John Audia [Fri, 19 Dec 2025 21:52:44 +0000 (16:52 -0500)]
libpfring: update to 9.2.0
Bump to 9.2.0 and swtich from git build to tagged tarball.
Added the following patches:
900-Fix-Compilation-on-kernel-6.17.patch (backport)
901-pf_ring-fix-virt_to_page-type-mismatch.patch (pending backport)[1,2]
Removed all upstreamed patches and removed MAINTAINER as no one is
maintaining this pkg. Note that this version is needed in order to
build against linux 6.18.
1. Suggested by CI co-pilot to prevent failure builds for ARM targets
including: arm_cortex9_vfpv3-d16, arm_cortex-a15_neon-vfpv4,
powerpc_464fp, and powerpc_8548.
Norman Gehrsitz [Wed, 31 Dec 2025 02:02:10 +0000 (03:02 +0100)]
acme-acme.sh: support --cert-profile option
acme 3.1.2 added a new --cert-profile option to request specific certificates.
This makes it possible to request shortlived six day certificates from Letsencrypt.
Josef Schlehofer [Wed, 31 Dec 2025 02:38:27 +0000 (03:38 +0100)]
pigeonhole: update to version 0.5.21.1
Release notes:
```
v0.5.21.1 2024-08-14 Aki Tuomi <redacted>
- sieve: When saving to local storage failed after a successful action
in sieve (e.g. redirect, vacation), the mail was reported as
successfully delivered, although it was lost locally.
```
Copy&pasted from
https://raw.githubusercontent.com/dovecot/pigeonhole/0.5.21.1/NEWS
Josef Schlehofer [Wed, 31 Dec 2025 02:33:18 +0000 (03:33 +0100)]
pigeonhole: change package versioning
The current pigeonhole Makefile is more complex than it needs to be, with
too many unique variables and the resulting package version
is currently this one:
```
dovecot-pigeonhole_2.3.21.0.5.21-r1_aarch64_cortex-a53.ipk
```
and based on Repology [1], it looks like we are the only GNU/Linux
distribution, who includes dovecot version and pigeonhole version
together. We should not include the extra dovecot version, because
even project [2] website does not do it except their tarball.
What we can do better is that we added and modify a little bit
EXTRA_DEPENDS, which ensures that pigenhole 0.5.21.1 will be used
for Dovecot 2.3, because of that, we can have package version as
it should be.
Josef Schlehofer [Wed, 31 Dec 2025 01:21:38 +0000 (02:21 +0100)]
dovecot-pigeonhole: fix Makefile syntax to match dovecot
Use $(XARGS) variable instead of plain xargs command, consistent with
the dovecot package implementation. Remove unnecessary space in
EXTRA_DEPENDS version constraint.
Fixes failing error on buildbot:
```
make[3]: warning: jobserver unavailable: using -j1. Add '+' to parent make rule.
Makefile:62: *** multiple target patterns. Stop.
time: package/feeds/packages/pigeonhole/compile#0.52#0.42#1.15
```
After that faulty commit the 'icu' package is always selected
even if php8 itself is not even selected.
Simple bug reproduction process:
perus@ub2510:/OpenWrt/aarch64$ rm .config
perus@ub2510:/OpenWrt/aarch64$ touch .config
perus@ub2510:/OpenWrt/aarch64$ make defconfig
Collecting package info: done
...
#
# configuration written to .config
#
perus@ub2510:/OpenWrt/aarch64$ grep -iE "php8|icu" .config
# PHP8
# CONFIG_PACKAGE_php8 is not set
CONFIG_PHP8_LIBXML=y
CONFIG_PHP8_DOM=y
CONFIG_PHP8_GETTEXT=y
CONFIG_PHP8_INTL=y
# CONFIG_PHP8_FULLICUDATA is not set
# end of PHP8
CONFIG_PACKAGE_icu=y
# CONFIG_PACKAGE_icu-data-tools is not set
# CONFIG_PACKAGE_icu-full-data is not set
Revert the commit, so that a fix can be developed and tested.
With CONFIG_PHP8_GETTEXT php8 always gains a
dependency on a version of the 'icu' package,
however said dependency is not declared, so
on gets compilation errors when
CONFIG_PHP8_GETTEXT=y but PACKAGE_icu is not
selected.
Therefore select PACKAGE_icu when PHP8_GETTEXT is
selected.
- Add coredns package 1.13.2
- Make wgsd-coredns package transitional to coredns with wgsd plugin enabled
- Make coredns plugin list configurable, disable heavy plugins by
default and add wgsd plugin
- Place the service into ujail
- Add netbox plugin
Co-authored-by: Tianling Shen <redacted> Signed-off-by: Vladimir Ermakov <redacted>
Josef Schlehofer [Mon, 29 Dec 2025 12:28:31 +0000 (13:28 +0100)]
treewide: remove Home Assistant dependencies
I previously attempted to package Home Assistant for OpenWrt.
However, given the announcement that Home Assistant will
primarily be supported via containers (e.g., Docker) or HA OS [1],
these specific Python package dependencies [2] are no longer needed.
I no longer maintain these packages, I don't use them, and there
are no other internal dependencies on them. Removing them will
result in slightly faster build times since they no longer require compilation.
Glenn Strauss [Sat, 27 Dec 2025 06:14:14 +0000 (01:14 -0500)]
lighttpd: mbedtls 3.x EC certs require drbg init
EC certs require drbg init with mbedtls >= 3.0.0
in addition to MBEDTLS_USE_PSA_CRYPTO requiring drbg init
x-ref:
"mbedtls error with ec certificates"
https://redmine.lighttpd.net/boards/2/topics/12097
"mod_mbedtls: ECDSA OpenSSL certificates do not work with lighttpd + mbedTLS/PSA (MBEDTLS_USE_PSA_CRYPTO)"
https://redmine.lighttpd.net/issues/3288
Alarcon Laurent [Wed, 24 Dec 2025 08:28:19 +0000 (09:28 +0100)]
lighttpd: fix plugin malformed dependencies
Dependencies for plugin authn_gssapi, authn_ldap, authn_pam, authn_dbi
and authn_sasl are not correctly written.
This cause lighttpd package to always compile krb5-libs, libopenldap and
libpam, even if not selected
Before the fix:
grep -e libpam -e krb5-libs -e libopenldap .config
\# CONFIG_PACKAGE_libpam is not set
\# CONFIG_PACKAGE_libopenldap is not set
\# CONFIG_PACKAGE_krb5-libs is not set
Josef Schlehofer [Mon, 29 Dec 2025 12:11:18 +0000 (13:11 +0100)]
jq: refactor variants and fix PROVIDES
Refactor package variants definition to be cleaner and more robust.
E.g.:
- Remove redundant PROVIDES:=jq from the main 'jq' package (it provides
itself automatically).
- Keep PROVIDES:=jq only on the 'jq-full' variant so it can serve as a
drop-in replacement.
- Use $(CP) macro rather than $(INSTALL_BIN) to preserve symlinks on shared objects
INSTALL_BIN turns all of the symlinks to files, increasing size.
Fixes: 711a19c4b23f3517ece5296d323c8f0220a0ff4e ("jq: provide regex support in additional package jq-full") Signed-off-by: Josef Schlehofer <redacted>
Obsolete use of $(SDK) in configure conditionals can result in
dependency errors when building a subset of packages for packages which
have multiple sub-packages.
The reason it causes dependency issues is that (using libdbi-drivers as
an example) lines like:
ifneq ($(SDK)$(CONFIG_PACKAGE_libdbd-sqlite3),)
always evaluate to true if you are compiling in the SDK. So for a user
compiling from the SDK, the configure arguments are always added to the package build.
Jordan Ngako [Thu, 25 Dec 2025 19:04:47 +0000 (20:04 +0100)]
libopen62541: preserve symlinks on install
$(INSTALL_BIN) follows symlinks, causing the .so to be copied multiple times.
Use $(CP) instead to preserve symlinks and cut package size by ~2/3.
OpenWrt libraries don’t need to be executable, so $(INSTALL_BIN) isn’t required.
Ruby 4.0 introduces "Ruby Box" and "ZJIT", and adds many improvements.
- Introduce experimental ZJIT compiler
- Improve YJIT performance and memory usage
- Add experimental Ruby Boxes object layout optimization
- VM and GC performance improvements
- Ractor runtime and scheduling enhancements
- Update language syntax and semantics (*nil behavior, logical operator parsing)
- Add Array#rfind and optimized Array#find
- Improve Binding API and implicit parameter access
- Extend Enumerator.produce with size keyword
- Enhance ArgumentError diagnostics with caller/callee context
- Add Fiber#raise(cause:)
- IO.select accepts Float::INFINITY timeout
- Improve Kernel#inspect extensibility
- Add Math.log1p and Math.expm1
- Promote Pathname and Set to core classes
- Extend Ractor API (join, value, lifecycle helpers)
- Fix endless and infinite Range behavior
- Define new top-level Ruby module
- Update Unicode to 17.0 and extend String strip methods
- Update bundled gems (RubyGems, Bundler, IRB, etc.)
Packaging changes:
- Include license files for all packages
- As ruby set moved into core, ruby-set is gone.
ruby-setsubclasscompact was added to include the set subclass
compatible layer
- Added conditional libatomic dependency for libruby
- YJIT and ZJIT are not built when cross-compiling (almost always for
openwrt, even when archs matches). However, the Makefile is ready for
both when upstream adds that feature. Config entries are marked as
BROKEN for now.
Changelog: https://github.com/ruby/ruby/compare/v3_4_0...v4.0.0 Signed-off-by: Luiz Angelo Daros de Luca <redacted>
TeleostNaCl Dai [Sun, 16 Nov 2025 04:05:11 +0000 (12:05 +0800)]
tcpreplay: add libbpf dependency
Since compiling tcpbridge requires linking libbpf.so.1, compiling tcpbridge first may result in compilation failure, like:
Package tcpbridge is missing dependencies for the following libraries: libbpf.so.1
The simplest way to solve it is to add libbpf dependency in Makefile
I use a small, custom application to convert data from my
electricity meter into Modbus format for my inverter and wallbox.
I developed this program against an earlier version of libmodbus
on x86, and it ran flawlessly on my ath79 router (big endian).
After migrating to a Mediatek router (little endian), the program
only outputted huge, meaningless values. However, it ran perfectly
fine on my x86 system (little endian), which is running Fedora
with libmodbus v3.1.11.
I then found several bug reports and the changelogs for libmodbus 3.1.11
that described and resolved my problem. So update openwrt to 3.1.11.
- Drop chcon and runcon as they require SELinux support and cannot be built from
coreutils 9.9 when configured with --without-selinux.
- Add libgmp dependency for coreutils-basenc to fix missing libgmp.so.10.
- Switch to -std=gnu17 to avoid build failure.
```
lib/openat-die.c: In function 'openat_save_fail':
lib/openat-die.c:37:3: error: format not a string literal and no format arguments [-Werror=format-security]
37 | error (exit_failure, errnum,
| ^~~~~
lib/openat-die.c: In function 'openat_restore_fail':
lib/openat-die.c:56:3: error: format not a string literal and no format arguments [-Werror=format-security]
56 | error (exit_failure, errnum,
| ^~~~~
```
- Refresh patch.
Ivan Diaz [Tue, 23 Dec 2025 13:30:29 +0000 (08:30 -0500)]
luci-app-watchcat: revert unnecessary quoting in init script
The quoting added in r18 for pinghosts is not needed. Multi-host support
remains fully functional, but the extra quotes caused inconsistent argument
handling between /etc/init.d/watchcat and /usr/bin/watchcat.sh,
especially for single-IP configurations.
This revert removes the unnecessary quoting in the init script and LUCI,
restoring consistent behavior while keeping multiple ping hosts supported.
Fixes: #28100 (watchcat: error if only one address is specified in pinghosts) Signed-off-by: Ivan Diaz <redacted>
commit ea66e463cffc0811757eedee80889323ff66191c added a new config
option LIBCURL_HTTP_AUTH to enable or disable HTTP_AUTH support in
cURL. It defaulted the option to n (disabled).
However, prior to this change HTTP_AUTH was enabled for cURL, as the
configure script defaults to HTTP_AUTH enabled when it is not
explicitly disabled.
This impacts any consumer of cURL that uses HTTP_AUTH, including
authentication by username and password in the URL. (Confirmed via
run testing).
So we set the default for the option to y (enabled).
For zabbix-server-frontend, the absence of php8-mod-filter results in
many of the frontend's pages failing to render. Therefore add this
module as a frontend dependency.
Without php8-mod-openssl the frontend fails with:
[13-Dec-2025 18:47:25 UTC] PHP Fatal error: Uncaught Error: Call to
undefined function openssl_random_pseudo_bytes() in
/www/zabbix/include/classes/helpers/CEncryptHelper.php:89
Stack trace:
CEncryptHelper::generateKey()
thrown in /www/zabbix/include/classes/helpers/CEncryptHelper.php on
line 89
Therefore add php8-mod-openssl as a frontend dependency.
TeleostNaCl Dai [Wed, 24 Dec 2025 14:59:36 +0000 (22:59 +0800)]
vim: fix depends configuration
Due to the incorrect DEPENDS configuration, the vim-full and vim-fuller
packages won't show up in menuconfig if the vim-runtime package is not
selected. This happens because these packages depend on vim-runtime.
To fix this, add the '+' symbol to the DEPENDS line. This ensures that
when either vim-full or vim-fuller is selected, the vim-runtime package
(which is a dependency) will also be selected automatically.
Fixes: d1351b3 ("vim: fix config and runtime") Signed-off-by: TeleostNaCl Dai <redacted>
miniupnpd: update to 2.3.9 to fix issues, refresh building
- Update daemon to 2.3.9 to fix removal of nftables rules in
`upnp_forward` and return the correct internal port; also resulted in
the excessive opening of new ports. Accept interface names starting
with digits
- Build from GitHub releases to get a reliable HTTPS server, as the
HTTP-only/HTTPS mirror were only available ~85%/77% over 3 months
https://redirect.github.com/miniupnp/miniupnp/issues/770
https://stats.uptimerobot.com/DwGDxUB914
- Build daemon with `--disable-pppconn` to remove the old/IGDv1-only
extra WANPPPConnection SSDP announcements workaround not included in
other implementations since >15y
- Build daemon with `--vendorcfg` to allow customisation of the
router/friendly name (+5 potential options) displayed in Windows
Explorer, 384 bytes extra required on ARMv7 (binary)
- Remove old (iptables variant only) patches, as no longer needed
- Remove `clean_ruleset_interval/threshold` UCI config options as not
standard/working since OpenWrt 22.03, as nftables not supported
George Sapkin [Mon, 22 Dec 2025 01:28:07 +0000 (03:28 +0200)]
tar: fix circular dependency on xz
tar depended both on xz and xz-utils which xz already depended on.
Coupled with if PACKAGE_tar check it caused all packages that depended
on tar to have a circular Kconfig dependency. Remove the check and
dependency on xz-utils and leave xz one only.
A patch is included in order to get the compiler (csc) to work properly
on the target device (comment in the OpenWRT package Makefile). csc,
chicken-install, chicken-status have been verified to work. What the
patch does is to remove -fmacro-prefix-map and -ldl in the strings that
are passed to gcc when the Scheme compiler runs. Without that, the
compiler will not run on the router. A longer description is in the
patch header.
Co-authored-by: George Sapkin <redacted> Signed-off-by: Jeronimo Pellegrini <redacted>
The Plasma Cloud PSX10 and Plasma Cloud PSX28 are officially supported by
upstream main. Install their default configuration files to be able to use
poemgr on these devices out of the box.
George Sapkin [Fri, 19 Dec 2025 13:13:39 +0000 (15:13 +0200)]
tar: fix EXTRA_DEPENDS
EXTRA_DEPENDS should be used for version constraints. Change to DEPENDS.
Fixes: 488be84 ("utils/tar: Make compression, acl, and xattr support configuration options") Fixes: 7a49296 ("utils/tar: Fix defaulting to selecting dependencies") Signed-off-by: George Sapkin <redacted>
rlwrap is a 'readline wrapper', a small utility that uses the GNU
Readline library to allow the editing of keyboard input for any
command.
The input history is preserved even across different invocations,
history search and completion are supported
Co-authored-by: George Sapkin <redacted> Signed-off-by: Jeronimo Pellegrini <redacted>
Wesley Gimenes [Sun, 21 Dec 2025 00:35:54 +0000 (21:35 -0300)]
2to3: remove package
This package is only used by `fail2ban`. After updating `fail2ban` to
`1.1.0` (2a202b2091336cd04d58d797021e278ba9d3f5ae), the `2to3` package
is no longer needed. If required, anyone can reintroduce the package.
This is the first `netbird` release that introduces a breaking change[1].
Therefore, versions after the `0.60.x` will not be backported to
OpenWrt 24.10. They will be backported to OpenWrt 25.12, because that
release has not been officially launched yet.
By default netbird now creates/updates[2]
`/etc/ssh/ssh_config.d/99-netbird.conf` for use with `openssh-client`.
OpenWrt uses `dropbear`, and this behavior may cause storage wear.
This behavior has been disabled with `NB_DISABLE_SSH_CONFIG="1"`[3] in the
init file.
Updates Zabbix to 7.0.21-r1 (latest 7.0 LTS version)
Note that for the frontend, clearing browser cache, cookies and other
site data for the zabbix frontend server may be necessary.
Security fixes compared to 7.0.12 (most are frontend only):
* CVE-2025-27238: API hostprototype.get lists data to users with
insufficient authorization https://support.zabbix.com/browse/ZBX-26988
* CVE-2025-27236: User information disclosure via api_jsonrpc.php on
method user.get with param search:
https://support.zabbix.com/browse/ZBX-27060
* CVE-2025-27231: LDAP 'Bind password' field value can be leaked by a
Zabbix Super Admin: https://support.zabbix.com/browse/ZBX-27062
* CVE-2025-49641: Insufficient permission check for the
problem.view.refresh action:
https://support.zabbix.com/browse/ZBX-27063
* CVE-2025-49643: Frontend DoS vulnerability due to asymmetric
resource consumption: https://support.zabbix.com/browse/ZBX-27284
George Sapkin [Sat, 13 Dec 2025 16:19:44 +0000 (18:19 +0200)]
vim: fix config and runtime
- Install shared runtime for both full and fuller.
- Switch big to huge as big is just an alias to normal.
- Fix default config path for tiny variant.
- Use upstream default config for both full and fuller.
- Don't mark default config files for backup.
- Don't mix variant files.
- Mark fuller variant config files for backup.
- Update configure arguments and remove deprecated ones.
- Remove deprecated configuration variables.
- Improve descriptions.
- Fix the following error by installing the missing runtime files for
full and correctly installing the default config for tiny:
E1187: Failed to source defaults.vim
- Fix the following fuller error by installing the missing directory in
runtime:
Error detected while processing /usr/share/vim/vim91/plugin/netrwPlugin.vim:
line 7:
E919: Directory not found in 'packpath': "pack/*/opt/netrw"
Fixes: https://github.com/openwrt/packages/issues/20203 Fixes: https://github.com/openwrt/packages/issues/28104 Signed-off-by: George Sapkin <redacted>
Christian Beier [Fri, 28 Nov 2025 19:28:53 +0000 (20:28 +0100)]
shairport-sync: enable Airplay 2 for -openssl only
https://github.com/mikebrady/shairport-sync/blob/master/
CONFIGURATION%20FLAGS.md#cryptography states that only the OpenSSL
cryptography backend is suitable for Airplay 2.
Further investigation revealed that the pair_ap module within
shairport-sync, which is needed for Airplay 2, does not have an Mbed TLS
backend.
Accordingly, this commit enables Airplay 2 only for the OpenSSL build.
This has the nice side effect that for Airplay 1 the -mini or -mbedtls
versions can be used without pulling in 6 MB of ffmepg libs.
Security:
* CVE-2025-31498. A use-after-free bug has been uncovered in read_answers() that was introduced in v1.32.3. Please see GHSA-6hxc-62jh-p29v
* CVE-2025-62408. A use-after-free bug has been uncovered in read_answers() that was introduced in v1.32.3. Please see GHSA-jq53-42q6-pqr5
Thomas Winkler [Mon, 15 Dec 2025 05:39:41 +0000 (06:39 +0100)]
tang: make sure output and errors are logged to system log
Currently, there is no logging at all, causing difficulties with
troubleshooting. Edit originally proposed by @q-b #26076
(comment) and implemented by @rugk #27401
As with gettext modules described in #28078 and #28075, xml and dom
related module selection affects the dependencies of other packages.
Therefore, we invert the dependency logic:
PHP8_LIBXML and PHP8_DOM are are enabled by default and packages
which depend on libxml2 and --enable-dom=shared are not shown (and
the related configure args are disabled) if the config options are
not enabled.
git.99rst.org / openwrt-packages.git / log