The nftables rule in acme-common partially works, but it races against the
acme.sh and uacme client. While the client is performing the renew the rule
is being deleted because the client is run in the background. This change
moves the rule management to the hook instead. While duplicate rules could
be created, the benefits outway the potential costs. It is unknown how many
installations issue/renew multiple certificates.
While at it, we synchronized .github/formalities.json with the current
default settings of the webhook bot.
Since the bot is shared across all OpenWrt repositories, the stale PR
cleanup is disabled by default at the repository level. Because this
repository wants to use stale triage, we explicitly enable it here.
- feeds: fixed the games_tracking feed URL
- f_etag: added housekeeping of the etag file
- f_etag: added 'last-modified' header as fallback for change detection
- small fixes & optimizations
Josef Schlehofer [Tue, 30 Jun 2026 06:15:38 +0000 (08:15 +0200)]
contributing: update CI section with current test infrastructure
Update the Continuous Integration section to reflect the current state:
- Update the list of runtime-tested architectures (add i386_pentium-mmx
and mips_24kc, remove outdated i386_pentium4)
- Document the generic test suite (executable, version, hardcoded path,
strip, linked library, and SONAME checks)
- Add documentation for test-version.sh (version check override) and
pre-test.sh (pre-test setup) scripts alongside the existing test.sh
- Document available environment variables (PKG_NAME, PKG_VERSION,
CI_HELPERS) for test scripts
dockerd: update configuration to select TFTP modules
PR https://github.com/openwrt/openwrt/pull/23690 introduces
the ability to add PACKAGE_kmod-nf-nathelper-tftp instead of
PACKAGE_kmod-nf-nathelper-extra to reduce space usage.
The scripts were a mess. Attempting even a simple update caused many
Copilot complaints. So we rewrite the scripts to be cleaner and
resolve the issues found by automated code review (such as Copilot).
Made extensive use of Qwen3.6-27B, LATE, and llama.ccp for local AI
code reviews during development.
In the process we deduplicate the nut-server and nut-monitor
initscripts and split them into several files, for easier automatic
and human review.
Incorporates and supersedes: #28308
Should supersede #21014
Closes: #28298 Signed-off-by: Daniel F. Dickinson <redacted>
Stan Grishin [Wed, 1 Jul 2026 18:13:57 +0000 (18:13 +0000)]
pbr: update to 1.2.2-18
Maintainer: me
Compile tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Run tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Description:
Update to version 1.2.2-18
- Update PKG_RELEASE to 18.
files/etc/init.d/pbr:
- Update package compatibility level to 26.
- Improve IPv4 gateway detection for various scenarios (e.g., netifd,
point-to-point links).
- Add pbr_get_ipaddr4 function to retrieve an interface's IPv4 address.
- Improve IPv6 gateway detection, including link-local router discovery
and point-to-point link handling.
- Add pbr_get_ipaddr6 function to retrieve an interface's IPv6 address.
- Introduce `is_punycode` helper for domain validation, recognizing
internationalized domain names.
- Expand `is_domain` to include `is_punycode` for comprehensive domain
matching.
- Add `warningInterfaceRoutingUnknownGateway` text for improved error
messages.
- Enhance `nftset` dnsmasq element addition logic to properly handle
existing entries and append new specifications for dual-stack.
- Flush IPv4 and IPv6 routes from custom tables during cleanup to ensure
proper state reset.
- Optimize `dns_policy_process` to only record the first IPv4 and IPv6
DNS servers to avoid issues with multi-value `src_addr` in family
mismatch checks.
- Refine IPv4 routing (`interface_routing`) for strict enforcement and
point-to-point links.
- Refine IPv6 routing (`interface_routing`) for strict enforcement and
point-to-point links.
- Adjust display of gateway information (`dispGw4`, `dispGw6`) to show
IP address if no gateway is found.
- Ensure `json_add_gateway` uses `dispGw4` and `dispGw6` for consistent
output.
- Move `process_interface` calls for `reset_globals` and
`enumerate_interface` earlier in `start_service` for consistent
trigger registration.
- Add logic to skip IPv6 interface reload if the gateway is unchanged to
prevent unnecessary restarts.
- Standardize `service_triggers` to always register all triggers,
ensuring robust recovery from WAN-down states.
Dharmik Parmar [Wed, 24 Jun 2026 17:07:18 +0000 (22:37 +0530)]
watchcat: clarify recovery timer baseline
Keep the default restart timing based on the moment the recovery action
is triggered.
The optional reset_failure_timer path still starts a fresh failure window
after the recovery action finishes. This makes the two timing modes
explicit.
Josef Schlehofer [Tue, 30 Jun 2026 13:32:58 +0000 (15:32 +0200)]
giflib: add version check override
The giflib-utils executables (gif2rgb, gifbuild, gifclrmp, giffix,
giftext, giftool) do not report the package version when run, which
causes the generic version probe to fail.
Add a test-version.sh to skip the version check for the giflib and
giflib-utils packages.
Josef Schlehofer [Tue, 30 Jun 2026 12:36:24 +0000 (14:36 +0200)]
uspot: add version check override
None of the uspot executables (radius-client, uspot, uspot-das) expose
the package version via --version or --help flags. This causes the
generic CI tests to fail with "No executables in the package provided
version".
Add a test-version.sh to skip the version probe for the uspot,
uspotfilter and uspot-www subpackages.
Josef Schlehofer [Mon, 29 Jun 2026 10:54:31 +0000 (12:54 +0200)]
ci: trigger build on pull_request and wait for FormalityCheck
- Change trigger back to pull_request to ensure it runs correctly on fork PRs
- Add a wait-for-formalities job that polls the GITHUB_TOKEN for FormalityCheck status
- Execute the feeds package test build only when the formalities check succeeds
- New major LTS version. See
https://www.haproxy.com/blog/announcing-haproxy-3-4
- Updated haproxy PKG_VERSION and PKG_HASH
- Added patch to insert version information into halog. This is to make the
ci/cd happy.
- See changes: http://git.haproxy.org/?p=haproxy-3.4.git;a=shortlog
Hauke Mehrtens [Sat, 27 Jun 2026 23:02:21 +0000 (01:02 +0200)]
banip: release 1.8.10-1
- fixed log monitor source-IP spoofing (GHSA-r6hx-4f83-vp8m)
Fix: per-ban_logterm source anchoring — the real source (last IP in the line)
is used by default; opt-in 'first:' prefix for source-first formats (web-server access logs).
- add f_mem() helper to read MemAvailable from /proc/meminfo
- cap the auto-detected CPU core count by available memory in f_system:
ban_cores is limited to MemAvailable / 48 (MiB per job), floored to at least 1 core;
this bounds the number of feeds processed in parallel on constrained devices,
a user-set ban_cores is still honored as a ceiling (the cap only ever lowers it).
- derive the GNU sort buffer size from available memory, applied only when
coreutils sort is present; busybox sort is a no-op
Yaroslav Petrov [Sat, 27 Jun 2026 15:45:34 +0000 (17:45 +0200)]
monit: update to 6.0.0
* New release, see the changelog [1] for what's new.
* Switch the download source from Bitbucket to the official release page (https://mmonit.com/monit/dist/). The source code archives on Bitbucket no longer use clear naming conventions like "monit-x.y.z". The Monit team has confirmed that downloading directly from their official distribution site is the recommended approach going forward.
Jan Froch [Sun, 21 Jun 2026 19:12:18 +0000 (21:12 +0200)]
usteer: update to Git HEAD (2026-05-19)
7532e12 ubus: added reassoc_delay and reason code 7b1379a policy: add dynamic signal threshold to band-steering 094c469 ubus: DEAUTH reason more accurate 49ba5f1 policy: optimized steering with different levels of aggressiveness 0beb2c9 local_node: handle NULL sta_addr by freeing query memory 1a2f171 policy: fix logic in load comparison for node selection
Rosen Penev [Sat, 27 Jun 2026 00:36:49 +0000 (17:36 -0700)]
strongswan: remove implicit kmod dependencies
kmod-ipsec has all of these already included, including the deflate
stuff as part of kmod-crypto-deflate and kmod-crypto-aead as part of
kmod-crypto-echaniv.
Thibaut VARÈNE [Mon, 22 Jun 2026 18:06:01 +0000 (20:06 +0200)]
uspot: update to Git HEAD (2026-06-22)
f5be8d0ee836 radius-client: fix printf format warning for uint64_t 815a28c49293 CMakeLists: set minimum required version to 3.10 for cmake 4.x 913980c0249f uspotfilter: switch to an RTNL active poll system
Update package description to reflect modern reality (support for
Thunderbird -- Lightning extension has not been a separate entity for
quite some time, and support for iOS clients -- iPhone and iPad, not
only iPhone).
Josef Schlehofer [Tue, 23 Jun 2026 20:01:26 +0000 (22:01 +0200)]
ci: labeler: avoid checking out fork codebase
Refactor the PR labeler workflow to checkout the base repository ref
instead of the pull request head ref from forks, resolving checkout
errors inside the pull_request_target context.
nantayo [Wed, 17 Jun 2026 03:27:07 +0000 (11:27 +0800)]
crun: update to 1.28
- remove outdated patch file
It was fixed upstream in containers/crun@9acf13d, so the patch file is no longer required.
- replace yajl with json-c
The JSON backend was switched from YAJL to json-c in containers/crun@b62cfdd, so --enable-embedded-yajl should be removed from CONFIGURE_ARGS and libjson-c should be add as a new dependency
net-snmp: fix 'bad number' warning when engineidtype is unset
Add a -n guard before the arithmetic comparison of engineidtype in
snmpd_engineid_add(). When the engineid UCI section exists but
engineidtype is not configured, the empty string is passed to
[ -ge ]/[ -le ] which causes 'sh: bad number' on every boot.
Dharmik Parmar [Mon, 11 May 2026 18:04:08 +0000 (23:34 +0530)]
watchcat: add optional failure timer reset
Add an opt-in reset_failure_timer option for restart_iface and
run_script modes.
When enabled, watchcat starts a fresh failure window after the
recovery action finishes before allowing another recovery action.
The existing behavior remains the default.
Document the intended default and reset_failure_timer timing
behavior in TIMINGS.md and use a safer string comparison for the
reset_failure_timer check.
Dirk Brenken [Mon, 22 Jun 2026 19:06:07 +0000 (21:06 +0200)]
adblock: update 4.5.6-2
- add f_mem() helper to read MemAvailable from /proc/meminfo,
replacing three duplicated inline reads in f_load, f_dns and f_jsnup
- cap the auto-detected CPU core count by available memory in f_load:
adb_cores is limited to MemAvailable / 48 (MiB per job), floored to at least 1 core;
this bounds the number of feeds processed in parallel on constrained devices,
a user-set adb_cores is still honored as a ceiling (the cap only ever lowers it).
- derive the GNU sort buffer size from available memory
- readme update:
- added a "low memory systems" recommendation to use
the zram-swap package (compressed swap) with a swappiness hint,
plus a sizing rule of thumb — this works for all DNS backends OOTB
- significantly expanded the custom-feeds section (all JSON fields, rule parameters, etc.)
Dirk Brenken [Sun, 21 Jun 2026 16:43:35 +0000 (18:43 +0200)]
banip: update 1.8.9-2
default feed updates:
- urlhaus, urlvir, webclient: switched from in to out
and added a tcp udp 80 443 port limit (destination feeds for LAN-initiated traffic)
- feodo, spamhaus, threat, threatview, proxy, tor, vpn, vpndc: switched from in to inout
- threatview: added url_6, as the source ships IPv4 and IPv6 in a single file
- country / asn: intentionally left on in; documented how to switch them to outbound/both
for the recurring "block connections to country X" case
- readme update:
- corrected the feed table to match the above,
- removed the stale drop row (replaced by spamhaus),
- and reworked the chain explanation to clarify the inbound-vs-outbound (source-IP vs destination-IP) model
- significantly expanded the custom-feeds section (all JSON fields, rule parameters, etc.
John Audia [Sun, 21 Jun 2026 10:18:22 +0000 (06:18 -0400)]
lxc: update to 7.0.0
Swtich to upstream recommended 7.0 LTS branch[1] which includes a fix
for CVE-2026-39402. Full changelog: https://github.com/lxc/lxc/releases/tag/v7.0.0
- Removed patches/021-remove-legacy-cgroup-support.patch due upstream
deprecated CGroupV1 support.
- Modified files/lxc-auto.init to remove the boot() function which mounted
legacy cgroup1 stuff as well. This PR will superceed
https://github.com/openwrt/packages/pull/27757 as a result.
- Added a version check script for the CI.
- Fix another CI failure with -Dmemfd-rexec=false
Note this release adds the ability to introduce landlock-sandboxing the
monitor process but that would depend on CONFIG_SECURITY_LANDLOCK in the
kernel. This can be added in a future PR if there is interest.
Wei-Ting Yang [Thu, 18 Jun 2026 04:34:14 +0000 (12:34 +0800)]
bash: update to 5.3 patch level 15
- Fix technically undefined behavior when comparing return value from
realloc to the original pointer
- Update mapfile patch 11, removing stray line and improving the
efficiency of the original fix
- Fix read builtin to avoid cases where -1 is used as an index into the
input buffer
Chester A. Unal [Tue, 9 Jun 2026 19:06:14 +0000 (20:06 +0100)]
bsbf-resources: update to GIT HEAD of 2026-06-19
Update bsbf-resources to the GIT HEAD of 2026-06-19.
- files/etc/uci-defaults/99-bsbf-bonding:
- Simplify the script and make sure multiple wan interfaces are processed
properly.
- Use routing table 1 instead of 100.
- Make it able to install the bsbf-bonding package without needing
bsbf-client-openwrt-installer.
- files/usr/sbin/bsbf-bonding:
- Move uninstall functionality to makefile.
- Bump PKG_RELEASE to 4.
- Add install rule to create /usr/share/nftables.d/ruleset-post.
files/etc/init.d/https-dns-proxy:
- Check if 'nft' command exists before generating rules.
- Add robust error handling for directory creation and file writing.
- Log errors when directory creation or file writing fails.
tests/run_tests.sh:
- Add test case for 'nft' binary absence, confirming no-op behavior.
- Add test case for mkdir failure during notrack rule generation.
Dirk Brenken [Wed, 17 Jun 2026 18:58:27 +0000 (20:58 +0200)]
travelmate: update 2.4.6-2
harden captive portal auto-login script handling:
* enforce the login-script allowlist in the backend instead of the
LuCI frontend only: canonicalize the configured path via 'readlink -f'
(defeats ../ traversal and symlink-to-interpreter tricks) and require a
regular, executable /etc/travelmate/*.login file before running it
* run the script in a noglob subshell ('set -f') so attacker-influenceable
script_args can no longer expand globs into the trusted script; field
splitting (multiple args) is preserved
* writing into /etc/travelmate/ is not covered by the luci-app-travelmate
ACL, so this limits the root-executed script to admin-placed login scripts
and closes a delegated-ACL to root command execution path.
python-jsonpath-ng: drop ply, six and decorator dependencies
jsonpath-ng 1.8.0 vendors ply as jsonpath_ng._ply and no longer imports
six or decorator, so none are required at runtime.
It builds through the setuptools.build_meta legacy backend but never
declared setuptools as a build dependency; it was only present in the host
build env transitively via those packages' builds. Add python-setuptools/host
explicitly so the build no longer relies on that side effect.
The jsonpath_ng CLI takes a required expression argument and has no version
flag, so the generic version check cannot detect the package version from it.
Add a test-version.sh override and assert __version__ in test.sh instead,
mirroring python-jmespath.
Dirk Brenken [Tue, 16 Jun 2026 19:30:33 +0000 (21:30 +0200)]
travelmate: release 2.4.6-1
- fix uplink teardown for bssid-pinned stations
the new implementaion reads the sta object once and parses fields by name via jshn
(isolated namespace, single fork). Bug finder: @adam8833 (#29768)
- add a fork-free f_normbssid() helper and normalize all config-side bssids
to upper case before comparison (in f_getcfg(), covering all callers, and
on the direct scan comparisons in f_main()).
- LuCI: adds a normBssid() helper function as well
net-snmp: fix service not restarting on config change
snmpd generates its runtime configuration in /var/run/snmpd.conf from
UCI during start_service(). However, since the procd instance command
line never changes, procd does not detect that a restart is needed when
the UCI config is modified.
Add 'procd_set_param file /etc/config/snmpd' so procd tracks the config
file and restarts snmpd when it changes. Without this, 'reload_service'
(triggered by procd_add_reload_trigger) re-creates an identical instance
definition and procd skips the restart, leaving stale configuration
active.
This also fixes a usability issue with SNMPv3: when changing a user's
authentication or privacy algorithm, net-snmp must restart to re-derive
localized keys via createUser. Without the restart, the daemon keeps
using cached key material and authentication fails.
Tested with net-snmp 5.9.4 on OpenWrt (aarch64 and ppc64).
git.99rst.org / openwrt-packages.git / log