CVS commit: pkgsrc/net/haproxy

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Wed Sep  2 05:37:22 UTC 2026

Modified Files:
        pkgsrc/net/haproxy: Makefile distinfo

Log Message:
haproxy: updated to 3.4.4

3.4.4
- BUG/MEDIUM: proxy: fix crash on delete first backend
- BUG/MINOR: cli: use the current argument to parse the FD spec in "show fd"
- BUG/MINOR: cli: do not reject the "/<fd>" form of "show fd"
- BUG/MINOR: ech: propagate error from load_echkeys()
- BUG/MINOR: ech: reject an ECH store with no usable private key
- BUG/MEDIUM: counters: preserve shared.tg pointer on 'clear counters all'
- BUG/MEDIUM: filter: Disable auto-close on channel during TCP payload filtering
- BUG/MINOR: server: check strdup return value on server ID
- BUG/MINOR: proxy: fix default-server leak on post-parsing cleanup
- MINOR: proxy: implement unpublished backend keyword
- DOC: explain better that named defaults are preserved
- BUG/MINOR: proxy: release watcher in various commands on CLI abort
- REGTESTS: proxy: complete "del backend" test
- BUG/MEDIUM: hpack: encode long methods and schemes using the long form
- BUG/MINOR: stats-file: reject tgid 0 when preloading shm objects
- BUG/MINOR: hlua: use a local buffer to format the socket addresses
- DEV: haring: bound the ring geometry to the size of the file
- BUG/MEDIUM: spoe: clear the applet pointer when the applet fails to start
- BUG/MINOR: mux-fcgi: don't call fcgi_strm_destroy() on a NULL stream
- BUG/MEDIUM: http-ana: don't crash on "keep-query" in a response redirect
- BUG/MEDIUM: stick-tables: use the same bucket for string keys with a NUL
- BUG/MEDIUM: sock: bound the recvmsg() length when receiving old sockets
- BUG/MEDIUM: http-ana: check the cookie rewrite result before moving the offsets
- BUG/MINOR: mux-fcgi: sanitize the STDERR records before logging them
- MINOR: log/tools: fix ambiguous comments for some log encoding helpers
- BUG/MEDIUM: log: always reserve room for trailing 0 when using CBOR encoding helpers
- BUG/MEDIUM: jwe: validate the secret length against the algorithm of the token
- BUG/MINOR: jwt: don't take an extra reference on the certificate public key
- BUG/MEDIUM: ssl: require a full-length AEAD tag when decrypting with AES-GCM
- BUG/MEDIUM: acme: don't delete a NULL token from the map
- BUG/MINOR: ssl: reject server certificate names containing a NUL byte
- BUG/MINOR: acme: restrict the permissions of the generated account key
- BUG/MINOR: connection: reserve the whole CRC32C TLV before saving its pointer
- BUG/MEDIUM: session: don't release a reversed connection twice on error
- BUG/MINOR: lb-chash: bound the walk when the saved cursor changed tree
- BUG/MINOR: debug: only dump the trace once in __BUG_ON_ONCE()
- BUG/MINOR: mux-h2: strip the userinfo when deriving :authority for a server
- BUG/MEDIUM: quic: prevent out-of-bound read on wrapping CRYPTO content
- BUG/MINOR: quic: drop multiple Retry on same connection
- BUG/MEDIUM: lua: resume Channel:send() from the unsent part of the string
- BUG/MEDIUM: hlua_fcn: ensure systematic bref cleanup for patref list iterator
- DOC: config: clarify req.ssl_sni
- BUG/MEDIUM: cache: retain the primary or secondary entry only when detaching its row
- BUG/MEDIUM: cache: do not release an entry under the cache read lock
- BUG/MINOR: wurfl: fix memory leak of information list and patch strings at deinit
- BUG/MINOR: ssl: reject an embedded NUL in the ssl_*_dn(entry) fetches
- BUG/MINOR: ssl: reject an embedded NUL in the full-DN ssl_*_dn() fetches
- BUG/MINOR: quic: avoid a division by zero in the BBR pacing interval
- BUG/MINOR: server: fix off-by-one error when parsing and copying source port range
- BUG/MEDIUM: http: fix authority parsing for absolute-form URI with empty path
- DOC: security: clarify that only up-to-date versions may get securty reports
- BUG/MEDIUM: bwlim: fix a stick-table entry leak in shared mode
- BUG/MINOR: payload: fix handshake length off-by-4 in ssl_hello_sni/alpn
- BUG/MINOR: spoe: check snprintf() return value in spoe_set_var/spoe_unset_var
- BUG/MINOR: qpack: missing shift count check in qpack_get_varint() (UB)
- BUG/MINOR: log: fix double-free error when error in parse_loger occurs
- BUG/MINOR: mux-h2: harden h2_dump_h2s_info() against potentially null h2s->sd
- BUG/MINOR: conn: Do not check 'sess_el' list on frontend connections in __trace_enabled
- BUG/MINOR: ssl: Fix leak of X509_NAME in traces
- BUG/MINOR: ssl: release the previous client cert reference at depth > 0
- BUG/MEDIUM: ssl: Fix unprotected 'ssl_sock_choose_sni_ctx' calls
- BUG/MEDIUM: ssl: enforce tune.ssl.lifetime across TLS1.3 session renewals
- BUG/MINOR: ssl: apply tune.ssl.lifetime to TLS1.3 sessions on BoringSSL/AWS-LC
- BUILD: ssl: disable the TLS1.3 session timeout clamp on wolfSSL
- BUG/MEDIUM: ssl: isolate TLS session resumption per X509 server certificate
- BUG/MINOR: ssl: isolate TLS session resumption per crt-list filter
- BUG/MEDIUM: ssl: isolate TLS session resumption per authentication policy
- BUG/MINOR: haproxy: fix out-of-scope tmpdir usage in do_chroot()
- BUG/MINOR: ssl/cli: fix frontend-not-found detection in 'show ssl sni -f'
- BUG/MINOR: resolvers: accept fields at the response boundary
- BUG/MEDIUM: sink: pre-initialize the implicit log forwarding server
- BUG/MEDIUM: mux-fcgi: check the room left before appending the index
- BUG/MINOR: ech: fix label at end of compound statement
- BUG/MINOR: hbuf: treat unexpected escape sequences as literals
- BUILD: ssl: avoid a potential null-dereference warning on OpenSSL 1.0.2
- BUG/MEDIUM: mux-h1: close the connection on a short content-length
- MEDIUM: mux-h2: don't report EOM on a short content-length message
- BUG/MEDIUM: connection: fix an infinite loop in the fc_pp_tlv() fetch
- BUG/MEDIUM: sink: do not hold the sft lock around ring_dispatch_messages()
- DOC: haterm: add a missing 'haterm' build target on an example
- MINOR: sample: add new converter has_ctl() to detect control characters
- MINOR: debug: check the match count in __BUG_ON_ONCE() and not in complain()
- REGTESTS: converters: use connection: close in the has_ctl() test
- BUG/MEDIUM: cache: ignore cache on redundant origin/referer
- BUG/MINOR: fcgi-app: allow explicit filter declaration with non-cache/non-compression filters
- BUG/MINOR: flt-http-comp: Don't read next block to detect end of data
- BUG/MEDIUM: sink: initialize the settings of the implicit log server
- BUG/MEDIUM: sink: do not create one implicit ring per logger copy


To generate a diff of this commit:
cvs rdiff -u -r1.162 -r1.163 pkgsrc/net/haproxy/Makefile
cvs rdiff -u -r1.153 -r1.154 pkgsrc/net/haproxy/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/net/haproxy/Makefile
diff -u pkgsrc/net/haproxy/Makefile:1.162 pkgsrc/net/haproxy/Makefile:1.163
--- pkgsrc/net/haproxy/Makefile:1.162   Sat Aug  1 13:48:09 2026
+++ pkgsrc/net/haproxy/Makefile Wed Sep  2 05:37:22 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.162 2026/08/01 13:48:09 adam Exp $
+# $NetBSD: Makefile,v 1.163 2026/09/02 05:37:22 adam Exp $
 
-DISTNAME=      haproxy-3.4.3
+DISTNAME=      haproxy-3.4.4
 CATEGORIES=    net www
 MASTER_SITES=  https://www.haproxy.org/download/${PKGVERSION_NOREV:R}/src/
 

Index: pkgsrc/net/haproxy/distinfo
diff -u pkgsrc/net/haproxy/distinfo:1.153 pkgsrc/net/haproxy/distinfo:1.154
--- pkgsrc/net/haproxy/distinfo:1.153   Sat Aug  1 13:48:09 2026
+++ pkgsrc/net/haproxy/distinfo Wed Sep  2 05:37:22 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.153 2026/08/01 13:48:09 adam Exp $
+$NetBSD: distinfo,v 1.154 2026/09/02 05:37:22 adam Exp $
 
-BLAKE2s (haproxy-3.4.3.tar.gz) = e5f2eef5707e9db2e3445cf518446e9db52b4e7cd405f14305f24eeedf6dabf0
-SHA512 (haproxy-3.4.3.tar.gz) = 05fa67d437814618ab8474cc36b9e81aa3c24c4eb644a36870495ccf48e70ff667ef6a752f0bc8ec508cc12b886cef5b9c1a235f78dcc3578c930a1b88ce065c
-Size (haproxy-3.4.3.tar.gz) = 5485483 bytes
+BLAKE2s (haproxy-3.4.4.tar.gz) = e649ead835614ee2df86a78d1c4d2e3f1ec52b3f4faa26ce2683434de13ec074
+SHA512 (haproxy-3.4.4.tar.gz) = 1134371d59dd0b494e8737801c545e5c9f14b2275ebea0750d001ee70991e33418c45c2eba43ea8aee39c3f534917bee826d11564e58919a0332beddd4666571
+Size (haproxy-3.4.4.tar.gz) = 5502948 bytes
 SHA1 (patch-include_haproxy_proxy-t.h) = 7aab2e32aacff45e7a2a0d6a48550b72d1fe7619
 SHA1 (patch-include_haproxy_queue-t.h) = a9f41857d66037b3f66f8d43090dab2d06c7bfb2
 SHA1 (patch-include_haproxy_queue.h) = eed5ea43212462134fb60b50c2a32e619e104d51