www/freenginx-devel1.31.4_8

www/freenginx-devel: third-party modules management (+)

- update lua module to its recent snapshot
- update lua-stream module to its recent snapshot

Bump PORTREVISION.

Sponsored by:	tipi.work

www/freenginx-devel: third-party modules management (+)

- security update of the ngx_http_cache_purge to v.3.0.4

ChangeLog:	https://github.com/nginx-modules/ngx_cache_purge/compare/3.0.2...3.0.4
Security:	CVE-2026-108981

Bump PORTREVISION.

Sponsored by:	tipi.work

www/freenginx-devel: third-party modules management

- update njs module to 1.0.2

Bump PORTREVISION.

Sponsored by:	tipi.work

<ChangeLog>

nginx modules:

*) Bugfix: fixed response body framing and keepalive connection reuse
   in ngx.fetch().  Responses with conflicting Content-Length fields,
   with both Transfer-Encoding and Content-Length, or with 1xx status
   codes are now rejected.

*) Bugfix: fixed enforcement of max_response_body_size for chunked
   responses in ngx.fetch().

*) Bugfix: fixed parsing of js_periodic options following
   worker_affinity in HTTP and Stream configurations.

*) Bugfix: fixed memory leaks and false unhandled promise rejection
   reports when formatting rejection reasons in the QuickJS engine.

Core:

*) Security: fixed a memory leak when parsing malformed XML in the
   njs engine.  Repeated malformed input could exhaust worker process
   memory.

*) Security: fixed incomplete XML attribute values containing entity
   references.  JavaScript accessors could return values different
   from those used by XML canonicalization, affecting signed XML
   validation.

*) Feature: added XMLNode.getAttributeNS() and XMLNode.getChildNS()
   methods for namespace-aware attribute and child element lookup.

*) Improvement: reduced compilation memory consumption in the njs
   engine and released temporary parser and generator data after
   compilation.

*) Improvement: switched to constant-time HMAC signature verification
   in WebCrypto.

*) Change: XML node mutation and canonicalization now reject detached
   nodes, and a removed child node has an undefined $parent.
   Text and attribute values must be primitive strings; null and
   undefined retain their deletion semantics for these values.
   addChild() and $tags reject source trees with namespaces.
   Assigning to $tag$name now throws TypeError in the QuickJS engine;
   deletion is still supported.

*) Change: the "test262" make target was renamed to "js_test".
   The "test262" target now runs the official Test262 suite and
   requires NJS_TEST262_DIR.

*) Bugfix: fixed stale XML node references after tree mutations and
   a crash when repeatedly modifying a node in the QuickJS engine.

*) Bugfix: fixed XML node methods being hidden by child elements with
   matching names in the QuickJS engine.

*) Bugfix: fixed XML document leaks during property existence checks
   in the QuickJS engine.

*) Bugfix: fixed out-of-bounds reads and invalid frees when formatting
   unhandled promise rejection reasons in the QuickJS shell.

*) Bugfix: fixed crashes and incorrect error reporting when importing
   modules after a failed module compilation in the njs engine.

*) Bugfix: fixed oversized Buffer allocation lengths being truncated
   instead of rejected in the QuickJS engine.

*) Bugfix: fixed use of invalidated zlib dictionary memory during
   argument conversion in the QuickJS engine.

*) Bugfix: fixed UTC Date setters applying the local timezone offset
   in the njs engine.

*) Bugfix: fixed Promise.any() with empty input resolving with
   AggregateError instead of rejecting in the njs engine.

*) Bugfix: fixed excessive execution time and memory consumption in
   Array.prototype.sort() with huge sparse arrays in the njs engine.
   This closes #1095 issue on Github.

*) Bugfix: fixed Array.prototype.concat() with sparse arrays in the
   njs engine.
   This closes #1095 issue on Github.

*) Bugfix: fixed initialization of array literals with more than
   32760 elements in the njs engine.

*) Bugfix: fixed invalid memory accesses when enumerating typed arrays
   with Object.values() and Object.entries() in the njs engine.
   This closes #1098 issue on Github.

*) Bugfix: fixed invalid memory accesses in Object.defineProperty()
   with reentrant property descriptors in the njs engine.
   This closes #1089 issue on Github.

*) Bugfix: fixed object-to-primitive conversion when user code
   replaced the input value during conversion in the njs engine.
   This closes #1094 issue on Github.

*) Bugfix: fixed memory corruption in RegExp replace and split
   operations with custom exec() results in the njs engine.
   This closes #1090, #1091, #1092, #1093, #1096, and #1097 issues
   on Github.

*) Bugfix: fixed out-of-bounds reads in RegExp replacement with
   inconsistent match objects in the njs engine.
   Thanks to Basavaraj S m.

*) Bugfix: fixed out-of-bounds reads in RegExp named capture lookup
   in the njs engine.
   This closes #1088 issue on Github.

*) Bugfix: fixed parsing of for loop initializers and preservation of
   lexical bindings across nested declarations in the njs engine.

*) Bugfix: prevented stack overflow when compiling deeply nested
   expressions in the njs engine by limiting recursive analysis.

<ChangeLog>

www/freenginx-devel: point to the actual OpenSSL 3.5 port

Bump PORTREVISION.

Sponsored by:	tipi.work

devel/grpc: Update to 1.84.0

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://github.com/grpc/grpc/releases

www/freenginx-devel: third-party modules management (+)

- update ngx-http-auth-jwt module to 2.5.0

Bump PORTREVISION.

Sponsored by:	tipi.work

www/freenginx-devel: third-party modules management (+)

- update nginx-auth-jwt module to 0.15.0, for details see
  https://github.com/kjdev/nginx-auth-jwt/compare/0.14.2...0.15.0

Bump PORTREVISION.

Sponsored by:	tipi.work

www/freenginx-devel: third-party modules management

- njs module security update to 1.0.1

Bump PORTREVISION.

Sponsored by:	tipi.work

<ChangeLog>

nginx modules:

*) Security: fixed an access control bypass in js_access when an
   asynchronous request body continuation threw an exception or
   produced an unhandled rejection.  Previously, nginx could continue
   processing the request as though the js_access check had succeeded.
   Thanks to Ta Duc Thien.

*) Security: fixed a worker process crash when reading
   Response.statusText after an upstream server returned a status
   line with an empty reason phrase.

*) Bugfix: fixed unhandled promise rejection tracking in reused
   QuickJS contexts.

*) Bugfix: fixed SharedDict.pop() returning undefined for unexpired
   entries in shared dictionaries with a timeout.

*) Bugfix: fixed validation and replacement of Fetch Headers values.
   This also fixed dangling header names in the QuickJS engine.

*) Bugfix: fixed missing validation of r.headersOut names and values,
   and of redirect targets passed to r.return().

*) Bugfix: fixed use-after-free, worker aborts, and leaks caused by
   cyclic references involving Fetch, HTTP request, and Stream session
   objects in the QuickJS engine.

*) Bugfix: fixed QuickJS context reuse after internal redirects and
   when pending jobs remained after request teardown.

*) Bugfix: fixed cleanup of partially initialized JavaScript contexts
   when request setup failed.

Core:

*) Security: fixed a heap buffer overflow while parsing namespace
   prefix lists passed to XML exclusive canonicalization.
   Thanks to Vladimir Vulnerability Research Tech Lead @ Cyera,
   evilgensec.

*) Bugfix: fixed a stack buffer overflow when exporting RSA keys
   larger than 4096 bits to JWK in WebCrypto.
   Thanks to Vaibhav Rajput.

*) Bugfix: fixed RSA-OAEP encryption and decryption with SHA-256 and
   SHA-384 digests in WebCrypto.

*) Bugfix: fixed compatibility with quickjs-ng 0.16.0 and later.

*) Bugfix: fixed empty stack traces for QuickJS errors created by
   host callbacks.

*) Feature: added btoa() and atob() global functions to the QuickJS
   engine and aligned their behavior between both engines.

<ChangeLog>

www/freenginx-devel: update: 1.31.3 -> 1.31.4

Sponsored by:	tipi.work

<ChangeLog>

*) Bugfix: the "index" directive used old values of non-cacheable
   variables.

*) Bugfix: variables with side effects might cause incorrect results
   during variable substitution and "no buffer space in script copy"
   alerts.

*) Bugfix: a segmentation fault might occur in a worker process when
   using regular expression captures with the
   "proxy_cache_background_update" directive or the
   ngx_http_slice_module.

*) Bugfix: in the ngx_http_perl_module; the bug had appeared in 1.31.3.

*) Bugfix: "header already sent" alerts might appear in logs when using
   SSI with proxying.

*) Bugfix: some data received from a backend with unbuffered proxying
   might not be sent to the client immediately when using SSI and the
   "gunzip" directive.

*) Change: now, if a connection to a backend is closed due to a timeout
   during buffered proxying, all data previously received from the
   backend are sent to the client.

</ChangeLog>

www/freenginx-devel: third-party modules management

- update passenger to 6.2.0

Bump PORTREVISION.

Sponsored by:	tipi.work

devel/grpc: Update to 1.83.0

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://github.com/grpc/grpc/releases

www/freenginx-devel: third-party modules management (+)

- update headers-more module to its recent version

Bump PORTREVISION.

Sponsored by:	tipi.work

www/freenginx-devel: follow change of other nginx ports

Reviewed by:	osa (maintainer, mentor)
Approved by:	osa (maintainer, mentor)
Differential Revision: https://reviews.freebsd.org/D58692

(cherry picked from commit 8c2ac84b701610ea2c269aeb8f06ead8eae48cb2)

www/freenginx-devel: chase devel/mongo-c-driver update

PR:             296607
Reported by:    Hiroo Ono <hiroo.ono+freebsd@gmail.com> (author)
Approved by:    Sergey A. Osokin <osa@FreeBSD.org>
Approved by:    osa, vvd (Mentors, implicit)

www/freenginx-devel: third-party modules management (+)

- update auth_jwt to 0.14.2
- update keyval module to its recent revision

Bump PORTREVISION.

Sponsored by:	tipi.work

www/freenginx-devel: third-party modules management (+)

- update lua
- update luastream
- update passenger

to their recent releases/snapshots.

Bump PORTREVISION.

Sponsored by:	tipi.work

devel/grpc: Update to 1.82.0

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://github.com/grpc/grpc/releases

www/freenginx-devel: third-party modules management (+)

- auth_jwt module update: 0.13.1 -> 0.14.1

Bump PORTREVISION.

Sponsored by:	tipi.work

www/freenginx-devel: third-party modules management (+)

Fix and enable build for the substitution_filter module.

Bump PORTREIVISON.

Sponsored by:	tipi.work

devel/grpc: Update to 1.81.1

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://github.com/grpc/grpc/releases

www/freenginx-devel: update: 1.31.2 -> 1.31.3

Build of the substitutions filter third-party module is temporarily disabled.

Sponsored by:	tipi.work

<ChangeLog>

*) Feature: additional checks are now used during variable substitution,
   including during execution of the ngx_http_rewrite_module directives,
   to prevent buffer overruns in case of errors in the code.

*) Bugfix: if the "auth_request_set" directive or regular expression
   named captures were used to change prefix variables, such as
   "$http_...", corresponding variables became empty in other parts of
   the configuration.

*) Bugfix: changing the $limit_rate and $args variables with the
   "auth_request_set" directive or regular expression named captures
   worked incorrectly.

*) Bugfix: in error handling in the mail proxy module.
   Thanks to Evan Hellman, Trail of Bits.

*) Bugfix: in error handling when using gzipping.
   Thanks to Evan Hellman, Trail of Bits.

*) Bugfix: in HTTP/3.

*) Bugfix: a segmentation fault might occur in a worker process when
   sending very long request header lines to a gRPC backend.
   Thanks to Evan Hellman, Trail of Bits.

*) Bugfix: a segmentation fault might occur in a worker process if the
   ngx_http_charset_module was used to convert responses from UTF-8.

*) Bugfix: in the ngx_http_perl_module.
   Thanks to Evan Hellman, Trail of Bits and Axel Mierczuk, Keith
   Hoodlet, 1Password's Off-by-1 Labs.

*) Bugfix: in error handling when using the proxy_no_cache directive.
   Thanks to Valentin Bartenev.

</ChangeLog>

www/freenginx-devel: third-party modules management (+)

- update passenger from 6.1.4 to 6.1.6

Bump PORTREVISION.

Sponsored by:	tipi.work

www/freenginx-devel: update njs module to 1.0.0

Bump PORTREVISION.

Sponsored by:	tipi.work

<ChangeLog>

nginx modules:

*) Improvement: aligned HTTP, Stream, and Fetch exception classes
   between the njs and QuickJS engines.  API misuse is now reported
   as TypeError and status bounds violations as RangeError.

*) Improvement: rejected unsafe request targets, methods, and header
   values in ngx.fetch() before request serialization.

*) Bugfix: fixed a heap use-after-free in r.subrequest() when the
   client closed the connection before the background subrequest
   completed.  The issue was introduced in 75d6b61 (0.9.5).
   This closes #1077 issue on Github.

*) Bugfix: fixed a worker segfault while reading a request header
   that nginx registers without a dedicated slot, such as
   "Proxy-Connection", via r.headersIn.
   This closes #1071 issue on Github.

*) Bugfix: excluded unverified-TLS and dynamic-proxy connections
   from the ngx.fetch() keepalive cache and validated cached
   connections before reuse.

*) Bugfix: fixed Content-Length truncation for very large request
   bodies and a missing CONNECT terminator for proxies configured
   without credentials in ngx.fetch().

*) Bugfix: fixed leaks of promises, events, and init property values
   on ngx.fetch() failure paths in the QuickJS engine.

*) Bugfix: fixed missing fetch event cleanup when the resolver
   failed to start.

*) Bugfix: fixed an out-of-bounds read of a short fetch proxy URL.

*) Bugfix: fixed request body truncation in r.readRequestJSON() for
   bodies containing invalid UTF-8 in the QuickJS engine.

*) Bugfix: fixed an out-of-bounds read while loading a shared
   dictionary state file.

*) Bugfix: set a pending exception when sendHeader(), send(), and
   finish() fail in the njs HTTP handlers.

*) Bugfix: fixed the variable value state after a stream variable
   storage allocation failure.

Core:

*) Improvement: bounded string-producing chained-buffer growth, so
   that exceeding the maximum string length raises a catchable
   RangeError("invalid string length") instead of exhausting worker
   memory.

*) Improvement: aligned built-in exception classes (XML, console,
   TextEncoder, TextDecoder, Buffer, fs.Stats) between the
   njs and QuickJS engines.

*) Bugfix: fixed an infinite loop while inflating a zlib stream
   that requires a dictionary in the QuickJS engine.

*) Bugfix: fixed an infinite loop in Buffer.prototype.fill() with
   a zero-length typed array source.

*) Bugfix: fixed a use-after-free in Array.prototype.sort() when a
   getter invoked for a hole grows the array.

*) Bugfix: fixed type confusion in Buffer.concat() when a list
   element getter returns a typed array during validation but not
   during the copy.

*) Bugfix: fixed an out-of-bounds access in the variable-length
   Buffer readInt/writeInt methods with a zero byteLength.

*) Bugfix: fixed an out-of-bounds read in Buffer.prototype.toString()
   when start was greater than end.

*) Bugfix: fixed Array.prototype.slice() of large arrays returning
   wrong results in the non-fast keys path.

*) Bugfix: fixed the typed array constructor, slice(), toReversed(),
   and toSorted() ignoring the source view byte offset in the
   same-type fast path.

*) Bugfix: fixed Buffer allocation length checks for lengths greater
   than or equal to 2^32 on 32-bit platforms.

*) Bugfix: fixed the Buffer.from() typed-array source offset for
   multi-byte element types in the QuickJS engine.

*) Bugfix: fixed Buffer float access alignment.

*) Bugfix: fixed an out-of-bounds read in a parser string escape
   lookahead.

<ChangeLog>

www/freenginx-devel: third-party modules management (+)

Update third-party modules to their recent snapshots:

- keyval
- lua
- mod_zip (moves back to its original author's repo)

Bump PORTREVISION.

Sponsored by:	tipi.work

www/freenginx-devel: third-party modules management (+)

Update nginx-otel module to its recent snapshot.

Bump PORTREVISION.

Sponsored by:	tipi.work

www/freenginx-devel: third-party modules management (+)

Update third-party passenger module to 6.1.4.

Bump PORTREVISION.

Sponsored by:	tipi.work

www/freenginx-devel: third-party modules management (+)

Update the following third-party modules and their dependencies
to the recent snapshots:

- echo
- encrypted session
- drizzle
- lua
- luastream
- memc
- set_misc
- srcache

Bump PORTREVISION.

Sponsored by:	tipi.work

www/freenginx-devel: add third-party auth_jwt module (+)

The binary form of the auth_jwt module has exactly the same name
as the binary form of the http_auth_jwt module, so let's guarded
both modules with the PREVENTS* knobs.

Bump PORTREVISION.

Sponsored by:	tipi.work

www/freenginx-devel: third-party modules management (+)

- cache_purge - update to 3.0.2
- lua - update to its recent bugfix snapshot
- lua-stream - update to its recent bugfix snapshot

Bump PORTREVISION.

Sponsored by:	tipi.wori

www/freenginx-devel: update: 1.31.1 -> 1.31.2

Sponsored by:	tipi.work

<ChangeLog>

*) Bugfix: a segmentation fault might occur in a worker process if
   nested captures were used in the "rewrite" directive.

*) Bugfix: the "if" directive incorrectly handled relative paths when
   checking files.

</ChangeLog>

www/freenginx-devel: third-party modules management (+)

- update lua module to its recent revision aka v0.10.13rc3

Bump PORTREVISION.

Sponsored by:	tipi.work

www/freenginx-devel: update third-party nchan module (+)

Bump PORTREVISION.

Sponsored by:	tipi.work

www/freenginx-devel: third-party modules management (+)

Update lua-nginx and stream-lua-nginx modules to their recent
snapshots.
Cleanup distinfo records.

Bump PORTREVISION.

Sponsored by:	tipi.work

www/freenginx-devel: update: 1.31.0 -> 1.31.1

Sponsored by:	tipi.work

<ChangeLog>

*) Feature: the "off" parameter of the "index" directive.
   Thanks to Fabiano Furtado.

*) Bugfix: a segmentation fault might occur in a worker process if the
   "rewrite" directive was used to change request arguments and other
   directives of the ngx_http_rewrite_module were executed afterwards.

*) Bugfix: in the "set" directive.

*) Bugfix: a segmentation fault might occur in a worker process if the
   ngx_http_charset_module was used to convert responses from UTF-8.

*) Bugfix: in the ngx_http_charset_module.

*) Bugfix: a segmentation fault might occur in a worker process if the
   "ssl_ocsp" directive was used.

*) Bugfix: a segmentation fault might occur in a worker process if the
   "scgi_pass" or "uwsgi_pass" directives were used.

*) Bugfix: in the "scgi_request_buffering" directive.

*) Bugfix: in HTTP/3.

</ChangeLog>

www/freenginx-devel: update njs 0.9.8 -> 0.9.9 (+)

Bump PORTREVISION.

<ChangeLog>

nginx modules:

*) Security: a heap buffer overflow might occur in a worker process
   when the "js_fetch_proxy" directive value contains nginx
   variables derived from the client request ($http_*, $arg_*,
   $cookie_*, etc.) and the location's JS handler invokes
   ngx.fetch(). The issue was introduced in dea83189 (0.9.4).

*) Feature: added js_access directive.

*) Feature: added r.readRequestText(), r.readRequestArrayBuffer(),
   and r.readRequestJSON() - async methods that read the request
   body, available in js_access and js_content directives.

*) Feature: added r.readRequestForm() - async method that parses
   the request body submitted from an HTML form
   (application/x-www-form-urlencoded and multipart/form-data) and
   returns a structured accessor object.  The method is available
   in js_access and js_content directives.

*) Feature: added jsVarNames() method.  The method returns the
   names of variables declared with js_var.

Core:

*) Bugfix: fixed evaluation order of call arguments with side
   effects.  Previously, an earlier argument could observe a later
   argument's mutation, e.g. f(a, a = 2) passed 2 as both
   arguments.
   The issue was introduced in fd5e523f (0.9.7).

</ChangeLog>

www/freenginx-devel: bump PORTSCOUT's value

www/freenginx-devel: update: 1.30.0 -> 1.31.0

Sponsored by:	tipi.work

<ChangeLog>

*) Change: now the "try_files" directive can be used with arguments
   starting with the request URI inside a location given by a regular
   expression, along with the "alias" directive.

*) Bugfix: the "try_files" directive might work incorrectly when used
   with the "alias" directive.

*) Bugfix: a segmentation fault might occur in a worker process if the
   "try_files" and "proxy_pass" directives were used together.

*) Bugfix: the "proxy_pass" directive without a URI part might use the
   original request URI after the URI was changed by the "try_files"
   directive.

*) Change: the logging level of the "invalid ccs message", "not on
   record boundary", "required compression algorithm missing", and some
   "record layer failure" SSL errors has been lowered from "crit" to
   "info".

</ChangeLog>

www/freenginx-devel: update third-party njs module: 0.9.7 -> 0.9.8 (+)

Bump PORTREVISION.

<ChangeLog>

nginx modules:

*) Bugfix: fixed loading of the built-in "crypto" module.
   The issue was introduced in 3185ce81 (0.9.7).

</ChangeLog>

devel/grpc: Update to 1.80.0

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://github.com/grpc/grpc/releases

www/freenginx-devel: update njs module: 0.9.6 -> 0.9.7

Bump PORTREVISION.

Sponsored by:	tipi.work

</ChangeLog>

nginx modules:

*) Feature: improved shared dict eviction strategy.

*) Feature: added ttl() method to shared dictionaries.

*) Bugfix: removed spurious "js vm init" notice log emitted during
   configuration parsing.

*) Bugfix: removed shared dict expiration from read-locked paths.

*) Bugfix: fixed double-free in shared dict update with eviction.

*) Bugfix: fixed per-entry TTL reset on shared dict incr() calls.

Core:

*) Feature: added Ed25519 and X25519 support for WebCrypto.

*) Feature: added wrapKey() and unwrapKey() support for WebCrypto.

*) Feature: added crypto.randomUUID().

*) Feature: allowed await expressions in tagged templates and as
   call arguments.

*) Improvement: switched to OpenSSL EVP for hashing in the built-in
   "crypto" module.

*) Bugfix: fixed call argument evaluation.

</ChangeLog>

www/freenginx-devel: update to 1.30.0

Sponsored by:	tipi.work

<ChangeLog>

*) 1.30.x stable branch.

</ChangeLog>

www/freenginx-devel: update: 1.29.6 -> 1.29.7

Sponsored by:	tipi.work

<ChangeLog>

*) Feature: OpenSSL 4.0 compatibility.

*) Bugfix: a segmentation fault might occur in a worker process if the
   ngx_http_dav_module was used to handle COPY and MOVE methods in a
   location with the "alias" directive.

*) Bugfix: client host name was not escaped in requests to the
   authentication server and in the XCLIENT command if the "resolver"
   directive was used in the SMTP proxy.

*) Bugfix: in the mail proxy module.

</ChangeLog>

www/freenginx-devel: update from 1.29.5 to 1.29.6

Sponsored by:	tipi.work

<ChangeLog>

*) Bugfix: incorrect "upstream server temporarily disabled" messages
   might be logged when using variables in the "proxy_pass" directive.

*) Bugfix: retrying a request to the next gRPC upstream server might not
   work correctly.
   Thanks to David Carlier.

*) Bugfix: a segmentation fault might occur in a worker process if the
   ngx_http_xslt_filter_module was used.

*) Bugfix: a segmentation fault might occur in a worker process if the
   ngx_http_mp4_module was used.

*) Bugfix: in the ngx_http_uwsgi_module and ngx_http_scgi_module
   modules.

*) Bugfix: in memory allocation error handling.

</ChangeLog>

www/freenginx-devel: fix a third-party rds-csv dynamic module build

Bump PORTREVISION.

Sponsored by:	tipi.work

devel/grpc: Update to 1.78.0

- Add OPENTELEMETRY option: disable by default for now due to build failure
- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://github.com/grpc/grpc/releases

www/freenginx-devel: third-party modules management (+)

- update vts module to its recent revision
- update zstd module to its recent revision

Bump PORTREVISION.

Sponsored by:	tipi.work

www/freenginx-devel: update njs module to 0.9.6

<ChangeLog>

nginx modules:

*) Bugfix: fixed expire field truncation in shared dict state files.
   Millisecond timestamps were silently truncated to 10 digits,
   making restored entries appear expired on restart.
   The issue has been present since eca03622 (0.9.1).

*) Bugfix: suppressed slab log_nomem for evict shared dict zones.
   When evict is enabled, memory allocation failures are expected
   and handled by evicting old entries.

*) Bugfix: fixed stack trace for native fetch exceptions for QuickJS
   engine.

Core:

*) Feature: added optional chaining support.

*) Feature: added nullish coalescing assignment operator (??=).

*) Feature: added logical assignment operators (||= and &&=).

*) Improvement: aligned SyntaxError reporting with other JS engines.
   Previously, file name was a part of the error message.  Now it is
   reported as "stack" property.

*) Improvement: improved Error.stack traces.
   Stack traces are now attached in error constructors.  Performance
   of Error.stack is improved by ~100 times.

*) Bugfix: fixed string offset map corruption in scope values hash.
   The issue caused SEGV/SIGBUS crashes for multi-byte UTF-8 string
   constants with more than 32 characters when accessing a character
   at index >= 32 (e.g. via .replace() or bracket notation).
   The issue was introduced in e7caa46d (0.9.5).

*) Bugfix: fixed heap-buffer-overflow in atom hash caused by
   Symbol().

*) Bugfix: fixed WebCrypto importKey() crash with mismatched JWK key
   type.

*) Bugfix: fixed interactive mode detection for piped stdin.
   The issue was introduced in 4988565c (0.8.0).

*) Bugfix: fixed build on MacOS.

*) Bugfix: fixed PTR macro compatibility with newer BFD library.

*) Bugfix: auto/cc: use portable 'command -v' instead of 'which'.
   Thanks to Zurab Kvachadze.

</ChangeLog>

www/freenginx-devel: third-party module management (+)

- update vts module to its recent snapshot

Bump PORTREVISION.

Sponsored by:	tipi.work

www/freenginx-devel: third-party module management (+)

- update passenger to 6.1.2

Bump PORTREVISION.

Sponsored by:	tipi.work

www/freenginx-devel: update to 1.29.5

<ChangeLog>

*) Feature: optimized SSL_sendfile() usage on FreeBSD.
   Thanks to Gleb Smirnoff.

*) Bugfix: upstream servers were not marked as failed after a response
   with status code 500, 502, 503, 504, or 429 if the code was listed in
   the "proxy_next_upstream" directive, but switching to the next server
   was not possible.

*) Bugfix: the "stale-if-error" cache control extension was not applied
   if a backend returned a response with status code 500, 502, 503, 504,
   or 429 and the code was listed in the "proxy_next_upstream"
   directive.

*) Bugfix: in handling of premature backend responses.

</ChangeLog>

Sponsored by:	tipi.work