Adds an initscript for zabbix_server, and related helper files
+ uses a zabbix_server uci conf to enable/disable startup
+ updates the default zabbix_server.conf to work with initscript
+ add a sysctl.d conf to set max-files more appropriate for zabbix_server
Addresses the issue pointed out in #28165, which is that zabbix_agentd
always creates a PidFile and has no option to disable PidFile creation.
Therefore update the configuration file to default to create a PidFile
where we want it.
We are pleased to announce the release of Unicode® ICU 78.2. It updates to CLDR 48.1. These are maintenance releases for ICU 78 and CLDR 48, with limited sets of bug fixes and no API or structural changes.
ICU 78.2 also includes a small number of bug fixes, as well as a minor update for time zone data (tzdata) version 2025c (2025-dec) ICU-23296.
Andrea Ferro [Mon, 12 Jan 2026 14:10:01 +0000 (15:10 +0100)]
ddns-scripts: add apertodns.com-token to provider list
Add missing provider entry for apertodns.com-token.
The service configuration (apertodns.com-token.json) was already
merged in PR #28160, but the provider list entry was missing.
Dirk Brenken [Mon, 12 Jan 2026 21:59:19 +0000 (22:59 +0100)]
banip: release 1.8.0-1
* hardened the uci config parsing
* added a fast, flexible & secure IPv4/IPv6 validator function, it eliminates > 99 % of garbage inputs
Please note: The ‘rule’ in the feed file now only contains parameters for the IP validator;
details can be found in the readme file. Old custom feed files are not compatible and will be
backed up/removed via the uci-defaults script
* added BCP38 support: to block packets with spoofed source IP addresses in all supported chains
* optimized the log monitor plus performance improvements
* removed the pallebone feed (discontinued)
* added the ipexdbl feed
* various small improvements
* LuCI: add the BC38 option under Table/Chain Settings
* LuCI: updating the custom feed editor
* LuCI: small usability improvements
* readme update
Michael Gray [Sat, 10 Jan 2026 04:42:36 +0000 (15:42 +1100)]
miniupnpd: enable IPv6 leases file
Introduces the IPv6 Leases file by default. This file will display active IPv6 leases requested under the IPv6 PCP (Port Control Protocol) a.k.a IPv6 Pinholes.
miniupnpd must be compiled with ENABLE_UPNPPINHOLE set for this to take effect. This is taken care of currently by setting CONFIG_IPV6.
The lease file looks something like
Proto;ClientIP;ClientPort;RemoteIP;RemotePort;UID;Timestamp;Description
Andrea Ferro [Sat, 10 Jan 2026 17:46:13 +0000 (18:46 +0100)]
ddns-scripts: add ApertoDNS DDNS provider
Add support for ApertoDNS dynamic DNS service with two configuration
options:
- apertodns.com: Standard DynDNS2 compatible authentication (user/pass)
- apertodns.com-token: Token-based authentication for DDNS clients
Both configurations support IPv4 and IPv6 updates via the standard
/nic/update endpoint.
Florian Eckert [Thu, 18 Dec 2025 13:12:49 +0000 (14:12 +0100)]
zabbix: zabbix-server-frontend: update dependency
Only show zabbix-server-frontend if the build dependency 'PACKEGE_php8' is
fulfilled. This means that 'zabbix-server-frotend' can only be selected if
PHP has also been enabled for building.
This change is needed to fix the following recursive dependency warning.
error: recursive dependency detected!
symbol PACKAGE_php8 is selected by PACKAGE_zabbix-server-frontend
symbol PACKAGE_zabbix-server-frontend depends on PHP8_DOM
symbol PHP8_DOM depends on PACKAGE_php8
For a resolution refer to Documentation/kbuild/kconfig-language.rst
Florian Eckert [Thu, 18 Dec 2025 12:11:23 +0000 (13:11 +0100)]
php8: add php8 depends and move compile option to Config.in
The php8 Makefile is already quite large. To improve readability, move
config section to a separate 'Config.in' file. To ensure that the PHP8
option is only saved in '.config' if PHP8 has been selected for building. A
depends on 'PACKAGE_php8' is added to the configuration option in the
'Config.in' file.
Torbjorn Tyridal [Tue, 18 Nov 2025 14:02:25 +0000 (14:02 +0000)]
strongswan: Add support for EAP-TLS authentication
Support for configuring EAP-TLS authentication scheme is added.
Similar to EAP-MSCHAPv2, this one is usually asymmetric
in the way that server auth method (pubkey) is different from
the client auth method (eap-tls).
The code handles this asymmetry automatically.
* Various options have changed since radicale2, and the current
initscripts set configuration that prevents radicale3 from starting
in some cases. So update the options to radicale3.
* LuCI will not display the app when the config file is empty, so
uncomment the first (server section) line.
* Changed the default data directory to /var (emphemeral storage) as
OpenWrt policy is to not write flash by default. As with PostgreSQL,
to be useful the user will need to set configuration for an
appropriate path.
* fix service_reload in initscript so it reloads configuration
* fold long lines for readability
* shellcheck is a useful linter, if a bit pedantic, so use it and
update script to address its warnings.
Wei-Ting Yang [Thu, 8 Jan 2026 04:35:42 +0000 (12:35 +0800)]
python-urllib3: update to 2.6.3
- Fixed HTTPResponse.read_chunked() to properly handle leftover data
in the decoder's buffer when reading compressed chunked responses.
- Fixed a security issue where decompression-bomb safeguards of the
streaming API were bypassed when HTTP redirects were followed.
(CVE-2026-21441)
- Started treating Retry-After times greater than 6 hours as 6 hours
by default.
- Fixed urllib3.connection.VerifiedHTTPSConnection on Emscripten.
This package is not compiled due to this build log failure:
```
adding 'radicale-2.1.12.dist-info/RECORD'
removing build/bdist.linux-aarch64/wheel
Successfully built radicale-2.1.12-py3-none-any.whl
Traceback (most recent call last):
File "<frozen runpy>", line 198, in _run_module_as_main
File "<frozen runpy>", line 88, in _run_code
File "/builder/shared-workdir/build/sdk/staging_dir/hostpkg/lib/python3.13/site-packages/installer/__main__.py", line 98, in <module>
_main(sys.argv[1:], "python -m installer")
~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/builder/shared-workdir/build/sdk/staging_dir/hostpkg/lib/python3.13/site-packages/installer/__main__.py", line 86, in _main
with WheelFile.open(args.wheel) as source:
~~~~~~~~~~~~~~^^^^^^^^^^^^
File "/builder/shared-workdir/build/sdk/staging_dir/target-aarch64_cortex-a53_musl/usr/lib/python3.13/contextlib.py", line 141, in __enter__
return next(self.gen)
File "/builder/shared-workdir/build/sdk/staging_dir/hostpkg/lib/python3.13/site-packages/installer/sources.py", line 162, in open
with zipfile.ZipFile(path) as f:
~~~~~~~~~~~~~~~^^^^^^
File "/builder/shared-workdir/build/sdk/staging_dir/target-aarch64_cortex-a53_musl/usr/lib/python3.13/zipfile/__init__.py", line 1367, in __init__
self.fp = io.open(file, filemode)
~~~~~~~^^^^^^^^^^^^^^^^
FileNotFoundError: [Errno 2] No such file or directory: '/builder/shared-workdir/build/sdk/build_dir/target-aarch64_cortex-a53_musl/pypi/Radicale-2.1.12//openwrt-build/Radicale-2.1.12-*.whl'
```
This occurred due to PEP 625, which requires wheel filenames in lowercase.
The local build produces lowercase-compliant names (radicale-2.1.12-*.whl),
but the script searches for uppercase (Radicale-2.1.12-*.whl).
Josef Schlehofer [Mon, 29 Dec 2025 09:04:15 +0000 (10:04 +0100)]
radicale3: new package
Radicale is a small but powerful CalDAV (calendars, to-do lists) and
CardDAV (contacts) server.
This package provides the latest 3.x series, which succeeds radicale2.
This is replacament for recently dropped radicale2 and radicale1.
Stan Grishin [Thu, 8 Jan 2026 03:22:38 +0000 (03:22 +0000)]
https-dns-proxy: update to 2025-12-29-1
* bump binary to 2025.12.29 with support for -S
* update README and delete README in files/
* bugfix: properly load global option for `force_ipv6_resolvers`
* add global and per-instance `source_addr` option
Thanks to @karl82 for adding source_addr support upstream.
Qingfang Deng [Sun, 4 Jan 2026 03:15:23 +0000 (11:15 +0800)]
libteam: add new package
libteam is a userspace tool to configure Linux network teaming.
This consists of 5 packages:
- libteam.so is a wrapper library to interface the Team Netlink API.
- teamd is a service/daemon to control a team netdev using the libteam library.
- teamdctl is a utility to alter teamd configuration at runtime.
- libteamdctl.so is a library used by teamdctl.
- teamnl is a utility mainly for debugging.
Instead of the xinetd-org sources, the OpenSUSE fork is used now
because the xinetd-org version is not maintained anymore. This fork
is used by Debian too and obsoletes the patches that were used
previously for the packaging at OpenWrt.
This rework was unneeded, rather the fix in
https://github.com/openwrt/packages/pull/28174 is required to resolve
missing HTTP_AUTH support.
The original issue in https://github.com/openwrt/packages/issues/27526
(unable to update OVH DynHost IP address) was wrongly attributed to a
change on the OVH API. As discussed in
https://github.com/openwrt/packages/issues/28172 the API continues to
work for 24.10.5 system, as well as users using wget-ssl.
The changes in https://github.com/openwrt/packages/pull/27561 and
the followup fix https://github.com/openwrt/packages/pull/27694 add
unnecessary dependencies which are heavier than the actually needed
minimum.
Therefore return the OVH provider to the previous state, and let
https://github.com/openwrt/packages/pull/28174 resolved the issue.
kea: fix build issue with boost-1.90 static assert
The headers apparently changed in 1.90 from 1.89 and the
definition for BOOST_STATIC_ASSERT() needs to be brought
in explicitly from <boost/static_assert.hpp> which wasn't
previously the case.
John Audia [Sat, 3 Jan 2026 22:14:17 +0000 (17:14 -0500)]
fscrypt: update to 0.3.6
Latest upstream source. shortlog:
Eric Biggers (13):
README.md: fix a typo
Fix non-constant format string passed to errors.Wrapf()
ci.yml: upgrade ubuntu-20.04 to ubuntu-latest
filesystem/mountpoint: fall back to using mount source field
Bump up required Go version to 1.23
Upgrade golang.org/x/sys
Upgrade golang.org/x/term
Upgrade golang.org/x/crypto
Upgrade google.golang.org/protobuf
Upgrade honnef.co/go/tools
Upgrade golang.org/x/tools
Upgrade github.com/urfave/cli
v0.3.6
NymanRobin (1):
Compare mount by value instead of reference
Petteri Räty (1):
Document stdin behaviour for getting raw key
dependabot[bot] (1):
build(deps): bump golang.org/x/crypto in the go_modules group
dkg (1):
README.md: link to RFE about systemd-homed fscrypt version support (#412)
John Audia [Fri, 19 Dec 2025 21:52:44 +0000 (16:52 -0500)]
libpfring: update to 9.2.0
Bump to 9.2.0 and swtich from git build to tagged tarball.
Added the following patches:
900-Fix-Compilation-on-kernel-6.17.patch (backport)
901-pf_ring-fix-virt_to_page-type-mismatch.patch (pending backport)[1,2]
Removed all upstreamed patches and removed MAINTAINER as no one is
maintaining this pkg. Note that this version is needed in order to
build against linux 6.18.
1. Suggested by CI co-pilot to prevent failure builds for ARM targets
including: arm_cortex9_vfpv3-d16, arm_cortex-a15_neon-vfpv4,
powerpc_464fp, and powerpc_8548.
Norman Gehrsitz [Wed, 31 Dec 2025 02:02:10 +0000 (03:02 +0100)]
acme-acme.sh: support --cert-profile option
acme 3.1.2 added a new --cert-profile option to request specific certificates.
This makes it possible to request shortlived six day certificates from Letsencrypt.
Josef Schlehofer [Wed, 31 Dec 2025 02:38:27 +0000 (03:38 +0100)]
pigeonhole: update to version 0.5.21.1
Release notes:
```
v0.5.21.1 2024-08-14 Aki Tuomi <redacted>
- sieve: When saving to local storage failed after a successful action
in sieve (e.g. redirect, vacation), the mail was reported as
successfully delivered, although it was lost locally.
```
Copy&pasted from
https://raw.githubusercontent.com/dovecot/pigeonhole/0.5.21.1/NEWS
Josef Schlehofer [Wed, 31 Dec 2025 02:33:18 +0000 (03:33 +0100)]
pigeonhole: change package versioning
The current pigeonhole Makefile is more complex than it needs to be, with
too many unique variables and the resulting package version
is currently this one:
```
dovecot-pigeonhole_2.3.21.0.5.21-r1_aarch64_cortex-a53.ipk
```
and based on Repology [1], it looks like we are the only GNU/Linux
distribution, who includes dovecot version and pigeonhole version
together. We should not include the extra dovecot version, because
even project [2] website does not do it except their tarball.
What we can do better is that we added and modify a little bit
EXTRA_DEPENDS, which ensures that pigenhole 0.5.21.1 will be used
for Dovecot 2.3, because of that, we can have package version as
it should be.
Josef Schlehofer [Wed, 31 Dec 2025 01:21:38 +0000 (02:21 +0100)]
dovecot-pigeonhole: fix Makefile syntax to match dovecot
Use $(XARGS) variable instead of plain xargs command, consistent with
the dovecot package implementation. Remove unnecessary space in
EXTRA_DEPENDS version constraint.
Fixes failing error on buildbot:
```
make[3]: warning: jobserver unavailable: using -j1. Add '+' to parent make rule.
Makefile:62: *** multiple target patterns. Stop.
time: package/feeds/packages/pigeonhole/compile#0.52#0.42#1.15
```
After that faulty commit the 'icu' package is always selected
even if php8 itself is not even selected.
Simple bug reproduction process:
perus@ub2510:/OpenWrt/aarch64$ rm .config
perus@ub2510:/OpenWrt/aarch64$ touch .config
perus@ub2510:/OpenWrt/aarch64$ make defconfig
Collecting package info: done
...
#
# configuration written to .config
#
perus@ub2510:/OpenWrt/aarch64$ grep -iE "php8|icu" .config
# PHP8
# CONFIG_PACKAGE_php8 is not set
CONFIG_PHP8_LIBXML=y
CONFIG_PHP8_DOM=y
CONFIG_PHP8_GETTEXT=y
CONFIG_PHP8_INTL=y
# CONFIG_PHP8_FULLICUDATA is not set
# end of PHP8
CONFIG_PACKAGE_icu=y
# CONFIG_PACKAGE_icu-data-tools is not set
# CONFIG_PACKAGE_icu-full-data is not set
Revert the commit, so that a fix can be developed and tested.
With CONFIG_PHP8_GETTEXT php8 always gains a
dependency on a version of the 'icu' package,
however said dependency is not declared, so
on gets compilation errors when
CONFIG_PHP8_GETTEXT=y but PACKAGE_icu is not
selected.
Therefore select PACKAGE_icu when PHP8_GETTEXT is
selected.
- Add coredns package 1.13.2
- Make wgsd-coredns package transitional to coredns with wgsd plugin enabled
- Make coredns plugin list configurable, disable heavy plugins by
default and add wgsd plugin
- Place the service into ujail
- Add netbox plugin
Co-authored-by: Tianling Shen <redacted> Signed-off-by: Vladimir Ermakov <redacted>
Josef Schlehofer [Mon, 29 Dec 2025 12:28:31 +0000 (13:28 +0100)]
treewide: remove Home Assistant dependencies
I previously attempted to package Home Assistant for OpenWrt.
However, given the announcement that Home Assistant will
primarily be supported via containers (e.g., Docker) or HA OS [1],
these specific Python package dependencies [2] are no longer needed.
I no longer maintain these packages, I don't use them, and there
are no other internal dependencies on them. Removing them will
result in slightly faster build times since they no longer require compilation.
Glenn Strauss [Sat, 27 Dec 2025 06:14:14 +0000 (01:14 -0500)]
lighttpd: mbedtls 3.x EC certs require drbg init
EC certs require drbg init with mbedtls >= 3.0.0
in addition to MBEDTLS_USE_PSA_CRYPTO requiring drbg init
x-ref:
"mbedtls error with ec certificates"
https://redmine.lighttpd.net/boards/2/topics/12097
"mod_mbedtls: ECDSA OpenSSL certificates do not work with lighttpd + mbedTLS/PSA (MBEDTLS_USE_PSA_CRYPTO)"
https://redmine.lighttpd.net/issues/3288
Alarcon Laurent [Wed, 24 Dec 2025 08:28:19 +0000 (09:28 +0100)]
lighttpd: fix plugin malformed dependencies
Dependencies for plugin authn_gssapi, authn_ldap, authn_pam, authn_dbi
and authn_sasl are not correctly written.
This cause lighttpd package to always compile krb5-libs, libopenldap and
libpam, even if not selected
Before the fix:
grep -e libpam -e krb5-libs -e libopenldap .config
\# CONFIG_PACKAGE_libpam is not set
\# CONFIG_PACKAGE_libopenldap is not set
\# CONFIG_PACKAGE_krb5-libs is not set
Josef Schlehofer [Mon, 29 Dec 2025 12:11:18 +0000 (13:11 +0100)]
jq: refactor variants and fix PROVIDES
Refactor package variants definition to be cleaner and more robust.
E.g.:
- Remove redundant PROVIDES:=jq from the main 'jq' package (it provides
itself automatically).
- Keep PROVIDES:=jq only on the 'jq-full' variant so it can serve as a
drop-in replacement.
- Use $(CP) macro rather than $(INSTALL_BIN) to preserve symlinks on shared objects
INSTALL_BIN turns all of the symlinks to files, increasing size.
Fixes: 711a19c4b23f3517ece5296d323c8f0220a0ff4e ("jq: provide regex support in additional package jq-full") Signed-off-by: Josef Schlehofer <redacted>
Obsolete use of $(SDK) in configure conditionals can result in
dependency errors when building a subset of packages for packages which
have multiple sub-packages.
The reason it causes dependency issues is that (using libdbi-drivers as
an example) lines like:
ifneq ($(SDK)$(CONFIG_PACKAGE_libdbd-sqlite3),)
always evaluate to true if you are compiling in the SDK. So for a user
compiling from the SDK, the configure arguments are always added to the package build.
Jordan Ngako [Thu, 25 Dec 2025 19:04:47 +0000 (20:04 +0100)]
libopen62541: preserve symlinks on install
$(INSTALL_BIN) follows symlinks, causing the .so to be copied multiple times.
Use $(CP) instead to preserve symlinks and cut package size by ~2/3.
OpenWrt libraries don’t need to be executable, so $(INSTALL_BIN) isn’t required.
Ruby 4.0 introduces "Ruby Box" and "ZJIT", and adds many improvements.
- Introduce experimental ZJIT compiler
- Improve YJIT performance and memory usage
- Add experimental Ruby Boxes object layout optimization
- VM and GC performance improvements
- Ractor runtime and scheduling enhancements
- Update language syntax and semantics (*nil behavior, logical operator parsing)
- Add Array#rfind and optimized Array#find
- Improve Binding API and implicit parameter access
- Extend Enumerator.produce with size keyword
- Enhance ArgumentError diagnostics with caller/callee context
- Add Fiber#raise(cause:)
- IO.select accepts Float::INFINITY timeout
- Improve Kernel#inspect extensibility
- Add Math.log1p and Math.expm1
- Promote Pathname and Set to core classes
- Extend Ractor API (join, value, lifecycle helpers)
- Fix endless and infinite Range behavior
- Define new top-level Ruby module
- Update Unicode to 17.0 and extend String strip methods
- Update bundled gems (RubyGems, Bundler, IRB, etc.)
Packaging changes:
- Include license files for all packages
- As ruby set moved into core, ruby-set is gone.
ruby-setsubclasscompact was added to include the set subclass
compatible layer
- Added conditional libatomic dependency for libruby
- YJIT and ZJIT are not built when cross-compiling (almost always for
openwrt, even when archs matches). However, the Makefile is ready for
both when upstream adds that feature. Config entries are marked as
BROKEN for now.
Changelog: https://github.com/ruby/ruby/compare/v3_4_0...v4.0.0 Signed-off-by: Luiz Angelo Daros de Luca <redacted>
TeleostNaCl Dai [Sun, 16 Nov 2025 04:05:11 +0000 (12:05 +0800)]
tcpreplay: add libbpf dependency
Since compiling tcpbridge requires linking libbpf.so.1, compiling tcpbridge first may result in compilation failure, like:
Package tcpbridge is missing dependencies for the following libraries: libbpf.so.1
The simplest way to solve it is to add libbpf dependency in Makefile
I use a small, custom application to convert data from my
electricity meter into Modbus format for my inverter and wallbox.
I developed this program against an earlier version of libmodbus
on x86, and it ran flawlessly on my ath79 router (big endian).
After migrating to a Mediatek router (little endian), the program
only outputted huge, meaningless values. However, it ran perfectly
fine on my x86 system (little endian), which is running Fedora
with libmodbus v3.1.11.
I then found several bug reports and the changelogs for libmodbus 3.1.11
that described and resolved my problem. So update openwrt to 3.1.11.
- Drop chcon and runcon as they require SELinux support and cannot be built from
coreutils 9.9 when configured with --without-selinux.
- Add libgmp dependency for coreutils-basenc to fix missing libgmp.so.10.
- Switch to -std=gnu17 to avoid build failure.
```
lib/openat-die.c: In function 'openat_save_fail':
lib/openat-die.c:37:3: error: format not a string literal and no format arguments [-Werror=format-security]
37 | error (exit_failure, errnum,
| ^~~~~
lib/openat-die.c: In function 'openat_restore_fail':
lib/openat-die.c:56:3: error: format not a string literal and no format arguments [-Werror=format-security]
56 | error (exit_failure, errnum,
| ^~~~~
```
- Refresh patch.
Ivan Diaz [Tue, 23 Dec 2025 13:30:29 +0000 (08:30 -0500)]
luci-app-watchcat: revert unnecessary quoting in init script
The quoting added in r18 for pinghosts is not needed. Multi-host support
remains fully functional, but the extra quotes caused inconsistent argument
handling between /etc/init.d/watchcat and /usr/bin/watchcat.sh,
especially for single-IP configurations.
This revert removes the unnecessary quoting in the init script and LUCI,
restoring consistent behavior while keeping multiple ping hosts supported.
Fixes: #28100 (watchcat: error if only one address is specified in pinghosts) Signed-off-by: Ivan Diaz <redacted>
commit ea66e463cffc0811757eedee80889323ff66191c added a new config
option LIBCURL_HTTP_AUTH to enable or disable HTTP_AUTH support in
cURL. It defaulted the option to n (disabled).
However, prior to this change HTTP_AUTH was enabled for cURL, as the
configure script defaults to HTTP_AUTH enabled when it is not
explicitly disabled.
This impacts any consumer of cURL that uses HTTP_AUTH, including
authentication by username and password in the URL. (Confirmed via
run testing).
So we set the default for the option to y (enabled).
For zabbix-server-frontend, the absence of php8-mod-filter results in
many of the frontend's pages failing to render. Therefore add this
module as a frontend dependency.
Without php8-mod-openssl the frontend fails with:
[13-Dec-2025 18:47:25 UTC] PHP Fatal error: Uncaught Error: Call to
undefined function openssl_random_pseudo_bytes() in
/www/zabbix/include/classes/helpers/CEncryptHelper.php:89
Stack trace:
CEncryptHelper::generateKey()
thrown in /www/zabbix/include/classes/helpers/CEncryptHelper.php on
line 89
Therefore add php8-mod-openssl as a frontend dependency.
git.99rst.org / openwrt-packages.git / log