Hi,
On Tue, 14 Jul 2026 23:57:01 +0200 =?utf-8?b?SsOpcsOpbXkgTGFs?=
<[email protected]> wrote:
> Package: lua-resty-core
> Version: 0.1.32-1
> Severity: important
>
> Hi,
>
> AFAIUI resty-core doesn't depend on libnginx-mod-http-lua ?
It uses LuaJIT FFI to call C functions exported by a
specific ngx_http_lua_module version. Upstream therefore performs an exact
version check when resty.core is loaded.
For example, lua-resty-core 0.1.32 contains the following check in
lib/resty/core/base.lua:
if subsystem == 'http' then
if not ngx.config
or not ngx.config.ngx_lua_version
or ngx.config.ngx_lua_version ~= 10029
then
error("ngx_http_lua_module 0.10.29 required")
end
end
This is an equality check, not a minimum-version check. The corresponding
upstream compatibility pairs are currently:
lua-resty-core 0.1.32 <-> ngx_http_lua 0.10.29
lua-resty-core 0.1.33 <-> ngx_http_lua 0.10.30
lua-resty-core 0.1.34 <-> ngx_http_lua 0.10.31
lua-resty-core 0.1.35 <-> ngx_http_lua 0.10.32
>
> If I don't understand well, at least I find it dubious that
> lua-resty-core:amd64 Depends libnginx-mod-http-lua (< 1:0.10.29.1~)
>
> The reverse is true, though. The nginx lua module should have a tight
> dependency on lua-resty-core.
Hmm, the dependency is incorrect. That lower bound is insufficient :(
To avoid circular dependencies,
fix can be: fix dependencies in libnginx-mod-http-lua and add ‘Breaks’ to
lua-resty-core,
lua-resty-core:
Depends:
libluajit-5.1-2,
- libnginx-mod-http-lua (<< 1:0.10.29.1~),
- libnginx-mod-http-lua (>= 1:0.10.29),
lua-resty-lrucache (>= 0.13-11),
+Breaks:
+ libnginx-mod-http-lua (<< 1:0.10.29),
libnginx-mod-http-lua:
-Depends: lua-resty-core (>= 0.1.32),
+Depends:
+ lua-resty-core (>= 0.1.32),
+ lua-resty-core (<< 0.1.32.1~),
Jan
