CVS commit: pkgsrc/www/p5-libwww

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Tue May 12 18:33:50 UTC 2026

Modified Files:
        pkgsrc/www/p5-libwww: Makefile distinfo

Log Message:
p5-libwww: update to 6.83.

6.83      2026-05-12 11:41:48Z
    - LWP::UserAgent now strips Authorization and Proxy-Authorization headers
      on cross-origin redirects (a different scheme, host, or port) to prevent
      credential leakage to the redirect target. Same-origin redirects retain
      credentials. Opt out with allow_credentialed_redirects => 1.
      CVE-2026-8368 reported by Kai Zen; PoC and initial patch by Stig
      Palmquist.
    - LWP::UserAgent now refuses https to http redirects by default to prevent
      leaking remaining request headers and bodies over plaintext. Opt in with
      allow_downgrade => 1. Related hardening alongside CVE-2026-8368; PoC by
      Stig Palmquist.


To generate a diff of this commit:
cvs rdiff -u -r1.150 -r1.151 pkgsrc/www/p5-libwww/Makefile
cvs rdiff -u -r1.87 -r1.88 pkgsrc/www/p5-libwww/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/p5-libwww/Makefile
diff -u pkgsrc/www/p5-libwww/Makefile:1.150 pkgsrc/www/p5-libwww/Makefile:1.151
--- pkgsrc/www/p5-libwww/Makefile:1.150 Sun Apr  5 07:25:10 2026
+++ pkgsrc/www/p5-libwww/Makefile       Tue May 12 18:33:50 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.150 2026/04/05 07:25:10 wiz Exp $
+# $NetBSD: Makefile,v 1.151 2026/05/12 18:33:50 wiz Exp $
 
-DISTNAME=      libwww-perl-6.82
+DISTNAME=      libwww-perl-6.83
 PKGNAME=       p5-${DISTNAME:S/-perl-/-/}
 CATEGORIES=    www perl5
 MASTER_SITES=  ${MASTER_SITE_PERL_CPAN:=../../authors/id/O/OA/OALDERS/}

Index: pkgsrc/www/p5-libwww/distinfo
diff -u pkgsrc/www/p5-libwww/distinfo:1.87 pkgsrc/www/p5-libwww/distinfo:1.88
--- pkgsrc/www/p5-libwww/distinfo:1.87  Sun Apr  5 07:25:10 2026
+++ pkgsrc/www/p5-libwww/distinfo       Tue May 12 18:33:50 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.87 2026/04/05 07:25:10 wiz Exp $
+$NetBSD: distinfo,v 1.88 2026/05/12 18:33:50 wiz Exp $
 
-BLAKE2s (libwww-perl-6.82.tar.gz) = a5aa471a0b4ae28924d097a2f2ab5d3daddf92389386966386ca3405ba91b3f0
-SHA512 (libwww-perl-6.82.tar.gz) = 2d090456f1e6808de7712b81d9d88da32edfaf1e841ec7669d12e93349159d7fd472155798a4bf03d9ac7fac45d93da9c680197fb2ad4482fa0ebbbabb82c2cd
-Size (libwww-perl-6.82.tar.gz) = 187496 bytes
+BLAKE2s (libwww-perl-6.83.tar.gz) = 052922e2e9441f5a8061c8826aeba7de606b7446d161ca974f4f0ecf586cf065
+SHA512 (libwww-perl-6.83.tar.gz) = 23d62d7319ae055f8bd3b103fd2b2d5f9a4d0f5d24e9a60448fba15f323d1b209c30ae2e276c7f5c295b41acee928af40316ae2c111a3f022aba7718e483ac62
+Size (libwww-perl-6.83.tar.gz) = 190640 bytes