nghttp2: security update to 1.70.0

Signed-off-by: stydxm <stydxm@outlook.com>

Author: stydxm

runtime-web/nghttp2/autobuild/defines.stage2

@@ -3,6 +3,7 @@ PKGSEC=libs
 PKGDEP="c-ares jansson jemalloc libev"
 PKGDES="Library to implement the HTTP/2 protocol and the HPACK header compression algorithm"
 
+ABTYPE=autotools
 # FIXME: --disable-examples to skip broken examples (event.h incompatibility).
 AUTOTOOLS_AFTER=(
     '--disable-werror'

runtime-web/nghttp2/spec

@@ -1,5 +1,4 @@
-VER=1.69.0
-REL=2
-SRCS="tbl::https://github.com/nghttp2/nghttp2/releases/download/v$VER/nghttp2-$VER.tar.xz"
-CHKSUMS="sha256::1fb324b6ec2c56f6bde0658f4139ffd8209fa9e77ce98fd7a5f63af8d0e508ad"
+VER=1.70.0
+SRCS="git::commit=tags/v$VER::https://github.com/nghttp2/nghttp2"
+CHKSUMS="SKIP"
 CHKUPDATE="anitya::id=8651"

topics/nghttp2-1.70.0.toml

@@ -0,0 +1,11 @@
+security = true
+
+[name]
+default = "nghttp2 1.70.0"
+
+[caution]
+default = "Fixes a HTTP Request/Response Smuggling vulnerability (CVE-2026-58055, Severity: Medium)"
+zh_CN = "修复 1 个 HTTP 请求/响应欺骗漏洞（CVE-2026-58055，严重性：中）"
+
+[packages-v2]
+"nghttp2" = "< 1.70.0"