Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 3 to 4.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v3...v4

)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

modules: update to latest HEAD

b848b61 batman-adv: compat: Fix skb_vlan_eth_hdr conflict in stable kernels

4e1c175d4 strongswan: trigger reload when interfaces are specified
0f499ec4b sing-box: Update to 1.7.7
f971d88d5 django: bump to version 4.2.8
e96b6f648  banip: update 0.9.3-3
26373f845  banip: update 0.9.3-2
6435e15a2 banip: bump to release 0.9.3-1
06d1feb78 php8: update to 8.2.14
1e9d9f2b4 dnsproxy: Update to 0.61.0
75d9f3af9 yq: Update to 4.40.5
1b500425d v2ray-geodata: Update to latest version
ea1f30b6f v2ray-core: Update to 5.13.0
e60975e71 dnsproxy: Update to 0.60.1
e95f8c8de tailscale: Update to 1.56.1
5b9ae50b2 wsdd2: update to 2023-12-21
73062e624 mosquitto: update to 2.0.18
515b0f92e nebula: update to 1.8.1
5b4067ccb libxcrypt: update to 4.4.36
9e7371ed5 libtorrent-rasterbar: Update to 2.0.9

51881b2eb9 mediatek: add support for Routerich AX3000
18d7962f7b ramips: add support for Rostelecom RT-FE-1A
f6fb6bb2ba ramips: mt7621: use lzma-loader for Sercomm NA502
9a7b14dcfe mediatek: enable mt7981-wo-firmware package by default
9325da80ab mac80211: fix a race condition related to enabling fast-xmit
b0fc8b47e0 netifd: update to Git openwrt-23.05 (2024-01-04)
5cc1918a7a dropbear: increase default receive window size
60e49cf170 ramips: fix label-mac for Xiaomi RA75

The Gluon Tunneldigger protocol handler hasn't received the care and
attention a core package, especially a VPN protocol, should.

Due to the works in #2102 it's no longer required to maintain
VPN handlers in the Gluon Core and they can be instead included via a
package feed.

Users who wish to continue using a supported core Gluon package are
encouraged to take a look at fastd in conjunction with it's null@l2tp method.
It offers roughly the same performance (it's using the same principle
of operation) and supports connections via IPv6 as a bonus.

In general it should be possible to change the VPN used protocol
asynchronously with a normal update.

If Gluon users wish to continue using tunneldigger the recomendation
is to participate in the development of tunneldigger inside our
community-packages.

Co-authored-by: David Lutz <kpanic@kpanicroom.de>

Bumps [sphinx](https://github.com/sphinx-doc/sphinx) from 7.1.2 to 7.2.6.
- [Release notes](https://github.com/sphinx-doc/sphinx/releases)
- [Changelog](https://github.com/sphinx-doc/sphinx/blob/master/CHANGES.rst)
- [Commits](https://github.com/sphinx-doc/sphinx/compare/v7.1.2...v7.2.6

)

---
updated-dependencies:
- dependency-name: sphinx
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 2 to 3.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](https://github.com/docker/setup-qemu-action/compare/v2...v3

)

---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 2 to 3.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](https://github.com/docker/setup-buildx-action/compare/v2...v3

)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.2.0 to 5.4.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](https://github.com/docker/metadata-action/compare/e6428a5c4e294a61438ed7f43155db912025b6b3...9dc751fe249ad99385a2583ee0d084c400eee04e

)

---
updated-dependencies:
- dependency-name: docker/metadata-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Signed-off-by: David Bauer <mail@david-bauer.net>

Signed-off-by: Magnus Frühling <skorpy@frankfurt.ccc.de>

* docs: user/site: add missing image-customization example

* doc: user/site: improve wording of image customization section

Also add a link to the examples section.

openwrt: backport patches for v2023.2 release

The error handling needed for the buffer growth logic relies on
uloop_fd's error flag, which is set based on epoll events. Doing so
without handling recvmsg's error codes is racy, as an error state may be
set between receiving epoll events and the next recvmsg, but calling
recvmsg clears the error state.

To fix this, add handling for errors returned by nl_recvmsgs_default()
and nl_recv(); checking for u->error and retrieving the error status
using getsockopt() becomes redundant.

We have observed this issue on Gluon (recent OpenWrt 23.05); on some
devices with DSA switches, the bridge interface's carrier-on event would
consistenly get lost during boot due to insufficient buffer space
(see [1]).

We have bisected the issue to netifd commit 516ab774cc16 ("system-linux:
fix race condition on bringing up wireless devices"), but that commit only
uncovered the preexisting bug by switching from getting the carrier state
from sysfs to using the netlink messages in cb_rtnl_event().

I suspect that other recent issues about netifd missing a carrier state
change like [2] may have the same underlying cause.

[1] https://github.com/freifunk-gluon/gluon/issues/3130
[2] https://github.com/openwrt/openwrt/issues/13863



Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
Signed-off-by: David Bauer <mail@david-bauer.net>

Increasing the receive window size improves throughout on higher-latency
links such as WAN connections. The current default of 24KB caps out at
around 500 KB/s.

Increasing the receive buffer to 256KB increases the throughput to at
least 11 MB/s.

Signed-off-by: David Bauer <mail@david-bauer.net>

readthedocs: update to Python 3.11

.readthedocs.yaml is how the file is mentioned in the docs. Adjust the
name.

The latest Sphinx versions require at least 3.9.

docs: remove an unrelated/misleading link and fix headings

This was an idea (thought experiment?) from a Wireless Battlemesh ages
ago between batman-adv devs. Regarding what could be done to interconnect
isolated/separate WiFi mesh clouds on layer 3 without losing best path
metric information, without worsening/compromising on the best route decision.
And as a more sophisticated approach to the batman-adv gateway feature and
a potential replacement for tunneled batman-adv over VPN connections.

Which is the opposite of what the sentence in this Gluon README
is saying. And this never got implemented in either batman-adv nor Gluon.

Therefore removing this link to this old draft page.

The newly added information is way too verbose and non-practical for a
"Getting started". Therefore adding an "Overview" heading and moving the
"Getting started" back to where it originally was.

This adds a hint to the Repository on Github and makes it easier to recognize the license text

Goal is to cancel Worfklows for Pull Request if they become obsolte
due to new changes.
Without this workflows will continue running, wasting resources and
delaying the run of relevant workflows.
This situation will typically occour if a author of a PR notices an
error/typo/missing bit and pushes new changes to the branch.

This won't affect concurrent workflows for otherwise triggered
workflows (push, workflow_dispatch, tag, ...).

build: implement flexible site-selection system

This package allows to easily select the correct libustream implementation
without all communities having the need to manually change their included
packages.

Signed-off-by: David Bauer <mail@david-bauer.net>

bcm27xx: add support for Pi4 and switch bcm27xx from ext4 to squashfs

Remove legacy migrations. These predate the currently supported upgrade path,
therefore we no longer need them.

Signed-off-by: Magnus Frühling <skorpy@frankfurt.ccc.de>

Known issues:

* 11s is not working
* has no reset button, only SSH access, serial access or an external SD
  card update can return it to config mode at the moment
* LED: generally the red sys LED is working, including boot and failsafe
  blink patters, but:
  * sometimes not lit after boot
  * not blinking in config mode; instead sometimes either persistently on
    and sometimes persistently off after booting into config mode

Therefore adding it as broken.

However, due to its CPU power and small size still interesting as a VPN
offloader or WiFi rooftop core node (e.g. to Gluon'ify 5+60GHz devices).

Manifest aliases are added for upgrades from unreleased Gluon builds
and can be removed again at some point in the future.

Tested on a Raspberry Pi 4 Model B Rev 1.1.

Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>

Similar to x86 build images with a squashfs instead of ext4 filesystem
on bcm27xx / for the Raspberry Pi. This allows to use sysupgrade
properly and allows to use the firstboot command.

Runtime tested on a Raspberry Pi 4. Build tested for the Pi 3 / bcm2710.

Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>

Load the site image-customization.lua file only on init. Previously, the
file was loaded on every device invocation.

Signed-off-by: David Bauer <mail@david-bauer.net>