Le sam. 22 août 2026 à 22:32, Jan Mojzis <[email protected]> a écrit :
> Hi, > > On Tue, 14 Jul 2026 23:57:01 +0200 =?utf-8?b?SsOpcsOpbXkgTGFs?= < > [email protected]> wrote: > > Package: lua-resty-core > > Version: 0.1.32-1 > > Severity: important > > > > Hi, > > > > AFAIUI resty-core doesn't depend on libnginx-mod-http-lua ? > > It uses LuaJIT FFI to call C functions exported by a > specific ngx_http_lua_module version. Upstream therefore performs an exact > version check when resty.core is loaded. > > For example, lua-resty-core 0.1.32 contains the following check in > lib/resty/core/base.lua: > > if subsystem == 'http' then > if not ngx.config > or not ngx.config.ngx_lua_version > or ngx.config.ngx_lua_version ~= 10029 > then > error("ngx_http_lua_module 0.10.29 required") > end > end > > This is an equality check, not a minimum-version check. The corresponding > upstream compatibility pairs are currently: > > lua-resty-core 0.1.32 <-> ngx_http_lua 0.10.29 > lua-resty-core 0.1.33 <-> ngx_http_lua 0.10.30 > lua-resty-core 0.1.34 <-> ngx_http_lua 0.10.31 > lua-resty-core 0.1.35 <-> ngx_http_lua 0.10.32 > > > > > > If I don't understand well, at least I find it dubious that > > lua-resty-core:amd64 Depends libnginx-mod-http-lua (< 1:0.10.29.1~) > > > > The reverse is true, though. The nginx lua module should have a tight > > dependency on lua-resty-core. > > Hmm, the dependency is incorrect. That lower bound is insufficient :( > > > To avoid circular dependencies, > fix can be: fix dependencies in libnginx-mod-http-lua and add ‘Breaks’ > to lua-resty-core, > > lua-resty-core: > > Depends: > libluajit-5.1-2, > - libnginx-mod-http-lua (<< 1:0.10.29.1~), > - libnginx-mod-http-lua (>= 1:0.10.29), > lua-resty-lrucache (>= 0.13-11), > +Breaks: > + libnginx-mod-http-lua (<< 1:0.10.29), > > > libnginx-mod-http-lua: > > -Depends: lua-resty-core (>= 0.1.32), > +Depends: > + lua-resty-core (>= 0.1.32), > + lua-resty-core (<< 0.1.32.1~), > LGTM > > > > Jan > > > > > >
