CVS commit: pkgsrc/devel/ruby-redmine61

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Wed Sep  2 17:01:01 UTC 2026

Modified Files:
        pkgsrc/devel/ruby-redmine61: Makefile PLIST distinfo
        pkgsrc/devel/ruby-redmine61/patches: patch-Gemfile

Log Message:
develr/ruby-redmine61: update to 6.1.4

6.1.4 (2026-08-25)

Security fixes:

* Defect #44249: API requests can affect a user's session and circumvent
  security policies

* Defect #44308: Stored XSS in Redmine Textile Formatter via < notextile >
  Tag-Restoration ("Frankenstein tag")

* Defect #44309: Nested issue-relations endpoints bypass source issue
  visibility

* Defect #44310: Child project inherit_members updates bypass
  member-management authorization

* Patch #44371: Filter key parameter from logging


To generate a diff of this commit:
cvs rdiff -u -r1.6 -r1.7 pkgsrc/devel/ruby-redmine61/Makefile
cvs rdiff -u -r1.3 -r1.4 pkgsrc/devel/ruby-redmine61/PLIST \
    pkgsrc/devel/ruby-redmine61/distinfo
cvs rdiff -u -r1.3 -r1.4 pkgsrc/devel/ruby-redmine61/patches/patch-Gemfile

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/ruby-redmine61/Makefile
diff -u pkgsrc/devel/ruby-redmine61/Makefile:1.6 pkgsrc/devel/ruby-redmine61/Makefile:1.7
--- pkgsrc/devel/ruby-redmine61/Makefile:1.6    Tue Aug 11 15:54:57 2026
+++ pkgsrc/devel/ruby-redmine61/Makefile        Wed Sep  2 17:01:01 2026
@@ -1,8 +1,7 @@
-# $NetBSD: Makefile,v 1.6 2026/08/11 15:54:57 taca Exp $
+# $NetBSD: Makefile,v 1.7 2026/09/02 17:01:01 taca Exp $
 
 DISTNAME=      redmine-${RM_VERSION}
 PKGNAME=       ${RUBY_PKGPREFIX}-${DISTNAME:S/redmine/redmine${RM_VER}/}
-PKGREVISION=   1
 CATEGORIES=    devel
 MASTER_SITES=  https://www.redmine.org/releases/
 
@@ -11,7 +10,7 @@ HOMEPAGE=     https://www.redmine.org/
 COMMENT=       Flexible project management web application
 LICENSE=       gnu-gpl-v2 # and so on.
 
-RM_VERSION=    6.1.3
+RM_VERSION=    6.1.4
 
 NO_BUILD=      yes
 
@@ -34,7 +33,7 @@ DEPENDS+=     ${RUBY_PKGPREFIX}-actionpack-x
 DEPENDS+=      ${RUBY_PKGPREFIX}-roadie-rails33_${RUBY_RAILS}>=3.3.0<3.4:../../mail/ruby-roadie-rails33
 DEPENDS+=      ${RUBY_PKGPREFIX}-marcel>=1.0.0:../../devel/ruby-marcel
 DEPENDS+=      ${RUBY_PKGPREFIX}-mail>=2.8.1<2.9:../../mail/ruby-mail
-DEPENDS+=      ${RUBY_PKGPREFIX}-nokogiri>=1.18.3<1.20:../../textproc/ruby-nokogiri
+DEPENDS+=      ${RUBY_PKGPREFIX}-nokogiri>=1.19.1<1.20:../../textproc/ruby-nokogiri
 #DEPENDS+=     ${RUBY_PKGPREFIX}-i18n>=1.14.1:../../devel/ruby-i18n
 DEPENDS+=      ${RUBY_PKGPREFIX}-rbpdf>=1.21.4<1.22:../../print/ruby-rbpdf
 DEPENDS+=      ${RUBY_PKGPREFIX}-addressable>=0:../../net/ruby-addressable
@@ -51,7 +50,7 @@ DEPENDS+=     ${RUBY_PKGPREFIX}-requestjs-ra
 #
 DEPENDS+=      ${RUBY_PKGPREFIX}-rotp>=6.2.0:../../security/ruby-rotp
 DEPENDS+=      ${RUBY_PKGPREFIX}-rqrcode>=1.2.0:../../textproc/ruby-rqrcode
-DEPENDS+=      ${RUBY_PKGPREFIX}-html-pipeline>=2.13.2<3:../../textproc/ruby-html-pipeline
+DEPENDS+=      ${RUBY_PKGPREFIX}-html-pipeline>=2.13.2:../../textproc/ruby-html-pipeline
 DEPENDS+=      ${RUBY_PKGPREFIX}-sanitize>=6.0<7:../../textproc/ruby-sanitize
 DEPENDS+=      ${RUBY_PKGPREFIX}-net-ldap>=0.17.0:../../net/ruby-net-ldap
 DEPENDS+=      ${RUBY_PKGPREFIX}-mini-magick>=5.2.0:../../graphics/ruby-mini-magick

Index: pkgsrc/devel/ruby-redmine61/PLIST
diff -u pkgsrc/devel/ruby-redmine61/PLIST:1.3 pkgsrc/devel/ruby-redmine61/PLIST:1.4
--- pkgsrc/devel/ruby-redmine61/PLIST:1.3       Tue Jun 16 14:34:56 2026
+++ pkgsrc/devel/ruby-redmine61/PLIST   Wed Sep  2 17:01:01 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.3 2026/06/16 14:34:56 taca Exp $
+@comment $NetBSD: PLIST,v 1.4 2026/09/02 17:01:01 taca Exp $
 bin/redmine61_generate_secret_token${RUBY_SUFFIX}.sh
 bin/redmine61_load_default_data${RUBY_SUFFIX}.sh
 bin/redmine61_migrate_db${RUBY_SUFFIX}.sh
@@ -2089,6 +2089,7 @@ ${RM_DIR}/test/unit/jobs/destroy_project
 ${RM_DIR}/test/unit/jobs/destroy_projects_job_test.rb
 ${RM_DIR}/test/unit/journal_observer_test.rb
 ${RM_DIR}/test/unit/journal_test.rb
+${RM_DIR}/test/unit/lib/parameter_filtering_test.rb
 ${RM_DIR}/test/unit/lib/redmine/access_control_test.rb
 ${RM_DIR}/test/unit/lib/redmine/acts/mentionable_test.rb
 ${RM_DIR}/test/unit/lib/redmine/acts/positioned_with_scope_test.rb
Index: pkgsrc/devel/ruby-redmine61/distinfo
diff -u pkgsrc/devel/ruby-redmine61/distinfo:1.3 pkgsrc/devel/ruby-redmine61/distinfo:1.4
--- pkgsrc/devel/ruby-redmine61/distinfo:1.3    Tue Jun 16 14:34:56 2026
+++ pkgsrc/devel/ruby-redmine61/distinfo        Wed Sep  2 17:01:01 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.3 2026/06/16 14:34:56 taca Exp $
+$NetBSD: distinfo,v 1.4 2026/09/02 17:01:01 taca Exp $
 
-BLAKE2s (redmine-6.1.3.tar.gz) = 0bcd52773c9eb65b6c1d3cad8771dbf0345d081bcd904ba4676f27ca1292ba99
-SHA512 (redmine-6.1.3.tar.gz) = 68957c091e26e73c95a4d3d6c5665c9c5a3105ff1619ba8af6aaf55a086c710468bd043228b2dfbfc71139a923cc510165cbcfb76a069d2c4b1a1e0ad5d8ff64
-Size (redmine-6.1.3.tar.gz) = 4157946 bytes
-SHA1 (patch-Gemfile) = 9abd5975a93bc8dfb30c436a770491755749b54b
+BLAKE2s (redmine-6.1.4.tar.gz) = 2a093a88f2629fefc81ecce5e28b9f082d79a4466def6aba6c2392e53382dab1
+SHA512 (redmine-6.1.4.tar.gz) = 91a1afed9e7ed291fa67d173ababfc0483931185cc9ff508da6e87df7444d4b11c23a56cbd2e4068e9bb1e06987f621e6dc26688dca11cf85c1573b5b8d7f459
+Size (redmine-6.1.4.tar.gz) = 4163011 bytes
+SHA1 (patch-Gemfile) = acf569ee1103837c1526b36e07dc26c701d48097
 SHA1 (patch-config_additional__environment.rb.example) = 7ad913800c5f31fdd9b71aa92294bdbeea7b77fe
 SHA1 (patch-lib_tasks_initializers.rake) = d5ccb73cff6baedee9dfbe7563e25925f1ff9d85

Index: pkgsrc/devel/ruby-redmine61/patches/patch-Gemfile
diff -u pkgsrc/devel/ruby-redmine61/patches/patch-Gemfile:1.3 pkgsrc/devel/ruby-redmine61/patches/patch-Gemfile:1.4
--- pkgsrc/devel/ruby-redmine61/patches/patch-Gemfile:1.3       Tue Jun 16 14:34:56 2026
+++ pkgsrc/devel/ruby-redmine61/patches/patch-Gemfile   Wed Sep  2 17:01:01 2026
@@ -1,16 +1,16 @@
-$NetBSD: patch-Gemfile,v 1.3 2026/06/16 14:34:56 taca Exp $
+$NetBSD: patch-Gemfile,v 1.4 2026/09/02 17:01:01 taca Exp $
 
 * Relax dependency.
 * Do not load gem for developemt and test.
 
---- Gemfile.orig       2026-06-15 19:25:05.000000000 +0000
+--- Gemfile.orig       2026-08-26 06:25:03.000000000 +0000
 +++ Gemfile
 @@ -2,7 +2,7 @@ source 'https://rubygems.org'
  
  ruby '>= 3.2.0', '< 3.5.0'
  
--gem 'rails', '7.2.3.1'
-+gem 'rails', '~> 7.2.3.1'
+-gem 'rails', '7.2.3.2'
++gem 'rails', '~> 7.2.3.2'
  gem 'rouge', '~> 4.5'
  gem 'mini_mime', '~> 1.1.0'
  gem "actionpack-xml_parser"