Merge branch 'openwrt:master' into master

2023-06-03 00:05:36 +05:30 · 2023-06-03 00:05:36 +05:30 · fb7db46440
commit fb7db46440
parent 60599620c1 3b59118c4f
95 changed files with 1167 additions and 1631 deletions
--- a/.github/workflows/multi-arch-test-build.yml
+++ b/.github/workflows/multi-arch-test-build.yml
@ -3,6 +3,10 @@ name: Test Build
 on:
  pull_request:

+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
  build:
    name: Test ${{ matrix.arch }}
@ -11,10 +15,22 @@ jobs:
      fail-fast: false
      matrix:
        include:
+          - arch: aarch64_cortex-a53
+            target: mvebu-cortexa53
+            runtime_test: true
+
+          - arch: arm_cortex-a15_neon-vfpv4
+            target: armvirt-32
+            runtime_test: true
+
          - arch: arm_cortex-a9_vfpv3-d16
            target: mvebu-cortexa9
            runtime_test: false

+          - arch: i386_pentium-mmx
+            target: x86-geode
+            runtime_test: true
+
          - arch: mips_24kc
            target: ath79-generic
            runtime_test: true
@ -31,17 +47,9 @@ jobs:
            target: mpc85xx-p1010
            runtime_test: false

-          - arch: aarch64_cortex-a53
-            target: mvebu-cortexa53
-            runtime_test: true
-
-          - arch: arm_cortex-a15_neon-vfpv4
-            target: armvirt-32
-            runtime_test: true
-
-          - arch: i386_pentium-mmx
-            target: x86-geode
-            runtime_test: true
+          - arch: riscv64_riscv64
+            target: sifiveu-generic
+            runtime_test: false

          - arch: x86_64
            target: x86-64
--- a/devel/ragel/Makefile
+++ b/devel/ragel/Makefile
@ -0,0 +1,37 @@
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=ragel
+PKG_VERSION:=6.10
+PKG_RELEASE:=1
+
+PKG_SOURCE_URL:=https://www.colm.net/files/ragel/
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_HASH:=5f156edb65d20b856d638dd9ee2dfb43285914d9aa2b6ec779dac0270cd56c3f
+
+PKG_MAINTAINER:=John Audia <therealgraysky@proton.me>
+PKG_LICENSE:=GPL-2.0-only
+PKG_LICENSE_FILES:=COPYING
+
+PKG_HOST_ONLY:=1
+HOST_BUILD_PARALLEL:=1
+
+include $(INCLUDE_DIR)/host-build.mk
+include $(INCLUDE_DIR)/package.mk
+
+define Package/ragel
+  SECTION:=devel
+  CATEGORY:=Development
+  TITLE:=Compiles finite state machines from regular languages into executable code
+  URL:=https://www.colm.net/open-source/ragel/
+  BUILDONLY:=1
+endef
+
+HOST_CONFIGURE_VARS += CXXFLAGS="$(HOST_CXXFLAGS) -std=gnu++98"
+
+$(eval $(call HostBuild))
+$(eval $(call BuildPackage,ragel))
--- a/lang/lua-eco/Makefile
+++ b/lang/lua-eco/Makefile
@ -1,12 +1,12 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=lua-eco
-PKG_VERSION:=2.2.0
+PKG_VERSION:=2.3.0
 PKG_RELEASE:=1

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL=https://github.com/zhaojh329/lua-eco/releases/download/v$(PKG_VERSION)
-PKG_HASH:=b45073ba93123d93ab7521b1e699c0f8f8f7de513342b16e2115a0f5a26f8014
+PKG_HASH:=931737acd080bd309fd589c521ad32d00b2285fe9edeefdcacb86ba8f1fe1fdc

 PKG_MAINTAINER:=Jianhui Zhao <zhaojh329@gmail.com>
 PKG_LICENSE:=MIT
@ -59,7 +59,10 @@ Package/lua-eco-http=$(call Package/lua-eco/Module,http/https,+lua-eco-dns +lua-
 Package/lua-eco-mqtt=$(call Package/lua-eco/Module,mqtt,+lua-eco-socket +lua-eco-dns +lua-mosquitto)
 Package/lua-eco-websocket=$(call Package/lua-eco/Module,websocket,+lua-eco-http +lua-eco-base64 +lua-eco-sha1)
 Package/lua-eco-termios=$(call Package/lua-eco/Module,termios)
-Package/lua-eco-network=$(call Package/lua-eco/Module,network)
+Package/lua-eco-struct=$(call Package/lua-eco/Module,struct pack)
+Package/lua-eco-network=$(call Package/lua-eco/Module,network utils)
+Package/lua-eco-netlink=$(call Package/lua-eco/Module,netlink)
+Package/lua-eco-nl80211=$(call Package/lua-eco/Module,nl80211,+lua-eco-netlink)

 define Package/lua-eco-ssl/config
 	choice
@ -170,11 +173,29 @@ define Package/lua-eco-termios/install
 	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/lib/lua/eco/termios.so $(1)/usr/lib/lua/eco
 endef

+define Package/lua-eco-struct/install
+	$(INSTALL_DIR) $(1)/usr/lib/lua/eco
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/lib/lua/eco/struct.so $(1)/usr/lib/lua/eco
+endef
+
 define Package/lua-eco-network/install
 	$(INSTALL_DIR) $(1)/usr/lib/lua/eco
 	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/lib/lua/eco/network.so $(1)/usr/lib/lua/eco
 endef

+define Package/lua-eco-netlink/install
+	$(INSTALL_DIR) $(1)/usr/lib/lua/eco/core
+	$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/lib/lua/eco/{nl,genl}.lua $(1)/usr/lib/lua/eco
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/lib/lua/eco/core/{nl,genl}.so $(1)/usr/lib/lua/eco/core
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/lib/lua/eco/rtnl.so $(1)/usr/lib/lua/eco
+endef
+
+define Package/lua-eco-nl80211/install
+	$(INSTALL_DIR) $(1)/usr/lib/lua/eco/core
+	$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/lib/lua/eco/nl80211.lua $(1)/usr/lib/lua/eco
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/lib/lua/eco/core/nl80211.so $(1)/usr/lib/lua/eco/core
+endef
+
 $(eval $(call BuildPackage,lua-eco))
 $(eval $(call BuildPackage,lua-eco-log))
 $(eval $(call BuildPackage,lua-eco-sys))
@ -190,3 +211,5 @@ $(eval $(call BuildPackage,lua-eco-mqtt))
 $(eval $(call BuildPackage,lua-eco-websocket))
 $(eval $(call BuildPackage,lua-eco-termios))
 $(eval $(call BuildPackage,lua-eco-network))
+$(eval $(call BuildPackage,lua-eco-netlink))
+$(eval $(call BuildPackage,lua-eco-nl80211))
--- a/lang/luaposix/Makefile
+++ b/lang/luaposix/Makefile
@ -6,12 +6,12 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=luaposix
-PKG_VERSION:=35.1
+PKG_VERSION:=36.1
 PKG_RELEASE:=1

 PKG_SOURCE_URL:=https://codeload.github.com/$(PKG_NAME)/$(PKG_NAME)/tar.gz/v$(PKG_VERSION)?
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_HASH:=1b5c48d2abd59de0738d1fc1e6204e44979ad2a1a26e8e22a2d6215dd502c797
+PKG_HASH:=e680ba9b9c7ae28c0598942cb00df7c7fbc70b82863bb55f028ea7dc101e39ac
 PKG_MAINTAINER:=Maxim Storchak <m.storchak@gmail.com>
 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=COPYING
--- a/lang/luaposix/patches/102-disable-compat-deprecated.patch
+++ b/lang/luaposix/patches/102-disable-compat-deprecated.patch
@ -1,17 +1,17 @@
 --- a/lib/posix/init.lua
 +++ b/lib/posix/init.lua
-@@ -325,14 +325,6 @@ do
-          end
+@@ -437,14 +437,6 @@ do
       end
    end
-
+ 
 -   -- Inject deprecated APIs (overwriting submodules) for backwards compatibility.
 -   for k, v in next, (require 'posix.deprecated') do
-      M[k] = v
+-      rawset(M, k, v)
 -   end
 -   for k, v in next, (require 'posix.compat') do
-      M[k] = v
+-      rawset(M, k, v)
 -   end
- end
- 
+-
+    --- Metamethods
+    -- @section metamethods
 
--- a/lang/luaposix/patches/900-disable-ldoc.patch
+++ b/lang/luaposix/patches/900-disable-ldoc.patch
@ -1,6 +1,6 @@
 --- a/lukefile
 +++ b/lukefile
-@@ -29,8 +29,6 @@ incdirs  = {
+@@ -35,8 +35,6 @@ incdirs  = {
    '$LUA_INCDIR',
 }
 
--- a/lang/python/numpy/Makefile
+++ b/lang/python/numpy/Makefile
@ -6,11 +6,11 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=numpy
-PKG_VERSION:=1.23.3
-PKG_RELEASE:=5
+PKG_VERSION:=1.24.3
+PKG_RELEASE:=1

 PYPI_NAME:=$(PKG_NAME)
-PKG_HASH:=51bf49c0cd1d52be0a240aa66f3458afc4b95d8993d2d04f0d91fa60c10af6cd
+PKG_HASH:=ab344f1bf21f140adab8e47fdbc7c35a477dc01408791f8ba00d018dd0bc5155

 PKG_MAINTAINER:=Alexandru Ardelean <ardeleanalex@gmail.com>

@ -54,6 +54,12 @@ config NUMPY_OPENBLAS_SUPPORT
 endmenu
 endef

+ifeq ($(ARCH),x86_64)
+# FIXME: temporary fix for x86_64 with GCC 13 + musl;
+#        numpy does not detect this compiler extension, so we just enable it
+TARGET_CFLAGS += -mavx512f
+endif
+
 define Build/Prepare/numpy-sitecfg
 	echo "[DEFAULT]"                                 >  $(PKG_BUILD_DIR)/site.cfg
 	echo "library_dirs = $(STAGING_DIR)/usr/lib"     >> $(PKG_BUILD_DIR)/site.cfg
--- a/lang/python/numpy/patches/001-unpin-build-dependencies.patch
+++ b/lang/python/numpy/patches/001-unpin-build-dependencies.patch
@ -1,9 +1,9 @@
 --- a/pyproject.toml
 +++ b/pyproject.toml
-@@ -2,8 +2,8 @@
+@@ -1,8 +1,8 @@
+ [build-system]
 # Minimum requirements for the build system to execute.
 requires = [
-     "packaging==20.5; platform_machine=='arm64'",  # macos M1
 -    "setuptools==59.2.0",
 -    "wheel==0.37.0",
 +    "setuptools>=59.2.0",
--- a/lang/python/pillow/Makefile
+++ b/lang/python/pillow/Makefile
@ -37,17 +37,17 @@ define Package/python3-pillow/description
 endef

 PYTHON3_PKG_BUILD_CONFIG_SETTINGS += \
-	--global-option=build_ext \
-	--global-option=--enable-zlib \
-	--global-option=--enable-jpeg \
-	--global-option=--enable-webp \
-	--global-option=--enable-webpmux \
-	--global-option=--enable-tiff \
-	--global-option=--enable-freetype \
-	--global-option=--disable-lcms \
-	--global-option=--disable-jpeg2000 \
-	--global-option=--disable-imagequant \
-	--global-option=--disable-platform-guessing
+	--build-option=build_ext \
+	--build-option=--enable-zlib \
+	--build-option=--enable-jpeg \
+	--build-option=--enable-webp \
+	--build-option=--enable-webpmux \
+	--build-option=--enable-tiff \
+	--build-option=--enable-freetype \
+	--build-option=--disable-lcms \
+	--build-option=--disable-jpeg2000 \
+	--build-option=--disable-imagequant \
+	--build-option=--disable-platform-guessing

 $(eval $(call Py3Package,python3-pillow))
 $(eval $(call BuildPackage,python3-pillow))
--- a/lang/python/pyodbc/Makefile
+++ b/lang/python/pyodbc/Makefile
@ -5,12 +5,12 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=pyodbc
-PKG_VERSION:=4.0.32
+PKG_VERSION:=4.0.39
 PKG_RELEASE:=1

 PYPI_NAME:=$(PKG_NAME)
-PKG_HASH:=9be5f0c3590655e1968488410fe3528bb8023d527e7ccec1f663d64245071a6b
-PKG_BUILD_DEPENDS:=python3 unixodbc
+PKG_HASH:=e528bb70dd6d6299ee429868925df0866e3e919c772b9eff79c8e17920d8f116
+
 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE.txt
 PKG_MAINTAINER:=Daniel Golle <daniel@makrotopia.org>
--- a/lang/python/python-bcrypt/Makefile
+++ b/lang/python/python-bcrypt/Makefile
@ -5,12 +5,12 @@

 include $(TOPDIR)/rules.mk

-PKG_NAME:=bcrypt
-PKG_VERSION:=3.1.7
-PKG_RELEASE:=5
+PKG_NAME:=python-bcrypt
+PKG_VERSION:=3.2.2
+PKG_RELEASE:=1

-PYPI_NAME:=$(PKG_NAME)
-PKG_HASH:=0b0069c752ec14172c5f78208f1863d7ad6755a6fae6fe76ec2c80d13be41e42
+PYPI_NAME:=bcrypt
+PKG_HASH:=433c410c2177057705da2a9f2cd01dd157493b2a7ac14c8593a16b3dab6b6bfb

 PKG_LICENSE:=Apache-2.0
 PKG_LICENSE_FILES:=LICENSE
@ -27,10 +27,7 @@ define Package/python3-bcrypt
  SUBMENU:=Python
  TITLE:=Modern password hashing
  URL:=https://github.com/pyca/bcrypt/
-  DEPENDS:= \
-	+python3 \
-	+python3-cffi \
-	+python3-six
+  DEPENDS:=+python3-light +python3-cffi
 endef

 define Package/python3-bcrypt/description
--- a/lang/python/python-build/Makefile
+++ b/lang/python/python-build/Makefile
@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=python-build
 PKG_VERSION:=0.10.0
-PKG_RELEASE:=1
+PKG_RELEASE:=2

 PYPI_NAME:=build
 PKG_HASH:=d5b71264afdb5951d6704482aac78de887c80691c52b88a9ad195983ca2c9269
@ -24,8 +24,7 @@ HOST_BUILD_DEPENDS:= \
 	python-installer/host \
 	python-flit-core/host \
 	python-packaging/host \
-	python-pyproject-hooks/host \
-	python-tomli/host
+	python-pyproject-hooks/host

 PYTHON3_HOST_BUILD_VARS:=PYTHONPATH=src

--- a/lang/python/python-click-log/Makefile
+++ b/lang/python/python-click-log/Makefile
@ -4,16 +4,17 @@

 include $(TOPDIR)/rules.mk

-PKG_NAME:=click-log
-PKG_VERSION:=0.3.2
-PKG_RELEASE:=2
+PKG_NAME:=python-click-log
+PKG_VERSION:=0.4.0
+PKG_RELEASE:=1
 PKG_MAINTAINER:=Karel Kočí <cynerd@email.cz>

-PKG_SOURCE_URL:=https://codeload.github.com/click-contrib/click-log/tar.gz/$(PKG_VERSION)?
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_HASH:=16babb66a2ebf22c37c1cf38753a84e6027eb8991fcf9a8487971591b8ca9812
+PYPI_NAME:=click-log
+PKG_HASH:=3970f8570ac54491237bcdb3d8ab5e3eef6c057df29f8c3d1151a51a9c23b975
 PKG_LICENSE:=MIT
+PKG_LICENSE_FILES:=LICENSE

+include ../pypi.mk
 include $(INCLUDE_DIR)/package.mk
 include ../python3-package.mk

@ -21,9 +22,9 @@ define Package/python3-click-log
  SECTION:=lang
  CATEGORY:=Languages
  SUBMENU:=Python
-  URL:=http://github.com/mitsuhiko/click
-  TITLE:=python3-click-log
-  DEPENDS:=+python3-click
+  URL:=https://github.com/click-contrib/click-log
+  TITLE:=Logging integration for Click
+  DEPENDS:=+python3-light +python3-logging +python3-click
 endef

 define Package/python3-click-log/description
--- a/lang/python/python-cython/Makefile
+++ b/lang/python/python-cython/Makefile
@ -8,11 +8,11 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=python-cython
-PKG_VERSION:=0.29.34
+PKG_VERSION:=0.29.35
 PKG_RELEASE:=1

 PYPI_NAME:=Cython
-PKG_HASH:=1909688f5d7b521a60c396d20bba9e47a1b2d2784bfb085401e1e1e7d29a29a8
+PKG_HASH:=6e381fa0bf08b3c26ec2f616b19ae852c06f5750f4290118bf986b6f85c8c527

 PKG_LICENSE:=Apache-2.0
 PKG_LICENSE_FILES:=LICENSE.txt
--- a/lang/python/python-evdev/Makefile
+++ b/lang/python/python-evdev/Makefile
@ -40,10 +40,10 @@ endef
 LINUX_EVDEV_HEADERS="$(LINUX_DIR)/include/uapi/linux/input.h:$(LINUX_DIR)/include/uapi/linux/input-event-codes.h"

 PYTHON3_PKG_BUILD_CONFIG_SETTINGS:= \
-	--global-option=build \
-	--global-option=build_ecodes \
-	--global-option=--evdev-headers="$(LINUX_EVDEV_HEADERS)" \
-	--global-option=build_ext
+	--build-option=build \
+	--build-option=build_ecodes \
+	--build-option=--evdev-headers="$(LINUX_EVDEV_HEADERS)" \
+	--build-option=build_ext

 $(eval $(call Py3Package,python3-evdev))
 $(eval $(call BuildPackage,python3-evdev))
--- a/lang/python/python-flit-scm/Makefile
+++ b/lang/python/python-flit-scm/Makefile
@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=python-flit-scm
 PKG_VERSION:=1.7.0
-PKG_RELEASE:=1
+PKG_RELEASE:=2

 PYPI_NAME:=flit-scm
 PYPI_SOURCE_NAME:=flit_scm
@ -25,8 +25,7 @@ HOST_BUILD_DEPENDS:= \
 	python-build/host \
 	python-installer/host \
 	python-flit-core/host \
-	python-setuptools-scm/host \
-	python-tomli/host
+	python-setuptools-scm/host

 include ../pypi.mk
 include $(INCLUDE_DIR)/package.mk
@ -40,7 +39,7 @@ define Package/python3-flit-scm
  SUBMENU:=Python
  TITLE:=A PEP 518 build backend that uses setuptools_scm and flit
  URL:=https://gitlab.com/WillDaSilva/flit_scm
-  DEPENDS:=+python3-light +python3-flit-core +python3-setuptools-scm +python3-tomli
+  DEPENDS:=+python3-light +python3-flit-core +python3-setuptools-scm
  BUILDONLY:=1
 endef

--- a/lang/python/python-gmpy2/Makefile
+++ b/lang/python/python-gmpy2/Makefile
@ -1,5 +1,5 @@
 #
-# Copyright (C) 2015-2018 OpenWrt.org
+# Copyright (C) 2015-2016, 2018-2020, 2023 Jeffery To
 #
 # This is free software, licensed under the GNU General Public License v2.
 # See /LICENSE for more information.
@ -8,12 +8,11 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=python-gmpy2
-PKG_VERSION:=2.0.8
-PKG_RELEASE:=6
+PKG_VERSION:=2.1.5
+PKG_RELEASE:=1

 PYPI_NAME:=gmpy2
-PYPI_SOURCE_EXT:=zip
-PKG_HASH:=dd233e3288b90f21b0bb384bcc7a7e73557bb112ccf0032ad52aa614eb373d3f
+PKG_HASH:=bc297f1fd8c377ae67a4f493fc0f926e5d1b157e5c342e30a4d84dc7b9f95d96

 PKG_LICENSE:=LGPL-3.0-or-later
 PKG_LICENSE_FILES:=COPYING.LESSER
@ -23,15 +22,13 @@ include ../pypi.mk
 include $(INCLUDE_DIR)/package.mk
 include ../python3-package.mk

-PYTHON3_PKG_BUILD_CONFIG_SETTINGS:=--global-option=--nompfr
-
 define Package/python3-gmpy2
  SECTION:=lang
  CATEGORY:=Languages
  SUBMENU:=Python
  TITLE:=GMP/MPIR, MPFR, and MPC interface
  URL:=https://github.com/aleaxit/gmpy
-  DEPENDS:=+libgmp +python3-light
+  DEPENDS:=+libgmp +libmpc +libmpfr +python3-light
 endef

 define Package/python3-gmpy2/description
--- a/lang/python/python-greenlet/Makefile
+++ b/lang/python/python-greenlet/Makefile
@ -8,11 +8,11 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=python-greenlet
-PKG_VERSION:=1.1.2
-PKG_RELEASE:=2
+PKG_VERSION:=2.0.2
+PKG_RELEASE:=1

 PYPI_NAME:=greenlet
-PKG_HASH:=e30f5ea4ae2346e62cedde8794a56858a67b878dd79f7df76a0767e356b1744a
+PKG_HASH:=e7c8dc13af7db097bed64a051d2dd49e9f0af495c26995c00a9ee842690d34c0

 PKG_MAINTAINER:=Jan Pavlinec <jan.pavlinec1@gmail.com>
 PKG_LICENSE:=MIT
--- a/lang/python/python-hatch-fancy-pypi-readme/Makefile
+++ b/lang/python/python-hatch-fancy-pypi-readme/Makefile
@ -8,24 +8,19 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=python-hatch-fancy-pypi-readme
-PKG_VERSION:=22.8.0
+PKG_VERSION:=23.1.0
 PKG_RELEASE:=1

 PYPI_NAME:=hatch-fancy-pypi-readme
 PYPI_SOURCE_NAME:=hatch_fancy_pypi_readme
-PKG_HASH:=da91282ca09601c18aded8e378daf8b578c70214866f0971156ee9bb9ce6c26a
+PKG_HASH:=b1df44063094af1e8248ceacd47a92c9cf313d6b9823bf66af8a927c3960287d

 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE.txt
 PKG_MAINTAINER:=Jeffery To <jeffery.to@gmail.com>

 PKG_HOST_ONLY:=1
-HOST_BUILD_DEPENDS:= \
-	python3/host \
-	python-build/host \
-	python-installer/host \
-	python-hatchling/host \
-	python-tomli/host
+HOST_BUILD_DEPENDS:=python3/host python-build/host python-installer/host python-hatchling/host

 include ../pypi.mk
 include $(INCLUDE_DIR)/package.mk
@ -39,7 +34,7 @@ define Package/python3-hatch-fancy-pypi-readme
  SUBMENU:=Python
  TITLE:=Fancy PyPI READMEs with Hatch
  URL:=https://github.com/hynek/hatch-fancy-pypi-readme
-  DEPENDS:=+python3-light +python3-hatchling +python3-tomli
+  DEPENDS:=+python3-light +python3-hatchling
  BUILDONLY:=1
 endef

--- a/lang/python/python-hatchling/Makefile
+++ b/lang/python/python-hatchling/Makefile
@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=python-hatchling
 PKG_VERSION:=1.17.0
-PKG_RELEASE:=1
+PKG_RELEASE:=2

 PYPI_NAME:=hatchling
 PKG_HASH:=b1244db3f45b4ef5a00106a46612da107cdfaf85f1580b8e1c059fefc98b0930
@ -27,7 +27,6 @@ HOST_BUILD_DEPENDS:= \
 	python-packaging/host \
 	python-pathspec/host \
 	python-pluggy/host \
-	python-tomli/host \
 	python-trove-classifiers/host

 include ../pypi.mk
@ -49,7 +48,6 @@ define Package/python3-hatchling
      +python3-packaging \
      +python3-pathspec \
      +python3-pluggy \
-      +python3-tomli \
      +python3-trove-classifiers
  BUILDONLY:=1
 endef
--- a/lang/python/python-jinja2/Makefile
+++ b/lang/python/python-jinja2/Makefile
@ -4,16 +4,16 @@

 include $(TOPDIR)/rules.mk

-PKG_NAME:=Jinja2
-PKG_VERSION:=3.0.3
-PKG_RELEASE:=2
+PKG_NAME:=python-jinja2
+PKG_VERSION:=3.1.2
+PKG_RELEASE:=1

-PYPI_NAME:=$(PKG_NAME)
-PKG_HASH:=611bb273cd68f3b993fabdc4064fc858c5b47a973cb5aa7999ec1ba405c87cd7
+PYPI_NAME:=Jinja2
+PKG_HASH:=31351a702a408a9e7595a8fc6150fc3f43bb6bf7e319770cbc0db9df9437e852

 PKG_MAINTAINER:=Michal Vasilek <michal.vasilek@nic.cz>
 PKG_LICENSE:=BSD-3-Clause
-PKG_LICENSE_FILES:=LICENSE
+PKG_LICENSE_FILES:=LICENSE.rst
 PKG_CPE_ID:=cpe:/a:pocoo:jinja2

 include ../pypi.mk
@ -24,9 +24,14 @@ define Package/python3-jinja2
  SECTION:=lang
  CATEGORY:=Languages
  SUBMENU:=Python
-  TITLE:=Jinja2
+  TITLE:=Very fast and expressive template engine
  URL:=https://palletsprojects.com/p/jinja/
-  DEPENDS:=+python3-light +python3-markupsafe
+  DEPENDS:= \
+      +python3-light \
+      +python3-asyncio \
+      +python3-logging \
+      +python3-urllib \
+      +python3-markupsafe
 endef

 define Package/python3-jinja2/description
--- a/lang/python/python-markupsafe/Makefile
+++ b/lang/python/python-markupsafe/Makefile
@ -4,12 +4,12 @@

 include $(TOPDIR)/rules.mk

-PKG_NAME:=MarkupSafe
-PKG_VERSION:=2.1.1
+PKG_NAME:=python-markupsafe
+PKG_VERSION:=2.1.2
 PKG_RELEASE:=1

-PYPI_NAME:=$(PKG_NAME)
-PKG_HASH:=7f91197cc9e48f989d12e4e6fbc46495c446636dfc81b9ccf50bb0ec74b91d4b
+PYPI_NAME:=MarkupSafe
+PKG_HASH:=abcabc8c2b26036d62d4c746381a6f7cf60aafcc653198ad678306986b09450d

 PKG_MAINTAINER:=Daniel Golle <daniel@makrotopia.org>
 PKG_LICENSE:=BSD-3-Clause
@ -23,13 +23,17 @@ define Package/python3-markupsafe
  SECTION:=lang
  CATEGORY:=Languages
  SUBMENU:=Python
-  TITLE:=MarkupSafe
+  TITLE:=Safely add untrusted strings to HTML/XML markup
  URL:=https://palletsprojects.com/p/markupsafe/
  DEPENDS:=+python3-light
 endef

 define Package/python3-markupsafe/description
-  MarkupSafe implements a text object that escapes characters so it is safe to use in HTML and XML.
+MarkupSafe implements a text object that escapes characters so it is
+safe to use in HTML and XML. Characters that have special meanings are
+replaced so that they display as the actual characters. This mitigates
+injection attacks, meaning untrusted user input can safely be displayed
+on a page.
 endef

 $(eval $(call Py3Package,python3-markupsafe))
--- a/lang/python/python-pip-conf/Makefile
+++ b/lang/python/python-pip-conf/Makefile
@ -1,36 +0,0 @@
-#
-# Copyright (C) 2017 OpenWrt.org
-#
-# This is free software, licensed under the GNU General Public License v2.
-# See /LICENSE for more information.
-#
-
-include $(TOPDIR)/rules.mk
-
-PKG_NAME:=python-pip-conf
-PKG_VERSION:=0.1
-PKG_RELEASE:=1
-
-include $(INCLUDE_DIR)/package.mk
-
-define Package/python-pip-conf
-  SUBMENU:=Python
-  SECTION:=lang
-  CATEGORY:=Languages
-  TITLE:=Configuration file for pip/pip3
-  URL:=https://pip.pypa.io
-  MAINTAINER:=Alexandru Ardelean <ardeleanalex@gmail.com>
-endef
-
-define Package/python-pip-conf/description
- Configuration file for pip/pip3
-endef
-
-Build/Compile:=
-
-define Package/python-pip-conf/install
-	$(INSTALL_DIR) $(1)/etc
-	$(CP) ./files/pip.conf $(1)/etc
-endef
-
-$(eval $(call BuildPackage,python-pip-conf))
--- a/lang/python/python-pip-conf/files/pip.conf
+++ b/lang/python/python-pip-conf/files/pip.conf
@ -1,3 +0,0 @@
-[global]
-cache-dir=/tmp/.cache
-log-file=/tmp/pip-log.txt
--- a/lang/python/python-pip/Makefile
+++ b/lang/python/python-pip/Makefile
@ -0,0 +1,56 @@
+#
+# Copyright (C) 2023 Jeffery To
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=python-pip
+PKG_VERSION:=23.1.2
+PKG_RELEASE:=1
+
+PYPI_NAME:=pip
+PKG_HASH:=0e7c86f486935893c708287b30bd050a36ac827ec7fe5e43fe7cb198dd835fba
+
+PKG_LICENSE:=MIT
+PKG_LICENSE_FILES:=LICENSE.txt
+PKG_MAINTAINER:=Jeffery To <jeffery.to@gmail.com>
+CPE_ID:=cpe:/a:python:pip
+
+include ../pypi.mk
+include $(INCLUDE_DIR)/package.mk
+include ../python3-package.mk
+
+define Package/python3-pip
+  SECTION:=lang
+  CATEGORY:=Languages
+  SUBMENU:=Python
+  TITLE:=PyPA recommended tool for installing Python packages
+  URL:=https://pip.pypa.io/
+  DEPENDS:=+python3
+endef
+
+define Package/python3-pip/description
+pip is the package installer for Python. You can use pip to install
+packages from the Python Package Index and other indexes.
+endef
+
+define Package/python3-pip/conffiles
+/etc/pip.conf
+endef
+
+define Py3Package/python3-pip/install
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/pip$(PYTHON3_VERSION) $(1)/usr/bin/
+	$(LN) pip$(PYTHON3_VERSION) $(1)/usr/bin/pip3
+	$(LN) pip$(PYTHON3_VERSION) $(1)/usr/bin/pip
+
+	$(INSTALL_DIR) $(1)/etc
+	$(INSTALL_DATA) ./files/pip.conf $(1)/etc/
+endef
+
+$(eval $(call Py3Package,python3-pip))
+$(eval $(call BuildPackage,python3-pip))
+$(eval $(call BuildPackage,python3-pip-src))
--- a/lang/python/python-pip/files/pip.conf
+++ b/lang/python/python-pip/files/pip.conf
@ -0,0 +1,2 @@
+[global]
+cache-dir = /var/cache/pip
--- a/lang/python/python-pip/patches/001-pyproject-hooks-pyc-fix.patch
+++ b/lang/python/python-pip/patches/001-pyproject-hooks-pyc-fix.patch
@ -0,0 +1,13 @@
+--- a/src/pip/_vendor/pyproject_hooks/_in_process/__init__.py
+++ b/src/pip/_vendor/pyproject_hooks/_in_process/__init__.py
+@@ -11,8 +11,8 @@ try:
+ except AttributeError:
+     # Python 3.8 compatibility
+     def _in_proc_script_path():
+-        return resources.path(__package__, '_in_process.py')
+        return resources.path(__package__, '_in_process.pyc')
+ else:
+     def _in_proc_script_path():
+         return resources.as_file(
+-            resources.files(__package__).joinpath('_in_process.py'))
+            resources.files(__package__).joinpath('_in_process.pyc'))
--- a/lang/python/python-pip/patches/002-pip-runner-pyc-fix.patch
+++ b/lang/python/python-pip/patches/002-pip-runner-pyc-fix.patch
@ -0,0 +1,11 @@
+--- a/src/pip/_internal/build_env.py
+++ b/src/pip/_internal/build_env.py
+@@ -54,7 +54,7 @@ def get_runnable_pip() -> str:
+         # case, we can use that directly.
+         return str(source)
+ 
+-    return os.fsdecode(source / "__pip-runner__.py")
+    return os.fsdecode(source / "__pip-runner__.pyc")
+ 
+ 
+ def _get_system_sitepackages() -> Set[str]:
--- a/lang/python/python-pip/patches/003-disable-pip-version-check.patch
+++ b/lang/python/python-pip/patches/003-disable-pip-version-check.patch
@ -0,0 +1,20 @@
+From: Barry Warsaw <barry@python.org>
+Date: Fri, 18 Nov 2016 17:07:47 -0500
+Subject: Set --disable-pip-version-check=True by default.
+
+Patch-Name: disable-pip-version-check.patch
+---
+ src/pip/_internal/cli/cmdoptions.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/src/pip/_internal/cli/cmdoptions.py
+++ b/src/pip/_internal/cli/cmdoptions.py
+@@ -892,7 +892,7 @@ disable_pip_version_check: Callable[...,
+     "--disable-pip-version-check",
+     dest="disable_pip_version_check",
+     action="store_true",
+-    default=False,
+    default=True,
+     help="Don't periodically check PyPI to determine whether a new version "
+     "of pip is available for download. Implied with --no-index.",
+ )
--- a/lang/python/python-pyproject-hooks/Makefile
+++ b/lang/python/python-pyproject-hooks/Makefile
@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=python-pyproject-hooks
 PKG_VERSION:=1.0.0
-PKG_RELEASE:=1
+PKG_RELEASE:=2

 PYPI_NAME:=pyproject_hooks
 PKG_HASH:=f271b298b97f5955d53fb12b72c1fb1948c22c1a6b70b315c54cedaca0264ef5
@ -19,7 +19,7 @@ PKG_LICENSE_FILES:=LICENSE
 PKG_MAINTAINER:=Jeffery To <jeffery.to@gmail.com>

 PKG_HOST_ONLY:=1
-HOST_BUILD_DEPENDS:=python3/host python-flit-core/host python-installer/host python-tomli/host
+HOST_BUILD_DEPENDS:=python3/host python-flit-core/host python-installer/host

 include ../pypi.mk
 include $(INCLUDE_DIR)/package.mk
--- a/lang/python/python-pytest/Makefile
+++ b/lang/python/python-pytest/Makefile
@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=python-pytest
 PKG_VERSION:=7.3.0
-PKG_RELEASE:=1
+PKG_RELEASE:=2

 PYPI_NAME:=pytest
 PKG_HASH:=58ecc27ebf0ea643ebfdf7fb1249335da761a00c9f955bcd922349bcb68ee57d
@ -34,7 +34,6 @@ define Package/python3-pytest
 	+python3 \
 	+python3-pluggy \
 	+python3-packaging \
-	+python3-tomli \
 	+python3-exceptiongroup \
 	+python3-iniconfig
 endef
--- a/lang/python/python-setuptools-scm/Makefile
+++ b/lang/python/python-setuptools-scm/Makefile
@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=python-setuptools-scm
 PKG_VERSION:=7.1.0
-PKG_RELEASE:=1
+PKG_RELEASE:=2

 PYPI_NAME:=setuptools-scm
 PYPI_SOURCE_NAME:=setuptools_scm
@ -26,7 +26,6 @@ HOST_BUILD_DEPENDS:= \
 	python-installer/host \
 	python-wheel/host \
 	python-packaging/host \
-	python-tomli/host \
 	python-typing-extensions/host

 include ../pypi.mk
@ -46,7 +45,6 @@ define Package/python3-setuptools-scm
      +python3-logging \
      +python3-packaging \
      +python3-setuptools \
-      +python3-tomli \
      +python3-typing-extensions
  BUILDONLY:=1
 endef
--- a/lang/python/python-setuptools/Makefile
+++ b/lang/python/python-setuptools/Makefile
@ -0,0 +1,82 @@
+#
+# Copyright (C) 2023 Jeffery To
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=python-setuptools
+PKG_VERSION:=67.8.0
+PKG_RELEASE:=1
+
+PYPI_NAME:=setuptools
+PKG_HASH:=62642358adc77ffa87233bc4d2354c4b2682d214048f500964dbe760ccedf102
+
+PKG_LICENSE:=MIT
+PKG_LICENSE_FILES:=LICENSE
+PKG_MAINTAINER:=Jeffery To <jeffery.to@gmail.com>
+CPE_ID:=cpe:/a:python:setuptools
+
+include ../pypi.mk
+include $(INCLUDE_DIR)/package.mk
+include ../python3-package.mk
+
+define Package/python3-setuptools/Default
+  SECTION:=lang
+  CATEGORY:=Languages
+  SUBMENU:=Python
+  URL:=https://github.com/pypa/setuptools
+endef
+
+define Package/python3-pkg-resources
+$(call Package/python3-setuptools/Default)
+  TITLE:=Package resource API
+  DEPENDS:=+python3-light +python3-email +python3-logging +python3-urllib
+endef
+
+define Package/python3-setuptools
+$(call Package/python3-setuptools/Default)
+  TITLE:=Fully-featured library to package Python projects
+  DEPENDS:=+python3 +python3-pkg-resources
+endef
+
+define Package/python3-setuptools/description/Default
+Setuptools is a fully-featured, actively-maintained, and stable library
+designed to facilitate packaging Python projects.
+
+It helps developers to easily share reusable code (in the form of a
+library) and programs (e.g., CLI/GUI tools implemented in Python), that
+can be installed with pip and uploaded to PyPI.
+endef
+
+define Package/python3-pkg-resources/description
+$(call Package/python3-setuptools/description/Default)
+
+This is the pkg_resources module of setuptools.
+endef
+
+define Package/python3-setuptools/description
+$(call Package/python3-setuptools/description/Default)
+
+This is the main setuptools module.
+endef
+
+define Py3Package/python3-pkg-resources/filespec
+|$(PYTHON3_PKG_DIR)/pkg_resources
+endef
+
+define Py3Package/python3-setuptools/filespec
+|$(PYTHON3_PKG_DIR)
+-|$(PYTHON3_PKG_DIR)/pkg_resources
+endef
+
+$(eval $(call Py3Package,python3-pkg-resources))
+$(eval $(call Py3Package,python3-setuptools))
+
+$(eval $(call BuildPackage,python3-pkg-resources))
+$(eval $(call BuildPackage,python3-setuptools))
+
+$(eval $(call BuildPackage,python3-pkg-resources-src))
+$(eval $(call BuildPackage,python3-setuptools-src))
--- a/lang/python/python-tomli/Makefile
+++ b/lang/python/python-tomli/Makefile
@ -1,50 +0,0 @@
-#
-# Copyright (C) 2023 Jeffery To
-#
-# This is free software, licensed under the GNU General Public License v2.
-# See /LICENSE for more information.
-#
-
-include $(TOPDIR)/rules.mk
-
-PKG_NAME:=python-tomli
-PKG_VERSION:=2.0.1
-PKG_RELEASE:=1
-
-PYPI_NAME:=tomli
-PKG_HASH:=de526c12914f0c550d15924c62d72abc48d6fe7364aa87328337a31007fe8a4f
-
-PKG_LICENSE:=MIT
-PKG_LICENSE_FILES:=LICENSE
-PKG_MAINTAINER:=Jeffery To <jeffery.to@gmail.com>
-
-PKG_HOST_ONLY:=1
-HOST_BUILD_DEPENDS:=python3/host python-flit-core/host python-installer/host
-
-include ../pypi.mk
-include $(INCLUDE_DIR)/package.mk
-include $(INCLUDE_DIR)/host-build.mk
-include ../python3-package.mk
-include ../python3-host-build.mk
-
-define Package/python3-tomli
-  SECTION:=lang
-  CATEGORY:=Languages
-  SUBMENU:=Python
-  TITLE:=A lil' TOML parser
-  URL:=https://github.com/hukkin/tomli
-  DEPENDS:=+python3-light
-  BUILDONLY:=1
-endef
-
-define Package/python3-tomli/description
-Tomli is a Python library for parsing TOML. Tomli is fully compatible
-with TOML v1.0.0.
-endef
-
-Host/Compile=$(Py3Host/Compile/Bootstrap)
-
-$(eval $(call Py3Package,python3-tomli))
-$(eval $(call BuildPackage,python3-tomli))
-$(eval $(call BuildPackage,python3-tomli-src))
-$(eval $(call HostBuild))
--- a/lang/python/python-trove-classifiers/Makefile
+++ b/lang/python/python-trove-classifiers/Makefile
@ -8,11 +8,11 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=python-trove-classifiers
-PKG_VERSION:=2023.5.2
+PKG_VERSION:=2023.5.24
 PKG_RELEASE:=1

 PYPI_NAME:=trove-classifiers
-PKG_HASH:=c46d6e40a9581599b16c712e0164fec3764872a4085c673c07559787caedb867
+PKG_HASH:=fd5a1546283be941f47540a135bdeae8fb261380a6a204d9c18012f2a1b0ceae

 PKG_LICENSE:=Apache-2.0
 PKG_LICENSE_FILES:=LICENSE
--- a/lang/python/python-typing-extensions/Makefile
+++ b/lang/python/python-typing-extensions/Makefile
@ -8,15 +8,15 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=python-typing-extensions
-PKG_VERSION:=4.5.0
+PKG_VERSION:=4.6.2
 PKG_RELEASE:=1

 PYPI_NAME:=typing-extensions
 PYPI_SOURCE_NAME:=typing_extensions
-PKG_HASH:=5cb5f4a79139d699607b3ef622a1dedafa84e115ab0024e0d9c044a9479ca7cb
+PKG_HASH:=06006244c70ac8ee83fa8282cb188f697b8db25bc8b4df07be1873c43897060c

 PKG_MAINTAINER:=Jan Pavlinec <jan.pavlinec1@gmail.com>, Jeffery To <jeffery.to@gmail.com>
-PKG_LICENSE:=PSF-2.0
+PKG_LICENSE:=Python-2.0.1 0BSD
 PKG_LICENSE_FILES:=LICENSE

 PKG_BUILD_DEPENDS:=python-flit-core/host
@ -32,14 +32,20 @@ define Package/python3-typing-extensions
  SUBMENU:=Python
  SECTION:=lang
  CATEGORY:=Languages
-  TITLE:=Module with type hints for Python
-  URL:=https://github.com/python/typing
-  DEPENDS:= \
-	+python3-light
+  TITLE:=Backported and Experimental Type Hints
+  URL:=https://github.com/python/typing_extensions
+  DEPENDS:=+python3-light
 endef

 define Package/python3-typing-extensions/description
-  Backported and Experimental Type Hints for Python.
+The typing_extensions module serves two related purposes:
+
+* Enable use of new type system features on older Python versions. For
+  example, typing.TypeGuard is new in Python 3.10, but typing_extensions
+  allows users on previous Python versions to use it too.
+
+* Enable experimentation with new type system PEPs before they are
+  accepted and added to the typing module.
 endef

 $(eval $(call Py3Package,python3-typing-extensions))
--- a/lang/python/python-werkzeug/Makefile
+++ b/lang/python/python-werkzeug/Makefile
@ -4,12 +4,12 @@

 include $(TOPDIR)/rules.mk

-PKG_NAME:=Werkzeug
-PKG_VERSION:=2.2.2
+PKG_NAME:=python-werkzeug
+PKG_VERSION:=2.3.4
 PKG_RELEASE:=1

-PYPI_NAME:=$(PKG_NAME)
-PKG_HASH:=7ea2d48322cc7c0f8b3a215ed73eabd7b5d75d0b50e31ab006286ccff9e00b8f
+PYPI_NAME:=Werkzeug
+PKG_HASH:=1d5a58e0377d1fe39d061a5de4469e414e78ccb1e1e59c0f5ad6fa1c36c52b76

 PKG_MAINTAINER:=Daniel Golle <daniel@makrotopia.org>
 PKG_LICENSE:=BSD-3-Clause
@ -23,13 +23,15 @@ define Package/python3-werkzeug
  SECTION:=lang
  CATEGORY:=Languages
  SUBMENU:=Python
-  TITLE:=Werkzeug
+  TITLE:=Comprehensive WSGI web application library
  URL:=https://palletsprojects.com/p/werkzeug/
-  DEPENDS:=+python3-light +python3-email
+  DEPENDS:=+python3 +python3-markupsafe
 endef

 define Package/python3-werkzeug/description
- The comprehensive WSGI web application library.
+Werkzeug is a comprehensive WSGI web application library. It began as a
+simple collection of various utilities for WSGI applications and has
+become one of the most advanced WSGI utility libraries.
 endef

 $(eval $(call Py3Package,python3-werkzeug))
--- a/lang/python/python3/Makefile
+++ b/lang/python/python3/Makefile
@ -11,7 +11,7 @@ include $(TOPDIR)/rules.mk
 include ../python3-version.mk

 PKG_NAME:=python3
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 PKG_VERSION:=$(PYTHON3_VERSION).$(PYTHON3_VERSION_MICRO)

 PKG_SOURCE:=Python-$(PKG_VERSION).tar.xz
@ -41,10 +41,6 @@ PKG_BUILD_FLAGS:=no-lto
 PKG_BUILD_DIR:=$(BUILD_DIR)/Python-$(PKG_VERSION)
 HOST_BUILD_DIR:=$(BUILD_DIR_HOST)/Python-$(PKG_VERSION)

-PKG_CONFIG_DEPENDS:= \
-	CONFIG_PACKAGE_python3-pkg-resources \
-	CONFIG_PACKAGE_python3-setuptools CONFIG_PACKAGE_python3-pip
-
 PKG_BUILD_DEPENDS:=bluez python3/host python-build/host python-installer/host python-wheel/host
 HOST_BUILD_DEPENDS:=bzip2/host libffi/host

@ -187,57 +183,6 @@ CONFIGURE_ARGS += \
 	$(if $(CONFIG_IPV6),--enable-ipv6) \
 	$(if $(findstring mips,$(CONFIG_ARCH)),,--with-lto)

-ifdef CONFIG_PACKAGE_python3-setuptools
-PYTHON3_SETUPTOOLS_BUILD:=1
-endif
-
-ifdef CONFIG_PACKAGE_python3-pkg-resources
-PYTHON3_SETUPTOOLS_BUILD:=1
-endif
-
-ifeq ($(PYTHON3_SETUPTOOLS_BUILD),1)
-define Build/Compile/python3-setuptools
-	$(HOST_PYTHON3_PIP_VARS) \
-	$(HOST_PYTHON3_PIP) \
-		install \
-		--ignore-installed \
-		--progress-bar off \
-		--root=$(PKG_BUILD_DIR)/install-setuptools \
-		--prefix=/usr \
-		$(PKG_BUILD_DIR)/Lib/ensurepip/_bundled/setuptools-$(PYTHON3_SETUPTOOLS_VERSION)-py3-none-any.whl
-	$(call PatchDir,$(PKG_BUILD_DIR)/install-setuptools/usr/lib/python$(PYTHON3_VERSION)/site-packages,./patches-setuptools,)
-endef
-else
-define Build/Compile/python3-setuptools
-	ls $(PKG_BUILD_DIR)/Lib/ensurepip/_bundled/setuptools-$(PYTHON3_SETUPTOOLS_VERSION)-py3-none-any.whl
-endef
-endif # CONFIG_PACKAGE_python3-setuptools
-
-ifdef CONFIG_PACKAGE_python3-pip
-define Build/Compile/python3-pip
-	$(HOST_PYTHON3_PIP_VARS) \
-	$(HOST_PYTHON3_PIP) \
-		install \
-		--ignore-installed \
-		--progress-bar off \
-		--root=$(PKG_BUILD_DIR)/install-pip \
-		--prefix=/usr \
-		$(PKG_BUILD_DIR)/Lib/ensurepip/_bundled/pip-$(PYTHON3_PIP_VERSION)-py3-none-any.whl
-	$(call PatchDir,$(PKG_BUILD_DIR)/install-pip/usr/lib/python$(PYTHON3_VERSION)/site-packages,./patches-pip,)
-endef
-else
-define Build/Compile/python3-pip
-	ls $(PKG_BUILD_DIR)/Lib/ensurepip/_bundled/pip-$(PYTHON3_PIP_VERSION)-py3-none-any.whl
-endef
-endif # CONFIG_PACKAGE_python3-pip
-
-define Build/Compile
-	$(call Build/Compile/Default)
-	# Use host pip to install python-setuptools
-	$(call Build/Compile/python3-setuptools)
-	$(call Build/Compile/python3-pip)
-endef
-
 define Build/InstallDev
 	$(INSTALL_DIR) $(1)/usr/include $(1)/usr/lib $(1)/usr/lib/pkgconfig
 	$(INSTALL_DIR) $(2)/bin
@ -366,6 +311,8 @@ HOST_CONFIGURE_ARGS += \
 define Host/Configure
 	$(SED) 's/^ENABLE_USER_SITE = None$$$$/ENABLE_USER_SITE = False/' $(HOST_BUILD_DIR)/Lib/site.py
 	$(call Host/Configure/Default)
+	ls $(HOST_BUILD_DIR)/Lib/ensurepip/_bundled/setuptools-$(PYTHON3_SETUPTOOLS_VERSION)-py3-none-any.whl
+	ls $(HOST_BUILD_DIR)/Lib/ensurepip/_bundled/pip-$(PYTHON3_PIP_VERSION)-py3-none-any.whl
 endef

 define Host/Install
@ -386,11 +333,11 @@ define Host/Install
 	)
 	$(call Host/Install/Default)
 	$(if $(wildcard $(HOST_PYTHON3_PKG_DIR)/.setuptools_installed_$(PYTHON3_SETUPTOOLS_VERSION)-$(PYTHON3_SETUPTOOLS_PKG_RELEASE)),,
-		$(call HostPatchDir,$(HOST_PYTHON3_PKG_DIR),./patches-setuptools,)
+		$(call HostPatchDir,$(HOST_PYTHON3_PKG_DIR),./patches-host-setuptools,)
 		touch $(HOST_PYTHON3_PKG_DIR)/.setuptools_installed_$(PYTHON3_SETUPTOOLS_VERSION)-$(PYTHON3_SETUPTOOLS_PKG_RELEASE)
 	)
 	$(if $(wildcard $(HOST_PYTHON3_PKG_DIR)/.pip_installed_$(PYTHON3_PIP_VERSION)-$(PYTHON3_PIP_PKG_RELEASE)),,
-		$(call HostPatchDir,$(HOST_PYTHON3_PKG_DIR),./patches-pip,)
+		$(call HostPatchDir,$(HOST_PYTHON3_PKG_DIR),./patches-host-pip,)
 		touch $(HOST_PYTHON3_PKG_DIR)/.pip_installed_$(PYTHON3_PIP_VERSION)-$(PYTHON3_PIP_PKG_RELEASE)
 	)
 endef
--- a/lang/python/python3/files/python3-package-pip.mk
+++ b/lang/python/python3/files/python3-package-pip.mk
@ -1,35 +0,0 @@
-#
-# Copyright (C) 2017 OpenWrt.org
-#
-# This is free software, licensed under the GNU General Public License v2.
-# See /LICENSE for more information.
-#
-
-define Package/python3-pip
-$(call Package/python3/Default)
-  TITLE:=Python $(PYTHON3_VERSION) pip module
-  VERSION:=$(PYTHON3_PIP_VERSION)-$(PYTHON3_PIP_PKG_RELEASE)
-  LICENSE:=MIT
-  LICENSE_FILES:=LICENSE.txt
-#  CPE_ID:=cpe:/a:python:pip # not currently handled this way by uscan
-  DEPENDS:=+python3 +python3-setuptools +python-pip-conf
-endef
-
-define Py3Package/python3-pip/install
-	$(INSTALL_DIR) $(1)/usr/bin $(1)/usr/lib/python$(PYTHON3_VERSION)/site-packages
-	$(CP) $(PKG_BUILD_DIR)/install-pip/usr/bin/pip$(PYTHON3_VERSION) $(1)/usr/bin
-	$(LN) pip$(PYTHON3_VERSION) $(1)/usr/bin/pip3
-	$(LN) pip$(PYTHON3_VERSION) $(1)/usr/bin/pip
-	$(CP) \
-		$(PKG_BUILD_DIR)/install-pip/usr/lib/python$(PYTHON3_VERSION)/site-packages/pip \
-		$(PKG_BUILD_DIR)/install-pip/usr/lib/python$(PYTHON3_VERSION)/site-packages/pip-$(PYTHON3_PIP_VERSION).dist-info \
-		$(1)/usr/lib/python$(PYTHON3_VERSION)/site-packages/
-	find $(1)/usr/lib/python$(PYTHON3_VERSION)/site-packages/ -path '*/__pycache__/*' -delete
-	find $(1)/usr/lib/python$(PYTHON3_VERSION)/site-packages/ -type d -name __pycache__ -delete
-endef
-
-$(eval $(call Py3BasePackage,python3-pip, \
-	/usr/lib/python$(PYTHON3_VERSION)/ensurepip \
-	, \
-	DO_NOT_ADD_TO_PACKAGE_DEPENDS \
-))
--- a/lang/python/python3/files/python3-package-pkg-resources.mk
+++ b/lang/python/python3/files/python3-package-pkg-resources.mk
@ -1,30 +0,0 @@
-#
-# Copyright (C) 2019 Alexandru Ardelean <ardeleanalex@gmail.com>
-#
-# This is free software, licensed under the GNU General Public License v2.
-# See /LICENSE for more information.
-#
-
-define Package/python3-pkg-resources
-$(call Package/python3/Default)
-  TITLE:=Python $(PYTHON3_VERSION) pkg_resources module (part of setuptools)
-  VERSION:=$(PYTHON3_SETUPTOOLS_VERSION)-$(PYTHON3_SETUPTOOLS_PKG_RELEASE)
-  LICENSE:=MIT
-  LICENSE_FILES:=LICENSE
-#  CPE_ID:=cpe:/a:python:setuptools # not currently handled this way by uscan
-  DEPENDS:=+python3
-endef
-
-define Py3Package/python3-pkg-resources/install
-	$(INSTALL_DIR) $(1)/usr/lib/python$(PYTHON3_VERSION)/site-packages
-	$(CP) \
-		$(PKG_BUILD_DIR)/install-setuptools/usr/lib/python$(PYTHON3_VERSION)/site-packages/pkg_resources \
-		$(1)/usr/lib/python$(PYTHON3_VERSION)/site-packages
-	find $(1)/usr/lib/python$(PYTHON3_VERSION)/site-packages/ -path '*/__pycache__/*' -delete
-	find $(1)/usr/lib/python$(PYTHON3_VERSION)/site-packages/ -type d -name __pycache__ -delete
-endef
-
-$(eval $(call Py3BasePackage,python3-pkg-resources, \
-	, \
-	DO_NOT_ADD_TO_PACKAGE_DEPENDS \
-))
--- a/lang/python/python3/files/python3-package-setuptools.mk
+++ b/lang/python/python3/files/python3-package-setuptools.mk
@ -1,32 +0,0 @@
-#
-# Copyright (C) 2017 OpenWrt.org
-#
-# This is free software, licensed under the GNU General Public License v2.
-# See /LICENSE for more information.
-#
-
-define Package/python3-setuptools
-$(call Package/python3/Default)
-  TITLE:=Python $(PYTHON3_VERSION) setuptools module
-  VERSION:=$(PYTHON3_SETUPTOOLS_VERSION)-$(PYTHON3_SETUPTOOLS_PKG_RELEASE)
-  LICENSE:=MIT
-  LICENSE_FILES:=LICENSE
-#  CPE_ID:=cpe:/a:python:setuptools # not currently handled this way by uscan
-  DEPENDS:=+python3 +python3-pkg-resources
-endef
-
-define Py3Package/python3-setuptools/install
-	$(INSTALL_DIR) $(1)/usr/bin $(1)/usr/lib/python$(PYTHON3_VERSION)/site-packages
-	$(CP) \
-		$(PKG_BUILD_DIR)/install-setuptools/usr/lib/python$(PYTHON3_VERSION)/site-packages/setuptools \
-		$(PKG_BUILD_DIR)/install-setuptools/usr/lib/python$(PYTHON3_VERSION)/site-packages/setuptools-$(PYTHON3_SETUPTOOLS_VERSION).dist-info \
-		$(PKG_BUILD_DIR)/install-setuptools/usr/lib/python$(PYTHON3_VERSION)/site-packages/_distutils_hack \
-		$(1)/usr/lib/python$(PYTHON3_VERSION)/site-packages
-	find $(1)/usr/lib/python$(PYTHON3_VERSION)/site-packages/ -path '*/__pycache__/*' -delete
-	find $(1)/usr/lib/python$(PYTHON3_VERSION)/site-packages/ -type d -name __pycache__ -delete
-endef
-
-$(eval $(call Py3BasePackage,python3-setuptools, \
-	, \
-	DO_NOT_ADD_TO_PACKAGE_DEPENDS \
-))
--- a/lang/python/python3/files/python3-package-venv.mk
+++ b/lang/python/python3/files/python3-package-venv.mk
@ -0,0 +1,19 @@
+#
+# Copyright (C) 2023 Jeffery To
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Package/python3-venv
+$(call Package/python3/Default)
+  TITLE:=Python $(PYTHON3_VERSION) venv module
+  DEPENDS:=+python3
+endef
+
+$(eval $(call Py3BasePackage,python3-venv, \
+	/usr/lib/python$(PYTHON3_VERSION)/ensurepip \
+	/usr/lib/python$(PYTHON3_VERSION)/venv \
+	, \
+	DO_NOT_ADD_TO_PACKAGE_DEPENDS \
+))
--- a/lang/python/python3/patches-setuptools/.placeholder
+++ b/lang/python/python3/patches-setuptools/.placeholder
--- a/lang/python/python3/patches-host-setuptools/.gitkeep
+++ b/lang/python/python3/patches-host-setuptools/.gitkeep
--- a/lang/python/python3/patches-pip/001-pep517-pyc-fix.patch
+++ b/lang/python/python3/patches-pip/001-pep517-pyc-fix.patch
@ -1,29 +0,0 @@
-diff --git a/pip/_vendor/pep517/in_process/__init__.py b/pip/_vendor/pep517/in_process/__init__.py
-index 281a356cfe26..77acbfc2670b 100644
--- a/pip/_vendor/pep517/in_process/__init__.py
-+++ b/pip/_vendor/pep517/in_process/__init__.py
-@@ -14,13 +14,21 @@ try:
-     except AttributeError:
-         # Python 3.8 compatibility
-         def _in_proc_script_path():
-            return resources.path(__package__, '_in_process.py')
-+            if resources.is_resource(__package__, '_in_process.py'):
-+                return resources.path(__package__, '_in_process.py')
-+            return resources.path(__package__, '_in_process.pyc')
-     else:
-         def _in_proc_script_path():
-+            if resources.files(__package__).joinpath('_in_process.py').is_file():
-+                return resources.as_file(
-+                    resources.files(__package__).joinpath('_in_process.py'))
-             return resources.as_file(
-                resources.files(__package__).joinpath('_in_process.py'))
-+                resources.files(__package__).joinpath('_in_process.pyc'))
- except ImportError:
-     # Python 3.6 compatibility
-     @contextmanager
-     def _in_proc_script_path():
-        yield pjoin(dirname(abspath(__file__)), '_in_process.py')
-+        _in_proc_script = pjoin(dirname(abspath(__file__)), '_in_process.py')
-+        if not os.path.isfile(_in_proc_script):
-+            _in_proc_script = pjoin(dirname(abspath(__file__)), '_in_process.pyc')
-+        yield _in_proc_script
--- a/libs/libmpc/Makefile
+++ b/libs/libmpc/Makefile
@ -0,0 +1,57 @@
+#
+# Copyright (C) 2023 Jeffery To
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=mpc
+PKG_VERSION:=1.3.1
+PKG_RELEASE:=1
+
+PKG_SOURCE_URL:=@GNU/mpc/
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_HASH:=ab642492f5cf882b74aa0cb730cd410a81edcdbec895183ce930e706c1c759b8
+
+PKG_LICENSE:=LGPL-3.0-or-later
+PKG_LICENSE_FILES:=COPYING.LESSER
+PKG_MAINTAINER:=Jeffery To <jeffery.to@gmail.com>
+
+PKG_BUILD_PARALLEL:=1
+PKG_FIXUP:=autoreconf
+PKG_INSTALL:=1
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/libmpc
+  SECTION:=libs
+  CATEGORY:=Libraries
+  TITLE:=GNU MPC library
+  URL:=https://www.multiprecision.org/mpc/
+  DEPENDS:=+libgmp +libmpfr
+  ABI_VERSION:=3
+endef
+
+define Package/libmpc/description
+GNU MPC is a portable library written in C for arbitrary precision
+arithmetic on complex numbers providing correct rounding. It implements
+a multiprecision equivalent of the C99 standard. It builds upon the GNU
+MP and the GNU MPFR libraries.
+endef
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/include
+	$(CP) $(PKG_INSTALL_DIR)/usr/include/mpc* $(1)/usr/include/
+
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libmpc.{a,so*} $(1)/usr/lib/
+endef
+
+define Package/libmpc/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libmpc.so.* $(1)/usr/lib/
+endef
+
+$(eval $(call BuildPackage,libmpc))
--- a/libs/libmpc/patches/001-only-src.patch
+++ b/libs/libmpc/patches/001-only-src.patch
@ -0,0 +1,22 @@
+--- a/Makefile.am
+++ b/Makefile.am
+@@ -23,7 +23,7 @@ ACLOCAL_AMFLAGS = -I m4
+ # VERSION = @VERSION@@GITVERSION@ # for development version
+ VERSION = @VERSION@
+ 
+-SUBDIRS = src tests doc tools
+SUBDIRS = src
+ 
+ EXTRA_HEADERS = src/mpc-log.h
+ include_HEADERS = src/mpc.h @MPC_LOG_H@
+--- a/Makefile.in
+++ b/Makefile.in
+@@ -376,7 +376,7 @@ top_build_prefix = @top_build_prefix@
+ top_builddir = @top_builddir@
+ top_srcdir = @top_srcdir@
+ ACLOCAL_AMFLAGS = -I m4
+-SUBDIRS = src tests doc tools
+SUBDIRS = src
+ EXTRA_HEADERS = src/mpc-log.h
+ include_HEADERS = src/mpc.h @MPC_LOG_H@
+ EXTRA_DIST = doc/fdl-1.3.texi src/mpc-log.h
--- a/libs/mpfr/Makefile
+++ b/libs/mpfr/Makefile
@ -0,0 +1,64 @@
+#
+# Copyright (C) 2023 Jeffery To
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=mpfr
+PKG_VERSION:=4.2.0
+PKG_RELEASE:=1
+
+PKG_SOURCE_URL:=@GNU/mpfr http://www.mpfr.org/mpfr-$(PKG_VERSION)
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
+PKG_HASH:=06a378df13501248c1b2db5aa977a2c8126ae849a9d9b7be2546fb4a9c26d993
+
+PKG_LICENSE:=LGPL-3.0-or-later
+PKG_LICENSE_FILES:=COPYING.LESSER
+PKG_MAINTAINER:=Jeffery To <jeffery.to@gmail.com>
+PKG_CPE_ID:=cpe:/a:mpfr:gnu_mpfr
+
+PKG_BUILD_PARALLEL:=1
+PKG_FIXUP:=autoreconf
+PKG_INSTALL:=1
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/libmpfr
+  SECTION:=libs
+  CATEGORY:=Libraries
+  TITLE:=GNU MPFR library
+  URL:=https://www.mpfr.org/
+  DEPENDS:=+libgmp
+  ABI_VERSION:=6
+endef
+
+define Package/libmpfr/description
+MPFR is a portable library written in C for arbitrary precision
+arithmetic on floating-point numbers. It is based on the GNU MP library.
+It aims to provide a class of floating-point numbers with precise
+semantics.
+endef
+
+CONFIGURE_ARGS += \
+	--enable-thread-safe
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/include
+	$(CP) $(PKG_INSTALL_DIR)/usr/include/mpf* $(1)/usr/include/
+
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libmpfr.{a,so*} $(1)/usr/lib/
+
+	$(INSTALL_DIR) $(1)/usr/lib/pkgconfig
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/mpfr.pc $(1)/usr/lib/pkgconfig/
+endef
+
+define Package/libmpfr/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libmpfr.so.* $(1)/usr/lib/
+endef
+
+$(eval $(call BuildPackage,libmpfr))
--- a/libs/mpfr/patches/001-only-src.patch
+++ b/libs/mpfr/patches/001-only-src.patch
@ -0,0 +1,22 @@
+--- a/Makefile.am
+++ b/Makefile.am
+@@ -38,7 +38,7 @@ AUTOMAKE_OPTIONS = gnu
+ # old Automake version.
+ ACLOCAL_AMFLAGS = -I m4
+ 
+-SUBDIRS = doc src tests tune tools/bench
+SUBDIRS = src
+ 
+ pkgconfigdir = $(libdir)/pkgconfig
+ pkgconfig_DATA = mpfr.pc
+--- a/Makefile.in
+++ b/Makefile.in
+@@ -401,7 +401,7 @@ AUTOMAKE_OPTIONS = gnu
+ # libtoolize and in case some developer needs to switch back to an
+ # old Automake version.
+ ACLOCAL_AMFLAGS = -I m4
+-SUBDIRS = doc src tests tune tools/bench
+SUBDIRS = src
+ pkgconfigdir = $(libdir)/pkgconfig
+ pkgconfig_DATA = mpfr.pc
+ nobase_dist_doc_DATA = AUTHORS BUGS COPYING COPYING.LESSER NEWS TODO \
--- a/net/acme-acmesh/Makefile
+++ b/net/acme-acmesh/Makefile
@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=acme-acmesh
 PKG_VERSION:=3.0.1
-PKG_RELEASE:=10
+PKG_RELEASE:=11

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/acmesh-official/acme.sh/tar.gz/$(PKG_VERSION)?
--- a/net/acme-acmesh/files/hook.sh
+++ b/net/acme-acmesh/files/hook.sh
@ -2,8 +2,6 @@
 set -u
 ACME=/usr/lib/acme/client/acme.sh
 LOG_TAG=acme-acmesh
-# webroot option deprecated, use the exported value directly in the next major version
-WEBROOT=${webroot:-$CHALLENGE_DIR}
 NOTIFY=/usr/lib/acme/notify

 # shellcheck source=net/acme/files/functions.sh
@ -13,30 +11,32 @@ NOTIFY=/usr/lib/acme/notify
 export CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
 export NO_TIMESTAMP=1

-link_certs()
-{
-    local main_domain
-    local domain_dir
-    domain_dir="$1"
-    main_domain="$2"
+link_certs() {
+	local main_domain
+	local domain_dir
+	domain_dir="$1"
+	main_domain="$2"

-    (umask 077; cat "$domain_dir/fullchain.cer" "$domain_dir/$main_domain.key" > "$domain_dir/combined.cer")
+	(
+		umask 077
+		cat "$domain_dir/fullchain.cer" "$domain_dir/$main_domain.key" >"$domain_dir/combined.cer"
+	)

-    if [ ! -e "$CERT_DIR/$main_domain.crt" ]; then
+	if [ ! -e "$CERT_DIR/$main_domain.crt" ]; then
 		ln -s "$domain_dir/$main_domain.cer" "$CERT_DIR/$main_domain.crt"
-    fi
-    if [ ! -e "$CERT_DIR/$main_domain.key" ]; then
+	fi
+	if [ ! -e "$CERT_DIR/$main_domain.key" ]; then
 		ln -s "$domain_dir/$main_domain.key" "$CERT_DIR/$main_domain.key"
-    fi
-    if [ ! -e "$CERT_DIR/$main_domain.fullchain.crt" ]; then
+	fi
+	if [ ! -e "$CERT_DIR/$main_domain.fullchain.crt" ]; then
 		ln -s "$domain_dir/fullchain.cer" "$CERT_DIR/$main_domain.fullchain.crt"
-    fi
-    if [ ! -e "$CERT_DIR/$main_domain.combined.crt" ]; then
+	fi
+	if [ ! -e "$CERT_DIR/$main_domain.combined.crt" ]; then
 		ln -s "$domain_dir/combined.cer" "$CERT_DIR/$main_domain.combined.crt"
-    fi
-    if [ ! -e "$CERT_DIR/$main_domain.chain.crt" ]; then
+	fi
+	if [ ! -e "$CERT_DIR/$main_domain.chain.crt" ]; then
 		ln -s "$domain_dir/ca.cer" "$CERT_DIR/$main_domain.chain.crt"
-    fi
+	fi
 }

 case $1 in
@ -44,12 +44,14 @@ get)
 	set --
 	[ "$debug" = 1 ] && set -- "$@" --debug

-	case $keylength in
-	ec-*)
+	case $key_type in
+	ec*)
+		keylength=${key_type/ec/ec-}
 		domain_dir="$state_dir/${main_domain}_ecc"
 		set -- "$@" --ecc
 		;;
-	*)
+	rsa*)
+		keylength=${key_type#rsa}
 		domain_dir="$state_dir/$main_domain"
 		;;
 	esac
@ -71,7 +73,7 @@ get)

 			case $status in
 			0)
-                                link_certs "$domain_dir" "$main_domain"
+				link_certs "$domain_dir" "$main_domain"
 				$NOTIFY renewed
 				exit
 				;;
@ -121,8 +123,8 @@ get)
 	elif [ "$standalone" = 1 ]; then
 		set -- "$@" --standalone --listen-v6
 	else
-		mkdir -p "$WEBROOT"
-		set -- "$@" --webroot "$WEBROOT"
+		mkdir -p "$CHALLENGE_DIR"
+		set -- "$@" --webroot "$CHALLENGE_DIR"
 	fi

 	set -- "$@" --issue --home "$state_dir"
@ -137,7 +139,7 @@ get)

 	case $status in
 	0)
-                link_certs "$domain_dir" "$main_domain"
+		link_certs "$domain_dir" "$main_domain"
 		$NOTIFY issued
 		;;
 	*)
--- a/net/acme-common/Makefile
+++ b/net/acme-common/Makefile
@ -8,7 +8,7 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=acme-common
-PKG_VERSION:=1.0.3
+PKG_VERSION:=1.0.4

 PKG_MAINTAINER:=Toke Høiland-Jørgensen <toke@toke.dk>
 PKG_LICENSE:=GPL-3.0-only
--- a/net/acme-common/files/acme.init
+++ b/net/acme-common/files/acme.init
@ -39,8 +39,17 @@ load_options() {
 	export domains
 	export main_domain
 	main_domain="$(first_arg $domains)"
-	config_get keylength "$section" keylength ec-256
-	export keylength
+	config_get keylength "$section" keylength
+	if [ "$keylength" ]; then
+		log warn "Option \"keylength\" is deprecated, please use key_type (e.g., ec256, rsa2048) instead."
+		case $keylength in
+		ec-*) key_type=${keylength/-/} ;;
+		*) key_type=rsa$keylength ;;
+		esac
+	else
+		config_get key_type "$section" key_type ec256
+	fi
+	export key_type
 	config_get dns "$section" dns
 	export dns
 	config_get acme_server "$section" acme_server
@ -51,11 +60,10 @@ load_options() {
 	export standalone
 	config_get dns_wait "$section" dns_wait
 	export dns_wait
-
 	config_get webroot "$section" webroot
-	export webroot
 	if [ "$webroot" ]; then
 		log warn "Option \"webroot\" is deprecated, please remove it and change your web server's config so it serves ACME challenge requests from $CHALLENGE_DIR."
+		CHALLENGE_DIR=$webroot
 	fi
 }

--- a/net/apfree-wifidog/Makefile
+++ b/net/apfree-wifidog/Makefile
@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=apfree-wifidog
-PKG_VERSION:=4.08.1771
-PKG_RELEASE:=7
+PKG_VERSION:=6.02.1939
+PKG_RELEASE:=6

 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_URL:=https://github.com/liudf0716/apfree_wifidog.git
+PKG_SOURCE_URL:=https://github.com/liudf0716/apfree-wifidog.git
 PKG_SOURCE_VERSION:=$(PKG_VERSION)
-PKG_MIRROR_HASH:=0fadb7a0e139bf4a5c6daffdd0f200ee2a4c903aea71e46bc19212b054ca71a7
+PKG_MIRROR_HASH:=b9e059c06427ad87312ea8a63c47d713dbad82ab0875778efe9f889e9c6b9c20

 PKG_MAINTAINER:=Dengfeng Liu <liudf0716@gmail.com>
 PKG_LICENSE:=GPL-3.0-or-later
@ -27,7 +27,7 @@ define Package/apfree-wifidog
  SUBMENU:=Captive Portals
  SECTION:=net
  CATEGORY:=Network
-  DEPENDS:=+zlib +firewall4 +iptables +libip4tc +libjson-c +libevent2 +libevent2-openssl +libuci +px5g
+  DEPENDS:=+zlib +libjson-c +libevent2 +libevent2-openssl +libuci 
  TITLE:=Apfree's wireless captive portal solution
  URL:=https://github.com/liudf0716/apfree_wifidog
 endef
--- a/net/apfree-wifidog/files/wifidogx.conf
+++ b/net/apfree-wifidog/files/wifidogx.conf
@ -1,9 +1,9 @@
-config wifidog
+config wifidogx 'common'
 	option gateway_interface 'br-lan'
-	option auth_server_hostname 'change wifidog.kunteng.org.cn to your auth server domain or ip'
+	option auth_server_hostname 'your auth server domain or ip'
 	option auth_server_port 443
 	option auth_server_path '/wifidog/'
 	option check_interval 60
 	option client_timeout 5
 	option wired_passed 0
-	option disabled 1
+	option enabled 0
--- a/net/apfree-wifidog/files/wifidogx.init
+++ b/net/apfree-wifidog/files/wifidogx.init
@ -6,271 +6,79 @@
 START=99

 USE_PROCD=1
-PROG=/usr/bin/wifidogx
+NAME=wifidogx
+PROG=/usr/bin/${NAME}
 CONFIGFILE=/tmp/wifidogx.conf

-extra_command "status" "Print the status of the service"
-
-PX5G_BIN="/usr/sbin/px5g"
-OPENSSL_BIN="/usr/bin/openssl"
-APFREE_CERT="/etc/apfree.crt"
-APFREE_KEY="/etc/apfree.key"
-
-generate_keys() {
-	local days bits country state location commonname
-	local UNIQUEID GENKEY_CMD
-
-	# Prefer px5g for certificate generation (existence evaluated last)
-	UNIQUEID=$(hexdump -n 4 -e '4/1 "%02x" "\n"' /dev/urandom)
-	[ -x "$OPENSSL_BIN" ] && GENKEY_CMD="$OPENSSL_BIN req -x509 -sha256 -outform pem -nodes"
-	[ -x "$PX5G_BIN" ] && GENKEY_CMD="$PX5G_BIN selfsigned -pem"
-	[ -n "$GENKEY_CMD" ] && {
-		$GENKEY_CMD \
-			-days "${days:-720}" -newkey rsa:"${bits:-2048}" -keyout "${APFREE_KEY}.new" -out "${APFREE_CERT}.new" \
-			-subj /C="${country:-CN}"/ST="${state:-Beijing}"/L="${location:-Unknown}"/O="${commonname:-ApFreeWiFidog}$UNIQUEID"/CN="${commonname:-ApFreeWiFidog}"
-		sync
-		mv "${APFREE_KEY}.new" "${APFREE_KEY}"
-		mv "${APFREE_CERT}.new" "${APFREE_CERT}"
-	}
-}
-
 service_trigger() {
-	procd_add_reload_trigger "wifidogx"
-}
-
-echo_firewall_rule() {
-	echo "    FirewallRule $1"
-}
-
-prepare_mqtt_conf() {
-	local cfg=$1
-	local serveraddr
-	local serverport
-
-	config_get serveraddr "$cfg" "serveraddr"
-	config_get serverport "$cfg" "serverport"
-	[ -z "${serveraddr}" ] || [ -z "${serverport}" ] && return 1
-
-	cat <<-EOF >>${CONFIGFILE}
-		MQTT {
-			ServerAddr ${serveraddr}
-			ServerPort ${serverport}
-		}
-	EOF
+	procd_add_reload_trigger ${NAME}
 }

 prepare_wifidog_conf() {
-	local cfg=$1
-	local disabled
-	local gateway_id
-	local gateway_interface
-	local auth_server_hostname
-	local auth_server_path
-	local auth_server_path_login
-	local auth_server_path_portal
-	local auth_server_path_msg
-	local auth_server_path_ping
-	local auth_server_path_auth
-	local delta_traffic
-	local check_interval
-	local client_timeout
-	local trusted_domains
-	local js_filter
-	local trusted_maclist
-	local untrusted_maclist
-	local pool_mode
-	local thread_number
-	local queue_size
-	local wired_passed
-	local trusted_iplist
-	local trusted_pan_domains
-	local proxy_port
-	local no_auth
-	local apple_cna
-	local update_domain_interval
-	local dns_timeout
-	local default_gateway_id
-	local external_interface
-	local auth_server_port

 	[ -f ${CONFIGFILE} ] && rm -f ${CONFIGFILE}

-	config_get disabled "${cfg}" "disabled" 1
-	if [ "${disabled}" = "1" ]; then
-		echo "wifidogx disabled in /etc/config/wifidogx file, please set disabled to 0 to enable it" >&2
-		return
-	fi
-
-	default_gateway_id=$(sed -e 's/://g' /sys/class/net/br-lan/address)
-
 	network_get_device external_interface wan

-	config_get gateway_id "${cfg}" "gateway_id" "${default_gateway_id}"
-	config_get gateway_interface "${cfg}" "gateway_interface" "br-lan"
-	config_get auth_server_hostname "${cfg}" "auth_server_hostname"
-	config_get auth_server_port "${cfg}" "auth_server_port" "80"
-	config_get auth_server_path "${cfg}" "auth_server_path" "/wifidog/"
-	config_get auth_server_path_login "${cfg}" "auth_server_path_login"
-	config_get auth_server_path_portal "${cfg}" "auth_server_path_portal"
-	config_get auth_server_path_msg "${cfg}" "auth_server_path_msg"
-	config_get auth_server_path_ping "${cfg}" "auth_server_path_ping"
-	config_get auth_server_path_auth "${cfg}" "auth_server_path_auth"
-	config_get delta_traffic "${cfg}" "delta_traffic"
-	config_get check_interval "${cfg}" "check_interval" "60"
-	config_get js_filter "${cfg}" "js_filter" 1
-	config_get client_timeout "${cfg}" "client_timeout"	"5"
-	config_get trusted_domains "${cfg}" "trusted_domains"
-	config_get trusted_maclist "${cfg}" "trusted_maclist"
-	config_get untrusted_maclist "${cfg}" "untrusted_maclist"
-	config_get pool_mode "${cfg}" "pool_mode" 0
-	config_get thread_number "${cfg}" "thread_number" 20
-	config_get queue_size "${cfg}" "queue_size" 200
-	config_get wired_passed "${cfg}" "wired_passed" 1
-	config_get trusted_iplist "${cfg}" "trusted_iplist"
-	config_get trusted_pan_domains "${cfg}" "trusted_pan_domains"
-	config_get proxy_port "${cfg}" "proxy_port"
-	config_get no_auth "${cfg}" "no_auth"
-	config_get apple_cna "${cfg}" "bypass_apple_cna"
-	config_get update_domain_interval "${cfg}" "update_domain_interval"
-	config_get dns_timeout "${cfg}" "dns_timeout"
+	uci_validate_section ${NAME} ${NAME} common \
+		'enabled:bool:0' \
+		'gateway_id:string' \
+		'gateway_interface:string:br-lan' \
+		'external_interface:string:external_interface' \
+		'auth_server_hostname:string' \
+		'auth_server_port:port:443' \
+		'auth_server_path:string:/wifidog/' \
+		'check_interval:integer:60' \
+		'client_timeout:integer:5' \
+		'js_filter:bool:1' \
+		'wired_passed:bool:1' \
+		'apple_cna:bool:0' \
+		'js_filter:bool:1' 

-	local set_auth_server_path_login
-	local set_auth_server_path_portal
-	local set_auth_server_path_msg
-	local set_auth_server_path_ping
-	local set_auth_server_path_auth
-	local set_delta_traffic
-	local set_trusted_maclist
-	local set_untrusted_maclist
-	local set_trusted_domains
-	local set_trusted_iplist
-	local set_trusted_pan_domains
-	local set_proxy_port
-	local set_no_auth
-	local set_firewall_rule_global
-	local set_firewall_rule_validating_users
-	local set_firewall_rule_known_users
-	local set_firewall_rule_auth_is_down
-	local set_firewall_rule_unknown_users
-	local set_firewall_rule_locked_users
-	local set_apple_cna
-	local set_update_domain_interval
-	local set_dns_timeout
-
-	set_auth_server_path_login=$([ -n "$auth_server_path_login" ] && echo "    LoginScriptPathFragment $auth_server_path_login")
-	set_auth_server_path_portal=$([ -n "$auth_server_path_portal" ] && echo "    PortalScriptPathFragment $auth_server_path_portal")
-	set_auth_server_path_msg=$([ -n "$auth_server_path_msg" ] && echo "    MsgScriptPathFragment $auth_server_path_msg")
-	set_auth_server_path_ping=$([ -n "$auth_server_path_ping" ] && echo "    PingScriptPathFragment $auth_server_path_ping")
-	set_auth_server_path_auth=$([ -n "$auth_server_path_auth" ] && echo "    AuthScriptPathFragment $auth_server_path_auth")
-	set_delta_traffic=$([ -n "$delta_traffic" ] && echo "DeltaTraffic $delta_traffic")
-	set_trusted_maclist=$([ -n "$trusted_maclist" ] && echo "TrustedMACList $trusted_maclist")
-	set_untrusted_maclist=$([ -n "$untrusted_maclist" ] && echo "UntrustedMACList $untrusted_maclist")
-	set_trusted_domains=$([ -n "$trusted_domains" ] && echo "TrustedDomains	$trusted_domains")
-	set_trusted_iplist=$([ -n "$trusted_iplist" ] && echo "TrustedIpList	$trusted_iplist")
-	set_trusted_pan_domains=$([ -n "$trusted_pan_domains" ] && echo "TrustedPanDomains	$trusted_pan_domains")
-	set_proxy_port=$([ -n "$proxy_port" ] && echo "Proxyport	$proxy_port")
-	set_no_auth=$([ -n "$no_auth"  ] && echo "NoAuth  $no_auth")
-	set_firewall_rule_global=$(config_list_foreach "$cfg" "firewall_rule_global" echo_firewall_rule)
-	set_firewall_rule_validating_users=$(config_list_foreach "$cfg" "firewall_rule_validating_users" echo_firewall_rule)
-	set_firewall_rule_known_users=$(config_list_foreach "$cfg" "firewall_rule_known_users" echo_firewall_rule)
-	set_firewall_rule_auth_is_down=$(config_list_foreach "$cfg" "firewall_rule_auth_is_down" echo_firewall_rule)
-	set_firewall_rule_unknown_users=$(config_list_foreach "$cfg" "firewall_rule_unknown_users" echo_firewall_rule)
-	set_firewall_rule_locked_users=$(config_list_foreach "$cfg" "firewall_rule_locked_users" echo_firewall_rule)
-	set_apple_cna=$([ -n "$apple_cna"  ] && echo "BypassAppleCNA $apple_cna")
-	set_update_domain_interval=$([ -n "$update_domain_interval" ] && echo "UpdateDomainInterval $update_domain_interval")
-	set_dns_timeout=$([ -n "$dns_timeout" ] && echo "DNSTimeout $dns_timeout")
-
-	cat <<-EOF >$CONFIGFILE
-		GatewayID $gateway_id
-		GatewayInterface $gateway_interface
-		Externalinterface $external_interface
-
-		AuthServer {
-			Hostname $auth_server_hostname
-			HTTPPort $auth_server_port
-			Path $auth_server_path
-			$set_auth_server_path_login
-			$set_auth_server_path_portal
-			$set_auth_server_path_msg
-			$set_auth_server_path_ping
-			$set_auth_server_path_auth
-		}
-
-		$set_delta_traffic
-		CheckInterval $check_interval
-		ClientTimeout $client_timeout
-		JsFilter $js_filter
-		WiredPassed $wired_passed
-		$set_trusted_domains
-		$set_untrusted_maclist
-		$set_trusted_maclist
-		$set_trusted_iplist
-		$set_trusted_pan_domains
-		$set_proxy_port
-		$set_no_auth
-		$set_apple_cna
-		$set_update_domain_interval
-		$set_dns_timeout
-
-		FirewallRuleSet global {
-			$set_firewall_rule_global
-		}
-
-		FirewallRuleSet validating-users {
-			$set_firewall_rule_validating_users
-			FirewallRule allow to 0.0.0.0/0
-		}
-
-		FirewallRuleSet known-users {
-			$set_firewall_rule_known_users
-			FirewallRule allow to 0.0.0.0/0
-		}
-
-		FirewallRuleSet auth-is-down {
-			$set_firewall_rule_auth_is_down
-		}
-
-		FirewallRuleSet unknown-users {
-			$set_firewall_rule_unknown_users
-			FirewallRule allow udp port 53
-			FirewallRule allow tcp port 53
-			FirewallRule allow udp port 67
-			FirewallRule allow tcp port 67
-		}
-
-		FirewallRuleSet locked-users {
-			$set_firewall_rule_locked_users
-			FirewallRule block to 0.0.0.0/0
-		}
-EOF
+	# if gateway_id is not set, get it from br-lan
+	if [ -z "$gateway_id" ]; then
+		gateway_id=$(sed -e 's/://g' /sys/class/net/${gateway_interface}/address)
+		# uci add gateway_id to config file
+		uci set ${NAME}.common.gateway_id=$gateway_id
+		uci commit ${NAME}
+	fi
+	
+	# set above variables to config file
+	echo "GatewayID $gateway_id" > ${CONFIGFILE}
+	echo "GatewayInterface $gateway_interface" >> ${CONFIGFILE}
+	echo "ExternalInterface $external_interface" >> ${CONFIGFILE}
+	echo "AuthServer {
+	Hostname $auth_server_hostname
+	HTTPPort $auth_server_port
+	Path $auth_server_path
+}" >> ${CONFIGFILE}
+	echo "CheckInterval $check_interval" >> ${CONFIGFILE}
+	echo "ClientTimeout $client_timeout" >> ${CONFIGFILE}
+	echo "JsFilter $js_filter" >> ${CONFIGFILE}
+	echo "WiredPassed $wired_passed" >> ${CONFIGFILE}
+	echo "BypassAppleCNA $apple_cna" >> ${CONFIGFILE}
 }

 init_config() {
-	config_load wifidogx
-	config_foreach prepare_wifidog_conf wifidog
+
+	prepare_wifidog_conf 

 	if [ ! -f ${CONFIGFILE} ]; then
 		echo "no wifidogx.conf, exit..." >&2
 		exit
 	fi
-
-	if [ ! -s "${APFREE_CERT}" ] || [ ! -s "${APFREE_KEY}" ]; then
-		generate_keys
-	fi
-
-	if [ ! -s ${APFREE_KEY} ] || [ ! -s ${APFREE_CERT} ]; then
-		echo "no cert or key, exit..." >&2
-		exit
-	fi
-
-	config_foreach prepare_mqtt_conf mqtt
-
-	sed -i -e '/^$/d' ${CONFIGFILE}
 }

 start_service() {
+	config_load $NAME
+
 	init_config

+	[ "$enabled" -eq 0 ] && {
+		echo "wifidogx is disabled, exit..." >&2
+		exit 0
+	}
+
 	procd_open_instance
 	# -f: run in foreground
 	procd_set_param command $PROG -c $CONFIGFILE -f -d 0
@ -282,3 +90,8 @@ start_service() {
 status_service() {
 	/usr/bin/wdctlx status
 }
+
+reload_service() {
+	stop 
+	start
+}
--- a/net/apfree-wifidog/patches/010-support-openssl-3.0.patch
+++ b/net/apfree-wifidog/patches/010-support-openssl-3.0.patch
@ -1,53 +0,0 @@
-From 53a042836063e965f8df9fc85bb32e8e46da8a05 Mon Sep 17 00:00:00 2001
-From: staylightblow8 <liudf0716@gmail.com>
-Date: Thu, 20 Oct 2022 10:47:59 +0800
-Subject: [PATCH] support openssl > 3.0
-
---
- cmake/Modules/FindOpenSSL.cmake | 27 +++++++++++++++++++++++----
- 1 file changed, 23 insertions(+), 4 deletions(-)
-
--- a/cmake/Modules/FindOpenSSL.cmake
-+++ b/cmake/Modules/FindOpenSSL.cmake
-@@ -282,11 +282,11 @@ function(from_hex HEX DEC)
-   set(${DEC} ${_res} PARENT_SCOPE)
- endfunction()
- 
-if (OPENSSL_INCLUDE_DIR)
-  if(OPENSSL_INCLUDE_DIR AND EXISTS "${OPENSSL_INCLUDE_DIR}/openssl/opensslv.h")
-    file(STRINGS "${OPENSSL_INCLUDE_DIR}/openssl/opensslv.h" openssl_version_str
-         REGEX "^# *define[\t ]+OPENSSL_VERSION_NUMBER[\t ]+0x([0-9a-fA-F])+.*")
-+if(OPENSSL_INCLUDE_DIR AND EXISTS "${OPENSSL_INCLUDE_DIR}/openssl/opensslv.h")
-+  file(STRINGS "${OPENSSL_INCLUDE_DIR}/openssl/opensslv.h" openssl_version_str
-+       REGEX "^#[\t ]*define[\t ]+OPENSSL_VERSION_NUMBER[\t ]+0x([0-9a-fA-F])+.*")
- 
-+  if(openssl_version_str)
-     # The version number is encoded as 0xMNNFFPPS: major minor fix patch status
-     # The status gives if this is a developer or prerelease and is ignored here.
-     # Major, minor, and fix directly translate into the version numbers shown in
-@@ -315,6 +315,25 @@ if (OPENSSL_INCLUDE_DIR)
-     endif ()
- 
-     set(OPENSSL_VERSION "${OPENSSL_VERSION_MAJOR}.${OPENSSL_VERSION_MINOR}.${OPENSSL_VERSION_FIX}${OPENSSL_VERSION_PATCH_STRING}")
-+  else ()
-+    # Since OpenSSL 3.0.0, the new version format is MAJOR.MINOR.PATCH and
-+    # a new OPENSSL_VERSION_STR macro contains exactly that
-+    file(STRINGS "${OPENSSL_INCLUDE_DIR}/openssl/opensslv.h" OPENSSL_VERSION_STR
-+         REGEX "^#[\t ]*define[\t ]+OPENSSL_VERSION_STR[\t ]+\"([0-9])+\\.([0-9])+\\.([0-9])+\".*")
-+    string(REGEX REPLACE "^.*OPENSSL_VERSION_STR[\t ]+\"([0-9]+\\.[0-9]+\\.[0-9]+)\".*$"
-+           "\\1" OPENSSL_VERSION_STR "${OPENSSL_VERSION_STR}")
-+
-+    set(OPENSSL_VERSION "${OPENSSL_VERSION_STR}")
-+
-+    # Setting OPENSSL_VERSION_MAJOR OPENSSL_VERSION_MINOR and OPENSSL_VERSION_FIX
-+    string(REGEX MATCHALL "([0-9])+" OPENSSL_VERSION_NUMBER "${OPENSSL_VERSION}")
-+    list(POP_FRONT OPENSSL_VERSION_NUMBER
-+      OPENSSL_VERSION_MAJOR
-+      OPENSSL_VERSION_MINOR
-+      OPENSSL_VERSION_FIX)
-+
-+    unset(OPENSSL_VERSION_NUMBER)
-+    unset(OPENSSL_VERSION_STR)
-   endif ()
- endif ()
- 
--- a/net/cloudflared/Makefile
+++ b/net/cloudflared/Makefile
@ -5,12 +5,12 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=cloudflared
-PKG_VERSION:=2023.5.0
+PKG_VERSION:=2023.5.1
 PKG_RELEASE:=1

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/cloudflare/cloudflared/tar.gz/$(PKG_VERSION)?
-PKG_HASH:=38d72e35fbb894c43161ee7c6871c44d9771bc9a1f3bc54602baf66e69acefd3
+PKG_HASH:=ee2c2a4b0c290c39475f79ab74972dfbce817df8e5090813cad0e58f33836194

 PKG_LICENSE:=Apache-2.0
 PKG_LICENSE_FILES:=LICENSE
--- a/net/dnsproxy/Makefile
+++ b/net/dnsproxy/Makefile
@ -5,12 +5,12 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=dnsproxy
-PKG_VERSION:=0.49.1
+PKG_VERSION:=0.49.2
 PKG_RELEASE:=1

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/AdguardTeam/dnsproxy/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=c587a7e88660c879f738df1ffcbf0402928a0c04ec0f148e385017f176e8ba14
+PKG_HASH:=e1bbaee78077a94149fc0fe18a4c7c9609d96307fa7c4b3ae09811965d5db96a

 PKG_MAINTAINER:=Tianling Shen <cnsztl@immortalwrt.org>
 PKG_LICENSE:=Apache-2.0
--- a/net/freeradius3/Makefile
+++ b/net/freeradius3/Makefile
@ -8,19 +8,19 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=freeradius3
-PKG_VERSION:=3_0_21
-PKG_RELEASE:=2
+PKG_VERSION:=3.0.26
+PKG_RELEASE:=1

-PKG_SOURCE:=release_$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://github.com/FreeRADIUS/freeradius-server/archive
-PKG_HASH:=b2014372948a92f86cfe2cf43c58ef47921c03af05666eb9d6416bdc6eeaedc2
+PKG_SOURCE:=freeradius-server-$(PKG_VERSION).tar.bz2
+PKG_SOURCE_URL:=https://github.com/FreeRADIUS/freeradius-server/releases/download/release_$(subst .,_,$(PKG_VERSION))/
+PKG_HASH:=9a65314c462da4d4c4204df72c45f210de671f89317299b01f78549ac4503f59

 PKG_MAINTAINER:=
 PKG_LICENSE:=GPL-2.0
 PKG_LICENSE_FILES:=COPYRIGHT LICENSE
 PKG_CPE_ID:=cpe:/a:freeradius:freeradius

-PKG_BUILD_DIR:=$(BUILD_DIR)/freeradius-server-release_$(PKG_VERSION)
+PKG_BUILD_DIR:=$(BUILD_DIR)/freeradius-server-$(PKG_VERSION)
 PKG_FIXUP:=autoreconf
 PYTHON3_PKG_BUILD:=0

@ -77,7 +77,6 @@ define Package/freeradius3-default
 +freeradius3-mod-digest \
 +freeradius3-mod-eap \
 +freeradius3-mod-eap-gtc \
-+freeradius3-mod-eap-leap \
 +freeradius3-mod-eap-md5 \
 +freeradius3-mod-eap-mschapv2 \
 +freeradius3-mod-eap-peap \
@ -195,12 +194,6 @@ define Package/freeradius3-mod-eap-gtc
  TITLE:=EAP/GTC module
 endef

-define Package/freeradius3-mod-eap-leap
-  $(call Package/freeradius3/Default)
-  DEPENDS:=freeradius3-mod-eap
-  TITLE:=EAP/LEAP module
-endef
-
 define Package/freeradius3-mod-eap-md5
  $(call Package/freeradius3/Default)
  DEPENDS:=freeradius3-mod-eap
@ -774,7 +767,6 @@ $(eval $(call BuildPlugin,freeradius3-mod-detail,rlm_detail,))
 $(eval $(call BuildPlugin,freeradius3-mod-digest,rlm_digest,))
 $(eval $(call BuildPlugin,freeradius3-mod-eap,rlm_eap,))
 $(eval $(call BuildPlugin,freeradius3-mod-eap-gtc,rlm_eap_gtc,))
-$(eval $(call BuildPlugin,freeradius3-mod-eap-leap,rlm_eap_leap,))
 $(eval $(call BuildPlugin,freeradius3-mod-eap-md5,rlm_eap_md5,))
 $(eval $(call BuildPlugin,freeradius3-mod-eap-mschapv2,rlm_eap_mschapv2,))
 $(eval $(call BuildPlugin,freeradius3-mod-eap-peap,rlm_eap_peap,))
--- a/net/freeradius3/patches/002-disable-session-cache-CVE-2017-9148.patch
+++ b/net/freeradius3/patches/002-disable-session-cache-CVE-2017-9148.patch
@ -9,16 +9,16 @@ Last-Update: 2020-04-28

 --- a/src/main/tls.c
 +++ b/src/main/tls.c
-@@ -675,7 +675,7 @@ tls_session_t *tls_new_session(TALLOC_CT
- 		state->mtu = vp->vp_integer;
+@@ -934,7 +934,7 @@ after_chain:
 	}
+ 	if (vp) vp->vp_integer = state->mtu;
 
 -	if (conf->session_cache_enable) state->allow_session_resumption = true; /* otherwise it's false */
 +	if (/*conf->session_cache_enable*/0) state->allow_session_resumption = true; /* otherwise it's false */
 
 	return state;
 }
-@@ -3332,7 +3332,7 @@ post_ca:
+@@ -4389,7 +4389,7 @@ post_ca:
 	/*
 	 *	Callbacks, etc. for session resumption.
 	 */
@ -27,7 +27,7 @@ Last-Update: 2020-04-28
 		/*
 		 *	Cache sessions on disk if requested.
 		 */
-@@ -3402,7 +3402,7 @@ post_ca:
+@@ -4469,7 +4469,7 @@ post_ca:
 	/*
 	 *	Setup session caching
 	 */
@ -36,7 +36,7 @@ Last-Update: 2020-04-28
 		/*
 		 *	Create a unique context Id per EAP-TLS configuration.
 		 */
-@@ -3571,7 +3571,7 @@ fr_tls_server_conf_t *tls_server_conf_pa
+@@ -4757,7 +4757,7 @@ fr_tls_server_conf_t *tls_server_conf_pa
 		goto error;
 	}
 
--- a/net/freeradius3/patches/010-openssl-deprecated.patch
+++ b/net/freeradius3/patches/010-openssl-deprecated.patch
@ -18,15 +18,15 @@
 }
 --- a/src/main/tls.c
 +++ b/src/main/tls.c
-@@ -55,6 +55,7 @@ USES_APPLE_DEPRECATED_API	/* OpenSSL API
+@@ -60,6 +60,7 @@ USES_APPLE_DEPRECATED_API	/* OpenSSL API
 #    include <openssl/evp.h>
 #  endif
 #  include <openssl/ssl.h>
 +#  include <openssl/dh.h>
 
- #define LOG_PREFIX "tls"
- 
-@@ -2133,7 +2134,7 @@ int cbtls_verify(int ok, X509_STORE_CTX
+ #if OPENSSL_VERSION_NUMBER >= 0x30000000L
+ #  include <openssl/provider.h>
+@@ -2954,7 +2955,7 @@ int cbtls_verify(int ok, X509_STORE_CTX
 	int		my_ok = ok;
 
 	ASN1_INTEGER	*sn = NULL;
@ -35,7 +35,7 @@
 	VALUE_PAIR	**certs;
 	char **identity;
 #ifdef HAVE_OPENSSL_OCSP_H
-@@ -2207,7 +2208,7 @@ int cbtls_verify(int ok, X509_STORE_CTX
+@@ -3028,7 +3029,7 @@ int cbtls_verify(int ok, X509_STORE_CTX
 	 *	Get the Expiration Date
 	 */
 	buf[0] = '\0';
@ -44,7 +44,7 @@
 	if (certs && (lookup <= 1) && asn_time &&
 	    (asn_time->length < (int) sizeof(buf))) {
 		memcpy(buf, (char*) asn_time->data, asn_time->length);
-@@ -2220,7 +2221,7 @@ int cbtls_verify(int ok, X509_STORE_CTX
+@@ -3041,7 +3042,7 @@ int cbtls_verify(int ok, X509_STORE_CTX
 	 *	Get the Valid Since Date
 	 */
 	buf[0] = '\0';
@ -53,7 +53,7 @@
 	if (certs && (lookup <= 1) && asn_time &&
 	    (asn_time->length < (int) sizeof(buf))) {
 		memcpy(buf, (char*) asn_time->data, asn_time->length);
-@@ -2690,10 +2691,12 @@ static int set_ecdh_curve(SSL_CTX *ctx,
+@@ -3592,10 +3593,12 @@ static int set_ecdh_curve(SSL_CTX *ctx,
  */
 int tls_global_init(bool spawn_flag, bool check)
 {
@ -66,7 +66,7 @@
 
 	/*
 	 *	Initialize the index for the certificates.
-@@ -2769,6 +2772,7 @@ int tls_global_version_check(char const
+@@ -3693,6 +3696,7 @@ int tls_global_version_check(char const
  */
 void tls_global_cleanup(void)
 {
@ -74,7 +74,7 @@
 #if OPENSSL_VERSION_NUMBER < 0x10000000L
 	ERR_remove_state(0);
 #elif OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-@@ -2781,6 +2785,7 @@ void tls_global_cleanup(void)
+@@ -3718,6 +3722,7 @@ void tls_global_cleanup(void)
 	ERR_free_strings();
 	EVP_cleanup();
 	CRYPTO_cleanup_all_ex_data();
--- a/net/https-dns-proxy/Makefile
+++ b/net/https-dns-proxy/Makefile
@ -1,14 +1,14 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=https-dns-proxy
-PKG_VERSION:=2022-10-15
-PKG_RELEASE:=12
+PKG_VERSION:=2023-05-25
+PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/aarond10/https_dns_proxy/
 PKG_SOURCE_DATE:=$(PKG_VERSION)
-PKG_SOURCE_VERSION:=f52a85f3edabecfbab41d9244c63a1c6b8aaf49b
-PKG_MIRROR_HASH:=dd8a55255e8859a462fcfd736577fec40731b39a4783325640518745009b0dee
+PKG_SOURCE_VERSION:=d03e11572562f008f68df217a7378628f1bb7b79
+PKG_MIRROR_HASH:=5af3683c48bc9e493ca2761a6f7ee756431692a695d6008f61b8b92431036dca
 PKG_MAINTAINER:=Stan Grishin <stangri@melmac.ca>
 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE
--- a/net/https-dns-proxy/files/https-dns-proxy.init
+++ b/net/https-dns-proxy/files/https-dns-proxy.init
@ -3,7 +3,7 @@
 # shellcheck disable=SC1091,SC3043,SC3060

 # shellcheck disable=SC2034
-START=80
+START=95
 # shellcheck disable=SC2034
 USE_PROCD=1

--- a/net/https-dns-proxy/patches/010-cmakelists-remove-cflags.patch
+++ b/net/https-dns-proxy/patches/010-cmakelists-remove-cflags.patch
@ -4,10 +4,10 @@
   set(CMAKE_INSTALL_BINDIR bin)
 endif()
 
-set(CMAKE_C_FLAGS "-Wall -Wextra --pedantic -Wno-strict-aliasing -Wno-variadic-macros")
+-set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall -Wextra --pedantic -Wno-strict-aliasing -Wno-variadic-macros")
 -set(CMAKE_C_FLAGS_DEBUG "-g -DDEBUG")
 -set(CMAKE_C_FLAGS_RELEASE "-O2")
-+#set(CMAKE_C_FLAGS "-Wall -Wextra --pedantic -Wno-strict-aliasing -Wno-variadic-macros")
+#set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall -Wextra --pedantic -Wno-strict-aliasing -Wno-variadic-macros")
 +#set(CMAKE_C_FLAGS_DEBUG "-g -DDEBUG")
 +#set(CMAKE_C_FLAGS_RELEASE "-O2")
 
--- a/net/https-dns-proxy/patches/020-cmakelists-add-version.patch
+++ b/net/https-dns-proxy/patches/020-cmakelists-add-version.patch
@ -1,51 +0,0 @@
-From 2ca80486ba6a4e5acbdf0ff581d9754af17fa33b Mon Sep 17 00:00:00 2001
-From: baranyaib90 <5031516+baranyaib90@users.noreply.github.com>
-Date: Mon, 24 Oct 2022 22:53:37 +0200
-Subject: [PATCH] Allow external setting of GIT_VERSION
-
---
- CMakeLists.txt | 34 ++++++++++++++++++----------------
- 1 file changed, 18 insertions(+), 16 deletions(-)
-
--- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -36,22 +36,24 @@ endif()
- 
- # VERSION
- 
-find_package(Git)
-if(Git_FOUND)
-  execute_process(
-    COMMAND "${GIT_EXECUTABLE}" show --date=format:%Y.%m.%d --format=%ad-%h --no-patch
-    WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}"
-    OUTPUT_VARIABLE GIT_VERSION
-    OUTPUT_STRIP_TRAILING_WHITESPACE)
-  message(STATUS "Version: ${GIT_VERSION}")
-+if(NOT GIT_VERSION)
-+  find_package(Git)
-+  if(Git_FOUND)
-+    execute_process(
-+      COMMAND "${GIT_EXECUTABLE}" show --date=format:%Y.%m.%d --format=%ad-%h --no-patch
-+      WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}"
-+      OUTPUT_VARIABLE GIT_VERSION
-+      OUTPUT_STRIP_TRAILING_WHITESPACE)
-+    message(STATUS "Version: ${GIT_VERSION}")
- 
-  # May not update version in some cases (example: git commit --amend)
-  set_property(GLOBAL APPEND
-    PROPERTY CMAKE_CONFIGURE_DEPENDS
-    "${CMAKE_SOURCE_DIR}/.git/index")
-else()
-  set(GIT_VERSION "UNKNOWN")
-  message(WARNING "Could not find git command! Version is set to: ${GIT_VERSION}")
-+    # May not update version in some cases (example: git commit --amend)
-+    set_property(GLOBAL APPEND
-+      PROPERTY CMAKE_CONFIGURE_DEPENDS
-+      "${CMAKE_SOURCE_DIR}/.git/index")
-+  else()
-+    set(GIT_VERSION "UNKNOWN")
-+    message(WARNING "Could not find git command! Version is set to: ${GIT_VERSION}")
-+  endif()
- endif()
- 
- # LIBRARY DEPENDENCIES
--- a/net/https-dns-proxy/patches/020-src-options.c-add-version.patch
+++ b/net/https-dns-proxy/patches/020-src-options.c-add-version.patch
@ -0,0 +1,11 @@
+--- a/src/options.c
+++ b/src/options.c
+@@ -22,7 +22,7 @@ const char * options_sw_version() {
+ #ifdef SW_VERSION
+   return SW_VERSION;
+ #else
+-  return "2023.01.01-atLeast";  // update date sometimes, like 1-2 times a year
+  return "2023-05-25-1";  // update date sometimes, like 1-2 times a year
+ #endif
+ }
+ 
--- a/net/lighttpd/Makefile
+++ b/net/lighttpd/Makefile
@ -8,14 +8,14 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=lighttpd
-PKG_VERSION:=1.4.70
+PKG_VERSION:=1.4.71
 PKG_RELEASE:=1
 # release candidate ~rcX testing; remove for release
 #PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://download.lighttpd.net/lighttpd/releases-1.4.x
-PKG_HASH:=921ebe1cf4b6b9897e03779ab7a23a31f4ba40a1abe2067525c33cd3ce61fe85
+PKG_HASH:=b8b6915da20396fdc354df3324d5e440169b2e5ea7859e3a775213841325afac

 PKG_MAINTAINER:=W. Michael Petullo <mike@flyn.org>
 PKG_LICENSE:=BSD-3-Clause
--- a/net/lighttpd/patches/020-meson-mod_webdav_min.patch
+++ b/net/lighttpd/patches/020-meson-mod_webdav_min.patch
@ -9,7 +9,7 @@ Subject: [PATCH] [meson] mod_webdav_min w/o deps: xml2 sqlite3 uuid

 --- a/src/meson.build
 +++ b/src/meson.build
-@@ -879,6 +879,16 @@ if libsasl.found()
+@@ -876,6 +876,16 @@ if libsasl.found()
 	]
 endif
 
--- a/net/lighttpd/patches/030-mod_h2-HTTP-2-separate-mod.patch
+++ b/net/lighttpd/patches/030-mod_h2-HTTP-2-separate-mod.patch
@ -1,87 +0,0 @@
-From 2892a7bf3f8ce92f41134fab25fbc2057f4a36bf Mon Sep 17 00:00:00 2001
-From: Glenn Strauss <gstrauss@gluelogic.com>
-Date: Wed, 10 May 2023 19:06:42 -0400
-Subject: [PATCH] [mod_h2] HTTP/2 separate module; no longer builtin
-
---
- src/CMakeLists.txt | 3 ---
- src/Makefile.am    | 9 +++------
- src/SConscript     | 4 +---
- src/meson.build    | 3 ---
- 4 files changed, 4 insertions(+), 15 deletions(-)
-
--- a/src/CMakeLists.txt
-+++ b/src/CMakeLists.txt
-@@ -922,10 +922,7 @@ set(SERVER_SRC
- 	response.c
- 	connections.c
- 	h1.c
-	h2.c
- 	sock_addr_cache.c
-	ls-hpack/lshpack.c
-	algo_xxhash.c
- 	fdevent_impl.c
- 	http_range.c
- 	network.c
--- a/src/Makefile.am
-+++ b/src/Makefile.am
-@@ -70,12 +70,10 @@ common_src=base64.c buffer.c burl.c log.
- 
- common_src += fdevent_win32.c fs_win32.c
- 
-src = server.c response.c connections.c h1.c h2.c \
-+src = server.c response.c connections.c h1.c \
- 	sock_addr_cache.c \
- 	network.c \
- 	network_write.c \
-	ls-hpack/lshpack.c \
-	algo_xxhash.c \
- 	fdevent_impl.c \
- 	http_range.c \
- 	data_config.c \
-@@ -428,6 +426,8 @@ lighttpd_LDADD = \
-   $(FAM_LIBS) $(LIBEV_LIBS) $(LIBUNWIND_LIBS)
- lighttpd_LDFLAGS = -export-dynamic
- 
-+lighttpd_SOURCES += h2.c ls-hpack/lshpack.c algo_xxhash.c
-+lighttpd_LDADD += $(XXHASH_LIBS)
- if BUILD_WITH_MAXMINDDB
- lighttpd_SOURCES += mod_maxminddb.c
- lighttpd_LDADD += $(MAXMINDDB_LIB)
-@@ -489,9 +489,6 @@ lighttpd_SOURCES += mod_wolfssl.c
- lighttpd_CPPFLAGS += $(WOLFSSL_CFLAGS)
- lighttpd_LDADD += $(WOLFSSL_LIBS)
- endif
-#(until switch to mod_h2)
-#lighttpd_SOURCES += h2.c ls-hpack/lshpack.c algo_xxhash.c
-#lighttpd_LDADD += $(XXHASH_LIBS)
- 
- else
- 
--- a/src/SConscript
-+++ b/src/SConscript
-@@ -75,10 +75,8 @@ common_src = Split("base64.c buffer.c bu
- 	ck.c \
- ")
- 
-src = Split("server.c response.c connections.c h1.c h2.c \
-+src = Split("server.c response.c connections.c h1.c \
- 	sock_addr_cache.c \
-	ls-hpack/lshpack.c \
-	algo_xxhash.c \
- 	fdevent_impl.c \
- 	http_range.c \
- 	network.c \
--- a/src/meson.build
-+++ b/src/meson.build
-@@ -560,10 +560,7 @@ main_src = files(
- 	'connections.c',
- 	'data_config.c',
- 	'h1.c',
-	'h2.c',
- 	'sock_addr_cache.c',
-	'ls-hpack/lshpack.c',
-	'algo_xxhash.c',
- 	'fdevent_impl.c',
- 	'http_range.c',
- 	'network_write.c',
--- a/net/mstpd/Config.in
+++ b/net/mstpd/Config.in
@ -1,12 +0,0 @@
-menu "Configuration"
-	depends on PACKAGE_mstpd
-
-config MSTPD_RTNL_RCV_BUFSIZE
-	int "Netlink receive buffer size"
-	default 262144
-
-config MSTPD_RTNL_SND_BUFSIZE
-	int "Netlink send buffer size"
-	default 262144
-
-endmenu
--- a/net/mstpd/Makefile
+++ b/net/mstpd/Makefile
@ -1,58 +0,0 @@
-#
-# Copyright (C) 2019 Alexandru Ardelean <ardeleanalex@gmail.com>
-#
-# This is free software, licensed under the GNU General Public License v2.
-# See /LICENSE for more information.
-#
-
-include $(TOPDIR)/rules.mk
-
-PKG_NAME:=mstpd
-PKG_VERSION:=0.1.0
-PKG_RELEASE:=1
-
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://codeload.github.com/mstpd/mstpd/tar.gz/$(PKG_VERSION)?
-PKG_HASH:=03d1ff4ca189d54322562cb2891888768af719d2c73ceafa5f1ca96133dffeb2
-
-PKG_MAINTAINER:=Alexandru Ardelean <ardeleanalex@gmail.com>
-PKG_LICENSE:=GPL-2.0-or-later
-PKG_LICENSE_FILES:=LICENSE
-
-PKG_FIXUP:=autoreconf
-
-include $(INCLUDE_DIR)/package.mk
-
-define Package/mstpd
-  SECTION:=net
-  CATEGORY:=Network
-  TITLE:=Multiple Spanning Tree Protocol daemon
-  URL:=https://github.com/mstpd/mstpd
-endef
-
-define Package/mstpd/description
-  Multiple Spanning Tree Protocol daemon.
-  Implements MSTP which is not implemented yet in the Linux kernel.
-endef
-
-define Package/mstpd/config
-  source "$(SOURCE)/Config.in"
-endef
-
-TARGET_CFLAGS += \
-	-DRTNL_RCV_BUFSIZE=$(CONFIG_MSTPD_RTNL_RCV_BUFSIZE) \
-	-DRTNL_SND_BUFSIZE=$(CONFIG_MSTPD_RTNL_SND_BUFSIZE)
-
-MAKE_VARS+=MODE=prod
-
-define Package/mstpd/install
-	$(INSTALL_DIR) $(1)/usr/sbin
-	$(INSTALL_BIN) $(PKG_BUILD_DIR)/mstpd $(1)/usr/sbin
-	$(INSTALL_BIN) $(PKG_BUILD_DIR)/mstpctl $(1)/usr/sbin
-	$(INSTALL_DIR) $(1)/etc/init.d/
-	$(INSTALL_BIN) ./files/etc/init.d/mstpd.init $(1)/etc/init.d/mstpd
-	$(INSTALL_DIR) $(1)/sbin
-	$(INSTALL_BIN) ./files/sbin/bridge-stp $(1)/sbin
-endef
-
-$(eval $(call BuildPackage,mstpd))
--- a/net/mstpd/files/etc/init.d/mstpd.init
+++ b/net/mstpd/files/etc/init.d/mstpd.init
@ -1,124 +0,0 @@
-#!/bin/sh /etc/rc.common
-
-# shellcheck disable=SC2034	# foo appears unused. Verify it or export it.
-
-START=25
-STOP=99
-
-MSTPCTL="/usr/sbin/mstpctl"
-MSTPD="/usr/sbin/mstpd"
-
-USE_PROCD=1
-
-mstpd_get_bridges() {
-	"$MSTPCTL" showbridge | grep -v "^ " | cut -d " " -f 1 2>/dev/null
-}
-
-# mstpd log levels 
-#   LOG_LEVEL_NONE  0
-#   LOG_LEVEL_ERROR 1
-#   LOG_LEVEL_INFO  2
-#   LOG_LEVEL_DEBUG 3
-#   LOG_LEVEL_STATE_MACHINE_TRANSITION 4
-#   LOG_LEVEL_MAX   100
-
-config_bridge_port_mstpd() {
-	local config="$1"
-	local index=$2 # FIXME: maybe remove index later
-	local name=$3
-
-	[ -n "$index" -a -n "$name" ] || return 0
-
-	config_get br_index "$config" br_index
-	[ -n "$br_index" ] || return 0
-	[ "$index" = "$br_index" ] || return 0
-
-	config_get port_name "$config" name
-	[ -n "$port_name" ] || return 0
-
-	for opt in bpduguard; do
-		config_get $opt "$config" $opt
-		eval optval=\$$opt
-		[ -z "$optval" ] || "$MSTPCTL" "set$opt" "$name" "$port_name" "$optval"
-	done
-}
-
-config_bridge_mstpd() {
-	local config="$1"
-	local optval=
-	local name=
-	local enable=
-	local mstid=0 #  for the moment, using only MSTID
-
-	config_get index "$config" index
-	[ -n "$index" ] || return 1
-
-	# Get bridge name
-	config_get name "$config" name
-	[ -n "$name" ] || return 0
-
-	config_get enable "$config" enable
-	if [ "$enable" != "1" ] ; then
-		return 0
-	fi
-
-	list_contains MSTPD_PREINSTALLED_BRIDGES "$name" || \
-		"$MSTPCTL" addbridge "$name"
-	# All options here have 'set$opt' equivalent calls in mstpd,
-	#  hence this trick with the loop
-	for opt in maxage fdelay maxhops hello ageing forcevers txholdcount; do
-		config_get $opt "$config" "$opt"
-		eval optval=\$$opt
-		[ -z "$optval" ] || "$MSTPCTL" set$opt "$name" "$optval"
-	done
-	config_get treeprio "$config" treeprio
-	[ -z "$treeprio" ] || $MSTPCTL settreeprio "$name" "$mstid" "$treeprio"
-	config_foreach config_bridge_port_mstpd bridge_port "$index" "$name"
-	CONFIGURED_BRIDGES="$CONFIGURED_BRIDGES $name"
-	export CONFIGURED_BRIDGES
-}
-
-start_service() {
-	procd_open_instance
-	procd_set_param command $MSTPD
-	procd_append_param command -v 2
-	procd_append_param command -d # don't daemonize, procd will handle that for us
-	procd_append_param command -s # print to syslog
-
-	# set auto respawn behavior
-	procd_set_param respawn
-
-	# reload config on respawn
-	procd_open_trigger
-	procd_add_raw_trigger "instance.start" 2000 "/etc/init.d/mstpd" "reload"
-	procd_close_trigger
-
-	procd_close_instance
-}
-
-service_running() {
-	pgrep mstpd >/dev/null 2>&1
-}
-
-reload_service() {
-	if ! running ; then
-		start
-		return
-	fi
-
-	unset CONFIGURED_BRIDGES
-	MSTPD_PREINSTALLED_BRIDGES="$(mstpd_get_bridges)"
-	export MSTPD_PREINSTALLED_BRIDGES
-
-	config_load 'mstpd'
-	config_foreach config_bridge_mstpd bridge
-
-	for bridge in $(mstpd_get_bridges) ; do
-		list_contains CONFIGURED_BRIDGES "$bridge" || \
-			$MSTPCTL delbridge "$bridge"
-	done
-	# return 0 (success) here, otherwise, and endless restart loop will occur from procd
-	# because the last return code may be mstpctl failing
-	return 0
-}
-
--- a/net/mstpd/files/sbin/bridge-stp
+++ b/net/mstpd/files/sbin/bridge-stp
@ -1,9 +0,0 @@
-#!/bin/sh
-
-# Dummy file ; don't do anything ;
-# Returning success here, tells the kernel to allow
-# a userspace module to handle STP states
-#
-# Meanwhile, procd will start mstpd, and all will be well
-
-exit 0
--- a/net/mstpd/patches/010-bsd.patch
+++ b/net/mstpd/patches/010-bsd.patch
@ -1,17 +0,0 @@
--- a/hmac_md5.c
-+++ b/hmac_md5.c
-@@ -356,10 +356,10 @@ caddr_t         digest;     /* caller di
-      */
- 
-     /* start out by storing key in pads */
-    bzero(k_ipad, sizeof k_ipad);
-    bzero(k_opad, sizeof k_opad);
-    bcopy(key, k_ipad, key_len);
-    bcopy( key, k_opad, key_len);
-+    memset(k_ipad, 0, sizeof k_ipad);
-+    memset(k_opad, 0, sizeof k_opad);
-+    memcpy(k_ipad, key, key_len);
-+    memcpy(k_opad, key, key_len);
- 
-     /* XOR key with ipad and opad values */
-     for(i = 0; i < 64; ++i)
--- a/net/nfs-kernel-server/Makefile
+++ b/net/nfs-kernel-server/Makefile
@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=nfs-kernel-server
 PKG_VERSION:=2.6.2
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 PKG_HASH:=26d46448982252e9e2c8346d10cf13e1143e7089c866f53e25db3359f3e9493c

 PKG_SOURCE_URL:=@SF/nfs
@ -32,7 +32,7 @@ define Package/nfs-kernel-server/Default
 	SECTION:=net
 	CATEGORY:=Network
 	SUBMENU:=Filesystem
-	DEPENDS:=+libwrap +libblkid +libuuid +libtirpc
+	DEPENDS:=+libblkid +libuuid +libtirpc
 	URL:=http://nfs.sourceforge.net/
 	MAINTAINER:=Peter Wagner <tripolar@gmx.at>
 endef
--- a/net/nginx/Makefile
+++ b/net/nginx/Makefile
@ -25,6 +25,22 @@ PKG_BUILD_PARALLEL:=1
 PKG_INSTALL:=1
 PKG_BUILD_FLAGS:=gc-sections

+# 3rd-party modules
+PKG_MOD_EXTRA := \
+	lua \
+	rtmp \
+	dav-ext \
+	naxsi \
+	brotli \
+	headers-more \
+	ts \
+	ubus
+# official and 3rd-party modules
+PKG_MOD_ALL := \
+	$(PKG_MOD_EXTRA) \
+	stream
+PKG_MOD_PATCHED := $(shell find patches -mindepth 1 -maxdepth 1 -type d -name 'nginx-mod-*' | sed -E 's,^patches/nginx-mod-,,')
+
 PKG_CONFIG_DEPENDS := \
 	CONFIG_NGINX_DAV \
 	CONFIG_NGINX_FLV \
@ -63,7 +79,8 @@ PKG_CONFIG_DEPENDS := \
 	CONFIG_NGINX_HTTP_REAL_IP \
 	CONFIG_NGINX_HTTP_SECURE_LINK \
 	CONFIG_OPENSSL_ENGINE \
-	CONFIG_OPENSSL_WITH_NPN
+	CONFIG_OPENSSL_WITH_NPN \
+	$(foreach m,$(PKG_MOD_EXTRA),CONFIG_PACKAGE_$(m))

 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/nls.mk
@ -84,6 +101,10 @@ define Package/nginx/description
 written by Igor Sysoev.
 endef

+define Package/nginx/conffiles
+/etc/nginx/
+endef
+
 define Package/nginx-ssl
  $(Package/nginx/default)
  TITLE += with SSL support
@ -99,330 +120,20 @@ Package/nginx-ssl/description = $(Package/nginx/description) \
  This variant is compiled with SSL support enabled. To enable additional module \
  select them in the nginx default configuration menu.

-define Package/nginx-full
-  $(Package/nginx/default)
-  TITLE += with ALL module selected
-  DEPENDS+=+libpcre +nginx-ssl-util +zlib +libxml2 \
-  +nginx-mod-ubus +nginx-mod-naxsi +nginx-mod-lua \
-  +nginx-mod-dav-ext +nginx-mod-stream +nginx-mod-headers-more \
-  +nginx-mod-brotli +nginx-mod-rtmp +nginx-mod-ts
-  EXTRA_DEPENDS:=nginx-ssl-util (>=1.5-1) (<2)
-  VARIANT:=all-module
-  PROVIDES += nginx-ssl
-endef
-
-Package/nginx-full/description = $(Package/nginx/description) \
-  This variant is compiled with ALL module selected.
-
 define Package/nginx-ssl/config
  source "$(SOURCE)/Config_ssl.in"
 endef

-config_files=mime.types
-
-define Package/nginx/conffiles
-/etc/nginx/
-endef
-
 Package/nginx-ssl/conffiles = $(Package/nginx/conffiles)
-Package/nginx-full/conffiles = $(Package/nginx/conffiles)

-ADDITIONAL_MODULES:= --with-http_ssl_module
+IsEnabled = $(or $(filter full,$(BUILD_VARIANT)),$(CONFIG_$(1)))
+IsDisabled = $(if $(call IsEnabled,$(1)),,1)

-ifneq ($(BUILD_VARIANT),all-module)
-  ifneq ($(CONFIG_NGINX_HTTP_CACHE),y)
-    ADDITIONAL_MODULES += --without-http-cache
-  endif
-  ifneq ($(CONFIG_NGINX_PCRE),y)
-    ADDITIONAL_MODULES += --without-pcre
-  endif
-  ifneq ($(CONFIG_NGINX_HTTP_CHARSET),y)
-    ADDITIONAL_MODULES += --without-http_charset_module
-  else
-    config_files += koi-utf koi-win win-utf
-  endif
-  ifneq ($(CONFIG_NGINX_HTTP_GZIP),y)
-    ADDITIONAL_MODULES += --without-http_gzip_module
-  endif
-  ifeq ($(CONFIG_NGINX_HTTP_GZIP_STATIC),y)
-    ADDITIONAL_MODULES += --with-http_gzip_static_module
-  endif
-  ifneq ($(CONFIG_NGINX_HTTP_SSI),y)
-    ADDITIONAL_MODULES += --without-http_ssi_module
-  endif
-  ifneq ($(CONFIG_NGINX_HTTP_USERID),y)
-    ADDITIONAL_MODULES += --without-http_userid_module
-  endif
-  ifneq ($(CONFIG_NGINX_HTTP_ACCESS),y)
-    ADDITIONAL_MODULES += --without-http_access_module
-  endif
-  ifneq ($(CONFIG_NGINX_HTTP_AUTH_BASIC),y)
-    ADDITIONAL_MODULES += --without-http_auth_basic_module
-  endif
-  ifneq ($(CONFIG_NGINX_HTTP_AUTOINDEX),y)
-    ADDITIONAL_MODULES += --without-http_autoindex_module
-  endif
-  ifneq ($(CONFIG_NGINX_HTTP_GEO),y)
-    ADDITIONAL_MODULES += --without-http_geo_module
-  endif
-  ifneq ($(CONFIG_NGINX_HTTP_MAP),y)
-    ADDITIONAL_MODULES += --without-http_map_module
-  endif
-  ifneq ($(CONFIG_NGINX_HTTP_SPLIT_CLIENTS),y)
-    ADDITIONAL_MODULES += --without-http_split_clients_module
-  endif
-  ifneq ($(CONFIG_NGINX_HTTP_REFERER),y)
-    ADDITIONAL_MODULES += --without-http_referer_module
-  endif
-  ifneq ($(CONFIG_NGINX_HTTP_REWRITE),y)
-    ADDITIONAL_MODULES += --without-http_rewrite_module
-  endif
-  ifneq ($(CONFIG_NGINX_HTTP_PROXY),y)
-    ADDITIONAL_MODULES += --without-http_proxy_module
-  endif
-  ifneq ($(CONFIG_NGINX_HTTP_FASTCGI),y)
-    ADDITIONAL_MODULES += --without-http_fastcgi_module
-  else
-    config_files += fastcgi_params
-  endif
-  ifneq ($(CONFIG_NGINX_HTTP_UWSGI),y)
-    ADDITIONAL_MODULES += --without-http_uwsgi_module
-  else
-    config_files += uwsgi_params
-  endif
-  ifneq ($(CONFIG_NGINX_HTTP_SCGI),y)
-    ADDITIONAL_MODULES += --without-http_scgi_module
-  else
-    config_files += scgi_params
-  endif
-  ifneq ($(CONFIG_NGINX_HTTP_MEMCACHED),y)
-    ADDITIONAL_MODULES += --without-http_memcached_module
-  endif
-  ifneq ($(CONFIG_NGINX_HTTP_LIMIT_CONN),y)
-    ADDITIONAL_MODULES += --without-http_limit_conn_module
-  endif
-  ifneq ($(CONFIG_NGINX_HTTP_LIMIT_REQ),y)
-    ADDITIONAL_MODULES += --without-http_limit_req_module
-  endif
-  ifneq ($(CONFIG_NGINX_HTTP_EMPTY_GIF),y)
-    ADDITIONAL_MODULES += --without-http_empty_gif_module
-  endif
-  ifneq ($(CONFIG_NGINX_HTTP_BROWSER),y)
-    ADDITIONAL_MODULES += --without-http_browser_module
-  endif
-  ifneq ($(CONFIG_NGINX_HTTP_UPSTREAM_HASH),y)
-    ADDITIONAL_MODULES += --without-http_upstream_hash_module
-  endif
-  ifneq ($(CONFIG_NGINX_HTTP_UPSTREAM_IP_HASH),y)
-    ADDITIONAL_MODULES += --without-http_upstream_ip_hash_module
-  endif
-  ifneq ($(CONFIG_NGINX_HTTP_UPSTREAM_LEAST_CONN),y)
-    ADDITIONAL_MODULES += --without-http_upstream_least_conn_module
-  endif
-  ifneq ($(CONFIG_NGINX_HTTP_UPSTREAM_KEEPALIVE),y)
-    ADDITIONAL_MODULES += --without-http_upstream_keepalive_module
-  endif
-  ifeq ($(CONFIG_IPV6),y)
-    ADDITIONAL_MODULES += --with-ipv6
-  endif
-  ifeq ($(CONFIG_NGINX_STUB_STATUS),y)
-    ADDITIONAL_MODULES += --with-http_stub_status_module
-  endif
-  ifeq ($(CONFIG_NGINX_FLV),y)
-    ADDITIONAL_MODULES += --with-http_flv_module
-  endif
-  ifeq ($(CONFIG_NGINX_DAV),y)
-    ADDITIONAL_MODULES += --with-http_dav_module
-  endif
-  ifeq ($(CONFIG_NGINX_HTTP_AUTH_REQUEST),y)
-    ADDITIONAL_MODULES += --with-http_auth_request_module
-  endif
-  ifeq ($(CONFIG_NGINX_HTTP_V2),y)
-    ADDITIONAL_MODULES += --with-http_v2_module
-  endif
-  ifeq ($(CONFIG_NGINX_HTTP_REAL_IP),y)
-    ADDITIONAL_MODULES += --with-http_realip_module
-  endif
-  ifeq ($(CONFIG_NGINX_HTTP_SECURE_LINK),y)
-    ADDITIONAL_MODULES += --with-http_secure_link_module
-  endif
-  ifeq ($(CONFIG_NGINX_HTTP_SUB),y)
-	ADDITIONAL_MODULES += --with-http_sub_module
-  endif
-else
-  ADDITIONAL_MODULES += --with-ipv6 --with-http_stub_status_module --with-http_flv_module \
-	--with-http_dav_module \
-	--with-http_auth_request_module --with-http_v2_module --with-http_realip_module \
-	--with-http_secure_link_module --with-http_sub_module \
-  config_files += koi-utf koi-win win-utf fastcgi_params uwsgi_params
-endif
-
-ifneq ($(CONFIG_PACKAGE_nginx-mod-naxsi),)
-  ADDITIONAL_MODULES += --add-dynamic-module=$(PKG_BUILD_DIR)/nginx-naxsi/naxsi_src
-endif
-ifneq ($(CONFIG_PACKAGE_nginx-mod-lua),)
-  ADDITIONAL_MODULES += --add-dynamic-module=$(PKG_BUILD_DIR)/lua-nginx
-endif
-ifneq ($(CONFIG_PACKAGE_nginx-mod-dav-ext),)
-  ADDITIONAL_MODULES += --add-dynamic-module=$(PKG_BUILD_DIR)/nginx-dav-ext-module
-endif
-ifneq ($(CONFIG_PACKAGE_nginx-mod-stream),)
-  ADDITIONAL_MODULES += --with-stream=dynamic --with-stream_ssl_module --with-stream_ssl_preread_module
-endif
-ifneq ($(CONFIG_PACKAGE_nginx-mod-ubus),)
-  ADDITIONAL_MODULES += --add-dynamic-module=$(PKG_BUILD_DIR)/nginx-ubus-module
-endif
-ifneq ($(CONFIG_PACKAGE_nginx-mod-headers-more),)
-  ADDITIONAL_MODULES += --add-dynamic-module=$(PKG_BUILD_DIR)/nginx-headers-more
-endif
-ifneq ($(CONFIG_PACKAGE_nginx-mod-brotli),)
-  ADDITIONAL_MODULES += --add-dynamic-module=$(PKG_BUILD_DIR)/nginx-brotli
-endif
-ifneq ($(CONFIG_PACKAGE_nginx-mod-rtmp),)
-  ADDITIONAL_MODULES += --add-dynamic-module=$(PKG_BUILD_DIR)/nginx-rtmp
-endif
-ifneq ($(CONFIG_PACKAGE_nginx-mod-ts),)
-  ADDITIONAL_MODULES += --add-dynamic-module=$(PKG_BUILD_DIR)/nginx-ts
-endif
-ifeq ($(CONFIG_NGINX_GEOIP_MODULE),y)
-  ADDITIONAL_MODULES += --with-http_geoip_module=dynamic
-endif
-
-define Package/nginx-mod-luci
-  TITLE:=Nginx on LuCI
-  SECTION:=net
-  CATEGORY:=Network
-  SUBMENU:=Web Servers/Proxies
-  TITLE:=Support file for Nginx
-  URL:=http://nginx.org/
-  DEPENDS:=+uwsgi +uwsgi-luci-support +nginx +nginx-mod-ubus
-  # TODO: add PROVIDES when removing nginx-mod-luci-ssl
-  # PROVIDES:=nginx-mod-luci-ssl
-endef
-
-define Package/nginx-mod-luci/description
- Support file for LuCI in nginx. Include custom nginx configuration, autostart script for uwsgi.
-endef
-
-NGINX_MODULES :=
-
-# $(1) module name
-# $(2) module additional dependency
-# $(3) module so name (stripped of the finaly _module.so)
-# $(4) module description
-define module
-  define Package/nginx-mod-$(strip $(1))
-	$(call Package/nginx/default)
-	DEPENDS:=+nginx-ssl $(2)
-	TITLE:=Nginx $(1) module
-  endef
-
-  define Package/nginx-mod-$(strip $(1))/description
-   $(4)
-  endef
-
-  define Package/nginx-mod-$(strip $(1))/install
-	$(INSTALL_DIR) $$(1)/usr/lib/nginx/modules
-	$(INSTALL_BIN) $$(PKG_INSTALL_DIR)/usr/lib/nginx/modules/$(3)_module.so $$(1)/usr/lib/nginx/modules
-  endef
-
-  NGINX_MODULES += nginx-mod-$(strip $(1))
-endef
-
-define brotli
-  define Package/nginx-mod-brotli
-	$(call Package/nginx/default)
-	DEPENDS:=+nginx-ssl
-	TITLE:=Nginx Brotli module
-  endef
-
-  define Package/nginx-mod-brotli/description
-   Add support for brotli compression module.
-  endef
-
-  define Package/nginx-mod-brotli/install
-	$(INSTALL_DIR) $$(1)/usr/lib/nginx/modules
-	$(INSTALL_BIN) $$(PKG_INSTALL_DIR)/usr/lib/nginx/modules/ngx_http_brotli_filter_module.so $$(1)/usr/lib/nginx/modules
-	$(INSTALL_BIN) $$(PKG_INSTALL_DIR)/usr/lib/nginx/modules/ngx_http_brotli_static_module.so $$(1)/usr/lib/nginx/modules
-  endef
-
-  NGINX_MODULES += nginx-mod-brotli
-endef
-
-define naxsi
-  define Package/nginx-mod-naxsi
-	$(call Package/nginx/default)
-	DEPENDS:=+nginx-ssl
-	TITLE:=Nginx naxsi module
-  endef
-
-  define Package/nginx-mod-naxsi/description
-   Enable NAXSI module.
-  endef
-
-  define Package/nginx-mod-naxsi/install
-	$(INSTALL_DIR) $$(1)/usr/lib/nginx/modules
-	$(INSTALL_BIN) $$(PKG_INSTALL_DIR)/usr/lib/nginx/modules/ngx_http_naxsi_module.so $$(1)/usr/lib/nginx/modules
-
-	$(INSTALL_DIR) $$(1)/etc/nginx
-	$(INSTALL_BIN) $$(PKG_BUILD_DIR)/nginx-naxsi/naxsi_config/naxsi_core.rules $$(1)/etc/nginx
-	chmod 0640 $$(1)/etc/nginx/naxsi_core.rules
-
-	$(INSTALL_BIN) $$(PKG_BUILD_DIR)/nginx-naxsi/naxsi_config/naxsi_core.rules $$(1)/etc/nginx
-	chmod 0640 $$(1)/etc/nginx/naxsi_core.rules
-  endef
-
-  NGINX_MODULES += nginx-mod-naxsi
-endef
-
-$(eval $(call module,lua, +luajit,ngx_http_lua, Enable Lua module))
-$(eval $(call module,stream, +@NGINX_STREAM_CORE_MODULE,ngx_stream, Add support for NGINX request streaming.))
-$(eval $(call module,ubus, +libubus +libjson-c +libblobmsg-json +@NGINX_UBUS,ngx_http_ubus, Enable UBUS api support directly from the server.))
-$(eval $(call module,dav-ext, +@NGINX_DAV +libxml2,ngx_http_dav_ext, Enable the WebDAV methods PROPFIND OPTIONS LOCK UNLOCK.))
-$(eval $(call module,headers-more,,ngx_http_headers_more_filter, Set and clear input and output headers...more than "add"!))
-$(eval $(call module,rtmp,,ngx_rtmp, Add support for NGINX-based Media Streaming Server module. \
-		DASH enhanced - https://github.com/ut0mt8/nginx-rtmp-module))
-$(eval $(call module, ts,,ngx_http_ts, Add support for MPEG-TS Live Module module.))
-$(eval $(call brotli))
-$(eval $(call naxsi))
-
-PKG_CONFIG_DEPENDS += $(patsubst %,CONFIG_PACKAGE_%,$(NGINX_MODULES))
-
-TARGET_CFLAGS += -DNGX_LUA_NO_BY_LUA_BLOCK
-
-ifneq ($(CONFIG_PACKAGE_nginx-mod-lua),)
-  CONFIGURE_VARS += LUAJIT_INC=$(STAGING_DIR)/usr/include/luajit-* \
-					LUAJIT_LIB=$(STAGING_DIR)/usr/lib
-endif
-
-CONFIGURE_VARS += CONFIG_BIG_ENDIAN=$(CONFIG_BIG_ENDIAN)
-
-CONFIGURE_ARGS += \
-			--crossbuild=Linux::$(ARCH) \
-			--prefix=/usr \
-			--conf-path=/etc/nginx/nginx.conf \
-			--modules-path=/usr/lib/nginx/modules \
-			--with-compat \
-			$(ADDITIONAL_MODULES) \
-			--error-log-path=stderr \
-			--pid-path=/var/run/nginx.pid \
-			--lock-path=/var/lock/nginx.lock \
-			--http-log-path=/var/log/nginx/access.log \
-			--http-client-body-temp-path=/var/lib/nginx/body \
-			--http-proxy-temp-path=/var/lib/nginx/proxy \
-			--http-fastcgi-temp-path=/var/lib/nginx/fastcgi \
-			--with-cc="$(TARGET_CC)" \
-			--with-cc-opt="$(TARGET_CPPFLAGS) $(TARGET_CFLAGS)" \
-			--with-ld-opt="$(TARGET_LDFLAGS)" \
-			--without-http_upstream_zone_module \
-			--without-pcre2
-
-define Package/nginx-mod-luci/install
-	$(INSTALL_DIR) $(1)/etc/nginx/conf.d
-	$(INSTALL_CONF) ./files-luci-support/luci.locations $(1)/etc/nginx/conf.d/
-	$(INSTALL_DIR) $(1)/etc/uci-defaults
-	$(INSTALL_BIN) ./files-luci-support/60_nginx-luci-support $(1)/etc/uci-defaults/60_nginx-luci-support
-endef
+config_files := mime.types \
+	$(if $(call IsEnabled,NGINX_HTTP_CHARSET),koi-utf koi-win win-utf) \
+	$(if $(call IsEnabled,NGINX_HTTP_FASTCGI),fastcgi_params) \
+	$(if $(call IsEnabled,NGINX_HTTP_UWSGI),uwsgi_params) \
+	$(if $(call IsEnabled,NGINX_HTTP_SCGI),scgi_params)

 define Package/nginx-ssl/install
 	$(INSTALL_DIR) $(1)/usr/sbin
@ -433,8 +144,6 @@ define Package/nginx-ssl/install
 	$(INSTALL_BIN) ./files/nginx.init $(1)/etc/init.d/nginx
 endef

-Package/nginx-full/install = $(Package/nginx-ssl/install)
-
 define Package/nginx-ssl/prerm
 #!/bin/sh
 [ -z "$${IPKG_INSTROOT}" ] || exit 0
@ -446,140 +155,140 @@ rm -f "$$(uci get "nginx.$${LAN_NAME}.ssl_certificate_key")"
 exit 0
 endef

+define Package/nginx-full
+  $(Package/nginx/default)
+  TITLE += with ALL module selected
+  DEPENDS+=+libpcre +nginx-ssl-util +zlib +libxml2 \
+    $(foreach m,$(PKG_MOD_ALL),+nginx-mod-$(m))
+  EXTRA_DEPENDS:=nginx-ssl-util (>=1.5-1) (<2)
+  VARIANT:=full
+  PROVIDES += nginx-ssl
+endef
+
+Package/nginx-full/description = $(Package/nginx/description) \
+  This variant is compiled with ALL module selected.
+
+Package/nginx-full/install = $(Package/nginx-ssl/install)
+
 Package/nginx-full/prerm = $(Package/nginx-ssl/prerm)

-define Download/nginx-headers-more
+Package/nginx-full/conffiles = $(Package/nginx/conffiles)
+
+define Package/nginx-mod-luci
+  TITLE:=Nginx on LuCI
+  SECTION:=net
+  CATEGORY:=Network
+  SUBMENU:=Web Servers/Proxies
+  TITLE:=Support file for Nginx
+  URL:=http://nginx.org/
+  DEPENDS:=+uwsgi +uwsgi-luci-support +nginx-ssl +nginx-mod-ubus
+  # TODO: add PROVIDES when removing nginx-mod-luci-ssl
+  # PROVIDES:=nginx-mod-luci-ssl
+endef
+
+define Package/nginx-mod-luci/description
+ Support file for LuCI in nginx. Include custom nginx configuration, autostart script for uwsgi.
+endef
+
+define Package/nginx-mod-luci/install
+	$(INSTALL_DIR) $(1)/etc/nginx/conf.d
+	$(INSTALL_CONF) ./files-luci-support/luci.locations $(1)/etc/nginx/conf.d/
+	$(INSTALL_DIR) $(1)/etc/uci-defaults
+	$(INSTALL_BIN) ./files-luci-support/60_nginx-luci-support $(1)/etc/uci-defaults/60_nginx-luci-support
+endef
+
+define Download/nginx-mod-headers-more
  VERSION:=bea1be3bbf6af28f6aa8cf0c01c07ee1637e2bd0
-  SUBDIR:=nginx-headers-more
-  FILE:=headers-more-nginx-module-$$(VERSION).tar.xz
  URL:=https://github.com/openresty/headers-more-nginx-module.git
  MIRROR_HASH:=3617bbf7a935208a1d8d5f86a8f9b770f6987e4d2b5663a9ab1b777217e3066b
  PROTO:=git
 endef

-define Prepare/nginx-headers-more
-	$(eval $(Download/nginx-headers-more))
-	xzcat $(DL_DIR)/$(FILE) | tar -C $(PKG_BUILD_DIR) $(TAR_OPTIONS)
-endef

-define Download/nginx-brotli
+define Download/nginx-mod-brotli
  VERSION:=e505dce68acc190cc5a1e780a3b0275e39f160ca
-  SUBDIR:=nginx-brotli
-  FILE:=ngx-brotli-module-$$(VERSION).tar.xz
  URL:=https://github.com/google/ngx_brotli.git
  MIRROR_HASH:=04847f11ef808fed50f44b2af0ef3abf59ff0ffc06dfc7394d9ab51d53fef31f
  PROTO:=git
 endef

-define Prepare/nginx-brotli
-	$(eval $(Download/nginx-brotli))
-	xzcat $(DL_DIR)/$(FILE) | tar -C $(PKG_BUILD_DIR) $(TAR_OPTIONS)
-endef
-
-define Download/nginx-rtmp
+define Download/nginx-mod-rtmp
  VERSION:=f0ea62342a4eca504b311cd5df910d026c3ea4cf
-  SUBDIR:=nginx-rtmp
-  FILE:=ngx-rtmp-module-$$(VERSION).tar.xz
  URL:=https://github.com/ut0mt8/nginx-rtmp-module.git
  MIRROR_HASH:=d3f58066f0f858ed79f7f2b0c9b89de2ccc512c94ab3d0625f6dcff3df0b72c1
  PROTO:=git
 endef

-define Prepare/nginx-rtmp
-	$(eval $(Download/nginx-rtmp))
-	xzcat $(DL_DIR)/$(FILE) | tar -C $(PKG_BUILD_DIR) $(TAR_OPTIONS)
-endef
-
-define Download/nginx-ts
+define Download/nginx-mod-ts
  VERSION:=ef2f874d95cc75747eb625a292524a702aefb0fd
-  SUBDIR:=nginx-ts
-  FILE:=ngx-ts-module-$$(VERSION).tar.xz
  URL:=https://github.com/arut/nginx-ts-module.git
  MIRROR_HASH:=73938950bb286d40d9e54b0994d1a63827340c1156c72eb04d7041b25b20ec18
  PROTO:=git
 endef

-define Prepare/nginx-ts
-	$(eval $(Download/nginx-ts))
-	xzcat $(DL_DIR)/$(FILE) | tar -C $(PKG_BUILD_DIR) $(TAR_OPTIONS)
-endef
-
-define Download/nginx-naxsi
+define Download/nginx-mod-naxsi
  VERSION:=951123ad456bdf5ac94e8d8819342fe3d49bc002
-  SUBDIR:=nginx-naxsi
-  FILE:=nginx-naxsi-module-$$(VERSION).tar.xz
  URL:=https://github.com/nbs-system/naxsi.git
  MIRROR_HASH:=c734cae19a596affadd62a2df1b58d3df8d1364093a4e80a7cd1ab4555963535
  PROTO:=git
 endef

-define Prepare/nginx-naxsi
-	$(eval $(Download/nginx-naxsi))
-	xzcat $(DL_DIR)/$(FILE) | tar -C $(PKG_BUILD_DIR) $(TAR_OPTIONS)
-endef
-
-define Download/lua-nginx
+define Download/nginx-mod-lua
  VERSION:=68acad14e4a8f42e31d4a4bb5ed44d6f5b55fc1c
-  SUBDIR:=lua-nginx
-  FILE:=lua-nginx-module-$$(VERSION).tar.xz
  URL:=https://github.com/openresty/lua-nginx-module.git
  MIRROR_HASH:=366f24e1ba6221e34f6ba20ab29146438438f88c89fd71f9500d169b3f5aedf0
  PROTO:=git
 endef

-define Prepare/lua-nginx
-	$(eval $(Download/lua-nginx))
-	xzcat $(DL_DIR)/$(FILE) | tar -C $(PKG_BUILD_DIR) $(TAR_OPTIONS)
-endef
-
-define Download/nginx-dav-ext-module
+define Download/nginx-mod-dav-ext
  VERSION:=f5e30888a256136d9c550bf1ada77d6ea78a48af
-  SUBDIR:=nginx-dav-ext-module
-  FILE:=nginx-dav-ext-module-$$(VERSION).tar.xz
  URL:=https://github.com/arut/nginx-dav-ext-module.git
  MIRROR_HASH:=70bb4c3907f4b783605500ba494e907aede11f8505702e370012abb3c177dc5b
  PROTO:=git
 endef

-define Prepare/nginx-dav-ext-module
-	$(eval $(Download/nginx-dav-ext-module))
-	xzcat $(DL_DIR)/$(FILE) | tar -C $(PKG_BUILD_DIR) $(TAR_OPTIONS)
-endef
-
-define Download/nginx-ubus-module
+define Download/nginx-mod-ubus
  VERSION:=b2d7260dcb428b2fb65540edb28d7538602b4a26
-  SUBDIR:=nginx-ubus-module
-  FILE:=nginx-ubus-module-$$(VERSION).tar.xz
  URL:=https://github.com/Ansuel/nginx-ubus-module.git
  MIRROR_HASH:=472cef416d25effcac66c85417ab6596e634a7a64d45b709bb090892d567553c
  PROTO:=git
 endef

-define Prepare/nginx-ubus-module
-	$(eval $(Download/nginx-ubus-module))
-	xzcat $(DL_DIR)/$(FILE) | tar -C $(PKG_BUILD_DIR) $(TAR_OPTIONS)
+define Module/Download
+  define Download/nginx-mod-$(1) +=
+
+    SUBDIR:=nginx-mod-$(1)
+    FILE:=nginx-mod-$(1)-$$$$(VERSION).tar.xz
+  endef
+endef
+$(foreach m,$(PKG_MOD_EXTRA),$(eval $(call Module/Download,$(m))))
+
+define Module/nginx-mod-naxsi/install
+	$(INSTALL_DIR) $(1)/etc/nginx
+	$(INSTALL_CONF) $(PKG_BUILD_DIR)/nginx-mod-naxsi/naxsi_config/naxsi_core.rules $(1)/etc/nginx
+endef
+
+define Quilt/Refresh/Package
+	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/nginx,nginx/)
+	$(foreach m,$(PKG_MOD_PATCHED),
+		$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/nginx-mod-$(m),nginx-mod-$(m)/)
+	)
 endef

 define Build/Patch
 	$(if $(QUILT),rm -rf $(PKG_BUILD_DIR)/patches; mkdir -p $(PKG_BUILD_DIR)/patches)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/nginx,nginx/)
-ifneq "$(or $(CONFIG_PACKAGE_nginx-mod-dav-ext),$(QUILT))" ""
-	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/dav-nginx,dav-nginx/)
-endif
-ifneq "$(or $(CONFIG_PACKAGE_nginx-mod-lua),$(QUILT))" ""
-	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/lua-nginx,lua-nginx/)
-endif
-ifneq "$(or $(CONFIG_PACKAGE_nginx-mod-rtmp),$(QUILT))" ""
-	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/rtmp-nginx,rtmp-nginx/)
-endif
+	$(foreach m,$(PKG_MOD_PATCHED),$(if $(or $(CONFIG_PACKAGE_nginx-mod-$(m)),$(QUILT)),
+		$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/nginx-mod-$(m),nginx-mod-$(m)/)
+	))
 	$(if $(QUILT),touch $(PKG_BUILD_DIR)/.quilt_used)
 endef

-define Quilt/Refresh/Package
-	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/nginx,nginx/)
-	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/dav-nginx,dav-nginx/)
-	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/lua-nginx,lua-nginx/)
-	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/rtmp-nginx,rtmp-nginx/)
+define Module/Build/Prepare
+	$(eval $(call Download,nginx-mod-$(1)))
+	$(eval $(Download/nginx-mod-$(1)))
+	mkdir -p $(PKG_BUILD_DIR)/nginx-mod-$(1)
+	xzcat $(DL_DIR)/$(FILE) | tar -C $(PKG_BUILD_DIR)/nginx-mod-$(1) $(TAR_OPTIONS) --strip-components 1
 endef

 define Build/Prepare
@ -587,54 +296,132 @@ define Build/Prepare
 	mkdir -p $(PKG_BUILD_DIR)
 	$(PKG_UNPACK)

-ifneq ($(CONFIG_PACKAGE_nginx-mod-naxsi),)
-  $(eval $(call Download,nginx-naxsi))
-  $(Prepare/nginx-naxsi)
-endif
-
-ifneq "$(or $(CONFIG_PACKAGE_nginx-mod-lua),$(QUILT))" ""
-  $(eval $(call Download,lua-nginx))
-  $(Prepare/lua-nginx)
-endif
-
-ifneq ($(CONFIG_PACKAGE_nginx-mod-brotli),)
-  $(eval $(call Download,nginx-brotli))
-  $(Prepare/nginx-brotli)
-endif
-
-ifneq ($(CONFIG_PACKAGE_nginx-mod-headers-more),)
-  $(eval $(call Download,nginx-headers-more))
-  $(Prepare/nginx-headers-more)
-endif
-
-ifneq "$(or $(CONFIG_PACKAGE_nginx-mod-rtmp),$(QUILT))" ""
-  $(eval $(call Download,nginx-rtmp))
-  $(Prepare/nginx-rtmp)
-endif
-
-ifneq ($(CONFIG_PACKAGE_nginx-mod-ts),)
-  $(eval $(call Download,nginx-ts))
-  $(Prepare/nginx-ts)
-endif
-
-ifneq "$(or $(CONFIG_PACKAGE_nginx-mod-dav-ext),$(QUILT))" ""
-  $(eval $(call Download,nginx-dav-ext-module))
-  $(Prepare/nginx-dav-ext-module)
-endif
-
-ifneq ($(CONFIG_PACKAGE_nginx-mod-ubus),)
-  $(eval $(call Download,nginx-ubus-module))
-  $(Prepare/nginx-ubus-module)
-endif
-
+	$(foreach m,$(filter-out $(PKG_MOD_PATCHED),$(PKG_MOD_EXTRA)),$(if $(CONFIG_PACKAGE_nginx-mod-$(m)),
+		$(call Module/Build/Prepare,$(m))
+	))
+	$(foreach m,$(PKG_MOD_PATCHED),$(if $(or $(CONFIG_PACKAGE_nginx-mod-$(m)),$(QUILT)),
+		$(call Module/Build/Prepare,$(m))
+	))
 	$(Build/Patch)
 endef

+# $(1) module name
+# $(2) module additional dependency
+# $(3) module so name (stripped of the finaly _module.so)
+# $(4) module description
+define BuildModule
+  define Package/nginx-mod-$(1)
+    $(call Package/nginx/default)
+    DEPENDS:=+nginx-ssl $(2)
+    TITLE:=Nginx $(1) module
+  endef
+
+  define Package/nginx-mod-$(1)/description
+    $(strip $(4))
+  endef
+
+  define Package/nginx-mod-$(1)/install
+	$(INSTALL_DIR) $$(1)/usr/lib/nginx/modules
+	$(foreach m,$(3),
+	  $(CP) $$(PKG_INSTALL_DIR)/usr/lib/nginx/modules/$(m)_module.so $$(1)/usr/lib/nginx/modules
+	)
+	$(call Module/nginx-mod-$(1)/install,$$(1))
+  endef
+
+  $$(eval $$(call BuildPackage,nginx-mod-$(1)))
+endef
+
+TARGET_CFLAGS += -DNGX_LUA_NO_BY_LUA_BLOCK
+
+ifneq ($(CONFIG_PACKAGE_nginx-mod-lua),)
+  CONFIGURE_VARS += LUAJIT_INC=$(STAGING_DIR)/usr/include/luajit-* \
+					LUAJIT_LIB=$(STAGING_DIR)/usr/lib
+endif
+
+CONFIGURE_VARS += CONFIG_BIG_ENDIAN=$(CONFIG_BIG_ENDIAN)
+
+CONFIGURE_ARGS += \
+	--crossbuild=Linux::$(ARCH) \
+	--prefix=/usr \
+	--conf-path=/etc/nginx/nginx.conf \
+	--modules-path=/usr/lib/nginx/modules \
+	--error-log-path=stderr \
+	--pid-path=/var/run/nginx.pid \
+	--lock-path=/var/lock/nginx.lock \
+	--http-log-path=/var/log/nginx/access.log \
+	--http-client-body-temp-path=/var/lib/nginx/body \
+	--http-proxy-temp-path=/var/lib/nginx/proxy \
+	--http-fastcgi-temp-path=/var/lib/nginx/fastcgi \
+	--with-cc="$(TARGET_CC)" \
+	--with-cc-opt="$(TARGET_CPPFLAGS) $(TARGET_CFLAGS)" \
+	--with-ld-opt="$(TARGET_LDFLAGS)" \
+	--without-http_upstream_zone_module \
+	--without-pcre2 \
+	--with-compat \
+	--with-http_ssl_module \
+	$(if $(call IsDisabled,NGINX_HTTP_CACHE),--without-http-cache) \
+	$(if $(call IsDisabled,NGINX_PCRE),--without-pcre) \
+	$(if $(call IsDisabled,NGINX_HTTP_CHARSET),--without-http_charset_module) \
+	$(if $(call IsDisabled,NGINX_HTTP_GZIP),--without-http_gzip_module) \
+	$(if $(call IsDisabled,NGINX_HTTP_SSI),--without-http_ssi_module) \
+	$(if $(call IsDisabled,NGINX_HTTP_USERID),--without-http_userid_module) \
+	$(if $(call IsDisabled,NGINX_HTTP_ACCESS),--without-http_access_module) \
+	$(if $(call IsDisabled,NGINX_HTTP_AUTH_BASIC),--without-http_auth_basic_module) \
+	$(if $(call IsDisabled,NGINX_HTTP_AUTOINDEX),--without-http_autoindex_module) \
+	$(if $(call IsDisabled,NGINX_HTTP_GEO),--without-http_geo_module) \
+	$(if $(call IsDisabled,NGINX_HTTP_MAP),--without-http_map_module) \
+	$(if $(call IsDisabled,NGINX_HTTP_SPLIT_CLIENTS),--without-http_split_clients_module) \
+	$(if $(call IsDisabled,NGINX_HTTP_REFERER),--without-http_referer_module) \
+	$(if $(call IsDisabled,NGINX_HTTP_REWRITE),--without-http_rewrite_module) \
+	$(if $(call IsDisabled,NGINX_HTTP_PROXY),--without-http_proxy_module) \
+	$(if $(call IsDisabled,NGINX_HTTP_FASTCGI),--without-http_fastcgi_module) \
+	$(if $(call IsDisabled,NGINX_HTTP_UWSGI),--without-http_uwsgi_module) \
+	$(if $(call IsDisabled,NGINX_HTTP_SCGI),--without-http_scgi_module) \
+	$(if $(call IsDisabled,NGINX_HTTP_MEMCACHED),--without-http_memcached_module) \
+	$(if $(call IsDisabled,NGINX_HTTP_LIMIT_CONN),--without-http_limit_conn_module) \
+	$(if $(call IsDisabled,NGINX_HTTP_LIMIT_REQ),--without-http_limit_req_module) \
+	$(if $(call IsDisabled,NGINX_HTTP_EMPTY_GIF),--without-http_empty_gif_module) \
+	$(if $(call IsDisabled,NGINX_HTTP_BROWSER),--without-http_browser_module) \
+	$(if $(call IsDisabled,NGINX_HTTP_UPSTREAM_HASH),--without-http_upstream_hash_module) \
+	$(if $(call IsDisabled,NGINX_HTTP_UPSTREAM_IP_HASH),--without-http_upstream_ip_hash_module) \
+	$(if $(call IsDisabled,NGINX_HTTP_UPSTREAM_LEAST_CONN),--without-http_upstream_least_conn_module) \
+	$(if $(call IsDisabled,NGINX_HTTP_UPSTREAM_KEEPALIVE),--without-http_upstream_keepalive_module) \
+	$(if $(call IsEnabled,IPV6),--with-ipv6) \
+	$(if $(call IsEnabled,NGINX_HTTP_GZIP_STATIC),--with-http_gzip_static_module) \
+	$(if $(call IsEnabled,NGINX_STUB_STATUS),--with-http_stub_status_module) \
+	$(if $(call IsEnabled,NGINX_FLV),--with-http_flv_module) \
+	$(if $(call IsEnabled,NGINX_DAV),--with-http_dav_module) \
+	$(if $(call IsEnabled,NGINX_HTTP_AUTH_REQUEST),--with-http_auth_request_module) \
+	$(if $(call IsEnabled,NGINX_HTTP_V2),--with-http_v2_module) \
+	$(if $(call IsEnabled,NGINX_HTTP_REAL_IP),--with-http_realip_module) \
+	$(if $(call IsEnabled,NGINX_HTTP_SECURE_LINK),--with-http_secure_link_module) \
+	$(if $(call IsEnabled,NGINX_HTTP_SUB),--with-http_sub_module) \
+	$(if $(CONFIG_PACKAGE_nginx-mod-stream),--with-stream=dynamic --with-stream_ssl_module --with-stream_ssl_preread_module) \
+	$(if $(CONFIG_PACKAGE_nginx-mod-naxsi),--add-dynamic-module=$(PKG_BUILD_DIR)/nginx-mod-naxsi/naxsi_src) \
+	$(foreach m,$(filter-out naxsi,$(PKG_MOD_EXTRA)), \
+		$(if $(CONFIG_PACKAGE_nginx-mod-$(m)),--add-dynamic-module=$(PKG_BUILD_DIR)/nginx-mod-$(m)))
+
 $(eval $(call BuildPackage,nginx-ssl))
 $(eval $(call BuildPackage,nginx-full))
 $(eval $(call BuildPackage,nginx-mod-luci))
-
-$(foreach m,$(NGINX_MODULES),$(eval $(call BuildPackage,$(m))))
+$(eval $(call BuildModule,stream,+@NGINX_STREAM_CORE_MODULE, \
+	ngx_stream, Add support for NGINX request streaming.))
+$(eval $(call BuildModule,lua,+luajit,ngx_http_lua, \
+	Enable Lua module))
+$(eval $(call BuildModule,ubus,+libubus +libjson-c +libblobmsg-json +@NGINX_UBUS, \
+	ngx_http_ubus,Enable UBUS api support directly from the server.))
+$(eval $(call BuildModule,dav-ext,+@NGINX_DAV +libxml2,ngx_http_dav_ext, \
+	Enable the WebDAV methods PROPFIND OPTIONS LOCK UNLOCK.))
+$(eval $(call BuildModule,headers-more,,ngx_http_headers_more_filter, \
+	Set and clear input and output headers...more than "add"!))
+$(eval $(call BuildModule,rtmp,,ngx_rtmp, \
+	Add support for NGINX-based Media Streaming Server module. DASH enhanced))
+$(eval $(call BuildModule,ts,,ngx_http_ts, \
+	Add support for MPEG-TS Live Module module.))
+$(eval $(call BuildModule,brotli,,ngx_http_brotli_filter ngx_http_brotli_static, \
+	Add support for brotli compression module.))
+$(eval $(call BuildModule,naxsi,,ngx_http_naxsi, \
+	Enable NAXSI module.))

 # TODO: remove after a transition period (together with pkg nginx-util):
 # It is for smoothly substituting nginx and nginx-mod-luci-ssl (by nginx-ssl
--- a/net/nginx/patches/nginx-mod-dav-ext/100-drop-libxslt-dep.patch
+++ b/net/nginx/patches/nginx-mod-dav-ext/100-drop-libxslt-dep.patch
@ -1,5 +1,5 @@
--- a/nginx-dav-ext-module/config
-+++ b/nginx-dav-ext-module/config
+--- a/nginx-mod-dav-ext/config
+++ b/nginx-mod-dav-ext/config
@@ -8,9 +8,8 @@ ngx_module_name=ngx_http_dav_ext_module
 # building nginx with the xslt module, in which case libxslt will
 # be linked anyway.  In other cases libxslt is just redundant.
--- a/net/nginx/patches/nginx-mod-lua/100-no_by_lua_block.patch
+++ b/net/nginx/patches/nginx-mod-lua/100-no_by_lua_block.patch
@ -1,5 +1,5 @@
--- a/lua-nginx/src/ngx_http_lua_module.c
-+++ b/lua-nginx/src/ngx_http_lua_module.c
+--- a/nginx-mod-lua/src/ngx_http_lua_module.c
+++ b/nginx-mod-lua/src/ngx_http_lua_module.c
@@ -207,12 +207,14 @@ static ngx_command_t ngx_http_lua_cmds[]
       offsetof(ngx_http_lua_loc_conf_t, log_socket_errors),
       NULL },
--- a/net/nginx/patches/nginx-mod-rtmp/100-bigedian.patch
+++ b/net/nginx/patches/nginx-mod-rtmp/100-bigedian.patch
@ -12,8 +12,8 @@ Subject: [PATCH 1/3] arut's e0e278bc7fedd6f7465648d1d20df1a8422d60bf [removed
 ngx_rtmp_handler.c    | 108 +++++++++++++++++++++---------------------
 5 files changed, 68 insertions(+), 64 deletions(-)

--- a/nginx-rtmp/ngx_rtmp.c
-+++ b/nginx-rtmp/ngx_rtmp.c
+--- a/nginx-mod-rtmp/ngx_rtmp.c
+++ b/nginx-mod-rtmp/ngx_rtmp.c
@@ -825,22 +825,6 @@ ngx_rtmp_fire_event(ngx_rtmp_session_t *
 }
 
@ -37,8 +37,8 @@ Subject: [PATCH 1/3] arut's e0e278bc7fedd6f7465648d1d20df1a8422d60bf [removed
 static ngx_int_t
 ngx_rtmp_init_process(ngx_cycle_t *cycle)
 {
--- a/nginx-rtmp/ngx_rtmp.h
-+++ b/nginx-rtmp/ngx_rtmp.h
+--- a/nginx-mod-rtmp/ngx_rtmp.h
+++ b/nginx-mod-rtmp/ngx_rtmp.h
@@ -417,34 +417,33 @@ ngx_int_t ngx_rtmp_fire_event(ngx_rtmp_s
 ngx_int_t ngx_rtmp_set_chunk_size(ngx_rtmp_session_t *s, ngx_uint_t size);
 
@ -92,8 +92,8 @@ Subject: [PATCH 1/3] arut's e0e278bc7fedd6f7465648d1d20df1a8422d60bf [removed
 
 /* Receiving messages */
 ngx_int_t ngx_rtmp_receive_message(ngx_rtmp_session_t *s,
--- a/nginx-rtmp/ngx_rtmp_amf.c
-+++ b/nginx-rtmp/ngx_rtmp_amf.c
+--- a/nginx-mod-rtmp/ngx_rtmp_amf.c
+++ b/nginx-mod-rtmp/ngx_rtmp_amf.c
@@ -10,23 +10,6 @@
 #include "ngx_rtmp.h"
 #include <string.h>
@ -244,8 +244,8 @@ Subject: [PATCH 1/3] arut's e0e278bc7fedd6f7465648d1d20df1a8422d60bf [removed
                 {
                     return NGX_ERROR;
                 }
--- a/nginx-rtmp/ngx_rtmp_flv_module.c
-+++ b/nginx-rtmp/ngx_rtmp_flv_module.c
+--- a/nginx-mod-rtmp/ngx_rtmp_flv_module.c
+++ b/nginx-mod-rtmp/ngx_rtmp_flv_module.c
@@ -102,7 +102,7 @@ ngx_rtmp_flv_fill_index(ngx_rtmp_amf_ctx
         return NGX_ERROR;
     }
@ -294,8 +294,8 @@ Subject: [PATCH 1/3] arut's e0e278bc7fedd6f7465648d1d20df1a8422d60bf [removed
 
     ctx->offset += (sizeof(ngx_rtmp_flv_header) + size + 4);
 
--- a/nginx-rtmp/ngx_rtmp_handler.c
-+++ b/nginx-rtmp/ngx_rtmp_handler.c
+--- a/nginx-mod-rtmp/ngx_rtmp_handler.c
+++ b/nginx-mod-rtmp/ngx_rtmp_handler.c
@@ -200,7 +200,7 @@ ngx_rtmp_recv(ngx_event_t *rev)
     ngx_rtmp_stream_t          *st, *st0;
     ngx_chain_t                *in, *head;
@ -470,8 +470,8 @@ Subject: [PATCH 1/3] arut's e0e278bc7fedd6f7465648d1d20df1a8422d60bf [removed
 
         /* This CONTRADICTS the standard
          * but that's the way flash client
--- a/nginx-rtmp/ngx_rtmp_send.c
-+++ b/nginx-rtmp/ngx_rtmp_send.c
+--- a/nginx-mod-rtmp/ngx_rtmp_send.c
+++ b/nginx-mod-rtmp/ngx_rtmp_send.c
@@ -33,13 +33,13 @@
     *(__b->last++) = (u_char)(utype);
 
@ -491,8 +491,8 @@ Subject: [PATCH 1/3] arut's e0e278bc7fedd6f7465648d1d20df1a8422d60bf [removed
 
 #define NGX_RTMP_USER_END(s)                                                \
     ngx_rtmp_prepare_message(s, &__h, NULL, __l);                           \
--- a/nginx-rtmp/hls/ngx_rtmp_hls_module.c
-+++ b/nginx-rtmp/hls/ngx_rtmp_hls_module.c
+--- a/nginx-mod-rtmp/hls/ngx_rtmp_hls_module.c
+++ b/nginx-mod-rtmp/hls/ngx_rtmp_hls_module.c
@@ -296,7 +296,7 @@ static ngx_command_t ngx_rtmp_hls_comman
       ngx_conf_set_enum_slot,
       NGX_RTMP_APP_CONF_OFFSET,
@ -534,8 +534,8 @@ Subject: [PATCH 1/3] arut's e0e278bc7fedd6f7465648d1d20df1a8422d60bf [removed
 
         if (len == 0) {
             continue;
--- a/nginx-rtmp/ngx_rtmp_bitop.h
-+++ b/nginx-rtmp/ngx_rtmp_bitop.h
+--- a/nginx-mod-rtmp/ngx_rtmp_bitop.h
+++ b/nginx-mod-rtmp/ngx_rtmp_bitop.h
@@ -40,7 +40,7 @@ uint64_t ngx_rtmp_bit_read_golomb(ngx_rt
     ((uint32_t) ngx_rtmp_bit_read(br, 32))
 
@ -545,8 +545,8 @@ Subject: [PATCH 1/3] arut's e0e278bc7fedd6f7465648d1d20df1a8422d60bf [removed
 
 
 #endif /* _NGX_RTMP_BITOP_H_INCLUDED_ */
--- a/nginx-rtmp/ngx_rtmp_eval.c
-+++ b/nginx-rtmp/ngx_rtmp_eval.c
+--- a/nginx-mod-rtmp/ngx_rtmp_eval.c
+++ b/nginx-mod-rtmp/ngx_rtmp_eval.c
@@ -166,7 +166,7 @@ ngx_rtmp_eval(void *ctx, ngx_str_t *in,
                         state = ESCAPE;
                         continue;
@ -556,8 +556,8 @@ Subject: [PATCH 1/3] arut's e0e278bc7fedd6f7465648d1d20df1a8422d60bf [removed
             case ESCAPE:
                 ngx_rtmp_eval_append(&b, &c, 1, log);
                 state = NORMAL;
--- a/nginx-rtmp/ngx_rtmp_handshake.c
-+++ b/nginx-rtmp/ngx_rtmp_handshake.c
+--- a/nginx-mod-rtmp/ngx_rtmp_handshake.c
+++ b/nginx-mod-rtmp/ngx_rtmp_handshake.c
@@ -264,7 +264,8 @@ ngx_rtmp_handshake_create_challenge(ngx_
     b = s->hs_buf;
     b->last = b->pos = b->start;
@ -578,8 +578,8 @@ Subject: [PATCH 1/3] arut's e0e278bc7fedd6f7465648d1d20df1a8422d60bf [removed
 
     p = b->pos + 4;
     ngx_log_debug5(NGX_LOG_DEBUG_RTMP, s->connection->log, 0,
--- a/nginx-rtmp/ngx_rtmp_mp4_module.c
-+++ b/nginx-rtmp/ngx_rtmp_mp4_module.c
+--- a/nginx-mod-rtmp/ngx_rtmp_mp4_module.c
+++ b/nginx-mod-rtmp/ngx_rtmp_mp4_module.c
@@ -528,9 +528,9 @@ ngx_rtmp_mp4_parse_mdhd(ngx_rtmp_session
             }
 
@ -1330,8 +1330,8 @@ Subject: [PATCH 1/3] arut's e0e278bc7fedd6f7465648d1d20df1a8422d60bf [removed
             shift += sizeof(extended_size);
 
         } else if (size == 0) {
--- a/nginx-rtmp/ngx_rtmp_receive.c
-+++ b/nginx-rtmp/ngx_rtmp_receive.c
+--- a/nginx-mod-rtmp/ngx_rtmp_receive.c
+++ b/nginx-mod-rtmp/ngx_rtmp_receive.c
@@ -17,7 +17,6 @@ ngx_rtmp_protocol_message_handler(ngx_rt
         ngx_rtmp_header_t *h, ngx_chain_t *in)
 {
@ -1424,8 +1424,8 @@ Subject: [PATCH 1/3] arut's e0e278bc7fedd6f7465648d1d20df1a8422d60bf [removed
     return NGX_OK;
 }
 
--- a/nginx-rtmp/ngx_rtmp_record_module.c
-+++ b/nginx-rtmp/ngx_rtmp_record_module.c
+--- a/nginx-mod-rtmp/ngx_rtmp_record_module.c
+++ b/nginx-mod-rtmp/ngx_rtmp_record_module.c
@@ -454,7 +454,7 @@ ngx_rtmp_record_node_open(ngx_rtmp_sessi
     ngx_err_t                   err;
     ngx_str_t                   path;
--- a/net/respondd/Makefile
+++ b/net/respondd/Makefile
@ -0,0 +1,64 @@
+#
+# Copyright (C) 2023 David Bauer <mail@david-bauer.net>
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=respondd
+PKG_SOURCE_DATE:=2019-05-01
+PKG_RELEASE:=1
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_URL:=https://github.com/freifunk-gluon/respondd.git
+PKG_SOURCE_VERSION:=58405297e76f97d4752dc7511dc15bbc7a01e586
+PKG_MIRROR_HASH:=22bc00df280fe611cfc895528f17269f03af804ea4c2ca2dc62da2457d3a1ee0
+
+PKG_MAINTAINER:=David Bauer <mail@david-bauer.net>
+PKG_LICENSE:=BSD-2-Clause
+
+CMAKE_SOURCE_SUBDIR:=src
+
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/cmake.mk
+
+define Package/respondd
+  SECTION:=net
+  CATEGORY:=Network
+  DEPENDS:=@IPV6 +libjson-c
+  TITLE:=Lightweight metadata multicast-responder
+endef
+
+define Package/respondd/description
+respondd is a server distributing information within a network.
+
+For doing so, respondd spawns a UDP socket (in Gluon 1001/udp),
+optionally joining a multicast group. When a request is received,
+the information requested is transmitted to the requester.
+
+All information is organized in a non-hierarchical namespace.
+Each entry identifies a request name (e.g. statistics, nodeinfo, ...)
+implemented by at least one "provider" C module. The respond is the
+result of merging the outputs of all providers for the given request
+name.
+endef
+
+define Package/respondd/conffiles
+/etc/config/respondd
+endef
+
+define Package/respondd/install
+	$(INSTALL_DIR) $(1)/usr/bin $(1)/etc/init.d $(1)/etc/config
+	$(INSTALL_CONF) ./files/respondd.config $(1)/etc/config/respondd
+	$(INSTALL_BIN) ./files/respondd.init $(1)/etc/init.d/respondd
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/respondd $(1)/usr/bin/
+endef
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/include
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/src/respondd.h $(1)/usr/include/
+endef
+
+$(eval $(call BuildPackage,respondd))
--- a/net/respondd/files/respondd.config
+++ b/net/respondd/files/respondd.config
@ -0,0 +1,8 @@
+config daemon daemon
+	option port '1001'
+	option providers '/lib/respondd'
+
+config multicast-group lan
+	option group 'ff02::1'
+	option disabled '1'
+	list interface 'br-lan'
--- a/net/respondd/files/respondd.init
+++ b/net/respondd/files/respondd.init
@ -0,0 +1,56 @@
+#!/bin/sh /etc/rc.common
+
+START=99
+
+USE_PROCD=1
+PROG=/usr/bin/respondd
+NAME=respondd
+
+
+multicast_group()
+{
+	config_get group "$1" group
+	config_get interfaces "$1" interface
+	config_get disabled "$1" disabled 0
+
+	if [ "$disabled" -gt "0" ]; then
+		return
+	fi
+
+	procd_append_param command -g $group
+	for iface in "$interfaces"; do
+		procd_append_param command -i "$iface"
+	done
+}
+
+daemon_settings()
+{
+	config_get port "$1" port
+	config_get providers "$1" providers
+
+	procd_append_param command -p "$port"
+	procd_append_param command -d "$providers"
+}
+
+start_service()
+{
+	. /lib/functions.sh
+	. /lib/functions/network.sh
+
+	procd_open_instance
+	procd_set_param command "$PROG"
+
+	config_load respondd
+	config_foreach daemon_settings daemon
+	config_foreach multicast_group multicast-group
+
+	procd_set_param respawn ${respawn_threshold:-3600} ${respawn_timeout:-5} ${respawn_retry:-5}
+	procd_set_param stderr 1
+	procd_close_instance
+}
+
+service_triggers()
+{
+	procd_add_config_trigger "config.change" "respondd" /etc/init.d/respondd reload
+	procd_add_interface_trigger "interface.*" 2000 /etc/init.d/respondd reload
+}
--- a/net/tailscale/Makefile
+++ b/net/tailscale/Makefile
@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=tailscale
-PKG_VERSION:=1.40.1
+PKG_VERSION:=1.42.0
 PKG_RELEASE:=1

 PKG_SOURCE:=tailscale-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/tailscale/tailscale/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=9c0a9648c921f695fc501536e69c8b4998d318256c8049de538f72fbe1491c18
+PKG_HASH:=09de9bacda98de8d733cff162572b7eac857d13db783776ba2a2450a44ecc5e9

 PKG_MAINTAINER:=Jan Pavlinec <jan.pavlinec1@gmail.com>
 PKG_LICENSE:=BSD-3-Clause
--- a/net/tailscale/patches/010-fake_iptables.patch
+++ b/net/tailscale/patches/010-fake_iptables.patch
@ -7,8 +7,8 @@
 +replace github.com/coreos/go-iptables => ./patched/go-iptables
 +
 require (
- 	filippo.io/mkcert v1.4.3
- 	github.com/Microsoft/go-winio v0.6.0
+ 	filippo.io/mkcert v1.4.4
+ 	github.com/Microsoft/go-winio v0.6.1
 --- a/patched/go-iptables/iptables/iptables.go
 +++ b/patched/go-iptables/iptables/iptables.go
@@ -149,12 +149,39 @@ func New(opts ...option) (*IPTables, err
--- a/net/v2ray-core/Makefile
+++ b/net/v2ray-core/Makefile
@ -5,12 +5,12 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=v2ray-core
-PKG_VERSION:=5.4.1
+PKG_VERSION:=5.7.0
 PKG_RELEASE:=1

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/v2fly/v2ray-core/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=e208bca255c4689a30104e965039d73fa138a7a6e902f820cff94b5b772b042b
+PKG_HASH:=599fcd264537e39178b6008a11af68816dfd1609e19a9cf8adc8b2a4240ee370

 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE
--- a/net/v2ray-geodata/Makefile
+++ b/net/v2ray-geodata/Makefile
@ -12,22 +12,22 @@ PKG_MAINTAINER:=Tianling Shen <cnsztl@immortalwrt.org>

 include $(INCLUDE_DIR)/package.mk

-GEOIP_VER:=202304060040
+GEOIP_VER:=202306010100
 GEOIP_FILE:=geoip.dat.$(GEOIP_VER)
 define Download/geoip
  URL:=https://github.com/v2fly/geoip/releases/download/$(GEOIP_VER)/
  URL_FILE:=geoip.dat
  FILE:=$(GEOIP_FILE)
-  HASH:=599ddc2dad1eac63abdda4ded69c46f2a087edabba96bacb82072234591bd5e1
+  HASH:=033864e77e40f8b9c1a5254bf85881515c51340d3d11e142a4e01594eb151914
 endef

-GEOSITE_VER:=20230408083150
+GEOSITE_VER:=20230601044045
 GEOSITE_FILE:=dlc.dat.$(GEOSITE_VER)
 define Download/geosite
  URL:=https://github.com/v2fly/domain-list-community/releases/download/$(GEOSITE_VER)/
  URL_FILE:=dlc.dat
  FILE:=$(GEOSITE_FILE)
-  HASH:=8804abc08dcacbcff2ef425f01c45e583e0bdf5061471286f4c470f159b2c594
+  HASH:=d20bcd23c185dd3102a2106ad5370bc615cfb33d9a818daaadefe7a2068fb9ef
 endef

 define Package/v2ray-geodata/template
--- a/utils/apparmor/Makefile
+++ b/utils/apparmor/Makefile
@ -4,7 +4,7 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=apparmor
 PKG_VERSION:=3.0.3
-PKG_RELEASE:=5
+PKG_RELEASE:=6

 PKG_SOURCE:=$(PKG_NAME)-v$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=https://gitlab.com/apparmor/apparmor/-/archive/v$(PKG_VERSION)
--- a/utils/apparmor/patches/100-add-missing-cstdint-include.patch
+++ b/utils/apparmor/patches/100-add-missing-cstdint-include.patch
@ -0,0 +1,32 @@
+From 64a64be7ffb5a84f27daa9f37ae8ad92800943d3 Mon Sep 17 00:00:00 2001
+From: Sergei Trofimovich <slyich@gmail.com>
+Date: Mon, 23 May 2022 23:12:31 +0100
+Subject: [PATCH] parser/capability.h: add missing <cstdint> include
+
+Without the change apparmor build fails on this week's gcc-13 snapshot as:
+
+    capability.h:66:6: error: variable or field '__debug_capabilities' declared void
+       66 | void __debug_capabilities(uint64_t capset, const char *name);
+          |      ^~~~~~~~~~~~~~~~~~~~
+    capability.h:66:27: error: 'uint64_t' was not declared in this scope
+       66 | void __debug_capabilities(uint64_t capset, const char *name);
+          |                           ^~~~~~~~
+    capability.h:23:1: note: 'uint64_t' is defined in header '<cstdint>'; did you forget to '#include <cstdint>'?
+       22 | #include <linux/capability.h>
+      +++ |+#include <cstdint>
+       23 |
+---
+ parser/capability.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/parser/capability.h
+++ b/parser/capability.h
+@@ -19,6 +19,8 @@
+ #ifndef __AA_CAPABILITY_H
+ #define __AA_CAPABILITY_H
+ 
+#include <cstdint>
+
+ #define NO_BACKMAP_CAP 0xff
+ 
+ #ifndef CAP_PERFMON
--- a/utils/collectd/Makefile
+++ b/utils/collectd/Makefile
@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=collectd
 PKG_VERSION:=5.12.0
-PKG_RELEASE:=42
+PKG_RELEASE:=43

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=https://collectd.org/files/ \
--- a/utils/collectd/files/collectd.uci
+++ b/utils/collectd/files/collectd.uci
@ -188,7 +188,8 @@ config globals 'globals'

 #config plugin 'tcpconns'
 #	option enable '0'
-#	list ListeningPort '0'
+#	option ListeningPorts '0'
+#	option AllPortsSummary '0'
 #	list LocalPort '22'
 #	list LocalPort '80'

--- a/utils/collectd/files/usr/share/collectd/plugin/tcpconns.json
+++ b/utils/collectd/files/usr/share/collectd/plugin/tcpconns.json
@ -1,6 +1,7 @@
 {
 	"bool": [
-		"ListeningPorts"
+		"ListeningPorts",
+		"AllPortsSummary"
 	],
 	"list": [
 		"LocalPort",
--- a/utils/tang/Makefile
+++ b/utils/tang/Makefile
@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=tang
 PKG_VERSION:=12
-PKG_RELEASE:=1
+PKG_RELEASE:=2

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://github.com/latchset/$(PKG_NAME)/releases/download/v$(PKG_VERSION)/
@ -27,6 +27,7 @@ define Package/tang
  TITLE:=tang v$(PKG_VERSION) - daemon for binding data to the presence of a third party
  DEPENDS:=+libhttp-parser +jose +bash
  URL:=https://github.com/latchset/tang
+  USERID:=tang:tang
 endef

 define Package/tang/description
--- a/utils/yq/Makefile
+++ b/utils/yq/Makefile
@ -1,12 +1,12 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=yq
-PKG_VERSION:=4.33.2
+PKG_VERSION:=4.34.1
 PKG_RELEASE:=1

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/mikefarah/yq/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=eea0435bef57a4523dbbe3680fafc321d821986a49a92af69b0c637a428d454d
+PKG_HASH:=69ff6f8bbb5f9eff5ccb537597740d24200db201b2709e442ae5effdbcb8ff9d

 PKG_MAINTAINER:=Tianling Shen <cnsztl@immortalwrt.org>
 PKG_LICENSE:=MIT
--- a/utils/zile/Makefile
+++ b/utils/zile/Makefile
@ -1,6 +1,4 @@
 #
-# Copyright (C) 2006-2016 OpenWrt.org
-#
 # This is free software, licensed under the GNU General Public License v2.
 # See /LICENSE for more information.
 #
@ -9,7 +7,7 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=zile
 PKG_VERSION:=2.3.24
-PKG_RELEASE:=5
+PKG_RELEASE:=6

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=@GNU/zile
@ -19,7 +17,6 @@ PKG_MAINTAINER:=Ted Hess <thess@kitschensync.net>
 PKG_LICENSE:=GPL-3.0-or-later
 PKG_LICENSE_FILES:=COPYING

-PKG_FIXUP:=autoreconf
 PKG_INSTALL:=1

 include $(INCLUDE_DIR)/package.mk