CVS commit: pkgsrc/www/goaccess

["Thomas Merkel" <tm%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   tm
Date:           Mon Oct 19 07:36:19 UTC 2026

Modified Files:
        pkgsrc/www/goaccess: Makefile PLIST distinfo
Added Files:
        pkgsrc/www/goaccess/patches: patch-src_wsauth.c

Log Message:
goaccess: update to 1.12

Changes to GoAccess 1.12 - Wednesday, September 16, 2026

  - Added a dedicated "AI Crawlers" browser category, separating AI assistants
    and model training bots from traditional search engine crawlers.
  - Added a Fediverse browser category for identifiable ActivityPub server
    traffic, separating it from traditional web crawlers.
  - Added a live requests-per-second rate alongside total requests in the
    terminal and HTML reports while following logs, and exposed it through the
    WebSocket JSON output.
  - Added a warning when restoring databases that predate request-grouping
    metadata, and rejected restores whose `--http-method` or `--http-protocol`
    settings no longer match the ones the database was created with.
  - Added `--exclude-asn` to exclude requests whose client address resolves to
    a given Autonomous System Number. It can be repeated, accepts either 8075
    or AS8075, and requires a GeoIP2 ASN database.
  - Added resolved, total and pending hostname metrics to the progress display
    when resolving IP addresses for static output.
  - Added the negotiated TLS key exchange group via `%g`, nested beneath its
    cipher suite in the TLS panel.
  - Added `VCOMBINED_PORT` and `VCOMMON_PORT` predefined log formats for
    virtual host logs that carry a colon-delimited port.
  - Documented `--concat-vhost-req` and `--unix-socket`, which were accepted
    but missing from the man page and the `--help` output.
  - Fixed a shutdown race that could leave WebSocket server threads running.
  - Fixed crawler filtering skipping bots whose operating system could not be
    determined.
  - Fixed panel sorting not being initialized for panels rendered after the
    initial load of the HTML report.
  - Fixed the globe projection not centering on an expanded continent, while
    preserving the current zoom level and manual rotation.
  - Fixed the printf format used for `size_t` values in bin2c, which warned on
    32-bit platforms.
  - Fixed the same log source being processed twice when it was passed more
    than once through different paths.
  - Fixed the spinner falling out of sync with the progress output while
    resolving hostnames.
  - Fixed user agent classification, correcting the Applebot spelling and
    giving HTTP library and uptime signatures precedence over broader fallback
    tokens.
  - Fixed `VCOMBINED` and `VCOMMON` requiring a port after the virtual host,
    which prevented logs without one from being parsed.
  - Fixed WebSocket text frames being parsed as null-terminated strings rather
    than by payload length.
  - Hardened WebSocket authentication by tracking the verified JWT `exp` claim
    and closing the connection once the token expires, and by clearing browser
    credentials when a token refresh fails or returns an unusable token.
  - Refined subitem indentation in the HTML report with a more compact layout
    and subtle tree guides.
  - Removed the deprecated `--no-column-names` from the `--help` output and
    the sample configuration, where it lingered after being dropped in v1.10.
  - Replaced the keyphrases panel with a UTM Campaigns panel reporting
    `utm_source`, `utm_medium`, `utm_campaign`, `utm_content` and `utm_term`.
  - Updated operating system detection, adding iPadOS, visionOS, watchOS,
    tvOS, KaiOS, Fuchsia, Xbox and Windows Phone.
  - Updated the Caddy predefined format to match the current JSON access log
    structure.
  - Updated the CloudFront predefined format to the current standard log
    schema, capturing the query string, virtual host and TLS fields while
    safely ignoring newer trailing fields.

Changes to GoAccess 1.11 - Sunday, July 19, 2026

  - Added automatic, crash-safe migration of persisted databases to storage
    format version 3.
  - Added configured zlib and AddressSanitizer options to the version output.
  - Added fullscreen expand and collapse controls to geolocation maps in the
    HTML report.
  - Added Traditional Chinese translation.
  - Expanded Debian package builds to Ubuntu 26.04 and additional
    architectures, and updated the packaging workflow actions.
  - Fixed a heap buffer overflow when parsing malformed Opera user agents.
  - Fixed an infinite loop while writing log parsing errors from multiple input
    files.
  - Fixed city lookups ignoring the City database when a Country database was
    listed first.
  - Fixed geolocation maps appearing grey after restoring persisted city data.
    New databases preserve the exact country-to-continent mapping, while older
    databases use a compatible built-in fallback.
  - Fixed `.gz` file extensions being interpreted as macros in the man page.
  - Fixed iOS version parsing from user-agent strings.
  - Fixed unique visitor undercounting caused by collisions between reversed
    data and visitor key pairs.
  - Fixed WebSocket payload size checks for large and fragmented messages.
  - Grouped Lynx, Links, ELinks, w3m and Chawan under a new "Text-based"
    browser category.
  - Reduced storage memory usage by about 20% and parsing time by about 35%.

Changes to GoAccess 1.10.2 - Tuesday, March 31, 2026

  - Added detection for Arc and Zen browsers in the HTML report.
  - Added Georgian translation.
  - Fixed a crash caused by invalid country/city parsing from the GeoIP
    database.
  - Fixed empty string data field crashing the HTML report on initial page
    load when entries contain no Referer, unknown UA strings, missing Host
    headers, or unresolvable GeoIP locations.
  - Fixed relative paths not being resolved to absolute paths while ingesting
    data.
  - Fixed old local stored preference objects not being validated on load,
    preventing corrupted localStorage from breaking the UI.

Changes to GoAccess 1.10.1 - Saturday, February 14, 2026

  - Fixed a crash when restoring persisted data via `--restore` that contained
    GEOLOCATION data generated in versions ≤ v1.9.4 and loaded with v1.10.

Changes to GoAccess 1.10 - Wednesday, February 11, 2026

  - Added new bar charts to the terminal UI for a quicker visual read of
    metrics.
  - Added city-level entries to the GEOLOCATION panel.
  - Added optional zlib support to parse compressed log files.
  - Added panel reordering in the TUI, letting you customize the dashboard
    layout.
  - Added sorting for panels in the HTML report.
  - Added the ability to expand and collapse subitems within TUI panels for
    easier navigation of large datasets.
  - Added a TX Amount percent column to the TUI for clearer traffic share
    insight.
  - Added the ability to prepend the virtual host to a request via
    --concat-vhost-req
  - Deprecated `--no-column-names` in favor of a unified TUI dashboard.
  - Fixed log tailing edge cases, including empty reads and date specificity
    overrides from the CLI.
  - Fixed stability issues in multi-threaded parsing and during Ctrl+C with
    multiple jobs.
  - Fixed inability to override date specificity from the CLI.
  - Fixed dry-run lines being counted as processed during config format
    testing.
  - Improved the TUI spinner and progress display for smoother, clearer
    feedback during parsing.
  - Refreshed the HTML dashboard styling and theme visuals.
  - Updated browser and OS detection lists, including macOS 26 (Tahoe) and
    Alibaba Cloud Linux.
  - Updated packaging targets, adding Debian Trixie while dropping Debian
    Buster and i386 builds.
  - Updated Swedish, Chinese and Japanese translations
  - Updated Dockerfile to use openssl-dev for compatibility with
    SSL_CIPHER_standard_name(3ssl).

Changes to GoAccess 1.9.4 - Monday, March 31, 2025

  - Added an azimuthal (globe) projection to the HTML report for geolocation,
    providing a less distorted view of the global map.
  - Added 'apple-touch-icon' for improved iPhone home screen support, enabling
    quick access to reports directly from the home screen.
  - Added 'aria-*' attributes to HTML report for better accessibility, ensuring
    that the report is more inclusive for screen readers and other assistive
    technologies.
  - Added 'theme-color' '<meta>' tag to the HTML report for better integration
    with mobile devices, allowing the browser's address bar to match the
    report's theme color.
  - Added additional validation checks to ensure the existence of file paths
    provided in CLI options, preventing errors.
  - Added WebSocket authentication to support both local-generated JSON Web
    Tokens (JWT) and external verification methods. This enhancement enables
    easy integration with external authentication systems while ensuring CSRF
    protection for token refresh requests.
  - Changed WebSocket server to avoid swapping bytes on big-endian platforms,
    fixing compatibility issues on AIX systems.
  - Fixed the issue where zooming/panning the map would unexpectedly skip or
    jump back, providing a smoother user experience.
  - Fixed the issue where the same mime types were displayed as duplicates due
    to different casing by normalizing mime types before adding them to the
    storage, ensuring consistent reporting.
  - Replaced div elements with more semantic HTML elements like <section>,
    <header>, and <article>, improving the structure and accessibility of the
    report.
  - Updated the list of supported browsers and operating systems to ensure more
    accurate tracking and reporting.
  - Updated the method of parsing the browser list for bots/crawlers, enabling
    the capture of previously difficult-to-parse bots, allowing for more
    precise targeting and better analytics.

Changes to GoAccess 1.9.3 - Friday, May 31, 2024

  - Added additional common bots to the list.
  - Added Address Sanitizer via '--enable-asan' to the configure options for
    debugging purposes.
  - Fixed inability to parse JSON keys containing dots.
  - Fixed out-of-bounds access for invalid HTTP status codes.
  - Fixed out-of-bounds access when parsing a log in serial processing mode.
  - Fixed regression introduced in 8f570c, which caused duplicate counts upon
    restoring from disk via '--restore'.

Changes to GoAccess 1.9.2 - Friday, April 12, 2024

  - Added World Map to the Geo Location panel on the HTML report.
  - Added additional non-official/standard HTTP status codes such as Caddy's 0
    HTTP status among others.
  - Added support for '%z' on strptime for non-glibc systems, such as musl libc
    in Alpine Linux (Docker container), enabling the use of '--tz'
  - Changed the '--hide/ignore-referrer' options to filter by hostname directly
    without the use of wildcards, e.g., '--ignore-referrer=wiki.google.com'.
  - Fixed inability to parse duplicate specifiers during log format parsing.
  - Fixed regression which previously hindered the ability to modify log, date,
    and time formats within the TUI dialog. i.e., '# goaccess access.log -c'.
  - Replaced 'remote_ip' with 'client_ip' for Caddy's JSON format, allowing the
    use of trusted proxies.
  - Updated Caddy JSON example log format to handle headers correctly.
  - Updated Swedish i18n.

Changes to GoAccess 1.9.1 - Tuesday, February 05, 2024

  - Added support for macOS to the OS detection.
  - Fixed C99 mode issue with initial declarations [CentOS7].
  - Fixed minor typographical, orthographic, and grammatical errors in the
    German translation.
  - Fixed a regression issue wherein parsing would halt at the first empty log
    file.


To generate a diff of this commit:
cvs rdiff -u -r1.43 -r1.44 pkgsrc/www/goaccess/Makefile
cvs rdiff -u -r1.7 -r1.8 pkgsrc/www/goaccess/PLIST
cvs rdiff -u -r1.28 -r1.29 pkgsrc/www/goaccess/distinfo
cvs rdiff -u -r0 -r1.1 pkgsrc/www/goaccess/patches/patch-src_wsauth.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/goaccess/Makefile
diff -u pkgsrc/www/goaccess/Makefile:1.43 pkgsrc/www/goaccess/Makefile:1.44
--- pkgsrc/www/goaccess/Makefile:1.43   Tue Sep 29 06:08:05 2026
+++ pkgsrc/www/goaccess/Makefile        Mon Oct 19 07:36:19 2026
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.43 2026/09/29 06:08:05 wiz Exp $
+# $NetBSD: Makefile,v 1.44 2026/10/19 07:36:19 tm Exp $
 
-DISTNAME=      goaccess-1.9
-PKGREVISION=   4
+DISTNAME=      goaccess-1.12
 CATEGORIES=    www
 MASTER_SITES=  https://tar.goaccess.io/
 

Index: pkgsrc/www/goaccess/PLIST
diff -u pkgsrc/www/goaccess/PLIST:1.7 pkgsrc/www/goaccess/PLIST:1.8
--- pkgsrc/www/goaccess/PLIST:1.7       Sat Oct  1 17:01:58 2022
+++ pkgsrc/www/goaccess/PLIST   Mon Oct 19 07:36:19 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.7 2022/10/01 17:01:58 wiedi Exp $
+@comment $NetBSD: PLIST,v 1.8 2026/10/19 07:36:19 tm Exp $
 bin/goaccess
 man/man1/goaccess.1
 share/examples/goaccess/browsers.list
@@ -9,9 +9,11 @@ share/locale/es/LC_MESSAGES/goaccess.mo
 share/locale/fr/LC_MESSAGES/goaccess.mo
 share/locale/it/LC_MESSAGES/goaccess.mo
 share/locale/ja/LC_MESSAGES/goaccess.mo
+share/locale/ka/LC_MESSAGES/goaccess.mo
 share/locale/ko/LC_MESSAGES/goaccess.mo
 share/locale/pt_BR/LC_MESSAGES/goaccess.mo
 share/locale/ru/LC_MESSAGES/goaccess.mo
 share/locale/sv/LC_MESSAGES/goaccess.mo
 share/locale/uk/LC_MESSAGES/goaccess.mo
 share/locale/zh_CN/LC_MESSAGES/goaccess.mo
+share/locale/zh_TW/LC_MESSAGES/goaccess.mo

Index: pkgsrc/www/goaccess/distinfo
diff -u pkgsrc/www/goaccess/distinfo:1.28 pkgsrc/www/goaccess/distinfo:1.29
--- pkgsrc/www/goaccess/distinfo:1.28   Sun Feb  4 20:00:52 2024
+++ pkgsrc/www/goaccess/distinfo        Mon Oct 19 07:36:19 2026
@@ -1,8 +1,9 @@
-$NetBSD: distinfo,v 1.28 2024/02/04 20:00:52 wiedi Exp $
+$NetBSD: distinfo,v 1.29 2026/10/19 07:36:19 tm Exp $
 
-BLAKE2s (goaccess-1.9.tar.gz) = e5ea44497aa1b48b60249c0fcb825ce5707e2e8ae3cc356053f6c8554d02733b
-SHA512 (goaccess-1.9.tar.gz) = 9bcde1bf84d80d5ee2c25f60d5530df29d61936362bc340c5ef2f1f5305b3f91cce96839f761c4cbfa2c3373d0b8d6fb63906057b5c707ec8626ab0dc9850199
-Size (goaccess-1.9.tar.gz) = 743607 bytes
+BLAKE2s (goaccess-1.12.tar.gz) = 412ec10254be64afcb768b57f55b7ed014052b3f6ad8cc51bec18df749131066
+SHA512 (goaccess-1.12.tar.gz) = e310074a77642e6ff445376cd2c4ca41906fc6450e56f0330d100ad5aa662896cbb54d2ec81dc0e091e90f153727136ec9b23e97be011cb05f937c6d0cbb63ce
+Size (goaccess-1.12.tar.gz) = 1198446 bytes
 SHA1 (patch-Makefile.am) = e72d4ac63fd2f9f236ce1feae9b021db2128b725
 SHA1 (patch-configure.ac) = 72bb96317458f27aa4549370d9ac99da9f59f1bd
 SHA1 (patch-src_util.c) = 23a46cde8088df4aaf2b77ea7519c25cda904e26
+SHA1 (patch-src_wsauth.c) = 53e151399b791b1475de3aa67a9177df12fa94e7

Added files:

Index: pkgsrc/www/goaccess/patches/patch-src_wsauth.c
diff -u /dev/null pkgsrc/www/goaccess/patches/patch-src_wsauth.c:1.1
--- /dev/null   Mon Oct 19 07:36:19 2026
+++ pkgsrc/www/goaccess/patches/patch-src_wsauth.c      Mon Oct 19 07:36:19 2026
@@ -0,0 +1,22 @@
+$NetBSD: patch-src_wsauth.c,v 1.1 2026/10/19 07:36:19 tm Exp $
+
+--- src/wsauth.c.orig  2026-10-16 11:33:37.615001854 +0000
++++ src/wsauth.c
+@@ -141,7 +141,7 @@ generate_ws_auth_secret (void) {
+ static char *
+ create_jwt_payload (const char *sub, long iat, long exp) {
+   char *payload = NULL;
+-  char hostname[HOST_NAME_MAX + 1] = { 0 };
++  char hostname[_POSIX_HOST_NAME_MAX + 1] = { 0 };
+ 
+   if (gethostname (hostname, sizeof (hostname)) != 0) {
+     perror ("gethostname");
+@@ -438,7 +438,7 @@ static int
+ validate_jwt_claims (const char *payload_json, size_t payload_len, time_t *expires_at) {
+   json_stream json;
+   JWTClaims claims = { 0 };
+-  char hostname[HOST_NAME_MAX + 1] = { 0 };
++  char hostname[_POSIX_HOST_NAME_MAX + 1] = { 0 };
+   time_t now = 0;
+   int parsed = 0, verify_only = 0;
+