head 1.7; access; symbols pkgsrc-2026Q2:1.6.0.2 pkgsrc-2026Q2-base:1.6 pkgsrc-2026Q1:1.5.0.4 pkgsrc-2026Q1-base:1.5 pkgsrc-2025Q4:1.5.0.2 pkgsrc-2025Q4-base:1.5 pkgsrc-2025Q3:1.3.0.2 pkgsrc-2025Q3-base:1.3 pkgsrc-2025Q2:1.2.0.4 pkgsrc-2025Q2-base:1.2 pkgsrc-2025Q1:1.2.0.2 pkgsrc-2025Q1-base:1.2; locks; strict; comment @# @; 1.7 date 2026.07.30.15.23.11; author taca; state Exp; branches; next 1.6; commitid D6yclerJnvDoTGPG; 1.6 date 2026.03.29.14.23.51; author taca; state Exp; branches; next 1.5; commitid GdlaYMrkDvI6wSzG; 1.5 date 2025.11.03.08.51.48; author taca; state Exp; branches 1.5.4.1; next 1.4; commitid 4EV3oTYJkYSan5hG; 1.4 date 2025.09.23.04.20.53; author taca; state Exp; branches; next 1.3; commitid eABIKxGnv710cNbG; 1.3 date 2025.08.14.15.25.07; author taca; state Exp; branches; next 1.2; commitid E4UQOMSWVtxz9I6G; 1.2 date 2025.03.16.15.33.56; author taca; state Exp; branches; next 1.1; commitid aWF1MwoAD0ox3jNF; 1.1 date 2025.01.02.07.16.46; author taca; state Exp; branches; next ; commitid nYXS0QjvWeNrESDF; 1.5.4.1 date 2026.03.31.13.37.47; author maya; state Exp; branches; next ; commitid Xqfm4HcoSdOoc8AG; desc @@ 1.7 log @www/ruby-rails80: update to 8.0.5.1 Ruby on Rails 8.0.5.1 (2026-07-29) Active Storage * A possible arbitrary file read and remote code execution in Active Storage variant processing (CVE-2026-66066) @ text @$NetBSD: distinfo,v 1.6 2026/03/29 14:23:51 taca Exp $ BLAKE2s (actionmailer-8.0.5.1.gem) = 088708b09bd49c09d1cab025e17a5fa4d374565ce882f481e1a8e9cbdf0f32ba SHA512 (actionmailer-8.0.5.1.gem) = 125d8fbc7d954a37e5e629ecb39ae075e8b0a93f94edacb99112d00cd1c05d4c0bacbbac00c14ba9666c16898dd449442fa87e79d92bd671b7fcd8b36c90e2e4 Size (actionmailer-8.0.5.1.gem) = 32256 bytes @ 1.6 log @www/ruby-rails80: update to 8.0.5 Ruby on Rails 8.0.4.1 (2026-03-23) Active Support * Reject scientific notation in NumberConverter [CVE-2026-33176] Jean Boussier * Fix SafeBuffer#% to preserve unsafe status [CVE-2026-33170] Jean Boussier * Improve performance of NumberToDelimitedConverter [CVE-2026-33169] Jean Boussier Action View * Skip blank attribute names in tag helpers to avoid generating invalid HTML. [CVE-2026-33168] Mike Dalessio Active Storage * Filter user supplied metadata in DirectUploadController [CVE-2026-33173] Jean Boussier * Configurable maxmimum streaming chunk size Makes sure that byte ranges for blobs don't exceed 100mb by default. Content ranges that are too big can result in denial of service. [CVE-2026-33174] Gannon McGibbon * Limit range requests to a single range [CVE-2026-33658] Jean Boussier * Prevent path traversal in DiskService. DiskService#path_for now raises an InvalidKeyError when passed keys with dot segments (".", ".."), or if the resolved path is outside the storage root directory. #path_for also now consistently raises InvalidKeyError if the key is invalid in any way, for example containing null bytes or having an incompatible encoding. Previously, the exception raised may have been ArgumentError or Encoding::CompatibilityError. DiskController now explicitly rescues InvalidKeyError with appropriate HTTP status codes. [CVE-2026-33195] Mike Dalessio * Prevent glob injection in DiskService#delete_prefixed. Escape glob metacharacters in the resolved path before passing to Dir.glob. Note that this change breaks any existing code that is relying on delete_prefixed to expand glob metacharacters. This change presumes that is unintended behavior (as other storage services do not respect these metacharacters). [CVE-2026-33202] Mike Dalessio Active Model Active Record Action Pack Active Job Action Mailer Action Cable Action Mailbox Action Text Railties * No change except version. 8.0.5 (2026-03-24) Changes are too many to write here, please refer: . @ text @d1 1 a1 1 $NetBSD: distinfo,v 1.5 2025/11/03 08:51:48 taca Exp $ d3 3 a5 3 BLAKE2s (actionmailer-8.0.5.gem) = 55fc24ca3647de4a19c98c7324efa4ae303cce2a313fd2d60efc3b8cc7923cd1 SHA512 (actionmailer-8.0.5.gem) = a50b7e40c0ac23956ade47a47d84d9d7723b4148fb2d6e78047ae4e4eb2cfbcaccf8f7e8e93ff1cff7c6349ecf02fb20819d01eaa1977044581fc04f93ccaa26 Size (actionmailer-8.0.5.gem) = 32256 bytes @ 1.5 log @www/ruby-rails80: update to 8.0.4 8.0.4 (2025-10-28) Active Support * Fix Enumerable#sole to return the full tuple instead of just the first element of the tuple. [Olivier Bellone] * Fix parallel tests hanging when worker processes die abruptly. Previously, if a worker process was killed (e.g., OOM killed, kill -9) during parallel test execution, the test suite would hang forever waiting for the dead worker. [Joshua Young] * Fix NameError when class_attribute is defined on instance singleton classes. Previously, calling class_attribute on an instance's singleton class would raise a NameError when accessing the attribute through the instance. object = MyClass.new object.singleton_class.class_attribute :foo, default: "bar" object.foo # previously raised NameError, now returns "bar" [Joshua Young] Active Record * Fix SQLite3 data loss during table alterations with CASCADE foreign keys. When altering a table in SQLite3 that is referenced by child tables with ON DELETE CASCADE foreign keys, ActiveRecord would silently delete all data from the child tables. This occurred because SQLite requires table recreation for schema changes, and during this process the original table is temporarily dropped, triggering CASCADE deletes on child tables. The root cause was incorrect ordering of operations. The original code wrapped disable_referential_integrity inside a transaction, but PRAGMA foreign_keys cannot be modified inside a transaction in SQLite - attempting to do so simply has no effect. This meant foreign keys remained enabled during table recreation, causing CASCADE deletes to fire. The fix reverses the order to follow the official SQLite 12-step ALTER TABLE procedure: disable_referential_integrity now wraps the transaction instead of being wrapped by it. This ensures foreign keys are properly disabled before the transaction starts and re-enabled after it commits, preventing CASCADE deletes while maintaining data integrity through atomic transactions. [Ruy Rocha] * Add support for bound SQL literals in CTEs. [Nicolas Bachschmidt] * Fix belongs_to associations not to clear the entire composite primary key. When clearing a belongs_to association that references a model with composite primary key, only the optional part of the key should be cleared. [zzak] * Fix invalid records being autosaved when distantly associated records are marked for deletion. [Ian Terrell, axlekb AB] Action View * Restore add_default_name_and_id method. [Hartley McGuire] Action Pack * Submit test requests using as: :html with Content-Type: x-www-form-urlencoded [Sean Doyle] Active Model Active Job Action Mailer Action Cable Active Storage Action Mailbox Action Text Railties * No changes. @ text @d1 1 a1 1 $NetBSD: distinfo,v 1.4 2025/09/23 04:20:53 taca Exp $ d3 3 a5 3 BLAKE2s (actionmailer-8.0.4.gem) = 533a7cb616e91adf704131631f3506bd8bf4a576a4d09bb82ac6a9cb942d7e1d SHA512 (actionmailer-8.0.4.gem) = 0c60d6df4819863d06bb22a163edef6ce12df42c82023af0daa897398c02dc8ab5678f8137694c7933673a7ac2facb1b6980b1297a59ffe7d16395301aad4907 Size (actionmailer-8.0.4.gem) = 32256 bytes @ 1.5.4.1 log @Pullup ticket #7062 - requested by taca databases/ruby-activerecord80: Security fix devel/ruby-activejob80: Security fix devel/ruby-activemodel80: Security fix devel/ruby-activestorage80: Security fix devel/ruby-activesupport80: Security fix devel/ruby-railties80: Security fix mail/ruby-actionmailbox80: Security fix mail/ruby-actionmailer80: Security fix textproc/ruby-actiontext80: Security fix www/ruby-actioncable80: Security fix www/ruby-actionpack80: Security fix www/ruby-actionview80: Security fix www/ruby-rails80: Security fix Revisions pulled up: - databases/ruby-activerecord80/distinfo 1.6 - devel/ruby-activejob80/distinfo 1.6 - devel/ruby-activemodel80/distinfo 1.6 - devel/ruby-activestorage80/distinfo 1.6 - devel/ruby-activesupport80/distinfo 1.6 - devel/ruby-railties80/Makefile 1.5 - devel/ruby-railties80/distinfo 1.6 - lang/ruby/rails.mk 1.189 - mail/ruby-actionmailbox80/distinfo 1.6 - mail/ruby-actionmailer80/distinfo 1.6 - textproc/ruby-actiontext80/distinfo 1.6 - www/ruby-actioncable80/distinfo 1.6 - www/ruby-actionpack80/Makefile 1.6 - www/ruby-actionpack80/distinfo 1.6 - www/ruby-actionview80/distinfo 1.6 - www/ruby-rails80/distinfo 1.6 --- Module Name: pkgsrc Committed By: taca Date: Sun Mar 29 14:23:51 UTC 2026 Modified Files: pkgsrc/databases/ruby-activerecord80: distinfo pkgsrc/devel/ruby-activejob80: distinfo pkgsrc/devel/ruby-activemodel80: distinfo pkgsrc/devel/ruby-activestorage80: distinfo pkgsrc/devel/ruby-activesupport80: distinfo pkgsrc/devel/ruby-railties80: Makefile distinfo pkgsrc/mail/ruby-actionmailbox80: distinfo pkgsrc/mail/ruby-actionmailer80: distinfo pkgsrc/textproc/ruby-actiontext80: distinfo pkgsrc/www/ruby-actioncable80: distinfo pkgsrc/www/ruby-actionpack80: Makefile distinfo pkgsrc/www/ruby-actionview80: distinfo pkgsrc/www/ruby-rails80: distinfo Log Message: www/ruby-rails80: update to 8.0.5 Ruby on Rails 8.0.4.1 (2026-03-23) Active Support * Reject scientific notation in NumberConverter [CVE-2026-33176] Jean Boussier * Fix SafeBuffer#% to preserve unsafe status [CVE-2026-33170] Jean Boussier * Improve performance of NumberToDelimitedConverter [CVE-2026-33169] Jean Boussier Action View * Skip blank attribute names in tag helpers to avoid generating invalid HTML. [CVE-2026-33168] Mike Dalessio Active Storage * Filter user supplied metadata in DirectUploadController [CVE-2026-33173] Jean Boussier * Configurable maxmimum streaming chunk size Makes sure that byte ranges for blobs don't exceed 100mb by default. Content ranges that are too big can result in denial of service. [CVE-2026-33174] Gannon McGibbon * Limit range requests to a single range [CVE-2026-33658] Jean Boussier * Prevent path traversal in DiskService. DiskService#path_for now raises an InvalidKeyError when passed keys with dot segments (".", ".."), or if the resolved path is outside the storage root directory. #path_for also now consistently raises InvalidKeyError if the key is invalid in any way, for example containing null bytes or having an incompatible encoding. Previously, the exception raised may have been ArgumentError or Encoding::CompatibilityError. DiskController now explicitly rescues InvalidKeyError with appropriate HTTP status codes. [CVE-2026-33195] Mike Dalessio * Prevent glob injection in DiskService#delete_prefixed. Escape glob metacharacters in the resolved path before passing to Dir.glob. Note that this change breaks any existing code that is relying on delete_prefixed to expand glob metacharacters. This change presumes that is unintended behavior (as other storage services do not respect these metacharacters). [CVE-2026-33202] Mike Dalessio Active Model Active Record Action Pack Active Job Action Mailer Action Cable Action Mailbox Action Text Railties * No change except version. 8.0.5 (2026-03-24) Changes are too many to write here, please refer: . --- Module Name: pkgsrc Committed By: taca Date: Sun Mar 29 14:28:13 UTC 2026 Modified Files: pkgsrc/lang/ruby: rails.mk Log Message: lang/ruby: update rails80 to 8.0.5 Make sure to update rails80 to 8.0.5. @ text @d1 1 a1 1 $NetBSD$ d3 3 a5 3 BLAKE2s (actionmailer-8.0.5.gem) = 55fc24ca3647de4a19c98c7324efa4ae303cce2a313fd2d60efc3b8cc7923cd1 SHA512 (actionmailer-8.0.5.gem) = a50b7e40c0ac23956ade47a47d84d9d7723b4148fb2d6e78047ae4e4eb2cfbcaccf8f7e8e93ff1cff7c6349ecf02fb20819d01eaa1977044581fc04f93ccaa26 Size (actionmailer-8.0.5.gem) = 32256 bytes @ 1.4 log @devel/ruby-railties80: update to 8.0.3 8.0.3 (2025-09-22) Action Mailer * No changes. @ text @d1 1 a1 1 $NetBSD: distinfo,v 1.3 2025/08/14 15:25:07 taca Exp $ d3 3 a5 3 BLAKE2s (actionmailer-8.0.3.gem) = e5a47669a1afd439a0e94a9da31bd7305b8c6ac4d5f685278b6ea9e38aed429f SHA512 (actionmailer-8.0.3.gem) = 20e6e29537f146d1aa752405c55658a4d062197c00cc6ad2c072791e680544d27d025334fb6603f5377f80d423e56f8edac80326fde7032178216b93679124cc Size (actionmailer-8.0.3.gem) = 32256 bytes @ 1.3 log @www/ruby-rails80: update to 8.0.2.1 Ruby on Rails 8.0.2.1 (2025-08-13) Active Record * Call inspect on ids in RecordNotFound error [CVE-2025-55193] Gannon McGibbon, John Hawthorn Active Storage * Remove dangerous transformations [CVE-2025-24293] Zack Deveau @ text @d1 1 a1 1 $NetBSD: distinfo,v 1.2 2025/03/16 15:33:56 taca Exp $ d3 3 a5 3 BLAKE2s (actionmailer-8.0.2.1.gem) = ba43baa3b1396601c1250fa3756b61f9bc853876fe5611a941ca91b35793b633 SHA512 (actionmailer-8.0.2.1.gem) = a6c8fed24b3ba39c54c78f5527b5dfcb2a8ea75ec9df7cc17fdcf2ce4c8575f403b37ac403d5a3d0f37fdfbf6a4daf55877a9a09ea6a704f0f4e9d8bcaa41c03 Size (actionmailer-8.0.2.1.gem) = 32256 bytes @ 1.2 log @mail/ruby-actionmailer80: update to 8.0.2 8.0.2 (2025/03/12) No change except version. @ text @d1 1 a1 1 $NetBSD: distinfo,v 1.1 2025/01/02 07:16:46 taca Exp $ d3 3 a5 3 BLAKE2s (actionmailer-8.0.2.gem) = 6b6882a2b90e91cb596e70360197fff1e15e63df7b1f3b9512614bc6cf821969 SHA512 (actionmailer-8.0.2.gem) = 37f4a38f8a1d1cd580f4e3ce8d9056031d53e8b5303c51fb697ac56dcac3fcba4034d3018459d6118669c33ed58d9fe3614df771b043865bf14ac5ad62ff99db Size (actionmailer-8.0.2.gem) = 32256 bytes @ 1.1 log @mail/ruby-actionmailer80: add package version 8.0.1 Action Mailer -- Easy email delivery and testing Action Mailer is a framework for designing email service layers. These layers are used to consolidate code for sending out forgotten passwords, welcome wishes on signup, invoices for billing, and any other use case that requires a written notification to either a person or another system. Action Mailer is in essence a wrapper around Action Controller and the Mail gem. It provides a way to make emails using templates in the same way that Action Controller renders views using templates. Additionally, an Action Mailer class can be used to process incoming email, such as allowing a blog to accept new posts from an email (which could even have been sent from a phone). This is for Ruby on Rails 8.0. @ text @d1 1 a1 1 $NetBSD$ d3 3 a5 3 BLAKE2s (actionmailer-8.0.1.gem) = 054cb4459b0be7effd143640afe36913450422c8d5cfe3cc799b9e6e50df2c98 SHA512 (actionmailer-8.0.1.gem) = a45ccba2fd3cd3b437af7ac25f713e3470d7ac8fdb21638c4248ccbc02ab78eeadb1f312b32d7cac188695cd6e54b58edc4586bf0b16777c61eebafe54de7add Size (actionmailer-8.0.1.gem) = 32256 bytes @