CVS commit: pkgsrc/net/haproxy

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Tue Oct 20 04:46:45 UTC 2026

Modified Files:
        pkgsrc/net/haproxy: Makefile distinfo

Log Message:
haproxy: updated to 3.4.7

3.4.7
- MEDIUM: jwt: Reject "none" alg in jwt_verify by default
- MINOR: quic: implement the AEAD integrity limit
- BUG/MEDIUM: flt-http-comp: Block HTX_FL_EOM flag till the end of compression
- BUG/MINOR: flt-http-comp: Rely on htx_set_eom() to restore EOM flag
- MINOR: stconn: prefer to replace endpoints rather than detaching them
- BUILD: haring: fix compile issue due to nop warning.
- MINOR: stick-table: provide a function to estimate on-wire data size
- MINOR: stick-table: calculate the on-wire size of each key
- BUG/MEDIUM: stick-table: restrict key sizes to what fits in a buffer
- BUG/MEDIUM: pattern: don't dereference static_pattern's data when not filling it
- BUG/MINOR: jwe: Buffer overflow when filling fake cek in case of RSA1.5
- BUG/MINOR: jwe: Avoid buffer overflow in fake cek (RSA1.5)
- BUG/MINOR: http: do not consume the delimiter of a truncated q-factor
- BUG/MINOR: sample: apply the ms_/us_ time offsets in the input unit
- BUG/MINOR: sample: zero-pad the fractional part emitted by http_date()
- BUG/MINOR: sample: make quic_enabled() always succeed
- BUG/MINOR: http-ana: return a 502 when checkcache blocks a response
- BUG/MINOR: stick-table: do not count the lookup itself in table_trackers()
- BUG/MINOR: payload: always report a boolean from req.ssl_ec_ext
- BUG/MINOR: http-fetch: do not count Set-Cookie attributes as cookies
- BUG/MEDIUM: tcpcheck: do not run a regex on an unallocated buffer
- BUG/MINOR: sample: return the decoded JWT part when no path is given
- DOC: config: mention other responses not blocked by option checkcache
- DOC: config: fix doc for hex2i() converter on unparsable input
- DOC: config: mention that url_ip and url_port fail when passed a name
- BUG/MINOR: proxy: add PR_CAP_LB for dynamically added backend
- BUG/MINOR: server: fix "del server" description
- BUG/MINOR: cli: update wait help usage
- MINOR: http-ana: automatically enable http-no-delay for streaming events (SSE)
- BUG/MINOR: log: fix erroneous error message in log-steps parser
- BUG/MINOR: hq-interop: prevent double EOM on request with standalone FIN
- BUG/MINOR: ssl: fix trace crash on FE conn release in io cb
- BUG/MINOR: ssl: fix trace crash on BE conn release in io cb
- BUG/MEDIUM: ssl: crt-list ciphers ignored with AWS-LC
- BUG/MEDIUM: ssl: crt-list curves ignored with AWS-LC
- BUG/MEDIUM: listener: Consider maxconn before waking listeners
- BUG/MINOR: ssl: use standard names for X25519 and X448 groups
- BUG/MINOR: mux_quic: extend FINAL_SIZE_ERROR detection on stream
- BUG/MINOR: h3: reject frames with truncated header
- BUG/MINOR: h3: close connection on GOAWAY frame too long
- BUG/MINOR: h3: reject RS/SS for QPACK uni streams
- BUG/MINOR: ssl: Fix potential NULL-deref in "dump ssl cert" with AWS-LC
- MINOR: doc: elaborate on diagnostic mode behavior
- BUG/MAJOR: cfgparse: properly check userlist section when scanning keywords
- BUG/MINOR: cfgparse-global: add missing gotos to error label in max-spread-checks
- BUG/MINOR: cfgparse-global: add missing calloc() check for the global description
- BUG/MINOR: cfgparse-listen: release the previous description of the proxy
- BUG/MINOR: cfgparse-listen: fix the argument checked by "email-alert"
- BUG/MINOR: cfgparse-listen: fix quoting of the condition conflict warning
- BUG/MINOR: cfgparse-listen: properly reject extra args in a backend section
- BUG/MINOR: proxy: also look for the closest option among cfg_opts3
- BUG/MINOR: cfgparse-listen: complete the list of options for the suggestions
- BUG/MEDIUM: cli: fix the last command detection on a full command line
- REGTESTS: cli: test a command line of exactly tune.bufsize bytes
- BUG/MEDIUM: log: do not ignore the peer's shutdown in the syslog applet
- REGTESTS: log: check that a log-forward TCP session ends on client close
- BUG/MINOR: spoe: Fix the message list splice with an empty list
- BUG/MINOR: hlua: assume proxy_find_by_id() may return NULL on previously existing server
- BUG/MEDIUM: mux-h2: don't return a freed tasklet from h2_deferred_shut()
- BUG/MEDIUM: mux-fcgi: don't return a freed tasklet from fcgi_deferred_shut()
- BUG/MEDIUM: mux-h1: don't pass an upgraded connection to traces in h1s_destroy()
- BUG/MEDIUM: mux-h2: report a dead rhttp connection in h2_wake()
- BUG/MEDIUM: mux-h2: fix a possible crash on rxbuf allocation failure
- BUG/MEDIUM: mux-h1: also release the embryonic stream when the error is empty
- BUG/MINOR: http-fetch: don't report pseudo-headers in TCP mode
- BUG/MEDIUM: mux-h1: only accept the H2 preface on the first request
- REGTESTS: http-messaging: Fix http_fail_cnt_body to succeed with small timeouts
- REGTEST: ssl: require OpenSSL 1.1.1 for crt-list ciphersuites tests
- BUG/MINOR: cfgparse-global: only warn when "localpeer" is set together with -L
- BUG/MAJOR: mux-h2: properly handle short reads on PING frames
- BUG/MAJOR: h1-htx: report an error on a too long chunk-size line


To generate a diff of this commit:
cvs rdiff -u -r1.167 -r1.168 pkgsrc/net/haproxy/Makefile
cvs rdiff -u -r1.155 -r1.156 pkgsrc/net/haproxy/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/net/haproxy/Makefile
diff -u pkgsrc/net/haproxy/Makefile:1.167 pkgsrc/net/haproxy/Makefile:1.168
--- pkgsrc/net/haproxy/Makefile:1.167   Tue Sep 29 09:01:19 2026
+++ pkgsrc/net/haproxy/Makefile Tue Oct 20 04:46:45 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.167 2026/09/29 09:01:19 adam Exp $
+# $NetBSD: Makefile,v 1.168 2026/10/20 04:46:45 adam Exp $
 
-DISTNAME=      haproxy-3.4.6
+DISTNAME=      haproxy-3.4.7
 CATEGORIES=    net www
 MASTER_SITES=  https://www.haproxy.org/download/${PKGVERSION_NOREV:R}/src/
 

Index: pkgsrc/net/haproxy/distinfo
diff -u pkgsrc/net/haproxy/distinfo:1.155 pkgsrc/net/haproxy/distinfo:1.156
--- pkgsrc/net/haproxy/distinfo:1.155   Tue Sep 29 09:01:19 2026
+++ pkgsrc/net/haproxy/distinfo Tue Oct 20 04:46:45 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.155 2026/09/29 09:01:19 adam Exp $
+$NetBSD: distinfo,v 1.156 2026/10/20 04:46:45 adam Exp $
 
-BLAKE2s (haproxy-3.4.6.tar.gz) = ac15cc313c05eee7fdc83c07d1f9ac7df8f8dbdedf84ce7dc9714145914fa700
-SHA512 (haproxy-3.4.6.tar.gz) = 04d20bca04dc6d5b18181c002997fc68e87dfdf2ff309753c7cf3383355ebcfce2d2b62a20f4d0e49bd75d25aa12da8d33f4b39a23b618199787cd1468fc0fe9
-Size (haproxy-3.4.6.tar.gz) = 5525386 bytes
+BLAKE2s (haproxy-3.4.7.tar.gz) = 484ed0de2eb0affe6e8732ba46743aed71c9d39697ae680b562dcf6f293d6378
+SHA512 (haproxy-3.4.7.tar.gz) = 6e61b05e122764f7a6eaa683ba843815785d2fb6c8d3bed80ec5be15c674777ac1829e09767962ede0c47a8b9bca837f81f9ef80f9e6147e292e26815c52402f
+Size (haproxy-3.4.7.tar.gz) = 5531506 bytes
 SHA1 (patch-include_haproxy_proxy-t.h) = 7aab2e32aacff45e7a2a0d6a48550b72d1fe7619
 SHA1 (patch-include_haproxy_queue-t.h) = a9f41857d66037b3f66f8d43090dab2d06c7bfb2
 SHA1 (patch-include_haproxy_queue.h) = eed5ea43212462134fb60b50c2a32e619e104d51