staging/nbd/package/libs, branch master

elfutils: fix license

2026-02-13T11:07:07Z

Remove OR between GPL-2.0-or-later and LGPL-3.0-or-later to avoid incorrect parsing of OR as a separate license in the SBOM. Fixes: 9a157b5d83d28043ea35501a19702beee5f8a107 Signed-off-by: Wei-Ting Yang Link: https://github.com/openwrt/openwrt/pull/22003 Signed-off-by: Robert Marko

uclient: update to Git HEAD (2026-02-13)

2026-02-13T09:10:14Z

63413daa8760 uclient-http: fix HTTP authentication after deferred header processing 4fa6fae02f74 uclient-fetch: Extract opt_post variable 8df3120639a4 uclient-fetch: Use HEAD for --spider 0392dfc8e8c4 uclient-fetch: Support of --method, --body-data and --body-file 115c92824b6d uclient-fetch: add OPTIONS request type a1531e89f6c2 uclient-fetch: support for WebDAV methods Fixes: https://github.com/openwrt/uclient/issues/14 Signed-off-by: Felix Fietkau

libubox: update to Git HEAD (2026-02-13)

2026-02-13T09:10:14Z

d324c0503040 libubox: send warnings to stderr 5a65cb5a79b7 libubox: document positional arguments 8c7b489daa02 libubox: add anonymous strings, ints, et al in arrays 5ec7ff2effb3 uloop: use volatile sig_atomic_t for do_sigchld flag 0efa2cd3b74c usock: check SO_ERROR after poll in usock_inet_timeout() 1a73ded9f738 usock: fix timeout handling in usock_inet_timeout() 1aa36ee774c8 usock: implement RFC 8305 Happy Eyeballs for usock_inet_timeout() Fixes: https://github.com/openwrt/uclient/issues/8 Signed-off-by: Felix Fietkau

jansson: update to 2.15.0

2026-02-07T08:04:19Z

Changelog: https://github.com/akheron/jansson/blob/v2.15.0/CHANGES Remove upstreamed patch: 001-cmake-ver.patch Link: https://github.com/openwrt/openwrt/pull/21908 Signed-off-by: Nick Hainke

libtraceevent: update to 1.9.0

2026-02-06T19:37:34Z

Changelog: 13701b5 libtraceevent: 1.9 6a3a815 libtraceevent: Add tep_load_modules() API 31fc91b libtraceevent: Add tep_parse_last_boot_info() 5e4ef1f libtraceevent: Add tep_btf_list_args() aa49dce libtraceevent: Split out btf func init code from tep_btf_print_args() 239b063 libtraceevent: Do not change names of functions not of this library c284dec libtraceevent: Handle __get_stacktrace() 1ba1262 libtraceevent: Move back to 1.8.99 263459e libtraceevent: Use BTF_INT_BITS/OFFSET() when parsing int parameters 0294b73 libtraceevent utest: Add simple test to test BTF parsing 38e03ac libtraceevent: Have BTF find functions with extra characters b441fff libtraceevent: Add man page for the new BTF functions 87f30d9 libtraceevent: Add loading of BTF to the tep handle 3488dc9 libtraceevent: Move to 1.9 devel Link: https://github.com/openwrt/openwrt/pull/21886 Signed-off-by: Nick Hainke

libtracefs: update to 1.8.3

2026-02-06T19:37:34Z

Changelog: 6fad6a1 libtracefs: version 1.8.3 5505e14 libtracefs: Do not have utest fail debugfs/tracing not found 362574c libtracefs: Fix whitespace in enable_disable_all() 06c07be libtracefs: Make comm field a string 0a2a28f libtracefs/Documentation: Fix markup in the man page 57fcdc1 libtracefs: utest: Return non-zero exit code when something fails ae03455 libtracefs: Fix tracefs_event_is_enabled() for all events 01a3fd3 libtracefs: Fix enum type in read_event_state ef1656b libtracefs: Fix the /dev/null redirection compatibility in Makefile Link: https://github.com/openwrt/openwrt/pull/21886 Signed-off-by: Nick Hainke

build: use STAGING_DIR for special APK package versions

2026-02-01T10:16:54Z

Removing tmp/ after having built base-files or toolchain currently breaks rootfs generation: $ rm -rf tmp $ make V=w ... make[2] package/install cat: .../openwrt/tmp/base-files.version: No such file or directory cat: .../openwrt/openwrt/tmp/libc.version: No such file or directory ERROR: 'base-files=' is not a valid world dependency, format is name(@tag)([<>~=]version) make[2]: *** [package/Makefile:100: package/install] Error 99 The only way to recover from here is to clean toolchain and base-files via $ make package/{base-files,toolchain}/clean tmp is supposed to be ephemeral, so clearing it is an expected action, which normally just triggers a regeneration of all files there. Fix this by moving the version files to $(STAGING_DIR). Fixes: 63e178f067 ("build: lock versions for special APK packages") Signed-off-by: Jonas Gorski Link: https://github.com/openwrt/openwrt/pull/21803 Signed-off-by: Robert Marko

uclient: update to Git HEAD (2026-01-31)

2026-01-31T14:03:33Z

b3ee1209a3d0 uclient-http: reset fd to -1 after close in disconnect 9c2ad269c42b uclient-http: fix seq field check to use correct field 80c9bd29c233 uclient-http: fix hang on HTTP to HTTPS redirect 931bbfeb2c92 ucode: fix memory leak when using ssl context Fixes: https://github.com/openwrt/uclient/issues/11 Fixes: https://github.com/openwrt/uclient/issues/13 Signed-off-by: Felix Fietkau

openssl: update to 3.5.5

2026-01-28T22:52:54Z

This release incorporates the following bug fixes and mitigations: fixed Improper validation of PBMAC1 parameters in PKCS#12 MAC verification. (CVE-2025-11187) fixed Stack buffer overflow in CMS AuthEnvelopedData parsing. (CVE-2025-15467) fixed NULL dereference in SSL_CIPHER_find () function on unknown cipher ID. (CVE-2025-15468) fixed openssl dgst one-shot codepath silently truncates inputs >16 MiB. (CVE-2025-15469) fixed TLS 1.3 CompressedCertificate excessive memory allocation. (CVE-2025-66199) fixed Heap out-of-bounds write in BIO_f_linebuffer on short writes. (CVE-2025-68160) fixed Unauthenticated/unencrypted trailing bytes with low-level OCB function calls. (CVE-2025-69418) fixed Out of bounds write in PKCS12_get_friendlyname () UTF-8 conversion. (CVE-2025-69419) fixed Missing ASN1_TYPE validation in TS_RESP_verify_response () function. (CVE-2025-69420) fixed NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex () function. (CVE-2025-69421) fixed Missing ASN1_TYPE validation in PKCS#12 parsing. (CVE-2026-22795) fixed ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes () function. (CVE-2026-22796) Adjust patches due to formatting changes. Signed-off-by: Ivan Pavlov Link: https://github.com/openwrt/openwrt/pull/21752 Signed-off-by: Hauke Mehrtens

libpcap: update to 1.10.6

2026-01-28T22:41:32Z

Vulnerabilities fixed: CVE-2025-11961 and CVE-2025-11964 Various improvements and bug fixes. Changelog: https://github.com/the-tcpdump-group/libpcap/blob/libpcap-1.10.6/CHANGES Upstreamed patches removed: 001-Add-support-for-Realtek-Ethertype-DSA-data.patch 002-Linux-handle-other-DSA-tags.patch Signed-off-by: Ivan Pavlov Link: https://github.com/openwrt/openwrt/pull/21744 Signed-off-by: Hauke Mehrtens