CVS commit: [pkgsrc-2026Q2] pkgsrc/www/nginx

["Maya Rashish" <maya%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   maya
Date:           Sat Aug  1 20:33:28 UTC 2026

Modified Files:
        pkgsrc/www/nginx [pkgsrc-2026Q2]: Makefile distinfo

Log Message:
Pullup ticket #7207 - requested by taca
www/nginx: Security fix

Revisions pulled up:
- www/nginx/Makefile                                            1.195
- www/nginx/distinfo                                            1.144

---
   Module Name: pkgsrc
   Committed By:        kim
   Date:                Tue Jul 21 03:42:05 UTC 2026

   Modified Files:
        pkgsrc/www/nginx: Makefile distinfo

   Log Message:
   nginx: Update to 1.30.4

   Changes with nginx 1.30.4                                        15 Jul 2026

       *) Security: heap buffer overflow might occur in a worker process when
          using the map directive with regex matching if the map variable was
          included in a string expression after a capture affected by this map;
          a similar issue might happen when using a non-cacheable variable in a
          string expression (CVE-2026-42533).
          Thanks to Mufeed VH of Winfunc Research and Maxim Dounin.

       *) Security: uninitialized memory access might occur when using unnamed
          regex captures with the "slice" directive or background cache update,
          which could result in worker process memory disclosure or worker
          process termination (CVE-2026-60005).

       *) Security: use-after-free might occur when processing a specially
          crafted proxied backend response with the ngx_http_ssi_filter_module
          (CVE-2026-56434).
          Thanks to P4P3R-HAK.


To generate a diff of this commit:
cvs rdiff -u -r1.193 -r1.193.2.1 pkgsrc/www/nginx/Makefile
cvs rdiff -u -r1.143 -r1.143.2.1 pkgsrc/www/nginx/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/nginx/Makefile
diff -u pkgsrc/www/nginx/Makefile:1.193 pkgsrc/www/nginx/Makefile:1.193.2.1
--- pkgsrc/www/nginx/Makefile:1.193     Thu Jun 18 07:13:08 2026
+++ pkgsrc/www/nginx/Makefile   Sat Aug  1 20:33:28 2026
@@ -1,6 +1,7 @@
-# $NetBSD: Makefile,v 1.193 2026/06/18 07:13:08 kim Exp $
+# $NetBSD: Makefile,v 1.193.2.1 2026/08/01 20:33:28 maya Exp $
 
 DISTNAME=      nginx-1.30.3
+DISTNAME=      nginx-1.30.4
 CATEGORIES=    www
 MASTER_SITES=  https://nginx.org/download/
 DISTFILES=     ${DEFAULT_DISTFILES}

Index: pkgsrc/www/nginx/distinfo
diff -u pkgsrc/www/nginx/distinfo:1.143 pkgsrc/www/nginx/distinfo:1.143.2.1
--- pkgsrc/www/nginx/distinfo:1.143     Thu Jun 18 07:13:08 2026
+++ pkgsrc/www/nginx/distinfo   Sat Aug  1 20:33:28 2026
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.143 2026/06/18 07:13:08 kim Exp $
+$NetBSD: distinfo,v 1.143.2.1 2026/08/01 20:33:28 maya Exp $
 
 BLAKE2s (array-var-nginx-module-0.06.tar.gz) = fa6ad2a2ce3c3eba3f69287b224e9c01fcaca29a083394ab74f2f655d3e2138b
 SHA512 (array-var-nginx-module-0.06.tar.gz) = bc72158856a1be18a26ee04c6b5b0f0a20bcce688610a493bf31e2a133e7eb12e11f7c18197a09a72b1513f6a08348ee5281b9d5b84cf43603539040ebd23c26
@@ -27,9 +27,9 @@ Size (naxsi-1.7-src-with-deps.tar.gz) = 
 BLAKE2s (nchan-1.3.7.tar.gz) = 27da0a52c9123186a321a01b02cb004eed0623110aafa6737dd43ceeff766010
 SHA512 (nchan-1.3.7.tar.gz) = 585c6f9107b84354e7f6c587f85cf554dd5c213b1e3baa75e0aee0b28520afb9cffff1812c32e81541a1f25773fc58d1b92ce6bd9d85accc12f37841633eb79b
 Size (nchan-1.3.7.tar.gz) = 665133 bytes
-BLAKE2s (nginx-1.30.3.tar.gz) = 45fe49e808e53478340bf7a269c18bd6ab732c5d4476321e2f96b71cc416f640
-SHA512 (nginx-1.30.3.tar.gz) = 13b479cb2e80bbe7e0b977bd762e70b0cb95c7ce5dc80da61ab59fbcf2da19eca266dc82a8ef1a8b8c8c19c22948abd1aa6a3817bf490880ae175f7e2f692495
-Size (nginx-1.30.3.tar.gz) = 1325830 bytes
+BLAKE2s (nginx-1.30.4.tar.gz) = a9cd2bc11e5b6e41d03a367990908a648e074175f7471c14bbdeec6cf0b55b75
+SHA512 (nginx-1.30.4.tar.gz) = 48c21de65fa188137a4088d02c28e2533a7164040bf19281637e025012e6d03afcacb0ee15463a107685a2a221037f24ce15fc89c46b6f7a36b94443d3993bf1
+Size (nginx-1.30.4.tar.gz) = 1328314 bytes
 BLAKE2s (nginx-dav-ext-module-3.0.0.tar.gz) = 8e823ffd605d4fca00eb3ca92a0954ca35fb178397e0b990fea7d47580ee582f
 SHA512 (nginx-dav-ext-module-3.0.0.tar.gz) = d0193ba90f1ef46c4e470630c4394bdf99d94fd2e3bd8be6cb2ba1655ec59944b1269025f032b79dc2c6dad366e54389ef6a6da2ddeb91d535a4027f2162fbde
 Size (nginx-dav-ext-module-3.0.0.tar.gz) = 14558 bytes