Merge pull request #21568 from commodo/python-updates1

pillow, pymysql, requests: bump versions

banip: release 0.9.0-1

* supports allowing / blocking of certain VLAN forwards in segregated network environments,
   set 'ban_vlanallow', ''ban_vlanblock' accordingly
* simplified the code/JSON to generate/parse the banIP status
* enclose nft related devices in quotation marks , e.g. to handle devices which starts with a number '10g-1'
* made the new vlan options available to LuCI (separate commit)

Signed-off-by: Dirk Brenken <dev@brenken.org>

pillow: bump to version 10.0.0

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>

pymysql: bump to version 1.1.0

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>

python-requests: bump to version 2.31.0

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>

yq: Update to 4.34.2

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

cloudflared: Update to 2023.7.0

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

inih: Update to r57

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

shairport-sync: fix init script

'name' may contains '%h' or '%v', printf will fail on that

Signed-off-by: Liangbin Lian <jjm2473@gmail.com>

ooniprobe: Update to 3.18.0

This version includes support for Go 1.20 (specifically 1.20.5).

This also:

* Adds a workaround for musl 1.2.4 compatibility in mattn/go-sqlite3[1]

* Sets GO_PKG_BUILD_PKG to build the main binary (ooniprobe) only

* Updates the package license; the project was relicensed in 3.13.0[2]

[1]: https://github.com/mattn/go-sqlite3/issues/1164
[2]: https://github.com/ooni/probe-cli/pull/446

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

python-trove-classifiers: Update to 2023.7.6

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

click: Update to 8.1.4, rename source package

This renames the source package to python-click to match other Python
packages.

This also updates the package dependencies, licence file, package title
and description.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

python-editables: Update to 0.4

The build backend was changed from setuptools to flit-core.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

docker-compose: Update to version 2.20.0

Signed-off-by: Javier Marcet <javier@marcet.info>

python-cython: Update to 0.29.36

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

Merge pull request #21550 from mhei/php8-update-to-8.2.8

php8: update to 8.2.8

adguardhome: bump to 0.107.33

* Full changelog available at:
  * https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.30
  * https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.31
  * https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.32
  * https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.33

Signed-off-by: Dobroslaw Kijowski <dobo90@gmail.com>

php8: update to 8.2.8

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

Merge pull request #21545 from nmav/tmp-ocserv1.2.0

ocserv: updated to 1.2.0

ocserv: updated to 1.2.0

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

sedutil: fix compilation with GCC13

Upstream backport.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

libtins: fix compilation with GCC13

Patch taken from upstream.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

nginx-util: fix compilation with GCC13

Signed-off-by: Rosen Penev <rosenp@gmail.com>

treewide: make all GNOME URLs consistent

Signed-off-by: Rosen Penev <rosenp@gmail.com>

lua-rs232: fix compilation with GCC13

Patch taken from upstream.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

libaio: opt out of lto usage

Signed-off-by: Javier Marcet <javier@marcet.info>

Nlohmannjson: Update to version 3.11.2

Compile tested: OpenWRT-23.05-rc2, arm_cortex-a7_neon-vfpv4, mips_24kc
Run tested: arm_cortex-a7_neon-vfpv4 (Linksys MR8300), mips_24kc (tplink_archer-a7), OpenWrt 23.05-rc2)

* Update package nlohmannjson to version 3.11.2.
* Version 3.11.2 is source compatible with 3.10.2 so no package should fail to compile
* From version 3.11.2 on forward template declarations are collected in the file
  json_fwd.hpp. The json.hpp still contains all template definitions.
  Because in most compilation units of a software package only the file json_fwd.hpp
  needs to be included, the compilation process is accelerated a lot.

Signed-off-by: Volker Christian <me@vchrist.at>

stress-ng: bump to version 0.15.10

Merged patches into a single one.
Disabling libmpfr (which got added recently).
To avoid potentially new build failures.

And disabling test-compiler check.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>

tailscale: update to 1.44.0

Signed-off-by: Zephyr Lykos <git@mochaa.ws>

snort3: update to 3.1.65.0

Upstream bump

Build system: x86_64
Build-tested: x86_64/AMD 5800U
Run-tested: x86_64/AMD 5800U

Signed-off-by: John Audia <therealgraysky@proton.me>

luaposix: update to 36.2.1

Signed-off-by: Maxim Storchak <m.storchak@gmail.com>

iperf3: update to 3.14

Release Notes:
https://github.com/esnet/iperf/blob/master/RELNOTES.md

Signed-off-by: John Audia <therealgraysky@proton.me>

libre2: update to 2023-02-01

Fixes compilation with GCC13

Signed-off-by: Rosen Penev <rosenp@gmail.com>

File: Fix segfault

Executables depending on binary package libmagic segfault in case
package file is not installed. Libmagic needs file
/usr/share/misc/magic to not segfault. Thus, install
/usr/share/misc/magic along with libmagic and not with file.

Signed-off-by: Volker Christian <me@vchrist.at>

File: Update to version 5.44

Signed-off-by: Volker Christian <me@vchrist.at>

btop: opt out of lto usage

Signed-off-by: Javier Marcet <javier@marcet.info>

dfu-programmer: update to 1.1.0

Changes:
 * Add `--erase-first` option

Signed-off-by: Stefan Hellermann <stefan@the2masters.de>

banip: update 0.8.9-4

* made the etag id parsing more bulletproof (to catch unverified etags as well)

Signed-off-by: Dirk Brenken <dev@brenken.org>

banip: update 0.8.9-3

* prevent superflous etag function calls during start action (on start backups will be used anyway)
* changed the ipthreat feed download URL (load a compressed file variant to save bandwidth)

Signed-off-by: Dirk Brenken <dev@brenken.org>

pdns: update to 4.8.1

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>

frp: update to 0.51.0

XTCP is incompatible with previous versions since 0.49.0.

Changelog:
https://github.com/fatedier/frp/releases/tag/v0.49.0
https://github.com/fatedier/frp/releases/tag/v0.50.0
https://github.com/fatedier/frp/releases/tag/v0.51.0

Signed-off-by: Van Waholtz <brvphoenix@gmail.com>

banip: update 0.8.9-2

* fix a corner case backup issue with empty feed downloads

Signed-off-by: Dirk Brenken <dev@brenken.org>

banip: release 0.8.9-1

* added HTTP ETag or entity tag support to download only ressources that have been updated on the server side,
  to save bandwith and speed up banIP reloads
* added 4 new feeds: binarydefense, bruteforceblock, etcompromised, ipblackhole (see readme)
* updated the readme

Signed-off-by: Dirk Brenken <dev@brenken.org>

pdns-recursor: update to 4.9.0

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>

Merge pull request #21496 from Ansuel/add-mtools

net-mtools: Add new package to debug multicast setups

nyx: fix python 3.11 compatibility

Signed-off-by: Javier Marcet <javier@marcet.info>

net-mtools: Add new package to debug multicast setups

Add new package to debug multicast setups. This is required to use
kselftests script for network testing.

net-mtools is used instead of mtools as it does conflicts with another
package that is also called mtools.

Some additional patch from Vladimir Oltean are added to make the tool
works on kernel selftests scripts.

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>

nginx: don't install all module for FULL variant

We currently have a more or less circular dependency with nginx ssl and
full variant.

FULL variant depends on every nginx module. Every nginx module depends
on nginx-ssl.

Since nginx-full depends on an nginx module, nginx-ssl is installed as
module depends on it and then the installation fails as nginx-full
conflicts with nginx-ssl.

nginx-full in it's meaning is nginx built with every config selected and
it should not have module as dependency. In fact an user should always
install them separetly as while other things, local modification to the
nginx config file are required to include the just installed module.

To fix this circular dependency problem, drop the dependency of every
nginx module for FULL variant.

Fixes: #21300
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>

nginx: add quic modue

This commit  adds support for http/3. This is an experimental version
and isn't fully supported because nginx is being built with the regular
OpenSSL and the regular one doesn't support quic.

Signed-off-by: Tiago Gaspar <tiagogaspar8@gmail.com>

nginx: update to 1.25.1

Update nginx to 1.25.1.

    *) Feature: the "http2" directive, which enables HTTP/2 on a per-server
       basis; the "http2" parameter of the "listen" directive is now
       deprecated.

    *) Change: HTTP/2 server push support has been removed.

    *) Change: the deprecated "ssl" directive is not supported anymore.

    *) Bugfix: in HTTP/3 when using OpenSSL.

Signed-off-by: Tiago Gaspar <tiagogaspar8@gmail.com>
[ improve commit title and add nginx changelog ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>

nginx: add support for MaxMind GeoIP2 databases

Signed-off-by: Javier Marcet <javier@marcet.info>

liburing: Update to v2.4

- Updated download URL and hash
- Switched to downloading bz2 archives to save bandwidth

Signed-off-by: Christian Lachner <gladiac@gmail.com>

python-docker: Update to 6.1.3

Signed-off-by: Javier Marcet <javier@marcet.info>

python-docker: Update to 6.1.2

Signed-off-by: Javier Marcet <javier@marcet.info>

haproxy: update to v2.8.1

- Update haproxy PKG_VERSION and PKG_HASH
- See changes: http://git.haproxy.org/?p=haproxy-2.8.git;a=shortlog

Signed-off-by: Christian Lachner <gladiac@gmail.com>

rclone: Update to 1.63.0

While at it fixed a typo error of license files variable.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

python-typing-extensions: Update to 4.7.1

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

python-dotenv: update to v1.0.0

- 1.0.0:

  - What's Changed:
    - Handle situations where the cwd does not exist.
    - Add python-decouple as a related project
    - Drop support for python 3.7, add python 3.12-dev

- 0.21.1:

  - Added:
    - Use Python 3.11 non-beta in CI
    - Modernize variables code
    - Modernize main.py and parser.py code
    - Improve conciseness of cli.py and init.py
    - Improve error message for get and list commands when env file
    can't be opened
    - Updated Licence to align with BSD OSI template

Signed-off-by: Javier Marcet <javier@marcet.info>

dnsproxy: Update to 0.51.0

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

Merge pull request #21483 from pprindeville/acpica-unix-update-20230628

acpica-unix: Update to 20230628

acpica-unix: Update to 20230628

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>

docker-compose: Update to version 2.19.1

Signed-off-by: Javier Marcet <javier@marcet.info>

python-websocket-client: update to 1.6.1

- 1.6.1
  - Fix Dispatcher keyboard interrupt. Should solve reconnect loop
  with rel

- 1.6.0
  - Fix teardown issue when ping thread is not properly ended
  - Fix double ping wait time on first ping
  - Minor typehints improvements

- 1.5.3
  - Add logic to avoid error in the case where content-length header
  does not exist, bug introduced in 1.5.2
  - Fix wsdump.py script typing, bug introduced in 1.5.2

- 1.5.2
  - Add typehints
  - Fix pytype errors
  - Fix args passed to logging function
  - Standardize PEP 3101 formatting
  - Add more verbose exception for unsuccessful handshake

Signed-off-by: Javier Marcet <javier@marcet.info>

python-stem: update to v1.8.2

Signed-off-by: Javier Marcet <javier@marcet.info>

libwebsockets: Fix -Werror=enum-int-mismatch in lws_tls_server_abort_connection()

with gcc 13 libwebsockets fails with -Werror=enum-int-mismatch with both
SSL variants. These 2 patches work out that issue. Problem is mentioned
as a issue in openwrt/packages#20949 and instead of overriding issue
with appropriate CFLAGS, this approach was suggested for me as it's
been made as a PR (for openssl) at warmcat/libwebsockets#2824

Second patch for mbedtls, was made by me using same approach
as was used of openssl.

Eventually these propably will be merged into libwebsockets mainstream.

Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>

grilo-plugins: update to 0.3.16

This drops the opensubtitles plugin, because it is not yet compatible
with libsoup3.

Signed-off-by: W. Michael Petullo <mike@flyn.org>

grilo: update to 0.3.16

Signed-off-by: W. Michael Petullo <mike@flyn.org>

python-hatchling: Update to 1.18.0

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

python-pluggy: Update to 1.2.0

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

sing-box: update to 1.3.0

Signed-off-by: Van Waholtz <brvphoenix@gmail.com>

netbird: update to 0.21.7

1. Release notes:
   https://github.com/netbirdio/netbird/releases/tag/v0.21.2
   https://github.com/netbirdio/netbird/releases/tag/v0.21.3
   https://github.com/netbirdio/netbird/releases/tag/v0.21.4
   https://github.com/netbirdio/netbird/releases/tag/v0.21.5
   https://github.com/netbirdio/netbird/releases/tag/v0.21.6
   https://github.com/netbirdio/netbird/releases/tag/v0.21.7
2. Update GO_PKG_LDFLAGS, because of https://github.com/netbirdio/netbird/commit/292ee260ad564d1e65199b1cb3430b0cd7ba9646
3. Define the configuration file.

Signed-off-by: Salem Huang <solohoh@hotmail.com>

python-markupsafe: Update to 2.1.3, add host build

The host build will be used for mako (to be added later).

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

python-service-identity: Update to 23.1.0

This adds new build dependencies as the package switched to
pyproject.toml-based builds.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

python-libmodbus: Update to 0.6.2

This also adds a source package (python3-libmodbus-src).

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

inadyn: update to 2.11.0

Signed-off-by: Robert Högberg <robert.hogberg@gmail.com>

strongswan: Update to 5.9.11

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>

vala: add self as maintainer of unmaintained package

Signed-off-by: W. Michael Petullo <mike@flyn.org>

vala: patch to circumvent apparent pkgconf bug

There is an apparent bug in pkgconf 1.9 that broke building the OpenWrt
Vala package. This adds a patch to circumvent the bug. For the related
discussion, see:

https://github.com/openwrt/packages/issues/21359

The pkgconf bug appears similar to the one discussed here:

https://github.com/pkgconf/pkgconf/issues/268

Signed-off-by: W. Michael Petullo <mike@flyn.org>

adblock: update to 4.1.5-8

* adapt adguard_tracking source changes

Signed-off-by: Dirk Brenken <dev@brenken.org>

minidlna: update to 1.3.3

Fixes CVE-2023-33476:
  ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable
  to Buffer Overflow. The vulnerability is caused by incorrect
  validation logic when handling HTTP requests using chunked transport
  encoding. This results in other code later using attacker-controlled
  chunk values that exceed the length of the allocated buffer,
  resulting in out-of-bounds read/write.

Signed-off-by: Robert Högberg <robert.hogberg@gmail.com>

python-gnupg: Update to 0.5.0

This also removes the dependency on gnupg as there are two packages for
gpg, gnupg and gnupg2; this library should work with either one.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

python-werkzeug: Update to 2.3.6

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

coova-chilli: fix kernel >= 5.17 compile

Signed-off-by: John Thomson <git@johnthomson.fastmail.com.au>

snort3: update to 3.1.64.0

Upstream bump

Signed-off-by: John Audia <therealgraysky@proton.me>

libdaq3: update to 3.0.11

Upstream bump

Signed-off-by: John Audia <therealgraysky@proton.me>

netsniff-ng: backport patch fixing wrong args handling with musl

Backport a patch from upstream fixing wrong args handling with musl.
Before this patch non args must be passed at the end of the command due
to a musl limitation.

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>

Merge pull request #21410 from pprindeville/isc-dhcp-dont-require-pools

isc-dhcp: don't require subnet pools

python-setuptools: Update to 68.0.0

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

python-packages: Take over maintainership from Daniel Golle

This was requested in
https://github.com/openwrt/packages/pull/21227#issuecomment-1567676980.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

knot: update to version 3.2.8

Signed-off-by: Jan Hák <jan.hak@nic.cz>

bind: bump to 9.18.16

Fixes CVEs:

- CVE-2023-2828: The overmem cleaning process has been improved, to
  prevent the cache from significantly exceeding the configured
  max-cache-size limit.
- CVE-2023-2911: A query that prioritizes stale data over lookup
  triggers a fetch to refresh the stale data in cache. If the fetch is
  aborted for exceeding the recursion quota, it was possible for named
  to enter an infinite callback loop and crash due to stack overflow.

The complete list of changes is available in the upstream release
notes at
https://ftp.isc.org/isc/bind9/cur/9.18/doc/arm/html/notes.html#notes-for-bind-9-18-16

Signed-off-by: Noah Meyerhans <frodo@morgul.net>

Merge pull request #21405 from jefferyto/selinux-update

selinux: Update selinux packages to 3.5, setools to 4.4.2, reorganize packages

libpfring: update to 8.4.0

Release notes:
https://github.com/ntop/PF_RING/releases/tag/8.4.0

Signed-off-by: John Thomson <git@johnthomson.fastmail.com.au>

xr_usb_serial_common: bump to 2023-03-31

Fix 6.1 kernel compile

git log --oneline ecc6eb.. -- xr_usb_serial_common-1a/
90ad530166f0 Support Linux 6.1
af618e2eded6 #45 Fix some warnings

Signed-off-by: John Thomson <git@johnthomson.fastmail.com.au>

Merge pull request #21366 from zhanhb/haproxy

haproxy: update to v2.8.0

banip: update 0.8.8-2

* process local lists in strict sequential order to prevent possible race conditions
* support ranges in the IP search, too
* fix some minor search issues

Signed-off-by: Dirk Brenken <dev@brenken.org>

haproxy: update to v2.8.0

- New major LTS release (https://www.mail-archive.com/haproxy@formilux.org/msg43600.html)

Signed-off-by: Huangbin Zhan <zhanhb88@gmail.com>

vsftpd: fix compilation with musl 1.2.4

musl 1.2.4 deprecated legacy "LFS64" ("large file support") interfaces so
just having _GNU_SOURCE defined is not enough anymore.

Manually pass -D_LARGEFILE64_SOURCE to allow to keep using LFS64 definitions.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

dnsdist: Move the configuration to Config.in

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>

dnsdist: Split in two packages `dnsdist` and `dnsdist-full`

`dnsdist-full` has all optional features enabled, but is a big package
in term of both flash and memory footprint.
`dnsdist` only keeps the features that make the most sense
on embeded devices, but can also be customised to match the
user's needs, up to the point where it matches `dnsdist-full`.

Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>