www/code-server: Update to 4.144.0
The --socket-fd option works again, the inherited socket is passed on to
the process that listens.
Changelog: https://github.com/coder/code-server/releases
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Bump PORTREVISION for the array-var and encrypted-session updates. Both
modules are built into these ports, and a BUILD_DEPENDS does not rebuild
them by itself.
Sponsored by: Netzkommune GmbH
www/nginx-module-encrypted-session: Update to 0.11
A session token is now versioned and carries a random IV and an
HMAC-SHA256 tag instead of a public MD5 prefix and a fixed CBC IV, and
header and ciphertext are authenticated before the token is decrypted.
The tag is compared with CRYPTO_memcmp, which closes a timing oracle over
an attacker controlled plaintext prefix. Tokens written by earlier
versions no longer decrypt.
Changelog: https://github.com/openresty/encrypted-session-nginx-module/compare/v0.10...v0.11
Sponsored by: Netzkommune GmbH
www/nginx-module-array-var: Update to 0.07
An array value is now a reference carrying a module tag and an array
pointer, and both the reference size and the tag are checked before the
value is mapped or joined.
Changelog: https://github.com/openresty/array-var-nginx-module/compare/v0.06...v0.07
Sponsored by: Netzkommune GmbH
lang/nawk: Update to 20260426
Take maintainership.
PR: 300135
Approved by: Chris Hutchinson <portmaster at BSDforge.com> (former maintainer)
Approved by: osa, fluffy (mentors, implicit)
www/p5-Starlet: update 0.32 -> 0.33
Changelog: https://metacpan.org/dist/Starlet/changes
Security: prevent excessive CPU use when parsing malformed chunk-size lines
Security: bound read allocations for large Content-Length values
Security: suppress response bodies for HEAD requests and 204/304 responses
Security: stream chunk data to the body buffer and limit chunk-size lines to 4096 bytes
