OpenWrt XSS, NixOS policy fights, packaging moves

OpenWrt and NixOS forums led the day with a stored XSS finding in a new LuCI theme and heated debates over LLM-generated contributions and packaging politics. Several technical items also advanced policy routing, flake aggregation, device support, and an ffmpeg ABI change in Fedora.

Stored XSS in proposed Footstrap LuCI theme

A new LuCI theme called Footstrap, presented as twice as fast as bootstrap, generated a long OpenWrt forum thread. The discussion revealed a stored unauthenticated SVG XSS issue through wallpaper upload served as image/svg+xml. Router administrators and theme authors should treat the finding as a reminder that web UI assets need careful content-type and sanitization handling.

NixOS debate on banning LLM-generated PR text

NixOS contributors debated an explicit ban on LLM-generated pull request descriptions and commits. Participants cited the spirit of existing policy and concerns about extractive quality. The thread reflects pressure on review norms as automated text enters the contribution workflow.

Shunt policy routing package merges to OpenWrt

The resolver-agnostic policy routing package shunt was merged into OpenWrt master after forum discussion. It supplies policy based routing that does not depend on which DNS backend is running. OpenWrt users who mix resolvers gain a cleaner way to express routing policy on master.

Omniflake aggregates twelve thousand flakes

Omniflake aggregates twelve thousand GitHub flakes behind a single input. Early users reported large lockfile reductions and fewer rate-limit issues. Nix flake consumers that pull many third-party inputs may find the consolidation useful for simpler locks.

OpenWrt completes Armor G5 hardware support

Pull request 24881 adds LED, fan, Bluetooth, and sensor support for the Zyxel NBG7815, finishing the Armor G5 port. The work brings remaining device features under OpenWrt. Owners of that hardware gain fuller coverage once the changes land.

Omarchy packaging thread turns political

A NixOS discourse thread on Omarchy packaging shifted into accusations over DHH politics and calls for exclusion. Technical packaging questions mixed with broader community tensions. Readers tracking project culture will note the temperature of the exchange.

Fedora Rawhide plans ffmpeg 9.0 SONAME bump

A Fedora maintainer announced an ffmpeg upgrade from 8.1 to 9.0 in Rawhide with a SONAME bump. Side-tag rebuilds are planned after Firefox 155. Maintainers of dependent packages on Rawhide should prepare for the ABI transition.

Prefer nixos.org tarballs for flake inputs

A NixOS discourse thread urged switching flake inputs to official nixos.org channel tarballs for size and independence benefits, and referenced a related pull request. The advice aims to shrink input footprints and reduce reliance on other hosts. Flake authors may want to evaluate the change for their lockfiles.