Repository navigation
modsecurity_standalone: 2.9.12 -> 2.9.15, use Lua 5.5 - #571363
Merged
GaetanLepage merged 2 commits intoOct 7, 2026
Merged
Conversation
nixpkgs-ci
Bot
added
8.has: package (update)
Contributor
Author
|
khaneliman
marked this pull request as ready for review
October 7, 2026 16:02
nixpkgs-ci
Bot
added
9.needs: reviewer
nixpkgs-ci
Bot
removed
the
9.needs: reviewer
GaetanLepage
reviewed
Oct 7, 2026
https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.13 https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.14 https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15 2.9.15 fixes GHSA-cxqf-vgrr-xxrv, GHSA-2vqc-36qp-ccmw, GHSA-jx3r-phvx-2jmj, GHSA-qrch-pjfr-9g47, GHSA-4j47-8qcr-jf59 and GHSA-5pww-8rfg-9crf. 2.9.14 removes the deprecated REQBODY_PROCESSOR_ERROR and REQBODY_PROCESSOR_ERROR_MSG variables. Upstream now vendors libinjection as a git submodule, so fetch submodules. Makefile.am.patch still applies. 2.9.13 also removes the NGINX connector from v2. Drop the nginx output, which held a copy of the source tree for building that connector; nothing in Nixpkgs uses it, and nginxModules.modsecurity builds on libmodsecurity 3.x instead. Built on x86_64-linux with Lua disabled (the default) and with luaSupport on the existing Lua 5.2 input; the upstream check and the mlogc version check passed for both. Assisted-by: Claude Code (Claude Opus 5.5)
Select Lua 5.5 instead of the generic Lua 5.2 compatibility input for the optional Lua support. ModSecurity 2.9.13 added Lua 5.5 handling to its state creation and detection. Lua support stays disabled by default, so the default package does not change. owasp-modsecurity/ModSecurity#3527 https://github.com/owasp-modsecurity/ModSecurity/blob/v2.9.15/build/find_lua.m4 Users who enable luaSupport now run their SecRuleScript and exec scripts with Lua 5.5 instead of the 5.2 compatibility build, so scripts relying on removed Lua 5.1 functions such as unpack or loadstring need updating. Built on x86_64-linux with luaSupport enabled; mod_security2.so links liblua.so.5.5. Apache httpd 2.4.69 loaded the module with a SecRuleScript rule that reads ARGS through m.getvar: a matching request returned 403 and logged "ModSecurity rule executed with Lua 5.5", and a non-matching request returned 200. The default build has no Lua in its closure. Related to NixOS#570322. Assisted-by: Claude Code (Claude Opus 5.5)
khaneliman
force-pushed
the
modsecurity-standalone-lua55
branch
from
October 7, 2026 18:02
04c2b3c to
da036d9
Compare
Contributor
|
GaetanLepage
approved these changes
Oct 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update ModSecurity v2 and move its optional Lua support from the 5.2 compatibility input to Lua 5.5, which 2.9.13 supports (#3527).
2.9.15 fixes GHSA-cxqf-vgrr-xxrv, GHSA-2vqc-36qp-ccmw, GHSA-jx3r-phvx-2jmj, GHSA-qrch-pjfr-9g47, GHSA-4j47-8qcr-jf59 and GHSA-5pww-8rfg-9crf, so the version bump commit is worth backporting on its own. Other changes worth knowing about:
nginxoutput (a copy of the source tree for building it) is dropped. Nothing in Nixpkgs uses it;nginxModules.modsecurityuses libmodsecurity 3.x.REQBODY_PROCESSOR_ERRORandREQBODY_PROCESSOR_ERROR_MSGvariables.Lua stays off by default, so the default package doesn't change from the Lua switch.
Changelogs: 2.9.13, 2.9.14, 2.9.15.
Related to #570322.
Built on x86_64-linux with Lua off and on, at both commits; the upstream check and
mlogcversion check passed. WithluaSupport = true, Apache httpd 2.4.69 loadedmod_security2.sowith aSecRuleScriptrule usingm.getvar: a matching request got 403 and logged "ModSecurity rule executed with Lua 5.5", a non-matching one got 200.Things done
passthru.tests.nixpkgs-reviewon this PR. See nixpkgs-review usage../result/bin/.PR description assisted by Claude Code (Claude Opus 5.5).