CVS commit: pkgsrc/www/freenginx-devel

["Sergey A. Osokin" <osa%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   osa
Date:           Sun Jun 28 17:34:40 UTC 2026

Modified Files:
        pkgsrc/www/freenginx-devel: Makefile distinfo options.mk
Added Files:
        pkgsrc/www/freenginx-devel/patches: extra-patch-njs-quickjs
Removed Files:
        pkgsrc/www/freenginx-devel/patches: extra-patch-auto-quickjs

Log Message:
www/freenginx-devel: update njs: 0.9.9 -> 1.0.0

Enable quickjs engine.

Bump PKGREVISION.

Sponsored by:   tipi.work

<ChangeLog>

nginx modules:

*) Improvement: aligned HTTP, Stream, and Fetch exception classes
   between the njs and QuickJS engines.  API misuse is now reported
   as TypeError and status bounds violations as RangeError.

*) Improvement: rejected unsafe request targets, methods, and header
   values in ngx.fetch() before request serialization.

*) Bugfix: fixed a heap use-after-free in r.subrequest() when the
   client closed the connection before the background subrequest
   completed.  The issue was introduced in 75d6b61 (0.9.5).
   This closes #1077 issue on Github.

*) Bugfix: fixed a worker segfault while reading a request header
   that nginx registers without a dedicated slot, such as
   "Proxy-Connection", via r.headersIn.
   This closes #1071 issue on Github.

*) Bugfix: excluded unverified-TLS and dynamic-proxy connections
   from the ngx.fetch() keepalive cache and validated cached
   connections before reuse.

*) Bugfix: fixed Content-Length truncation for very large request
   bodies and a missing CONNECT terminator for proxies configured
   without credentials in ngx.fetch().

*) Bugfix: fixed leaks of promises, events, and init property values
   on ngx.fetch() failure paths in the QuickJS engine.

*) Bugfix: fixed missing fetch event cleanup when the resolver
   failed to start.

*) Bugfix: fixed an out-of-bounds read of a short fetch proxy URL.

*) Bugfix: fixed request body truncation in r.readRequestJSON() for
   bodies containing invalid UTF-8 in the QuickJS engine.

*) Bugfix: fixed an out-of-bounds read while loading a shared
   dictionary state file.

*) Bugfix: set a pending exception when sendHeader(), send(), and
   finish() fail in the njs HTTP handlers.

*) Bugfix: fixed the variable value state after a stream variable
   storage allocation failure.

Core:

*) Improvement: bounded string-producing chained-buffer growth, so
   that exceeding the maximum string length raises a catchable
   RangeError("invalid string length") instead of exhausting worker
   memory.

*) Improvement: aligned built-in exception classes (XML, console,
   TextEncoder, TextDecoder, Buffer, fs.Stats) between the
   njs and QuickJS engines.

*) Bugfix: fixed an infinite loop while inflating a zlib stream
   that requires a dictionary in the QuickJS engine.

*) Bugfix: fixed an infinite loop in Buffer.prototype.fill() with
   a zero-length typed array source.

*) Bugfix: fixed a use-after-free in Array.prototype.sort() when a
   getter invoked for a hole grows the array.

*) Bugfix: fixed type confusion in Buffer.concat() when a list
   element getter returns a typed array during validation but not
   during the copy.

*) Bugfix: fixed an out-of-bounds access in the variable-length
   Buffer readInt/writeInt methods with a zero byteLength.

*) Bugfix: fixed an out-of-bounds read in Buffer.prototype.toString()
   when start was greater than end.

*) Bugfix: fixed Array.prototype.slice() of large arrays returning
   wrong results in the non-fast keys path.

*) Bugfix: fixed the typed array constructor, slice(), toReversed(),
   and toSorted() ignoring the source view byte offset in the
   same-type fast path.

*) Bugfix: fixed Buffer allocation length checks for lengths greater
   than or equal to 2^32 on 32-bit platforms.

*) Bugfix: fixed the Buffer.from() typed-array source offset for
   multi-byte element types in the QuickJS engine.

*) Bugfix: fixed Buffer float access alignment.

*) Bugfix: fixed an out-of-bounds read in a parser string escape
   lookahead.

</ChangeLog>


To generate a diff of this commit:
cvs rdiff -u -r1.16 -r1.17 pkgsrc/www/freenginx-devel/Makefile
cvs rdiff -u -r1.14 -r1.15 pkgsrc/www/freenginx-devel/distinfo
cvs rdiff -u -r1.8 -r1.9 pkgsrc/www/freenginx-devel/options.mk
cvs rdiff -u -r1.4 -r0 \
    pkgsrc/www/freenginx-devel/patches/extra-patch-auto-quickjs
cvs rdiff -u -r0 -r1.1 \
    pkgsrc/www/freenginx-devel/patches/extra-patch-njs-quickjs

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/freenginx-devel/Makefile
diff -u pkgsrc/www/freenginx-devel/Makefile:1.16 pkgsrc/www/freenginx-devel/Makefile:1.17
--- pkgsrc/www/freenginx-devel/Makefile:1.16    Sun May 31 15:24:37 2026
+++ pkgsrc/www/freenginx-devel/Makefile Sun Jun 28 17:34:40 2026
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.16 2026/05/31 15:24:37 osa Exp $
+# $NetBSD: Makefile,v 1.17 2026/06/28 17:34:40 osa Exp $
 
 DISTNAME=      freenginx-1.31.2
 PKGNAME=       ${DISTNAME:S/-/-devel-/1}
-PKGREVISION=   1
+PKGREVISION=   2
 CATEGORIES=    www
 MASTER_SITES=  https://freenginx.org/download/
 DISTFILES=     ${DEFAULT_DISTFILES}
@@ -115,7 +115,7 @@ post-patch:
                ${WRKSRC}/..${NAXSI_SUBDIR}/libinjection/src/libinjection_sqli.c
 .endif
 .if !empty(PKG_OPTIONS:Mnginx-njs)
-       cd ${WRKSRC} && ${PATCH} < ${PATCHDIR}/extra-patch-auto-quickjs
+       cd ${WRKSRC} && ${PATCH} < ${PATCHDIR}/extra-patch-njs-quickjs
 .endif
 .if !empty(PKG_OPTIONS:Mnginx-upload)
        cd ${WRKSRC} && ${PATCH} < ${PATCHDIR}/extra-patch-ngx_http_upload_module.c

Index: pkgsrc/www/freenginx-devel/distinfo
diff -u pkgsrc/www/freenginx-devel/distinfo:1.14 pkgsrc/www/freenginx-devel/distinfo:1.15
--- pkgsrc/www/freenginx-devel/distinfo:1.14    Sun May 31 15:24:37 2026
+++ pkgsrc/www/freenginx-devel/distinfo Sun Jun 28 17:34:40 2026
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.14 2026/05/31 15:24:37 osa Exp $
+$NetBSD: distinfo,v 1.15 2026/06/28 17:34:40 osa Exp $
 
 BLAKE2s (array-var-nginx-module-0.06.tar.gz) = fa6ad2a2ce3c3eba3f69287b224e9c01fcaca29a083394ab74f2f655d3e2138b
 SHA512 (array-var-nginx-module-0.06.tar.gz) = bc72158856a1be18a26ee04c6b5b0f0a20bcce688610a493bf31e2a133e7eb12e11f7c18197a09a72b1513f6a08348ee5281b9d5b84cf43603539040ebd23c26
@@ -42,9 +42,9 @@ Size (ngx_devel_kit-0.3.4.tar.gz) = 6647
 BLAKE2s (ngx_http_geoip2_module-3.4.tar.gz) = eb14ed670788d4cc46037719ebab29e1c0da53cadbb0da10198e76255d924273
 SHA512 (ngx_http_geoip2_module-3.4.tar.gz) = 18dea21e5ae2647bea1fc448058a1b773c936917245edef8d861d5e23ed92e9a3b1ec4ef43ffb2ece7b5899d787910adcf4fbd39f84d7e8d7c54759e2fee5b72
 Size (ngx_http_geoip2_module-3.4.tar.gz) = 8877 bytes
-BLAKE2s (njs-0.9.9.tar.gz) = 7e3bbbd6b7a2737fe4976ad21779c62992934bda85dc5856a043181f3bd84200
-SHA512 (njs-0.9.9.tar.gz) = 67b921c127fabb0ac0a8e53f63291af3227db0d2a9d67f32bfc853072403d9634f19ef736513a4007673fc98e1d3be8a5b3ac4832b04956852e43706891c38be
-Size (njs-0.9.9.tar.gz) = 994273 bytes
+BLAKE2s (njs-1.0.0.tar.gz) = 112eb493fc5739cfa8c07e0e2a78d56fa1aec13166a9a1697ee35c41e7faa697
+SHA512 (njs-1.0.0.tar.gz) = 11ed2e1b0d6e781e7030d46b27dddb96f53b2ceb92ef7811e025a40b8e9bf0996577200cde50bedfe85586478e9830472c0de37f79897d9446f4e23225dff668
+Size (njs-1.0.0.tar.gz) = 1011616 bytes
 BLAKE2s (openresty-echo-nginx-module-b0f344b_GH.tar.gz) = e1ed241e7d3e57024f666bc8489f83575664121a01ef9424b7d7bf4a1f8cdc3f
 SHA512 (openresty-echo-nginx-module-b0f344b_GH.tar.gz) = ef5150094fda342eec018273eb312b16fb7731474e96865374c98dafe7a507fcf9c7e5fd2766d3296afb11e0348e4b20a973d20303052a71bdec7c92bd088d38
 Size (openresty-echo-nginx-module-b0f344b_GH.tar.gz) = 53548 bytes

Index: pkgsrc/www/freenginx-devel/options.mk
diff -u pkgsrc/www/freenginx-devel/options.mk:1.8 pkgsrc/www/freenginx-devel/options.mk:1.9
--- pkgsrc/www/freenginx-devel/options.mk:1.8   Sun May 31 15:24:37 2026
+++ pkgsrc/www/freenginx-devel/options.mk       Sun Jun 28 17:34:40 2026
@@ -1,4 +1,4 @@
-# $NetBSD: options.mk,v 1.8 2026/05/31 15:24:37 osa Exp $
+# $NetBSD: options.mk,v 1.9 2026/06/28 17:34:40 osa Exp $
 
 CODELOAD_SITE_GITHUB=          https://codeload.github.com/
 
@@ -387,7 +387,7 @@ PLIST.rtmp=         yes
 .endif
 
 .if !empty(PKG_OPTIONS:Mnginx-njs) || make(makesum) || make(mdi) || make(distclean)
-NJS_VERSION=           0.9.9
+NJS_VERSION=           1.0.0
 NJS_DISTNAME=          njs-${NJS_VERSION}
 NJS_DISTFILE=          ${NJS_DISTNAME}.tar.gz
 SITES.${NJS_DISTFILE}= -${MASTER_SITE_GITHUB:=nginx/njs/archive/}${NJS_VERSION}.tar.gz

Added files:

Index: pkgsrc/www/freenginx-devel/patches/extra-patch-njs-quickjs
diff -u /dev/null pkgsrc/www/freenginx-devel/patches/extra-patch-njs-quickjs:1.1
--- /dev/null   Sun Jun 28 17:34:40 2026
+++ pkgsrc/www/freenginx-devel/patches/extra-patch-njs-quickjs  Sun Jun 28 17:34:40 2026
@@ -0,0 +1,28 @@
+--- ../njs-1.0.0/auto/quickjs.orig     2026-06-23 11:18:04.000000000 -0400
++++ ../njs-1.0.0/auto/quickjs  2026-06-28 13:23:46.299804429 -0400
+@@ -42,9 +42,9 @@
+     fi
+ 
+     if [ $njs_found = no ]; then
+-        njs_feature="QuickJS library -I/usr/include/quickjs/ -L/usr/lib/quickjs/ -lquickjs"
+-        njs_feature_incs="$NJS_QUICKJS_DEFAULT_INCS /usr/include/quickjs/"
+-        njs_feature_libs="-L/usr/lib/quickjs/ -lquickjs -lm -ldl -lpthread"
++        njs_feature="QuickJS library -I/usr/pkg/include/quickjs -L/usr/pkg/lib -lquickjs"
++        njs_feature_incs="$NJS_QUICKJS_DEFAULT_INCS /usr/include/quickjs"
++        njs_feature_libs="-L/usr/pkg/lib -lquickjs -lm -lpthread"
+ 
+         . auto/feature
+     fi
+--- ../njs-1.0.0/nginx/config.orig     2026-06-28 13:01:43.273373787 -0400
++++ ../njs-1.0.0/nginx/config  2026-06-28 13:02:46.754225650 -0400
+@@ -60,8 +60,8 @@
+     fi
+ 
+     if [ $ngx_found = no ]; then
+-        ngx_feature="QuickJS library -I/usr/include/quickjs/ -L/usr/lib/quickjs/ -lquickjs"
+-        ngx_feature_libs="-L/usr/lib/quickjs/ -lquickjs -lm -ldl -lpthread"
++        ngx_feature="QuickJS library -I/usr/pkg/include/quickjs/ -L/usr/pkg/lib/ -lquickjs"
++        ngx_feature_libs="-L/usr/pkg/lib/quickjs/ -lquickjs -lm -lpthread"
+ 
+         . auto/feature
+     fi