lua-nginx-module embeds Lua into nginx and provides a powerful scripting
environment for nginx HTTP request processing.
It is part of the OpenResty ecosystem and is commonly used together with
lua-resty-core and ngx_devel_kit.
Reason:
Since 20260819 www/nginx-module-lua no longer installs a prebuilt
libexec/nginx/ngx_http_lua_module.so. The port now only provides the
module sources used by the nginx ports, because the prebuilt module
conflicted with the one built by www/nginx with the LUA option.
If nginx.conf contains
load_module "/usr/local/libexec/nginx/ngx_http_lua_module.so";
nginx will fail to start after the upgrade. A running nginx keeps
serving until the next restart, so this may surface later.
Rebuild www/nginx (or www/nginx-devel, www/freenginx) with the DSO and
LUA options enabled. The module is installed at the same path again,
so the load_module line keeps working. LUA is not a default option,
therefore the official binary packages do not ship the module.
www/nginx-module-lua: Update to 0.10.31
Two stable releases at once, 0.10.29 is from 2025.
All three local patches are gone: 0.10.31 guards the freenginx cases
upstream, in the client hello handler, in the subrequest start time and in
ngx_http_lua_time.
Sponsored by: Netzkommune GmbH
www/{nginx-module-lua,nginx-module-lua-stream}: Fix Lua on freenginx
Both modules call ngx_ssl_client_hello_callback(), guarded only by
nginx_version > 1029001. freenginx reports 1030001 but has no such
function, so load_module failed with an undefined symbol. Skip the
call on freenginx, as the modules already do on nginx before 1.29.2.
ngx.req.start_time() returned r->start_time / 1000.0. freenginx takes
start_time from ngx_current_msec, which is CLOCK_MONOTONIC and not the
Unix epoch, so ngx.now() - ngx.req.start_time() silently returned
garbage. Derive the epoch value from the current time and the elapsed
milliseconds.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Copy the module sources with cp instead of COPYTREE_SHARE in the
LUA and LUASTREAM pre-configure targets. COPYTREE_SHARE hardlinks
the files and then fails to chmod them when poudriere builds as an
unprivileged user.
Convert www/nginx-module-lua into a pure source-only port. The
prebuilt DSO conflicted with the module built by the nginx ports.
Add compat patches so lua-nginx-module builds against freenginx.
PR: 297651
Reported by: Brad Ackerman
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Start moving the bundled 3rd-party modules into dedicated
nginx-module-* ports, so that module versions are maintained in a
single place instead of the GH_TUPLE lists of the nginx ports.
As a first step, convert www/nginx-module-lua into a hybrid port
that installs the lua-nginx-module sources next to the prebuilt
DSO and use them in the three nginx ports via an unversioned
BUILD_DEPENDS instead of fetching from GitHub.
Sponsored by: Netzkommune GmbH
www/nginx: Update to 1.30.4
Changes:
*) Security: heap buffer overflow when using the map directive with
regex matching (CVE-2026-42533)
*) Security: uninitialized memory access when using unnamed regex
captures with the "slice" directive or background cache update
(CVE-2026-60005)
*) Security: use-after-free when processing a specially crafted
proxied backend response with the ngx_http_ssi_filter_module
(CVE-2026-56434)
Release Notes: https://nginx.org/en/CHANGES-1.30
Security: 56feeac6-8263-11f1-92ba-bc24110523fe
Security: CVE-2026-42533
Security: CVE-2026-56434
Security: CVE-2026-60005
PR: 296830
Sponsored by: Netzkommune GmbH
www/nginx-module-lua: Add new port
Add a new port for the OpenResty lua-nginx-module dynamic
module for nginx.
WWW: https://github.com/openresty/lua-nginx-module
Sponsored by: Netzkommune GmbH
