security/zoneminder: Update to 1.38.4
Upstream NEWS, less bugfixes and minor improvements:
# ZoneMinder 1.38.4 Release Notes
This is a maintenance release for the 1.38 series: API/web authorization
fixes, memory-safety and injection hardening, recording correctness fixes,
and UI fixes.
sysutils/disko: import package
Not just where your space went, but when and why.
du and dust tell you what is large now. df tells you a disk is 82% full.
Neither answers the question you actually have at 2am, 'My disk was fine two
days ago. What happened?'
disko records a snapshot every time it scans, so it can tell you.
sysutils/claptrap: import package
Claptrap is a tool that allows you to parse complex command line arguments in
shell scripts using a declarative specification.
expat: update to 2.8.3.
Release 2.8.3 Mon August 10 2026
Security fixes:
#1296 CVE-2026-72522 -- Fix an out-of-bounds read and the resulting
infinite loop caused by treating low surrogates (Unicode)
the same as high surrogates in functions *_toUtf16.
Needs Expat compiled with 16bit character support
(e.g. with Firefox and/or on Windows) to be affected.
Upstream CVSS 3.1 vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5)
(Note the "AV:N" for network/remote, the "AV:L" in NVD by
Mitre is mistaken.)
Original bug report from Mozilla at:
https://bugzilla.mozilla.org/show_bug.cgi?id=2053153
Bug fixes:
#1297 #1300 lib: Fix support for 2+ GiB documents (regression from 2.8.2)
#1286 lib: Reject empty version in the XML declaration
[34 lines not shown]
graphics/ruby-mini-magick: update to 5.3.3
5.3.3 (2026-08-06)
* Restored support for passing an IO object such as StringIO as :stdin to
MiniMagick::Tool#call, which got broken in 5.3.2 when Open3.capture3 was
replaced with Open3.popen3 for manual timeouts.
graphics/ruby-RMagick: update to 7.1.1
7.1.1 (2026-08-06)
Bug Fixes
* Fix Strings being recycled while the C pointers into them are in use by
@Watson1978 in #1847
finance/ruby-braintree: update to 4.40.0
4.40.0 (2026-08-05)
* Add EmailFormatIsInvalid (92963) and EmailIsTooLong (92964) validation
error codes to PayPalAccount
* Add network to three_d_secure_pass_thru across Transaction.sale,
CreditCard, Customer, PaymentMethod, and CreditCardVerification, with
ThreeDSecurePassThru::Network constants (Eftpos, Mastercard, Visa)
* Fix path traversal vulnerability in Dispute and Address gateways by
validating that IDs used in request paths do not contain path separators
or relative-path segments
devel/ruby-simplecov: update to 1.1.0
1.1.0 (2026-08-10)
What's Changed
* Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #1243
* Bump ruby/setup-ruby from 1.318.0 to 1.320.0 by @dependabot[bot] in #1242
* Improve collate performance by @danielwestendorf in #1244
* Bump ruby/setup-ruby from 1.320.0 to 1.321.0 by @dependabot[bot] in #1247
* Make the HTML report a single self-contained index.html by @sferik in
#1245
* Cut unloaded-file injection cost, fix 100% coverage in merged reports by
@sferik in #1252
* Stop matching the :nocov: regex twice on every classified line by
@andriytyurnikov in #1253
* Absorb resultsets into one accumulator instead of folding pairwise by
@andriytyurnikov in #1254
* Inject unloaded files once at the merge point, not once per process by
[12 lines not shown]
