CVS commit: pkgsrc/lang

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Sat Jul 18 14:09:03 UTC 2026

Modified Files:
        pkgsrc/lang/ruby: rubyversion.mk
        pkgsrc/lang/ruby33: Makefile PLIST distinfo
Removed Files:
        pkgsrc/lang/ruby33/patches: patch-lib_erb.rb patch-lib_erb_version.rb
            patch-test_erb_test__erb.rb

Log Message:
lang/ruby33: update to 3.3.12

pkgsrc change: stop installing obsolete ChangeLog.

Note: erb's security problem was already fixed with ruby33-3.3.11nb2.

3.3.12 (2026-07-16)

What's Changed

This release includes the following security fixes.

* CVE-2026-41316: ERB @_init deserialization guard bypass via def_module /
  def_method / def_class

This release updates the default gem erb to 4.0.3.1 and the bundled gem
net-imap to 0.4.25.  The net-imap update fixes CVE-2026-42245,
CVE-2026-42246, CVE-2026-42256, CVE-2026-42257, CVE-2026-42258,
CVE-2026-47240, CVE-2026-47241 and CVE-2026-47242.  Please see the release
notes of net-imap v0.4.24 and net-imap v0.4.25 for the details of these
fixes.


To generate a diff of this commit:
cvs rdiff -u -r1.326 -r1.327 pkgsrc/lang/ruby/rubyversion.mk
cvs rdiff -u -r1.12 -r1.13 pkgsrc/lang/ruby33/Makefile
cvs rdiff -u -r1.10 -r1.11 pkgsrc/lang/ruby33/PLIST
cvs rdiff -u -r1.18 -r1.19 pkgsrc/lang/ruby33/distinfo
cvs rdiff -u -r1.1 -r0 pkgsrc/lang/ruby33/patches/patch-lib_erb.rb \
    pkgsrc/lang/ruby33/patches/patch-lib_erb_version.rb \
    pkgsrc/lang/ruby33/patches/patch-test_erb_test__erb.rb

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/ruby/rubyversion.mk
diff -u pkgsrc/lang/ruby/rubyversion.mk:1.326 pkgsrc/lang/ruby/rubyversion.mk:1.327
--- pkgsrc/lang/ruby/rubyversion.mk:1.326       Sat Jul 18 14:04:38 2026
+++ pkgsrc/lang/ruby/rubyversion.mk     Sat Jul 18 14:09:02 2026
@@ -1,4 +1,4 @@
-# $NetBSD: rubyversion.mk,v 1.326 2026/07/18 14:04:38 taca Exp $
+# $NetBSD: rubyversion.mk,v 1.327 2026/07/18 14:09:02 taca Exp $
 #
 
 # This file determines which Ruby version is used as a dependency for
@@ -212,7 +212,7 @@ RUBY_VERSION_REQD?= ${PKGNAME_REQD:C/rub
 .endif
 
 # current supported Ruby's version
-RUBY33_VERSION=                3.3.11
+RUBY33_VERSION=                3.3.12
 RUBY34_VERSION=                3.4.10
 RUBY40_VERSION=                4.0.6
 
@@ -308,7 +308,7 @@ RUBY_NET_PROTOCOL_VER=              0.2.2
 RUBY_NKF_VER=                  0.1.3
 RUBY_OBSERVER_VER=             0.1.2
 RUBY_OPEN3_VER=                        0.2.1
-RUBY_OPENSSL_VER=              3.2.2
+RUBY_OPENSSL_VER=              3.2.4
 RUBY_OPEN_URI_VER=             0.4.1
 RUBY_OPTPARSE_VER=             0.4.0
 RUBY_OSTRUCT_VER=              0.6.0
@@ -349,7 +349,7 @@ RUBY_DEBUG_VER=                     1.9.2
 RUBY_MATRIX_VER=               0.4.2
 RUBY_MINITEST_VER=             5.20.0
 RUBY_NET_FTP_VER=              0.3.4
-RUBY_NET_IMAP_VER=             0.4.21
+RUBY_NET_IMAP_VER=             0.4.25
 RUBY_NET_POP_VER=              0.1.2
 RUBY_NET_SMTP_VER=             0.5.1
 RUBY_POWER_ASSERT_VER=         2.0.3

Index: pkgsrc/lang/ruby33/Makefile
diff -u pkgsrc/lang/ruby33/Makefile:1.12 pkgsrc/lang/ruby33/Makefile:1.13
--- pkgsrc/lang/ruby33/Makefile:1.12    Tue May 19 14:45:52 2026
+++ pkgsrc/lang/ruby33/Makefile Sat Jul 18 14:09:03 2026
@@ -1,8 +1,7 @@
-# $NetBSD: Makefile,v 1.12 2026/05/19 14:45:52 taca Exp $
+# $NetBSD: Makefile,v 1.13 2026/07/18 14:09:03 taca Exp $
 
 DISTNAME=      ${RUBY_DISTNAME}
 PKGNAME=       ${RUBY_PKGPREFIX}-${RUBY_VERSION}
-PKGREVISION=   2
 CATEGORIES=    lang ruby
 MASTER_SITES=  ${MASTER_SITE_RUBY}
 
@@ -49,7 +48,7 @@ CFLAGS+=      -fno-ipa-modref
 .  endif
 .endif
 
-DOCS=          BSDL CONTRIBUTING.md COPYING COPYING.ja ChangeLog GPL \
+DOCS=          BSDL CONTRIBUTING.md COPYING COPYING.ja GPL \
                KNOWNBUGS.rb LEGAL NEWS.md README.ja.md README.md \
                README.EXT README.EXT.ja
 EXT_DOCS=      syslog/syslog.txt
@@ -87,9 +86,7 @@ pre-configure:
        ${CHMOD} -x ${WRKSRC}/sample/test.rb
 
 pre-install:
-#      cd ${WRKSRC}/lib; \
-#              ${FIND} . \( -name '*.orig' -o -name '*.orig_dist' \) \
-#              -exec ${RM} -f {} \;
+       ${RM} -fr ${WRKSRC}/doc/ChangeLog
 .for f in ${EMPTY_DIRS}
        ${RMDIR} ${WRKSRC}/lib/rdoc/${f} 2>/dev/null || ${TRUE}
 .endfor
@@ -100,7 +97,6 @@ post-install:
                        -o -name '*.o' -o -name 'gem_make.out' \
                        -o -name 'mkmf.log' \) -exec rm {} \;
        cd ${WRKSRC}/doc && ${PAX} -rw . ${DESTDIR}${PREFIX}/${RUBY_DOC}
-       ${MV} ${DESTDIR}${PREFIX}/${RUBY_DOC}/ChangeLog  ${DESTDIR}${PREFIX}/${RUBY_DOC}/ChangeLog.prev
 .for f in ${DOCS}
        ${INSTALL_DATA} ${WRKSRC}/${f} ${DESTDIR}${PREFIX}/${RUBY_DOC}
 .endfor

Index: pkgsrc/lang/ruby33/PLIST
diff -u pkgsrc/lang/ruby33/PLIST:1.10 pkgsrc/lang/ruby33/PLIST:1.11
--- pkgsrc/lang/ruby33/PLIST:1.10       Thu Mar 26 14:05:17 2026
+++ pkgsrc/lang/ruby33/PLIST    Sat Jul 18 14:09:03 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.10 2026/03/26 14:05:17 taca Exp $
+@comment $NetBSD: PLIST,v 1.11 2026/07/18 14:09:03 taca Exp $
 bin/bundle${RUBY_SUFFIX}
 bin/bundler${RUBY_SUFFIX}
 bin/erb${RUBY_SUFFIX}
@@ -2522,18 +2522,6 @@ ${RUBY_DOC}/BSDL
 ${RUBY_DOC}/CONTRIBUTING.md
 ${RUBY_DOC}/COPYING
 ${RUBY_DOC}/COPYING.ja
-${RUBY_DOC}/ChangeLog
-${RUBY_DOC}/ChangeLog.prev/ChangeLog-0.06_to_0.52
-${RUBY_DOC}/ChangeLog.prev/ChangeLog-0.50_to_0.60
-${RUBY_DOC}/ChangeLog.prev/ChangeLog-0.60_to_1.1
-${RUBY_DOC}/ChangeLog.prev/ChangeLog-1.8.0
-${RUBY_DOC}/ChangeLog.prev/ChangeLog-1.9.3
-${RUBY_DOC}/ChangeLog.prev/ChangeLog-2.0.0
-${RUBY_DOC}/ChangeLog.prev/ChangeLog-2.1.0
-${RUBY_DOC}/ChangeLog.prev/ChangeLog-2.2.0
-${RUBY_DOC}/ChangeLog.prev/ChangeLog-2.3.0
-${RUBY_DOC}/ChangeLog.prev/ChangeLog-2.4.0
-${RUBY_DOC}/ChangeLog.prev/ChangeLog-YARV
 ${RUBY_DOC}/GPL
 ${RUBY_DOC}/KNOWNBUGS.rb
 ${RUBY_DOC}/LEGAL

Index: pkgsrc/lang/ruby33/distinfo
diff -u pkgsrc/lang/ruby33/distinfo:1.18 pkgsrc/lang/ruby33/distinfo:1.19
--- pkgsrc/lang/ruby33/distinfo:1.18    Tue May 19 14:45:52 2026
+++ pkgsrc/lang/ruby33/distinfo Sat Jul 18 14:09:03 2026
@@ -1,14 +1,12 @@
-$NetBSD: distinfo,v 1.18 2026/05/19 14:45:52 taca Exp $
+$NetBSD: distinfo,v 1.19 2026/07/18 14:09:03 taca Exp $
 
-BLAKE2s (ruby-3.3.11.tar.xz) = 2a6996052aae975b7e3aa34849ae11efdb7fdbf8594c9f6cb9e7f0338c361c21
-SHA512 (ruby-3.3.11.tar.xz) = 1f8eb206a90121015b294dada7ea61ebd136e7e7dbb1c4bb7df21b85f359a2e733f438153bf07c57815a963e4ef3f766081fd4226caa6547f4c263b33ed7726e
-Size (ruby-3.3.11.tar.xz) = 15879844 bytes
+BLAKE2s (ruby-3.3.12.tar.xz) = 6f9811297c07bd766d7a79cbe6b9767be3373fdd461458779e1717bd346d270a
+SHA512 (ruby-3.3.12.tar.xz) = 1755901f5d1e66250e4f9f4e3a0bf31ec25055f1cb86fafc68281f6d108e9cf5329a6c74c221b1a31aa7de78e9c2d8aa7b76faf39acfce44c5ed94cf7e766f3f
+Size (ruby-3.3.12.tar.xz) = 15891224 bytes
 SHA1 (patch-common.mk) = c23eed58427b2fd4ba8fdb3692f609701a666c6d
 SHA1 (patch-configure) = 031792cb999e3624236f8afc3363492b437e35d7
 SHA1 (patch-ext_openssl_openssl__missing.h) = 3f8d79736fd14806dfaf76e333eec63ff3ff5890
 SHA1 (patch-include_ruby_internal_static__assert.h) = 7d5c3ae7ff674b9b34639924fcf08237164de9f8
-SHA1 (patch-lib_erb.rb) = f28a0318017b90409e71d4b80e0c2fd7faec07ae
-SHA1 (patch-lib_erb_version.rb) = 6704dceeb27d582c648fdaa3988ae3ea69607ffb
 SHA1 (patch-lib_mkmf.rb) = 4a3cd18548dbdf43a13695d4e76f817c0347e335
 SHA1 (patch-lib_rdoc_encoding.rb) = 0e82d2942d9bfcb67dc7c994889d7bc5ec2ae85a
 SHA1 (patch-lib_rdoc_parser_c.rb) = 063d1edd3f4b9416f759266edf1cf070f2f9faef
@@ -19,7 +17,6 @@ SHA1 (patch-lib_rubygems_dependency__ins
 SHA1 (patch-lib_rubygems_install__update__options.rb) = 0cd0816e1cd7c84c1dab1e091787c4dc38d28273
 SHA1 (patch-lib_rubygems_installer.rb) = 4ef74b4f79837a929e81bcd0e7eba9061a442304
 SHA1 (patch-lib_rubygems_platform.rb) = bde36a8fc1ba2fbf4d6fb8829bc116fb4d09b404
-SHA1 (patch-test_erb_test__erb.rb) = 4acc8a98f7051b05e2c7d0859068f2ca75bdbc20
 SHA1 (patch-test_rubygems_test__gem.rb) = 32f7c7d7f8a024c045d78c2bce93944fc3113d04
 SHA1 (patch-thread__pthread.c) = 7c1231933a2d6ce9d56891ab512371841697fbca
 SHA1 (patch-tool_ifchange) = 1814cd41f0b0a93b181799cb117bd1f57068cf33