git: f513f0e2ae32 - 2026Q2 - www/nginx{,-devel}: Update to 1.30.3/1.31.2

Go to: [ bottom of page ] [ top of archives ] [ this month ]
From: Jochen Neumeister <joneum_at_FreeBSD.org>
Date: Fri, 19 Jun 2026 15:57:52 UTC
The branch 2026Q2 has been updated by joneum:

URL: https://cgit.FreeBSD.org/ports/commit/?id=f513f0e2ae320a105f40037825cabc5f38d54478

commit f513f0e2ae320a105f40037825cabc5f38d54478
Author:     Jochen Neumeister <joneum@FreeBSD.org>
AuthorDate: 2026-06-19 15:56:28 +0000
Commit:     Jochen Neumeister <joneum@FreeBSD.org>
CommitDate: 2026-06-19 15:57:27 +0000

    www/nginx{,-devel}: Update to 1.30.3/1.31.2
    
    Update nginx and nginx-devel to the latest security releases.
    
    The quarterly branch was updated manually to account for changes
    present in main that are not part of 2026Q2.
    
    Security:       CVE-2026-42055, CVE-2026-48142, CVE-2026-42530
    Sponsored by:   Netzkommune GmbH
---
 www/Makefile                                       |  1 +
 www/lua-stream-nginx-module/Makefile               | 30 ++++++++
 www/lua-stream-nginx-module/distinfo               |  3 +
 .../files/patch-src_ngx__stream__lua__module.c     | 20 +++++
 .../patch-src_ngx__stream__lua__ssl__certby.c      | 11 +++
 .../files/patch-src_ngx__stream__lua__time.c       | 12 +++
 www/lua-stream-nginx-module/pkg-descr              |  2 +
 www/lua-stream-nginx-module/pkg-plist              | 89 ++++++++++++++++++++++
 www/nginx-acme/Makefile                            |  2 +-
 www/nginx-acme/distinfo                            | 10 +--
 www/nginx-devel/Makefile                           |  5 ++
 www/nginx-devel/Makefile.extmod                    |  8 +-
 www/nginx-devel/distinfo                           | 16 ++--
 www/nginx-devel/files/extra-patch-mod_zip          | 31 ++++++++
 www/nginx-devel/version.mk                         |  2 +-
 www/nginx/Makefile                                 |  7 +-
 www/nginx/Makefile.extmod                          | 10 ++-
 www/nginx/distinfo                                 | 20 +++--
 www/nginx/files/extra-patch-mod_zip                | 31 ++++++++
 www/nginx/version.mk                               |  2 +-
 20 files changed, 276 insertions(+), 36 deletions(-)

diff --git a/www/Makefile b/www/Makefile
index 0b7458587664..add70f388d32 100644
--- a/www/Makefile
+++ b/www/Makefile
@@ -368,6 +368,7 @@
     SUBDIR += lua-resty-lrucache
     SUBDIR += lua-resty-session
     SUBDIR += lua-resty-session3
+    SUBDIR += lua-stream-nginx-module
     SUBDIR += luakit
     SUBDIR += luakit-devel
     SUBDIR += lux
diff --git a/www/lua-stream-nginx-module/Makefile b/www/lua-stream-nginx-module/Makefile
new file mode 100644
index 000000000000..1a58e0577583
--- /dev/null
+++ b/www/lua-stream-nginx-module/Makefile
@@ -0,0 +1,30 @@
+PORTNAME=	lua-stream-nginx-module
+DISTVERSIONPREFIX=	v
+DISTVERSION=	0.0.17
+CATEGORIES=	www
+
+MAINTAINER=	joneum@FreeBSD.org
+COMMENT=	Lua module for the NGINX stream subsystem
+WWW=		https://github.com/openresty/stream-lua-nginx-module
+
+LICENSE=	BSD2CLAUSE
+LICENSE_FILE=	${WRKSRC}/LICENSE
+
+USE_GITHUB=	yes
+GH_ACCOUNT=	openresty
+GH_PROJECT=	stream-lua-nginx-module
+
+NO_ARCH=	yes
+NO_BUILD=	yes
+
+MODULESDIR=	${LOCALBASE}/share/nginx/modules/${PORTNAME}
+
+PLIST_SUB=	MODULESDIR=${MODULESDIR}
+
+do-install:
+	@${MKDIR} ${STAGEDIR}${MODULESDIR}/src
+	${INSTALL_DATA} ${WRKSRC}/config ${STAGEDIR}${MODULESDIR}
+	@cd ${WRKSRC}/src && \
+		${COPYTREE_SHARE} . ${STAGEDIR}${MODULESDIR}/src
+
+.include <bsd.port.mk>
diff --git a/www/lua-stream-nginx-module/distinfo b/www/lua-stream-nginx-module/distinfo
new file mode 100644
index 000000000000..eda78a19aefc
--- /dev/null
+++ b/www/lua-stream-nginx-module/distinfo
@@ -0,0 +1,3 @@
+TIMESTAMP = 1779703418
+SHA256 (openresty-stream-lua-nginx-module-v0.0.17_GH0.tar.gz) = 09cf5b90904a575b90c16d5cf861b978ef2dbe6d5340e5eb3707e2d2a3ac5cdc
+SIZE (openresty-stream-lua-nginx-module-v0.0.17_GH0.tar.gz) = 413563
diff --git a/www/lua-stream-nginx-module/files/patch-src_ngx__stream__lua__module.c b/www/lua-stream-nginx-module/files/patch-src_ngx__stream__lua__module.c
new file mode 100644
index 000000000000..7b6af1ff42b2
--- /dev/null
+++ b/www/lua-stream-nginx-module/files/patch-src_ngx__stream__lua__module.c
@@ -0,0 +1,20 @@
+--- src/ngx_stream_lua_module.c.orig
++++ src/ngx_stream_lua_module.c
+@@ -916,7 +916,7 @@ ngx_stream_lua_merge_srv_conf(ngx_conf_t
+     ngx_stream_lua_srv_conf_t       *conf = child;
+ 
+ #if (NGX_STREAM_SSL)
+-#if defined(nginx_version) && nginx_version >= 1025005
++#if defined(nginx_version) && nginx_version >= 1025005 && !defined(freenginx)
+     ngx_stream_ssl_srv_conf_t       *sscf;
+ #else
+     ngx_stream_ssl_conf_t           *sscf;
+@@ -925,7 +925,7 @@ ngx_stream_lua_merge_srv_conf(ngx_conf_t
+     dd("merge srv conf");
+ 
+     sscf = ngx_stream_conf_get_module_srv_conf(cf, ngx_stream_ssl_module);
+-#if defined(nginx_version) && nginx_version >= 1025005
++#if defined(nginx_version) && nginx_version >= 1025005 && !defined(freenginx)
+     if (sscf && sscf->ssl.ctx) {
+ #else
+     if (sscf && sscf->listen) {
diff --git a/www/lua-stream-nginx-module/files/patch-src_ngx__stream__lua__ssl__certby.c b/www/lua-stream-nginx-module/files/patch-src_ngx__stream__lua__ssl__certby.c
new file mode 100644
index 000000000000..b986a924bd9f
--- /dev/null
+++ b/www/lua-stream-nginx-module/files/patch-src_ngx__stream__lua__ssl__certby.c
@@ -0,0 +1,11 @@
+--- src/ngx_stream_lua_ssl_certby.c.orig
++++ src/ngx_stream_lua_ssl_certby.c
+@@ -1554,7 +1554,7 @@ ngx_stream_lua_ffi_ssl_verify_client(ngx
+ 
+     ngx_stream_lua_ctx_t        *ctx;
+     ngx_ssl_conn_t              *ssl_conn;
+-#if defined(nginx_version) && nginx_version >= 1025005
++#if defined(nginx_version) && nginx_version >= 1025005 && !defined(freenginx)
+     ngx_stream_ssl_srv_conf_t   *sscf;
+ #else
+     ngx_stream_ssl_conf_t       *sscf;
diff --git a/www/lua-stream-nginx-module/files/patch-src_ngx__stream__lua__time.c b/www/lua-stream-nginx-module/files/patch-src_ngx__stream__lua__time.c
new file mode 100644
index 000000000000..79bd3eee4f57
--- /dev/null
+++ b/www/lua-stream-nginx-module/files/patch-src_ngx__stream__lua__time.c
@@ -0,0 +1,12 @@
+--- src/ngx_stream_lua_time.c.orig
++++ src/ngx_stream_lua_time.c
+@@ -36,7 +36,11 @@ ngx_stream_lua_ffi_now(void)
+ double
+ ngx_stream_lua_ffi_req_start_time(ngx_stream_lua_request_t *r)
+ {
++#if defined(freenginx)
++    return r->session->start_time / 1000.0;
++#else
+     return r->session->start_sec + r->session->start_msec / 1000.0;
++#endif
+ }
diff --git a/www/lua-stream-nginx-module/pkg-descr b/www/lua-stream-nginx-module/pkg-descr
new file mode 100644
index 000000000000..d2a71572b807
--- /dev/null
+++ b/www/lua-stream-nginx-module/pkg-descr
@@ -0,0 +1,2 @@
+ngx_stream_lua_module embeds Lua into the NGINX stream subsystem,
+allowing Lua code to run in TCP and UDP stream processing phases.
diff --git a/www/lua-stream-nginx-module/pkg-plist b/www/lua-stream-nginx-module/pkg-plist
new file mode 100644
index 000000000000..a4fc1359e842
--- /dev/null
+++ b/www/lua-stream-nginx-module/pkg-plist
@@ -0,0 +1,89 @@
+share/nginx/modules/lua-stream-nginx-module/config
+share/nginx/modules/lua-stream-nginx-module/src/api/ngx_stream_lua_api.h
+share/nginx/modules/lua-stream-nginx-module/src/ddebug.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_api.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_args.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_args.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_balancer.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_balancer.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_cache.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_cache.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_clfactory.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_clfactory.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_common.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_config.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_config.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_consts.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_consts.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_contentby.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_contentby.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_control.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_control.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_coroutine.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_coroutine.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_ctx.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_ctx.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_directive.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_directive.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_exception.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_exception.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_initby.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_initby.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_initworkerby.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_initworkerby.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_input_filters.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_input_filters.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_lex.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_lex.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_log.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_log.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_log_ringbuf.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_log_ringbuf.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_logby.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_logby.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_misc.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_misc.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_module.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_output.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_output.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_pcrefix.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_pcrefix.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_phase.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_phase.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_prereadby.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_prereadby.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_probe.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_proxy_ssl_verifyby.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_proxy_ssl_verifyby.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_regex.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_request.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_request.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_script.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_script.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_semaphore.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_semaphore.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_shdict.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_shdict.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_sleep.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_sleep.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_socket_tcp.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_socket_tcp.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_socket_udp.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_socket_udp.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_ssl.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_ssl.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_ssl_certby.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_ssl_certby.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_ssl_client_helloby.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_ssl_client_helloby.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_string.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_string.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_time.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_timer.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_timer.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_uthread.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_uthread.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_util.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_util.h
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_variable.c
+share/nginx/modules/lua-stream-nginx-module/src/ngx_stream_lua_worker.c
diff --git a/www/nginx-acme/Makefile b/www/nginx-acme/Makefile
index fe726b685c72..b9c3335dc626 100644
--- a/www/nginx-acme/Makefile
+++ b/www/nginx-acme/Makefile
@@ -1,6 +1,6 @@
 PORTNAME=	acme
 PORTVERSION=	0.3.1
-PORTREVISION=	3
+PORTREVISION=	8
 CATEGORIES=	www
 MASTER_SITES=	https://github.com/nginx/nginx-${PORTNAME}/releases/download/v${PORTVERSION}/:acme \
 		https://nginx.org/download/:nginx
diff --git a/www/nginx-acme/distinfo b/www/nginx-acme/distinfo
index d3f0efe3f0a0..8b96017ba8b2 100644
--- a/www/nginx-acme/distinfo
+++ b/www/nginx-acme/distinfo
@@ -1,10 +1,10 @@
-TIMESTAMP = 1779470228
+TIMESTAMP = 1781798762
 SHA256 (nginx-acme-0.3.1.tar.gz) = be3d3d10f042930a3bf348731698eadb7003d224a863c53b719ccd28721572c3
 SIZE (nginx-acme-0.3.1.tar.gz) = 99486
-SHA256 (nginx-1.30.2.tar.gz) = 7df3090907fca3cc0e456d6dc00ceb230da74ea88026ceff0affc29dbbd9ac4c
-SIZE (nginx-1.30.2.tar.gz) = 1325247
-SHA256 (nginx-1.31.0.tar.gz) = 6d5b00d45393af2e4e7c52a442d2a198f0ccbc7678ed062a46f403edd833ebaa
-SIZE (nginx-1.31.0.tar.gz) = 1337335
+SHA256 (nginx-1.30.3.tar.gz) = e5823dc6f45610993def93ebf6cfce68264af4958c77e874b7d20f3709001b8f
+SIZE (nginx-1.30.3.tar.gz) = 1325830
+SHA256 (nginx-1.31.2.tar.gz) = af2a957c41da636ddc4f883e4523c6d140b4784dbce42000c364ae5092aa473c
+SIZE (nginx-1.31.2.tar.gz) = 1339618
 SHA256 (rust/crates/aho-corasick-1.1.4.crate) = ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301
 SIZE (rust/crates/aho-corasick-1.1.4.crate) = 184015
 SHA256 (rust/crates/allocator-api2-0.3.1.crate) = c583acf993cf4245c4acb0a2cc2ab1f9cc097de73411bb6d3647ff6af2b1013d
diff --git a/www/nginx-devel/Makefile b/www/nginx-devel/Makefile
index 52dc99ad6181..7949bb6a3328 100644
--- a/www/nginx-devel/Makefile
+++ b/www/nginx-devel/Makefile
@@ -335,6 +335,11 @@ post-patch-SFLOW-on:
 pre-configure-SMALL_LIGHT-on:
 	( cd ${WRKSRC_small_light} && ./setup )
 
+pre-configure-LUASTREAM-on:
+	@${RM} -rf ${WRKSRC_luastream}
+	@cd ${LOCALBASE}/share/nginx/modules/lua-stream-nginx-module && \
+		${COPYTREE_SHARE} . ${WRKSRC_luastream}
+
 do-configure-NJS-on:
 	( cd ${WRKSRC_njs} && ${SETENV} ${CONFIGURE_ENV} ${CONFIGURE_CMD} ${NJS_CONFIGURE_ARGS} )
 
diff --git a/www/nginx-devel/Makefile.extmod b/www/nginx-devel/Makefile.extmod
index 80260a77c3e7..423562316662 100644
--- a/www/nginx-devel/Makefile.extmod
+++ b/www/nginx-devel/Makefile.extmod
@@ -187,8 +187,9 @@ HTTP_VIDEO_THUMBEXTRACTOR_GH_TUPLE=	wandenberg:nginx-video-thumbextractor-module
 HTTP_VIDEO_THUMBEXTRACTOR_VARS=		DSO_EXTMODS+=vte
 HTTP_VIDEO_THUMBEXTRACTOR_EXTRA_PATCHES=${PATCHDIR}/extra-patch-nginx-thumbextractor-module-config
 
-HTTP_ZIP_GH_TUPLE=	vince2678:mod_zip:39dc908:mod_zip
+HTTP_ZIP_GH_TUPLE=	evanmiller:mod_zip:a9f9afa:mod_zip
 HTTP_ZIP_VARS=		DSO_EXTMODS+=mod_zip
+HTTP_ZIP_EXTRA_PATCHES=	${PATCHDIR}/extra-patch-mod_zip
 
 ICONV_IMPLIES=		DEVEL_KIT
 ICONV_USES=		iconv
@@ -213,7 +214,8 @@ LUASTREAM_LIB_DEPENDS=	libluajit-5.1.so:lang/luajit-openresty
 LUASTREAM_RUN_DEPENDS=	lua-resty-core>0:www/lua-resty-core
 LUASTREAM_CONFIGURE_ENV=LUAJIT_INC=${LOCALBASE}/include/luajit-2.1 \
 			LUAJIT_LIB=${LOCALBASE}/lib
-LUASTREAM_GH_TUPLE=	openresty:stream-lua-nginx-module:v0.0.16:luastream
+LUASTREAM_BUILD_DEPENDS=lua-stream-nginx-module>=0.0.17:www/lua-stream-nginx-module
+WRKSRC_luastream=	${WRKDIR}/lua-stream-nginx-module
 LUASTREAM_VARS=		DSO_EXTMODS+=luastream
 
 LINK_GH_TUPLE=		Taymindis:nginx-link-function:3.2.4:link
@@ -240,7 +242,7 @@ NAXSI_VARS=		DSO_EXTMODS+=naxsi NAXSI_SUBDIR=/naxsi_src
 NAXSI_EXTRA_PATCHES=	${PATCHDIR}/extra-patch-naxsi-libinjection__sqli_c \
 			${PATCHDIR}/extra-patch-naxsi_config
 
-NJS_GH_TUPLE=		nginx:njs:0.9.6:njs
+NJS_GH_TUPLE=		nginx:njs:0.9.9:njs
 NJS_CONFIGURE_ON=	--with-cc-opt="-I ${LOCALBASE}/include/quickjs"
 NJS_LIB_DEPENDS=	libquickjs.so:lang/quickjs \
 			libxml2.so:textproc/libxml2 \
diff --git a/www/nginx-devel/distinfo b/www/nginx-devel/distinfo
index ffc2e5251b46..47d72b1f51c2 100644
--- a/www/nginx-devel/distinfo
+++ b/www/nginx-devel/distinfo
@@ -1,6 +1,6 @@
-TIMESTAMP = 1779212996
-SHA256 (nginx-1.31.0.tar.gz) = 6d5b00d45393af2e4e7c52a442d2a198f0ccbc7678ed062a46f403edd833ebaa
-SIZE (nginx-1.31.0.tar.gz) = 1337335
+TIMESTAMP = 1781798737
+SHA256 (nginx-1.31.2.tar.gz) = af2a957c41da636ddc4f883e4523c6d140b4784dbce42000c364ae5092aa473c
+SIZE (nginx-1.31.2.tar.gz) = 1339618
 SHA256 (nginx_mogilefs_module-1.0.4.tar.gz) = 7ac230d30907f013dff8d435a118619ea6168aa3714dba62c6962d350c6295ae
 SIZE (nginx_mogilefs_module-1.0.4.tar.gz) = 11208
 SHA256 (passenger-6.1.2.tar.gz) = 94400a52e536cfdd8acf2accb47badb7a67dc309452f1b05600da67343f25bf8
@@ -85,8 +85,8 @@ SHA256 (gdongca-nginx-sticky-module-ng-a3263ad_GH0.tar.gz) = 610bd7fa83d6f8fdb17
 SIZE (gdongca-nginx-sticky-module-ng-a3263ad_GH0.tar.gz) = 122022
 SHA256 (wandenberg-nginx-video-thumbextractor-module-e81f850_GH0.tar.gz) = 9113f887a8740fe72614ee32f481177d33e9542c3b0625627da19a1c4f3da2cb
 SIZE (wandenberg-nginx-video-thumbextractor-module-e81f850_GH0.tar.gz) = 2710072
-SHA256 (vince2678-mod_zip-39dc908_GH0.tar.gz) = bc5c3d725268abbe1c5c38de5b18a4ad9dbe5821c4afeaccabd3eec38b272be4
-SIZE (vince2678-mod_zip-39dc908_GH0.tar.gz) = 30275
+SHA256 (evanmiller-mod_zip-a9f9afa_GH0.tar.gz) = 645035b7d7a83ab3f47c692386e85bef69514b7778c1d069783d8fc76cc868da
+SIZE (evanmiller-mod_zip-a9f9afa_GH0.tar.gz) = 30917
 SHA256 (calio-iconv-nginx-module-v0.14_GH0.tar.gz) = b8b9f355c05c0790226512f6732348a2404d48531688a1fc04ce6768163bf462
 SIZE (calio-iconv-nginx-module-v0.14_GH0.tar.gz) = 13133
 SHA256 (baysao-nginx-let-module-c1f23aa_GH0.tar.gz) = 7393809d5d8877812da1bd5b5fbd1d8b00bc85e71f2f387c344f007773e49050
@@ -95,8 +95,6 @@ SHA256 (Taymindis-nginx-link-function-3.2.4_GH0.tar.gz) = 20c3679199ba7efe1598f0
 SIZE (Taymindis-nginx-link-function-3.2.4_GH0.tar.gz) = 139656
 SHA256 (openresty-lua-nginx-module-v0.10.29_GH0.tar.gz) = ca2c2122b909529bf9d1a89e9a5763835a2bd2629def8cb279c550f638f0a78f
 SIZE (openresty-lua-nginx-module-v0.10.29_GH0.tar.gz) = 892502
-SHA256 (openresty-stream-lua-nginx-module-v0.0.16_GH0.tar.gz) = 3b1103cf5ee940ea94711eae1a7ccc1a161273ec9a08eb415f1d45ad385f967d
-SIZE (openresty-stream-lua-nginx-module-v0.0.16_GH0.tar.gz) = 395259
 SHA256 (openresty-memc-nginx-module-v0.20_GH0.tar.gz) = a42dd56dd6e2144755a127bcd2a6cc1a488258dc5cdb751d6a3e5dd5b6989239
 SIZE (openresty-memc-nginx-module-v0.20_GH0.tar.gz) = 34736
 SHA256 (owasp-modsecurity-ModSecurity-nginx-fd28e6a_GH0.tar.gz) = deafee4e4145a73b9369999e261368b34d4f7ff1be2596a559abd9e1d5df5526
@@ -107,8 +105,8 @@ SHA256 (wargio-naxsi-1.7_GH0.tar.gz) = adee817da71913f64a9fb0fca142d9520bb0e5014
 SIZE (wargio-naxsi-1.7_GH0.tar.gz) = 1132392
 SHA256 (libinjection-libinjection-b9fcaaf_GH0.tar.gz) = 7812e1316b61a7a7d3a65a57a07c6d5235ac40fe35e6edda983f31a44661a38e
 SIZE (libinjection-libinjection-b9fcaaf_GH0.tar.gz) = 2218207
-SHA256 (nginx-njs-0.9.6_GH0.tar.gz) = 713e931d1ffcd337f6304dc55e512dcf2099ba4cc3a996c9ea14f22d5d9cdd79
-SIZE (nginx-njs-0.9.6_GH0.tar.gz) = 953437
+SHA256 (nginx-njs-0.9.9_GH0.tar.gz) = a07f4cf0a2076bbabde23cab48aea68641ebf5d54ea69b415ce70a8da4153843
+SIZE (nginx-njs-0.9.9_GH0.tar.gz) = 994273
 SHA256 (osokin-nginx-otel-3a655df_GH0.tar.gz) = 71ee1561303c289d4562148f8719b60796c36abe16de1b3c10d10b8e6f03a952
 SIZE (osokin-nginx-otel-3a655df_GH0.tar.gz) = 27169
 SHA256 (konstruxi-ngx_postgres-8aa7359_GH0.tar.gz) = c69ad4495de7c7883ebc23e1e6c4cc83a4ac6a7fddd4d5c12e49d33b65f7c50b
diff --git a/www/nginx-devel/files/extra-patch-mod_zip b/www/nginx-devel/files/extra-patch-mod_zip
new file mode 100644
index 000000000000..414ab48e6e0c
--- /dev/null
+++ b/www/nginx-devel/files/extra-patch-mod_zip
@@ -0,0 +1,31 @@
+--- ../mod_zip-a9f9afa/config	2025-09-04 19:55:16.000000000 +0000
++++ ../mod_zip-a9f9afa/config	2026-06-12 13:41:30.208275468 +0000
+@@ -43,7 +43,7 @@
+ 
+ ngx_feature="multi-value headers are linked lists (nginx 1.23.0+)"
+ ngx_feature_name="NGX_ZIP_MULTI_HEADERS_LINKED_LISTS"
+-ngx_feature_run=yes
++ngx_feature_run=no
+ ngx_feature_incs="#include \"nginx.h\""
+ ngx_feature_path="src/core"
+ ngx_feature_test="
+--- ../mod_zip-a9f9afa/ngx_http_zip_module.h	2025-09-04 19:55:16.000000000 +0000
++++ ../mod_zip-a9f9afa/ngx_http_zip_module.h	2026-06-12 13:41:14.029809686 +0000
+@@ -3,8 +3,17 @@
+ #include <ngx_config.h>
+ #include <ngx_core.h>
+ #include <ngx_http.h>
++#include <nginx.h>
+ #include <time.h>
+ 
++/* Fallback in case the configure-time feature test did not run:
++ * multi-value headers became linked lists in nginx 1.23.0 */
++#ifndef NGX_ZIP_MULTI_HEADERS_LINKED_LISTS
++#if (nginx_version >= 1023000)
++#define NGX_ZIP_MULTI_HEADERS_LINKED_LISTS 1
++#endif
++#endif
++
+ #define NGX_ZIP_MIME_TYPE "application/zip"
+ #define ngx_http_zip_current_file(ctx) ctx->pieces[ctx->pieces_i].file
+ 
diff --git a/www/nginx-devel/version.mk b/www/nginx-devel/version.mk
index 7f62669fe9b4..97d18ade9f33 100644
--- a/www/nginx-devel/version.mk
+++ b/www/nginx-devel/version.mk
@@ -1 +1 @@
-NGINX_VERSION=	1.31.0
+NGINX_VERSION=	1.31.2
diff --git a/www/nginx/Makefile b/www/nginx/Makefile
index 1f4bb26e6f0e..fba1e8e9ce87 100644
--- a/www/nginx/Makefile
+++ b/www/nginx/Makefile
@@ -17,7 +17,7 @@ LICENSE_FILE=	${WRKSRC}/LICENSE
 
 CONFLICTS_INSTALL=	nginx-devel
 
-PORTSCOUT=	limit:^1\.2[6-7]\.[0-9]*
+PORTSCOUT=	limit:^1\.30\.[0-9]*
 
 USES=		cpe
 
@@ -322,6 +322,11 @@ post-patch-SFLOW-on:
 pre-configure-SMALL_LIGHT-on:
 	( cd ${WRKSRC_small_light} && ./setup )
 
+pre-configure-LUASTREAM-on:
+	@${RM} -rf ${WRKSRC_luastream}
+	@cd ${LOCALBASE}/share/nginx/modules/lua-stream-nginx-module && \
+		${COPYTREE_SHARE} . ${WRKSRC_luastream}
+
 do-configure-NJS-on:
 	( cd ${WRKSRC_njs} && ${SETENV} ${CONFIGURE_ENV} ${CONFIGURE_CMD} ${NJS_CONFIGURE_ARGS} )
 
diff --git a/www/nginx/Makefile.extmod b/www/nginx/Makefile.extmod
index c22375e66ee2..f02e0f8db064 100644
--- a/www/nginx/Makefile.extmod
+++ b/www/nginx/Makefile.extmod
@@ -30,7 +30,7 @@ BROTLI_GH_TUPLE=	google:ngx_brotli:a71f931:brotli
 BROTLI_VARS=		DSO_EXTMODS+=brotli
 BROTLI_EXTRA_PATCHES=	${PATCHDIR}/extra-patch-ngx_brotli_filter_config
 
-CACHE_PURGE_GH_TUPLE=	nginx-modules:ngx_cache_purge:a84b0f3:cache_purge
+CACHE_PURGE_GH_TUPLE=	nginx-modules:ngx_cache_purge:6147443:cache_purge
 CACHE_PURGE_VARS=	DSO_EXTMODS+=cache_purge
 
 ECHO_GH_TUPLE=		openresty:echo-nginx-module:5a402aa:echo
@@ -185,8 +185,9 @@ HTTP_VIDEO_THUMBEXTRACTOR_GH_TUPLE=	wandenberg:nginx-video-thumbextractor-module
 HTTP_VIDEO_THUMBEXTRACTOR_VARS=		DSO_EXTMODS+=vte
 HTTP_VIDEO_THUMBEXTRACTOR_EXTRA_PATCHES=${PATCHDIR}/extra-patch-nginx-thumbextractor-module-config
 
-HTTP_ZIP_GH_TUPLE=	vince2678:mod_zip:5b2604b:mod_zip
+HTTP_ZIP_GH_TUPLE=	evanmiller:mod_zip:a9f9afa:mod_zip
 HTTP_ZIP_VARS=		DSO_EXTMODS+=mod_zip
+HTTP_ZIP_EXTRA_PATCHES=	${PATCHDIR}/extra-patch-mod_zip
 
 ICONV_IMPLIES=		DEVEL_KIT
 ICONV_USES=		iconv
@@ -211,7 +212,8 @@ LUASTREAM_LIB_DEPENDS=	libluajit-5.1.so:lang/luajit-openresty
 LUASTREAM_RUN_DEPENDS=	lua-resty-core>0:www/lua-resty-core
 LUASTREAM_CONFIGURE_ENV=LUAJIT_INC=${LOCALBASE}/include/luajit-2.1 \
 			LUAJIT_LIB=${LOCALBASE}/lib
-LUASTREAM_GH_TUPLE=	openresty:stream-lua-nginx-module:v0.0.16:luastream
+LUASTREAM_BUILD_DEPENDS=lua-stream-nginx-module>=0.0.17:www/lua-stream-nginx-module
+WRKSRC_luastream=	${WRKDIR}/lua-stream-nginx-module
 LUASTREAM_VARS=		DSO_EXTMODS+=luastream
 
 LINK_GH_TUPLE=		Taymindis:nginx-link-function:3.2.4:link
@@ -234,7 +236,7 @@ NAXSI_VARS=		DSO_EXTMODS+=naxsi NAXSI_SUBDIR=/naxsi_src
 NAXSI_EXTRA_PATCHES=	${PATCHDIR}/extra-patch-naxsi-libinjection__sqli_c \
 			${PATCHDIR}/extra-patch-naxsi_config
 
-NJS_GH_TUPLE=		nginx:njs:0.9.8:njs
+NJS_GH_TUPLE=		nginx:njs:0.9.9:njs
 NJS_VARS=		DSO_EXTMODS+=njs NJS_SUBDIR=/nginx
 NJS_IMPLIES=		STREAM
 
diff --git a/www/nginx/distinfo b/www/nginx/distinfo
index 69e5148ac5d1..7b9098253905 100644
--- a/www/nginx/distinfo
+++ b/www/nginx/distinfo
@@ -1,6 +1,6 @@
-TIMESTAMP = 1779470210
-SHA256 (nginx-1.30.2.tar.gz) = 7df3090907fca3cc0e456d6dc00ceb230da74ea88026ceff0affc29dbbd9ac4c
-SIZE (nginx-1.30.2.tar.gz) = 1325247
+TIMESTAMP = 1781796210
+SHA256 (nginx-1.30.3.tar.gz) = e5823dc6f45610993def93ebf6cfce68264af4958c77e874b7d20f3709001b8f
+SIZE (nginx-1.30.3.tar.gz) = 1325830
 SHA256 (nginx_mogilefs_module-1.0.4.tar.gz) = 7ac230d30907f013dff8d435a118619ea6168aa3714dba62c6962d350c6295ae
 SIZE (nginx_mogilefs_module-1.0.4.tar.gz) = 11208
 SHA256 (ngx_http_redis-0.3.9.tar.gz) = 21f87540f0a44b23ffa5df16fb3d788bc90803b255ef14f9c26e3847a6f26f46
@@ -15,8 +15,8 @@ SHA256 (anomalizer-ngx_aws_auth-21931b2_GH0.tar.gz) = d8a2422da96a638e9a911e4edb
 SIZE (anomalizer-ngx_aws_auth-21931b2_GH0.tar.gz) = 15580
 SHA256 (google-ngx_brotli-a71f931_GH0.tar.gz) = b3312a045d5303a40d02beb34711b8ca27f7b72d647e9ee2012a8eddd14d9b22
 SIZE (google-ngx_brotli-a71f931_GH0.tar.gz) = 16376
-SHA256 (nginx-modules-ngx_cache_purge-a84b0f3_GH0.tar.gz) = ddfd4fdd99075d906b7b75c49f56ec96b76df7951dfa54502e0f83890447031f
-SIZE (nginx-modules-ngx_cache_purge-a84b0f3_GH0.tar.gz) = 17162
+SHA256 (nginx-modules-ngx_cache_purge-6147443_GH0.tar.gz) = 0537f2a2bc9e6b88040c7747ed39eea99881f17d39f0d390c9c60f668fb45f9a
+SIZE (nginx-modules-ngx_cache_purge-6147443_GH0.tar.gz) = 42057
 SHA256 (vision5-ngx_devel_kit-v0.3.3_GH0.tar.gz) = faa2fcd5168b10764d35081356511d5f84db5c526a1aa4b6add2db94b6853b2b
 SIZE (vision5-ngx_devel_kit-v0.3.3_GH0.tar.gz) = 66561
 SHA256 (openresty-drizzle-nginx-module-3504fc6_GH0.tar.gz) = 86076735597f14db28cffabc0ab1f233cd51aab7cf112c56e267783e7814fc65
@@ -83,8 +83,8 @@ SHA256 (dvershinin-nginx-sticky-module-ng-2753211_GH0.tar.gz) = e4a533dfa214ea28
 SIZE (dvershinin-nginx-sticky-module-ng-2753211_GH0.tar.gz) = 120676
 SHA256 (wandenberg-nginx-video-thumbextractor-module-e81f850_GH0.tar.gz) = 9113f887a8740fe72614ee32f481177d33e9542c3b0625627da19a1c4f3da2cb
 SIZE (wandenberg-nginx-video-thumbextractor-module-e81f850_GH0.tar.gz) = 2710072
-SHA256 (vince2678-mod_zip-5b2604b_GH0.tar.gz) = 4fe63be3b842882494152e586f0b87e73f51bfbfd801b78f033c71a011cba789
-SIZE (vince2678-mod_zip-5b2604b_GH0.tar.gz) = 29559
+SHA256 (evanmiller-mod_zip-a9f9afa_GH0.tar.gz) = 645035b7d7a83ab3f47c692386e85bef69514b7778c1d069783d8fc76cc868da
+SIZE (evanmiller-mod_zip-a9f9afa_GH0.tar.gz) = 30917
 SHA256 (calio-iconv-nginx-module-v0.14_GH0.tar.gz) = b8b9f355c05c0790226512f6732348a2404d48531688a1fc04ce6768163bf462
 SIZE (calio-iconv-nginx-module-v0.14_GH0.tar.gz) = 13133
 SHA256 (baysao-nginx-let-module-c1f23aa_GH0.tar.gz) = 7393809d5d8877812da1bd5b5fbd1d8b00bc85e71f2f387c344f007773e49050
@@ -93,8 +93,6 @@ SHA256 (Taymindis-nginx-link-function-3.2.4_GH0.tar.gz) = 20c3679199ba7efe1598f0
 SIZE (Taymindis-nginx-link-function-3.2.4_GH0.tar.gz) = 139656
 SHA256 (openresty-lua-nginx-module-v0.10.29_GH0.tar.gz) = ca2c2122b909529bf9d1a89e9a5763835a2bd2629def8cb279c550f638f0a78f
 SIZE (openresty-lua-nginx-module-v0.10.29_GH0.tar.gz) = 892502
-SHA256 (openresty-stream-lua-nginx-module-v0.0.16_GH0.tar.gz) = 3b1103cf5ee940ea94711eae1a7ccc1a161273ec9a08eb415f1d45ad385f967d
-SIZE (openresty-stream-lua-nginx-module-v0.0.16_GH0.tar.gz) = 395259
 SHA256 (openresty-memc-nginx-module-v0.19_GH0.tar.gz) = 8c2bdbe875e4f5225d0778bfb09a2668f9281d7de6218c7b462a7ba2cee06fe8
 SIZE (openresty-memc-nginx-module-v0.19_GH0.tar.gz) = 34654
 SHA256 (SpiderLabs-ModSecurity-nginx-v1.0.3_GH0.tar.gz) = 32a42256616cc674dca24c8654397390adff15b888b77eb74e0687f023c8751b
@@ -103,8 +101,8 @@ SHA256 (wargio-naxsi-1.6_GH0.tar.gz) = e5920fdd09cae155b89eb21a94a21c029ebfdb056
 SIZE (wargio-naxsi-1.6_GH0.tar.gz) = 1116227
 SHA256 (libinjection-libinjection-4aa3894_GH0.tar.gz) = ededea133e89e238ef2e60d0d62ef7ef9e741449eed8c5d856007132505bcd5b
 SIZE (libinjection-libinjection-4aa3894_GH0.tar.gz) = 2218294
-SHA256 (nginx-njs-0.9.8_GH0.tar.gz) = 016cea70b70f0abcf894366bd555e34ea839b920fac1b085fb063a2ecccc8672
-SIZE (nginx-njs-0.9.8_GH0.tar.gz) = 967795
+SHA256 (nginx-njs-0.9.9_GH0.tar.gz) = a07f4cf0a2076bbabde23cab48aea68641ebf5d54ea69b415ce70a8da4153843
+SIZE (nginx-njs-0.9.9_GH0.tar.gz) = 994273
 SHA256 (osokin-nginx-otel-51273ec_GH0.tar.gz) = a2107ba0be94c8561ae50773163c7946a58e508be46920f588d05a347c867d9c
 SIZE (osokin-nginx-otel-51273ec_GH0.tar.gz) = 28076
 SHA256 (konstruxi-ngx_postgres-8aa7359_GH0.tar.gz) = c69ad4495de7c7883ebc23e1e6c4cc83a4ac6a7fddd4d5c12e49d33b65f7c50b
diff --git a/www/nginx/files/extra-patch-mod_zip b/www/nginx/files/extra-patch-mod_zip
new file mode 100644
index 000000000000..414ab48e6e0c
--- /dev/null
+++ b/www/nginx/files/extra-patch-mod_zip
@@ -0,0 +1,31 @@
+--- ../mod_zip-a9f9afa/config	2025-09-04 19:55:16.000000000 +0000
++++ ../mod_zip-a9f9afa/config	2026-06-12 13:41:30.208275468 +0000
+@@ -43,7 +43,7 @@
+ 
+ ngx_feature="multi-value headers are linked lists (nginx 1.23.0+)"
+ ngx_feature_name="NGX_ZIP_MULTI_HEADERS_LINKED_LISTS"
+-ngx_feature_run=yes
++ngx_feature_run=no
+ ngx_feature_incs="#include \"nginx.h\""
+ ngx_feature_path="src/core"
+ ngx_feature_test="
+--- ../mod_zip-a9f9afa/ngx_http_zip_module.h	2025-09-04 19:55:16.000000000 +0000
++++ ../mod_zip-a9f9afa/ngx_http_zip_module.h	2026-06-12 13:41:14.029809686 +0000
+@@ -3,8 +3,17 @@
+ #include <ngx_config.h>
+ #include <ngx_core.h>
+ #include <ngx_http.h>
++#include <nginx.h>
+ #include <time.h>
+ 
++/* Fallback in case the configure-time feature test did not run:
++ * multi-value headers became linked lists in nginx 1.23.0 */
++#ifndef NGX_ZIP_MULTI_HEADERS_LINKED_LISTS
++#if (nginx_version >= 1023000)
++#define NGX_ZIP_MULTI_HEADERS_LINKED_LISTS 1
++#endif
++#endif
++
+ #define NGX_ZIP_MIME_TYPE "application/zip"
+ #define ngx_http_zip_current_file(ctx) ctx->pieces[ctx->pieces_i].file
+ 
diff --git a/www/nginx/version.mk b/www/nginx/version.mk
index 4ad146d99d54..55882255221d 100644
--- a/www/nginx/version.mk
+++ b/www/nginx/version.mk
@@ -1 +1 @@
-NGINX_VERSION=	1.30.2
+NGINX_VERSION=	1.30.3