625.

Signed-off-by: Josef Schlehofer <redacted>

trafficshaper: remove test codes

Remove requirement test code as it is already supplied by package
dependencies
Depend on ip6tables to satisfy description claim

Signed-off-by: Andris PE <redacted>

ykclient: remove package

Upstream stopped ykclient developments.
https://github.com/Yubico/yubico-c-client

Signed-off-by: Yanase Yuki <redacted>

triggerhappy: remove package

The latest upstream commit is 9 years ago.
It seems this package is no longer maintained.
No packages depends on this.

Signed-off-by: Yanase Yuki <redacted>

ci: label formality failures

Add or remove 'not following guidelines' label based on formality check
status.

Signed-off-by: George Sapkin <redacted>

ci: add PR labeler workflow

Label based on target release branch. Labels must be manually defined to
avoid giving the action unnecessary permissions. Release labels must be
defined in the config after each release is forked.

Signed-off-by: George Sapkin <redacted>

netstinky: remove package

It seems this package is no longer maintained.
- The latest upstream commit is 4 years ago.
- Official website and IoC update servers
  are unreachable.
  https://crt.sh/?q=netstinky-api.wand.net.nz

No packages depend on this.

Signed-off-by: Yanase Yuki <redacted>

webui-aria2: remove package

It seems this software is no longer maintained.
- The latest upstream commit is 4 years ago.
- Author didn't respond security issue report. (CVE-2023-39141)

No packages depend on this.

Signed-off-by: Yanase Yuki <redacted>

syncthing: bump to 2.0.12

Changelog: https://github.com/syncthing/syncthing/releases/tag/v2.0.12
Signed-off-by: George Sapkin <redacted>

knot: update to version 3.5.2

Release notes: https://www.knot-dns.cz/2025-11-28-version-352.html

Signed-off-by: Jan Hák <redacted>

isc-dhcp: use modzone not addzone so in-addr.arpa works

Updates to in-addr.arpa are being rejected with:

update failed: REFUSED

because we create an empty zone, and then try to add it again
when it already exists.  So use modzone instead to update it.

Signed-off-by: Philip Prindeville <redacted>

cyrus-sasl: fix build with glibc

Add missing dependency +USE_GLIBC:libcrypt-compat to express dependency
on libcrypto.so.1 when building with GNU glibc.

Signed-off-by: Daniel Golle <redacted>

clixon: backport upstream patch fixing support for 32 bit

Backport upstream patch for clixon fixing support for 32 bit.

Signed-off-by: Christian Marangi <redacted>

exim: update to version 4.99

See https://code.exim.org/exim/exim/releases/tag/exim-4.99

Signed-off-by: Daniel Golle <redacted>

pv: explicitly enable ncursesw, add dependency

Explicitly enable ncurses usage and add dependency for it.

(Feature was added 1.9.24, and buildbot has occasionally failed due
to the missing dependency if ncurses has been already built.)

Signed-off-by: Hannu Nyman <redacted>

pv: remove inactive maintainer

Remove the maintainer info, as jow has not committed to the package
since 2016.

Signed-off-by: Hannu Nyman <redacted>

freeradius3: drop yubikey support

FreeRADIUS yubikey plugin depends on obsolete libyubikey.
libyubikey has been removed from repo
due to upstream EoL. (9ea17111f05e1bc3)
This commit will fix libyubikey dependency problem.

Signed-off-by: Yanase Yuki <redacted>

tdb: update for compatibility, remove absent maintainer

Update to 1.4.14 for compatibility with the current packages infra
(python etc.)

* Refresh patches. Remove old upstream patch
* Remove absent maintainer

Signed-off-by: Hannu Nyman <redacted>

lm-sensors: pass TARGET_LDFLAGS to fix linking

Explicitly pass $(TARGET_LDFLAGS) to the build system
to resolve MIPS linker errors related to missing -fPIC.

Signed-off-by: Anari Jalakas <redacted>

leptonica: adjust for tesseract expectations

Adjust include path and cmake file path so that tesseract, the only user
of the library, finds the items in place. Should unbreak the tesseract
build.

Signed-off-by: Hannu Nyman <redacted>

python-setuptools: fix PKG_CPE_ID

Should be PKG_CPE_ID, not CPE_ID.

Signed-off-by: Wei-Ting Yang <redacted>

shine: fix compile bug in l3mdct

- Project has different function declaration in header and source.
- Reformat patches for `git am`

Fixes: https://github.com/openwrt/packages/issues/27957
Signed-off-by: Vladimir Ermakov <redacted>

tailscale: update to 1.90.9

Changelog: https://tailscale.com/changelog#2025-11-19
Changelog: https://tailscale.com/changelog#2025-11-25

Signed-off-by: Sandro Jäckel <redacted>

snort3: update to 3.10.0.0

Changelog: https://github.com/snort3/snort3/releases/tag/3.10.0.0

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc (Intel N150)

Signed-off-by: John Audia <redacted>

libdaq3: update to 3.0.23

Changelog: https://github.com/snort3/libdaq/releases/tag/v3.0.23

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc (Intel N150)

Signed-off-by: John Audia <redacted>

tor: update to 0.4.8.21 stable

Minor release, see the changelog [1] for what's new.

[1] https://gitlab.torproject.org/tpo/core/tor/-/blob/tor-0.4.8.21/ChangeLog

Signed-off-by: Rui Salvaterra <redacted>

esniper: remove package

esniper's development has been stopped in 2020.
https://esniper.sourceforge.net/
No packages depend on this.

Signed-off-by: Yanase Yuki <redacted>

python-pypubsub: switch to PyPi sdist

- PyPi sdist was recently added for this package. Switch to using it.

Signed-off-by: Austin Lane <redacted>

python-chardet: fix build (depend on setuptools)

- Properly depend on python-setuptools to fix build failures.

Signed-off-by: Austin Lane <redacted>

python-certifi: fix build (depend on setuptools)

- Setuptools has been required since certifi 2025.06.15
  https://github.com/certifi/python-certifi/pull/350

Signed-off-by: Austin Lane <redacted>

python-curl: bump to version 7.45.7

Change bumps version to 7.45.7
Adding python-setuptools/host as PKG_BUILD_DEPENDS.

Package is no longer needed.

Fixes:
 https://github.com/openwrt/packages/issues/27915

Signed-off-by: Alexandru Ardelean <redacted>

python-idna: bump to version 3.11

bump to version 3.11

Signed-off-by: Ioan Bobar <redacted>

Revert "tar: fix EXTRA_DEPENDS"

This reverts commit 593267af241de9cc1e425036305988ccbc396862.

Signed-off-by: George Sapkin <redacted>

ola: fix compilation with newer liblo

Upstream backport.

Signed-off-by: Rosen Penev <redacted>

liblo: fix pkgconf file

OS paths are wrongly being passed.

Signed-off-by: Rosen Penev <redacted>

python-urllib3: fix builds with setuptools-scm 9.x

- Fix builds for python-urllib3 with setuptools-scm
- Patch sourced from upstream (un-released/main branch)

Signed-off-by: Austin Lane <redacted>

perl-www-curl: fix compilation error with new cURL version

Add patch removing internal macro CURL_HAS_DECLSPEC_ATTRIBUTE.

This fix a compilation error for the package.

Also improve the old 7.88 patch with wrong whitespace.

Signed-off-by: Christian Marangi <redacted>

netopeer2: fix install path for netopeer2-server

New version of netopeer2 moved the install location of netopeer2-server
from /usr/bin to /usr/sbin.

Update the install location to reflect this change.

Signed-off-by: Christian Marangi <redacted>

sysrepo: correctly install .yang file with revision

With new sysrepo version, the .yang file are shipped with revision.
Update the package install to align to the new names.

The change of name doesn't cause regression as the revision is optional
on loading .yang files.

Signed-off-by: Christian Marangi <redacted>

libnetconf2: add pending patch to disable PAM support

Add pending patch to disable PAM support to limit need to add extra
dependency.

This is needed if libpam is selected as the package will detect the
library and enable support for it by default.

Signed-off-by: Christian Marangi <redacted>

libradiotap: backport upstream patch for CMake >= 4.0 support

Backport upstream patch for libradiotap for CMake >= 4.0 support.

Signed-off-by: Christian Marangi <redacted>

openthread-br: bump to 2025-06-12 and add patch for CMake >= 4.0 support

Bump to version 2025-06-12 and add pending patch for openthread-br for
CMake >= 4.0 support.

The package use an old cJSON version that cause compilation problem with
CMake >= 4.0 support. To handle this, add a pending patch to use an
external version of cJSON.

We already ship this package so it's trivial to use that instead of the
one in the openthread-br repository.

Signed-off-by: Christian Marangi <redacted>