CVS commit: pkgsrc/www/ruby-mechanize

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Sun Sep  6 16:17:28 UTC 2026

Modified Files:
        pkgsrc/www/ruby-mechanize: Makefile PLIST distinfo

Log Message:
www/ruby-mechanize: update to 2.14.1

2.14.1 (2026-08-22)

Security

* Strip both Proxy-Authorization and Cookie2 headers on a cross-origin
  redirect.  GHSA-2mwr-xjcg-37j7

* Headers set through Mechanize#request_headers= now obey the same
  cross-origin redirect rules as per-request headers, instead of being
  re-applied unconditionally to every request.  GHSA-2mwr-xjcg-37j7

* A redirect is now considered cross-origin when the scheme, the host or the
  port changes, per RFC 6454.  Previously only a host change discarded
  cookies, and an https: to http: redirect to the same host carried
  credentials in cleartext.  GHSA-5jgv-wc2m-xv99

* A meta refresh that points cross-origin now discards sensitive request
  headers, the same as an HTTP redirect.  Previously headers set through
  Mechanize#request_headers= followed it unconditionally.
  GHSA-c6rp-p8xm-4q9f

Improved

* A meta refresh now carries the original request's headers, minus any
  credential withheld for crossing an origin and minus the entity headers of
  the original request.  Previously it carried only the headers set through
  Mechanize#request_headers=.

* robots.txt is fetched without any caller-supplied request headers, on any
  origin.  Previously it received the headers set through
  Mechanize#request_headers=.  It is a request mechanize makes on its own
  behalf.


To generate a diff of this commit:
cvs rdiff -u -r1.31 -r1.32 pkgsrc/www/ruby-mechanize/Makefile
cvs rdiff -u -r1.18 -r1.19 pkgsrc/www/ruby-mechanize/PLIST
cvs rdiff -u -r1.28 -r1.29 pkgsrc/www/ruby-mechanize/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/ruby-mechanize/Makefile
diff -u pkgsrc/www/ruby-mechanize/Makefile:1.31 pkgsrc/www/ruby-mechanize/Makefile:1.32
--- pkgsrc/www/ruby-mechanize/Makefile:1.31     Sun Jan 19 16:53:03 2025
+++ pkgsrc/www/ruby-mechanize/Makefile  Sun Sep  6 16:17:28 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.31 2025/01/19 16:53:03 taca Exp $
+# $NetBSD: Makefile,v 1.32 2026/09/06 16:17:28 taca Exp $
 
-DISTNAME=      mechanize-2.14.0
+DISTNAME=      mechanize-2.14.1
 CATEGORIES=    www
 
 MAINTAINER=    minskim%NetBSD.org@localhost

Index: pkgsrc/www/ruby-mechanize/PLIST
diff -u pkgsrc/www/ruby-mechanize/PLIST:1.18 pkgsrc/www/ruby-mechanize/PLIST:1.19
--- pkgsrc/www/ruby-mechanize/PLIST:1.18        Sat Jun 15 16:42:59 2024
+++ pkgsrc/www/ruby-mechanize/PLIST     Sun Sep  6 16:17:28 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.18 2024/06/15 16:42:59 taca Exp $
+@comment $NetBSD: PLIST,v 1.19 2026/09/06 16:17:28 taca Exp $
 ${GEM_HOME}/cache/${GEM_NAME}.gem
 ${GEM_LIBDIR}/.autotest
 ${GEM_LIBDIR}/.github/dependabot.yml
@@ -13,6 +13,7 @@ ${GEM_LIBDIR}/Gemfile
 ${GEM_LIBDIR}/LICENSE.txt
 ${GEM_LIBDIR}/README.md
 ${GEM_LIBDIR}/Rakefile
+${GEM_LIBDIR}/SECURITY.md
 ${GEM_LIBDIR}/examples/flickr_upload.rb
 ${GEM_LIBDIR}/examples/latest_user_agents.rb
 ${GEM_LIBDIR}/examples/mech-dump.rb

Index: pkgsrc/www/ruby-mechanize/distinfo
diff -u pkgsrc/www/ruby-mechanize/distinfo:1.28 pkgsrc/www/ruby-mechanize/distinfo:1.29
--- pkgsrc/www/ruby-mechanize/distinfo:1.28     Sun Jan 19 16:53:03 2025
+++ pkgsrc/www/ruby-mechanize/distinfo  Sun Sep  6 16:17:28 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.28 2025/01/19 16:53:03 taca Exp $
+$NetBSD: distinfo,v 1.29 2026/09/06 16:17:28 taca Exp $
 
-BLAKE2s (mechanize-2.14.0.gem) = 2bfafcf97cf71be28899564922b04bdb1f461e82b3aba9dbaf726ec9932cf044
-SHA512 (mechanize-2.14.0.gem) = 563b79c116da1d438525d0c52f530323254612d081b3a5ca7633837cf052b55e8b09021effac06aea7b2895ce5a20f14b58a6fca1cfb2d66244092fed0454a76
-Size (mechanize-2.14.0.gem) = 145920 bytes
+BLAKE2s (mechanize-2.14.1.gem) = 90353cbfbd6e9a4e915d4b65bd928cc4287d287db83486d8a102802d16231174
+SHA512 (mechanize-2.14.1.gem) = d15d877d6514ab479a178aa682244e5a521256ca431f329be44045e5a80843ba4864919bea49376b1dc6ab400cdaae0e5fc14b99b1ce2091e0d6c078633153ad
+Size (mechanize-2.14.1.gem) = 148992 bytes