CVS commit: pkgsrc/www/freenginx

["Sergey A. Osokin" <osa%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   osa
Date:           Wed Sep  2 17:20:44 UTC 2026

Modified Files:
        pkgsrc/www/freenginx: Makefile distinfo options.mk
        pkgsrc/www/freenginx/patches: extra-patch-njs-quickjs

Log Message:
www/freenginx: update njs 1.0.0 -> 1.0.1

Bump PKGREVISION.

Sponsored by:   tipi.work

<ChangeLog>

nginx modules:

*) Security: fixed an access control bypass in js_access when an
   asynchronous request body continuation threw an exception or
   produced an unhandled rejection.  Previously, nginx could continue
   processing the request as though the js_access check had succeeded.
   Thanks to Ta Duc Thien.

*) Security: fixed a worker process crash when reading
   Response.statusText after an upstream server returned a status
   line with an empty reason phrase.

*) Bugfix: fixed unhandled promise rejection tracking in reused
   QuickJS contexts.

*) Bugfix: fixed SharedDict.pop() returning undefined for unexpired
   entries in shared dictionaries with a timeout.

*) Bugfix: fixed validation and replacement of Fetch Headers values.
   This also fixed dangling header names in the QuickJS engine.

*) Bugfix: fixed missing validation of r.headersOut names and values,
   and of redirect targets passed to r.return().

*) Bugfix: fixed use-after-free, worker aborts, and leaks caused by
   cyclic references involving Fetch, HTTP request, and Stream session
   objects in the QuickJS engine.

*) Bugfix: fixed QuickJS context reuse after internal redirects and
   when pending jobs remained after request teardown.

*) Bugfix: fixed cleanup of partially initialized JavaScript contexts
   when request setup failed.

Core:

*) Security: fixed a heap buffer overflow while parsing namespace
   prefix lists passed to XML exclusive canonicalization.
   Thanks to Vladimir Vulnerability Research Tech Lead @ Cyera,
   evilgensec.

*) Bugfix: fixed a stack buffer overflow when exporting RSA keys
   larger than 4096 bits to JWK in WebCrypto.
   Thanks to Vaibhav Rajput.

*) Bugfix: fixed RSA-OAEP encryption and decryption with SHA-256 and
   SHA-384 digests in WebCrypto.

*) Bugfix: fixed compatibility with quickjs-ng 0.16.0 and later.

*) Bugfix: fixed empty stack traces for QuickJS errors created by
   host callbacks.

*) Feature: added btoa() and atob() global functions to the QuickJS
   engine and aligned their behavior between both engines.

</ChangeLog>


To generate a diff of this commit:
cvs rdiff -u -r1.11 -r1.12 pkgsrc/www/freenginx/Makefile
cvs rdiff -u -r1.9 -r1.10 pkgsrc/www/freenginx/distinfo
cvs rdiff -u -r1.7 -r1.8 pkgsrc/www/freenginx/options.mk
cvs rdiff -u -r1.1 -r1.2 pkgsrc/www/freenginx/patches/extra-patch-njs-quickjs

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/freenginx/Makefile
diff -u pkgsrc/www/freenginx/Makefile:1.11 pkgsrc/www/freenginx/Makefile:1.12
--- pkgsrc/www/freenginx/Makefile:1.11  Thu Jul 16 19:05:40 2026
+++ pkgsrc/www/freenginx/Makefile       Wed Sep  2 17:20:44 2026
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.11 2026/07/16 19:05:40 wiz Exp $
+# $NetBSD: Makefile,v 1.12 2026/09/02 17:20:44 osa Exp $
 
 DISTNAME=      freenginx-1.30.1
-PKGREVISION=   2
+PKGREVISION=   3
 CATEGORIES=    www
 MASTER_SITES=  https://freenginx.org/download/
 DISTFILES=     ${DEFAULT_DISTFILES}

Index: pkgsrc/www/freenginx/distinfo
diff -u pkgsrc/www/freenginx/distinfo:1.9 pkgsrc/www/freenginx/distinfo:1.10
--- pkgsrc/www/freenginx/distinfo:1.9   Wed Jul  8 19:19:00 2026
+++ pkgsrc/www/freenginx/distinfo       Wed Sep  2 17:20:44 2026
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.9 2026/07/08 19:19:00 osa Exp $
+$NetBSD: distinfo,v 1.10 2026/09/02 17:20:44 osa Exp $
 
 BLAKE2s (array-var-nginx-module-0.06.tar.gz) = fa6ad2a2ce3c3eba3f69287b224e9c01fcaca29a083394ab74f2f655d3e2138b
 SHA512 (array-var-nginx-module-0.06.tar.gz) = bc72158856a1be18a26ee04c6b5b0f0a20bcce688610a493bf31e2a133e7eb12e11f7c18197a09a72b1513f6a08348ee5281b9d5b84cf43603539040ebd23c26
@@ -42,9 +42,9 @@ Size (ngx_devel_kit-0.3.4.tar.gz) = 6647
 BLAKE2s (ngx_http_geoip2_module-3.4.tar.gz) = eb14ed670788d4cc46037719ebab29e1c0da53cadbb0da10198e76255d924273
 SHA512 (ngx_http_geoip2_module-3.4.tar.gz) = 18dea21e5ae2647bea1fc448058a1b773c936917245edef8d861d5e23ed92e9a3b1ec4ef43ffb2ece7b5899d787910adcf4fbd39f84d7e8d7c54759e2fee5b72
 Size (ngx_http_geoip2_module-3.4.tar.gz) = 8877 bytes
-BLAKE2s (njs-1.0.0.tar.gz) = 112eb493fc5739cfa8c07e0e2a78d56fa1aec13166a9a1697ee35c41e7faa697
-SHA512 (njs-1.0.0.tar.gz) = 11ed2e1b0d6e781e7030d46b27dddb96f53b2ceb92ef7811e025a40b8e9bf0996577200cde50bedfe85586478e9830472c0de37f79897d9446f4e23225dff668
-Size (njs-1.0.0.tar.gz) = 1011616 bytes
+BLAKE2s (njs-1.0.1.tar.gz) = 4ddfe3a7d363d65023b6e2e5d26fdeca11fc53988ddf47fb39bf7eb60988be44
+SHA512 (njs-1.0.1.tar.gz) = 4531873957ec947e7e4c36d2713efff624aead0de1f3a8978efd3a06c1fdfd07fc848dcfb4cb284149b5ed91ba3f00030fe49c17f5d1aabda7efc1d38da31bda
+Size (njs-1.0.1.tar.gz) = 1003218 bytes
 BLAKE2s (openresty-echo-nginx-module-b0f344b_GH.tar.gz) = e1ed241e7d3e57024f666bc8489f83575664121a01ef9424b7d7bf4a1f8cdc3f
 SHA512 (openresty-echo-nginx-module-b0f344b_GH.tar.gz) = ef5150094fda342eec018273eb312b16fb7731474e96865374c98dafe7a507fcf9c7e5fd2766d3296afb11e0348e4b20a973d20303052a71bdec7c92bd088d38
 Size (openresty-echo-nginx-module-b0f344b_GH.tar.gz) = 53548 bytes

Index: pkgsrc/www/freenginx/options.mk
diff -u pkgsrc/www/freenginx/options.mk:1.7 pkgsrc/www/freenginx/options.mk:1.8
--- pkgsrc/www/freenginx/options.mk:1.7 Wed Jul  8 19:19:00 2026
+++ pkgsrc/www/freenginx/options.mk     Wed Sep  2 17:20:44 2026
@@ -1,4 +1,4 @@
-# $NetBSD: options.mk,v 1.7 2026/07/08 19:19:00 osa Exp $
+# $NetBSD: options.mk,v 1.8 2026/09/02 17:20:44 osa Exp $
 
 CODELOAD_SITE_GITHUB=          https://codeload.github.com/
 
@@ -387,7 +387,7 @@ PLIST.rtmp=         yes
 .endif
 
 .if !empty(PKG_OPTIONS:Mnginx-njs) || make(makesum) || make(mdi) || make(distclean)
-NJS_VERSION=           1.0.0
+NJS_VERSION=           1.0.1
 NJS_DISTNAME=          njs-${NJS_VERSION}
 NJS_DISTFILE=          ${NJS_DISTNAME}.tar.gz
 SITES.${NJS_DISTFILE}= -${MASTER_SITE_GITHUB:=nginx/njs/archive/}${NJS_VERSION}.tar.gz

Index: pkgsrc/www/freenginx/patches/extra-patch-njs-quickjs
diff -u pkgsrc/www/freenginx/patches/extra-patch-njs-quickjs:1.1 pkgsrc/www/freenginx/patches/extra-patch-njs-quickjs:1.2
--- pkgsrc/www/freenginx/patches/extra-patch-njs-quickjs:1.1    Wed Jul  8 19:19:00 2026
+++ pkgsrc/www/freenginx/patches/extra-patch-njs-quickjs        Wed Sep  2 17:20:44 2026
@@ -1,5 +1,5 @@
---- ../njs-1.0.0/auto/quickjs.orig     2026-06-23 11:18:04.000000000 -0400
-+++ ../njs-1.0.0/auto/quickjs  2026-06-28 13:23:46.299804429 -0400
+--- ../njs-1.0.1/auto/quickjs.orig     2026-06-23 11:18:04.000000000 -0400
++++ ../njs-1.0.1/auto/quickjs  2026-06-28 13:23:46.299804429 -0400
 @@ -42,9 +42,9 @@
      fi
  
@@ -13,8 +13,8 @@
  
          . auto/feature
      fi
---- ../njs-1.0.0/nginx/config.orig     2026-06-28 13:01:43.273373787 -0400
-+++ ../njs-1.0.0/nginx/config  2026-06-28 13:02:46.754225650 -0400
+--- ../njs-1.0.1/nginx/config.orig     2026-06-28 13:01:43.273373787 -0400
++++ ../njs-1.0.1/nginx/config  2026-06-28 13:02:46.754225650 -0400
 @@ -60,8 +60,8 @@
      fi