head 1.7; access; symbols pkgsrc-2026Q2:1.6.0.2 pkgsrc-2026Q2-base:1.6 pkgsrc-2026Q1:1.5.0.4 pkgsrc-2026Q1-base:1.5 pkgsrc-2025Q4:1.5.0.2 pkgsrc-2025Q4-base:1.5 pkgsrc-2025Q3:1.3.0.2 pkgsrc-2025Q3-base:1.3 pkgsrc-2025Q2:1.2.0.4 pkgsrc-2025Q2-base:1.2 pkgsrc-2025Q1:1.2.0.2 pkgsrc-2025Q1-base:1.2; locks; strict; comment @# @; 1.7 date 2026.07.30.15.23.11; author taca; state Exp; branches; next 1.6; commitid D6yclerJnvDoTGPG; 1.6 date 2026.03.29.14.23.51; author taca; state Exp; branches; next 1.5; commitid GdlaYMrkDvI6wSzG; 1.5 date 2025.11.03.08.51.48; author taca; state Exp; branches 1.5.4.1; next 1.4; commitid 4EV3oTYJkYSan5hG; 1.4 date 2025.09.23.04.20.27; author taca; state Exp; branches; next 1.3; commitid Pk87RO7RBbmQbNbG; 1.3 date 2025.08.14.15.25.07; author taca; state Exp; branches; next 1.2; commitid E4UQOMSWVtxz9I6G; 1.2 date 2025.03.16.15.33.07; author taca; state Exp; branches; next 1.1; commitid R2oxfNBj1dZf3jNF; 1.1 date 2025.01.02.07.15.19; author taca; state Exp; branches; next ; commitid l9jhP3EIR8bXDSDF; 1.5.4.1 date 2026.03.31.13.37.46; author maya; state Exp; branches; next ; commitid Xqfm4HcoSdOoc8AG; desc @@ 1.7 log @www/ruby-rails80: update to 8.0.5.1 Ruby on Rails 8.0.5.1 (2026-07-29) Active Storage * A possible arbitrary file read and remote code execution in Active Storage variant processing (CVE-2026-66066) @ text @$NetBSD: distinfo,v 1.6 2026/03/29 14:23:51 taca Exp $ BLAKE2s (activestorage-8.0.5.1.gem) = f7a423e5d1a1445d53f9e599c5910c74331589d097a45c21a917e4b62dd2f9fe SHA512 (activestorage-8.0.5.1.gem) = 5d29e27b2b42cbbe4c00ec6d36187a20fd8a04bb5ddc5d509e5fcce9d30b11318175b2f2e94c6ff7a4ea53dee6e705cfc65abb65a2b76568cda1069e24185a29 Size (activestorage-8.0.5.1.gem) = 70144 bytes @ 1.6 log @www/ruby-rails80: update to 8.0.5 Ruby on Rails 8.0.4.1 (2026-03-23) Active Support * Reject scientific notation in NumberConverter [CVE-2026-33176] Jean Boussier * Fix SafeBuffer#% to preserve unsafe status [CVE-2026-33170] Jean Boussier * Improve performance of NumberToDelimitedConverter [CVE-2026-33169] Jean Boussier Action View * Skip blank attribute names in tag helpers to avoid generating invalid HTML. [CVE-2026-33168] Mike Dalessio Active Storage * Filter user supplied metadata in DirectUploadController [CVE-2026-33173] Jean Boussier * Configurable maxmimum streaming chunk size Makes sure that byte ranges for blobs don't exceed 100mb by default. Content ranges that are too big can result in denial of service. [CVE-2026-33174] Gannon McGibbon * Limit range requests to a single range [CVE-2026-33658] Jean Boussier * Prevent path traversal in DiskService. DiskService#path_for now raises an InvalidKeyError when passed keys with dot segments (".", ".."), or if the resolved path is outside the storage root directory. #path_for also now consistently raises InvalidKeyError if the key is invalid in any way, for example containing null bytes or having an incompatible encoding. Previously, the exception raised may have been ArgumentError or Encoding::CompatibilityError. DiskController now explicitly rescues InvalidKeyError with appropriate HTTP status codes. [CVE-2026-33195] Mike Dalessio * Prevent glob injection in DiskService#delete_prefixed. Escape glob metacharacters in the resolved path before passing to Dir.glob. Note that this change breaks any existing code that is relying on delete_prefixed to expand glob metacharacters. This change presumes that is unintended behavior (as other storage services do not respect these metacharacters). [CVE-2026-33202] Mike Dalessio Active Model Active Record Action Pack Active Job Action Mailer Action Cable Action Mailbox Action Text Railties * No change except version. 8.0.5 (2026-03-24) Changes are too many to write here, please refer: . @ text @d1 1 a1 1 $NetBSD: distinfo,v 1.5 2025/11/03 08:51:48 taca Exp $ d3 3 a5 3 BLAKE2s (activestorage-8.0.5.gem) = 9d2cda98ea45570ded55f78112a30a555db02e79cf6e59a936294954bed27215 SHA512 (activestorage-8.0.5.gem) = 5f5fe68707d9cff08d24b731ea7b098863f1ef9999aba3d6bfaa6b16b6ee5dba0ef7cd920761930695f24183dbf34c95ac7394f3c668811688da158d51975b70 Size (activestorage-8.0.5.gem) = 68608 bytes @ 1.5 log @www/ruby-rails80: update to 8.0.4 8.0.4 (2025-10-28) Active Support * Fix Enumerable#sole to return the full tuple instead of just the first element of the tuple. [Olivier Bellone] * Fix parallel tests hanging when worker processes die abruptly. Previously, if a worker process was killed (e.g., OOM killed, kill -9) during parallel test execution, the test suite would hang forever waiting for the dead worker. [Joshua Young] * Fix NameError when class_attribute is defined on instance singleton classes. Previously, calling class_attribute on an instance's singleton class would raise a NameError when accessing the attribute through the instance. object = MyClass.new object.singleton_class.class_attribute :foo, default: "bar" object.foo # previously raised NameError, now returns "bar" [Joshua Young] Active Record * Fix SQLite3 data loss during table alterations with CASCADE foreign keys. When altering a table in SQLite3 that is referenced by child tables with ON DELETE CASCADE foreign keys, ActiveRecord would silently delete all data from the child tables. This occurred because SQLite requires table recreation for schema changes, and during this process the original table is temporarily dropped, triggering CASCADE deletes on child tables. The root cause was incorrect ordering of operations. The original code wrapped disable_referential_integrity inside a transaction, but PRAGMA foreign_keys cannot be modified inside a transaction in SQLite - attempting to do so simply has no effect. This meant foreign keys remained enabled during table recreation, causing CASCADE deletes to fire. The fix reverses the order to follow the official SQLite 12-step ALTER TABLE procedure: disable_referential_integrity now wraps the transaction instead of being wrapped by it. This ensures foreign keys are properly disabled before the transaction starts and re-enabled after it commits, preventing CASCADE deletes while maintaining data integrity through atomic transactions. [Ruy Rocha] * Add support for bound SQL literals in CTEs. [Nicolas Bachschmidt] * Fix belongs_to associations not to clear the entire composite primary key. When clearing a belongs_to association that references a model with composite primary key, only the optional part of the key should be cleared. [zzak] * Fix invalid records being autosaved when distantly associated records are marked for deletion. [Ian Terrell, axlekb AB] Action View * Restore add_default_name_and_id method. [Hartley McGuire] Action Pack * Submit test requests using as: :html with Content-Type: x-www-form-urlencoded [Sean Doyle] Active Model Active Job Action Mailer Action Cable Active Storage Action Mailbox Action Text Railties * No changes. @ text @d1 1 a1 1 $NetBSD: distinfo,v 1.4 2025/09/23 04:20:27 taca Exp $ d3 3 a5 3 BLAKE2s (activestorage-8.0.4.gem) = 1dbfd60f1093638b041338b16c860625013ccc5f66a796b4b661fee58c93385f SHA512 (activestorage-8.0.4.gem) = 624db3d6fc80ff4d2175be141d0206051ae2e88147c12ab0f19cde291aaa89aceb3c74e0d9ac0d0e403c177be3dc571a5094b08a41d8938426d86b0f2bdc9a5b Size (activestorage-8.0.4.gem) = 66560 bytes @ 1.5.4.1 log @Pullup ticket #7062 - requested by taca databases/ruby-activerecord80: Security fix devel/ruby-activejob80: Security fix devel/ruby-activemodel80: Security fix devel/ruby-activestorage80: Security fix devel/ruby-activesupport80: Security fix devel/ruby-railties80: Security fix mail/ruby-actionmailbox80: Security fix mail/ruby-actionmailer80: Security fix textproc/ruby-actiontext80: Security fix www/ruby-actioncable80: Security fix www/ruby-actionpack80: Security fix www/ruby-actionview80: Security fix www/ruby-rails80: Security fix Revisions pulled up: - databases/ruby-activerecord80/distinfo 1.6 - devel/ruby-activejob80/distinfo 1.6 - devel/ruby-activemodel80/distinfo 1.6 - devel/ruby-activestorage80/distinfo 1.6 - devel/ruby-activesupport80/distinfo 1.6 - devel/ruby-railties80/Makefile 1.5 - devel/ruby-railties80/distinfo 1.6 - lang/ruby/rails.mk 1.189 - mail/ruby-actionmailbox80/distinfo 1.6 - mail/ruby-actionmailer80/distinfo 1.6 - textproc/ruby-actiontext80/distinfo 1.6 - www/ruby-actioncable80/distinfo 1.6 - www/ruby-actionpack80/Makefile 1.6 - www/ruby-actionpack80/distinfo 1.6 - www/ruby-actionview80/distinfo 1.6 - www/ruby-rails80/distinfo 1.6 --- Module Name: pkgsrc Committed By: taca Date: Sun Mar 29 14:23:51 UTC 2026 Modified Files: pkgsrc/databases/ruby-activerecord80: distinfo pkgsrc/devel/ruby-activejob80: distinfo pkgsrc/devel/ruby-activemodel80: distinfo pkgsrc/devel/ruby-activestorage80: distinfo pkgsrc/devel/ruby-activesupport80: distinfo pkgsrc/devel/ruby-railties80: Makefile distinfo pkgsrc/mail/ruby-actionmailbox80: distinfo pkgsrc/mail/ruby-actionmailer80: distinfo pkgsrc/textproc/ruby-actiontext80: distinfo pkgsrc/www/ruby-actioncable80: distinfo pkgsrc/www/ruby-actionpack80: Makefile distinfo pkgsrc/www/ruby-actionview80: distinfo pkgsrc/www/ruby-rails80: distinfo Log Message: www/ruby-rails80: update to 8.0.5 Ruby on Rails 8.0.4.1 (2026-03-23) Active Support * Reject scientific notation in NumberConverter [CVE-2026-33176] Jean Boussier * Fix SafeBuffer#% to preserve unsafe status [CVE-2026-33170] Jean Boussier * Improve performance of NumberToDelimitedConverter [CVE-2026-33169] Jean Boussier Action View * Skip blank attribute names in tag helpers to avoid generating invalid HTML. [CVE-2026-33168] Mike Dalessio Active Storage * Filter user supplied metadata in DirectUploadController [CVE-2026-33173] Jean Boussier * Configurable maxmimum streaming chunk size Makes sure that byte ranges for blobs don't exceed 100mb by default. Content ranges that are too big can result in denial of service. [CVE-2026-33174] Gannon McGibbon * Limit range requests to a single range [CVE-2026-33658] Jean Boussier * Prevent path traversal in DiskService. DiskService#path_for now raises an InvalidKeyError when passed keys with dot segments (".", ".."), or if the resolved path is outside the storage root directory. #path_for also now consistently raises InvalidKeyError if the key is invalid in any way, for example containing null bytes or having an incompatible encoding. Previously, the exception raised may have been ArgumentError or Encoding::CompatibilityError. DiskController now explicitly rescues InvalidKeyError with appropriate HTTP status codes. [CVE-2026-33195] Mike Dalessio * Prevent glob injection in DiskService#delete_prefixed. Escape glob metacharacters in the resolved path before passing to Dir.glob. Note that this change breaks any existing code that is relying on delete_prefixed to expand glob metacharacters. This change presumes that is unintended behavior (as other storage services do not respect these metacharacters). [CVE-2026-33202] Mike Dalessio Active Model Active Record Action Pack Active Job Action Mailer Action Cable Action Mailbox Action Text Railties * No change except version. 8.0.5 (2026-03-24) Changes are too many to write here, please refer: . --- Module Name: pkgsrc Committed By: taca Date: Sun Mar 29 14:28:13 UTC 2026 Modified Files: pkgsrc/lang/ruby: rails.mk Log Message: lang/ruby: update rails80 to 8.0.5 Make sure to update rails80 to 8.0.5. @ text @d1 1 a1 1 $NetBSD$ d3 3 a5 3 BLAKE2s (activestorage-8.0.5.gem) = 9d2cda98ea45570ded55f78112a30a555db02e79cf6e59a936294954bed27215 SHA512 (activestorage-8.0.5.gem) = 5f5fe68707d9cff08d24b731ea7b098863f1ef9999aba3d6bfaa6b16b6ee5dba0ef7cd920761930695f24183dbf34c95ac7394f3c668811688da158d51975b70 Size (activestorage-8.0.5.gem) = 68608 bytes @ 1.4 log @devel/ruby-railties80: update to 8.0.3 8.0.3 (2025-09-22) Active Storage * Address deprecation of Aws::S3::Object#upload_stream in ActiveStorage::Service::S3Service. Joshua Young * Fix config.active_storage.touch_attachment_records to work with eager loading. fatkodima @ text @d1 1 a1 1 $NetBSD: distinfo,v 1.3 2025/08/14 15:25:07 taca Exp $ d3 3 a5 3 BLAKE2s (activestorage-8.0.3.gem) = a0adeba1ae20d97ebe1d7dab61f7d15b35a5ed6ae1278c59e0e86fe8fd94f96a SHA512 (activestorage-8.0.3.gem) = b3b8548b31e820ab6b1372276d9e04e8b3e6f3a7ced274c70fa8333f001d7fd81161dc25b69d73c15cee718bc0ba165543e1a79a7673821bd179625bdc0aaded Size (activestorage-8.0.3.gem) = 66560 bytes @ 1.3 log @www/ruby-rails80: update to 8.0.2.1 Ruby on Rails 8.0.2.1 (2025-08-13) Active Record * Call inspect on ids in RecordNotFound error [CVE-2025-55193] Gannon McGibbon, John Hawthorn Active Storage * Remove dangerous transformations [CVE-2025-24293] Zack Deveau @ text @d1 1 a1 1 $NetBSD: distinfo,v 1.2 2025/03/16 15:33:07 taca Exp $ d3 3 a5 3 BLAKE2s (activestorage-8.0.2.1.gem) = b0826da66fea5da1eef6b613eabc63ebbfc5edd68f7fa2c776b310d9ef3c4009 SHA512 (activestorage-8.0.2.1.gem) = 3d7e37b702495cd31ee0b50a8934d8b7b36b330d1f362fcac95958aa854a7355104b04d1f8ab95333ee65cd3d30b8adbc6df9e4d9ce49ddf1f49ec83a1bd93fc Size (activestorage-8.0.2.1.gem) = 65536 bytes @ 1.2 log @devel/ruby-activestorage80: update to 8.0.2 8.0.2 (2025/03/12) * A Blob will no longer autosave associated Attachment. This fixes an issue where a record with an attachment would have its dirty attributes reset, preventing your after commit callbacks on that record to behave as expected. Note that this change doesn't require any changes on your application and is supposed to be internal. Active Storage Attachment will continue to be autosaved (through a different relation). Edouard-chin @ text @d1 1 a1 1 $NetBSD: distinfo,v 1.1 2025/01/02 07:15:19 taca Exp $ d3 3 a5 3 BLAKE2s (activestorage-8.0.2.gem) = 0240b9020e2ab6eee9cdd61dc4d5c465e797c9b1719145338fa2b030b58834a5 SHA512 (activestorage-8.0.2.gem) = 1347b4331e9612d9731e5cf9477fa25ddb14af10766292b2b47b8b39337e5949c6943469f0811796fb964d3b3f1b2a0a65b7741e74b4e0c93a02b14da7d6d8dd Size (activestorage-8.0.2.gem) = 65536 bytes @ 1.1 log @devel/ruby-activestorage80: add package version 8.0.1 Active Storage Active Storage makes it simple to upload and reference files in cloud services like [Amazon S3](https://aws.amazon.com/s3/), [Google Cloud Storage](https://cloud.google.com/storage/docs/), or [Microsoft Azure Storage](https://azure.microsoft.com/en-us/services/storage/), and attach those files to Active Records. Supports having one main service and mirrors in other services for redundancy. It also provides a disk service for testing or local deployments, but the focus is on cloud storage. Files can be uploaded from the server to the cloud or directly from the client to the cloud. Image files can furthermore be transformed using on-demand variants for quality, aspect ratio, size, or any other [MiniMagick](https://github.com/minimagick/minimagick) or [Vips](https://www.rubydoc.info/gems/ruby-vips/Vips/Image) supported transformation. This is for Ruby on Rails 8.0. @ text @d1 1 a1 1 $NetBSD$ d3 3 a5 3 BLAKE2s (activestorage-8.0.1.gem) = 12cfbd09e0ce41cb4433d48ae0065cd025d73d54e1b5beefa268befca92ee469 SHA512 (activestorage-8.0.1.gem) = a6c0db453d2e7d00a0ae150099b91a85f9267ab96159fce9a797170aeab1f1dda69c61d578cd31e7e58f0a38e9767c04c77306781f0f4b809fe2936506030c1d Size (activestorage-8.0.1.gem) = 65024 bytes @