CVS commit: pkgsrc/devel/pcre2

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Tue Sep 29 05:55:04 UTC 2026

Modified Files:
        pkgsrc/devel/pcre2: Makefile distinfo

Log Message:
pcre2: update to 10.49.

Version 10.49 28-September-2026
-------------------------------

1. (GHSA-r9hj-j2rw-4q3m) Security fix to prevent an out-of-bounds write with
arbitrary data. Applications are only affected if using the
pcre2_jit_stack_create() and pcre2_jit_stack_assign() APIs to provide a growable
JIT stack, and then matching against a pattern with unusually high JIT stack
usage, such as a large number of capturing groups.

The implications of an out-of-bounds write could include arbitrary code
execution.

The issue is not a regression and affects releases 10.48 and earlier.


To generate a diff of this commit:
cvs rdiff -u -r1.35 -r1.36 pkgsrc/devel/pcre2/Makefile
cvs rdiff -u -r1.31 -r1.32 pkgsrc/devel/pcre2/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/pcre2/Makefile
diff -u pkgsrc/devel/pcre2/Makefile:1.35 pkgsrc/devel/pcre2/Makefile:1.36
--- pkgsrc/devel/pcre2/Makefile:1.35    Sun Sep 27 10:34:45 2026
+++ pkgsrc/devel/pcre2/Makefile Tue Sep 29 05:55:04 2026
@@ -1,11 +1,10 @@
-# $NetBSD: Makefile,v 1.35 2026/09/27 10:34:45 tnn Exp $
+# $NetBSD: Makefile,v 1.36 2026/09/29 05:55:04 wiz Exp $
 #
 # NOTE: basically every update will require a recursive bump,
 # otherwise you'll see errors like:
 # /usr/lib/libpcre2-8.so.0: version PCRE2_10.47 required by /usr/lib/libglib-2.0.so.0 not defined
 
-DISTNAME=      pcre2-10.48
-PKGREVISION=   1
+DISTNAME=      pcre2-10.49
 CATEGORIES=    devel
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=PhilipHazel/}
 GITHUB_RELEASE=        ${DISTNAME}

Index: pkgsrc/devel/pcre2/distinfo
diff -u pkgsrc/devel/pcre2/distinfo:1.31 pkgsrc/devel/pcre2/distinfo:1.32
--- pkgsrc/devel/pcre2/distinfo:1.31    Sun Sep 27 10:34:45 2026
+++ pkgsrc/devel/pcre2/distinfo Tue Sep 29 05:55:04 2026
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.31 2026/09/27 10:34:45 tnn Exp $
+$NetBSD: distinfo,v 1.32 2026/09/29 05:55:04 wiz Exp $
 
-BLAKE2s (pcre2-10.48.tar.gz) = fac788212a947345cb441020b11affc6a025dfb7270151359e15d81353b9442a
-SHA512 (pcre2-10.48.tar.gz) = 7682828c8bf512406f3f1bff773830416e55750bec1cf4bb39a1238f5a61026df71817dbd2dd0fcd72a76fcfb15d7b386a64739b33ad99bad77170652248fa35
-Size (pcre2-10.48.tar.gz) = 2887260 bytes
+BLAKE2s (pcre2-10.49.tar.gz) = d00d7ef4d076667d90150fc2e4e8cb419d893b4d61d5aac73a9b326db7143c65
+SHA512 (pcre2-10.49.tar.gz) = 6cfd9f824837078bea959ea89c1494950987892ec9b8546691b1aa94fde37c60429c4711c55f9a629c8a6a86bb6ebae738b3a0ebf6e42c70ab008ec6c394aca0
+Size (pcre2-10.49.tar.gz) = 2880625 bytes
 SHA1 (patch-configure) = 9069921c895a57ad072f7c1564f34b173a144d63