head	1.2;
access;
symbols;
locks; strict;
comment	@# @;


1.2
date	2026.09.02.17.20.44;	author osa;	state Exp;
branches;
next	1.1;
commitid	pJRaDdCGtRdVr4UG;

1.1
date	2026.07.08.19.19.00;	author osa;	state Exp;
branches;
next	;
commitid	if3WeiPckpsLTSMG;


desc
@@


1.2
log
@www/freenginx: update njs 1.0.0 -> 1.0.1

Bump PKGREVISION.

Sponsored by:	tipi.work

<ChangeLog>

nginx modules:

*) Security: fixed an access control bypass in js_access when an
   asynchronous request body continuation threw an exception or
   produced an unhandled rejection.  Previously, nginx could continue
   processing the request as though the js_access check had succeeded.
   Thanks to Ta Duc Thien.

*) Security: fixed a worker process crash when reading
   Response.statusText after an upstream server returned a status
   line with an empty reason phrase.

*) Bugfix: fixed unhandled promise rejection tracking in reused
   QuickJS contexts.

*) Bugfix: fixed SharedDict.pop() returning undefined for unexpired
   entries in shared dictionaries with a timeout.

*) Bugfix: fixed validation and replacement of Fetch Headers values.
   This also fixed dangling header names in the QuickJS engine.

*) Bugfix: fixed missing validation of r.headersOut names and values,
   and of redirect targets passed to r.return().

*) Bugfix: fixed use-after-free, worker aborts, and leaks caused by
   cyclic references involving Fetch, HTTP request, and Stream session
   objects in the QuickJS engine.

*) Bugfix: fixed QuickJS context reuse after internal redirects and
   when pending jobs remained after request teardown.

*) Bugfix: fixed cleanup of partially initialized JavaScript contexts
   when request setup failed.

Core:

*) Security: fixed a heap buffer overflow while parsing namespace
   prefix lists passed to XML exclusive canonicalization.
   Thanks to Vladimir Vulnerability Research Tech Lead @@ Cyera,
   evilgensec.

*) Bugfix: fixed a stack buffer overflow when exporting RSA keys
   larger than 4096 bits to JWK in WebCrypto.
   Thanks to Vaibhav Rajput.

*) Bugfix: fixed RSA-OAEP encryption and decryption with SHA-256 and
   SHA-384 digests in WebCrypto.

*) Bugfix: fixed compatibility with quickjs-ng 0.16.0 and later.

*) Bugfix: fixed empty stack traces for QuickJS errors created by
   host callbacks.

*) Feature: added btoa() and atob() global functions to the QuickJS
   engine and aligned their behavior between both engines.

</ChangeLog>
@
text
@--- ../njs-1.0.1/auto/quickjs.orig	2026-06-23 11:18:04.000000000 -0400
+++ ../njs-1.0.1/auto/quickjs	2026-06-28 13:23:46.299804429 -0400
@@@@ -42,9 +42,9 @@@@
     fi
 
     if [ $njs_found = no ]; then
-        njs_feature="QuickJS library -I/usr/include/quickjs/ -L/usr/lib/quickjs/ -lquickjs"
-        njs_feature_incs="$NJS_QUICKJS_DEFAULT_INCS /usr/include/quickjs/"
-        njs_feature_libs="-L/usr/lib/quickjs/ -lquickjs -lm -ldl -lpthread"
+        njs_feature="QuickJS library -I/usr/pkg/include/quickjs -L/usr/pkg/lib -lquickjs"
+        njs_feature_incs="$NJS_QUICKJS_DEFAULT_INCS /usr/include/quickjs"
+        njs_feature_libs="-L/usr/pkg/lib -lquickjs -lm -lpthread"
 
         . auto/feature
     fi
--- ../njs-1.0.1/nginx/config.orig	2026-06-28 13:01:43.273373787 -0400
+++ ../njs-1.0.1/nginx/config	2026-06-28 13:02:46.754225650 -0400
@@@@ -60,8 +60,8 @@@@
     fi
 
     if [ $ngx_found = no ]; then
-        ngx_feature="QuickJS library -I/usr/include/quickjs/ -L/usr/lib/quickjs/ -lquickjs"
-        ngx_feature_libs="-L/usr/lib/quickjs/ -lquickjs -lm -ldl -lpthread"
+        ngx_feature="QuickJS library -I/usr/pkg/include/quickjs/ -L/usr/pkg/lib/ -lquickjs"
+        ngx_feature_libs="-L/usr/pkg/lib/quickjs/ -lquickjs -lm -lpthread"
 
         . auto/feature
     fi
@


1.1
log
@www/freenginx: third-party modules management (+)

Update cache_purge module and njs modules to their recent versions (merge
changes from www/freenginx-devel).

Bump PKGREVISION.

Sponsored by:	tipi.work
@
text
@d1 2
a2 2
--- ../njs-1.0.0/auto/quickjs.orig	2026-06-23 11:18:04.000000000 -0400
+++ ../njs-1.0.0/auto/quickjs	2026-06-28 13:23:46.299804429 -0400
d16 2
a17 2
--- ../njs-1.0.0/nginx/config.orig	2026-06-28 13:01:43.273373787 -0400
+++ ../njs-1.0.0/nginx/config	2026-06-28 13:02:46.754225650 -0400
@