Skip to content

Commit 12bd76c

Browse files
TheophileDiotTheophileDiot
authored
Merge pull request #3693 from bunkerity/dev
Merge branch "dev" into branch "staging"
2 parents a5c40a8 + 45f7cc8 commit 12bd76c

47 files changed

Lines changed: 4434 additions & 3266 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎CHANGELOG.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,8 @@
99
- [DEPS] Updated lua-resty-signal version to v0.05
1010
- [DEPS] Updated lua-resty-string version to v0.19
1111
- [DEPS] Updated lua-upstream-nginx-module version to v0.08
12-
- [DEPS] Updated LuaJIT version to v2.1-20260620
12+
- [DEPS] Updated LuaJIT version to v2.1-20260701
13+
- [DEPS] Updated Modsecurity version to v3.0.16
1314

1415
## v1.6.12~rc3 - 2026/06/18
1516

‎src/all-in-one/Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ RUN export MAKEFLAGS="-j$(nproc)" && \
4949
export URL="$(jq -r .url re2.json)" && \
5050
export COMMIT="$(jq -r .commit re2.json)" && \
5151
bash install-re2.sh && \
52-
go install github.com/mikefarah/yq/v4@v4.44.3
52+
go install github.com/mikefarah/yq/v4@v4.50.1
5353

5454
COPY src/all-in-one/deps/crowdsec.json crowdsec.json
5555
COPY --chmod=644 src/all-in-one/scripts/install-crowdsec.sh install-crowdsec.sh
@@ -171,7 +171,7 @@ RUN umask 027
171171
RUN apk add --no-cache bash curl geoip grep libgcc libgd libmagic libpq libstdc++ libxml2 mariadb-client mariadb-connector-c openssl pcre2 python3 py3-pip sed sqlite postgresql-client tzdata unzip yajl supervisor brotli lmdb libfuzzy2
172172

173173
# Fix CVEs
174-
# There are no CVEs for the following packages
174+
RUN apk add --no-cache "libexpat>=2.8.2-r0" # CVE-2026-50219 CVE-2026-56132 CVE-2026-56403 CVE-2026-56404 CVE-2026-56405 CVE-2026-56406 CVE-2026-56410 CVE-2026-56411 CVE-2026-56412 CVE-2026-56131 CVE-2026-56407 CVE-2026-56408 CVE-2026-56409
175175

176176
COPY src/deps/requirements.txt /tmp/requirements-deps.txt
177177

‎src/bw/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ RUN umask 027
7878
RUN apk add --no-cache openssl pcre2 bash python3 yajl geoip libxml2 libgd curl tzdata brotli lmdb libfuzzy2
7979

8080
# Fix CVEs
81-
# There are no CVEs for the following packages
81+
RUN apk add --no-cache "libexpat>=2.8.2-r0" # CVE-2026-50219 CVE-2026-56132 CVE-2026-56403 CVE-2026-56404 CVE-2026-56405 CVE-2026-56406 CVE-2026-56410 CVE-2026-56411 CVE-2026-56412 CVE-2026-56131 CVE-2026-56407 CVE-2026-56408 CVE-2026-56409
8282

8383
# Copy dependencies
8484
COPY --from=builder --chown=0:101 --chmod=550 /usr/share/bunkerweb /usr/share/bunkerweb

‎src/deps/deps.json‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -193,9 +193,9 @@
193193
},
194194
{
195195
"id": "luajit",
196-
"name": "LuaJIT v2.1-20260620",
196+
"name": "LuaJIT v2.1-20260701",
197197
"url": "https://github.com/openresty/luajit2.git",
198-
"commit": "b411bec3ce550ef9968fc83bca094455cf812c1f",
198+
"commit": "2802aafe24b7c3b2892e616c2bee97a61e9c026e",
199199
"post_install": "rm -r src/deps/src/luajit/t"
200200
},
201201
{
@@ -235,9 +235,9 @@
235235
},
236236
{
237237
"id": "modsecurity",
238-
"name": "ModSecurity v3.0.15",
238+
"name": "ModSecurity v3.0.16",
239239
"url": "https://github.com/owasp-modsecurity/ModSecurity.git",
240-
"commit": "0fb4aff98b4980cf6426697d5605c424e3d5bb60",
240+
"commit": "7ea9fefbe0ba409d8733b4d682c8c4c059cd028d",
241241
"post_install": "rm -rf src/deps/src/modsecurity/others/libinjection src/deps/src/modsecurity/others/mbedtls && patch --forward src/deps/src/modsecurity/configure.ac src/deps/misc/modsecurity.patch || rm src/deps/src/modsecurity/configure.ac.orig src/deps/src/modsecurity/configure.ac.rej && patch --forward src/deps/src/modsecurity/src/transaction.cc src/deps/misc/modsecurity-transaction-cc.patch || rm src/deps/src/modsecurity/src/transaction.cc.orig src/deps/src/modsecurity/src/transaction.cc.rej && patch --forward src/deps/src/modsecurity/headers/modsecurity/transaction.h src/deps/misc/modsecurity-transaction-h.patch || rm src/deps/src/modsecurity/headers/modsecurity/transaction.h.orig src/deps/src/modsecurity/headers/modsecurity/transaction.h.rej"
242242
},
243243
{

‎src/deps/src/luajit/src/Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -376,7 +376,7 @@ ifneq ($(HOST_SYS),$(TARGET_SYS))
376376
HOST_XCFLAGS+= -DLUAJIT_OS=LUAJIT_OS_OSX
377377
else
378378
ifeq (iOS,$(TARGET_SYS))
379-
HOST_XCFLAGS+= -DLUAJIT_OS=LUAJIT_OS_OSX -DTARGET_OS_IPHONE=1
379+
HOST_XCFLAGS+= -DLUAJIT_OS=LUAJIT_OS_OSX -DLUAJIT_TARGET_IPHONE=1
380380
else
381381
HOST_XCFLAGS+= -DLUAJIT_OS=LUAJIT_OS_OTHER
382382
endif

‎src/deps/src/luajit/src/lib_os.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -231,6 +231,7 @@ LJLIB_CF(os_date)
231231
LJLIB_CF(os_time)
232232
{
233233
time_t t;
234+
errno = 0;
234235
if (lua_isnoneornil(L, 1)) { /* called without args? */
235236
t = time(NULL); /* get current time */
236237
} else {
@@ -244,7 +245,6 @@ LJLIB_CF(os_time)
244245
ts.tm_mon = (int)((unsigned int)getfield(L, "month", -1) - 1u);
245246
ts.tm_year = (int)((unsigned int)getfield(L, "year", -1) - 1900u);
246247
ts.tm_isdst = getboolfield(L, "isdst");
247-
errno = 0;
248248
t = mktime(&ts);
249249
}
250250
if (t == (time_t)(-1) && errno != 0)

‎src/deps/src/luajit/src/lj_arch.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,7 @@
131131
#define LJ_TARGET_POSIX (LUAJIT_OS > LUAJIT_OS_WINDOWS)
132132
#define LJ_TARGET_DLOPEN LJ_TARGET_POSIX
133133

134-
#if defined(TARGET_OS_IPHONE) && TARGET_OS_IPHONE
134+
#if (defined(TARGET_OS_IPHONE) && TARGET_OS_IPHONE) || LUAJIT_TARGET_IPHONE
135135
#define LJ_TARGET_IOS 1
136136
#else
137137
#define LJ_TARGET_IOS 0

‎src/deps/src/luajit/src/lj_ccall.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1254,7 +1254,7 @@ static int ccall_set_args(lua_State *L, CTState *cts, CType *ct,
12541254
if (CCALL_ALIGN_STACKARG) { /* Align argument on stack. */
12551255
MSize align = (1u << ctype_align(ccall_struct_align(cts, d))) - 1;
12561256
#if LJ_TARGET_ARM64 && LJ_TARGET_OSX
1257-
isva = ctype_isstruct(d->info);
1257+
isva |= ctype_isstruct(d->info);
12581258
#endif
12591259
if (rp || (CCALL_PACK_STACKARG && isva && align < CTSIZE_PTR-1))
12601260
align = CTSIZE_PTR-1;

‎src/deps/src/modsecurity/CHANGES‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,19 @@
1+
v3.0.16 - 2026-Jun-29
2+
---------------------
3+
4+
- [fix: wrong behavior in utf8toUnicode on i386 architecture]
5+
[PR from private repo - @airween; fixed CVE-2026-52761]
6+
- [fix: multipart/form-data request body parser invalidly handles `\r` and `\n` characters]
7+
[PR from private repo - @sondt99, @dungNHVhust, @hnakamura, @airween; fixed CVE-2026-52747]
8+
- fix(lexer): rejection of '@' in ctl:ruleRemoveTarget actions
9+
[PR #3566, #3589 - @Jitterx69, @airween]
10+
- fix: cppcheck warnings with version 2.21.0
11+
[PR #3577 - @airween]
12+
- ci: pin Windows version in workflow
13+
[PR #3570 - @airween]
14+
- Alternative fix for @inspectFile: improved fork safety with multi-threaded tests (PR #3489)
15+
[PR #3552 - @Easton97-Jens]
16+
117
v3.0.15 - 2026-Apr-28
218
---------------------
319

‎src/deps/src/modsecurity/examples/multithread/Makefile.am‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,4 +54,8 @@ multithread_CPPFLAGS = \
5454
MAINTAINERCLEANFILES = \
5555
Makefile.in
5656

57+
EXTRA_DIST = \
58+
basic_rules.conf \
59+
inspectfile_rules.conf \
60+
inspectfile_helper.sh
5761

0 commit comments

Comments
 (0)