CVS commit: pkgsrc/textproc/p5-YAML-Syck

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Fri Jul 17 06:14:44 UTC 2026

Modified Files:
        pkgsrc/textproc/p5-YAML-Syck: Makefile distinfo

Log Message:
p5-YAML-Syck: update to 1.47.

1.47 Jul 13 2026

  [Security]
  - Fix four libsyck memory-safety CVEs reachable from the default
    YAML::Syck::Load() path on untrusted input with no special flags
    (reported by Paul Johnson via CPANSec, PR #213):
    - CVE-2026-57075 (CWE-125): out-of-bounds read in the base64 decoder
      caused by signed-char indexing of the decode table on !!binary input
    - CVE-2026-57076 (CWE-416): use-after-free of an anchor key string
      shared between the node and the anchors table
    - CVE-2026-57077 (CWE-125): one-byte out-of-bounds read in the lexer
      newline scan during block-scalar parsing (incomplete-fix follow-on
      to CVE-2025-11683)
    - CVE-2026-13713 (CWE-416/CWE-415): use-after-free / double-free of an
      anchor node on anchor redefinition, a remote-crash DoS from a
      7-byte input
  - Harden syck_base64dec() to bounds-check each read so it cannot run past
    a non-NUL-terminated input buffer (defense-in-depth for callers passing
    raw buffers; PR #213)

  [Bug Fixes]
  - Fix: enforce $MaxDepth on Load to prevent C-stack exhaustion from
    deeply nested YAML/JSON input; YAML::Syck and JSON::Syck Load now
    default to 512, matching Dump (PR #204)
  - Fix: emit YAML canonical forms (.nan, .inf, -.inf) for NaN/Inf values
    in Dump so they roundtrip with ImplicitTyping instead of reloading as
    plain strings (PR #201)

  [Maintenance]
  - CI: add an AddressSanitizer job that builds the XS with
    -fsanitize=address and runs the suite plus the CVE trigger inputs to
    catch libsyck memory-safety defects; de-pin the libasan version so it
    tracks the runner's GCC (PR #213)

1.46 May 24 2026

  [Bug Fixes]
  - Fix: preserve string nature of numeric-looking values in Dump; pure
    strings (POK only, no IOK/NOK) are now quoted to maintain roundtrip
    fidelity (GH #199, PR #200)
  - Fix: accept trailing commas in flow sequences and mappings
    ([a, b,] and {a: 1,}), valid per YAML 1.0/1.1/1.2 spec
    (GH #195, PR #196)

  [Maintenance]
  - CI: upgrade install-with-cpm to v2 for compatibility with Perl
    versions prior to 5.24 in perldocker containers (GH #197, PR #198)
  - Clean up MANIFEST.SKIP: add #!include_default, remove redundant
    entries, exclude .claude/ from distribution


To generate a diff of this commit:
cvs rdiff -u -r1.42 -r1.43 pkgsrc/textproc/p5-YAML-Syck/Makefile
cvs rdiff -u -r1.23 -r1.24 pkgsrc/textproc/p5-YAML-Syck/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/textproc/p5-YAML-Syck/Makefile
diff -u pkgsrc/textproc/p5-YAML-Syck/Makefile:1.42 pkgsrc/textproc/p5-YAML-Syck/Makefile:1.43
--- pkgsrc/textproc/p5-YAML-Syck/Makefile:1.42  Thu Jul 16 19:05:30 2026
+++ pkgsrc/textproc/p5-YAML-Syck/Makefile       Fri Jul 17 06:14:44 2026
@@ -1,8 +1,7 @@
-# $NetBSD: Makefile,v 1.42 2026/07/16 19:05:30 wiz Exp $
+# $NetBSD: Makefile,v 1.43 2026/07/17 06:14:44 wiz Exp $
 
-DISTNAME=      YAML-Syck-1.45
+DISTNAME=      YAML-Syck-1.47
 PKGNAME=       p5-${DISTNAME}
-PKGREVISION=   1
 CATEGORIES=    textproc perl5
 MASTER_SITES=  ${MASTER_SITE_PERL_CPAN:=../../authors/id/T/TO/TODDR/}
 
@@ -14,5 +13,8 @@ LICENSE=      mit AND 2-clause-bsd
 PERL5_PACKLIST=                auto/YAML/Syck/.packlist
 PERL5_MODULE_TYPE=     Module::Install::Bundled
 
+# https://github.com/cpan-authors/YAML-Syck/issues/218
+EXTRACT_USING= gtar
+
 .include "../../lang/perl5/module.mk"
 .include "../../mk/bsd.pkg.mk"

Index: pkgsrc/textproc/p5-YAML-Syck/distinfo
diff -u pkgsrc/textproc/p5-YAML-Syck/distinfo:1.23 pkgsrc/textproc/p5-YAML-Syck/distinfo:1.24
--- pkgsrc/textproc/p5-YAML-Syck/distinfo:1.23  Tue May 12 18:35:42 2026
+++ pkgsrc/textproc/p5-YAML-Syck/distinfo       Fri Jul 17 06:14:44 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.23 2026/05/12 18:35:42 wiz Exp $
+$NetBSD: distinfo,v 1.24 2026/07/17 06:14:44 wiz Exp $
 
-BLAKE2s (YAML-Syck-1.45.tar.gz) = 168d225b3aab55af244c876c8c2c306c07ab44031ba7c5525ffa260bcead35f4
-SHA512 (YAML-Syck-1.45.tar.gz) = ed719ef609c1a3f938cee8e03b41a989805d7681ba7e44bc6326162c285ff542fce77f3f3ea3ba6e576ad1a9bfa762b7af8cf009041ed312f5bd01b5635d125a
-Size (YAML-Syck-1.45.tar.gz) = 264328 bytes
+BLAKE2s (YAML-Syck-1.47.tar.gz) = 119db0a83da527c15a27d35d2ed19a09776d07fa4fb03b233d137aba9e618428
+SHA512 (YAML-Syck-1.47.tar.gz) = 7f1f37a18063716630f785599e82ebd43747f842775300f3a5f8e69d4261f3a9f69d88e232b55fb1ad61c5c29c7e6b6512cca9b2a3c4f66cf6f9e93947a2f63f
+Size (YAML-Syck-1.47.tar.gz) = 270328 bytes