head	1.2;
access;
symbols
	pkgsrc-2026Q2:1.1.0.4
	pkgsrc-2026Q2-base:1.1
	pkgsrc-2026Q1:1.1.0.2;
locks; strict;
comment	@# @;


1.2
date	2026.07.18.14.09.03;	author taca;	state dead;
branches;
next	1.1;
commitid	Uk975jzW613SR8OG;

1.1
date	2026.05.06.05.28.23;	author taca;	state Exp;
branches
	1.1.2.1;
next	;
commitid	GDUOM6Rmv0RIkIEG;

1.1.2.1
date	2026.05.06.05.28.23;	author bsiegert;	state dead;
branches;
next	1.1.2.2;
commitid	sY27BZHY7cVl1aFG;

1.1.2.2
date	2026.05.09.16.52.07;	author bsiegert;	state Exp;
branches;
next	;
commitid	sY27BZHY7cVl1aFG;


desc
@@


1.2
log
@lang/ruby33: update to 3.3.12

pkgsrc change: stop installing obsolete ChangeLog.

Note: erb's security problem was already fixed with ruby33-3.3.11nb2.


3.3.12 (2026-07-16)

What's Changed

This release includes the following security fixes.

* CVE-2026-41316: ERB @@_init deserialization guard bypass via def_module /
  def_method / def_class

This release updates the default gem erb to 4.0.3.1 and the bundled gem
net-imap to 0.4.25.  The net-imap update fixes CVE-2026-42245,
CVE-2026-42246, CVE-2026-42256, CVE-2026-42257, CVE-2026-42258,
CVE-2026-47240, CVE-2026-47241 and CVE-2026-47242.  Please see the release
notes of net-imap v0.4.24 and net-imap v0.4.25 for the details of these
fixes.
@
text
@$NetBSD: patch-lib_erb.rb,v 1.1 2026/05/06 05:28:23 taca Exp $

Update to erb 4.0.3.1 to fix CVE-2026-41316.

--- lib/erb.rb.orig	2026-03-26 00:05:04.000000000 +0000
+++ lib/erb.rb
@@@@ -463,6 +463,9 @@@@ class ERB
   #   erb.def_method(MyClass, 'render(arg1, arg2)', filename)
   #   print MyClass.new.render('foo', 123)
   def def_method(mod, methodname, fname='(ERB)')
+    unless @@_init.equal?(self.class.singleton_class)
+      raise ArgumentError, "not initialized"
+    end
     src = self.src.sub(/^(?!#|$)/) {"def #{methodname}\n"} << "\nend\n"
     mod.module_eval do
       eval(src, binding, fname, -1)
@


1.1
log
@lang/ruby33: update default gem erb to 4.0.3.1

Update default gem erb to 4.0.3.1 to fix security problem of CVE-2026-41316.

Bump PKGREVISION.
@
text
@d1 1
a1 1
$NetBSD$
@


1.1.2.1
log
@file patch-lib_erb.rb was added on branch pkgsrc-2026Q1 on 2026-05-09 16:52:07 +0000
@
text
@d1 16
@


1.1.2.2
log
@Pullup ticket #7105 - requested by taca
lang/ruby33: security fix

Revisions pulled up:
- lang/ruby/rubyversion.mk                                      1.322
- lang/ruby33/Makefile                                          1.11
- lang/ruby33/distinfo                                          1.17
- lang/ruby33/patches/patch-lib_erb.rb                          1.1
- lang/ruby33/patches/patch-lib_erb_version.rb                  1.1
- lang/ruby33/patches/patch-test_erb_test__erb.rb               1.1

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Wed May  6 05:28:23 UTC 2026

   Modified Files:
   	pkgsrc/lang/ruby: rubyversion.mk
   	pkgsrc/lang/ruby33: Makefile distinfo
   Added Files:
   	pkgsrc/lang/ruby33/patches: patch-lib_erb.rb patch-lib_erb_version.rb
   	    patch-test_erb_test__erb.rb

   Log Message:
   lang/ruby33: update default gem erb to 4.0.3.1

   Update default gem erb to 4.0.3.1 to fix security problem of CVE-2026-41316.

   Bump PKGREVISION.
@
text
@a0 16
$NetBSD: patch-lib_erb.rb,v 1.1 2026/05/06 05:28:23 taca Exp $

Update to erb 4.0.3.1 to fix CVE-2026-41316.

--- lib/erb.rb.orig	2026-03-26 00:05:04.000000000 +0000
+++ lib/erb.rb
@@@@ -463,6 +463,9 @@@@ class ERB
   #   erb.def_method(MyClass, 'render(arg1, arg2)', filename)
   #   print MyClass.new.render('foo', 123)
   def def_method(mod, methodname, fname='(ERB)')
+    unless @@_init.equal?(self.class.singleton_class)
+      raise ArgumentError, "not initialized"
+    end
     src = self.src.sub(/^(?!#|$)/) {"def #{methodname}\n"} << "\nend\n"
     mod.module_eval do
       eval(src, binding, fname, -1)
@