CVS commit: pkgsrc/www/ruby-rack

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Sat Nov  7 16:46:21 UTC 2026

Modified Files:
        pkgsrc/www/ruby-rack: Makefile distinfo

Log Message:
www/ruby-rack: update to 3.2.8

3.2.8 (2026-10-30)

Security

* GHSA-5v64-555j-wjxm Multipart parser retains parsed data in its scan
  buffer, allowing denial of service via memory exhaustion.

* GHSA-wvg4-6p58-3gh3 Rack::Static header rules were matched against an
  unnormalized path, allowing dot segments to bypass them.

* GHSA-2j8w-xcrc-x985 Rack::Request#host_with_port, #base_url, and #url
  returned the raw authority when it was invalid; host_with_port now returns
  nil in that case.

* GHSA-p8x9-v4hv-2w4g Multipart requests with more than one boundary
  parameter were accepted when the first value was empty or began with a
  quote, semicolon, or comma, bypassing the guard added for CVE-2026-26961.

Fixed

* Rack::Multipart::UploadedFile now delegates keyword arguments to the
  wrapped tempfile.  Calls such as uploaded_file.readlines(chomp: true)
  raised TypeError on Ruby 3.0+.  (#2481, #2501, @SeanLF)


To generate a diff of this commit:
cvs rdiff -u -r1.58 -r1.59 pkgsrc/www/ruby-rack/Makefile
cvs rdiff -u -r1.56 -r1.57 pkgsrc/www/ruby-rack/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/ruby-rack/Makefile
diff -u pkgsrc/www/ruby-rack/Makefile:1.58 pkgsrc/www/ruby-rack/Makefile:1.59
--- pkgsrc/www/ruby-rack/Makefile:1.58  Thu Aug 13 16:30:29 2026
+++ pkgsrc/www/ruby-rack/Makefile       Sat Nov  7 16:46:21 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.58 2026/08/13 16:30:29 taca Exp $
+# $NetBSD: Makefile,v 1.59 2026/11/07 16:46:21 taca Exp $
 
-DISTNAME=      rack-3.2.7
+DISTNAME=      rack-3.2.8
 CATEGORIES=    www
 
 MAINTAINER=    pkgsrc-users%NetBSD.org@localhost

Index: pkgsrc/www/ruby-rack/distinfo
diff -u pkgsrc/www/ruby-rack/distinfo:1.56 pkgsrc/www/ruby-rack/distinfo:1.57
--- pkgsrc/www/ruby-rack/distinfo:1.56  Thu Aug 13 16:30:29 2026
+++ pkgsrc/www/ruby-rack/distinfo       Sat Nov  7 16:46:21 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.56 2026/08/13 16:30:29 taca Exp $
+$NetBSD: distinfo,v 1.57 2026/11/07 16:46:21 taca Exp $
 
-BLAKE2s (rack-3.2.7.gem) = 718491e7665840c179f5eeb72c070640924fd6ef9e31e316fcfdeadf7145e1b7
-SHA512 (rack-3.2.7.gem) = 1f2da42ffffd4701b093a3cca57f93919e5c9a6323fb6306a7c99604c0156883a789e02344bc60bd43b01b9e33964ca00f311d349f32525ad25b3b0491d4872d
-Size (rack-3.2.7.gem) = 121344 bytes
+BLAKE2s (rack-3.2.8.gem) = c63b7de117484b16fb62e5fa5ed7e38bb5b8c1fffc64828b0f5bee7e22ab2594
+SHA512 (rack-3.2.8.gem) = ee8b2f0e3b62224887a28ca5f16be8647b6356498d5eb96a70637e7256c8dab35612bdada4b8fcdfe2980e545cab23d54b38262f1fc60f17f0c847c37dd1f6ab
+Size (rack-3.2.8.gem) = 122368 bytes