www/ruby-sass-embedded: 1.108.1
1.105.1 (2026-09-29)
* Add Sass::Value#to_h (#422)
* Add Sass::Value#to_s and Sass::Value#inspect (#423)
* Add Sass::Value::String#+ and Sass::Value::String#to_str (#424)
* Bump sass from 1.105.0 to 1.105.1 in /ext/sass (#425)
1.105.2 (2026-10-16)
* Bump sass from 1.105.1 to 1.105.2 in /ext/sass (#427)
1.106.0 (2026-10-21)
* Use Array#pack for LEB128 on Ruby 4.1 (#428)
* Bump sass from 1.105.2 to 1.106.0 in /ext/sass (#429)
1.106.1 (2026-10-21)
[20 lines not shown]
www/ruby-rails-html-sanitizer: update to 1.7.2
1.7.2 (2026-11-02)
* Deciding whether an SVG href or xlink:href is a local reference no longer
takes quadratic time.
PermitScrubber matched the attribute value against a pattern that
rescanned the value's whitespace run from every line start, so an
all-whitespace value took seconds to scrub. Only Ruby 3.1 and earlier are
affected, because Ruby 3.2 introduced linear-time regexp matching.
Through PermitScrubber, applications are only affected if the allowed tags
are overridden to include an SVG reference element such as use; the
default configuration is not affected.
This change addresses GHSA-cpgf-5mjf-73p7. PermitScrubber now applies the
html5lib attribute value rules by calling
Loofah::HTML5::Scrub.scrub_attribute_value rather than carrying its own
copy. The minimum Loofah dependency is now ~> 2.25, >= 2.25.3.
[24 lines not shown]
www/ruby-patron: update to 1.1.0
0.14.0 (2026-10-27)
* Expose libcurl's transfer timings (name lookup, connect, TLS, first byte,
total) as Response#timings
* Add ssl_cert, ssl_cert_type, ssl_key and ssl_key_password for presenting a
client certificate (mutual TLS). Thanks @lenage for the original
contribution in #165
* Raise Patron::ClientCertificateError when the client certificate or its
key can't be used
* Accept a Pathname for cacert
* Fix a request whose options fail to apply (for example an option of the
wrong type) leaking its headers and open files into the next request on
the same Session
[39 lines not shown]
www/ruby-mechanize: update to 2.14.2
2.14.2 (2026-10-26)
Security
* A malicious server can no longer make Mechanize::FileSaver, or
Mechanize::DirectorySaver with decode_filename: true, write files outside
the save directory. Only applications that register one of these as a
pluggable parser are affected. GHSA-hxgc-9476-fc65
Improved
* The gem no longer packages the test suite, the test certificates, or the
example scripts, which makes it about a third smaller. It still packages
test/htdocs/, which Mechanize::TestCase needs. (#667) @yuri-zubov
* Mechanize::TestCase fake responses work with net-http 0.10.0 and later,
which reads response lines with Net::BufferedIO#readuntil. Previously a
[4 lines not shown]
www/php-nextcloud: Update to 34.0.5
Tested on netbsd-10 amd64 with php84.
This (confusingly) also called "Nextcloud Hub 26 Spring".
Upstream tarballs lack NEWS, and NEWS-ish content is mostly at
https://nextcloud.com/blog/nextcloud-hub26-spring/
- Euro-Office available
- lots of improvements and fixes
www/ruby-loofah: update to 2.25.3
2.25.3 (2026-11-01)
Security
* Ensure Loofah::HTML5::Scrub.allowed_uri? rejects schemes split by a
numeric character reference without a semicolon that ends at a character
allowed_uri? strips (e.g. javascript: alert(1)) or at another
character reference (e.g. javascript:alert(1)). Character
references are now decoded before anything is stripped, as browsers do.
See GHSA-p9wj-w8xq-vjx6. @flavorjones
* Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes the named character
reference /, which CGI.unescapeHTML does not decode and browsers read
as /, and rejects data: URIs that disguise a disallowed mediatype with it
(e.g. data:text/html,<script>alert(1)</script>). Previously that
mediatype was treated as malformed and fell back to the allowed
text/plain. Only v2.25.2 is affected. See GHSA-jcff-cj73-4w4f.
[66 lines not shown]
Add pkg-config file for upcoming math/bitwuzla import.
Note that symfpu.pc doesn't have the "Libs" line because
-lsymfpu doesn't work on symfpu.a and math/bitwuzla needs
only headers.
www/ruby-jekyll-seo-tag: update to 2.9.1
2.9.1 (2026-09-29)
Security
* Escape all metadata attribute outputs, and make the JSON-LD block safe
inside its script tag (GHSA-572m-7cg5-6j5r)
www/ruby-jekyll-feed: update to 0.18.0
0.18.0 (2026-09-29)
Security
* Escape xml:lang values and CDATA terminators in the feed
(GHSA-3gx8-pqcm-38hw, #396)
Development Fixes
* Upgrade to Rake 13 to fix master (#381)
* feat(CI): Add Ruby 3.2/3.3 to the test matrix (#402)
* Fix style offenses (#414)
Documentation
* Fix typos in Readme (#384)
[3 lines not shown]
