CVS commit: pkgsrc/www/ruby-rack2

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Sat Nov  7 16:48:14 UTC 2026

Modified Files:
        pkgsrc/www/ruby-rack2: Makefile distinfo

Log Message:
www/ruby-rack2: update to 2.2.25

2.2.25 (2026-10-30)

Security

* GHSA-5v64-555j-wjxm Multipart parser retains parsed data in its scan
  buffer, allowing denial of service via memory exhaustion.

* GHSA-wvg4-6p58-3gh3 Rack::Static header rules were matched against an
  unnormalized path, allowing dot segments to bypass them.

* GHSA-p8x9-v4hv-2w4g Multipart requests with more than one boundary
  parameter were accepted when the first value was empty or began with a
  quote, semicolon, or comma, bypassing the guard added for CVE-2026-26961.

Fixed

* Multipart parser: scan boundary lines with a literal newline search
  instead of a backtracking regexp, which allocated tens of megabytes per
  scan for long lines and made the scan buffer fix above ineffective on this
  series.


To generate a diff of this commit:
cvs rdiff -u -r1.17 -r1.18 pkgsrc/www/ruby-rack2/Makefile \
    pkgsrc/www/ruby-rack2/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/ruby-rack2/Makefile
diff -u pkgsrc/www/ruby-rack2/Makefile:1.17 pkgsrc/www/ruby-rack2/Makefile:1.18
--- pkgsrc/www/ruby-rack2/Makefile:1.17 Thu Aug 13 16:34:44 2026
+++ pkgsrc/www/ruby-rack2/Makefile      Sat Nov  7 16:48:14 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.17 2026/08/13 16:34:44 taca Exp $
+# $NetBSD: Makefile,v 1.18 2026/11/07 16:48:14 taca Exp $
 
-DISTNAME=      rack-2.2.24
+DISTNAME=      rack-2.2.25
 PKGNAME=       ${RUBY_PKGPREFIX}-${DISTNAME:S/rack/&2/}
 CATEGORIES=    www
 
Index: pkgsrc/www/ruby-rack2/distinfo
diff -u pkgsrc/www/ruby-rack2/distinfo:1.17 pkgsrc/www/ruby-rack2/distinfo:1.18
--- pkgsrc/www/ruby-rack2/distinfo:1.17 Thu Aug 13 16:34:44 2026
+++ pkgsrc/www/ruby-rack2/distinfo      Sat Nov  7 16:48:14 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.17 2026/08/13 16:34:44 taca Exp $
+$NetBSD: distinfo,v 1.18 2026/11/07 16:48:14 taca Exp $
 
-BLAKE2s (rack-2.2.24.gem) = ddd16f2c12aa64b4267e1d3574c76a5d356364cf8f9b840338fb8083c50eaa36
-SHA512 (rack-2.2.24.gem) = c03bc7033f69ae3ba4d31d56de9d244c01cd931a97f34a434b4957933d684160554e2e4212723b7119c2df09b4f09b0ca52f33f980e8444a15467be64a818ba9
-Size (rack-2.2.24.gem) = 157184 bytes
+BLAKE2s (rack-2.2.25.gem) = c9f08e6985055e036cedb8a40e22d2f4b608b12f58a53706bb9c078841c314a1
+SHA512 (rack-2.2.25.gem) = 8da00f400e5c343de859ff581d85bcbc2e5a4a9a7292d5afd5c2f76442e25b73d44945bd75e59573dd0d210da730732eea2856f5ba02a5bfb91f9d31b4c68c13
+Size (rack-2.2.25.gem) = 157696 bytes