CVS commit: [pkgsrc-2026Q3] pkgsrc/www/ruby-rack

["Maya Rashish" <maya%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   maya
Date:           Wed Nov 11 10:45:02 UTC 2026

Modified Files:
        pkgsrc/www/ruby-rack [pkgsrc-2026Q3]: Makefile distinfo

Log Message:
Pullup ticket #7367 - requested by taca
www/ruby-rack: Security fix

Revisions pulled up:
- www/ruby-rack/Makefile                                        1.59
- www/ruby-rack/distinfo                                        1.57

---
   Module Name: pkgsrc
   Committed By:        taca
   Date:                Sat Nov  7 16:46:21 UTC 2026

   Modified Files:
        pkgsrc/www/ruby-rack: Makefile distinfo

   Log Message:
   www/ruby-rack: update to 3.2.8

   3.2.8 (2026-10-30)

   Security

   * GHSA-5v64-555j-wjxm Multipart parser retains parsed data in its scan
     buffer, allowing denial of service via memory exhaustion.

   * GHSA-wvg4-6p58-3gh3 Rack::Static header rules were matched against an
     unnormalized path, allowing dot segments to bypass them.

   * GHSA-2j8w-xcrc-x985 Rack::Request#host_with_port, #base_url, and #url
     returned the raw authority when it was invalid; host_with_port now returns
     nil in that case.

   * GHSA-p8x9-v4hv-2w4g Multipart requests with more than one boundary
     parameter were accepted when the first value was empty or began with a
     quote, semicolon, or comma, bypassing the guard added for CVE-2026-26961.

   Fixed

   * Rack::Multipart::UploadedFile now delegates keyword arguments to the
     wrapped tempfile.  Calls such as uploaded_file.readlines(chomp: true)
     raised TypeError on Ruby 3.0+.  (#2481, #2501, @SeanLF)


To generate a diff of this commit:
cvs rdiff -u -r1.58 -r1.58.2.1 pkgsrc/www/ruby-rack/Makefile
cvs rdiff -u -r1.56 -r1.56.2.1 pkgsrc/www/ruby-rack/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/ruby-rack/Makefile
diff -u pkgsrc/www/ruby-rack/Makefile:1.58 pkgsrc/www/ruby-rack/Makefile:1.58.2.1
--- pkgsrc/www/ruby-rack/Makefile:1.58  Thu Aug 13 16:30:29 2026
+++ pkgsrc/www/ruby-rack/Makefile       Wed Nov 11 10:45:02 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.58 2026/08/13 16:30:29 taca Exp $
+# $NetBSD: Makefile,v 1.58.2.1 2026/11/11 10:45:02 maya Exp $
 
-DISTNAME=      rack-3.2.7
+DISTNAME=      rack-3.2.8
 CATEGORIES=    www
 
 MAINTAINER=    pkgsrc-users%NetBSD.org@localhost

Index: pkgsrc/www/ruby-rack/distinfo
diff -u pkgsrc/www/ruby-rack/distinfo:1.56 pkgsrc/www/ruby-rack/distinfo:1.56.2.1
--- pkgsrc/www/ruby-rack/distinfo:1.56  Thu Aug 13 16:30:29 2026
+++ pkgsrc/www/ruby-rack/distinfo       Wed Nov 11 10:45:02 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.56 2026/08/13 16:30:29 taca Exp $
+$NetBSD: distinfo,v 1.56.2.1 2026/11/11 10:45:02 maya Exp $
 
-BLAKE2s (rack-3.2.7.gem) = 718491e7665840c179f5eeb72c070640924fd6ef9e31e316fcfdeadf7145e1b7
-SHA512 (rack-3.2.7.gem) = 1f2da42ffffd4701b093a3cca57f93919e5c9a6323fb6306a7c99604c0156883a789e02344bc60bd43b01b9e33964ca00f311d349f32525ad25b3b0491d4872d
-Size (rack-3.2.7.gem) = 121344 bytes
+BLAKE2s (rack-3.2.8.gem) = c63b7de117484b16fb62e5fa5ed7e38bb5b8c1fffc64828b0f5bee7e22ab2594
+SHA512 (rack-3.2.8.gem) = ee8b2f0e3b62224887a28ca5f16be8647b6356498d5eb96a70637e7256c8dab35612bdada4b8fcdfe2980e545cab23d54b38262f1fc60f17f0c847c37dd1f6ab
+Size (rack-3.2.8.gem) = 122368 bytes