CVS commit: pkgsrc/www/ruby-rack2

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Thu Aug 13 16:34:44 UTC 2026

Modified Files:
        pkgsrc/www/ruby-rack2: Makefile distinfo

Log Message:
www/ruby-rack2: update to 2.2.24

2.2.23 (2026-04-01)

Security

* CVE-2026-34763 Root directory disclosure via unescaped regex interpolation
  in Rack::Directory.

* CVE-2026-34230 Avoid O(n^2) algorithm in Rack::Utils.select_best_encoding
  which could lead to denial of service.

* CVE-2026-26961 Raise error for multipart requests with multiple boundary
  parameters.

* CVE-2026-34786 Rack::Static header_rules bypass via URL-encoded path
  mismatch.

* CVE-2026-34831 Content-Length mismatch in Rack::Files error responses.

* CVE-2026-34826 Multipart byte range processing allows denial of service
  via excessive overlapping ranges.

* CVE-2026-34830 Rack::Sendfile header-based X-Accel-Mapping regex injection
  enables unauthorized X-Accel-Redirect.

* CVE-2026-34785 Rack::Static prefix matching can expose unintended files
  under the static root.

* CVE-2026-34829 Multipart parsing without Content-Length header allows
  unbounded chunked file uploads.

2.2.24 (2026-08-13)

Security

* CVE-2026-26962 Improper unfolding of folded multipart headers preserves
  CRLF in parsed parameter values.


To generate a diff of this commit:
cvs rdiff -u -r1.16 -r1.17 pkgsrc/www/ruby-rack2/Makefile \
    pkgsrc/www/ruby-rack2/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/ruby-rack2/Makefile
diff -u pkgsrc/www/ruby-rack2/Makefile:1.16 pkgsrc/www/ruby-rack2/Makefile:1.17
--- pkgsrc/www/ruby-rack2/Makefile:1.16 Mon Feb 16 14:45:15 2026
+++ pkgsrc/www/ruby-rack2/Makefile      Thu Aug 13 16:34:44 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.16 2026/02/16 14:45:15 taca Exp $
+# $NetBSD: Makefile,v 1.17 2026/08/13 16:34:44 taca Exp $
 
-DISTNAME=      rack-2.2.22
+DISTNAME=      rack-2.2.24
 PKGNAME=       ${RUBY_PKGPREFIX}-${DISTNAME:S/rack/&2/}
 CATEGORIES=    www
 
Index: pkgsrc/www/ruby-rack2/distinfo
diff -u pkgsrc/www/ruby-rack2/distinfo:1.16 pkgsrc/www/ruby-rack2/distinfo:1.17
--- pkgsrc/www/ruby-rack2/distinfo:1.16 Mon Feb 16 14:45:15 2026
+++ pkgsrc/www/ruby-rack2/distinfo      Thu Aug 13 16:34:44 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.16 2026/02/16 14:45:15 taca Exp $
+$NetBSD: distinfo,v 1.17 2026/08/13 16:34:44 taca Exp $
 
-BLAKE2s (rack-2.2.22.gem) = 0196e40362bdad165edd759f802ef8bf264b834b6a09633fd8b95b865dce417f
-SHA512 (rack-2.2.22.gem) = ef4fe8d96c34c86cea0ed0240c7d1e68b014be9e7bbb5b859359cdd9c0df582bdc160b794dd1eda80fcff22a91107726519a3a6831d8db64a691f3420a669ed8
-Size (rack-2.2.22.gem) = 155648 bytes
+BLAKE2s (rack-2.2.24.gem) = ddd16f2c12aa64b4267e1d3574c76a5d356364cf8f9b840338fb8083c50eaa36
+SHA512 (rack-2.2.24.gem) = c03bc7033f69ae3ba4d31d56de9d244c01cd931a97f34a434b4957933d684160554e2e4212723b7119c2df09b4f09b0ca52f33f980e8444a15467be64a818ba9
+Size (rack-2.2.24.gem) = 157184 bytes