14:15 Dave Cottlehuber (dch) 

www/h2o*: meld devel flavour into main port

- upstream has indicated there will be no more versioned releases
- only master branch updates
- all remaining consumers of libh2o have moved to alternatives

    ed5fe11

22:13 Dave Cottlehuber (dch) 

www/h2o: patch for HTTP2 rapid reset attack, deprecate

- downstream dnsdist project has backported a fix for this specific issue
- deprecation is still planned, and port should not be considered secure
- pet port in line with www/h2o-devel

See https://github.com/h2o/h2o/pull/3293 for further details

Obtained from:	Remi Gacogne <remi.gacogne@powerdns.com>
Security:	CVE-2023-44487
Security:	https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf

    dcd7c23

18:29 dch 

www/h2o: update to 2.2.6

resolves:

- CVE-2019-9512 (Ping Flood)
- CVE-2019-9514 (Reset Flood)
- CVE-2019-9515 (Settings Flood)

PR:		239843
Submitted by:	Max Kostikov <max@kostikov.co>
Reported by:	Max Kostikov <max@kostikov.co>
Reviewed by:	adamw
Approved by:	jrm (mentor, implicit)
MFH:		2019Q3
Security:	CVE-2019-9512
Security:	CVE-2019-9514
Security:	CVE-2019-9515
Sponsored by:	SkunkWerks, GmbH

 

22:47 dch 

www/h2o: update 2.2.4 to 2.2.5

- fix buffer overflow CVE-2018-0608 #1775 (Frederik Deweerdt)
- LibreSSL and PicoTLS changes
- see https://github.com/h2o/h2o/blob/master/Changes

PR:		228762
Submitted by:	Max Kostikov <max@kostikov.co>
Approved by:	jrm
MFH:		2018Q3
Security:	CVE-2018-0608

 

00:40 dch 

www/h2o: update to 2.2.4

Approved by:	jrm (mentor)
Sponsored by:	https://iwantmyname.com/
Differential Revision:	https://reviews.freebsd.org/D13077

 

22:34 dch 

www/h2o: update to 2.2.3

- resolve security vulnerabilities via new release
- ensure custom config files are loaded by re-ordering h2o rc.d script
- clean up options while we are here
- full changelog: https://github.com/h2o/h2o/releases/tag/v2.2.3

PR:		222281
Reported by:	freebsd@get-experience.com
Reviewed by:	jrm (mentor)
Approved by:	jrm (mentor)
MFH:		2017Q4
Security:	CVE-2017-10868
Security:	CVE-2017-10869
Differential Revision:	https://reviews.freebsd.org/D12619

 

05:46 miwi 

- Update to 2.2.2

PR:		218764
Submitted by:	maintainer

 

18:38 amdmi3 

- Upgrade to 2.1.0
- Drop bundled libressl switch

PR:		217088
Submitted by:	dch@skunkwerks.at (maintainer)

 

09:27 brnrd 

www/h2o: Update to 2.0.4 (Fixes vulnerability)

  - Update to version 2.0.4

PR:		211892
Submitted by:	Dave Cottlehuber <dch@skunkwerks.at> (maintainer)
Reviewed by:	brnrd
MFH:		2016Q3
Security:	08664d42-7989-11e6-b7a8-74d02b9a84d5

 

21:01 junovitch 

www/h2o: update 2.0.0 -> 2.0.1

This is a bug-fix release of 2.0 series, fixing following issues found in 2.0.0.
* [fastcgi] fix internal server error when PHP returns a huge header #958
* [http2] recognize link header containing multiple links #950
* [libh2o] fix resource leaks upon startup failure #936
* [libh2o] do not require linking to libbrotli externally #941

Changes:	https://github.com/h2o/h2o/releases/tag/v2.0.1

PR:		210769
Submitted by:	Dave Cottlehuber <dch@skunkwerks.at> (maintainer)

 

22:38 junovitch 

www/h2o: update 1.7.3 -> 2.0.0

- explicitly set H2O_PERL via rc.d script

Summary of major changes:
- support for Brotli compression
- directives for file-level resource mapping
- addition of the status handler
- reverse proxying using HTTPS

Changes:	https://github.com/h2o/h2o/releases/tag/v2.0.0

PR:		209927
Submitted by:	Dave Cottlehuber <dch@skunkwerks.at> (maintainer)

 

22:50 zi 

- Update to 1.7.3

PR:		209926
Submitted by:	Dave Cottlehuber
Security:	65bb1858-27de-11e6-b714-74d02b9a84d5

 

14:43 matthew 

Update to 1.7.2

- various SSL & signal handling fixes
- minor http2 tweaks

PR:		209517
Submitted by:	dch@skunkwerks.at (maintainer)

 

12:37 feld 

www/h2o: Update to 1.7.1

- build system fixes
- improved documentation
- fix file transfer > 2GB on FreeBSD

PR:		208002

 

15:28 koobs 

www/h2o: Update to 1.7.0

- Update PORTVERSION and dinsto checksum (1.7.0)
- Update pkg-plist

Changes:

  https://github.com/h2o/h2o/blob/v1.7.0/Changes

PR:		206949
Submitted by:	Dave Cottlehuber <dch skunkwerks at> (maintainer)

 

22:02 rakuco 

Update to 1.6.3.

PR:		206708
Submitted by:	Dave Cottlehuber <dch@skunkwerks.at> (maintainer)

 

15:40 miwi 

- Update to 1.6.2

PR:		206193
Submitted by:	maintainer
MFH:		2016Q1
Security:	6c808811-bb9a-11e5-a65c-485d605f4717

 

15:59 junovitch 

www/h2o: update 1.6.0 -> 1.6.1 and add LibreSSL option

- OPTIONS: Add bundled LIBRESSL option and set as default
  - HTTP/2 support requires TLS ALPN extension missing in base OpenSSL
  - Upstream expectation is the bundled LibreSSL is used to support HTTP/2
  - Enables ChaCha20-Poly1305 ciphers as a bonus
- Update sample configuration file

Changes:	https://github.com/h2o/h2o/releases/tag/v1.6.1

PR:		205946
Submitted by:	Dave Cottlehuber <dch@skunkwerks.at> (maintainer)

 

23:30 junovitch 

www/h2o: update 1.5.3 -> 1.6.0

Changes:	https://github.com/h2o/h2o/releases/tag/v1.6.0

PR:		205337
Submitted by:	Dave Cottlehuber <dch@skunkwerks.at> (maintainer)

 

02:47 junovitch 

www/h2o: update 1.5.2 -> 1.5.3

Changes:	https://github.com/h2o/h2o/releases/tag/v1.5.3

PR:		204321
Submitted by:	Dave Cottlehuber <dch@skunkwerks.at> (maintainer)

 

23:05 junovitch 

www/h2o: update 1.5.0 -> 1.5.2

- Update cmake args and regen cmake patch for the new release
- Add documentation files to pkg-plist

Changes:	https://github.com/h2o/h2o/releases/tag/v1.5.1
Changes:	https://github.com/h2o/h2o/releases/tag/v1.5.2

PR:		203956
Submitted by:	Dave Cottlehuber <dch@skunkwerks.at> (maintainer)

 

14:00 junovitch 

www/h2o: update 1.4.5 -> 1.5.0

Changes:	https://github.com/h2o/h2o/releases/tag/v1.5.0

PR:		203575
Submitted by:	Dave Cottlehuber <dch@skunkwerks.at> (maintainer)

 

12:29 gblach 

- Fix rc.d issues introduced with recent perl changes [1]
- Update to 1.4.5 [2]

PR:		203147 [1], 203096 [2]
Submitted by:	Dave Cottlehuber (maintainer)

 

19:29 gblach 

- Update to 1.4.4 [1]
- Drop 8.x support [2]

PR:		202818 [1]
Submitted by:	Dave Cottlehuber (dch <at> skunkwerks <dot> at) [1]
Approved by:	portmgr blanket [2]

 

11:11 wen 

- Update to 1.4.3

PR:		202379
Submitted by:	dch@skunkwerks.at(maintainer)

 

11:21 pi 

www/h2o: 1.2.0 -> 1.4.2

ChangeLog:
https://github.com/h2o/h2o/releases

PR:		200998
Submitted by:	sean@x-n.su
Approved by:	Dave Cottlehuber <dch@skunkwerks.at> (maintainer)

 

06:10 wen 

- Update to 1.2.0

PR:		198573
Submitted by:	anonymous.bug.report@gmail.com
Approved by:	dch@skunkwerks.at(maintainer)

 

20:24 mat 

Update ports in the remaining categories to not use GH_COMMIT.

With minor cleanups to make things simpler.

With hat:	portmgr
Sponsored by:	Absolight

 

11:51 az 

- update to 1.0.1
- ignore build on OSVERSION < 9.0 as it doesn't compile even with clang
- some port cleanups

PR:		197846
Submitted by:	dch@skunkwerks.at (maintainer)

 

21:03 az 

- add new port: www/h2o

H2O is a very fast HTTP server written in C. It can also be used as a library.
It supports:

- HTTP/1.0, HTTP/1.1
- [HTTP/2](http://http2.github.io/)
- draft 16 (and draft 14 to support older clients)
- persistent connections
- chunked encoding
- negotiation methods: NPN, ALPN, Upgrade, direct
- dependency and weight-based prioritization
- server push
- TLS
- uses [OpenSSL](https://www.openssl.org/)

(Only the first 15 lines of the commit message are shown above )