diff --git a/package/lean/nft-qos/Makefile b/package/lean/nft-qos/Makefile
index 78e0ec2b95..996f8bed39 100644
--- a/package/lean/nft-qos/Makefile
+++ b/package/lean/nft-qos/Makefile
@@ -21,7 +21,7 @@ include $(INCLUDE_DIR)/package.mk
 define Package/nft-qos
   SECTION:=utils
   CATEGORY:=Base system
-  DEPENDS:=+nftables +kmod-nft-netdev +kmod-nft-bridge
+  DEPENDS:=+nftables-nojson +kmod-nft-netdev +kmod-nft-bridge
   TITLE:=QoS scripts over nftables
   PKGARCH:=all
 endef
diff --git a/package/libs/jansson/Makefile b/package/libs/jansson/Makefile
index 30278ca02e..5799a362dd 100644
--- a/package/libs/jansson/Makefile
+++ b/package/libs/jansson/Makefile
@@ -8,14 +8,14 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=jansson
-PKG_VERSION:=2.12
-PKG_RELEASE:=1
+PKG_VERSION:=2.13.1
+PKG_RELEASE:=2
 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=http://www.digip.org/jansson/releases/
-PKG_HASH:=645d72cc5dbebd4df608d33988e55aa42a7661039e19a379fcbe5c79d1aee1d2
+PKG_HASH:=ee90a0f879d2b7b7159124ff22b937a2a9a8c36d3bb65d1da7dd3f04370a10bd
 
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/cmake.mk
@@ -32,12 +32,16 @@ define Package/jansson
   CATEGORY:=Libraries
   TITLE:=Jansson library
   URL:=http://www.digip.org/jansson/
+  ABI_VERSION:=4
 endef
 
 define Package/jansson/description
   Jansson is a C library for encoding, decoding and manipulating JSON data
 endef
 
+TARGET_CFLAGS += -flto
+TARGET_LDFLAGS += -flto
+
 define Package/jansson/install
 	$(INSTALL_DIR) $(1)/usr/lib
 	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libjansson*so* $(1)/usr/lib/
diff --git a/package/libs/libnftnl/Makefile b/package/libs/libnftnl/Makefile
index 74771fe678..c56fb068ce 100644
--- a/package/libs/libnftnl/Makefile
+++ b/package/libs/libnftnl/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libnftnl
-PKG_VERSION:=1.1.5
-PKG_RELEASE:=1
+PKG_VERSION:=1.1.7
+PKG_RELEASE:=2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=https://netfilter.org/projects/$(PKG_NAME)/files
-PKG_HASH:=66de4d05227c0a1a731c369b193010d18a05b1185c2735211e0ecf658eeb14f3
+PKG_HASH:=20dbc13f11004aea2c9e479cfb90359cb11fe3446c3140811c18e4ec1648ed8f
 PKG_MAINTAINER:=Steven Barth <steven@midlink.org>
 PKG_LICENSE:=GPL-2.0+
 
@@ -39,7 +39,8 @@ define Package/libnftnl/description
  programming interface (API) to the in-kernel nf_tables subsystem.
 endef
 
-TARGET_CFLAGS += $(FPIC)
+TARGET_CFLAGS += $(FPIC) -flto
+TARGET_LDFLAGS += -flto
 
 CONFIGURE_ARGS += \
 	--enable-static \
diff --git a/package/libs/wolfssl/Makefile b/package/libs/wolfssl/Makefile
index 1fcca9fc5f..dc8ca2b262 100644
--- a/package/libs/wolfssl/Makefile
+++ b/package/libs/wolfssl/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=wolfssl
 PKG_VERSION:=4.5.0-stable
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/wolfSSL/wolfssl/archive/v$(PKG_VERSION)
@@ -56,7 +56,8 @@ define Package/libwolfssl/config
 	source "$(SOURCE)/Config.in"
 endef
 
-TARGET_CFLAGS += $(FPIC) -DFP_MAX_BITS=8192 -fomit-frame-pointer
+TARGET_CFLAGS += $(FPIC) -DFP_MAX_BITS=8192 -fomit-frame-pointer -flto
+TARGET_LDFLAGS += -flto
 
 # --enable-stunnel needed for OpenSSL API compatibility bits
 CONFIGURE_ARGS += \
diff --git a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/server/api/v2ray.lua b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/server/api/v2ray.lua
index fa149de89d..924512ebfc 100644
--- a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/server/api/v2ray.lua
+++ b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/server/api/v2ray.lua
@@ -45,7 +45,7 @@ function gen_config(user)
         }
     elseif user.protocol == "shadowsocks" then
         settings = {
-            method = user.v_ss_encrypt_method,
+            method = user.method,
             password = user.password,
             level = tonumber(user.level) or 1,
             network = user.ss_network or "TCP,UDP",
diff --git a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/server/user.lua b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/server/user.lua
index 1b29fc9471..50aa25f275 100644
--- a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/server/user.lua
+++ b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/server/user.lua
@@ -113,7 +113,7 @@ username = s:option(Value, "username", translate("Username"))
 username:depends("protocol", "http")
 username:depends("protocol", "socks")
 
-password = s:option(Value, "password", translate("Password"))
+password = s:option(Value, "password", translate("Password"), translate("The MTProto protocol must be 32 characters and can only contain characters from 0 to 9 and a to f."))
 password.password = true
 password:depends("type", "SSR")
 password:depends("type", "Brook")
@@ -404,15 +404,14 @@ quic_guise:depends("transport", "quic")
 fallback = s:option(Flag, "fallback", translate("Fallback"))
 fallback:depends({ type = "V2ray", protocol = "vless", transport = "tcp", stream_security = "tls" })
 
-fallback_addr = s:option(Value, "fallback_addr", "Fallback" .. translate("Address (Support Domain Name)"))
-fallback_addr:depends("fallback", "1")
+fallback_alpn = s:option(Value, "fallback_alpn", "Fallback alpn")
+fallback_alpn:depends("fallback", "1")
 
-fallback_port = s:option(Value, "fallback_port", "Fallback" .. translate("Port"))
-fallback_port.datatype = "port"
-fallback_port:depends("fallback", "1")
+fallback_path = s:option(Value, "fallback_path", "Fallback path")
+fallback_path:depends("fallback", "1")
 
-fallback_unix = s:option(Value, "fallback_unix", "Fallback UNIX domain socket", translate("UNIX domain socket, absolute path, you can add @ at the beginning to represent abstract, and it is empty by default. If this value is filled in, addr and port will be ignored."))
-fallback_unix:depends("fallback", "1")
+fallback_dest = s:option(Value, "fallback_dest", "Fallback dest")
+fallback_dest:depends("fallback", "1")
 
 fallback_xver = s:option(Value, "fallback_xver", "Fallback xver")
 fallback_xver.default = 0
diff --git a/package/lienol/luci-app-passwall/po/zh-cn/passwall.po b/package/lienol/luci-app-passwall/po/zh-cn/passwall.po
index d5d4cf007f..ccccdbb0ef 100644
--- a/package/lienol/luci-app-passwall/po/zh-cn/passwall.po
+++ b/package/lienol/luci-app-passwall/po/zh-cn/passwall.po
@@ -949,9 +949,6 @@ msgstr "<br />none：默认值，不进行伪装，发送的数据是没有特
 msgid "A legal file path. This file must not exist before running V2Ray."
 msgstr "一个合法的文件路径。在运行 V2Ray 之前，这个文件必须不存在。"
 
-msgid "UNIX domain socket, absolute path, you can add @ at the beginning to represent abstract, and it is empty by default. If this value is filled in, addr and port will be ignored."
-msgstr "UNIX domain socket，绝对路径，可在开头加 @ 代表 abstract，默认为空。若填写了该值，addr 和 port 将被忽略。"
-
 msgid "TCP Open Socks"
 msgstr "开启Socks"
 
@@ -997,6 +994,9 @@ msgstr "隐藏菜单方法，地址栏输入例："
 msgid "After the hidden to the display, input example in the address bar:"
 msgstr "当你隐藏后想再次显示，地址栏输入例："
 
+msgid "The MTProto protocol must be 32 characters and can only contain characters from 0 to 9 and a to f."
+msgstr "MTProto 协议必须为 32 个字符，仅可包含 0 到 9 和 a 到 f 之间的字符。"
+
 msgid "When OTA is enabled, a connection that is not OTA enabled is rejected. This option is invalid when using AEAD encryption."
 msgstr "开启 OTA 后，将拒绝未启用 OTA 的连接。当使用 AEAD 加密时，该选项无效。"
 
diff --git a/package/network/services/dropbear/Config.in b/package/network/services/dropbear/Config.in
index 108b80376b..6aa5a7e4e1 100644
--- a/package/network/services/dropbear/Config.in
+++ b/package/network/services/dropbear/Config.in
@@ -51,7 +51,7 @@ config DROPBEAR_ECC_FULL
 
 config DROPBEAR_ED25519
 	bool "Ed25519 support"
-	default n
+	default y if !SMALL_FLASH
 	help
 		This enables the following public key algorithm:
 		  ssh-ed25519
diff --git a/package/network/services/dropbear/Makefile b/package/network/services/dropbear/Makefile
index 1cda98bf7e..6c97d3e77b 100644
--- a/package/network/services/dropbear/Makefile
+++ b/package/network/services/dropbear/Makefile
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2006-2016 OpenWrt.org
+# Copyright (C) 2006-2020 OpenWrt.org
 #
 # This is free software, licensed under the GNU General Public License v2.
 # See /LICENSE for more information.
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dropbear
 PKG_VERSION:=2020.80
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:= \
@@ -25,6 +25,7 @@ PKG_BUILD_PARALLEL:=1
 PKG_ASLR_PIE_REGULAR:=1
 PKG_USE_MIPS16:=0
 PKG_FIXUP:=autoreconf
+PKG_FLAGS:=nonshared
 
 PKG_CONFIG_DEPENDS:= \
 	CONFIG_TARGET_INIT_PATH CONFIG_DROPBEAR_ECC CONFIG_DROPBEAR_ECC_FULL \
diff --git a/package/network/utils/nftables/Makefile b/package/network/utils/nftables/Makefile
index 3c9c827a99..7830596e84 100644
--- a/package/network/utils/nftables/Makefile
+++ b/package/network/utils/nftables/Makefile
@@ -7,13 +7,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=nftables
-PKG_VERSION:=0.9.3
-PKG_RELEASE:=1
+PKG_VERSION:=0.9.6
+PKG_RELEASE:=2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=https://netfilter.org/projects/$(PKG_NAME)/files
-PKG_HASH:=956b915ce2a7aeaff123e49006be7a0690a0964e96c062703181a36e2e5edb78
-PKG_MAINTAINER:=Steven Barth <steven@midlink.org>
+PKG_HASH:=68d6fdfe8ab02303e6b1f13968a4022da5b0120110eaee3233d806857937b66e
+PKG_MAINTAINER:=
 PKG_LICENSE:=GPL-2.0
 
 PKG_FIXUP:=autoreconf
@@ -28,33 +28,48 @@ CONFIGURE_ARGS += \
         --disable-man-doc \
         --with-mini-gmp \
         --without-cli \
-        --disable-python \
+        --disable-python
 
-define Package/nftables
+define Package/nftables/Default
   SECTION:=net
   CATEGORY:=Network
   SUBMENU:=Firewall
-  TITLE:=nftables packet filtering userspace utility
-  DEPENDS:=+kmod-nft-core +libnftnl +PACKAGE_NFT_WITH_JSON:jansson
+  TITLE:=nftables userspace utility
+  DEPENDS:=+kmod-nft-core +libnftnl
   URL:=http://netfilter.org/projects/nftables/
+  PROVIDES:=nftables
 endef
 
-define Package/nftables/config
-	config PACKAGE_NFT_WITH_JSON
-		bool "Build nftables with json support"
-		depends on PACKAGE_nftables
-		default n
+define Package/nftables-nojson
+  $(Package/nftables/Default)
+  TITLE+= no JSON support
+  VARIANT:=nojson
+  DEFAULT_VARIANT:=1
 endef
 
-ifeq ($(CONFIG_PACKAGE_NFT_WITH_JSON),y)
-CONFIGURE_ARGS += --with-json
+define Package/nftables-json
+  $(Package/nftables/Default)
+  TITLE+= with JSON support
+  VARIANT:=json
+  DEPENDS+=+jansson
+endef
+
+ifeq ($(BUILD_VARIANT),json)
+  CONFIGURE_ARGS += --with-json
 endif
 
-define Package/nftables/install
+TARGET_CFLAGS += -flto
+TARGET_LDFLAGS += -flto
+
+define Package/nftables/install/Default
 	$(INSTALL_DIR) $(1)/usr/sbin
 	$(CP) $(PKG_INSTALL_DIR)/usr/sbin/nft $(1)/usr/sbin/
 	$(INSTALL_DIR) $(1)/usr/lib
 	$(CP) $(PKG_INSTALL_DIR)/usr/lib/*.so* $(1)/usr/lib/
 endef
 
-$(eval $(call BuildPackage,nftables))
+Package/nftables-nojson/install = $(Package/nftables/install/Default)
+Package/nftables-json/install = $(Package/nftables/install/Default)
+
+$(eval $(call BuildPackage,nftables-nojson))
+$(eval $(call BuildPackage,nftables-json))
diff --git a/package/utils/util-linux/Makefile b/package/utils/util-linux/Makefile
index 0fc9819c58..05ceaa413e 100644
--- a/package/utils/util-linux/Makefile
+++ b/package/utils/util-linux/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=util-linux
 PKG_VERSION:=2.36
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@KERNEL/linux/utils/$(PKG_NAME)/v2.36
@@ -526,6 +526,7 @@ CONFIGURE_ARGS += \
 	--without-python		\
 	--without-udev			\
 	--without-readline		\
+	--without-libmagic		\
 	--with-ncursesw
 
 TARGET_CFLAGS += $(FPIC) -std=gnu99