diff --git a/package/base-files/Makefile b/package/base-files/Makefile
index 602251a79b..f589d8d839 100644
--- a/package/base-files/Makefile
+++ b/package/base-files/Makefile
@@ -12,7 +12,7 @@ include $(INCLUDE_DIR)/version.mk
 include $(INCLUDE_DIR)/feeds.mk
 
 PKG_NAME:=base-files
-PKG_RELEASE:=216
+PKG_RELEASE:=217
 PKG_FLAGS:=nonshared
 
 PKG_FILE_DEPENDS:=$(PLATFORM_DIR)/ $(GENERIC_PLATFORM_DIR)/base-files/
diff --git a/package/base-files/files/sbin/sysupgrade b/package/base-files/files/sbin/sysupgrade
index dc51826100..8b9c9bedb1 100755
--- a/package/base-files/files/sbin/sysupgrade
+++ b/package/base-files/files/sbin/sysupgrade
@@ -130,12 +130,19 @@ list_changed_conffiles() {
 	done
 }
 
+list_static_conffiles() {
+	local filter=$1
+
+	find $(sed -ne '/^[[:space:]]*$/d; /^#/d; p' \
+		/etc/sysupgrade.conf /lib/upgrade/keep.d/* 2>/dev/null) \
+		\( -type f -o -type l \) $filter 2>/dev/null
+}
+
 add_conffiles() {
 	local file="$1"
-	( find $(sed -ne '/^[[:space:]]*$/d; /^#/d; p' \
-		/etc/sysupgrade.conf /lib/upgrade/keep.d/* 2>/dev/null) \
-		\( -type f -o -type l \) $find_filter 2>/dev/null;
-	  list_changed_conffiles ) | sort -u > "$file"
+
+	( list_static_conffiles "$find_filter"; list_changed_conffiles ) |
+		sort -u > "$file"
 	return 0
 }
 
@@ -153,9 +160,7 @@ add_overlayfiles() {
 
 		# backup files from /etc/sysupgrade.conf and /lib/upgrade/keep.d, but
 		# ignore those aready controlled by opkg conffiles
-		find $(sed -ne '/^[[:space:]]*$/d; /^#/d; p' \
-			/etc/sysupgrade.conf /lib/upgrade/keep.d/* 2>/dev/null) \
-			\( -type f -o -type l \) 2>/dev/null | sort -u |
+		list_static_conffiles | sort -u |
 			grep -h -v -x -F -f $conffiles > "$keepfiles"
 
 		# backup conffiles, but only those changed if '-u'
diff --git a/package/kernel/linux/files/sysctl-br-netfilter.conf b/package/kernel/linux/files/sysctl-br-netfilter.conf
index 22c24a4bfe..b10ddc0874 100644
--- a/package/kernel/linux/files/sysctl-br-netfilter.conf
+++ b/package/kernel/linux/files/sysctl-br-netfilter.conf
@@ -2,6 +2,6 @@
 # /etc/sysctl.conf can be used to customize sysctl settings
 
 # disable bridge firewalling by default
-net.bridge.bridge-nf-call-arptables=1
-net.bridge.bridge-nf-call-ip6tables=1
-net.bridge.bridge-nf-call-iptables=1
+net.bridge.bridge-nf-call-arptables=0
+net.bridge.bridge-nf-call-ip6tables=0
+net.bridge.bridge-nf-call-iptables=0
diff --git a/package/lean/luci-app-ssr-plus/Makefile b/package/lean/luci-app-ssr-plus/Makefile
index 2718d6b7df..c3179c29e5 100644
--- a/package/lean/luci-app-ssr-plus/Makefile
+++ b/package/lean/luci-app-ssr-plus/Makefile
@@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-ssr-plus
 PKG_VERSION:=182
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 define Package/$(PKG_NAME)/conffiles
 /etc/config/shadowsocksr
diff --git a/package/lean/luci-app-ssr-plus/luasrc/controller/shadowsocksr.lua b/package/lean/luci-app-ssr-plus/luasrc/controller/shadowsocksr.lua
index 09c63309c6..2fe43138a8 100644
--- a/package/lean/luci-app-ssr-plus/luasrc/controller/shadowsocksr.lua
+++ b/package/lean/luci-app-ssr-plus/luasrc/controller/shadowsocksr.lua
@@ -4,7 +4,7 @@ module("luci.controller.shadowsocksr", package.seeall)
 
 function index()
 	if not nixio.fs.access("/etc/config/shadowsocksr") then
-		return
+		call("act_reset")
 	end
 	entry({"admin", "services", "shadowsocksr"}, alias("admin", "services", "shadowsocksr", "client"), _("ShadowSocksR Plus+"), 10).dependent = true
 	entry({"admin", "services", "shadowsocksr", "client"}, cbi("shadowsocksr/client"), _("SSR Client"), 10).leaf = true
diff --git a/package/lean/luci-app-ssr-plus/luasrc/view/shadowsocksr/ssrurl.htm b/package/lean/luci-app-ssr-plus/luasrc/view/shadowsocksr/ssrurl.htm
index 84d150481a..123aa2ca4c 100644
--- a/package/lean/luci-app-ssr-plus/luasrc/view/shadowsocksr/ssrurl.htm
+++ b/package/lean/luci-app-ssr-plus/luasrc/view/shadowsocksr/ssrurl.htm
@@ -218,7 +218,7 @@ function import_ssr_url(btn, urlname, sid) {
 			document.getElementsByName('cbid.shadowsocksr.' + sid + '.tls')[0].checked = true;
 			document.getElementsByName('cbid.shadowsocksr.' + sid + '.tls')[0].dispatchEvent(event);
 			document.getElementsByName('cbid.shadowsocksr.' + sid + '.tls_host')[0].value = queryParam.peer || '';
-			document.getElementsByName('cbid.shadowsocksr.' + sid + '.insecure')[0].checked = queryParam.allowInsecure === '1';
+			document.getElementsByName('cbid.shadowsocksr.' + sid + '.insecure')[0].checked = queryParam.allowInsecure == '1';
 			if (param != undefined) {
 				document.getElementsByName('cbid.shadowsocksr.' + sid + '.alias')[0].value = decodeURI(param);
 			}
diff --git a/package/lean/luci-app-ssr-plus/root/etc/init.d/shadowsocksr b/package/lean/luci-app-ssr-plus/root/etc/init.d/shadowsocksr
index 490109c36f..902bf25f27 100755
--- a/package/lean/luci-app-ssr-plus/root/etc/init.d/shadowsocksr
+++ b/package/lean/luci-app-ssr-plus/root/etc/init.d/shadowsocksr
@@ -589,12 +589,14 @@ load_config() {
 		LOCAL_SERVER=$GLOBAL_SERVER
 		local_config_file=$TMP_PATH/tcp-udp-ssr-local.json
 		start_local
+		local_enable=0
 		;;
 	*)
 		if [ "$LOCAL_SERVER" == "$GLOBAL_SERVER" ]; then
 			_local="1"
 			local_config_file=$TMP_PATH/tcp-udp-ssr-local.json
 			start_local
+			local_enable=0
 		else
 			_local="2"
 			local_config_file=$TMP_PATH/tcp-udp-ssr-local.json
diff --git a/package/lean/luci-app-ssr-plus/root/usr/bin/ssr-monitor b/package/lean/luci-app-ssr-plus/root/usr/bin/ssr-monitor
index 964e06a6bb..e590440696 100755
--- a/package/lean/luci-app-ssr-plus/root/usr/bin/ssr-monitor
+++ b/package/lean/luci-app-ssr-plus/root/usr/bin/ssr-monitor
@@ -34,8 +34,8 @@ while [ "1" == "1" ]; do #死循环
 	if [ "$redir_tcp_process" -gt 0 ]; then
 		icount=$(busybox ps -w | grep ssr-retcp | grep -v grep | wc -l)
 		if [ "$icount" == 0 ]; then
-			logger -t "$NAME" "ssr redir tcp error.restart!"
-			echolog "ssr redir tcp error.restart!"
+			logger -t "$NAME" "ssrplus redir tcp error.restart!"
+			echolog "ssrplus redir tcp error.restart!"
 			/etc/init.d/shadowsocksr restart
 			exit 0
 		fi
@@ -44,8 +44,8 @@ while [ "1" == "1" ]; do #死循环
 	if [ "$redir_udp_process" -gt 0 ]; then
 		icount=$(busybox ps -w | grep ssr-reudp | grep -v grep | wc -l)
 		if [ "$icount" == 0 ]; then
-			logger -t "$NAME" "ssr redir udp error.restart!"
-			echolog "ssr redir udp error.restart!"
+			logger -t "$NAME" "ssrplus redir udp error.restart!"
+			echolog "ssrplus redir udp error.restart!"
 			/etc/init.d/shadowsocksr restart
 			exit 0
 		fi
@@ -54,8 +54,8 @@ while [ "1" == "1" ]; do #死循环
 	if [ "$server_process_count" -gt 0 ]; then
 		icount=$(busybox ps -w | grep ssr-server | grep -v grep | wc -l)
 		if [ "$icount" -lt "$server_process_count" ]; then #如果进程挂掉就重启它
-			logger -t "$NAME" "ssr server error.restart!"
-			echolog "ssr server error.restart!"
+			logger -t "$NAME" "ssrplus server error.restart!"
+			echolog "ssrplus server error.restart!"
 			kill -9 $(busybox ps -w | grep ssr-server | grep -v grep | awk '{print $1}') >/dev/null 2>&1
 			/etc/init.d/shadowsocksr restart
 			exit 0
@@ -65,8 +65,8 @@ while [ "1" == "1" ]; do #死循环
 	if [ "$kcp_process" -gt 0 ]; then
 		icount=$(busybox ps -w | grep kcptun-client | grep -v grep | wc -l)
 		if [ "$icount" -lt "$kcp_process" ]; then #如果进程挂掉就重启它
-			logger -t "$NAME" "ssr kcptun error.restart!"
-			echolog "ssr kcptun error.restart!"
+			logger -t "$NAME" "ssrplus kcptun error.restart!"
+			echolog "ssrplus kcptun error.restart!"
 			killall -q -9 kcptun-client
 			(/usr/bin/kcptun-client -r $server:$kcp_port -l :$server_port $password $kcp_param &)
 		fi
diff --git a/package/network/ipv6/odhcp6c/Makefile b/package/network/ipv6/odhcp6c/Makefile
index b1528ee2d1..a52d3a3504 100644
--- a/package/network/ipv6/odhcp6c/Makefile
+++ b/package/network/ipv6/odhcp6c/Makefile
@@ -12,9 +12,9 @@ PKG_RELEASE:=16
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/odhcp6c.git
-PKG_SOURCE_DATE:=2020-12-08
-PKG_SOURCE_VERSION:=0ffa3a31f7146d320214f431291c1196070a010f
-PKG_MIRROR_HASH:=16eab81663ad7bd7f650c62019b65ded21f08e797874041787543e2e8ed665e8
+PKG_SOURCE_DATE:=2020-12-26
+PKG_SOURCE_VERSION:=eac1961983b8e7a74c494feedcb878170b135072
+PKG_MIRROR_HASH:=3d026e66a57082d15a848357fdd94b8332d4916aa5a3251f72c3f83da3d6513e
 PKG_MAINTAINER:=Hans Dedecker <dedeckeh@gmail.com>
 PKG_LICENSE:=GPL-2.0
 
diff --git a/target/imagebuilder/Makefile b/target/imagebuilder/Makefile
index 0a6d66daf9..7e117dd8fe 100644
--- a/target/imagebuilder/Makefile
+++ b/target/imagebuilder/Makefile
@@ -19,6 +19,9 @@ IB_LDIR:=$(patsubst $(TOPDIR)/%,$(PKG_BUILD_DIR)/%,$(LINUX_DIR))
 IB_DTSDIR:=$(patsubst $(TOPDIR)/%,$(PKG_BUILD_DIR)/%,$(LINUX_DIR))/arch/$(LINUX_KARCH)/boot/dts/
 IB_IDIR:=$(patsubst $(TOPDIR)/%,$(PKG_BUILD_DIR)/%,$(STAGING_DIR_IMAGE))
 
+BUNDLER_PATH := $(subst $(space),:,$(filter-out $(TOPDIR)/%,$(subst :,$(space),$(PATH))))
+BUNDLER_COMMAND := PATH=$(BUNDLER_PATH) $(XARGS) $(SCRIPT_DIR)/bundle-libraries.sh $(PKG_BUILD_DIR)/staging_dir/host
+
 all: compile
 
 $(BIN_DIR)/$(IB_NAME).tar.xz: clean
@@ -98,7 +101,7 @@ endif
 	$(INSTALL_DIR) $(PKG_BUILD_DIR)/staging_dir/host/bin
 	$(CP) $(STAGING_DIR_HOST)/bin/* $(PKG_BUILD_DIR)/staging_dir/host/bin/
 	(cd $(PKG_BUILD_DIR); find staging_dir/host/bin/ $(IB_LDIR)/scripts/dtc/ -type f | \
-		$(XARGS) $(SCRIPT_DIR)/bundle-libraries.sh $(PKG_BUILD_DIR)/staging_dir/host)
+		$(BUNDLER_COMMAND))
 	$(CP) $(TOPDIR)/staging_dir/host/lib/libfakeroot* $(PKG_BUILD_DIR)/staging_dir/host/lib
 	STRIP=$(STAGING_DIR_HOST)/bin/sstrip $(SCRIPT_DIR)/rstrip.sh $(PKG_BUILD_DIR)/staging_dir/host/bin/
 	$(TAR) -cf - -C $(BUILD_DIR) $(IB_NAME) | xz -T$(if $(filter 1,$(NPROC)),2,0) -zc -7e > $@
diff --git a/target/sdk/Makefile b/target/sdk/Makefile
index d31d84983d..feef07f502 100644
--- a/target/sdk/Makefile
+++ b/target/sdk/Makefile
@@ -20,6 +20,9 @@ STAGING_SUBDIR_HOST := staging_dir/host
 STAGING_SUBDIR_TARGET := staging_dir/$(TARGET_DIR_NAME)
 STAGING_SUBDIR_TOOLCHAIN := staging_dir/toolchain-$(ARCH)$(ARCH_SUFFIX)_gcc-$(GCCV)_$(LIBC)$(if $(CONFIG_arm),_eabi)
 
+BUNDLER_PATH := $(subst $(space),:,$(filter-out $(TOPDIR)/%,$(subst :,$(space),$(PATH))))
+BUNDLER_COMMAND := PATH=$(BUNDLER_PATH) $(XARGS) $(SCRIPT_DIR)/bundle-libraries.sh $(SDK_BUILD_DIR)/$(STAGING_SUBDIR_HOST)
+
 EXCLUDE_DIRS:=*/ccache/* \
 	*/stamp \
 	*/stampfiles \
@@ -109,7 +112,8 @@ $(BIN_DIR)/$(SDK_NAME).tar.xz: clean
 
 	(cd $(SDK_BUILD_DIR); find $(STAGING_SUBDIR_HOST)/bin $(STAGING_SUBDIR_HOST)/usr/bin \
 		$(STAGING_SUBDIR_TOOLCHAIN)/bin $(STAGING_SUBDIR_TOOLCHAIN)/*/bin $(STAGING_SUBDIR_TOOLCHAIN)/libexec \
-		-type f | $(XARGS) $(SCRIPT_DIR)/bundle-libraries.sh $(SDK_BUILD_DIR)/$(STAGING_SUBDIR_HOST))
+		$(KDIR_BASE) \
+		-type f | $(BUNDLER_COMMAND))
 
 	@-( \
 		find \
diff --git a/toolchain/glibc/common.mk b/toolchain/glibc/common.mk
index faf749eea3..2977b9b58d 100644
--- a/toolchain/glibc/common.mk
+++ b/toolchain/glibc/common.mk
@@ -12,8 +12,8 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
-PKG_SOURCE_VERSION:=050022910be1d1f5c11cd5168f1685ad4f9580d2
-PKG_MIRROR_HASH:=b0a8c79acbb371badcc8477e840ab32bf796d5e7a0eab224bc8fd5aca6b1e631
+PKG_SOURCE_VERSION:=1d49bede4d8a5448067e8579b14fedf437e75aee
+PKG_MIRROR_HASH:=1f8b04585eaf36b06783f36550fc24689224ffd35f8f650f3954797a7002481a
 PKG_SOURCE_URL:=https://sourceware.org/git/glibc.git
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.xz
 
diff --git a/tools/Makefile b/tools/Makefile
index 33696bc9f5..af7070efee 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -82,8 +82,9 @@ ifneq ($(HOST_OS),Linux)
 endif
 
 ifneq ($(CONFIG_CCACHE)$(CONFIG_SDK),)
-$(foreach tool, $(filter-out xz patch,$(tools-y)), $(eval $(curdir)/$(tool)/compile += $(curdir)/ccache/compile))
+$(foreach tool, $(filter-out xz zstd patch pkgconf libressl cmake,$(tools-y)), $(eval $(curdir)/$(tool)/compile += $(curdir)/ccache/compile))
 tools-y += ccache
+$(curdir)/ccache/compile := $(curdir)/cmake/compile $(curdir)/zstd/compile
 endif
 
 # in case there is no patch tool on the host we need to make patch tool a
diff --git a/tools/ccache/Makefile b/tools/ccache/Makefile
index 6e55001fd5..e016e0beb3 100644
--- a/tools/ccache/Makefile
+++ b/tools/ccache/Makefile
@@ -1,4 +1,4 @@
-# 
+#
 # Copyright (C) 2006-2015 OpenWrt.org
 #
 # This is free software, licensed under the GNU General Public License v2.
@@ -8,25 +8,26 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/target.mk
 
 PKG_NAME:=ccache
-PKG_VERSION:=3.7.11
+PKG_VERSION:=4.1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://github.com/ccache/ccache/releases/download/v$(PKG_VERSION)
-PKG_HASH:=8d450208099a4d202bd7df87caaec81baee20ce9dd62da91e9ea7b95a9072f68
+PKG_HASH:=5fdc804056632d722a1182e15386696f0ea6c59cb4ab4d65a54f0b269ae86f99
+
+HOST_BUILD_PARALLEL:=1
 
 include $(INCLUDE_DIR)/host-build.mk
+include $(INCLUDE_DIR)/cmake.mk
 
-HOST_CONFIGURE_VARS += CC="$(HOSTCC_NOCACHE)"
+CMAKE_HOST_OPTIONS += \
+	-DCMAKE_C_COMPILER_LAUNCHER="" \
+	-DCMAKE_CXX_COMPILER_LAUNCHER=""
 
 define Host/Install/ccache
 	$(INSTALL_DIR) $(STAGING_DIR_HOST)/bin/
 	$(CP) ./files/* $(STAGING_DIR_HOST)/bin/
 endef
 
-define Host/Clean
-	-$(MAKE) -C $(HOST_BUILD_DIR) uninstall
-	$(call Host/Clean/Default)
-endef
 define Host/Install
 	$(call Host/Install/Default)
 	$(call Host/Install/ccache)
diff --git a/tools/ccache/patches/100-honour-copts.patch b/tools/ccache/patches/100-honour-copts.patch
index ccfa1c0247..e4045ef9be 100644
--- a/tools/ccache/patches/100-honour-copts.patch
+++ b/tools/ccache/patches/100-honour-copts.patch
@@ -1,10 +1,10 @@
---- a/src/ccache.c
-+++ b/src/ccache.c
-@@ -2277,6 +2277,7 @@ calculate_object_hash(struct args *args,
- 			"CPLUS_INCLUDE_PATH",
- 			"OBJC_INCLUDE_PATH",
- 			"OBJCPLUS_INCLUDE_PATH", // clang
-+			"GCC_HONOUR_COPTS",
- 			NULL
- 		};
- 		for (const char **p = envvars; *p; ++p) {
+--- a/src/ccache.cpp
++++ b/src/ccache.cpp
+@@ -1654,6 +1654,7 @@ calculate_result_name(Context& ctx,
+                              "CPLUS_INCLUDE_PATH",
+                              "OBJC_INCLUDE_PATH",
+                              "OBJCPLUS_INCLUDE_PATH", // clang
++                             "GCC_HONOUR_COPTS",
+                              nullptr};
+     for (const char** p = envvars; *p; ++p) {
+       const char* v = getenv(*p);
diff --git a/tools/libressl/Makefile b/tools/libressl/Makefile
index dbd8ca4d1a..2b5a33450c 100644
--- a/tools/libressl/Makefile
+++ b/tools/libressl/Makefile
@@ -23,6 +23,7 @@ HOST_BUILD_PARALLEL:=1
 
 include $(INCLUDE_DIR)/host-build.mk
 
+HOSTCC := $(HOSTCC_NOCACHE)
 HOST_CONFIGURE_ARGS += --enable-static --disable-shared --disable-tests
 HOST_CFLAGS += $(FPIC)
 
diff --git a/tools/pkg-config/Makefile b/tools/pkg-config/Makefile
index 17a8737be1..e735b2382e 100644
--- a/tools/pkg-config/Makefile
+++ b/tools/pkg-config/Makefile
@@ -19,6 +19,8 @@ include $(INCLUDE_DIR)/host-build.mk
 
 unexport PKG_CONFIG
 
+HOSTCC := $(HOSTCC_NOCACHE)
+
 HOST_CONFIGURE_ARGS += --with-internal-glib
 
 ifeq ($(HOST_OS),Darwin)
diff --git a/tools/zstd/Makefile b/tools/zstd/Makefile
index 7459725e8e..ec85362544 100644
--- a/tools/zstd/Makefile
+++ b/tools/zstd/Makefile
@@ -15,6 +15,7 @@ HOST_BUILD_PARALLEL:=1
 
 include $(INCLUDE_DIR)/host-build.mk
 
+HOSTCC := $(HOSTCC_NOCACHE)
 HOST_MAKE_FLAGS = PREFIX=$(HOST_BUILD_PREFIX) HAVE_ZLIB=0 HAVE_LZMA=0 HAVE_LZ4=0
 
 $(eval $(call HostBuild))