CVS commit: [pkgsrc-2026Q3] pkgsrc/www/php-ja-wordpress

["Maya Rashish" <maya%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   maya
Date:           Wed Oct 21 00:23:21 UTC 2026

Modified Files:
        pkgsrc/www/php-ja-wordpress [pkgsrc-2026Q3]: Makefile distinfo

Log Message:
Pullup ticket #7289 - requested by taca
www/php-ja-wordpress: Security fix

Revisions pulled up:
- www/php-ja-wordpress/Makefile                                 1.39
- www/php-ja-wordpress/distinfo                                 1.35

---
   Module Name: pkgsrc
   Committed By:        taca
   Date:                Wed Oct  7 15:52:14 UTC 2026

   Modified Files:
        pkgsrc/www/php-ja-wordpress: Makefile distinfo

   Log Message:
   www/php-ja-wordpress: update to 7.0.7

   7.0.7 (2026-10-06)

   Security updates

   This release features one security fix. Because this is a security release,
   it is recommended that you update your sites immediately.

   The security team would like to thank the following people for responsibly
   reporting vulnerabilities, and allowing them to be fixed in this release:

   * A stored XSS on the Comments administration page, exploitable via pending
     comments, reported by Thomas Chauchefoin at Trail of Bits

   * A DoS issue in the WP_Http::make_absolute_url() method, reported by
     Anthropic

   * A second-Order SQL injection in WordPress WXR export, reported by
     Anthropic

   * A weakness allowing Author role users to sticky posts, reported by
     Anthropic

   * Unauthenticated disclosure of comments on private & unpublished posts,
     reported by Ananda Dhakal from Patchstack

   * Imgur embeds are vulnerable to XSS, reported by Zhengyu Liu, Jingcheng
     Yang, and Gavin Zhong

   * Forgeable parameters passed to the {status}_{type} hook can lead to action
     name collision, reported by Alex Concha of the WordPress security team


To generate a diff of this commit:
cvs rdiff -u -r1.37.2.1 -r1.37.2.2 pkgsrc/www/php-ja-wordpress/Makefile
cvs rdiff -u -r1.33.2.1 -r1.33.2.2 pkgsrc/www/php-ja-wordpress/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/php-ja-wordpress/Makefile
diff -u pkgsrc/www/php-ja-wordpress/Makefile:1.37.2.1 pkgsrc/www/php-ja-wordpress/Makefile:1.37.2.2
--- pkgsrc/www/php-ja-wordpress/Makefile:1.37.2.1       Fri Oct  2 12:48:51 2026
+++ pkgsrc/www/php-ja-wordpress/Makefile        Wed Oct 21 00:23:21 2026
@@ -1,10 +1,10 @@
-# $NetBSD: Makefile,v 1.37.2.1 2026/10/02 12:48:51 bsiegert Exp $
+# $NetBSD: Makefile,v 1.37.2.2 2026/10/21 00:23:21 maya Exp $
 #
 # when updating this, please run 'make upload'
 
 DISTNAME=              wordpress-${VERSION}-ja
 PKGNAME=               ${PHP_PKG_PREFIX}-ja-wordpress-${VERSION}
-VERSION=               7.0.6
+VERSION=               7.0.7
 CATEGORIES=            www
 MASTER_SITES=          https://ja.wordpress.org/
 

Index: pkgsrc/www/php-ja-wordpress/distinfo
diff -u pkgsrc/www/php-ja-wordpress/distinfo:1.33.2.1 pkgsrc/www/php-ja-wordpress/distinfo:1.33.2.2
--- pkgsrc/www/php-ja-wordpress/distinfo:1.33.2.1       Fri Oct  2 12:48:51 2026
+++ pkgsrc/www/php-ja-wordpress/distinfo        Wed Oct 21 00:23:21 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.33.2.1 2026/10/02 12:48:51 bsiegert Exp $
+$NetBSD: distinfo,v 1.33.2.2 2026/10/21 00:23:21 maya Exp $
 
-BLAKE2s (wordpress-7.0.6-ja.tar.gz) = 3583a6c3e1253659813cbc1c3a56d7c58af0fe5070fc84806e38bd26ccb331cb
-SHA512 (wordpress-7.0.6-ja.tar.gz) = 6c1a59aad445b2d3c6874a0514e07d95c3a7a3990d85836908455e31187d2ba1d7f60f841f090b352f144ca1dcb0197c8a13d4432087b2b3d4356ceec788ce45
-Size (wordpress-7.0.6-ja.tar.gz) = 36919266 bytes
+BLAKE2s (wordpress-7.0.7-ja.tar.gz) = f0821874866d05099363f01ea64c62d6d214351a5183e79452405f2ba06d0b49
+SHA512 (wordpress-7.0.7-ja.tar.gz) = 8e78a984eb20dbece1dec2b6b2d7aa0f85b17d72e399e1551b0c87cc6c0db305f0b9d8b8edd2a7786b91f3ec6dc953f413012fb33d9b237639b2857dede6cabb
+Size (wordpress-7.0.7-ja.tar.gz) = 36920800 bytes