diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 29fa3ac029..952bcbfbed 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -17,7 +17,7 @@ jobs:
           sync-labels: true
 
       - name: Checkout PR code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
diff --git a/admin/schroot/Makefile b/admin/schroot/Makefile
index 99e2e160e5..e5d5ad2f24 100644
--- a/admin/schroot/Makefile
+++ b/admin/schroot/Makefile
@@ -27,6 +27,7 @@ define Package/schroot
   TITLE:=Securely enter a chroot and run a command or login shell.
   DEPENDS:=$(ICONV_DEPENDS) \
 	+boost +boost-filesystem +boost-iostreams +boost-program_options +boost-regex \
+	+coreutils +coreutils-cp +coreutils-stat \
 	+SCHROOT_BTRFS:btrfs-progs \
 	+SCHROOT_LOOPBACK:losetup \
 	+SCHROOT_LVM:lvm2 \
diff --git a/lang/php8-pecl-http/Makefile b/lang/php8-pecl-http/Makefile
index 786464f037..adab786d06 100644
--- a/lang/php8-pecl-http/Makefile
+++ b/lang/php8-pecl-http/Makefile
@@ -31,6 +31,9 @@ include ../php8/pecl.mk
 
 CONFIGURE_VARS+= \
 	PECL_cv_HAVE_EXT_raphf=yes \
+	PECL_cv_libbrotlicommon_exists=no \
+	PECL_cv_libbrotlidec_exists=no \
+	PECL_cv_libbrotlienc_exists=no \
 	PECL_cv_HAVE_LIBCURL_ARES=no \
 	PECL_cv_HAVE_LIBCURL_OpenSSL=$(if $(CONFIG_LIBCURL_OPENSSL),yes,no) \
 	PECL_cv_HAVE_LIBCURL_GnuTLS=$(if $(CONFIG_LIBCURL_GNUTLS),yes,no) \
diff --git a/lang/python/python-netifaces/Makefile b/lang/python/python-netifaces/Makefile
new file mode 100644
index 0000000000..351752a507
--- /dev/null
+++ b/lang/python/python-netifaces/Makefile
@@ -0,0 +1,40 @@
+#
+# Copyright (C) 2019 CZ.NIC, z. s. p. o. (https://www.nic.cz/)
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=python-netifaces
+PKG_VERSION:=0.11.0
+PKG_RELEASE:=1
+
+PYPI_NAME:=netifaces
+PKG_HASH:=043a79146eb2907edf439899f262b3dfe41717d34124298ed281139a8b93ca32
+
+PKG_MAINTAINER:=Josef Schlehofer <pepe.schlehofer@gmail.com>
+PKG_LICENSE:=MIT
+PKG_LICENSE_FILES:=LICENSE
+
+include ../pypi.mk
+include $(INCLUDE_DIR)/package.mk
+include ../python3-package.mk
+
+define Package/python3-netifaces
+  SECTION:=lang
+  CATEGORY:=Languages
+  SUBMENU:=Python
+  TITLE:=Portable network interface information
+  URL:=https://github.com/al45tair/netifaces
+  DEPENDS:=+python3-light
+endef
+
+define Package/python3-netifaces/description
+  Portable network interface information.
+endef
+
+$(eval $(call Py3Package,python3-netifaces))
+$(eval $(call BuildPackage,python3-netifaces))
+$(eval $(call BuildPackage,python3-netifaces-src))
diff --git a/lang/python/python-netifaces/patches/100-fix-build.patch b/lang/python/python-netifaces/patches/100-fix-build.patch
new file mode 100644
index 0000000000..6d9f00e170
--- /dev/null
+++ b/lang/python/python-netifaces/patches/100-fix-build.patch
@@ -0,0 +1,13 @@
+diff --git a/netifaces.c b/netifaces.c
+index 839c42c..8b04dc4 100644
+--- a/netifaces.c
++++ b/netifaces.c
+@@ -1805,7 +1805,7 @@ gateways (PyObject *self)
+         sizeof(sanl_from),
+         &iov,
+         1,
+-        NULL,
++        0,
+         0,
+         0
+       };
diff --git a/lang/rust/Makefile b/lang/rust/Makefile
index 717b15d46e..220a14f2e2 100644
--- a/lang/rust/Makefile
+++ b/lang/rust/Makefile
@@ -75,7 +75,7 @@ HOST_CONFIGURE_ARGS = \
 	--release-channel=stable \
 	--enable-cargo-native-static \
 	--bootstrap-cache-path=$(DL_DIR)/rustc \
-	--set=llvm.download-ci-llvm=true \
+	--set=llvm.download-ci-llvm=false \
 	$(TARGET_CONFIGURE_ARGS)
 
 define Host/Uninstall
diff --git a/libs/avahi/Makefile b/libs/avahi/Makefile
index dc1fd247d7..a9346f3eaa 100644
--- a/libs/avahi/Makefile
+++ b/libs/avahi/Makefile
@@ -218,6 +218,23 @@ $(call Package/avahi/Default/description)
  For more information please see the avahi documentation.
 endef
 
+define Package/libavahi-compat-libdnssd
+  $(call Package/avahi/Default)
+  SECTION:=libs
+  CATEGORY:=Libraries
+  VARIANT:=dbus
+  DEPENDS:=+libavahi-client
+  TITLE+= (libdnssd)
+endef
+
+define Package/libavahi-compat-libdnssd/description
+$(call Package/avahi/Default/description)
+ .
+ This packages adds the libavahi-compat-libdnssd library.
+ It also automatically adds the required libavahi-client package.
+ For more information please see the avahi documentation.
+endef
+
 define Package/avahi-utils
   $(call Package/avahi/Default)
   SUBMENU:=IP Addresses and Names
@@ -278,6 +295,10 @@ CONFIGURE_ARGS += \
 	--with-autoipd-group=avahi
 
 ifeq ($(BUILD_VARIANT),dbus)
+ifneq ($(CONFIG_PACKAGE_libavahi-compat-libdnssd),)
+CONFIGURE_ARGS += \
+	--enable-compat-libdns_sd
+endif
 CONFIGURE_ARGS += \
 	--enable-dbus
 else
@@ -294,6 +315,11 @@ define Build/InstallDev
 	$(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/
 	$(INSTALL_DIR) $(1)/usr/lib
 	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libavahi-* $(1)/usr/lib/
+ifneq ($(CONFIG_PACKAGE_libavahi-compat-libdnssd),)
+ifeq ($(BUILD_VARIANT),dbus)
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libdns_sd* $(1)/usr/lib/
+endif
+endif
 	$(INSTALL_DIR) $(1)/usr/lib/pkgconfig
 	$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/* $(1)/usr/lib/pkgconfig/
 endef
@@ -316,6 +342,11 @@ define Package/libavahi-client/install
 	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libavahi-client.so.* $(1)/usr/lib/
 endef
 
+define Package/libavahi-compat-libdnssd/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libdns_sd.so* $(1)/usr/lib/
+endef
+
 define Package/avahi-utils/install
 	$(INSTALL_DIR) $(1)/usr/bin
 	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/* $(1)/usr/bin/
@@ -363,6 +394,7 @@ define Package/avahi-dnsconfd/install
 endef
 
 $(eval $(call BuildPackage,libavahi-client))
+$(eval $(call BuildPackage,libavahi-compat-libdnssd))
 $(eval $(call BuildPackage,avahi-utils))
 $(eval $(call BuildPackage,libavahi-dbus-support))
 $(eval $(call BuildPackage,libavahi-nodbus-support))
diff --git a/libs/nghttp2/Makefile b/libs/nghttp2/Makefile
index fb90982127..d37010bb29 100644
--- a/libs/nghttp2/Makefile
+++ b/libs/nghttp2/Makefile
@@ -28,7 +28,7 @@ HTTP/2 C Library
 endef
 
 CMAKE_OPTIONS += \
-        -DENABLE_LIB_ONLY=ON
+        -DENABLE_LIB_ONLY=ON -DENABLE_STATIC_LIB=ON
 
 define Build/InstallDev
 	$(call Build/InstallDev/cmake,$(1))
diff --git a/libs/pcre/Config.in b/libs/pcre/Config.in
new file mode 100644
index 0000000000..15e75fc753
--- /dev/null
+++ b/libs/pcre/Config.in
@@ -0,0 +1,11 @@
+config PCRE_JIT_ENABLED
+	bool
+	depends on PACKAGE_libpcre && (arm || i386 || i686 || x86_64 || mips || mipsel || powerpc || sparc)
+	default y if (arm || i686 || x86_64)
+	prompt "Enable JIT compiler support"
+	help
+		Enable JIT (Just-In-Time) compiler support.
+
+		Enabling this option can give an about 10x performance increase on JIT operations. It can be desireable for e.g. high performance Apache mod_rewrite or HA-Proxy reqrep operations.
+
+		However, JIT should _only_ be enabled on architectures that are supported. Enabling JIT on unsupported platforms will result in a compilation failure. A list of supported architectures can be found here: https://pcre.org/original/doc/html/pcrejit.html#SEC3 .
diff --git a/libs/pcre/Makefile b/libs/pcre/Makefile
new file mode 100644
index 0000000000..5309f81d7a
--- /dev/null
+++ b/libs/pcre/Makefile
@@ -0,0 +1,129 @@
+#
+# Copyright (C) 2006-2015 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=pcre
+PKG_VERSION:=8.45
+PKG_RELEASE:=5
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
+PKG_SOURCE_URL:=@SF/$(PKG_NAME)
+PKG_HASH:=4dae6fdcd2bb0bb6c37b5f97c33c2be954da743985369cddac3546e3218bffb8
+
+PKG_MAINTAINER:=Thomas Heil <heil@terminal-consulting.de>
+PKG_LICENSE:=BSD-3-Clause
+PKG_LICENSE_FILES:=LICENCE
+PKG_CPE_ID:=cpe:/a:pcre:pcre
+
+PKG_INSTALL:=1
+PKG_BUILD_PARALLEL:=1
+
+PKG_CONFIG_DEPENDS:=\
+	CONFIG_PACKAGE_libpcrecpp \
+	CONFIG_PCRE_JIT_ENABLED
+
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/host-build.mk
+
+define Package/libpcre/default
+  SECTION:=libs
+  CATEGORY:=Libraries
+  URL:=https://www.pcre.org/
+endef
+
+define Package/libpcre/config
+  source "$(SOURCE)/Config.in"
+endef
+
+define Package/libpcre
+  $(call Package/libpcre/default)
+  TITLE:=A Perl Compatible Regular Expression library
+endef
+
+define Package/libpcre16
+  $(call Package/libpcre/default)
+  TITLE:=A Perl Compatible Regular Expression library (16bit support)
+endef
+
+define Package/libpcre32
+  $(call Package/libpcre/default)
+  TITLE:=A Perl Compatible Regular Expression library (32bit support)
+endef
+
+define Package/libpcrecpp
+  $(call Package/libpcre/default)
+  TITLE:=C++ wrapper for Perl Compatible Regular Expression library
+  DEPENDS:=+libpcre +libstdcpp
+endef
+
+HOST_CONFIGURE_ARGS += \
+	--disable-shared \
+	--enable-utf8 \
+	--enable-unicode-properties \
+	--enable-pcre16 \
+	--with-match-limit-recursion=16000 \
+	--enable-cpp \
+	--with-pic
+
+CONFIGURE_ARGS += \
+	--enable-utf8 \
+	--enable-unicode-properties \
+	--enable-pcre16 \
+	--enable-pcre32 \
+	$(if $(CONFIG_PCRE_JIT_ENABLED),--enable-jit,--disable-jit) \
+	--with-match-limit-recursion=16000 \
+	--$(if $(CONFIG_PACKAGE_libpcrecpp),en,dis)able-cpp \
+	--with-pic
+
+MAKE_FLAGS += \
+	CFLAGS="$(TARGET_CFLAGS)"
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/pcre-config $(1)/usr/bin/
+	$(SED) 's,^\(prefix\|exec_prefix\)=.*,\1=$(STAGING_DIR)/usr,g' $(1)/usr/bin/pcre-config
+
+	$(INSTALL_DIR) $(2)/bin
+	$(LN) $(STAGING_DIR)/usr/bin/pcre-config $(2)/bin
+
+	$(INSTALL_DIR) $(1)/usr/include
+	$(CP) $(PKG_INSTALL_DIR)/usr/include/pcre*.h $(1)/usr/include/
+
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libpcre*.{a,so*} $(1)/usr/lib/
+
+	$(INSTALL_DIR) $(1)/usr/lib/pkgconfig
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libpcre*.pc $(1)/usr/lib/pkgconfig/
+endef
+
+define Package/libpcre/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libpcre{,posix}.so.* $(1)/usr/lib/
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libpcre.so $(1)/usr/lib/
+endef
+
+define Package/libpcre16/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libpcre16.so* $(1)/usr/lib/
+endef
+
+define Package/libpcre32/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libpcre32.so* $(1)/usr/lib/
+endef
+
+define Package/libpcrecpp/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libpcrecpp.so.* $(1)/usr/lib/
+endef
+
+$(eval $(call BuildPackage,libpcre))
+$(eval $(call BuildPackage,libpcre16))
+$(eval $(call BuildPackage,libpcre32))
+$(eval $(call BuildPackage,libpcrecpp))
+$(eval $(call HostBuild))
diff --git a/multimedia/gst1-libav/patches/020-fixup.patch b/multimedia/gst1-libav/patches/020-fixup.patch
new file mode 100644
index 0000000000..76eb22104a
--- /dev/null
+++ b/multimedia/gst1-libav/patches/020-fixup.patch
@@ -0,0 +1,24 @@
+diff --git a/ext/libav/gstavmux.c b/ext/libav/gstavmux.c
+index 325a79d..68e3d50 100644
+--- a/ext/libav/gstavmux.c
++++ b/ext/libav/gstavmux.c
+@@ -883,7 +883,8 @@ gst_ffmpegmux_register (GstPlugin * plugin)
+     gchar *type_name;
+     GstRank rank = GST_RANK_MARGINAL;
+ 
+-    if ((!strncmp (in_plugin->name, "u16", 3)) ||
++    if ((!in_plugin->name) ||
++        (!strncmp (in_plugin->name, "u16", 3)) ||
+         (!strncmp (in_plugin->name, "s16", 3)) ||
+         (!strncmp (in_plugin->name, "u24", 3)) ||
+         (!strncmp (in_plugin->name, "s24", 3)) ||
+@@ -921,7 +922,8 @@ gst_ffmpegmux_register (GstPlugin * plugin)
+       continue;
+     }
+ 
+-    if ((!strncmp (in_plugin->long_name, "raw ", 4))) {
++    if ((!in_plugin->long_name) ||
++        (!strncmp (in_plugin->long_name, "raw ", 4))) {
+       GST_LOG ("Ignoring raw muxer %s", in_plugin->name);
+       continue;
+     }
diff --git a/multimedia/gst1-plugins-ugly/Makefile b/multimedia/gst1-plugins-ugly/Makefile
index 47595835e4..55236a276c 100644
--- a/multimedia/gst1-plugins-ugly/Makefile
+++ b/multimedia/gst1-plugins-ugly/Makefile
@@ -28,6 +28,7 @@ include $(INCLUDE_DIR)/meson.mk
 PKG_CONFIG_DEPENDS:= \
 	CONFIG_PACKAGE_gst1-mod-asf \
 	CONFIG_PACKAGE_gst1-mod-mpeg2dec \
+	CONFIG_PACKAGE_gst1-mod-x264 \
 
 GST_UGLY_MODULES:=
 
@@ -101,7 +102,7 @@ MESON_ARGS += \
 	-Ddvdread=disabled \
 	$(call GST_COND_SELECT,mpeg2dec) \
 	-Dsidplay=disabled \
-	-Dx264=disabled \
+	$(call GST_COND_SELECT,x264) \
 	\
 	-Dgpl=enabled \
 	-Dnls=enabled \
@@ -154,6 +155,7 @@ endef
 
 $(eval $(call GstBuildPlugin,asf,ASF demuxer,audio video riff rtp rtsp sdp tag,,))
 $(eval $(call GstBuildPlugin,mpeg2dec,MPEG decoder,video,,+libmpeg2))
+$(eval $(call GstBuildPlugin,x264,H264/AVC codec support,pbutils,,+libx264))
 
 $(eval $(call BuildPackage,gstreamer1-plugins-ugly))
 $(eval $(call BuildPackage,gst1-plugins-ugly))
diff --git a/net/aria2/files/aria2.conf b/net/aria2/files/aria2.conf
index 108a30e012..5ca60ec0d1 100644
--- a/net/aria2/files/aria2.conf
+++ b/net/aria2/files/aria2.conf
@@ -20,12 +20,12 @@ config aria2 'main'
 
 	# Add addition Headers here.
 	# eg. list header 'Content-Encoding: gzip'
-	list header ''
+	#list header ''
 
 	# Add BT trackers here.
 	# eg. list bt_tracker 'http://tracker.example.com/announce'
-	list bt_tracker ''
+	#list bt_tracker ''
 
 	# Add extra settings here.
 	# eg. list extra_settings 'option=value'
-	list extra_settings ''
+	#list extra_settings ''
diff --git a/net/cgi-io/patches/10-allow-underscore-character-in-filename.patch b/net/cgi-io/patches/10-allow-underscore-character-in-filename.patch
new file mode 100644
index 0000000000..10db5e0200
--- /dev/null
+++ b/net/cgi-io/patches/10-allow-underscore-character-in-filename.patch
@@ -0,0 +1,30 @@
+--- a/main.c
++++ b/main.c
+@@ -547,11 +547,11 @@ main_download(int argc, char **argv)
+ 		return failure(403, 0, "Requested path is not a regular file or block device");
+ 
+ 	for (p = fields[5]; p && *p; p++)
+-		if (!isalnum(*p) && !strchr(" ()<>@,;:[]?.=%-", *p))
++		if (!isalnum(*p) && !strchr(" ()<>@,;:[]?.=%-_", *p))
+ 			return failure(400, 0, "Invalid characters in filename");
+ 
+ 	for (p = fields[7]; p && *p; p++)
+-		if (!isalnum(*p) && !strchr(" .;=/-", *p))
++		if (!isalnum(*p) && !strchr(" .;=/-_", *p))
+ 			return failure(400, 0, "Invalid characters in mimetype");
+ 
+ 	rfd = open(fields[3], O_RDONLY);
+@@ -745,11 +745,11 @@ main_exec(int argc, char **argv)
+ 		return failure(403, 0, "Exec permission denied");
+ 
+ 	for (p = fields[5]; p && *p; p++)
+-		if (!isalnum(*p) && !strchr(" ()<>@,;:[]?.=%-", *p))
++		if (!isalnum(*p) && !strchr(" ()<>@,;:[]?.=%-_", *p))
+ 			return failure(400, 0, "Invalid characters in filename");
+ 
+ 	for (p = fields[7]; p && *p; p++)
+-		if (!isalnum(*p) && !strchr(" .;=/-", *p))
++		if (!isalnum(*p) && !strchr(" .;=/-_", *p))
+ 			return failure(400, 0, "Invalid characters in mimetype");
+ 
+ 	args = fields[3] ? parse_command(fields[3]) : NULL;
diff --git a/net/curl/Makefile b/net/curl/Makefile
index 86ef92915b..120d0b72fe 100644
--- a/net/curl/Makefile
+++ b/net/curl/Makefile
@@ -118,6 +118,7 @@ CONFIGURE_ARGS += \
 	--disable-ipfs \
 	--enable-shared \
 	--enable-static \
+	--without-brotli \
 	--without-nss \
 	--without-librtmp \
 	--without-ca-path \
diff --git a/net/dawn/Makefile b/net/dawn/Makefile
index b127e9831f..9373c3102d 100644
--- a/net/dawn/Makefile
+++ b/net/dawn/Makefile
@@ -6,12 +6,11 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dawn
 PKG_SOURCE_DATE:=2025-11-07
-PKG_RELEASE:=1
+PKG_VERSION:=20251110
 
-PKG_SOURCE_PROTO:=git
-PKG_SOURCE_URL:=https://github.com/berlin-open-wireless-lab/DAWN.git
-PKG_SOURCE_VERSION:=7414c34a08c7cbbd5f292e0e25e53f1edbfc751a
-PKG_MIRROR_HASH:=9663f6e75e9bf8cb2c38df6348ee6163c472d3c0cd1c10eedeab60ddb824dc0e
+PKG_SOURCE_URL:=https://codeload.github.com/fakemesh/dawn/tar.gz/$(PKG_VERSION)?
+PKG_HASH:=ac77d0ef3011f693369ab68a6c7028d859b0007677cdc090aaf4d7660a16c4af
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 
 PKG_MAINTAINER:=Nick Hainke <vincent@systemli.org>
 PKG_LICENSE:=GPL-2.0-only
diff --git a/net/ddns-scripts/Makefile b/net/ddns-scripts/Makefile
index a5d7b4c5fe..73b1039a2e 100644
--- a/net/ddns-scripts/Makefile
+++ b/net/ddns-scripts/Makefile
@@ -78,6 +78,17 @@ define Package/ddns-scripts-luadns/description
   Dynamic DNS Client scripts extension for LuaDNS API v1 (require curl)
 endef
 
+
+define Package/ddns-scripts_aliyun
+    $(call Package/ddns-scripts/Default)
+    TITLE:=DDNS extension for AliYun.com
+    DEPENDS:=ddns-scripts +hmac-sha1-util +wget-any
+endef
+define Package/ddns-scripts_aliyun/description
+	Dynamic DNS Client scripts extension for AliYun.com
+endef
+
+
 define Package/ddns-scripts-cloudflare
   $(call Package/ddns-scripts/Default)
   TITLE:=Extension for cloudflare.com API v4
@@ -404,6 +415,7 @@ define Package/ddns-scripts/install
 	$(INSTALL_DIR) $(1)/etc/uci-defaults
 	$(INSTALL_DATA) ./files/etc/uci-defaults/50-ddns-migrate-retry-count \
 		$(1)/etc/uci-defaults/
+	$(INSTALL_DATA) ./files/uci.defaults $(1)/etc/uci-defaults/99-ddns
 endef
 
 define Package/ddns-scripts/postinst
@@ -483,6 +495,22 @@ fi
 exit 0
 endef
 
+define Package/ddns-scripts_aliyun/install
+	$(INSTALL_DIR) $(1)/usr/lib/ddns
+	$(INSTALL_BIN) ./files/update_aliyun_com.sh $(1)/usr/lib/ddns
+
+	$(INSTALL_DIR) $(1)/usr/share/ddns/default
+	$(INSTALL_DATA) ./files/usr/share/ddns/services/aliyun.com.json \
+		$(1)/usr/share/ddns/default
+endef
+
+define Package/ddns-scripts_aliyun/prerm
+#!/bin/sh
+if [ -z "$${IPKG_INSTROOT}" ]; then
+	/etc/init.d/ddns stop
+fi
+exit 0
+endef
 
 define Package/ddns-scripts-cloudflare/install
 	$(INSTALL_DIR) $(1)/usr/lib/ddns
@@ -885,6 +913,7 @@ $(eval $(call BuildPackage,ddns-scripts))
 $(eval $(call BuildPackage,ddns-scripts-services))
 $(eval $(call BuildPackage,ddns-scripts-utils))
 $(eval $(call BuildPackage,ddns-scripts-luadns))
+$(eval $(call BuildPackage,ddns-scripts_aliyun))
 $(eval $(call BuildPackage,ddns-scripts-cloudflare))
 $(eval $(call BuildPackage,ddns-scripts-gcp))
 $(eval $(call BuildPackage,ddns-scripts-freedns))
diff --git a/net/ddns-scripts/files/etc/hotplug.d/iface/ddns b/net/ddns-scripts/files/etc/hotplug.d/iface/ddns
index 9ef172deb6..22c889326c 100644
--- a/net/ddns-scripts/files/etc/hotplug.d/iface/ddns
+++ b/net/ddns-scripts/files/etc/hotplug.d/iface/ddns
@@ -2,7 +2,7 @@
 
 # there are other ACTIONs like ifupdate we don't need
 case "$ACTION" in
-	ifup)					# OpenWrt is giving a network not phys. Interface
+	ifup|ifupdate)					# OpenWrt is giving a network not phys. Interface
 		/etc/init.d/ddns enabled && /usr/lib/ddns/dynamic_dns_updater.sh -n "$INTERFACE" -- start
 		;;
 	ifdown)
diff --git a/net/ddns-scripts/files/uci.defaults b/net/ddns-scripts/files/uci.defaults
new file mode 100644
index 0000000000..fe8daa28a2
--- /dev/null
+++ b/net/ddns-scripts/files/uci.defaults
@@ -0,0 +1,9 @@
+
+uci -q batch <<-EOF >/dev/null
+	delete ucitrack.@ddns[-1]
+	add ucitrack ddns
+	set ucitrack.@ddns[-1].init=ddns
+	commit ucitrack
+EOF
+
+exit 0
diff --git a/net/ddns-scripts/files/update_aliyun_com.sh b/net/ddns-scripts/files/update_aliyun_com.sh
new file mode 100644
index 0000000000..3ec06be631
--- /dev/null
+++ b/net/ddns-scripts/files/update_aliyun_com.sh
@@ -0,0 +1,237 @@
+#!/bin/sh
+#
+# 用于阿里云解析的DNS更新脚本
+# 2017-2018 Sense <sensec at gmail dot com>
+# 阿里云解析API文档 https://help.aliyun.com/document_detail/29739.html
+#
+# 本脚本由 dynamic_dns_functions.sh 内的函数 send_update() 调用
+#
+# 需要在 /etc/config/ddns 中设置的选项
+# option username - 阿里云API访问账号 Access Key ID。可通过 aliyun.com 帐号管理的 accesskeys 获取, 或者访问 https://ak-console.aliyun.com
+# option password - 阿里云API访问密钥 Access Key Secret
+# option domain   - 完整的域名。建议主机与域名之间使用 @符号 分隔，否则将以第一个 .符号 之前的内容作为主机名
+#
+
+# 检查传入参数
+[ -z "$username" ] && write_log 14 "配置错误！保存阿里云API访问账号的'用户名'不能为空"
+[ -z "$password" ] && write_log 14 "配置错误！保存阿里云API访问密钥的'密码'不能为空"
+
+# 检查外部调用工具
+[ -n "$WGET_SSL" ] || write_log 4 "使用阿里云API建议安装 GNU Wget 支持，否则部分功能失效"
+command -v sed >/dev/null 2>&1 || write_log 13 "使用阿里云API需要 sed 支持，请先安装"
+command -v hmac-sha1-util >/dev/null 2>&1 || write_log 13 "使用阿里云API需要 hmac-sha1-util 支持，请先安装"
+
+# 包含用于解析 JSON 格式返回值的函数
+. /usr/share/libubox/jshn.sh
+
+# 变量声明
+local __HOST __DOMAIN __TYPE __URLBASE __CMDBASE __URLARGS __SEPARATOR __RECID
+[ $use_https -eq 0 ] && __URLBASE="http://alidns.aliyuncs.com/" || __URLBASE="https://alidns.aliyuncs.com/"
+__SEPARATOR="&"
+
+# 从 $domain 分离主机和域名
+[ "${domain:0:2}" == "@." ] && domain="${domain/./}" # 主域名处理
+[ "$domain" == "${domain/@/}" ] && domain="${domain/./@}" # 未找到分隔符，兼容常用域名格式
+__HOST="${domain%%@*}"
+__DOMAIN="${domain#*@}"
+[ -z "$__HOST" -o "$__HOST" == "$__DOMAIN" ] && __HOST="@"
+
+# 设置记录类型
+[ $use_ipv6 -eq 0 ] && __TYPE="A" || __TYPE="AAAA"
+
+# 构造基本通信命令
+build_command() {
+	__CMDBASE="$WGET_SSL -nv -t 1 -O $DATFILE -o $ERRFILE"
+	if ! [ -n "$WGET_SSL" ]; then
+		__CMDBASE="$WGET --timeout=60 -qO $DATFILE"
+	fi
+	# 绑定用于通信的主机/IP
+	if [ -n "$bind_network" ] && [ -n "$WGET_SSL" ]; then
+		local bind_ip run_prog
+		[ $use_ipv6 -eq 0 ] && run_prog="network_get_ipaddr" || run_prog="network_get_ipaddr6"
+		eval "$run_prog bind_ip $bind_network" || \
+			write_log 13 "Can not detect local IP using '$run_prog $bind_network' - Error: '$?'"
+		write_log 7 "Force communication via IP '$bind_ip'"
+		__CMDBASE="$__CMDBASE --bind-address=$bind_ip"
+	fi
+	# 强制设定IP版本
+	if [ $force_ipversion -eq 1 ]; then
+		[ $use_ipv6 -eq 0 ] && __CMDBASE="$__CMDBASE -4" || __CMDBASE="$__CMDBASE -6"
+	fi
+	# 设置CA证书参数
+	if [ $use_https -eq 1 ]; then
+		if [ "$cacert" = "IGNORE" ]; then
+			__CMDBASE="$__CMDBASE --no-check-certificate"
+		elif [ -f "$cacert" ]; then
+			__CMDBASE="$__CMDBASE --ca-certificate=${cacert}"
+		elif [ -d "$cacert" ]; then
+			__CMDBASE="$__CMDBASE --ca-directory=${cacert}"
+		elif [ -n "$cacert" ]; then
+			write_log 14 "No valid certificate(s) found at '$cacert' for HTTPS communication"
+		fi
+	fi
+	# 如果没有设置，禁用代理 (这可能是 .wgetrc 或环境设置错误)
+	[ -z "$proxy" ] && [ -n "$WGET_SSL" ] && __CMDBASE="$__CMDBASE --no-proxy"
+	[ -z "$proxy" ] && ! [ -n "$WGET_SSL" ] && __CMDBASE="$__CMDBASE --proxy=off"
+}
+
+# 用于阿里云API的通信函数
+aliyun_transfer() {
+	local __PARAM="$@"
+	local __CNT=0
+	local __RUNPROG __ERR PID_SLEEP
+
+	[ $# -eq 0 ] && write_log 12 "Error in 'aliyun_transfer()' - wrong number of parameters"
+
+	while : ; do
+		build_Request $__PARAM
+		__RUNPROG="$__CMDBASE '${__URLBASE}?${__URLARGS}'"
+
+		write_log 7 "#> $__RUNPROG"
+		eval $__RUNPROG
+		__ERR=$?
+		[ $__ERR -eq 0 ] && return 0
+
+		write_log 3 "GNU Wget Error: '$__ERR'"
+		write_log 7 "$(cat $ERRFILE)"
+
+		if [ $VERBOSE -gt 1 ]; then
+			write_log 4 "Transfer failed - Verbose Mode: $VERBOSE - NO retry on error"
+			return 1
+		fi
+
+		__CNT=$(( $__CNT + 1 ))
+		[ $retry_count -gt 0 -a $__CNT -gt $retry_count ] && \
+			write_log 14 "Transfer failed after $retry_count retries"
+
+		write_log 4 "Transfer failed - retry $__CNT/$retry_count in $RETRY_SECONDS seconds"
+		sleep $RETRY_SECONDS &
+		PID_SLEEP=$!
+		wait $PID_SLEEP
+		PID_SLEEP=0
+	done
+}
+
+# 百分号编码
+percentEncode() {
+	if [ -z "${1//[A-Za-z0-9_.~-]/}" ]; then
+		echo -n "$1"
+	else
+		local string=$1; local i=0; local ret chr
+		while [ $i -lt ${#string} ]; do
+			chr=${string:$i:1}
+			[ -z "${chr#[^A-Za-z0-9_.~-]}" ] && chr=$(printf '%%%02X' "'$chr")
+			ret="$ret$chr"
+			i=$(( $i + 1 ))
+		done
+		echo -n "$ret"
+	fi
+}
+
+# 构造阿里云解析请求参数
+build_Request() {
+	local args="$@"; local string
+	local HTTP_METHOD="GET"
+
+	# 添加请求参数
+	__URLARGS=
+	for string in $args; do
+		case "${string%%=*}" in
+			Format|Version|AccessKeyId|SignatureMethod|Timestamp|SignatureVersion|SignatureNonce|Signature) ;; # 过滤公共参数
+			*) __URLARGS="$__URLARGS${__SEPARATOR}"$(percentEncode "${string%%=*}")"="$(percentEncode "${string#*=}");;
+		esac
+	done
+	__URLARGS="${__URLARGS:1}"
+
+	# 附加公共参数
+	string="Format=JSON"; __URLARGS="$__URLARGS${__SEPARATOR}"$(percentEncode "${string%%=*}")"="$(percentEncode "${string#*=}")
+	string="Version=2015-01-09"; __URLARGS="$__URLARGS${__SEPARATOR}"$(percentEncode "${string%%=*}")"="$(percentEncode "${string#*=}")
+	string="AccessKeyId=$username"; __URLARGS="$__URLARGS${__SEPARATOR}"$(percentEncode "${string%%=*}")"="$(percentEncode "${string#*=}")
+	string="SignatureMethod=HMAC-SHA1"; __URLARGS="$__URLARGS${__SEPARATOR}"$(percentEncode "${string%%=*}")"="$(percentEncode "${string#*=}")
+	string="Timestamp="$(date -u '+%Y-%m-%dT%H:%M:%SZ'); __URLARGS="$__URLARGS${__SEPARATOR}"$(percentEncode "${string%%=*}")"="$(percentEncode "${string#*=}")
+	string="SignatureVersion=1.0"; __URLARGS="$__URLARGS${__SEPARATOR}"$(percentEncode "${string%%=*}")"="$(percentEncode "${string#*=}")
+	string="SignatureNonce="$(cat '/proc/sys/kernel/random/uuid'); __URLARGS="$__URLARGS${__SEPARATOR}"$(percentEncode "${string%%=*}")"="$(percentEncode "${string#*=}")
+
+	# 对请求参数进行排序，用于生成签名
+	string=$(echo -n "$__URLARGS" | sed 's/\'"${__SEPARATOR}"'/\n/g' | sort | sed ':label; N; s/\n/\'"${__SEPARATOR}"'/g; b label')
+	# 构造用于计算签名的字符串
+	string="${HTTP_METHOD}${__SEPARATOR}"$(percentEncode "/")"${__SEPARATOR}"$(percentEncode "$string")
+	# 字符串计算签名HMAC值
+	local signature=$(echo -n "$string" | hmac-sha1-util "${password}&")
+	# HMAC值编码成字符串，得到签名值
+	signature=$(echo -n "$signature" | base64)
+
+	# 附加签名参数
+	string="Signature=$signature"; __URLARGS="$__URLARGS${__SEPARATOR}"$(percentEncode "${string%%=*}")"="$(percentEncode "${string#*=}")
+}
+
+# 添加解析记录
+add_domain() {
+	local value
+	aliyun_transfer "Action=AddDomainRecord" "DomainName=${__DOMAIN}" "RR=${__HOST}" "Type=${__TYPE}" "Value=${__IP}" || write_log 14 "服务器通信失败"
+	json_cleanup; json_load "$(cat "$DATFILE" 2> /dev/null)" >/dev/null 2>&1
+	json_get_var value "RecordId"
+	[ -z "$value" ] && write_log 14 "添加新解析记录失败"
+	write_log 7 "添加新解析记录成功"
+	return 0
+}
+
+# 修改解析记录
+update_domain() {
+	local value
+	aliyun_transfer "Action=UpdateDomainRecord" "RecordId=${__RECID}" "RR=${__HOST}" "Type=${__TYPE}" "Value=${__IP}" || write_log 14 "服务器通信失败"
+	json_cleanup; json_load "$(cat "$DATFILE" 2> /dev/null)" >/dev/null 2>&1
+	json_get_var value "RecordId"
+	[ -z "$value" ] && write_log 14 "修改解析记录失败"
+	write_log 7 "修改解析记录成功"
+	return 0
+}
+
+# 启用解析记录
+enable_domain() {
+	local value
+	aliyun_transfer "Action=SetDomainRecordStatus" "RecordId=${__RECID}" "Status=Enable" || write_log 14 "服务器通信失败"
+	json_cleanup; json_load "$(cat "$DATFILE" 2> /dev/null)" >/dev/null 2>&1
+	json_get_var value "Status"
+	[ "$value" != "Enable" ] && write_log 14 "启用解析记录失败"
+	write_log 7 "启用解析记录成功"
+	return 0
+}
+
+# 获取子域名解析记录列表
+describe_domain() {
+	local value type; local ret=0
+	aliyun_transfer "Action=DescribeSubDomainRecords" "SubDomain=${__HOST}.${__DOMAIN}" "Type=${__TYPE}" || write_log 14 "服务器通信失败"
+	json_cleanup; json_load "$(cat "$DATFILE" 2> /dev/null)" >/dev/null 2>&1
+	json_get_var value "TotalCount"
+	if [ $value -eq 0 ]; then
+		write_log 7 "解析记录不存在"
+		ret=1
+	else
+		json_select "DomainRecords" >/dev/null 2>&1
+		json_select "Record" >/dev/null 2>&1
+		json_select 1 >/dev/null 2>&1
+		json_get_var value "Locked"
+		[ $value -ne 0 ] && write_log 14 "解析记录被锁定"
+		json_get_var __RECID "RecordId"
+		write_log 7 "获得解析记录ID: ${__RECID}"
+		json_get_var value "Status"
+		[ "$value" != "ENABLE" ] && ret=$(( $ret | 2 )) && write_log 7 "解析记录被禁用"
+		json_get_var type "Type"
+		json_get_var value "Value"
+		[ "$type" != "${__TYPE}" -o "$value" != "${__IP}" ] && ret=$(( $ret | 4 )) && write_log 7 "地址或类型需要修改"
+	fi
+	return $ret
+}
+
+build_command
+describe_domain
+ret=$?
+if [ $ret -eq 1 ]; then
+	sleep 3 && add_domain
+else
+	[ $(( $ret & 2 )) -ne 0 ] && sleep 3 && enable_domain
+	[ $(( $ret & 4 )) -ne 0 ] && sleep 3 && update_domain
+fi
+
+return 0
diff --git a/net/ddns-scripts/files/usr/lib/ddns/dynamic_dns_lucihelper.sh b/net/ddns-scripts/files/usr/lib/ddns/dynamic_dns_lucihelper.sh
index 1268503dd4..c5e2caf112 100644
--- a/net/ddns-scripts/files/usr/lib/ddns/dynamic_dns_lucihelper.sh
+++ b/net/ddns-scripts/files/usr/lib/ddns/dynamic_dns_lucihelper.sh
@@ -24,6 +24,7 @@ Commands:
  verify_dns          given DNS-SERVER
  verify_proxy        given PROXY
  start               start given SECTION
+ stop                stop given SECTION
  reload              force running ddns processes to reload changed configuration
  restart             restart all ddns processes
  stop                stop given SECTION
@@ -154,6 +155,9 @@ case "$1" in
 			"$DDNSPRG" -v "$VERBOSE" -S "$SECTION" -- start
 		fi
 		;;
+	stop)
+		[ -z "$SECTION" ] &&  usage_err "command 'start': 'SECTION' not set"
+		$DDNSPRG -v $VERBOSE -S $SECTION -- stop
 	reload)
 		"$DDNSPRG" -- reload
 		;;
diff --git a/net/ddns-scripts/files/usr/share/ddns/services/aliyun.com.json b/net/ddns-scripts/files/usr/share/ddns/services/aliyun.com.json
new file mode 100644
index 0000000000..c1ad8a5545
--- /dev/null
+++ b/net/ddns-scripts/files/usr/share/ddns/services/aliyun.com.json
@@ -0,0 +1,9 @@
+{
+	"name": "aliyun.com",
+	"ipv4": {
+		"url": "update_aliyun_com.sh"
+	},
+	"ipv6": {
+		"url": "update_aliyun_com.sh"
+	}
+}
diff --git a/net/ieee8021xclient/Makefile b/net/ieee8021xclient/Makefile
index 62a4f27387..5357c1b9cd 100644
--- a/net/ieee8021xclient/Makefile
+++ b/net/ieee8021xclient/Makefile
@@ -20,7 +20,7 @@ define Package/ieee8021xclient
   CATEGORY:=Network
   MAINTAINER:=David Yang <mmyangfl@gmail.com>
   TITLE:=Wired 802.1x client config support
-  DEPENDS:=@(PACKAGE_wpa-supplicant||PACKAGE_wpad)
+  DEPENDS:=+wpad
   PKGARCH:=all
 endef
 
diff --git a/net/ksmbd-tools/Makefile b/net/ksmbd-tools/Makefile
index 0f09c1cc31..cc979b26be 100644
--- a/net/ksmbd-tools/Makefile
+++ b/net/ksmbd-tools/Makefile
@@ -2,11 +2,11 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ksmbd-tools
 PKG_VERSION:=3.5.6
-PKG_RELEASE:=1
+PKG_RELEASE:=20251206
 
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://github.com/cifsd-team/ksmbd-tools/releases/download/$(PKG_VERSION)
-PKG_HASH:=8ce27cf947667b634478186aa7ef91fce68461c781d3880693a4639f8fecc397
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_RELEASE).tar.gz
+PKG_SOURCE_URL:=https://codeload.github.com/ptpt52/ksmbd-tools/tar.gz/$(PKG_RELEASE)?
+PKG_HASH:=49869a135fa2d0f5d2e6bf29b834a607e3344ea7f551426a46ada4e87b8fac7b
 
 PKG_LICENSE:=GPL-2.0-or-later
 PKG_LICENSE_FILES:=COPYING
@@ -18,6 +18,9 @@ include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/nls.mk
 include $(INCLUDE_DIR)/meson.mk
 
+TAR_OPTIONS+= --strip-components 1
+TAR_CMD=$(HOST_TAR) -C $(1) $(TAR_OPTIONS)
+
 define Package/ksmbd-tools/Default
   SECTION:=net
   CATEGORY:=Network
diff --git a/net/ksmbd-tools/files/ksmbd.init b/net/ksmbd-tools/files/ksmbd.init
index f87b392bde..dc6dfb60f4 100644
--- a/net/ksmbd-tools/files/ksmbd.init
+++ b/net/ksmbd-tools/files/ksmbd.init
@@ -36,7 +36,7 @@ config_get_ram()
 
 smb_header()
 {
-	config_get_sane SMBD_IFACE "$1" interface "lan"
+	config_get_sane SMBD_IFACE "$1" interface ""
 
 	# resolve interfaces
 	interfaces=$(
diff --git a/net/ksmbd-tools/patches/030-glib.patch b/net/ksmbd-tools/patches/030-glib.patch
deleted file mode 100644
index 4b9d7a4518..0000000000
--- a/net/ksmbd-tools/patches/030-glib.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- a/meson.build
-+++ b/meson.build
-@@ -21,6 +21,7 @@ include_dirs = include_directories(
- glib_dep = dependency(
-   'glib-2.0',
-   version: '>= 2.58',
-+  static: true,
- )
- libnl_dep = dependency(
-   'libnl-genl-3.0',
diff --git a/net/miniupnpd/Makefile b/net/miniupnpd/Makefile
index 8fa98ebde4..999b70840c 100644
--- a/net/miniupnpd/Makefile
+++ b/net/miniupnpd/Makefile
@@ -8,12 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=miniupnpd
-PKG_VERSION:=2.3.9
-PKG_RELEASE:=2
+PKG_VERSION:=20240802
+PKG_RELEASE:=1
 
-PKG_SOURCE_URL:=https://github.com/miniupnp/miniupnp/releases/download/miniupnpd_$(subst .,_,$(PKG_VERSION))
+PKG_SOURCE_URL:=https://codeload.github.com/x-wrt/miniupnp/tar.gz/$(PKG_VERSION)?
+PKG_HASH:=a4f4fe39f81b53845d7c078d4814aa5e7f0f99fa5e3e35be28ae0c6d3fda3dfc
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_HASH:=66cb3c3d697ab2bb3a61d3c48628166d6ba328d7c2dbeb95898fdf2a3202af7b
+PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION)/miniupnpd
 
 PKG_MAINTAINER:=
 PKG_LICENSE:=BSD-3-Clause
@@ -26,11 +27,14 @@ PKG_BUILD_PARALLEL:=1
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/version.mk
 
+TAR_OPTIONS+= --strip-components 1
+TAR_CMD=$(HOST_TAR) -C $(1)/.. $(TAR_OPTIONS)
+
 define Package/miniupnpd/Default
   SECTION:=net
   CATEGORY:=Network
   DEPENDS:= \
-	+libcap-ng \
+	+libcap \
 	+libmnl \
 	+libuuid
   PROVIDES:=miniupnpd
@@ -74,24 +78,20 @@ define Build/Prepare
 endef
 
 CONFIGURE_ARGS = \
-	--disable-fork \
-	--disable-pppconn \
-	--firewall=$(BUILD_VARIANT) \
-	--igd2 \
 	$(if $(CONFIG_IPV6),--ipv6) \
+	--igd2 \
 	--leasefile \
 	--portinuse \
-	--regex \
-	--vendorcfg
+	--firewall=$(BUILD_VARIANT) \
+	--disable-fork \
+	--regex
 
 TARGET_CFLAGS += $(FPIC)
 TARGET_LDFLAGS += -Wl,--gc-sections,--as-needed
 
 ifeq ($(BUILD_VARIANT),iptables)
-ifeq ($(filter $(ARCH),mips mipsel),)
 	TARGET_CFLAGS += -flto
 endif
-endif
 
 define Package/miniupnpd/install/Default
 	$(INSTALL_DIR) $(1)/usr/sbin
@@ -102,6 +102,10 @@ define Package/miniupnpd/install/Default
 	$(INSTALL_BIN) ./files/miniupnpd.init $(1)/etc/init.d/miniupnpd
 	$(INSTALL_CONF) ./files/upnpd.config $(1)/etc/config/upnpd
 	$(INSTALL_DATA) ./files/miniupnpd.hotplug $(1)/etc/hotplug.d/iface/50-miniupnpd
+	$(INSTALL_DIR) $(1)/usr/share/miniupnpd
+	$(INSTALL_DATA) ./files/core.sh $(1)/usr/share/miniupnpd/core.sh
+	$(INSTALL_DIR) $(1)/etc/uci-defaults
+	$(INSTALL_BIN) ./files/miniupnpd.defaults.iptables $(1)/etc/uci-defaults/99-miniupnpd-nft
 endef
 
 define Package/miniupnpd-iptables/install
@@ -114,8 +118,6 @@ endef
 
 define Package/miniupnpd-nftables/install
 	$(call Package/miniupnpd/install/Default,$1)
-	$(INSTALL_DIR) $(1)/usr/share/nftables.d
-	$(CP) ./files/nftables.d/* $(1)/usr/share/nftables.d/
 endef
 
 $(eval $(call BuildPackage,miniupnpd-iptables))
diff --git a/net/miniupnpd/files/core.sh b/net/miniupnpd/files/core.sh
new file mode 100644
index 0000000000..298d0e2833
--- /dev/null
+++ b/net/miniupnpd/files/core.sh
@@ -0,0 +1,85 @@
+#!/bin/sh
+
+#addrule ifname iaddr iport eport proto
+#delrule eport proto
+
+CMDLINE="sh $0 $@"
+cmd=$1
+
+test -e /usr/share/miniupnpd/nft.include || \
+ln -s /tmp/run/miniupnpd.nft /usr/share/miniupnpd/nft.include && \
+touch /tmp/run/miniupnpd.nft
+
+case $cmd in
+	addrule)
+	ifname=$2
+	iaddr=$3
+	iport=$4
+	eport=$5
+	proto=$6
+	nft -a list chain inet fw4 dstnat | grep -o "miniupnpd-$eport-$proto-dstnat.*" | while read _ _ _ handle; do nft delete rule inet fw4 dstnat handle $handle; done
+	line="nft insert rule inet fw4 dstnat iifname $ifname meta nfproto ipv4 $proto dport $eport counter dnat to $iaddr:$iport comment miniupnpd-$eport-$proto-dstnat"
+	$line;
+	if [ "$proto" = "udp" ]; then
+		grep "miniupnpd-$eport-$proto-dstnat" /tmp/run/miniupnpd.nft | while read _ _ _ _ _iaddr _iport _eport _proto _; do
+			sh /usr/share/natcapd/natcapd.cone_nat_unused.sh delrule $_iaddr $_iport $_eport
+		done
+		sh /usr/share/natcapd/natcapd.cone_nat_unused.sh addrule $iaddr $iport $eport
+	fi
+
+	nft -a list chain inet fw4 forward_wan | grep -o "miniupnpd-$eport-$proto-forward_wan.*" | while read _ _ _ handle; do nft delete rule inet fw4 forward_wan handle $handle; done
+	line="nft insert rule inet fw4 forward_wan ip daddr $iaddr $proto dport $iport counter accept comment miniupnpd-$eport-$proto-forward_wan"
+	$line;
+
+	nft -a list chain inet fw4 srcnat | grep -o "miniupnpd-$eport-$proto-srcnat.*" | while read _ _ _ handle; do nft delete rule inet fw4 srcnat handle $handle; done
+	line="nft insert rule inet fw4 srcnat ip saddr $iaddr $proto sport $iport counter masquerade to :$eport comment miniupnpd-$eport-$proto-srcnat"
+	$line;
+
+	sed -i "s%.*miniupnpd-$eport-$proto-dstnat%$CMDLINE #miniupnpd-$eport-$proto-dstnat%" /tmp/run/miniupnpd.nft
+	grep -q "miniupnpd-$eport-$proto-dstnat" /tmp/run/miniupnpd.nft || echo "$CMDLINE #miniupnpd-$eport-$proto-dstnat" >>/tmp/run/miniupnpd.nft
+	;;
+
+	delrule)
+	eport=$2
+	proto=$3
+	if [ "$proto" = "udp" ]; then
+		grep "miniupnpd-$eport-$proto-dstnat" /tmp/run/miniupnpd.nft | while read _ _ _ _ _iaddr _iport _eport _proto _; do
+			sh /usr/share/natcapd/natcapd.cone_nat_unused.sh delrule $_iaddr $_iport $_eport
+		done
+	fi
+	nft -a list chain inet fw4 dstnat | grep -o "miniupnpd-$eport-$proto-dstnat.*" | while read _ _ _ handle; do nft delete rule inet fw4 dstnat handle $handle; done
+
+	nft -a list chain inet fw4 forward_wan | grep -o "miniupnpd-$eport-$proto-forward_wan.*" | while read _ _ _ handle; do nft delete rule inet fw4 forward_wan handle $handle; done
+
+	nft -a list chain inet fw4 srcnat | grep -o "miniupnpd-$eport-$proto-srcnat.*" | while read _ _ _ handle; do nft delete rule inet fw4 srcnat handle $handle; done
+
+	sed -i "/.*miniupnpd-$eport-$proto-dstnat/d" /tmp/run/miniupnpd.nft
+	;;
+
+	stop)
+	grep "miniupnpd-.*-udp-dstnat" /tmp/run/miniupnpd.nft | while read _ _ _ _ _iaddr _iport _eport _proto _; do
+		sh /usr/share/natcapd/natcapd.cone_nat_unused.sh delrule $_iaddr $_iport $_eport
+	done
+	nft -a list chain inet fw4 dstnat | grep -o "miniupnpd-.*-dstnat.*" | while read _ _ _ handle; do nft delete rule inet fw4 dstnat handle $handle; done
+	nft -a list chain inet fw4 forward_wan | grep -o "miniupnpd-.*-forward_wan.*" | while read _ _ _ handle; do nft delete rule inet fw4 forward_wan handle $handle; done
+	nft -a list chain inet fw4 srcnat | grep -o "miniupnpd-.*-srcnat.*" | while read _ _ _ handle; do nft delete rule inet fw4 srcnat handle $handle; done
+	echo -n >/tmp/run/miniupnpd.nft
+	;;
+
+	delfwindex)
+	handle=$2
+	## iifname "pppoe-wan" meta nfproto ipv4 udp dport 1236 counter packets 0 bytes 0 dnat ip to 192.168.16.101:1234 comment "miniupnpd-1236-udp-dstnat" # handle 4625
+	line=$(nft -a list chain inet fw4 dstnat | grep ".* # handle $handle$")
+	proto=${line/* meta nfproto ipv4 /}
+	eport=${proto/* dport /}
+	eport=${eport/ counter */}
+	proto=${proto/ dport */}
+	lease=$(uci get upnpd.config.upnp_lease_file)
+	test -f "$lease" && {
+		PROTO=$(echo -n $proto | tr a-z A-Z)
+		sed -i "/$PROTO:$eport:/d" "$lease"
+	}
+	sh $0 delrule $eport $proto
+	/etc/init.d/miniupnpd restart
+	;;
+esac
diff --git a/net/miniupnpd/files/firewall3.include b/net/miniupnpd/files/firewall3.include
index 4fd4839743..926e2c85ff 100644
--- a/net/miniupnpd/files/firewall3.include
+++ b/net/miniupnpd/files/firewall3.include
@@ -20,8 +20,9 @@ iptables_prepend_rule() {
 	local chain="$3"
 	local target="$4"
 
-	$iptables "$IPTARGS" -t "$table" -I "$chain" $($iptables "$IPTARGS" -t "$table" --line-numbers -nL "$chain" | \
-		sed -ne '$s/[^0-9].*//p') -j "$target"
+	NR=`$iptables "$IPTARGS" -t "$table" --line-numbers -nL "$chain"; $iptables "$IPTARGS" -t "$table" --line-numbers -nL "$chain" | grep ".*MASQUERADE.*udp.*random-fully.*"`
+	NR=`echo "$NR" | sed -ne '$s/[^0-9].*//p'`
+	$iptables "$IPTARGS" -t "$table" -I "$chain" $NR -j "$target"
 }
 
 ADDED=0
diff --git a/net/miniupnpd/files/miniupnpd.defaults.iptables b/net/miniupnpd/files/miniupnpd.defaults.iptables
index 7271389d3b..41defc6c6f 100644
--- a/net/miniupnpd/files/miniupnpd.defaults.iptables
+++ b/net/miniupnpd/files/miniupnpd.defaults.iptables
@@ -2,12 +2,10 @@
 
 uci -q batch <<-EOT
 	delete firewall.miniupnpd
-	set firewall.miniupnpd=include
-	set firewall.miniupnpd.type=script
-	set firewall.miniupnpd.path=/usr/share/miniupnpd/firewall.include
-	set firewall.miniupnpd.family=any
-	set firewall.miniupnpd.reload=1
 	commit firewall
 EOT
 
+grep -q "^sh /usr/share/miniupnpd/nft.include" /etc/firewall.include || \
+echo "sh /usr/share/miniupnpd/nft.include" >>/etc/firewall.include
+
 exit 0
diff --git a/net/miniupnpd/files/miniupnpd.hotplug b/net/miniupnpd/files/miniupnpd.hotplug
index 607a32bdc6..cf36346f54 100644
--- a/net/miniupnpd/files/miniupnpd.hotplug
+++ b/net/miniupnpd/files/miniupnpd.hotplug
@@ -23,8 +23,7 @@ else
 	if [ -n "$external_zone" ] ; then
 		ifname=$($FW -q zone "$external_zone" 2>/dev/null | head -1)
 	else
-		network_find_wan external_iface && \
-			network_get_device ifname "$external_iface"
+		ifname=$(ip r | grep default | grep -o "dev .*" | awk '{print $2}' | head -1)
 	fi
 fi
 if [ -n "$external_iface6" ] ; then
@@ -33,8 +32,7 @@ else
 	if [ -n "$external_zone" ] ; then
 		ifname6=$($FW -q zone "$external_zone" 2>/dev/null | head -1)
 	else
-		network_find_wan6 external_iface6 && \
-			network_get_device ifname6 "$external_iface6"
+		ifname6=$(ip -6 r | grep default | grep -o "dev .*" | awk '{print $2}' | head -1)
 	fi
 fi
 
diff --git a/net/miniupnpd/files/miniupnpd.init b/net/miniupnpd/files/miniupnpd.init
index bb15b15cb9..bbfc039ff4 100644
--- a/net/miniupnpd/files/miniupnpd.init
+++ b/net/miniupnpd/files/miniupnpd.init
@@ -61,7 +61,9 @@ upnpd() {
 	local external_iface external_iface6 external_zone external_ip internal_iface
 	local upload download log_output port config_file serial_number model_number
 	local use_stun stun_host stun_port uuid notify_interval presentation_url
-	local upnp_lease_file upnp_lease_file6 ipv6_disable
+	local upnp_lease_file clean_ruleset_threshold clean_ruleset_interval
+	local ipv6_disable
+	local force_forwarding
 
 	local enabled
 	config_get_bool enabled config enabled 1
@@ -86,8 +88,10 @@ upnpd() {
 	config_get notify_interval config notify_interval
 	config_get presentation_url config presentation_url
 	config_get upnp_lease_file config upnp_lease_file
-	config_get upnp_lease_file6 config upnp_lease_file6
+	config_get clean_ruleset_threshold config clean_ruleset_threshold
+	config_get clean_ruleset_interval config clean_ruleset_interval
 	config_get ipv6_disable config ipv6_disable 0
+	config_get force_forwarding config force_forwarding 0
 
 	local conf ifname ifname6
 
@@ -99,8 +103,7 @@ upnpd() {
 		if [ -n "$external_zone" ] ; then
 			ifname=$($FW -q zone "$external_zone" 2>/dev/null | head -1)
 		else
-			network_find_wan external_iface && \
-				network_get_device ifname "$external_iface"
+			ifname=$(ip r | grep default | grep -o "dev .*" | awk '{print $2}' | head -1)
 		fi
 	fi
 	if [ -n "$external_iface6" ] ; then
@@ -109,8 +112,7 @@ upnpd() {
 		if [ -n "$external_zone" ] ; then
 			ifname6=$($FW -q zone "$external_zone" 2>/dev/null | head -1)
 		else
-			network_find_wan6 external_iface6 && \
-				network_get_device ifname6 "$external_iface6"
+			ifname6=$(ip -6 r | grep default | grep -o "dev .*" | awk '{print $2}' | head -1)
 		fi
 	fi
 
@@ -140,6 +142,7 @@ upnpd() {
 		upnpd_write_bool igdv1 0 force_igd_desc_v1
 		upnpd_write_bool use_stun 0 ext_perform_stun
 		upnpd_write_bool ipv6_disable $ipv6_disable
+		upnpd_write_bool force_forwarding $force_forwarding
 
 		[ "$use_stun" -eq 0 ] || {
 			[ -n "$stun_host" ] && echo "ext_stun_host=$stun_host"
@@ -152,9 +155,10 @@ upnpd() {
 		}
 
 		[ -n "$upnp_lease_file" ] && touch "$upnp_lease_file" && echo "lease_file=$upnp_lease_file"
-		[ -n "$upnp_lease_file6" ] && touch "$upnp_lease_file6" && echo "lease_file6=$upnp_lease_file6"
 		[ -n "$presentation_url" ] && echo "presentation_url=$presentation_url"
 		[ -n "$notify_interval" ] && echo "notify_interval=$notify_interval"
+		[ -n "$clean_ruleset_threshold" ] && echo "clean_ruleset_threshold=$clean_ruleset_threshold"
+		[ -n "$clean_ruleset_interval" ] && echo "clean_ruleset_interval=$clean_ruleset_interval"
 		[ -n "$serial_number" ] && echo "serial=$serial_number"
 		[ -n "$model_number" ] && echo "model_number=$model_number"
 		[ -n "$port" ] && echo "port=$port"
@@ -169,25 +173,12 @@ upnpd() {
 
 		config_foreach conf_rule_add perm_rule
 
-		if [ "$FW" = "fw4" ]; then
-			#When using nftables configure miniupnpd to use its own table and chains
-			echo "upnp_table_name=fw4"
-			echo "upnp_nat_table_name=fw4"
-			echo "upnp_forward_chain=upnp_forward"
-			echo "upnp_nat_chain=upnp_prerouting"
-			echo "upnp_nat_postrouting_chain=upnp_postrouting"
-		fi
-
 		} > "$tmpconf"
 	fi
 
 	if [ -n "$ifname" ]; then
 		# start firewall
-		if [ "$FW" = "fw4" ]; then
-			nft -s -t -n list chain inet fw4 upnp_forward >/dev/null 2>&1 || fw4 reload
-		else
-			iptables -L MINIUPNPD >/dev/null 2>&1 || fw3 reload
-		fi
+		:
 	else
 		logger -t "upnp daemon" "external interface not found, not starting"
 	fi
@@ -201,16 +192,7 @@ upnpd() {
 }
 
 stop_service() {
-	if [ "$FW" = "fw3" ]; then
-		iptables -t nat -F MINIUPNPD 2>/dev/null
-		iptables -t nat -F MINIUPNPD-POSTROUTING 2>/dev/null
-		iptables -t filter -F MINIUPNPD 2>/dev/null
-		[ -x /usr/sbin/ip6tables ] && ip6tables -t filter -F MINIUPNPD 2>/dev/null
-	else
-		nft flush chain inet fw4 upnp_forward 2>/dev/null
-		nft flush chain inet fw4 upnp_prerouting 2>/dev/null
-		nft flush chain inet fw4 upnp_postrouting 2>/dev/null
-	fi
+	sh /usr/share/miniupnpd/core.sh stop
 }
 
 start_service() {
diff --git a/net/miniupnpd/files/upnpd.config b/net/miniupnpd/files/upnpd.config
index c4546e018f..9ac378dcac 100644
--- a/net/miniupnpd/files/upnpd.config
+++ b/net/miniupnpd/files/upnpd.config
@@ -2,6 +2,7 @@ config upnpd config
 	option enabled		0
 	option enable_natpmp	1
 	option enable_upnp	1
+	option force_forwarding 1
 	option secure_mode	1
 	option log_output	0
 	option download		1024
@@ -11,8 +12,11 @@ config upnpd config
 	option internal_iface	lan
 	option port		5000
 	option upnp_lease_file	/var/run/miniupnpd.leases
-	option upnp_lease_file6	/var/run/miniupnpd.leases6
 	option igdv1		1
+	option ipv6_disable 1
+	option stun_host 'stun.miwifi.com'
+	option stun_port '3478'
+	option use_stun '1'
 
 config perm_rule
 	option action		allow
diff --git a/net/miniupnpd/patches/200-remove-default-cflags.patch b/net/miniupnpd/patches/200-remove-default-cflags.patch
new file mode 100644
index 0000000000..0a1ba0a233
--- /dev/null
+++ b/net/miniupnpd/patches/200-remove-default-cflags.patch
@@ -0,0 +1,24 @@
+--- a/Makefile.linux
++++ b/Makefile.linux
+@@ -25,16 +25,16 @@ CONFIG_OPTIONS ?= $(cat .configure.cache
+ CONFIG_OPTIONS += --firewall=iptables
+ #CFLAGS = -O -g -DDEBUG
+ CFLAGS ?= -Os
+-CFLAGS += -fno-strict-aliasing
+-CFLAGS += -fno-common
+-CFLAGS += -fstack-protector -fPIE
+-CFLAGS += -D_FORTIFY_SOURCE=2
++#CFLAGS += -fno-strict-aliasing
++#CFLAGS += -fno-common
++#CFLAGS += -fstack-protector -fPIE
++#CFLAGS += -D_FORTIFY_SOURCE=2
+ CPPFLAGS += -D_GNU_SOURCE
+ CFLAGS += -Wall
+ CFLAGS += -Wextra -Wstrict-prototypes -Wdeclaration-after-statement
+ #CFLAGS += -Wno-missing-field-initializers
+ #CFLAGS += -ansi	# iptables headers does use typeof which is a gcc extension
+-LDFLAGS += -Wl,-z,now -Wl,-z,relro -pie
++LDFLAGS ?= -Wl,-z,now -Wl,-z,relro -pie
+ CC ?= gcc
+ RM = rm -f
+ INSTALL = install
diff --git a/net/miniupnpd/patches/300-fixup.patch b/net/miniupnpd/patches/300-fixup.patch
new file mode 100644
index 0000000000..5e8251c178
--- /dev/null
+++ b/net/miniupnpd/patches/300-fixup.patch
@@ -0,0 +1,13 @@
+diff --git a/netfilter_nft/nftnlrdr_misc.c b/netfilter_nft/nftnlrdr_misc.c
+index 7f227ee..da65be0 100644
+--- a/netfilter_nft/nftnlrdr_misc.c
++++ b/netfilter_nft/nftnlrdr_misc.c
+@@ -305,7 +305,7 @@ parse_rule_nat(struct nftnl_expr *e, rule_t *r)
+ 	reg_val_ptr = get_reg_val_ptr(r, addr_min_reg);
+ 	if (reg_val_ptr != NULL) {
+ 		r->nat_addr = (in_addr_t)*reg_val_ptr;
+-		if (proto_min_reg == NFT_REG_1) {
++		if (proto_min_reg == NFT_REG_1 || proto_min_reg == NFT_REG_2) {
+ 			r->nat_port = proto_min_val;
+ 		}
+ 	} else {
diff --git a/net/nginx-util/files/nginx.config b/net/nginx-util/files/nginx.config
index 4f07ae1d4d..7c9d342bcc 100644
--- a/net/nginx-util/files/nginx.config
+++ b/net/nginx-util/files/nginx.config
@@ -6,7 +6,7 @@ config server '_lan'
 	list listen '443 ssl default_server'
 	list listen '[::]:443 ssl default_server'
 	option server_name '_lan'
-	list include 'restrict_locally'
+	#list include 'restrict_locally'
 	list include 'conf.d/*.locations'
 	option uci_manage_ssl 'self-signed'
 	option ssl_certificate '/etc/nginx/conf.d/_lan.crt'
@@ -19,4 +19,6 @@ config server '_redirect2ssl'
 	list listen '80'
 	list listen '[::]:80'
 	option server_name '_redirect2ssl'
-	option return '302 https://$host$request_uri'
+	#option return '302 https://$host$request_uri'
+	list include 'conf.d/*.locations'
+	option access_log 'off; # logd openwrt'
diff --git a/net/nginx-util/files/uci.conf.template b/net/nginx-util/files/uci.conf.template
index a9532576ce..f79d0c3af1 100644
--- a/net/nginx-util/files/uci.conf.template
+++ b/net/nginx-util/files/uci.conf.template
@@ -21,7 +21,7 @@ http {
 	default_type application/octet-stream;
 	sendfile on;
 
-	client_max_body_size 128M;
+	client_max_body_size 256M;
 	large_client_header_buffers 2 1k;
 
 	gzip on;
diff --git a/net/nginx-util/src/nginx-ssl-util.hpp b/net/nginx-util/src/nginx-ssl-util.hpp
index 5a64b000a8..3432bfe741 100644
--- a/net/nginx-util/src/nginx-ssl-util.hpp
+++ b/net/nginx-util/src/nginx-ssl-util.hpp
@@ -166,14 +166,9 @@ static constexpr auto _escape = _Line{
         std::string ret{};
         for (char c : strptr) {
             switch (c) {
-                case '^':
-                    ret += '\\';
-                    ret += c;
-                    break;
-                case '_':
-                case '-':
-                    ret += c;
-                    break;
+                case '^': ret += '\\'; /* fallthrough */
+                case '_': /* fallthrough */
+                case '-': ret += c; break;
                 default:
                     if ((isalpha(c) != 0) || (isdigit(c) != 0)) {
                         ret += c;
@@ -456,7 +451,7 @@ inline void create_ssl_certificate(const std::string& crtpath,
 
         write_key(pkey, tmpkeypath);
 
-        std::string subject{"/C=ZZ/ST=Somewhere/L=None/CN=OpenWrt/O=OpenWrt"};
+        std::string subject{"/C=ZZ/ST=Somewhere/L=None/CN=x-wrt.lan/O=x-wrt.lan"};
         subject += noncestr.data();
 
         selfsigned(pkey, days, subject, tmpcrtpath);
diff --git a/net/nginx-util/src/nginx-util.cpp b/net/nginx-util/src/nginx-util.cpp
index 3b4ad8c60e..5ffe5209fc 100644
--- a/net/nginx-util/src/nginx-util.cpp
+++ b/net/nginx-util/src/nginx-util.cpp
@@ -20,7 +20,7 @@ void create_lan_listen()  // create empty files for compatibility:
     // TODO(pst): replace by dummies after transitioning nginx config to UCI:
     std::vector<std::string> ips;
 
-#ifndef NO_UBUS
+#if 0
     try {
         auto loopback_status = ubus::call("network.interface.loopback", "status");
 
@@ -54,7 +54,8 @@ void create_lan_listen()  // create empty files for compatibility:
     catch (const std::runtime_error&) { /* do nothing about it */
     }
 #else
-    ips.emplace_back("127.0.0.1");
+    ips.emplace_back("0.0.0.0");
+    ips.emplace_back("[::]");
 #endif
 
     std::string listen = std::string{file_comment_auto_created};
diff --git a/net/nginx/Makefile b/net/nginx/Makefile
index 6a86d896a0..8dd00c3360 100644
--- a/net/nginx/Makefile
+++ b/net/nginx/Makefile
@@ -23,7 +23,7 @@ PKG_CPE_ID:=cpe:/a:f5:nginx_open_source
 PKG_FIXUP:=autoreconf
 PKG_BUILD_PARALLEL:=1
 PKG_INSTALL:=1
-PKG_BUILD_FLAGS:=gc-sections lto
+PKG_BUILD_FLAGS:=gc-sections
 
 # 3rd-party modules
 PKG_MOD_EXTRA := \
diff --git a/net/nginx/files-luci-support/60_nginx-luci-support b/net/nginx/files-luci-support/60_nginx-luci-support
index 8f1eef44e7..757727a6ae 100644
--- a/net/nginx/files-luci-support/60_nginx-luci-support
+++ b/net/nginx/files-luci-support/60_nginx-luci-support
@@ -1,5 +1,9 @@
 #!/bin/sh
 
+grep -r -l ngx_http_ubus_module.so /etc/nginx/module.d | grep -v ngx_http_ubus.module | while read file; do
+	rm -f $file
+done
+
 if nginx -V 2>&1 | grep -q ubus && [ -f /usr/lib/nginx/modules/ngx_http_ubus_module.so ]; then
 	if [ -z "$(cat /etc/nginx/conf.d/luci.locations | grep ubus)" ]; then
 		cat <<EOT >> /etc/nginx/conf.d/luci.locations
diff --git a/net/nginx/files-luci-support/luci.locations b/net/nginx/files-luci-support/luci.locations
index 374ee5d9fc..bdce530b01 100644
--- a/net/nginx/files-luci-support/luci.locations
+++ b/net/nginx/files-luci-support/luci.locations
@@ -15,3 +15,11 @@ location ~ /cgi-bin/cgi-(backup|download|upload|exec) {
 location /luci-static {
 		error_log stderr crit;
 }
+
+location /jsonrpc {
+		proxy_set_header Host $http_host;
+		proxy_set_header X-NginX-Proxy true;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_pass http://127.0.0.1:6800;
+}
diff --git a/net/nginx/files/nginx.init b/net/nginx/files/nginx.init
index a6b6ebea3d..c6c03c0d59 100644
--- a/net/nginx/files/nginx.init
+++ b/net/nginx/files/nginx.init
@@ -46,13 +46,17 @@ nginx_check_luci_template() {
 }
 
 nginx_init() {
+	eval $("${NGINX_UTIL}" get_env)
 	[ -z "${CONF}" ] || return # already called.
 
 	[ -d /var/log/nginx ] || mkdir -p /var/log/nginx
 	[ -d /var/lib/nginx ] || mkdir -p /var/lib/nginx
 
 	rm -f "$(readlink "${UCI_CONF}")"
-	${NGINX_UTIL} init_lan
+	for i in 1 2 3; do
+		busybox timeout 30 ${NGINX_UTIL} init_lan && break
+		logger -t "nginx_init" -p "daemon.info" "${NGINX_UTIL} init_lan timeout"
+	done
 
 	if [ -f $UCI_CONF_TEMPLATE ]; then
 		nginx_check_luci_template
@@ -124,6 +128,7 @@ configure_mdns() {
 }
 
 start_service() {
+	eval $("${NGINX_UTIL}" get_env)
 	nginx_init
 
 	procd_open_instance
@@ -141,6 +146,7 @@ start_service() {
 
 
 reload_service() {
+	eval $("${NGINX_UTIL}" get_env)
 	nginx_init
 
 	if [ "$(cat "/proc/$(cat "/var/run/nginx.pid")/cmdline")" = \
diff --git a/net/nginx/patches/nginx/102-sizeof_test_fix.patch b/net/nginx/patches/nginx/102-sizeof_test_fix.patch
index 823e7eabb9..7d2430eab9 100644
--- a/net/nginx/patches/nginx/102-sizeof_test_fix.patch
+++ b/net/nginx/patches/nginx/102-sizeof_test_fix.patch
@@ -4,7 +4,7 @@
  $NGX_INCLUDE_INTTYPES_H
  $NGX_INCLUDE_AUTO_CONFIG_H
  
-+volatile char object_code_block[] = {
++char object_code_block[] = {
 +	'\n', 'e', '4', 'V', 'A',
 +	'0', 'x', ('0' + sizeof($ngx_type)),
 +	'Y', '3', 'p', 'M', '\n'
diff --git a/net/p910nd/files/p910nd.init b/net/p910nd/files/p910nd.init
index cfb3bbd956..ebd2a464d1 100644
--- a/net/p910nd/files/p910nd.init
+++ b/net/p910nd/files/p910nd.init
@@ -87,6 +87,8 @@ start_p910nd() {
 			# Call procd_add_mdns with the positional parameters
 			MDNS_INSTANCE_NAME="$mdns_ty" procd_add_mdns "$@"
 		fi
+		procd_set_param stdout 1 # relay stdout to logd
+		procd_set_param stderr 1 # relay stderr to logd
 		procd_close_instance
 	fi
 }
diff --git a/net/p910nd/patches/10-p910nd-timeout.patch b/net/p910nd/patches/10-p910nd-timeout.patch
new file mode 100644
index 0000000000..6f41469fdc
--- /dev/null
+++ b/net/p910nd/patches/10-p910nd-timeout.patch
@@ -0,0 +1,35 @@
+diff --git a/p910nd.c b/p910nd.c
+index 2fa4454..e89aa4d 100644
+--- a/p910nd.c
++++ b/p910nd.c
+@@ -401,11 +401,13 @@ int copy_stream(int fd, int lp)
+ 		struct timeval now;
+ 		struct timeval then;
+ 		struct timeval timeout;
++		struct timeval last_read_time;
+ 		int timer = 0;
+ 		Buffer_t printerToNetworkBuffer;
+ 		initBuffer(&printerToNetworkBuffer, lp, fd, 0);
+ 		fd_set readfds;
+ 		fd_set writefds;
++		gettimeofday(&last_read_time, 0);
+ 		/* Finish when network sent EOF. */
+ 		/* Although the printer to network stream may not be finished (does this matter?) */
+ 		while (!networkToPrinterBuffer.eof_sent && !networkToPrinterBuffer.err) {
+@@ -433,8 +435,15 @@ int copy_stream(int fd, int lp)
+ 			if (FD_ISSET(fd, &readfds)) {
+ 				/* Read network data. */
+ 				result = readBuffer(&networkToPrinterBuffer);
+-				if (result > 0)
++				if (result > 0) {
+ 					dolog(LOG_DEBUG,"read %d bytes from network\n",result);
++					gettimeofday(&last_read_time, 0);
++				}
++			}
++			gettimeofday(&now, 0);
++			if (now.tv_sec - last_read_time.tv_sec >= 30) {
++				dolog(LOG_NOTICE,"read no data from network for 30s, stop copy stream\n");
++				break;
+ 			}
+ 			if (FD_ISSET(lp, &readfds)) {
+ 				/* Read printer data, but pace it more slowly. */
diff --git a/net/p910nd/patches/20-refine.patch b/net/p910nd/patches/20-refine.patch
new file mode 100644
index 0000000000..4997f77a73
--- /dev/null
+++ b/net/p910nd/patches/20-refine.patch
@@ -0,0 +1,177 @@
+diff --git a/p910nd.c b/p910nd.c
+index e89aa4d..51210ca 100644
+--- a/p910nd.c
++++ b/p910nd.c
+@@ -159,6 +159,8 @@ typedef struct {
+ 	int eof_read;		/* Nonzero indicates the input file has reached EOF. */
+ 	int eof_sent;		/* Nonzero indicates the output file has fully received all data. */
+ 	int err;		/* Nonzero indicates an error detected on the output file. */
++#define READ_ERR  0x01
++#define WRITE_ERR 0x02
+ 	char buffer[BUFFER_SIZE];	/* Buffered data goes here. */
+ } Buffer_t;
+ 
+@@ -293,7 +295,7 @@ void initBuffer(Buffer_t * b, int infd, int outfd, int detectEof)
+ /* Sets the readfds and writefds (used by select) based on current buffer state. */
+ void prepBuffer(Buffer_t * b, fd_set * readfds, fd_set * writefds)
+ {
+-	if (b->outfd>=0 && !b->err && (b->bytes != 0 || b->eof_read)) {
++	if (b->outfd>=0 && (!(b->err & WRITE_ERR)) && (b->bytes != 0 || b->eof_read)) {
+ 		FD_SET(b->outfd, writefds);
+ 	}
+ 	if (b->infd>=0 && !b->eof_read && b->bytes < sizeof(b->buffer)) {
+@@ -334,7 +336,7 @@ ssize_t readBuffer(Buffer_t * b)
+ 			}
+ 		} else if (result < 0) {
+ 			dolog(LOGOPTS, "read: %m\n");
+-			b->err = 1;
++			b->err |= READ_ERR;
+ 		}
+ 		else if (b->detectEof) {
+ 			dolog(LOG_DEBUG, "read: eof\n");
+@@ -351,15 +353,11 @@ ssize_t writeBuffer(Buffer_t * b)
+ {
+ 	int avail;
+ 	ssize_t result = 0;
+-	if (b->bytes == 0 || b->err) {
++	if (b->bytes == 0 || (b->err & WRITE_ERR)) {
+ 		/* Buffer is empty. */
+ 		avail = 0;
+-	} else if (b->endidx > b->startidx) {
+-		/* Buffer is not wrapped. Can write all the data. */
+-		avail = b->endidx - b->startidx;
+ 	} else {
+-		/* Buffer is wrapped. Can only write the top (first) part. */
+-		avail = sizeof(b->buffer) - b->startidx;
++		avail = b->bytes;
+ 	}
+ 	if (avail) {
+ 		if (b->outfd>=0)
+@@ -369,7 +367,7 @@ ssize_t writeBuffer(Buffer_t * b)
+ 		if (result < 0) {
+ 			/* Mark the output file in an error condition. */
+ 			dolog(LOGOPTS, "write: %m\n");
+-			b->err = 1;
++			b->err |= WRITE_ERR;
+ 		} else {
+ 			/* Zero or more bytes were written. */
+ 			b->startidx += result;
+@@ -382,8 +380,10 @@ ssize_t writeBuffer(Buffer_t * b)
+ 			}
+ 		}
+ 	}
+-	else if (b->eof_read)
++	else if (b->eof_read) {
+ 		b->eof_sent = 1;
++		dolog(LOG_DEBUG, "write: eof\n");
++	}
+ 	
+ 	/* Return the write() result, -1 (error) or #bytes written. */
+ 	return result;
+@@ -393,6 +393,7 @@ ssize_t writeBuffer(Buffer_t * b)
+ /* If bidir, also copy data from printer (lp) to network (fd). */
+ int copy_stream(int fd, int lp)
+ {
++	int need_clear_lp = 0;
+ 	int result;
+ 	Buffer_t networkToPrinterBuffer;
+ 	initBuffer(&networkToPrinterBuffer, fd, lp, 1);
+@@ -410,7 +411,7 @@ int copy_stream(int fd, int lp)
+ 		gettimeofday(&last_read_time, 0);
+ 		/* Finish when network sent EOF. */
+ 		/* Although the printer to network stream may not be finished (does this matter?) */
+-		while (!networkToPrinterBuffer.eof_sent && !networkToPrinterBuffer.err) {
++		while (!networkToPrinterBuffer.eof_sent && !(networkToPrinterBuffer.err & WRITE_ERR) && !(printerToNetworkBuffer.err & WRITE_ERR)) {
+ 			FD_ZERO(&readfds);
+ 			FD_ZERO(&writefds);
+ 			prepBuffer(&networkToPrinterBuffer, &readfds, &writefds);
+@@ -427,6 +428,7 @@ int copy_stream(int fd, int lp)
+ 				else
+ 					FD_CLR(lp, &readfds);
+ 			}
++			gettimeofday(&now, 0);
+ 			timeout.tv_sec = 0;
+ 			timeout.tv_usec = 100000;
+ 			result = select(maxfd + 1, &readfds, &writefds, 0, &timeout);
+@@ -436,11 +438,10 @@ int copy_stream(int fd, int lp)
+ 				/* Read network data. */
+ 				result = readBuffer(&networkToPrinterBuffer);
+ 				if (result > 0) {
+-					dolog(LOG_DEBUG,"read %d bytes from network\n",result);
++					dolog(LOG_DEBUG,"%d.%d: read %d bytes from network\n", (int)now.tv_sec, (int)now.tv_usec, result);
+ 					gettimeofday(&last_read_time, 0);
+ 				}
+ 			}
+-			gettimeofday(&now, 0);
+ 			if (now.tv_sec - last_read_time.tv_sec >= 30) {
+ 				dolog(LOG_NOTICE,"read no data from network for 30s, stop copy stream\n");
+ 				break;
+@@ -449,7 +450,7 @@ int copy_stream(int fd, int lp)
+ 				/* Read printer data, but pace it more slowly. */
+ 				result = readBuffer(&printerToNetworkBuffer);
+ 				if (result > 0) {
+-					dolog(LOG_DEBUG,"read %d bytes from printer\n",result);
++					dolog(LOG_DEBUG,"%d.%d: read %d bytes from printer\n", (int)now.tv_sec, (int)now.tv_usec, result);
+ 					gettimeofday(&then, 0);
+ 					// wait 100 msec before reading again.
+ 					then.tv_usec += 100000;
+@@ -457,16 +458,35 @@ int copy_stream(int fd, int lp)
+ 						then.tv_usec -= 1000000;
+ 						then.tv_sec++;
+ 					}
+-					timer = 1;
++					if (!need_clear_lp) {
++						timer = 1;
++					}
+ 				}
+ 			}
+ 			if (FD_ISSET(lp, &writefds)) {
+ 				/* Write data to printer. */
+ 				result = writeBuffer(&networkToPrinterBuffer);
+-				if (result > 0)
+-					dolog(LOG_DEBUG,"wrote %d bytes to printer\n",result);
++				if (result > 0) {
++					if (need_clear_lp) {
++						need_clear_lp = 0;
++						printerToNetworkBuffer.startidx = 0;
++						printerToNetworkBuffer.endidx = 0;
++						printerToNetworkBuffer.bytes = 0;
++						printerToNetworkBuffer.totalin = 0;
++						printerToNetworkBuffer.totalout = 0;
++					}
++					dolog(LOG_DEBUG,"%d.%d: wrote %d bytes to printer\n", (int)now.tv_sec, (int)now.tv_usec, result);
++				}
+ 			}
+ 			if (FD_ISSET(fd, &writefds) || printerToNetworkBuffer.outfd == -1) {
++				if (need_clear_lp) {
++					printerToNetworkBuffer.startidx = 0;
++					printerToNetworkBuffer.endidx = 0;
++					printerToNetworkBuffer.bytes = 0;
++					printerToNetworkBuffer.totalin = 0;
++					printerToNetworkBuffer.totalout = 0;
++					continue;
++				}
+ 				/* Write data to network. */
+ 				result = writeBuffer(&printerToNetworkBuffer);
+ 				/* If socket write error, discard further data from printer */
+@@ -475,14 +495,19 @@ int copy_stream(int fd, int lp)
+ 					printerToNetworkBuffer.err = 0;
+ 					result = 0;
+ 					dolog(LOG_DEBUG,"network write error, discarding further printer data\n",result);
++					break;
+ 				}
+ 				else if (result > 0) {
+ 					if (printerToNetworkBuffer.outfd == -1)
+ 						dolog(LOG_DEBUG,"discarded %d bytes from printer\n",result);				
+ 					else
+-						dolog(LOG_DEBUG,"wrote %d bytes to network\n",result);
++						dolog(LOG_DEBUG,"%d.%d: wrote %d bytes to network\n", (int)now.tv_sec, (int)now.tv_usec, result);
+ 				}
+ 			}
++			if ((networkToPrinterBuffer.err & READ_ERR) && now.tv_sec - last_read_time.tv_sec >= 10) {
++				dolog(LOG_NOTICE,"read no data from network err, stop copy stream in 10s\n");
++				break;
++			}
+ 		}
+ 		dolog(LOG_NOTICE,
+ 		       "Finished job: %d/%d bytes sent to printer, %d/%d bytes sent to network\n",
diff --git a/net/p910nd/patches/30-listen-at-max-30-connections-wait-queues.patch b/net/p910nd/patches/30-listen-at-max-30-connections-wait-queues.patch
new file mode 100644
index 0000000000..c3232ced7c
--- /dev/null
+++ b/net/p910nd/patches/30-listen-at-max-30-connections-wait-queues.patch
@@ -0,0 +1,25 @@
+From 0b794f93675deb881c8a4adae88818c54c2d351d Mon Sep 17 00:00:00 2001
+From: Chen Minqiang <ptpt52@gmail.com>
+Date: Thu, 18 Nov 2021 11:27:46 +0800
+Subject: [PATCH] listen at max 30 connections wait queues
+
+---
+ p910nd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/p910nd.c b/p910nd.c
+index 51210ca..0792584 100644
+--- a/p910nd.c
++++ b/p910nd.c
+@@ -651,7 +651,7 @@ void server(int lpnumber)
+ 			res = res->ai_next;
+ 			continue;
+ 		}
+-		if (listen(netfd, 5) < 0) {
++		if (listen(netfd, 30) < 0) {
+ 			dolog(LOGOPTS, "listen: %m\n");
+ 			close(netfd);
+ 			res = res->ai_next;
+-- 
+2.17.1
+
diff --git a/net/p910nd/patches/31-abort-printer-open-failed.patch b/net/p910nd/patches/31-abort-printer-open-failed.patch
new file mode 100644
index 0000000000..298ce1369e
--- /dev/null
+++ b/net/p910nd/patches/31-abort-printer-open-failed.patch
@@ -0,0 +1,41 @@
+From 9bb911014ee1130cabe15fb04d533fceb6c0239f Mon Sep 17 00:00:00 2001
+From: Chen Minqiang <ptpt52@gmail.com>
+Date: Thu, 18 Nov 2021 16:36:16 +0800
+Subject: [PATCH] abort printer open failed
+
+---
+ p910nd.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/p910nd.c b/p910nd.c
+index 0792584..edad256 100644
+--- a/p910nd.c
++++ b/p910nd.c
+@@ -663,6 +663,7 @@ void server(int lpnumber)
+ 	clientlen = sizeof(client);
+ 	memset(&client, 0, sizeof(client));
+ 	while ((fd = accept(netfd, (struct sockaddr *)&client, &clientlen)) >= 0) {
++		int open_printer_fail = 0;
+ 		char host[INET6_ADDRSTRLEN];
+ #ifdef	USE_LIBWRAP
+ 		if (hosts_ctl("p910nd", STRING_UNKNOWN, get_ip_str((struct sockaddr *)&client, host, sizeof(host)), STRING_UNKNOWN) == 0) {
+@@ -676,8 +677,15 @@ void server(int lpnumber)
+ 		/*write(fd, "Printing", 8); */
+ 
+ 		/* Make sure lp device is open... */
+-		while ((lp = open_printer(lpnumber)) == -1)
++		while ((lp = open_printer(lpnumber)) == -1 && open_printer_fail < 3) {
++			open_printer_fail++;
+ 			sleep(10);
++		}
++		if (lp == -1) {
++			dolog(LOG_NOTICE, "Abort. printer open failed for %s:%hu\n", get_ip_str((struct sockaddr *)&client, host, sizeof(host)), get_port((struct sockaddr *)&client));
++			(void)close(fd);
++			continue;
++		}
+ 
+ 		if (copy_stream(fd, lp) < 0)
+ 			dolog(LOGOPTS, "copy_stream: %m\n");
+-- 
+2.17.1
+
diff --git a/net/pptpd/Makefile b/net/pptpd/Makefile
index 2e69d89ea0..6f723f8df6 100644
--- a/net/pptpd/Makefile
+++ b/net/pptpd/Makefile
@@ -25,7 +25,7 @@ include $(INCLUDE_DIR)/package.mk
 define Package/pptpd
   SECTION:=net
   CATEGORY:=Network
-  DEPENDS:=+kmod-ppp +kmod-gre +kmod-mppe +ppp
+  DEPENDS:=+kmod-ppp +kmod-gre +kmod-mppe +ppp-mod-pptp
   TITLE:=PopTop pptp server
   URL:=http://poptop.sourceforge.net/
   SUBMENU:=VPN
diff --git a/net/pptpd/files/pptpd.init b/net/pptpd/files/pptpd.init
index c97ce24210..200e34c693 100644
--- a/net/pptpd/files/pptpd.init
+++ b/net/pptpd/files/pptpd.init
@@ -21,7 +21,7 @@ validate_pptpd_section() {
 		'enabled:bool:1' \
 		'localip:string' \
 		'remoteip:string' \
-		'mppe:list(string):required no40 no56 stateless' \
+		'mppe:list(string):nomppe-40 require-mppe-128 nomppe-stateful' \
 		'logwtmp:bool:0'
 }
 
@@ -35,7 +35,7 @@ setup_login() {
 	[ -n "$password" ] || return 0
 	[ -n "$remoteip" ] || remoteip=*
 
-	echo "$username pptp-server $password $remoteip" >> $CHAP_SECRETS
+	echo "$username pptp-server \"$password\" $remoteip" >> $CHAP_SECRETS.pptp
 }
 
 setup_config() {
@@ -54,7 +54,9 @@ setup_config() {
 	[ -n "$remoteip" ] && echo "remoteip  $remoteip" >> $CONFIG
 	[ "$logwtmp" -eq 1 ] && echo "logwtmp" >> $CONFIG
 
-	echo "mppe $(echo $mppe | sed -e 's/\s/,/g')" >> $OPTIONS_PPTP
+	for opt in $mppe; do
+		echo $opt >>$OPTIONS_PPTP
+	done
 
 	return 0
 }
@@ -63,9 +65,12 @@ start_service() {
 	config_load pptpd
 	validate_pptpd_section pptpd setup_config || return
 	sed -i -E "/^\w+\s+pptp-server\s+.+$/d" $CHAP_SECRETS
+	:>$CHAP_SECRETS.pptp
 	config_foreach validate_login_section login setup_login
+	cat $CHAP_SECRETS.pptp $CHAP_SECRETS.l2tp >$CHAP_SECRETS 2>/dev/null
 
-	ln -sfn $CHAP_SECRETS /etc/ppp/chap-secrets
+	readlink /etc/ppp/chap-secrets &>/dev/null || \
+	ln -sfn $CHAP_SECRETS /etc/ppp/chap-secrets &>/dev/null
 
 	procd_open_instance
 	procd_set_param command $BIN -c $CONFIG --fg -o $OPTIONS_PPTP
diff --git a/net/pptpd/patches/105-ppp-ifname-for-natcap.patch b/net/pptpd/patches/105-ppp-ifname-for-natcap.patch
new file mode 100644
index 0000000000..4dd085f5e0
--- /dev/null
+++ b/net/pptpd/patches/105-ppp-ifname-for-natcap.patch
@@ -0,0 +1,22 @@
+--- a/pptpctrl.c
++++ b/pptpctrl.c
+@@ -681,6 +681,7 @@ static int startCall(char **pppaddrs, st
+  */
+ static void launch_pppd(char **pppaddrs, struct in_addr *inetaddrs)
+ {
++        static __thread char pppname[16];
+         char *pppd_argv[16];
+         int an = 0;
+         sigset_t sigs;
+@@ -801,6 +802,11 @@ static void launch_pppd(char **pppaddrs,
+                  pppd_argv[an++] = inet_ntoa(inetaddrs[1]);
+         }
+ 
++        snprintf(pppname, 16, "pcap%u", getpid());
++        pppname[15] = 0;
++        pppd_argv[an++] = "ifname";
++        pppd_argv[an++] = pppname;
++
+         pppd_argv[an++] = "remotenumber";
+         pppd_argv[an++] = inet_ntoa(inetaddrs[1]);
+ #endif
diff --git a/net/redsocks/files/redsocks.conf b/net/redsocks/files/redsocks.conf
index 64307c715d..603bbb07f3 100644
--- a/net/redsocks/files/redsocks.conf
+++ b/net/redsocks/files/redsocks.conf
@@ -12,10 +12,10 @@ base {
 	 */
 	// log = stderr;
 	// log = "file:/path/to/file";
-	log = "syslog:local7";
+	log = "stderr";
 
 	// detach from console
-	daemon = on;
+	daemon = off;
 
 	/* Change uid, gid and root directory, these options require root
 	 * privilegies on startup.
diff --git a/net/redsocks/files/redsocks.init b/net/redsocks/files/redsocks.init
index 56c9de3273..9e5a077f96 100644
--- a/net/redsocks/files/redsocks.init
+++ b/net/redsocks/files/redsocks.init
@@ -1,36 +1,18 @@
 #!/bin/sh /etc/rc.common
 # Copyright (C) 2007 OpenWrt.org
+# Copyright (C) 2021 X-WRT
 
 START=90
+USE_PROCD=1
 
-# check if configuration exists
-[ -e "/etc/redsocks.conf" ] || exit 0
+CONF="/etc/redsocks.conf"
 
-start() {
-	if [ -e "/var/run/redsocks.pid" ]; then
-		echo "redsocks is already running"
-		exit 0
-	fi
-
-	/bin/echo -n "running redsocks ..."
-	
-	# startup the safety-wrapper for the daemon
-	/usr/sbin/redsocks -p /var/run/redsocks.pid
-	
-	/bin/echo " done"
-}
-
-stop() {
-	if [ ! -e "/var/run/redsocks.pid" ]; then
-		echo "redsocks is not running"
-		exit 0
-	fi
-
-	/bin/echo -n "stopping redsocks ..."
-	
-	# kill the process
-	/bin/kill $(cat /var/run/redsocks.pid)
-	rm /var/run/redsocks.pid
-	
-	echo " done"
+start_service() {
+	procd_open_instance
+	procd_set_param command /usr/sbin/redsocks -c "${CONF}"
+	procd_set_param stdout 1
+	procd_set_param stderr 1
+	procd_set_param file "${CONF}"
+	procd_set_param respawn 3600 1 0
+	procd_close_instance
 }
diff --git a/net/sqm-scripts/Makefile b/net/sqm-scripts/Makefile
index 808e99f051..e162559d72 100644
--- a/net/sqm-scripts/Makefile
+++ b/net/sqm-scripts/Makefile
@@ -24,7 +24,7 @@ include $(INCLUDE_DIR)/package.mk
 define Package/sqm-scripts
   SECTION:=net
   CATEGORY:=Base system
-  DEPENDS:=+tc +kmod-sched-cake +kmod-ifb +iptables +iptables-mod-ipopt
+  DEPENDS:=+tc +kmod-sched-cake +kmod-ifb +iptables +iptables-mod-ipopt +@BUSYBOX_CONFIG_FEATURE_STAT_FORMAT
   TITLE:=SQM Scripts (QoS)
   PKGARCH:=all
 endef
diff --git a/net/usteer/Makefile b/net/usteer/Makefile
index f64908b579..f98a4cd7ce 100644
--- a/net/usteer/Makefile
+++ b/net/usteer/Makefile
@@ -6,10 +6,11 @@ PKG_NAME:=usteer
 PKG_SOURCE_DATE:=2025-10-04
 PKG_SOURCE_VERSION:=1d6524c6e6b58853f053c7816249a8f68ad9b0e8
 PKG_RELEASE:=1
+PKG_VERSION:=20251009
 
-PKG_SOURCE_PROTO:=git
-PKG_SOURCE_URL=https://git.openwrt.org/project/usteer.git
-PKG_MIRROR_HASH:=5f0525c441a023c07e6cb1b9e895ee0fdd84cd67043a905c2954caaa934e4eb8
+PKG_SOURCE_URL:=https://codeload.github.com/fakemesh/usteer/tar.gz/$(PKG_VERSION)?
+PKG_HASH:=40e83474eda801ecda55c08164e9ccca04c8488608c1c8f9d44910bff540ea49
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 
 PKG_MAINTAINER:=David Bauer <mail@david-bauer.net>
 PKG_LICENSE:=GPL-2.0-only
diff --git a/net/webui-aria2/Makefile b/net/webui-aria2/Makefile
new file mode 100644
index 0000000000..e1a9801298
--- /dev/null
+++ b/net/webui-aria2/Makefile
@@ -0,0 +1,52 @@
+#
+# Copyright (C) 2016-2020 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=webui-aria2
+PKG_SOURCE_DATE:=2018-12-09
+PKG_SOURCE_VERSION:=fb9d758d5cdc2be0867ee9502c44fd17560f5d24
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_SOURCE_DATE).tar.gz
+PKG_SOURCE_URL:=https://codeload.github.com/ziahamza/webui-aria2/tar.gz/$(PKG_SOURCE_VERSION)?
+PKG_HASH:=4cddcbd64a7b20baf0c2c31cb3c07d0fa01576a12c4e6feefd0840acd3f65919
+PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_SOURCE_VERSION)
+
+PKG_LICENSE:=MIT
+PKG_LICENSE_FILES:=LICENSE
+PKG_MAINTAINER:=Hsing-Wang Liao <kuoruan@gmail.com>
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/webui-aria2
+  SECTION:=net
+  CATEGORY:=Network
+  SUBMENU:=Download Manager
+  DEPENDS:=
+  TITLE:=An interface to interact with aria2
+  URL:=https://github.com/ziahamza/webui-aria2
+  PKGARCH:=all
+endef
+
+define Package/webui-aria2/description
+	The aim for this project is to create the worlds best and hottest interface to interact with aria2. Very simple to use.
+endef
+
+define Build/Compile
+endef
+
+define Package/webui-aria2/install
+	$(INSTALL_DIR) $(1)/www/webui-aria2 
+
+	$(CP) \
+		$(PKG_BUILD_DIR)/docs/* \
+		$(PKG_BUILD_DIR)/{LICENSE,favicon.ico} \
+		$(1)/www/webui-aria2
+endef
+
+$(eval $(call BuildPackage,webui-aria2))
diff --git a/net/webui-aria2/patches/0001-fix-favicon-path.patch b/net/webui-aria2/patches/0001-fix-favicon-path.patch
new file mode 100644
index 0000000000..2fb174971d
--- /dev/null
+++ b/net/webui-aria2/patches/0001-fix-favicon-path.patch
@@ -0,0 +1,11 @@
+--- a/docs/index.html
++++ b/docs/index.html
+@@ -3,7 +3,7 @@
+ 
+ <!-- {{{ head -->
+ <head>
+-  <link rel="icon" href="../favicon.ico" />
++  <link rel="icon" href="favicon.ico" />
+ 
+   <meta charset="utf-8">
+   <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
diff --git a/net/xl2tpd/patches/0009-ppp-ifname-for-natcap.patch b/net/xl2tpd/patches/0009-ppp-ifname-for-natcap.patch
new file mode 100644
index 0000000000..6eb639ac6f
--- /dev/null
+++ b/net/xl2tpd/patches/0009-ppp-ifname-for-natcap.patch
@@ -0,0 +1,19 @@
+diff --git a/xl2tpd.c b/xl2tpd.c
+index 791d5a4..0f549f7 100644
+--- a/xl2tpd.c
++++ b/xl2tpd.c
+@@ -529,6 +529,14 @@ int start_pppd (struct call *c, struct ppp_opts *opts)
+     else if (!c->pppd)
+     {
+         /* child */
++        if (c->container->lns) {
++            char pppname[16];
++            snprintf(pppname, 16, "l2tp%u", getpid());
++            pppname[15] = 0;
++            stropt[pos++] = strdup("ifname");
++            stropt[pos++] = strdup(pppname);
++            stropt[pos] = NULL;
++        }
+ 
+         close (0); /* redundant; the dup2() below would do that, too */
+         close (1); /* ditto */
diff --git a/utils/dockerd/patches/100-ip6tables-fixup.patch b/utils/dockerd/patches/100-ip6tables-fixup.patch
new file mode 100644
index 0000000000..8ac4dcbe56
--- /dev/null
+++ b/utils/dockerd/patches/100-ip6tables-fixup.patch
@@ -0,0 +1,35 @@
+diff --git a/libnetwork/drivers/bridge/setup_ip_forwarding.go b/libnetwork/drivers/bridge/setup_ip_forwarding.go
+index a29ac07..92c831a 100644
+--- a/libnetwork/drivers/bridge/setup_ip_forwarding.go
++++ b/libnetwork/drivers/bridge/setup_ip_forwarding.go
+@@ -54,20 +54,20 @@ func setupIPForwarding(enableIPTables bool, enableIP6Tables bool) error {
+ 				}
+ 			})
+ 		}
+-	}
+ 
+-	// add only iptables rules - forwarding is handled by setupIPv6Forwarding in setup_ipv6
+-	if enableIP6Tables {
+-		iptable := iptables.GetIptable(iptables.IPv6)
+-		if err := iptable.SetDefaultPolicy(iptables.Filter, "FORWARD", iptables.Drop); err != nil {
+-			log.G(context.TODO()).Warnf("Setting the default DROP policy on firewall reload failed, %v", err)
+-		}
+-		iptables.OnReloaded(func() {
+-			log.G(context.TODO()).Debug("Setting the default DROP policy on firewall reload")
++		// add only iptables rules - forwarding is handled by setupIPv6Forwarding in setup_ipv6
++		if enableIP6Tables {
++			iptable := iptables.GetIptable(iptables.IPv6)
+ 			if err := iptable.SetDefaultPolicy(iptables.Filter, "FORWARD", iptables.Drop); err != nil {
+ 				log.G(context.TODO()).Warnf("Setting the default DROP policy on firewall reload failed, %v", err)
+ 			}
+-		})
++			iptables.OnReloaded(func() {
++				log.G(context.TODO()).Debug("Setting the default DROP policy on firewall reload")
++				if err := iptable.SetDefaultPolicy(iptables.Filter, "FORWARD", iptables.Drop); err != nil {
++					log.G(context.TODO()).Warnf("Setting the default DROP policy on firewall reload failed, %v", err)
++				}
++			})
++		}
+ 	}
+ 
+ 	return nil
diff --git a/utils/lsof/Makefile b/utils/lsof/Makefile
index ba704d3eac..2432160e9b 100644
--- a/utils/lsof/Makefile
+++ b/utils/lsof/Makefile
@@ -8,7 +8,7 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=lsof
 PKG_VERSION:=4.99.5
-PKG_RELEASE:=2
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/lsof-org/lsof/releases/download/$(PKG_VERSION)
@@ -28,11 +28,12 @@ DISABLE_NLS:=
 define Package/lsof
   SECTION:=utils
   CATEGORY:=Utilities
+  DEPENDS:=+libtirpc
   TITLE:=LiSt Open Files - a diagnostic tool
   URL:=http://people.freebsd.org/~abe/
 endef
 
-CONFIGURE_ARGS += --without-selinux --without-libtirpc
+CONFIGURE_ARGS += --without-selinux
 
 define Package/lsof/install
 	$(INSTALL_DIR) $(1)/usr/bin
diff --git a/utils/prometheus-node-exporter-lua/Makefile b/utils/prometheus-node-exporter-lua/Makefile
index 31583a6cf8..b7717e1272 100644
--- a/utils/prometheus-node-exporter-lua/Makefile
+++ b/utils/prometheus-node-exporter-lua/Makefile
@@ -249,7 +249,7 @@ endef
 define Package/prometheus-node-exporter-lua-mwan3
   $(call Package/prometheus-node-exporter-lua/Default)
   TITLE+= (mwan3 collector)
-  DEPENDS:=prometheus-node-exporter-lua +mwan3
+  DEPENDS:=prometheus-node-exporter-lua
 endef
 
 define Package/prometheus-node-exporter-lua-mwan3/install
diff --git a/utils/tini/patches/002-fix_missing_basename.patch b/utils/tini/patches/002-fix_missing_basename.patch
new file mode 100644
index 0000000000..56f252d47a
--- /dev/null
+++ b/utils/tini/patches/002-fix_missing_basename.patch
@@ -0,0 +1,11 @@
+--- a/src/tini.c
++++ b/src/tini.c
+@@ -18,6 +18,8 @@
+ #include "tiniConfig.h"
+ #include "tiniLicense.h"
+ 
++#define basename(name) (strrchr((name),'/') ? strrchr((name),'/')+1 : (name))
++
+ #if TINI_MINIMAL
+ #define PRINT_FATAL(...)                         fprintf(stderr, __VA_ARGS__); fprintf(stderr, "\n");
+ #define PRINT_WARNING(...)  if (verbosity > 0) { fprintf(stderr, __VA_ARGS__); fprintf(stderr, "\n"); }