netbird: update to 0.77.1

[nagual2]

📦 Package Details

Maintainer: @wehagy
Description:

Update netbird to upstream v0.77.1.

Changelog: netbirdio/netbird@v0.73.2...v0.77.1

Notable changes:

• fix local privilege escalation via unauthenticated daemon IPC socket (GHSA-qcpp-8vwj-hhwr), affects all client versions < 0.76.0
• fix nftables route rule expression ordering
• fall back to per-IP ACL rules when ipset is unavailable

---

🧪 Run Testing Details

• OpenWrt Version: 25.12.4
• OpenWrt Target/Subtarget: x86/64
• OpenWrt Device: Hyper-V VM

Compile tested: OpenWrt SDK 25.12.0, x86_64 (make package/netbird/compile → netbird-0.77.1-r1.apk)
Run tested: upgraded installed package on 25.12.4 x86_64, procd service starts, netbird version reports 0.77.1, CLI status works against running daemon.

---

✅ Formalities

• I have reviewed the CONTRIBUTING.md file for detailed contributing guidelines.

---

Companion PR for stable branch: #30370 (will re-cherry-pick to openwrt-25.12 after this lands on master).

[egc112]

It is a PR for Main branch so it should be compiled and run tested on that same Main branch and not on 25.12

Spoiler it does not compile

[nagual2]

Thanks for the review — fair point on the branch: this was compile and run tested on the 25.12 SDK, and a PR targeting master has to be tested on master. I'll redo the testing on current master (snapshot) for x86/64 and update the PR description accordingly.

On the compile failure, though, I can't reproduce it on x86/64. I built v0.77.1 here with Go 1.26.7 — the version currently in master (GO_DEFAULT_VERSION:=1.26) — for GOOS=linux GOARCH=amd64, and it compiled cleanly.

The known Go 1.26 blocker was gvisor.dev/gvisor: netbird#5290, WaitReasonSelect redeclared from the duplicate runtime_constants_go125.go / runtime_constants_go126.go. That was fixed upstream, and 0.77.1 pins gvisor v0.0.0-20260219192049, where pkg/sync only ships runtime_constants_go_impl.go — so that failure mode is gone in this release.

Could you share the build log, the target architecture and the Go version you used? If it fails on a specific arch or in cgo mode I'll reproduce it and fix it rather than guess.

[egc112]

Go 1.26 has been removed from Main branch.
It now has Golang 1.27.
Netbird 0.77.1 does not compile with Go 1.27
707ebe9

[nagual2]

Thanks — confirmed: master now defaults to Go 1.27 after 707ebe9 (golang 1.26 dropped).

I retested v0.77.1 with Go 1.27.0 (GOTOOLCHAIN=local, CGO_ENABLED=0, GOOS=linux GOARCH=amd64) and it compiled cleanly (ELF client ~60 MiB).

The gvisor pin in 0.77.1 (v0.0.0-20260219192049-0f2374377e89) only ships runtime_constants_go_impl.go, so the old Go 1.26 redeclaration failure mode is not present.

Could you share the failing build log (target/subtarget + exact error)? If it fails under OpenWrt's cgo/external-link path or on a non-x86_64 arch, I'll reproduce that specifically and fix it.

[openwrt-ai]

Commit checks

• 2800f85 "netbird: update to 0.77.1" — the Compile tested: / Run tested: lines say OpenWrt 25.12.0 SDK and OpenWrt 25.12.4, but this PR targets master. You already agreed to redo the testing; note the fix belongs in the commit message as well, not only in the PR description — these trailers are what lands in the tree.

• 2800f85 — Co-authored-by: Cursor <[email protected]> attributes a tool rather than a person. CONTRIBUTING.md:80 requires a real name and real e-mail address for authorship; dropping the trailer avoids the ambiguity.

• 2800f85 — nit: Maintainer: Wesley Gimenes <[email protected]> @wehagy names the maintainer twice, once as name+e-mail and once as a GitHub handle. The earlier netbird bumps (784e09ef, df6533b9) use only the name and address.

• 2800f85 — nit: each of the three "Notable upstream changes" bullets is split by a blank line, so the GHSA reference and the bullet text render as separate paragraphs in git log. Removing the blank lines keeps each bullet as one item.

The Makefile change itself looks fine: PKG_VERSION and PKG_HASH are the only edits, PKG_RELEASE correctly stays at 1 for a version bump, and v0.77.1 exists upstream (6b3ee45e5e9b0b2b186765ac9f44f3cd5caab5e6).

---

Generated by Claude Code