CVS commit: [pkgsrc-2026Q3] pkgsrc/lang

["Maya Rashish" <maya%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   maya
Date:           Mon Nov  9 08:39:05 UTC 2026

Modified Files:
        pkgsrc/lang/ruby [pkgsrc-2026Q3]: rubyversion.mk
        pkgsrc/lang/ruby33 [pkgsrc-2026Q3]: Makefile distinfo
Removed Files:
        pkgsrc/lang/ruby33/patches [pkgsrc-2026Q3]: patch-lib_resolv.rb

Log Message:
Pullup ticket #7338 - requested by taca
lang/ruby33: Security fix

Revisions pulled up:
- lang/ruby/rubyversion.mk                                      1.335
- lang/ruby33/Makefile                                          1.16
- lang/ruby33/distinfo                                          1.21
- lang/ruby33/patches/patch-lib_resolv.rb                       deleted

---
   Module Name: pkgsrc
   Committed By:        taca
   Date:                Sun Oct 25 14:35:56 UTC 2026

   Modified Files:
        pkgsrc/lang/ruby: rubyversion.mk
        pkgsrc/lang/ruby33: Makefile distinfo
   Removed Files:
        pkgsrc/lang/ruby33/patches: patch-lib_resolv.rb

   Log Message:
   lang/ruby33: update to 3.3.13

   This update contains these security fixes.

   * CVE-2026-89078: Double Free issue in Regular Expression Parser (GitLa=
   b
     19.4.1)

   * CVE-2026-93577: Integer Overflow issue in Regular Expression Compiler=

     (GitLab 19.4.1)

   * CVE-2026-97229: Integer Overflow issue in CI/CD Regular Expression
     Compiler (GitLab 19.4.2)

   * CVE-2026-110264: Integer Overflow issue in Regular Expression Compile=
   r
     (GitLab 19.5.1)

   3.3.13 (2026-10-23)

   * Bug #21703: RUBY_CRASH_REPORT does not work when shelling out in some=

     cases

   * Bug #22311: Build crashes on macOS 26 with the macOS 27 SDK because
     pipe2() and dup3() are unavailable

   * Prevent double free for too big repetition quantifiers by makenowjust=
    =B7
     Pull Request #13332

   * Reject overflowed repeat/null-check IDs in huge regexps by makenowjus=
   t =B7
     Pull Request #16801

   * Bug #22384: Regexp compile error in the 2nd+ branch of a top-level
     alternation leaks the parse tree (regression from #13332, Ruby 4.0)


To generate a diff of this commit:
cvs rdiff -u -r1.331.2.3 -r1.331.2.4 pkgsrc/lang/ruby/rubyversion.mk
cvs rdiff -u -r1.15 -r1.15.2.1 pkgsrc/lang/ruby33/Makefile
cvs rdiff -u -r1.20 -r1.20.2.1 pkgsrc/lang/ruby33/distinfo
cvs rdiff -u -r1.3 -r0 pkgsrc/lang/ruby33/patches/patch-lib_resolv.rb

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/ruby/rubyversion.mk
diff -u pkgsrc/lang/ruby/rubyversion.mk:1.331.2.3 pkgsrc/lang/ruby/rubyversion.mk:1.331.2.4
--- pkgsrc/lang/ruby/rubyversion.mk:1.331.2.3   Mon Nov  9 08:24:08 2026
+++ pkgsrc/lang/ruby/rubyversion.mk     Mon Nov  9 08:39:05 2026
@@ -1,4 +1,4 @@
-# $NetBSD: rubyversion.mk,v 1.331.2.3 2026/11/09 08:24:08 maya Exp $
+# $NetBSD: rubyversion.mk,v 1.331.2.4 2026/11/09 08:39:05 maya Exp $
 #
 
 # This file determines which Ruby version is used as a dependency for
@@ -212,7 +212,7 @@ RUBY_VERSION_REQD?= ${PKGNAME_REQD:C/rub
 .endif
 
 # current supported Ruby's version
-RUBY33_VERSION=                3.3.12
+RUBY33_VERSION=                3.3.13
 RUBY34_VERSION=                3.4.12
 RUBY40_VERSION=                4.0.9
 

Index: pkgsrc/lang/ruby33/Makefile
diff -u pkgsrc/lang/ruby33/Makefile:1.15 pkgsrc/lang/ruby33/Makefile:1.15.2.1
--- pkgsrc/lang/ruby33/Makefile:1.15    Sat Sep 19 13:19:40 2026
+++ pkgsrc/lang/ruby33/Makefile Mon Nov  9 08:39:05 2026
@@ -1,8 +1,7 @@
-# $NetBSD: Makefile,v 1.15 2026/09/19 13:19:40 taca Exp $
+# $NetBSD: Makefile,v 1.15.2.1 2026/11/09 08:39:05 maya Exp $
 
 DISTNAME=      ${RUBY_DISTNAME}
 PKGNAME=       ${RUBY_PKGPREFIX}-${RUBY_VERSION}
-PKGREVISION=   2
 CATEGORIES=    lang ruby
 MASTER_SITES=  ${MASTER_SITE_RUBY}
 

Index: pkgsrc/lang/ruby33/distinfo
diff -u pkgsrc/lang/ruby33/distinfo:1.20 pkgsrc/lang/ruby33/distinfo:1.20.2.1
--- pkgsrc/lang/ruby33/distinfo:1.20    Wed Sep 16 14:50:17 2026
+++ pkgsrc/lang/ruby33/distinfo Mon Nov  9 08:39:05 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.20 2026/09/16 14:50:17 taca Exp $
+$NetBSD: distinfo,v 1.20.2.1 2026/11/09 08:39:05 maya Exp $
 
-BLAKE2s (ruby-3.3.12.tar.xz) = 6f9811297c07bd766d7a79cbe6b9767be3373fdd461458779e1717bd346d270a
-SHA512 (ruby-3.3.12.tar.xz) = 1755901f5d1e66250e4f9f4e3a0bf31ec25055f1cb86fafc68281f6d108e9cf5329a6c74c221b1a31aa7de78e9c2d8aa7b76faf39acfce44c5ed94cf7e766f3f
-Size (ruby-3.3.12.tar.xz) = 15891224 bytes
+BLAKE2s (ruby-3.3.13.tar.xz) = 167e653ccd74fb36883eafc63d8f53a406c7ad84248e840a31bcd398ed6cf804
+SHA512 (ruby-3.3.13.tar.xz) = 906e270e2629b44e469265e08d693f996b467a3fc165fbdb9b8f6f7b37effe4fdae9d4968e72a809d1381e35279cb10b6630d40fac31a634981deb4c30ff325c
+Size (ruby-3.3.13.tar.xz) = 15878972 bytes
 SHA1 (patch-common.mk) = c23eed58427b2fd4ba8fdb3692f609701a666c6d
 SHA1 (patch-configure) = 031792cb999e3624236f8afc3363492b437e35d7
 SHA1 (patch-ext_openssl_openssl__missing.h) = 3f8d79736fd14806dfaf76e333eec63ff3ff5890
@@ -10,8 +10,6 @@ SHA1 (patch-include_ruby_internal_static
 SHA1 (patch-lib_mkmf.rb) = 4a3cd18548dbdf43a13695d4e76f817c0347e335
 SHA1 (patch-lib_rdoc_encoding.rb) = 0e82d2942d9bfcb67dc7c994889d7bc5ec2ae85a
 SHA1 (patch-lib_rdoc_parser_c.rb) = 063d1edd3f4b9416f759266edf1cf070f2f9faef
-SHA1 (patch-lib_resolv.gemspec) = d9f93eba29243f5776c54f626486790917d2b1d5
-SHA1 (patch-lib_resolv.rb) = 67732ec5ef16d75c51ae40e39844bb644f4ab126
 SHA1 (patch-lib_rubygems.rb) = 81af71ae9b0c3fef2ad1de88a542b3ece14b4519
 SHA1 (patch-lib_rubygems_commands_setup__command.rb) = 66c475a5308deb2ed5096b88cf65549732f87421
 SHA1 (patch-lib_rubygems_config__file.rb) = 584f8cd9ef1d1b9bf25efc7e85c2219166db7ac9