Leaving hcxnmealog out is intentional.
It is the GPS/wardriving helper that was split out of hcxdumptool in
6.3.5. It needs a GPS receiver (USB NMEA device such as /dev/ttyACM0,
or gpsd wrapping one) and is not used for the usual handshake/PMKID
capture on a stationary router.
Daniel Golle [Wed, 2 Sep 2026 13:24:53 +0000 (14:24 +0100)]
podman: wire the podman bridges into dnsmasq and fw4
Ship a uci-defaults script that excepts the podman bridges from dnsmasq so
aardvark-dns can own the gateway :53, adds an fw4 zone forwarding the podman
subnets to wan, and reloads both so it also applies on a running system.
Gagan Deep [Wed, 9 Sep 2026 17:09:31 +0000 (17:09 +0000)]
openwisp-config: fetch release tarball instead of git clone
Switch source fetch from git clone to the upstream release tarball
published for every tag, as recommended by the feed guidelines.
This replaces PKG_MIRROR_HASH with a plain PKG_HASH of the
codeload tarball.
Co-authored-by: Federico Capoano <redacted> Signed-off-by: Gagan Deep <redacted>
5130 removed --with-probe-type; generic is the default now, selected by
not passing --enable-hwprobe. Drop 001-uname.patch, upstream took the
`uname -n` change in 5120.
Also set LD back to busybox's "$(CC) -nostdlib": OpenWrt's MAKE_FLAGS
force the raw ld.bfd, which rejects the compiler-driver flags in
OpenWrt's LDFLAGS (-fuse-ld=, -specs=, -flto=) with "-f may not be used
without -shared".
Fixes: https://github.com/openwrt/packages/issues/30083 Signed-off-by: Alexandru Ardelean <redacted>
Daniel Golle [Thu, 10 Sep 2026 14:45:16 +0000 (15:45 +0100)]
cryptsetup: update to 2.8.8
Stable bug-fix release. It avoids a TOCTOU issue in LUKS header restore
by opening the header file only once, hardens BITLK metadata validation
against crafted images, fixes an integer overflow in the anti-forensic
data size calculation on 32-bit systems and a memory corruption in
reencrypt init with more than 16 active LUKS2 keyslots or tokens, and
adds keyed discards to integritysetup (--allow-discards-keyed, Linux
7.3 or later).
Daniel Golle [Thu, 10 Sep 2026 14:33:44 +0000 (15:33 +0100)]
cryptsetup: fix Argon2 with OpenSSL built without it
OpenWrt builds OpenSSL with no-blake2, which OpenSSL's Configure turns
into no-argon2 because Argon2 is built on BLAKE2b. The cryptsetup
configure script only looks for the OSSL_KDF_PARAM_ARGON2_VERSION macro,
which such a build still installs, so it drops the bundled Argon2 and
EVP_KDF_fetch() fails at runtime. Every LUKS2 keyslot using Argon2 then
fails instantly with "Keyslot open failed", and cryptsetup benchmark
reports argon2id as N/A. Add a patch that also checks OPENSSL_NO_ARGON2
so the bundled implementation is used again.
Fixes: fbac2e7861fb ("cryptsetup: update to 2.8.7") Signed-off-by: Daniel Golle <redacted>
- cap the GeoIP lookup at 15 batch requests per report run (ip-api.com rate limit)
- reuse the map data for 60 seconds instead of querying the service again
- log batch requests without geo data
- limit the parallel background jobs exactly to `ban_cores (same as adblock)
- LuCI: fix the GeoIP map description
- readme update
mdns-repeater: bump to 2026.07.16~488feaf7, simplify MAKE_FLAGS
Now that @BKPepe's change to not override CFLAGS is accepted upstream
(geekman/mdns-repeater#28), simplify the Makefile to only pass through
the version string (HGVERSION). All other flags now get forwarded by
default as expected.
nut: fix setting RUNAS and STATEPATH in hotplug scripts
A previous PR missed updating the hotplug scripts for the
new find_runas and find_statepath functions which emit
the value on stdout instead of setting a variable in the
caller's scope. Update that usage and handle error conditions.
Also ensure we fully handle finding the group of the RUNAS user for
the serial usb hotplug case, and handle error conditions for that.
On boot, hotplug events were causing excessive start and stop action
for the upsd daemon and driver daemons. We fix that with two primary
actions:
1. Don't restart service daemons on hotplug until after first boot
has completed.
2. Use more robust handling of procd instance starts by ensuring
that the first start starts the nut-server service and all
others add to the nut-server service (rather than replacing it).
Ignore hotplug events without a DEVNAME.
In addition clean up some logging.
In the process, this fixes #30375 "hotplugging for setting usb access
right[s] doesn't work anymore"
Closes: #30375 Signed-off-by: Daniel F. Dickinson <redacted>
Short-circuit not applicable portions of hotplug script on remove, and
make sure we ignore events with incomplete information (no DEVNAME
or no ACTION).
Josef Schlehofer [Fri, 21 Aug 2026 09:39:59 +0000 (11:39 +0200)]
tvheadend: drop the handwritten version override
The handwritten debian/changelog is only used to override the version
reported by support/version, but it is unnecessary and causes a version
mismatch:
- Build/Prepare feeds the raw git hash into debian/changelog, so the
binary reports ddb984f4c17f4a26fd34f3e1b24e3323f9641b75~openwrt1
instead of the package version 2026.08.17~ddb984f4.
- The CI package test then fails because it cannot find the package
version in the output of any installed executable.
- Without .git, debian/changelog or rpm/version, support/version falls
back to the source directory name.
- OpenWrt already names the source directory tvheadend-$(PKG_VERSION),
so the binary correctly reports 2026.08.17~ddb984f4 without any
override.
Alpine uses rpm/version in the same way and does not encode its own
package release into the version either.
Josef Schlehofer [Fri, 21 Aug 2026 06:54:05 +0000 (08:54 +0200)]
tvheadend: require GNU libiconv and drop the iconv self-test patch
tvheadend has no transliteration of its own. It asks iconv for
"<charset>//TRANSLIT//IGNORE", a GNU extension that musl does not
implement. Converting "ŽluťoučkýKůň" to ASCII on mpc85xx/p2020
(Turris 1.x), musl 1.2.6:
050-iconv-test-continue.patch removed the abort() from the startup
self-test that reports this, so the package could be built against
musl's iconv. That silenced the check without fixing anything:
intlconv_utf8() still returns -EIO, so cleanup_filename() in
src/dvr/dvr_rec.c cannot build a recording file name and
pvr_generate_filename() fails. The charset cannot be avoided either,
because intlconv_filesystem_charset() returns "ASCII" unless $LANG
names a UTF-8 locale, which OpenWrt does not set by default.
Depend on libiconv-full instead of $(ICONV_DEPENDS), which pulls it in
only when BUILD_NLS is set, and point the compiler at its staging prefix
when nls.mk has not already done so. The binary then links against
libiconv.so.2, the self-test passes and the patch can be dropped.
Josef Schlehofer [Fri, 21 Aug 2026 06:53:50 +0000 (08:53 +0200)]
tvheadend: update to 2026-08-17
Update to git master ddb984f4, 124 commits on from the previously
packaged 395afb85. Most of that is web UI work and translation updates,
with smaller fixes in the build system, mpegts and dvr code.
Chris Swan [Wed, 9 Sep 2026 14:03:42 +0000 (15:03 +0100)]
csshnpd: bump to c1.1.1 release
fixed srv segfault on connection teardown (pthread_join clobbered tid)
C daemon filters device atSign out of the manager atSign list
handle the case where the only manager atSign is the device atSign
sshnpd + srv code review findings (24 fixes: bounds checks, leak
fixes, error-path hardening, log hygiene)
bump atsdk to at_c v0.4.1 for the atauth/onboarding
-the trigger calls start refresh, start_service() skips the run
while adblock_status in the runtime file is anything but error
- a missing or unreadable runtime file still starts a run,
which covers the boot case, and a failed run is retried on the next interface event
- manual start, boot, restart and reload are unaffected;
a suspended or stopped adblock is no longer restarted by an interface event
- wan6 in adb_trigger is supported now
- updatted the README and moved to the package root
- LuCI: reworked the feed editor, get rid of custom css
This commit updates the dnsdist package from 2.0.6 to 2.0.9,
fixing several issues including CVE-2026-42005, CVE-2026-40011,
CVE-2026-40211, CVE-2026-40210, CVE-2026-40209, CVE-2026-40208,
CVE-2026-42004 and CVE-2026-52682.
This commit updates the PowerDNS authoritative server to 4.9.17,
the latest release in the 4.9.x LTS branch.
This fixes several security issues, including but not limited to:
CVE-2026-33257, CVE-2026-33260, CVE-2026-33611, CVE-2026-33610,
CVE-2026-33609, CVE-2026-33608, CVE-2026-42002, CVE-2026-42001,
CVE-2026-42000, CVE-2026-41999, CVE-2026-42396, CVE-2026-42005,
CVE-2026-52682.
Mark Abe [Sun, 6 Sep 2026 22:45:53 +0000 (00:45 +0200)]
tcfilter: add package for persistent tc ingress filters
UCI front-end that installs raw "tc filter ... ingress" expressions on
network devices at boot and re-applies them on ifup, removing them on
stop. The match/action part is entered verbatim as tc syntax; the
package manages the device, the preference number, enable/disable and
persistence. A procd reload trigger re-applies on config changes.
Intended for driving hardware tc-flower offload (e.g. the Realtek DSA
PIE offload) where no higher-level configuration layer exists.
Co-authored-by: OpenWrt AI review account <redacted> Assisted-by: Claude Code (Anthropic Claude Sonnet 5) Signed-off-by: Mark Abe <redacted>
- f_getup() collects the wan state in one pass and diffs the uplink against
the local allowlist
- new f_refresh() patches only the changed allowlist Set elements
in a single atomic nft transaction, without touching the running instance
- the procd trigger calls start refresh, start_service() picks the path, a manual start is unaffected
- wan6 in ban_trigger is supported now
- updatted the README and moved to the package root
- LuCI: reworked the feed editor, get rid of custom css
Daniel Golle [Mon, 7 Sep 2026 18:26:54 +0000 (19:26 +0100)]
fwupd: backport upstream support for MxL862xx switches
Backport two patches from upstream implementing devlink-based firmware
update support for the MaxLinear MxL862xx DSA switch family, found eg.
on the BananaPi R4 Pro (8E/4E).
Users can update the switch firmware using `fwupdmgr update`.
Refresh PKG_HASH from the tag tarball. Upstream moved from
keplerproject to lunarmodules and the 2.7.0 tag has no leading v;
point PKG_SOURCE_URL and the homepage URL at lunarmodules.
- *Per-policy `action`, `route` (default) or `bypass` - the equivalent of pbr's `ignore`,
an exception carved out of every policy below it.
- `keep_local`, default on - a marked packet to one of your own subnets
stays on `main` instead of taking the policy's default route.
- The ruleset is re-applied when the table is deleted - e.g. with `/etc/init.d/firewall stop`
- README update
- do not set trm_action in the function library; the library is sourced by the init script,
reported by @sch-m
- fixed the uplink ssid comparison for fancy essids with quotes
- added a new optional per uplink revive option; an uplink disabled by the retry limit is set back
to enabled after n run cycles, default off, minimum 10, number of revivals capped by trm_maxretry.
Counters live in a runtime file, no extra config writes
- update the wifibahn login script, support the new CNA portal API
- LuCI: rework the wireless scan dialog; card list instead of the result table, mobile friendly
- LuCI: add the per uplink revive option to the uplink dialog (off / 10 / 30 / 60 run cycles)
- readme update
Florian Eckert [Wed, 24 Jun 2026 15:00:01 +0000 (17:00 +0200)]
curl: add krb5 support
Enable Kerberos authentication support in curl by including krb5-libs.
This allows curl to handle GSSAPI/Kerberos authentication protocols,
enhancing compatibility with enterprise environments.
The feature is disabled by default to avoid unnecessary dependencies.
Jimmy Qin [Fri, 13 Feb 2026 19:25:40 +0000 (20:25 +0100)]
ddns-scripts: update hotplug script
To handle ip address changing by ifupdate.
When the ipv6 address is updated for an interface
(some ISP only give dynamic ipv6 address).
The ddns script will go into dead loop,
as the new ipv6 address is not used.
The simple change is restarting ddns when ip address is changed.
Dengfeng Liu [Sun, 6 Sep 2026 04:17:53 +0000 (12:17 +0800)]
apfree-wifidog: update to 9.09.2938
Highlights of this release:
- eBPF captive DNS fast-answer: LAN DNS queries for captive detection
domains are answered at wire speed from a pinned BPF map (default
1.1.1.1) while the query still reaches dnsmasq, so captive portal
detection works when the router is offline
- Real IPs are learned back into the map from snooped upstream DNS
responses; the dnsmasq aw-captive-domains-hosts mechanism and its
restart dance are removed (one-time migration at startup)
- Always start HTTP/HTTPS service threads (fix dangling gencb arg);
sync trusted MACs into eBPF mac_map; portal DNS consumer
auto-reconnects when aw-bpf reloads
Maintainer: me
Compile tested: aarch64_cortex-a53 (chawrt 25.12 / OpenWrt snapshot)
Handling uci-defaults scripts in package postinst is not needed in
modern OpenWrt and in fact results in error messages on install since
the common postinst processes and deletes uci-defaults scripts before
package-specific postinsts are executed.
Therefore remove the unneeded postinsts in this package.
Version 1.34.7 includes the following security fixes:
* CVE-2026-33630 (GHSA-6wfj-rwm7-3542): fix a use-after-free /
double-free issue in query-completion handling.
* CVE-2026-69184 (GHSA-pjmc-gx33-gc76): limit DNS name compression
pointer traversal to prevent CPU-exhaustion denial of service.
* CVE-2026-69186 (GHSA-jv8r-gqr9-68wj): validate DNS record counts
before allocation to prevent memory-amplification denial of service.
It also fixes the UDP socket exhaustion regression introduced in 1.34.6.
Version 1.34.8 reverts an unintended API break introduced in 1.34.7 by
the callback parameter const changes.
George Sapkin [Wed, 2 Sep 2026 12:30:14 +0000 (15:30 +0300)]
golang: add support for host-only version series
Support configuring major version series as host-only (i.e. no target
packages) to reduce strain on buildbots in release branches. The goal is to
have one major target series and multiple host-only ones. E.g. 25.12 uses
1.26 as the default host/target series and 1.27 and beyond as host-only for
packages that require these.
Josef Schlehofer [Sun, 16 Aug 2026 10:40:23 +0000 (12:40 +0200)]
librespeed-common: add measurement backend
Add a common backend for running librespeed-cli measurements on a router.
The package provides a locked measurement runner, live progress state, and
an rpcd ucode plugin exposing start/stop/status/result/history/config over
ubus. Scheduled measurements are managed through cron and can run within a
configurable time window. Optional daily aggregation keeps longer-term
history compact.
Raw measurements are kept in JSONL for a configurable retention period.
When persistent archive storage is configured, completed days are reduced
to daily min/avg/max values.
Daniel Golle [Wed, 2 Sep 2026 14:15:02 +0000 (15:15 +0100)]
libdht: update to 2026-09-01
Two fixes to the maintenance and search timers, both of which cost a
node contacts it should have had.
Neighbourhood maintenance for both address families was gated on a
single flag that either family's bucket maintenance could set. Bucket
maintenance only confirms nodes that are already known, while
neighbourhood maintenance is what grows the table, so a family whose
nodes never answer held back table growth for the other family too. A
node with no route for one family still holds addresses of that family,
because they arrive in the replies of the other, so this reaches any
single-stack node on a dual-stack build. Each family is now gated on
its own bucket maintenance, and the number of queries per round is
unchanged.
A search step scheduled for exactly its due second returned without
sending anything, because the comparison required the second to have
passed rather than arrived. The early return left the step time alone,
so the search then waited another full interval having sent nothing.
Reset PKG_RELEASE, since the source version changed.
Keith T. Garner [Tue, 11 Aug 2026 19:17:59 +0000 (14:17 -0500)]
ddns-scripts: add gandi pat support
Gandi has deprecated Api Key for authentication and replaced it with
Personal Access Tokens. This adds a v2 gandi package containing a script
using the new authentication scheme while keeping the old version intact
for any existing API Key users. Additionally, it documents the old
version as deprecated and points users to v2.
Daniel Golle [Mon, 31 Aug 2026 23:27:47 +0000 (00:27 +0100)]
libjuice: fix SHA-1 on big-endian targets
libjuice's vendored picohash guards the final byte-order swap in
_picohash_sha1_final with SHA_BIG_ENDIAN, which nothing defines, while
endianness is detected into _PICOHASH_BIG_ENDIAN. On big-endian targets
the swap runs when it must not and every SHA-1 digest is emitted with each
32-bit word reversed, taking HMAC-SHA1 with it.
libjuice uses HMAC-SHA1 for STUN MESSAGE-INTEGRITY, so on mips, mips64,
powerpc and every other big-endian target each ICE connectivity check is
rejected as failing integrity. No candidate pair is nominated and no
session can be established. picohash is the default backend, as USE_NETTLE
is off, so this affects the package as built here.
Verified on lantiq/xrx200 (mips_24kc, MIPS 34Kc): before the patch an ICE
agent loops with "STUN integrity check failed" and never leaves the
connecting state; after it the agent reaches completed and a session comes
up over the DHT and ICE. RFC 2202 HMAC-SHA1 test case 1 and the SHA-1
vector for "abc" both fail before and pass after.
Submitted upstream as paullouisageneau/libjuice#353 and, for the vendored
copy's origin, kazuho/picohash#13.
Daniel Golle [Wed, 19 Aug 2026 06:33:41 +0000 (07:33 +0100)]
conmon: fall back to the runtime's exit status file
conmon learns a container's exit status by waiting for the pid it reads from
the runtime's --container-pidfile, which only works while the container is
conmon's own child. With ujail the container belongs to procd, so conmon has
nothing to wait for: it probes the pid with kill(pid, 0), finds it gone and
settles for a status of zero, as its own comment admits. podman then reports
0 for a container that exited 42, and an exec session that succeeded looks
like a failure.
Add a patch letting the runtime supply what conmon cannot observe: ujail
writes the status to an exit_status file beside the pid file, and conmon
adopts it in the one place it would otherwise guess. A runtime whose
container conmon does reap is unaffected, since no such file exists there.
020-fall-back-to-runtime-exit-status-file.patch also picks up two
fixes review caught: the fallback to a status of 0 now waits up to a
tenth of a second in 10ms steps for the runtime to finish writing the
file, since the runtime can only write it after the kernel has
already reaped the container and made the pid stop answering conmon's
probe, so either order is possible; and a status file is only trusted
if it is at least as new as the pid file, so a stale one left by an
earlier container in the same directory is ignored. Its header also
lost the `diff --git`/`index` lines and `git format-patch` version
trailer that don't survive `make package/conmon/refresh`, which is
what CI's "Dirty patches detected" check was catching on every
architecture. Verified via a scratch quilt tree against the pristine
2.2.1 source that the refreshed patch applies cleanly and stays
stable under a second refresh, and that the patched ctr_exit.c and
ctr_stdio.c both syntax-check clean against host glib.
Daniel Golle [Thu, 20 Aug 2026 13:58:34 +0000 (14:58 +0100)]
lvm2: update to 2.03.42
LVM2 2.03.42:
- add --lockopt retries=N / removeretry=SECONDS to lvmlockd
- use lockd_lv lock probes for pvmove holder availability in shared VGs
- auto-revert metadata when initial pvmove mirror activation fails
- refuse activation of a pvmove-locked LV when pvmove runs on another
node; allow pvmove --abort without args when using lvmlockd
- add cluster lock lifecycle for pvmove LV in shared VGs, and support
for pvmove in a shared VG
- allow lvremove -f to remove pvmove-locked LVs after an interrupted
pvmove; handle active pvmove during vgchange -an with force flags
- fix pvmove completion to use suspend+resume for DM table reload; fix
deactivation cascade during active pvmove
- support inactive LVs in pvmove with metadata-only mirror insertion;
kill orphaned polling process on pvmove --abort
- support formatting vdo volumes with the kernel vdo target (>=9.2);
fix VDO index_memory_size_mb quantisation and report the minimum
required pool size
- add --enable-asan/--enable-tsan build options
device-mapper 1.02.216:
- make libdm thread safe
- add use_kernel_format to dm_vdo_target_params
- introduce libdevmapper-san with --enable-asan/--enable-tsan
- parent table force reload when child device table changes
Refreshed 002-const-stdio.patch and 003-no-mallinfo.patch against the
new upstream source (make package/lvm2/refresh; hunk offsets only, no
content change) and gave both a proper git-am header block (From/Date/
Subject/Signed-off-by), crediting their original authorship (Daniel
Golle, 2015) with an accurate subject/body; they previously had none,
which the CI formality bot flagged. The header block was drafted via
git format-patch against a scratch commit of the pristine source, then
the whole patch re-refreshed through quilt so the diff body matches
what make package/lvm2/refresh actually produces byte for byte -
format-patch output alone does not survive OpenWrt's own refresh
(diff --git/index lines and full @@ context get stripped, the
trailing signature dropped), which is what the CI patch-format check
was rejecting before this.
CONTRIBUTING.md: add pointers to LLM review prompts
If you have questions about what is expected of a pull request, and there is
no specific documentation for your case, or the comments from a reviewer seem
at odds with the documentation you have found, it can be useful to refer to the
prompts given to the automated LLM reviewer. Therefore add those pointers to the
CONTRIBUTING.md document
net/acme-acmesh: prevent concurrent execution of acme.sh instances
After switching ACME to being run through procd, individual ACME
instances are now executed in parallel instead of sequentially. This
causes acme.sh to become confused in certain cases. Petr reported that
certificate files ended up with the wrong contents after updating to
OpenWrt 25.12.
Fix this by wrapping the acme.sh execution in a global `flock` keyed on
a file in the state directory. The procd instances will still run in
parallel, but they'll all serialise on the same lock, so only one
acme.sh instance will run at a time.
Fixes: 76b676e4ebbb ("acme.sh: move to procd to ensure logging gets to syslog") Reported-by: Petr Novák <redacted> Signed-off-by: Toke Høiland-Jørgensen <redacted>
Eric Fahlgren [Mon, 31 Aug 2026 02:00:54 +0000 (19:00 -0700)]
owut: update to 2026.08.30
efahl/owut@9b51eeec3ec3 owut: refactor image type extraction
efahl/owut@7185daa0a1bb owut: include raw board in device info
efahl/owut@2fab581877f3 owut: allow to append apk repositories to build requests
Samuele Longhi [Tue, 25 Aug 2026 11:14:53 +0000 (13:14 +0200)]
owut: remove comments and empty lines from the built package
This allows to save some bytes, while preserving the scripts's
copyright and license information.
In owut at current ref db17536ec5cbcc6a76a51e65f3d192b6a2184abb
the reduction in the size applied to the source code is (e.g. without
the computed "s/%%VERSION%%/$(PKG_VERSION)-r$(PKG_RELEASE)/"):
Nick Hainke [Wed, 19 Aug 2026 10:04:17 +0000 (12:04 +0200)]
uneighbord: add uneighbord
uneighbord synchronizes hostapd 802.11k Neighbor Reports between local
`hostapd.*` BSSes and other OpenWrt access points on the same LAN, over
IPv6 link-local UDP multicast. Reports are only shared between BSSes with
the same SSID, and installed through hostapd's ubus API.
git.99rst.org / openwrt-packages.git / log