p5-SQL-Abstract: update to 2.000003.
2.000003 - 2026-11-06
- SECURITY, CVE-2026-121265: generate() (and so AUTOLOAD with
allow_autoload) also treats an arrayref in its hashref or arrayref
as one bind value. 2.000002 fixed only insert(), update() and
values(): generate('update t', { name => [ "(SELECT ...)" ] })
still gave UPDATE T SET name = (SELECT ...). \[ $sql, @bind ] is
literal SQL in generate() too; array_datatypes => 0 restores the
old behaviour.
- every module has a $VERSION, the same as SQL::Abstract
2.000002 - 2026-11-05
- SECURITY, CVE-2026-121265: array_datatypes is on by default, so an
arrayref as a column value in insert() or update() (and values())
is one bind value. Before, it was literal SQL and its first element
went into the SQL text: a JSON array or a repeated form field like
{ name => [ "x, is_admin = 1" ] } gave
UPDATE t SET name = x, is_admin = 1. Literal SQL is
[170 lines not shown]
qt6: update comment
qt6 needs recursive bumps for _every_ version change, not only major
versions, otherwise we see
/usr/pkg/qt6/lib/libQt6Svg.so.6: Undefined PLT symbol "_ZN14QObjectPrivateC2E16QtPrivate_6_11_2" (symnum = 958)
Pass a number of bpf_insn to npf_bpf_compile, this should fix kern/60975.
Contrary to what the PR says, it broke loudly only in -current
when I tightened checks in bpfjit_generate_code on July 5th, 2026.
In stable releases it reads past the end of allocations but it generates
valid jitted code.
Why it works in stable releases:
- bpf_validate() checks that a rule ends with a valid RET and
that jumps don't jump past the last RET,
- bpfjit in stable releases doesn't check for a valid RET, it
relies on bpf_validate().
- bpfjit starts by (over)allocating a shadow bpfjit_insn array,
then scans (and goes past the end) instructions, builds CFG
and sets the "unreachable" flag in the shadow array. All
instructions after the last RET have unreachable set to true.
- bpfjit skips emitting any code when unreachable is true
[5 lines not shown]
Use proper naming for registering ether filtering hooks
get_etherpfil_head function name doesn't make sense in that context.
use register_etherpfil_hooks (plural) which registers one hook
(by calling the singular form (register_etherpfil_hook)
per interface at the ether layer.
No functional change intended
Thanks Edgar Fub
www/ruby-rack-test: update to 2.3.0
2.3.0 (2026-10-21)
Bug fixes:
* Do not mutate arguments given to Rack::Utils.build_multipart (Oskar
Eichler #361)
* Rewind tempfile if there are errors when appending in
UploadedFile#append_to (Oskar Eichler #363)
* Preserve request method and params for 308 redirects (requires Rack 2+)
(Oskar Eichler #364)
* Reuse rack.input in 307/308 redirect request if it is rewindable, fixing
cases that use application/json and other content types (Oskar Eichler
#367)
[8 lines not shown]
www/ruby-rack2: update to 2.2.25
2.2.25 (2026-10-30)
Security
* GHSA-5v64-555j-wjxm Multipart parser retains parsed data in its scan
buffer, allowing denial of service via memory exhaustion.
* GHSA-wvg4-6p58-3gh3 Rack::Static header rules were matched against an
unnormalized path, allowing dot segments to bypass them.
* GHSA-p8x9-v4hv-2w4g Multipart requests with more than one boundary
parameter were accepted when the first value was empty or began with a
quote, semicolon, or comma, bypassing the guard added for CVE-2026-26961.
Fixed
* Multipart parser: scan boundary lines with a literal newline search
[3 lines not shown]
www/ruby-rack: update to 3.2.8
3.2.8 (2026-10-30)
Security
* GHSA-5v64-555j-wjxm Multipart parser retains parsed data in its scan
buffer, allowing denial of service via memory exhaustion.
* GHSA-wvg4-6p58-3gh3 Rack::Static header rules were matched against an
unnormalized path, allowing dot segments to bypass them.
* GHSA-2j8w-xcrc-x985 Rack::Request#host_with_port, #base_url, and #url
returned the raw authority when it was invalid; host_with_port now returns
nil in that case.
* GHSA-p8x9-v4hv-2w4g Multipart requests with more than one boundary
parameter were accepted when the first value was empty or began with a
quote, semicolon, or comma, bypassing the guard added for CVE-2026-26961.
[6 lines not shown]
www/ruby-httpclient: update to 2.10.0
2.10.0 (2026-10-31)
* Refresh the bundled Mozilla CA certificates to the October 20, 2026
snapshot, building on #444 (#482)
* With peer verification enabled and no custom verification callback, reject
TLS connections when a server supplies certificates containing blocked
eMudhra intermediate CA public keys, including cross-signed variants
(#480, #481) Connections are also rejected when a server supplies an
unused certificate containing a blocked public key. VERIFY_NONE/nil
disables this check; a custom verification callback replaces the default
policy and is responsible for certificate validation.
* Report Java socket read timeouts on JRuby as
HTTPClient::ReceiveTimeoutError (#486)
* Add JRuby CI coverage (#486)
[7 lines not shown]
www/ruby-html-proofer: update to 5.2.3
5.2.3 (2026-10-16)
Bug Fixes
* Add ruby-json 3 support (de14af9)
Miscellaneous Chores
* reporter: Escape colons in swapped test URLs (#879)
* reporter: Avoid live external URLs (#879)
* Prefix Dependabot commits with a Conventional Commits type (#880)
* Lint PR titles for Conventional Commits (#880)
* Run release prep on every push to main (#880)
www/ruby-faraday-net_http: update to 3.5.0
3.5.0 (2026-10-11)
!! This release contains changes to errors raised !!
Please note: when responses cannot be correctly deflated, a
Faraday::ConnectionFailed error will be raised instead of raw Zlib::* errors
as before. This have been considered a bug rather than a breaking change,
and therefore included in the minor version bump.
What's Changed
* Bump actions/checkout from 6 to 7 by @dependabot[bot] in #58
* Add SOCKS proxy support by @iMacTia in #64
* Handle quoted and case-insensitive charset parameters by @OskarEichler in
#59
* Wrap deflate data and dictionary errors as connection failures by
@OskarEichler in #60
[8 lines not shown]
