www/ruby-aws-sdk-core: update to 3.254.0
3.254.0 (2026-07-09)
* Feature - Serialize BigDecimal values as JSON numbers in document types
for REST-JSON and JSON protocols.
3.253.0 (2026-07-08)
* Feature - Updated Aws::Signin::Client with the latest API changes.
* Feature - Adds support for OAuth 2.0 token operations in AWS Sign-In,
CreateOAuth2TokenWithIAM (client credentials flow),
IntrospectOAuth2TokenWithIAM (token inspection), and
RevokeOAuth2TokenWithIAM (token revocation).
www/ruby-aws-partitions: update to 1.1271.0
1.1271.0 (2026-07-17)
* Feature - Updated the partitions source data that determines the AWS
service regions and endpoints.
1.1270.0 (2026-07-16)
* Feature - Updated the partitions source data that determines the AWS
service regions and endpoints.
1.1269.0 (2026-07-13)
* Feature - Updated the partitions source data that determines the AWS
service regions and endpoints.
1.1268.0 (2026-07-10)
[26 lines not shown]
textproc/ruby-yard: update to 0.9.45
0.9.45 (2026-07-14)
* Use @param types to document generated Struct.new and Data.define members
(#1684)
* Add compatibility with RDoc 8
* Fix TypesExplainer parsing of types following Hash collections (#1688)
* Fix HTML generation for RBS constants without source values (#1686)
* Fix method redefinition warnings when loading YARD with Ruby warnings
enabled (#1687)
* Improve sanitization of yard server request paths
textproc/ruby-tilt: update to 2.8.0
2.8.0 (2026-07-06)
* Support rdoc 8 in the rdoc template (jeremyevans)
* Support options added in recent Commonmarker versions in the Commonmarker
template (halo) (#26)
textproc/ruby-nori: update to 2.9.1
2.9.0 (2026-07-05)
Changed
* The :standards profile no longer applies schema-less typing. Under
Nori.new(standards: true), :advanced_typecasting now defaults to false (an
explicit advanced_typecasting: true still wins), and the bare
un-namespaced type= and nil= attributes become ordinary attributes instead
of casting instructions. No more type= conversions (integer, date,
decimal, array, file, ...), and only a prefixed xsi:nil="true" marks an
element nil. These conventions come from Rails' Hash.from_xml (inherited
via crack and merb), not from any XML spec. Without a schema, character
data is just text. Knowing that <id>123</id> holds an integer is the
business of a schema-aware layer, not a guess from string shape. Parsing
without the profile is completely unchanged.
Added
[40 lines not shown]
textproc/ruby-commonmarker: update to 2.9.0
2.9.0 (2026-07-14)
What's Changed
* Fix i686 with u32 parsing hack by @kivikakk in #471
* feat: Upgrade to comrak 0.54 with math_latex + alert_style options, and
changed header_ids by @gjtorikian in #472
* [skip test] Release v2.9.0 by @github-actions[bot] in #474
security/ruby-oauth: update to 1.1.8
1.1.8 (2026-07-15)
* TAG: v1.1.8
* COVERAGE: 69.47% -- 835/1202 lines in 42 files
* BRANCH COVERAGE: 47.75% -- 159/333 branches in 42 files
* 40.38% documented
Changed
* Raised the anonymous_loader runtime dependency floor to >= 0.1.1.
* Raised the auth-sanitizer runtime dependency floor to >= 0.2.2 and
switched isolated sanitizer loading to the released anonymous_loader gem,
including local workspace wiring for the new runtime dependency.
* Raised the oauth-tty runtime dependency floor to >= 1.0.11.
* Raised the anonymous_loader runtime dependency floor to >= 0.1.2.
* Retemplated generated project metadata, support documentation, CI
workflows, binstubs, and development dependency floors with kettle-jem
[19 lines not shown]
security/ruby-ssrf_filter: add version 1.5.0
This package is required by newer version of www/ruby-css-parser package.
ssrf_filter makes it easy to defend against server side request forgery
(SSRF) attacks. SSRF vulnerabilities happen when you accept URLs as user
input and fetch them on your server (for instance, when a user enters a link
into a Twitter/Facebook status update and a content preview is generated).
Users can pass in URLs or IPs such that your server will make requests to
the internal network. For example if you're hosted on AWS they can request
the instance metadata endpoint http://169.254.169.254/latest/meta-data/ and
get your IAM credentials.
Attempts to guard against this are often implemented incorrectly, by
blocking all ip addresses, not handling IPv6 or http redirects correctly, or
having TOCTTOU bugs and other issues.
[8 lines not shown]
