CVS commit: pkgsrc/www/ruby-http

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Tue Jul 21 14:04:43 UTC 2026

Modified Files:
        pkgsrc/www/ruby-http: Makefile distinfo

Log Message:
www/ruby-http: update to 6.0.4

6.0.4 -(2026-07-14)

Fixed

* On Ruby 3.4+ with TCPSocket, the redundant Timeout.timeout wrap around
  socket-level connect_timeout is removed.  The native timeout is used
  alone, which avoids a slow Thread leak from Timeout::Request retention
  under abnormal exit paths (see #542).  On Ruby 3.2/3.3 and with custom
  socket classes the previous Timeout.timeout wrap is preserved.

Security

* HTTP::Request::Builder#make_request_uri now rejects protocol-relative
  inputs (//host/path) when resolving against a configured base_uri or
  persistent origin.  Previously such inputs were treated as network-path
  references per RFC 3986 §5.2 and replaced the base authority — via
  URI#join on the base_uri branch and via string concatenation on the
  persistent branch — allowing an attacker who controlled the path argument
  to redirect the request to an arbitrary host and leak any
  connection-scoped headers (HTTP.auth(...), etc.). See GHSA-r98x-p6m8-xcrv
  for details.


To generate a diff of this commit:
cvs rdiff -u -r1.20 -r1.21 pkgsrc/www/ruby-http/Makefile
cvs rdiff -u -r1.22 -r1.23 pkgsrc/www/ruby-http/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/ruby-http/Makefile
diff -u pkgsrc/www/ruby-http/Makefile:1.20 pkgsrc/www/ruby-http/Makefile:1.21
--- pkgsrc/www/ruby-http/Makefile:1.20  Tue May  5 13:44:56 2026
+++ pkgsrc/www/ruby-http/Makefile       Tue Jul 21 14:04:43 2026
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.20 2026/05/05 13:44:56 taca Exp $
+# $NetBSD: Makefile,v 1.21 2026/07/21 14:04:43 taca Exp $
 #
 
-DISTNAME=      http-6.0.3
+DISTNAME=      http-6.0.4
 CATEGORIES=    www
 
 MAINTAINER=    pkgsrc-users%NetBSD.org@localhost

Index: pkgsrc/www/ruby-http/distinfo
diff -u pkgsrc/www/ruby-http/distinfo:1.22 pkgsrc/www/ruby-http/distinfo:1.23
--- pkgsrc/www/ruby-http/distinfo:1.22  Tue May  5 13:44:56 2026
+++ pkgsrc/www/ruby-http/distinfo       Tue Jul 21 14:04:43 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.22 2026/05/05 13:44:56 taca Exp $
+$NetBSD: distinfo,v 1.23 2026/07/21 14:04:43 taca Exp $
 
-BLAKE2s (http-6.0.3.gem) = f227d9146f6a5a370d1bdc1247ae19a88a1d912e9e1ddb1fe536cf8bbe4f8bce
-SHA512 (http-6.0.3.gem) = 5527b7d853b25a6f247b387dbb63907c94e7da3777ce26b32792cf895f8bff2752bd8bfe840182c7ec81a2df678e917bc534f4f173ee9da8c466ad8086156163
-Size (http-6.0.3.gem) = 78336 bytes
+BLAKE2s (http-6.0.4.gem) = 10c39cf805634eeec9b68678b98559f112cbf67509703ea0d50c32f11312681b
+SHA512 (http-6.0.4.gem) = 363ac49b2b95186917e6f3fa48228c1b2644d4869496d3abe5afeb8f518333b00a31330594c4ba4c48161cba6e0b7ace58d234a5aecee45942752122e0d73afe
+Size (http-6.0.4.gem) = 78848 bytes