CVS commit: [pkgsrc-2026Q3] pkgsrc/www/ruby-rack2

["Maya Rashish" <maya%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   maya
Date:           Wed Nov 11 10:45:37 UTC 2026

Modified Files:
        pkgsrc/www/ruby-rack2 [pkgsrc-2026Q3]: Makefile distinfo

Log Message:
Pullup ticket #7368 - requested by taca
www/ruby-rack2: Security fix

Revisions pulled up:
- www/ruby-rack2/Makefile                                       1.18
- www/ruby-rack2/distinfo                                       1.18

---
   Module Name: pkgsrc
   Committed By:        taca
   Date:                Sat Nov  7 16:48:14 UTC 2026

   Modified Files:
        pkgsrc/www/ruby-rack2: Makefile distinfo

   Log Message:
   www/ruby-rack2: update to 2.2.25

   2.2.25 (2026-10-30)

   Security

   * GHSA-5v64-555j-wjxm Multipart parser retains parsed data in its scan
     buffer, allowing denial of service via memory exhaustion.

   * GHSA-wvg4-6p58-3gh3 Rack::Static header rules were matched against an
     unnormalized path, allowing dot segments to bypass them.

   * GHSA-p8x9-v4hv-2w4g Multipart requests with more than one boundary
     parameter were accepted when the first value was empty or began with a
     quote, semicolon, or comma, bypassing the guard added for CVE-2026-26961.

   Fixed

   * Multipart parser: scan boundary lines with a literal newline search
     instead of a backtracking regexp, which allocated tens of megabytes per
     scan for long lines and made the scan buffer fix above ineffective on this
     series.


To generate a diff of this commit:
cvs rdiff -u -r1.17 -r1.17.2.1 pkgsrc/www/ruby-rack2/Makefile \
    pkgsrc/www/ruby-rack2/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/ruby-rack2/Makefile
diff -u pkgsrc/www/ruby-rack2/Makefile:1.17 pkgsrc/www/ruby-rack2/Makefile:1.17.2.1
--- pkgsrc/www/ruby-rack2/Makefile:1.17 Thu Aug 13 16:34:44 2026
+++ pkgsrc/www/ruby-rack2/Makefile      Wed Nov 11 10:45:37 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.17 2026/08/13 16:34:44 taca Exp $
+# $NetBSD: Makefile,v 1.17.2.1 2026/11/11 10:45:37 maya Exp $
 
-DISTNAME=      rack-2.2.24
+DISTNAME=      rack-2.2.25
 PKGNAME=       ${RUBY_PKGPREFIX}-${DISTNAME:S/rack/&2/}
 CATEGORIES=    www
 
Index: pkgsrc/www/ruby-rack2/distinfo
diff -u pkgsrc/www/ruby-rack2/distinfo:1.17 pkgsrc/www/ruby-rack2/distinfo:1.17.2.1
--- pkgsrc/www/ruby-rack2/distinfo:1.17 Thu Aug 13 16:34:44 2026
+++ pkgsrc/www/ruby-rack2/distinfo      Wed Nov 11 10:45:37 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.17 2026/08/13 16:34:44 taca Exp $
+$NetBSD: distinfo,v 1.17.2.1 2026/11/11 10:45:37 maya Exp $
 
-BLAKE2s (rack-2.2.24.gem) = ddd16f2c12aa64b4267e1d3574c76a5d356364cf8f9b840338fb8083c50eaa36
-SHA512 (rack-2.2.24.gem) = c03bc7033f69ae3ba4d31d56de9d244c01cd931a97f34a434b4957933d684160554e2e4212723b7119c2df09b4f09b0ca52f33f980e8444a15467be64a818ba9
-Size (rack-2.2.24.gem) = 157184 bytes
+BLAKE2s (rack-2.2.25.gem) = c9f08e6985055e036cedb8a40e22d2f4b608b12f58a53706bb9c078841c314a1
+SHA512 (rack-2.2.25.gem) = 8da00f400e5c343de859ff581d85bcbc2e5a4a9a7292d5afd5c2f76442e25b73d44945bd75e59573dd0d210da730732eea2856f5ba02a5bfb91f9d31b4c68c13
+Size (rack-2.2.25.gem) = 157696 bytes