diff --git a/package/kernel/linux/modules/netdevices.mk b/package/kernel/linux/modules/netdevices.mk
index 8c817bb901..050ad678b1 100644
--- a/package/kernel/linux/modules/netdevices.mk
+++ b/package/kernel/linux/modules/netdevices.mk
@@ -742,7 +742,7 @@ $(eval $(call KernelPackage,ixgbevf))
 define KernelPackage/i40e
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=Intel(R) Ethernet Controller XL710 Family support
-  DEPENDS:=@PCI_SUPPORT +kmod-mdio +kmod-ptp +kmod-hwmon-core +kmod-libphy
+  DEPENDS:=@PCI_SUPPORT +kmod-mdio +kmod-ptp +kmod-hwmon-core +kmod-libphy @!TARGET_ramips
   KCONFIG:=CONFIG_I40E \
     CONFIG_I40E_VXLAN=n \
     CONFIG_I40E_HWMON=y \
diff --git a/package/libs/mbedtls/Makefile b/package/libs/mbedtls/Makefile
index dfbc2c859b..625a26c739 100644
--- a/package/libs/mbedtls/Makefile
+++ b/package/libs/mbedtls/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mbedtls
-PKG_VERSION:=2.16.12
+PKG_VERSION:=2.28.0
 PKG_RELEASE:=$(AUTORELEASE)
 PKG_USE_MIPS16:=0
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/ARMmbed/mbedtls/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=294871ab1864a65d0b74325e9219d5bcd6e91c34a3c59270c357bb9ae4d5c393
+PKG_HASH:=6519579b836ed78cc549375c7c18b111df5717e86ca0eeff4cb64b2674f424cc
 
 PKG_LICENSE:=GPL-2.0-or-later
 PKG_LICENSE_FILES:=gpl-2.0.txt
@@ -146,6 +146,9 @@ define Build/Configure
 	     END { exit(rc) }' $(PKG_BUILD_DIR)/include/mbedtls/config.h \
 	     >$(PKG_BUILD_DIR)/include/mbedtls/config.h.new && \
 	mv $(PKG_BUILD_DIR)/include/mbedtls/config.h.new $(PKG_BUILD_DIR)/include/mbedtls/config.h
+
+	sed -i '/fuzz/d' $(PKG_BUILD_DIR)/programs/CMakeLists.txt
+	sed -i '/test/d' $(PKG_BUILD_DIR)/programs/CMakeLists.txt
 endef
 
 define Build/InstallDev
diff --git a/package/libs/mbedtls/patches/100-Implements-AES-and-GCM-with-ARMv8-Crypto-Extensions.patch b/package/libs/mbedtls/patches/100-Implements-AES-and-GCM-with-ARMv8-Crypto-Extensions.patch
index 7c840c020f..7ae41e82b8 100644
--- a/package/libs/mbedtls/patches/100-Implements-AES-and-GCM-with-ARMv8-Crypto-Extensions.patch
+++ b/package/libs/mbedtls/patches/100-Implements-AES-and-GCM-with-ARMv8-Crypto-Extensions.patch
@@ -100,7 +100,7 @@ Then run normal make or cmake etc.
 +#endif /* MBEDTLS_ARMV8CE_AES_H */
 --- a/include/mbedtls/check_config.h
 +++ b/include/mbedtls/check_config.h
-@@ -95,6 +95,10 @@
+@@ -72,6 +72,10 @@
  #error "MBEDTLS_AESNI_C defined, but not all prerequisites"
  #endif
  
@@ -111,25 +111,21 @@ Then run normal make or cmake etc.
  #if defined(MBEDTLS_CTR_DRBG_C) && !defined(MBEDTLS_AES_C)
  #error "MBEDTLS_CTR_DRBG_C defined, but not all prerequisites"
  #endif
-@@ -772,3 +776,4 @@
- typedef int mbedtls_iso_c_forbids_empty_translation_units;
- 
- #endif /* MBEDTLS_CHECK_CONFIG_H */
-+
 --- a/include/mbedtls/config.h
 +++ b/include/mbedtls/config.h
-@@ -73,6 +73,7 @@
-  * Requires support for asm() in compiler.
+@@ -47,6 +47,7 @@
   *
   * Used in:
-+ *      library/armv8ce_aes.c
   *      library/aria.c
++ *      library/armv8ce_aes.c
   *      library/timing.c
   *      include/mbedtls/bn_mul.h
-@@ -1905,6 +1906,21 @@
+  *
+@@ -2312,6 +2313,21 @@
+  */
  #define MBEDTLS_AESNI_C
  
- /**
++/**
 + * \def MBEDTLS_ARMV8CE_AES_C
 + *
 + * Enable ARMv8 Crypto Extensions for AES and GCM
@@ -144,30 +140,28 @@ Then run normal make or cmake etc.
 + */
 +//#define MBEDTLS_ARMV8CE_AES_C
 +
-+/**
+ /**
   * \def MBEDTLS_AES_C
   *
-  * Enable the AES block cipher.
 --- a/library/aes.c
 +++ b/library/aes.c
-@@ -69,7 +69,9 @@
+@@ -39,6 +39,9 @@
  #if defined(MBEDTLS_AESNI_C)
  #include "mbedtls/aesni.h"
  #endif
--
 +#if defined(MBEDTLS_ARMV8CE_AES_C)
 +#include "mbedtls/armv8ce_aes.h"
 +#endif
+ 
  #if defined(MBEDTLS_SELF_TEST)
  #if defined(MBEDTLS_PLATFORM_C)
- #include "mbedtls/platform.h"
-@@ -1052,6 +1054,11 @@
+@@ -999,6 +1002,11 @@ int mbedtls_aes_crypt_ecb( mbedtls_aes_context *ctx,
          return( mbedtls_aesni_crypt_ecb( ctx, mode, input, output ) );
  #endif
  
 +#if defined(MBEDTLS_ARMV8CE_AES_C)
-+	// We don't do runtime checking for ARMv8 Crypto Extensions
-+	return mbedtls_armv8ce_aes_crypt_ecb( ctx, mode, input, output );
++    // We don't do runtime checking for ARMv8 Crypto Extensions
++    return mbedtls_armv8ce_aes_crypt_ecb( ctx, mode, input, output );
 +#endif
 +
  #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_HAVE_X86)
@@ -320,7 +314,7 @@ Then run normal make or cmake etc.
 +#endif /* MBEDTLS_ARMV8CE_AES_C */
 --- a/library/CMakeLists.txt
 +++ b/library/CMakeLists.txt
-@@ -7,6 +7,7 @@
+@@ -15,6 +15,7 @@ set(src_crypto
      aesni.c
      arc4.c
      aria.c
@@ -330,7 +324,7 @@ Then run normal make or cmake etc.
      base64.c
 --- a/library/gcm.c
 +++ b/library/gcm.c
-@@ -71,6 +71,10 @@
+@@ -41,6 +41,10 @@
  #include "mbedtls/aesni.h"
  #endif
  
@@ -341,26 +335,26 @@ Then run normal make or cmake etc.
  #if defined(MBEDTLS_SELF_TEST) && defined(MBEDTLS_AES_C)
  #include "mbedtls/aes.h"
  #include "mbedtls/platform.h"
-@@ -140,6 +144,12 @@
+@@ -87,6 +91,12 @@ static int gcm_gen_table( mbedtls_gcm_context *ctx )
      if( ( ret = mbedtls_cipher_update( &ctx->cipher_ctx, h, 16, h, &olen ) ) != 0 )
          return( ret );
  
 +#if defined(MBEDTLS_ARMV8CE_AES_C)
-+	// we don't do feature testing with ARMv8 cryptography extensions
++    // we don't do feature testing with ARMv8 cryptography extensions
 +    memcpy( ctx ->HL, h, 16 );          // put H at the beginning of buffer
 +    return( 0 );                        // that's all we need
 +#endif
 +
      /* pack h as two 64-bits ints, big-endian */
-     GET_UINT32_BE( hi, h,  0  );
-     GET_UINT32_BE( lo, h,  4  );
-@@ -248,6 +258,11 @@
+     hi = MBEDTLS_GET_UINT32_BE( h,  0  );
+     lo = MBEDTLS_GET_UINT32_BE( h,  4  );
+@@ -196,6 +206,11 @@ static void gcm_mult( mbedtls_gcm_context *ctx, const unsigned char x[16],
      unsigned char lo, hi, rem;
      uint64_t zh, zl;
  
 +#if defined(MBEDTLS_ARMV8CE_AES_C)
-+	mbedtls_armv8ce_gcm_mult( output, x, (const unsigned char *) ctx->HL );
-+	return;
++    mbedtls_armv8ce_gcm_mult( output, x, (const unsigned char *) ctx->HL );
++    return;
 +#endif
 +
  #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64)
@@ -368,17 +362,17 @@ Then run normal make or cmake etc.
          unsigned char h[16];
 --- a/library/Makefile
 +++ b/library/Makefile
-@@ -65,6 +65,7 @@
- 
- OBJS_CRYPTO=	aes.o		aesni.o		arc4.o		\
- 		aria.o		asn1parse.o	asn1write.o	\
-+		armv8ce_aes.o					\
- 		base64.o	bignum.o	blowfish.o	\
- 		camellia.o	ccm.o		chacha20.o	\
- 		chachapoly.o	cipher.o	cipher_wrap.o	\
+@@ -72,6 +72,7 @@ OBJS_CRYPTO= \
+ 	     aesni.o \
+ 	     arc4.o \
+ 	     aria.o \
++	     armv8ce_aes.o \
+ 	     asn1parse.o \
+ 	     asn1write.o \
+ 	     base64.o \
 --- a/library/version_features.c
 +++ b/library/version_features.c
-@@ -586,6 +586,9 @@
+@@ -624,6 +624,9 @@ static const char * const features[] = {
  #if defined(MBEDTLS_AESNI_C)
      "MBEDTLS_AESNI_C",
  #endif /* MBEDTLS_AESNI_C */
diff --git a/package/libs/mbedtls/patches/200-config.patch b/package/libs/mbedtls/patches/200-config.patch
index 67f331674c..faf5bb5db9 100644
--- a/package/libs/mbedtls/patches/200-config.patch
+++ b/package/libs/mbedtls/patches/200-config.patch
@@ -1,6 +1,6 @@
 --- a/include/mbedtls/config.h
 +++ b/include/mbedtls/config.h
-@@ -692,14 +692,14 @@
+@@ -665,14 +665,14 @@
   *
   * Enable Output Feedback mode (OFB) for symmetric ciphers.
   */
@@ -17,10 +17,10 @@
  
  /**
   * \def MBEDTLS_CIPHER_NULL_CIPHER
-@@ -816,19 +816,19 @@
-  *
+@@ -790,20 +790,20 @@
   * Comment macros to disable the curve and functions for it
   */
+ /* Short Weierstrass curves (supporting ECP, ECDH, ECDSA) */
 -#define MBEDTLS_ECP_DP_SECP192R1_ENABLED
 -#define MBEDTLS_ECP_DP_SECP224R1_ENABLED
 +//#define MBEDTLS_ECP_DP_SECP192R1_ENABLED
@@ -40,13 +40,14 @@
 +//#define MBEDTLS_ECP_DP_BP256R1_ENABLED
 +//#define MBEDTLS_ECP_DP_BP384R1_ENABLED
 +//#define MBEDTLS_ECP_DP_BP512R1_ENABLED
+ /* Montgomery curves (supporting ECP) */
  #define MBEDTLS_ECP_DP_CURVE25519_ENABLED
 -#define MBEDTLS_ECP_DP_CURVE448_ENABLED
 +//#define MBEDTLS_ECP_DP_CURVE448_ENABLED
  
  /**
   * \def MBEDTLS_ECP_NIST_OPTIM
-@@ -952,7 +952,7 @@
+@@ -956,7 +956,7 @@
   *             See dhm.h for more details.
   *
   */
@@ -55,7 +56,7 @@
  
  /**
   * \def MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
-@@ -972,7 +972,7 @@
+@@ -976,7 +976,7 @@
   *      MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA
   *      MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA
   */
@@ -64,7 +65,7 @@
  
  /**
   * \def MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
-@@ -997,7 +997,7 @@
+@@ -1001,7 +1001,7 @@
   *      MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA
   *      MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA
   */
@@ -73,7 +74,7 @@
  
  /**
   * \def MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
-@@ -1131,7 +1131,7 @@
+@@ -1135,7 +1135,7 @@
   *      MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
   *      MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
   */
@@ -82,7 +83,7 @@
  
  /**
   * \def MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
-@@ -1155,7 +1155,7 @@
+@@ -1159,7 +1159,7 @@
   *      MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256
   *      MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384
   */
@@ -91,7 +92,7 @@
  
  /**
   * \def MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
-@@ -1259,7 +1259,7 @@
+@@ -1263,7 +1263,7 @@
   * This option is only useful if both MBEDTLS_SHA256_C and
   * MBEDTLS_SHA512_C are defined. Otherwise the available hash module is used.
   */
@@ -100,7 +101,7 @@
  
  /**
   * \def MBEDTLS_ENTROPY_NV_SEED
-@@ -1354,14 +1354,14 @@
+@@ -1478,14 +1478,14 @@
   * Uncomment this macro to disable the use of CRT in RSA.
   *
   */
@@ -117,7 +118,7 @@
  
  /**
   * \def MBEDTLS_SHA256_SMALLER
-@@ -1515,7 +1515,7 @@
+@@ -1756,7 +1756,7 @@
   *          configuration of this extension).
   *
   */
@@ -126,7 +127,7 @@
  
  /**
   * \def MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO
-@@ -1720,7 +1720,7 @@
+@@ -2017,7 +2017,7 @@
   *
   * Comment this macro to disable support for truncated HMAC in SSL
   */
@@ -135,7 +136,7 @@
  
  /**
   * \def MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT
-@@ -1796,7 +1796,7 @@
+@@ -2185,7 +2185,7 @@
   *
   * Comment this to disable run-time checking and save ROM space
   */
@@ -144,7 +145,7 @@
  
  /**
   * \def MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3
-@@ -2126,7 +2126,7 @@
+@@ -2534,7 +2534,7 @@
   *      MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256
   *      MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256
   */
@@ -153,7 +154,7 @@
  
  /**
   * \def MBEDTLS_ARIA_C
-@@ -2192,7 +2192,7 @@
+@@ -2600,7 +2600,7 @@
   * This module enables the AES-CCM ciphersuites, if other requisites are
   * enabled as well.
   */
@@ -162,7 +163,7 @@
  
  /**
   * \def MBEDTLS_CERTS_C
-@@ -2204,7 +2204,7 @@
+@@ -2612,7 +2612,7 @@
   *
   * This module is used for testing (ssl_client/server).
   */
@@ -171,7 +172,7 @@
  
  /**
   * \def MBEDTLS_CHACHA20_C
-@@ -2312,7 +2312,7 @@
+@@ -2725,7 +2725,7 @@
   * \warning   DES is considered a weak cipher and its use constitutes a
   *            security risk. We recommend considering stronger ciphers instead.
   */
@@ -180,7 +181,7 @@
  
  /**
   * \def MBEDTLS_DHM_C
-@@ -2475,7 +2475,7 @@
+@@ -2890,7 +2890,7 @@
   * This module adds support for the Hashed Message Authentication Code
   * (HMAC)-based key derivation function (HKDF).
   */
@@ -189,7 +190,7 @@
  
  /**
   * \def MBEDTLS_HMAC_DRBG_C
-@@ -2785,7 +2785,7 @@
+@@ -3203,7 +3203,7 @@
   *
   * This module enables abstraction of common (libc) functions.
   */
@@ -198,7 +199,7 @@
  
  /**
   * \def MBEDTLS_POLY1305_C
-@@ -2806,7 +2806,7 @@
+@@ -3279,7 +3279,7 @@
   * Caller:  library/md.c
   *
   */
@@ -207,7 +208,7 @@
  
  /**
   * \def MBEDTLS_RSA_C
-@@ -3013,7 +3013,7 @@
+@@ -3486,7 +3486,7 @@
   *
   * This module provides run-time version information.
   */
@@ -216,7 +217,7 @@
  
  /**
   * \def MBEDTLS_X509_USE_C
-@@ -3123,7 +3123,7 @@
+@@ -3596,7 +3596,7 @@
   * Module:  library/xtea.c
   * Caller:
   */
diff --git a/package/network/utils/ipset/Makefile b/package/network/utils/ipset/Makefile
index bc4945e0f6..7b8d035198 100644
--- a/package/network/utils/ipset/Makefile
+++ b/package/network/utils/ipset/Makefile
@@ -9,12 +9,12 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=ipset
-PKG_VERSION:=7.6
+PKG_VERSION:=7.15
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=http://ipset.netfilter.org
-PKG_HASH:=0e7d44caa9c153d96a9b5f12644fbe35a632537a5a7f653792b72e53d9d5c2db
+PKG_HASH:=0a5545aaadb640142c1f888d366a78ddf8724799967fa20686a70053bd621751
 
 PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
 PKG_LICENSE:=GPL-2.0
@@ -62,6 +62,7 @@ endef
 define Package/ipset/install
 	$(INSTALL_DIR) $(1)/usr/sbin
 	$(CP) $(PKG_INSTALL_DIR)/usr/sbin/ipset $(1)/usr/sbin/
+	$(CP) $(PKG_INSTALL_DIR)/usr/sbin/ipset-translate $(1)/usr/sbin/
 endef
 
 define Package/libipset/install
diff --git a/package/network/utils/ipset/patches/0001-lib-ipset-fix-printf-warning.patch b/package/network/utils/ipset/patches/0001-lib-ipset-fix-printf-warning.patch
new file mode 100644
index 0000000000..90dfacab8f
--- /dev/null
+++ b/package/network/utils/ipset/patches/0001-lib-ipset-fix-printf-warning.patch
@@ -0,0 +1,11 @@
+--- a/lib/ipset.c
++++ b/lib/ipset.c
+@@ -1847,7 +1847,7 @@ static int ipset_xlate(struct ipset *ips
+ 		return -1;
+ 	case IPSET_CMD_LIST:
+ 		if (!set) {
+-			printf("list sets %s\n",
++			printf("list sets %s %s\n",
+ 			       ipset_xlate_family(family), table);
+ 		} else {
+ 			printf("list set %s %s %s\n",
diff --git a/scripts/mkhash.c b/scripts/mkhash.c
index ed3d42d4c3..a28d5fd537 100644
--- a/scripts/mkhash.c
+++ b/scripts/mkhash.c
@@ -105,7 +105,6 @@ be32enc(void *buf, uint32_t u)
 	p[2] = ((uint8_t) ((u >> 8) & 0xff));
 	p[3] = ((uint8_t) (u & 0xff));
 }
-#endif
 
 static void
 be64enc(void *buf, uint64_t u)
@@ -132,6 +131,7 @@ be32dec(const void *buf)
 
 	return (((uint32_t) be16dec(p)) << 16) | be16dec(p + 2);
 }
+#endif
 
 #define MD5_DIGEST_LENGTH	16
 
diff --git a/tools/Makefile b/tools/Makefile
index 6f0856dab7..b611bd79a2 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -47,6 +47,7 @@ $(curdir)/bison/compile := $(curdir)/flex/compile
 $(curdir)/cbootimage/compile += $(curdir)/automake/compile
 $(curdir)/cmake/compile += $(curdir)/libressl/compile $(curdir)/ninja/compile
 $(curdir)/dosfstools/compile := $(curdir)/autoconf/compile $(curdir)/automake/compile
+$(curdir)/expat/compile := $(curdir)/cmake/compile
 $(curdir)/e2fsprogs/compile := $(curdir)/libtool/compile
 $(curdir)/fakeroot/compile := $(curdir)/libtool/compile
 $(curdir)/findutils/compile := $(curdir)/bison/compile
@@ -76,7 +77,7 @@ $(curdir)/squashfs/compile := $(curdir)/lzma-old/compile
 $(curdir)/squashfskit4/compile := $(curdir)/xz/compile $(curdir)/zlib/compile
 $(curdir)/upx/compile := $(curdir)/ucl/compile
 $(curdir)/zlib/compile := $(curdir)/cmake/compile
-$(curdir)/zstd/compile := $(curdir)/cmake/compile
+$(curdir)/zstd/compile := $(curdir)/meson/compile
 
 ifneq ($(HOST_OS),Linux)
   $(curdir)/squashfskit4/compile += $(curdir)/coreutils/compile
@@ -86,7 +87,7 @@ endif
 ifneq ($(CONFIG_CCACHE)$(CONFIG_SDK),)
 $(foreach tool, $(filter-out xz zstd pkgconf patch ninja meson libressl cmake,$(tools-y)), $(eval $(curdir)/$(tool)/compile += $(curdir)/ccache/compile))
 tools-y += ccache
-$(curdir)/ccache/compile := $(curdir)/zstd/compile
+$(curdir)/ccache/compile := $(curdir)/cmake/compile $(curdir)/zstd/compile
 endif
 
 # in case there is no patch tool on the host we need to make patch tool a
diff --git a/tools/cmake/Makefile b/tools/cmake/Makefile
index 8f0631eb74..d1d5b58a47 100644
--- a/tools/cmake/Makefile
+++ b/tools/cmake/Makefile
@@ -7,14 +7,14 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=cmake
-PKG_VERSION:=3.22.1
+PKG_VERSION:=3.22.2
 PKG_RELEASE:=1
 PKG_CPE_ID:=cpe:/a:kitware:cmake
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/Kitware/CMake/releases/download/v$(PKG_VERSION)/ \
 		https://cmake.org/files/v3.19/
-PKG_HASH:=0e998229549d7b3f368703d20e248e7ee1f853910d42704aa87918c213ea82c0
+PKG_HASH:=3c1c478b9650b107d452c5bd545c72e2fad4e37c09b89a1984b9a2f46df6aced
 
 HOST_BUILD_PARALLEL:=1
 HOST_CONFIGURE_PARALLEL:=1
diff --git a/tools/expat/Makefile b/tools/expat/Makefile
index cfc70b2a49..0bc54a3d48 100644
--- a/tools/expat/Makefile
+++ b/tools/expat/Makefile
@@ -9,21 +9,25 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=expat
 PKG_CPE_ID:=cpe:/a:libexpat:expat
-PKG_VERSION:=2.2.10
+PKG_VERSION:=2.4.6
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
-PKG_HASH:=b2c160f1b60e92da69de8e12333096aeb0c3bf692d41c60794de278af72135a5
+PKG_HASH:=ce317706b07cae150f90cddd4253f5b4fba929607488af5ac47bf2bc08e31f09
 PKG_SOURCE_URL:=https://github.com/libexpat/libexpat/releases/download/R_$(subst .,_,$(PKG_VERSION))
 
-HOST_BUILD_PARALLEL:=1
-
 include $(INCLUDE_DIR)/host-build.mk
+include $(INCLUDE_DIR)/cmake.mk
 
-HOST_CONFIGURE_ARGS += \
-	--without-docbook
-
-define Host/Install
-	$(MAKE) -C $(HOST_BUILD_DIR) install
-endef
+CMAKE_HOST_OPTIONS += \
+	-DDOCBOOK_TO_MAN=OFF \
+	-DEXPAT_BUILD_TOOLS=OFF \
+	-DEXPAT_BUILD_EXAMPLES=OFF \
+	-DEXPAT_BUILD_TESTS=OFF \
+	-DEXPAT_BUILD_DOCS=OFF \
+	-DEXPAT_WITH_LIBBSD=OFF \
+	-DEXPAT_ENABLE_INSTALL=ON \
+	-DEXPAT_DTD=OFF \
+	-DEXPAT_NS=OFF \
+	-DEXPAT_DEV_URANDOM=OFF
 
 $(eval $(call HostBuild))
diff --git a/tools/fakeroot/Makefile b/tools/fakeroot/Makefile
index f4333fbfb3..adae332099 100644
--- a/tools/fakeroot/Makefile
+++ b/tools/fakeroot/Makefile
@@ -5,12 +5,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=fakeroot
-PKG_VERSION:=1.26
+PKG_VERSION:=1.27
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)_$(PKG_VERSION).orig.tar.gz
 PKG_SOURCE_URL:=@DEBIAN/pool/main/f/fakeroot
-PKG_HASH:=480a578ffdc5592e73df4c086950d321b4adc78dbdaec56c82e4fe1fb68de8e9
+PKG_HASH:=3c45eb2d1802a2762069e2e9d21bdd6fb533592bc0cda74c9aff066ab01caddc
 PKG_LICENSE:=GPL-3.0-or-later
 PKG_LICENSE_FILES:=COPYING
 PKG_FIXUP:=autoreconf
diff --git a/tools/fakeroot/patches/100-macos_compile_fix.patch b/tools/fakeroot/patches/100-macos_compile_fix.patch
deleted file mode 100644
index 64c0b472c6..0000000000
--- a/tools/fakeroot/patches/100-macos_compile_fix.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/libfakeroot_inode64.c
-+++ b/libfakeroot_inode64.c
-@@ -36,6 +36,8 @@
- #include <fts.h>
- #endif /* HAVE_FTS_H */
- 
-+void load_library_symbols(void);
-+
- #include "wrapped.h"
- #include "wraptmpf.h"
- #include "wrapdef.h"
diff --git a/tools/fakeroot/patches/400-alpine-libc.musl-fix.patch b/tools/fakeroot/patches/400-alpine-libc.musl-fix.patch
index c37282af5d..730732db2e 100644
--- a/tools/fakeroot/patches/400-alpine-libc.musl-fix.patch
+++ b/tools/fakeroot/patches/400-alpine-libc.musl-fix.patch
@@ -6,7 +6,7 @@ Error relocating openwrt/staging_dir/host/lib/libfakeroot.so: SEND_GET_XATTR: sy
 
 --- a/libfakeroot.c
 +++ b/libfakeroot.c
-@@ -81,12 +81,14 @@
+@@ -86,12 +86,14 @@
  #define SEND_STAT64(a,b,c) send_stat64(a,b,c)
  #define SEND_GET_STAT(a,b) send_get_stat(a,b)
  #define SEND_GET_STAT64(a,b) send_get_stat64(a,b)
@@ -21,7 +21,7 @@ Error relocating openwrt/staging_dir/host/lib/libfakeroot.so: SEND_GET_XATTR: sy
  #define SEND_GET_XATTR64(a,b,c) send_get_xattr64(a,b)
  #endif
  
-@@ -131,8 +133,9 @@
+@@ -136,8 +138,9 @@
  
  /* 10.10 uses id_t in getpriority/setpriority calls, so pretend
     id_t is used everywhere, just happens to be int on some OSes */
diff --git a/tools/fakeroot/patches/500-macos_arm64_compile_fix.patch b/tools/fakeroot/patches/500-macos_arm64_compile_fix.patch
deleted file mode 100644
index a3731b9e99..0000000000
--- a/tools/fakeroot/patches/500-macos_arm64_compile_fix.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-diff --git a/communicate.c b/communicate.c
-index e2699a2..21e5366 100644
---- a/communicate.c
-+++ b/communicate.c
-@@ -24,7 +24,12 @@
-    In this file, we want 'struct stat' to have a 32-bit 'ino_t'.
-    We use 'struct stat64' when we need a 64-bit 'ino_t'.
- */
--#define _DARWIN_NO_64_BIT_INODE
-+# include <sys/types.h>
-+# if __DARWIN_ONLY_64_BIT_INO_T
-+#  define _DARWIN_USE_64_BIT_INODE
-+# else
-+#  define _DARWIN_NO_64_BIT_INODE
-+# endif
- #endif
- 
- #include "communicate.h"
-diff --git a/communicate.h b/communicate.h
-index 3f9ca39..a586108 100644
---- a/communicate.h
-+++ b/communicate.h
-@@ -91,6 +91,10 @@
- # include <inttypes.h>
- #endif
- 
-+#if __DARWIN_ONLY_64_BIT_INO_T
-+struct stat64 __DARWIN_STRUCT_STAT64;
-+#endif
-+
- #ifndef FAKEROOT_FAKENET
- # define FAKEROOTKEY_ENV          "FAKEROOTKEY"
- #endif /* ! FAKEROOT_FAKENET */
-diff --git a/faked.c b/faked.c
-index a970184..ea51a23 100644
---- a/faked.c
-+++ b/faked.c
-@@ -84,7 +84,12 @@
-    In this file, we want 'struct stat' to have a 32-bit 'ino_t'.
-    We use 'struct stat64' when we need a 64-bit 'ino_t'.
- */
--#define _DARWIN_NO_64_BIT_INODE
-+# include <sys/types.h>
-+# if __DARWIN_ONLY_64_BIT_INO_T
-+#  define _DARWIN_USE_64_BIT_INODE
-+# else
-+#  define _DARWIN_NO_64_BIT_INODE
-+# endif
- #endif
- 
- #include "config.h"
-diff --git a/libfakeroot.c b/libfakeroot.c
-index c967d5d..836337d 100644
---- a/libfakeroot.c
-+++ b/libfakeroot.c
-@@ -38,7 +38,12 @@
-    In this file, we want 'struct stat' to have a 32-bit 'ino_t'.
-    We use 'struct stat64' when we need a 64-bit 'ino_t'.
- */
--#define _DARWIN_NO_64_BIT_INODE
-+# include <sys/types.h>
-+# if __DARWIN_ONLY_64_BIT_INO_T
-+#  define _DARWIN_USE_64_BIT_INODE
-+# else
-+#  define _DARWIN_NO_64_BIT_INODE
-+# endif
- 
- /* The helper _unix2003 version of this file calls a few functions in this file
-    that are marked with static_nonapple so that needs to become private instead
-diff --git a/libfakeroot_unix2003.c b/libfakeroot_unix2003.c
-index e1e19b6..f32bfec 100644
---- a/libfakeroot_unix2003.c
-+++ b/libfakeroot_unix2003.c
-@@ -18,7 +18,11 @@
-    In this file, we want 'struct stat' to have a 32-bit 'ino_t'.
-    We use 'struct stat64' when we need a 64-bit 'ino_t'.
- */
--#define _DARWIN_NO_64_BIT_INODE
-+# if __DARWIN_ONLY_64_BIT_INO_T
-+#  define _DARWIN_USE_64_BIT_INODE
-+# else
-+#  define _DARWIN_NO_64_BIT_INODE
-+# endif
- 
- /*
-    This file is for 32-bit symbols which have the "$UNIX2003" version, i.e.
diff --git a/tools/fakeroot/patches/600-macOS.patch b/tools/fakeroot/patches/600-macOS.patch
new file mode 100644
index 0000000000..f9d6d189b2
--- /dev/null
+++ b/tools/fakeroot/patches/600-macOS.patch
@@ -0,0 +1,56 @@
+--- a/communicate.c
++++ b/communicate.c
+@@ -441,6 +441,10 @@ void semaphore_down(){
+ 
+ #else /* FAKEROOT_FAKENET */
+ 
++#ifndef SOL_TCP
++# define SOL_TCP 6 /* this should probably be done with getprotoent */
++#endif
++
+ static struct sockaddr *get_addr(void)
+ {
+   static struct sockaddr_in addr = { 0, 0, { 0 } };
+--- a/libfakeroot_inode64.c
++++ b/libfakeroot_inode64.c
+@@ -25,7 +25,7 @@
+ #include "config.h"
+ #include "communicate.h"
+ 
+-#if MAC_OS_X_VERSION_MIN_REQUIRED >= MAC_OS_X_VERSION_10_5
++#if MAC_OS_X_VERSION_MIN_REQUIRED >= MAC_OS_X_VERSION_10_5 && !__DARWIN_ONLY_64_BIT_INO_T
+ 
+ #include <stdio.h>
+ #include <spawn.h>
+--- a/wrapfunc.inp
++++ b/wrapfunc.inp
+@@ -48,9 +48,11 @@ getattrlist$UNIX2003;int;(const char *pa
+ #endif
+ #endif
+ #if MAC_OS_X_VERSION_MIN_REQUIRED >= MAC_OS_X_VERSION_10_5
++#if !__DARWIN_ONLY_64_BIT_INO_T
+ lstat$INODE64;int;(const char *file_name, struct stat *buf);(file_name, buf)
+ stat$INODE64;int;(const char *file_name, struct stat *buf);(file_name, buf)
+ fstat$INODE64;int;(int fd, struct stat *buf);(fd, buf)
++#endif
+ posix_spawn;int;(pid_t * __restrict pid, const char * __restrict path, const posix_spawn_file_actions_t *file_actions, const posix_spawnattr_t * __restrict attrp, char *const argv[ __restrict], char *const envp[ __restrict]);(pid, path, file_actions, attrp, argv, envp)
+ posix_spawnp;int;(pid_t * __restrict pid, const char * __restrict path, const posix_spawn_file_actions_t *file_actions, const posix_spawnattr_t * __restrict attrp, char *const argv[ __restrict], char *const envp[ __restrict]);(pid, path, file_actions, attrp, argv, envp)
+ #endif
+@@ -232,7 +234,7 @@ facl;int;(int fd, int cmd, int cnt, void
+ #ifdef HAVE_FTS_READ
+ fts_read;FTSENT *;(FTS *ftsp);(ftsp)
+ #ifdef __APPLE__
+-#if MAC_OS_X_VERSION_MIN_REQUIRED >= MAC_OS_X_VERSION_10_5
++#if MAC_OS_X_VERSION_MIN_REQUIRED >= MAC_OS_X_VERSION_10_5 && !__DARWIN_ONLY_64_BIT_INO_T
+ fts_read$INODE64;FTSENT *;(FTS *ftsp);(ftsp)
+ #endif
+ #endif /* ifdef __APPLE__ */
+@@ -240,7 +242,7 @@ fts_read$INODE64;FTSENT *;(FTS *ftsp);(f
+ #ifdef HAVE_FTS_CHILDREN
+ fts_children;FTSENT *;(FTS *ftsp, int options);(ftsp, options)
+ #ifdef __APPLE__
+-#if MAC_OS_X_VERSION_MIN_REQUIRED >= MAC_OS_X_VERSION_10_5
++#if MAC_OS_X_VERSION_MIN_REQUIRED >= MAC_OS_X_VERSION_10_5 && !__DARWIN_ONLY_64_BIT_INO_T
+ fts_children$INODE64;FTSENT *;(FTS *ftsp, int options);(ftsp, options)
+ #endif
+ #endif /* ifdef __APPLE__ */
diff --git a/tools/findutils/Makefile b/tools/findutils/Makefile
index 37cd897355..d0d780689b 100644
--- a/tools/findutils/Makefile
+++ b/tools/findutils/Makefile
@@ -8,11 +8,11 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=findutils
 PKG_CPE_ID:=cpe:/a:gnu:findutils
-PKG_VERSION:=4.8.0
+PKG_VERSION:=4.9.0
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@GNU/$(PKG_NAME)
-PKG_HASH:=57127b7e97d91282c6ace556378d5455a9509898297e46e10443016ea1387164
+PKG_HASH:=a2bfb8c09d436770edc59f50fa483e785b161a3b7b9d547573cb08065fd462fe
 
 HOST_BUILD_PARALLEL:=1
 
diff --git a/tools/findutils/patches/010-endpwent.patch b/tools/findutils/patches/010-endpwent.patch
new file mode 100644
index 0000000000..dc346f3f76
--- /dev/null
+++ b/tools/findutils/patches/010-endpwent.patch
@@ -0,0 +1,20 @@
+--- a/find/parser.c
++++ b/find/parser.c
+@@ -67,12 +67,12 @@
+ #include "findutils-version.h"
+ #include "system.h"
+ 
+-
+-#ifndef HAVE_ENDGRENT
+-# define endgrent ()
++#if ! HAVE_ENDGRENT
++# define endgrent() ((void) 0)
+ #endif
+-#ifndef HAVE_ENDPWENT
+-# define endpwent ()
++
++#if ! HAVE_ENDPWENT
++# define endpwent() ((void) 0)
+ #endif
+ 
+ static bool parse_accesscheck   (const struct parser_table*, char *argv[], int *arg_ptr);
diff --git a/tools/mklibs/Makefile b/tools/mklibs/Makefile
index 7c9ffffbad..efa912bf6d 100644
--- a/tools/mklibs/Makefile
+++ b/tools/mklibs/Makefile
@@ -7,11 +7,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mklibs
-PKG_VERSION:=0.1.44
+PKG_VERSION:=0.1.45
 
 PKG_SOURCE:=$(PKG_NAME)_$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@DEBIAN/pool/main/m/mklibs/
-PKG_HASH:=3af0b6bd35e5b6fc58d8b68827fbae2ff6b7e20dd2b238ccb9b49d84722066c2
+PKG_HASH:=dd92a904b3942566f713fe536cd77dd1a5cfc62243c0e0bc6bb5d866e37422f3
 
 HOST_FIXUP:=autoreconf
 
diff --git a/tools/mklibs/patches/002-disable_symbol_checks.patch b/tools/mklibs/patches/002-disable_symbol_checks.patch
index e18dfa8e55..96ca7a5f83 100644
--- a/tools/mklibs/patches/002-disable_symbol_checks.patch
+++ b/tools/mklibs/patches/002-disable_symbol_checks.patch
@@ -5,7 +5,7 @@
          for name in unresolved:
              if not needed_symbols[name].weak:
 -                raise Exception("Unresolvable symbol %s" % name)
-+                print "WARNING: Unresolvable symbol %s" % name
++                print("WARNING: Unresolvable symbol %s" % name)
          break
  
      previous_pass_unresolved = unresolved
@@ -14,7 +14,7 @@
          if not name in symbol_provider:
              if not needed_symbols[name].weak:
 -                raise Exception("No library provides non-weak %s" % name)
-+                print "WARNING: Unresolvable symbol %s" % name
++                print("WARNING: Unresolvable symbol %s" % name)
          else:
              lib = symbol_provider[name]
              library_symbols_used[lib].add(library_symbols[lib][name])
diff --git a/tools/mklibs/patches/003-no_copy.patch b/tools/mklibs/patches/003-no_copy.patch
index 75beccf82e..bc1ae8d73d 100644
--- a/tools/mklibs/patches/003-no_copy.patch
+++ b/tools/mklibs/patches/003-no_copy.patch
@@ -32,11 +32,11 @@
 -                      dest_path + "/" + so_file_name + "-so",
 -                      dest_path + "/" + so_file_name + "-so-stripped")
              ## DEBUG
-             debug(DEBUG_VERBOSE, so_file, "\t", `os.stat(so_file)[ST_SIZE]`)
+             debug(DEBUG_VERBOSE, so_file, "\t", str(os.stat(so_file)[ST_SIZE]))
              debug(DEBUG_VERBOSE, dest_path + "/" + so_file_name + "-so", "\t",
-                   `os.stat(dest_path + "/" + so_file_name + "-so")[ST_SIZE]`)
+                   str(os.stat(dest_path + "/" + so_file_name + "-so")[ST_SIZE]))
 -            debug(DEBUG_VERBOSE, dest_path + "/" + so_file_name + "-so-stripped",
--                  "\t", `os.stat(dest_path + "/" + so_file_name + "-so-stripped")[ST_SIZE]`)
+-                  "\t", str(os.stat(dest_path + "/" + so_file_name + "-so-stripped")[ST_SIZE]))
  
  # Finalising libs and cleaning up
 -for lib in regexpfilter(os.listdir(dest_path), "(.*)-so-stripped$"):
diff --git a/tools/mklibs/patches/005-duplicate_syms.patch b/tools/mklibs/patches/005-duplicate_syms.patch
index b0fdab7b10..2627203fab 100644
--- a/tools/mklibs/patches/005-duplicate_syms.patch
+++ b/tools/mklibs/patches/005-duplicate_syms.patch
@@ -23,7 +23,7 @@
      for name in needed_symbols:
 -        if not name in symbol_provider:
 -            if not needed_symbols[name].weak:
--                print "WARNING: Unresolvable symbol %s" % name
+-                print("WARNING: Unresolvable symbol %s" % name)
 -        else:
 -            lib = symbol_provider[name]
 -            library_symbols_used[lib].add(library_symbols[lib][name])
diff --git a/tools/mklibs/patches/006-uclibc_init.patch b/tools/mklibs/patches/006-uclibc_init.patch
deleted file mode 100644
index da83340fe4..0000000000
--- a/tools/mklibs/patches/006-uclibc_init.patch
+++ /dev/null
@@ -1,14 +0,0 @@
---- a/src/mklibs
-+++ b/src/mklibs
-@@ -604,6 +604,11 @@ while 1:
-                 extra_post_obj.append(sysroot + libc_extras_dir + "/sofini.o")
-                 symbols.add(ProvidedSymbol('__dso_handle', None, None, True))
- 
-+            if soname in ("libc.so.0"):
-+                symbols.add(ProvidedSymbol('__uClibc_init', None, None, True))
-+                symbols.add(ProvidedSymbol('__uClibc_fini', None, None, True))
-+                extra_flags.append("-Wl,-init,__uClibc_init")
-+
-             map_file = find_pic_map(library)
-             if map_file:
-                 extra_flags.append("-Wl,--version-script=" + map_file)
diff --git a/tools/mklibs/patches/007-gc_sections.patch b/tools/mklibs/patches/007-gc_sections.patch
index 2fdf4034da..3d098ae426 100644
--- a/tools/mklibs/patches/007-gc_sections.patch
+++ b/tools/mklibs/patches/007-gc_sections.patch
@@ -1,6 +1,6 @@
 --- a/src/mklibs
 +++ b/src/mklibs
-@@ -616,7 +616,7 @@ while 1:
+@@ -611,7 +611,7 @@ while 1:
              # compile in only used symbols
              cmd = []
              cmd.extend(gcc_options)
diff --git a/tools/mklibs/patches/008-uclibc_libgcc_link.patch b/tools/mklibs/patches/008-uclibc_libgcc_link.patch
index 34cd9d3ab3..a221278d2a 100644
--- a/tools/mklibs/patches/008-uclibc_libgcc_link.patch
+++ b/tools/mklibs/patches/008-uclibc_libgcc_link.patch
@@ -22,7 +22,7 @@
  
              symbols.update(library_symbols_used[library])
  
-@@ -623,9 +621,10 @@ while 1:
+@@ -618,9 +616,10 @@ while 1:
              cmd.append(pic_file)
              cmd.extend(extra_post_obj)
              cmd.extend(extra_flags)
diff --git a/tools/mklibs/patches/009-uclibc_libpthread_symbols.patch b/tools/mklibs/patches/009-uclibc_libpthread_symbols.patch
deleted file mode 100644
index 0d4d3e95aa..0000000000
--- a/tools/mklibs/patches/009-uclibc_libpthread_symbols.patch
+++ /dev/null
@@ -1,63 +0,0 @@
---- a/src/mklibs
-+++ b/src/mklibs
-@@ -173,9 +173,10 @@ def undefined_symbols(obj):
-     return result
- 
- class ProvidedSymbol(Symbol):
--    def __init__(self, name, version, library, default_version):
-+    def __init__(self, name, version, library, default_version, weak):
-         super(ProvidedSymbol, self).__init__(name, version, library)
-         self.default_version = default_version
-+        self.weak = weak
- 
-     def base_names(self):
-         ret = []
-@@ -216,11 +217,15 @@ def provided_symbols(obj):
-         if version_string.lower() not in ('base', 'none'):
-             version = version_string
- 
-+        weak = False
-+        if weak_string.lower() == 'true':
-+            weak = True
-+
-         default_version = False
-         if default_version_string.lower() == 'true':
-             default_version = True
- 
--        result.append(ProvidedSymbol(name, version, library, default_version))
-+        result.append(ProvidedSymbol(name, version, library, default_version, weak))
- 
-     return result
-     
-@@ -509,6 +514,9 @@ while 1:
-             debug(DEBUG_SPAM, "present_symbols adding %s" % symbol)
-             names = symbol.base_names()
-             for name in names:
-+                if name in present_symbols:
-+                    if symbol.library != present_symbols[name].library:
-+                        needed_symbols[name] = UndefinedSymbol(name, True, symbol.version, symbol.library)
-                 present_symbols[name] = symbol
- 
-     # are we finished?
-@@ -600,12 +608,16 @@ while 1:
-                 # may segfault in ptmalloc_init due to undefined weak reference
-                 extra_pre_obj.append(sysroot + libc_extras_dir + "/soinit.o")
-                 extra_post_obj.append(sysroot + libc_extras_dir + "/sofini.o")
--                symbols.add(ProvidedSymbol('__dso_handle', None, None, True))
-+                symbols.add(ProvidedSymbol('__dso_handle', None, None, True, True))
- 
--            if soname in ("libc.so.0"):
--                symbols.add(ProvidedSymbol('__uClibc_init', None, None, True))
--                symbols.add(ProvidedSymbol('__uClibc_fini', None, None, True))
--                extra_flags.append("-Wl,-init,__uClibc_init")
-+            if soname == "libc.so.0":
-+                symbols.add(ProvidedSymbol('__uClibc_init', None, None, True, True))
-+                symbols.add(ProvidedSymbol('__uClibc_fini', None, None, True, True))
-+                extra_pre_obj.append("-Wl,-init,__uClibc_init")
-+
-+            if soname == "libpthread.so.0":
-+                symbols.add(ProvidedSymbol('__pthread_initialize_minimal_internal', None, None, True, True))
-+                extra_flags.append("-Wl,-z,nodelete,-z,initfirst,-init=__pthread_initialize_minimal_internal")
- 
-             map_file = find_pic_map(library)
-             if map_file:
diff --git a/tools/mklibs/patches/011-remove_multiarch.patch b/tools/mklibs/patches/011-remove_multiarch.patch
index 23e45cc12c..8c0bfdf1a0 100644
--- a/tools/mklibs/patches/011-remove_multiarch.patch
+++ b/tools/mklibs/patches/011-remove_multiarch.patch
@@ -1,6 +1,6 @@
 --- a/src/mklibs
 +++ b/src/mklibs
-@@ -274,6 +274,7 @@ def extract_soname(so_file):
+@@ -269,6 +269,7 @@ def extract_soname(so_file):
      return ""
  
  def multiarch(paths):
diff --git a/tools/mklibs/patches/100-apply-2to3.patch b/tools/mklibs/patches/100-apply-2to3.patch
index 9f2ae6c438..dcacbab205 100644
--- a/tools/mklibs/patches/100-apply-2to3.patch
+++ b/tools/mklibs/patches/100-apply-2to3.patch
@@ -1,10 +1,10 @@
 --- a/src/mklibs
 +++ b/src/mklibs
-@@ -57,18 +57,18 @@ debuglevel = DEBUG_NORMAL
+@@ -57,17 +57,17 @@ debuglevel = DEBUG_NORMAL
  
  def debug(level, *msg):
      if debuglevel >= level:
--        print string.join(msg)
+-        print(string.join(msg))
 +        print(' '.join(msg))
  
  # return a list of lines of output of the command
@@ -15,82 +15,22 @@
      output = pipe.read().strip()
      status = pipe.close() 
      if status is not None and os.WEXITSTATUS(status) != 0:
--        print "Command failed with status", os.WEXITSTATUS(status),  ":", \
--               command, string.join(args)
--	print "With output:", output
-+        print("Command failed with status", os.WEXITSTATUS(status),  ":", \
+         print("Command failed with status", os.WEXITSTATUS(status),  ":", \
+-               command, string.join(args))
 +               command, ' '.join(args))
-+        print("With output:", output)
+         print("With output:", output)
          sys.exit(1)
      return [i for i in output.split('\n') if i]
- 
-@@ -204,7 +204,7 @@ class ProvidedSymbol(Symbol):
- # Return a set of symbols provided by a library
- def provided_symbols(obj):
-     if not os.access(obj, os.F_OK):
--        raise Exception("Cannot find lib" + obj)
-+        raise Exception("Cannot find lib " + obj)
-     library = extract_soname(obj)
- 
-     output = command("mklibs-readelf", "--print-symbols-provided", obj)
-@@ -297,27 +297,27 @@ def usage(was_err):
-         outfd = sys.stderr
-     else:
-         outfd = sys.stdout
--    print >> outfd, "Usage: mklibs [OPTION]... -d DEST FILE ..."
--    print >> outfd, "Make a set of minimal libraries for FILE(s) in DEST."
--    print >> outfd, "" 
--    print >> outfd, "  -d, --dest-dir DIRECTORY     create libraries in DIRECTORY"
--    print >> outfd, "  -D, --no-default-lib         omit default libpath (", ':'.join(default_lib_path), ")"
--    print >> outfd, "  -L DIRECTORY[:DIRECTORY]...  add DIRECTORY(s) to the library search path"
--    print >> outfd, "  -l LIBRARY                   add LIBRARY always"
--    print >> outfd, "      --ldlib LDLIB            use LDLIB for the dynamic linker"
--    print >> outfd, "      --libc-extras-dir DIRECTORY  look for libc extra files in DIRECTORY"
--    print >> outfd, "      --target TARGET          prepend TARGET- to the gcc and binutils calls"
--    print >> outfd, "      --root ROOT              search in ROOT for library rpaths"
--    print >> outfd, "      --sysroot ROOT           prepend ROOT to all paths for libraries"
--    print >> outfd, "      --gcc-options OPTIONS    pass OPTIONS to gcc"
--    print >> outfd, "      --libdir DIR             use DIR (e.g. lib64) in place of lib in default paths"
--    print >> outfd, "  -v, --verbose                explain what is being done"
--    print >> outfd, "  -h, --help                   display this help and exit"
-+    print("Usage: mklibs [OPTION]... -d DEST FILE ...", file=outfd)
-+    print("Make a set of minimal libraries for FILE(s) in DEST.", file=outfd)
-+    print("", file=outfd) 
-+    print("  -d, --dest-dir DIRECTORY     create libraries in DIRECTORY", file=outfd)
+@@ -296,7 +296,7 @@ def usage(was_err):
+     print("Make a set of minimal libraries for FILE(s, file=outfd) in DEST.", file=outfd)
+     print("" , file=outfd)
+     print("  -d, --dest-dir DIRECTORY     create libraries in DIRECTORY", file=outfd)
+-    print("  -D, --no-default-lib         omit default libpath (", ':'.join(default_lib_path, file=outfd), ", file=outfd)", file=outfd)
 +    print("  -D, --no-default-lib         omit default libpath (", ':'.join(default_lib_path), ")", file=outfd)
-+    print("  -L DIRECTORY[:DIRECTORY]...  add DIRECTORY(s) to the library search path", file=outfd)
-+    print("  -l LIBRARY                   add LIBRARY always", file=outfd)
-+    print("      --ldlib LDLIB            use LDLIB for the dynamic linker", file=outfd)
-+    print("      --libc-extras-dir DIRECTORY  look for libc extra files in DIRECTORY", file=outfd)
-+    print("      --target TARGET          prepend TARGET- to the gcc and binutils calls", file=outfd)
-+    print("      --root ROOT              search in ROOT for library rpaths", file=outfd)
-+    print("      --sysroot ROOT           prepend ROOT to all paths for libraries", file=outfd)
-+    print("      --gcc-options OPTIONS    pass OPTIONS to gcc", file=outfd)
-+    print("      --libdir DIR             use DIR (e.g. lib64) in place of lib in default paths", file=outfd)
-+    print("  -v, --verbose                explain what is being done", file=outfd)
-+    print("  -h, --help                   display this help and exit", file=outfd)
-     sys.exit(was_err)
- 
- def version(vers):
--    print "mklibs: version ",vers
--    print ""
-+    print("mklibs: version ",vers)
-+    print("")
- 
- #################### main ####################
- ## Usage: ./mklibs.py [OPTION]... -d DEST FILE ...
-@@ -368,8 +368,8 @@ script_pattern = re.compile("^#!\s*/")
- 
- try:
-     optlist, proglist = getopt.getopt(sys.argv[1:], opts, longopts)
--except getopt.GetoptError, msg:
--    print >> sys.stderr, msg
-+except getopt.GetoptError as msg:
-+    print(msg, file=sys.stderr)
-     usage(1)
- 
- for opt, arg in optlist:
-@@ -377,7 +377,7 @@ for opt, arg in optlist:
+     print("  -L DIRECTORY[:DIRECTORY]...  add DIRECTORY(s, file=outfd) to the library search path", file=outfd)
+     print("  -l LIBRARY                   add LIBRARY always", file=outfd)
+     print("      --ldlib LDLIB            use LDLIB for the dynamic linker", file=outfd)
+@@ -372,7 +372,7 @@ for opt, arg in optlist:
          if debuglevel < DEBUG_SPAM:
              debuglevel = debuglevel + 1
      elif opt == "-L":
@@ -99,7 +39,7 @@
      elif opt in ("-d", "--dest-dir"):
          dest_path = arg
      elif opt in ("-D", "--no-default-lib"):
-@@ -396,17 +396,17 @@ for opt, arg in optlist:
+@@ -391,7 +391,7 @@ for opt, arg in optlist:
      elif opt in ("-l",):
          force_libs.append(arg)
      elif opt == "--gcc-options":
@@ -108,19 +48,7 @@
      elif opt == "--libdir":
          libdir = arg
      elif opt in ("--help", "-h"):
--	usage(0)
-+        usage(0)
-         sys.exit(0)
-     elif opt in ("--version", "-V"):
-         version(vers)
-         sys.exit(0)
-     else:
--        print "WARNING: unknown option: " + opt + "\targ: " + arg
-+        print("WARNING: unknown option: " + opt + "\targ: " + arg)
- 
- if include_default_lib_path == "yes":
-     lib_path.extend([a.replace("/lib/", "/" + libdir + "/") for a in default_lib_path])
-@@ -424,22 +424,22 @@ if ldlib == "LDLIB":
+@@ -419,17 +419,17 @@ if ldlib == "LDLIB":
  objects = {}  # map from inode to filename
  for prog in proglist:
      inode = os.stat(prog)[ST_INO]
@@ -141,45 +69,20 @@
          output = command("mklibs-readelf", "--print-interp", obj)
          if output:
              ldlib = output.pop()
--	if ldlib:
--	    break
-+        if ldlib:
-+            break
- 
- if not ldlib:
-     sys.exit("E: Dynamic linker not found, aborting.")
-@@ -454,10 +454,10 @@ for obj in sorted(objects.values()):
-             for rpath_elem in rpath_val:
-                 if not rpath_elem in lib_rpath:
-                     if debuglevel >= DEBUG_VERBOSE:
--                        print "Adding rpath " + rpath_elem + " for " + obj
-+                        print("Adding rpath " + rpath_elem + " for " + obj)
-                     lib_rpath.append(rpath_elem)
-         else:
--            print "warning: " + obj + " may need rpath, but --root not specified"
-+            print("warning: " + obj + " may need rpath, but --root not specified")
- 
- lib_path.extend(lib_rpath)
- 
-@@ -465,12 +465,12 @@ passnr = 1
- available_libs = []
- previous_pass_unresolved = set()
+@@ -462,9 +462,9 @@ previous_pass_unresolved = set()
  while 1:
--    debug(DEBUG_NORMAL, "I: library reduction pass", `passnr`)
-+    debug(DEBUG_NORMAL, "I: library reduction pass", repr(passnr))
+     debug(DEBUG_NORMAL, "I: library reduction pass", str(passnr))
      if debuglevel >= DEBUG_VERBOSE:
--        print "Objects:",
+-        print("Objects:",)
 -        for obj in sorted([x[string.rfind(x, '/') + 1:] for x in objects.values()]):
--            print obj,
--        print
+-            print(obj,)
 +        print("Objects:", end=' ')
 +        for obj in sorted([x[x.rfind('/') + 1:] for x in list(objects.values())]):
 +            print(obj, end=' ')
-+        print()
+         print()
  
      passnr = passnr + 1
-     # Gather all already reduced libraries and treat them as objects as well
-@@ -479,7 +479,7 @@ while 1:
+@@ -474,7 +474,7 @@ while 1:
          obj = dest_path + "/" + lib
          small_libs.append(obj)
          inode = os.stat(obj)[ST_INO]
@@ -188,7 +91,7 @@
              debug(DEBUG_SPAM, obj, "is hardlink to", objects[inode])
          else:
              objects[inode] = obj
-@@ -509,7 +509,7 @@ while 1:
+@@ -504,7 +504,7 @@ while 1:
      present_symbols = {}
      checked_libs = small_libs
      checked_libs.extend(available_libs)
@@ -197,70 +100,8 @@
      for lib in checked_libs:
          for symbol in provided_symbols(lib):
              debug(DEBUG_SPAM, "present_symbols adding %s" % symbol)
-@@ -529,8 +529,8 @@ while 1:
-             unresolved.add(name)
-             num_unresolved = num_unresolved + 1
- 
--    debug (DEBUG_NORMAL, `len(needed_symbols)`, "symbols,",
--           `num_unresolved`, "unresolved")
-+    debug (DEBUG_NORMAL, repr(len(needed_symbols)), "symbols,",
-+           repr(num_unresolved), "unresolved")
- 
-     if num_unresolved == 0:
-         break
-@@ -539,7 +539,7 @@ while 1:
-         # No progress in last pass. Verify all remaining symbols are weak.
-         for name in unresolved:
-             if not needed_symbols[name].weak:
--                print "WARNING: Unresolvable symbol %s" % name
-+                print("WARNING: Unresolvable symbol %s" % name)
-         break
- 
-     previous_pass_unresolved = unresolved
-@@ -641,9 +641,9 @@ while 1:
-             command(target + "gcc", *cmd)
- 
-             ## DEBUG
--            debug(DEBUG_VERBOSE, so_file, "\t", `os.stat(so_file)[ST_SIZE]`)
-+            debug(DEBUG_VERBOSE, so_file, "\t", repr(os.stat(so_file)[ST_SIZE]))
-             debug(DEBUG_VERBOSE, dest_path + "/" + so_file_name + "-so", "\t",
--                  `os.stat(dest_path + "/" + so_file_name + "-so")[ST_SIZE]`)
-+                  repr(os.stat(dest_path + "/" + so_file_name + "-so")[ST_SIZE]))
- 
- # Finalising libs and cleaning up
- for lib in regexpfilter(os.listdir(dest_path), "(.*)-so$"):
-@@ -680,4 +680,4 @@ if not os.access(dest_path + "/" + ld_fu
-     command(target + "objcopy", "--strip-unneeded -R .note -R .comment",
-             ld_file, dest_path + "/" + ld_full_path)
- 
--os.chmod(dest_path + "/" + ld_full_path, 0755)
-+os.chmod(dest_path + "/" + ld_full_path, 0o755)
 --- a/src/mklibs-copy
 +++ b/src/mklibs-copy
-@@ -51,9 +51,9 @@ def command(command, *args):
-     output = pipe.read().strip()
-     status = pipe.close()
-     if status is not None and os.WEXITSTATUS(status) != 0:
--        print "Command failed with status", os.WEXITSTATUS(status),  ":", \
--               command, ' '.join(args)
--	print "With output:", output
-+        print("Command failed with status", os.WEXITSTATUS(status),  ":", \
-+               command, ' '.join(args))
-+        print("With output:", output)
-         sys.exit(1)
-     return output.split('\n')
- 
-@@ -134,8 +134,8 @@ def multiarch(paths):
-         return paths
- 
- def version(vers):
--    print "mklibs: version ",vers
--    print ""
-+    print("mklibs: version ",vers)
-+    print("")
- 
- # Clean the environment
- vers="0.12"
 @@ -159,7 +159,7 @@ if include_default_lib_path:
  objects = {}  # map from inode to filename
  for prog in proglist:
@@ -270,23 +111,15 @@
          logger.debug("%s is a hardlink to %s", prog, objects[inode])
      elif so_pattern.match(prog):
          logger.debug("%s is a library", prog)
-@@ -169,12 +169,12 @@ for prog in proglist:
+@@ -169,7 +169,7 @@ for prog in proglist:
          logger.debug("%s is no ELF", prog)
  
  if not ldlib:
 -    for obj in objects.values():
 +    for obj in list(objects.values()):
          output = command("mklibs-readelf", "-i", obj)
--	for x in output:
-+        for x in output:
-             ldlib = x
--	if ldlib:
--	    break
-+        if ldlib:
-+            break
- 
- if not ldlib:
-     sys.exit("E: Dynamic linker not found, aborting.")
+         for x in output:
+                 ldlib = x
 @@ -182,7 +182,7 @@ if not ldlib:
  logger.info('Using %s as dynamic linker', ldlib)
  
@@ -319,9 +152,3 @@
          libraries.update(library_depends(obj))
  
      if libraries == previous_pass_libraries:
-@@ -272,4 +272,4 @@ if not os.access(dest_path + "/" + ld_fu
-     command(target + "objcopy", "--strip-unneeded -R .note -R .comment",
-             ld_file, dest_path + "/" + ld_full_path)
- 
--os.chmod(dest_path + "/" + ld_full_path, 0755)
-+os.chmod(dest_path + "/" + ld_full_path, 0o755)
diff --git a/tools/mtools/Makefile b/tools/mtools/Makefile
index 5e3c950ba3..c10e887b36 100644
--- a/tools/mtools/Makefile
+++ b/tools/mtools/Makefile
@@ -7,11 +7,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mtools
-PKG_VERSION:=4.0.35
+PKG_VERSION:=4.0.37
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=@GNU/$(PKG_NAME)
-PKG_HASH:=34769e173751d2f0d891a08c76c80427e929b8ee43438019b8666cc3d7a44749
+PKG_HASH:=799b197e23e47b61259628810b27790efb7a1fe36037ef1da8a27b0ae4fa8342
 
 HOST_BUILD_PARALLEL:=1
 
diff --git a/tools/zstd/Makefile b/tools/zstd/Makefile
index b93a5d2b52..93f6745976 100644
--- a/tools/zstd/Makefile
+++ b/tools/zstd/Makefile
@@ -1,25 +1,35 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=zstd
-PKG_VERSION:=1.5.0
+PKG_VERSION:=1.5.2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/facebook/zstd/releases/download/v$(PKG_VERSION)
-PKG_HASH:=5194fbfa781fcf45b98c5e849651aa7b3b0a008c6b72d4a0db760f3002291e94
+PKG_HASH:=7c42d56fac126929a6a85dbc73ff1db2411d04f104fae9bdea51305663a83fd0
 
 PKG_LICENSE:=BSD-3-Clause
 PKG_LICENSE_FILES:=LICENSE
 PKG_CPE_ID:=cpe:/a:facebook:zstandard
 
-CMAKE_SOURCE_SUBDIR:=build/cmake
-
 include $(INCLUDE_DIR)/host-build.mk
-include $(INCLUDE_DIR)/cmake.mk
+include $(INCLUDE_DIR)/meson.mk
 
-CMAKE_HOST_OPTIONS += \
-	-DBUILD_TESTING=OFF \
-	-DCMAKE_C_COMPILER_LAUNCHER="" \
-	-DCMAKE_C_COMPILER=$(HOSTCC_NOCACHE) \
-	-DZSTD_LEGACY_SUPPORT=OFF
+MESON_HOST_BUILD_DIR:=$(HOST_BUILD_DIR)/build/meson/openwrt-build
+
+HOSTCC:= $(HOSTCC_NOCACHE)
+HOST_LDFLAGS += -Wl,-rpath,$(STAGING_DIR_HOST)/lib
+
+MESON_HOST_ARGS += \
+	-Dlegacy_level=7 \
+	-Ddebug_level=0 \
+	-Dbacktrace=false \
+	-Dstatic_runtime=false \
+	-Dbin_programs=true \
+	-Dbin_tests=false \
+	-Dbin_contrib=false \
+	-Dmulti_thread=enabled \
+	-Dzlib=disabled \
+	-Dlzma=disabled \
+	-Dlz4=disabled
 
 $(eval $(call HostBuild))