diff --git a/lang/lua-eco/Makefile b/lang/lua-eco/Makefile
index d49c5c432..efcc87ca2 100644
--- a/lang/lua-eco/Makefile
+++ b/lang/lua-eco/Makefile
@@ -1,12 +1,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=lua-eco
-PKG_VERSION:=2.3.0
+PKG_VERSION:=2.4.0
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL=https://github.com/zhaojh329/lua-eco/releases/download/v$(PKG_VERSION)
-PKG_HASH:=931737acd080bd309fd589c521ad32d00b2285fe9edeefdcacb86ba8f1fe1fdc
+PKG_HASH:=7dd3ae8c9548ad9f0bfcc9a95e77c6f24ef868d3dd21983c5b940f738360ff9b
 
 PKG_MAINTAINER:=Jianhui Zhao <zhaojh329@gmail.com>
 PKG_LICENSE:=MIT
@@ -26,7 +26,7 @@ define Package/lua-eco
   CATEGORY:=Languages
   SUBMENU:=Lua
   URL:=https://github.com/zhaojh329/lua-eco
-  DEPENDS:=+libev +liblua
+  DEPENDS:=+libev +liblua +luabitop
 endef
 
 define Package/lua-eco/description
@@ -49,8 +49,9 @@ Package/lua-eco-sys=$(call Package/lua-eco/Module,system utils)
 Package/lua-eco-file=$(call Package/lua-eco/Module,file utils)
 Package/lua-eco-base64=$(call Package/lua-eco/Module,base64)
 Package/lua-eco-sha1=$(call Package/lua-eco/Module,sha1)
+Package/lua-eco-md5=$(call Package/lua-eco/Module,md5)
 Package/lua-eco-socket=$(call Package/lua-eco/Module,socket,+lua-eco-file +lua-eco-sys)
-Package/lua-eco-dns=$(call Package/lua-eco/Module,dns,+lua-eco-socket +luabitop)
+Package/lua-eco-dns=$(call Package/lua-eco/Module,dns,+lua-eco-socket)
 Package/lua-eco-ssl=$(call Package/lua-eco/Module,ssl,\
   +LUA_ECO_OPENSSL:libopenssl +LUA_ECO_WOLFSSL:libwolfssl \
   +LUA_ECO_MBEDTLS:libmbedtls +LUA_ECO_MBEDTLS:zlib +lua-eco-socket)
@@ -60,8 +61,8 @@ Package/lua-eco-mqtt=$(call Package/lua-eco/Module,mqtt,+lua-eco-socket +lua-eco
 Package/lua-eco-websocket=$(call Package/lua-eco/Module,websocket,+lua-eco-http +lua-eco-base64 +lua-eco-sha1)
 Package/lua-eco-termios=$(call Package/lua-eco/Module,termios)
 Package/lua-eco-struct=$(call Package/lua-eco/Module,struct pack)
-Package/lua-eco-network=$(call Package/lua-eco/Module,network utils)
-Package/lua-eco-netlink=$(call Package/lua-eco/Module,netlink)
+Package/lua-eco-netlink=$(call Package/lua-eco/Module,netlink,+lua-eco-socket)
+Package/lua-eco-ip=$(call Package/lua-eco/Module,ip utils,+lua-eco-netlink)
 Package/lua-eco-nl80211=$(call Package/lua-eco/Module,nl80211,+lua-eco-netlink)
 
 define Package/lua-eco-ssl/config
@@ -101,6 +102,7 @@ define Package/lua-eco/install
 	$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/lib/lua/eco/encoding/hex.lua $(1)/usr/lib/lua/eco/encoding
 	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/lib/lua/eco/core/{time,bufio}.so $(1)/usr/lib/lua/eco/core
 	$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/lib/lua/eco/{time,bufio,bit,sync}.lua $(1)/usr/lib/lua/eco
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/lib/lua/eco/binary.so $(1)/usr/lib/lua/eco
 endef
 
 define Package/lua-eco-log/install
@@ -130,6 +132,11 @@ define Package/lua-eco-sha1/install
 	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/lib/lua/eco/crypto/sha1.so $(1)/usr/lib/lua/eco/crypto
 endef
 
+define Package/lua-eco-md5/install
+	$(INSTALL_DIR) $(1)/usr/lib/lua/eco/crypto
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/lib/lua/eco/crypto/md5.so $(1)/usr/lib/lua/eco/crypto
+endef
+
 define Package/lua-eco-socket/install
 	$(INSTALL_DIR) $(1)/usr/lib/lua/eco/core
 	$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/lib/lua/eco/socket.lua $(1)/usr/lib/lua/eco
@@ -178,11 +185,6 @@ define Package/lua-eco-struct/install
 	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/lib/lua/eco/struct.so $(1)/usr/lib/lua/eco
 endef
 
-define Package/lua-eco-network/install
-	$(INSTALL_DIR) $(1)/usr/lib/lua/eco
-	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/lib/lua/eco/network.so $(1)/usr/lib/lua/eco
-endef
-
 define Package/lua-eco-netlink/install
 	$(INSTALL_DIR) $(1)/usr/lib/lua/eco/core
 	$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/lib/lua/eco/{nl,genl}.lua $(1)/usr/lib/lua/eco
@@ -190,6 +192,11 @@ define Package/lua-eco-netlink/install
 	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/lib/lua/eco/rtnl.so $(1)/usr/lib/lua/eco
 endef
 
+define Package/lua-eco-ip/install
+	$(INSTALL_DIR) $(1)/usr/lib/lua/eco
+	$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/lib/lua/eco/ip.lua $(1)/usr/lib/lua/eco
+endef
+
 define Package/lua-eco-nl80211/install
 	$(INSTALL_DIR) $(1)/usr/lib/lua/eco/core
 	$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/lib/lua/eco/nl80211.lua $(1)/usr/lib/lua/eco
@@ -202,6 +209,7 @@ $(eval $(call BuildPackage,lua-eco-sys))
 $(eval $(call BuildPackage,lua-eco-file))
 $(eval $(call BuildPackage,lua-eco-base64))
 $(eval $(call BuildPackage,lua-eco-sha1))
+$(eval $(call BuildPackage,lua-eco-md5))
 $(eval $(call BuildPackage,lua-eco-socket))
 $(eval $(call BuildPackage,lua-eco-dns))
 $(eval $(call BuildPackage,lua-eco-ssl))
@@ -210,6 +218,6 @@ $(eval $(call BuildPackage,lua-eco-http))
 $(eval $(call BuildPackage,lua-eco-mqtt))
 $(eval $(call BuildPackage,lua-eco-websocket))
 $(eval $(call BuildPackage,lua-eco-termios))
-$(eval $(call BuildPackage,lua-eco-network))
 $(eval $(call BuildPackage,lua-eco-netlink))
+$(eval $(call BuildPackage,lua-eco-ip))
 $(eval $(call BuildPackage,lua-eco-nl80211))
diff --git a/lang/php8/Makefile b/lang/php8/Makefile
index 263c2bdf3..b263692a0 100644
--- a/lang/php8/Makefile
+++ b/lang/php8/Makefile
@@ -94,7 +94,7 @@ endef
 
 define Package/php8-cli
   $(call Package/php8/Default)
-  DEPENDS+= +PACKAGE_php8-mod-intl:libstdcpp
+  DEPENDS+= +PACKAGE_php8-mod-intl:libstdcpp +riscv64:libatomic
   TITLE+= (CLI)
 endef
 
@@ -105,7 +105,7 @@ endef
 
 define Package/php8-cgi
   $(call Package/php8/Default)
-  DEPENDS+= +PACKAGE_php8-mod-intl:libstdcpp
+  DEPENDS+= +PACKAGE_php8-mod-intl:libstdcpp +riscv64:libatomic
   TITLE+= (CGI & FastCGI)
 endef
 
@@ -127,7 +127,7 @@ endef
 
 define Package/php8-fpm
   $(call Package/php8/Default)
-  DEPENDS+= +PACKAGE_php8-mod-intl:libstdcpp
+  DEPENDS+= +PACKAGE_php8-mod-intl:libstdcpp +riscv64:libatomic
   TITLE+= (FPM)
 endef
 
@@ -159,6 +159,7 @@ define Package/apache-mod-php8
   CATEGORY:=Network
   DEPENDS+=PACKAGE_apache-mod-php8:apache \
 	   +PACKAGE_php8-mod-intl:libstdcpp \
+	   +riscv64:libatomic \
 	   +libpcre2 +zlib
   TITLE:=PHP8 module for Apache Web Server
 endef
@@ -197,6 +198,9 @@ endif
 ifeq ($(CONFIG_USE_MUSL),y)
 TARGET_CFLAGS += -D_LARGEFILE64_SOURCE
 endif
+ifneq ($(findstring riscv64,$(CONFIG_ARCH)),)
+TARGET_LDFLAGS += -latomic
+endif
 
 ifneq ($(SDK)$(CONFIG_PACKAGE_php8-mod-bcmath),)
   CONFIGURE_ARGS+= --enable-bcmath=shared
@@ -603,6 +607,8 @@ define BuildModule
   define Package/php8-mod-$(1)
     $(call Package/php8/Default)
 
+    DEPENDS+=+riscv64:libatomic
+
     ifneq ($(3),)
       DEPENDS+=$(3)
     endif
diff --git a/lang/python/python-distro/Makefile b/lang/python/python-distro/Makefile
index 70c767508..b41ed2283 100644
--- a/lang/python/python-distro/Makefile
+++ b/lang/python/python-distro/Makefile
@@ -1,11 +1,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=python-distro
-PKG_VERSION:=1.7.0
+PKG_VERSION:=1.8.0
 PKG_RELEASE:=1
 
 PYPI_NAME:=distro
-PKG_HASH:=151aeccf60c216402932b52e40ee477a939f8d58898927378a02abbe852c1c39
+PKG_HASH:=02e111d1dc6a50abb8eed6bf31c3e48ed8b0830d1ea2a1b78c61765c2513fdd8
 
 PKG_MAINTAINER:=Javier Marcet <javier@marcet.info>
 PKG_LICENSE:=Apache-2.0
@@ -19,14 +19,14 @@ define Package/python3-distro
   SECTION:=lang
   CATEGORY:=Languages
   SUBMENU:=Python
-  TITLE:=Distro - an OS platform information API
+  TITLE:=OS platform information API
   URL:=https://github.com/python-distro/distro
   DEPENDS:=+python3-light +python3-logging
 endef
 
 define Package/python3-distro/description
-  A much more elaborate, renewed alternative implementation for Python's
-  platform.linux_distribution()
+distro provides information about the OS distribution it runs on, such
+as a reliable machine-readable ID, or version information.
 endef
 
 $(eval $(call Py3Package,python3-distro))
diff --git a/lang/python/python-markdown/Makefile b/lang/python/python-markdown/Makefile
index d6ce6836c..c8eba9044 100644
--- a/lang/python/python-markdown/Makefile
+++ b/lang/python/python-markdown/Makefile
@@ -8,11 +8,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=python-markdown
-PKG_VERSION:=3.3.6
+PKG_VERSION:=3.4.4
 PKG_RELEASE:=1
 
 PYPI_NAME:=Markdown
-PKG_HASH:=76df8ae32294ec39dcf89340382882dfa12975f87f45c3ed1ecdb1e8cefc7006
+PKG_HASH:=225c6123522495d4119a90b3a3ba31a1e87a70369e03f14799ea9c0d7183a3d6
 
 PKG_MAINTAINER:=Josef Schlehofer <josef.schlehofer@nic.cz>
 PKG_LICENSE:=BSD-3-Clause
@@ -26,15 +26,19 @@ define Package/python3-markdown
   SECTION:=lang
   CATEGORY:=Languages
   SUBMENU:=Python
-  TITLE:=Markdown implementation in Python
+  TITLE:=Implementation of John Gruber's Markdown
   URL:=https://python-markdown.github.io/
   DEPENDS:= \
 	+python3-light \
-	+python3-logging
+	+python3-codecs \
+	+python3-logging \
+	+python3-xml
 endef
 
 define Package/python3-markdown/description
-  A fast and complete Python implementation of Markdown.
+This is a Python implementation of John Gruber’s Markdown. It is almost
+completely compliant with the reference implementation, though there are
+a few very minor differences.
 endef
 
 $(eval $(call Py3Package,python3-markdown))
diff --git a/lang/python/python-more-itertools/Makefile b/lang/python/python-more-itertools/Makefile
index 2b007627a..a16ed56d5 100644
--- a/lang/python/python-more-itertools/Makefile
+++ b/lang/python/python-more-itertools/Makefile
@@ -8,16 +8,18 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=python-more-itertools
-PKG_VERSION:=8.7.0
+PKG_VERSION:=10.1.0
 PKG_RELEASE:=1
 
 PYPI_NAME:=more-itertools
-PKG_HASH:=c5d6da9ca3ff65220c3bfd2a8db06d698f05d4d2b9be57e1deb2be5a45019713
+PKG_HASH:=626c369fa0eb37bac0291bce8259b332fd59ac792fa5497b59837309cd5b114a
 
 PKG_MAINTAINER:=Jan Pavlinec <jan.pavlinec1@gmail.com>
 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE
 
+PKG_BUILD_DEPENDS:=python-flit-core/host
+
 include ../pypi.mk
 include $(INCLUDE_DIR)/package.mk
 include ../python3-package.mk
@@ -27,7 +29,7 @@ define Package/python3-more-itertools
   SECTION:=lang
   CATEGORY:=Languages
   TITLE:=More routines for operating on iterables, beyond itertools
-  URL:=https://github.com/erikrose/more-itertools
+  URL:=https://github.com/more-itertools/more-itertools
   DEPENDS:=+python3-light
 endef
 
diff --git a/lang/python/python-msgpack/Makefile b/lang/python/python-msgpack/Makefile
index 00dd55db4..052289b92 100644
--- a/lang/python/python-msgpack/Makefile
+++ b/lang/python/python-msgpack/Makefile
@@ -8,16 +8,18 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=python-msgpack
-PKG_VERSION:=1.0.2
+PKG_VERSION:=1.0.5
 PKG_RELEASE:=1
 
 PYPI_NAME:=msgpack
-PKG_HASH:=fae04496f5bc150eefad4e9571d1a76c55d021325dcd484ce45065ebbdd00984
+PKG_HASH:=c075544284eadc5cddc70f4757331d99dcbc16b2bbd4849d15f8aae4cf36d31c
 
 PKG_MAINTAINER:=Jan Pavlinec <jan.pavlinec1@gmail.com>
 PKG_LICENSE:=Apache-2.0
 PKG_LICENSE_FILES:=COPYING
 
+PKG_BUILD_DEPENDS:=python-cython/host
+
 include ../pypi.mk
 include $(INCLUDE_DIR)/package.mk
 include ../python3-package.mk
@@ -26,7 +28,7 @@ define Package/python3-msgpack
   SUBMENU:=Python
   SECTION:=lang
   CATEGORY:=Languages
-  TITLE:=MessagePack (de)serializer
+  TITLE:=MessagePack serializer
   URL:=https://msgpack.org/
   DEPENDS:=+python3-light +libstdcpp
 endef
diff --git a/lang/python/python-psutil/Makefile b/lang/python/python-psutil/Makefile
index 07baf6693..9e336a307 100644
--- a/lang/python/python-psutil/Makefile
+++ b/lang/python/python-psutil/Makefile
@@ -8,18 +8,16 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=python-psutil
-PKG_VERSION:=5.9.0
-PKG_RELEASE:=2
+PKG_VERSION:=5.9.5
+PKG_RELEASE:=1
 
 PYPI_NAME:=psutil
-PKG_HASH:=869842dbd66bb80c3217158e629d6fceaecc3a3166d3d1faee515b05dd26ca25
+PKG_HASH:=5410638e4df39c54d957fc51ce03048acd8e6d60abc0f5107af51e5fb566eb3c
 
 PKG_MAINTAINER:=Jan Pavlinec <jan.pavlinec1@gmail.com>
 PKG_LICENSE:=BSD 3-Clause
 PKG_LICENSE_FILES:=LICENSE
 
-PKG_BUILD_DEPENDS:=python-setuptools-scm/host
-
 include ../pypi.mk
 include $(INCLUDE_DIR)/package.mk
 include ../python3-package.mk
@@ -28,7 +26,7 @@ define Package/python3-psutil
   SUBMENU:=Python
   SECTION:=lang
   CATEGORY:=Languages
-  TITLE:=psutil (process and system utilities)
+  TITLE:=Process and system monitoring
   URL:=https://github.com/giampaolo/psutil
   DEPENDS:=+python3-light
 endef
@@ -38,9 +36,6 @@ define Package/python3-psutil/description
   on running processes and system utilization.
 endef
 
-PYTHON3_VARS += \
-	TARGET_SYS_PLATFORM=linux
-
 $(eval $(call Py3Package,python3-psutil))
 $(eval $(call BuildPackage,python3-psutil))
 $(eval $(call BuildPackage,python3-psutil-src))
diff --git a/lang/python/python-psutil/patches/100-fix-non-Linux-compile.patch b/lang/python/python-psutil/patches/100-fix-non-Linux-compile.patch
new file mode 100644
index 000000000..eea19c823
--- /dev/null
+++ b/lang/python/python-psutil/patches/100-fix-non-Linux-compile.patch
@@ -0,0 +1,29 @@
+--- a/setup.py
++++ b/setup.py
+@@ -43,16 +43,16 @@ HERE = os.path.abspath(os.path.dirname(_
+ # ...so we can import _common.py and _compat.py
+ sys.path.insert(0, os.path.join(HERE, "psutil"))
+ 
+-from _common import AIX  # NOQA
+-from _common import BSD  # NOQA
+-from _common import FREEBSD  # NOQA
+-from _common import LINUX  # NOQA
+-from _common import MACOS  # NOQA
+-from _common import NETBSD  # NOQA
+-from _common import OPENBSD  # NOQA
+-from _common import POSIX  # NOQA
+-from _common import SUNOS  # NOQA
+-from _common import WINDOWS  # NOQA
++AIX = False
++BSD = False
++FREEBSD = False
++LINUX = True
++MACOS = False
++NETBSD = False
++OPENBSD = False
++POSIX = True
++SUNOS = False
++WINDOWS = False
+ from _common import hilite  # NOQA
+ from _compat import PY3  # NOQA
+ from _compat import which  # NOQA
diff --git a/lang/python/python-psutil/patches/100_add_cross_platform_build_ability.patch b/lang/python/python-psutil/patches/100_add_cross_platform_build_ability.patch
deleted file mode 100644
index e7e84f49a..000000000
--- a/lang/python/python-psutil/patches/100_add_cross_platform_build_ability.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From: https://github.com/giampaolo/psutil/pull/2068/commits/9a5cb2b71d301a63ea765f02a196fd046e769685
-
-From 9a5cb2b71d301a63ea765f02a196fd046e769685 Mon Sep 17 00:00:00 2001
-From: "Sergey V. Lobanov" <sergey@lobanov.in>
-Date: Mon, 31 Jan 2022 17:48:14 +0300
-Subject: [PATCH] Add cross-platform build ability
-
-Currently it is not possible to build psutil on MacOS for Linux
-target using external toolchain. It fails due to build script
-detects build host OS and changes build logic according to detected
-OS.
-
-This patch allows to redefine os.name and sys.platform using ENV
-vars TARGET_OS_NAME and TARGET_SYS_PLATFORM. If these variables
-are not defined then os.name and sys.platform is used as it does
-currently.
-
-Using this patch it is possible to compile psutil on MacOS with
-OpenWrt GCC Toolchain (OpenWrt is Linux).
-
-Signed-off-by: Sergey V. Lobanov <sergey@lobanov.in>
----
- psutil/_common.py | 23 ++++++++++++++---------
- 1 file changed, 14 insertions(+), 9 deletions(-)
-
---- a/psutil/_common.py
-+++ b/psutil/_common.py
-@@ -81,17 +81,22 @@ __all__ = [
- # ===================================================================
- 
- 
--POSIX = os.name == "posix"
--WINDOWS = os.name == "nt"
--LINUX = sys.platform.startswith("linux")
--MACOS = sys.platform.startswith("darwin")
-+# Allow to redefine os.name and sys.platform if build OS and target 
-+# OS are different (e.g. build OS is MacOS, target OS is Linux)
-+target_os_name = os.getenv('TARGET_OS_NAME', os.name)
-+target_sys_platform = os.getenv('TARGET_SYS_PLATFORM', sys.platform)
-+
-+POSIX = target_os_name == "posix"
-+WINDOWS = target_os_name == "nt"
-+LINUX = target_sys_platform.startswith("linux")
-+MACOS = target_sys_platform.startswith("darwin")
- OSX = MACOS  # deprecated alias
--FREEBSD = sys.platform.startswith(("freebsd", "midnightbsd"))
--OPENBSD = sys.platform.startswith("openbsd")
--NETBSD = sys.platform.startswith("netbsd")
-+FREEBSD = target_sys_platform.startswith(("freebsd", "midnightbsd"))
-+OPENBSD = target_sys_platform.startswith("openbsd")
-+NETBSD = target_sys_platform.startswith("netbsd")
- BSD = FREEBSD or OPENBSD or NETBSD
--SUNOS = sys.platform.startswith(("sunos", "solaris"))
--AIX = sys.platform.startswith("aix")
-+SUNOS = target_sys_platform.startswith(("sunos", "solaris"))
-+AIX = target_sys_platform.startswith("aix")
- 
- 
- # ===================================================================
diff --git a/lang/python/python-psycopg2/Makefile b/lang/python/python-psycopg2/Makefile
index 32d83a58d..cd9ae9767 100644
--- a/lang/python/python-psycopg2/Makefile
+++ b/lang/python/python-psycopg2/Makefile
@@ -8,11 +8,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=python-psycopg2
-PKG_VERSION:=2.8.6
+PKG_VERSION:=2.9.7
 PKG_RELEASE:=1
 
 PYPI_NAME:=psycopg2
-PKG_HASH:=fb23f6c71107c37fd667cb4ea363ddeb936b348bbd6449278eb92c189699f543
+PKG_HASH:=f00cc35bd7119f1fed17b85bd1007855194dde2cbd8de01ab8ebb17487440ad8
 
 PKG_MAINTAINER:=Daniel Danzberger <daniel@dd-wrt.com>
 PKG_LICENSE:=LGPL-3.0-or-later
@@ -28,13 +28,19 @@ define Package/python3-psycopg2
   CATEGORY:=Languages
   TITLE:=PostgreSQL database adapter
   URL:=https://www.psycopg.org/
-  DEPENDS:=+python3 +libpq
+  DEPENDS:= \
+    +python3-light \
+    +python3-decimal \
+    +python3-logging \
+    +python3-uuid \
+    +libpq
 endef
 
 define Package/python3-psycopg2/description
- Psycopg is the most popular PostgreSQL adapter for the Python programming language
+Psycopg is the most popular PostgreSQL adapter for the Python
+programming language
 endef
 
 $(eval $(call Py3Package,python3-psycopg2))
 $(eval $(call BuildPackage,python3-psycopg2))
-
+$(eval $(call BuildPackage,python3-psycopg2-src))
diff --git a/lang/python/python-trove-classifiers/Makefile b/lang/python/python-trove-classifiers/Makefile
index 9df7e0550..d370438a9 100644
--- a/lang/python/python-trove-classifiers/Makefile
+++ b/lang/python/python-trove-classifiers/Makefile
@@ -8,11 +8,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=python-trove-classifiers
-PKG_VERSION:=2023.7.6
+PKG_VERSION:=2023.8.7
 PKG_RELEASE:=1
 
 PYPI_NAME:=trove-classifiers
-PKG_HASH:=8a8e168b51d20fed607043831d37632bb50919d1c80a64e0f1393744691a8b22
+PKG_HASH:=c9f2a0a85d545e5362e967e4f069f56fddfd91215e22ffa48c66fb283521319a
 
 PKG_LICENSE:=Apache-2.0
 PKG_LICENSE_FILES:=LICENSE
diff --git a/lang/rust/rust-values.mk b/lang/rust/rust-values.mk
index 27e7f0806..26935c0f6 100644
--- a/lang/rust/rust-values.mk
+++ b/lang/rust/rust-values.mk
@@ -22,6 +22,12 @@ ifdef CONFIG_PKG_CC_STACKPROTECTOR_STRONG
 endif
 endif
 
+ifeq ($(HOST_OS),Darwin)
+  ifeq ($(HOST_ARCH),arm64)
+    RUSTC_HOST_ARCH:=aarch64-apple-darwin
+  endif
+endif
+
 # mips64 openwrt has a specific targed in rustc
 ifeq ($(ARCH),mips64)
   RUSTC_TARGET_ARCH:=$(REAL_GNU_TARGET_NAME)
diff --git a/libs/libyang/Makefile b/libs/libyang/Makefile
index 4053f5dd6..659929343 100644
--- a/libs/libyang/Makefile
+++ b/libs/libyang/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libyang
-PKG_VERSION:=2.0.112
+PKG_VERSION:=2.1.80
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/CESNET/libyang/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=184dd67c66c1ad968a2ee4d0950fb6b103834917b04b17af9c7bca80967636ee
+PKG_HASH:=fc4744839b64628939d291e5c4f3841f2a9aef38a465682703794341687a51c4
 
 PKG_MAINTAINER:=Jakov Smolic <jakov.smolic@sartura.hr>
 PKG_LICENSE:=BSD-3-Clause
diff --git a/net/adguardhome/Makefile b/net/adguardhome/Makefile
index a2622d17d..ada453c85 100644
--- a/net/adguardhome/Makefile
+++ b/net/adguardhome/Makefile
@@ -6,13 +6,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=adguardhome
-PKG_VERSION:=0.107.33
+PKG_VERSION:=0.107.36
 PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_VERSION:=v$(PKG_VERSION)
 PKG_SOURCE_URL:=https://github.com/AdguardTeam/AdGuardHome
-PKG_MIRROR_HASH:=924c549a924b66d087d82b6c1402e4928ef176a9f742f3482cb92156956ee1fd
+PKG_MIRROR_HASH:=6f32717df3654432d0c50ee730f0eef3ec806a966508f5cd82899077f1e086c8
 
 PKG_LICENSE:=GPL-3.0-only
 PKG_LICENSE_FILES:=LICENSE.txt
diff --git a/net/adguardhome/patches/0001-go-get-github.com-quic-go-quic-go-v0.37.6.patch b/net/adguardhome/patches/0001-go-get-github.com-quic-go-quic-go-v0.37.6.patch
new file mode 100644
index 000000000..c158b2368
--- /dev/null
+++ b/net/adguardhome/patches/0001-go-get-github.com-quic-go-quic-go-v0.37.6.patch
@@ -0,0 +1,45 @@
+From 61c2e12116147fab716221009b3a14fa5792a72d Mon Sep 17 00:00:00 2001
+From: Dobroslaw Kijowski <dobo90@gmail.com>
+Date: Mon, 21 Aug 2023 10:22:27 +0200
+Subject: [PATCH] go get github.com/quic-go/quic-go@v0.37.6
+
+---
+ go.mod | 4 ++--
+ go.sum | 4 ++++
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/go.mod
++++ b/go.mod
+@@ -28,7 +28,7 @@ require (
+ 	github.com/mdlayher/raw v0.1.0
+ 	github.com/miekg/dns v1.1.55
+ 	// TODO(a.garipov): Update to ≥ v0.37.0 once we update to Go 1.20.
+-	github.com/quic-go/quic-go v0.36.2
++	github.com/quic-go/quic-go v0.37.6
+ 	github.com/stretchr/testify v1.8.4
+ 	github.com/ti-mo/netfilter v0.5.0
+ 	go.etcd.io/bbolt v1.3.7
+@@ -60,7 +60,7 @@ require (
+ 	github.com/pmezard/go-difflib v1.0.0 // indirect
+ 	github.com/quic-go/qpack v0.4.0 // indirect
+ 	github.com/quic-go/qtls-go1-19 v0.3.2 // indirect
+-	github.com/quic-go/qtls-go1-20 v0.2.2 // indirect
++	github.com/quic-go/qtls-go1-20 v0.3.1 // indirect
+ 	github.com/u-root/uio v0.0.0-20230305220412-3e8cd9d6bf63 // indirect
+ 	golang.org/x/mod v0.12.0 // indirect
+ 	golang.org/x/sync v0.3.0 // indirect
+--- a/go.sum
++++ b/go.sum
+@@ -108,8 +108,12 @@ github.com/quic-go/qtls-go1-19 v0.3.2 h1
+ github.com/quic-go/qtls-go1-19 v0.3.2/go.mod h1:ySOI96ew8lnoKPtSqx2BlI5wCpUVPT05RMAlajtnyOI=
+ github.com/quic-go/qtls-go1-20 v0.2.2 h1:WLOPx6OY/hxtTxKV1Zrq20FtXtDEkeY00CGQm8GEa3E=
+ github.com/quic-go/qtls-go1-20 v0.2.2/go.mod h1:JKtK6mjbAVcUTN/9jZpvLbGxvdWIKS8uT7EiStoU1SM=
++github.com/quic-go/qtls-go1-20 v0.3.1 h1:O4BLOM3hwfVF3AcktIylQXyl7Yi2iBNVy5QsV+ySxbg=
++github.com/quic-go/qtls-go1-20 v0.3.1/go.mod h1:X9Nh97ZL80Z+bX/gUXMbipO6OxdiDi58b/fMC9mAL+k=
+ github.com/quic-go/quic-go v0.36.2 h1:ZX/UNQ4gvpCv2RmwdbA6lrRjF6EBm5yZ7TMoT4NQVrA=
+ github.com/quic-go/quic-go v0.36.2/go.mod h1:zPetvwDlILVxt15n3hr3Gf/I3mDf7LpLKPhR4Ez0AZQ=
++github.com/quic-go/quic-go v0.37.6 h1:2IIUmQzT5YNxAiaPGjs++Z4hGOtIR0q79uS5qE9ccfY=
++github.com/quic-go/quic-go v0.37.6/go.mod h1:YsbH1r4mSHPJcLF4k4zruUkLBqctEMBDR6VPvcYjIsU=
+ github.com/shirou/gopsutil/v3 v3.21.8 h1:nKct+uP0TV8DjjNiHanKf8SAuub+GNsbrOtM9Nl9biA=
+ github.com/shirou/gopsutil/v3 v3.21.8/go.mod h1:YWp/H8Qs5fVmf17v7JNZzA0mPJ+mS2e9JdiUF9LlKzQ=
+ github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
diff --git a/net/frp/Makefile b/net/frp/Makefile
index fdb40431d..81a0b758b 100644
--- a/net/frp/Makefile
+++ b/net/frp/Makefile
@@ -1,12 +1,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=frp
-PKG_VERSION:=0.51.0
+PKG_VERSION:=0.51.3
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/fatedier/frp/tar.gz/v${PKG_VERSION}?
-PKG_HASH:=80ccfa40c4e25309ddb48818f6342bc59f7639be83ab6ef59ffab5caeedc37e8
+PKG_HASH:=83032399773901348c660d41c967530e794ab58172ccd070db89d5e50d915fef
 
 PKG_MAINTAINER:=Richard Yu <yurichard3839@gmail.com>
 PKG_LICENSE:=Apache-2.0
diff --git a/net/frr/Makefile b/net/frr/Makefile
index b985c1f40..1387de25a 100644
--- a/net/frr/Makefile
+++ b/net/frr/Makefile
@@ -7,15 +7,15 @@
 
 include $(TOPDIR)/rules.mk
 PKG_NAME:=frr
-PKG_VERSION:=8.5.1
+PKG_VERSION:=9.0.0
 PKG_RELEASE:=1
-PKG_SOURCE_DATE:=2023-05-12
+PKG_SOURCE_DATE:=2023-08-12
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_SOURCE_DATE).tar.gz
-PKG_SOURCE_VERSION:=05469ab2b553302c2a7032f4c89e4510dc3fa6d9
+PKG_SOURCE_VERSION:=9852228d1e87bdbad13e0fed8313203f00bf26af
 PKG_SOURCE_URL:=https://codeload.github.com/FRRouting/frr/tar.gz/$(PKG_SOURCE_VERSION)?
 
-PKG_HASH:=caf3fcf1998ecd9a08e67373921a2d4bf49dbfc707008d20a1d38fd1606ef298
+PKG_HASH:=6e611cd86ae9787a4b8d71411fdc38ad1fe843a839756c9c386848ffde81f6cf
 PKG_MAINTAINER:=Lucian Cristian <lucian.cristian@gmail.com>
 
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_SOURCE_VERSION)
@@ -59,7 +59,7 @@ PKG_BUILD_PARALLEL:=1
 PKG_INSTALL:=1
 PKG_BUILD_FLAGS:=lto
 
-PKG_BUILD_DEPENDS:=frr/host
+PKG_BUILD_DEPENDS:=frr/host protobuf-c/host
 HOST_BUILD_DEPENDS:=python3/host
 
 include $(INCLUDE_DIR)/package.mk
@@ -96,7 +96,7 @@ endef
 define Package/frr-libfrr
   $(call Package/frr/Default)
   TITLE:=zebra library
-  DEPENDS+=+librt +libatomic +libcap +libjson-c +libyang +FRR_OPENSSL:libopenssl +FRR_SNMP:libnetsnmp
+  DEPENDS+=+librt +libatomic +libcap +libjson-c +libyang +libprotobuf-c +FRR_OPENSSL:libopenssl +FRR_SNMP:libnetsnmp
   CONFLICTS:=quagga-libzebra
 endef
 
diff --git a/net/frr/patches/098-fix_mips_libyang.patch b/net/frr/patches/098-fix_mips_libyang.patch
index 3cf24c985..b69b6e437 100644
--- a/net/frr/patches/098-fix_mips_libyang.patch
+++ b/net/frr/patches/098-fix_mips_libyang.patch
@@ -1,6 +1,6 @@
 --- a/lib/northbound.h
 +++ b/lib/northbound.h
-@@ -593,11 +593,7 @@ struct frr_yang_module_info {
+@@ -627,11 +627,7 @@ struct frr_yang_module_info {
  
  		/* Priority - lower priorities are processed first. */
  		uint32_t priority;
diff --git a/net/frr/patches/996-qpb_header_fix.patch b/net/frr/patches/996-qpb_header_fix.patch
new file mode 100644
index 000000000..07b06febf
--- /dev/null
+++ b/net/frr/patches/996-qpb_header_fix.patch
@@ -0,0 +1,11 @@
+--- a/qpb/qpb_allocator.h
++++ b/qpb/qpb_allocator.h
+@@ -14,7 +14,7 @@
+ #ifndef _QPB_ALLOCATOR_H_
+ #define _QPB_ALLOCATOR_H_
+ 
+-#include <google/protobuf-c/protobuf-c.h>
++#include <protobuf-c/protobuf-c.h>
+ 
+ struct linear_allocator_t_;
+ 
diff --git a/net/frr/patches/997-reverse_python_test.patch b/net/frr/patches/997-reverse_python_test.patch
index 8e454a456..aa3e0f87d 100644
--- a/net/frr/patches/997-reverse_python_test.patch
+++ b/net/frr/patches/997-reverse_python_test.patch
@@ -1,6 +1,6 @@
 --- a/configure.ac
 +++ b/configure.ac
-@@ -839,7 +839,6 @@ fi
+@@ -855,7 +855,6 @@ fi
  #
  
  AS_IF([test "$host" = "$build"], [
diff --git a/net/frr/patches/999-thread_reverse.patch b/net/frr/patches/999-thread_reverse.patch
deleted file mode 100644
index 0f5b24bf6..000000000
--- a/net/frr/patches/999-thread_reverse.patch
+++ /dev/null
@@ -1,111 +0,0 @@
---- a/lib/thread.c
-+++ b/lib/thread.c
-@@ -868,13 +868,9 @@ static void thread_free(struct thread_ma
- 	XFREE(MTYPE_THREAD, thread);
- }
- 
--static int fd_poll(struct thread_master *m, const struct timeval *timer_wait,
--		   bool *eintr_p)
-+static int fd_poll(struct thread_master *m, struct pollfd *pfds, nfds_t pfdsize,
-+		   nfds_t count, const struct timeval *timer_wait)
- {
--	sigset_t origsigs;
--	unsigned char trash[64];
--	nfds_t count = m->handler.copycount;
--
- 	/*
- 	 * If timer_wait is null here, that means poll() should block
- 	 * indefinitely, unless the thread_master has overridden it by setting
-@@ -905,58 +901,15 @@ static int fd_poll(struct thread_master
- 	rcu_assert_read_unlocked();
- 
- 	/* add poll pipe poker */
--	assert(count + 1 < m->handler.pfdsize);
--	m->handler.copy[count].fd = m->io_pipe[0];
--	m->handler.copy[count].events = POLLIN;
--	m->handler.copy[count].revents = 0x00;
--
--	/* We need to deal with a signal-handling race here: we
--	 * don't want to miss a crucial signal, such as SIGTERM or SIGINT,
--	 * that may arrive just before we enter poll(). We will block the
--	 * key signals, then check whether any have arrived - if so, we return
--	 * before calling poll(). If not, we'll re-enable the signals
--	 * in the ppoll() call.
--	 */
--
--	sigemptyset(&origsigs);
--	if (m->handle_signals) {
--		/* Main pthread that handles the app signals */
--		if (frr_sigevent_check(&origsigs)) {
--			/* Signal to process - restore signal mask and return */
--			pthread_sigmask(SIG_SETMASK, &origsigs, NULL);
--			num = -1;
--			*eintr_p = true;
--			goto done;
--		}
--	} else {
--		/* Don't make any changes for the non-main pthreads */
--		pthread_sigmask(SIG_SETMASK, NULL, &origsigs);
--	}
-+	assert(count + 1 < pfdsize);
-+	pfds[count].fd = m->io_pipe[0];
-+	pfds[count].events = POLLIN;
-+	pfds[count].revents = 0x00;
- 
--#if defined(HAVE_PPOLL)
--	struct timespec ts, *tsp;
-+	num = poll(pfds, count + 1, timeout);
- 
--	if (timeout >= 0) {
--		ts.tv_sec = timeout / 1000;
--		ts.tv_nsec = (timeout % 1000) * 1000000;
--		tsp = &ts;
--	} else
--		tsp = NULL;
--
--	num = ppoll(m->handler.copy, count + 1, tsp, &origsigs);
--	pthread_sigmask(SIG_SETMASK, &origsigs, NULL);
--#else
--	/* Not ideal - there is a race after we restore the signal mask */
--	pthread_sigmask(SIG_SETMASK, &origsigs, NULL);
--	num = poll(m->handler.copy, count + 1, timeout);
--#endif
--
--done:
--
--	if (num < 0 && errno == EINTR)
--		*eintr_p = true;
--
--	if (num > 0 && m->handler.copy[count].revents != 0 && num--)
-+	unsigned char trash[64];
-+	if (num > 0 && pfds[count].revents != 0 && num--)
- 		while (read(m->io_pipe[0], &trash, sizeof(trash)) > 0)
- 			;
- 
-@@ -1766,7 +1719,7 @@ struct thread *thread_fetch(struct threa
- 	struct timeval zerotime = {0, 0};
- 	struct timeval tv;
- 	struct timeval *tw = NULL;
--	bool eintr_p = false;
-+
- 	int num = 0;
- 
- 	do {
-@@ -1842,14 +1795,14 @@ struct thread *thread_fetch(struct threa
- 
- 		pthread_mutex_unlock(&m->mtx);
- 		{
--			eintr_p = false;
--			num = fd_poll(m, tw, &eintr_p);
-+			num = fd_poll(m, m->handler.copy, m->handler.pfdsize,
-+				      m->handler.copycount, tw);
- 		}
- 		pthread_mutex_lock(&m->mtx);
- 
- 		/* Handle any errors received in poll() */
- 		if (num < 0) {
--			if (eintr_p) {
-+			if (errno == EINTR) {
- 				pthread_mutex_unlock(&m->mtx);
- 				/* loop around to signal handler */
- 				continue;
diff --git a/net/simple-adblock/Makefile b/net/simple-adblock/Makefile
index 5037303ec..b3820ac81 100644
--- a/net/simple-adblock/Makefile
+++ b/net/simple-adblock/Makefile
@@ -6,7 +6,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=simple-adblock
 PKG_VERSION:=1.9.5
-PKG_RELEASE:=4
+PKG_RELEASE:=5
 PKG_MAINTAINER:=Stan Grishin <stangri@melmac.ca>
 PKG_LICENSE:=GPL-3.0-or-later
 
diff --git a/net/simple-adblock/files/simple-adblock.init b/net/simple-adblock/files/simple-adblock.init
index 25240c8c1..ce51af0d7 100644
--- a/net/simple-adblock/files/simple-adblock.init
+++ b/net/simple-adblock/files/simple-adblock.init
@@ -1393,7 +1393,7 @@ adb_start() {
 	fi
 	json_add_array firewall
 	if [ "$force_dns" -ne 0 ]; then
-		for c in $force_dns_port; do
+		for c in ${force_dns_port/,/ }; do
 			if netstat -tuln | grep LISTEN | grep ":${c}" >/dev/null 2>&1; then
 				json_add_object ""
 				json_add_string type redirect
@@ -1640,7 +1640,7 @@ load_validate_config() {
 	uci_load_validate "$packageName" "$packageName" "$1" "${2}${3:+ $3}" \
 		'enabled:bool:0' \
 		'force_dns:bool:1' \
-		'force_dns_port:list(integer):"53 853"' \
+		'force_dns_port:list(integer):53,853' \
 		'parallel_downloads:bool:1' \
 		'debug:bool:0' \
 		'compressed_cache:bool:0' \
@@ -1661,7 +1661,7 @@ load_validate_config() {
 		'procd_boot_wan_timeout:integer:60' \
 		'led:or("", "none", file, device, string)' \
 		'dns:or("dnsmasq.addnhosts", "dnsmasq.conf", "dnsmasq.ipset", "dnsmasq.nftset", "dnsmasq.servers", "unbound.adb_list"):dnsmasq.servers' \
-		'dns_instance:or(list(integer, string)):0' \
+		'dns_instance:list(or(integer, string)):0' \
 		'allowed_domain:list(string)' \
 		'allowed_domains_url:list(string)' \
 		'blocked_domain:list(string)' \
diff --git a/net/sing-box/Makefile b/net/sing-box/Makefile
index cbd4b4ac6..e8be6b45d 100644
--- a/net/sing-box/Makefile
+++ b/net/sing-box/Makefile
@@ -1,12 +1,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=sing-box
-PKG_VERSION:=1.3.0
+PKG_VERSION:=1.4.0-beta.5
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/SagerNet/sing-box/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=e89ffdadf11d4b34d12b2c0659efea0f0786b2396ea4638c61a06e7772783ca5
+PKG_HASH:=0c3e1d0c19308c2b6f5a360ee84f899d292718184542a2302674421eeecff072
 
 PKG_LICENSE:=GPL-3.0-or-later
 PKG_LICENSE_FILES:=LICENSE
diff --git a/net/tailscale/Makefile b/net/tailscale/Makefile
index d07dc502d..13a78ebdf 100644
--- a/net/tailscale/Makefile
+++ b/net/tailscale/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=tailscale
-PKG_VERSION:=1.44.0
+PKG_VERSION:=1.48.0
 PKG_RELEASE:=1
 
-PKG_SOURCE:=tailscale-$(PKG_VERSION).tar.gz
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/tailscale/tailscale/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=dc230cf3ac290140e573268a6e8f17124752ef064c8d3a86765a9dbb6f1bd354
+PKG_HASH:=a58f9a42d2d6c0eb0517f5e11f4b7f19892d999c8969c2ca148e4222089c85fc
 
 PKG_MAINTAINER:=Jan Pavlinec <jan.pavlinec1@gmail.com>
 PKG_LICENSE:=BSD-3-Clause
@@ -63,29 +63,7 @@ Package/tailscaled/description:=$(Package/tailscale/description)
 
 define Package/tailscaled/conffiles
 /etc/config/tailscale
-/etc/tailscale/tailscaled.state
-endef
-
-GO_IPTABLES_VERSION:=0.6.0
-GO_IPTABLES_FILE:=$(PKG_NAME)-go-iptables-$(GO_IPTABLES_VERSION).tar.gz
-
-define Download/go-iptables
-  URL:=https://codeload.github.com/coreos/go-iptables/tar.gz/v$(GO_IPTABLES_VERSION)?
-  URL_FILE:=$(GO_IPTABLES_FILE)
-  FILE:=$(GO_IPTABLES_FILE)
-  HASH:=a784cc17fcb17879f073eae47bc4c2e899f59f6906dac5a0aa7a9cc9f95ea66d
-endef
-
-define Build/Prepare
-	$(PKG_UNPACK)
-	[ ! -d ./src/ ] || $(CP) ./src/. $(PKG_BUILD_DIR)
-	$(eval $(call Download,go-iptables))
-	( \
-		mkdir -p $(PKG_BUILD_DIR)/patched/ ; \
-		gzip -dc $(DL_DIR)/$(GO_IPTABLES_FILE) | $(HOST_TAR) -C $(PKG_BUILD_DIR)/patched $(TAR_OPTIONS) ; \
-		mv $(PKG_BUILD_DIR)/patched/go-iptables-$(GO_IPTABLES_VERSION) $(PKG_BUILD_DIR)/patched/go-iptables ; \
-	)
-	$(Build/Patch)
+/etc/tailscale/
 endef
 
 define Package/tailscale/install
diff --git a/net/tailscale/patches/010-fake_iptables.patch b/net/tailscale/patches/010-fake_iptables.patch
deleted file mode 100644
index ca7086ed8..000000000
--- a/net/tailscale/patches/010-fake_iptables.patch
+++ /dev/null
@@ -1,53 +0,0 @@
---- a/go.mod
-+++ b/go.mod
-@@ -2,6 +2,8 @@ module tailscale.com
- 
- go 1.20
- 
-+replace github.com/coreos/go-iptables => ./patched/go-iptables
-+
- require (
- 	filippo.io/mkcert v1.4.4
- 	github.com/Microsoft/go-winio v0.6.1
---- a/patched/go-iptables/iptables/iptables.go
-+++ b/patched/go-iptables/iptables/iptables.go
-@@ -149,12 +149,39 @@ func New(opts ...option) (*IPTables, err
- 	return ipt, nil
- }
- 
-+func NewFake(opts ...option) (*IPTables, error) {
-+
-+	ipt := &IPTables{
-+		path:		   "/bin/false",
-+		proto:		   ProtocolIPv4,
-+		hasCheck:	   false,
-+		hasWait:	   false,
-+		waitSupportSecond: false,
-+		hasRandomFully:	   false,
-+		v1:		   0,
-+		v2:		   0,
-+		v3:		   0,
-+		mode:		   "legacy",
-+		timeout:	   0,
-+	}
-+
-+	for _, opt := range opts {
-+		opt(ipt)
-+	}
-+
-+	return ipt, nil
-+}
-+
- // New creates a new IPTables for the given proto.
- // The proto will determine which command is used, either "iptables" or "ip6tables".
- func NewWithProtocol(proto Protocol) (*IPTables, error) {
- 	return New(IPFamily(proto), Timeout(0))
- }
- 
-+func NewFakeWithProtocol(proto Protocol) (*IPTables, error) {
-+	return NewFake(IPFamily(proto), Timeout(0))
-+}
-+
- // Proto returns the protocol used by this IPTables.
- func (ipt *IPTables) Proto() Protocol {
- 	return ipt.proto
diff --git a/net/tailscale/patches/020-tailscaled_fake_iptables.patch b/net/tailscale/patches/020-tailscaled_fake_iptables.patch
deleted file mode 100644
index a4d54bdc6..000000000
--- a/net/tailscale/patches/020-tailscaled_fake_iptables.patch
+++ /dev/null
@@ -1,32 +0,0 @@
---- a/wgengine/router/router_linux.go
-+++ b/wgengine/router/router_linux.go
-@@ -129,7 +129,7 @@ func newUserspaceRouter(logf logger.Logf
- 
- 	ipt4, err := iptables.NewWithProtocol(iptables.ProtocolIPv4)
- 	if err != nil {
--		return nil, err
-+		ipt4, err = iptables.NewFakeWithProtocol(iptables.ProtocolIPv4)
- 	}
- 
- 	v6err := checkIPv6(logf)
-@@ -148,7 +148,7 @@ func newUserspaceRouter(logf logger.Logf
- 		// if unavailable. We want that to be a non-fatal error.
- 		ipt6, err = iptables.NewWithProtocol(iptables.ProtocolIPv6)
- 		if err != nil {
--			return nil, err
-+			ipt6, err = iptables.NewFakeWithProtocol(iptables.ProtocolIPv6)
- 		}
- 	}
- 
-@@ -1676,11 +1676,6 @@ func checkIPv6(logf logger.Logf) error {
- 		return fmt.Errorf("kernel doesn't support IPv6 policy routing: %w", err)
- 	}
- 
--	// Some distros ship ip6tables separately from iptables.
--	if _, err := exec.LookPath("ip6tables"); err != nil {
--		return err
--	}
--
- 	return nil
- }
- 
diff --git a/net/tailscale/patches/030-default_to_netfilter_off.patch b/net/tailscale/patches/030-default_to_netfilter_off.patch
deleted file mode 100644
index 1edd00225..000000000
--- a/net/tailscale/patches/030-default_to_netfilter_off.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/cmd/tailscale/cli/up.go
-+++ b/cmd/tailscale/cli/up.go
-@@ -147,7 +147,7 @@ func defaultNetfilterMode() string {
- 	if distro.Get() == distro.Synology {
- 		return "off"
- 	}
--	return "on"
-+	return "off"
- }
- 
- type upArgsT struct {
diff --git a/net/tunneldigger-broker/Makefile b/net/tunneldigger-broker/Makefile
index 42605406e..44f69fdff 100644
--- a/net/tunneldigger-broker/Makefile
+++ b/net/tunneldigger-broker/Makefile
@@ -5,15 +5,13 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_URL:=https://github.com/wlanslovenija/tunneldigger.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=4f72b30578ac3dbc5482f4a54054bf870355bdf5
-PKG_MIRROR_HASH:=e93b986b60475c16b0022ba4f5da981929cc3d6992c632f41264804912825473
+PKG_SOURCE_VERSION:=v0.4.0
+PKG_MIRROR_HASH:=c67a0e626cec571823085a7a28bc72fcaa077669cac52c441b0dde02d676e16c
 
 PKG_MAINTAINER:=Nick Hainke <vincent@systemli.org>
 PKG_LICENSE:=AGPL-3.0
 PKG_LICENSE_FILES:=COPYING
 
-PKG_BUILD_DEPENDS:=python-cffi/host
-
 include ../../lang/python/pypi.mk
 include $(INCLUDE_DIR)/package.mk
 include ../../lang/python/python3-package.mk
@@ -22,22 +20,18 @@ define Package/tunneldigger-broker
   SECTION:=net
   CATEGORY:=Network
   DEPENDS:= \
-	+ip-full \
+	+ip \
 	+kmod-l2tp \
-	+kmod-l2tp-ip \
 	+kmod-l2tp-eth \
 	+kmod-sched \
-	+libnetfilter-conntrack \
 	+libnfnetlink \
 	+libnl-tiny \
 	+libpthread \
 	+librt \
-	+python3-cffi \
 	+python3-ctypes \
 	+python3-light \
 	+python3-logging \
-	+python3-six \
-	+tc-full
+	+tc-tiny
   TITLE:=Broker for L2TPv3 tunnels using tunneldigger
   URL:=https://github.com/wlanslovenija/tunneldigger
 endef
@@ -48,7 +42,7 @@ support for L2TPv3 tunnels over UDP. This package contains the broker.
 endef
 
 PYTHON3_PKG_SETUP_DIR:=broker
-PYTHON3_PKG_WHEEL_VERSION:=0.4.0.dev1
+PYTHON3_PKG_WHEEL_VERSION:=0.4.0
 
 define Py3Package/tunneldigger-broker/install
 	$(INSTALL_DIR) $(1)/lib/functions
@@ -57,6 +51,7 @@ define Py3Package/tunneldigger-broker/install
 	$(INSTALL_BIN) ./files/hook-setup $(1)/usr/lib/tunneldigger-broker/hooks/setup
 	$(INSTALL_BIN) ./files/hook-teardown $(1)/usr/lib/tunneldigger-broker/hooks/teardown
 	$(INSTALL_BIN) ./files/hook-mtu-changed $(1)/usr/lib/tunneldigger-broker/hooks/mtu-changed
+	$(INSTALL_BIN) ./files/hook-connection-rate-limit $(1)/usr/lib/tunneldigger-broker/hooks/connection-rate-limit
 	$(INSTALL_DIR) $(1)/etc/init.d
 	$(INSTALL_BIN) ./files/tunneldigger-broker.init $(1)/etc/init.d/tunneldigger-broker
 	$(INSTALL_DIR) $(1)/etc/config
diff --git a/net/tunneldigger-broker/files/config.default b/net/tunneldigger-broker/files/config.default
index 13bb45113..ce911cdc1 100644
--- a/net/tunneldigger-broker/files/config.default
+++ b/net/tunneldigger-broker/files/config.default
@@ -3,16 +3,23 @@ config broker
 	list port '123'
 	list port '8942'
 	option interface 'loopback'
-	option max_cookies '1024'
 	option max_tunnels '1024'
-	option port_base '20000'
 	option tunnel_id_base '100'
-	option tunnel_timeout '60'
 	option pmtu '0'
-	option namespace 'production'
 	option connection_rate_limit '0.2'
+	option connection_rate_limit_per_ip_count '0'
+	option connection_rate_limit_per_ip_time '0'
 
 config log
-	option filename '/dev/null'
 	option verbosity 'INFO'
 	option log_ip_addresses '0'
+
+# To automatically put tunnel interfaces into pre-exitsing bridges
+# via the hook scripts, then create a bridge section for each 
+# supported mtu.  If pmtu is set to non-zero above, then only that 
+# bridge is needed.  To isolate the bridge ports, set isolate to '1'.
+# '0' is the default
+#config bridge
+#	option interface 'br-mybridge'
+#	option mtu '1446'
+#	option isolate '1'
diff --git a/net/tunneldigger-broker/files/hook-connection-rate-limit b/net/tunneldigger-broker/files/hook-connection-rate-limit
new file mode 100755
index 000000000..813c38029
--- /dev/null
+++ b/net/tunneldigger-broker/files/hook-connection-rate-limit
@@ -0,0 +1,17 @@
+#!/bin/bash
+set -e
+
+ENDPOINT_IP="$1"
+ENDPOINT_PORT="$2"
+UUID="$3"
+
+# This assumes that an ipset was created with something like
+# ```
+# ipset create create tunneldigger_blocked hash:ip family inet timeout 300
+# ```
+# and that a firewall rule like the following uses the ipset to block connections:
+# ```
+# -A INPUT -m set --match-set tunneldigger_blocked src -j DROP
+# ```
+
+#ipset add tunneldigger_blocked "$ENDPOINT_IP"
diff --git a/net/tunneldigger-broker/files/hook-mtu-changed b/net/tunneldigger-broker/files/hook-mtu-changed
index 3cfc59a14..9be884d66 100755
--- a/net/tunneldigger-broker/files/hook-mtu-changed
+++ b/net/tunneldigger-broker/files/hook-mtu-changed
@@ -21,10 +21,14 @@ if [ -z "$new_bridge" ]; then
   exit 1
 fi
 
+# Get the isolation option for this bridge
+tunneldigger_get_bridge_isolate isolate "${NEW_MTU}"
+
 # Remove interface from old bridge.
 ip link set dev ${INTERFACE} nomaster
 ip link set dev ${old_bridge} mtu ${OLD_MTU}
 
 # Change interface bridge and MTU.
 ip link set dev ${INTERFACE} master ${new_bridge} mtu ${NEW_MTU}
+echo $isolate > /sys/class/net/${INTERFACE}/brport/isolated
 ip link set dev ${new_bridge} mtu ${NEW_MTU}
diff --git a/net/tunneldigger-broker/files/hook-setup b/net/tunneldigger-broker/files/hook-setup
index ed809ad6d..08fd17754 100755
--- a/net/tunneldigger-broker/files/hook-setup
+++ b/net/tunneldigger-broker/files/hook-setup
@@ -13,9 +13,14 @@ if [ -z "$bridge" ]; then
   exit 1
 fi
 
+# Get the isolation option for this bridge
+tunneldigger_get_bridge_isolate isolate "${MTU}"
+
 # Disable IPv6 on this interface as it will be bridged.
 echo 1 > /proc/sys/net/ipv6/conf/${INTERFACE}/disable_ipv6
 # Add the interface to the proper bridge and bring it up.
 ip link set dev ${INTERFACE} master ${bridge} mtu ${MTU} up
+# Isolate the bridge port, if so configured
+echo $isolate > /sys/class/net/${INTERFACE}/brport/isolated
 # Ensure bridge MTU.
 ip link set dev ${bridge} mtu ${MTU}
diff --git a/net/tunneldigger-broker/files/tunneldigger-broker.init b/net/tunneldigger-broker/files/tunneldigger-broker.init
index 5c0888b04..1fa98fea7 100755
--- a/net/tunneldigger-broker/files/tunneldigger-broker.init
+++ b/net/tunneldigger-broker/files/tunneldigger-broker.init
@@ -54,7 +54,7 @@ parse_broker() {
 		cfg_append_kv address "${address}"
 	}
 
-	OPTIONS="max_cookies max_tunnels port_base tunnel_id_base tunnel_timeout namespace connection_rate_limit pmtu"
+	OPTIONS="max_tunnels tunnel_id_base connection_rate_limit connection_rate_limit_per_ip_count connection_rate_limit_per_ip_time pmtu"
 	for option in ${OPTIONS}; do
 		cfg_append_option "$section" "${option}" "${option}"
 	done
@@ -66,13 +66,14 @@ parse_broker() {
 	cfg_append_kv "session.up" "${HOOKPATH}/setup"
 	cfg_append_kv "session.pre-down" "${HOOKPATH}/teardown"
 	cfg_append_kv "session.mtu-changed" "${HOOKPATH}/mtu-changed"
+	cfg_append_kv "broker.connection-rate-limit" "${HOOKPATH}/connection-rate-limit"
 }
 
 parse_log() {
 	local section="$1"
 	cfg_append_section log
 	
-	OPTIONS="filename verbosity"
+	OPTIONS="verbosity"
 	for option in ${OPTIONS}; do
 		cfg_append_option "$section" "${option}" "${option}"
 	done
@@ -97,8 +98,25 @@ start_service() {
 	procd_set_param command "/usr/bin/python"
 	procd_append_param command -m tunneldigger_broker.main
 	procd_append_param command "${CONFIGFILE}"
+
+	# Set up a trigger when the interface changes state
+	local netdev
+	network_get_physdev netdev $(uci show "tunneldigger-broker.@broker[0].interface" | cut -d \' -f 2)
+	procd_set_param netdev $netdev
+
 	procd_set_param respawn
 	procd_set_param stdout 1
 	procd_set_param stderr 1
 	procd_close_instance
 }
+
+reload_service() {
+	restart
+}
+
+service_triggers() {
+	local interface=$(uci show "tunneldigger-broker.@broker[0].interface" | cut -d \' -f 2)
+	procd_add_interface_trigger "interface.*.up" $interface /etc/init.d/tunneldigger-broker restart
+	procd_add_reload_trigger "tunneldigger-broker"
+}
+
diff --git a/net/tunneldigger-broker/files/tunneldigger.sh b/net/tunneldigger-broker/files/tunneldigger.sh
index 68b323f31..5b492d699 100644
--- a/net/tunneldigger-broker/files/tunneldigger.sh
+++ b/net/tunneldigger-broker/files/tunneldigger.sh
@@ -11,12 +11,8 @@ tunneldigger_get_bridge() {
 	# Discover the configured bridge.
 	unset _td_bridge
 	_td_bridge=""
-	config_cb() {
-		local cfg="$CONFIG_SECTION"
-		config_get configname "$cfg" TYPE
-		if [ "$configname" != "bridge" ]; then
-			return
-		fi
+	handle_bridge() {
+		local cfg="$1"
 
 		config_get cfg_mtu "$cfg" mtu
 		config_get interface "$cfg" interface
@@ -29,11 +25,46 @@ tunneldigger_get_bridge() {
 	}
 
 	config_load tunneldigger-broker
-	reset_cb
+	config_foreach handle_bridge bridge $mtu
 	if [ -z "$_td_bridge" ]; then
 		return
 	fi
 
-	eval $variable=$_td_bridge
-	# network_get_device $variable $_td_bridge
+	variable="$_td_bridge"
+	export ${NO_EXPORT:+-n} "$1=$variable"
+}
+
+# Get the isolation option for this bridge
+tunneldigger_get_bridge_isolate() {
+	local variable="$1"
+	local mtr="$2"
+
+        # Overwrite the destination variable.
+        unset $variable
+
+        # Discover the configured bridge.
+        unset _isolate_bridge
+        _isolate_bridge=""
+        handle_bridge() {
+                local cfg="$1"
+
+                config_get cfg_mtu "$cfg" mtu
+                config_get isolate "$cfg" isolate 0
+
+                if [ "$cfg_mtu" != "$mtu" ]; then
+                        return
+                fi
+
+                _isolate_bridge="$isolate"
+        }
+
+        config_load tunneldigger-broker
+        config_foreach handle_bridge bridge $mtu
+        if [ -z "$_isolate_bridge" ]; then
+                return
+        fi
+
+        variable="$_isolate_bridge"
+        export ${NO_EXPORT:+-n} "$1=$variable"
+
 }
diff --git a/net/unbound/Makefile b/net/unbound/Makefile
index 0620944cf..9626c4e29 100644
--- a/net/unbound/Makefile
+++ b/net/unbound/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=unbound
 PKG_VERSION:=1.17.1
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://nlnetlabs.nl/downloads/unbound
diff --git a/net/unbound/patches/200-remove-SSL-unexpected-eof-messages.patch b/net/unbound/patches/200-remove-SSL-unexpected-eof-messages.patch
new file mode 100644
index 000000000..3f7d62b40
--- /dev/null
+++ b/net/unbound/patches/200-remove-SSL-unexpected-eof-messages.patch
@@ -0,0 +1,37 @@
+--- a/util/net_help.c
++++ b/util/net_help.c
+@@ -1005,6 +1005,16 @@ listen_sslctx_setup(void* ctxt)
+ 			log_crypto_err("could not set cipher list with SSL_CTX_set_cipher_list");
+ 	}
+ #endif
++#if defined(SSL_OP_IGNORE_UNEXPECTED_EOF)
++	/* ignore errors when peers do not send the mandatory close_notify
++	 * alert on shutdown.
++	 * Relevant for openssl >= 3 */
++	if((SSL_CTX_set_options(ctx, SSL_OP_IGNORE_UNEXPECTED_EOF) &
++		SSL_OP_IGNORE_UNEXPECTED_EOF) != SSL_OP_IGNORE_UNEXPECTED_EOF) {
++		log_crypto_err("could not set SSL_OP_IGNORE_UNEXPECTED_EOF");
++		return 0;
++	}
++#endif
+ 
+ 	if((SSL_CTX_set_options(ctx, SSL_OP_CIPHER_SERVER_PREFERENCE) &
+ 		SSL_OP_CIPHER_SERVER_PREFERENCE) !=
+@@ -1233,6 +1243,17 @@ void* connect_sslctx_create(char* key, c
+ 		SSL_CTX_free(ctx);
+ 		return 0;
+ 	}
++#endif
++#if defined(SSL_OP_IGNORE_UNEXPECTED_EOF)
++	/* ignore errors when peers do not send the mandatory close_notify
++	 * alert on shutdown.
++	 * Relevant for openssl >= 3 */
++	if((SSL_CTX_set_options(ctx, SSL_OP_IGNORE_UNEXPECTED_EOF) &
++		SSL_OP_IGNORE_UNEXPECTED_EOF) != SSL_OP_IGNORE_UNEXPECTED_EOF) {
++		log_crypto_err("could not set SSL_OP_IGNORE_UNEXPECTED_EOF");
++		SSL_CTX_free(ctx);
++		return 0;
++	}
+ #endif
+ 	if(key && key[0]) {
+ 		if(!SSL_CTX_use_certificate_chain_file(ctx, pem)) {
diff --git a/utils/syncthing/Makefile b/utils/syncthing/Makefile
index be1d98372..1696a01cd 100644
--- a/utils/syncthing/Makefile
+++ b/utils/syncthing/Makefile
@@ -1,12 +1,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=syncthing
-PKG_VERSION:=1.23.2
+PKG_VERSION:=1.23.7
 PKG_RELEASE:=1
 
 PKG_SOURCE:=syncthing-source-v$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/syncthing/syncthing/releases/download/v$(PKG_VERSION)
-PKG_HASH:=3d0eca0e6f4eaaeba4879918b3f54f47d59fb5f4288a83af821d509271ada189
+PKG_HASH:=18d8dd74d8077f500a139752261b78217ef0b0a912a7c017192097a7196e21a1
 
 PKG_BUILD_DIR=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)/$(PKG_NAME)
 
@@ -26,13 +26,13 @@ GO_PKG_BUILD_PKG:=\
 	$(if $(CONFIG_PACKAGE_strelaysrv),$(GO_PKG)/cmd/strelaysrv/)
 GO_PKG_INSTALL_EXTRA:=^gui/
 
+GO_PKG_TAGS:=noupgrade,noquic
 GO_PKG_LDFLAGS_X:=\
 	$(GO_PKG)/lib/build.Version=v$(PKG_VERSION) \
 	$(GO_PKG)/lib/build.Stamp=$(SOURCE_DATE_EPOCH) \
 	$(GO_PKG)/lib/build.User=openwrt \
 	$(GO_PKG)/lib/build.Host=openwrt \
-	$(GO_PKG)/lib/build.Tags=noupgrade
-GO_PKG_TAGS:=noupgrade
+	$(GO_PKG)/lib/build.Tags=$(GO_PKG_TAGS)
 
 include $(INCLUDE_DIR)/package.mk
 include ../../lang/golang/golang-package.mk
diff --git a/utils/yq/Makefile b/utils/yq/Makefile
index 882387752..600581050 100644
--- a/utils/yq/Makefile
+++ b/utils/yq/Makefile
@@ -1,12 +1,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=yq
-PKG_VERSION:=4.34.2
+PKG_VERSION:=4.35.1
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/mikefarah/yq/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=035b7e827eccc66907270ff7f0d35c7917d56ded4aff44f7b942fe4802b70d01
+PKG_HASH:=b3e079169529ec6b42925d0802c22d86f1ef6e1458dce67eae5a1d6db56cb8c3
 
 PKG_MAINTAINER:=Tianling Shen <cnsztl@immortalwrt.org>
 PKG_LICENSE:=MIT