Beta Branch update nginx module security pins and fix module builds in 140.00beta01

update nginx module security pins and fix module builds in 140.00beta01

Security pins and build fixes for shipped nginx modules, matching
141.00beta01.

Changes:
- njs 1.0.2 (CVE-2026-101025, CVE-2026-101019), Angie-1.12.4,
freenginx 1.30.2 (CVE-2026-97629), headers-more 0.41, echo 0.66
(fixes freenginx builds), ngx_http_redis 0.4.1-cmm
- ngx_cache_purge 2.5.3 -> 3.0.4 (CVE-2026-108981 and the nginx 1.29.4+
proxy struct misread), plus the freenginx struct guard
- nginx_upstream_check_module 0.4.0 pinned to NGINX_UPSTREAMCHECKCOMMIT
and its nginx core patch now applied (check_1.30.4+.patch for nginx
1.29.6+, dry-run first, skipped on Angie and freenginx), so health
checks run
- ModSecurity from github.com/owasp-modsecurity pinned to v3.0.17 and
connector v1.0.4, recursive submodules, libmaxminddb version check fix,
and modsecurity directives only enabled when the module built
- NGINX_STICKY: deprecation warning, native sticky disabled with the
matching --without switch, source compat fix for nginx 1.23.0+ and Angie
- NGINX_TLS_FINGERPRINT: deprecation warning, corrected gate, nginx patch
dry-run, no forced OpenSSL rebuild with system OpenSSL, libssl.num entry
- Angie builds: restore --with-stream, --with-stream_ssl_module and
--with-threads, and drop Angie's -Werror for Lua with AWS-LC

---

Continue reading...

140.00beta01 branch

• Branch: https://github.com/centminmod/centminmod/tree/140.00beta01
• Commit History: https://github.com/centminmod/centminmod/commits/140.00beta01