CVS commit: [pkgsrc-2026Q2] pkgsrc/www/ruby-rails-html-sanitizer

["Maya Rashish" <maya%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   maya
Date:           Sun Aug 16 21:29:59 UTC 2026

Modified Files:
        pkgsrc/www/ruby-rails-html-sanitizer [pkgsrc-2026Q2]: Makefile PLIST
            distinfo

Log Message:
Pullup ticket #7232 - requested by taca
www/ruby-rails-html-sanitizer: Security fix

Revisions pulled up:
- www/ruby-rails-html-sanitizer/Makefile                        1.12
- www/ruby-rails-html-sanitizer/PLIST                           1.5
- www/ruby-rails-html-sanitizer/distinfo                        1.14

---
   Module Name: pkgsrc
   Committed By:        taca
   Date:                Wed Aug 12 05:22:49 UTC 2026

   Modified Files:
        pkgsrc/www/ruby-rails-html-sanitizer: Makefile PLIST distinfo

   Log Message:
   www/ruby-rails-html-sanitizer: update to 1.7.1

   1.7.1 (2026-07-15)

   * SVG reference elements now restrict both href and xlink:href to local
     references.

     Previously PermitScrubber restricted only xlink:href on elements in
     SVG_ALLOW_LOCAL_HREF, so a plain href attribute on those elements could
     reference an external document. Applications are only affected if the
     allowed tags are overridden to include an SVG reference element such as
     use; the default configuration is not affected.

     This change addresses GHSA-cj75-f6xr-r4g7 (CVE requested).  The minimum
     Loofah dependency is now ~> 2.25, >= 2.25.2.


To generate a diff of this commit:
cvs rdiff -u -r1.11 -r1.11.2.1 pkgsrc/www/ruby-rails-html-sanitizer/Makefile
cvs rdiff -u -r1.4 -r1.4.2.1 pkgsrc/www/ruby-rails-html-sanitizer/PLIST
cvs rdiff -u -r1.13 -r1.13.2.1 pkgsrc/www/ruby-rails-html-sanitizer/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/ruby-rails-html-sanitizer/Makefile
diff -u pkgsrc/www/ruby-rails-html-sanitizer/Makefile:1.11 pkgsrc/www/ruby-rails-html-sanitizer/Makefile:1.11.2.1
--- pkgsrc/www/ruby-rails-html-sanitizer/Makefile:1.11  Sun Apr 12 15:33:30 2026
+++ pkgsrc/www/ruby-rails-html-sanitizer/Makefile       Sun Aug 16 21:29:59 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.11 2026/04/12 15:33:30 taca Exp $
+# $NetBSD: Makefile,v 1.11.2.1 2026/08/16 21:29:59 maya Exp $
 
-DISTNAME=      rails-html-sanitizer-1.7.0
+DISTNAME=      rails-html-sanitizer-1.7.1
 CATEGORIES=    www
 
 MAINTAINER=    minskim%NetBSD.org@localhost
@@ -8,7 +8,7 @@ HOMEPAGE=       https://github.com/rails/rails
 COMMENT=       HTML sanitizer for Rails applications
 LICENSE=       mit
 
-DEPENDS+=      ${RUBY_PKGPREFIX}-loofah>=2.19<3:../../www/ruby-loofah
+DEPENDS+=      ${RUBY_PKGPREFIX}-loofah>=2.25.2<3:../../www/ruby-loofah
 
 USE_LANGUAGES= # empty
 

Index: pkgsrc/www/ruby-rails-html-sanitizer/PLIST
diff -u pkgsrc/www/ruby-rails-html-sanitizer/PLIST:1.4 pkgsrc/www/ruby-rails-html-sanitizer/PLIST:1.4.2.1
--- pkgsrc/www/ruby-rails-html-sanitizer/PLIST:1.4      Sun Apr 12 15:33:30 2026
+++ pkgsrc/www/ruby-rails-html-sanitizer/PLIST  Sun Aug 16 21:29:59 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.4 2026/04/12 15:33:30 taca Exp $
+@comment $NetBSD: PLIST,v 1.4.2.1 2026/08/16 21:29:59 maya Exp $
 ${GEM_HOME}/cache/${GEM_NAME}.gem
 ${GEM_LIBDIR}/CHANGELOG.md
 ${GEM_LIBDIR}/MIT-LICENSE
@@ -7,8 +7,4 @@ ${GEM_LIBDIR}/lib/rails-html-sanitizer.r
 ${GEM_LIBDIR}/lib/rails/html/sanitizer.rb
 ${GEM_LIBDIR}/lib/rails/html/sanitizer/version.rb
 ${GEM_LIBDIR}/lib/rails/html/scrubbers.rb
-${GEM_LIBDIR}/test/rails_api_test.rb
-${GEM_LIBDIR}/test/sanitizer_test.rb
-${GEM_LIBDIR}/test/scrubbers_test.rb
-${GEM_LIBDIR}/test/test_helper.rb
 ${GEM_HOME}/specifications/${GEM_NAME}.gemspec

Index: pkgsrc/www/ruby-rails-html-sanitizer/distinfo
diff -u pkgsrc/www/ruby-rails-html-sanitizer/distinfo:1.13 pkgsrc/www/ruby-rails-html-sanitizer/distinfo:1.13.2.1
--- pkgsrc/www/ruby-rails-html-sanitizer/distinfo:1.13  Sun Apr 12 15:33:30 2026
+++ pkgsrc/www/ruby-rails-html-sanitizer/distinfo       Sun Aug 16 21:29:59 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.13 2026/04/12 15:33:30 taca Exp $
+$NetBSD: distinfo,v 1.13.2.1 2026/08/16 21:29:59 maya Exp $
 
-BLAKE2s (rails-html-sanitizer-1.7.0.gem) = c646eac714c6a0345b604cc90709fbe39b1fc3a2ca364be765fff22aa4bfb2d6
-SHA512 (rails-html-sanitizer-1.7.0.gem) = dae6e187f96fa0a1f2406f53596fdfc260e52d64ce5d452f2a617a3db9856e43dd7a11f749bd8b494356d0404ddff5775706927d89e116d430b9215bef4f4a06
-Size (rails-html-sanitizer-1.7.0.gem) = 26112 bytes
+BLAKE2s (rails-html-sanitizer-1.7.1.gem) = 887216d67ff1ff05b9eadf7d1d57e6997ca682624c9d145c4c1d46b8ba0811f0
+SHA512 (rails-html-sanitizer-1.7.1.gem) = 75031b179c1287e7adc38b57ffc2448642e8cf5bd3988143a5baf879f2ce7171d7b11590929f84cc5a88b852466e33ddc7d1a421aca147dd22df5ef29d63a626
+Size (rails-html-sanitizer-1.7.1.gem) = 15360 bytes