CVS commit: pkgsrc/www/p5-HTTP-Body

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Fri Nov  6 17:22:00 UTC 2026

Modified Files:
        pkgsrc/www/p5-HTTP-Body: Makefile distinfo

Log Message:
p5-HTTP-Body: update to 1.25.

TOOL_DEPENDS -> TEST_DEPENDS for a test dependency.

1.25      2026-11-05 18:47:08+01:00 Europe/Berlin
        - SECURITY, CVE-2026-117500: the suffix of an upload's filename is
          worked out from its last 255 bytes only, only when $file_temp_suffix
          is unset, and for the default $basename_regexp by a string search
          instead of the regexp; a filename of many dots ending in a backslash
          made the default $basename_regexp take time quadratic in its length
          (7 s per part at the 32 KiB header limit, once per part) in the
          default configuration
        - SECURITY, CVE-2026-117501: a chunked body is framed line by line with
          a limit on the chunk-size line ($HTTP::Body::max_chunk_line_size,
          1024 bytes), chunk data is passed on as it arrives instead of being
          held until the chunk is complete, malformed framing (a line that is
          no chunk-size line, a size that does not fit an integer, chunk data
          not followed by CRLF) croaks instead of buffering forever, and
          nothing after the trailer or after the body parser is done is kept
        - SECURITY, CVE-2026-121006: the trailer of a chunked body is limited
          to $HTTP::Body::max_trailer_size bytes (32768) and
          $HTTP::Body::max_trailer_lines header lines (100); everything that
          followed the last chunk in the same call to add() was parsed with
          HTTP::Headers, which takes time quadratic in the number of fields of
          one name (6 s for 16 KiB of "a:" lines)
        - trailing_headers: a trailer is read up to its blank line also when it
          arrives in later calls to add() than the last chunk; it used to be
          lost
        - XFormsMultipart: a part other than the start part now gets its
          temporary file and the NUL strip of RT#123615 like any upload; it used
          to be returned by upload without a tempname, its data dropped
        - parse_header: a continuation line at the start of a part's header
          block is dropped instead of dying, and a line that is no header field
          is dropped instead of being stored under a made-up field name
        - add: the caller's buffer is no longer modified in place when it
          exceeds the Content-Length, so a read-only value is accepted
        - Docs: every method of the parser classes is described, add and
          length say what they return; the README lists every limit,
          $basename_regexp and all runtime prerequisites
        - File::Spec is declared as a prerequisite


To generate a diff of this commit:
cvs rdiff -u -r1.34 -r1.35 pkgsrc/www/p5-HTTP-Body/Makefile
cvs rdiff -u -r1.16 -r1.17 pkgsrc/www/p5-HTTP-Body/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/p5-HTTP-Body/Makefile
diff -u pkgsrc/www/p5-HTTP-Body/Makefile:1.34 pkgsrc/www/p5-HTTP-Body/Makefile:1.35
--- pkgsrc/www/p5-HTTP-Body/Makefile:1.34       Wed Oct 28 21:57:06 2026
+++ pkgsrc/www/p5-HTTP-Body/Makefile    Fri Nov  6 17:22:00 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.34 2026/10/28 21:57:06 wiz Exp $
+# $NetBSD: Makefile,v 1.35 2026/11/06 17:22:00 wiz Exp $
 
-DISTNAME=      HTTP-Body-1.24
+DISTNAME=      HTTP-Body-1.25
 PKGNAME=       p5-${DISTNAME}
 CATEGORIES=    www perl5
 MASTER_SITES=  ${MASTER_SITE_PERL_CPAN:=../../authors/id/G/GE/GETTY/}
@@ -10,8 +10,8 @@ HOMEPAGE=     https://metacpan.org/release/H
 COMMENT=       HTTP Body Parser
 LICENSE=       ${PERL5_LICENSE}
 
-TOOL_DEPENDS+= p5-Test-Deep-[0-9]*:../../devel/p5-Test-Deep
 DEPENDS+=      p5-HTTP-Message>=0:../../www/p5-HTTP-Message
+TEST_DEPENDS+= p5-Test-Deep-[0-9]*:../../devel/p5-Test-Deep
 
 USE_LANGUAGES=         # empty
 PERL5_PACKLIST=                auto/HTTP/Body/.packlist

Index: pkgsrc/www/p5-HTTP-Body/distinfo
diff -u pkgsrc/www/p5-HTTP-Body/distinfo:1.16 pkgsrc/www/p5-HTTP-Body/distinfo:1.17
--- pkgsrc/www/p5-HTTP-Body/distinfo:1.16       Wed Oct 28 21:57:06 2026
+++ pkgsrc/www/p5-HTTP-Body/distinfo    Fri Nov  6 17:22:00 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.16 2026/10/28 21:57:06 wiz Exp $
+$NetBSD: distinfo,v 1.17 2026/11/06 17:22:00 wiz Exp $
 
-BLAKE2s (HTTP-Body-1.24.tar.gz) = 758b34990e242313e4781a121f70fb024543c0f1a5546ec912ab544b03998b8d
-SHA512 (HTTP-Body-1.24.tar.gz) = d4e37088e90906d268eb843c295f1a38dd72a53dbddd806ec5bfe8e55b82c40c9268a2fe55e26835e7bbb2c120d3643355f3a9a1b9efc093626cd67c4eae5402
-Size (HTTP-Body-1.24.tar.gz) = 34500 bytes
+BLAKE2s (HTTP-Body-1.25.tar.gz) = 42926d965d3c0d94f3061ef693189c398ffc62dfa87040069ef7d4619254d247
+SHA512 (HTTP-Body-1.25.tar.gz) = 68df3cb79b201a218b78e41946df03237a2a787eb532fea8dd3757350b76e2f251f843f5c93c40c753f6a72e09a7a770c715cd7f85252abb8b17b341e25f47fd
+Size (HTTP-Body-1.25.tar.gz) = 43123 bytes