CVS commit: pkgsrc/www/p5-Plack

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Mon Oct 26 06:56:20 UTC 2026

Modified Files:
        pkgsrc/www/p5-Plack: Makefile distinfo

Log Message:
p5-Plack: update to 1.0057.

1.0057  2026-10-24 02:01:28 PDT
    [BUG FIXES]
        - Fix Plack, Plack::Request and Plack::Response in 1.0056 still declaring $VERSION 1.0055,
          which kept PAUSE from indexing 1.0056. This release contains the same fixes as 1.0056,
          including CVE-2026-115825

1.0056  2026-10-24 01:55:22 PDT
    [SECURITY]
        - Fix HTTP::Server::PSGI allocating a buffer as large as the declared Content-Length,
          which let a single request crash the server with "Out of memory!" (CVE-2026-115825)
    [BUG FIXES]
        - Fix HTTP::Server::PSGI passing bytes after the Content-Length body to the app in psgi.input
        - Fix HTTP::Server::PSGI accepting malformed, negative, duplicate or too long (more than
          18 digits) Content-Length. Such requests now get 400 Bad Request
        - Fix HTTP::Server::PSGI ignoring Transfer-Encoding and passing the raw chunked body to the app.
          Such requests now get 501 Not Implemented
        - Fix HTTP::Server::PSGI passing stray bytes after the headers as psgi.input when the request
          has no Content-Length or a Content-Length of 0

1.0055  2026-10-13 15:00:27 PDT
    [SECURITY]
        - Fix memory leak of every request env in Plack::Middleware::Recursive (CVE-2026-110333)
        - Plack::Request::Upload->basename never returns '', '.' or '..' (CVE-2026-110332)
        - Plack::App::URLMap matches SERVER_PORT literally when stripping it from Host (CVE-2026-110335)
    [BUG FIXES]
        - Plack::Middleware::ErrorDocument restores the env after a subrequest, so outer
          middleware such as AccessLog sees the original request (CVE-2026-110334)
    [DOCUMENTATION]
        - Document that Plack::Handler::FCGI and Apache2 keep dot segments in PATH_INFO and
          warn against relying on front-server path-based access control (CVE-2026-110336)


To generate a diff of this commit:
cvs rdiff -u -r1.62 -r1.63 pkgsrc/www/p5-Plack/Makefile
cvs rdiff -u -r1.42 -r1.43 pkgsrc/www/p5-Plack/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/p5-Plack/Makefile
diff -u pkgsrc/www/p5-Plack/Makefile:1.62 pkgsrc/www/p5-Plack/Makefile:1.63
--- pkgsrc/www/p5-Plack/Makefile:1.62   Wed Aug 19 04:29:17 2026
+++ pkgsrc/www/p5-Plack/Makefile        Mon Oct 26 06:56:20 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.62 2026/08/19 04:29:17 wen Exp $
+# $NetBSD: Makefile,v 1.63 2026/10/26 06:56:20 wiz Exp $
 
-DISTNAME=      Plack-1.0054
+DISTNAME=      Plack-1.0057
 PKGNAME=       p5-${DISTNAME}
 CATEGORIES=    www perl5
 MASTER_SITES=  ${MASTER_SITE_PERL_CPAN:=../../authors/id/M/MI/MIYAGAWA/}
@@ -10,9 +10,7 @@ HOMEPAGE=     https://metacpan.org/release/P
 COMMENT=       PSGI toolkit and servers
 LICENSE=       ${PERL5_LICENSE}
 
-TOOL_DEPENDS+= p5-Test-Requires-[0-9]*:../../devel/p5-Test-Requires
-TOOL_DEPENDS+= p5-CGI-Compile-[0-9]*:../../www/p5-CGI-Compile
-
+DEPENDS+=      p5-CGI-Compile-[0-9]*:../../www/p5-CGI-Compile
 DEPENDS+=      p5-libwww>=5.814:../../www/p5-libwww
 DEPENDS+=      p5-HTTP-Message>=5.814:../../www/p5-HTTP-Message
 DEPENDS+=      p5-URI>=1.59:../../www/p5-URI
@@ -30,9 +28,15 @@ DEPENDS+=    p5-Apache-LogFormat-Compiler>=
 DEPENDS+=      p5-Cookie-Baker>=0.07:../../www/p5-Cookie-Baker
 DEPENDS+=      p5-HTTP-Headers-Fast>=0.18:../../www/p5-HTTP-Headers-Fast
 DEPENDS+=      p5-WWW-Form-UrlEncoded>=0.23:../../www/p5-WWW-Form-UrlEncoded
+TEST_DEPENDS+= p5-Test-Requires-[0-9]*:../../devel/p5-Test-Requires
+TEST_DEPENDS+= p5-Test-TCP-[0-9]*:../../net/p5-Test-TCP
 
 USE_LANGUAGES= # empty
 PERL5_PACKLIST=        auto/Plack/.packlist
 
+.if make(test)
+ALLOW_NETWORK_ACCESS=  yes
+.endif
+
 .include "../../lang/perl5/module.mk"
 .include "../../mk/bsd.pkg.mk"

Index: pkgsrc/www/p5-Plack/distinfo
diff -u pkgsrc/www/p5-Plack/distinfo:1.42 pkgsrc/www/p5-Plack/distinfo:1.43
--- pkgsrc/www/p5-Plack/distinfo:1.42   Wed Aug 19 04:29:17 2026
+++ pkgsrc/www/p5-Plack/distinfo        Mon Oct 26 06:56:20 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.42 2026/08/19 04:29:17 wen Exp $
+$NetBSD: distinfo,v 1.43 2026/10/26 06:56:20 wiz Exp $
 
-BLAKE2s (Plack-1.0054.tar.gz) = bcfb2c4304eee7ac7bce78e7719c5ed0ea34bbc6fce129e8678ce9141dc880c8
-SHA512 (Plack-1.0054.tar.gz) = 2cc1179e79e620e6bc55d7f5e865e4ca86f39c10ea1477ce9f4918f8b4a9b5cae855b8624e2894106b10aedf83d3d6a32b5fee38faaeb17d8156d257373cbfd8
-Size (Plack-1.0054.tar.gz) = 198571 bytes
+BLAKE2s (Plack-1.0057.tar.gz) = 2148bbf579c1ff6604f0659343f19e5472ff6346fedb5f93702e3ac82238a2e4
+SHA512 (Plack-1.0057.tar.gz) = 5a905f0c2152df3d907d2308507200871577070fa308ee1dd32ece0c62399faf056f7c52d593328090f6b00620f64ec0528759725f1de5c2020eaa3565464b56
+Size (Plack-1.0057.tar.gz) = 203316 bytes