From 06ccb7d98083ddbef47b190881d619316bfdb582 Mon Sep 17 00:00:00 2001
From: Lesik Edelweiss <lesikedelweiss@disroot.org>
Date: Thu, 14 May 2026 06:01:07 +0300
Subject: gnu: nginx: Update to 1.31.0.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes CVEs:
- 2025-53859: Buffer overread in the ngx_mail_smtp_module.
  <https://my.f5.com/manage/s/article/K000152786>
- 2026-1642: SSL upstream injection.
  <https://my.f5.com/manage/s/article/K000159824>
- 2026-28755: OCSP result bypass in stream.
  <https://my.f5.com/manage/s/article/K000160368>
- 2026-28753: Injection in auth_http and XCLIENT.
  <https://my.f5.com/manage/s/article/K000160367>
- 2026-27651: NULL pointer dereference while using CRAM-MD5 or APOP.
  <https://my.f5.com/manage/s/article/K000160383>
- 2026-32647: Buffer overflow in the ngx_http_mp4_module.
  <https://my.f5.com/manage/s/article/K000160366>
- 2026-27784: Buffer overflow in the ngx_http_mp4_module.
  <https://my.f5.com/manage/s/article/K000160364>
- 2026-27654: Buffer overflow in ngx_http_dav_module.
  <https://my.f5.com/manage/s/article/K000160382>
- 2026-40701: resolver use-after-free in OCSP.
  <https://my.f5.com/manage/s/article/K000161021>
- 2026-40460: HTTP/3 address spoofing.
  <https://my.f5.com/manage/s/article/K000161068>
- 2026-42934: Buffer overread in the ngx_http_charset_module.
  <https://my.f5.com/manage/s/article/K000161028>
- 2026-42946: Buffer overread in the ngx_http_scgi_module and
ngx_http_uwsgi_module.
  <https://my.f5.com/manage/s/article/K000161027>
- 2026-42945: Buffer overflow in the ngx_http_rewrite_module.
  <https://my.f5.com/manage/s/article/K000161019>
- 2026-42926 HTTP/2 request injection in the ngx_http_proxy_module.
  <https://my.f5.com/manage/s/article/K000161131>

* gnu/packages/web.scm (nginx): Update to 1.31.0.
* gnu/packages/web.scm (nginx-documentation):
  Update to 1.31.0-0.82d15ac.  [source]: Switch to git-fetch.

Change-Id: I87d546d38c8c8a61ad1a8408337b352b2e8de97e
Merges: https://codeberg.org/guix/guix/pulls/8606
Reviewed-by: Sharlatan Hellseher <sharlatanus@gmail.com>
Signed-off-by: Nguyễn Gia Phong <cnx@loang.net>
---
 gnu/packages/web.scm | 23 +++++++++++------------
 1 file changed, 11 insertions(+), 12 deletions(-)

(limited to 'gnu')

diff --git a/gnu/packages/web.scm b/gnu/packages/web.scm
index dba5f073f9..0fb15e2b69 100644
--- a/gnu/packages/web.scm
+++ b/gnu/packages/web.scm
@@ -579,14 +579,14 @@ the same, being completely separated from the Internet.")
     ;; Track the ‘mainline’ branch.  Upstream considers it more reliable than
     ;; ’stable’ and recommends that “in general you deploy the NGINX mainline
     ;; branch at all times” (https://www.nginx.com/blog/nginx-1-6-1-7-released/)
-    (version "1.28.0")
+    (version "1.31.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://nginx.org/download/nginx-"
                                   version ".tar.gz"))
               (sha256
                (base32
-                "0sppdxbmz61y3hfcfyc20gk0ky8f3m60hppzlcy9vpy0hsqcddf6"))))
+                "1apb6gcfs0zl8qm0dvbqfsycrw4ql794592jgi72xbwkaga00nvd"))))
     (build-system gnu-build-system)
     (inputs (list libxcrypt libxml2 libxslt openssl pcre zlib))
     (arguments
@@ -680,21 +680,20 @@ and as a proxy to reduce the load on back-end HTTP or mail servers.")
 
 (define-public nginx-documentation
   ;; This documentation should be relevant for the current nginx package.
-  (let ((version "1.28.0")
-        (revision 3202)
-        (changeset "16887604240f"))
+  (let ((commit "82d15ac14a0c96800d60d0215b2f8fb36ecc1a73")
+        (revision "0"))
     (package
       (name "nginx-documentation")
-      (version (simple-format #f "~A-~A-~A" version revision changeset))
+      (version (git-version "1.31.0" revision commit))
       (source
-       (origin (method hg-fetch)
-               (uri (hg-reference
-                     (url "http://hg.nginx.org/nginx.org")
-                     (changeset changeset)))
-               (file-name (string-append name "-" version))
+       (origin (method git-fetch)
+               (uri (git-reference
+                     (url "https://github.com/nginx/nginx.org.git")
+                     (commit commit)))
+               (file-name (git-file-name name version))
                (sha256
                 (base32
-                 "0slfgl9ap6hxcjg2fc5lfccz0sbmlk83p74i31g05a27ldrqv03l"))))
+                 "15xdl364zkbaks5zmc6q7wrnrzqc2zvzma8322l3m552a4aipma7"))))
       (build-system gnu-build-system)
       (arguments
        '(#:tests? #f                    ; no test suite
-- 
cgit v1.3