CVS commit: [pkgsrc-2026Q3] pkgsrc/www/ruby-mechanize

To: pkgsrc-changes%NetBSD.org@localhost
Subject: CVS commit: [pkgsrc-2026Q3] pkgsrc/www/ruby-mechanize
From: "Maya Rashish" <maya%netbsd.org@localhost>
Date: Wed, 11 Nov 2026 10:51:24 +0000

Module Name:    pkgsrc
Committed By:   maya
Date:           Wed Nov 11 10:51:24 UTC 2026

Modified Files:
        pkgsrc/www/ruby-mechanize [pkgsrc-2026Q3]: Makefile PLIST distinfo

Log Message:
Pullup ticket #7373 - requested by taca
www/ruby-mechanize: Security fix

Revisions pulled up:
- www/ruby-mechanize/Makefile                                   1.33
- www/ruby-mechanize/PLIST                                      1.20
- www/ruby-mechanize/distinfo                                   1.30

---
   Module Name: pkgsrc
   Committed By:        taca
   Date:                Sun Nov  8 14:01:18 UTC 2026

   Modified Files:
        pkgsrc/www/ruby-mechanize: Makefile PLIST distinfo

   Log Message:
   www/ruby-mechanize: update to 2.14.2

   2.14.2 (2026-10-26)

   Security

   * A malicious server can no longer make Mechanize::FileSaver, or
     Mechanize::DirectorySaver with decode_filename: true, write files outside
     the save directory.  Only applications that register one of these as a
     pluggable parser are affected.  GHSA-hxgc-9476-fc65

   Improved

   * The gem no longer packages the test suite, the test certificates, or the
     example scripts, which makes it about a third smaller.  It still packages
     test/htdocs/, which Mechanize::TestCase needs.  (#667) @yuri-zubov

   * Mechanize::TestCase fake responses work with net-http 0.10.0 and later,
     which reads response lines with Net::BufferedIO#readuntil.  Previously a
     chunked response body raised NoMethodError.  The fake socket is now a
     Net::BufferedIO, like a real one, so read_body yields fragments of at most
     16 KiB, and a body shorter than its Content-Length raises EOFError when
     ignore_eof is false.


To generate a diff of this commit:
cvs rdiff -u -r1.32 -r1.32.2.1 pkgsrc/www/ruby-mechanize/Makefile
cvs rdiff -u -r1.19 -r1.19.2.1 pkgsrc/www/ruby-mechanize/PLIST
cvs rdiff -u -r1.29 -r1.29.2.1 pkgsrc/www/ruby-mechanize/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/ruby-mechanize/Makefile
diff -u pkgsrc/www/ruby-mechanize/Makefile:1.32 pkgsrc/www/ruby-mechanize/Makefile:1.32.2.1
--- pkgsrc/www/ruby-mechanize/Makefile:1.32     Sun Sep  6 16:17:28 2026
+++ pkgsrc/www/ruby-mechanize/Makefile  Wed Nov 11 10:51:24 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.32 2026/09/06 16:17:28 taca Exp $
+# $NetBSD: Makefile,v 1.32.2.1 2026/11/11 10:51:24 maya Exp $
 
-DISTNAME=      mechanize-2.14.1
+DISTNAME=      mechanize-2.14.2
 CATEGORIES=    www
 
 MAINTAINER=    minskim%NetBSD.org@localhost

Index: pkgsrc/www/ruby-mechanize/PLIST
diff -u pkgsrc/www/ruby-mechanize/PLIST:1.19 pkgsrc/www/ruby-mechanize/PLIST:1.19.2.1
--- pkgsrc/www/ruby-mechanize/PLIST:1.19        Sun Sep  6 16:17:28 2026
+++ pkgsrc/www/ruby-mechanize/PLIST     Wed Nov 11 10:51:24 2026
@@ -1,26 +1,11 @@
-@comment $NetBSD: PLIST,v 1.19 2026/09/06 16:17:28 taca Exp $
+@comment $NetBSD: PLIST,v 1.19.2.1 2026/11/11 10:51:24 maya Exp $
 ${GEM_HOME}/cache/${GEM_NAME}.gem
-${GEM_LIBDIR}/.autotest
-${GEM_LIBDIR}/.github/dependabot.yml
-${GEM_LIBDIR}/.github/workflows/ci.yml
-${GEM_LIBDIR}/.github/workflows/upstream.yml
-${GEM_LIBDIR}/.gitignore
-${GEM_LIBDIR}/.yardopts
 ${GEM_LIBDIR}/CHANGELOG.md
 ${GEM_LIBDIR}/EXAMPLES.rdoc
 ${GEM_LIBDIR}/GUIDE.rdoc
-${GEM_LIBDIR}/Gemfile
 ${GEM_LIBDIR}/LICENSE.txt
 ${GEM_LIBDIR}/README.md
-${GEM_LIBDIR}/Rakefile
 ${GEM_LIBDIR}/SECURITY.md
-${GEM_LIBDIR}/examples/flickr_upload.rb
-${GEM_LIBDIR}/examples/latest_user_agents.rb
-${GEM_LIBDIR}/examples/mech-dump.rb
-${GEM_LIBDIR}/examples/proxy_req.rb
-${GEM_LIBDIR}/examples/rubygems.rb
-${GEM_LIBDIR}/examples/spider.rb
-${GEM_LIBDIR}/examples/wikipedia_links_to_philosophy.rb
 ${GEM_LIBDIR}/lib/mechanize.rb
 ${GEM_LIBDIR}/lib/mechanize/chunked_termination_error.rb
 ${GEM_LIBDIR}/lib/mechanize/content_type_error.rb
@@ -111,12 +96,6 @@ ${GEM_LIBDIR}/lib/mechanize/unsupported_
 ${GEM_LIBDIR}/lib/mechanize/util.rb
 ${GEM_LIBDIR}/lib/mechanize/version.rb
 ${GEM_LIBDIR}/lib/mechanize/xml_file.rb
-${GEM_LIBDIR}/mechanize.gemspec
-${GEM_LIBDIR}/test/data/htpasswd
-${GEM_LIBDIR}/test/data/server.crt
-${GEM_LIBDIR}/test/data/server.csr
-${GEM_LIBDIR}/test/data/server.key
-${GEM_LIBDIR}/test/data/server.pem
 ${GEM_LIBDIR}/test/htdocs/alt_text.html
 ${GEM_LIBDIR}/test/htdocs/bad_form_test.html
 ${GEM_LIBDIR}/test/htdocs/button.jpg
@@ -164,52 +143,4 @@ ${GEM_LIBDIR}/test/htdocs/tc_relative_li
 ${GEM_LIBDIR}/test/htdocs/tc_textarea.html
 ${GEM_LIBDIR}/test/htdocs/test_click.html
 ${GEM_LIBDIR}/test/htdocs/unusual______.html
-${GEM_LIBDIR}/test/test_mechanize.rb
-${GEM_LIBDIR}/test/test_mechanize_cookie.rb
-${GEM_LIBDIR}/test/test_mechanize_cookie_jar.rb
-${GEM_LIBDIR}/test/test_mechanize_directory_saver.rb
-${GEM_LIBDIR}/test/test_mechanize_download.rb
-${GEM_LIBDIR}/test/test_mechanize_element_not_found_error.rb
-${GEM_LIBDIR}/test/test_mechanize_file.rb
-${GEM_LIBDIR}/test/test_mechanize_file_connection.rb
-${GEM_LIBDIR}/test/test_mechanize_file_request.rb
-${GEM_LIBDIR}/test/test_mechanize_file_response.rb
-${GEM_LIBDIR}/test/test_mechanize_file_saver.rb
-${GEM_LIBDIR}/test/test_mechanize_form.rb
-${GEM_LIBDIR}/test/test_mechanize_form_check_box.rb
-${GEM_LIBDIR}/test/test_mechanize_form_encoding.rb
-${GEM_LIBDIR}/test/test_mechanize_form_field.rb
-${GEM_LIBDIR}/test/test_mechanize_form_file_upload.rb
-${GEM_LIBDIR}/test/test_mechanize_form_image_button.rb
-${GEM_LIBDIR}/test/test_mechanize_form_keygen.rb
-${GEM_LIBDIR}/test/test_mechanize_form_multi_select_list.rb
-${GEM_LIBDIR}/test/test_mechanize_form_option.rb
-${GEM_LIBDIR}/test/test_mechanize_form_radio_button.rb
-${GEM_LIBDIR}/test/test_mechanize_form_select_list.rb
-${GEM_LIBDIR}/test/test_mechanize_form_textarea.rb
-${GEM_LIBDIR}/test/test_mechanize_headers.rb
-${GEM_LIBDIR}/test/test_mechanize_history.rb
-${GEM_LIBDIR}/test/test_mechanize_http_agent.rb
-${GEM_LIBDIR}/test/test_mechanize_http_auth_challenge.rb
-${GEM_LIBDIR}/test/test_mechanize_http_auth_realm.rb
-${GEM_LIBDIR}/test/test_mechanize_http_auth_store.rb
-${GEM_LIBDIR}/test/test_mechanize_http_content_disposition_parser.rb
-${GEM_LIBDIR}/test/test_mechanize_http_www_authenticate_parser.rb
-${GEM_LIBDIR}/test/test_mechanize_image.rb
-${GEM_LIBDIR}/test/test_mechanize_link.rb
-${GEM_LIBDIR}/test/test_mechanize_page.rb
-${GEM_LIBDIR}/test/test_mechanize_page_encoding.rb
-${GEM_LIBDIR}/test/test_mechanize_page_frame.rb
-${GEM_LIBDIR}/test/test_mechanize_page_image.rb
-${GEM_LIBDIR}/test/test_mechanize_page_link.rb
-${GEM_LIBDIR}/test/test_mechanize_page_meta_refresh.rb
-${GEM_LIBDIR}/test/test_mechanize_parser.rb
-${GEM_LIBDIR}/test/test_mechanize_pluggable_parser.rb
-${GEM_LIBDIR}/test/test_mechanize_redirect_limit_reached_error.rb
-${GEM_LIBDIR}/test/test_mechanize_redirect_not_get_or_head_error.rb
-${GEM_LIBDIR}/test/test_mechanize_response_read_error.rb
-${GEM_LIBDIR}/test/test_mechanize_subclass.rb
-${GEM_LIBDIR}/test/test_mechanize_util.rb
-${GEM_LIBDIR}/test/test_mechanize_xml_file.rb
-${GEM_LIBDIR}/test/test_multi_select.rb
 ${GEM_HOME}/specifications/${GEM_NAME}.gemspec

Index: pkgsrc/www/ruby-mechanize/distinfo
diff -u pkgsrc/www/ruby-mechanize/distinfo:1.29 pkgsrc/www/ruby-mechanize/distinfo:1.29.2.1
--- pkgsrc/www/ruby-mechanize/distinfo:1.29     Sun Sep  6 16:17:28 2026
+++ pkgsrc/www/ruby-mechanize/distinfo  Wed Nov 11 10:51:24 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.29 2026/09/06 16:17:28 taca Exp $
+$NetBSD: distinfo,v 1.29.2.1 2026/11/11 10:51:24 maya Exp $
 
-BLAKE2s (mechanize-2.14.1.gem) = 90353cbfbd6e9a4e915d4b65bd928cc4287d287db83486d8a102802d16231174
-SHA512 (mechanize-2.14.1.gem) = d15d877d6514ab479a178aa682244e5a521256ca431f329be44045e5a80843ba4864919bea49376b1dc6ab400cdaae0e5fc14b99b1ce2091e0d6c078633153ad
-Size (mechanize-2.14.1.gem) = 148992 bytes
+BLAKE2s (mechanize-2.14.2.gem) = 23e5d22ef1e9cc7fcc98bf6bef79a07de695cb82d921eb4643148bcc5cde84ef
+SHA512 (mechanize-2.14.2.gem) = 14cbfd4bde1ca588708683e1023b5f77841e7aec2a27e3c7e6cecd56509dbcd7ca8c0a29799b59437668f04e4d9d061ce21a354214dc7746731efcfba9d9a8f3
+Size (mechanize-2.14.2.gem) = 96256 bytes

Prev by Date: CVS commit: [pkgsrc-2026Q3] pkgsrc/www/ruby-loofah
Next by Date: CVS commit: [pkgsrc-2026Q3] pkgsrc/www/p5-Catalyst-Plugin-Authentication
Previous by Thread: CVS commit: [pkgsrc-2026Q3] pkgsrc/www/ruby-loofah
Next by Thread: CVS commit: [pkgsrc-2026Q3] pkgsrc/www/p5-Catalyst-Plugin-Authentication
Indexes:

Home | Main Index | Thread Index | Old Index