CVS commit: pkgsrc/devel/py-mako

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Mon Sep 28 15:37:03 UTC 2026

Modified Files:
        pkgsrc/devel/py-mako: Makefile distinfo

Log Message:
py-mako: update to 1.4.3.

1.4.3

bug

    [bug] [tests]

    Fixed regression caused in 1.4.2 where tests added to the suite
    were unable to run directly on Windows, due to posix mechanics:
    the tests force os.path to posixpath, whereas
    TemplateLookup.get_template() converts the configured directory
    using os.path.sep. These tests are now skipped on that platform,
    where the traversal check is instead exercised against ntpath
    natively.

1.4.2

bug

    [bug] [tests]

    Adjusted the test suite to accommodate for a change in Pygments
    2.21.0 where the HtmlFormatter now renders " and ' characters
    literally rather than as HTML entities, which caused failures
    in tests that assert against the rendered output of
    html_error_template().

    [bug] [template]

    Fixed issue in TemplateLookup where a URI beginning with a
    drive designator (e.g. C:/../../secret.txt) could bypass the
    directory traversal check on Windows, allowing reads of arbitrary
    files outside of the template directory. The check in Template
    normalized the URI using os.path, which on Windows is ntpath;
    as ntpath splits the drive designator off and treats the
    remainder as rooted, the .. segments were absorbed before the
    check could inspect them. Normalization is now performed with
    posixpath, which is the same module used by
    TemplateLookup.get_template() to resolve the URI to a file.


To generate a diff of this commit:
cvs rdiff -u -r1.42 -r1.43 pkgsrc/devel/py-mako/Makefile
cvs rdiff -u -r1.35 -r1.36 pkgsrc/devel/py-mako/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/py-mako/Makefile
diff -u pkgsrc/devel/py-mako/Makefile:1.42 pkgsrc/devel/py-mako/Makefile:1.43
--- pkgsrc/devel/py-mako/Makefile:1.42  Sun Aug  9 16:21:08 2026
+++ pkgsrc/devel/py-mako/Makefile       Mon Sep 28 15:37:03 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.42 2026/08/09 16:21:08 wiz Exp $
+# $NetBSD: Makefile,v 1.43 2026/09/28 15:37:03 wiz Exp $
 
-DISTNAME=      mako-1.4.1
+DISTNAME=      mako-1.4.3
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME}
 CATEGORIES=    devel python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=M/Mako/}

Index: pkgsrc/devel/py-mako/distinfo
diff -u pkgsrc/devel/py-mako/distinfo:1.35 pkgsrc/devel/py-mako/distinfo:1.36
--- pkgsrc/devel/py-mako/distinfo:1.35  Sun Aug  9 16:21:08 2026
+++ pkgsrc/devel/py-mako/distinfo       Mon Sep 28 15:37:03 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.35 2026/08/09 16:21:08 wiz Exp $
+$NetBSD: distinfo,v 1.36 2026/09/28 15:37:03 wiz Exp $
 
-BLAKE2s (mako-1.4.1.tar.gz) = c3359b13a439353aaf263282b6ee421777a2573c22269139449619f10cf8d193
-SHA512 (mako-1.4.1.tar.gz) = 5129ff5335dc2b5d90941905b6b4de12bbba766a5ad91032a4adf362428e71e48e11998ead598d9f19140e7a1f4f84be91a02cfa47b7a8933f23a6c1ffda658e
-Size (mako-1.4.1.tar.gz) = 410165 bytes
+BLAKE2s (mako-1.4.3.tar.gz) = 03287000e66567e7238db8522d41ececbcd5174aca981acd07f9fcc267c50d19
+SHA512 (mako-1.4.3.tar.gz) = 2b35c28c64c57dc55d9ecf792b497c7834e3871b63f72daba37d730aeaaa070fe4d37b6a0ef2ab590eb978340d17b3fb9a6f02e093a600eb9cd2d9d5b9dff258
+Size (mako-1.4.3.tar.gz) = 412799 bytes