snapcast: add package snapserver and snapclient

Snapcast [1] is a multiroom client-server audio player, where all
clients are time synchronized with the server to play perfectly synced
audio.

It's not a standalone player, but an extension that turns your existing
audio player into a Sonos-like multiroom solution.
Audio is captured by the server and routed to the connected clients.
Several players can feed audio to the server in parallel and clients can
be grouped to play the same audio stream.
One of the most generic ways to use Snapcast is in conjunction with the
music player daemon (MPD) [2] or Mopidy [3].

The inclusion starts with version 0.28.0 because of OpenSSL dependency
issues of version 0.29.0. Newer versions (e.g. 0.32.3, see [4])
with optional OpenSSL support, will be incorporated with flavours,
like "-mini" and "-full" in the upcoming PRs.
More about this topic please check the inclusion PR at [5]!

[1]: https://github.com/badaix/snapcast
[2]: http://www.musicpd.org/
[3]: https://www.mopidy.com/
[4]: https://github.com/badaix/snapcast/blob/develop/changelog.md
[5]: https://github.com/openwrt/packages/pull/23956#discussion_r2330463363

Fixes: #23924
Suggested-by: Tianling Shen <redacted>
Suggested-by: George Sapkin <redacted>
Signed-off-by: Szabolcs Hubai <redacted>

snapcast: add Snapcast from badaix/snapos as is

Add Snapcast package files as is from
https://github.com/badaix/snapos/tree/29a5daebb0513faa825b12474125c0c2dd66c2ee/openwrt/snapcast

Co-authored-by: badaix <redacted>
Co-authored-by: David Andreoletti <redacted>
Co-authored-by: luciferin <redacted>
Signed-off-by: Szabolcs Hubai <redacted>

sumo: add missing fmt dependency

Apparently it's used by sumo.

Signed-off-by: Rosen Penev <redacted>

unzip: add valid patche headers and missing CVE informations

This commit adds a valid git patch header for each patch, so that
additional information can be stored. This is in this case and 'CVE:' tag.
This can be used by CVE scanner to find out if the patch fixes a CVE.

Signed-off-by: Florian Eckert <redacted>

atftp: bump PKG_RELEASE

Bump PKG_RELEASE by one.

Signed-off-by: Florian Eckert <redacted>

atftp: add patch to fix build error

This patch fixes the following compilation build error for gcc14:

tftpd_pcre.c:109:37: error: passing argument 1 of 'pcre2_substring_list_free_8' from incompatible p
  109 |           pcre2_substring_list_free((const PCRE2_UCHAR **)substrlist);
      |                                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      |                                     |
      |                                     const PCRE2_UCHAR8 ** {aka const unsigned char **}
In file included from tftpd_pcre.h:24,
                 from tftpd_pcre.c:35:

I have also submitted the change to the upstream project:
https://github.com/madmartin/atftp/pull/2

Signed-off-by: Florian Eckert <redacted>

atftp: add patch to fix build warning

This patch fixes the following compilation build warning:

logger.c:117:47: warning: format '%li' expects argument of type 'long int', but argument 7 has type
  117 |                fprintf(log_fp, "%s %s %s[%d.%li]: %s\n", time_buf, hostname,
      |                                             ~~^
      |                                               |
      |                                               long int
  118 |                        log_ident, getpid(), pthread_self(), message);
      |                                             ~~~~~~~~~~~~~~
      |                                             |
      |                                             pthread_t {aka struct __pthread *}
logger.c:124:47: warning: format '%li' expects argument of type 'long int', but argument 7 has type
  124 |                fprintf(stderr, "%s %s %s[%d.%li]: %s\n", time_buf, hostname,
      |                                             ~~^
      |                                               |
      |                                               long int
  125 |                        log_ident, getpid(), pthread_self(), message);
      |                                             ~~~~~~~~~~~~~~
      |                                             |
      |                                             pthread_t {aka struct __pthread *}

I have also submitted the change to the upstream project:
https://github.com/madmartin/atftp/pull/2

Signed-off-by: Florian Eckert <redacted>

snort3: update to 3.9.5.0

Changelog: https://github.com/snort3/snort3/releases/tag/3.9.5.0

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc

Signed-off-by: John Audia <redacted>

snort3: fix logic in gpertools-runtime depends

The logic in e57cc9898a362d81e8dec5dd779293e6ff3d4710 was flawed causing
gperftools-runtime to fail to get detected when building resulting in:
...
ninja: Entering directory `/scratch/union/build_dir/target-x86_64_glibc/snort3-3.9.1.0'
ninja: error: '/scratch/union/staging_dir/target-x86_64_glibc/usr/lib/libtcmalloc.so', needed by 'src/snort', missing and no known rule to make it
make[2]: *** [Makefile:161: /scratch/union/build_dir/target-x86_64_glibc/snort3-3.9.1.0/.built] Error 1

It was missed due testing in build root that already had gperftools-runtime
built only discovered when building from a clean build root.

This commit fixes this flaw.

Test:
cat <<EOF > .config
CONFIG_TARGET_x86=y
CONFIG_TARGET_x86_64=y
CONFIG_TARGET_x86_64_DEVICE_generic=y
CONFIG_PACKAGE_snort3=y
EOF

make defconfig
grep gperftools-run .config
CONFIG_PACKAGE_gperftools-runtime=y

cat <<EOF > .config
CONFIG_TARGET_qoriq=y
CONFIG_TARGET_qoriq_generic=y
CONFIG_TARGET_qoriq_generic_DEVICE_watchguard_firebox-m300=y
CONFIG_PACKAGE_snort3=y
EOF

make defconfig
grep gperftools-run .config

Signed-off-by: John Audia <redacted>

openlist: Update to 4.1.2

Release note: https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.2

Signed-off-by: Tianling Shen <redacted>

xray-core: Update to 25.9.5

Release note: https://github.com/XTLS/Xray-core/releases/tag/v25.9.5

Signed-off-by: Tianling Shen <redacted>

v2ray-core: Update to 5.38.0

Release note: https://github.com/v2fly/v2ray-core/releases/tag/v5.38.0

Signed-off-by: Tianling Shen <redacted>

v2raya: Update to 2.2.7.1

Release note: https://github.com/v2rayA/v2rayA/releases/tag/v2.2.7.1

Signed-off-by: Tianling Shen <redacted>

v2ray-geodata: Update to latest version

Update all geodata.

Signed-off-by: Tianling Shen <redacted>

libconfig: update to 1.8.1

Fixes compilation with GCC 15.

Signed-off-by: Rosen Penev <redacted>

v4l2loopback: update to version 0.15.1

update to v4l2loopback 0.15.1

Signed-off-by: Michel Promonet <redacted>

php8: update to 8.4.12

Upstream changelog:
https://www.php.net/ChangeLog-8.php#8.4.12

Signed-off-by: Michael Heimpold <redacted>

realtek-poe: increase version to 1.3

* Add support for RTL8238B

Signed-off-by: Carl-Daniel Hailfinger <redacted>

esp2net: bump to 2025-09-02

Signed-off-by: Nuno Gonçalves <redacted>

sing-box: Properly set only the full variant as default

Adjust the variant definition so that DEFAULT_VARIANT is only applied
to the full variant.
Set the title of the full variant to 'full' for menuconfig.

Signed-off-by: Hannu Nyman <redacted>

gihub: fix PR template broken URL

changes the relative URL in the PR template to an absolute URL
to resolve a "Not Found" error.

Signed-off-by: Wesley Gimenes <redacted>

modemmanager: bump PKG_RELEASE

Bump PKG_RELEASE number.

Signed-off-by: Florian Eckert <redacted>

modemmanager: always reset the init_eps if not configured

The initial EPS is stored on the modem side. When establishing a connection,
it must therefore be deleted if no EPS has been configured. This is because
the system does not know whether one was configured previously.

Signed-off-by: Florian Eckert <redacted>

modemmanager: add missing ppp ifname option value

The pppd supports the option to configure the name of the network interface
at startup using the ifname option.

The pppd can overwrite the name of the network interface at startup using
the 'ifname' configuration option. If this option is not specified, the new
network interface is created according to the following scheme:
ppp<number>, e.g. ppp0, ppp1 and so on. This can therefore change with
every start if the number has been already assigned to another ppp connection.

In order to always get the same interface name with the modemmanger proto via
ppp, it is created according to the new scheme by setting the 'ifname':
ppp-<uci network interface name>, e.g. ppp-wwan.

Signed-off-by: Florian Eckert <redacted>

keepalived: add enabled option

To prevent the keepalived service from starting if there is no valid
configuration yet, the new option enabled is added. This must be set to
true for keepalived to start.

Signed-off-by: Florian Eckert <redacted>

keepalived: only add content to config file if needed

Only add the first two pieces of information to the configuration file if
there is a valid '/etc/config/keepalived'.

Signed-off-by: Florian Eckert <redacted>

keepalived: enable reproducible-build

Before keepalived version '2.3.0' the compilation was not reproducable
because the compile date and other information has been added to the binary.

Starting with version '2.3.0', there is a new compilation option
'--enable-reproducible-build' that makes the binary reproducible.

The data that prevented this has been moved to a separate file,
'/etc/keepalived/keepalived.config-opts'.

This commit enables the reproducable build.

[1] https://github.com/acassen/keepalived/commit/30d2f759783e769c27974d22bab88f7e82dfcdf9

Signed-off-by: Florian Eckert <redacted>

stunnel: update version to 5.75

Bugfixes:
* Fixed infinite loop triggered by OCSP URL parsing errors (thx to Richard Könning for reporting).
* Fixed OPENSSL_NO_OCSP build issues (thx to Dmitry Mostovoy for reporting).
* Fixed default curve selection in FIPS mode with OpenSSL 3.4+.
* Fixed tests with modern Python versions.
* Fixed tests with multiple OpenSSL versions installed.

Features:
* Added provider URI support for "cert" and "key" options.
* Added new "CAstore" service-level option (OpenSSL 3.0+).
* Added "provider" (OpenSSL 3.0+), "providerParameter" (OpenSSL 3.5+), and "setEnv" global options.
* Key file/URI path added to passphrase prompt on Unix.
* PKCS#11 provider installed on Windows.

Signed-off-by: Florian Eckert <redacted>

stunnel: update version to 5.74

Bugfixes:
* Fixed a stapling cache deallocation crash.
* Fixed "redirect" with protocol negotiation.

Features:
* "protocolHost" support for "socks" protocol clients.
* More detailed logs in OpenSSL 3.0 or later.

Signed-off-by: Florian Eckert <redacted>

stunnel: update version to 5.73

Bugfixes
* Fixed a memory leak while reloading stunnel.conf sections with
  "client=yes" and "delay=no".
* Fixed TIMEOUTocsp with values greater than 4.
* Fix the IPv6 test on a non-IPv6 machine.

Features
* HELO replaced with EHLO in the post-STARTTLS SMTP protocol negotiation
* OCSP stapling fetches moved away from server threads.
* improved client-side session resumption.
* Added support for the mimalloc allocator.
* Check for protocolHost moved to configuration file processing for the
  client-side CONNECT protocol.
* Clarified some confusing OpenSSL's certificate verification error messages.

Signed-off-by: Florian Eckert <redacted>

acme-common: cleanup acme start crontab migration

The '/etc/init.d/acme start' crontab migration
should also delete the existing
'/etc/init.d/acme start' line.

Otherwise, on every sysupgrade that carries
forward existing configurations, a new
'0 0 * * * /etc/init.d/acme renew' line is
added to the crontab.

Furthermore, do not add an 'acme renew' crontab
line if it already exists.

Signed-off-by: Satadru Pramanik, DO, MPH, MEng <redacted>

owut: update to 2025.09.03

Bug fixes:
    efahl/owut@5743eea3bcda owut: suppress all but json output when using dump
    efahl/owut@efe39e2e3897 owut: handle sigint (ctrl-c) properly
Enhancements:
    efahl/owut@49e9bce7b8c3 owut: provide download progress for slow connections

Signed-off-by: Eric Fahlgren <redacted>

lksctp-tools: update to 1.0.21

update to 1.0.21

Signed-off-by: Aleksey Vasilenko <redacted>

gperftools: update to 2.17.2

Bump to latest release and removed upstreamed patch.

Resulting libs give a fully functional snort3 which was built against
this new version.

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc (Intel N150 based box)

Signed-off-by: John Audia <redacted>

chrony: update to 4.8

Update chrony to 4.8 and configure chronyc to drop root privileges by
default.

Release notes: https://chrony-project.org/news.html#_27_aug_2025_chrony_4_8_released

Signed-off-by: Miroslav Lichvar <redacted>

mwan3: bump PKG_RELEASE

- fix some problems with GNU sed/grep
- add IPv6-PD src_ip logic

Signed-off-by: Fabian Groffen <redacted>

mwan3: init.d/mwan3: fix GNU grep warning about stray \

GNU grep complains:
  grep: warning: stray \ before :

Drop the \, confirmed with busybox grep backslash is non-significant
(the output is the same).

Closes: https://github.com/openwrt/packages/issues/25198
Signed-off-by: Fabian Groffen <redacted>

mwan3: common.sh: fix src_ip detection for ipv6-PD

IPv6 via PPPoE often receives a prefix, not an address. In that case
mwan3_get_src_ip would not find an address and fall back to ::.  However
in case of multiple IPv6 upstreams, this no longer means a ping (such as
done by uptime check) succeeds, for there are multiple addresses.

With this, mwan3 can effectively load-balance/fail-over on a PPPoE IPv6
prefix and a secondary (LTE) acquired /64 without immediately disabling
the IPv6 prefix interface as soon as the secondary IPv6 interface comes
up.

I think this change is also a fix to #26690
but I'm not 100% sure of that.

Signed-off-by: Fabian Groffen <redacted>

mwan3: common.sh: fix sed syntax for GNU sed

`pq' yields with GNU sed:
  sed: -e expression #1, char 15: extra characters after command
so, make q a separate command instead.

busybox accepts this too, and still returns only the first match (q
quits processing)

Signed-off-by: Fabian Groffen <redacted>

sing-box: add variant tiny

The tiny version disables tailscale by default for small package size.
OpenWrt also has the tailscale package as an alternative. We prefer
to keep the base version has the same build tags with the upstream
releases for compatibility.

Signed-off-by: Van Waholtz <redacted>

sing-box: Update to 1.12.4

changelog: https://github.com/SagerNet/sing-box/releases/tag/v1.12.4

Signed-off-by: Anton P. <redacted>

ruby: update to 3.3.9

3.3.9 release includes the following security fix of default gems:

- CVE-2025-24294: Possible Denial of Service in resolv gem

And the following fixes for build issues:

- GCC 15.1
- Visual Studio 2022 Version 17.14

3.3.7 and 3.3.8 are routine update that includes minor bug fixes.

Signed-off-by: Luiz Angelo Daros de Luca <redacted>

libtorrent-rasterbar: update boost dependencies

libtorrent only links to boost headers since boost 1.69.
Remove boost-system from the dependencies and add boost as build
dependency.

Signed-off-by: Tianling Shen <redacted>

micro: add new package

Modern and intuitive terminal-based text editor

https://micro-editor.github.io

Co-authored-by: Wesley Gimenes <redacted>
Signed-off-by: Gregory Gullin <redacted>

squid: update to 7.1

- Use GitHub for sources URL
- Remove autoreconf fixup (it works out-of-the-box)
- Remove squid-mod-cachemgr package since cachemgr.cgi was removed upstream
- Rename ac_cv_epoll_works to squid_cv_epoll_works to follow upstream
- Don't customize target CFLAGS and LDFLAGS (they work as is)
- Remove nettle configure patch - upstream handles it correctly now
- Remove dummy comment in config menu

Signed-off-by: Aleksey Vasilenko <redacted>

bc: update to 1.08.2

- Remove autoreconf and GCC 15 workaround
- Remove 3 obsolete/upstreamed patches
- Manually rebase no-doc patch

Signed-off-by: Aleksey Vasilenko <redacted>

nginx: update CPE ID

Looking at the official CPE dictionary [1], `cpe:/a:nginx:nginx` was
only used until 1.21.4 inclusively. Later it was renamed to
`cpe:/a:f5:nginx`, and it showed up in a few more non-contiguous
versions numbers after 1.21.4.

In all nginx security advisories [2] starting from year 2024, the CPE
ID used is `cpe:/a:f5:nginx_open_source`. This includes versions 1.25.0
and newer.

Update the CPE ID to the newest known value of `cpe:/a:f5:nginx_open_source`
used in nginx's own security advirosies/CVEs.

[1]: https://nvd.nist.gov/products/cpe
[2]: https://nginx.org/en/security_advisories.html

Signed-off-by: Roman Azarenko <redacted>

ampr-ripd: Initial package release

This project can be used with the OpenWrt SDK to generate a package
for ampr-ripd.  It is intended for use only by licensed amateur radio
operators.  ampr-ripd is a modified RIPv2 listener that provides
route information for ARDC IPIP Mesh tunnels.

Signed-off-by: Dan Srebnick <redacted>

libtirpc: fix build for client packages

Version 1.3.7 introduced a feature which moved symbols into an optional
database section[1]. Add corresponding configure args to fix the build
with our packages. This commit adds the new option to ensure client
packages (snort, rpcbind, lsof, etc.) build without error.

Build system: x86/64 (using external toolchain from snapshot)
Build-tested: x86/64

Co-authored-by: Hannu Nyman <redacted>
Signed-off-by: John Audia <redacted>

rsync: update dependencies for rrsync

- update dependencies from perl to python
- support dropbear

Signed-off-by: Maxim Storchak <redacted>

lsof: fix compilation issue with "libtirpc"

adding --without-libtirpc to CONFIGURE_ARGS + version bump. Ref.: https://github.com/openwrt/packages/issues/27357

Signed-off-by: Ulrich Stark <redacted>

lf: update to r37

https://github.com/gokcehan/lf/releases/tag/r37

Signed-off-by: Nate Robinson <redacted>

django-restframework: assign PKG_CPE_ID

https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:django-rest-framework:django_rest_framework

Signed-off-by: Wei-Ting Yang <redacted>

yt-dlp: bump to 2025.08.22

Changelog: https://github.com/yt-dlp/yt-dlp/releases/tag/2025.08.22
Signed-off-by: George Sapkin <redacted>

telegraf: update to 1.35.4

- Update Telegraf to v1.35.4
- Adjust GO_PKG_LDFLAGS_X to reflect upstream changes in version metadata
- Add default configuration file (Telegraf no longer includes one)
- Drop deprecated tcp_listener and udp_listener plugins from telegraf-small
- Rework how plugins for small variant are specified to reflect upstream changes
- Add -static TARGET_LDFLAGS for MIPS target to avoid R_MIPS_26 relocation errors during build

Signed-off-by: Niklas Thorild <redacted>

adblock-fast: update to 1.1.4-r12

README:
* update header

Init-script:
* set an earlier start to get triggers to work
* better str_contains
* improve readability of json() by getting rid of cascading case statements
* add new errors/status messages to get_text()
* prepare get_text() for localization by switching to inline printf
* adjust shellcheck disable comments where needed
* parse unbound config for DNS hijack ports
* test if the archived cache exists on boot and proceed to use it if it does
* add trigger waiting status so that luci app can display correct status
* do not run adb_config_update on boot, speeding up trigger setup

Signed-off-by: Stan Grishin <redacted>

sing-box: Revert "sing-box: update to 1.12.3"

This reverts commit 002e0559a5f3339fd5232a6e63cc00ce6886b3ab.

sing-box 1.12.3 is apparently buggy and crashes.
Reference to #27346 and #27339
Let's revert the upgrade.

Signed-off-by: Hannu Nyman <redacted>

vips: update to 8.17.1

Upstream list of changes is available at
https://github.com/libvips/libvips/releases/tag/v8.17.1.

Signed-off-by: W. Michael Petullo <redacted>

krb5: update to 1.22.1

Upstream list of changes is available at
https://web.mit.edu/kerberos/krb5-1.22/krb5-1.22.1.html.

Of note is that this release fixes CVE-2025-57736.

Also removes "-std=gnu11" from build.

Signed-off-by: W. Michael Petullo <redacted>

adguardhome: bump to 0.107.65

Changelog: https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.65
Signed-off-by: George Sapkin <redacted>

transmission-web-control: fix mirror hash

Fix hash.

Signed-off-by: Hannu Nyman <redacted>

libtirpc: update to 1.3.7

Release notes: https://sourceforge.net/projects/libtirpc/files/libtirpc/1.3.7/Release-1-3-7.txt

Removed upstreamed patches.

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc (Intel N150 based box)

Signed-off-by: John Audia <redacted>

lm-sensors: fix build with glibc

The lm-sensors build was failing on glibc-based targets with:
  ld: cannot find -liconv: No such file or directory

which occurred because the upstream Makefile unconditionally links
against -liconv, but glibc has iconv functionality built-in and does not
provide a separate libiconv library.

I submitted the new patch upstream to fix this:
https://github.com/hramrach/lm-sensors/pull/14

This change is backward compatible based on my testing building
lm-sensors for x86/64 with glibc and again with musl after having
applied the patch.

Build system: x86/64
Build-tested: x86/64-glibc and x86/64
Run-tested: x86/64-glibc (Intel N150 based box)

Signed-off-by: John Audia <redacted>

poemgr: update to latest HEAD

f1f093852aba poemgr: drop prefix from json-c include
adfb382a996a poemgr: Fix missing/unused includes
27d53374601b Makefile: compile object files before linking
e07fdec5e1cf Makefile: use LDLIBS to link libraries
1e6659b786e8 Makefile: mark targets without any output
f7f147977891 Makefile: reference output file using variable
aa3ae603099a Makefile: Add missing license header

Signed-off-by: Sven Eckelmann <redacted>

v2ray-geodata: Update to latest version

Update all geodata.

Signed-off-by: Tianling Shen <redacted>

rclone: Update to 1.71.0

Removed upstreamed patch.

Release note: https://github.com/rclone/rclone/releases/tag/v1.71.0

Signed-off-by: Tianling Shen <redacted>

openlist: Update to 4.1.1

Release note: https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.1

Signed-off-by: Tianling Shen <redacted>

v2raya: Update to 2.2.7

Release note: https://github.com/v2rayA/v2rayA/releases/tag/v2.2.7

Signed-off-by: Tianling Shen <redacted>

ngtcp2: update to 1.15.0

this time is for real

Signed-off-by: Aleksey Vasilenko <redacted>

linknx: prevent jsoncpp dependency

Signed-off-by: Othmar Truniger <redacted>

transmission-web-control: Update to 20240408

Update to commit f02a47aff2680de10c2269e22a3d0b37a318dbcd
Change TITLE variable to make it easier to understand.

Signed-off-by: Ryan Keane <redacted>

nut: update to 2.8.4

See upstream changelog at
https://networkupstools.org/docs/release-notes.chunked/NUT_Release_Notes.html

New drivers:
* failover
* liebert-gxe
* microsol-apc
* nutdrv_hashx
* powervar_cx_ser
* nutdrv_siemens-sitop
* sms_ser
* bicker_ser
* ve-direct
* nhs_ser
* powervar_cx_usb

Signed-off-by: Sebastian Hamann <redacted>

nut: switch to https:// download URL

Signed-off-by: Sebastian Hamann <redacted>

nut: fix typo in nut_serial.hotplug (fix #21504)

Signed-off-by: Sebastian Hamann <redacted>

ffmpeg: update to 6.1.3

- Remove 2 upstreamed patches

Signed-off-by: Aleksey Vasilenko <redacted>

dufs: backport upstream fixes

Including one security fix.

Signed-off-by: Tianling Shen <redacted>

python3: fix host uuid and ncurses

pkgconfig doesn't work correct for these two packages. Just readd the
proper paths.

Signed-off-by: Rosen Penev <redacted>

nnn: update to version 5.1

Release notes: https://github.com/jarun/nnn/compare/v4.9...v5.1

Signed-off-by: Gregory Gullin <redacted>

gateway-go: update to 2.0.10

- support ipv6 transport for remote access

Signed-off-by: Yu Fang <redacted>

i2csfp: update to latest Git HEAD

This fixes build with GCC15.

Signed-off-by: Jonas Jelonek <redacted>

iodine: use procd, add extra options

Iodine now uses a procd init.d service and output is sent to the system
log.

Two new options have been added:

- debuglevel — increases the verbosity of debug output.

- check_client_ip — controls whether to accept or reject queries from
  different IP addresses for the same login. This should be disabled if
  the recursive DNS server might send queries from varying IPs. However,
  disabling this option also makes replay attacks significantly easier.

Signed-off-by: Luiz Angelo Daros de Luca <redacted>

syncthing: improve relay argument parsing

Fixes: 47644ba46 ("syncthing: fix discovery and relay extra args")
Signed-off-by: George Sapkin <redacted>

syncthing: improve discovery argument parsing

Fixes: 47644ba46 ("syncthing: fix discovery and relay extra args")
Signed-off-by: George Sapkin <redacted>

ariang: bump to 1.3.11

ariang: bump to 1.3.11

Change log is available at https://github.com/mayswind/AriaNg/releases/tag/1.3.11

Signed-off-by: Roc Lai <redacted>

libjpeg-turbo: update to 3.1.1

update to 3.1.1

Signed-off-by: Aleksey Vasilenko <redacted>

clamav: update to 1.4.3

update to 1.4.3

Signed-off-by: Aleksey Vasilenko <redacted>

https-dns-proxy: match updated curl config options

- match updated curl config options

Signed-off-by: Aleksey Vasilenko <redacted>

nghttp2: update to 1.66.0

- Update package description

Signed-off-by: Aleksey Vasilenko <redacted>

nghttp3: update to 1.11.0

- Update package description
- Use CP instead of INSTALL_DATA to copy symlinks properly

Signed-off-by: Aleksey Vasilenko <redacted>

ngtcp2: update to 1.15.0

- Remove superficial libnghttp3 dependency
- Add libopenssl dependency
- Update package description
- Fix leaking lib and includes in libngtcp2_crypto_ossl.pc
- Use CP instead of INSTALL_DATA to copy symlinks properly

Signed-off-by: Aleksey Vasilenko <redacted>

curl: update to 8.15.0

- Merge LIBCURL_NGTCP2 and LIBCURL_NGHTTP3 into single LIBCURL_HTTP3 config option
- Rename LIBCURL_NGHTTP2 to LIBCURL_HTTP2 config option
- Disable IPFS support which is enabled by default
- Refresh a patch

Signed-off-by: Aleksey Vasilenko <redacted>

golang: bump to 1.25.0

Fixes: CVE-2025-47907
Link: https://go.dev/doc/go1.25
Signed-off-by: George Sapkin <redacted>

libzip: update to 1.11.4

update to 1.11.4

Signed-off-by: Aleksey Vasilenko <redacted>

coova-chilli: update to 1.7

Swith to local tarballs for smaller size.

Some patches were merged upstream.

Switch to static instead of attribute constructor. Simpler.

Signed-off-by: Rosen Penev <redacted>

uradvd: provide warning upon disabled configuration

which grants clarity and better traceability.

Signed-off-by: Jan-Niklas Burfeind <redacted>

uradvd: Update to 2025-08-16

Provide four new options:
--valid-lifetime
--preferred-lifetime
--max-router-adv-interval
--min-router-adv-interval

Signed-off-by: Jan-Niklas Burfeind <redacted>

apr: update to 1.7.6

update to 1.7.6

Signed-off-by: Aleksey Vasilenko <redacted>

boost: Updates package to version 1.89.0
This commit updates boost to version 1.89.0

New libraries in this release:
* Bloom [2]: filters, from Joaquín M López Muñoz.

Other Notes:
* Boost.System is now a header-only library [3]

More info about Boost 1.89.0 can be found at the usual place [1].

[1]: https://www.boost.org/users/history/version_1_89_0.html
[2]: https://www.boost.org/libs/bloom/
[3]; https://github.com/boostorg/system/commit/7a495bb46d7ccd808e4be2a6589260839b0fd3a3

Signed-off-by: Carlos Miguel Ferreira <redacted>

libcbor: adjust for cmake 4.x

Cmake 4.x requires 'cmake_minimum_required' to be at least 3.5.
Use 3.30 as the value (current cmake in OpenWrt 24.10).

Signed-off-by: Hannu Nyman <redacted>

treewide: adjust local CMakeLists.txt min version to cmake 4.x

cmake 4.x will require 'cmake_minimum_required' defined in cmake
projects to be at least 3.5. Adjust those local sources where that
variable is currently defined with value below 3.5.

Use 3.30 as the value, as 3.30 is currently used in 24.10, the oldest
still supported OpenWrt release branch.

Signed-off-by: Hannu Nyman <redacted>