CVS commit: [pkgsrc-2026Q1] pkgsrc/devel/ruby-redmine60

["Maya Rashish" <maya%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   maya
Date:           Tue Mar 31 13:07:12 UTC 2026

Modified Files:
        pkgsrc/devel/ruby-redmine60 [pkgsrc-2026Q1]: Makefile PLIST distinfo
        pkgsrc/devel/ruby-redmine60/patches [pkgsrc-2026Q1]: patch-Gemfile

Log Message:
Pullup ticket #7064 - requested by taca
devel/ruby-redmine60: Security fix

Revisions pulled up:
- devel/ruby-redmine60/Makefile                                 1.13
- devel/ruby-redmine60/PLIST                                    1.7
- devel/ruby-redmine60/distinfo                                 1.9
- devel/ruby-redmine60/patches/patch-Gemfile                    1.7

---
   Module Name: pkgsrc
   Committed By:        taca
   Date:                Sun Mar 29 13:59:32 UTC 2026

   Modified Files:
        pkgsrc/devel/ruby-redmine60: Makefile PLIST distinfo
        pkgsrc/devel/ruby-redmine60/patches: patch-Gemfile

   Log Message:
   devel/ruby-redmine60: update to 6.0.9

   6.0.9 (2026-03-16)

   This release contains security fixes.

   [Code cleanup/refactoring]

   * Patch #43872: Update GitHub Actions workflow dependencies

   [Database]

   * Patch #43668: Serialize address limit checks during email_addresses#create

   [Issues]

   * Feature #43837: Add a hint to the issue relation add form that clarifies
     multiple comma-separated issue IDs are accepted

   [Issues filter]

   * Patch #43736: author.group filter test fix

   [Issues list]

   * Defect #31972: An empty group_count badge is displayed when grouped with
     created_on

   [Permissions and roles]

   * Feature #43659: Set minimum width for Permission column in permission
     report

   [Security]

   * Defect #43661: Unsafe eval usage in AttachmentsHelper
   * Defect #43690: Directory Traversal via Backslash-Separated Paths in
     Filesystem SCM
   * Defect #43691: DOM (Stored) XSS in @mention autocomplete via unescaped
     user name
   * Defect #43692: LDAP Injection (Unescaped Input in LDAP Search Filter)
   * Defect #43694: DOM XSS: HTML Injection via Custom Field Name in Query
     Filter Generation
   * Defect #43830: User who is allowed to view only their own time entries can
     retrieve other users' time entry details by directly specifying the
     TimeEntry ID via the REST API
   * Defect #43840: Update Nokogiri to 1.19.1

   [Text formatting]

   * Defect #40918: Wiki "Edit this section" does not extract SeText headings
     correctly in CommonMark Markdown

   [UI]

   * Defect #43804: Custom field preview does not work on bulk issue edit
   * Defect #43869: Default assignee selected by category is not shown in UI


To generate a diff of this commit:
cvs rdiff -u -r1.12 -r1.12.2.1 pkgsrc/devel/ruby-redmine60/Makefile
cvs rdiff -u -r1.6 -r1.6.2.1 pkgsrc/devel/ruby-redmine60/PLIST
cvs rdiff -u -r1.8 -r1.8.2.1 pkgsrc/devel/ruby-redmine60/distinfo
cvs rdiff -u -r1.6 -r1.6.2.1 \
    pkgsrc/devel/ruby-redmine60/patches/patch-Gemfile

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/ruby-redmine60/Makefile
diff -u pkgsrc/devel/ruby-redmine60/Makefile:1.12 pkgsrc/devel/ruby-redmine60/Makefile:1.12.2.1
--- pkgsrc/devel/ruby-redmine60/Makefile:1.12   Wed Feb 11 07:51:14 2026
+++ pkgsrc/devel/ruby-redmine60/Makefile        Tue Mar 31 13:07:12 2026
@@ -1,8 +1,7 @@
-# $NetBSD: Makefile,v 1.12 2026/02/11 07:51:14 taca Exp $
+# $NetBSD: Makefile,v 1.12.2.1 2026/03/31 13:07:12 maya Exp $
 
 DISTNAME=      redmine-${RM_VERSION}
 PKGNAME=       ${RUBY_PKGPREFIX}-${DISTNAME:S/redmine/redmine${RM_VER}/}
-PKGREVISION=   1
 CATEGORIES=    devel
 MASTER_SITES=  https://www.redmine.org/releases/
 
@@ -11,7 +10,7 @@ HOMEPAGE=     https://www.redmine.org/
 COMMENT=       Flexible project management web application
 LICENSE=       gnu-gpl-v2 # and so on.
 
-RM_VERSION=    6.0.8
+RM_VERSION=    6.0.9
 
 NO_BUILD=      yes
 

Index: pkgsrc/devel/ruby-redmine60/PLIST
diff -u pkgsrc/devel/ruby-redmine60/PLIST:1.6 pkgsrc/devel/ruby-redmine60/PLIST:1.6.2.1
--- pkgsrc/devel/ruby-redmine60/PLIST:1.6       Wed Feb 11 07:51:14 2026
+++ pkgsrc/devel/ruby-redmine60/PLIST   Tue Mar 31 13:07:12 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.6 2026/02/11 07:51:14 taca Exp $
+@comment $NetBSD: PLIST,v 1.6.2.1 2026/03/31 13:07:12 maya Exp $
 bin/redmine60_generate_secret_token${RUBY_SUFFIX}.sh
 bin/redmine60_load_default_data${RUBY_SUFFIX}.sh
 bin/redmine60_migrate_db${RUBY_SUFFIX}.sh
@@ -1998,6 +1998,7 @@ ${RM_DIR}/test/system/issues_test.rb
 ${RM_DIR}/test/system/keyboard_shortcuts_test.rb
 ${RM_DIR}/test/system/messages_test.rb
 ${RM_DIR}/test/system/my_page_test.rb
+${RM_DIR}/test/system/query_test.rb
 ${RM_DIR}/test/system/quick_jump_test.rb
 ${RM_DIR}/test/system/repositories_test.rb
 ${RM_DIR}/test/system/sudo_mode_test.rb

Index: pkgsrc/devel/ruby-redmine60/distinfo
diff -u pkgsrc/devel/ruby-redmine60/distinfo:1.8 pkgsrc/devel/ruby-redmine60/distinfo:1.8.2.1
--- pkgsrc/devel/ruby-redmine60/distinfo:1.8    Wed Feb 11 07:51:14 2026
+++ pkgsrc/devel/ruby-redmine60/distinfo        Tue Mar 31 13:07:12 2026
@@ -1,9 +1,9 @@
-$NetBSD: distinfo,v 1.8 2026/02/11 07:51:14 taca Exp $
+$NetBSD: distinfo,v 1.8.2.1 2026/03/31 13:07:12 maya Exp $
 
-BLAKE2s (redmine-6.0.8.tar.gz) = 0273e56a7df7e0edc093fbad6174c38e71aa09236b8ce32a650ce7ecb6c4282b
-SHA512 (redmine-6.0.8.tar.gz) = c0005a8cf7f8208a96a77b81820bb4520ca69d24692248f02e36c225c53b84b11d84f1bc56e227064d956c371426a85f0f9f5f3676f5a189f984b58a429cd75a
-Size (redmine-6.0.8.tar.gz) = 4070190 bytes
-SHA1 (patch-Gemfile) = e1c60b6da33cb638018ef5215955e15753912ccc
+BLAKE2s (redmine-6.0.9.tar.gz) = 3dd4faac2b149ee412761345888bf22105ef30e7b17904b6d3dca3396a0d5bf5
+SHA512 (redmine-6.0.9.tar.gz) = 00ed51a94e3c5b0d2fe118c42f83e00dd06d4a72f0e450a7cc8ef1e68fe628afcbcd0ea82b9108469cb5ef99b35e18bb12bfa5d183dad133f283ce42fe8cf19f
+Size (redmine-6.0.9.tar.gz) = 4071535 bytes
+SHA1 (patch-Gemfile) = 732fd64023ffe871b0fbe2a4f2e9b12fb11e3db0
 SHA1 (patch-config_additional__environment.rb.example) = 7ad913800c5f31fdd9b71aa92294bdbeea7b77fe
 SHA1 (patch-lib_redmine_scm_adapters_mercurial_redminehelper.py) = 87db1005896b2a962b8b93ec5b5b7d313ae6f691
 SHA1 (patch-lib_tasks_initializers.rake) = d5ccb73cff6baedee9dfbe7563e25925f1ff9d85

Index: pkgsrc/devel/ruby-redmine60/patches/patch-Gemfile
diff -u pkgsrc/devel/ruby-redmine60/patches/patch-Gemfile:1.6 pkgsrc/devel/ruby-redmine60/patches/patch-Gemfile:1.6.2.1
--- pkgsrc/devel/ruby-redmine60/patches/patch-Gemfile:1.6       Wed Feb 11 07:51:14 2026
+++ pkgsrc/devel/ruby-redmine60/patches/patch-Gemfile   Tue Mar 31 13:07:12 2026
@@ -1,11 +1,11 @@
-$NetBSD: patch-Gemfile,v 1.6 2026/02/11 07:51:14 taca Exp $
+$NetBSD: patch-Gemfile,v 1.6.2.1 2026/03/31 13:07:12 maya Exp $
 
 * Relax dependency.
 * Do not load gem for developemt and test.
 
---- Gemfile.orig       2026-01-06 02:25:03.000000000 +0000
+--- Gemfile.orig       2026-03-17 07:40:04.000000000 +0000
 +++ Gemfile
-@@ -2,26 +2,26 @@ source 'https://rubygems.org'
+@@ -2,7 +2,7 @@ source 'https://rubygems.org'
  
  ruby '>= 3.1.0', '< 3.4.0'
  
@@ -14,11 +14,7 @@ $NetBSD: patch-Gemfile,v 1.6 2026/02/11 
  gem 'rouge', '~> 4.5'
  gem 'mini_mime', '~> 1.1.0'
  gem "actionpack-xml_parser"
- gem 'roadie-rails', '~> 3.2.0'
- gem 'marcel'
- gem 'mail', '~> 2.8.1'
--gem 'nokogiri', '~> 1.18.3'
-+gem 'nokogiri', '>= 1.18.3'
+@@ -13,15 +13,15 @@ gem 'nokogiri', Gem.ruby_version >= Gem:
  gem 'i18n', '~> 1.14.1'
  gem 'rbpdf', '~> 1.21.4'
  gem 'addressable'
@@ -30,11 +26,11 @@ $NetBSD: patch-Gemfile,v 1.6 2026/02/11 
  #  Ruby Standard Gems
 -gem 'csv', '~> 3.2.8'
 -gem 'net-imap', '~> 0.4.20'
-+gem 'csv', '>=3.2.8'
-+gem 'net-imap', '>=0.4.20'
++gem 'csv', '>= 3.2.8'
++gem 'net-imap', '>= 0.4.20'
  gem 'net-pop', '~> 0.1.2'
 -gem 'net-smtp', '~> 0.4.0'
-+gem 'net-smtp', '>=0.4.0'
++gem 'net-smtp', '>= 0.4.0'
  
  # Windows does not include zoneinfo files, so bundle the tzinfo-data gem
  gem 'tzinfo-data', platforms: [:mingw, :x64_mingw, :mswin]