CVS commit: [pkgsrc-2026Q3] pkgsrc/security/ruby-oauth

["Maya Rashish" <maya%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   maya
Date:           Wed Nov 11 13:31:20 UTC 2026

Modified Files:
        pkgsrc/security/ruby-oauth [pkgsrc-2026Q3]: Makefile PLIST distinfo

Log Message:
Pullup ticket #7382 - requested by taca
security/ruby-oauth: Security fix

Revisions pulled up:
- security/ruby-oauth/Makefile                                  1.29
- security/ruby-oauth/PLIST                                     1.16
- security/ruby-oauth/distinfo                                  1.26

---
   Module Name: pkgsrc
   Committed By:        taca
   Date:                Sun Nov  8 13:44:13 UTC 2026

   Modified Files:
        pkgsrc/security/ruby-oauth: Makefile PLIST distinfo

   Log Message:
   security/ruby-oauth: update to 1.1.9

   1.1.9 (2026-11-07)

   Added

   * access_token_cross_origin_requests consumer option (default false):
     AccessToken#request now refuses an absolute service URI whose origin
     differs from the configured :site, raising OAuth::Error, so the signed
     OAuth Authorization header is not sent to a different host.  Same-origin
     absolute URIs and relative paths are unaffected.  Set the option to true
     to restore cross-origin service calls.  [CWE-918]

   * kettle-jem-template-20260720-001 - READMEs can now display configured
     corporate sponsor logos.

   * Spec coverage for OAuth::Client::Helper, the query_string OAuth signing
     scheme in lib/oauth/client/net_http.rb, and the
     OAuth::Error/OAuth::Unauthorized/OAuth::Problem classes — none previously
     had a dedicated spec file.

   * kettle-jem-template-20260720-005 - README Support & Community links now
     include RubyForum.

   * kettle-jem-template-20260726-001 - Projects now include YARD lint
     configuration and documentation dependencies so documentation issues fail
     before generated docs are refreshed.

   * kettle-jem-template-20260727-001 - Spec harness documentation now lists
     the RSpec helpers provided by kettle-test.

   * kettle-jem-template-20260729-005 - Gemspec metadata now publishes this
     project's RubyForum tag as mailing_list_uri, and support docs link to the
     tagged RubyForum community alongside Discord.

   * kettle-jem-template-20260913-001 - Templating now also surfaces a review
     entry in dependency_conflicts.resolve when a direct development dependency
     doesn't support one or more of this project's declared engines: and has no
     template-managed modular home (e.g. sqlite3 on jruby).  Review each entry
     and pick a resolution per the project's own engine support needs.

   Changed

   * [kc] kettle-jem/prepare: updated 22 project files:

        - configuration (2)
        - dependencies (20)

   * [kc] kettle-jem/template: updated 51 project files:

        - code and tests (3)
        - dependencies (7)
        - documentation (2)
        - other (4)
        - workflows (35)

   * Dependency floors raised to the latest releases, including auth-sanitizer
     >= 0.2.4 (Hash#inspect redaction in debug logging, GHSA-cmh8-5q25-68v6).

   * kettle-jem-template-20260716-002 - Generated gemspec manifests now ship
     fewer repository-only files by default to reduce downstream distro
     packaging churn.

   * kettle-jem-template-20260720-002 - Development Gemfiles now use the
     released tree_sitter_language_pack gem 1.13.3 or newer by default.

   * kettle-jem-template-20260725-002 - Version specs now use anonymous_loader
     to cover version.rb without redefining constants, or are removed when
     version specs are not managed for the project.

   * kettle-jem-template-20260728-001 - Generated Ruby workflows now use
     clearer setup-ruby-flash planning and can prepare appraisal-only jobs
     without installing the main Gemfile bundle.

   * kettle-jem-template-20260801-001 - Generated README gem dashboard links
     now use ClickGems instead of BestGems.

   * [kc] kettle-jem/prepare: updated 15 project files:

        - configuration (1)
        - dependencies (14)

   * [kc] kettle-jem/template: updated 50 project files:

        - code and tests (1)
        - configuration (1)
        - dependencies (12)
        - documentation (1)
        - other (3)
        - workflows (32)

   Fixed

   Too many to write here, please refer
   <https://github.com/ruby-oauth/oauth/releases#release-v1.1.9> in detail.


To generate a diff of this commit:
cvs rdiff -u -r1.28 -r1.28.2.1 pkgsrc/security/ruby-oauth/Makefile
cvs rdiff -u -r1.15 -r1.15.2.1 pkgsrc/security/ruby-oauth/PLIST
cvs rdiff -u -r1.25 -r1.25.2.1 pkgsrc/security/ruby-oauth/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/ruby-oauth/Makefile
diff -u pkgsrc/security/ruby-oauth/Makefile:1.28 pkgsrc/security/ruby-oauth/Makefile:1.28.2.1
--- pkgsrc/security/ruby-oauth/Makefile:1.28    Mon Jul 20 05:34:04 2026
+++ pkgsrc/security/ruby-oauth/Makefile Wed Nov 11 13:31:20 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.28 2026/07/20 05:34:04 taca Exp $
+# $NetBSD: Makefile,v 1.28.2.1 2026/11/11 13:31:20 maya Exp $
 
-DISTNAME=      oauth-1.1.8
+DISTNAME=      oauth-1.1.9
 CATEGORIES=    security
 
 MAINTAINER=    pkgsrc-users%NetBSD.org@localhost

Index: pkgsrc/security/ruby-oauth/PLIST
diff -u pkgsrc/security/ruby-oauth/PLIST:1.15 pkgsrc/security/ruby-oauth/PLIST:1.15.2.1
--- pkgsrc/security/ruby-oauth/PLIST:1.15       Mon Jul 20 05:34:04 2026
+++ pkgsrc/security/ruby-oauth/PLIST    Wed Nov 11 13:31:20 2026
@@ -1,16 +1,8 @@
-@comment $NetBSD: PLIST,v 1.15 2026/07/20 05:34:04 taca Exp $
+@comment $NetBSD: PLIST,v 1.15.2.1 2026/11/11 13:31:20 maya Exp $
 ${GEM_HOME}/cache/${GEM_NAME}.gem
 ${GEM_LIBDIR}/CHANGELOG.md
-${GEM_LIBDIR}/CITATION.cff
-${GEM_LIBDIR}/CODE_OF_CONDUCT.md
-${GEM_LIBDIR}/CONTRIBUTING.md
-${GEM_LIBDIR}/FUNDING.md
 ${GEM_LIBDIR}/LICENSE.md
-${GEM_LIBDIR}/MIT.md
 ${GEM_LIBDIR}/README.md
-${GEM_LIBDIR}/RUBOCOP.md
-${GEM_LIBDIR}/SECURITY.md
-${GEM_LIBDIR}/certs/pboling.pem
 ${GEM_LIBDIR}/lib/oauth.rb
 ${GEM_LIBDIR}/lib/oauth/auth_sanitizer.rb
 ${GEM_LIBDIR}/lib/oauth/client.rb
@@ -53,8 +45,5 @@ ${GEM_LIBDIR}/lib/oauth/tokens/request_t
 ${GEM_LIBDIR}/lib/oauth/tokens/server_token.rb
 ${GEM_LIBDIR}/lib/oauth/tokens/token.rb
 ${GEM_LIBDIR}/lib/oauth/version.rb
-${GEM_LIBDIR}/sig/oauth/consumer.rbs
-${GEM_LIBDIR}/sig/oauth/signature/base.rbs
-${GEM_LIBDIR}/sig/oauth/tokens/token.rbs
-${GEM_LIBDIR}/sig/oauth/version.rbs
+${GEM_LIBDIR}/sig/oauth.rbs
 ${GEM_HOME}/specifications/${GEM_NAME}.gemspec

Index: pkgsrc/security/ruby-oauth/distinfo
diff -u pkgsrc/security/ruby-oauth/distinfo:1.25 pkgsrc/security/ruby-oauth/distinfo:1.25.2.1
--- pkgsrc/security/ruby-oauth/distinfo:1.25    Mon Jul 20 05:34:04 2026
+++ pkgsrc/security/ruby-oauth/distinfo Wed Nov 11 13:31:20 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.25 2026/07/20 05:34:04 taca Exp $
+$NetBSD: distinfo,v 1.25.2.1 2026/11/11 13:31:20 maya Exp $
 
-BLAKE2s (oauth-1.1.8.gem) = 4764997ba2eeab2741e3cf5ad9833bf7a4e0088be14d397454a94ac806f7450e
-SHA512 (oauth-1.1.8.gem) = 2b98919f1800817a1fee4737a0bbe0e06d6689232b97705c47b59212f76d0647fcec8c0f654560678e2bfbc2cd73423866853c9cbb8d480f651ebbdc74cbc174
-Size (oauth-1.1.8.gem) = 69120 bytes
+BLAKE2s (oauth-1.1.9.gem) = 449fad5ac5b5d9688213bed9ff4ff6ed51bdcebcc4ea865e5f68358e76f80cf2
+SHA512 (oauth-1.1.9.gem) = 425c792dd9c6d2629557afa7ba630765e8d151c5aa2a840131f7a843125c224617392bc3de5202d62ca771f139b28b3dcaf382617e703be58049db5f56d20412
+Size (oauth-1.1.9.gem) = 58368 bytes