CVS commit: pkgsrc/www/p5-HTTP-Body

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Wed Oct 28 21:57:07 UTC 2026

Modified Files:
        pkgsrc/www/p5-HTTP-Body: Makefile distinfo

Log Message:
p5-HTTP-Body: update to 1.24.

1.24      2026-10-26 18:28:01+01:00 Europe/Berlin
        - SECURITY, CVE-2026-116131: urlencoded bodies are limited to
          $HTTP::Body::UrlEncoded::max_params fields and multipart bodies to
          $HTTP::Body::MultiPart::max_parts parts (1000 each); reported and
          patched by CPANSec
        - SECURITY, CVE-2026-116132: the temporary file of an upload that is
          still incomplete at DESTROY-time is now always deleted; reported and
          patched by CPANSec (also fixes RT#84004)
        - SECURITY, CVE-2026-116133: a multipart body without a boundary or with
          a malformed delimiter line no longer takes quadratic time; a malformed
          delimiter line now croaks, and padding or an epilogue after the close
          delimiter is accepted; reported and patched by CPANSec
        - SECURITY, CVE-2026-116134: a multipart part's header block is limited
          to $HTTP::Body::MultiPart::max_header_size bytes (32768) and
          $HTTP::Body::MultiPart::max_header_lines lines (100); reported and
          patched by CPANSec
        - SECURITY, CVE-2026-116135: mixed-case percent escapes (e.g. %aB) in
          urlencoded bodies are decoded instead of being dropped; reported and
          patched by CPANSec
        - SECURITY, CVE-2026-116285: the chunk size line of a chunked body is
          matched in linear instead of quadratic time
        - SECURITY, CVE-2026-116531: a chunked body is now framed independently
          of where the reads feeding add() fall; a read that split a chunk could
          leave the parser never reaching 'done', hanging a server that reads
          until done
        - INCOMPATIBLE: add() now croaks when one of the new limits is exceeded.
          Raise the variable, or set it to 0 to disable that limit, if your
          forms need more. See NOTES in HTTP::Body.
        - RT#105021: temp-file write errors in MultiPart and OctetStream now
          croak instead of silently truncating the stored body
        - RT#123615: a NUL byte in a multipart filename is stripped so it cannot
          truncate a path handed on downstream
        - Moved repository from Shadowcat git to GitHub (libwww-perl/HTTP-Body)
        - Updated all metadata resources to point to GitHub
        - Fixed prerequisites: moved Digest::MD5 to test deps, changed HTTP::Headers to HTTP::Message
        - Added README.md for GitHub
        - Updated support section in documentation
        - Moved the POD, POD coverage and Perl::Critic tests to xt/release, so
          they run on every release instead of being skipped


To generate a diff of this commit:
cvs rdiff -u -r1.33 -r1.34 pkgsrc/www/p5-HTTP-Body/Makefile
cvs rdiff -u -r1.15 -r1.16 pkgsrc/www/p5-HTTP-Body/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/p5-HTTP-Body/Makefile
diff -u pkgsrc/www/p5-HTTP-Body/Makefile:1.33 pkgsrc/www/p5-HTTP-Body/Makefile:1.34
--- pkgsrc/www/p5-HTTP-Body/Makefile:1.33       Thu Jul 16 19:06:00 2026
+++ pkgsrc/www/p5-HTTP-Body/Makefile    Wed Oct 28 21:57:06 2026
@@ -1,10 +1,9 @@
-# $NetBSD: Makefile,v 1.33 2026/07/16 19:06:00 wiz Exp $
+# $NetBSD: Makefile,v 1.34 2026/10/28 21:57:06 wiz Exp $
 
-DISTNAME=      HTTP-Body-1.23
+DISTNAME=      HTTP-Body-1.24
 PKGNAME=       p5-${DISTNAME}
-PKGREVISION=   3
 CATEGORIES=    www perl5
-MASTER_SITES=  ${MASTER_SITE_PERL_CPAN:=HTTP/}
+MASTER_SITES=  ${MASTER_SITE_PERL_CPAN:=../../authors/id/G/GE/GETTY/}
 
 MAINTAINER=    pkgsrc-users%NetBSD.org@localhost
 HOMEPAGE=      https://metacpan.org/release/HTTP-Body

Index: pkgsrc/www/p5-HTTP-Body/distinfo
diff -u pkgsrc/www/p5-HTTP-Body/distinfo:1.15 pkgsrc/www/p5-HTTP-Body/distinfo:1.16
--- pkgsrc/www/p5-HTTP-Body/distinfo:1.15       Sun Apr  7 21:34:46 2024
+++ pkgsrc/www/p5-HTTP-Body/distinfo    Wed Oct 28 21:57:06 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.15 2024/04/07 21:34:46 wiz Exp $
+$NetBSD: distinfo,v 1.16 2026/10/28 21:57:06 wiz Exp $
 
-BLAKE2s (HTTP-Body-1.23.tar.gz) = e72277d3252a69ec1b96b5b178e111ea39263ab8ff20a0d3c070d60545ede58a
-SHA512 (HTTP-Body-1.23.tar.gz) = b02fb8652ceebdaa858ff12fe759ded62eefa7f23e5bf8b90e31a52d4433f13d29986f9646141b92a6a4ea58e1be007c6f675c3e2b26559fa0ff9333e69f3ebb
-Size (HTTP-Body-1.23.tar.gz) = 26980 bytes
+BLAKE2s (HTTP-Body-1.24.tar.gz) = 758b34990e242313e4781a121f70fb024543c0f1a5546ec912ab544b03998b8d
+SHA512 (HTTP-Body-1.24.tar.gz) = d4e37088e90906d268eb843c295f1a38dd72a53dbddd806ec5bfe8e55b82c40c9268a2fe55e26835e7bbb2c120d3643355f3a9a1b9efc093626cd67c4eae5402
+Size (HTTP-Body-1.24.tar.gz) = 34500 bytes