CVS commit: pkgsrc/net/haproxy

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Sat Aug  1 13:48:09 UTC 2026

Modified Files:
        pkgsrc/net/haproxy: Makefile distinfo

Log Message:
haproxy: updated to 3.4.3

3.4.3
- BUG/MEDIUM: h3: fix parser desync on error with multiple frames
- BUG/MINOR: mux_quic: prevent multiple STOP_SENDING emission per stream
- BUILD: quic: workaround a gcc bug saying "maybe used uninitialized" when USE_TRACE=0
- CLEANUP: traces: get rid of a few rare empty args in TRACE calls
- MINOR: compiler: add a macro to ignore all arguments
- MINOR: trace: always pretend to use args when disabled
- BUG/MINOR: trace/quic_frame: use buf, not trace_buf in chunk_frm_appendf()
- BUG/MEDIUM: mux_quic: do not free QCS if STOP_SENDING to sent
- MINOR: mux_quic: use separate error code for STOP_SENDING
- BUG/MEDIUM: mux_quic: complete stream shutdown for read channel
- BUG/MINOR: quic: ignore STREAM after MUX closure on BE side
- BUG/MEDIUM: fd: Fix a deadlock when closing other tgroups fds
- BUG/MEDIUM: tcpcheck: Add proxy used for healthcheck sections in proxies list
- BUG/MINOR: sample: Fix a possible underflow on be2hex for large chunk size
- MINOR: chunks: Add function to get a large/regular chunk depending on a buffer
- BUG/MEDIUM: chunk: Review chunks usage to not retrieve a large buffer by error
- MINOR: htx: Add a field to save the headers data size
- MEDIUM: htx: Be sure size of headers never exceed regular buffer on update
- BUG/MINOR: stream: Fix custom timeouts initialization when setting backend
- REGTESTS: Improve script testing the set-timeout action
- BUG/MINOR: stream: Fix custom max-retries initialization when setting backend
- BUG/MINOR: http-conv: Make url-dec failed if no space for trailing null byte
- MINOR: haterm: add note about QUIC usage on SSL port
- BUG/MINOR: hlua: Apply socket timeout on server side only
- BUG/MEDIUM: applet: Reenable reads in applet context if requesting a connection
- MINOR: stats: factor the proxy vs scope check into its own function
- BUG/MEDIUM: stats: subject "stats admin" accesses to "stats scope" filtering
- BUG/MINOR: shctx: fix shctx_row_data_get() when offset exceeds a block
- MINOR: shctx: clamp shctx_row_data_get() reads against the offset
- DOC: stats: document the per-proxy byte count fields in the CSV list
- BUG/MEDIUM: cache: reattach the row when a secondary entry is incomplete
- BUG/MEDIUM: stats: Ensure that Origin is valid on POSTs
- DOC: stats: Document that stats admin is vulnerable to a CSRF attack
- BUG/MEDIUM: ssl-gencert: Don't forget to free memory when done
- BUG/MEDIUM: protobuf: adjust sample size capacity after pointer shift
- BUG/MEDIUM: protobuf: fix nested path bypass in field lookup
- BUG/MINOR: ssl: fix proxy lookup for show ssl sni
- REGTESTS: protobuf: add regression test for nested vs flat paths
- BUG/MINOR: mux-h1: Don't delay send if message with c-l was fully sent
- BUG/MEDIUM: net-helper: Adjust sample size capacity after pointer shift
- BUG/MEDIUM: sample: Adjust sample size capacity after pointer shift for bytes()
- BUG/MEDIUM: sample: Adjust sample size capacity after pointer shift for ltrim()
- BUG/MINOR: sample: Fix bytes() when length it greater than remaining data
- DOC: fix typo in "del ssl ech" command
- DOC: remove outdated experimental mention on dynamic backends
- BUG/MEDIUM: proxy: protect "show servers ..." against server deletion
- BUG/MEDIUM: proxy: protect "show servers ..." against backend deletion
- BUG/MEDIUM: proxy: protect show backend against be deletion
- BUG/MEDIUM: server: Properly check for streams before deletion
- BUG/MINOR: resolvers: do not index resolvers names in the proxies
- BUG/MEDIUM: proxy: protect "show errors" against backend deletion
- BUG/MEDIUM: ssl: Spell HAVE_VANILLA_OPENSSL correctly
- BUG/MEDIUM: ssl: Handle non-application data record while splicing
- DEBUG: fd: catch access attempts to closed FDs
- REORG: h1-htx: Move h1 headers map in h1-htx
- BUG/MEDIUM: mux-h1: Always adjust case for all outgoing headers as expected
- BUG/MINOR: http-htx: fix the length moved when removing a header value
- BUG/MEDIUM: http-fetch: don't parse a non-HTTP check buffer as an HTX message
- BUG/MEDIUM: http-fetch: reject a negative capture id in capture.{req,res}.hdr
- BUG/MINOR: http-fetch: fix a NULL channel dereference in smp_fetch_body()
- BUG/MINOR: http: fix an out-of-bounds read in http_get_host_port() on empty host
- BUG/MINOR: http-htx: check the trash allocation in http_scheme_based_normalize()
- BUG/MINOR: h1: report the right error position on authority/host mismatch
- BUG/MINOR: h2: don't use a block pointer to roll back a partial HTX conversion
- BUG/MINOR: h3: don't use a block pointer to roll back a partial HTX conversion
- BUG/MINOR: http-ana: fix a one-byte over-read in the client-side cookie parser
- BUG/MINOR: http-act: fix a double free of the regex on a rule parsing error
- BUG/MINOR: http-act: fix a double free of the map reference on a parsing error
- BUG/MINOR: http-act: restore the response buffer state in the early-hint action
- BUG/MINOR: http-act: work on a copy of the sample in del-headers-bin
- BUG/MINOR: http-act: reject a negative capture id in the capture actions
- BUG/MINOR: http-htx: check the strdup() of the "lf-string" http reply argument
- BUG/MEDIUM: tools: make string encoding possible to fail instead of truncating
- BUG/MINOR: htx: Perform raw copy for messages of same size in htx_copy_msg()
- BUG/MINOR: htx: Transfer HTX_FL_EOM flag on success in htx_append_msg()
- BUG/MINOR: http-rules: fix release of a failed "set-cookie-fmt" redirect rule
- BUG/MINOR: slz: do not read past the end of the input around the match loop
- CLEANUP: slz: fix the documented worst case size of flush() and finish()
- BUG/MINOR: slz: use the exact switch cost for the last literals of a block
- BUG/MEDIUM: slz: bound the bits wasted by the 9-bit literals
- BUG/MINOR: slz: do not append a block to an already finished stream
- BUG/MINOR: slz: fix the adler32 accumulators signedness on 32-bit
- BUG/MINOR: slz: avoid undefined shifts when building the word byte by byte
- CLEANUP: slz: clarify that the size promise applies to the stream, not to a call
- MEDIUM: ssl: Add a way to rate-limit TLSv1.3 KeyUpdate
- DOC: ssl: Document tune.ssl.keyupdate-rate-limit
- BUG/MEDIUM: ssl: Put CO_ER_SSL_KEYUPDATE at the right place
- BUILD: ssl: Do not use SSL3_MT_KEY_UPDATE, hardcode 24 instead
- BUG/MEDIUM: peers: check the available room before encoding dict values
- BUG/MEDIUM: sample: reject the deprecated protobuf group wire types
- BUG/MAJOR: ssl/ocsp: lock the OCSP response around reads in the stapling callback
- MINOR: server: improve parsing error for server-template
- BUG/MINOR: server: fix QUIC on server-template
- BUG/MINOR: server: duplicate server alt_proto in srv_settings_cpy()
- BUG/MINOR: server: fix check reuse-pool in srv_settings_cpy()
- IMPORT: cebtree: private: fix the duplicate detection in the lookup shortcut


To generate a diff of this commit:
cvs rdiff -u -r1.161 -r1.162 pkgsrc/net/haproxy/Makefile
cvs rdiff -u -r1.152 -r1.153 pkgsrc/net/haproxy/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/net/haproxy/Makefile
diff -u pkgsrc/net/haproxy/Makefile:1.161 pkgsrc/net/haproxy/Makefile:1.162
--- pkgsrc/net/haproxy/Makefile:1.161   Fri Jul  3 13:53:34 2026
+++ pkgsrc/net/haproxy/Makefile Sat Aug  1 13:48:09 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.161 2026/07/03 13:53:34 adam Exp $
+# $NetBSD: Makefile,v 1.162 2026/08/01 13:48:09 adam Exp $
 
-DISTNAME=      haproxy-3.4.2
+DISTNAME=      haproxy-3.4.3
 CATEGORIES=    net www
 MASTER_SITES=  https://www.haproxy.org/download/${PKGVERSION_NOREV:R}/src/
 

Index: pkgsrc/net/haproxy/distinfo
diff -u pkgsrc/net/haproxy/distinfo:1.152 pkgsrc/net/haproxy/distinfo:1.153
--- pkgsrc/net/haproxy/distinfo:1.152   Fri Jul  3 13:53:34 2026
+++ pkgsrc/net/haproxy/distinfo Sat Aug  1 13:48:09 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.152 2026/07/03 13:53:34 adam Exp $
+$NetBSD: distinfo,v 1.153 2026/08/01 13:48:09 adam Exp $
 
-BLAKE2s (haproxy-3.4.2.tar.gz) = 1c7a0d97f41107b257636ec877523ed93196fd4190a50a2001906fdc230c7a85
-SHA512 (haproxy-3.4.2.tar.gz) = b3b66bff9ca8f183f8c7fd0f2516ea8d391c4a7c23c54ba8546bb829b17b457113e14d08c85269ce47f91449814bd5054ebe2b793414d3163ef692040986dcef
-Size (haproxy-3.4.2.tar.gz) = 5472656 bytes
+BLAKE2s (haproxy-3.4.3.tar.gz) = e5f2eef5707e9db2e3445cf518446e9db52b4e7cd405f14305f24eeedf6dabf0
+SHA512 (haproxy-3.4.3.tar.gz) = 05fa67d437814618ab8474cc36b9e81aa3c24c4eb644a36870495ccf48e70ff667ef6a752f0bc8ec508cc12b886cef5b9c1a235f78dcc3578c930a1b88ce065c
+Size (haproxy-3.4.3.tar.gz) = 5485483 bytes
 SHA1 (patch-include_haproxy_proxy-t.h) = 7aab2e32aacff45e7a2a0d6a48550b72d1fe7619
 SHA1 (patch-include_haproxy_queue-t.h) = a9f41857d66037b3f66f8d43090dab2d06c7bfb2
 SHA1 (patch-include_haproxy_queue.h) = eed5ea43212462134fb60b50c2a32e619e104d51