CVS commit: [pkgsrc-2026Q2] pkgsrc/textproc/p5-YAML-Syck

["Maya Rashish" <maya%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   maya
Date:           Sat Aug  1 20:05:55 UTC 2026

Modified Files:
        pkgsrc/textproc/p5-YAML-Syck [pkgsrc-2026Q2]: Makefile distinfo

Log Message:
Pullup ticket #7204 - requested by taca
textproc/p5-YAML-Syck: Security fix

Revisions pulled up:
- textproc/p5-YAML-Syck/Makefile                                1.43
- textproc/p5-YAML-Syck/distinfo                                1.24

---
   Module Name: pkgsrc
   Committed By:        wiz
   Date:                Fri Jul 17 06:14:44 UTC 2026

   Modified Files:
        pkgsrc/textproc/p5-YAML-Syck: Makefile distinfo

   Log Message:
   p5-YAML-Syck: update to 1.47.

   1.47 Jul 13 2026

     [Security]
     - Fix four libsyck memory-safety CVEs reachable from the default
       YAML::Syck::Load() path on untrusted input with no special flags
       (reported by Paul Johnson via CPANSec, PR #213):
       - CVE-2026-57075 (CWE-125): out-of-bounds read in the base64 decoder
         caused by signed-char indexing of the decode table on !!binary input
       - CVE-2026-57076 (CWE-416): use-after-free of an anchor key string
         shared between the node and the anchors table
       - CVE-2026-57077 (CWE-125): one-byte out-of-bounds read in the lexer
         newline scan during block-scalar parsing (incomplete-fix follow-on
         to CVE-2025-11683)
       - CVE-2026-13713 (CWE-416/CWE-415): use-after-free / double-free of an
         anchor node on anchor redefinition, a remote-crash DoS from a
         7-byte input
     - Harden syck_base64dec() to bounds-check each read so it cannot run past
       a non-NUL-terminated input buffer (defense-in-depth for callers passing
       raw buffers; PR #213)

     [Bug Fixes]
     - Fix: enforce $MaxDepth on Load to prevent C-stack exhaustion from
       deeply nested YAML/JSON input; YAML::Syck and JSON::Syck Load now
       default to 512, matching Dump (PR #204)
     - Fix: emit YAML canonical forms (.nan, .inf, -.inf) for NaN/Inf values
       in Dump so they roundtrip with ImplicitTyping instead of reloading as
       plain strings (PR #201)

     [Maintenance]
     - CI: add an AddressSanitizer job that builds the XS with
       -fsanitize=address and runs the suite plus the CVE trigger inputs to
       catch libsyck memory-safety defects; de-pin the libasan version so it
       tracks the runner's GCC (PR #213)

   1.46 May 24 2026

     [Bug Fixes]
     - Fix: preserve string nature of numeric-looking values in Dump; pure
       strings (POK only, no IOK/NOK) are now quoted to maintain roundtrip
       fidelity (GH #199, PR #200)
     - Fix: accept trailing commas in flow sequences and mappings
       ([a, b,] and {a: 1,}), valid per YAML 1.0/1.1/1.2 spec
       (GH #195, PR #196)

     [Maintenance]
     - CI: upgrade install-with-cpm to v2 for compatibility with Perl
       versions prior to 5.24 in perldocker containers (GH #197, PR #198)
     - Clean up MANIFEST.SKIP: add #!include_default, remove redundant
       entries, exclude .claude/ from distribution


To generate a diff of this commit:
cvs rdiff -u -r1.41 -r1.41.2.1 pkgsrc/textproc/p5-YAML-Syck/Makefile
cvs rdiff -u -r1.23 -r1.23.2.1 pkgsrc/textproc/p5-YAML-Syck/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/textproc/p5-YAML-Syck/Makefile
diff -u pkgsrc/textproc/p5-YAML-Syck/Makefile:1.41 pkgsrc/textproc/p5-YAML-Syck/Makefile:1.41.2.1
--- pkgsrc/textproc/p5-YAML-Syck/Makefile:1.41  Tue May 12 18:35:42 2026
+++ pkgsrc/textproc/p5-YAML-Syck/Makefile       Sat Aug  1 20:05:55 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.41 2026/05/12 18:35:42 wiz Exp $
+# $NetBSD: Makefile,v 1.41.2.1 2026/08/01 20:05:55 maya Exp $
 
-DISTNAME=      YAML-Syck-1.45
+DISTNAME=      YAML-Syck-1.47
 PKGNAME=       p5-${DISTNAME}
 CATEGORIES=    textproc perl5
 MASTER_SITES=  ${MASTER_SITE_PERL_CPAN:=../../authors/id/T/TO/TODDR/}
@@ -13,5 +13,8 @@ LICENSE=      mit AND 2-clause-bsd
 PERL5_PACKLIST=                auto/YAML/Syck/.packlist
 PERL5_MODULE_TYPE=     Module::Install::Bundled
 
+# https://github.com/cpan-authors/YAML-Syck/issues/218
+EXTRACT_USING= gtar
+
 .include "../../lang/perl5/module.mk"
 .include "../../mk/bsd.pkg.mk"

Index: pkgsrc/textproc/p5-YAML-Syck/distinfo
diff -u pkgsrc/textproc/p5-YAML-Syck/distinfo:1.23 pkgsrc/textproc/p5-YAML-Syck/distinfo:1.23.2.1
--- pkgsrc/textproc/p5-YAML-Syck/distinfo:1.23  Tue May 12 18:35:42 2026
+++ pkgsrc/textproc/p5-YAML-Syck/distinfo       Sat Aug  1 20:05:55 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.23 2026/05/12 18:35:42 wiz Exp $
+$NetBSD: distinfo,v 1.23.2.1 2026/08/01 20:05:55 maya Exp $
 
-BLAKE2s (YAML-Syck-1.45.tar.gz) = 168d225b3aab55af244c876c8c2c306c07ab44031ba7c5525ffa260bcead35f4
-SHA512 (YAML-Syck-1.45.tar.gz) = ed719ef609c1a3f938cee8e03b41a989805d7681ba7e44bc6326162c285ff542fce77f3f3ea3ba6e576ad1a9bfa762b7af8cf009041ed312f5bd01b5635d125a
-Size (YAML-Syck-1.45.tar.gz) = 264328 bytes
+BLAKE2s (YAML-Syck-1.47.tar.gz) = 119db0a83da527c15a27d35d2ed19a09776d07fa4fb03b233d137aba9e618428
+SHA512 (YAML-Syck-1.47.tar.gz) = 7f1f37a18063716630f785599e82ebd43747f842775300f3a5f8e69d4261f3a9f69d88e232b55fb1ad61c5c29c7e6b6512cca9b2a3c4f66cf6f9e93947a2f63f
+Size (YAML-Syck-1.47.tar.gz) = 270328 bytes