Josef Schlehofer [Sun, 10 May 2026 20:58:19 +0000 (22:58 +0200)]
treewide: fix dangling SONAME symlinks when using ABI_VERSION
A previous commit attempted to introduce proper SONAME symlinks for
packages utilizing ABI_VERSION. However, it incorrectly copied only
the symlink without the underlying physical library file, resulting
in broken packages with dangling symlinks.
Before:
```
tar -Oxzf bin/packages/arm_cortex-a9_vfpv3-d16/packages/oniguruma_6.9.9-r1_arm_cortex-a9_vfpv3-d16.ipk ./data.tar.gz | tar -tzvf -
drwxr-xr-x 0 0 0 0 Feb 5 2024 ./
drwxr-xr-x 0 0 0 0 Feb 5 2024 ./usr/
drwxr-xr-x 0 0 0 0 Feb 5 2024 ./usr/lib/
lrwxrwxrwx 0 0 0 0 Feb 5 2024 ./usr/lib/libonig.so.5 -> libonig.so.5.4.0
```
After:
```
tar -Oxzf bin/packages/arm_cortex-a9_vfpv3-d16/packages/oniguruma_6.9.9-r1_arm_cortex-a9_vfpv3-d16.ipk ./data.tar.gz | tar -tzvf -
drwxr-xr-x 0 0 0 0 Feb 5 2024 ./
drwxr-xr-x 0 0 0 0 Feb 5 2024 ./usr/
drwxr-xr-x 0 0 0 0 Feb 5 2024 ./usr/lib/
lrwxrwxrwx 0 0 0 0 Feb 5 2024 ./usr/lib/libonig.so.5 -> libonig.so.5.4.0
-rwxr-xr-x 0 0 0 526493 Feb 5 2024 ./usr/lib/libonig.so.5.4.0
```
This properly standardizes shared library packaging, prevents shipping
duplicate full-sized files (as seen previously in packages like libre2),
and aligns the packages feed with core OpenWrt practices.
As you could see in the previous commit (see it in the ``Fixes`` tag):
Before:
```
tar -Oxzf bin/packages/arm_cortex-a9_vfpv3-d16/packages/re2_2023.02.01\~b025c6a3-r1_arm_cortex-a9_vfpv3-d16.ipk ./data.tar.gz | tar -tzvf -
drwxr-xr-x 0 0 0 0 Aug 18 2024 ./
drwxr-xr-x 0 0 0 0 Aug 18 2024 ./usr/
drwxr-xr-x 0 0 0 0 Aug 18 2024 ./usr/lib/
-rw-r--r-- 0 0 0 331875 Aug 18 2024 ./usr/lib/libre2.so
-rw-r--r-- 0 0 0 331875 Aug 18 2024 ./usr/lib/libre2.so.10
-rw-r--r-- 0 0 0 331875 Aug 18 2024 ./usr/lib/libre2.so.10.0.0
```
After:
```
tar -Oxzf bin/packages/arm_cortex-a9_vfpv3-d16/packages/re2_2023.02.01\~b025c6a3-r1_arm_cortex-a9_vfpv3-d16.ipk ./data.tar.gz | tar -tzvf -
drwxr-xr-x 0 0 0 0 Aug 18 2024 ./
drwxr-xr-x 0 0 0 0 Aug 18 2024 ./usr/
drwxr-xr-x 0 0 0 0 Aug 18 2024 ./usr/lib/
lrwxrwxrwx 0 0 0 0 Aug 18 2024 ./usr/lib/libre2.so -> libre2.so.10
lrwxrwxrwx 0 0 0 0 Aug 18 2024 ./usr/lib/libre2.so.10 -> libre2.so.10.0.0
-rwxr-xr-x 0 0 0 331875 Aug 18 2024 ./usr/lib/libre2.so.10.0.0
```
Fixes: 537c2a631dd117564720a80f6976280901b010f5 ("treewide: avoid deref symlinks when installing .so") Signed-off-by: Josef Schlehofer <redacted>
Andy Chiang [Mon, 18 May 2026 16:56:53 +0000 (23:56 +0700)]
qemu-ga: skip starting on bare metal device
The same firmware image may be deployed on either bare metal device or
virtualized platforms (e.g., Proxmox VE).
On bare metal device, `qemu-ga` may still be started even though no
virtio-serial channel is available, resulting in repeated attempts to
access /dev/virtio-ports/org.qemu.guest_agent.0.
This causes continuous service respawning by procd and unnecessary log
spam.
This commit adds a pre-check for /dev/virtio-ports to avoid starting
`qemu-ga` when virtio-serial support is not present.
Andy Voigt [Sun, 10 May 2026 19:36:29 +0000 (21:36 +0200)]
libsml: add new package
libSML implements the Smart Message Language protocol used by German smart
meters (FNN specification). It is used by projects like volkszaehler for
reading smart meter data.
Fotios Kitsantas [Tue, 19 May 2026 18:39:50 +0000 (19:39 +0100)]
ddns-scripts: add blazingfast.io Anycast DNS provider
Add DDNS update support for blazingfast.io Anycast DNS via their
REST API. Authentication is performed via JWT token obtained from
the login endpoint. Zone records are fetched to verify the record
type before update, ensuring IPv4 services only target A records
and IPv6 services only target AAAA records.
Service, zone and record IDs are passed via param_opt as
space-separated key=value pairs:
service_id=X zone_id=Y record_id=Z
curl --config file approach is used throughout to avoid eval and
shell injection from user-controlled values. Supports both IPv4
and IPv6. For dual-stack, create two separate DDNS service sections
with their respective record IDs.
Tested on GL.iNet MT5000 (Brume 3) running OpenWrt with
ddns-scripts 2.8.2.
Erik Conijn [Thu, 21 May 2026 14:09:40 +0000 (16:09 +0200)]
openvpn: add missing host routes
Maintainer: Alexandru Ardelean <redacted>
ping @feckert
First of all big thanks to all involved devs, porting this to proto is not a minor task and besides some small quirks it is working well.
(Not all that happy with the use of a default route instead of /1 routes, because you loose internet if the tunnel goes down but that is just me nitpicking)
However I had problems with default routing as the host routes to the server endpoint were missing.
I tracked it down to code in the `openvpn-hotplug` script and made some changes and in my testing it appears to work now.
As a bonus I also added code for a future implementation of the `nohostroute` option.
Problem:
The host routes were created by just using route setup this however does not work.
Solution:
using `proto_add_host_dependency` seems the better solution.
Furthermore the correct guard for IPv6 seems to be `net_gateway_ipv6` instead of `route_ipv6_gateway` however even the correct guard is only working if ipv6 source routing is disabled on wan6, so perhaps we should consider removing the guard entirely.
For now I left it in place with a warning.
I have tested it on X86 running master build from 5 days ago, both for IPv4 and IPv6
Large version jump from 4.8.1 to 4.19.4 (latest upstream LTS).
Build changes:
- Refresh patches/004-fix-su-controoling-term.patch: su.c moved the
ioctl() call from line 1122 to 1169 and changed (char *) 0 to
(char *) NULL; update patch context and re-canonicalise through
quilt (blank context line spacing).
- New CONFIGURE_ARGS:
* --disable-logind: 4.19.4 added an optional libsystemd-based
logind integration which OpenWrt doesn't ship.
* --without-libbsd: shadow's configure now hard-fails on missing
readpassphrase() unless libbsd is found; the in-tree
lib/readpassphrase.c fallback is enabled by --without-libbsd.
* --without-sssd: avoid dragging in an sssd build dep.
* --disable-subordinate-ids: 4.19.4 builds libsubid (subuid/subgid
runtime API) unconditionally when subids are enabled, and its
libtool -export-symbols-regex generates a version script that
binutils 2.40+ rejects against libxcrypt's versioned
crypt_checksalt@@XCRYPT_4.3 symbol. Disabling subordinate-ids
skips libsubid entirely; OpenWrt doesn't ship libsubid.
- Drop newgidmap, newuidmap, lastlog and groups from SHADOW_APPLETS:
newgidmap/newuidmap are only built when subordinate-ids are
enabled, lastlog defaults to disabled in 4.19.4, and the groups
binary was removed from shadow upstream (use coreutils).
Test coverage:
- Replace the per-applet --version check in test.sh with per-applet
functional tests:
pwck -> 'pwck -r' read-only consistency check; accept
non-zero exit since the CI container's /etc/passwd
trips minor warnings.
grpck -> 'grpck -r' read-only consistency check.
chage -> 'chage -l root' lists password aging info.
useradd -> 'useradd -D' dumps defaults without modifying state.
passwd -> 'passwd -S root' prints the password status line.
faillog -> create empty /var/log/faillog then 'faillog -a'
must emit a header line.
login/su -> PAM-interactive; presence covered by generic tests.
Other applets -> verify binary presence (CI's generic tests
already check stripped, no build paths, linked-libs).
- Add test-version.sh as a generic-version-check override: shadow
tools don't honour --version (only --help), so the framework's
probe finds no PKG_VERSION match in any binary and would otherwise
fail Generic tests for every sub-package.
Update from 0.26.5 to 1.0.4 (major version jump 0.x -> 1.x).
Changes:
- Add +libcurl to DEPENDS: libupnpp 1.0.4 introduced a new mandatory
dependency on libcurl (used for HTTP/SOAP communications)
- Build system remains meson (already in use)
- No patches needed
libudev-zero: backport hwdb USB ID lookup from upstream master
Replace the four stub udev_hwdb_*() functions with a working
implementation that looks up vendor and product names from
/usr/share/hwdata/usb.ids, so callers using the standard libudev
hwdb API benefit without needing package-specific patches.
The patch is a clean backport of upstream commit 2bebebc9e0444
("udev: implement hwdb USB ID lookup from usb.ids (#80)") merged
to illiliti/libudev-zero master on 2026-05-19, post-1.0.3. Drop
when the package is bumped to the next libudev-zero release.
Upstream now defaults USB_IDS_PATH to ${SHAREDIR}/hwdata/usb.ids
with SHAREDIR=${PREFIX}/share, so the explicit
USB_IDS_PATH=/usr/share/hwdata/usb.ids in MAKE_FLAGS is no longer
needed and is dropped.
Fixes: https://github.com/openwrt/packages/issues/29386 Signed-off-by: Alexandru Ardelean <redacted>
Update from 017 to 019. Version 019 dropped autoconf in favour of meson,
so switch to include/meson.mk and drop PKG_FIXUP:=autoreconf and the
autoconf CONFIGURE_ARGS.
The binary lsusb no longer reads usb.ids directly; it now queries the
udev hardware database. lsusb.py still searches /usr/share/hwdata/usb.ids
for device name resolution.
On some build systems, the miniperl binary is created without execute
permission (errno 126 when running it as /bin/sh). This breaks building
the mro extension and cascades to all dependent packages.
Fix by ensuring chmod +x on miniperl after the main build step.
This matches how many other build systems handle this same issue.
Daniel Golle [Tue, 19 May 2026 10:25:40 +0000 (11:25 +0100)]
lvm2: update to 2.03.41
Stable bug-fix release in the 2.03.x series. The bundled
device-mapper library bumps from 1.02.209 to 1.02.215; track that
in PKG_VERSION_DM as well so the libdevmapper package shows the
correct upstream version.
$(PKG_CONFIG_PATH) here is the make-time variable, which is never
set for host context (include/host-build.mk only exports it as a
per-rule env variable, not a make variable). It therefore expanded
to the empty string, and the resulting single-entry PKG_CONFIG_PATH
overrode the exported defaults from host-build.mk, hiding uuid.pc
from the host pkg-config wrapper.
Fix: refer to the env variable via shell expansion ($$PKG_CONFIG_PATH)
instead of the make variable. The make recipe expands $$ to $, and
the shell resolves $PKG_CONFIG_PATH from the inherited environment
populated by include/host-build.mk (which sets it to
$(STAGING_DIR_HOST)/lib/pkgconfig:$(HOST_BUILD_PREFIX)/lib/pkgconfig).
Fixes: 5e4f937e ("ola: use protobuf-compat instead of protobuf") Signed-off-by: Alexandru Ardelean <redacted>
rsyslog: make libyaml support optional via RSYSLOG_libyaml
The upstream rsyslog build links against libyaml-0.so.2 whenever
pkg-config detects yaml-0.1, which made libyaml a hard dependency
of the rsyslog binary without any way to opt out from OpenWrt
config. libyaml is only used for YAML (.yaml/.yml) configuration
files and for loading rate-limiting policies from external files;
RainerScript (.conf) installs do not need it.
Introduce a new RSYSLOG_libyaml Config.in switch, default off, and
gate the +libyaml DEPENDS entry on it. Pass --enable-libyaml or
--disable-libyaml to configure based on the switch.
The upstream configure script in 8.2604.0 does not understand a
--disable-libyaml flag (libyaml was unconditionally autodetected).
Backport upstream commit c5c244861 ("configure: make libyaml
default-on explicit") as 001-configure-make-libyaml-default-on-
explicit.patch, which adds the AC_ARG_ENABLE(libyaml) block. The
patch dissolves cleanly once the package is bumped to 8.2606.0+.
PKG_FIXUP:=autoreconf is added so the configure.ac change flows
into the generated configure script during the SDK build.
Daniel Golle [Tue, 19 May 2026 10:50:29 +0000 (11:50 +0100)]
gnupg2: update to 2.5.20
New stable release on the 2.5.x development series. Highlights from
upstream's NEWS:
* gpgsm: Implement GCM encryption.
* gpgsm: New option --attribute and server command SETATTR to
include arbitrary signed or unsigned attributes into a
signature. Requires libksba >= 1.7.0 (bumped to 1.8.0 in the
preceding commit).
* gpgsm: Introduce system attribute _signingCertificateV2.
* gpg: Fix wrong assertion failure which could very rarely occur
during key signature checking.
* gpg: Consider certify-only keys for revocation signature check.
* gpgsm: Fix possible double free in the CMS parser.
* gpgsm: Fix possible too early removal of ephemeral keys.
Daniel Golle [Tue, 19 May 2026 10:50:11 +0000 (11:50 +0100)]
libksba: update to 1.8.0
Minor version bump on the GnuPG X.509 library. Highlights from
upstream's NEWS:
1.8.0 (2026-05-13)
* New function ksba_cms_get_attribute.
* Support building of unsigned attributes with
ksba_cms_add_attribute.
1.7.0 (2026-05-07)
* Add support for building AuthEnvelopedData.
* New function ksba_cms_add_attribute.
* Fix silent truncation of 64 bit length fields.
* Fix incorrect overflow guard condition in _ksba_ber_read_tl.
The added interfaces (ksba_cms_add_attribute, _get_attribute) are
required by GnuPG >= 2.5.20 to expose gpgsm's --attribute option.
Daniel Golle [Tue, 19 May 2026 10:26:58 +0000 (11:26 +0100)]
openal-soft: update to 1.25.2
Stable bug-fix release in the 1.25.x series. Highlights from
upstream's ChangeLog include:
* Fix STL hardening assertion in the reverb effect.
* Fix a potential crash with older PipeWire headers.
* Fix capturing mono from a stereo or greater WASAPI input device.
* Add capture support to the SDL3 backend.
* Implement 3D processing for Distortion, Chorus, Flanger,
Pitch Shifter and Frequency Shifter effects.
Qingfang Deng [Thu, 14 May 2026 01:35:06 +0000 (09:35 +0800)]
openvpn: use mbedtls by default
When luci-proto-openvpn is selected in `make menuconfig`,
openvpn-openssl is picked up automatically. As mbedTLS is the default
TLS package, set DEFAULT_VARIANT on openvpn-mbedtls so that it is used
by default.
Fotios Kitsantas [Sun, 10 May 2026 13:22:55 +0000 (14:22 +0100)]
ddns-scripts: add blazingfast.io Anycast DNS provider
Add DDNS update support for blazingfast.io Anycast DNS via their
REST API. Authentication is performed via JWT token obtained from
the login endpoint. Zone records are fetched to verify the record
type before update, ensuring IPv4 services only target A records
and IPv6 services only target AAAA records.
Service, zone and record IDs are passed via param_opt as
space-separated key=value pairs:
service_id=X zone_id=Y record_id=Z
curl --config file approach is used throughout to avoid eval and
shell injection from user-controlled values. Supports both IPv4
and IPv6. For dual-stack, create two separate DDNS service sections
with their respective record IDs.
Tested on GL.iNet MT5000 (Brume 3) running OpenWrt with
ddns-scripts 2.8.2.
Chester A. Unal [Sat, 16 May 2026 19:33:33 +0000 (20:33 +0100)]
bsbf-openwrt-resources: improve iface type detection and DNS
To find the correct network interface to create a network entry for, check
which driver is driving the network interface.
Restrict creating a network entry with DHCP client to network interfaces
driven by the cdc_ether, r8152, rndis_host, or ipheth driver.
Ensure UCI section name derived from interface name is proper.
Do not disable using DNS servers advertised by the ISP. This was a
requirement of bsbf-bonding. We can now do this as we transparently proxy
all DNS traffic to Xray which resolves queries.
Chester A. Unal [Sat, 16 May 2026 19:19:16 +0000 (20:19 +0100)]
bsbf-resources: update to GIT HEAD of 2026-05-16
Update bsbf-resources to the GIT HEAD of 2026-05-16.
- files/etc/uci-defaults/99-bsbf-bonding:
- Do not ever exit non-zero. It prevents the script from being deleted
after it's run.
- Fix creating a new wan zone.
- Do not disable using DNS servers advertised by the ISP. We can now do
this as we transparently proxy all DNS traffic to Xray which resolves
queries.
- files/usr/sbin/bsbf-bonding:
- Attempting to source a file that doesn't exist breaks the rest of the
script. Therefore, only source /etc/bsbf/bsbf-bonding.conf if it
exists. Then, print to stderr if the configuration is improper.
Dirk Brenken [Sat, 16 May 2026 20:49:56 +0000 (22:49 +0200)]
adblock: update 4.5.5-4
- gated f_load behind a ubus socket check at the end of adblock.sh
to harden against pre-ubus invocations
- added a 'adb_bver' fallback in f_log for invocation paths without prior f_load execution
- minor code improvements and fixes
Dirk Brenken [Sat, 16 May 2026 20:14:30 +0000 (22:14 +0200)]
banip: update 1.8.8-3
- gated config sanity checks at the end of banip-functions.sh
behind 'ban_action' to skip them on init script sourcing paths (enable/disable/help)
- added a ubus socket guard around f_system to harden against pre-ubus sourcing
- added a 'ban_bver' fallback in f_log for sourcing paths without prior f_system execution
- reordered system utility references before system library sourcing,
so f_log has a valid 'ban_logcmd' available if the library check fails
- minor code improvements and fixes
Dirk Brenken [Sat, 16 May 2026 17:55:27 +0000 (19:55 +0200)]
travelmate: update 2.4.5-2
- gated config sanity checks at the end of travelmate-functions.sh
behind 'trm_action' to fix init script enable/disable/help paths
- added a ubus socket guard around f_system to harden against pre-ubus sourcing
- added a 'trm_bver' fallback in f_log for sourcing paths without prior f_system execution
- reordered system utility references before system library sourcing,
so f_log has a valid 'trm_logcmd' available if the library check fails
- minor code improvements
1.0.1 fixes a false-positive path-traversal check in destinations.py:
the 1.0.0 code used Path.resolve() to validate that each installed file
stays within the --destdir, but Path.resolve() follows symlinks.
OpenWrt's staging dir and toolchain directories contain many symlinks,
so resolved paths could escape the destdir comparison and trigger:
ValueError: Attempting to write <file> outside of the target directory
1.0.1 replaces Path.resolve() with os.path.abspath(), which normalises
the path without following symlinks, eliminating the false positive.
Daniel Golle [Fri, 8 May 2026 17:07:22 +0000 (18:07 +0100)]
cni-plugins: update to 1.9.1
Major version jump from 1.1.1 covering the 1.2.x - 1.9.x series.
Highlights:
- portmap: implement netfilter (nft) backend; bandwidth: optimization
- bridge: support "vlanTrunk" property and DAD/PVID support
- macvlan: support "linkInContainer" mode
- ipvlan: support "linkInContainer" mode
- dhcp: support DHCP option 121 classless static routes
- host-local: handle ranges with single IP
- firewall: support "ingressPolicy" with iptables and nftables
- tuning: allow specifying tx queue length
- Go module bumps including security fixes
- Minimum Go version: 1.23
Daniel Golle [Fri, 8 May 2026 17:07:05 +0000 (18:07 +0100)]
cni: update to 1.3.0
Major version jump from 1.1.2 covering the 1.2.x series and 1.3.0:
- libcni: support DEL --force option (CNI 1.2)
- GC: support --valid-attachments option (CNI 1.2)
- cnitool: bug fixes and minor improvements
- Drop support for old plugin API versions (<0.4.0)
- Various Go module updates and CVE fixes
- Minimum Go version: 1.21
0.26.x:
* util: Revise crypto API to prevent misuse of key material
* util: Add various TIME related helper APIs
* pils: Ship missing header
* pq: fix NULL reporting in arrays
* pq: fix consistency check errors
* util: fix UTF-8 uppercase/lowercase conversion API insanity
0.25.2:
* build: Various build system and detection logic improvements
* reintroduce some flat file storages
Drop patches that have been merged upstream:
- 0001-meson-convert-SQLite-version-detection-to-compile-time
- 0002-meson-convert-cURL-version-detection-to-compile-time
- 0003-meson-convert-libsodium-version-detection-to-compile
- 0004-meson-convert-cURL-SSL-library-detection-to-compile
- 0007-namecache-install-sql-files
- 0008-namecache-build-flat-namecache-plugin
Refresh 0005-meson-detect-libcurl-gnutls.patch for the upstream
switch from cc.compiles to cc.run for the cURL SSL backend check.
Seo Suchan [Wed, 13 May 2026 12:20:51 +0000 (21:20 +0900)]
acme: make 'acme' keyword actually virtual
before acme is an empty package that depend either acme-acmesh or uacme.
but this boolean logic in depend ignored by apk itself.
let's make a virtual keyword
witch both acme.sh and uacme provides.
acme.sh is explicit default.
oci-runtime-tools is a rolling release without versioned upstream
releases. The new commit brings updated runtime-spec dependencies
and bug fixes accumulated since November 2024.
Daniel Golle [Fri, 8 May 2026 17:44:19 +0000 (18:44 +0100)]
opentracker: update to GIT HEAD of 2026-04-13
opentracker is an open and free bittorrent tracker without
versioned releases. Bumping PKG_SOURCE_VERSION to upstream
HEAD as of 2026-04-13 to pick up accumulated fixes since
the 2025-04-25 snapshot.
Daniel Golle [Fri, 8 May 2026 17:20:50 +0000 (18:20 +0100)]
libcurl-gnutls: update to 8.20.0
Tracks upstream curl 8.20.0 (April 2026 release).
Changes since 8.14.1 cover six upstream releases (8.15.0 - 8.20.0).
Highlights:
* async-thrdd: use thread queue for resolving
* build: make NTLM disabled by default
* lib: add thread pool and queue
* lib: drop support for < c-ares 1.16.0
* lib: make SMB support opt-in
* multi.h: add CURLMNWC_CLEAR_ALL
* rtmp: drop support
* cmake: drop support for CMake 3.17 and older
* Various TLS, HTTP/3, altsvc and resolver bug fixes.
Daniel Golle [Fri, 8 May 2026 17:10:15 +0000 (18:10 +0100)]
debootstrap: update to 1.0.143
Update to latest upstream release.
Highlights of changes since 1.0.128:
* Added support for Debian 13 (trixie)
* Added support for many new Ubuntu releases (jammy through plucky)
* Improvements to keyring handling
* Various bug fixes and cleanups
Drop PKG_REAL_VERSION and the now-redundant PKG_BUILD_DIR override:
upstream and downstream versions match, so use PKG_VERSION directly
in PKG_SOURCE.
Daniel Golle [Fri, 8 May 2026 17:09:35 +0000 (18:09 +0100)]
debian-archive-keyring: update to 2025.1
Changes since 2023.4:
* Add automatic signing keys for trixie
* Add Debian Stable Release Key (13/trixie) (ID: 762F67A0B2C39DE4)
* Clean up maintscript removal of ancient archive certificates
* Get rid of team-members/ and signature verification
* Remove buster keys
* Rename keyrings from .gpg to .pgp
* Use OpenPGP instead of GnuPG when referring to the specification
Daniel Golle [Fri, 8 May 2026 17:14:04 +0000 (18:14 +0100)]
exim: update to 4.99.3 (security release)
4.99.3 (security release):
* Addresses EXIM-Security-2026-05-01.1: a remotely reachable
Use-After-Free vulnerability in Exim's BDAT (binary data
transmission) body parsing path when using the GnuTLS
backend. This can lead to heap corruption and potential code
execution. Affects 4.97 through 4.99.x when built with GnuTLS
support AND with STARTTLS and CHUNKING advertised.
Reported by xbow security.
Previous security releases folded into this bump:
4.99.2 (security release):
* Addresses Exim-Security-2026-04.1, covering 4 CVEs:
- CVE-2026-40684: Possible crash with malicious DNS data (musl libc)
- CVE-2026-40685: Possible OOB read/write on corrupt JSON in header
- CVE-2026-40686: Possible OOB read with large UTF8 trailing characters
- CVE-2026-40687: Possible OOB read/write with SPA authenticator
4.99.1 (security release):
* Re-incarnation of CVE-2025-26794, ports fixes from 4.98.1/4.98.2.
gstreamer1: add libatomic dependency for 32-bit arm targets
arm926ej-s (ARMv5) does not have native lock-free atomics and the
toolchain inserts calls to libatomic.so.1 for atomic operations.
The libgstreamer1 DEPENDS only listed armeb, powerpc, mips and mipsel
as needing libatomic, missing plain arm (little-endian 32-bit ARM).
Extend the condition to include arm so the package is properly
declared on all 32-bit ARM targets that require libatomic.
perlbase-archive, perlbase-pod, and perlbase-test install Perl script
wrappers (ptar, pod2man, prove, etc.) that do not output the OpenWrt
package version string (5.40.0), causing generic version check failures
in CI.
git.99rst.org / openwrt-packages.git / log