git: f657cf702d5b - main - www/nginx-devel: Update to 1.29.7

Go to: [ bottom of page ] [ top of archives ] [ this month ]
From: Jochen Neumeister <joneum_at_FreeBSD.org>
Date: Thu, 26 Mar 2026 21:22:39 UTC
The branch main has been updated by joneum:

URL: https://cgit.FreeBSD.org/ports/commit/?id=f657cf702d5b0409bcc74cd36f89ac563dae84ce

commit f657cf702d5b0409bcc74cd36f89ac563dae84ce
Author:     Jochen Neumeister <joneum@FreeBSD.org>
AuthorDate: 2026-03-26 21:21:01 +0000
Commit:     Jochen Neumeister <joneum@FreeBSD.org>
CommitDate: 2026-03-26 21:22:26 +0000

    www/nginx-devel: Update to 1.29.7
    
    Changes with nginx 1.29.7                                        24 Mar
    2026
    
        *) Security: a buffer overflow might occur while handling a COPY or
    MOVE
           request in a location with "alias", allowing an attacker to
    modify
           the source or destination path outside of the document root
           (CVE-2026-27654).
           Thanks to Calif.io in collaboration with Claude and Anthropic
           Research.
    
        *) Security: processing of a specially crafted mp4 file by the
           ngx_http_mp4_module on 32-bit platforms might cause a worker
    process
           crash, or might have potential other impact (CVE-2026-27784).
           Thanks to Prabhav Srinath (sprabhav7).
    
        *) Security: processing of a specially crafted mp4 file by the
           ngx_http_mp4_module might cause a worker process crash, or might
    have
           potential other impact (CVE-2026-32647).
           Thanks to Xint Code and Pavel Kohout (Aisle Research).
    
        *) Security: a segmentation fault might occur in a worker process if
    the
           CRAM-MD5 or APOP authentication methods were used and
    authentication
           retry was enabled (CVE-2026-27651).
           Thanks to Arkadi Vainbrand.
    
        *) Security: an attacker might use PTR DNS records to inject data in
           auth_http requests, as well as in the XCLIENT command in the
    backend
           SMTP connection (CVE-2026-28753).
           Thanks to Asim Viladi Oglu Manizada, Colin Warren, Xiao Liu
    (Yunnan
           University), Yuan Tan (UC Riverside), and Bird Liu (Lanzhou
           University).
    
        *) Security: SSL handshake might succeed despite OCSP rejecting a
    client
           certificate in the stream module (CVE-2026-28755).
           Thanks to Mufeed VH of Winfunc Research.
    
        *) Feature: the "multipath" parameter of the "listen" directive.
    
        *) Feature: the "local" parameter of the "keepalive" directive in
    the
           "upstream" block.
    
        *) Change: now the "keepalive" directive in the "upstream" block is
           enabled by default.
    
        *) Change: now ngx_http_proxy_module supports keepalive by default;
    the
           default value for "proxy_http_version" is "1.1"; the "Connection"
           proxy header is not sent by default anymore.
    
        *) Bugfix: an invalid HTTP/2 request might be sent after switching
    to
           the next upstream if buffered body was used in the
           ngx_http_grpc_module.
    
    Changes with nginx 1.29.6                                        10 Mar
    2026
    
        *) Feature: session affinity support; the "sticky" directive in the
           "upstream" block of the "http" module; the "server" directive
           supports the "route" and "drain" parameters.
    
        *) Change: now nginx limits the size and rate of QUIC stateless
    reset
           packets.
    
        *) Bugfix: receiving a QUIC packet by a wrong worker process could
    cause
           the connection to terminate.
    
        *) Bugfix: "[crit] cache file ... contains invalid header" messages
           might appear in logs when sending a cached HTTP/2 response.
    
        *) Bugfix: proxying to scgi backends might not work when using
    chunked
           transfer encoding and the "scgi_request_buffering" directive.
           Thanks to Mufeed VH.
    
        *) Bugfix: in the ngx_http_mp4_module.
           Thanks to Andrew Lacambra.
    
        *) Bugfix: nginx treated a comma as separator in the "Cookie"
    request
           header line when evaluating "$cookie_..." variables.
    
        *) Bugfix: in IMAP command literal argument parsing.
    
    Sponsored by:   Netzkommune GmbH
---
 www/nginx-acme/Makefile    | 2 +-
 www/nginx-acme/distinfo    | 6 +++---
 www/nginx-devel/Makefile   | 2 +-
 www/nginx-devel/distinfo   | 6 +++---
 www/nginx-devel/version.mk | 2 +-
 5 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/www/nginx-acme/Makefile b/www/nginx-acme/Makefile
index 3dc37bbb0ded..191dda6ebd91 100644
--- a/www/nginx-acme/Makefile
+++ b/www/nginx-acme/Makefile
@@ -1,6 +1,6 @@
 PORTNAME=	acme
 PORTVERSION=	0.1.1
-PORTREVISION=	11
+PORTREVISION=	12
 CATEGORIES=	www
 MASTER_SITES=	https://github.com/nginx/nginx-${PORTNAME}/releases/download/v${PORTVERSION}/:acme \
 		https://nginx.org/download/:nginx
diff --git a/www/nginx-acme/distinfo b/www/nginx-acme/distinfo
index 1d91ca6f9b3f..102fdda548c9 100644
--- a/www/nginx-acme/distinfo
+++ b/www/nginx-acme/distinfo
@@ -1,10 +1,10 @@
-TIMESTAMP = 1774553068
+TIMESTAMP = 1774559764
 SHA256 (nginx-acme-0.1.1.tar.gz) = c2158d7f9baa53a9186c406e82c3068832f03b87a1d1066b0d214a8bf834ddfd
 SIZE (nginx-acme-0.1.1.tar.gz) = 77853
 SHA256 (nginx-1.28.3.tar.gz) = 2c96a946bfb0882a21744ed429770a2123ae1828c7c48665092993ddee91a918
 SIZE (nginx-1.28.3.tar.gz) = 1284562
-SHA256 (nginx-1.29.5.tar.gz) = 6744768a4114880f37b13a0443244e731bcb3130c0a065d7e37d8fd589ade374
-SIZE (nginx-1.29.5.tar.gz) = 1310203
+SHA256 (nginx-1.29.7.tar.gz) = 673f8fb8c0961c44fbd9410d6161831453609b44063d3f2948253fc2b5692139
+SIZE (nginx-1.29.7.tar.gz) = 1323485
 SHA256 (rust/crates/addr2line-0.24.2.crate) = dfbe277e56a376000877090da837660b4427aad530e3028d44e0bffe4f89a1c1
 SIZE (rust/crates/addr2line-0.24.2.crate) = 39015
 SHA256 (rust/crates/adler2-2.0.1.crate) = 320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa
diff --git a/www/nginx-devel/Makefile b/www/nginx-devel/Makefile
index ae280e855b9c..52dc99ad6181 100644
--- a/www/nginx-devel/Makefile
+++ b/www/nginx-devel/Makefile
@@ -1,7 +1,7 @@
 PORTNAME?=	nginx
 PORTVERSION=	${NGINX_VERSION}
 .include "version.mk"
-PORTREVISION=	2
+PORTREVISION=	0
 CATEGORIES=	www
 MASTER_SITES=	https://nginx.org/download/ \
 		LOCAL/osa
diff --git a/www/nginx-devel/distinfo b/www/nginx-devel/distinfo
index cdfb287a2005..68b43978f53c 100644
--- a/www/nginx-devel/distinfo
+++ b/www/nginx-devel/distinfo
@@ -1,6 +1,6 @@
-TIMESTAMP = 1774541643
-SHA256 (nginx-1.29.5.tar.gz) = 6744768a4114880f37b13a0443244e731bcb3130c0a065d7e37d8fd589ade374
-SIZE (nginx-1.29.5.tar.gz) = 1310203
+TIMESTAMP = 1774559735
+SHA256 (nginx-1.29.7.tar.gz) = 673f8fb8c0961c44fbd9410d6161831453609b44063d3f2948253fc2b5692139
+SIZE (nginx-1.29.7.tar.gz) = 1323485
 SHA256 (nginx_mogilefs_module-1.0.4.tar.gz) = 7ac230d30907f013dff8d435a118619ea6168aa3714dba62c6962d350c6295ae
 SIZE (nginx_mogilefs_module-1.0.4.tar.gz) = 11208
 SHA256 (passenger-6.1.2.tar.gz) = 94400a52e536cfdd8acf2accb47badb7a67dc309452f1b05600da67343f25bf8
diff --git a/www/nginx-devel/version.mk b/www/nginx-devel/version.mk
index 379cc0056bca..964722b0f419 100644
--- a/www/nginx-devel/version.mk
+++ b/www/nginx-devel/version.mk
@@ -1 +1 @@
-NGINX_VERSION=	1.29.5
+NGINX_VERSION=	1.29.7