ecdsautils: update to 0.4.2

1b53b726f3dc ecdsautils 0.4.2
554e2585efd9 sha256: fix misaligned buffer read in ecdsa_sha256_update()
8c17b073647f sha256: remove burnStack function

Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>

tmux: update to 3.5a

Signed-off-by: Maxim Storchak <m.storchak@gmail.com>

sing-box: Update to 1.9.7

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

node: bump to v20.18.0

Notable Changes
Experimental Network Inspection Support in Node.js
Exposes X509_V_FLAG_PARTIAL_CHAIN to tls.createSecureContext
New option for vm.createContext() to create a context with a freezable globalThis

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

libucontext: update to 1.3.2

Switch to local tarballs instead of codeload. No need to override
PKG_BUILD_DIR.

Remove PKG_BUILD_PARALLEL and PKG_INSTALL as they are not needed with
meson.

Remove upstreamed patch.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

libpng: fix compilation with loongarch64

Explicitly disable unsupported hardware acceleration instead of trying
to match against targets.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

pbr: update to 1.1.7-21

* switch to dstnat chain from dstnat_lan chain for dns & tor policies (thanks @egc112)
* re-introduce procd_lan_interface for better LAN detection
* improve is_domain function
* introduce health-check for requried fw4 chains
* bugfix: avoid double counters for dns policies
* bugfix: remove faulty counters for tor policies
* rename interface_process to process_interface for better code readability
* overhaul pbr.user.aws script for a much better performance and more compact
  (gzipped) storage of the ranges json locally (thanks @bigsmile74)

Signed-off-by: Stan Grishin <stangri@melmac.ca>

xray-core: update to 24.9.30

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

go2rtc: initial package

Signed-off-by: Vladimir Ermakov <vooon341@gmail.com>

netbird: update to 0.30.0

Signed-off-by: Wesley Gimenes <wehagy@proton.me>

mwan3: add check_quality for httping

Example output of TRACK_OUTPUT (httping -c 1 -t 1 'http://www.google.co.uk'):

PING www.google.co.uk:80 (/):
connected to 142.250.200.35:80 (654 bytes), seq=0 time=136.58 ms
--- http://www.google.co.uk/ ping statistics ---
1 connects, 1 ok, 0.00% failed, time 1137 ms
round-trip min/avg/max = 136.6/136.6/136.6 ms

Signed-off-by: William Solichin <william.r.solichin@protonmail.com>

utils/xz: fix license

Remove GPL-2.0+ and GPL-3.0+ from PKG_LICENSE as GNU GPLv2+ and GPLv3+
are only used for the build system as stated in [1]:

 The build system contains public domain files, and files that
 are under GNU GPLv2+ or GNU GPLv3+. None of these files end up
 in the binaries being built.

Moreover, add 0BSD which is used since version 5.6.0 [2]

[1]: https://github.com/tukaani-project/xz/commit/02ddf09bc3079b3e17297729b9e43f14d407b8fc
[2]: https://github.com/tukaani-project/xz/commit/689e0228baeb95232430e90d628379db89583d71

Fixes: b9e87eeb7deb8b3890415b835c9c69764893c023 (xz: import from old packages feed)
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>

haveged: Update to 1.9.19

Update haveged to version 1.9.19.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

php8: update to 8.3.12

This fixes:
    - CVE-2024-8925
    - CVE-2024-8926
    - CVE-2024-8927
    - CVE-2024-9026

Upstream changelog:
https://www.php.net/ChangeLog-8.php#8.3.12

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

netbird: update to 0.29.4

Signed-off-by: Wesley Gimenes <wehagy@proton.me>

netbird: update to 0.29.3

Signed-off-by: Wesley Gimenes <wehagy@proton.me>

netbird: update to 0.29.2

Signed-off-by: Wesley Gimenes <wehagy@proton.me>

hev-socks5-server: update to 2.6.8

Signed-off-by: Ray Wang <r@hev.cc>

libxslt: update to 1.1.42

Fixes compilation with newer libxml2.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

meta: VS Code: Git: Always Sign Off

Signed-off-by: Andrey Butirsky <butirsky@gmail.com>

dnsdist: update to 1.9.7

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>

jool: add hotplug script to disable fraglist GRO

The kernel module translation code cannot deal with it

Signed-off-by: Felix Fietkau <nbd@nbd.name>

jool: add missing dependency

Signed-off-by: Felix Fietkau <nbd@nbd.name>

golang: Update to 1.23.2

go1.23.2 (released 2024-10-01) includes fixes to the compiler, cgo,
the runtime, and the maps, os, os/exec, time, and unique packages.

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

CONTRIBUTING.md: remove incorrect info about `PKG_VERSION`

The documentation stated that `PKG_VERSION` is the OpenWrt version
and therefore includes the `PKG_RELEASE`, but this statement
was incorrect and has been removed to avoid confusion.

Signed-off-by: Wesley Gimenes <wehagy@proton.me>

rclone: Update to 1.68.1

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

v2ray-geodata: Update to latest version

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

v2ray-core: Update to 5.19.0

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

stress-ng: bump to version 0.18.05

Changelog: https://github.com/ColinIanKing/stress-ng/releases/tag/V0.18.05

Signed-off-by: John Audia <therealgraysky@proton.me>

tmux: update to 3.5

Signed-off-by: Maxim Storchak <m.storchak@gmail.com>

lsof: update to 4.99.3

Signed-off-by: Maxim Storchak <m.storchak@gmail.com>

qemu: update to 9.1.0

- Update version
- Refresh patches
- Remove unsupported config options:
  - `--enable-live-block-migration`
  - `--disable-pvrdma`

Signed-off-by: Vladimir Ermakov <vooon341@gmail.com>

tailscale: add Sandro Jäckel as a maintainer

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
Signed-off-by: Zephyr Lykos <git@mochaa.ws>

tailscale: Update to 1.74.1

Signed-off-by: Zephyr Lykos <git@mochaa.ws>

tailscale: Update to 1.74.0

https://github.com/tailscale/tailscale/releases/v1.74.0

This commit also updates package maintainer to me, since Jan Pavlinec
has been unresponsive for a year.

Signed-off-by: Zephyr Lykos <git@mochaa.ws>

nut: specify pid path during build

nut was recently upgraded to 2.8.1 which includes a change in
configure.ac that uses /run for the pidfile if it exists during build.

Explicitly specify --with-pidpath to use the path that was used with
2.8.0 and prior.

The symptom here was that there'd be leftover processes when nut-monitor
was restarted.

Fixes: 82f36e0c781d ("nut: update to 2.8.1")
Fixes: https://github.com/openwrt/packages/issues/24106
Signed-off-by: Matt Merhar <mattmerhar@protonmail.com>

runc: Update to 1.1.14

This is the fourteenth patch release in the 1.1.z release branch of
runc. It includes a fix for a low severity security issue
(CVE-2024-45310) as well as some minor build-related fixes (including Go
1.23 support).
Fix CVE-2024-45310, a low-severity attack that allowed
maliciously configured containers to create empty files and directories on
the host.
Add support for Go 1.23.
Revert "allow overriding VERSION value in Makefile" and add EXTRA_VERSION.
rootfs: consolidate mountpoint creation logic.

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

dockerd: Update to 27.3.1

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

containerd: Update to 1.7.22

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

docker: Update to 27.3.1

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

gstreamer1: bump to 1.24.8

Compile-tested
Runtime-tested

Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>

gst1-plugins-ugly: bump to 1.24.8

Compile-tested
Runtime-tested

Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>

gst1-plugins-good: bump to 1.24.8

Compile-tested
Runtime-tested

Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>

gst1-plugins-base: bump to 1.24.8

Compile-tested
Runtime-tested

Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>

gst1-plugins-bad: bump to 1.24.8

Compile-tested
Runtime-tested

Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>

gst1-libav: bump to 1.24.8

Compile-tested
Runtime-tested

Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>

gst1-plugins-bad: switch to https source

The current http simply points to the new https.

Switch to it directly like it's already done for
the other gstreamer libs.

Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>

openwisp-config: update to 1.1.0

Signed-off-by: Gagan Deep <pandafy.dev@gmail.com>

openwisp-monitoring: update to 0.2.0

Signed-off-by: Gagan Deep <pandafy.dev@gmail.com>

tailscale: build with less features

Omit usually unused features:

- ipn.StateStore implementation using AWS SSM
- BIRD Internet Routing Daemon client
- tstun TAP device for bridging
- Kubernetes kubectl configuration utility
- Command line completion script generation

This shaves off about 500kb from the final executable.

Signed-off-by: Zephyr Lykos <git@mochaa.ws>

ctop: Drop unused variable

Co-authored-by: Tianling Shen <cnsztl@immortalwrt.org>
Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

golang: Optimized values to suit golang 1.23

Added GOARM64 and GORISCV64 in golang-build.sh.
Drop deprecated GOROOT_FINAL in GoCompiler/Default/Make.
Updated environment vars in golang-values.mk for GOARM64 and GORISCV64.
Refined host build in golang/Makefile for openbsd_riscv64.

Co-authored-by: Tianling Shen <cnsztl@immortalwrt.org>
Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

golang: Update to 1.23.1

Go 1.23.1 (released 2024-09-05) includes security fixes to
the encoding/gob, go/build/constraint, and go/parser
packages. It also addresses bug fixes in the compiler,
go command, runtime, and the database/sql, go/types,
os, runtime/trace, and unique packages.

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

owut: update to 2024.09.28

Bug fixes:
    efahl/owut@20d5afb owut: translate mapped names from platform 'supported_devices'

Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>

rust: use `TARGET_LINKER` as linker

Signed-off-by: hingbong lo <hingbonglo@gmail.com>

eza: update to 0.20.0

eza has been relicensed to European Union Public License 1.2 (EUPL-1.2)
with v0.20.0.

Release notes:
0.19.3: https://github.com/eza-community/eza/releases/tag/v0.19.3
0.19.4: https://github.com/eza-community/eza/releases/tag/v0.19.4
0.20.0: https://github.com/eza-community/eza/releases/tag/v0.20.0

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>

btop: Update to 1.4.0

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

git: update to 2.46.2

- Refresh patches

Signed-off-by: Aleksey Vasilenko <aleksey.vasilenko@gmail.com>

crowdsec-firewall-bouncer: updated to new upstream release version 0.0.31

Signed-off-by: S. Brusch <ne20002@gmx.ch>
Maintainer: Kerma Gérald <gandalf@gk2.net>
Run tested: mediatek/filogic, BPI-R3, Openwrt 23.05.5

Description:

    updated to new upstream release version 0.0.31

pbr: update to 1.1.7-15

* implement system health check on start for required fw4 table/chains
* add error messages for failed health checks
* move resolver check & config from load_package_config to load_environment
* no longer filter only static rules for pbr_* tables

Signed-off-by: Stan Grishin <stangri@melmac.ca>

Revert "mwan3: use network_get_preferred_ipaddr6"

This reverts commit fc3cc2fe5c33b36014178d3652785d00cae1c9eb.

As long as the related pullrequest [1] is not merged, this change must be
revert.

[1] https://github.com/openwrt/openwrt/pull/14333

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

squid: update to 6.11

Signed-off-by: Aleksey Vasilenko <aleksey.vasilenko@gmail.com>

libpng: update to 1.6.44

- Refresh patch

Signed-off-by: Aleksey Vasilenko <aleksey.vasilenko@gmail.com>

sing-box: Update to 1.9.6

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

sing-box: Update to 1.9.5

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>

openssh: bump to 9.9p1

Release notes: https://www.openssh.com/txt/release-9.9

Added upstream patch to fix build[1]

1. https://github.com/openssh/openssh-portable/commit/76a618d2842c34c16cd21a4efc7230e2f459008d.patch

Build system: x86/64
Build-tested: x86/64/AMD Cezanne
Run-tested: x86/64/AMD Cezanne

Signed-off-by: John Audia <therealgraysky@proton.me>

iputils: bump to 20240905

Refresh patches

Signed-off-by: Noah Meyerhans <frodo@morgul.net>

ddns-scripts: fix update_porkbun_v3 shell syntax

The closing bracket was forgotten in a function.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

pbr: bugfix: filter only static routes for new tables

* fixes https://github.com/openwrt/packages/issues/24999

Signed-off-by: Stan Grishin <stangri@melmac.ca>

fwupd: add package

Signed-off-by: Lukas Voegl <lvoegl@tdt.de>

libgudev: add package

Signed-off-by: Lukas Voegl <lvoegl@tdt.de>

libxmlb: add package

Signed-off-by: Lukas Voegl <lvoegl@tdt.de>

libjcat: add package

Signed-off-by: Lukas Voegl <lvoegl@tdt.de>

iperf3: explicitly disable SCTP

Since https://github.com/openwrt/openwrt/commit/3fa5ee0b28b736c5d06af34ed5c3e80f78235fe8
OpenWrt no longer disables SCTP support by default.
It caused the leak of libsctp dependency to iperf3.
Here we disable it explicitly to fix the build.

Signed-off-by: Aleksey Vasilenko <aleksey.vasilenko@gmail.com>

knot-resolver: update to version 5.7.4

Knot Resolver 5.7.4 (2024-07-23)
================================

Security
--------
- reduce buffering of transmitted data, especially TCP-based in userspace
  Also expose some of the new tweaks in lua:
   (require 'ffi').C.the_worker.engine.net.tcp.user_timeout = 1000
   (require 'ffi').C.the_worker.engine.net.listen_{tcp,udp}_buflens.{snd,rcv}

Improvements
------------
- add the fresh DNSSEC root key KSK-2024 already, Key ID 38696

Incompatible changes
--------------------
- libknot 3.0.x support is dropped
  Upstream last maintained 3.0.x in spring 2022.

Knot Resolver 5.7.3 (2024-05-30)
================================

Improvements
------------
- stats: add separate metrics for IPv6 and IPv4

Bugfixes
--------
- fix NSEC3 records missing in answer for positive wildcard expansion
  with the NSEC3 having over-limit iteration count

Knot Resolver 5.7.2 (2024-03-27)
================================

Bugfixes
--------
- fix on 32-bit systems with 64-bit time_t

Signed-off-by: Jan Hák <jan.hak@nic.cz>

libmariadb: update to 3.4.1

- Remove a mirror with invalid certificate
- Manually rebase 010-link-to-libucontext.patch
- Add new 020-fix-ucontext-maybe-uninitialized.patch

Signed-off-by: Aleksey Vasilenko <aleksey.vasilenko@gmail.com>

mariadb: update to 11.4.3

- Remove 2 upstreamed libfmt patches
- Manually refresh 180-relax-mysql_install-db-wrt-pam-tool.patch
- Automatically refresh remaining patches

Signed-off-by: Aleksey Vasilenko <aleksey.vasilenko@gmail.com>

clamav: update to 1.4.1

Signed-off-by: Aleksey Vasilenko <aleksey.vasilenko@gmail.com>

nghttp2: update to 1.63.0

Signed-off-by: Aleksey Vasilenko <aleksey.vasilenko@gmail.com>

owut: update to 2024.09.21

Bug fixes:
    efahl/owut@e791bd2 owut: more robust handling of build errors
Enhancements:
    efahl/owut@853f5ab owut: don't use "extra" versions
    efahl/owut@4629b0f owut: minor cleanups

Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>

dnsproxy: fix set hosts options

1. Mount hosts files since the daemon is in ujail
2. Set hosts options at last as all other options set after it will
   be ignored

Drop redundant reload_service func while at it.

Fixes: ecdf98767e03 ("dnsproxy: add hosts configurations")
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

stress-ng: bump to version 0.18.04

Patch needed a refresh

Build system: x86/64
Build-tested: x86/64/AMD Cezanne
Run-tested: x86/64/AMD Cezanne

Signed-off-by: John Audia <therealgraysky@proton.me>
Co-authored-by: Tianling Shen <cnsztl@gmail.com>

exfatprogs: update to 1.2.5

Signed-off-by: Aleksey Vasilenko <aleksey.vasilenko@gmail.com>

btrfs-progs: update to 6.11

- Update package URL

Signed-off-by: Aleksey Vasilenko <aleksey.vasilenko@gmail.com>

tgt: update to 1.0.93

Signed-off-by: Maxim Storchak <m.storchak@gmail.com>

docker-compose: Update to version 2.29.7

Release notes:
https://github.com/docker/compose/releases/tag/v2.29.7

Signed-off-by: Javier Marcet <javier@marcet.info>

docker-compose: Update to version 2.29.6

Release notes:
https://github.com/docker/compose/releases/tag/v2.29.6

Signed-off-by: Javier Marcet <javier@marcet.info>

docker-compose: Update to version 2.29.5

Release notes:
https://github.com/docker/compose/releases/tag/v2.29.5

Signed-off-by: Javier Marcet <javier@marcet.info>

tailscale: Fix README.md

There is only one package since commit 7bef195bbabcec88a2b9055846880fd93c2a8a7a. Not two like the readme says.

Signed-off-by: John Schmidt <john@schmidthaus.rocks>

dnsproxy: migrate old options

Migrate "all_servers" and "fastest_addr" to new option "upstream_mode".

Fixes: d0823a8244a0 ("dnsproxy: Update to 0.73.2")
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

haproxy: update to v3.0.5

- Update haproxy PKG_VERSION and PKG_HASH
- See changes: http://git.haproxy.org/?p=haproxy-3.0.git;a=shortlog

Signed-off-by: Christian Lachner <gladiac@gmail.com>

crowdsec-firewall-bouncer: updated to new upstream release version 0.0.30

Signed-off-by: S. Brusch <ne20002@gmx.ch>
Maintainer: Kerma Gérald <gandalf@gk2.net>
Run tested: mediatek/filogic, BPI-R3, Openwrt 23.05.4

Description:

    updated to new upstream release version 0.0.30

pbr: update to 1.1.7-10

* allow using WG servers as gateways if explicitly set in supported_interface
* automatically execute user scripts in /etc/pbr.d/
* change the dnsmasq restart logic on start/reload/restart
* further nft file atomic mode-related code cleanup
* fix spelling in error message

Signed-off-by: Stan Grishin <stangri@melmac.ca>

adblock-fast: bugfixes and shellcheck update

* BUGFIX: correctly identify available RAM
* BUGFIX: properly store remote list filesize in config
* shellcheck updates

Signed-off-by: Stan Grishin <stangri@melmac.ca>

zerotier: test network is called earth

The official name of this public network
for testing is Earth.

Signed-off-by: Moritz Warning <moritzwarning@web.de>

zerotier: fix option disabled

Signed-off-by: Moritz Warning <moritzwarning@web.de>

zerotier: update to 1.14.1

Signed-off-by: Moritz Warning <moritzwarning@web.de>

banIP: update to 1.0.0-7

* fixed auto allow-/blocklist-issue with IPv6 addresses in CIDR notation
* removed edrop feed from readme (had been removed from feeds for a while)

Signed-off-by: Dirk Brenken <dev@brenken.org>

linuxptp: update to v4.4

- Replaced SF project and download URLs with nwtime ones.
  The project is now hosted at https://linuxptp.nwtime.org/.

- Removed 020-gcc14.patch. Missing include was fixed upstream
  in v4.2.

- Added patch to disable MAC library autodetection. That
  can silently pick up unwanted dependencies, depending on
  package build order. We can add linuxptp-<mac lib> variants
  of this package later if there are users of authenticated
  PTP.

Signed-off-by: Shenghao Yang <me@shenghaoyang.info>

podman: Update to 5.2.2

- Cleanup Makefile
- Refresh patches
- Simplify go tags
- Separate go tags with space due to upstream change
- Remove vars which are indentical to upstream or empty
- Invoke built-in go vars instead of duplicating one by one

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Tested-by: Dirk Buchwalder <buchwalder@posteo.de>