CVS commit: pkgsrc/lang

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Sun Oct 25 14:32:43 UTC 2026

Modified Files:
        pkgsrc/lang/ruby: rubyversion.mk
        pkgsrc/lang/ruby34: distinfo

Log Message:
lang/ruby34: update to 3.4.12

This update contains these security fixes.

* CVE-2026-89078: Double Free issue in Regular Expression Parser (GitLab
  19.4.1)

* CVE-2026-93577: Integer Overflow issue in Regular Expression Compiler
  (GitLab 19.4.1)

* CVE-2026-97229: Integer Overflow issue in CI/CD Regular Expression
  Compiler (GitLab 19.4.2)

* CVE-2026-110264: Integer Overflow issue in Regular Expression Compiler
  (GitLab 19.5.1)

3.4.12 (2026-10-23)

* Bug #22342: IO#gets can ignore the limit argument in some edge cases

* Bug #22284: Passing an object with to_int to curry as its arity causes
  problems with LLP64.

* Bug #22387: str_shared_replace incorrectly recalculates termlen

* Bug #22391: Fix propagation of errno in rb_io_maybe_wait.

* Bug #22388: Use-after-free when an Enumerable retains its each block

* Bug #22326: heap buffer overflow in array.values_at()

* Bug #22423: String#initialize(encoding:) stores an inflated capacity and
  writes past the malloc'd buffer on append (rb_str_init termlen
  double-adjust)

* Prevent double free for too big repetition quantifiers by makenowjust ·
  Pull Request #13332

* Bug #22415: Thread.handle_interrupt needs to preserve errinfo

* Bug #22406: Process.fork can leave the child unable to resolve hostnames:
  getaddrinfo helper threads take glibc's resolver lock after releasing the
  fork lock

* Bug #22445: On macOS, a child of Kernel#fork can abort with "[BUG]
  pthread_rwlock_destroy: Resource busy (EBUSY)"

* Reject overflowed repeat/null-check IDs in huge regexps by makenowjust ·
  Pull Request #16801

* Bug #22384: Regexp compile error in the 2nd+ branch of a top-level
  alternation leaks the parse tree (regression from #13332, Ruby 4.0)


To generate a diff of this commit:
cvs rdiff -u -r1.333 -r1.334 pkgsrc/lang/ruby/rubyversion.mk
cvs rdiff -u -r1.20 -r1.21 pkgsrc/lang/ruby34/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/ruby/rubyversion.mk
diff -u pkgsrc/lang/ruby/rubyversion.mk:1.333 pkgsrc/lang/ruby/rubyversion.mk:1.334
--- pkgsrc/lang/ruby/rubyversion.mk:1.333       Sun Oct 25 14:26:19 2026
+++ pkgsrc/lang/ruby/rubyversion.mk     Sun Oct 25 14:32:43 2026
@@ -1,4 +1,4 @@
-# $NetBSD: rubyversion.mk,v 1.333 2026/10/25 14:26:19 taca Exp $
+# $NetBSD: rubyversion.mk,v 1.334 2026/10/25 14:32:43 taca Exp $
 #
 
 # This file determines which Ruby version is used as a dependency for
@@ -213,7 +213,7 @@ RUBY_VERSION_REQD?= ${PKGNAME_REQD:C/rub
 
 # current supported Ruby's version
 RUBY33_VERSION=                3.3.12
-RUBY34_VERSION=                3.4.11
+RUBY34_VERSION=                3.4.12
 RUBY40_VERSION=                4.0.9
 
 # current API compatible version; used for version of shared library

Index: pkgsrc/lang/ruby34/distinfo
diff -u pkgsrc/lang/ruby34/distinfo:1.20 pkgsrc/lang/ruby34/distinfo:1.21
--- pkgsrc/lang/ruby34/distinfo:1.20    Thu Sep 24 15:28:57 2026
+++ pkgsrc/lang/ruby34/distinfo Sun Oct 25 14:32:43 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.20 2026/09/24 15:28:57 taca Exp $
+$NetBSD: distinfo,v 1.21 2026/10/25 14:32:43 taca Exp $
 
-BLAKE2s (ruby-3.4.11.tar.xz) = e1314342598a9634334df928eef6bf0939b110f0ea5d99c39fe3adf7f73600a9
-SHA512 (ruby-3.4.11.tar.xz) = 466952978880190ca8eae2709a42f4cb8983aa2fa329219ef1cbe309de549928d4f94078cd70b168b313833ed9b7f8bbbe3c21ef2e772a3d3bf0c68cab669d2a
-Size (ruby-3.4.11.tar.xz) = 16712500 bytes
+BLAKE2s (ruby-3.4.12.tar.xz) = b4f95d70cf152504fc5569b4d3385bafd8e307c2cfc0dcce000fafc532ee77ee
+SHA512 (ruby-3.4.12.tar.xz) = 7866ed652921f9f0d601e1e323d29fddee3506cfd89e258cab7601786bffec8a17245468d517d246ecfa7fa9a982b73cfff0aaf6534444753e8b6add297bfbd3
+Size (ruby-3.4.12.tar.xz) = 16732860 bytes
 SHA1 (patch-common.mk) = c23eed58427b2fd4ba8fdb3692f609701a666c6d
 SHA1 (patch-configure) = ff1b1e659ddc7cb1d62a71e1447df55f1f7b07c2
 SHA1 (patch-ext_openssl_openssl__missing.h) = 3f8d79736fd14806dfaf76e333eec63ff3ff5890