From 7ce09a9a71b52e01aca84977e1862e6a53104b62 Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Sat, 23 May 2026 10:35:56 +0200 Subject: [PATCH] package/nginx: security bump version to 1.30.2 https://nginx.org/en/CHANGES-1.30 https://nginx.org/en/security_advisories.html 1.30.2: Fixes CVE-2026-9256 1.30.1: Fixes CVE-2026-42926 (only from 1.29.4), CVE-2026-42945, CVE-2026-42946, CVE-2026-42934, CVE-2026-40460 & CVE-2026-40701. Updated license hash due to copyright year bump: https://github.com/nginx/nginx/commit/7fa941a55e211ebd57f512fbfb24d59dbb97940d Signed-off-by: Bernd Kuhls [Peter: clarify CVE-2026-42926] Signed-off-by: Peter Korsgaard (cherry picked from commit 0455e2571d35b642115e9122159ace0ce803fceb) Signed-off-by: Thomas Perale --- package/nginx/nginx.hash | 4 ++-- package/nginx/nginx.mk | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package/nginx/nginx.hash b/package/nginx/nginx.hash index 1d11937987..5055b4bd57 100644 --- a/package/nginx/nginx.hash +++ b/package/nginx/nginx.hash @@ -1,4 +1,4 @@ # Locally calculated after checking pgp signature -sha256 2c96a946bfb0882a21744ed429770a2123ae1828c7c48665092993ddee91a918 nginx-1.28.3.tar.gz +sha256 7df3090907fca3cc0e456d6dc00ceb230da74ea88026ceff0affc29dbbd9ac4c nginx-1.30.2.tar.gz # License files, locally calculated -sha256 77c01620abf36ed747b7eca4bd271e49023fe3a8e2b3525bcf4b09c8e3aa28e4 LICENSE +sha256 08845fe39e06b51dad7685c28140ab49577a86e947523e16b536a46caf89ad5c LICENSE diff --git a/package/nginx/nginx.mk b/package/nginx/nginx.mk index a8b7ee7319..3f6aecebef 100644 --- a/package/nginx/nginx.mk +++ b/package/nginx/nginx.mk @@ -4,7 +4,7 @@ # ################################################################################ -NGINX_VERSION = 1.28.3 +NGINX_VERSION = 1.30.2 NGINX_SITE = https://nginx.org/download NGINX_LICENSE = BSD-2-Clause NGINX_LICENSE_FILES = LICENSE