CVS commit: pkgsrc/www/php-concrete-cms

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Wed Sep  9 14:18:31 UTC 2026

Modified Files:
        pkgsrc/www/php-concrete-cms: Makefile PLIST distinfo

Log Message:
www/php-concrete-cms: update to 9.5.4

9.5.4 (2026-09-08)

Behavioral Improvements

* Test mail settings: show email sender, add links to configuration pages
  (#13078) (thanks mlocati)
* SEO bulk report no longer rescans paths needlessly for every page it
  lists. (#13071)
* Improve sanitization checking of SVG on upload

Bug Fixes

* Fix issue with composer attribute control not saving
* When dragging / dropping page in sitemap an "invalid token"-error occurs
  (#13077)
* Rescan Locale strips every content-block page link and crashes on stack
  pages (#13082) (thanks janscarton)
* Mail Service: From and Subject headers are still encoded on the dashboard
  logs page (9.5.3) (#13075) (thanks broreece)
* Express object dashboard: validation failure returns a 500 instead of an
  error (#13093)
* Express object dashboard: delete_entries() has no permission check (#13095)
* [Bug] Translate Site Interface “Save to file” fails with “Invalid
  language identifier” on a non-default site (#13065)

Security Updates

* CVE-2026-85385 (Risk Rank 7.7) (thanks Suraj Bhosale)
* CVE-2026-85386 (Risk Rank 7.3) (thanks Valentin SARRE (Independent
  security researcher))
* CVE-2026-85387 (thanks Myq Larson)
* CVE-2026-87028 (Risk Rank 5.3) (thanks Pakung)
* CVE-2026-87031 (Risk Rank 2.1) (thanks Winston Crooker)

Developer

* Fix the documented types of the attribute value objects (#13079) (thanks
  mlocati)
* Removed some vestigial code (thanks mlocati)


To generate a diff of this commit:
cvs rdiff -u -r1.20 -r1.21 pkgsrc/www/php-concrete-cms/Makefile
cvs rdiff -u -r1.14 -r1.15 pkgsrc/www/php-concrete-cms/PLIST
cvs rdiff -u -r1.16 -r1.17 pkgsrc/www/php-concrete-cms/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/php-concrete-cms/Makefile
diff -u pkgsrc/www/php-concrete-cms/Makefile:1.20 pkgsrc/www/php-concrete-cms/Makefile:1.21
--- pkgsrc/www/php-concrete-cms/Makefile:1.20   Wed Sep  2 14:52:20 2026
+++ pkgsrc/www/php-concrete-cms/Makefile        Wed Sep  9 14:18:31 2026
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.20 2026/09/02 14:52:20 taca Exp $
+# $NetBSD: Makefile,v 1.21 2026/09/09 14:18:31 taca Exp $
 #
 
 DISTNAME=      concrete-cms-${GITHUB_RELEASE}
@@ -6,7 +6,7 @@ PKGNAME=        ${PHP_PKG_PREFIX}-${DISTNAME}
 CATEGORIES=    www
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=concretecms/}
 GITHUB_PROJECT=        concretecms
-GITHUB_RELEASE=        9.5.3
+GITHUB_RELEASE=        9.5.4
 EXTRACT_SUFX=  .zip
 
 MAINTAINER=    pkgsrc-users%NetBSD.org@localhost

Index: pkgsrc/www/php-concrete-cms/PLIST
diff -u pkgsrc/www/php-concrete-cms/PLIST:1.14 pkgsrc/www/php-concrete-cms/PLIST:1.15
--- pkgsrc/www/php-concrete-cms/PLIST:1.14      Wed Sep  2 14:52:20 2026
+++ pkgsrc/www/php-concrete-cms/PLIST   Wed Sep  9 14:18:31 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.14 2026/09/02 14:52:20 taca Exp $
+@comment $NetBSD: PLIST,v 1.15 2026/09/09 14:18:31 taca Exp $
 ${CC_DOCDIR}/README
 ${CC_WEBDIR}/LICENSE.TXT
 ${CC_WEBDIR}/application/bootstrap/app.php
@@ -1697,7 +1697,6 @@ ${CC_WEBDIR}/concrete/controllers/fronte
 ${CC_WEBDIR}/concrete/controllers/frontend/switch_language.php
 ${CC_WEBDIR}/concrete/controllers/install.php
 ${CC_WEBDIR}/concrete/controllers/marketplace.php
-${CC_WEBDIR}/concrete/controllers/oauth2.php
 ${CC_WEBDIR}/concrete/controllers/page_types/core_stack.php
 ${CC_WEBDIR}/concrete/controllers/page_types/core_theme_documentation.php
 ${CC_WEBDIR}/concrete/controllers/page_types/core_theme_documentation_category.php
@@ -7195,7 +7194,6 @@ ${CC_WEBDIR}/concrete/src/Announcement/S
 ${CC_WEBDIR}/concrete/src/Announcement/Slide/SlideInterface.php
 ${CC_WEBDIR}/concrete/src/Antispam/Library.php
 ${CC_WEBDIR}/concrete/src/Antispam/Service.php
-${CC_WEBDIR}/concrete/src/Api/Api.php
 ${CC_WEBDIR}/concrete/src/Api/ApiController.php
 ${CC_WEBDIR}/concrete/src/Api/ApiResourceValueInterface.php
 ${CC_WEBDIR}/concrete/src/Api/ApiRouteList.php
@@ -7304,6 +7302,7 @@ ${CC_WEBDIR}/concrete/src/Api/OAuth/Cont
 ${CC_WEBDIR}/concrete/src/Api/OAuth/Grant/RefreshTokenGrant.php
 ${CC_WEBDIR}/concrete/src/Api/OAuth/Server/ClaimsSetFactory.php
 ${CC_WEBDIR}/concrete/src/Api/OAuth/Server/IdTokenResponse.php
+${CC_WEBDIR}/concrete/src/Api/OAuth/UserStatusValidator.php
 ${CC_WEBDIR}/concrete/src/Api/OAuth/Validator/DefaultValidator.php
 ${CC_WEBDIR}/concrete/src/Api/OpenApi/Factory/ExpressEntitySpecFactory.php
 ${CC_WEBDIR}/concrete/src/Api/OpenApi/FileContent.php
@@ -8712,6 +8711,8 @@ ${CC_WEBDIR}/concrete/src/File/Component
 ${CC_WEBDIR}/concrete/src/File/Component/Chooser/OptionInterface.php
 ${CC_WEBDIR}/concrete/src/File/Component/Chooser/OptionSerializableTrait.php
 ${CC_WEBDIR}/concrete/src/File/Component/Chooser/UploaderOptionInterface.php
+${CC_WEBDIR}/concrete/src/File/Document/Xml/Sanitizer.php
+${CC_WEBDIR}/concrete/src/File/Document/Xml/SanitizerException.php
 ${CC_WEBDIR}/concrete/src/File/EditResponse.php
 ${CC_WEBDIR}/concrete/src/File/Event/DeleteFile.php
 ${CC_WEBDIR}/concrete/src/File/Event/DuplicateFile.php
@@ -8771,6 +8772,7 @@ ${CC_WEBDIR}/concrete/src/File/Import/Pr
 ${CC_WEBDIR}/concrete/src/File/Import/Processor/SvgProcessor.php
 ${CC_WEBDIR}/concrete/src/File/Import/Processor/ThumbnailGenerator.php
 ${CC_WEBDIR}/concrete/src/File/Import/Processor/ValidatorInterface.php
+${CC_WEBDIR}/concrete/src/File/Import/Processor/XmlProcessor.php
 ${CC_WEBDIR}/concrete/src/File/Import/ProcessorManager.php
 ${CC_WEBDIR}/concrete/src/File/ImportProcessor/AutorotateImageProcessor.php
 ${CC_WEBDIR}/concrete/src/File/ImportProcessor/ConstrainImageProcessor.php
@@ -9061,7 +9063,6 @@ ${CC_WEBDIR}/concrete/src/Http/DefaultSe
 ${CC_WEBDIR}/concrete/src/Http/DispatcherInterface.php
 ${CC_WEBDIR}/concrete/src/Http/FlysystemFileResponse.php
 ${CC_WEBDIR}/concrete/src/Http/HttpServiceProvider.php
-${CC_WEBDIR}/concrete/src/Http/Middleware/APIAuthenticatorMiddleware.php
 ${CC_WEBDIR}/concrete/src/Http/Middleware/ApiLoggerMiddleware.php
 ${CC_WEBDIR}/concrete/src/Http/Middleware/ApplicationMiddleware.php
 ${CC_WEBDIR}/concrete/src/Http/Middleware/ContentSecurityPolicyMiddleware.php
@@ -10755,6 +10756,8 @@ ${CC_WEBDIR}/concrete/src/Updater/Migrat
 ${CC_WEBDIR}/concrete/src/Updater/Migrations/Migrations/Version20251120183116.php
 ${CC_WEBDIR}/concrete/src/Updater/Migrations/Migrations/Version20260203004500.php
 ${CC_WEBDIR}/concrete/src/Updater/Migrations/Migrations/Version20260811120000.php
+${CC_WEBDIR}/concrete/src/Updater/Migrations/Migrations/Version20260903000000.php
+${CC_WEBDIR}/concrete/src/Updater/Migrations/Migrations/Version20260908000000.php
 ${CC_WEBDIR}/concrete/src/Updater/Migrations/RepeatableMigrationInterface.php
 ${CC_WEBDIR}/concrete/src/Updater/Migrations/Routine/AddPageDraftsBooleanTrait.php
 ${CC_WEBDIR}/concrete/src/Updater/RemoteApplicationUpdate.php

Index: pkgsrc/www/php-concrete-cms/distinfo
diff -u pkgsrc/www/php-concrete-cms/distinfo:1.16 pkgsrc/www/php-concrete-cms/distinfo:1.17
--- pkgsrc/www/php-concrete-cms/distinfo:1.16   Wed Sep  2 14:52:20 2026
+++ pkgsrc/www/php-concrete-cms/distinfo        Wed Sep  9 14:18:31 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.16 2026/09/02 14:52:20 taca Exp $
+$NetBSD: distinfo,v 1.17 2026/09/09 14:18:31 taca Exp $
 
-BLAKE2s (concrete-cms-9.5.3.zip) = 6220a879efcfe405c68c51f7657be1f4da03588099a8c43fe6bbe2051d523621
-SHA512 (concrete-cms-9.5.3.zip) = c60a16d18bfddb99f57c5c6fbcbc11c7b6512199b8a531f030c98ef62d7ceaf24635f07aabdb84e3a72d705fc3948870e2a604d6eb567194b3f273867fef756b
-Size (concrete-cms-9.5.3.zip) = 76895747 bytes
+BLAKE2s (concrete-cms-9.5.4.zip) = 1897adb8c6ccd37475b5f893ff2285f48bc97984f1e1ed4c2b6edc4696e6400e
+SHA512 (concrete-cms-9.5.4.zip) = b8eef9c0f4c7bea2ee7a547bec0b41ba613f9c9a2adfde6d39e1f733c4ac628ebbaee116fca7eb9adfdf89c5c57826b287408f9fd43f85523f09c39db6be1371
+Size (concrete-cms-9.5.4.zip) = 76915938 bytes