nut: simplify/improve consistency for RUNAS and STATEPATH
We claimed we only supported a single upsd section named 'upsd' and a
single uspmon section named 'upsmon', but when determining RUNAS
and STATEPATH we were using overly-complex functions as we were
attempting to support multiple upsd and upsmon sections.
Simplify the logic by adhering to our stated support.
While were are at it we make RUNAS handling more consistent between
nut-server (upsd) and nut-monitor (upsmon).
We no longer try to limp along if RUNAS is not set by find_runas; to do
this properly would require over-complicated logic when setting file
and directory permissions and ownership.
nut: do not trigger on interface activity by default
The defaults were triggiering on any activity on the network, which
caused excessive restarts. So default to no interface trigger, with
'all' (or specific interfaces) as an option.
See https://github.com/openwrt/packages/pull/29607#discussion_r3463553192
While driverpath is could in theory be configurable, this was not implemented
in the OpenWrt NUT package, and there is not need for it. Therefore remove the
sample configuration for it, and setting that configuration in the upsd.conf file.
See https://github.com/openwrt/packages/pull/29607#discussion_r3463526037
We should fallback to the default if one is not specified. In addition
find_statepath is the wrong place to check for its existence - it should
be created by the initscript if it does not exist.
See https://github.com/openwrt/packages/pull/29607#discussion_r3462976647
Fabrice Fontaine [Wed, 17 Jun 2026 15:23:39 +0000 (17:23 +0200)]
utils/hplip: fix CPE ID
hp:linux_imaging_and_printing is a better CPE ID than
hp:linux_imaging_and_printing_project as this CPE ID has the latest CVE
(whereas hp:linux_imaging_and_printing_project only has CVEs up to
2013):
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:hp:linux_imaging_and_printing
Daniel Golle [Mon, 13 Jul 2026 11:45:18 +0000 (12:45 +0100)]
fwupd: allow enabling the devlink plugin
The devlink plugin allows updating firmware of network devices
implementing the kernel devlink interface. It is gated on libmnl,
which was hard-disabled so far. Wire the libmnl meson option to a
new FWUPD_PLUGIN_DEVLINK config symbol, enabled by default, and add
the corresponding libmnl runtime dependency to fwupd-libs.
stress-ng: add config menu to select external libraries
Backport upstream e0c4d324a, which lets a LIB_* variable be emptied to skip
that library's check. Drop 001-disable-extra-stressors.patch, which hardcoded
the same choice, and drive it from a Config.in menu instead. Defaults keep the
previously built set of stressors: only crypt, aio, bsd, jpeg, kmod, sctp and
zlib are probed. apparmor, EGL, GBM, GLES2, IPSec_MB and Judy have no OpenWrt
package, so they are never probed. Drop the backport once it is in a release.
stress-ng: link libatomic instead of disabling atomics
Drop 002-disable-atomics-mips-and-ppc.patch. It papered over link errors for
64-bit atomics on MIPS and PPC, which happen because stress-ng strips -latomic
whenever $(CC) matches "musl-gcc" -- as our cross toolchains do. Pass
LIB_ATOMIC=-latomic instead; libatomic is already in DEPENDS. Its stress-fractal
hunk was in any case dead since upstream 24c30b7fa narrowed the row counter back
to int32_t, which MIPS32 and PPC32 increment atomically inline.
nantayo dev [Thu, 2 Jul 2026 03:09:35 +0000 (11:09 +0800)]
podman: update to 5.8.4
- fix PKG_SOURCE_URL
Podman repository has been transferred from containers to podman-container-tools
- update package version
changelog see: https://github.com/podman-container-tools/podman/releases/tag/v5.8.4
zabbix: remove dependency on symbol ZABBIX_ENABLE_ZABBIX
It results a failure to build due to
https://github.com/openwrt/gh-action-sdk/issues/70. This means there will be some
ZABBIX symbols in .config eveen when ZABBIX is not selected, but this is a
necessary tradeoff. See
https://github.com/openwrt/packages/pull/29803#issuecomment-4882201182.
* The Makefile was using an overly clever means to be compact that the
CI webhook, and possibly the CI test container, didn't understand. We
unroll that logic, and have more usual install and conffiles sections.
In the process we fix a missing conffile install for zbbix-proxy*
packages.
Changelog:
Changes from 1.5 to 1.5.1
-------------------------
* Rename public register definitions on x86 and x86_64 to avoid clashing
with glibc definitions when built in freestanding mode.
Patch contributed by Daan De Meyer.
Changes from 1.4 to 1.5
-----------------------
* Workaround various header compatibility issues in glibc and bionic.
* Allow ppc64 target to be built in freestanding mode.
Changes from 1.3.3 to 1.4
-------------------------
* Add hard-float support to most architectures where relevant.
Some patches contributed by Richard Campbell.
Changes from 1.3.2 to 1.3.3
---------------------------
* Use `bl` instruction instead of explicit GOT lookup for `exit`
in 64-bit PowerPC assembly.
* Fix installation path for standalone libucontext headers.
Patch contributed by Marian Buschsieweke.
* Fix missing includes for freestanding builds.
Patch contributed by David Leeds.
Makefile:
Disabled documents.
Added glibc supports, and remove hardcoded musl dependency.
Put test_libucontext_posix only available in musl runtime.
Both patches still apply unchanged and remain necessary: upstream's library
list is unchanged, and stress-misaligned.c still only disables atomics on PPC
for gcc < 5.0 while stress-fractal.c has no arch guard at all.
fluent-bit: update to 5.0.8, adopt maintainer, fix musl startup segfault
Update 4.2.0 -> 5.0.8 and adopt maintainership. fluent-bit segfaulted at
startup on every musl target: under GCC 14 the upstream C-TLS probe no longer
compiles (undeclared __tls_get_addr), so the pthread_key fallback calls
pthread_getspecific() before pthread_key_create() and derefs a NULL tsd array
on musl (glibc is unaffected). Force -DFLB_HAVE_C_TLS=Yes for __thread TLS.
strongswan: add one default named ipsec uci section 'globals'
The UCI section 'ipsec' should only be available once, as these are
general settings for 'strongswan.conf'. It makes no sense to configure them
more than once. To ensure that the general settings can also be configured
via LuCI, this section must be present at least once.
For configurations already in the field, a uci-default script is added
that assigns the name 'globals' to the last ipsec section type.
Florian Eckert [Thu, 25 Jun 2026 11:13:27 +0000 (13:13 +0200)]
strongswan: use procd running check
Instead of using the standard procd check, the function is overridden, and
the check to see if the service is running is performed using the command
'swanctl --stats > /dev/null 2>&1'. The problem with this is, that this
call is blocking if the strongswan charon socket is not available. The call
does not return until the timeout has expired.
This block does not occur if we use the standard behavior of procd, which
checks whether the service it started is actually running. This change
therefore uses the standard call via procd, which returns the value without
blocking.
libdrm: skip the generic version check for the whole package
libdrm-tests ships DRM tools (modetest, proptest, ...) with no --version flag,
so the generic probe aborts with "No executables in the package provided
version" and fails CI. test-version.sh is shared by every subpackage built from
this directory and a non-zero exit fails it, so it must accept the whole family
(the libraries ship no executables either) -- hence libdrm*, not just libdrm-tests.
- convert the patch to a make option
- Add -J/-j options for JSON and JSON Lines output format.
- lsof_free_result(): handle result == NULL
- Fix missing parenthesis in lstat error message format
- Fix use-after-free in lsof_select_process_regex
- Fix truncated fd numbers in -F field output
- Display connection state for UDP sockets with -T option
Jiang Tengfei [Fri, 26 Jun 2026 14:33:29 +0000 (22:33 +0800)]
ddns-scripts: support version output in frontend
The /usr/bin/ddns frontend did not support a version option, so
generic package tests treated it as an executable that could not report
the package version.
Read the installed version file and support -V/--version, matching the
version output style used by dynamic_dns_updater.sh.
Jiang Tengfei [Fri, 26 Jun 2026 14:33:11 +0000 (22:33 +0800)]
ddns-scripts: add curl source IP bind fallback
Keep the existing cURL bind_network behavior of binding to the
logical device first. This preserves the behavior introduced for
PPPoE and multi-WAN setups where the selected network must also be
used for the DDNS update request.
Some setups can still fail when libcurl binds directly to the logical
PPP device. In that case the transfer may time out even though binding
to the source address of the same network succeeds. This can make DDNS
updates fail repeatedly on affected systems.
Retry cURL transfers once with the network source IP when the
device-bound transfer fails. This leaves the normal path unchanged,
keeps the update request on the same network, and matches the existing
GNU Wget behavior which already binds to the network IP address.
Also document the implicit bind_network default and the cURL fallback
in the sample configuration.
Features optimized datastore YANG validation including incremental
validation, a reduced XML config footprint, configurable datastore
cache, many bugfixes and a prototype gRPC/gNMI implementation.
Jan Klos [Wed, 1 Jul 2026 09:49:54 +0000 (11:49 +0200)]
nginx: update to 1.30.3
Fixes buffer overflow vulnerability in ngx_http_proxy_v2_module & ngx_http_grpc_module
(CVE-2026-42055) and buffer overread vulnerability in ngx_http_charset_module (CVE-2026-48142).
treewide: homogenize references to libfts for MUSL
The way we use -lfts isn't particularly consistent. There's no reason
it shouldn't be. glibc users shouldn't have to deal with someone else's
lack of rigor.
avahi: define missing DEFAULT_VARIANT and add conflicts
- Add DEFAULT_VARIANT to "avahi-daemon" and "libavahi" virtual packages;
set to "dbus" variant because it is more compatible.
When some package depends on one of these virtual packages an arbitrarily
variant it is selected. This avoids that.
- Add conflicts in order to avoid mixing packages with different variants
(when defining a DEFAULT_VARIANT the conflicts definition should be on
that side of the dependency to avoid recursive dependencies).
- Avoid building unused "dbus" dependency.
Fixes: ASU sysupgrade problem with avahi packages https://forum.openwrt.org/t/luci-attended-sysupgrade-support-thread/230552/137 Fixes: https://github.com/openwrt/packages/commit/9bc03b9d9971c2f1e146f7c2d287d1fc16e776f0 Signed-off-by: Mario Andrés Pérez <redacted>
Bump from the 0.9-rc4 pre-release to 0.9-rc5. Update PKG_VERSION,
PKG_SOURCE, PKG_SOURCE_URL, PKG_BUILD_DIR and PKG_HASH accordingly.
The two carried patches (010-pkgconfig, 020-no-po-subdir) still apply
unchanged, and test-version.sh already normalises the underscore in the
apk version (0.9_rc5) back to the upstream 0.9-rc5 string.
The nftables rule in acme-common partially works, but it races against the
acme.sh and uacme client. While the client is performing the renew the rule
is being deleted because the client is run in the background. This change
moves the rule management to the hook instead. While duplicate rules could
be created, the benefits outway the potential costs. It is unknown how many
installations issue/renew multiple certificates.
While at it, we synchronized .github/formalities.json with the current
default settings of the webhook bot.
Since the bot is shared across all OpenWrt repositories, the stale PR
cleanup is disabled by default at the repository level. Because this
repository wants to use stale triage, we explicitly enable it here.
- feeds: fixed the games_tracking feed URL
- f_etag: added housekeeping of the etag file
- f_etag: added 'last-modified' header as fallback for change detection
- small fixes & optimizations
Josef Schlehofer [Tue, 30 Jun 2026 06:15:38 +0000 (08:15 +0200)]
contributing: update CI section with current test infrastructure
Update the Continuous Integration section to reflect the current state:
- Update the list of runtime-tested architectures (add i386_pentium-mmx
and mips_24kc, remove outdated i386_pentium4)
- Document the generic test suite (executable, version, hardcoded path,
strip, linked library, and SONAME checks)
- Add documentation for test-version.sh (version check override) and
pre-test.sh (pre-test setup) scripts alongside the existing test.sh
- Document available environment variables (PKG_NAME, PKG_VERSION,
CI_HELPERS) for test scripts
git.99rst.org / openwrt-packages.git / log