NGINX is a high performance edge web server with the lowest memory footprint
and the key features to build modern and efficient web infrastructure.
NGINX functionality includes HTTP server, HTTP and mail reverse proxy, caching,
load balancing, compression, request throttling, connection multiplexing and
reuse, SSL offload and HTTP media streaming.
See also: https://nginx.org/
Reason:
Following the rename of security/openssl35 to security/openssl, the
HTTPV3_OSSL35 option has been renamed to HTTPV3_OSSL.
The saved setting does not carry over. If you had the old option
enabled, select the new one and rebuild the port:
# make -C /usr/ports/www/nginx-devel config
Number of commits found: 1304 (showing only 100 on this page) #
www/nginx-devel: update from 1.21.2 to 1.21.3.
<Changelog>
*) Change: optimization of client request body reading when using
HTTP/2.
*) Bugfix: in request body filters internal API when using HTTP/2 and
buffering of the data being processed.
</Changelog>
www/nginx-devel: update from 1.21.1 to 1.21.2.
While I'm here, fix build of the third-party ajp module by changing
a distribution point.
<Changelog>
*) Change: now nginx rejects HTTP/1.0 requests with the
"Transfer-Encoding" header line.
*) Change: export ciphers are no longer supported.
*) Feature: OpenSSL 3.0 compatibility.
*) Feature: the "Auth-SSL-Protocol" and "Auth-SSL-Cipher" header lines
(Only the first 15 lines of the commit message are shown above )
www/nginx-devel: update NGINX JavaScript module to 0.6.2.
<ChangeLog>
nginx modules:
*) Bugfix: fixed CPU hog when js_filter is registered
in both directions.
Core:
*) Feature: introduced AggregateError implementation.
*) Feature: added remaining Promise constructor methods.
The following methods were added: Promise.all(),
Promise.allSettled(), Promise.any(), Promise.race().
(Only the first 15 lines of the commit message are shown above )
www/nginx-devel: update from 1.21.0 to 1.21.1.
<Changelog>
*) Change: now nginx always returns an error for the CONNECT method.
*) Change: now nginx always returns an error if both "Content-Length"
and "Transfer-Encoding" header lines are present in the request.
*) Change: now nginx always returns an error if spaces or control
characters are used in the request line.
*) Change: now nginx always returns an error if spaces or control
characters are used in a header name.
(Only the first 15 lines of the commit message are shown above )
www/nginx-devel: update NGINX JavaScript module to 0.6.1.
<ChangeLog>
*) Bugfix: fixed RegExpBuiltinExec() with UTF-8 only regexps.
The bug was introduced in 0.4.2.
*) Bugfix: fixed parsing of export default declaration with
non-assignment expressions.
Thanks to Artem S. Povalyukhin.
</ChangeLog>
www/nginx-devel: update NGINX JavaScript module to 0.6.0.
Bump PORTREVISION.
<ChangeLog for njs 0.5.3>
Core:
*) Feature: added let and const declaration support.
*) Feature: added RegExp.prototype[Symbol.split].
*) Feature: added sticky flag support for RegExp.
*) Bugfix: fixed heap-buffer-overflow in
(Only the first 15 lines of the commit message are shown above )
www/nginx-devel: security update from 1.20.0 to 1.21.0.
Security: 0882f019-bd60-11eb-9bdd-8c164567ca3c
Security: CVE-2021-23017
<Changelog>
*) Security: 1-byte memory overwrite might occur during DNS server
response processing if the "resolver" directive was used, allowing an
attacker who is able to forge UDP packets from the DNS server to
cause worker process crash or, potentially, arbitrary code execution
(CVE-2021-23017).
*) Feature: variables support in the "proxy_ssl_certificate",
"proxy_ssl_certificate_key" "grpc_ssl_certificate",
(Only the first 15 lines of the commit message are shown above )
www/nginx-devel: update from 1.19.9 to 1.19.10.
<Changelog>
*) Change: the default value of the "keepalive_requests" directive was
changed to 1000.
*) Feature: the "keepalive_time" directive.
*) Feature: the $connection_time variable.
*) Workaround: "gzip filter failed to use preallocated memory" alerts
appeared in logs when using zlib-ng.
</Changelog>
Update from 1.19.8 to 1.19.9.
Update NGINX JavaScript module from 0.5.2 to 0.5.3.
Remove needless patches.
<ChangeLog for nginx 1.19.9>
*) Bugfix: nginx could not be built with the mail proxy module, but
without the ngx_mail_ssl_module; the bug had appeared in 1.19.8.
*) Bugfix: "upstream sent response body larger than indicated content
length" errors might occur when working with gRPC backends; the bug
had appeared in 1.19.1.
*) Bugfix: nginx might not close a connection till keepalive timeout
(Only the first 15 lines of the commit message are shown above )
Update from 1.19.7 to 1.19.8.
Add the vendor's patch to build mail module without SSL support.
<Changelog>
*) Feature: flags in the "proxy_cookie_flags" directive can now contain
variables.
*) Feature: the "proxy_protocol" parameter of the "listen" directive,
the "proxy_protocol" and "set_real_ip_from" directives in mail proxy.
*) Bugfix: HTTP/2 connections were immediately closed when using
"keepalive_timeout 0"; the bug had appeared in 1.19.7.
*) Bugfix: some errors were logged as unknown if nginx was built with
glibc 2.32.
*) Bugfix: in the eventport method.
</Changelog>
Refresh the kernel TLS patch.
This functionality is available with the following prerequisites:
o) security/openssl built from ports with the kTLS options defined;
o) FreeBSD 13.
Bump PORTREVISION.
Submitted by: jhb
Obtained from: https://github.com/nginx/nginx/compare/master...bsdjhb:ktls.patch
Update from 1.19.6 to 1.19.7.
Update njs module from 0.5.0 to 0.5.1.
Update third-party auth_ldap module to its recent commit.
<Changelog>
Changes with nginx 1.19.7 16 Feb 2021
*) Change: connections handling in HTTP/2 has been changed to better
match HTTP/1.x; the "http2_recv_timeout", "http2_idle_timeout", and
"http2_max_requests" directives have been removed, the
"keepalive_timeout" and "keepalive_requests" directives should be
used instead.
*) Change: the "http2_max_field_size" and "http2_max_header_size"
(Only the first 15 lines of the commit message are shown above )
Fix PROPFIND fail with 500 on simlinks to non exist file/dir
when nginx compiled with the third-party http_dav_ext module.
Bump PORTREVISION.
PR: 220871
Update the following third-party modules to their recent
commits or versions:
o) aws_auth
o) brotli
o) http_shibboleth
o) set_misc
o) srcache
Bump PORTREVISION.
Update from 1.19.5 to 1.19.6.
<Changelog>
*) Bugfix: "no live upstreams" errors if a "server" inside "upstream"
block was marked as "down".
*) Bugfix: a segmentation fault might occur in a worker process if HTTPS
was used; the bug had appeared in 1.19.5.
*) Bugfix: nginx returned the 400 response on requests like
"GET http://example.com?args HTTP/1.0".
*) Bugfix: in the ngx_http_flv_module and ngx_http_mp4_module.
Thanks to Chris Newton.
</Changelog>
Fix a worker process issue by adding the vendor's patch.
Bump PORTREVISION.
Reported by: Peter Putzer <freebsd@mnd.sc>
<ChangeLog>
SSL: fixed SSL shutdown on lingering close.
Ensure c->recv is properly reset to ngx_recv if SSL_shutdown()
blocks on writing.
The bug had appeared in 554c6ae25ffc.
</ChangeLog>
PR: 251664
Update njs module from 0.4.4 to 0.5.0.
Bump PORTREVISION.
<ChangeLog>
nginx modules:
*) Feature: introduced global "ngx" object.
The following methods were added:
ngx.log(level, msg)
The following properties were added:
ngx.INFO,
ngx.WARN,
ngx.ERR.
(Only the first 15 lines of the commit message are shown above )
Update from 1.19.4 to 1.19.5.
<Changelog>
*) Feature: the -e switch.
*) Feature: the same source files can now be specified in different
modules while building addon modules.
*) Bugfix: SSL shutdown did not work when lingering close was used.
*) Bugfix: "upstream sent frame for closed stream" errors might occur
when working with gRPC backends.
*) Bugfix: in request body filters internal API.
</Changelog>
Update from 1.19.3 to 1.19.4.
Remove needless patches.
<Changelog>
*) Feature: the "ssl_conf_command", "proxy_ssl_conf_command",
"grpc_ssl_conf_command", and "uwsgi_ssl_conf_command" directives.
*) Feature: the "ssl_reject_handshake" directive.
*) Feature: the "proxy_smtp_auth" directive in mail proxy.
</Changelog>
Update nginx from 1.19.2 to 1.19.3.
Update njs module from 0.4.3 to 0.4.4.
<Changelog for nginx 1.19.3>
*) Feature: the ngx_stream_set_module.
*) Feature: the "proxy_cookie_flags" directive.
*) Feature: the "userid_flags" directive.
*) Bugfix: the "stale-if-error" cache control extension was erroneously
applied if backend returned a response with status code 500, 502,
503, 504, 403, 404, or 429.
(Only the first 15 lines of the commit message are shown above )
Add the corresponding library path to the patch for the
third-party http_auth_spnego module.
The third-party http_auth_spnego module may not work with
in-base Kerberos implementation because of gss_locaname()
function usage, so remove the GSSAPI_BASE option from the
GSSAPI radio button.
Bump PORTREVISION.
Partially revert back r533146 cause upstream_check third-party
dynamic module can't work as expected, so let's keep it static
for now.
Bump PORTREVISION.
PR: 247523
Update nginx from 1.19.1 to 1.19.2.
Update njs module from 0.4.2 to 0.4.3.
While I'm here soften some variables and target definitions to
prepare the port for a separate build of dynamic modules.
<Changelog for nginx 1.19.2>
*) Change: now nginx starts closing keepalive connections before all
free worker connections are exhausted, and logs a warning about this
to the error log.
*) Change: optimization of client request body reading when using
chunked transfer encoding.
(Only the first 15 lines of the commit message are shown above )
Update from 1.19.0 to 1.19.1.
<ChangeLog>
*) Change: the "lingering_close", "lingering_time", and
"lingering_timeout" directives now work when using HTTP/2.
*) Change: now extra data sent by a backend are always discarded.
*) Change: now after receiving a too short response from a FastCGI
server nginx tries to send the available part of the response to the
client, and then closes the client connection.
*) Change: now after receiving a response with incorrect length from a
gRPC backend nginx stops response processing with an error.
(Only the first 15 lines of the commit message are shown above )
Merge r537527 and r537550 from www/nginx:
1. Switch with the nginx-upload-module to fdintino, they support http/2:
https://github.com/fdintino/nginx-upload-module/.
2. Update 3rd party module nginx-link-function to 3.2.2.
Bump PORTREVISION.
PR: 246746 [1]
246897 [2]
Update nginx from 1.18.0 to 1.19.0.
<ChangeLog>
*) Feature: client certificate validation with OCSP.
*) Bugfix: "upstream sent frame for closed stream" errors might occur
when working with gRPC backends.
*) Bugfix: OCSP stapling might not work if the "resolver" directive was
not specified.
*) Bugfix: connections with incorrect HTTP/2 preface were not logged.
</ChangeLog>
Update njs module from 0.4.0 to 0.4.1.
While I'm here add '--with-compat' option to the configure script
to enable dynamic modules compatibility.
<ChangeLog>
*) Feature: added support for multi-value headers in r.headersIn.
*) Feature: introduced raw headers API.
*) Feature: added TypedScript API description.
Core:
*) Bugfix: fixed Array.prototype.slice() for sparse arrays.
</ChangeLog>
Convert the following third-party modules to dynamic:
o) accept_language
o) modsecurity3
While I'm here fix the third-party auth_krb5 module build.
Bump PORTREVISION.
Update njs module from 0.3.9 to 0.4.0.
<ChangeLog>
*) Feature: added js_import directive.
*) Feature: added support for multi-value headers in r.headersOut.
*) Improvement: iteration over r.headersOut with special headers.
*) Improvement: iteration over r.headersOut with duplicates.
*) Change: r.responseBody property handler now returns "undefined"
instead of throwing an exception if response body is not available.
(Only the first 15 lines of the commit message are shown above )
Update some third-party modules to their recent versions.
Convert the following third-party modules to dynamic:
o) ajp
o) cache_purge
o) vts
o) websockify
Bump PORTREVISION.
Update nginx from 1.17.9 to 1.17.10.
Keep third-party modules knobs sorted, but DEVEL_KIT must be
earlier cause ARRAYVAR depends on it, so partially revert back
r531124.
<ChangeLog>
*) Feature: the "auth_delay" directive.
</ChangeLog>
Add STREAM_REALIP knob for the ngx_stream_realip module. (*)
Enable STREAM_REALIP knob by default.
Also, create STREAMGRP group for stream-specific modules.
Bump PORTREVISION.
Requested by: Kirill I. <kerya@kerya.net> (*)
Update nginx from 1.17.8 to 1.17.9.
<ChangeLog>
*) Change: now nginx does not allow several "Host" request header lines.
*) Bugfix: nginx ignored additional "Transfer-Encoding" request header
lines.
*) Bugfix: socket leak when using HTTP/2.
*) Bugfix: a segmentation fault might occur in a worker process if OCSP
stapling was used.
*) Bugfix: in the ngx_http_mp4_module.
*) Bugfix: nginx used status code 494 instead of 400 if errors with code
494 were redirected with the "error_page" directive.
*) Bugfix: socket leak when using subrequests in the njs module and the
"aio" directive.
</ChangeLog>
Update NGINX JavaScript (aka njs) module from 0.3.8 to 0.3.9.
To avoid a potential conflict between two versions of LuaJIT let's
update mod_security's dependecy list and use lang/luajit-openresty
instead of original lang/luajit.
Bump PORTREVISION.
Add link-function third-party module, it provides dynamic linking to
your application in a server context and call the function of your
application in a location directive.
Bump PORTREVISION.
Update nginx from 1.17.7 to 1.17.8.
Update third-party njs module from 0.3.7 to 0.3.8.
<ChangeLog with nginx 1.17.8>
*) Feature: variables support in the "grpc_pass" directive.
*) Bugfix: a timeout might occur while handling pipelined requests in an
SSL connection; the bug had appeared in 1.17.5.
*) Bugfix: in the "debug_points" directive when using HTTP/2.
Thanks to Daniil Bondarev.
</ChangeLog>
(Only the first 15 lines of the commit message are shown above )
