packages/utils, branch master

watchcat: resolve interface resolution race

2026-10-02T04:56:11Z

- Add interface trigger handling in watchcat.init - Log when raw interface trigger is activated by any interface coming up - Move helper functions to separate file - Update Makefile to install new functions file Closes: #30463 Signed-off-by: Daniel F. Dickinson

watchcat: silence shellcheck false positives

2026-10-02T04:56:11Z

We use shellcheck even though it is pedantic to assist in reducing errors. Therefore, we add shellcheck directives to silence false positives. We keep changes minimal as some shellcheck suggestions result in watchcat failing to function properly. Also make formatting shmt clean (using -ln=bash due to ash constructs that shfmt 3.8.0 does not accept for posix shells including busybox). Signed-off-by: Daniel F. Dickinson

sane-backends: depend on scanner-support for the group

2026-09-29T17:14:57Z

The package allocates a group named scanner with a dynamic id, while openwrt.git's scanner-support package allocates it as gid 47. Two different ids for one group name make the metadata scan fail. Depend on scanner-support and pin the group to the same id. The hotplug script stays here: it matches a scanner by vendor and product id against the usbid lists this package ships, which scanner-support has no way to do, and it already checks that the group exists before granting access. Signed-off-by: Daniel Golle

uvol: pad the MBR disk signature when matching root=

2026-09-28T22:46:00Z

get_bootdev() identifies the boot disk for a root=PARTUUID=xxxxxxxx-NN command line by reading the four-byte signature at offset 440 of each block device, but renders it with %x per byte, so a byte below 0x10 comes out as a single digit and the string is too short to ever match. A disk whose signature is cf0a3161 yields "cfa3161", get_bootdev() returns null, and every backend's init fails: uvol then reports no backend at all and no volume can be created on a perfectly good volume group. Pad each byte to two digits, as the GPT branch of the same function already does. Fixes: 6350c7bc63a1 ("uvol: replace with re-write in ucode") Signed-off-by: Daniel Golle

setools: fix the version reported by the tools

2026-09-28T14:44:38Z

setools reads its version through importlib.metadata, which imports the email module. email is part of python3-urllib, so without it every tool prints "unknown" for --version, and the generic version check fails for all of them. Depend on python3-urllib. Signed-off-by: Josef Schlehofer

selinux-python: add version check override

2026-09-28T14:44:38Z

None of the selinux-python tools print the package version, so the generic version check fails for all of them. Signed-off-by: Josef Schlehofer

xz: update to 5.8.4

2026-09-28T08:10:45Z

Fixes GHSA-5qpq-xqfv-j9pg: after a failed memory allocation, reinitializing an existing .lzma, .lz or MicroLZMA decoder to decode a different file could access invalid memory and at least crash. It affects all XZ Utils versions since 5.0.0. The release also fixes a wrong error code in lzma_stream_buffer_decode() and a slowdown of lzma_index_cat() with crafted files that made "xz --list" appear to hang. Release notes: https://github.com/tukaani-project/xz/releases/tag/v5.8.4 Signed-off-by: Josef Schlehofer

gpsd: install gps2udp client

2026-09-28T06:01:08Z

gpsd-clients/install only shipped cgps, gpsctl, gpsdecode, gpsmon, gpspipe, gpxlogger and lcdgps, leaving out gps2udp even though it's built by scons like the rest of the client tools. Install it too. Signed-off-by: Jose Luis Sanroma Tato

telegraf: update to 1.40.1

2026-09-27T19:18:46Z

Update Telegraf to v1.40.1. Signed-off-by: Niklas Thorild

librespeed: fix the kconfig recursion between common and the clients

2026-09-24T06:34:20Z

Two packages provide librespeed-cli, and for a dependency written with a leading plus, package-metadata.pl re-emits the chosen provider's architecture gate under a condition that names the consuming package. Kconfig reads that as a self-dependency, once for librespeed-common and again for luci-app-librespeed. Naming the client without the plus emits a plain either-or instead, and the user picks. The provide also crosses package boundaries, where package-pack.mk asks for an unversioned one: with a version the higher one wins, so a release on either side would decide which client apk installs. Unversioned, the package called librespeed-cli keeps the name, and a default variant gives the Rust client the provider priority so it is still chosen where the Go client is not built. Signed-off-by: Josef Schlehofer