netbird: update to 0.77.1

[nagual2]

📦 Package Details

Maintainer: @wehagy
Description:

Update netbird to upstream v0.77.1.

Changelog: netbirdio/netbird@v0.73.2...v0.77.1

Notable changes:

• fix local privilege escalation via unauthenticated daemon IPC socket (GHSA-qcpp-8vwj-hhwr), affects all client versions < 0.76.0
• fix nftables route rule expression ordering
• fall back to per-IP ACL rules when ipset is unavailable

---

🧪 Run Testing Details

• OpenWrt Version: 25.12.4
• OpenWrt Target/Subtarget: x86/64
• OpenWrt Device: Hyper-V VM

Compile tested: OpenWrt SDK 25.12.0, x86_64 (make package/netbird/compile → netbird-0.77.1-r1.apk)
Run tested: upgraded installed package on 25.12.4 x86_64, procd service starts, netbird version reports 0.77.1, CLI status works against running daemon.

---

✅ Formalities

• I have reviewed the CONTRIBUTING.md file for detailed contributing guidelines.

[openwrt-ai]

Commit checks

• f55750f "netbird: update to 0.77.1" — the (cherry picked from commit a9ac45ccbb8534eff42dc8cbbe270b8886099f27) trailer points at a commit that is not in openwrt/packages master. Evidence:

  • master (tip 89f358c) still carries PKG_VERSION:=0.73.2 in net/netbird/Makefile:4.
  • git merge-base --is-ancestor a9ac45cc… origin/master returns false, and git branch -r --contains a9ac45cc… is empty — the object is only reachable because forks share GitHub's object store.
  • A repo-wide PR search for netbird 0.77.1 returns this PR and nothing else, so there is no master PR pending either.

  Two consequences worth your call:

  • The trailer is misleading in the 25.12 history — the SHA won't resolve to anything a reader can find on master.
  • Merging this first leaves openwrt-25.12 on 0.77.1 while master stays on 0.73.2, so the next branch-out would ship a netbird downgrade.

  The usual fix is ordering, not content: land the update on master first, then re-cherry-pick with git cherry-pick -x so the trailer names the merged SHA. If you'd rather treat this as a standalone stable-branch security update instead, dropping the cherry picked from line would at least stop it from claiming an upstream commit that isn't there — but master would still want the same bump.

What checks out

For the record, the parts I could verify are all fine, so the above is the only substantive concern:

• The diff is byte-identical to a9ac45cc… (both move net/netbird/Makefile from blob 2893c4c1 to adbb10c8), so the cherry-pick introduced no divergence of its own.
• v0.77.1 exists upstream — git ls-remote https://github.com/netbirdio/netbird v0.77.1 → 6b3ee45e5e9b0b2b186765ac9f44f3cd5caab5e6.
• Go requirements are satisfied on this branch: netbird 0.77.1's go.mod asks for go 1.25.5 / toolchain go1.25.12, and openwrt-25.12 ships GO_DEFAULT_VERSION:=1.26 in lang/golang/golang-values.mk. (Worth noting since a 0.73.2 → 0.77.1 jump is exactly where a toolchain bump would normally bite on a stable branch.)
• PKG_RELEASE:=1 is correct for a PKG_VERSION upgrade.
• No other netbird commits sit between the branch base and master for this package, so no prerequisite commit is missing.
• All three FormalityCheck runs are green on f55750f; the build workflow hasn't reported yet, so there's nothing CI-side to act on.

I could not verify PKG_HASH — this session's egress blocks codeload.github.com for that repo, so the tarball checksum is unverified here rather than wrong.

---

Generated by Claude Code

[openwrt-ai]

nit (optional, not a blocker): dropping the blank line after PKG_RELEASE is unrelated to the version bump and isn't mentioned in the commit message, so it adds a hunk a reader has to explain to themselves. Separating the PKG_NAME/PKG_VERSION/PKG_RELEASE block from the PKG_SOURCE* block with a blank line is the layout this Makefile has used and the common one in the feed.

Note this same wart is present in the master-side commit the trailer names, so if you keep it here for verbatim parity with that commit, that is a defensible choice — just calling it out since it is the only part of the diff that isn't the version/hash change.

Suggested change

	PKG_RELEASE:=1
	PKG_RELEASE:=1

---

Generated by Claude Code

[egc112]

Please target and test on Master branch.

[openwrt-ai]

Re-reviewed at e0bf45b (force-push since my last pass at f55750f).

Fixed since last review: the amend restores the blank line after PKG_RELEASE:=1, so the diff is now a clean 2-line version+hash bump with no incidental whitespace change. Nothing else in the diff to flag.

Commit checks

• e0bf45b "netbird: update to 0.77.1" — the (cherry picked from commit a9ac45ccbb8534eff42dc8cbbe270b8886099f27) trailer still names a commit that is not in openwrt/packages master. Re-verified against master tip a583d911:

  • PKG_VERSION:=0.73.2 at net/netbird/Makefile:4 — master is still on 0.73.2.
  • git merge-base --is-ancestor a9ac45cc… a583d911 → false.
  • A repo-wide PR search for netbird 0.77 returns only this PR, so nothing is queued on master either.

  New evidence since my last pass: a9ac45cc… is authored by nagual2 <[email protected]>, i.e. a commit on the fork rather than a merged master commit — it resolves only because forks share GitHub's object store. @egc112 has independently asked for the same thing in the thread.

  Secondary inaccuracy: this head no longer matches a9ac45cc… either. That commit also deleted the blank line after PKG_RELEASE:=1 (5 lines changed); e0bf45b keeps it (2 lines changed). The divergence is an improvement, so no action needed on the content — it is only worth naming because a cherry picked from trailer asserts the two commits are identical, and here they are not.

  Consequence unchanged from last review: merging this first leaves openwrt-25.12 on 0.77.1 while master stays on 0.73.2, so the next branch-out would ship a netbird downgrade. The usual fix is ordering rather than content — land the bump on master, then re-cherry-pick with git cherry-pick -x so the trailer names the merged SHA. If you would rather carry this as a standalone stable-branch security update, dropping the trailer would at least stop it claiming an upstream commit that does not exist; master would still want the same bump.

Verified clean

• v0.77.1 exists upstream — git ls-remote https://github.com/netbirdio/netbird refs/tags/v0.77.1 → 6b3ee45e5e9b0b2b186765ac9f44f3cd5caab5e6.
• Go requirements hold on this branch: netbird 0.77.1 asks for go 1.25.5 / toolchain go1.25.12, and openwrt-25.12 ships GO_DEFAULT_VERSION:=1.26.
• PKG_RELEASE:=1 is correct for a PKG_VERSION upgrade.
• No prerequisite netbird commit is missing between the branch base and master.

PKG_HASH remains unverified — this session's egress returns 403 for codeload.github.com, so the checksum is unchecked here rather than wrong.

To be clear on what blocks: the code change itself looks correct and I have no objection to the content. The only open item is the trailer/ordering question above, which is a maintainer call.

---

Generated by Claude Code