openvpn: fix quoting and deprecated option filtering

This patch fixes two issues in the netifd protocol script:

1. Fix logic error in deprecated option filtering:
   Previously, ${f%%:*} was called before checking for the deprecated
   flag (:d). This stripped the suffix and made the check [ "${f#*:}" = "d" ]
   always fail. The cleaning of $f is now deferred until after this check.

2. Improve parameter quoting for specific options:
   - Adds single quotes to --push and --push-remove parameters to handle
     spaces (e.g., "route 10.0.0.0 255.255.255.0").
   - Unifies quoting for 'file' type options to improve shell safety.
   - Refactors the build logic using a case statement for better
     extensibility.

Signed-off-by: Chen Minqiang <redacted>

adblock: update 4.5.3-4

* harden adblock backend: removed  all needless eval calls
* more fixes & optimizations
* LuCI: Allow dns instance selection for smartdns (not only for dnsmasq)
* LuCI: more fixes & optimizations
* readme update

Signed-off-by: Dirk Brenken <redacted>

v2ray-geodata: Update to latest version

Update all geodata.

Signed-off-by: Tianling Shen <redacted>

cloudflared: Update to 2026.3.0

2026.3.0
- 2026-03-05 TUN-10292: Add cloudflared management token command
- 2026-03-03 chore: Addressing small fixes and typos
- 2026-03-03 fix: Update go-sentry and go-oidc to address CVE's
- 2026-02-24 TUN-10258: add agents.md
- 2026-02-23 TUN-10267: Update mods to fix CVE GO-2026-4394
- 2026-02-20 TUN-10247: Update tail command to use /management/logs endpoint
- 2026-02-11 TUN-9858: Add more information to proxy-dns removal message

2026.2.0
- 2026-02-06 TUN-10216: TUN fix cloudflare vulnerabilities GO-2026-4340 and GO-2026-4341
- 2026-02-02 TUN-9858: Remove proxy-dns feature from cloudflared

Signed-off-by: Tianling Shen <redacted>

dnsproxy: Update to 0.81.0

Release note:
- https://github.com/AdguardTeam/dnsproxy/releases/tag/v0.79.0
- https://github.com/AdguardTeam/dnsproxy/releases/tag/v0.80.0
- https://github.com/AdguardTeam/dnsproxy/releases/tag/v0.81.0

Signed-off-by: Tianling Shen <redacted>

rclone: Update to 1.73.3

Release note: https://rclone.org/changelog/#v1-73-3-2026-03-23

Signed-off-by: Tianling Shen <redacted>

v2ray-core: Update to 5.47.0

Release note: https://github.com/v2fly/v2ray-core/releases/tag/v5.47.0

Signed-off-by: Tianling Shen <redacted>

xray-core: Update to 26.2.6

Release note: https://github.com/XTLS/Xray-core/releases/tag/v26.2.6

Signed-off-by: Tianling Shen <redacted>

cloudreve: Update to 4.15.0

Changelog:
- https://github.com/cloudreve/cloudreve/releases/tag/4.10.0
- https://github.com/cloudreve/cloudreve/releases/tag/4.10.1
- https://github.com/cloudreve/cloudreve/releases/tag/4.11.0
- https://github.com/cloudreve/cloudreve/releases/tag/4.11.1
- https://github.com/cloudreve/cloudreve/releases/tag/4.12.1
- https://github.com/cloudreve/cloudreve/releases/tag/4.13.0
- https://github.com/cloudreve/cloudreve/releases/tag/4.14.0
- https://github.com/cloudreve/cloudreve/releases/tag/4.14.1
- https://github.com/cloudreve/cloudreve/releases/tag/4.15.0

Fixes: CVE-2026-25726
Signed-off-by: Tianling Shen <redacted>

python-poetry-core: bump to 2.3.1

Bump to latest available version.

Signed-off-by: Jean Thomas <redacted>

adblock-fast: update to 1.2.2-r14

* fix: ensure output in CLI in status and quick start commands
* fix: ensure relevant directories exist when using a (gzip) cache file on
  first boot
* add: update functional tests

Signed-off-by: Stan Grishin <redacted>

python-pycparser: bump to 3.0

v3.0 removes the dependency on PLY by rewriting pycparser with a
hand-written lexer and recursive-descent parser for C. No API changes
or functionality changes - the same AST is produced as before.

Other changes:
- Drop EOL Python 3.8 and 3.9 support (minimum now 3.10)
- Add support for Python 3.14

Since PLY is no longer used:
- Remove python-ply from PKG_BUILD_DEPENDS and HOST_BUILD_DEPENDS
- Remove +python3-ply from package DEPENDS
- Remove 001-use-external-ply.patch (no longer needed)

Full release notes:
https://github.com/eliben/pycparser/releases/tag/release_v3.00

Co-Authored-By: Claude Sonnet 4.6 <redacted>
Signed-off-by: Alexandru Ardelean <redacted>

ddns-scripts: add netcup.com support

Add a new netcup DDNS provider using the netcup DNS api
(ccp.netcup.net) with API key authentication.

Configuration mapping:
* username  = netcup customer number
* password  = netcup API password
* param_enc = netcup API key (generated in the CCP)
* domain    = fully qualified subdomain to update  (e.g. home.example.de)
* param_opt = (optional) root/zone domain override (e.g. example.de)
              When omitted the root domain is derived by stripping the
              leftmost label from 'domain'. This only works correctly for
              a single subdomain level (e.g. "home.example.de").
              param_opt MUST be set explicitly in two cases:
              1. Deep subdomains: domain=test.internal.example.org
              2. ccSLD apex domains: domain=example.co.nz

Signed-off-by: Tim Flubshi <redacted>

bsbf-rate-limiting: add

Update bsbf-resources to the GIT HEAD of 2026-03-24. Add bsbf-rate-limiting
and make bsbf-bonding depend on bsbf-rate-limiting.

Signed-off-by: Chester A. Unal <redacted>

plp-mtu-discovery: update to GIT HEAD of 2026-03-16

Update plp-mtu-discovery to the GIT HEAD of 2026-03-16.

Signed-off-by: Chester A. Unal <redacted>

python-psutil: bump to 7.2.2

Notable changes since 5.9.5:

v6.0.0:
- process_iter() is now ~20x faster (no longer pre-emptively checks
  PID reuse); add process_iter.cache_clear() API
- Process.connections() renamed to Process.net_connections()
  (old name deprecated)
- disk_partitions() namedtuple drops maxfile/maxpath fields
- Support building with free-threaded CPython 3.13

v7.0.0:
- Drop Python 2.7 support

v7.2.0:
- New heap_info() and heap_trim() functions for native C heap allocator
  access (glibc, mimalloc, libmalloc)
- Tests are no longer part of the installed package

v7.2.2:
- [Linux] Process.wait() now uses pidfd_open() + poll() for waiting
  (no busy loop, faster response); requires Linux >= 5.3 + Python 3.9,
  falls back to polling otherwise
- [macOS/BSD] Process.wait() now uses kqueue() for waiting
- Various macOS memory leak and error handling fixes

Also refresh 100-fix-non-Linux-compile.patch for the updated setup.py
(noqa comment style changed; _compat imports removed upstream).
Add test.sh.

Full changelog:
https://github.com/giampaolo/psutil/blob/master/HISTORY.rst

Co-Authored-By: Claude Sonnet 4.6 <redacted>
Signed-off-by: Alexandru Ardelean <redacted>

django-restframework: bump to 3.17.0

v3.17.0 changes:
- Drop Python 3.9 support (minimum now 3.10)
- Drop deprecated coreapi support
- Add Python 3.14 support
- Add ability to specify output format for DurationField
- Add missing decorators: @versioning_class(), @content_negotiation_class(),
  @metadata_class() for function-based views
- Support violation messages in UniqueConstraint

Full release notes:
https://github.com/encode/django-rest-framework/releases/tag/3.17.0

Co-Authored-By: Claude Sonnet 4.6 <redacted>
Signed-off-by: Alexandru Ardelean <redacted>

micropython: bump to 1.27.0

Also update micropython-lib to v1.27.0. Switch micropython-lib from a
git source to the release tarball from:
https://github.com/micropython/micropython-lib/releases/tag/v1.27.0

MPY_VERSION remains at 6, no ABI change.

Adjusted patches.

Signed-off-by: Alexandru Ardelean <redacted>

libvpx: update to 1.16.0

Update libvpx to v1.16.0 "Xenonetta Duck". Highlights include:
- Arm SVE2 and Neon optimizations for 12-tap filters.
- AVX512 implementations for Sum of Absolute Differences (SAD).
- Support for per-frame and per-spatial-layer PSNR calculation.
- ABI incompatible with the previous release.

Includes changes from intermediate releases:
- v1.15.2: Fixes CVE-2025-5283 (bug webm:413411335).
- v1.15.1: SO major version bump and changelog corrections.
- v1.15.0: New codec control for key frame filtering and RTC improvements.

Changelog: https://github.com/webmproject/libvpx/blob/v1.16.0/CHANGELOG
Signed-off-by: Luiz Angelo Daros de Luca <redacted>

ruby: update to 4.0.2

ruby 4.0.2 is a routine update that includes a bugfix in YJIT for
NoMethodError on Puma, along with other bugfixes.

ruby 4.0.1 includes a bugfix for spurious wakeup from Kernel#sleep when
subprocess exits in another thread, along with other bugfixes.

Link: https://www.ruby-lang.org/en/news/2026/03/16/ruby-4-0-2-released/
Changelog: https://github.com/ruby/ruby/releases/tag/v4.0.2
Link: https://www.ruby-lang.org/en/news/2026/01/13/ruby-4-0-1-released/
Changelog: https://github.com/ruby/ruby/releases/tag/v4.0.1
Signed-off-by: Luiz Angelo Daros de Luca <redacted>

net-snmp: add distro extend using /etc/os-release

Read PRETTY_NAME from /etc/os-release via /bin/sh for distro output.

Bump PKG_RELEASE to account for the package configuration change.

Signed-off-by: Kamil Bienkiewicz <redacted>

python-setuptools-scm: bump to 10.0.1

v10.0.0 is a major release with these key changes:
- Drop Python 3.8 and 3.9 support; minimum is now Python 3.10
- Depend on vcs-versioning for core version inference logic, allowing
  other build backends to reuse it without a setuptools dependency
- Version files (write_to, version_file) are now written to the build
  directory during build_py instead of the source tree during version
  inference, enabling builds from read-only source directories

v10.0.1 fixes the release pipeline tooling only (no functional changes).

Full release notes:
https://github.com/pypa/setuptools-scm/releases/tag/setuptools-scm-v10.0.0

Co-Authored-By: Claude Sonnet 4.6 <redacted>
Signed-off-by: Alexandru Ardelean <redacted>

python-vcs-versioning: add new package (version 1.0.1)

vcs-versioning provides the core VCS version inference logic that was
extracted from setuptools-scm into a standalone library. This enables
other build backends to use the same version inference without a
setuptools dependency.

Required as a new dependency for setuptools-scm >= 10.0.0.

Co-Authored-By: Claude Sonnet 4.6 <redacted>
Signed-off-by: Alexandru Ardelean <redacted>

python-chardet: bump to 7.2.0

Bump to 7.2.0.

Signed-off-by: Alexandru Ardelean <redacted>

python-more-itertools: drop package (no longer used)

Was needed by python-zipp
Right now, it's no longer needed, so it can be pulled by pip
on the device (if needed).

Signed-off-by: Alexandru Ardelean <redacted>

pillow: bump to 12.1.1

Pillow 12.x introduces pybind11-based C extension bindings and a
custom build backend (wrapping setuptools.build_meta). This requires:
- Replacing python-setuptools-scm with python-setuptools as build dep
- Adding python-pybind11 as a new build dependency (host)
- Updating build config settings from --build-option flags to the new
  key=value format (e.g. zlib=enable, imagequant=disable)
- Removing the separate webpmux flag (merged into webp feature)

Full release notes:
https://pillow.readthedocs.io/en/stable/releasenotes/index.html

Remove 001-remove-setuptools-version-limit.patch
That's an old relic since when setuptools was packaged inside Python3

Signed-off-by: Alexandru Ardelean <redacted>

python-pybind11: add new package (version 2.13.6)

pybind11 is a header-only library that exposes C++ types in Python,
used as a build-time dependency by packages like Pillow 12.x.

Uses setuptools as its build backend.

Signed-off-by: Alexandru Ardelean <redacted>

libwebp: bump to 1.6.0

Changelog since 1.5.0:
- Binary compatible release
- New API: WebPValidateDecoderConfig
- AVX2/SSE2 optimizations and lossless compression improvements
- Fix -mt multi-threading consistency issue
- cwebp: -resize can be restricted with -resize_mode

Full changelog: https://chromium.googlesource.com/webm/libwebp/+/refs/tags/v1.6.0/ChangeLog

Signed-off-by: Alexandru Ardelean <redacted>

newt: bump to 0.52.25

Changes since 0.52.24:
- Bug fixes and maintenance updates

Need to revert a patch in the build, since it doesn't work for
cross-compilation.

Signed-off-by: Alexandru Ardelean <redacted>

python-werkzeug: bump to 3.1.6

Changelog since 3.1.3:
- v3.1.4: Fix special device name access on Windows in send_from_directory
  (security); fix multipart parser \r\n handling at chunk boundaries;
  improve Watchdog reloader CPU efficiency
- v3.1.5: Extend Windows path protection against special device names
  (security); fix multipart form parser \r\n at chunk boundaries; fix
  AttributeError in DebuggedApplication with pin_security=False
- v3.1.6: Block special device names in multi-segment paths on Windows
  via safe_join (security)

Add test.sh.

Full changelog:
https://werkzeug.palletsprojects.com/en/stable/changes/

Signed-off-by: Alexandru Ardelean <redacted>

libtorrent-rasterbar: add boost as dependency for python package

`boost-python3` will be only selectable after `boost` is selected,
so add `boost` to dependencies as well.

Signed-off-by: Tianling Shen <redacted>

python-pyasn1: bump to 0.6.3

Changelog since 0.6.2:
- Fix CVE-2026-30922: nesting depth limit in ASN.1 decoder to prevent
  stack overflow from deeply nested structures
- Fix OverflowError from oversized BER length fields (#54)
- Fix incorrect stacklevel in deprecation warnings (#86)
- Fix fractional seconds parsing in asDateTime function (#81)

Full changelog: https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst

Signed-off-by: Alexandru Ardelean <redacted>

python-attrs: bump to 26.1.0

Changelog since 25.3.0:
- v25.4.0: Add python-hatch-fancy-pypi-readme as build dependency
- v26.1.0: Field aliases now resolved before calling field_transformer,
  with new Attribute.alias_is_default flag (#1509); fix type annotations
  for validators.optional() with tuples (#1496); validators.disabled()
  now supports nesting (#1513); frozen classes support
  on_setattr=attrs.setters.NO_OP (#1515); attrs.fields() accepts
  instances in addition to classes (#1529)

Full changelog: https://www.attrs.org/en/stable/changelog.html

Signed-off-by: Alexandru Ardelean <redacted>

mpremote: bump to 1.27.0

Sync with MicroPython 1.27.0 release.
Drop patch: we have Python 3.14, importlib_metadata will be installed
for Python 3.7 or smaller.

New dep: platformdirs added.

Signed-off-by: Alexandru Ardelean <redacted>

snapcast: update to v0.35.0

A straightforward update from 0.34.0 (2025-10-12, [1])
to 0.35.0 (2026-03-10, [2])

Upstream changelog:
https://github.com/snapcast/snapcast/blob/v0.35.0/changelog.md

[1]: https://github.com/snapcast/snapcast/releases/tag/v0.34.0
[2]: https://github.com/snapcast/snapcast/releases/tag/v0.35.0

Signed-off-by: Szabolcs Hubai <redacted>

python-attrs: bump to 25.4.0

Changes since 23.1.0:
- attrs 24.1.0: add __attrs_init__ customization via on_setattr
- attrs 24.2.0: improve type annotations, deprecate older APIs
- attrs 25.1.0: Python 3.13 support, drop Python 3.7
- attrs 25.3.0: further type annotation improvements
- attrs 25.4.0: bug fixes and maintenance

Signed-off-by: Alexandru Ardelean <redacted>

python-hatch-fancy-pypi-readme: bump to 25.1.0

Changes since 23.1.0:
- 24.1.0: migrate from setup.cfg to pyproject.toml
- 25.1.0: drop Python 3.7 and 3.8 support; maintenance updates

Required by python-attrs 25.4.0 which needs hatch-fancy-pypi-readme>=23.2.0.

Signed-off-by: Alexandru Ardelean <redacted>

snort3: update to 3.12.1.0

Changelog: https://github.com/snort3/snort3/releases/tag/3.12.1.0

Signed-off-by: John Audia <redacted>

libdaq3: update to 3.0.27

Release notes: https://github.com/snort3/libdaq/releases/tag/v3.0.27

Signed-off-by: John Audia <redacted>

yt-dlp: bump to 2026.03.17

Changes: https://github.com/yt-dlp/yt-dlp/releases/tag/2026.03.13
Changes: https://github.com/yt-dlp/yt-dlp/releases/tag/2026.03.17
Signed-off-by: George Sapkin <redacted>

adblock: update 4.5.3-3

* renamed f_query to f_search (Query => Search)
* add better input validation to the  f_search function,
   to compensate for the very limited Wildcard ACL mechanisms in LuCI, see
   https://github.com/openwrt/luci/issues/8435 for reference
* LuCI: add a proper poll mechanism to mitigate Reporting timeouts
  on "Search" and "Refresh", even with big  pcap files
* LuCI: Refine some ACLs
* LuCI: more fixes & optimizations
* readme update

Signed-off-by: Dirk Brenken <redacted>

libqmi: update to v1.38.0

* See changes (was v1.36.0): https://gitlab.freedesktop.org/
  mobile-broadband/libqmi/-/blob/main/NEWS

Signed-off-by: Martin Neumann <redacted>

python-augeas: bump to 1.2.0

Changes since 1.1.0:
- Python 3.11+ compatibility fixes
- Drop Python 2 support
- Various bug fixes and maintenance updates

Drop upstreamed patch: 001-backport-ffi-fix.patch

Signed-off-by: Alexandru Ardelean <redacted>

banip: update 1.8.1-3

* add better input validation to the f_content and f_search functions,
   to compensate for the very limited Wildcard ACL mechanisms in LuCI, see
   https://github.com/openwrt/luci/issues/8435 for reference
* LuCI: add a proper poll mechanism to mitigate Reporting timeouts
  on "Search" and "Refresh", even with big  Sets
* LuCI: Refine some ACLs
* LuCI: more fixes & optimizations
* readme update

Signed-off-by: Dirk Brenken <redacted>

ffmpeg: document BUILD_PATENTED in package description

Add a note indicating that patented codecs and technologies are
available when CONFIG_BUILD_PATENTED=y.

Signed-off-by: Wei-Ting Yang <redacted>

fwupd: update to v2.1.1

* See changes (was v2.0.1): https://github.com/fwupd/fwupd/releases

Signed-off-by: Martin Neumann <redacted>

net-mtools: backport upstream fix

Backport upstream commit fixing error caused by use of
uninitialized memory.

Signed-off-by: Daniel Golle <redacted>

zabbix: hide CONFIG symbols when no Zabbix package selected

As noted in #28709 OpenWrt  contains CONFIG_
symbols for Zabbix even when no Zabbix package is selected.
This fixes and Closes #28709.

We add a 'guard' symbol for the menus and choices so the only
generate CONFIG symbols when 'Enable Zabbix'
(CONFIG_ZABBIX_ENABLE_ZABBIX) is selected.

We also make all the Zabbix packages depend on this symbol,
for consistency.

This operates much as the pseudo-package solution, but without
a pseudo-package required.

Signed-off-by: Daniel F. Dickinson <redacted>

zabbix: change spaces to tabs in Config.in

This seems to be more standard for Config.in.

Signed-off-by: Daniel F. Dickinson <redacted>

zabbix: move small config-xx.in back to Makefile

Based on https://github.com/openwrt/packages/issues/28709#issuecomment-4060013105
it has been noted that the number config.in files was high compared to actual
config selections.

Therefore move smaller selection back into the Makefile. They are still kept
with the most appropriate package which they configure.

Signed-off-by: Daniel F. Dickinson <redacted>

python-bidict: bump to 0.23.1

Changes since 0.22.1:
- Require Python >= 3.8 (dropped 3.7)
- Performance improvements and internal refactoring
- Better type annotations and mypy support
- Various bug fixes

Also add PKG_BUILD_DEPENDS on python-setuptools/host as bidict uses
setuptools.build_meta build backend.

Signed-off-by: Alexandru Ardelean <redacted>

python-six: bump to 1.17.0

Changes since 1.16.0:
- Drop Python 2.7 and 3.5 support
- Add ensure_str(), ensure_binary(), ensure_text() helpers
- Various minor fixes and maintenance updates

six 1.17.0 switched to pyproject.toml with setuptools build backend,
so add PKG_BUILD_DEPENDS on python-setuptools/host.

Signed-off-by: Alexandru Ardelean <redacted>

python-socketio: bump to 5.11.2

Changelog since 5.8.0:
- v5.9.0: Optimize performance and memory usage for broadcasts
- v5.10.0: Add SimpleClient and AsyncSimpleClient classes; add reporting
  to Socket.IO Admin UI; add server shutdown() function; make async
  enter_room/leave_room proper coroutines
- v5.11.0: Add catch-all namespace support; improve pubsub manager
  robustness; fix background task garbage collection
- v5.11.1: Add connection retry option in client; drop Python 3.7 support;
  add Python 3.12 support
- v5.11.2: Improve routing to catch-all namespace handlers; add option
  to disable routing in ASGIApp

Add test.sh.

Full changelog:
https://github.com/miguelgrinberg/python-socketio/releases

Signed-off-by: Alexandru Ardelean <redacted>

python-gmpy2: bump to 2.3.0

Changelog since 2.2.2:
- Add mpz.array() method for NumPy interaction
- Implement mpq.limit_denominator() functionality
- Add is_integer() method for mpz/mpq types
- Add mixed-mode arithmetic support for mpc types
- Enhanced formatting using context's rounding mode defaults
- Full free-threaded Python build support
- Fix memory leaks in MPFR/MPC cache and context exit
- Drop CPython 3.8 support (requires 3.9+)

Add test.sh.

gmpy2 2.3.0 switched to pyproject.toml with setuptools-scm for version
management. Add python-setuptools-scm/host to PKG_BUILD_DEPENDS.

Full changelog:
https://github.com/aleaxit/gmpy/releases

Signed-off-by: Alexandru Ardelean <redacted>

net/kea: assign PKG_CPE_ID

cpe:/a:isc:kea is the correct CPE ID for kea:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:isc:kea

Signed-off-by: Fabrice Fontaine <redacted>

podman: update to 5.8.1

- adjust makefile
- refresh patch

Signed-off-by: nantayo <redacted>

haproxy: update to v3.2.15

- Fixes multiple security critical bugs with H3 handling. CVE submission is
  pending.
- Updated haproxy PKG_VERSION and PKG_HASH
- Removed get-latest-patches.sh as it is not used anymore.
- See changes: http://git.haproxy.org/?p=haproxy-3.2.git;a=shortlog

Signed-off-by: Christian Lachner <redacted>

python-chardet: bump to 7.1.0

Changes since 7.0.1:
- Add PEP 263 encoding declaration detection for Python source files
- Improve performance: 5.5x faster first-detect time
- Fix undocumented encoding name changes introduced in 5.x
- Restore backward compatibility for encoding names

Signed-off-by: Alexandru Ardelean <redacted>

python-gnupg: bump to 0.5.6

Changelog since 0.5.1:
- Add configurable I/O buffer size via buffer_size attribute (0.5.2)
- Add Web Key Directory (WKD) support for automatic key location (0.5.3)
- Fix sensitive data exposure by removing decryption result logging (0.5.3)
- Fix exception handling in on_data callable during GPG operations (0.5.4)
- Fix GPG version detection robustness (0.5.5)
- Add uid_map attribute to capture UID information (0.5.5)
- Add capability, fingerprint and keygrip to subkey_info (0.5.6)
- Fix username handling when verification keys are expired/revoked (0.5.6)

Full changelog:
https://github.com/vsajip/python-gnupg/releases

Signed-off-by: Alexandru Ardelean <redacted>

net/smcroute: assign PKG_CPE_ID

cpe:/a:troglobit:smcroute is the correct CPE ID for smcroute:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:troglobit:smcroute

Signed-off-by: Fabrice Fontaine <redacted>

python/python-orjson: assign PKG_CPE_ID

cpe:/a:ijl:orjson is the correct CPE ID for orjson:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:ijl:orjson

Signed-off-by: Fabrice Fontaine <redacted>

numpy: bump to 2.4.3

Changelog since 2.4.2:
- Fix threading issue with OpenBLAS on ARM
- Fix memory leaks found via LeakSanitizer
- Fix buffer overrun in CPU baseline validation
- Fix NULL pointer dereference and reference leaks
- Fix np.ma.flatten_structured_array infinite recursion
- Fix np.isin() weak hash function
- Fix busdaycalendar bool array weekmask handling

Full changelog:
https://github.com/numpy/numpy/releases/tag/v2.4.3

Signed-off-by: Alexandru Ardelean <redacted>

python-zipp: bump to 3.23.0

Changelog since 3.16.2:
- v3.17.0: Add CompleteDirs.inject classmethod; prevent path separators
  from matching '?' wildcards in glob
- v3.18.0: Improve glob performance bypassing ZipFile.namelist; support
  platform-specific path separators in glob
- v3.19.1: Fix handling of malformed zip files
- v3.19.3: Fix glob to match directories in addition to files
- v3.20.0: Expose zipfile compatibility overlay as public API (zipp.compat.overlay)
- v3.20.1: Fix infinite loops in archive name handling preserving special chars
- v3.20.2: Make zipfile compatibility overlay hashable
- v3.21.0: Enhance performance for zipfile.Path.open in non-reading modes
- v3.22.0: Fix basename-based properties on Windows; backport CPython tests
- v3.23.0: Add compatibility shim supporting Python 3.13 and earlier

Add python-setuptools/host to PKG_BUILD_DEPENDS (now requires setuptools>=77).
Patch out coherent.licensed build dependency (not packaged).
Add test.sh.

Full changelog:
https://github.com/jaraco/zipp/releases

Signed-off-by: Alexandru Ardelean <redacted>

syncthing: validate syncthing config

Validate UCI config for syncthing service.

Switch instance name to syncthing.

Signed-off-by: George Sapkin <redacted>

syncthing: validate strelaysrv config

Validate UCI config for strelaysrv service.

Switch instance name to strelaysrv.

Signed-off-by: George Sapkin <redacted>

syncthing: validate stdiscosrv config

Validate UCI config for stdiscosrv service.

Change default DB directory to /etc/stdiscosrv/db.

Switch instance name to stdiscosrv.

Signed-off-by: George Sapkin <redacted>

syncthing: add GC and thread control variables

Add Go GC and threading control variables - GOGC, GOMEMLIMIT, and
GOMAXPROCS - to all services to allow more granular control of the
memory management on lower memory devices.

Link: https://go.dev/doc/gc-guide#GOGC
Link: https://pkg.go.dev/runtime#pkg-overview
Link: https://go.dev/blog/container-aware-gomaxprocs
Signed-off-by: George Sapkin <redacted>

openvpn: increment PKG_RELEASE by one

Increment PKG_RELEASE by one.

Signed-off-by: Chen Minqiang <redacted>

openvpn: handle netifd setup in hotplug script

- Process 'up'/'down' events to manage interface status.
- Add IPv4/IPv6 addresses and routes via netifd-proto.
- Parse DNS/search domains from foreign options.
- Convert netmasks and CIDR strings with new helpers.
- Apply MTU settings from OpenVPN environment.

Signed-off-by: Chen Minqiang <redacted>

openvpn: cleanup and fix netifd proto script logic

- Default to '--ifconfig-noexec' and '--route-noexec' to allow hotplug
  script to handle IP and routing configuration.
- Only append '--auth-user-pass-verify' if the option is explicitly
  configured to avoid unexpected authentication requirements.
- Fix missing retrieval of 'auth_user_pass', 'askpass', and 'tls_verify'.
- Remove redundant '--config' parameter (managed by option_builder).
- Simplify 'script_security' assignment logic.

Signed-off-by: Chen Minqiang <redacted>

python-apipkg: bump to 3.0.2

Changelog since 3.0.1:
- Fix import path to make it vendoring-friendly
- Remove py reference from test suite

Add test.sh.

Full changelog:
https://github.com/pytest-dev/apipkg/releases

Signed-off-by: Alexandru Ardelean <redacted>

python-cython: bump to 3.2.4

Changelog since 3.1.5:
- v3.2.0: Type inference for builtin exception types; extended f-string
  syntax (PEP-701); t-strings support (PEP-750); optimized PEP-604 union
  type checks; freelists support for Limited API; faster fused function
  dispatch; efficient C array looping for literal sequences
- v3.2.1: Fix relative imports with shared utility modules; fix GIL
  acquisition crashes under lock congestion in Python 3.11
- v3.2.2: Update C-API declarations for PyDict_*Ref() functions; fix
  invalid C code generation for literal sequences in generators
- v3.2.3: Add PyList_*() function declarations; fix t-strings losing
  final elements in Limited API; fix excessive process requests in
  parallel builds
- v3.2.4: Add @collection_type() decorator; add C++ exception declarations;
  fix pseudo-literal default values in function arguments; reduce pickle
  serialization size for extension types

Full changelog:
https://github.com/cython/cython/releases

Signed-off-by: Alexandru Ardelean <redacted>

python-greenlet: bump to 3.3.2

Changelog since 3.3.1:
- v3.3.2: Fix crash on Python 3.10 during interpreter shutdown with
  active greenlets

Add test.sh.

Full changelog:
https://github.com/python-greenlet/greenlet/releases

Signed-off-by: Alexandru Ardelean <redacted>

python-pkgconfig: bump to 1.6.0

Changelog since 1.5.5:
- Drop Python < 3.9 support; add Python 3.9-3.14 support
- Replace deprecated distutils with setuptools for Python 3.12+
  compatibility
- Reorganize to src/ layout
- Migrate CI from Travis CI to GitHub Actions
- Fix edge cases in configure_extension() for empty compiler/linker flags

Full changelog:
https://github.com/matze/pkgconfig/releases

Signed-off-by: Alexandru Ardelean <redacted>

python-pyasn1: bump to 0.6.2

Changelog since 0.5.1:
- v0.6.0: Drop Python 2.7 and Python 3.6/3.7 support; add support for
  RELATIVE-OID construct
- v0.6.1: Add Python 3.13 compatibility; remove legacy Python 2 code
- v0.6.2: Fix continuation octet limits in OID/RELATIVE-OID decoder
  (CVE-2026-23490); add Python 3.14 support; switch to pyproject.toml

Full changelog:
https://github.com/pyasn1/pyasn1/releases

Signed-off-by: Alexandru Ardelean <redacted>

python-incremental: bump to 24.11.0

Changelog since 24.7.2:
- Switch build system from wheel to hatchling
- Switch runtime dependency from setuptools/pkg-resources to packaging
- Add CLI script (pipx run incremental)
- Add Python 3.13 and 3.14 support; drop Python 3.8 support
- Drop Click dependency from CLI

Update HOST_BUILD_DEPENDS to use python-hatchling/host instead of
python-wheel/host, and replace +python3-pkg-resources dependency with
+python3-packaging in DEPENDS.

Add test.sh.

Full changelog:
https://github.com/twisted/incremental/releases

Signed-off-by: Alexandru Ardelean <redacted>

python-zope-interface: bump to 8.2

Changelog since 8.0.1:
- v8.0.1: Improve test robustness; eliminate runtime dependency on setuptools
- v8.1: Drop Python 3.9 support; add Python 3.14 support
- v8.2: Consolidate package metadata into pyproject.toml; add handling
  for Python 3.14's new __annotate_func__ attribute

Full changelog:
https://github.com/zopefoundation/zope.interface/releases

Signed-off-by: Alexandru Ardelean <redacted>

python-frozenlist: bump to version 1.8

And disable custom build-backend in order to use setuptools.

Signed-off-by: Jean Thomas <redacted>

python-expandvars: add new package

Necessary to build python-frozenlist

Signed-off-by: Jean Thomas <redacted>

coredns: update to 1.14.2

Security fixes for CVE-2026-26017, CVE-2026-26018.

Release notes: https://github.com/coredns/coredns/releases/tag/v1.14.2

Package changes:
- Add optional proxyproto plugin config
- Fix configure-plugin macro to preserve upstream plugin ordering
- Reorganize Config.in with section headers and help texts

Signed-off-by: Vladimir Ermakov <redacted>

python/openpyxl: assign PKG_CPE_ID

cpe:/a:python:openpyxl is the correct CPE ID for openpyxl:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:python:openpyxl

Signed-off-by: Fabrice Fontaine <redacted>

python/python-eventlet: assign PKG_CPE_ID

cpe:/a:eventlet:eventlet is the correct CPE ID for python-eventlet:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:eventlet:eventlet

Signed-off-by: Fabrice Fontaine <redacted>

telegraf: add disk plugin to small variant

Added inputs.disk to TELEGRAF_SMALL_PLUGINS

Signed-off-by: Niklas Thorild <redacted>

icu: bump to 78.3

Unicode® ICU 78.3 is a maintenance update on top of ICU 78 and 78.2, mostly for the CLDR 48.2 bug fixes. In addition, it fixes a C++ code point iterator bug, and updates to timezone data 2026a.

Signed-off-by: Hirokazu MORIKAWA <redacted>

multimedia/icecast: fix PKG_CPE_ID

cpe:/a:xiph:icecast is the correct CPE ID for icecast:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:xiph:icecast

Fixes: a36f265f767da363b60ef09a3b72bb84d9d3cf33 (icecast: Update to 2.4.4)
Signed-off-by: Fabrice Fontaine <redacted>

mail/bogofilter: fix PKG_CPE_ID

cpe:/a:bogofilter_project:bogofilter is the correct CPE ID for bogofilter:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:bogofilter_project:bogofilter

Fixes: 299e5b0a9bce19d6e96cb9ff217028b36ee2dd36 (treewide: add PKG_CPE_ID for better cvescanner coverage)
Signed-off-by: Fabrice Fontaine <redacted>

sound/owntone: fix typo in PKG_CPE_ID

cpe:/a:owntone:owntone_server is the correct CPE ID for owntone:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:owntone:owntone_server

Fixes: e8360bc4e1205e9b931623f9a9a1044056af85cd (sound/owntone: assign PKG_CPE_ID)
Signed-off-by: Fabrice Fontaine <redacted>

python-build: bump to 1.4.0

Changelog since 1.3.0:
- v1.3.0: Add --config-json for JSON-based configuration; drop Python 3.8
  support; fix ModuleNotFoundError when pip isn't installed
- v1.4.0: Add --quiet flag for silent operation; add --metadata option to
  dump PEP 517 metadata; add support for UV environment variable;
  improve Python 3.14 compatibility

Full changelog:
https://github.com/pypa/build/releases

Signed-off-by: Alexandru Ardelean <redacted>

python-setuptools: bump to 82.0.1

Changelog since 80.9.0:
- v81.0.0: Remove --dry-run parameter from setup.py
- v82.0.0: Remove pkg_resources module (deprecated since 67.5.0);
  users should migrate to importlib.resources / importlib.metadata
- v82.0.1: Fix loading of launcher manifest.xml file; documentation
  improvements for installing source distributions

Since pkg_resources has been removed in v82.0.0, drop the
python3-pkg-resources sub-package and remove it as a dependency
from python3-setuptools.

Full changelog:
https://github.com/pypa/setuptools/releases

Signed-off-by: Alexandru Ardelean <redacted>

python-hatchling: bump to 1.29.0

Changelog since 1.27.0:
- v1.27.0: Update default version of core metadata to 2.4
- v1.28.0: Drop Python 3.9 support; add sbom-files option and
  sbom_files build data to wheel build target for SBOM file inclusion
- v1.29.0: Fix Source Date Epoch handling for dates before 1980

Full changelog:
https://github.com/pypa/hatch/releases

Signed-off-by: Alexandru Ardelean <redacted>

python-click: bump to 8.3.1

Changelog since 8.1.7:
- v8.1.8: Fix type hints for open_file(); fix multiline error messages
  for invalid Path; restore empty string defaults in help text
- v8.2.0: Drop Python 3.7-3.9 support; switch to pyproject.toml/flit_core;
  redesign shell completion system (Bash 4.4+, Zsh, Fish);
  add ProgressBar(hidden) parameter
- v8.2.1: Fix flag value handling for flag options with explicit types;
  fix shell completion for nested groups
- v8.2.2: Fix default/flag_value/type parameter reconciliation; fix Zsh
  completion for items containing colons
- v8.3.0: Rework flag_value and default parameters; enable default on
  Argument with nargs=-1; enhance Fish shell autocompletion
- v8.3.1: Fix pager argument handling; fix prompt rendering with empty
  prompt_suffix; fix parameter conversion timing issues

Add test.sh.

Full changelog:
https://github.com/pallets/click/releases

Signed-off-by: Alexandru Ardelean <redacted>

python3: bump to 3.14.3

Major version bump from 3.13.9 to 3.14.3.

Highlights of Python 3.14:
- PEP 649: Deferred evaluation of annotations
- PEP 750: Template string literals (t-strings)
- PEP 758: Exception syntax simplification (no brackets needed)
- PEP 765: Restrict control flow in finally blocks
- PEP 779: Official free-threaded mode support
- PEP 784: Zstandard compression module
- UUID versions 6-8 support with faster generation
- Formally verified HMAC implementation
- Experimental JIT compiler support
- Tail-call interpreter option for performance

Full release notes:
https://www.python.org/downloads/release/python-3143/

Dropped 100-test_hashlib-better-handle-support-for-SHA3.patch (upstreamed)
Adapted 027-fix-host-build-libressl.patch (for
X509_VERIFY_PARAM_get_hostflags() )

Refreshed other patches.

Signed-off-by: Alexandru Ardelean <redacted>

ddns-scripts: switch to procd handling

The 'ddns-scripts' packages still uses not the procd service handling.
This commit changes this.

This change also resolves the issue where, if a UCI configuration is
already present, the process is blocked during installation via APK and
does not complete.

Signed-off-by: Florian Eckert <redacted>
Tested-by: Luiz Angelo Daros de Luca <redacted>

adblock-fast: update to 1.2.2-r12

Config:
* update pause_timeout default value to 60
* add config option rpcd_token

Init script:
* add validation for rpcd_token

Ucode script:
* fix: always reload config options on RPCD calls to prevent stale values
* fix: shell_quote curl params
* fix: do not reload is_tty on each call

Signed-off-by: Stan Grishin <redacted>

telegraf: update to 1.38.1
- Update Telegraf to v1.38.1

Signed-off-by: Niklas Thorild <redacted>

python/python-wheel: assign PKG_CPE_ID

cpe:/a:wheel_project:wheel is the correct CPE ID for python-wheel:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:wheel_project:wheel

Signed-off-by: Fabrice Fontaine <redacted>

multimedia/go2rtc: assign PKG_CPE_ID

cpe:/a:alexxit:go2rtc is the correct CPE ID for go2rtc:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:alexxit:go2rtc

Signed-off-by: Fabrice Fontaine <redacted>

lang/chicken-scheme: assign PKG_CPE_ID

cpe:/a:call-cc:chicken is the correct CPE ID for chicken-scheme:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:call-cc:chicken

Signed-off-by: Fabrice Fontaine <redacted>

net/zerotier: assign PKG_CPE_ID

cpe:/a:zerotier:zerotierone is the correct CPE ID for zerotier:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:zerotier:zerotierone

Signed-off-by: Fabrice Fontaine <redacted>

libs/jose: assign PKG_CPE_ID

cpe:/a:latchset:jose is the correct CPE ID for jose:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:latchset:jose

Signed-off-by: Fabrice Fontaine <redacted>