CVS commit: pkgsrc/devel/pcre2

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Tue Sep  1 08:59:33 UTC 2026

Modified Files:
        pkgsrc/devel/pcre2: Makefile PLIST distinfo

Log Message:
pcre2: updated to 10.48

10.48 31-August-2026

This is a regular release, incorporating security fixes along with small
improvements and fixes to library behaviour.

Only changes to behaviour, changes to the API, and other significant changes
are described here. Please see the ChangeLog and Git log for further details.

As well as the tarball and Git tag for this release, there are detailed
instructions for backporting security and correctness fixes, for the last
five years of releases.

* (Git change) Renamed the default development branch from master to main.

* (Maintenance change) Added a five-year support lifecycle policy and
publication of backport patches for security and high-severity fixes in older
releases.

* (Security fix for very specific API usage, GHSA-2p8c-ff85-vh9x) If
pcre2_jit_compile() is called with options for some match modes, and then
pcre2_match() is used to perform a match for a different match mode, an
out-of-bounds read can occur if the match is attempted against invalid UTF input.

* (Security fix for pattern conversion, GHSA-q8g2-wprr-34m9) If pcre2_convert()
is called on untrusted input on platforms with 32-bit size_t, an out-of-bounds
heap write can occur.

* (Security fix, GHSA-3r4p-g7gg-ppmf) Fixed an out-of-bounds write in DFA
matching when using a heap limit; also fixed possible integer overflows which
could cause under-allocation of the workspace.

* (Security fix, GHSA-fmgr-6ggq-9859) Added bounds checks for several integer
overflows while compiling patterns on 32-bit CPUs, which could cause
under-allocation followed by out-of-bounds writes.

* (Security fix, GHSA-9qww-pwc4-77qq) Applied lower buffer bound to prevent
two out-of-bounds reads while scanning backwards through invalid UTF data with
PCRE2_MATCH_INVALID_UTF.

* (Matching correctness) Fixed several matching issues:
  - A JIT-specific matching bug affecting prefix scanning on patterns with
    repeats.
  - A JIT-specific matching bug in variable-length lookbehinds.
  - Miscompiled Unicode character classes combining characters at or below
    U+00FF with characters at U+0100 and U+8000 or above.
  - Incorrect JIT character advancement with PCRE2_MATCH_INVALID_UTF in UTF-8
    and UTF-16 modes, which could skip adjacent characters.

* (Behaviour change) Updated Unicode support to Unicode 17.0.

* (Small behaviour changes) Many small fixes, including pcre2_substitute()
improvements, optimisation of possessive backreference matching, and
pcre2_compile() fixes.

* (Small build changes) Many small adjustments to the CMake and Zig builds.

* (Security fix for very specific API usage. Fixed a leak and later
invalid free when calling the fast-path pcre2_jit_match() function with a match
data object previously used with pcre2_match() and
PCRE2_COPY_MATCHED_SUBJECT.

* (Low-severity security fix, GHSA-q7rw-r7qq-2hx6) Fixed exposure of two
uninitialised bytes from malloc() via pcre2_serialize_encode().


To generate a diff of this commit:
cvs rdiff -u -r1.32 -r1.33 pkgsrc/devel/pcre2/Makefile
cvs rdiff -u -r1.13 -r1.14 pkgsrc/devel/pcre2/PLIST
cvs rdiff -u -r1.29 -r1.30 pkgsrc/devel/pcre2/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/pcre2/Makefile
diff -u pkgsrc/devel/pcre2/Makefile:1.32 pkgsrc/devel/pcre2/Makefile:1.33
--- pkgsrc/devel/pcre2/Makefile:1.32    Wed Oct 22 06:40:26 2025
+++ pkgsrc/devel/pcre2/Makefile Tue Sep  1 08:59:33 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.32 2025/10/22 06:40:26 adam Exp $
+# $NetBSD: Makefile,v 1.33 2026/09/01 08:59:33 adam Exp $
 
-DISTNAME=      pcre2-10.47
+DISTNAME=      pcre2-10.48
 CATEGORIES=    devel
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=PhilipHazel/}
 GITHUB_RELEASE=        ${DISTNAME}

Index: pkgsrc/devel/pcre2/PLIST
diff -u pkgsrc/devel/pcre2/PLIST:1.13 pkgsrc/devel/pcre2/PLIST:1.14
--- pkgsrc/devel/pcre2/PLIST:1.13       Wed Oct 22 06:40:26 2025
+++ pkgsrc/devel/pcre2/PLIST    Tue Sep  1 08:59:33 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.13 2025/10/22 06:40:26 adam Exp $
+@comment $NetBSD: PLIST,v 1.14 2026/09/01 08:59:33 adam Exp $
 bin/pcre2-config
 bin/pcre2grep
 bin/pcre2test
@@ -119,6 +119,7 @@ share/doc/pcre2/LICENCE.md
 share/doc/pcre2/NEWS
 share/doc/pcre2/README
 share/doc/pcre2/SECURITY.md
+share/doc/pcre2/SUPPORT-LIFECYCLE.md
 share/doc/pcre2/html/NON-AUTOTOOLS-BUILD.txt
 share/doc/pcre2/html/README.txt
 share/doc/pcre2/html/index.html

Index: pkgsrc/devel/pcre2/distinfo
diff -u pkgsrc/devel/pcre2/distinfo:1.29 pkgsrc/devel/pcre2/distinfo:1.30
--- pkgsrc/devel/pcre2/distinfo:1.29    Wed Oct 22 06:40:26 2025
+++ pkgsrc/devel/pcre2/distinfo Tue Sep  1 08:59:33 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.29 2025/10/22 06:40:26 adam Exp $
+$NetBSD: distinfo,v 1.30 2026/09/01 08:59:33 adam Exp $
 
-BLAKE2s (pcre2-10.47.tar.gz) = 9064b84ccf6d6f451384070ff9dd04d516492745d832f1531dc15539ee0064e5
-SHA512 (pcre2-10.47.tar.gz) = e461a95f623fe70136b1a070847f317c56f9a31801181cc8fd7eef8077ae6cccd385d5ccb983f6e9b49245830535e7acddb10c6831c20afb9bdf4f9a45ae48eb
-Size (pcre2-10.47.tar.gz) = 2792969 bytes
+BLAKE2s (pcre2-10.48.tar.gz) = fac788212a947345cb441020b11affc6a025dfb7270151359e15d81353b9442a
+SHA512 (pcre2-10.48.tar.gz) = 7682828c8bf512406f3f1bff773830416e55750bec1cf4bb39a1238f5a61026df71817dbd2dd0fcd72a76fcfb15d7b386a64739b33ad99bad77170652248fa35
+Size (pcre2-10.48.tar.gz) = 2887260 bytes