🌴 Sync 2026-09-27 20:55:59

luci-app-fwlive/Makefile

@@ -12,7 +12,7 @@ LUCI_DEPENDS:=+luci-base +logd +jsonfilter +coreutils-timeout
 LUCI_PKGARCH:=all
 
 PKG_VERSION:=0.1.46
-PKG_RELEASE:=41
+PKG_RELEASE:=42
 
 # Reproducible build: honor SOURCE_DATE_EPOCH from the build environment (set by docker-sdk.sh / CI).
 ifdef SOURCE_DATE_EPOCH
@@ -34,9 +34,10 @@ esac
 # the upgrade action arg.
 # A version-shaped $$1 with empty $$2 is APK uninstall (pre-deinstall).
 # Same-version APK reinstall uses post-upgrade and does not run this hook.
-# A version-changing APK upgrade is indistinguishable from uninstall at
-# this hook (both pass the old version as $$1). Do not claim that path
-# was lab-proven.
+# A version-changing APK upgrade also skips this hook: apk-tools 3.0
+# runs post-upgrade (PKG_UPGRADE=1) on the new package and pre-deinstall
+# only on uninstall (apk del). Lab-proven on OpenWrt 25.12.5
+# (apk-tools 3.0.5), 0.1.43-r1 -> 0.1.44-r1.
 [ "$${PKG_UPGRADE:-}" = 1 ] && exit 0
 case "$${2-}" in
 	remove) ;;
@@ -56,7 +57,7 @@ esac
 # Best-effort restore still exits 0 so a transient lock/pending-staging failure
 # cannot strand the package half-removed. The baseline is kept on failure for
 # admin recovery; helpers are still present while this prerm runs.
-restore_wan_log_baseline || logger -t fwlive "WAN log baseline restore failed during uninstall"
+restore_wan_log_baseline >/dev/null || logger -t fwlive "WAN log baseline restore failed during uninstall"
 exit 0
 endef
 

luci-app-fwlive/root/usr/libexec/fwlive-adaptive-cap.sh

@@ -116,7 +116,11 @@ fwlive_adaptive_state_dir_ok() {
 	[ -d "$_dir" ] || return 1
 	# shellcheck disable=SC3067
 	[ -O "$_dir" ] || return 1
-	return 0
+	# Same group/other-write refuse as wan_log_lock_dir_safe: the
+	# PID-predictable ${STATE}.tmp.$$ + mv is a symlink-write if the
+	# dir is world-writable.
+	_writable=$(find "$_dir" -prune \( -perm -020 -o -perm -002 \) -print 2>/dev/null) || return 1
+	[ -z "$_writable" ]
 }
 
 # Extract a decimal integer field from a one-line JSON object (builtin only).

luci-app-fwlive/root/usr/libexec/fwlive-is-firewall-event.sh

@@ -5,7 +5,8 @@
 # source: core/fwlive-log.js CLASSIFY_SPEC
 # Shared isFirewallEvent parity logic (shell). Sourced by fwlive-log-filter.sh and tests.
 # Sourced library: do not add set -euo here; callers own strict mode.
-# One awk process classifies a batch (MODE=json/json_reply) or one message (default).
+# MODE=json prints matching records comma-joined, with no array wrapper or trailing newline.
+# MODE=json_reply wraps a poll reply; default MODE=msg classifies one message.
 
 # The caller sets FILTER_DIR when this file is sourced. Resolve the asset
 # once, not once per classification call.

luci-app-fwlive/root/usr/libexec/fwlive-logging.sh

@@ -411,8 +411,18 @@ maybe_snapshot_wan_log_baseline() {
 	zone="$1"
 	path="$(wan_log_baseline_path)"
 	[ -n "$zone" ] || return 1
+	[ -L "$path" ] && return 1
 	[ -f "$path" ] && return 0
-	mkdir -p "$(dirname "$path")" 2>/dev/null || return 1
+	_dir=$(dirname "$path")
+	[ -n "$_dir" ] || return 1
+	[ -L "$_dir" ] && return 1
+	mkdir -p "$_dir" 2>/dev/null || return 1
+	[ -L "$_dir" ] && return 1
+	[ -L "$path" ] && return 1
+	# Production path only: tests relocate WAN_LOG_BASELINE_FILE.
+	if [ -z "${FWLIVE_WAN_LOG_BASELINE_FILE:-}" ] && [ "$path" = /etc/fwlive/wan-log-baseline ]; then
+		wan_log_lock_dir_safe "$_dir" || return 1
+	fi
 	current=$(wan_zone_log_value "$zone")
 	printf '%s' "$current" >"$path" 2>/dev/null || return 1
 	return 0

luci-app-fwlive/root/usr/libexec/rpcd/fwlive

@@ -66,6 +66,9 @@ slug_key() {
 # Cap rules JSON size so a huge ruleset cannot unbound an rpcd reply.
 RULES_MAP_MAX_KEYS=512
 RULES_MAP_MAX_BYTES=65536
+# First-wins dups never increment _map_keys, so they would otherwise walk
+# the whole dump. Bound map_prefix_with_label calls independently.
+RULES_MAP_MAX_LINES=512
 
 map_add() {
 	key="$1"
@@ -111,10 +114,12 @@ map_add() {
 uci_rule_names() {
 	# uci missing / empty firewall config is "no names", not fatal.
 	# pipefail + set -e cannot apply to this pipeline.
+	# One show dump; named-section names still use uci get.
+	_firewall_show=$(uci -q show firewall 2>/dev/null || true)
 	{
-		uci -q show firewall 2>/dev/null |
+		printf '%s\n' "$_firewall_show" |
 			sed -n "s/^firewall\.@rule\[[0-9]*\]\.name='\(.*\)'$/\1/p" || true
-		uci -q show firewall 2>/dev/null |
+		printf '%s\n' "$_firewall_show" |
 			sed -n 's/^firewall\.\([A-Za-z0-9_-]*\)=rule$/\1/p' |
 			while IFS= read -r section; do
 				uci -q get "firewall.${section}.name" 2>/dev/null || true
@@ -152,6 +157,11 @@ read_rpc_input() {
 map_prefix_with_label() {
 	prefix="$1"
 	label="$2"
+	if [ "${_map_lines:-0}" -ge "$RULES_MAP_MAX_LINES" ]; then
+		_map_overflow=1
+		return 0
+	fi
+	_map_lines=$(( ${_map_lines:-0} + 1 ))
 	prefix=$(normalize_log_prefix "$prefix")
 	[ -n "$prefix" ] || return 0
 	slug=$(slug_key "$prefix")
@@ -496,6 +506,7 @@ enrich_rules_dump() {
 build_rules_map() {
 	OUT=''
 	_map_keys=0
+	_map_lines=0
 	_map_overflow=''
 	_enrich_error=''
 	backend=unknown

luci-app-passwall/Makefile

@@ -7,8 +7,8 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-passwall
-PKG_VERSION:=26.9.26
-PKG_RELEASE:=295
+PKG_VERSION:=26.9.27
+PKG_RELEASE:=296
 PKG_PO_VERSION:=$(PKG_VERSION)
 
 PKG_CONFIG_DEPENDS:= \
@@ -163,15 +163,7 @@ endef
 define Package/$(PKG_NAME)/conffiles
 /etc/config/passwall
 /etc/config/passwall_server
-/usr/share/passwall/rules/direct_host
-/usr/share/passwall/rules/direct_ip
-/usr/share/passwall/rules/proxy_host
-/usr/share/passwall/rules/proxy_ip
-/usr/share/passwall/rules/block_host
-/usr/share/passwall/rules/block_ip
-/usr/share/passwall/rules/lanlist_ipv4
-/usr/share/passwall/rules/lanlist_ipv6
-/usr/share/passwall/rules/domains_excluded
+/etc/passwall/
 endef
 
 define Package/$(PKG_NAME)/postinst

luci-app-passwall/luasrc/controller/passwall.lua

@@ -20,6 +20,7 @@ function index()
 			luci.sys.call('cp -f /usr/share/passwall/0_default_config /etc/config/passwall')
 		else return end
 	end
+	luci.sys.call("mkdir -p /etc/passwall/rules")
 	local api = require "luci.passwall.api"
 	local appname = api.appname		-- global definitions not available
 	local fs = api.fs
@@ -931,13 +932,15 @@ end
 local backup_files = {
     "/etc/config/passwall",
     "/etc/config/passwall_server",
-    "/usr/share/passwall/rules/block_host",
-    "/usr/share/passwall/rules/block_ip",
-    "/usr/share/passwall/rules/direct_host",
-    "/usr/share/passwall/rules/direct_ip",
-    "/usr/share/passwall/rules/proxy_host",
-    "/usr/share/passwall/rules/proxy_ip",
-    "/usr/share/passwall/rules/domains_excluded"
+    "/etc/passwall/rules/block_host",
+    "/etc/passwall/rules/block_ip",
+    "/etc/passwall/rules/direct_host",
+    "/etc/passwall/rules/direct_ip",
+    "/etc/passwall/rules/proxy_host",
+    "/etc/passwall/rules/proxy_ip",
+    "/etc/passwall/rules/lanlist_ipv4",
+    "/etc/passwall/rules/lanlist_ipv6",
+    "/etc/passwall/rules/domains_excluded"
 }
 
 function create_backup()
@@ -1042,6 +1045,13 @@ function reset_config()
 		luci.sys.call('/etc/init.d/passwall stop')
 		if luci.sys.call('[ -s "/usr/share/passwall/0_default_config" ]') == 0 then
 			luci.sys.call('cp -f /usr/share/passwall/0_default_config /etc/config/passwall')
+			local files = {
+				"direct_host", "direct_ip", "proxy_host", "proxy_ip", "block_host", "block_ip",
+				"lanlist_ipv4", "lanlist_ipv6", "domains_excluded"
+			}
+			for _, f in ipairs(files) do
+				luci.sys.call("cp -f /usr/share/passwall/rules/" .. f .. " /etc/passwall/rules/" .. f)
+			end
 			api.log(" * 恢复默认配置成功。")
 		else
 			api.log(" * 找不到默认配置文件，重置失败！")

luci-app-passwall/luasrc/model/cbi/passwall/client/other.lua

@@ -193,7 +193,7 @@ if has_xray then
 	o.default = 0
 	o.description = translate("Override the connection destination address with the sniffed domain.<br />Otherwise use sniffed domain for routing only.<br />If using shunt nodes, configure the domain shunt rules correctly.")
 
-	local domains_excluded = string.format("/usr/share/%s/rules/domains_excluded", m.config)
+	local domains_excluded = string.format("/etc/%s/rules/domains_excluded", m.config)
 	o = s_xray:option(TextValue, "excluded_domains", translate("Excluded Domains"), translate("If the traffic sniffing result is in this list, the destination address will not be overridden."))
 	o.rows = 15
 	o.wrap = "off"

luci-app-passwall/luasrc/model/cbi/passwall/client/rule_list.lua

@@ -2,10 +2,10 @@ local api = require "luci.passwall.api"
 local fs = api.fs
 local sys = api.sys
 local datatypes = api.datatypes
-local path = string.format("/usr/share/%s/rules/", api.appname)
-local gfwlist_path = path .. "gfwlist"
-local chnlist_path = path .. "chnlist"
-local chnroute_path = path .. "chnroute"
+local path = string.format("/etc/%s/rules/", api.appname)
+local gfwlist_path = "/usr/share/" .. api.appname .. "/rules/gfwlist"
+local chnlist_path = "/usr/share/" .. api.appname .. "/rules/chnlist"
+local chnroute_path = "/usr/share/" .. api.appname .. "/rules/chnroute"
 
 api.set_default_cbi()
 

luci-app-passwall/luasrc/passwall/util_sing-box.lua

@@ -1643,8 +1643,8 @@ function gen_config(var)
 					return table.concat(list, "\n")
 				end
 
-				local domain_list = read_proxy_list("/usr/share/passwall/rules/proxy_host")
-				local ip_list = read_proxy_list("/usr/share/passwall/rules/proxy_ip")
+				local domain_list = read_proxy_list("/etc/passwall/rules/proxy_host")
+				local ip_list = read_proxy_list("/etc/passwall/rules/proxy_ip")
 
 				local bin = api.finded_com("geoview")
 				if bin then

luci-app-passwall/luasrc/passwall/util_xray.lua

@@ -15,7 +15,7 @@ local xray_version = api.get_app_version("xray")
 local xray_min_version = "26.7.11"
 
 local function get_domain_excluded()
-	local path = string.format("/usr/share/%s/rules/domains_excluded", api.c_config)
+	local path = string.format("/etc/%s/rules/domains_excluded", api.c_config)
 	local content = fs.readfile(path)
 	if not content then return nil end
 	local hosts = {}
@@ -1425,8 +1425,8 @@ function gen_config(var)
 					return table.concat(list, "\n")
 				end
 
-				local domain_list = read_proxy_list("/usr/share/passwall/rules/proxy_host")
-				local ip_list = read_proxy_list("/usr/share/passwall/rules/proxy_ip")
+				local domain_list = read_proxy_list("/etc/passwall/rules/proxy_host")
+				local ip_list = read_proxy_list("/etc/passwall/rules/proxy_ip")
 
 				local bin = api.finded_com("geoview")
 				if bin then

luci-app-passwall/root/etc/uci-defaults/luci-app-passwall

@@ -39,6 +39,21 @@ uci commit firewall
 
 [ ! -s "/etc/config/passwall" ] && cp -f /usr/share/passwall/0_default_config /etc/config/passwall
 
+mkdir -p /etc/passwall/rules
+for file in \
+	direct_host \
+	direct_ip \
+	proxy_host \
+	proxy_ip \
+	block_host \
+	block_ip \
+	lanlist_ipv4 \
+	lanlist_ipv6 \
+	domains_excluded
+do
+	[ -f "/etc/passwall/rules/$file" ] || cp "/usr/share/passwall/rules/$file" "/etc/passwall/rules/$file"
+done
+
 chmod +x /usr/share/passwall/*.sh
 
 [ "$(uci -q get passwall.@global_xray[0].sniffing)" == "1" ] && [ "$(uci -q get passwall.@global_xray[0].route_only)" != "1" ] && uci -q set passwall.@global_xray[0].sniffing_override_dest=1

luci-app-passwall/root/usr/share/passwall/helper_chinadns_add.lua

@@ -26,6 +26,7 @@ local datatypes = api.datatypes
 local TMP_PATH = api.TMP_PATH
 local TMP_ACL_PATH = TMP_PATH .. "/acl"
 local RULES_PATH = "/usr/share/passwall/rules"
+local USER_RULES_PATH = "/etc/passwall/rules"
 local FLAG_PATH = TMP_ACL_PATH .. "/" .. FLAG
 local config_lines = {}
 local tmp_lines = {}
@@ -130,7 +131,7 @@ local file_block_host = TMP_ACL_PATH .. "/block_host"
 if USE_BLOCK_LIST == "1" and not fs.access(file_block_host) then
 	local block_domain, lookup_block_domain = {}, {}
 	local geosite_arg = ""
-	local f = io.open(RULES_PATH .. "/block_host")
+	local f = io.open(USER_RULES_PATH .. "/block_host")
 	if f then
 		for line in f:lines() do
 			if not line:find("#") and line:find("geosite:") then
@@ -217,7 +218,7 @@ local file_direct_host = TMP_ACL_PATH .. "/direct_host"
 if USE_DIRECT_LIST == "1" and not fs.access(file_direct_host) then
 	local direct_domain, lookup_direct_domain = {}, {}
 	local geosite_arg = ""
-	local f = io.open(RULES_PATH .. "/direct_host")
+	local f = io.open(USER_RULES_PATH .. "/direct_host")
 	if f then
 		for line in f:lines() do
 			if not line:find("#") and line:find("geosite:") then
@@ -267,7 +268,7 @@ local file_proxy_host = TMP_ACL_PATH .. "/proxy_host"
 if USE_PROXY_LIST == "1" and not fs.access(file_proxy_host) then
 	local proxy_domain, lookup_proxy_domain = {}, {}
 	local geosite_arg = ""
-	local f = io.open(RULES_PATH .. "/proxy_host")
+	local f = io.open(USER_RULES_PATH .. "/proxy_host")
 	if f then
 		for line in f:lines() do
 			if not line:find("#") and line:find("geosite:") then

luci-app-passwall/root/usr/share/passwall/helper_dnsmasq.lua

@@ -336,6 +336,7 @@ function add_rule(var)
 	local cache_text = ""
 	local nodes_address_md5 = sys.exec("echo -n $(uci show passwall | grep '\\.address') | md5sum")
 	local new_rules = sys.exec("echo -n $(find /usr/share/passwall/rules -type f | xargs md5sum)")
+	new_rules = new_rules .. sys.exec("echo -n $(find /etc/passwall/rules -type f | xargs md5sum)")
 	local new_text = TMP_DNSMASQ_PATH .. DNSMASQ_CONF_FILE .. DEFAULT_DNS .. LOCAL_DNS .. TUN_DNS .. USE_DEFAULT_DNS .. CHINADNS_DNS .. USE_DIRECT_LIST .. USE_PROXY_LIST .. USE_BLOCK_LIST .. USE_GFW_LIST .. CHN_LIST .. DEFAULT_PROXY_MODE .. NO_PROXY_IPV6 .. nodes_address_md5 .. new_rules .. NFTFLAG
 	if fs.access(CACHE_TEXT_FILE) then
 		for line in io.lines(CACHE_TEXT_FILE) do
@@ -380,7 +381,7 @@ function add_rule(var)
 		--屏蔽列表
 		if USE_CHINADNS_NG == "0" and USE_BLOCK_LIST == "1" then
 			local geosite_arg = ""
-			local f = io.open("/usr/share/passwall/rules/block_host")
+			local f = io.open("/etc/passwall/rules/block_host")
 			if f then
 				for line in f:lines() do
 					if not line:find("#") and line:find("geosite:") then
@@ -455,7 +456,7 @@ function add_rule(var)
 				}
 				--始终用国内DNS解析直连（白名单）列表
 				local geosite_arg = ""
-				local f = io.open("/usr/share/passwall/rules/direct_host")
+				local f = io.open("/etc/passwall/rules/direct_host")
 				if f then
 					for line in f:lines() do
 						if not line:find("#") and line:find("geosite:") then
@@ -505,7 +506,7 @@ function add_rule(var)
 				end
 				--始终使用远程DNS解析代理（黑名单）列表
 				local geosite_arg = ""
-				local f = io.open("/usr/share/passwall/rules/proxy_host")
+				local f = io.open("/etc/passwall/rules/proxy_host")
 				if f then
 					for line in f:lines() do
 						if not line:find("#") and line:find("geosite:") then

luci-app-passwall/root/usr/share/passwall/helper_smartdns_add.lua

@@ -31,6 +31,7 @@ local datatypes = api.datatypes
 local TMP_PATH = api.TMP_PATH
 local TMP_ACL_PATH = TMP_PATH .. "/acl"
 local RULES_PATH = "/usr/share/passwall/rules"
+local USER_RULES_PATH = "/etc/passwall/rules"
 local FLAG_PATH = TMP_ACL_PATH .. "/" .. FLAG
 local TMP_CONF_FILE = FLAG_PATH .. "/smartdns.conf"
 local config_lines = {}
@@ -288,7 +289,7 @@ local file_block_host = TMP_ACL_PATH .. "/block_host"
 if USE_BLOCK_LIST == "1" and not fs.access(file_block_host) then
 	local block_domain, lookup_block_domain = {}, {}
 	local geosite_arg = ""
-	local f = io.open(RULES_PATH .. "/block_host")
+	local f = io.open(USER_RULES_PATH .. "/block_host")
 	if f then
 		for line in f:lines() do
 			if not line:find("#") and line:find("geosite:") then
@@ -378,7 +379,7 @@ local file_direct_host = TMP_ACL_PATH .. "/direct_host"
 if USE_DIRECT_LIST == "1" and not fs.access(file_direct_host) then
 	local direct_domain, lookup_direct_domain = {}, {}
 	local geosite_arg = ""
-	local f = io.open(RULES_PATH .. "/direct_host")
+	local f = io.open(USER_RULES_PATH .. "/direct_host")
 	if f then
 		for line in f:lines() do
 			if not line:find("#") and line:find("geosite:") then
@@ -430,7 +431,7 @@ local file_proxy_host = TMP_ACL_PATH .. "/proxy_host"
 if USE_PROXY_LIST == "1" and not fs.access(file_proxy_host) then
 	local proxy_domain, lookup_proxy_domain = {}, {}
 	local geosite_arg = ""
-	local f = io.open(RULES_PATH .. "/proxy_host")
+	local f = io.open(USER_RULES_PATH .. "/proxy_host")
 	if f then
 		for line in f:lines() do
 			if not line:find("#") and line:find("geosite:") then

luci-app-passwall/root/usr/share/passwall/iptables.sh

@@ -936,10 +936,10 @@ add_firewall_rule() {
 
 	#直连列表
 	[ "$USE_DIRECT_LIST_ALL" = "1" ] && {
-		cat $RULES_PATH/direct_ip | tr -s "\r\n" "\n" | sed 's/#.*//' | grep -E "$IPv4_REGEX" | sed -e "s/^/add $IPSET_WHITE &/g" -e "s/$/ timeout 0/g" | ipset -! -R
-		cat $RULES_PATH/direct_ip | tr -s "\r\n" "\n" | sed 's/#.*//' | grep -E "$IPv6_REGEX" | sed -e "s/^/add $IPSET_WHITE6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R
+		cat $USER_RULES_PATH/direct_ip | tr -s "\r\n" "\n" | sed 's/#.*//' | grep -E "$IPv4_REGEX" | sed -e "s/^/add $IPSET_WHITE &/g" -e "s/$/ timeout 0/g" | ipset -! -R
+		cat $USER_RULES_PATH/direct_ip | tr -s "\r\n" "\n" | sed 's/#.*//' | grep -E "$IPv6_REGEX" | sed -e "s/^/add $IPSET_WHITE6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R
 		[ "$USE_GEOVIEW" = "1" ] && {
-			local GEOIP_CODE=$(cat $RULES_PATH/direct_ip | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g')
+			local GEOIP_CODE=$(cat $USER_RULES_PATH/direct_ip | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g')
 			if [ -n "$GEOIP_CODE" ]; then
 				get_geoip $GEOIP_CODE ipv4 | sed -e "s/^/add $IPSET_WHITE &/g" -e "s/$/ timeout 0/g" | ipset -! -R
 				get_geoip $GEOIP_CODE ipv6 | sed -e "s/^/add $IPSET_WHITE6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R
@@ -950,10 +950,10 @@ add_firewall_rule() {
 
 	#代理列表
 	[ "$USE_PROXY_LIST_ALL" = "1" ] && {
-		cat $RULES_PATH/proxy_ip | tr -s "\r\n" "\n" | sed 's/#.*//' | grep -E "$IPv4_REGEX" | sed -e "s/^/add $IPSET_BLACK &/g" -e "s/$/ timeout 0/g" | ipset -! -R
-		cat $RULES_PATH/proxy_ip | tr -s "\r\n" "\n" | sed 's/#.*//' | grep -E "$IPv6_REGEX" | sed -e "s/^/add $IPSET_BLACK6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R
+		cat $USER_RULES_PATH/proxy_ip | tr -s "\r\n" "\n" | sed 's/#.*//' | grep -E "$IPv4_REGEX" | sed -e "s/^/add $IPSET_BLACK &/g" -e "s/$/ timeout 0/g" | ipset -! -R
+		cat $USER_RULES_PATH/proxy_ip | tr -s "\r\n" "\n" | sed 's/#.*//' | grep -E "$IPv6_REGEX" | sed -e "s/^/add $IPSET_BLACK6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R
 		[ "$USE_GEOVIEW" = "1" ] && {
-			local GEOIP_CODE=$(cat $RULES_PATH/proxy_ip | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g')
+			local GEOIP_CODE=$(cat $USER_RULES_PATH/proxy_ip | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g')
 			if [ -n "$GEOIP_CODE" ]; then
 				get_geoip $GEOIP_CODE ipv4 | sed -e "s/^/add $IPSET_BLACK &/g" -e "s/$/ timeout 0/g" | ipset -! -R
 				get_geoip $GEOIP_CODE ipv6 | sed -e "s/^/add $IPSET_BLACK6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R
@@ -964,10 +964,10 @@ add_firewall_rule() {
 
 	#屏蔽列表
 	[ "$USE_BLOCK_LIST_ALL" = "1" ] && {
-		cat $RULES_PATH/block_ip | tr -s "\r\n" "\n" | sed 's/#.*//' | grep -E "$IPv4_REGEX" | sed -e "s/^/add $IPSET_BLOCK &/g" -e "s/$/ timeout 0/g" | ipset -! -R
-		cat $RULES_PATH/block_ip | tr -s "\r\n" "\n" | sed 's/#.*//' | grep -E "$IPv6_REGEX" | sed -e "s/^/add $IPSET_BLOCK6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R
+		cat $USER_RULES_PATH/block_ip | tr -s "\r\n" "\n" | sed 's/#.*//' | grep -E "$IPv4_REGEX" | sed -e "s/^/add $IPSET_BLOCK &/g" -e "s/$/ timeout 0/g" | ipset -! -R
+		cat $USER_RULES_PATH/block_ip | tr -s "\r\n" "\n" | sed 's/#.*//' | grep -E "$IPv6_REGEX" | sed -e "s/^/add $IPSET_BLOCK6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R
 		[ "$USE_GEOVIEW" = "1" ] && {
-			local GEOIP_CODE=$(cat $RULES_PATH/block_ip | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g')
+			local GEOIP_CODE=$(cat $USER_RULES_PATH/block_ip | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g')
 			if [ -n "$GEOIP_CODE" ]; then
 				get_geoip $GEOIP_CODE ipv4 | sed -e "s/^/add $IPSET_BLOCK &/g" -e "s/$/ timeout 0/g" | ipset -! -R
 				get_geoip $GEOIP_CODE ipv6 | sed -e "s/^/add $IPSET_BLOCK6 &/g" -e "s/$/ timeout 0/g" | ipset -! -R

luci-app-passwall/root/usr/share/passwall/nftables.sh

@@ -1042,10 +1042,10 @@ add_firewall_rule() {
 
 	#直连列表
 	[ "$USE_DIRECT_LIST_ALL" = "1" ] && {
-		cat $RULES_PATH/direct_ip | sed 's/#.*//' | grep -E "$IPv4_REGEX" | insert_nftset $NFTSET_WHITE_STATIC
-		cat $RULES_PATH/direct_ip | sed 's/#.*//' | grep -E "$IPv6_REGEX" | insert_nftset $NFTSET_WHITE6_STATIC
+		cat $USER_RULES_PATH/direct_ip | sed 's/#.*//' | grep -E "$IPv4_REGEX" | insert_nftset $NFTSET_WHITE_STATIC
+		cat $USER_RULES_PATH/direct_ip | sed 's/#.*//' | grep -E "$IPv6_REGEX" | insert_nftset $NFTSET_WHITE6_STATIC
 		[ "$USE_GEOVIEW" = "1" ] && {
-			local GEOIP_CODE=$(cat $RULES_PATH/direct_ip | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g')
+			local GEOIP_CODE=$(cat $USER_RULES_PATH/direct_ip | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g')
 			if [ -n "$GEOIP_CODE" ]; then
 				get_geoip $GEOIP_CODE ipv4 | insert_nftset $NFTSET_WHITE_STATIC
 				get_geoip $GEOIP_CODE ipv6 | insert_nftset $NFTSET_WHITE6_STATIC
@@ -1056,10 +1056,10 @@ add_firewall_rule() {
 
 	#代理列表
 	[ "$USE_PROXY_LIST_ALL" = "1" ] && {
-		cat $RULES_PATH/proxy_ip | sed 's/#.*//' | grep -E "$IPv4_REGEX" | insert_nftset $NFTSET_BLACK_STATIC
-		cat $RULES_PATH/proxy_ip | sed 's/#.*//' | grep -E "$IPv6_REGEX" | insert_nftset $NFTSET_BLACK6_STATIC
+		cat $USER_RULES_PATH/proxy_ip | sed 's/#.*//' | grep -E "$IPv4_REGEX" | insert_nftset $NFTSET_BLACK_STATIC
+		cat $USER_RULES_PATH/proxy_ip | sed 's/#.*//' | grep -E "$IPv6_REGEX" | insert_nftset $NFTSET_BLACK6_STATIC
 		[ "$USE_GEOVIEW" = "1" ] && {
-			local GEOIP_CODE=$(cat $RULES_PATH/proxy_ip | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g')
+			local GEOIP_CODE=$(cat $USER_RULES_PATH/proxy_ip | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g')
 			if [ -n "$GEOIP_CODE" ]; then
 				get_geoip $GEOIP_CODE ipv4 | insert_nftset $NFTSET_BLACK_STATIC
 				get_geoip $GEOIP_CODE ipv6 | insert_nftset $NFTSET_BLACK6_STATIC
@@ -1070,10 +1070,10 @@ add_firewall_rule() {
 
 	#屏蔽列表
 	[ "$USE_BLOCK_LIST_ALL" = "1" ] && {
-		cat $RULES_PATH/block_ip | sed 's/#.*//' | grep -E "$IPv4_REGEX" | insert_nftset $NFTSET_BLOCK_STATIC
-		cat $RULES_PATH/block_ip | sed 's/#.*//' | grep -E "$IPv6_REGEX" | insert_nftset $NFTSET_BLOCK6_STATIC
+		cat $USER_RULES_PATH/block_ip | sed 's/#.*//' | grep -E "$IPv4_REGEX" | insert_nftset $NFTSET_BLOCK_STATIC
+		cat $USER_RULES_PATH/block_ip | sed 's/#.*//' | grep -E "$IPv6_REGEX" | insert_nftset $NFTSET_BLOCK6_STATIC
 		[ "$USE_GEOVIEW" = "1" ] && {
-			local GEOIP_CODE=$(cat $RULES_PATH/block_ip | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g')
+			local GEOIP_CODE=$(cat $USER_RULES_PATH/block_ip | tr -s "\r\n" "\n" | sed -e "/^$/d" | grep -E "^geoip:" | grep -v "^geoip:private" | sed -E 's/^geoip:(.*)/\1/' | sed ':a;N;$!ba;s/\n/,/g')
 			if [ -n "$GEOIP_CODE" ]; then
 				get_geoip $GEOIP_CODE ipv4 | insert_nftset $NFTSET_BLOCK_STATIC
 				get_geoip $GEOIP_CODE ipv6 | insert_nftset $NFTSET_BLOCK6_STATIC

luci-app-passwall/root/usr/share/passwall/utils.sh

@@ -14,6 +14,7 @@ TMP_IFACE_PATH=${TMP_PATH}/iface
 TMP_ROUTE_PATH=${TMP_PATH}/route
 TMP_SCRIPT_FUNC_PATH=${TMP_PATH}/script_func
 RULES_PATH=/usr/share/${CONFIG}/rules
+USER_RULES_PATH=/etc/${CONFIG}/rules
 
 IPv6_REGEX="([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|"
 IPv6_REGEX="${IPv6_REGEX}([0-9a-fA-F]{1,4}:){1,7}:|"
@@ -493,11 +494,11 @@ get_subscribe_host(){
 }
 
 gen_lanlist() {
-	cat $RULES_PATH/lanlist_ipv4 | tr -s '\n' | grep -v "^#"
+	cat $USER_RULES_PATH/lanlist_ipv4 | tr -s '\n' | grep -v "^#"
 }
 
 gen_lanlist_6() {
-	cat $RULES_PATH/lanlist_ipv6 | tr -s '\n' | grep -v "^#"
+	cat $USER_RULES_PATH/lanlist_ipv6 | tr -s '\n' | grep -v "^#"
 }
 
 get_wan_ips() {

luci-theme-design/Makefile

@@ -9,7 +9,7 @@ LUCI_TITLE:=Design Theme
 LUCI_DEPENDS:=
 PKG_LICENSE:=Apache-2.0
 PKG_VERSION:=7.1
-PKG_RELEASE:=8
+PKG_RELEASE:=9
 
 LUCI_MINIFY_CSS:=
 CONFIG_LUCI_CSSTIDY:=

luci-theme-design/htdocs/luci-static/design/css/style.css

@@ -1243,6 +1243,17 @@ table > tr:last-child {
 	margin: auto 0;
 }
 
+.nft-rules .th,
+.nft-rules .td:not(.center) {
+    text-align: left;
+}
+
+.nft-rules .ifacebadge > em {
+    width: auto;
+    height: auto;
+    padding-left: 0;
+}
+
 .cbi-section-table-row {
     text-align: center;
 }
@@ -4095,6 +4106,7 @@ input[name="nslookup"] {
 
 
 .navbar {
+    display: flex;
     z-index: 200;
 	overflow: hidden;
 	position: fixed;
@@ -4110,10 +4122,9 @@ input[name="nslookup"] {
   }
   
   .navbar a {
-	  float: left;
+	  flex: 1;
 	  text-align: center;
 	  padding: 8px 0;
-	  width: 20%;
 	  text-decoration: none;
 	  max-width: 100px;
   }

luci-theme-design/htdocs/luci-static/design/images/homeproxy.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#999" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round">
+  <path d="m3 10 9-7 9 7M5 9v11h14V9"/>
+  <path d="M8 12h8m-2-2 2 2-2 2M16 17H8m2-2-2 2 2 2"/>
+</svg>

luci-theme-design/ucode/template/themes/design/header.ut

@@ -18,8 +18,10 @@
 	const request_path = ctx.request_path ?? dispatch_path;
 	const current_path = length(dispatch_path) ? join('-', dispatch_path) : 'main-login';
 	const current_page = length(request_path) ? join('-', request_path) : current_path;
-	const show_proxy_icon = access('/etc/config/google_fu_mode');
-	const theme_rev = `${version?.luciversion ?? 'dev'}-designfix-20260418i`;
+	const show_proxy_icon = access('/etc/config/shadowsocksr') || access('/etc/config/google_fu_mode');
+	const show_openclash_icon = access('/etc/config/openclash');
+	const show_homeproxy_icon = access('/etc/config/homeproxy');
+	const theme_rev = `${version?.luciversion ?? 'dev'}-designfix-20260927`;
 
 	http.prepare_content('text/html; charset=UTF-8');
 -%}
@@ -77,6 +79,10 @@
 	<a href="{{ dispatcher.build_url('admin/status/overview') }}"><img src="{{ media }}/images/home.png"></a>
 	{% if (show_proxy_icon): %}
 	<a href="{{ dispatcher.build_url('admin/services/shadowsocksr') }}"><img src="{{ media }}/images/ssr.png"></a>
+	{% elif (show_homeproxy_icon): %}
+	<a href="{{ dispatcher.build_url('admin/services/homeproxy') }}" title="HomeProxy"><img src="{{ media }}/images/homeproxy.svg" alt="HomeProxy"></a>
+	{% elif (show_openclash_icon): %}
+	<a href="{{ dispatcher.build_url('admin/services/openclash') }}" title="OpenClash"><img src="{{ media }}/images/openclash.png" alt="OpenClash"></a>
 	{% endif %}
 	<a href="{{ dispatcher.build_url('admin/network/network') }}"><img src="{{ media }}/images/link.png"></a>
 	<a href="{{ dispatcher.build_url('admin/status/realtime') }}"><img src="{{ media }}/images/rank.png"></a>

mise/Makefile

@@ -14,8 +14,8 @@ MISE_HASH_x86_64:=3832f39c325e343f81fe3d92b2447c5d1a5eea1bc85092bb7b6c2580622264
 MISE_HASH_aarch64:=06186cfbfe947049b21d58575fb0ea800cc26ed1375f20f4b678cb3a9d679437
 
 PKG_NAME:=mise
-PKG_VERSION:=2026.9.14
-PKG_RELEASE:=21
+PKG_VERSION:=2026.9.15
+PKG_RELEASE:=22
 PKG_SOURCE:=$(PKG_NAME)-v$(PKG_VERSION)-linux-$(MISE_ARCH)-musl.tar.gz
 PKG_SOURCE_URL:=https://github.com/jdx/mise/releases/download/v$(PKG_VERSION)/
 PKG_HASH:=skip

node/Makefile

@@ -0,0 +1,277 @@
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=node
+
+ifeq ($(CONFIG_NODEJS_22),y)
+PKG_VERSION:=22.23.2
+PKG_RELEASE:=1
+PKG_HASH:=skip
+PATCH_DIR:=./patches/v22.x
+NODEJS_BIN_SUM:=b294a556e639d64338823920e5866c21c02741742d2e1529ee1a225c1ec9252a
+NODE_MODULE_VERSION:=127
+else
+ifeq ($(CONFIG_NODEJS_26),y)
+PKG_VERSION:=26.9.0
+PKG_RELEASE:=1
+PKG_HASH:=skip
+PATCH_DIR:=./patches/v26.x
+NODEJS_BIN_SUM:=03d9104fc4f19652e74480fed11c023d75981464b7292f21a601c3f95ce7d90d
+NODE_MODULE_VERSION:=147
+else
+PKG_VERSION:=24.21.0
+PKG_RELEASE:=1
+PKG_HASH:=skip
+PATCH_DIR:=./patches/v24.x
+NODEJS_BIN_SUM:=6e1db87ef58b8819e5d5402eff1536491b18edd8eb7bee5ef7897876e88dc5ff
+NODE_MODULE_VERSION:=137
+endif
+endif
+
+PKG_SOURCE:=$(PKG_NAME)-v$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://mirrors.tencent.com/nodejs-release/v$(PKG_VERSION) \
+                https://nodejs.org/dist/v$(PKG_VERSION)
+PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-v$(PKG_VERSION)
+HOST_BUILD_DIR:=$(BUILD_DIR_HOST)/$(PKG_NAME)-v$(PKG_VERSION)
+
+PKG_MAINTAINER:=Hirokazu MORIKAWA <morikw2@gmail.com>
+PKG_LICENSE:=MIT
+PKG_LICENSE_FILES:=LICENSE
+PKG_CPE_ID:=cpe:/a:nodejs:node.js
+
+HOST_BUILD_DEPENDS:=python3/host python-setuptools/host
+HOST_BUILD_PARALLEL:=1
+
+PKG_BUILD_DEPENDS:=python3/host python-setuptools/host
+PKG_BUILD_PARALLEL:=1
+PKG_INSTALL:=1
+PKG_ASLR_PIE:=0
+
+include $(INCLUDE_DIR)/host-build.mk
+include $(INCLUDE_DIR)/package.mk
+
+define Package/node
+  SECTION:=lang
+  CATEGORY:=Languages
+  SUBMENU:=Node.js
+  TITLE:=Node.js is a platform built on Chrome's JavaScript runtime
+  URL:=https://nodejs.org/
+  DEPENDS:=@HAS_FPU @(i386||x86_64||arm||aarch64||riscv64) \
+	   +libstdcpp +libopenssl +zlib +libnghttp2 \
+	   +libcares +libatomic +NODEJS_ICU_SYSTEM:icu +NODEJS_ICU_SYSTEM:icu-full-data
+  ABI_VERSION:=$(NODE_MODULE_VERSION)
+endef
+
+define Package/node/description
+  Node.js® is a JavaScript runtime built on Chrome's V8 JavaScript engine. Node.js uses
+  an event-driven, non-blocking I/O model that makes it lightweight and efficient. Node.js'
+   package ecosystem, npm, is the largest ecosystem of open source libraries in the world.
+
+  *** The following preparations must be made on the host side. ***
+      1. gcc 12.2 or higher is required.
+      2. To build a 32-bit target, gcc-multilib, g++-multilib are required.
+      3. Requires libatomic package. (If necessary, install the 32-bit library at the same time.)
+     ex) sudo apt-get install gcc-multilib g++-multilib
+endef
+
+define Package/node-npm
+  SECTION:=lang
+  CATEGORY:=Languages
+  SUBMENU:=Node.js
+  TITLE:=NPM stands for Node Package Manager
+  URL:=https://www.npmjs.com/
+  DEPENDS:=+node
+endef
+
+define Package/node-npm/description
+	NPM is the package manager for NodeJS
+endef
+
+define Package/node/config
+	menu "Configuration"
+
+	choice
+		prompt "Version Selection"
+		default NODEJS_22
+		help
+		 Select node.js version.
+		 The host package version is also the same.
+
+		config NODEJS_22
+			bool "22.x Maintenance LTS"
+
+		config NODEJS_24
+			bool "24.x Active LTS"
+
+		config NODEJS_26
+			bool "26.x Current"
+	endchoice
+
+	if PACKAGE_node
+		choice
+			prompt "i18n features"
+			default NODEJS_ICU_SMALL
+			help
+			 Select i18n features
+
+			config NODEJS_ICU_NONE
+				bool "Disable"
+
+			config NODEJS_ICU_SMALL
+				bool "small-icu"
+
+			config NODEJS_ICU_SYSTEM
+				depends on ARCH_64BIT
+				bool "system-icu"
+
+			config NODEJS_FULL_ICU
+				bool "full-icu"
+		endchoice
+	endif
+
+	config NODEJS_NPM_KEEP_CACHE
+		bool "keep npm cache"
+		help
+		  Keep npm package cache.
+		  More space will be consumed by the cache.
+		default n
+
+	config NODEJS_NPM_CACHE_DIR
+		string "Set npm cache directory" if NODEJS_NPM_KEEP_CACHE
+		default ""
+		help
+		  Store npm cache in this directory.
+		  If not set, uses './tmp'
+
+	config NODEJS_HOST_BIN
+		bool "Install the official nodejs binary package as HOSTPKG"
+		depends on HOST_OS_LINUX
+		help
+		  Reduce build time for the host package.
+		default y
+
+	endmenu
+endef
+
+NODEJS_CPU:=$(subst aarch64,arm64,$(subst x86_64,x64,$(subst i386,ia32,$(ARCH))))
+
+ifneq ($(CONFIG_ARCH_64BIT),y)
+FORCE_32BIT:=-m32
+endif
+
+MAKE_VARS+= \
+	DESTCPU=$(NODEJS_CPU) \
+	NO_LOAD='cctest.target.mk embedtest.target.mk node_mksnapshot.target.mk overlapped-checker.target.mk \
+		mkcodecache.target.mk tools/v8_gypfiles/torque_base.target.mk tools/v8_gypfiles/v8_init.target.mk' \
+	LD_LIBRARY_PATH=$(STAGING_DIR_HOSTPKG)/share/icu/current/lib
+
+HOST_MAKE_VARS+=NO_LOAD='cctest.target.mk embedtest.target.mk overlapped-checker.target.mk'
+
+CONFIGURE_VARS:= \
+	CC="$(TARGET_CC) $(TARGET_OPTIMIZATION)" \
+	CXX="$(TARGET_CXX) $(TARGET_OPTIMIZATION)" \
+	CC_host="$(HOSTCC) $(FORCE_32BIT)" \
+	CXX_host="$(HOSTCXX) $(FORCE_32BIT)"
+
+CONFIGURE_ARGS:= \
+	--dest-cpu=$(NODEJS_CPU) \
+	--dest-os=linux \
+	--cross-compiling \
+	--shared-zlib \
+	--shared-openssl \
+	--shared-nghttp2 \
+	--shared-cares \
+	$(if $(CONFIG_NODEJS_26),--v8-disable-temporal-support) \
+	$(if $(CONFIG_NODEJS_26),$(if $(CONFIG_ARCH_64BIT),,--without-ffi)) \
+	--with-intl=$(if $(CONFIG_NODEJS_ICU_SMALL),small-icu,$(if $(CONFIG_NODEJS_ICU_SYSTEM),system-icu,$(if $(CONFIG_NODEJS_FULL_ICU),full-icu,none))) \
+	$(if $(findstring +neon",$(CONFIG_CPU_TYPE)),--with-arm-fpu=neon) \
+	$(if $(findstring +neon-vfpv4",$(CONFIG_CPU_TYPE)),--with-arm-fpu=neon) \
+	$(if $(findstring +vfpv4",$(CONFIG_CPU_TYPE)),--with-arm-fpu=vfpv3) \
+	$(if $(findstring +vfp",$(CONFIG_CPU_TYPE)),--with-arm-fpu=vfp) \
+	$(if $(findstring +vfpv3",$(CONFIG_CPU_TYPE)),--with-arm-fpu=vfpv3) \
+	$(if $(findstring +vfpv3-d16",$(CONFIG_CPU_TYPE)),--with-arm-fpu=vfpv3-d16) \
+	--prefix=/usr
+
+HOST_CONFIGURE_VARS:=
+HOST_CONFIGURE_ARGS:= \
+	--dest-os=$(if $(findstring Darwin,$(HOST_OS)),mac,linux) \
+	--with-intl=small-icu \
+	--prefix=$(STAGING_DIR_HOSTPKG)
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/include
+	$(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/
+endef
+
+define Package/node/install
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/node $(1)/usr/bin/
+endef
+
+define Package/node-npm/install
+	$(INSTALL_DIR) $(1)/usr/lib/node_modules/npm
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/node_modules/npm/{package.json,LICENSE} \
+		$(1)/usr/lib/node_modules/npm/
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/node_modules/npm/README.md \
+		$(1)/usr/lib/node_modules/npm/
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/node_modules/npm/{node_modules,bin,lib} \
+		$(1)/usr/lib/node_modules/npm/
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(LN) ../lib/node_modules/npm/bin/npm-cli.js $(1)/usr/bin/npm
+	$(LN) ../lib/node_modules/npm/bin/npx-cli.js $(1)/usr/bin/npx
+endef
+
+define Package/node-npm/postrm
+#!/bin/sh
+rm -rf /usr/lib/node_modules/npm || true
+endef
+
+ifeq ($(CONFIG_NODEJS_HOST_BIN),y)
+
+NODEJS_BIN:=node-v$(PKG_VERSION)-linux-x64.tar.gz
+
+define Download/nodebin
+	URL:=https://nodejs.org/download/release/v$(PKG_VERSION)/
+	FILE:=$(NODEJS_BIN)
+	HASH:=skip
+endef
+
+define Host/Prepare
+	$(eval $(call Download,nodebin))
+endef
+
+define Host/Configure
+	# nothing to do
+endef
+
+define Host/Compile
+	# nothing to do
+endef
+
+define Host/Install
+	rm -f $(1)/bin/npm
+	rm -f $(1)/bin/npx
+	rm -rf $(1)/lib/node_modules/npm
+	rm -f $(1)/bin/corepack
+	rm -rf $(1)/lib/node_modules/corepack
+	$(TAR) xvf $(DL_DIR)/$(NODEJS_BIN) -C $(1) --strip-components=1
+	rm -f $(1)/{CHANGELOG.md,LICENSE,README.md}
+endef
+
+else
+define Host/Install
+	rm -f $(1)/bin/npm
+	rm -f $(1)/bin/npx
+	rm -rf $(1)/lib/node_modules/npm
+	rm -f $(1)/bin/corepack
+	rm -rf $(1)/lib/node_modules/corepack
+	$(call Host/Install/Default)
+endef
+endif
+
+$(eval $(call HostBuild))
+$(eval $(call BuildPackage,node))
+$(eval $(call BuildPackage,node-npm))

node/patches/v22.x/003-path.patch

@@ -0,0 +1,12 @@
+--- a/lib/internal/modules/cjs/loader.js
++++ b/lib/internal/modules/cjs/loader.js
+@@ -2026,7 +2026,8 @@ Module._initPaths = function() {
+     path.resolve(process.execPath, '..') :
+     path.resolve(process.execPath, '..', '..');
+ 
+-  const paths = [path.resolve(prefixDir, 'lib', 'node')];
++  const paths = [path.resolve(prefixDir, 'lib', 'node'),
++                 path.resolve(prefixDir, 'lib', 'node_modules')];
+ 
+   if (homeDir) {
+     ArrayPrototypeUnshift(paths, path.resolve(homeDir, '.node_libraries'));

node/patches/v22.x/004-musl_support.patch

@@ -0,0 +1,42 @@
+--- a/deps/v8/src/base/platform/condition-variable.cc
++++ b/deps/v8/src/base/platform/condition-variable.cc
+@@ -20,7 +20,7 @@ namespace base {
+ 
+ ConditionVariable::ConditionVariable() {
+ #if (V8_OS_FREEBSD || V8_OS_NETBSD || V8_OS_OPENBSD || \
+-     (V8_OS_LINUX && V8_LIBC_GLIBC))
++     V8_OS_LINUX)
+   // On Free/Net/OpenBSD and Linux with glibc we can change the time
+   // source for pthread_cond_timedwait() to use the monotonic clock.
+   pthread_condattr_t attr;
+@@ -96,7 +96,7 @@ bool ConditionVariable::WaitFor(Mutex* m
+       &native_handle_, &mutex->native_handle(), &ts);
+ #else
+ #if (V8_OS_FREEBSD || V8_OS_NETBSD || V8_OS_OPENBSD || \
+-     (V8_OS_LINUX && V8_LIBC_GLIBC))
++     V8_OS_LINUX)
+   // On Free/Net/OpenBSD and Linux with glibc we can change the time
+   // source for pthread_cond_timedwait() to use the monotonic clock.
+   result = clock_gettime(CLOCK_MONOTONIC, &ts);
+--- a/deps/v8/src/base/platform/platform-posix.cc
++++ b/deps/v8/src/base/platform/platform-posix.cc
+@@ -1219,7 +1219,7 @@ bool Thread::Start() {
+ #if V8_OS_DARWIN
+     // Default on Mac OS X is 512kB -- bump up to 1MB
+     stack_size = 1 * 1024 * 1024;
+-#elif V8_OS_AIX
++#elif V8_OS_AIX || !defined(__GLIBC__)
+     // Default on AIX is 96kB -- bump up to 2MB
+     stack_size = 2 * 1024 * 1024;
+ #endif
+--- a/deps/v8/src/codegen/external-reference-table.cc
++++ b/deps/v8/src/codegen/external-reference-table.cc
+@@ -10,7 +10,7 @@
+ #include "src/ic/stub-cache.h"
+ #include "src/logging/counters.h"
+ 
+-#if defined(DEBUG) && defined(V8_OS_LINUX) && !defined(V8_OS_ANDROID)
++#if defined(DEBUG) && defined(V8_OS_LINUX) && !defined(V8_OS_ANDROID) && defined(V8_LIBC_GLIBC)
+ #define SYMBOLIZE_FUNCTION
+ #include <execinfo.h>
+ 

node/patches/v22.x/007-fix_host_build_on_macos.patch

@@ -0,0 +1,11 @@
+--- a/tools/gyp/pylib/gyp/generator/make.py
++++ b/tools/gyp/pylib/gyp/generator/make.py
+@@ -208,7 +208,7 @@ cmd_solink_module = $(LINK.$(TOOLSET)) -
+ 
+ LINK_COMMANDS_MAC = """\
+ quiet_cmd_alink = LIBTOOL-STATIC $@
+-cmd_alink = rm -f $@ && %(python)s gyp-mac-tool filter-libtool libtool $(GYP_LIBTOOLFLAGS) -static -o $@ $(filter %%.o,$^)
++cmd_alink = rm -f $@ && %(python)s gyp-mac-tool filter-libtool /usr/bin/libtool $(GYP_LIBTOOLFLAGS) -static -o $@ $(filter %%.o,$^)
+ 
+ quiet_cmd_link = LINK($(TOOLSET)) $@
+ cmd_link = $(LINK.$(TOOLSET)) $(GYP_LDFLAGS) $(LDFLAGS.$(TOOLSET)) -o "$@" $(LD_INPUTS) $(LIBS)

node/patches/v22.x/012-changing-default-npm-settings.patch

@@ -0,0 +1,20 @@
+--- a/deps/npm/node_modules/@npmcli/config/lib/definitions/definitions.js
++++ b/deps/npm/node_modules/@npmcli/config/lib/definitions/definitions.js
+@@ -1212,7 +1212,7 @@ const definitions = {
+     },
+   }),
+   loglevel: new Definition('loglevel', {
+-    default: 'notice',
++    default: 'info',
+     type: [
+       'silent',
+       'error',
+@@ -1993,7 +1993,7 @@ const definitions = {
+     flatten,
+   }),
+   'strict-ssl': new Definition('strict-ssl', {
+-    default: true,
++    default: false,
+     type: Boolean,
+     description: `
+       Whether or not to do SSL key validation when making requests to the

node/patches/v22.x/200-uv_gyp.patch

@@ -0,0 +1,10 @@
+--- a/deps/uv/uv.gyp
++++ b/deps/uv/uv.gyp
+@@ -156,6 +156,7 @@
+       'target_name': 'libuv',
+       'toolsets': ['host', 'target'],
+       'type': '<(uv_library)',
++      'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+       'include_dirs': [
+         'include',
+         'src/',

node/patches/v22.x/201-zlib_gyp.patch

@@ -0,0 +1,10 @@
+--- a/deps/zlib/zlib.gyp
++++ b/deps/zlib/zlib.gyp
+@@ -8,6 +8,7 @@
+     'use_system_zlib%': 0,
+     'arm_fpu%': '',
+   },
++  'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+   'conditions': [
+     ['use_system_zlib==0', {
+       'targets': [

node/patches/v22.x/202-node_gyp.patch

@@ -0,0 +1,18 @@
+--- a/node.gyp
++++ b/node.gyp
+@@ -1141,6 +1141,7 @@
+       'includes': [
+         'node.gypi'
+       ],
++      'libraries!':[ '-licui18n', '-licuuc', '-licudata', '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'include_dirs': [
+         'src',
+         'tools/msvs/genfiles',
+@@ -1357,6 +1358,7 @@
+         'tools',
+         'src',
+       ],
++      'libraries!':[ '-licui18n', '-licuuc', '-licudata', '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'sources': [
+         'tools/js2c.cc',
+         'tools/executable_wrapper.h',

node/patches/v22.x/203-icu-generic_gyp.patch

@@ -0,0 +1,106 @@
+--- a/tools/icu/icu-generic.gyp
++++ b/tools/icu/icu-generic.gyp
+@@ -106,6 +106,7 @@
+           'sources': [
+             '<@(icu_src_i18n)'
+           ],
++          'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+           'include_dirs': [
+             '<(icu_path)/source/i18n',
+           ],
+@@ -114,6 +115,7 @@
+           ],
+           'dependencies': [ 'icuucx', 'icu_implementation', 'icu_uconfig', 'icu_uconfig_target' ],
+           'direct_dependent_settings': {
++            'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+             'include_dirs': [
+               '<(icu_path)/source/i18n',
+             ],
+@@ -223,6 +225,7 @@
+               # full data - no trim needed
+               'sources': [ '<(SHARED_INTERMEDIATE_DIR)/icudt<(icu_ver_major)_dat.<(icu_asm_ext)' ],
+               'dependencies': [ 'genccode#host', 'icupkg#host', 'icu_implementation#host', 'icu_uconfig' ],
++              'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+               'include_dirs': [
+                 '<(icu_path)/source/common',
+               ],
+@@ -307,6 +310,7 @@
+               # This file contains the small ICU data
+               'sources': [ '<(SHARED_INTERMEDIATE_DIR)/icusmdt<(icu_ver_major)_dat.<(icu_asm_ext)' ],
+               # for umachine.h
++              'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+               'include_dirs': [
+                 '<(icu_path)/source/common',
+               ],
+@@ -323,6 +327,7 @@
+       'sources': [
+         '<@(icu_src_stubdata)'
+       ],
++      'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+       'include_dirs': [
+         '<(icu_path)/source/common',
+       ],
+@@ -362,6 +367,7 @@
+           '_XOPEN_SOURCE_EXTENDED=0',
+         ]}],
+       ],
++      'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+       'include_dirs': [
+         '<(icu_path)/source/common',
+       ],
+@@ -371,6 +377,7 @@
+       'cflags_c': ['-std=c99'],
+       'export_dependent_settings': [ 'icu_uconfig', 'icu_uconfig_target' ],
+       'direct_dependent_settings': {
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(icu_path)/source/common',
+         ],
+@@ -401,6 +408,7 @@
+         '<(icu_path)/source/tools/toolutil/dbgutil.cpp',
+         '<(icu_path)/source/tools/toolutil/dbgutil.h',
+       ],
++      'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+       'include_dirs': [
+         '<(icu_path)/source/common',
+         '<(icu_path)/source/i18n',
+@@ -420,6 +428,7 @@
+         }]
+       ],
+       'direct_dependent_settings': {
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(icu_path)/source/common',
+           '<(icu_path)/source/i18n',
+@@ -441,6 +450,7 @@
+       'target_name': 'genrb',
+       'type': 'executable',
+       'toolsets': [ 'host' ],
++      'libraries!':[ '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'dependencies': [ 'icutools', 'icu_implementation' ],
+       'sources': [
+         '<@(icu_src_genrb)'
+@@ -463,6 +473,7 @@
+       'target_name': 'iculslocs',
+       'toolsets': [ 'host' ],
+       'type': 'executable',
++      'libraries!':[ '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'dependencies': [ 'icutools' ],
+       'sources': [
+         'iculslocs.cc',
+@@ -481,6 +492,7 @@
+       'target_name': 'icupkg',
+       'toolsets': [ 'host' ],
+       'type': 'executable',
++      'libraries!':[ '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'dependencies': [ 'icutools' ],
+       'sources': [
+         '<@(icu_src_icupkg)',
+@@ -498,6 +510,7 @@
+       'target_name': 'genccode',
+       'toolsets': [ 'host' ],
+       'type': 'executable',
++      'libraries!':[ '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'dependencies': [ 'icutools' ],
+       'sources': [
+         '<@(icu_src_genccode)',

node/patches/v22.x/204-v8_gyp.patch

@@ -0,0 +1,166 @@
+--- a/tools/v8_gypfiles/v8.gyp
++++ b/tools/v8_gypfiles/v8.gyp
+@@ -90,6 +90,7 @@
+       ],
+       'hard_dependency': 1,
+       'direct_dependent_settings': {
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(SHARED_INTERMEDIATE_DIR)',
+         ],
+@@ -211,6 +212,7 @@
+           '<@(torque_outputs_cc)',
+           '<@(torque_outputs_inc)',
+         ],
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(SHARED_INTERMEDIATE_DIR)',
+         ],
+@@ -232,6 +234,7 @@
+         'sources': [
+           '<(generate_bytecode_builtins_list_output)',
+         ],
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(generate_bytecode_output_root)',
+           '<(SHARED_INTERMEDIATE_DIR)',
+@@ -270,6 +273,7 @@
+       'sources': [
+         '<(V8_ROOT)/src/init/setup-isolate-full.cc',
+       ],
++      'include_dirs': [ '../../deps/v8/third_party/abseil-cpp', '<!@(echo "$STAGING_DIR"/usr/../usr/include)' ],
+     },  # v8_init
+     {
+       # This target is used to work around a GCC issue that causes the
+@@ -311,9 +315,11 @@
+         'v8_pch',
+         'abseil.gyp:abseil',
+       ],
++      'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+       'include_dirs': [
+         '<(SHARED_INTERMEDIATE_DIR)',
+         '<(generate_bytecode_output_root)',
++        '../../deps/v8/third_party/abseil-cpp', '<!@(echo "$STAGING_DIR"/usr/../usr/include)',
+       ],
+       'sources': [
+         '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/BUILD.gn"  "\\"v8_initializers.*?sources = ")',
+@@ -842,6 +848,7 @@
+       'toolsets': ['host', 'target'],
+       'direct_dependent_settings': {
+         'sources': ['<!@pymod_do_main(GN-scraper "<(V8_ROOT)/BUILD.gn"  "v8_compiler_sources = ")'],
++        'include_dirs': [ '../../deps/v8/third_party/abseil-cpp', '<!@(echo "$STAGING_DIR"/usr/../usr/include)' ],
+         'conditions': [
+           ['v8_target_arch=="ia32"', {
+             'sources': [
+@@ -956,6 +963,8 @@
+       'target_name': 'v8_turboshaft',
+       'type': 'static_library',
+       'toolsets': ['host', 'target'],
++      'libraries!':[ '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
++      'include_dirs': [ '../../deps/v8/third_party/abseil-cpp', '<!@(echo "$STAGING_DIR"/usr/../usr/include)' ],
+       'dependencies': [
+         'generate_bytecode_builtins_list',
+         'run_torque',
+@@ -995,6 +1004,7 @@
+         'run_torque',
+         'v8_maybe_icu',
+       ],
++      'include_dirs': [ '../../deps/v8/third_party/abseil-cpp', '<!@(echo "$STAGING_DIR"/usr/../usr/include)' ],
+       'conditions': [
+         ['(is_component_build and not v8_optimized_debug and v8_enable_fast_mksnapshot) or v8_enable_turbofan==0', {
+           'dependencies': [
+@@ -1090,6 +1100,7 @@
+       ],
+       'includes': ['inspector.gypi'],
+       'direct_dependent_settings': {
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(generate_bytecode_output_root)',
+           '<(SHARED_INTERMEDIATE_DIR)',
+@@ -1749,6 +1760,7 @@
+         }],
+       ],
+       'direct_dependent_settings': {
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(V8_ROOT)/include',
+         ],
+@@ -1769,6 +1781,7 @@
+     {
+       'target_name': 'bytecode_builtins_list_generator',
+       'type': 'executable',
++      'libraries!':[ '-licui18n', '-licuuc', '-licudata', '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'conditions': [
+         ['want_separate_host_toolset', {
+           'toolsets': ['host'],
+@@ -1797,6 +1810,9 @@
+     {
+       'target_name': 'mksnapshot',
+       'type': 'executable',
++      'libraries!':[ '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
++      'library_dirs':[ '../../../../staging_dir/hostpkg/share/icu/current/lib' ],
++      'include_dirs': [ '../../deps/v8/third_party/abseil-cpp', '<!@(echo "$STAGING_DIR"/usr/../usr/include)' ],
+       'dependencies': [
+         'v8_base_without_compiler',
+         'v8_compiler_for_mksnapshot',
+@@ -1825,6 +1841,7 @@
+     {
+       'target_name': 'torque',
+       'type': 'executable',
++      'libraries!':[ '-licui18n', '-licuuc', '-licudata', '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'dependencies': [
+         'torque_base',
+         # "build/win:default_exe_manifest",
+@@ -1867,6 +1884,7 @@
+     {
+       'target_name': 'torque-language-server',
+       'type': 'executable',
++      'libraries!':[ '-licui18n', '-licuuc', '-licudata', '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'conditions': [
+         ['want_separate_host_toolset', {
+           'toolsets': ['host'],
+@@ -1898,6 +1916,8 @@
+     {
+       'target_name': 'gen-regexp-special-case',
+       'type': 'executable',
++      'libraries!':[ '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
++      'library_dirs':[ '../../../../staging_dir/hostpkg/share/icu/current/lib' ],
+       'dependencies': [
+         'v8_libbase',
+         # "build/win:default_exe_manifest",
+@@ -2138,6 +2158,7 @@
+          }],
+       ],
+       'direct_dependent_settings': {
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(V8_ROOT)/include',
+         ],
+@@ -2277,15 +2298,19 @@
+         }],
+       ],
+       'direct_dependent_settings': {
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(V8_ROOT)/third_party/zlib',
+           '<(V8_ROOT)/third_party/zlib/google',
++          '../../deps/v8/third_party/abseil-cpp', '<!@(echo "$STAGING_DIR"/usr/../usr/include)',
+         ],
+       },
+       'defines': [ 'ZLIB_IMPLEMENTATION' ],
++      'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+       'include_dirs': [
+         '<(V8_ROOT)/third_party/zlib',
+         '<(V8_ROOT)/third_party/zlib/google',
++        '../../deps/v8/third_party/abseil-cpp', '<!@(echo "$STAGING_DIR"/usr/../usr/include)',
+       ],
+       'sources': [
+         '<(V8_ROOT)/third_party/zlib/adler32.c',
+@@ -2330,6 +2355,7 @@
+       'variables': {
+         'FP16_ROOT': '../../deps/v8/third_party/fp16',
+       },
++      'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+       'direct_dependent_settings': {
+         'include_dirs': [
+           '<(FP16_ROOT)/src/include',

node/patches/v22.x/205_abseil_gyp.patch

@@ -0,0 +1,19 @@
+--- a/tools/v8_gypfiles/abseil.gyp
++++ b/tools/v8_gypfiles/abseil.gyp
+@@ -9,13 +9,16 @@
+         'ABSEIL_ROOT': '../../deps/v8/third_party/abseil-cpp',
+       },
+       'direct_dependent_settings': {
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(ABSEIL_ROOT)',
+         ],
+       },
++      'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+       'include_dirs': [
+         '<(ABSEIL_ROOT)',
+       ],
++      'include_dirs': [ '<(ABSEIL_ROOT)', '<!@(echo "$STAGING_DIR"/usr/../usr/include)' ],
+       'sources': [
+         '<(ABSEIL_ROOT)/absl/algorithm/algorithm.h',
+         '<(ABSEIL_ROOT)/absl/algorithm/container.h',

node/patches/v22.x/999-deps-v8-src-base-small-vector_h.patch

@@ -0,0 +1,10 @@
+--- a/deps/v8/src/base/small-vector.h
++++ b/deps/v8/src/base/small-vector.h
+@@ -22,7 +22,6 @@ template <typename T, size_t kSize, type
+ class SmallVector {
+   // Currently only support trivially copyable and trivially destructible data
+   // types, as it uses memcpy to copy elements and never calls destructors.
+-  ASSERT_TRIVIALLY_COPYABLE(T);
+   static_assert(std::is_trivially_destructible<T>::value);
+ 
+  public:

node/patches/v22.x/999-fix_compile_error_for_ia32.patch

@@ -0,0 +1,38 @@
+--- a/deps/v8/src/compiler/backend/ia32/instruction-selector-ia32.cc
++++ b/deps/v8/src/compiler/backend/ia32/instruction-selector-ia32.cc
+@@ -1161,7 +1161,7 @@ template <typename Adapter>
+ void VisitAtomicExchange(InstructionSelectorT<Adapter>* selector,
+                          typename Adapter::node_t node, ArchOpcode opcode,
+                          MachineRepresentation rep) {
+-  using node_t = Adapter::node_t;
++  using node_t = typename Adapter::node_t;
+   IA32OperandGeneratorT<Adapter> g(selector);
+   node_t base = selector->input_at(node, 0);
+   node_t index = selector->input_at(node, 1);
+@@ -1732,7 +1732,7 @@ template <typename Adapter>
+ void VisitWord32PairShift(InstructionSelectorT<Adapter>* selector,
+                           InstructionCode opcode,
+                           typename Adapter::node_t node) {
+-  using node_t = Adapter::node_t;
++  using node_t = typename Adapter::node_t;
+   IA32OperandGeneratorT<Adapter> g(selector);
+ 
+   node_t shift = selector->input_at(node, 2);
+@@ -2507,7 +2507,7 @@ template <typename Adapter>
+ void VisitAtomicBinOp(InstructionSelectorT<Adapter>* selector,
+                       typename Adapter::node_t node, ArchOpcode opcode,
+                       MachineRepresentation rep) {
+-  using node_t = Adapter::node_t;
++  using node_t = typename Adapter::node_t;
+   AddressingMode addressing_mode;
+   IA32OperandGeneratorT<Adapter> g(selector);
+   node_t base = selector->input_at(node, 0);
+@@ -2528,7 +2528,7 @@ void VisitAtomicBinOp(InstructionSelecto
+ template <typename Adapter>
+ void VisitPairAtomicBinOp(InstructionSelectorT<Adapter>* selector,
+                           typename Adapter::node_t node, ArchOpcode opcode) {
+-  using node_t = Adapter::node_t;
++  using node_t = typename Adapter::node_t;
+   IA32OperandGeneratorT<Adapter> g(selector);
+   node_t base = selector->input_at(node, 0);
+   node_t index = selector->input_at(node, 1);

node/patches/v22.x/999-localhost-no-addrconfig.patch

@@ -0,0 +1,29 @@
+Description: do not use dns.ADDRCONFIG for localhost
+ it fails on IPv6-only systems. Setting it with libc fails on linux.
+ https://github.com/nodejs/node/issues/33279
+Author: Jérémy Lal <kapouer@melix.org>
+Last-Update: 2020-06-11
+Bug-Debian: https://bugs.debian.org/962318
+Forwarded: https://github.com/nodejs/node/issues/33816
+--- a/lib/net.js
++++ b/lib/net.js
+@@ -1,4 +1,5 @@
+ // Copyright Joyent, Inc. and other Node contributors.
++
+ //
+ // Permission is hereby granted, free of charge, to any person obtaining a
+ // copy of this software and associated documentation files (the
+@@ -1372,13 +1373,6 @@ function lookupAndConnect(self, options)
+     hints: options.hints || 0,
+   };
+ 
+-  if (!isWindows &&
+-      dnsopts.family !== 4 &&
+-      dnsopts.family !== 6 &&
+-      dnsopts.hints === 0) {
+-    dnsopts.hints = dns.ADDRCONFIG;
+-  }
+-
+   debug('connect: find host', host);
+   debug('connect: dns options', dnsopts);
+   self._host = host;

node/patches/v22.x/999-revert_enable_pointer_authentication_on_arm64.patch

@@ -0,0 +1,10 @@
+--- a/node.gyp
++++ b/node.gyp
+@@ -1142,6 +1142,7 @@
+         'node.gypi'
+       ],
+       'libraries!':[ '-licui18n', '-licuuc', '-licudata', '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
++      'cflags!': ['-mbranch-protection=standard'],
+       'include_dirs': [
+         'src',
+         'tools/msvs/genfiles',

node/patches/v24.x/003-path.patch

@@ -0,0 +1,12 @@
+--- a/lib/internal/modules/cjs/loader.js
++++ b/lib/internal/modules/cjs/loader.js
+@@ -2176,7 +2176,8 @@ Module._initPaths = function() {
+     path.resolve(process.execPath, '..') :
+     path.resolve(process.execPath, '..', '..');
+ 
+-  const paths = [path.resolve(prefixDir, 'lib', 'node')];
++  const paths = [path.resolve(prefixDir, 'lib', 'node'),
++                 path.resolve(prefixDir, 'lib', 'node_modules')];
+ 
+   if (homeDir) {
+     ArrayPrototypeUnshift(paths, path.resolve(homeDir, '.node_libraries'));

node/patches/v24.x/004-musl_support.patch

@@ -0,0 +1,22 @@
+--- a/deps/v8/src/base/platform/platform-posix.cc
++++ b/deps/v8/src/base/platform/platform-posix.cc
+@@ -1261,7 +1261,7 @@ bool Thread::Start() {
+ #if V8_OS_DARWIN
+     // Default on Mac OS X is 512kB -- bump up to 1MB
+     stack_size = 1 * 1024 * 1024;
+-#elif V8_OS_AIX
++#elif V8_OS_AIX || !defined(__GLIBC__)
+     // Default on AIX is 96kB -- bump up to 2MB
+     stack_size = 2 * 1024 * 1024;
+ #endif
+--- a/deps/v8/src/codegen/external-reference-table.cc
++++ b/deps/v8/src/codegen/external-reference-table.cc
+@@ -10,7 +10,7 @@
+ #include "src/ic/stub-cache.h"
+ #include "src/logging/counters.h"
+ 
+-#if defined(DEBUG) && defined(V8_OS_LINUX) && !defined(V8_OS_ANDROID)
++#if defined(DEBUG) && defined(V8_OS_LINUX) && !defined(V8_OS_ANDROID) && defined(V8_LIBC_GLIBC)
+ #define SYMBOLIZE_FUNCTION
+ #include <execinfo.h>
+ 

node/patches/v24.x/007-fix_host_build_on_macos.patch

@@ -0,0 +1,11 @@
+--- a/tools/gyp/pylib/gyp/generator/make.py
++++ b/tools/gyp/pylib/gyp/generator/make.py
+@@ -208,7 +208,7 @@ cmd_solink_module = $(LINK.$(TOOLSET)) -
+ 
+ LINK_COMMANDS_MAC = """\
+ quiet_cmd_alink = LIBTOOL-STATIC $@
+-cmd_alink = rm -f $@ && %(python)s gyp-mac-tool filter-libtool libtool $(GYP_LIBTOOLFLAGS) -static -o $@ $(filter %%.o,$^)
++cmd_alink = rm -f $@ && %(python)s gyp-mac-tool filter-libtool /usr/bin/libtool $(GYP_LIBTOOLFLAGS) -static -o $@ $(filter %%.o,$^)
+ 
+ quiet_cmd_link = LINK($(TOOLSET)) $@
+ cmd_link = $(LINK.$(TOOLSET)) $(GYP_LDFLAGS) $(LDFLAGS.$(TOOLSET)) -o "$@" $(LD_INPUTS) $(LIBS)

node/patches/v24.x/012-changing-default-npm-settings.patch

@@ -0,0 +1,20 @@
+--- a/deps/npm/node_modules/@npmcli/config/lib/definitions/definitions.js
++++ b/deps/npm/node_modules/@npmcli/config/lib/definitions/definitions.js
+@@ -1384,7 +1384,7 @@ const definitions = {
+     },
+   }),
+   loglevel: new Definition('loglevel', {
+-    default: 'notice',
++    default: 'info',
+     type: [
+       'silent',
+       'error',
+@@ -2393,7 +2393,7 @@ const definitions = {
+     flatten,
+   }),
+   'strict-ssl': new Definition('strict-ssl', {
+-    default: true,
++    default: false,
+     type: Boolean,
+     description: `
+       Whether or not to do SSL key validation when making requests to the

node/patches/v24.x/200-uv_gyp.patch

@@ -0,0 +1,10 @@
+--- a/deps/uv/uv.gyp
++++ b/deps/uv/uv.gyp
+@@ -155,6 +155,7 @@
+       'target_name': 'libuv',
+       'toolsets': ['host', 'target'],
+       'type': '<(uv_library)',
++      'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+       'include_dirs': [
+         'include',
+         'src/',

node/patches/v24.x/201-zlib_gyp.patch

@@ -0,0 +1,10 @@
+--- a/deps/zlib/zlib.gyp
++++ b/deps/zlib/zlib.gyp
+@@ -8,6 +8,7 @@
+     'use_system_zlib%': 0,
+     'arm_fpu%': '',
+   },
++  'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+   'conditions': [
+     ['use_system_zlib==0', {
+       'targets': [

node/patches/v24.x/202-node_gyp.patch

@@ -0,0 +1,18 @@
+--- a/node.gyp
++++ b/node.gyp
+@@ -1222,6 +1222,7 @@
+       'includes': [
+         'node.gypi'
+       ],
++      'libraries!':[ '-licui18n', '-licuuc', '-licudata', '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'include_dirs': [
+         'src',
+         'tools/msvs/genfiles',
+@@ -1610,6 +1611,7 @@
+       'target_name': 'node_js2c',
+       'type': 'executable',
+       'toolsets': ['host'],
++      'libraries!':[ '-licui18n', '-licuuc', '-licudata', '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'include_dirs': [
+         'tools',
+         'src',

node/patches/v24.x/203-icu-generic_gyp.patch

@@ -0,0 +1,106 @@
+--- a/tools/icu/icu-generic.gyp
++++ b/tools/icu/icu-generic.gyp
+@@ -106,6 +106,7 @@
+           'sources': [
+             '<@(icu_src_i18n)'
+           ],
++          'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+           'include_dirs': [
+             '<(icu_path)/source/i18n',
+           ],
+@@ -114,6 +115,7 @@
+           ],
+           'dependencies': [ 'icuucx', 'icu_implementation', 'icu_uconfig', 'icu_uconfig_target' ],
+           'direct_dependent_settings': {
++            'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+             'include_dirs': [
+               '<(icu_path)/source/i18n',
+             ],
+@@ -224,6 +226,7 @@
+               # full data - no trim needed
+               'sources': [ '<(SHARED_INTERMEDIATE_DIR)/icudt<(icu_ver_major)_dat.<(icu_asm_ext)' ],
+               'dependencies': [ 'genccode#host', 'icupkg#host', 'icu_implementation#host', 'icu_uconfig' ],
++              'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+               'include_dirs': [
+                 '<(icu_path)/source/common',
+               ],
+@@ -308,6 +311,7 @@
+               # This file contains the small ICU data
+               'sources': [ '<(SHARED_INTERMEDIATE_DIR)/icusmdt<(icu_ver_major)_dat.<(icu_asm_ext)' ],
+               # for umachine.h
++              'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+               'include_dirs': [
+                 '<(icu_path)/source/common',
+               ],
+@@ -324,6 +328,7 @@
+       'sources': [
+         '<@(icu_src_stubdata)'
+       ],
++      'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+       'include_dirs': [
+         '<(icu_path)/source/common',
+       ],
+@@ -363,6 +368,7 @@
+           '_XOPEN_SOURCE_EXTENDED=0',
+         ]}],
+       ],
++      'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+       'include_dirs': [
+         '<(icu_path)/source/common',
+       ],
+@@ -372,6 +378,7 @@
+       'cflags_c': ['-std=c99'],
+       'export_dependent_settings': [ 'icu_uconfig', 'icu_uconfig_target' ],
+       'direct_dependent_settings': {
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(icu_path)/source/common',
+         ],
+@@ -402,6 +409,7 @@
+         '<(icu_path)/source/tools/toolutil/dbgutil.cpp',
+         '<(icu_path)/source/tools/toolutil/dbgutil.h',
+       ],
++      'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+       'include_dirs': [
+         '<(icu_path)/source/common',
+         '<(icu_path)/source/i18n',
+@@ -421,6 +429,7 @@
+         }]
+       ],
+       'direct_dependent_settings': {
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(icu_path)/source/common',
+           '<(icu_path)/source/i18n',
+@@ -442,6 +451,7 @@
+       'target_name': 'genrb',
+       'type': 'executable',
+       'toolsets': [ 'host' ],
++      'libraries!':[ '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'dependencies': [ 'icutools', 'icu_implementation' ],
+       'sources': [
+         '<@(icu_src_genrb)'
+@@ -474,6 +484,7 @@
+       'target_name': 'iculslocs',
+       'toolsets': [ 'host' ],
+       'type': 'executable',
++      'libraries!':[ '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'dependencies': [ 'icutools' ],
+       'sources': [
+         'iculslocs.cc',
+@@ -502,6 +513,7 @@
+       'target_name': 'icupkg',
+       'toolsets': [ 'host' ],
+       'type': 'executable',
++      'libraries!':[ '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'dependencies': [ 'icutools' ],
+       'sources': [
+         '<@(icu_src_icupkg)',
+@@ -529,6 +541,7 @@
+       'target_name': 'genccode',
+       'toolsets': [ 'host' ],
+       'type': 'executable',
++      'libraries!':[ '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'dependencies': [ 'icutools' ],
+       'sources': [
+         '<@(icu_src_genccode)',

node/patches/v24.x/204-v8_gyp.patch

@@ -0,0 +1,131 @@
+--- a/tools/v8_gypfiles/v8.gyp
++++ b/tools/v8_gypfiles/v8.gyp
+@@ -105,6 +105,7 @@
+       ],
+       'hard_dependency': 1,
+       'direct_dependent_settings': {
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(SHARED_INTERMEDIATE_DIR)',
+         ],
+@@ -227,6 +228,7 @@
+           '<@(torque_outputs_cc)',
+           '<@(torque_outputs_inc)',
+         ],
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(SHARED_INTERMEDIATE_DIR)',
+         ],
+@@ -248,6 +250,7 @@
+         'sources': [
+           '<(generate_bytecode_builtins_list_output)',
+         ],
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(generate_bytecode_output_root)',
+           '<(SHARED_INTERMEDIATE_DIR)',
+@@ -331,6 +334,7 @@
+         'fp16',
+         'abseil.gyp:abseil',
+       ],
++      'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+       'include_dirs': [
+         '<(SHARED_INTERMEDIATE_DIR)',
+         '<(generate_bytecode_output_root)',
+@@ -952,6 +956,7 @@
+       'target_name': 'v8_compiler',
+       'type': 'static_library',
+       'toolsets': ['host', 'target'],
++      'libraries!':[ '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'dependencies': [
+         'generate_bytecode_builtins_list',
+         'run_torque',
+@@ -1084,6 +1089,7 @@
+       ],
+       'includes': ['inspector.gypi'],
+       'direct_dependent_settings': {
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(generate_bytecode_output_root)',
+           '<(SHARED_INTERMEDIATE_DIR)',
+@@ -1705,6 +1711,7 @@
+         }],
+       ],
+       'direct_dependent_settings': {
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(V8_ROOT)/include',
+         ],
+@@ -1725,6 +1732,7 @@
+     {
+       'target_name': 'bytecode_builtins_list_generator',
+       'type': 'executable',
++      'libraries!':[ '-licui18n', '-licuuc', '-licudata', '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'conditions': [
+         ['want_separate_host_toolset', {
+           'toolsets': ['host'],
+@@ -1765,6 +1773,8 @@
+     {
+       'target_name': 'mksnapshot',
+       'type': 'executable',
++      'libraries!':[ '-L<!@(echo "$STAGING_DIR"/usr/lib)', '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
++      'libraries':[ '-L../../../../staging_dir/hostpkg/share/icu/current/lib' ],
+       'dependencies': [
+         'v8_base_without_compiler',
+         'v8_compiler_for_mksnapshot',
+@@ -1821,6 +1831,7 @@
+     {
+       'target_name': 'torque',
+       'type': 'executable',
++      'libraries!':[ '-licui18n', '-licuuc', '-licudata', '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'dependencies': [
+         'torque_base',
+         'abseil.gyp:abseil',
+@@ -1875,6 +1886,7 @@
+     {
+       'target_name': 'torque-language-server',
+       'type': 'executable',
++      'libraries!':[ '-licui18n', '-licuuc', '-licudata', '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'conditions': [
+         ['want_separate_host_toolset', {
+           'toolsets': ['host'],
+@@ -1917,6 +1929,8 @@
+     {
+       'target_name': 'gen-regexp-special-case',
+       'type': 'executable',
++      'libraries!':[ '-L<!@(echo "$STAGING_DIR"/usr/lib)', '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
++      'libraries':[ '-L../../../../staging_dir/hostpkg/share/icu/current/lib' ],
+       'dependencies': [
+         'v8_libbase',
+         # "build/win:default_exe_manifest",
+@@ -2169,6 +2183,7 @@
+          }],
+       ],
+       'direct_dependent_settings': {
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(V8_ROOT)/include',
+         ],
+@@ -2310,12 +2325,14 @@
+         }],
+       ],
+       'direct_dependent_settings': {
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(V8_ROOT)/third_party/zlib',
+           '<(V8_ROOT)/third_party/zlib/google',
+         ],
+       },
+       'defines': [ 'ZLIB_IMPLEMENTATION' ],
++      'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+       'include_dirs': [
+         '<(V8_ROOT)/third_party/zlib',
+         '<(V8_ROOT)/third_party/zlib/google',
+@@ -2363,6 +2380,7 @@
+       'variables': {
+         'FP16_ROOT': '../../deps/v8/third_party/fp16',
+       },
++      'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+       'direct_dependent_settings': {
+         'include_dirs': [
+           '<(FP16_ROOT)/src/include',

node/patches/v24.x/205_abseil_gyp.patch

@@ -0,0 +1,23 @@
+--- a/tools/v8_gypfiles/abseil.gyp
++++ b/tools/v8_gypfiles/abseil.gyp
+@@ -9,16 +9,20 @@
+         'ABSEIL_ROOT': '../../deps/v8/third_party/abseil-cpp',
+       },
+       'direct_dependent_settings': {
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(ABSEIL_ROOT)',
+         ],
++        'include_dirs': [ '<(ABSEIL_ROOT)', '<!@(echo "$STAGING_DIR"/usr/../usr/include)' ],
+         'xcode_settings': {
+           'OTHER_LDFLAGS': ['-framework CoreFoundation'],
+         },
+       },
++      'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+       'include_dirs': [
+         '<(ABSEIL_ROOT)',
+       ],
++      'include_dirs': [ '<(ABSEIL_ROOT)', '<!@(echo "$STAGING_DIR"/usr/../usr/include)' ],
+       'sources': [
+         '<(ABSEIL_ROOT)/absl/algorithm/algorithm.h',
+         '<(ABSEIL_ROOT)/absl/algorithm/container.h',

node/patches/v24.x/999-hdr_histogram-x86.patch

@@ -0,0 +1,15 @@
+From: Johannes Müller <alpinelinux@jogemu.at>
+Date: Wed Aug 5 17:35:19 2026 +0000
+Subject: Deactivate AVX2 dispatch on x86 due to unsupported _mm_extract_epi64
+
+--- a/deps/histogram/src/hdr_histogram.c
++++ b/deps/histogram/src/hdr_histogram.c
+@@ -36,7 +36,7 @@
+ 
+ /* Runtime-dispatched AVX2 path: keep the rest of this TU at the project's
+    baseline ISA so the shipped binary does not silently require AVX2. */
+-#if (defined(__x86_64__) || defined(_M_X64) || defined(__i386__) || defined(_M_IX86)) \
++#if (defined(__x86_64__) || defined(_M_X64)) \
+     && (defined(__GNUC__) || defined(__clang__)) && !defined(__INTEL_COMPILER) && !defined(_MSC_VER)
+ #  define HDR_HAS_AVX2_DISPATCH 1
+ #  include <immintrin.h>

node/patches/v24.x/999-localhost-no-addrconfig.patch

@@ -0,0 +1,29 @@
+Description: do not use dns.ADDRCONFIG for localhost
+ it fails on IPv6-only systems. Setting it with libc fails on linux.
+ https://github.com/nodejs/node/issues/33279
+Author: Jérémy Lal <kapouer@melix.org>
+Last-Update: 2020-06-11
+Bug-Debian: https://bugs.debian.org/962318
+Forwarded: https://github.com/nodejs/node/issues/33816
+--- a/lib/net.js
++++ b/lib/net.js
+@@ -1,4 +1,5 @@
+ // Copyright Joyent, Inc. and other Node contributors.
++
+ //
+ // Permission is hereby granted, free of charge, to any person obtaining a
+ // copy of this software and associated documentation files (the
+@@ -1744,13 +1745,6 @@ function lookupAndConnect(self, options)
+     hints: options.hints || 0,
+   };
+ 
+-  if (!isWindows &&
+-      dnsopts.family !== 4 &&
+-      dnsopts.family !== 6 &&
+-      dnsopts.hints === 0) {
+-    dnsopts.hints = dns.ADDRCONFIG;
+-  }
+-
+   debug('connect: find host', host);
+   debug('connect: dns options', dnsopts);
+   self._host = host;

node/patches/v24.x/999-revert_enable_pointer_authentication_on_arm64.patch

@@ -0,0 +1,10 @@
+--- a/node.gyp
++++ b/node.gyp
+@@ -1223,6 +1223,7 @@
+         'node.gypi'
+       ],
+       'libraries!':[ '-licui18n', '-licuuc', '-licudata', '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
++      'cflags!': ['-mbranch-protection=standard'],
+       'include_dirs': [
+         'src',
+         'tools/msvs/genfiles',

node/patches/v24.x/999-v8-int64-lowering-reducer.patch

@@ -0,0 +1,20 @@
+--- a/deps/v8/src/compiler/turboshaft/int64-lowering-reducer.h
++++ b/deps/v8/src/compiler/turboshaft/int64-lowering-reducer.h
+@@ -637,7 +637,7 @@ class Int64LoweringReducer : public Next
+       result = __ Word32CountLeadingZeros(high);
+     }
+ 
+-    return __ Tuple<Word32, Word32>(result, __ Word32Constant(0));
++    return __ template Tuple<Word32, Word32>(result, __ Word32Constant(0));
+   }
+ 
+   V<Word32Pair> LowerCtz(V<Word32Pair> input) {
+@@ -650,7 +650,7 @@ class Int64LoweringReducer : public Next
+       result = __ Word32CountTrailingZeros(low);
+     }
+ 
+-    return __ Tuple<Word32, Word32>(result, __ Word32Constant(0));
++    return __ template Tuple<Word32, Word32>(result, __ Word32Constant(0));
+   }
+ 
+   V<Word32Pair> LowerPopCount(V<Word32Pair> input) {

node/patches/v26.x/003-path.patch

@@ -0,0 +1,12 @@
+--- a/lib/internal/modules/cjs/loader.js
++++ b/lib/internal/modules/cjs/loader.js
+@@ -2212,7 +2212,8 @@ Module._initPaths = function() {
+     path.resolve(process.execPath, '..') :
+     path.resolve(process.execPath, '..', '..');
+ 
+-  const paths = [path.resolve(prefixDir, 'lib', 'node')];
++  const paths = [path.resolve(prefixDir, 'lib', 'node'),
++                 path.resolve(prefixDir, 'lib', 'node_modules')];
+ 
+   if (homeDir) {
+     ArrayPrototypeUnshift(paths, path.resolve(homeDir, '.node_libraries'));

node/patches/v26.x/004-musl_support.patch

@@ -0,0 +1,22 @@
+--- a/deps/v8/src/base/platform/platform-posix.cc
++++ b/deps/v8/src/base/platform/platform-posix.cc
+@@ -1337,7 +1337,7 @@ bool Thread::Start() {
+ #if V8_OS_DARWIN
+     // Default on Mac OS X is 512kB -- bump up to 1MB
+     stack_size = 1 * 1024 * 1024;
+-#elif V8_OS_AIX
++#elif V8_OS_AIX || !defined(__GLIBC__)
+     // Default on AIX is 96kB -- bump up to 2MB
+     stack_size = 2 * 1024 * 1024;
+ #endif
+--- a/deps/v8/src/codegen/external-reference-table.cc
++++ b/deps/v8/src/codegen/external-reference-table.cc
+@@ -10,7 +10,7 @@
+ #include "src/ic/stub-cache.h"
+ #include "src/logging/counters.h"
+ 
+-#if defined(DEBUG) && defined(V8_OS_LINUX) && !defined(V8_OS_ANDROID)
++#if defined(DEBUG) && defined(V8_OS_LINUX) && !defined(V8_OS_ANDROID) && defined(V8_LIBC_GLIBC)
+ #define SYMBOLIZE_FUNCTION
+ #include <execinfo.h>
+ 

node/patches/v26.x/007-fix_host_build_on_macos.patch

@@ -0,0 +1,11 @@
+--- a/tools/gyp/pylib/gyp/generator/make.py
++++ b/tools/gyp/pylib/gyp/generator/make.py
+@@ -208,7 +208,7 @@ cmd_solink_module = $(LINK.$(TOOLSET)) -
+ 
+ LINK_COMMANDS_MAC = """\
+ quiet_cmd_alink = LIBTOOL-STATIC $@
+-cmd_alink = rm -f $@ && %(python)s gyp-mac-tool filter-libtool libtool $(GYP_LIBTOOLFLAGS) -static -o $@ $(filter %%.o,$^)
++cmd_alink = rm -f $@ && %(python)s gyp-mac-tool filter-libtool /usr/bin/libtool $(GYP_LIBTOOLFLAGS) -static -o $@ $(filter %%.o,$^)
+ 
+ quiet_cmd_link = LINK($(TOOLSET)) $@
+ cmd_link = $(LINK.$(TOOLSET)) $(GYP_LDFLAGS) $(LDFLAGS.$(TOOLSET)) -o "$@" $(LD_INPUTS) $(LIBS)

node/patches/v26.x/012-changing-default-npm-settings.patch

@@ -0,0 +1,20 @@
+--- a/deps/npm/node_modules/@npmcli/config/lib/definitions/definitions.js
++++ b/deps/npm/node_modules/@npmcli/config/lib/definitions/definitions.js
+@@ -1384,7 +1384,7 @@ const definitions = {
+     },
+   }),
+   loglevel: new Definition('loglevel', {
+-    default: 'notice',
++    default: 'info',
+     type: [
+       'silent',
+       'error',
+@@ -2393,7 +2393,7 @@ const definitions = {
+     flatten,
+   }),
+   'strict-ssl': new Definition('strict-ssl', {
+-    default: true,
++    default: false,
+     type: Boolean,
+     description: `
+       Whether or not to do SSL key validation when making requests to the

node/patches/v26.x/200-uv_gyp.patch

@@ -0,0 +1,10 @@
+--- a/deps/uv/uv.gyp
++++ b/deps/uv/uv.gyp
+@@ -155,6 +155,7 @@
+       'target_name': 'libuv',
+       'toolsets': ['host', 'target'],
+       'type': '<(uv_library)',
++      'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+       'include_dirs': [
+         'include',
+         'src/',

node/patches/v26.x/201-zlib_gyp.patch

@@ -0,0 +1,10 @@
+--- a/deps/zlib/zlib.gyp
++++ b/deps/zlib/zlib.gyp
+@@ -8,6 +8,7 @@
+     'use_system_zlib%': 0,
+     'arm_fpu%': '',
+   },
++  'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+   'conditions': [
+     ['use_system_zlib==0', {
+       'targets': [

node/patches/v26.x/202-node_gyp.patch

@@ -0,0 +1,18 @@
+--- a/node.gyp
++++ b/node.gyp
+@@ -1243,6 +1243,7 @@
+       'includes': [
+         'node.gypi'
+       ],
++      'libraries!':[ '-licui18n', '-licuuc', '-licudata', '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'include_dirs': [
+         'src',
+         'tools/msvs/genfiles',
+@@ -1635,6 +1636,7 @@
+       'target_name': 'node_js2c',
+       'type': 'executable',
+       'toolsets': ['host'],
++      'libraries!':[ '-licui18n', '-licuuc', '-licudata', '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'include_dirs': [
+         'tools',
+         'src',

node/patches/v26.x/203-icu-generic_gyp.patch

@@ -0,0 +1,106 @@
+--- a/tools/icu/icu-generic.gyp
++++ b/tools/icu/icu-generic.gyp
+@@ -106,6 +106,7 @@
+           'sources': [
+             '<@(icu_src_i18n)'
+           ],
++          'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+           'include_dirs': [
+             '<(icu_path)/source/i18n',
+           ],
+@@ -114,6 +115,7 @@
+           ],
+           'dependencies': [ 'icuucx', 'icu_implementation', 'icu_uconfig', 'icu_uconfig_target' ],
+           'direct_dependent_settings': {
++            'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+             'include_dirs': [
+               '<(icu_path)/source/i18n',
+             ],
+@@ -224,6 +226,7 @@
+               # full data - no trim needed
+               'sources': [ '<(SHARED_INTERMEDIATE_DIR)/icudt<(icu_ver_major)_dat.<(icu_asm_ext)' ],
+               'dependencies': [ 'genccode#host', 'icupkg#host', 'icu_implementation#host', 'icu_uconfig' ],
++              'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+               'include_dirs': [
+                 '<(icu_path)/source/common',
+               ],
+@@ -308,6 +311,7 @@
+               # This file contains the small ICU data
+               'sources': [ '<(SHARED_INTERMEDIATE_DIR)/icusmdt<(icu_ver_major)_dat.<(icu_asm_ext)' ],
+               # for umachine.h
++              'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+               'include_dirs': [
+                 '<(icu_path)/source/common',
+               ],
+@@ -324,6 +328,7 @@
+       'sources': [
+         '<@(icu_src_stubdata)'
+       ],
++      'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+       'include_dirs': [
+         '<(icu_path)/source/common',
+       ],
+@@ -363,6 +368,7 @@
+           '_XOPEN_SOURCE_EXTENDED=0',
+         ]}],
+       ],
++      'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+       'include_dirs': [
+         '<(icu_path)/source/common',
+       ],
+@@ -372,6 +378,7 @@
+       'cflags_c': ['-std=c99'],
+       'export_dependent_settings': [ 'icu_uconfig', 'icu_uconfig_target' ],
+       'direct_dependent_settings': {
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(icu_path)/source/common',
+         ],
+@@ -402,6 +409,7 @@
+         '<(icu_path)/source/tools/toolutil/dbgutil.cpp',
+         '<(icu_path)/source/tools/toolutil/dbgutil.h',
+       ],
++      'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+       'include_dirs': [
+         '<(icu_path)/source/common',
+         '<(icu_path)/source/i18n',
+@@ -421,6 +429,7 @@
+         }]
+       ],
+       'direct_dependent_settings': {
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(icu_path)/source/common',
+           '<(icu_path)/source/i18n',
+@@ -442,6 +451,7 @@
+       'target_name': 'genrb',
+       'type': 'executable',
+       'toolsets': [ 'host' ],
++      'libraries!':[ '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'dependencies': [ 'icutools', 'icu_implementation' ],
+       'sources': [
+         '<@(icu_src_genrb)'
+@@ -474,6 +484,7 @@
+       'target_name': 'iculslocs',
+       'toolsets': [ 'host' ],
+       'type': 'executable',
++      'libraries!':[ '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'dependencies': [ 'icutools' ],
+       'sources': [
+         'iculslocs.cc',
+@@ -502,6 +513,7 @@
+       'target_name': 'icupkg',
+       'toolsets': [ 'host' ],
+       'type': 'executable',
++      'libraries!':[ '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'dependencies': [ 'icutools' ],
+       'sources': [
+         '<@(icu_src_icupkg)',
+@@ -529,6 +541,7 @@
+       'target_name': 'genccode',
+       'toolsets': [ 'host' ],
+       'type': 'executable',
++      'libraries!':[ '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'dependencies': [ 'icutools' ],
+       'sources': [
+         '<@(icu_src_genccode)',

node/patches/v26.x/204-v8_gyp.patch

@@ -0,0 +1,131 @@
+--- a/tools/v8_gypfiles/v8.gyp
++++ b/tools/v8_gypfiles/v8.gyp
+@@ -113,6 +113,7 @@
+       ],
+       'hard_dependency': 1,
+       'direct_dependent_settings': {
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(SHARED_INTERMEDIATE_DIR)',
+         ],
+@@ -235,6 +236,7 @@
+           '<@(torque_outputs_cc)',
+           '<@(torque_outputs_inc)',
+         ],
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(SHARED_INTERMEDIATE_DIR)',
+         ],
+@@ -256,6 +258,7 @@
+         'sources': [
+           '<(generate_bytecode_builtins_list_output)',
+         ],
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(generate_bytecode_output_root)',
+           '<(SHARED_INTERMEDIATE_DIR)',
+@@ -315,6 +318,7 @@
+         'v8_shared_internal_headers',
+         'v8_pch',
+       ],
++      'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+       'include_dirs': [
+         '<(SHARED_INTERMEDIATE_DIR)',
+         '<(generate_bytecode_output_root)',
+@@ -987,6 +991,7 @@
+       'target_name': 'v8_compiler',
+       'type': 'static_library',
+       'toolsets': ['host', 'target'],
++      'libraries!':[ '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'dependencies': [
+         'generate_bytecode_builtins_list',
+         'run_torque',
+@@ -1122,6 +1127,7 @@
+       ],
+       'includes': ['inspector.gypi'],
+       'direct_dependent_settings': {
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(generate_bytecode_output_root)',
+           '<(SHARED_INTERMEDIATE_DIR)',
+@@ -1794,6 +1800,7 @@
+         }],
+       ],
+       'direct_dependent_settings': {
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(V8_ROOT)/include',
+         ],
+@@ -1814,6 +1821,7 @@
+     {
+       'target_name': 'bytecode_builtins_list_generator',
+       'type': 'executable',
++      'libraries!':[ '-licui18n', '-licuuc', '-licudata', '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'conditions': [
+         ['want_separate_host_toolset', {
+           'toolsets': ['host'],
+@@ -1856,6 +1864,8 @@
+     {
+       'target_name': 'mksnapshot',
+       'type': 'executable',
++      'libraries!':[ '-L<!@(echo "$STAGING_DIR"/usr/lib)', '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
++      'libraries':[ '-L../../../../staging_dir/hostpkg/share/icu/current/lib' ],
+       'dependencies': [
+         'v8_base_without_compiler',
+         'v8_compiler_for_mksnapshot',
+@@ -1918,6 +1928,7 @@
+     {
+       'target_name': 'torque',
+       'type': 'executable',
++      'libraries!':[ '-licui18n', '-licuuc', '-licudata', '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'dependencies': [
+         'torque_base',
+         # "build/win:default_exe_manifest",
+@@ -1974,6 +1985,7 @@
+     {
+       'target_name': 'torque-language-server',
+       'type': 'executable',
++      'libraries!':[ '-licui18n', '-licuuc', '-licudata', '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
+       'conditions': [
+         ['want_separate_host_toolset', {
+           'toolsets': ['host'],
+@@ -2016,6 +2028,8 @@
+     {
+       'target_name': 'gen-regexp-special-case',
+       'type': 'executable',
++      'libraries!':[ '-L<!@(echo "$STAGING_DIR"/usr/lib)', '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
++      'libraries':[ '-L../../../../staging_dir/hostpkg/share/icu/current/lib' ],
+       'dependencies': [
+         'v8_libbase',
+         # "build/win:default_exe_manifest",
+@@ -2277,6 +2291,7 @@
+          }],
+       ],
+       'direct_dependent_settings': {
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(V8_ROOT)/include',
+         ],
+@@ -2420,12 +2435,14 @@
+         }],
+       ],
+       'direct_dependent_settings': {
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(V8_ROOT)/third_party/zlib',
+           '<(V8_ROOT)/third_party/zlib/google',
+         ],
+       },
+       'defines': [ 'ZLIB_IMPLEMENTATION' ],
++      'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+       'include_dirs': [
+         '<(V8_ROOT)/third_party/zlib',
+         '<(V8_ROOT)/third_party/zlib/google',
+@@ -2473,6 +2490,7 @@
+       'variables': {
+         'FP16_ROOT': '../../deps/v8/third_party/fp16',
+       },
++      'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+       'all_dependent_settings': {
+         'include_dirs': [
+           '<(FP16_ROOT)/src/include',

node/patches/v26.x/205_abseil_gyp.patch

@@ -0,0 +1,23 @@
+--- a/tools/v8_gypfiles/abseil.gyp
++++ b/tools/v8_gypfiles/abseil.gyp
+@@ -9,16 +9,20 @@
+         'ABSEIL_ROOT': '../../deps/v8/third_party/abseil-cpp',
+       },
+       'direct_dependent_settings': {
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [
+           '<(ABSEIL_ROOT)',
+         ],
++        'include_dirs': [ '<(ABSEIL_ROOT)', '<!@(echo "$STAGING_DIR"/usr/../usr/include)' ],
+         'xcode_settings': {
+           'OTHER_LDFLAGS': ['-framework CoreFoundation'],
+         },
+       },
++      'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+       'include_dirs': [
+         '<(ABSEIL_ROOT)',
+       ],
++      'include_dirs': [ '<(ABSEIL_ROOT)', '<!@(echo "$STAGING_DIR"/usr/../usr/include)' ],
+       'sources': [
+         '<(ABSEIL_ROOT)/absl/algorithm/algorithm.h',
+         '<(ABSEIL_ROOT)/absl/algorithm/container.h',

node/patches/v26.x/206-lief_gyp.patch

@@ -0,0 +1,18 @@
+--- a/deps/LIEF/lief.gyp
++++ b/deps/LIEF/lief.gyp
+@@ -419,6 +419,7 @@
+       'toolsets': ['host', 'target'],
+       'type': 'static_library',
+       'includes': [],
++      'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+       'include_dirs': [
+         '.',
+         #include <LIEF/third-party/internal/expected.hpp>
+@@ -439,6 +440,7 @@
+         "include/LIEF/third-party/internal",
+       ],
+       'direct_dependent_settings': {
++        'include_dirs!': [ '<!@(echo "$STAGING_DIR"/usr/include)' ],
+         'include_dirs': [ 'include' ],
+       },
+       'defines': [

node/patches/v26.x/999-hdr_histogram-x86.patch

@@ -0,0 +1,15 @@
+From: Johannes Müller <alpinelinux@jogemu.at>
+Date: Wed Aug 5 17:35:19 2026 +0000
+Subject: Deactivate AVX2 dispatch on x86 due to unsupported _mm_extract_epi64
+
+--- a/deps/histogram/src/hdr_histogram.c
++++ b/deps/histogram/src/hdr_histogram.c
+@@ -36,7 +36,7 @@
+ 
+ /* Runtime-dispatched AVX2 path: keep the rest of this TU at the project's
+    baseline ISA so the shipped binary does not silently require AVX2. */
+-#if (defined(__x86_64__) || defined(_M_X64) || defined(__i386__) || defined(_M_IX86)) \
++#if (defined(__x86_64__) || defined(_M_X64)) \
+     && (defined(__GNUC__) || defined(__clang__)) && !defined(__INTEL_COMPILER) && !defined(_MSC_VER)
+ #  define HDR_HAS_AVX2_DISPATCH 1
+ #  include <immintrin.h>

node/patches/v26.x/999-localhost-no-addrconfig.patch

@@ -0,0 +1,29 @@
+Description: do not use dns.ADDRCONFIG for localhost
+ it fails on IPv6-only systems. Setting it with libc fails on linux.
+ https://github.com/nodejs/node/issues/33279
+Author: Jérémy Lal <kapouer@melix.org>
+Last-Update: 2020-06-11
+Bug-Debian: https://bugs.debian.org/962318
+Forwarded: https://github.com/nodejs/node/issues/33816
+--- a/lib/net.js
++++ b/lib/net.js
+@@ -1,4 +1,5 @@
+ // Copyright Joyent, Inc. and other Node contributors.
++
+ //
+ // Permission is hereby granted, free of charge, to any person obtaining a
+ // copy of this software and associated documentation files (the
+@@ -1744,13 +1745,6 @@ function lookupAndConnect(self, options)
+     hints: options.hints || 0,
+   };
+ 
+-  if (!isWindows &&
+-      dnsopts.family !== 4 &&
+-      dnsopts.family !== 6 &&
+-      dnsopts.hints === 0) {
+-    dnsopts.hints = dns.ADDRCONFIG;
+-  }
+-
+   debug('connect: find host', host);
+   debug('connect: dns options', dnsopts);
+   self._host = host;

node/patches/v26.x/999-revert_enable_pointer_authentication_on_arm64.patch

@@ -0,0 +1,10 @@
+--- a/node.gyp
++++ b/node.gyp
+@@ -1244,6 +1244,7 @@
+         'node.gypi'
+       ],
+       'libraries!':[ '-licui18n', '-licuuc', '-licudata', '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ],
++      'cflags!': ['-mbranch-protection=standard'],
+       'include_dirs': [
+         'src',
+         'tools/msvs/genfiles',

node/patches/v26.x/999-v8-armhf_fixedtag.patch

@@ -0,0 +1,26 @@
+From: Johannes Müller <alpinelinux@jogemu.at>
+Date: Wed May 6 19:56:53 2025 +0000
+Subject: Allow less highway lanes to fix armhf build
+
+--- a/deps/v8/src/strings/string-hasher.cc
++++ b/deps/v8/src/strings/string-hasher.cc
+@@ -77,7 +77,7 @@ uint64_t HashConvertingTo8Bit(const uint
+ 
+ bool IsOnly8BitSIMD(const uint16_t* chars, unsigned len) {
+   namespace hw = hwy::HWY_NAMESPACE;
+-  hw::FixedTag<uint16_t, 8> tag;
++  hw::CappedTag<uint16_t, 8> tag;
+   const size_t stride = hw::Lanes(tag);
+   const auto high_byte_mask = hw::Set(tag, static_cast<uint16_t>(0xFF00));
+   const auto zero = hw::Zero(tag);
+--- a/deps/v8/src/json/json-stringifier.cc
++++ b/deps/v8/src/json/json-stringifier.cc
+@@ -3398,7 +3398,7 @@ bool FastJsonStringifier<Char>::AppendSt
+   size_t uncopied_src_index = 0;  // Index of first char not copied yet.
+   const SrcChar* block = chars;
+   const SrcChar* end = chars + length;
+-  hw::FixedTag<SrcChar, 16> tag;
++  hw::CappedTag<SrcChar, 16> tag;
+   static const size_t stride = hw::Lanes(tag);
+ 
+   const auto mask_0x20 = hw::Set(tag, 0x20);

node/patches/v26.x/999-v8-disable-trap-handler-on-riscv-sv39.patch

@@ -0,0 +1,24 @@
+Patch source: https://github.com/felixonmars/archriscv-packages/commit/c892e1fff21f427b5753b5d9cd8defb6b14763dd
+
+Disable v8's trap handler[1] to workaround ENOMEM on sv39 systems[2].
+v8's OOB trap handler for wasm tries to allocate a 10 GB guard region[3],
+but unfortunately on sv39 systems we only have 256GB virtual memory for
+userspace, which is usually already exhausted by the node process and
+leads to `WebAssembly.Instance(): Out of memory: Cannot allocate Wasm
+memory for new instance` errors
+
+[1]: https://chromium-review.googlesource.com/c/v8/v8/+/5227604
+[2]: https://github.com/riscv-forks/electron/issues/3#issuecomment-2391689815
+[3]: https://github.com/nodejs/node/blob/09a8440b45f69651ff52110cb1bc2dde9e14e2e8/deps/v8/src/objects/backing-store.cc#L38
+
+--- a/deps/v8/src/trap-handler/trap-handler.h
++++ b/deps/v8/src/trap-handler/trap-handler.h
+@@ -49,7 +49,7 @@ namespace v8::internal::trap_handler {
+ // RISCV64 (non-simulator) on Linux.
+ #elif V8_TARGET_ARCH_RISCV64 && V8_HOST_ARCH_RISCV64 && V8_OS_LINUX && \
+     !V8_OS_ANDROID
+-#define V8_TRAP_HANDLER_SUPPORTED true
++#define V8_TRAP_HANDLER_SUPPORTED false
+ // RISCV64 simulator on x64 on Linux
+ #elif V8_TARGET_ARCH_RISCV64 && V8_HOST_ARCH_X64 && V8_OS_LINUX
+ #define V8_TRAP_HANDLER_VIA_SIMULATOR

node/patches/v26.x/999-v8-maglev-ir-riscv.patch

@@ -0,0 +1,24 @@
+From: Johannes Müller <alpinelinux@jogemu.at>
+Date: Fri Jul 12 11:33:42 2026 +0000
+Subject: Resolve undefined reference to FloatMinMaxHelper
+
+--- a/deps/v8/src/maglev/riscv/maglev-ir-riscv.cc
++++ b/deps/v8/src/maglev/riscv/maglev-ir-riscv.cc
+@@ -881,7 +881,7 @@ void Float64Min::GenerateCode(MaglevAsse
+   DoubleRegister right = ToDoubleRegister(RightInput());
+   DoubleRegister out = ToDoubleRegister(result());
+ 
+-  __ FloatMinMaxHelper<double>(out, left, right, MaxMinKind::kMin);
++  __ Float64Min(out, left, right);
+ }
+ 
+ void Float64Max::SetValueLocationConstraints() {
+@@ -896,7 +896,7 @@ void Float64Max::GenerateCode(MaglevAsse
+   DoubleRegister right = ToDoubleRegister(RightInput());
+   DoubleRegister out = ToDoubleRegister(result());
+ 
+-  __ FloatMinMaxHelper<double>(out, left, right, MaxMinKind::kMax);
++  __ Float64Max(out, left, right);
+ }
+ 
+ int Float64Ieee754Unary::MaxCallStackArgs() const { return 0; }

node/patches/v26.x/999-v8-temporal-baked-zoneinfo64.patch

@@ -0,0 +1,114 @@
+From: Martijn van der Ven <martijn@vanderven.se>
+Date: Thu Aug 20 09:37:04 2026 +0000
+Subject: Enable Temporal with system ICU via baked zoneinfo64 data
+
+V8 loads Temporal's timezone data through the ICU-internal udatamem.h
+API, which system ICU does not provide, so configuring with
+--with-intl=system-icu leaves Temporal disabled. Always use the baked
+zoneinfo64 data path that V8 already uses for builds without intl
+instead; the zoneinfo64.res input is vendored in the release tarball
+as part of the zoneinfo64 crate.
+
+Patch-Source: https://github.com/nodejs/node/pull/62766
+--- a/deps/v8/src/objects/js-temporal-zoneinfo64.h
++++ b/deps/v8/src/objects/js-temporal-zoneinfo64.h
+@@ -7,7 +7,7 @@
+ 
+ #include "temporal_rs/Provider.d.hpp"
+ 
+-#ifdef V8_INTL_SUPPORT
++#if false
+ #include "unicode/udata.h"
+ #else
+ #include <vector>
+@@ -37,7 +37,7 @@ class ZoneInfo64Provider {
+   ZoneInfo64Provider();
+   ~ZoneInfo64Provider();
+   std::unique_ptr<temporal_rs::Provider> provider;
+-#ifdef V8_INTL_SUPPORT
++#if false
+   UDataMemory* memory;
+ #endif
+ };
+--- a/deps/v8/src/objects/js-temporal-zoneinfo64.cc
++++ b/deps/v8/src/objects/js-temporal-zoneinfo64.cc
+@@ -10,7 +10,7 @@
+ #include "temporal_rs/Provider.hpp"
+ #include "temporal_rs/TimeZone.hpp"
+ 
+-#ifdef V8_INTL_SUPPORT
++#if false
+ #include "udatamem.h"
+ #else
+ // Defined in builtins-temporal-zoneinfo64-data.cc, generated by
+@@ -22,7 +22,7 @@ extern "C" size_t zoneinfo64_static_data
+ namespace v8::internal {
+ 
+ ZoneInfo64Provider::ZoneInfo64Provider() {
+-#ifdef V8_INTL_SUPPORT
++#if false
+   UErrorCode status = U_ZERO_ERROR;
+   memory = udata_open(0, "res", "zoneinfo64", &status);
+   if (U_FAILURE(status)) {
+@@ -74,7 +74,7 @@ ZoneInfo64Provider::~ZoneInfo64Provider(
+ 
+   // Then clean up memory
+   // This ideally is a no-op when using static data
+-#ifdef V8_INTL_SUPPORT
++#if false
+   if (memory) {
+     udata_close(memory);
+   }
+--- a/tools/v8_gypfiles/v8.gyp
++++ b/tools/v8_gypfiles/v8.gyp
+@@ -1159,6 +1159,9 @@
+           ],
+         }],
+         ['v8_enable_temporal_support==1', {
++          'dependencies': [
++            'make_temporal_zoneinfo_cpp',
++          ],
+           'conditions': [
+             ['node_shared_temporal_capi=="false"', {
+               'dependencies': [
+@@ -2063,6 +2066,40 @@
+       ],
+     },  # gen-regexp-special-case
+     {
++      'target_name': 'make_temporal_zoneinfo_cpp',
++      'type': 'none',
++      'toolsets': ['host', 'target'],
++      'conditions': [
++        ['v8_enable_temporal_support==1', {
++          'actions': [
++            {
++              'action_name': 'make_temporal_zoneinfo_cpp_action',
++              'inputs': [
++                '<(V8_ROOT)/tools/include-file-as-bytes.py',
++                '<(V8_ROOT)/../crates/vendor/zoneinfo64-v0_3/src/data/zoneinfo64.res',
++              ],
++              'outputs': [
++                '<(SHARED_INTERMEDIATE_DIR)/src/builtins/builtins-temporal-zoneinfo64-data.cc',
++              ],
++              'action': [
++                '<(python)',
++                '<(V8_ROOT)/tools/include-file-as-bytes.py',
++                '<(V8_ROOT)/../crates/vendor/zoneinfo64-v0_3/src/data/zoneinfo64.res',
++                '<@(_outputs)',
++                'zoneinfo64_static_data',
++              ],
++              'message': 'Generating temporal zoneinfo static data',
++            },
++          ],
++        }],
++      ],
++      'direct_dependent_settings': {
++        'sources': [
++          '<(SHARED_INTERMEDIATE_DIR)/src/builtins/builtins-temporal-zoneinfo64-data.cc',
++        ],
++      },
++    },  # make_temporal_zoneinfo_cpp
++    {
+       'target_name': 'run_gen-regexp-special-case',
+       'type': 'none',
+       'toolsets': ['host', 'target'],

node/patches/v26.x/999-v8-x86_mm_cvtsi128_si64.patch

@@ -0,0 +1,24 @@
+From: Johannes Müller <50362-jogemu@users.gitlab.alpinelinux.org>
+Date: Fri Oct 31 07:00:11 2025 +0000
+Subject: Fix x86 build because _mm_cvtsi128_si64 is x64 only
+
+--- a/deps/v8/src/strings/string-hasher.cc
++++ b/deps/v8/src/strings/string-hasher.cc
+@@ -24,7 +24,7 @@ struct ConvertTo8BitHashReader {
+     DCHECK_LE(p[5], 0xff);
+     DCHECK_LE(p[6], 0xff);
+     DCHECK_LE(p[7], 0xff);
+-#ifdef __SSE2__
++#if defined(__SSE2__) && defined(__x86_64__)
+     __m128i x = _mm_loadu_si128(reinterpret_cast<const __m128i*>(p));
+     return _mm_cvtsi128_si64(_mm_packus_epi16(x, x));
+ #elif defined(__ARM_NEON__)
+@@ -45,7 +45,7 @@ struct ConvertTo8BitHashReader {
+     DCHECK_LE(p[1], 0xff);
+     DCHECK_LE(p[2], 0xff);
+     DCHECK_LE(p[3], 0xff);
+-#ifdef __SSE2__
++#if defined(__SSE2__) && defined(__x86_64__)
+     __m128i x = _mm_loadu_si64(reinterpret_cast<const __m128i*>(p));
+     return _mm_cvtsi128_si64(_mm_packus_epi16(x, x));
+ #elif defined(__ARM_NEON__)

node/patches/v26.x/999-v8-yield-processor.patch

@@ -0,0 +1,16 @@
+[arm64] Use the ISB instruction instead of YIELD
+https://source.chromium.org/chromium/_/chromium/v8/v8/+/2b4f16e81707a744c09417f49ad6c7cb77413da8
+--- a/deps/v8/src/base/platform/yield-processor.h
++++ b/deps/v8/src/base/platform/yield-processor.h
+@@ -41,8 +41,10 @@
+ #if defined(V8_HOST_ARCH_IA32) || defined(V8_HOST_ARCH_X64)
+ #define YIELD_PROCESSOR __asm__ __volatile__("pause")
+ #elif defined(V8_HOST_ARCH_ARM64) || \
+-    (defined(V8_HOST_ARCH_ARM) && __ARM_ARCH >= 6)
++    (defined(V8_HOST_ARCH_ARM) && __ARM_ARCH > 6)
+ #define YIELD_PROCESSOR __asm__ __volatile__("isb" ::: "memory")
++#elif defined(V8_HOST_ARCH_ARM)
++#define YIELD_PROCESSOR __asm__ __volatile__("yield")
+ #elif defined(V8_HOST_ARCH_MIPS64EL) && __mips_isa_rev >= 2
+ // Don't bother doing using .word here since r2 is the lowest supported mips64
+ // that Chromium supports.

node/test.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+node -pe 'process.version' | grep "$2"

wwand-ipa/Makefile

@@ -14,11 +14,11 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=wwand-ipa
 PKG_VERSION:=0.1.0_p2
-PKG_RELEASE:=3
+PKG_RELEASE:=4
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/ddimension/wwand-ipa.git
-PKG_SOURCE_VERSION:=5b20069accf93daf685867e5902fb97e63413a36
+PKG_SOURCE_VERSION:=446cbb483e6792e68248a0f8f1c86244ded14b86
 PKG_MIRROR_HASH:=skip
 
 PKG_LICENSE:=GPL-2.0-only

wwand-ipad/Makefile

@@ -16,11 +16,11 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=wwand-ipad
 PKG_VERSION:=0.1.0_p21
-PKG_RELEASE:=3
+PKG_RELEASE:=4
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/ddimension/ipad.git
-PKG_SOURCE_VERSION:=fef4e5807f43eebc54327ff6f3751705d74b2dd7
+PKG_SOURCE_VERSION:=32610f6591938b36705478ffd04e14d1b0ed51be
 PKG_MIRROR_HASH:=skip
 
 PKG_LICENSE:=GPL-2.0-only Apache-2.0

wwand-rsim/Makefile

@@ -21,12 +21,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=wwand-rsim
-PKG_VERSION:=0.0.1_p27
-PKG_RELEASE:=1
+PKG_VERSION:=0.0.1_p37
+PKG_RELEASE:=2
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/ddimension/wwand-rsim.git
-PKG_SOURCE_VERSION:=a0cc81ccb480c19bcf5808cc148b17a2f5d26ca4
+PKG_SOURCE_VERSION:=8bb57e354b74eeac891e70e3fe8b9bc309737c23
 PKG_MIRROR_HASH:=skip
 
 PKG_LICENSE:=GPL-2.0-only
@@ -150,7 +150,10 @@ define Package/rsim-card/description
  (Phoenix/Smartmouse serial readers, the WB Electronics Smartmouse USB over
  libusb) or the SIM of a modem it reaches over its AT port (at:<tty>,
  AT+CSIM; that modem's radio is switched off while its card is lent), and
- speaks JSON lines on stdin/stdout. Install it on a router that only holds
+ speaks JSON lines on stdin/stdout; a paired phone's SIM over the
+ Bluetooth SIM Access Profile (bt:<address>, kernel sockets only).
+ `rsim-card --list` shows what the machine offers; `rsim-card --serve` is
+ the forced command for the router's SSH key. Install it on a router that only holds
  the reader or the modem (a SIM host); the router with the using modem
  reaches it over SSH (rsim_reader ssh:<user>@<host>:<reader>). Needs
  nothing of wwand.
@@ -169,15 +172,38 @@ define Package/wwand-rsim
 endef
 
 define Package/wwand-rsim/description
- Lets a Qualcomm modem use a SIM card that sits in a reader on the router,
- or on another machine reached over SSH, as if it were in the modem's own
- slot (QMI UIM Remote). Readers: Phoenix/Smartmouse serial readers, and the
- WB Electronics Smartmouse USB driven over libusb (clock and mode set by
- software). Configure per modem with `option rsim_reader` (phoenix:<tty>,
- wbsm:, or ssh:<user>@<host>:<reader>). The modem firmware must have the
- service enabled: `wwandctl rsim [modem] enable --reset` (Quectel).
- Another wwand modem can lend its card instead (`modem:<donor>`), over the
- SIM Access Profile or APDU by APDU (QMI UIM or AT+CSIM).
+ Lets a Qualcomm modem use a SIM card that is not in its own slot, as if
+ it were (QMI UIM Remote): in a reader on the router or on another machine
+ reached over SSH (Phoenix/Smartmouse serial readers, the WB Electronics
+ Smartmouse USB over libusb), in a phone paired over Bluetooth (SIM Access
+ Profile), in a modem wwand does not manage (AT+CSIM), in another modem of
+ this router, in a modem of another wwand router (over SSH, restricted with
+ rsim-card --serve; that router needs wwand-rsim-provider), or in an
+ osmo-remsim SIM bank (RSPRO). A lending modem detaches
+ first and keeps its radio off; the lender's APN settings come along as a
+ wwand_sim for the card. Configure per modem with `option rsim` (a
+ wwand_simreader) or in LuCI. The modem firmware must have the service
+ enabled: `wwandctl rsim [modem] enable --reset` (Quectel).
+endef
+
+define Package/wwand-rsim-provider
+  SECTION:=net
+  CATEGORY:=Network
+  SUBMENU:=WWAN
+  TITLE:=Lend this router's modem SIMs to other wwand routers
+  # the lending itself is the rsim plugin's, in the daemon; this is the
+  # relay another router runs here over SSH (wwandctl rsim proxy)
+  DEPENDS:=+wwand-rsim
+  VARIANT:=nopcsc
+endef
+
+define Package/wwand-rsim-provider/description
+ The provider side of wwand-rsim: `wwandctl rsim proxy`, which another
+ router's wwand-rsim runs here over SSH to borrow the card of one of this
+ router's modems (SIM Access or APDU by APDU, the modem's radio parked
+ meanwhile), and `wwandctl rsim proxy --list`, which a scan from there
+ shows. Without it this router lends its cards only to its own modems (SIM
+ sponsor), and another router reaches them only over an AT port.
 endef
 
 define Package/luci-app-wwand-rsim
@@ -209,6 +235,11 @@ define Package/wwand-rsim/install
 	$(INSTALL_DATA) $(PKG_BUILD_DIR)/ctl/rsim.uc $(1)$(UCDIR)/ctl/
 endef
 
+define Package/wwand-rsim-provider/install
+	$(INSTALL_DIR) $(1)$(UCDIR)/ctl
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/ctl/rsim_provider.uc $(1)$(UCDIR)/ctl/
+endef
+
 # named, not globbed (the rule luci-app-wwand follows)
 define Package/luci-app-wwand-rsim/install
 	$(INSTALL_DIR) $(1)/www/luci-static/resources/view/wwand
@@ -224,4 +255,5 @@ endef
 $(eval $(call BuildPackage,rsim-card))
 $(eval $(call BuildPackage,rsim-card-pcsc))
 $(eval $(call BuildPackage,wwand-rsim))
+$(eval $(call BuildPackage,wwand-rsim-provider))
 $(eval $(call BuildPackage,luci-app-wwand-rsim))

wwand/Makefile

@@ -50,12 +50,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=wwand
-PKG_VERSION:=1.6.8_p41
-PKG_RELEASE:=59
+PKG_VERSION:=1.6.8_p56
+PKG_RELEASE:=60
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/ddimension/wwand.git
-PKG_SOURCE_VERSION:=113788ba066262395e84ac8f8e9ad11a5facfaf8
+PKG_SOURCE_VERSION:=ed275d3cf5ab201fcbdf213b4665a443ca776c5c
 PKG_MIRROR_HASH:=skip
 
 PKG_LICENSE:=GPL-2.0-only