From upstream: This release consolidates security fixes for issues reported over
a period of time. There are fixes for CVE-2026-77860, CVE-2026-77955,
CVE-2026-78227, CVE-2026-80225, CVE-2026-81634, CVE-2026-81642,
CVE-2026-82717, CVE-2026-82720, and CVE-2026-85501.
- add the trigger interfaces to the runtime status
- support url templates for the country and asn feeds;
the readme contains an example of how to use an alternative
MaxMind source as country feed
- fix the fallback handling of the custom feed file
- disable the curl url globbing
- drop the unsupported 'w' nft expiry unit
- LuCI: show the trigger interfaces, label the board model
- LuCI: drop the unsupported 'w' expiry unit
- LuCI: fix the custom feed file handling
- readme update
This commit updates PowerDNS Recursor to 5.2.13, the latest release
on the 5.2.x LTS branch.
This includes security fixes for the following issues and more:
CVE-2026-24027, CVE-2026-0398, CVE-2026-33256, CVE-2026-33257,
CVE-2026-33258, CVE-2026-33259, CVE-2026-33260, CVE-2026-33261,
CVE-2026-33262, CVE-2026-33601, CVE-2026-33600, CVE-2026-33612,
CVE-2026-40012, CVE-2026-42005, CVE-2026-42390, CVE-2026-42389,
CVE-2026-42388, CVE-2026-42387, CVE-2026-52690, CVE-2026-52688,
CVE-2026-52686, CVE-2026-52682.
Daniel Golle [Tue, 8 Sep 2026 17:55:02 +0000 (18:55 +0100)]
gst1-libav: fix build with FFmpeg 9
libavcodec 63 does not define the V308, V408 and V410 codec IDs that
the video decoder and encoder registration list among the quasi
codecs to skip, so both files fail to compile. Backport the upstream
change that guards those entries by libavcodec major version.
Fixes: 78521023 ("ffmpeg: update to 9.0.1") Signed-off-by: Daniel Golle <redacted>
* snooped elements expire with the TTL of the DNS answer,
clamped to 60..entry_ttl; entry_ttl is now the ceiling, polled elements still use it
* write cache tracks the expiry it last wrote per element and rewrites
when the new expiry moves by at least half of the answer's lifetime, in either direction
* a flow's route is decided on its first packet and kept on the conntrack entry:
route statements set ct mark, one restore rule per policy marks later packets
of the original direction, settled flows skip the lookups
* LuCI: change the entry_ttl option text
* update the README
Co-authored-by: Claude <redacted> Signed-off-by: Dirk Brenken <redacted>
The custom initial EPS bearer code uses init_username, which agrees
with the documented UCI option. However, the option was registered
and read as init_user, so init_username was discarded before the
custom EPS bearer settings were passed to mmcli.
Register and read the option consistently as init_username.
CONTRIBUTING: document what a patch has to look like
Three things are expected of a patch under <package>/patches/ and none of
them were written down for contributors.
The header has to be git am compatible, with the From/From:/Date:/Subject:
lines, which the formality check enforces. The body has to say where the
change stands with respect to upstream, so a later maintainer can tell a
backport that a version bump makes redundant from a cross-compile fix that
has to stay. And the diff has to come from the buildroot's refresh target,
which invokes quilt with -p ab --no-index --no-timestamps and
QUILT_DIFF_OPTS=-p; a git diff carries index lines and timestamps and lacks
the function name in the hunk headers, so it gets sent back even when it
applies.
Write all three down, and say what each quilt option is for rather than
just naming the command, so the reason survives the next time someone
wonders whether the timestamps matter.
llm-review-rules.md already tells the review bot about the refresh target
and the upstream reference. That file is the bot's instructions and it
points contributors here, so this is where the requirement belongs.
- new per-policy `domain_file` list: domain patterns from a file, one
per line, for community-maintained lists too large for UCI. Entries
are learned by snoop only, never polled
- a bare name lives under /tmp/shunt (tmpfs, no flash wear), an
absolute path is taken as given; a missing file is an issue, not a
fatal error, the policy stays rendered with empty sets
- new `shunt refresh` (ubus method `refresh`): re-reads the files and
swaps the matcher in place, no restart, learned addresses stay
- matcher: regex fast path, 4x faster on 100k patterns
- routes and rules are written over rtnetlink via ucode-mod-rtnl
instead of one `ip` process per command; route.uc renders the
netlink operations, the new src/rt.uc applies them and reads the
verdict from rtnl.error()
- `rp_filter_manage` writes /proc/sys directly, `nft` is the last
remaining child process
- `+ip` dropped from DEPENDS
- README update
Co-authored-by: Claude <redacted> Signed-off-by: Dirk Brenken <redacted>
Wei-Ting Yang [Wed, 16 Sep 2026 12:32:16 +0000 (20:32 +0800)]
bash: update to 5.3 patch level 20
- Accommodate macOS dynamic pipe sizing, avoiding hangs.
- Modify the readline redisplay code to use a buffer offset instead of
the physical prompt length in a multibyte locale to determine whether
to reprint the prompt from column 0 because the cursor is before the
last invisible character in the prompt string.
- Fix readline crash with a prompt that exceeds 256 wrapped lines.
Fix readline redisplay code to print the entire prompt if the first
few characters are identical but part of a terminal escape sequence
and the prompt needs to be redrawn.
- Work around systems including bytes between 128 and 255 in the
isalpha(3) set, which causes bash to potentially include them in
identifier names.
- If readline handles a SIGWINCH and updates its idea of the screen
dimensions, it needs to recompute the columns where the prompt wraps
lines every time, not just when the screen width decreases.
Daniel Golle [Thu, 10 Sep 2026 12:07:07 +0000 (13:07 +0100)]
ustreamer: use ATOMIC64_DEPENDS
ustreamer and ustreamer-dump import 64-bit atomics from libatomic where
the compiler cannot inline them, but the build links the library on
every architecture. ATOMIC64_DEPENDS restricts the dependency to the
targets that need it; --as-needed drops the unused library elsewhere.
Daniel Golle [Thu, 10 Sep 2026 12:07:06 +0000 (13:07 +0100)]
sysrepo: use ATOMIC64_DEPENDS
sysrepo-plugind imports 64-bit atomics from libatomic where the
compiler cannot inline them, but the CMake build links the library on
every architecture. ATOMIC64_DEPENDS restricts the dependency to the
targets that need it; --as-needed drops the unused library elsewhere.
Daniel Golle [Thu, 10 Sep 2026 12:07:07 +0000 (13:07 +0100)]
srt: use ATOMIC64_DEPENDS
libatomic is only needed where the compiler does not inline 64-bit
atomics, but the package depends on it on every target.
ATOMIC64_DEPENDS restricts the dependency to those targets.
Daniel Golle [Thu, 10 Sep 2026 12:07:07 +0000 (13:07 +0100)]
ruby: use ATOMIC64_DEPENDS
The open-coded architecture list pulls libatomic onto ARMv6K and ARMv7
targets although they inline 64-bit atomics, and still names the
removed arc architecture. ATOMIC64_DEPENDS covers exactly the targets
that need it.
Daniel Golle [Thu, 10 Sep 2026 12:07:07 +0000 (13:07 +0100)]
rtorrent: use ATOMIC64_DEPENDS
libatomic is only needed where the compiler does not inline 64-bit
atomics, but the package depends on it on every target.
ATOMIC64_DEPENDS restricts the dependency to those targets.
Daniel Golle [Thu, 10 Sep 2026 12:07:08 +0000 (13:07 +0100)]
python3: use ATOMIC64_DEPENDS
libatomic is only needed where the compiler does not inline 64-bit
atomics, but the package depends on it on every target.
ATOMIC64_DEPENDS restricts the dependency to those targets.
Daniel Golle [Thu, 10 Sep 2026 12:48:17 +0000 (13:48 +0100)]
php8: drop libatomic dependency
PHP's configure script probes __atomic_exchange_1 as an external
function on riscv64, which only resolves against libatomic, and so
links the library although no binary references an atomic symbol.
The riscv64-only dependency and linker flag paper over that. Link
with --as-needed so the unused library is dropped and remove both;
mips and riscv64 builds import no atomic symbols.
Daniel Golle [Thu, 10 Sep 2026 13:42:07 +0000 (14:42 +0100)]
openal-soft: drop libatomic dependency
The CMake build links libatomic on targets without inline 64-bit
atomics, but libopenal imports no symbol from it. Link with --as-needed
so the unused library is dropped and remove the dependency.
Daniel Golle [Thu, 10 Sep 2026 12:07:06 +0000 (13:07 +0100)]
nfdump: use ATOMIC64_DEPENDS
libatomic is only needed where the compiler does not inline 64-bit
atomics, but the package depends on it on every target.
ATOMIC64_DEPENDS restricts the dependency to those targets.
Daniel Golle [Thu, 10 Sep 2026 12:07:07 +0000 (13:07 +0100)]
netatalk: use ATOMIC64_DEPENDS
libatomic is only needed where the compiler does not inline 64-bit
atomics, but the package depends on it on every target.
ATOMIC64_DEPENDS restricts the dependency to those targets.
Daniel Golle [Thu, 10 Sep 2026 14:40:04 +0000 (15:40 +0100)]
nanomq: use ATOMIC64_DEPENDS
The daemon imports 64-bit atomics from libatomic where the compiler
cannot inline them, but the CMake build links the library on every
architecture. ATOMIC64_DEPENDS restricts the dependency to the targets
that need it; --as-needed drops the unused library elsewhere.
Daniel Golle [Thu, 10 Sep 2026 12:07:08 +0000 (13:07 +0100)]
gstreamer1: use ATOMIC64_DEPENDS
The open-coded architecture list pulls libatomic onto ARMv6K and ARMv7
targets although they inline 64-bit atomics. ATOMIC64_DEPENDS covers
exactly the targets that need it.
Daniel Golle [Thu, 10 Sep 2026 12:07:06 +0000 (13:07 +0100)]
gnunet: use ATOMIC64_DEPENDS
libatomic is only needed where the compiler does not inline 64-bit
atomics, but the package depends on it on every target.
ATOMIC64_DEPENDS restricts the dependency to those targets.
Daniel Golle [Thu, 10 Sep 2026 12:07:06 +0000 (13:07 +0100)]
bind: use ATOMIC64_DEPENDS
libatomic is only needed where the compiler does not inline 64-bit
atomics, but the package depends on it on every target.
ATOMIC64_DEPENDS restricts the dependency to those targets.
- removing Ted Hess as maintainer per request by himself
- removing Ian Leonard as maintainer per request by himself
- adding myself (Mirko Vogt) as maintainer
- adding Daniel Golle as maintainer
ffmpeg: add V4L2 hardware decoding patches from LibreELEC
V4L2 Request API hwaccels for stateless decoders such as Allwinner
cedrus, exporting DRM_PRIME frames, and a V4L2 M2M deinterlace filter
driving mem2mem deinterlacers such as Allwinner's sun8i-di on DRM_PRIME
frames. The hwaccels introduce the v4l2-request and libudev configure
options.
Add the FFMPEG_V4L2_REQUEST option (pulls libdrm and libudev) to the
libffmpeg menu, keep both new configure options explicitly off in the
common block like the other autodetected ones, and re-add the
*_v4l2request hwaccels under manual component selection.
Patches:
120-v4l2-request-01 to -13: carried over from LibreELEC
(packages/multimedia/ffmpeg/patches/v4l2-request/0001-v4l2-request.patch
as of LibreELEC commit 79de202a10), one file per patch of the series:
01 avutil/hwcontext: Add hwdevice type for V4L2 Request API
(Jonas Karlman)
02 avutil/hwcontext_v4l2request: Probe for a capable media and
video device (Jonas Karlman)
03 avcodec: Add common V4L2 Request API code (Jonas Karlman)
04 avcodec/v4l2request: Add common decode support for hwaccels
(Jonas Karlman)
05 avcodec: Add V4L2 Request API mpeg2 hwaccel (Jonas Karlman)
06 avcodec/h264dec: add ref_pic_marking and pic_order_cnt bit_size
to slice context (Boris Brezillon)
07 avcodec: Add V4L2 Request API h264 hwaccel (Jernej Skrabec)
08 avcodec: Add V4L2 Request API hevc hwaccel (Jernej Skrabec)
09 avcodec: Add V4L2 Request API vp8 hwaccel (Boris Brezillon)
10 avcodec: Add V4L2 Request API vp9 hwaccel (Boris Brezillon)
11 avcodec: Add V4L2 Request API av1 hwaccel (Jonas Karlman)
12 avutil/hwcontext_v4l2request: Add support for AFBC_16X16_SPLIT
pix fmts (Jernej Skrabec)
13 avutil/hwcontext_v4l2request: Add support for BROADCOM_SAND128
pix fmts (Jonas Karlman)
Co-developed by Alex Bee, Benjamin Gaignard and Ezequiel Garcia.
140-vf-deinterlace-v4l2m2m: carried over from LibreELEC
(packages/multimedia/ffmpeg/patches/vf-deinterlace-v4l2m2m/0001-vf-deinterlace-v4l2m2m.patch
as of LibreELEC commit 9ef6c9c6f7; Jernej Skrabec): adds the
deinterlace_v4l2m2m filter
Headers unchanged, hunks refreshed with quilt; the patched tree is
identical to the one LibreELEC's files produce.
LibreELEC's v4l2-drmprime patch (stateful M2M decoders) is not carried:
it needs a rebase for FFmpeg 9 which LibreELEC has not done either.
The V4L2 Request API series is under review upstream as:
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20847
The patches here are taken from LibreELEC, though,
as that's the set that Kodi is built and tested against,
incl. some platform specific fixes.
Patches:
110-libdav1d-get-format: carried over from LibreELEC (Lukas Rusak):
adds a get_format callback to the libdav1d decoder so Kodi's
hardware-first, software-fallback decoder setup initialises
multithreaded software decoding properly; without effect until the
libdav1d option is enabled
111-swscale-yuv2rgb-no-warning: carried over from LibreELEC
(Christian Hewitt): removes the warning swscale logs on every
context initialisation without an accelerated colourspace
conversion
LibreELEC keeps both in one file
(packages/multimedia/ffmpeg/patches/libreelec/0001-libreelec.patch as
of LibreELEC commit 5d54b2dd82); they are split here so each keeps its
own header. Headers unchanged, hunks refreshed with quilt; the patched
tree is identical to the one LibreELEC's file produces.
Upstream dropped libpostproc in 8.0; Kodi still requires it.
The --enable/--disable-postproc option the patch re-introduces is set
explicitly: on together with GPL in libffmpeg, off in libffmpeg-mini.
Patches:
100-postproc: carried over from LibreELEC (Matthias Reichl's rebase
of Michael Niedermayer's libpostproc source plugin;
packages/multimedia/ffmpeg/patches/postproc/0001-postproc.patch as
of LibreELEC commit 5f03a122f8): re-adds libpostproc as a source
plugin
Header unchanged, hunks refreshed with quilt; the patched tree is
identical to the one LibreELEC's file produces.
Variants: libffmpeg is the configurable build (menu "FFmpeg
configuration"; the defaults give a full-featured build), libffmpeg-mini
a fixed small decoder set for playback-only consumers; the two conflict.
The former -full, -custom and -audio-dec variants are folded into
libffmpeg: its menu carries the per-codec/format/protocol selection the
custom variant had, controlled by a "manual component selection"
option that is off by default. libffmpeg provides libffmpeg-full and
libffmpeg-audio-dec as transitional aliases for consumers not yet
updated. libffmpeg-mini no longer provides the libffmpeg virtual
package: its fixed set is too small for the in-tree consumers of that
name (mpd, minidlna), which need the default build; it is for consumers
that depend on it explicitly.
* deterministic configure: --disable-autodetect plus an explicit
--disable baseline for everything configure would pick up from the
environment; each optional library/hwaccel is one config symbol
driving both the conditional DEPENDS and the configure flag
* menu: licence, size/speed, programs, hwaccels (libdrm, V4L2 M2M,
VA-API), TLS backend (default mbedTLS, OpenWrt's default TLS
library), external libraries, system libraries, component selection.
Defaults follow what in-tree consumers need: libopus, LAME (shine
on soft-float) and libx264 on; fdk-aac only for a nonfree, non-GPL
build. The ALSA input device is dropped (no in-tree consumer).
libdav1d (FFmpeg has no native software AV1 decoder) and VA-API are
prepared but commented out until the dav1d and libva packages exist
in the feeds.
* BUILD_PATENTED: vvc (H.266) is added to the patented component lists
next to h264, hevc and vc1; FFmpeg 9 builds its native VVC decoder,
parser, muxer and demuxer by default and H.266 is licensed through
the same patent pools as HEVC.
Build fixes for 9.0.1 are part of this commit; feature patches from
LibreELEC and the options they introduce follow in separate commits.
Patches:
010-pkgconfig: kept unchanged: expresses libdir and includedir
relative to ${prefix} in the generated .pc files
020-libavcodec-fix-Wint-conversion-in-vulkan,
030-avformat-file-guard-fd_dup-by-FD_PROTOCOL-or-PIPE_PR,
040-vulkan_decode-fix-the-print-format-of-VkDeviceSize,
050-avcodec-dct-Make-declarations-and-definitions-match,
060-avutil-tx-fix-GCC-memset-warning,
080-avcodec-pcm-bluray-dvd-Use-correct-pointer-types-on-,
090-avcodec-tiff-Suppress-unused-variable-warnings,
100-avcodec-tableprint_vlc-Unbreak-hardcoded-tables,
120-avfilter-af_channelsplit-fix-mixed-declaration-and-c:
dropped: merged upstream
070-avformat-rawdec-guard-by-CONFIG_DATA_DEMUXER: dropped: only
silenced an unused-function warning in builds without the data
demuxer
160-libavdevice-v4l2-libv4l2-posix-ioctl: new: libv4l2.h only
declares v4l2_ioctl() with the POSIX "int request" signature when
the consumer defines a feature macro first; FFmpeg detects that
signature (HAVE_IOCTL_POSIX) but never tells the header, and GCC 14
turns the resulting pointer-type mismatch into an error. Define
both macro spellings (v4l-utils <= 1.30 and >= 1.32). Same approach
as q66's posix-ioctl.patch in Chimera Linux, also carried by Alpine,
which defines one of the two names per copy
170-tls_mbedtls-build-without-version-module: new: OpenWrt's mbedtls
package disables MBEDTLS_VERSION_C, so mbedtls_version_get_number()
is not declared; fall back to the compile-time MBEDTLS_VERSION_NUMBER
180-mips-cabac-no-mips16: re-added: restores the MIPS16 guard for the
MIPS CABAC inline assembly from Rosen Penev's 030-h264-mips.patch
(2020), dropped by the 6.1.2 update
190-configure-hevcparse-select-hevc_sei: new: configure's hevcparse
component does not select hevc_sei although hevc/parse.c needs it;
without BUILD_PATENTED the HEVC decoder and parser that used to pull
it in are off while the default-enabled dovi_split bitstream filter
still needs hevcparse, leaving ff_hevc_decode_nal_sei undefined
The explicit GPL option and the explicit libdrm dependency follow
Daniel Golle's 7.1.4 update proposal of this package, which was superseded
by this PR/update.
Assisted-By: Claude Fable 5.1 <redacted> Signed-off-by: Mirko Vogt <redacted>
Daniel Golle [Mon, 14 Sep 2026 15:46:13 +0000 (16:46 +0100)]
rtorrent: stop discarding the target build flags
CONFIGURE_VARS is assigned rather than appended to, which discards the
default from package-defaults.mk: the cross compiler settings and the
CFLAGS, CXXFLAGS, CPPFLAGS and LDFLAGS the build system passes. The
client is configured with autoconf's own -g -O2 and built for the
toolchain's default architecture instead, without the target CPU flags,
the hardening flags and -ffile-prefix-map.
Fixes: 6d9d87166017 ("rtorrent: update to 0.15.3") Signed-off-by: Daniel Golle <redacted>
Daniel Golle [Mon, 14 Sep 2026 15:46:07 +0000 (16:46 +0100)]
libtorrent: stop discarding the target build flags
CONFIGURE_VARS is assigned rather than appended to, which discards the
default from package-defaults.mk: the cross compiler settings and the
CFLAGS, CXXFLAGS, CPPFLAGS and LDFLAGS the build system passes. The
library is configured with autoconf's own -g -O2 and built for the
toolchain's default architecture instead, without the target CPU flags,
the hardening flags and -ffile-prefix-map. On x86/geode that also costs
the 64-bit atomics: at the default -march=i486 the compiler cannot
inline them and emits __atomic_load_8 and __atomic_store_8 calls, so
every binary linking the static library needs libatomic.
Fixes: 13a058bed6c0 ("libtorrent: update to 0.15.3") Signed-off-by: Daniel Golle <redacted>
pulseaudio: detect intl and iconv through meson dependency objects
The build probes for dgettext and iconv_open with bare symbol checks,
which succeed against libc even when a standalone GNU libintl or
libiconv is on the include path. Their headers redirect the calls to
libintl_* and libiconv_* symbols, so the objects then need -lintl,
which the Makefile supplied through TARGET_LDFLAGS for every link,
and the standalone libiconv was bypassed through LIBICONV_PLUG.
Add the two patches from upstream merge request 877, which switch the
probes to meson's intl and iconv dependency objects. These compile a
test including the header, so they fall back to linking the library
exactly when the header requires it. With BUILD_NLS this links
libintl-full and libiconv-full where they are used; without it, the
libc implementations are used as before. The second patch makes the
libm link conditional in the same way. Drop the -lintl workaround.
Patches taken from merge request currently under review upstream:
https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/merge_requests/877
The last release, 17.0, dates from January 2024. Master has since
accumulated fixes not available in any release, among them the SAP
port byte order in module-rtp-recv, an out-of-bounds access in
stream_get_timing_info_callback, multichannel processing in
module-echo-cancel and several JSON UTF-8 handling fixes. Switch to
the current master head.
The snapshot tarball carries neither a .git directory nor the
.tarball-version file of a release tarball, so git-version-gen has no
source for the version string and meson would fail parsing the empty
result. Write .tarball-version in Build/Prepare from the last release
tag reachable from the snapshot plus the abbreviated commit, so the
library version and the libpulsecommon file name derive from 17.0 as
the build's own git describe would.
Keep PKG_VERSION at 17.0 instead of the date-derived default, so the
package version matches what the libraries and binaries report, the
CI version check finds it in the --version output, and a later switch
back to a release tarball still sorts as an upgrade. PKG_SOURCE_DATE
and PKG_SOURCE_VERSION identify the snapshot, and the repacked tarball
carries both in its name so that a later snapshot does not collide with
this one in the download directory and on the source mirror.
Upstream turned the doxygen and tests options into feature options;
pass disabled instead of false. Normalise the indentation of the last
three MESON_ARGS entries while touching them.
Move the PulseAudio client libraries into a separate libpulse package,
so a client can depend on just the client library instead of pulling
in the whole daemon. Upstream ships three libraries whose names do not
make the split obvious: libpulse and libpulse-simple are the client
API, libpulsecommon is a private library shared by client and server,
and libpulsecore is the server core used only by the daemon and its
modules. libpulse, libpulse-simple and libpulsecommon go into the new
package; libpulsecore, libpulsedsp and the module helper libraries stay
with pulseaudio-daemon, which now depends on libpulse. The iconv and
gettext users (pulse/utf8.c and pulsecore/i18n.c) are part of
libpulsecommon, so libpulse carries the ICONV_DEPENDS and INTL_DEPENDS
itself.
Enable D-Bus support in both variants, not just the avahi one. D-Bus
support adds the pa_dbus_* and rtkit helpers to libpulsecommon, which
the daemon and its modules link against and which now ships in
libpulse. Since a single libpulse package serves both variants, it has
to be built the same way in both, or the avahi daemon would end up with
a libpulsecommon lacking those symbols. Unconditional D-Bus support is
the simplest way to achieve that; the price is that pure clients now
pull in libdbus.
Two follow-on changes: the D-Bus policy file, previously installed by
the avahi variant only, is now installed by both daemon variants. The
daemon also declares its own libdbus dependency, independent of
libpulse, because libpulsecore links libdbus directly.
Daniel Golle [Thu, 10 Sep 2026 02:50:50 +0000 (02:50 +0000)]
comrade: update to 0.2.2
Since 0.2.0 comrade uses 64-bit atomics and its CMake links libatomic
where the compiler cannot inline them; depend on it through
ATOMIC64_DEPENDS under the same condition.
Add the prplMesh 6.0.1 EasyMesh controller and agent for stock OpenWrt.
The package keeps the installed hostapd/wpad stack and drives it over
the existing UCI, ubus, nl80211 and hostapd control sockets.
The hostapd control interface client is a small self-contained
implementation added by patch 120, so no hostapd source tree is
downloaded, bundled or duplicated at build time and the system hostapd
stays the only hostapd. Binaries install under /usr/libexec/prplmesh,
read-only data under /usr/share/prplmesh, shared libraries under
/usr/lib, configuration under /etc/config/prplmesh. Of the prplOS
helper scripts only prplmesh_utils.sh is installed: patch 161 teaches
its platform guard stock OpenWrt and the init's daily log roller
invokes it; the other helpers stay uninstalled. Its option parsing
needs util-linux getopt (the busybox applet is off by default), hence
the getopt dependency.
At build time prplMesh generates its IEEE 1905 / EasyMesh TLV classes
from YAML definitions with its own Python generator, hence the host
Python and PyYAML build dependencies.
Stock builds run without NBAPI, so the controller skips the
CurrentOperatingClassProfile data-model cleanup for radios without a
data model path, and legacy vendor diagnostic measurements default to
off while standard EasyMesh metrics stay enabled. The controller also
registers radios that appear only in Topology Responses: some stock
agents never run WSC onboarding for a band (Wi-Fi 7 units and their
6 GHz radio), and such radios, their BSSes and their clients stayed
invisible otherwise. Agents in turn import clients that are already
associated when the agent starts: patch 150 walks hostapd's
STA-FIRST/STA-NEXT list on the nl80211 AP and monitor HALs and
reconciles the result every 60 seconds, so stations that associated
while the agent was down appear without waiting for a reassociation,
and stale entries are disconnected only after a cleanly enumerated
sweep. The init preflights every binary the selected management mode
needs before registering any procd instance, and the example
credentials ship empty so an enabled but unconfigured service fails
validation loudly instead of deploying a published passphrase.
A test-version.sh verifies the installed version from the shipped
version file instead of probing daemons, and a test.sh checks the
shipped log levels and the roll-helper install.
Production log levels default to error, info, warning and fatal for
file and syslog output of both daemons. Log retention is enforced by
the upstream roll helper (its platform guard now accepts openwrt):
the init prunes previous-boot logs once per boot before the daemons
come up (a /var/run stamp keeps procd reload triggers, which re-enter
start_service with the daemons live, from re-rolling their logs) and
a procd-supervised roller repeats the roll daily; an image stripped
of the helper runs without rotation instead of refusing to start.
Link-metrics reporting no longer warns about wireless-capable radios
deliberately not used for backhaul.
An earlier revision of this integration, differing only in the wpa_ctrl
client origin and the install prefix, runs on OpenWrt 25.12.5
mediatek/mt7622 with two Ethernet-connected EasyMesh agents.
Ref: https://gitlab.com/prpl-foundation/prplmesh/prplMesh
Ref: https://gitlab.com/kreout/prpl-mesh-mercusys/-/merge_requests/1 Signed-off-by: Andrei Ovcharenko <redacted>
hcxdumptool: pass TARGET_LDFLAGS and restore -std=gnu99
Command-line CFLAGS overrides upstream's CFLAGS += -std=gnu99.
Pass TARGET_LDFLAGS for OpenWrt PIE/RELRO, and keep -lpcap which that
override would otherwise drop.
Leaving hcxnmealog out is intentional.
It is the GPS/wardriving helper that was split out of hcxdumptool in
6.3.5. It needs a GPS receiver (USB NMEA device such as /dev/ttyACM0,
or gpsd wrapping one) and is not used for the usual handshake/PMKID
capture on a stationary router.
Daniel Golle [Wed, 2 Sep 2026 13:24:53 +0000 (14:24 +0100)]
podman: wire the podman bridges into dnsmasq and fw4
Ship a uci-defaults script that excepts the podman bridges from dnsmasq so
aardvark-dns can own the gateway :53, adds an fw4 zone forwarding the podman
subnets to wan, and reloads both so it also applies on a running system.
Gagan Deep [Wed, 9 Sep 2026 17:09:31 +0000 (17:09 +0000)]
openwisp-config: fetch release tarball instead of git clone
Switch source fetch from git clone to the upstream release tarball
published for every tag, as recommended by the feed guidelines.
This replaces PKG_MIRROR_HASH with a plain PKG_HASH of the
codeload tarball.
Co-authored-by: Federico Capoano <redacted> Signed-off-by: Gagan Deep <redacted>
5130 removed --with-probe-type; generic is the default now, selected by
not passing --enable-hwprobe. Drop 001-uname.patch, upstream took the
`uname -n` change in 5120.
Also set LD back to busybox's "$(CC) -nostdlib": OpenWrt's MAKE_FLAGS
force the raw ld.bfd, which rejects the compiler-driver flags in
OpenWrt's LDFLAGS (-fuse-ld=, -specs=, -flto=) with "-f may not be used
without -shared".
Fixes: https://github.com/openwrt/packages/issues/30083 Signed-off-by: Alexandru Ardelean <redacted>
Daniel Golle [Thu, 10 Sep 2026 14:45:16 +0000 (15:45 +0100)]
cryptsetup: update to 2.8.8
Stable bug-fix release. It avoids a TOCTOU issue in LUKS header restore
by opening the header file only once, hardens BITLK metadata validation
against crafted images, fixes an integer overflow in the anti-forensic
data size calculation on 32-bit systems and a memory corruption in
reencrypt init with more than 16 active LUKS2 keyslots or tokens, and
adds keyed discards to integritysetup (--allow-discards-keyed, Linux
7.3 or later).
Daniel Golle [Thu, 10 Sep 2026 14:33:44 +0000 (15:33 +0100)]
cryptsetup: fix Argon2 with OpenSSL built without it
OpenWrt builds OpenSSL with no-blake2, which OpenSSL's Configure turns
into no-argon2 because Argon2 is built on BLAKE2b. The cryptsetup
configure script only looks for the OSSL_KDF_PARAM_ARGON2_VERSION macro,
which such a build still installs, so it drops the bundled Argon2 and
EVP_KDF_fetch() fails at runtime. Every LUKS2 keyslot using Argon2 then
fails instantly with "Keyslot open failed", and cryptsetup benchmark
reports argon2id as N/A. Add a patch that also checks OPENSSL_NO_ARGON2
so the bundled implementation is used again.
Fixes: fbac2e7861fb ("cryptsetup: update to 2.8.7") Signed-off-by: Daniel Golle <redacted>
- cap the GeoIP lookup at 15 batch requests per report run (ip-api.com rate limit)
- reuse the map data for 60 seconds instead of querying the service again
- log batch requests without geo data
- limit the parallel background jobs exactly to `ban_cores (same as adblock)
- LuCI: fix the GeoIP map description
- readme update
mdns-repeater: bump to 2026.07.16~488feaf7, simplify MAKE_FLAGS
Now that @BKPepe's change to not override CFLAGS is accepted upstream
(geekman/mdns-repeater#28), simplify the Makefile to only pass through
the version string (HGVERSION). All other flags now get forwarded by
default as expected.
nut: fix setting RUNAS and STATEPATH in hotplug scripts
A previous PR missed updating the hotplug scripts for the
new find_runas and find_statepath functions which emit
the value on stdout instead of setting a variable in the
caller's scope. Update that usage and handle error conditions.
Also ensure we fully handle finding the group of the RUNAS user for
the serial usb hotplug case, and handle error conditions for that.
On boot, hotplug events were causing excessive start and stop action
for the upsd daemon and driver daemons. We fix that with two primary
actions:
1. Don't restart service daemons on hotplug until after first boot
has completed.
2. Use more robust handling of procd instance starts by ensuring
that the first start starts the nut-server service and all
others add to the nut-server service (rather than replacing it).
Ignore hotplug events without a DEVNAME.
In addition clean up some logging.
In the process, this fixes #30375 "hotplugging for setting usb access
right[s] doesn't work anymore"
Closes: #30375 Signed-off-by: Daniel F. Dickinson <redacted>
Short-circuit not applicable portions of hotplug script on remove, and
make sure we ignore events with incomplete information (no DEVNAME
or no ACTION).
git.99rst.org / openwrt-packages.git / log