-
Notifications
You must be signed in to change notification settings - Fork 239
Expand file tree
/
Copy pathCHANGES
More file actions
2616 lines (1582 loc) · 80.5 KB
/
Copy pathCHANGES
File metadata and controls
2616 lines (1582 loc) · 80.5 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Changes with njs 1.0.1 02 Sep 2026
nginx modules:
*) Security: fixed an access control bypass in js_access when an
asynchronous request body continuation threw an exception or
produced an unhandled rejection. Previously, nginx could continue
processing the request as though the js_access check had succeeded.
Thanks to Ta Duc Thien.
*) Security: fixed a worker process crash when reading
Response.statusText after an upstream server returned a status
line with an empty reason phrase.
*) Bugfix: fixed unhandled promise rejection tracking in reused
QuickJS contexts.
*) Bugfix: fixed SharedDict.pop() returning undefined for unexpired
entries in shared dictionaries with a timeout.
*) Bugfix: fixed validation and replacement of Fetch Headers values.
This also fixed dangling header names in the QuickJS engine.
*) Bugfix: fixed missing validation of r.headersOut names and values,
and of redirect targets passed to r.return().
*) Bugfix: fixed use-after-free, worker aborts, and leaks caused by
cyclic references involving Fetch, HTTP request, and Stream session
objects in the QuickJS engine.
*) Bugfix: fixed QuickJS context reuse after internal redirects and
when pending jobs remained after request teardown.
*) Bugfix: fixed cleanup of partially initialized JavaScript contexts
when request setup failed.
Core:
*) Security: fixed a heap buffer overflow while parsing namespace
prefix lists passed to XML exclusive canonicalization.
Thanks to Vladimir Vulnerability Research Tech Lead @ Cyera,
evilgensec.
*) Bugfix: fixed a stack buffer overflow when exporting RSA keys
larger than 4096 bits to JWK in WebCrypto.
Thanks to Vaibhav Rajput.
*) Bugfix: fixed RSA-OAEP encryption and decryption with SHA-256 and
SHA-384 digests in WebCrypto.
*) Bugfix: fixed compatibility with quickjs-ng 0.16.0 and later.
*) Bugfix: fixed empty stack traces for QuickJS errors created by
host callbacks.
*) Feature: added btoa() and atob() global functions to the QuickJS
engine and aligned their behavior between both engines.
Changes with njs 1.0.0 23 Jun 2026
nginx modules:
*) Improvement: aligned HTTP, Stream, and Fetch exception classes
between the njs and QuickJS engines. API misuse is now reported
as TypeError and status bounds violations as RangeError.
*) Improvement: rejected unsafe request targets, methods, and header
values in ngx.fetch() before request serialization.
*) Bugfix: fixed a heap use-after-free in r.subrequest() when the
client closed the connection before the background subrequest
completed. The issue was introduced in 75d6b61 (0.9.5).
This closes #1077 issue on Github.
*) Bugfix: fixed a worker segfault while reading a request header
that nginx registers without a dedicated slot, such as
"Proxy-Connection", via r.headersIn.
This closes #1071 issue on Github.
*) Bugfix: excluded unverified-TLS and dynamic-proxy connections
from the ngx.fetch() keepalive cache and validated cached
connections before reuse.
*) Bugfix: fixed Content-Length truncation for very large request
bodies and a missing CONNECT terminator for proxies configured
without credentials in ngx.fetch().
*) Bugfix: fixed leaks of promises, events, and init property values
on ngx.fetch() failure paths in the QuickJS engine.
*) Bugfix: fixed missing fetch event cleanup when the resolver
failed to start.
*) Bugfix: fixed an out-of-bounds read of a short fetch proxy URL.
*) Bugfix: fixed request body truncation in r.readRequestJSON() for
bodies containing invalid UTF-8 in the QuickJS engine.
*) Bugfix: fixed an out-of-bounds read while loading a shared
dictionary state file.
*) Bugfix: set a pending exception when sendHeader(), send(), and
finish() fail in the njs HTTP handlers.
*) Bugfix: fixed the variable value state after a stream variable
storage allocation failure.
Core:
*) Improvement: bounded string-producing chained-buffer growth, so
that exceeding the maximum string length raises a catchable
RangeError("invalid string length") instead of exhausting worker
memory.
*) Improvement: aligned built-in exception classes (XML, console,
TextEncoder, TextDecoder, Buffer, fs.Stats) between the
njs and QuickJS engines.
*) Bugfix: fixed an infinite loop while inflating a zlib stream
that requires a dictionary in the QuickJS engine.
*) Bugfix: fixed an infinite loop in Buffer.prototype.fill() with
a zero-length typed array source.
*) Bugfix: fixed a use-after-free in Array.prototype.sort() when a
getter invoked for a hole grows the array.
*) Bugfix: fixed type confusion in Buffer.concat() when a list
element getter returns a typed array during validation but not
during the copy.
*) Bugfix: fixed an out-of-bounds access in the variable-length
Buffer readInt/writeInt methods with a zero byteLength.
*) Bugfix: fixed an out-of-bounds read in Buffer.prototype.toString()
when start was greater than end.
*) Bugfix: fixed Array.prototype.slice() of large arrays returning
wrong results in the non-fast keys path.
*) Bugfix: fixed the typed array constructor, slice(), toReversed(),
and toSorted() ignoring the source view byte offset in the
same-type fast path.
*) Bugfix: fixed Buffer allocation length checks for lengths greater
than or equal to 2^32 on 32-bit platforms.
*) Bugfix: fixed the Buffer.from() typed-array source offset for
multi-byte element types in the QuickJS engine.
*) Bugfix: fixed Buffer float access alignment.
*) Bugfix: fixed an out-of-bounds read in a parser string escape
lookahead.
Changes with njs 0.9.9 19 May 2026
nginx modules:
*) Security: a heap buffer overflow might occur in a worker process
when the "js_fetch_proxy" directive value contains nginx
variables derived from the client request ($http_*, $arg_*,
$cookie_*, etc.) and the location's JS handler invokes
ngx.fetch(). The issue was introduced in dea83189 (0.9.4).
*) Feature: added js_access directive.
*) Feature: added r.readRequestText(), r.readRequestArrayBuffer(),
and r.readRequestJSON() - async methods that read the request
body, available in js_access and js_content directives.
*) Feature: added r.readRequestForm() - async method that parses
the request body submitted from an HTML form
(application/x-www-form-urlencoded and multipart/form-data) and
returns a structured accessor object. The method is available
in js_access and js_content directives.
*) Feature: added jsVarNames() method. The method returns the
names of variables declared with js_var.
Core:
*) Bugfix: fixed evaluation order of call arguments with side
effects. Previously, an earlier argument could observe a later
argument's mutation, e.g. f(a, a = 2) passed 2 as both
arguments.
The issue was introduced in fd5e523f (0.9.7).
Changes with njs 0.9.8 23 Apr 2026
nginx modules:
*) Bugfix: fixed loading of the built-in "crypto" module.
The issue was introduced in 3185ce81 (0.9.7).
Changes with njs 0.9.7 21 Apr 2026
nginx modules:
*) Feature: improved shared dict eviction strategy.
*) Feature: added ttl() method to shared dictionaries.
*) Bugfix: removed spurious "js vm init" notice log emitted during
configuration parsing.
*) Bugfix: removed shared dict expiration from read-locked paths.
*) Bugfix: fixed double-free in shared dict update with eviction.
*) Bugfix: fixed per-entry TTL reset on shared dict incr() calls.
Core:
*) Feature: added Ed25519 and X25519 support for WebCrypto.
*) Feature: added wrapKey() and unwrapKey() support for WebCrypto.
*) Feature: added crypto.randomUUID().
*) Feature: allowed await expressions in tagged templates and as
call arguments.
*) Improvement: switched to OpenSSL EVP for hashing in the built-in
"crypto" module.
*) Bugfix: fixed call argument evaluation.
Changes with njs 0.9.6 03 Mar 2026
nginx modules:
*) Bugfix: fixed expire field truncation in shared dict state files.
Millisecond timestamps were silently truncated to 10 digits,
making restored entries appear expired on restart.
The issue has been present since eca03622 (0.9.1).
*) Bugfix: suppressed slab log_nomem for evict shared dict zones.
When evict is enabled, memory allocation failures are expected
and handled by evicting old entries.
*) Bugfix: fixed stack trace for native fetch exceptions for QuickJS
engine.
Core:
*) Feature: added optional chaining support.
*) Feature: added nullish coalescing assignment operator (??=).
*) Feature: added logical assignment operators (||= and &&=).
*) Improvement: aligned SyntaxError reporting with other JS engines.
Previously, file name was a part of the error message. Now it is
reported as "stack" property.
*) Improvement: improved Error.stack traces.
Stack traces are now attached in error constructors. Performance
of Error.stack is improved by ~100 times.
*) Bugfix: fixed string offset map corruption in scope values hash.
The issue caused SEGV/SIGBUS crashes for multi-byte UTF-8 string
constants with more than 32 characters when accessing a character
at index >= 32 (e.g. via .replace() or bracket notation).
The issue was introduced in e7caa46d (0.9.5).
*) Bugfix: fixed heap-buffer-overflow in atom hash caused by
Symbol().
*) Bugfix: fixed WebCrypto importKey() crash with mismatched JWK key
type.
*) Bugfix: fixed interactive mode detection for piped stdin.
The issue was introduced in 4988565c (0.8.0).
*) Bugfix: fixed build on MacOS.
*) Bugfix: fixed PTR macro compatibility with newer BFD library.
*) Bugfix: auto/cc: use portable 'command -v' instead of 'which'.
Thanks to Zurab Kvachadze.
Changes with njs 0.9.5 13 Jan 2026
nginx modules:
*) Feature: added native module support for QuickJS engine.
The following directives were added: js_load_http_native_module,
js_load_stream_native_module.
*) Bugfix: fixed js_body_filter with multiple chunks for QuickJS
engine.
*) Bugfix: fixed buffer_type inheritance in if blocks for js_body_filter.
Previously, when js_body_filter was used inside an if block,
the data parameter received Buffer type instead of the expected
String type.
*) Bugfix: fixed js_body_filter when data is not in memory.
Previously, when upstream data was delivered from nginx cache,
js_body_filter was not able to process it correctly.
*) Bugfix: improved r.subrequest() error handling.
Fixed a problem of a lost write event when the njs handler
making r.subrequest() is called from a lua handler as a
subrequest.
Core:
*) Bugfix: fixed XMLAttr object.
Pointer to xmlAttr could become invalid when the parent XMLNode
was modified.
*) Bugfix: fixed XMLNode update.
*) Bugfix: fixed ArrayBuffer with detached buffers.
*) Bugfix: added missing detached array checks.
*) Bugfix: fixed fs.mkdir() and friends.
*) Bugfix: fixed path restoration in fs.mkdir() and friends on
error.
*) Bugfix: fixed missed allocation check in promise code.
Changes with njs 0.9.4 28 Oct 2025
nginx modules:
*) Feature: added HTTP forward proxy support for ngx.fetch() API.
Core:
*) Bugfix: fixed r.subrequest() to a location with JS handler
for QuickJS. The bug became visible after
bellard/quickjs@42eb2795.
Changes with njs 0.9.3 07 Oct 2025
nginx modules:
*) Bugfix: fixed heap-use-after-free while module loading.
*) Bugfix: fixed heap-use-after-free in js_set handler used
in log phase. The issue was introduced in 04f6dfb (0.9.2).
Changes with njs 0.9.2 23 Sep 2025
nginx modules:
*) Feature: added HTTP keepalive support for ngx.fetch() API.
*) Improvement: added configure time check when js_import is
not defined.
*) Bugfix: fixed merging of js_path directives.
*) Bugfix: fixed building when http_ssl and stream_ssl
unavailable.
Core:
*) Change: increased the default stack size to 160k for njs VM.
*) Feature: added njs.on('exit') API for qjs engine.
*) Improvement: optimized memory consumption while streaming
in qjs.
*) Bugfix: fixed building qjs engine with clang 19.
*) Bugfix: fixed building with GCC 15 and -O3.
Changes with njs 0.9.1 10 Jul 2025
nginx modules:
*) Feature: added Fetch API for QuickJS engine.
*) Feature: added state file for a shared dictionary.
*) Bugfix: fixed handling of Content-Length header when
a body is provided for Fetch API.
*) Bugfix: fixed qjs engine after bellard/quickjs@458c34d2.
*) Bugfix: fixed NULL pointer dereference when processing
If-* headers.
Core:
*) Feature: added ECDH support for WebCrypto.
*) Improvement: reduced memory consumption by the object hash.
The new hash uses 42% less memory per element.
*) Improvement: reduced memory consumption for concatenation of
numbers and strings.
*) Improvement: reduced memory consumption of
String.prototype.concat() with scalar values.
*) Bugfix: fixed segfault in njs_property_query().
The issue was introduced in b28e50b1 (0.9.0).
*) Bugfix: fixed Function constructor template injection.
*) Bugfix: fixed GCC compilation with O3 optimization level.
*) Bugfix: fixed constant is too large for 'long' warning
on MIPS -mabi=n32.
*) Bugfix: fixed compilation with GCC 4.1.
*) Bugfix: fixed %TypedArray%.from() with the buffer is detached
by the mapper.
*) Bugfix: fixed %TypedArray%.prototype.slice() with overlapping
buffers.
*) Bugfix: fixed handling of detached buffers for typed arrays.
*) Bugfix: fixed frame saving for async functions with
closures.
*) Bugfix: fixed RegExp compilation of patterns with
escaped '[' characters.
Changes with njs 0.9.0 06 May 2025
Core:
*) Feature: refactored working with built-in strings, symbols
and small integers.
Performance improvements (arewefastyet/benchmarks/v8-v7 benchmark):
Richards: +57% (631 → 989)
Crypto: +7% (1445 → 1551)
RayTrace: +37% (562 → 772)
NavierStokes: +20% (2062 → 2465)
Overall score: +29% (1014 → 1307)
*) Bugfix: fixed regexp undefined value of captured group.
*) Bugfix: fixed GCC 15 build with -Wunterminated-string-initialization.
Changes with njs 0.8.10 08 Apr 2025
nginx modules:
*) Feature: reading r.requestText or r.requestBuffer from
a temp file.
Previously, an exception was thrown when accessing r.requestText
or r.requestBuffer if a client request body size exceeded
client_body_buffer_size.
*) Improvement: improved reporting of unhandled promise rejections.
*) Bugfix: fixed name corruption in variable and header processing.
*) Bugfix: fixed SharedDict.incr() with empty init argument
for QuickJS engine.
*) Bugfix: accepting response headers with underscore characters
in Fetch API.
Core:
*) Change: fixed serializeToString().
Previously, serializeToString() was exclusiveC14n() which returned
string instead of Buffer. According to the published documentation it
should be c14n().
*) Feature: added WebCrypto API for QuickJS engine.
*) Feature: added TextEncoder/TextDecoder for QuickJS engine.
*) Feature: added querystring module for QuickJS engine.
*) Feature: added crypto module for QuickJS engine.
*) Feature: added xml module for QuickJS engine.
*) Feature: added support for QuickJS-NG library.
*) Bugfix: fixed buffer.concat() with a single argument in quickjs.
*) Bugfix: added missed syntax error for await in template literal.
*) Bugfix: fixed non-NULL terminated strings formatting in
exceptions for QuickJS engine.
*) Bugfix: fixed compatibility with recent change in QuickJS
and QuickJS-NG.
Changes with njs 0.8.9 14 Jan 2025
nginx modules:
*) Bugfix: removed extra VM creation per server.
Previously, when js_import was declared in http or stream blocks,
an extra copy of the VM instance was created for each server
block. This was not needed and consumed a lot of memory for
configurations with many server blocks.
This issue was introduced in 9b674412 (0.8.6) and was partially
fixed for location blocks only in 685b64f0 (0.8.7).
Core:
*) Feature: added fs module for QuickJS engine.
Changes with njs 0.8.8 10 Dec 2024
nginx modules:
*) Feature: implemented shared dictionary for QuickJS engine.
*) Improvement: js_preload_object is refactored.
*) Bugfix: fixed limit rated output.
*) Bugfix: optimized use of SSL contexts for
js_fetch_trusted_certificate directive.
Core:
*) Feature: implemented process object for QuickJS engine.
*) Feature: implemented process.kill() method.
*) Bugfix: fixed tests with libxml2 2.13 and later.
*) Bugfix: fixed promise resolving when Promise is inherited.
*) Bugfix: fixed absolute scope in cloned VMs.
Changes with njs 0.8.7 22 Oct 2024
nginx modules:
*) Bugfix: eliminated unnecessary VM creation.
Previously, njs consumed memory proportionally to the number of
nginx locations. The issue was introduced in 9b674412 (0.8.6).
*) Improvement: added strict syntax validation for js_body_filter.
*) Improvement: improved error messages for module loading
failures.
Core:
*) Feature: implemented fs.readlink() and friends.
*) Improvement: implemented lazy stack symbolization.
*) Bugfix: fixed heap-buffer-overflow in Buffer.prototype.indexOf().
The issue was introduced in 5d15a8d6 (0.8.6).
*) Bugfix: fixed Buffer.prototype.lastIndexOf() when `from` is
provided.
Changes with njs 0.8.6 02 Oct 2024
nginx modules:
*) Feature: introduced QuickJS engine.
*) Feature: added optional nocache flag for js_set directive.
Thanks to Thomas P.
*) Feature: exposed capture group variables in HTTP module.
Thanks to Thomas P.
Core:
*) Feature: added Buffer module for QuickJS engine.
*) Bugfix: fixed handling of empty labelled statement in a function.
*) Bugfix: fixed Function constructor handling when called without
arguments.
*) Bugfix: fixed Buffer.prototype.writeInt8() and friends.
*) Bugfix: fixed Buffer.prototype.writeFloat() and friends.
*) Bugfix: fixed Buffer.prototype.lastIndexOf().
*) Bugfix: fixed Buffer.prototype.write().
*) Bugfix: fixed maybe-uninitialized warnings in error creation.
*) Bugfix: fixed 'ctx.codepoint' initialization in UTF-8 decoding.
*) Bugfix: fixed 'length' initialization in Array.prototype.pop().
*) Bugfix: fixed handling of encode arg in fs.readdir() and
fs.realpath().
Changes with njs 0.8.5 25 Jun 2024
nginx modules:
*) Change: r.variables.var, r.requestText, r.responseText,
s.variables.var, and the "data" argument of the s.on() callback
with "upload" or "download" event types will now convert bytes
invalid in UTF-8 encoding into the replacement character. When
working with binary data, use r.rawVariables.var, r.requestBuffer,
r.responseBuffer, s.rawVariables.var, and the "upstream" or
"downstream" event type for s.on() instead.
*) Feature: added timeout argument for shared dictionary methods
add(), set() and incr().
*) Bugfix: fixed checking for duplicate js_set variables.
*) Bugfix: fixed request Host header when the port is non-standard.
*) Bugfix: fixed handling of a zero-length request body in ngx.fetch()
and r.subrequest().
*) Bugfix: fixed heap-buffer-overflow in Headers.get().
*) Bugfix: fixed r.subrequest() error handling.
Core:
*) Feature: added zlib module for QuickJS engine.
*) Bugfix: fixed zlib.inflate().
*) Bugfix: fixed String.prototype.replaceAll() with zero-length
argument.
*) Bugfix: fixed retval handling after an exception in
Array.prototype.toSpliced(), Array.prototype.toReversed(),
Array.prototype.toSorted().
*) Bugfix: fixed RegExp.prototype[@@replace]() with replacements
containing "$'", "$\`" and strings with Unicode characters.
*) Bugfix: fixed a one-byte overread in decodeURI() and
decodeURIComponent().
*) Bugfix: fixed tracking of argument scope.
*) Bugfix: fixed integer overflow in Date.parse().
Changes with njs 0.8.4 16 Apr 2024
nginx modules:
*) Feature: allowing to set Server header for outgoing headers.
*) Improvement: validating URI and args arguments in r.subrequest().
*) Improvement: checking for duplicate js_set variables.
*) Bugfix: fixed clear() method of a shared dictionary without
timeout introduced in 0.8.3.
*) Bugfix: fixed r.send() with Buffer argument.
Core:
*) Feature: added QuickJS engine support in CLI.
*) Bugfix: fixed atob() with non-padded base64 strings.
Changes with njs 0.8.3 07 Feb 2024
nginx modules:
*) Bugfix: fixed Headers.set().
*) Bugfix: fixed js_set with Buffer values.
*) Bugfix: fixed clear() method of a shared dictionary when
a timeout is not specified.
*) Bugfix: fixed stub_status statistics when js_periodic is
enabled.
Core:
*) Bugfix: fixed building with libxml2 2.12 and later.
*) Bugfix: fixed Date constructor for overflows and with
NaN values.
*) Bugfix: fixed underflow in querystring.parse().
*) Bugfix: fixed potential buffer overread in
String.prototype.match().
*) Bugfix: fixed parsing of for-in loops.
*) Bugfix: fixed parsing of hexadecimal, octal, and binary
literals with no digits.
Changes with njs 0.8.2 24 Oct 2023
nginx modules:
*) Feature: introduced console object. The following methods
were introduced: error(), info(), log(), time(), timeEnd(),
warn().
*) Bugfix: fixed HEAD response handling with large Content-Length
in fetch API.
*) Bugfix: fixed items() method for a shared dictionary.
*) Bugfix: fixed delete() method for a shared dictionary.
Core:
*) Feature: extended "fs" module. Added existsSync().
*) Bugfix: fixed "xml" module. Fixed broken XML exception handling
in parse() method.
*) Bugfix: fixed RegExp.prototype.exec() with global regexp and
unicode input.
*) Bugfix: fixed return statement parsing with invalid expression.
Changes with njs 0.8.1 12 Sep 2023
nginx modules:
*) Feature: introduced js_periodic directive.
The directive specifies a JS handler to run at regular intervals.
*) Feature: implemented items() method for a shared dictionary.
The method returns all the non-expired key-value pairs.
*) Bugfix: fixed size() and keys() methods of a shared dictionary.
*) Bugfix: fixed erroneous exception in r.internalRedirect()
introduced in 0.8.0.
Core:
*) Bugfix: fixed incorrect order of keys in
Object.getOwnPropertyNames().
Changes with njs 0.8.0 6 Jul 2023
nginx modules:
*) Change: removed special treatment of forbidden headers in Fetch API
introduced in 0.7.10.
*) Change: removed deprecated since 0.5.0 r.requestBody and
r.responseBody in HTTP module.
*) Change: throwing an exception in r.internalRedirect() while
filtering in HTTP module.
*) Feature: introduced global nginx properties.
ngx.build - an optional nginx build name, corresponds to
--build=name argument of configure script, by default is "".
ngx.conf_file_path - the file path to current nginx configuration
file.
ngx.error_log_path - the file path to current error log file.
ngx.prefix - the directory that keeps server files.
ngx.version - the nginx version as a string, for example: "1.25.0".
ngx.version_number - the nginx version as a number, for example:
1025000.
ngx.worker_id - corresponds to an nginx internal worker id.
The value is between 0 and worker_processes - 1.
*) Feature: introduced js_shared_dict_zone directive.
The directive allows to declare a dictionary that is shared among the
working processes.
*) Improvement: added compile-time options to disable njs modules.
For example to disable libxslt related code:
NJS_LIBXSLT=NO ./configure .. --add-module=/path/to/njs/module
*) Bugfix: fixed r.status setter when filtering in HTTP module.
*) Bugfix: fixed setting of Location header in HTTP module.
Core:
*) Change: native methods are provided with retval argument.
This change breaks compatibility with C extension for njs
requiring to modify the code.
*) Change: non-compliant deprecated String methods were removed.
The following methods were removed: String.bytesFrom(),
String.prototype.fromBytes(), String.prototype.fromUTF8(),
String.prototype.toBytes(), String.prototype.toUTF8(),
String.prototype.toString(encoding).
*) Change: removed support for building with GNU readline.
*) Feature: added Array.from(), Array.prototype.toSorted(),
Array.prototype.toSpliced(), Array.prototype.toReversed().
*) Feature: added %TypedArray%.prototype.toSorted(),
%TypedArray%.prototype.toSpliced(),
%TypedArray%.prototype.toReversed().
*) Feature: added CryptoKey properties in WebCrypto.
The following properties for CryptoKey were added:
algorithm, extractable, type, usages.
*) Bugfix: fixed retval of crypto.getRandomValues().
*) Bugfix: fixed evaluation of computed property names with function
expressions.
*) Bugfix: fixed implicit name for a function expression declared in
arrays.
*) Bugfix: fixed parsing of for-in loops.
*) Bugfix: fixed Date.parse() with ISO-8601 format and UTC time
offset.
Changes with njs 0.7.12 10 Apr 2023
nginx modules:
*) Bugfix: fixed Headers() constructor in Fetch API.
Core:
*) Feature: added Hash.copy() method in "crypto" module.
*) Feature: added "zlib" module.
*) Improvement: added support for export {name as default}
statement.
*) Bugfix: fixed Number constructor according to the spec.
Changes with njs 0.7.11 9 Mar 2023
nginx modules:
*) Bugfix: added missed linking with libxml2 for the dynamic module.
The bug was introduced in 0.7.10.
Core:
*) Feature: added XMLNode API to modify XML documents.
*) Change: removed XML_PARSE_DTDVALID during parsing of XML document
due to security implications. The issue was introduced
in 0.7.10. When XML_PARSE_DTDVALID is enabled, libxml2 parses and
executes external entities present inside an XML document.
*) Bugfix: fixed the detection of await in arguments.
*) Bugfix: fixed Error() instance dumping when "name" prop is not
primitive.
*) Bugfix: fixed array instance with a getter property dumping.
*) Bugfix: fixed njs_object_property() with NJS_WHITEOUT properties.
*) Bugfix: fixed func instance dumping with "name" as getter.
*) Bugfix: fixed attaching of a stack to an error object.
*) Bugfix: fixed String.prototype.replace() with replacement containing
"$'", "$`".
Changes with njs 0.7.10 7 Feb 2023
nginx modules:
*) Feature: added Request, Response and Headers ctors in Fetch API.
*) Bugfix: fixed nginx logger callback for calls in master process.
Core:
*) Feature: added signal support in CLI.
*) Feature: added "xml" module for working with XML documents.
*) Feature: extended support for symmetric and asymmetric keys
in WebCrypto. Most notably JWK format for importKey() was added.
*) Feature: extended support for symmetric and asymmetric keys
in WebCrypto. Most notably JWK format for importKey() was added.
generateKey() and exportKey() were also implemented.
*) Feature: added String.prototype.replaceAll().
*) Bugfix: fixed for(expr1; conditional syntax error handling.
*) Bugfix: fixed Object.values() and Object.entries() with external
objects.
*) Bugfix: fixed RegExp.prototype[@@replace]().
Changes with njs 0.7.9 17 Nov 2022
nginx modules:
*) Bugfix: fixed Fetch Response prototype reinitialization.
When at least one js_import directive was declared in both HTTP
and Stream, ngx.fetch() returned inapproriate response in Stream.
The bug was introduced in 0.7.7.
Core:
*) Bugfix: fixed String.prototype.replace(re) if re.exec() returns
non-flat array.
*) Bugfix: fixed Array.prototype.fill() when start object changes
"this".
*) Bugfix: fixed description for fs.mkdir() and fs.rmdir() methods.
*) Bugfix: fixed %TypedArray%.prototype.set(s) when s element changes
"this".
*) Bugfix: fixed Array.prototype.splice(s, d) when d resizes "this"
during evaluation.
*) Bugfix: fixed for-in loop with left and right hand side
expressions.
Changes with njs 0.7.8 25 Oct 2022
nginx modules:
*) Feature: added js_preload_object directive.
*) Feature: added ngx.conf_prefix property.
*) Feature: added s.sendUpstream() and s.sendDownstream()
in stream module.
*) Feature: added support for HEAD method in Fetch API.
*) Improvement: improved async callback support for s.send()
in stream module.
Core:
*) Feature: added "name" instance property for a function
object.
*) Feature: added njs.memoryStats object.
*) Bugfix: fixed String.prototype.trimEnd() with unicode
string.
*) Bugfix: fixed Object.freeze() with fast arrays.
*) Bugfix: fixed Object.defineProperty() with fast arrays.
*) Bugfix: fixed async token as a property name of an object.
*) Bugfix: fixed property set instruction when key modifies
base binding.
*) Bugfix: fixed complex assignments.
*) Bugfix: fixed handling of unhandled promise rejection.
*) Bugfix: fixed process.env when duplicate environ variables
are present.
*) Bugfix: fixed double declaration detection in modules.
*) Bugfix: fixed bound function calls according to the spec.
*) Bugfix: fixed break label for if statement.
*) Bugfix: fixed labeled empty statements.
Changes with njs 0.7.7 30 Aug 2022
nginx modules:
*) Feature: the number of nginx configuration contexts where
js directives can be specified is extended.
HTTP: js_import, js_path, js_set and js_var are allowed
in server and location contexts. js_content, js_body_filter
and js_header_filter are allowed in 'if' context.
Stream: js_import, js_path, js_set and js_var are allowed
in server context.
*) Feature: added r.internal property.
*) Bugfix: fixed reading response body in fetch API.
*) Bugfix: fixed "js_fetch_timeout" in stream module.
*) Bugfix: fixed socket leak with 0 fetch timeout.