CVS commit: pkgsrc/www/php-ja-wordpress

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Thu Sep 24 03:40:07 UTC 2026

Modified Files:
        pkgsrc/www/php-ja-wordpress: Makefile distinfo

Log Message:
www/php-ja-wordpress: update to 7.0.6

7.0.5 (2026-09-17)

Security Updates

* An issue allowing a crafted URL to install and preview a theme from
  WordPress.org reported by Paulos Yibelo and pwn.ai

* A stored cross-site scripting (XSS) issue in custom header images on some
  themes reported by Jeremy Felt of the WordPress Security Team

* An information disclosure issue exposing the title of a private parent
  post reported by HDWSec

* An HTML API issue allowing modified text to break out of an HTML comment
  reported by Jeremy Felt of the WordPress Security Team

* A multisite issue allowing a site administrator to network-activate a
  network-only plugin reported by Jesse McNeil

* A Contributor+ arbitrary post overwrite issue reported by Anthropic

* An authenticated path traversal issue in the REST API templates controller
  reported by Anthropic

* An authorization issue allowing any authenticated user to reparent
  comments, including notes, reported by viridis

* An XML-RPC issue allowing changeset posts to bypass the custom CSS
  capability check reported by Ben Bidner of the WordPress Security Team

* A Contributor+ disclosure of draft and pending post slugs reported by
  hermanhms

* An unauthenticated stored cross-site scripting (XSS) issue via paragraph
  formatting, subject to comment approval, reported by Rafie Muhammad
  (Awesome Motive, Inc.)

7.0.6 (2026-09-22)

Security Updates (CVE-2026-87902)

* An unauthenticated path traversal issue in page-template resolution
  leading to conditional remote code execution reported by Robert Ressl


To generate a diff of this commit:
cvs rdiff -u -r1.37 -r1.38 pkgsrc/www/php-ja-wordpress/Makefile
cvs rdiff -u -r1.33 -r1.34 pkgsrc/www/php-ja-wordpress/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/php-ja-wordpress/Makefile
diff -u pkgsrc/www/php-ja-wordpress/Makefile:1.37 pkgsrc/www/php-ja-wordpress/Makefile:1.38
--- pkgsrc/www/php-ja-wordpress/Makefile:1.37   Mon Aug 17 08:38:04 2026
+++ pkgsrc/www/php-ja-wordpress/Makefile        Thu Sep 24 03:40:06 2026
@@ -1,11 +1,10 @@
-# $NetBSD: Makefile,v 1.37 2026/08/17 08:38:04 wiz Exp $
+# $NetBSD: Makefile,v 1.38 2026/09/24 03:40:06 taca Exp $
 #
 # when updating this, please run 'make upload'
 
 DISTNAME=              wordpress-${VERSION}-ja
 PKGNAME=               ${PHP_PKG_PREFIX}-ja-wordpress-${VERSION}
-PKGREVISION=           1
-VERSION=               7.0.4
+VERSION=               7.0.6
 CATEGORIES=            www
 MASTER_SITES=          https://ja.wordpress.org/
 
@@ -13,7 +12,7 @@ MAINTAINER=           ryoon%NetBSD.org@localhost
 HOMEPAGE=              https://ja.wordpress.org/
 COMMENT=               Blogging tool written in php (Localized for Japanese)
 LICENSE=               gnu-gpl-v2
-DIST_SUBDIR=           php-ja-wordpress-20260817
+#DIST_SUBDIR=          php-ja-wordpress-20260924
 
 USE_TOOLS+=            pax
 

Index: pkgsrc/www/php-ja-wordpress/distinfo
diff -u pkgsrc/www/php-ja-wordpress/distinfo:1.33 pkgsrc/www/php-ja-wordpress/distinfo:1.34
--- pkgsrc/www/php-ja-wordpress/distinfo:1.33   Mon Aug 17 04:19:49 2026
+++ pkgsrc/www/php-ja-wordpress/distinfo        Thu Sep 24 03:40:06 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.33 2026/08/17 04:19:49 taca Exp $
+$NetBSD: distinfo,v 1.34 2026/09/24 03:40:06 taca Exp $
 
-BLAKE2s (php-ja-wordpress-20260817/wordpress-7.0.4-ja.tar.gz) = f2eda277d989f2f907748b7da224d787cfa3b570e5075193ab070596c8909802
-SHA512 (php-ja-wordpress-20260817/wordpress-7.0.4-ja.tar.gz) = d8ae3a5c3b61f0e533ad6f0c6ca118e962cbae86cd2ce72ebd238730c6bc96c14552803f1dab1e71dc5d38560c245ab1976523983e8666c11308e7d9d11dc92c
-Size (php-ja-wordpress-20260817/wordpress-7.0.4-ja.tar.gz) = 36916361 bytes
+BLAKE2s (wordpress-7.0.6-ja.tar.gz) = 3583a6c3e1253659813cbc1c3a56d7c58af0fe5070fc84806e38bd26ccb331cb
+SHA512 (wordpress-7.0.6-ja.tar.gz) = 6c1a59aad445b2d3c6874a0514e07d95c3a7a3990d85836908455e31187d2ba1d7f60f841f090b352f144ca1dcb0197c8a13d4432087b2b3d4356ceec788ce45
+Size (wordpress-7.0.6-ja.tar.gz) = 36919266 bytes