CVS commit: pkgsrc/www/freenginx-devel

["Sergey A. Osokin" <osa%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   osa
Date:           Fri Oct 16 14:09:55 UTC 2026

Modified Files:
        pkgsrc/www/freenginx-devel: Makefile distinfo options.mk
        pkgsrc/www/freenginx-devel/patches: extra-patch-njs-quickjs

Log Message:
www/freenginx-devel: update njs 1.0.1 -> 1.0.2

Bump PKGREVISION.

Sponsored by:   tipi.work

<ChangeLog>

nginx modules:

*) Bugfix: fixed response body framing and keepalive connection reuse
   in ngx.fetch().  Responses with conflicting Content-Length fields,
   with both Transfer-Encoding and Content-Length, or with 1xx status
   codes are now rejected.

*) Bugfix: fixed enforcement of max_response_body_size for chunked
   responses in ngx.fetch().

*) Bugfix: fixed parsing of js_periodic options following
   worker_affinity in HTTP and Stream configurations.

*) Bugfix: fixed memory leaks and false unhandled promise rejection
   reports when formatting rejection reasons in the QuickJS engine.

Core:

*) Security: fixed a memory leak when parsing malformed XML in the
   njs engine.  Repeated malformed input could exhaust worker process
   memory.

*) Security: fixed incomplete XML attribute values containing entity
   references.  JavaScript accessors could return values different
   from those used by XML canonicalization, affecting signed XML
   validation.

*) Feature: added XMLNode.getAttributeNS() and XMLNode.getChildNS()
   methods for namespace-aware attribute and child element lookup.

*) Improvement: reduced compilation memory consumption in the njs
   engine and released temporary parser and generator data after
   compilation.

*) Improvement: switched to constant-time HMAC signature verification
   in WebCrypto.

*) Change: XML node mutation and canonicalization now reject detached
   nodes, and a removed child node has an undefined $parent.
   Text and attribute values must be primitive strings; null and
   undefined retain their deletion semantics for these values.
   addChild() and $tags reject source trees with namespaces.
   Assigning to $tag$name now throws TypeError in the QuickJS engine;
   deletion is still supported.

*) Change: the "test262" make target was renamed to "js_test".
   The "test262" target now runs the official Test262 suite and
   requires NJS_TEST262_DIR.

*) Bugfix: fixed stale XML node references after tree mutations and
   a crash when repeatedly modifying a node in the QuickJS engine.

*) Bugfix: fixed XML node methods being hidden by child elements with
   matching names in the QuickJS engine.

*) Bugfix: fixed XML document leaks during property existence checks
   in the QuickJS engine.

*) Bugfix: fixed out-of-bounds reads and invalid frees when formatting
   unhandled promise rejection reasons in the QuickJS shell.

*) Bugfix: fixed crashes and incorrect error reporting when importing
   modules after a failed module compilation in the njs engine.

*) Bugfix: fixed oversized Buffer allocation lengths being truncated
   instead of rejected in the QuickJS engine.

*) Bugfix: fixed use of invalidated zlib dictionary memory during
   argument conversion in the QuickJS engine.

*) Bugfix: fixed UTC Date setters applying the local timezone offset
   in the njs engine.

*) Bugfix: fixed Promise.any() with empty input resolving with
   AggregateError instead of rejecting in the njs engine.

*) Bugfix: fixed excessive execution time and memory consumption in
   Array.prototype.sort() with huge sparse arrays in the njs engine.
   This closes #1095 issue on Github.

*) Bugfix: fixed Array.prototype.concat() with sparse arrays in the
   njs engine.
   This closes #1095 issue on Github.

*) Bugfix: fixed initialization of array literals with more than
   32760 elements in the njs engine.

*) Bugfix: fixed invalid memory accesses when enumerating typed arrays
   with Object.values() and Object.entries() in the njs engine.
   This closes #1098 issue on Github.

*) Bugfix: fixed invalid memory accesses in Object.defineProperty()
   with reentrant property descriptors in the njs engine.
   This closes #1089 issue on Github.

*) Bugfix: fixed object-to-primitive conversion when user code
   replaced the input value during conversion in the njs engine.
   This closes #1094 issue on Github.

*) Bugfix: fixed memory corruption in RegExp replace and split
   operations with custom exec() results in the njs engine.
   This closes #1090, #1091, #1092, #1093, #1096, and #1097 issues
   on Github.

*) Bugfix: fixed out-of-bounds reads in RegExp replacement with
   inconsistent match objects in the njs engine.
   Thanks to Basavaraj S m.

*) Bugfix: fixed out-of-bounds reads in RegExp named capture lookup
   in the njs engine.
   This closes #1088 issue on Github.

*) Bugfix: fixed parsing of for loop initializers and preservation of
   lexical bindings across nested declarations in the njs engine.

*) Bugfix: prevented stack overflow when compiling deeply nested
   expressions in the njs engine by limiting recursive analysis.

</ChangeLog>


To generate a diff of this commit:
cvs rdiff -u -r1.24 -r1.25 pkgsrc/www/freenginx-devel/Makefile
cvs rdiff -u -r1.18 -r1.19 pkgsrc/www/freenginx-devel/distinfo
cvs rdiff -u -r1.10 -r1.11 pkgsrc/www/freenginx-devel/options.mk
cvs rdiff -u -r1.2 -r1.3 \
    pkgsrc/www/freenginx-devel/patches/extra-patch-njs-quickjs

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/freenginx-devel/Makefile
diff -u pkgsrc/www/freenginx-devel/Makefile:1.24 pkgsrc/www/freenginx-devel/Makefile:1.25
--- pkgsrc/www/freenginx-devel/Makefile:1.24    Tue Sep 29 06:08:04 2026
+++ pkgsrc/www/freenginx-devel/Makefile Fri Oct 16 14:09:55 2026
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.24 2026/09/29 06:08:04 wiz Exp $
+# $NetBSD: Makefile,v 1.25 2026/10/16 14:09:55 osa Exp $
 
 DISTNAME=      freenginx-1.31.4
 PKGNAME=       ${DISTNAME:S/-/-devel-/1}
-PKGREVISION=   3
+PKGREVISION=   4
 CATEGORIES=    www
 MASTER_SITES=  https://freenginx.org/download/
 DISTFILES=     ${DEFAULT_DISTFILES}

Index: pkgsrc/www/freenginx-devel/distinfo
diff -u pkgsrc/www/freenginx-devel/distinfo:1.18 pkgsrc/www/freenginx-devel/distinfo:1.19
--- pkgsrc/www/freenginx-devel/distinfo:1.18    Wed Sep  2 17:28:16 2026
+++ pkgsrc/www/freenginx-devel/distinfo Fri Oct 16 14:09:55 2026
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.18 2026/09/02 17:28:16 osa Exp $
+$NetBSD: distinfo,v 1.19 2026/10/16 14:09:55 osa Exp $
 
 BLAKE2s (array-var-nginx-module-0.06.tar.gz) = fa6ad2a2ce3c3eba3f69287b224e9c01fcaca29a083394ab74f2f655d3e2138b
 SHA512 (array-var-nginx-module-0.06.tar.gz) = bc72158856a1be18a26ee04c6b5b0f0a20bcce688610a493bf31e2a133e7eb12e11f7c18197a09a72b1513f6a08348ee5281b9d5b84cf43603539040ebd23c26
@@ -42,9 +42,9 @@ Size (ngx_devel_kit-0.3.4.tar.gz) = 6647
 BLAKE2s (ngx_http_geoip2_module-3.4.tar.gz) = eb14ed670788d4cc46037719ebab29e1c0da53cadbb0da10198e76255d924273
 SHA512 (ngx_http_geoip2_module-3.4.tar.gz) = 18dea21e5ae2647bea1fc448058a1b773c936917245edef8d861d5e23ed92e9a3b1ec4ef43ffb2ece7b5899d787910adcf4fbd39f84d7e8d7c54759e2fee5b72
 Size (ngx_http_geoip2_module-3.4.tar.gz) = 8877 bytes
-BLAKE2s (njs-1.0.1.tar.gz) = 4ddfe3a7d363d65023b6e2e5d26fdeca11fc53988ddf47fb39bf7eb60988be44
-SHA512 (njs-1.0.1.tar.gz) = 4531873957ec947e7e4c36d2713efff624aead0de1f3a8978efd3a06c1fdfd07fc848dcfb4cb284149b5ed91ba3f00030fe49c17f5d1aabda7efc1d38da31bda
-Size (njs-1.0.1.tar.gz) = 1003218 bytes
+BLAKE2s (njs-1.0.2.tar.gz) = f0485b46f5062e07e4227ea826979163c67b874aa96b46137ae348e36f6728ef
+SHA512 (njs-1.0.2.tar.gz) = 17e81d8f2247d1fd593b1949c5c966fbf784378c4665051527c27578ec0ea374ab6efb6c5da93f69b38fa125bdfd4db55e749e522f527eb9b42daa6b74563055
+Size (njs-1.0.2.tar.gz) = 1071822 bytes
 BLAKE2s (openresty-echo-nginx-module-b0f344b_GH.tar.gz) = e1ed241e7d3e57024f666bc8489f83575664121a01ef9424b7d7bf4a1f8cdc3f
 SHA512 (openresty-echo-nginx-module-b0f344b_GH.tar.gz) = ef5150094fda342eec018273eb312b16fb7731474e96865374c98dafe7a507fcf9c7e5fd2766d3296afb11e0348e4b20a973d20303052a71bdec7c92bd088d38
 Size (openresty-echo-nginx-module-b0f344b_GH.tar.gz) = 53548 bytes

Index: pkgsrc/www/freenginx-devel/options.mk
diff -u pkgsrc/www/freenginx-devel/options.mk:1.10 pkgsrc/www/freenginx-devel/options.mk:1.11
--- pkgsrc/www/freenginx-devel/options.mk:1.10  Wed Sep  2 17:21:26 2026
+++ pkgsrc/www/freenginx-devel/options.mk       Fri Oct 16 14:09:55 2026
@@ -1,4 +1,4 @@
-# $NetBSD: options.mk,v 1.10 2026/09/02 17:21:26 osa Exp $
+# $NetBSD: options.mk,v 1.11 2026/10/16 14:09:55 osa Exp $
 
 CODELOAD_SITE_GITHUB=          https://codeload.github.com/
 
@@ -387,7 +387,7 @@ PLIST.rtmp=         yes
 .endif
 
 .if !empty(PKG_OPTIONS:Mnginx-njs) || make(makesum) || make(mdi) || make(distclean)
-NJS_VERSION=           1.0.1
+NJS_VERSION=           1.0.2
 NJS_DISTNAME=          njs-${NJS_VERSION}
 NJS_DISTFILE=          ${NJS_DISTNAME}.tar.gz
 SITES.${NJS_DISTFILE}= -${MASTER_SITE_GITHUB:=nginx/njs/archive/}${NJS_VERSION}.tar.gz

Index: pkgsrc/www/freenginx-devel/patches/extra-patch-njs-quickjs
diff -u pkgsrc/www/freenginx-devel/patches/extra-patch-njs-quickjs:1.2 pkgsrc/www/freenginx-devel/patches/extra-patch-njs-quickjs:1.3
--- pkgsrc/www/freenginx-devel/patches/extra-patch-njs-quickjs:1.2      Wed Sep  2 17:21:26 2026
+++ pkgsrc/www/freenginx-devel/patches/extra-patch-njs-quickjs  Fri Oct 16 14:09:55 2026
@@ -1,5 +1,5 @@
---- ../njs-1.0.1/auto/quickjs.orig     2026-06-23 11:18:04.000000000 -0400
-+++ ../njs-1.0.1/auto/quickjs  2026-06-28 13:23:46.299804429 -0400
+--- ../njs-1.0.2/auto/quickjs.orig     2026-06-23 11:18:04.000000000 -0400
++++ ../njs-1.0.2/auto/quickjs  2026-06-28 13:23:46.299804429 -0400
 @@ -42,9 +42,9 @@
      fi
  
@@ -13,8 +13,8 @@
  
          . auto/feature
      fi
---- ../njs-1.0.1/nginx/config.orig     2026-06-28 13:01:43.273373787 -0400
-+++ ../njs-1.0.1/nginx/config  2026-06-28 13:02:46.754225650 -0400
+--- ../njs-1.0.2/nginx/config.orig     2026-06-28 13:01:43.273373787 -0400
++++ ../njs-1.0.2/nginx/config  2026-06-28 13:02:46.754225650 -0400
 @@ -60,8 +60,8 @@
      fi