CVS commit: [pkgsrc-2026Q3] pkgsrc/security/ruby-auth-sanitizer

["Maya Rashish" <maya%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   maya
Date:           Wed Nov 11 13:31:55 UTC 2026

Modified Files:
        pkgsrc/security/ruby-auth-sanitizer [pkgsrc-2026Q3]: Makefile PLIST
            distinfo

Log Message:
Pullup ticket #7361 - requested by taca
security/ruby-auth-sanitizer: Security fix

Revisions pulled up:
- security/ruby-auth-sanitizer/Makefile                         1.2
- security/ruby-auth-sanitizer/PLIST                            1.2
- security/ruby-auth-sanitizer/distinfo                         1.2

---
   Module Name: pkgsrc
   Committed By:        taca
   Date:                Mon Nov  2 07:10:59 UTC 2026

   Modified Files:
        pkgsrc/security/ruby-auth-sanitizer: Makefile PLIST distinfo

   Log Message:
   security/ruby-auth-sanitizer: update to 0.2.5

   0.2.4 (2026-10-23)

   Security

   * SanitizedLogger now redacts configured keys in Ruby Hash#inspect output
     (both Ruby 3.4+ {"key" => "value"} / {key: "value"} and pre-3.4
     hash-rocket formats), fixes a mangling bug where the form-pair pattern
     partially matched :key=>"value" pairs, and no longer raises on
     invalid-encoded message bytes.  This closes the OAUTH_DEBUG
     cleartext-logging bypass reported for oauth2 as GHSA-cmh8-5q25-68v6, where
     Faraday renders Hash request bodies with pretty_inspect.  Reported by
     iamibi.

   Other changes are too many to write here, please refer:
   <https://github.com/ruby-oauth/auth-sanitizer/releases#release-v0.2.4>.

   0.2.5 ((2026-10-25)

   Added

   * kettle-jem-template-20260720-001 - READMEs can now display configured
     corporate sponsor logos.

   Changed

   * [kc] kettle-jem/prepare: updated 15 project files:

        - dependencies (15)

   * [kc] kettle-jem/template: updated 7 project files:

        - code and tests (1)
        - dependencies (2)
        - documentation (1)
        - other (2)
        - workflows (1)


To generate a diff of this commit:
cvs rdiff -u -r1.1 -r1.1.2.1 pkgsrc/security/ruby-auth-sanitizer/Makefile \
    pkgsrc/security/ruby-auth-sanitizer/PLIST \
    pkgsrc/security/ruby-auth-sanitizer/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/ruby-auth-sanitizer/Makefile
diff -u pkgsrc/security/ruby-auth-sanitizer/Makefile:1.1 pkgsrc/security/ruby-auth-sanitizer/Makefile:1.1.2.1
--- pkgsrc/security/ruby-auth-sanitizer/Makefile:1.1    Mon Jul 20 05:13:18 2026
+++ pkgsrc/security/ruby-auth-sanitizer/Makefile        Wed Nov 11 13:31:54 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.1 2026/07/20 05:13:18 taca Exp $
+# $NetBSD: Makefile,v 1.1.2.1 2026/11/11 13:31:54 maya Exp $
 
-DISTNAME=      auth-sanitizer-0.2.3
+DISTNAME=      auth-sanitizer-0.2.5
 CATEGORIES=    security
 
 MAINTAINER=    pkgsrc-users%NetBSD.org@localhost
@@ -8,7 +8,7 @@ HOMEPAGE=       https://github.com/ruby-oauth/
 COMMENT=       Configurable KV output redaction
 LICENSE=       mit
 
-DEPENDS+=      ${RUBY_PKGPREFIX}-version_gem>=1.1.14<2:../../devel/ruby-version_gem
+DEPENDS+=      ${RUBY_PKGPREFIX}-version_gem>=1.1.16<2:../../devel/ruby-version_gem
 
 USE_LANGUAGES= # none
 
Index: pkgsrc/security/ruby-auth-sanitizer/PLIST
diff -u pkgsrc/security/ruby-auth-sanitizer/PLIST:1.1 pkgsrc/security/ruby-auth-sanitizer/PLIST:1.1.2.1
--- pkgsrc/security/ruby-auth-sanitizer/PLIST:1.1       Mon Jul 20 05:13:18 2026
+++ pkgsrc/security/ruby-auth-sanitizer/PLIST   Wed Nov 11 13:31:54 2026
@@ -1,23 +1,15 @@
-@comment $NetBSD: PLIST,v 1.1 2026/07/20 05:13:18 taca Exp $
+@comment $NetBSD: PLIST,v 1.1.2.1 2026/11/11 13:31:54 maya Exp $
 ${GEM_HOME}/cache/${GEM_NAME}.gem
 ${GEM_LIBDIR}/CHANGELOG.md
-${GEM_LIBDIR}/CITATION.cff
-${GEM_LIBDIR}/CODE_OF_CONDUCT.md
-${GEM_LIBDIR}/CONTRIBUTING.md
-${GEM_LIBDIR}/FUNDING.md
 ${GEM_LIBDIR}/LICENSE.md
-${GEM_LIBDIR}/MIT.md
 ${GEM_LIBDIR}/README.md
-${GEM_LIBDIR}/RUBOCOP.md
-${GEM_LIBDIR}/SECURITY.md
-${GEM_LIBDIR}/certs/pboling.pem
 ${GEM_LIBDIR}/lib/auth/sanitizer.rb
 ${GEM_LIBDIR}/lib/auth/sanitizer/core.rb
 ${GEM_LIBDIR}/lib/auth/sanitizer/filtered_attributes.rb
 ${GEM_LIBDIR}/lib/auth/sanitizer/sanitized_logger.rb
 ${GEM_LIBDIR}/lib/auth/sanitizer/thing_filter.rb
+${GEM_LIBDIR}/lib/auth/sanitizer/value_sanitizer.rb
 ${GEM_LIBDIR}/lib/auth/sanitizer/version.rb
 ${GEM_LIBDIR}/lib/auth_sanitizer/loader.rb
 ${GEM_LIBDIR}/sig/auth/sanitizer.rbs
-${GEM_LIBDIR}/sig/auth/sanitizer/version.rbs
 ${GEM_HOME}/specifications/${GEM_NAME}.gemspec
Index: pkgsrc/security/ruby-auth-sanitizer/distinfo
diff -u pkgsrc/security/ruby-auth-sanitizer/distinfo:1.1 pkgsrc/security/ruby-auth-sanitizer/distinfo:1.1.2.1
--- pkgsrc/security/ruby-auth-sanitizer/distinfo:1.1    Mon Jul 20 05:13:18 2026
+++ pkgsrc/security/ruby-auth-sanitizer/distinfo        Wed Nov 11 13:31:54 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.1 2026/07/20 05:13:18 taca Exp $
+$NetBSD: distinfo,v 1.1.2.1 2026/11/11 13:31:54 maya Exp $
 
-BLAKE2s (auth-sanitizer-0.2.3.gem) = 0bdc8f1f8972ac6063f44ada9f62f921df5c2be6bd6ca8495a60bdd634911322
-SHA512 (auth-sanitizer-0.2.3.gem) = 67d0411b7e418845c238025e988a79e2ec9fedbd37330e0f8dd862d62c139a8a314d6a4a647e4fb30b49ae18486d5781978331cf8420903a82b13a699059ec02
-Size (auth-sanitizer-0.2.3.gem) = 44544 bytes
+BLAKE2s (auth-sanitizer-0.2.5.gem) = d5d64d3209b7f9ea613394cf668d639403523f853f8421cba5d045e8ecc8e463
+SHA512 (auth-sanitizer-0.2.5.gem) = 48a7b7985fa43afd89ab9130bd84c71bbe7c48f2444e20300665fe2d912a0a1b1c094d435dd318d7f07b9ece1fca05db0abd3ca959d3f16a1d3dba6bbc3b4e0e
+Size (auth-sanitizer-0.2.5.gem) = 33792 bytes