CVS commit: pkgsrc/www/wordpress

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Wed Nov  4 15:54:18 UTC 2026

Modified Files:
        pkgsrc/www/wordpress: Makefile distinfo

Log Message:
www/wordpress: update to 7.0.8

7.0.8 (2026-10-28)

* An Editor+ stored cross-site scripting (XSS) issue in the personal data
  erasure requests screen reported by Anthropic

* A Contributor+ stored cross-site scripting (XSS) issue via whitespace in
  block delimiters reported by Rafie Muhammad (Awesome Motive, Inc.)

* An information disclosure issue exposing unpublished Customizer changes to
  unauthenticated visitors reported by Antonio Lorensius Silaban

* A hardening fix for unescaped usernames on the multisite Network Users
  screens reported by Anthropic

* A permissions issue letting custom roles that moderate comments read, edit
  and delete notes on posts they can’t edit reported by Ramon of the
  WordPress Security Team

* A race condition during core updates that could lead to remote code
  execution reported by Umut Bayram

* A Contributor+ issue in Interactivity API bindings that lets object
  elements load admin pages reported by rekter0

* A Contributor+ stored cross-site scripting (XSS) issue in Customizer
  selective refresh reported by Rafie Muhammad (Awesome Motive, Inc.)

* A Contributor+ stored cross-site scripting (XSS) issue via javascript:
  URLs in Interactivity API bindings reported by Luis Herranz and multiple
  independent reporters

* A Contributor+ stored cross-site scripting (XSS) issue in the labels of
  the Comments Pagination and Post Navigation Link blocks reported by Alex
  Concha of the WordPress Security Team

* An issue allowing post content to shadow Script Module data with a
  matching element ID reported by Weston Ruter

* A cross-site scripting (XSS) issue in the Categories block via format
  string injection reported by Ben Bidner

* A hardening fix for unsafe preg_replace() replacements in the Image and
  Playlist blocks reported by Ben Bidner of the WordPress Security Team

* A Contributor+ stored cross-site scripting (XSS) issue via Interactivity
  API event handler bindings reported by Jon Surrell

* An Author+ stored cross-site scripting (XSS) issue in the Interactivity
  Router via uploaded text files reported by Anas cherni

* A Contributor+ stored cross-site scripting (XSS) issue via prototype
  pollution in Interactivity API context namespaces reported by rekter0

* Contributor+ stored cross-site scripting (XSS) and denial of service
  issues in Interactivity API bindings reported by rekter0, Marcel Karlsson
  (whoismarcel), Jon Surrell and Alex Concha of the WordPress Security Team

* An update to the bundled root certificates due to the eMudhra revocation.


To generate a diff of this commit:
cvs rdiff -u -r1.125 -r1.126 pkgsrc/www/wordpress/Makefile
cvs rdiff -u -r1.105 -r1.106 pkgsrc/www/wordpress/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/wordpress/Makefile
diff -u pkgsrc/www/wordpress/Makefile:1.125 pkgsrc/www/wordpress/Makefile:1.126
--- pkgsrc/www/wordpress/Makefile:1.125 Mon Oct 12 21:14:17 2026
+++ pkgsrc/www/wordpress/Makefile       Wed Nov  4 15:54:18 2026
@@ -1,10 +1,10 @@
-# $NetBSD: Makefile,v 1.125 2026/10/12 21:14:17 wiz Exp $
+# $NetBSD: Makefile,v 1.126 2026/11/04 15:54:18 taca Exp $
 #
 # when updating this, please run 'PKG_DEVELOPER=1 make upload-distfiles'
 
 DISTNAME=              wordpress-${VERSION}
 PKGNAME=               ${PHP_PKG_PREFIX}-${DISTNAME}
-VERSION=               7.0.7
+VERSION=               7.0.8
 CATEGORIES=            www
 MASTER_SITES=          https://wordpress.org/
 

Index: pkgsrc/www/wordpress/distinfo
diff -u pkgsrc/www/wordpress/distinfo:1.105 pkgsrc/www/wordpress/distinfo:1.106
--- pkgsrc/www/wordpress/distinfo:1.105 Wed Oct  7 15:51:22 2026
+++ pkgsrc/www/wordpress/distinfo       Wed Nov  4 15:54:18 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.105 2026/10/07 15:51:22 taca Exp $
+$NetBSD: distinfo,v 1.106 2026/11/04 15:54:18 taca Exp $
 
-BLAKE2s (wordpress-7.0.7.tar.gz) = 7f522b768f11ddec8f7436de99602b0e8689a5945ac8cfecd544bf715186d9a8
-SHA512 (wordpress-7.0.7.tar.gz) = d14a33ceb5b2a7fcfe1d2db6e2becac4395664965051903a0819fd1923c6b78e397e96c9246fca2815207950a288fc4ab125316e8c7b3b140aca7d4119cef4e0
-Size (wordpress-7.0.7.tar.gz) = 29557971 bytes
+BLAKE2s (wordpress-7.0.8.tar.gz) = def10c1e1a33658037515972ae482754201f8ab885b98c7f8d57534601199e25
+SHA512 (wordpress-7.0.8.tar.gz) = 501ffb6f81c714c3c0adc4eff40f827b7691965ec320ab627179c743fe348d0a5f2c985763915bab032be4b0fb15f0301a1315bab39886d1d1a00a05ae742447
+Size (wordpress-7.0.8.tar.gz) = 29548324 bytes