CVS commit: pkgsrc/www/p5-Starman

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Mon Oct 26 07:02:34 UTC 2026

Modified Files:
        pkgsrc/www/p5-Starman: Makefile distinfo

Log Message:
p5-Starman: update to 0.4019.

0.4019  2026-10-24 02:02:21 PDT
        [SECURITY]
        - Stream chunked request bodies to the temporary buffer instead of
          holding whole chunks in memory (CVE-2026-115824)
        - Parse chunk-size lines in linear time with a 4 KiB length limit and
          strict syntax; malformed lines get 400 (CVE-2026-115822)
        - Do not send a response body for HEAD requests or 1xx, 204 and 304
          responses, on both the array and streaming paths (CVE-2026-115823)
        - Limit how long a request body may take to arrive: --read-timeout
          (default 5 seconds) now also applies to each wait for more of the
          body, and the new --body-timeout option limits the total time
          (default 300 seconds; raise it or set it to 0 for slower uploads).
          Expiry gets 408 (CVE-2026-115817)
        - Reject Transfer-Encoding other than "chunked" (400/501) and close
          the connection after a request with both Transfer-Encoding and
          Content-Length. Completes the fix for CVE-2026-40560
        - Reject malformed, negative and conflicting Content-Length headers
          with 400
        - Reject malformed header field names: whitespace before the colon,
          obs-fold, and Content-Length/Transfer-Encoding spelled with "_"
        - Read request bodies with exact framing: keep the bytes after a body
          for the next pipelined request, consume chunked trailers (up to
          16 KiB), and reject bodies cut short by EOF with 400 instead of
          dispatching a partial body
        - Parse each request header exactly once and skip empty lines before
          the request line (a request could be dispatched twice with the
          pure-Perl HTTP::Parser::XS backend)
        - Respond with 500 instead of dispatching a truncated body when the
          request body cannot be stored (e.g. disk full)
        - Do not send Content-Length or Transfer-Encoding in 1xx and 204
          responses
        - Limit request headers to 128 KiB (431)
        [BEHAVIOUR CHANGES]
        - Requests with Transfer-Encoding in HTTP/1.0, or with obs-fold header
          lines, now get 400
        - Pipelined requests of any method are served (previously anything
          but GET/HEAD after a request was silently dropped)
        - A chunked body must end with the empty line after the last chunk
          (RFC 9112); "0\r\n" alone no longer completes the request. Clients
          using HTTP::Tiny older than 0.064 (bundled with perl 5.24 and
          older) send chunked bodies that way and now get 408


To generate a diff of this commit:
cvs rdiff -u -r1.35 -r1.36 pkgsrc/www/p5-Starman/Makefile
cvs rdiff -u -r1.15 -r1.16 pkgsrc/www/p5-Starman/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/p5-Starman/Makefile
diff -u pkgsrc/www/p5-Starman/Makefile:1.35 pkgsrc/www/p5-Starman/Makefile:1.36
--- pkgsrc/www/p5-Starman/Makefile:1.35 Thu Jul 16 19:06:17 2026
+++ pkgsrc/www/p5-Starman/Makefile      Mon Oct 26 07:02:34 2026
@@ -1,8 +1,7 @@
-# $NetBSD: Makefile,v 1.35 2026/07/16 19:06:17 wiz Exp $
+# $NetBSD: Makefile,v 1.36 2026/10/26 07:02:34 wiz Exp $
 
-DISTNAME=      Starman-0.4018
+DISTNAME=      Starman-0.4019
 PKGNAME=       p5-${DISTNAME}
-PKGREVISION=   1
 CATEGORIES=    www perl5
 MASTER_SITES=  ${MASTER_SITE_PERL_CPAN:=../../authors/id/M/MI/MIYAGAWA/}
 

Index: pkgsrc/www/p5-Starman/distinfo
diff -u pkgsrc/www/p5-Starman/distinfo:1.15 pkgsrc/www/p5-Starman/distinfo:1.16
--- pkgsrc/www/p5-Starman/distinfo:1.15 Wed Apr 29 06:52:22 2026
+++ pkgsrc/www/p5-Starman/distinfo      Mon Oct 26 07:02:34 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.15 2026/04/29 06:52:22 wiz Exp $
+$NetBSD: distinfo,v 1.16 2026/10/26 07:02:34 wiz Exp $
 
-BLAKE2s (Starman-0.4018.tar.gz) = 865f38443edc5d98f51b6360c4c48cc617a454e175067586c78bffc15cfafbc0
-SHA512 (Starman-0.4018.tar.gz) = b839ea13b94ec9556145956a7d3f6973ed99579d30a6102c325e9eac6b306aa6f64f5ac000159a01142fa380a149f5c2be890c6fc3f8846f9922993c489c81fe
-Size (Starman-0.4018.tar.gz) = 33079 bytes
+BLAKE2s (Starman-0.4019.tar.gz) = 3099b61f2af019cbcfe23393549639576d7e6c0e2bf213c67273ede8f32bf26c
+SHA512 (Starman-0.4019.tar.gz) = db1aa765c1f504ea7555cd91af21629b4fa0d9ef1a5964c2d6ef7da2f7b6e241d90ba5ca64876dc645ca13063d99dbc38ee2d840fece85fef489d63ea9686630
+Size (Starman-0.4019.tar.gz) = 45120 bytes