CVS commit: [pkgsrc-2026Q3] pkgsrc/lang

["Maya Rashish" <maya%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   maya
Date:           Mon Nov  9 08:24:09 UTC 2026

Modified Files:
        pkgsrc/lang/ruby [pkgsrc-2026Q3]: rubyversion.mk
        pkgsrc/lang/ruby34 [pkgsrc-2026Q3]: distinfo

Log Message:
Pullup ticket #7337 - requested by taca
lang/ruby34: Security fix

Revisions pulled up:
- lang/ruby/rubyversion.mk                                      1.334
- lang/ruby34/distinfo                                          1.21

---
   Module Name: pkgsrc
   Committed By:        taca
   Date:                Sun Oct 25 14:32:43 UTC 2026

   Modified Files:
        pkgsrc/lang/ruby: rubyversion.mk
        pkgsrc/lang/ruby34: distinfo

   Log Message:
   lang/ruby34: update to 3.4.12

   This update contains these security fixes.

   * CVE-2026-89078: Double Free issue in Regular Expression Parser (GitLa=
   b
     19.4.1)

   * CVE-2026-93577: Integer Overflow issue in Regular Expression Compiler=

     (GitLab 19.4.1)

   * CVE-2026-97229: Integer Overflow issue in CI/CD Regular Expression
     Compiler (GitLab 19.4.2)

   * CVE-2026-110264: Integer Overflow issue in Regular Expression Compile=
   r
     (GitLab 19.5.1)

   3.4.12 (2026-10-23)

   * Bug #22342: IO#gets can ignore the limit argument in some edge cases

   * Bug #22284: Passing an object with to_int to curry as its arity cause=
   s
     problems with LLP64.

   * Bug #22387: str_shared_replace incorrectly recalculates termlen

   * Bug #22391: Fix propagation of errno in rb_io_maybe_wait.

   * Bug #22388: Use-after-free when an Enumerable retains its each block

   * Bug #22326: heap buffer overflow in array.values_at()

   * Bug #22423: String#initialize(encoding:) stores an inflated capacity =
   and
     writes past the malloc'd buffer on append (rb_str_init termlen
     double-adjust)

   * Prevent double free for too big repetition quantifiers by makenowjust=
    =B7
     Pull Request #13332

   * Bug #22415: Thread.handle_interrupt needs to preserve errinfo

   * Bug #22406: Process.fork can leave the child unable to resolve hostna=
   mes:
     getaddrinfo helper threads take glibc's resolver lock after releasing=
    the
     fork lock

   * Bug #22445: On macOS, a child of Kernel#fork can abort with "[BUG]
     pthread_rwlock_destroy: Resource busy (EBUSY)"

   * Reject overflowed repeat/null-check IDs in huge regexps by makenowjus=
   t =B7
     Pull Request #16801

   * Bug #22384: Regexp compile error in the 2nd+ branch of a top-level
     alternation leaks the parse tree (regression from #13332, Ruby 4.0)


To generate a diff of this commit:
cvs rdiff -u -r1.331.2.2 -r1.331.2.3 pkgsrc/lang/ruby/rubyversion.mk
cvs rdiff -u -r1.18.2.1 -r1.18.2.2 pkgsrc/lang/ruby34/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/ruby/rubyversion.mk
diff -u pkgsrc/lang/ruby/rubyversion.mk:1.331.2.2 pkgsrc/lang/ruby/rubyversion.mk:1.331.2.3
--- pkgsrc/lang/ruby/rubyversion.mk:1.331.2.2   Mon Nov  9 08:16:34 2026
+++ pkgsrc/lang/ruby/rubyversion.mk     Mon Nov  9 08:24:08 2026
@@ -1,4 +1,4 @@
-# $NetBSD: rubyversion.mk,v 1.331.2.2 2026/11/09 08:16:34 maya Exp $
+# $NetBSD: rubyversion.mk,v 1.331.2.3 2026/11/09 08:24:08 maya Exp $
 #
 
 # This file determines which Ruby version is used as a dependency for
@@ -213,7 +213,7 @@ RUBY_VERSION_REQD?= ${PKGNAME_REQD:C/rub
 
 # current supported Ruby's version
 RUBY33_VERSION=                3.3.12
-RUBY34_VERSION=                3.4.11
+RUBY34_VERSION=                3.4.12
 RUBY40_VERSION=                4.0.9
 
 # current API compatible version; used for version of shared library

Index: pkgsrc/lang/ruby34/distinfo
diff -u pkgsrc/lang/ruby34/distinfo:1.18.2.1 pkgsrc/lang/ruby34/distinfo:1.18.2.2
--- pkgsrc/lang/ruby34/distinfo:1.18.2.1        Tue Oct 20 23:07:18 2026
+++ pkgsrc/lang/ruby34/distinfo Mon Nov  9 08:24:09 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.18.2.1 2026/10/20 23:07:18 maya Exp $
+$NetBSD: distinfo,v 1.18.2.2 2026/11/09 08:24:09 maya Exp $
 
-BLAKE2s (ruby-3.4.11.tar.xz) = e1314342598a9634334df928eef6bf0939b110f0ea5d99c39fe3adf7f73600a9
-SHA512 (ruby-3.4.11.tar.xz) = 466952978880190ca8eae2709a42f4cb8983aa2fa329219ef1cbe309de549928d4f94078cd70b168b313833ed9b7f8bbbe3c21ef2e772a3d3bf0c68cab669d2a
-Size (ruby-3.4.11.tar.xz) = 16712500 bytes
+BLAKE2s (ruby-3.4.12.tar.xz) = b4f95d70cf152504fc5569b4d3385bafd8e307c2cfc0dcce000fafc532ee77ee
+SHA512 (ruby-3.4.12.tar.xz) = 7866ed652921f9f0d601e1e323d29fddee3506cfd89e258cab7601786bffec8a17245468d517d246ecfa7fa9a982b73cfff0aaf6534444753e8b6add297bfbd3
+Size (ruby-3.4.12.tar.xz) = 16732860 bytes
 SHA1 (patch-common.mk) = c23eed58427b2fd4ba8fdb3692f609701a666c6d
 SHA1 (patch-configure) = ff1b1e659ddc7cb1d62a71e1447df55f1f7b07c2
 SHA1 (patch-ext_openssl_openssl__missing.h) = 3f8d79736fd14806dfaf76e333eec63ff3ff5890