CVS commit: pkgsrc/www/py-WebOb

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Thu Aug 20 10:16:52 UTC 2026

Modified Files:
        pkgsrc/www/py-WebOb: Makefile distinfo

Log Message:
py-WebOb: updated to 1.8.11

1.8.11 (2026-08-02)

Security Fix

- The fixes for CVE-2024-42353 and GHSA-fh3h-vg37-cc95 were still
  incomplete: besides removing tab, CR, and LF, ``urllib.parse.urljoin``
  also strips leading and trailing C0 control and space characters from a
  URL before parsing it. A Location value such as
  ``" //www.example.com/test"`` could therefore still be interpreted as a
  protocol-relative URL (and ``" https://www.example.com/test"`` as an
  absolute one), allowing an open redirect.

  WebOb no longer uses ``urllib.parse.urljoin`` and instead ships its own
  implementation of the RFC 3986 reference resolution algorithm,
  ``webob.util.urljoin``, which resolves the URL exactly as given without
  removing any characters. It is now used to make the Location header
  absolute, by ``Request.relative_url``, and by the ``_HTTPMove`` based
  HTTP exceptions, which normalize the Location header through the same
  code path as the Response object (so a protocol-relative location
  passed to e.g. ``HTTPFound`` no longer redirects off-host either).

  See https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g


To generate a diff of this commit:
cvs rdiff -u -r1.23 -r1.24 pkgsrc/www/py-WebOb/Makefile
cvs rdiff -u -r1.15 -r1.16 pkgsrc/www/py-WebOb/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/py-WebOb/Makefile
diff -u pkgsrc/www/py-WebOb/Makefile:1.23 pkgsrc/www/py-WebOb/Makefile:1.24
--- pkgsrc/www/py-WebOb/Makefile:1.23   Wed Jun 24 18:14:13 2026
+++ pkgsrc/www/py-WebOb/Makefile        Thu Aug 20 10:16:52 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.23 2026/06/24 18:14:13 adam Exp $
+# $NetBSD: Makefile,v 1.24 2026/08/20 10:16:52 adam Exp $
 
-DISTNAME=      webob-1.8.10
+DISTNAME=      webob-1.8.11
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME:S/webob/WebOb/}
 CATEGORIES=    www python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=w/webob/}

Index: pkgsrc/www/py-WebOb/distinfo
diff -u pkgsrc/www/py-WebOb/distinfo:1.15 pkgsrc/www/py-WebOb/distinfo:1.16
--- pkgsrc/www/py-WebOb/distinfo:1.15   Wed Jun 24 18:14:13 2026
+++ pkgsrc/www/py-WebOb/distinfo        Thu Aug 20 10:16:52 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.15 2026/06/24 18:14:13 adam Exp $
+$NetBSD: distinfo,v 1.16 2026/08/20 10:16:52 adam Exp $
 
-BLAKE2s (webob-1.8.10.tar.gz) = 4500add35d9f268fdefee507b1b89c6a904e3f1095ede028ac0c68328a5567ef
-SHA512 (webob-1.8.10.tar.gz) = a37333d95763b24cd6d435e4dd59a18a8cb3c10c23075d6c79114654c84f38b9e41b36d868e4e3200fba93774529f6f4506b29a04411acaa90a2d14cc668a7ed
-Size (webob-1.8.10.tar.gz) = 280796 bytes
+BLAKE2s (webob-1.8.11.tar.gz) = ae1a4ae7789da7bde17b51912a58f465fee2dbde099739501b2aff98402c940d
+SHA512 (webob-1.8.11.tar.gz) = 0cf296c667c2450f0fff393b2eb5bc8e5cceb0bcdb9b751200855db08a63dded6babd6c2c2ab1f801dd01dbac8ead0e8a6c74cc77bebd17fb30567f6eac60829
+Size (webob-1.8.11.tar.gz) = 286047 bytes