CVS commit: pkgsrc/www/nginx

["Kimmo Suominen" <kim%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   kim
Date:           Thu Oct 15 18:49:40 UTC 2026

Modified Files:
        pkgsrc/www/nginx: Makefile distinfo

Log Message:
nginx: Update to 1.30.6

Changes with nginx 1.30.6                                        14 Oct 2026

    *) Security: a buffer overflow might occur in a worker process when
       using the "alias" directive if the request URI was changed by the
       "rewrite" directive and was then mapped to a file path
       (CVE-2026-15176).

    *) Security: a buffer overflow might occur in a worker process while
       evaluating string expressions with variables, which affected the
       document root calculation and request logging in the http and stream
       modules (CVE-2026-93479).
       Thanks to Matt Suiche of Tolmo Inc.

    *) Security: when using HTTP/3 a part of an unknown frame might be
       treated as the request body, which might result in bypassing the
       "client_max_body_size" limit or injecting data in the proxied request
       (CVE-2026-95101).
       Thanks to Hansol Lee of GOTROOT.

    *) Security: when using TLS session ticket key rotation, one of the keys
       was left uninitialized, which might allow to forge a session
       (CVE-2026-97629).
       Thanks to PhiNode Labs.

    *) Security: when using asynchronous file I/O (AIO), use-after-free
       might occur in certain configurations if the SSI page has "include
       virtual" commands (CVE-2026-97205).
       Thanks to cyberlancer.

    *) Change: the logging level of the "invalid alert" and "record layer
       failure" SSL errors, and of the "SSL alert number N" for any alert
       numbers has been lowered from "crit" to "info".

    *) Bugfix: a segmentation fault might occur in a worker process or
       "request count is zero" alerts might appear in logs if the
       "X-Accel-Redirect" header line was cached and the cached response was
       then served to a client.
       Thanks to Jiří Setnička and Maxim Dounin.

    *) Bugfix: a segmentation fault might occur in a worker process if the
       ngx_http_dav_module was used to handle COPY and MOVE methods in a
       location with the "alias" directive.
       Thanks to Maxim Dounin.

    *) Bugfix: a segmentation fault might occur while reading configuration
       if the "geo" directive with the "ranges" parameter was used and the
       corresponding binary base file was corrupted.

    *) Bugfix: use-after-free might occur in a worker process if proxying
       with buffering was used and an error occurred while sending the
       response to an HTTP/2 client.

    *) Bugfix: a worker process might not exit or "accept4() failed (9: Bad
       file descriptor)" alerts might appear in logs if the worker process
       ran out of file descriptors before graceful shutdown.

    *) Bugfix: a segmentation fault might occur in a worker process if the
       "select" method was used.

    *) Bugfix: in binary compatibility with third-party modules using script
       codes; the bug had appeared in 1.30.4.

    *) Bugfix: in the ngx_http_perl_module.
       Thanks to Maxim Dounin.

    *) Bugfix: in flow control in the ngx_http_v2_module.

    *) Bugfix: "[error] upstream sent frame for unknown stream" and "[crit]
       cache file ... contains invalid header" messages might appear in logs
       when sending a cached HTTP/2 response in the ngx_http_proxy_v2_module
       if the "proxy_cache_revalidate" directive was used.

    *) Bugfix: IPv6 fragmentation might not be disabled when using QUIC on
       some operating systems.

    *) Bugfix: in the ngx_http_auth_basic_module on Solaris.

    *) Bugfixes in HTTP/3, ngx_http_image_filter_module,
       ngx_http_slice_module, and ngx_http_memcached_module.


To generate a diff of this commit:
cvs rdiff -u -r1.199 -r1.200 pkgsrc/www/nginx/Makefile
cvs rdiff -u -r1.145 -r1.146 pkgsrc/www/nginx/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/nginx/Makefile
diff -u pkgsrc/www/nginx/Makefile:1.199 pkgsrc/www/nginx/Makefile:1.200
--- pkgsrc/www/nginx/Makefile:1.199     Tue Sep 29 06:08:07 2026
+++ pkgsrc/www/nginx/Makefile   Thu Oct 15 18:49:39 2026
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.199 2026/09/29 06:08:07 wiz Exp $
+# $NetBSD: Makefile,v 1.200 2026/10/15 18:49:39 kim Exp $
 
-DISTNAME=      nginx-1.30.5
-PKGREVISION=   2
+DISTNAME=      nginx-1.30.6
 CATEGORIES=    www
 MASTER_SITES=  https://nginx.org/download/
 DISTFILES=     ${DEFAULT_DISTFILES}

Index: pkgsrc/www/nginx/distinfo
diff -u pkgsrc/www/nginx/distinfo:1.145 pkgsrc/www/nginx/distinfo:1.146
--- pkgsrc/www/nginx/distinfo:1.145     Wed Sep 16 10:36:51 2026
+++ pkgsrc/www/nginx/distinfo   Thu Oct 15 18:49:39 2026
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.145 2026/09/16 10:36:51 kim Exp $
+$NetBSD: distinfo,v 1.146 2026/10/15 18:49:39 kim Exp $
 
 BLAKE2s (array-var-nginx-module-0.06.tar.gz) = fa6ad2a2ce3c3eba3f69287b224e9c01fcaca29a083394ab74f2f655d3e2138b
 SHA512 (array-var-nginx-module-0.06.tar.gz) = bc72158856a1be18a26ee04c6b5b0f0a20bcce688610a493bf31e2a133e7eb12e11f7c18197a09a72b1513f6a08348ee5281b9d5b84cf43603539040ebd23c26
@@ -27,9 +27,9 @@ Size (naxsi-1.7-src-with-deps.tar.gz) = 
 BLAKE2s (nchan-1.3.7.tar.gz) = 27da0a52c9123186a321a01b02cb004eed0623110aafa6737dd43ceeff766010
 SHA512 (nchan-1.3.7.tar.gz) = 585c6f9107b84354e7f6c587f85cf554dd5c213b1e3baa75e0aee0b28520afb9cffff1812c32e81541a1f25773fc58d1b92ce6bd9d85accc12f37841633eb79b
 Size (nchan-1.3.7.tar.gz) = 665133 bytes
-BLAKE2s (nginx-1.30.5.tar.gz) = 237c8db3b063b174045fd960be5c8156101f17923f66bd4f6ce0c942aaa5eb85
-SHA512 (nginx-1.30.5.tar.gz) = 0e36c27b1a2c3c7f38b73990cef615c59f300ef1bd473a5ed23d5f89ff4e8cd51ca63754430a5dfe4fdaf48ed9eb64a3d74b0bf9a80226f700f99d1d2fa9000d
-Size (nginx-1.30.5.tar.gz) = 1328600 bytes
+BLAKE2s (nginx-1.30.6.tar.gz) = 78e41ca15d6a63eceaeefe4fe05955793807a8fd42935eea2a99b6f49cdbc348
+SHA512 (nginx-1.30.6.tar.gz) = 1b04fcb5a7ee3df573b1a0d792cf1f1cfc02d30d03592f2f04b2b2842d9f42364957f4420e53af380b9fffd5eb4a3a5c11f6d71643168db25baeea748cf94fa2
+Size (nginx-1.30.6.tar.gz) = 1331698 bytes
 BLAKE2s (nginx-dav-ext-module-3.0.0.tar.gz) = 8e823ffd605d4fca00eb3ca92a0954ca35fb178397e0b990fea7d47580ee582f
 SHA512 (nginx-dav-ext-module-3.0.0.tar.gz) = d0193ba90f1ef46c4e470630c4394bdf99d94fd2e3bd8be6cb2ba1655ec59944b1269025f032b79dc2c6dad366e54389ef6a6da2ddeb91d535a4027f2162fbde
 Size (nginx-dav-ext-module-3.0.0.tar.gz) = 14558 bytes