staging/stintel/package/libs, branch master

pcre2: fix PKG_LICENSE_FILES after upstream rename

2026-05-07T16:20:24Z

PCRE2 10.47 renamed LICENCE to LICENCE.md. Update PKG_LICENSE_FILES to match the actual filename in the source tarball. Signed-off-by: Michael Pfeifroth Link: https://github.com/openwrt/openwrt/pull/23164 Signed-off-by: Robert Marko

treewide: remove unused archs leftovers

2026-05-07T08:58:47Z

These are all unused by the current targets, clean up and stop irritating the user with irrelevant grep results. Signed-off-by: Andre Heider Link: https://github.com/openwrt/openwrt/pull/23240 Signed-off-by: Robert Marko

mbedtls: backport upstream patches to fix TLS 1.2 client issues

2026-05-04T22:27:58Z

Fix a TLS 1.2 regression that caused clients to reject valid ServerKeyExchange signatures using RSA-PSS signature algorithms. The TLS 1.2 regression resulted in errors like: $ curl https://api.domeneshop.no/v0/ curl: (35) ssl_handshake returned: (-0x6600) SSL - A field in a message was incorrect or inconsistent with other fields Fixes: https://github.com/openwrt/openwrt/issues/22874 Fixes: https://github.com/openwrt/openwrt/issues/23116 Fixes: f48ef0040b7e ("mbedtls: update to 3.6.6") Signed-off-by: Magnus Kroken Link: https://github.com/openwrt/openwrt/pull/23066 Signed-off-by: Hauke Mehrtens

libsemanage: update to 3.10

2026-04-27T08:50:53Z

Release Notes: https://github.com/SELinuxProject/selinux/wiki/Releases#release-310 Signed-off-by: Alexandru Ardelean Link: https://github.com/openwrt/openwrt/pull/23082 Signed-off-by: Robert Marko

libselinux: update to 3.10

2026-04-27T08:50:53Z

Release Notes: https://github.com/SELinuxProject/selinux/wiki/Releases#release-310 Signed-off-by: Alexandru Ardelean Link: https://github.com/openwrt/openwrt/pull/23082 Signed-off-by: Robert Marko

libsepol: update to 3.10

2026-04-27T08:50:53Z

Release Notes: https://github.com/SELinuxProject/selinux/wiki/Releases#release-310 Signed-off-by: Alexandru Ardelean Link: https://github.com/openwrt/openwrt/pull/23082 Signed-off-by: Robert Marko

wolfssl: update to 5.9.1

2026-04-24T19:08:24Z

For changes, see: https://github.com/wolfSSL/wolfssl/releases/tag/v5.9.1-stable This includes a fix for a critical (CVSS 9.3) vulnerability: https://github.com/advisories/GHSA-f5h9-5q52-qrx7 Signed-off-by: Sander van Deijck Link: https://github.com/openwrt/openwrt/pull/23072 Signed-off-by: Nick Hainke

treewide: use HTTPS for PKG_SOURCE_URL where possible

2026-04-20T03:58:37Z

Switch http:// (and redundant ftp://) PKG_SOURCE_URL entries to https:// across tools/ and package/. PKG_HASH alone does not protect against an attacker tampering with insecure downloads when a maintainer regenerates the hash via `make ... FIXUP=1`: HTTPS authenticates the upstream so the captured hash reflects real upstream content. In-place http -> https (HTTPS reachability verified per host): - tools/elftosb, tools/lzop, tools/liblzo, tools/mpfr, tools/dosfstools, tools/libressl, tools/xz - package/libs/mpfr, package/libs/libmnl, package/libs/libnfnetlink Replaced with @OPENWRT (HTTPS-only mirror) where the upstream HTTPS host is dead or has a broken certificate: - package/libs/popt (ftp.rpm.org cert mismatch) - package/firmware/ixp4xx-microcode (was http://downloads.openwrt.org) - package/boot/imx-bootlets (trabant.uid0.hu cert mismatch) - package/boot/kobs-ng (freescale.com URL is dead, redirects to nxp.com root) Dropped redundant ftp://ftp.denx.de fallback (https://ftp.denx.de is already listed): - package/boot/uboot-tools, tools/mkimage Signed-off-by: Paul Spooren

libbpf: update to 1.7.0

2026-04-18T07:21:00Z

Release Notes: - https://github.com/libbpf/libbpf/releases/tag/v1.6.3 - https://github.com/libbpf/libbpf/releases/tag/v1.7.0 Link: https://github.com/openwrt/openwrt/pull/22971 Signed-off-by: Nick Hainke

openssl: update to 3.5.6

2026-04-11T10:18:54Z

This release incorporates the following bug fixes and mitigations: Fixed incorrect failure handling in RSA KEM RSASVE encapsulation. (CVE-2026-31790) Fixed loss of key agreement group tuple structure when the DEFAULT keyword is used in the server-side configuration of the key-agreement group list. (CVE-2026-2673) Fixed potential use-after-free in DANE client code. (CVE-2026-28387) Fixed NULL pointer dereference when processing a delta CRL. (CVE-2026-28388) Fixed possible NULL dereference when processing CMS KeyAgreeRecipientInfo. (CVE-2026-28389) Fixed possible NULL dereference when processing CMS KeyTransportRecipientInfo. (CVE-2026-28390) Fixed heap buffer overflow in hexadecimal conversion. (CVE-2026-31789) No need refresh patches Signed-off-by: Jack Sun Link: https://github.com/openwrt/openwrt/pull/22847 Signed-off-by: Robert Marko