Update test.sh to use $2 (positional version argument) instead of the
$PKG_VERSION environment variable, and add a check that the alternative
binary /usr/libexec/less-gnu is present.
Drop two patches that have been applied upstream:
- 100-fuse_signals.c-fix-build-warning-when-HAVE_BACKTRACE.patch
- 101-mount_util.c-check-if-utab-exists-before-update.patch
Remove <linux/prctl.h> from backend.c via Build/Prepare sed: both
<linux/prctl.h> and <sys/prctl.h> define struct prctl_mm_map in newer
musl toolchains, causing a redefinition build error. sys/prctl.h alone
provides everything fio needs.
Changes:
- Fix: kallsyms on powerpc64 with ABI V1
- fix: ASoC: soc-dapm: move struct snd_soc_dapm_context (v7.0)
- fix: adjust range in btrfs probe for v6.18.14
Remove obsolete patches:
- 010-compat-off64_t-is-not-defined-by-musl.patch: the patched files
(src/common/compat/compat-fcntl.c and src/common/compat/fcntl.h)
no longer exist in 2.15.0
- 020-fix-lttng-tools-fails-to-compile-with-libxml2-2-14-0.patch: the
encode_string() function was refactored in 2.15.0 to use
xmlCharEncInFunc() instead of handler->input(), so the fix is no
longer needed
Add musl compatibility fixes in Build/Prepare via sed:
- Remove :: global-namespace qualifier from TFD_CLOEXEC in timerfd.hpp;
musl defines it as an octal literal so ::TFD_CLOEXEC is invalid C++
- Same fix for EPOLL_CLOEXEC in poller.cpp
- Relax static_assert in consumer.hpp from __cplusplus == 201103L to
>= 201103L; SDK builds with C++17
Add missing +libstdcpp to DEPENDS (lttng-tools links libstdc++.so.6).
Update from 2.13.9 to 2.15.0 (skips 2.14.x stable series).
Highlights of the 2.14/2.15 series:
- C++ header compatibility improvements (tracepoint API usable from C++)
- liblttng-ust-tracepoint split into its own shared library
- Add liblttng-ust-fd, liblttng-ust-fork helper libraries
- Ring buffer API cleanup and modernisation
- Drop internal libcompat layer
Patch update:
- 100-no-tests.patch: adjust hunk offset from line 7 to line 9; the
tests/ entry in SUBDIRS moved down two lines in Makefile.am
Changes:
- dwarf/godwarf: fix regression debugging DWARFv5 on macOS
- cmd/dlv: use goversion.ParseProducer for DW_AT_producer parsing
- pkg/proc: fix flakiness in TestWaitFor
- eBPF backend: extend feature to print procedure parameters in trace
- minor comment and code cleanup
Upstream release 28.5 (2026-04-23), patch release for OTP 28.
Applications updated:
- erl_interface-5.7: new --{enable,disable}-use-embedded-3pp-alternatives
configure option; allows using system zstd, zlib, ryu, openssl, tcl
instead of bundled copies (default: zlib uses OS version if available)
- erts-16.4: fixed bug in enif_make_map_from_arrays for arrays with >= 33
keys (duplicates could produce broken maps); fixed Unicode handling in
erl.exe args_file on Windows
- mnesia-4.25.3: bug fixes
- ssl-11.6: bug fixes
Highlight: new "Secure Coding Guidelines" document added to Design
Principles describing how to write secure Erlang code.
Version 8.2604.0 follows the YYYYMM.x versioning scheme (April 2026).
The 8.2604.0 release enables --enable-impstats-push by default, which
requires protobuf-c-compiler (protoc-c). Since we don't ship
protobuf-c in the SDK environment and the impstats push feature is
not essential for typical OpenWrt use, disable it explicitly with
--disable-impstats-push.
Dirk Brenken [Sat, 9 May 2026 19:38:20 +0000 (21:38 +0200)]
travelmate: release 2.4.5-1
- added opt-in protection against access points with locally-administered (LAA) BSSIDs
- added a special trm_maxretry value '0', enabling unlimited connection retries
- removed obsolete connection-tracking functions (too many uci updates/flash wear)
- all runtime files now live under a single /var/run/travelmate/ directory
- various code cleanups & fixes
- LuCI: made the new UCI option 'trm_eviltwin' available
- LuCI: more cleanups
- readme update
Daniel Golle [Fri, 8 May 2026 17:40:01 +0000 (18:40 +0100)]
lvm2: update to 2.03.40 (libdm 1.02.209)
Update LVM2 from 2.03.33 to 2.03.40, bundled libdm from 1.02.207 to
1.02.209.
LVM2 highlights since 2.03.33:
2.03.40 (28th April 2026):
* Many bug fixes and memory/lock leak fixes throughout the
tree (vgcreate, vgmerge, vgimportclone, pvscan, raid, dmeventd,
pvmove, lvmpolld).
* Validate area_count and metadata sizes to prevent overflows.
* Fix percent_check threshold stuck above 100% in dmeventd
thin/vdo plugins.
* Pre-create udev cookie before critical section to avoid
resume failures.
2.03.39 (13th March 2026):
* Support --interval +N to delay first poll in pvmove and lvpoll.
* Add atomic leases using Compare and Write (CAW) to lvmlockd.
* Add lvm-index(7), lvm-categories(7), lvm-args(7) man pages.
* Show active cache mode in kernel table line (lvs -o kernel_cache_mode).
* Switch from internal device_mapper library to libdm.
2.03.34 - 2.03.38:
* Persistent reservation support on a VG; VG attr character + pr
field on vgs reflecting persistent reservation status.
* dmeventd: restart with no monitored devices, no actions on
removed devices.
* Various filter, integrity, cache, raid and pvmove fixes.
libdm changes since 1.02.207 (1.02.208 / 1.02.209) consist purely
of internal cleanups and version bumps; no user-visible changes
documented in WHATS_NEW_DM.
Daniel Golle [Fri, 8 May 2026 17:08:15 +0000 (18:08 +0100)]
cryptsetup: update to 2.8.6
Stable bug-fix release. All users of cryptsetup 2.8.x must upgrade.
Changes since 2.8.4:
* Fix FileVault (fvault2) metadata parsing crash with crafted images.
Reported by David Pokora (Trail of Bits/Anthropic).
* Fix reading FileVault image metadata from incorrect image offset.
* OpenSSL backend: increase the number of allowed threads to 64
(workaround for parallel Argon2 PBKDF deadlock).
* Fix LUKS2 reencryption lock name when the device is being reencrypted.
* Check UUID of the resumed device to match UUID stored in metadata.
* Add a specific error for failed detached header allocation.
* Fix tests not to use aes-generic kernel cipher name (Linux 7.0+).
* Fix OpenSSL crypto backend if built with LibreSSL.
* Several compatibility fixes to the alternative Meson configuration.
* Various code fixes based on AI-assisted reviews (memory wiping,
error paths, integrity sector overflow, device-mapper flags, ...).
Daniel Golle [Fri, 8 May 2026 17:28:19 +0000 (18:28 +0100)]
libxmp: update to 4.7.0
A substantial release with many new features and module format
fixes since 4.6.3.
Highlights:
* Increase maximum sampling rate (XMP_MAX_SRATE) to 768000.
* xmp_seek_time now always seeks; new xmp_seek_time_frame for
frame-accurate seeking.
* New tempo factor APIs: xmp_set_tempo_factor_relative,
xmp_get_tempo_factor, xmp_get_tempo_factor_relative.
* New API define XMP_FORMAT_32BIT to enable 32-bit integer output.
* New API defines XMP_INST_NO_DEFAULT_PAN, XMP_MARK_SKIP,
XMP_MARK_END.
* Add support for Pack-Ice depacking and Software Visions DMF
(Apocalypse Abyss MOD variant).
* Internal module time/duration calculations now use doubles.
* Numerous bug fixes across MOD, XM, S3M, IT, RTM, MED, Funktracker,
Imago Orpheus IMF, Liquid Tracker LIQ, DigiBooster Pro, IMS and
other formats: sample default panning/volume corrections, effect
memory and translation fixes, note edge cases.
Daniel Golle [Fri, 8 May 2026 17:34:18 +0000 (18:34 +0100)]
openal-soft: update to 1.25.1
1.25.1:
* Fixed the OpenSL and JACK backends.
* Fixed WASAPI and CoreAudio capture.
* Fixed building the OSS backend with OSS v4.
* Fixed a debug assertion with HRTF enabled.
* Fixed an STL hardening assertion in the polyphase resampler.
* Added a new stereo-encoding option for Tetraphonic Surround Matrix
Encoding.
1.25.0:
* Updated library codebase to C++20.
* Fixed alcIsExtensionPresent to do a case-insensitive compare.
* Fixed potential noise when switching reverbs.
* Fixed reverb panning with certain output modes.
* Fixed retrieving the alGetProcAddressDirect extension function.
* Fixed negative source offsets with a callback buffer.
* Added build options for STL hardening (default ON for performant checks).
* Added support for fourth-order ambisonics.
* Added support for CAF files to the Wave Writer backend.
* Added optional support for C++20 modules.
* Updated alsoft-config to Qt6.
* Changed default period size to 512 sample frames.
Daniel Golle [Fri, 8 May 2026 17:51:57 +0000 (18:51 +0100)]
xdg-dbus-proxy: update to 0.1.7
Changes in 0.1.7 (2025-04-07):
* Drop the autotools build system
* Unbreak the CI
* Prevent a crash on disconnect
* Fix building with glibc >= 2.43
* Fix the eavesdrop filtering to prevent message interception
Daniel Golle [Fri, 8 May 2026 17:24:59 +0000 (18:24 +0100)]
libp11: update to 0.4.18
Changes since 0.4.16:
0.4.18 (2026-02-16):
* Support for RSA-PSS and RSA-OAEP using keys retrieved using the
PKCS11_get_private_key() libp11 API and the PKCS#11 provider.
* Improved test coverage.
0.4.17 (2026-02-01):
* Ed25519 and Ed448 support (PKCS#11 v3.2).
* Fixed OPENSSL_NO_EC builds.
* Reverted RSA public exponent change from PR #474.
* Fixed crash on module initialization failures.
* Ignoring trailing newlines in pin-source files.
* Initial build fixes for the upcoming OpenSSL 4.x.
Drop the now obsolete 001-fix-install.patch which has been merged
upstream.
Daniel Golle [Fri, 8 May 2026 17:51:38 +0000 (18:51 +0100)]
wavpack: update to 5.9.0
Release 5.9.0 (January 16, 2026):
* added: new feature to wvtag to copy tags from one WavPack file
to another
* improved: minor tweaks to the new DNS (dynamic noise shaping)
algorithm
* improved: better handling of specific non-standard WAV and AIFF
files
* improved: added CI (GitHub Actions) and fixed a few minor build
issues
* fixed: --pause option failed in many situations (Windows-only)
* fixed: issues related to encoding from an unknown length
(e.g., pipes)
* fixed: several fuzzer-revealed issues related to multithreading
* fixed: potential buffer overruns in WavpackOpenRawDecoder()
Daniel Golle [Fri, 8 May 2026 17:21:58 +0000 (18:21 +0100)]
libjwt: update to 3.3.2
Major version jump from 1.17.1 to 3.3.2.
libjwt 3.x is a substantial rewrite:
* New backend abstraction supporting OpenSSL, GnuTLS and MbedTLS
crypto libraries (selected at build time).
* New JWK and JWKS APIs for key handling with full RFC 7517 support.
* Improved error handling and reporting.
* EdDSA signature support (Ed25519, Ed448).
* Optional libcurl integration for fetching JWKS from a URL.
* Many API additions while keeping backwards-compatible semantics
for the most common HMAC/RSA/ECDSA operations.
Force OpenSSL backend (-DWITH_GNUTLS=OFF -DWITH_MBEDTLS=OFF) since
libopenssl is already a dependency, avoiding pulling in libgnutls.
Disable -DWITH_TESTS=OFF since the testsuite is not relevant for
embedded targets.
Daniel Golle [Fri, 8 May 2026 17:21:15 +0000 (18:21 +0100)]
libevdev: update to 1.13.6
Minor update from 1.13.4 with new EV_KEY/EV_ABS code definitions
synced with the latest kernel input headers, plus various bug fixes
and tooling improvements.
Stan Grishin [Sat, 9 May 2026 05:38:49 +0000 (05:38 +0000)]
https-dns-proxy: update to 2026.03.18-3
Maintainer: me
Compile tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.1
Run tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.1
Description:
update to 2026.03.18, release 3
- update PKG_RELEASE to 3
files/etc/init.d/https-dns-proxy:
- refactor nftable rules to explicitly add and flush the table and
chains instead of block replacement
- make nftable `delete table` call silent in `notrack_nft remove`
- update `notrack_nft remove` to check for absence of nftable table
instead of just checking the file
- ensure `notrack_nft remove` sets _error=1 on failure
- ignore dnsmasq instances with port 0 in
`dnsmasq_instance_append_force_dns_port`
tests/run_tests.sh:
- add test case to ensure dnsmasq port 0 is ignored
- update `notrack_nft remove` test to confirm success when both file
and table are absent
Daniel Golle [Fri, 8 May 2026 17:16:10 +0000 (18:16 +0100)]
gawk: update to 5.4.0
Changes from 5.3.x to 5.4.0:
* Use Mike Haertel's MinRX regular expression matcher by default.
The old regex and dfa engines are still available.
* New @nsinclude directive: like @include but doesn't reset
the namespace to "awk".
* lshift()/rshift() return 0 when shifting more bits than in uintmax_t.
* Persistent memory: store meta-info in backing file; warn on
version mismatch; allow dynamic extensions with persistent memory.
* ordchr extension now supports multibyte / wide characters.
* length(array) is no longer an extension (POSIX 2024); --posix
no longer rejects it and --lint no longer warns.
* --traditional rationalised to match BWK awk behaviour.
* Assertions are now enabled in the C code.
* Hexadecimal floating-point values may now be used in source,
strtonum() and -n/--non-decimal-data option.
* UDP networking support is now deprecated, will be removed in 6.0.
* Reading regular disk input files is somewhat faster (no timeout check).
* Various bug fixes.
Daniel Golle [Fri, 8 May 2026 20:11:56 +0000 (21:11 +0100)]
libdrm: update to 2.4.133
Bump from 2.4.123 to current upstream stable. Required by recent
Mesa, weston, wlroots and other graphics-stack consumers
(wlroots 0.20+ explicitly requires libdrm >= 2.4.129).
Tianling Shen [Sat, 9 May 2026 02:55:47 +0000 (10:55 +0800)]
dos2unix: Update to 7.5.5
2026-04-06: Version 7.5.5
* New option --error-binary: Return an error if a
binary file is skipped.
* Fix: dos2unix error on empty input. The problem was introduced
in version 7.5.4.
Daniel Golle [Fri, 8 May 2026 16:59:39 +0000 (17:59 +0100)]
bubblewrap: update to 0.11.2
0.11.2 (CVE-2026-41163):
* In setuid mode, don't run the low-privileged parts of the setup
as dumpable, as that allows it to be ptraced which can lead to problems.
* New build option -Dsupport_setuid, which if set to false (the default)
disables the support for setuid.
0.11.1:
* Reset disposition of SIGCHLD, restoring normal subprocess management
if bwrap was run from a process that was ignoring that signal.
* Don't ignore --userns 0, --userns2 0 or --pidns 0 if used.
* Fix grammar in an error message and a broken link in the documentation.
Rob White [Sun, 8 Mar 2026 14:53:40 +0000 (14:53 +0000)]
wifi-chipset-detect: new package
Maintainer: Rob White rob@blue-wave.net
Compile tested: All
Run tested: arm_cortex-a7_neon-vfpv4, mipsel_24kc, mips_24kc,
aarch64_cortex-a53; On 24.10, 25.12 and master/snapshot.
Description: wifi-chipset-detect (1.0.0)
This is a new package that reports in json format the chipset
and driver capabilities of installed wireless hardware.
Developed originally for use where Captive Portal
and Mesh Backhaul networks are being built.
It provides a stand alone script to detect details of the physical
wireless hardware without requiring the radios to be enabled.
There are no dependencies over and above the basic OpenWrt flash image.
It is based on functionality built into the OpenNDS and Mesh11sd packages.
The json formatted output is displayed on the terminal screen.
It is also written to the file /tmp/wifidetect.
This version does not require the Captive Portal
or Mesh network to be running.
Full details can be seen here:
https://github.com/openNDS/wifi-chipset-detect
Changelog:
- Fix MMDB_open incorrectly rejecting databases with 0-element
map/array fields at the end of metadata (v1.13.3)
- Fix compilation conflict with bswap32/bswap64 macros on macOS 26
Tahoe (v1.13.2)
- Fix validation and edge-case handling in database open path (v1.12.x)
Changelog:
- Security: reject unescaped control characters in JSON strings
- Security: fix use-after-free in Reader::parse()
- Add std::string_view support in the Value API
- Fix string_view ABI mismatch between library and consumers
Chester A. Unal [Sat, 2 May 2026 17:56:47 +0000 (18:56 +0100)]
bsbf-resources: update to GIT HEAD of 2026-05-06
Update bsbf-resources to the GIT HEAD of 2026-05-06.
- Remove bsbf-route as bsbf-mptcp now includes the functionality it
provides.
- Remove bsbf-plpmtu as that functionality is now provided with the
plp-mtu-discovery package.
- Remove bsbf-tcp-in-udp as it's not a production-ready solution as it is.
- Add bsbf-client-web.
- Update the dependencies of bsbf-mptcp to curl, fping, ip-full, and
mptcpize.
- Remove files/etc/config/bsbf-mptcp as that functionality is now provided
using the /etc/bsbf/bsbf-mptcp-subflow-backup file.
- Remove files/etc/hotplug.d/iface/99-bsbf-mptcp as that functionality is
now provided by the bsbf-mptcp service.
- Update the dependencies of bsbf-bonding to bsbf-client-web, bsbf-mptcp,
bsbf-rate-limiting, and xray-core.
- Get rid of fw4 dependency and 99-bsbf-bonding.nft in favour of
resources-client/bsbf_bonding.nft. Add a oneshot service to apply it at
boot.
- Move from bsbf-openwrt-resources to bsbf-resources directory as we now
install resources-client/xray.json and resources-client/bsbf_bonding.nft.
- Add the bsbf-bonding command.
- Run `bsbf-bonding --enable` at the end on the uci-defaults script.
- Add the tc package as a dependency for bsbf-rate-limiting.
Fixes: https://github.com/openwrt/packages/issues/29306 Signed-off-by: Chester A. Unal <redacted>
Chester A. Unal [Tue, 5 May 2026 07:58:20 +0000 (08:58 +0100)]
bsbf-bonding: fix checking if interface is a bridge
The current check would match a uci device section that doesn't say if the
interface is a bridge. Check that the type option is bridge to address
this.
Stan Grishin [Mon, 4 May 2026 03:01:56 +0000 (03:01 +0000)]
https-dns-proxy: update to 2026.03.18-2
Maintainer: me
Compile tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.1
Run tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.1
Description:
Fix nftables rule directory creation
- Bump PKG_RELEASE to 2.
files/etc/init.d/https-dns-proxy:
- Add 'mkdir -p' before writing nftables rules to ensure the parent
directory exists. This fixes an issue where the directory might not
exist on initial installation, causing errors.
tests/run_tests.sh:
- Add comprehensive regression tests for notrack_nft.
- Mock 'nft' to track invocations and control return codes for testing.
- Patch 'NOTRACK_NFT_FILE' to a test-specific path for isolated testing.
- Verify 'notrack_nft' correctly creates the parent directory if missing.
- Test content of generated nftables snippet, idempotence, and removal.
unbound-control-setup is a shell script that generates TLS certificates
for unbound-control; it does not print a version string. The generic CI
test framework cannot verify the version via the binary, causing the
"No executables in the package provided version" failure.
Add a package-specific test.sh that:
- tests unbound-daemon version via 'unbound -V' and config file presence
- tests libunbound shared library presence
- tests unbound-anchor/-checkconf/-control/-host binaries run and
respond to -h without starting the daemon
- tests unbound-control-setup as an installed, executable shell script
containing expected keywords (no version check)
alsa-lib: add test.sh for aserver without --version
aserver does not implement --version so the generic CI version check
fails for it. Add a test.sh case that verifies it is present and
executable instead.
Drop 020-string-view.patch: mpd 0.23.17 uses std::string_view directly
in src/tag/GenParseName.cxx, making the patch redundant.
Changes since 0.23.16:
- Optimize the "albumart" command to send larger chunks when available
- Explicitly disallow 'idle' and 'noidle' commands in command lists
- Require libnfs 4.0 or later for NFS storage support
- Trigger inotify database update after symlink creation
- Prefer FFmpeg over sndfile and audiofile for DTS-WAV support
- Add support for libfmt 11.1
Changes since 6.2.1:
- Build without expat by default (switch to picoxml)
- Fix build errors with -Dipv6=false option (issue #142)
- Check size of POST upload data and response data against
g_maxContentLength; change default from 16k to 2MB
- Use IPv6 socket when looking for an available port with IPv6 enabled
- Fix MHD start error handling to not delete minisocket array prematurely
- Remove code assuming different v4/v6 listening ports
- Add per-subsystem debug logging control via environment variable
- SSDP code cleanups and header removal
- Fix win32 compile issue (setsockopt args)
- Avoid leaking private headers to consumers via meson build
Security fixes (18 GHSAs addressed between 7.1.2-1 and 7.1.2-21):
- Fix stack buffer overflow in MagnifyImage (GHSA-rqq8-jh93-f4vg, high)
- Fix heap buffer overflow in WaveletDenoiseImage (GHSA-5ggv-92r5-cp4p)
- Fix uninitialized pointer dereference in JBIG decoder (GHSA-wj8w-pjxf-9g4f, high)
- Fix heap buffer over-write in PNG encoder with large profiles (GHSA-qmw5-2p58-xvrc)
- Fix heap buffer overflow in UHDR encoder (GHSA-h95r-c8c7-mrwx)
- Fix stack buffer overflow in sixel encoder (GHSA-49hx-7656-jpg3)
- Fix heap-buffer-overflow in NewXMLTree XML parsing (GHSA-gc62-2v5p-qpmp)
- Fix heap buffer over-write on 32-bit systems in SFW decoder (GHSA-56jp-jfqg-f8f4)
- Add overflow checks to BMP/DIB, SGI, PS3, JXL, and sixel write paths
Bug fixes:
- Fix double-free in SVG gradientTransform/transform parsing
- Fix NULL pointer dereference in HEIC NCLX color profile allocation
- Fix heap over-read in BilateralBlurImage with even-dimension kernels
- Fix infinite loop when decoding JXL with -limit height/width
- Fix race condition using properties instead of global splaytree
Security fixes:
- Fix MSL/SVG parsers to use libxml2 SAX handlers, removing archaic
cruft with potential security issues
- Fix JP2 Jasper max_samples calculation to avoid DoS via huge images
- Apply image dimension resource limits and fix heap write overflow in JXL
- Fix WPG palette buffer allocation (SF bug #750)
- Fix ColorFloodfillImage() to error when clip-mask is present
Bug fixes:
- Fix JPEG CMYK inversion regression introduced in 1.3.43
- Re-implement PNG8 writer with correct indexed-color and binary transparency
- Re-write HEIF reader (AVIF, HEIC) based on heif_image_get_plane_readonly2(),
adding deep image support and YCbCr/monochrome output
- Fix Hull transform arithmetic overflow regression from Oct 2023
- Fix -crop percentage tiling regression
- Re-enable EXPERIMENTAL_EXIF_TAGS by default with known issues fixed
- Fix Magick++ thread safety regression since 2003 (pthreads support)
New features:
- Add support for newer Artifex urw-base35-fonts (OpenType and Type 1)
- Add ImagesResource limit to control simultaneous loaded images
- Add EXIF Version 3.0 decoding and validation
- Add preliminary MP4 coder with HEIF sequence support
- Require C99 compiler compatibility in build infrastructure
Update from 4.0.1 to 4.10.1. Notable changes across releases:
- 4.10.1: switch to cProfile (profile module deprecated in Python 3.15);
fix Literal membership tests and sequence type handling
- 4.10.0: fix MSVC initialization delays in GitHub Actions; fix variant
directory components in CompilationDatabase; improve Ninja quoting
- 4.9.0: drop Python 3.6 support; add comprehensive type hints for Node
classes; add clang/clang++ to default tool search order; support binary
and octal integer constants in C preprocessor
- 4.8.0: replace black/flake8 with ruff; add MSVC_TOOLSET_VERSION,
MSVC_SDK_VERSION, MSVC_SPECTRE_LIBS construction variables
- 4.7.0: make NewParallel scheduler the default; CacheDir writes execute
in parallel outside taskmaster critical section; add Python 3.13 support
- 4.6.0: add Visual Studio 2026 and ARM64 host configuration support;
enhanced type hints throughout Environment and Node classes
- 4.5.0: add ValidateOptions(); refactor Taskmaster into a package;
migrate to Python's logging module; extend ninja tool with daemon support
- 4.4.0: add MSVC_USE_SETTINGS and multiple MSVC configuration variables;
implement global policy settings for MSVC version handling
- 4.3.0: add SConsEnvironmentError exception; improved MSVC detection;
Python 3.12 compatibility fixes
- 4.2.0: Performance improvements in Node processing; improved MSVC
support for VS 2022; better parallel build handling
Update from 17.00.0004 (2024-12-09) to 18.00.0001 (2026-03-23).
This is a major version bump to the 18.x series, aligning with
PostgreSQL 18 support. Switch from a fixed git commit to the
18.00.0001 tagged release.
Add test.sh to verify the psqlodbca and psqlodbcw shared libraries
are present after installation.
- 6.19.0: fix log sunit automatic configuration in mkfs; fix data
corruption bug in libxfs_file_write; fix various memory leaks; improve
realtime subvolume info in xfs_io statfs
- 6.18.0: adjust nr_zones for zoned filesystems on conventional devices
in mkfs; fix xfs_logprint pointer bugs; fix mdrestore superblock length
check; add 2025 LTS config
- 6.16.0: atomic write enhancements for maximum atomic write limits at
mount time; refactor log recovery infrastructure; remove experimental
warnings from xfs_scrub
- 6.13.0: comprehensive metadata directory support in xfs_repair, xfs_db,
and mkfs; realtime group support with new RT group structures; quota
inodes use metadata directory infrastructure; realtime space quotas
- 6.12.0: realtime device support in xfs_db; file range commit ioctls
with atomic write statx fields; modernize perag lookup to xarray;
require -std=gnu11 for compilation
Add test.sh to verify xfs-mkfs and xfs-fsck report the correct version
and xfs-admin/xfs-growfs produce expected help output.
Update from 6.11 to 7.5. Notable changes across releases:
- 7.5: fix cifscreds command-line option parsing and ambiguous command
matching; documentation updates for echo_interval parameter
- 7.4: retry logic for -EINPROGRESS errors during mount operations;
improved handling for multiple IP address resolution scenarios
- 7.3: fix guest mount option handling; prevent empty password
parameters from being passed to the SMB client
- 7.2: improve return code checking in getcifsacl; better handling of
permission-related errors across different kernel versions
- 7.1: add upcall_target mount option for namespace resolution; enable
credential lookups in host or application namespace (e.g., Kubernetes)
- 7.0: migrate files to /usr per DEP17 M2 standard
- 6.15: fix CVE-2022-27239 (stack buffer overflow in ip= argument
parsing) and CVE-2022-29869 (info leak in verbose logging)
Add libtalloc dependency to cifsmount
Add test.sh to verify mount.cifs and smbinfo report the correct version.
Paul Donald [Tue, 21 Apr 2026 14:10:02 +0000 (16:10 +0200)]
ocserv: bump to v1.4.1
* Version 1.4.1 (released 2026-02-28)
- [SECURITY] Fixed authentication bypass (medium severity) when using
certificate authentication with cert-user-oid set to SAN(rfc822name):
a client presenting a valid CA-signed certificate without the expected
RFC822 SAN field could authenticate using password credentials alone,
bypassing the intended certificate-to-username binding. Requires the
attacker to possess both a valid CA-signed certificate and valid user
credentials (694)
- The bundled inih was updated to r62.
- The bundled protobuf-c was updated to 1.5.2.
- Fixed a bug where session timeout could be bypassed by reconnecting
(e.g., closing/opening laptop lid) (599)
- occtl: 'show user' command now includes a 'Session started at:' field,
indicating when the VPN session was established
- occtl: Fix column misalignment in ban command outputs
- occtl: Fix 'show ip bans' may produce invalid JSON (683)
- Handle dotted client hostnames (e.g., .local) by stripping the domain suffix
- Renamed `min-reauth-time` configuration option to `ban-time` to better reflect
its purpose (676). This option defines the duration (in seconds) for which
an IP address is banned after exceeding the maximum allowed `max-ban-score`.
Default is 300 seconds (5 minutes).
- Fixed ocserv-worker process title
- Fixed ignored udp-port in vhost (612)
* Version 1.4.0 (released 2026-01-04)
- The bundled llhtp was updated to 9.3.0.
- The bundled protobuf-c was updated to 1.5.1.
- Fixed issues with PAM authentication when combined with pam_sssd (618)
- Enhanced the seccomp filters to address issue in testing (627)
- Fixed "unexpected URL" errors for Cisco AnyConnect clients
- Fixed the 'ping-leases' option, which was broken since version 1.1.1
- Fixed maximum MTU tracking in server statistics
- Fixed 'iroute' option processing to handle multiple routes (625)
- Fixed session accounting for roaming users (674)
- occtl: fix invalid JSON output in `occtl -j show iroutes` (661)
- occtl: fix regression with trailing commas in `occtl -j show sessions` (669)
- occtl: fix missing column headers in 'show ip bans' output (677)
- occtl: 'show ip bans' no longer shows expired bans (675)
- Fixed DTLS not working with systemd socket activation (647)
- Fixed a bug in the ban timer logic that could prevent IP addresses
from being banned or cause premature unbans (678)
- Session statistics are now reported at consistent intervals
for RADIUS compatibility (630)
- Single form to enter username and password (551)
afalg_engine AFAIK is a faster version of what OpenSSL provides last
time I used it. Although I don't think it was useful for long. OpenSSH's
sandbox conflicts with AF_ALG.
prosody: fix build, bump to to 0.12.6 and add test.sh
mod_s2s was refactored into a single mod_s2s.lua in the flat modules
directory in 0.12.x; remove the obsolete subdirectory install rule that
caused the package build to fail.
Also add util/human/ and util/prosodyctl/ which are new subdirectories
in 0.12.x not covered by the previous install rules.
Force libidn instead of ICU for stringprep
prosody's configure script auto-detects stringprep backends and prefers
ICU when available, generating -DUSE_STRINGPREP_ICU and including
<unicode/usprep.h>. The OpenWrt SDK staging directory does not provide
ICU development headers, so the build fails with:
encodings.c:271:10: fatal error: unicode/usprep.h: No such file or directory
The Makefile DEPENDS already declares +libidn. Pass --with-idn=idn to
explicitly select the libidn backend, which is available in the staging
directory.
Also, pass TARGET="../util/" to MAKE_FLAGS. OpenWrt has it's own TARGET
env var which clobbers the 'TARGET' var from prosody's build (specified
as 'TARGET?=../util/')
Adding a test.sh to check for the correct version (since prosody mostly
has lua scripts).
Security release addressing multiple vulnerabilities. 0.12.6 is
likely the last release of the 0.12.x series (EOL June 2026).
Update avahi from 0.8 to 0.9-rc4. The 0.9 development line accumulates
four years of bug and security fixes since the 0.8 release (2020-02-18).
Notable improvements in 0.9-rc4 over 0.8:
Security (all CVEs previously backported as patches, now removed):
- CVE-2023-38469: reject TXT records whose total rdata exceeds
AVAHI_DNS_RDATA_MAX, preventing heap-buffer reads under crafted mDNS
- CVE-2023-38470: ensure each DNS label is at least one byte, preventing
an infinite loop on malformed packets
- CVE-2023-38471: extract host name via avahi_unescape_label() before
generating an alternative to avoid operating on a raw escaped string
- CVE-2023-38472: check that rdata pointer is non-NULL before passing to
avahi_rdata_parse() from dbus-entry-group
- CVE-2023-38473: derive alternative host name from its unescaped form,
fixing incorrect hostname collision resolution with escaped labels
Bug fixes (previously backported):
- Fix NULL-pointer crashes in avahi_s_*_browser_new() (#175)
- Avoid infinite loop in avahi-daemon simple-protocol by handling
AVAHI_WATCH_HUP event in client_work
- Fix potential undefined behaviour in avahi_dns_packet_consume_uint32:
cast uint8_t operands to uint32_t before shifting
- Fix memory/CPU leak in the simple event loop: cleanup_watches() was
zeroing timeout_req_cleanup instead of watch_req_cleanup, so completed
watches were never removed from the linked list
- Emit D-Bus error reply when avahi-daemon cannot resolve a hostname or
service, rather than crashing with a NULL dereference
- Increase ini-file-parser line buffer from 256 to 1024 bytes to handle
longer configuration values without silent truncation
Other changes:
- P2P tunnel support: IFF_MULTICAST is no longer required for
point-to-point interfaces when allow-point-to-point=yes
- Runtime directory: configure.ac now derives the socket path from
${runstatedir} (defaults to ${localstatedir}/run), so the
explicit patch reverting the /run hardcoding is no longer needed
- Patch 010-pkgconfig.patch (pkgconfig prefix alignment) is retained
as it has not been merged upstream
Disable libsystemd (not available on OpenWrt)
avahi 0.9-rc4 added --enable-libsystemd which defaults to enabled and
fails configure when libsystemd is not found via pkg-config. OpenWrt
does not provide libsystemd; disable it explicitly.
Also pass --with-systemdsystemunitdir=no to suppress the pkg-config
lookup for the systemd unit directory.
Drop po/ subdir from build
The 0.9-rc4 tarball is a raw git archive; po/Makefile.in.in is not
pre-generated as it was in the 0.8 release tarball. autopoint (from
gettext) is needed to install it, but is not available in the OpenWrt
SDK. Since OpenWrt does not use NLS translations, remove po/ from
SUBDIRS in Makefile.am to avoid the missing po/Makefile.in.in error
during configure.
In 0.9-rc4 the D-Bus system.d directory changed from
$(sysconfdir)/dbus-1/system.d to $(datadir)/dbus-1/system.d,
so avahi-dbus.conf is now installed under usr/share/dbus-1/system.d.
Update the install rule source path accordingly; keep the on-device
destination at /etc/dbus-1/system.d for compatibility.
On master, updater help and missing-option text still refer to '-N'.
Use '-S' instead so the messages match accepted script options.
Also clarify that SECTION is the UCI section name/id to start.
This is a text-only change; runtime behavior is unchanged.
Changelog:
- Add UCM profiles for DualSense PS5 controller and multiple Qualcomm
platforms
- Improve USB audio device handling and HDA initialization patterns
- Enhance phantom jack detection and optional headphone output handling
- Add support for Steinberg audio devices and new MediaTek SoC configs
Changelog:
- Update to Unicode 15.1.0 standard with U+19DA marked DISALLOWED
- Switch from gnulib submodule to GNULIB_REVISION for build management
- Fix uninitialized memory and compiler warnings
- Improve reproducibility and cross-platform build compatibility
Changelog:
- Fix uninitialized value bug in idna_to_unicode_4z4z on malloc failure
- Restore Unicode table generation scripts for modern Perl compatibility
- Fix Windows/musl compatibility for version checking
- Achieve reproducible builds across tested platforms
Dirk Brenken [Mon, 4 May 2026 17:42:14 +0000 (19:42 +0200)]
banip: update 1.8.8-2
- optimized pidfile handling in the init file
- small cornercase fixes & improvements
- drop deprecated 'drop' feed (replaced by 'spamhaus' json feed with the same content)
- LuCI: expose the new JSON Lines Format in the feed editor
- readme update
FindLuaJIT.cmake uses NO_DEFAULT_PATH and only searches hardcoded
luajit-specific paths, so it never finds regular Lua. However if
LUAJIT_INCLUDE_DIRS and LUAJIT_LIBRARY are pre-set in the CMake
cache, find_path/find_library skip their searches, the module sets
LUAJIT_FOUND=ON and also sets LUA_INCLUDE_DIR/LUA_LIBRARIES from
those values, and the if(NOT LUAJIT_FOUND) guard skips the broken
find_package(Lua REQUIRED) call that fails under CMake 4.3.
George Sapkin [Mon, 10 Nov 2025 16:14:03 +0000 (18:14 +0200)]
ci: mark and close PRs with formality issues
Add a recurring workflow that runs every day at 5:30 and marks all PRs
that have formality check failures (i.e. marked as 'not following
guidelines') that have not been active in the past 14 days as stale.
Close stale PRs after 14 more days.
libquadmath is only packaged for x86 and powerpc targets in OpenWrt.
Declaring it as an unconditional runtime dependency of boost-charconv
causes apk installation failure on all other architectures (e.g.
i386, arm, mips) with "libquadmath (no such package)".
Guard the dependency with an ARCH filter so it is only pulled in on
platforms where the package actually exists.
Signed-off-by: Alexandru Ardelean <redacted>
boost: add x86 to libquadmath arch conditional in boost-charconv
libquadmath is available on x86 (i386) in addition to x86_64 and
powerpc variants. Include it in the filter so boost-charconv gets
the correct dependency on 32-bit x86 targets.
boost::asio::post() without an explicit executor fails to compile with
Boost >= 1.82 due to changes in the executor model: bare lambdas no
longer have an implicit system executor that satisfies the
blocking.never requirement.
Pass io_context_ explicitly as the first argument so the handler is
dispatched on the correct io_context thread, which is the original
intent of the call (making stop() safe to call from any thread).
Add test.sh
domoticz is a daemon requiring a database and network port; it does not
implement a --version flag. Verify the binary is present and executable.
Disable LTO to fix link failure on i386 with musl fortify
Suggested via https://github.com/openwrt/packages/pull/29239
Also tested.
Bump to latest upstream snapshot (2025-11-05). re2 uses date-based
versioning from git. This brings roughly two years of upstream
improvements including performance optimisations, bug fixes, and
C++17/20 compatibility improvements.
This commit was merged into the master branch by accident
and should be undone. Adding ujail as a hardcoded dependency
is incorrect, as ujail is meant to be an optional dependency.
A better approach is to implement ujail support within
the init script, which was discussed in the pull request
(https://github.com/openwrt/packages/pull/29277),
consistent with how other packages in the repository handle this.
Ernestas Kulik [Fri, 1 May 2026 08:59:47 +0000 (11:59 +0300)]
libgpiod: add python-setuptools host build dep
If python3-gpiod is enabled and the python-setuptools host package is
missing, the setuptools.build_meta import will cause a build failure.
Fix this by adding a conditional build dependency.
git.99rst.org / openwrt-packages.git / log