www/freenginx-devel: update: 1.31.2 -> 1.31.3

Build of the substitutions filter third-party module is temporarily disabled.

Sponsored by:	tipi.work

<ChangeLog>

*) Feature: additional checks are now used during variable substitution,
   including during execution of the ngx_http_rewrite_module directives,
   to prevent buffer overruns in case of errors in the code.

*) Bugfix: if the "auth_request_set" directive or regular expression
   named captures were used to change prefix variables, such as
   "$http_...", corresponding variables became empty in other parts of
   the configuration.

*) Bugfix: changing the $limit_rate and $args variables with the
   "auth_request_set" directive or regular expression named captures
   worked incorrectly.

*) Bugfix: in error handling in the mail proxy module.
   Thanks to Evan Hellman, Trail of Bits.

*) Bugfix: in error handling when using gzipping.
   Thanks to Evan Hellman, Trail of Bits.

*) Bugfix: in HTTP/3.

*) Bugfix: a segmentation fault might occur in a worker process when
   sending very long request header lines to a gRPC backend.
   Thanks to Evan Hellman, Trail of Bits.

*) Bugfix: a segmentation fault might occur in a worker process if the
   ngx_http_charset_module was used to convert responses from UTF-8.

*) Bugfix: in the ngx_http_perl_module.
   Thanks to Evan Hellman, Trail of Bits and Axel Mierczuk, Keith
   Hoodlet, 1Password's Off-by-1 Labs.

*) Bugfix: in error handling when using the proxy_no_cache directive.
   Thanks to Valentin Bartenev.

</ChangeLog>

6 files changed, 72 insertions, 6 deletions

diff --git a/www/freenginx-devel/Makefile b/www/freenginx-devel/Makefile
index a7195a3765b7..1effd58abe79 100644
--- a/www/freenginx-devel/Makefile
+++ b/www/freenginx-devel/Makefile
@@ -1,7 +1,6 @@
 PORTNAME=	freenginx
 PORTVERSION=	${NGINX_VERSION}
 .include "version.mk"
-PORTREVISION=	8
 CATEGORIES=	www
 MASTER_SITES=	https://freenginx.org/download/ \
 		LOCAL/osa
diff --git a/www/freenginx-devel/Makefile.extmod b/www/freenginx-devel/Makefile.extmod
index b29662a482ab..3e501810f98d 100644
--- a/www/freenginx-devel/Makefile.extmod
+++ b/www/freenginx-devel/Makefile.extmod
@@ -53,6 +53,7 @@ DYNAMIC_UPSTREAM_GH_TUPLE=	ZigzagAK:ngx_dynamic_upstream:ab67fe7:dynamic_upstrea
 DYNAMIC_UPSTREAM_IMPLIES=	STREAM
 DYNAMIC_UPSTREAM_VARS=		DSO_EXTMODS+=dynamic_upstream
 
+DEVEL_KIT_EXTRA_PATCHES=	${PATCHDIR}/extra-patch-ndk_set_var.c
 DEVEL_KIT_GH_TUPLE=		vision5:ngx_devel_kit:v0.3.4:devel_kit
 DEVEL_KIT_USES=			iconv
 DEVEL_KIT_VARS=			FIRST_DSO_EXTMODS+=devel_kit
@@ -160,6 +161,7 @@ HTTP_SLICE_AHEAD_EXTRA_PATCHES=	${PATCHDIR}/extra-patch-src_http_modules_ngx_htt
 
 HTTP_SUBS_FILTER_GH_TUPLE=	yaoweibin:ngx_http_substitutions_filter_module:e12e965:subs_filter
 HTTP_SUBS_FILTER_VARS=		DSO_EXTMODS+=subs_filter
+HTTP_SUBS_FILTER_IGNORE=	substitutions filter module: patching is required
 
 HTTP_TARANTOOL_GH_TUPLE=	tarantool:nginx_upstream_module:aeb8696:nginx_tarantool
 HTTP_TARANTOOL_EXTRA_PATCHES=	${PATCHDIR}/extra-patch-ngx_http_tarantool-config
@@ -285,7 +287,8 @@ PASSENGER_VARS=		WRKSRC_passenger=${WRKDIR}/passenger-${PASSENGER_NGINX_VER} \
 			DSO_EXTDIRS+=passenger-${PASSENGER_NGINX_VER}/src/nginx_module
 
 POSTGRES_GH_TUPLE=	konstruxi:ngx_postgres:8aa7359:postgres
-POSTGRES_EXTRA_PATCHES=	${PATCHDIR}/extra-patch-ngx_postgres-config
+POSTGRES_EXTRA_PATCHES=	${PATCHDIR}/extra-patch-ngx_postgres-config \
+			${PATCHDIR}/extra-patch-ngx_postgres_module.c
 POSTGRES_USES=		pgsql
 POSTGRES_VARS=		DSO_EXTMODS+=postgres
 
diff --git a/www/freenginx-devel/distinfo b/www/freenginx-devel/distinfo
index bbe2b30e4b7e..60b6cdd42470 100644
--- a/www/freenginx-devel/distinfo
+++ b/www/freenginx-devel/distinfo
@@ -1,6 +1,6 @@
-TIMESTAMP = 1783350463
-SHA256 (freenginx-1.31.2.tar.gz) = acf12de40dfec016f3130720f15b642f7df0eea0857e579129854d830595a1ea
-SIZE (freenginx-1.31.2.tar.gz) = 1253159
+TIMESTAMP = 1783437133
+SHA256 (freenginx-1.31.3.tar.gz) = 74ea2ea1c6eb2e04f0f29a5629c1e3b6ebf2e511051ddd284a6a9f98b035b624
+SIZE (freenginx-1.31.3.tar.gz) = 1255777
 SHA256 (nginx_mogilefs_module-1.0.4.tar.gz) = 7ac230d30907f013dff8d435a118619ea6168aa3714dba62c6962d350c6295ae
 SIZE (nginx_mogilefs_module-1.0.4.tar.gz) = 11208
 SHA256 (passenger-6.1.6.tar.gz) = d20202961aadf3d3dc043fecafeadb02a22093ef0941dfce69c70621caf5bc90
diff --git a/www/freenginx-devel/files/extra-patch-ndk_set_var.c b/www/freenginx-devel/files/extra-patch-ndk_set_var.c
new file mode 100644
index 000000000000..f485c5665eba
--- /dev/null
+++ b/www/freenginx-devel/files/extra-patch-ndk_set_var.c
@@ -0,0 +1,31 @@
+--- ../ngx_devel_kit-0.3.4/src/ndk_set_var.c.orig	2026-07-07 14:27:09.629438000 -0400
++++ ../ngx_devel_kit-0.3.4/src/ndk_set_var.c	2026-07-07 14:27:54.282783000 -0400
+@@ -452,7 +452,6 @@
+     ngx_http_variable_t                 *v;
+     ndk_http_rewrite_loc_conf_t         *rlcf;
+     ngx_http_script_var_code_t          *vcode;
+-    ngx_http_script_var_handler_code_t  *vhcode;
+ 
+     v = info->v;
+     cf = info->cf;
+@@ -460,20 +459,6 @@
+ 
+     if (ndk_set_var_filter(cf, rlcf, filter) != NGX_CONF_OK) {
+         return NGX_CONF_ERROR;
+-    }
+-
+-    if (v->set_handler) {
+-        vhcode = ngx_http_script_start_code(cf->pool, &rlcf->codes,
+-                                   sizeof(ngx_http_script_var_handler_code_t));
+-        if (vhcode == NULL) {
+-            return NGX_CONF_ERROR;
+-        }
+-
+-        vhcode->code = ngx_http_script_var_set_handler_code;
+-        vhcode->handler = v->set_handler;
+-        vhcode->data = v->data;
+-
+-        return NGX_CONF_OK;
+     }
+ 
+     vcode = ngx_http_script_start_code(cf->pool, &rlcf->codes,
diff --git a/www/freenginx-devel/files/extra-patch-ngx_postgres_module.c b/www/freenginx-devel/files/extra-patch-ngx_postgres_module.c
new file mode 100644
index 000000000000..b6678a50091c
--- /dev/null
+++ b/www/freenginx-devel/files/extra-patch-ngx_postgres_module.c
@@ -0,0 +1,33 @@
+--- ../ngx_postgres-8aa7359/src/ngx_postgres_module.c.orig	2026-07-07 15:00:37.981716000 -0400
++++ ../ngx_postgres-8aa7359/src/ngx_postgres_module.c	2026-07-07 15:01:51.287487000 -0400
+@@ -1180,7 +1180,6 @@
+     ngx_int_t                            index;
+     ngx_http_variable_t                 *v;
+     ngx_http_script_var_code_t          *vcode;
+-    ngx_http_script_var_handler_code_t  *vhcode;
+     ngx_postgres_rewrite_loc_conf_t     *rlcf;
+     ngx_postgres_escape_t               *pge;
+     ngx_str_t                            dst;
+@@ -1269,22 +1268,6 @@
+ 
+     pge->code = ngx_postgres_escape_string;
+     pge->empty = empty;
+-
+-    if (v->set_handler) {
+-        vhcode = ngx_http_script_start_code(cf->pool, &rlcf->codes,
+-                                   sizeof(ngx_http_script_var_handler_code_t));
+-        if (vhcode == NULL) {
+-            dd("returning NGX_CONF_ERROR");
+-            return NGX_CONF_ERROR;
+-        }
+-
+-        vhcode->code = ngx_http_script_var_set_handler_code;
+-        vhcode->handler = v->set_handler;
+-        vhcode->data = v->data;
+-
+-        dd("returning NGX_CONF_OK");
+-        return NGX_CONF_OK;
+-    }
+ 
+     vcode = ngx_http_script_start_code(cf->pool, &rlcf->codes,
+                                        sizeof(ngx_http_script_var_code_t));
diff --git a/www/freenginx-devel/version.mk b/www/freenginx-devel/version.mk
index 97d18ade9f33..8f9632cba8ed 100644
--- a/www/freenginx-devel/version.mk
+++ b/www/freenginx-devel/version.mk
@@ -1 +1 @@
-NGINX_VERSION=	1.31.2
+NGINX_VERSION=	1.31.3